libip6t_REJECT.c revision b313d8f3f78c62cce930728bc9163ecf942c22e8
1/* Shared library add-on to ip6tables to add customized REJECT support. 2 * 3 * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 4 * 5 * ported to IPv6 by Harald Welte <laforge@gnumonks.org> 6 * 7 */ 8#include <stdio.h> 9#include <string.h> 10#include <xtables.h> 11#include <linux/netfilter_ipv6/ip6t_REJECT.h> 12 13struct reject_names { 14 const char *name; 15 const char *alias; 16 enum ip6t_reject_with with; 17 const char *desc; 18}; 19 20enum { 21 O_REJECT_WITH = 0, 22}; 23 24static const struct reject_names reject_table[] = { 25 {"icmp6-no-route", "no-route", 26 IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"}, 27 {"icmp6-adm-prohibited", "adm-prohibited", 28 IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"}, 29#if 0 30 {"icmp6-not-neighbor", "not-neighbor"}, 31 IP6T_ICMP6_NOT_NEIGHBOR, "ICMPv6 not a neighbor"}, 32#endif 33 {"icmp6-addr-unreachable", "addr-unreach", 34 IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"}, 35 {"icmp6-port-unreachable", "port-unreach", 36 IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"}, 37 {"tcp-reset", "tcp-reset", 38 IP6T_TCP_RESET, "TCP RST packet"} 39}; 40 41static void 42print_reject_types(void) 43{ 44 unsigned int i; 45 46 printf("Valid reject types:\n"); 47 48 for (i = 0; i < ARRAY_SIZE(reject_table); ++i) { 49 printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); 50 printf(" %-25s\talias\n", reject_table[i].alias); 51 } 52 printf("\n"); 53} 54 55static void REJECT_help(void) 56{ 57 printf( 58"REJECT target options:\n" 59"--reject-with type drop input packet and send back\n" 60" a reply packet according to type:\n"); 61 62 print_reject_types(); 63} 64 65static const struct xt_option_entry REJECT_opts[] = { 66 {.name = "reject-with", .id = O_REJECT_WITH, .type = XTTYPE_STRING}, 67 XTOPT_TABLEEND, 68}; 69 70static void REJECT_init(struct xt_entry_target *t) 71{ 72 struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data; 73 74 /* default */ 75 reject->with = IP6T_ICMP6_PORT_UNREACH; 76 77} 78 79static void REJECT_parse(struct xt_option_call *cb) 80{ 81 struct ip6t_reject_info *reject = cb->data; 82 unsigned int i; 83 84 xtables_option_parse(cb); 85 for (i = 0; i < ARRAY_SIZE(reject_table); ++i) 86 if (strncasecmp(reject_table[i].name, 87 cb->arg, strlen(cb->arg)) == 0 || 88 strncasecmp(reject_table[i].alias, 89 cb->arg, strlen(cb->arg)) == 0) { 90 reject->with = reject_table[i].with; 91 return; 92 } 93 xtables_error(PARAMETER_PROBLEM, 94 "unknown reject type \"%s\"", cb->arg); 95} 96 97static void REJECT_print(const void *ip, const struct xt_entry_target *target, 98 int numeric) 99{ 100 const struct ip6t_reject_info *reject 101 = (const struct ip6t_reject_info *)target->data; 102 unsigned int i; 103 104 for (i = 0; i < ARRAY_SIZE(reject_table); ++i) 105 if (reject_table[i].with == reject->with) 106 break; 107 printf(" reject-with %s", reject_table[i].name); 108} 109 110static void REJECT_save(const void *ip, const struct xt_entry_target *target) 111{ 112 const struct ip6t_reject_info *reject 113 = (const struct ip6t_reject_info *)target->data; 114 unsigned int i; 115 116 for (i = 0; i < ARRAY_SIZE(reject_table); ++i) 117 if (reject_table[i].with == reject->with) 118 break; 119 120 printf(" --reject-with %s", reject_table[i].name); 121} 122 123static struct xtables_target reject_tg6_reg = { 124 .name = "REJECT", 125 .version = XTABLES_VERSION, 126 .family = NFPROTO_IPV6, 127 .size = XT_ALIGN(sizeof(struct ip6t_reject_info)), 128 .userspacesize = XT_ALIGN(sizeof(struct ip6t_reject_info)), 129 .help = REJECT_help, 130 .init = REJECT_init, 131 .print = REJECT_print, 132 .save = REJECT_save, 133 .x6_parse = REJECT_parse, 134 .x6_options = REJECT_opts, 135}; 136 137void _init(void) 138{ 139 xtables_register_target(&reject_tg6_reg); 140} 141