nft_synproxy.c 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393
  1. // SPDX-License-Identifier: GPL-2.0
  2. #include <linux/types.h>
  3. #include <net/ip.h>
  4. #include <net/tcp.h>
  5. #include <net/netlink.h>
  6. #include <net/netfilter/nf_tables.h>
  7. #include <net/netfilter/nf_conntrack.h>
  8. #include <net/netfilter/nf_conntrack_synproxy.h>
  9. #include <net/netfilter/nf_synproxy.h>
  10. #include <linux/netfilter/nf_tables.h>
  11. #include <linux/netfilter/nf_synproxy.h>
  12. struct nft_synproxy {
  13. struct nf_synproxy_info info;
  14. };
  15. static const struct nla_policy nft_synproxy_policy[NFTA_SYNPROXY_MAX + 1] = {
  16. [NFTA_SYNPROXY_MSS] = { .type = NLA_U16 },
  17. [NFTA_SYNPROXY_WSCALE] = { .type = NLA_U8 },
  18. [NFTA_SYNPROXY_FLAGS] = { .type = NLA_U32 },
  19. };
  20. static void nft_synproxy_tcp_options(struct synproxy_options *opts,
  21. const struct tcphdr *tcp,
  22. struct synproxy_net *snet,
  23. struct nf_synproxy_info *info,
  24. const struct nft_synproxy *priv)
  25. {
  26. this_cpu_inc(snet->stats->syn_received);
  27. if (tcp->ece && tcp->cwr)
  28. opts->options |= NF_SYNPROXY_OPT_ECN;
  29. opts->options &= priv->info.options;
  30. opts->mss_encode = opts->mss_option;
  31. opts->mss_option = info->mss;
  32. if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
  33. synproxy_init_timestamp_cookie(info, opts);
  34. else
  35. opts->options &= ~(NF_SYNPROXY_OPT_WSCALE |
  36. NF_SYNPROXY_OPT_SACK_PERM |
  37. NF_SYNPROXY_OPT_ECN);
  38. }
  39. static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
  40. struct nft_regs *regs,
  41. const struct nft_pktinfo *pkt,
  42. const struct tcphdr *tcp,
  43. struct tcphdr *_tcph,
  44. struct synproxy_options *opts)
  45. {
  46. struct nf_synproxy_info info = priv->info;
  47. struct net *net = nft_net(pkt);
  48. struct synproxy_net *snet = synproxy_pernet(net);
  49. struct sk_buff *skb = pkt->skb;
  50. if (tcp->syn) {
  51. /* Initial SYN from client */
  52. nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
  53. synproxy_send_client_synack(net, skb, tcp, opts);
  54. consume_skb(skb);
  55. regs->verdict.code = NF_STOLEN;
  56. } else if (tcp->ack) {
  57. /* ACK from client */
  58. if (synproxy_recv_client_ack(net, skb, tcp, opts,
  59. ntohl(tcp->seq))) {
  60. consume_skb(skb);
  61. regs->verdict.code = NF_STOLEN;
  62. } else {
  63. regs->verdict.code = NF_DROP;
  64. }
  65. }
  66. }
  67. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  68. static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
  69. struct nft_regs *regs,
  70. const struct nft_pktinfo *pkt,
  71. const struct tcphdr *tcp,
  72. struct tcphdr *_tcph,
  73. struct synproxy_options *opts)
  74. {
  75. struct nf_synproxy_info info = priv->info;
  76. struct net *net = nft_net(pkt);
  77. struct synproxy_net *snet = synproxy_pernet(net);
  78. struct sk_buff *skb = pkt->skb;
  79. if (tcp->syn) {
  80. /* Initial SYN from client */
  81. nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
  82. synproxy_send_client_synack_ipv6(net, skb, tcp, opts);
  83. consume_skb(skb);
  84. regs->verdict.code = NF_STOLEN;
  85. } else if (tcp->ack) {
  86. /* ACK from client */
  87. if (synproxy_recv_client_ack_ipv6(net, skb, tcp, opts,
  88. ntohl(tcp->seq))) {
  89. consume_skb(skb);
  90. regs->verdict.code = NF_STOLEN;
  91. } else {
  92. regs->verdict.code = NF_DROP;
  93. }
  94. }
  95. }
  96. #endif /* CONFIG_NF_TABLES_IPV6*/
  97. static void nft_synproxy_do_eval(const struct nft_synproxy *priv,
  98. struct nft_regs *regs,
  99. const struct nft_pktinfo *pkt)
  100. {
  101. struct synproxy_options opts = {};
  102. struct sk_buff *skb = pkt->skb;
  103. int thoff = pkt->xt.thoff;
  104. const struct tcphdr *tcp;
  105. struct tcphdr _tcph;
  106. if (pkt->tprot != IPPROTO_TCP) {
  107. regs->verdict.code = NFT_BREAK;
  108. return;
  109. }
  110. if (nf_ip_checksum(skb, nft_hook(pkt), thoff, IPPROTO_TCP)) {
