1 /*
2  * This is a module which is used for rejecting packets.
3  */
4 
5 /* (C) 1999-2001 Paul `Rusty' Russell
6  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11  */
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/slab.h>
16 #include <linux/ip.h>
17 #include <linux/udp.h>
18 #include <linux/icmp.h>
19 #include <net/icmp.h>
20 #include <net/ip.h>
21 #include <net/tcp.h>
22 #include <net/route.h>
23 #include <net/dst.h>
24 #include <linux/netfilter/x_tables.h>
25 #include <linux/netfilter_ipv4/ip_tables.h>
26 #include <linux/netfilter_ipv4/ipt_REJECT.h>
27 #ifdef CONFIG_BRIDGE_NETFILTER
28 #include <linux/netfilter_bridge.h>
29 #endif
30 
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
33 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");
34 
35 /* Send RST reply */
send_reset(struct sk_buff * oldskb,int hook)36 static void send_reset(struct sk_buff *oldskb, int hook)
37 {
38 	struct sk_buff *nskb;
39 	const struct iphdr *oiph;
40 	struct iphdr *niph;
41 	const struct tcphdr *oth;
42 	struct tcphdr _otcph, *tcph;
43 	unsigned int addr_type;
44 
45 	/* IP header checks: fragment. */
46 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
47 		return;
48 
49 	oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
50 				 sizeof(_otcph), &_otcph);
51 	if (oth == NULL)
52 		return;
53 
54 	/* No RST for RST. */
55 	if (oth->rst)
56 		return;
57 
58 	/* Check checksum */
59 	if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
60 		return;
61 	oiph = ip_hdr(oldskb);
62 
63 	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
64 			 LL_MAX_HEADER, GFP_ATOMIC);
65 	if (!nskb)
66 		return;
67 
68 	skb_reserve(nskb, LL_MAX_HEADER);
69 
70 	skb_reset_network_header(nskb);
71 	niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
72 	niph->version	= 4;
73 	niph->ihl	= sizeof(struct iphdr) / 4;
74 	niph->tos	= 0;
75 	niph->id	= 0;
76 	niph->frag_off	= htons(IP_DF);
77 	niph->protocol	= IPPROTO_TCP;
78 	niph->check	= 0;
79 	niph->saddr	= oiph->daddr;
80 	niph->daddr	= oiph->saddr;
81 
82 	tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
83 	memset(tcph, 0, sizeof(*tcph));
84 	tcph->source	= oth->dest;
85 	tcph->dest	= oth->source;
86 	tcph->doff	= sizeof(struct tcphdr) / 4;
87 
88 	if (oth->ack)
89 		tcph->seq = oth->ack_seq;
90 	else {
91 		tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
92 				      oldskb->len - ip_hdrlen(oldskb) -
93 				      (oth->doff << 2));
94 		tcph->ack = 1;
95 	}
96 
97 	tcph->rst	= 1;
98 	tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
99 				    niph->daddr, 0);
100 	nskb->ip_summed = CHECKSUM_PARTIAL;
101 	nskb->csum_start = (unsigned char *)tcph - nskb->head;
102 	nskb->csum_offset = offsetof(struct tcphdr, check);
103 
104 	addr_type = RTN_UNSPEC;
105 	if (hook != NF_INET_FORWARD
106 #ifdef CONFIG_BRIDGE_NETFILTER
107 	    || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
108 #endif
109 	   )
110 		addr_type = RTN_LOCAL;
111 
112 	/* ip_route_me_harder expects skb->dst to be set */
113 	skb_dst_set_noref(nskb, skb_dst(oldskb));
114 
115 	nskb->protocol = htons(ETH_P_IP);
116 	if (ip_route_me_harder(nskb, addr_type))
117 		goto free_nskb;
118 
119 	niph->ttl	= ip4_dst_hoplimit(skb_dst(nskb));
120 
121 	/* "Never happens" */
122 	if (nskb->len > dst_mtu(skb_dst(nskb)))
123 		goto free_nskb;
124 
125 	nf_ct_attach(nskb, oldskb);
126 
127 	ip_local_out(nskb);
128 	return;
129 
130  free_nskb:
131 	kfree_skb(nskb);
132 }
133 
send_unreach(struct sk_buff * skb_in,int code)134 static inline void send_unreach(struct sk_buff *skb_in, int code)
135 {
136 	icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
137 }
138 
139 static unsigned int
reject_tg(struct sk_buff * skb,const struct xt_action_param * par)140 reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
141 {
142 	const struct ipt_reject_info *reject = par->targinfo;
143 
144 	switch (reject->with) {
145 	case IPT_ICMP_NET_UNREACHABLE:
146 		send_unreach(skb, ICMP_NET_UNREACH);
147 		break;
148 	case IPT_ICMP_HOST_UNREACHABLE:
149 		send_unreach(skb, ICMP_HOST_UNREACH);
150 		break;
151 	case IPT_ICMP_PROT_UNREACHABLE:
152 		send_unreach(skb, ICMP_PROT_UNREACH);
153 		break;
154 	case IPT_ICMP_PORT_UNREACHABLE:
155 		send_unreach(skb, ICMP_PORT_UNREACH);
156 		break;
157 	case IPT_ICMP_NET_PROHIBITED:
158 		send_unreach(skb, ICMP_NET_ANO);
159 		break;
160 	case IPT_ICMP_HOST_PROHIBITED:
161 		send_unreach(skb, ICMP_HOST_ANO);
162 		break;
163 	case IPT_ICMP_ADMIN_PROHIBITED:
164 		send_unreach(skb, ICMP_PKT_FILTERED);
165 		break;
166 	case IPT_TCP_RESET:
167 		send_reset(skb, par->hooknum);
168 	case IPT_ICMP_ECHOREPLY:
169 		/* Doesn't happen. */
170 		break;
171 	}
172 
173 	return NF_DROP;
174 }
175 
reject_tg_check(const struct xt_tgchk_param * par)176 static int reject_tg_check(const struct xt_tgchk_param *par)
177 {
178 	const struct ipt_reject_info *rejinfo = par->targinfo;
179 	const struct ipt_entry *e = par->entryinfo;
180 
181 	if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
182 		pr_info("ECHOREPLY no longer supported.\n");
183 		return -EINVAL;
184 	} else if (rejinfo->with == IPT_TCP_RESET) {
185 		/* Must specify that it's a TCP packet */
186 		if (e->ip.proto != IPPROTO_TCP ||
187 		    (e->ip.invflags & XT_INV_PROTO)) {
188 			pr_info("TCP_RESET invalid for non-tcp\n");
189 			return -EINVAL;
190 		}
191 	}
192 	return 0;
193 }
194 
195 static struct xt_target reject_tg_reg __read_mostly = {
196 	.name		= "REJECT",
197 	.family		= NFPROTO_IPV4,
198 	.target		= reject_tg,
199 	.targetsize	= sizeof(struct ipt_reject_info),
200 	.table		= "filter",
201 	.hooks		= (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
202 			  (1 << NF_INET_LOCAL_OUT),
203 	.checkentry	= reject_tg_check,
204 	.me		= THIS_MODULE,
205 };
206 
reject_tg_init(void)207 static int __init reject_tg_init(void)
208 {
209 	return xt_register_target(&reject_tg_reg);
210 }
211 
reject_tg_exit(void)212 static void __exit reject_tg_exit(void)
213 {
214 	xt_unregister_target(&reject_tg_reg);
215 }
216 
217 module_init(reject_tg_init);
218 module_exit(reject_tg_exit);
219