[deliverable/linux.git] / net / bridge / netfilter / nft_reject_bridge.c

/*
 * Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nft_reject.h>
#include <net/netfilter/nf_tables_bridge.h>
#include <net/netfilter/ipv4/nf_reject.h>
#include <net/netfilter/ipv6/nf_reject.h>
#include <linux/ip.h>
#include <net/ip.h>
#include <net/ip6_checksum.h>
#include <linux/netfilter_bridge.h>
#include "../br_private.h"

static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
					struct sk_buff *nskb)
{
	struct ethhdr *eth;

	eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
	skb_reset_mac_header(nskb);
	ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
	ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
	eth->h_proto = eth_hdr(oldskb)->h_proto;
	skb_pull(nskb, ETH_HLEN);
}

static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb, int hook)
{
	struct sk_buff *nskb;
	struct iphdr *niph;
	const struct tcphdr *oth;
	struct tcphdr _oth;

	if (!nft_bridge_iphdr_validate(oldskb))
		return;

	oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
	if (!oth)
		return;

	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
			 LL_MAX_HEADER, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
				   sysctl_ip_default_ttl);
	nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
	niph->ttl	= sysctl_ip_default_ttl;
	niph->tot_len	= htons(nskb->len);
	ip_send_check(niph);

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
}

static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb, int hook,
					  u8 code)
{
	struct sk_buff *nskb;
	struct iphdr *niph;
	struct icmphdr *icmph;
	unsigned int len;
	void *payload;
	__wsum csum;

	if (!nft_bridge_iphdr_validate(oldskb))
		return;

	/* IP header checks: fragment. */
	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
		return;

	/* RFC says return as much as we can without exceeding 576 bytes. */
	len = min_t(unsigned int, 536, oldskb->len);

	if (!pskb_may_pull(oldskb, len))
		return;

	if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), 0))
		return;

	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
			 LL_MAX_HEADER + len, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
				   sysctl_ip_default_ttl);

	skb_reset_transport_header(nskb);
	icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
	memset(icmph, 0, sizeof(*icmph));
	icmph->type     = ICMP_DEST_UNREACH;
	icmph->code	= code;

	payload = skb_put(nskb, len);
	memcpy(payload, skb_network_header(oldskb), len);

	csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
	icmph->checksum = csum_fold(csum);

	niph->tot_len	= htons(nskb->len);
	ip_send_check(niph);

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
}

static void nft_reject_br_send_v6_tcp_reset(struct net *net,
					    struct sk_buff *oldskb, int hook)
{
	struct sk_buff *nskb;
	const struct tcphdr *oth;
	struct tcphdr _oth;
	unsigned int otcplen;
	struct ipv6hdr *nip6h;

	if (!nft_bridge_ip6hdr_validate(oldskb))
		return;

	oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
	if (!oth)
		return;

	nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
			 LL_MAX_HEADER, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
				     net->ipv6.devconf_all->hop_limit);
	nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
}

static void nft_reject_br_send_v6_unreach(struct net *net,
					  struct sk_buff *oldskb, int hook,
					  u8 code)
{
	struct sk_buff *nskb;
	struct ipv6hdr *nip6h;
	struct icmp6hdr *icmp6h;
	unsigned int len;
	void *payload;

	if (!nft_bridge_ip6hdr_validate(oldskb))
		return;

	/* Include "As much of invoking packet as possible without the ICMPv6
	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
	 */
	len = min_t(unsigned int, 1220, oldskb->len);

	if (!pskb_may_pull(oldskb, len))
		return;

