Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * Transparent proxy support for Linux/iptables
3 *
4 * Copyright (C) 2007-2008 BalaBit IT Ltd.
5 * Author: Krisztian Kovacs
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 */
12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13#include <linux/module.h>
14#include <linux/skbuff.h>
15#include <linux/netfilter/x_tables.h>
16#include <linux/netfilter_ipv4/ip_tables.h>
17#include <net/tcp.h>
18#include <net/udp.h>
19#include <net/icmp.h>
20#include <net/sock.h>
21#include <net/inet_sock.h>
22#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
23
24#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
25#include <linux/netfilter_ipv6/ip6_tables.h>
26#include <net/inet6_hashtables.h>
27#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
28#endif
29
30#include <net/netfilter/nf_socket.h>
31#include <linux/netfilter/xt_socket.h>
32
33/* "socket" match based redirection (no specific rule)
34 * ===================================================
35 *
36 * There are connections with dynamic endpoints (e.g. FTP data
37 * connection) that the user is unable to add explicit rules
38 * for. These are taken care of by a generic "socket" rule. It is
39 * assumed that the proxy application is trusted to open such
40 * connections without explicit iptables rule (except of course the
41 * generic 'socket' rule). In this case the following sockets are
42 * matched in preference order:
43 *
44 * - match: if there's a fully established connection matching the
45 * _packet_ tuple
46 *
47 * - match: if there's a non-zero bound listener (possibly with a
48 * non-local address) We don't accept zero-bound listeners, since
49 * then local services could intercept traffic going through the
50 * box.
51 */
52static bool
53socket_match(const struct sk_buff *skb, struct xt_action_param *par,
54 const struct xt_socket_mtinfo1 *info)
55{
56 struct sk_buff *pskb = (struct sk_buff *)skb;
57 struct sock *sk = skb->sk;
58
59 if (!sk)
60 sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
61 if (sk) {
62 bool wildcard;
63 bool transparent = true;
64
65 /* Ignore sockets listening on INADDR_ANY,
66 * unless XT_SOCKET_NOWILDCARD is set
67 */
68 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
69 sk_fullsock(sk) &&
70 inet_sk(sk)->inet_rcv_saddr == 0);
71
72 /* Ignore non-transparent sockets,
73 * if XT_SOCKET_TRANSPARENT is used
74 */
75 if (info->flags & XT_SOCKET_TRANSPARENT)
76 transparent = inet_sk_transparent(sk);
77
78 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
79 transparent && sk_fullsock(sk))
80 pskb->mark = sk->sk_mark;
81
82 if (sk != skb->sk)
83 sock_gen_put(sk);
84
85 if (wildcard || !transparent)
86 sk = NULL;
87 }
88
89 return sk != NULL;
90}
91
92static bool
93socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
94{
95 static struct xt_socket_mtinfo1 xt_info_v0 = {
96 .flags = 0,
97 };
98
99 return socket_match(skb, par, &xt_info_v0);
100}
101
102static bool
103socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
104{
105 return socket_match(skb, par, par->matchinfo);
106}
107
108#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
109static bool
110socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
111{
112 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
113 struct sk_buff *pskb = (struct sk_buff *)skb;
114 struct sock *sk = skb->sk;
115
116 if (!sk)
117 sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
118 if (sk) {
119 bool wildcard;
120 bool transparent = true;
121
122 /* Ignore sockets listening on INADDR_ANY
123 * unless XT_SOCKET_NOWILDCARD is set
124 */
125 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
126 sk_fullsock(sk) &&
127 ipv6_addr_any(&sk->sk_v6_rcv_saddr));
128
129 /* Ignore non-transparent sockets,
130 * if XT_SOCKET_TRANSPARENT is used
131 */
132 if (info->flags & XT_SOCKET_TRANSPARENT)
133 transparent = inet_sk_transparent(sk);
134
135 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
136 transparent && sk_fullsock(sk))
137 pskb->mark = sk->sk_mark;
138
139 if (sk != skb->sk)
140 sock_gen_put(sk);
141
142 if (wildcard || !transparent)
143 sk = NULL;
144 }
145
146 return sk != NULL;
147}
148#endif
149
150static int socket_mt_enable_defrag(struct net *net, int family)
151{
152 switch (family) {
153 case NFPROTO_IPV4:
