Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 3d8c6dce53a349df8878d078e56bf429bad572f9

Authored by Pablo Neira Ayuso
1 parent 4017a7ee69

netfilter: xt_TPROXY: fix invflags check in tproxy_tg6_check() 

We have to check for IP6T_INV_PROTO in invflags, instead of flags.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Balazs Scheidler <bazsi@balabit.hu>

Showing 1 changed file with 2 additions and 2 deletions Inline Diff

net/netfilter/xt_TPROXY.c
Diff comments   View file @ 3d8c6dc
1 /* 1 /*
2 * Transparent proxy support for Linux/iptables 2 * Transparent proxy support for Linux/iptables
3 * 3 *
4 * Copyright (c) 2006-2010 BalaBit IT Ltd. 4 * Copyright (c) 2006-2010 BalaBit IT Ltd.
5 * Author: Balazs Scheidler, Krisztian Kovacs 5 * Author: Balazs Scheidler, Krisztian Kovacs
6 * 6 *
7 * This program is free software; you can redistribute it and/or modify 7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as 8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation. 9 * published by the Free Software Foundation.
10 * 10 *
11 */ 11 */
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h> 13 #include <linux/module.h>
14 #include <linux/skbuff.h> 14 #include <linux/skbuff.h>
15 #include <linux/ip.h> 15 #include <linux/ip.h>
16 #include <net/checksum.h> 16 #include <net/checksum.h>
17 #include <net/udp.h> 17 #include <net/udp.h>
18 #include <net/tcp.h> 18 #include <net/tcp.h>
19 #include <net/inet_sock.h> 19 #include <net/inet_sock.h>
20 #include <net/inet_hashtables.h> 20 #include <net/inet_hashtables.h>
21 #include <linux/inetdevice.h> 21 #include <linux/inetdevice.h>
22 #include <linux/netfilter/x_tables.h> 22 #include <linux/netfilter/x_tables.h>
23 #include <linux/netfilter_ipv4/ip_tables.h> 23 #include <linux/netfilter_ipv4/ip_tables.h>
24 24
25 #include <net/netfilter/ipv4/nf_defrag_ipv4.h> 25 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
26 26
27 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 27 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
28 #define XT_TPROXY_HAVE_IPV6 1 28 #define XT_TPROXY_HAVE_IPV6 1
29 #include <net/if_inet6.h> 29 #include <net/if_inet6.h>
30 #include <net/addrconf.h> 30 #include <net/addrconf.h>
31 #include <net/inet6_hashtables.h> 31 #include <net/inet6_hashtables.h>
32 #include <linux/netfilter_ipv6/ip6_tables.h> 32 #include <linux/netfilter_ipv6/ip6_tables.h>
33 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 33 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
34 #endif 34 #endif
35 35
36 #include <linux/netfilter/xt_TPROXY.h> 36 #include <linux/netfilter/xt_TPROXY.h>
37 37
38 enum nf_tproxy_lookup_t { 38 enum nf_tproxy_lookup_t {
39 NFT_LOOKUP_LISTENER, 39 NFT_LOOKUP_LISTENER,
40 NFT_LOOKUP_ESTABLISHED, 40 NFT_LOOKUP_ESTABLISHED,
41 }; 41 };
42 42
43 static bool tproxy_sk_is_transparent(struct sock *sk) 43 static bool tproxy_sk_is_transparent(struct sock *sk)
44 { 44 {
45 if (sk->sk_state != TCP_TIME_WAIT) { 45 if (sk->sk_state != TCP_TIME_WAIT) {
46 if (inet_sk(sk)->transparent) 46 if (inet_sk(sk)->transparent)
47 return true; 47 return true;
48 sock_put(sk); 48 sock_put(sk);
49 } else { 49 } else {
50 if (inet_twsk(sk)->tw_transparent) 50 if (inet_twsk(sk)->tw_transparent)
51 return true; 51 return true;
52 inet_twsk_put(inet_twsk(sk)); 52 inet_twsk_put(inet_twsk(sk));
53 } 53 }
54 return false; 54 return false;
55 } 55 }
56 56
57 static inline __be32 57 static inline __be32
58 tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) 58 tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
59 { 59 {
60 struct in_device *indev; 60 struct in_device *indev;
61 __be32 laddr; 61 __be32 laddr;
62 62
63 if (user_laddr) 63 if (user_laddr)
64 return user_laddr; 64 return user_laddr;
65 65
66 laddr = 0; 66 laddr = 0;
67 rcu_read_lock(); 67 rcu_read_lock();
68 indev = __in_dev_get_rcu(skb->dev); 68 indev = __in_dev_get_rcu(skb->dev);
69 for_primary_ifa(indev) { 69 for_primary_ifa(indev) {
70 laddr = ifa->ifa_local; 70 laddr = ifa->ifa_local;
71 break; 71 break;
72 } endfor_ifa(indev); 72 } endfor_ifa(indev);
73 rcu_read_unlock(); 73 rcu_read_unlock();
74 74
75 return laddr ? laddr : daddr; 75 return laddr ? laddr : daddr;
76 } 76 }
77 77
78 /* 78 /*
79 * This is used when the user wants to intercept a connection matching 79 * This is used when the user wants to intercept a connection matching
80 * an explicit iptables rule. In this case the sockets are assumed 80 * an explicit iptables rule. In this case the sockets are assumed
