blob: cc7bfaeb72fd7a355acfcfa311cecf855211e3ec [file] [log] [blame]
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <xtables.h>
#include <limits.h> /* INT_MAX in ip6_tables.h */
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <netinet/icmp6.h>
#include "libxt_icmp.h"
enum {
O_ICMPV6_TYPE = 0,
};
static const struct xt_icmp_names icmpv6_codes[] = {
{ "destination-unreachable", 1, 0, 0xFF },
{ "no-route", 1, 0, 0 },
{ "communication-prohibited", 1, 1, 1 },
{ "beyond-scope", 1, 2, 2 },
{ "address-unreachable", 1, 3, 3 },
{ "port-unreachable", 1, 4, 4 },
{ "failed-policy", 1, 5, 5 },
{ "reject-route", 1, 6, 6 },
{ "packet-too-big", 2, 0, 0xFF },
{ "time-exceeded", 3, 0, 0xFF },
/* Alias */ { "ttl-exceeded", 3, 0, 0xFF },
{ "ttl-zero-during-transit", 3, 0, 0 },
{ "ttl-zero-during-reassembly", 3, 1, 1 },
{ "parameter-problem", 4, 0, 0xFF },
{ "bad-header", 4, 0, 0 },
{ "unknown-header-type", 4, 1, 1 },
{ "unknown-option", 4, 2, 2 },
{ "echo-request", 128, 0, 0xFF },
/* Alias */ { "ping", 128, 0, 0xFF },
{ "echo-reply", 129, 0, 0xFF },
/* Alias */ { "pong", 129, 0, 0xFF },
{ "router-solicitation", 133, 0, 0xFF },
{ "router-advertisement", 134, 0, 0xFF },
{ "neighbour-solicitation", 135, 0, 0xFF },
/* Alias */ { "neighbor-solicitation", 135, 0, 0xFF },
{ "neighbour-advertisement", 136, 0, 0xFF },
/* Alias */ { "neighbor-advertisement", 136, 0, 0xFF },
{ "redirect", 137, 0, 0xFF },
};
static void icmp6_help(void)
{
printf(
"icmpv6 match options:\n"
"[!] --icmpv6-type typename match icmpv6 type\n"
" (or numeric type or type/code)\n");
printf("Valid ICMPv6 Types:");
xt_print_icmp_types(icmpv6_codes, ARRAY_SIZE(icmpv6_codes));
}
static const struct xt_option_entry icmp6_opts[] = {
{.name = "icmpv6-type", .id = O_ICMPV6_TYPE, .type = XTTYPE_STRING,
.flags = XTOPT_MAND | XTOPT_INVERT},
XTOPT_TABLEEND,
};
static void
parse_icmpv6(const char *icmpv6type, uint8_t *type, uint8_t code[])
{
static const unsigned int limit = ARRAY_SIZE(icmpv6_codes);
unsigned int match = limit;
unsigned int i;
for (i = 0; i < limit; i++) {
if (strncasecmp(icmpv6_codes[i].name, icmpv6type, strlen(icmpv6type))
== 0) {
if (match != limit)
xtables_error(PARAMETER_PROBLEM,
"Ambiguous ICMPv6 type `%s':"
" `%s' or `%s'?",
icmpv6type,
icmpv6_codes[match].name,
icmpv6_codes[i].name);
match = i;
}
}
if (match != limit) {
*type = icmpv6_codes[match].type;
code[0] = icmpv6_codes[match].code_min;
code[1] = icmpv6_codes[match].code_max;
} else {
char *slash;
char buffer[strlen(icmpv6type) + 1];
unsigned int number;
strcpy(buffer, icmpv6type);
slash = strchr(buffer, '/');
if (slash)
*slash = '\0';
if (!xtables_strtoui(buffer, NULL, &number, 0, UINT8_MAX))
xtables_error(PARAMETER_PROBLEM,
"Invalid ICMPv6 type `%s'\n", buffer);
*type = number;
if (slash) {
if (!xtables_strtoui(slash+1, NULL, &number, 0, UINT8_MAX))
xtables_error(PARAMETER_PROBLEM,
"Invalid ICMPv6 code `%s'\n",
slash+1);
code[0] = code[1] = number;
} else {
code[0] = 0;
code[1] = 0xFF;
}
}
}
static void icmp6_init(struct xt_entry_match *m)
{
struct ip6t_icmp *icmpv6info = (struct ip6t_icmp *)m->data;
icmpv6info->code[1] = 0xFF;
}
static void icmp6_parse(struct xt_option_call *cb)
{
struct ip6t_icmp *icmpv6info = cb->data;
xtables_option_parse(cb);
parse_icmpv6(cb->arg, &icmpv6info->type, icmpv6info->code);
