libipt_icmp.c revision fc9237da4e8455e34193a56e56e561d7cd0b31ba 
1/* Shared library add-on to iptables to add ICMP support. */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <getopt.h>
7#include <iptables.h>
8#include <linux/netfilter_ipv4/ip_tables.h>
9
10/* special hack for icmp-type 'any':
11 * Up to kernel <=2.4.20 the problem was:
12 * '-p icmp ' matches all icmp packets
13 * '-p icmp -m icmp' matches _only_ ICMP type 0 :(
14 * This is now fixed by initializing the field * to icmp type 0xFF
15 * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
16 */
17
18struct icmp_names {
19	const char *name;
20	u_int8_t type;
21	u_int8_t code_min, code_max;
22};
23
24static const struct icmp_names icmp_codes[] = {
25	{ "any", 0xFF, 0, 0xFF },
26	{ "echo-reply", 0, 0, 0xFF },
27	/* Alias */ { "pong", 0, 0, 0xFF },
28
29	{ "destination-unreachable", 3, 0, 0xFF },
30	{   "network-unreachable", 3, 0, 0 },
31	{   "host-unreachable", 3, 1, 1 },
32	{   "protocol-unreachable", 3, 2, 2 },
33	{   "port-unreachable", 3, 3, 3 },
34	{   "fragmentation-needed", 3, 4, 4 },
35	{   "source-route-failed", 3, 5, 5 },
36	{   "network-unknown", 3, 6, 6 },
37	{   "host-unknown", 3, 7, 7 },
38	{   "network-prohibited", 3, 9, 9 },
39	{   "host-prohibited", 3, 10, 10 },
40	{   "TOS-network-unreachable", 3, 11, 11 },
41	{   "TOS-host-unreachable", 3, 12, 12 },
42	{   "communication-prohibited", 3, 13, 13 },
43	{   "host-precedence-violation", 3, 14, 14 },
44	{   "precedence-cutoff", 3, 15, 15 },
45
46	{ "source-quench", 4, 0, 0xFF },
47
48	{ "redirect", 5, 0, 0xFF },
49	{   "network-redirect", 5, 0, 0 },
50	{   "host-redirect", 5, 1, 1 },
51	{   "TOS-network-redirect", 5, 2, 2 },
52	{   "TOS-host-redirect", 5, 3, 3 },
53
54	{ "echo-request", 8, 0, 0xFF },
55	/* Alias */ { "ping", 8, 0, 0xFF },
56
57	{ "router-advertisement", 9, 0, 0xFF },
58
59	{ "router-solicitation", 10, 0, 0xFF },
60
61	{ "time-exceeded", 11, 0, 0xFF },
62	/* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
63	{   "ttl-zero-during-transit", 11, 0, 0 },
64	{   "ttl-zero-during-reassembly", 11, 1, 1 },
65
66	{ "parameter-problem", 12, 0, 0xFF },
67	{   "ip-header-bad", 12, 0, 0 },
68	{   "required-option-missing", 12, 1, 1 },
69
70	{ "timestamp-request", 13, 0, 0xFF },
71
72	{ "timestamp-reply", 14, 0, 0xFF },
73
74	{ "address-mask-request", 17, 0, 0xFF },
75
76	{ "address-mask-reply", 18, 0, 0xFF }
77};
78
79static void
80print_icmptypes()
81{
82	unsigned int i;
83	printf("Valid ICMP Types:");
84
85	for (i = 0; i < sizeof(icmp_codes)/sizeof(struct icmp_names); i++) {
86		if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
87			if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
88			    && (icmp_codes[i].code_max
89				== icmp_codes[i-1].code_max))
90				printf(" (%s)", icmp_codes[i].name);
91			else
92				printf("\n   %s", icmp_codes[i].name);
93		}
94		else
95			printf("\n%s", icmp_codes[i].name);
96	}
97	printf("\n");
98}
99
100/* Function which prints out usage message. */
101static void
102help(void)
103{
104	printf(
105"ICMP v%s options:\n"
106" --icmp-type [!] typename	match icmp type\n"
107"				(or numeric type or type/code)\n"
108"\n", IPTABLES_VERSION);
109	print_icmptypes();
110}
111
112static struct option opts[] = {
113	{ "icmp-type", 1, 0, '1' },
114	{0}
115};
116
117static unsigned int
118parse_icmp(const char *icmptype, u_int8_t *type, u_int8_t code[])
119{
120	unsigned int limit = sizeof(icmp_codes)/sizeof(struct icmp_names);
121	unsigned int match = limit;
122	unsigned int i;
123
124	for (i = 0; i < limit; i++) {
125		if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))
126		    == 0) {
127			if (match != limit)
128				exit_error(PARAMETER_PROBLEM,
129					   "Ambiguous ICMP type `%s':"
130					   " `%s' or `%s'?",
131					   icmptype,
132					   icmp_codes[match].name,
133					   icmp_codes[i].name);
134			match = i;
135		}
136	}
137
138	if (match != limit) {
139		*type = icmp_codes[match].type;
140		code[0] = icmp_codes[match].code_min;
141		code[1] = icmp_codes[match].code_max;
142	} else {
143		char *slash;
144		char buffer[strlen(icmptype) + 1];
145		unsigned int number;
146
147		strcpy(buffer, icmptype);
148		slash = strchr(buffer, '/');
149
150		if (slash)
151			*slash = '\0';
152
153		if (string_to_number(buffer, 0, 255, &number) == -1)
154			exit_error(PARAMETER_PROBLEM,
155				   "Invalid ICMP type `%s'\n", buffer);
156		*type = number;
157		if (slash) {
158			if (string_to_number(slash+1, 0, 255, &number) == -1)
159				exit_error(PARAMETER_PROBLEM,
160					   "Invalid ICMP code `%s'\n",
161					   slash+1);
162			code[0] = code[1] = number;
163		} else {
164			code[0] = 0;
165			code[1] = 0xFF;
166		}
167	}
168
169	if (code[0] == 0 && code[1] == 0xFF)
170		return NFC_IP_SRC_PT;
171	else return NFC_IP_SRC_PT | NFC_IP_DST_PT;
172}
173
174/* Initialize the match. */
175static void
176init(struct ipt_entry_match *m, unsigned int *nfcache)
177{
178	struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data;
179
180	icmpinfo->type = 0xFF;
181	icmpinfo->code[1] = 0xFF;
182}
183
184/* Function which parses command options; returns true if it
185   ate an option */
186static int
187parse(int c, char **argv, int invert, unsigned int *flags,
188      const struct ipt_entry *entry,
189      unsigned int *nfcache,
190      struct ipt_entry_match **match)
191{
192	struct ipt_icmp *icmpinfo = (struct ipt_icmp *)(*match)->data;
193
194	switch (c) {
195	case '1':
196		check_inverse(optarg, &invert, &optind, 0);
197		*nfcache |= parse_icmp(argv[optind-1],
198				       &icmpinfo->type,
199				       icmpinfo->code);
200		if (invert)
201			icmpinfo->invflags |= IPT_ICMP_INV;
202		break;
203
204	default:
205		return 0;
206	}
207
208	return 1;
209}
210
211static void print_icmptype(u_int8_t type,
212			   u_int8_t code_min, u_int8_t code_max,
213			   int invert,
214			   int numeric)
215{
216	if (!numeric) {
217		unsigned int i;
218
219		for (i = 0;
220		     i < sizeof(icmp_codes)/sizeof(struct icmp_names);
221		     i++) {
222			if (icmp_codes[i].type == type
223			    && icmp_codes[i].code_min == code_min
224			    && icmp_codes[i].code_max == code_max)
225				break;
226		}
227
228		if (i != sizeof(icmp_codes)/sizeof(struct icmp_names)) {
229			printf("%s%s ",
230			       invert ? "!" : "",
231			       icmp_codes[i].name);
232			return;
233		}
234	}
235
236	if (invert)
237		printf("!");
238
239	printf("type %u", type);
240	if (code_min == 0 && code_max == 0xFF)
241		printf(" ");
242	else if (code_min == code_max)
243		printf(" code %u ", code_min);
244	else
245		printf(" codes %u-%u ", code_min, code_max);
246}
247
248/* Prints out the union ipt_matchinfo. */
249static void
250print(const struct ipt_ip *ip,
251      const struct ipt_entry_match *match,
252      int numeric)
253{
254	const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
255
256	printf("icmp ");
257	print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
258		       icmp->invflags & IPT_ICMP_INV,
259		       numeric);
260
261	if (icmp->invflags & ~IPT_ICMP_INV)
262		printf("Unknown invflags: 0x%X ",
263		       icmp->invflags & ~IPT_ICMP_INV);
264}
265
266/* Saves the match in parsable form to stdout. */
267static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
268{
269	const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
270
271	if (icmp->invflags & IPT_ICMP_INV)
272		printf("! ");
273
274	/* special hack for 'any' case */
275	if (icmp->type == 0xFF) {
276		print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
277				icmp->invflags & IPT_ICMP_INV, 0);
278	} else {
279		printf("--icmp-type %u", icmp->type);
280		if (icmp->code[0] != 0 || icmp->code[1] != 0xFF)
281			printf("/%u", icmp->code[0]);
282		printf(" ");
283	}
284}
285
286/* Final check; we don't care. */
287static void final_check(unsigned int flags)
288{
289}
290
291static
292struct iptables_match icmp
293= { NULL,
294    "icmp",
295    IPTABLES_VERSION,
296    IPT_ALIGN(sizeof(struct ipt_icmp)),
297    IPT_ALIGN(sizeof(struct ipt_icmp)),
298    &help,
299    &init,
300    &parse,
301    &final_check,
302    &print,
303    &save,
304    opts
305};
306
307void _init(void)
308{
309	register_match(&icmp);
310}
311