2 * Transparent proxy support for Linux/iptables
4 * Copyright (C) 2007-2008 BalaBit IT Ltd.
5 * Author: Krisztian Kovacs
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <net/inet_sock.h>
22 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
24 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
25 #define XT_SOCKET_HAVE_IPV6 1
26 #include <linux/netfilter_ipv6/ip6_tables.h>
27 #include <net/inet6_hashtables.h>
28 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
31 #include <linux/netfilter/xt_socket.h>
33 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
34 #define XT_SOCKET_HAVE_CONNTRACK 1
35 #include <net/netfilter/nf_conntrack.h>
39 extract_icmp4_fields(const struct sk_buff
*skb
,
46 unsigned int outside_hdrlen
= ip_hdrlen(skb
);
47 struct iphdr
*inside_iph
, _inside_iph
;
48 struct icmphdr
*icmph
, _icmph
;
49 __be16
*ports
, _ports
[2];
51 icmph
= skb_header_pointer(skb
, outside_hdrlen
,
52 sizeof(_icmph
), &_icmph
);
56 switch (icmph
->type
) {
57 case ICMP_DEST_UNREACH
:
58 case ICMP_SOURCE_QUENCH
:
60 case ICMP_TIME_EXCEEDED
:
61 case ICMP_PARAMETERPROB
:
67 inside_iph
= skb_header_pointer(skb
, outside_hdrlen
+
68 sizeof(struct icmphdr
),
69 sizeof(_inside_iph
), &_inside_iph
);
70 if (inside_iph
== NULL
)
73 if (inside_iph
->protocol
!= IPPROTO_TCP
&&
74 inside_iph
->protocol
!= IPPROTO_UDP
)
77 ports
= skb_header_pointer(skb
, outside_hdrlen
+
78 sizeof(struct icmphdr
) +
79 (inside_iph
->ihl
<< 2),
80 sizeof(_ports
), &_ports
);
84 /* the inside IP packet is the one quoted from our side, thus
85 * its saddr is the local address */
86 *protocol
= inside_iph
->protocol
;
87 *laddr
= inside_iph
->saddr
;
89 *raddr
= inside_iph
->daddr
;
95 /* "socket" match based redirection (no specific rule)
96 * ===================================================
98 * There are connections with dynamic endpoints (e.g. FTP data
99 * connection) that the user is unable to add explicit rules
100 * for. These are taken care of by a generic "socket" rule. It is
101 * assumed that the proxy application is trusted to open such
102 * connections without explicit iptables rule (except of course the
103 * generic 'socket' rule). In this case the following sockets are
104 * matched in preference order:
106 * - match: if there's a fully established connection matching the
109 * - match: if there's a non-zero bound listener (possibly with a
110 * non-local address) We don't accept zero-bound listeners, since
111 * then local services could intercept traffic going through the
115 xt_socket_get_sock_v4(struct net
*net
, const u8 protocol
,
116 const __be32 saddr
, const __be32 daddr
,
117 const __be16 sport
, const __be16 dport
,
118 const struct net_device
*in
)
122 return __inet_lookup(net
, &tcp_hashinfo
,
123 saddr
, sport
, daddr
, dport
,
126 return udp4_lib_lookup(net
, saddr
, sport
, daddr
, dport
,
132 static bool xt_socket_sk_is_transparent(struct sock
*sk
)
134 switch (sk
->sk_state
) {
136 return inet_twsk(sk
)->tw_transparent
;
138 case TCP_NEW_SYN_RECV
:
139 return inet_rsk(inet_reqsk(sk
))->no_srccheck
;
142 return inet_sk(sk
)->transparent
;
146 static struct sock
*xt_socket_lookup_slow_v4(const struct sk_buff
*skb
,
147 const struct net_device
*indev
)
149 const struct iphdr
*iph
= ip_hdr(skb
);
150 __be32
uninitialized_var(daddr
), uninitialized_var(saddr
);
151 __be16
uninitialized_var(dport
), uninitialized_var(sport
);
152 u8
uninitialized_var(protocol
);
153 #ifdef XT_SOCKET_HAVE_CONNTRACK
154 struct nf_conn
const *ct
;
155 enum ip_conntrack_info ctinfo
;
158 if (iph
->protocol
== IPPROTO_UDP
|| iph
->protocol
== IPPROTO_TCP
) {
159 struct udphdr _hdr
, *hp
;
161 hp
= skb_header_pointer(skb
, ip_hdrlen(skb
),
162 sizeof(_hdr
), &_hdr
);
166 protocol
= iph
->protocol
;
172 } else if (iph
->protocol
== IPPROTO_ICMP
) {
173 if (extract_icmp4_fields(skb
, &protocol
, &saddr
, &daddr
,
180 #ifdef XT_SOCKET_HAVE_CONNTRACK
181 /* Do the lookup with the original socket address in
182 * case this is a reply packet of an established
183 * SNAT-ted connection.
