Commit | Line | Data |
---|---|---|
c8d7b98b PNA |
1 | /* (C) 1999-2001 Paul `Rusty' Russell |
2 | * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License version 2 as | |
6 | * published by the Free Software Foundation. | |
7 | */ | |
8 | ||
ab2d7251 | 9 | #include <linux/module.h> |
c8d7b98b PNA |
10 | #include <net/ip.h> |
11 | #include <net/tcp.h> | |
12 | #include <net/route.h> | |
13 | #include <net/dst.h> | |
56768644 | 14 | #include <net/netfilter/ipv4/nf_reject.h> |
c8d7b98b | 15 | #include <linux/netfilter_ipv4.h> |
c737b7c4 | 16 | #include <linux/netfilter_bridge.h> |
c8d7b98b | 17 | |
052b9498 PNA |
18 | const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, |
19 | struct tcphdr *_oth, int hook) | |
c8d7b98b | 20 | { |
c8d7b98b | 21 | const struct tcphdr *oth; |
c8d7b98b PNA |
22 | |
23 | /* IP header checks: fragment. */ | |
24 | if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) | |
052b9498 | 25 | return NULL; |
c8d7b98b | 26 | |
e1dbbc59 LZ |
27 | if (ip_hdr(oldskb)->protocol != IPPROTO_TCP) |
28 | return NULL; | |
29 | ||
c8d7b98b | 30 | oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), |
052b9498 | 31 | sizeof(struct tcphdr), _oth); |
c8d7b98b | 32 | if (oth == NULL) |
052b9498 | 33 | return NULL; |
c8d7b98b PNA |
34 | |
35 | /* No RST for RST. */ | |
36 | if (oth->rst) | |
052b9498 | 37 | return NULL; |
c8d7b98b PNA |
38 | |
39 | /* Check checksum */ | |
40 | if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) | |
052b9498 | 41 | return NULL; |
c8d7b98b | 42 | |
052b9498 PNA |
43 | return oth; |
44 | } | |
45 | EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_get); | |
c8d7b98b | 46 | |
052b9498 PNA |
47 | struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, |
48 | const struct sk_buff *oldskb, | |
a03a8dbe | 49 | __u8 protocol, int ttl) |
052b9498 PNA |
50 | { |
51 | struct iphdr *niph, *oiph = ip_hdr(oldskb); | |
c8d7b98b PNA |
52 | |
53 | skb_reset_network_header(nskb); | |
4df864c1 | 54 | niph = skb_put(nskb, sizeof(struct iphdr)); |
c8d7b98b PNA |
55 | niph->version = 4; |
56 | niph->ihl = sizeof(struct iphdr) / 4; | |
57 | niph->tos = 0; | |
58 | niph->id = 0; | |
59 | niph->frag_off = htons(IP_DF); | |
052b9498 | 60 | niph->protocol = protocol; |
c8d7b98b PNA |
61 | niph->check = 0; |
62 | niph->saddr = oiph->daddr; | |
63 | niph->daddr = oiph->saddr; | |
052b9498 PNA |
64 | niph->ttl = ttl; |
65 | ||
66 | nskb->protocol = htons(ETH_P_IP); | |
67 | ||
68 | return niph; | |
69 | } | |
70 | EXPORT_SYMBOL_GPL(nf_reject_iphdr_put); | |
71 | ||
72 | void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb, | |
73 | const struct tcphdr *oth) | |
74 | { | |
75 | struct iphdr *niph = ip_hdr(nskb); | |
76 | struct tcphdr *tcph; | |
c8d7b98b PNA |
77 | |
78 | skb_reset_transport_header(nskb); | |
b080db58 | 79 | tcph = skb_put_zero(nskb, sizeof(struct tcphdr)); |
c8d7b98b PNA |
80 | tcph->source = oth->dest; |
81 | tcph->dest = oth->source; | |
82 | tcph->doff = sizeof(struct tcphdr) / 4; | |
83 | ||
052b9498 | 84 | if (oth->ack) { |
c8d7b98b | 85 | tcph->seq = oth->ack_seq; |
052b9498 | 86 | } else { |
c8d7b98b PNA |
87 | tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + |
88 | oldskb->len - ip_hdrlen(oldskb) - | |
89 | (oth->doff << 2)); | |
90 | tcph->ack = 1; | |
91 | } | |
92 | ||
93 | tcph->rst = 1; | |
94 | tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr, | |
95 | niph->daddr, 0); | |
96 | nskb->ip_summed = CHECKSUM_PARTIAL; | |
97 | nskb->csum_start = (unsigned char *)tcph - nskb->head; | |
98 | nskb->csum_offset = offsetof(struct tcphdr, check); | |
