// SPDX-License-Identifier: GPL-2.0-only/* * A module for stripping a specific TCP option from TCP packets. * * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org> * Copyright © CC Computer Consultants GmbH, 2007 */ #include <linux/module.h>#include <linux/skbuff.h>#include <linux/ip.h>#include <linux/ipv6.h>#include <linux/tcp.h>#include <net/ipv6.h>#include <net/tcp.h>#include <linux/netfilter/x_tables.h>#include <linux/netfilter/xt_TCPOPTSTRIP.h> static inline unsigned int optlen(const u8 *opt, unsigned int offset){	/* Beware zero-length options: make finite progress */	if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)		return 1;	else		return opt[offset+1];} static unsigned inttcpoptstrip_mangle_packet(struct sk_buff *skb,			  const struct xt_action_param *par,			  unsigned int tcphoff){	const struct xt_tcpoptstrip_target_info *info = par->targinfo;	struct tcphdr *tcph, _th;	unsigned int optl, i, j;	u16 n, o;	u8 *opt;	int tcp_hdrlen; 	/* This is a fragment, no TCP header is available */	if (par->fragoff != 0)		return XT_CONTINUE; 	tcph = skb_header_pointer(skb, tcphoff, sizeof(_th), &_th);	if (!tcph)		return NF_DROP; 	tcp_hdrlen = tcph->doff * 4;	if (tcp_hdrlen < sizeof(struct tcphdr))		return NF_DROP; 	if (skb_ensure_writable(skb, tcphoff + tcp_hdrlen))		return NF_DROP; 	/* must reload tcph, might have been moved */	tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);	opt  = (u8 *)tcph; 	/*	 * Walk through all TCP options - if we find some option to remove,	 * set all octets to %TCPOPT_NOP and adjust checksum.	 */	for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {		optl = optlen(opt, i); 		if (i + optl > tcp_hdrlen)			break; 		if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))			continue; 		for (j = 0; j < optl; ++j) {			o = opt[i+j];			n = TCPOPT_NOP;			if ((i + j) % 2 == 0) {				o <<= 8;				n <<= 8;			}			inet_proto_csum_replace2(&tcph->check, skb, htons(o),						 htons(n), false);		}		memset(opt + i, TCPOPT_NOP, optl);	} 	return XT_CONTINUE;} static unsigned inttcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par){	return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb));} #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)static unsigned inttcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par){	struct ipv6hdr *ipv6h = ipv6_hdr(skb);	int tcphoff;	u8 nexthdr;	__be16 frag_off; 	nexthdr = ipv6h->nexthdr;	tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);	if (tcphoff < 0)		return NF_DROP; 	return tcpoptstrip_mangle_packet(skb, par, tcphoff);}#endif static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {	{		.name       = "TCPOPTSTRIP",		.family     = NFPROTO_IPV4,		.table      = "mangle",		.proto      = IPPROTO_TCP,		.target     = tcpoptstrip_tg4,		.targetsize = sizeof(struct xt_tcpoptstrip_target_info),		.me         = THIS_MODULE,	},#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)	{		.name       = "TCPOPTSTRIP",		.family     = NFPROTO_IPV6,		.table      = "mangle",		.proto      = IPPROTO_TCP,		.target     = tcpoptstrip_tg6,		.targetsize = sizeof(struct xt_tcpoptstrip_target_info),		.me         = THIS_MODULE,	},#endif}; static int __init tcpoptstrip_tg_init(void){	return xt_register_targets(tcpoptstrip_tg_reg,				   ARRAY_SIZE(tcpoptstrip_tg_reg));} static void __exit tcpoptstrip_tg_exit(void){	xt_unregister_targets(tcpoptstrip_tg_reg,			      ARRAY_SIZE(tcpoptstrip_tg_reg));} module_init(tcpoptstrip_tg_init);module_exit(tcpoptstrip_tg_exit);MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");MODULE_DESCRIPTION("Xtables: TCP option stripping");MODULE_LICENSE("GPL");MODULE_ALIAS("ipt_TCPOPTSTRIP");MODULE_ALIAS("ip6t_TCPOPTSTRIP");