xt_TCPMSS.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * This is a module which is used for setting the MSS option in TCP packets.
  4. *
  5. * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
  6. * Copyright (C) 2007 Patrick McHardy <kaber@trash.net>
  7. */
  8. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  9. #include <linux/module.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/ip.h>
  12. #include <linux/gfp.h>
  13. #include <linux/ipv6.h>
  14. #include <linux/tcp.h>
  15. #include <net/dst.h>
  16. #include <net/flow.h>
  17. #include <net/ipv6.h>
  18. #include <net/route.h>
  19. #include <net/tcp.h>
  20. #include <linux/netfilter_ipv4/ip_tables.h>
  21. #include <linux/netfilter_ipv6/ip6_tables.h>
  22. #include <linux/netfilter/x_tables.h>
  23. #include <linux/netfilter/xt_tcpudp.h>
  24. #include <linux/netfilter/xt_TCPMSS.h>
  25. MODULE_LICENSE("GPL");
  26. MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
  27. MODULE_DESCRIPTION("Xtables: TCP Maximum Segment Size (MSS) adjustment");
  28. MODULE_ALIAS("ipt_TCPMSS");
  29. MODULE_ALIAS("ip6t_TCPMSS");
  30. static inline unsigned int
  31. optlen(const u_int8_t *opt, unsigned int offset)
  32. {
  33. /* Beware zero-length options: make finite progress */
  34. if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
  35. return 1;
  36. else
  37. return opt[offset+1];
  38. }
  39. static u_int32_t tcpmss_reverse_mtu(struct net *net,
  40. const struct sk_buff *skb,
  41. unsigned int family)
  42. {
  43. struct flowi fl;
  44. struct rtable *rt = NULL;
  45. u_int32_t mtu = ~0U;
  46. if (family == PF_INET) {
  47. struct flowi4 *fl4 = &fl.u.ip4;
  48. memset(fl4, 0, sizeof(*fl4));
  49. fl4->daddr = ip_hdr(skb)->saddr;
  50. } else {
  51. struct flowi6 *fl6 = &fl.u.ip6;
  52. memset(fl6, 0, sizeof(*fl6));
  53. fl6->daddr = ipv6_hdr(skb)->saddr;
  54. }
  55. nf_route(net, (struct dst_entry **)&rt, &fl, false, family);
  56. if (rt != NULL) {
  57. mtu = dst_mtu(&rt->dst);
  58. dst_release(&rt->dst);
  59. }
  60. return mtu;
  61. }
  62. static int
  63. tcpmss_mangle_packet(struct sk_buff *skb,
  64. const struct xt_action_param *par,
  65. unsigned int family,
  66. unsigned int tcphoff,
  67. unsigned int minlen)
  68. {
  69. const struct xt_tcpmss_info *info = par->targinfo;
  70. struct tcphdr *tcph;
  71. int len, tcp_hdrlen;
  72. unsigned int i;
  73. __be16 oldval;
  74. u16 newmss;
  75. u8 *opt;
  76. /* This is a fragment, no TCP header is available */
  77. if (par->fragoff != 0)
  78. return 0;
  79. if (skb_ensure_writable(skb, skb->len))
  80. return -1;
  81. len = skb->len - tcphoff;
  82. if (len < (int)sizeof(struct tcphdr))
  83. return -1;
  84. tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
  85. tcp_hdrlen = tcph->doff * 4;
  86. if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
  87. return -1;
  88. if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
  89. struct net *net = xt_net(par);
  90. unsigned int in_mtu = tcpmss_reverse_mtu(net, skb, family);
  91. unsigned int min_mtu = min(dst_mtu(skb_dst(skb)), in_mtu);
  92. if (min_mtu <= minlen) {
  93. net_err_ratelimited("unknown or invalid path-MTU (%u)\n",
  94. min_mtu);
  95. return -1;
  96. }
  97. newmss = min_mtu - minlen;
  98. } else
  99. newmss = info->mss;
  100. opt = (u_int8_t *)tcph;
  101. for (i = sizeof(struct tcphdr); i <= tcp_hdrlen - TCPOLEN_MSS; i += optlen(opt, i)) {
  102. if (opt[i] == TCPOPT_MSS && opt[i+1] == TCPOLEN_MSS) {
  103. u_int16_t oldmss;
  104. oldmss = (opt[i+2] << 8) | opt[i+3];
  105. /* Never increase MSS, even when setting it, as
  106. * doing so results in problems for hosts that rely
  107. * on MSS being set correctly.