  111. regs->verdict.code = NF_DROP;
  112. return;
  113. }
  114. tcp = skb_header_pointer(skb, pkt->xt.thoff,
  115. sizeof(struct tcphdr),
  116. &_tcph);
  117. if (!tcp) {
  118. regs->verdict.code = NF_DROP;
  119. return;
  120. }
  121. if (!synproxy_parse_options(skb, thoff, tcp, &opts)) {
  122. regs->verdict.code = NF_DROP;
  123. return;
  124. }
  125. switch (skb->protocol) {
  126. case htons(ETH_P_IP):
  127. nft_synproxy_eval_v4(priv, regs, pkt, tcp, &_tcph, &opts);
  128. return;
  129. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  130. case htons(ETH_P_IPV6):
  131. nft_synproxy_eval_v6(priv, regs, pkt, tcp, &_tcph, &opts);
  132. return;
  133. #endif
  134. }
  135. regs->verdict.code = NFT_BREAK;
  136. }
  137. static int nft_synproxy_do_init(const struct nft_ctx *ctx,
  138. const struct nlattr * const tb[],
  139. struct nft_synproxy *priv)
  140. {
  141. struct synproxy_net *snet = synproxy_pernet(ctx->net);
  142. u32 flags;
  143. int err;
  144. if (tb[NFTA_SYNPROXY_MSS])
  145. priv->info.mss = ntohs(nla_get_be16(tb[NFTA_SYNPROXY_MSS]));
  146. if (tb[NFTA_SYNPROXY_WSCALE])
  147. priv->info.wscale = nla_get_u8(tb[NFTA_SYNPROXY_WSCALE]);
  148. if (tb[NFTA_SYNPROXY_FLAGS]) {
  149. flags = ntohl(nla_get_be32(tb[NFTA_SYNPROXY_FLAGS]));
  150. if (flags & ~NF_SYNPROXY_OPT_MASK)
  151. return -EOPNOTSUPP;
  152. priv->info.options = flags;
  153. }
  154. err = nf_ct_netns_get(ctx->net, ctx->family);
  155. if (err)
  156. return err;
  157. switch (ctx->family) {
  158. case NFPROTO_IPV4:
  159. err = nf_synproxy_ipv4_init(snet, ctx->net);
  160. if (err)
  161. goto nf_ct_failure;
  162. break;
  163. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  164. case NFPROTO_IPV6:
  165. err = nf_synproxy_ipv6_init(snet, ctx->net);
  166. if (err)
  167. goto nf_ct_failure;
  168. break;
  169. #endif
  170. case NFPROTO_INET:
  171. case NFPROTO_BRIDGE:
  172. err = nf_synproxy_ipv4_init(snet, ctx->net);
  173. if (err)
  174. goto nf_ct_failure;
  175. err = nf_synproxy_ipv6_init(snet, ctx->net);
  176. if (err) {
  177. nf_synproxy_ipv4_fini(snet, ctx->net);
  178. goto nf_ct_failure;
  179. }
  180. break;
  181. }
  182. return 0;
  183. nf_ct_failure:
  184. nf_ct_netns_put(ctx->net, ctx->family);
  185. return err;
  186. }
  187. static void nft_synproxy_do_destroy(const struct nft_ctx *ctx)
  188. {
  189. struct synproxy_net *snet = synproxy_pernet(ctx->net);
  190. switch (ctx->family) {
  191. case NFPROTO_IPV4:
  192. nf_synproxy_ipv4_fini(snet, ctx->net);
  193. break;
  194. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  195. case NFPROTO_IPV6:
  196. nf_synproxy_ipv6_fini(snet, ctx->net);
  197. break;
  198. #endif
  199. case NFPROTO_INET:
  200. case NFPROTO_BRIDGE:
  201. nf_synproxy_ipv4_fini(snet, ctx->net);
  202. nf_synproxy_ipv6_fini(snet, ctx->net);
  203. break;
  204. }
  205. nf_ct_netns_put(ctx->net, ctx->family);
  206. }
  207. static int nft_synproxy_do_dump(struct sk_buff *skb, struct nft_synproxy *priv)
  208. {
  209. if (nla_put_be16(skb, NFTA_SYNPROXY_MSS, htons(priv->info.mss)) ||
  210. nla_put_u8(skb, NFTA_SYNPROXY_WSCALE, priv->info.wscale) ||
  211. nla_put_be32(skb, NFTA_SYNPROXY_FLAGS, htonl(priv->info.options)))
  212. goto nla_put_failure;
  213. return 0;
  214. nla_put_failure:
  215. return -1;
  216. }
  217. static void nft_synproxy_eval(const struct nft_expr *expr,
  218. struct nft_regs *regs,
  219. const struct nft_pktinfo *pkt)
  220. {
  221. const struct nft_synproxy *priv = nft_expr_priv(expr);
  222. nft_synproxy_do_eval(priv, regs, pkt);
  223. }
  224. static int nft_synproxy_validate(const struct nft_ctx *ctx,
  225. const struct nft_expr *expr,
  226. const struct nft_data **data)
  227. {
  228. return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
  229. (1 << NF_INET_FORWARD));
  230. }
  231. static int nft_synproxy_init(const struct nft_ctx *ctx,
  232. const struct nft_expr *expr,
  233. const struct nlattr * const tb[])
  234. {
  235. struct nft_synproxy *priv = nft_expr_priv(expr);
  236. return nft_synproxy_do_init(ctx, tb, priv);
  237. }
  238. static void nft_synproxy_destroy(const struct nft_ctx *ctx,
  239. const struct nft_expr *expr)
  240. {
  241. nft_synproxy_do_destroy(ctx);
  242. }
  243. static int nft_synproxy_dump(struct sk_buff *skb, const struct nft_expr *expr)
  244. {
  245. struct nft_synproxy *priv = nft_expr_priv(expr);
  246. return nft_synproxy_do_dump(skb, priv);
  247. }
  248. static struct nft_expr_type nft_synproxy_type;
  249. static const struct nft_expr_ops nft_synproxy_ops = {
  250. .eval = nft_synproxy_eval,
  251. .size = NFT_EXPR_SIZE(sizeof(struct nft_synproxy)),
  252. .init = nft_synproxy_init,
  253. .destroy = nft_synproxy_destroy,
  254. .dump = nft_synproxy_dump,
  255. .type = &nft_synproxy_type,
  256. .validate = nft_synproxy_validate,
  257. };
  258. static struct nft_expr_type nft_synproxy_type __read_mostly = {
  259. .ops = &nft_synproxy_ops,
  260. .name = "synproxy",
  261. .owner = THIS_MODULE,
  262. .policy = nft_synproxy_policy,
  263. .maxattr = NFTA_SYNPROXY_MAX,
  264. };
  265. static int nft_synproxy_obj_init(const struct nft_ctx *ctx,
  266. const struct nlattr * const tb[],
  267. struct nft_object *obj)
  268. {
  269. struct nft_synproxy *priv = nft_obj_data(obj);
  270. return nft_synproxy_do_init(ctx, tb, priv);
  271. }
  272. static void nft_synproxy_obj_destroy(const struct nft_ctx *ctx,
  273. struct nft_object *obj)
  274. {
  275. nft_synproxy_do_destroy(ctx);
  276. }
  277. static int nft_synproxy_obj_dump(struct sk_buff *skb,
  278. struct nft_object *obj, bool reset)
  279. {
  280. struct nft_synproxy *priv = nft_obj_data(obj);
  281. return nft_synproxy_do_dump(skb, priv);
  282. }
  283. static void nft_synproxy_obj_eval(struct nft_object *obj,
  284. struct nft_regs *regs,
  285. const struct nft_pktinfo *pkt)
  286. {
  287. const struct nft_synproxy *priv = nft_obj_data(obj);
  288. nft_synproxy_do_eval(priv, regs, pkt);
  289. }
  290. static void nft_synproxy_obj_update(struct nft_object *obj,
  291. struct nft_object *newobj)
  292. {
  293. struct nft_synproxy *newpriv = nft_obj_data(newobj);
  294. struct nft_synproxy *priv = nft_obj_data(obj);
  295. priv->info = newpriv->info;
  296. }
  297. static struct nft_object_type nft_synproxy_obj_type;
  298. static const struct nft_object_ops nft_synproxy_obj_ops = {
  299. .type = &nft_synproxy_obj_type,
  300. .size = sizeof(struct nft_synproxy),
  301. .init = nft_synproxy_obj_init,
  302. .destroy = nft_synproxy_obj_destroy,
  303. .dump = nft_synproxy_obj_dump,
  304. .eval = nft_synproxy_obj_eval,
  305. .update = nft_synproxy_obj_update,
  306. };
  307. static struct nft_object_type nft_synproxy_obj_type __read_mostly = {
  308. .type = NFT_OBJECT_SYNPROXY,
  309. .ops = &nft_synproxy_obj_ops,
  310. .maxattr = NFTA_SYNPROXY_MAX,
  311. .policy = nft_synproxy_policy,
  312. .owner = THIS_MODULE,
  313. };
  314. static int __init nft_synproxy_module_init(void)
  315. {
  316. int err;
  317. err = nft_register_obj(&nft_synproxy_obj_type);
  318. if (err < 0)
  319. return err;
  320. err = nft_register_expr(&nft_synproxy_type);
  321. if (err < 0)
  322. goto err;
  323. return 0;
  324. err:
  325. nft_unregister_obj(&nft_synproxy_obj_type);
  326. return err;
  327. }
  328. static void __exit nft_synproxy_module_exit(void)
  329. {
  330. nft_unregister_expr(&nft_synproxy_type);
  331. nft_unregister_obj(&nft_synproxy_obj_type);
  332. }
  333. module_init(nft_synproxy_module_init);
  334. module_exit(nft_synproxy_module_exit);
  335. MODULE_LICENSE("GPL");
  336. MODULE_AUTHOR("Fernando Fernandez <ffmancera@riseup.net>");
  337. MODULE_ALIAS_NFT_EXPR("synproxy");
  338. MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_SYNPROXY);
  339. MODULE_DESCRIPTION("nftables SYNPROXY expression support");