052b9498 PNA |
99 | } |
100 | EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put); | |
101 | ||
102 | /* Send RST reply */ | |
372892ec | 103 | void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) |
052b9498 | 104 | { |
c4b0e771 | 105 | struct net_device *br_indev __maybe_unused; |
052b9498 | 106 | struct sk_buff *nskb; |
052b9498 PNA |
107 | struct iphdr *niph; |
108 | const struct tcphdr *oth; | |
109 | struct tcphdr _oth; | |
110 | ||
111 | oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook); | |
112 | if (!oth) | |
113 | return; | |
114 | ||
115 | if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) | |
116 | return; | |
117 | ||
052b9498 PNA |
118 | nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + |
119 | LL_MAX_HEADER, GFP_ATOMIC); | |
120 | if (!nskb) | |
121 | return; | |
c8d7b98b PNA |
122 | |
123 | /* ip_route_me_harder expects skb->dst to be set */ | |
124 | skb_dst_set_noref(nskb, skb_dst(oldskb)); | |
125 | ||
cc31d43b PEP |
126 | nskb->mark = IP4_REPLY_MARK(net, oldskb->mark); |
127 | ||
052b9498 PNA |
128 | skb_reserve(nskb, LL_MAX_HEADER); |
129 | niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, | |
130 | ip4_dst_hoplimit(skb_dst(nskb))); | |
131 | nf_reject_ip_tcphdr_put(nskb, oldskb, oth); | |
132 | ||
e45f5066 | 133 | if (ip_route_me_harder(net, nskb, RTN_UNSPEC)) |
c8d7b98b PNA |
134 | goto free_nskb; |
135 | ||
7400bb4b TT |
136 | niph = ip_hdr(nskb); |
137 | ||
c8d7b98b PNA |
138 | /* "Never happens" */ |
139 | if (nskb->len > dst_mtu(skb_dst(nskb))) | |
140 | goto free_nskb; | |
141 | ||
142 | nf_ct_attach(nskb, oldskb); | |
143 | ||
144 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) | |
145 | /* If we use ip_local_out for bridged traffic, the MAC source on | |
146 | * the RST will be ours, instead of the destination's. This confuses | |
147 | * some routers/firewalls, and they drop the packet. So we need to | |
148 | * build the eth header using the original destination's MAC as the | |
149 | * source, and send the RST packet directly. | |
150 | */ | |
c4b0e771 FW |
151 | br_indev = nf_bridge_get_physindev(oldskb); |
152 | if (br_indev) { | |
c8d7b98b | 153 | struct ethhdr *oeth = eth_hdr(oldskb); |
c737b7c4 | 154 | |
c4b0e771 | 155 | nskb->dev = br_indev; |
c8d7b98b PNA |
156 | niph->tot_len = htons(nskb->len); |
157 | ip_send_check(niph); | |
158 | if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol), | |
159 | oeth->h_source, oeth->h_dest, nskb->len) < 0) | |
160 | goto free_nskb; | |
161 | dev_queue_xmit(nskb); | |
162 | } else | |
163 | #endif | |
33224b16 | 164 | ip_local_out(net, nskb->sk, nskb); |
c8d7b98b PNA |
165 | |
166 | return; | |
167 | ||
168 | free_nskb: | |
169 | kfree_skb(nskb); | |
170 | } | |
171 | EXPORT_SYMBOL_GPL(nf_send_reset); | |
ab2d7251 | 172 | |
ee586bbc FW |
173 | void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) |
174 | { | |
175 | struct iphdr *iph = ip_hdr(skb_in); | |
7fc38225 | 176 | u8 proto = iph->protocol; |
ee586bbc | 177 | |
219f1d79 | 178 | if (iph->frag_off & htons(IP_OFFSET)) |
ee586bbc FW |
179 | return; |
180 | ||
7fc38225 | 181 | if (skb_csum_unnecessary(skb_in) || !nf_reject_verify_csum(proto)) { |
ee586bbc FW |
182 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); |
183 | return; | |
184 | } | |
185 | ||
ee586bbc FW |
186 | if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0) |
187 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); | |
188 | } | |
189 | EXPORT_SYMBOL_GPL(nf_send_unreach); | |
190 | ||
ab2d7251 | 191 | MODULE_LICENSE("GPL"); |