Jan Engelhardt <jengelh@xxxxxxxxxxxxxxx> writes:
> On Oct 2 2007 16:20, Sven Schnelle wrote:
>>+static void tcpoptstrip_help(void)
>>+{
>>+ printf("TCPOPTSTRIP target options:\n"
>>+ " --strip-tcp-options option(s) strip specified tcp options from TCP Header\n"
>>+ " --strip-wscale strip windows scaling option\n"
>>+ " --strip-timestamp strip timestamp option\n"
>>+ " --strip-mss strip mss option\n"
>>+ " --strip-sack strip sack option\n"
>>+ " --strip-sack-permitted strip sack permitted option\n");
>>+}
>
> I have added a strip-md5.
Thanks. I've added only a few options, so this list may still be
extensible ;-)
> This here is untested.
> [iptables patch]
I've changed the code in the meantime so that names could be specified
inside the --strip-options argument list, instead of having extra
options for every tcp option, this makes code smaller, and it is even
simpler to add new names.
For example:
--strip-options 3 is the same as --strip-options wscale. iptables-save
and iptables -L would give the names of the options, instead of the
numbers.
Output looks like this now:
root@deprecated(1058):~0# iptables -nvL -t mangle
Chain PREROUTING (policy ACCEPT 161 packets, 123K bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 161 packets, 123K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 TCPOPTSTRIP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 TCPOPTSTRIP options wscale,77
Chain OUTPUT (policy ACCEPT 124 packets, 13460 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 124 packets, 13460 bytes)
pkts bytes target prot opt in out source destination
My version of the patch right now:
Index: libxt_TCPOPTSTRIP.c
===================================================================
--- libxt_TCPOPTSTRIP.c (revision 0)
+++ libxt_TCPOPTSTRIP.c (revision 0)
@@ -0,0 +1,205 @@
+/*
+ * Shared library add-on to iptables to add TCPOPTSTRIP target support.
+ * Copyright (c) 2007 Sven Schnelle <svens@xxxxxxxxxxxx>
+ */
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <xtables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_TCPOPTSTRIP.h>
+#ifndef TCPOPT_MD5SIG
+# define TCPOPT_MD5SIG 19
+#endif
+
+enum {
+ F_STRIP = 1 << 0,
+};
+
+static const struct option tcpoptstrip_opts[] = {
+ {"strip-options", true, NULL, '0'},
+ {NULL},
+};
+
+struct tcp_optionmap_struct {
+ const char *name;
+ const int option;
+};
+
+static const struct tcp_optionmap_struct tcp_optionmap[] = {
+ {"wscale", TCPOPT_WINDOW},
+ {"mss", TCPOPT_MAXSEG},
+ {"sack-permitted", TCPOPT_SACK_PERMITTED},
+ {"sack", TCPOPT_SACK},
+ {"timestamp", TCPOPT_TIMESTAMP},
+ {"md5", TCPOPT_MD5SIG},
+ {NULL},
+};
+
+static void tcpoptstrip_help(void)
+{
+ printf(
+"TCPOPTSTRIP target options:\n"
+" --strip-options value strip specified TCP options denoted by value\n"
+" (separated by comma) from TCP header\n"
+" instead of the numeric value, you can also use the following names: \n"
+" mss strip MSS option\n"
+" wscale strip window scaling option\n"
+" sack-permitted strip \"SACK permitted\" option\n"
+" sack strip SACK option\n"
+" timestamp strip timestamp option\n"
+" md5 strip MD5 signature (RFC2385) option\n"
+ );
+}
+
+static void tcpoptstrip_init(struct xt_entry_target *t)
+{
+ struct xt_tcpoptstrip_info *info = (void *)t->data;
+
+ /* strictly necessary? play safe for now. */
+ memset(info->strip_bmap, 0, sizeof(info->strip_bmap));
+}
+
+static void parse_list(struct xt_tcpoptstrip_info *info, char *arg)
+{
+ unsigned int option;
+ char *p;
+ int i;
+
+ while (true) {
+ p = strchr(arg, ',');
+ if (p != NULL)
+ *p = '\0';
+
+ option = 0;
+ for (i = 0; tcp_optionmap[i].name != NULL; i++) {
+ if (!strcmp(tcp_optionmap[i].name, arg)) {
