hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-22 03:04:34 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

netpfil: Use accessor functions and named constants for all tcphdr flags

Browse Source 
Update all remaining references to the struct tcphdr th_x2 field.
This completes the compatibilty of various aspects with AccECN
(TH_AE), after the internal ipfw "re-checksum required" was moved
to use the TH_RES1 flag.

No functional change.

Reviewed By:           tuexen, #transport, glebius
Sponsored by:          NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D43172
This commit is contained in:
Richard Scheffenegger 2023-12-25 12:26:25 +01:00
parent 358453ce9b
commit a8b70cf260
7 changed files with 29 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/dev/xen/netback/netback_unit_tests.c
View File

@ -35,6 +35,7 @@
*/
#include <sys/cdefs.h>
#include <netinet/tcp.h>
/**
* \file netback_unit_tests.c
*
@ -2311,9 +2312,8 @@ xnb_fill_tcp(struct mbuf *m)
tcp->th_dport = htons(2222);
tcp->th_seq = htonl(0x00f72b10);
tcp->th_ack = htonl(0x7f37ba6c);
tcp->th_x2 = 0;
tcp_set_flags(tcp, TH_ACK | TH_PUSH);
tcp->th_off = 8;
tcp->th_flags = 0x18;
tcp->th_win = htons(0x410);
/* th_sum is incorrect; will be inserted by function under test */
tcp->th_sum = htons(0xbaad);

10
sys/netgraph/ng_nat.c
View File

@ -862,9 +862,9 @@ ng_nat_rcvdata(hook_p hook, item_p item )
* doesn't have any idea about checksum offloading
* in kernel. To workaround this, we do not do
* checksumming in LibAlias, but only mark the
* packets in th_x2 field. If we receive a marked
* packet, we calculate correct checksum for it
* aware of offloading.
* packets with TH_RES1 in the th_x2 field. If we
* receive a marked packet, we calculate correct
* checksum for it aware of offloading.
*
* Why do I do such a terrible hack instead of
* recalculating checksum for each packet?
@ -875,10 +875,10 @@ ng_nat_rcvdata(hook_p hook, item_p item )
* has this problem, too.
*/
if (th->th_x2) {
if (tcp_get_flags(th) & TH_RES1) {
uint16_t ip_len = ntohs(ip->ip_len);
th->th_x2 = 0;
tcp_set_flags(th, tcp_get_flags(th) & ~TH_RES1);
th->th_sum = in_pseudo(ip->ip_src.s_addr,
ip->ip_dst.s_addr, htons(IPPROTO_TCP +
ip_len - (ip->ip_hl << 2)));

13
sys/netinet/tcp.h
View File

@ -79,6 +79,19 @@ struct tcphdr {
u_short th_urp; /* urgent pointer */
};
static inline uint16_t
tcp_get_flags(const struct tcphdr *th)
{
return (((uint16_t)th->th_x2 << 8) | th->th_flags);
}
static inline void
tcp_set_flags(struct tcphdr *th, uint16_t flags)
{
th->th_x2 = (flags >> 8) & 0x0f;
th->th_flags = flags & 0xff;
}
#define PADTCPOLEN(len) ((((len) / 4) + !!((len) % 4)) * 4)
#define TCPOPT_EOL 0

12
sys/netinet/tcp_var.h
View File

@ -1578,16 +1578,4 @@ tcp_fields_to_net(struct tcphdr *th)
}
#endif /* _KERNEL */
static inline uint16_t
tcp_get_flags(const struct tcphdr *th)
{
return (((uint16_t)th->th_x2 << 8) | th->th_flags);
}
static inline void
tcp_set_flags(struct tcphdr *th, uint16_t flags)
{
th->th_x2 = (flags >> 8) & 0x0f;
th->th_flags = flags & 0xff;
}
#endif /* _NETINET_TCP_VAR_H_ */

6
sys/netpfil/ipfilter/netinet/ip_compat.h
View File

@ -687,12 +687,6 @@ typedef struct tcpiphdr tcpiphdr_t;
#ifndef IP_HL_A
# define IP_HL_A(x,y) (x)->ip_hl = ((y) & 0xf)
#endif
#ifndef TCP_X2
# define TCP_X2(x) (x)->th_x2
#endif
#ifndef TCP_X2_A
# define TCP_X2_A(x,y) (x)->th_x2 = (y)
#endif
#ifndef TCP_OFF
# define TCP_OFF(x) (x)->th_off
#endif

7
sys/netpfil/ipfilter/netinet/ip_fil_freebsd.c
View File

@ -379,18 +379,17 @@ ipf_send_reset(fr_info_t *fin)
tcp2->th_sport = tcp->th_dport;
tcp2->th_dport = tcp->th_sport;
if (tcp->th_flags & TH_ACK) {
if (tcp_get_flags(tcp) & TH_ACK) {
tcp2->th_seq = tcp->th_ack;
tcp2->th_flags = TH_RST;
tcp_set_flags(tcp2, TH_RST);
tcp2->th_ack = 0;
} else {
tcp2->th_seq = 0;
tcp2->th_ack = ntohl(tcp->th_seq);
tcp2->th_ack += tlen;
tcp2->th_ack = htonl(tcp2->th_ack);
tcp2->th_flags = TH_RST|TH_ACK;
tcp_set_flags(tcp2, TH_RST|TH_ACK);
}
TCP_X2_A(tcp2, 0);
TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2);
tcp2->th_win = tcp->th_win;
tcp2->th_sum = 0;

11
sys/netpfil/pf/pf_norm.c
View File

@ -1376,7 +1376,7 @@ pf_normalize_tcp(struct pfi_kkif *kif, struct mbuf *m, int ipoff,
struct tcphdr *th = &pd->hdr.tcp;
int rewrite = 0;
u_short reason;
u_int8_t flags;
u_int16_t flags;
sa_family_t af = pd->af;
int srs;
@ -1434,7 +1434,7 @@ pf_normalize_tcp(struct pfi_kkif *kif, struct mbuf *m, int ipoff,
if (rm && rm->rule_flag & PFRULE_REASSEMBLE_TCP)
pd->flags |= PFDESC_TCP_NORM;
flags = th->th_flags;
flags = tcp_get_flags(th);
if (flags & TH_SYN) {
/* Illegal packet */
if (flags & TH_RST)
@ -1459,12 +1459,13 @@ pf_normalize_tcp(struct pfi_kkif *kif, struct mbuf *m, int ipoff,
goto tcp_drop;
/* If flags changed, or reserved data set, then adjust */
if (flags != th->th_flags || th->th_x2 != 0) {
if (flags != tcp_get_flags(th) ||
(tcp_get_flags(th) & (TH_RES1|TH_RES2|TH_RES2)) != 0) {
u_int16_t ov, nv;
ov = *(u_int16_t *)(&th->th_ack + 1);
th->th_flags = flags;
th->th_x2 = 0;
flags &= ~(TH_RES1 | TH_RES2 | TH_RES3);
tcp_set_flags(th, flags);
nv = *(u_int16_t *)(&th->th_ack + 1);
th->th_sum = pf_proto_cksum_fixup(m, th->th_sum, ov, nv, 0);