TProxy 探秘

1
static struct xt_target tproxy_tg_reg[] __read_mostly = {
2
  {
3
    .name    = "TPROXY",
4
    .family    = NFPROTO_IPV4,
5
    .table    = "mangle",
6
    .target    = tproxy_tg4_v0,
7
    .revision  = 0,
8
    .targetsize  = sizeof(struct xt_tproxy_target_info),
9
    .checkentry  = tproxy_tg4_check,
10
    .hooks    = 1 << NF_INET_PRE_ROUTING,
11
    .me    = THIS_MODULE,
12
  },
13
  {
14
    .name    = "TPROXY",
15
    .family    = NFPROTO_IPV4,
16
    .table    = "mangle",
17
    .target    = tproxy_tg4_v1,
18
    .revision  = 1,
19
    .targetsize  = sizeof(struct xt_tproxy_target_info_v1),
20
    .checkentry  = tproxy_tg4_check,
21
    .hooks    = 1 << NF_INET_PRE_ROUTING,
22
    .me    = THIS_MODULE,
23
  },
24
#ifdef XT_TPROXY_HAVE_IPV6
25
  {
26
    .name    = "TPROXY",
27
    .family    = NFPROTO_IPV6,
28
    .table    = "mangle",
29
    .target    = tproxy_tg6_v1,
30
    .revision  = 1,
31
    .targetsize  = sizeof(struct xt_tproxy_target_info_v1),
32
    .checkentry  = tproxy_tg6_check,
33
    .hooks    = 1 << NF_INET_PRE_ROUTING,
34
    .me    = THIS_MODULE,
35
  },
36
#endif
37

38
};
39

40
static int __init tproxy_tg_init(void)
41
{
42
  return xt_register_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
43
}
44

45
static void __exit tproxy_tg_exit(void)
46
{
47
  xt_unregister_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
48
}
49

50
module_init(tproxy_tg_init);
51
module_exit(tproxy_tg_exit);
52
MODULE_LICENSE("GPL");
53
MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
54
MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module.");
55
MODULE_ALIAS("ipt_TPROXY");
56
MODULE_ALIAS("ip6t_TPROXY");

1
static int tproxy_tg4_check(const struct xt_tgchk_param *par)
2
{
3
  const struct ipt_ip *i = par->entryinfo;
4
  int err;
5

6
  err = nf_defrag_ipv4_enable(par->net);
7
  if (err)
8
    return err;
9

10
  if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
11
      && !(i->invflags & IPT_INV_PROTO))
12
    return 0;
13

14
  pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
15
  return -EINVAL;
16
}

1
static unsigned int
2
tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par)
3
{
4
  const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
5

6
  return tproxy_tg4(xt_net(par), skb, tgi->laddr.ip, tgi->lport,
7
        tgi->mark_mask, tgi->mark_value);
8
}

1
static unsigned int
2
tproxy_tg4(struct net *net, struct sk_buff *skb, __be32 laddr, __be16 lport,
3
     u_int32_t mark_mask, u_int32_t mark_value)
4
{
5
  const struct iphdr *iph = ip_hdr(skb);
6
  struct udphdr _hdr, *hp;
7
  struct sock *sk;
8

9
  hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
10
  if (hp == NULL)
11
    return NF_DROP;
12

13
  /* check if there's an ongoing connection on the packet
14
   * addresses, this happens if the redirect already happened
15
   * and the current packet belongs to an already established
16
   * connection */
17
  sk = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
18
           iph->saddr, iph->daddr,
19
           hp->source, hp->dest,
20
           skb->dev, NFT_LOOKUP_ESTABLISHED);
21

22
  laddr = tproxy_laddr4(skb, laddr, iph->daddr);
23
  if (!lport)
24
    lport = hp->dest;
25

26
  /* UDP has no TCP_TIME_WAIT state, so we never enter here */
27
  if (sk && sk->sk_state == TCP_TIME_WAIT)
28
    /* reopening a TIME_WAIT connection needs special handling */
29
    sk = tproxy_handle_time_wait4(net, skb, laddr, lport, sk);
30
  else if (!sk)
31
    /* no, there's no established connection, check if
32
     * there's a listener on the redirected addr/port */
33
    sk = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
34
             iph->saddr, laddr,
35
             hp->source, lport,
36
             skb->dev, NFT_LOOKUP_LISTENER);
37

38
  /* NOTE: assign_sock consumes our sk reference */
39
  if (sk && tproxy_sk_is_transparent(sk)) {
40
    /* This should be in a separate target, but we don't do multiple
41
       targets on the same rule yet */
42
    skb->mark = (skb->mark & ~mark_mask) ^ mark_value;
43

44
    pr_debug("redirecting: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
45
       iph->protocol, &iph->daddr, ntohs(hp->dest),
46
       &laddr, ntohs(lport), skb->mark);
47

48
    nf_tproxy_assign_sock(skb, sk);
49
    return NF_ACCEPT;
50
  }
51

52
  pr_debug("no socket, dropping: proto %hhu %pI4:%hu -> %pI4:%hu, mark: %x\n",
53
     iph->protocol, &iph->saddr, ntohs(hp->source),
54
     &iph->daddr, ntohs(hp->dest), skb->mark);
55
  return NF_DROP;
56
}

1
static inline __be32
2
tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
3
{
4
  struct in_device *indev;
5
  __be32 laddr;
6

7
  if (user_laddr)
8
    return user_laddr;
9

10
  laddr = 0;
11
  indev = __in_dev_get_rcu(skb->dev);
12
  for_primary_ifa(indev) {
13
    laddr = ifa->ifa_local;
14
    break;
15
  } endfor_ifa(indev);
16

17
  return laddr ? laddr : daddr;
18
}

1
/**
2
 * tproxy_handle_time_wait4 - handle IPv4 TCP TIME_WAIT reopen redirections
3
 * @skb:  The skb being processed.
4
 * @laddr:  IPv4 address to redirect to or zero.
5
 * @lport:  TCP port to redirect to or zero.
6
 * @sk:    The TIME_WAIT TCP socket found by the lookup.
7
 *
8
 * We have to handle SYN packets arriving to TIME_WAIT sockets
9
 * differently: instead of reopening the connection we should rather
10
 * redirect the new connection to the proxy if there's a listener
11
 * socket present.
12
 *
13
 * tproxy_handle_time_wait4() consumes the socket reference passed in.
14
 *
15
 * Returns the listener socket if there's one, the TIME_WAIT socket if
16
 * no such listener is found, or NULL if the TCP header is incomplete.
17
 */
18
static struct sock *
19
tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
20
       __be32 laddr, __be16 lport, struct sock *sk)
21
{
22
  const struct iphdr *iph = ip_hdr(skb);
23
  struct tcphdr _hdr, *hp;
24

25
  hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
26
  if (hp == NULL) {
27
    inet_twsk_put(inet_twsk(sk));
28
    return NULL;
29
  }
30

31
  if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
32
    /* SYN to a TIME_WAIT socket, we'd rather redirect it
33
     * to a listener socket if there's one */
34
    struct sock *sk2;
35

36
    sk2 = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
37
              iph->saddr, laddr ? laddr : iph->daddr,
38
              hp->source, lport ? lport : hp->dest,
39
              skb->dev, NFT_LOOKUP_LISTENER);
40
    if (sk2) {
41
      inet_twsk_deschedule_put(inet_twsk(sk));
42
      sk = sk2;
43
    }
44
  }
45

