You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
287 lines
7.1 KiB
287 lines
7.1 KiB
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <xtables.h>
|
|
#include <limits.h> /* INT_MAX in ip6_tables.h */
|
|
#include <linux/netfilter_ipv4/ip_tables.h>
|
|
|
|
#include "libxt_icmp.h"
|
|
|
|
/* special hack for icmp-type 'any':
|
|
* Up to kernel <=2.4.20 the problem was:
|
|
* '-p icmp ' matches all icmp packets
|
|
* '-p icmp -m icmp' matches _only_ ICMP type 0 :(
|
|
* This is now fixed by initializing the field * to icmp type 0xFF
|
|
* See: https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=37
|
|
*/
|
|
|
|
enum {
|
|
O_ICMP_TYPE = 0,
|
|
};
|
|
|
|
static const struct xt_icmp_names icmp_codes[] = {
|
|
{ "any", 0xFF, 0, 0xFF },
|
|
{ "echo-reply", 0, 0, 0xFF },
|
|
/* Alias */ { "pong", 0, 0, 0xFF },
|
|
|
|
{ "destination-unreachable", 3, 0, 0xFF },
|
|
{ "network-unreachable", 3, 0, 0 },
|
|
{ "host-unreachable", 3, 1, 1 },
|
|
{ "protocol-unreachable", 3, 2, 2 },
|
|
{ "port-unreachable", 3, 3, 3 },
|
|
{ "fragmentation-needed", 3, 4, 4 },
|
|
{ "source-route-failed", 3, 5, 5 },
|
|
{ "network-unknown", 3, 6, 6 },
|
|
{ "host-unknown", 3, 7, 7 },
|
|
{ "network-prohibited", 3, 9, 9 },
|
|
{ "host-prohibited", 3, 10, 10 },
|
|
{ "TOS-network-unreachable", 3, 11, 11 },
|
|
{ "TOS-host-unreachable", 3, 12, 12 },
|
|
{ "communication-prohibited", 3, 13, 13 },
|
|
{ "host-precedence-violation", 3, 14, 14 },
|
|
{ "precedence-cutoff", 3, 15, 15 },
|
|
|
|
{ "source-quench", 4, 0, 0xFF },
|
|
|
|
{ "redirect", 5, 0, 0xFF },
|
|
{ "network-redirect", 5, 0, 0 },
|
|
{ "host-redirect", 5, 1, 1 },
|
|
{ "TOS-network-redirect", 5, 2, 2 },
|
|
{ "TOS-host-redirect", 5, 3, 3 },
|
|
|
|
{ "echo-request", 8, 0, 0xFF },
|
|
/* Alias */ { "ping", 8, 0, 0xFF },
|
|
|
|
{ "router-advertisement", 9, 0, 0xFF },
|
|
|
|
{ "router-solicitation", 10, 0, 0xFF },
|
|
|
|
{ "time-exceeded", 11, 0, 0xFF },
|
|
/* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
|
|
{ "ttl-zero-during-transit", 11, 0, 0 },
|
|
{ "ttl-zero-during-reassembly", 11, 1, 1 },
|
|
|
|
{ "parameter-problem", 12, 0, 0xFF },
|
|
{ "ip-header-bad", 12, 0, 0 },
|
|
{ "required-option-missing", 12, 1, 1 },
|
|
|
|
{ "timestamp-request", 13, 0, 0xFF },
|
|
|
|
{ "timestamp-reply", 14, 0, 0xFF },
|
|
|
|
{ "address-mask-request", 17, 0, 0xFF },
|
|
|
|
{ "address-mask-reply", 18, 0, 0xFF }
|
|
};
|
|
|
|
static void icmp_help(void)
|
|
{
|
|
printf(
|
|
"icmp match options:\n"
|
|
"[!] --icmp-type typename match icmp type\n"
|
|
"[!] --icmp-type type[/code] (or numeric type or type/code)\n");
|
|
printf("Valid ICMP Types:");
|
|
xt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes));
|
|
}
|
|
|
|
static const struct xt_option_entry icmp_opts[] = {
|
|
{.name = "icmp-type", .id = O_ICMP_TYPE, .type = XTTYPE_STRING,
|
|
.flags = XTOPT_MAND | XTOPT_INVERT},
|
|
XTOPT_TABLEEND,
|
|
};
|
|
|
|
static void
|
|
parse_icmp(const char *icmptype, uint8_t *type, uint8_t code[])
|
|
{
|
|
static const unsigned int limit = ARRAY_SIZE(icmp_codes);
|
|
unsigned int match = limit;
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < limit; i++) {
|
|
if (strncasecmp(icmp_codes[i].name, icmptype, strlen(icmptype))
|
|
== 0) {
|
|
if (match != limit)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"Ambiguous ICMP type `%s':"
|
|
" `%s' or `%s'?",
|
|
icmptype,
|
|
icmp_codes[match].name,
|
|
icmp_codes[i].name);
|
|
match = i;
|
|
}
|
|
}
|
|
|
|
if (match != limit) {
|
|
*type = icmp_codes[match].type;
|
|
code[0] = icmp_codes[match].code_min;
|
|
code[1] = icmp_codes[match].code_max;
|
|
} else {
|
|
char *slash;
|
|
char buffer[strlen(icmptype) + 1];
|
|
unsigned int number;
|
|
|
|
strcpy(buffer, icmptype);
|
|
slash = strchr(buffer, '/');
|
|
|
|
if (slash)
|
|
*slash = '\0';
|
|
|
|
if (!xtables_strtoui(buffer, NULL, &number, 0, UINT8_MAX))
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"Invalid ICMP type `%s'\n", buffer);
|
|
*type = number;
|
|
if (slash) {
|
|
if (!xtables_strtoui(slash+1, NULL, &number, 0, UINT8_MAX))
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"Invalid ICMP code `%s'\n",
|
|
slash+1);
|
|
code[0] = code[1] = number;
|
|
} else {
|
|
code[0] = 0;
|
|
code[1] = 0xFF;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void icmp_init(struct xt_entry_match *m)
|
|
{
|
|
struct ipt_icmp *icmpinfo = (struct ipt_icmp *)m->data;
|
|
|
|
icmpinfo->type = 0xFF;
|
|
icmpinfo->code[1] = 0xFF;
|
|
}
|
|
|
|
static void icmp_parse(struct xt_option_call *cb)
|
|
{
|
|
struct ipt_icmp *icmpinfo = cb->data;
|
|
|
|
xtables_option_parse(cb);
|
|
parse_icmp(cb->arg, &icmpinfo->type, icmpinfo->code);
|
|
if (cb->invert)
|
|
icmpinfo->invflags |= IPT_ICMP_INV;
|
|
}
|
|
|
|
static void print_icmptype(uint8_t type,
|
|
uint8_t code_min, uint8_t code_max,
|
|
int invert,
|
|
int numeric)
|
|
{
|
|
if (!numeric) {
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(icmp_codes); ++i)
|
|
if (icmp_codes[i].type == type
|
|
&& icmp_codes[i].code_min == code_min
|
|
&& icmp_codes[i].code_max == code_max)
|
|
break;
|
|
|
|
if (i != ARRAY_SIZE(icmp_codes)) {
|
|
printf(" %s%s",
|
|
invert ? "!" : "",
|
|
icmp_codes[i].name);
|
|
return;
|
|
}
|
|
}
|
|
|
|
if (invert)
|
|
printf(" !");
|
|
|
|
printf("type %u", type);
|
|
if (code_min == code_max)
|
|
printf(" code %u", code_min);
|
|
else if (code_min != 0 || code_max != 0xFF)
|
|
printf(" codes %u-%u", code_min, code_max);
|
|
}
|
|
|
|
static void icmp_print(const void *ip, const struct xt_entry_match *match,
|
|
int numeric)
|
|
{
|
|
const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
|
|
|
|
printf(" icmp");
|
|
print_icmptype(icmp->type, icmp->code[0], icmp->code[1],
|
|
icmp->invflags & IPT_ICMP_INV,
|
|
numeric);
|
|
|
|
if (icmp->invflags & ~IPT_ICMP_INV)
|
|
printf(" Unknown invflags: 0x%X",
|
|
icmp->invflags & ~IPT_ICMP_INV);
|
|
}
|
|
|
|
static void icmp_save(const void *ip, const struct xt_entry_match *match)
|
|
{
|
|
const struct ipt_icmp *icmp = (struct ipt_icmp *)match->data;
|
|
|
|
if (icmp->invflags & IPT_ICMP_INV)
|
|
printf(" !");
|
|
|
|
/* special hack for 'any' case */
|
|
if (icmp->type == 0xFF) {
|
|
printf(" --icmp-type any");
|
|
} else {
|
|
printf(" --icmp-type %u", icmp->type);
|
|
if (icmp->code[0] != 0 || icmp->code[1] != 0xFF)
|
|
printf("/%u", icmp->code[0]);
|
|
}
|
|
}
|
|
|
|
static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
|
unsigned int code_min,
|
|
unsigned int code_max)
|
|
{
|
|
unsigned int i;
|
|
|
|
if (code_min != code_max) {
|
|
for (i = 0; i < ARRAY_SIZE(icmp_codes); ++i)
|
|
if (icmp_codes[i].type == icmptype &&
|
|
icmp_codes[i].code_min == code_min &&
|
|
icmp_codes[i].code_max == code_max) {
|
|
xt_xlate_add(xl, "%s", icmp_codes[i].name);
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int icmp_xlate(struct xt_xlate *xl,
|
|
const struct xt_xlate_mt_params *params)
|
|
{
|
|
const struct ipt_icmp *info = (struct ipt_icmp *)params->match->data;
|
|
|
|
if (info->type != 0xFF) {
|
|
xt_xlate_add(xl, "icmp type%s ",
|
|
(info->invflags & IPT_ICMP_INV) ? " !=" : "");
|
|
|
|
if (!type_xlate_print(xl, info->type, info->code[0],
|
|
info->code[1]))
|
|
return 0;
|
|
} else {
|
|
/* '-m icmp --icmp-type any' is a noop by itself,
|
|
* but it eats a (mandatory) previous '-p icmp' so
|
|
* emit it here */
|
|
xt_xlate_add(xl, "ip protocol icmp");
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
static struct xtables_match icmp_mt_reg = {
|
|
.name = "icmp",
|
|
.version = XTABLES_VERSION,
|
|
.family = NFPROTO_IPV4,
|
|
.size = XT_ALIGN(sizeof(struct ipt_icmp)),
|
|
.userspacesize = XT_ALIGN(sizeof(struct ipt_icmp)),
|
|
.help = icmp_help,
|
|
.init = icmp_init,
|
|
.print = icmp_print,
|
|
.save = icmp_save,
|
|
.x6_parse = icmp_parse,
|
|
.x6_options = icmp_opts,
|
|
.xlate = icmp_xlate,
|
|
};
|
|
|
|
void _init(void)
|
|
{
|
|
xtables_register_match(&icmp_mt_reg);
|
|
}
|