[linux-2.6-block.git] / net / bridge / netfilter / nft_reject_bridge.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nft_reject.h>
#include <net/netfilter/ipv4/nf_reject.h>
#include <net/netfilter/ipv6/nf_reject.h>
#include <linux/ip.h>
#include <net/ip.h>
#include <net/ip6_checksum.h>
#include <linux/netfilter_bridge.h>
#include <linux/netfilter_ipv6.h>
#include "../br_private.h"

static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
					struct sk_buff *nskb)
{
	struct ethhdr *eth;

	eth = skb_push(nskb, ETH_HLEN);
	skb_reset_mac_header(nskb);
	ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
	ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
	eth->h_proto = eth_hdr(oldskb)->h_proto;
	skb_pull(nskb, ETH_HLEN);
}

static int nft_bridge_iphdr_validate(struct sk_buff *skb)
{
	struct iphdr *iph;
	u32 len;

	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
		return 0;

	iph = ip_hdr(skb);
	if (iph->ihl < 5 || iph->version != 4)
		return 0;

	len = ntohs(iph->tot_len);
	if (skb->len < len)
		return 0;
	else if (len < (iph->ihl*4))
		return 0;

	if (!pskb_may_pull(skb, iph->ihl*4))
		return 0;

	return 1;
}

/* We cannot use oldskb->dev, it can be either bridge device (NF_BRIDGE INPUT)
 * or the bridge port (NF_BRIDGE PREROUTING).
 */
static void nft_reject_br_send_v4_tcp_reset(struct net *net,
					    struct sk_buff *oldskb,
					    const struct net_device *dev,
					    int hook)
{
	struct sk_buff *nskb;
	struct iphdr *niph;
	const struct tcphdr *oth;
	struct tcphdr _oth;

	if (!nft_bridge_iphdr_validate(oldskb))
		return;

	oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
	if (!oth)
		return;

	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
			 LL_MAX_HEADER, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
				   net->ipv4.sysctl_ip_default_ttl);
	nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
	niph->tot_len = htons(nskb->len);
	ip_send_check(niph);

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_forward(br_port_get_rcu(dev), nskb, false, true);
}

static void nft_reject_br_send_v4_unreach(struct net *net,
					  struct sk_buff *oldskb,
					  const struct net_device *dev,
					  int hook, u8 code)
{
	struct sk_buff *nskb;
	struct iphdr *niph;
	struct icmphdr *icmph;
	unsigned int len;
	__wsum csum;
	u8 proto;

	if (!nft_bridge_iphdr_validate(oldskb))
		return;

	/* IP header checks: fragment. */
	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
		return;

	/* RFC says return as much as we can without exceeding 576 bytes. */
	len = min_t(unsigned int, 536, oldskb->len);

	if (!pskb_may_pull(oldskb, len))
		return;

	if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))
		return;

	proto = ip_hdr(oldskb)->protocol;

	if (!skb_csum_unnecessary(oldskb) &&
	    nf_reject_verify_csum(proto) &&
	    nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))
		return;

	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
			 LL_MAX_HEADER + len, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
				   net->ipv4.sysctl_ip_default_ttl);

	skb_reset_transport_header(nskb);
	icmph = skb_put_zero(nskb, sizeof(struct icmphdr));
	icmph->type     = ICMP_DEST_UNREACH;
	icmph->code	= code;

	skb_put_data(nskb, skb_network_header(oldskb), len);

	csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
	icmph->checksum = csum_fold(csum);

	niph->tot_len	= htons(nskb->len);
	ip_send_check(niph);

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_forward(br_port_get_rcu(dev), nskb, false, true);
}

static int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
{
	struct ipv6hdr *hdr;
	u32 pkt_len;

