2 * IP6 tables REJECT target module
3 * Linux INET6 implementation
5 * Copyright (C)2003 USAGI/WIDE Project
8 * Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
10 * Based on net/ipv4/netfilter/ipt_REJECT.c
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
18 #include <linux/config.h>
19 #include <linux/module.h>
20 #include <linux/skbuff.h>
21 #include <linux/icmpv6.h>
22 #include <linux/netdevice.h>
26 #include <net/ip6_checksum.h>
27 #include <net/ip6_fib.h>
28 #include <net/ip6_route.h>
30 #include <linux/netfilter_ipv6/ip6_tables.h>
31 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
33 MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
34 MODULE_DESCRIPTION("IP6 tables REJECT target module");
35 MODULE_LICENSE("GPL");
40 #define DEBUGP(format, args...)
44 static void send_reset(struct sk_buff
*oldskb
)
47 struct tcphdr otcph
, *tcph
;
48 unsigned int otcplen
, hh_len
;
49 int tcphoff
, needs_ack
;
50 struct ipv6hdr
*oip6h
= oldskb
->nh
.ipv6h
, *ip6h
;
51 struct dst_entry
*dst
= NULL
;
55 if ((!(ipv6_addr_type(&oip6h
->saddr
) & IPV6_ADDR_UNICAST
)) ||
56 (!(ipv6_addr_type(&oip6h
->daddr
) & IPV6_ADDR_UNICAST
))) {
57 DEBUGP("ip6t_REJECT: addr is not unicast.\n");
61 proto
= oip6h
->nexthdr
;
62 tcphoff
= ipv6_skip_exthdr(oldskb
, ((u8
*)(oip6h
+1) - oldskb
->data
), &proto
);
64 if ((tcphoff
< 0) || (tcphoff
> oldskb
->len
)) {
65 DEBUGP("ip6t_REJECT: Can't get TCP header.\n");
69 otcplen
= oldskb
->len
- tcphoff
;
71 /* IP header checks: fragment, too short. */
72 if ((proto
!= IPPROTO_TCP
) || (otcplen
< sizeof(struct tcphdr
))) {
73 DEBUGP("ip6t_REJECT: proto(%d) != IPPROTO_TCP, or too short. otcplen = %d\n",
78 if (skb_copy_bits(oldskb
, tcphoff
, &otcph
, sizeof(struct tcphdr
)))
83 DEBUGP("ip6t_REJECT: RST is set\n");
88 if (csum_ipv6_magic(&oip6h
->saddr
, &oip6h
->daddr
, otcplen
, IPPROTO_TCP
,
89 skb_checksum(oldskb
, tcphoff
, otcplen
, 0))) {
90 DEBUGP("ip6t_REJECT: TCP checksum is invalid\n");
94 memset(&fl
, 0, sizeof(fl
));
95 fl
.proto
= IPPROTO_TCP
;
96 ipv6_addr_copy(&fl
.fl6_src
, &oip6h
->daddr
);
97 ipv6_addr_copy(&fl
.fl6_dst
, &oip6h
->saddr
);
98 fl
.fl_ip_sport
= otcph
.dest
;
99 fl
.fl_ip_dport
= otcph
.source
;
100 dst
= ip6_route_output(NULL
, &fl
);
104 xfrm_lookup(&dst
, &fl
, NULL
, 0)) {
109 hh_len
= (dst
->dev
->hard_header_len
+ 15)&~15;
110 nskb
= alloc_skb(hh_len
+ 15 + dst
->header_len
+ sizeof(struct ipv6hdr
)
111 + sizeof(struct tcphdr
) + dst
->trailer_len
,
116 printk("ip6t_REJECT: Can't alloc skb\n");
123 skb_reserve(nskb
, hh_len
+ dst
->header_len
);
125 ip6h
= nskb
->nh
.ipv6h
= (struct ipv6hdr
*)
126 skb_put(nskb
, sizeof(struct ipv6hdr
));
128 ip6h
->hop_limit
= dst_metric(dst
, RTAX_HOPLIMIT
);
129 ip6h
->nexthdr
= IPPROTO_TCP
;
130 ip6h
->payload_len
= htons(sizeof(struct tcphdr
));
131 ipv6_addr_copy(&ip6h
->saddr
, &oip6h
->daddr
);
132 ipv6_addr_copy(&ip6h
->daddr
, &oip6h
->saddr
);
134 tcph
= (struct tcphdr
*)skb_put(nskb
, sizeof(struct tcphdr
));
135 /* Truncate to length (no data) */
136 tcph
->doff
= sizeof(struct tcphdr
)/4;
137 tcph
->source
= otcph
.dest
;
138 tcph
->dest
= otcph
.source
;
142 tcph
->seq
= otcph
.ack_seq
;
146 tcph
->ack_seq
= htonl(ntohl(otcph
.seq
) + otcph
.syn
+ otcph
.fin
147 + otcplen
- (otcph
.doff
<<2));
152 ((u_int8_t
*)tcph
)[13] = 0;
154 tcph
->ack
= needs_ack
;
159 /* Adjust TCP checksum */
160 tcph
->check
= csum_ipv6_magic(&nskb
->nh
.ipv6h
->saddr
,
161 &nskb
->nh
.ipv6h
->daddr
,
162 sizeof(struct tcphdr
), IPPROTO_TCP
,
163 csum_partial((char *)tcph
,
164 sizeof(struct tcphdr
), 0));
166 NF_HOOK(PF_INET6
, NF_IP6_LOCAL_OUT
, nskb
, NULL
, nskb
->dst
->dev
,
171 send_unreach(struct sk_buff
*skb_in
, unsigned char code
, unsigned int hooknum
)
173 if (hooknum
== NF_IP6_LOCAL_OUT
&& skb_in
->dev
== NULL
)
174 skb_in
->dev
= &loopback_dev
;
176 icmpv6_send(skb_in
, ICMPV6_DEST_UNREACH
, code
, 0, NULL
);
179 static unsigned int reject6_target(struct sk_buff
**pskb
,
180 const struct net_device
*in
,
181 const struct net_device
*out
,
182 unsigned int hooknum
,
183 const void *targinfo
,
186 const struct ip6t_reject_info
*reject
= targinfo
;
188 DEBUGP(KERN_DEBUG
"%s: medium point\n", __FUNCTION__
);
189 /* WARNING: This code causes reentry within ip6tables.
190 This means that the ip6tables jump stack is now crap. We
191 must return an absolute verdict. --RR */
192 switch (reject
->with
) {
193 case IP6T_ICMP6_NO_ROUTE
:
194 send_unreach(*pskb
, ICMPV6_NOROUTE
, hooknum
);
196 case IP6T_ICMP6_ADM_PROHIBITED
:
197 send_unreach(*pskb
, ICMPV6_ADM_PROHIBITED
, hooknum
);
199 case IP6T_ICMP6_NOT_NEIGHBOUR
:
200 send_unreach(*pskb
, ICMPV6_NOT_NEIGHBOUR
, hooknum
);
202 case IP6T_ICMP6_ADDR_UNREACH
:
203 send_unreach(*pskb
, ICMPV6_ADDR_UNREACH
, hooknum
);
205 case IP6T_ICMP6_PORT_UNREACH
:
206 send_unreach(*pskb
, ICMPV6_PORT_UNREACH
, hooknum
);
208 case IP6T_ICMP6_ECHOREPLY
:
216 printk(KERN_WARNING
"ip6t_REJECT: case %u not handled yet\n", reject
->with
);
223 static int check(const char *tablename
,
224 const struct ip6t_entry
*e
,
226 unsigned int targinfosize
,
227 unsigned int hook_mask
)
229 const struct ip6t_reject_info
*rejinfo
= targinfo
;
231 if (targinfosize
!= IP6T_ALIGN(sizeof(struct ip6t_reject_info
))) {
232 DEBUGP("ip6t_REJECT: targinfosize %u != 0\n", targinfosize
);
236 /* Only allow these for packet filtering. */
237 if (strcmp(tablename
, "filter") != 0) {
238 DEBUGP("ip6t_REJECT: bad table `%s'.\n", tablename
);
242 if ((hook_mask
& ~((1 << NF_IP6_LOCAL_IN
)
243 | (1 << NF_IP6_FORWARD
)
244 | (1 << NF_IP6_LOCAL_OUT
))) != 0) {
245 DEBUGP("ip6t_REJECT: bad hook mask %X\n", hook_mask
);
249 if (rejinfo
->with
== IP6T_ICMP6_ECHOREPLY
) {
250 printk("ip6t_REJECT: ECHOREPLY is not supported.\n");
252 } else if (rejinfo
->with
== IP6T_TCP_RESET
) {
253 /* Must specify that it's a TCP packet */
254 if (e
->ipv6
.proto
!= IPPROTO_TCP
255 || (e
->ipv6
.invflags
& IP6T_INV_PROTO
)) {
256 DEBUGP("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
264 static struct ip6t_target ip6t_reject_reg
= {
266 .target
= reject6_target
,
271 static int __init
init(void)
273 if (ip6t_register_target(&ip6t_reject_reg
))
278 static void __exit
fini(void)
280 ip6t_unregister_target(&ip6t_reject_reg
);