1 /* Shared library add-on to iptables to add ICMP support. */
8 #include <linux/netfilter_ipv4/ip_tables.h>
10 /* special hack for icmp-type 'any':
11 * Up to kernel <=2.4.20 the problem was:
12 * '-p icmp ' matches all icmp packets
13 * '-p icmp -m icmp' matches _only_ ICMP type 0 :(
14 * This is now fixed by initializing the field * to icmp type 0xFF
15 * See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
21 u_int8_t code_min
, code_max
;
24 static const struct icmp_names icmp_codes
[] = {
25 { "any", 0xFF, 0, 0xFF },
26 { "echo-reply", 0, 0, 0xFF },
27 /* Alias */ { "pong", 0, 0, 0xFF },
29 { "destination-unreachable", 3, 0, 0xFF },
30 { "network-unreachable", 3, 0, 0 },
31 { "host-unreachable", 3, 1, 1 },
32 { "protocol-unreachable", 3, 2, 2 },
33 { "port-unreachable", 3, 3, 3 },
34 { "fragmentation-needed", 3, 4, 4 },
35 { "source-route-failed", 3, 5, 5 },
36 { "network-unknown", 3, 6, 6 },
37 { "host-unknown", 3, 7, 7 },
38 { "network-prohibited", 3, 9, 9 },
39 { "host-prohibited", 3, 10, 10 },
40 { "TOS-network-unreachable", 3, 11, 11 },
41 { "TOS-host-unreachable", 3, 12, 12 },
42 { "communication-prohibited", 3, 13, 13 },
43 { "host-precedence-violation", 3, 14, 14 },
44 { "precedence-cutoff", 3, 15, 15 },
46 { "source-quench", 4, 0, 0xFF },
48 { "redirect", 5, 0, 0xFF },
49 { "network-redirect", 5, 0, 0 },
50 { "host-redirect", 5, 1, 1 },
51 { "TOS-network-redirect", 5, 2, 2 },
52 { "TOS-host-redirect", 5, 3, 3 },
54 { "echo-request", 8, 0, 0xFF },
55 /* Alias */ { "ping", 8, 0, 0xFF },
57 { "router-advertisement", 9, 0, 0xFF },
59 { "router-solicitation", 10, 0, 0xFF },
61 { "time-exceeded", 11, 0, 0xFF },
62 /* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
63 { "ttl-zero-during-transit", 11, 0, 0 },
64 { "ttl-zero-during-reassembly", 11, 1, 1 },
66 { "parameter-problem", 12, 0, 0xFF },
67 { "ip-header-bad", 12, 0, 0 },
68 { "required-option-missing", 12, 1, 1 },
70 { "timestamp-request", 13, 0, 0xFF },
72 { "timestamp-reply", 14, 0, 0xFF },
74 { "address-mask-request", 17, 0, 0xFF },
76 { "address-mask-reply", 18, 0, 0xFF }
83 printf("Valid ICMP Types:");
85 for (i
= 0; i
< sizeof(icmp_codes
)/sizeof(struct icmp_names
); i
++) {
86 if (i
&& icmp_codes
[i
].type
== icmp_codes
[i
-1].type
) {
87 if (icmp_codes
[i
].code_min
== icmp_codes
[i
-1].code_min
88 && (icmp_codes
[i
].code_max
89 == icmp_codes
[i
-1].code_max
))
90 printf(" (%s)", icmp_codes
[i
].name
);
92 printf("\n %s", icmp_codes
[i
].name
);
95 printf("\n%s", icmp_codes
[i
].name
);
100 /* Function which prints out usage message. */
105 "ICMP v%s options:\n"
106 " --icmp-type [!] typename match icmp type\n"
107 " (or numeric type or type/code)\n"
108 "\n", IPTABLES_VERSION
);
112 static struct option opts
[] = {
113 { "icmp-type", 1, 0, '1' },
118 parse_icmp(const char *icmptype
, u_int8_t
*type
, u_int8_t code
[])
120 unsigned int limit
= sizeof(icmp_codes
)/sizeof(struct icmp_names
);
121 unsigned int match
= limit
;
124 for (i
= 0; i
< limit
; i
++) {
125 if (strncasecmp(icmp_codes
[i
].name
, icmptype
, strlen(icmptype
))
128 exit_error(PARAMETER_PROBLEM
,
129 "Ambiguous ICMP type `%s':"
