1/* Shared library add-on to iptables to add customized REJECT support.
2 *
3 * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4 *
5 * ported to IPv6 by Harald Welte <laforge@gnumonks.org>
6 *
7 */
8#include <stdio.h>
9#include <string.h>
10#include <stdlib.h>
11#include <getopt.h>
12#include <ip6tables.h>
13#include <linux/netfilter_ipv6/ip6_tables.h>
14#include <linux/netfilter_ipv6/ip6t_REJECT.h>
15
16struct reject_names {
17	const char *name;
18	const char *alias;
19	enum ip6t_reject_with with;
20	const char *desc;
21};
22
23static const struct reject_names reject_table[] = {
24	{"icmp6-no-route", "no-route",
25		IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"},
26	{"icmp6-adm-prohibited", "adm-prohibited",
27		IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"},
28	{"icmp6-addr-unreachable", "addr-unreach",
29		IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"},
30	{"icmp6-port-unreachable", "port-unreach",
31		IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"},
32	{"tcp-reset", "tcp-reset",
33		IP6T_TCP_RESET, "TCP RST packet"}
34};
35
36static void
37print_reject_types()
38{
39	unsigned int i;
40
41	printf("Valid reject types:\n");
42
43	for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
44		printf("    %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
45		printf("    %-25s\talias\n", reject_table[i].alias);
46	}
47	printf("\n");
48}
49
50/* Saves the union ipt_targinfo in parsable form to stdout. */
51
52/* Function which prints out usage message. */
53static void
54help(void)
55{
56	printf(
57"REJECT options:\n"
58"--reject-with type              drop input packet and send back\n"
59"                                a reply packet according to type:\n");
60
61	print_reject_types();
62}
63
64static struct option opts[] = {
65	{ "reject-with", 1, 0, '1' },
66	{ 0 }
67};
68
69/* Allocate and initialize the target. */
70static void
71init(struct ip6t_entry_target *t, unsigned int *nfcache)
72{
73	struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data;
74
75	/* default */
76	reject->with = IP6T_ICMP6_PORT_UNREACH;
77
78	/* Can't cache this */
79	*nfcache |= NFC_UNKNOWN;
80}
81
82/* Function which parses command options; returns true if it
83   ate an option */
84static int
85parse(int c, char **argv, int invert, unsigned int *flags,
86      const struct ip6t_entry *entry,
87      struct ip6t_entry_target **target)
88{
89	struct ip6t_reject_info *reject =
90		(struct ip6t_reject_info *)(*target)->data;
91	unsigned int limit = sizeof(reject_table)/sizeof(struct reject_names);
92	unsigned int i;
93
94	switch(c) {
95	case '1':
96		if (check_inverse(optarg, &invert, NULL, 0))
97			exit_error(PARAMETER_PROBLEM,
98				   "Unexpected `!' after --reject-with");
99		for (i = 0; i < limit; i++) {
100			if ((strncasecmp(reject_table[i].name, optarg, strlen(optarg)) == 0)
101			    || (strncasecmp(reject_table[i].alias, optarg, strlen(optarg)) == 0)) {
102				reject->with = reject_table[i].with;
103				return 1;
104			}
105		}
106		exit_error(PARAMETER_PROBLEM, "unknown reject type `%s'",optarg);
107	default:
108		/* Fall through */
109		break;
110	}
111	return 0;
112}
113
114/* Final check; nothing. */
115static void final_check(unsigned int flags)
116{
117}
118
119/* Prints out ipt_reject_info. */
120static void
121print(const struct ip6t_ip6 *ip,
122      const struct ip6t_entry_target *target,
123      int numeric)
124{
125	const struct ip6t_reject_info *reject
126		= (const struct ip6t_reject_info *)target->data;
127	unsigned int i;
128
129	for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
130		if (reject_table[i].with == reject->with)
131			break;
132	}
133	printf("reject-with %s ", reject_table[i].name);
134}
135
136/* Saves ipt_reject in parsable form to stdout. */
137static void save(const struct ip6t_ip6 *ip,
138		 const struct ip6t_entry_target *target)
139{
140	const struct ip6t_reject_info *reject
141		= (const struct ip6t_reject_info *)target->data;
142	unsigned int i;
143
144	for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++)
145		if (reject_table[i].with == reject->with)
146			break;
147
148	printf("--reject-with %s ", reject_table[i].name);
149}
150
151struct ip6tables_target reject
152= { NULL,
153    "REJECT",
154    IPTABLES_VERSION,
155    IP6T_ALIGN(sizeof(struct ip6t_reject_info)),
156    IP6T_ALIGN(sizeof(struct ip6t_reject_info)),
157    &help,
158    &init,
159    &parse,
160    &final_check,
161    &print,
162    &save,
163    opts
164};
165
166void _init(void)
167{
168	register_target6(&reject);
169}
170