net/netfilter/xt_TCPMSS.c

   1 /*
   2  * This is a module which is used for setting the MSS option in TCP packets.
   3  *
   4  * Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
   5  * Copyright (C) 2007 Patrick McHardy <kaber@trash.net>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/module.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/ip.h>
  15 #include <linux/gfp.h>
  16 #include <linux/ipv6.h>
  17 #include <linux/tcp.h>
  18 #include <net/dst.h>
  19 #include <net/flow.h>
  20 #include <net/ipv6.h>
  21 #include <net/route.h>
  22 #include <net/tcp.h>
  23
  24 #include <linux/netfilter_ipv4/ip_tables.h>
  25 #include <linux/netfilter_ipv6/ip6_tables.h>
  26 #include <linux/netfilter/x_tables.h>
  27 #include <linux/netfilter/xt_tcpudp.h>
  28 #include <linux/netfilter/xt_TCPMSS.h>
  29
  30 MODULE_LICENSE("GPL");
  31 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
  32 MODULE_DESCRIPTION("Xtables: TCP Maximum Segment Size (MSS) adjustment");
  33 MODULE_ALIAS("ipt_TCPMSS");
  34 MODULE_ALIAS("ip6t_TCPMSS");
  35
  36 static inline unsigned int
  37 optlen(const u_int8_t *opt, unsigned int offset)
  38 {
  39         /* Beware zero-length options: make finite progress */
  40         if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
  41                 return 1;
  42         else
  43                 return opt[offset+1];
  44 }
  45
  46 static int
  47 tcpmss_mangle_packet(struct sk_buff *skb,
  48                      const struct xt_action_param *par,
  49                      unsigned int in_mtu,
  50                      unsigned int tcphoff,
  51                      unsigned int minlen)
  52 {
  53         const struct xt_tcpmss_info *info = par->targinfo;
  54         struct tcphdr *tcph;
  55         unsigned int tcplen, i;
  56         __be16 oldval;
  57         u16 newmss;
  58         u8 *opt;
  59
  60         /* This is a fragment, no TCP header is available */
  61         if (par->fragoff != 0)
  62                 return XT_CONTINUE;
  63
  64         if (!skb_make_writable(skb, skb->len))
  65                 return -1;
  66
  67         tcplen = skb->len - tcphoff;
  68         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
  69
  70         /* Header cannot be larger than the packet */
  71         if (tcplen < tcph->doff*4)
  72                 return -1;
  73
  74         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
  75                 if (dst_mtu(skb_dst(skb)) <= minlen) {
  76                         net_err_ratelimited("unknown or invalid path-MTU (%u)\n",
  77                                             dst_mtu(skb_dst(skb)));
  78                         return -1;
  79                 }
  80                 if (in_mtu <= minlen) {
  81                         net_err_ratelimited("unknown or invalid path-MTU (%u)\n",
  82                                             in_mtu);
  83                         return -1;
  84                 }
  85                 newmss = min(dst_mtu(skb_dst(skb)), in_mtu) - minlen;
  86         } else
  87                 newmss = info->mss;
  88
  89         opt = (u_int8_t *)tcph;
  90         for (i = sizeof(struct tcphdr); i < tcph->doff*4; i += optlen(opt, i)) {
  91                 if (opt[i] == TCPOPT_MSS && tcph->doff*4 - i >= TCPOLEN_MSS &&
  92                     opt[i+1] == TCPOLEN_MSS) {
  93                         u_int16_t oldmss;
  94
  95                         oldmss = (opt[i+2] << 8) | opt[i+3];
  96
  97                         /* Never increase MSS, even when setting it, as
  98                          * doing so results in problems for hosts that rely
  99                          * on MSS being set correctly.
 100                          */
 101                         if (oldmss <= newmss)
 102                                 return 0;
 103
 104                         opt[i+2] = (newmss & 0xff00) >> 8;
 105                         opt[i+3] = newmss & 0x00ff;
 106
 107                         inet_proto_csum_replace2(&tcph->check, skb,
 108                                                  htons(oldmss), htons(newmss),
 109                                                  0);
 110                         return 0;
 111                 }
 112         }
 113
 114         /* There is data after the header so the option can't be added
 115            without moving it, and doing so may make the SYN packet
 116            itself too large. Accept the packet unmodified instead. */
 117         if (tcplen > tcph->doff*4)
 118                 return 0;
 119
 120         /*
 121          * MSS Option not found ?! add it..
