[TCP]: Fix some warning when MD5 is disabled.
[linux-2.6] / net / ipv6 / netfilter / ip6t_REJECT.c
1 /*
2  * IP6 tables REJECT target module
3  * Linux INET6 implementation
4  *
5  * Copyright (C)2003 USAGI/WIDE Project
6  *
7  * Authors:
8  *      Yasuyuki Kozakai        <yasuyuki.kozakai@toshiba.co.jp>
9  *
10  * Based on net/ipv4/netfilter/ipt_REJECT.c
11  *
12  * This program is free software; you can redistribute it and/or
13  * modify it under the terms of the GNU General Public License
14  * as published by the Free Software Foundation; either version
15  * 2 of the License, or (at your option) any later version.
16  */
17
18 #include <linux/module.h>
19 #include <linux/skbuff.h>
20 #include <linux/icmpv6.h>
21 #include <linux/netdevice.h>
22 #include <net/ipv6.h>
23 #include <net/tcp.h>
24 #include <net/icmp.h>
25 #include <net/ip6_checksum.h>
26 #include <net/ip6_fib.h>
27 #include <net/ip6_route.h>
28 #include <net/flow.h>
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
31
32 MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
33 MODULE_DESCRIPTION("IP6 tables REJECT target module");
34 MODULE_LICENSE("GPL");
35
36 #if 0
37 #define DEBUGP printk
38 #else
39 #define DEBUGP(format, args...)
40 #endif
41
42 /* Send RST reply */
43 static void send_reset(struct sk_buff *oldskb)
44 {
45         struct sk_buff *nskb;
46         struct tcphdr otcph, *tcph;
47         unsigned int otcplen, hh_len;
48         int tcphoff, needs_ack;
49         struct ipv6hdr *oip6h = oldskb->nh.ipv6h, *ip6h;
50         struct dst_entry *dst = NULL;
51         u8 proto;
52         struct flowi fl;
53
54         if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
55             (!(ipv6_addr_type(&oip6h->daddr) & IPV6_ADDR_UNICAST))) {
56                 DEBUGP("ip6t_REJECT: addr is not unicast.\n");
57                 return;
58         }
59
60         proto = oip6h->nexthdr;
61         tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto);
62
63         if ((tcphoff < 0) || (tcphoff > oldskb->len)) {
64                 DEBUGP("ip6t_REJECT: Can't get TCP header.\n");
65                 return;
66         }
67
68         otcplen = oldskb->len - tcphoff;
69
70         /* IP header checks: fragment, too short. */
71         if ((proto != IPPROTO_TCP) || (otcplen < sizeof(struct tcphdr))) {
72                 DEBUGP("ip6t_REJECT: proto(%d) != IPPROTO_TCP, or too short. otcplen = %d\n",
73                         proto, otcplen);
74                 return;
75         }
76
77         if (skb_copy_bits(oldskb, tcphoff, &otcph, sizeof(struct tcphdr)))
78                 BUG();
79
80         /* No RST for RST. */
81         if (otcph.rst) {
82                 DEBUGP("ip6t_REJECT: RST is set\n");
83                 return;
84         }
85
86         /* Check checksum. */
87         if (csum_ipv6_magic(&oip6h->saddr, &oip6h->daddr, otcplen, IPPROTO_TCP,
88                             skb_checksum(oldskb, tcphoff, otcplen, 0))) {
89                 DEBUGP("ip6t_REJECT: TCP checksum is invalid\n");
90                 return;
91         }
92
93         memset(&fl, 0, sizeof(fl));
94         fl.proto = IPPROTO_TCP;
95         ipv6_addr_copy(&fl.fl6_src, &oip6h->daddr);
96         ipv6_addr_copy(&fl.fl6_dst, &oip6h->saddr);
97         fl.fl_ip_sport = otcph.dest;
98         fl.fl_ip_dport = otcph.source;
99         security_skb_classify_flow(oldskb, &fl);
100         dst = ip6_route_output(NULL, &fl);
101         if (dst == NULL)
102                 return;
103         if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
104                 return;
105
106         hh_len = (dst->dev->hard_header_len + 15)&~15;
107         nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
108                          + sizeof(struct tcphdr) + dst->trailer_len,
109                          GFP_ATOMIC);
110
111         if (!nskb) {
112                 if (net_ratelimit())
113                         printk("ip6t_REJECT: Can't alloc skb\n");
114                 dst_release(dst);
115                 return;
116         }
117
118         nskb->dst = dst;
119
120         skb_reserve(nskb, hh_len + dst->header_len);
121
122         ip6h = nskb->nh.ipv6h = (struct ipv6hdr *)
123                                         skb_put(nskb, sizeof(struct ipv6hdr));
124         ip6h->version = 6;
125         ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT);
126         ip6h->nexthdr = IPPROTO_TCP;
127         ip6h->payload_len = htons(sizeof(struct tcphdr));
128         ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
129         ipv6_addr_copy(&ip6h->daddr, &oip6h->saddr);
130
131         tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
132         /* Truncate to length (no data) */
133         tcph->doff = sizeof(struct tcphdr)/4;
134         tcph->source = otcph.dest;
135         tcph->dest = otcph.source;
136
137         if (otcph.ack) {
138                 needs_ack = 0;
139                 tcph->seq = otcph.ack_seq;
140                 tcph->ack_seq = 0;
141         } else {
142                 needs_ack = 1;
143                 tcph->ack_seq = htonl(ntohl(otcph.seq) + otcph.syn + otcph.fin
144                                       + otcplen - (otcph.doff<<2));
145                 tcph->seq = 0;
146         }
147
148         /* Reset flags */
149         ((u_int8_t *)tcph)[13] = 0;
150         tcph->rst = 1;
151         tcph->ack = needs_ack;
152         tcph->window = 0;
153         tcph->urg_ptr = 0;
154         tcph->check = 0;
155
156         /* Adjust TCP checksum */
157         tcph->check = csum_ipv6_magic(&nskb->nh.ipv6h->saddr,
158                                       &nskb->nh.ipv6h->daddr,
159                                       sizeof(struct tcphdr), IPPROTO_TCP,
160                                       csum_partial((char *)tcph,
161                                                    sizeof(struct tcphdr), 0));
162
163         nf_ct_attach(nskb, oldskb);
164
165         NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
166                 dst_output);
167 }
168
169 static inline void
170 send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum)
171 {
172         if (hooknum == NF_IP6_LOCAL_OUT && skb_in->dev == NULL)
173                 skb_in->dev = &loopback_dev;
174
175         icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
176 }
177
178 static unsigned int reject6_target(struct sk_buff **pskb,
179                            const struct net_device *in,
180                            const struct net_device *out,
181                            unsigned int hooknum,
182                            const struct xt_target *target,
183                            const void *targinfo)
184 {
185         const struct ip6t_reject_info *reject = targinfo;
186
187         DEBUGP(KERN_DEBUG "%s: medium point\n", __FUNCTION__);
188         /* WARNING: This code causes reentry within ip6tables.
189            This means that the ip6tables jump stack is now crap.  We
190            must return an absolute verdict. --RR */
191         switch (reject->with) {
192         case IP6T_ICMP6_NO_ROUTE:
193                 send_unreach(*pskb, ICMPV6_NOROUTE, hooknum);
194                 break;
195         case IP6T_ICMP6_ADM_PROHIBITED:
196                 send_unreach(*pskb, ICMPV6_ADM_PROHIBITED, hooknum);
197                 break;
198         case IP6T_ICMP6_NOT_NEIGHBOUR:
199                 send_unreach(*pskb, ICMPV6_NOT_NEIGHBOUR, hooknum);
200                 break;
201         case IP6T_ICMP6_ADDR_UNREACH:
202                 send_unreach(*pskb, ICMPV6_ADDR_UNREACH, hooknum);
203                 break;
204         case IP6T_ICMP6_PORT_UNREACH:
205                 send_unreach(*pskb, ICMPV6_PORT_UNREACH, hooknum);
206                 break;
207         case IP6T_ICMP6_ECHOREPLY:
208                 /* Do nothing */
209                 break;
210         case IP6T_TCP_RESET:
211                 send_reset(*pskb);
212                 break;
213         default:
214                 if (net_ratelimit())
215                         printk(KERN_WARNING "ip6t_REJECT: case %u not handled yet\n", reject->with);
216                 break;
217         }
218
219         return NF_DROP;
220 }
221
222 static int check(const char *tablename,
223                  const void *entry,
224                  const struct xt_target *target,
225                  void *targinfo,
226                  unsigned int hook_mask)
227 {
228         const struct ip6t_reject_info *rejinfo = targinfo;
229         const struct ip6t_entry *e = entry;
230
231         if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
232                 printk("ip6t_REJECT: ECHOREPLY is not supported.\n");
233                 return 0;
234         } else if (rejinfo->with == IP6T_TCP_RESET) {
235                 /* Must specify that it's a TCP packet */
236                 if (e->ipv6.proto != IPPROTO_TCP
237                     || (e->ipv6.invflags & IP6T_INV_PROTO)) {
238                         DEBUGP("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
239                         return 0;
240                 }
241         }
242         return 1;
243 }
244
245 static struct ip6t_target ip6t_reject_reg = {
246         .name           = "REJECT",
247         .target         = reject6_target,
248         .targetsize     = sizeof(struct ip6t_reject_info),
249         .table          = "filter",
250         .hooks          = (1 << NF_IP6_LOCAL_IN) | (1 << NF_IP6_FORWARD) |
251                           (1 << NF_IP6_LOCAL_OUT),
252         .checkentry     = check,
253         .me             = THIS_MODULE
254 };
255
256 static int __init ip6t_reject_init(void)
257 {
258         return ip6t_register_target(&ip6t_reject_reg);
259 }
260
261 static void __exit ip6t_reject_fini(void)
262 {
263         ip6t_unregister_target(&ip6t_reject_reg);
264 }
265
266 module_init(ip6t_reject_init);
267 module_exit(ip6t_reject_fini);