2 * This is a module which is used for setting the MSS option in TCP packets.
4 * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
17 #include <linux/netfilter_ipv4/ip_tables.h>
18 #include <linux/netfilter_ipv4/ipt_TCPMSS.h>
20 MODULE_LICENSE("GPL");
21 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
22 MODULE_DESCRIPTION("iptables TCP MSS modification module");
24 static inline unsigned int
25 optlen(const u_int8_t
*opt
, unsigned int offset
)
27 /* Beware zero-length options: make finite progress */
28 if (opt
[offset
] <= TCPOPT_NOP
|| opt
[offset
+1] == 0)
35 ipt_tcpmss_target(struct sk_buff
**pskb
,
36 const struct net_device
*in
,
37 const struct net_device
*out
,
39 const struct xt_target
*target
,
42 const struct ipt_tcpmss_info
*tcpmssinfo
= targinfo
;
45 u_int16_t tcplen
, newmss
;
46 __be16 newtotlen
, oldval
;
50 if (!skb_make_writable(pskb
, (*pskb
)->len
))
53 iph
= (*pskb
)->nh
.iph
;
54 tcplen
= (*pskb
)->len
- iph
->ihl
*4;
55 tcph
= (void *)iph
+ iph
->ihl
*4;
57 /* Since it passed flags test in tcp match, we know it is is
58 not a fragment, and has data >= tcp header length. SYN
59 packets should not contain data: if they did, then we risk
60 running over MTU, sending Frag Needed and breaking things
62 if (tcplen
!= tcph
->doff
*4) {
65 "ipt_tcpmss_target: bad length (%d bytes)\n",
70 if (tcpmssinfo
->mss
== IPT_TCPMSS_CLAMP_PMTU
) {
71 if (dst_mtu((*pskb
)->dst
) <= sizeof(struct iphdr
) +
72 sizeof(struct tcphdr
)) {
74 printk(KERN_ERR
"ipt_tcpmss_target: "
75 "unknown or invalid path-MTU (%d)\n",
76 dst_mtu((*pskb
)->dst
));
77 return NF_DROP
; /* or IPT_CONTINUE ?? */
80 newmss
= dst_mtu((*pskb
)->dst
) - sizeof(struct iphdr
) -
81 sizeof(struct tcphdr
);
83 newmss
= tcpmssinfo
->mss
;
85 opt
= (u_int8_t
*)tcph
;
86 for (i
= sizeof(struct tcphdr
); i
< tcph
->doff
*4; i
+= optlen(opt
, i
)) {
87 if (opt
[i
] == TCPOPT_MSS
&& tcph
->doff
*4 - i
>= TCPOLEN_MSS
&&
88 opt
[i
+1] == TCPOLEN_MSS
) {
91 oldmss
= (opt
[i
+2] << 8) | opt
[i
+3];
93 if (tcpmssinfo
->mss
== IPT_TCPMSS_CLAMP_PMTU
&&
97 opt
[i
+2] = (newmss
& 0xff00) >> 8;
98 opt
[i
+3] = (newmss
& 0x00ff);
100 nf_proto_csum_replace2(&tcph
->check
, *pskb
,
101 htons(oldmss
), htons(newmss
), 0);
107 * MSS Option not found ?! add it..
109 if (skb_tailroom((*pskb
)) < TCPOLEN_MSS
) {
110 struct sk_buff
*newskb
;
112 newskb
= skb_copy_expand(*pskb
, skb_headroom(*pskb
),
113 TCPOLEN_MSS
, GFP_ATOMIC
);
118 iph
= (*pskb
)->nh
.iph
;
119 tcph
= (void *)iph
+ iph
->ihl
*4;
122 skb_put((*pskb
), TCPOLEN_MSS
);
124 opt
= (u_int8_t
*)tcph
+ sizeof(struct tcphdr
);
125 memmove(opt
+ TCPOLEN_MSS
, opt
, tcplen
- sizeof(struct tcphdr
));
127 nf_proto_csum_replace2(&tcph
->check
, *pskb
,
128 htons(tcplen
), htons(tcplen
+ TCPOLEN_MSS
), 1);
130 opt
[1] = TCPOLEN_MSS
;
131 opt
[2] = (newmss
& 0xff00) >> 8;
132 opt
[3] = (newmss
& 0x00ff);
134 nf_proto_csum_replace4(&tcph
->check
, *pskb
, 0, *((__be32
*)opt
), 0);
136 oldval
= ((__be16
*)tcph
)[6];
137 tcph
->doff
+= TCPOLEN_MSS
/4;
138 nf_proto_csum_replace2(&tcph
->check
, *pskb
,
139 oldval
, ((__be16
*)tcph
)[6], 0);
141 newtotlen
= htons(ntohs(iph
->tot_len
) + TCPOLEN_MSS
);
142 nf_csum_replace2(&iph
->check
, iph
->tot_len
, newtotlen
);
143 iph
->tot_len
= newtotlen
;
149 static inline int find_syn_match(const struct ipt_entry_match
*m
)
151 const struct ipt_tcp
*tcpinfo
= (const struct ipt_tcp
*)m
->data
;
153 if (strcmp(m
->u
.kernel
.match
->name
, "tcp") == 0 &&
154 tcpinfo
->flg_cmp
& TH_SYN
&&
155 !(tcpinfo
->invflags
& IPT_TCP_INV_FLAGS
))
161 /* Must specify -p tcp --syn/--tcp-flags SYN */
163 ipt_tcpmss_checkentry(const char *tablename
,
165 const struct xt_target
*target
,
167 unsigned int hook_mask
)
169 const struct ipt_tcpmss_info
*tcpmssinfo
= targinfo
;
170 const struct ipt_entry
*e
= e_void
;
172 if (tcpmssinfo
->mss
== IPT_TCPMSS_CLAMP_PMTU
&&
173 (hook_mask
& ~((1 << NF_IP_FORWARD
) |
174 (1 << NF_IP_LOCAL_OUT
) |
175 (1 << NF_IP_POST_ROUTING
))) != 0) {
176 printk("TCPMSS: path-MTU clamping only supported in "
177 "FORWARD, OUTPUT and POSTROUTING hooks\n");
181 if (IPT_MATCH_ITERATE(e
, find_syn_match
))
183 printk("TCPMSS: Only works on TCP SYN packets\n");
187 static struct ipt_target ipt_tcpmss_reg
= {
189 .target
= ipt_tcpmss_target
,
190 .targetsize
= sizeof(struct ipt_tcpmss_info
),
191 .proto
= IPPROTO_TCP
,
192 .checkentry
= ipt_tcpmss_checkentry
,
196 static int __init
ipt_tcpmss_init(void)
198 return ipt_register_target(&ipt_tcpmss_reg
);
201 static void __exit
ipt_tcpmss_fini(void)
203 ipt_unregister_target(&ipt_tcpmss_reg
);
206 module_init(ipt_tcpmss_init
);
207 module_exit(ipt_tcpmss_fini
);