libip6t_icmp6.c revision ea146a982e26c42f9954f140276f8deeb2edbe98 
1/* Shared library add-on to iptables to add ICMP support. */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <getopt.h>
7#include <ip6tables.h>
8#include <linux/netfilter_ipv6/ip6_tables.h>
9
10struct icmpv6_names {
11	const char *name;
12	u_int8_t type;
13	u_int8_t code_min, code_max;
14};
15
16static const struct icmpv6_names icmpv6_codes[] = {
17	{ "destination-unreachable", 1, 0, 0xFF },
18	{   "no-route", 1, 0, 0 },
19	{   "communication-prohibited", 1, 1, 1 },
20	{   "address-unreachable", 1, 3, 3 },
21	{   "port-unreachable", 1, 4, 4 },
22
23	{ "packet-too-big", 2, 0, 0xFF },
24
25	{ "time-exceeded", 3, 0, 0xFF },
26	/* Alias */ { "ttl-exceeded", 3, 0, 0xFF },
27	{   "ttl-zero-during-transit", 3, 0, 0 },
28	{   "ttl-zero-during-reassembly", 3, 1, 1 },
29
30	{ "parameter-problem", 4, 0, 0xFF },
31	{   "bad-header", 4, 0, 0 },
32	{   "unknown-header-type", 4, 1, 1 },
33	{   "unknown-option", 4, 2, 2 },
34
35	{ "echo-request", 128, 0, 0xFF },
36	/* Alias */ { "ping", 128, 0, 0xFF },
37
38	{ "echo-reply", 129, 0, 0xFF },
39	/* Alias */ { "pong", 129, 0, 0xFF },
40
41	{ "router-solicitation", 133, 0, 0xFF },
42
43	{ "router-advertisement", 134, 0, 0xFF },
44
45	{ "neighbour-solicitation", 135, 0, 0xFF },
46	/* Alias */ { "neighbor-solicitation", 135, 0, 0xFF },
47
48	{ "neighbour-advertisement", 136, 0, 0xFF },
49	/* Alias */ { "neighbor-advertisement", 136, 0, 0xFF },
50
51	{ "redirect", 137, 0, 0xFF },
52
53};
54
55static void
56print_icmpv6types()
57{
58	unsigned int i;
59	printf("Valid ICMPv6 Types:");
60
61	for (i = 0; i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names); i++) {
62		if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) {
63			if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min
64			    && (icmpv6_codes[i].code_max
65				== icmpv6_codes[i-1].code_max))
66				printf(" (%s)", icmpv6_codes[i].name);
67			else
68				printf("\n   %s", icmpv6_codes[i].name);
69		}
70		else
71			printf("\n%s", icmpv6_codes[i].name);
72	}
73	printf("\n");
74}
75
76/* Function which prints out usage message. */
77static void
78help(void)
79{
80	printf(
81"ICMPv6 v%s options:\n"
82" --icmpv6-type [!] typename	match icmpv6 type\n"
83"				(or numeric type or type/code)\n"
84"\n", IPTABLES_VERSION);
85	print_icmpv6types();
86}
87
88static const struct option opts[] = {
89	{ "icmpv6-type", 1, 0, '1' },
90	{0}
91};
92
93static void
94parse_icmpv6(const char *icmpv6type, u_int8_t *type, u_int8_t code[])
95{
96	unsigned int limit = sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
97	unsigned int match = limit;
98	unsigned int i;
99
100	for (i = 0; i < limit; i++) {
101		if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))
102		    == 0) {
103			if (match != limit)
104				exit_error(PARAMETER_PROBLEM,
105					   "Ambiguous ICMPv6 type `%s':"
106					   " `%s' or `%s'?",
107					   icmpv6type,
108					   icmpv6_codes[match].name,
109					   icmpv6_codes[i].name);
110			match = i;
111		}
112	}
113
114	if (match != limit) {
115		*type = icmpv6_codes[match].type;
116		code[0] = icmpv6_codes[match].code_min;
117		code[1] = icmpv6_codes[match].code_max;
118	} else {
119		char *slash;
120		char buffer[strlen(icmpv6type) + 1];
121		unsigned int number;
122
123		strcpy(buffer, icmpv6type);
124		slash = strchr(buffer, '/');
125
126		if (slash)
127			*slash = '\0';
128
129		if (string_to_number(buffer, 0, 255, &number) == -1)
130			exit_error(PARAMETER_PROBLEM,
131				   "Invalid ICMPv6 type `%s'\n", buffer);
132		*type = number;
133		if (slash) {
134			if (string_to_number(slash+1, 0, 255, &number) == -1)
135				exit_error(PARAMETER_PROBLEM,
136					   "Invalid ICMPv6 code `%s'\n",
137					   slash+1);
138			code[0] = code[1] = number;
139		} else {
140			code[0] = 0;
141			code[1] = 0xFF;
142		}
143	}
144}
145
146/* Initialize the match. */
147static void
148init(struct xt_entry_match *m)
149{
150	struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data;
151
152	icmpv6info->code[1] = 0xFF;
153}
154
155/* Function which parses command options; returns true if it
156   ate an option */
157static int
158parse(int c, char **argv, int invert, unsigned int *flags,
159      const void *entry,
160      struct xt_entry_match **match)
161{
162	struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)(*match)->data;
163
164	switch (c) {
165	case '1':
166		if (*flags == 1)
167			exit_error(PARAMETER_PROBLEM,
168				   "icmpv6 match: only use --icmpv6-type once!");
169		check_inverse(optarg, &invert, &optind, 0);
170		parse_icmpv6(argv[optind-1], &icmpv6info->type,
171			     icmpv6info->code);
172		if (invert)
173			icmpv6info->invflags |= IP6T_ICMP_INV;
174		*flags = 1;
175		break;
176
177	default:
178		return 0;
179	}
180
181	return 1;
182}
183
184static void print_icmpv6type(u_int8_t type,
185			   u_int8_t code_min, u_int8_t code_max,
186			   int invert,
187			   int numeric)
188{
189	if (!numeric) {
190		unsigned int i;
191
192		for (i = 0;
193		     i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
194		     i++) {
195			if (icmpv6_codes[i].type == type
196			    && icmpv6_codes[i].code_min == code_min
197			    && icmpv6_codes[i].code_max == code_max)
198				break;
199		}
200
201		if (i != sizeof(icmpv6_codes)/sizeof(struct icmpv6_names)) {
202			printf("%s%s ",
203			       invert ? "!" : "",
204			       icmpv6_codes[i].name);
205			return;
206		}
207	}
208
209	if (invert)
210		printf("!");
211
212	printf("type %u", type);
213	if (code_min == 0 && code_max == 0xFF)
214		printf(" ");
215	else if (code_min == code_max)
216		printf(" code %u ", code_min);
217	else
218		printf(" codes %u-%u ", code_min, code_max);
219}
220
221/* Prints out the union ipt_matchinfo. */
222static void
223print(const void *ip,
224      const struct xt_entry_match *match,
225      int numeric)
226{
227	const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
228
229	printf("ipv6-icmp ");
230	print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1],
231		       icmpv6->invflags & IP6T_ICMP_INV,
232		       numeric);
233
234	if (icmpv6->invflags & ~IP6T_ICMP_INV)
235		printf("Unknown invflags: 0x%X ",
236		       icmpv6->invflags & ~IP6T_ICMP_INV);
237}
238
239/* Saves the match in parsable form to stdout. */
240static void save(const void *ip, const struct xt_entry_match *match)
241{
242	const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
243
244	if (icmpv6->invflags & IP6T_ICMP_INV)
245		printf("! ");
246
247	printf("--icmpv6-type %u", icmpv6->type);
248	if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF)
249		printf("/%u", icmpv6->code[0]);
250	printf(" ");
251}
252
253static void final_check(unsigned int flags)
254{
255	if (!flags)
256		exit_error(PARAMETER_PROBLEM,
257			   "icmpv6 match: You must specify `--icmpv6-type'");
258}
259
260static struct ip6tables_match icmpv6 = {
261	.name 		= "icmp6",
262	.version 	= IPTABLES_VERSION,
263	.size		= IP6T_ALIGN(sizeof(struct ip6t_icmp)),
264	.userspacesize	= IP6T_ALIGN(sizeof(struct ip6t_icmp)),
265	.help		= &help,
266	.init		= &init,
267	.parse		= &parse,
268	.final_check	= &final_check,
269	.print		= &print,
270	.save		= &save,
271	.extra_opts	= opts,
272};
273
274void _init(void)
275{
276	register_match6(&icmpv6);
277}
278