1 // SPDX-License-Identifier: GPL-2.0-only 2 #include <net/netfilter/nf_tproxy.h> 3 #include <linux/module.h> 4 #include <net/inet6_hashtables.h> 5 #include <net/addrconf.h> 6 #include <net/udp.h> 7 #include <net/tcp.h> 8 9 const struct in6_addr * 10 nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr, 11 const struct in6_addr *daddr) 12 { 13 struct inet6_dev *indev; 14 struct inet6_ifaddr *ifa; 15 struct in6_addr *laddr; 16 17 if (!ipv6_addr_any(user_laddr)) 18 return user_laddr; 19 laddr = NULL; 20 21 indev = __in6_dev_get(skb->dev); 22 if (indev) { 23 read_lock_bh(&indev->lock); 24 list_for_each_entry(ifa, &indev->addr_list, if_list) { 25 if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED)) 26 continue; 27 28 laddr = &ifa->addr; 29 break; 30 } 31 read_unlock_bh(&indev->lock); 32 } 33 34 return laddr ? laddr : daddr; 35 } 36 EXPORT_SYMBOL_GPL(nf_tproxy_laddr6); 37 38 struct sock * 39 nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff, 40 struct net *net, 41 const struct in6_addr *laddr, 42 const __be16 lport, 43 struct sock *sk) 44 { 45 const struct ipv6hdr *iph = ipv6_hdr(skb); 46 struct tcphdr _hdr, *hp; 47 48 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr); 49 if (hp == NULL) { 50 inet_twsk_put(inet_twsk(sk)); 51 return NULL; 52 } 53 54 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) { 55 /* SYN to a TIME_WAIT socket, we'd rather redirect it 56 * to a listener socket if there's one */ 57 struct sock *sk2; 58 59 sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto, 60 &iph->saddr, 61 nf_tproxy_laddr6(skb, laddr, &iph->daddr), 62 hp->source, 63 lport ? lport : hp->dest, 64 skb->dev, NF_TPROXY_LOOKUP_LISTENER); 65 if (sk2) { 66 inet_twsk_deschedule_put(inet_twsk(sk)); 67 sk = sk2; 68 } 69 } 70 71 return sk; 72 } 73 EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6); 74 75 struct sock * 76 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, 77 const u8 protocol, 78 const struct in6_addr *saddr, const struct in6_addr *daddr, 79 const __be16 sport, const __be16 dport, 80 const struct net_device *in, 81 const enum nf_tproxy_lookup_t lookup_type) 82 { 83 struct sock *sk; 84 85 switch (protocol) { 86 case IPPROTO_TCP: { 87 struct tcphdr _hdr, *hp; 88 89 hp = skb_header_pointer(skb, thoff, 90 sizeof(struct tcphdr), &_hdr); 91 if (hp == NULL) 92 return NULL; 93 94 switch (lookup_type) { 95 case NF_TPROXY_LOOKUP_LISTENER: 96 sk = inet6_lookup_listener(net, &tcp_hashinfo, skb, 97 thoff + __tcp_hdrlen(hp), 98 saddr, sport, 99 daddr, ntohs(dport), 100 in->ifindex, 0); 101 102 if (sk && !refcount_inc_not_zero(&sk->sk_refcnt)) 103 sk = NULL; 104 /* NOTE: we return listeners even if bound to 105 * 0.0.0.0, those are filtered out in 106 * xt_socket, since xt_TPROXY needs 0 bound 107 * listeners too 108 */ 109 break; 110 case NF_TPROXY_LOOKUP_ESTABLISHED: 111 sk = __inet6_lookup_established(net, &tcp_hashinfo, 112 saddr, sport, daddr, ntohs(dport), 113 in->ifindex, 0); 114 break; 115 default: 116 BUG(); 117 } 118 break; 119 } 120 case IPPROTO_UDP: 121 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport, 122 in->ifindex); 123 if (sk) { 124 int connected = (sk->sk_state == TCP_ESTABLISHED); 125 int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr); 126 127 /* NOTE: we return listeners even if bound to 128 * 0.0.0.0, those are filtered out in 129 * xt_socket, since xt_TPROXY needs 0 bound 130 * listeners too 131 */ 132 if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) || 133 (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) { 134 sock_put(sk); 135 sk = NULL; 136 } 137 } 138 break; 139 default: 140 WARN_ON(1); 141 sk = NULL; 142 } 143 144 pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n", 145 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk); 146 147 return sk; 148 } 149 EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6); 150 151 MODULE_LICENSE("GPL"); 152 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs"); 153 MODULE_DESCRIPTION("Netfilter IPv6 transparent proxy support"); 154