81 * matching in preference order: 81 * matching in preference order:
82 * 82 *
83 * - match: if there's a fully established connection matching the 83 * - match: if there's a fully established connection matching the
84 * _packet_ tuple, it is returned, assuming the redirection 84 * _packet_ tuple, it is returned, assuming the redirection
85 * already took place and we process a packet belonging to an 85 * already took place and we process a packet belonging to an
86 * established connection 86 * established connection
87 * 87 *
88 * - match: if there's a listening socket matching the redirection 88 * - match: if there's a listening socket matching the redirection
89 * (e.g. on-port & on-ip of the connection), it is returned, 89 * (e.g. on-port & on-ip of the connection), it is returned,
90 * regardless if it was bound to 0.0.0.0 or an explicit 90 * regardless if it was bound to 0.0.0.0 or an explicit
91 * address. The reasoning is that if there's an explicit rule, it 91 * address. The reasoning is that if there's an explicit rule, it
92 * does not really matter if the listener is bound to an interface 92 * does not really matter if the listener is bound to an interface
93 * or to 0. The user already stated that he wants redirection 93 * or to 0. The user already stated that he wants redirection
94 * (since he added the rule). 94 * (since he added the rule).
95 * 95 *
96 * Please note that there's an overlap between what a TPROXY target 96 * Please note that there's an overlap between what a TPROXY target
97 * and a socket match will match. Normally if you have both rules the 97 * and a socket match will match. Normally if you have both rules the
98 * "socket" match will be the first one, effectively all packets 98 * "socket" match will be the first one, effectively all packets
99 * belonging to established connections going through that one. 99 * belonging to established connections going through that one.
100 */ 100 */
101 static inline struct sock * 101 static inline struct sock *
102 nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, 102 nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
103 const __be32 saddr, const __be32 daddr, 103 const __be32 saddr, const __be32 daddr,
104 const __be16 sport, const __be16 dport, 104 const __be16 sport, const __be16 dport,
105 const struct net_device *in, 105 const struct net_device *in,
106 const enum nf_tproxy_lookup_t lookup_type) 106 const enum nf_tproxy_lookup_t lookup_type)
107 { 107 {
108 struct sock *sk; 108 struct sock *sk;
109 109
110 switch (protocol) { 110 switch (protocol) {
111 case IPPROTO_TCP: 111 case IPPROTO_TCP:
112 switch (lookup_type) { 112 switch (lookup_type) {
113 case NFT_LOOKUP_LISTENER: 113 case NFT_LOOKUP_LISTENER:
114 sk = inet_lookup_listener(net, &tcp_hashinfo, 114 sk = inet_lookup_listener(net, &tcp_hashinfo,
115 saddr, sport, 115 saddr, sport,
116 daddr, dport, 116 daddr, dport,
117 in->ifindex); 117 in->ifindex);
118 118
119 /* NOTE: we return listeners even if bound to 119 /* NOTE: we return listeners even if bound to
120 * 0.0.0.0, those are filtered out in 120 * 0.0.0.0, those are filtered out in
121 * xt_socket, since xt_TPROXY needs 0 bound 121 * xt_socket, since xt_TPROXY needs 0 bound
122 * listeners too 122 * listeners too
123 */ 123 */
124 break; 124 break;
125 case NFT_LOOKUP_ESTABLISHED: 125 case NFT_LOOKUP_ESTABLISHED:
126 sk = inet_lookup_established(net, &tcp_hashinfo, 126 sk = inet_lookup_established(net, &tcp_hashinfo,
127 saddr, sport, daddr, dport, 127 saddr, sport, daddr, dport,
128 in->ifindex); 128 in->ifindex);
129 break; 129 break;
130 default: 130 default:
131 BUG(); 131 BUG();
132 } 132 }
133 break; 133 break;
134 case IPPROTO_UDP: 134 case IPPROTO_UDP:
135 sk = udp4_lib_lookup(net, saddr, sport, daddr, dport, 135 sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
136 in->ifindex); 136 in->ifindex);
137 if (sk) { 137 if (sk) {
138 int connected = (sk->sk_state == TCP_ESTABLISHED); 138 int connected = (sk->sk_state == TCP_ESTABLISHED);
139 int wildcard = (inet_sk(sk)->inet_rcv_saddr == 0); 139 int wildcard = (inet_sk(sk)->inet_rcv_saddr == 0);
140 140
141 /* NOTE: we return listeners even if bound to 141 /* NOTE: we return listeners even if bound to
142 * 0.0.0.0, those are filtered out in 142 * 0.0.0.0, those are filtered out in
143 * xt_socket, since xt_TPROXY needs 0 bound 143 * xt_socket, since xt_TPROXY needs 0 bound
144 * listeners too 144 * listeners too
145 */ 145 */
