* [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables @ 2014-10-23 17:36 Alvaro Neira Ayuso 2014-10-23 17:36 ` [nft PATCH 2/2 v2] evaluate: reject: enhance the error support throwing message with more details Alvaro Neira Ayuso 2014-10-24 10:04 ` [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables Pablo Neira Ayuso 0 siblings, 2 replies; 4+ messages in thread From: Alvaro Neira Ayuso @ 2014-10-23 17:36 UTC (permalink / raw) To: netfilter-devel; +Cc: kaber In rules like: nft add rule inet filter input reject or nft add rule bridge filter input reject we use icmpx to reject it. But if we have network context, we also use type of reject. With this patch, we check the network context. If we don't have context, we still use icmpx. However, if we have rules with network context like: nft add rule inet meta nfproto ipv4 reject or nft add rule bridge ether type ipv6 reject We are going to use icmp or icmpv6 to reject it taking into account the network context. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> --- [changes in v2] * Added these new rules into the reject tests for bridge and inet tables. src/evaluate.c | 44 ++++++++++++++++++++++++++++++++++++-- tests/regression/bridge/reject.t | 3 +++ tests/regression/inet/reject.t | 3 +++ 3 files changed, 48 insertions(+), 2 deletions(-) diff --git a/src/evaluate.c b/src/evaluate.c index 63ba82e..2dd49fa 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1357,6 +1357,9 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt, static int stmt_evaluate_reject_default(struct eval_ctx *ctx, struct stmt *stmt) { + int protocol; + const struct proto_desc *desc, *base; + switch (ctx->pctx.family) { case NFPROTO_IPV4: case NFPROTO_IPV6: @@ -1368,9 +1371,46 @@ static int stmt_evaluate_reject_default(struct eval_ctx *ctx, stmt->reject.icmp_code = ICMP6_DST_UNREACH_NOPORT; break; case NFPROTO_INET: + desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; + if (desc == NULL) { + stmt->reject.type = NFT_REJECT_ICMPX_UNREACH; + stmt->reject.icmp_code = NFT_REJECT_ICMPX_PORT_UNREACH; + break; + } + stmt->reject.type = NFT_REJECT_ICMP_UNREACH; + base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; + protocol = proto_find_num(base, desc); + switch (protocol) { + case NFPROTO_IPV4: + stmt->reject.family = NFPROTO_IPV4; + stmt->reject.icmp_code = ICMP_PORT_UNREACH; + break; + case NFPROTO_IPV6: + stmt->reject.family = NFPROTO_IPV6; + stmt->reject.icmp_code = ICMP6_DST_UNREACH_NOPORT; + break; + } + break; case NFPROTO_BRIDGE: - stmt->reject.type = NFT_REJECT_ICMPX_UNREACH; - stmt->reject.icmp_code = NFT_REJECT_ICMPX_PORT_UNREACH; + desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; + if (desc == NULL) { + stmt->reject.type = NFT_REJECT_ICMPX_UNREACH; + stmt->reject.icmp_code = NFT_REJECT_ICMPX_PORT_UNREACH; + break; + } + stmt->reject.type = NFT_REJECT_ICMP_UNREACH; + base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; + protocol = proto_find_num(base, desc); + switch (protocol) { + case __constant_htons(ETH_P_IP): + stmt->reject.family = NFPROTO_IPV4; + stmt->reject.icmp_code = ICMP_PORT_UNREACH; + break; + case __constant_htons(ETH_P_IPV6): + stmt->reject.family = NFPROTO_IPV6; + stmt->reject.icmp_code = ICMP6_DST_UNREACH_NOPORT; + break; + } break; } return 0; diff --git a/tests/regression/bridge/reject.t b/tests/regression/bridge/reject.t index 11a0f1c..43e5461 100644 --- a/tests/regression/bridge/reject.t +++ b/tests/regression/bridge/reject.t @@ -18,6 +18,9 @@ reject with icmpv6 type port-unreachable;ok;ether type ip6 reject ip protocol tcp reject with tcp reset;ok;ip protocol 6 reject with tcp reset reject;ok +ether type ip reject;ok +ether type ip6 reject;ok + reject with icmpx type host-unreachable;ok reject with icmpx type no-route;ok reject with icmpx type admin-prohibited;ok diff --git a/tests/regression/inet/reject.t b/tests/regression/inet/reject.t index 2f5aef3..52e7b28 100644 --- a/tests/regression/inet/reject.t +++ b/tests/regression/inet/reject.t @@ -18,6 +18,9 @@ reject with icmpv6 type port-unreachable;ok;meta nfproto ipv6 reject reject with tcp reset;ok;meta l4proto 6 reject with tcp reset reject;ok +meta nfproto ipv4 reject;ok +meta nfproto ipv6 reject;ok + reject with icmpx type host-unreachable;ok reject with icmpx type no-route;ok reject with icmpx type admin-prohibited;ok -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [nft PATCH 2/2 v2] evaluate: reject: enhance the error support throwing message with more details 2014-10-23 17:36 [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables Alvaro Neira Ayuso @ 2014-10-23 17:36 ` Alvaro Neira Ayuso 2014-10-24 10:04 ` Pablo Neira Ayuso 2014-10-24 10:04 ` [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables Pablo Neira Ayuso 1 sibling, 1 reply; 4+ messages in thread From: Alvaro Neira Ayuso @ 2014-10-23 17:36 UTC (permalink / raw) To: netfilter-devel; +Cc: kaber If we add a rule like: nft add rule bridge filter input ether type ip reject with icmpv6 type no-route We throw an error like: <cmdline>:1:44-49: Error: conflicting protocols specified: ip vs ip6 add rule bridge filter input ether type ip reject with icmpv6 type no-route Now, we are going to show in which part of the rule, we have the conflict: <cmdline>:1:51-75: Error: conflicting protocols specified: ip vs ip6 add rule bridge filter input ether type ip reject with icmpv6 type no-route ~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> --- [changes in v2] * Fixed some cosmetics errors. src/evaluate.c | 43 ++++++++++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/src/evaluate.c b/src/evaluate.c index 2dd49fa..b722567 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1213,8 +1213,9 @@ static int stmt_evaluate_reject_inet_family(struct eval_ctx *ctx, case NFT_REJECT_TCP_RST: break; case NFT_REJECT_ICMPX_UNREACH: - return stmt_error(ctx, stmt, - "conflicting network protocol specified"); + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], + "conflicting network protocol specified"); case NFT_REJECT_ICMP_UNREACH: base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; protocol = proto_find_num(base, desc); @@ -1222,12 +1223,14 @@ static int stmt_evaluate_reject_inet_family(struct eval_ctx *ctx, case NFPROTO_IPV4: if (stmt->reject.family == NFPROTO_IPV4) break; - return stmt_error(ctx, stmt, + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], "conflicting protocols specified: ip vs ip6"); case NFPROTO_IPV6: if (stmt->reject.family == NFPROTO_IPV6) break; - return stmt_error(ctx, stmt, + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], "conflicting protocols specified: ip vs ip6"); default: BUG("unsupported family"); @@ -1263,8 +1266,9 @@ static int stmt_evaluate_reject_bridge_family(struct eval_ctx *ctx, switch (stmt->reject.type) { case NFT_REJECT_ICMPX_UNREACH: - return stmt_error(ctx, stmt, - "conflicting network protocol specified"); + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], + "conflicting network protocol specified"); case NFT_REJECT_TCP_RST: base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; protocol = proto_find_num(base, desc); @@ -1273,8 +1277,9 @@ static int stmt_evaluate_reject_bridge_family(struct eval_ctx *ctx, case __constant_htons(ETH_P_IPV6): break; default: - return stmt_error(ctx, stmt, - "cannot reject this ether type"); + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], + "cannot reject this ether type"); } break; case NFT_REJECT_ICMP_UNREACH: @@ -1284,16 +1289,19 @@ static int stmt_evaluate_reject_bridge_family(struct eval_ctx *ctx, case __constant_htons(ETH_P_IP): if (NFPROTO_IPV4 == stmt->reject.family) break; - return stmt_error(ctx, stmt, + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], "conflicting protocols specified: ip vs ip6"); case __constant_htons(ETH_P_IPV6): if (NFPROTO_IPV6 == stmt->reject.family) break; - return stmt_error(ctx, stmt, + return stmt_binary_error(ctx, stmt->reject.expr, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], "conflicting