1 /* Shared library add-on to iptables to add ICMP support. */
8 #include <linux/netfilter_ipv4/ip_tables.h>
10 /* special hack for icmp-type 'any':
11 * Up to kernel <=2.4.20 the problem was:
12 * '-p icmp ' matches all icmp packets
13 * '-p icmp -m icmp' matches _only_ ICMP type 0 :(
14 * This is now fixed by initializing the field * to icmp type 0xFF
15 * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
21 u_int8_t code_min, code_max;
24 static const struct icmp_names icmp_codes[] = {
25 { "any", 0xFF, 0, 0xFF },
26 { "echo-reply", 0, 0, 0xFF },
27 /* Alias */ { "pong", 0, 0, 0xFF },
29 { "destination-unreachable", 3, 0, 0xFF },
30 { "network-unreachable", 3, 0, 0 },
31 { "host-unreachable", 3, 1, 1 },
32 { "protocol-unreachable", 3, 2, 2 },
33 { "port-unreachable", 3, 3, 3 },
34 { "fragmentation-needed", 3, 4, 4 },
35 { "source-route-failed", 3, 5, 5 },
36 { "network-unknown", 3, 6, 6 },
37 { "host-unknown", 3, 7, 7 },
38 { "network-prohibited", 3, 9, 9 },
39 { "host-prohibited", 3, 10, 10 },
40 { "TOS-network-unreachable", 3, 11, 11 },
41 { "TOS-host-unreachable", 3, 12, 12 },
42 { "communication-prohibited", 3, 13, 13 },
43 { "host-precedence-violation", 3, 14, 14 },
44 { "precedence-cutoff", 3, 15, 15 },
46 { "source-quench", 4, 0, 0xFF },
48 { "redirect", 5, 0, 0xFF },
49 { "network-redirect", 5, 0, 0 },
50 { "host-redirect", 5, 1, 1 },
51 { "TOS-network-redirect", 5, 2, 2 },
52 { "TOS-host-redirect", 5, 3, 3 },
54 { "echo-request", 8, 0, 0xFF },
55 /* Alias */ { "ping", 8, 0, 0xFF },
57 { "router-advertisement", 9, 0, 0xFF },
59 { "router-solicitation", 10, 0, 0xFF },
61 { "time-exceeded", 11, 0, 0xFF },
62 /* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
63 { "ttl-zero-during-transit", 11, 0, 0 },
64 { "ttl-zero-during-reassembly", 11, 1, 1 },
66 { "parameter-problem", 12, 0, 0xFF },
67 { "ip-header-bad", 12, 0, 0 },
68 { "required-option-missing", 12, 1, 1 },
70 { "timestamp-request", 13, 0, 0xFF },
72 { "timestamp-reply", 14, 0, 0xFF },
74 { "address-mask-request", 17, 0, 0xFF },
76 { "address-mask-reply", 18, 0, 0xFF }
83 printf("Valid ICMP Types:");
85 for (i = 0; i < sizeof(icmp_codes)/sizeof(struct icmp_names); i++) {
86 if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
87 if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
88 && (icmp_codes[i].code_max
89 == icmp_codes[i-1].code_max))
90 printf(" (%s)", icmp_codes[i].name);
92 printf("\n %s", icmp_codes[i].name);
95 printf("\n%s", icmp_codes[i].name);
100 /* Function which prints out usage message. */
101 static void icmp_help(void)
104 "icmp match options:\n"
105 " --icmp-type [!] typename match icmp type\n"
106 " (or numeric type or type/code)\n");
110 static const struct option icmp_opts[] = {
111 { "icmp-type", 1, NULL, '1' },
116 parse_icmp(const char *icmptype, u_int8_t *type, u_int8_t code[])
118 unsigned int limit = sizeof(icmp_codes)/sizeof(struct icmp_names);
119 unsigned int match = limit;
122 for (i = 0; i < limit; i++) {
123 if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))
126 exit_error(PARAMETER_PROBLEM,
127 "Ambiguous ICMP type `%s':"
130 icmp_codes[match].name,
136 if (match != limit) {
137 *type = icmp_codes[match].type;
138 code[0] = icmp_codes[match].code_min;
139 code[1] = icmp_codes[match].code_max;
142 char buffer[strlen(icmptype) + 1];
145 strcpy(buffer, icmptype);
146 slash = strchr(buffer, '/');
151 if (string_to_number(buffer, 0, 255, &number) == -1)
152 exit_error(PARAMETER_PROBLEM,
153 "Invalid ICMP type `%s'\n", buffer);
156 if (string_to_number(slash+1, 0, 255, &number) == -1)
157 exit_error(PARAMETER_PROBLEM,
158 "Invalid ICMP code `%s'\n",
160 code[0] = code[1] = number;
168 /* Initialize the match. */
169 static void icmp_init(struct xt_entry_match *m)
171 struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data;
173 icmpinfo->type = 0xFF;
174 icmpinfo->code[1] = 0xFF;
177 /* Function which parses command options; returns true if it
179 static int icmp_parse(int c, char **argv, int invert, unsigned int *flags,
180 const void *entry, struct xt_entry_match **match)
182 struct ipt_icmp *icmpinfo = (struct ipt_icmp *)(*match)->data;
187 exit_error(PARAMETER_PROBLEM,
188 "icmp match: only use --icmp-type once!");
189 check_inverse(optarg, &invert, &optind, 0);
190 parse_icmp(argv[optind-1], &icmpinfo->type,
193 icmpinfo->invflags |= IPT_ICMP_INV;
204 static void print_icmptype(u_int8_t type,
205 u_int8_t code_min, u_int8_t code_max,
213 i < sizeof(icmp_codes)/sizeof(struct icmp_names);
215 if (icmp_codes[i].type == type
216 && icmp_codes[i].code_min == code_min
217 && icmp_codes[i].code_max == code_max)
221 if (i != sizeof(icmp_codes)/sizeof(struct icmp_names)) {
232 printf("type %u", type);
233 if (code_min == 0 && code_max == 0xFF)
235 else if (code_min == code_max)
236 printf(" code %u ", code_min);
238 printf(" codes %u-%u ", code_min, code_max);
241 /* Prints out the union ipt_matchinfo. */
242 static void icmp_print(const void *ip, const struct xt_entry_match *match,
245 const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
248 print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
249 icmp->invflags & IPT_ICMP_INV,
252 if (icmp->invflags & ~IPT_ICMP_INV)
253 printf("Unknown invflags: 0x%X ",
254 icmp->invflags & ~IPT_ICMP_INV);
257 /* Saves the match in parsable form to stdout. */
258 static void icmp_save(const void *ip, const struct xt_entry_match *match)
260 const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
262 if (icmp->invflags & IPT_ICMP_INV)
265 /* special hack for 'any' case */
266 if (icmp->type == 0xFF) {
267 printf("--icmp-type any ");
269 printf("--icmp-type %u", icmp->type);
270 if (icmp->code[0] != 0 || icmp->code[1] != 0xFF)
271 printf("/%u", icmp->code[0]);
276 static struct xtables_match icmp_mt_reg = {
278 .version = XTABLES_VERSION,
280 .size = XT_ALIGN(sizeof(struct ipt_icmp)),
281 .userspacesize = XT_ALIGN(sizeof(struct ipt_icmp)),
287 .extra_opts = icmp_opts,
292 xtables_register_match(&icmp_mt_reg);