netfilter: nf_tables: Add native tproxy support
A great portion of the code is taken from xt_TPROXY.c There are some changes compared to the iptables implementation: - tproxy statement is not terminal here - Either address or port has to be specified, but at least one of them is necessary. If one of them is not specified, the evaluation will be performed with the original attribute of the packet (ie. target port is not specified => the packet's dport will be used). To make this work in inet tables, the tproxy structure has a family member (typically called priv->family) which is not necessarily equal to ctx->family. priv->family can have three values legally: - NFPROTO_IPV4 if the table family is ip OR if table family is inet, but an ipv4 address is specified as a target address. The rule only evaluates ipv4 packets in this case. - NFPROTO_IPV6 if the table family is ip6 OR if table family is inet, but an ipv6 address is specified as a target address. The rule only evaluates ipv6 packets in this case. - NFPROTO_UNSPEC if the table family is inet AND if only the port is specified. The rule will evaluate both ipv4 and ipv6 packets. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Máté Eckl
Pablo Neira Ayuso
parent
b96af92d6e
commit
4ed8eb6570
4 changed files with 341 additions and 0 deletions
|
|
@ -1252,6 +1252,22 @@ enum nft_nat_attributes {
|
|||
};
|
||||
#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
|
||||
|
||||
/**
|
||||
* enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
|
||||
*
|
||||
* NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
|
||||
* NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
|
||||
* NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
|
||||
*/
|
||||
enum nft_tproxy_attributes {
|
||||
NFTA_TPROXY_UNSPEC,
|
||||
NFTA_TPROXY_FAMILY,
|
||||
NFTA_TPROXY_REG_ADDR,
|
||||
NFTA_TPROXY_REG_PORT,
|
||||
__NFTA_TPROXY_MAX
|
||||
};
|
||||
#define NFTA_TPROXY_MAX (__NFTA_TPROXY_MAX - 1)
|
||||
|
||||
/**
|
||||
* enum nft_masq_attributes - nf_tables masquerade expression attributes
|
||||
*
|
||||
|
|
|
|||
|
|
@ -634,6 +634,16 @@ config NFT_OSF
|
|||
help
|
||||
This option allows matching packets from an specific OS.
|
||||
|
||||
config NFT_TPROXY
|
||||
tristate "Netfilter nf_tables tproxy support"
|
||||
depends on IPV6 || IPV6=n
|
||||
select NF_DEFRAG_IPV4
|
||||
select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
|
||||
select NF_TPROXY_IPV4
|
||||
select NF_TPROXY_IPV6 if NF_TABLES_IPV6
|
||||
help
|
||||
This makes transparent proxy support available in nftables.
|
||||
|
||||
if NF_TABLES_NETDEV
|
||||
|
||||
config NF_DUP_NETDEV
|
||||
|
|
|
|||
|
|
@ -111,6 +111,7 @@ obj-$(CONFIG_NFT_FIB_INET) += nft_fib_inet.o
|
|||
obj-$(CONFIG_NFT_FIB_NETDEV) += nft_fib_netdev.o
|
||||
obj-$(CONFIG_NFT_SOCKET) += nft_socket.o
|
||||
obj-$(CONFIG_NFT_OSF) += nft_osf.o
|
||||
obj-$(CONFIG_NFT_TPROXY) += nft_tproxy.o
|
||||
|
||||
# nf_tables netdev
|
||||
obj-$(CONFIG_NFT_DUP_NETDEV) += nft_dup_netdev.o
|
||||
|
|
|
|||
314
net/netfilter/nft_tproxy.c
Normal file
314
net/netfilter/nft_tproxy.c
Normal file
|
|
@ -0,0 +1,314 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0 */
|
||||
#include <linux/module.h>
|
||||
#include <linux/netfilter/nf_tables.h>
|
||||
#include <net/netfilter/nf_tables.h>
|
||||
#include <net/netfilter/nf_tables_core.h>
|
||||
#include <net/netfilter/nf_tproxy.h>
|
||||
#include <net/inet_sock.h>
|
||||
#include <net/tcp.h>
|
||||
#include <linux/if_ether.h>
|
||||
#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
|
||||
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
|
||||
#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
|
||||
#endif
|
||||
|
||||
struct nft_tproxy {
|
||||
enum nft_registers sreg_addr:8;
|
||||
enum nft_registers sreg_port:8;
|
||||
u8 family;
|
||||
};
|
||||
|
||||
static void nft_tproxy_eval_v4(const struct nft_expr *expr,
|
||||
struct nft_regs *regs,
|
||||
const struct nft_pktinfo *pkt)
|
||||
{
|
||||
const struct nft_tproxy *priv = nft_expr_priv(expr);
|
||||
struct sk_buff *skb = pkt->skb;
|
||||
const struct iphdr *iph = ip_hdr(skb);
|
||||
struct udphdr _hdr, *hp;
|
||||
__be32 taddr = 0;
|
||||
__be16 tport = 0;
|
||||
struct sock *sk;
|
||||
|
||||
hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
|
||||
if (!hp) {
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
return;
|
||||
}
|
||||
|
||||
/* check if there's an ongoing connection on the packet addresses, this
|
||||
* happens if the redirect already happened and the current packet
|
||||
* belongs to an already established connection
|
||||
*/
|
||||
sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
|
||||
iph->saddr, iph->daddr,
|
||||
hp->source, hp->dest,
|
||||
skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
|
||||
|
||||
if (priv->sreg_addr)
|
||||
taddr = regs->data[priv->sreg_addr];
|
||||
taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
|
||||
|
||||
if (priv->sreg_port)
|
||||
tport = regs->data[priv->sreg_port];
|
||||
if (!tport)
|
||||
tport = hp->dest;
|
||||
|
||||
/* UDP has no TCP_TIME_WAIT state, so we never enter here */
|
||||
if (sk && sk->sk_state == TCP_TIME_WAIT) {
|
||||
/* reopening a TIME_WAIT connection needs special handling */
|
||||
sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
|
||||
} else if (!sk) {
|
||||
/* no, there's no established connection, check if
|
||||
* there's a listener on the redirected addr/port
|
||||
*/
|
||||
sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
|
||||
iph->saddr, taddr,
|
||||
hp->source, tport,
|
||||
skb->dev, NF_TPROXY_LOOKUP_LISTENER);
|
||||
}
|
||||
|
||||
if (sk && nf_tproxy_sk_is_transparent(sk))
|
||||
nf_tproxy_assign_sock(skb, sk);
|
||||
else
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
}
|
||||
|
||||
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
|
||||
static void nft_tproxy_eval_v6(const struct nft_expr *expr,
|
||||
struct nft_regs *regs,
|
||||
const struct nft_pktinfo *pkt)
|
||||
{
|
||||
const struct nft_tproxy *priv = nft_expr_priv(expr);
|
||||
struct sk_buff *skb = pkt->skb;
|
||||
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
||||
struct in6_addr taddr = {0};
|
||||
int thoff = pkt->xt.thoff;
|
||||
struct udphdr _hdr, *hp;
|
||||
__be16 tport = 0;
|
||||
struct sock *sk;
|
||||
int l4proto;
|
||||
|
||||
if (!pkt->tprot_set) {
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
return;
|
||||
}
|
||||
l4proto = pkt->tprot;
|
||||
|
||||
hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
|
||||
if (hp == NULL) {
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
return;
|
||||
}
|
||||
|
||||
/* check if there's an ongoing connection on the packet addresses, this
|
||||
* happens if the redirect already happened and the current packet
|
||||
* belongs to an already established connection
|
||||
*/
|
||||
sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
|
||||
&iph->saddr, &iph->daddr,
|
||||
hp->source, hp->dest,
|
||||
nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
|
||||
|
||||
if (priv->sreg_addr)
|
||||
memcpy(&taddr, ®s->data[priv->sreg_addr], sizeof(taddr));
|
||||
taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
|
||||
|
||||
if (priv->sreg_port)
|
||||
tport = regs->data[priv->sreg_port];
|
||||
if (!tport)
|
||||
tport = hp->dest;
|
||||
|
||||
/* UDP has no TCP_TIME_WAIT state, so we never enter here */
|
||||
if (sk && sk->sk_state == TCP_TIME_WAIT) {
|
||||
/* reopening a TIME_WAIT connection needs special handling */
|
||||
sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
|
||||
nft_net(pkt),
|
||||
&taddr,
|
||||
tport,
|
||||
sk);
|
||||
} else if (!sk) {
|
||||
/* no there's no established connection, check if
|
||||
* there's a listener on the redirected addr/port
|
||||
*/
|
||||
sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
|
||||
l4proto, &iph->saddr, &taddr,
|
||||
hp->source, tport,
|
||||
nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
|
||||
}
|
||||
|
||||
/* NOTE: assign_sock consumes our sk reference */
|
||||
if (sk && nf_tproxy_sk_is_transparent(sk))
|
||||
nf_tproxy_assign_sock(skb, sk);
|
||||
else
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
}
|
||||
#endif
|
||||
|
||||
static void nft_tproxy_eval(const struct nft_expr *expr,
|
||||
struct nft_regs *regs,
|
||||
const struct nft_pktinfo *pkt)
|
||||
{
|
||||
const struct nft_tproxy *priv = nft_expr_priv(expr);
|
||||
|
||||
switch (nft_pf(pkt)) {
|
||||
case NFPROTO_IPV4:
|
||||
switch (priv->family) {
|
||||
case NFPROTO_IPV4:
|
||||
case NFPROTO_UNSPEC:
|
||||
nft_tproxy_eval_v4(expr, regs, pkt);
|
||||
return;
|
||||
}
|
||||
break;
|
||||
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
|
||||
case NFPROTO_IPV6:
|
||||
switch (priv->family) {
|
||||
case NFPROTO_IPV6:
|
||||
case NFPROTO_UNSPEC:
|
||||
nft_tproxy_eval_v6(expr, regs, pkt);
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
}
|
||||
regs->verdict.code = NFT_BREAK;
|
||||
}
|
||||
|
||||
static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
|
||||
[NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },
|
||||
[NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
|
||||
[NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
|
||||
};
|
||||
|
||||
static int nft_tproxy_init(const struct nft_ctx *ctx,
|
||||
const struct nft_expr *expr,
|
||||
const struct nlattr * const tb[])
|
||||
{
|
||||
struct nft_tproxy *priv = nft_expr_priv(expr);
|
||||
unsigned int alen = 0;
|
||||
int err;
|
||||
|
||||
if (!tb[NFTA_TPROXY_FAMILY] ||
|
||||
(!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
|
||||
return -EINVAL;
|
||||
|
||||
priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
|
||||
|
||||
switch (ctx->family) {
|
||||
case NFPROTO_IPV4:
|
||||
if (priv->family != NFPROTO_IPV4)
|
||||
return -EINVAL;
|
||||
break;
|
||||
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
|
||||
case NFPROTO_IPV6:
|
||||
if (priv->family != NFPROTO_IPV6)
|
||||
return -EINVAL;
|
||||
break;
|
||||
#endif
|
||||
case NFPROTO_INET:
|
||||
break;
|
||||
default:
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
/* Address is specified but the rule family is not set accordingly */
|
||||
if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
|
||||
return -EINVAL;
|
||||
|
||||
switch (priv->family) {
|
||||
case NFPROTO_IPV4:
|
||||
alen = FIELD_SIZEOF(union nf_inet_addr, in);
|
||||
err = nf_defrag_ipv4_enable(ctx->net);
|
||||
if (err)
|
||||
return err;
|
||||
break;
|
||||
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
|
||||
case NFPROTO_IPV6:
|
||||
alen = FIELD_SIZEOF(union nf_inet_addr, in6);
|
||||
err = nf_defrag_ipv6_enable(ctx->net);
|
||||
if (err)
|
||||
return err;
|
||||
break;
|
||||
#endif
|
||||
case NFPROTO_UNSPEC:
|
||||
/* No address is specified here */
|
||||
err = nf_defrag_ipv4_enable(ctx->net);
|
||||
if (err)
|
||||
return err;
|
||||
err = nf_defrag_ipv6_enable(ctx->net);
|
||||
if (err)
|
||||
return err;
|
||||
break;
|
||||
default:
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
if (tb[NFTA_TPROXY_REG_ADDR]) {
|
||||
priv->sreg_addr = nft_parse_register(tb[NFTA_TPROXY_REG_ADDR]);
|
||||
err = nft_validate_register_load(priv->sreg_addr, alen);
|
||||
if (err < 0)
|
||||
return err;
|
||||
}
|
||||
|
||||
if (tb[NFTA_TPROXY_REG_PORT]) {
|
||||
priv->sreg_port = nft_parse_register(tb[NFTA_TPROXY_REG_PORT]);
|
||||
err = nft_validate_register_load(priv->sreg_port, sizeof(u16));
|
||||
if (err < 0)
|
||||
return err;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int nft_tproxy_dump(struct sk_buff *skb,
|
||||
const struct nft_expr *expr)
|
||||
{
|
||||
const struct nft_tproxy *priv = nft_expr_priv(expr);
|
||||
|
||||
if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
|
||||
return -1;
|
||||
|
||||
if (priv->sreg_addr &&
|
||||
nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
|
||||
return -1;
|
||||
|
||||
if (priv->sreg_port &&
|
||||
nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static struct nft_expr_type nft_tproxy_type;
|
||||
static const struct nft_expr_ops nft_tproxy_ops = {
|
||||
.type = &nft_tproxy_type,
|
||||
.size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
|
||||
.eval = nft_tproxy_eval,
|
||||
.init = nft_tproxy_init,
|
||||
.dump = nft_tproxy_dump,
|
||||
};
|
||||
|
||||
static struct nft_expr_type nft_tproxy_type __read_mostly = {
|
||||
.name = "tproxy",
|
||||
.ops = &nft_tproxy_ops,
|
||||
.policy = nft_tproxy_policy,
|
||||
.maxattr = NFTA_TPROXY_MAX,
|
||||
.owner = THIS_MODULE,
|
||||
};
|
||||
|
||||
static int __init nft_tproxy_module_init(void)
|
||||
{
|
||||
return nft_register_expr(&nft_tproxy_type);
|
||||
}
|
||||
|
||||
static void __exit nft_tproxy_module_exit(void)
|
||||
{
|
||||
nft_unregister_expr(&nft_tproxy_type);
|
||||
}
|
||||
|
||||
module_init(nft_tproxy_module_init);
|
||||
module_exit(nft_tproxy_module_exit);
|
||||
|
||||
MODULE_LICENSE("GPL");
|
||||
MODULE_AUTHOR("Máté Eckl");
|
||||
MODULE_DESCRIPTION("nf_tables tproxy support module");
|
||||
MODULE_ALIAS_NFT_EXPR("tproxy");
|
||||
Loading…
Reference in a new issue