[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / xt_socket.c

/*
 * Transparent proxy support for Linux/iptables
 *
 * Copyright (C) 2007-2008 BalaBit IT Ltd.
 * Author: Krisztian Kovacs
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <net/icmp.h>
#include <net/sock.h>
#include <net/inet_sock.h>
#include <net/netfilter/nf_tproxy_core.h>
#include <net/netfilter/ipv4/nf_defrag_ipv4.h>

#include <linux/netfilter/xt_socket.h>

#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
#define XT_SOCKET_HAVE_CONNTRACK 1
#include <net/netfilter/nf_conntrack.h>
#endif

static int
extract_icmp_fields(const struct sk_buff *skb,
		    u8 *protocol,
		    __be32 *raddr,
		    __be32 *laddr,
		    __be16 *rport,
		    __be16 *lport)
{
	unsigned int outside_hdrlen = ip_hdrlen(skb);
	struct iphdr *inside_iph, _inside_iph;
	struct icmphdr *icmph, _icmph;
	__be16 *ports, _ports[2];

	icmph = skb_header_pointer(skb, outside_hdrlen,
				   sizeof(_icmph), &_icmph);
	if (icmph == NULL)
		return 1;

	switch (icmph->type) {
	case ICMP_DEST_UNREACH:
	case ICMP_SOURCE_QUENCH:
	case ICMP_REDIRECT:
	case ICMP_TIME_EXCEEDED:
	case ICMP_PARAMETERPROB:
		break;
	default:
		return 1;
	}

	inside_iph = skb_header_pointer(skb, outside_hdrlen +
					sizeof(struct icmphdr),
					sizeof(_inside_iph), &_inside_iph);
	if (inside_iph == NULL)
		return 1;

	if (inside_iph->protocol != IPPROTO_TCP &&
	    inside_iph->protocol != IPPROTO_UDP)
		return 1;

	ports = skb_header_pointer(skb, outside_hdrlen +
				   sizeof(struct icmphdr) +
				   (inside_iph->ihl << 2),
				   sizeof(_ports), &_ports);
	if (ports == NULL)
		return 1;

	/* the inside IP packet is the one quoted from our side, thus
	 * its saddr is the local address */
	*protocol = inside_iph->protocol;
	*laddr = inside_iph->saddr;
	*lport = ports[0];
	*raddr = inside_iph->daddr;
	*rport = ports[1];

	return 0;
}


static bool
socket_match(const struct sk_buff *skb, const struct xt_match_param *par,
	     const struct xt_socket_mtinfo1 *info)
{
	const struct iphdr *iph = ip_hdr(skb);
	struct udphdr _hdr, *hp = NULL;
	struct sock *sk;
	__be32 daddr, saddr;
	__be16 dport, sport;
	u8 protocol;
#ifdef XT_SOCKET_HAVE_CONNTRACK
	struct nf_conn const *ct;
	enum ip_conntrack_info ctinfo;
#endif

	if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
		hp = skb_header_pointer(skb, ip_hdrlen(skb),
					sizeof(_hdr), &_hdr);
		if (hp == NULL)
			return false;

		protocol = iph->protocol;
		saddr = iph->saddr;
		sport = hp->source;
		daddr = iph->daddr;
		dport = hp->dest;

	} else if (iph->protocol == IPPROTO_ICMP) {
		if (extract_icmp_fields(skb, &protocol, &saddr, &daddr,
					&sport, &dport))
			return false;
	} else {
		return false;
	}

#ifdef XT_SOCKET_HAVE_CONNTRACK
	/* Do the lookup with the original socket address in case this is a
	 * reply packet of an established SNAT-ted connection. */

	ct = nf_ct_get(skb, &ctinfo);
	if (ct && (ct != &nf_conntrack_untracked) &&
	    ((iph->protocol != IPPROTO_ICMP &&
	      ctinfo == IP_CT_IS_REPLY + IP_CT_ESTABLISHED) ||
	     (iph->protocol == IPPROTO_ICMP &&
	      ctinfo == IP_CT_IS_REPLY + IP_CT_RELATED)) &&
	    (ct->status & IPS_SRC_NAT_DONE)) {

		daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
		dport = (iph->protocol == IPPROTO_TCP) ?
			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port :
			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
	}
#endif

	sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
				   saddr, daddr, sport, dport, par->in, false);
	if (sk != NULL) {
		bool wildcard;
		bool transparent = true;

		/* Ignore sockets listening on INADDR_ANY */
		wildcard = (sk->sk_state != TCP_TIME_WAIT &&
			    inet_sk(sk)->inet_rcv_saddr == 0);

		/* Ignore non-transparent sockets,
		   if XT_SOCKET_TRANSPARENT is used */
		if (info && info->flags & XT_SOCKET_TRANSPARENT)
			transparent = ((sk->sk_state != TCP_TIME_WAIT &&
					inet_sk(sk)->transparent) ||
				       (sk->sk_state == TCP_TIME_WAIT &&
					inet_twsk(sk)->tw_transparent));

		nf_tproxy_put_sock(sk);

		if (wildcard || !transparent)
			sk = NULL;
	}

	pr_debug("socket match: proto %u %08x:%u -> %08x:%u "
		 "(orig %08x:%u) sock %p\n",
		 protocol, ntohl(saddr), ntohs(sport),
		 ntohl(daddr), ntohs(dport),
		 ntohl(iph->daddr), hp ? ntohs(hp->dest) : 0, sk);

	return (sk != NULL);
}

static bool
socket_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
	return socket_match(skb, par, NULL);
}

static bool
socket_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
{
	return socket_match(skb, par, par->matchinfo);
}

static struct xt_match socket_mt_reg[] __read_mostly = {
	{
		.name		= "socket",
		.revision	= 0,
		.family		= NFPROTO_IPV4,
		.match		= socket_mt_v0,
		.hooks		= 1 << NF_INET_PRE_ROUTING,
		.me		= THIS_MODULE,
	},
	{
		.name		= "socket",
		.revision	= 1,
		.family		= NFPROTO_IPV4,
		.match		= socket_mt_v1,
		.matchsize	= sizeof(struct xt_socket_mtinfo1),
		.hooks		= 1 << NF_INET_PRE_ROUTING,
		.me		= THIS_MODULE,
	},
};

static int __init socket_mt_init(void)
{
	nf_defrag_ipv4_enable();
	return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
}

static void __exit socket_mt_exit(void)
{
	xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
}

