include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit...

[mv-sheeva.git] / net / netfilter / xt_TCPMSS.c

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index eda64c1cb1e5e9f430d4c44e1858ee9096659f92..c5f4b9919e9a016ef3f3428440e2446571293920 100644 (file)
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/gfp.h>
 #include <linux/ipv6.h>
 #include <linux/tcp.h>
 #include <net/dst.h>
@@ -60,17 +61,9 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        tcplen = skb->len - tcphoff;
        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 
-       /* Since it passed flags test in tcp match, we know it is is
-          not a fragment, and has data >= tcp header length.  SYN
-          packets should not contain data: if they did, then we risk
-          running over MTU, sending Frag Needed and breaking things
-          badly. --RR */
-       if (tcplen != tcph->doff*4) {
-               if (net_ratelimit())
-                       printk(KERN_ERR "xt_TCPMSS: bad length (%u bytes)\n",
-                              skb->len);
+       /* Header cannot be larger than the packet */
+       if (tcplen < tcph->doff*4)
                return -1;
-       }
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
                if (dst_mtu(skb_dst(skb)) <= minlen) {
@@ -115,6 +108,12 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                }
        }
 
+       /* There is data after the header so the option can't be added
+          without moving it, and doing so may make the SYN packet
+          itself too large. Accept the packet unmodified instead. */
+       if (tcplen > tcph->doff*4)
+               return 0;
+
        /*
         * MSS Option not found ?! add it..
         */
@@ -241,6 +240,7 @@ static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
 {
        const struct xt_tcpmss_info *info = par->targinfo;
        const struct ipt_entry *e = par->entryinfo;
+       const struct xt_entry_match *ematch;
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
            (par->hook_mask & ~((1 << NF_INET_FORWARD) |
@@ -250,8 +250,9 @@ static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
                       "FORWARD, OUTPUT and POSTROUTING hooks\n");
                return false;
        }
-       if (IPT_MATCH_ITERATE(e, find_syn_match))
-               return true;
+       xt_ematch_foreach(ematch, e)
+               if (find_syn_match(ematch))
+                       return true;
        printk("xt_TCPMSS: Only works on TCP SYN packets\n");
        return false;
 }
@@ -261,6 +262,7 @@ static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
 {
        const struct xt_tcpmss_info *info = par->targinfo;
        const struct ip6t_entry *e = par->entryinfo;
+       const struct xt_entry_match *ematch;
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
            (par->hook_mask & ~((1 << NF_INET_FORWARD) |
@@ -270,8 +272,9 @@ static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
                       "FORWARD, OUTPUT and POSTROUTING hooks\n");
                return false;
        }
-       if (IP6T_MATCH_ITERATE(e, find_syn_match))
-               return true;
+       xt_ematch_foreach(ematch, e)
+               if (find_syn_match(ematch))
+                       return true;
        printk("xt_TCPMSS: Only works on TCP SYN packets\n");
        return false;
 }