1 /*
2  * A module for stripping a specific TCP option from TCP packets.
3  *
4  * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
5  * Copyright © CC Computer Consultants GmbH, 2007
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11 
12 #include <linux/module.h>
13 #include <linux/skbuff.h>
14 #include <linux/ip.h>
15 #include <linux/ipv6.h>
16 #include <linux/tcp.h>
17 #include <net/ipv6.h>
18 #include <net/tcp.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter/xt_TCPOPTSTRIP.h>
21 
22 static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
23 {
24 	/* Beware zero-length options: make finite progress */
25 	if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
26 		return 1;
27 	else
28 		return opt[offset+1];
29 }
30 
31 static unsigned int
32 tcpoptstrip_mangle_packet(struct sk_buff *skb,
33 			  const struct xt_action_param *par,
34 			  unsigned int tcphoff, unsigned int minlen)
35 {
36 	const struct xt_tcpoptstrip_target_info *info = par->targinfo;
37 	unsigned int optl, i, j;
38 	struct tcphdr *tcph;
39 	u_int16_t n, o;
40 	u_int8_t *opt;
41 	int len, tcp_hdrlen;
42 
43 	/* This is a fragment, no TCP header is available */
44 	if (par->fragoff != 0)
45 		return XT_CONTINUE;
46 
47 	if (!skb_make_writable(skb, skb->len))
48 		return NF_DROP;
49 
50 	len = skb->len - tcphoff;
51 	if (len < (int)sizeof(struct tcphdr))
52 		return NF_DROP;
53 
54 	tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
55 	tcp_hdrlen = tcph->doff * 4;
56 
57 	if (len < tcp_hdrlen)
58 		return NF_DROP;
59 
60 	opt  = (u_int8_t *)tcph;
61 
62 	/*
63 	 * Walk through all TCP options - if we find some option to remove,
64 	 * set all octets to %TCPOPT_NOP and adjust checksum.
65 	 */
66 	for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
67 		optl = optlen(opt, i);
68 
69 		if (i + optl > tcp_hdrlen)
70 			break;
71 
72 		if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
73 			continue;
74 
75 		for (j = 0; j < optl; ++j) {
76 			o = opt[i+j];
77 			n = TCPOPT_NOP;
78 			if ((i + j) % 2 == 0) {
79 				o <<= 8;
80 				n <<= 8;
81 			}
82 			inet_proto_csum_replace2(&tcph->check, skb, htons(o),
83 						 htons(n), false);
84 		}
85 		memset(opt + i, TCPOPT_NOP, optl);
86 	}
87 
88 	return XT_CONTINUE;
89 }
90 
91 static unsigned int
92 tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
93 {
94 	return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb),
95 	       sizeof(struct iphdr) + sizeof(struct tcphdr));
96 }
97 
98 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
99 static unsigned int
100 tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
101 {
102 	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
103 	int tcphoff;
104 	u_int8_t nexthdr;
105 	__be16 frag_off;
106 
107 	nexthdr = ipv6h->nexthdr;
108 	tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
109 	if (tcphoff < 0)
110 		return NF_DROP;
111 
112 	return tcpoptstrip_mangle_packet(skb, par, tcphoff,
113 	       sizeof(*ipv6h) + sizeof(struct tcphdr));
114 }
115 #endif
116 
117 static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
118 	{
119 		.name       = "TCPOPTSTRIP",
120 		.family     = NFPROTO_IPV4,
121 		.table      = "mangle",
122 		.proto      = IPPROTO_TCP,
123 		.target     = tcpoptstrip_tg4,
124 		.targetsize = sizeof(struct xt_tcpoptstrip_target_info),
125 		.me         = THIS_MODULE,
126 	},
127 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
128 	{
129 		.name       = "TCPOPTSTRIP",
130 		.family     = NFPROTO_IPV6,
131 		.table      = "mangle",
132 		.proto      = IPPROTO_TCP,
133 		.target     = tcpoptstrip_tg6,
134 		.targetsize = sizeof(struct xt_tcpoptstrip_target_info),
135 		.me         = THIS_MODULE,
136 	},
137 #endif
138 };
139 
140 static int __init tcpoptstrip_tg_init(void)
141 {
142 	return xt_register_targets(tcpoptstrip_tg_reg,
143 				   ARRAY_SIZE(tcpoptstrip_tg_reg));
144 }
145 
146 static void __exit tcpoptstrip_tg_exit(void)
147 {
148 	xt_unregister_targets(tcpoptstrip_tg_reg,
149 			      ARRAY_SIZE(tcpoptstrip_tg_reg));
150 }
151 
152 module_init(tcpoptstrip_tg_init);
153 module_exit(tcpoptstrip_tg_exit);
154 MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
155 MODULE_DESCRIPTION("Xtables: TCP option stripping");
156 MODULE_LICENSE("GPL");
157 MODULE_ALIAS("ipt_TCPOPTSTRIP");
158 MODULE_ALIAS("ip6t_TCPOPTSTRIP");
159