Commit | Line | Data |
---|---|---|
be91fd5e | 1 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
1da177e4 LT |
2 | #include <linux/module.h> |
3 | #include <linux/skbuff.h> | |
4 | #include <net/ip.h> | |
2e4e6a17 | 5 | #include <net/ipv6.h> |
1da177e4 LT |
6 | #include <linux/sctp.h> |
7 | ||
2e4e6a17 HW |
8 | #include <linux/netfilter/x_tables.h> |
9 | #include <linux/netfilter/xt_sctp.h> | |
1da177e4 | 10 | #include <linux/netfilter_ipv4/ip_tables.h> |
2e4e6a17 HW |
11 | #include <linux/netfilter_ipv6/ip6_tables.h> |
12 | ||
13 | MODULE_LICENSE("GPL"); | |
14 | MODULE_AUTHOR("Kiran Kumar Immidi"); | |
2ae15b64 | 15 | MODULE_DESCRIPTION("Xtables: SCTP protocol packet match"); |
2e4e6a17 | 16 | MODULE_ALIAS("ipt_sctp"); |
73aaf935 | 17 | MODULE_ALIAS("ip6t_sctp"); |
1da177e4 | 18 | |
1da177e4 LT |
19 | #define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \ |
20 | || (!!((invflag) & (option)) ^ (cond))) | |
21 | ||
1d93a9cb | 22 | static bool |
2e4e6a17 | 23 | match_flags(const struct xt_sctp_flag_info *flag_info, |
1da177e4 LT |
24 | const int flag_count, |
25 | u_int8_t chunktype, | |
26 | u_int8_t chunkflags) | |
27 | { | |
28 | int i; | |
29 | ||
7c4e36bc JE |
30 | for (i = 0; i < flag_count; i++) |
31 | if (flag_info[i].chunktype == chunktype) | |
1da177e4 | 32 | return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag; |
1da177e4 | 33 | |
1d93a9cb | 34 | return true; |
1da177e4 LT |
35 | } |
36 | ||
1d93a9cb | 37 | static inline bool |
1da177e4 | 38 | match_packet(const struct sk_buff *skb, |
2e4e6a17 | 39 | unsigned int offset, |
009e8c96 | 40 | const struct xt_sctp_info *info, |
cff533ac | 41 | bool *hotdrop) |
1da177e4 | 42 | { |
1da177e4 | 43 | u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)]; |
3cf93c96 JE |
44 | const sctp_chunkhdr_t *sch; |
45 | sctp_chunkhdr_t _sch; | |
009e8c96 LZ |
46 | int chunk_match_type = info->chunk_match_type; |
47 | const struct xt_sctp_flag_info *flag_info = info->flag_info; | |
48 | int flag_count = info->flag_count; | |
1da177e4 | 49 | |
be91fd5e | 50 | #ifdef DEBUG |
1da177e4 LT |
51 | int i = 0; |
52 | #endif | |
53 | ||
7c4e36bc | 54 | if (chunk_match_type == SCTP_CHUNK_MATCH_ALL) |
009e8c96 | 55 | SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap); |
1da177e4 | 56 | |
1da177e4 LT |
57 | do { |
58 | sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch); | |
d3dcd4ef | 59 | if (sch == NULL || sch->length == 0) { |
be91fd5e | 60 | pr_debug("Dropping invalid SCTP packet.\n"); |
cff533ac | 61 | *hotdrop = true; |
1d93a9cb | 62 | return false; |
601e68e1 | 63 | } |
be91fd5e JE |
64 | #ifdef DEBUG |
65 | pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d" | |
66 | "\tflags: %x\n", | |
67 | ++i, offset, sch->type, htons(sch->length), | |
68 | sch->flags); | |
69 | #endif | |
962c8372 | 70 | offset += (ntohs(sch->length) + 3) & ~3; |
1da177e4 | 71 | |
be91fd5e | 72 | pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset); |
1da177e4 | 73 | |
009e8c96 | 74 | if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) { |
1da177e4 LT |
75 | switch (chunk_match_type) { |
76 | case SCTP_CHUNK_MATCH_ANY: | |
601e68e1 | 77 | if (match_flags(flag_info, flag_count, |
1da177e4 | 78 | sch->type, sch->flags)) { |
1d93a9cb | 79 | return true; |
1da177e4 LT |
80 | } |
81 | break; | |
82 | ||
83 | case SCTP_CHUNK_MATCH_ALL: | |
601e68e1 | 84 | if (match_flags(flag_info, flag_count, |
7c4e36bc | 85 | sch->type, sch->flags)) |
1da177e4 | 86 | SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type); |
1da177e4 LT |
87 | break; |
88 | ||
89 | case SCTP_CHUNK_MATCH_ONLY: | |
601e68e1 | 90 | if (!match_flags(flag_info, flag_count, |
7c4e36bc | 91 | sch->type, sch->flags)) |
1d93a9cb | 92 | return false; |
1da177e4 LT |
93 | break; |
94 | } | |
95 | } else { | |
96 | switch (chunk_match_type) { | |
97 | case SCTP_CHUNK_MATCH_ONLY: | |
1d93a9cb | 98 | return false; |
1da177e4 LT |
99 | } |
100 | } | |
