2 * Transparent proxy support for Linux/iptables
4 * Copyright (c) 2006-2010 BalaBit IT Ltd.
5 * Author: Balazs Scheidler, Krisztian Kovacs
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
16 #include <net/checksum.h>
18 #include <net/inet_sock.h>
19 #include <linux/inetdevice.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter_ipv4/ip_tables.h>
23 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
24 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
25 #include <net/if_inet6.h>
26 #include <net/addrconf.h>
27 #include <linux/netfilter_ipv6/ip6_tables.h>
28 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
31 #include <net/netfilter/nf_tproxy_core.h>
32 #include <linux/netfilter/xt_TPROXY.h>
35 tproxy_laddr4(struct sk_buff
*skb
, __be32 user_laddr
, __be32 daddr
)
37 struct in_device
*indev
;
45 indev
= __in_dev_get_rcu(skb
->dev
);
46 for_primary_ifa(indev
) {
47 laddr
= ifa
->ifa_local
;
52 return laddr
? laddr
: daddr
;
56 * tproxy_handle_time_wait4() - handle IPv4 TCP TIME_WAIT reopen redirections
57 * @skb: The skb being processed.
58 * @laddr: IPv4 address to redirect to or zero.
59 * @lport: TCP port to redirect to or zero.
60 * @sk: The TIME_WAIT TCP socket found by the lookup.
62 * We have to handle SYN packets arriving to TIME_WAIT sockets
63 * differently: instead of reopening the connection we should rather
64 * redirect the new connection to the proxy if there's a listener
67 * tproxy_handle_time_wait4() consumes the socket reference passed in.
69 * Returns the listener socket if there's one, the TIME_WAIT socket if
70 * no such listener is found, or NULL if the TCP header is incomplete.
73 tproxy_handle_time_wait4(struct sk_buff
*skb
, __be32 laddr
, __be16 lport
,
76 const struct iphdr
*iph
= ip_hdr(skb
);
77 struct tcphdr _hdr
, *hp
;
79 hp
= skb_header_pointer(skb
, ip_hdrlen(skb
), sizeof(_hdr
), &_hdr
);
81 inet_twsk_put(inet_twsk(sk
));
85 if (hp
->syn
&& !hp
->rst
&& !hp
->ack
&& !hp
->fin
) {
86 /* SYN to a TIME_WAIT socket, we'd rather redirect it
87 * to a listener socket if there's one */
90 sk2
= nf_tproxy_get_sock_v4(dev_net(skb
->dev
), iph
->protocol
,
91 iph
->saddr
, laddr
? laddr
: iph
->daddr
,
92 hp
->source
, lport
? lport
: hp
->dest
,
93 skb
->dev
, NFT_LOOKUP_LISTENER
);
95 inet_twsk_deschedule(inet_twsk(sk
), &tcp_death_row
);
96 inet_twsk_put(inet_twsk(sk
));
105 tproxy_tg4(struct sk_buff
*skb
, __be32 laddr
, __be16 lport
,
106 u_int32_t mark_mask
, u_int32_t mark_value
)
108 const struct iphdr
*iph
= ip_hdr(skb
);
109 struct udphdr _hdr
, *hp
;
112 hp
= skb_header_pointer(skb
, ip_hdrlen(skb
), sizeof(_hdr
), &_hdr
);
116 /* check if there's an ongoing connection on the packet
117 * addresses, this happens if the redirect already happened
118 * and the current packet belongs to an already established
120 sk
= nf_tproxy_get_sock_v4(dev_net(skb
->dev
), iph
->protocol
,
121 iph
->saddr
, iph
->daddr
,
122 hp
->source
, hp
->dest
,
123 skb
->dev
, NFT_LOOKUP_ESTABLISHED
);
125 laddr
= tproxy_laddr4(skb
, laddr
, iph
->daddr
);
129 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
130 if (sk
&& sk
->sk_state
== TCP_TIME_WAIT
)
131 /* reopening a TIME_WAIT connection needs special handling */
132 sk
= tproxy_handle_time_wait4(skb
, laddr
, lport
, sk
);
134 /* no, there's no established connection, check if
135 * there's a listener on the redirected addr/port */
136 sk
= nf_tproxy_get_sock_v4(dev_net(skb
->dev
), iph
->protocol
,
139 skb
->dev
, NFT_LOOKUP_LISTENER
);
141 /* NOTE: assign_sock consumes our sk reference */
142 if (sk
&& nf_tproxy_assign_sock(skb
, sk
)) {
143 /* This should be in a separate target, but we don't do multiple
144 targets on the same rule yet */
145 skb
->mark
= (skb
->mark
& ~mark_mask
) ^ mark_value
;
147 pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
148 iph
->protocol
, &iph
->daddr
, ntohs(hp
->dest
),
149 &laddr
, ntohs(lport
), skb
->mark
);
153 pr_debug("no socket, dropping: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
154 iph
->protocol
, &iph
->saddr
, ntohs(hp
->source
),
155 &iph
->daddr
, ntohs(hp
->dest
), skb
->mark
);
160 tproxy_tg4_v0(struct sk_buff
*skb
, const struct xt_action_param
*par
)
162 const struct xt_tproxy_target_info
*tgi
= par
->targinfo
;
164 return tproxy_tg4(skb
, tgi
->laddr
, tgi
->lport
, tgi
->mark_mask
, tgi
->mark_value
);
168 tproxy_tg4_v1(struct sk_buff
*skb
, const struct xt_action_param
*par
)
170 const struct xt_tproxy_target_info_v1
*tgi
= par
->targinfo
;
172 return tproxy_tg4(skb
, tgi
->laddr
.ip
, tgi
->lport
, tgi
->mark_mask
, tgi
->mark_value
);
175 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
177 static inline const struct in6_addr
*
178 tproxy_laddr6(struct sk_buff
*skb
, const struct in6_addr
*user_laddr
,
179 const struct in6_addr
*daddr
)
181 struct inet6_dev
*indev
;
182 struct inet6_ifaddr
*ifa
;
183 struct in6_addr
*laddr
;
185 if (!ipv6_addr_any(user_laddr
))
190 indev
= __in6_dev_get(skb
->dev
);
192 list_for_each_entry(ifa
, &indev
->addr_list
, if_list
) {
193 if (ifa
->flags
& (IFA_F_TENTATIVE
| IFA_F_DEPRECATED
))
201 return laddr
? laddr
: daddr
;
205 * tproxy_handle_time_wait6() - handle IPv6 TCP TIME_WAIT reopen redirections
206 * @skb: The skb being processed.
207 * @tproto: Transport protocol.
208 * @thoff: Transport protocol header offset.
209 * @par: Iptables target parameters.
210 * @sk: The TIME_WAIT TCP socket found by the lookup.
212 * We have to handle SYN packets arriving to TIME_WAIT sockets
213 * differently: instead of reopening the connection we should rather
214 * redirect the new connection to the proxy if there's a listener
217 * tproxy_handle_time_wait6() consumes the socket reference passed in.
219 * Returns the listener socket if there's one, the TIME_WAIT socket if
220 * no such listener is found, or NULL if the TCP header is incomplete.
223 tproxy_handle_time_wait6(struct sk_buff
*skb
, int tproto
, int thoff
,
224 const struct xt_action_param
*par
,
227 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
228 struct tcphdr _hdr
, *hp
;
229 const struct xt_tproxy_target_info_v1
*tgi
= par
->targinfo
;
231 hp
= skb_header_pointer(skb
, thoff
, sizeof(_hdr
), &_hdr
);
233 inet_twsk_put(inet_twsk(sk
));
237 if (hp
->syn
&& !hp
->rst
&& !hp
->ack
&& !hp
->fin
) {
238 /* SYN to a TIME_WAIT socket, we'd rather redirect it
239 * to a listener socket if there's one */
242 sk2
= nf_tproxy_get_sock_v6(dev_net(skb
->dev
), tproto
,
244 tproxy_laddr6(skb
, &tgi
->laddr
.in6
, &iph
->daddr
),
246 tgi
->lport
? tgi
->lport
: hp
->dest
,
247 skb
->dev
, NFT_LOOKUP_LISTENER
);
249 inet_twsk_deschedule(inet_twsk(sk
), &tcp_death_row
);
250 inet_twsk_put(inet_twsk(sk
));
259 tproxy_tg6_v1(struct sk_buff
*skb
, const struct xt_action_param
*par
)
261 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
262 const struct xt_tproxy_target_info_v1
*tgi
= par
->targinfo
;
263 struct udphdr _hdr
, *hp
;
265 const struct in6_addr
*laddr
;
270 tproto
= ipv6_find_hdr(skb
, &thoff
, -1, NULL
);
272 pr_debug("unable to find transport header in IPv6 packet, dropping\n");
276 hp
= skb_header_pointer(skb
, thoff
, sizeof(_hdr
), &_hdr
);