 122          */
 123         if (skb_tailroom(skb) < TCPOLEN_MSS) {
 124                 if (pskb_expand_head(skb, 0,
 125                                      TCPOLEN_MSS - skb_tailroom(skb),
 126                                      GFP_ATOMIC))
 127                         return -1;
 128                 tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 129         }
 130
 131         skb_put(skb, TCPOLEN_MSS);
 132
 133         /*
 134          * IPv4: RFC 1122 states "If an MSS option is not received at
 135          * connection setup, TCP MUST assume a default send MSS of 536".
 136          * IPv6: RFC 2460 states IPv6 has a minimum MTU of 1280 and a minimum
 137          * length IPv6 header of 60, ergo the default MSS value is 1220
 138          * Since no MSS was provided, we must use the default values
 139          */
 140         if (par->family == NFPROTO_IPV4)
 141                 newmss = min(newmss, (u16)536);
 142         else
 143                 newmss = min(newmss, (u16)1220);
 144
 145         opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
 146         memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
 147
 148         inet_proto_csum_replace2(&tcph->check, skb,
 149                                  htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
 150         opt[0] = TCPOPT_MSS;
 151         opt[1] = TCPOLEN_MSS;
 152         opt[2] = (newmss & 0xff00) >> 8;
 153         opt[3] = newmss & 0x00ff;
 154
 155         inet_proto_csum_replace4(&tcph->check, skb, 0, *((__be32 *)opt), 0);
 156
 157         oldval = ((__be16 *)tcph)[6];
 158         tcph->doff += TCPOLEN_MSS/4;
 159         inet_proto_csum_replace2(&tcph->check, skb,
 160                                  oldval, ((__be16 *)tcph)[6], 0);
 161         return TCPOLEN_MSS;
 162 }
 163
 164 static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
 165                                     unsigned int family)
 166 {
 167         struct flowi fl;
 168         const struct nf_afinfo *ai;
 169         struct rtable *rt = NULL;
 170         u_int32_t mtu     = ~0U;
 171
 172         if (family == PF_INET) {
 173                 struct flowi4 *fl4 = &fl.u.ip4;
 174                 memset(fl4, 0, sizeof(*fl4));
 175                 fl4->daddr = ip_hdr(skb)->saddr;
 176         } else {
 177                 struct flowi6 *fl6 = &fl.u.ip6;
 178
 179                 memset(fl6, 0, sizeof(*fl6));
 180                 fl6->daddr = ipv6_hdr(skb)->saddr;
 181         }
 182         rcu_read_lock();
 183         ai = nf_get_afinfo(family);
 184         if (ai != NULL)
 185                 ai->route(&init_net, (struct dst_entry **)&rt, &fl, false);
 186         rcu_read_unlock();
 187
 188         if (rt != NULL) {
 189                 mtu = dst_mtu(&rt->dst);
 190                 dst_release(&rt->dst);
 191         }
 192         return mtu;
 193 }
 194
 195 static unsigned int
 196 tcpmss_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 197 {
 198         struct iphdr *iph = ip_hdr(skb);
 199         __be16 newlen;
 200         int ret;
 201
 202         ret = tcpmss_mangle_packet(skb, par,
 203                                    tcpmss_reverse_mtu(skb, PF_INET),
 204                                    iph->ihl * 4,
 205                                    sizeof(*iph) + sizeof(struct tcphdr));
 206         if (ret < 0)
 207                 return NF_DROP;
 208         if (ret > 0) {
 209                 iph = ip_hdr(skb);
 210                 newlen = htons(ntohs(iph->tot_len) + ret);
 211                 csum_replace2(&iph->check, iph->tot_len, newlen);
 212                 iph->tot_len = newlen;
 213         }
 214         return XT_CONTINUE;
 215 }
 216
 217 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 218 static unsigned int
 219 tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 220 {
 221         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 222         u8 nexthdr;
 223         __be16 frag_off;
 224         int tcphoff;
 225         int ret;
 226
 227         nexthdr = ipv6h->nexthdr;
 228         tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
 229         if (tcphoff < 0)
 230                 return NF_DROP;
