From c8af1fd0a9b8e7e39626c7d66ade0ddc93f25fbe Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Mon, 23 Jul 2001 02:15:09 +0000 Subject: added libip6t_REJECT.c for IPv6 reject support --- extensions/Makefile | 2 +- extensions/libip6t_REJECT.c | 172 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 173 insertions(+), 1 deletion(-) create mode 100644 extensions/libip6t_REJECT.c (limited to 'extensions') diff --git a/extensions/Makefile b/extensions/Makefile index d7b61733..01213363 100644 --- a/extensions/Makefile +++ b/extensions/Makefile @@ -1,7 +1,7 @@ #! /usr/bin/make PF_EXT_SLIB:=tcp udp icmp mac limit standard REJECT LOG unclean state multiport tos TOS mark MARK owner SNAT DNAT MASQUERADE REDIRECT MIRROR SAME -PF6_EXT_SLIB:=tcp udp icmpv6 standard MARK mark +PF6_EXT_SLIB:=tcp udp icmpv6 standard MARK mark REJECT # The following may not be present, but compile them anyway. PF_EXT_SLIB+=FTOS TCPMSS TTL ULOG ah esp iplimit tcpmss ttl diff --git a/extensions/libip6t_REJECT.c b/extensions/libip6t_REJECT.c new file mode 100644 index 00000000..ab8595d9 --- /dev/null +++ b/extensions/libip6t_REJECT.c @@ -0,0 +1,172 @@ +/* Shared library add-on to iptables to add customized REJECT support. + * + * (C) 2000 Jozsef Kadlecsik + * + * ported to IPv6 by Harald Welte + * + */ +#include +#include +#include +#include +#include +#include +#include + +struct reject_names { + const char *name; + const char *alias; + enum ip6t_reject_with with; + const char *desc; +}; + +static const struct reject_names reject_table[] = { + {"icmp6-no-route", "no-route", + IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"}, + {"icmp6-adm-prohibited", "adm-prohibited", + IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"}, +#if 0 + {"icmp6-not-neighbor", "not-neighbor"}, + IP6T_ICMP6_NOT_NEIGHBOR, "ICMPv6 not a neighbor"}, +#endif + {"icmp6-addr-unreachable", "addr-unreach", + IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"}, + {"icmp6-port-unreachable", "port-unreach", + IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"}, + {"tcp-reset", "tcp-reset", + IP6T_TCP_RESET, "TCP RST packet"} +}; + +static void +print_reject_types() +{ + unsigned int i; + + printf("Valid reject types:\n"); + + for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) { + printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); + printf(" %-25s\talias\n", reject_table[i].alias); + } + printf("\n"); +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"REJECT options:\n" +"--reject-with type drop input packet and send back\n" +" a reply packet according to type:\n"); + + print_reject_types(); +} + +static struct option opts[] = { + { "reject-with", 1, 0, '1' }, + { 0 } +}; + +/* Allocate and initialize the target. */ +static void +init(struct ip6t_entry_target *t, unsigned int *nfcache) +{ + struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data; + + /* default */ + reject->with = IP6T_ICMP6_PORT_UNREACH; + + /* Can't cache this */ + *nfcache |= NFC_UNKNOWN; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + struct ip6t_entry_target **target) +{ + struct ip6t_reject_info *reject = + (struct ip6t_reject_info *)(*target)->data; + unsigned int limit = sizeof(reject_table)/sizeof(struct reject_names); + unsigned int i; + + switch(c) { + case '1': + if (check_inverse(optarg, &invert)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --reject-with"); + for (i = 0; i < limit; i++) { + if ((strncasecmp(reject_table[i].name, optarg, strlen(optarg)) == 0) + || (strncasecmp(reject_table[i].alias, optarg, strlen(optarg)) == 0)) { + reject->with = reject_table[i].with; + return 1; + } + } + exit_error(PARAMETER_PROBLEM, "unknown reject type `%s'",optarg); + default: + /* Fall through */ + } + return 0; +} + +/* Final check; nothing. */ +static void final_check(unsigned int flags) +{ +} + +/* Prints out ipt_reject_info. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_target *target, + int numeric) +{ + const struct ip6t_reject_info *reject + = (const struct ip6t_reject_info *)target->data; + unsigned int i; + + for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) { + if (reject_table[i].with == reject->with) + break; + } + printf("reject-with %s ", reject_table[i].name); +} + +/* Saves ipt_reject in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, + const struct ip6t_entry_target *target) +{ + const struct ip6t_reject_info *reject + = (const struct ip6t_reject_info *)target->data; + unsigned int i; + + for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) + if (reject_table[i].with == reject->with) + break; + + printf("--reject-with %s ", reject_table[i].name); +} + +struct ip6tables_target reject += { NULL, + "REJECT", + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_reject_info)), + IP6T_ALIGN(sizeof(struct ip6t_reject_info)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_target6(&reject); +} -- cgit v1.2.3