146 if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) || 146 if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
147 (lookup_type == NFT_LOOKUP_LISTENER && connected)) { 147 (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
148 sock_put(sk); 148 sock_put(sk);
149 sk = NULL; 149 sk = NULL;
150 } 150 }
151 } 151 }
152 break; 152 break;
153 default: 153 default:
154 WARN_ON(1); 154 WARN_ON(1);
155 sk = NULL; 155 sk = NULL;
156 } 156 }
157 157
158 pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n", 158 pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n",
159 protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk); 159 protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk);
160 160
161 return sk; 161 return sk;
162 } 162 }
163 163
164 #ifdef XT_TPROXY_HAVE_IPV6 164 #ifdef XT_TPROXY_HAVE_IPV6
165 static inline struct sock * 165 static inline struct sock *
166 nf_tproxy_get_sock_v6(struct net *net, const u8 protocol, 166 nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,
167 const struct in6_addr *saddr, const struct in6_addr *daddr, 167 const struct in6_addr *saddr, const struct in6_addr *daddr,
168 const __be16 sport, const __be16 dport, 168 const __be16 sport, const __be16 dport,
169 const struct net_device *in, 169 const struct net_device *in,
170 const enum nf_tproxy_lookup_t lookup_type) 170 const enum nf_tproxy_lookup_t lookup_type)
171 { 171 {
172 struct sock *sk; 172 struct sock *sk;
173 173
174 switch (protocol) { 174 switch (protocol) {
175 case IPPROTO_TCP: 175 case IPPROTO_TCP:
176 switch (lookup_type) { 176 switch (lookup_type) {
177 case NFT_LOOKUP_LISTENER: 177 case NFT_LOOKUP_LISTENER:
178 sk = inet6_lookup_listener(net, &tcp_hashinfo, 178 sk = inet6_lookup_listener(net, &tcp_hashinfo,
179 saddr, sport, 179 saddr, sport,
180 daddr, ntohs(dport), 180 daddr, ntohs(dport),
181 in->ifindex); 181 in->ifindex);
182 182
183 /* NOTE: we return listeners even if bound to 183 /* NOTE: we return listeners even if bound to
184 * 0.0.0.0, those are filtered out in 184 * 0.0.0.0, those are filtered out in
185 * xt_socket, since xt_TPROXY needs 0 bound 185 * xt_socket, since xt_TPROXY needs 0 bound
186 * listeners too 186 * listeners too
187 */ 187 */
188 break; 188 break;
189 case NFT_LOOKUP_ESTABLISHED: 189 case NFT_LOOKUP_ESTABLISHED:
190 sk = __inet6_lookup_established(net, &tcp_hashinfo, 190 sk = __inet6_lookup_established(net, &tcp_hashinfo,
191 saddr, sport, daddr, ntohs(dport), 191 saddr, sport, daddr, ntohs(dport),
192 in->ifindex); 192 in->ifindex);
193 break; 193 break;
194 default: 194 default:
195 BUG(); 195 BUG();
196 } 196 }
197 break; 197 break;
198 case IPPROTO_UDP: 198 case IPPROTO_UDP:
199 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport, 199 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
200 in->ifindex); 200 in->ifindex);
201 if (sk) { 201 if (sk) {
202 int connected = (sk->sk_state == TCP_ESTABLISHED); 202 int connected = (sk->sk_state == TCP_ESTABLISHED);
203 int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr); 203 int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr);
204 204
205 /* NOTE: we return listeners even if bound to 205 /* NOTE: we return listeners even if bound to
206 * 0.0.0.0, those are filtered out in 206 * 0.0.0.0, those are filtered out in
207 * xt_socket, since xt_TPROXY needs 0 bound 207 * xt_socket, since xt_TPROXY needs 0 bound
208 * listeners too 208 * listeners too
209 */ 209 */
210 if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) || 210 if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
211 (lookup_type == NFT_LOOKUP_LISTENER && connected)) { 211 (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
212 sock_put(sk); 212 sock_put(sk);
213 sk = NULL; 213 sk = NULL;
214 } 214 }
215 } 215 }
216 break; 216 break;
217 default: 217 default:
218 WARN_ON(1); 218 WARN_ON(1);
219 sk = NULL; 219 sk = NULL;
220 } 220 }
221 221
222 pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n", 222 pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
223 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk); 223 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
224 224
225 return sk; 225 return sk;
226 } 226 }
227 #endif 227 #endif
228 228
229 /** 229 /**
230 * tproxy_handle_time_wait4 - handle IPv4 TCP TIME_WAIT reopen redirections 230 * tproxy_handle_time_wait4 - handle IPv4 TCP TIME_WAIT reopen redirections
231 * @skb: The skb being processed. 231 * @skb: The skb being processed.
232 * @laddr: IPv4 address to redirect to or zero. 232 * @laddr: IPv4 address to redirect to or zero.
233 * @lport: TCP port to redirect to or zero. 233 * @lport: TCP port to redirect to or zero.
234 * @sk: The TIME_WAIT TCP socket found by the lookup. 234 * @sk: The TIME_WAIT TCP socket found by the lookup.
235 * 235 *
236 * We have to handle SYN packets arriving to TIME_WAIT sockets 236 * We have to handle SYN packets arriving to TIME_WAIT sockets
237 * differently: instead of reopening the connection we should rather 237 * differently: instead of reopening the connection we should rather
238 * redirect the new connection to the proxy if there's a listener 238 * redirect the new connection to the proxy if there's a listener
239 * socket present. 239 * socket present.
240 * 240 *
241 * tproxy_handle_time_wait4() consumes the socket reference passed in. 241 * tproxy_handle_time_wait4() consumes the socket reference passed in.
242 * 242 *
243 * Returns the listener socket if there's one, the TIME_WAIT socket if 243 * Returns the listener socket if there's one, the TIME_WAIT socket if
244 * no such listener is found, or NULL if the TCP header is incomplete. 244 * no such listener is found, or NULL if the TCP header is incomplete.
245 */ 245 */
246 static struct sock * 246 static struct sock *
247 tproxy_handle_time_wait4(struct sk_buff *skb, __be32 laddr, __be16 lport, 247 tproxy_handle_time_wait4(struct sk_buff *skb, __be32 laddr, __be16 lport,
248 struct sock *sk) 248 struct sock *sk)
249 { 249 {
250 const struct iphdr *iph = ip_hdr(skb); 250 const struct iphdr *iph = ip_hdr(skb);
251 struct tcphdr _hdr, *hp; 251 struct tcphdr _hdr, *hp;
252 252
253 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); 253 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
254 if (hp == NULL) { 254 if (hp == NULL) {
255 inet_twsk_put(inet_twsk(sk)); 255 inet_twsk_put(inet_twsk(sk));
256 return NULL; 256 return NULL;
257 } 257 }
258 258
259 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) { 259 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
260 /* SYN to a TIME_WAIT socket, we'd rather redirect it 260 /* SYN to a TIME_WAIT socket, we'd rather redirect it
261 * to a listener socket if there's one */ 261 * to a listener socket if there's one */
262 struct sock *sk2; 262 struct sock *sk2;
263 263
264 sk2 = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, 264 sk2 = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
265 iph->saddr, laddr ? laddr : iph->daddr, 265 iph->saddr, laddr ? laddr : iph->daddr,
266 hp->source, lport ? lport : hp->dest, 266 hp->source, lport ? lport : hp->dest,
267 skb->dev, NFT_LOOKUP_LISTENER); 267 skb->dev, NFT_LOOKUP_LISTENER);
268 if (sk2) { 268 if (sk2) {
269 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); 269 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
270 inet_twsk_put(inet_twsk(sk)); 270 inet_twsk_put(inet_twsk(sk));
271 sk = sk2; 271 sk = sk2;
272 } 272 }
273 } 273 }
274 274
275 return sk; 275 return sk;
276 } 276 }
277 277
278 /* assign a socket to the skb -- consumes sk */ 278 /* assign a socket to the skb -- consumes sk */
279 static void 279 static void
280 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk) 280 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
281 { 281 {
282 skb_orphan(skb); 282 skb_orphan(skb);
283 skb->sk = sk; 283 skb->sk = sk;
284 skb->destructor = sock_edemux; 284 skb->destructor = sock_edemux;
285 } 285 }
286 286
287 static unsigned int 287 static unsigned int
288 tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport, 288 tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
289 u_int32_t mark_mask, u_int32_t mark_value) 289 u_int32_t mark_mask, u_int32_t mark_value)
290 { 290 {
291 const struct iphdr *iph = ip_hdr(skb); 291 const struct iphdr *iph = ip_hdr(skb);
292 struct udphdr _hdr, *hp; 292 struct udphdr _hdr, *hp;
293 struct sock *sk; 293 struct sock *sk;
294 294
295 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); 295 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
296 if (hp == NULL) 296 if (hp == NULL)
297 return NF_DROP; 297 return NF_DROP;
298 298
299 /* check if there's an ongoing connection on the packet 299 /* check if there's an ongoing connection on the packet
300 * addresses, this happens if the redirect already happened 300 * addresses, this happens if the redirect already happened
301 * and the current packet belongs to an already established 301 * and the current packet belongs to an already established
302 * connection */ 302 * connection */
303 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, 303 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
304 iph->saddr, iph->daddr, 304 iph->saddr, iph->daddr,
305 hp->source, hp->dest, 305 hp->source, hp->dest,
306 skb->dev, NFT_LOOKUP_ESTABLISHED); 306 skb->dev, NFT_LOOKUP_ESTABLISHED);
307 307
308 laddr = tproxy_laddr4(skb, laddr, iph->daddr); 308 laddr = tproxy_laddr4(skb, laddr, iph->daddr);
309 if (!lport) 309 if (!lport)
310 lport = hp->dest; 310 lport = hp->dest;
