Types

ICMPv6 messages are classified according to the type and code fields present in the ICMPv6 header. The abbreviations for the types and codes may be used in rules in pf.conf(5). The following types are defined:

The following codes are defined:

Headers

All ICMPv6 messages are prefixed with an ICMPv6 header. This header corresponds to the icmp6_hdr structure and has the following definition:

struct icmp6_hdr {
	u_int8_t	icmp6_type;	/* type field */
	u_int8_t	icmp6_code;	/* code field */
	u_int16_t	icmp6_cksum;	/* checksum field */
	union {
		u_int32_t icmp6_un_data32[1]; /* type-specific */
		u_int16_t icmp6_un_data16[2]; /* type-specific */
		u_int8_t  icmp6_un_data8[4];  /* type-specific */
	} icmp6_dataun;
} __packed;

#define icmp6_data32	icmp6_dataun.icmp6_un_data32
#define icmp6_data16	icmp6_dataun.icmp6_un_data16
#define icmp6_data8	icmp6_dataun.icmp6_un_data8
#define icmp6_pptr	icmp6_data32[0]	/* parameter prob */
#define icmp6_mtu	icmp6_data32[0]	/* packet too big */
#define icmp6_id	icmp6_data16[0]	/* echo request/reply */
#define icmp6_seq	icmp6_data16[1]	/* echo request/reply */
#define icmp6_maxdelay	icmp6_data16[0]	/* mcast group membership*/

icmp6_type describes the type of the message. Suitable values are defined in ⟨netinet/icmp6.h⟩. icmp6_code describes the sub-type of the message and depends on icmp6_type. icmp6_cksum contains the checksum for the message and is filled in by the kernel on outgoing messages. The other fields are used for type-specific purposes.

Filters

Because of the extra functionality of ICMPv6 in comparison to ICMPv4, a larger number of messages may be potentially received on an ICMPv6 socket. Input filters may therefore be used to restrict input to a subset of the incoming ICMPv6 messages so only interesting messages are returned by the recv(2) family of calls to an application.

The icmp6_filter structure may be used to refine the input message set according to the ICMPv6 type. By default, all messages types are allowed on newly created raw ICMPv6 sockets. The following macros may be used to refine the input set:

void ICMP6_FILTER_SETPASSALL(struct icmp6_filter *filterp)

Allow all incoming messages. filterp is modified to allow all message types.

void ICMP6_FILTER_SETBLOCKALL(struct icmp6_filter *filterp)

Ignore all incoming messages. filterp is modified to ignore all message types.

void ICMP6_FILTER_SETPASS(int type, struct icmp6_filter *filterp)

Allow ICMPv6 messages with the given type. filterp is modified to allow such messages.

void ICMP6_FILTER_SETBLOCK(int type, struct icmp6_filter *filterp)

Ignore ICMPv6 messages with the given type. filterp is modified to ignore such messages.

int ICMP6_FILTER_WILLPASS(int type, const struct icmp6_filter *filterp)

Determine if the given filter will allow an ICMPv6 message of the given type.

int ICMP6_FILTER_WILLBLOCK(int type, const struct icmp6_filter *filterp)

Determine if the given filter will ignore an ICMPv6 message of the given type.

The getsockopt(2) and setsockopt(2) calls may be used to obtain and install the filter on ICMPv6 sockets at option level IPPROTO_ICMPV6 and name ICMPV6_FILTER with a pointer to the icmp6_filter structure as the option value.

Non-privileged ICMPv6

ICMPv6 sockets can be opened with the SOCK_DGRAM socket type without requiring root privileges. The synopsis is the following:

socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6)

This can only be used to send ICMPv6 echo requests to gauge the quality of the connectivity to a host, to receive destination unreachable message for path MTU discovery, or to receive time exceeded message for traceroute.

A socket opened with superuser privileges can send any kind of ICMPv6 message and can also use the ip6(4) options that require superuser privileges.