![Liping Zhang](/assets/img/avatar_default.png)
After I add the nft rule "nft add rule filter prerouting reject with tcp reset", kernel panic happened on my system: NULL pointer dereference at ... IP: [<ffffffff81b9db2f>] nf_send_reset+0xaf/0x400 Call Trace: [<ffffffff81b9da80>] ? nf_reject_ip_tcphdr_get+0x160/0x160 [<ffffffffa0928061>] nft_reject_ipv4_eval+0x61/0xb0 [nft_reject_ipv4] [<ffffffffa08e836a>] nft_do_chain+0x1fa/0x890 [nf_tables] [<ffffffffa08e8170>] ? __nft_trace_packet+0x170/0x170 [nf_tables] [<ffffffffa06e0900>] ? nf_ct_invert_tuple+0xb0/0xc0 [nf_conntrack] [<ffffffffa07224d4>] ? nf_nat_setup_info+0x5d4/0x650 [nf_nat] [...] Because in the PREROUTING chain, routing information is not exist, then we will dereference the NULL pointer and oops happen. So we restrict reject expression to INPUT, FORWARD and OUTPUT chain. This is consistent with iptables REJECT target. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
159 lines
3.8 KiB
C
159 lines
3.8 KiB
C
/*
|
|
* Copyright (c) 2014 Patrick McHardy <kaber@trash.net>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/netlink.h>
|
|
#include <linux/netfilter.h>
|
|
#include <linux/netfilter/nf_tables.h>
|
|
#include <net/netfilter/nf_tables.h>
|
|
#include <net/netfilter/nft_reject.h>
|
|
#include <net/netfilter/ipv4/nf_reject.h>
|
|
#include <net/netfilter/ipv6/nf_reject.h>
|
|
|
|
static void nft_reject_inet_eval(const struct nft_expr *expr,
|
|
struct nft_regs *regs,
|
|
const struct nft_pktinfo *pkt)
|
|
{
|
|
struct nft_reject *priv = nft_expr_priv(expr);
|
|
|
|
switch (pkt->pf) {
|
|
case NFPROTO_IPV4:
|
|
switch (priv->type) {
|
|
case NFT_REJECT_ICMP_UNREACH:
|
|
nf_send_unreach(pkt->skb, priv->icmp_code,
|
|
pkt->hook);
|
|
break;
|
|
case NFT_REJECT_TCP_RST:
|
|
nf_send_reset(pkt->net, pkt->skb, pkt->hook);
|
|
break;
|
|
case NFT_REJECT_ICMPX_UNREACH:
|
|
nf_send_unreach(pkt->skb,
|
|
nft_reject_icmp_code(priv->icmp_code),
|
|
pkt->hook);
|
|
break;
|
|
}
|
|
break;
|
|
case NFPROTO_IPV6:
|
|
switch (priv->type) {
|
|
case NFT_REJECT_ICMP_UNREACH:
|
|
nf_send_unreach6(pkt->net, pkt->skb, priv->icmp_code,
|
|
pkt->hook);
|
|
break;
|
|
case NFT_REJECT_TCP_RST:
|
|
nf_send_reset6(pkt->net, pkt->skb, pkt->hook);
|
|
break;
|
|
case NFT_REJECT_ICMPX_UNREACH:
|
|
nf_send_unreach6(pkt->net, pkt->skb,
|
|
nft_reject_icmpv6_code(priv->icmp_code),
|
|
pkt->hook);
|
|
break;
|
|
}
|
|
break;
|
|
}
|
|
|
|
regs->verdict.code = NF_DROP;
|
|
}
|
|
|
|
static int nft_reject_inet_init(const struct nft_ctx *ctx,
|
|
const struct nft_expr *expr,
|
|
const struct nlattr * const tb[])
|
|
{
|
|
struct nft_reject *priv = nft_expr_priv(expr);
|
|
int icmp_code, err;
|
|
|
|
err = nft_reject_validate(ctx, expr, NULL);
|
|
if (err < 0)
|
|
return err;
|
|
|
|
if (tb[NFTA_REJECT_TYPE] == NULL)
|
|
return -EINVAL;
|
|
|
|
priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
|
|
switch (priv->type) {
|
|
case NFT_REJECT_ICMP_UNREACH:
|
|
case NFT_REJECT_ICMPX_UNREACH:
|
|
if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
|
|
return -EINVAL;
|
|
|
|
icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
|
|
if (priv->type == NFT_REJECT_ICMPX_UNREACH &&
|
|
icmp_code > NFT_REJECT_ICMPX_MAX)
|
|
return -EINVAL;
|
|
|
|
priv->icmp_code = icmp_code;
|
|
break;
|
|
case NFT_REJECT_TCP_RST:
|
|
break;
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int nft_reject_inet_dump(struct sk_buff *skb,
|
|
const struct nft_expr *expr)
|
|
{
|
|
const struct nft_reject *priv = nft_expr_priv(expr);
|
|
|
|
if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
|
|
goto nla_put_failure;
|
|
|
|
switch (priv->type) {
|
|
case NFT_REJECT_ICMP_UNREACH:
|
|
case NFT_REJECT_ICMPX_UNREACH:
|
|
if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
|
|
goto nla_put_failure;
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
return 0;
|
|
|
|
nla_put_failure:
|
|
return -1;
|
|
}
|
|
|
|
static struct nft_expr_type nft_reject_inet_type;
|
|
static const struct nft_expr_ops nft_reject_inet_ops = {
|
|
.type = &nft_reject_inet_type,
|
|
.size = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
|
|
.eval = nft_reject_inet_eval,
|
|
.init = nft_reject_inet_init,
|
|
.dump = nft_reject_inet_dump,
|
|
.validate = nft_reject_validate,
|
|
};
|
|
|
|
static struct nft_expr_type nft_reject_inet_type __read_mostly = {
|
|
.family = NFPROTO_INET,
|
|
.name = "reject",
|
|
.ops = &nft_reject_inet_ops,
|
|
.policy = nft_reject_policy,
|
|
.maxattr = NFTA_REJECT_MAX,
|
|
.owner = THIS_MODULE,
|
|
};
|
|
|
|
static int __init nft_reject_inet_module_init(void)
|
|
{
|
|
return nft_register_expr(&nft_reject_inet_type);
|
|
}
|
|
|
|
static void __exit nft_reject_inet_module_exit(void)
|
|
{
|
|
nft_unregister_expr(&nft_reject_inet_type);
|
|
}
|
|
|
|
module_init(nft_reject_inet_module_init);
|
|
module_exit(nft_reject_inet_module_exit);
|
|
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
|
|
MODULE_ALIAS_NFT_AF_EXPR(1, "reject");
|