[net-next-2.6.git] / net / netfilter / xt_sctp.c

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/sctp/sctp.h>
#include <linux/sctp.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_sctp.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kiran Kumar Immidi");
MODULE_DESCRIPTION("Xtables: SCTP protocol packet match");
MODULE_ALIAS("ipt_sctp");
MODULE_ALIAS("ip6t_sctp");

#define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
					      || (!!((invflag) & (option)) ^ (cond)))

static bool
match_flags(const struct xt_sctp_flag_info *flag_info,
	    const int flag_count,
	    u_int8_t chunktype,
	    u_int8_t chunkflags)
{
	int i;

	for (i = 0; i < flag_count; i++)
		if (flag_info[i].chunktype == chunktype)
			return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag;

	return true;
}

static inline bool
match_packet(const struct sk_buff *skb,
	     unsigned int offset,
	     const struct xt_sctp_info *info,
	     bool *hotdrop)
{
	u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)];
	const sctp_chunkhdr_t *sch;
	sctp_chunkhdr_t _sch;
	int chunk_match_type = info->chunk_match_type;
	const struct xt_sctp_flag_info *flag_info = info->flag_info;
	int flag_count = info->flag_count;

#ifdef DEBUG
	int i = 0;
#endif

	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
		SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);

	do {
		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
		if (sch == NULL || sch->length == 0) {
			pr_debug("Dropping invalid SCTP packet.\n");
			*hotdrop = true;
			return false;
		}
#ifdef DEBUG
		pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
			 "\tflags: %x\n",
			 ++i, offset, sch->type, htons(sch->length),
			 sch->flags);
#endif
		offset += WORD_ROUND(ntohs(sch->length));

		pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);

		if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
			switch (chunk_match_type) {
			case SCTP_CHUNK_MATCH_ANY:
				if (match_flags(flag_info, flag_count,
					sch->type, sch->flags)) {
					return true;
				}
				break;

			case SCTP_CHUNK_MATCH_ALL:
				if (match_flags(flag_info, flag_count,
				    sch->type, sch->flags))
					SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type);
				break;

			case SCTP_CHUNK_MATCH_ONLY:
				if (!match_flags(flag_info, flag_count,
				    sch->type, sch->flags))
					return false;
				break;
			}
		} else {
			switch (chunk_match_type) {
			case SCTP_CHUNK_MATCH_ONLY:
				return false;
			}
		}
	} while (offset < skb->len);

	switch (chunk_match_type) {
	case SCTP_CHUNK_MATCH_ALL:
		return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
	case SCTP_CHUNK_MATCH_ANY:
		return false;
	case SCTP_CHUNK_MATCH_ONLY:
		return true;
	}

	/* This will never be reached, but required to stop compiler whine */
	return false;
}

static bool
sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_sctp_info *info = par->matchinfo;
	const sctp_sctphdr_t *sh;
	sctp_sctphdr_t _sh;

	if (par->fragoff != 0) {
		pr_debug("Dropping non-first fragment.. FIXME\n");
		return false;
	}

	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
	if (sh == NULL) {
		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
		par->hotdrop = true;
		return false;
	}
	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));

	return  SCCHECK(ntohs(sh->source) >= info->spts[0]
			&& ntohs(sh->source) <= info->spts[1],
			XT_SCTP_SRC_PORTS, info->flags, info->invflags)
		&& SCCHECK(ntohs(sh->dest) >= info->dpts[0]
			&& ntohs(sh->dest) <= info->dpts[1],
			XT_SCTP_DEST_PORTS, info->flags, info->invflags)
		&& SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t),
					info, &par->hotdrop),
			   XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
}

static int sctp_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_sctp_info *info = par->matchinfo;

	if (info->flags & ~XT_SCTP_VALID_FLAGS)
		return -EINVAL;
	if (info->invflags & ~XT_SCTP_VALID_FLAGS)
		return -EINVAL;
	if (info->invflags & ~info->flags)
		return -EINVAL;
	if (!(info->flags & XT_SCTP_CHUNK_TYPES))
		return 0;
	if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL |
	    SCTP_CHUNK_MATCH_ANY | SCTP_CHUNK_MATCH_ONLY))
		return 0;
	return -EINVAL;
}

static struct xt_match sctp_mt_reg[] __read_mostly = {
	{
		.name		= "sctp",
		.family		= NFPROTO_IPV4,
		.checkentry	= sctp_mt_check,
		.match		= sctp_mt,
		.matchsize	= sizeof(struct xt_sctp_info),
		.proto		= IPPROTO_SCTP,
		.me		= THIS_MODULE
	},
	{
		.name		= "sctp",
		.family		= NFPROTO_IPV6,
		.checkentry	= sctp_mt_check,
		.match		= sctp_mt,
		.matchsize	= sizeof(struct xt_sctp_info),
		.proto		= IPPROTO_SCTP,
		.me		= THIS_MODULE
	},
};

static int __init sctp_mt_init(void)
{
	return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
}

static void __exit sctp_mt_exit(void)
{
	xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
}

module_init(sctp_mt_init);
module_exit(sctp_mt_exit);
Commit	Line	Data
be91fd5e	1	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
1da177e4 LT	2	#include <linux/module.h>
	3	#include <linux/skbuff.h>
	4	#include <net/ip.h>
2e4e6a17	5	#include <net/ipv6.h>
2bf07482	6	#include <net/sctp/sctp.h>
1da177e4 LT	7	#include <linux/sctp.h>
1da177e4 LT	8
2e4e6a17 HW	9	#include <linux/netfilter/x_tables.h>
2e4e6a17 HW	10	#include <linux/netfilter/xt_sctp.h>
1da177e4	11	#include <linux/netfilter_ipv4/ip_tables.h>
2e4e6a17 HW	12	#include <linux/netfilter_ipv6/ip6_tables.h>
	13
	14	MODULE_LICENSE("GPL");
	15	MODULE_AUTHOR("Kiran Kumar Immidi");
2ae15b64	16	MODULE_DESCRIPTION("Xtables: SCTP protocol packet match");
2e4e6a17	17	MODULE_ALIAS("ipt_sctp");
73aaf935	18	MODULE_ALIAS("ip6t_sctp");
1da177e4	19
1da177e4 LT	20	#define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
	21	\|\| (!!((invflag) & (option)) ^ (cond)))
	22
1d93a9cb	23	static bool
2e4e6a17	24	match_flags(const struct xt_sctp_flag_info *flag_info,
1da177e4 LT	25	const int flag_count,
	26	u_int8_t chunktype,
	27	u_int8_t chunkflags)
	28	{
	29	int i;
	30
7c4e36bc JE	31	for (i = 0; i < flag_count; i++)
7c4e36bc JE	32	if (flag_info[i].chunktype == chunktype)
1da177e4	33	return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag;
1da177e4	34
1d93a9cb	35	return true;
1da177e4 LT	36	}
1da177e4 LT	37
1d93a9cb	38	static inline bool
1da177e4	39	match_packet(const struct sk_buff *skb,
2e4e6a17	40	unsigned int offset,
009e8c96	41	const struct xt_sctp_info *info,
cff533ac	42	bool *hotdrop)
1da177e4	43	{
1da177e4	44	u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)];
3cf93c96 JE	45	const sctp_chunkhdr_t *sch;
3cf93c96 JE	46	sctp_chunkhdr_t _sch;
009e8c96 LZ	47	int chunk_match_type = info->chunk_match_type;
	48	const struct xt_sctp_flag_info *flag_info = info->flag_info;
	49	int flag_count = info->flag_count;
1da177e4	50
be91fd5e	51	#ifdef DEBUG
1da177e4 LT	52	int i = 0;
	53	#endif
	54
7c4e36bc	55	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
009e8c96	56	SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);
1da177e4	57
1da177e4 LT	58	do {
1da177e4 LT	59	sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
d3dcd4ef	60	if (sch == NULL \|\| sch->length == 0) {
be91fd5e	61	pr_debug("Dropping invalid SCTP packet.\n");
cff533ac	62	*hotdrop = true;
1d93a9cb	63	return false;
601e68e1	64	}
be91fd5e JE	65	#ifdef DEBUG
	66	pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
	67	"\tflags: %x\n",
	68	++i, offset, sch->type, htons(sch->length),
	69	sch->flags);
	70	#endif
2bf07482	71	offset += WORD_ROUND(ntohs(sch->length));
1da177e4	72
be91fd5e	73	pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);
1da177e4	74
009e8c96	75	if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
1da177e4 LT	76	switch (chunk_match_type) {
1da177e4 LT	77	case SCTP_CHUNK_MATCH_ANY:
601e68e1	78	if (match_flags(flag_info, flag_count,
1da177e4	79	sch->type, sch->flags)) {
1d93a9cb	80	return true;
1da177e4 LT	81	}
	82	break;
	83
	84	case SCTP_CHUNK_MATCH_ALL:
601e68e1	85	if (match_flags(flag_info, flag_count,
7c4e36bc	86	sch->type, sch->flags))
1da177e4	87	SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type);
1da177e4 LT	88	break;
	89
	90	case SCTP_CHUNK_MATCH_ONLY:
601e68e1	91	if (!match_flags(flag_info, flag_count,
7c4e36bc	92	sch->type, sch->flags))
1d93a9cb	93	return false;
1da177e4 LT	94	break;
	95	}
	96	} else {
	97	switch (chunk_match_type) {
	98	case SCTP_CHUNK_MATCH_ONLY:
1d93a9cb	99	return false;
1da177e4 LT	100	}
	101	}
	102	} while (offset < skb->len);
	103
	104	switch (chunk_match_type) {
	105	case SCTP_CHUNK_MATCH_ALL:
d4e2675a	106	return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
1da177e4	107	case SCTP_CHUNK_MATCH_ANY:
1d93a9cb	108	return false;
1da177e4	109	case SCTP_CHUNK_MATCH_ONLY:
1d93a9cb	110	return true;
1da177e4 LT	111	}
	112
	113	/* This will never be reached, but required to stop compiler whine */
1d93a9cb	114	return false;
1da177e4 LT	115	}
1da177e4 LT	116
1d93a9cb	117	static bool
62fc8051	118	sctp_mt(const struct sk_buff skb, struct xt_action_param par)
1da177e4	119	{
f7108a20	120	const struct xt_sctp_info *info = par->matchinfo;
3cf93c96 JE	121	const sctp_sctphdr_t *sh;
3cf93c96 JE	122	sctp_sctphdr_t _sh;
1da177e4	123
f7108a20	124	if (par->fragoff != 0) {
be91fd5e	125	pr_debug("Dropping non-first fragment.. FIXME\n");
1d93a9cb	126	return false;
1da177e4	127	}
601e68e1	128
f7108a20	129	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
1da177e4	130	if (sh == NULL) {
be91fd5e	131	pr_debug("Dropping evil TCP offset=0 tinygram.\n");
b4ba2611	132	par->hotdrop = true;
1d93a9cb	133	return false;
601e68e1	134	}
be91fd5e	135	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
1da177e4	136
7c4e36bc JE	137	return SCCHECK(ntohs(sh->source) >= info->spts[0]
7c4e36bc JE	138	&& ntohs(sh->source) <= info->spts[1],
601e68e1	139	XT_SCTP_SRC_PORTS, info->flags, info->invflags)
7c4e36bc JE	140	&& SCCHECK(ntohs(sh->dest) >= info->dpts[0]
7c4e36bc JE	141	&& ntohs(sh->dest) <= info->dpts[1],
2e4e6a17	142	XT_SCTP_DEST_PORTS, info->flags, info->invflags)
f7108a20	143	&& SCCHECK(match_packet(skb, par->thoff + sizeof(sctp_sctphdr_t),
b4ba2611	144	info, &par->hotdrop),
2e4e6a17	145	XT_SCTP_CHUNK_TYPES, info->flags, info->invflags);
1da177e4 LT	146	}
1da177e4 LT	147
b0f38452	148	static int sctp_mt_check(const struct xt_mtchk_param *par)
2e4e6a17	149	{
9b4fce7a	150	const struct xt_sctp_info *info = par->matchinfo;
2e4e6a17	151
9f567317	152	if (info->flags & ~XT_SCTP_VALID_FLAGS)
bd414ee6	153	return -EINVAL;
9f567317	154	if (info->invflags & ~XT_SCTP_VALID_FLAGS)
bd414ee6	155	return -EINVAL;
9f567317	156	if (info->invflags & ~info->flags)
bd414ee6	157	return -EINVAL;
9f567317	158	if (!(info->flags & XT_SCTP_CHUNK_TYPES))
bd414ee6	159	return 0;
9f567317 JE	160	if (info->chunk_match_type & (SCTP_CHUNK_MATCH_ALL \|
9f567317 JE	161	SCTP_CHUNK_MATCH_ANY \| SCTP_CHUNK_MATCH_ONLY))
bd414ee6 JE	162	return 0;
bd414ee6 JE	163	return -EINVAL;
2e4e6a17 HW	164	}
2e4e6a17 HW	165
d3c5ee6d	166	static struct xt_match sctp_mt_reg[] __read_mostly = {
4470bbc7 PM	167	{
4470bbc7 PM	168	.name = "sctp",
ee999d8b	169	.family = NFPROTO_IPV4,
d3c5ee6d JE	170	.checkentry = sctp_mt_check,
d3c5ee6d JE	171	.match = sctp_mt,
4470bbc7 PM	172	.matchsize = sizeof(struct xt_sctp_info),
	173	.proto = IPPROTO_SCTP,
	174	.me = THIS_MODULE
	175	},
	176	{
	177	.name = "sctp",
ee999d8b	178	.family = NFPROTO_IPV6,
d3c5ee6d JE	179	.checkentry = sctp_mt_check,
d3c5ee6d JE	180	.match = sctp_mt,
4470bbc7 PM	181	.matchsize = sizeof(struct xt_sctp_info),
	182	.proto = IPPROTO_SCTP,
	183	.me = THIS_MODULE
	184	},
5d04bff0	185	};
2e4e6a17	186
d3c5ee6d	187	static int __init sctp_mt_init(void)
1da177e4	188	{
d3c5ee6d	189	return xt_register_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
1da177e4 LT	190	}
1da177e4 LT	191
d3c5ee6d	192	static void __exit sctp_mt_exit(void)
1da177e4	193	{
d3c5ee6d	194	xt_unregister_matches(sctp_mt_reg, ARRAY_SIZE(sctp_mt_reg));
1da177e4 LT	195	}
1da177e4 LT	196
d3c5ee6d JE	197	module_init(sctp_mt_init);
d3c5ee6d JE	198	module_exit(sctp_mt_exit);