Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * This is a module which is used for rejecting packets. |
| 3 | * Added support for customized reject packets (Jozsef Kadlecsik). |
| 4 | * Added support for ICMP type-3-code-13 (Maciej Soltysiak). [RFC 1812] |
| 5 | */ |
| 6 | |
| 7 | /* (C) 1999-2001 Paul `Rusty' Russell |
| 8 | * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> |
| 9 | * |
| 10 | * This program is free software; you can redistribute it and/or modify |
| 11 | * it under the terms of the GNU General Public License version 2 as |
| 12 | * published by the Free Software Foundation. |
| 13 | */ |
| 14 | |
| 15 | #include <linux/config.h> |
| 16 | #include <linux/module.h> |
| 17 | #include <linux/skbuff.h> |
| 18 | #include <linux/ip.h> |
| 19 | #include <linux/udp.h> |
| 20 | #include <linux/icmp.h> |
| 21 | #include <net/icmp.h> |
| 22 | #include <net/ip.h> |
| 23 | #include <net/tcp.h> |
| 24 | #include <net/route.h> |
| 25 | #include <net/dst.h> |
| 26 | #include <linux/netfilter_ipv4/ip_tables.h> |
| 27 | #include <linux/netfilter_ipv4/ipt_REJECT.h> |
| 28 | #ifdef CONFIG_BRIDGE_NETFILTER |
| 29 | #include <linux/netfilter_bridge.h> |
| 30 | #endif |
| 31 | |
| 32 | MODULE_LICENSE("GPL"); |
| 33 | MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); |
| 34 | MODULE_DESCRIPTION("iptables REJECT target module"); |
| 35 | |
| 36 | #if 0 |
| 37 | #define DEBUGP printk |
| 38 | #else |
| 39 | #define DEBUGP(format, args...) |
| 40 | #endif |
| 41 | |
| 42 | static inline struct rtable *route_reverse(struct sk_buff *skb, |
| 43 | struct tcphdr *tcph, int hook) |
| 44 | { |
| 45 | struct iphdr *iph = skb->nh.iph; |
| 46 | struct dst_entry *odst; |
| 47 | struct flowi fl = {}; |
| 48 | struct rtable *rt; |
| 49 | |
| 50 | /* We don't require ip forwarding to be enabled to be able to |
| 51 | * send a RST reply for bridged traffic. */ |
| 52 | if (hook != NF_IP_FORWARD |
| 53 | #ifdef CONFIG_BRIDGE_NETFILTER |
| 54 | || (skb->nf_bridge && skb->nf_bridge->mask & BRNF_BRIDGED) |
| 55 | #endif |
| 56 | ) { |
| 57 | fl.nl_u.ip4_u.daddr = iph->saddr; |
| 58 | if (hook == NF_IP_LOCAL_IN) |
| 59 | fl.nl_u.ip4_u.saddr = iph->daddr; |
| 60 | fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); |
| 61 | |
| 62 | if (ip_route_output_key(&rt, &fl) != 0) |
| 63 | return NULL; |
| 64 | } else { |
| 65 | /* non-local src, find valid iif to satisfy |
| 66 | * rp-filter when calling ip_route_input. */ |
| 67 | fl.nl_u.ip4_u.daddr = iph->daddr; |
| 68 | if (ip_route_output_key(&rt, &fl) != 0) |
| 69 | return NULL; |
| 70 | |
| 71 | odst = skb->dst; |
| 72 | if (ip_route_input(skb, iph->saddr, iph->daddr, |
| 73 | RT_TOS(iph->tos), rt->u.dst.dev) != 0) { |
| 74 | dst_release(&rt->u.dst); |
| 75 | return NULL; |
| 76 | } |
| 77 | dst_release(&rt->u.dst); |
| 78 | rt = (struct rtable *)skb->dst; |
| 79 | skb->dst = odst; |
| 80 | |
| 81 | fl.nl_u.ip4_u.daddr = iph->saddr; |
| 82 | fl.nl_u.ip4_u.saddr = iph->daddr; |
| 83 | fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); |
| 84 | } |
| 85 | |
