1 /* 2 * Transparent proxy support for Linux/iptables 3 * 4 * Copyright (C) 2007-2008 BalaBit IT Ltd. 5 * Author: Krisztian Kovacs 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 */ 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 #include <linux/module.h> 14 #include <linux/skbuff.h> 15 #include <linux/netfilter/x_tables.h> 16 #include <linux/netfilter_ipv4/ip_tables.h> 17 #include <linux/netfilter_ipv6/ip6_tables.h> 18 #include <net/tcp.h> 19 #include <net/udp.h> 20 #include <net/icmp.h> 21 #include <net/sock.h> 22 #include <net/inet_sock.h> 23 #include <net/netfilter/nf_tproxy_core.h> 24 #include <net/netfilter/ipv4/nf_defrag_ipv4.h> 25 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 26 27 #include <linux/netfilter/xt_socket.h> 28 29 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 30 #define XT_SOCKET_HAVE_CONNTRACK 1 31 #include <net/netfilter/nf_conntrack.h> 32 #endif 33 34 static int 35 extract_icmp4_fields(const struct sk_buff *skb, 36 u8 *protocol, 37 __be32 *raddr, 38 __be32 *laddr, 39 __be16 *rport, 40 __be16 *lport) 41 { 42 unsigned int outside_hdrlen = ip_hdrlen(skb); 43 struct iphdr *inside_iph, _inside_iph; 44 struct icmphdr *icmph, _icmph; 45 __be16 *ports, _ports[2]; 46 47 icmph = skb_header_pointer(skb, outside_hdrlen, 48 sizeof(_icmph), &_icmph); 49 if (icmph == NULL) 50 return 1; 51 52 switch (icmph->type) { 53 case ICMP_DEST_UNREACH: 54 case ICMP_SOURCE_QUENCH: 55 case ICMP_REDIRECT: 56 case ICMP_TIME_EXCEEDED: 57 case ICMP_PARAMETERPROB: 58 break; 59 default: 60 return 1; 61 } 62 63 inside_iph = skb_header_pointer(skb, outside_hdrlen + 64 sizeof(struct icmphdr), 65 sizeof(_inside_iph), &_inside_iph); 66 if (inside_iph == NULL) 67 return 1; 68 69 if (inside_iph->protocol != IPPROTO_TCP && 70 inside_iph->protocol != IPPROTO_UDP) 71 return 1; 72 73 ports = skb_header_pointer(skb, outside_hdrlen + 74 sizeof(struct icmphdr) + 75 (inside_iph->ihl << 2), 76 sizeof(_ports), &_ports); 77 if (ports == NULL) 78 return 1; 79 80 /* the inside IP packet is the one quoted from our side, thus 81 * its saddr is the local address */ 82 *protocol = inside_iph->protocol; 83 *laddr = inside_iph->saddr; 84 *lport = ports[0]; 85 *raddr = inside_iph->daddr; 86 *rport = ports[1]; 87 88 return 0; 89 } 90 91 static bool 92 socket_match(const struct sk_buff *skb, struct xt_action_param *par, 93 const struct xt_socket_mtinfo1 *info) 94 { 95 const struct iphdr *iph = ip_hdr(skb); 96 struct udphdr _hdr, *hp = NULL; 97 struct sock *sk; 98 __be32 daddr, saddr; 99 __be16 dport, sport; 100 u8 protocol; 101 #ifdef XT_SOCKET_HAVE_CONNTRACK 102 struct nf_conn const *ct; 103 enum ip_conntrack_info ctinfo; 104 #endif 105 106 if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) { 107 hp = skb_header_pointer(skb, ip_hdrlen(skb), 108 sizeof(_hdr), &_hdr); 109 if (hp == NULL) 110 return false; 111 112 protocol = iph->protocol; 113 saddr = iph->saddr; 114 sport = hp->source; 115 daddr = iph->daddr; 116 dport = hp->dest; 117 118 } else if (iph->protocol == IPPROTO_ICMP) { 119 if (extract_icmp4_fields(skb, &protocol, &saddr, &daddr, 120 &sport, &dport)) 121 return false; 122 } else { 123 return false; 124 } 125 126 #ifdef XT_SOCKET_HAVE_CONNTRACK 127 /* Do the lookup with the original socket address in case this is a 128 * reply packet of an established SNAT-ted connection. */ 129 130 ct = nf_ct_get(skb, &ctinfo); 131 if (ct && !nf_ct_is_untracked(ct) && 132 ((iph->protocol != IPPROTO_ICMP && 133 ctinfo == IP_CT_IS_REPLY + IP_CT_ESTABLISHED) || 134 (iph->protocol == IPPROTO_ICMP && 135 ctinfo == IP_CT_IS_REPLY + IP_CT_RELATED)) && 136 (ct->status & IPS_SRC_NAT_DONE)) { 137 138 daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip; 139 dport = (iph->protocol == IPPROTO_TCP) ? 140 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port : 141 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port; 142 } 143 #endif 144 145 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, 146 saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); 147 if (sk != NULL) { 148 bool wildcard; 149 bool transparent = true; 150 151 /* Ignore sockets listening on INADDR_ANY */ 152 wildcard = (sk->sk_state != TCP_TIME_WAIT && 153 inet_sk(sk)->inet_rcv_saddr == 0); 154 155 /* Ignore non-transparent sockets, 156 if XT_SOCKET_TRANSPARENT is used */ 157 if (info && info->flags & XT_SOCKET_TRANSPARENT) 158 transparent = ((sk->sk_state != TCP_TIME_WAIT && 159 inet_sk(sk)->transparent) || 160 (sk->sk_state == TCP_TIME_WAIT && 161 inet_twsk(sk)->tw_transparent)); 162 163 nf_tproxy_put_sock(sk); 164 165 if (wildcard || !transparent) 166 sk = NULL; 167 } 168 169 pr_debug("proto %hhu %pI4:%hu -> %pI4:%hu (orig %pI4:%hu) sock %p\n", 170 protocol, &saddr, ntohs(sport), 171 &daddr, ntohs(dport), 172 &iph->daddr, hp ? ntohs(hp->dest) : 0, sk); 173 174 return (sk != NULL); 175 } 176 177 static bool 178 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par) 179 { 180 return socket_match(skb, par, NULL); 181 } 182 183 static bool 184 socket_mt4_v1(const struct sk_buff *skb, struct xt_action_param *par) 185 { 186 return socket_match(skb, par, par->matchinfo); 187 } 188 189 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 190 191 static int 192 extract_icmp6_fields(const struct sk_buff *skb, 193 unsigned int outside_hdrlen, 194 u8 *protocol, 195 struct in6_addr **raddr, 196 struct in6_addr **laddr, 197 __be16 *rport, 198 __be16 *lport) 199 { 200 struct ipv6hdr *inside_iph, _inside_iph; 201 struct icmp6hdr *icmph, _icmph; 202 __be16 *ports, _ports[2]; 203 u8 inside_nexthdr; 204 int inside_hdrlen; 205 206 icmph = skb_header_pointer(skb, outside_hdrlen, 207 sizeof(_icmph), &_icmph); 208 if (icmph == NULL) 209 return 1; 210 211 if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK) 212 return 1; 213 214 inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph); 215 if (inside_iph == NULL) 216 return 1; 217 inside_nexthdr = inside_iph->nexthdr; 218 219 inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph), &inside_nexthdr); 220 if (inside_hdrlen < 0) 221 return 1; /* hjm: Packet has no/incomplete transport layer headers. */ 222 223 if (inside_nexthdr != IPPROTO_TCP && 224 inside_nexthdr != IPPROTO_UDP) 225 return 1; 226 227 ports = skb_header_pointer(skb, inside_hdrlen, 228 sizeof(_ports), &_ports); 229 if (ports == NULL) 230 return 1; 231 232 /* the inside IP packet is the one quoted from our side, thus 233 * its saddr is the local address */ 234 *protocol = inside_nexthdr; 235 *laddr = &inside_iph->saddr; 236 *lport = ports[0]; 237 *raddr = &inside_iph->daddr; 238 *rport = ports[1]; 239 240 return 0; 241 } 242 243 static bool 244 socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par) 245 { 246 struct ipv6hdr *iph = ipv6_hdr(skb); 247 struct udphdr _hdr, *hp = NULL; 248 struct sock *sk; 249 struct in6_addr *daddr, *saddr; 250 __be16 dport, sport; 251 int thoff; 252 u8 tproto; 253 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo; 254 255 tproto = ipv6_find_hdr(skb, &thoff, -1, NULL); 256 if (tproto < 0) { 257 pr_debug("unable to find transport header in IPv6 packet, dropping\n"); 258 return NF_DROP; 259 } 260 261 if (tproto == IPPROTO_UDP || tproto == IPPROTO_TCP) { 262 hp = skb_header_pointer(skb, thoff, 263 sizeof(_hdr), &_hdr); 264 if (hp == NULL) 265 return false; 266 267 saddr = &iph->saddr; 268 sport = hp->source; 269 daddr = &iph->daddr; 270 dport = hp->dest; 271 272 } else if (tproto == IPPROTO_ICMPV6) { 273 if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr, 274 &sport, &dport)) 275 return false; 276 } else { 277 return false; 278 } 279 280 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto, 281 saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); 282 if (sk != NULL) { 283 bool wildcard; 284 bool transparent = true; 285 286 /* Ignore sockets listening on INADDR_ANY */ 287 wildcard = (sk->sk_state != TCP_TIME_WAIT && 288 ipv6_addr_any(&inet6_sk(sk)->rcv_saddr)); 289 290 /* Ignore non-transparent sockets, 291 if XT_SOCKET_TRANSPARENT is used */ 292 if (info && info->flags & XT_SOCKET_TRANSPARENT) 293 transparent = ((sk->sk_state != TCP_TIME_WAIT && 294 inet_sk(sk)->transparent) || 295 (sk->sk_state == TCP_TIME_WAIT && 296 inet_twsk(sk)->tw_transparent)); 297 298 nf_tproxy_put_sock(sk); 299 300 if (wildcard || !transparent) 301 sk = NULL; 302 } 303 304 pr_debug("proto %hhu %pI6:%hu -> %pI6:%hu " 305 "(orig %pI6:%hu) sock %p\n", 306 tproto, saddr, ntohs(sport), 307 daddr, ntohs(dport), 308 &iph->daddr, hp ? ntohs(hp->dest) : 0, sk); 309 310 return (sk != NULL); 311 } 312 #endif 313 314 static struct xt_match socket_mt_reg[] __read_mostly = { 315 { 316 .name = "socket", 317 .revision = 0, 318 .family = NFPROTO_IPV4, 319 .match = socket_mt4_v0, 320 .hooks = (1 << NF_INET_PRE_ROUTING) | 321 (1 << NF_INET_LOCAL_IN), 322 .me = THIS_MODULE, 323 }, 324 { 325 .name = "socket", 326 .revision = 1, 327 .family = NFPROTO_IPV4, 328 .match = socket_mt4_v1, 329 .matchsize = sizeof(struct xt_socket_mtinfo1), 330 .hooks = (1 << NF_INET_PRE_ROUTING) | 331 (1 << NF_INET_LOCAL_IN), 332 .me = THIS_MODULE, 333 }, 334 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 335 { 336 .name = "socket", 337 .revision = 1, 338 .family = NFPROTO_IPV6, 339 .match = socket_mt6_v1, 340 .matchsize = sizeof(struct xt_socket_mtinfo1), 341 .hooks = (1 << NF_INET_PRE_ROUTING) | 342 (1 << NF_INET_LOCAL_IN), 343 .me = THIS_MODULE, 344 }, 345 #endif 346 }; 347 348 static int __init socket_mt_init(void) 349 { 350 nf_defrag_ipv4_enable(); 351 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 352 nf_defrag_ipv6_enable(); 353 #endif 354 355 return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg)); 356 } 357 358 static void __exit socket_mt_exit(void) 359 { 360 xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg)); 361 } 362 363 module_init(socket_mt_init); 364 module_exit(socket_mt_exit); 365 366 MODULE_LICENSE("GPL"); 367 MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler"); 368 MODULE_DESCRIPTION("x_tables socket match module"); 369 MODULE_ALIAS("ipt_socket"); 370 MODULE_ALIAS("ip6t_socket"); 371