46
  return sk;
47
}

1
static bool tproxy_sk_is_transparent(struct sock *sk)
2
{
3
  switch (sk->sk_state) {
4
  case TCP_TIME_WAIT:
5
    if (inet_twsk(sk)->tw_transparent)
6
      return true;
7
    break;
8
  case TCP_NEW_SYN_RECV:
9
    if (inet_rsk(inet_reqsk(sk))->no_srccheck)
10
      return true;
11
    break;
12
  default:
13
    if (inet_sk(sk)->transparent)
14
      return true;
15
  }
16

17
  sock_gen_put(sk);
18
  return false;
19
}

1
/* assign a socket to the skb -- consumes sk */
2
static void
3
nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
4
{
5
  skb_orphan(skb);
6
  skb->sk = sk;
7
  skb->destructor = sock_edemux;
8
}

1
/*
2
 * This is used when the user wants to intercept a connection matching
3
 * an explicit iptables rule. In this case the sockets are assumed
4
 * matching in preference order:
5
 *
6
 *   - match: if there's a fully established connection matching the
7
 *     _packet_ tuple, it is returned, assuming the redirection
8
 *     already took place and we process a packet belonging to an
9
 *     established connection
10
 *
11
 *   - match: if there's a listening socket matching the redirection
12
 *     (e.g. on-port & on-ip of the connection), it is returned,
13
 *     regardless if it was bound to 0.0.0.0 or an explicit
14
 *     address. The reasoning is that if there's an explicit rule, it
15
 *     does not really matter if the listener is bound to an interface
16
 *     or to 0. The user already stated that he wants redirection
17
 *     (since he added the rule).
18
 *
19
 * Please note that there's an overlap between what a TPROXY target
20
 * and a socket match will match. Normally if you have both rules the
21
 * "socket" match will be the first one, effectively all packets
22
 * belonging to established connections going through that one.
23
 */
24
static inline struct sock *
25
nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
26
          const u8 protocol,
27
          const __be32 saddr, const __be32 daddr,
28
          const __be16 sport, const __be16 dport,
29
          const struct net_device *in,
30
          const enum nf_tproxy_lookup_t lookup_type)
31
{
32
  struct sock *sk;
33
  struct tcphdr *tcph;
34

35
  switch (protocol) {
36
  case IPPROTO_TCP:
37
    switch (lookup_type) {
38
    case NFT_LOOKUP_LISTENER:
39
      tcph = hp;
40
      sk = inet_lookup_listener(net, &tcp_hashinfo, skb,
41
                ip_hdrlen(skb) +
42
                  __tcp_hdrlen(tcph),
43
                saddr, sport,
44
                daddr, dport,
45
                in->ifindex, 0);
46

47
      if (sk && !refcount_inc_not_zero(&sk->sk_refcnt))
48
        sk = NULL;
49
      /* NOTE: we return listeners even if bound to
50
       * 0.0.0.0, those are filtered out in
51
       * xt_socket, since xt_TPROXY needs 0 bound
52
       * listeners too
53
       */
54
      break;
55
    case NFT_LOOKUP_ESTABLISHED:
56
      sk = inet_lookup_established(net, &tcp_hashinfo,
57
                saddr, sport, daddr, dport,
58
                in->ifindex);
59
      break;
60
    default:
61
      BUG();
62
    }
63
    break;
64
  case IPPROTO_UDP:
65
    sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
66
             in->ifindex);
67
    if (sk) {
68
      int connected = (sk->sk_state == TCP_ESTABLISHED);
69
      int wildcard = (inet_sk(sk)->inet_rcv_saddr == 0);
70

71
      /* NOTE: we return listeners even if bound to
72
       * 0.0.0.0, those are filtered out in
73
       * xt_socket, since xt_TPROXY needs 0 bound
74
       * listeners too
75
       */
76
      if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
77
          (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
78
        sock_put(sk);
79
        sk = NULL;
80
      }
81
    }
82
    break;
83
  default:
84
    WARN_ON(1);
85
    sk = NULL;
86
  }
87

88
  pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n",
89
     protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk);
90

91
  return sk;
92
}