Blame view
net/netfilter/nft_reject.c
3.01 KB
d2912cb15 treewide: Replace... |
1 |
// SPDX-License-Identifier: GPL-2.0-only |
96518518c netfilter: add nf... |
2 |
/* |
ef1f7df91 netfilter: nf_tab... |
3 |
* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> |
bee11dc78 netfilter: nft_re... |
4 |
* Copyright (c) 2013 Eric Leblond <eric@regit.org> |
96518518c netfilter: add nf... |
5 |
* |
96518518c netfilter: add nf... |
6 7 8 9 10 11 12 13 14 15 |
* Development of this code funded by Astaro AG (http://www.astaro.com/) */ #include <linux/kernel.h> #include <linux/init.h> #include <linux/module.h> #include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h> |
cc4723ca3 netfilter: nft_re... |
16 |
#include <net/netfilter/nft_reject.h> |
51b0a5d8c netfilter: nft_re... |
17 18 |
#include <linux/icmp.h> #include <linux/icmpv6.h> |
bee11dc78 netfilter: nft_re... |
19 |
|
cc4723ca3 netfilter: nft_re... |
20 |
const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = { |
96518518c netfilter: add nf... |
21 22 23 |
[NFTA_REJECT_TYPE] = { .type = NLA_U32 }, [NFTA_REJECT_ICMP_CODE] = { .type = NLA_U8 }, }; |
cc4723ca3 netfilter: nft_re... |
24 |
EXPORT_SYMBOL_GPL(nft_reject_policy); |
96518518c netfilter: add nf... |
25 |
|
89e1f6d2b netfilter: nft_re... |
26 27 28 29 30 31 32 33 34 35 |
int nft_reject_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nft_data **data) { return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD) | (1 << NF_INET_LOCAL_OUT)); } EXPORT_SYMBOL_GPL(nft_reject_validate); |
cc4723ca3 netfilter: nft_re... |
36 37 38 |
int nft_reject_init(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nlattr * const tb[]) |
96518518c netfilter: add nf... |
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 |
{ struct nft_reject *priv = nft_expr_priv(expr); if (tb[NFTA_REJECT_TYPE] == NULL) return -EINVAL; priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE])); switch (priv->type) { case NFT_REJECT_ICMP_UNREACH: if (tb[NFTA_REJECT_ICMP_CODE] == NULL) return -EINVAL; priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]); case NFT_REJECT_TCP_RST: break; default: return -EINVAL; } return 0; } |
cc4723ca3 netfilter: nft_re... |
59 |
EXPORT_SYMBOL_GPL(nft_reject_init); |
96518518c netfilter: add nf... |
60 |
|
cc4723ca3 netfilter: nft_re... |
61 |
int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr) |
96518518c netfilter: add nf... |
62 63 |
{ const struct nft_reject *priv = nft_expr_priv(expr); |
bee11dc78 netfilter: nft_re... |
64 |
if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type))) |
96518518c netfilter: add nf... |
65 66 67 68 69 70 71 |
goto nla_put_failure; switch (priv->type) { case NFT_REJECT_ICMP_UNREACH: if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code)) goto nla_put_failure; break; |
129d23a56 netfilter; Add so... |
72 73 |
default: break; |
96518518c netfilter: add nf... |
74 75 76 77 78 79 80 |
} return 0; nla_put_failure: return -1; } |
cc4723ca3 netfilter: nft_re... |
81 |
EXPORT_SYMBOL_GPL(nft_reject_dump); |
96518518c netfilter: add nf... |
82 |
|
f0d1f04f0 netfilter: fix wr... |
83 |
static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = { |
51b0a5d8c netfilter: nft_re... |
84 85 86 87 88 89 90 91 |
[NFT_REJECT_ICMPX_NO_ROUTE] = ICMP_NET_UNREACH, [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMP_PORT_UNREACH, [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMP_HOST_UNREACH, [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMP_PKT_FILTERED, }; int nft_reject_icmp_code(u8 code) { |
fa5950e49 netfilter: nf_tab... |
92 93 |
if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) return ICMP_NET_UNREACH; |
51b0a5d8c netfilter: nft_re... |
94 95 96 97 98 |
return icmp_code_v4[code]; } EXPORT_SYMBOL_GPL(nft_reject_icmp_code); |
f0d1f04f0 netfilter: fix wr... |
99 |
static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = { |
51b0a5d8c netfilter: nft_re... |
100 101 102 103 104 105 106 107 |
[NFT_REJECT_ICMPX_NO_ROUTE] = ICMPV6_NOROUTE, [NFT_REJECT_ICMPX_PORT_UNREACH] = ICMPV6_PORT_UNREACH, [NFT_REJECT_ICMPX_HOST_UNREACH] = ICMPV6_ADDR_UNREACH, [NFT_REJECT_ICMPX_ADMIN_PROHIBITED] = ICMPV6_ADM_PROHIBITED, }; int nft_reject_icmpv6_code(u8 code) { |
fa5950e49 netfilter: nf_tab... |
108 109 |
if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX)) return ICMPV6_NOROUTE; |
51b0a5d8c netfilter: nft_re... |
110 111 112 113 114 |
return icmp_code_v6[code]; } EXPORT_SYMBOL_GPL(nft_reject_icmpv6_code); |
96518518c netfilter: add nf... |
115 116 |
MODULE_LICENSE("GPL"); MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); |