nf_synproxy_core.c 31 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
  4. */
  5. #include <linux/module.h>
  6. #include <linux/skbuff.h>
  7. #include <asm/unaligned.h>
  8. #include <net/tcp.h>
  9. #include <net/netns/generic.h>
  10. #include <linux/proc_fs.h>
  11. #include <linux/netfilter_ipv6.h>
  12. #include <linux/netfilter/nf_synproxy.h>
  13. #include <net/netfilter/nf_conntrack.h>
  14. #include <net/netfilter/nf_conntrack_ecache.h>
  15. #include <net/netfilter/nf_conntrack_extend.h>
  16. #include <net/netfilter/nf_conntrack_seqadj.h>
  17. #include <net/netfilter/nf_conntrack_synproxy.h>
  18. #include <net/netfilter/nf_conntrack_zones.h>
  19. #include <net/netfilter/nf_synproxy.h>
  20. unsigned int synproxy_net_id;
  21. EXPORT_SYMBOL_GPL(synproxy_net_id);
  22. bool
  23. synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
  24. const struct tcphdr *th, struct synproxy_options *opts)
  25. {
  26. int length = (th->doff * 4) - sizeof(*th);
  27. u8 buf[40], *ptr;
  28. if (unlikely(length < 0))
  29. return false;
  30. ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
  31. if (ptr == NULL)
  32. return false;
  33. opts->options = 0;
  34. while (length > 0) {
  35. int opcode = *ptr++;
  36. int opsize;
  37. switch (opcode) {
  38. case TCPOPT_EOL:
  39. return true;
  40. case TCPOPT_NOP:
  41. length--;
  42. continue;
  43. default:
  44. if (length < 2)
  45. return true;
  46. opsize = *ptr++;
  47. if (opsize < 2)
  48. return true;
  49. if (opsize > length)
  50. return true;
  51. switch (opcode) {
  52. case TCPOPT_MSS:
  53. if (opsize == TCPOLEN_MSS) {
  54. opts->mss_option = get_unaligned_be16(ptr);
  55. opts->options |= NF_SYNPROXY_OPT_MSS;
  56. }
  57. break;
  58. case TCPOPT_WINDOW:
  59. if (opsize == TCPOLEN_WINDOW) {
  60. opts->wscale = *ptr;
  61. if (opts->wscale > TCP_MAX_WSCALE)
  62. opts->wscale = TCP_MAX_WSCALE;
  63. opts->options |= NF_SYNPROXY_OPT_WSCALE;
  64. }
  65. break;
  66. case TCPOPT_TIMESTAMP:
  67. if (opsize == TCPOLEN_TIMESTAMP) {
  68. opts->tsval = get_unaligned_be32(ptr);
  69. opts->tsecr = get_unaligned_be32(ptr + 4);
  70. opts->options |= NF_SYNPROXY_OPT_TIMESTAMP;
  71. }
  72. break;
  73. case TCPOPT_SACK_PERM:
  74. if (opsize == TCPOLEN_SACK_PERM)
  75. opts->options |= NF_SYNPROXY_OPT_SACK_PERM;
  76. break;
  77. }
  78. ptr += opsize - 2;
  79. length -= opsize;
  80. }
  81. }
  82. return true;
  83. }
  84. EXPORT_SYMBOL_GPL(synproxy_parse_options);
  85. static unsigned int
  86. synproxy_options_size(const struct synproxy_options *opts)
  87. {
  88. unsigned int size = 0;
  89. if (opts->options & NF_SYNPROXY_OPT_MSS)
  90. size += TCPOLEN_MSS_ALIGNED;
  91. if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
  92. size += TCPOLEN_TSTAMP_ALIGNED;
  93. else if (opts->options & NF_SYNPROXY_OPT_SACK_PERM)
  94. size += TCPOLEN_SACKPERM_ALIGNED;
  95. if (opts->options & NF_SYNPROXY_OPT_WSCALE)
  96. size += TCPOLEN_WSCALE_ALIGNED;
  97. return size;
  98. }
  99. static void
  100. synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
  101. {
  102. __be32 *ptr = (__be32 *)(th + 1);
  103. u8 options = opts->options;
  104. if (options & NF_SYNPROXY_OPT_MSS)
  105. *ptr++ = htonl((TCPOPT_MSS << 24) |
  106. (TCPOLEN_MSS << 16) |
  107. opts->mss_option);
  108. if (options & NF_SYNPROXY_OPT_TIMESTAMP) {
  109. if (options & NF_SYNPROXY_OPT_SACK_PERM)
  110. *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
  111. (TCPOLEN_SACK_PERM << 16) |
  112. (TCPOPT_TIMESTAMP << 8) |
  113. TCPOLEN_TIMESTAMP);
  114. else
  115. *ptr++ = htonl((TCPOPT_NOP << 24) |
  116. (TCPOPT_NOP << 16) |
  117. (TCPOPT_TIMESTAMP << 8) |
  118. TCPOLEN_TIMESTAMP);
  119. *ptr++ = htonl(opts->tsval);
  120. *ptr++ = htonl(opts->tsecr);
  121. } else if (options & NF_SYNPROXY_OPT_SACK_PERM)
  122. *ptr++ = htonl((TCPOPT_NOP << 24) |
  123. (TCPOPT_NOP << 16) |
  124. (TCPOPT_SACK_PERM << 8) |
  125. TCPOLEN_SACK_PERM);
  126. if (options & NF_SYNPROXY_OPT_WSCALE)
  127. *ptr++ = htonl((TCPOPT_NOP << 24) |
  128. (TCPOPT_WINDOW << 16) |
  129. (TCPOLEN_WINDOW << 8) |
  130. opts->wscale);
  131. }
  132. void synproxy_init_timestamp_cookie(const struct nf_synproxy_info *info,
  133. struct synproxy_options *opts)
  134. {
  135. opts->tsecr = opts->tsval;
  136. opts->tsval = tcp_time_stamp_raw() & ~0x3f;
  137. if (opts->options & NF_SYNPROXY_OPT_WSCALE) {
  138. opts->tsval |= opts->wscale;
  139. opts->wscale = info->wscale;
  140. } else
  141. opts->tsval |= 0xf;
  142. if (opts->options & NF_SYNPROXY_OPT_SACK_PERM)
  143. opts->tsval |= 1 << 4;
  144. if (opts->options & NF_SYNPROXY_OPT_ECN)
  145. opts->tsval |= 1 << 5;
  146. }
  147. EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);
  148. static void
  149. synproxy_check_timestamp_cookie(struct synproxy_options *opts)
  150. {
  151. opts->wscale = opts->tsecr & 0xf;
  152. if (opts->wscale != 0xf)
  153. opts->options |= NF_SYNPROXY_OPT_WSCALE;
  154. opts->options |= opts->tsecr & (1 << 4) ? NF_SYNPROXY_OPT_SACK_PERM : 0;
  155. opts->options |= opts->tsecr & (1 << 5) ? NF_SYNPROXY_OPT_ECN : 0;
  156. }
  157. static unsigned int
  158. synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff,
  159. struct tcphdr *th, struct nf_conn *ct,
  160. enum ip_conntrack_info ctinfo,
  161. const struct nf_conn_synproxy *synproxy)
  162. {
  163. unsigned int optoff, optend;
  164. __be32 *ptr, old;
  165. if (synproxy->tsoff == 0)
  166. return 1;
  167. optoff = protoff + sizeof(struct tcphdr);
  168. optend = protoff + th->doff * 4;
  169. if (skb_ensure_writable(skb, optend))
  170. return 0;
  171. while (optoff < optend) {
  172. unsigned char *op = skb->data + optoff;
  173. switch (op[0]) {
  174. case TCPOPT_EOL:
  175. return 1;
  176. case TCPOPT_NOP:
  177. optoff++;
  178. continue;
  179. default:
  180. if (optoff + 1 == optend ||
  181. optoff + op[1] > optend ||
  182. op[1] < 2)
  183. return 0;
  184. if (op[0] == TCPOPT_TIMESTAMP &&
  185. op[1] == TCPOLEN_TIMESTAMP) {
  186. if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
  187. ptr = (__be32 *)&op[2];
  188. old = *ptr;
  189. *ptr = htonl(ntohl(*ptr) -
  190. synproxy->tsoff);
  191. } else {
  192. ptr = (__be32 *)&op[6];
  193. old = *ptr;
  194. *ptr = htonl(ntohl(*ptr) +
  195. synproxy->tsoff);
  196. }
  197. inet_proto_csum_replace4(&th->check, skb,
  198. old, *ptr, false);
  199. return 1;
  200. }
  201. optoff += op[1];
  202. }
  203. }
  204. return 1;
  205. }
  206. static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
  207. .len = sizeof(struct nf_conn_synproxy),
  208. .align = __alignof__(struct nf_conn_synproxy),
  209. .id = NF_CT_EXT_SYNPROXY,
  210. };
  211. #ifdef CONFIG_PROC_FS
  212. static void *synproxy_cpu_seq_start(struct seq_file *seq, loff_t *pos)
  213. {
  214. struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
  215. int cpu;
  216. if (*pos == 0)
  217. return SEQ_START_TOKEN;
  218. for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
  219. if (!cpu_possible(cpu))
  220. continue;
  221. *pos = cpu + 1;
  222. return per_cpu_ptr(snet->stats, cpu);
  223. }
  224. return NULL;
  225. }
  226. static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  227. {
  228. struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
  229. int cpu;
  230. for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
  231. if (!cpu_possible(cpu))
  232. continue;
  233. *pos = cpu + 1;
  234. return per_cpu_ptr(snet->stats, cpu);
  235. }
  236. (*pos)++;
  237. return NULL;
  238. }
  239. static void synproxy_cpu_seq_stop(struct seq_file *seq, void *v)
  240. {
  241. return;
  242. }
  243. static int synproxy_cpu_seq_show(struct seq_file *seq, void *v)
  244. {
  245. struct synproxy_stats *stats = v;
  246. if (v == SEQ_START_TOKEN) {
  247. seq_puts(seq, "entries\t\tsyn_received\t"
  248. "cookie_invalid\tcookie_valid\t"
  249. "cookie_retrans\tconn_reopened\n");
  250. return 0;
  251. }
  252. seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
  253. stats->syn_received,
  254. stats->cookie_invalid,
  255. stats->cookie_valid,
  256. stats->cookie_retrans,
  257. stats->conn_reopened);
  258. return 0;
  259. }
  260. static const struct seq_operations synproxy_cpu_seq_ops = {
  261. .start = synproxy_cpu_seq_start,
  262. .next = synproxy_cpu_seq_next,
  263. .stop = synproxy_cpu_seq_stop,
  264. .show = synproxy_cpu_seq_show,
  265. };
  266. static int __net_init synproxy_proc_init(struct net *net)
  267. {
  268. if (!proc_create_net("synproxy", 0444, net->proc_net_stat,
  269. &synproxy_cpu_seq_ops, sizeof(struct seq_net_private)))
  270. return -ENOMEM;
  271. return 0;
  272. }
  273. static void __net_exit synproxy_proc_exit(struct net *net)
  274. {
  275. remove_proc_entry("synproxy", net->proc_net_stat);
  276. }
  277. #else
  278. static int __net_init synproxy_proc_init(struct net *net)
  279. {
  280. return 0;
  281. }
  282. static void __net_exit synproxy_proc_exit(struct net *net)
  283. {
  284. return;
  285. }
  286. #endif /* CONFIG_PROC_FS */
  287. static int __net_init synproxy_net_init(struct net *net)