185 ct
= nf_ct_get(skb
, &ctinfo
);
186 if (ct
&& !nf_ct_is_untracked(ct
) &&
187 ((iph
->protocol
!= IPPROTO_ICMP
&&
188 ctinfo
== IP_CT_ESTABLISHED_REPLY
) ||
189 (iph
->protocol
== IPPROTO_ICMP
&&
190 ctinfo
== IP_CT_RELATED_REPLY
)) &&
191 (ct
->status
& IPS_SRC_NAT_DONE
)) {
193 daddr
= ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u3
.ip
;
194 dport
= (iph
->protocol
== IPPROTO_TCP
) ?
195 ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u
.tcp
.port
:
196 ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u
.udp
.port
;
200 return xt_socket_get_sock_v4(dev_net(skb
->dev
), protocol
, saddr
, daddr
,
201 sport
, dport
, indev
);
205 socket_match(const struct sk_buff
*skb
, struct xt_action_param
*par
,
206 const struct xt_socket_mtinfo1
*info
)
208 struct sk_buff
*pskb
= (struct sk_buff
*)skb
;
209 struct sock
*sk
= skb
->sk
;
212 sk
= xt_socket_lookup_slow_v4(skb
, par
->in
);
215 bool transparent
= true;
217 /* Ignore sockets listening on INADDR_ANY,
218 * unless XT_SOCKET_NOWILDCARD is set
220 wildcard
= (!(info
->flags
& XT_SOCKET_NOWILDCARD
) &&
222 inet_sk(sk
)->inet_rcv_saddr
== 0);
224 /* Ignore non-transparent sockets,
225 * if XT_SOCKET_TRANSPARENT is used
227 if (info
->flags
& XT_SOCKET_TRANSPARENT
)
228 transparent
= xt_socket_sk_is_transparent(sk
);
230 if (info
->flags
& XT_SOCKET_RESTORESKMARK
&& !wildcard
&&
232 pskb
->mark
= sk
->sk_mark
;
237 if (wildcard
|| !transparent
)
245 socket_mt4_v0(const struct sk_buff
*skb
, struct xt_action_param
*par
)
247 static struct xt_socket_mtinfo1 xt_info_v0
= {
251 return socket_match(skb
, par
, &xt_info_v0
);
255 socket_mt4_v1_v2_v3(const struct sk_buff
*skb
, struct xt_action_param
*par
)
257 return socket_match(skb
, par
, par
->matchinfo
);
260 #ifdef XT_SOCKET_HAVE_IPV6
263 extract_icmp6_fields(const struct sk_buff
*skb
,
264 unsigned int outside_hdrlen
,
266 const struct in6_addr
**raddr
,
267 const struct in6_addr
**laddr
,
270 struct ipv6hdr
*ipv6_var
)
272 const struct ipv6hdr
*inside_iph
;
273 struct icmp6hdr
*icmph
, _icmph
;
274 __be16
*ports
, _ports
[2];
276 __be16 inside_fragoff
;
279 icmph
= skb_header_pointer(skb
, outside_hdrlen
,
280 sizeof(_icmph
), &_icmph
);
284 if (icmph
->icmp6_type
& ICMPV6_INFOMSG_MASK
)
287 inside_iph
= skb_header_pointer(skb
, outside_hdrlen
+ sizeof(_icmph
),
288 sizeof(*ipv6_var
), ipv6_var
);
289 if (inside_iph
== NULL
)
291 inside_nexthdr
= inside_iph
->nexthdr
;
293 inside_hdrlen
= ipv6_skip_exthdr(skb
, outside_hdrlen
+ sizeof(_icmph
) +
295 &inside_nexthdr
, &inside_fragoff
);
296 if (inside_hdrlen
< 0)
297 return 1; /* hjm: Packet has no/incomplete transport layer headers. */
299 if (inside_nexthdr
!= IPPROTO_TCP
&&
300 inside_nexthdr
!= IPPROTO_UDP
)
303 ports
= skb_header_pointer(skb
, inside_hdrlen
,
304 sizeof(_ports
), &_ports
);
308 /* the inside IP packet is the one quoted from our side, thus
309 * its saddr is the local address */
310 *protocol
= inside_nexthdr
;
311 *laddr
= &inside_iph
->saddr
;
313 *raddr
= &inside_iph
->daddr
;
320 xt_socket_get_sock_v6(struct net
*net
, const u8 protocol
,
321 const struct in6_addr
*saddr
, const struct in6_addr
*daddr
,
322 const __be16 sport
, const __be16 dport
,
323 const struct net_device
*in
)
327 return inet6_lookup(net
, &tcp_hashinfo
,
328 saddr
, sport
, daddr
, dport
,
331 return udp6_lib_lookup(net
, saddr
, sport
, daddr
, dport
,
338 static struct sock
*xt_socket_lookup_slow_v6(const struct sk_buff
*skb
,
339 const struct net_device
*indev
)
341 __be16
uninitialized_var(dport
), uninitialized_var(sport
);
342 const struct in6_addr
*daddr
= NULL
, *saddr
= NULL
;
343 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
344 int thoff
= 0, tproto
;
346 tproto
= ipv6_find_hdr(skb
, &thoff
, -1, NULL
, NULL
);
348 pr_debug("unable to find transport header in IPv6 packet, dropping\n");
352 if (tproto
== IPPROTO_UDP
|| tproto
== IPPROTO_TCP
) {
353 struct udphdr _hdr
, *hp
;
355 hp
= skb_header_pointer(skb
, thoff
, sizeof(_hdr
), &_hdr
);
364 } else if (tproto
== IPPROTO_ICMPV6
) {
365 struct ipv6hdr ipv6_var
;
367 if (extract_icmp6_fields(skb
, thoff
, &tproto
, &saddr
, &daddr
,
368 &sport
, &dport
, &ipv6_var
))
374 return xt_socket_get_sock_v6(dev_net(skb
->dev
), tproto
, saddr
, daddr
,
375 sport
, dport
, indev
);
379 socket_mt6_v1_v2_v3(const struct sk_buff
*skb
, struct xt_action_param
*par
)
381 const struct xt_socket_mtinfo1
*info
= (struct xt_socket_mtinfo1
*) par
->matchinfo
;
382 struct sk_buff
*pskb
= (struct sk_buff
*)skb
;
383 struct sock
*sk
= skb
->sk
;
386 sk
= xt_socket_lookup_slow_v6(skb
, par
->in
);
389 bool transparent
= true;
391 /* Ignore sockets listening on INADDR_ANY
392 * unless XT_SOCKET_NOWILDCARD is set
394 wildcard
= (!(info
->flags
& XT_SOCKET_NOWILDCARD
) &&
396 ipv6_addr_any(&sk
->sk_v6_rcv_saddr
));
398 /* Ignore non-transparent sockets,
399 * if XT_SOCKET_TRANSPARENT is used
401 if (info
->flags
& XT_SOCKET_TRANSPARENT
)
402 transparent
= xt_socket_sk_is_transparent(sk
);
404 if (info
->flags
& XT_SOCKET_RESTORESKMARK
&& !wildcard
&&
406 pskb
->mark
= sk
->sk_mark
;
411 if (wildcard
|| !transparent
)
419 static int socket_mt_v1_check(const struct xt_mtchk_param
*par
)
421 const struct xt_socket_mtinfo1
*info
= (struct xt_socket_mtinfo1
*) par
->matchinfo
;
423 if (info
->flags
& ~XT_SOCKET_FLAGS_V1
) {
424 pr_info("unknown flags 0x%x\n", info
->flags
& ~XT_SOCKET_FLAGS_V1
);
430 static int socket_mt_v2_check(const struct xt_mtchk_param
*par
)
432 const struct xt_socket_mtinfo2
*info
= (struct xt_socket_mtinfo2
*) par
->matchinfo
;
434 if (info
->flags
& ~XT_SOCKET_FLAGS_V2
) {
435 pr_info("unknown flags 0x%x\n", info
->flags
& ~XT_SOCKET_FLAGS_V2
);
441 static int socket_mt_v3_check(const struct xt_mtchk_param
*par
)
443 const struct xt_socket_mtinfo3
*info
=
444 (struct xt_socket_mtinfo3
*)par
->matchinfo
;
446 if (info
->flags
& ~XT_SOCKET_FLAGS_V3
) {
447 pr_info("unknown flags 0x%x\n",
448 info
->flags
& ~XT_SOCKET_FLAGS_V3
);
454 static struct xt_match socket_mt_reg
[] __read_mostly
= {
458 .family
= NFPROTO_IPV4
,
459 .match
= socket_mt4_v0
,
460 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
461 (1 << NF_INET_LOCAL_IN
),
467 .family
= NFPROTO_IPV4
,
468 .match
= socket_mt4_v1_v2_v3
,
469 .checkentry
= socket_mt_v1_check
,
470 .matchsize
= sizeof(struct xt_socket_mtinfo1
),
471 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
472 (1 << NF_INET_LOCAL_IN
),
475 #ifdef XT_SOCKET_HAVE_IPV6
479 .family
= NFPROTO_IPV6
,
480 .match
= socket_mt6_v1_v2_v3
,
481 .checkentry
= socket_mt_v1_check
,
482 .matchsize
= sizeof(struct xt_socket_mtinfo1
),
483 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
484 (1 << NF_INET_LOCAL_IN
),
491 .family
= NFPROTO_IPV4
,
492 .match
= socket_mt4_v1_v2_v3
,
493 .checkentry
= socket_mt_v2_check
,
494 .matchsize
= sizeof(struct xt_socket_mtinfo1
),
495 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
496 (1 << NF_INET_LOCAL_IN
),
499 #ifdef XT_SOCKET_HAVE_IPV6
503 .family
= NFPROTO_IPV6
,
504 .match
= socket_mt6_v1_v2_v3
,
505 .checkentry
= socket_mt_v2_check
,
506 .matchsize
= sizeof(struct xt_socket_mtinfo1
),
507 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
508 (1 << NF_INET_LOCAL_IN
),
515 .family
= NFPROTO_IPV4
,
516 .match
= socket_mt4_v1_v2_v3
,
517 .checkentry
= socket_mt_v3_check
,
518 .matchsize
= sizeof(struct xt_socket_mtinfo1
),
519 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
520 (1 << NF_INET_LOCAL_IN
),
523 #ifdef XT_SOCKET_HAVE_IPV6
527 .family
= NFPROTO_IPV6
,
528 .match
= socket_mt6_v1_v2_v3
,
529 .checkentry
= socket_mt_v3_check
,
530 .matchsize
= sizeof(struct xt_socket_mtinfo1
),
531 .hooks
= (1 << NF_INET_PRE_ROUTING
) |
532 (1 << NF_INET_LOCAL_IN
),
538 static int __init
socket_mt_init(void)
540 nf_defrag_ipv4_enable();
541 #ifdef XT_SOCKET_HAVE_IPV6
542 nf_defrag_ipv6_enable();
545 return xt_register_matches(socket_mt_reg
, ARRAY_SIZE(socket_mt_reg
));
548 static void __exit
socket_mt_exit(void)
550 xt_unregister_matches(socket_mt_reg
, ARRAY_SIZE(socket_mt_reg
));
553 module_init(socket_mt_init
);
554 module_exit(socket_mt_exit
);
556 MODULE_LICENSE("GPL");
557 MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
558 MODULE_DESCRIPTION("x_tables socket match module");
559 MODULE_ALIAS("ipt_socket");
560 MODULE_ALIAS("ip6t_socket");