]>
Commit | Line | Data |
---|---|---|
09c434b8 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
be91fd5e | 2 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
1da177e4 LT |
3 | #include <linux/module.h> |
4 | #include <linux/skbuff.h> | |
5 | #include <net/ip.h> | |
2e4e6a17 | 6 | #include <net/ipv6.h> |
2bf07482 | 7 | #include <net/sctp/sctp.h> |
1da177e4 LT |
8 | #include <linux/sctp.h> |
9 | ||
2e4e6a17 HW |
10 | #include <linux/netfilter/x_tables.h> |
11 | #include <linux/netfilter/xt_sctp.h> | |
1da177e4 | 12 | #include <linux/netfilter_ipv4/ip_tables.h> |
2e4e6a17 HW |
13 | #include <linux/netfilter_ipv6/ip6_tables.h> |
14 | ||
15 | MODULE_LICENSE("GPL"); | |
16 | MODULE_AUTHOR("Kiran Kumar Immidi"); | |
2ae15b64 | 17 | MODULE_DESCRIPTION("Xtables: SCTP protocol packet match"); |
2e4e6a17 | 18 | MODULE_ALIAS("ipt_sctp"); |
73aaf935 | 19 | MODULE_ALIAS("ip6t_sctp"); |
1da177e4 | 20 | |
1da177e4 LT |
21 | #define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \ |
22 | || (!!((invflag) & (option)) ^ (cond))) | |
23 | ||
1d93a9cb | 24 | static bool |
2e4e6a17 | 25 | match_flags(const struct xt_sctp_flag_info *flag_info, |
1da177e4 LT |
26 | const int flag_count, |
27 | u_int8_t chunktype, | |
28 | u_int8_t chunkflags) | |
29 | { | |
30 | int i; | |
31 | ||
7c4e36bc JE |
32 | for (i = 0; i < flag_count; i++) |
33 | if (flag_info[i].chunktype == chunktype) | |
1da177e4 | 34 | return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag; |
1da177e4 | 35 | |
1d93a9cb | 36 | return true; |
1da177e4 LT |
37 | } |
38 | ||
1d93a9cb | 39 | static inline bool |
1da177e4 | 40 | match_packet(const struct sk_buff *skb, |
2e4e6a17 | 41 | unsigned int offset, |
009e8c96 | 42 | const struct xt_sctp_info *info, |
cff533ac | 43 | bool *hotdrop) |
1da177e4 | 44 | { |
1da177e4 | 45 | u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)]; |
922dbc5b XL |
46 | const struct sctp_chunkhdr *sch; |
47 | struct sctp_chunkhdr _sch; | |
009e8c96 LZ |
48 | int chunk_match_type = info->chunk_match_type; |
49 | const struct xt_sctp_flag_info *flag_info = info->flag_info; | |
50 | int flag_count = info->flag_count; | |
1da177e4 | 51 | |
be91fd5e | 52 | #ifdef DEBUG |
1da177e4 LT |
53 | int i = 0; |
54 | #endif | |
55 | ||
7c4e36bc | 56 | if (chunk_match_type == SCTP_CHUNK_MATCH_ALL) |
009e8c96 | 57 | SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap); |
1da177e4 | 58 | |
1da177e4 LT |
59 | do { |
60 | sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch); | |
d3dcd4ef | 61 | if (sch == NULL || sch->length == 0) { |
be91fd5e | 62 | pr_debug("Dropping invalid SCTP packet.\n"); |
cff533ac | 63 | *hotdrop = true; |
1d93a9cb | 64 | return false; |
601e68e1 | 65 | } |
be91fd5e JE |
66 | #ifdef DEBUG |
67 | pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d" | |
68 | "\tflags: %x\n", | |
69 | ++i, offset, sch->type, htons(sch->length), | |
70 | sch->flags); | |
71 | #endif | |
e2f036a9 | 72 | offset += SCTP_PAD4(ntohs(sch->length)); |
1da177e4 | 73 | |
be91fd5e | 74 | pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset); |
1da177e4 | 75 | |
009e8c96 | 76 | if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) { |
1da177e4 LT |
77 | switch (chunk_match_type) { |
78 | case SCTP_CHUNK_MATCH_ANY: | |
601e68e1 | 79 | if (match_flags(flag_info, flag_count, |
1da177e4 | 80 | sch->type, sch->flags)) { |
1d93a9cb | 81 | return true; |
1da177e4 LT |
82 | } |
83 | break; | |
84 | ||
85 | case SCTP_CHUNK_MATCH_ALL: | |
601e68e1 | 86 | if (match_flags(flag_info, flag_count, |
7c4e36bc | 87 | sch->type, sch->flags)) |
1da177e4 | 88 | SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type); |
1da177e4 LT |
89 | break; |
90 | ||
91 | case SCTP_CHUNK_MATCH_ONLY: | |
601e68e1 | 92 | if (!match_flags(flag_info, flag_count, |
7c4e36bc | 93 | sch->type, sch->flags)) |
1d93a9cb | 94 | return false; |
1da177e4 LT |
95 | break; |
96 | } | |
97 | } else { | |
98 | switch (chunk_match_type) { | |
99 | case SCTP_CHUNK_MATCH_ONLY: | |
1d93a9cb | 100 | return false; |
1da177e4 LT |
101 | } |
102 | } | |
103 | } while (offset < skb->len); | |
104 | ||
105 | switch (chunk_match_type) { | |
106 | case SCTP_CHUNK_MATCH_ALL: | |
d4e2675a | 107 | return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy); |
1da177e4 | 108 | case SCTP_CHUNK_MATCH_ANY: |
1d93a9cb | 109 | return false; |
1da177e4 | 110 | case SCTP_CHUNK_MATCH_ONLY: |
1d93a9cb | 111 | return true; |
1da177e4 LT |
112 | } |
113 | ||
114 | /* This will never be reached, but required to stop compiler whine */ | |
1d93a9cb | 115 | return false; |
1da177e4 LT |
116 | } |
117 | ||
1d93a9cb | 118 | static bool |
62fc8051 | 119 | sctp_mt(const struct sk_buff *skb, struct xt_action_param *par) |
1da177e4 | 120 | { |
f7108a20 | 121 | const struct xt_sctp_info *info = par->matchinfo; |
ae146d9b XL |
122 | const struct sctphdr *sh; |
123 | struct sctphdr _sh; | |
1da177e4 | 124 | |
f7108a20 | 125 | if (par->fragoff != 0) { |
be91fd5e | 126 | pr_debug("Dropping non-first fragment.. FIXME\n"); |
1d93a9cb | 127 | return false; |
1da177e4 | 128 | } |
601e68e1 | 129 | |
f7108a20 | 130 | sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh); |
1da177e4 | 131 | if (sh == NULL) { |
be91fd5e | 132 | pr_debug("Dropping evil TCP offset=0 tinygram.\n"); |
b4ba2611 | 133 | par->hotdrop = true; |
1d93a9cb | 134 | return false; |
601e68e1 | 135 | } |
be91fd5e | 136 | pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest)); |
1da177e4 | 137 | |
7c4e36bc JE |
138 | return SCCHECK(ntohs(sh->source) >= info->spts[0] |
139 | && ntohs(sh->source) <= info->spts[1], | |
ae146d9b XL |
140 | XT_SCTP_SRC_PORTS, info->flags, info->invflags) && |
141 | SCCHECK(ntohs(sh->dest) >= info->dpts[0] | |
7c4e36bc | 142 | && ntohs(sh->dest) <= info->dpts[1], |
ae146d9b XL |
143 | XT_SCTP_DEST_PORTS, info->flags, info->invflags) && |
144 | SCCHECK(match_packet(skb, par->thoff + sizeof(_sh), | |
145 | info, &par->hotdrop), | |
146 | XT_SCTP_CHUNK_TYPES, info->flags, info->invflags); | |
1da177e4 LT |
147 | } |
148 | ||
b0f38452 | 149 | static int sctp_mt_check(const struct xt_mtchk_param *par) |
2e4e6a17 | 150 | { |
9b4fce7a | 151 | const struct xt_sctp_info *info = par->matchinfo; |
2e4e6a17 | 152 | |
9f567317 | 153 | if (info->flags & ~XT_SCTP_VALID_FLAGS) |
bd414ee6 | 154 | return -EINVAL; |
9f567317 | 155 | if (info->invflags & ~XT_SCTP_VALID_FLAGS) |
bd414ee6 | 156 | return -EINVAL; |
9f567317 | 157 | if (info->invflags & ~info->flags) |
bd414ee6 | 158 | return -EINVAL; |
9f567317 | 159 | if (!(info->flags & XT_SCTP_CHUNK_TYPES)) |
bd414ee6 | 160 | return 0; |
9f567317 JE |
161 | if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL | |
162 | SCTP_CHUNK_MATCH_ANY | SCTP_CHUNK_MATCH_ONLY)) | |
bd414ee6 JE |
163 | return 0; |
164 | return -EINVAL; | |
2e4e6a17 HW |
165 | } |
166 | ||
d3c5ee6d | 167 | static struct xt_match sctp_mt_reg[] __read_mostly = { |
4470bbc7 PM |
168 | { |
169 | .name = "sctp", | |
ee999d8b | 170 | .family = NFPROTO_IPV4, |
d3c5ee6d JE |
171 | .checkentry = sctp_mt_check, |
172 | .match = sctp_mt, | |
4470bbc7 PM |
173 | .matchsize = sizeof(struct xt_sctp_info), |
174 | .proto = IPPROTO_SCTP, | |
175 | .me = THIS_MODULE | |
176 | }, | |
177 | { | |
178 | .name = "sctp", | |
ee999d8b | 179 | .family = NFPROTO_IPV6, |
d3c5ee6d JE |
180 | .checkentry = sctp_mt_check, |
181 | .match = sctp_mt, | |
4470bbc7 PM |
182 | .matchsize = sizeof(struct xt_sctp_info), |
183 | .proto = IPPROTO_SCTP, | |
184 | .me = THIS_MODULE | |
185 | }, | |
5d04bff0 | 186 | }; |
2e4e6a17 | 187 | |
d3c5ee6d | 188 | static int __init sctp_mt_init(void) |
1da177e4 | 189 | { |
d3c5ee6d | 190 | return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg)); |
1da177e4 LT |
191 | } |
192 | ||
d3c5ee6d | 193 | static void __exit sctp_mt_exit(void) |
1da177e4 | 194 | { |
d3c5ee6d | 195 | xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg)); |
1da177e4 LT |
196 | } |
197 | ||
d3c5ee6d JE |
198 | module_init(sctp_mt_init); |
199 | module_exit(sctp_mt_exit); |