Commit 127917c2 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nft_reject_bridge: restrict reject to prerouting and input

Restrict the reject expression to the prerouting and input bridge
hooks. If we allow this to be used from forward or any other later
bridge hook, if the frame is flooded to several ports, we'll end up
sending several reject packets, one per cloned packet.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 523b929d
...@@ -18,6 +18,7 @@ ...@@ -18,6 +18,7 @@
#include <net/netfilter/ipv6/nf_reject.h> #include <net/netfilter/ipv6/nf_reject.h>
#include <linux/ip.h> #include <linux/ip.h>
#include <net/ip.h> #include <net/ip.h>
#include <linux/netfilter_bridge.h>
#include "../br_private.h" #include "../br_private.h"
static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb, static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
...@@ -305,12 +306,34 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr, ...@@ -305,12 +306,34 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
data[NFT_REG_VERDICT].verdict = NF_DROP; data[NFT_REG_VERDICT].verdict = NF_DROP;
} }
static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain)
{
struct nft_base_chain *basechain;
if (chain->flags & NFT_BASE_CHAIN) {
basechain = nft_base_chain(chain);
switch (basechain->ops[0].hooknum) {
case NF_BR_PRE_ROUTING:
case NF_BR_LOCAL_IN:
break;
default:
return -EOPNOTSUPP;
}
}
return 0;
}
static int nft_reject_bridge_init(const struct nft_ctx *ctx, static int nft_reject_bridge_init(const struct nft_ctx *ctx,
const struct nft_expr *expr, const struct nft_expr *expr,
const struct nlattr * const tb[]) const struct nlattr * const tb[])
{ {
struct nft_reject *priv = nft_expr_priv(expr); struct nft_reject *priv = nft_expr_priv(expr);
int icmp_code; int icmp_code, err;
err = nft_reject_bridge_validate_hooks(ctx->chain);
if (err < 0)
return err;
if (tb[NFTA_REJECT_TYPE] == NULL) if (tb[NFTA_REJECT_TYPE] == NULL)
return -EINVAL; return -EINVAL;
...@@ -359,6 +382,13 @@ static int nft_reject_bridge_dump(struct sk_buff *skb, ...@@ -359,6 +382,13 @@ static int nft_reject_bridge_dump(struct sk_buff *skb,
return -1; return -1;
} }
static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nft_data **data)
{
return nft_reject_bridge_validate_hooks(ctx->chain);
}
static struct nft_expr_type nft_reject_bridge_type; static struct nft_expr_type nft_reject_bridge_type;
static const struct nft_expr_ops nft_reject_bridge_ops = { static const struct nft_expr_ops nft_reject_bridge_ops = {
.type = &nft_reject_bridge_type, .type = &nft_reject_bridge_type,
...@@ -366,6 +396,7 @@ static const struct nft_expr_ops nft_reject_bridge_ops = { ...@@ -366,6 +396,7 @@ static const struct nft_expr_ops nft_reject_bridge_ops = {
.eval = nft_reject_bridge_eval, .eval = nft_reject_bridge_eval,
.init = nft_reject_bridge_init, .init = nft_reject_bridge_init,
.dump = nft_reject_bridge_dump, .dump = nft_reject_bridge_dump,
.validate = nft_reject_bridge_validate,
}; };
static struct nft_expr_type nft_reject_bridge_type __read_mostly = { static struct nft_expr_type nft_reject_bridge_type __read_mostly = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment