1 // SPDX-License-Identifier: GPL-2.0-only
2 /* (C) 1999-2001 Paul `Rusty' Russell
3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4 */
5
6 #include <linux/module.h>
7 #include <net/ip.h>
8 #include <net/tcp.h>
9 #include <net/route.h>
10 #include <net/dst.h>
11 #include <net/dst_metadata.h>
12 #include <net/netfilter/ipv4/nf_reject.h>
13 #include <linux/netfilter_ipv4.h>
14 #include <linux/netfilter_bridge.h>
15
16 static struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,
17 const struct sk_buff *oldskb,
18 __u8 protocol, int ttl);
19 static void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb,
20 const struct tcphdr *oth);
21 static const struct tcphdr *
22 nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,
23 struct tcphdr *_oth, int hook);
24
nf_reject_iphdr_validate(struct sk_buff * skb)25 static int nf_reject_iphdr_validate(struct sk_buff *skb)
26 {
27 struct iphdr *iph;
28 u32 len;
29
30 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
31 return 0;
32
33 iph = ip_hdr(skb);
34 if (iph->ihl < 5 || iph->version != 4)
35 return 0;
36
37 len = ntohs(iph->tot_len);
38 if (skb->len < len)
39 return 0;
40 else if (len < (iph->ihl*4))
41 return 0;
42
43 if (!pskb_may_pull(skb, iph->ihl*4))
44 return 0;
45
46 return 1;
47 }
48
nf_reject_skb_v4_tcp_reset(struct net * net,struct sk_buff * oldskb,const struct net_device * dev,int hook)49 struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
50 struct sk_buff *oldskb,
51 const struct net_device *dev,
52 int hook)
53 {
54 const struct tcphdr *oth;
55 struct sk_buff *nskb;
56 struct iphdr *niph;
57 struct tcphdr _oth;
58
59 if (!nf_reject_iphdr_validate(oldskb))
60 return NULL;
61
62 oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
63 if (!oth)
64 return NULL;
65
66 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
67 LL_MAX_HEADER, GFP_ATOMIC);
68 if (!nskb)
69 return NULL;
70
71 nskb->dev = (struct net_device *)dev;
72
73 skb_reserve(nskb, LL_MAX_HEADER);
74 niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
75 READ_ONCE(net->ipv4.sysctl_ip_default_ttl));
76 nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
77 niph->tot_len = htons(nskb->len);
78 ip_send_check(niph);
79
80 return nskb;
81 }
82 EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
83
nf_skb_is_icmp_unreach(const struct sk_buff * skb)84 static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
85 {
86 const struct iphdr *iph = ip_hdr(skb);
87 u8 *tp, _type;
88 int thoff;
89
90 if (iph->protocol != IPPROTO_ICMP)
91 return false;
92
93 thoff = skb_network_offset(skb) + ip_hdrlen(skb);
94
95 tp = skb_header_pointer(skb,
96 thoff + offsetof(struct icmphdr, type),
97 sizeof(_type), &_type);
98
99 if (!tp)
100 return false;
101
102 return *tp == ICMP_DEST_UNREACH;
103 }
104
nf_reject_skb_v4_unreach(struct net * net,struct sk_buff * oldskb,const struct net_device * dev,int hook,u8 code)105 struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
106 struct sk_buff *oldskb,
107 const struct net_device *dev,
108 int hook, u8 code)
109 {
110 struct sk_buff *nskb;
111 struct iphdr *niph;
112 struct icmphdr *icmph;
113 unsigned int len;
114 int dataoff;
115 __wsum csum;
116 u8 proto;
117
118 if (!nf_reject_iphdr_validate(oldskb))
119 return NULL;
120
121 /* IP header checks: fragment. */
122 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
123 return NULL;
124
125 /* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
126 if (nf_skb_is_icmp_unreach(oldskb))
127 return NULL;
128
129 /* RFC says return as much as we can without exceeding 576 bytes. */
130 len = min_t(unsigned int, 536, oldskb->len);
131
132 if (!pskb_may_pull(oldskb, len))
133 return NULL;
134
135 if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))
136 return NULL;
137
138 dataoff = ip_hdrlen(oldskb);
139 proto = ip_hdr(oldskb)->protocol;
140
141 if (!skb_csum_unnecessary(oldskb) &&
142 nf_reject_verify_csum(oldskb, dataoff, proto) &&
143 nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))
144 return NULL;
145
146 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
147 LL_MAX_HEADER + len, GFP_ATOMIC);
148 if (!nskb)
149 return NULL;
150
151 nskb->dev = (struct net_device *)dev;
152
153 skb_reserve(nskb, LL_MAX_HEADER);
154 niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
155 READ_ONCE(net->ipv4.sysctl_ip_default_ttl));
156
157 skb_reset_transport_header(nskb);
158 icmph = skb_put_zero(nskb, sizeof(struct icmphdr));
159 icmph->type = ICMP_DEST_UNREACH;
160 icmph->code = code;
161
162 skb_put_data(nskb, skb_network_header(oldskb), len);
163
164 csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
165 icmph->checksum = csum_fold(csum);
166
167 niph->tot_len = htons(nskb->len);
168 ip_send_check(niph);
169
170 return nskb;
171 }
172 EXPORT_SYMBOL_GPL(nf_reject_skb_v4_unreach);
173
174 static const struct tcphdr *
nf_reject_ip_tcphdr_get(struct sk_buff * oldskb,struct tcphdr * _oth,int hook)175 nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,
176 struct tcphdr *_oth, int hook)
177 {
178 const struct tcphdr *oth;
179
180 /* IP header checks: fragment. */
181 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
182 return NULL;
183
184 if (ip_hdr(oldskb)->protocol != IPPROTO_TCP)
185 return NULL;
186
187 oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
188 sizeof(struct tcphdr), _oth);
189 if (oth == NULL)
190 return NULL;
191
192 /* No RST for RST. */
193 if (oth->rst)
194 return NULL;
195
196 /* Check checksum */
197 if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
198 return NULL;
199
200 return oth;
201 }
202
nf_reject_iphdr_put(struct sk_buff * nskb,const struct sk_buff * oldskb,__u8 protocol,int ttl)203 static struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb,
204 const struct sk_buff *oldskb,
205 __u8 protocol, int ttl)
206 {
207 struct iphdr *niph, *oiph = ip_hdr(oldskb);
208
209 skb_reset_network_header(nskb);
210 niph = skb_put(nskb, sizeof(struct iphdr));
211 niph->version = 4;
212 niph->ihl = sizeof(struct iphdr) / 4;
213 niph->tos = 0;
214 niph->id = 0;
215 niph->frag_off = htons(IP_DF);
216 niph->protocol = protocol;
217 niph->check = 0;
218 niph->saddr = oiph->daddr;
219 niph->daddr = oiph->saddr;
220 niph->ttl = ttl;
221
222 nskb->protocol = htons(ETH_P_IP);
223
224 return niph;
225 }
226
nf_reject_ip_tcphdr_put(struct sk_buff * nskb,const struct sk_buff * oldskb,const struct tcphdr * oth)227 static void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb,
228 const struct tcphdr *oth)
229 {
230 struct iphdr *niph = ip_hdr(nskb);
231 struct tcphdr *tcph;
232
233 skb_reset_transport_header(nskb);
234 tcph = skb_put_zero(nskb, sizeof(struct tcphdr));
235 tcph->source = oth->dest;
236 tcph->dest = oth->source;
237 tcph->doff = sizeof(struct tcphdr) / 4;
238
239 if (oth->ack) {
240 tcph->seq = oth->ack_seq;
241 } else {
242 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
243 oldskb->len - ip_hdrlen(oldskb) -
244 (oth->doff << 2));
245 tcph->ack = 1;
246 }
247
248 tcph->rst = 1;
249 tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
250 niph->daddr, 0);
251 nskb->ip_summed = CHECKSUM_PARTIAL;
252 nskb->csum_start = (unsigned char *)tcph - nskb->head;
