1 // SPDX-License-Identifier: GPL-2.0-only 2 /* (C) 1999-2001 Paul `Rusty' Russell 3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 4 */ 5 6 #include <linux/module.h> 7 #include <net/ip.h> 8 #include <net/tcp.h> 9 #include <net/route.h> 10 #include <net/dst.h> 11 #include <net/netfilter/ipv4/nf_reject.h> 12 #include <linux/netfilter_ipv4.h> 13 #include <linux/netfilter_bridge.h> 14 15 const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, 16 struct tcphdr *_oth, int hook) 17 { 18 const struct tcphdr *oth; 19 20 /* IP header checks: fragment. */ 21 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) 22 return NULL; 23 24 if (ip_hdr(oldskb)->protocol != IPPROTO_TCP) 25 return NULL; 26 27 oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), 28 sizeof(struct tcphdr), _oth); 29 if (oth == NULL) 30 return NULL; 31 32 /* No RST for RST. */ 33 if (oth->rst) 34 return NULL; 35 36 /* Check checksum */ 37 if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) 38 return NULL; 39 40 return oth; 41 } 42 EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_get); 43 44 struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, 45 const struct sk_buff *oldskb, 46 __u8 protocol, int ttl) 47 { 48 struct iphdr *niph, *oiph = ip_hdr(oldskb); 49 50 skb_reset_network_header(nskb); 51 niph = skb_put(nskb, sizeof(struct iphdr)); 52 niph->version = 4; 53 niph->ihl = sizeof(struct iphdr) / 4; 54 niph->tos = 0; 55 niph->id = 0; 56 niph->frag_off = htons(IP_DF); 57 niph->protocol = protocol; 58 niph->check = 0; 59 niph->saddr = oiph->daddr; 60 niph->daddr = oiph->saddr; 61 niph->ttl = ttl; 62 63 nskb->protocol = htons(ETH_P_IP); 64 65 return niph; 66 } 67 EXPORT_SYMBOL_GPL(nf_reject_iphdr_put); 68 69 void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb, 70 const struct tcphdr *oth) 71 { 72 struct iphdr *niph = ip_hdr(nskb); 73 struct tcphdr *tcph; 74 75 skb_reset_transport_header(nskb); 76 tcph = skb_put_zero(nskb, sizeof(struct tcphdr)); 77 tcph->source = oth->dest; 78 tcph->dest = oth->source; 79 tcph->doff = sizeof(struct tcphdr) / 4; 80 81 if (oth->ack) { 82 tcph->seq = oth->ack_seq; 83 } else { 84 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + 85 oldskb->len - ip_hdrlen(oldskb) - 86 (oth->doff << 2)); 87 tcph->ack = 1; 88 } 89 90 tcph->rst = 1; 91 tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr, 92 niph->daddr, 0); 93 nskb->ip_summed = CHECKSUM_PARTIAL; 94 nskb->csum_start = (unsigned char *)tcph - nskb->head; 95 nskb->csum_offset = offsetof(struct tcphdr, check); 96 } 97 EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put); 98 99 /* Send RST reply */ 100 void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) 101 { 102 struct net_device *br_indev __maybe_unused; 103 struct sk_buff *nskb; 104 struct iphdr *niph; 105 const struct tcphdr *oth; 106 struct tcphdr _oth; 107 108 oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook); 109 if (!oth) 110 return; 111 112 if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) 113 return; 114 115 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + 116 LL_MAX_HEADER, GFP_ATOMIC); 117 if (!nskb) 118 return; 119 120 /* ip_route_me_harder expects skb->dst to be set */ 121 skb_dst_set_noref(nskb, skb_dst(oldskb)); 122 123 nskb->mark = IP4_REPLY_MARK(net, oldskb->mark); 124 125 skb_reserve(nskb, LL_MAX_HEADER); 126 niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, 127 ip4_dst_hoplimit(skb_dst(nskb))); 128 nf_reject_ip_tcphdr_put(nskb, oldskb, oth); 129 130 if (ip_route_me_harder(net, nskb, RTN_UNSPEC)) 131 goto free_nskb; 132 133 niph = ip_hdr(nskb); 134 135 /* "Never happens" */ 136 if (nskb->len > dst_mtu(skb_dst(nskb))) 137 goto free_nskb; 138 139 nf_ct_attach(nskb, oldskb); 140 141 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 142 /* If we use ip_local_out for bridged traffic, the MAC source on 143 * the RST will be ours, instead of the destination's. This confuses 144 * some routers/firewalls, and they drop the packet. So we need to 145 * build the eth header using the original destination's MAC as the 146 * source, and send the RST packet directly. 147 */ 148 br_indev = nf_bridge_get_physindev(oldskb); 149 if (br_indev) { 150 struct ethhdr *oeth = eth_hdr(oldskb); 151 152 nskb->dev = br_indev; 153 niph->tot_len = htons(nskb->len); 154 ip_send_check(niph); 155 if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol), 156 oeth->h_source, oeth->h_dest, nskb->len) < 0) 157 goto free_nskb; 158 dev_queue_xmit(nskb); 159 } else 160 #endif 161 ip_local_out(net, nskb->sk, nskb); 162 163 return; 164 165 free_nskb: 166 kfree_skb(nskb); 167 } 168 EXPORT_SYMBOL_GPL(nf_send_reset); 169 170 void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) 171 { 172 struct iphdr *iph = ip_hdr(skb_in); 173 u8 proto = iph->protocol; 174 175 if (iph->frag_off & htons(IP_OFFSET)) 176 return; 177 178 if (skb_csum_unnecessary(skb_in) || !nf_reject_verify_csum(proto)) { 179 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); 180 return; 181 } 182 183 if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0) 184 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); 185 } 186 EXPORT_SYMBOL_GPL(nf_send_unreach); 187 188 MODULE_LICENSE("GPL"); 189