Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
[sfrench/cifs-2.6.git] / net / bridge / netfilter / nft_reject_bridge.c
1 /*
2  * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nft_reject.h>
17 #include <net/netfilter/ipv4/nf_reject.h>
18 #include <net/netfilter/ipv6/nf_reject.h>
19 #include <linux/ip.h>
20 #include <net/ip.h>
21 #include <linux/netfilter_bridge.h>
22 #include "../br_private.h"
23
24 static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
25                                         struct sk_buff *nskb)
26 {
27         struct ethhdr *eth;
28
29         eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
30         skb_reset_mac_header(nskb);
31         ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
32         ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
33         eth->h_proto = eth_hdr(oldskb)->h_proto;
34         skb_pull(nskb, ETH_HLEN);
35 }
36
37 static int nft_reject_iphdr_validate(struct sk_buff *oldskb)
38 {
39         struct iphdr *iph;
40         u32 len;
41
42         if (!pskb_may_pull(oldskb, sizeof(struct iphdr)))
43                 return 0;
44
45         iph = ip_hdr(oldskb);
46         if (iph->ihl < 5 || iph->version != 4)
47                 return 0;
48
49         len = ntohs(iph->tot_len);
50         if (oldskb->len < len)
51                 return 0;
52         else if (len < (iph->ihl*4))
53                 return 0;
54
55         if (!pskb_may_pull(oldskb, iph->ihl*4))
56                 return 0;
57
58         return 1;
59 }
60
61 static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb, int hook)
62 {
63         struct sk_buff *nskb;
64         struct iphdr *niph;
65         const struct tcphdr *oth;
66         struct tcphdr _oth;
67
68         if (!nft_reject_iphdr_validate(oldskb))
69                 return;
70
71         oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
72         if (!oth)
73                 return;
74
75         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
76                          LL_MAX_HEADER, GFP_ATOMIC);
77         if (!nskb)
78                 return;
79
80         skb_reserve(nskb, LL_MAX_HEADER);
81         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
82                                    sysctl_ip_default_ttl);
83         nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
84         niph->ttl       = sysctl_ip_default_ttl;
85         niph->tot_len   = htons(nskb->len);
86         ip_send_check(niph);
87
88         nft_reject_br_push_etherhdr(oldskb, nskb);
89
90         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
91 }
92
93 static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb, int hook,
94                                           u8 code)
95 {
96         struct sk_buff *nskb;
97         struct iphdr *niph;
98         struct icmphdr *icmph;
99         unsigned int len;
100         void *payload;
101         __wsum csum;
102
103         if (!nft_reject_iphdr_validate(oldskb))
104                 return;
105
106         /* IP header checks: fragment. */
107         if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
108                 return;
109
110         /* RFC says return as much as we can without exceeding 576 bytes. */
111         len = min_t(unsigned int, 536, oldskb->len);
112
113         if (!pskb_may_pull(oldskb, len))
114                 return;
115
116         if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), 0))
117                 return;
118
119         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
120                          LL_MAX_HEADER + len, GFP_ATOMIC);
121         if (!nskb)
122                 return;
123
124         skb_reserve(nskb, LL_MAX_HEADER);
125         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
126                                    sysctl_ip_default_ttl);
127
128         skb_reset_transport_header(nskb);
129         icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
130         memset(icmph, 0, sizeof(*icmph));
131         icmph->type     = ICMP_DEST_UNREACH;
132         icmph->code     = code;
133
134         payload = skb_put(nskb, len);
135         memcpy(payload, skb_network_header(oldskb), len);
136
137         csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
138         icmph->checksum = csum_fold(csum);
139
140         niph->tot_len   = htons(nskb->len);
141         ip_send_check(niph);
142
143         nft_reject_br_push_etherhdr(oldskb, nskb);
144
145         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
146 }
147
148 static int nft_reject_ip6hdr_validate(struct sk_buff *oldskb)
149 {
150         struct ipv6hdr *hdr;
151         u32 pkt_len;
152
153         if (!pskb_may_pull(oldskb, sizeof(struct ipv6hdr)))
154                 return 0;
155
156         hdr = ipv6_hdr(oldskb);
157         if (hdr->version != 6)
158                 return 0;
159
160         pkt_len = ntohs(hdr->payload_len);
161         if (pkt_len + sizeof(struct ipv6hdr) > oldskb->len)
162                 return 0;
163
164         return 1;
165 }
166
167 static void nft_reject_br_send_v6_tcp_reset(struct net *net,
