Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * This is a module which is used for rejecting packets. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 3 | */ |
| 4 | |
| 5 | /* (C) 1999-2001 Paul `Rusty' Russell |
| 6 | * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
| 9 | * it under the terms of the GNU General Public License version 2 as |
| 10 | * published by the Free Software Foundation. |
| 11 | */ |
| 12 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | #include <linux/module.h> |
| 14 | #include <linux/skbuff.h> |
| 15 | #include <linux/ip.h> |
| 16 | #include <linux/udp.h> |
| 17 | #include <linux/icmp.h> |
| 18 | #include <net/icmp.h> |
| 19 | #include <net/ip.h> |
| 20 | #include <net/tcp.h> |
| 21 | #include <net/route.h> |
| 22 | #include <net/dst.h> |
Jan Engelhardt | 6709dbb | 2007-02-07 15:11:19 -0800 | [diff] [blame] | 23 | #include <linux/netfilter/x_tables.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 24 | #include <linux/netfilter_ipv4/ip_tables.h> |
| 25 | #include <linux/netfilter_ipv4/ipt_REJECT.h> |
| 26 | #ifdef CONFIG_BRIDGE_NETFILTER |
| 27 | #include <linux/netfilter_bridge.h> |
| 28 | #endif |
| 29 | |
| 30 | MODULE_LICENSE("GPL"); |
| 31 | MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); |
| 32 | MODULE_DESCRIPTION("iptables REJECT target module"); |
| 33 | |
| 34 | #if 0 |
| 35 | #define DEBUGP printk |
| 36 | #else |
| 37 | #define DEBUGP(format, args...) |
| 38 | #endif |
| 39 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 40 | /* Send RST reply */ |
| 41 | static void send_reset(struct sk_buff *oldskb, int hook) |
| 42 | { |
| 43 | struct sk_buff *nskb; |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 44 | struct iphdr *niph; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | struct tcphdr _otcph, *oth, *tcph; |
Al Viro | 6a19d61 | 2006-09-28 14:22:24 -0700 | [diff] [blame] | 46 | __be16 tmp_port; |
| 47 | __be32 tmp_addr; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 48 | int needs_ack; |
Patrick McHardy | 9d02002 | 2006-10-02 16:12:20 -0700 | [diff] [blame] | 49 | unsigned int addr_type; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 50 | |
| 51 | /* IP header checks: fragment. */ |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 52 | if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 53 | return; |
| 54 | |
Arnaldo Carvalho de Melo | c9bdd4b | 2007-03-12 20:09:15 -0300 | [diff] [blame] | 55 | oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 56 | sizeof(_otcph), &_otcph); |
| 57 | if (oth == NULL) |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 58 | return; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 59 | |
| 60 | /* No RST for RST. */ |
| 61 | if (oth->rst) |
| 62 | return; |
| 63 | |
Patrick McHardy | 6150bac | 2005-06-21 14:03:46 -0700 | [diff] [blame] | 64 | /* Check checksum */ |
Arnaldo Carvalho de Melo | c9bdd4b | 2007-03-12 20:09:15 -0300 | [diff] [blame] | 65 | if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) |
Patrick McHardy | 6150bac | 2005-06-21 14:03:46 -0700 | [diff] [blame] | 66 | return; |
| 67 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 68 | /* We need a linear, writeable skb. We also need to expand |
| 69 | headroom in case hh_len of incoming interface < hh_len of |
| 70 | outgoing interface */ |
Patrick McHardy | 9d02002 | 2006-10-02 16:12:20 -0700 | [diff] [blame] | 71 | nskb = skb_copy_expand(oldskb, LL_MAX_HEADER, skb_tailroom(oldskb), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 72 | GFP_ATOMIC); |
