1
2
3
4
5
6
7
8
9#include <linux/kernel.h>
10#include <linux/init.h>
11#include <linux/module.h>
12#include <linux/netlink.h>
13#include <linux/netfilter.h>
14#include <linux/netfilter/nf_tables.h>
15#include <net/netfilter/nf_tables.h>
16#include <net/netfilter/nft_reject.h>
17#include <net/netfilter/nf_tables_bridge.h>
18#include <net/netfilter/ipv4/nf_reject.h>
19#include <net/netfilter/ipv6/nf_reject.h>
20#include <linux/ip.h>
21#include <net/ip.h>
22#include <net/ip6_checksum.h>
23#include <linux/netfilter_bridge.h>
24#include <linux/netfilter_ipv6.h>
25#include "../br_private.h"
26
27static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
28 struct sk_buff *nskb)
29{
30 struct ethhdr *eth;
31
32 eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
33 skb_reset_mac_header(nskb);
34 ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
35 ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
36 eth->h_proto = eth_hdr(oldskb)->h_proto;
37 skb_pull(nskb, ETH_HLEN);
38}
39
40
41
42
43static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb,
44 const struct net_device *dev,
45 int hook)
46{
47 struct sk_buff *nskb;
48 struct iphdr *niph;
49 const struct tcphdr *oth;
50 struct tcphdr _oth;
51
52 if (!nft_bridge_iphdr_validate(oldskb))
53 return;
54
55 oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
56 if (!oth)
57 return;
58
59 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
60 LL_MAX_HEADER, GFP_ATOMIC);
61 if (!nskb)
62 return;
63
64 skb_reserve(nskb, LL_MAX_HEADER);
65 niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
66 sysctl_ip_default_ttl);
67 nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
68 niph->ttl = sysctl_ip_default_ttl;
69 niph->tot_len = htons(nskb->len);
70 ip_send_check(niph);
71
72 nft_reject_br_push_etherhdr(oldskb, nskb);
73
74 br_deliver(br_port_get_rcu(dev), nskb);
75}
76
77static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb,
78 const struct net_device *dev,
79 int hook, u8 code)
80{
81 struct sk_buff *nskb;
82 struct iphdr *niph;
83 struct icmphdr *icmph;
84 unsigned int len;
85 void *payload;
86 __wsum csum;
87 u8 proto;
88
89 if (oldskb->csum_bad || !nft_bridge_iphdr_validate(oldskb))
90 return;
91
92
93 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
94 return;
95
96
97 len = min_t(unsigned int, 536, oldskb->len);
98
99 if (!pskb_may_pull(oldskb, len))
100 return;
101
102 if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))
103 return;
104
105 if (ip_hdr(oldskb)->protocol == IPPROTO_TCP ||
106 ip_hdr(oldskb)->protocol == IPPROTO_UDP)
107 proto = ip_hdr(oldskb)->protocol;
108 else
109 proto = 0;
110
111 if (!skb_csum_unnecessary(oldskb) &&
112 nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))
113 return;
114
115 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
116 LL_MAX_HEADER + len, GFP_ATOMIC);
117 if (!nskb)
118 return;
119
120 skb_reserve(nskb, LL_MAX_HEADER);
121 niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
122 sysctl_ip_default_ttl);
123
124 skb_reset_transport_header(nskb);
125 icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
126 memset(icmph, 0, sizeof(*icmph));
127 icmph->type = ICMP_DEST_UNREACH;
128 icmph->code = code;
129
130 payload = skb_put(nskb, len);
131 memcpy(payload, skb_network_header(oldskb), len);
132
133 csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
134 icmph->checksum = csum_fold(csum);
135
136 niph->tot_len = htons(nskb->len);
137 ip_send_check(niph);
138
139 nft_reject_br_push_etherhdr(oldskb, nskb);
140
141 br_deliver(br_port_get_rcu(dev), nskb);
142}
143
144static void nft_reject_br_send_v6_tcp_reset(struct net *net,
145 struct sk_buff *oldskb,
