xt_tcpmss.c 2.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* Kernel module to match TCP MSS values. */
  3. /* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
  4. * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
  5. */
  6. #include <linux/module.h>
  7. #include <linux/skbuff.h>
  8. #include <net/tcp.h>
  9. #include <linux/netfilter/xt_tcpmss.h>
  10. #include <linux/netfilter/x_tables.h>
  11. #include <linux/netfilter_ipv4/ip_tables.h>
  12. #include <linux/netfilter_ipv6/ip6_tables.h>
  13. MODULE_LICENSE("GPL");
  14. MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
  15. MODULE_DESCRIPTION("Xtables: TCP MSS match");
  16. MODULE_ALIAS("ipt_tcpmss");
  17. MODULE_ALIAS("ip6t_tcpmss");
  18. static bool
  19. tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
  20. {
  21. const struct xt_tcpmss_match_info *info = par->matchinfo;
  22. const struct tcphdr *th;
  23. struct tcphdr _tcph;
  24. /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
  25. const u_int8_t *op;
  26. u8 _opt[15 * 4 - sizeof(_tcph)];
  27. unsigned int i, optlen;
  28. /* If we don't have the whole header, drop packet. */
  29. th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
  30. if (th == NULL)
  31. goto dropit;
  32. /* Malformed. */
  33. if (th->doff*4 < sizeof(*th))
  34. goto dropit;
  35. optlen = th->doff*4 - sizeof(*th);
  36. if (!optlen)
  37. goto out;
  38. /* Truncated options. */
  39. op = skb_header_pointer(skb, par->thoff + sizeof(*th), optlen, _opt);
  40. if (op == NULL)
  41. goto dropit;
  42. for (i = 0; i < optlen; ) {
  43. if (op[i] == TCPOPT_MSS
  44. && (optlen - i) >= TCPOLEN_MSS
  45. && op[i+1] == TCPOLEN_MSS) {
  46. u_int16_t mssval;
  47. mssval = (op[i+2] << 8) | op[i+3];
  48. return (mssval >= info->mss_min &&
  49. mssval <= info->mss_max) ^ info->invert;
  50. }
  51. if (op[i] < 2)
  52. i++;
  53. else
  54. i += op[i+1] ? : 1;
  55. }
  56. out:
  57. return info->invert;
  58. dropit:
  59. par->hotdrop = true;
  60. return false;
  61. }
  62. static struct xt_match tcpmss_mt_reg[] __read_mostly = {
  63. {
  64. .name = "tcpmss",
  65. .family = NFPROTO_IPV4,
  66. .match = tcpmss_mt,
  67. .matchsize = sizeof(struct xt_tcpmss_match_info),
  68. .proto = IPPROTO_TCP,
  69. .me = THIS_MODULE,
  70. },
  71. {
  72. .name = "tcpmss",
  73. .family = NFPROTO_IPV6,
  74. .match = tcpmss_mt,
  75. .matchsize = sizeof(struct xt_tcpmss_match_info),
  76. .proto = IPPROTO_TCP,
  77. .me = THIS_MODULE,
  78. },
  79. };
  80. static int __init tcpmss_mt_init(void)
  81. {
  82. return xt_register_matches(tcpmss_mt_reg, ARRAY_SIZE(tcpmss_mt_reg));
  83. }
  84. static void __exit tcpmss_mt_exit(void)
  85. {
  86. xt_unregister_matches(tcpmss_mt_reg, ARRAY_SIZE(tcpmss_mt_reg));
  87. }
  88. module_init(tcpmss_mt_init);
  89. module_exit(tcpmss_mt_exit);