	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
		return 0;

	hdr = ipv6_hdr(skb);
	if (hdr->version != 6)
		return 0;

	pkt_len = ntohs(hdr->payload_len);
	if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
		return 0;

	return 1;
}

static void nft_reject_br_send_v6_tcp_reset(struct net *net,
					    struct sk_buff *oldskb,
					    const struct net_device *dev,
					    int hook)
{
	struct sk_buff *nskb;
	const struct tcphdr *oth;
	struct tcphdr _oth;
	unsigned int otcplen;
	struct ipv6hdr *nip6h;

	if (!nft_bridge_ip6hdr_validate(oldskb))
		return;

	oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
	if (!oth)
		return;

	nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
			 LL_MAX_HEADER, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
				     net->ipv6.devconf_all->hop_limit);
	nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_forward(br_port_get_rcu(dev), nskb, false, true);
}

static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
{
	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
	int thoff;
	__be16 fo;
	u8 proto = ip6h->nexthdr;

	if (skb_csum_unnecessary(skb))
		return true;

	if (ip6h->payload_len &&
	    pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
		return false;

	ip6h = ipv6_hdr(skb);
	thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
	if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
		return false;

	if (!nf_reject_verify_csum(proto))
		return true;

	return nf_ip6_checksum(skb, hook, thoff, proto) == 0;
}

static void nft_reject_br_send_v6_unreach(struct net *net,
					  struct sk_buff *oldskb,
					  const struct net_device *dev,
					  int hook, u8 code)
{
	struct sk_buff *nskb;
	struct ipv6hdr *nip6h;
	struct icmp6hdr *icmp6h;
	unsigned int len;

	if (!nft_bridge_ip6hdr_validate(oldskb))
		return;

	/* Include "As much of invoking packet as possible without the ICMPv6
	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
	 */
	len = min_t(unsigned int, 1220, oldskb->len);

	if (!pskb_may_pull(oldskb, len))
		return;

	if (!reject6_br_csum_ok(oldskb, hook))
		return;

	nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
			 LL_MAX_HEADER + len, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
				     net->ipv6.devconf_all->hop_limit);

	skb_reset_transport_header(nskb);
	icmp6h = skb_put_zero(nskb, sizeof(struct icmp6hdr));
	icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
	icmp6h->icmp6_code = code;

	skb_put_data(nskb, skb_network_header(oldskb), len);
	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));

	icmp6h->icmp6_cksum =
		csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
				nskb->len - sizeof(struct ipv6hdr),
				IPPROTO_ICMPV6,
				csum_partial(icmp6h,
					     nskb->len - sizeof(struct ipv6hdr),
					     0));

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_forward(br_port_get_rcu(dev), nskb, false, true);
}

static void nft_reject_bridge_eval(const struct nft_expr *expr,
				   struct nft_regs *regs,
				   const struct nft_pktinfo *pkt)
{
	struct nft_reject *priv = nft_expr_priv(expr);
	const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;

	if (is_broadcast_ether_addr(dest) ||
	    is_multicast_ether_addr(dest))
		goto out;

	switch (eth_hdr(pkt->skb)->h_proto) {
	case htons(ETH_P_IP):
		switch (priv->type) {
		case NFT_REJECT_ICMP_UNREACH:
			nft_reject_br_send_v4_unreach(nft_net(pkt), pkt->skb,
						      nft_in(pkt),
						      nft_hook(pkt),
						      priv->icmp_code);
			break;
		case NFT_REJECT_TCP_RST:
			nft_reject_br_send_v4_tcp_reset(nft_net(pkt), pkt->skb,
							nft_in(pkt),
							nft_hook(pkt));
			break;
		case NFT_REJECT_ICMPX_UNREACH:
			nft_reject_br_send_v4_unreach(nft_net(pkt), pkt->skb,
						      nft_in(pkt),
						      nft_hook(pkt),
						      nft_reject_icmp_code(priv->icmp_code));
			break;
		}
		break;
	case htons(ETH_P_IPV6):
		switch (priv->type) {
		case NFT_REJECT_ICMP_UNREACH:
			nft_reject_br_send_v6_unreach(nft_net(pkt), pkt->skb,
						      nft_in(pkt),
						      nft_hook(pkt),
						      priv->icmp_code);
			break;
		case NFT_REJECT_TCP_RST:
			nft_reject_br_send_v6_tcp_reset(nft_net(pkt), pkt->skb,
							nft_in(pkt),
							nft_hook(pkt));
			break;
		case NFT_REJECT_ICMPX_UNREACH:
			nft_reject_br_send_v6_unreach(nft_net(pkt), pkt->skb,
						      nft_in(pkt),
						      nft_hook(pkt),
						      nft_reject_icmpv6_code(priv->icmp_code));
			break;
		}
		break;
	default:
		/* No explicit way to reject this protocol, drop it. */
		break;
	}
out:
	regs->verdict.code = NF_DROP;
}

