1 /* Kernel module to match TCP MSS values. */
3 /* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/module.h>
11 #include <linux/skbuff.h>
14 #include <linux/netfilter_ipv4/ipt_tcpmss.h>
15 #include <linux/netfilter_ipv4/ip_tables.h>
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
21 MODULE_DESCRIPTION("iptables TCP MSS match module");
23 /* Returns 1 if the mss option is set and matched by the range, 0 otherwise */
25 mssoption_match(u_int16_t min
, u_int16_t max
,
26 const struct sk_buff
*skb
,
30 struct tcphdr _tcph
, *th
;
31 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
32 u8 _opt
[15 * 4 - sizeof(_tcph
)], *op
;
33 unsigned int i
, optlen
;
35 /* If we don't have the whole header, drop packet. */
36 th
= skb_header_pointer(skb
, skb
->nh
.iph
->ihl
* 4,
37 sizeof(_tcph
), &_tcph
);
42 if (th
->doff
*4 < sizeof(*th
))
45 optlen
= th
->doff
*4 - sizeof(*th
);
49 /* Truncated options. */
50 op
= skb_header_pointer(skb
, skb
->nh
.iph
->ihl
* 4 + sizeof(*th
),
55 for (i
= 0; i
< optlen
; ) {
56 if (op
[i
] == TCPOPT_MSS
57 && (optlen
- i
) >= TCPOLEN_MSS
58 && op
[i
+1] == TCPOLEN_MSS
) {
61 mssval
= (op
[i
+2] << 8) | op
[i
+3];
63 return (mssval
>= min
&& mssval
<= max
) ^ invert
;
77 match(const struct sk_buff
*skb
,
78 const struct net_device
*in
,
79 const struct net_device
*out
,
80 const void *matchinfo
,
84 const struct ipt_tcpmss_match_info
*info
= matchinfo
;
86 return mssoption_match(info
->mss_min
, info
->mss_max
, skb
,
87 info
->invert
, hotdrop
);
91 checkentry(const char *tablename
,
92 const struct ipt_ip
*ip
,
94 unsigned int matchsize
,
95 unsigned int hook_mask
)
97 if (matchsize
!= IPT_ALIGN(sizeof(struct ipt_tcpmss_match_info
)))
100 /* Must specify -p tcp */
101 if (ip
->proto
!= IPPROTO_TCP
|| (ip
->invflags
& IPT_INV_PROTO
)) {
102 printk("tcpmss: Only works on TCP packets\n");
109 static struct ipt_match tcpmss_match
= {
112 .checkentry
= &checkentry
,
116 static int __init
init(void)
118 return ipt_register_match(&tcpmss_match
);
121 static void __exit
fini(void)
123 ipt_unregister_match(&tcpmss_match
);