diff options
author | Alvaro Neira <alvaroneay@gmail.com> | 2014-09-30 17:21:40 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-10-09 13:53:11 +0200 |
commit | 5fdd0b6a0600e66f9ff6d9a1d6b749aa68a3ba99 (patch) | |
tree | 282a5201207e607a0ccc94c17cab9bebb12da723 /src/payload.c | |
parent | 67094206871b3dbaabd48894bc171e67010762c4 (diff) |
nft: complete reject support
This patch allows to use the reject action in rules. For example:
nft add rule filter input udp dport 22 reject
In this rule, we assume that the reason is network unreachable. Also
we can specify the reason with the option "with" and the reason. For example:
nft add rule filter input tcp dport 22 reject with icmp type host-unreachable
In the bridge tables and inet tables, we can use this action too. For example:
nft add rule inet filter input reject with icmp type host-unreachable
In this rule above, this generates a meta nfproto dependency to match
ipv4 traffic because we use a icmpv4 reason to reject.
If the reason is not specified, we infer it from the context.
Moreover, we have the new icmpx datatype. You can use this datatype for
the bridge and the inet tables to simplify your ruleset. For example:
nft add rule inet filter input reject with icmpx type host-unreachable
We have four icmpx reason and the mapping is:
ICMPX reason | ICMPv6 | ICMPv4
| |
admin-prohibited | admin-prohibited | admin-prohibited
port-unreachable | port-unreachable | port-unreachable
no-route | no-route | net-unreachable
host-unreachable | addr-unreachable | host-unreachable
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/payload.c')
-rw-r--r-- | src/payload.c | 31 |
1 files changed, 26 insertions, 5 deletions
diff --git a/src/payload.c b/src/payload.c index b7b74edd..ebf8079b 100644 --- a/src/payload.c +++ b/src/payload.c @@ -198,11 +198,32 @@ int payload_gen_dependency(struct eval_ctx *ctx, const struct expr *expr, } desc = ctx->pctx.protocol[expr->payload.base - 1].desc; - /* Special case for mixed IPv4/IPv6 tables: use meta L4 proto */ - if (desc == NULL && - ctx->pctx.family == NFPROTO_INET && - expr->payload.base == PROTO_BASE_TRANSPORT_HDR) - desc = &proto_inet_service; + /* Special case for mixed IPv4/IPv6 and bridge tables */ + if (desc == NULL) { + switch (ctx->pctx.family) { + case NFPROTO_INET: + switch (expr->payload.base) { + case PROTO_BASE_TRANSPORT_HDR: + desc = &proto_inet_service; + break; + case PROTO_BASE_LL_HDR: + desc = &proto_inet; + break; + default: + break; + } + break; + case NFPROTO_BRIDGE: + switch (expr->payload.base) { + case PROTO_BASE_LL_HDR: + desc = &proto_eth; + break; + default: + break; + } + break; + } + } if (desc == NULL) return expr_error(ctx->msgs, expr, |