Patrick McHardy | 9d02002 | 2006-10-02 16:12:20 -0700 | [diff] [blame] | 73 | if (!nskb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 74 | return; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | |
| 76 | /* This packet will not be the same as the other: clear nf fields */ |
| 77 | nf_reset(nskb); |
Thomas Graf | 82e91ff | 2006-11-09 15:19:14 -0800 | [diff] [blame] | 78 | nskb->mark = 0; |
James Morris | 984bc16 | 2006-06-09 00:29:17 -0700 | [diff] [blame] | 79 | skb_init_secmark(nskb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | |
Herbert Xu | bbf4a6b | 2007-02-13 12:32:58 -0800 | [diff] [blame] | 81 | skb_shinfo(nskb)->gso_size = 0; |
| 82 | skb_shinfo(nskb)->gso_segs = 0; |
| 83 | skb_shinfo(nskb)->gso_type = 0; |
| 84 | |
Arnaldo Carvalho de Melo | c9bdd4b | 2007-03-12 20:09:15 -0300 | [diff] [blame] | 85 | tcph = (struct tcphdr *)(skb_network_header(nskb) + ip_hdrlen(nskb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 86 | |
| 87 | /* Swap source and dest */ |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 88 | niph = ip_hdr(nskb); |
| 89 | tmp_addr = niph->saddr; |
| 90 | niph->saddr = niph->daddr; |
| 91 | niph->daddr = tmp_addr; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 92 | tmp_port = tcph->source; |
| 93 | tcph->source = tcph->dest; |
| 94 | tcph->dest = tmp_port; |
| 95 | |
| 96 | /* Truncate to length (no data) */ |
| 97 | tcph->doff = sizeof(struct tcphdr)/4; |
Arnaldo Carvalho de Melo | c9bdd4b | 2007-03-12 20:09:15 -0300 | [diff] [blame] | 98 | skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr)); |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 99 | niph->tot_len = htons(nskb->len); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 100 | |
| 101 | if (tcph->ack) { |
| 102 | needs_ack = 0; |
| 103 | tcph->seq = oth->ack_seq; |
| 104 | tcph->ack_seq = 0; |
| 105 | } else { |
| 106 | needs_ack = 1; |
Arnaldo Carvalho de Melo | c9bdd4b | 2007-03-12 20:09:15 -0300 | [diff] [blame] | 107 | tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + |
| 108 | oldskb->len - ip_hdrlen(oldskb) - |
| 109 | (oth->doff << 2)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 110 | tcph->seq = 0; |
| 111 | } |
| 112 | |
| 113 | /* Reset flags */ |
| 114 | ((u_int8_t *)tcph)[13] = 0; |
| 115 | tcph->rst = 1; |
| 116 | tcph->ack = needs_ack; |
| 117 | |
| 118 | tcph->window = 0; |
| 119 | tcph->urg_ptr = 0; |
| 120 | |
Patrick McHardy | af443b6 | 2006-11-28 20:10:21 -0800 | [diff] [blame] | 121 | /* Adjust TCP checksum */ |
| 122 | tcph->check = 0; |
Frederik Deweerdt | ba7808e | 2007-02-04 20:15:27 -0800 | [diff] [blame] | 123 | tcph->check = tcp_v4_check(sizeof(struct tcphdr), |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 124 | niph->saddr, niph->daddr, |
Jan Engelhardt | a47362a | 2007-07-07 22:16:55 -0700 | [diff] [blame] | 125 | csum_partial(tcph, |
Patrick McHardy | af443b6 | 2006-11-28 20:10:21 -0800 | [diff] [blame] | 126 | sizeof(struct tcphdr), 0)); |
| 127 | |
Patrick McHardy | 9d02002 | 2006-10-02 16:12:20 -0700 | [diff] [blame] | 128 | /* Set DF, id = 0 */ |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 129 | niph->frag_off = htons(IP_DF); |
| 130 | niph->id = 0; |
Patrick McHardy | 9d02002 | 2006-10-02 16:12:20 -0700 | [diff] [blame] | 131 | |
| 132 | addr_type = RTN_UNSPEC; |
| 133 | if (hook != NF_IP_FORWARD |
| 134 | #ifdef CONFIG_BRIDGE_NETFILTER |
| 135 | || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED) |
| 136 | #endif |
| 137 | ) |
| 138 | addr_type = RTN_LOCAL; |
| 139 | |
| 140 | if (ip_route_me_harder(&nskb, addr_type)) |
| 141 | goto free_nskb; |
| 142 | |
Patrick McHardy | 4cf411d | 2006-08-05 00:58:33 -0700 | [diff] [blame] | 143 | nskb->ip_summed = CHECKSUM_NONE; |
Patrick McHardy | af443b6 | 2006-11-28 20:10:21 -0800 | [diff] [blame] | 144 | |
Patrick McHardy | 9d02002 | 2006-10-02 16:12:20 -0700 | [diff] [blame] | 145 | /* Adjust IP TTL */ |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 146 | niph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 147 | |
| 148 | /* Adjust IP checksum */ |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 149 | niph->check = 0; |
| 150 | niph->check = ip_fast_csum(skb_network_header(nskb), niph->ihl); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 151 | |
| 152 | /* "Never happens" */ |
| 153 | if (nskb->len > dst_mtu(nskb->dst)) |
| 154 | goto free_nskb; |
| 155 | |
| 156 | nf_ct_attach(nskb, oldskb); |
| 157 | |
| 158 | NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, nskb, NULL, nskb->dst->dev, |
| 159 | dst_output); |
| 160 | return; |
| 161 | |
| 162 | free_nskb: |
| 163 | kfree_skb(nskb); |
| 164 | } |
| 165 | |
| 166 | static inline void send_unreach(struct sk_buff *skb_in, int code) |
| 167 | { |
| 168 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 169 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 170 | |
| 171 | static unsigned int reject(struct sk_buff **pskb, |
| 172 | const struct net_device *in, |
| 173 | const struct net_device *out, |
| 174 | unsigned int hooknum, |
Patrick McHardy | c498673 | 2006-03-20 18:02:56 -0800 | [diff] [blame] | 175 | const struct xt_target *target, |
Patrick McHardy | fe1cb10 | 2006-08-22 00:35:47 -0700 | [diff] [blame] | 176 | const void *targinfo) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 177 | { |
| 178 | const struct ipt_reject_info *reject = targinfo; |
| 179 | |
| 180 | /* Our naive response construction doesn't deal with IP |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 181 | options, and probably shouldn't try. */ |
Arnaldo Carvalho de Melo | c9bdd4b | 2007-03-12 20:09:15 -0300 | [diff] [blame] | 182 | if (ip_hdrlen(*pskb) != sizeof(struct iphdr)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | return NF_DROP; |
| 184 | |
| 185 | /* WARNING: This code causes reentry within iptables. |
| 186 | This means that the iptables jump stack is now crap. We |
| 187 | must return an absolute verdict. --RR */ |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 188 | switch (reject->with) { |
| 189 | case IPT_ICMP_NET_UNREACHABLE: |
| 190 | send_unreach(*pskb, ICMP_NET_UNREACH); |
| 191 | break; |
| 192 | case IPT_ICMP_HOST_UNREACHABLE: |
| 193 | send_unreach(*pskb, ICMP_HOST_UNREACH); |
| 194 | break; |
| 195 | case IPT_ICMP_PROT_UNREACHABLE: |
| 196 | send_unreach(*pskb, ICMP_PROT_UNREACH); |
| 197 | break; |
| 198 | case IPT_ICMP_PORT_UNREACHABLE: |
| 199 | send_unreach(*pskb, ICMP_PORT_UNREACH); |
| 200 | break; |
| 201 | case IPT_ICMP_NET_PROHIBITED: |
| 202 | send_unreach(*pskb, ICMP_NET_ANO); |
| 203 | break; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 204 | case IPT_ICMP_HOST_PROHIBITED: |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 205 | send_unreach(*pskb, ICMP_HOST_ANO); |
| 206 | break; |
| 207 | case IPT_ICMP_ADMIN_PROHIBITED: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 208 | send_unreach(*pskb, ICMP_PKT_FILTERED); |
| 209 | break; |
