~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/netfilter/ipt_REJECT.c

Version: ~ [ linux-5.3-rc5 ] ~ [ linux-5.2.9 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.67 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.139 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.189 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.189 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.72 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * This is a module which is used for rejecting packets.
  3  */
  4 
  5 /* (C) 1999-2001 Paul `Rusty' Russell
  6  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  7  *
  8  * This program is free software; you can redistribute it and/or modify
  9  * it under the terms of the GNU General Public License version 2 as
 10  * published by the Free Software Foundation.
 11  */
 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 13 #include <linux/module.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/slab.h>
 16 #include <linux/ip.h>
 17 #include <linux/udp.h>
 18 #include <linux/icmp.h>
 19 #include <net/icmp.h>
 20 #include <net/ip.h>
 21 #include <net/tcp.h>
 22 #include <net/route.h>
 23 #include <net/dst.h>
 24 #include <linux/netfilter/x_tables.h>
 25 #include <linux/netfilter_ipv4/ip_tables.h>
 26 #include <linux/netfilter_ipv4/ipt_REJECT.h>
 27 #ifdef CONFIG_BRIDGE_NETFILTER
 28 #include <linux/netfilter_bridge.h>
 29 #endif
 30 
 31 MODULE_LICENSE("GPL");
 32 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 33 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");
 34 
 35 /* Send RST reply */
 36 static void send_reset(struct sk_buff *oldskb, int hook)
 37 {
 38         struct sk_buff *nskb;
 39         const struct iphdr *oiph;
 40         struct iphdr *niph;
 41         const struct tcphdr *oth;
 42         struct tcphdr _otcph, *tcph;
 43 
 44         /* IP header checks: fragment. */
 45         if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
 46                 return;
 47 
 48         oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
 49                                  sizeof(_otcph), &_otcph);
 50         if (oth == NULL)
 51                 return;
 52 
 53         /* No RST for RST. */
 54         if (oth->rst)
 55                 return;
 56 
 57         if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
 58                 return;
 59 
 60         /* Check checksum */
 61         if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
 62                 return;
 63         oiph = ip_hdr(oldskb);
 64 
 65         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
 66                          LL_MAX_HEADER, GFP_ATOMIC);
 67         if (!nskb)
 68                 return;
 69 
 70         skb_reserve(nskb, LL_MAX_HEADER);
 71 
 72         skb_reset_network_header(nskb);
 73         niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
 74         niph->version   = 4;
 75         niph->ihl       = sizeof(struct iphdr) / 4;
 76         niph->tos       = 0;
 77         niph->id        = 0;
 78         niph->frag_off  = htons(IP_DF);
 79         niph->protocol  = IPPROTO_TCP;
 80         niph->check     = 0;
 81         niph->saddr     = oiph->daddr;
 82         niph->daddr     = oiph->saddr;
 83 
 84         skb_reset_transport_header(nskb);
 85         tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
 86         memset(tcph, 0, sizeof(*tcph));
 87         tcph->source    = oth->dest;
 88         tcph->dest      = oth->source;
 89         tcph->doff      = sizeof(struct tcphdr) / 4;
 90 
 91         if (oth->ack)
 92                 tcph->seq = oth->ack_seq;
 93         else {
 94                 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
 95                                       oldskb->len - ip_hdrlen(oldskb) -
 96                                       (oth->doff << 2));
 97                 tcph->ack = 1;
 98         }
 99 
100         tcph->rst       = 1;
101         tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
102                                     niph->daddr, 0);
103         nskb->ip_summed = CHECKSUM_PARTIAL;
104         nskb->csum_start = (unsigned char *)tcph - nskb->head;
105         nskb->csum_offset = offsetof(struct tcphdr, check);
106 
107         /* ip_route_me_harder expects skb->dst to be set */
108         skb_dst_set_noref(nskb, skb_dst(oldskb));
109 
110         nskb->protocol = htons(ETH_P_IP);
111         if (ip_route_me_harder(nskb, RTN_UNSPEC))
112                 goto free_nskb;
113 
114         niph->ttl       = ip4_dst_hoplimit(skb_dst(nskb));
115 
116         /* "Never happens" */
117         if (nskb->len > dst_mtu(skb_dst(nskb)))
118                 goto free_nskb;
119 
120         nf_ct_attach(nskb, oldskb);
121 
122         ip_local_out(nskb);
123         return;
124 
125  free_nskb:
126         kfree_skb(nskb);
127 }
128 
129 static inline void send_unreach(struct sk_buff *skb_in, int code)
130 {
131         icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
132 }
133 
134 static unsigned int
135 reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
136 {
137         const struct ipt_reject_info *reject = par->targinfo;
138 
139         switch (reject->with) {
140         case IPT_ICMP_NET_UNREACHABLE:
141                 send_unreach(skb, ICMP_NET_UNREACH);
142                 break;
143         case IPT_ICMP_HOST_UNREACHABLE:
144                 send_unreach(skb, ICMP_HOST_UNREACH);
145                 break;
146         case IPT_ICMP_PROT_UNREACHABLE:
147                 send_unreach(skb, ICMP_PROT_UNREACH);
148                 break;
149         case IPT_ICMP_PORT_UNREACHABLE:
150                 send_unreach(skb, ICMP_PORT_UNREACH);
151                 break;
152         case IPT_ICMP_NET_PROHIBITED:
153                 send_unreach(skb, ICMP_NET_ANO);
154                 break;
155         case IPT_ICMP_HOST_PROHIBITED:
156                 send_unreach(skb, ICMP_HOST_ANO);
157                 break;
158         case IPT_ICMP_ADMIN_PROHIBITED:
159                 send_unreach(skb, ICMP_PKT_FILTERED);
160                 break;
161         case IPT_TCP_RESET:
162                 send_reset(skb, par->hooknum);
163         case IPT_ICMP_ECHOREPLY:
164                 /* Doesn't happen. */
165                 break;
166         }
167 
168         return NF_DROP;
169 }
170 
171 static int reject_tg_check(const struct xt_tgchk_param *par)
172 {
173         const struct ipt_reject_info *rejinfo = par->targinfo;
174         const struct ipt_entry *e = par->entryinfo;
175 
176         if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
177                 pr_info("ECHOREPLY no longer supported.\n");
178                 return -EINVAL;
179         } else if (rejinfo->with == IPT_TCP_RESET) {
180                 /* Must specify that it's a TCP packet */
181                 if (e->ip.proto != IPPROTO_TCP ||
182                     (e->ip.invflags & XT_INV_PROTO)) {
183                         pr_info("TCP_RESET invalid for non-tcp\n");
184                         return -EINVAL;
185                 }
186         }
187         return 0;
188 }
189 
190 static struct xt_target reject_tg_reg __read_mostly = {
191         .name           = "REJECT",
192         .family         = NFPROTO_IPV4,
193         .target         = reject_tg,
194         .targetsize     = sizeof(struct ipt_reject_info),
195         .table          = "filter",
196         .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
197                           (1 << NF_INET_LOCAL_OUT),
198         .checkentry     = reject_tg_check,
199         .me             = THIS_MODULE,
200 };
201 
202 static int __init reject_tg_init(void)
203 {
204         return xt_register_target(&reject_tg_reg);
205 }
206 
207 static void __exit reject_tg_exit(void)
208 {
209         xt_unregister_target(&reject_tg_reg);
210 }
211 
212 module_init(reject_tg_init);
213 module_exit(reject_tg_exit);
214 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp