1 /* Shared library add-on to iptables to add customized REJECT support.
2 *
3 * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4 */
5 #include <stdio.h>
6 #include <string.h>
7 #include <xtables.h>
8 #include <linux/netfilter_ipv4/ipt_REJECT.h>
9 #include <linux/version.h>
10
11 /* If we are compiling against a kernel that does not support
12 * IPT_ICMP_ADMIN_PROHIBITED, we are emulating it.
13 * The result will be a plain DROP of the packet instead of
14 * reject. -- Maciej Soltysiak <solt@dns.toxicfilms.tv>
15 */
16 #ifndef IPT_ICMP_ADMIN_PROHIBITED
17 #define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1
18 #endif
19
20 struct reject_names {
21 const char *name;
22 const char *alias;
23 const char *desc;
24 const char *xlate;
25 };
26
27 enum {
28 O_REJECT_WITH = 0,
29 };
30
31 static const struct reject_names reject_table[] = {
32 [IPT_ICMP_NET_UNREACHABLE] = {
33 "icmp-net-unreachable", "net-unreach",
34 "ICMP network unreachable",
35 "net-unreachable",
36 },
37 [IPT_ICMP_HOST_UNREACHABLE] = {
38 "icmp-host-unreachable", "host-unreach",
39 "ICMP host unreachable",
40 "host-unreachable",
41 },
42 [IPT_ICMP_PROT_UNREACHABLE] = {
43 "icmp-proto-unreachable", "proto-unreach",
44 "ICMP protocol unreachable",
45 "prot-unreachable",
46 },
47 [IPT_ICMP_PORT_UNREACHABLE] = {
48 "icmp-port-unreachable", "port-unreach",
49 "ICMP port unreachable (default)",
50 "port-unreachable",
51 },
52 #if 0
53 [IPT_ICMP_ECHOREPLY] = {
54 "echo-reply", "echoreply",
55 "for ICMP echo only: faked ICMP echo reply",
56 "echo-reply",
57 },
58 #endif
59 [IPT_ICMP_NET_PROHIBITED] = {
60 "icmp-net-prohibited", "net-prohib",
61 "ICMP network prohibited",
62 "net-prohibited",
63 },
64 [IPT_ICMP_HOST_PROHIBITED] = {
65 "icmp-host-prohibited", "host-prohib",
66 "ICMP host prohibited",
67 "host-prohibited",
68 },
69 [IPT_TCP_RESET] = {
70 "tcp-reset", "tcp-rst",
71 "TCP RST packet",
72 "tcp reset",
73 },
74 [IPT_ICMP_ADMIN_PROHIBITED] = {
75 "icmp-admin-prohibited", "admin-prohib",
76 "ICMP administratively prohibited (*)",
77 "admin-prohibited",
78 },
79 };
80
81 static void
print_reject_types(void)82 print_reject_types(void)
83 {
84 unsigned int i;
85
86 printf("Valid reject types:\n");
87
88 for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
89 if (!reject_table[i].name)
90 continue;
91 printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
92 printf(" %-25s\talias\n", reject_table[i].alias);
93 }
94 printf("\n");
95 }
96
REJECT_help(void)97 static void REJECT_help(void)
98 {
99 printf(
100 "REJECT target options:\n"
101 "--reject-with type drop input packet and send back\n"
102 " a reply packet according to type:\n");
103
104 print_reject_types();
105
106 printf("(*) See man page or read the INCOMPATIBILITES file for compatibility issues.\n");
107 }
108
109 static const struct xt_option_entry REJECT_opts[] = {
110 {.name = "reject-with", .id = O_REJECT_WITH, .type = XTTYPE_STRING},
111 XTOPT_TABLEEND,
112 };
113
REJECT_init(struct xt_entry_target * t)114 static void REJECT_init(struct xt_entry_target *t)
115 {
116 struct ipt_reject_info *reject = (struct ipt_reject_info *)t->data;
117
118 /* default */
119 reject->with = IPT_ICMP_PORT_UNREACHABLE;
120
121 }
122
REJECT_parse(struct xt_option_call * cb)123 static void REJECT_parse(struct xt_option_call *cb)
124 {
125 struct ipt_reject_info *reject = cb->data;
126 unsigned int i;
127
128 xtables_option_parse(cb);
129 for (i = 0; i < ARRAY_SIZE(reject_table); ++i) {
130 if (!reject_table[i].name)
131 continue;
132 if (strncasecmp(reject_table[i].name,
133 cb->arg, strlen(cb->arg)) == 0 ||
134 strncasecmp(reject_table[i].alias,
135 cb->arg, strlen(cb->arg)) == 0) {
136 reject->with = i;
137 return;
138 }
139 }
140 /* This due to be dropped late in 2.4 pre-release cycle --RR */
141 if (strncasecmp("echo-reply", cb->arg, strlen(cb->arg)) == 0 ||
142 strncasecmp("echoreply", cb->arg, strlen(cb->arg)) == 0)
143 fprintf(stderr, "--reject-with echo-reply no longer"
144 " supported\n");
145 xtables_error(PARAMETER_PROBLEM,
146 "unknown reject type \"%s\"", cb->arg);
147 }
148
REJECT_print(const void * ip,const struct xt_entry_target * target,int numeric)149 static void REJECT_print(const void *ip, const struct xt_entry_target *target,
150 int numeric)
151 {
152 const struct ipt_reject_info *reject
153 = (const struct ipt_reject_info *)target->data;
154
155 printf(" reject-with %s", reject_table[reject->with].name);
156 }
157
REJECT_save(const void * ip,const struct xt_entry_target * target)158 static void REJECT_save(const void *ip, const struct xt_entry_target *target)
159 {
160 const struct ipt_reject_info *reject =
161 (const struct ipt_reject_info *)target->data;
162
163 printf(" --reject-with %s", reject_table[reject->with].name);
164 }
165
REJECT_xlate(struct xt_xlate * xl,const struct xt_xlate_tg_params * params)166 static int REJECT_xlate(struct xt_xlate *xl,
167 const struct xt_xlate_tg_params *params)
168 {
169 const struct ipt_reject_info *reject =
170 (const struct ipt_reject_info *)params->target->data;
171
172 if (reject->with == IPT_ICMP_PORT_UNREACHABLE)
173 xt_xlate_add(xl, "reject");
174 else if (reject->with == IPT_TCP_RESET)
175 xt_xlate_add(xl, "reject with %s",
176 reject_table[reject->with].xlate);
177 else
178 xt_xlate_add(xl, "reject with icmp type %s",
179 reject_table[reject->with].xlate);
180
181 return 1;
182 }
183
184
185 static struct xtables_target reject_tg_reg = {
186 .name = "REJECT",
187 .version = XTABLES_VERSION,
188 .family = NFPROTO_IPV4,
189 .size = XT_ALIGN(sizeof(struct ipt_reject_info)),
190 .userspacesize = XT_ALIGN(sizeof(struct ipt_reject_info)),
191 .help = REJECT_help,
192 .init = REJECT_init,
193 .print = REJECT_print,
194 .save = REJECT_save,
195 .x6_parse = REJECT_parse,
196 .x6_options = REJECT_opts,
197 .xlate = REJECT_xlate,
198 };
199
_init(void)200 void _init(void)
201 {
202 xtables_register_target(&reject_tg_reg);
203 }
204