Force socket error on iptables reject with icmp semantics?

Force socket error on iptables reject with icmp semantics?

[JP Abgrall]

Before I go bug the kernel people, I'd like to know if this seems
reasonable from a netfilter perspective.

>From e8b45cfd66ccc1be0bc406fc9662f0f1e7a94283 Mon Sep 17 00:00:00 2001
From: JP Abgrall <jpa@google.com>
Date: Thu, 19 May 2011 19:30:02 -0700
Subject: [PATCH] netfilter: have ip*t REJECT set the sock err when an
icmp is to be sent

Allow the REJECT --reject-with icmp*blabla to also set the matching error
locally on the socket affected by the reject.
This allows the process to see an error as if it received it via ICMP.
It avoids the local process who's packet is rejected to have to wait
for a pseudo-eternity until some timeout kicks in.
---
 net/ipv4/netfilter/ipt_REJECT.c  |    6 ++++++
 net/ipv6/netfilter/ip6t_REJECT.c |    7 +++++++
 2 files changed, 13 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 43eec80..5b27d4b 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -134,6 +134,12 @@ static void send_reset(struct sk_buff *oldskb, int hook)
 static inline void send_unreach(struct sk_buff *skb_in, int code)
 {
        icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
+       if (skb_in->sk) {
+               skb_in->sk->sk_err = icmp_err_convert[code].errno;
+               skb_in->sk->sk_error_report(skb_in->sk);
+               pr_debug("ipt_REJECT: sk_err=%d for skb=%p sk=%p\n",
+                       skb_in->sk->sk_err, skb_in, skb_in->sk);
+       }
 }

 static unsigned int
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 2933396..89a5512 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -174,6 +174,13 @@ send_unreach(struct net *net, struct sk_buff
*skb_in, unsigned char code,
                skb_in->dev = net->loopback_dev;

        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
+       if (skb_in->sk) {
+               icmpv6_err_convert(ICMP_DEST_UNREACH, code,
+                                  &skb_in->sk->sk_err);
+               skb_in->sk->sk_error_report(skb_in->sk);
+               pr_debug("ip6t_REJECT: sk_err=%d for skb=%p sk=%p\n",
+                       skb_in->sk->sk_err, skb_in, skb_in->sk);
+       }
 }

 static unsigned int
--
1.7.3.1

Re: Force socket error on iptables reject with icmp semantics?

[Patrick McHardy]

On 24.05.2011 01:16, JP Abgrall wrote:
> Before I go bug the kernel people, I'd like to know if this seems
> reasonable from a netfilter perspective.
> 
>>From e8b45cfd66ccc1be0bc406fc9662f0f1e7a94283 Mon Sep 17 00:00:00 2001
> From: JP Abgrall <jpa@google.com>
> Date: Thu, 19 May 2011 19:30:02 -0700
> Subject: [PATCH] netfilter: have ip*t REJECT set the sock err when an
> icmp is to be sent
> 
> Allow the REJECT --reject-with icmp*blabla to also set the matching error
> locally on the socket affected by the reject.
> This allows the process to see an error as if it received it via ICMP.
> It avoids the local process who's packet is rejected to have to wait
> for a pseudo-eternity until some timeout kicks in.

The interpretation and handling of the ICMP errors is up to the higher
layer protocols. So doing this in the REJECT target is not a good idea.
Unless there's something wrong in your setup, the ICMP message should
be received by the socket anyways.

Re: Force socket error on iptables reject with icmp semantics?

[JP Abgrall]

On Tue, May 24, 2011 at 00:01, Patrick McHardy <kaber@trash.net> wrote:
> The interpretation and handling of the ICMP errors is up to the higher
> layer protocols.
This is only for DEST_UNREACH, and I was expecting that the convert
table/func was the way to deal with it. But apparently not.

How about e.g. "--reject-with-forced-socket-error-matching-icmp
--reject-with icmp*blabla"?

> Unless there's something wrong in your setup, the ICMP message should
> be received by the socket anyways.
My understanding was that it won't happen if an ingress packet gets
rejected. In that case the icmp is only sent back out, as it uses
icmp*_send().

I'll see if it is not too hard to have icmp*_send(...., direction),
and call it for each direction.

For now, I'll keep my reject change (after fixing the arg in the v6
convert call) as it does allow user space to not wait for incoming
data after that.
--