1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* (C) 1999-2001 Paul `Rusty' Russell |
3 | * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> |
4 | */ |
5 | |
6 | #include <linux/module.h> |
7 | #include <net/ipv6.h> |
8 | #include <net/ip6_route.h> |
9 | #include <net/ip6_fib.h> |
10 | #include <net/ip6_checksum.h> |
11 | #include <net/netfilter/ipv6/nf_reject.h> |
12 | #include <linux/netfilter_ipv6.h> |
13 | #include <linux/netfilter_bridge.h> |
14 | |
15 | static bool nf_reject_v6_csum_ok(struct sk_buff *skb, int hook) |
16 | { |
17 | const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
18 | int thoff; |
19 | __be16 fo; |
20 | u8 proto = ip6h->nexthdr; |
21 | |
22 | if (skb_csum_unnecessary(skb)) |
23 | return true; |
24 | |
25 | if (ip6h->payload_len && |
26 | pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h))) |
27 | return false; |
28 | |
29 | ip6h = ipv6_hdr(skb); |
30 | thoff = ipv6_skip_exthdr(skb, start: ((u8*)(ip6h+1) - skb->data), nexthdrp: &proto, frag_offp: &fo); |
31 | if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0) |
32 | return false; |
33 | |
34 | if (!nf_reject_verify_csum(skb, dataoff: thoff, proto)) |
35 | return true; |
36 | |
37 | return nf_ip6_checksum(skb, hook, dataoff: thoff, protocol: proto) == 0; |
38 | } |
39 | |
40 | static int nf_reject_ip6hdr_validate(struct sk_buff *skb) |
41 | { |
42 | struct ipv6hdr *hdr; |
43 | u32 pkt_len; |
44 | |
45 | if (!pskb_may_pull(skb, len: sizeof(struct ipv6hdr))) |
46 | return 0; |
47 | |
48 | hdr = ipv6_hdr(skb); |
49 | if (hdr->version != 6) |
50 | return 0; |
51 | |
52 | pkt_len = ntohs(hdr->payload_len); |
53 | if (pkt_len + sizeof(struct ipv6hdr) > skb->len) |
54 | return 0; |
55 | |
56 | return 1; |
57 | } |
58 | |
59 | struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net, |
60 | struct sk_buff *oldskb, |
61 | const struct net_device *dev, |
62 | int hook) |
63 | { |
64 | struct sk_buff *nskb; |
65 | const struct tcphdr *oth; |
66 | struct tcphdr _oth; |
67 | unsigned int otcplen; |
68 | struct ipv6hdr *nip6h; |
69 | |
70 | if (!nf_reject_ip6hdr_validate(skb: oldskb)) |
71 | return NULL; |
72 | |
73 | oth = nf_reject_ip6_tcphdr_get(oldskb, otcph: &_oth, otcplen: &otcplen, hook); |
74 | if (!oth) |
75 | return NULL; |
76 | |
77 | nskb = alloc_skb(size: sizeof(struct ipv6hdr) + sizeof(struct tcphdr) + |
78 | LL_MAX_HEADER, GFP_ATOMIC); |
79 | if (!nskb) |
80 | return NULL; |
81 | |
82 | nskb->dev = (struct net_device *)dev; |
83 | |
84 | skb_reserve(skb: nskb, LL_MAX_HEADER); |
85 | nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP, |
86 | READ_ONCE(net->ipv6.devconf_all->hop_limit)); |
87 | nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen); |
88 | nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr)); |
89 | |
90 | return nskb; |
91 | } |
92 | EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset); |
93 | |
94 | struct sk_buff *nf_reject_skb_v6_unreach(struct net *net, |
95 | struct sk_buff *oldskb, |
96 | const struct net_device *dev, |
97 | int hook, u8 code) |
98 | { |
99 | struct sk_buff *nskb; |
100 | struct ipv6hdr *nip6h; |
101 | struct icmp6hdr *icmp6h; |
102 | unsigned int len; |
103 | |
104 | if (!nf_reject_ip6hdr_validate(skb: oldskb)) |
105 | return NULL; |
106 | |
107 | /* Include "As much of invoking packet as possible without the ICMPv6 |
108 | * packet exceeding the minimum IPv6 MTU" in the ICMP payload. |
109 | */ |
110 | len = min_t(unsigned int, 1220, oldskb->len); |
111 | |
112 | if (!pskb_may_pull(skb: oldskb, len)) |
113 | return NULL; |
114 | |
115 | if (!nf_reject_v6_csum_ok(skb: oldskb, hook)) |
116 | return NULL; |
117 | |
118 | nskb = alloc_skb(size: sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) + |
119 | LL_MAX_HEADER + len, GFP_ATOMIC); |
120 | if (!nskb) |
121 | return NULL; |
122 | |
123 | nskb->dev = (struct net_device *)dev; |
124 | |
125 | skb_reserve(skb: nskb, LL_MAX_HEADER); |
126 | nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6, |
127 | READ_ONCE(net->ipv6.devconf_all->hop_limit)); |
128 | |
129 | skb_reset_transport_header(skb: nskb); |
130 | icmp6h = skb_put_zero(skb: nskb, len: sizeof(struct icmp6hdr)); |
131 | icmp6h->icmp6_type = ICMPV6_DEST_UNREACH; |
132 | icmp6h->icmp6_code = code; |
133 | |
134 | skb_put_data(skb: nskb, data: skb_network_header(skb: oldskb), len); |
135 | nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr)); |
136 | |
137 | icmp6h->icmp6_cksum = |
138 | csum_ipv6_magic(saddr: &nip6h->saddr, daddr: &nip6h->daddr, |
139 | len: nskb->len - sizeof(struct ipv6hdr), |
140 | IPPROTO_ICMPV6, |
141 | sum: csum_partial(buff: icmp6h, |
142 | len: nskb->len - sizeof(struct ipv6hdr), |
143 | sum: 0)); |
144 | |
145 | return nskb; |
146 | } |
147 | EXPORT_SYMBOL_GPL(nf_reject_skb_v6_unreach); |
148 | |
149 | const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb, |
150 | struct tcphdr *otcph, |
151 | unsigned int *otcplen, int hook) |
152 | { |
153 | const struct ipv6hdr *oip6h = ipv6_hdr(skb: oldskb); |
154 | u8 proto; |
155 | __be16 frag_off; |
156 | int tcphoff; |
157 | |
158 | proto = oip6h->nexthdr; |
159 | tcphoff = ipv6_skip_exthdr(oldskb, start: ((u8 *)(oip6h + 1) - oldskb->data), |
160 | nexthdrp: &proto, frag_offp: &frag_off); |
161 | |
162 | if ((tcphoff < 0) || (tcphoff > oldskb->len)) { |
163 | pr_debug("Cannot get TCP header.\n" ); |
164 | return NULL; |
165 | } |
166 | |
167 | *otcplen = oldskb->len - tcphoff; |
168 | |
169 | /* IP header checks: fragment, too short. */ |
170 | if (proto != IPPROTO_TCP || *otcplen < sizeof(struct tcphdr)) { |
171 | pr_debug("proto(%d) != IPPROTO_TCP or too short (len = %d)\n" , |
172 | proto, *otcplen); |
173 | return NULL; |
174 | } |
175 | |
176 | otcph = skb_header_pointer(skb: oldskb, offset: tcphoff, len: sizeof(struct tcphdr), |
177 | buffer: otcph); |
178 | if (otcph == NULL) |
179 | return NULL; |
180 | |
181 | /* No RST for RST. */ |
182 | if (otcph->rst) { |
183 | pr_debug("RST is set\n" ); |
184 | return NULL; |
185 | } |
186 | |
187 | /* Check checksum. */ |
188 | if (nf_ip6_checksum(skb: oldskb, hook, dataoff: tcphoff, IPPROTO_TCP)) { |
189 | pr_debug("TCP checksum is invalid\n" ); |
190 | return NULL; |
191 | } |
192 | |
193 | return otcph; |
194 | } |
195 | EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_get); |
196 | |
197 | struct ipv6hdr *nf_reject_ip6hdr_put(struct sk_buff *nskb, |
198 | const struct sk_buff *oldskb, |
199 | __u8 protocol, int hoplimit) |
200 | { |
201 | struct ipv6hdr *ip6h; |
202 | const struct ipv6hdr *oip6h = ipv6_hdr(skb: oldskb); |
203 | #define DEFAULT_TOS_VALUE 0x0U |
204 | const __u8 tclass = DEFAULT_TOS_VALUE; |
205 | |
206 | skb_put(skb: nskb, len: sizeof(struct ipv6hdr)); |
207 | skb_reset_network_header(skb: nskb); |
208 | ip6h = ipv6_hdr(skb: nskb); |
209 | ip6_flow_hdr(hdr: ip6h, tclass, flowlabel: 0); |
210 | ip6h->hop_limit = hoplimit; |
211 | ip6h->nexthdr = protocol; |
212 | ip6h->saddr = oip6h->daddr; |
213 | ip6h->daddr = oip6h->saddr; |
214 | |
215 | nskb->protocol = htons(ETH_P_IPV6); |
216 | |