if (cb->invert)
icmpv6info->invflags |= IP6T_ICMP_INV;
}
static void print_icmpv6type(uint8_t type,
uint8_t code_min, uint8_t code_max,
int invert,
int numeric)
{
if (!numeric) {
unsigned int i;
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
if (icmpv6_codes[i].type == type
&& icmpv6_codes[i].code_min == code_min
&& icmpv6_codes[i].code_max == code_max)
break;
if (i != ARRAY_SIZE(icmpv6_codes)) {
printf(" %s%s",
invert ? "!" : "",
icmpv6_codes[i].name);
return;
}
}
if (invert)
printf(" !");
printf("type %u", type);
if (code_min == code_max)
printf(" code %u", code_min);
else if (code_min != 0 || code_max != 0xFF)
printf(" codes %u-%u", code_min, code_max);
}
static void icmp6_print(const void *ip, const struct xt_entry_match *match,
int numeric)
{
const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
printf(" ipv6-icmp");
print_icmpv6type(icmpv6->type, icmpv6->code[0], icmpv6->code[1],
icmpv6->invflags & IP6T_ICMP_INV,
numeric);
if (icmpv6->invflags & ~IP6T_ICMP_INV)
printf(" Unknown invflags: 0x%X",
icmpv6->invflags & ~IP6T_ICMP_INV);
}
static void icmp6_save(const void *ip, const struct xt_entry_match *match)
{
const struct ip6t_icmp *icmpv6 = (struct ip6t_icmp *)match->data;
if (icmpv6->invflags & IP6T_ICMP_INV)
printf(" !");
printf(" --icmpv6-type %u", icmpv6->type);
if (icmpv6->code[0] != 0 || icmpv6->code[1] != 0xFF)
printf("/%u", icmpv6->code[0]);
}
#define XT_ICMPV6_TYPE(type) (type - ND_ROUTER_SOLICIT)
static const char *icmp6_type_xlate_array[] = {
[XT_ICMPV6_TYPE(ND_ROUTER_SOLICIT)] = "nd-router-solicit",
[XT_ICMPV6_TYPE(ND_ROUTER_ADVERT)] = "nd-router-advert",
[XT_ICMPV6_TYPE(ND_NEIGHBOR_SOLICIT)] = "nd-neighbor-solicit",
[XT_ICMPV6_TYPE(ND_NEIGHBOR_ADVERT)] = "nd-neighbor-advert",
[XT_ICMPV6_TYPE(ND_REDIRECT)] = "nd-redirect",
};
static const char *icmp6_type_xlate(unsigned int type)
{
if (type < ND_ROUTER_SOLICIT || type > ND_REDIRECT)
return NULL;
return icmp6_type_xlate_array[XT_ICMPV6_TYPE(type)];
}
static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
unsigned int code_min,
unsigned int code_max)
{
unsigned int i;
const char *type_name;
if (code_min == code_max)
return 0;
type_name = icmp6_type_xlate(icmptype);
if (type_name) {
xt_xlate_add(xl, "%s", type_name);
} else {
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
if (icmpv6_codes[i].type == icmptype &&
icmpv6_codes[i].code_min == code_min &&
icmpv6_codes[i].code_max == code_max)
break;
if (i != ARRAY_SIZE(icmpv6_codes))
xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
else
return 0;
}
return 1;
}
static int icmp6_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
const struct ip6t_icmp *info = (struct ip6t_icmp *)params->match->data;
xt_xlate_add(xl, "icmpv6 type%s ",
(info->invflags & IP6T_ICMP_INV) ? " !=" : "");
if (!type_xlate_print(xl, info->type, info->code[0], info->code[1]))
return 0;
return 1;
}
static struct xtables_match icmp6_mt6_reg = {
.name = "icmp6",
.version = XTABLES_VERSION,
.family = NFPROTO_IPV6,
.size = XT_ALIGN(sizeof(struct ip6t_icmp)),
.userspacesize = XT_ALIGN(sizeof(struct ip6t_icmp)),
.help = icmp6_help,
.init = icmp6_init,
.print = icmp6_print,
.save = icmp6_save,
.x6_parse = icmp6_parse,
.x6_options = icmp6_opts,
.xlate = icmp6_xlate,
};
void _init(void)
{
xtables_register_match(&icmp6_mt6_reg);
}