Commit | Line | Data |
---|---|---|
cc70d069 EL |
1 | #ifndef _IPV4_NF_REJECT_H |
2 | #define _IPV4_NF_REJECT_H | |
3 | ||
4 | #include <net/ip.h> | |
5 | #include <net/tcp.h> | |
6 | #include <net/route.h> | |
7 | #include <net/dst.h> | |
51b0a5d8 | 8 | #include <net/icmp.h> |
cc70d069 EL |
9 | |
10 | static inline void nf_send_unreach(struct sk_buff *skb_in, int code) | |
11 | { | |
12 | icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0); | |
13 | } | |
14 | ||
15 | /* Send RST reply */ | |
16 | static void nf_send_reset(struct sk_buff *oldskb, int hook) | |
17 | { | |
18 | struct sk_buff *nskb; | |
19 | const struct iphdr *oiph; | |
20 | struct iphdr *niph; | |
21 | const struct tcphdr *oth; | |
22 | struct tcphdr _otcph, *tcph; | |
23 | ||
24 | /* IP header checks: fragment. */ | |
25 | if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) | |
26 | return; | |
27 | ||
28 | oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), | |
29 | sizeof(_otcph), &_otcph); | |
30 | if (oth == NULL) | |
31 | return; | |
32 | ||
33 | /* No RST for RST. */ | |
34 | if (oth->rst) | |
35 | return; | |
36 | ||
37 | if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) | |
38 | return; | |
39 | ||
40 | /* Check checksum */ | |
41 | if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) | |
42 | return; | |
43 | oiph = ip_hdr(oldskb); | |
44 | ||
45 | nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + | |
46 | LL_MAX_HEADER, GFP_ATOMIC); | |
47 | if (!nskb) | |
48 | return; | |
49 | ||
50 | skb_reserve(nskb, LL_MAX_HEADER); | |
51 | ||
52 | skb_reset_network_header(nskb); | |
53 | niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr)); | |
54 | niph->version = 4; | |
55 | niph->ihl = sizeof(struct iphdr) / 4; | |
56 | niph->tos = 0; | |
57 | niph->id = 0; | |
58 | niph->frag_off = htons(IP_DF); | |
59 | niph->protocol = IPPROTO_TCP; | |
60 | niph->check = 0; | |
61 | niph->saddr = oiph->daddr; | |
62 | niph->daddr = oiph->saddr; | |
63 | ||
64 | skb_reset_transport_header(nskb); | |
65 | tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); | |
66 | memset(tcph, 0, sizeof(*tcph)); | |
67 | tcph->source = oth->dest; | |
68 | tcph->dest = oth->source; | |
69 | tcph->doff = sizeof(struct tcphdr) / 4; | |
70 | ||
71 | if (oth->ack) | |
72 | tcph->seq = oth->ack_seq; | |
73 | else { | |
74 | tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + | |
75 | oldskb->len - ip_hdrlen(oldskb) - | |
76 | (oth->doff << 2)); | |
77 | tcph->ack = 1; | |
78 | } | |
79 | ||
80 | tcph->rst = 1; | |
81 | tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr, | |
82 | niph->daddr, 0); | |
83 | nskb->ip_summed = CHECKSUM_PARTIAL; | |
84 | nskb->csum_start = (unsigned char *)tcph - nskb->head; | |
85 | nskb->csum_offset = offsetof(struct tcphdr, check); | |
86 | ||
87 | /* ip_route_me_harder expects skb->dst to be set */ | |
88 | skb_dst_set_noref(nskb, skb_dst(oldskb)); | |
89 | ||
90 | nskb->protocol = htons(ETH_P_IP); | |
91 | if (ip_route_me_harder(nskb, RTN_UNSPEC)) | |
92 | goto free_nskb; | |
93 | ||
94 | niph->ttl = ip4_dst_hoplimit(skb_dst(nskb)); | |
95 | ||
96 | /* "Never happens" */ | |
97 | if (nskb->len > dst_mtu(skb_dst(nskb))) | |
98 | goto free_nskb; | |
99 | ||
100 | nf_ct_attach(nskb, oldskb); | |
101 | ||
34666d46 | 102 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
cc70d069 EL |
103 | /* If we use ip_local_out for bridged traffic, the MAC source on |
104 | * the RST will be ours, instead of the destination's. This confuses | |
105 | * some routers/firewalls, and they drop the packet. So we need to | |
106 | * build the eth header using the original destination's MAC as the | |
107 | * source, and send the RST packet directly. | |
108 | */ | |
109 | if (oldskb->nf_bridge) { | |
110 | struct ethhdr *oeth = eth_hdr(oldskb); | |
111 | nskb->dev = oldskb->nf_bridge->physindev; | |
112 | niph->tot_len = htons(nskb->len); | |
113 | ip_send_check(niph); | |
114 | if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol), | |
115 | oeth->h_source, oeth->h_dest, nskb->len) < 0) | |
116 | goto free_nskb; | |
117 | dev_queue_xmit(nskb); | |
118 | } else | |
119 | #endif | |
120 | ip_local_out(nskb); | |
121 | ||
122 | return; | |
123 | ||
124 | free_nskb: | |
125 | kfree_skb(nskb); | |
126 | } | |
127 | ||
128 | ||
129 | #endif /* _IPV4_NF_REJECT_H */ |