	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
			 LL_MAX_HEADER + len, GFP_ATOMIC);
	if (!nskb)
		return;

	skb_reserve(nskb, LL_MAX_HEADER);
	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
				     net->ipv6.devconf_all->hop_limit);

	skb_reset_transport_header(nskb);
	icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
	memset(icmp6h, 0, sizeof(*icmp6h));
	icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
	icmp6h->icmp6_code = code;

	payload = skb_put(nskb, len);
	memcpy(payload, skb_network_header(oldskb), len);
	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));

	icmp6h->icmp6_cksum =
		csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
				nskb->len - sizeof(struct ipv6hdr),
				IPPROTO_ICMPV6,
				csum_partial(icmp6h,
					     nskb->len - sizeof(struct ipv6hdr),
					     0));

	nft_reject_br_push_etherhdr(oldskb, nskb);

	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
}

static void nft_reject_bridge_eval(const struct nft_expr *expr,
				 struct nft_data data[NFT_REG_MAX + 1],
				 const struct nft_pktinfo *pkt)
{
	struct nft_reject *priv = nft_expr_priv(expr);
	struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
	const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;

	if (is_broadcast_ether_addr(dest) ||
	    is_multicast_ether_addr(dest))
		goto out;

	switch (eth_hdr(pkt->skb)->h_proto) {
	case htons(ETH_P_IP):
		switch (priv->type) {
		case NFT_REJECT_ICMP_UNREACH:
			nft_reject_br_send_v4_unreach(pkt->skb,
						      pkt->ops->hooknum,
						      priv->icmp_code);
			break;
		case NFT_REJECT_TCP_RST:
			nft_reject_br_send_v4_tcp_reset(pkt->skb,
							pkt->ops->hooknum);
			break;
		case NFT_REJECT_ICMPX_UNREACH:
			nft_reject_br_send_v4_unreach(pkt->skb,
						      pkt->ops->hooknum,
						      nft_reject_icmp_code(priv->icmp_code));
			break;
		}
		break;
	case htons(ETH_P_IPV6):
		switch (priv->type) {
		case NFT_REJECT_ICMP_UNREACH:
			nft_reject_br_send_v6_unreach(net, pkt->skb,
						      pkt->ops->hooknum,
						      priv->icmp_code);
			break;
		case NFT_REJECT_TCP_RST:
			nft_reject_br_send_v6_tcp_reset(net, pkt->skb,
							pkt->ops->hooknum);
			break;
		case NFT_REJECT_ICMPX_UNREACH:
			nft_reject_br_send_v6_unreach(net, pkt->skb,
						      pkt->ops->hooknum,
						      nft_reject_icmpv6_code(priv->icmp_code));
			break;
		}
		break;
	default:
		/* No explicit way to reject this protocol, drop it. */
		break;
	}
out:
	data[NFT_REG_VERDICT].verdict = NF_DROP;
}

static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
{
	struct nft_base_chain *basechain;

	if (chain->flags & NFT_BASE_CHAIN) {
		basechain = nft_base_chain(chain);

		switch (basechain->ops[0].hooknum) {
		case NF_BR_PRE_ROUTING:
		case NF_BR_LOCAL_IN:
			break;
		default:
			return -EOPNOTSUPP;
		}
	}
	return 0;
}

static int nft_reject_bridge_init(const struct nft_ctx *ctx,
				  const struct nft_expr *expr,
				  const struct nlattr * const tb[])
{
	struct nft_reject *priv = nft_expr_priv(expr);
	int icmp_code, err;

	err = nft_reject_bridge_validate_hooks(ctx->chain);
	if (err < 0)
		return err;

	if (tb[NFTA_REJECT_TYPE] == NULL)
		return -EINVAL;

	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
	switch (priv->type) {
	case NFT_REJECT_ICMP_UNREACH:
	case NFT_REJECT_ICMPX_UNREACH:
		if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
			return -EINVAL;

		icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
		if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
		    icmp_code > NFT_REJECT_ICMPX_MAX)
			return -EINVAL;

		priv->icmp_code = icmp_code;
		break;
	case NFT_REJECT_TCP_RST:
		break;
	default:
		return -EINVAL;
	}
	return 0;
}

static int nft_reject_bridge_dump(struct sk_buff *skb,
				  const struct nft_expr *expr)
{
	const struct nft_reject *priv = nft_expr_priv(expr);

