2 * This is a module which is used for setting the MSS option in TCP packets.
4 * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
14 #include <linux/ipv6.h>
15 #include <linux/tcp.h>
19 #include <net/route.h>
22 #include <linux/netfilter_ipv4/ip_tables.h>
23 #include <linux/netfilter_ipv6/ip6_tables.h>
24 #include <linux/netfilter/x_tables.h>
25 #include <linux/netfilter/xt_tcpudp.h>
26 #include <linux/netfilter/xt_TCPMSS.h>
28 MODULE_LICENSE("GPL");
29 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
30 MODULE_DESCRIPTION("Xtables: TCP Maximum Segment Size (MSS) adjustment");
31 MODULE_ALIAS("ipt_TCPMSS");
32 MODULE_ALIAS("ip6t_TCPMSS");
34 static inline unsigned int
35 optlen(const u_int8_t *opt, unsigned int offset)
37 /* Beware zero-length options: make finite progress */
38 if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
45 tcpmss_mangle_packet(struct sk_buff *skb,
46 const struct xt_tcpmss_info *info,
52 unsigned int tcplen, i;
57 if (!skb_make_writable(skb, skb->len))
60 tcplen = skb->len - tcphoff;
61 tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
63 /* Header cannot be larger than the packet */
64 if (tcplen < tcph->doff*4)
67 if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
68 if (dst_mtu(skb_dst(skb)) <= minlen) {
70 pr_err("unknown or invalid path-MTU (%u)\n",
71 dst_mtu(skb_dst(skb)));
74 if (in_mtu <= minlen) {
76 pr_err("unknown or invalid path-MTU (%u)\n",
80 newmss = min(dst_mtu(skb_dst(skb)), in_mtu) - minlen;
84 opt = (u_int8_t *)tcph;
85 for (i = sizeof(struct tcphdr); i < tcph->doff*4; i += optlen(opt, i)) {
86 if (opt[i] == TCPOPT_MSS && tcph->doff*4 - i >= TCPOLEN_MSS &&
87 opt[i+1] == TCPOLEN_MSS) {
90 oldmss = (opt[i+2] << 8) | opt[i+3];
92 /* Never increase MSS, even when setting it, as
93 * doing so results in problems for hosts that rely
94 * on MSS being set correctly.
99 opt[i+2] = (newmss & 0xff00) >> 8;
100 opt[i+3] = newmss & 0x00ff;
102 inet_proto_csum_replace2(&tcph->check, skb,
103 htons(oldmss), htons(newmss),
109 /* There is data after the header so the option can't be added
110 without moving it, and doing so may make the SYN packet
111 itself too large. Accept the packet unmodified instead. */
112 if (tcplen > tcph->doff*4)
116 * MSS Option not found ?! add it..
118 if (skb_tailroom(skb) < TCPOLEN_MSS) {
119 if (pskb_expand_head(skb, 0,
120 TCPOLEN_MSS - skb_tailroom(skb),
123 tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
126 skb_put(skb, TCPOLEN_MSS);
128 opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
129 memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
131 inet_proto_csum_replace2(&tcph->check, skb,
132 htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
134 opt[1] = TCPOLEN_MSS;
135 opt[2] = (newmss & 0xff00) >> 8;
136 opt[3] = newmss & 0x00ff;
138 inet_proto_csum_replace4(&tcph->check, skb, 0, *((__be32 *)opt), 0);
140 oldval = ((__be16 *)tcph)[6];
141 tcph->doff += TCPOLEN_MSS/4;
142 inet_proto_csum_replace2(&tcph->check, skb,
143 oldval, ((__be16 *)tcph)[6], 0);
147 static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
150 struct flowi fl = {};
151 const struct nf_afinfo *ai;
152 struct rtable *rt = NULL;
155 if (family == PF_INET)
156 fl.fl4_dst = ip_hdr(skb)->saddr;
158 fl.fl6_dst = ipv6_hdr(skb)->saddr;
161 ai = nf_get_afinfo(family);
