[deliverable/linux.git] / net / ipv6 / netfilter / ip6t_REJECT.c

/*
 * IP6 tables REJECT target module
 * Linux INET6 implementation
 *
 * Copyright (C)2003 USAGI/WIDE Project
 *
 * Authors:
 *	Yasuyuki Kozakai	<yasuyuki.kozakai@toshiba.co.jp>
 *
 * Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
 *
 * Based on net/ipv4/netfilter/ipt_REJECT.c
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/gfp.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/icmpv6.h>
#include <linux/netdevice.h>
#include <net/icmp.h>
#include <net/flow.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter_ipv6/ip6t_REJECT.h>

#include <net/netfilter/ipv6/nf_reject.h>

MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
MODULE_LICENSE("GPL");


static unsigned int
reject_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct ip6t_reject_info *reject = par->targinfo;
	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);

	pr_debug("%s: medium point\n", __func__);
	switch (reject->with) {
	case IP6T_ICMP6_NO_ROUTE:
		nf_send_unreach6(net, skb, ICMPV6_NOROUTE, par->hooknum);
		break;
	case IP6T_ICMP6_ADM_PROHIBITED:
		nf_send_unreach6(net, skb, ICMPV6_ADM_PROHIBITED, par->hooknum);
		break;
	case IP6T_ICMP6_NOT_NEIGHBOUR:
		nf_send_unreach6(net, skb, ICMPV6_NOT_NEIGHBOUR, par->hooknum);
		break;
	case IP6T_ICMP6_ADDR_UNREACH:
		nf_send_unreach6(net, skb, ICMPV6_ADDR_UNREACH, par->hooknum);
		break;
	case IP6T_ICMP6_PORT_UNREACH:
		nf_send_unreach6(net, skb, ICMPV6_PORT_UNREACH, par->hooknum);
		break;
	case IP6T_ICMP6_ECHOREPLY:
		/* Do nothing */
		break;
	case IP6T_TCP_RESET:
		nf_send_reset6(net, skb, par->hooknum);
		break;
	default:
		net_info_ratelimited("case %u not handled yet\n", reject->with);
		break;
	}

	return NF_DROP;
}

static int reject_tg6_check(const struct xt_tgchk_param *par)
{
	const struct ip6t_reject_info *rejinfo = par->targinfo;
	const struct ip6t_entry *e = par->entryinfo;

	if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
		pr_info("ECHOREPLY is not supported.\n");
		return -EINVAL;
	} else if (rejinfo->with == IP6T_TCP_RESET) {
		/* Must specify that it's a TCP packet */
		if (e->ipv6.proto != IPPROTO_TCP ||
		    (e->ipv6.invflags & XT_INV_PROTO)) {
			pr_info("TCP_RESET illegal for non-tcp\n");
			return -EINVAL;
		}
	}
	return 0;
}

static struct xt_target reject_tg6_reg __read_mostly = {
	.name		= "REJECT",
	.family		= NFPROTO_IPV6,
	.target		= reject_tg6,
	.targetsize	= sizeof(struct ip6t_reject_info),
	.table		= "filter",
	.hooks		= (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
			  (1 << NF_INET_LOCAL_OUT),
	.checkentry	= reject_tg6_check,
	.me		= THIS_MODULE
};

static int __init reject_tg6_init(void)
{
	return xt_register_target(&reject_tg6_reg);
}

static void __exit reject_tg6_exit(void)
{
	xt_unregister_target(&reject_tg6_reg);
}

module_init(reject_tg6_init);
module_exit(reject_tg6_exit);
Commit	Line	Data
764d8a9f PM	1	/*
	2	* IP6 tables REJECT target module
	3	* Linux INET6 implementation
	4	*
	5	* Copyright (C)2003 USAGI/WIDE Project
	6	*
	7	* Authors:
	8	* Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
	9	*
f229f6ce PM	10	* Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
f229f6ce PM	11	*
764d8a9f PM	12	* Based on net/ipv4/netfilter/ipt_REJECT.c
	13	*
	14	* This program is free software; you can redistribute it and/or
	15	* modify it under the terms of the GNU General Public License
	16	* as published by the Free Software Foundation; either version
	17	* 2 of the License, or (at your option) any later version.
	18	*/
ff67e4e4	19	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
764d8a9f	20
5a0e3ad6	21	#include <linux/gfp.h>
764d8a9f PM	22	#include <linux/module.h>
	23	#include <linux/skbuff.h>
	24	#include <linux/icmpv6.h>
	25	#include <linux/netdevice.h>
764d8a9f	26	#include <net/icmp.h>
764d8a9f	27	#include <net/flow.h>
6709dbbb	28	#include <linux/netfilter/x_tables.h>
764d8a9f PM	29	#include <linux/netfilter_ipv6/ip6_tables.h>
	30	#include <linux/netfilter_ipv6/ip6t_REJECT.h>
	31
cc70d069 EL	32	#include <net/netfilter/ipv6/nf_reject.h>
cc70d069 EL	33
764d8a9f	34	MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
2ae15b64	35	MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
764d8a9f PM	36	MODULE_LICENSE("GPL");
764d8a9f PM	37
764d8a9f	38
d3c5ee6d	39	static unsigned int
4b560b44	40	reject_tg6(struct sk_buff skb, const struct xt_action_param par)
764d8a9f	41	{
7eb35586 JE	42	const struct ip6t_reject_info *reject = par->targinfo;
7eb35586 JE	43	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
764d8a9f	44
0dc47877	45	pr_debug("%s: medium point\n", __func__);
1ab1457c YH	46	switch (reject->with) {
1ab1457c YH	47	case IP6T_ICMP6_NO_ROUTE:
cc70d069	48	nf_send_unreach6(net, skb, ICMPV6_NOROUTE, par->hooknum);
1ab1457c YH	49	break;
1ab1457c YH	50	case IP6T_ICMP6_ADM_PROHIBITED:
cc70d069	51	nf_send_unreach6(net, skb, ICMPV6_ADM_PROHIBITED, par->hooknum);
1ab1457c YH	52	break;
1ab1457c YH	53	case IP6T_ICMP6_NOT_NEIGHBOUR:
cc70d069	54	nf_send_unreach6(net, skb, ICMPV6_NOT_NEIGHBOUR, par->hooknum);
1ab1457c YH	55	break;
1ab1457c YH	56	case IP6T_ICMP6_ADDR_UNREACH:
cc70d069	57	nf_send_unreach6(net, skb, ICMPV6_ADDR_UNREACH, par->hooknum);
1ab1457c YH	58	break;
1ab1457c YH	59	case IP6T_ICMP6_PORT_UNREACH:
cc70d069	60	nf_send_unreach6(net, skb, ICMPV6_PORT_UNREACH, par->hooknum);
1ab1457c YH	61	break;
1ab1457c YH	62	case IP6T_ICMP6_ECHOREPLY:
764d8a9f PM	63	/* Do nothing */
	64	break;
	65	case IP6T_TCP_RESET:
cc70d069	66	nf_send_reset6(net, skb, par->hooknum);
764d8a9f PM	67	break;
764d8a9f PM	68	default:
e87cc472	69	net_info_ratelimited("case %u not handled yet\n", reject->with);
764d8a9f PM	70	break;
	71	}
	72
	73	return NF_DROP;
	74	}
	75
135367b8	76	static int reject_tg6_check(const struct xt_tgchk_param *par)
764d8a9f	77	{
af5d6dc2 JE	78	const struct ip6t_reject_info *rejinfo = par->targinfo;
af5d6dc2 JE	79	const struct ip6t_entry *e = par->entryinfo;
764d8a9f	80
764d8a9f	81	if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
ff67e4e4	82	pr_info("ECHOREPLY is not supported.\n");
d6b00a53	83	return -EINVAL;
764d8a9f PM	84	} else if (rejinfo->with == IP6T_TCP_RESET) {
764d8a9f PM	85	/* Must specify that it's a TCP packet */
3666ed1c JP	86	if (e->ipv6.proto != IPPROTO_TCP \|\|
3666ed1c JP	87	(e->ipv6.invflags & XT_INV_PROTO)) {
ff67e4e4	88	pr_info("TCP_RESET illegal for non-tcp\n");
d6b00a53	89	return -EINVAL;
764d8a9f PM	90	}
764d8a9f PM	91	}
d6b00a53	92	return 0;
764d8a9f PM	93	}
764d8a9f PM	94
d3c5ee6d	95	static struct xt_target reject_tg6_reg __read_mostly = {
764d8a9f	96	.name = "REJECT",
ee999d8b	97	.family = NFPROTO_IPV6,
d3c5ee6d	98	.target = reject_tg6,
7f939713 PM	99	.targetsize = sizeof(struct ip6t_reject_info),
7f939713 PM	100	.table = "filter",
6e23ae2a PM	101	.hooks = (1 << NF_INET_LOCAL_IN) \| (1 << NF_INET_FORWARD) \|
6e23ae2a PM	102	(1 << NF_INET_LOCAL_OUT),
d3c5ee6d	103	.checkentry = reject_tg6_check,
764d8a9f PM	104	.me = THIS_MODULE
	105	};
	106
d3c5ee6d	107	static int __init reject_tg6_init(void)
764d8a9f	108	{
d3c5ee6d	109	return xt_register_target(&reject_tg6_reg);
764d8a9f PM	110	}
764d8a9f PM	111
d3c5ee6d	112	static void __exit reject_tg6_exit(void)
764d8a9f	113	{
d3c5ee6d	114	xt_unregister_target(&reject_tg6_reg);
764d8a9f PM	115	}
764d8a9f PM	116
d3c5ee6d JE	117	module_init(reject_tg6_init);
d3c5ee6d JE	118	module_exit(reject_tg6_exit);