1 /* Shared library add-on to iptables to add customized REJECT support.
3 * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5 * ported to IPv6 by Harald Welte <laforge@gnumonks.org>
12 #include <ip6tables.h>
13 #include <linux/netfilter_ipv6/ip6_tables.h>
14 #include <linux/netfilter_ipv6/ip6t_REJECT.h>
19 enum ip6t_reject_with with
;
23 static const struct reject_names reject_table
[] = {
24 {"icmp6-no-route", "no-route",
25 IP6T_ICMP6_NO_ROUTE
, "ICMPv6 no route"},
26 {"icmp6-adm-prohibited", "adm-prohibited",
27 IP6T_ICMP6_ADM_PROHIBITED
, "ICMPv6 administratively prohibited"},
29 {"icmp6-not-neighbor", "not-neighbor"},
30 IP6T_ICMP6_NOT_NEIGHBOR
, "ICMPv6 not a neighbor"},
32 {"icmp6-addr-unreachable", "addr-unreach",
33 IP6T_ICMP6_ADDR_UNREACH
, "ICMPv6 address unreachable"},
34 {"icmp6-port-unreachable", "port-unreach",
35 IP6T_ICMP6_PORT_UNREACH
, "ICMPv6 port unreachable"},
36 {"tcp-reset", "tcp-reset",
37 IP6T_TCP_RESET
, "TCP RST packet"}
45 printf("Valid reject types:\n");
47 for (i
= 0; i
< sizeof(reject_table
)/sizeof(struct reject_names
); i
++) {
48 printf(" %-25s\t%s\n", reject_table
[i
].name
, reject_table
[i
].desc
);
49 printf(" %-25s\talias\n", reject_table
[i
].alias
);
54 /* Saves the union ipt_targinfo in parsable form to stdout. */
56 /* Function which prints out usage message. */
62 "--reject-with type drop input packet and send back\n"
63 " a reply packet according to type:\n");
68 static struct option opts
[] = {
69 { "reject-with", 1, 0, '1' },
73 /* Allocate and initialize the target. */
75 init(struct ip6t_entry_target
*t
, unsigned int *nfcache
)
77 struct ip6t_reject_info
*reject
= (struct ip6t_reject_info
*)t
->data
;
80 reject
->with
= IP6T_ICMP6_PORT_UNREACH
;
84 /* Function which parses command options; returns true if it
87 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
88 const struct ip6t_entry
*entry
,
89 struct ip6t_entry_target
**target
)
91 struct ip6t_reject_info
*reject
=
92 (struct ip6t_reject_info
*)(*target
)->data
;
93 unsigned int limit
= sizeof(reject_table
)/sizeof(struct reject_names
);
98 if (check_inverse(optarg
, &invert
, NULL
, 0))
99 exit_error(PARAMETER_PROBLEM
,
100 "Unexpected `!' after --reject-with");
101 for (i
= 0; i
< limit
; i
++) {
102 if ((strncasecmp(reject_table
[i
].name
, optarg
, strlen(optarg
)) == 0)
103 || (strncasecmp(reject_table
[i
].alias
, optarg
, strlen(optarg
)) == 0)) {
104 reject
->with
= reject_table
[i
].with
;
108 exit_error(PARAMETER_PROBLEM
, "unknown reject type `%s'",optarg
);
116 /* Final check; nothing. */
117 static void final_check(unsigned int flags
)
121 /* Prints out ipt_reject_info. */
123 print(const struct ip6t_ip6
*ip
,
124 const struct ip6t_entry_target
*target
,
127 const struct ip6t_reject_info
*reject
128 = (const struct ip6t_reject_info
*)target
->data
;
131 for (i
= 0; i
< sizeof(reject_table
)/sizeof(struct reject_names
); i
++) {
132 if (reject_table
[i
].with
== reject
->with
)
135 printf("reject-with %s ", reject_table
[i
].name
);
138 /* Saves ipt_reject in parsable form to stdout. */
139 static void save(const struct ip6t_ip6
*ip
,
140 const struct ip6t_entry_target
*target
)
142 const struct ip6t_reject_info
*reject
143 = (const struct ip6t_reject_info
*)target
->data
;
146 for (i
= 0; i
< sizeof(reject_table
)/sizeof(struct reject_names
); i
++)
147 if (reject_table
[i
].with
== reject
->with
)
150 printf("--reject-with %s ", reject_table
[i
].name
);
153 struct ip6tables_target reject
= {
155 .version
= IPTABLES_VERSION
,
156 .size
= IP6T_ALIGN(sizeof(struct ip6t_reject_info
)),
157 .userspacesize
= IP6T_ALIGN(sizeof(struct ip6t_reject_info
)),
161 .final_check
= &final_check
,
169 register_target6(&reject
);