From e4076172c33810472d9d658554588b6e379a4fbe Mon Sep 17 00:00:00 2001 From: Arnaud Ebalard Date: Tue, 16 Jan 2007 14:19:20 +0000 Subject: Add ip6tables TCPMSS extension (Arnaud Ebalard ) Kernel part will go in 2.6.21. --- extensions/libip6t_TCPMSS.c | 134 +++++++++++++++++++++++++++++ extensions/libip6t_TCPMSS.man | 42 +++++++++ include/linux/netfilter_ipv6/ip6t_TCPMSS.h | 10 +++ 3 files changed, 186 insertions(+) create mode 100644 extensions/libip6t_TCPMSS.c create mode 100644 extensions/libip6t_TCPMSS.man create mode 100644 include/linux/netfilter_ipv6/ip6t_TCPMSS.h diff --git a/extensions/libip6t_TCPMSS.c b/extensions/libip6t_TCPMSS.c new file mode 100644 index 00000000..7fcccd5c --- /dev/null +++ b/extensions/libip6t_TCPMSS.c @@ -0,0 +1,134 @@ +/* Shared library add-on to iptables to add TCPMSS target support. + * + * Copyright (c) 2000 Marc Boucher +*/ +#include +#include +#include +#include + +#include +#include +#include + +struct mssinfo { + struct ip6t_entry_target t; + struct ip6t_tcpmss_info mss; +}; + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"TCPMSS target v%s mutually-exclusive options:\n" +" --set-mss value explicitly set MSS option to specified value\n" +" --clamp-mss-to-pmtu automatically clamp MSS value to (path_MTU - 60)\n", +IPTABLES_VERSION); +} + +static struct option opts[] = { + { "set-mss", 1, 0, '1' }, + { "clamp-mss-to-pmtu", 0, 0, '2' }, + { 0 } +}; + +/* Initialize the target. */ +static void +init(struct ip6t_entry_target *t, unsigned int *nfcache) +{ +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + struct ip6t_entry_target **target) +{ + struct ip6t_tcpmss_info *mssinfo + = (struct ip6t_tcpmss_info *)(*target)->data; + + switch (c) { + unsigned int mssval; + + case '1': + if (*flags) + exit_error(PARAMETER_PROBLEM, + "TCPMSS target: Only one option may be specified"); + if (string_to_number(optarg, 0, 65535 - 60, &mssval) == -1) + exit_error(PARAMETER_PROBLEM, "Bad TCPMSS value `%s'", optarg); + + mssinfo->mss = mssval; + *flags = 1; + break; + + case '2': + if (*flags) + exit_error(PARAMETER_PROBLEM, + "TCPMSS target: Only one option may be specified"); + mssinfo->mss = IP6T_TCPMSS_CLAMP_PMTU; + *flags = 1; + break; + + default: + return 0; + } + + return 1; +} + +static void +final_check(unsigned int flags) +{ + if (!flags) + exit_error(PARAMETER_PROBLEM, + "TCPMSS target: At least one parameter is required"); +} + +/* Prints out the targinfo. */ +static void +print(const struct ip6t_ip6 *ip6, + const struct ip6t_entry_target *target, + int numeric) +{ + const struct ip6t_tcpmss_info *mssinfo = + (const struct ip6t_tcpmss_info *)target->data; + if(mssinfo->mss == IP6T_TCPMSS_CLAMP_PMTU) + printf("TCPMSS clamp to PMTU "); + else + printf("TCPMSS set %u ", mssinfo->mss); +} + +/* Saves the union ip6t_targinfo in parsable form to stdout. */ +static void +save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target) +{ + const struct ip6t_tcpmss_info *mssinfo = + (const struct ip6t_tcpmss_info *)target->data; + + if(mssinfo->mss == IP6T_TCPMSS_CLAMP_PMTU) + printf("--clamp-mss-to-pmtu "); + else + printf("--set-mss %u ", mssinfo->mss); +} + +static struct ip6tables_target mss = { + .next = NULL, + .name = "TCPMSS", + .version = IPTABLES_VERSION, + .size = IP6T_ALIGN(sizeof(struct ip6t_tcpmss_info)), + .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_tcpmss_info)), + .help = &help, + .init = &init, + .parse = &parse, + .final_check = &final_check, + .print = &print, + .save = &save, + .extra_opts = opts +}; + +void _init(void) +{ + register_target6(&mss); +} diff --git a/extensions/libip6t_TCPMSS.man b/extensions/libip6t_TCPMSS.man new file mode 100644 index 00000000..b4c357e8 --- /dev/null +++ b/extensions/libip6t_TCPMSS.man @@ -0,0 +1,42 @@ +This target allows to alter the MSS value of TCP SYN packets, to control +the maximum size for that connection (usually limiting it to your +outgoing interface's MTU minus 60). Of course, it can only be used +in conjunction with +.BR "-p tcp" . +It is only valid in the +.BR mangle +table. +.br +This target is used to overcome criminally braindead ISPs or servers +which block ICMPv6 Packet Too Big packets or are unable to send them. +The symptoms of this problem are that everything works fine from your +Linux firewall/router, but machines behind it can never exchange large +packets: +.PD 0 +.RS 0.1i +.TP 0.3i +1) +Web browsers connect, then hang with no data received. +.TP +2) +Small mail works fine, but large emails hang. +.TP +3) +ssh works fine, but scp hangs after initial handshaking. +.RE +.PD +Workaround: activate this option and add a rule to your firewall +configuration like: +.nf + ip6tables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\ + -j TCPMSS --clamp-mss-to-pmtu +.fi +.TP +.BI "--set-mss " "value" +Explicitly set MSS option to specified value. +.TP +.B "--clamp-mss-to-pmtu" +Automatically clamp MSS value to (path_MTU - 60). +.TP +These options are mutually exclusive. + diff --git a/include/linux/netfilter_ipv6/ip6t_TCPMSS.h b/include/linux/netfilter_ipv6/ip6t_TCPMSS.h new file mode 100644 index 00000000..412d1cbc --- /dev/null +++ b/include/linux/netfilter_ipv6/ip6t_TCPMSS.h @@ -0,0 +1,10 @@ +#ifndef _IP6T_TCPMSS_H +#define _IP6T_TCPMSS_H + +struct ip6t_tcpmss_info { + u_int16_t mss; +}; + +#define IP6T_TCPMSS_CLAMP_PMTU 0xffff + +#endif /*_IP6T_TCPMSS_H*/ -- cgit v1.2.3