netfilter: xt_TCPMSS: Add IPv6 default MSS
Subsystems (2)
PATCH 1/1 netfilter: xt_TCPMSS: Add IPv6 default MSS
As a followup to commit 409b545a ("netfilter: xt_TCPMSS: Fix violation of RFC879 in absence of MSS option"), John Heffner points out that IPv6 has a higher MTU than IPv4, and thus a higher minimum MSS. Update TCPMSS target to account for this, and update RFC comment.
Phil
Signed-off-by Phil Oester <[email protected]>
net/netfilter/xt_TCPMSS.c +15 -7
@@ -48,7 +48,8 @@ tcpmss_mangle_packet(struct sk_buff *skb,const struct xt_tcpmss_info *info, unsigned int in_mtu, unsigned int tcphoff, - unsigned int minlen) + unsigned int minlen, + unsigned int family) { struct tcphdr *tcph;unsigned int tcplen, i;
@@ -126,11 +127,16 @@ tcpmss_mangle_packet(struct sk_buff *skb,skb_put (skb,TCPOLEN_MSS );/* -* RFC 879 states that the default MSS is 536 without specific -* knowledge that the destination host is prepared to accept larger. -* Since no MSS was provided, we MUST NOT set a value > 536. +* IPv4: RFC 1122 states "If an MSS option is not received at connection +* setup, TCP MUST assume a default send MSS of 536". +* IPv6: RFC 2460 states IPv6 has a minimum MTU of 1280 and a minimum +* length IPv6 header of 60, ergo the default MSS value is 1220 +* Since no MSS was provided, we must use the default values */ - newmss =min (newmss, (u16 )536 ); +if (family ==PF_INET ) + newmss=min (newmss, (u16 )536 ); +else + newmss=min (newmss, (u16 )1220 ); opt = (u_int8_t *)tcph +sizeof (struct tcphdr );memmove (opt +TCPOLEN_MSS , opt, tcplen -sizeof (struct tcphdr ));
@@ -192,7 +198,8 @@ tcpmss_tg4(struct sk_buff *skb, const struct xt_action_param *par) ret =tcpmss_mangle_packet (skb, par->targinfo,tcpmss_reverse_mtu (skb,PF_INET ), iph->ihl *4 , -sizeof (*iph) +sizeof (struct tcphdr )); +sizeof (*iph) +sizeof (struct tcphdr ), +PF_INET );if (ret <0 )return NF_DROP ;if (ret >0 ) {
@@ -221,7 +228,8 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par) ret =tcpmss_mangle_packet (skb, par->targinfo,tcpmss_reverse_mtu (skb,PF_INET6 ), tcphoff, -sizeof (*ipv6h) +sizeof (struct tcphdr )); +sizeof (*ipv6h) +sizeof (struct tcphdr ), +PF_INET6 );if (ret <0 )return NF_DROP ;if (ret >0 ) {
Quoted 4 lines · Phil Oester
As a followup to commit
409b545a("netfilter:xt_TCPMSS: Fix violation of RFC879 in absence of MSS option"), John Heffner points out that IPv6 has a higher MTU than IPv4, and thus a higher minimum MSS. Update TCPMSS target to account for this, and update RFC comment.
Applied, thanks.
Made some little mangling to pass the xt param.