1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * Copyright (c) 2013 Eric Leblond <eric@regit.org> 5 * 6 * Development of this code funded by Astaro AG (http://www.astaro.com/) 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/init.h> 11 #include <linux/module.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nft_reject.h> 17 #include <linux/icmp.h> 18 #include <linux/icmpv6.h> 19 20 const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { 21 [NFTA_REJECT_TYPE] = { .type = NLA_U32 }, 22 [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 }, 23 }; 24 EXPORT_SYMBOL_GPL(nft_reject_policy); 25 26 int nft_reject_validate(const struct nft_ctx *ctx, 27 const struct nft_expr *expr, 28 const struct nft_data **data) 29 { 30 return nft_chain_validate_hooks(ctx->chain, 31 (1 << NF_INET_LOCAL_IN) | 32 (1 << NF_INET_FORWARD) | 33 (1 << NF_INET_LOCAL_OUT)); 34 } 35 EXPORT_SYMBOL_GPL(nft_reject_validate); 36 37 int nft_reject_init(const struct nft_ctx *ctx, 38 const struct nft_expr *expr, 39 const struct nlattr * const tb[]) 40 { 41 struct nft_reject *priv = nft_expr_priv(expr); 42 43 if (tb[NFTA_REJECT_TYPE] == NULL) 44 return -EINVAL; 45 46 priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE])); 47 switch (priv->type) { 48 case NFT_REJECT_ICMP_UNREACH: 49 if (tb[NFTA_REJECT_ICMP_CODE] == NULL) 50 return -EINVAL; 51 priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]); 52 case NFT_REJECT_TCP_RST: 53 break; 54 default: 55 return -EINVAL; 56 } 57 58 return 0; 59 } 60 EXPORT_SYMBOL_GPL(nft_reject_init); 61 62 int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr) 63 { 64 const struct nft_reject *priv = nft_expr_priv(expr); 65 66 if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type))) 67 goto nla_put_failure; 68 69 switch (priv->type) { 70 case NFT_REJECT_ICMP_UNREACH: 71 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code)) 72 goto nla_put_failure; 73 break; 74 default: 75 break; 76 } 77 78 return 0; 79 80 nla_put_failure: 81 return -1; 82 } 83 EXPORT_SYMBOL_GPL(nft_reject_dump); 84 85 static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = { 86 [NFT_REJECT_ICMPX_NO_ROUTE] = ICMP_NET_UNREACH, 87 [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMP_PORT_UNREACH, 88 [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMP_HOST_UNREACH, 89 [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMP_PKT_FILTERED, 90 }; 91 92 int nft_reject_icmp_code(u8 code) 93 { 94 if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) 95 return ICMP_NET_UNREACH; 96 97 return icmp_code_v4[code]; 98 } 99 100 EXPORT_SYMBOL_GPL(nft_reject_icmp_code); 101 102 103 static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = { 104 [NFT_REJECT_ICMPX_NO_ROUTE] = ICMPV6_NOROUTE, 105 [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMPV6_PORT_UNREACH, 106 [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMPV6_ADDR_UNREACH, 107 [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMPV6_ADM_PROHIBITED, 108 }; 109 110 int nft_reject_icmpv6_code(u8 code) 111 { 112 if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) 113 return ICMPV6_NOROUTE; 114 115 return icmp_code_v6[code]; 116 } 117 118 EXPORT_SYMBOL_GPL(nft_reject_icmpv6_code); 119 120 MODULE_LICENSE("GPL"); 121 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 122