LXR linux/net/netfilter/xt

   1/*
   2 * A module for stripping a specific TCP option from TCP packets.
   3 *
   4 * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
   5 * Copyright © CC Computer Consultants GmbH, 2007
   6 *
   7 * This program is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License version 2 as
   9 * published by the Free Software Foundation.
  10 */
  11
  12#include <linux/module.h>
  13#include <linux/skbuff.h>
  14#include <linux/ip.h>
  15#include <linux/ipv6.h>
  16#include <linux/tcp.h>
  17#include <net/ipv6.h>
  18#include <net/tcp.h>
  19#include <linux/netfilter/x_tables.h>
  20#include <linux/netfilter/xt_TCPOPTSTRIP.h>
  21
  22static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
  23{
  24        /* Beware zero-length options: make finite progress */
  25        if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
  26                return 1;
  27        else
  28                return opt[offset+1];
  29}
  30
  31static unsigned int
  32tcpoptstrip_mangle_packet(struct sk_buff *skb,
  33                          const struct xt_action_param *par,
  34                          unsigned int tcphoff, unsigned int minlen)
  35{
  36        const struct xt_tcpoptstrip_target_info *info = par->targinfo;
  37        unsigned int optl, i, j;
  38        struct tcphdr *tcph;
  39        u_int16_t n, o;
  40        u_int8_t *opt;
  41        int len, tcp_hdrlen;
  42
  43        /* This is a fragment, no TCP header is available */
  44        if (par->fragoff != 0)
  45                return XT_CONTINUE;
  46
  47        if (!skb_make_writable(skb, skb->len))
  48                return NF_DROP;
  49
  50        len = skb->len - tcphoff;
  51        if (len < (int)sizeof(struct tcphdr))
  52                return NF_DROP;
  53
  54        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
  55        tcp_hdrlen = tcph->doff * 4;
  56
  57        if (len < tcp_hdrlen)
  58                return NF_DROP;
  59
  60        opt  = (u_int8_t *)tcph;
  61
  62        /*
  63         * Walk through all TCP options - if we find some option to remove,
  64         * set all octets to %TCPOPT_NOP and adjust checksum.
  65         */
  66        for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
  67                optl = optlen(opt, i);
  68
  69                if (i + optl > tcp_hdrlen)
  70                        break;
  71
  72                if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
  73                        continue;
  74
  75                for (j = 0; j < optl; ++j) {
  76                        o = opt[i+j];
  77                        n = TCPOPT_NOP;
  78                        if ((i + j) % 2 == 0) {
  79                                o <<= 8;
  80                                n <<= 8;
  81                        }
  82                        inet_proto_csum_replace2(&tcph->check, skb, htons(o),
  83                                                 htons(n), false);
  84                }
  85                memset(opt + i, TCPOPT_NOP, optl);
  86        }
  87
  88        return XT_CONTINUE;
  89}
  90
  91static unsigned int
  92tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
  93{
  94        return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb),
  95               sizeof(struct iphdr) + sizeof(struct tcphdr));
  96}
  97
  98#if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
  99static unsigned int
 100tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 101{
 102        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 103        int tcphoff;
 104        u_int8_t nexthdr;
 105        __be16 frag_off;
 106
 107        nexthdr = ipv6h->nexthdr;
 108        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
 109        if (tcphoff < 0)
 110                return NF_DROP;
 111
 112        return tcpoptstrip_mangle_packet(skb, par, tcphoff,
 113               sizeof(*ipv6h) + sizeof(struct tcphdr));
 114}
 115#endif
 116
 117static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
 118        {
 119                .name       = "TCPOPTSTRIP",
 120                .family     = NFPROTO_IPV4,
 121                .table      = "mangle",
 122                .proto      = IPPROTO_TCP,
 123                .target     = tcpoptstrip_tg4,
 124                .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
 125                .me         = THIS_MODULE,
 126        },
 127#if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
 128        {
 129                .name       = "TCPOPTSTRIP",
 130                .family     = NFPROTO_IPV6,
 131                .table      = "mangle",
 132                .proto      = IPPROTO_TCP,
 133                .target     = tcpoptstrip_tg6,
 134                .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
 135                .me         = THIS_MODULE,
 136        },
 137#endif
 138};
 139
 140static int __init tcpoptstrip_tg_init(void)
 141{
 142        return xt_register_targets(tcpoptstrip_tg_reg,
 143                                   ARRAY_SIZE(tcpoptstrip_tg_reg));
 144}
 145
 146static void __exit tcpoptstrip_tg_exit(void)
 147{
 148        xt_unregister_targets(tcpoptstrip_tg_reg,
 149                              ARRAY_SIZE(tcpoptstrip_tg_reg));
 150}
 151
 152module_init(tcpoptstrip_tg_init);
 153module_exit(tcpoptstrip_tg_exit);
 154MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
 155MODULE_DESCRIPTION("Xtables: TCP option stripping");
 156MODULE_LICENSE("GPL");
 157MODULE_ALIAS("ipt_TCPOPTSTRIP");
 158MODULE_ALIAS("ip6t_TCPOPTSTRIP");
 159