1 /* (C) 1999-2001 Paul `Rusty' Russell 2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9 #include <linux/module.h> 10 #include <net/ip.h> 11 #include <net/tcp.h> 12 #include <net/route.h> 13 #include <net/dst.h> 14 #include <net/netfilter/ipv4/nf_reject.h> 15 #include <linux/netfilter_ipv4.h> 16 #include <linux/netfilter_bridge.h> 17 18 const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, 19 struct tcphdr *_oth, int hook) 20 { 21 const struct tcphdr *oth; 22 23 /* IP header checks: fragment. */ 24 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) 25 return NULL; 26 27 if (ip_hdr(oldskb)->protocol != IPPROTO_TCP) 28 return NULL; 29 30 oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), 31 sizeof(struct tcphdr), _oth); 32 if (oth == NULL) 33 return NULL; 34 35 /* No RST for RST. */ 36 if (oth->rst) 37 return NULL; 38 39 /* Check checksum */ 40 if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) 41 return NULL; 42 43 return oth; 44 } 45 EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_get); 46 47 struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, 48 const struct sk_buff *oldskb, 49 __u8 protocol, int ttl) 50 { 51 struct iphdr *niph, *oiph = ip_hdr(oldskb); 52 53 skb_reset_network_header(nskb); 54 niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr)); 55 niph->version = 4; 56 niph->ihl = sizeof(struct iphdr) / 4; 57 niph->tos = 0; 58 niph->id = 0; 59 niph->frag_off = htons(IP_DF); 60 niph->protocol = protocol; 61 niph->check = 0; 62 niph->saddr = oiph->daddr; 63 niph->daddr = oiph->saddr; 64 niph->ttl = ttl; 65 66 nskb->protocol = htons(ETH_P_IP); 67 68 return niph; 69 } 70 EXPORT_SYMBOL_GPL(nf_reject_iphdr_put); 71 72 void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb, 73 const struct tcphdr *oth) 74 { 75 struct iphdr *niph = ip_hdr(nskb); 76 struct tcphdr *tcph; 77 78 skb_reset_transport_header(nskb); 79 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); 80 memset(tcph, 0, sizeof(*tcph)); 81 tcph->source = oth->dest; 82 tcph->dest = oth->source; 83 tcph->doff = sizeof(struct tcphdr) / 4; 84 85 if (oth->ack) { 86 tcph->seq = oth->ack_seq; 87 } else { 88 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + 89 oldskb->len - ip_hdrlen(oldskb) - 90 (oth->doff << 2)); 91 tcph->ack = 1; 92 } 93 94 tcph->rst = 1; 95 tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr, 96 niph->daddr, 0); 97 nskb->ip_summed = CHECKSUM_PARTIAL; 98 nskb->csum_start = (unsigned char *)tcph - nskb->head; 99 nskb->csum_offset = offsetof(struct tcphdr, check); 100 } 101 EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put); 102 103 /* Send RST reply */ 104 void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) 105 { 106 struct sk_buff *nskb; 107 const struct iphdr *oiph; 108 struct iphdr *niph; 109 const struct tcphdr *oth; 110 struct tcphdr _oth; 111 112 oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook); 113 if (!oth) 114 return; 115 116 if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) 117 return; 118 119 oiph = ip_hdr(oldskb); 120 121 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + 122 LL_MAX_HEADER, GFP_ATOMIC); 123 if (!nskb) 124 return; 125 126 /* ip_route_me_harder expects skb->dst to be set */ 127 skb_dst_set_noref(nskb, skb_dst(oldskb)); 128 129 skb_reserve(nskb, LL_MAX_HEADER); 130 niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, 131 ip4_dst_hoplimit(skb_dst(nskb))); 132 nf_reject_ip_tcphdr_put(nskb, oldskb, oth); 133 134 if (ip_route_me_harder(net, nskb, RTN_UNSPEC)) 135 goto free_nskb; 136 137 /* "Never happens" */ 138 if (nskb->len > dst_mtu(skb_dst(nskb))) 139 goto free_nskb; 140 141 nf_ct_attach(nskb, oldskb); 142 143 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 144 /* If we use ip_local_out for bridged traffic, the MAC source on 145 * the RST will be ours, instead of the destination's. This confuses 146 * some routers/firewalls, and they drop the packet. So we need to 147 * build the eth header using the original destination's MAC as the 148 * source, and send the RST packet directly. 149 */ 150 if (oldskb->nf_bridge) { 151 struct ethhdr *oeth = eth_hdr(oldskb); 152 153 nskb->dev = nf_bridge_get_physindev(oldskb); 154 niph->tot_len = htons(nskb->len); 155 ip_send_check(niph); 156 if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol), 157 oeth->h_source, oeth->h_dest, nskb->len) < 0) 158 goto free_nskb; 159 dev_queue_xmit(nskb); 160 } else 161 #endif 162 ip_local_out(net, nskb->sk, nskb); 163 164 return; 165 166 free_nskb: 167 kfree_skb(nskb); 168 } 169 EXPORT_SYMBOL_GPL(nf_send_reset); 170 171 void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) 172 { 173 struct iphdr *iph = ip_hdr(skb_in); 174 u8 proto; 175 176 if (skb_in->csum_bad || iph->frag_off & htons(IP_OFFSET)) 177 return; 178 179 if (skb_csum_unnecessary(skb_in)) { 180 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); 181 return; 182 } 183 184 if (iph->protocol == IPPROTO_TCP || iph->protocol == IPPROTO_UDP) 185 proto = iph->protocol; 186 else 187 proto = 0; 188 189 if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0) 190 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); 191 } 192 EXPORT_SYMBOL_GPL(nf_send_unreach); 193 194 MODULE_LICENSE("GPL"); 195