netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts (cc4723ca) · Commits · 戴 / test

include/net/netfilter/nft_reject.h

0 → 100644

+17 −0

Original line number	Diff line number	Diff line
		#ifndef _NFT_REJECT_H_
		#define _NFT_REJECT_H_

		struct nft_reject {
		enum nft_reject_types type:8;
		u8 icmp_code;
		};

		extern const struct nla_policy nft_reject_policy[];

		int nft_reject_init(const struct nft_ctx *ctx,
		const struct nft_expr *expr,
		const struct nlattr * const tb[]);

		int nft_reject_dump(struct sk_buff skb, const struct nft_expr expr);

		#endif

net/ipv4/netfilter/Kconfig

+5 −0

Original line number	Diff line number	Diff line
		@@ -61,6 +61,11 @@ config NFT_CHAIN_NAT_IPV4
		packet transformations such as the source, destination address and
		source and destination ports.

		config NFT_REJECT_IPV4
		depends on NF_TABLES_IPV4
		default NFT_REJECT
		tristate

		config NF_TABLES_ARP
		depends on NF_TABLES
		tristate "ARP nf_tables support"

net/ipv4/netfilter/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,7 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
		obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
		obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
		obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
		obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
		obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o

		# generic IP tables

net/ipv4/netfilter/nft_reject_ipv4.c

0 → 100644

+74 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
		* Copyright (c) 2013 Eric Leblond <eric@regit.org>
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		* published by the Free Software Foundation.
		*
		* Development of this code funded by Astaro AG (http://www.astaro.com/)
		*/

		#include <linux/kernel.h>
		#include <linux/init.h>
		#include <linux/module.h>
		#include <linux/netlink.h>
		#include <linux/netfilter.h>
		#include <linux/netfilter/nf_tables.h>
		#include <net/netfilter/nf_tables.h>
		#include <net/icmp.h>
		#include <net/netfilter/ipv4/nf_reject.h>
		#include <net/netfilter/nft_reject.h>

		static void nft_reject_ipv4_eval(const struct nft_expr *expr,
		struct nft_data data[NFT_REG_MAX + 1],
		const struct nft_pktinfo *pkt)
		{
		struct nft_reject *priv = nft_expr_priv(expr);

		switch (priv->type) {
		case NFT_REJECT_ICMP_UNREACH:
		nf_send_unreach(pkt->skb, priv->icmp_code);
		break;
		case NFT_REJECT_TCP_RST:
		nf_send_reset(pkt->skb, pkt->ops->hooknum);
		break;
		}

		data[NFT_REG_VERDICT].verdict = NF_DROP;
		}

		static struct nft_expr_type nft_reject_ipv4_type;
		static const struct nft_expr_ops nft_reject_ipv4_ops = {
		.type = &nft_reject_ipv4_type,
		.size = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
		.eval = nft_reject_ipv4_eval,
		.init = nft_reject_init,
		.dump = nft_reject_dump,
		};

		static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
		.family = NFPROTO_IPV4,
		.name = "reject",
		.ops = &nft_reject_ipv4_ops,
		.policy = nft_reject_policy,
		.maxattr = NFTA_REJECT_MAX,
		.owner = THIS_MODULE,
		};

		static int __init nft_reject_ipv4_module_init(void)
		{
		return nft_register_expr(&nft_reject_ipv4_type);
		}

		static void __exit nft_reject_ipv4_module_exit(void)
		{
		nft_unregister_expr(&nft_reject_ipv4_type);
		}

		module_init(nft_reject_ipv4_module_init);
		module_exit(nft_reject_ipv4_module_exit);

		MODULE_LICENSE("GPL");
		MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
		MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "reject");

net/ipv6/netfilter/Kconfig

+5 −0

Original line number	Diff line number	Diff line
		@@ -50,6 +50,11 @@ config NFT_CHAIN_NAT_IPV6
		packet transformations such as the source, destination address and
		source and destination ports.

		config NFT_REJECT_IPV6
		depends on NF_TABLES_IPV6
		default NFT_REJECT
		tristate

		config IP6_NF_IPTABLES
		tristate "IP6 tables support (required for filtering)"
		depends on INET && IPV6

Admin message