1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Connection tracking protocol helper module for SCTP. 4 * 5 * Copyright (c) 2004 Kiran Kumar Immidi <immidi_kiran@yahoo.com> 6 * Copyright (c) 2004-2012 Patrick McHardy <kaber@trash.net> 7 * 8 * SCTP is defined in RFC 2960. References to various sections in this code 9 * are to this RFC. 10 */ 11 12 #include <linux/types.h> 13 #include <linux/timer.h> 14 #include <linux/netfilter.h> 15 #include <linux/in.h> 16 #include <linux/ip.h> 17 #include <linux/sctp.h> 18 #include <linux/string.h> 19 #include <linux/seq_file.h> 20 #include <linux/spinlock.h> 21 #include <linux/interrupt.h> 22 #include <net/sctp/checksum.h> 23 24 #include <net/netfilter/nf_log.h> 25 #include <net/netfilter/nf_conntrack.h> 26 #include <net/netfilter/nf_conntrack_l4proto.h> 27 #include <net/netfilter/nf_conntrack_ecache.h> 28 #include <net/netfilter/nf_conntrack_timeout.h> 29 30 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more 31 closely. They're more complex. --RR 32 33 And so for me for SCTP :D -Kiran */ 34 35 static const char *const sctp_conntrack_names[] = { 36 "NONE", 37 "CLOSED", 38 "COOKIE_WAIT", 39 "COOKIE_ECHOED", 40 "ESTABLISHED", 41 "SHUTDOWN_SENT", 42 "SHUTDOWN_RECD", 43 "SHUTDOWN_ACK_SENT", 44 "HEARTBEAT_SENT", 45 "HEARTBEAT_ACKED", 46 }; 47 48 #define SECS * HZ 49 #define MINS * 60 SECS 50 #define HOURS * 60 MINS 51 #define DAYS * 24 HOURS 52 53 static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = { 54 [SCTP_CONNTRACK_CLOSED] = 10 SECS, 55 [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS, 56 [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS, 57 [SCTP_CONNTRACK_ESTABLISHED] = 5 DAYS, 58 [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000, 59 [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000, 60 [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS, 61 [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS, 62 [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS, 63 }; 64 65 #define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1 66 67 #define sNO SCTP_CONNTRACK_NONE 68 #define sCL SCTP_CONNTRACK_CLOSED 69 #define sCW SCTP_CONNTRACK_COOKIE_WAIT 70 #define sCE SCTP_CONNTRACK_COOKIE_ECHOED 71 #define sES SCTP_CONNTRACK_ESTABLISHED 72 #define sSS SCTP_CONNTRACK_SHUTDOWN_SENT 73 #define sSR SCTP_CONNTRACK_SHUTDOWN_RECD 74 #define sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT 75 #define sHS SCTP_CONNTRACK_HEARTBEAT_SENT 76 #define sHA SCTP_CONNTRACK_HEARTBEAT_ACKED 77 #define sIV SCTP_CONNTRACK_MAX 78 79 /* 80 These are the descriptions of the states: 81 82 NOTE: These state names are tantalizingly similar to the states of an 83 SCTP endpoint. But the interpretation of the states is a little different, 84 considering that these are the states of the connection and not of an end 85 point. Please note the subtleties. -Kiran 86 87 NONE - Nothing so far. 88 COOKIE WAIT - We have seen an INIT chunk in the original direction, or also 89 an INIT_ACK chunk in the reply direction. 90 COOKIE ECHOED - We have seen a COOKIE_ECHO chunk in the original direction. 91 ESTABLISHED - We have seen a COOKIE_ACK in the reply direction. 92 SHUTDOWN_SENT - We have seen a SHUTDOWN chunk in the original direction. 93 SHUTDOWN_RECD - We have seen a SHUTDOWN chunk in the reply directoin. 94 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite 95 to that of the SHUTDOWN chunk. 96 CLOSED - We have seen a SHUTDOWN_COMPLETE chunk in the direction of 97 the SHUTDOWN chunk. Connection is closed. 98 HEARTBEAT_SENT - We have seen a HEARTBEAT in a new flow. 99 HEARTBEAT_ACKED - We have seen a HEARTBEAT-ACK in the direction opposite to 100 that of the HEARTBEAT chunk. Secondary connection is 101 established. 102 */ 103 104 /* TODO 105 - I have assumed that the first INIT is in the original direction. 106 This messes things when an INIT comes in the reply direction in CLOSED 107 state. 108 - Check the error type in the reply dir before transitioning from 109 cookie echoed to closed. 110 - Sec 5.2.4 of RFC 2960 111 - Full Multi Homing support. 112 */ 113 114 /* SCTP conntrack state transitions */ 115 static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = { 116 { 117 /* ORIGINAL */ 118 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */ 119 /* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA}, 120 /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA}, 121 /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL}, 122 /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS}, 123 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA, sSA, sHA}, 124 /* error */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* Can't have Stale cookie*/ 125 /* cookie_echo */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* 5.2.4 - Big TODO */ 126 /* cookie_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},/* Can't come in orig dir */ 127 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL, sCL, sHA}, 128 /* heartbeat */ {sHS, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA}, 129 /* heartbeat_ack*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA} 130 }, 131 { 132 /* REPLY */ 133 /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */ 134 /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* INIT in sCL Big TODO */ 135 /* init_ack */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA}, 136 /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL}, 137 /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR}, 138 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA}, 139 /* error */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA, sIV, sHA}, 140 /* cookie_echo */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* Can't come in reply dir */ 141 /* cookie_ack */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA, sIV, sHA}, 142 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL, sIV, sHA}, 143 /* heartbeat */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA}, 144 /* heartbeat_ack*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHA, sHA} 145 } 146 }; 147 148 #ifdef CONFIG_NF_CONNTRACK_PROCFS 149 /* Print out the private part of the conntrack. */ 150 static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct) 151 { 152 seq_printf(s, "%s ", sctp_conntrack_names[ct->proto.sctp.state]); 153 } 154 #endif 155 156 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \ 157 for ((offset) = (dataoff) + sizeof(struct sctphdr), (count) = 0; \ 158 (offset) < (skb)->len && \ 159 ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))); \ 160 (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++) 161 162 /* Some validity checks to make sure the chunks are fine */ 163 static int do_basic_checks(struct nf_conn *ct, 164 const struct sk_buff *skb, 165 unsigned int dataoff, 166 unsigned long *map) 167 { 168 u_int32_t offset, count; 169 struct sctp_chunkhdr _sch, *sch; 170 int flag; 171 172 flag = 0; 173 174 for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) { 175 pr_debug("Chunk Num: %d Type: %d\n", count, sch->type); 176 177 if (sch->type == SCTP_CID_INIT || 178 sch->type == SCTP_CID_INIT_ACK || 179 sch->type == SCTP_CID_SHUTDOWN_COMPLETE) 180 flag = 1; 181 182 /* 183 * Cookie Ack/Echo chunks not the first OR 184 * Init / Init Ack / Shutdown compl chunks not the only chunks 185 * OR zero-length. 186 */ 187 if (((sch->type == SCTP_CID_COOKIE_ACK || 188 sch->type == SCTP_CID_COOKIE_ECHO || 189 flag) && 190 count != 0) || !sch->length) { 191 pr_debug("Basic checks failed\n"); 192 return 1; 193 } 194 195 if (map) 196 set_bit(sch->type, map); 197 } 198 199 pr_debug("Basic checks passed\n"); 200 return count == 0; 201 } 202 203 static int sctp_new_state(enum ip_conntrack_dir dir, 204 enum sctp_conntrack cur_state, 205 int chunk_type) 206 { 207 int i; 208 209 pr_debug("Chunk type: %d\n", chunk_type); 210 211 switch (chunk_type) { 212 case SCTP_CID_INIT: 213 pr_debug("SCTP_CID_INIT\n"); 214 i = 0; 215 break; 216 case SCTP_CID_INIT_ACK: 217 pr_debug("SCTP_CID_INIT_ACK\n"); 218 i = 1; 219 break; 220 case SCTP_CID_ABORT: 221 pr_debug("SCTP_CID_ABORT\n"); 222 i = 2; 223 break; 224 case SCTP_CID_SHUTDOWN: 225 pr_debug("SCTP_CID_SHUTDOWN\n"); 226 i = 3; 227 break; 228 case SCTP_CID_SHUTDOWN_ACK: 229 pr_debug("SCTP_CID_SHUTDOWN_ACK\n"); 230 i = 4; 231 break; 232 case SCTP_CID_ERROR: 233 pr_debug("SCTP_CID_ERROR\n"); 234 i = 5; 235 break; 236 case SCTP_CID_COOKIE_ECHO: 237 pr_debug("SCTP_CID_COOKIE_ECHO\n"); 238 i = 6; 239 break; 240 case SCTP_CID_COOKIE_ACK: 241 pr_debug("SCTP_CID_COOKIE_ACK\n"); 242 i = 7; 243 break; 244 case SCTP_CID_SHUTDOWN_COMPLETE: 245 pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n"); 246 i = 8; 247 break; 248 case SCTP_CID_HEARTBEAT: 249 pr_debug("SCTP_CID_HEARTBEAT"); 250 i = 9; 251 break; 252 case SCTP_CID_HEARTBEAT_ACK: 253 pr_debug("SCTP_CID_HEARTBEAT_ACK"); 254 i = 10; 255 break; 256 default: 257 /* Other chunks like DATA or SACK do not change the state */ 258 pr_debug("Unknown chunk type, Will stay in %s\n", 259 sctp_conntrack_names[cur_state]); 260 return cur_state; 261 } 262 263 pr_debug("dir: %d cur_state: %s chunk_type: %d new_state: %s\n", 264 dir, sctp_conntrack_names[cur_state], chunk_type, 265 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]); 266 267 return sctp_conntracks[dir][i][cur_state]; 268 } 269 270 /* Don't need lock here: this conntrack not in circulation yet */ 271 static noinline bool 272 sctp_new(struct nf_conn *ct, const struct sk_buff *skb, 273 const struct sctphdr *sh, unsigned int dataoff) 274 { 275 enum sctp_conntrack new_state; 276 const struct sctp_chunkhdr *sch; 277 struct sctp_chunkhdr _sch; 278 u32 offset, count; 279 280 memset(&ct->proto.sctp, 0, sizeof(ct->proto.sctp)); 281 new_state = SCTP_CONNTRACK_MAX; 282 for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) { 283 new_state = sctp_new_state(IP_CT_DIR_ORIGINAL, 284 SCTP_CONNTRACK_NONE, sch->type); 285 286 /* Invalid: delete conntrack */ 287 if (new_state == SCTP_CONNTRACK_NONE || 288 new_state == SCTP_CONNTRACK_MAX) { 289 pr_debug("nf_conntrack_sctp: invalid new deleting.\n"); 290 return false; 291 } 292 293 /* Copy the vtag into the state info */ 294 if (sch->type == SCTP_CID_INIT) { 295 struct sctp_inithdr _inithdr, *ih; 296 /* Sec 8.5.1 (A) */ 297 if (sh->vtag) 298 return false; 299 300 ih = skb_header_pointer(skb, offset + sizeof(_sch), 301 sizeof(_inithdr), &_inithdr); 302 if (!ih) 303 return false; 304 305 pr_debug("Setting vtag %x for new conn\n", 306 ih->init_tag); 307 308 ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = ih->init_tag; 309 } else if (sch->type == SCTP_CID_HEARTBEAT) { 310 pr_debug("Setting vtag %x for secondary conntrack\n", 311 sh->vtag); 312 ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = sh->vtag; 313 } else { 314 /* If it is a shutdown ack OOTB packet, we expect a return 315 shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */ 316 pr_debug("Setting vtag %x for new conn OOTB\n", 317 sh->vtag); 318 ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag; 319 } 320 321 ct->proto.sctp.state = SCTP_CONNTRACK_NONE; 322 } 323 324 return true; 325 } 326 327 static bool sctp_error(struct sk_buff *skb, 328 unsigned int dataoff, 329 const struct nf_hook_state *state) 330 { 331 const struct sctphdr *sh; 332 const char *logmsg; 333 334 if (skb->len < dataoff + sizeof(struct sctphdr)) { 335 logmsg = "nf_ct_sctp: short packet "; 336 goto out_invalid; 337 } 338 if (state->hook == NF_INET_PRE_ROUTING && 339 state->net->ct.sysctl_checksum && 340 skb->ip_summed == CHECKSUM_NONE) { 341 if (skb_ensure_writable(skb, dataoff + sizeof(*sh))) { 342 logmsg = "nf_ct_sctp: failed to read header "; 343 goto out_invalid; 344 } 345 sh = (const struct sctphdr *)(skb->data + dataoff); 346 if (sh->checksum != sctp_compute_cksum(skb, dataoff)) { 347 logmsg = "nf_ct_sctp: bad CRC "; 348 goto out_invalid; 349 } 350 skb->ip_summed = CHECKSUM_UNNECESSARY; 351 } 352 return false; 353 out_invalid: 354 nf_l4proto_log_invalid(skb, state->net, state->pf, IPPROTO_SCTP, "%s", logmsg); 355 return true; 356 } 357 358 /* Returns verdict for packet, or -NF_ACCEPT for invalid. */ 359 int nf_conntrack_sctp_packet(struct nf_conn *ct, 360 struct sk_buff *skb, 361 unsigned int dataoff, 362 enum ip_conntrack_info ctinfo, 363 const struct nf_hook_state *state) 364 { 365 enum sctp_conntrack new_state, old_state; 366 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 367 const struct sctphdr *sh; 368 struct sctphdr _sctph; 369 const struct sctp_chunkhdr *sch; 370 struct sctp_chunkhdr _sch; 371 u_int32_t offset, count; 372 unsigned int *timeouts; 373 unsigned long map[256 / sizeof(unsigned long)] = { 0 }; 374 bool ignore = false; 375 376 if (sctp_error(skb, dataoff, state)) 377 return -NF_ACCEPT; 378 379 sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph); 380 if (sh == NULL) 381 goto out; 382 383 if (do_basic_checks(ct, skb, dataoff, map) != 0) 384 goto out; 385 386 if (!nf_ct_is_confirmed(ct)) { 387 /* If an OOTB packet has any of these chunks discard (Sec 8.4) */ 388 if (test_bit(SCTP_CID_ABORT, map) || 389 test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) || 390 test_bit(SCTP_CID_COOKIE_ACK, map)) 391 return -NF_ACCEPT; 392 393 if (!sctp_new(ct, skb, sh, dataoff)) 394 return -NF_ACCEPT; 395 } 396 397 /* Check the verification tag (Sec 8.5) */ 398 if (!test_bit(SCTP_CID_INIT, map) && 399 !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) && 400 !test_bit(SCTP_CID_COOKIE_ECHO, map) && 401 !test_bit(SCTP_CID_ABORT, map) && 402 !test_bit(SCTP_CID_SHUTDOWN_ACK, map) && 403 !test_bit(SCTP_CID_HEARTBEAT, map) && 404 !test_bit(SCTP_CID_HEARTBEAT_ACK, map) && 405 sh->vtag != ct->proto.sctp.vtag[dir]) { 406 pr_debug("Verification tag check failed\n"); 407 goto out; 408 } 409 410 old_state = new_state = SCTP_CONNTRACK_NONE; 411 spin_lock_bh(&ct->lock); 412 for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) { 413 /* Special cases of Verification tag check (Sec 8.5.1) */ 414 if (sch->type == SCTP_CID_INIT) { 415 /* Sec 8.5.1 (A) */ 416 if (sh->vtag != 0) 417 goto out_unlock; 418 } else if (sch->type == SCTP_CID_ABORT) { 419 /* Sec 8.5.1 (B) */ 420 if (sh->vtag != ct->proto.sctp.vtag[dir] && 421 sh->vtag != ct->proto.sctp.vtag[!dir]) 422 goto out_unlock; 423 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) { 424 /* Sec 8.5.1 (C) */ 425 if (sh->vtag != ct->proto.sctp.vtag[dir] && 426 sh->vtag != ct->proto.sctp.vtag[!dir] && 427 sch->flags & SCTP_CHUNK_FLAG_T) 428 goto out_unlock; 429 } else if (sch->type == SCTP_CID_COOKIE_ECHO) { 430 /* Sec 8.5.1 (D) */ 431 if (sh->vtag != ct->proto.sctp.vtag[dir]) 432 goto out_unlock; 433 } else if (sch->type == SCTP_CID_HEARTBEAT) { 434 if (ct->proto.sctp.vtag[dir] == 0) { 435 pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir); 436 ct->proto.sctp.vtag[dir] = sh->vtag; 437 } else if (sh->vtag != ct->proto.sctp.vtag[dir]) { 438 if (test_bit(SCTP_CID_DATA, map) || ignore) 439 goto out_unlock; 440 441 ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED; 442 ct->proto.sctp.last_dir = dir; 443 ignore = true; 444 continue; 445 } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) { 446 ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED; 447 } 448 } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) { 449 if (ct->proto.sctp.vtag[dir] == 0) { 450 pr_debug("Setting vtag %x for dir %d\n", 451 sh->vtag, dir); 452 ct->proto.sctp.vtag[dir] = sh->vtag; 453 } else if (sh->vtag != ct->proto.sctp.vtag[dir]) { 454 if (test_bit(SCTP_CID_DATA, map) || ignore) 455 goto out_unlock; 456 457 if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 || 458 ct->proto.sctp.last_dir == dir) 459 goto out_unlock; 460 461 ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED; 462 ct->proto.sctp.vtag[dir] = sh->vtag; 463 ct->proto.sctp.vtag[!dir] = 0; 464 } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) { 465 ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED; 466 } 467 } 468 469 old_state = ct->proto.sctp.state; 470 new_state = sctp_new_state(dir, old_state, sch->type); 471 472 /* Invalid */ 473 if (new_state == SCTP_CONNTRACK_MAX) { 474 pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u " 475 "conntrack=%u\n", 476 dir, sch->type, old_state); 477 goto out_unlock; 478 } 479 480 /* If it is an INIT or an INIT ACK note down the vtag */ 481 if (sch->type == SCTP_CID_INIT || 482 sch->type == SCTP_CID_INIT_ACK) { 483 struct sctp_inithdr _inithdr, *ih; 484 485 ih = skb_header_pointer(skb, offset + sizeof(_sch), 486 sizeof(_inithdr), &_inithdr); 487 if (ih == NULL) 488 goto out_unlock; 489 pr_debug("Setting vtag %x for dir %d\n", 490 ih->init_tag, !dir); 491 ct->proto.sctp.vtag[!dir] = ih->init_tag; 492 } 493 494 ct->proto.sctp.state = new_state; 495 if (old_state != new_state) 496 nf_conntrack_event_cache(IPCT_PROTOINFO, ct); 497 } 498 spin_unlock_bh(&ct->lock); 499 500 /* allow but do not refresh timeout */ 501 if (ignore) 502 return NF_ACCEPT; 503 504 timeouts = nf_ct_timeout_lookup(ct); 505 if (!timeouts) 506 timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts; 507 508 nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]); 509 510 if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED && 511 dir == IP_CT_DIR_REPLY && 512 new_state == SCTP_CONNTRACK_ESTABLISHED) { 513 pr_debug("Setting assured bit\n"); 514 set_bit(IPS_ASSURED_BIT, &ct->status); 515 nf_conntrack_event_cache(IPCT_ASSURED, ct); 516 } 517 518 return NF_ACCEPT; 519 520 out_unlock: 521 spin_unlock_bh(&ct->lock); 522 out: 523 return -NF_ACCEPT; 524 } 525 526 static bool sctp_can_early_drop(const struct nf_conn *ct) 527 { 528 switch (ct->proto.sctp.state) { 529 case SCTP_CONNTRACK_SHUTDOWN_SENT: 530 case SCTP_CONNTRACK_SHUTDOWN_RECD: 531 case SCTP_CONNTRACK_SHUTDOWN_ACK_SENT: 532 return true; 533 default: 534 break; 535 } 536 537 return false; 538 } 539 540 #if IS_ENABLED(CONFIG_NF_CT_NETLINK) 541 542 #include <linux/netfilter/nfnetlink.h> 543 #include <linux/netfilter/nfnetlink_conntrack.h> 544 545 static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, 546 struct nf_conn *ct) 547 { 548 struct nlattr *nest_parms; 549 550 spin_lock_bh(&ct->lock); 551 nest_parms = nla_nest_start(skb, CTA_PROTOINFO_SCTP); 552 if (!nest_parms) 553 goto nla_put_failure; 554 555 if (nla_put_u8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state) || 556 nla_put_be32(skb, CTA_PROTOINFO_SCTP_VTAG_ORIGINAL, 557 ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]) || 558 nla_put_be32(skb, CTA_PROTOINFO_SCTP_VTAG_REPLY, 559 ct->proto.sctp.vtag[IP_CT_DIR_REPLY])) 560 goto nla_put_failure; 561 562 spin_unlock_bh(&ct->lock); 563 564 nla_nest_end(skb, nest_parms); 565 566 return 0; 567 568 nla_put_failure: 569 spin_unlock_bh(&ct->lock); 570 return -1; 571 } 572 573 static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = { 574 [CTA_PROTOINFO_SCTP_STATE] = { .type = NLA_U8 }, 575 [CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 }, 576 [CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 }, 577 }; 578 579 #define SCTP_NLATTR_SIZE ( \ 580 NLA_ALIGN(NLA_HDRLEN + 1) + \ 581 NLA_ALIGN(NLA_HDRLEN + 4) + \ 582 NLA_ALIGN(NLA_HDRLEN + 4)) 583 584 static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct) 585 { 586 struct nlattr *attr = cda[CTA_PROTOINFO_SCTP]; 587 struct nlattr *tb[CTA_PROTOINFO_SCTP_MAX+1]; 588 int err; 589 590 /* updates may not contain the internal protocol info, skip parsing */ 591 if (!attr) 592 return 0; 593 594 err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_SCTP_MAX, attr, 595 sctp_nla_policy, NULL); 596 if (err < 0) 597 return err; 598 599 if (!tb[CTA_PROTOINFO_SCTP_STATE] || 600 !tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] || 601 !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]) 602 return -EINVAL; 603 604 spin_lock_bh(&ct->lock); 605 ct->proto.sctp.state = nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]); 606 ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = 607 nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]); 608 ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = 609 nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]); 610 spin_unlock_bh(&ct->lock); 611 612 return 0; 613 } 614 #endif 615 616 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 617 618 #include <linux/netfilter/nfnetlink.h> 619 #include <linux/netfilter/nfnetlink_cttimeout.h> 620 621 static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[], 622 struct net *net, void *data) 623 { 624 unsigned int *timeouts = data; 625 struct nf_sctp_net *sn = nf_sctp_pernet(net); 626 int i; 627 628 if (!timeouts) 629 timeouts = sn->timeouts; 630 631 /* set default SCTP timeouts. */ 632 for (i=0; i<SCTP_CONNTRACK_MAX; i++) 633 timeouts[i] = sn->timeouts[i]; 634 635 /* there's a 1:1 mapping between attributes and protocol states. */ 636 for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) { 637 if (tb[i]) { 638 timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ; 639 } 640 } 641 642 timeouts[CTA_TIMEOUT_SCTP_UNSPEC] = timeouts[CTA_TIMEOUT_SCTP_CLOSED]; 643 return 0; 644 } 645 646 static int 647 sctp_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data) 648 { 649 const unsigned int *timeouts = data; 650 int i; 651 652 for (i=CTA_TIMEOUT_SCTP_UNSPEC+1; i<CTA_TIMEOUT_SCTP_MAX+1; i++) { 653 if (nla_put_be32(skb, i, htonl(timeouts[i] / HZ))) 654 goto nla_put_failure; 655 } 656 return 0; 657 658 nla_put_failure: 659 return -ENOSPC; 660 } 661 662 static const struct nla_policy 663 sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = { 664 [CTA_TIMEOUT_SCTP_CLOSED] = { .type = NLA_U32 }, 665 [CTA_TIMEOUT_SCTP_COOKIE_WAIT] = { .type = NLA_U32 }, 666 [CTA_TIMEOUT_SCTP_COOKIE_ECHOED] = { .type = NLA_U32 }, 667 [CTA_TIMEOUT_SCTP_ESTABLISHED] = { .type = NLA_U32 }, 668 [CTA_TIMEOUT_SCTP_SHUTDOWN_SENT] = { .type = NLA_U32 }, 669 [CTA_TIMEOUT_SCTP_SHUTDOWN_RECD] = { .type = NLA_U32 }, 670 [CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT] = { .type = NLA_U32 }, 671 [CTA_TIMEOUT_SCTP_HEARTBEAT_SENT] = { .type = NLA_U32 }, 672 [CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED] = { .type = NLA_U32 }, 673 }; 674 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ 675 676 void nf_conntrack_sctp_init_net(struct net *net) 677 { 678 struct nf_sctp_net *sn = nf_sctp_pernet(net); 679 int i; 680 681 for (i = 0; i < SCTP_CONNTRACK_MAX; i++) 682 sn->timeouts[i] = sctp_timeouts[i]; 683 684 /* timeouts[0] is unused, init it so ->timeouts[0] contains 685 * 'new' timeout, like udp or icmp. 686 */ 687 sn->timeouts[0] = sctp_timeouts[SCTP_CONNTRACK_CLOSED]; 688 } 689 690 const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp = { 691 .l4proto = IPPROTO_SCTP, 692 #ifdef CONFIG_NF_CONNTRACK_PROCFS 693 .print_conntrack = sctp_print_conntrack, 694 #endif 695 .can_early_drop = sctp_can_early_drop, 696 #if IS_ENABLED(CONFIG_NF_CT_NETLINK) 697 .nlattr_size = SCTP_NLATTR_SIZE, 698 .to_nlattr = sctp_to_nlattr, 699 .from_nlattr = nlattr_to_sctp, 700 .tuple_to_nlattr = nf_ct_port_tuple_to_nlattr, 701 .nlattr_tuple_size = nf_ct_port_nlattr_tuple_size, 702 .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple, 703 .nla_policy = nf_ct_port_nla_policy, 704 #endif 705 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 706 .ctnl_timeout = { 707 .nlattr_to_obj = sctp_timeout_nlattr_to_obj, 708 .obj_to_nlattr = sctp_timeout_obj_to_nlattr, 709 .nlattr_max = CTA_TIMEOUT_SCTP_MAX, 710 .obj_size = sizeof(unsigned int) * SCTP_CONNTRACK_MAX, 711 .nla_policy = sctp_timeout_nla_policy, 712 }, 713 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ 714 }; 715