static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
				      const struct nft_expr *expr,
				      const struct nft_data **data)
{
	return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
						    (1 << NF_BR_LOCAL_IN));
}

static int nft_reject_bridge_init(const struct nft_ctx *ctx,
				  const struct nft_expr *expr,
				  const struct nlattr * const tb[])
{
	struct nft_reject *priv = nft_expr_priv(expr);
	int icmp_code;

	if (tb[NFTA_REJECT_TYPE] == NULL)
		return -EINVAL;

	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
	switch (priv->type) {
	case NFT_REJECT_ICMP_UNREACH:
	case NFT_REJECT_ICMPX_UNREACH:
		if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
			return -EINVAL;

		icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
		if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
		    icmp_code > NFT_REJECT_ICMPX_MAX)
			return -EINVAL;

		priv->icmp_code = icmp_code;
		break;
	case NFT_REJECT_TCP_RST:
		break;
	default:
		return -EINVAL;
	}
	return 0;
}

static int nft_reject_bridge_dump(struct sk_buff *skb,
				  const struct nft_expr *expr)
{
	const struct nft_reject *priv = nft_expr_priv(expr);

	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
		goto nla_put_failure;

	switch (priv->type) {
	case NFT_REJECT_ICMP_UNREACH:
	case NFT_REJECT_ICMPX_UNREACH:
		if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
			goto nla_put_failure;
		break;
	default:
		break;
	}

	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_reject_bridge_type;
static const struct nft_expr_ops nft_reject_bridge_ops = {
	.type		= &nft_reject_bridge_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),
	.eval		= nft_reject_bridge_eval,
	.init		= nft_reject_bridge_init,
	.dump		= nft_reject_bridge_dump,
	.validate	= nft_reject_bridge_validate,
};

static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
	.family		= NFPROTO_BRIDGE,
	.name		= "reject",
	.ops		= &nft_reject_bridge_ops,
	.policy		= nft_reject_policy,
	.maxattr	= NFTA_REJECT_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_reject_bridge_module_init(void)
{
	return nft_register_expr(&nft_reject_bridge_type);
}

static void __exit nft_reject_bridge_module_exit(void)
{
	nft_unregister_expr(&nft_reject_bridge_type);
}

