Blame view
net/netfilter/nft_reject_inet.c
3.6 KB
d2912cb15
|
1 |
// SPDX-License-Identifier: GPL-2.0-only |
05513e9e3
|
2 3 |
/* * Copyright (c) 2014 Patrick McHardy <kaber@trash.net> |
05513e9e3
|
4 5 6 7 8 9 10 11 12 13 |
*/ #include <linux/kernel.h> #include <linux/init.h> #include <linux/module.h> #include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h> #include <net/netfilter/nft_reject.h> |
51b0a5d8c
|
14 15 |
#include <net/netfilter/ipv4/nf_reject.h> #include <net/netfilter/ipv6/nf_reject.h> |
05513e9e3
|
16 17 |
static void nft_reject_inet_eval(const struct nft_expr *expr, |
a55e22e92
|
18 |
struct nft_regs *regs, |
05513e9e3
|
19 20 |
const struct nft_pktinfo *pkt) { |
51b0a5d8c
|
21 |
struct nft_reject *priv = nft_expr_priv(expr); |
51b0a5d8c
|
22 |
|
0e5a1c7eb
|
23 |
switch (nft_pf(pkt)) { |
05513e9e3
|
24 |
case NFPROTO_IPV4: |
51b0a5d8c
|
25 26 |
switch (priv->type) { case NFT_REJECT_ICMP_UNREACH: |
ee586bbc2
|
27 |
nf_send_unreach(pkt->skb, priv->icmp_code, |
0e5a1c7eb
|
28 |
nft_hook(pkt)); |
51b0a5d8c
|
29 30 |
break; case NFT_REJECT_TCP_RST: |
0e5a1c7eb
|
31 |
nf_send_reset(nft_net(pkt), pkt->skb, nft_hook(pkt)); |
51b0a5d8c
|
32 33 34 |
break; case NFT_REJECT_ICMPX_UNREACH: nf_send_unreach(pkt->skb, |
ee586bbc2
|
35 |
nft_reject_icmp_code(priv->icmp_code), |
0e5a1c7eb
|
36 |
nft_hook(pkt)); |
51b0a5d8c
|
37 38 39 |
break; } break; |
05513e9e3
|
40 |
case NFPROTO_IPV6: |
51b0a5d8c
|
41 42 |
switch (priv->type) { case NFT_REJECT_ICMP_UNREACH: |
0e5a1c7eb
|
43 44 |
nf_send_unreach6(nft_net(pkt), pkt->skb, priv->icmp_code, nft_hook(pkt)); |
51b0a5d8c
|
45 46 |
break; case NFT_REJECT_TCP_RST: |
0e5a1c7eb
|
47 |
nf_send_reset6(nft_net(pkt), pkt->skb, nft_hook(pkt)); |
51b0a5d8c
|
48 49 |
break; case NFT_REJECT_ICMPX_UNREACH: |
0e5a1c7eb
|
50 |
nf_send_unreach6(nft_net(pkt), pkt->skb, |
51b0a5d8c
|
51 |
nft_reject_icmpv6_code(priv->icmp_code), |
0e5a1c7eb
|
52 |
nft_hook(pkt)); |
51b0a5d8c
|
53 54 55 56 |
break; } break; } |
a55e22e92
|
57 58 |
regs->verdict.code = NF_DROP; |
51b0a5d8c
|
59 60 61 62 63 64 65 |
} static int nft_reject_inet_init(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nlattr * const tb[]) { struct nft_reject *priv = nft_expr_priv(expr); |
c56e3956c
|
66 |
int icmp_code; |
51b0a5d8c
|
67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
if (tb[NFTA_REJECT_TYPE] == NULL) return -EINVAL; priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE])); switch (priv->type) { case NFT_REJECT_ICMP_UNREACH: case NFT_REJECT_ICMPX_UNREACH: if (tb[NFTA_REJECT_ICMP_CODE] == NULL) return -EINVAL; icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]); if (priv->type == NFT_REJECT_ICMPX_UNREACH && icmp_code > NFT_REJECT_ICMPX_MAX) return -EINVAL; priv->icmp_code = icmp_code; break; case NFT_REJECT_TCP_RST: break; default: return -EINVAL; |
05513e9e3
|
89 |
} |
51b0a5d8c
|
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 |
return 0; } static int nft_reject_inet_dump(struct sk_buff *skb, const struct nft_expr *expr) { const struct nft_reject *priv = nft_expr_priv(expr); if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type))) goto nla_put_failure; switch (priv->type) { case NFT_REJECT_ICMP_UNREACH: case NFT_REJECT_ICMPX_UNREACH: if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code)) goto nla_put_failure; break; |
129d23a56
|
107 108 |
default: break; |
51b0a5d8c
|
109 110 111 112 113 114 |
} return 0; nla_put_failure: return -1; |
05513e9e3
|
115 116 117 118 119 120 121 |
} static struct nft_expr_type nft_reject_inet_type; static const struct nft_expr_ops nft_reject_inet_ops = { .type = &nft_reject_inet_type, .size = NFT_EXPR_SIZE(sizeof(struct nft_reject)), .eval = nft_reject_inet_eval, |
51b0a5d8c
|
122 123 |
.init = nft_reject_inet_init, .dump = nft_reject_inet_dump, |
89e1f6d2b
|
124 |
.validate = nft_reject_validate, |
05513e9e3
|
125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 |
}; static struct nft_expr_type nft_reject_inet_type __read_mostly = { .family = NFPROTO_INET, .name = "reject", .ops = &nft_reject_inet_ops, .policy = nft_reject_policy, .maxattr = NFTA_REJECT_MAX, .owner = THIS_MODULE, }; static int __init nft_reject_inet_module_init(void) { return nft_register_expr(&nft_reject_inet_type); } static void __exit nft_reject_inet_module_exit(void) { nft_unregister_expr(&nft_reject_inet_type); } module_init(nft_reject_inet_module_init); module_exit(nft_reject_inet_module_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); MODULE_ALIAS_NFT_AF_EXPR(1, "reject"); |