module_init(socket_mt_init);
module_exit(socket_mt_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
MODULE_DESCRIPTION("x_tables socket match module");
MODULE_ALIAS("ipt_socket");
Commit	Line	Data
136cdc71 KK	1	/*
	2	* Transparent proxy support for Linux/iptables
	3	*
	4	* Copyright (C) 2007-2008 BalaBit IT Ltd.
	5	* Author: Krisztian Kovacs
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*
	11	*/
	12
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/netfilter/x_tables.h>
	16	#include <linux/netfilter_ipv4/ip_tables.h>
	17	#include <net/tcp.h>
	18	#include <net/udp.h>
	19	#include <net/icmp.h>
	20	#include <net/sock.h>
	21	#include <net/inet_sock.h>
	22	#include <net/netfilter/nf_tproxy_core.h>
	23	#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
	24
a31e1ffd LAT	25	#include <linux/netfilter/xt_socket.h>
a31e1ffd LAT	26
136cdc71 KK	27	#if defined(CONFIG_NF_CONNTRACK) \|\| defined(CONFIG_NF_CONNTRACK_MODULE)
	28	#define XT_SOCKET_HAVE_CONNTRACK 1
	29	#include <net/netfilter/nf_conntrack.h>
	30	#endif
	31
	32	static int
	33	extract_icmp_fields(const struct sk_buff *skb,
	34	u8 *protocol,
	35	__be32 *raddr,
	36	__be32 *laddr,
	37	__be16 *rport,
	38	__be16 *lport)
	39	{
	40	unsigned int outside_hdrlen = ip_hdrlen(skb);
	41	struct iphdr *inside_iph, _inside_iph;
	42	struct icmphdr *icmph, _icmph;
	43	__be16 *ports, _ports[2];
	44
	45	icmph = skb_header_pointer(skb, outside_hdrlen,
	46	sizeof(_icmph), &_icmph);
	47	if (icmph == NULL)
	48	return 1;
	49
	50	switch (icmph->type) {
	51	case ICMP_DEST_UNREACH:
	52	case ICMP_SOURCE_QUENCH:
	53	case ICMP_REDIRECT:
	54	case ICMP_TIME_EXCEEDED:
	55	case ICMP_PARAMETERPROB:
	56	break;
	57	default:
	58	return 1;
	59	}
	60
	61	inside_iph = skb_header_pointer(skb, outside_hdrlen +
	62	sizeof(struct icmphdr),
	63	sizeof(_inside_iph), &_inside_iph);
	64	if (inside_iph == NULL)
	65	return 1;
	66
	67	if (inside_iph->protocol != IPPROTO_TCP &&
	68	inside_iph->protocol != IPPROTO_UDP)
	69	return 1;
	70
	71	ports = skb_header_pointer(skb, outside_hdrlen +
	72	sizeof(struct icmphdr) +
	73	(inside_iph->ihl << 2),
	74	sizeof(_ports), &_ports);
	75	if (ports == NULL)
	76	return 1;
	77
	78	/* the inside IP packet is the one quoted from our side, thus
	79	* its saddr is the local address */
	80	*protocol = inside_iph->protocol;
	81	*laddr = inside_iph->saddr;
	82	*lport = ports[0];
	83	*raddr = inside_iph->daddr;
	84	*rport = ports[1];
	85
	86	return 0;
	87	}
	88
	89
	90	static bool
a31e1ffd LAT	91	socket_match(const struct sk_buff skb, const struct xt_match_param par,
a31e1ffd LAT	92	const struct xt_socket_mtinfo1 *info)
136cdc71 KK	93	{
	94	const struct iphdr *iph = ip_hdr(skb);
	95	struct udphdr _hdr, *hp = NULL;
	96	struct sock *sk;
	97	__be32 daddr, saddr;
	98	__be16 dport, sport;
	99	u8 protocol;
	100	#ifdef XT_SOCKET_HAVE_CONNTRACK
	101	struct nf_conn const *ct;
	102	enum ip_conntrack_info ctinfo;
	103	#endif
	104
	105	if (iph->protocol == IPPROTO_UDP \|\| iph->protocol == IPPROTO_TCP) {
	106	hp = skb_header_pointer(skb, ip_hdrlen(skb),
	107	sizeof(_hdr), &_hdr);
	108	if (hp == NULL)
	109	return false;
	110
	111	protocol = iph->protocol;
	112	saddr = iph->saddr;
	113	sport = hp->source;
	114	daddr = iph->daddr;
	115	dport = hp->dest;
	116
	117	} else if (iph->protocol == IPPROTO_ICMP) {
	118	if (extract_icmp_fields(skb, &protocol, &saddr, &daddr,
	119	&sport, &dport))
	120	return false;
	121	} else {
	122	return false;
	123	}
	124
	125	#ifdef XT_SOCKET_HAVE_CONNTRACK
	126	/* Do the lookup with the original socket address in case this is a
	127	* reply packet of an established SNAT-ted connection. */
	128
	129	ct = nf_ct_get(skb, &ctinfo);
	130	if (ct && (ct != &nf_conntrack_untracked) &&
	131	((iph->protocol != IPPROTO_ICMP &&
	132	ctinfo == IP_CT_IS_REPLY + IP_CT_ESTABLISHED) \|\|
	133	(iph->protocol == IPPROTO_ICMP &&
	134	ctinfo == IP_CT_IS_REPLY + IP_CT_RELATED)) &&
	135	(ct->status & IPS_SRC_NAT_DONE)) {
	136
	137	daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
	138	dport = (iph->protocol == IPPROTO_TCP) ?
	139	ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port :
	140	ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
	141	}
	142	#endif
	143
	144	sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
f7108a20	145	saddr, daddr, sport, dport, par->in, false);
136cdc71	146	if (sk != NULL) {
a31e1ffd LAT	147	bool wildcard;
	148	bool transparent = true;
	149
	150	/* Ignore sockets listening on INADDR_ANY */
	151	wildcard = (sk->sk_state != TCP_TIME_WAIT &&
c720c7e8	152	inet_sk(sk)->inet_rcv_saddr == 0);
a31e1ffd LAT	153
	154	/* Ignore non-transparent sockets,
	155	if XT_SOCKET_TRANSPARENT is used */
	156	if (info && info->flags & XT_SOCKET_TRANSPARENT)
	157	transparent = ((sk->sk_state != TCP_TIME_WAIT &&
	158	inet_sk(sk)->transparent) \|\|
	159	(sk->sk_state == TCP_TIME_WAIT &&
	160	inet_twsk(sk)->tw_transparent));
136cdc71 KK	161
136cdc71 KK	162	nf_tproxy_put_sock(sk);
a31e1ffd LAT	163
a31e1ffd LAT	164	if (wildcard \|\| !transparent)
136cdc71 KK	165	sk = NULL;
	166	}
	167
	168	pr_debug("socket match: proto %u %08x:%u -> %08x:%u "
	169	"(orig %08x:%u) sock %p\n",
	170	protocol, ntohl(saddr), ntohs(sport),
	171	ntohl(daddr), ntohs(dport),
	172	ntohl(iph->daddr), hp ? ntohs(hp->dest) : 0, sk);
	173
	174	return (sk != NULL);
	175	}
	176
a31e1ffd LAT	177	static bool
	178	socket_mt_v0(const struct sk_buff skb, const struct xt_match_param par)
	179	{
	180	return socket_match(skb, par, NULL);
	181	}
	182
	183	static bool
	184	socket_mt_v1(const struct sk_buff skb, const struct xt_match_param par)
	185	{
	186	return socket_match(skb, par, par->matchinfo);
	187	}
	188
	189	static struct xt_match socket_mt_reg[] __read_mostly = {
	190	{
	191	.name = "socket",
	192	.revision = 0,
	193	.family = NFPROTO_IPV4,
	194	.match = socket_mt_v0,
	195	.hooks = 1 << NF_INET_PRE_ROUTING,
	196	.me = THIS_MODULE,
	197	},
	198	{
	199	.name = "socket",
	200	.revision = 1,
	201	.family = NFPROTO_IPV4,
	202	.match = socket_mt_v1,
	203	.matchsize = sizeof(struct xt_socket_mtinfo1),
	204	.hooks = 1 << NF_INET_PRE_ROUTING,
	205	.me = THIS_MODULE,
	206	},
136cdc71 KK	207	};
	208
	209	static int __init socket_mt_init(void)
	210	{
	211	nf_defrag_ipv4_enable();
a31e1ffd	212	return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
136cdc71 KK	213	}
	214
	215	static void __exit socket_mt_exit(void)
	216	{
a31e1ffd	217	xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
136cdc71 KK	218	}
	219
	220	module_init(socket_mt_init);
	221	module_exit(socket_mt_exit);
	222
	223	MODULE_LICENSE("GPL");
	224	MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
	225	MODULE_DESCRIPTION("x_tables socket match module");
	226	MODULE_ALIAS("ipt_socket");