2 * IP6 tables REJECT target module
3 * Linux INET6 implementation
5 * Copyright (C)2003 USAGI/WIDE Project
8 * Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
10 * Copyright (c) 2005-2007 Patrick McHardy <kaber@trash.net>
12 * Based on net/ipv4/netfilter/ipt_REJECT.c
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
21 #include <linux/gfp.h>
22 #include <linux/module.h>
23 #include <linux/skbuff.h>
24 #include <linux/icmpv6.h>
25 #include <linux/netdevice.h>
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
32 #include <net/netfilter/ipv6/nf_reject.h>
34 MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
35 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
36 MODULE_LICENSE("GPL");
39 reject_tg6(struct sk_buff
*skb
, const struct xt_action_param
*par
)
41 const struct ip6t_reject_info
*reject
= par
->targinfo
;
42 struct net
*net
= xt_net(par
);
44 switch (reject
->with
) {
45 case IP6T_ICMP6_NO_ROUTE
:
46 nf_send_unreach6(net
, skb
, ICMPV6_NOROUTE
, xt_hooknum(par
));
48 case IP6T_ICMP6_ADM_PROHIBITED
:
49 nf_send_unreach6(net
, skb
, ICMPV6_ADM_PROHIBITED
,
52 case IP6T_ICMP6_NOT_NEIGHBOUR
:
53 nf_send_unreach6(net
, skb
, ICMPV6_NOT_NEIGHBOUR
,
56 case IP6T_ICMP6_ADDR_UNREACH
:
57 nf_send_unreach6(net
, skb
, ICMPV6_ADDR_UNREACH
,
60 case IP6T_ICMP6_PORT_UNREACH
:
61 nf_send_unreach6(net
, skb
, ICMPV6_PORT_UNREACH
,
64 case IP6T_ICMP6_ECHOREPLY
:
68 nf_send_reset6(net
, skb
, xt_hooknum(par
));
70 case IP6T_ICMP6_POLICY_FAIL
:
71 nf_send_unreach6(net
, skb
, ICMPV6_POLICY_FAIL
, xt_hooknum(par
));
73 case IP6T_ICMP6_REJECT_ROUTE
:
74 nf_send_unreach6(net
, skb
, ICMPV6_REJECT_ROUTE
,
82 static int reject_tg6_check(const struct xt_tgchk_param
*par
)
84 const struct ip6t_reject_info
*rejinfo
= par
->targinfo
;
85 const struct ip6t_entry
*e
= par
->entryinfo
;
87 if (rejinfo
->with
== IP6T_ICMP6_ECHOREPLY
) {
88 pr_info_ratelimited("ECHOREPLY is not supported\n");
90 } else if (rejinfo
->with
== IP6T_TCP_RESET
) {
91 /* Must specify that it's a TCP packet */
92 if (!(e
->ipv6
.flags
& IP6T_F_PROTO
) ||
93 e
->ipv6
.proto
!= IPPROTO_TCP
||
94 (e
->ipv6
.invflags
& XT_INV_PROTO
)) {
95 pr_info_ratelimited("TCP_RESET illegal for non-tcp\n");
102 static struct xt_target reject_tg6_reg __read_mostly
= {
104 .family
= NFPROTO_IPV6
,
105 .target
= reject_tg6
,
106 .targetsize
= sizeof(struct ip6t_reject_info
),
108 .hooks
= (1 << NF_INET_LOCAL_IN
) | (1 << NF_INET_FORWARD
) |
109 (1 << NF_INET_LOCAL_OUT
),
110 .checkentry
= reject_tg6_check
,
114 static int __init
reject_tg6_init(void)
116 return xt_register_target(&reject_tg6_reg
);
119 static void __exit
reject_tg6_exit(void)
121 xt_unregister_target(&reject_tg6_reg
);
124 module_init(reject_tg6_init
);
125 module_exit(reject_tg6_exit
);