Книга: Iptables Tutorial 1.2.2
SCTP matches
SCTP matches
SCTP or Stream Control Transmission Protocol is a relatively new occurence in the networking domain in comparison to the TCP and UDP protocols. The SCTP Characteristics chapter explains the protocol more in detail. The implicit SCTP matches are loaded through adding the -p sctp match to the command line of iptables.
The SCTP protocol was developed by some of the larger telecom and switch/network manufacturers out there, and the protocol is specifically well suited for large simultaneous transactions with high reliability and high throughput.
Table 10-5. SCTP matches
| Match | --source-port, --sport |
| Kernel | 2.6 |
| Example | iptables -A INPUT -p sctp --source-port 80 |
| Explanation | The --source-port match is used to match an SCTP packet based on the source port in the SCTP packet header. The port can either be a single port, as in the example above, or a range of ports specified as --source-port 20:100, or it can also be inverted with the !-sign. This looks, for example, like --source-port ! 25. The source port is an unsigned 16 bit integer, so the maximum value is 65535 and the lowest value is 0. |
| Match | --destination-port, --dport |
| Kernel | 2.6 |
| Example | iptables -A INPUT -p sctp --destination-port 80 |
| Explanation | This match is used for the destination port of the SCTP packets. All SCTP packets contain a destination port, just as it does a source port, in the headers. The port can be either specified as in the example above, or with a port range such as --destination-port 6660:6670. The command can also be inverted with the !-sign, for example, --destination-port ! 80. This example would match all packets but those to port 80. The same applies for destination ports as for source ports, the highest port is 65535 and the lowest is 0. |
| Match | --chunk-types |
| Kernel | 2.6 |
| Example | iptables -A INPUT -p sctp --chunk-types any INIT,INIT_ACK |
| Explanation | This matches the chunk type of the SCTP packet. Currently there are a host of different chunk types available. For a complete list, see below. The match begins with the --chunk-types keyword, and then continues with a flag noting if we are to match all, any or none. After this, you specify the SCTP Chunk Types to match for. The Chunk Types are available in the separate list below. |
| Additionally, the flags can take some Chunk Flags as well. This is done for example in the form --chunk-types any DATA:Be. The flags are specific for each SCTP Chunk type and must be valid according to the separate list after this table. | |
| If an upper case letter is used, the flag must be set, and if a lower case flag is set it must be unset to match. The whole match can be inversed by using an ! sign just after the --chunk-types keyword. For example, --chunk-types ! any DATA:Be would match anything but this pattern. |
Below is the list of chunk types that the --chunk-types match will recognize. The list is quite extensive as you can see, but the mostly used packets are DATA and SACK packets. The rest are mostly used for controlling the association.
SCTP Chunk types as used in --chunk-types
• ABORT
• ASCONF
• ASCONF_ACK
• COOKIE_ACK
• COOKIE_ECHO
• DATA
• ECN_CWR
• ECN_ECNE
• ERROR
• HEARTBEAT
• HEARTBEAT_ACK
• INIT
• INIT_ACK
• SACK
• SHUTDOWN
• SHUTDOWN_ACK
• SHUTDOWN_COMPLETE
The following flags can be used with the --chunk-types match as seen above. According to the RFC 2960 - Stream Control Transmission Protocol all the rest of the flags are reserved or not in use, and must be set to 0. Iptables does currently not contain any measures to enforce this, fortunately, since it begs to become another problem such as the one previously experienced when ECN was implemented in the IP protocol.
SCTP Chunk flags as used in --chunk-types
• DATA - U or u for Unordered bit, B or b for Beginning fragment bit and E or e for Ending fragment bit.
• ABORT - T or t for TCB destroy flag.
• SHUTDOWN_COMPLETE - T or t for TCB destroyed flag.
Оглавление книги
