1 /*
2 * Copyright (c) 2016, The OpenThread Authors.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 * 3. Neither the name of the copyright holder nor the
13 * names of its contributors may be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 /**
30 * @file
31 * This file implements IPv6 datagram filtering.
32 */
33
34 #include "ip6_filter.hpp"
35
36 #include "instance/instance.hpp"
37
38 namespace ot {
39 namespace Ip6 {
40
41 RegisterLogModule("Ip6Filter");
42
Accept(Message & aMessage) const43 bool Filter::Accept(Message &aMessage) const
44 {
45 bool rval = false;
46 Headers headers;
47 uint16_t dstPort;
48
49 // Allow all received IPv6 datagrams with link security enabled
50 if (aMessage.IsLinkSecurityEnabled())
51 {
52 ExitNow(rval = true);
53 }
54
55 SuccessOrExit(headers.ParseFrom(aMessage));
56
57 VerifyOrExit(headers.GetDestinationAddress().IsLinkLocalUnicastOrMulticast());
58
59 // Allow all link-local IPv6 datagrams when Thread is not enabled
60 if (Get<Mle::MleRouter>().GetRole() == Mle::kRoleDisabled)
61 {
62 ExitNow(rval = true);
63 }
64
65 dstPort = headers.GetDestinationPort();
66
67 switch (headers.GetIpProto())
68 {
69 case kProtoUdp:
70 // Allow MLE traffic
71 if (dstPort == Mle::kUdpPort)
72 {
73 ExitNow(rval = true);
74 }
75
76 #if OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE
77 // Allow native commissioner traffic
78 if (Get<KeyManager>().GetSecurityPolicy().mNativeCommissioningEnabled &&
79 dstPort == Get<MeshCoP::BorderAgent>().GetUdpPort())
80 {
81 ExitNow(rval = true);
82 }
83 #endif
84 break;
85
86 case kProtoTcp:
87 break;
88
89 default:
90 // Allow UDP or TCP traffic only
91 ExitNow();
92 }
93
94 // Check against allowed unsecure port list
95 rval = mUnsecurePorts.Contains(dstPort);
96
97 exit:
98 return rval;
99 }
100
UpdateUnsecurePorts(Action aAction,uint16_t aPort)101 Error Filter::UpdateUnsecurePorts(Action aAction, uint16_t aPort)
102 {
103 Error error = kErrorNone;
104 uint16_t *entry;
105
106 VerifyOrExit(aPort != 0, error = kErrorInvalidArgs);
107
108 entry = mUnsecurePorts.Find(aPort);
109
110 if (aAction == kAdd)
111 {
112 VerifyOrExit(entry == nullptr);
113 SuccessOrExit(error = mUnsecurePorts.PushBack(aPort));
114 }
115 else
116 {
117 VerifyOrExit(entry != nullptr, error = kErrorNotFound);
118 mUnsecurePorts.Remove(*entry);
119 }
120
121 LogInfo("%s unsecure port %d", (aAction == kAdd) ? "Added" : "Removed", aPort);
122
123 exit:
124 return error;
125 }
126
127 } // namespace Ip6
128 } // namespace ot
129
