]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - net/netfilter/xt_TCPMSS.c
2 * This is a module which is used for setting the MSS option in TCP packets.
4 * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
14 #include <linux/ipv6.h>
15 #include <linux/tcp.h>
19 #include <linux/netfilter_ipv4/ip_tables.h>
20 #include <linux/netfilter_ipv6/ip6_tables.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter/xt_tcpudp.h>
23 #include <linux/netfilter/xt_TCPMSS.h>
25 MODULE_LICENSE("GPL");
26 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
27 MODULE_DESCRIPTION("x_tables TCP MSS modification module");
28 MODULE_ALIAS("ipt_TCPMSS");
29 MODULE_ALIAS("ip6t_TCPMSS");
31 static inline unsigned int
32 optlen(const u_int8_t
*opt
, unsigned int offset
)
34 /* Beware zero-length options: make finite progress */
35 if (opt
[offset
] <= TCPOPT_NOP
|| opt
[offset
+1] == 0)
42 tcpmss_mangle_packet(struct sk_buff
**pskb
,
43 const struct xt_tcpmss_info
*info
,
48 unsigned int tcplen
, i
;
53 if (!skb_make_writable(pskb
, (*pskb
)->len
))
56 tcplen
= (*pskb
)->len
- tcphoff
;
57 tcph
= (struct tcphdr
*)(skb_network_header(*pskb
) + tcphoff
);
59 /* Since it passed flags test in tcp match, we know it is is
60 not a fragment, and has data >= tcp header length. SYN
61 packets should not contain data: if they did, then we risk
62 running over MTU, sending Frag Needed and breaking things
64 if (tcplen
!= tcph
->doff
*4) {
66 printk(KERN_ERR
"xt_TCPMSS: bad length (%u bytes)\n",
71 if (info
->mss
== XT_TCPMSS_CLAMP_PMTU
) {
72 if (dst_mtu((*pskb
)->dst
) <= minlen
) {
74 printk(KERN_ERR
"xt_TCPMSS: "
75 "unknown or invalid path-MTU (%u)\n",
76 dst_mtu((*pskb
)->dst
));
79 newmss
= dst_mtu((*pskb
)->dst
) - minlen
;
83 opt
= (u_int8_t
*)tcph
;
84 for (i
= sizeof(struct tcphdr
); i
< tcph
->doff
*4; i
+= optlen(opt
, i
)) {
85 if (opt
[i
] == TCPOPT_MSS
&& tcph
->doff
*4 - i
>= TCPOLEN_MSS
&&
86 opt
[i
+1] == TCPOLEN_MSS
) {
89 oldmss
= (opt
[i
+2] << 8) | opt
[i
+3];
91 if (info
->mss
== XT_TCPMSS_CLAMP_PMTU
&&
95 opt
[i
+2] = (newmss
& 0xff00) >> 8;
96 opt
[i
+3] = newmss
& 0x00ff;
98 nf_proto_csum_replace2(&tcph
->check
, *pskb
,
99 htons(oldmss
), htons(newmss
), 0);
105 * MSS Option not found ?! add it..
107 if (skb_tailroom((*pskb
)) < TCPOLEN_MSS
) {
108 struct sk_buff
*newskb
;
110 newskb
= skb_copy_expand(*pskb
, skb_headroom(*pskb
),
111 TCPOLEN_MSS
, GFP_ATOMIC
);
116 tcph
= (struct tcphdr
*)(skb_network_header(*pskb
) + tcphoff
);
119 skb_put((*pskb
), TCPOLEN_MSS
);
121 opt
= (u_int8_t
*)tcph
+ sizeof(struct tcphdr
);
122 memmove(opt
+ TCPOLEN_MSS
, opt
, tcplen
- sizeof(struct tcphdr
));
124 nf_proto_csum_replace2(&tcph
->check
, *pskb
,
125 htons(tcplen
), htons(tcplen
+ TCPOLEN_MSS
), 1);
127 opt
[1] = TCPOLEN_MSS
;
128 opt
[2] = (newmss
& 0xff00) >> 8;
129 opt
[3] = newmss
& 0x00ff;
131 nf_proto_csum_replace4(&tcph
->check
, *pskb
, 0, *((__be32
*)opt
), 0);
133 oldval
= ((__be16
*)tcph
)[6];
134 tcph
->doff
+= TCPOLEN_MSS
/4;
135 nf_proto_csum_replace2(&tcph
->check
, *pskb
,
136 oldval
, ((__be16
*)tcph
)[6], 0);
141 xt_tcpmss_target4(struct sk_buff
**pskb
,
142 const struct net_device
*in
,
143 const struct net_device
*out
,
144 unsigned int hooknum
,
