2 * A module for stripping a specific TCP option from TCP packets.
4 * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
5 * Copyright © CC Computer Consultants GmbH, 2007
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/module.h>
13 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/tcp.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter/xt_TCPOPTSTRIP.h>
22 static inline unsigned int optlen(const u_int8_t
*opt
, unsigned int offset
)
24 /* Beware zero-length options: make finite progress */
25 if (opt
[offset
] <= TCPOPT_NOP
|| opt
[offset
+1] == 0)
32 tcpoptstrip_mangle_packet(struct sk_buff
*skb
,
33 const struct xt_action_param
*par
,
34 unsigned int tcphoff
, unsigned int minlen
)
36 const struct xt_tcpoptstrip_target_info
*info
= par
->targinfo
;
37 unsigned int optl
, i
, j
;
43 /* This is a fragment, no TCP header is available */
44 if (par
->fragoff
!= 0)
47 if (!skb_make_writable(skb
, skb
->len
))
50 len
= skb
->len
- tcphoff
;
51 if (len
< (int)sizeof(struct tcphdr
) ||
52 tcp_hdr(skb
)->doff
* 4 > len
)
55 tcph
= (struct tcphdr
*)(skb_network_header(skb
) + tcphoff
);
56 opt
= (u_int8_t
*)tcph
;
59 * Walk through all TCP options - if we find some option to remove,
60 * set all octets to %TCPOPT_NOP and adjust checksum.
62 for (i
= sizeof(struct tcphdr
); i
< tcp_hdrlen(skb
); i
+= optl
) {
63 optl
= optlen(opt
, i
);
65 if (i
+ optl
> tcp_hdrlen(skb
))
68 if (!tcpoptstrip_test_bit(info
->strip_bmap
, opt
[i
]))
71 for (j
= 0; j
< optl
; ++j
) {
74 if ((i
+ j
) % 2 == 0) {
78 inet_proto_csum_replace2(&tcph
->check
, skb
, htons(o
),
81 memset(opt
+ i
, TCPOPT_NOP
, optl
);
88 tcpoptstrip_tg4(struct sk_buff
*skb
, const struct xt_action_param
*par
)
90 return tcpoptstrip_mangle_packet(skb
, par
, ip_hdrlen(skb
),
91 sizeof(struct iphdr
) + sizeof(struct tcphdr
));
94 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
96 tcpoptstrip_tg6(struct sk_buff
*skb
, const struct xt_action_param
*par
)
98 struct ipv6hdr
*ipv6h
= ipv6_hdr(skb
);
103 nexthdr
= ipv6h
->nexthdr
;
104 tcphoff
= ipv6_skip_exthdr(skb
, sizeof(*ipv6h
), &nexthdr
, &frag_off
);
108 return tcpoptstrip_mangle_packet(skb
, par
, tcphoff
,
109 sizeof(*ipv6h
) + sizeof(struct tcphdr
));
113 static struct xt_target tcpoptstrip_tg_reg
[] __read_mostly
= {
115 .name
= "TCPOPTSTRIP",
116 .family
= NFPROTO_IPV4
,
118 .proto
= IPPROTO_TCP
,
119 .target
= tcpoptstrip_tg4
,
120 .targetsize
= sizeof(struct xt_tcpoptstrip_target_info
),
123 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
125 .name
= "TCPOPTSTRIP",
126 .family
= NFPROTO_IPV6
,
128 .proto
= IPPROTO_TCP
,
129 .target
= tcpoptstrip_tg6
,
130 .targetsize
= sizeof(struct xt_tcpoptstrip_target_info
),
136 static int __init
tcpoptstrip_tg_init(void)
138 return xt_register_targets(tcpoptstrip_tg_reg
,
139 ARRAY_SIZE(tcpoptstrip_tg_reg
));
142 static void __exit
tcpoptstrip_tg_exit(void)
144 xt_unregister_targets(tcpoptstrip_tg_reg
,
145 ARRAY_SIZE(tcpoptstrip_tg_reg
));
148 module_init(tcpoptstrip_tg_init
);
149 module_exit(tcpoptstrip_tg_exit
);
150 MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
151 MODULE_DESCRIPTION("Xtables: TCP option stripping");
152 MODULE_LICENSE("GPL");
153 MODULE_ALIAS("ipt_TCPOPTSTRIP");
154 MODULE_ALIAS("ip6t_TCPOPTSTRIP");