~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_conntrack_proto_sctp.c

Version: ~ [ linux-5.13-rc1 ] ~ [ linux-5.12.2 ] ~ [ linux-5.11.19 ] ~ [ linux-5.10.35 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.117 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.190 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.232 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.268 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.268 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /*
  3  * Connection tracking protocol helper module for SCTP.
  4  *
  5  * Copyright (c) 2004 Kiran Kumar Immidi <immidi_kiran@yahoo.com>
  6  * Copyright (c) 2004-2012 Patrick McHardy <kaber@trash.net>
  7  *
  8  * SCTP is defined in RFC 2960. References to various sections in this code
  9  * are to this RFC.
 10  */
 11 
 12 #include <linux/types.h>
 13 #include <linux/timer.h>
 14 #include <linux/netfilter.h>
 15 #include <linux/in.h>
 16 #include <linux/ip.h>
 17 #include <linux/sctp.h>
 18 #include <linux/string.h>
 19 #include <linux/seq_file.h>
 20 #include <linux/spinlock.h>
 21 #include <linux/interrupt.h>
 22 #include <net/sctp/checksum.h>
 23 
 24 #include <net/netfilter/nf_log.h>
 25 #include <net/netfilter/nf_conntrack.h>
 26 #include <net/netfilter/nf_conntrack_l4proto.h>
 27 #include <net/netfilter/nf_conntrack_ecache.h>
 28 #include <net/netfilter/nf_conntrack_timeout.h>
 29 
 30 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
 31    closely.  They're more complex. --RR
 32 
 33    And so for me for SCTP :D -Kiran */
 34 
 35 static const char *const sctp_conntrack_names[] = {
 36         "NONE",
 37         "CLOSED",
 38         "COOKIE_WAIT",
 39         "COOKIE_ECHOED",
 40         "ESTABLISHED",
 41         "SHUTDOWN_SENT",
 42         "SHUTDOWN_RECD",
 43         "SHUTDOWN_ACK_SENT",
 44         "HEARTBEAT_SENT",
 45         "HEARTBEAT_ACKED",
 46 };
 47 
 48 #define SECS  * HZ
 49 #define MINS  * 60 SECS
 50 #define HOURS * 60 MINS
 51 #define DAYS  * 24 HOURS
 52 
 53 static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
 54         [SCTP_CONNTRACK_CLOSED]                 = 10 SECS,
 55         [SCTP_CONNTRACK_COOKIE_WAIT]            = 3 SECS,
 56         [SCTP_CONNTRACK_COOKIE_ECHOED]          = 3 SECS,
 57         [SCTP_CONNTRACK_ESTABLISHED]            = 5 DAYS,
 58         [SCTP_CONNTRACK_SHUTDOWN_SENT]          = 300 SECS / 1000,
 59         [SCTP_CONNTRACK_SHUTDOWN_RECD]          = 300 SECS / 1000,
 60         [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT]      = 3 SECS,
 61         [SCTP_CONNTRACK_HEARTBEAT_SENT]         = 30 SECS,
 62         [SCTP_CONNTRACK_HEARTBEAT_ACKED]        = 210 SECS,
 63 };
 64 
 65 #define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1
 66 
 67 #define sNO SCTP_CONNTRACK_NONE
 68 #define sCL SCTP_CONNTRACK_CLOSED
 69 #define sCW SCTP_CONNTRACK_COOKIE_WAIT
 70 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED
 71 #define sES SCTP_CONNTRACK_ESTABLISHED
 72 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT
 73 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD
 74 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
 75 #define sHS SCTP_CONNTRACK_HEARTBEAT_SENT
 76 #define sHA SCTP_CONNTRACK_HEARTBEAT_ACKED
 77 #define sIV SCTP_CONNTRACK_MAX
 78 
 79 /*
 80         These are the descriptions of the states:
 81 
 82 NOTE: These state names are tantalizingly similar to the states of an
 83 SCTP endpoint. But the interpretation of the states is a little different,
 84 considering that these are the states of the connection and not of an end
 85 point. Please note the subtleties. -Kiran
 86 
 87 NONE              - Nothing so far.
 88 COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also
 89                     an INIT_ACK chunk in the reply direction.
 90 COOKIE ECHOED     - We have seen a COOKIE_ECHO chunk in the original direction.
 91 ESTABLISHED       - We have seen a COOKIE_ACK in the reply direction.
 92 SHUTDOWN_SENT     - We have seen a SHUTDOWN chunk in the original direction.
 93 SHUTDOWN_RECD     - We have seen a SHUTDOWN chunk in the reply directoin.
 94 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
 95                     to that of the SHUTDOWN chunk.
 96 CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
 97                     the SHUTDOWN chunk. Connection is closed.
 98 HEARTBEAT_SENT    - We have seen a HEARTBEAT in a new flow.
 99 HEARTBEAT_ACKED   - We have seen a HEARTBEAT-ACK in the direction opposite to
100                     that of the HEARTBEAT chunk. Secondary connection is
101                     established.
102 */
103 
104 /* TODO
105  - I have assumed that the first INIT is in the original direction.
106  This messes things when an INIT comes in the reply direction in CLOSED
107  state.
108  - Check the error type in the reply dir before transitioning from
109 cookie echoed to closed.
110  - Sec 5.2.4 of RFC 2960
111  - Full Multi Homing support.
112 */
113 
114 /* SCTP conntrack state transitions */
115 static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
116         {
117 /*      ORIGINAL        */
118 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
119 /* init         */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},
120 /* init_ack     */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},
121 /* abort        */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
122 /* shutdown     */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
123 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA, sSA, sHA},
124 /* error        */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* Can't have Stale cookie*/
125 /* cookie_echo  */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* 5.2.4 - Big TODO */
126 /* cookie_ack   */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* Can't come in orig dir */
127 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL, sCL, sHA},
128 /* heartbeat    */ {sHS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA},
129 /* heartbeat_ack*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA}
130         },
131         {
132 /*      REPLY   */
133 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
134 /* init         */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* INIT in sCL Big TODO */
135 /* init_ack     */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},
136 /* abort        */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL},
137 /* shutdown     */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR},
138 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA},
139 /* error        */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA, sIV, sHA},
140 /* cookie_echo  */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* Can't come in reply dir */
141 /* cookie_ack   */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA, sIV, sHA},
142 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL, sIV, sHA},
143 /* heartbeat    */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA},
144 /* heartbeat_ack*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHA, sHA}
145         }
146 };
147 
148 #ifdef CONFIG_NF_CONNTRACK_PROCFS
149 /* Print out the private part of the conntrack. */
150 static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
151 {
152         seq_printf(s, "%s ", sctp_conntrack_names[ct->proto.sctp.state]);
153 }
154 #endif
155 
156 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count)     \
157 for ((offset) = (dataoff) + sizeof(struct sctphdr), (count) = 0;        \
158         (offset) < (skb)->len &&                                        \
159         ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch)));   \
160         (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++)
161 
162 /* Some validity checks to make sure the chunks are fine */
163 static int do_basic_checks(struct nf_conn *ct,
164                            const struct sk_buff *skb,
165                            unsigned int dataoff,
166                            unsigned long *map)
167 {
168         u_int32_t offset, count;
169         struct sctp_chunkhdr _sch, *sch;
170         int flag;
171 
172         flag = 0;
173 
174         for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
175                 pr_debug("Chunk Num: %d  Type: %d\n", count, sch->type);
176 
177                 if (sch->type == SCTP_CID_INIT ||
178                     sch->type == SCTP_CID_INIT_ACK ||
179                     sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
180                         flag = 1;
181 
182                 /*
183                  * Cookie Ack/Echo chunks not the first OR
184                  * Init / Init Ack / Shutdown compl chunks not the only chunks
185                  * OR zero-length.
