xt_tcpmss.c 2.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115
  1. /* Kernel module to match TCP MSS values. */
  2. /* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
  3. * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License version 2 as
  7. * published by the Free Software Foundation.
  8. */
  9. #include <linux/module.h>
  10. #include <linux/skbuff.h>
  11. #include <net/tcp.h>
  12. #include <linux/netfilter/xt_tcpmss.h>
  13. #include <linux/netfilter/x_tables.h>
  14. #include <linux/netfilter_ipv4/ip_tables.h>
  15. #include <linux/netfilter_ipv6/ip6_tables.h>
  16. MODULE_LICENSE("GPL");
  17. MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
  18. MODULE_DESCRIPTION("iptables TCP MSS match module");
  19. MODULE_ALIAS("ipt_tcpmss");
  20. static int
  21. match(const struct sk_buff *skb,
  22. const struct net_device *in,
  23. const struct net_device *out,
  24. const struct xt_match *match,
  25. const void *matchinfo,
  26. int offset,
  27. unsigned int protoff,
  28. int *hotdrop)
  29. {
  30. const struct xt_tcpmss_match_info *info = matchinfo;
  31. struct tcphdr _tcph, *th;
  32. /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
  33. u8 _opt[15 * 4 - sizeof(_tcph)], *op;
  34. unsigned int i, optlen;
  35. /* If we don't have the whole header, drop packet. */
  36. th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
  37. if (th == NULL)
  38. goto dropit;
  39. /* Malformed. */
  40. if (th->doff*4 < sizeof(*th))
  41. goto dropit;
  42. optlen = th->doff*4 - sizeof(*th);
  43. if (!optlen)
  44. goto out;
  45. /* Truncated options. */
  46. op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt);
  47. if (op == NULL)
  48. goto dropit;
  49. for (i = 0; i < optlen; ) {
  50. if (op[i] == TCPOPT_MSS
  51. && (optlen - i) >= TCPOLEN_MSS
  52. && op[i+1] == TCPOLEN_MSS) {
  53. u_int16_t mssval;
  54. mssval = (op[i+2] << 8) | op[i+3];
  55. return (mssval >= info->mss_min &&
  56. mssval <= info->mss_max) ^ info->invert;
  57. }
  58. if (op[i] < 2)
  59. i++;
  60. else
  61. i += op[i+1] ? : 1;
  62. }
  63. out:
  64. return info->invert;
  65. dropit:
  66. *hotdrop = 1;
  67. return 0;
  68. }
  69. static struct xt_match xt_tcpmss_match[] = {
  70. {
  71. .name = "tcpmss",
  72. .family = AF_INET,
  73. .match = match,
  74. .matchsize = sizeof(struct xt_tcpmss_match_info),
  75. .proto = IPPROTO_TCP,
  76. .me = THIS_MODULE,
  77. },
  78. {
  79. .name = "tcpmss",
  80. .family = AF_INET6,
  81. .match = match,
  82. .matchsize = sizeof(struct xt_tcpmss_match_info),
  83. .proto = IPPROTO_TCP,
  84. .me = THIS_MODULE,
  85. },
  86. };
  87. static int __init xt_tcpmss_init(void)
  88. {
  89. return xt_register_matches(xt_tcpmss_match,
  90. ARRAY_SIZE(xt_tcpmss_match));
  91. }
  92. static void __exit xt_tcpmss_fini(void)
  93. {
  94. xt_unregister_matches(xt_tcpmss_match, ARRAY_SIZE(xt_tcpmss_match));
  95. }
  96. module_init(xt_tcpmss_init);
  97. module_exit(xt_tcpmss_fini);