module_init(nft_reject_bridge_module_init);
module_exit(nft_reject_bridge_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
85f5b308 PNA	2	/*
85f5b308 PNA	3	* Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
85f5b308 PNA	4	*/
	5
	6	#include <linux/kernel.h>
	7	#include <linux/init.h>
	8	#include <linux/module.h>
	9	#include <linux/netlink.h>
	10	#include <linux/netfilter.h>
	11	#include <linux/netfilter/nf_tables.h>
	12	#include <net/netfilter/nf_tables.h>
	13	#include <net/netfilter/nft_reject.h>
51b0a5d8 PNA	14	#include <net/netfilter/ipv4/nf_reject.h>
51b0a5d8 PNA	15	#include <net/netfilter/ipv6/nf_reject.h>
523b929d PNA	16	#include <linux/ip.h>
523b929d PNA	17	#include <net/ip.h>
c1207c04	18	#include <net/ip6_checksum.h>
127917c2	19	#include <linux/netfilter_bridge.h>
72500bc1	20	#include <linux/netfilter_ipv6.h>
523b929d PNA	21	#include "../br_private.h"
	22
	23	static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
	24	struct sk_buff *nskb)
	25	{
	26	struct ethhdr *eth;
	27
d58ff351	28	eth = skb_push(nskb, ETH_HLEN);
523b929d PNA	29	skb_reset_mac_header(nskb);
	30	ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
	31	ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
	32	eth->h_proto = eth_hdr(oldskb)->h_proto;
	33	skb_pull(nskb, ETH_HLEN);
	34	}
	35
10151d7b PNA	36	static int nft_bridge_iphdr_validate(struct sk_buff *skb)
	37	{
	38	struct iphdr *iph;
	39	u32 len;
	40
	41	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
	42	return 0;
	43
	44	iph = ip_hdr(skb);
	45	if (iph->ihl < 5 \|\| iph->version != 4)
	46	return 0;
	47
	48	len = ntohs(iph->tot_len);
	49	if (skb->len < len)
	50	return 0;
	51	else if (len < (iph->ihl*4))
	52	return 0;
	53
	54	if (!pskb_may_pull(skb, iph->ihl*4))
	55	return 0;
	56
	57	return 1;
	58	}
	59
72500bc1 FW	60	/* We cannot use oldskb->dev, it can be either bridge device (NF_BRIDGE INPUT)
	61	* or the bridge port (NF_BRIDGE PREROUTING).
	62	*/
29421198 LZ	63	static void nft_reject_br_send_v4_tcp_reset(struct net *net,
29421198 LZ	64	struct sk_buff *oldskb,
72500bc1 FW	65	const struct net_device *dev,
72500bc1 FW	66	int hook)
523b929d PNA	67	{
	68	struct sk_buff *nskb;
	69	struct iphdr *niph;
	70	const struct tcphdr *oth;
	71	struct tcphdr _oth;
	72
68b0faa8	73	if (!nft_bridge_iphdr_validate(oldskb))
523b929d PNA	74	return;
	75
	76	oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
	77	if (!oth)
	78	return;
	79
	80	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
	81	LL_MAX_HEADER, GFP_ATOMIC);
	82	if (!nskb)
	83	return;
	84
	85	skb_reserve(nskb, LL_MAX_HEADER);
	86	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
fa50d974	87	net->ipv4.sysctl_ip_default_ttl);
523b929d	88	nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
6542df2f	89	niph->tot_len = htons(nskb->len);
523b929d PNA	90	ip_send_check(niph);
	91
	92	nft_reject_br_push_etherhdr(oldskb, nskb);
	93
37b090e6	94	br_forward(br_port_get_rcu(dev), nskb, false, true);
523b929d PNA	95	}
523b929d PNA	96
29421198 LZ	97	static void nft_reject_br_send_v4_unreach(struct net *net,
29421198 LZ	98	struct sk_buff *oldskb,
72500bc1 FW	99	const struct net_device *dev,
72500bc1 FW	100	int hook, u8 code)
523b929d PNA	101	{
	102	struct sk_buff *nskb;
	103	struct iphdr *niph;
	104	struct icmphdr *icmph;
	105	unsigned int len;
523b929d	106	__wsum csum;
72500bc1	107	u8 proto;
523b929d	108
219f1d79	109	if (!nft_bridge_iphdr_validate(oldskb))
523b929d PNA	110	return;
	111
	112	/* IP header checks: fragment. */
	113	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
	114	return;
	115
	116	/* RFC says return as much as we can without exceeding 576 bytes. */
	117	len = min_t(unsigned int, 536, oldskb->len);
	118
	119	if (!pskb_may_pull(oldskb, len))
	120	return;
	121
a03a8dbe	122	if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))
72500bc1 FW	123	return;
72500bc1 FW	124
7fc38225	125	proto = ip_hdr(oldskb)->protocol;
72500bc1 FW	126
72500bc1 FW	127	if (!skb_csum_unnecessary(oldskb) &&
7fc38225	128	nf_reject_verify_csum(proto) &&
72500bc1	129	nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))
523b929d PNA	130	return;
	131
	132	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
	133	LL_MAX_HEADER + len, GFP_ATOMIC);
	134	if (!nskb)
	135	return;
	136
	137	skb_reserve(nskb, LL_MAX_HEADER);
	138	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
fa50d974	139	net->ipv4.sysctl_ip_default_ttl);
523b929d PNA	140
523b929d PNA	141	skb_reset_transport_header(nskb);
b080db58	142	icmph = skb_put_zero(nskb, sizeof(struct icmphdr));
523b929d PNA	143	icmph->type = ICMP_DEST_UNREACH;
	144	icmph->code = code;
	145
b952f4df	146	skb_put_data(nskb, skb_network_header(oldskb), len);
523b929d PNA	147
	148	csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
	149	icmph->checksum = csum_fold(csum);
	150
	151	niph->tot_len = htons(nskb->len);
	152	ip_send_check(niph);
	153
	154	nft_reject_br_push_etherhdr(oldskb, nskb);
	155
37b090e6	156	br_forward(br_port_get_rcu(dev), nskb, false, true);
523b929d PNA	157	}
523b929d PNA	158
10151d7b PNA	159	static int nft_bridge_ip6hdr_validate(struct sk_buff *skb)
	160	{
	161	struct ipv6hdr *hdr;
	162	u32 pkt_len;
	163
	164	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
	165	return 0;
	166
	167	hdr = ipv6_hdr(skb);
	168	if (hdr->version != 6)
	169	return 0;
	170
	171	pkt_len = ntohs(hdr->payload_len);
	172	if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
	173	return 0;
	174
	175	return 1;
	176	}
	177
523b929d	178	static void nft_reject_br_send_v6_tcp_reset(struct net *net,
72500bc1 FW	179	struct sk_buff *oldskb,
	180	const struct net_device *dev,
	181	int hook)
523b929d PNA	182	{
	183	struct sk_buff *nskb;
	184	const struct tcphdr *oth;
	185	struct tcphdr _oth;
	186	unsigned int otcplen;
	187	struct ipv6hdr *nip6h;
	188
68b0faa8	189	if (!nft_bridge_ip6hdr_validate(oldskb))
523b929d PNA	190	return;
	191
	192	oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
	193	if (!oth)
	194	return;
	195
	196	nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
	197	LL_MAX_HEADER, GFP_ATOMIC);
	198	if (!nskb)
	199	return;
	200
	201	skb_reserve(nskb, LL_MAX_HEADER);
	202	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
	203	net->ipv6.devconf_all->hop_limit);
	204	nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
	205	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
	206
	207	nft_reject_br_push_etherhdr(oldskb, nskb);
	208
37b090e6	209	br_forward(br_port_get_rcu(dev), nskb, false, true);
72500bc1 FW	210	}
	211
	212	static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
	213	{
	214	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
	215	int thoff;
	216	__be16 fo;
	217	u8 proto = ip6h->nexthdr;
	218
72500bc1 FW	219	if (skb_csum_unnecessary(skb))
	220	return true;
	221
	222	if (ip6h->payload_len &&
	223	pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
	224	return false;
	225
6c57f045	226	ip6h = ipv6_hdr(skb);
72500bc1 FW	227	thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
	228	if (thoff < 0 \|\| thoff >= skb->len \|\| (fo & htons(~0x7)) != 0)
	229	return false;
	230
7fc38225 AN	231	if (!nf_reject_verify_csum(proto))
	232	return true;
	233
72500bc1	234	return nf_ip6_checksum(skb, hook, thoff, proto) == 0;
523b929d PNA	235	}
	236
	237	static void nft_reject_br_send_v6_unreach(struct net *net,
72500bc1 FW	238	struct sk_buff *oldskb,
	239	const struct net_device *dev,
	240	int hook, u8 code)
523b929d PNA	241	{
	242	struct sk_buff *nskb;
	243	struct ipv6hdr *nip6h;
	244	struct icmp6hdr *icmp6h;
	245	unsigned int len;
523b929d	246
68b0faa8	247	if (!nft_bridge_ip6hdr_validate(oldskb))
523b929d PNA	248	return;
	249
	250	/* Include "As much of invoking packet as possible without the ICMPv6
	251	* packet exceeding the minimum IPv6 MTU" in the ICMP payload.
	252	*/
	253	len = min_t(unsigned int, 1220, oldskb->len);
	254
	255	if (!pskb_may_pull(oldskb, len))
	256	return;
	257
72500bc1 FW	258	if (!reject6_br_csum_ok(oldskb, hook))
	259	return;
	260
0cafa392	261	nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
523b929d PNA	262	LL_MAX_HEADER + len, GFP_ATOMIC);
	263	if (!nskb)
	264	return;
	265
	266	skb_reserve(nskb, LL_MAX_HEADER);
	267	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
	268	net->ipv6.devconf_all->hop_limit);
	269
	270	skb_reset_transport_header(nskb);
b080db58	271	icmp6h = skb_put_zero(nskb, sizeof(struct icmp6hdr));
523b929d PNA	272	icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
	273	icmp6h->icmp6_code = code;
	274
b952f4df	275	skb_put_data(nskb, skb_network_header(oldskb), len);
523b929d PNA	276	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
	277
	278	icmp6h->icmp6_cksum =
	279	csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
	280	nskb->len - sizeof(struct ipv6hdr),
	281	IPPROTO_ICMPV6,
	282	csum_partial(icmp6h,
	283	nskb->len - sizeof(struct ipv6hdr),
	284	0));
	285
	286	nft_reject_br_push_etherhdr(oldskb, nskb);
	287
37b090e6	288	br_forward(br_port_get_rcu(dev), nskb, false, true);
523b929d	289	}
85f5b308 PNA	290
85f5b308 PNA	291	static void nft_reject_bridge_eval(const struct nft_expr *expr,
a55e22e9 PM	292	struct nft_regs *regs,
a55e22e9 PM	293	const struct nft_pktinfo *pkt)
85f5b308	294	{
51b0a5d8	295	struct nft_reject *priv = nft_expr_priv(expr);
523b929d PNA	296	const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
	297
	298	if (is_broadcast_ether_addr(dest) \|\|
	299	is_multicast_ether_addr(dest))
	300	goto out;
51b0a5d8	301
85f5b308 PNA	302	switch (eth_hdr(pkt->skb)->h_proto) {
85f5b308 PNA	303	case htons(ETH_P_IP):
51b0a5d8 PNA	304	switch (priv->type) {
51b0a5d8 PNA	305	case NFT_REJECT_ICMP_UNREACH:
0e5a1c7e PNA	306	nft_reject_br_send_v4_unreach(nft_net(pkt), pkt->skb,
	307	nft_in(pkt),
	308	nft_hook(pkt),
523b929d	309	priv->icmp_code);
51b0a5d8 PNA	310	break;
51b0a5d8 PNA	311	case NFT_REJECT_TCP_RST:
0e5a1c7e PNA	312	nft_reject_br_send_v4_tcp_reset(nft_net(pkt), pkt->skb,
	313	nft_in(pkt),
	314	nft_hook(pkt));
51b0a5d8 PNA	315	break;
51b0a5d8 PNA	316	case NFT_REJECT_ICMPX_UNREACH:
0e5a1c7e PNA	317	nft_reject_br_send_v4_unreach(nft_net(pkt), pkt->skb,
	318	nft_in(pkt),
	319	nft_hook(pkt),
523b929d	320	nft_reject_icmp_code(priv->icmp_code));
51b0a5d8 PNA	321	break;
	322	}
	323	break;
85f5b308	324	case htons(ETH_P_IPV6):
51b0a5d8 PNA	325	switch (priv->type) {
51b0a5d8 PNA	326	case NFT_REJECT_ICMP_UNREACH:
0e5a1c7e PNA	327	nft_reject_br_send_v6_unreach(nft_net(pkt), pkt->skb,
	328	nft_in(pkt),
	329	nft_hook(pkt),
523b929d	330	priv->icmp_code);
51b0a5d8 PNA	331	break;
51b0a5d8 PNA	332	case NFT_REJECT_TCP_RST:
0e5a1c7e PNA	333	nft_reject_br_send_v6_tcp_reset(nft_net(pkt), pkt->skb,
	334	nft_in(pkt),
	335	nft_hook(pkt));
51b0a5d8 PNA	336	break;
51b0a5d8 PNA	337	case NFT_REJECT_ICMPX_UNREACH:
0e5a1c7e PNA	338	nft_reject_br_send_v6_unreach(nft_net(pkt), pkt->skb,
	339	nft_in(pkt),
	340	nft_hook(pkt),
523b929d	341	nft_reject_icmpv6_code(priv->icmp_code));
51b0a5d8 PNA	342	break;
	343	}
	344	break;
85f5b308 PNA	345	default:
85f5b308 PNA	346	/* No explicit way to reject this protocol, drop it. */
85f5b308 PNA	347	break;
85f5b308 PNA	348	}
523b929d	349	out:
a55e22e9	350	regs->verdict.code = NF_DROP;
51b0a5d8 PNA	351	}
51b0a5d8 PNA	352
75e8d06d PNA	353	static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
	354	const struct nft_expr *expr,
	355	const struct nft_data **data)
127917c2	356	{
75e8d06d PNA	357	return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) \|
75e8d06d PNA	358	(1 << NF_BR_LOCAL_IN));
127917c2 PNA	359	}
127917c2 PNA	360
51b0a5d8 PNA	361	static int nft_reject_bridge_init(const struct nft_ctx *ctx,
	362	const struct nft_expr *expr,
	363	const struct nlattr * const tb[])
	364	{
	365	struct nft_reject *priv = nft_expr_priv(expr);
c56e3956	366	int icmp_code;
51b0a5d8 PNA	367
	368	if (tb[NFTA_REJECT_TYPE] == NULL)
	369	return -EINVAL;
	370
	371	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
	372	switch (priv->type) {
	373	case NFT_REJECT_ICMP_UNREACH:
	374	case NFT_REJECT_ICMPX_UNREACH:
	375	if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
	376	return -EINVAL;
	377
	378	icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
	379	if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
	380	icmp_code > NFT_REJECT_ICMPX_MAX)
	381	return -EINVAL;
	382
	383	priv->icmp_code = icmp_code;
	384	break;
	385	case NFT_REJECT_TCP_RST:
	386	break;
	387	default:
	388	return -EINVAL;
	389	}
	390	return 0;
	391	}
	392
	393	static int nft_reject_bridge_dump(struct sk_buff *skb,
	394	const struct nft_expr *expr)
	395	{
	396	const struct nft_reject *priv = nft_expr_priv(expr);
	397
	398	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
	399	goto nla_put_failure;
	400
	401	switch (priv->type) {
	402	case NFT_REJECT_ICMP_UNREACH:
	403	case NFT_REJECT_ICMPX_UNREACH:
	404	if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
	405	goto nla_put_failure;
	406	break;
c1f86676 DM	407	default:
c1f86676 DM	408	break;
51b0a5d8 PNA	409	}
	410
	411	return 0;
	412
	413	nla_put_failure:
	414	return -1;
85f5b308 PNA	415	}
	416
	417	static struct nft_expr_type nft_reject_bridge_type;
	418	static const struct nft_expr_ops nft_reject_bridge_ops = {
	419	.type = &nft_reject_bridge_type,
	420	.size = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
	421	.eval = nft_reject_bridge_eval,
51b0a5d8 PNA	422	.init = nft_reject_bridge_init,
51b0a5d8 PNA	423	.dump = nft_reject_bridge_dump,
127917c2	424	.validate = nft_reject_bridge_validate,
85f5b308 PNA	425	};
	426
	427	static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
	428	.family = NFPROTO_BRIDGE,
	429	.name = "reject",
	430	.ops = &nft_reject_bridge_ops,
	431	.policy = nft_reject_policy,
	432	.maxattr = NFTA_REJECT_MAX,
	433	.owner = THIS_MODULE,
	434	};
	435
	436	static int __init nft_reject_bridge_module_init(void)
	437	{
	438	return nft_register_expr(&nft_reject_bridge_type);
	439	}
	440
	441	static void __exit nft_reject_bridge_module_exit(void)
	442	{
	443	nft_unregister_expr(&nft_reject_bridge_type);
	444	}
	445
	446	module_init(nft_reject_bridge_module_init);
	447	module_exit(nft_reject_bridge_module_exit);
	448
	449	MODULE_LICENSE("GPL");
	450	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	451	MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");