2 * Transparent proxy support for Linux/iptables
4 * Copyright (c) 2006-2010 BalaBit IT Ltd.
5 * Author: Balazs Scheidler, Krisztian Kovacs
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
16 #include <net/checksum.h>
18 #include <net/inet_sock.h>
19 #include <linux/inetdevice.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter_ipv4/ip_tables.h>
23 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
24 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
25 #include <net/if_inet6.h>
26 #include <net/addrconf.h>
27 #include <linux/netfilter_ipv6/ip6_tables.h>
28 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
31 #include <net/netfilter/nf_tproxy_core.h>
32 #include <linux/netfilter/xt_TPROXY.h>
35 tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
37 struct in_device *indev;
45 indev = __in_dev_get_rcu(skb->dev);
46 for_primary_ifa(indev) {
47 laddr = ifa->ifa_local;
52 return laddr ? laddr : daddr;
56 * tproxy_handle_time_wait4() - handle IPv4 TCP TIME_WAIT reopen redirections
57 * @skb: The skb being processed.
58 * @laddr: IPv4 address to redirect to or zero.
59 * @lport: TCP port to redirect to or zero.
60 * @sk: The TIME_WAIT TCP socket found by the lookup.
62 * We have to handle SYN packets arriving to TIME_WAIT sockets
63 * differently: instead of reopening the connection we should rather
64 * redirect the new connection to the proxy if there's a listener
67 * tproxy_handle_time_wait4() consumes the socket reference passed in.
69 * Returns the listener socket if there's one, the TIME_WAIT socket if
70 * no such listener is found, or NULL if the TCP header is incomplete.
73 tproxy_handle_time_wait4(struct sk_buff *skb, __be32 laddr, __be16 lport,
76 const struct iphdr *iph = ip_hdr(skb);
77 struct tcphdr _hdr, *hp;
79 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
81 inet_twsk_put(inet_twsk(sk));
85 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
86 /* SYN to a TIME_WAIT socket, we'd rather redirect it
87 * to a listener socket if there's one */
90 sk2 = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
91 iph->saddr, laddr ? laddr : iph->daddr,
92 hp->source, lport ? lport : hp->dest,
93 skb->dev, NFT_LOOKUP_LISTENER);
95 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
96 inet_twsk_put(inet_twsk(sk));
105 tproxy_tg4(struct sk_buff *skb, __be32 laddr, __be16 lport,
106 u_int32_t mark_mask, u_int32_t mark_value)
108 const struct iphdr *iph = ip_hdr(skb);
109 struct udphdr _hdr, *hp;
112 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
116 /* check if there's an ongoing connection on the packet
117 * addresses, this happens if the redirect already happened
118 * and the current packet belongs to an already established
120 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
121 iph->saddr, iph->daddr,
122 hp->source, hp->dest,
123 skb->dev, NFT_LOOKUP_ESTABLISHED);
125 laddr = tproxy_laddr4(skb, laddr, iph->daddr);
129 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
130 if (sk && sk->sk_state == TCP_TIME_WAIT)
131 /* reopening a TIME_WAIT connection needs special handling */
132 sk = tproxy_handle_time_wait4(skb, laddr, lport, sk);
134 /* no, there's no established connection, check if
135 * there's a listener on the redirected addr/port */
136 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
139 skb->dev, NFT_LOOKUP_LISTENER);
141 /* NOTE: assign_sock consumes our sk reference */
142 if (sk && nf_tproxy_assign_sock(skb, sk)) {
143 /* This should be in a separate target, but we don't do multiple
144 targets on the same rule yet */
145 skb->mark = (skb->mark & ~mark_mask) ^ mark_value;
147 pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
148 iph->protocol, &iph->daddr, ntohs(hp->dest),
149 &laddr, ntohs(lport), skb->mark);
153 pr_debug("no socket, dropping: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
154 iph->protocol, &iph->saddr, ntohs(hp->source),
155 &iph->daddr, ntohs(hp->dest), skb->mark);
160 tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par)
162 const struct xt_tproxy_target_info *tgi = par->targinfo;
164 return tproxy_tg4(skb, tgi->laddr, tgi->lport, tgi->mark_mask, tgi->mark_value);
168 tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par)
170 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
172 return tproxy_tg4(skb, tgi->laddr.ip, tgi->lport, tgi->mark_mask, tgi->mark_value);
175 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
177 static inline const struct in6_addr *
178 tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
179 const struct in6_addr *daddr)
181 struct inet6_dev *indev;
182 struct inet6_ifaddr *ifa;
183 struct in6_addr *laddr;
185 if (!ipv6_addr_any(user_laddr))
190 indev = __in6_dev_get(skb->dev);
192 list_for_each_entry(ifa, &indev->addr_list, if_list) {
193 if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
201 return laddr ? laddr : daddr;
205 * tproxy_handle_time_wait6() - handle IPv6 TCP TIME_WAIT reopen redirections
206 * @skb: The skb being processed.
207 * @tproto: Transport protocol.
208 * @thoff: Transport protocol header offset.
209 * @par: Iptables target parameters.
210 * @sk: The TIME_WAIT TCP socket found by the lookup.
212 * We have to handle SYN packets arriving to TIME_WAIT sockets
213 * differently: instead of reopening the connection we should rather
214 * redirect the new connection to the proxy if there's a listener
217 * tproxy_handle_time_wait6() consumes the socket reference passed in.
219 * Returns the listener socket if there's one, the TIME_WAIT socket if
220 * no such listener is found, or NULL if the TCP header is incomplete.
223 tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
224 const struct xt_action_param *par,
227 const struct ipv6hdr *iph = ipv6_hdr(skb);
228 struct tcphdr _hdr, *hp;
229 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
231 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
233 inet_twsk_put(inet_twsk(sk));
237 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
238 /* SYN to a TIME_WAIT socket, we'd rather redirect it
239 * to a listener socket if there's one */
242 sk2 = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
244 tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr),
246 tgi->lport ? tgi->lport : hp->dest,
247 skb->dev, NFT_LOOKUP_LISTENER);
249 inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
250 inet_twsk_put(inet_twsk(sk));
259 tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
261 const struct ipv6hdr *iph = ipv6_hdr(skb);
262 const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
263 struct udphdr _hdr, *hp;
265 const struct in6_addr *laddr;
270 tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
272 pr_debug("unable to find transport header in IPv6 packet, dropping\n");
276 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
278 pr_debug("unable to grab transport header contents in IPv6 packet, dropping\n");
282 /* check if there's an ongoing connection on the packet
283 * addresses, this happens if the redirect already happened
284 * and the current packet belongs to an already established
286 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
287 &iph->saddr, &iph->daddr,
288 hp->source, hp->dest,
289 par->in, NFT_LOOKUP_ESTABLISHED);
291 laddr = tproxy_laddr6(skb, &tgi->laddr.in6, &iph->daddr);
292 lport = tgi->lport ? tgi->lport : hp->dest;
294 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
295 if (sk && sk->sk_state == TCP_TIME_WAIT)
296 /* reopening a TIME_WAIT connection needs special handling */
297 sk = tproxy_handle_time_wait6(skb, tproto, thoff, par, sk);
299 /* no there's no established connection, check if
300 * there's a listener on the redirected addr/port */
301 sk = nf_tproxy_get_sock_v6(dev_net(skb->dev), tproto,
304 par->in, NFT_LOOKUP_LISTENER);
306 /* NOTE: assign_sock consumes our sk reference */
307 if (sk && nf_tproxy_assign_sock(skb, sk)) {
308 /* This should be in a separate target, but we don't do multiple
309 targets on the same rule yet */
310 skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
312 pr_debug("redirecting: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
313 tproto, &iph->saddr, ntohs(hp->source),
314 laddr, ntohs(lport), skb->mark);
318 pr_debug("no socket, dropping: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
319 tproto, &iph->saddr, ntohs(hp->source),
320 &iph->daddr, ntohs(hp->dest), skb->mark);
325 static int tproxy_tg6_check(const struct xt_tgchk_param *par)
327 const struct ip6t_ip6 *i = par->entryinfo;
329 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
330 && !(i->flags & IP6T_INV_PROTO))
333 pr_info("Can be used only in combination with "
334 "either -p tcp or -p udp\n");
339 static int tproxy_tg4_check(const struct xt_tgchk_param *par)
341 const struct ipt_ip *i = par->entryinfo;
343 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
344 && !(i->invflags & IPT_INV_PROTO))
347 pr_info("Can be used only in combination with "
348 "either -p tcp or -p udp\n");
352 static struct xt_target tproxy_tg_reg[] __read_mostly = {
355 .family = NFPROTO_IPV4,
357 .target = tproxy_tg4_v0,
359 .targetsize = sizeof(struct xt_tproxy_target_info),
360 .checkentry = tproxy_tg4_check,
361 .hooks = 1 << NF_INET_PRE_ROUTING,
366 .family = NFPROTO_IPV4,
368 .target = tproxy_tg4_v1,
370 .targetsize = sizeof(struct xt_tproxy_target_info_v1),
371 .checkentry = tproxy_tg4_check,
372 .hooks = 1 << NF_INET_PRE_ROUTING,
375 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
378 .family = NFPROTO_IPV6,
380 .target = tproxy_tg6_v1,
382 .targetsize = sizeof(struct xt_tproxy_target_info_v1),
383 .checkentry = tproxy_tg6_check,
384 .hooks = 1 << NF_INET_PRE_ROUTING,
391 static int __init tproxy_tg_init(void)
393 nf_defrag_ipv4_enable();
394 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
395 nf_defrag_ipv6_enable();
398 return xt_register_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
401 static void __exit tproxy_tg_exit(void)
403 xt_unregister_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
406 module_init(tproxy_tg_init);
407 module_exit(tproxy_tg_exit);
408 MODULE_LICENSE("GPL");
409 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
410 MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module.");
411 MODULE_ALIAS("ipt_TPROXY");
412 MODULE_ALIAS("ip6t_TPROXY");