+ option = tcp_optionmap[i].option;
+ break;
+ }
+ }
+
+ if (option != 0 && string_to_number(arg, 0, 255, &option) == -1)
+ exit_error(PARAMETER_PROBLEM,
+ "Bad TCP option value \"%s\"", arg);
+
+ if (option < 2)
+ exit_error(PARAMETER_PROBLEM,
+ "Option value may not be 0 or 1");
+
+ if(tcpoptstrip_test_bit(info->strip_bmap, option))
+ exit_error(PARAMETER_PROBLEM,
+ "Option \"%s\" already specified", arg);
+
+ tcpoptstrip_set_bit(info->strip_bmap, option);
+ if (p == NULL)
+ break;
+ arg = p + 1;
+ }
+}
+
+static int tcpoptstrip_parse(int c, char **argv, int invert,
+ unsigned int *flags, const void *entry,
+ struct xt_entry_target **target)
+{
+ struct xt_tcpoptstrip_info *info = (void *)(*target)->data;
+
+ switch (c) {
+ case '0':
+ if (*flags & F_STRIP)
+ exit_error(PARAMETER_PROBLEM,
+ "You can specify --strip-options only once");
+ parse_list(info, optarg);
+ *flags |= F_STRIP;
+ return 1;
+ }
+
+ return 0;
+}
+
+static void tcpoptstrip_check(unsigned int flags)
+{
+ if (flags == 0)
+ exit_error(PARAMETER_PROBLEM,
+ "TCPOPTSTRIP: At least one of the strip options must be specified");
+}
+
+static void tcpoptstrip_print_list(bool parse, const struct xt_tcpoptstrip_info *info)
+{
+ bool first = true;
+ unsigned int i,j;
+ const char *name;
+
+ for (i = 0; i < 256; ++i) {
+ if (!tcpoptstrip_test_bit(info->strip_bmap, i))
+ continue;
+
+ putchar(first ? ' ' : ',');
+ first = false;
+
+ name = NULL;
+ for (j = 0; tcp_optionmap[j].name != NULL; j++) {
+ if (tcp_optionmap[j].option == i)
+ name = tcp_optionmap[j].name;
+ }
+
+ if(name)
+ fputs(name, stdout);
+ else
+ printf("%u", i);
+ }
+}
+
+static void tcpoptstrip_print(const void *ip,
+ const struct xt_entry_target *target, int numeric)
+{
+ const struct xt_tcpoptstrip_info *info = (const void *)target->data;
+ printf("TCPOPTSTRIP options");
+ tcpoptstrip_print_list(false, info);
+}
+
+static void tcpoptstrip_save(const void *ip,
+ const struct xt_entry_target *target)
+{
+ const struct xt_tcpoptstrip_info *info = (const void *)target->data;
+ printf("--strip-options");
+ tcpoptstrip_print_list(true, info);
+}
+
+static struct xtables_target tcpoptstrip_reg = {
+ .name = "TCPOPTSTRIP",
+ .family = AF_INET,
+ .version = IPTABLES_VERSION,
+ .size = XT_ALIGN(sizeof(struct xt_tcpoptstrip_info)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_tcpoptstrip_info)),
+ .help = tcpoptstrip_help,
+ .init = tcpoptstrip_init,
+ .parse = tcpoptstrip_parse,
+ .final_check = tcpoptstrip_check,
+ .print = tcpoptstrip_print,
+ .save = tcpoptstrip_save,
+ .extra_opts = tcpoptstrip_opts,
+};
+
+static struct xtables_target tcpoptstrip6_reg = {
+ .name = "TCPOPTSTRIP",
+ .family = AF_INET6,
+ .version = IPTABLES_VERSION,
+ .size = XT_ALIGN(sizeof(struct xt_tcpoptstrip_info)),
+ .userspacesize = XT_ALIGN(sizeof(struct xt_tcpoptstrip_info)),
+ .help = tcpoptstrip_help,
+ .init = tcpoptstrip_init,
+ .parse = tcpoptstrip_parse,
+ .final_check = tcpoptstrip_check,
+ .print = tcpoptstrip_print,
+ .save = tcpoptstrip_save,
+ .extra_opts = tcpoptstrip_opts,
+};
+
+void _init(void)
+{
+ xtables_register_target(&tcpoptstrip_reg);
+ xtables_register_target(&tcpoptstrip6_reg);
+}
Index: Makefile
===================================================================
--- Makefile (revision 7065)
+++ Makefile (working copy)
@@ -7,7 +7,7 @@
#
PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG
PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT
-PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE
+PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TCPOPTSTRIP TRACE
PF_EXT_SELINUX_SLIB:=
PF6_EXT_SELINUX_SLIB:=
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