| 86 | if (rt->u.dst.error) { |
| 87 | dst_release(&rt->u.dst); |
| 88 | return NULL; |
| 89 | } |
| 90 | |
| 91 | fl.proto = IPPROTO_TCP; |
| 92 | fl.fl_ip_sport = tcph->dest; |
| 93 | fl.fl_ip_dport = tcph->source; |
| 94 | |
Patrick McHardy | e104411b | 2005-09-08 15:11:55 -0700 | [diff] [blame] | 95 | xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 96 | |
| 97 | return rt; |
| 98 | } |
| 99 | |
| 100 | /* Send RST reply */ |
| 101 | static void send_reset(struct sk_buff *oldskb, int hook) |
| 102 | { |
| 103 | struct sk_buff *nskb; |
Patrick McHardy | 6150bac | 2005-06-21 14:03:46 -0700 | [diff] [blame] | 104 | struct iphdr *iph = oldskb->nh.iph; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 105 | struct tcphdr _otcph, *oth, *tcph; |
| 106 | struct rtable *rt; |
| 107 | u_int16_t tmp_port; |
| 108 | u_int32_t tmp_addr; |
| 109 | int needs_ack; |
| 110 | int hh_len; |
| 111 | |
| 112 | /* IP header checks: fragment. */ |
| 113 | if (oldskb->nh.iph->frag_off & htons(IP_OFFSET)) |
| 114 | return; |
| 115 | |
| 116 | oth = skb_header_pointer(oldskb, oldskb->nh.iph->ihl * 4, |
| 117 | sizeof(_otcph), &_otcph); |
| 118 | if (oth == NULL) |
| 119 | return; |
| 120 | |
| 121 | /* No RST for RST. */ |
| 122 | if (oth->rst) |
| 123 | return; |
| 124 | |
Patrick McHardy | 6150bac | 2005-06-21 14:03:46 -0700 | [diff] [blame] | 125 | /* Check checksum */ |
Patrick McHardy | 96f6bf8 | 2006-04-06 14:19:24 -0700 | [diff] [blame] | 126 | if (nf_ip_checksum(oldskb, hook, iph->ihl * 4, IPPROTO_TCP)) |
Patrick McHardy | 6150bac | 2005-06-21 14:03:46 -0700 | [diff] [blame] | 127 | return; |
| 128 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 129 | if ((rt = route_reverse(oldskb, oth, hook)) == NULL) |
| 130 | return; |
| 131 | |
| 132 | hh_len = LL_RESERVED_SPACE(rt->u.dst.dev); |
| 133 | |
| 134 | /* We need a linear, writeable skb. We also need to expand |
| 135 | headroom in case hh_len of incoming interface < hh_len of |
| 136 | outgoing interface */ |
| 137 | nskb = skb_copy_expand(oldskb, hh_len, skb_tailroom(oldskb), |
| 138 | GFP_ATOMIC); |
| 139 | if (!nskb) { |
| 140 | dst_release(&rt->u.dst); |
| 141 | return; |
| 142 | } |
| 143 | |
| 144 | dst_release(nskb->dst); |
| 145 | nskb->dst = &rt->u.dst; |
| 146 | |
| 147 | /* This packet will not be the same as the other: clear nf fields */ |
| 148 | nf_reset(nskb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 149 | nskb->nfmark = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 150 | |
| 151 | tcph = (struct tcphdr *)((u_int32_t*)nskb->nh.iph + nskb->nh.iph->ihl); |
| 152 | |
| 153 | /* Swap source and dest */ |
| 154 | tmp_addr = nskb->nh.iph->saddr; |
| 155 | nskb->nh.iph->saddr = nskb->nh.iph->daddr; |
| 156 | nskb->nh.iph->daddr = tmp_addr; |
| 157 | tmp_port = tcph->source; |
| 158 | tcph->source = tcph->dest; |
| 159 | tcph->dest = tmp_port; |
| 160 | |
| 161 | /* Truncate to length (no data) */ |
| 162 | tcph->doff = sizeof(struct tcphdr)/4; |
| 163 | skb_trim(nskb, nskb->nh.iph->ihl*4 + sizeof(struct tcphdr)); |
| 164 | nskb->nh.iph->tot_len = htons(nskb->len); |
| 165 | |
| 166 | if (tcph->ack) { |
| 167 | needs_ack = 0; |
| 168 | tcph->seq = oth->ack_seq; |
| 169 | tcph->ack_seq = 0; |
| 170 | } else { |
| 171 | needs_ack = 1; |
| 172 | tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin |
| 173 | + oldskb->len - oldskb->nh.iph->ihl*4 |
| 174 | - (oth->doff<<2)); |
| 175 | tcph->seq = 0; |
| 176 | } |
| 177 | |
| 178 | /* Reset flags */ |
| 179 | ((u_int8_t *)tcph)[13] = 0; |
| 180 | tcph->rst = 1; |
| 181 | tcph->ack = needs_ack; |
| 182 | |
| 183 | tcph->window = 0; |
| 184 | tcph->urg_ptr = 0; |
| 185 | |
| 186 | /* Adjust TCP checksum */ |
| 187 | tcph->check = 0; |
| 188 | tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr), |
| 189 | nskb->nh.iph->saddr, |
| 190 | nskb->nh.iph->daddr, |
| 191 | csum_partial((char *)tcph, |
| 192 | sizeof(struct tcphdr), 0)); |
| 193 | |
| 194 | /* Adjust IP TTL, DF */ |
Yasuyuki Kozakai | e8eaedf | 2006-01-05 12:28:57 -0800 | [diff] [blame] | 195 | nskb->nh.iph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 196 | /* Set DF, id = 0 */ |
| 197 | nskb->nh.iph->frag_off = htons(IP_DF); |
| 198 | nskb->nh.iph->id = 0; |
| 199 | |
| 200 | /* Adjust IP checksum */ |
| 201 | nskb->nh.iph->check = 0; |
| 202 | nskb->nh.iph->check = ip_fast_csum((unsigned char *)nskb->nh.iph, |
| 203 | nskb->nh.iph->ihl); |
| 204 | |
| 205 | /* "Never happens" */ |
| 206 | if (nskb->len > dst_mtu(nskb->dst)) |
| 207 | goto free_nskb; |
| 208 | |
| 209 | nf_ct_attach(nskb, oldskb); |
| 210 | |
| 211 | NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, nskb, NULL, nskb->dst->dev, |
| 212 | dst_output); |
| 213 | return; |
| 214 | |
| 215 | free_nskb: |
| 216 | kfree_skb(nskb); |
| 217 | } |
| 218 | |
| 219 | static inline void send_unreach(struct sk_buff *skb_in, int code) |
| 220 | { |
| 221 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); |
| 222 | } |
| 223 | |
| 224 | static unsigned int reject(struct sk_buff **pskb, |
| 225 | const struct net_device *in, |
| 226 | const struct net_device *out, |
| 227 | unsigned int hooknum, |
Patrick McHardy | c498673 | 2006-03-20 18:02:56 -0800 | [diff] [blame] | 228 | const struct xt_target *target, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 229 | const void *targinfo, |
| 230 | void *userinfo) |
| 231 | { |
| 232 | const struct ipt_reject_info *reject = targinfo; |
| 233 | |
| 234 | /* Our naive response construction doesn't deal with IP |
| 235 | options, and probably shouldn't try. */ |
| 236 | if ((*pskb)->nh.iph->ihl<<2 != sizeof(struct iphdr)) |
| 237 | return NF_DROP; |
| 238 | |
| 239 | /* WARNING: This code causes reentry within iptables. |
| 240 | This means that the iptables jump stack is now crap. We |
| 241 | must return an absolute verdict. --RR */ |
| 242 | switch (reject->with) { |
| 243 | case IPT_ICMP_NET_UNREACHABLE: |
| 244 | send_unreach(*pskb, ICMP_NET_UNREACH); |
| 245 | break; |
| 246 | case IPT_ICMP_HOST_UNREACHABLE: |
| 247 | send_unreach(*pskb, ICMP_HOST_UNREACH); |
| 248 | break; |
| 249 | case IPT_ICMP_PROT_UNREACHABLE: |
