devip: do tcp mss clamping when forwarding packets

when forwarding packets (gating), unconditionally
check tcp-syn packets for the mss-size option and
reduce it to fit the mtu of the outgoing interface.

this is done by exporting a new tcpmssclamp() function
from ip/tcp.c  that takes an ip packet and its buffer size
and the effective mtu of the interface and adjusts
the mss value of tcp syn options.

this function is now also used by devbridge, enforcing
a tcp mss below the tunnel mtu.

5 files changed, 80 insertions, 6 deletions

diff --git a/sys/src/9/ip/ip.c b/sys/src/9/ip/ip.c
index de8b20a0d..89e6cf5a7 100644
--- a/sys/src/9/ip/ip.c
+++ b/sys/src/9/ip/ip.c
@@ -134,14 +134,16 @@ ipoput4(Fs *f, Block *bp, int gating, int ttl, int tos, Routehint *rh)
 	if(ifc->m == nil)
 		goto raise;
 
-	if(!gating){
+	medialen = ifc->maxtu - ifc->m->hsize;
+	if(gating)
+		tcpmssclamp((uchar*)eh, len, medialen);
+	else {
 		eh->vihl = IP_VER4|IP_HLEN4;
 		eh->tos = tos;
 	}
 	eh->ttl = ttl;
 
 	/* If we dont need to fragment just send it */
-	medialen = ifc->maxtu - ifc->m->hsize;
 	if(len <= medialen) {
 		hnputs(eh->length, len);
 		if(!gating){
diff --git a/sys/src/9/ip/ip.h b/sys/src/9/ip/ip.h
index ca77043cd..56d94d4cf 100644
--- a/sys/src/9/ip/ip.h
+++ b/sys/src/9/ip/ip.h
@@ -755,6 +755,11 @@ extern void	ip_init(Fs*);
 extern void	ip_init_6(Fs*);
 
 /*
+ *  tcp.c
+ */
+extern void	tcpmssclamp(uchar*, int, int);
+
+/*
  * bootp.c
  */
 extern int	bootpread(char*, ulong, int);
diff --git a/sys/src/9/ip/ipaux.c b/sys/src/9/ip/ipaux.c
index 50e4e6cc1..9f413ca0e 100644
--- a/sys/src/9/ip/ipaux.c
+++ b/sys/src/9/ip/ipaux.c
@@ -557,8 +557,11 @@ hnputs_csum(void *p, ushort v, uchar *pcsum)
 {
 	ulong csum;
 
-	assert((((uchar*)p - pcsum) & 1) == 0);
-
+	if(((uchar*)p - pcsum) & 1){
+		hnputs_csum((uchar*)p-1, (nhgets((uchar*)p-1) & 0xFF00) | v>>8, pcsum);
+		hnputs_csum((uchar*)p+1, (nhgets((uchar*)p+1) & 0x00FF) | v<<8, pcsum);
+		return;
+	}
 	csum = nhgets(pcsum)^0xFFFF;
 	csum += nhgets(p)^0xFFFF;
 	csum += v;
diff --git a/sys/src/9/ip/ipv6.c b/sys/src/9/ip/ipv6.c
index bfe652d47..c7045de89 100644
--- a/sys/src/9/ip/ipv6.c
+++ b/sys/src/9/ip/ipv6.c
@@ -88,7 +88,10 @@ ipoput6(Fs *f, Block *bp, int gating, int ttl, int tos, Routehint *rh)
 	if(ifc->m == nil)
 		goto raise;
 
-	if(!gating){
+	medialen = ifc->maxtu - ifc->m->hsize;
+	if(gating)
+		tcpmssclamp((uchar*)eh, len, medialen);
+	else {
 		eh->vcf[0] = IP_VER6;
 		eh->vcf[0] |= tos >> 4;
 		eh->vcf[1]  = tos << 4;
@@ -96,7 +99,6 @@ ipoput6(Fs *f, Block *bp, int gating, int ttl, int tos, Routehint *rh)
 	eh->ttl = ttl;
 
 	/* If we dont need to fragment just send it */
-	medialen = ifc->maxtu - ifc->m->hsize;
 	if(len <= medialen) {
 		hnputs(eh->ploadlen, len - IP6HDR);
 		ipifcoput(ifc, bp, V6, gate, rh);
diff --git a/sys/src/9/ip/tcp.c b/sys/src/9/ip/tcp.c
index d2a83a747..86105230c 100644
--- a/sys/src/9/ip/tcp.c
+++ b/sys/src/9/ip/tcp.c
@@ -3307,6 +3307,68 @@ tcpforward(Proto *tcp, Block *bp, Route *r)
 	return bp;
 }
 
+void
+tcpmssclamp(uchar *p, int n, int mtu)
+{
+	Tcp4hdr *h4;
+	Tcp6hdr *h6;
+	uchar *pcksum;
+	int hdrlen, optlen, newmss, oldmss;
+
+	if(n < TCP4_PKT)
+		return;
+	h4 = (Tcp4hdr*)p;
+	h6 = (Tcp6hdr*)p;
+	if((h4->vihl&0xF0)==IP_VER4) {
+		if(h4->proto != IP_TCPPROTO)
+			return;
+		if(!(h4->tcpflag[1] & SYN))
+			return;
+		hdrlen = (h4->tcpflag[0] >> 2) & ~3;
+		if(hdrlen > (n - TCP4_PKT))
+			return;
+		n = hdrlen - TCP4_HDRSIZE;
+		p = h4->tcpopt;
+		pcksum = h4->tcpcksum;
+		newmss = mtu - (TCP4_PKT + TCP4_HDRSIZE);
+	} else {
+		if(n < TCP6_PKT)
+			return;
+		if(h6->proto != IP_TCPPROTO)
+			return;
+		if(!(h6->tcpflag[1] & SYN))
+			return;
+		hdrlen = (h6->tcpflag[0] >> 2) & ~3;
+		if(hdrlen > (n - TCP6_PKT))
+			return;
+		n = hdrlen - TCP6_HDRSIZE;
+		p = h6->tcpopt;
+		pcksum = h6->tcpcksum;
+		newmss = mtu - (TCP6_PKT + TCP6_HDRSIZE);
+	}
+	while(n > 0 && *p != EOLOPT) {
+		if(*p == NOOPOPT) {
+			n--;
+			p++;
+			continue;
+		}
+		optlen = p[1];
+		if(optlen < 2 || optlen > n)
+			break;
+		if(*p == MSSOPT){
+			if(optlen != MSS_LENGTH)
+				break;
+			oldmss = nhgets(p+2);
+			if(newmss >= oldmss)
+				break;
+			hnputs_csum(p+2, newmss, pcksum);
+			break;
+		}
+		n -= optlen;
+		p += optlen;
+	}
+}
+
 static char*
 tcpporthogdefensectl(char *val)
 {