1 /*
2 * This is a module which is used for rejecting packets.
3 */
4
5 /* (C) 1999-2001 Paul `Rusty' Russell
6 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 */
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/slab.h>
16 #include <linux/ip.h>
17 #include <linux/udp.h>
18 #include <linux/icmp.h>
19 #include <net/icmp.h>
20 #include <net/ip.h>
21 #include <net/tcp.h>
22 #include <net/route.h>
23 #include <net/dst.h>
24 #include <linux/netfilter/x_tables.h>
25 #include <linux/netfilter_ipv4/ip_tables.h>
26 #include <linux/netfilter_ipv4/ipt_REJECT.h>
27 #ifdef CONFIG_BRIDGE_NETFILTER
28 #include <linux/netfilter_bridge.h>
29 #endif
30
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
33 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");
34
35 /* Send RST reply */
send_reset(struct sk_buff * oldskb,int hook)36 static void send_reset(struct sk_buff *oldskb, int hook)
37 {
38 struct sk_buff *nskb;
39 const struct iphdr *oiph;
40 struct iphdr *niph;
41 const struct tcphdr *oth;
42 struct tcphdr _otcph, *tcph;
43 unsigned int addr_type;
44
45 /* IP header checks: fragment. */
46 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
47 return;
48
49 oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
50 sizeof(_otcph), &_otcph);
51 if (oth == NULL)
52 return;
53
54 /* No RST for RST. */
55 if (oth->rst)
56 return;
57
58 /* Check checksum */
59 if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
60 return;
61 oiph = ip_hdr(oldskb);
62
63 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
64 LL_MAX_HEADER, GFP_ATOMIC);
65 if (!nskb)
66 return;
67
68 skb_reserve(nskb, LL_MAX_HEADER);
69
70 skb_reset_network_header(nskb);
71 niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
72 niph->version = 4;
73 niph->ihl = sizeof(struct iphdr) / 4;
74 niph->tos = 0;
75 niph->id = 0;
76 niph->frag_off = htons(IP_DF);
77 niph->protocol = IPPROTO_TCP;
78 niph->check = 0;
79 niph->saddr = oiph->daddr;
80 niph->daddr = oiph->saddr;
81
82 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
83 memset(tcph, 0, sizeof(*tcph));
84 tcph->source = oth->dest;
85 tcph->dest = oth->source;
86 tcph->doff = sizeof(struct tcphdr) / 4;
87
88 if (oth->ack)
89 tcph->seq = oth->ack_seq;
90 else {
91 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
92 oldskb->len - ip_hdrlen(oldskb) -
93 (oth->doff << 2));
94 tcph->ack = 1;
95 }
96
97 tcph->rst = 1;
98 tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
99 niph->daddr, 0);
100 nskb->ip_summed = CHECKSUM_PARTIAL;
101 nskb->csum_start = (unsigned char *)tcph - nskb->head;
102 nskb->csum_offset = offsetof(struct tcphdr, check);
103
104 addr_type = RTN_UNSPEC;
105 if (hook != NF_INET_FORWARD
106 #ifdef CONFIG_BRIDGE_NETFILTER
107 || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
108 #endif
109 )
110 addr_type = RTN_LOCAL;
111
112 /* ip_route_me_harder expects skb->dst to be set */
113 skb_dst_set_noref(nskb, skb_dst(oldskb));
114
115 nskb->protocol = htons(ETH_P_IP);
116 if (ip_route_me_harder(nskb, addr_type))
117 goto free_nskb;
118
119 niph->ttl = ip4_dst_hoplimit(skb_dst(nskb));
120
121 /* "Never happens" */
122 if (nskb->len > dst_mtu(skb_dst(nskb)))
123 goto free_nskb;
124
125 nf_ct_attach(nskb, oldskb);
126
127 ip_local_out(nskb);
128 return;
129
130 free_nskb:
131 kfree_skb(nskb);
132 }
133
send_unreach(struct sk_buff * skb_in,int code)134 static inline void send_unreach(struct sk_buff *skb_in, int code)
135 {
136 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
137 }
138
139 static unsigned int
reject_tg(struct sk_buff * skb,const struct xt_action_param * par)140 reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
141 {
142 const struct ipt_reject_info *reject = par->targinfo;
143
144 switch (reject->with) {
145 case IPT_ICMP_NET_UNREACHABLE:
146 send_unreach(skb, ICMP_NET_UNREACH);
147 break;
148 case IPT_ICMP_HOST_UNREACHABLE:
149 send_unreach(skb, ICMP_HOST_UNREACH);
150 break;
151 case IPT_ICMP_PROT_UNREACHABLE:
152 send_unreach(skb, ICMP_PROT_UNREACH);
153 break;
154 case IPT_ICMP_PORT_UNREACHABLE:
155 send_unreach(skb, ICMP_PORT_UNREACH);
156 break;
157 case IPT_ICMP_NET_PROHIBITED:
158 send_unreach(skb, ICMP_NET_ANO);
159 break;
160 case IPT_ICMP_HOST_PROHIBITED:
161 send_unreach(skb, ICMP_HOST_ANO);
162 break;
163 case IPT_ICMP_ADMIN_PROHIBITED:
164 send_unreach(skb, ICMP_PKT_FILTERED);
165 break;
166 case IPT_TCP_RESET:
167 send_reset(skb, par->hooknum);
168 case IPT_ICMP_ECHOREPLY:
169 /* Doesn't happen. */
170 break;
171 }
172
173 return NF_DROP;
174 }
175
reject_tg_check(const struct xt_tgchk_param * par)176 static int reject_tg_check(const struct xt_tgchk_param *par)
177 {
178 const struct ipt_reject_info *rejinfo = par->targinfo;
179 const struct ipt_entry *e = par->entryinfo;
180
181 if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
182 pr_info("ECHOREPLY no longer supported.\n");
183 return -EINVAL;
184 } else if (rejinfo->with == IPT_TCP_RESET) {
185 /* Must specify that it's a TCP packet */
186 if (e->ip.proto != IPPROTO_TCP ||
187 (e->ip.invflags & XT_INV_PROTO)) {
188 pr_info("TCP_RESET invalid for non-tcp\n");
189 return -EINVAL;
190 }
191 }
192 return 0;
193 }
194
195 static struct xt_target reject_tg_reg __read_mostly = {
196 .name = "REJECT",
197 .family = NFPROTO_IPV4,
198 .target = reject_tg,
199 .targetsize = sizeof(struct ipt_reject_info),
200 .table = "filter",
201 .hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
202 (1 << NF_INET_LOCAL_OUT),
203 .checkentry = reject_tg_check,
204 .me = THIS_MODULE,
205 };
206
reject_tg_init(void)207 static int __init reject_tg_init(void)
208 {
209 return xt_register_target(&reject_tg_reg);
210 }
211
reject_tg_exit(void)212 static void __exit reject_tg_exit(void)
213 {
214 xt_unregister_target(&reject_tg_reg);
215 }
216
217 module_init(reject_tg_init);
218 module_exit(reject_tg_exit);
219