tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* Kernel module to match TCP MSS values. */
2
3/* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
4 * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <net/tcp.h>
14
15#include <linux/netfilter/xt_tcpmss.h>
16#include <linux/netfilter/x_tables.h>
17
18#include <linux/netfilter_ipv4/ip_tables.h>
19#include <linux/netfilter_ipv6/ip6_tables.h>
20
21#define TH_SYN 0x02
22
23MODULE_LICENSE("GPL");
24MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
25MODULE_DESCRIPTION("iptables TCP MSS match module");
26MODULE_ALIAS("ipt_tcpmss");
27
28/* Returns 1 if the mss option is set and matched by the range, 0 otherwise */
29static inline int
30mssoption_match(u_int16_t min, u_int16_t max,
31 const struct sk_buff *skb,
32 unsigned int protoff,
33 int invert,
34 int *hotdrop)
35{
36 struct tcphdr _tcph, *th;
37 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
38 u8 _opt[15 * 4 - sizeof(_tcph)], *op;
39 unsigned int i, optlen;
40
41 /* If we don't have the whole header, drop packet. */
42 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
43 if (th == NULL)
44 goto dropit;
45
46 /* Malformed. */
47 if (th->doff*4 < sizeof(*th))
48 goto dropit;
49
50 optlen = th->doff*4 - sizeof(*th);
51 if (!optlen)
52 goto out;
53
54 /* Truncated options. */
55 op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt);
56 if (op == NULL)
57 goto dropit;
58
59 for (i = 0; i < optlen; ) {
60 if (op[i] == TCPOPT_MSS
61 && (optlen - i) >= TCPOLEN_MSS
62 && op[i+1] == TCPOLEN_MSS) {
63 u_int16_t mssval;
64
65 mssval = (op[i+2] << 8) | op[i+3];
66
67 return (mssval >= min && mssval <= max) ^ invert;
68 }
69 if (op[i] < 2) i++;
70 else i += op[i+1]?:1;
71 }
72out:
73 return invert;
74
75 dropit:
76 *hotdrop = 1;
77 return 0;
78}
79
80static int
81match(const struct sk_buff *skb,
82 const struct net_device *in,
83 const struct net_device *out,
84 const struct xt_match *match,
85 const void *matchinfo,
86 int offset,
87 unsigned int protoff,
88 int *hotdrop)
89{
90 const struct xt_tcpmss_match_info *info = matchinfo;
91
92 return mssoption_match(info->mss_min, info->mss_max, skb, protoff,
93 info->invert, hotdrop);
94}
95
96static struct xt_match tcpmss_match = {
97 .name = "tcpmss",
98 .match = match,
99 .matchsize = sizeof(struct xt_tcpmss_match_info),
100 .proto = IPPROTO_TCP,
101 .family = AF_INET,
102 .me = THIS_MODULE,
103};
104
105static struct xt_match tcpmss6_match = {
106 .name = "tcpmss",
107 .match = match,
108 .matchsize = sizeof(struct xt_tcpmss_match_info),
109 .proto = IPPROTO_TCP,
110 .family = AF_INET6,
111 .me = THIS_MODULE,
112};
113
114
115static int __init xt_tcpmss_init(void)
116{
117 int ret;
118 ret = xt_register_match(&tcpmss_match);
119 if (ret)
120 return ret;
121
122 ret = xt_register_match(&tcpmss6_match);
123 if (ret)
124 xt_unregister_match(&tcpmss_match);
125
126 return ret;
127}
128
129static void __exit xt_tcpmss_fini(void)
130{
131 xt_unregister_match(&tcpmss6_match);
132 xt_unregister_match(&tcpmss_match);
133}
134
135module_init(xt_tcpmss_init);
136module_exit(xt_tcpmss_fini);