decorations for module tools, + set svn-keywords on older branches
[iptables.git] / extensions / libip6t_icmp6.c
1 /* Shared library add-on to iptables to add ICMP support. */
2 #include <stdio.h>
3 #include <netdb.h>
4 #include <string.h>
5 #include <stdlib.h>
6 #include <getopt.h>
7 #include <ip6tables.h>
8 #include <linux/netfilter_ipv6/ip6_tables.h>
9
10 struct icmpv6_names {
11         const char *name;
12         u_int8_t type;
13         u_int8_t code_min, code_max;
14 };
15
16 static const struct icmpv6_names icmpv6_codes[] = {
17         { "destination-unreachable", 1, 0, 0xFF },
18         {   "no-route", 1, 0, 0 },
19         {   "communication-prohibited", 1, 1, 1 },
20         {   "address-unreachable", 1, 3, 3 },
21         {   "port-unreachable", 1, 4, 4 },
22
23         { "packet-too-big", 2, 0, 0xFF },
24
25         { "time-exceeded", 3, 0, 0xFF },
26         /* Alias */ { "ttl-exceeded", 3, 0, 0xFF },
27         {   "ttl-zero-during-transit", 3, 0, 0 },
28         {   "ttl-zero-during-reassembly", 3, 1, 1 },
29
30         { "parameter-problem", 4, 0, 0xFF },
31         {   "bad-header", 4, 0, 0 },
32         {   "unknown-header-type", 4, 1, 1 },
33         {   "unknown-option", 4, 2, 2 },
34
35         { "echo-request", 128, 0, 0xFF },
36         /* Alias */ { "ping", 128, 0, 0xFF },
37
38         { "echo-reply", 129, 0, 0xFF },
39         /* Alias */ { "pong", 129, 0, 0xFF },
40
41         { "router-solicitation", 133, 0, 0xFF },
42
43         { "router-advertisement", 134, 0, 0xFF },
44
45         { "neighbour-solicitation", 135, 0, 0xFF },
46         /* Alias */ { "neighbor-solicitation", 135, 0, 0xFF },
47
48         { "neighbour-advertisement", 136, 0, 0xFF },
49         /* Alias */ { "neighbor-advertisement", 136, 0, 0xFF },
50
51         { "redirect", 137, 0, 0xFF },
52
53 };
54
55 static void
56 print_icmpv6types(void)
57 {
58         unsigned int i;
59         printf("Valid ICMPv6 Types:");
60
61         for (i = 0; i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names); i++) {
62                 if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) {
63                         if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min
64                             && (icmpv6_codes[i].code_max
65                                 == icmpv6_codes[i-1].code_max))
66                                 printf(" (%s)", icmpv6_codes[i].name);
67                         else
68                                 printf("\n   %s", icmpv6_codes[i].name);
69                 }
70                 else
71                         printf("\n%s", icmpv6_codes[i].name);
72         }
73         printf("\n");
74 }
75
76 /* Function which prints out usage message. */
77 static void icmp6_help(void)
78 {
79         printf(
80 "icmpv6 match options:\n"
81 " --icmpv6-type [!] typename    match icmpv6 type\n"
82 "                               (or numeric type or type/code)\n");
83         print_icmpv6types();
84 }
85
86 static const struct option icmp6_opts[] = {
87         { "icmpv6-type", 1, NULL, '1' },
88         { .name = NULL }
89 };
90
91 static void
92 parse_icmpv6(const char *icmpv6type, u_int8_t *type, u_int8_t code[])
93 {
94         unsigned int limit = sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
95         unsigned int match = limit;
96         unsigned int i;
97
98         for (i = 0; i < limit; i++) {
99                 if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))
100                     == 0) {
101                         if (match != limit)
102                                 exit_error(PARAMETER_PROBLEM,
103                                            "Ambiguous ICMPv6 type `%s':"
104                                            " `%s' or `%s'?",
105                                            icmpv6type,
106                                            icmpv6_codes[match].name,
107                                            icmpv6_codes[i].name);
108                         match = i;
109                 }
110         }
111
112         if (match != limit) {
113                 *type = icmpv6_codes[match].type;
114                 code[0] = icmpv6_codes[match].code_min;
115                 code[1] = icmpv6_codes[match].code_max;
116         } else {
117                 char *slash;
118                 char buffer[strlen(icmpv6type) + 1];
119                 unsigned int number;
120
121                 strcpy(buffer, icmpv6type);
122                 slash = strchr(buffer, '/');
123
124                 if (slash)
125                         *slash = '\0';
126
127                 if (string_to_number(buffer, 0, 255, &number) == -1)
128                         exit_error(PARAMETER_PROBLEM,
129                                    "Invalid ICMPv6 type `%s'\n", buffer);
130                 *type = number;
131                 if (slash) {
132                         if (string_to_number(slash+1, 0, 255, &number) == -1)
133                                 exit_error(PARAMETER_PROBLEM,
134                                            "Invalid ICMPv6 code `%s'\n",
135                                            slash+1);
136                         code[0] = code[1] = number;
137                 } else {
138                         code[0] = 0;
139                         code[1] = 0xFF;
140                 }
141         }
142 }
143
144 /* Initialize the match. */
145 static void icmp6_init(struct xt_entry_match *m)
146 {
147         struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data;
148
149         icmpv6info->code[1] = 0xFF;
150 }
151
152 /* Function which parses command options; returns true if it
153    ate an option */
154 static int icmp6_parse(int c, char **argv, int invert, unsigned int *flags,
155                        const void *entry, struct xt_entry_match **match)
156 {
157         struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)(*match)->data;
158
159         switch (c) {
160         case '1':
161                 if (*flags == 1)
162                         exit_error(PARAMETER_PROBLEM,
163                                    "icmpv6 match: only use --icmpv6-type once!");
164                 check_inverse(optarg, &invert, &optind, 0);
165                 parse_icmpv6(argv[optind-1], &icmpv6info->type, 
166                              icmpv6info->code);
167                 if (invert)
168                         icmpv6info->invflags |= IP6T_ICMP_INV;
169                 *flags = 1;
170                 break;
171
172         default:
173                 return 0;
174         }
175
176         return 1;
177 }
178
179 static void print_icmpv6type(u_int8_t type,
180                            u_int8_t code_min, u_int8_t code_max,
181                            int invert,
182                            int numeric)
183 {
184         if (!numeric) {
185                 unsigned int i;
186
187                 for (i = 0;
188                      i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
189                      i++) {
190                         if (icmpv6_codes[i].type == type
191                             && icmpv6_codes[i].code_min == code_min
192                             && icmpv6_codes[i].code_max == code_max)
193                                 break;
194                 }
195
196                 if (i != sizeof(icmpv6_codes)/sizeof(struct icmpv6_names)) {
197                         printf("%s%s ",
198                                invert ? "!" : "",
199                                icmpv6_codes[i].name);
200                         return;
201                 }
202         }
203
204         if (invert)
205                 printf("!");
206
207         printf("type %u", type);
208         if (code_min == 0 && code_max == 0xFF)
209                 printf(" ");
210         else if (code_min == code_max)
211                 printf(" code %u ", code_min);
212         else
213                 printf(" codes %u-%u ", code_min, code_max);
214 }
215
216 /* Prints out the union ipt_matchinfo. */
217 static void icmp6_print(const void *ip, const struct xt_entry_match *match,
218                         int numeric)
219 {
220         const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
221
222         printf("ipv6-icmp ");
223         print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1],
224                        icmpv6->invflags & IP6T_ICMP_INV,
225                        numeric);
226
227         if (icmpv6->invflags & ~IP6T_ICMP_INV)
228                 printf("Unknown invflags: 0x%X ",
229                        icmpv6->invflags & ~IP6T_ICMP_INV);
230 }
231
232 /* Saves the match in parsable form to stdout. */
233 static void icmp6_save(const void *ip, const struct xt_entry_match *match)
234 {
235         const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
236
237         if (icmpv6->invflags & IP6T_ICMP_INV)
238                 printf("! ");
239
240         printf("--icmpv6-type %u", icmpv6->type);
241         if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF)
242                 printf("/%u", icmpv6->code[0]);
243         printf(" ");
244 }
245
246 static void icmp6_check(unsigned int flags)
247 {
248         if (!flags)
249                 exit_error(PARAMETER_PROBLEM,
250                            "icmpv6 match: You must specify `--icmpv6-type'");
251 }
252
253 static struct xtables_match icmp6_mt6_reg = {
254         .name           = "icmp6",
255         .version        = XTABLES_VERSION,
256         .family         = PF_INET6,
257         .size           = XT_ALIGN(sizeof(struct ip6t_icmp)),
258         .userspacesize  = XT_ALIGN(sizeof(struct ip6t_icmp)),
259         .help           = icmp6_help,
260         .init           = icmp6_init,
261         .parse          = icmp6_parse,
262         .final_check    = icmp6_check,
263         .print          = icmp6_print,
264         .save           = icmp6_save,
265         .extra_opts     = icmp6_opts,
266 };
267
268 void _init(void)
269 {
270         xtables_register_match(&icmp6_mt6_reg);
271 }