[net-next-2.6.git] / net / netfilter / xt_sctp.c

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <linux/sctp.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_sctp.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kiran Kumar Immidi");
MODULE_DESCRIPTION("Xtables: SCTP protocol packet match");
MODULE_ALIAS("ipt_sctp");
MODULE_ALIAS("ip6t_sctp");

#define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
					      || (!!((invflag) & (option)) ^ (cond)))

static bool
match_flags(const struct xt_sctp_flag_info *flag_info,
	    const int flag_count,
	    u_int8_t chunktype,
	    u_int8_t chunkflags)
{
	int i;

	for (i = 0; i < flag_count; i++)
		if (flag_info[i].chunktype == chunktype)
			return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag;

	return true;
}

static inline bool
match_packet(const struct sk_buff *skb,
	     unsigned int offset,
	     const struct xt_sctp_info *info,
	     bool *hotdrop)
{
	u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)];
	const sctp_chunkhdr_t *sch;
	sctp_chunkhdr_t _sch;
	int chunk_match_type = info->chunk_match_type;
	const struct xt_sctp_flag_info *flag_info = info->flag_info;
	int flag_count = info->flag_count;

#ifdef DEBUG
	int i = 0;
#endif

	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
		SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);

	do {
		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
		if (sch == NULL || sch->length == 0) {
			pr_debug("Dropping invalid SCTP packet.\n");
			*hotdrop = true;
			return false;
		}
#ifdef DEBUG
		pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
			 "\tflags: %x\n",
			 ++i, offset, sch->type, htons(sch->length),
			 sch->flags);
#endif
		offset += (ntohs(sch->length) + 3) & ~3;

		pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);

		if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
			switch (chunk_match_type) {
			case SCTP_CHUNK_MATCH_ANY:
				if (match_flags(flag_info, flag_count,
					sch->type, sch->flags)) {
					return true;
				}
				break;

			case SCTP_CHUNK_MATCH_ALL:
				if (match_flags(flag_info, flag_count,
				    sch->type, sch->flags))
					SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type);
				break;

			case SCTP_CHUNK_MATCH_ONLY:
				if (!match_flags(flag_info, flag_count,
				    sch->type, sch->flags))
					return false;
				break;
			}
		} else {
			switch (chunk_match_type) {
			case SCTP_CHUNK_MATCH_ONLY:
				return false;
			}
		}
	} while (offset < skb->len);

	switch (chunk_match_type) {
	case SCTP_CHUNK_MATCH_ALL:
		return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
	case SCTP_CHUNK_MATCH_ANY:
		return false;
	case SCTP_CHUNK_MATCH_ONLY:
		return true;
	}

	/* This will never be reached, but required to stop compiler whine */
	return false;
}

static bool
sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_sctp_info *info = par->matchinfo;
	const sctp_sctphdr_t *sh;
	sctp_sctphdr_t _sh;

	if (par->fragoff != 0) {
		pr_debug("Dropping non-first fragment.. FIXME\n");
		return false;
	}

	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
	if (sh == NULL) {
		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
		par->hotdrop = true;
		return false;
	}
	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));

	return  SCCHECK(ntohs(sh->source) >= info->spts[0]
			&& ntohs(sh->source) <= info->spts[1],
			XT_SCTP_SRC_PORTS, info->flags, info->invflags)
		&& SCCHECK(ntohs(sh->dest) >= info->dpts[0]
			&& ntohs(sh->dest) <= info->dpts[1],
			XT_SCTP_DEST_PORTS, info->flags, info->invflags)
		&& SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t),
					info, &par->hotdrop),
			   XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
}

static int sctp_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_sctp_info *info = par->matchinfo;

	if (info->flags & ~XT_SCTP_VALID_FLAGS)
		return -EINVAL;
	if (info->invflags & ~XT_SCTP_VALID_FLAGS)
		return -EINVAL;
	if (info->invflags & ~info->flags)
		return -EINVAL;
	if (!(info->flags & XT_SCTP_CHUNK_TYPES))
		return 0;
	if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL |
	    SCTP_CHUNK_MATCH_ANY | SCTP_CHUNK_MATCH_ONLY))
		return 0;
	return -EINVAL;
}

static struct xt_match sctp_mt_reg[] __read_mostly = {
	{
		.name		= "sctp",
		.family		= NFPROTO_IPV4,
		.checkentry	= sctp_mt_check,
		.match		= sctp_mt,
		.matchsize	= sizeof(struct xt_sctp_info),
		.proto		= IPPROTO_SCTP,
		.me		= THIS_MODULE
	},
	{
		.name		= "sctp",
		.family		= NFPROTO_IPV6,
		.checkentry	= sctp_mt_check,
		.match		= sctp_mt,
		.matchsize	= sizeof(struct xt_sctp_info),
		.proto		= IPPROTO_SCTP,
		.me		= THIS_MODULE
	},
};

static int __init sctp_mt_init(void)
{
	return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
}

static void __exit sctp_mt_exit(void)
{
	xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
}

module_init(sctp_mt_init);
module_exit(sctp_mt_exit);
Commit	Line	Data
	1	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
	2	#include <linux/module.h>
	3	#include <linux/skbuff.h>
	4	#include <net/ip.h>
	5	#include <net/ipv6.h>
	6	#include <linux/sctp.h>
	7
	8	#include <linux/netfilter/x_tables.h>
	9	#include <linux/netfilter/xt_sctp.h>
	10	#include <linux/netfilter_ipv4/ip_tables.h>
	11	#include <linux/netfilter_ipv6/ip6_tables.h>
	12
	13	MODULE_LICENSE("GPL");
	14	MODULE_AUTHOR("Kiran Kumar Immidi");
	15	MODULE_DESCRIPTION("Xtables: SCTP protocol packet match");
	16	MODULE_ALIAS("ipt_sctp");
	17	MODULE_ALIAS("ip6t_sctp");
	18
	19	#define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
	20	\|\| (!!((invflag) & (option)) ^ (cond)))
	21
	22	static bool
	23	match_flags(const struct xt_sctp_flag_info *flag_info,
	24	const int flag_count,
	25	u_int8_t chunktype,
	26	u_int8_t chunkflags)
	27	{
	28	int i;
	29
	30	for (i = 0; i < flag_count; i++)
	31	if (flag_info[i].chunktype == chunktype)
	32	return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag;
	33
	34	return true;
	35	}
	36
	37	static inline bool
	38	match_packet(const struct sk_buff *skb,
	39	unsigned int offset,
	40	const struct xt_sctp_info *info,
	41	bool *hotdrop)
	42	{
	43	u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)];
	44	const sctp_chunkhdr_t *sch;
	45	sctp_chunkhdr_t _sch;
	46	int chunk_match_type = info->chunk_match_type;
	47	const struct xt_sctp_flag_info *flag_info = info->flag_info;
	48	int flag_count = info->flag_count;
	49
	50	#ifdef DEBUG
	51	int i = 0;
	52	#endif
	53
	54	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
	55	SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);
	56
	57	do {
	58	sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
	59	if (sch == NULL \|\| sch->length == 0) {
	60	pr_debug("Dropping invalid SCTP packet.\n");
	61	*hotdrop = true;
	62	return false;
	63	}
	64	#ifdef DEBUG
	65	pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
	66	"\tflags: %x\n",
	67	++i, offset, sch->type, htons(sch->length),
	68	sch->flags);
	69	#endif
	70	offset += (ntohs(sch->length) + 3) & ~3;
	71
	72	pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);
	73
	74	if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
	75	switch (chunk_match_type) {
	76	case SCTP_CHUNK_MATCH_ANY:
	77	if (match_flags(flag_info, flag_count,
	78	sch->type, sch->flags)) {
	79	return true;
	80	}
	81	break;
	82
	83	case SCTP_CHUNK_MATCH_ALL:
	84	if (match_flags(flag_info, flag_count,