146 const struct net_device *dev,
147 int hook)
148{
149 struct sk_buff *nskb;
150 const struct tcphdr *oth;
151 struct tcphdr _oth;
152 unsigned int otcplen;
153 struct ipv6hdr *nip6h;
154
155 if (!nft_bridge_ip6hdr_validate(oldskb))
156 return;
157
158 oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
159 if (!oth)
160 return;
161
162 nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
163 LL_MAX_HEADER, GFP_ATOMIC);
164 if (!nskb)
165 return;
166
167 skb_reserve(nskb, LL_MAX_HEADER);
168 nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
169 net->ipv6.devconf_all->hop_limit);
170 nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
171 nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
172
173 nft_reject_br_push_etherhdr(oldskb, nskb);
174
175 br_deliver(br_port_get_rcu(dev), nskb);
176}
177
178static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
179{
180 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
181 int thoff;
182 __be16 fo;
183 u8 proto = ip6h->nexthdr;
184
185 if (skb->csum_bad)
186 return false;
187
188 if (skb_csum_unnecessary(skb))
189 return true;
190
191 if (ip6h->payload_len &&
192 pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
193 return false;
194
195 thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
196 if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
197 return false;
198
199 return nf_ip6_checksum(skb, hook, thoff, proto) == 0;
200}
201
202static void nft_reject_br_send_v6_unreach(struct net *net,
203 struct sk_buff *oldskb,
204 const struct net_device *dev,
205 int hook, u8 code)
206{
207 struct sk_buff *nskb;
208 struct ipv6hdr *nip6h;
209 struct icmp6hdr *icmp6h;
210 unsigned int len;
211 void *payload;
212
213 if (!nft_bridge_ip6hdr_validate(oldskb))
214 return;
215
216
217
218
219 len = min_t(unsigned int, 1220, oldskb->len);
220
221 if (!pskb_may_pull(oldskb, len))
222 return;
223
224 if (!reject6_br_csum_ok(oldskb, hook))
225 return;
226
227 nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
228 LL_MAX_HEADER + len, GFP_ATOMIC);
229 if (!nskb)
230 return;
231
232 skb_reserve(nskb, LL_MAX_HEADER);
233 nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
234 net->ipv6.devconf_all->hop_limit);
235
236 skb_reset_transport_header(nskb);
237 icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
238 memset(icmp6h, 0, sizeof(*icmp6h));
239 icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
240 icmp6h->icmp6_code = code;
241
242 payload = skb_put(nskb, len);
243 memcpy(payload, skb_network_header(oldskb), len);
244 nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
245
246 icmp6h->icmp6_cksum =
247 csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
248 nskb->len - sizeof(struct ipv6hdr),
249 IPPROTO_ICMPV6,
250 csum_partial(icmp6h,
251 nskb->len - sizeof(struct ipv6hdr),
252 0));
253
254 nft_reject_br_push_etherhdr(oldskb, nskb);
255
256 br_deliver(br_port_get_rcu(dev), nskb);
257}
258
259static void nft_reject_bridge_eval(const struct nft_expr *expr,
260 struct nft_regs *regs,
261 const struct nft_pktinfo *pkt)
262{
263 struct nft_reject *priv = nft_expr_priv(expr);
264 struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
265 const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
266
267 if (is_broadcast_ether_addr(dest) ||
268 is_multicast_ether_addr(dest))
269 goto out;
270
271 switch (eth_hdr(pkt->skb)->h_proto) {
272 case htons(ETH_P_IP):
273 switch (priv->type) {
274 case NFT_REJECT_ICMP_UNREACH:
275 nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
276 pkt->ops->hooknum,
277 priv->icmp_code);
278 break;
279 case NFT_REJECT_TCP_RST:
280 nft_reject_br_send_v4_tcp_reset(pkt->skb, pkt->in,
281 pkt->ops->hooknum);
282 break;
283 case NFT_REJECT_ICMPX_UNREACH:
284 nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
285 pkt->ops->hooknum,
286 nft_reject_icmp_code(priv->icmp_code));
287 break;
288 }
289 break;
290 case htons(ETH_P_IPV6):
291 switch (priv->type) {
292 case NFT_REJECT_ICMP_UNREACH:
293 nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,
294 pkt->ops->hooknum,
295 priv->icmp_code);
296 break;
297 case NFT_REJECT_TCP_RST:
298 nft_reject_br_send_v6_tcp_reset(net, pkt->skb, pkt->in,
299 pkt->ops->hooknum);
300 break;
301 case NFT_REJECT_ICMPX_UNREACH:
302 nft_reject_br_send_v6_unreach(net, pkt->skb, pkt->in,
303 pkt->ops->hooknum,
304 nft_reject_icmpv6_code(priv->icmp_code));
305 break;
306 }
307 break;
308 default:
309
310 break;
311 }
312out:
313 regs->verdict.code = NF_DROP;
314}
315
316static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
317 const struct nft_expr *expr,
318 const struct nft_data **data)
319{
320 return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
321 (1 << NF_BR_LOCAL_IN));
322}
323
324static int nft_reject_bridge_init(const struct nft_ctx *ctx,
325 const struct nft_expr *expr,
326 const struct nlattr * const tb[])
327{
328 struct nft_reject *priv = nft_expr_priv(expr);
329 int icmp_code, err;
330
331 err = nft_reject_bridge_validate(ctx, expr, NULL);
332 if (err < 0)
333 return err;
334
335 if (tb[NFTA_REJECT_TYPE] == NULL)
336 return -EINVAL;
337
338 priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
339 switch (priv->type) {
340 case NFT_REJECT_ICMP_UNREACH:
341 case NFT_REJECT_ICMPX_UNREACH:
342 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
343 return -EINVAL;
344
345 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
346 if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
347 icmp_code > NFT_REJECT_ICMPX_MAX)
348 return -EINVAL;
349
350 priv->icmp_code = icmp_code;
351 break;
352 case NFT_REJECT_TCP_RST:
353 break;
354 default:
355 return -EINVAL;
356 }
357 return 0;
358}
359
360static int nft_reject_bridge_dump(struct sk_buff *skb,
361 const struct nft_expr *expr)
362{
363 const struct nft_reject *priv = nft_expr_priv(expr);
364
365 if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
366 goto nla_put_failure;
367
368 switch (priv->type) {
369 case NFT_REJECT_ICMP_UNREACH:
370 case NFT_REJECT_ICMPX_UNREACH:
371 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
372 goto nla_put_failure;
373 break;
374 default:
375 break;
376 }
377
378 return 0;
379
380nla_put_failure:
381 return -1;
382}
383
384static struct nft_expr_type nft_reject_bridge_type;
385static const struct nft_expr_ops nft_reject_bridge_ops = {
386 .type = &nft_reject_bridge_type,
387 .size = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
388 .eval = nft_reject_bridge_eval,
389 .init = nft_reject_bridge_init,
390 .dump = nft_reject_bridge_dump,
391 .validate = nft_reject_bridge_validate,
392};
393
394static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
395 .family = NFPROTO_BRIDGE,
396 .name = "reject",
397 .ops = &nft_reject_bridge_ops,
398 .policy = nft_reject_policy,
399 .maxattr = NFTA_REJECT_MAX,
400 .owner = THIS_MODULE,
401};
402
403static int __init nft_reject_bridge_module_init(void)
404{
405 return nft_register_expr(&nft_reject_bridge_type);
406}
407
408static void __exit nft_reject_bridge_module_exit(void)
409{
410 nft_unregister_expr(&nft_reject_bridge_type);
411}
412
413module_init(nft_reject_bridge_module_init);
414module_exit(nft_reject_bridge_module_exit);
415
416MODULE_LICENSE("GPL");
417MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
418MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");
419
