1/* Shared library add-on to iptables to add customized REJECT support. 2 * 3 * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 4 * 5 * ported to IPv6 by Harald Welte <laforge@gnumonks.org> 6 * 7 */ 8#include <stdio.h> 9#include <string.h> 10#include <stdlib.h> 11#include <getopt.h> 12#include <ip6tables.h> 13#include <linux/netfilter_ipv6/ip6_tables.h> 14#include <linux/netfilter_ipv6/ip6t_REJECT.h> 15 16struct reject_names { 17 const char *name; 18 const char *alias; 19 enum ip6t_reject_with with; 20 const char *desc; 21}; 22 23static const struct reject_names reject_table[] = { 24 {"icmp6-no-route", "no-route", 25 IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"}, 26 {"icmp6-adm-prohibited", "adm-prohibited", 27 IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"}, 28 {"icmp6-addr-unreachable", "addr-unreach", 29 IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"}, 30 {"icmp6-port-unreachable", "port-unreach", 31 IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"}, 32 {"tcp-reset", "tcp-reset", 33 IP6T_TCP_RESET, "TCP RST packet"} 34}; 35 36static void 37print_reject_types() 38{ 39 unsigned int i; 40 41 printf("Valid reject types:\n"); 42 43 for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) { 44 printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); 45 printf(" %-25s\talias\n", reject_table[i].alias); 46 } 47 printf("\n"); 48} 49 50/* Saves the union ipt_targinfo in parsable form to stdout. */ 51 52/* Function which prints out usage message. */ 53static void 54help(void) 55{ 56 printf( 57"REJECT options:\n" 58"--reject-with type drop input packet and send back\n" 59" a reply packet according to type:\n"); 60 61 print_reject_types(); 62} 63 64static struct option opts[] = { 65 { "reject-with", 1, 0, '1' }, 66 { 0 } 67}; 68 69/* Allocate and initialize the target. */ 70static void 71init(struct ip6t_entry_target *t, unsigned int *nfcache) 72{ 73 struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data; 74 75 /* default */ 76 reject->with = IP6T_ICMP6_PORT_UNREACH; 77 78 /* Can't cache this */ 79 *nfcache |= NFC_UNKNOWN; 80} 81 82/* Function which parses command options; returns true if it 83 ate an option */ 84static int 85parse(int c, char **argv, int invert, unsigned int *flags, 86 const struct ip6t_entry *entry, 87 struct ip6t_entry_target **target) 88{ 89 struct ip6t_reject_info *reject = 90 (struct ip6t_reject_info *)(*target)->data; 91 unsigned int limit = sizeof(reject_table)/sizeof(struct reject_names); 92 unsigned int i; 93 94 switch(c) { 95 case '1': 96 if (check_inverse(optarg, &invert, NULL, 0)) 97 exit_error(PARAMETER_PROBLEM, 98 "Unexpected `!' after --reject-with"); 99 for (i = 0; i < limit; i++) { 100 if ((strncasecmp(reject_table[i].name, optarg, strlen(optarg)) == 0) 101 || (strncasecmp(reject_table[i].alias, optarg, strlen(optarg)) == 0)) { 102 reject->with = reject_table[i].with; 103 return 1; 104 } 105 } 106 exit_error(PARAMETER_PROBLEM, "unknown reject type `%s'",optarg); 107 default: 108 /* Fall through */ 109 break; 110 } 111 return 0; 112} 113 114/* Final check; nothing. */ 115static void final_check(unsigned int flags) 116{ 117} 118 119/* Prints out ipt_reject_info. */ 120static void 121print(const struct ip6t_ip6 *ip, 122 const struct ip6t_entry_target *target, 123 int numeric) 124{ 125 const struct ip6t_reject_info *reject 126 = (const struct ip6t_reject_info *)target->data; 127 unsigned int i; 128 129 for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) { 130 if (reject_table[i].with == reject->with) 131 break; 132 } 133 printf("reject-with %s ", reject_table[i].name); 134} 135 136/* Saves ipt_reject in parsable form to stdout. */ 137static void save(const struct ip6t_ip6 *ip, 138 const struct ip6t_entry_target *target) 139{ 140 const struct ip6t_reject_info *reject 141 = (const struct ip6t_reject_info *)target->data; 142 unsigned int i; 143 144 for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) 145 if (reject_table[i].with == reject->with) 146 break; 147 148 printf("--reject-with %s ", reject_table[i].name); 149} 150 151struct ip6tables_target reject 152= { NULL, 153 "REJECT", 154 IPTABLES_VERSION, 155 IP6T_ALIGN(sizeof(struct ip6t_reject_info)), 156 IP6T_ALIGN(sizeof(struct ip6t_reject_info)), 157 &help, 158 &init, 159 &parse, 160 &final_check, 161 &print, 162 &save, 163 opts 164}; 165 166void _init(void) 167{ 168 register_target6(&reject); 169} 170