include/net/netfilter/nf_tproxy_core.h

   1 #ifndef _NF_TPROXY_CORE_H
   2 #define _NF_TPROXY_CORE_H
   3
   4 #include <linux/types.h>
   5 #include <linux/in.h>
   6 #include <linux/skbuff.h>
   7 #include <net/sock.h>
   8 #include <net/inet_hashtables.h>
   9 #include <net/inet6_hashtables.h>
  10 #include <net/tcp.h>
  11
  12 #define NFT_LOOKUP_ANY         0
  13 #define NFT_LOOKUP_LISTENER    1
  14 #define NFT_LOOKUP_ESTABLISHED 2
  15
  16 /* look up and get a reference to a matching socket */
  17
  18
  19 /* This function is used by the 'TPROXY' target and the 'socket'
  20  * match. The following lookups are supported:
  21  *
  22  * Explicit TProxy target rule
  23  * ===========================
  24  *
  25  * This is used when the user wants to intercept a connection matching
  26  * an explicit iptables rule. In this case the sockets are assumed
  27  * matching in preference order:
  28  *
  29  *   - match: if there's a fully established connection matching the
  30  *     _packet_ tuple, it is returned, assuming the redirection
  31  *     already took place and we process a packet belonging to an
  32  *     established connection
  33  *
  34  *   - match: if there's a listening socket matching the redirection
  35  *     (e.g. on-port & on-ip of the connection), it is returned,
  36  *     regardless if it was bound to 0.0.0.0 or an explicit
  37  *     address. The reasoning is that if there's an explicit rule, it
  38  *     does not really matter if the listener is bound to an interface
  39  *     or to 0. The user already stated that he wants redirection
  40  *     (since he added the rule).
  41  *
  42  * "socket" match based redirection (no specific rule)
  43  * ===================================================
  44  *
  45  * There are connections with dynamic endpoints (e.g. FTP data
  46  * connection) that the user is unable to add explicit rules
  47  * for. These are taken care of by a generic "socket" rule. It is
  48  * assumed that the proxy application is trusted to open such
  49  * connections without explicit iptables rule (except of course the
  50  * generic 'socket' rule). In this case the following sockets are
  51  * matched in preference order:
  52  *
  53  *   - match: if there's a fully established connection matching the
  54  *     _packet_ tuple
  55  *
  56  *   - match: if there's a non-zero bound listener (possibly with a
  57  *     non-local address) We don't accept zero-bound listeners, since
  58  *     then local services could intercept traffic going through the
  59  *     box.
  60  *
  61  * Please note that there's an overlap between what a TPROXY target
  62  * and a socket match will match. Normally if you have both rules the
  63  * "socket" match will be the first one, effectively all packets
  64  * belonging to established connections going through that one.
  65  */
  66 static inline struct sock *
  67 nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
  68                       const __be32 saddr, const __be32 daddr,
  69                       const __be16 sport, const __be16 dport,
  70                       const struct net_device *in, int lookup_type)
  71 {
  72         struct sock *sk;
  73
  74         /* look up socket */
  75         switch (protocol) {
  76         case IPPROTO_TCP:
  77                 switch (lookup_type) {
  78                 case NFT_LOOKUP_ANY:
  79                         sk = __inet_lookup(net, &tcp_hashinfo,
  80                                            saddr, sport, daddr, dport,
  81                                            in->ifindex);
  82                         break;
  83                 case NFT_LOOKUP_LISTENER:
  84                         sk = inet_lookup_listener(net, &tcp_hashinfo,
  85                                                     daddr, dport,
  86                                                     in->ifindex);
  87
  88                         /* NOTE: we return listeners even if bound to
  89                          * 0.0.0.0, those are filtered out in
  90                          * xt_socket, since xt_TPROXY needs 0 bound
  91                          * listeners too */
  92
  93                         break;
  94                 case NFT_LOOKUP_ESTABLISHED:
  95                         sk = inet_lookup_established(net, &tcp_hashinfo,
  96                                                     saddr, sport, daddr, dport,
  97                                                     in->ifindex);
  98                         break;
  99                 default:
 100                         WARN_ON(1);
 101                         sk = NULL;
 102                         break;
 103                 }
 104                 break;
 105         case IPPROTO_UDP:
 106                 sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
 107                                      in->ifindex);
 108                 if (sk && lookup_type != NFT_LOOKUP_ANY) {
 109                         int connected = (sk->sk_state == TCP_ESTABLISHED);
 110                         int wildcard = (inet_sk(sk)->inet_rcv_saddr == 0);
 111
 112                         /* NOTE: we return listeners even if bound to
 113                          * 0.0.0.0, those are filtered out in
 114                          * xt_socket, since xt_TPROXY needs 0 bound
 115                          * listeners too */
 116                         if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
 117                             (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
 118                                 sock_put(sk);
 119                                 sk = NULL;
 120                         }
 121                 }
 122                 break;
 123         default:
 124                 WARN_ON(1);
 125                 sk = NULL;
 126         }
 127
 128         pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n",
 129                  protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk);
 130
 131         return sk;
 132 }
 133
 134 #if IS_ENABLED(CONFIG_IPV6)
 135 static inline struct sock *
 136 nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,
 137                       const struct in6_addr *saddr, const struct in6_addr *daddr,
 138                       const __be16 sport, const __be16 dport,
 139                       const struct net_device *in, int lookup_type)
 140 {
 141         struct sock *sk;
 142
 143         /* look up socket */
 144         switch (protocol) {
 145         case IPPROTO_TCP:
 146                 switch (lookup_type) {
 147                 case NFT_LOOKUP_ANY:
 148                         sk = inet6_lookup(net, &tcp_hashinfo,
 149                                           saddr, sport, daddr, dport,
 150                                           in->ifindex);
 151                         break;
 152                 case NFT_LOOKUP_LISTENER:
 153                         sk = inet6_lookup_listener(net, &tcp_hashinfo,
 154                                                    daddr, ntohs(dport),
 155                                                    in->ifindex);
 156
 157                         /* NOTE: we return listeners even if bound to
 158                          * 0.0.0.0, those are filtered out in
 159                          * xt_socket, since xt_TPROXY needs 0 bound
 160                          * listeners too */
 161
 162                         break;
 163                 case NFT_LOOKUP_ESTABLISHED:
 164                         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 165                                                         saddr, sport, daddr, ntohs(dport),
 166                                                         in->ifindex);
 167                         break;
 168                 default:
 169                         WARN_ON(1);
 170                         sk = NULL;
 171                         break;
 172                 }
 173                 break;
 174         case IPPROTO_UDP:
 175                 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
 176                                      in->ifindex);
 177                 if (sk && lookup_type != NFT_LOOKUP_ANY) {
 178                         int connected = (sk->sk_state == TCP_ESTABLISHED);
 179                         int wildcard = ipv6_addr_any(&inet6_sk(sk)->rcv_saddr);
 180
 181                         /* NOTE: we return listeners even if bound to
 182                          * 0.0.0.0, those are filtered out in
 183                          * xt_socket, since xt_TPROXY needs 0 bound
 184                          * listeners too */
 185                         if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
 186                             (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
 187                                 sock_put(sk);
 188                                 sk = NULL;
 189                         }
 190                 }
 191                 break;
 192         default:
 193                 WARN_ON(1);
 194                 sk = NULL;
 195         }
 196
 197         pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
 198                  protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
 199
 200         return sk;
 201 }
 202 #endif
 203
 204 /* assign a socket to the skb -- consumes sk */
 205 void
 206 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk);
 207
 208 #endif