rxrpc: Improve up-front incoming packet checking

Do more up-front checking on incoming packets to weed out invalid ones and
also ones aimed at services that we don't support.

Whilst we're at it, replace the clearing of call and skew if we don't find
a connection with just initialising the variables to zero at the top of the
function.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index b0f12471f5e70f5b5df3b7c9645806703db2e10e..a569e9e010d1dd42185f4d92ce27c605d4838653 100644 (file)
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -1125,12 +1125,13 @@ void rxrpc_data_ready(struct sock *udp_sk)
 {
        struct rxrpc_connection *conn;
        struct rxrpc_channel *chan;
-       struct rxrpc_call *call;
+       struct rxrpc_call *call = NULL;
        struct rxrpc_skb_priv *sp;
        struct rxrpc_local *local = udp_sk->sk_user_data;
+       struct rxrpc_sock *rx;
        struct sk_buff *skb;
        unsigned int channel;
-       int ret, skew;
+       int ret, skew = 0;
 
        _enter("%p", udp_sk);
 
@@ -1181,12 +1182,6 @@ void rxrpc_data_ready(struct sock *udp_sk)
 
        trace_rxrpc_rx_packet(sp);
 
-       if (sp->hdr.type >= RXRPC_N_PACKET_TYPES ||
-           !((RXRPC_SUPPORTED_PACKET_TYPES >> sp->hdr.type) & 1)) {
-               _proto("Rx Bad Packet Type %u", sp->hdr.type);
-               goto bad_message;
-       }
-
        switch (sp->hdr.type) {
        case RXRPC_PACKET_TYPE_VERSION:
                if (rxrpc_to_client(sp))
@@ -1198,24 +1193,63 @@ void rxrpc_data_ready(struct sock *udp_sk)
                if (rxrpc_to_server(sp))
                        goto discard;
                /* Fall through */
+       case RXRPC_PACKET_TYPE_ACK:
+       case RXRPC_PACKET_TYPE_ACKALL:
+               if (sp->hdr.callNumber == 0)
+                       goto bad_message;
+               /* Fall through */
+       case RXRPC_PACKET_TYPE_ABORT:
+               break;
 
        case RXRPC_PACKET_TYPE_DATA:
-               if (sp->hdr.callNumber == 0)
+               if (sp->hdr.callNumber == 0 ||
+                   sp->hdr.seq == 0)
                        goto bad_message;
                if (sp->hdr.flags & RXRPC_JUMBO_PACKET &&
                    !rxrpc_validate_jumbo(skb))
                        goto bad_message;
                break;
 
+       case RXRPC_PACKET_TYPE_CHALLENGE:
+               if (rxrpc_to_server(sp))
+                       goto discard;
+               break;
+       case RXRPC_PACKET_TYPE_RESPONSE:
+               if (rxrpc_to_client(sp))
+                       goto discard;
+               break;
+
                /* Packet types 9-11 should just be ignored. */
        case RXRPC_PACKET_TYPE_PARAMS:
        case RXRPC_PACKET_TYPE_10:
        case RXRPC_PACKET_TYPE_11:
                goto discard;
+
+       default:
+               _proto("Rx Bad Packet Type %u", sp->hdr.type);
+               goto bad_message;
        }
 
+       if (sp->hdr.serviceId == 0)
+               goto bad_message;
+
        rcu_read_lock();
 
+       if (rxrpc_to_server(sp)) {
+               /* Weed out packets to services we're not offering.  Packets
+                * that would begin a call are explicitly rejected and the rest
+                * are just discarded.
+                */
+               rx = rcu_dereference(local->service);
+               if (!rx || (sp->hdr.serviceId != rx->srx.srx_service &&
+                           sp->hdr.serviceId != rx->second_service)) {
+                       if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
+                           sp->hdr.seq == 1)
+                               goto unsupported_service;
+                       goto discard_unlock;
+               }
+       }
+
        conn = rxrpc_find_connection_rcu(local, skb);
        if (conn) {
                if (sp->hdr.securityIndex != conn->security_ix)
@@ -1297,14 +1331,10 @@ void rxrpc_data_ready(struct sock *udp_sk)
                        if (!test_bit(RXRPC_CALL_RX_HEARD, &call->flags))
                                set_bit(RXRPC_CALL_RX_HEARD, &call->flags);
                }
-       } else {
-               skew = 0;
-               call = NULL;
        }
 
        if (!call || atomic_read(&call->usage) == 0) {
                if (rxrpc_to_client(sp) ||
-                   sp->hdr.callNumber == 0 ||
                    sp->hdr.type != RXRPC_PACKET_TYPE_DATA)
                        goto bad_message_unlock;
                if (sp->hdr.seq != 1)
@@ -1340,6 +1370,13 @@ wrong_security:
        skb->priority = RXKADINCONSISTENCY;
        goto post_abort;
 
+unsupported_service:
+       rcu_read_unlock();
+       trace_rxrpc_abort(0, "INV", sp->hdr.cid, sp->hdr.callNumber, sp->hdr.seq,
+                         RX_INVALID_OPERATION, EOPNOTSUPP);
+       skb->priority = RX_INVALID_OPERATION;
+       goto post_abort;
+
 reupgrade:
        rcu_read_unlock();
        trace_rxrpc_abort(0, "UPG", sp->hdr.cid, sp->hdr.callNumber, sp->hdr.seq,

diff --git a/net/rxrpc/protocol.h b/net/rxrpc/protocol.h
index 93da73bf709857bbd48b2859092175bf43df8dfd..f9cb83c938f35d4ad8e381658da53e8f2494ff6a 100644 (file)
--- a/net/rxrpc/protocol.h
+++ b/net/rxrpc/protocol.h
@@ -50,7 +50,6 @@ struct rxrpc_wire_header {
 #define RXRPC_PACKET_TYPE_10           10      /* Ignored */
 #define RXRPC_PACKET_TYPE_11           11      /* Ignored */
 #define RXRPC_PACKET_TYPE_VERSION      13      /* version string request */
-#define RXRPC_N_PACKET_TYPES           14      /* number of packet types (incl type 0) */
 
        uint8_t         flags;          /* packet flags */
 #define RXRPC_CLIENT_INITIATED 0x01            /* signifies a packet generated by a client */
@@ -72,20 +71,6 @@ struct rxrpc_wire_header {
 
 } __packed;
 
-#define RXRPC_SUPPORTED_PACKET_TYPES (                 \
-               (1 << RXRPC_PACKET_TYPE_DATA) |         \
-               (1 << RXRPC_PACKET_TYPE_ACK) |          \
-               (1 << RXRPC_PACKET_TYPE_BUSY) |         \
-               (1 << RXRPC_PACKET_TYPE_ABORT) |        \
-               (1 << RXRPC_PACKET_TYPE_ACKALL) |       \
-               (1 << RXRPC_PACKET_TYPE_CHALLENGE) |    \
-               (1 << RXRPC_PACKET_TYPE_RESPONSE) |     \
-               /*(1 << RXRPC_PACKET_TYPE_DEBUG) | */   \
-               (1 << RXRPC_PACKET_TYPE_PARAMS) |       \
-               (1 << RXRPC_PACKET_TYPE_10) |           \
-               (1 << RXRPC_PACKET_TYPE_11) |           \
-               (1 << RXRPC_PACKET_TYPE_VERSION))
-
 /*****************************************************************************/
 /*
  * jumbo packet secondary header