nft_tproxy.c 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. #include <linux/module.h>
  3. #include <linux/netfilter/nf_tables.h>
  4. #include <net/netfilter/nf_tables.h>
  5. #include <net/netfilter/nf_tables_core.h>
  6. #include <net/netfilter/nf_tproxy.h>
  7. #include <net/inet_sock.h>
  8. #include <net/tcp.h>
  9. #include <linux/if_ether.h>
  10. #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
  11. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  12. #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  13. #endif
  14. struct nft_tproxy {
  15. enum nft_registers sreg_addr:8;
  16. enum nft_registers sreg_port:8;
  17. u8 family;
  18. };
  19. static void nft_tproxy_eval_v4(const struct nft_expr *expr,
  20. struct nft_regs *regs,
  21. const struct nft_pktinfo *pkt)
  22. {
  23. const struct nft_tproxy *priv = nft_expr_priv(expr);
  24. struct sk_buff *skb = pkt->skb;
  25. const struct iphdr *iph = ip_hdr(skb);
  26. struct udphdr _hdr, *hp;
  27. __be32 taddr = 0;
  28. __be16 tport = 0;
  29. struct sock *sk;
  30. if (pkt->tprot != IPPROTO_TCP &&
  31. pkt->tprot != IPPROTO_UDP) {
  32. regs->verdict.code = NFT_BREAK;
  33. return;
  34. }
  35. hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
  36. if (!hp) {
  37. regs->verdict.code = NFT_BREAK;
  38. return;
  39. }
  40. /* check if there's an ongoing connection on the packet addresses, this
  41. * happens if the redirect already happened and the current packet
  42. * belongs to an already established connection
  43. */
  44. sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
  45. iph->saddr, iph->daddr,
  46. hp->source, hp->dest,
  47. skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
  48. if (priv->sreg_addr)
  49. taddr = regs->data[priv->sreg_addr];
  50. taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
  51. if (priv->sreg_port)
  52. tport = nft_reg_load16(&regs->data[priv->sreg_port]);
  53. if (!tport)
  54. tport = hp->dest;
  55. /* UDP has no TCP_TIME_WAIT state, so we never enter here */
  56. if (sk && sk->sk_state == TCP_TIME_WAIT) {
  57. /* reopening a TIME_WAIT connection needs special handling */
  58. sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
  59. } else if (!sk) {
  60. /* no, there's no established connection, check if
  61. * there's a listener on the redirected addr/port
  62. */
  63. sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
  64. iph->saddr, taddr,
  65. hp->source, tport,
  66. skb->dev, NF_TPROXY_LOOKUP_LISTENER);
  67. }
  68. if (sk && nf_tproxy_sk_is_transparent(sk))
  69. nf_tproxy_assign_sock(skb, sk);
  70. else
  71. regs->verdict.code = NFT_BREAK;
  72. }
  73. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  74. static void nft_tproxy_eval_v6(const struct nft_expr *expr,
  75. struct nft_regs *regs,
  76. const struct nft_pktinfo *pkt)
  77. {
  78. const struct nft_tproxy *priv = nft_expr_priv(expr);
  79. struct sk_buff *skb = pkt->skb;
  80. const struct ipv6hdr *iph = ipv6_hdr(skb);
  81. struct in6_addr taddr;
  82. int thoff = pkt->xt.thoff;
  83. struct udphdr _hdr, *hp;
  84. __be16 tport = 0;
  85. struct sock *sk;
  86. int l4proto;
  87. memset(&taddr, 0, sizeof(taddr));
  88. if (pkt->tprot != IPPROTO_TCP &&
  89. pkt->tprot != IPPROTO_UDP) {
  90. regs->verdict.code = NFT_BREAK;
  91. return;
  92. }
  93. l4proto = pkt->tprot;
  94. hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
  95. if (hp == NULL) {
  96. regs->verdict.code = NFT_BREAK;
  97. return;
  98. }
  99. /* check if there's an ongoing connection on the packet addresses, this
  100. * happens if the redirect already happened and the current packet
  101. * belongs to an already established connection
  102. */
  103. sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
  104. &iph->saddr, &iph->daddr,
  105. hp->source, hp->dest,
  106. nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
  107. if (priv->sreg_addr)
  108. memcpy(&taddr, &regs->data[priv->sreg_addr], sizeof(taddr));
  109. taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
  110. if (priv->sreg_port)
  111. tport = nft_reg_load16(&regs->data[priv->sreg_port]);
  112. if (!tport)
  113. tport = hp->dest;
  114. /* UDP has no TCP_TIME_WAIT state, so we never enter here */
  115. if (sk && sk->sk_state == TCP_TIME_WAIT) {
  116. /* reopening a TIME_WAIT connection needs special handling */
  117. sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
  118. nft_net(pkt),
  119. &taddr,
  120. tport,
  121. sk);
  122. } else if (!sk) {
  123. /* no there's no established connection, check if
  124. * there's a listener on the redirected addr/port
  125. */
  126. sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
  127. l4proto, &iph->saddr, &taddr,
  128. hp->source, tport,
  129. nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
  130. }
  131. /* NOTE: assign_sock consumes our sk reference */
  132. if (sk && nf_tproxy_sk_is_transparent(sk))
  133. nf_tproxy_assign_sock(skb, sk);
  134. else
  135. regs->verdict.code = NFT_BREAK;
  136. }
  137. #endif
  138. static void nft_tproxy_eval(const struct nft_expr *expr,
  139. struct nft_regs *regs,
  140. const struct nft_pktinfo *pkt)
  141. {
  142. const struct nft_tproxy *priv = nft_expr_priv(expr);
  143. switch (nft_pf(pkt)) {
  144. case NFPROTO_IPV4:
  145. switch (priv->family) {
  146. case NFPROTO_IPV4:
  147. case NFPROTO_UNSPEC:
  148. nft_tproxy_eval_v4(expr, regs, pkt);
  149. return;
  150. }
  151. break;
  152. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  153. case NFPROTO_IPV6:
  154. switch (priv->family) {
  155. case NFPROTO_IPV6:
  156. case NFPROTO_UNSPEC:
  157. nft_tproxy_eval_v6(expr, regs, pkt);
  158. return;
  159. }
  160. #endif
  161. }
  162. regs->verdict.code = NFT_BREAK;
  163. }
  164. static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
  165. [NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },
  166. [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
  167. [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
  168. };
  169. static int nft_tproxy_init(const struct nft_ctx *ctx,
  170. const struct nft_expr *expr,
  171. const struct nlattr * const tb[])
  172. {
  173. struct nft_tproxy *priv = nft_expr_priv(expr);
  174. unsigned int alen = 0;
  175. int err;
  176. if (!tb[NFTA_TPROXY_FAMILY] ||
  177. (!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
  178. return -EINVAL;
  179. priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
  180. switch (ctx->family) {
  181. case NFPROTO_IPV4:
  182. if (priv->family != NFPROTO_IPV4)
  183. return -EINVAL;
  184. break;
  185. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  186. case NFPROTO_IPV6:
  187. if (priv->family != NFPROTO_IPV6)
  188. return -EINVAL;
  189. break;
  190. #endif
  191. case NFPROTO_INET:
  192. break;
  193. default:
  194. return -EOPNOTSUPP;
  195. }
  196. /* Address is specified but the rule family is not set accordingly */
  197. if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
  198. return -EINVAL;
  199. switch (priv->family) {
  200. case NFPROTO_IPV4:
  201. alen = sizeof_field(union nf_inet_addr, in);
  202. err = nf_defrag_ipv4_enable(ctx->net);
  203. if (err)
  204. return err;
  205. break;
  206. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  207. case NFPROTO_IPV6:
  208. alen = sizeof_field(union nf_inet_addr, in6);
  209. err = nf_defrag_ipv6_enable(ctx->net);
  210. if (err)
  211. return err;
  212. break;
  213. #endif
  214. case NFPROTO_UNSPEC:
  215. /* No address is specified here */
  216. err = nf_defrag_ipv4_enable(ctx->net);
  217. if (err)
  218. return err;
  219. #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
  220. err = nf_defrag_ipv6_enable(ctx->net);
  221. if (err)
  222. return err;
  223. #endif
  224. break;
  225. default:
  226. return -EOPNOTSUPP;
  227. }
  228. if (tb[NFTA_TPROXY_REG_ADDR]) {
  229. priv->sreg_addr = nft_parse_register(tb[NFTA_TPROXY_REG_ADDR]);
  230. err = nft_validate_register_load(priv->sreg_addr, alen);
  231. if (err < 0)
  232. return err;
  233. }
  234. if (tb[NFTA_TPROXY_REG_PORT]) {
  235. priv->sreg_port = nft_parse_register(tb[NFTA_TPROXY_REG_PORT]);
  236. err = nft_validate_register_load(priv->sreg_port, sizeof(u16));
  237. if (err < 0)
  238. return err;
  239. }
  240. return 0;
  241. }
  242. static int nft_tproxy_dump(struct sk_buff *skb,
  243. const struct nft_expr *expr)
  244. {
  245. const struct nft_tproxy *priv = nft_expr_priv(expr);
  246. if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
  247. return -1;
  248. if (priv->sreg_addr &&
  249. nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
  250. return -1;
  251. if (priv->sreg_port &&
  252. nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
  253. return -1;
  254. return 0;
  255. }
  256. static struct nft_expr_type nft_tproxy_type;
  257. static const struct nft_expr_ops nft_tproxy_ops = {
  258. .type = &nft_tproxy_type,
  259. .size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
  260. .eval = nft_tproxy_eval,
  261. .init = nft_tproxy_init,
  262. .dump = nft_tproxy_dump,
  263. };
  264. static struct nft_expr_type nft_tproxy_type __read_mostly = {
  265. .name = "tproxy",
  266. .ops = &nft_tproxy_ops,
  267. .policy = nft_tproxy_policy,
  268. .maxattr = NFTA_TPROXY_MAX,
  269. .owner = THIS_MODULE,
  270. };
  271. static int __init nft_tproxy_module_init(void)
  272. {
  273. return nft_register_expr(&nft_tproxy_type);
  274. }
  275. static void __exit nft_tproxy_module_exit(void)
  276. {
  277. nft_unregister_expr(&nft_tproxy_type);
  278. }
  279. module_init(nft_tproxy_module_init);
  280. module_exit(nft_tproxy_module_exit);
  281. MODULE_LICENSE("GPL");
  282. MODULE_AUTHOR("Máté Eckl");
  283. MODULE_DESCRIPTION("nf_tables tproxy support module");
  284. MODULE_ALIAS_NFT_EXPR("tproxy");