1 /* Kernel module to match TCP MSS values. */
3 /* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
4 * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
15 #include <linux/netfilter/xt_tcpmss.h>
16 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter_ipv4/ip_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
23 MODULE_LICENSE("GPL");
24 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
25 MODULE_DESCRIPTION("iptables TCP MSS match module");
26 MODULE_ALIAS("ipt_tcpmss");
28 /* Returns 1 if the mss option is set and matched by the range, 0 otherwise */
30 mssoption_match(u_int16_t min
, u_int16_t max
,
31 const struct sk_buff
*skb
,
36 struct tcphdr _tcph
, *th
;
37 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
38 u8 _opt
[15 * 4 - sizeof(_tcph
)], *op
;
39 unsigned int i
, optlen
;
41 /* If we don't have the whole header, drop packet. */
42 th
= skb_header_pointer(skb
, protoff
, sizeof(_tcph
), &_tcph
);
47 if (th
->doff
*4 < sizeof(*th
))
50 optlen
= th
->doff
*4 - sizeof(*th
);
54 /* Truncated options. */
55 op
= skb_header_pointer(skb
, protoff
+ sizeof(*th
), optlen
, _opt
);
59 for (i
= 0; i
< optlen
; ) {
60 if (op
[i
] == TCPOPT_MSS
61 && (optlen
- i
) >= TCPOLEN_MSS
62 && op
[i
+1] == TCPOLEN_MSS
) {
65 mssval
= (op
[i
+2] << 8) | op
[i
+3];
67 return (mssval
>= min
&& mssval
<= max
) ^ invert
;
81 match(const struct sk_buff
*skb
,
82 const struct net_device
*in
,
83 const struct net_device
*out
,
84 const struct xt_match
*match
,
85 const void *matchinfo
,
90 const struct xt_tcpmss_match_info
*info
= matchinfo
;
92 return mssoption_match(info
->mss_min
, info
->mss_max
, skb
, protoff
,
93 info
->invert
, hotdrop
);
96 static struct xt_match tcpmss_match
= {
99 .matchsize
= sizeof(struct xt_tcpmss_match_info
),
100 .proto
= IPPROTO_TCP
,
104 static struct xt_match tcpmss6_match
= {
107 .matchsize
= sizeof(struct xt_tcpmss_match_info
),
108 .proto
= IPPROTO_TCP
,
113 static int __init
init(void)
116 ret
= xt_register_match(AF_INET
, &tcpmss_match
);
120 ret
= xt_register_match(AF_INET6
, &tcpmss6_match
);
122 xt_unregister_match(AF_INET
, &tcpmss_match
);
127 static void __exit
fini(void)
129 xt_unregister_match(AF_INET6
, &tcpmss6_match
);
130 xt_unregister_match(AF_INET
, &tcpmss_match
);
This page took 0.033359 seconds and 5 git commands to generate.