~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_TCPOPTSTRIP.c

Version: ~ [ linux-5.9-rc6 ] ~ [ linux-5.8.10 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.66 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.146 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.198 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.236 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.236 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * A module for stripping a specific TCP option from TCP packets.
  3  *
  4  * Copyright (C) 2007 Sven Schnelle <svens@bitebene.org>
  5  * Copyright © CC Computer Consultants GmbH, 2007
  6  *
  7  * This program is free software; you can redistribute it and/or modify
  8  * it under the terms of the GNU General Public License version 2 as
  9  * published by the Free Software Foundation.
 10  */
 11 
 12 #include <linux/module.h>
 13 #include <linux/skbuff.h>
 14 #include <linux/ip.h>
 15 #include <linux/ipv6.h>
 16 #include <linux/tcp.h>
 17 #include <net/ipv6.h>
 18 #include <net/tcp.h>
 19 #include <linux/netfilter/x_tables.h>
 20 #include <linux/netfilter/xt_TCPOPTSTRIP.h>
 21 
 22 static inline unsigned int optlen(const u_int8_t *opt, unsigned int offset)
 23 {
 24         /* Beware zero-length options: make finite progress */
 25         if (opt[offset] <= TCPOPT_NOP || opt[offset+1] == 0)
 26                 return 1;
 27         else
 28                 return opt[offset+1];
 29 }
 30 
 31 static unsigned int
 32 tcpoptstrip_mangle_packet(struct sk_buff *skb,
 33                           const struct xt_action_param *par,
 34                           unsigned int tcphoff, unsigned int minlen)
 35 {
 36         const struct xt_tcpoptstrip_target_info *info = par->targinfo;
 37         unsigned int optl, i, j;
 38         struct tcphdr *tcph;
 39         u_int16_t n, o;
 40         u_int8_t *opt;
 41         int len, tcp_hdrlen;
 42 
 43         /* This is a fragment, no TCP header is available */
 44         if (par->fragoff != 0)
 45                 return XT_CONTINUE;
 46 
 47         if (!skb_make_writable(skb, skb->len))
 48                 return NF_DROP;
 49 
 50         len = skb->len - tcphoff;
 51         if (len < (int)sizeof(struct tcphdr))
 52                 return NF_DROP;
 53 
 54         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
 55         tcp_hdrlen = tcph->doff * 4;
 56 
 57         if (len < tcp_hdrlen)
 58                 return NF_DROP;
 59 
 60         opt  = (u_int8_t *)tcph;
 61 
 62         /*
 63          * Walk through all TCP options - if we find some option to remove,
 64          * set all octets to %TCPOPT_NOP and adjust checksum.
 65          */
 66         for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
 67                 optl = optlen(opt, i);
 68 
 69                 if (i + optl > tcp_hdrlen)
 70                         break;
 71 
 72                 if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
 73                         continue;
 74 
 75                 for (j = 0; j < optl; ++j) {
 76                         o = opt[i+j];
 77                         n = TCPOPT_NOP;
 78                         if ((i + j) % 2 == 0) {
 79                                 o <<= 8;
 80                                 n <<= 8;
 81                         }
 82                         inet_proto_csum_replace2(&tcph->check, skb, htons(o),
 83                                                  htons(n), false);
 84                 }
 85                 memset(opt + i, TCPOPT_NOP, optl);
 86         }
 87 
 88         return XT_CONTINUE;
 89 }
 90 
 91 static unsigned int
 92 tcpoptstrip_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 93 {
 94         return tcpoptstrip_mangle_packet(skb, par, ip_hdrlen(skb),
 95                sizeof(struct iphdr) + sizeof(struct tcphdr));
 96 }
 97 
 98 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
 99 static unsigned int
100 tcpoptstrip_tg6(struct sk_buff *skb, const struct xt_action_param *par)
101 {
102         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
103         int tcphoff;
104         u_int8_t nexthdr;
105         __be16 frag_off;
106 
107         nexthdr = ipv6h->nexthdr;
108         tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr, &frag_off);
109         if (tcphoff < 0)
110                 return NF_DROP;
111 
112         return tcpoptstrip_mangle_packet(skb, par, tcphoff,
113                sizeof(*ipv6h) + sizeof(struct tcphdr));
114 }
115 #endif
116 
117 static struct xt_target tcpoptstrip_tg_reg[] __read_mostly = {
118         {
119                 .name       = "TCPOPTSTRIP",
120                 .family     = NFPROTO_IPV4,
121                 .table      = "mangle",
122                 .proto      = IPPROTO_TCP,
123                 .target     = tcpoptstrip_tg4,
124                 .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
125                 .me         = THIS_MODULE,
126         },
127 #if IS_ENABLED(CONFIG_IP6_NF_MANGLE)
128         {
129                 .name       = "TCPOPTSTRIP",
130                 .family     = NFPROTO_IPV6,
131                 .table      = "mangle",
132                 .proto      = IPPROTO_TCP,
133                 .target     = tcpoptstrip_tg6,
134                 .targetsize = sizeof(struct xt_tcpoptstrip_target_info),
135                 .me         = THIS_MODULE,
136         },
137 #endif
138 };
139 
140 static int __init tcpoptstrip_tg_init(void)
141 {
142         return xt_register_targets(tcpoptstrip_tg_reg,
143                                    ARRAY_SIZE(tcpoptstrip_tg_reg));
144 }
145 
146 static void __exit tcpoptstrip_tg_exit(void)
147 {
148         xt_unregister_targets(tcpoptstrip_tg_reg,
149                               ARRAY_SIZE(tcpoptstrip_tg_reg));
150 }
151 
152 module_init(tcpoptstrip_tg_init);
153 module_exit(tcpoptstrip_tg_exit);
154 MODULE_AUTHOR("Sven Schnelle <svens@bitebene.org>, Jan Engelhardt <jengelh@medozas.de>");
155 MODULE_DESCRIPTION("Xtables: TCP option stripping");
156 MODULE_LICENSE("GPL");
157 MODULE_ALIAS("ipt_TCPOPTSTRIP");
158 MODULE_ALIAS("ip6t_TCPOPTSTRIP");
159 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp