nf_tproxy_ipv6.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2#include <net/netfilter/nf_tproxy.h>
  3#include <linux/module.h>
  4#include <net/inet6_hashtables.h>
  5#include <net/addrconf.h>
  6#include <net/udp.h>
  7#include <net/tcp.h>
  8
  9const struct in6_addr *
 10nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
 11	      const struct in6_addr *daddr)
 12{
 13	struct inet6_dev *indev;
 14	struct inet6_ifaddr *ifa;
 15	struct in6_addr *laddr;
 16
 17	if (!ipv6_addr_any(user_laddr))
 18		return user_laddr;
 19	laddr = NULL;
 20
 21	indev = __in6_dev_get(skb->dev);
 22	if (indev) {
 23		read_lock_bh(&indev->lock);
 24		list_for_each_entry(ifa, &indev->addr_list, if_list) {
 25			if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
 26				continue;
 27
 28			laddr = &ifa->addr;
 29			break;
 30		}
 31		read_unlock_bh(&indev->lock);
 32	}
 33
 34	return laddr ? laddr : daddr;
 35}
 36EXPORT_SYMBOL_GPL(nf_tproxy_laddr6);
 37
 38struct sock *
 39nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
 40			 struct net *net,
 41			 const struct in6_addr *laddr,
 42			 const __be16 lport,
 43			 struct sock *sk)
 44{
 45	const struct ipv6hdr *iph = ipv6_hdr(skb);
 46	struct tcphdr _hdr, *hp;
 47
 48	hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
 49	if (hp == NULL) {
 50		inet_twsk_put(inet_twsk(sk));
 51		return NULL;
 52	}
 53
 54	if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
 55		/* SYN to a TIME_WAIT socket, we'd rather redirect it
 56		 * to a listener socket if there's one */
 57		struct sock *sk2;
 58
 59		sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
 60					    &iph->saddr,
 61					    nf_tproxy_laddr6(skb, laddr, &iph->daddr),
 62					    hp->source,
 63					    lport ? lport : hp->dest,
 64					    skb->dev, NF_TPROXY_LOOKUP_LISTENER);
 65		if (sk2) {
 66			nf_tproxy_twsk_deschedule_put(inet_twsk(sk));
 67			sk = sk2;
 68		}
 69	}
 70
 71	return sk;
 72}
 73EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
 74
 75struct sock *
 76nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 77		      const u8 protocol,
 78		      const struct in6_addr *saddr, const struct in6_addr *daddr,
 79		      const __be16 sport, const __be16 dport,
 80		      const struct net_device *in,
 81		      const enum nf_tproxy_lookup_t lookup_type)
 82{
 83	struct sock *sk;
 84
 85	switch (protocol) {
 86	case IPPROTO_TCP: {
 87		struct tcphdr _hdr, *hp;
 88
 89		hp = skb_header_pointer(skb, thoff,
 90					sizeof(struct tcphdr), &_hdr);
 91		if (hp == NULL)
 92			return NULL;
 93
 94		switch (lookup_type) {
 95		case NF_TPROXY_LOOKUP_LISTENER:
 96			sk = inet6_lookup_listener(net, skb,
 97						   thoff + __tcp_hdrlen(hp),
 98						   saddr, sport,
 99						   daddr, ntohs(dport),
100						   in->ifindex, 0);
101
102			if (sk && !refcount_inc_not_zero(&sk->sk_refcnt))
103				sk = NULL;
104			/* NOTE: we return listeners even if bound to
105			 * 0.0.0.0, those are filtered out in
106			 * xt_socket, since xt_TPROXY needs 0 bound
107			 * listeners too
108			 */
109			break;
110		case NF_TPROXY_LOOKUP_ESTABLISHED:
111			sk = __inet6_lookup_established(net, saddr, sport, daddr,
112							ntohs(dport), in->ifindex, 0);
113			break;
114		default:
115			BUG();
116		}
117		break;
118		}
119	case IPPROTO_UDP:
120		sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
121				     in->ifindex);
122		if (sk) {
123			int connected = (sk->sk_state == TCP_ESTABLISHED);
124			int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr);
125
126			/* NOTE: we return listeners even if bound to
127			 * 0.0.0.0, those are filtered out in
128			 * xt_socket, since xt_TPROXY needs 0 bound
129			 * listeners too
130			 */
131			if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
132			    (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) {
133				sock_put(sk);
134				sk = NULL;
135			}
136		}
137		break;
138	default:
139		WARN_ON(1);
140		sk = NULL;
141	}
142
143	pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
144		 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
145
146	return sk;
147}
148EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6);
149
150MODULE_LICENSE("GPL");
151MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
152MODULE_DESCRIPTION("Netfilter IPv6 transparent proxy support");