1 /*
2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3  * Copyright (c) 2013 Eric Leblond <eric@regit.org>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
10  */
11 
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/icmp.h>
20 #include <net/netfilter/ipv4/nf_reject.h>
21 #include <net/netfilter/nft_reject.h>
22 
23 void nft_reject_ipv4_eval(const struct nft_expr *expr,
24 			  struct nft_data data[NFT_REG_MAX + 1],
25 			  const struct nft_pktinfo *pkt)
26 {
27 	struct nft_reject *priv = nft_expr_priv(expr);
28 
29 	switch (priv->type) {
30 	case NFT_REJECT_ICMP_UNREACH:
31 		nf_send_unreach(pkt->skb, priv->icmp_code);
32 		break;
33 	case NFT_REJECT_TCP_RST:
34 		nf_send_reset(pkt->skb, pkt->ops->hooknum);
35 		break;
36 	}
37 
38 	data[NFT_REG_VERDICT].verdict = NF_DROP;
39 }
40 EXPORT_SYMBOL_GPL(nft_reject_ipv4_eval);
41 
42 static struct nft_expr_type nft_reject_ipv4_type;
43 static const struct nft_expr_ops nft_reject_ipv4_ops = {
44 	.type		= &nft_reject_ipv4_type,
45 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),
46 	.eval		= nft_reject_ipv4_eval,
47 	.init		= nft_reject_init,
48 	.dump		= nft_reject_dump,
49 };
50 
51 static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
52 	.family		= NFPROTO_IPV4,
53 	.name		= "reject",
54 	.ops		= &nft_reject_ipv4_ops,
55 	.policy		= nft_reject_policy,
56 	.maxattr	= NFTA_REJECT_MAX,
57 	.owner		= THIS_MODULE,
58 };
59 
60 static int __init nft_reject_ipv4_module_init(void)
61 {
62 	return nft_register_expr(&nft_reject_ipv4_type);
63 }
64 
65 static void __exit nft_reject_ipv4_module_exit(void)
66 {
67 	nft_unregister_expr(&nft_reject_ipv4_type);
68 }
69 
70 module_init(nft_reject_ipv4_module_init);
71 module_exit(nft_reject_ipv4_module_exit);
72 
73 MODULE_LICENSE("GPL");
74 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
75 MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "reject");
76