154 return nf_defrag_ipv4_enable(net);
155#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
156 case NFPROTO_IPV6:
157 return nf_defrag_ipv6_enable(net);
158#endif
159 }
160 WARN_ONCE(1, "Unknown family %d\n", family);
161 return 0;
162}
163
164static int socket_mt_v1_check(const struct xt_mtchk_param *par)
165{
166 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
167 int err;
168
169 err = socket_mt_enable_defrag(par->net, par->family);
170 if (err)
171 return err;
172
173 if (info->flags & ~XT_SOCKET_FLAGS_V1) {
174 pr_info_ratelimited("unknown flags 0x%x\n",
175 info->flags & ~XT_SOCKET_FLAGS_V1);
176 return -EINVAL;
177 }
178 return 0;
179}
180
181static int socket_mt_v2_check(const struct xt_mtchk_param *par)
182{
183 const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
184 int err;
185
186 err = socket_mt_enable_defrag(par->net, par->family);
187 if (err)
188 return err;
189
190 if (info->flags & ~XT_SOCKET_FLAGS_V2) {
191 pr_info_ratelimited("unknown flags 0x%x\n",
192 info->flags & ~XT_SOCKET_FLAGS_V2);
193 return -EINVAL;
194 }
195 return 0;
196}
197
198static int socket_mt_v3_check(const struct xt_mtchk_param *par)
199{
200 const struct xt_socket_mtinfo3 *info =
201 (struct xt_socket_mtinfo3 *)par->matchinfo;
202 int err;
203
204 err = socket_mt_enable_defrag(par->net, par->family);
205 if (err)
206 return err;
207 if (info->flags & ~XT_SOCKET_FLAGS_V3) {
208 pr_info_ratelimited("unknown flags 0x%x\n",
209 info->flags & ~XT_SOCKET_FLAGS_V3);
210 return -EINVAL;
211 }
212 return 0;
213}
214
215static struct xt_match socket_mt_reg[] __read_mostly = {
216 {
217 .name = "socket",
218 .revision = 0,
219 .family = NFPROTO_IPV4,
220 .match = socket_mt4_v0,
221 .hooks = (1 << NF_INET_PRE_ROUTING) |
222 (1 << NF_INET_LOCAL_IN),
223 .me = THIS_MODULE,
224 },
225 {
226 .name = "socket",
227 .revision = 1,
228 .family = NFPROTO_IPV4,
229 .match = socket_mt4_v1_v2_v3,
230 .checkentry = socket_mt_v1_check,
231 .matchsize = sizeof(struct xt_socket_mtinfo1),
232 .hooks = (1 << NF_INET_PRE_ROUTING) |
233 (1 << NF_INET_LOCAL_IN),
234 .me = THIS_MODULE,
235 },
236#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
237 {
238 .name = "socket",
239 .revision = 1,
240 .family = NFPROTO_IPV6,
241 .match = socket_mt6_v1_v2_v3,
242 .checkentry = socket_mt_v1_check,
243 .matchsize = sizeof(struct xt_socket_mtinfo1),
244 .hooks = (1 << NF_INET_PRE_ROUTING) |
245 (1 << NF_INET_LOCAL_IN),
246 .me = THIS_MODULE,
247 },
248#endif
249 {
250 .name = "socket",
251 .revision = 2,
252 .family = NFPROTO_IPV4,
253 .match = socket_mt4_v1_v2_v3,
254 .checkentry = socket_mt_v2_check,
255 .matchsize = sizeof(struct xt_socket_mtinfo1),
256 .hooks = (1 << NF_INET_PRE_ROUTING) |
257 (1 << NF_INET_LOCAL_IN),
258 .me = THIS_MODULE,
259 },
260#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
261 {
262 .name = "socket",
263 .revision = 2,
264 .family = NFPROTO_IPV6,
265 .match = socket_mt6_v1_v2_v3,
266 .checkentry = socket_mt_v2_check,
267 .matchsize = sizeof(struct xt_socket_mtinfo1),
268 .hooks = (1 << NF_INET_PRE_ROUTING) |
269 (1 << NF_INET_LOCAL_IN),
270 .me = THIS_MODULE,
271 },
272#endif
273 {
274 .name = "socket",
275 .revision = 3,
276 .family = NFPROTO_IPV4,
277 .match = socket_mt4_v1_v2_v3,
278 .checkentry = socket_mt_v3_check,
279 .matchsize = sizeof(struct xt_socket_mtinfo1),
280 .hooks = (1 << NF_INET_PRE_ROUTING) |
281 (1 << NF_INET_LOCAL_IN),
282 .me = THIS_MODULE,
283 },
284#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
285 {
286 .name = "socket",
287 .revision = 3,
288 .family = NFPROTO_IPV6,
289 .match = socket_mt6_v1_v2_v3,
290 .checkentry = socket_mt_v3_check,
291 .matchsize = sizeof(struct xt_socket_mtinfo1),
292 .hooks = (1 << NF_INET_PRE_ROUTING) |
293 (1 << NF_INET_LOCAL_IN),
294 .me = THIS_MODULE,
295 },
296#endif
297};
298
299static int __init socket_mt_init(void)
300{
301 return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
302}
303
304static void __exit socket_mt_exit(void)
305{
306 xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
307}
308
309module_init(socket_mt_init);
310module_exit(socket_mt_exit);
311
312MODULE_LICENSE("GPL");
313MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
314MODULE_DESCRIPTION("x_tables socket match module");
315MODULE_ALIAS("ipt_socket");
316MODULE_ALIAS("ip6t_socket");