  108. */
  109. if (oldmss <= newmss)
  110. return 0;
  111. opt[i+2] = (newmss & 0xff00) >> 8;
  112. opt[i+3] = newmss & 0x00ff;
  113. inet_proto_csum_replace2(&tcph->check, skb,
  114. htons(oldmss), htons(newmss),
  115. false);
  116. return 0;
  117. }
  118. }
  119. /* There is data after the header so the option can't be added
  120. * without moving it, and doing so may make the SYN packet
  121. * itself too large. Accept the packet unmodified instead.
  122. */
  123. if (len > tcp_hdrlen)
  124. return 0;
  125. /* tcph->doff has 4 bits, do not wrap it to 0 */
  126. if (tcp_hdrlen >= 15 * 4)
  127. return 0;
  128. /*
  129. * MSS Option not found ?! add it..
  130. */
  131. if (skb_tailroom(skb) < TCPOLEN_MSS) {
  132. if (pskb_expand_head(skb, 0,
  133. TCPOLEN_MSS - skb_tailroom(skb),
  134. GFP_ATOMIC))
  135. return -1;
  136. tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
  137. }
  138. skb_put(skb, TCPOLEN_MSS);
  139. /*
  140. * IPv4: RFC 1122 states "If an MSS option is not received at
  141. * connection setup, TCP MUST assume a default send MSS of 536".
  142. * IPv6: RFC 2460 states IPv6 has a minimum MTU of 1280 and a minimum
  143. * length IPv6 header of 60, ergo the default MSS value is 1220
  144. * Since no MSS was provided, we must use the default values
  145. */
  146. if (xt_family(par) == NFPROTO_IPV4)
  147. newmss = min(newmss, (u16)536);
  148. else
  149. newmss = min(newmss, (u16)1220);
  150. opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
  151. memmove(opt + TCPOLEN_MSS, opt, len - sizeof(struct tcphdr));
  152. inet_proto_csum_replace2(&tcph->check, skb,
  153. htons(len), htons(len + TCPOLEN_MSS), true);
  154. opt[0] = TCPOPT_MSS;
  155. opt[1] = TCPOLEN_MSS;
  156. opt[2] = (newmss & 0xff00) >> 8;
  157. opt[3] = newmss & 0x00ff;
  158. inet_proto_csum_replace4(&tcph->check, skb, 0, *((__be32 *)opt), false);
  159. oldval = ((__be16 *)tcph)[6];
  160. tcph->doff += TCPOLEN_MSS/4;
  161. inet_proto_csum_replace2(&tcph->check, skb,
  162. oldval, ((__be16 *)tcph)[6], false);
  163. return TCPOLEN_MSS;
  164. }
  165. static unsigned int
  166. tcpmss_tg4(struct sk_buff *skb, const struct xt_action_param *par)
  167. {
  168. struct iphdr *iph = ip_hdr(skb);
  169. __be16 newlen;
  170. int ret;
  171. ret = tcpmss_mangle_packet(skb, par,
  172. PF_INET,
  173. iph->ihl * 4,
  174. sizeof(*iph) + sizeof(struct tcphdr));
  175. if (ret < 0)
  176. return NF_DROP;
  177. if (ret > 0) {
  178. iph = ip_hdr(skb);
  179. newlen = htons(ntohs(iph->tot_len) + ret);
  180. csum_replace2(&iph->check, iph->tot_len, newlen);
  181. iph->tot_len = newlen;
  182. }
  183. return XT_CONTINUE;
  184. }
  185. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  186. static unsigned int
  187. tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
  188. {
  189. struct ipv6hdr *ipv6h = ipv6_hdr(skb);
  190. u8 nexthdr;
  191. __be16 frag_off, oldlen, newlen;
  192. int tcphoff;
  193. int ret;
  194. nexthdr = ipv6h->nexthdr;
  195. tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
  196. if (tcphoff < 0)
  197. return NF_DROP;
  198. ret = tcpmss_mangle_packet(skb, par,
  199. PF_INET6,
  200. tcphoff,
  201. sizeof(*ipv6h) + sizeof(struct tcphdr));
  202. if (ret < 0)
  203. return NF_DROP;
