LXR linux/net/netfilter/xt

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * A module for stripping a specific TCP option from TCP packets.
   4 *
   5 * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
   6 * Copyright © CC Computer Consultants GmbH, 2007
   7 */
   8
   9#include <linux/module.h>
  10#include <linux/skbuff.h>
  11#include <linux/ip.h>
  12#include <linux/ipv6.h>
  13#include <linux/tcp.h>
  14#include <net/ipv6.h>
  15#include <net/tcp.h>
  16#include <linux/netfilter/x_tables.h>
  17#include <linux/netfilter/xt_TCPOPTSTRIP.h>
  18
  19static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
  20{
  21        /* Beware zero-length options: make finite progress */
  22        if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
  23                return 1;
  24        else
  25                return opt[offset+1];
  26}
  27
  28static unsigned int
  29tcpoptstrip_mangle_packet(struct sk_buff *skb,
  30                          const struct xt_action_param *par,
  31                          unsigned int tcphoff, unsigned int minlen)
  32{
  33        const struct xt_tcpoptstrip_target_info *info = par->targinfo;
  34        unsigned int optl, i, j;
  35        struct tcphdr *tcph;
  36        u_int16_t n, o;
  37        u_int8_t *opt;
  38        int len, tcp_hdrlen;
  39
  40        /* This is a fragment, no TCP header is available */
  41        if (par->fragoff != 0)
  42                return XT_CONTINUE;
  43
  44        if (!skb_make_writable(skb, skb->len))
  45                return NF_DROP;
  46
  47        len = skb->len - tcphoff;
  48        if (len < (int)sizeof(struct tcphdr))
  49                return NF_DROP;
  50
  51        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
  52        tcp_hdrlen = tcph->doff * 4;
  53
  54        if (len < tcp_hdrlen)
  55                return NF_DROP;
  56
  57        opt  = (u_int8_t *)tcph;
  58
  59        /*
  60         * Walk through all TCP options - if we find some option to remove,
  61         * set all octets to %TCPOPT_NOP and adjust checksum.
  62         */
  63        for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
  64                optl = optlen(opt, i);
  65
  66                if (i + optl > tcp_hdrlen)
  67                        break;
  68
  69                if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
  70                        continue;
  71
  72                for (j = 0; j < optl; ++j) {
  73                        o = opt[i+j];
  74                        n = TCPOPT_NOP;
  75                        if ((i + j) % 2 == 0) {
  76                                o <<= 8;
  77                                n <<= 8;
  78                        }
  79                        inet_proto_csum_replace2(&tcph->check, skb, htons(o),
  80                                                 htons(n), false);
  81                }
  82                memset(opt + i, TCPOPT_NOP, optl);
  83        }
  84
  85        return XT_CONTINUE;
  86}
  87
  88static unsigned int
  89tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
  90{
  91        return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb),
  92               sizeof(struct iphdr) + sizeof(struct tcphdr));
  93}
  94
  95#if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
  96static unsigned int
  97tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
  98{
  99        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 100        int tcphoff;
 101        u_int8_t nexthdr;
 102        __be16 frag_off;
 103
 104        nexthdr = ipv6h->nexthdr;
 105        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
 106        if (tcphoff < 0)
 107                return NF_DROP;
 108
 109        return tcpoptstrip_mangle_packet(skb, par, tcphoff,
 110               sizeof(*ipv6h) + sizeof(struct tcphdr));
 111}
 112#endif
 113
 114static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
 115        {
 116                .name       = "TCPOPTSTRIP",
 117                .family     = NFPROTO_IPV4,
 118                .table      = "mangle",
 119                .proto      = IPPROTO_TCP,
 120                .target     = tcpoptstrip_tg4,
 121                .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
 122                .me         = THIS_MODULE,
 123        },
 124#if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
 125        {
 126                .name       = "TCPOPTSTRIP",
 127                .family     = NFPROTO_IPV6,
 128                .table      = "mangle",
 129                .proto      = IPPROTO_TCP,
 130                .target     = tcpoptstrip_tg6,
 131                .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
 132                .me         = THIS_MODULE,
 133        },
 134#endif
 135};
 136
 137static int __init tcpoptstrip_tg_init(void)
 138{
 139        return xt_register_targets(tcpoptstrip_tg_reg,
 140                                   ARRAY_SIZE(tcpoptstrip_tg_reg));
 141}
 142
 143static void __exit tcpoptstrip_tg_exit(void)
 144{
 145        xt_unregister_targets(tcpoptstrip_tg_reg,
 146                              ARRAY_SIZE(tcpoptstrip_tg_reg));
 147}
 148
 149module_init(tcpoptstrip_tg_init);
 150module_exit(tcpoptstrip_tg_exit);
 151MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
 152MODULE_DESCRIPTION("Xtables: TCP option stripping");
 153MODULE_LICENSE("GPL");
 154MODULE_ALIAS("ipt_TCPOPTSTRIP");
 155MODULE_ALIAS("ip6t_TCPOPTSTRIP");
 156