Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 1 | /* (C) 1999-2001 Paul `Rusty' Russell |
| 2 | * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> |
| 3 | * |
| 4 | * This program is free software; you can redistribute it and/or modify |
| 5 | * it under the terms of the GNU General Public License version 2 as |
| 6 | * published by the Free Software Foundation. |
| 7 | */ |
| 8 | |
Pablo Neira Ayuso | ab2d725 | 2014-10-10 11:25:20 +0200 | [diff] [blame] | 9 | #include <linux/module.h> |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 10 | #include <net/ip.h> |
| 11 | #include <net/tcp.h> |
| 12 | #include <net/route.h> |
| 13 | #include <net/dst.h> |
Florian Westphal | 5676864 | 2014-11-13 10:04:16 +0100 | [diff] [blame] | 14 | #include <net/netfilter/ipv4/nf_reject.h> |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 15 | #include <linux/netfilter_ipv4.h> |
Florian Westphal | c737b7c | 2015-04-02 14:31:41 +0200 | [diff] [blame] | 16 | #include <linux/netfilter_bridge.h> |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 17 | |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 18 | const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, |
| 19 | struct tcphdr *_oth, int hook) |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 20 | { |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 21 | const struct tcphdr *oth; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 22 | |
| 23 | /* IP header checks: fragment. */ |
| 24 | if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 25 | return NULL; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 26 | |
Liping Zhang | e1dbbc5 | 2016-06-20 21:26:28 +0800 | [diff] [blame] | 27 | if (ip_hdr(oldskb)->protocol != IPPROTO_TCP) |
| 28 | return NULL; |
| 29 | |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 30 | oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 31 | sizeof(struct tcphdr), _oth); |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 32 | if (oth == NULL) |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 33 | return NULL; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 34 | |
| 35 | /* No RST for RST. */ |
| 36 | if (oth->rst) |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 37 | return NULL; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 38 | |
| 39 | /* Check checksum */ |
| 40 | if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 41 | return NULL; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 42 | |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 43 | return oth; |
| 44 | } |
| 45 | EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_get); |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 46 | |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 47 | struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, |
| 48 | const struct sk_buff *oldskb, |
Florian Westphal | a03a8db | 2015-03-09 23:04:15 +0100 | [diff] [blame] | 49 | __u8 protocol, int ttl) |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 50 | { |
| 51 | struct iphdr *niph, *oiph = ip_hdr(oldskb); |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 52 | |
| 53 | skb_reset_network_header(nskb); |
| 54 | niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr)); |
| 55 | niph->version = 4; |
| 56 | niph->ihl = sizeof(struct iphdr) / 4; |
| 57 | niph->tos = 0; |
| 58 | niph->id = 0; |
| 59 | niph->frag_off = htons(IP_DF); |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 60 | niph->protocol = protocol; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 61 | niph->check = 0; |
| 62 | niph->saddr = oiph->daddr; |
| 63 | niph->daddr = oiph->saddr; |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 64 | niph->ttl = ttl; |
| 65 | |
| 66 | nskb->protocol = htons(ETH_P_IP); |
| 67 | |
| 68 | return niph; |
| 69 | } |
| 70 | EXPORT_SYMBOL_GPL(nf_reject_iphdr_put); |
| 71 | |
| 72 | void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb, |
| 73 | const struct tcphdr *oth) |
| 74 | { |
| 75 | struct iphdr *niph = ip_hdr(nskb); |
| 76 | struct tcphdr *tcph; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 77 | |
| 78 | skb_reset_transport_header(nskb); |
| 79 | tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); |
| 80 | memset(tcph, 0, sizeof(*tcph)); |
| 81 | tcph->source = oth->dest; |
| 82 | tcph->dest = oth->source; |
| 83 | tcph->doff = sizeof(struct tcphdr) / 4; |
| 84 | |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 85 | if (oth->ack) { |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 86 | tcph->seq = oth->ack_seq; |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 87 | } else { |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 88 | tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + |
| 89 | oldskb->len - ip_hdrlen(oldskb) - |
| 90 | (oth->doff << 2)); |
| 91 | tcph->ack = 1; |
| 92 | } |
| 93 | |
| 94 | tcph->rst = 1; |
| 95 | tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr, |
| 96 | niph->daddr, 0); |
| 97 | nskb->ip_summed = CHECKSUM_PARTIAL; |
| 98 | nskb->csum_start = (unsigned char *)tcph - nskb->head; |
| 99 | nskb->csum_offset = offsetof(struct tcphdr, check); |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 100 | } |
| 101 | EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put); |
| 102 | |
| 103 | /* Send RST reply */ |
Eric W. Biederman | 372892e | 2015-09-25 15:07:27 -0500 | [diff] [blame] | 104 | void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 105 | { |
| 106 | struct sk_buff *nskb; |
| 107 | const struct iphdr *oiph; |
| 108 | struct iphdr *niph; |
| 109 | const struct tcphdr *oth; |
| 110 | struct tcphdr _oth; |
| 111 | |
| 112 | oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook); |
| 113 | if (!oth) |
| 114 | return; |
| 115 | |
| 116 | if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) |
| 117 | return; |
| 118 | |
| 119 | oiph = ip_hdr(oldskb); |
| 120 | |
| 121 | nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + |
| 122 | LL_MAX_HEADER, GFP_ATOMIC); |
| 123 | if (!nskb) |
| 124 | return; |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 125 | |
| 126 | /* ip_route_me_harder expects skb->dst to be set */ |
| 127 | skb_dst_set_noref(nskb, skb_dst(oldskb)); |
| 128 | |
Pau Espin Pedrol | 9acfb31 | 2017-01-06 20:33:27 +0100 | [diff] [blame] | 129 | nskb->mark = IP4_REPLY_MARK(net, oldskb->mark); |
| 130 | |
Pablo Neira Ayuso | 052b949 | 2014-10-25 18:24:57 +0200 | [diff] [blame] | 131 | skb_reserve(nskb, LL_MAX_HEADER); |
| 132 | niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, |
| 133 | ip4_dst_hoplimit(skb_dst(nskb))); |
| 134 | nf_reject_ip_tcphdr_put(nskb, oldskb, oth); |
| 135 | |
Eric W. Biederman | e45f506 | 2015-09-25 15:07:30 -0500 | [diff] [blame] | 136 | if (ip_route_me_harder(net, nskb, RTN_UNSPEC)) |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 137 | goto free_nskb; |
| 138 | |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 139 | /* "Never happens" */ |
| 140 | if (nskb->len > dst_mtu(skb_dst(nskb))) |
| 141 | goto free_nskb; |
| 142 | |
| 143 | nf_ct_attach(nskb, oldskb); |
| 144 | |
| 145 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
| 146 | /* If we use ip_local_out for bridged traffic, the MAC source on |
| 147 | * the RST will be ours, instead of the destination's. This confuses |
| 148 | * some routers/firewalls, and they drop the packet. So we need to |
| 149 | * build the eth header using the original destination's MAC as the |
| 150 | * source, and send the RST packet directly. |
| 151 | */ |
| 152 | if (oldskb->nf_bridge) { |
| 153 | struct ethhdr *oeth = eth_hdr(oldskb); |
Florian Westphal | c737b7c | 2015-04-02 14:31:41 +0200 | [diff] [blame] | 154 | |
| 155 | nskb->dev = nf_bridge_get_physindev(oldskb); |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 156 | niph->tot_len = htons(nskb->len); |
| 157 | ip_send_check(niph); |
| 158 | if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol), |
| 159 | oeth->h_source, oeth->h_dest, nskb->len) < 0) |
| 160 | goto free_nskb; |
| 161 | dev_queue_xmit(nskb); |
| 162 | } else |
| 163 | #endif |
Eric W. Biederman | 33224b1 | 2015-10-07 16:48:46 -0500 | [diff] [blame] | 164 | ip_local_out(net, nskb->sk, nskb); |
Pablo Neira Ayuso | c8d7b98 | 2014-09-26 14:35:15 +0200 | [diff] [blame] | 165 | |
| 166 | return; |
| 167 | |
| 168 | free_nskb: |
| 169 | kfree_skb(nskb); |
| 170 | } |
| 171 | EXPORT_SYMBOL_GPL(nf_send_reset); |
Pablo Neira Ayuso | ab2d725 | 2014-10-10 11:25:20 +0200 | [diff] [blame] | 172 | |
Florian Westphal | ee586bb | 2015-02-16 18:54:04 +0100 | [diff] [blame] | 173 | void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) |
| 174 | { |
| 175 | struct iphdr *iph = ip_hdr(skb_in); |
| 176 | u8 proto; |
| 177 | |
| 178 | if (skb_in->csum_bad || iph->frag_off & htons(IP_OFFSET)) |
| 179 | return; |
| 180 | |
| 181 | if (skb_csum_unnecessary(skb_in)) { |
| 182 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); |
| 183 | return; |
| 184 | } |
| 185 | |
| 186 | if (iph->protocol == IPPROTO_TCP || iph->protocol == IPPROTO_UDP) |
| 187 | proto = iph->protocol; |
| 188 | else |
| 189 | proto = 0; |
| 190 | |
| 191 | if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0) |
| 192 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); |
| 193 | } |
| 194 | EXPORT_SYMBOL_GPL(nf_send_unreach); |
| 195 | |
Pablo Neira Ayuso | ab2d725 | 2014-10-10 11:25:20 +0200 | [diff] [blame] | 196 | MODULE_LICENSE("GPL"); |