1 /*
2 * Transparent proxy support for Linux/iptables
3 *
4 * Copyright (C) 2007-2008 BalaBit IT Ltd.
5 * Author: Krisztian Kovacs
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 */
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter_ipv4/ip_tables.h>
17 #include <net/tcp.h>
18 #include <net/udp.h>
19 #include <net/icmp.h>
20 #include <net/sock.h>
21 #include <net/inet_sock.h>
22 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
23
24 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
25 #include <linux/netfilter_ipv6/ip6_tables.h>
26 #include <net/inet6_hashtables.h>
27 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
28 #endif
29
30 #include <net/netfilter/nf_socket.h>
31 #include <linux/netfilter/xt_socket.h>
32
33 /* "socket" match based redirection (no specific rule)
34 * ===================================================
35 *
36 * There are connections with dynamic endpoints (e.g. FTP data
37 * connection) that the user is unable to add explicit rules
38 * for. These are taken care of by a generic "socket" rule. It is
39 * assumed that the proxy application is trusted to open such
40 * connections without explicit iptables rule (except of course the
41 * generic 'socket' rule). In this case the following sockets are
42 * matched in preference order:
43 *
44 * - match: if there's a fully established connection matching the
45 * _packet_ tuple
46 *
47 * - match: if there's a non-zero bound listener (possibly with a
48 * non-local address) We don't accept zero-bound listeners, since
49 * then local services could intercept traffic going through the
50 * box.
51 */
52 static bool
socket_match(const struct sk_buff * skb,struct xt_action_param * par,const struct xt_socket_mtinfo1 * info)53 socket_match(const struct sk_buff *skb, struct xt_action_param *par,
54 const struct xt_socket_mtinfo1 *info)
55 {
56 struct sk_buff *pskb = (struct sk_buff *)skb;
57 struct sock *sk = skb->sk;
58
59 if (!sk)
60 sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
61 if (sk) {
62 bool wildcard;
63 bool transparent = true;
64
65 /* Ignore sockets listening on INADDR_ANY,
66 * unless XT_SOCKET_NOWILDCARD is set
67 */
68 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
69 sk_fullsock(sk) &&
70 inet_sk(sk)->inet_rcv_saddr == 0);
71
72 /* Ignore non-transparent sockets,
73 * if XT_SOCKET_TRANSPARENT is used
74 */
75 if (info->flags & XT_SOCKET_TRANSPARENT)
76 transparent = nf_sk_is_transparent(sk);
77
78 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
79 transparent && sk_fullsock(sk))
80 pskb->mark = sk->sk_mark;
81
82 sock_gen_put(sk);
83
84 if (wildcard || !transparent)
85 sk = NULL;
86 }
87
88 return sk != NULL;
89 }
90
91 static bool
socket_mt4_v0(const struct sk_buff * skb,struct xt_action_param * par)92 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
93 {
94 static struct xt_socket_mtinfo1 xt_info_v0 = {
95 .flags = 0,
96 };
97
98 return socket_match(skb, par, &xt_info_v0);
99 }
100
101 static bool
socket_mt4_v1_v2_v3(const struct sk_buff * skb,struct xt_action_param * par)102 socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
103 {
104 return socket_match(skb, par, par->matchinfo);
105 }
106
107 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
108 static bool
socket_mt6_v1_v2_v3(const struct sk_buff * skb,struct xt_action_param * par)109 socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
110 {
111 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
112 struct sk_buff *pskb = (struct sk_buff *)skb;
113 struct sock *sk = skb->sk;
114
115 if (!sk)
116 sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
117 if (sk) {
118 bool wildcard;
119 bool transparent = true;
120
121 /* Ignore sockets listening on INADDR_ANY
122 * unless XT_SOCKET_NOWILDCARD is set
123 */
124 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
125 sk_fullsock(sk) &&
126 ipv6_addr_any(&sk->sk_v6_rcv_saddr));
127
128 /* Ignore non-transparent sockets,
129 * if XT_SOCKET_TRANSPARENT is used
130 */
131 if (info->flags & XT_SOCKET_TRANSPARENT)
132 transparent = nf_sk_is_transparent(sk);
133
134 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
135 transparent && sk_fullsock(sk))
136 pskb->mark = sk->sk_mark;
137
138 if (sk != skb->sk)
139 sock_gen_put(sk);
140
141 if (wildcard || !transparent)
142 sk = NULL;
143 }
144
145 return sk != NULL;
146 }
147 #endif
148
socket_mt_enable_defrag(struct net * net,int family)149 static int socket_mt_enable_defrag(struct net *net, int family)
150 {
151 switch (family) {
152 case NFPROTO_IPV4:
153 return nf_defrag_ipv4_enable(net);
154 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
155 case NFPROTO_IPV6:
156 return nf_defrag_ipv6_enable(net);
157 #endif
158 }
159 WARN_ONCE(1, "Unknown family %d\n", family);
160 return 0;
161 }
162
socket_mt_v1_check(const struct xt_mtchk_param * par)163 static int socket_mt_v1_check(const struct xt_mtchk_param *par)
164 {
165 const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
166 int err;
167
168 err = socket_mt_enable_defrag(par->net, par->family);
169 if (err)
170 return err;
171
172 if (info->flags & ~XT_SOCKET_FLAGS_V1) {
173 pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
174 return -EINVAL;
175 }
176 return 0;
177 }
178
socket_mt_v2_check(const struct xt_mtchk_param * par)179 static int socket_mt_v2_check(const struct xt_mtchk_param *par)
180 {
181 const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
182 int err;
183
184 err = socket_mt_enable_defrag(par->net, par->family);
185 if (err)
186 return err;
187
188 if (info->flags & ~XT_SOCKET_FLAGS_V2) {
189 pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
190 return -EINVAL;
191 }
192 return 0;
193 }
194
socket_mt_v3_check(const struct xt_mtchk_param * par)195 static int socket_mt_v3_check(const struct xt_mtchk_param *par)
196 {
197 const struct xt_socket_mtinfo3 *info =
198 (struct xt_socket_mtinfo3 *)par->matchinfo;
199 int err;
200
201 err = socket_mt_enable_defrag(par->net, par->family);
202 if (err)
203 return err;
204 if (info->flags & ~XT_SOCKET_FLAGS_V3) {
205 pr_info("unknown flags 0x%x\n",
206 info->flags & ~XT_SOCKET_FLAGS_V3);
207 return -EINVAL;
208 }
209 return 0;
210 }
211
212 static struct xt_match socket_mt_reg[] __read_mostly = {
213 {
214 .name = "socket",
215 .revision = 0,
216 .family = NFPROTO_IPV4,
217 .match = socket_mt4_v0,
218 .hooks = (1 << NF_INET_PRE_ROUTING) |
219 (1 << NF_INET_LOCAL_IN),
220 .me = THIS_MODULE,
221 },
222 {
223 .name = "socket",
224 .revision = 1,
225 .family = NFPROTO_IPV4,
226 .match = socket_mt4_v1_v2_v3,
227 .checkentry = socket_mt_v1_check,
228 .matchsize = sizeof(struct xt_socket_mtinfo1),
229 .hooks = (1 << NF_INET_PRE_ROUTING) |
230 (1 << NF_INET_LOCAL_IN),
231 .me = THIS_MODULE,
232 },
233 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
234 {
235 .name = "socket",
236 .revision = 1,
237 .family = NFPROTO_IPV6,
238 .match = socket_mt6_v1_v2_v3,
239 .checkentry = socket_mt_v1_check,
240 .matchsize = sizeof(struct xt_socket_mtinfo1),
241 .hooks = (1 << NF_INET_PRE_ROUTING) |
242 (1 << NF_INET_LOCAL_IN),
243 .me = THIS_MODULE,
244 },
245 #endif
246 {
247 .name = "socket",
248 .revision = 2,
249 .family = NFPROTO_IPV4,
250 .match = socket_mt4_v1_v2_v3,
251 .checkentry = socket_mt_v2_check,
252 .matchsize = sizeof(struct xt_socket_mtinfo1),
253 .hooks = (1 << NF_INET_PRE_ROUTING) |
254 (1 << NF_INET_LOCAL_IN),
255 .me = THIS_MODULE,
256 },
257 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
258 {
259 .name = "socket",
260 .revision = 2,
261 .family = NFPROTO_IPV6,
262 .match = socket_mt6_v1_v2_v3,
263 .checkentry = socket_mt_v2_check,
264 .matchsize = sizeof(struct xt_socket_mtinfo1),
265 .hooks = (1 << NF_INET_PRE_ROUTING) |
266 (1 << NF_INET_LOCAL_IN),
267 .me = THIS_MODULE,
268 },
269 #endif
270 {
271 .name = "socket",
272 .revision = 3,
273 .family = NFPROTO_IPV4,
274 .match = socket_mt4_v1_v2_v3,
275 .checkentry = socket_mt_v3_check,
276 .matchsize = sizeof(struct xt_socket_mtinfo1),
277 .hooks = (1 << NF_INET_PRE_ROUTING) |
278 (1 << NF_INET_LOCAL_IN),
279 .me = THIS_MODULE,
280 },
281 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
282 {
283 .name = "socket",
284 .revision = 3,
285 .family = NFPROTO_IPV6,
286 .match = socket_mt6_v1_v2_v3,
287 .checkentry = socket_mt_v3_check,
288 .matchsize = sizeof(struct xt_socket_mtinfo1),
289 .hooks = (1 << NF_INET_PRE_ROUTING) |
290 (1 << NF_INET_LOCAL_IN),
291 .me = THIS_MODULE,
292 },
293 #endif
294 };
295
socket_mt_init(void)296 static int __init socket_mt_init(void)
297 {
298 return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
299 }
300
socket_mt_exit(void)301 static void __exit socket_mt_exit(void)
302 {
303 xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
304 }
305
306 module_init(socket_mt_init);
307 module_exit(socket_mt_exit);
308
309 MODULE_LICENSE("GPL");
310 MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
311 MODULE_DESCRIPTION("x_tables socket match module");
312 MODULE_ALIAS("ipt_socket");
313 MODULE_ALIAS("ip6t_socket");
314