163 ai->route((struct dst_entry **)&rt, &fl);
167 mtu = dst_mtu(&rt->u.dst);
168 dst_release(&rt->u.dst);
174 tcpmss_tg4(struct sk_buff *skb, const struct xt_target_param *par)
176 struct iphdr *iph = ip_hdr(skb);
180 ret = tcpmss_mangle_packet(skb, par->targinfo,
181 tcpmss_reverse_mtu(skb, PF_INET),
183 sizeof(*iph) + sizeof(struct tcphdr));
188 newlen = htons(ntohs(iph->tot_len) + ret);
189 csum_replace2(&iph->check, iph->tot_len, newlen);
190 iph->tot_len = newlen;
195 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
197 tcpmss_tg6(struct sk_buff *skb, const struct xt_target_param *par)
199 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
204 nexthdr = ipv6h->nexthdr;
205 tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
208 ret = tcpmss_mangle_packet(skb, par->targinfo,
209 tcpmss_reverse_mtu(skb, PF_INET6),
211 sizeof(*ipv6h) + sizeof(struct tcphdr));
215 ipv6h = ipv6_hdr(skb);
216 ipv6h->payload_len = htons(ntohs(ipv6h->payload_len) + ret);
224 /* Must specify -p tcp --syn */
225 static inline bool find_syn_match(const struct xt_entry_match *m)
227 const struct xt_tcp *tcpinfo = (const struct xt_tcp *)m->data;
229 if (strcmp(m->u.kernel.match->name, "tcp") == 0 &&
230 tcpinfo->flg_cmp & TH_SYN &&
231 !(tcpinfo->invflags & XT_TCP_INV_FLAGS))
237 static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
239 const struct xt_tcpmss_info *info = par->targinfo;
240 const struct ipt_entry *e = par->entryinfo;
241 const struct xt_entry_match *ematch;
243 if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
244 (par->hook_mask & ~((1 << NF_INET_FORWARD) |
245 (1 << NF_INET_LOCAL_OUT) |
246 (1 << NF_INET_POST_ROUTING))) != 0) {
247 pr_info("path-MTU clamping only supported in "
248 "FORWARD, OUTPUT and POSTROUTING hooks\n");
251 xt_ematch_foreach(ematch, e)
252 if (find_syn_match(ematch))
254 pr_info("Only works on TCP SYN packets\n");
258 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
259 static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
261 const struct xt_tcpmss_info *info = par->targinfo;
262 const struct ip6t_entry *e = par->entryinfo;
263 const struct xt_entry_match *ematch;
265 if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
266 (par->hook_mask & ~((1 << NF_INET_FORWARD) |
267 (1 << NF_INET_LOCAL_OUT) |
268 (1 << NF_INET_POST_ROUTING))) != 0) {
269 pr_info("path-MTU clamping only supported in "
270 "FORWARD, OUTPUT and POSTROUTING hooks\n");
273 xt_ematch_foreach(ematch, e)
274 if (find_syn_match(ematch))
276 pr_info("Only works on TCP SYN packets\n");
281 static struct xt_target tcpmss_tg_reg[] __read_mostly = {
283 .family = NFPROTO_IPV4,
285 .checkentry = tcpmss_tg4_check,
286 .target = tcpmss_tg4,
287 .targetsize = sizeof(struct xt_tcpmss_info),
288 .proto = IPPROTO_TCP,
291 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
293 .family = NFPROTO_IPV6,
295 .checkentry = tcpmss_tg6_check,
296 .target = tcpmss_tg6,
297 .targetsize = sizeof(struct xt_tcpmss_info),
298 .proto = IPPROTO_TCP,
304 static int __init tcpmss_tg_init(void)
306 return xt_register_targets(tcpmss_tg_reg, ARRAY_SIZE(tcpmss_tg_reg));
309 static void __exit tcpmss_tg_exit(void)
311 xt_unregister_targets(tcpmss_tg_reg, ARRAY_SIZE(tcpmss_tg_reg));
314 module_init(tcpmss_tg_init);
315 module_exit(tcpmss_tg_exit);