libip6t_icmp6.c revision 5f2922cfc0bbfbeb878f5c12e9fb3eb602ae5507 
1/* Shared library add-on to ip6tables to add ICMP support. */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <getopt.h>
7#include <xtables.h>
8#include <linux/netfilter_ipv6/ip6_tables.h>
9
10struct icmpv6_names {
11	const char *name;
12	u_int8_t type;
13	u_int8_t code_min, code_max;
14};
15
16static const struct icmpv6_names icmpv6_codes[] = {
17	{ "destination-unreachable", 1, 0, 0xFF },
18	{   "no-route", 1, 0, 0 },
19	{   "communication-prohibited", 1, 1, 1 },
20	{   "address-unreachable", 1, 3, 3 },
21	{   "port-unreachable", 1, 4, 4 },
22
23	{ "packet-too-big", 2, 0, 0xFF },
24
25	{ "time-exceeded", 3, 0, 0xFF },
26	/* Alias */ { "ttl-exceeded", 3, 0, 0xFF },
27	{   "ttl-zero-during-transit", 3, 0, 0 },
28	{   "ttl-zero-during-reassembly", 3, 1, 1 },
29
30	{ "parameter-problem", 4, 0, 0xFF },
31	{   "bad-header", 4, 0, 0 },
32	{   "unknown-header-type", 4, 1, 1 },
33	{   "unknown-option", 4, 2, 2 },
34
35	{ "echo-request", 128, 0, 0xFF },
36	/* Alias */ { "ping", 128, 0, 0xFF },
37
38	{ "echo-reply", 129, 0, 0xFF },
39	/* Alias */ { "pong", 129, 0, 0xFF },
40
41	{ "router-solicitation", 133, 0, 0xFF },
42
43	{ "router-advertisement", 134, 0, 0xFF },
44
45	{ "neighbour-solicitation", 135, 0, 0xFF },
46	/* Alias */ { "neighbor-solicitation", 135, 0, 0xFF },
47
48	{ "neighbour-advertisement", 136, 0, 0xFF },
49	/* Alias */ { "neighbor-advertisement", 136, 0, 0xFF },
50
51	{ "redirect", 137, 0, 0xFF },
52
53};
54
55static void
56print_icmpv6types(void)
57{
58	unsigned int i;
59	printf("Valid ICMPv6 Types:");
60
61	for (i = 0; i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names); i++) {
62		if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) {
63			if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min
64			    && (icmpv6_codes[i].code_max
65				== icmpv6_codes[i-1].code_max))
66				printf(" (%s)", icmpv6_codes[i].name);
67			else
68				printf("\n   %s", icmpv6_codes[i].name);
69		}
70		else
71			printf("\n%s", icmpv6_codes[i].name);
72	}
73	printf("\n");
74}
75
76static void icmp6_help(void)
77{
78	printf(
79"icmpv6 match options:\n"
80"[!] --icmpv6-type typename	match icmpv6 type\n"
81"				(or numeric type or type/code)\n");
82	print_icmpv6types();
83}
84
85static const struct option icmp6_opts[] = {
86	{ "icmpv6-type", 1, NULL, '1' },
87	{ .name = NULL }
88};
89
90static void
91parse_icmpv6(const char *icmpv6type, u_int8_t *type, u_int8_t code[])
92{
93	unsigned int limit = sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
94	unsigned int match = limit;
95	unsigned int i;
96
97	for (i = 0; i < limit; i++) {
98		if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))
99		    == 0) {
100			if (match != limit)
101				exit_error(PARAMETER_PROBLEM,
102					   "Ambiguous ICMPv6 type `%s':"
103					   " `%s' or `%s'?",
104					   icmpv6type,
105					   icmpv6_codes[match].name,
106					   icmpv6_codes[i].name);
107			match = i;
108		}
109	}
110
111	if (match != limit) {
112		*type = icmpv6_codes[match].type;
113		code[0] = icmpv6_codes[match].code_min;
114		code[1] = icmpv6_codes[match].code_max;
115	} else {
116		char *slash;
117		char buffer[strlen(icmpv6type) + 1];
118		unsigned int number;
119
120		strcpy(buffer, icmpv6type);
121		slash = strchr(buffer, '/');
122
123		if (slash)
124			*slash = '\0';
125
126		if (!xtables_strtoui(buffer, NULL, &number, 0, UINT8_MAX))
127			exit_error(PARAMETER_PROBLEM,
128				   "Invalid ICMPv6 type `%s'\n", buffer);
129		*type = number;
130		if (slash) {
131			if (!xtables_strtoui(slash+1, NULL, &number, 0, UINT8_MAX))
132				exit_error(PARAMETER_PROBLEM,
133					   "Invalid ICMPv6 code `%s'\n",
134					   slash+1);
135			code[0] = code[1] = number;
136		} else {
137			code[0] = 0;
138			code[1] = 0xFF;
139		}
140	}
141}
142
143static void icmp6_init(struct xt_entry_match *m)
144{
145	struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data;
146
147	icmpv6info->code[1] = 0xFF;
148}
149
150static int icmp6_parse(int c, char **argv, int invert, unsigned int *flags,
151                       const void *entry, struct xt_entry_match **match)
152{
153	struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)(*match)->data;
154
155	switch (c) {
156	case '1':
157		if (*flags == 1)
158			exit_error(PARAMETER_PROBLEM,
159				   "icmpv6 match: only use --icmpv6-type once!");
160		check_inverse(optarg, &invert, &optind, 0);
161		parse_icmpv6(argv[optind-1], &icmpv6info->type,
162			     icmpv6info->code);
163		if (invert)
164			icmpv6info->invflags |= IP6T_ICMP_INV;
165		*flags = 1;
166		break;
167
168	default:
169		return 0;
170	}
171
172	return 1;
173}
174
175static void print_icmpv6type(u_int8_t type,
176			   u_int8_t code_min, u_int8_t code_max,
177			   int invert,
178			   int numeric)
179{
180	if (!numeric) {
181		unsigned int i;
182
183		for (i = 0;
184		     i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
185		     i++) {
186			if (icmpv6_codes[i].type == type
187			    && icmpv6_codes[i].code_min == code_min
188			    && icmpv6_codes[i].code_max == code_max)
189				break;
190		}
191
192		if (i != sizeof(icmpv6_codes)/sizeof(struct icmpv6_names)) {
193			printf("%s%s ",
194			       invert ? "!" : "",
195			       icmpv6_codes[i].name);
196			return;
197		}
198	}
199
200	if (invert)
201		printf("!");
202
203	printf("type %u", type);
204	if (code_min == 0 && code_max == 0xFF)
205		printf(" ");
206	else if (code_min == code_max)
207		printf(" code %u ", code_min);
208	else
209		printf(" codes %u-%u ", code_min, code_max);
210}
211
212static void icmp6_print(const void *ip, const struct xt_entry_match *match,
213                        int numeric)
214{
215	const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
216
217	printf("ipv6-icmp ");
218	print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1],
219		       icmpv6->invflags & IP6T_ICMP_INV,
220		       numeric);
221
222	if (icmpv6->invflags & ~IP6T_ICMP_INV)
223		printf("Unknown invflags: 0x%X ",
224		       icmpv6->invflags & ~IP6T_ICMP_INV);
225}
226
227static void icmp6_save(const void *ip, const struct xt_entry_match *match)
228{
229	const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
230
231	if (icmpv6->invflags & IP6T_ICMP_INV)
232		printf("! ");
233
234	printf("--icmpv6-type %u", icmpv6->type);
235	if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF)
236		printf("/%u", icmpv6->code[0]);
237	printf(" ");
238}
239
240static void icmp6_check(unsigned int flags)
241{
242	if (!flags)
243		exit_error(PARAMETER_PROBLEM,
244			   "icmpv6 match: You must specify `--icmpv6-type'");
245}
246
247static struct xtables_match icmp6_mt6_reg = {
248	.name 		= "icmp6",
249	.version 	= XTABLES_VERSION,
250	.family		= NFPROTO_IPV6,
251	.size		= XT_ALIGN(sizeof(struct ip6t_icmp)),
252	.userspacesize	= XT_ALIGN(sizeof(struct ip6t_icmp)),
253	.help		= icmp6_help,
254	.init		= icmp6_init,
255	.parse		= icmp6_parse,
256	.final_check	= icmp6_check,
257	.print		= icmp6_print,
258	.save		= icmp6_save,
259	.extra_opts	= icmp6_opts,
260};
261
262void _init(void)
263{
264	xtables_register_match(&icmp6_mt6_reg);
265}
266