Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37c08387 authored by Jan Engelhardt's avatar Jan Engelhardt Committed by David S. Miller
Browse files

[NETFILTER]: xt_TCPMSS: consider reverse route's MTU in clamp-to-pmtu 



The TCPMSS target in Xtables should consider the MTU of the reverse
route on forwarded packets as part of the path MTU.

Point in case: IN=ppp0, OUT=eth0. MSS set to 1460 in spite of MTU of
ppp0 being 1392.

Signed-off-by: default avatarJan Engelhardt <jengelh@computergmbh.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent df200969

net/netfilter/xt_TCPMSS.c

+59 −3
Original line number Diff line number Diff line
@@ -13,7 +13,10 @@ 
#include <linux/ip.h>

#include <linux/ipv6.h>

#include <linux/tcp.h>

#include <net/dst.h>

#include <net/flow.h>

#include <net/ipv6.h>

#include <net/route.h>

#include <net/tcp.h>



#include <linux/netfilter_ipv4/ip_tables.h>
@@ -41,6 +44,7 @@ optlen(const u_int8_t *opt, unsigned int offset) 
static int

tcpmss_mangle_packet(struct sk_buff *skb,

		     const struct xt_tcpmss_info *info,

		     unsigned int in_mtu,

		     unsigned int tcphoff,

		     unsigned int minlen)

{
@@ -76,7 +80,13 @@ tcpmss_mangle_packet(struct sk_buff *skb, 
				       dst_mtu(skb->dst));

			return -1;

		}

		newmss = dst_mtu(skb->dst) - minlen;

		if (in_mtu <= minlen) {

			if (net_ratelimit())

				printk(KERN_ERR "xt_TCPMSS: unknown or "

				       "invalid path-MTU (%u)\n", in_mtu);

			return -1;

		}

		newmss = min(dst_mtu(skb->dst), in_mtu) - minlen;

	} else

		newmss = info->mss;
@@ -137,6 +147,28 @@ tcpmss_mangle_packet(struct sk_buff *skb, 
	return TCPOLEN_MSS;

}



static u_int32_t tcpmss_reverse_mtu4(const struct iphdr *iph)

{

	struct flowi fl = {

		.fl4_dst = iph->saddr,

	};

	const struct nf_afinfo *ai;

	struct rtable *rt = NULL;

	u_int32_t mtu     = ~0U;



	rcu_read_lock();

	ai = nf_get_afinfo(AF_INET);

	if (ai != NULL)

		ai->route((struct dst_entry **)&rt, &fl);

	rcu_read_unlock();



	if (rt != NULL) {

		mtu = dst_mtu(&rt->u.dst);

		dst_release(&rt->u.dst);

	}

	return mtu;

}



static unsigned int

tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,

           const struct net_device *out, unsigned int hooknum,
@@ -146,7 +178,8 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in, 
	__be16 newlen;

	int ret;



	ret = tcpmss_mangle_packet(skb, targinfo, iph->ihl * 4,

	ret = tcpmss_mangle_packet(skb, targinfo, tcpmss_reverse_mtu4(iph),

				   iph->ihl * 4,

				   sizeof(*iph) + sizeof(struct tcphdr));

	if (ret < 0)

		return NF_DROP;
@@ -160,6 +193,28 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in, 
}



#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)

static u_int32_t tcpmss_reverse_mtu6(const struct ipv6hdr *iph)

{

	struct flowi fl = {

		.fl6_dst = iph->saddr,

	};

	const struct nf_afinfo *ai;

	struct rtable *rt = NULL;

	u_int32_t mtu     = ~0U;



	rcu_read_lock();

	ai = nf_get_afinfo(AF_INET6);

	if (ai != NULL)

		ai->route((struct dst_entry **)&rt, &fl);

	rcu_read_unlock();



	if (rt != NULL) {

		mtu = dst_mtu(&rt->u.dst);

		dst_release(&rt->u.dst);

	}

	return mtu;

}



static unsigned int

tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,

           const struct net_device *out, unsigned int hooknum,
@@ -174,7 +229,8 @@ tcpmss_tg6(struct sk_buff *skb, const struct net_device *in, 
	tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);

	if (tcphoff < 0)

		return NF_DROP;

	ret = tcpmss_mangle_packet(skb, targinfo, tcphoff,

	ret = tcpmss_mangle_packet(skb, targinfo, tcpmss_reverse_mtu6(ipv6h),

				   tcphoff,

				   sizeof(*ipv6h) + sizeof(struct tcphdr));

	if (ret < 0)

		return NF_DROP;