1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20
21#include <linux/gfp.h>
22#include <linux/module.h>
23#include <linux/skbuff.h>
24#include <linux/icmpv6.h>
25#include <linux/netdevice.h>
26#include <net/icmp.h>
27#include <net/flow.h>
28#include <linux/netfilter/x_tables.h>
29#include <linux/netfilter_ipv6/ip6_tables.h>
30#include <linux/netfilter_ipv6/ip6t_REJECT.h>
31
32#include <net/netfilter/ipv6/nf_reject.h>
33
34MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
35MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv6");
36MODULE_LICENSE("GPL");
37
38static unsigned int
39reject_tg6(struct sk_buff *skb, const struct xt_action_param *par)
40{
41 const struct ip6t_reject_info *reject = par->targinfo;
42 struct net *net = par->net;
43
44 switch (reject->with) {
45 case IP6T_ICMP6_NO_ROUTE:
46 nf_send_unreach6(net, skb, ICMPV6_NOROUTE, par->hooknum);
47 break;
48 case IP6T_ICMP6_ADM_PROHIBITED:
49 nf_send_unreach6(net, skb, ICMPV6_ADM_PROHIBITED, par->hooknum);
50 break;
51 case IP6T_ICMP6_NOT_NEIGHBOUR:
52 nf_send_unreach6(net, skb, ICMPV6_NOT_NEIGHBOUR, par->hooknum);
53 break;
54 case IP6T_ICMP6_ADDR_UNREACH:
55 nf_send_unreach6(net, skb, ICMPV6_ADDR_UNREACH, par->hooknum);
56 break;
57 case IP6T_ICMP6_PORT_UNREACH:
58 nf_send_unreach6(net, skb, ICMPV6_PORT_UNREACH, par->hooknum);
59 break;
60 case IP6T_ICMP6_ECHOREPLY:
61
62 break;
63 case IP6T_TCP_RESET:
64 nf_send_reset6(net, skb, par->hooknum);
65 break;
66 case IP6T_ICMP6_POLICY_FAIL:
67 nf_send_unreach6(net, skb, ICMPV6_POLICY_FAIL, par->hooknum);
68 break;
69 case IP6T_ICMP6_REJECT_ROUTE:
70 nf_send_unreach6(net, skb, ICMPV6_REJECT_ROUTE, par->hooknum);
71 break;
72 }
73
74 return NF_DROP;
75}
76
77static int reject_tg6_check(const struct xt_tgchk_param *par)
78{
79 const struct ip6t_reject_info *rejinfo = par->targinfo;
80 const struct ip6t_entry *e = par->entryinfo;
81
82 if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
83 pr_info("ECHOREPLY is not supported.\n");
84 return -EINVAL;
85 } else if (rejinfo->with == IP6T_TCP_RESET) {
86
87 if (!(e->ipv6.flags & IP6T_F_PROTO) ||
88 e->ipv6.proto != IPPROTO_TCP ||
89 (e->ipv6.invflags & XT_INV_PROTO)) {
90 pr_info("TCP_RESET illegal for non-tcp\n");
91 return -EINVAL;
92 }
93 }
94 return 0;
95}
96
97static struct xt_target reject_tg6_reg __read_mostly = {
98 .name = "REJECT",
99 .family = NFPROTO_IPV6,
100 .target = reject_tg6,
101 .targetsize = sizeof(struct ip6t_reject_info),
102 .table = "filter",
103 .hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) |
104 (1 << NF_INET_LOCAL_OUT),
105 .checkentry = reject_tg6_check,
106 .me = THIS_MODULE
107};
108
109static int __init reject_tg6_init(void)
110{
111 return xt_register_target(&reject_tg6_reg);
112}
113
114static void __exit reject_tg6_exit(void)
115{
116 xt_unregister_target(&reject_tg6_reg);
117}
118
119module_init(reject_tg6_init);
120module_exit(reject_tg6_exit);
121