168                                             struct sk_buff *oldskb, int hook)
169 {
170         struct sk_buff *nskb;
171         const struct tcphdr *oth;
172         struct tcphdr _oth;
173         unsigned int otcplen;
174         struct ipv6hdr *nip6h;
175
176         if (!nft_reject_ip6hdr_validate(oldskb))
177                 return;
178
179         oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
180         if (!oth)
181                 return;
182
183         nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
184                          LL_MAX_HEADER, GFP_ATOMIC);
185         if (!nskb)
186                 return;
187
188         skb_reserve(nskb, LL_MAX_HEADER);
189         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
190                                      net->ipv6.devconf_all->hop_limit);
191         nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
192         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
193
194         nft_reject_br_push_etherhdr(oldskb, nskb);
195
196         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
197 }
198
199 static void nft_reject_br_send_v6_unreach(struct net *net,
200                                           struct sk_buff *oldskb, int hook,
201                                           u8 code)
202 {
203         struct sk_buff *nskb;
204         struct ipv6hdr *nip6h;
205         struct icmp6hdr *icmp6h;
206         unsigned int len;
207         void *payload;
208
209         if (!nft_reject_ip6hdr_validate(oldskb))
210                 return;
211
212         /* Include "As much of invoking packet as possible without the ICMPv6
213          * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
214          */
215         len = min_t(unsigned int, 1220, oldskb->len);
216
217         if (!pskb_may_pull(oldskb, len))
218                 return;
219
220         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
221                          LL_MAX_HEADER + len, GFP_ATOMIC);
222         if (!nskb)
223                 return;
224
225         skb_reserve(nskb, LL_MAX_HEADER);
226         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
227                                      net->ipv6.devconf_all->hop_limit);
228
229         skb_reset_transport_header(nskb);
230         icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
231         memset(icmp6h, 0, sizeof(*icmp6h));
232         icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
233         icmp6h->icmp6_code = code;
234
235         payload = skb_put(nskb, len);
236         memcpy(payload, skb_network_header(oldskb), len);
237         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
238
239         icmp6h->icmp6_cksum =
240                 csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
241                                 nskb->len - sizeof(struct ipv6hdr),
242                                 IPPROTO_ICMPV6,
243                                 csum_partial(icmp6h,
244                                              nskb->len - sizeof(struct ipv6hdr),
245                                              0));
246
247         nft_reject_br_push_etherhdr(oldskb, nskb);
248
249         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
250 }
251
252 static void nft_reject_bridge_eval(const struct nft_expr *expr,
253                                  struct nft_data data[NFT_REG_MAX + 1],
254                                  const struct nft_pktinfo *pkt)
255 {
256         struct nft_reject *priv = nft_expr_priv(expr);
257         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
258         const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
259
260         if (is_broadcast_ether_addr(dest) ||
261             is_multicast_ether_addr(dest))
262                 goto out;
263
264         switch (eth_hdr(pkt->skb)->h_proto) {
265         case htons(ETH_P_IP):
266                 switch (priv->type) {
267                 case NFT_REJECT_ICMP_UNREACH:
268                         nft_reject_br_send_v4_unreach(pkt->skb,
269                                                       pkt->ops->hooknum,
270                                                       priv->icmp_code);
271                         break;
272                 case NFT_REJECT_TCP_RST:
273                         nft_reject_br_send_v4_tcp_reset(pkt->skb,
274                                                         pkt->ops->hooknum);
275                         break;
276                 case NFT_REJECT_ICMPX_UNREACH:
277                         nft_reject_br_send_v4_unreach(pkt->skb,
278                                                       pkt->ops->hooknum,
279                                                       nft_reject_icmp_code(priv->icmp_code));
280                         break;
281                 }
282                 break;
283         case htons(ETH_P_IPV6):
284                 switch (priv->type) {
285                 case NFT_REJECT_ICMP_UNREACH:
286                         nft_reject_br_send_v6_unreach(net, pkt->skb,
287                                                       pkt->ops->hooknum,