protocols specified: ip vs ip6"); default: - return stmt_error(ctx, stmt, - "cannot reject this ether type"); + return stmt_binary_error(ctx, stmt, + &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR], + "cannot reject this ether type"); } break; } @@ -1331,13 +1339,13 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt, return -1; break; case NFT_REJECT_ICMPX_UNREACH: - return stmt_error(ctx, stmt, + return stmt_binary_error(ctx, stmt->reject.expr, stmt, "abstracted ICMP unreachable not supported"); case NFT_REJECT_ICMP_UNREACH: - if (stmt->reject.family != ctx->pctx.family) - return stmt_error(ctx, stmt, + if (stmt->reject.family == ctx->pctx.family) + break; + return stmt_binary_error(ctx, stmt->reject.expr, stmt, "conflicting protocols specified: ip vs ip6"); - break; } break; case NFPROTO_BRIDGE: @@ -1452,7 +1460,8 @@ static int stmt_evaluate_reset(struct eval_ctx *ctx, struct stmt *stmt) break; default: if (stmt->reject.type == NFT_REJECT_TCP_RST) { - return stmt_error(ctx, stmt, + return stmt_binary_error(ctx, stmt, + &ctx->pctx.protocol[PROTO_BASE_TRANSPORT_HDR], "you cannot use tcp reset with this protocol"); } break; -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [nft PATCH 2/2 v2] evaluate: reject: enhance the error support throwing message with more details 2014-10-23 17:36 ` [nft PATCH 2/2 v2] evaluate: reject: enhance the error support throwing message with more details Alvaro Neira Ayuso @ 2014-10-24 10:04 ` Pablo Neira Ayuso 0 siblings, 0 replies; 4+ messages in thread From: Pablo Neira Ayuso @ 2014-10-24 10:04 UTC (permalink / raw) To: Alvaro Neira Ayuso; +Cc: netfilter-devel, kaber On Thu, Oct 23, 2014 at 07:36:57PM +0200, Alvaro Neira Ayuso wrote: > If we add a rule like: > > nft add rule bridge filter input ether type ip reject with icmpv6 type no-route > > We throw an error like: > > <cmdline>:1:44-49: Error: conflicting protocols specified: ip vs ip6 > add rule bridge filter input ether type ip reject with icmpv6 type no-route > > Now, we are going to show in which part of the rule, we have the conflict: > > <cmdline>:1:51-75: Error: conflicting protocols specified: ip vs ip6 > add rule bridge filter input ether type ip reject with icmpv6 type no-route > ~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^^ Applied, thanks. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables 2014-10-23 17:36 [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables Alvaro Neira Ayuso 2014-10-23 17:36 ` [nft PATCH 2/2 v2] evaluate: reject: enhance the error support throwing message with more details Alvaro Neira Ayuso @ 2014-10-24 10:04 ` Pablo Neira Ayuso 1 sibling, 0 replies; 4+ messages in thread From: Pablo Neira Ayuso @ 2014-10-24 10:04 UTC (permalink / raw) To: Alvaro Neira Ayuso; +Cc: netfilter-devel, kaber On Thu, Oct 23, 2014 at 07:36:56PM +0200, Alvaro Neira Ayuso wrote: > In rules like: > > nft add rule inet filter input reject > or > nft add rule bridge filter input reject > > we use icmpx to reject it. But if we have network context, we also use type of > reject. With this patch, we check the network context. If we don't have context, > we still use icmpx. However, if we have rules with network context like: > > nft add rule inet meta nfproto ipv4 reject > or > nft add rule bridge ether type ipv6 reject > > We are going to use icmp or icmpv6 to reject it taking into account the network > context. Applied, thanks. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-10-24 10:02 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-10-23 17:36 [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables Alvaro Neira Ayuso 2014-10-23 17:36 ` [nft PATCH 2/2 v2] evaluate: reject: enhance the error support throwing message with more details Alvaro Neira Ayuso 2014-10-24 10:04 ` Pablo Neira Ayuso 2014-10-24 10:04 ` [nft PATCH 1/2 v2] evaluate: reject: check the context in reject without reason for bridge and inet tables Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).