~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_socket.c

Version: ~ [ linux-5.4-rc7 ] ~ [ linux-5.3.11 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.84 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.154 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.201 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.201 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.77 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Transparent proxy support for Linux/iptables
  3  *
  4  * Copyright (C) 2007-2008 BalaBit IT Ltd.
  5  * Author: Krisztian Kovacs
  6  *
  7  * This program is free software; you can redistribute it and/or modify
  8  * it under the terms of the GNU General Public License version 2 as
  9  * published by the Free Software Foundation.
 10  *
 11  */
 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 13 #include <linux/module.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/netfilter/x_tables.h>
 16 #include <linux/netfilter_ipv4/ip_tables.h>
 17 #include <net/tcp.h>
 18 #include <net/udp.h>
 19 #include <net/icmp.h>
 20 #include <net/sock.h>
 21 #include <net/inet_sock.h>
 22 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 23 
 24 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 25 #include <linux/netfilter_ipv6/ip6_tables.h>
 26 #include <net/inet6_hashtables.h>
 27 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 28 #endif
 29 
 30 #include <net/netfilter/nf_socket.h>
 31 #include <linux/netfilter/xt_socket.h>
 32 
 33 /* "socket" match based redirection (no specific rule)
 34  * ===================================================
 35  *
 36  * There are connections with dynamic endpoints (e.g. FTP data
 37  * connection) that the user is unable to add explicit rules
 38  * for. These are taken care of by a generic "socket" rule. It is
 39  * assumed that the proxy application is trusted to open such
 40  * connections without explicit iptables rule (except of course the
 41  * generic 'socket' rule). In this case the following sockets are
 42  * matched in preference order:
 43  *
 44  *   - match: if there's a fully established connection matching the
 45  *     _packet_ tuple
 46  *
 47  *   - match: if there's a non-zero bound listener (possibly with a
 48  *     non-local address) We don't accept zero-bound listeners, since
 49  *     then local services could intercept traffic going through the
 50  *     box.
 51  */
 52 static bool
 53 socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 54              const struct xt_socket_mtinfo1 *info)
 55 {
 56         struct sk_buff *pskb = (struct sk_buff *)skb;
 57         struct sock *sk = skb->sk;
 58 
 59         if (!sk)
 60                 sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
 61         if (sk) {
 62                 bool wildcard;
 63                 bool transparent = true;
 64 
 65                 /* Ignore sockets listening on INADDR_ANY,
 66                  * unless XT_SOCKET_NOWILDCARD is set
 67                  */
 68                 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
 69                             sk_fullsock(sk) &&
 70                             inet_sk(sk)->inet_rcv_saddr == 0);
 71 
 72                 /* Ignore non-transparent sockets,
 73                  * if XT_SOCKET_TRANSPARENT is used
 74                  */
 75                 if (info->flags & XT_SOCKET_TRANSPARENT)
 76                         transparent = nf_sk_is_transparent(sk);
 77 
 78                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
 79                     transparent)
 80                         pskb->mark = sk->sk_mark;
 81 
 82                 if (sk != skb->sk)
 83                         sock_gen_put(sk);
 84 
 85                 if (wildcard || !transparent)
 86                         sk = NULL;
 87         }
 88 
 89         return sk != NULL;
 90 }
 91 
 92 static bool
 93 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 94 {
 95         static struct xt_socket_mtinfo1 xt_info_v0 = {
 96                 .flags = 0,
 97         };
 98 
 99         return socket_match(skb, par, &xt_info_v0);
100 }
101 
102 static bool
103 socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
104 {
105         return socket_match(skb, par, par->matchinfo);
106 }
107 
108 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
109 static bool
110 socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
111 {
112         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
113         struct sk_buff *pskb = (struct sk_buff *)skb;
114         struct sock *sk = skb->sk;
115 
116         if (!sk)
117                 sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
118         if (sk) {
119                 bool wildcard;
120                 bool transparent = true;
121 
122                 /* Ignore sockets listening on INADDR_ANY
123                  * unless XT_SOCKET_NOWILDCARD is set
124                  */
125                 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
126                             sk_fullsock(sk) &&
127                             ipv6_addr_any(&sk->sk_v6_rcv_saddr));
128 
129                 /* Ignore non-transparent sockets,
130                  * if XT_SOCKET_TRANSPARENT is used
131                  */
132                 if (info->flags & XT_SOCKET_TRANSPARENT)
133                         transparent = nf_sk_is_transparent(sk);
134 
135                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
136                     transparent)
137                         pskb->mark = sk->sk_mark;
138 
139                 if (sk != skb->sk)
140                         sock_gen_put(sk);
141 
142                 if (wildcard || !transparent)
143                         sk = NULL;
144         }
145 
146         return sk != NULL;
147 }
148 #endif
149 
150 static int socket_mt_enable_defrag(struct net *net, int family)
151 {
152         switch (family) {
153         case NFPROTO_IPV4:
154                 return nf_defrag_ipv4_enable(net);
155 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
156         case NFPROTO_IPV6:
157                 return nf_defrag_ipv6_enable(net);
158 #endif
159         }
160         WARN_ONCE(1, "Unknown family %d\n", family);
