extensions/libip6t_REJECT.c

   1 /* Shared library add-on to ip6tables to add customized REJECT support.
   2  *
   3  * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   4  *
   5  * ported to IPv6 by Harald Welte <laforge@gnumonks.org>
   6  *
   7  */
   8 #include <stdio.h>
   9 #include <string.h>
  10 #include <xtables.h>
  11 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
  12
  13 struct reject_names {
  14         const char *name;
  15         const char *alias;
  16         enum ip6t_reject_with with;
  17         const char *desc;
  18 };
  19
  20 enum {
  21         O_REJECT_WITH = 0,
  22 };
  23
  24 static const struct reject_names reject_table[] = {
  25         {"icmp6-no-route", "no-route",
  26                 IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"},
  27         {"icmp6-adm-prohibited", "adm-prohibited",
  28                 IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"},
  29 #if 0
  30         {"icmp6-not-neighbor", "not-neighbor"},
  31                 IP6T_ICMP6_NOT_NEIGHBOR, "ICMPv6 not a neighbor"},
  32 #endif
  33         {"icmp6-addr-unreachable", "addr-unreach",
  34                 IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"},
  35         {"icmp6-port-unreachable", "port-unreach",
  36                 IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"},
  37         {"tcp-reset", "tcp-reset",
  38                 IP6T_TCP_RESET, "TCP RST packet"}
  39 };
  40
  41 static void
  42 print_reject_types(void)
  43 {
  44         unsigned int i;
  45
  46         printf("Valid reject types:\n");
  47
  48         for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
  49                 printf("    %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
  50                 printf("    %-25s\talias\n", reject_table[i].alias);
  51         }
  52         printf("\n");
  53 }
  54
  55 static void REJECT_help(void)
  56 {
  57         printf(
  58 "REJECT target options:\n"
  59 "--reject-with type              drop input packet and send back\n"
  60 "                                a reply packet according to type:\n");
  61
  62         print_reject_types();
  63 }
  64
  65 static const struct xt_option_entry REJECT_opts[] = {
  66         {.name = "reject-with", .id = O_REJECT_WITH, .type = XTTYPE_STRING},
  67         XTOPT_TABLEEND,
  68 };
  69
  70 static void REJECT_init(struct xt_entry_target *t)
  71 {
  72         struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data;
  73
  74         /* default */
  75         reject->with = IP6T_ICMP6_PORT_UNREACH;
  76
  77 }
  78
  79 static void REJECT_parse(struct xt_option_call *cb)
  80 {
  81         struct ip6t_reject_info *reject = cb->data;
  82         unsigned int i;
  83
  84         xtables_option_parse(cb);
  85         for (i = 0; i < ARRAY_SIZE(reject_table); ++i)
  86                 if (strncasecmp(reject_table[i].name,
  87                       cb->arg, strlen(cb->arg)) == 0 ||
  88                     strncasecmp(reject_table[i].alias,
  89                       cb->arg, strlen(cb->arg)) == 0) {
  90                         reject->with = reject_table[i].with;
  91                         return;
  92                 }
  93         xtables_error(PARAMETER_PROBLEM,
  94                 "unknown reject type \"%s\"", cb->arg);
  95 }
  96
  97 static void REJECT_print(const void *ip, const struct xt_entry_target *target,
  98                          int numeric)
  99 {
 100         const struct ip6t_reject_info *reject
 101                 = (const struct ip6t_reject_info *)target->data;
 102         unsigned int i;
 103
 104         for (i = 0; i < ARRAY_SIZE(reject_table); ++i)
 105                 if (reject_table[i].with == reject->with)
 106                         break;
 107         printf(" reject-with %s", reject_table[i].name);
 108 }
 109
 110 static void REJECT_save(const void *ip, const struct xt_entry_target *target)
 111 {
 112         const struct ip6t_reject_info *reject
 113                 = (const struct ip6t_reject_info *)target->data;
 114         unsigned int i;
 115
 116         for (i = 0; i < ARRAY_SIZE(reject_table); ++i)
 117                 if (reject_table[i].with == reject->with)
 118                         break;
 119
 120         printf(" --reject-with %s", reject_table[i].name);
 121 }
 122
 123 static struct xtables_target reject_tg6_reg = {
 124         .name = "REJECT",
 125         .version        = XTABLES_VERSION,
 126         .family         = NFPROTO_IPV6,
 127         .size           = XT_ALIGN(sizeof(struct ip6t_reject_info)),
 128         .userspacesize  = XT_ALIGN(sizeof(struct ip6t_reject_info)),
 129         .help           = REJECT_help,
 130         .init           = REJECT_init,
 131         .print          = REJECT_print,
 132         .save           = REJECT_save,
 133         .x6_parse       = REJECT_parse,
 134         .x6_options     = REJECT_opts,
 135 };
 136
 137 void _init(void)
 138 {
 139         xtables_register_target(&reject_tg6_reg);
 140 }