{"id":30064927,"url":"https://github.com/maximilianfeldthusen/icmpv6-filter-module","last_synced_at":"2026-05-16T18:32:29.469Z","repository":{"id":306010506,"uuid":"1024686546","full_name":"maximilianfeldthusen/ICMPv6-Filter-Module","owner":"maximilianfeldthusen","description":"ICMPv6-Filter-Module This Linux kernel module uses Netfilter to inspect incoming IPv6 packets:","archived":false,"fork":false,"pushed_at":"2025-07-23T05:31:49.000Z","size":13,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"TFD","last_synced_at":"2025-07-23T07:14:02.682Z","etag":null,"topics":["icmpv6","incoming","inspect","linux","linux-kernel","netfilter","packets"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/maximilianfeldthusen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-23T05:18:07.000Z","updated_at":"2025-07-23T06:31:34.000Z","dependencies_parsed_at":"2025-07-23T07:14:57.367Z","dependency_job_id":"38cf1de0-666c-479b-ae86-7201ba8b574c","html_url":"https://github.com/maximilianfeldthusen/ICMPv6-Filter-Module","commit_stats":null,"previous_names":["maximilianfeldthusen/icmpv6-filter-module"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/maximilianfeldthusen/ICMPv6-Filter-Module","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maximilianfeldthusen%2FICMPv6-Filter-Module","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maximilianfeldthusen%2FICMPv6-Filter-Module/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maximilianfeldthusen%2FICMPv6-Filter-Module/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maximilianfeldthusen%2FICMPv6-Filter-Module/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/maximilianfeldthusen","download_url":"https://codeload.github.com/maximilianfeldthusen/ICMPv6-Filter-Module/tar.gz/refs/heads/TFD","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maximilianfeldthusen%2FICMPv6-Filter-Module/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269367394,"owners_count":24405385,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-08T02:00:09.200Z","response_time":72,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["icmpv6","incoming","inspect","linux","linux-kernel","netfilter","packets"],"created_at":"2025-08-08T05:24:23.355Z","updated_at":"2026-05-16T18:32:29.418Z","avatar_url":"https://github.com/maximilianfeldthusen.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"## ICMPv6-Filter-Module\n\n###  Module Purpose\nThis Linux kernel module uses Netfilter to inspect incoming IPv6 packets:\n- Filters ICMPv6 packets by **type** (e.g., Echo Request = 128)\n- Matches packets from a specific **IPv6 source address**\n- Optionally **drops** or just logs matching packets\n- Offers runtime configuration via a `/proc` file\n\n---\n\n##  Core Components Explained\n\n### 1. **Includes \u0026 Definitions**\n```c\n#include \u003clinux/module.h\u003e       // For module macros\n#include \u003clinux/netfilter.h\u003e    // Netfilter base\n#include \u003clinux/netfilter_ipv6.h\u003e // IPv6 Netfilter\n#include \u003clinux/ipv6.h\u003e         // IPv6 headers\n#include \u003clinux/icmpv6.h\u003e       // ICMPv6 header\n#include \u003clinux/proc_fs.h\u003e      // /proc file system\n#include \u003clinux/uaccess.h\u003e      // Copy from user space\n```\nThese headers pull in the kernel APIs you'll need.\n\n---\n\n### 2. **Global Settings**\n```c\n#define PROC_NAME \"icmpv6_filter\"\n#define MAX_INPUT 128\n```\n- This sets up your `/proc/icmpv6_filter` file\n- Input buffer for commands from userspace is limited to 128 bytes\n\n---\n\n### 3. **Filter State Variables**\n```c\nstatic struct in6_addr match_ip = IN6ADDR_ANY_INIT;\nstatic int icmp_type = 128;\nstatic bool drop = false;\n```\n- `match_ip`: IPv6 address to match. Default: any address\n- `icmp_type`: Default is 128 (Echo Request)\n- `drop`: `false` means log, `true` means drop\n\n---\n\n### 4. **Packet Inspection Hook**\n```c\nstatic unsigned int filter_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)\n```\nThis function is called on every packet before it's routed:\n- Extracts IPv6 and ICMPv6 headers\n- Compares packet’s type and source IP against module's settings\n- Logs and accepts or drops based on current `drop` state\n\n---\n\n### 5. **/proc Write Handler**\n```c\nstatic ssize_t proc_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)\n```\n- Reads configuration string from userspace, like:\n  ```\n  type=135 ip=fe80::1 drop=1\n  ```\n- Updates the module's internal parameters using `sscanf()`\n- Converts IP string into binary format with `in6_pton()`\n\n---\n\n### 6. **/proc File Ops Struct**\n```c\nstatic struct proc_ops proc_file_ops = {\n    .proc_write = proc_write,\n};\n```\nThis ties your write handler to the proc file’s behavior.\n\n---\n\n### 7. **Module Initialization**\n```c\nstatic int __init filter_init(void)\n```\n- Registers the Netfilter hook\n- Creates the `/proc` file\n- Loads your module and prints a kernel log\n\n---\n\n### 8. **Module Cleanup**\n```c\nstatic void __exit filter_exit(void)\n```\n- Removes the proc entry and Netfilter hook when the module is unloaded\n\n---\n\n##  Runtime Interaction\nOnce loaded:\n```bash\necho \"type=135 ip=fe80::1 drop=1\" | sudo tee /proc/icmpv6_filter\n```\n This updates the module to **drop** incoming **Neighbor Solicitation** (type 135) messages from **fe80::1**.\n\nCheck your logs:\n```bash\ndmesg | grep ICMPv6\n```\n---\n###  **How to Use**\n1. Build:\n   ```bash\n   make\n   ```\n\n2. Load:\n   ```bash\n   sudo insmod icmpv6_filter_proc.ko\n   ```\n\n3. Update parameters at runtime:\n   ```bash\n   echo \"type=135 ip=fe80::1 drop=1\" | sudo tee /proc/icmpv6_filter\n   ```\n\n4. Inspect logs:\n   ```bash\n   dmesg | grep ICMPv6\n   ```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaximilianfeldthusen%2Ficmpv6-filter-module","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmaximilianfeldthusen%2Ficmpv6-filter-module","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaximilianfeldthusen%2Ficmpv6-filter-module/lists"}