~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_sctp.c

Version: ~ [ linux-5.18-rc6 ] ~ [ linux-5.17.6 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.38 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.114 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.192 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.241 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.277 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.312 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  2 #include <linux/module.h>
  3 #include <linux/skbuff.h>
  4 #include <net/ip.h>
  5 #include <net/ipv6.h>
  6 #include <net/sctp/sctp.h>
  7 #include <linux/sctp.h>
  8 
  9 #include <linux/netfilter/x_tables.h>
 10 #include <linux/netfilter/xt_sctp.h>
 11 #include <linux/netfilter_ipv4/ip_tables.h>
 12 #include <linux/netfilter_ipv6/ip6_tables.h>
 13 
 14 MODULE_LICENSE("GPL");
 15 MODULE_AUTHOR("Kiran Kumar Immidi");
 16 MODULE_DESCRIPTION("Xtables: SCTP protocol packet match");
 17 MODULE_ALIAS("ipt_sctp");
 18 MODULE_ALIAS("ip6t_sctp");
 19 
 20 #define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
 21                                               || (!!((invflag) & (option)) ^ (cond)))
 22 
 23 static bool
 24 match_flags(const struct xt_sctp_flag_info *flag_info,
 25             const int flag_count,
 26             u_int8_t chunktype,
 27             u_int8_t chunkflags)
 28 {
 29         int i;
 30 
 31         for (i = 0; i < flag_count; i++)
 32                 if (flag_info[i].chunktype == chunktype)
 33                         return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag;
 34 
 35         return true;
 36 }
 37 
 38 static inline bool
 39 match_packet(const struct sk_buff *skb,
 40              unsigned int offset,
 41              const struct xt_sctp_info *info,
 42              bool *hotdrop)
 43 {
 44         u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)];
 45         const struct sctp_chunkhdr *sch;
 46         struct sctp_chunkhdr _sch;
 47         int chunk_match_type = info->chunk_match_type;
 48         const struct xt_sctp_flag_info *flag_info = info->flag_info;
 49         int flag_count = info->flag_count;
 50 
 51 #ifdef DEBUG
 52         int i = 0;
 53 #endif
 54 
 55         if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
 56                 SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);
 57 
 58         do {
 59                 sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
 60                 if (sch == NULL || sch->length == 0) {
 61                         pr_debug("Dropping invalid SCTP packet.\n");
 62                         *hotdrop = true;
 63                         return false;
 64                 }
 65 #ifdef DEBUG
 66                 pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
 67                          "\tflags: %x\n",
 68                          ++i, offset, sch->type, htons(sch->length),
 69                          sch->flags);
 70 #endif
 71                 offset += SCTP_PAD4(ntohs(sch->length));
 72 
 73                 pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);
 74 
 75                 if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
 76                         switch (chunk_match_type) {
 77                         case SCTP_CHUNK_MATCH_ANY:
 78                                 if (match_flags(flag_info, flag_count,
 79                                         sch->type, sch->flags)) {
 80                                         return true;
 81                                 }
 82                                 break;
 83 
 84                         case SCTP_CHUNK_MATCH_ALL:
 85                                 if (match_flags(flag_info, flag_count,
 86                                     sch->type, sch->flags))
 87                                         SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type);
 88                                 break;
 89 
 90                         case SCTP_CHUNK_MATCH_ONLY:
 91                                 if (!match_flags(flag_info, flag_count,
 92                                     sch->type, sch->flags))
 93                                         return false;
 94                                 break;
 95                         }
 96                 } else {
 97                         switch (chunk_match_type) {
 98                         case SCTP_CHUNK_MATCH_ONLY:
 99                                 return false;
100                         }
101                 }
102         } while (offset < skb->len);
103 
104         switch (chunk_match_type) {
105         case SCTP_CHUNK_MATCH_ALL:
106                 return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
107         case SCTP_CHUNK_MATCH_ANY:
108                 return false;
109         case SCTP_CHUNK_MATCH_ONLY:
110                 return true;
111         }
112 
113         /* This will never be reached, but required to stop compiler whine */
114         return false;
115 }
116 
117 static bool
118 sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)
119 {
120         const struct xt_sctp_info *info = par->matchinfo;
121         const struct sctphdr *sh;
122         struct sctphdr _sh;
123 
124         if (par->fragoff != 0) {
125                 pr_debug("Dropping non-first fragment.. FIXME\n");
126                 return false;
127         }
128 
129         sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
130         if (sh == NULL) {
131                 pr_debug("Dropping evil TCP offset=0 tinygram.\n");
132                 par->hotdrop = true;
133                 return false;
134         }
135         pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
136 
137         return  SCCHECK(ntohs(sh->source) >= info->spts[0]
138                         && ntohs(sh->source) <= info->spts[1],
139                         XT_SCTP_SRC_PORTS, info->flags, info->invflags) &&
140                 SCCHECK(ntohs(sh->dest) >= info->dpts[0]
141                         && ntohs(sh->dest) <= info->dpts[1],
142                         XT_SCTP_DEST_PORTS, info->flags, info->invflags) &&
143                 SCCHECK(match_packet(skb, par->thoff + sizeof(_sh),
144                                      info, &par->hotdrop),
145                         XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
146 }
147 
148 static int sctp_mt_check(const struct xt_mtchk_param *par)
149 {
150         const struct xt_sctp_info *info = par->matchinfo;
151 
152         if (info->flags & ~XT_SCTP_VALID_FLAGS)
153                 return -EINVAL;
154         if (info->invflags & ~XT_SCTP_VALID_FLAGS)
155                 return -EINVAL;
156         if (info->invflags & ~info->flags)
157                 return -EINVAL;
158         if (!(info->flags & XT_SCTP_CHUNK_TYPES))
159                 return 0;
160         if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL |
161             SCTP_CHUNK_MATCH_ANY | SCTP_CHUNK_MATCH_ONLY))
162                 return 0;
163         return -EINVAL;
164 }
165 
166 static struct xt_match sctp_mt_reg[] __read_mostly = {
167         {
168                 .name           = "sctp",
169                 .family         = NFPROTO_IPV4,
170                 .checkentry     = sctp_mt_check,
171                 .match          = sctp_mt,
172                 .matchsize      = sizeof(struct xt_sctp_info),
173                 .proto          = IPPROTO_SCTP,
174                 .me             = THIS_MODULE
175         },
176         {
177                 .name           = "sctp",
178                 .family         = NFPROTO_IPV6,
179                 .checkentry     = sctp_mt_check,
180                 .match          = sctp_mt,
181                 .matchsize      = sizeof(struct xt_sctp_info),
182                 .proto          = IPPROTO_SCTP,
183                 .me             = THIS_MODULE
184         },
185 };
186 
187 static int __init sctp_mt_init(void)
188 {
189         return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
190 }
191 
192 static void __exit sctp_mt_exit(void)
193 {
194         xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
195 }
196 
197 module_init(sctp_mt_init);
198 module_exit(sctp_mt_exit);
199 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp