net/netfilter/nft_reject.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2013 Eric Leblond <eric@regit.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/netlink.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_tables.h>
  19 #include <net/icmp.h>
  20 #include <net/netfilter/ipv4/nf_reject.h>
  21
  22 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  23 #include <net/netfilter/ipv6/nf_reject.h>
  24 #endif
  25
  26 struct nft_reject {
  27         enum nft_reject_types   type:8;
  28         u8                      icmp_code;
  29         u8                      family;
  30 };
  31
  32 static void nft_reject_eval(const struct nft_expr *expr,
  33                               struct nft_data data[NFT_REG_MAX + 1],
  34                               const struct nft_pktinfo *pkt)
  35 {
  36         struct nft_reject *priv = nft_expr_priv(expr);
  37 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  38         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
  39 #endif
  40         switch (priv->type) {
  41         case NFT_REJECT_ICMP_UNREACH:
  42                 if (priv->family == NFPROTO_IPV4)
  43                         nf_send_unreach(pkt->skb, priv->icmp_code);
  44 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  45                 else if (priv->family == NFPROTO_IPV6)
  46                         nf_send_unreach6(net, pkt->skb, priv->icmp_code,
  47                                       pkt->ops->hooknum);
  48 #endif
  49                 break;
  50         case NFT_REJECT_TCP_RST:
  51                 if (priv->family == NFPROTO_IPV4)
  52                         nf_send_reset(pkt->skb, pkt->ops->hooknum);
  53 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  54                 else if (priv->family == NFPROTO_IPV6)
  55                         nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
  56 #endif
  57                 break;
  58         }
  59
  60         data[NFT_REG_VERDICT].verdict = NF_DROP;
  61 }
  62
  63 static const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
  64         [NFTA_REJECT_TYPE]              = { .type = NLA_U32 },
  65         [NFTA_REJECT_ICMP_CODE]         = { .type = NLA_U8 },
  66 };
  67
  68 static int nft_reject_init(const struct nft_ctx *ctx,
  69                            const struct nft_expr *expr,
  70                            const struct nlattr * const tb[])
  71 {
  72         struct nft_reject *priv = nft_expr_priv(expr);
  73
  74         if (tb[NFTA_REJECT_TYPE] == NULL)
  75                 return -EINVAL;
  76
  77         priv->family = ctx->afi->family;
  78         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
  79         switch (priv->type) {
  80         case NFT_REJECT_ICMP_UNREACH:
  81                 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
  82                         return -EINVAL;
  83                 priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
  84         case NFT_REJECT_TCP_RST:
  85                 break;
  86         default:
  87                 return -EINVAL;
  88         }
  89
  90         return 0;
  91 }
  92
  93 static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
  94 {
  95         const struct nft_reject *priv = nft_expr_priv(expr);
  96
  97         if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
  98                 goto nla_put_failure;
  99
 100         switch (priv->type) {
 101         case NFT_REJECT_ICMP_UNREACH:
 102                 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
 103                         goto nla_put_failure;
 104                 break;
 105         }
 106
 107         return 0;
 108
 109 nla_put_failure:
 110         return -1;
 111 }
 112
 113 static struct nft_expr_type nft_reject_type;
 114 static const struct nft_expr_ops nft_reject_ops = {
 115         .type           = &nft_reject_type,
 116         .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
 117         .eval           = nft_reject_eval,
 118         .init           = nft_reject_init,
 119         .dump           = nft_reject_dump,
 120 };
 121
 122 static struct nft_expr_type nft_reject_type __read_mostly = {
 123         .name           = "reject",
 124         .ops            = &nft_reject_ops,
 125         .policy         = nft_reject_policy,
 126         .maxattr        = NFTA_REJECT_MAX,
 127         .owner          = THIS_MODULE,
 128 };
 129
 130 static int __init nft_reject_module_init(void)
 131 {
 132         return nft_register_expr(&nft_reject_type);
 133 }
 134
 135 static void __exit nft_reject_module_exit(void)
 136 {
 137         nft_unregister_expr(&nft_reject_type);
 138 }
 139
 140 module_init(nft_reject_module_init);
 141 module_exit(nft_reject_module_exit);
 142
 143 MODULE_LICENSE("GPL");
 144 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 145 MODULE_ALIAS_NFT_EXPR("reject");