From patchwork Mon Jun 10 12:30:38 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Phil Oester X-Patchwork-Id: 250664 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 79F952C008C for ; Wed, 12 Jun 2013 13:43:26 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751436Ab3FLDnY (ORCPT ); Tue, 11 Jun 2013 23:43:24 -0400 Received: from mail-pd0-f173.google.com ([209.85.192.173]:44024 "EHLO mail-pd0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750994Ab3FLDnY (ORCPT ); Tue, 11 Jun 2013 23:43:24 -0400 Received: by mail-pd0-f173.google.com with SMTP id v14so5493786pde.32 for ; Tue, 11 Jun 2013 20:43:24 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent:x-gm-message-state; bh=cKEcT32ntwKhOve/507j34Z8GTzE3bzUKUnpKWC9gYY=; b=W/RBvwjCLNhkaZPumABeBxtu84O+Nlbm7/LAKmv9TQaAf8Kxiw6L6RIMWYt9oy4sgi mZXZch47y7oGyTSSemPuPoipTPXIdRvdHskHLTUN8R9iGk4xUc7h8yLpC/DcrJBLf+Ll 5lSEwqFh+Nn0GKWuYOOlEyQn8TUiJjQXpffciVZ++ustZob/KeUHddDPyw5Uhzn5vVZE K6QQBjAMYKVJXJXod1ZJtZCm95FHOJCUqGCJImmjK2mefVytCKiTXR439IGFi5JKUzb4 IH335DNV0BmW51Z9u4THyFzH1ADQOxnXLQefwRZZ7Vp2+iH6rkGKE0HNJbjvxoIApcNW /SLw== X-Received: by 10.68.231.37 with SMTP id td5mr17957628pbc.52.1371008604002; Tue, 11 Jun 2013 20:43:24 -0700 (PDT) Received: from gmail.com (pool-71-105-239-63.lsanca.fios.verizon.net. [71.105.239.63]) by mx.google.com with ESMTPSA id nk2sm17253788pbc.43.2013.06.11.20.43.22 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 11 Jun 2013 20:43:23 -0700 (PDT) Date: Mon, 10 Jun 2013 08:30:38 -0400 From: Phil Oester To: netfilter-devel@vger.kernel.org Cc: pablo@netfilter.org Subject: [PATCH] netfilter: xt_TCPMSS: Add IPv6 default MSS Message-ID: <20130610123038.GA5089@gmail.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Gm-Message-State: ALoCoQlXuzSCcZBj1E80+mgE3NTeBEuYBmbdMFD//wj2ynr5tCvZcp6Seoa0KNy7DKdkX8ljOA/H Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org As a followup to commit 409b545a ("netfilter: xt_TCPMSS: Fix violation of RFC879 in absence of MSS option"), John Heffner points out that IPv6 has a higher MTU than IPv4, and thus a higher minimum MSS. Update TCPMSS target to account for this, and update RFC comment. Phil Signed-off-by: Phil Oester diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c index 53af7db..f123cbd 100644 --- a/net/netfilter/xt_TCPMSS.c +++ b/net/netfilter/xt_TCPMSS.c @@ -48,7 +48,8 @@ tcpmss_mangle_packet(struct sk_buff *skb, const struct xt_tcpmss_info *info, unsigned int in_mtu, unsigned int tcphoff, - unsigned int minlen) + unsigned int minlen, + unsigned int family) { struct tcphdr *tcph; unsigned int tcplen, i; @@ -126,11 +127,16 @@ tcpmss_mangle_packet(struct sk_buff *skb, skb_put(skb, TCPOLEN_MSS); /* - * RFC 879 states that the default MSS is 536 without specific - * knowledge that the destination host is prepared to accept larger. - * Since no MSS was provided, we MUST NOT set a value > 536. + * IPv4: RFC 1122 states "If an MSS option is not received at connection + * setup, TCP MUST assume a default send MSS of 536". + * IPv6: RFC 2460 states IPv6 has a minimum MTU of 1280 and a minimum + * length IPv6 header of 60, ergo the default MSS value is 1220 + * Since no MSS was provided, we must use the default values */ - newmss = min(newmss, (u16)536); + if (family == PF_INET) + newmss=min(newmss, (u16)536); + else + newmss=min(newmss, (u16)1220); opt = (u_int8_t *)tcph + sizeof(struct tcphdr); memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr)); @@ -192,7 +198,8 @@ tcpmss_tg4(struct sk_buff *skb, const struct xt_action_param *par) ret = tcpmss_mangle_packet(skb, par->targinfo, tcpmss_reverse_mtu(skb, PF_INET), iph->ihl * 4, - sizeof(*iph) + sizeof(struct tcphdr)); + sizeof(*iph) + sizeof(struct tcphdr), + PF_INET); if (ret < 0) return NF_DROP; if (ret > 0) { @@ -221,7 +228,8 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par) ret = tcpmss_mangle_packet(skb, par->targinfo, tcpmss_reverse_mtu(skb, PF_INET6), tcphoff, - sizeof(*ipv6h) + sizeof(struct tcphdr)); + sizeof(*ipv6h) + sizeof(struct tcphdr), + PF_INET6); if (ret < 0) return NF_DROP; if (ret > 0) {