nf_tproxy.h

  1#ifndef _NF_TPROXY_H_
  2#define _NF_TPROXY_H_
  3
  4#include <net/tcp.h>
  5
  6enum nf_tproxy_lookup_t {
  7	 NF_TPROXY_LOOKUP_LISTENER,
  8	 NF_TPROXY_LOOKUP_ESTABLISHED,
  9};
 10
 11static inline bool nf_tproxy_sk_is_transparent(struct sock *sk)
 12{
 13	if (inet_sk_transparent(sk))
 14		return true;
 15
 16	sock_gen_put(sk);
 17	return false;
 18}
 19
 20static inline void nf_tproxy_twsk_deschedule_put(struct inet_timewait_sock *tw)
 21{
 22	local_bh_disable();
 23	inet_twsk_deschedule_put(tw);
 24	local_bh_enable();
 25}
 26
 27/* assign a socket to the skb -- consumes sk */
 28static inline void nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
 29{
 30	skb_orphan(skb);
 31	skb->sk = sk;
 32	skb->destructor = sock_edemux;
 33}
 34
 35__be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr);
 36
 37/**
 38 * nf_tproxy_handle_time_wait4 - handle IPv4 TCP TIME_WAIT reopen redirections
 39 * @net:	The network namespace.
 40 * @skb:	The skb being processed.
 41 * @laddr:	IPv4 address to redirect to or zero.
 42 * @lport:	TCP port to redirect to or zero.
 43 * @sk:		The TIME_WAIT TCP socket found by the lookup.
 44 *
 45 * We have to handle SYN packets arriving to TIME_WAIT sockets
 46 * differently: instead of reopening the connection we should rather
 47 * redirect the new connection to the proxy if there's a listener
 48 * socket present.
 49 *
 50 * nf_tproxy_handle_time_wait4() consumes the socket reference passed in.
 51 *
 52 * Returns: the listener socket if there's one, the TIME_WAIT socket if
 53 * no such listener is found, or NULL if the TCP header is incomplete.
 54 */
 55struct sock *
 56nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
 57			    __be32 laddr, __be16 lport, struct sock *sk);
 58
 59/*
 60 * This is used when the user wants to intercept a connection matching
 61 * an explicit iptables rule. In this case the sockets are assumed
 62 * matching in preference order:
 63 *
 64 *   - match: if there's a fully established connection matching the
 65 *     _packet_ tuple, it is returned, assuming the redirection
 66 *     already took place and we process a packet belonging to an
 67 *     established connection
 68 *
 69 *   - match: if there's a listening socket matching the redirection
 70 *     (e.g. on-port & on-ip of the connection), it is returned,
 71 *     regardless if it was bound to 0.0.0.0 or an explicit
 72 *     address. The reasoning is that if there's an explicit rule, it
 73 *     does not really matter if the listener is bound to an interface
 74 *     or to 0. The user already stated that he wants redirection
 75 *     (since he added the rule).
 76 *
 77 * Please note that there's an overlap between what a TPROXY target
 78 * and a socket match will match. Normally if you have both rules the
 79 * "socket" match will be the first one, effectively all packets
 80 * belonging to established connections going through that one.
 81 */
 82struct sock *
 83nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
 84		      const u8 protocol,
 85		      const __be32 saddr, const __be32 daddr,
 86		      const __be16 sport, const __be16 dport,
 87		      const struct net_device *in,
 88		      const enum nf_tproxy_lookup_t lookup_type);
 89
 90const struct in6_addr *
 91nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
 92		 const struct in6_addr *daddr);
 93
 94/**
 95 * nf_tproxy_handle_time_wait6 - handle IPv6 TCP TIME_WAIT reopen redirections
 96 * @skb:	The skb being processed.
 97 * @tproto:	Transport protocol.
 98 * @thoff:	Transport protocol header offset.
 99 * @net:	Network namespace.
100 * @laddr:	IPv6 address to redirect to.
101 * @lport:	TCP port to redirect to or zero.
102 * @sk:		The TIME_WAIT TCP socket found by the lookup.
103 *
104 * We have to handle SYN packets arriving to TIME_WAIT sockets
105 * differently: instead of reopening the connection we should rather
106 * redirect the new connection to the proxy if there's a listener
107 * socket present.
108 *
109 * nf_tproxy_handle_time_wait6() consumes the socket reference passed in.
110 *
111 * Returns: the listener socket if there's one, the TIME_WAIT socket if
112 * no such listener is found, or NULL if the TCP header is incomplete.
113 */
114struct sock *
115nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
116			    struct net *net,
117			    const struct in6_addr *laddr,
118			    const __be16 lport,
119			    struct sock *sk);
120
121struct sock *
122nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
123		      const u8 protocol,
124		      const struct in6_addr *saddr, const struct in6_addr *daddr,
125		      const __be16 sport, const __be16 dport,
126		      const struct net_device *in,
127		      const enum nf_tproxy_lookup_t lookup_type);
128
129#endif /* _NF_TPROXY_H_ */