288                                                       priv->icmp_code);
289                         break;
290                 case NFT_REJECT_TCP_RST:
291                         nft_reject_br_send_v6_tcp_reset(net, pkt->skb,
292                                                         pkt->ops->hooknum);
293                         break;
294                 case NFT_REJECT_ICMPX_UNREACH:
295                         nft_reject_br_send_v6_unreach(net, pkt->skb,
296                                                       pkt->ops->hooknum,
297                                                       nft_reject_icmpv6_code(priv->icmp_code));
298                         break;
299                 }
300                 break;
301         default:
302                 /* No explicit way to reject this protocol, drop it. */
303                 break;
304         }
305 out:
306         data[NFT_REG_VERDICT].verdict = NF_DROP;
307 }
308
309 static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
310 {
311         struct nft_base_chain *basechain;
312
313         if (chain->flags & NFT_BASE_CHAIN) {
314                 basechain = nft_base_chain(chain);
315
316                 switch (basechain->ops[0].hooknum) {
317                 case NF_BR_PRE_ROUTING:
318                 case NF_BR_LOCAL_IN:
319                         break;
320                 default:
321                         return -EOPNOTSUPP;
322                 }
323         }
324         return 0;
325 }
326
327 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
328                                   const struct nft_expr *expr,
329                                   const struct nlattr * const tb[])
330 {
331         struct nft_reject *priv = nft_expr_priv(expr);
332         int icmp_code, err;
333
334         err = nft_reject_bridge_validate_hooks(ctx->chain);
335         if (err < 0)
336                 return err;
337
338         if (tb[NFTA_REJECT_TYPE] == NULL)
339                 return -EINVAL;
340
341         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
342         switch (priv->type) {
343         case NFT_REJECT_ICMP_UNREACH:
344         case NFT_REJECT_ICMPX_UNREACH:
345                 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
346                         return -EINVAL;
347
348                 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
349                 if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
350                     icmp_code > NFT_REJECT_ICMPX_MAX)
351                         return -EINVAL;
352
353                 priv->icmp_code = icmp_code;
354                 break;
355         case NFT_REJECT_TCP_RST:
356                 break;
357         default:
358                 return -EINVAL;
359         }
360         return 0;
361 }
362
363 static int nft_reject_bridge_dump(struct sk_buff *skb,
364                                   const struct nft_expr *expr)
365 {
366         const struct nft_reject *priv = nft_expr_priv(expr);
367
368         if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
369                 goto nla_put_failure;
370
371         switch (priv->type) {
372         case NFT_REJECT_ICMP_UNREACH:
373         case NFT_REJECT_ICMPX_UNREACH:
374                 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
375                         goto nla_put_failure;
376                 break;
377         }
378
379         return 0;
380
381 nla_put_failure:
382         return -1;
383 }
384
385 static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
386                                       const struct nft_expr *expr,
387                                       const struct nft_data **data)
388 {
389         return nft_reject_bridge_validate_hooks(ctx->chain);
390 }
391
392 static struct nft_expr_type nft_reject_bridge_type;
393 static const struct nft_expr_ops nft_reject_bridge_ops = {
394         .type           = &nft_reject_bridge_type,
395         .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
396         .eval           = nft_reject_bridge_eval,
397         .init           = nft_reject_bridge_init,
398         .dump           = nft_reject_bridge_dump,
399         .validate       = nft_reject_bridge_validate,
400 };
401
402 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
403         .family         = NFPROTO_BRIDGE,
404         .name           = "reject",
405         .ops            = &nft_reject_bridge_ops,
406         .policy         = nft_reject_policy,
407         .maxattr        = NFTA_REJECT_MAX,
408         .owner          = THIS_MODULE,
409 };
410
411 static int __init nft_reject_bridge_module_init(void)
412 {
413         return nft_register_expr(&nft_reject_bridge_type);
414 }
415
416 static void __exit nft_reject_bridge_module_exit(void)
417 {
418         nft_unregister_expr(&nft_reject_bridge_type);
419 }
420
421 module_init(nft_reject_bridge_module_init);
422 module_exit(nft_reject_bridge_module_exit);
423
424 MODULE_LICENSE("GPL");
425 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
426 MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");