1 /* SPDX-License-Identifier: GPL-2.0 */
2 #include <linux/module.h>
3 #include <linux/netfilter/nf_tables.h>
4 #include <net/netfilter/nf_tables.h>
5 #include <net/netfilter/nf_tables_core.h>
6 #include <net/netfilter/nf_tproxy.h>
7 #include <net/inet_sock.h>
9 #include <linux/if_ether.h>
10 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
11 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
12 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
21 static void nft_tproxy_eval_v4(const struct nft_expr *expr,
22 struct nft_regs *regs,
23 const struct nft_pktinfo *pkt)
25 const struct nft_tproxy *priv = nft_expr_priv(expr);
26 struct sk_buff *skb = pkt->skb;
27 const struct iphdr *iph = ip_hdr(skb);
28 struct udphdr _hdr, *hp;
33 if (pkt->tprot != IPPROTO_TCP &&
34 pkt->tprot != IPPROTO_UDP) {
35 regs->verdict.code = NFT_BREAK;
39 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
41 regs->verdict.code = NFT_BREAK;
45 /* check if there's an ongoing connection on the packet addresses, this
46 * happens if the redirect already happened and the current packet
47 * belongs to an already established connection
49 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
50 iph->saddr, iph->daddr,
52 skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
55 taddr = nft_reg_load_be32(®s->data[priv->sreg_addr]);
56 taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
59 tport = nft_reg_load_be16(®s->data[priv->sreg_port]);
63 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
64 if (sk && sk->sk_state == TCP_TIME_WAIT) {
65 /* reopening a TIME_WAIT connection needs special handling */
66 sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
68 /* no, there's no established connection, check if
69 * there's a listener on the redirected addr/port
71 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
74 skb->dev, NF_TPROXY_LOOKUP_LISTENER);
77 if (sk && nf_tproxy_sk_is_transparent(sk))
78 nf_tproxy_assign_sock(skb, sk);
80 regs->verdict.code = NFT_BREAK;
83 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
84 static void nft_tproxy_eval_v6(const struct nft_expr *expr,
85 struct nft_regs *regs,
86 const struct nft_pktinfo *pkt)
88 const struct nft_tproxy *priv = nft_expr_priv(expr);
89 struct sk_buff *skb = pkt->skb;
90 const struct ipv6hdr *iph = ipv6_hdr(skb);
91 int thoff = nft_thoff(pkt);
92 struct udphdr _hdr, *hp;
93 struct in6_addr taddr;
98 memset(&taddr, 0, sizeof(taddr));
100 if (pkt->tprot != IPPROTO_TCP &&
101 pkt->tprot != IPPROTO_UDP) {
102 regs->verdict.code = NFT_BREAK;
105 l4proto = pkt->tprot;
107 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
109 regs->verdict.code = NFT_BREAK;
113 /* check if there's an ongoing connection on the packet addresses, this
114 * happens if the redirect already happened and the current packet
115 * belongs to an already established connection
117 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
118 &iph->saddr, &iph->daddr,
119 hp->source, hp->dest,
120 nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
123 memcpy(&taddr, ®s->data[priv->sreg_addr], sizeof(taddr));
124 taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
127 tport = nft_reg_load_be16(®s->data[priv->sreg_port]);
131 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
132 if (sk && sk->sk_state == TCP_TIME_WAIT) {
133 /* reopening a TIME_WAIT connection needs special handling */
134 sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
140 /* no there's no established connection, check if
141 * there's a listener on the redirected addr/port
143 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
144 l4proto, &iph->saddr, &taddr,
146 nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
149 /* NOTE: assign_sock consumes our sk reference */
150 if (sk && nf_tproxy_sk_is_transparent(sk))
151 nf_tproxy_assign_sock(skb, sk);
153 regs->verdict.code = NFT_BREAK;
157 static void nft_tproxy_eval(const struct nft_expr *expr,
158 struct nft_regs *regs,
159 const struct nft_pktinfo *pkt)
161 const struct nft_tproxy *priv = nft_expr_priv(expr);
