xt_TCPOPTSTRIP.c 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * A module for stripping a specific TCP option from TCP packets.
  4. *
  5. * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
  6. * Copyright © CC Computer Consultants GmbH, 2007
  7. */
  8. #include <linux/module.h>
  9. #include <linux/skbuff.h>
  10. #include <linux/ip.h>
  11. #include <linux/ipv6.h>
  12. #include <linux/tcp.h>
  13. #include <net/ipv6.h>
  14. #include <net/tcp.h>
  15. #include <linux/netfilter/x_tables.h>
  16. #include <linux/netfilter/xt_TCPOPTSTRIP.h>
  17. static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
  18. {
  19. /* Beware zero-length options: make finite progress */
  20. if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
  21. return 1;
  22. else
  23. return opt[offset+1];
  24. }
  25. static unsigned int
  26. tcpoptstrip_mangle_packet(struct sk_buff *skb,
  27. const struct xt_action_param *par,
  28. unsigned int tcphoff)
  29. {
  30. const struct xt_tcpoptstrip_target_info *info = par->targinfo;
  31. struct tcphdr *tcph, _th;
  32. unsigned int optl, i, j;
  33. u_int16_t n, o;
  34. u_int8_t *opt;
  35. int tcp_hdrlen;
  36. /* This is a fragment, no TCP header is available */
  37. if (par->fragoff != 0)
  38. return XT_CONTINUE;
  39. tcph = skb_header_pointer(skb, tcphoff, sizeof(_th), &_th);
  40. if (!tcph)
  41. return NF_DROP;
  42. tcp_hdrlen = tcph->doff * 4;
  43. if (tcp_hdrlen < sizeof(struct tcphdr))
  44. return NF_DROP;
  45. if (skb_ensure_writable(skb, tcphoff + tcp_hdrlen))
  46. return NF_DROP;
  47. /* must reload tcph, might have been moved */
  48. tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
  49. opt = (u8 *)tcph;
  50. /*
  51. * Walk through all TCP options - if we find some option to remove,
  52. * set all octets to %TCPOPT_NOP and adjust checksum.
  53. */
  54. for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
  55. optl = optlen(opt, i);
  56. if (i + optl > tcp_hdrlen)
  57. break;
  58. if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
  59. continue;
  60. for (j = 0; j < optl; ++j) {
  61. o = opt[i+j];
  62. n = TCPOPT_NOP;
  63. if ((i + j) % 2 == 0) {
  64. o <<= 8;
  65. n <<= 8;
  66. }
  67. inet_proto_csum_replace2(&tcph->check, skb, htons(o),
  68. htons(n), false);
  69. }
  70. memset(opt + i, TCPOPT_NOP, optl);
  71. }
  72. return XT_CONTINUE;
  73. }
  74. static unsigned int
  75. tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
  76. {
  77. return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb));
  78. }
  79. #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
  80. static unsigned int
  81. tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
  82. {
  83. struct ipv6hdr *ipv6h = ipv6_hdr(skb);
  84. int tcphoff;
  85. u_int8_t nexthdr;
  86. __be16 frag_off;
  87. nexthdr = ipv6h->nexthdr;
  88. tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
  89. if (tcphoff < 0)
  90. return NF_DROP;
  91. return tcpoptstrip_mangle_packet(skb, par, tcphoff);
  92. }
  93. #endif
  94. static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
  95. {
  96. .name = "TCPOPTSTRIP",
  97. .family = NFPROTO_IPV4,
  98. .table = "mangle",
  99. .proto = IPPROTO_TCP,
  100. .target = tcpoptstrip_tg4,
  101. .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
  102. .me = THIS_MODULE,
  103. },
  104. #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
  105. {
  106. .name = "TCPOPTSTRIP",
  107. .family = NFPROTO_IPV6,
  108. .table = "mangle",
  109. .proto = IPPROTO_TCP,
  110. .target = tcpoptstrip_tg6,
  111. .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
  112. .me = THIS_MODULE,
  113. },
  114. #endif
  115. };
  116. static int __init tcpoptstrip_tg_init(void)
  117. {
  118. return xt_register_targets(tcpoptstrip_tg_reg,
  119. ARRAY_SIZE(tcpoptstrip_tg_reg));
  120. }
  121. static void __exit tcpoptstrip_tg_exit(void)
  122. {
  123. xt_unregister_targets(tcpoptstrip_tg_reg,
  124. ARRAY_SIZE(tcpoptstrip_tg_reg));
  125. }
  126. module_init(tcpoptstrip_tg_init);
  127. module_exit(tcpoptstrip_tg_exit);
  128. MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
  129. MODULE_DESCRIPTION("Xtables: TCP option stripping");
  130. MODULE_LICENSE("GPL");
  131. MODULE_ALIAS("ipt_TCPOPTSTRIP");
  132. MODULE_ALIAS("ip6t_TCPOPTSTRIP");