217 | return ip6h; |
218 | } |
219 | EXPORT_SYMBOL_GPL(nf_reject_ip6hdr_put); |
220 | |
221 | void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, |
222 | const struct sk_buff *oldskb, |
223 | const struct tcphdr *oth, unsigned int otcplen) |
224 | { |
225 | struct tcphdr *tcph; |
226 | int needs_ack; |
227 | |
228 | skb_reset_transport_header(skb: nskb); |
229 | tcph = skb_put(skb: nskb, len: sizeof(struct tcphdr)); |
230 | /* Truncate to length (no data) */ |
231 | tcph->doff = sizeof(struct tcphdr)/4; |
232 | tcph->source = oth->dest; |
233 | tcph->dest = oth->source; |
234 | |
235 | if (oth->ack) { |
236 | needs_ack = 0; |
237 | tcph->seq = oth->ack_seq; |
238 | tcph->ack_seq = 0; |
239 | } else { |
240 | needs_ack = 1; |
241 | tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + |
242 | otcplen - (oth->doff<<2)); |
243 | tcph->seq = 0; |
244 | } |
245 | |
246 | /* Reset flags */ |
247 | ((u_int8_t *)tcph)[13] = 0; |
248 | tcph->rst = 1; |
249 | tcph->ack = needs_ack; |
250 | tcph->window = 0; |
251 | tcph->urg_ptr = 0; |
252 | tcph->check = 0; |
253 | |
254 | /* Adjust TCP checksum */ |
255 | tcph->check = csum_ipv6_magic(saddr: &ipv6_hdr(skb: nskb)->saddr, |
256 | daddr: &ipv6_hdr(skb: nskb)->daddr, |
257 | len: sizeof(struct tcphdr), IPPROTO_TCP, |
258 | sum: csum_partial(buff: tcph, |
259 | len: sizeof(struct tcphdr), sum: 0)); |
260 | } |
261 | EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_put); |
262 | |
263 | static int nf_reject6_fill_skb_dst(struct sk_buff *skb_in) |
264 | { |
265 | struct dst_entry *dst = NULL; |
266 | struct flowi fl; |
267 | |
268 | memset(&fl, 0, sizeof(struct flowi)); |
269 | fl.u.ip6.daddr = ipv6_hdr(skb: skb_in)->saddr; |
270 | nf_ip6_route(net: dev_net(dev: skb_in->dev), dst: &dst, fl: &fl, strict: false); |
271 | if (!dst) |
272 | return -1; |
273 | |
274 | skb_dst_set(skb: skb_in, dst); |
275 | return 0; |
276 | } |
277 | |
278 | void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, |
279 | int hook) |
280 | { |
281 | struct sk_buff *nskb; |
282 | struct tcphdr _otcph; |
283 | const struct tcphdr *otcph; |
284 | unsigned int otcplen, hh_len; |
285 | const struct ipv6hdr *oip6h = ipv6_hdr(skb: oldskb); |
286 | struct ipv6hdr *ip6h; |
287 | struct dst_entry *dst = NULL; |
288 | struct flowi6 fl6; |
289 | |
290 | if ((!(ipv6_addr_type(addr: &oip6h->saddr) & IPV6_ADDR_UNICAST)) || |
291 | (!(ipv6_addr_type(addr: &oip6h->daddr) & IPV6_ADDR_UNICAST))) { |
292 | pr_debug("addr is not unicast.\n" ); |
293 | return; |
294 | } |
295 | |
296 | otcph = nf_reject_ip6_tcphdr_get(oldskb, &_otcph, &otcplen, hook); |
297 | if (!otcph) |
298 | return; |
299 | |
300 | memset(&fl6, 0, sizeof(fl6)); |
301 | fl6.flowi6_proto = IPPROTO_TCP; |
302 | fl6.saddr = oip6h->daddr; |
303 | fl6.daddr = oip6h->saddr; |
304 | fl6.fl6_sport = otcph->dest; |
305 | fl6.fl6_dport = otcph->source; |
306 | |
307 | if (hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) { |
308 | nf_ip6_route(net, dst: &dst, fl: flowi6_to_flowi(fl6: &fl6), strict: false); |
309 | if (!dst) |
310 | return; |
311 | skb_dst_set(skb: oldskb, dst); |
312 | } |
313 | |
314 | fl6.flowi6_oif = l3mdev_master_ifindex(dev: skb_dst(skb: oldskb)->dev); |
315 | fl6.flowi6_mark = IP6_REPLY_MARK(net, oldskb->mark); |
316 | security_skb_classify_flow(skb: oldskb, flic: flowi6_to_flowi_common(fl6: &fl6)); |
317 | dst = ip6_route_output(net, NULL, fl6: &fl6); |
318 | if (dst->error) { |
319 | dst_release(dst); |
320 | return; |
321 | } |
322 | dst = xfrm_lookup(net, dst_orig: dst, fl: flowi6_to_flowi(fl6: &fl6), NULL, flags: 0); |
323 | if (IS_ERR(ptr: dst)) |
324 | return; |
325 | |
326 | hh_len = (dst->dev->hard_header_len + 15)&~15; |
327 | nskb = alloc_skb(size: hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr) |
328 | + sizeof(struct tcphdr) + dst->trailer_len, |
329 | GFP_ATOMIC); |
330 | |
331 | if (!nskb) { |
332 | net_dbg_ratelimited("cannot alloc skb\n" ); |
333 | dst_release(dst); |
334 | return; |
335 | } |
336 | |
337 | skb_dst_set(skb: nskb, dst); |
338 | |
339 | nskb->mark = fl6.flowi6_mark; |
340 | |
341 | skb_reserve(skb: nskb, len: hh_len + dst->header_len); |
342 | ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP, |
343 | ip6_dst_hoplimit(dst)); |
344 | nf_reject_ip6_tcphdr_put(nskb, oldskb, otcph, otcplen); |
345 | |
346 | nf_ct_attach(nskb, oldskb); |
347 | nf_ct_set_closing(nfct: skb_nfct(skb: oldskb)); |
348 | |
349 | #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
350 | /* If we use ip6_local_out for bridged traffic, the MAC source on |
351 | * the RST will be ours, instead of the destination's. This confuses |
352 | * some routers/firewalls, and they drop the packet. So we need to |
353 | * build the eth header using the original destination's MAC as the |
354 | * source, and send the RST packet directly. |
355 | */ |
356 | if (nf_bridge_info_exists(skb: oldskb)) { |
357 | struct ethhdr *oeth = eth_hdr(skb: oldskb); |
358 | struct net_device *br_indev; |
359 | |
360 | br_indev = nf_bridge_get_physindev(skb: oldskb, net); |
361 | if (!br_indev) { |
362 | kfree_skb(skb: nskb); |
363 | return; |
364 | } |
365 | |
366 | nskb->dev = br_indev; |
367 | nskb->protocol = htons(ETH_P_IPV6); |
368 | ip6h->payload_len = htons(sizeof(struct tcphdr)); |
369 | if (dev_hard_header(skb: nskb, dev: nskb->dev, ntohs(nskb->protocol), |
370 | daddr: oeth->h_source, saddr: oeth->h_dest, len: nskb->len) < 0) { |
371 | kfree_skb(skb: nskb); |
372 | return; |
373 | } |
374 | dev_queue_xmit(skb: nskb); |
375 | } else |
376 | #endif |
377 | ip6_local_out(net, sk, skb: nskb); |
378 | } |
379 | EXPORT_SYMBOL_GPL(nf_send_reset6); |
380 | |
381 | static bool reject6_csum_ok(struct sk_buff *skb, int hook) |
382 | { |
383 | const struct ipv6hdr *ip6h = ipv6_hdr(skb); |
384 | int thoff; |
385 | __be16 fo; |
386 | u8 proto; |
387 | |
388 | if (skb_csum_unnecessary(skb)) |
389 | return true; |
390 | |
391 | proto = ip6h->nexthdr; |
392 | thoff = ipv6_skip_exthdr(skb, start: ((u8 *)(ip6h + 1) - skb->data), nexthdrp: &proto, frag_offp: &fo); |
393 | |
394 | if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0) |
395 | return false; |
396 | |
397 | if (!nf_reject_verify_csum(skb, dataoff: thoff, proto)) |
398 | return true; |
399 | |
400 | return nf_ip6_checksum(skb, hook, dataoff: thoff, protocol: proto) == 0; |
401 | } |
402 | |
403 | void nf_send_unreach6(struct net *net, struct sk_buff *skb_in, |
404 | unsigned char code, unsigned int hooknum) |
405 | { |
406 | if (!reject6_csum_ok(skb: skb_in, hook: hooknum)) |
407 | return; |
408 | |
409 | if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL) |
410 | skb_in->dev = net->loopback_dev; |
411 | |
412 | if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_INGRESS) && |
413 | nf_reject6_fill_skb_dst(skb_in) < 0) |
414 | return; |
415 | |
416 | icmpv6_send(skb: skb_in, ICMPV6_DEST_UNREACH, code, info: 0); |
417 | } |
418 | EXPORT_SYMBOL_GPL(nf_send_unreach6); |
419 | |
420 | MODULE_LICENSE("GPL" ); |
421 | MODULE_DESCRIPTION("IPv6 packet rejection core" ); |
422 | |