1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * Copyright (c) 2013 Eric Leblond <eric@regit.org> 5 * 6 * Development of this code funded by Astaro AG (http://www.astaro.com/) 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/init.h> 11 #include <linux/module.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nft_reject.h> 17 #include <linux/icmp.h> 18 #include <linux/icmpv6.h> 19 20 const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { 21 [NFTA_REJECT_TYPE] = { .type = NLA_U32 }, 22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 }, 23 }; 24 EXPORT_SYMBOL_GPL(nft_reject_policy); 25 26 int nft_reject_validate(const struct nft_ctx *ctx, 27 const struct nft_expr *expr, 28 const struct nft_data **data) 29 { 30 return nft_chain_validate_hooks(ctx->chain, 31 (1 << NF_INET_LOCAL_IN) | 32 (1 << NF_INET_FORWARD) | 33 (1 << NF_INET_LOCAL_OUT) | 34 (1 << NF_INET_PRE_ROUTING)); 35 } 36 EXPORT_SYMBOL_GPL(nft_reject_validate); 37 38 int nft_reject_init(const struct nft_ctx *ctx, 39 const struct nft_expr *expr, 40 const struct nlattr * const tb[]) 41 { 42 struct nft_reject *priv = nft_expr_priv(expr); 43 int icmp_code; 44 45 if (tb[NFTA_REJECT_TYPE] == NULL) 46 return -EINVAL; 47 48 priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE])); 49 switch (priv->type) { 50 case NFT_REJECT_ICMP_UNREACH: 51 case NFT_REJECT_ICMPX_UNREACH: 52 if (tb[NFTA_REJECT_ICMP_CODE] == NULL) 53 return -EINVAL; 54 55 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]); 56 if (priv->type == NFT_REJECT_ICMPX_UNREACH && 57 icmp_code > NFT_REJECT_ICMPX_MAX) 58 return -EINVAL; 59 60 priv->icmp_code = icmp_code; 61 break; 62 case NFT_REJECT_TCP_RST: 63 break; 64 default: 65 return -EINVAL; 66 } 67 68 return 0; 69 } 70 EXPORT_SYMBOL_GPL(nft_reject_init); 71 72 int nft_reject_dump(struct sk_buff *skb, 73 const struct nft_expr *expr, bool reset) 74 { 75 const struct nft_reject *priv = nft_expr_priv(expr); 76 77 if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type))) 78 goto nla_put_failure; 79 80 switch (priv->type) { 81 case NFT_REJECT_ICMP_UNREACH: 82 case NFT_REJECT_ICMPX_UNREACH: 83 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code)) 84 goto nla_put_failure; 85 break; 86 default: 87 break; 88 } 89 90 return 0; 91 92 nla_put_failure: 93 return -1; 94 } 95 EXPORT_SYMBOL_GPL(nft_reject_dump); 96 97 static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = { 98 [NFT_REJECT_ICMPX_NO_ROUTE] = ICMP_NET_UNREACH, 99 [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMP_PORT_UNREACH, 100 [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMP_HOST_UNREACH, 101 [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMP_PKT_FILTERED, 102 }; 103 104 int nft_reject_icmp_code(u8 code) 105 { 106 if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) 107 return ICMP_NET_UNREACH; 108 109 return icmp_code_v4[code]; 110 } 111 112 EXPORT_SYMBOL_GPL(nft_reject_icmp_code); 113 114 115 static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = { 116 [NFT_REJECT_ICMPX_NO_ROUTE] = ICMPV6_NOROUTE, 117 [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMPV6_PORT_UNREACH, 118 [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMPV6_ADDR_UNREACH, 119 [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMPV6_ADM_PROHIBITED, 120 }; 121 122 int nft_reject_icmpv6_code(u8 code) 123 { 124 if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) 125 return ICMPV6_NOROUTE; 126 127 return icmp_code_v6[code]; 128 } 129 130 EXPORT_SYMBOL_GPL(nft_reject_icmpv6_code); 131 132 MODULE_LICENSE("GPL"); 133 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 134 MODULE_DESCRIPTION("Netfilter x_tables over nftables module"); 135