IPTables: Added support for Reject with TCP Reset.

iptables_test: Fixed some of the broken ipv6 tests.
PiperOrigin-RevId: 940087094

Author: parth-opensrc

pkg/abi/linux/netfilter.go

@@ -859,3 +859,53 @@ type XTMarkMtinfo1 struct {
 
 // SizeOfXTMarkMtinfo1 is the size of XTMarkMtinfo1.
 const SizeOfXTMarkMtinfo1 = 12
+
+// Ref: include/uapi/linux/netfilter_ipv4/ipt_REJECT.h:enum ipt_reject_with
+const (
+	IPT_ICMP_NET_UNREACHABLE = iota
+	IPT_ICMP_HOST_UNREACHABLE
+	IPT_ICMP_PROT_UNREACHABLE
+	IPT_ICMP_PORT_UNREACHABLE
+	IPT_ICMP_ECHOREPLY
+	IPT_ICMP_NET_PROHIBITED
+	IPT_ICMP_HOST_PROHIBITED
+	IPT_TCP_RESET
+	IPT_ICMP_ADMIN_PROHIBITED
+)
+
+// Ref: include/uapi/linux/netfilter_ipv6/ip6t_REJECT.h:enum ip6t_reject_with
+const (
+	IP6T_ICMP6_NO_ROUTE = iota
+	IP6T_ICMP6_ADM_PROHIBITED
+	IP6T_ICMP6_NOT_NEIGHBOUR
+	IP6T_ICMP6_ADDR_UNREACH
+	IP6T_ICMP6_PORT_UNREACH
+	IP6T_ICMP6_ECHOREPLY
+	IP6T_TCP_RESET
+	IP6T_ICMP6_POLICY_FAIL
+	IP6T_ICMP6_REJECT_ROUTE
+)
+
+// IPTRejectInfo is the argument for the IPT_REJECT target. It corresponds to
+// struct ipt_reject_info in include/uapi/linux/netfilter_ipv4/ipt_REJECT.h.
+//
+// +marshal
+type IPTRejectInfo struct {
+	_    structs.HostLayout
+	With uint32
+}
+
+// SizeOfIPTRejectInfo is the size of an IPTRejectInfo.
+const SizeOfIPTRejectInfo = 4
+
+// IP6TRejectInfo is the argument for the IP6T_REJECT target. It corresponds to
+// struct ip6t_reject_info in include/uapi/linux/netfilter_ipv6/ip6t_REJECT.h.
+//
+// +marshal
+type IP6TRejectInfo struct {
+	_    structs.HostLayout
+	With uint32
+}
+
+// SizeOfIP6TRejectInfo is the size of an IP6TRejectInfo.
+const SizeOfIP6TRejectInfo = 4

pkg/sentry/socket/netfilter/ipv4.go

@@ -186,6 +186,20 @@ func modifyEntries4(mapper IDMapper, stk *stack.Stack, optVal []byte, replace *l
 				nflog("failed to parse target: %v", err)
 				return nil, err
 			}
+			// Set the handler for REJECT targets.
+			if rejectTarget, ok := target.(*rejectIPv4Target); ok {
+				if replace.Name.String() != filterTable {
+					nflog("REJECT target is only supported in the filter table")
+					return nil, syserr.ErrInvalidArgument
+				}
+				netProto := stk.NetworkProtocolInstance(header.IPv4ProtocolNumber)
+				handler, ok := netProto.(stack.RejectIPv4WithHandler)
+				if !ok {
+					nflog("modifyEntries4: expected %T to implement stack.RejectIPv4WithHandler", netProto)
+					return nil, syserr.ErrInvalidArgument
+				}
+				rejectTarget.Handler = handler
+			}
 			rule.Target = target
 		}
 		optVal = optVal[targetSize:]