278 pr_debug("unable to grab transport header contents in IPv6 packet, dropping\n");
282 /* check if there's an ongoing connection on the packet
283 * addresses, this happens if the redirect already happened
284 * and the current packet belongs to an already established
286 sk
= nf_tproxy_get_sock_v6(dev_net(skb
->dev
), tproto
,
287 &iph
->saddr
, &iph
->daddr
,
288 hp
->source
, hp
->dest
,
289 par
->in
, NFT_LOOKUP_ESTABLISHED
);
291 laddr
= tproxy_laddr6(skb
, &tgi
->laddr
.in6
, &iph
->daddr
);
292 lport
= tgi
->lport
? tgi
->lport
: hp
->dest
;
294 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
295 if (sk
&& sk
->sk_state
== TCP_TIME_WAIT
)
296 /* reopening a TIME_WAIT connection needs special handling */
297 sk
= tproxy_handle_time_wait6(skb
, tproto
, thoff
, par
, sk
);
299 /* no there's no established connection, check if
300 * there's a listener on the redirected addr/port */
301 sk
= nf_tproxy_get_sock_v6(dev_net(skb
->dev
), tproto
,
304 par
->in
, NFT_LOOKUP_LISTENER
);
306 /* NOTE: assign_sock consumes our sk reference */
307 if (sk
&& nf_tproxy_assign_sock(skb
, sk
)) {
308 /* This should be in a separate target, but we don't do multiple
309 targets on the same rule yet */
310 skb
->mark
= (skb
->mark
& ~tgi
->mark_mask
) ^ tgi
->mark_value
;
312 pr_debug("redirecting: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
313 tproto
, &iph
->saddr
, ntohs(hp
->source
),
314 laddr
, ntohs(lport
), skb
->mark
);
318 pr_debug("no socket, dropping: proto %hhu %pI6:%hu -> %pI6:%hu, mark: %x\n",
319 tproto
, &iph
->saddr
, ntohs(hp
->source
),
320 &iph
->daddr
, ntohs(hp
->dest
), skb
->mark
);
325 static int tproxy_tg6_check(const struct xt_tgchk_param
*par
)
327 const struct ip6t_ip6
*i
= par
->entryinfo
;
329 if ((i
->proto
== IPPROTO_TCP
|| i
->proto
== IPPROTO_UDP
)
330 && !(i
->flags
& IP6T_INV_PROTO
))
333 pr_info("Can be used only in combination with "
334 "either -p tcp or -p udp\n");
339 static int tproxy_tg4_check(const struct xt_tgchk_param
*par
)
341 const struct ipt_ip
*i
= par
->entryinfo
;
343 if ((i
->proto
== IPPROTO_TCP
|| i
->proto
== IPPROTO_UDP
)
344 && !(i
->invflags
& IPT_INV_PROTO
))
347 pr_info("Can be used only in combination with "
348 "either -p tcp or -p udp\n");
352 static struct xt_target tproxy_tg_reg
[] __read_mostly
= {
355 .family
= NFPROTO_IPV4
,
357 .target
= tproxy_tg4_v0
,
359 .targetsize
= sizeof(struct xt_tproxy_target_info
),
360 .checkentry
= tproxy_tg4_check
,
361 .hooks
= 1 << NF_INET_PRE_ROUTING
,
366 .family
= NFPROTO_IPV4
,
368 .target
= tproxy_tg4_v1
,
370 .targetsize
= sizeof(struct xt_tproxy_target_info_v1
),
371 .checkentry
= tproxy_tg4_check
,
372 .hooks
= 1 << NF_INET_PRE_ROUTING
,
375 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
378 .family
= NFPROTO_IPV6
,
380 .target
= tproxy_tg6_v1
,
382 .targetsize
= sizeof(struct xt_tproxy_target_info_v1
),
383 .checkentry
= tproxy_tg6_check
,
384 .hooks
= 1 << NF_INET_PRE_ROUTING
,
391 static int __init
tproxy_tg_init(void)
393 nf_defrag_ipv4_enable();
394 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
395 nf_defrag_ipv6_enable();
398 return xt_register_targets(tproxy_tg_reg
, ARRAY_SIZE(tproxy_tg_reg
));
401 static void __exit
tproxy_tg_exit(void)
403 xt_unregister_targets(tproxy_tg_reg
, ARRAY_SIZE(tproxy_tg_reg
));
406 module_init(tproxy_tg_init
);
407 module_exit(tproxy_tg_exit
);
408 MODULE_LICENSE("GPL");
409 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
410 MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module.");
411 MODULE_ALIAS("ipt_TPROXY");
412 MODULE_ALIAS("ip6t_TPROXY");