311 311
312 /* UDP has no TCP_TIME_WAIT state, so we never enter here */ 312 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
313 if (sk && sk->sk_state == TCP_TIME_WAIT) 313 if (sk && sk->sk_state == TCP_TIME_WAIT)
314 /* reopening a TIME_WAIT connection needs special handling */ 314 /* reopening a TIME_WAIT connection needs special handling */
315 sk = tproxy_handle_time_wait4(skb, laddr, lport, sk); 315 sk = tproxy_handle_time_wait4(skb, laddr, lport, sk);
316 else if (!sk) 316 else if (!sk)
317 /* no, there's no established connection, check if 317 /* no, there's no established connection, check if
318 * there's a listener on the redirected addr/port */ 318 * there's a listener on the redirected addr/port */
319 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, 319 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
320 iph->saddr, laddr, 320 iph->saddr, laddr,
321 hp->source, lport, 321 hp->source, lport,
322 skb->dev, NFT_LOOKUP_LISTENER); 322 skb->dev, NFT_LOOKUP_LISTENER);
323 323
324 /* NOTE: assign_sock consumes our sk reference */ 324 /* NOTE: assign_sock consumes our sk reference */
325 if (sk && tproxy_sk_is_transparent(sk)) { 325 if (sk && tproxy_sk_is_transparent(sk)) {
326 /* This should be in a separate target, but we don't do multiple 326 /* This should be in a separate target, but we don't do multiple
327 targets on the same rule yet */ 327 targets on the same rule yet */
328 skb->mark = (skb->mark & ~mark_mask) ^ mark_value; 328 skb->mark = (skb->mark & ~mark_mask) ^ mark_value;
329 329
330 pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n", 330 pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
331 iph->protocol, &iph->daddr, ntohs(hp->dest), 331 iph->protocol, &iph->daddr, ntohs(hp->dest),
332 &laddr, ntohs(lport), skb->mark); 332 &laddr, ntohs(lport), skb->mark);
333 333
334 nf_tproxy_assign_sock(skb, sk); 334 nf_tproxy_assign_sock(skb, sk);
335 return NF_ACCEPT; 335 return NF_ACCEPT;
336 } 336 }
337 337
338 pr_debug("no socket, dropping: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n", 338 pr_debug("no socket, dropping: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
339 iph->protocol, &iph->saddr, ntohs(hp->source), 339 iph->protocol, &iph->saddr, ntohs(hp->source),
340 &iph->daddr, ntohs(hp->dest), skb->mark); 340 &iph->daddr, ntohs(hp->dest), skb->mark);
341 return NF_DROP; 341 return NF_DROP;
342 } 342 }
343 343
344 static unsigned int 344 static unsigned int
345 tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par) 345 tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par)
346 { 346 {
347 const struct xt_tproxy_target_info *tgi = par->targinfo; 347 const struct xt_tproxy_target_info *tgi = par->targinfo;
348 348
349 return tproxy_tg4(skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value); 349 return tproxy_tg4(skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value);
350 } 350 }
351 351
352 static unsigned int 352 static unsigned int
353 tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par) 353 tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par)
354 { 354 {
355 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo; 355 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
356 356
357 return tproxy_tg4(skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value); 357 return tproxy_tg4(skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value);
358 } 358 }
359 359
360 #ifdef XT_TPROXY_HAVE_IPV6 360 #ifdef XT_TPROXY_HAVE_IPV6
361 361
362 static inline const struct in6_addr * 362 static inline const struct in6_addr *
363 tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr, 363 tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
364 const struct in6_addr *daddr) 364 const struct in6_addr *daddr)
365 { 365 {
366 struct inet6_dev *indev; 366 struct inet6_dev *indev;
367 struct inet6_ifaddr *ifa; 367 struct inet6_ifaddr *ifa;
368 struct in6_addr *laddr; 368 struct in6_addr *laddr;
369 369
370 if (!ipv6_addr_any(user_laddr)) 370 if (!ipv6_addr_any(user_laddr))
371 return user_laddr; 371 return user_laddr;
372 laddr = NULL; 372 laddr = NULL;
373 373
374 rcu_read_lock(); 374 rcu_read_lock();
375 indev = __in6_dev_get(skb->dev); 375 indev = __in6_dev_get(skb->dev);
376 if (indev) 376 if (indev)
377 list_for_each_entry(ifa, &indev->addr_list, if_list) { 377 list_for_each_entry(ifa, &indev->addr_list, if_list) {
378 if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED)) 378 if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
379 continue; 379 continue;
380 380
381 laddr = &ifa->addr; 381 laddr = &ifa->addr;
382 break; 382 break;
383 } 383 }
384 rcu_read_unlock(); 384 rcu_read_unlock();
385 385
386 return laddr ? laddr : daddr; 386 return laddr ? laddr : daddr;
387 } 387 }
388 388
389 /** 389 /**
390 * tproxy_handle_time_wait6 - handle IPv6 TCP TIME_WAIT reopen redirections 390 * tproxy_handle_time_wait6 - handle IPv6 TCP TIME_WAIT reopen redirections
391 * @skb: The skb being processed. 391 * @skb: The skb being processed.