| 210 | case IPT_TCP_RESET: |
| 211 | send_reset(*pskb, hooknum); |
| 212 | case IPT_ICMP_ECHOREPLY: |
| 213 | /* Doesn't happen. */ |
| 214 | break; |
| 215 | } |
| 216 | |
| 217 | return NF_DROP; |
| 218 | } |
| 219 | |
Jan Engelhardt | e1931b7 | 2007-07-07 22:16:26 -0700 | [diff] [blame] | 220 | static bool check(const char *tablename, |
| 221 | const void *e_void, |
| 222 | const struct xt_target *target, |
| 223 | void *targinfo, |
| 224 | unsigned int hook_mask) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 225 | { |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 226 | const struct ipt_reject_info *rejinfo = targinfo; |
Harald Welte | 2e4e6a1 | 2006-01-12 13:30:04 -0800 | [diff] [blame] | 227 | const struct ipt_entry *e = e_void; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 228 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 229 | if (rejinfo->with == IPT_ICMP_ECHOREPLY) { |
| 230 | printk("REJECT: ECHOREPLY no longer supported.\n"); |
Jan Engelhardt | e1931b7 | 2007-07-07 22:16:26 -0700 | [diff] [blame] | 231 | return false; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | } else if (rejinfo->with == IPT_TCP_RESET) { |
| 233 | /* Must specify that it's a TCP packet */ |
| 234 | if (e->ip.proto != IPPROTO_TCP |
Jan Engelhardt | 6709dbb | 2007-02-07 15:11:19 -0800 | [diff] [blame] | 235 | || (e->ip.invflags & XT_INV_PROTO)) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 236 | DEBUGP("REJECT: TCP_RESET invalid for non-tcp\n"); |
Jan Engelhardt | e1931b7 | 2007-07-07 22:16:26 -0700 | [diff] [blame] | 237 | return false; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 238 | } |
| 239 | } |
Jan Engelhardt | e1931b7 | 2007-07-07 22:16:26 -0700 | [diff] [blame] | 240 | return true; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 241 | } |
| 242 | |
Patrick McHardy | 9f15c53 | 2007-07-07 22:22:02 -0700 | [diff] [blame] | 243 | static struct xt_target ipt_reject_reg __read_mostly = { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 244 | .name = "REJECT", |
Jan Engelhardt | 6709dbb | 2007-02-07 15:11:19 -0800 | [diff] [blame] | 245 | .family = AF_INET, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 246 | .target = reject, |
Patrick McHardy | 1d5cd90 | 2006-03-20 18:01:14 -0800 | [diff] [blame] | 247 | .targetsize = sizeof(struct ipt_reject_info), |
| 248 | .table = "filter", |
| 249 | .hooks = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | |
| 250 | (1 << NF_IP_LOCAL_OUT), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 251 | .checkentry = check, |
| 252 | .me = THIS_MODULE, |
| 253 | }; |
| 254 | |
Andrew Morton | 65b4b4e | 2006-03-28 16:37:06 -0800 | [diff] [blame] | 255 | static int __init ipt_reject_init(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 256 | { |
Jan Engelhardt | 6709dbb | 2007-02-07 15:11:19 -0800 | [diff] [blame] | 257 | return xt_register_target(&ipt_reject_reg); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 258 | } |
| 259 | |
Andrew Morton | 65b4b4e | 2006-03-28 16:37:06 -0800 | [diff] [blame] | 260 | static void __exit ipt_reject_fini(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 261 | { |
Jan Engelhardt | 6709dbb | 2007-02-07 15:11:19 -0800 | [diff] [blame] | 262 | xt_unregister_target(&ipt_reject_reg); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 263 | } |
| 264 | |
Andrew Morton | 65b4b4e | 2006-03-28 16:37:06 -0800 | [diff] [blame] | 265 | module_init(ipt_reject_init); |
| 266 | module_exit(ipt_reject_fini); |