1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * A module for stripping a specific TCP option from TCP packets. 4 * 5 * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org> 6 * Copyright © CC Computer Consultants GmbH, 2007 7 */ 8 9 #include <linux/module.h> 10 #include <linux/skbuff.h> 11 #include <linux/ip.h> 12 #include <linux/ipv6.h> 13 #include <linux/tcp.h> 14 #include <net/ipv6.h> 15 #include <net/tcp.h> 16 #include <linux/netfilter/x_tables.h> 17 #include <linux/netfilter/xt_TCPOPTSTRIP.h> 18 19 static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset) 20 { 21 /* Beware zero-length options: make finite progress */ 22 if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0) 23 return 1; 24 else 25 return opt[offset+1]; 26 } 27 28 static unsigned int 29 tcpoptstrip_mangle_packet(struct sk_buff *skb, 30 const struct xt_action_param *par, 31 unsigned int tcphoff) 32 { 33 const struct xt_tcpoptstrip_target_info *info = par->targinfo; 34 struct tcphdr *tcph, _th; 35 unsigned int optl, i, j; 36 u_int16_t n, o; 37 u_int8_t *opt; 38 int tcp_hdrlen; 39 40 /* This is a fragment, no TCP header is available */ 41 if (par->fragoff != 0) 42 return XT_CONTINUE; 43 44 tcph = skb_header_pointer(skb, tcphoff, sizeof(_th), &_th); 45 if (!tcph) 46 return NF_DROP; 47 48 tcp_hdrlen = tcph->doff * 4; 49 if (tcp_hdrlen < sizeof(struct tcphdr)) 50 return NF_DROP; 51 52 if (skb_ensure_writable(skb, tcphoff + tcp_hdrlen)) 53 return NF_DROP; 54 55 /* must reload tcph, might have been moved */ 56 tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); 57 opt = (u8 *)tcph; 58 59 /* 60 * Walk through all TCP options - if we find some option to remove, 61 * set all octets to %TCPOPT_NOP and adjust checksum. 62 */ 63 for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) { 64 optl = optlen(opt, i); 65 66 if (i + optl > tcp_hdrlen) 67 break; 68 69 if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i])) 70 continue; 71 72 for (j = 0; j < optl; ++j) { 73 o = opt[i+j]; 74 n = TCPOPT_NOP; 75 if ((i + j) % 2 == 0) { 76 o <<= 8; 77 n <<= 8; 78 } 79 inet_proto_csum_replace2(&tcph->check, skb, htons(o), 80 htons(n), false); 81 } 82 memset(opt + i, TCPOPT_NOP, optl); 83 } 84 85 return XT_CONTINUE; 86 } 87 88 static unsigned int 89 tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par) 90 { 91 return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb)); 92 } 93 94 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE) 95 static unsigned int 96 tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par) 97 { 98 struct ipv6hdr *ipv6h = ipv6_hdr(skb); 99 int tcphoff; 100 u_int8_t nexthdr; 101 __be16 frag_off; 102 103 nexthdr = ipv6h->nexthdr; 104 tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off); 105 if (tcphoff < 0) 106 return NF_DROP; 107 108 return tcpoptstrip_mangle_packet(skb, par, tcphoff); 109 } 110 #endif 111 112 static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = { 113 { 114 .name = "TCPOPTSTRIP", 115 .family = NFPROTO_IPV4, 116 .table = "mangle", 117 .proto = IPPROTO_TCP, 118 .target = tcpoptstrip_tg4, 119 .targetsize = sizeof(struct xt_tcpoptstrip_target_info), 120 .me = THIS_MODULE, 121 }, 122 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE) 123 { 124 .name = "TCPOPTSTRIP", 125 .family = NFPROTO_IPV6, 126 .table = "mangle", 127 .proto = IPPROTO_TCP, 128 .target = tcpoptstrip_tg6, 129 .targetsize = sizeof(struct xt_tcpoptstrip_target_info), 130 .me = THIS_MODULE, 131 }, 132 #endif 133 }; 134 135 static int __init tcpoptstrip_tg_init(void) 136 { 137 return xt_register_targets(tcpoptstrip_tg_reg, 138 ARRAY_SIZE(tcpoptstrip_tg_reg)); 139 } 140 141 static void __exit tcpoptstrip_tg_exit(void) 142 { 143 xt_unregister_targets(tcpoptstrip_tg_reg, 144 ARRAY_SIZE(tcpoptstrip_tg_reg)); 145 } 146 147 module_init(tcpoptstrip_tg_init); 148 module_exit(tcpoptstrip_tg_exit); 149 MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>"); 150 MODULE_DESCRIPTION("Xtables: TCP option stripping"); 151 MODULE_LICENSE("GPL"); 152 MODULE_ALIAS("ipt_TCPOPTSTRIP"); 153 MODULE_ALIAS("ip6t_TCPOPTSTRIP"); 154