2 * IP6 tables REJECT target module
3 * Linux INET6 implementation
5 * Copyright (C)2003 USAGI/WIDE Project
8 * Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
10 * Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
12 * Based on net/ipv4/netfilter/ipt_REJECT.c
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
21 #include <linux/gfp.h>
22 #include <linux/module.h>
23 #include <linux/skbuff.h>
24 #include <linux/icmpv6.h>
25 #include <linux/netdevice.h>
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
32 #include <net/netfilter/ipv6/nf_reject.h>
34 MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
35 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
36 MODULE_LICENSE("GPL");
39 reject_tg6(struct sk_buff
*skb
, const struct xt_action_param
*par
)
41 const struct ip6t_reject_info
*reject
= par
->targinfo
;
42 struct net
*net
= par
->net
;
44 switch (reject
->with
) {
45 case IP6T_ICMP6_NO_ROUTE
:
46 nf_send_unreach6(net
, skb
, ICMPV6_NOROUTE
, par
->hooknum
);
48 case IP6T_ICMP6_ADM_PROHIBITED
:
49 nf_send_unreach6(net
, skb
, ICMPV6_ADM_PROHIBITED
, par
->hooknum
);
51 case IP6T_ICMP6_NOT_NEIGHBOUR
:
52 nf_send_unreach6(net
, skb
, ICMPV6_NOT_NEIGHBOUR
, par
->hooknum
);
54 case IP6T_ICMP6_ADDR_UNREACH
:
55 nf_send_unreach6(net
, skb
, ICMPV6_ADDR_UNREACH
, par
->hooknum
);
57 case IP6T_ICMP6_PORT_UNREACH
:
58 nf_send_unreach6(net
, skb
, ICMPV6_PORT_UNREACH
, par
->hooknum
);
60 case IP6T_ICMP6_ECHOREPLY
:
64 nf_send_reset6(net
, skb
, par
->hooknum
);
66 case IP6T_ICMP6_POLICY_FAIL
:
67 nf_send_unreach6(net
, skb
, ICMPV6_POLICY_FAIL
, par
->hooknum
);
69 case IP6T_ICMP6_REJECT_ROUTE
:
70 nf_send_unreach6(net
, skb
, ICMPV6_REJECT_ROUTE
, par
->hooknum
);
77 static int reject_tg6_check(const struct xt_tgchk_param
*par
)
79 const struct ip6t_reject_info
*rejinfo
= par
->targinfo
;
80 const struct ip6t_entry
*e
= par
->entryinfo
;
82 if (rejinfo
->with
== IP6T_ICMP6_ECHOREPLY
) {
83 pr_info("ECHOREPLY is not supported.\n");
85 } else if (rejinfo
->with
== IP6T_TCP_RESET
) {
86 /* Must specify that it's a TCP packet */
87 if (!(e
->ipv6
.flags
& IP6T_F_PROTO
) ||
88 e
->ipv6
.proto
!= IPPROTO_TCP
||
89 (e
->ipv6
.invflags
& XT_INV_PROTO
)) {
90 pr_info("TCP_RESET illegal for non-tcp\n");
97 static struct xt_target reject_tg6_reg __read_mostly
= {
99 .family
= NFPROTO_IPV6
,
100 .target
= reject_tg6
,
101 .targetsize
= sizeof(struct ip6t_reject_info
),
103 .hooks
= (1 << NF_INET_LOCAL_IN
) | (1 << NF_INET_FORWARD
) |
104 (1 << NF_INET_LOCAL_OUT
),
105 .checkentry
= reject_tg6_check
,
109 static int __init
reject_tg6_init(void)
111 return xt_register_target(&reject_tg6_reg
);
114 static void __exit
reject_tg6_exit(void)
116 xt_unregister_target(&reject_tg6_reg
);
119 module_init(reject_tg6_init
);
120 module_exit(reject_tg6_exit
);