Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51b0a5d8 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_reject: introduce icmp code abstraction for inet and bridge 



This patch introduces the NFT_REJECT_ICMPX_UNREACH type which provides
an abstraction to the ICMP and ICMPv6 codes that you can use from the
inet and bridge tables, they are:

* NFT_REJECT_ICMPX_NO_ROUTE: no route to host - network unreachable
* NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratevely prohibited

You can still use the specific codes when restricting the rule to match
the corresponding layer 3 protocol.

I decided to not overload the existing NFT_REJECT_ICMP_UNREACH to have
different semantics depending on the table family and to allow the user
to specify ICMP family specific codes if they restrict it to the
corresponding family.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2c804d0f

include/net/netfilter/ipv4/nf_reject.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -5,6 +5,7 @@ 
#include <net/tcp.h>

#include <net/tcp.h>

#include <net/route.h>

#include <net/route.h>

#include <net/dst.h>

#include <net/dst.h>

#include <net/icmp.h>





static inline void nf_send_unreach(struct sk_buff *skb_in, int code)

static inline void nf_send_unreach(struct sk_buff *skb_in, int code)

{

{

include/net/netfilter/nft_reject.h

+2 −7
Original line number Original line Diff line number Diff line
@@ -14,12 +14,7 @@ int nft_reject_init(const struct nft_ctx *ctx, 




int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr);

int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr);





void nft_reject_ipv4_eval(const struct nft_expr *expr,

int nft_reject_icmp_code(u8 code);

			  struct nft_data data[NFT_REG_MAX + 1],

int nft_reject_icmpv6_code(u8 code);

			  const struct nft_pktinfo *pkt);



void nft_reject_ipv6_eval(const struct nft_expr *expr,

			  struct nft_data data[NFT_REG_MAX + 1],

			  const struct nft_pktinfo *pkt);





#endif
 
#endif

include/uapi/linux/netfilter/nf_tables.h

+21 −0
Original line number Original line Diff line number Diff line
@@ -749,12 +749,33 @@ enum nft_queue_attributes { 
 *

 *

 * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable

 * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable

 * @NFT_REJECT_TCP_RST: reject using TCP RST

 * @NFT_REJECT_TCP_RST: reject using TCP RST

 * @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet

 */

 */

enum nft_reject_types {

enum nft_reject_types {

	NFT_REJECT_ICMP_UNREACH,

	NFT_REJECT_ICMP_UNREACH,

	NFT_REJECT_TCP_RST,

	NFT_REJECT_TCP_RST,

	NFT_REJECT_ICMPX_UNREACH,

};

};





/**

 * enum nft_reject_code - Generic reject codes for IPv4/IPv6

 *

 * @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable

 * @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable

 * @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable

 * @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited

 *

 * These codes are mapped to real ICMP and ICMPv6 codes.

 */

enum nft_reject_inet_code {

	NFT_REJECT_ICMPX_NO_ROUTE	= 0,

	NFT_REJECT_ICMPX_PORT_UNREACH,

	NFT_REJECT_ICMPX_HOST_UNREACH,

	NFT_REJECT_ICMPX_ADMIN_PROHIBITED,

	__NFT_REJECT_ICMPX_MAX

};

#define NFT_REJECT_ICMPX_MAX	(__NFT_REJECT_ICMPX_MAX + 1)



/**

/**

 * enum nft_reject_attributes - nf_tables reject expression netlink attributes

 * enum nft_reject_attributes - nf_tables reject expression netlink attributes

 *

 *

net/bridge/netfilter/nft_reject_bridge.c

+90 −5
Original line number Original line Diff line number Diff line
@@ -14,21 +14,106 @@ 
#include <linux/netfilter/nf_tables.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nft_reject.h>

#include <net/netfilter/nft_reject.h>

#include <net/netfilter/ipv4/nf_reject.h>

#include <net/netfilter/ipv6/nf_reject.h>





static void nft_reject_bridge_eval(const struct nft_expr *expr,

static void nft_reject_bridge_eval(const struct nft_expr *expr,

				 struct nft_data data[NFT_REG_MAX + 1],

				 struct nft_data data[NFT_REG_MAX + 1],

				 const struct nft_pktinfo *pkt)

				 const struct nft_pktinfo *pkt)

