extensions/libipt_icmp.c.print_type

   1 /* Shared library add-on to iptables to add ICMP support. */
   2 #include <stdio.h>
   3 #include <netdb.h>
   4 #include <string.h>
   5 #include <stdlib.h>
   6 #include <getopt.h>
   7 #include <iptables.h>
   8 #include <linux/netfilter_ipv4/ip_tables.h>
   9
  10 /* special hack for icmp-type 'any':
  11  * Up to kernel <=2.4.20 the problem was:
  12  * '-p icmp ' matches all icmp packets
  13  * '-p icmp -m icmp' matches _only_ ICMP type 0 :(
  14  * This is now fixed by initializing the field * to icmp type 0xFF
  15  * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
  16  */
  17
  18 struct icmp_names {
  19         const char *name;
  20         u_int8_t type;
  21         u_int8_t code_min, code_max;
  22 };
  23
  24 static const struct icmp_names icmp_codes[] = {
  25         { "any", 0xFF, 0, 0xFF },
  26         { "echo-reply", 0, 0, 0xFF },
  27         /* Alias */ { "pong", 0, 0, 0xFF },
  28
  29         { "destination-unreachable", 3, 0, 0xFF },
  30         {   "network-unreachable", 3, 0, 0 },
  31         {   "host-unreachable", 3, 1, 1 },
  32         {   "protocol-unreachable", 3, 2, 2 },
  33         {   "port-unreachable", 3, 3, 3 },
  34         {   "fragmentation-needed", 3, 4, 4 },
  35         {   "source-route-failed", 3, 5, 5 },
  36         {   "network-unknown", 3, 6, 6 },
  37         {   "host-unknown", 3, 7, 7 },
  38         {   "network-prohibited", 3, 9, 9 },
  39         {   "host-prohibited", 3, 10, 10 },
  40         {   "TOS-network-unreachable", 3, 11, 11 },
  41         {   "TOS-host-unreachable", 3, 12, 12 },
  42         {   "communication-prohibited", 3, 13, 13 },
  43         {   "host-precedence-violation", 3, 14, 14 },
  44         {   "precedence-cutoff", 3, 15, 15 },
  45
  46         { "source-quench", 4, 0, 0xFF },
  47
  48         { "redirect", 5, 0, 0xFF },
  49         {   "network-redirect", 5, 0, 0 },
  50         {   "host-redirect", 5, 1, 1 },
  51         {   "TOS-network-redirect", 5, 2, 2 },
  52         {   "TOS-host-redirect", 5, 3, 3 },
  53
  54         { "echo-request", 8, 0, 0xFF },
  55         /* Alias */ { "ping", 8, 0, 0xFF },
  56
  57         { "router-advertisement", 9, 0, 0xFF },
  58
  59         { "router-solicitation", 10, 0, 0xFF },
  60
  61         { "time-exceeded", 11, 0, 0xFF },
  62         /* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
  63         {   "ttl-zero-during-transit", 11, 0, 0 },
  64         {   "ttl-zero-during-reassembly", 11, 1, 1 },
  65
  66         { "parameter-problem", 12, 0, 0xFF },
  67         {   "ip-header-bad", 12, 0, 0 },
  68         {   "required-option-missing", 12, 1, 1 },
  69
  70         { "timestamp-request", 13, 0, 0xFF },
  71
  72         { "timestamp-reply", 14, 0, 0xFF },
  73
  74         { "address-mask-request", 17, 0, 0xFF },
  75
  76         { "address-mask-reply", 18, 0, 0xFF }
  77 };
  78
  79 static void
  80 print_icmptypes()
  81 {
  82         unsigned int i;
  83         printf("Valid ICMP Types:");
  84
  85         for (i = 0; i < sizeof(icmp_codes)/sizeof(struct icmp_names); i++) {
  86                 if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
  87                         if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
  88                             && (icmp_codes[i].code_max
  89                                 == icmp_codes[i-1].code_max))
  90                                 printf(" (%s)", icmp_codes[i].name);
  91                         else
  92                                 printf("\n   %s", icmp_codes[i].name);
  93                 }
  94                 else
  95                         printf("\n%s", icmp_codes[i].name);
  96         }
  97         printf("\n");
  98 }
  99
 100 /* Function which prints out usage message. */
 101 static void
 102 help(void)
 103 {
 104         printf(
 105 "ICMP v%s options:\n"
 106 " --icmp-type [!] typename      match icmp type\n"
 107 "                               (or numeric type or type/code)\n"
 108 "\n", IPTABLES_VERSION);
 109         print_icmptypes();
 110 }
 111
 112 static struct option opts[] = {
 113         { "icmp-type", 1, 0, '1' },
 114         {0}
 115 };
 116
 117 static unsigned int
 118 parse_icmp(const char *icmptype, u_int8_t *type, u_int8_t code[])
 119 {
 120         unsigned int limit = sizeof(icmp_codes)/sizeof(struct icmp_names);
 121         unsigned int match = limit;
 122         unsigned int i;
 123
 124         for (i = 0; i < limit; i++) {
 125                 if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))
 126                     == 0) {
 127                         if (match != limit)
 128                                 exit_error(PARAMETER_PROBLEM,
 129                                            "Ambiguous ICMP type `%s':"
 130                                            " `%s' or `%s'?",
 131                                            icmptype,
 132                                            icmp_codes[match].name,
 133                                            icmp_codes[i].name);
 134                         match = i;
 135                 }
 136         }
 137
 138         if (match != limit) {
 139                 *type = icmp_codes[match].type;
 140                 code[0] = icmp_codes[match].code_min;
 141                 code[1] = icmp_codes[match].code_max;
 142         } else {
 143                 char *slash;
 144                 char buffer[strlen(icmptype) + 1];
 145                 unsigned int number;
 146
 147                 strcpy(buffer, icmptype);
 148                 slash = strchr(buffer, '/');
 149
 150                 if (slash)
 151                         *slash = '\0';
 152
 153                 if (string_to_number(buffer, 0, 255, &number) == -1)
 154                         exit_error(PARAMETER_PROBLEM,
 155                                    "Invalid ICMP type `%s'\n", buffer);
 156                 *type = number;
 157                 if (slash) {
 158                         if (string_to_number(slash+1, 0, 255, &number) == -1)
 159                                 exit_error(PARAMETER_PROBLEM,
 160                                            "Invalid ICMP code `%s'\n",
 161                                            slash+1);
 162                         code[0] = code[1] = number;
 163                 } else {
 164                         code[0] = 0;
 165                         code[1] = 0xFF;
 166                 }
 167         }
 168
 169         if (code[0] == 0 && code[1] == 0xFF)
 170                 return NFC_IP_SRC_PT;
 171         else return NFC_IP_SRC_PT | NFC_IP_DST_PT;
 172 }
 173
 174 /* Initialize the match. */
 175 static void
 176 init(struct ipt_entry_match *m, unsigned int *nfcache)
 177 {
 178         struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data;
 179
 180         icmpinfo->type = 0xFF;
 181         icmpinfo->code[1] = 0xFF;
 182 }
 183
 184 /* Function which parses command options; returns true if it
 185    ate an option */
 186 static int
 187 parse(int c, char **argv, int invert, unsigned int *flags,
 188       const struct ipt_entry *entry,
 189       unsigned int *nfcache,
 190       struct ipt_entry_match **match)
 191 {
 192         struct ipt_icmp *icmpinfo = (struct ipt_icmp *)(*match)->data;
 193
 194         switch (c) {
 195         case '1':
 196                 check_inverse(optarg, &invert, &optind, 0);
 197                 *nfcache |= parse_icmp(argv[optind-1],
 198                                        &icmpinfo->type,
 199                                        icmpinfo->code);
 200                 if (invert)
 201                         icmpinfo->invflags |= IPT_ICMP_INV;
 202                 break;
 203
 204         default:
 205                 return 0;
 206         }
 207
 208         return 1;
 209 }
 210
 211 static void print_icmptype(u_int8_t type,
 212                            u_int8_t code_min, u_int8_t code_max,
 213                            int invert,
 214                            int numeric)
 215 {
 216         if (!numeric) {
 217                 unsigned int i;
 218
 219                 for (i = 0;
 220                      i < sizeof(icmp_codes)/sizeof(struct icmp_names);
 221                      i++) {
 222                         if (icmp_codes[i].type == type
 223                             && icmp_codes[i].code_min == code_min
 224                             && icmp_codes[i].code_max == code_max)
 225                                 break;
 226                 }
 227
 228                 if (i != sizeof(icmp_codes)/sizeof(struct icmp_names)) {
 229                         printf("%s%s ",
 230                                invert ? "!" : "",
 231                                icmp_codes[i].name);
 232                         return;
 233                 }
 234         }
 235
 236         if (invert)
 237                 printf("!");
 238
 239         printf("type %u", type);
 240         if (code_min == 0 && code_max == 0xFF)
 241                 printf(" ");
 242         else if (code_min == code_max)
 243                 printf(" code %u ", code_min);
 244         else
 245                 printf(" codes %u-%u ", code_min, code_max);
 246 }
 247
 248 /* Prints out the union ipt_matchinfo. */
 249 static void
 250 print(const struct ipt_ip *ip,
 251       const struct ipt_entry_match *match,
 252       int numeric)
 253 {
 254         const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 255
 256         printf("icmp ");
 257         print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
 258                        icmp->invflags & IPT_ICMP_INV,
 259                        numeric);
 260
 261         if (icmp->invflags & ~IPT_ICMP_INV)
 262                 printf("Unknown invflags: 0x%X ",
 263                        icmp->invflags & ~IPT_ICMP_INV);
 264 }
 265
 266 /* Saves the match in parsable form to stdout. */
 267 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 268 {
 269         const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 270
 271         if (icmp->invflags & IPT_ICMP_INV)
 272                 printf("! ");
 273
 274         /* special hack for 'any' case */
 275         if (icmp->type == 0xFF) {
 276                 print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
 277                                 icmp->invflags & IPT_ICMP_INV, 0);
 278         } else {
 279                 printf("--icmp-type %u", icmp->type);
 280                 if (icmp->code[0] != 0 || icmp->code[1] != 0xFF)
 281                         printf("/%u", icmp->code[0]);
 282                 printf(" ");
 283         }
 284 }
 285
 286 /* Final check; we don't care. */
 287 static void final_check(unsigned int flags)
 288 {
 289 }
 290
 291 static
 292 struct iptables_match icmp
 293 = { NULL,
 294     "icmp",
 295     IPTABLES_VERSION,
 296     IPT_ALIGN(sizeof(struct ipt_icmp)),
 297     IPT_ALIGN(sizeof(struct ipt_icmp)),
 298     &help,
 299     &init,
 300     &parse,
 301     &final_check,
 302     &print,
 303     &save,
 304     opts
 305 };
 306
 307 void _init(void)
 308 {
 309         register_match(&icmp);
 310 }