Blame SOURCES/0056-extensions-sctp-Translate-chunk-types-option.patch

ec5e2e
From 48f38c4224f31d19176df83539501292fcc6092b Mon Sep 17 00:00:00 2001
ec5e2e
From: Phil Sutter <phil@nwl.cc>
ec5e2e
Date: Tue, 4 May 2021 16:26:42 +0200
ec5e2e
Subject: [PATCH] extensions: sctp: Translate --chunk-types option
ec5e2e
ec5e2e
The translation is not fully complete as it is not possible to map 'any'
ec5e2e
match type into nft syntax with a single rule. Also, 'only' match type
ec5e2e
translation is a bit poor as it explicitly lists all chunk types that
ec5e2e
are supposed to be missing.
ec5e2e
ec5e2e
Signed-off-by: Phil Sutter <phil@nwl.cc>
ec5e2e
(cherry picked from commit 5818be177110a09120dd8fe4bd2533acbf8da301)
ec5e2e
---
ec5e2e
 extensions/libxt_sctp.c      | 91 ++++++++++++++++++++++++++++--------
ec5e2e
 extensions/libxt_sctp.txlate |  6 +++
ec5e2e
 2 files changed, 78 insertions(+), 19 deletions(-)
ec5e2e
ec5e2e
diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
ec5e2e
index ee4e99ebf11bf..5d8ab85cacf42 100644
ec5e2e
--- a/extensions/libxt_sctp.c
ec5e2e
+++ b/extensions/libxt_sctp.c
ec5e2e
@@ -92,28 +92,29 @@ struct sctp_chunk_names {
ec5e2e
 	const char *name;
ec5e2e
 	unsigned int chunk_type;
ec5e2e
 	const char *valid_flags;
ec5e2e
+	const char *nftname;
ec5e2e
 };
ec5e2e
 
ec5e2e
 /*'ALL' and 'NONE' will be treated specially. */
ec5e2e
 static const struct sctp_chunk_names sctp_chunk_names[]
ec5e2e
-= { { .name = "DATA", 		.chunk_type = 0,   .valid_flags = "----IUBE"},
ec5e2e
-    { .name = "INIT", 		.chunk_type = 1,   .valid_flags = "--------"},
ec5e2e
-    { .name = "INIT_ACK", 	.chunk_type = 2,   .valid_flags = "--------"},
ec5e2e
-    { .name = "SACK",		.chunk_type = 3,   .valid_flags = "--------"},
ec5e2e
-    { .name = "HEARTBEAT",	.chunk_type = 4,   .valid_flags = "--------"},
ec5e2e
-    { .name = "HEARTBEAT_ACK",	.chunk_type = 5,   .valid_flags = "--------"},
ec5e2e
-    { .name = "ABORT",		.chunk_type = 6,   .valid_flags = "-------T"},
ec5e2e
-    { .name = "SHUTDOWN",	.chunk_type = 7,   .valid_flags = "--------"},
ec5e2e
-    { .name = "SHUTDOWN_ACK",	.chunk_type = 8,   .valid_flags = "--------"},
ec5e2e
-    { .name = "ERROR",		.chunk_type = 9,   .valid_flags = "--------"},
ec5e2e
-    { .name = "COOKIE_ECHO",	.chunk_type = 10,  .valid_flags = "--------"},
ec5e2e
-    { .name = "COOKIE_ACK",	.chunk_type = 11,  .valid_flags = "--------"},
ec5e2e
-    { .name = "ECN_ECNE",	.chunk_type = 12,  .valid_flags = "--------"},
ec5e2e
-    { .name = "ECN_CWR",	.chunk_type = 13,  .valid_flags = "--------"},
ec5e2e
-    { .name = "SHUTDOWN_COMPLETE", .chunk_type = 14,  .valid_flags = "-------T"},
ec5e2e
-    { .name = "ASCONF",		.chunk_type = 193,  .valid_flags = "--------"},
ec5e2e
-    { .name = "ASCONF_ACK",	.chunk_type = 128,  .valid_flags = "--------"},
ec5e2e
-    { .name = "FORWARD_TSN",	.chunk_type = 192,  .valid_flags = "--------"},
ec5e2e
+= { { .name = "DATA", 		.chunk_type = 0,   .valid_flags = "----IUBE", .nftname = "data" },
ec5e2e
+    { .name = "INIT", 		.chunk_type = 1,   .valid_flags = "--------", .nftname = "init" },
ec5e2e
+    { .name = "INIT_ACK", 	.chunk_type = 2,   .valid_flags = "--------", .nftname = "init-ack" },
ec5e2e
+    { .name = "SACK",		.chunk_type = 3,   .valid_flags = "--------", .nftname = "sack" },
ec5e2e
+    { .name = "HEARTBEAT",	.chunk_type = 4,   .valid_flags = "--------", .nftname = "heartbeat" },
ec5e2e
+    { .name = "HEARTBEAT_ACK",	.chunk_type = 5,   .valid_flags = "--------", .nftname = "heartbeat-ack" },
ec5e2e
+    { .name = "ABORT",		.chunk_type = 6,   .valid_flags = "-------T", .nftname = "abort" },
ec5e2e
+    { .name = "SHUTDOWN",	.chunk_type = 7,   .valid_flags = "--------", .nftname = "shutdown" },
ec5e2e
+    { .name = "SHUTDOWN_ACK",	.chunk_type = 8,   .valid_flags = "--------", .nftname = "shutdown-ack" },
ec5e2e
+    { .name = "ERROR",		.chunk_type = 9,   .valid_flags = "--------", .nftname = "error" },
ec5e2e
+    { .name = "COOKIE_ECHO",	.chunk_type = 10,  .valid_flags = "--------", .nftname = "cookie-echo" },
ec5e2e
+    { .name = "COOKIE_ACK",	.chunk_type = 11,  .valid_flags = "--------", .nftname = "cookie-ack" },
ec5e2e
+    { .name = "ECN_ECNE",	.chunk_type = 12,  .valid_flags = "--------", .nftname = "ecne" },
ec5e2e
+    { .name = "ECN_CWR",	.chunk_type = 13,  .valid_flags = "--------", .nftname = "cwr" },
ec5e2e
+    { .name = "SHUTDOWN_COMPLETE", .chunk_type = 14,  .valid_flags = "-------T", .nftname = "shutdown-complete" },
ec5e2e
+    { .name = "ASCONF",		.chunk_type = 193,  .valid_flags = "--------", .nftname = "asconf" },
ec5e2e
+    { .name = "ASCONF_ACK",	.chunk_type = 128,  .valid_flags = "--------", .nftname = "asconf-ack" },
ec5e2e
+    { .name = "FORWARD_TSN",	.chunk_type = 192,  .valid_flags = "--------", .nftname = "forward-tsn" },
ec5e2e
 };
ec5e2e
 
ec5e2e
 static void
ec5e2e
@@ -485,12 +486,52 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
ec5e2e
 	}
ec5e2e
 }
ec5e2e
 
ec5e2e
+static const char *sctp_xlate_chunk(struct xt_xlate *xl, const char *space,
ec5e2e
+				    const struct xt_sctp_info *einfo,
ec5e2e
+				    const struct sctp_chunk_names *scn)
ec5e2e
+{
ec5e2e
+	bool inv = einfo->invflags & XT_SCTP_CHUNK_TYPES;
ec5e2e
+	const struct xt_sctp_flag_info *flag_info = NULL;
ec5e2e
+	int i;
ec5e2e
+
ec5e2e
+	if (!scn->nftname)
ec5e2e
+		return space;
ec5e2e
+
ec5e2e
+	if (!SCTP_CHUNKMAP_IS_SET(einfo->chunkmap, scn->chunk_type)) {
ec5e2e
+		if (einfo->chunk_match_type != SCTP_CHUNK_MATCH_ONLY)
ec5e2e
+			return space;
ec5e2e
+
ec5e2e
+		xt_xlate_add(xl, "%ssctp chunk %s %s", space,
ec5e2e
+			     scn->nftname, inv ? "exists" : "missing");
ec5e2e
+		return " ";
ec5e2e
+	}
ec5e2e
+
ec5e2e
+	for (i = 0; i < einfo->flag_count; i++) {
ec5e2e
+		if (einfo->flag_info[i].chunktype == scn->chunk_type) {
ec5e2e
+			flag_info = &einfo->flag_info[i];
ec5e2e
+			break;
ec5e2e
+		}
ec5e2e
+	}
ec5e2e
+
ec5e2e
+	if (!flag_info) {
ec5e2e
+		xt_xlate_add(xl, "%ssctp chunk %s %s", space,
ec5e2e
+			     scn->nftname, inv ? "missing" : "exists");
ec5e2e
+		return " ";
ec5e2e
+	}
ec5e2e
+
ec5e2e
+	xt_xlate_add(xl, "%ssctp chunk %s flags & 0x%x %s 0x%x", space,
ec5e2e
+		     scn->nftname, flag_info->flag_mask,
ec5e2e
+		     inv ? "!=" : "==", flag_info->flag);
ec5e2e
+
ec5e2e
+	return " ";
ec5e2e
+}
ec5e2e
+
ec5e2e
 static int sctp_xlate(struct xt_xlate *xl,
ec5e2e
 		      const struct xt_xlate_mt_params *params)
ec5e2e
 {
ec5e2e
 	const struct xt_sctp_info *einfo =
ec5e2e
 		(const struct xt_sctp_info *)params->match->data;
ec5e2e
-	char *space = "";
ec5e2e
+	const char *space = "";
ec5e2e
 
ec5e2e
 	if (!einfo->flags)
ec5e2e
 		return 0;
ec5e2e
@@ -516,6 +557,18 @@ static int sctp_xlate(struct xt_xlate *xl,
ec5e2e
 			xt_xlate_add(xl, "%ssctp dport%s %u", space,
ec5e2e
 				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
ec5e2e
 				     einfo->dpts[0]);
ec5e2e
+		space = " ";
ec5e2e
+	}
ec5e2e
+
ec5e2e
+	if (einfo->flags & XT_SCTP_CHUNK_TYPES) {
ec5e2e
+		int i;
ec5e2e
+
ec5e2e
+		if (einfo->chunk_match_type == SCTP_CHUNK_MATCH_ANY)
ec5e2e
+			return 0;
ec5e2e
+
ec5e2e
+		for (i = 0; i < ARRAY_SIZE(sctp_chunk_names); i++)
ec5e2e
+			space = sctp_xlate_chunk(xl, space, einfo,
ec5e2e
+						 &sctp_chunk_names[i]);
ec5e2e
 	}
ec5e2e
 
ec5e2e
 	return 1;
ec5e2e
diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate
ec5e2e
index 0d6c59e183675..bb817525db8d8 100644
ec5e2e
--- a/extensions/libxt_sctp.txlate
ec5e2e
+++ b/extensions/libxt_sctp.txlate
ec5e2e
@@ -36,3 +36,9 @@ nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept
ec5e2e
 
ec5e2e
 iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT
ec5e2e
 nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept
ec5e2e
+
ec5e2e
+iptables-translate -A INPUT -p sctp --chunk-types all INIT,DATA:iUbE,SACK,ABORT:T -j ACCEPT
ec5e2e
+nft add rule ip filter INPUT sctp chunk data flags & 0xf == 0x5 sctp chunk init exists sctp chunk sack exists sctp chunk abort flags & 0x1 == 0x1 counter accept
ec5e2e
+
ec5e2e
+iptables-translate -A INPUT -p sctp --chunk-types only SHUTDOWN_COMPLETE -j ACCEPT
ec5e2e
+nft add rule ip filter INPUT sctp chunk data missing sctp chunk init missing sctp chunk init-ack missing sctp chunk sack missing sctp chunk heartbeat missing sctp chunk heartbeat-ack missing sctp chunk abort missing sctp chunk shutdown missing sctp chunk shutdown-ack missing sctp chunk error missing sctp chunk cookie-echo missing sctp chunk cookie-ack missing sctp chunk ecne missing sctp chunk cwr missing sctp chunk shutdown-complete exists sctp chunk asconf missing sctp chunk asconf-ack missing sctp chunk forward-tsn missing counter accept
ec5e2e
-- 
ec5e2e
2.31.1
ec5e2e