net/ipv6/netfilter/nf_tproxy_ipv6.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 #include <net/netfilter/nf_tproxy.h>
   3 #include <linux/module.h>
   4 #include <net/inet6_hashtables.h>
   5 #include <net/addrconf.h>
   6 #include <net/udp.h>
   7 #include <net/tcp.h>
   8
   9 const struct in6_addr *
  10 nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
  11               const struct in6_addr *daddr)
  12 {
  13         struct inet6_dev *indev;
  14         struct inet6_ifaddr *ifa;
  15         struct in6_addr *laddr;
  16
  17         if (!ipv6_addr_any(user_laddr))
  18                 return user_laddr;
  19         laddr = NULL;
  20
  21         indev = __in6_dev_get(skb->dev);
  22         if (indev) {
  23                 read_lock_bh(&indev->lock);
  24                 list_for_each_entry(ifa, &indev->addr_list, if_list) {
  25                         if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
  26                                 continue;
  27
  28                         laddr = &ifa->addr;
  29                         break;
  30                 }
  31                 read_unlock_bh(&indev->lock);
  32         }
  33
  34         return laddr ? laddr : daddr;
  35 }
  36 EXPORT_SYMBOL_GPL(nf_tproxy_laddr6);
  37
  38 struct sock *
  39 nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
  40                          struct net *net,
  41                          const struct in6_addr *laddr,
  42                          const __be16 lport,
  43                          struct sock *sk)
  44 {
  45         const struct ipv6hdr *iph = ipv6_hdr(skb);
  46         struct tcphdr _hdr, *hp;
  47
  48         hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
  49         if (hp == NULL) {
  50                 inet_twsk_put(inet_twsk(sk));
  51                 return NULL;
  52         }
  53
  54         if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
  55                 /* SYN to a TIME_WAIT socket, we'd rather redirect it
  56                  * to a listener socket if there's one */
  57                 struct sock *sk2;
  58
  59                 sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
  60                                             &iph->saddr,
  61                                             nf_tproxy_laddr6(skb, laddr, &iph->daddr),
  62                                             hp->source,
  63                                             lport ? lport : hp->dest,
  64                                             skb->dev, NF_TPROXY_LOOKUP_LISTENER);
  65                 if (sk2) {
  66                         inet_twsk_deschedule_put(inet_twsk(sk));
  67                         sk = sk2;
  68                 }
  69         }
  70
  71         return sk;
  72 }
  73 EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
  74
  75 struct sock *
  76 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
  77                       const u8 protocol,
  78                       const struct in6_addr *saddr, const struct in6_addr *daddr,
  79                       const __be16 sport, const __be16 dport,
  80                       const struct net_device *in,
  81                       const enum nf_tproxy_lookup_t lookup_type)
  82 {
  83         struct sock *sk;
  84
  85         switch (protocol) {
  86         case IPPROTO_TCP: {
  87                 struct tcphdr _hdr, *hp;
  88
  89                 hp = skb_header_pointer(skb, thoff,
  90                                         sizeof(struct tcphdr), &_hdr);
  91                 if (hp == NULL)
  92                         return NULL;
  93
  94                 switch (lookup_type) {
  95                 case NF_TPROXY_LOOKUP_LISTENER:
  96                         sk = inet6_lookup_listener(net, &tcp_hashinfo, skb,
  97                                                    thoff + __tcp_hdrlen(hp),
  98                                                    saddr, sport,
  99                                                    daddr, ntohs(dport),
 100                                                    in->ifindex, 0);
 101
 102                         if (sk && !refcount_inc_not_zero(&sk->sk_refcnt))
 103                                 sk = NULL;
 104                         /* NOTE: we return listeners even if bound to
 105                          * 0.0.0.0, those are filtered out in
 106                          * xt_socket, since xt_TPROXY needs 0 bound
 107                          * listeners too
 108                          */
 109                         break;
 110                 case NF_TPROXY_LOOKUP_ESTABLISHED:
 111                         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 112                                                         saddr, sport, daddr, ntohs(dport),
 113                                                         in->ifindex, 0);
 114                         break;
 115                 default:
 116                         BUG();
 117                 }
 118                 break;
 119                 }
 120         case IPPROTO_UDP:
 121                 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
 122                                      in->ifindex);
 123                 if (sk) {
 124                         int connected = (sk->sk_state == TCP_ESTABLISHED);
 125                         int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr);
 126
 127                         /* NOTE: we return listeners even if bound to
 128                          * 0.0.0.0, those are filtered out in
 129                          * xt_socket, since xt_TPROXY needs 0 bound
 130                          * listeners too
 131                          */
 132                         if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
 133                             (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) {
 134                                 sock_put(sk);
 135                                 sk = NULL;
 136                         }
 137                 }
 138                 break;
 139         default:
 140                 WARN_ON(1);
 141                 sk = NULL;
 142         }
 143
 144         pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
 145                  protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
 146
 147         return sk;
 148 }
 149 EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6);
 150
 151 MODULE_LICENSE("GPL");
 152 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
 153 MODULE_DESCRIPTION("Netfilter IPv4 transparent proxy support");