161         return 0;
162 }
163 
164 static int socket_mt_v1_check(const struct xt_mtchk_param *par)
165 {
166         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
167         int err;
168 
169         err = socket_mt_enable_defrag(par->net, par->family);
170         if (err)
171                 return err;
172 
173         if (info->flags & ~XT_SOCKET_FLAGS_V1) {
174                 pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
175                 return -EINVAL;
176         }
177         return 0;
178 }
179 
180 static int socket_mt_v2_check(const struct xt_mtchk_param *par)
181 {
182         const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
183         int err;
184 
185         err = socket_mt_enable_defrag(par->net, par->family);
186         if (err)
187                 return err;
188 
189         if (info->flags & ~XT_SOCKET_FLAGS_V2) {
190                 pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
191                 return -EINVAL;
192         }
193         return 0;
194 }
195 
196 static int socket_mt_v3_check(const struct xt_mtchk_param *par)
197 {
198         const struct xt_socket_mtinfo3 *info =
199                                     (struct xt_socket_mtinfo3 *)par->matchinfo;
200         int err;
201 
202         err = socket_mt_enable_defrag(par->net, par->family);
203         if (err)
204                 return err;
205         if (info->flags & ~XT_SOCKET_FLAGS_V3) {
206                 pr_info("unknown flags 0x%x\n",
207                         info->flags & ~XT_SOCKET_FLAGS_V3);
208                 return -EINVAL;
209         }
210         return 0;
211 }
212 
213 static struct xt_match socket_mt_reg[] __read_mostly = {
214         {
215                 .name           = "socket",
216                 .revision       = 0,
217                 .family         = NFPROTO_IPV4,
218                 .match          = socket_mt4_v0,
219                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
220                                   (1 << NF_INET_LOCAL_IN),
221                 .me             = THIS_MODULE,
222         },
223         {
224                 .name           = "socket",
225                 .revision       = 1,
226                 .family         = NFPROTO_IPV4,
227                 .match          = socket_mt4_v1_v2_v3,
228                 .checkentry     = socket_mt_v1_check,
229                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
230                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
231                                   (1 << NF_INET_LOCAL_IN),
232                 .me             = THIS_MODULE,
233         },
234 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
235         {
236                 .name           = "socket",
237                 .revision       = 1,
238                 .family         = NFPROTO_IPV6,
239                 .match          = socket_mt6_v1_v2_v3,
240                 .checkentry     = socket_mt_v1_check,
241                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
242                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
243                                   (1 << NF_INET_LOCAL_IN),
244                 .me             = THIS_MODULE,
245         },
246 #endif
247         {
248                 .name           = "socket",
249                 .revision       = 2,
250                 .family         = NFPROTO_IPV4,
251                 .match          = socket_mt4_v1_v2_v3,
252                 .checkentry     = socket_mt_v2_check,
253                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
254                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
255                                   (1 << NF_INET_LOCAL_IN),
256                 .me             = THIS_MODULE,
257         },
258 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
259         {
260                 .name           = "socket",
261                 .revision       = 2,
262                 .family         = NFPROTO_IPV6,
263                 .match          = socket_mt6_v1_v2_v3,
264                 .checkentry     = socket_mt_v2_check,
265                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
266                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
267                                   (1 << NF_INET_LOCAL_IN),
268                 .me             = THIS_MODULE,
269         },
270 #endif
271         {
272                 .name           = "socket",
273                 .revision       = 3,
274                 .family         = NFPROTO_IPV4,
275                 .match          = socket_mt4_v1_v2_v3,
276                 .checkentry     = socket_mt_v3_check,
277                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
278                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
279                                   (1 << NF_INET_LOCAL_IN),
280                 .me             = THIS_MODULE,
281         },
282 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
283         {
284                 .name           = "socket",
285                 .revision       = 3,
286                 .family         = NFPROTO_IPV6,
287                 .match          = socket_mt6_v1_v2_v3,
288                 .checkentry     = socket_mt_v3_check,
289                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
290                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
291                                   (1 << NF_INET_LOCAL_IN),
292                 .me             = THIS_MODULE,
293         },
294 #endif
295 };
296 
297 static int __init socket_mt_init(void)
298 {
299         return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
300 }
301 
302 static void __exit socket_mt_exit(void)
303 {
304         xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
305 }
306 
307 module_init(socket_mt_init);
308 module_exit(socket_mt_exit);
309 
310 MODULE_LICENSE("GPL");
311 MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
312 MODULE_DESCRIPTION("x_tables socket match module");
313 MODULE_ALIAS("ipt_socket");
314 MODULE_ALIAS("ip6t_socket");
315 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp