blob: a6e642a2a3824682aaf977aac35bda7575d3678e [file] [log] [blame]
Marc Bouchere6869a82000-03-20 06:03:29 +00001/* Shared library add-on to iptables to add ICMP support. */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <getopt.h>
7#include <iptables.h>
8#include <linux/netfilter_ipv4/ip_tables.h>
9
Harald Weltefc9237d2003-02-25 10:50:59 +000010/* special hack for icmp-type 'any':
11 * Up to kernel <=2.4.20 the problem was:
12 * '-p icmp ' matches all icmp packets
13 * '-p icmp -m icmp' matches _only_ ICMP type 0 :(
14 * This is now fixed by initializing the field * to icmp type 0xFF
15 * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
16 */
17
Marc Bouchere6869a82000-03-20 06:03:29 +000018struct icmp_names {
19 const char *name;
20 u_int8_t type;
21 u_int8_t code_min, code_max;
22};
23
24static const struct icmp_names icmp_codes[] = {
Harald Weltefc9237d2003-02-25 10:50:59 +000025 { "any", 0xFF, 0, 0xFF },
Marc Bouchere6869a82000-03-20 06:03:29 +000026 { "echo-reply", 0, 0, 0xFF },
27 /* Alias */ { "pong", 0, 0, 0xFF },
28
29 { "destination-unreachable", 3, 0, 0xFF },
30 { "network-unreachable", 3, 0, 0 },
31 { "host-unreachable", 3, 1, 1 },
32 { "protocol-unreachable", 3, 2, 2 },
33 { "port-unreachable", 3, 3, 3 },
34 { "fragmentation-needed", 3, 4, 4 },
35 { "source-route-failed", 3, 5, 5 },
36 { "network-unknown", 3, 6, 6 },
37 { "host-unknown", 3, 7, 7 },
38 { "network-prohibited", 3, 9, 9 },
39 { "host-prohibited", 3, 10, 10 },
40 { "TOS-network-unreachable", 3, 11, 11 },
41 { "TOS-host-unreachable", 3, 12, 12 },
42 { "communication-prohibited", 3, 13, 13 },
43 { "host-precedence-violation", 3, 14, 14 },
44 { "precedence-cutoff", 3, 15, 15 },
45
46 { "source-quench", 4, 0, 0xFF },
47
48 { "redirect", 5, 0, 0xFF },
49 { "network-redirect", 5, 0, 0 },
50 { "host-redirect", 5, 1, 1 },
51 { "TOS-network-redirect", 5, 2, 2 },
52 { "TOS-host-redirect", 5, 3, 3 },
53
54 { "echo-request", 8, 0, 0xFF },
55 /* Alias */ { "ping", 8, 0, 0xFF },
56
57 { "router-advertisement", 9, 0, 0xFF },
58
59 { "router-solicitation", 10, 0, 0xFF },
60
61 { "time-exceeded", 11, 0, 0xFF },
62 /* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
63 { "ttl-zero-during-transit", 11, 0, 0 },
64 { "ttl-zero-during-reassembly", 11, 1, 1 },
65
66 { "parameter-problem", 12, 0, 0xFF },
67 { "ip-header-bad", 12, 0, 0 },
68 { "required-option-missing", 12, 1, 1 },
69
70 { "timestamp-request", 13, 0, 0xFF },
71
72 { "timestamp-reply", 14, 0, 0xFF },
73
74 { "address-mask-request", 17, 0, 0xFF },
75
76 { "address-mask-reply", 18, 0, 0xFF }
77};
78
79static void
80print_icmptypes()
81{
82 unsigned int i;
83 printf("Valid ICMP Types:");
84
85 for (i = 0; i < sizeof(icmp_codes)/sizeof(struct icmp_names); i++) {
86 if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
87 if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
88 && (icmp_codes[i].code_max
89 == icmp_codes[i-1].code_max))
90 printf(" (%s)", icmp_codes[i].name);
91 else
92 printf("\n %s", icmp_codes[i].name);
93 }
94 else
95 printf("\n%s", icmp_codes[i].name);
96 }
97 printf("\n");
98}
99
100/* Function which prints out usage message. */
101static void
102help(void)
103{
104 printf(
105"ICMP v%s options:\n"
106" --icmp-type [!] typename match icmp type\n"
107" (or numeric type or type/code)\n"
Harald Welte80fe35d2002-05-29 13:08:15 +0000108"\n", IPTABLES_VERSION);
Marc Bouchere6869a82000-03-20 06:03:29 +0000109 print_icmptypes();
110}
111
112static struct option opts[] = {
113 { "icmp-type", 1, 0, '1' },
114 {0}
115};
116
Pablo Neira8115e542005-02-14 13:13:04 +0000117static void
Marc Bouchere6869a82000-03-20 06:03:29 +0000118parse_icmp(const char *icmptype, u_int8_t *type, u_int8_t code[])
119{
120 unsigned int limit = sizeof(icmp_codes)/sizeof(struct icmp_names);
121 unsigned int match = limit;
122 unsigned int i;
123
124 for (i = 0; i < limit; i++) {
125 if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))
126 == 0) {
127 if (match != limit)
128 exit_error(PARAMETER_PROBLEM,
129 "Ambiguous ICMP type `%s':"
130 " `%s' or `%s'?",
131 icmptype,
132 icmp_codes[match].name,
133 icmp_codes[i].name);
134 match = i;
135 }
136 }
137
138 if (match != limit) {
139 *type = icmp_codes[match].type;
140 code[0] = icmp_codes[match].code_min;
141 code[1] = icmp_codes[match].code_max;
142 } else {
143 char *slash;
144 char buffer[strlen(icmptype) + 1];
Harald Welteb4719762001-07-23 02:14:22 +0000145 unsigned int number;
Marc Bouchere6869a82000-03-20 06:03:29 +0000146
147 strcpy(buffer, icmptype);
148 slash = strchr(buffer, '/');
149
150 if (slash)
151 *slash = '\0';
152
Harald Welteb4719762001-07-23 02:14:22 +0000153 if (string_to_number(buffer, 0, 255, &number) == -1)
Marc Bouchere6869a82000-03-20 06:03:29 +0000154 exit_error(PARAMETER_PROBLEM,
155 "Invalid ICMP type `%s'\n", buffer);
156 *type = number;
157 if (slash) {
Harald Welteb4719762001-07-23 02:14:22 +0000158 if (string_to_number(slash+1, 0, 255, &number) == -1)
Marc Bouchere6869a82000-03-20 06:03:29 +0000159 exit_error(PARAMETER_PROBLEM,
160 "Invalid ICMP code `%s'\n",
161 slash+1);
162 code[0] = code[1] = number;
163 } else {
164 code[0] = 0;
165 code[1] = 0xFF;
166 }
167 }
Marc Bouchere6869a82000-03-20 06:03:29 +0000168}
169
170/* Initialize the match. */
171static void
172init(struct ipt_entry_match *m, unsigned int *nfcache)
173{
174 struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data;
175
Harald Weltefc9237d2003-02-25 10:50:59 +0000176 icmpinfo->type = 0xFF;
Marc Bouchere6869a82000-03-20 06:03:29 +0000177 icmpinfo->code[1] = 0xFF;
178}
179
180/* Function which parses command options; returns true if it
181 ate an option */
182static int
183parse(int c, char **argv, int invert, unsigned int *flags,
184 const struct ipt_entry *entry,
185 unsigned int *nfcache,
186 struct ipt_entry_match **match)
187{
188 struct ipt_icmp *icmpinfo = (struct ipt_icmp *)(*match)->data;
189
190 switch (c) {
191 case '1':
Yasuyuki KOZAKAIb1cda882006-07-04 10:23:26 +0000192 if (*flags == 1)
193 exit_error(PARAMETER_PROBLEM,
194 "icmp match: only use --icmp-type once!");
Harald Welteb77f1da2002-03-14 11:35:58 +0000195 check_inverse(optarg, &invert, &optind, 0);
Pablo Neira8115e542005-02-14 13:13:04 +0000196 parse_icmp(argv[optind-1], &icmpinfo->type,
197 icmpinfo->code);
Marc Bouchere6869a82000-03-20 06:03:29 +0000198 if (invert)
199 icmpinfo->invflags |= IPT_ICMP_INV;
Yasuyuki KOZAKAIb1cda882006-07-04 10:23:26 +0000200 *flags = 1;
Marc Bouchere6869a82000-03-20 06:03:29 +0000201 break;
202
203 default:
204 return 0;
205 }
206
207 return 1;
208}
209
210static void print_icmptype(u_int8_t type,
211 u_int8_t code_min, u_int8_t code_max,
212 int invert,
213 int numeric)
214{
215 if (!numeric) {
216 unsigned int i;
217
218 for (i = 0;
219 i < sizeof(icmp_codes)/sizeof(struct icmp_names);
220 i++) {
221 if (icmp_codes[i].type == type
222 && icmp_codes[i].code_min == code_min
223 && icmp_codes[i].code_max == code_max)
224 break;
225 }
226
227 if (i != sizeof(icmp_codes)/sizeof(struct icmp_names)) {
228 printf("%s%s ",
229 invert ? "!" : "",
230 icmp_codes[i].name);
231 return;
232 }
233 }
234
235 if (invert)
236 printf("!");
237
238 printf("type %u", type);
239 if (code_min == 0 && code_max == 0xFF)
240 printf(" ");
241 else if (code_min == code_max)
242 printf(" code %u ", code_min);
243 else
244 printf(" codes %u-%u ", code_min, code_max);
245}
246
247/* Prints out the union ipt_matchinfo. */
248static void
249print(const struct ipt_ip *ip,
250 const struct ipt_entry_match *match,
251 int numeric)
252{
253 const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
254
255 printf("icmp ");
256 print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
257 icmp->invflags & IPT_ICMP_INV,
258 numeric);
259
260 if (icmp->invflags & ~IPT_ICMP_INV)
261 printf("Unknown invflags: 0x%X ",
262 icmp->invflags & ~IPT_ICMP_INV);
263}
264
265/* Saves the match in parsable form to stdout. */
266static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
267{
268 const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
269
270 if (icmp->invflags & IPT_ICMP_INV)
271 printf("! ");
272
Harald Weltefc9237d2003-02-25 10:50:59 +0000273 /* special hack for 'any' case */
274 if (icmp->type == 0xFF) {
Harald Welted2979572004-02-04 08:42:37 +0000275 printf("--icmp-type any ");
Harald Weltefc9237d2003-02-25 10:50:59 +0000276 } else {
277 printf("--icmp-type %u", icmp->type);
278 if (icmp->code[0] != 0 || icmp->code[1] != 0xFF)
279 printf("/%u", icmp->code[0]);
280 printf(" ");
281 }
Marc Bouchere6869a82000-03-20 06:03:29 +0000282}
283
Yasuyuki KOZAKAIee9e2202007-02-19 05:01:39 +0000284/* Final check; we don't care. We can pass 0xFF to match any type */
Marc Bouchere6869a82000-03-20 06:03:29 +0000285static void final_check(unsigned int flags)
286{
287}
288
Pablo Neira8caee8b2004-12-28 13:11:59 +0000289static struct iptables_match icmp = {
290 .next = NULL,
291 .name = "icmp",
292 .version = IPTABLES_VERSION,
293 .size = IPT_ALIGN(sizeof(struct ipt_icmp)),
294 .userspacesize = IPT_ALIGN(sizeof(struct ipt_icmp)),
295 .help = &help,
296 .init = &init,
297 .parse = &parse,
298 .final_check = &final_check,
299 .print = &print,
300 .save = &save,
301 .extra_opts = opts
Marc Bouchere6869a82000-03-20 06:03:29 +0000302};
303
304void _init(void)
305{
306 register_match(&icmp);
307}