net/bridge/netfilter/nft_reject_bridge.c

   1 /*
   2  * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/kernel.h>
  10 #include <linux/init.h>
  11 #include <linux/module.h>
  12 #include <linux/netlink.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/netfilter/nf_tables.h>
  15 #include <net/netfilter/nf_tables.h>
  16 #include <net/netfilter/nft_reject.h>
  17 #include <net/netfilter/nf_tables_bridge.h>
  18 #include <net/netfilter/ipv4/nf_reject.h>
  19 #include <net/netfilter/ipv6/nf_reject.h>
  20 #include <linux/ip.h>
  21 #include <net/ip.h>
  22 #include <net/ip6_checksum.h>
  23 #include <linux/netfilter_bridge.h>
  24 #include <linux/netfilter_ipv6.h>
  25 #include "../br_private.h"
  26
  27 static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
  28                                         struct sk_buff *nskb)
  29 {
  30         struct ethhdr *eth;
  31
  32         eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
  33         skb_reset_mac_header(nskb);
  34         ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
  35         ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
  36         eth->h_proto = eth_hdr(oldskb)->h_proto;
  37         skb_pull(nskb, ETH_HLEN);
  38
  39         if (skb_vlan_tag_present(oldskb)) {
  40                 u16 vid = skb_vlan_tag_get(oldskb);
  41
  42                 __vlan_hwaccel_put_tag(nskb, oldskb->vlan_proto, vid);
  43         }
  44 }
  45
  46 /* We cannot use oldskb->dev, it can be either bridge device (NF_BRIDGE INPUT)
  47  * or the bridge port (NF_BRIDGE PREROUTING).
  48  */
  49 static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb,
  50                                             const struct net_device *dev,
  51                                             int hook)
  52 {
  53         struct sk_buff *nskb;
  54         struct iphdr *niph;
  55         const struct tcphdr *oth;
  56         struct tcphdr _oth;
  57
  58         if (!nft_bridge_iphdr_validate(oldskb))
  59                 return;
  60
  61         oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
  62         if (!oth)
  63                 return;
  64
  65         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
  66                          LL_MAX_HEADER, GFP_ATOMIC);
  67         if (!nskb)
  68                 return;
  69
  70         skb_reserve(nskb, LL_MAX_HEADER);
  71         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
  72                                    sysctl_ip_default_ttl);
  73         nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
  74         niph->ttl       = sysctl_ip_default_ttl;
  75         niph->tot_len   = htons(nskb->len);
  76         ip_send_check(niph);
  77
  78         nft_reject_br_push_etherhdr(oldskb, nskb);
  79
  80         br_deliver(br_port_get_rcu(dev), nskb);
  81 }
  82
  83 static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb,
  84                                           const struct net_device *dev,
  85                                           int hook, u8 code)
  86 {
  87         struct sk_buff *nskb;
  88         struct iphdr *niph;
  89         struct icmphdr *icmph;
  90         unsigned int len;
  91         void *payload;
  92         __wsum csum;
  93         u8 proto;
  94
  95         if (oldskb->csum_bad || !nft_bridge_iphdr_validate(oldskb))
  96                 return;
  97
  98         /* IP header checks: fragment. */
  99         if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
 100                 return;
 101
 102         /* RFC says return as much as we can without exceeding 576 bytes. */
 103         len = min_t(unsigned int, 536, oldskb->len);
 104
 105         if (!pskb_may_pull(oldskb, len))
 106                 return;
 107
 108         if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))
 109                 return;
 110
 111         if (ip_hdr(oldskb)->protocol == IPPROTO_TCP ||
 112             ip_hdr(oldskb)->protocol == IPPROTO_UDP)
 113                 proto = ip_hdr(oldskb)->protocol;
 114         else
 115                 proto = 0;
 116
 117         if (!skb_csum_unnecessary(oldskb) &&
 118             nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))
 119                 return;
 120
 121         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
 122                          LL_MAX_HEADER + len, GFP_ATOMIC);
 123         if (!nskb)
 124                 return;
 125
 126         skb_reserve(nskb, LL_MAX_HEADER);
 127         niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
 128                                    sysctl_ip_default_ttl);
 129
 130         skb_reset_transport_header(nskb);
 131         icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
 132         memset(icmph, 0, sizeof(*icmph));
 133         icmph->type     = ICMP_DEST_UNREACH;
 134         icmph->code     = code;
 135
 136         payload = skb_put(nskb, len);
 137         memcpy(payload, skb_network_header(oldskb), len);
 138
 139         csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
 140         icmph->checksum = csum_fold(csum);
 141
 142         niph->tot_len   = htons(nskb->len);
 143         ip_send_check(niph);
 144
 145         nft_reject_br_push_etherhdr(oldskb, nskb);
 146
 147         br_deliver(br_port_get_rcu(dev), nskb);
 148 }
 149
 150 static void nft_reject_br_send_v6_tcp_reset(struct net *net,
 151                                             struct sk_buff *oldskb,
