Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1afe839e authored by Andreas Herz's avatar Andreas Herz Committed by Pablo Neira Ayuso
Browse files

netfilter: ip6t_REJECT: added missing icmpv6 codes 



RFC 4443 added two new codes values for ICMPv6 type 1:

 5 - Source address failed ingress/egress policy
 6 - Reject route to destination

And RFC 7084 states in L-14 that IPv6 Router MUST send ICMPv6 Destination
Unreachable with code 5 for packets forwarded to it that use an address
from a prefix that has been invalidated.

Codes 5 and 6 are more informative subsets of code 1.

Signed-off-by: default avatarAndreas Herz <andi@geekosphere.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 116984a3

include/uapi/linux/netfilter_ipv6/ip6t_REJECT.h

+3 −1
Original line number Diff line number Diff line
@@ -10,7 +10,9 @@ enum ip6t_reject_with { 
	IP6T_ICMP6_ADDR_UNREACH,

	IP6T_ICMP6_PORT_UNREACH,

	IP6T_ICMP6_ECHOREPLY,

	IP6T_TCP_RESET

	IP6T_TCP_RESET,

	IP6T_ICMP6_POLICY_FAIL,

	IP6T_ICMP6_REJECT_ROUTE

};



struct ip6t_reject_info {

net/ipv6/netfilter/ip6t_REJECT.c

+6 −0
Original line number Diff line number Diff line
@@ -63,6 +63,12 @@ reject_tg6(struct sk_buff *skb, const struct xt_action_param *par) 
	case IP6T_TCP_RESET:

		nf_send_reset6(net, skb, par->hooknum);

		break;

	case IP6T_ICMP6_POLICY_FAIL:

		nf_send_unreach6(net, skb, ICMPV6_POLICY_FAIL, par->hooknum);

		break;

	case IP6T_ICMP6_REJECT_ROUTE:

		nf_send_unreach6(net, skb, ICMPV6_REJECT_ROUTE, par->hooknum);

		break;

	}



	return NF_DROP;