	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
		goto nla_put_failure;

	switch (priv->type) {
	case NFT_REJECT_ICMP_UNREACH:
	case NFT_REJECT_ICMPX_UNREACH:
		if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
			goto nla_put_failure;
		break;
	}

	return 0;

nla_put_failure:
	return -1;
}

static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
				      const struct nft_expr *expr,
				      const struct nft_data **data)
{
	return nft_reject_bridge_validate_hooks(ctx->chain);
}

static struct nft_expr_type nft_reject_bridge_type;
static const struct nft_expr_ops nft_reject_bridge_ops = {
	.type		= &nft_reject_bridge_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),
	.eval		= nft_reject_bridge_eval,
	.init		= nft_reject_bridge_init,
	.dump		= nft_reject_bridge_dump,
	.validate	= nft_reject_bridge_validate,
};

static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
	.family		= NFPROTO_BRIDGE,
	.name		= "reject",
	.ops		= &nft_reject_bridge_ops,
	.policy		= nft_reject_policy,
	.maxattr	= NFTA_REJECT_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_reject_bridge_module_init(void)
{
	return nft_register_expr(&nft_reject_bridge_type);
}

static void __exit nft_reject_bridge_module_exit(void)
{
	nft_unregister_expr(&nft_reject_bridge_type);
}

module_init(nft_reject_bridge_module_init);
module_exit(nft_reject_bridge_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");
Commit	Line	Data
85f5b308 PNA	1	/*
	2	* Copyright (c) 2014 Pablo Neira Ayuso <pablo@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/kernel.h>
	10	#include <linux/init.h>
	11	#include <linux/module.h>
	12	#include <linux/netlink.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/netfilter/nf_tables.h>
	15	#include <net/netfilter/nf_tables.h>
	16	#include <net/netfilter/nft_reject.h>
68b0faa8	17	#include <net/netfilter/nf_tables_bridge.h>
51b0a5d8 PNA	18	#include <net/netfilter/ipv4/nf_reject.h>
51b0a5d8 PNA	19	#include <net/netfilter/ipv6/nf_reject.h>
523b929d PNA	20	#include <linux/ip.h>
523b929d PNA	21	#include <net/ip.h>
c1207c04	22	#include <net/ip6_checksum.h>
127917c2	23	#include <linux/netfilter_bridge.h>
523b929d PNA	24	#include "../br_private.h"
	25
	26	static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
	27	struct sk_buff *nskb)
	28	{
	29	struct ethhdr *eth;
	30
	31	eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN);
	32	skb_reset_mac_header(nskb);
	33	ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest);
	34	ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
	35	eth->h_proto = eth_hdr(oldskb)->h_proto;
	36	skb_pull(nskb, ETH_HLEN);
	37	}
	38
523b929d PNA	39	static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb, int hook)
	40	{
	41	struct sk_buff *nskb;
	42	struct iphdr *niph;
	43	const struct tcphdr *oth;
	44	struct tcphdr _oth;
	45
68b0faa8	46	if (!nft_bridge_iphdr_validate(oldskb))
523b929d PNA	47	return;
	48
	49	oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook);
	50	if (!oth)
	51	return;
	52
	53	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
	54	LL_MAX_HEADER, GFP_ATOMIC);
	55	if (!nskb)
	56	return;
	57
	58	skb_reserve(nskb, LL_MAX_HEADER);
	59	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
	60	sysctl_ip_default_ttl);
	61	nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
	62	niph->ttl = sysctl_ip_default_ttl;
	63	niph->tot_len = htons(nskb->len);
	64	ip_send_check(niph);
	65
	66	nft_reject_br_push_etherhdr(oldskb, nskb);
	67
	68	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
	69	}
	70
	71	static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb, int hook,
	72	u8 code)
	73	{
	74	struct sk_buff *nskb;
	75	struct iphdr *niph;
	76	struct icmphdr *icmph;
	77	unsigned int len;
	78	void *payload;
	79	__wsum csum;
	80
68b0faa8	81	if (!nft_bridge_iphdr_validate(oldskb))
523b929d PNA	82	return;
	83
	84	/* IP header checks: fragment. */
	85	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
	86	return;
	87
	88	/* RFC says return as much as we can without exceeding 576 bytes. */
	89	len = min_t(unsigned int, 536, oldskb->len);
	90
	91	if (!pskb_may_pull(oldskb, len))
	92	return;
	93
	94	if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), 0))
	95	return;
	96
	97	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) +
	98	LL_MAX_HEADER + len, GFP_ATOMIC);
	99	if (!nskb)
	100	return;
	101
	102	skb_reserve(nskb, LL_MAX_HEADER);
	103	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP,
	104	sysctl_ip_default_ttl);
	105
	106	skb_reset_transport_header(nskb);
	107	icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr));
	108	memset(icmph, 0, sizeof(*icmph));
	109	icmph->type = ICMP_DEST_UNREACH;
	110	icmph->code = code;
	111
	112	payload = skb_put(nskb, len);
	113	memcpy(payload, skb_network_header(oldskb), len);
	114
	115	csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0);
	116	icmph->checksum = csum_fold(csum);
	117
	118	niph->tot_len = htons(nskb->len);
	119	ip_send_check(niph);
	120
	121	nft_reject_br_push_etherhdr(oldskb, nskb);
	122
	123	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
	124	}
	125
523b929d PNA	126	static void nft_reject_br_send_v6_tcp_reset(struct net *net,
	127	struct sk_buff *oldskb, int hook)
	128	{
	129	struct sk_buff *nskb;
	130	const struct tcphdr *oth;
	131	struct tcphdr _oth;
	132	unsigned int otcplen;
	133	struct ipv6hdr *nip6h;
	134
68b0faa8	135	if (!nft_bridge_ip6hdr_validate(oldskb))
523b929d PNA	136	return;
	137
	138	oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook);
	139	if (!oth)
	140	return;
	141
	142	nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) +
	143	LL_MAX_HEADER, GFP_ATOMIC);
	144	if (!nskb)
	145	return;
	146
	147	skb_reserve(nskb, LL_MAX_HEADER);
	148	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
	149	net->ipv6.devconf_all->hop_limit);
	150	nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen);
	151	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
	152
	153	nft_reject_br_push_etherhdr(oldskb, nskb);
	154
	155	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
	156	}
	157
	158	static void nft_reject_br_send_v6_unreach(struct net *net,
	159	struct sk_buff *oldskb, int hook,
	160	u8 code)
	161	{
	162	struct sk_buff *nskb;
	163	struct ipv6hdr *nip6h;
	164	struct icmp6hdr *icmp6h;
	165	unsigned int len;
	166	void *payload;
	167
68b0faa8	168	if (!nft_bridge_ip6hdr_validate(oldskb))
523b929d PNA	169	return;
	170
	171	/* Include "As much of invoking packet as possible without the ICMPv6
	172	* packet exceeding the minimum IPv6 MTU" in the ICMP payload.
	173	*/
	174	len = min_t(unsigned int, 1220, oldskb->len);
	175
	176	if (!pskb_may_pull(oldskb, len))
	177	return;
	178
	179	nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
	180	LL_MAX_HEADER + len, GFP_ATOMIC);
	181	if (!nskb)
	182	return;
	183
	184	skb_reserve(nskb, LL_MAX_HEADER);
	185	nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6,
	186	net->ipv6.devconf_all->hop_limit);
	187
	188	skb_reset_transport_header(nskb);
	189	icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr));
	190	memset(icmp6h, 0, sizeof(*icmp6h));
	191	icmp6h->icmp6_type = ICMPV6_DEST_UNREACH;
	192	icmp6h->icmp6_code = code;
	193
	194	payload = skb_put(nskb, len);
	195	memcpy(payload, skb_network_header(oldskb), len);
	196	nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr));
	197
	198	icmp6h->icmp6_cksum =
	199	csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr,
	200	nskb->len - sizeof(struct ipv6hdr),
	201	IPPROTO_ICMPV6,
	202	csum_partial(icmp6h,
	203	nskb->len - sizeof(struct ipv6hdr),
	204	0));
	205
	206	nft_reject_br_push_etherhdr(oldskb, nskb);
	207
	208	br_deliver(br_port_get_rcu(oldskb->dev), nskb);
	209	}
85f5b308 PNA	210
	211	static void nft_reject_bridge_eval(const struct nft_expr *expr,
	212	struct nft_data data[NFT_REG_MAX + 1],
	213	const struct nft_pktinfo *pkt)
	214	{
51b0a5d8 PNA	215	struct nft_reject *priv = nft_expr_priv(expr);
51b0a5d8 PNA	216	struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
523b929d PNA	217	const unsigned char *dest = eth_hdr(pkt->skb)->h_dest;
	218
	219	if (is_broadcast_ether_addr(dest) \|\|
	220	is_multicast_ether_addr(dest))
	221	goto out;
51b0a5d8	222
85f5b308 PNA	223	switch (eth_hdr(pkt->skb)->h_proto) {
85f5b308 PNA	224	case htons(ETH_P_IP):
51b0a5d8 PNA	225	switch (priv->type) {
51b0a5d8 PNA	226	case NFT_REJECT_ICMP_UNREACH:
523b929d PNA	227	nft_reject_br_send_v4_unreach(pkt->skb,
	228	pkt->ops->hooknum,
	229	priv->icmp_code);
51b0a5d8 PNA	230	break;
51b0a5d8 PNA	231	case NFT_REJECT_TCP_RST:
523b929d PNA	232	nft_reject_br_send_v4_tcp_reset(pkt->skb,
523b929d PNA	233	pkt->ops->hooknum);
51b0a5d8 PNA	234	break;
51b0a5d8 PNA	235	case NFT_REJECT_ICMPX_UNREACH:
523b929d PNA	236	nft_reject_br_send_v4_unreach(pkt->skb,
	237	pkt->ops->hooknum,
	238	nft_reject_icmp_code(priv->icmp_code));
51b0a5d8 PNA	239	break;
	240	}
	241	break;
85f5b308	242	case htons(ETH_P_IPV6):
51b0a5d8 PNA	243	switch (priv->type) {
51b0a5d8 PNA	244	case NFT_REJECT_ICMP_UNREACH:
523b929d PNA	245	nft_reject_br_send_v6_unreach(net, pkt->skb,
	246	pkt->ops->hooknum,
	247	priv->icmp_code);
51b0a5d8 PNA	248	break;
51b0a5d8 PNA	249	case NFT_REJECT_TCP_RST:
523b929d PNA	250	nft_reject_br_send_v6_tcp_reset(net, pkt->skb,
523b929d PNA	251	pkt->ops->hooknum);
51b0a5d8 PNA	252	break;
51b0a5d8 PNA	253	case NFT_REJECT_ICMPX_UNREACH:
523b929d PNA	254	nft_reject_br_send_v6_unreach(net, pkt->skb,
	255	pkt->ops->hooknum,
	256	nft_reject_icmpv6_code(priv->icmp_code));
51b0a5d8 PNA	257	break;
	258	}
	259	break;
85f5b308 PNA	260	default:
85f5b308 PNA	261	/* No explicit way to reject this protocol, drop it. */
85f5b308 PNA	262	break;
85f5b308 PNA	263	}
523b929d	264	out:
51b0a5d8 PNA	265	data[NFT_REG_VERDICT].verdict = NF_DROP;
	266	}
	267
127917c2 PNA	268	static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
	269	{
	270	struct nft_base_chain *basechain;
	271
	272	if (chain->flags & NFT_BASE_CHAIN) {
	273	basechain = nft_base_chain(chain);
	274
	275	switch (basechain->ops[0].hooknum) {
	276	case NF_BR_PRE_ROUTING:
	277	case NF_BR_LOCAL_IN:
	278	break;
	279	default:
	280	return -EOPNOTSUPP;
	281	}
	282	}
	283	return 0;
	284	}
	285
51b0a5d8 PNA	286	static int nft_reject_bridge_init(const struct nft_ctx *ctx,
	287	const struct nft_expr *expr,
	288	const struct nlattr * const tb[])
	289	{
	290	struct nft_reject *priv = nft_expr_priv(expr);
127917c2 PNA	291	int icmp_code, err;
	292
	293	err = nft_reject_bridge_validate_hooks(ctx->chain);
	294	if (err < 0)
	295	return err;
51b0a5d8 PNA	296
	297	if (tb[NFTA_REJECT_TYPE] == NULL)
	298	return -EINVAL;
	299
	300	priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
	301	switch (priv->type) {
	302	case NFT_REJECT_ICMP_UNREACH:
	303	case NFT_REJECT_ICMPX_UNREACH:
	304	if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
	305	return -EINVAL;
	306
	307	icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
	308	if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
	309	icmp_code > NFT_REJECT_ICMPX_MAX)
	310	return -EINVAL;
	311
	312	priv->icmp_code = icmp_code;
	313	break;
	314	case NFT_REJECT_TCP_RST:
	315	break;
	316	default:
	317	return -EINVAL;
	318	}
	319	return 0;
	320	}
	321
	322	static int nft_reject_bridge_dump(struct sk_buff *skb,
	323	const struct nft_expr *expr)
	324	{
	325	const struct nft_reject *priv = nft_expr_priv(expr);
	326
	327	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
	328	goto nla_put_failure;
	329
	330	switch (priv->type) {
	331	case NFT_REJECT_ICMP_UNREACH:
	332	case NFT_REJECT_ICMPX_UNREACH:
	333	if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
	334	goto nla_put_failure;
	335	break;
	336	}
	337
	338	return 0;
	339
	340	nla_put_failure:
	341	return -1;
85f5b308 PNA	342	}
85f5b308 PNA	343
127917c2 PNA	344	static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
	345	const struct nft_expr *expr,
	346	const struct nft_data **data)
	347	{
	348	return nft_reject_bridge_validate_hooks(ctx->chain);
	349	}
	350
85f5b308 PNA	351	static struct nft_expr_type nft_reject_bridge_type;
	352	static const struct nft_expr_ops nft_reject_bridge_ops = {
	353	.type = &nft_reject_bridge_type,
	354	.size = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
	355	.eval = nft_reject_bridge_eval,
51b0a5d8 PNA	356	.init = nft_reject_bridge_init,
51b0a5d8 PNA	357	.dump = nft_reject_bridge_dump,
127917c2	358	.validate = nft_reject_bridge_validate,
85f5b308 PNA	359	};
	360
	361	static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
	362	.family = NFPROTO_BRIDGE,
	363	.name = "reject",
	364	.ops = &nft_reject_bridge_ops,
	365	.policy = nft_reject_policy,
	366	.maxattr = NFTA_REJECT_MAX,
	367	.owner = THIS_MODULE,
	368	};
	369
	370	static int __init nft_reject_bridge_module_init(void)
	371	{
	372	return nft_register_expr(&nft_reject_bridge_type);
	373	}
	374
	375	static void __exit nft_reject_bridge_module_exit(void)
	376	{
	377	nft_unregister_expr(&nft_reject_bridge_type);
	378	}
	379
	380	module_init(nft_reject_bridge_module_init);
	381	module_exit(nft_reject_bridge_module_exit);
	382
	383	MODULE_LICENSE("GPL");
	384	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	385	MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "reject");