1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * A module for stripping a specific TCP option from TCP packets.
4  *
5  * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
6  * Copyright © CC Computer Consultants GmbH, 2007
7  */
8 
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
11 #include <linux/ip.h>
12 #include <linux/ipv6.h>
13 #include <linux/tcp.h>
14 #include <net/ipv6.h>
15 #include <net/tcp.h>
16 #include <linux/netfilter/x_tables.h>
17 #include <linux/netfilter/xt_TCPOPTSTRIP.h>
18 
optlen(const u_int8_t * opt,unsigned int offset)19 static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
20 {
21 	/* Beware zero-length options: make finite progress */
22 	if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
23 		return 1;
24 	else
25 		return opt[offset+1];
26 }
27 
28 static unsigned int
tcpoptstrip_mangle_packet(struct sk_buff * skb,const struct xt_action_param * par,unsigned int tcphoff)29 tcpoptstrip_mangle_packet(struct sk_buff *skb,
30 			  const struct xt_action_param *par,
31 			  unsigned int tcphoff)
32 {
33 	const struct xt_tcpoptstrip_target_info *info = par->targinfo;
34 	struct tcphdr *tcph, _th;
35 	unsigned int optl, i, j;
36 	u_int16_t n, o;
37 	u_int8_t *opt;
38 	int tcp_hdrlen;
39 
40 	/* This is a fragment, no TCP header is available */
41 	if (par->fragoff != 0)
42 		return XT_CONTINUE;
43 
44 	tcph = skb_header_pointer(skb, tcphoff, sizeof(_th), &_th);
45 	if (!tcph)
46 		return NF_DROP;
47 
48 	tcp_hdrlen = tcph->doff * 4;
49 	if (tcp_hdrlen < sizeof(struct tcphdr))
50 		return NF_DROP;
51 
52 	if (skb_ensure_writable(skb, tcphoff + tcp_hdrlen))
53 		return NF_DROP;
54 
55 	/* must reload tcph, might have been moved */
56 	tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
57 	opt  = (u8 *)tcph;
58 
59 	/*
60 	 * Walk through all TCP options - if we find some option to remove,
61 	 * set all octets to %TCPOPT_NOP and adjust checksum.
62 	 */
63 	for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
64 		optl = optlen(opt, i);
65 
66 		if (i + optl > tcp_hdrlen)
67 			break;
68 
69 		if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
70 			continue;
71 
72 		for (j = 0; j < optl; ++j) {
73 			o = opt[i+j];
74 			n = TCPOPT_NOP;
75 			if ((i + j) % 2 == 0) {
76 				o <<= 8;
77 				n <<= 8;
78 			}
79 			inet_proto_csum_replace2(&tcph->check, skb, htons(o),
80 						 htons(n), false);
81 		}
82 		memset(opt + i, TCPOPT_NOP, optl);
83 	}
84 
85 	return XT_CONTINUE;
86 }
87 
88 static unsigned int
tcpoptstrip_tg4(struct sk_buff * skb,const struct xt_action_param * par)89 tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
90 {
91 	return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb));
92 }
93 
94 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
95 static unsigned int
tcpoptstrip_tg6(struct sk_buff * skb,const struct xt_action_param * par)96 tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
97 {
98 	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
99 	int tcphoff;
100 	u_int8_t nexthdr;
101 	__be16 frag_off;
102 
103 	nexthdr = ipv6h->nexthdr;
104 	tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
105 	if (tcphoff < 0)
106 		return NF_DROP;
107 
108 	return tcpoptstrip_mangle_packet(skb, par, tcphoff);
109 }
110 #endif
111 
112 static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
113 	{
114 		.name       = "TCPOPTSTRIP",
115 		.family     = NFPROTO_IPV4,
116 		.table      = "mangle",
117 		.proto      = IPPROTO_TCP,
118 		.target     = tcpoptstrip_tg4,
119 		.targetsize = sizeof(struct xt_tcpoptstrip_target_info),
120 		.me         = THIS_MODULE,
121 	},
122 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
123 	{
124 		.name       = "TCPOPTSTRIP",
125 		.family     = NFPROTO_IPV6,
126 		.table      = "mangle",
127 		.proto      = IPPROTO_TCP,
128 		.target     = tcpoptstrip_tg6,
129 		.targetsize = sizeof(struct xt_tcpoptstrip_target_info),
130 		.me         = THIS_MODULE,
131 	},
132 #endif
133 };
134 
tcpoptstrip_tg_init(void)135 static int __init tcpoptstrip_tg_init(void)
136 {
137 	return xt_register_targets(tcpoptstrip_tg_reg,
138 				   ARRAY_SIZE(tcpoptstrip_tg_reg));
139 }
140 
tcpoptstrip_tg_exit(void)141 static void __exit tcpoptstrip_tg_exit(void)
142 {
143 	xt_unregister_targets(tcpoptstrip_tg_reg,
144 			      ARRAY_SIZE(tcpoptstrip_tg_reg));
145 }
146 
147 module_init(tcpoptstrip_tg_init);
148 module_exit(tcpoptstrip_tg_exit);
149 MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
150 MODULE_DESCRIPTION("Xtables: TCP option stripping");
151 MODULE_LICENSE("GPL");
152 MODULE_ALIAS("ipt_TCPOPTSTRIP");
153 MODULE_ALIAS("ip6t_TCPOPTSTRIP");
154