 231         ret = tcpmss_mangle_packet(skb, par,
 232                                    tcpmss_reverse_mtu(skb, PF_INET6),
 233                                    tcphoff,
 234                                    sizeof(*ipv6h) + sizeof(struct tcphdr));
 235         if (ret < 0)
 236                 return NF_DROP;
 237         if (ret > 0) {
 238                 ipv6h = ipv6_hdr(skb);
 239                 ipv6h->payload_len = htons(ntohs(ipv6h->payload_len) + ret);
 240         }
 241         return XT_CONTINUE;
 242 }
 243 #endif
 244
 245 /* Must specify -p tcp --syn */
 246 static inline bool find_syn_match(const struct xt_entry_match *m)
 247 {
 248         const struct xt_tcp *tcpinfo = (const struct xt_tcp *)m->data;
 249
 250         if (strcmp(m->u.kernel.match->name, "tcp") == 0 &&
 251             tcpinfo->flg_cmp & TCPHDR_SYN &&
 252             !(tcpinfo->invflags & XT_TCP_INV_FLAGS))
 253                 return true;
 254
 255         return false;
 256 }
 257
 258 static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
 259 {
 260         const struct xt_tcpmss_info *info = par->targinfo;
 261         const struct ipt_entry *e = par->entryinfo;
 262         const struct xt_entry_match *ematch;
 263
 264         if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
 265             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
 266                            (1 << NF_INET_LOCAL_OUT) |
 267                            (1 << NF_INET_POST_ROUTING))) != 0) {
 268                 pr_info("path-MTU clamping only supported in "
 269                         "FORWARD, OUTPUT and POSTROUTING hooks\n");
 270                 return -EINVAL;
 271         }
 272         xt_ematch_foreach(ematch, e)
 273                 if (find_syn_match(ematch))
 274                         return 0;
 275         pr_info("Only works on TCP SYN packets\n");
 276         return -EINVAL;
 277 }
 278
 279 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 280 static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
 281 {
 282         const struct xt_tcpmss_info *info = par->targinfo;
 283         const struct ip6t_entry *e = par->entryinfo;
 284         const struct xt_entry_match *ematch;
 285
 286         if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
 287             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
 288                            (1 << NF_INET_LOCAL_OUT) |
 289                            (1 << NF_INET_POST_ROUTING))) != 0) {
 290                 pr_info("path-MTU clamping only supported in "
 291                         "FORWARD, OUTPUT and POSTROUTING hooks\n");
 292                 return -EINVAL;
 293         }
 294         xt_ematch_foreach(ematch, e)
 295                 if (find_syn_match(ematch))
 296                         return 0;
 297         pr_info("Only works on TCP SYN packets\n");
 298         return -EINVAL;
 299 }
 300 #endif
 301
 302 static struct xt_target tcpmss_tg_reg[] __read_mostly = {
 303         {
 304                 .family         = NFPROTO_IPV4,
 305                 .name           = "TCPMSS",
 306                 .checkentry     = tcpmss_tg4_check,
 307                 .target         = tcpmss_tg4,
 308                 .targetsize     = sizeof(struct xt_tcpmss_info),
 309                 .proto          = IPPROTO_TCP,
 310                 .me             = THIS_MODULE,
 311         },
 312 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 313         {
 314                 .family         = NFPROTO_IPV6,
 315                 .name           = "TCPMSS",
 316                 .checkentry     = tcpmss_tg6_check,
 317                 .target         = tcpmss_tg6,
 318                 .targetsize     = sizeof(struct xt_tcpmss_info),
 319                 .proto          = IPPROTO_TCP,
 320                 .me             = THIS_MODULE,
 321         },
 322 #endif
 323 };
 324
 325 static int __init tcpmss_tg_init(void)
 326 {
 327         return xt_register_targets(tcpmss_tg_reg, ARRAY_SIZE(tcpmss_tg_reg));
 328 }
 329
 330 static void __exit tcpmss_tg_exit(void)
 331 {
 332         xt_unregister_targets(tcpmss_tg_reg, ARRAY_SIZE(tcpmss_tg_reg));
 333 }
 334
 335 module_init(tcpmss_tg_init);
 336 module_exit(tcpmss_tg_exit);