net/bridge/netfilter/nft_reject_bridge.c

   1 /*
   2  * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/kernel.h>
  10 #include <linux/init.h>
  11 #include <linux/module.h>
  12 #include <linux/netlink.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/netfilter/nf_tables.h>
  15 #include <net/netfilter/nf_tables.h>
  16 #include <net/netfilter/nft_reject.h>
  17 #include <net/netfilter/ipv4/nf_reject.h>
  18 #include <net/netfilter/ipv6/nf_reject.h>
  19 #include <linux/ip.h>
  20 #include <net/ip.h>
  21 #include <linux/netfilter_bridge.h>
  22 #include "../br_private.h"
  23
  24 static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
  25                                         struct sk_buff *nskb)
  26 {
  27         struct ethhdr *eth;
  28
  29         eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
  30         skb_reset_mac_header(nskb);
  31         ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
  32         ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
  33         eth->h_proto = eth_hdr(oldskb)->h_proto;
  34         skb_pull(nskb, ETH_HLEN);
  35 }
  36
  37 static int nft_reject_iphdr_validate(struct sk_buff *oldskb)
  38 {
  39         struct iphdr *iph;
  40         u32 len;
  41
  42         if (!pskb_may_pull(oldskb, sizeof(struct iphdr)))
  43                 return 0;
  44
  45         iph = ip_hdr(oldskb);
  46         if (iph->ihl < 5 || iph->version != 4)
  47                 return 0;
  48
  49         len = ntohs(iph->tot_len);
  50         if (oldskb->len < len)
  51                 return 0;
  52         else if (len < (iph->ihl*4))
  53                 return 0;
  54
  55         if (!pskb_may_pull(oldskb, iph->ihl*4))
  56                 return 0;
  57
  58         return 1;
  59 }
  60
  61 static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb, int hook)
  62 {
  63         struct sk_buff *nskb;
  64         struct iphdr *niph;
  65         const struct tcphdr *oth;
  66         struct tcphdr _oth;
  67
  68         if (!nft_reject_iphdr_validate(oldskb))
  69                 return;
  70
  71         oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
  72         if (!oth)
  73                 return;
  74
  75         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
  76                          LL_MAX_HEADER, GFP_ATOMIC);
  77         if (!nskb)
  78                 return;
  79
  80         skb_reserve(nskb, LL_MAX_HEADER);
  81         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
  82                                    sysctl_ip_default_ttl);
  83         nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
  84         niph->ttl       = sysctl_ip_default_ttl;
  85         niph->tot_len   = htons(nskb->len);
  86         ip_send_check(niph);
  87
  88         nft_reject_br_push_etherhdr(oldskb, nskb);
  89
  90         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
  91 }
  92
  93 static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb, int hook,
  94                                           u8 code)
  95 {
  96         struct sk_buff *nskb;
  97         struct iphdr *niph;
  98         struct icmphdr *icmph;
  99         unsigned int len;
 100         void *payload;
 101         __wsum csum;
 102
 103         if (!nft_reject_iphdr_validate(oldskb))
 104                 return;
 105
 106         /* IP header checks: fragment. */
 107         if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
 108                 return;
 109
 110         /* RFC says return as much as we can without exceeding 576 bytes. */
 111         len = min_t(unsigned int, 536, oldskb->len);
 112
 113         if (!pskb_may_pull(oldskb, len))
 114                 return;
 115
 116         if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), 0))
 117                 return;
 118
 119         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
 120                          LL_MAX_HEADER + len, GFP_ATOMIC);
 121         if (!nskb)
 122                 return;
 123
 124         skb_reserve(nskb, LL_MAX_HEADER);
 125         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
 126                                    sysctl_ip_default_ttl);
 127
 128         skb_reset_transport_header(nskb);
 129         icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
 130         memset(icmph, 0, sizeof(*icmph));
 131         icmph->type     = ICMP_DEST_UNREACH;
 132         icmph->code     = code;
 133
 134         payload = skb_put(nskb, len);
 135         memcpy(payload, skb_network_header(oldskb), len);
 136
 137         csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
 138         icmph->checksum = csum_fold(csum);
 139
 140         niph->tot_len   = htons(nskb->len);
 141         ip_send_check(niph);
 142
 143         nft_reject_br_push_etherhdr(oldskb, nskb);
 144
 145         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
 146 }
 147
 148 static int nft_reject_ip6hdr_validate(struct sk_buff *oldskb)
 149 {
 150         struct ipv6hdr *hdr;
 151         u32 pkt_len;
 152
 153         if (!pskb_may_pull(oldskb, sizeof(struct ipv6hdr)))
 154                 return 0;
 155
 156         hdr = ipv6_hdr(oldskb);
 157         if (hdr->version != 6)
 158                 return 0;
 159
 160         pkt_len = ntohs(hdr->payload_len);
 161         if (pkt_len + sizeof(struct ipv6hdr) > oldskb->len)
 162                 return 0;
 163
 164         return 1;
 165 }
 166
 167 static void nft_reject_br_send_v6_tcp_reset(struct net *net,
 168                                             struct sk_buff *oldskb, int hook)
 169 {
 170         struct sk_buff *nskb;
 171         const struct tcphdr *oth;
 172         struct tcphdr _oth;
 173         unsigned int otcplen;
 174         struct ipv6hdr *nip6h;
 175
 176         if (!nft_reject_ip6hdr_validate(oldskb))
 177                 return;
 178
 179         oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
 180         if (!oth)
 181                 return;
 182
 183         nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
 184                          LL_MAX_HEADER, GFP_ATOMIC);
 185         if (!nskb)
 186                 return;
 187
 188         skb_reserve(nskb, LL_MAX_HEADER);
 189         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
 190                                      net->ipv6.devconf_all->hop_limit);
 191         nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
 192         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
 193
 194         nft_reject_br_push_etherhdr(oldskb, nskb);
 195
 196         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
 197 }
 198
 199 static void nft_reject_br_send_v6_unreach(struct net *net,
 200                                           struct sk_buff *oldskb, int hook,
 201                                           u8 code)
 202 {
 203         struct sk_buff *nskb;
 204         struct ipv6hdr *nip6h;
 205         struct icmp6hdr *icmp6h;
 206         unsigned int len;
 207         void *payload;
 208
 209         if (!nft_reject_ip6hdr_validate(oldskb))
 210                 return;
 211
 212         /* Include "As much of invoking packet as possible without the ICMPv6
 213          * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
 214          */
 215         len = min_t(unsigned int, 1220, oldskb->len);
 216
 217         if (!pskb_may_pull(oldskb, len))
 218                 return;
 219
 220         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
 221                          LL_MAX_HEADER + len, GFP_ATOMIC);
 222         if (!nskb)
 223                 return;
 224
 225         skb_reserve(nskb, LL_MAX_HEADER);
 226         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
 227                                      net->ipv6.devconf_all->hop_limit);
 228
 229         skb_reset_transport_header(nskb);
 230         icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
 231         memset(icmp6h, 0, sizeof(*icmp6h));
 232         icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
 233         icmp6h->icmp6_code = code;
 234
 235         payload = skb_put(nskb, len);
 236         memcpy(payload, skb_network_header(oldskb), len);
 237         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
 238
 239         icmp6h->icmp6_cksum =
 240                 csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
 241                                 nskb->len - sizeof(struct ipv6hdr),
 242                                 IPPROTO_ICMPV6,
 243                                 csum_partial(icmp6h,
 244                                              nskb->len - sizeof(struct ipv6hdr),
 245                                              0));
 246
 247         nft_reject_br_push_etherhdr(oldskb, nskb);
 248
 249         br_deliver(br_port_get_rcu(oldskb->dev), nskb);
 250 }
 251
 252 static void nft_reject_bridge_eval(const struct nft_expr *expr,
 253                                  struct nft_data data[NFT_REG_MAX + 1],
 254                                  const struct nft_pktinfo *pkt)
 255 {
 256         struct nft_reject *priv = nft_expr_priv(expr);
 257         struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
 258         const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
 259
 260         if (is_broadcast_ether_addr(dest) ||
 261             is_multicast_ether_addr(dest))
 262                 goto out;
 263
 264         switch (eth_hdr(pkt->skb)->h_proto) {
 265         case htons(ETH_P_IP):
 266                 switch (priv->type) {
 267                 case NFT_REJECT_ICMP_UNREACH:
 268                         nft_reject_br_send_v4_unreach(pkt->skb,
 269                                                       pkt->ops->hooknum,
 270                                                       priv->icmp_code);
 271                         break;
 272                 case NFT_REJECT_TCP_RST:
 273                         nft_reject_br_send_v4_tcp_reset(pkt->skb,
 274                                                         pkt->ops->hooknum);
 275                         break;
 276                 case NFT_REJECT_ICMPX_UNREACH:
 277                         nft_reject_br_send_v4_unreach(pkt->skb,
 278                                                       pkt->ops->hooknum,
 279                                                       nft_reject_icmp_code(priv->icmp_code));
 280                         break;
 281                 }
 282                 break;
 283         case htons(ETH_P_IPV6):
 284                 switch (priv->type) {
 285                 case NFT_REJECT_ICMP_UNREACH:
 286                         nft_reject_br_send_v6_unreach(net, pkt->skb,
 287                                                       pkt->ops->hooknum,
 288                                                       priv->icmp_code);
 289                         break;
 290                 case NFT_REJECT_TCP_RST:
 291                         nft_reject_br_send_v6_tcp_reset(net, pkt->skb,
 292                                                         pkt->ops->hooknum);
 293                         break;
 294                 case NFT_REJECT_ICMPX_UNREACH:
 295                         nft_reject_br_send_v6_unreach(net, pkt->skb,
 296                                                       pkt->ops->hooknum,
 297                                                       nft_reject_icmpv6_code(priv->icmp_code));
 298                         break;
 299                 }
 300                 break;
 301         default:
 302                 /* No explicit way to reject this protocol, drop it. */
 303                 break;
 304         }
 305 out:
 306         data[NFT_REG_VERDICT].verdict = NF_DROP;
 307 }
 308
 309 static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
 310 {
 311         struct nft_base_chain *basechain;
 312
 313         if (chain->flags & NFT_BASE_CHAIN) {
 314                 basechain = nft_base_chain(chain);
 315
 316                 switch (basechain->ops[0].hooknum) {
 317                 case NF_BR_PRE_ROUTING:
 318                 case NF_BR_LOCAL_IN:
 319                         break;
 320                 default:
 321                         return -EOPNOTSUPP;
 322                 }
 323         }
 324         return 0;
 325 }
 326
 327 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
 328                                   const struct nft_expr *expr,
 329                                   const struct nlattr * const tb[])
 330 {
 331         struct nft_reject *priv = nft_expr_priv(expr);
 332         int icmp_code, err;
 333
 334         err = nft_reject_bridge_validate_hooks(ctx->chain);
 335         if (err < 0)
 336                 return err;
 337
 338         if (tb[NFTA_REJECT_TYPE] == NULL)
 339                 return -EINVAL;
 340
 341         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
 342         switch (priv->type) {
 343         case NFT_REJECT_ICMP_UNREACH:
 344         case NFT_REJECT_ICMPX_UNREACH:
 345                 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
 346                         return -EINVAL;
 347
 348                 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
 349                 if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
 350                     icmp_code > NFT_REJECT_ICMPX_MAX)
 351                         return -EINVAL;
 352
 353                 priv->icmp_code = icmp_code;
 354                 break;
 355         case NFT_REJECT_TCP_RST:
 356                 break;
 357         default:
 358                 return -EINVAL;
 359         }
 360         return 0;
 361 }
 362
 363 static int nft_reject_bridge_dump(struct sk_buff *skb,
 364                                   const struct nft_expr *expr)
 365 {
 366         const struct nft_reject *priv = nft_expr_priv(expr);
 367
 368         if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
 369                 goto nla_put_failure;
 370
 371         switch (priv->type) {
 372         case NFT_REJECT_ICMP_UNREACH:
 373         case NFT_REJECT_ICMPX_UNREACH:
 374                 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
 375                         goto nla_put_failure;
 376                 break;
 377         }
 378
 379         return 0;
 380
 381 nla_put_failure:
 382         return -1;
 383 }
 384
 385 static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
 386                                       const struct nft_expr *expr,
 387                                       const struct nft_data **data)
 388 {
 389         return nft_reject_bridge_validate_hooks(ctx->chain);
 390 }
 391
 392 static struct nft_expr_type nft_reject_bridge_type;
 393 static const struct nft_expr_ops nft_reject_bridge_ops = {
 394         .type           = &nft_reject_bridge_type,
 395         .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
 396         .eval           = nft_reject_bridge_eval,
 397         .init           = nft_reject_bridge_init,
 398         .dump           = nft_reject_bridge_dump,
 399         .validate       = nft_reject_bridge_validate,
 400 };
 401
 402 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
 403         .family         = NFPROTO_BRIDGE,
 404         .name           = "reject",
 405         .ops            = &nft_reject_bridge_ops,
 406         .policy         = nft_reject_policy,
 407         .maxattr        = NFTA_REJECT_MAX,
 408         .owner          = THIS_MODULE,
 409 };
 410
 411 static int __init nft_reject_bridge_module_init(void)
 412 {
 413         return nft_register_expr(&nft_reject_bridge_type);
 414 }
 415
 416 static void __exit nft_reject_bridge_module_exit(void)
 417 {
 418         nft_unregister_expr(&nft_reject_bridge_type);
 419 }
 420
 421 module_init(nft_reject_bridge_module_init);
 422 module_exit(nft_reject_bridge_module_exit);
 423
 424 MODULE_LICENSE("GPL");
 425 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 426 MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");