1 /*
2 * Copyright (c) 2016, The OpenThread Authors.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 * 3. Neither the name of the copyright holder nor the
13 * names of its contributors may be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
20 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 /**
30 * @file
31 * This file implements IPv6 datagram filtering.
32 */
33
34 #include "ip6_filter.hpp"
35
36 #include <stdio.h>
37
38 #include "common/code_utils.hpp"
39 #include "common/locator_getters.hpp"
40 #include "common/log.hpp"
41 #include "instance/instance.hpp"
42 #include "meshcop/meshcop.hpp"
43 #include "net/ip6.hpp"
44 #include "net/tcp6.hpp"
45 #include "net/udp6.hpp"
46 #include "thread/mle.hpp"
47
48 namespace ot {
49 namespace Ip6 {
50
51 RegisterLogModule("Ip6Filter");
52
Accept(Message & aMessage) const53 bool Filter::Accept(Message &aMessage) const
54 {
55 bool rval = false;
56 Headers headers;
57 uint16_t dstPort;
58
59 // Allow all received IPv6 datagrams with link security enabled
60 if (aMessage.IsLinkSecurityEnabled())
61 {
62 ExitNow(rval = true);
63 }
64
65 SuccessOrExit(headers.ParseFrom(aMessage));
66
67 VerifyOrExit(headers.GetDestinationAddress().IsLinkLocalUnicastOrMulticast());
68
69 // Allow all link-local IPv6 datagrams when Thread is not enabled
70 if (Get<Mle::MleRouter>().GetRole() == Mle::kRoleDisabled)
71 {
72 ExitNow(rval = true);
73 }
74
75 dstPort = headers.GetDestinationPort();
76
77 switch (headers.GetIpProto())
78 {
79 case kProtoUdp:
80 // Allow MLE traffic
81 if (dstPort == Mle::kUdpPort)
82 {
83 ExitNow(rval = true);
84 }
85
86 #if OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE
87 // Allow native commissioner traffic
88 if (Get<KeyManager>().GetSecurityPolicy().mNativeCommissioningEnabled &&
89 dstPort == Get<MeshCoP::BorderAgent>().GetUdpPort())
90 {
91 ExitNow(rval = true);
92 }
93 #endif
94 break;
95
96 case kProtoTcp:
97 break;
98
99 default:
100 // Allow UDP or TCP traffic only
101 ExitNow();
102 }
103
104 // Check against allowed unsecure port list
105 rval = mUnsecurePorts.Contains(dstPort);
106
107 exit:
108 return rval;
109 }
110
UpdateUnsecurePorts(Action aAction,uint16_t aPort)111 Error Filter::UpdateUnsecurePorts(Action aAction, uint16_t aPort)
112 {
113 Error error = kErrorNone;
114 uint16_t *entry;
115
116 VerifyOrExit(aPort != 0, error = kErrorInvalidArgs);
117
118 entry = mUnsecurePorts.Find(aPort);
119
120 if (aAction == kAdd)
121 {
122 VerifyOrExit(entry == nullptr);
123 SuccessOrExit(error = mUnsecurePorts.PushBack(aPort));
124 }
125 else
126 {
127 VerifyOrExit(entry != nullptr, error = kErrorNotFound);
128 mUnsecurePorts.Remove(*entry);
129 }
130
131 LogInfo("%s unsecure port %d", (aAction == kAdd) ? "Added" : "Removed", aPort);
132
133 exit:
134 return error;
135 }
136
137 } // namespace Ip6
138 } // namespace ot
139
