drivers/net: macvtap and tun depend on INET
[sfrench/cifs-2.6.git] / net / bridge / netfilter / nft_reject_bridge.c
1 /*
2  * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nft_reject.h>
17 #include <net/netfilter/ipv4/nf_reject.h>
18 #include <net/netfilter/ipv6/nf_reject.h>
19
20 static void nft_reject_bridge_eval(const struct nft_expr *expr,
21                                  struct nft_data data[NFT_REG_MAX + 1],
22                                  const struct nft_pktinfo *pkt)
23 {
24         struct nft_reject *priv = nft_expr_priv(expr);
25         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
26
27         switch (eth_hdr(pkt->skb)->h_proto) {
28         case htons(ETH_P_IP):
29                 switch (priv->type) {
30                 case NFT_REJECT_ICMP_UNREACH:
31                         nf_send_unreach(pkt->skb, priv->icmp_code);
32                         break;
33                 case NFT_REJECT_TCP_RST:
34                         nf_send_reset(pkt->skb, pkt->ops->hooknum);
35                         break;
36                 case NFT_REJECT_ICMPX_UNREACH:
37                         nf_send_unreach(pkt->skb,
38                                         nft_reject_icmp_code(priv->icmp_code));
39                         break;
40                 }
41                 break;
42         case htons(ETH_P_IPV6):
43                 switch (priv->type) {
44                 case NFT_REJECT_ICMP_UNREACH:
45                         nf_send_unreach6(net, pkt->skb, priv->icmp_code,
46                                          pkt->ops->hooknum);
47                         break;
48                 case NFT_REJECT_TCP_RST:
49                         nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
50                         break;
51                 case NFT_REJECT_ICMPX_UNREACH:
52                         nf_send_unreach6(net, pkt->skb,
53                                          nft_reject_icmpv6_code(priv->icmp_code),
54                                          pkt->ops->hooknum);
55                         break;
56                 }
57                 break;
58         default:
59                 /* No explicit way to reject this protocol, drop it. */
60                 break;
61         }
62         data[NFT_REG_VERDICT].verdict = NF_DROP;
63 }
64
65 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
66                                   const struct nft_expr *expr,
67                                   const struct nlattr * const tb[])
68 {
69         struct nft_reject *priv = nft_expr_priv(expr);
70         int icmp_code;
71
72         if (tb[NFTA_REJECT_TYPE] == NULL)
73                 return -EINVAL;
74
75         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
76         switch (priv->type) {
77         case NFT_REJECT_ICMP_UNREACH:
78         case NFT_REJECT_ICMPX_UNREACH:
79                 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
80                         return -EINVAL;
81
82                 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
83                 if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
84                     icmp_code > NFT_REJECT_ICMPX_MAX)
85                         return -EINVAL;
86
87                 priv->icmp_code = icmp_code;
88                 break;
89         case NFT_REJECT_TCP_RST:
90                 break;
91         default:
92                 return -EINVAL;
93         }
94         return 0;
95 }
96
97 static int nft_reject_bridge_dump(struct sk_buff *skb,
98                                   const struct nft_expr *expr)
99 {
100         const struct nft_reject *priv = nft_expr_priv(expr);
101
102         if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
103                 goto nla_put_failure;
104
105         switch (priv->type) {
106         case NFT_REJECT_ICMP_UNREACH:
107         case NFT_REJECT_ICMPX_UNREACH:
108                 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
109                         goto nla_put_failure;
110                 break;
111         }
112
113         return 0;
114
115 nla_put_failure:
116         return -1;
117 }
118
119 static struct nft_expr_type nft_reject_bridge_type;
120 static const struct nft_expr_ops nft_reject_bridge_ops = {
121         .type           = &nft_reject_bridge_type,
122         .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
123         .eval           = nft_reject_bridge_eval,
124         .init           = nft_reject_bridge_init,
125         .dump           = nft_reject_bridge_dump,
126 };
127
128 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
129         .family         = NFPROTO_BRIDGE,
130         .name           = "reject",
131         .ops            = &nft_reject_bridge_ops,
132         .policy         = nft_reject_policy,
133         .maxattr        = NFTA_REJECT_MAX,
134         .owner          = THIS_MODULE,
135 };
136
137 static int __init nft_reject_bridge_module_init(void)
138 {
139         return nft_register_expr(&nft_reject_bridge_type);
140 }
141
142 static void __exit nft_reject_bridge_module_exit(void)
143 {
144         nft_unregister_expr(&nft_reject_bridge_type);
145 }
146
147 module_init(nft_reject_bridge_module_init);
148 module_exit(nft_reject_bridge_module_exit);
149
150 MODULE_LICENSE("GPL");
151 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
152 MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");