libip6t_icmp6.c revision d09b6d591ca7d7d7575cb6aa20384c9830f777ab 
1/* Shared library add-on to ip6tables to add ICMP support. */
2#include <stdbool.h>
3#include <stdio.h>
4#include <netdb.h>
5#include <string.h>
6#include <stdlib.h>
7#include <getopt.h>
8#include <xtables.h>
9#include <limits.h> /* INT_MAX in ip6_tables.h */
10#include <linux/netfilter_ipv6/ip6_tables.h>
11
12struct icmpv6_names {
13	const char *name;
14	uint8_t type;
15	uint8_t code_min, code_max;
16};
17
18static const struct icmpv6_names icmpv6_codes[] = {
19	{ "destination-unreachable", 1, 0, 0xFF },
20	{   "no-route", 1, 0, 0 },
21	{   "communication-prohibited", 1, 1, 1 },
22	{   "address-unreachable", 1, 3, 3 },
23	{   "port-unreachable", 1, 4, 4 },
24
25	{ "packet-too-big", 2, 0, 0xFF },
26
27	{ "time-exceeded", 3, 0, 0xFF },
28	/* Alias */ { "ttl-exceeded", 3, 0, 0xFF },
29	{   "ttl-zero-during-transit", 3, 0, 0 },
30	{   "ttl-zero-during-reassembly", 3, 1, 1 },
31
32	{ "parameter-problem", 4, 0, 0xFF },
33	{   "bad-header", 4, 0, 0 },
34	{   "unknown-header-type", 4, 1, 1 },
35	{   "unknown-option", 4, 2, 2 },
36
37	{ "echo-request", 128, 0, 0xFF },
38	/* Alias */ { "ping", 128, 0, 0xFF },
39
40	{ "echo-reply", 129, 0, 0xFF },
41	/* Alias */ { "pong", 129, 0, 0xFF },
42
43	{ "router-solicitation", 133, 0, 0xFF },
44
45	{ "router-advertisement", 134, 0, 0xFF },
46
47	{ "neighbour-solicitation", 135, 0, 0xFF },
48	/* Alias */ { "neighbor-solicitation", 135, 0, 0xFF },
49
50	{ "neighbour-advertisement", 136, 0, 0xFF },
51	/* Alias */ { "neighbor-advertisement", 136, 0, 0xFF },
52
53	{ "redirect", 137, 0, 0xFF },
54
55};
56
57static void
58print_icmpv6types(void)
59{
60	unsigned int i;
61	printf("Valid ICMPv6 Types:");
62
63	for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) {
64		if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) {
65			if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min
66			    && (icmpv6_codes[i].code_max
67				== icmpv6_codes[i-1].code_max))
68				printf(" (%s)", icmpv6_codes[i].name);
69			else
70				printf("\n   %s", icmpv6_codes[i].name);
71		}
72		else
73			printf("\n%s", icmpv6_codes[i].name);
74	}
75	printf("\n");
76}
77
78static void icmp6_help(void)
79{
80	printf(
81"icmpv6 match options:\n"
82"[!] --icmpv6-type typename	match icmpv6 type\n"
83"				(or numeric type or type/code)\n");
84	print_icmpv6types();
85}
86
87static const struct option icmp6_opts[] = {
88	{.name = "icmpv6-type", .has_arg = true, .val = '1'},
89	XT_GETOPT_TABLEEND,
90};
91
92static void
93parse_icmpv6(const char *icmpv6type, uint8_t *type, uint8_t code[])
94{
95	static const unsigned int limit = ARRAY_SIZE(icmpv6_codes);
96	unsigned int match = limit;
97	unsigned int i;
98
99	for (i = 0; i < limit; i++) {
100		if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))
101		    == 0) {
102			if (match != limit)
103				xtables_error(PARAMETER_PROBLEM,
104					   "Ambiguous ICMPv6 type `%s':"
105					   " `%s' or `%s'?",
106					   icmpv6type,
107					   icmpv6_codes[match].name,
108					   icmpv6_codes[i].name);
109			match = i;
110		}
111	}
112
113	if (match != limit) {
114		*type = icmpv6_codes[match].type;
115		code[0] = icmpv6_codes[match].code_min;
116		code[1] = icmpv6_codes[match].code_max;
117	} else {
118		char *slash;
119		char buffer[strlen(icmpv6type) + 1];
120		unsigned int number;
121
122		strcpy(buffer, icmpv6type);
123		slash = strchr(buffer, '/');
124
125		if (slash)
126			*slash = '\0';
127
128		if (!xtables_strtoui(buffer, NULL, &number, 0, UINT8_MAX))
129			xtables_error(PARAMETER_PROBLEM,
130				   "Invalid ICMPv6 type `%s'\n", buffer);
131		*type = number;
132		if (slash) {
133			if (!xtables_strtoui(slash+1, NULL, &number, 0, UINT8_MAX))
134				xtables_error(PARAMETER_PROBLEM,
135					   "Invalid ICMPv6 code `%s'\n",
136					   slash+1);
137			code[0] = code[1] = number;
138		} else {
139			code[0] = 0;
140			code[1] = 0xFF;
141		}
142	}
143}
144
145static void icmp6_init(struct xt_entry_match *m)
146{
147	struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data;
148
149	icmpv6info->code[1] = 0xFF;
150}
151
152static int icmp6_parse(int c, char **argv, int invert, unsigned int *flags,
153                       const void *entry, struct xt_entry_match **match)
154{
155	struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)(*match)->data;
156
157	switch (c) {
158	case '1':
159		if (*flags == 1)
160			xtables_error(PARAMETER_PROBLEM,
161				   "icmpv6 match: only use --icmpv6-type once!");
162		xtables_check_inverse(optarg, &invert, &optind, 0, argv);
163		parse_icmpv6(optarg, &icmpv6info->type,
164			     icmpv6info->code);
165		if (invert)
166			icmpv6info->invflags |= IP6T_ICMP_INV;
167		*flags = 1;
168		break;
169	}
170
171	return 1;
172}
173
174static void print_icmpv6type(uint8_t type,
175			   uint8_t code_min, uint8_t code_max,
176			   int invert,
177			   int numeric)
178{
179	if (!numeric) {
180		unsigned int i;
181
182		for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
183			if (icmpv6_codes[i].type == type
184			    && icmpv6_codes[i].code_min == code_min
185			    && icmpv6_codes[i].code_max == code_max)
186				break;
187
188		if (i != ARRAY_SIZE(icmpv6_codes)) {
189			printf("%s%s ",
190			       invert ? "!" : "",
191			       icmpv6_codes[i].name);
192			return;
193		}
194	}
195
196	if (invert)
197		printf("!");
198
199	printf("type %u", type);
200	if (code_min == 0 && code_max == 0xFF)
201		printf(" ");
202	else if (code_min == code_max)
203		printf(" code %u ", code_min);
204	else
205		printf(" codes %u-%u ", code_min, code_max);
206}
207
208static void icmp6_print(const void *ip, const struct xt_entry_match *match,
209                        int numeric)
210{
211	const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
212
213	printf("ipv6-icmp ");
214	print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1],
215		       icmpv6->invflags & IP6T_ICMP_INV,
216		       numeric);
217
218	if (icmpv6->invflags & ~IP6T_ICMP_INV)
219		printf("Unknown invflags: 0x%X ",
220		       icmpv6->invflags & ~IP6T_ICMP_INV);
221}
222
223static void icmp6_save(const void *ip, const struct xt_entry_match *match)
224{
225	const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
226
227	if (icmpv6->invflags & IP6T_ICMP_INV)
228		printf("! ");
229
230	printf("--icmpv6-type %u", icmpv6->type);
231	if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF)
232		printf("/%u", icmpv6->code[0]);
233	printf(" ");
234}
235
236static void icmp6_check(unsigned int flags)
237{
238	if (!flags)
239		xtables_error(PARAMETER_PROBLEM,
240			   "icmpv6 match: You must specify `--icmpv6-type'");
241}
242
243static struct xtables_match icmp6_mt6_reg = {
244	.name 		= "icmp6",
245	.version 	= XTABLES_VERSION,
246	.family		= NFPROTO_IPV6,
247	.size		= XT_ALIGN(sizeof(struct ip6t_icmp)),
248	.userspacesize	= XT_ALIGN(sizeof(struct ip6t_icmp)),
249	.help		= icmp6_help,
250	.init		= icmp6_init,
251	.parse		= icmp6_parse,
252	.final_check	= icmp6_check,
253	.print		= icmp6_print,
254	.save		= icmp6_save,
255	.extra_opts	= icmp6_opts,
256};
257
258void _init(void)
259{
260	xtables_register_match(&icmp6_mt6_reg);
261}
262