| 250 | send_unreach(*pskb, ICMP_PROT_UNREACH); |
| 251 | break; |
| 252 | case IPT_ICMP_PORT_UNREACHABLE: |
| 253 | send_unreach(*pskb, ICMP_PORT_UNREACH); |
| 254 | break; |
| 255 | case IPT_ICMP_NET_PROHIBITED: |
| 256 | send_unreach(*pskb, ICMP_NET_ANO); |
| 257 | break; |
| 258 | case IPT_ICMP_HOST_PROHIBITED: |
| 259 | send_unreach(*pskb, ICMP_HOST_ANO); |
| 260 | break; |
| 261 | case IPT_ICMP_ADMIN_PROHIBITED: |
| 262 | send_unreach(*pskb, ICMP_PKT_FILTERED); |
| 263 | break; |
| 264 | case IPT_TCP_RESET: |
| 265 | send_reset(*pskb, hooknum); |
| 266 | case IPT_ICMP_ECHOREPLY: |
| 267 | /* Doesn't happen. */ |
| 268 | break; |
| 269 | } |
| 270 | |
| 271 | return NF_DROP; |
| 272 | } |
| 273 | |
| 274 | static int check(const char *tablename, |
Harald Welte | 2e4e6a1 | 2006-01-12 13:30:04 -0800 | [diff] [blame] | 275 | const void *e_void, |
Patrick McHardy | c498673 | 2006-03-20 18:02:56 -0800 | [diff] [blame] | 276 | const struct xt_target *target, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 277 | void *targinfo, |
| 278 | unsigned int targinfosize, |
| 279 | unsigned int hook_mask) |
| 280 | { |
| 281 | const struct ipt_reject_info *rejinfo = targinfo; |
Harald Welte | 2e4e6a1 | 2006-01-12 13:30:04 -0800 | [diff] [blame] | 282 | const struct ipt_entry *e = e_void; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 283 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 284 | if (rejinfo->with == IPT_ICMP_ECHOREPLY) { |
| 285 | printk("REJECT: ECHOREPLY no longer supported.\n"); |
| 286 | return 0; |
| 287 | } else if (rejinfo->with == IPT_TCP_RESET) { |
| 288 | /* Must specify that it's a TCP packet */ |
| 289 | if (e->ip.proto != IPPROTO_TCP |
| 290 | || (e->ip.invflags & IPT_INV_PROTO)) { |
| 291 | DEBUGP("REJECT: TCP_RESET invalid for non-tcp\n"); |
| 292 | return 0; |
| 293 | } |
| 294 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 295 | return 1; |
| 296 | } |
| 297 | |
| 298 | static struct ipt_target ipt_reject_reg = { |
| 299 | .name = "REJECT", |
| 300 | .target = reject, |
Patrick McHardy | 1d5cd90 | 2006-03-20 18:01:14 -0800 | [diff] [blame] | 301 | .targetsize = sizeof(struct ipt_reject_info), |
| 302 | .table = "filter", |
| 303 | .hooks = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | |
| 304 | (1 << NF_IP_LOCAL_OUT), |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 305 | .checkentry = check, |
| 306 | .me = THIS_MODULE, |
| 307 | }; |
| 308 | |
Andrew Morton | 65b4b4e | 2006-03-28 16:37:06 -0800 | [diff] [blame] | 309 | static int __init ipt_reject_init(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 310 | { |
| 311 | return ipt_register_target(&ipt_reject_reg); |
| 312 | } |
| 313 | |
Andrew Morton | 65b4b4e | 2006-03-28 16:37:06 -0800 | [diff] [blame] | 314 | static void __exit ipt_reject_fini(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 315 | { |
| 316 | ipt_unregister_target(&ipt_reject_reg); |
| 317 | } |
| 318 | |
Andrew Morton | 65b4b4e | 2006-03-28 16:37:06 -0800 | [diff] [blame] | 319 | module_init(ipt_reject_init); |
| 320 | module_exit(ipt_reject_fini); |