Commit 8dcfc9e3 authored by Rusty Russell's avatar Rusty Russell Committed by David S. Miller

[NETFILTER]: Linearize iptables matches.

Adjusts the IPTables matches to handle non-linear packets.
Untested: ipt_ah and ipt_esp.
parent 4b5fb65e
......@@ -35,14 +35,16 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ahhdr *ah = hdr;
struct ahhdr ah;
const struct ipt_ah *ahinfo = matchinfo;
if (offset == 0 && datalen < sizeof(struct ahhdr)) {
/* Must not be a fragment. */
if (offset)
return 0;
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &ah, sizeof(ah)) < 0) {
/* We've been asked to examine this packet, and we
can't. Hence, no choice but to drop. */
duprintf("Dropping evil AH tinygram.\n");
......@@ -50,10 +52,8 @@ match(const struct sk_buff *skb,
return 0;
}
/* Must not be a fragment. */
return !offset
&& spi_match(ahinfo->spis[0], ahinfo->spis[1],
ntohl(ah->spi),
return spi_match(ahinfo->spis[0], ahinfo->spis[1],
ntohl(ah.spi),
!!(ahinfo->invflags & IPT_AH_INV_SPI));
}
......
......@@ -14,8 +14,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_conntrack_info *sinfo = matchinfo;
......
......@@ -19,8 +19,7 @@ MODULE_LICENSE("GPL");
static int match(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *matchinfo,
int offset, const void *hdr, u_int16_t datalen,
int *hotdrop)
int offset, int *hotdrop)
{
const struct ipt_dscp_info *info = matchinfo;
const struct iphdr *iph = skb->nh.iph;
......
......@@ -19,34 +19,40 @@ MODULE_DESCRIPTION("IP tables ECN matching module");
MODULE_LICENSE("GPL");
static inline int match_ip(const struct sk_buff *skb,
const struct iphdr *iph,
const struct ipt_ecn_info *einfo)
{
return ((iph->tos&IPT_ECN_IP_MASK) == einfo->ip_ect);
return ((skb->nh.iph->tos&IPT_ECN_IP_MASK) == einfo->ip_ect);
}
static inline int match_tcp(const struct sk_buff *skb,
const struct iphdr *iph,
const struct ipt_ecn_info *einfo)
const struct ipt_ecn_info *einfo,
int *hotdrop)
{
struct tcphdr *tcph = (void *)iph + iph->ihl*4;
struct tcphdr tcph;
/* In practice, TCP match does this, so can't fail. But let's
be good citizens. */
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0) {
*hotdrop = 0;
return 0;
}
if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
if (tcph->ece == 1)
if (tcph.ece == 1)
return 0;
} else {
if (tcph->ece == 0)
if (tcph.ece == 0)
return 0;
}
}
if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
if (tcph->cwr == 1)
if (tcph.cwr == 1)
return 0;
} else {
if (tcph->cwr == 0)
if (tcph.cwr == 0)
return 0;
}
}
......@@ -56,20 +62,18 @@ static inline int match_tcp(const struct sk_buff *skb,
static int match(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *matchinfo,
int offset, const void *hdr, u_int16_t datalen,
int *hotdrop)
int offset, int *hotdrop)
{
const struct ipt_ecn_info *info = matchinfo;
const struct iphdr *iph = skb->nh.iph;
if (info->operation & IPT_ECN_OP_MATCH_IP)
if (!match_ip(skb, iph, info))
if (!match_ip(skb, info))
return 0;
if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
if (iph->protocol != IPPROTO_TCP)
if (skb->nh.iph->protocol != IPPROTO_TCP)
return 0;
if (!match_tcp(skb, iph, info))
if (!match_tcp(skb, info, hotdrop))
return 0;
}
......
......@@ -35,14 +35,16 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct esphdr *esp = hdr;
struct esphdr esp;
const struct ipt_esp *espinfo = matchinfo;
if (offset == 0 && datalen < sizeof(struct esphdr)) {
/* Must not be a fragment. */
if (offset)
return 0;
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &esp, sizeof(esp)) < 0) {
/* We've been asked to examine this packet, and we
can't. Hence, no choice but to drop. */
duprintf("Dropping evil ESP tinygram.\n");
......@@ -50,10 +52,8 @@ match(const struct sk_buff *skb,
return 0;
}
/* Must not be a fragment. */
return !offset
&& spi_match(espinfo->spis[0], espinfo->spis[1],
ntohl(esp->spi),
return spi_match(espinfo->spis[0], espinfo->spis[1],
ntohl(esp.spi),
!!(espinfo->invflags & IPT_ESP_INV_SPI));
}
......
......@@ -28,8 +28,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_helper_info *info = matchinfo;
......
......@@ -15,8 +15,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_length_info *info = matchinfo;
......
......@@ -47,8 +47,6 @@ ipt_limit_match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
struct ipt_rateinfo *r = ((struct ipt_rateinfo *)matchinfo)->master;
......
......@@ -12,8 +12,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_mac_info *info = matchinfo;
......
......@@ -11,8 +11,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_mark_info *info = matchinfo;
......
......@@ -39,15 +39,18 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct udphdr *udp = hdr;
u16 ports[2];
const struct ipt_multiport *multiinfo = matchinfo;
/* Must be big enough to read ports. */
if (offset == 0 && datalen < sizeof(struct udphdr)) {
/* Must not be a fragment. */
if (offset)
return 0;
/* Must be big enough to read ports (both UDP and TCP have
them at the start). */
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, ports, sizeof(ports)) < 0) {
/* We've been asked to examine this packet, and we
can't. Hence, no choice but to drop. */
duprintf("ipt_multiport:"
......@@ -56,11 +59,9 @@ match(const struct sk_buff *skb,
return 0;
}
/* Must not be a fragment. */
return !offset
&& ports_match(multiinfo->ports,
return ports_match(multiinfo->ports,
multiinfo->flags, multiinfo->count,
ntohs(udp->source), ntohs(udp->dest));
ntohs(ports[0]), ntohs(ports[1]));
}
/* Called when user tries to insert an entry of this type. */
......
......@@ -115,8 +115,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_owner_info *info = matchinfo;
......@@ -170,8 +168,11 @@ checkentry(const char *tablename,
return 0;
}
if (matchsize != IPT_ALIGN(sizeof(struct ipt_owner_info)))
if (matchsize != IPT_ALIGN(sizeof(struct ipt_owner_info))) {
printk("Matchsize %u != %u\n", matchsize,
IPT_ALIGN(sizeof(struct ipt_owner_info)));
return 0;
}
return 1;
}
......
......@@ -13,8 +13,6 @@ static int match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_pkttype_info *info = matchinfo;
......
......@@ -13,8 +13,6 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_state_info *sinfo = matchinfo;
......
......@@ -11,24 +11,32 @@
/* Returns 1 if the mss option is set and matched by the range, 0 otherwise */
static inline int
mssoption_match(u_int16_t min, u_int16_t max,
const struct tcphdr *tcp,
u_int16_t datalen,
const struct sk_buff *skb,
int invert,
int *hotdrop)
{
unsigned int i;
const u_int8_t *opt = (u_int8_t *)tcp;
struct tcphdr tcph;
/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
u8 opt[15 * 4 - sizeof(tcph)];
unsigned int i, optlen;
/* If we don't have the whole header, drop packet. */
if (tcp->doff * 4 > datalen) {
*hotdrop = 1;
return 0;
}
for (i = sizeof(struct tcphdr); i < tcp->doff * 4; ) {
if ((opt[i] == TCPOPT_MSS)
&& ((tcp->doff * 4 - i) >= TCPOLEN_MSS)
&& (opt[i+1] == TCPOLEN_MSS)) {
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0)
goto dropit;
/* Malformed. */
if (tcph.doff*4 < sizeof(tcph))
goto dropit;
optlen = tcph.doff*4 - sizeof(tcph);
/* Truncated options. */
if (skb_copy_bits(skb, skb->nh.iph->ihl*4+sizeof(tcph), opt, optlen)<0)
goto dropit;
for (i = 0; i < optlen; ) {
if (opt[i] == TCPOPT_MSS
&& (optlen - i) >= TCPOLEN_MSS
&& opt[i+1] == TCPOLEN_MSS) {
u_int16_t mssval;
mssval = (opt[i+2] << 8) | opt[i+3];
......@@ -38,8 +46,11 @@ mssoption_match(u_int16_t min, u_int16_t max,
if (opt[i] < 2) i++;
else i += opt[i+1]?:1;
}
return invert;
dropit:
*hotdrop = 1;
return 0;
}
static int
......@@ -48,15 +59,11 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_tcpmss_match_info *info = matchinfo;
const struct tcphdr *tcph = (void *)skb->nh.iph + skb->nh.iph->ihl*4;
return mssoption_match(info->mss_min, info->mss_max, tcph,
skb->len - skb->nh.iph->ihl*4,
return mssoption_match(info->mss_min, info->mss_max, skb,
info->invert, hotdrop);
}
......
......@@ -11,14 +11,11 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_tos_info *info = matchinfo;
const struct iphdr *iph = skb->nh.iph;
return (iph->tos == info->tos) ^ info->invert;
return (skb->nh.iph->tos == info->tos) ^ info->invert;
}
static int
......
......@@ -19,24 +19,22 @@ MODULE_LICENSE("GPL");
static int match(const struct sk_buff *skb, const struct net_device *in,
const struct net_device *out, const void *matchinfo,
int offset, const void *hdr, u_int16_t datalen,
int *hotdrop)
int offset, int *hotdrop)
{
const struct ipt_ttl_info *info = matchinfo;
const struct iphdr *iph = skb->nh.iph;
switch (info->mode) {
case IPT_TTL_EQ:
return (iph->ttl == info->ttl);
return (skb->nh.iph->ttl == info->ttl);
break;
case IPT_TTL_NE:
return (!(iph->ttl == info->ttl));
return (!(skb->nh.iph->ttl == info->ttl));
break;
case IPT_TTL_LT:
return (iph->ttl < info->ttl);
return (skb->nh.iph->ttl < info->ttl);
break;
case IPT_TTL_GT:
return (iph->ttl > info->ttl);
return (skb->nh.iph->ttl > info->ttl);
break;
default:
printk(KERN_WARNING "ipt_ttl: unknown mode %d\n",
......
......@@ -31,16 +31,17 @@ struct icmp_info
};
static int
check_ip(struct iphdr *iph, size_t length, int embedded);
check_ip(const struct sk_buff *skb, unsigned int offset);
/* ICMP-specific checks. */
static int
check_icmp(const struct icmphdr *icmph,
u_int16_t datalen,
check_icmp(const struct sk_buff *skb,
unsigned int offset,
unsigned int fragoff,
int more_frags,
int embedded)
{
struct icmphdr icmph;
static struct icmp_info info[]
= { [ICMP_ECHOREPLY]
= { 8, 65536, ICMP_NOT_ERROR, 0, 0 },
......@@ -76,92 +77,95 @@ check_icmp(const struct icmphdr *icmph,
= { 12, 12, ICMP_NOT_ERROR, 0, 0 } };
/* Can't do anything if it's a fragment. */
if (offset)
if (fragoff)
return 1;
/* Must cover type and code. */
if (datalen < 2) {
limpk("ICMP len=%u too short\n", datalen);
/* CHECK: Must have whole header.. */
if (skb_copy_bits(skb, offset, &icmph, sizeof(icmph)) < 0) {
limpk("ICMP len=%u too short\n", skb->len - offset);
return 0;
}
/* If not embedded. */
/* If not embedded in an ICMP error already. */
if (!embedded) {
/* Bad checksum? Don't print, just ignore. */
if (!more_frags
&& ip_compute_csum((unsigned char *) icmph, datalen) != 0)
return 0;
/* CHECK: Truncated ICMP (even if first fragment). */
if (icmph->type < sizeof(info)/sizeof(struct icmp_info)
&& info[icmph->type].min_len != 0
&& datalen < info[icmph->type].min_len) {
if (icmph.type < sizeof(info)/sizeof(struct icmp_info)
&& info[icmph.type].min_len != 0
&& skb->len - offset < info[icmph.type].min_len) {
limpk("ICMP type %u len %u too short\n",
icmph->type, datalen);
icmph.type, skb->len - offset);
return 0;
}
/* CHECK: Check within known error ICMPs. */
if (icmph->type < sizeof(info)/sizeof(struct icmp_info)
&& info[icmph->type].err == ICMP_IS_ERROR) {
if (icmph.type < sizeof(info)/sizeof(struct icmp_info)
&& info[icmph.type].err == ICMP_IS_ERROR) {
/* Max IP header size = 60 */
char inner[60 + 8];
struct iphdr *inner_ip = (struct iphdr *)inner;
/* CHECK: Embedded packet must be at least
length of iph + 8 bytes. */
struct iphdr *inner = (void *)icmph + 8;
/* datalen > 8 since all ICMP_IS_ERROR types
have min length > 8 */
if (datalen - 8 < sizeof(struct iphdr)) {
if (skb_copy_bits(skb, offset + sizeof(icmph),
inner, sizeof(struct iphdr)+8) < 0) {
limpk("ICMP error internal way too short\n");
return 0;
}
if (datalen - 8 < inner->ihl*4 + 8) {
/* iphhdr may actually be longer: still need 8
actual protocol bytes. */
if (offset + sizeof(icmph) + inner_ip->ihl*4 + 8
> skb->len) {
limpk("ICMP error internal too short\n");
return 0;
}
if (!check_ip(inner, datalen - 8, 1))
if (!check_ip(skb, offset + sizeof(icmph)))
return 0;
}
} else {
/* CHECK: Can't embed ICMP unless known non-error. */
if (icmph->type >= sizeof(info)/sizeof(struct icmp_info)
|| info[icmph->type].err != ICMP_NOT_ERROR) {
if (icmph.type >= sizeof(info)/sizeof(struct icmp_info)
|| info[icmph.type].err != ICMP_NOT_ERROR) {
limpk("ICMP type %u not embeddable\n",
icmph->type);
icmph.type);
return 0;
}
}
/* CHECK: Invalid ICMP codes. */
if (icmph->type < sizeof(info)/sizeof(struct icmp_info)
&& (icmph->code < info[icmph->type].min_code
|| icmph->code > info[icmph->type].max_code)) {
if (icmph.type < sizeof(info)/sizeof(struct icmp_info)
&& (icmph.code < info[icmph.type].min_code
|| icmph.code > info[icmph.type].max_code)) {
limpk("ICMP type=%u code=%u\n",
icmph->type, icmph->code);
icmph.type, icmph.code);
return 0;
}
/* CHECK: Above maximum length. */
if (icmph->type < sizeof(info)/sizeof(struct icmp_info)
&& info[icmph->type].max_len != 0
&& datalen > info[icmph->type].max_len) {
if (icmph.type < sizeof(info)/sizeof(struct icmp_info)
&& info[icmph.type].max_len != 0
&& skb->len - offset > info[icmph.type].max_len) {
limpk("ICMP type=%u too long: %u bytes\n",
icmph->type, datalen);
icmph.type, skb->len - offset);
return 0;
}
switch (icmph->type) {
switch (icmph.type) {
case ICMP_PARAMETERPROB: {
/* CHECK: Problem param must be within error packet's
* IP header. */
struct iphdr *iph = (void *)icmph + 8;
u_int32_t arg = ntohl(icmph->un.gateway);
u_int32_t arg = ntohl(icmph.un.gateway);
if (icmph->code == 0) {
if (icmph.code == 0) {
/* We've already made sure it's long enough. */
struct iphdr iph;
skb_copy_bits(skb, offset + sizeof(icmph), &iph,
sizeof(iph));
/* Code 0 means that upper 8 bits is pointer
to problem. */
if ((arg >> 24) >= iph->ihl*4) {
if ((arg >> 24) >= iph.ihl*4) {
limpk("ICMP PARAMETERPROB ptr = %u\n",
ntohl(icmph->un.gateway) >> 24);
ntohl(icmph.un.gateway) >> 24);
return 0;
}
arg &= 0x00FFFFFF;
......@@ -179,9 +183,9 @@ check_icmp(const struct icmphdr *icmph,
case ICMP_TIME_EXCEEDED:
case ICMP_SOURCE_QUENCH:
/* CHECK: Unused must be zero. */
if (icmph->un.gateway != 0) {
if (icmph.un.gateway != 0) {
limpk("ICMP type=%u unused = %u\n",
icmph->type, ntohl(icmph->un.gateway));
icmph.type, ntohl(icmph.un.gateway));
return 0;
}
break;
......@@ -192,32 +196,26 @@ check_icmp(const struct icmphdr *icmph,
/* UDP-specific checks. */
static int
check_udp(const struct iphdr *iph,
const struct udphdr *udph,
u_int16_t datalen,
check_udp(const struct sk_buff *skb,
unsigned int offset,
unsigned int fragoff,
int more_frags,
int embedded)
{
struct udphdr udph;
/* Can't do anything if it's a fragment. */
if (offset)
if (fragoff)
return 1;
/* CHECK: Must cover UDP header. */
if (datalen < sizeof(struct udphdr)) {
limpk("UDP len=%u too short\n", datalen);
if (skb_copy_bits(skb, offset, &udph, sizeof(udph)) < 0) {
limpk("UDP len=%u too short\n", skb->len - offset);
return 0;
}
/* Bad checksum? Don't print, just say it's unclean. */
/* FIXME: SRC ROUTE packets won't match checksum --RR */
if (!more_frags && !embedded && udph->check
&& csum_tcpudp_magic(iph->saddr, iph->daddr, datalen, IPPROTO_UDP,
csum_partial((char *)udph, datalen, 0)) != 0)
return 0;
/* CHECK: Destination port can't be zero. */
if (!udph->dest) {
if (!udph.dest) {
limpk("UDP zero destination port\n");
return 0;
}
......@@ -225,24 +223,24 @@ check_udp(const struct iphdr *iph,
if (!more_frags) {
if (!embedded) {
/* CHECK: UDP length must match. */
if (ntohs(udph->len) != datalen) {
if (ntohs(udph.len) != skb->len - offset) {
limpk("UDP len too short %u vs %u\n",
ntohs(udph->len), datalen);
ntohs(udph.len), skb->len - offset);
return 0;
}
} else {
/* CHECK: UDP length be >= this truncated pkt. */
if (ntohs(udph->len) < datalen) {
if (ntohs(udph.len) < skb->len - offset) {
limpk("UDP len too long %u vs %u\n",
ntohs(udph->len), datalen);
ntohs(udph.len), skb->len - offset);
return 0;
}
}
} else {
/* CHECK: UDP length must be > this frag's length. */
if (ntohs(udph->len) <= datalen) {
if (ntohs(udph.len) <= skb->len - offset) {
limpk("UDP fragment len too short %u vs %u\n",
ntohs(udph->len), datalen);
ntohs(udph.len), skb->len - offset);
return 0;
}
}
......@@ -250,104 +248,104 @@ check_udp(const struct iphdr *iph,
return 1;
}
#define TH_FIN 0x01
#define TH_SYN 0x02
#define TH_RST 0x04
#define TH_PUSH 0x08
#define TH_ACK 0x10
#define TH_URG 0x20
#define TH_ECE 0x40
#define TH_CWR 0x80
/* TCP-specific checks. */
static int
check_tcp(const struct iphdr *iph,
const struct tcphdr *tcph,
u_int16_t datalen,
check_tcp(const struct sk_buff *skb,
unsigned int offset,
unsigned int fragoff,
int more_frags,
int embedded)
{
u_int8_t *opt = (u_int8_t *)tcph;
u_int8_t *endhdr = (u_int8_t *)tcph + tcph->doff * 4;
u_int8_t tcpflags;
struct tcphdr tcph;
unsigned char opt[15 * 4 - sizeof(struct tcphdr)];
u32 tcpflags;
int end_of_options = 0;
size_t i;
unsigned int i, optlen;
/* CHECK: Can't have offset=1: used to override TCP syn-checks. */
/* In fact, this is caught below (offset < 516). */
/* Can't do anything if it's a fragment. */
if (offset)
if (fragoff)
return 1;
/* CHECK: Smaller than minimal TCP hdr. */
if (datalen < sizeof(struct tcphdr)) {
if (skb_copy_bits(skb, offset, &tcph, sizeof(tcph)) < 0) {
u16 ports[2];
if (!embedded) {
limpk("Packet length %u < TCP header.\n", datalen);
limpk("Packet length %u < TCP header.\n",
skb->len - offset);
return 0;
}
/* Must have ports available (datalen >= 8), from
check_icmp which set embedded = 1 */
/* CHECK: TCP ports inside ICMP error */
if (!tcph->source || !tcph->dest) {
skb_copy_bits(skb, offset, ports, sizeof(ports));
if (!ports[0] || !ports[1]) {
limpk("Zero TCP ports %u/%u.\n",
htons(tcph->source), htons(tcph->dest));
htons(ports[0]), htons(ports[1]));
return 0;
}
return 1;
}
/* CHECK: Smaller than actual TCP hdr. */
if (datalen < tcph->doff * 4) {
/* CHECK: TCP header claims tiny size. */
if (tcph.doff * 4 < sizeof(tcph)) {
limpk("TCP header claims tiny size %u\n", tcph.doff * 4);
return 0;
}
/* CHECK: Packet smaller than actual TCP hdr. */
optlen = tcph.doff*4 - sizeof(tcph);
if (skb_copy_bits(skb, offset + sizeof(tcph), opt, optlen) < 0) {
if (!embedded) {
limpk("Packet length %u < actual TCP header.\n",
datalen);
skb->len - offset);
return 0;
} else
return 1;
}
/* Bad checksum? Don't print, just say it's unclean. */
/* FIXME: SRC ROUTE packets won't match checksum --RR */
if (!more_frags && !embedded
&& csum_tcpudp_magic(iph->saddr, iph->daddr, datalen, IPPROTO_TCP,
csum_partial((char *)tcph, datalen, 0)) != 0)
return 0;
/* CHECK: TCP ports non-zero */
if (!tcph->source || !tcph->dest) {
if (!tcph.source || !tcph.dest) {
limpk("Zero TCP ports %u/%u.\n",
htons(tcph->source), htons(tcph->dest));
htons(tcph.source), htons(tcph.dest));
return 0;
}
tcpflags = tcp_flag_word(&tcph);
/* CHECK: TCP reserved bits zero. */
if(tcp_flag_word(tcph) & TCP_RESERVED_BITS) {
if (tcpflags & TCP_RESERVED_BITS) {
limpk("TCP reserved bits not zero\n");
return 0;
}
tcpflags &= ~(TCP_DATA_OFFSET | TCP_FLAG_CWR | TCP_FLAG_ECE
| __constant_htonl(0x0000FFFF));
/* CHECK: TCP flags. */
tcpflags = (((u_int8_t *)tcph)[13] & ~(TH_ECE|TH_CWR));
if (tcpflags != TH_SYN
&& tcpflags != (TH_SYN|TH_ACK)
&& tcpflags != TH_RST
&& tcpflags != (TH_RST|TH_ACK)
&& tcpflags != (TH_RST|TH_ACK|TH_PUSH)
&& tcpflags != (TH_FIN|TH_ACK)
&& tcpflags != TH_ACK
&& tcpflags != (TH_ACK|TH_PUSH)
&& tcpflags != (TH_ACK|TH_URG)
&& tcpflags != (TH_ACK|TH_URG|TH_PUSH)
&& tcpflags != (TH_FIN|TH_ACK|TH_PUSH)
&& tcpflags != (TH_FIN|TH_ACK|TH_URG)
&& tcpflags != (TH_FIN|TH_ACK|TH_URG|TH_PUSH)) {
limpk("TCP flags bad: %u\n", tcpflags);
return 0;
}
for (i = sizeof(struct tcphdr); i < tcph->doff * 4; ) {
if (tcpflags != TCP_FLAG_SYN
&& tcpflags != (TCP_FLAG_SYN|TCP_FLAG_ACK)
&& tcpflags != TCP_FLAG_RST
&& tcpflags != (TCP_FLAG_RST|TCP_FLAG_ACK)
&& tcpflags != (TCP_FLAG_RST|TCP_FLAG_ACK|TCP_FLAG_PSH)
&& tcpflags != (TCP_FLAG_FIN|TCP_FLAG_ACK)
&& tcpflags != TCP_FLAG_ACK
&& tcpflags != (TCP_FLAG_ACK|TCP_FLAG_PSH)
&& tcpflags != (TCP_FLAG_ACK|TCP_FLAG_URG)
&& tcpflags != (TCP_FLAG_ACK|TCP_FLAG_URG|TCP_FLAG_PSH)
&& tcpflags != (TCP_FLAG_FIN|TCP_FLAG_ACK|TCP_FLAG_PSH)
&& tcpflags != (TCP_FLAG_FIN|TCP_FLAG_ACK|TCP_FLAG_URG)
&& tcpflags != (TCP_FLAG_FIN|TCP_FLAG_ACK|TCP_FLAG_URG
|TCP_FLAG_PSH)) {
limpk("TCP flags bad: 0x%04X\n", ntohl(tcpflags) >> 16);
return 0;
}
for (i = 0; i < optlen; ) {
switch (opt[i]) {
case 0:
end_of_options = 1;
......@@ -364,7 +362,7 @@ check_tcp(const struct iphdr *iph,
return 0;
}
/* CHECK: options at tail. */
else if (i+1 >= tcph->doff * 4) {
else if (i+1 >= optlen) {
limpk("TCP option %u at tail\n",
opt[i]);
return 0;
......@@ -376,8 +374,8 @@ check_tcp(const struct iphdr *iph,
return 0;
}
/* CHECK: oversize options. */
else if (&opt[i] + opt[i+1] > endhdr) {
limpk("TCP option %u at %Zu too long\n",
else if (i + opt[i+1] > optlen) {
limpk("TCP option %u at %u too long\n",
(unsigned int) opt[i], i);
return 0;
}
......@@ -392,34 +390,44 @@ check_tcp(const struct iphdr *iph,
/* Returns 1 if ok */
/* Standard IP checks. */
static int
check_ip(struct iphdr *iph, size_t length, int embedded)
check_ip(const struct sk_buff *skb, unsigned int offset)
{
u_int8_t *opt = (u_int8_t *)iph;
u_int8_t *endhdr = (u_int8_t *)iph + iph->ihl * 4;
int end_of_options = 0;
void *protoh;
size_t datalen;
unsigned int datalen, optlen;
unsigned int i;
unsigned int offset;
unsigned int fragoff;
struct iphdr iph;
unsigned char opt[15 * 4 - sizeof(struct iphdr)];
int embedded = offset;
/* Should only happen for local outgoing raw-socket packets. */
/* CHECK: length >= ip header. */
if (length < sizeof(struct iphdr) || length < iph->ihl * 4) {
limpk("Packet length %Zu < IP header.\n", length);
if (skb_copy_bits(skb, offset, &iph, sizeof(iph)) < 0) {
limpk("Packet length %u < IP header.\n", skb->len - offset);
return 0;
}
if (iph.ihl * 4 < sizeof(iph)) {
limpk("IP len %u < minimum IP header.\n", iph.ihl*4);
return 0;
}
optlen = iph.ihl * 4 - sizeof(iph);
if (skb_copy_bits(skb, offset+sizeof(struct iphdr), opt, optlen)<0) {
limpk("Packet length %u < IP header %u.\n",
skb->len - offset, iph.ihl * 4);
return 0;
}
offset = ntohs(iph->frag_off) & IP_OFFSET;
protoh = (void *)iph + iph->ihl * 4;
datalen = length - iph->ihl * 4;
fragoff = (ntohs(iph.frag_off) & IP_OFFSET);
datalen = skb->len - (offset + sizeof(struct iphdr) + optlen);
/* CHECK: Embedded fragment. */
if (embedded && offset) {
if (offset && fragoff) {
limpk("Embedded fragment.\n");
return 0;
}
for (i = sizeof(struct iphdr); i < iph->ihl * 4; ) {
for (i = 0; i < optlen; ) {
switch (opt[i]) {
case 0:
end_of_options = 1;
......@@ -436,7 +444,7 @@ check_ip(struct iphdr *iph, size_t length, int embedded)
return 0;
}
/* CHECK: options at tail. */
else if (i+1 >= iph->ihl * 4) {
else if (i+1 >= optlen) {
limpk("IP option %u at tail\n",
opt[i]);
return 0;
......@@ -448,7 +456,7 @@ check_ip(struct iphdr *iph, size_t length, int embedded)
return 0;
}
/* CHECK: oversize options. */
else if (&opt[i] + opt[i+1] > endhdr) {
else if (i + opt[i+1] > optlen) {
limpk("IP option %u at %u too long\n",
opt[i], i);
return 0;
......@@ -461,30 +469,30 @@ check_ip(struct iphdr *iph, size_t length, int embedded)
/* Fragment checks. */
/* CHECK: More fragments, but doesn't fill 8-byte boundary. */
if ((ntohs(iph->frag_off) & IP_MF)
&& (ntohs(iph->tot_len) % 8) != 0) {
limpk("Truncated fragment %u long.\n", ntohs(iph->tot_len));
if ((ntohs(iph.frag_off) & IP_MF)
&& (ntohs(iph.tot_len) % 8) != 0) {
limpk("Truncated fragment %u long.\n", ntohs(iph.tot_len));
return 0;
}
/* CHECK: Oversize fragment a-la Ping of Death. */
if (offset * 8 + datalen > 65535) {
limpk("Oversize fragment to %u.\n", offset * 8);
