1 /* Shared library add-on to iptables to add customized REJECT support.
3 * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
10 #include <linux/netfilter_ipv4/ip_tables.h>
11 #include <linux/netfilter_ipv4/ipt_REJECT.h>
12 #include <linux/version.h>
14 /* If we are compiling against a kernel that does not support
15 * IPT_ICMP_ADMIN_PROHIBITED, we are emulating it.
16 * The result will be a plain DROP of the packet instead of
17 * reject. -- Maciej Soltysiak <solt@dns.toxicfilms.tv>
19 #ifndef IPT_ICMP_ADMIN_PROHIBITED
20 #define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1
26 enum ipt_reject_with with;
30 static const struct reject_names reject_table[] = {
31 {"icmp-net-unreachable", "net-unreach",
32 IPT_ICMP_NET_UNREACHABLE, "ICMP network unreachable"},
33 {"icmp-host-unreachable", "host-unreach",
34 IPT_ICMP_HOST_UNREACHABLE, "ICMP host unreachable"},
35 {"icmp-proto-unreachable", "proto-unreach",
36 IPT_ICMP_PROT_UNREACHABLE, "ICMP protocol unreachable"},
37 {"icmp-port-unreachable", "port-unreach",
38 IPT_ICMP_PORT_UNREACHABLE, "ICMP port unreachable (default)"},
40 {"echo-reply", "echoreply",
41 IPT_ICMP_ECHOREPLY, "for ICMP echo only: faked ICMP echo reply"},
43 {"icmp-net-prohibited", "net-prohib",
44 IPT_ICMP_NET_PROHIBITED, "ICMP network prohibited"},
45 {"icmp-host-prohibited", "host-prohib",
46 IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"},
47 {"tcp-reset", "tcp-rst",
48 IPT_TCP_RESET, "TCP RST packet"},
49 {"icmp-admin-prohibited", "admin-prohib",
50 IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited (*)"}
54 print_reject_types(void)
58 printf("Valid reject types:\n");
60 for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
61 printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
62 printf(" %-25s\talias\n", reject_table[i].alias);
67 /* Saves the union ipt_targinfo in parsable form to stdout. */
69 /* Function which prints out usage message. */
70 static void REJECT_help(void)
73 "REJECT target options:\n"
74 "--reject-with type drop input packet and send back\n"
75 " a reply packet according to type:\n");
79 printf("(*) See man page or read the INCOMPATIBILITES file for compatibility issues.\n");
82 static const struct option REJECT_opts[] = {
83 { "reject-with", 1, NULL, '1' },
87 /* Allocate and initialize the target. */
88 static void REJECT_init(struct xt_entry_target *t)
90 struct ipt_reject_info *reject = (struct ipt_reject_info *)t->data;
93 reject->with = IPT_ICMP_PORT_UNREACHABLE;
97 /* Function which parses command options; returns true if it
99 static int REJECT_parse(int c, char **argv, int invert, unsigned int *flags,
100 const void *entry, struct xt_entry_target **target)
102 struct ipt_reject_info *reject = (struct ipt_reject_info *)(*target)->data;
103 unsigned int limit = sizeof(reject_table)/sizeof(struct reject_names);
108 if (check_inverse(optarg, &invert, NULL, 0))
109 exit_error(PARAMETER_PROBLEM,
110 "Unexpected `!' after --reject-with");
111 for (i = 0; i < limit; i++) {
112 if ((strncasecmp(reject_table[i].name, optarg, strlen(optarg)) == 0)
113 || (strncasecmp(reject_table[i].alias, optarg, strlen(optarg)) == 0)) {
114 reject->with = reject_table[i].with;
118 /* This due to be dropped late in 2.4 pre-release cycle --RR */
119 if (strncasecmp("echo-reply", optarg, strlen(optarg)) == 0
120 || strncasecmp("echoreply", optarg, strlen(optarg)) == 0)
121 fprintf(stderr, "--reject-with echo-reply no longer"
123 exit_error(PARAMETER_PROBLEM, "unknown reject type `%s'",optarg);
131 /* Prints out ipt_reject_info. */
132 static void REJECT_print(const void *ip, const struct xt_entry_target *target,
135 const struct ipt_reject_info *reject
136 = (const struct ipt_reject_info *)target->data;
139 for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
140 if (reject_table[i].with == reject->with)
143 printf("reject-with %s ", reject_table[i].name);
146 /* Saves ipt_reject in parsable form to stdout. */
147 static void REJECT_save(const void *ip, const struct xt_entry_target *target)
149 const struct ipt_reject_info *reject
150 = (const struct ipt_reject_info *)target->data;
153 for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++)
154 if (reject_table[i].with == reject->with)
157 printf("--reject-with %s ", reject_table[i].name);
160 static struct xtables_target reject_tg_reg = {
162 .version = XTABLES_VERSION,
164 .size = XT_ALIGN(sizeof(struct ipt_reject_info)),
165 .userspacesize = XT_ALIGN(sizeof(struct ipt_reject_info)),
168 .parse = REJECT_parse,
169 .print = REJECT_print,
171 .extra_opts = REJECT_opts,
176 xtables_register_target(&reject_tg_reg);