163 switch (nft_pf(pkt)) {
165 switch (priv->family) {
168 nft_tproxy_eval_v4(expr, regs, pkt);
172 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
174 switch (priv->family) {
177 nft_tproxy_eval_v6(expr, regs, pkt);
182 regs->verdict.code = NFT_BREAK;
185 static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
186 [NFTA_TPROXY_FAMILY] = NLA_POLICY_MAX(NLA_BE32, 255),
187 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
188 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
191 static int nft_tproxy_init(const struct nft_ctx *ctx,
192 const struct nft_expr *expr,
193 const struct nlattr * const tb[])
195 struct nft_tproxy *priv = nft_expr_priv(expr);
196 unsigned int alen = 0;
199 if (!tb[NFTA_TPROXY_FAMILY] ||
200 (!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
203 priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
205 switch (ctx->family) {
207 if (priv->family != NFPROTO_IPV4)
210 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
212 if (priv->family != NFPROTO_IPV6)
222 /* Address is specified but the rule family is not set accordingly */
223 if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
226 switch (priv->family) {
228 alen = sizeof_field(union nf_inet_addr, in);
229 err = nf_defrag_ipv4_enable(ctx->net);
233 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
235 alen = sizeof_field(union nf_inet_addr, in6);
236 err = nf_defrag_ipv6_enable(ctx->net);
242 /* No address is specified here */
243 err = nf_defrag_ipv4_enable(ctx->net);
246 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
247 err = nf_defrag_ipv6_enable(ctx->net);
256 if (tb[NFTA_TPROXY_REG_ADDR]) {
257 err = nft_parse_register_load(tb[NFTA_TPROXY_REG_ADDR],
258 &priv->sreg_addr, alen);
263 if (tb[NFTA_TPROXY_REG_PORT]) {
264 err = nft_parse_register_load(tb[NFTA_TPROXY_REG_PORT],
265 &priv->sreg_port, sizeof(u16));
273 static void nft_tproxy_destroy(const struct nft_ctx *ctx,
274 const struct nft_expr *expr)
276 const struct nft_tproxy *priv = nft_expr_priv(expr);
278 switch (priv->family) {
280 nf_defrag_ipv4_disable(ctx->net);
282 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
284 nf_defrag_ipv6_disable(ctx->net);
288 nf_defrag_ipv4_disable(ctx->net);
289 #if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
290 nf_defrag_ipv6_disable(ctx->net);
296 static int nft_tproxy_dump(struct sk_buff *skb,
297 const struct nft_expr *expr, bool reset)
299 const struct nft_tproxy *priv = nft_expr_priv(expr);
301 if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
304 if (priv->sreg_addr &&
305 nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
308 if (priv->sreg_port &&
309 nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
315 static int nft_tproxy_validate(const struct nft_ctx *ctx,
316 const struct nft_expr *expr,
317 const struct nft_data **data)
319 if (ctx->family != NFPROTO_IPV4 &&
320 ctx->family != NFPROTO_IPV6 &&
321 ctx->family != NFPROTO_INET)
324 return nft_chain_validate_hooks(ctx->chain, 1 << NF_INET_PRE_ROUTING);
327 static struct nft_expr_type nft_tproxy_type;
328 static const struct nft_expr_ops nft_tproxy_ops = {
329 .type = &nft_tproxy_type,
330 .size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
331 .eval = nft_tproxy_eval,
332 .init = nft_tproxy_init,
333 .destroy = nft_tproxy_destroy,
334 .dump = nft_tproxy_dump,
335 .reduce = NFT_REDUCE_READONLY,
336 .validate = nft_tproxy_validate,
339 static struct nft_expr_type nft_tproxy_type __read_mostly = {
341 .ops = &nft_tproxy_ops,
342 .policy = nft_tproxy_policy,
343 .maxattr = NFTA_TPROXY_MAX,
344 .owner = THIS_MODULE,
347 static int __init nft_tproxy_module_init(void)
349 return nft_register_expr(&nft_tproxy_type);
352 static void __exit nft_tproxy_module_exit(void)
354 nft_unregister_expr(&nft_tproxy_type);
357 module_init(nft_tproxy_module_init);
358 module_exit(nft_tproxy_module_exit);
360 MODULE_LICENSE("GPL");
361 MODULE_AUTHOR("Máté Eckl");
362 MODULE_DESCRIPTION("nf_tables tproxy support module");
363 MODULE_ALIAS_NFT_EXPR("tproxy");