LXR linux/net/ipv6/netfilter/nf_tproxy

   1// SPDX-License-Identifier: GPL-2.0-only
   2#include <net/netfilter/nf_tproxy.h>
   3#include <linux/module.h>
   4#include <net/inet6_hashtables.h>
   5#include <net/addrconf.h>
   6#include <net/udp.h>
   7#include <net/tcp.h>
   8
   9const struct in6_addr *
  10nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
  11              const struct in6_addr *daddr)
  12{
  13        struct inet6_dev *indev;
  14        struct inet6_ifaddr *ifa;
  15        struct in6_addr *laddr;
  16
  17        if (!ipv6_addr_any(user_laddr))
  18                return user_laddr;
  19        laddr = NULL;
  20
  21        indev = __in6_dev_get(skb->dev);
  22        if (indev) {
  23                read_lock_bh(&indev->lock);
  24                list_for_each_entry(ifa, &indev->addr_list, if_list) {
  25                        if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
  26                                continue;
  27
  28                        laddr = &ifa->addr;
  29                        break;
  30                }
  31                read_unlock_bh(&indev->lock);
  32        }
  33
  34        return laddr ? laddr : daddr;
  35}
  36EXPORT_SYMBOL_GPL(nf_tproxy_laddr6);
  37
  38struct sock *
  39nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
  40                         struct net *net,
  41                         const struct in6_addr *laddr,
  42                         const __be16 lport,
  43                         struct sock *sk)
  44{
  45        const struct ipv6hdr *iph = ipv6_hdr(skb);
  46        struct tcphdr _hdr, *hp;
  47
  48        hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
  49        if (hp == NULL) {
  50                inet_twsk_put(inet_twsk(sk));
  51                return NULL;
  52        }
  53
  54        if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
  55                /* SYN to a TIME_WAIT socket, we'd rather redirect it
  56                 * to a listener socket if there's one */
  57                struct sock *sk2;
  58
  59                sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
  60                                            &iph->saddr,
  61                                            nf_tproxy_laddr6(skb, laddr, &iph->daddr),
  62                                            hp->source,
  63                                            lport ? lport : hp->dest,
  64                                            skb->dev, NF_TPROXY_LOOKUP_LISTENER);
  65                if (sk2) {
  66                        inet_twsk_deschedule_put(inet_twsk(sk));
  67                        sk = sk2;
  68                }
  69        }
  70
  71        return sk;
  72}
  73EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
  74
  75struct sock *
  76nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
  77                      const u8 protocol,
  78                      const struct in6_addr *saddr, const struct in6_addr *daddr,
  79                      const __be16 sport, const __be16 dport,
  80                      const struct net_device *in,
  81                      const enum nf_tproxy_lookup_t lookup_type)
  82{
  83        struct sock *sk;
  84
  85        switch (protocol) {
  86        case IPPROTO_TCP: {
  87                struct tcphdr _hdr, *hp;
  88
  89                hp = skb_header_pointer(skb, thoff,
  90                                        sizeof(struct tcphdr), &_hdr);
  91                if (hp == NULL)
  92                        return NULL;
  93
  94                switch (lookup_type) {
  95                case NF_TPROXY_LOOKUP_LISTENER:
  96                        sk = inet6_lookup_listener(net, &tcp_hashinfo, skb,
  97                                                   thoff + __tcp_hdrlen(hp),
  98                                                   saddr, sport,
  99                                                   daddr, ntohs(dport),
 100                                                   in->ifindex, 0);
 101
 102                        if (sk && !refcount_inc_not_zero(&sk->sk_refcnt))
 103                                sk = NULL;
 104                        /* NOTE: we return listeners even if bound to
 105                         * 0.0.0.0, those are filtered out in
 106                         * xt_socket, since xt_TPROXY needs 0 bound
 107                         * listeners too
 108                         */
 109                        break;
 110                case NF_TPROXY_LOOKUP_ESTABLISHED:
 111                        sk = __inet6_lookup_established(net, &tcp_hashinfo,
 112                                                        saddr, sport, daddr, ntohs(dport),
 113                                                        in->ifindex, 0);
 114                        break;
 115                default:
 116                        BUG();
 117                }
 118                break;
 119                }
 120        case IPPROTO_UDP:
 121                sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
 122                                     in->ifindex);
 123                if (sk) {
 124                        int connected = (sk->sk_state == TCP_ESTABLISHED);
 125                        int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr);
 126
 127                        /* NOTE: we return listeners even if bound to
 128                         * 0.0.0.0, those are filtered out in
 129                         * xt_socket, since xt_TPROXY needs 0 bound
 130                         * listeners too
 131                         */
 132                        if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
 133                            (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) {
 134                                sock_put(sk);
 135                                sk = NULL;
 136                        }
 137                }
 138                break;
 139        default:
 140                WARN_ON(1);
 141                sk = NULL;
 142        }
 143
 144        pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
 145                 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
 146
 147        return sk;
 148}
 149EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6);
 150
 151MODULE_LICENSE("GPL");
 152MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
 153MODULE_DESCRIPTION("Netfilter IPv4 transparent proxy support");
 154