  204. if (ret > 0) {
  205. ipv6h = ipv6_hdr(skb);
  206. oldlen = ipv6h->payload_len;
  207. newlen = htons(ntohs(oldlen) + ret);
  208. if (skb->ip_summed == CHECKSUM_COMPLETE)
  209. skb->csum = csum_add(csum_sub(skb->csum, oldlen),
  210. newlen);
  211. ipv6h->payload_len = newlen;
  212. }
  213. return XT_CONTINUE;
  214. }
  215. #endif
  216. /* Must specify -p tcp --syn */
  217. static inline bool find_syn_match(const struct xt_entry_match *m)
  218. {
  219. const struct xt_tcp *tcpinfo = (const struct xt_tcp *)m->data;
  220. if (strcmp(m->u.kernel.match->name, "tcp") == 0 &&
  221. tcpinfo->flg_cmp & TCPHDR_SYN &&
  222. !(tcpinfo->invflags & XT_TCP_INV_FLAGS))
  223. return true;
  224. return false;
  225. }
  226. static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
  227. {
  228. const struct xt_tcpmss_info *info = par->targinfo;
  229. const struct ipt_entry *e = par->entryinfo;
  230. const struct xt_entry_match *ematch;
  231. if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
  232. (par->hook_mask & ~((1 << NF_INET_FORWARD) |
  233. (1 << NF_INET_LOCAL_OUT) |
  234. (1 << NF_INET_POST_ROUTING))) != 0) {
  235. pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
  236. return -EINVAL;
  237. }
  238. if (par->nft_compat)
  239. return 0;
  240. xt_ematch_foreach(ematch, e)
  241. if (find_syn_match(ematch))
  242. return 0;
  243. pr_info_ratelimited("Only works on TCP SYN packets\n");
  244. return -EINVAL;
  245. }
  246. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  247. static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
  248. {
  249. const struct xt_tcpmss_info *info = par->targinfo;
  250. const struct ip6t_entry *e = par->entryinfo;
  251. const struct xt_entry_match *ematch;
  252. if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
  253. (par->hook_mask & ~((1 << NF_INET_FORWARD) |
  254. (1 << NF_INET_LOCAL_OUT) |
  255. (1 << NF_INET_POST_ROUTING))) != 0) {
  256. pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
  257. return -EINVAL;
  258. }
  259. if (par->nft_compat)
  260. return 0;
  261. xt_ematch_foreach(ematch, e)
  262. if (find_syn_match(ematch))
  263. return 0;
  264. pr_info_ratelimited("Only works on TCP SYN packets\n");
  265. return -EINVAL;
  266. }
  267. #endif
  268. static struct xt_target tcpmss_tg_reg[] __read_mostly = {
  269. {
  270. .family = NFPROTO_IPV4,
  271. .name = "TCPMSS",
  272. .checkentry = tcpmss_tg4_check,
  273. .target = tcpmss_tg4,
  274. .targetsize = sizeof(struct xt_tcpmss_info),
  275. .proto = IPPROTO_TCP,
  276. .me = THIS_MODULE,
  277. },
  278. #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
  279. {
  280. .family = NFPROTO_IPV6,
  281. .name = "TCPMSS",
  282. .checkentry = tcpmss_tg6_check,
  283. .target = tcpmss_tg6,
  284. .targetsize = sizeof(struct xt_tcpmss_info),
  285. .proto = IPPROTO_TCP,
  286. .me = THIS_MODULE,
  287. },
  288. #endif
  289. };
  290. static int __init tcpmss_tg_init(void)
  291. {
  292. return xt_register_targets(tcpmss_tg_reg, ARRAY_SIZE(tcpmss_tg_reg));
  293. }
  294. static void __exit tcpmss_tg_exit(void)
  295. {
  296. xt_unregister_targets(tcpmss_tg_reg, ARRAY_SIZE(tcpmss_tg_reg));
  297. }
  298. module_init(tcpmss_tg_init);
  299. module_exit(tcpmss_tg_exit);