diff options
| author | Alvaro Neira <alvaroneay@gmail.com> | 2014-09-30 17:21:40 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-10-09 13:53:11 +0200 |
| commit | 5fdd0b6a0600e66f9ff6d9a1d6b749aa68a3ba99 (patch) | |
| tree | 282a5201207e607a0ccc94c17cab9bebb12da723 /src/statement.c | |
| parent | 67094206871b3dbaabd48894bc171e67010762c4 (diff) | |
nft: complete reject support
This patch allows to use the reject action in rules. For example:
nft add rule filter input udp dport 22 reject
In this rule, we assume that the reason is network unreachable. Also
we can specify the reason with the option "with" and the reason. For example:
nft add rule filter input tcp dport 22 reject with icmp type host-unreachable
In the bridge tables and inet tables, we can use this action too. For example:
nft add rule inet filter input reject with icmp type host-unreachable
In this rule above, this generates a meta nfproto dependency to match
ipv4 traffic because we use a icmpv4 reason to reject.
If the reason is not specified, we infer it from the context.
Moreover, we have the new icmpx datatype. You can use this datatype for
the bridge and the inet tables to simplify your ruleset. For example:
nft add rule inet filter input reject with icmpx type host-unreachable
We have four icmpx reason and the mapping is:
ICMPX reason | ICMPv6 | ICMPv4
| |
admin-prohibited | admin-prohibited | admin-prohibited
port-unreachable | port-unreachable | port-unreachable
no-route | no-route | net-unreachable
host-unreachable | addr-unreachable | host-unreachable
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/statement.c')
| -rw-r--r-- | src/statement.c | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/src/statement.c b/src/statement.c index 8e4b49e2..357f0948 100644 --- a/src/statement.c +++ b/src/statement.c @@ -16,6 +16,10 @@ #include <string.h> #include <syslog.h> +#include <arpa/inet.h> +#include <linux/netfilter.h> +#include <netinet/ip_icmp.h> +#include <netinet/icmp6.h> #include <statement.h> #include <utils.h> #include <list.h> @@ -227,6 +231,33 @@ struct stmt *queue_stmt_alloc(const struct location *loc) static void reject_stmt_print(const struct stmt *stmt) { printf("reject"); + switch (stmt->reject.type) { + case NFT_REJECT_TCP_RST: + printf(" with tcp reset"); + break; + case NFT_REJECT_ICMPX_UNREACH: + if (stmt->reject.icmp_code == NFT_REJECT_ICMPX_PORT_UNREACH) + break; + printf(" with icmpx type "); + expr_print(stmt->reject.expr); + break; + case NFT_REJECT_ICMP_UNREACH: + switch (stmt->reject.family) { + case NFPROTO_IPV4: + if (stmt->reject.icmp_code == ICMP_PORT_UNREACH) + break; + printf(" with icmp type "); + expr_print(stmt->reject.expr); + break; + case NFPROTO_IPV6: + if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) + break; + printf(" with icmpv6 type "); + expr_print(stmt->reject.expr); + break; + } + break; + } } static const struct stmt_ops reject_stmt_ops = { |