net/netfilter/xt_TCPOPTSTRIP.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * A module for stripping a specific TCP option from TCP packets.
0004  *
0005  * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
0006  * Copyright © CC Computer Consultants GmbH, 2007
0007  */
0008
0009 #include <linux/module.h>
0010 #include <linux/skbuff.h>
0011 #include <linux/ip.h>
0012 #include <linux/ipv6.h>
0013 #include <linux/tcp.h>
0014 #include <net/ipv6.h>
0015 #include <net/tcp.h>
0016 #include <linux/netfilter/x_tables.h>
0017 #include <linux/netfilter/xt_TCPOPTSTRIP.h>
0018
0019 static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
0020 {
0021     /* Beware zero-length options: make finite progress */
0022     if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
0023         return 1;
0024     else
0025         return opt[offset+1];
0026 }
0027
0028 static unsigned int
0029 tcpoptstrip_mangle_packet(struct sk_buff *skb,
0030               const struct xt_action_param *par,
0031               unsigned int tcphoff)
0032 {
0033     const struct xt_tcpoptstrip_target_info *info = par->targinfo;
0034     struct tcphdr *tcph, _th;
0035     unsigned int optl, i, j;
0036     u_int16_t n, o;
0037     u_int8_t *opt;
0038     int tcp_hdrlen;
0039
0040     /* This is a fragment, no TCP header is available */
0041     if (par->fragoff != 0)
0042         return XT_CONTINUE;
0043
0044     tcph = skb_header_pointer(skb, tcphoff, sizeof(_th), &_th);
0045     if (!tcph)
0046         return NF_DROP;
0047
0048     tcp_hdrlen = tcph->doff * 4;
0049     if (tcp_hdrlen < sizeof(struct tcphdr))
0050         return NF_DROP;
0051
0052     if (skb_ensure_writable(skb, tcphoff + tcp_hdrlen))
0053         return NF_DROP;
0054
0055     /* must reload tcph, might have been moved */
0056     tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
0057     opt  = (u8 *)tcph;
0058
0059     /*
0060      * Walk through all TCP options - if we find some option to remove,
0061      * set all octets to %TCPOPT_NOP and adjust checksum.
0062      */
0063     for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
0064         optl = optlen(opt, i);
0065
0066         if (i + optl > tcp_hdrlen)
0067             break;
0068
0069         if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
0070             continue;
0071
0072         for (j = 0; j < optl; ++j) {
0073             o = opt[i+j];
0074             n = TCPOPT_NOP;
0075             if ((i + j) % 2 == 0) {
0076                 o <<= 8;
0077                 n <<= 8;
0078             }
0079             inet_proto_csum_replace2(&tcph->check, skb, htons(o),
0080                          htons(n), false);
0081         }
0082         memset(opt + i, TCPOPT_NOP, optl);
0083     }
0084
0085     return XT_CONTINUE;
0086 }
0087
0088 static unsigned int
0089 tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
0090 {
0091     return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb));
0092 }
0093
0094 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
0095 static unsigned int
0096 tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
0097 {
0098     struct ipv6hdr *ipv6h = ipv6_hdr(skb);
0099     int tcphoff;
0100     u_int8_t nexthdr;
0101     __be16 frag_off;
0102
0103     nexthdr = ipv6h->nexthdr;
0104     tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
0105     if (tcphoff < 0)
0106         return NF_DROP;
0107
0108     return tcpoptstrip_mangle_packet(skb, par, tcphoff);
0109 }
0110 #endif
0111
0112 static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
0113     {
0114         .name       = "TCPOPTSTRIP",
0115         .family     = NFPROTO_IPV4,
0116         .table      = "mangle",
0117         .proto      = IPPROTO_TCP,
0118         .target     = tcpoptstrip_tg4,
0119         .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
0120         .me         = THIS_MODULE,
0121     },
0122 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
0123     {
0124         .name       = "TCPOPTSTRIP",
0125         .family     = NFPROTO_IPV6,
0126         .table      = "mangle",
0127         .proto      = IPPROTO_TCP,
0128         .target     = tcpoptstrip_tg6,
0129         .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
0130         .me         = THIS_MODULE,
0131     },
0132 #endif
0133 };
0134
0135 static int __init tcpoptstrip_tg_init(void)
0136 {
0137     return xt_register_targets(tcpoptstrip_tg_reg,
0138                    ARRAY_SIZE(tcpoptstrip_tg_reg));
0139 }
0140
0141 static void __exit tcpoptstrip_tg_exit(void)
0142 {
0143     xt_unregister_targets(tcpoptstrip_tg_reg,
0144                   ARRAY_SIZE(tcpoptstrip_tg_reg));
0145 }
0146
0147 module_init(tcpoptstrip_tg_init);
0148 module_exit(tcpoptstrip_tg_exit);
0149 MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
0150 MODULE_DESCRIPTION("Xtables: TCP option stripping");
0151 MODULE_LICENSE("GPL");
0152 MODULE_ALIAS("ipt_TCPOPTSTRIP");
0153 MODULE_ALIAS("ip6t_TCPOPTSTRIP");