git: 9839a5ad3a68 - stable/12 - ipfw: Have NAT steal the TH_RES1 bit, instead of the TH_AE bit
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 10 Nov 2022 07:46:58 UTC
The branch stable/12 has been updated by rscheff: URL: https://cgit.FreeBSD.org/src/commit/?id=9839a5ad3a683c3841ec00c9e1a4d551dcf9c1de commit 9839a5ad3a683c3841ec00c9e1a4d551dcf9c1de Author: Richard Scheffenegger <rscheff@FreeBSD.org> AuthorDate: 2022-11-09 09:54:34 +0000 Commit: Richard Scheffenegger <rscheff@FreeBSD.org> CommitDate: 2022-11-09 22:33:41 +0000 ipfw: Have NAT steal the TH_RES1 bit, instead of the TH_AE bit The NAT module use of the tcphdr.th_x2 field now collides with the use of this TCP header flag as AccECN (AE) bit. Use the topmost bit instead to allow negotiation of AccECN across a NAT device. Event: IETF 115 Hackathon Reviewed By: #transport, tuexen MFC after: 3 days Approved by: re (gjb, early-MFC) Sponsored by: NetApp, Inc. Differential Revision: https://reviews.freebsd.org/D37300 (cherry picked from commit 0b00b801493aa1d4996b0891ea58fbef343f85df) --- sys/netinet/libalias/alias_ftp.c | 2 +- sys/netinet/libalias/alias_irc.c | 2 +- sys/netinet/libalias/alias_proxy.c | 2 +- sys/netinet/libalias/alias_skinny.c | 6 +++--- sys/netinet/libalias/alias_smedia.c | 4 ++-- sys/netinet/tcp.h | 3 +++ sys/netpfil/ipfw/ip_fw_nat.c | 4 ++-- 7 files changed, 13 insertions(+), 10 deletions(-) diff --git a/sys/netinet/libalias/alias_ftp.c b/sys/netinet/libalias/alias_ftp.c index 962194ec0a68..b2fcfbf2396b 100644 --- a/sys/netinet/libalias/alias_ftp.c +++ b/sys/netinet/libalias/alias_ftp.c @@ -754,7 +754,7 @@ NewFtpMessage(struct libalias *la, struct ip *pip, /* Compute TCP checksum for revised packet */ tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif diff --git a/sys/netinet/libalias/alias_irc.c b/sys/netinet/libalias/alias_irc.c index 32e831742048..524b70b0632c 100644 --- a/sys/netinet/libalias/alias_irc.c +++ b/sys/netinet/libalias/alias_irc.c @@ -458,7 +458,7 @@ AliasHandleIrcOut(struct libalias *la, /* Compute TCP checksum for revised packet */ tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif diff --git a/sys/netinet/libalias/alias_proxy.c b/sys/netinet/libalias/alias_proxy.c index 9b75b22a74b3..7efab1fdc8db 100644 --- a/sys/netinet/libalias/alias_proxy.c +++ b/sys/netinet/libalias/alias_proxy.c @@ -368,7 +368,7 @@ ProxyEncodeTcpStream(struct alias_link *lnk, tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif diff --git a/sys/netinet/libalias/alias_skinny.c b/sys/netinet/libalias/alias_skinny.c index 31b33696fc20..2c664c2c58d9 100644 --- a/sys/netinet/libalias/alias_skinny.c +++ b/sys/netinet/libalias/alias_skinny.c @@ -216,7 +216,7 @@ alias_skinny_reg_msg(struct RegisterMessage *reg_msg, struct ip *pip, tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif @@ -259,7 +259,7 @@ alias_skinny_port_msg(struct IpPortMessage *port_msg, struct ip *pip, tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif @@ -291,7 +291,7 @@ alias_skinny_opnrcvch_ack(struct libalias *la, struct OpenReceiveChannelAck *opn tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif diff --git a/sys/netinet/libalias/alias_smedia.c b/sys/netinet/libalias/alias_smedia.c index 9b5a9d673ecf..c09c8e0c6d77 100644 --- a/sys/netinet/libalias/alias_smedia.c +++ b/sys/netinet/libalias/alias_smedia.c @@ -404,7 +404,7 @@ alias_rtsp_out(struct libalias *la, struct ip *pip, tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif @@ -451,7 +451,7 @@ alias_pna_out(struct libalias *la, struct ip *pip, /* Compute TCP checksum for revised packet */ tc->th_sum = 0; #ifdef _KERNEL - tc->th_x2 = 1; + tc->th_x2 = (TH_RES1 >> 8); #else tc->th_sum = TcpChecksum(pip); #endif diff --git a/sys/netinet/tcp.h b/sys/netinet/tcp.h index 21922eb4df2e..beb6ece82f35 100644 --- a/sys/netinet/tcp.h +++ b/sys/netinet/tcp.h @@ -72,6 +72,9 @@ struct tcphdr { #define TH_ECE 0x40 #define TH_CWR 0x80 #define TH_AE 0x100 /* maps into th_x2 */ +#define TH_RES3 0x200 +#define TH_RES2 0x400 +#define TH_RES1 0x800 #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_PUSH|TH_ACK|TH_URG|TH_ECE|TH_CWR) #define PRINT_TH_FLAGS "\20\1FIN\2SYN\3RST\4PUSH\5ACK\6URG\7ECE\10CWR\11AE" diff --git a/sys/netpfil/ipfw/ip_fw_nat.c b/sys/netpfil/ipfw/ip_fw_nat.c index 9e15e9addbe5..b75210246a00 100644 --- a/sys/netpfil/ipfw/ip_fw_nat.c +++ b/sys/netpfil/ipfw/ip_fw_nat.c @@ -416,7 +416,7 @@ ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m) struct tcphdr *th; th = (struct tcphdr *)(ip + 1); - if (th->th_x2) + if (th->th_x2 & (TH_RES1 >> 8)) ldt = 1; } @@ -436,7 +436,7 @@ ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m) * Maybe it was set in * libalias... */ - th->th_x2 = 0; + th->th_x2 &= ~(TH_RES1 >> 8); th->th_sum = cksum; mcl->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);