if (fragoff * 8 + datalen > 65535) {
limpk("Oversize fragment to %u.\n", fragoff * 8);
return 0;
}
/* CHECK: DF set and offset or MF set. */
if ((ntohs(iph->frag_off) & IP_DF)
&& (offset || (ntohs(iph->frag_off) & IP_MF))) {
/* CHECK: DF set and fragoff or MF set. */
if ((ntohs(iph.frag_off) & IP_DF)
&& (fragoff || (ntohs(iph.frag_off) & IP_MF))) {
limpk("DF set and offset=%u, MF=%u.\n",
offset, ntohs(iph->frag_off) & IP_MF);
fragoff, ntohs(iph.frag_off) & IP_MF);
return 0;
}
/* CHECK: Zero-sized fragments. */
if ((offset || (ntohs(iph->frag_off) & IP_MF))
if ((fragoff || (ntohs(iph.frag_off) & IP_MF))
&& datalen == 0) {
limpk("Zero size fragment offset=%u\n", offset);
limpk("Zero size fragment offset=%u\n", fragoff);
return 0;
}
......@@ -500,52 +508,54 @@ check_ip(struct iphdr *iph, size_t length, int embedded)
here. */
#define MIN_LIKELY_MTU 128
/* CHECK: Min size of first frag = 128. */
if ((ntohs(iph->frag_off) & IP_MF)
&& offset == 0
&& ntohs(iph->tot_len) < MIN_LIKELY_MTU) {
limpk("First fragment size %u < %u\n", ntohs(iph->tot_len),
if ((ntohs(iph.frag_off) & IP_MF)
&& fragoff == 0
&& ntohs(iph.tot_len) < MIN_LIKELY_MTU) {
limpk("First fragment size %u < %u\n", ntohs(iph.tot_len),
MIN_LIKELY_MTU);
return 0;
}
/* CHECK: Min offset of frag = 128 - IP hdr len. */
if (offset && offset * 8 < MIN_LIKELY_MTU - iph->ihl * 4) {
limpk("Fragment starts at %u < %u\n", offset * 8,
MIN_LIKELY_MTU - iph->ihl * 4);
if (fragoff && fragoff * 8 < MIN_LIKELY_MTU - iph.ihl * 4) {
limpk("Fragment starts at %u < %u\n", fragoff * 8,
MIN_LIKELY_MTU - iph.ihl * 4);
return 0;
}
/* CHECK: Protocol specification non-zero. */
if (iph->protocol == 0) {
if (iph.protocol == 0) {
limpk("Zero protocol\n");
return 0;
}
/* FIXME: This is already checked for in "Oversize fragment"
above --RR */
/* CHECK: Do not use what is unused.
* First bit of fragmentation flags should be unused.
* May be used by OS fingerprinting tools.
* 04 Jun 2002, Maciej Soltysiak, solt@dns.toxicfilms.tv
*/
if (ntohs(iph->frag_off)>>15) {
if (ntohs(iph.frag_off)>>15) {
limpk("IP unused bit set\n");
return 0;
}
/* Per-protocol checks. */
switch (iph->protocol) {
switch (iph.protocol) {
case IPPROTO_ICMP:
return check_icmp(protoh, datalen, offset,
(ntohs(iph->frag_off) & IP_MF),
return check_icmp(skb, offset + iph.ihl*4, fragoff,
(ntohs(iph.frag_off) & IP_MF),
embedded);
case IPPROTO_UDP:
return check_udp(iph, protoh, datalen, offset,
(ntohs(iph->frag_off) & IP_MF),
return check_udp(skb, offset + iph.ihl*4, fragoff,
(ntohs(iph.frag_off) & IP_MF),
embedded);
case IPPROTO_TCP:
return check_tcp(iph, protoh, datalen, offset,
(ntohs(iph->frag_off) & IP_MF),
return check_tcp(skb, offset + iph.ihl*4, fragoff,
(ntohs(iph.frag_off) & IP_MF),
embedded);
default:
/* Ignorance is bliss. */
......@@ -559,11 +569,9 @@ match(const struct sk_buff *skb,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
return !check_ip(skb->nh.iph, skb->len, 0);
return !check_ip(skb, 0);
}
/* Called when user tries to insert an entry of this type. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment