| Message ID | 1413847780-10149-3-git-send-email-alvaroneay@gmail.com |
|---|---|
| State | Superseded |
| Delegated to: | Pablo Neira |
| Headers | show |
On Tue, Oct 21, 2014 at 01:29:39AM +0200, Alvaro Neira Ayuso wrote: > nft add rule -nnn bridge test-bridge input \ > ip protocol tcp reject with tcp reset > > If we use in reject the type tcp reset. We don't need to check if the network > context is compatible with the reason. This patch fix that. > > Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> > --- > src/evaluate.c | 80 +++++++++++++++++++++++++++++++++----------------------- > 1 file changed, 47 insertions(+), 33 deletions(-) > > diff --git a/src/evaluate.c b/src/evaluate.c > index 20235a8..8b19baf 100644 > --- a/src/evaluate.c > +++ b/src/evaluate.c > @@ -1208,24 +1208,31 @@ static int stmt_evaluate_reject_inet(struct eval_ctx *ctx, struct stmt *stmt, > const struct proto_desc *desc, *base; > int protocol; > > - base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; > - desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; > - if (desc != NULL) { > - protocol = proto_find_num(base, desc); > - switch (protocol) { > - case NFPROTO_IPV4: > - if (stmt->reject.family == NFPROTO_IPV4) > - return 0; > - return stmt_error(ctx, stmt, > - "conflicting protocols specified: ip vs ip6"); > - case NFPROTO_IPV6: > - if (stmt->reject.family == NFPROTO_IPV6) > - return 0; > - return stmt_error(ctx, stmt, > - "conflicting protocols specified: ip vs ip6"); > - default: > - BUG("unsupported family"); > + switch (stmt->reject.type) { > + case NFT_REJECT_TCP_RST: > + break; > + case NFT_REJECT_ICMPX_UNREACH: Do you really need to check layer 3 conflicts with icmpx? > + case NFT_REJECT_ICMP_UNREACH: > + base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; > + desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; > + if (desc != NULL) { > + protocol = proto_find_num(base, desc); > + switch (protocol) { > + case NFPROTO_IPV4: > + if (stmt->reject.family == NFPROTO_IPV4) > + return 0; > + return stmt_error(ctx, stmt, > + "conflicting protocols specified: ip vs ip6"); > + case NFPROTO_IPV6: > + if (stmt->reject.family == NFPROTO_IPV6) > + return 0; > + return stmt_error(ctx, stmt, > + "conflicting protocols specified: ip vs ip6"); > + default: > + BUG("unsupported family"); > + } > } > + break; > } > if (stmt->reject.type == NFT_REJECT_ICMPX_UNREACH) > return 0; -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
El 21/10/14 09:55, Pablo Neira Ayuso escribió: > On Tue, Oct 21, 2014 at 01:29:39AM +0200, Alvaro Neira Ayuso wrote: >> nft add rule -nnn bridge test-bridge input \ >> ip protocol tcp reject with tcp reset >> >> If we use in reject the type tcp reset. We don't need to check if the network >> context is compatible with the reason. This patch fix that. >> >> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> >> --- >> src/evaluate.c | 80 +++++++++++++++++++++++++++++++++----------------------- >> 1 file changed, 47 insertions(+), 33 deletions(-) >> >> diff --git a/src/evaluate.c b/src/evaluate.c >> index 20235a8..8b19baf 100644 >> --- a/src/evaluate.c >> +++ b/src/evaluate.c >> @@ -1208,24 +1208,31 @@ static int stmt_evaluate_reject_inet(struct eval_ctx *ctx, struct stmt *stmt, >> const struct proto_desc *desc, *base; >> int protocol; >> >> - base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; >> - desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; >> - if (desc != NULL) { >> - protocol = proto_find_num(base, desc); >> - switch (protocol) { >> - case NFPROTO_IPV4: >> - if (stmt->reject.family == NFPROTO_IPV4) >> - return 0; >> - return stmt_error(ctx, stmt, >> - "conflicting protocols specified: ip vs ip6"); >> - case NFPROTO_IPV6: >> - if (stmt->reject.family == NFPROTO_IPV6) >> - return 0; >> - return stmt_error(ctx, stmt, >> - "conflicting protocols specified: ip vs ip6"); >> - default: >> - BUG("unsupported family"); >> + switch (stmt->reject.type) { >> + case NFT_REJECT_TCP_RST: >> + break; >> + case NFT_REJECT_ICMPX_UNREACH: > > Do you really need to check layer 3 conflicts with icmpx? Ups you're right. In Inet tables we don't need to check it. We only have Ipv4 and Ipv6 traffic. I have been focus in bridge and I have followed the same steps (check the network context) like bridge tables and in Inet is not necessary. I'm going to fix it. Thanks Pablo > >> + case NFT_REJECT_ICMP_UNREACH: >> + base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; >> + desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; >> + if (desc != NULL) { >> + protocol = proto_find_num(base, desc); >> + switch (protocol) { >> + case NFPROTO_IPV4: >> + if (stmt->reject.family == NFPROTO_IPV4) >> + return 0; >> + return stmt_error(ctx, stmt, >> + "conflicting protocols specified: ip vs ip6"); >> + case NFPROTO_IPV6: >> + if (stmt->reject.family == NFPROTO_IPV6) >> + return 0; >> + return stmt_error(ctx, stmt, >> + "conflicting protocols specified: ip vs ip6"); >> + default: >> + BUG("unsupported family"); >> + } >> } >> + break; >> } >> if (stmt->reject.type == NFT_REJECT_ICMPX_UNREACH) >> return 0; -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/src/evaluate.c b/src/evaluate.c index 20235a8..8b19baf 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1208,24 +1208,31 @@ static int stmt_evaluate_reject_inet(struct eval_ctx *ctx, struct stmt *stmt, const struct proto_desc *desc, *base; int protocol; - base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; - desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; - if (desc != NULL) { - protocol = proto_find_num(base, desc); - switch (protocol) { - case NFPROTO_IPV4: - if (stmt->reject.family == NFPROTO_IPV4) - return 0; - return stmt_error(ctx, stmt, - "conflicting protocols specified: ip vs ip6"); - case NFPROTO_IPV6: - if (stmt->reject.family == NFPROTO_IPV6) - return 0; - return stmt_error(ctx, stmt, - "conflicting protocols specified: ip vs ip6"); - default: - BUG("unsupported family"); + switch (stmt->reject.type) { + case NFT_REJECT_TCP_RST: + break; + case NFT_REJECT_ICMPX_UNREACH: + case NFT_REJECT_ICMP_UNREACH: + base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; + desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; + if (desc != NULL) { + protocol = proto_find_num(base, desc); + switch (protocol) { + case NFPROTO_IPV4: + if (stmt->reject.family == NFPROTO_IPV4) + return 0; + return stmt_error(ctx, stmt, + "conflicting protocols specified: ip vs ip6"); + case NFPROTO_IPV6: + if (stmt->reject.family == NFPROTO_IPV6) + return 0; + return stmt_error(ctx, stmt, + "conflicting protocols specified: ip vs ip6"); + default: + BUG("unsupported family"); + } } + break; } if (stmt->reject.type == NFT_REJECT_ICMPX_UNREACH) return 0; @@ -1240,25 +1247,32 @@ static int stmt_evaluate_reject_bridge(struct eval_ctx *ctx, struct stmt *stmt, const struct proto_desc *desc, *base; int protocol; - base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; - desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; - if (desc != NULL) { - protocol = proto_find_num(base, desc); - switch (protocol) { - case __constant_htons(ETH_P_IP): - if (NFPROTO_IPV4 == stmt->reject.family) - return 0; - return stmt_error(ctx, stmt, + switch (stmt->reject.type) { + case NFT_REJECT_TCP_RST: + break; + case NFT_REJECT_ICMPX_UNREACH: + case NFT_REJECT_ICMP_UNREACH: + base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; + desc = ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; + if (desc != NULL) { + protocol = proto_find_num(base, desc); + switch (protocol) { + case __constant_htons(ETH_P_IP): + if (NFPROTO_IPV4 == stmt->reject.family) + return 0; + return stmt_error(ctx, stmt, "conflicting protocols specified: ip vs ip6"); - case __constant_htons(ETH_P_IPV6): - if (NFPROTO_IPV6 == stmt->reject.family) - return 0; - return stmt_error(ctx, stmt, + case __constant_htons(ETH_P_IPV6): + if (NFPROTO_IPV6 == stmt->reject.family) + return 0; + return stmt_error(ctx, stmt, "conflicting protocols specified: ip vs ip6"); - default: - return stmt_error(ctx, stmt, - "cannot reject this ether type"); + default: + return stmt_error(ctx, stmt, + "cannot reject this ether type"); + } } + break; } if (stmt->reject.type == NFT_REJECT_ICMPX_UNREACH) return 0;
nft add rule -nnn bridge test-bridge input \ ip protocol tcp reject with tcp reset If we use in reject the type tcp reset. We don't need to check if the network context is compatible with the reason. This patch fix that. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> --- src/evaluate.c | 80 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 47 insertions(+), 33 deletions(-)