LXR linux/net/ipv4/netfilter/nft_reject

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   4 * Copyright (c) 2013 Eric Leblond <eric@regit.org>
   5 *
   6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
   7 */
   8
   9#include <linux/kernel.h>
  10#include <linux/init.h>
  11#include <linux/module.h>
  12#include <linux/netlink.h>
  13#include <linux/netfilter.h>
  14#include <linux/netfilter/nf_tables.h>
  15#include <net/netfilter/nf_tables.h>
  16#include <net/netfilter/ipv4/nf_reject.h>
  17#include <net/netfilter/nft_reject.h>
  18
  19static void nft_reject_ipv4_eval(const struct nft_expr *expr,
  20                                 struct nft_regs *regs,
  21                                 const struct nft_pktinfo *pkt)
  22{
  23        struct nft_reject *priv = nft_expr_priv(expr);
  24
  25        switch (priv->type) {
  26        case NFT_REJECT_ICMP_UNREACH:
  27                nf_send_unreach(pkt->skb, priv->icmp_code, nft_hook(pkt));
  28                break;
  29        case NFT_REJECT_TCP_RST:
  30                nf_send_reset(nft_net(pkt), nft_sk(pkt), pkt->skb,
  31                              nft_hook(pkt));
  32                break;
  33        default:
  34                break;
  35        }
  36
  37        regs->verdict.code = NF_DROP;
  38}
  39
  40static struct nft_expr_type nft_reject_ipv4_type;
  41static const struct nft_expr_ops nft_reject_ipv4_ops = {
  42        .type           = &nft_reject_ipv4_type,
  43        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
  44        .eval           = nft_reject_ipv4_eval,
  45        .init           = nft_reject_init,
  46        .dump           = nft_reject_dump,
  47        .validate       = nft_reject_validate,
  48};
  49
  50static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
  51        .family         = NFPROTO_IPV4,
  52        .name           = "reject",
  53        .ops            = &nft_reject_ipv4_ops,
  54        .policy         = nft_reject_policy,
  55        .maxattr        = NFTA_REJECT_MAX,
  56        .owner          = THIS_MODULE,
  57};
  58
  59static int __init nft_reject_ipv4_module_init(void)
  60{
  61        return nft_register_expr(&nft_reject_ipv4_type);
  62}
  63
  64static void __exit nft_reject_ipv4_module_exit(void)
  65{
  66        nft_unregister_expr(&nft_reject_ipv4_type);
  67}
  68
  69module_init(nft_reject_ipv4_module_init);
  70module_exit(nft_reject_ipv4_module_exit);
  71
  72MODULE_LICENSE("GPL");
  73MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
  74MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "reject");
  75MODULE_DESCRIPTION("IPv4 packet rejection for nftables");
  76