1// SPDX-License-Identifier: GPL-2.0-only
2#include <net/netfilter/nf_tproxy.h>
3#include <linux/module.h>
4#include <net/inet6_hashtables.h>
5#include <net/addrconf.h>
6#include <net/udp.h>
7#include <net/tcp.h>
8
9const struct in6_addr *
10nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
11 const struct in6_addr *daddr)
12{
13 struct inet6_dev *indev;
14 struct inet6_ifaddr *ifa;
15 struct in6_addr *laddr;
16
17 if (!ipv6_addr_any(a: user_laddr))
18 return user_laddr;
19 laddr = NULL;
20
21 indev = __in6_dev_get(dev: skb->dev);
22 if (indev) {
23 read_lock_bh(&indev->lock);
24 list_for_each_entry(ifa, &indev->addr_list, if_list) {
25 if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
26 continue;
27
28 laddr = &ifa->addr;
29 break;
30 }
31 read_unlock_bh(&indev->lock);
32 }
33
34 return laddr ? laddr : daddr;
35}
36EXPORT_SYMBOL_GPL(nf_tproxy_laddr6);
37
38struct sock *
39nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
40 struct net *net,
41 const struct in6_addr *laddr,
42 const __be16 lport,
43 struct sock *sk)
44{
45 const struct ipv6hdr *iph = ipv6_hdr(skb);
46 struct tcphdr _hdr, *hp;
47
48 hp = skb_header_pointer(skb, offset: thoff, len: sizeof(_hdr), buffer: &_hdr);
49 if (hp == NULL) {
50 inet_twsk_put(tw: inet_twsk(sk));
51 return NULL;
52 }
53
54 if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
55 /* SYN to a TIME_WAIT socket, we'd rather redirect it
56 * to a listener socket if there's one */
57 struct sock *sk2;
58
59 sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, protocol: tproto,
60 saddr: &iph->saddr,
61 daddr: nf_tproxy_laddr6(skb, laddr, &iph->daddr),
62 sport: hp->source,
63 dport: lport ? lport : hp->dest,
64 in: skb->dev, lookup_type: NF_TPROXY_LOOKUP_LISTENER);
65 if (sk2) {
66 nf_tproxy_twsk_deschedule_put(tw: inet_twsk(sk));
67 sk = sk2;
68 }
69 }
70
71 return sk;
72}
73EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
74
75struct sock *
76nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
77 const u8 protocol,
78 const struct in6_addr *saddr, const struct in6_addr *daddr,
79 const __be16 sport, const __be16 dport,
80 const struct net_device *in,
81 const enum nf_tproxy_lookup_t lookup_type)
82{
83 struct inet_hashinfo *hinfo = net->ipv4.tcp_death_row.hashinfo;
84 struct sock *sk;
85
86 switch (protocol) {
87 case IPPROTO_TCP: {
88 struct tcphdr _hdr, *hp;
89
90 hp = skb_header_pointer(skb, offset: thoff,
91 len: sizeof(struct tcphdr), buffer: &_hdr);
92 if (hp == NULL)
93 return NULL;
94
95 switch (lookup_type) {
96 case NF_TPROXY_LOOKUP_LISTENER:
97 sk = inet6_lookup_listener(net, hashinfo: hinfo, skb,
98 doff: thoff + __tcp_hdrlen(th: hp),
99 saddr, sport,
100 daddr, ntohs(dport),
101 dif: in->ifindex, sdif: 0);
102
103 if (sk && !refcount_inc_not_zero(r: &sk->sk_refcnt))
104 sk = NULL;
105 /* NOTE: we return listeners even if bound to
106 * 0.0.0.0, those are filtered out in
107 * xt_socket, since xt_TPROXY needs 0 bound
108 * listeners too
109 */
110 break;
111 case NF_TPROXY_LOOKUP_ESTABLISHED:
112 sk = __inet6_lookup_established(net, hashinfo: hinfo, saddr, sport, daddr,
113 ntohs(dport), dif: in->ifindex, sdif: 0);
114 break;
115 default:
116 BUG();
117 }
118 break;
119 }
120 case IPPROTO_UDP:
121 sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
122 dif: in->ifindex);
123 if (sk) {
124 int connected = (sk->sk_state == TCP_ESTABLISHED);
125 int wildcard = ipv6_addr_any(a: &sk->sk_v6_rcv_saddr);
126
127 /* NOTE: we return listeners even if bound to
128 * 0.0.0.0, those are filtered out in
129 * xt_socket, since xt_TPROXY needs 0 bound
130 * listeners too
131 */
132 if ((lookup_type == NF_TPROXY_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
133 (lookup_type == NF_TPROXY_LOOKUP_LISTENER && connected)) {
134 sock_put(sk);
135 sk = NULL;
136 }
137 }
138 break;
139 default:
140 WARN_ON(1);
141 sk = NULL;
142 }
143
144 pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
145 protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
146
147 return sk;
148}
149EXPORT_SYMBOL_GPL(nf_tproxy_get_sock_v6);
150
151MODULE_LICENSE("GPL");
152MODULE_AUTHOR("Balazs Scheidler, Krisztian Kovacs");
153MODULE_DESCRIPTION("Netfilter IPv6 transparent proxy support");
154

source code of linux/net/ipv6/netfilter/nf_tproxy_ipv6.c