132 icmp_codes
[match
].name
,
138 if (match
!= limit
) {
139 *type
= icmp_codes
[match
].type
;
140 code
[0] = icmp_codes
[match
].code_min
;
141 code
[1] = icmp_codes
[match
].code_max
;
144 char buffer
[strlen(icmptype
) + 1];
147 strcpy(buffer
, icmptype
);
148 slash
= strchr(buffer
, '/');
153 if (string_to_number(buffer
, 0, 255, &number
) == -1)
154 exit_error(PARAMETER_PROBLEM
,
155 "Invalid ICMP type `%s'\n", buffer
);
158 if (string_to_number(slash
+1, 0, 255, &number
) == -1)
159 exit_error(PARAMETER_PROBLEM
,
160 "Invalid ICMP code `%s'\n",
162 code
[0] = code
[1] = number
;
170 /* Initialize the match. */
172 init(struct ipt_entry_match
*m
, unsigned int *nfcache
)
174 struct ipt_icmp
*icmpinfo
= (struct ipt_icmp
*)m
->data
;
176 icmpinfo
->type
= 0xFF;
177 icmpinfo
->code
[1] = 0xFF;
180 /* Function which parses command options; returns true if it
183 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
184 const struct ipt_entry
*entry
,
185 unsigned int *nfcache
,
186 struct ipt_entry_match
**match
)
188 struct ipt_icmp
*icmpinfo
= (struct ipt_icmp
*)(*match
)->data
;
193 exit_error(PARAMETER_PROBLEM
,
194 "icmp match: only use --icmp-type once!");
195 check_inverse(optarg
, &invert
, &optind
, 0);
196 parse_icmp(argv
[optind
-1], &icmpinfo
->type
,
199 icmpinfo
->invflags
|= IPT_ICMP_INV
;
210 static void print_icmptype(u_int8_t type
,
211 u_int8_t code_min
, u_int8_t code_max
,
219 i
< sizeof(icmp_codes
)/sizeof(struct icmp_names
);
221 if (icmp_codes
[i
].type
== type
222 && icmp_codes
[i
].code_min
== code_min
223 && icmp_codes
[i
].code_max
== code_max
)
227 if (i
!= sizeof(icmp_codes
)/sizeof(struct icmp_names
)) {
238 printf("type %u", type
);
239 if (code_min
== 0 && code_max
== 0xFF)
241 else if (code_min
== code_max
)
242 printf(" code %u ", code_min
);
244 printf(" codes %u-%u ", code_min
, code_max
);
247 /* Prints out the union ipt_matchinfo. */
249 print(const struct ipt_ip
*ip
,
250 const struct ipt_entry_match
*match
,
253 const struct ipt_icmp
*icmp
= (struct ipt_icmp
*)match
->data
;
256 print_icmptype(icmp
->type
, icmp
->code
[0], icmp
->code
[1],
257 icmp
->invflags
& IPT_ICMP_INV
,
260 if (icmp
->invflags
& ~IPT_ICMP_INV
)
261 printf("Unknown invflags: 0x%X ",
262 icmp
->invflags
& ~IPT_ICMP_INV
);
265 /* Saves the match in parsable form to stdout. */
266 static void save(const struct ipt_ip
*ip
, const struct ipt_entry_match
*match
)
268 const struct ipt_icmp
*icmp
= (struct ipt_icmp
*)match
->data
;
270 if (icmp
->invflags
& IPT_ICMP_INV
)
273 /* special hack for 'any' case */
274 if (icmp
->type
== 0xFF) {
275 printf("--icmp-type any ");
277 printf("--icmp-type %u", icmp
->type
);
278 if (icmp
->code
[0] != 0 || icmp
->code
[1] != 0xFF)
279 printf("/%u", icmp
->code
[0]);
284 /* Final check; we don't care. We can pass 0xFF to match any type */
285 static void final_check(unsigned int flags
)
289 static struct iptables_match icmp
= {
292 .version
= IPTABLES_VERSION
,
293 .size
= IPT_ALIGN(sizeof(struct ipt_icmp
)),
294 .userspacesize
= IPT_ALIGN(sizeof(struct ipt_icmp
)),
298 .final_check
= &final_check
,
306 register_match(&icmp
);