186                  */
187                 if (((sch->type == SCTP_CID_COOKIE_ACK ||
188                       sch->type == SCTP_CID_COOKIE_ECHO ||
189                       flag) &&
190                      count != 0) || !sch->length) {
191                         pr_debug("Basic checks failed\n");
192                         return 1;
193                 }
194 
195                 if (map)
196                         set_bit(sch->type, map);
197         }
198 
199         pr_debug("Basic checks passed\n");
200         return count == 0;
201 }
202 
203 static int sctp_new_state(enum ip_conntrack_dir dir,
204                           enum sctp_conntrack cur_state,
205                           int chunk_type)
206 {
207         int i;
208 
209         pr_debug("Chunk type: %d\n", chunk_type);
210 
211         switch (chunk_type) {
212         case SCTP_CID_INIT:
213                 pr_debug("SCTP_CID_INIT\n");
214                 i = 0;
215                 break;
216         case SCTP_CID_INIT_ACK:
217                 pr_debug("SCTP_CID_INIT_ACK\n");
218                 i = 1;
219                 break;
220         case SCTP_CID_ABORT:
221                 pr_debug("SCTP_CID_ABORT\n");
222                 i = 2;
223                 break;
224         case SCTP_CID_SHUTDOWN:
225                 pr_debug("SCTP_CID_SHUTDOWN\n");
226                 i = 3;
227                 break;
228         case SCTP_CID_SHUTDOWN_ACK:
229                 pr_debug("SCTP_CID_SHUTDOWN_ACK\n");
230                 i = 4;
231                 break;
232         case SCTP_CID_ERROR:
233                 pr_debug("SCTP_CID_ERROR\n");
234                 i = 5;
235                 break;
236         case SCTP_CID_COOKIE_ECHO:
237                 pr_debug("SCTP_CID_COOKIE_ECHO\n");
238                 i = 6;
239                 break;
240         case SCTP_CID_COOKIE_ACK:
241                 pr_debug("SCTP_CID_COOKIE_ACK\n");
242                 i = 7;
243                 break;
244         case SCTP_CID_SHUTDOWN_COMPLETE:
245                 pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");
246                 i = 8;
247                 break;
248         case SCTP_CID_HEARTBEAT:
249                 pr_debug("SCTP_CID_HEARTBEAT");
250                 i = 9;
251                 break;
252         case SCTP_CID_HEARTBEAT_ACK:
253                 pr_debug("SCTP_CID_HEARTBEAT_ACK");
254                 i = 10;
255                 break;
256         default:
257                 /* Other chunks like DATA or SACK do not change the state */
258                 pr_debug("Unknown chunk type, Will stay in %s\n",
259                          sctp_conntrack_names[cur_state]);
260                 return cur_state;
261         }
262 
263         pr_debug("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n",
264                  dir, sctp_conntrack_names[cur_state], chunk_type,
265                  sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
266 
267         return sctp_conntracks[dir][i][cur_state];
268 }
269 
270 /* Don't need lock here: this conntrack not in circulation yet */
271 static noinline bool
272 sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
273          const struct sctphdr *sh, unsigned int dataoff)
274 {
275         enum sctp_conntrack new_state;
276         const struct sctp_chunkhdr *sch;
277         struct sctp_chunkhdr _sch;
278         u32 offset, count;
279 
280         memset(&ct->proto.sctp, 0, sizeof(ct->proto.sctp));
281         new_state = SCTP_CONNTRACK_MAX;
282         for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) {
283                 new_state = sctp_new_state(IP_CT_DIR_ORIGINAL,
284                                            SCTP_CONNTRACK_NONE, sch->type);
285 
286                 /* Invalid: delete conntrack */
287                 if (new_state == SCTP_CONNTRACK_NONE ||
288                     new_state == SCTP_CONNTRACK_MAX) {
289                         pr_debug("nf_conntrack_sctp: invalid new deleting.\n");
290                         return false;
291                 }
292 
293                 /* Copy the vtag into the state info */
294                 if (sch->type == SCTP_CID_INIT) {
295                         struct sctp_inithdr _inithdr, *ih;
296                         /* Sec 8.5.1 (A) */
297                         if (sh->vtag)
298                                 return false;
299 
300                         ih = skb_header_pointer(skb, offset + sizeof(_sch),
301                                                 sizeof(_inithdr), &_inithdr);
302                         if (!ih)
303                                 return false;
304 
305                         pr_debug("Setting vtag %x for new conn\n",
306                                  ih->init_tag);
307 
308                         ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = ih->init_tag;
309                 } else if (sch->type == SCTP_CID_HEARTBEAT) {
310                         pr_debug("Setting vtag %x for secondary conntrack\n",
311                                  sh->vtag);
312                         ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = sh->vtag;
313                 } else {
314                 /* If it is a shutdown ack OOTB packet, we expect a return
315                    shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
316                         pr_debug("Setting vtag %x for new conn OOTB\n",
317                                  sh->vtag);
318                         ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
319                 }
320 
321                 ct->proto.sctp.state = SCTP_CONNTRACK_NONE;
322         }
323 
324         return true;
325 }
326 
327 static bool sctp_error(struct sk_buff *skb,
328                        unsigned int dataoff,
329                        const struct nf_hook_state *state)
330 {
331         const struct sctphdr *sh;
332         const char *logmsg;
333 
334         if (skb->len < dataoff + sizeof(struct sctphdr)) {
335                 logmsg = "nf_ct_sctp: short packet ";
336                 goto out_invalid;
337         }
338         if (state->hook == NF_INET_PRE_ROUTING &&
339             state->net->ct.sysctl_checksum &&
340             skb->ip_summed == CHECKSUM_NONE) {
341                 if (skb_ensure_writable(skb, dataoff + sizeof(*sh))) {
342                         logmsg = "nf_ct_sctp: failed to read header ";
343                         goto out_invalid;
344                 }
345                 sh = (const struct sctphdr *)(skb->data + dataoff);
346                 if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
347                         logmsg = "nf_ct_sctp: bad CRC ";
348                         goto out_invalid;
349                 }
350                 skb->ip_summed = CHECKSUM_UNNECESSARY;
351         }
352         return false;
353 out_invalid:
354         nf_l4proto_log_invalid(skb, state->net, state->pf, IPPROTO_SCTP, "%s", logmsg);
355         return true;
356 }
357 
358 /* Returns verdict for packet, or -NF_ACCEPT for invalid. */
359 int nf_conntrack_sctp_packet(struct nf_conn *ct,
360                              struct sk_buff *skb,
361                              unsigned int dataoff,
362                              enum ip_conntrack_info ctinfo,
363                              const struct nf_hook_state *state)
364 {
365         enum sctp_conntrack new_state, old_state;
366         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
367         const struct sctphdr *sh;
368         struct sctphdr _sctph;
369         const struct sctp_chunkhdr *sch;
370         struct sctp_chunkhdr _sch;
371         u_int32_t offset, count;
372         unsigned int *timeouts;
373         unsigned long map[256 / sizeof(unsigned long)] = { 0 };
374         bool ignore = false;
375 
376         if (sctp_error(skb, dataoff, state))
377                 return -NF_ACCEPT;
378 
379         sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
380         if (sh == NULL)
381                 goto out;
382 
383         if (do_basic_checks(ct, skb, dataoff, map) != 0)
384                 goto out;
385 
386         if (!nf_ct_is_confirmed(ct)) {
387                 /* If an OOTB packet has any of these chunks discard (Sec 8.4) */
388                 if (test_bit(SCTP_CID_ABORT, map) ||
389                     test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) ||
390                     test_bit(SCTP_CID_COOKIE_ACK, map))
391                         return -NF_ACCEPT;
392 
393                 if (!sctp_new(ct, skb, sh, dataoff))
394                         return -NF_ACCEPT;
395         }
396 
397         /* Check the verification tag (Sec 8.5) */
398         if (!test_bit(SCTP_CID_INIT, map) &&
399             !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
400             !test_bit(SCTP_CID_COOKIE_ECHO, map) &&
401             !test_bit(SCTP_CID_ABORT, map) &&
402             !test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
403             !test_bit(SCTP_CID_HEARTBEAT, map) &&
404             !test_bit(SCTP_CID_HEARTBEAT_ACK, map) &&
