summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlvaro Neira <alvaroneay@gmail.com>2014-10-23 19:36:56 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-10-24 12:00:57 +0200
commitc00d1287c088a6694b427c5143c98c028677c4bb (patch)
tree3383d8eccb9a0ed8f36b7ff8e6967c893c783cad
parent3e6ab2b33514228f892ba6c8389e40c4e82bc980 (diff)
evaluate: reject: check the context in reject without reason for bridge and inet tables
In rules like: nft add rule inet filter input reject or nft add rule bridge filter input reject we use icmpx to reject it. But if we have network context, we also use type of reject. With this patch, we check the network context. If we don't have context, we still use icmpx. However, if we have rules with network context like: nft add rule inet meta nfproto ipv4 reject or nft add rule bridge ether type ipv6 reject We are going to use icmp or icmpv6 to reject it taking into account the network context. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--src/evaluate.c44
-rw-r--r--tests/regression/bridge/reject.t3
-rw-r--r--tests/regression/inet/reject.t3
3 files changed, 48 insertions, 2 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index 63ba82e3..2dd49fa6 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1357,6 +1357,9 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt,
static int stmt_evaluate_reject_default(struct eval_ctx *ctx,
struct stmt *stmt)
{
+ int protocol;
+ const struct proto_desc *desc, *base;
+
switch (ctx->pctx.family) {
case NFPROTO_IPV4:
case NFPROTO_IPV6:
@@ -1368,9 +1371,46 @@ static int stmt_evaluate_reject_default(struct eval_ctx *ctx,
stmt->reject.icmp_code = ICMP6_DST_UNREACH_NOPORT;
break;
case NFPROTO_INET:
+ desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
+ if (desc == NULL) {
+ stmt->reject.type = NFT_REJECT_ICMPX_UNREACH;
+ stmt->reject.icmp_code = NFT_REJECT_ICMPX_PORT_UNREACH;
+ break;
+ }
+ stmt->reject.type = NFT_REJECT_ICMP_UNREACH;
+ base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
+ protocol = proto_find_num(base, desc);
+ switch (protocol) {
+ case NFPROTO_IPV4:
+ stmt->reject.family = NFPROTO_IPV4;
+ stmt->reject.icmp_code = ICMP_PORT_UNREACH;
+ break;
+ case NFPROTO_IPV6:
+ stmt->reject.family = NFPROTO_IPV6;
+ stmt->reject.icmp_code = ICMP6_DST_UNREACH_NOPORT;
+ break;
+ }
+ break;
case NFPROTO_BRIDGE:
- stmt->reject.type = NFT_REJECT_ICMPX_UNREACH;
- stmt->reject.icmp_code = NFT_REJECT_ICMPX_PORT_UNREACH;
+ desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
+ if (desc == NULL) {
+ stmt->reject.type = NFT_REJECT_ICMPX_UNREACH;
+ stmt->reject.icmp_code = NFT_REJECT_ICMPX_PORT_UNREACH;
+ break;
+ }
+ stmt->reject.type = NFT_REJECT_ICMP_UNREACH;
+ base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
+ protocol = proto_find_num(base, desc);
+ switch (protocol) {
+ case __constant_htons(ETH_P_IP):
+ stmt->reject.family = NFPROTO_IPV4;
+ stmt->reject.icmp_code = ICMP_PORT_UNREACH;
+ break;
+ case __constant_htons(ETH_P_IPV6):
+ stmt->reject.family = NFPROTO_IPV6;
+ stmt->reject.icmp_code = ICMP6_DST_UNREACH_NOPORT;
+ break;
+ }
break;
}
return 0;
diff --git a/tests/regression/bridge/reject.t b/tests/regression/bridge/reject.t
index 11a0f1c5..43e54611 100644
--- a/tests/regression/bridge/reject.t
+++ b/tests/regression/bridge/reject.t
@@ -18,6 +18,9 @@ reject with icmpv6 type port-unreachable;ok;ether type ip6 reject
ip protocol tcp reject with tcp reset;ok;ip protocol 6 reject with tcp reset
reject;ok
+ether type ip reject;ok
+ether type ip6 reject;ok
+
reject with icmpx type host-unreachable;ok
reject with icmpx type no-route;ok
reject with icmpx type admin-prohibited;ok
diff --git a/tests/regression/inet/reject.t b/tests/regression/inet/reject.t
index 2f5aef3a..52e7b28b 100644
--- a/tests/regression/inet/reject.t
+++ b/tests/regression/inet/reject.t
@@ -18,6 +18,9 @@ reject with icmpv6 type port-unreachable;ok;meta nfproto ipv6 reject
reject with tcp reset;ok;meta l4proto 6 reject with tcp reset
reject;ok
+meta nfproto ipv4 reject;ok
+meta nfproto ipv6 reject;ok
+
reject with icmpx type host-unreachable;ok
reject with icmpx type no-route;ok
reject with icmpx type admin-prohibited;ok