253 nskb->csum_offset = offsetof(struct tcphdr, check);
254 }
255
nf_reject_fill_skb_dst(struct sk_buff * skb_in)256 static int nf_reject_fill_skb_dst(struct sk_buff *skb_in)
257 {
258 struct dst_entry *dst = NULL;
259 struct flowi fl;
260
261 memset(&fl, 0, sizeof(struct flowi));
262 fl.u.ip4.daddr = ip_hdr(skb_in)->saddr;
263 nf_ip_route(dev_net(skb_in->dev), &dst, &fl, false);
264 if (!dst)
265 return -1;
266
267 skb_dst_drop(skb_in);
268 skb_dst_set(skb_in, dst);
269 return 0;
270 }
271
272 /* Send RST reply */
nf_send_reset(struct net * net,struct sock * sk,struct sk_buff * oldskb,int hook)273 void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
274 int hook)
275 {
276 const struct tcphdr *oth;
277 struct sk_buff *nskb;
278 struct tcphdr _oth;
279
280 oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
281 if (!oth)
282 return;
283
284 if (!skb_valid_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0)
285 return;
286
287 if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
288 return;
289
290 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
291 LL_MAX_HEADER, GFP_ATOMIC);
292 if (!nskb)
293 return;
294
295 /* ip_route_me_harder expects skb->dst to be set */
296 skb_dst_set_noref(nskb, skb_dst(oldskb));
297
298 nskb->mark = IP4_REPLY_MARK(net, oldskb->mark);
299
300 skb_reserve(nskb, LL_MAX_HEADER);
301 nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
302 ip4_dst_hoplimit(skb_dst(nskb)));
303 nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
304 if (ip_route_me_harder(net, sk, nskb, RTN_UNSPEC))
305 goto free_nskb;
306
307 /* "Never happens" */
308 if (nskb->len > dst4_mtu(skb_dst(nskb)))
309 goto free_nskb;
310
311 nf_ct_attach(nskb, oldskb);
312 nf_ct_set_closing(skb_nfct(oldskb));
313
314 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
315 /* If we use ip_local_out for bridged traffic, the MAC source on
316 * the RST will be ours, instead of the destination's. This confuses
317 * some routers/firewalls, and they drop the packet. So we need to
318 * build the eth header using the original destination's MAC as the
319 * source, and send the RST packet directly.
320 */
321 if (nf_bridge_info_exists(oldskb)) {
322 struct ethhdr *oeth = eth_hdr(oldskb);
323 struct iphdr *niph = ip_hdr(nskb);
324 struct net_device *br_indev;
325
326 br_indev = nf_bridge_get_physindev(oldskb, net);
327 if (!br_indev)
328 goto free_nskb;
329
330 nskb->dev = br_indev;
331 niph->tot_len = htons(nskb->len);
332 ip_send_check(niph);
333 if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
334 oeth->h_source, oeth->h_dest, nskb->len) < 0)
335 goto free_nskb;
336 dev_queue_xmit(nskb);
337 } else
338 #endif
339 ip_local_out(net, nskb->sk, nskb);
340
341 return;
342
343 free_nskb:
344 kfree_skb(nskb);
345 }
346 EXPORT_SYMBOL_GPL(nf_send_reset);
347
nf_send_unreach(struct sk_buff * skb_in,int code,int hook)348 void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
349 {
350 struct iphdr *iph = ip_hdr(skb_in);
351 int dataoff = ip_hdrlen(skb_in);
352 u8 proto = iph->protocol;
353
354 if (iph->frag_off & htons(IP_OFFSET))
355 return;
356
357 if (!skb_valid_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
358 return;
359
360 if (skb_csum_unnecessary(skb_in) ||
361 !nf_reject_verify_csum(skb_in, dataoff, proto)) {
362 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
363 return;
364 }
365
366 if (nf_ip_checksum(skb_in, hook, dataoff, proto) == 0)
367 icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
368 }
369 EXPORT_SYMBOL_GPL(nf_send_unreach);
370
371 MODULE_LICENSE("GPL");
372 MODULE_DESCRIPTION("IPv4 packet rejection core");
373