evaluate: reject: Allow icmpx in inet/bridge families

Commit 3e6ab2b335142 added restraints on reject types for bridge and
inet families but aparently those were too strict: If a rule in e.g.
inet family contained a match which introduced a protocol dependency,
icmpx type rejects were disallowed for no obvious reason.

Allow icmpx type rejects in inet family regardless of protocol
dependency since we either have IPv4 or IPv6 traffic in there and for
both icmpx is fine.

Merge restraints in bridge family with those for TCP reset since it
already does what is needed, namely checking that ether proto is either
IPv4 or IPv6.

Fixes: 3e6ab2b335142 ("evaluate: reject: check in bridge and inet the network context in reject")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 3f57ef60cb7575dfcfa201798dad1405e1ea0ba9..3f15b322d503817570ec5fc4c02ed6346fde28a5 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2143,9 +2143,7 @@ static int stmt_evaluate_reject_inet_family(struct eval_ctx *ctx,
        case NFT_REJECT_TCP_RST:
                break;
        case NFT_REJECT_ICMPX_UNREACH:
-               return stmt_binary_error(ctx, stmt->reject.expr,
-                                   &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR],
-                                   "conflicting network protocol specified");
+               break;
        case NFT_REJECT_ICMP_UNREACH:
                base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
                protocol = proto_find_num(base, desc);
@@ -2196,9 +2194,6 @@ static int stmt_evaluate_reject_bridge_family(struct eval_ctx *ctx,
 
        switch (stmt->reject.type) {
        case NFT_REJECT_ICMPX_UNREACH:
-               return stmt_binary_error(ctx, stmt->reject.expr,
-                                   &ctx->pctx.protocol[PROTO_BASE_NETWORK_HDR],
-                                   "conflicting network protocol specified");
        case NFT_REJECT_TCP_RST:
                base = ctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
                protocol = proto_find_num(base, desc);

diff --git a/tests/py/bridge/reject.t b/tests/py/bridge/reject.t
index d1c2ecab5fc0785178d6ef3a8fabee6497c5331f..ad5280f7d5730e1a6307bcd88769b152eeab363f 100644 (file)
--- a/tests/py/bridge/reject.t
+++ b/tests/py/bridge/reject.t
@@ -37,3 +37,8 @@ ether type arp reject;fail
 ether type vlan reject with tcp reset;fail
 ether type arp reject with tcp reset;fail
 ip protocol udp reject with tcp reset;fail
+
+ether type ip reject with icmpx type admin-prohibited;ok
+ether type ip6 reject with icmpx type admin-prohibited;ok
+ether type vlan reject with icmpx type admin-prohibited;fail
+ether type arp reject with icmpx type admin-prohibited;fail

diff --git a/tests/py/bridge/reject.t.json b/tests/py/bridge/reject.t.json
index aa716f807066636cc9d9a591110b998913fbc11b..c0bed56e6ce417489af66e11dcf487e2bff1ad9f 100644 (file)
--- a/tests/py/bridge/reject.t.json
+++ b/tests/py/bridge/reject.t.json
@@ -219,3 +219,47 @@
     }
 ]
 
+# ether type ip reject with icmpx type admin-prohibited
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "type",
+                    "protocol": "ether"
+                }
+            },
+            "op": "==",
+            "right": "ip"
+        }
+    },
+    {
+        "reject": {
+            "expr": "admin-prohibited",
+            "type": "icmpx"
+        }
+    }
+]
+
+# ether type ip6 reject with icmpx type admin-prohibited
+[
+    {
+        "match": {
+            "left": {
+                "payload": {
+                    "field": "type",
+                    "protocol": "ether"
+                }
+            },
+            "op": "==",
+            "right": "ip6"
+        }
+    },
+    {
+        "reject": {
+            "expr": "admin-prohibited",
+            "type": "icmpx"
+        }
+    }
+]
+

diff --git a/tests/py/bridge/reject.t.payload b/tests/py/bridge/reject.t.payload
index b984f6f8de4d6ce227462cc2e460758a8259d46f..888179df9c9777c88ecf1476334d5acea907dfab 100644 (file)
--- a/tests/py/bridge/reject.t.payload
+++ b/tests/py/bridge/reject.t.payload
@@ -106,3 +106,15 @@ bridge test-bridge input
 bridge test-bridge input
   [ reject type 2 code 1 ]
 
+# ether type ip reject with icmpx type admin-prohibited
+bridge test-bridge input
+  [ payload load 2b @ link header + 12 => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+  [ reject type 2 code 3 ]
+
+# ether type ip6 reject with icmpx type admin-prohibited
+bridge test-bridge input
+  [ payload load 2b @ link header + 12 => reg 1 ]
+  [ cmp eq reg 1 0x0000dd86 ]
+  [ reject type 2 code 3 ]
+

diff --git a/tests/py/inet/reject.t b/tests/py/inet/reject.t
index cb3caa4aca5c83e7af5151bf43d18df50820e74f..0e8966c9a389cd70d4a1f7cd47d7f6f150132026 100644 (file)
--- a/tests/py/inet/reject.t
+++ b/tests/py/inet/reject.t
@@ -34,3 +34,6 @@ meta nfproto ipv6 reject with icmp type host-unreachable;fail
 meta nfproto ipv4 ip protocol icmp reject with icmpv6 type no-route;fail
 meta nfproto ipv6 ip protocol icmp reject with icmp type host-unreachable;fail
 meta l4proto udp reject with tcp reset;fail
+
+meta nfproto ipv4 reject with icmpx type admin-prohibited;ok
+meta nfproto ipv6 reject with icmpx type admin-prohibited;ok

diff --git a/tests/py/inet/reject.t.json b/tests/py/inet/reject.t.json
index 0939f4450509b4fd9968d4dec7a3b26282c41f50..46d4857a57c9901d1d42968622002a1ddf7fafd1 100644 (file)
--- a/tests/py/inet/reject.t.json
+++ b/tests/py/inet/reject.t.json
@@ -238,3 +238,45 @@
     }
 ]
 
+# meta nfproto ipv4 reject with icmpx type admin-prohibited
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "nfproto"
+                }
+            },
+            "op": "==",
+            "right": "ipv4"
+        }
+    },
+    {
+        "reject": {
+            "expr": "admin-prohibited",
+            "type": "icmpx"
+        }
+    }
+]
+
+# meta nfproto ipv6 reject with icmpx type admin-prohibited
+[
+    {
+        "match": {
+            "left": {
+                "meta": {
+                    "key": "nfproto"
+                }
+            },
+            "op": "==",
+            "right": "ipv6"
+        }
+    },
+    {
+        "reject": {
+            "expr": "admin-prohibited",
+            "type": "icmpx"
+        }
+    }
+]
+

diff --git a/tests/py/inet/reject.t.payload.inet b/tests/py/inet/reject.t.payload.inet
index 7a6468e81f9e71a2617db5114fc4524ab4d43f05..ee1aae02f1e1d14d8c74f6c7f324100f64d3c09a 100644 (file)
--- a/tests/py/inet/reject.t.payload.inet
+++ b/tests/py/inet/reject.t.payload.inet
@@ -220,3 +220,15 @@ inet test-inet input
   [ cmp eq reg 1 0x0000000a ]
   [ reject type 0 code 0 ]
 
+# meta nfproto ipv4 reject with icmpx type admin-prohibited
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ reject type 2 code 3 ]
+
+# meta nfproto ipv6 reject with icmpx type admin-prohibited
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x0000000a ]
+  [ reject type 2 code 3 ]
+