net/ipv6/netfilter/nf_tproxy_ipv6.c

   1 #include <net/netfilter/nf_tproxy.h>
   2 #include <linux/module.h>
   3 #include <net/inet6_hashtables.h>
   4 #include <net/addrconf.h>
   5 #include <net/udp.h>
   6 #include <net/tcp.h>
   7
   8 const struct in6_addr *
   9 nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
  10               const struct in6_addr *daddr)
  11 {
  12         struct inet6_dev *indev;
  13         struct inet6_ifaddr *ifa;
  14         struct in6_addr *laddr;
  15
  16         if (!ipv6_addr_any(user_laddr))
  17                 return user_laddr;
  18         laddr = NULL;
  19
  20         indev = __in6_dev_get(skb->dev);
  21         if (indev) {
  22                 read_lock_bh(&indev->lock);
  23                 list_for_each_entry(ifa, &indev->addr_list, if_list) {
  24                         if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
  25                                 continue;
  26
  27                         laddr = &ifa->addr;
  28                         break;
  29                 }
  30                 read_unlock_bh(&indev->lock);
  31         }
  32
  33         return laddr ? laddr : daddr;
  34 }
  35 EXPORT_SYMBOL_GPL(nf_tproxy_laddr6);
  36
  37 struct sock *
  38 nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
  39                          struct net *net,
  40                          const struct in6_addr *laddr,
  41                          const __be16 lport,
  42                          struct sock *sk)
  43 {
  44         const struct ipv6hdr *iph = ipv6_hdr(skb);
  45         struct tcphdr _hdr, *hp;
  46
  47         hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
  48         if (hp == NULL) {
  49                 inet_twsk_put(inet_twsk(sk));
  50                 return NULL;
  51         }
  52
  53         if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
  54                 /* SYN to a TIME_WAIT socket, we'd rather redirect it
  55                  * to a listener socket if there's one */
  56                 struct sock *sk2;
  57
  58                 sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
  59                                             &iph->saddr,
  60                                             nf_tproxy_laddr6(skb, laddr, &iph->daddr),
  61                                             hp->source,
  62                                             lport ? lport : hp->dest,
  63                                             skb->dev, NF_TPROXY_LOOKUP_LISTENER);
  64                 if (sk2) {
  65                         inet_twsk_deschedule_put(inet_twsk(sk));
  66                         sk = sk2;
  67                 }
  68         }
  69
  70         return sk;
  71 }
  72 EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
  73
  74 struct sock *
  75 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
  76                       const u8 protocol,
  77                       const struct in6_addr *saddr, const struct in6_addr *daddr,
  78                       const __be16 sport, const __be16 dport,
  79                       const struct net_device *in,
  80                       const enum nf_tproxy_lookup_t lookup_type)
  81 {
  82         struct sock *sk;
  83
  84         switch (protocol) {
  85         case IPPROTO_TCP: {
  86                 struct tcphdr _hdr, *hp;
  87
  88                 hp = skb_header_pointer(skb, thoff,
  89                                         sizeof(struct tcphdr), &_hdr);
  90                 if (hp == NULL)
  91                         return NULL;
  92
  93                 switch (lookup_type) {
  94                 case NF_TPROXY_LOOKUP_LISTENER:
  95                         sk = inet6_lookup_listener(net, &tcp_hashinfo, skb,
  96                                                    thoff + __tcp_hdrlen(hp),
  97                                                    saddr, sport,
  98                                                    daddr, ntohs(dport),
  99                                                    in->ifindex, 0);
 100
 101                         if (sk && !refcount_inc_not_zero(&sk->sk_refcnt))
 102                                 sk = NULL;
 103                         /* NOTE: we return listeners even if bound to
 104                          * 0.0.0.0, those are filtered out in
 105                          * xt_socket, since xt_TPROXY needs 0 bound
 106                          * listeners too
 107                          */
 108                         break;
 109                 case NF_TPROXY_LOOKUP_ESTABLISHED:
 110                         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 111                                                         saddr, sport, daddr, ntohs(dport),
 112                                                         in->ifindex, 0);
 113                         break;
 114                 default:
 115                         BUG();
 116                 }
 117                 break;
 118                 }
 119         case IPPROTO_UDP:
 120                 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
 121                                      in->ifindex);
 122                 if (sk) {
 123                         int connected = (sk->sk_state == TCP_ESTABLISHED);
 124                         int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr);
 125
 126                         /* NOTE: we return listeners even if bound to
 127                          * 0.0.0.0, those are filtered out in
 128                          * xt_socket, since xt_TPROXY needs 0 bound
 129                          * listeners too
 130                          */
 131                         if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
 132                             (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) {
 133                                 sock_put(sk);
 134                                 sk = NULL;
 135                         }
 136                 }
 137                 break;
 138         default:
 139                 WARN_ON(1);
 140                 sk = NULL;
 141         }
 142
 143         pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
 144                  protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
 145
 146         return sk;
 147 }
 148 EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6);
 149
 150 MODULE_LICENSE("GPL");
 151 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
 152 MODULE_DESCRIPTION("Netfilter IPv4 transparent proxy support");