392 * @tproto: Transport protocol. 392 * @tproto: Transport protocol.
393 * @thoff: Transport protocol header offset. 393 * @thoff: Transport protocol header offset.
394 * @par: Iptables target parameters. 394 * @par: Iptables target parameters.
395 * @sk: The TIME_WAIT TCP socket found by the lookup. 395 * @sk: The TIME_WAIT TCP socket found by the lookup.
396 * 396 *
397 * We have to handle SYN packets arriving to TIME_WAIT sockets 397 * We have to handle SYN packets arriving to TIME_WAIT sockets
398 * differently: instead of reopening the connection we should rather 398 * differently: instead of reopening the connection we should rather
399 * redirect the new connection to the proxy if there's a listener 399 * redirect the new connection to the proxy if there's a listener
400 * socket present. 400 * socket present.
401 * 401 *
402 * tproxy_handle_time_wait6() consumes the socket reference passed in. 402 * tproxy_handle_time_wait6() consumes the socket reference passed in.
403 * 403 *
404 * Returns the listener socket if there's one, the TIME_WAIT socket if 404 * Returns the listener socket if there's one, the TIME_WAIT socket if
405 * no such listener is found, or NULL if the TCP header is incomplete. 405 * no such listener is found, or NULL if the TCP header is incomplete.
406 */ 406 */
407 static struct sock * 407 static struct sock *
408 tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff, 408 tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
409 const struct xt_action_param *par, 409 const struct xt_action_param *par,
410 struct sock *sk) 410 struct sock *sk)
411 { 411 {
412 const struct ipv6hdr *iph = ipv6_hdr(skb); 412 const struct ipv6hdr *iph = ipv6_hdr(skb);
413 struct tcphdr _hdr, *hp; 413 struct tcphdr _hdr, *hp;
414 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo; 414 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
415 415
416 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr); 416 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
417 if (hp == NULL) { 417 if (hp == NULL) {
418 inet_twsk_put(inet_twsk(sk)); 418 inet_twsk_put(inet_twsk(sk));
419 return NULL; 419 return NULL;
420 } 420 }
421 421
422 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) { 422 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
423 /* SYN to a TIME_WAIT socket, we'd rather redirect it 423 /* SYN to a TIME_WAIT socket, we'd rather redirect it
424 * to a listener socket if there's one */ 424 * to a listener socket if there's one */
425 struct sock *sk2; 425 struct sock *sk2;
426 426
427 sk2 = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, 427 sk2 = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
428 &iph->saddr, 428 &iph->saddr,
429 tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr), 429 tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr),
430 hp->source, 430 hp->source,
431 tgi->lport ? tgi->lport : hp->dest, 431 tgi->lport ? tgi->lport : hp->dest,
432 skb->dev, NFT_LOOKUP_LISTENER); 432 skb->dev, NFT_LOOKUP_LISTENER);
433 if (sk2) { 433 if (sk2) {
434 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); 434 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
435 inet_twsk_put(inet_twsk(sk)); 435 inet_twsk_put(inet_twsk(sk));
436 sk = sk2; 436 sk = sk2;
437 } 437 }
438 } 438 }
439 439
440 return sk; 440 return sk;
441 } 441 }
442 442
443 static unsigned int 443 static unsigned int
444 tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par) 444 tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
445 { 445 {
446 const struct ipv6hdr *iph = ipv6_hdr(skb); 446 const struct ipv6hdr *iph = ipv6_hdr(skb);
447 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo; 447 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
448 struct udphdr _hdr, *hp; 448 struct udphdr _hdr, *hp;
449 struct sock *sk; 449 struct sock *sk;
450 const struct in6_addr *laddr; 450 const struct in6_addr *laddr;
451 __be16 lport; 451 __be16 lport;
452 int thoff = 0; 452 int thoff = 0;
453 int tproto; 453 int tproto;
454 454
455 tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL); 455 tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
456 if (tproto < 0) { 456 if (tproto < 0) {
457 pr_debug("unable to find transport header in IPv6 packet, dropping\n"); 457 pr_debug("unable to find transport header in IPv6 packet, dropping\n");
458 return NF_DROP; 458 return NF_DROP;
459 } 459 }
460 460
461 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr); 461 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
462 if (hp == NULL) { 462 if (hp == NULL) {
463 pr_debug("unable to grab transport header contents in IPv6 packet, dropping\n"); 463 pr_debug("unable to grab transport header contents in IPv6 packet, dropping\n");
464 return NF_DROP; 464 return NF_DROP;
465 } 465 }
466 466
467 /* check if there's an ongoing connection on the packet 467 /* check if there's an ongoing connection on the packet
468 * addresses, this happens if the redirect already happened 468 * addresses, this happens if the redirect already happened
469 * and the current packet belongs to an already established 469 * and the current packet belongs to an already established
470 * connection */ 470 * connection */
471 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, 471 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
472 &iph->saddr, &iph->daddr, 472 &iph->saddr, &iph->daddr,
473 hp->source, hp->dest, 473 hp->source, hp->dest,
474 par->in, NFT_LOOKUP_ESTABLISHED); 474 par->in, NFT_LOOKUP_ESTABLISHED);
475 475
476 laddr = tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr); 476 laddr = tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr);
477 lport = tgi->lport ? tgi->lport : hp->dest; 477 lport = tgi->lport ? tgi->lport : hp->dest;
478 478
479 /* UDP has no TCP_TIME_WAIT state, so we never enter here */ 479 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
480 if (sk && sk->sk_state == TCP_TIME_WAIT) 480 if (sk && sk->sk_state == TCP_TIME_WAIT)
481 /* reopening a TIME_WAIT connection needs special handling */ 481 /* reopening a TIME_WAIT connection needs special handling */
482 sk = tproxy_handle_time_wait6(skb, tproto, thoff, par, sk); 482 sk = tproxy_handle_time_wait6(skb, tproto, thoff, par, sk);
483 else if (!sk) 483 else if (!sk)
484 /* no there's no established connection, check if 484 /* no there's no established connection, check if
485 * there's a listener on the redirected addr/port */ 485 * there's a listener on the redirected addr/port */
486 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, 486 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
487 &iph->saddr, laddr, 487 &iph->saddr, laddr,
488 hp->source, lport, 488 hp->source, lport,
489 par->in, NFT_LOOKUP_LISTENER); 489 par->in, NFT_LOOKUP_LISTENER);
490 490
491 /* NOTE: assign_sock consumes our sk reference */ 491 /* NOTE: assign_sock consumes our sk reference */
492 if (sk && tproxy_sk_is_transparent(sk)) { 492 if (sk && tproxy_sk_is_transparent(sk)) {
493 /* This should be in a separate target, but we don't do multiple 493 /* This should be in a separate target, but we don't do multiple
494 targets on the same rule yet */ 494 targets on the same rule yet */
495 skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value; 495 skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
496 496
497 pr_debug("redirecting: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n", 497 pr_debug("redirecting: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
498 tproto, &iph->saddr, ntohs(hp->source), 498 tproto, &iph->saddr, ntohs(hp->source),
499 laddr, ntohs(lport), skb->mark); 499 laddr, ntohs(lport), skb->mark);
500 500
501 nf_tproxy_assign_sock(skb, sk); 501 nf_tproxy_assign_sock(skb, sk);
502 return NF_ACCEPT; 502 return NF_ACCEPT;
503 } 503 }
504 504
505 pr_debug("no socket, dropping: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n", 505 pr_debug("no socket, dropping: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
506 tproto, &iph->saddr, ntohs(hp->source), 506 tproto, &iph->saddr, ntohs(hp->source),
507 &iph->daddr, ntohs(hp->dest), skb->mark); 507 &iph->daddr, ntohs(hp->dest), skb->mark);
508 508
509 return NF_DROP; 509 return NF_DROP;
510 } 510 }
511 511
512 static int tproxy_tg6_check(const struct xt_tgchk_param *par) 512 static int tproxy_tg6_check(const struct xt_tgchk_param *par)
513 { 513 {
514 const struct ip6t_ip6 *i = par->entryinfo; 514 const struct ip6t_ip6 *i = par->entryinfo;
515 515
516 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) 516 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
517 && !(i->flags & IP6T_INV_PROTO)) 517 !(i->invflags & IP6T_INV_PROTO))
518 return 0; 518 return 0;
519 519
520 pr_info("Can be used only in combination with " 520 pr_info("Can be used only in combination with "
521 "either -p tcp or -p udp\n"); 521 "either -p tcp or -p udp\n");
522 return -EINVAL; 522 return -EINVAL;
523 } 523 }
524 #endif 524 #endif
525 525
526 static int tproxy_tg4_check(const struct xt_tgchk_param *par) 526 static int tproxy_tg4_check(const struct xt_tgchk_param *par)
527 { 527 {
528 const struct ipt_ip *i = par->entryinfo; 528 const struct ipt_ip *i = par->entryinfo;
529 529
530 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) 530 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
531 && !(i->invflags & IPT_INV_PROTO)) 531 && !(i->invflags & IPT_INV_PROTO))
532 return 0; 532 return 0;
533 533
534 pr_info("Can be used only in combination with " 534 pr_info("Can be used only in combination with "
535 "either -p tcp or -p udp\n"); 535 "either -p tcp or -p udp\n");
536 return -EINVAL; 536 return -EINVAL;
537 } 537 }
538 538
539 static struct xt_target tproxy_tg_reg[] __read_mostly = { 539 static struct xt_target tproxy_tg_reg[] __read_mostly = {
540 { 540 {
541 .name = "TPROXY", 541 .name = "TPROXY",
542 .family = NFPROTO_IPV4, 542 .family = NFPROTO_IPV4,
543 .table = "mangle", 543 .table = "mangle",
544 .target = tproxy_tg4_v0, 544 .target = tproxy_tg4_v0,
545 .revision = 0, 545 .revision = 0,
546 .targetsize = sizeof(struct xt_tproxy_target_info), 546 .targetsize = sizeof(struct xt_tproxy_target_info),
547 .checkentry = tproxy_tg4_check, 547 .checkentry = tproxy_tg4_check,
548 .hooks = 1 << NF_INET_PRE_ROUTING, 548 .hooks = 1 << NF_INET_PRE_ROUTING,
549 .me = THIS_MODULE, 549 .me = THIS_MODULE,
550 }, 550 },
551 { 551 {
552 .name = "TPROXY", 552 .name = "TPROXY",
553 .family = NFPROTO_IPV4, 553 .family = NFPROTO_IPV4,
554 .table = "mangle", 554 .table = "mangle",
555 .target = tproxy_tg4_v1, 555 .target = tproxy_tg4_v1,
556 .revision = 1, 556 .revision = 1,
557 .targetsize = sizeof(struct xt_tproxy_target_info_v1), 557 .targetsize = sizeof(struct xt_tproxy_target_info_v1),
558 .checkentry = tproxy_tg4_check, 558 .checkentry = tproxy_tg4_check,
559 .hooks = 1 << NF_INET_PRE_ROUTING, 559 .hooks = 1 << NF_INET_PRE_ROUTING,
560 .me = THIS_MODULE, 560 .me = THIS_MODULE,
561 }, 561 },
562 #ifdef XT_TPROXY_HAVE_IPV6 562 #ifdef XT_TPROXY_HAVE_IPV6
563 { 563 {
564 .name = "TPROXY", 564 .name = "TPROXY",
565 .family = NFPROTO_IPV6, 565 .family = NFPROTO_IPV6,
566 .table = "mangle", 566 .table = "mangle",
567 .target = tproxy_tg6_v1, 567 .target = tproxy_tg6_v1,
568 .revision = 1, 568 .revision = 1,
569 .targetsize = sizeof(struct xt_tproxy_target_info_v1), 569 .targetsize = sizeof(struct xt_tproxy_target_info_v1),
570 .checkentry = tproxy_tg6_check, 570 .checkentry = tproxy_tg6_check,
571 .hooks = 1 << NF_INET_PRE_ROUTING, 571 .hooks = 1 << NF_INET_PRE_ROUTING,
572 .me = THIS_MODULE, 572 .me = THIS_MODULE,
573 }, 573 },
574 #endif 574 #endif
575 575
576 }; 576 };
577 577
578 static int __init tproxy_tg_init(void) 578 static int __init tproxy_tg_init(void)
579 { 579 {
580 nf_defrag_ipv4_enable(); 580 nf_defrag_ipv4_enable();
581 #ifdef XT_TPROXY_HAVE_IPV6 581 #ifdef XT_TPROXY_HAVE_IPV6
582 nf_defrag_ipv6_enable(); 582 nf_defrag_ipv6_enable();
583 #endif 583 #endif
584 584
585 return xt_register_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg)); 585 return xt_register_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
586 } 586 }
587 587
588 static void __exit tproxy_tg_exit(void) 588 static void __exit tproxy_tg_exit(void)
589 { 589 {
590 xt_unregister_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg)); 590 xt_unregister_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
591 } 591 }
592 592
593 module_init(tproxy_tg_init); 593 module_init(tproxy_tg_init);
594 module_exit(tproxy_tg_exit); 594 module_exit(tproxy_tg_exit);
595 MODULE_LICENSE("GPL"); 595 MODULE_LICENSE("GPL");
596 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs"); 596 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
597 MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module."); 597 MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module.");
598 MODULE_ALIAS("ipt_TPROXY"); 598 MODULE_ALIAS("ipt_TPROXY");
599 MODULE_ALIAS("ip6t_TPROXY"); 599 MODULE_ALIAS("ip6t_TPROXY");
600 600