iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: Add native tproxy support

Browse Source 
A great portion of the code is taken from xt_TPROXY.c

There are some changes compared to the iptables implementation:
 - tproxy statement is not terminal here
 - Either address or port has to be specified, but at least one of them
   is necessary. If one of them is not specified, the evaluation will be
   performed with the original attribute of the packet (ie. target port
   is not specified => the packet's dport will be used).

To make this work in inet tables, the tproxy structure has a family
member (typically called priv->family) which is not necessarily equal to
ctx->family.

priv->family can have three values legally:
 - NFPROTO_IPV4 if the table family is ip OR if table family is inet,
   but an ipv4 address is specified as a target address. The rule only
   evaluates ipv4 packets in this case.
 - NFPROTO_IPV6 if the table family is ip6 OR if table family is inet,
   but an ipv6 address is specified as a target address. The rule only
   evaluates ipv6 packets in this case.
 - NFPROTO_UNSPEC if the table family is inet AND if only the port is
   specified. The rule will evaluate both ipv4 and ipv6 packets.

Signed-off-by: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Máté Eckl 2018-07-30 11:07:32 +02:00 committed by Pablo Neira Ayuso
parent b96af92d6e
commit 4ed8eb6570
4 changed files with 341 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
include/uapi/linux/netfilter/nf_tables.h
View File

@ -1252,6 +1252,22 @@ enum nft_nat_attributes {
};
#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
/**
* enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
*
* NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
* NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
* NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
*/
enum nft_tproxy_attributes {
NFTA_TPROXY_UNSPEC,
NFTA_TPROXY_FAMILY,
NFTA_TPROXY_REG_ADDR,
NFTA_TPROXY_REG_PORT,
__NFTA_TPROXY_MAX
};
#define NFTA_TPROXY_MAX (__NFTA_TPROXY_MAX - 1)
/**
* enum nft_masq_attributes - nf_tables masquerade expression attributes
*

10
net/netfilter/Kconfig
View File

@ -634,6 +634,16 @@ config NFT_OSF
help
This option allows matching packets from an specific OS.
config NFT_TPROXY
tristate "Netfilter nf_tables tproxy support"
depends on IPV6 || IPV6=n
select NF_DEFRAG_IPV4
select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
select NF_TPROXY_IPV4
select NF_TPROXY_IPV6 if NF_TABLES_IPV6
help
This makes transparent proxy support available in nftables.
if NF_TABLES_NETDEV
config NF_DUP_NETDEV

1
net/netfilter/Makefile
View File

@ -111,6 +111,7 @@ obj-$(CONFIG_NFT_FIB_INET) += nft_fib_inet.o
obj-$(CONFIG_NFT_FIB_NETDEV) += nft_fib_netdev.o
obj-$(CONFIG_NFT_SOCKET) += nft_socket.o
obj-$(CONFIG_NFT_OSF) += nft_osf.o
obj-$(CONFIG_NFT_TPROXY) += nft_tproxy.o
# nf_tables netdev
obj-$(CONFIG_NFT_DUP_NETDEV) += nft_dup_netdev.o

314
net/netfilter/nft_tproxy.c Normal file
View File

@ -0,0 +1,314 @@
/* SPDX-License-Identifier: GPL-2.0 */
#include <linux/module.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tproxy.h>
#include <net/inet_sock.h>
#include <net/tcp.h>
#include <linux/if_ether.h>
#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
#endif
struct nft_tproxy {
enum nft_registers sreg_addr:8;
enum nft_registers sreg_port:8;
u8 family;
};
static void nft_tproxy_eval_v4(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
const struct nft_tproxy *priv = nft_expr_priv(expr);
struct sk_buff *skb = pkt->skb;
const struct iphdr *iph = ip_hdr(skb);
struct udphdr _hdr, *hp;
__be32 taddr = 0;
__be16 tport = 0;
struct sock *sk;
hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
if (!hp) {
regs->verdict.code = NFT_BREAK;
return;
}
/* check if there's an ongoing connection on the packet addresses, this
* happens if the redirect already happened and the current packet
* belongs to an already established connection
*/
sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
iph->saddr, iph->daddr,
hp->source, hp->dest,
skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
if (priv->sreg_addr)
taddr = regs->data[priv->sreg_addr];
taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
if (priv->sreg_port)
tport = regs->data[priv->sreg_port];
if (!tport)
tport = hp->dest;
/* UDP has no TCP_TIME_WAIT state, so we never enter here */
if (sk && sk->sk_state == TCP_TIME_WAIT) {
/* reopening a TIME_WAIT connection needs special handling */
sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
} else if (!sk) {
/* no, there's no established connection, check if
* there's a listener on the redirected addr/port
*/
sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
iph->saddr, taddr,
hp->source, tport,
skb->dev, NF_TPROXY_LOOKUP_LISTENER);
}
if (sk && nf_tproxy_sk_is_transparent(sk))
nf_tproxy_assign_sock(skb, sk);
else
regs->verdict.code = NFT_BREAK;
}
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
static void nft_tproxy_eval_v6(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
const struct nft_tproxy *priv = nft_expr_priv(expr);
struct sk_buff *skb = pkt->skb;
const struct ipv6hdr *iph = ipv6_hdr(skb);
struct in6_addr taddr = {0};
int thoff = pkt->xt.thoff;
struct udphdr _hdr, *hp;
__be16 tport = 0;
struct sock *sk;
int l4proto;
if (!pkt->tprot_set) {
regs->verdict.code = NFT_BREAK;
return;
}
l4proto = pkt->tprot;
hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
if (hp == NULL) {
regs->verdict.code = NFT_BREAK;
return;
}
/* check if there's an ongoing connection on the packet addresses, this
* happens if the redirect already happened and the current packet
* belongs to an already established connection
*/
sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
&iph->saddr, &iph->daddr,
hp->source, hp->dest,
nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
if (priv->sreg_addr)
memcpy(&taddr, &regs->data[priv->sreg_addr], sizeof(taddr));
taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
if (priv->sreg_port)
tport = regs->data[priv->sreg_port];
if (!tport)
tport = hp->dest;
/* UDP has no TCP_TIME_WAIT state, so we never enter here */
if (sk && sk->sk_state == TCP_TIME_WAIT) {
/* reopening a TIME_WAIT connection needs special handling */
sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
nft_net(pkt),
&taddr,
tport,
sk);
} else if (!sk) {
/* no there's no established connection, check if
* there's a listener on the redirected addr/port
*/
sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
l4proto, &iph->saddr, &taddr,
hp->source, tport,
nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
}
/* NOTE: assign_sock consumes our sk reference */
if (sk && nf_tproxy_sk_is_transparent(sk))
nf_tproxy_assign_sock(skb, sk);
else
regs->verdict.code = NFT_BREAK;
}
#endif
static void nft_tproxy_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
const struct nft_tproxy *priv = nft_expr_priv(expr);
switch (nft_pf(pkt)) {
case NFPROTO_IPV4:
switch (priv->family) {
case NFPROTO_IPV4:
case NFPROTO_UNSPEC:
nft_tproxy_eval_v4(expr, regs, pkt);
return;
}
break;
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
case NFPROTO_IPV6:
switch (priv->family) {
case NFPROTO_IPV6:
case NFPROTO_UNSPEC:
nft_tproxy_eval_v6(expr, regs, pkt);
return;
}
#endif
}
regs->verdict.code = NFT_BREAK;
}
static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
[NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },
[NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
[NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
};
static int nft_tproxy_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
{
struct nft_tproxy *priv = nft_expr_priv(expr);
unsigned int alen = 0;
int err;
if (!tb[NFTA_TPROXY_FAMILY] ||
(!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
return -EINVAL;
priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
switch (ctx->family) {
case NFPROTO_IPV4:
if (priv->family != NFPROTO_IPV4)
return -EINVAL;
break;
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
case NFPROTO_IPV6:
if (priv->family != NFPROTO_IPV6)
return -EINVAL;
break;
#endif
case NFPROTO_INET:
break;
default:
return -EOPNOTSUPP;
}
/* Address is specified but the rule family is not set accordingly */
if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
return -EINVAL;
switch (priv->family) {
case NFPROTO_IPV4:
alen = FIELD_SIZEOF(union nf_inet_addr, in);
err = nf_defrag_ipv4_enable(ctx->net);
if (err)
return err;
break;
#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
case NFPROTO_IPV6:
alen = FIELD_SIZEOF(union nf_inet_addr, in6);
err = nf_defrag_ipv6_enable(ctx->net);
if (err)
return err;
break;
#endif
case NFPROTO_UNSPEC:
/* No address is specified here */
err = nf_defrag_ipv4_enable(ctx->net);
if (err)
return err;
err = nf_defrag_ipv6_enable(ctx->net);
if (err)
return err;
break;
default:
return -EOPNOTSUPP;
}
if (tb[NFTA_TPROXY_REG_ADDR]) {
priv->sreg_addr = nft_parse_register(tb[NFTA_TPROXY_REG_ADDR]);
err = nft_validate_register_load(priv->sreg_addr, alen);
if (err < 0)
return err;
}
if (tb[NFTA_TPROXY_REG_PORT]) {
priv->sreg_port = nft_parse_register(tb[NFTA_TPROXY_REG_PORT]);
err = nft_validate_register_load(priv->sreg_port, sizeof(u16));
if (err < 0)
return err;
}
return 0;
}
static int nft_tproxy_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
const struct nft_tproxy *priv = nft_expr_priv(expr);
if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
return -1;
if (priv->sreg_addr &&
nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
return -1;
if (priv->sreg_port &&
nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
return -1;
return 0;
}
static struct nft_expr_type nft_tproxy_type;
static const struct nft_expr_ops nft_tproxy_ops = {
.type = &nft_tproxy_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
.eval = nft_tproxy_eval,
.init = nft_tproxy_init,
.dump = nft_tproxy_dump,
};
static struct nft_expr_type nft_tproxy_type __read_mostly = {
.name = "tproxy",
.ops = &nft_tproxy_ops,
.policy = nft_tproxy_policy,
.maxattr = NFTA_TPROXY_MAX,
.owner = THIS_MODULE,
};
static int __init nft_tproxy_module_init(void)
{
return nft_register_expr(&nft_tproxy_type);
}
static void __exit nft_tproxy_module_exit(void)
{
nft_unregister_expr(&nft_tproxy_type);
}
module_init(nft_tproxy_module_init);
module_exit(nft_tproxy_module_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Máté Eckl");
MODULE_DESCRIPTION("nf_tables tproxy support module");
MODULE_ALIAS_NFT_EXPR("tproxy");