405             sh->vtag != ct->proto.sctp.vtag[dir]) {
406                 pr_debug("Verification tag check failed\n");
407                 goto out;
408         }
409 
410         old_state = new_state = SCTP_CONNTRACK_NONE;
411         spin_lock_bh(&ct->lock);
412         for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
413                 /* Special cases of Verification tag check (Sec 8.5.1) */
414                 if (sch->type == SCTP_CID_INIT) {
415                         /* Sec 8.5.1 (A) */
416                         if (sh->vtag != 0)
417                                 goto out_unlock;
418                 } else if (sch->type == SCTP_CID_ABORT) {
419                         /* Sec 8.5.1 (B) */
420                         if (sh->vtag != ct->proto.sctp.vtag[dir] &&
421                             sh->vtag != ct->proto.sctp.vtag[!dir])
422                                 goto out_unlock;
423                 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
424                         /* Sec 8.5.1 (C) */
425                         if (sh->vtag != ct->proto.sctp.vtag[dir] &&
426                             sh->vtag != ct->proto.sctp.vtag[!dir] &&
427                             sch->flags & SCTP_CHUNK_FLAG_T)
428                                 goto out_unlock;
429                 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
430                         /* Sec 8.5.1 (D) */
431                         if (sh->vtag != ct->proto.sctp.vtag[dir])
432                                 goto out_unlock;
433                 } else if (sch->type == SCTP_CID_HEARTBEAT) {
434                         if (ct->proto.sctp.vtag[dir] == 0) {
435                                 pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
436                                 ct->proto.sctp.vtag[dir] = sh->vtag;
437                         } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
438                                 if (test_bit(SCTP_CID_DATA, map) || ignore)
439                                         goto out_unlock;
440 
441                                 ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
442                                 ct->proto.sctp.last_dir = dir;
443                                 ignore = true;
444                                 continue;
445                         } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
446                                 ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
447                         }
448                 } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) {
449                         if (ct->proto.sctp.vtag[dir] == 0) {
450                                 pr_debug("Setting vtag %x for dir %d\n",
451                                          sh->vtag, dir);
452                                 ct->proto.sctp.vtag[dir] = sh->vtag;
453                         } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
454                                 if (test_bit(SCTP_CID_DATA, map) || ignore)
455                                         goto out_unlock;
456 
457                                 if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 ||
458                                     ct->proto.sctp.last_dir == dir)
459                                         goto out_unlock;
460 
461                                 ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
462                                 ct->proto.sctp.vtag[dir] = sh->vtag;
463                                 ct->proto.sctp.vtag[!dir] = 0;
464                         } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
465                                 ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
466                         }
467                 }
468 
469                 old_state = ct->proto.sctp.state;
470                 new_state = sctp_new_state(dir, old_state, sch->type);
471 
472                 /* Invalid */
473                 if (new_state == SCTP_CONNTRACK_MAX) {
474                         pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "
475                                  "conntrack=%u\n",
476                                  dir, sch->type, old_state);
477                         goto out_unlock;
478                 }
479 
480                 /* If it is an INIT or an INIT ACK note down the vtag */
481                 if (sch->type == SCTP_CID_INIT ||
482                     sch->type == SCTP_CID_INIT_ACK) {
483                         struct sctp_inithdr _inithdr, *ih;
484 
485                         ih = skb_header_pointer(skb, offset + sizeof(_sch),
486                                                 sizeof(_inithdr), &_inithdr);
487                         if (ih == NULL)
488                                 goto out_unlock;
489                         pr_debug("Setting vtag %x for dir %d\n",
490                                  ih->init_tag, !dir);
491                         ct->proto.sctp.vtag[!dir] = ih->init_tag;
492                 }
493 
494                 ct->proto.sctp.state = new_state;
495                 if (old_state != new_state)
496                         nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
497         }
498         spin_unlock_bh(&ct->lock);
499 
500         /* allow but do not refresh timeout */
501         if (ignore)
502                 return NF_ACCEPT;
503 
504         timeouts = nf_ct_timeout_lookup(ct);
505         if (!timeouts)
506                 timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
507 
508         nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
509 
510         if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
511             dir == IP_CT_DIR_REPLY &&
512             new_state == SCTP_CONNTRACK_ESTABLISHED) {
513                 pr_debug("Setting assured bit\n");
514                 set_bit(IPS_ASSURED_BIT, &ct->status);
515                 nf_conntrack_event_cache(IPCT_ASSURED, ct);
516         }
517 
518         return NF_ACCEPT;
519 
520 out_unlock:
521         spin_unlock_bh(&ct->lock);
522 out:
523         return -NF_ACCEPT;
524 }
525 
526 static bool sctp_can_early_drop(const struct nf_conn *ct)
527 {
528         switch (ct->proto.sctp.state) {
529         case SCTP_CONNTRACK_SHUTDOWN_SENT:
530         case SCTP_CONNTRACK_SHUTDOWN_RECD:
531         case SCTP_CONNTRACK_SHUTDOWN_ACK_SENT:
532                 return true;
533         default:
534                 break;
535         }
536 
537         return false;
538 }
539 
540 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
541 
542 #include <linux/netfilter/nfnetlink.h>
543 #include <linux/netfilter/nfnetlink_conntrack.h>
544 
545 static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
546                           struct nf_conn *ct)
547 {
548         struct nlattr *nest_parms;
549 
550         spin_lock_bh(&ct->lock);
551         nest_parms = nla_nest_start(skb, CTA_PROTOINFO_SCTP);
552         if (!nest_parms)
553                 goto nla_put_failure;
554 
555         if (nla_put_u8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state) ||
556             nla_put_be32(skb, CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
557                          ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]) ||
558             nla_put_be32(skb, CTA_PROTOINFO_SCTP_VTAG_REPLY,
559                          ct->proto.sctp.vtag[IP_CT_DIR_REPLY]))
560                 goto nla_put_failure;
561 
562         spin_unlock_bh(&ct->lock);
563 
564         nla_nest_end(skb, nest_parms);
565 
566         return 0;
567 
568 nla_put_failure:
569         spin_unlock_bh(&ct->lock);
570         return -1;
571 }
572 
573 static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
574         [CTA_PROTOINFO_SCTP_STATE]          = { .type = NLA_U8 },
575         [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]  = { .type = NLA_U32 },
576         [CTA_PROTOINFO_SCTP_VTAG_REPLY]     = { .type = NLA_U32 },
577 };
578 
579 #define SCTP_NLATTR_SIZE ( \
580                 NLA_ALIGN(NLA_HDRLEN + 1) + \
581                 NLA_ALIGN(NLA_HDRLEN + 4) + \
582                 NLA_ALIGN(NLA_HDRLEN + 4))
583 
584 static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
585 {
586         struct nlattr *attr = cda[CTA_PROTOINFO_SCTP];
587         struct nlattr *tb[CTA_PROTOINFO_SCTP_MAX+1];
588         int err;
589 
590         /* updates may not contain the internal protocol info, skip parsing */
591         if (!attr)
592                 return 0;
593 
594         err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_SCTP_MAX, attr,
595                                           sctp_nla_policy, NULL);
596         if (err < 0)
597                 return err;
598 
599         if (!tb[CTA_PROTOINFO_SCTP_STATE] ||
600             !tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] ||
601             !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY])
602                 return -EINVAL;
603 
604         spin_lock_bh(&ct->lock);
605         ct->proto.sctp.state = nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]);
606         ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] =
607                 nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]);
608         ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
609                 nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]);
610         spin_unlock_bh(&ct->lock);
611 
612         return 0;
613 }
614 #endif
615 
616 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
617 
618 #include <linux/netfilter/nfnetlink.h>
619 #include <linux/netfilter/nfnetlink_cttimeout.h>
620 
621 static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
622                                       struct net *net, void *data)
623 {
624         unsigned int *timeouts = data;
625         struct nf_sctp_net *sn = nf_sctp_pernet(net);
626         int i;
627 
628         if (!timeouts)
629                 timeouts = sn->timeouts;
630 
631         /* set default SCTP timeouts. */
632         for (i=0; i<SCTP_CONNTRACK_MAX; i++)
633                 timeouts[i] = sn->timeouts[i];
634 
635         /* there's a 1:1 mapping between attributes and protocol states. */
636         for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) {
637                 if (tb[i]) {
638                         timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
639                 }
640         }
641 
642         timeouts[CTA_TIMEOUT_SCTP_UNSPEC] = timeouts[CTA_TIMEOUT_SCTP_CLOSED];
643         return 0;
644 }
645 
646 static int
647 sctp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
648 {
649         const unsigned int *timeouts = data;
650         int i;
651 
652         for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) {
653                 if (nla_put_be32(skb, i, htonl(timeouts[i] / HZ)))
654                         goto nla_put_failure;
655         }
656         return 0;
657 
658 nla_put_failure:
659         return -ENOSPC;
660 }
661 
662 static const struct nla_policy
663 sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
664         [CTA_TIMEOUT_SCTP_CLOSED]               = { .type = NLA_U32 },
665         [CTA_TIMEOUT_SCTP_COOKIE_WAIT]          = { .type = NLA_U32 },
666         [CTA_TIMEOUT_SCTP_COOKIE_ECHOED]        = { .type = NLA_U32 },
667         [CTA_TIMEOUT_SCTP_ESTABLISHED]          = { .type = NLA_U32 },
668         [CTA_TIMEOUT_SCTP_SHUTDOWN_SENT]        = { .type = NLA_U32 },
669         [CTA_TIMEOUT_SCTP_SHUTDOWN_RECD]        = { .type = NLA_U32 },
670         [CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT]    = { .type = NLA_U32 },
671         [CTA_TIMEOUT_SCTP_HEARTBEAT_SENT]       = { .type = NLA_U32 },
672         [CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED]      = { .type = NLA_U32 },
673 };
674 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
675 
676 void nf_conntrack_sctp_init_net(struct net *net)
677 {
678         struct nf_sctp_net *sn = nf_sctp_pernet(net);
679         int i;
680 
681         for (i = 0; i < SCTP_CONNTRACK_MAX; i++)
682                 sn->timeouts[i] = sctp_timeouts[i];
683 
684         /* timeouts[0] is unused, init it so ->timeouts[0] contains
685          * 'new' timeout, like udp or icmp.
686          */
687         sn->timeouts[0] = sctp_timeouts[SCTP_CONNTRACK_CLOSED];
688 }
689 
690 const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp = {
691         .l4proto                = IPPROTO_SCTP,
692 #ifdef CONFIG_NF_CONNTRACK_PROCFS
693         .print_conntrack        = sctp_print_conntrack,
694 #endif
695         .can_early_drop         = sctp_can_early_drop,
696 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
697         .nlattr_size            = SCTP_NLATTR_SIZE,
698         .to_nlattr              = sctp_to_nlattr,
699         .from_nlattr            = nlattr_to_sctp,
700         .tuple_to_nlattr        = nf_ct_port_tuple_to_nlattr,
701         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
702         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
703         .nla_policy             = nf_ct_port_nla_policy,
704 #endif
705 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
706         .ctnl_timeout           = {
707                 .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
708                 .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
709                 .nlattr_max     = CTA_TIMEOUT_SCTP_MAX,
710                 .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
711                 .nla_policy     = sctp_timeout_nla_policy,
712         },
713 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
714 };
715 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp