2 * IP6 tables REJECT target module
3 * Linux INET6 implementation
5 * Copyright (C)2003 USAGI/WIDE Project
8 * Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
10 * Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
12 * Based on net/ipv4/netfilter/ipt_REJECT.c
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
21 #include <linux/gfp.h>
22 #include <linux/module.h>
23 #include <linux/skbuff.h>
24 #include <linux/icmpv6.h>
25 #include <linux/netdevice.h>
29 #include <net/ip6_checksum.h>
30 #include <net/ip6_fib.h>
31 #include <net/ip6_route.h>
33 #include <linux/netfilter/x_tables.h>
34 #include <linux/netfilter_ipv6/ip6_tables.h>
35 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
37 MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
38 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
39 MODULE_LICENSE("GPL");
42 static void send_reset(struct net
*net
, struct sk_buff
*oldskb
)
45 struct tcphdr otcph
, *tcph
;
46 unsigned int otcplen
, hh_len
;
47 int tcphoff
, needs_ack
;
48 const struct ipv6hdr
*oip6h
= ipv6_hdr(oldskb
);
50 #define DEFAULT_TOS_VALUE 0x0U
51 const __u8 tclass
= DEFAULT_TOS_VALUE
;
52 struct dst_entry
*dst
= NULL
;
57 if ((!(ipv6_addr_type(&oip6h
->saddr
) & IPV6_ADDR_UNICAST
)) ||
58 (!(ipv6_addr_type(&oip6h
->daddr
) & IPV6_ADDR_UNICAST
))) {
59 pr_debug("addr is not unicast.\n");
63 proto
= oip6h
->nexthdr
;
64 tcphoff
= ipv6_skip_exthdr(oldskb
, ((u8
*)(oip6h
+1) - oldskb
->data
), &proto
, &frag_off
);
66 if ((tcphoff
< 0) || (tcphoff
> oldskb
->len
)) {
67 pr_debug("Cannot get TCP header.\n");
71 otcplen
= oldskb
->len
- tcphoff
;
73 /* IP header checks: fragment, too short. */
74 if (proto
!= IPPROTO_TCP
|| otcplen
< sizeof(struct tcphdr
)) {
75 pr_debug("proto(%d) != IPPROTO_TCP, "
76 "or too short. otcplen = %d\n",
81 if (skb_copy_bits(oldskb
, tcphoff
, &otcph
, sizeof(struct tcphdr
)))
86 pr_debug("RST is set\n");
91 if (csum_ipv6_magic(&oip6h
->saddr
, &oip6h
->daddr
, otcplen
, IPPROTO_TCP
,
92 skb_checksum(oldskb
, tcphoff
, otcplen
, 0))) {
93 pr_debug("TCP checksum is invalid\n");
97 memset(&fl6
, 0, sizeof(fl6
));
98 fl6
.flowi6_proto
= IPPROTO_TCP
;
99 fl6
.saddr
= oip6h
->daddr
;
100 fl6
.daddr
= oip6h
->saddr
;
101 fl6
.fl6_sport
= otcph
.dest
;
102 fl6
.fl6_dport
= otcph
.source
;
103 security_skb_classify_flow(oldskb
, flowi6_to_flowi(&fl6
));
104 dst
= ip6_route_output(net
, NULL
, &fl6
);
105 if (dst
== NULL
|| dst
->error
) {
109 dst
= xfrm_lookup(net
, dst
, flowi6_to_flowi(&fl6
), NULL
, 0);
113 hh_len
= (dst
->dev
->hard_header_len
+ 15)&~15;
114 nskb
= alloc_skb(hh_len
+ 15 + dst
->header_len
+ sizeof(struct ipv6hdr
)
115 + sizeof(struct tcphdr
) + dst
->trailer_len
,
119 net_dbg_ratelimited("cannot alloc skb\n");
124 skb_dst_set(nskb
, dst
);
126 skb_reserve(nskb
, hh_len
+ dst
->header_len
);
128 skb_put(nskb
, sizeof(struct ipv6hdr
));
129 skb_reset_network_header(nskb
);
130 ip6h
= ipv6_hdr(nskb
);
131 ip6_flow_hdr(ip6h
, tclass
, 0);
132 ip6h
->hop_limit
= ip6_dst_hoplimit(dst
);
133 ip6h
->nexthdr
= IPPROTO_TCP
;
134 ip6h
->saddr
= oip6h
->daddr
;
135 ip6h
->daddr
= oip6h
->saddr
;
137 skb_reset_transport_header(nskb
);
138 tcph
= (struct tcphdr
*)skb_put(nskb
, sizeof(struct tcphdr
));
139 /* Truncate to length (no data) */
140 tcph
->doff
= sizeof(struct tcphdr
)/4;
141 tcph
->source
= otcph
.dest
;
142 tcph
->dest
= otcph
.source
;
146 tcph
->seq
= otcph
.ack_seq
;
150 tcph
->ack_seq
= htonl(ntohl(otcph
.seq
) + otcph
.syn
+ otcph
.fin
151 + otcplen
- (otcph
.doff
<<2));
156 ((u_int8_t
*)tcph
)[13] = 0;
158 tcph
->ack
= needs_ack
;
163 /* Adjust TCP checksum */
164 tcph
->check
= csum_ipv6_magic(&ipv6_hdr(nskb
)->saddr
,
165 &ipv6_hdr(nskb
)->daddr
,
166 sizeof(struct tcphdr
), IPPROTO_TCP
,
168 sizeof(struct tcphdr
), 0));
170 nf_ct_attach(nskb
, oldskb
);
176 send_unreach(struct net
*net
, struct sk_buff
*skb_in
, unsigned char code
,
177 unsigned int hooknum
)
179 if (hooknum
== NF_INET_LOCAL_OUT
&& skb_in
->dev
== NULL
)
180 skb_in
->dev
= net
->loopback_dev
;
182 icmpv6_send(skb_in
, ICMPV6_DEST_UNREACH
, code
, 0);
183 #ifdef CONFIG_IP6_NF_TARGET_REJECT_SKERR
185 icmpv6_err_convert(ICMPV6_DEST_UNREACH
, code
,
186 &skb_in
->sk
->sk_err
);
187 skb_in
->sk
->sk_error_report(skb_in
->sk
);
188 pr_debug("ip6t_REJECT: sk_err=%d for skb=%p sk=%p\n",
189 skb_in
->sk
->sk_err
, skb_in
, skb_in
->sk
);
195 reject_tg6(struct sk_buff
*skb
, const struct xt_action_param
*par
)
197 const struct ip6t_reject_info
*reject
= par
->targinfo
;
198 struct net
*net
= dev_net((par
->in
!= NULL
) ? par
->in
: par
->out
);
200 pr_debug("%s: medium point\n", __func__
);
201 switch (reject
->with
) {
202 case IP6T_ICMP6_NO_ROUTE
:
203 send_unreach(net
, skb
, ICMPV6_NOROUTE
, par
->hooknum
);
205 case IP6T_ICMP6_ADM_PROHIBITED
:
206 send_unreach(net
, skb
, ICMPV6_ADM_PROHIBITED
, par
->hooknum
);
208 case IP6T_ICMP6_NOT_NEIGHBOUR
:
209 send_unreach(net
, skb
, ICMPV6_NOT_NEIGHBOUR
, par
->hooknum
);
211 case IP6T_ICMP6_ADDR_UNREACH
:
212 send_unreach(net
, skb
, ICMPV6_ADDR_UNREACH
, par
->hooknum
);
214 case IP6T_ICMP6_PORT_UNREACH
:
215 send_unreach(net
, skb
, ICMPV6_PORT_UNREACH
, par
->hooknum
);
217 case IP6T_ICMP6_ECHOREPLY
:
221 send_reset(net
, skb
);
224 net_info_ratelimited("case %u not handled yet\n", reject
->with
);
231 static int reject_tg6_check(const struct xt_tgchk_param
*par
)
233 const struct ip6t_reject_info
*rejinfo
= par
->targinfo
;
234 const struct ip6t_entry
*e
= par
->entryinfo
;
236 if (rejinfo
->with
== IP6T_ICMP6_ECHOREPLY
) {
237 pr_info("ECHOREPLY is not supported.\n");
239 } else if (rejinfo
->with
== IP6T_TCP_RESET
) {
240 /* Must specify that it's a TCP packet */
241 if (e
->ipv6
.proto
!= IPPROTO_TCP
||
242 (e
->ipv6
.invflags
& XT_INV_PROTO
)) {
243 pr_info("TCP_RESET illegal for non-tcp\n");
250 static struct xt_target reject_tg6_reg __read_mostly
= {
252 .family
= NFPROTO_IPV6
,
253 .target
= reject_tg6
,
254 .targetsize
= sizeof(struct ip6t_reject_info
),
256 .hooks
= (1 << NF_INET_LOCAL_IN
) | (1 << NF_INET_FORWARD
) |
257 (1 << NF_INET_LOCAL_OUT
),
258 .checkentry
= reject_tg6_check
,
262 static int __init
reject_tg6_init(void)
264 return xt_register_target(&reject_tg6_reg
);
267 static void __exit
reject_tg6_exit(void)
269 xt_unregister_target(&reject_tg6_reg
);
272 module_init(reject_tg6_init
);
273 module_exit(reject_tg6_exit
);