2 * This is a module which is used for setting the MSS option in TCP packets.
4 * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
17 #include <linux/netfilter_ipv4/ip_tables.h>
18 #include <linux/netfilter_ipv4/ipt_TCPMSS.h>
20 MODULE_LICENSE("GPL");
21 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
22 MODULE_DESCRIPTION("iptables TCP MSS modification module");
27 #define DEBUGP(format, args...)
31 cheat_check(u_int32_t oldvalinv
, u_int32_t newval
, u_int16_t oldcheck
)
33 u_int32_t diffs
[] = { oldvalinv
, newval
};
34 return csum_fold(csum_partial((char *)diffs
, sizeof(diffs
),
38 static inline unsigned int
39 optlen(const u_int8_t
*opt
, unsigned int offset
)
41 /* Beware zero-length options: make finite progress */
42 if (opt
[offset
] <= TCPOPT_NOP
|| opt
[offset
+1] == 0) return 1;
43 else return opt
[offset
+1];
47 ipt_tcpmss_target(struct sk_buff
**pskb
,
48 const struct net_device
*in
,
49 const struct net_device
*out
,
54 const struct ipt_tcpmss_info
*tcpmssinfo
= targinfo
;
57 u_int16_t tcplen
, newtotlen
, oldval
, newmss
;
61 if (!skb_make_writable(pskb
, (*pskb
)->len
))
64 if ((*pskb
)->ip_summed
== CHECKSUM_HW
&&
65 skb_checksum_help(*pskb
, out
== NULL
))
68 iph
= (*pskb
)->nh
.iph
;
69 tcplen
= (*pskb
)->len
- iph
->ihl
*4;
71 tcph
= (void *)iph
+ iph
->ihl
*4;
73 /* Since it passed flags test in tcp match, we know it is is
74 not a fragment, and has data >= tcp header length. SYN
75 packets should not contain data: if they did, then we risk
76 running over MTU, sending Frag Needed and breaking things
78 if (tcplen
!= tcph
->doff
*4) {
81 "ipt_tcpmss_target: bad length (%d bytes)\n",
86 if(tcpmssinfo
->mss
== IPT_TCPMSS_CLAMP_PMTU
) {
90 "ipt_tcpmss_target: no dst?! can't determine path-MTU\n");
91 return NF_DROP
; /* or IPT_CONTINUE ?? */
94 if(dst_mtu((*pskb
)->dst
) <= (sizeof(struct iphdr
) + sizeof(struct tcphdr
))) {
97 "ipt_tcpmss_target: unknown or invalid path-MTU (%d)\n", dst_mtu((*pskb
)->dst
));
98 return NF_DROP
; /* or IPT_CONTINUE ?? */
101 newmss
= dst_mtu((*pskb
)->dst
) - sizeof(struct iphdr
) - sizeof(struct tcphdr
);
103 newmss
= tcpmssinfo
->mss
;
105 opt
= (u_int8_t
*)tcph
;
106 for (i
= sizeof(struct tcphdr
); i
< tcph
->doff
*4; i
+= optlen(opt
, i
)){
107 if ((opt
[i
] == TCPOPT_MSS
) &&
108 ((tcph
->doff
*4 - i
) >= TCPOLEN_MSS
) &&
109 (opt
[i
+1] == TCPOLEN_MSS
)) {
112 oldmss
= (opt
[i
+2] << 8) | opt
[i
+3];
114 if((tcpmssinfo
->mss
== IPT_TCPMSS_CLAMP_PMTU
) &&
118 opt
[i
+2] = (newmss
& 0xff00) >> 8;
119 opt
[i
+3] = (newmss
& 0x00ff);
121 tcph
->check
= cheat_check(htons(oldmss
)^0xFFFF,
125 DEBUGP(KERN_INFO
"ipt_tcpmss_target: %u.%u.%u.%u:%hu"
126 "->%u.%u.%u.%u:%hu changed TCP MSS option"
127 " (from %u to %u)\n",
128 NIPQUAD((*pskb
)->nh
.iph
->saddr
),
130 NIPQUAD((*pskb
)->nh
.iph
->daddr
),
138 * MSS Option not found ?! add it..
