1
2#include <linux/module.h>
3#include <linux/netfilter/nf_tables.h>
4#include <net/netfilter/nf_tables.h>
5#include <net/netfilter/nf_tables_core.h>
6#include <net/netfilter/nf_tproxy.h>
7#include <net/inet_sock.h>
8#include <net/tcp.h>
9#include <linux/if_ether.h>
10#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
11#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
12#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
13#endif
14
15struct nft_tproxy {
16 enum nft_registers sreg_addr:8;
17 enum nft_registers sreg_port:8;
18 u8 family;
19};
20
21static void nft_tproxy_eval_v4(const struct nft_expr *expr,
22 struct nft_regs *regs,
23 const struct nft_pktinfo *pkt)
24{
25 const struct nft_tproxy *priv = nft_expr_priv(expr);
26 struct sk_buff *skb = pkt->skb;
27 const struct iphdr *iph = ip_hdr(skb);
28 struct udphdr _hdr, *hp;
29 __be32 taddr = 0;
30 __be16 tport = 0;
31 struct sock *sk;
32
33 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
34 if (!hp) {
35 regs->verdict.code = NFT_BREAK;
36 return;
37 }
38
39
40
41
42
43 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
44 iph->saddr, iph->daddr,
45 hp->source, hp->dest,
46 skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
47
48 if (priv->sreg_addr)
49 taddr = regs->data[priv->sreg_addr];
50 taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
51
52 if (priv->sreg_port)
53 tport = nft_reg_load16(®s->data[priv->sreg_port]);
54 if (!tport)
55 tport = hp->dest;
56
57
58 if (sk && sk->sk_state == TCP_TIME_WAIT) {
59
60 sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
61 } else if (!sk) {
62
63
64
65 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
66 iph->saddr, taddr,
67 hp->source, tport,
68 skb->dev, NF_TPROXY_LOOKUP_LISTENER);
69 }
70
71 if (sk && nf_tproxy_sk_is_transparent(sk))
72 nf_tproxy_assign_sock(skb, sk);
73 else
74 regs->verdict.code = NFT_BREAK;
75}
76
77#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
78static void nft_tproxy_eval_v6(const struct nft_expr *expr,
79 struct nft_regs *regs,
80 const struct nft_pktinfo *pkt)
81{
82 const struct nft_tproxy *priv = nft_expr_priv(expr);
83 struct sk_buff *skb = pkt->skb;
84 const struct ipv6hdr *iph = ipv6_hdr(skb);
85 struct in6_addr taddr;
86 int thoff = pkt->xt.thoff;
87 struct udphdr _hdr, *hp;
88 __be16 tport = 0;
89 struct sock *sk;
90 int l4proto;
91
92 memset(&taddr, 0, sizeof(taddr));
93
94 if (!pkt->tprot_set) {
95 regs->verdict.code = NFT_BREAK;
96 return;
97 }
98 l4proto = pkt->tprot;
99
100 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
101 if (hp == NULL) {
102 regs->verdict.code = NFT_BREAK;
103 return;
104 }
105
106
107
108
109
110 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
111 &iph->saddr, &iph->daddr,
112 hp->source, hp->dest,
113 nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
114
115 if (priv->sreg_addr)
116 memcpy(&taddr, ®s->data[priv->sreg_addr], sizeof(taddr));
117 taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
118
119 if (priv->sreg_port)
120 tport = nft_reg_load16(®s->data[priv->sreg_port]);
121 if (!tport)
122 tport = hp->dest;
123
124
125 if (sk && sk->sk_state == TCP_TIME_WAIT) {
126
127 sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
128 nft_net(pkt),
129 &taddr,
130 tport,
131 sk);
132 } else if (!sk) {
133
134
135
136 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
137 l4proto, &iph->saddr, &taddr,
138 hp->source, tport,
139 nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
140 }
141
142
143 if (sk && nf_tproxy_sk_is_transparent(sk))
144 nf_tproxy_assign_sock(skb, sk);
145 else
146 regs->verdict.code = NFT_BREAK;
147}
148#endif
149
150static void nft_tproxy_eval(const struct nft_expr *expr,
151 struct nft_regs *regs,
152 const struct nft_pktinfo *pkt)
153{
154 const struct nft_tproxy *priv = nft_expr_priv(expr);
155
156 switch (nft_pf(pkt)) {
157 case NFPROTO_IPV4:
158 switch (priv->family) {
159 case NFPROTO_IPV4:
160 case NFPROTO_UNSPEC:
161 nft_tproxy_eval_v4(expr, regs, pkt);
162 return;
163 }
164 break;
165#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
166 case NFPROTO_IPV6:
167 switch (priv->family) {
168 case NFPROTO_IPV6:
169 case NFPROTO_UNSPEC:
170 nft_tproxy_eval_v6(expr, regs, pkt);
171 return;
172 }
173#endif
174 }
175 regs->verdict.code = NFT_BREAK;
176}
177
178static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
179 [NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },
180 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
181 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
182};
183
184static int nft_tproxy_init(const struct nft_ctx *ctx,
185 const struct nft_expr *expr,
186 const struct nlattr * const tb[])
187{
188 struct nft_tproxy *priv = nft_expr_priv(expr);
189 unsigned int alen = 0;
190 int err;
191
192 if (!tb[NFTA_TPROXY_FAMILY] ||
193 (!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
194 return -EINVAL;
195
196 priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
197
198 switch (ctx->family) {
199 case NFPROTO_IPV4:
200 if (priv->family != NFPROTO_IPV4)
201 return -EINVAL;
202 break;
203#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
204 case NFPROTO_IPV6:
205 if (priv->family != NFPROTO_IPV6)
206 return -EINVAL;
207 break;
208#endif
209 case NFPROTO_INET:
210 break;
211 default:
212 return -EOPNOTSUPP;
213 }
214
215
216 if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
217 return -EINVAL;
218
219 switch (priv->family) {
220 case NFPROTO_IPV4:
221 alen = sizeof_field(union nf_inet_addr, in);
222 err = nf_defrag_ipv4_enable(ctx->net);
223 if (err)
224 return err;
225 break;
226#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
227 case NFPROTO_IPV6:
228 alen = sizeof_field(union nf_inet_addr, in6);
229 err = nf_defrag_ipv6_enable(ctx->net);
230 if (err)
231 return err;
232 break;
233#endif
234 case NFPROTO_UNSPEC:
235
236 err = nf_defrag_ipv4_enable(ctx->net);
237 if (err)
238 return err;
239#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
240 err = nf_defrag_ipv6_enable(ctx->net);
241 if (err)
242 return err;
243#endif
244 break;
245 default:
246 return -EOPNOTSUPP;
247 }
248
249 if (tb[NFTA_TPROXY_REG_ADDR]) {
250 priv->sreg_addr = nft_parse_register(tb[NFTA_TPROXY_REG_ADDR]);
251 err = nft_validate_register_load(priv->sreg_addr, alen);
252 if (err < 0)
253 return err;
254 }
255
256 if (tb[NFTA_TPROXY_REG_PORT]) {
257 priv->sreg_port = nft_parse_register(tb[NFTA_TPROXY_REG_PORT]);
258 err = nft_validate_register_load(priv->sreg_port, sizeof(u16));
259 if (err < 0)
260 return err;
261 }
262
263 return 0;
264}
265
266static int nft_tproxy_dump(struct sk_buff *skb,
267 const struct nft_expr *expr)
268{
269 const struct nft_tproxy *priv = nft_expr_priv(expr);
270
271 if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
272 return -1;
273
274 if (priv->sreg_addr &&
275 nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
276 return -1;
277
278 if (priv->sreg_port &&
279 nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
280 return -1;
281
282 return 0;
283}
284
285static struct nft_expr_type nft_tproxy_type;
286static const struct nft_expr_ops nft_tproxy_ops = {
287 .type = &nft_tproxy_type,
288 .size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
289 .eval = nft_tproxy_eval,
290 .init = nft_tproxy_init,
291 .dump = nft_tproxy_dump,
292};
293
294static struct nft_expr_type nft_tproxy_type __read_mostly = {
295 .name = "tproxy",
296 .ops = &nft_tproxy_ops,
297 .policy = nft_tproxy_policy,
298 .maxattr = NFTA_TPROXY_MAX,
299 .owner = THIS_MODULE,
300};
301
302static int __init nft_tproxy_module_init(void)
303{
304 return nft_register_expr(&nft_tproxy_type);
305}
306
307static void __exit nft_tproxy_module_exit(void)
308{
309 nft_unregister_expr(&nft_tproxy_type);
310}
311
312module_init(nft_tproxy_module_init);
313module_exit(nft_tproxy_module_exit);
314
315MODULE_LICENSE("GPL");
316MODULE_AUTHOR("Máté Eckl");
317MODULE_DESCRIPTION("nf_tables tproxy support module");
318MODULE_ALIAS_NFT_EXPR("tproxy");
319