101 | } while (offset < skb->len); | |
102 | ||
103 | switch (chunk_match_type) { | |
104 | case SCTP_CHUNK_MATCH_ALL: | |
d4e2675a | 105 | return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy); |
1da177e4 | 106 | case SCTP_CHUNK_MATCH_ANY: |
1d93a9cb | 107 | return false; |
1da177e4 | 108 | case SCTP_CHUNK_MATCH_ONLY: |
1d93a9cb | 109 | return true; |
1da177e4 LT |
110 | } |
111 | ||
112 | /* This will never be reached, but required to stop compiler whine */ | |
1d93a9cb | 113 | return false; |
1da177e4 LT |
114 | } |
115 | ||
1d93a9cb | 116 | static bool |
62fc8051 | 117 | sctp_mt(const struct sk_buff *skb, struct xt_action_param *par) |
1da177e4 | 118 | { |
f7108a20 | 119 | const struct xt_sctp_info *info = par->matchinfo; |
3cf93c96 JE |
120 | const sctp_sctphdr_t *sh; |
121 | sctp_sctphdr_t _sh; | |
1da177e4 | 122 | |
f7108a20 | 123 | if (par->fragoff != 0) { |
be91fd5e | 124 | pr_debug("Dropping non-first fragment.. FIXME\n"); |
1d93a9cb | 125 | return false; |
1da177e4 | 126 | } |
601e68e1 | 127 | |
f7108a20 | 128 | sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh); |
1da177e4 | 129 | if (sh == NULL) { |
be91fd5e | 130 | pr_debug("Dropping evil TCP offset=0 tinygram.\n"); |
b4ba2611 | 131 | par->hotdrop = true; |
1d93a9cb | 132 | return false; |
601e68e1 | 133 | } |
be91fd5e | 134 | pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest)); |
1da177e4 | 135 | |
7c4e36bc JE |
136 | return SCCHECK(ntohs(sh->source) >= info->spts[0] |
137 | && ntohs(sh->source) <= info->spts[1], | |
601e68e1 | 138 | XT_SCTP_SRC_PORTS, info->flags, info->invflags) |
7c4e36bc JE |
139 | && SCCHECK(ntohs(sh->dest) >= info->dpts[0] |
140 | && ntohs(sh->dest) <= info->dpts[1], | |
2e4e6a17 | 141 | XT_SCTP_DEST_PORTS, info->flags, info->invflags) |
f7108a20 | 142 | && SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t), |
b4ba2611 | 143 | info, &par->hotdrop), |
2e4e6a17 | 144 | XT_SCTP_CHUNK_TYPES, info->flags, info->invflags); |
1da177e4 LT |
145 | } |
146 | ||
b0f38452 | 147 | static int sctp_mt_check(const struct xt_mtchk_param *par) |
2e4e6a17 | 148 | { |
9b4fce7a | 149 | const struct xt_sctp_info *info = par->matchinfo; |
2e4e6a17 | 150 | |
9f567317 | 151 | if (info->flags & ~XT_SCTP_VALID_FLAGS) |
bd414ee6 | 152 | return -EINVAL; |
9f567317 | 153 | if (info->invflags & ~XT_SCTP_VALID_FLAGS) |
bd414ee6 | 154 | return -EINVAL; |
9f567317 | 155 | if (info->invflags & ~info->flags) |
bd414ee6 | 156 | return -EINVAL; |
9f567317 | 157 | if (!(info->flags & XT_SCTP_CHUNK_TYPES)) |
bd414ee6 | 158 | return 0; |
9f567317 JE |
159 | if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL | |
160 | SCTP_CHUNK_MATCH_ANY | SCTP_CHUNK_MATCH_ONLY)) | |
bd414ee6 JE |
161 | return 0; |
162 | return -EINVAL; | |
2e4e6a17 HW |
163 | } |
164 | ||
d3c5ee6d | 165 | static struct xt_match sctp_mt_reg[] __read_mostly = { |
4470bbc7 PM |
166 | { |
167 | .name = "sctp", | |
ee999d8b | 168 | .family = NFPROTO_IPV4, |
d3c5ee6d JE |
169 | .checkentry = sctp_mt_check, |
170 | .match = sctp_mt, | |
4470bbc7 PM |
171 | .matchsize = sizeof(struct xt_sctp_info), |
172 | .proto = IPPROTO_SCTP, | |
173 | .me = THIS_MODULE | |
174 | }, | |
175 | { | |
176 | .name = "sctp", | |
ee999d8b | 177 | .family = NFPROTO_IPV6, |
d3c5ee6d JE |
178 | .checkentry = sctp_mt_check, |
179 | .match = sctp_mt, | |
4470bbc7 PM |
180 | .matchsize = sizeof(struct xt_sctp_info), |
181 | .proto = IPPROTO_SCTP, | |
182 | .me = THIS_MODULE | |
183 | }, | |
5d04bff0 | 184 | }; |
2e4e6a17 | 185 | |
d3c5ee6d | 186 | static int __init sctp_mt_init(void) |
1da177e4 | 187 | { |
d3c5ee6d | 188 | return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg)); |
1da177e4 LT |
189 | } |
190 | ||
d3c5ee6d | 191 | static void __exit sctp_mt_exit(void) |
1da177e4 | 192 | { |
d3c5ee6d | 193 | xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg)); |
1da177e4 LT |
194 | } |
195 | ||
d3c5ee6d JE |
196 | module_init(sctp_mt_init); |
197 | module_exit(sctp_mt_exit); |