pkg/sentry/socket/netfilter/ipv6.go

@@ -189,6 +189,20 @@ func modifyEntries6(mapper IDMapper, stk *stack.Stack, optVal []byte, replace *l
 				nflog("failed to parse target: %v", err)
 				return nil, err
 			}
+			// Set the handler for REJECT targets.
+			if rejectTarget, ok := target.(*rejectIPv6Target); ok {
+				if replace.Name.String() != filterTable {
+					nflog("REJECT target is only supported in the filter table")
+					return nil, syserr.ErrInvalidArgument
+				}
+				netProto := stk.NetworkProtocolInstance(header.IPv6ProtocolNumber)
+				handler, ok := netProto.(stack.RejectIPv6WithHandler)
+				if !ok {
+					nflog("modifyEntries6: expected %T to implement stack.RejectIPv6WithHandler", netProto)
+					return nil, syserr.ErrInvalidArgument
+				}
+				rejectTarget.Handler = handler
+			}
 			rule.Target = target
 		}
 		optVal = optVal[targetSize:]

pkg/sentry/socket/netfilter/targets.go

@@ -19,6 +19,7 @@ import (
 	"fmt"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/bits"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/marshal"
 	"gvisor.dev/gvisor/pkg/syserr"
@@ -103,6 +104,15 @@ func init() {
 	registerTargetMaker(&dnatTargetMakerR2{
 		NetworkProtocol: header.IPv6ProtocolNumber,
 	})
+
+	// REJECT targets.
+	registerTargetMaker(&rejectTargetMaker{
+		NetworkProtocol: header.IPv4ProtocolNumber,
+	})
+	registerTargetMaker(&rejectTargetMaker{
+		NetworkProtocol: header.IPv6ProtocolNumber,
+	})
+
 }
 
 // The stack package provides some basic, useful targets for us. The following
@@ -533,3 +543,210 @@ func htons(port uint16) uint16 {
 	hostarch.ByteOrder.PutUint16(buf, port)
 	return binary.BigEndian.Uint16(buf)
 }
+
+// RejectTargetName is used to mark targets as reject targets.
+const RejectTargetName = "REJECT"
+
+// +stateify savable
+type rejectIPv4Target struct {
+	stack.RejectIPv4Target
+}
+
+func (rt *rejectIPv4Target) id() targetID {
+	return targetID{
+		name:            RejectTargetName,
+		networkProtocol: header.IPv4ProtocolNumber,
+	}
+}
+
+// +stateify savable
+type rejectIPv6Target struct {
+	stack.RejectIPv6Target
+}
+
+func (rt *rejectIPv6Target) id() targetID {
+	return targetID{
+		name:            RejectTargetName,
+		networkProtocol: header.IPv6ProtocolNumber,
+	}
+}
+
+// +stateify savable
+type rejectTargetMaker struct {
+	NetworkProtocol tcpip.NetworkProtocolNumber
+}
+
+func (rm *rejectTargetMaker) id() targetID {
+	return targetID{
+		name:            RejectTargetName,
+		networkProtocol: rm.NetworkProtocol,
+	}
+}
+
+func (rm *rejectTargetMaker) marshalIPv4(tgt target) []byte {
+	rt := tgt.(*rejectIPv4Target)
+	size := bits.AlignUp(linux.SizeOfXTEntryTarget+linux.SizeOfIPTRejectInfo, 8)
+	xt := linux.XTEntryTarget{
+		TargetSize: uint16(size),
+	}
+	copy(xt.Name[:], RejectTargetName)
+
+	var with uint32
+	switch rt.RejectWith {
+	case stack.RejectIPv4WithICMPNetUnreachable:
+		with = linux.IPT_ICMP_NET_UNREACHABLE
+	case stack.RejectIPv4WithICMPHostUnreachable:
+		with = linux.IPT_ICMP_HOST_UNREACHABLE
+	case stack.RejectIPv4WithICMPPortUnreachable:
+		with = linux.IPT_ICMP_PORT_UNREACHABLE
+	case stack.RejectIPv4WithICMPNetProhibited:
+		with = linux.IPT_ICMP_NET_PROHIBITED
+	case stack.RejectIPv4WithICMPHostProhibited:
+		with = linux.IPT_ICMP_HOST_PROHIBITED
+	case stack.RejectIPv4WithICMPAdminProhibited:
+		with = linux.IPT_ICMP_ADMIN_PROHIBITED
+	case stack.RejectIPv4WithTCPReset:
+		with = linux.IPT_TCP_RESET
+	case stack.RejectIPv4WithICMPEchoReply:
+		with = linux.IPT_ICMP_ECHOREPLY
+	default:
+		panic(fmt.Sprintf("unknown reject option %v", rt.RejectWith))
+	}
+
+	info := linux.IPTRejectInfo{With: with}
+
+	buf := make([]byte, size)
+	bufRemain := xt.MarshalUnsafe(buf)
+	info.MarshalUnsafe(bufRemain)
+	return buf
+}
+
+func (rm *rejectTargetMaker) marshalIPv6(tgt target) []byte {
+	rt := tgt.(*rejectIPv6Target)
+	size := bits.AlignUp(linux.SizeOfXTEntryTarget+linux.SizeOfIP6TRejectInfo, 8)
+	xt := linux.XTEntryTarget{
+		TargetSize: uint16(size),
+	}
+	copy(xt.Name[:], RejectTargetName)
+
+	var with uint32
+	switch rt.RejectWith {
+	case stack.RejectIPv6WithICMPNoRoute:
+		with = linux.IP6T_ICMP6_NO_ROUTE
+	case stack.RejectIPv6WithICMPAddrUnreachable:
+		with = linux.IP6T_ICMP6_ADDR_UNREACH
+	case stack.RejectIPv6WithICMPPortUnreachable:
+		with = linux.IP6T_ICMP6_PORT_UNREACH
+	case stack.RejectIPv6WithICMPAdminProhibited:
+		with = linux.IP6T_ICMP6_ADM_PROHIBITED
+	case stack.RejectIPv6WithTCPReset:
+		with = linux.IP6T_TCP_RESET
+	case stack.RejectIPv6WithICMPNotNeighbour:
+		with = linux.IP6T_ICMP6_NOT_NEIGHBOUR
+	case stack.RejectIPv6WithICMPPolicyFail:
+		with = linux.IP6T_ICMP6_POLICY_FAIL
+	case stack.RejectIPv6WithICMPRejectRoute:
+		with = linux.IP6T_ICMP6_REJECT_ROUTE
+	default:
+		panic(fmt.Sprintf("unknown reject option %v", rt.RejectWith))
+	}
+
+	info := linux.IP6TRejectInfo{With: with}
+
+	buf := make([]byte, size)
+	bufRemain := xt.MarshalUnsafe(buf)
+	info.MarshalUnsafe(bufRemain)
+	return buf
+}
+
+func (rm *rejectTargetMaker) marshal(tgt target) []byte {
+	netProto := rm.NetworkProtocol
+	switch rm.NetworkProtocol {
+	case header.IPv4ProtocolNumber:
+		return rm.marshalIPv4(tgt)
+	case header.IPv6ProtocolNumber:
+		return rm.marshalIPv6(tgt)
+	default:
+		panic(fmt.Sprintf("unsupported network protocol %d", netProto))
+	}
+}
+
+func (rm *rejectTargetMaker) unmarshalIPv4(buf []byte, filter stack.IPHeaderFilter) (target, *syserr.Error) {
+	if len(buf) < linux.SizeOfXTEntryTarget+linux.SizeOfIPTRejectInfo {
+		nflog("rejectTargetMaker: buf has insufficient size %d", len(buf))
+		return nil, syserr.ErrInvalidArgument
+	}
+
+	var info linux.IPTRejectInfo
+	info.UnmarshalUnsafe(buf[linux.SizeOfXTEntryTarget:])
+
+	var rejectWith stack.RejectIPv4WithICMPType
+	switch info.With {
+	case linux.IPT_ICMP_PORT_UNREACHABLE:
+		rejectWith = stack.RejectIPv4WithICMPPortUnreachable
+	case linux.IPT_TCP_RESET:
+		if filter.Protocol != header.TCPProtocolNumber {
+			nflog("rejectTargetMaker: TCP_RESET invalid for non-tcp")
+			return nil, syserr.ErrInvalidArgument
+		}
+		rejectWith = stack.RejectIPv4WithTCPReset
+	case linux.IPT_ICMP_HOST_UNREACHABLE, linux.IPT_ICMP_NET_UNREACHABLE,
+		linux.IPT_ICMP_HOST_PROHIBITED, linux.IPT_ICMP_NET_PROHIBITED, linux.IPT_ICMP_ADMIN_PROHIBITED:
+
+		nflog("rejectTargetMaker: unsupported reject type %d", info.With)
+		return nil, syserr.ErrNotSupported
+	default:
+		nflog("rejectTargetMaker: unknown reject type %d", info.With)
+		return nil, syserr.ErrInvalidArgument
+	}
+
+	return &rejectIPv4Target{stack.RejectIPv4Target{
+		RejectWith: rejectWith,
+	}}, nil
+}
+
+func (rm *rejectTargetMaker) unmarshalIPv6(buf []byte, filter stack.IPHeaderFilter) (target, *syserr.Error) {
+	if len(buf) < linux.SizeOfXTEntryTarget+linux.SizeOfIP6TRejectInfo {
+		nflog("rejectTargetMaker: buf has insufficient size %d", len(buf))
+		return nil, syserr.ErrInvalidArgument
+	}
+
+	var info linux.IP6TRejectInfo
+	info.UnmarshalUnsafe(buf[linux.SizeOfXTEntryTarget:])
+
+	var rejectWith stack.RejectIPv6WithICMPType
+	switch info.With {
+	case linux.IP6T_ICMP6_PORT_UNREACH:
+		rejectWith = stack.RejectIPv6WithICMPPortUnreachable
+	case linux.IP6T_TCP_RESET:
+		if filter.Protocol != header.TCPProtocolNumber {
+			nflog("rejectTargetMaker: TCP_RESET invalid for non-tcp")
+			return nil, syserr.ErrInvalidArgument
+		}
+		rejectWith = stack.RejectIPv6WithTCPReset
+	case linux.IP6T_ICMP6_NO_ROUTE, linux.IP6T_ICMP6_ADM_PROHIBITED, linux.IP6T_ICMP6_NOT_NEIGHBOUR,
+		linux.IP6T_ICMP6_ADDR_UNREACH, linux.IP6T_ICMP6_POLICY_FAIL, linux.IP6T_ICMP6_REJECT_ROUTE:
+
+		nflog("rejectTargetMaker: unsupported reject type %d", info.With)
+		return nil, syserr.ErrNotSupported
+	default:
+		nflog("rejectTargetMaker: unknown reject type %d", info.With)
+		return nil, syserr.ErrInvalidArgument
+	}
+
+	return &rejectIPv6Target{stack.RejectIPv6Target{
+		RejectWith: rejectWith,
+	}}, nil
+}
+
+func (rm *rejectTargetMaker) unmarshal(buf []byte, filter stack.IPHeaderFilter) (target, *syserr.Error) {
+	switch filter.NetworkProtocol() {
+	case header.IPv4ProtocolNumber:
+		return rm.unmarshalIPv4(buf, filter)
+	case header.IPv6ProtocolNumber:
+		return rm.unmarshalIPv6(buf, filter)
+	default:
+		nflog("rejectTargetMaker: unsupported network protocol %d", filter.NetworkProtocol())
+		return nil, syserr.ErrInvalidArgument
+	}
+}

pkg/tcpip/network/internal/ip/BUILD

@@ -11,6 +11,7 @@ go_library(
         "duplicate_address_detection.go",
         "errors.go",
         "generic_multicast_protocol.go",
+        "reject_with_reset.go",
         "stats.go",
     ],
     visibility = [
@@ -19,6 +20,7 @@ go_library(
         "//pkg/tcpip/network/ipv6:__pkg__",
     ],
     deps = [
+        "//pkg/buffer",
         "//pkg/sync",
         "//pkg/tcpip",
         "//pkg/tcpip/header",