145 const struct xt_target
*target
,
146 const void *targinfo
)
148 struct iphdr
*iph
= ip_hdr(*pskb
);
152 ret
= tcpmss_mangle_packet(pskb
, targinfo
, iph
->ihl
* 4,
153 sizeof(*iph
) + sizeof(struct tcphdr
));
158 newlen
= htons(ntohs(iph
->tot_len
) + ret
);
159 nf_csum_replace2(&iph
->check
, iph
->tot_len
, newlen
);
160 iph
->tot_len
= newlen
;
165 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
167 xt_tcpmss_target6(struct sk_buff
**pskb
,
168 const struct net_device
*in
,
169 const struct net_device
*out
,
170 unsigned int hooknum
,
171 const struct xt_target
*target
,
172 const void *targinfo
)
174 struct ipv6hdr
*ipv6h
= ipv6_hdr(*pskb
);
179 nexthdr
= ipv6h
->nexthdr
;
180 tcphoff
= ipv6_skip_exthdr(*pskb
, sizeof(*ipv6h
), &nexthdr
);
185 ret
= tcpmss_mangle_packet(pskb
, targinfo
, tcphoff
,
186 sizeof(*ipv6h
) + sizeof(struct tcphdr
));
190 ipv6h
= ipv6_hdr(*pskb
);
191 ipv6h
->payload_len
= htons(ntohs(ipv6h
->payload_len
) + ret
);
199 /* Must specify -p tcp --syn */
200 static inline bool find_syn_match(const struct xt_entry_match
*m
)
202 const struct xt_tcp
*tcpinfo
= (const struct xt_tcp
*)m
->data
;
204 if (strcmp(m
->u
.kernel
.match
->name
, "tcp") == 0 &&
205 tcpinfo
->flg_cmp
& TH_SYN
&&
206 !(tcpinfo
->invflags
& XT_TCP_INV_FLAGS
))
213 xt_tcpmss_checkentry4(const char *tablename
,
215 const struct xt_target
*target
,
217 unsigned int hook_mask
)
219 const struct xt_tcpmss_info
*info
= targinfo
;
220 const struct ipt_entry
*e
= entry
;
222 if (info
->mss
== XT_TCPMSS_CLAMP_PMTU
&&
223 (hook_mask
& ~((1 << NF_IP_FORWARD
) |
224 (1 << NF_IP_LOCAL_OUT
) |
225 (1 << NF_IP_POST_ROUTING
))) != 0) {
226 printk("xt_TCPMSS: path-MTU clamping only supported in "
227 "FORWARD, OUTPUT and POSTROUTING hooks\n");
230 if (IPT_MATCH_ITERATE(e
, find_syn_match
))
232 printk("xt_TCPMSS: Only works on TCP SYN packets\n");
236 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
238 xt_tcpmss_checkentry6(const char *tablename
,
240 const struct xt_target
*target
,
242 unsigned int hook_mask
)
244 const struct xt_tcpmss_info
*info
= targinfo
;
245 const struct ip6t_entry
*e
= entry
;
247 if (info
->mss
== XT_TCPMSS_CLAMP_PMTU
&&
248 (hook_mask
& ~((1 << NF_IP6_FORWARD
) |
249 (1 << NF_IP6_LOCAL_OUT
) |
250 (1 << NF_IP6_POST_ROUTING
))) != 0) {
251 printk("xt_TCPMSS: path-MTU clamping only supported in "
252 "FORWARD, OUTPUT and POSTROUTING hooks\n");
255 if (IP6T_MATCH_ITERATE(e
, find_syn_match
))
257 printk("xt_TCPMSS: Only works on TCP SYN packets\n");
262 static struct xt_target xt_tcpmss_reg
[] __read_mostly
= {
266 .checkentry
= xt_tcpmss_checkentry4
,
267 .target
= xt_tcpmss_target4
,
268 .targetsize
= sizeof(struct xt_tcpmss_info
),
269 .proto
= IPPROTO_TCP
,
272 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
276 .checkentry
= xt_tcpmss_checkentry6
,
277 .target
= xt_tcpmss_target6
,
278 .targetsize
= sizeof(struct xt_tcpmss_info
),
279 .proto
= IPPROTO_TCP
,
285 static int __init
xt_tcpmss_init(void)
287 return xt_register_targets(xt_tcpmss_reg
, ARRAY_SIZE(xt_tcpmss_reg
));
290 static void __exit
xt_tcpmss_fini(void)
292 xt_unregister_targets(xt_tcpmss_reg
, ARRAY_SIZE(xt_tcpmss_reg
));
295 module_init(xt_tcpmss_init
);
296 module_exit(xt_tcpmss_fini
);