~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/bridge/netfilter/nft_reject_bridge.c

Version: ~ [ linux-5.16-rc3 ] ~ [ linux-5.15.5 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.82 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.162 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.218 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.256 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.291 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.293 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  */
  8 
  9 #include <linux/kernel.h>
 10 #include <linux/init.h>
 11 #include <linux/module.h>
 12 #include <linux/netlink.h>
 13 #include <linux/netfilter.h>
 14 #include <linux/netfilter/nf_tables.h>
 15 #include <net/netfilter/nf_tables.h>
 16 #include <net/netfilter/nft_reject.h>
 17 #include <net/netfilter/nf_tables_bridge.h>
 18 #include <net/netfilter/ipv4/nf_reject.h>
 19 #include <net/netfilter/ipv6/nf_reject.h>
 20 #include <linux/ip.h>
 21 #include <net/ip.h>
 22 #include <net/ip6_checksum.h>
 23 #include <linux/netfilter_bridge.h>
 24 #include <linux/netfilter_ipv6.h>
 25 #include "../br_private.h"
 26 
 27 static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
 28                                         struct sk_buff *nskb)
 29 {
 30         struct ethhdr *eth;
 31 
 32         eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
 33         skb_reset_mac_header(nskb);
 34         ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
 35         ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
 36         eth->h_proto = eth_hdr(oldskb)->h_proto;
 37         skb_pull(nskb, ETH_HLEN);
 38 }
 39 
 40 /* We cannot use oldskb->dev, it can be either bridge device (NF_BRIDGE INPUT)
 41  * or the bridge port (NF_BRIDGE PREROUTING).
 42  */
 43 static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb,
 44                                             const struct net_device *dev,
 45                                             int hook)
 46 {
 47         struct sk_buff *nskb;
 48         struct iphdr *niph;
 49         const struct tcphdr *oth;
 50         struct tcphdr _oth;
 51 
 52         if (!nft_bridge_iphdr_validate(oldskb))
 53                 return;
 54 
 55         oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
 56         if (!oth)
 57                 return;
 58 
 59         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
 60                          LL_MAX_HEADER, GFP_ATOMIC);
 61         if (!nskb)
 62                 return;
 63 
 64         skb_reserve(nskb, LL_MAX_HEADER);
 65         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
 66                                    sysctl_ip_default_ttl);
 67         nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
 68         niph->ttl       = sysctl_ip_default_ttl;
 69         niph->tot_len   = htons(nskb->len);
 70         ip_send_check(niph);
 71 
 72         nft_reject_br_push_etherhdr(oldskb, nskb);
 73 
 74         br_deliver(br_port_get_rcu(dev), nskb);
 75 }
 76 
 77 static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb,
 78                                           const struct net_device *dev,
 79                                           int hook, u8 code)
 80 {
 81         struct sk_buff *nskb;
 82         struct iphdr *niph;
 83         struct icmphdr *icmph;
 84         unsigned int len;
 85         void *payload;
 86         __wsum csum;
 87         u8 proto;
 88 
 89         if (oldskb->csum_bad || !nft_bridge_iphdr_validate(oldskb))
 90                 return;
 91 
 92         /* IP header checks: fragment. */
 93         if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
 94                 return;
 95 
 96         /* RFC says return as much as we can without exceeding 576 bytes. */
 97         len = min_t(unsigned int, 536, oldskb->len);
 98 
 99         if (!pskb_may_pull(oldskb, len))
100                 return;
101 
102         if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))
103                 return;
104 
105         if (ip_hdr(oldskb)->protocol == IPPROTO_TCP ||
106             ip_hdr(oldskb)->protocol == IPPROTO_UDP)
107                 proto = ip_hdr(oldskb)->protocol;
108         else
109                 proto = 0;
110 
111         if (!skb_csum_unnecessary(oldskb) &&
112             nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))
113                 return;
114 
115         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
116                          LL_MAX_HEADER + len, GFP_ATOMIC);
117         if (!nskb)
118                 return;
119 
120         skb_reserve(nskb, LL_MAX_HEADER);
121         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
122                                    sysctl_ip_default_ttl);
123 
124         skb_reset_transport_header(nskb);
125         icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
126         memset(icmph, 0, sizeof(*icmph));
127         icmph->type     = ICMP_DEST_UNREACH;
128         icmph->code     = code;
129 
130         payload = skb_put(nskb, len);
131         memcpy(payload, skb_network_header(oldskb), len);
132 
133         csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
134         icmph->checksum = csum_fold(csum);
135 
136         niph->tot_len   = htons(nskb->len);
137         ip_send_check(niph);
138 
139         nft_reject_br_push_etherhdr(oldskb, nskb);
140 
141         br_deliver(br_port_get_rcu(dev), nskb);
142 }
143 
144 static void nft_reject_br_send_v6_tcp_reset(struct net *net,
145                                             struct sk_buff *oldskb,
146                                             const struct net_device *dev,
147                                             int hook)
148 {
149         struct sk_buff *nskb;
150         const struct tcphdr *oth;
151         struct tcphdr _oth;
152         unsigned int otcplen;
153         struct ipv6hdr *nip6h;
154 
155         if (!nft_bridge_ip6hdr_validate(oldskb))
156                 return;
157 
158         oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
159         if (!oth)
160                 return;
161 
162         nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
163                          LL_MAX_HEADER, GFP_ATOMIC);
164         if (!nskb)
165                 return;
166 
167         skb_reserve(nskb, LL_MAX_HEADER);
168         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
169                                      net->ipv6.devconf_all->hop_limit);
170         nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
171         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
172 
173         nft_reject_br_push_etherhdr(oldskb, nskb);
174 
175         br_deliver(br_port_get_rcu(dev), nskb);
176 }
177 
178 static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
179 {
180         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
181         int thoff;
182         __be16 fo;
183         u8 proto = ip6h->nexthdr;
184 
185         if (skb->csum_bad)
186                 return false;
187 
188         if (skb_csum_unnecessary(skb))
189                 return true;
190 
191         if (ip6h->payload_len &&
192             pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
193                 return false;
194 
195         thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
196         if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
197                 return false;
198 
199         return nf_ip6_checksum(skb, hook, thoff, proto) == 0;
200 }
201 
202 static void nft_reject_br_send_v6_unreach(struct net *net,
203                                           struct sk_buff *oldskb,
204                                           const struct net_device *dev,
205                                           int hook, u8 code)
206 {
207         struct sk_buff *nskb;
208         struct ipv6hdr *nip6h;
209         struct icmp6hdr *icmp6h;
210         unsigned int len;
211         void *payload;
212 
213         if (!nft_bridge_ip6hdr_validate(oldskb))
214                 return;
215 
216         /* Include "As much of invoking packet as possible without the ICMPv6
217          * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
218          */
219         len = min_t(unsigned int, 1220, oldskb->len);
220 
221         if (!pskb_may_pull(oldskb, len))
222                 return;
223 
224         if (!reject6_br_csum_ok(oldskb, hook))
225                 return;
226 
227         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
228                          LL_MAX_HEADER + len, GFP_ATOMIC);
229         if (!nskb)
230                 return;
231 
232         skb_reserve(nskb, LL_MAX_HEADER);
233         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
234                                      net->ipv6.devconf_all->hop_limit);
235 
236         skb_reset_transport_header(nskb);
237         icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
238         memset(icmp6h, 0, sizeof(*icmp6h));
239         icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
240         icmp6h->icmp6_code = code;
241 
242         payload = skb_put(nskb, len);
243         memcpy(payload, skb_network_header(oldskb), len);
244         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
245 
246         icmp6h->icmp6_cksum =
247                 csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
248                                 nskb->len - sizeof(struct ipv6hdr),
249                                 IPPROTO_ICMPV6,
250                                 csum_partial(icmp6h,
251                                              nskb->len - sizeof(struct ipv6hdr),
252                                              0));
253 
254         nft_reject_br_push_etherhdr(oldskb, nskb);
255 
256         br_deliver(br_port_get_rcu(dev), nskb);
257 }
258 
259 static void nft_reject_bridge_eval(const struct nft_expr *expr,
260                                    struct nft_regs *regs,
261                                    const struct nft_pktinfo *pkt)
262 {
263         struct nft_reject *priv = nft_expr_priv(expr);
264         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
265         const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
266 
267         if (is_broadcast_ether_addr(dest) ||
268             is_multicast_ether_addr(dest))
269                 goto out;
270 
271         switch (eth_hdr(pkt->skb)->h_proto) {
272         case htons(ETH_P_IP):
273                 switch (priv->type) {
274                 case NFT_REJECT_ICMP_UNREACH:
275                         nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
276                                                       pkt->ops->hooknum,
277                                                       priv->icmp_code);
278                         break;
279                 case NFT_REJECT_TCP_RST:
280                         nft_reject_br_send_v4_tcp_reset(pkt->skb, pkt->in,
281                                                         pkt->ops->hooknum);
282                         break;
283                 case NFT_REJECT_ICMPX_UNREACH:
284                         nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
285                                                       pkt->ops->hooknum,
286                                                       nft_reject_icmp_code(priv->icmp_code));
287                         break;
288                 }
289                 break;
290         case htons(ETH_P_IPV6):
291                 switch (priv->type) {
292                 case NFT_REJECT_ICMP_UNREACH:
293                         nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,
294                                                       pkt->ops->hooknum,
295                                                       priv->icmp_code);
296                         break;
297                 case NFT_REJECT_TCP_RST:
298                         nft_reject_br_send_v6_tcp_reset(net, pkt->skb, pkt->in,
299                                                         pkt->ops->hooknum);
300                         break;
301                 case NFT_REJECT_ICMPX_UNREACH:
302                         nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,
303                                                       pkt->ops->hooknum,
304                                                       nft_reject_icmpv6_code(priv->icmp_code));
305                         break;
306                 }
307                 break;
308         default:
309                 /* No explicit way to reject this protocol, drop it. */
310                 break;
311         }
312 out:
313         regs->verdict.code = NF_DROP;
314 }
315 
316 static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
317                                       const struct nft_expr *expr,
318                                       const struct nft_data **data)
319 {
320         return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
321                                                     (1 << NF_BR_LOCAL_IN));
322 }
323 
324 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
325                                   const struct nft_expr *expr,
326                                   const struct nlattr * const tb[])
327 {
328         struct nft_reject *priv = nft_expr_priv(expr);
329         int icmp_code, err;
330 
331         err = nft_reject_bridge_validate(ctx, expr, NULL);
332         if (err < 0)
333                 return err;
334 
335         if (tb[NFTA_REJECT_TYPE] == NULL)
336                 return -EINVAL;
337 
338         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
339         switch (priv->type) {
340         case NFT_REJECT_ICMP_UNREACH:
341         case NFT_REJECT_ICMPX_UNREACH:
342                 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
343                         return -EINVAL;
344 
345                 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
346                 if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
347                     icmp_code > NFT_REJECT_ICMPX_MAX)
348                         return -EINVAL;
349 
350                 priv->icmp_code = icmp_code;
351                 break;
352         case NFT_REJECT_TCP_RST:
353                 break;
354         default:
355                 return -EINVAL;
356         }
357         return 0;
358 }
359 
360 static int nft_reject_bridge_dump(struct sk_buff *skb,
361                                   const struct nft_expr *expr)
362 {
363         const struct nft_reject *priv = nft_expr_priv(expr);
364 
365         if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
366                 goto nla_put_failure;
367 
368         switch (priv->type) {
369         case NFT_REJECT_ICMP_UNREACH:
370         case NFT_REJECT_ICMPX_UNREACH:
371                 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
372                         goto nla_put_failure;
373                 break;
374         default:
375                 break;
376         }
377 
378         return 0;
379 
380 nla_put_failure:
381         return -1;
382 }
383 
384 static struct nft_expr_type nft_reject_bridge_type;
385 static const struct nft_expr_ops nft_reject_bridge_ops = {
386         .type           = &nft_reject_bridge_type,
387         .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
388         .eval           = nft_reject_bridge_eval,
389         .init           = nft_reject_bridge_init,
390         .dump           = nft_reject_bridge_dump,
391         .validate       = nft_reject_bridge_validate,
392 };
393 
394 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
395         .family         = NFPROTO_BRIDGE,
396         .name           = "reject",
397         .ops            = &nft_reject_bridge_ops,
398         .policy         = nft_reject_policy,
399         .maxattr        = NFTA_REJECT_MAX,
400         .owner          = THIS_MODULE,
401 };
402 
403 static int __init nft_reject_bridge_module_init(void)
404 {
405         return nft_register_expr(&nft_reject_bridge_type);
406 }
407 
408 static void __exit nft_reject_bridge_module_exit(void)
409 {
410         nft_unregister_expr(&nft_reject_bridge_type);
411 }
412 
413 module_init(nft_reject_bridge_module_init);
414 module_exit(nft_reject_bridge_module_exit);
415 
416 MODULE_LICENSE("GPL");
417 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
418 MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");
419 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp