added libip6t_REJECT.c for IPv6 reject support

diff --git a/extensions/Makefile b/extensions/Makefile
index d7b617332590e5a81a8b87d42a4bb2e9dd067aa1..012133634a3d1fb79d7c4a41095cbc7edf21dc9d 100644 (file)
--- a/extensions/Makefile
+++ b/extensions/Makefile
@@ -1,7 +1,7 @@
 #! /usr/bin/make
 
 PF_EXT_SLIB:=tcp udp icmp mac limit standard REJECT LOG unclean state multiport tos TOS mark MARK owner SNAT DNAT MASQUERADE REDIRECT MIRROR SAME
-PF6_EXT_SLIB:=tcp udp icmpv6 standard MARK mark
+PF6_EXT_SLIB:=tcp udp icmpv6 standard MARK mark REJECT
 
 # The following may not be present, but compile them anyway.
 PF_EXT_SLIB+=FTOS TCPMSS TTL ULOG ah esp iplimit tcpmss ttl

diff --git a/extensions/libip6t_REJECT.c b/extensions/libip6t_REJECT.c
new file mode 100644 (file)
index 0000000..ab8595d
--- /dev/null
+++ b/extensions/libip6t_REJECT.c
@@ -0,0 +1,172 @@
+/* Shared library add-on to iptables to add customized REJECT support.
+ *
+ * (C) 2000 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ * 
+ * ported to IPv6 by Harald Welte <laforge@gnumonks.org>
+ *
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <ip6tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv6/ip6t_REJECT.h>
+
+struct reject_names {
+       const char *name;
+       const char *alias;
+       enum ip6t_reject_with with;
+       const char *desc;
+};
+
+static const struct reject_names reject_table[] = {
+       {"icmp6-no-route", "no-route",
+               IP6T_ICMP6_NO_ROUTE, "ICMPv6 no route"},
+       {"icmp6-adm-prohibited", "adm-prohibited",
+               IP6T_ICMP6_ADM_PROHIBITED, "ICMPv6 administratively prohibited"},
+#if 0
+       {"icmp6-not-neighbor", "not-neighbor"},
+               IP6T_ICMP6_NOT_NEIGHBOR, "ICMPv6 not a neighbor"},
+#endif
+       {"icmp6-addr-unreachable", "addr-unreach",
+               IP6T_ICMP6_ADDR_UNREACH, "ICMPv6 address unreachable"},
+       {"icmp6-port-unreachable", "port-unreach",
+               IP6T_ICMP6_PORT_UNREACH, "ICMPv6 port unreachable"},
+       {"tcp-reset", "tcp-reset",
+               IP6T_TCP_RESET, "TCP RST packet"}
+};
+
+static void
+print_reject_types()
+{
+       unsigned int i;
+
+       printf("Valid reject types:\n");
+
+       for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
+               printf("    %-25s\t%s\n", reject_table[i].name, reject_table[i].desc);
+               printf("    %-25s\talias\n", reject_table[i].alias);
+       }
+       printf("\n");
+}
+
+/* Saves the union ipt_targinfo in parsable form to stdout. */
+
+/* Function which prints out usage message. */
+static void
+help(void)
+{
+       printf(
+"REJECT options:\n"
+"--reject-with type              drop input packet and send back\n"
+"                                a reply packet according to type:\n");
+
+       print_reject_types();
+}
+
+static struct option opts[] = {
+       { "reject-with", 1, 0, '1' },
+       { 0 }
+};
+
+/* Allocate and initialize the target. */
+static void
+init(struct ip6t_entry_target *t, unsigned int *nfcache)
+{
+       struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data;
+
+       /* default */
+       reject->with = IP6T_ICMP6_PORT_UNREACH;
+
+       /* Can't cache this */
+       *nfcache |= NFC_UNKNOWN;
+}
+
+/* Function which parses command options; returns true if it
+   ate an option */
+static int
+parse(int c, char **argv, int invert, unsigned int *flags,
+      const struct ip6t_entry *entry,
+      struct ip6t_entry_target **target)
+{
+       struct ip6t_reject_info *reject = 
+               (struct ip6t_reject_info *)(*target)->data;
+       unsigned int limit = sizeof(reject_table)/sizeof(struct reject_names);
+       unsigned int i;
+
+       switch(c) {
+       case '1':
+               if (check_inverse(optarg, &invert))
+                       exit_error(PARAMETER_PROBLEM,
+                                  "Unexpected `!' after --reject-with");
+               for (i = 0; i < limit; i++) {
+                       if ((strncasecmp(reject_table[i].name, optarg, strlen(optarg)) == 0)
+                           || (strncasecmp(reject_table[i].alias, optarg, strlen(optarg)) == 0)) {
+                               reject->with = reject_table[i].with;
+                               return 1;
+                       }
+               }
+               exit_error(PARAMETER_PROBLEM, "unknown reject type `%s'",optarg);
+       default:
+               /* Fall through */
+       }
+       return 0;
+}
+
+/* Final check; nothing. */
+static void final_check(unsigned int flags)
+{
+}
+
+/* Prints out ipt_reject_info. */
+static void
+print(const struct ip6t_ip6 *ip,
+      const struct ip6t_entry_target *target,
+      int numeric)
+{
+       const struct ip6t_reject_info *reject
+               = (const struct ip6t_reject_info *)target->data;
+       unsigned int i;
+
+       for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
+               if (reject_table[i].with == reject->with)
+                       break;
+       }
+       printf("reject-with %s ", reject_table[i].name);
+}
+
+/* Saves ipt_reject in parsable form to stdout. */
+static void save(const struct ip6t_ip6 *ip, 
+                const struct ip6t_entry_target *target)
+{
+       const struct ip6t_reject_info *reject
+               = (const struct ip6t_reject_info *)target->data;
+       unsigned int i;
+
+       for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++)
+               if (reject_table[i].with == reject->with)
+                       break;
+
+       printf("--reject-with %s ", reject_table[i].name);
+}
+
+struct ip6tables_target reject
+= { NULL,
+    "REJECT",
+    NETFILTER_VERSION,
+    IP6T_ALIGN(sizeof(struct ip6t_reject_info)),
+    IP6T_ALIGN(sizeof(struct ip6t_reject_info)),
+    &help,
+    &init,
+    &parse,
+    &final_check,
+    &print,
+    &save,
+    opts
+};
+
+void _init(void)
+{
+       register_target6(&reject);
+}

diff --git a/include/linux/netfilter_ipv6/ip6t_REJECT.h b/include/linux/netfilter_ipv6/ip6t_REJECT.h
new file mode 100644 (file)
index 0000000..7266402
--- /dev/null
+++ b/include/linux/netfilter_ipv6/ip6t_REJECT.h
@@ -0,0 +1,16 @@
+#ifndef _IP6T_REJECT_H
+#define _IP6T_REJECT_H
+
+enum ip6t_reject_with {
+       IP6T_ICMP6_NO_ROUTE,
+       IP6T_ICMP6_ADM_PROHIBITED,
+       IP6T_ICMP6_ADDR_UNREACH,
+       IP6T_ICMP6_PORT_UNREACH,
+       IP6T_TCP_RESET
+};
+
+struct ip6t_reject_info {
+       enum ip6t_reject_with with;      /* reject type */
+};
+
+#endif /*_IP6T_REJECT_H*/