~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/netfilter/nf_tproxy_ipv6.c

Version: ~ [ linux-5.6-rc7 ] ~ [ linux-5.5.11 ] ~ [ linux-5.4.27 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.112 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.174 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.217 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.217 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.82 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #include <net/netfilter/nf_tproxy.h>
  2 #include <linux/module.h>
  3 #include <net/inet6_hashtables.h>
  4 #include <net/addrconf.h>
  5 #include <net/udp.h>
  6 #include <net/tcp.h>
  7 
  8 const struct in6_addr *
  9 nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
 10               const struct in6_addr *daddr)
 11 {
 12         struct inet6_dev *indev;
 13         struct inet6_ifaddr *ifa;
 14         struct in6_addr *laddr;
 15 
 16         if (!ipv6_addr_any(user_laddr))
 17                 return user_laddr;
 18         laddr = NULL;
 19 
 20         indev = __in6_dev_get(skb->dev);
 21         if (indev) {
 22                 read_lock_bh(&indev->lock);
 23                 list_for_each_entry(ifa, &indev->addr_list, if_list) {
 24                         if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
 25                                 continue;
 26 
 27                         laddr = &ifa->addr;
 28                         break;
 29                 }
 30                 read_unlock_bh(&indev->lock);
 31         }
 32 
 33         return laddr ? laddr : daddr;
 34 }
 35 EXPORT_SYMBOL_GPL(nf_tproxy_laddr6);
 36 
 37 struct sock *
 38 nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
 39                          struct net *net,
 40                          const struct in6_addr *laddr,
 41                          const __be16 lport,
 42                          struct sock *sk)
 43 {
 44         const struct ipv6hdr *iph = ipv6_hdr(skb);
 45         struct tcphdr _hdr, *hp;
 46 
 47         hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
 48         if (hp == NULL) {
 49                 inet_twsk_put(inet_twsk(sk));
 50                 return NULL;
 51         }
 52 
 53         if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
 54                 /* SYN to a TIME_WAIT socket, we'd rather redirect it
 55                  * to a listener socket if there's one */
 56                 struct sock *sk2;
 57 
 58                 sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
 59                                             &iph->saddr,
 60                                             nf_tproxy_laddr6(skb, laddr, &iph->daddr),
 61                                             hp->source,
 62                                             lport ? lport : hp->dest,
 63                                             skb->dev, NF_TPROXY_LOOKUP_LISTENER);
 64                 if (sk2) {
 65                         inet_twsk_deschedule_put(inet_twsk(sk));
 66                         sk = sk2;
 67                 }
 68         }
 69 
 70         return sk;
 71 }
 72 EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
 73 
 74 struct sock *
 75 nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
 76                       const u8 protocol,
 77                       const struct in6_addr *saddr, const struct in6_addr *daddr,
 78                       const __be16 sport, const __be16 dport,
 79                       const struct net_device *in,
 80                       const enum nf_tproxy_lookup_t lookup_type)
 81 {
 82         struct sock *sk;
 83 
 84         switch (protocol) {
 85         case IPPROTO_TCP: {
 86                 struct tcphdr _hdr, *hp;
 87 
 88                 hp = skb_header_pointer(skb, thoff,
 89                                         sizeof(struct tcphdr), &_hdr);
 90                 if (hp == NULL)
 91                         return NULL;
 92 
 93                 switch (lookup_type) {
 94                 case NF_TPROXY_LOOKUP_LISTENER:
 95                         sk = inet6_lookup_listener(net, &tcp_hashinfo, skb,
 96                                                    thoff + __tcp_hdrlen(hp),
 97                                                    saddr, sport,
 98                                                    daddr, ntohs(dport),
 99                                                    in->ifindex, 0);
100 
101                         if (sk && !refcount_inc_not_zero(&sk->sk_refcnt))
102                                 sk = NULL;
103                         /* NOTE: we return listeners even if bound to
104                          * 0.0.0.0, those are filtered out in
105                          * xt_socket, since xt_TPROXY needs 0 bound
106                          * listeners too
107                          */
108                         break;
109                 case NF_TPROXY_LOOKUP_ESTABLISHED:
110                         sk = __inet6_lookup_established(net, &tcp_hashinfo,
111                                                         saddr, sport, daddr, ntohs(dport),
112                                                         in->ifindex, 0);
113                         break;
114                 default:
115                         BUG();
116                 }
117                 break;
118                 }
119         case IPPROTO_UDP:
120                 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
121                                      in->ifindex);
122                 if (sk) {
123                         int connected = (sk->sk_state == TCP_ESTABLISHED);
124                         int wildcard = ipv6_addr_any(&sk->sk_v6_rcv_saddr);
125 
126                         /* NOTE: we return listeners even if bound to
127                          * 0.0.0.0, those are filtered out in
128                          * xt_socket, since xt_TPROXY needs 0 bound
129                          * listeners too
130                          */
131                         if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
132                             (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) {
133                                 sock_put(sk);
134                                 sk = NULL;
135                         }
136                 }
137                 break;
138         default:
139                 WARN_ON(1);
140                 sk = NULL;
141         }
142 
143         pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
144                  protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
145 
146         return sk;
147 }
148 EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6);
149 
150 MODULE_LICENSE("GPL");
151 MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
152 MODULE_DESCRIPTION("Netfilter IPv4 transparent proxy support");
153 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp