Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cc4723ca authored by Patrick McHardy's avatar Patrick McHardy Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts 



Currently the nft_reject module depends on symbols from ipv6. This is
wrong since no generic module should force IPv6 support to be loaded.
Split up the module into AF-specific and a generic part.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 64d46806

include/net/netfilter/nft_reject.h

0 → 100644
+17 −0
Original line number Diff line number Diff line 
#ifndef _NFT_REJECT_H_

#define _NFT_REJECT_H_



struct nft_reject {

	enum nft_reject_types	type:8;

	u8			icmp_code;

};



extern const struct nla_policy nft_reject_policy[];



int nft_reject_init(const struct nft_ctx *ctx,

		    const struct nft_expr *expr,

		    const struct nlattr * const tb[]);



int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr);



#endif

net/ipv4/netfilter/Kconfig

+5 −0
Original line number Diff line number Diff line
@@ -61,6 +61,11 @@ config NFT_CHAIN_NAT_IPV4 
	  packet transformations such as the source, destination address and

	  source and destination ports.



config NFT_REJECT_IPV4

	depends on NF_TABLES_IPV4

	default NFT_REJECT

	tristate



config NF_TABLES_ARP

	depends on NF_TABLES

	tristate "ARP nf_tables support"

net/ipv4/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o 
obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o

obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o

obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o

obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o

obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o



# generic IP tables

net/ipv4/netfilter/nft_reject_ipv4.c

0 → 100644
+74 −0
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>

 * Copyright (c) 2013 Eric Leblond <eric@regit.org>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 as

 * published by the Free Software Foundation.

 *

 * Development of this code funded by Astaro AG (http://www.astaro.com/)

 */



#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables.h>

#include <net/icmp.h>

#include <net/netfilter/ipv4/nf_reject.h>

#include <net/netfilter/nft_reject.h>



static void nft_reject_ipv4_eval(const struct nft_expr *expr,

				 struct nft_data data[NFT_REG_MAX + 1],

				 const struct nft_pktinfo *pkt)

{

	struct nft_reject *priv = nft_expr_priv(expr);



	switch (priv->type) {

	case NFT_REJECT_ICMP_UNREACH:

		nf_send_unreach(pkt->skb, priv->icmp_code);

		break;

	case NFT_REJECT_TCP_RST:

		nf_send_reset(pkt->skb, pkt->ops->hooknum);

		break;

	}



	data[NFT_REG_VERDICT].verdict = NF_DROP;

}



static struct nft_expr_type nft_reject_ipv4_type;

static const struct nft_expr_ops nft_reject_ipv4_ops = {

	.type		= &nft_reject_ipv4_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_reject)),

	.eval		= nft_reject_ipv4_eval,

	.init		= nft_reject_init,

	.dump		= nft_reject_dump,

};



static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {

	.family		= NFPROTO_IPV4,

	.name		= "reject",

	.ops		= &nft_reject_ipv4_ops,

	.policy		= nft_reject_policy,

	.maxattr	= NFTA_REJECT_MAX,

	.owner		= THIS_MODULE,

};



static int __init nft_reject_ipv4_module_init(void)

{

	return nft_register_expr(&nft_reject_ipv4_type);

}



static void __exit nft_reject_ipv4_module_exit(void)

{

	nft_unregister_expr(&nft_reject_ipv4_type);

}



module_init(nft_reject_ipv4_module_init);

module_exit(nft_reject_ipv4_module_exit);



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");

MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "reject");

net/ipv6/netfilter/Kconfig

+5 −0
Original line number Diff line number Diff line
@@ -50,6 +50,11 @@ config NFT_CHAIN_NAT_IPV6 
	  packet transformations such as the source, destination address and

	  source and destination ports.



config NFT_REJECT_IPV6

	depends on NF_TABLES_IPV6

	default NFT_REJECT

	tristate



config IP6_NF_IPTABLES

	tristate "IP6 tables support (required for filtering)"

	depends on INET && IPV6