  288. {
  289. struct synproxy_net *snet = synproxy_pernet(net);
  290. struct nf_conn *ct;
  291. int err = -ENOMEM;
  292. ct = nf_ct_tmpl_alloc(net, &nf_ct_zone_dflt, GFP_KERNEL);
  293. if (!ct)
  294. goto err1;
  295. if (!nfct_seqadj_ext_add(ct))
  296. goto err2;
  297. if (!nfct_synproxy_ext_add(ct))
  298. goto err2;
  299. __set_bit(IPS_CONFIRMED_BIT, &ct->status);
  300. nf_conntrack_get(&ct->ct_general);
  301. snet->tmpl = ct;
  302. snet->stats = alloc_percpu(struct synproxy_stats);
  303. if (snet->stats == NULL)
  304. goto err2;
  305. err = synproxy_proc_init(net);
  306. if (err < 0)
  307. goto err3;
  308. return 0;
  309. err3:
  310. free_percpu(snet->stats);
  311. err2:
  312. nf_ct_tmpl_free(ct);
  313. err1:
  314. return err;
  315. }
  316. static void __net_exit synproxy_net_exit(struct net *net)
  317. {
  318. struct synproxy_net *snet = synproxy_pernet(net);
  319. nf_ct_put(snet->tmpl);
  320. synproxy_proc_exit(net);
  321. free_percpu(snet->stats);
  322. }
  323. static struct pernet_operations synproxy_net_ops = {
  324. .init = synproxy_net_init,
  325. .exit = synproxy_net_exit,
  326. .id = &synproxy_net_id,
  327. .size = sizeof(struct synproxy_net),
  328. };
  329. static int __init synproxy_core_init(void)
  330. {
  331. int err;
  332. err = nf_ct_extend_register(&nf_ct_synproxy_extend);
  333. if (err < 0)
  334. goto err1;
  335. err = register_pernet_subsys(&synproxy_net_ops);
  336. if (err < 0)
  337. goto err2;
  338. return 0;
  339. err2:
  340. nf_ct_extend_unregister(&nf_ct_synproxy_extend);
  341. err1:
  342. return err;
  343. }
  344. static void __exit synproxy_core_exit(void)
  345. {
  346. unregister_pernet_subsys(&synproxy_net_ops);
  347. nf_ct_extend_unregister(&nf_ct_synproxy_extend);
  348. }
  349. module_init(synproxy_core_init);
  350. module_exit(synproxy_core_exit);
  351. static struct iphdr *
  352. synproxy_build_ip(struct net *net, struct sk_buff *skb, __be32 saddr,
  353. __be32 daddr)
  354. {
  355. struct iphdr *iph;
  356. skb_reset_network_header(skb);
  357. iph = skb_put(skb, sizeof(*iph));
  358. iph->version = 4;
  359. iph->ihl = sizeof(*iph) / 4;
  360. iph->tos = 0;
  361. iph->id = 0;
  362. iph->frag_off = htons(IP_DF);
  363. iph->ttl = net->ipv4.sysctl_ip_default_ttl;
  364. iph->protocol = IPPROTO_TCP;
  365. iph->check = 0;
  366. iph->saddr = saddr;
  367. iph->daddr = daddr;
  368. return iph;
  369. }
  370. static void
  371. synproxy_send_tcp(struct net *net,
  372. const struct sk_buff *skb, struct sk_buff *nskb,
  373. struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
  374. struct iphdr *niph, struct tcphdr *nth,
  375. unsigned int tcp_hdr_size)
  376. {
  377. nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);
  378. nskb->ip_summed = CHECKSUM_PARTIAL;
  379. nskb->csum_start = (unsigned char *)nth - nskb->head;
  380. nskb->csum_offset = offsetof(struct tcphdr, check);
  381. skb_dst_set_noref(nskb, skb_dst(skb));
  382. nskb->protocol = htons(ETH_P_IP);
  383. if (ip_route_me_harder(net, nskb->sk, nskb, RTN_UNSPEC))
  384. goto free_nskb;
  385. if (nfct) {
  386. nf_ct_set(nskb, (struct nf_conn *)nfct, ctinfo);
  387. nf_conntrack_get(nfct);
  388. }
  389. ip_local_out(net, nskb->sk, nskb);
  390. return;
  391. free_nskb:
  392. kfree_skb(nskb);
  393. }
  394. void
  395. synproxy_send_client_synack(struct net *net,
  396. const struct sk_buff *skb, const struct tcphdr *th,
  397. const struct synproxy_options *opts)
  398. {
  399. struct sk_buff *nskb;
  400. struct iphdr *iph, *niph;
  401. struct tcphdr *nth;
  402. unsigned int tcp_hdr_size;
  403. u16 mss = opts->mss_encode;
  404. iph = ip_hdr(skb);
  405. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  406. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  407. GFP_ATOMIC);
  408. if (!nskb)
  409. return;
  410. skb_reserve(nskb, MAX_TCP_HEADER);
  411. niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
  412. skb_reset_transport_header(nskb);
  413. nth = skb_put(nskb, tcp_hdr_size);
  414. nth->source = th->dest;
  415. nth->dest = th->source;
  416. nth->seq = htonl(__cookie_v4_init_sequence(iph, th, &mss));
  417. nth->ack_seq = htonl(ntohl(th->seq) + 1);
  418. tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
  419. if (opts->options & NF_SYNPROXY_OPT_ECN)
  420. tcp_flag_word(nth) |= TCP_FLAG_ECE;
  421. nth->doff = tcp_hdr_size / 4;
  422. nth->window = 0;
  423. nth->check = 0;
  424. nth->urg_ptr = 0;
  425. synproxy_build_options(nth, opts);
  426. synproxy_send_tcp(net, skb, nskb, skb_nfct(skb),
  427. IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
  428. }
  429. EXPORT_SYMBOL_GPL(synproxy_send_client_synack);
  430. static void
  431. synproxy_send_server_syn(struct net *net,
  432. const struct sk_buff *skb, const struct tcphdr *th,
  433. const struct synproxy_options *opts, u32 recv_seq)
  434. {
  435. struct synproxy_net *snet = synproxy_pernet(net);
  436. struct sk_buff *nskb;
  437. struct iphdr *iph, *niph;
  438. struct tcphdr *nth;
  439. unsigned int tcp_hdr_size;
  440. iph = ip_hdr(skb);
  441. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  442. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  443. GFP_ATOMIC);
  444. if (!nskb)
  445. return;
  446. skb_reserve(nskb, MAX_TCP_HEADER);
  447. niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
  448. skb_reset_transport_header(nskb);
  449. nth = skb_put(nskb, tcp_hdr_size);
  450. nth->source = th->source;
  451. nth->dest = th->dest;
  452. nth->seq = htonl(recv_seq - 1);
  453. /* ack_seq is used to relay our ISN to the synproxy hook to initialize
  454. * sequence number translation once a connection tracking entry exists.
  455. */
  456. nth->ack_seq = htonl(ntohl(th->ack_seq) - 1);
  457. tcp_flag_word(nth) = TCP_FLAG_SYN;
  458. if (opts->options & NF_SYNPROXY_OPT_ECN)
  459. tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
  460. nth->doff = tcp_hdr_size / 4;
  461. nth->window = th->window;
  462. nth->check = 0;
  463. nth->urg_ptr = 0;
  464. synproxy_build_options(nth, opts);
  465. synproxy_send_tcp(net, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
  466. niph, nth, tcp_hdr_size);
  467. }
  468. static void
  469. synproxy_send_server_ack(struct net *net,
  470. const struct ip_ct_tcp *state,
  471. const struct sk_buff *skb, const struct tcphdr *th,
  472. const struct synproxy_options *opts)
  473. {
  474. struct sk_buff *nskb;
  475. struct iphdr *iph, *niph;
  476. struct tcphdr *nth;
  477. unsigned int tcp_hdr_size;
  478. iph = ip_hdr(skb);
  479. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  480. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  481. GFP_ATOMIC);
  482. if (!nskb)
  483. return;
  484. skb_reserve(nskb, MAX_TCP_HEADER);
  485. niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
  486. skb_reset_transport_header(nskb);
  487. nth = skb_put(nskb, tcp_hdr_size);
  488. nth->source = th->dest;
  489. nth->dest = th->source;
  490. nth->seq = htonl(ntohl(th->ack_seq));
  491. nth->ack_seq = htonl(ntohl(th->seq) + 1);
  492. tcp_flag_word(nth) = TCP_FLAG_ACK;
  493. nth->doff = tcp_hdr_size / 4;
  494. nth->window = htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
  495. nth->check = 0;
  496. nth->urg_ptr = 0;
  497. synproxy_build_options(nth, opts);
  498. synproxy_send_tcp(net, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
  499. }
  500. static void
  501. synproxy_send_client_ack(struct net *net,
  502. const struct sk_buff *skb, const struct tcphdr *th,
  503. const struct synproxy_options *opts)
  504. {
  505. struct sk_buff *nskb;
  506. struct iphdr *iph, *niph;
  507. struct tcphdr *nth;
  508. unsigned int tcp_hdr_size;
  509. iph = ip_hdr(skb);
  510. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  511. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  512. GFP_ATOMIC);
  513. if (!nskb)
  514. return;
  515. skb_reserve(nskb, MAX_TCP_HEADER);
  516. niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
  517. skb_reset_transport_header(nskb);
  518. nth = skb_put(nskb, tcp_hdr_size);
  519. nth->source = th->source;
  520. nth->dest = th->dest;
  521. nth->seq = htonl(ntohl(th->seq) + 1);
  522. nth->ack_seq = th->ack_seq;
  523. tcp_flag_word(nth) = TCP_FLAG_ACK;
  524. nth->doff = tcp_hdr_size / 4;
  525. nth->window = htons(ntohs(th->window) >> opts->wscale);
  526. nth->check = 0;
  527. nth->urg_ptr = 0;
  528. synproxy_build_options(nth, opts);
  529. synproxy_send_tcp(net, skb, nskb, skb_nfct(skb),
  530. IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
  531. }
  532. bool
  533. synproxy_recv_client_ack(struct net *net,
  534. const struct sk_buff *skb, const struct tcphdr *th,
  535. struct synproxy_options *opts, u32 recv_seq)
  536. {
  537. struct synproxy_net *snet = synproxy_pernet(net);
  538. int mss;
  539. mss = __cookie_v4_check(ip_hdr(skb), th, ntohl(th->ack_seq) - 1);
  540. if (mss == 0) {
  541. this_cpu_inc(snet->stats->cookie_invalid);
  542. return false;
  543. }
  544. this_cpu_inc(snet->stats->cookie_valid);
  545. opts->mss_option = mss;
  546. opts->options |= NF_SYNPROXY_OPT_MSS;
  547. if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
  548. synproxy_check_timestamp_cookie(opts);
  549. synproxy_send_server_syn(net, skb, th, opts, recv_seq);
  550. return true;
  551. }
  552. EXPORT_SYMBOL_GPL(synproxy_recv_client_ack);
  553. unsigned int
  554. ipv4_synproxy_hook(void *priv, struct sk_buff *skb,
  555. const struct nf_hook_state *nhs)
  556. {
  557. struct net *net = nhs->net;
  558. struct synproxy_net *snet = synproxy_pernet(net);
  559. enum ip_conntrack_info ctinfo;
  560. struct nf_conn *ct;
  561. struct nf_conn_synproxy *synproxy;
  562. struct synproxy_options opts = {};
  563. const struct ip_ct_tcp *state;
  564. struct tcphdr *th, _th;
  565. unsigned int thoff;
  566. ct = nf_ct_get(skb, &ctinfo);
  567. if (!ct)
  568. return NF_ACCEPT;
  569. synproxy = nfct_synproxy(ct);
  570. if (!synproxy)
  571. return NF_ACCEPT;
  572. if (nf_is_loopback_packet(skb) ||
  573. ip_hdr(skb)->protocol != IPPROTO_TCP)
  574. return NF_ACCEPT;
  575. thoff = ip_hdrlen(skb);
  576. th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
  577. if (!th)
  578. return NF_DROP;
  579. state = &ct->proto.tcp;
  580. switch (state->state) {
  581. case TCP_CONNTRACK_CLOSE:
  582. if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
  583. nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
  584. ntohl(th->seq) + 1);
  585. break;
  586. }
  587. if (!th->syn || th->ack ||
  588. CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
  589. break;
  590. /* Reopened connection - reset the sequence number and timestamp
  591. * adjustments, they will get initialized once the connection is
  592. * reestablished.
  593. */
  594. nf_ct_seqadj_init(ct, ctinfo, 0);
  595. synproxy->tsoff = 0;
  596. this_cpu_inc(snet->stats->conn_reopened);
  597. fallthrough;
  598. case TCP_CONNTRACK_SYN_SENT:
  599. if (!synproxy_parse_options(skb, thoff, th, &opts))
  600. return NF_DROP;
  601. if (!th->syn && th->ack &&
  602. CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
  603. /* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,
  604. * therefore we need to add 1 to make the SYN sequence
  605. * number match the one of first SYN.
  606. */
  607. if (synproxy_recv_client_ack(net, skb, th, &opts,
  608. ntohl(th->seq) + 1)) {
  609. this_cpu_inc(snet->stats->cookie_retrans);
  610. consume_skb(skb);
  611. return NF_STOLEN;
  612. } else {
  613. return NF_DROP;
  614. }
  615. }
  616. synproxy->isn = ntohl(th->ack_seq);
  617. if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP)
  618. synproxy->its = opts.tsecr;
  619. nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
  620. break;
  621. case TCP_CONNTRACK_SYN_RECV:
  622. if (!th->syn || !th->ack)
  623. break;
  624. if (!synproxy_parse_options(skb, thoff, th, &opts))
  625. return NF_DROP;
  626. if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP) {
  627. synproxy->tsoff = opts.tsval - synproxy->its;
  628. nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
  629. }
  630. opts.options &= ~(NF_SYNPROXY_OPT_MSS |
  631. NF_SYNPROXY_OPT_WSCALE |
  632. NF_SYNPROXY_OPT_SACK_PERM);
  633. swap(opts.tsval, opts.tsecr);
  634. synproxy_send_server_ack(net, state, skb, th, &opts);
  635. nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
  636. nf_conntrack_event_cache(IPCT_SEQADJ, ct);
  637. swap(opts.tsval, opts.tsecr);
  638. synproxy_send_client_ack(net, skb, th, &opts);
  639. consume_skb(skb);
  640. return NF_STOLEN;
  641. default:
  642. break;
  643. }
  644. synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);
  645. return NF_ACCEPT;
  646. }
  647. EXPORT_SYMBOL_GPL(ipv4_synproxy_hook);
  648. static const struct nf_hook_ops ipv4_synproxy_ops[] = {
  649. {
  650. .hook = ipv4_synproxy_hook,
  651. .pf = NFPROTO_IPV4,
  652. .hooknum = NF_INET_LOCAL_IN,
  653. .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
  654. },
  655. {
  656. .hook = ipv4_synproxy_hook,
  657. .pf = NFPROTO_IPV4,
  658. .hooknum = NF_INET_POST_ROUTING,
  659. .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
  660. },
  661. };
  662. int nf_synproxy_ipv4_init(struct synproxy_net *snet, struct net *net)
  663. {
  664. int err;
  665. if (snet->hook_ref4 == 0) {
  666. err = nf_register_net_hooks(net, ipv4_synproxy_ops,
  667. ARRAY_SIZE(ipv4_synproxy_ops));
  668. if (err)
  669. return err;
  670. }
  671. snet->hook_ref4++;
  672. return 0;
  673. }
  674. EXPORT_SYMBOL_GPL(nf_synproxy_ipv4_init);
  675. void nf_synproxy_ipv4_fini(struct synproxy_net *snet, struct net *net)
  676. {
  677. snet->hook_ref4--;
  678. if (snet->hook_ref4 == 0)
  679. nf_unregister_net_hooks(net, ipv4_synproxy_ops,
  680. ARRAY_SIZE(ipv4_synproxy_ops));
  681. }
  682. EXPORT_SYMBOL_GPL(nf_synproxy_ipv4_fini);
  683. #if IS_ENABLED(CONFIG_IPV6)
  684. static struct ipv6hdr *
  685. synproxy_build_ip_ipv6(struct net *net, struct sk_buff *skb,
  686. const struct in6_addr *saddr,
  687. const struct in6_addr *daddr)
  688. {
  689. struct ipv6hdr *iph;
  690. skb_reset_network_header(skb);
  691. iph = skb_put(skb, sizeof(*iph));
  692. ip6_flow_hdr(iph, 0, 0);
  693. iph->hop_limit = net->ipv6.devconf_all->hop_limit;
  694. iph->nexthdr = IPPROTO_TCP;
  695. iph->saddr = *saddr;
  696. iph->daddr = *daddr;
  697. return iph;
  698. }
  699. static void
  700. synproxy_send_tcp_ipv6(struct net *net,
  701. const struct sk_buff *skb, struct sk_buff *nskb,
  702. struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
  703. struct ipv6hdr *niph, struct tcphdr *nth,
  704. unsigned int tcp_hdr_size)
  705. {
  706. struct dst_entry *dst;
  707. struct flowi6 fl6;
  708. int err;
  709. nth->check = ~tcp_v6_check(tcp_hdr_size, &niph->saddr, &niph->daddr, 0);
  710. nskb->ip_summed = CHECKSUM_PARTIAL;
  711. nskb->csum_start = (unsigned char *)nth - nskb->head;
  712. nskb->csum_offset = offsetof(struct tcphdr, check);
  713. memset(&fl6, 0, sizeof(fl6));
  714. fl6.flowi6_proto = IPPROTO_TCP;
  715. fl6.saddr = niph->saddr;
  716. fl6.daddr = niph->daddr;
  717. fl6.fl6_sport = nth->source;
  718. fl6.fl6_dport = nth->dest;
  719. security_skb_classify_flow((struct sk_buff *)skb,
  720. flowi6_to_flowi(&fl6));
  721. err = nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
  722. if (err) {
  723. goto free_nskb;
  724. }
  725. dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
  726. if (IS_ERR(dst))
  727. goto free_nskb;
  728. skb_dst_set(nskb, dst);
  729. if (nfct) {
  730. nf_ct_set(nskb, (struct nf_conn *)nfct, ctinfo);
  731. nf_conntrack_get(nfct);
  732. }
  733. ip6_local_out(net, nskb->sk, nskb);
  734. return;
  735. free_nskb:
  736. kfree_skb(nskb);
  737. }
  738. void
  739. synproxy_send_client_synack_ipv6(struct net *net,
  740. const struct sk_buff *skb,
  741. const struct tcphdr *th,
  742. const struct synproxy_options *opts)
  743. {
  744. struct sk_buff *nskb;
  745. struct ipv6hdr *iph, *niph;
  746. struct tcphdr *nth;
  747. unsigned int tcp_hdr_size;
  748. u16 mss = opts->mss_encode;
  749. iph = ipv6_hdr(skb);
  750. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  751. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  752. GFP_ATOMIC);
  753. if (!nskb)
  754. return;
  755. skb_reserve(nskb, MAX_TCP_HEADER);
  756. niph = synproxy_build_ip_ipv6(net, nskb, &iph->daddr, &iph->saddr);
  757. skb_reset_transport_header(nskb);
  758. nth = skb_put(nskb, tcp_hdr_size);
  759. nth->source = th->dest;
  760. nth->dest = th->source;
  761. nth->seq = htonl(nf_ipv6_cookie_init_sequence(iph, th, &mss));
  762. nth->ack_seq = htonl(ntohl(th->seq) + 1);
  763. tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
  764. if (opts->options & NF_SYNPROXY_OPT_ECN)
  765. tcp_flag_word(nth) |= TCP_FLAG_ECE;
  766. nth->doff = tcp_hdr_size / 4;
  767. nth->window = 0;
  768. nth->check = 0;
  769. nth->urg_ptr = 0;
  770. synproxy_build_options(nth, opts);
  771. synproxy_send_tcp_ipv6(net, skb, nskb, skb_nfct(skb),
  772. IP_CT_ESTABLISHED_REPLY, niph, nth,
  773. tcp_hdr_size);
  774. }
  775. EXPORT_SYMBOL_GPL(synproxy_send_client_synack_ipv6);
  776. static void
  777. synproxy_send_server_syn_ipv6(struct net *net, const struct sk_buff *skb,
  778. const struct tcphdr *th,
  779. const struct synproxy_options *opts, u32 recv_seq)
  780. {
  781. struct synproxy_net *snet = synproxy_pernet(net);
  782. struct sk_buff *nskb;
  783. struct ipv6hdr *iph, *niph;
  784. struct tcphdr *nth;
  785. unsigned int tcp_hdr_size;
  786. iph = ipv6_hdr(skb);
  787. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  788. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  789. GFP_ATOMIC);
  790. if (!nskb)
  791. return;
  792. skb_reserve(nskb, MAX_TCP_HEADER);
  793. niph = synproxy_build_ip_ipv6(net, nskb, &iph->saddr, &iph->daddr);
  794. skb_reset_transport_header(nskb);
  795. nth = skb_put(nskb, tcp_hdr_size);
  796. nth->source = th->source;
  797. nth->dest = th->dest;
  798. nth->seq = htonl(recv_seq - 1);
  799. /* ack_seq is used to relay our ISN to the synproxy hook to initialize
  800. * sequence number translation once a connection tracking entry exists.
  801. */
  802. nth->ack_seq = htonl(ntohl(th->ack_seq) - 1);
  803. tcp_flag_word(nth) = TCP_FLAG_SYN;
  804. if (opts->options & NF_SYNPROXY_OPT_ECN)
  805. tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
  806. nth->doff = tcp_hdr_size / 4;
  807. nth->window = th->window;
  808. nth->check = 0;
  809. nth->urg_ptr = 0;
  810. synproxy_build_options(nth, opts);
  811. synproxy_send_tcp_ipv6(net, skb, nskb, &snet->tmpl->ct_general,
  812. IP_CT_NEW, niph, nth, tcp_hdr_size);
  813. }
  814. static void
  815. synproxy_send_server_ack_ipv6(struct net *net, const struct ip_ct_tcp *state,
  816. const struct sk_buff *skb,
  817. const struct tcphdr *th,
  818. const struct synproxy_options *opts)
  819. {
  820. struct sk_buff *nskb;
  821. struct ipv6hdr *iph, *niph;
  822. struct tcphdr *nth;
  823. unsigned int tcp_hdr_size;
  824. iph = ipv6_hdr(skb);
  825. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  826. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  827. GFP_ATOMIC);
  828. if (!nskb)
  829. return;
  830. skb_reserve(nskb, MAX_TCP_HEADER);
  831. niph = synproxy_build_ip_ipv6(net, nskb, &iph->daddr, &iph->saddr);
  832. skb_reset_transport_header(nskb);
  833. nth = skb_put(nskb, tcp_hdr_size);
  834. nth->source = th->dest;
  835. nth->dest = th->source;
  836. nth->seq = htonl(ntohl(th->ack_seq));
  837. nth->ack_seq = htonl(ntohl(th->seq) + 1);
  838. tcp_flag_word(nth) = TCP_FLAG_ACK;
  839. nth->doff = tcp_hdr_size / 4;
  840. nth->window = htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
  841. nth->check = 0;
  842. nth->urg_ptr = 0;
  843. synproxy_build_options(nth, opts);
  844. synproxy_send_tcp_ipv6(net, skb, nskb, NULL, 0, niph, nth,
  845. tcp_hdr_size);
  846. }
  847. static void
  848. synproxy_send_client_ack_ipv6(struct net *net, const struct sk_buff *skb,
  849. const struct tcphdr *th,
  850. const struct synproxy_options *opts)
  851. {
  852. struct sk_buff *nskb;
  853. struct ipv6hdr *iph, *niph;
  854. struct tcphdr *nth;
  855. unsigned int tcp_hdr_size;
  856. iph = ipv6_hdr(skb);
  857. tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
  858. nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
  859. GFP_ATOMIC);
  860. if (!nskb)
  861. return;
  862. skb_reserve(nskb, MAX_TCP_HEADER);
  863. niph = synproxy_build_ip_ipv6(net, nskb, &iph->saddr, &iph->daddr);
  864. skb_reset_transport_header(nskb);
  865. nth = skb_put(nskb, tcp_hdr_size);
  866. nth->source = th->source;
  867. nth->dest = th->dest;
  868. nth->seq = htonl(ntohl(th->seq) + 1);
  869. nth->ack_seq = th->ack_seq;
  870. tcp_flag_word(nth) = TCP_FLAG_ACK;
  871. nth->doff = tcp_hdr_size / 4;
  872. nth->window = htons(ntohs(th->window) >> opts->wscale);
  873. nth->check = 0;
  874. nth->urg_ptr = 0;
  875. synproxy_build_options(nth, opts);
  876. synproxy_send_tcp_ipv6(net, skb, nskb, skb_nfct(skb),
  877. IP_CT_ESTABLISHED_REPLY, niph, nth,
  878. tcp_hdr_size);
  879. }
  880. bool
  881. synproxy_recv_client_ack_ipv6(struct net *net,
  882. const struct sk_buff *skb,
  883. const struct tcphdr *th,
  884. struct synproxy_options *opts, u32 recv_seq)
  885. {
  886. struct synproxy_net *snet = synproxy_pernet(net);
  887. int mss;
  888. mss = nf_cookie_v6_check(ipv6_hdr(skb), th, ntohl(th->ack_seq) - 1);
  889. if (mss == 0) {
  890. this_cpu_inc(snet->stats->cookie_invalid);
  891. return false;
  892. }
  893. this_cpu_inc(snet->stats->cookie_valid);
  894. opts->mss_option = mss;
  895. opts->options |= NF_SYNPROXY_OPT_MSS;
  896. if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
  897. synproxy_check_timestamp_cookie(opts);
  898. synproxy_send_server_syn_ipv6(net, skb, th, opts, recv_seq);
  899. return true;
  900. }
  901. EXPORT_SYMBOL_GPL(synproxy_recv_client_ack_ipv6);
  902. unsigned int
  903. ipv6_synproxy_hook(void *priv, struct sk_buff *skb,
  904. const struct nf_hook_state *nhs)
  905. {
  906. struct net *net = nhs->net;
  907. struct synproxy_net *snet = synproxy_pernet(net);
  908. enum ip_conntrack_info ctinfo;
  909. struct nf_conn *ct;
  910. struct nf_conn_synproxy *synproxy;
  911. struct synproxy_options opts = {};
  912. const struct ip_ct_tcp *state;
  913. struct tcphdr *th, _th;
  914. __be16 frag_off;
  915. u8 nexthdr;
  916. int thoff;
  917. ct = nf_ct_get(skb, &ctinfo);
  918. if (!ct)
  919. return NF_ACCEPT;
  920. synproxy = nfct_synproxy(ct);
  921. if (!synproxy)
  922. return NF_ACCEPT;
  923. if (nf_is_loopback_packet(skb))
  924. return NF_ACCEPT;
  925. nexthdr = ipv6_hdr(skb)->nexthdr;
  926. thoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
  927. &frag_off);
  928. if (thoff < 0 || nexthdr != IPPROTO_TCP)
  929. return NF_ACCEPT;
  930. th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
  931. if (!th)
  932. return NF_DROP;
  933. state = &ct->proto.tcp;
  934. switch (state->state) {
  935. case TCP_CONNTRACK_CLOSE:
  936. if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
  937. nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
  938. ntohl(th->seq) + 1);
  939. break;
  940. }
  941. if (!th->syn || th->ack ||
  942. CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
  943. break;
  944. /* Reopened connection - reset the sequence number and timestamp
  945. * adjustments, they will get initialized once the connection is
  946. * reestablished.
  947. */
  948. nf_ct_seqadj_init(ct, ctinfo, 0);
  949. synproxy->tsoff = 0;
  950. this_cpu_inc(snet->stats->conn_reopened);
  951. fallthrough;
  952. case TCP_CONNTRACK_SYN_SENT:
  953. if (!synproxy_parse_options(skb, thoff, th, &opts))
  954. return NF_DROP;
  955. if (!th->syn && th->ack &&
  956. CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
  957. /* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,
  958. * therefore we need to add 1 to make the SYN sequence
  959. * number match the one of first SYN.
  960. */
  961. if (synproxy_recv_client_ack_ipv6(net, skb, th, &opts,
  962. ntohl(th->seq) + 1)) {
  963. this_cpu_inc(snet->stats->cookie_retrans);
  964. consume_skb(skb);
  965. return NF_STOLEN;
  966. } else {
  967. return NF_DROP;
  968. }
  969. }
  970. synproxy->isn = ntohl(th->ack_seq);
  971. if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP)
  972. synproxy->its = opts.tsecr;
  973. nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
  974. break;
  975. case TCP_CONNTRACK_SYN_RECV:
  976. if (!th->syn || !th->ack)
  977. break;
  978. if (!synproxy_parse_options(skb, thoff, th, &opts))
  979. return NF_DROP;
  980. if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP) {
  981. synproxy->tsoff = opts.tsval - synproxy->its;
  982. nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
  983. }
  984. opts.options &= ~(NF_SYNPROXY_OPT_MSS |
  985. NF_SYNPROXY_OPT_WSCALE |
  986. NF_SYNPROXY_OPT_SACK_PERM);
  987. swap(opts.tsval, opts.tsecr);
  988. synproxy_send_server_ack_ipv6(net, state, skb, th, &opts);
  989. nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
  990. nf_conntrack_event_cache(IPCT_SEQADJ, ct);
  991. swap(opts.tsval, opts.tsecr);
  992. synproxy_send_client_ack_ipv6(net, skb, th, &opts);
  993. consume_skb(skb);
  994. return NF_STOLEN;
  995. default:
  996. break;
  997. }
  998. synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);
  999. return NF_ACCEPT;
  1000. }
  1001. EXPORT_SYMBOL_GPL(ipv6_synproxy_hook);
  1002. static const struct nf_hook_ops ipv6_synproxy_ops[] = {
  1003. {
  1004. .hook = ipv6_synproxy_hook,
  1005. .pf = NFPROTO_IPV6,
  1006. .hooknum = NF_INET_LOCAL_IN,
  1007. .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
  1008. },
  1009. {
  1010. .hook = ipv6_synproxy_hook,
  1011. .pf = NFPROTO_IPV6,
  1012. .hooknum = NF_INET_POST_ROUTING,
  1013. .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
  1014. },
  1015. };
  1016. int
  1017. nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net)
  1018. {
  1019. int err;
  1020. if (snet->hook_ref6 == 0) {
  1021. err = nf_register_net_hooks(net, ipv6_synproxy_ops,
  1022. ARRAY_SIZE(ipv6_synproxy_ops));
  1023. if (err)
  1024. return err;
  1025. }
  1026. snet->hook_ref6++;
  1027. return 0;
  1028. }
  1029. EXPORT_SYMBOL_GPL(nf_synproxy_ipv6_init);
  1030. void
  1031. nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net)
  1032. {
  1033. snet->hook_ref6--;
  1034. if (snet->hook_ref6 == 0)
  1035. nf_unregister_net_hooks(net, ipv6_synproxy_ops,
  1036. ARRAY_SIZE(ipv6_synproxy_ops));
  1037. }
  1038. EXPORT_SYMBOL_GPL(nf_synproxy_ipv6_fini);
  1039. #endif /* CONFIG_IPV6 */
  1040. MODULE_LICENSE("GPL");
  1041. MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
  1042. MODULE_DESCRIPTION("nftables SYNPROXY expression support");