1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * Copyright (c) 2013 Eric Leblond <eric@regit.org> 5 * 6 * Development of this code funded by Astaro AG (http://www.astaro.com/) 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/init.h> 11 #include <linux/module.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nft_reject.h> 17 #include <linux/icmp.h> 18 #include <linux/icmpv6.h> 19 20 const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { 21 [NFTA_REJECT_TYPE] = { .type = NLA_U32 }, 22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 }, 23 }; 24 EXPORT_SYMBOL_GPL(nft_reject_policy); 25 26 int nft_reject_validate(const struct nft_ctx *ctx, 27 const struct nft_expr *expr, 28 const struct nft_data **data) 29 { 30 return nft_chain_validate_hooks(ctx->chain, 31 (1 << NF_INET_LOCAL_IN) | 32 (1 << NF_INET_FORWARD) | 33 (1 << NF_INET_LOCAL_OUT) | 34 (1 << NF_INET_PRE_ROUTING)); 35 } 36 EXPORT_SYMBOL_GPL(nft_reject_validate); 37 38 int nft_reject_init(const struct nft_ctx *ctx, 39 const struct nft_expr *expr, 40 const struct nlattr * const tb[]) 41 { 42 struct nft_reject *priv = nft_expr_priv(expr); 43 44 if (tb[NFTA_REJECT_TYPE] == NULL) 45 return -EINVAL; 46 47 priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE])); 48 switch (priv->type) { 49 case NFT_REJECT_ICMP_UNREACH: 50 if (tb[NFTA_REJECT_ICMP_CODE] == NULL) 51 return -EINVAL; 52 priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]); 53 case NFT_REJECT_TCP_RST: 54 break; 55 default: 56 return -EINVAL; 57 } 58 59 return 0; 60 } 61 EXPORT_SYMBOL_GPL(nft_reject_init); 62 63 int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr) 64 { 65 const struct nft_reject *priv = nft_expr_priv(expr); 66 67 if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type))) 68 goto nla_put_failure; 69 70 switch (priv->type) { 71 case NFT_REJECT_ICMP_UNREACH: 72 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code)) 73 goto nla_put_failure; 74 break; 75 default: 76 break; 77 } 78 79 return 0; 80 81 nla_put_failure: 82 return -1; 83 } 84 EXPORT_SYMBOL_GPL(nft_reject_dump); 85 86 static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = { 87 [NFT_REJECT_ICMPX_NO_ROUTE] = ICMP_NET_UNREACH, 88 [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMP_PORT_UNREACH, 89 [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMP_HOST_UNREACH, 90 [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMP_PKT_FILTERED, 91 }; 92 93 int nft_reject_icmp_code(u8 code) 94 { 95 if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) 96 return ICMP_NET_UNREACH; 97 98 return icmp_code_v4[code]; 99 } 100 101 EXPORT_SYMBOL_GPL(nft_reject_icmp_code); 102 103 104 static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = { 105 [NFT_REJECT_ICMPX_NO_ROUTE] = ICMPV6_NOROUTE, 106 [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMPV6_PORT_UNREACH, 107 [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMPV6_ADDR_UNREACH, 108 [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMPV6_ADM_PROHIBITED, 109 }; 110 111 int nft_reject_icmpv6_code(u8 code) 112 { 113 if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) 114 return ICMPV6_NOROUTE; 115 116 return icmp_code_v6[code]; 117 } 118 119 EXPORT_SYMBOL_GPL(nft_reject_icmpv6_code); 120 121 MODULE_LICENSE("GPL"); 122 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 123 MODULE_DESCRIPTION("Netfilter x_tables over nftables module"); 124