ia64/linux-2.6.18-xen.hg

view net/netfilter/xt_tcpmss.c @ 0:831230e53067

Import 2.6.18 from kernel.org tarball.
author Ian Campbell <ian.campbell@xensource.com>
date Wed Apr 11 14:15:44 2007 +0100 (2007-04-11)
parents
children
line source
1 /* Kernel module to match TCP MSS values. */
3 /* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
4 * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <net/tcp.h>
15 #include <linux/netfilter/xt_tcpmss.h>
16 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter_ipv4/ip_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 #define TH_SYN 0x02
23 MODULE_LICENSE("GPL");
24 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
25 MODULE_DESCRIPTION("iptables TCP MSS match module");
26 MODULE_ALIAS("ipt_tcpmss");
28 /* Returns 1 if the mss option is set and matched by the range, 0 otherwise */
29 static inline int
30 mssoption_match(u_int16_t min, u_int16_t max,
31 const struct sk_buff *skb,
32 unsigned int protoff,
33 int invert,
34 int *hotdrop)
35 {
36 struct tcphdr _tcph, *th;
37 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
38 u8 _opt[15 * 4 - sizeof(_tcph)], *op;
39 unsigned int i, optlen;
41 /* If we don't have the whole header, drop packet. */
42 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
43 if (th == NULL)
44 goto dropit;
46 /* Malformed. */
47 if (th->doff*4 < sizeof(*th))
48 goto dropit;
50 optlen = th->doff*4 - sizeof(*th);
51 if (!optlen)
52 goto out;
54 /* Truncated options. */
55 op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt);
56 if (op == NULL)
57 goto dropit;
59 for (i = 0; i < optlen; ) {
60 if (op[i] == TCPOPT_MSS
61 && (optlen - i) >= TCPOLEN_MSS
62 && op[i+1] == TCPOLEN_MSS) {
63 u_int16_t mssval;
65 mssval = (op[i+2] << 8) | op[i+3];
67 return (mssval >= min && mssval <= max) ^ invert;
68 }
69 if (op[i] < 2) i++;
70 else i += op[i+1]?:1;
71 }
72 out:
73 return invert;
75 dropit:
76 *hotdrop = 1;
77 return 0;
78 }
80 static int
81 match(const struct sk_buff *skb,
82 const struct net_device *in,
83 const struct net_device *out,
84 const struct xt_match *match,
85 const void *matchinfo,
86 int offset,
87 unsigned int protoff,
88 int *hotdrop)
89 {
90 const struct xt_tcpmss_match_info *info = matchinfo;
92 return mssoption_match(info->mss_min, info->mss_max, skb, protoff,
93 info->invert, hotdrop);
94 }
96 static struct xt_match tcpmss_match = {
97 .name = "tcpmss",
98 .match = match,
99 .matchsize = sizeof(struct xt_tcpmss_match_info),
100 .proto = IPPROTO_TCP,
101 .family = AF_INET,
102 .me = THIS_MODULE,
103 };
105 static struct xt_match tcpmss6_match = {
106 .name = "tcpmss",
107 .match = match,
108 .matchsize = sizeof(struct xt_tcpmss_match_info),
109 .proto = IPPROTO_TCP,
110 .family = AF_INET6,
111 .me = THIS_MODULE,
112 };
115 static int __init xt_tcpmss_init(void)
116 {
117 int ret;
118 ret = xt_register_match(&tcpmss_match);
119 if (ret)
120 return ret;
122 ret = xt_register_match(&tcpmss6_match);
123 if (ret)
124 xt_unregister_match(&tcpmss_match);
126 return ret;
127 }
129 static void __exit xt_tcpmss_fini(void)
130 {
131 xt_unregister_match(&tcpmss6_match);
132 xt_unregister_match(&tcpmss_match);
133 }
135 module_init(xt_tcpmss_init);
136 module_exit(xt_tcpmss_fini);