extensions/libipt_icmp.c

   1 /* Shared library add-on to iptables to add ICMP support. */
   2 #include <stdio.h>
   3 #include <netdb.h>
   4 #include <string.h>
   5 #include <stdlib.h>
   6 #include <getopt.h>
   7 #include <iptables.h>
   8 #include <linux/netfilter_ipv4/ip_tables.h>
   9
  10 /* special hack for icmp-type 'any':
  11  * Up to kernel <=2.4.20 the problem was:
  12  * '-p icmp ' matches all icmp packets
  13  * '-p icmp -m icmp' matches _only_ ICMP type 0 :(
  14  * This is now fixed by initializing the field * to icmp type 0xFF
  15  * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
  16  */
  17
  18 struct icmp_names {
  19         const char *name;
  20         u_int8_t type;
  21         u_int8_t code_min, code_max;
  22 };
  23
  24 static const struct icmp_names icmp_codes[] = {
  25         { "any", 0xFF, 0, 0xFF },
  26         { "echo-reply", 0, 0, 0xFF },
  27         /* Alias */ { "pong", 0, 0, 0xFF },
  28
  29         { "destination-unreachable", 3, 0, 0xFF },
  30         {   "network-unreachable", 3, 0, 0 },
  31         {   "host-unreachable", 3, 1, 1 },
  32         {   "protocol-unreachable", 3, 2, 2 },
  33         {   "port-unreachable", 3, 3, 3 },
  34         {   "fragmentation-needed", 3, 4, 4 },
  35         {   "source-route-failed", 3, 5, 5 },
  36         {   "network-unknown", 3, 6, 6 },
  37         {   "host-unknown", 3, 7, 7 },
  38         {   "network-prohibited", 3, 9, 9 },
  39         {   "host-prohibited", 3, 10, 10 },
  40         {   "TOS-network-unreachable", 3, 11, 11 },
  41         {   "TOS-host-unreachable", 3, 12, 12 },
  42         {   "communication-prohibited", 3, 13, 13 },
  43         {   "host-precedence-violation", 3, 14, 14 },
  44         {   "precedence-cutoff", 3, 15, 15 },
  45
  46         { "source-quench", 4, 0, 0xFF },
  47
  48         { "redirect", 5, 0, 0xFF },
  49         {   "network-redirect", 5, 0, 0 },
  50         {   "host-redirect", 5, 1, 1 },
  51         {   "TOS-network-redirect", 5, 2, 2 },
  52         {   "TOS-host-redirect", 5, 3, 3 },
  53
  54         { "echo-request", 8, 0, 0xFF },
  55         /* Alias */ { "ping", 8, 0, 0xFF },
  56
  57         { "router-advertisement", 9, 0, 0xFF },
  58
  59         { "router-solicitation", 10, 0, 0xFF },
  60
  61         { "time-exceeded", 11, 0, 0xFF },
  62         /* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
  63         {   "ttl-zero-during-transit", 11, 0, 0 },
  64         {   "ttl-zero-during-reassembly", 11, 1, 1 },
  65
  66         { "parameter-problem", 12, 0, 0xFF },
  67         {   "ip-header-bad", 12, 0, 0 },
  68         {   "required-option-missing", 12, 1, 1 },
  69
  70         { "timestamp-request", 13, 0, 0xFF },
  71
  72         { "timestamp-reply", 14, 0, 0xFF },
  73
  74         { "address-mask-request", 17, 0, 0xFF },
  75
  76         { "address-mask-reply", 18, 0, 0xFF }
  77 };
  78
  79 static void
  80 print_icmptypes()
  81 {
  82         unsigned int i;
  83         printf("Valid ICMP Types:");
  84
  85         for (i = 0; i < sizeof(icmp_codes)/sizeof(struct icmp_names); i++) {
  86                 if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
  87                         if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
  88                             && (icmp_codes[i].code_max
  89                                 == icmp_codes[i-1].code_max))
  90                                 printf(" (%s)", icmp_codes[i].name);
  91                         else
  92                                 printf("\n   %s", icmp_codes[i].name);
  93                 }
  94                 else
  95                         printf("\n%s", icmp_codes[i].name);
  96         }
  97         printf("\n");
  98 }
  99
 100 /* Function which prints out usage message. */
 101 static void
 102 help(void)
 103 {
 104         printf(
 105 "ICMP v%s options:\n"
 106 " --icmp-type [!] typename      match icmp type\n"
 107 "                               (or numeric type or type/code)\n"
 108 "\n", IPTABLES_VERSION);
 109         print_icmptypes();
 110 }
 111
 112 static struct option opts[] = {
 113         { "icmp-type", 1, 0, '1' },
 114         {0}
 115 };
 116
 117 static void
 118 parse_icmp(const char *icmptype, u_int8_t *type, u_int8_t code[])
 119 {
 120         unsigned int limit = sizeof(icmp_codes)/sizeof(struct icmp_names);
 121         unsigned int match = limit;
 122         unsigned int i;
 123
 124         for (i = 0; i < limit; i++) {
 125                 if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))
 126                     == 0) {
 127                         if (match != limit)
 128                                 exit_error(PARAMETER_PROBLEM,
 129                                            "Ambiguous ICMP type `%s':"
 130                                            " `%s' or `%s'?",
 131                                            icmptype,
 132                                            icmp_codes[match].name,
 133                                            icmp_codes[i].name);
 134                         match = i;
 135                 }
 136         }
 137
 138         if (match != limit) {
 139                 *type = icmp_codes[match].type;
 140                 code[0] = icmp_codes[match].code_min;
 141                 code[1] = icmp_codes[match].code_max;
 142         } else {
 143                 char *slash;
 144                 char buffer[strlen(icmptype) + 1];
 145                 unsigned int number;
 146
 147                 strcpy(buffer, icmptype);
 148                 slash = strchr(buffer, '/');
 149
 150                 if (slash)
 151                         *slash = '\0';
 152
 153                 if (string_to_number(buffer, 0, 255, &number) == -1)
 154                         exit_error(PARAMETER_PROBLEM,
 155                                    "Invalid ICMP type `%s'\n", buffer);
 156                 *type = number;
 157                 if (slash) {
 158                         if (string_to_number(slash+1, 0, 255, &number) == -1)
 159                                 exit_error(PARAMETER_PROBLEM,
 160                                            "Invalid ICMP code `%s'\n",
 161                                            slash+1);
 162                         code[0] = code[1] = number;
 163                 } else {
 164                         code[0] = 0;
 165                         code[1] = 0xFF;
 166                 }
 167         }
 168 }
 169
 170 /* Initialize the match. */
 171 static void
 172 init(struct ipt_entry_match *m, unsigned int *nfcache)
 173 {
 174         struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data;
 175
 176         icmpinfo->type = 0xFF;
 177         icmpinfo->code[1] = 0xFF;
 178 }
 179
 180 /* Function which parses command options; returns true if it
 181    ate an option */
 182 static int
 183 parse(int c, char **argv, int invert, unsigned int *flags,
 184       const struct ipt_entry *entry,
 185       unsigned int *nfcache,
 186       struct ipt_entry_match **match)
 187 {
 188         struct ipt_icmp *icmpinfo = (struct ipt_icmp *)(*match)->data;
 189
 190         switch (c) {
 191         case '1':
 192                 if (*flags == 1)
 193                         exit_error(PARAMETER_PROBLEM,
 194                                    "icmp match: only use --icmp-type once!");
 195                 check_inverse(optarg, &invert, &optind, 0);
 196                 parse_icmp(argv[optind-1], &icmpinfo->type,
 197                            icmpinfo->code);
 198                 if (invert)
 199                         icmpinfo->invflags |= IPT_ICMP_INV;
 200                 *flags = 1;
 201                 break;
 202
 203         default:
 204                 return 0;
 205         }
 206
 207         return 1;
 208 }
 209
 210 static void print_icmptype(u_int8_t type,
 211                            u_int8_t code_min, u_int8_t code_max,
 212                            int invert,
 213                            int numeric)
 214 {
 215         if (!numeric) {
 216                 unsigned int i;
 217
 218                 for (i = 0;
 219                      i < sizeof(icmp_codes)/sizeof(struct icmp_names);
 220                      i++) {
 221                         if (icmp_codes[i].type == type
 222                             && icmp_codes[i].code_min == code_min
 223                             && icmp_codes[i].code_max == code_max)
 224                                 break;
 225                 }
 226
 227                 if (i != sizeof(icmp_codes)/sizeof(struct icmp_names)) {
 228                         printf("%s%s ",
 229                                invert ? "!" : "",
 230                                icmp_codes[i].name);
 231                         return;
 232                 }
 233         }
 234
 235         if (invert)
 236                 printf("!");
 237
 238         printf("type %u", type);
 239         if (code_min == 0 && code_max == 0xFF)
 240                 printf(" ");
 241         else if (code_min == code_max)
 242                 printf(" code %u ", code_min);
 243         else
 244                 printf(" codes %u-%u ", code_min, code_max);
 245 }
 246
 247 /* Prints out the union ipt_matchinfo. */
 248 static void
 249 print(const struct ipt_ip *ip,
 250       const struct ipt_entry_match *match,
 251       int numeric)
 252 {
 253         const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 254
 255         printf("icmp ");
 256         print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
 257                        icmp->invflags & IPT_ICMP_INV,
 258                        numeric);
 259
 260         if (icmp->invflags & ~IPT_ICMP_INV)
 261                 printf("Unknown invflags: 0x%X ",
 262                        icmp->invflags & ~IPT_ICMP_INV);
 263 }
 264
 265 /* Saves the match in parsable form to stdout. */
 266 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 267 {
 268         const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
 269
 270         if (icmp->invflags & IPT_ICMP_INV)
 271                 printf("! ");
 272
 273         /* special hack for 'any' case */
 274         if (icmp->type == 0xFF) {
 275                 printf("--icmp-type any ");
 276         } else {
 277                 printf("--icmp-type %u", icmp->type);
 278                 if (icmp->code[0] != 0 || icmp->code[1] != 0xFF)
 279                         printf("/%u", icmp->code[0]);
 280                 printf(" ");
 281         }
 282 }
 283
 284 /* Final check; we don't care. We can pass 0xFF to match any type */
 285 static void final_check(unsigned int flags)
 286 {
 287 }
 288
 289 static struct iptables_match icmp = {
 290         .next           = NULL,
 291         .name           = "icmp",
 292         .version        = IPTABLES_VERSION,
 293         .size           = IPT_ALIGN(sizeof(struct ipt_icmp)),
 294         .userspacesize  = IPT_ALIGN(sizeof(struct ipt_icmp)),
 295         .help           = &help,
 296         .init           = &init,
 297         .parse          = &parse,
 298         .final_check    = &final_check,
 299         .print          = &print,
 300         .save           = &save,
 301         .extra_opts     = opts
 302 };
 303
 304 void _init(void)
 305 {
 306         register_match(&icmp);
 307 }