140 if (skb_tailroom((*pskb
)) < TCPOLEN_MSS
) {
141 struct sk_buff
*newskb
;
143 newskb
= skb_copy_expand(*pskb
, skb_headroom(*pskb
),
144 TCPOLEN_MSS
, GFP_ATOMIC
);
147 printk(KERN_ERR
"ipt_tcpmss_target:"
148 " unable to allocate larger skb\n");
154 iph
= (*pskb
)->nh
.iph
;
155 tcph
= (void *)iph
+ iph
->ihl
*4;
158 skb_put((*pskb
), TCPOLEN_MSS
);
160 opt
= (u_int8_t
*)tcph
+ sizeof(struct tcphdr
);
161 memmove(opt
+ TCPOLEN_MSS
, opt
, tcplen
- sizeof(struct tcphdr
));
163 tcph
->check
= cheat_check(htons(tcplen
) ^ 0xFFFF,
164 htons(tcplen
+ TCPOLEN_MSS
), tcph
->check
);
165 tcplen
+= TCPOLEN_MSS
;
168 opt
[1] = TCPOLEN_MSS
;
169 opt
[2] = (newmss
& 0xff00) >> 8;
170 opt
[3] = (newmss
& 0x00ff);
172 tcph
->check
= cheat_check(~0, *((u_int32_t
*)opt
), tcph
->check
);
174 oldval
= ((u_int16_t
*)tcph
)[6];
175 tcph
->doff
+= TCPOLEN_MSS
/4;
176 tcph
->check
= cheat_check(oldval
^ 0xFFFF,
177 ((u_int16_t
*)tcph
)[6], tcph
->check
);
179 newtotlen
= htons(ntohs(iph
->tot_len
) + TCPOLEN_MSS
);
180 iph
->check
= cheat_check(iph
->tot_len
^ 0xFFFF,
181 newtotlen
, iph
->check
);
182 iph
->tot_len
= newtotlen
;
184 DEBUGP(KERN_INFO
"ipt_tcpmss_target: %u.%u.%u.%u:%hu"
185 "->%u.%u.%u.%u:%hu added TCP MSS option (%u)\n",
186 NIPQUAD((*pskb
)->nh
.iph
->saddr
),
188 NIPQUAD((*pskb
)->nh
.iph
->daddr
),
198 static inline int find_syn_match(const struct ipt_entry_match
*m
)
200 const struct ipt_tcp
*tcpinfo
= (const struct ipt_tcp
*)m
->data
;
202 if (strcmp(m
->u
.kernel
.match
->name
, "tcp") == 0
203 && (tcpinfo
->flg_cmp
& TH_SYN
)
204 && !(tcpinfo
->invflags
& IPT_TCP_INV_FLAGS
))
210 /* Must specify -p tcp --syn/--tcp-flags SYN */
212 ipt_tcpmss_checkentry(const char *tablename
,
215 unsigned int targinfosize
,
216 unsigned int hook_mask
)
218 const struct ipt_tcpmss_info
*tcpmssinfo
= targinfo
;
219 const struct ipt_entry
*e
= e_void
;
221 if (targinfosize
!= IPT_ALIGN(sizeof(struct ipt_tcpmss_info
))) {
222 DEBUGP("ipt_tcpmss_checkentry: targinfosize %u != %u\n",
223 targinfosize
, IPT_ALIGN(sizeof(struct ipt_tcpmss_info
)));
228 if((tcpmssinfo
->mss
== IPT_TCPMSS_CLAMP_PMTU
) &&
229 ((hook_mask
& ~((1 << NF_IP_FORWARD
)
230 | (1 << NF_IP_LOCAL_OUT
)
231 | (1 << NF_IP_POST_ROUTING
))) != 0)) {
232 printk("TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
236 if (e
->ip
.proto
== IPPROTO_TCP
237 && !(e
->ip
.invflags
& IPT_INV_PROTO
)
238 && IPT_MATCH_ITERATE(e
, find_syn_match
))
241 printk("TCPMSS: Only works on TCP SYN packets\n");
245 static struct ipt_target ipt_tcpmss_reg
= {
247 .target
= ipt_tcpmss_target
,
248 .checkentry
= ipt_tcpmss_checkentry
,
252 static int __init
init(void)
254 return ipt_register_target(&ipt_tcpmss_reg
);
257 static void __exit
fini(void)
259 ipt_unregister_target(&ipt_tcpmss_reg
);