]>
Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | #include <linux/module.h> |
2 | #include <linux/skbuff.h> | |
3 | #include <net/ip.h> | |
4 | #include <linux/sctp.h> | |
5 | ||
6 | #include <linux/netfilter_ipv4/ip_tables.h> | |
7 | #include <linux/netfilter_ipv4/ipt_sctp.h> | |
8 | ||
9 | #ifdef DEBUG_SCTP | |
10 | #define duprintf(format, args...) printk(format , ## args) | |
11 | #else | |
12 | #define duprintf(format, args...) | |
13 | #endif | |
14 | ||
15 | #define SCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \ | |
16 | || (!!((invflag) & (option)) ^ (cond))) | |
17 | ||
18 | static int | |
19 | match_flags(const struct ipt_sctp_flag_info *flag_info, | |
20 | const int flag_count, | |
21 | u_int8_t chunktype, | |
22 | u_int8_t chunkflags) | |
23 | { | |
24 | int i; | |
25 | ||
26 | for (i = 0; i < flag_count; i++) { | |
27 | if (flag_info[i].chunktype == chunktype) { | |
28 | return (chunkflags & flag_info[i].flag_mask) == flag_info[i].flag; | |
29 | } | |
30 | } | |
31 | ||
32 | return 1; | |
33 | } | |
34 | ||
35 | static int | |
36 | match_packet(const struct sk_buff *skb, | |
37 | const u_int32_t *chunkmap, | |
38 | int chunk_match_type, | |
39 | const struct ipt_sctp_flag_info *flag_info, | |
40 | const int flag_count, | |
41 | int *hotdrop) | |
42 | { | |
43 | int offset; | |
44 | u_int32_t chunkmapcopy[256 / sizeof (u_int32_t)]; | |
45 | sctp_chunkhdr_t _sch, *sch; | |
46 | ||
47 | #ifdef DEBUG_SCTP | |
48 | int i = 0; | |
49 | #endif | |
50 | ||
51 | if (chunk_match_type == SCTP_CHUNK_MATCH_ALL) { | |
52 | SCTP_CHUNKMAP_COPY(chunkmapcopy, chunkmap); | |
53 | } | |
54 | ||
55 | offset = skb->nh.iph->ihl * 4 + sizeof (sctp_sctphdr_t); | |
56 | do { | |
57 | sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch); | |
58 | if (sch == NULL) { | |
59 | duprintf("Dropping invalid SCTP packet.\n"); | |
60 | *hotdrop = 1; | |
61 | return 0; | |
62 | } | |
63 | ||
64 | duprintf("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d\tflags: %x\n", | |
65 | ++i, offset, sch->type, htons(sch->length), sch->flags); | |
66 | ||
67 | offset += (htons(sch->length) + 3) & ~3; | |
68 | ||
69 | duprintf("skb->len: %d\toffset: %d\n", skb->len, offset); | |
70 | ||
71 | if (SCTP_CHUNKMAP_IS_SET(chunkmap, sch->type)) { | |
72 | switch (chunk_match_type) { | |
73 | case SCTP_CHUNK_MATCH_ANY: | |
74 | if (match_flags(flag_info, flag_count, | |
75 | sch->type, sch->flags)) { | |
76 | return 1; | |
77 | } | |
78 | break; | |
79 | ||
80 | case SCTP_CHUNK_MATCH_ALL: | |
81 | if (match_flags(flag_info, flag_count, | |
82 | sch->type, sch->flags)) { | |
83 | SCTP_CHUNKMAP_CLEAR(chunkmapcopy, sch->type); | |
84 | } | |
85 | break; | |
86 | ||
87 | case SCTP_CHUNK_MATCH_ONLY: | |
88 | if (!match_flags(flag_info, flag_count, | |
89 | sch->type, sch->flags)) { | |
90 | return 0; | |
91 | } | |
92 | break; | |
93 | } | |
94 | } else { | |
95 | switch (chunk_match_type) { | |
96 | case SCTP_CHUNK_MATCH_ONLY: | |
97 | return 0; | |
98 | } | |
99 | } | |
100 | } while (offset < skb->len); | |
101 | ||
102 | switch (chunk_match_type) { | |
103 | case SCTP_CHUNK_MATCH_ALL: | |
104 | return SCTP_CHUNKMAP_IS_CLEAR(chunkmap); | |
105 | case SCTP_CHUNK_MATCH_ANY: | |
106 | return 0; | |
107 | case SCTP_CHUNK_MATCH_ONLY: | |
108 | return 1; | |
109 | } | |
110 | ||
111 | /* This will never be reached, but required to stop compiler whine */ | |
112 | return 0; | |
113 | } | |
114 | ||
115 | static int | |
116 | match(const struct sk_buff *skb, | |
117 | const struct net_device *in, | |
118 | const struct net_device *out, | |
119 | const void *matchinfo, | |
120 | int offset, | |
121 | int *hotdrop) | |
122 | { | |
123 | const struct ipt_sctp_info *info; | |
124 | sctp_sctphdr_t _sh, *sh; | |
125 | ||
126 | info = (const struct ipt_sctp_info *)matchinfo; | |
127 | ||
128 | if (offset) { | |
129 | duprintf("Dropping non-first fragment.. FIXME\n"); | |
130 | return 0; | |
131 | } | |
132 | ||
133 | sh = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_sh), &_sh); | |
134 | if (sh == NULL) { | |
135 | duprintf("Dropping evil TCP offset=0 tinygram.\n"); | |
136 | *hotdrop = 1; | |
137 | return 0; | |
138 | } | |
139 | duprintf("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest)); | |
140 | ||
141 | return SCCHECK(((ntohs(sh->source) >= info->spts[0]) | |
142 | && (ntohs(sh->source) <= info->spts[1])), | |
143 | IPT_SCTP_SRC_PORTS, info->flags, info->invflags) | |
144 | && SCCHECK(((ntohs(sh->dest) >= info->dpts[0]) | |
145 | && (ntohs(sh->dest) <= info->dpts[1])), | |
146 | IPT_SCTP_DEST_PORTS, info->flags, info->invflags) | |
147 | && SCCHECK(match_packet(skb, info->chunkmap, info->chunk_match_type, | |
148 | info->flag_info, info->flag_count, | |
149 | hotdrop), | |
150 | IPT_SCTP_CHUNK_TYPES, info->flags, info->invflags); | |
151 | } | |
152 | ||
153 | static int | |
154 | checkentry(const char *tablename, | |
155 | const struct ipt_ip *ip, | |
156 | void *matchinfo, | |
157 | unsigned int matchsize, | |
158 | unsigned int hook_mask) | |
159 | { | |
160 | const struct ipt_sctp_info *info; | |
161 | ||
162 | info = (const struct ipt_sctp_info *)matchinfo; | |
163 | ||
164 | return ip->proto == IPPROTO_SCTP | |
165 | && !(ip->invflags & IPT_INV_PROTO) | |
166 | && matchsize == IPT_ALIGN(sizeof(struct ipt_sctp_info)) | |
167 | && !(info->flags & ~IPT_SCTP_VALID_FLAGS) | |
168 | && !(info->invflags & ~IPT_SCTP_VALID_FLAGS) | |
169 | && !(info->invflags & ~info->flags) | |
170 | && ((!(info->flags & IPT_SCTP_CHUNK_TYPES)) || | |
171 | (info->chunk_match_type & | |
172 | (SCTP_CHUNK_MATCH_ALL | |
173 | | SCTP_CHUNK_MATCH_ANY | |
174 | | SCTP_CHUNK_MATCH_ONLY))); | |
175 | } | |
176 | ||
177 | static struct ipt_match sctp_match = | |
178 | { | |
179 | .list = { NULL, NULL}, | |
180 | .name = "sctp", | |
181 | .match = &match, | |
182 | .checkentry = &checkentry, | |
183 | .destroy = NULL, | |
184 | .me = THIS_MODULE | |
185 | }; | |
186 | ||
187 | static int __init init(void) | |
188 | { | |
189 | return ipt_register_match(&sctp_match); | |
190 | } | |
191 | ||
192 | static void __exit fini(void) | |
193 | { | |
194 | ipt_unregister_match(&sctp_match); | |
195 | } | |
196 | ||
197 | module_init(init); | |
198 | module_exit(fini); | |
199 | ||
200 | MODULE_LICENSE("GPL"); | |
201 | MODULE_AUTHOR("Kiran Kumar Immidi"); | |
202 | MODULE_DESCRIPTION("Match for SCTP protocol packets"); | |
203 |