 152                                             const struct net_device *dev,
 153                                             int hook)
 154 {
 155         struct sk_buff *nskb;
 156         const struct tcphdr *oth;
 157         struct tcphdr _oth;
 158         unsigned int otcplen;
 159         struct ipv6hdr *nip6h;
 160
 161         if (!nft_bridge_ip6hdr_validate(oldskb))
 162                 return;
 163
 164         oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
 165         if (!oth)
 166                 return;
 167
 168         nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
 169                          LL_MAX_HEADER, GFP_ATOMIC);
 170         if (!nskb)
 171                 return;
 172
 173         skb_reserve(nskb, LL_MAX_HEADER);
 174         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
 175                                      net->ipv6.devconf_all->hop_limit);
 176         nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
 177         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
 178
 179         nft_reject_br_push_etherhdr(oldskb, nskb);
 180
 181         br_deliver(br_port_get_rcu(dev), nskb);
 182 }
 183
 184 static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
 185 {
 186         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 187         int thoff;
 188         __be16 fo;
 189         u8 proto = ip6h->nexthdr;
 190
 191         if (skb->csum_bad)
 192                 return false;
 193
 194         if (skb_csum_unnecessary(skb))
 195                 return true;
 196
 197         if (ip6h->payload_len &&
 198             pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
 199                 return false;
 200
 201         ip6h = ipv6_hdr(skb);
 202         thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
 203         if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
 204                 return false;
 205
 206         return nf_ip6_checksum(skb, hook, thoff, proto) == 0;
 207 }
 208
 209 static void nft_reject_br_send_v6_unreach(struct net *net,
 210                                           struct sk_buff *oldskb,
 211                                           const struct net_device *dev,
 212                                           int hook, u8 code)
 213 {
 214         struct sk_buff *nskb;
 215         struct ipv6hdr *nip6h;
 216         struct icmp6hdr *icmp6h;
 217         unsigned int len;
 218         void *payload;
 219
 220         if (!nft_bridge_ip6hdr_validate(oldskb))
 221                 return;
 222
 223         /* Include "As much of invoking packet as possible without the ICMPv6
 224          * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
 225          */
 226         len = min_t(unsigned int, 1220, oldskb->len);
 227
 228         if (!pskb_may_pull(oldskb, len))
 229                 return;
 230
 231         if (!reject6_br_csum_ok(oldskb, hook))
 232                 return;
 233
 234         nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
 235                          LL_MAX_HEADER + len, GFP_ATOMIC);
 236         if (!nskb)
 237                 return;
 238
 239         skb_reserve(nskb, LL_MAX_HEADER);
 240         nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
 241                                      net->ipv6.devconf_all->hop_limit);
 242
 243         skb_reset_transport_header(nskb);
 244         icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
 245         memset(icmp6h, 0, sizeof(*icmp6h));
 246         icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
 247         icmp6h->icmp6_code = code;
 248
 249         payload = skb_put(nskb, len);
 250         memcpy(payload, skb_network_header(oldskb), len);
 251         nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
 252
 253         icmp6h->icmp6_cksum =
 254                 csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
 255                                 nskb->len - sizeof(struct ipv6hdr),
 256                                 IPPROTO_ICMPV6,
 257                                 csum_partial(icmp6h,
 258                                              nskb->len - sizeof(struct ipv6hdr),
 259                                              0));
 260
 261         nft_reject_br_push_etherhdr(oldskb, nskb);
 262
 263         br_deliver(br_port_get_rcu(dev), nskb);
 264 }
 265
 266 static void nft_reject_bridge_eval(const struct nft_expr *expr,
 267                                    struct nft_regs *regs,
 268                                    const struct nft_pktinfo *pkt)
 269 {
 270         struct nft_reject *priv = nft_expr_priv(expr);
 271         const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
 272
 273         if (is_broadcast_ether_addr(dest) ||
 274             is_multicast_ether_addr(dest))
 275                 goto out;
 276
 277         switch (eth_hdr(pkt->skb)->h_proto) {
 278         case htons(ETH_P_IP):
 279                 switch (priv->type) {
 280                 case NFT_REJECT_ICMP_UNREACH:
 281                         nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
 282                                                       pkt->hook,
 283                                                       priv->icmp_code);
 284                         break;
 285                 case NFT_REJECT_TCP_RST:
 286                         nft_reject_br_send_v4_tcp_reset(pkt->skb, pkt->in,
 287                                                         pkt->hook);
 288                         break;
 289                 case NFT_REJECT_ICMPX_UNREACH:
 290                         nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
 291                                                       pkt->hook,
 292                                                       nft_reject_icmp_code(priv->icmp_code));
 293                         break;
 294                 }
 295                 break;
 296         case htons(ETH_P_IPV6):
 297                 switch (priv->type) {
 298                 case NFT_REJECT_ICMP_UNREACH:
 299                         nft_reject_br_send_v6_unreach(pkt->net, pkt->skb,
 300                                                       pkt->in, pkt->hook,
 301                                                       priv->icmp_code);
 302                         break;
 303                 case NFT_REJECT_TCP_RST:
 304                         nft_reject_br_send_v6_tcp_reset(pkt->net, pkt->skb,
 305                                                         pkt->in, pkt->hook);
 306                         break;
 307                 case NFT_REJECT_ICMPX_UNREACH:
 308                         nft_reject_br_send_v6_unreach(pkt->net, pkt->skb,
 309                                                       pkt->in, pkt->hook,
 310                                                       nft_reject_icmpv6_code(priv->icmp_code));
 311                         break;
 312                 }
 313                 break;
 314         default:
 315                 /* No explicit way to reject this protocol, drop it. */
 316                 break;
 317         }
 318 out:
 319         regs->verdict.code = NF_DROP;
 320 }
 321
 322 static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
 323                                       const struct nft_expr *expr,
 324                                       const struct nft_data **data)
 325 {
 326         return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
 327                                                     (1 << NF_BR_LOCAL_IN));
 328 }
 329
 330 static int nft_reject_bridge_init(const struct nft_ctx *ctx,
 331                                   const struct nft_expr *expr,
 332                                   const struct nlattr * const tb[])
 333 {
 334         struct nft_reject *priv = nft_expr_priv(expr);
 335         int icmp_code, err;
 336
 337         err = nft_reject_bridge_validate(ctx, expr, NULL);
 338         if (err < 0)
 339                 return err;
 340
 341         if (tb[NFTA_REJECT_TYPE] == NULL)
 342                 return -EINVAL;
 343
 344         priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
 345         switch (priv->type) {
 346         case NFT_REJECT_ICMP_UNREACH:
 347         case NFT_REJECT_ICMPX_UNREACH:
 348                 if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
 349                         return -EINVAL;
 350
 351                 icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
 352                 if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
 353                     icmp_code > NFT_REJECT_ICMPX_MAX)
 354                         return -EINVAL;
 355
 356                 priv->icmp_code = icmp_code;
 357                 break;
 358         case NFT_REJECT_TCP_RST:
 359                 break;
 360         default:
 361                 return -EINVAL;
 362         }
 363         return 0;
 364 }
 365
 366 static int nft_reject_bridge_dump(struct sk_buff *skb,
 367                                   const struct nft_expr *expr)
 368 {
 369         const struct nft_reject *priv = nft_expr_priv(expr);
 370
 371         if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
 372                 goto nla_put_failure;
 373
 374         switch (priv->type) {
 375         case NFT_REJECT_ICMP_UNREACH:
 376         case NFT_REJECT_ICMPX_UNREACH:
 377                 if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
 378                         goto nla_put_failure;
 379                 break;
 380         default:
 381                 break;
 382         }
 383
 384         return 0;
 385
 386 nla_put_failure:
 387         return -1;
 388 }
 389
 390 static struct nft_expr_type nft_reject_bridge_type;
 391 static const struct nft_expr_ops nft_reject_bridge_ops = {
 392         .type           = &nft_reject_bridge_type,
 393         .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
 394         .eval           = nft_reject_bridge_eval,
 395         .init           = nft_reject_bridge_init,
 396         .dump           = nft_reject_bridge_dump,
 397         .validate       = nft_reject_bridge_validate,
 398 };
 399
 400 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
 401         .family         = NFPROTO_BRIDGE,
 402         .name           = "reject",
 403         .ops            = &nft_reject_bridge_ops,
 404         .policy         = nft_reject_policy,
 405         .maxattr        = NFTA_REJECT_MAX,
 406         .owner          = THIS_MODULE,
 407 };
 408
 409 static int __init nft_reject_bridge_module_init(void)
 410 {
 411         return nft_register_expr(&nft_reject_bridge_type);
 412 }
 413
 414 static void __exit nft_reject_bridge_module_exit(void)
 415 {
 416         nft_unregister_expr(&nft_reject_bridge_type);
 417 }
 418
 419 module_init(nft_reject_bridge_module_init);
 420 module_exit(nft_reject_bridge_module_exit);
 421
 422 MODULE_LICENSE("GPL");
 423 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 424 MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");