2 * This is a module which is used for rejecting packets.
5 /* (C) 1999-2001 Paul `Rusty' Russell
6 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/slab.h>
17 #include <linux/udp.h>
18 #include <linux/icmp.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter_ipv4/ip_tables.h>
22 #include <linux/netfilter_ipv4/ipt_REJECT.h>
23 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
24 #include <linux/netfilter_bridge.h>
27 #include <net/netfilter/ipv4/nf_reject.h>
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
31 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");
34 reject_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
36 const struct ipt_reject_info
*reject
= par
->targinfo
;
37 int hook
= par
->hooknum
;
39 switch (reject
->with
) {
40 case IPT_ICMP_NET_UNREACHABLE
:
41 nf_send_unreach(skb
, ICMP_NET_UNREACH
, hook
);
43 case IPT_ICMP_HOST_UNREACHABLE
:
44 nf_send_unreach(skb
, ICMP_HOST_UNREACH
, hook
);
46 case IPT_ICMP_PROT_UNREACHABLE
:
47 nf_send_unreach(skb
, ICMP_PROT_UNREACH
, hook
);
49 case IPT_ICMP_PORT_UNREACHABLE
:
50 nf_send_unreach(skb
, ICMP_PORT_UNREACH
, hook
);
52 case IPT_ICMP_NET_PROHIBITED
:
53 nf_send_unreach(skb
, ICMP_NET_ANO
, hook
);
55 case IPT_ICMP_HOST_PROHIBITED
:
56 nf_send_unreach(skb
, ICMP_HOST_ANO
, hook
);
58 case IPT_ICMP_ADMIN_PROHIBITED
:
59 nf_send_unreach(skb
, ICMP_PKT_FILTERED
, hook
);
62 nf_send_reset(skb
, hook
);
63 case IPT_ICMP_ECHOREPLY
:
71 static int reject_tg_check(const struct xt_tgchk_param
*par
)
73 const struct ipt_reject_info
*rejinfo
= par
->targinfo
;
74 const struct ipt_entry
*e
= par
->entryinfo
;
76 if (rejinfo
->with
== IPT_ICMP_ECHOREPLY
) {
77 pr_info("ECHOREPLY no longer supported.\n");
79 } else if (rejinfo
->with
== IPT_TCP_RESET
) {
80 /* Must specify that it's a TCP packet */
81 if (e
->ip
.proto
!= IPPROTO_TCP
||
82 (e
->ip
.invflags
& XT_INV_PROTO
)) {
83 pr_info("TCP_RESET invalid for non-tcp\n");
90 static struct xt_target reject_tg_reg __read_mostly
= {
92 .family
= NFPROTO_IPV4
,
94 .targetsize
= sizeof(struct ipt_reject_info
),
96 .hooks
= (1 << NF_INET_LOCAL_IN
) | (1 << NF_INET_FORWARD
) |
97 (1 << NF_INET_LOCAL_OUT
),
98 .checkentry
= reject_tg_check
,
102 static int __init
reject_tg_init(void)
104 return xt_register_target(&reject_tg_reg
);
107 static void __exit
reject_tg_exit(void)
109 xt_unregister_target(&reject_tg_reg
);
112 module_init(reject_tg_init
);
113 module_exit(reject_tg_exit
);