extensions/libip6t_icmp6.c

   1 /* Shared library add-on to iptables to add ICMP support. */
   2 #include <stdio.h>
   3 #include <netdb.h>
   4 #include <string.h>
   5 #include <stdlib.h>
   6 #include <getopt.h>
   7 #include <ip6tables.h>
   8 #include <linux/netfilter_ipv6/ip6_tables.h>
   9
  10 struct icmpv6_names {
  11         const char *name;
  12         u_int8_t type;
  13         u_int8_t code_min, code_max;
  14 };
  15
  16 static const struct icmpv6_names icmpv6_codes[] = {
  17         { "destination-unreachable", 1, 0, 0xFF },
  18         {   "no-route", 1, 0, 0 },
  19         {   "communication-prohibited", 1, 1, 1 },
  20         {   "address-unreachable", 1, 3, 3 },
  21         {   "port-unreachable", 1, 4, 4 },
  22
  23         { "packet-too-big", 2, 0, 0xFF },
  24
  25         { "time-exceeded", 3, 0, 0xFF },
  26         /* Alias */ { "ttl-exceeded", 3, 0, 0xFF },
  27         {   "ttl-zero-during-transit", 3, 0, 0 },
  28         {   "ttl-zero-during-reassembly", 3, 1, 1 },
  29
  30         { "parameter-problem", 4, 0, 0xFF },
  31         {   "bad-header", 4, 0, 0 },
  32         {   "unknown-header-type", 4, 1, 1 },
  33         {   "unknown-option", 4, 2, 2 },
  34
  35         { "echo-request", 128, 0, 0xFF },
  36         /* Alias */ { "ping", 128, 0, 0xFF },
  37
  38         { "echo-reply", 129, 0, 0xFF },
  39         /* Alias */ { "pong", 129, 0, 0xFF },
  40
  41         { "router-solicitation", 133, 0, 0xFF },
  42
  43         { "router-advertisement", 134, 0, 0xFF },
  44
  45         { "neighbour-solicitation", 135, 0, 0xFF },
  46         /* Alias */ { "neighbor-solicitation", 135, 0, 0xFF },
  47
  48         { "neighbour-advertisement", 136, 0, 0xFF },
  49         /* Alias */ { "neighbor-advertisement", 136, 0, 0xFF },
  50
  51         { "redirect", 137, 0, 0xFF },
  52
  53 };
  54
  55 static void
  56 print_icmpv6types(void)
  57 {
  58         unsigned int i;
  59         printf("Valid ICMPv6 Types:");
  60
  61         for (i = 0; i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names); i++) {
  62                 if (i && icmpv6_codes[i].type == icmpv6_codes[i-1].type) {
  63                         if (icmpv6_codes[i].code_min == icmpv6_codes[i-1].code_min
  64                             && (icmpv6_codes[i].code_max
  65                                 == icmpv6_codes[i-1].code_max))
  66                                 printf(" (%s)", icmpv6_codes[i].name);
  67                         else
  68                                 printf("\n   %s", icmpv6_codes[i].name);
  69                 }
  70                 else
  71                         printf("\n%s", icmpv6_codes[i].name);
  72         }
  73         printf("\n");
  74 }
  75
  76 /* Function which prints out usage message. */
  77 static void icmp6_help(void)
  78 {
  79         printf(
  80 "icmpv6 match options:\n"
  81 " --icmpv6-type [!] typename    match icmpv6 type\n"
  82 "                               (or numeric type or type/code)\n");
  83         print_icmpv6types();
  84 }
  85
  86 static const struct option icmp6_opts[] = {
  87         { "icmpv6-type", 1, NULL, '1' },
  88         { .name = NULL }
  89 };
  90
  91 static void
  92 parse_icmpv6(const char *icmpv6type, u_int8_t *type, u_int8_t code[])
  93 {
  94         unsigned int limit = sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
  95         unsigned int match = limit;
  96         unsigned int i;
  97
  98         for (i = 0; i < limit; i++) {
  99                 if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))
 100                     == 0) {
 101                         if (match != limit)
 102                                 exit_error(PARAMETER_PROBLEM,
 103                                            "Ambiguous ICMPv6 type `%s':"
 104                                            " `%s' or `%s'?",
 105                                            icmpv6type,
 106                                            icmpv6_codes[match].name,
 107                                            icmpv6_codes[i].name);
 108                         match = i;
 109                 }
 110         }
 111
 112         if (match != limit) {
 113                 *type = icmpv6_codes[match].type;
 114                 code[0] = icmpv6_codes[match].code_min;
 115                 code[1] = icmpv6_codes[match].code_max;
 116         } else {
 117                 char *slash;
 118                 char buffer[strlen(icmpv6type) + 1];
 119                 unsigned int number;
 120
 121                 strcpy(buffer, icmpv6type);
 122                 slash = strchr(buffer, '/');
 123
 124                 if (slash)
 125                         *slash = '\0';
 126
 127                 if (string_to_number(buffer, 0, 255, &number) == -1)
 128                         exit_error(PARAMETER_PROBLEM,
 129                                    "Invalid ICMPv6 type `%s'\n", buffer);
 130                 *type = number;
 131                 if (slash) {
 132                         if (string_to_number(slash+1, 0, 255, &number) == -1)
 133                                 exit_error(PARAMETER_PROBLEM,
 134                                            "Invalid ICMPv6 code `%s'\n",
 135                                            slash+1);
 136                         code[0] = code[1] = number;
 137                 } else {
 138                         code[0] = 0;
 139                         code[1] = 0xFF;
 140                 }
 141         }
 142 }
 143
 144 /* Initialize the match. */
 145 static void icmp6_init(struct xt_entry_match *m)
 146 {
 147         struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data;
 148
 149         icmpv6info->code[1] = 0xFF;
 150 }
 151
 152 /* Function which parses command options; returns true if it
 153    ate an option */
 154 static int icmp6_parse(int c, char **argv, int invert, unsigned int *flags,
 155                        const void *entry, struct xt_entry_match **match)
 156 {
 157         struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)(*match)->data;
 158
 159         switch (c) {
 160         case '1':
 161                 if (*flags == 1)
 162                         exit_error(PARAMETER_PROBLEM,
 163                                    "icmpv6 match: only use --icmpv6-type once!");
 164                 check_inverse(optarg, &invert, &optind, 0);
 165                 parse_icmpv6(argv[optind-1], &icmpv6info->type,
 166                              icmpv6info->code);
 167                 if (invert)
 168                         icmpv6info->invflags |= IP6T_ICMP_INV;
 169                 *flags = 1;
 170                 break;
 171
 172         default:
 173                 return 0;
 174         }
 175
 176         return 1;
 177 }
 178
 179 static void print_icmpv6type(u_int8_t type,
 180                            u_int8_t code_min, u_int8_t code_max,
 181                            int invert,
 182                            int numeric)
 183 {
 184         if (!numeric) {
 185                 unsigned int i;
 186
 187                 for (i = 0;
 188                      i < sizeof(icmpv6_codes)/sizeof(struct icmpv6_names);
 189                      i++) {
 190                         if (icmpv6_codes[i].type == type
 191                             && icmpv6_codes[i].code_min == code_min
 192                             && icmpv6_codes[i].code_max == code_max)
 193                                 break;
 194                 }
 195
 196                 if (i != sizeof(icmpv6_codes)/sizeof(struct icmpv6_names)) {
 197                         printf("%s%s ",
 198                                invert ? "!" : "",
 199                                icmpv6_codes[i].name);
 200                         return;
 201                 }
 202         }
 203
 204         if (invert)
 205                 printf("!");
 206
 207         printf("type %u", type);
 208         if (code_min == 0 && code_max == 0xFF)
 209                 printf(" ");
 210         else if (code_min == code_max)
 211                 printf(" code %u ", code_min);
 212         else
 213                 printf(" codes %u-%u ", code_min, code_max);
 214 }
 215
 216 /* Prints out the union ipt_matchinfo. */
 217 static void icmp6_print(const void *ip, const struct xt_entry_match *match,
 218                         int numeric)
 219 {
 220         const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
 221
 222         printf("ipv6-icmp ");
 223         print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1],
 224                        icmpv6->invflags & IP6T_ICMP_INV,
 225                        numeric);
 226
 227         if (icmpv6->invflags & ~IP6T_ICMP_INV)
 228                 printf("Unknown invflags: 0x%X ",
 229                        icmpv6->invflags & ~IP6T_ICMP_INV);
 230 }
 231
 232 /* Saves the match in parsable form to stdout. */
 233 static void icmp6_save(const void *ip, const struct xt_entry_match *match)
 234 {
 235         const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
 236
 237         if (icmpv6->invflags & IP6T_ICMP_INV)
 238                 printf("! ");
 239
 240         printf("--icmpv6-type %u", icmpv6->type);
 241         if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF)
 242                 printf("/%u", icmpv6->code[0]);
 243         printf(" ");
 244 }
 245
 246 static void icmp6_check(unsigned int flags)
 247 {
 248         if (!flags)
 249                 exit_error(PARAMETER_PROBLEM,
 250                            "icmpv6 match: You must specify `--icmpv6-type'");
 251 }
 252
 253 static struct xtables_match icmp6_mt6_reg = {
 254         .name           = "icmp6",
 255         .version        = XTABLES_VERSION,
 256         .family         = PF_INET6,
 257         .size           = XT_ALIGN(sizeof(struct ip6t_icmp)),
 258         .userspacesize  = XT_ALIGN(sizeof(struct ip6t_icmp)),
 259         .help           = icmp6_help,
 260         .init           = icmp6_init,
 261         .parse          = icmp6_parse,
 262         .final_check    = icmp6_check,
 263         .print          = icmp6_print,
 264         .save           = icmp6_save,
 265         .extra_opts     = icmp6_opts,
 266 };
 267
 268 void _init(void)
 269 {
 270         xtables_register_match(&icmp6_mt6_reg);
 271 }