|
Packit |
7b22a4 |
/* Shared library add-on to ip6tables to add customized REJECT support.
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* ported to IPv6 by Harald Welte <laforge@gnumonks.org>
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
#include <stdio.h>
|
|
Packit |
7b22a4 |
#include <string.h>
|
|
Packit |
7b22a4 |
#include <xtables.h>
|
|
Packit |
7b22a4 |
#include <linux/netfilter_ipv6/ip6t_REJECT.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
struct reject_names {
|
|
Packit |
7b22a4 |
const char *name;
|
|
Packit |
7b22a4 |
const char *alias;
|
|
Packit |
7b22a4 |
const char *desc;
|
|
Packit |
7b22a4 |
const char *xlate;
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
enum {
|
|
Packit |
7b22a4 |
O_REJECT_WITH = 0,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static const struct reject_names reject_table[] = {
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_NO_ROUTE] = {
|
|
Packit |
7b22a4 |
"icmp6-no-route", "no-route",
|
|
Packit |
7b22a4 |
"ICMPv6 no route",
|
|
Packit |
7b22a4 |
"no-route",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_ADM_PROHIBITED] = {
|
|
Packit |
7b22a4 |
"icmp6-adm-prohibited", "adm-prohibited",
|
|
Packit |
7b22a4 |
"ICMPv6 administratively prohibited",
|
|
Packit |
7b22a4 |
"admin-prohibited",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
#if 0
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_NOT_NEIGHBOR] = {
|
|
Packit |
7b22a4 |
"icmp6-not-neighbor", "not-neighbor",
|
|
Packit |
7b22a4 |
"ICMPv6 not a neighbor",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
#endif
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_ADDR_UNREACH] = {
|
|
Packit |
7b22a4 |
"icmp6-addr-unreachable", "addr-unreach",
|
|
Packit |
7b22a4 |
"ICMPv6 address unreachable",
|
|
Packit |
7b22a4 |
"addr-unreachable",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_PORT_UNREACH] = {
|
|
Packit |
7b22a4 |
"icmp6-port-unreachable", "port-unreach",
|
|
Packit |
7b22a4 |
"ICMPv6 port unreachable",
|
|
Packit |
7b22a4 |
"port-unreachable",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
#if 0
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_ECHOREPLY] = {},
|
|
Packit |
7b22a4 |
#endif
|
|
Packit |
7b22a4 |
[IP6T_TCP_RESET] = {
|
|
Packit |
7b22a4 |
"tcp-reset", "tcp-reset",
|
|
Packit |
7b22a4 |
"TCP RST packet",
|
|
Packit |
7b22a4 |
"tcp reset",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_POLICY_FAIL] = {
|
|
Packit |
7b22a4 |
"icmp6-policy-fail", "policy-fail",
|
|
Packit |
7b22a4 |
"ICMPv6 policy fail",
|
|
Packit |
7b22a4 |
"policy-fail",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
[IP6T_ICMP6_REJECT_ROUTE] = {
|
|
Packit |
7b22a4 |
"icmp6-reject-route", "reject-route",
|
|
Packit |
7b22a4 |
"ICMPv6 reject route",
|
|
Packit |
7b22a4 |
"reject-route",
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void
|
|
Packit |
7b22a4 |
print_reject_types(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
unsigned int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
printf("Valid reject types:\n");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
|
|
Packit |
7b22a4 |
if (!reject_table[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
|
|
Packit |
7b22a4 |
printf(" %-25s\talias\n", reject_table[i].alias);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
printf("\n");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void REJECT_help(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
printf(
|
|
Packit |
7b22a4 |
"REJECT target options:\n"
|
|
Packit |
7b22a4 |
"--reject-with type drop input packet and send back\n"
|
|
Packit |
7b22a4 |
" a reply packet according to type:\n");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
print_reject_types();
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static const struct xt_option_entry REJECT_opts[] = {
|
|
Packit |
7b22a4 |
{.name = "reject-with", .id = O_REJECT_WITH, .type = XTTYPE_STRING},
|
|
Packit |
7b22a4 |
XTOPT_TABLEEND,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void REJECT_init(struct xt_entry_target *t)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/* default */
|
|
Packit |
7b22a4 |
reject->with = IP6T_ICMP6_PORT_UNREACH;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void REJECT_parse(struct xt_option_call *cb)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct ip6t_reject_info *reject = cb->data;
|
|
Packit |
7b22a4 |
unsigned int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
xtables_option_parse(cb);
|
|
Packit |
7b22a4 |
for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
|
|
Packit |
7b22a4 |
if (!reject_table[i].name)
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
if (strncasecmp(reject_table[i].name,
|
|
Packit |
7b22a4 |
cb->arg, strlen(cb->arg)) == 0 ||
|
|
Packit |
7b22a4 |
strncasecmp(reject_table[i].alias,
|
|
Packit |
7b22a4 |
cb->arg, strlen(cb->arg)) == 0) {
|
|
Packit |
7b22a4 |
reject->with = i;
|
|
Packit |
7b22a4 |
return;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"unknown reject type \"%s\"", cb->arg);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void REJECT_print(const void *ip, const struct xt_entry_target *target,
|
|
Packit |
7b22a4 |
int numeric)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct ip6t_reject_info *reject
|
|
Packit |
7b22a4 |
= (const struct ip6t_reject_info *)target->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
printf(" reject-with %s", reject_table[reject->with].name);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void REJECT_save(const void *ip, const struct xt_entry_target *target)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct ip6t_reject_info *reject
|
|
Packit |
7b22a4 |
= (const struct ip6t_reject_info *)target->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
printf(" --reject-with %s", reject_table[reject->with].name);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int REJECT_xlate(struct xt_xlate *xl,
|
|
Packit |
7b22a4 |
const struct xt_xlate_tg_params *params)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct ip6t_reject_info *reject =
|
|
Packit |
7b22a4 |
(const struct ip6t_reject_info *)params->target->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (reject->with == IP6T_ICMP6_PORT_UNREACH)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "reject");
|
|
Packit |
7b22a4 |
else if (reject->with == IP6T_TCP_RESET)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "reject with %s",
|
|
Packit |
7b22a4 |
reject_table[reject->with].xlate);
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "reject with icmpv6 type %s",
|
|
Packit |
7b22a4 |
reject_table[reject->with].xlate);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static struct xtables_target reject_tg6_reg = {
|
|
Packit |
7b22a4 |
.name = "REJECT",
|
|
Packit |
7b22a4 |
.version = XTABLES_VERSION,
|
|
Packit |
7b22a4 |
.family = NFPROTO_IPV6,
|
|
Packit |
7b22a4 |
.size = XT_ALIGN(sizeof(struct ip6t_reject_info)),
|
|
Packit |
7b22a4 |
.userspacesize = XT_ALIGN(sizeof(struct ip6t_reject_info)),
|
|
Packit |
7b22a4 |
.help = REJECT_help,
|
|
Packit |
7b22a4 |
.init = REJECT_init,
|
|
Packit |
7b22a4 |
.print = REJECT_print,
|
|
Packit |
7b22a4 |
.save = REJECT_save,
|
|
Packit |
7b22a4 |
.x6_parse = REJECT_parse,
|
|
Packit |
7b22a4 |
.x6_options = REJECT_opts,
|
|
Packit |
7b22a4 |
.xlate = REJECT_xlate,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void _init(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
xtables_register_target(&reject_tg6_reg);
|
|
Packit |
7b22a4 |
}
|