{

{

	struct nft_reject *priv = nft_expr_priv(expr);

	struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);



	switch (eth_hdr(pkt->skb)->h_proto) {

	switch (eth_hdr(pkt->skb)->h_proto) {

	case htons(ETH_P_IP):

	case htons(ETH_P_IP):

		return nft_reject_ipv4_eval(expr, data, pkt);

		switch (priv->type) {

		case NFT_REJECT_ICMP_UNREACH:

			nf_send_unreach(pkt->skb, priv->icmp_code);

			break;

		case NFT_REJECT_TCP_RST:

			nf_send_reset(pkt->skb, pkt->ops->hooknum);

			break;

		case NFT_REJECT_ICMPX_UNREACH:

			nf_send_unreach(pkt->skb,

					nft_reject_icmp_code(priv->icmp_code));

			break;

		}

		break;

	case htons(ETH_P_IPV6):

	case htons(ETH_P_IPV6):

		return nft_reject_ipv6_eval(expr, data, pkt);

		switch (priv->type) {

		case NFT_REJECT_ICMP_UNREACH:

			nf_send_unreach6(net, pkt->skb, priv->icmp_code,

					 pkt->ops->hooknum);

			break;

		case NFT_REJECT_TCP_RST:

			nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);

			break;

		case NFT_REJECT_ICMPX_UNREACH:

			nf_send_unreach6(net, pkt->skb,

					 nft_reject_icmpv6_code(priv->icmp_code),

					 pkt->ops->hooknum);

			break;

		}

		break;

	default:

	default:

		/* No explicit way to reject this protocol, drop it. */

		/* No explicit way to reject this protocol, drop it. */

		break;

	}

	data[NFT_REG_VERDICT].verdict = NF_DROP;

	data[NFT_REG_VERDICT].verdict = NF_DROP;

}



static int nft_reject_bridge_init(const struct nft_ctx *ctx,

				  const struct nft_expr *expr,

				  const struct nlattr * const tb[])

{

	struct nft_reject *priv = nft_expr_priv(expr);

	int icmp_code;



	if (tb[NFTA_REJECT_TYPE] == NULL)

		return -EINVAL;



	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));

	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (tb[NFTA_REJECT_ICMP_CODE] == NULL)

			return -EINVAL;



		icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);

		if (priv->type == NFT_REJECT_ICMPX_UNREACH &&

		    icmp_code > NFT_REJECT_ICMPX_MAX)

			return -EINVAL;



		priv->icmp_code = icmp_code;

		break;

		break;

	case NFT_REJECT_TCP_RST:

		break;

	default:

		return -EINVAL;

	}

	}

	return 0;

}



static int nft_reject_bridge_dump(struct sk_buff *skb,

				  const struct nft_expr *expr)

{

	const struct nft_reject *priv = nft_expr_priv(expr);



	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))

		goto nla_put_failure;



	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

	case NFT_REJECT_ICMPX_UNREACH:

		if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))

			goto nla_put_failure;

		break;

	}



	return 0;



nla_put_failure:

	return -1;

}

}





static struct nft_expr_type nft_reject_bridge_type;

static struct nft_expr_type nft_reject_bridge_type;
@@ -36,8 +121,8 @@ static const struct nft_expr_ops nft_reject_bridge_ops = { 
	.type		= &nft_reject_bridge_type,

	.type		= &nft_reject_bridge_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),

	.eval		= nft_reject_bridge_eval,

	.eval		= nft_reject_bridge_eval,

	.init		= nft_reject_init,

	.init		= nft_reject_bridge_init,

	.dump		= nft_reject_dump,

	.dump		= nft_reject_bridge_dump,

};

};





static struct nft_expr_type nft_reject_bridge_type __read_mostly = {

static struct nft_expr_type nft_reject_bridge_type __read_mostly = {

net/ipv4/netfilter/nft_reject_ipv4.c

+0 −1
Original line number Original line Diff line number Diff line
@@ -16,7 +16,6 @@ 
#include <linux/netfilter.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/icmp.h>

#include <net/netfilter/ipv4/nf_reject.h>

#include <net/netfilter/ipv4/nf_reject.h>

#include <net/netfilter/nft_reject.h>

#include <net/netfilter/nft_reject.h>