~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/xt_socket.c

Version: ~ [ linux-5.18-rc6 ] ~ [ linux-5.17.6 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.38 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.114 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.192 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.241 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.277 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.312 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Transparent proxy support for Linux/iptables
  3  *
  4  * Copyright (C) 2007-2008 BalaBit IT Ltd.
  5  * Author: Krisztian Kovacs
  6  *
  7  * This program is free software; you can redistribute it and/or modify
  8  * it under the terms of the GNU General Public License version 2 as
  9  * published by the Free Software Foundation.
 10  *
 11  */
 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 13 #include <linux/module.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/netfilter/x_tables.h>
 16 #include <linux/netfilter_ipv4/ip_tables.h>
 17 #include <net/tcp.h>
 18 #include <net/udp.h>
 19 #include <net/icmp.h>
 20 #include <net/sock.h>
 21 #include <net/inet_sock.h>
 22 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 23 
 24 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 25 #include <linux/netfilter_ipv6/ip6_tables.h>
 26 #include <net/inet6_hashtables.h>
 27 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 28 #endif
 29 
 30 #include <net/netfilter/nf_socket.h>
 31 #include <linux/netfilter/xt_socket.h>
 32 
 33 /* "socket" match based redirection (no specific rule)
 34  * ===================================================
 35  *
 36  * There are connections with dynamic endpoints (e.g. FTP data
 37  * connection) that the user is unable to add explicit rules
 38  * for. These are taken care of by a generic "socket" rule. It is
 39  * assumed that the proxy application is trusted to open such
 40  * connections without explicit iptables rule (except of course the
 41  * generic 'socket' rule). In this case the following sockets are
 42  * matched in preference order:
 43  *
 44  *   - match: if there's a fully established connection matching the
 45  *     _packet_ tuple
 46  *
 47  *   - match: if there's a non-zero bound listener (possibly with a
 48  *     non-local address) We don't accept zero-bound listeners, since
 49  *     then local services could intercept traffic going through the
 50  *     box.
 51  */
 52 static bool
 53 socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 54              const struct xt_socket_mtinfo1 *info)
 55 {
 56         struct sk_buff *pskb = (struct sk_buff *)skb;
 57         struct sock *sk = skb->sk;
 58 
 59         if (!sk)
 60                 sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
 61         if (sk) {
 62                 bool wildcard;
 63                 bool transparent = true;
 64 
 65                 /* Ignore sockets listening on INADDR_ANY,
 66                  * unless XT_SOCKET_NOWILDCARD is set
 67                  */
 68                 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
 69                             sk_fullsock(sk) &&
 70                             inet_sk(sk)->inet_rcv_saddr == 0);
 71 
 72                 /* Ignore non-transparent sockets,
 73                  * if XT_SOCKET_TRANSPARENT is used
 74                  */
 75                 if (info->flags & XT_SOCKET_TRANSPARENT)
 76                         transparent = inet_sk_transparent(sk);
 77 
 78                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
 79                     transparent && sk_fullsock(sk))
 80                         pskb->mark = sk->sk_mark;
 81 
 82                 if (sk != skb->sk)
 83                         sock_gen_put(sk);
 84 
 85                 if (wildcard || !transparent)
 86                         sk = NULL;
 87         }
 88 
 89         return sk != NULL;
 90 }
 91 
 92 static bool
 93 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 94 {
 95         static struct xt_socket_mtinfo1 xt_info_v0 = {
 96                 .flags = 0,
 97         };
 98 
 99         return socket_match(skb, par, &xt_info_v0);
100 }
101 
102 static bool
103 socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
104 {
105         return socket_match(skb, par, par->matchinfo);
106 }
107 
108 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
109 static bool
110 socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
111 {
112         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
113         struct sk_buff *pskb = (struct sk_buff *)skb;
114         struct sock *sk = skb->sk;
115 
116         if (!sk)
117                 sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
118         if (sk) {
119                 bool wildcard;
120                 bool transparent = true;
121 
122                 /* Ignore sockets listening on INADDR_ANY
123                  * unless XT_SOCKET_NOWILDCARD is set
124                  */
125                 wildcard = (!(info->flags & XT_SOCKET_NOWILDCARD) &&
126                             sk_fullsock(sk) &&
127                             ipv6_addr_any(&sk->sk_v6_rcv_saddr));
128 
129                 /* Ignore non-transparent sockets,
130                  * if XT_SOCKET_TRANSPARENT is used
131                  */
132                 if (info->flags & XT_SOCKET_TRANSPARENT)
133                         transparent = inet_sk_transparent(sk);
134 
135                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
136                     transparent && sk_fullsock(sk))
137                         pskb->mark = sk->sk_mark;
138 
139                 if (sk != skb->sk)
140                         sock_gen_put(sk);
141 
142                 if (wildcard || !transparent)
143                         sk = NULL;
144         }
145 
146         return sk != NULL;
147 }
148 #endif
149 
150 static int socket_mt_enable_defrag(struct net *net, int family)
151 {
152         switch (family) {
153         case NFPROTO_IPV4:
154                 return nf_defrag_ipv4_enable(net);
155 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
156         case NFPROTO_IPV6:
157                 return nf_defrag_ipv6_enable(net);
158 #endif
159         }
160         WARN_ONCE(1, "Unknown family %d\n", family);