	85	sch->type, sch->flags))
	86	SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type);
	87	break;
	88
	89	case SCTP_CHUNK_MATCH_ONLY:
	90	if (!match_flags(flag_info, flag_count,
	91	sch->type, sch->flags))
	92	return false;
	93	break;
	94	}
	95	} else {
	96	switch (chunk_match_type) {
	97	case SCTP_CHUNK_MATCH_ONLY:
	98	return false;
	99	}
	100	}
	101	} while (offset < skb->len);
	102
	103	switch (chunk_match_type) {
	104	case SCTP_CHUNK_MATCH_ALL:
	105	return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
	106	case SCTP_CHUNK_MATCH_ANY:
	107	return false;
	108	case SCTP_CHUNK_MATCH_ONLY:
	109	return true;
	110	}
	111
	112	/* This will never be reached, but required to stop compiler whine */
	113	return false;
	114	}
	115
	116	static bool
	117	sctp_mt(const struct sk_buff skb, struct xt_action_param par)
	118	{
	119	const struct xt_sctp_info *info = par->matchinfo;
	120	const sctp_sctphdr_t *sh;
	121	sctp_sctphdr_t _sh;
	122
	123	if (par->fragoff != 0) {
	124	pr_debug("Dropping non-first fragment.. FIXME\n");
	125	return false;
	126	}
	127
	128	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
	129	if (sh == NULL) {
	130	pr_debug("Dropping evil TCP offset=0 tinygram.\n");
	131	par->hotdrop = true;
	132	return false;
	133	}
	134	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
	135
	136	return SCCHECK(ntohs(sh->source) >= info->spts[0]
	137	&& ntohs(sh->source) <= info->spts[1],
	138	XT_SCTP_SRC_PORTS, info->flags, info->invflags)
	139	&& SCCHECK(ntohs(sh->dest) >= info->dpts[0]
	140	&& ntohs(sh->dest) <= info->dpts[1],
	141	XT_SCTP_DEST_PORTS, info->flags, info->invflags)
	142	&& SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t),
	143	info, &par->hotdrop),
	144	XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
	145	}
	146
	147	static int sctp_mt_check(const struct xt_mtchk_param *par)
	148	{
	149	const struct xt_sctp_info *info = par->matchinfo;
	150
	151	if (info->flags & ~XT_SCTP_VALID_FLAGS)
	152	return -EINVAL;
	153	if (info->invflags & ~XT_SCTP_VALID_FLAGS)
	154	return -EINVAL;
	155	if (info->invflags & ~info->flags)
	156	return -EINVAL;
	157	if (!(info->flags & XT_SCTP_CHUNK_TYPES))
	158	return 0;
	159	if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL \|
	160	SCTP_CHUNK_MATCH_ANY \| SCTP_CHUNK_MATCH_ONLY))
	161	return 0;
	162	return -EINVAL;
	163	}
	164
	165	static struct xt_match sctp_mt_reg[] __read_mostly = {
	166	{
	167	.name = "sctp",
	168	.family = NFPROTO_IPV4,
	169	.checkentry = sctp_mt_check,
	170	.match = sctp_mt,
	171	.matchsize = sizeof(struct xt_sctp_info),
	172	.proto = IPPROTO_SCTP,
	173	.me = THIS_MODULE
	174	},
	175	{
	176	.name = "sctp",
	177	.family = NFPROTO_IPV6,
	178	.checkentry = sctp_mt_check,
	179	.match = sctp_mt,
	180	.matchsize = sizeof(struct xt_sctp_info),
	181	.proto = IPPROTO_SCTP,
	182	.me = THIS_MODULE
	183	},
	184	};
	185
	186	static int __init sctp_mt_init(void)
	187	{
	188	return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
	189	}
	190
	191	static void __exit sctp_mt_exit(void)
	192	{
	193	xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
	194	}
	195
	196	module_init(sctp_mt_init);
	197	module_exit(sctp_mt_exit);