netfilter: xtables: make use of caller family rather than target family

[safe/jmp/linux-2.6] / net / netfilter / xt_TCPMSS.c

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index eda64c1..2077da3 100644 (file)
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -7,7 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
@@ -60,29 +60,21 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        tcplen = skb->len - tcphoff;
        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 
-       /* Since it passed flags test in tcp match, we know it is is
-          not a fragment, and has data >= tcp header length.  SYN
-          packets should not contain data: if they did, then we risk
-          running over MTU, sending Frag Needed and breaking things
-          badly. --RR */
-       if (tcplen != tcph->doff*4) {
-               if (net_ratelimit())
-                       printk(KERN_ERR "xt_TCPMSS: bad length (%u bytes)\n",
-                              skb->len);
+       /* Header cannot be larger than the packet */
+       if (tcplen < tcph->doff*4)
                return -1;
-       }
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
                if (dst_mtu(skb_dst(skb)) <= minlen) {
                        if (net_ratelimit())
-                               printk(KERN_ERR "xt_TCPMSS: "
+                               pr_err("xt_TCPMSS: "
                                       "unknown or invalid path-MTU (%u)\n",
                                       dst_mtu(skb_dst(skb)));
                        return -1;
                }
                if (in_mtu <= minlen) {
                        if (net_ratelimit())
-                               printk(KERN_ERR "xt_TCPMSS: unknown or "
+                               pr_err("xt_TCPMSS: unknown or "
                                       "invalid path-MTU (%u)\n", in_mtu);
                        return -1;
                }
@@ -115,6 +107,12 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                }
        }
 
+       /* There is data after the header so the option can't be added
+          without moving it, and doing so may make the SYN packet
+          itself too large. Accept the packet unmodified instead. */
+       if (tcplen > tcph->doff*4)
+               return 0;
+
        /*
         * MSS Option not found ?! add it..
         */
@@ -241,18 +239,20 @@ static bool tcpmss_tg4_check(const struct xt_tgchk_param *par)
 {
        const struct xt_tcpmss_info *info = par->targinfo;
        const struct ipt_entry *e = par->entryinfo;
+       const struct xt_entry_match *ematch;
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
            (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_POST_ROUTING))) != 0) {
-               printk("xt_TCPMSS: path-MTU clamping only supported in "
-                      "FORWARD, OUTPUT and POSTROUTING hooks\n");
+               pr_info("path-MTU clamping only supported in "
+                       "FORWARD, OUTPUT and POSTROUTING hooks\n");
                return false;
        }
-       if (IPT_MATCH_ITERATE(e, find_syn_match))
-               return true;
-       printk("xt_TCPMSS: Only works on TCP SYN packets\n");
+       xt_ematch_foreach(ematch, e)
+               if (find_syn_match(ematch))
+                       return true;
+       pr_info("Only works on TCP SYN packets\n");
        return false;
 }
 
@@ -261,18 +261,20 @@ static bool tcpmss_tg6_check(const struct xt_tgchk_param *par)
 {
        const struct xt_tcpmss_info *info = par->targinfo;
        const struct ip6t_entry *e = par->entryinfo;
+       const struct xt_entry_match *ematch;
 
        if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
            (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_POST_ROUTING))) != 0) {
-               printk("xt_TCPMSS: path-MTU clamping only supported in "
-                      "FORWARD, OUTPUT and POSTROUTING hooks\n");
+               pr_info("path-MTU clamping only supported in "
+                       "FORWARD, OUTPUT and POSTROUTING hooks\n");
                return false;
        }
-       if (IP6T_MATCH_ITERATE(e, find_syn_match))
-               return true;
-       printk("xt_TCPMSS: Only works on TCP SYN packets\n");
+       xt_ematch_foreach(ematch, e)
+               if (find_syn_match(ematch))
+                       return true;
+       pr_info("Only works on TCP SYN packets\n");
        return false;
 }
 #endif