161         return 0;
162 }
163 
164 static int socket_mt_v1_check(const struct xt_mtchk_param *par)
165 {
166         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
167         int err;
168 
169         err = socket_mt_enable_defrag(par->net, par->family);
170         if (err)
171                 return err;
172 
173         if (info->flags & ~XT_SOCKET_FLAGS_V1) {
174                 pr_info_ratelimited("unknown flags 0x%x\n",
175                                     info->flags & ~XT_SOCKET_FLAGS_V1);
176                 return -EINVAL;
177         }
178         return 0;
179 }
180 
181 static int socket_mt_v2_check(const struct xt_mtchk_param *par)
182 {
183         const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
184         int err;
185 
186         err = socket_mt_enable_defrag(par->net, par->family);
187         if (err)
188                 return err;
189 
190         if (info->flags & ~XT_SOCKET_FLAGS_V2) {
191                 pr_info_ratelimited("unknown flags 0x%x\n",
192                                     info->flags & ~XT_SOCKET_FLAGS_V2);
193                 return -EINVAL;
194         }
195         return 0;
196 }
197 
198 static int socket_mt_v3_check(const struct xt_mtchk_param *par)
199 {
200         const struct xt_socket_mtinfo3 *info =
201                                     (struct xt_socket_mtinfo3 *)par->matchinfo;
202         int err;
203 
204         err = socket_mt_enable_defrag(par->net, par->family);
205         if (err)
206                 return err;
207         if (info->flags & ~XT_SOCKET_FLAGS_V3) {
208                 pr_info_ratelimited("unknown flags 0x%x\n",
209                                     info->flags & ~XT_SOCKET_FLAGS_V3);
210                 return -EINVAL;
211         }
212         return 0;
213 }
214 
215 static struct xt_match socket_mt_reg[] __read_mostly = {
216         {
217                 .name           = "socket",
218                 .revision       = 0,
219                 .family         = NFPROTO_IPV4,
220                 .match          = socket_mt4_v0,
221                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
222                                   (1 << NF_INET_LOCAL_IN),
223                 .me             = THIS_MODULE,
224         },
225         {
226                 .name           = "socket",
227                 .revision       = 1,
228                 .family         = NFPROTO_IPV4,
229                 .match          = socket_mt4_v1_v2_v3,
230                 .checkentry     = socket_mt_v1_check,
231                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
232                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
233                                   (1 << NF_INET_LOCAL_IN),
234                 .me             = THIS_MODULE,
235         },
236 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
237         {
238                 .name           = "socket",
239                 .revision       = 1,
240                 .family         = NFPROTO_IPV6,
241                 .match          = socket_mt6_v1_v2_v3,
242                 .checkentry     = socket_mt_v1_check,
243                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
244                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
245                                   (1 << NF_INET_LOCAL_IN),
246                 .me             = THIS_MODULE,
247         },
248 #endif
249         {
250                 .name           = "socket",
251                 .revision       = 2,
252                 .family         = NFPROTO_IPV4,
253                 .match          = socket_mt4_v1_v2_v3,
254                 .checkentry     = socket_mt_v2_check,
255                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
256                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
257                                   (1 << NF_INET_LOCAL_IN),
258                 .me             = THIS_MODULE,
259         },
260 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
261         {
262                 .name           = "socket",
263                 .revision       = 2,
264                 .family         = NFPROTO_IPV6,
265                 .match          = socket_mt6_v1_v2_v3,
266                 .checkentry     = socket_mt_v2_check,
267                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
268                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
269                                   (1 << NF_INET_LOCAL_IN),
270                 .me             = THIS_MODULE,
271         },
272 #endif
273         {
274                 .name           = "socket",
275                 .revision       = 3,
276                 .family         = NFPROTO_IPV4,
277                 .match          = socket_mt4_v1_v2_v3,
278                 .checkentry     = socket_mt_v3_check,
279                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
280                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
281                                   (1 << NF_INET_LOCAL_IN),
282                 .me             = THIS_MODULE,
283         },
284 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
285         {
286                 .name           = "socket",
287                 .revision       = 3,
288                 .family         = NFPROTO_IPV6,
289                 .match          = socket_mt6_v1_v2_v3,
290                 .checkentry     = socket_mt_v3_check,
291                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
292                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
293                                   (1 << NF_INET_LOCAL_IN),
294                 .me             = THIS_MODULE,
295         },
296 #endif
297 };
298 
299 static int __init socket_mt_init(void)
300 {
301         return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
302 }
303 
304 static void __exit socket_mt_exit(void)
305 {
306         xt_unregister_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
307 }
308 
309 module_init(socket_mt_init);
310 module_exit(socket_mt_exit);
311 
312 MODULE_LICENSE("GPL");
313 MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
314 MODULE_DESCRIPTION("x_tables socket match module");
315 MODULE_ALIAS("ipt_socket");
316 MODULE_ALIAS("ip6t_socket");
317 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp