cttproxy-2.6.18-2.0.6/0002775000175000017500000000000010547470350013426 5ustar hiddenhiddencttproxy-2.6.18-2.0.6/examples/0002775000175000017500000000000010227205054015234 5ustar hiddenhiddencttproxy-2.6.18-2.0.6/examples/foreign-udp-connect.c0000664000175000017500000000364310017606222021251 0ustar hiddenhidden#include #include #include #include #include #include #include /* an IP address bound to one of the local interfaces */ #define LOCAL_IP "1.2.3.4" /* the IP address to use as source address */ #define FOREIGN_IP "10.0.0.1" /* IP address to connect to */ #define DEST_IP "192.168.1.1" int main() { int sock; struct sockaddr_in sin; struct in_tproxy itp; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock == -1) { perror("socket"); return -1; } /* check tproxy version */ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ sin.sin_family = AF_INET; inet_aton(LOCAL_IP, &sin.sin_addr); sin.sin_port = htons(9999); if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("bind"); return -1; } /* assign foreign address, specify exact foreign port */ itp.op = TPROXY_ASSIGN; inet_aton(FOREIGN_IP, (struct in_addr *) &itp.v.addr.faddr); itp.v.addr.fport = htons(2000); if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } /* set connect flag on socket */ itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); return -1; } /* connect */ inet_aton(DEST_IP, &sin.sin_addr); sin.sin_port = htons(10000); if (connect(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("connect"); return -1; } write(sock, "1234\n", 5); close(sock); return 0; } cttproxy-2.6.18-2.0.6/examples/foreign-tcp-connect.c0000664000175000017500000000401610200200216021225 0ustar hiddenhidden#include #include #include #include #include #include #include /* an IP address bound to one of the local interfaces */ #define LOCAL_IP "1.2.3.4" /* the IP address to use as source address */ #define FOREIGN_IP "10.0.0.1" /* IP address to connect to */ #define DEST_IP "192.168.1.1" int main() { int sock; struct sockaddr_in sin; struct in_tproxy itp; char ch; char buf[] = "GET / HTTP/1.0\r\nHost: www\r\n\r\n"; sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == -1) { perror("socket"); return -1; } /* check tproxy version */ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ sin.sin_family = AF_INET; inet_aton(LOCAL_IP, &sin.sin_addr); sin.sin_port = htons(9999); if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("bind"); return -1; } /* assign foreign address */ itp.op = TPROXY_ASSIGN; inet_aton(FOREIGN_IP, (struct in_addr *) &itp.v.addr.faddr); itp.v.addr.fport = htons(2000); if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } /* set connect flag on socket */ itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); return -1; } /* connect */ inet_aton(DEST_IP, &sin.sin_addr); sin.sin_port = htons(80); if (connect(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("connect"); return -1; } write(sock, buf, strlen(buf)); while (read(sock, &ch, 1) == 1) { putchar(ch); } close(sock); return 0; } cttproxy-2.6.18-2.0.6/examples/Makefile0000664000175000017500000000040710005215540016666 0ustar hiddenhiddenCFLAGS=-Wall -I/usr/src/linux/include all: foreign-tcp-connect foreign-tcp-listen foreign-udp-connect foreign-udp-connect-alloc redirect-udp-recv clean: rm foreign-tcp-connect foreign-tcp-listen foreign-udp-connect foreign-udp-connect-alloc redirect-udp-recv cttproxy-2.6.18-2.0.6/examples/redirect-udp-recv.c0000664000175000017500000000507210017606332020727 0ustar hiddenhidden#include #include #include #include #include #include #include /* Local IP address to bind to */ #define DEST_IP "192.168.1.1" int main() { int sock; struct msghdr msg; struct cmsghdr *cmsg; char buf[1024]; char msgbuf[3000]; struct iovec iov; size_t len = sizeof(buf); struct sockaddr_in sa; struct in_tproxy itp; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock == -1) { perror("socket"); return -1; } /* check tproxy version */ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ sa.sin_family = AF_INET; inet_aton("192.168.131.124", &sa.sin_addr); sa.sin_port = htons(9999); if (bind(sock, (struct sockaddr *) &sa, sizeof(sa)) == -1) { perror("bind"); return -1; } /* set RECVORIGADDRS socket option, to be able to get original destination address * through recvmsg() */ memset(&msg, 0, sizeof(msg)); msg.msg_controllen = sizeof(buf); msg.msg_control = buf; msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = msgbuf; iov.iov_len = sizeof(msgbuf); if (setsockopt(sock, SOL_IP, IP_RECVORIGADDRS, &len, sizeof(len)) == -1) { perror("setsockopt(SOL_IP, IP_RECVORIGADDRS)"); } while (1) { recvmsg(sock, &msg, 0); for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg,cmsg)) { printf("level=%d, type=%d\n", cmsg->cmsg_level, cmsg->cmsg_type); if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_PKTINFO) { struct in_pktinfo *info = (struct in_pktinfo *) CMSG_DATA(cmsg); printf("addr=%08x, peer=%08x, ifi=%d\n", info->ipi_addr.s_addr, info->ipi_spec_dst.s_addr, info->ipi_ifindex); } else if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_ORIGADDRS) { struct in_origaddrs *ioa = (struct in_origaddrs *) CMSG_DATA(cmsg); char addr1[32], addr2[32]; strcpy(addr1, inet_ntoa(ioa->ioa_srcaddr)); strcpy(addr2, inet_ntoa(ioa->ioa_dstaddr)); printf("src=%s:%d, dst=%s:%d\n", addr1, ntohs(ioa->ioa_srcport), addr2, ntohs(ioa->ioa_dstport)); } } } } cttproxy-2.6.18-2.0.6/examples/skaidrus/0002775000175000017500000000000010547470503017071 5ustar hiddenhiddencttproxy-2.6.18-2.0.6/examples/skaidrus/main.c0000664000175000017500000000356510166262533020167 0ustar hiddenhidden/* * skaidrus, an example transparent proxy application * Copyright (C) 2004, 2005 Lennert Buytenhek * * This program is free software; you can redistribute and/or modify it * under the terms of the GNU Lesser General Public License as published * by the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include #include #include "skaidrus.h" static int detect_tproxy_v2(void) { struct in_tproxy itp; int sock; sock = socket(AF_INET, SOCK_STREAM, 0); if (sock < 0) { perror("socket"); return 1; } itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) < 0) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); close(sock); return 1; } close(sock); return 0; } int main() { struct skaidrus_instance si; fprintf(stderr, "skaidrus, an example transparent proxy application\n"); fprintf(stderr, "\n"); if (geteuid() != 0) { fprintf(stderr, "error: need root privileges for performing " "transparent proxy functions\n"); return 1; } if (detect_tproxy_v2()) { fprintf(stderr, "error: version >= 2.0.0 of linux transparent " "proxy patches not detected\n"); return 1; } iv_init(); openlog("skaidrus", LOG_NDELAY | LOG_PERROR, LOG_USER); si.local_addr.sin_family = AF_INET; si.local_addr.sin_addr.s_addr = htonl(INADDR_ANY); si.local_addr.sin_port = htons(9841); if (!register_skaidrus_instance(&si)) { fprintf(stderr, "can't register skaidrus instance\n"); return 1; } fprintf(stderr, "up and running\n"); iv_main(); return 0; } cttproxy-2.6.18-2.0.6/examples/skaidrus/TODO0000664000175000017500000000120110227205050017535 0ustar hiddenhidden- The is_local_address check should really be implemented by trying to bind to the given address (like in determine_source_address), and then checking if the source address that would be used to connect to this destination is the same address as the destination itself. - Implement a way of preventing connections for being transproxied. This would for example be useful if you have hosts on an internal (e.g. 10.0.0.0/8) network that want to connect to the outside world -- in such a case, not doing transproxying is akin to using MASQUERADE. cttproxy-2.6.18-2.0.6/examples/skaidrus/Makefile0000664000175000017500000000023710547470502020530 0ustar hiddenhiddenskaidrus: main.c skaidrus.c skaidrus.h skaidrus_private.h gcc -Wall -I /usr/src/linux/include -o skaidrus main.c skaidrus.c `ivykis-config --cflags --libs` cttproxy-2.6.18-2.0.6/examples/skaidrus/skaidrus.c0000664000175000017500000003256110200417723021056 0ustar hiddenhidden/* * skaidrus, an example transparent proxy application * Copyright (C) 2004, 2005 Lennert Buytenhek * * This program is free software; you can redistribute and/or modify it * under the terms of the GNU Lesser General Public License as published * by the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #include #include #include #include #include #include #include #include #include #include #include "skaidrus.h" #include "skaidrus_private.h" /* util functions ***********************************************************/ static int determine_source_address(struct sockaddr_in *destination, struct sockaddr_in *source) { struct sockaddr_in addr; socklen_t addrlen; char textaddr[32]; int sock; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { syslog(LOG_CRIT, "determine_source_address: error " "%d while creating socket", errno); abort(); } addr = *destination; addr.sin_port = htons(80); if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { syslog(LOG_ALERT, "determine_source_address: error %d " "while looking up route for %d", errno, inet_aton(textaddr, &(addr.sin_addr))); close(sock); return -1; } addrlen = sizeof(*source); if (getsockname(sock, (struct sockaddr *)source, &addrlen) < 0) { syslog(LOG_CRIT, "determine_source_address: error %d " "while retrieving source address", errno); abort(); } source->sin_port = 0; close(sock); return 0; } /* If we're going to tproxy an outgoing connection anyway, we do not have * to bind to the very same source address that we would use in case we * wouldn't be tproxy'ing. * * In earlier versions of the tproxy code, at least in 1.9.6, there used * to be an issue where tproxy (ip_conntrack) and the local TCP stack * would disagree about which local port numbers are in use, which would * sometimes lead to outgoing connections being tproxy'd with the wrong * source address, being the source address that was previously used * for this local port. (So if we would tproxy-connect from local port * number 12345 with source address 1.2.3.4, and a few minutes later from * local port number 12345 with source address 2.3.4.5, 1.2.3.4 would * be used instead of 2.3.4.5 as source address even if the connection * with source address 1.2.3.4 would already have been terminated.) * * One possible way to work around that is to assign a set of 'fake' IP * addresses to localhost, say 10.10.10.{1-255}, and to round-robin local * port allocation over these IPs, binding ~50000 (or whatever the size * of your ip_local_port_range is) connections to each IP before moving * on to the next one. */ static int bind_to_source_address(int fd, struct sockaddr_in *addr) { struct sockaddr_in source; if (determine_source_address(addr, &source) < 0) return -1; if (bind(fd, (struct sockaddr *)&source, sizeof(source)) < 0) { perror("bind"); return -1; } return 0; } static int is_local_address(struct sockaddr_in *_addr) { struct sockaddr_in addr; int is_local; int sock; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { syslog(LOG_CRIT, "is_local_address: error %d in socket(2)", errno); abort(); } addr = *_addr; addr.sin_port = htons(0); is_local = 0; if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0) is_local = 1; close(sock); return is_local; } /* state FORWARDING *********************************************************/ static void got_user_data(void *_req); static void got_user_write_space(void *_req); static void got_server_data(void *_req); static void got_server_write_space(void *_req); static void connection_kill(struct connection *req) { list_del(&(req->list)); iv_unregister_fd(&(req->user_fd)); close(req->user_fd.fd); iv_unregister_fd(&(req->server_fd)); close(req->server_fd.fd); free(req); } static void got_user_data(void *_req) { struct connection *req = (struct connection *)_req; unsigned char *ptr; int space; int ret; ptr = req->us_buf + req->us_buf_length; space = sizeof(req->us_buf) - req->us_buf_length; if (!space) { syslog(LOG_CRIT, "got_user_data: no space"); abort(); } ret = iv_read(&(req->user_fd), ptr, space); if (ret < 0) { if (errno != EAGAIN) connection_kill(req); return; } if (!req->us_buf_length && req->state != CONNECTION_STATE_WAITING_CONN) iv_fd_set_handler_out(&(req->server_fd), got_server_write_space); if (ret == 0) { req->us_saw_fin = 1; iv_fd_set_handler_in(&(req->user_fd), NULL); return; } req->us_buf_length += ret; if (req->us_buf_length == sizeof(req->us_buf)) iv_fd_set_handler_in(&(req->user_fd), NULL); } static void got_user_write_space(void *_req) { struct connection *req = (struct connection *)_req; if (!req->su_buf_length && req->su_saw_fin != 1) { syslog(LOG_CRIT, "got_user_write_space: nothing to do"); abort(); } if (req->su_buf_length) { int ret; ret = iv_write(&(req->user_fd), req->su_buf, req->su_buf_length); if (ret <= 0) { if (ret == 0 || errno != EAGAIN) connection_kill(req); return; } if (req->su_buf_length == sizeof(req->su_buf) && !req->su_saw_fin) iv_fd_set_handler_in(&(req->server_fd), got_server_data); req->su_buf_length -= ret; memmove(req->su_buf, req->su_buf + ret, req->su_buf_length); } if (!req->su_buf_length) { iv_fd_set_handler_out(&(req->user_fd), NULL); switch (req->su_saw_fin) { case 0: break; case 1: req->su_saw_fin = 2; shutdown(req->user_fd.fd, SHUT_WR); if (req->us_saw_fin == 2) connection_kill(req); break; case 2: syslog(LOG_CRIT, "got_user_write_space: already relayed fin"); abort(); } } } static void got_user_error(void *_req) { struct connection *req = (struct connection *)_req; int retlen; int ret; retlen = sizeof(ret); if (getsockopt(req->user_fd.fd, SOL_SOCKET, SO_ERROR, &ret, &retlen) < 0) { syslog(LOG_CRIT, "got_user_error: error %d while getsockopt(SO_ERROR)", errno); abort(); } if (ret == 0) { syslog(LOG_CRIT, "got_user_error: no error?!"); abort(); } connection_kill(req); } static void got_server_data(void *_req) { struct connection *req = (struct connection *)_req; unsigned char *ptr; int space; int ret; ptr = req->su_buf + req->su_buf_length; space = sizeof(req->su_buf) - req->su_buf_length; if (!space) { syslog(LOG_CRIT, "got_server_data: no space"); abort(); } ret = iv_read(&(req->server_fd), ptr, space); if (ret < 0) { if (errno != EAGAIN) connection_kill(req); return; } if (!req->su_buf_length && req->state == CONNECTION_STATE_FORWARDING) iv_fd_set_handler_out(&(req->user_fd), got_user_write_space); if (ret == 0) { req->su_saw_fin = 1; iv_fd_set_handler_in(&(req->server_fd), NULL); return; } req->su_buf_length += ret; if (req->su_buf_length == sizeof(req->su_buf)) iv_fd_set_handler_in(&(req->server_fd), NULL); } static void got_server_write_space(void *_req) { struct connection *req = (struct connection *)_req; if (!req->us_buf_length && req->us_saw_fin != 1) { syslog(LOG_CRIT, "got_server_write_space: nothing to do"); abort(); } if (req->us_buf_length) { int ret; ret = iv_write(&(req->server_fd), req->us_buf, req->us_buf_length); if (ret <= 0) { if (ret == 0 || errno != EAGAIN) connection_kill(req); return; } if (req->us_buf_length == sizeof(req->us_buf) && !req->us_saw_fin) iv_fd_set_handler_in(&(req->user_fd), got_user_data); req->us_buf_length -= ret; memmove(req->us_buf, req->us_buf + ret, req->us_buf_length); } if (!req->us_buf_length) { iv_fd_set_handler_out(&(req->server_fd), NULL); switch (req->us_saw_fin) { case 0: break; case 1: req->us_saw_fin = 2; shutdown(req->server_fd.fd, SHUT_WR); if (req->su_saw_fin == 2) connection_kill(req); break; case 2: syslog(LOG_CRIT, "got_server_write_space: already relayed fin"); abort(); } } } static void got_server_error(void *_req) { struct connection *req = (struct connection *)_req; int retlen; int ret; retlen = sizeof(ret); if (getsockopt(req->server_fd.fd, SOL_SOCKET, SO_ERROR, &ret, &retlen) < 0) { syslog(LOG_CRIT, "got_server_error: error %d while getsockopt(SO_ERROR)", errno); abort(); } if (ret == 0) { syslog(LOG_CRIT, "got_server_error: no error?!"); abort(); } connection_kill(req); } /* state WAITING_CONN *******************************************************/ static void got_server_connect(void *_req) { struct connection *req = (struct connection *)_req; int retlen; int ret; retlen = sizeof(ret); if (getsockopt(req->server_fd.fd, SOL_SOCKET, SO_ERROR, &ret, &retlen) < 0) { syslog(LOG_CRIT, "got_server_connect: error %d while getsockopt(SO_ERROR)", errno); abort(); } if (ret) { if (ret != EINPROGRESS) connection_kill(req); return; } iv_fd_set_handler_in(&(req->server_fd), got_server_data); if (req->us_buf_length) iv_fd_set_handler_out(&(req->server_fd), got_server_write_space); else iv_fd_set_handler_out(&(req->server_fd), NULL); iv_fd_set_handler_err(&(req->server_fd), got_server_error); req->su_buf_length = 0; req->su_saw_fin = 0; req->state = CONNECTION_STATE_FORWARDING; } /* new connection ***********************************************************/ static void connection_new(struct skaidrus_instance *si, int fd, struct sockaddr_in *src) { struct sockaddr_in addr; struct in_tproxy itp; struct connection *req; socklen_t addrlen; int server_fd; int ret; addrlen = sizeof(addr); if (getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, &addr, &addrlen) < 0) { syslog(LOG_INFO, "connection_new: no SO_ORIGINAL_DST"); close(fd); return; } if (is_local_address(&addr)) { syslog(LOG_ALERT, "connection_new: originally for me, dropping"); close(fd); return; } server_fd = socket(AF_INET, SOCK_STREAM, 0); if (server_fd < 0) { syslog(LOG_ALERT, "connection_new: socket err %d", errno); close(fd); return; } if (bind_to_source_address(server_fd, &addr) < 0) { close(server_fd); close(fd); return; } itp.op = TPROXY_ASSIGN; itp.v.addr.faddr = src->sin_addr; itp.v.addr.fport = htons(0); if (setsockopt(server_fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) < 0) { syslog(LOG_ALERT, "connection_new: tproxy_assign err %d", errno); close(server_fd); close(fd); return; } itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if (setsockopt(server_fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) < 0) { syslog(LOG_ALERT, "connection_new: tproxy_flags err %d", errno); close(server_fd); close(fd); return; } req = malloc(sizeof(*req)); if (req == NULL) { syslog(LOG_CRIT, "connection_new: out of memory"); close(server_fd); close(fd); return; } list_add_tail(&(req->list), &(si->connections)); req->si = si; req->state = CONNECTION_STATE_WAITING_CONN; INIT_IV_FD(&(req->user_fd)); req->user_fd.fd = fd; req->user_fd.cookie = (void *)req; req->user_fd.handler_in = got_user_data; req->user_fd.handler_err = got_user_error; iv_register_fd(&(req->user_fd)); INIT_IV_FD(&(req->server_fd)); req->server_fd.fd = server_fd; req->server_fd.cookie = (void *)req; req->server_fd.handler_in = got_server_connect; req->server_fd.handler_out = got_server_connect; iv_register_fd(&(req->server_fd)); req->us_buf_length = 0; req->us_saw_fin = 0; ret = iv_connect(&(req->server_fd), (struct sockaddr *)&addr, sizeof(addr)); if (ret == 0 || errno != EINPROGRESS) got_server_connect((void *)req); } static void got_connection(void *_si) { struct skaidrus_instance *si = (struct skaidrus_instance *)_si; struct sockaddr_in addr; socklen_t addrlen; int yes; int fd; addrlen = sizeof(addr); fd = iv_accept(&(si->listen_fd), (struct sockaddr *)&addr, &addrlen); if (fd < 0) { if (errno != EAGAIN && errno != ECONNABORTED) { syslog(LOG_CRIT, "got_connection: error %d", errno); abort(); } return; } #if 0 printf("got connection from %s:%d\n", inet_ntoa(addr.sin_addr), ntohs(addr.sin_port)); #endif yes = 1; if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &yes, sizeof(yes)) < 0) { syslog(LOG_CRIT, "got_connection: error %d in " "setsockopt(SO_KEEPALIVE)", errno); abort(); } connection_new(si, fd, &addr); } int register_skaidrus_instance(struct skaidrus_instance *si) { int fd; int yes; fd = socket(AF_INET, SOCK_STREAM, 0); if (fd < 0) { syslog(LOG_CRIT, "make_listening_connection: socket() error %d", errno); return 0; } yes = 1; if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) { syslog(LOG_CRIT, "make_listening_socket: setsockopt() error " "%d", errno); return 0; } if (bind(fd, (struct sockaddr *)&(si->local_addr), sizeof(si->local_addr)) < 0) { syslog(LOG_CRIT, "make_listening_socket: bind() error %d", errno); return 0; } if (listen(fd, 100) < 0) { syslog(LOG_CRIT, "make_listening_socket: listen() error %d", errno); return 0; } INIT_IV_FD(&(si->listen_fd)); si->listen_fd.fd = fd; si->listen_fd.cookie = (void *)si; si->listen_fd.handler_in = got_connection; iv_register_fd(&(si->listen_fd)); INIT_LIST_HEAD(&(si->connections)); return 1; } void unregister_skaidrus_instance(struct skaidrus_instance *si) { struct list_head *lh; struct list_head *lh2; iv_unregister_fd(&(si->listen_fd)); close(si->listen_fd.fd); list_for_each_safe (lh, lh2, &(si->connections)) { struct connection *req; req = list_entry(lh, struct connection, list); connection_kill(req); } } cttproxy-2.6.18-2.0.6/examples/skaidrus/skaidrus.h0000664000175000017500000000142410166251042021056 0ustar hiddenhidden/* * skaidrus, an example transparent proxy application * Copyright (C) 2004, 2005 Lennert Buytenhek * * This program is free software; you can redistribute and/or modify it * under the terms of the GNU Lesser General Public License as published * by the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #ifndef __SKAIDRUS_H #define __SKAIDRUS_H #include #include struct skaidrus_instance { struct sockaddr_in local_addr; struct iv_fd listen_fd; struct list_head connections; }; int register_skaidrus_instance(struct skaidrus_instance *si); void unregister_skaidrus_instance(struct skaidrus_instance *si); #endif cttproxy-2.6.18-2.0.6/examples/skaidrus/skaidrus_private.h0000664000175000017500000000224510166257140022617 0ustar hiddenhidden/* * skaidrus, an example transparent proxy application * Copyright (C) 2004, 2005 Lennert Buytenhek * * This program is free software; you can redistribute and/or modify it * under the terms of the GNU Lesser General Public License as published * by the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. */ #ifndef __SKAIDRUS_PRIVATE_H #define __SKAIDRUS_PRIVATE_H struct connection { struct list_head list; struct skaidrus_instance *si; int state; struct iv_fd user_fd; struct iv_fd server_fd; int us_buf_length; int us_saw_fin; int su_buf_length; int su_saw_fin; unsigned char us_buf[4096]; unsigned char su_buf[4096]; }; /* After accepting the user connection and initiating the tproxy connect * to the backend server (for which we're faking the user's original source * address), we're now waiting for that tproxy connect to either succeed * or fail. */ #define CONNECTION_STATE_WAITING_CONN (0) /* The tproxy connect succeeded, we're now bidirectionally proxying the * user connection and the connection to the backend server. */ #define CONNECTION_STATE_FORWARDING (1) #endif cttproxy-2.6.18-2.0.6/examples/skaidrus/README0000664000175000017500000000053410166262221017742 0ustar hiddenhidden This is an example application for tproxy v2, called skaidrus. It listens on TCP port 9841, and all connections that are redirected to that port (using the '-j REDIRECT --to-ports 9841' iptables construct) are transproxied to their original destination. The code is covered under the LGPL so feel free to include this in your own application. cttproxy-2.6.18-2.0.6/examples/foreign-tcp-listen.c0000664000175000017500000000467610017606133021124 0ustar hiddenhidden#include #include #include #include #include #include #include #include /* an IP address bound to one of the local interfaces */ #define LOCAL_IP "1.2.3.4" /* the IP address to listen on (non-local) */ #define FOREIGN_IP "10.0.0.1" int sigint_received = 0; void sigint(int signo) { sigint_received = 1; } int main() { int sock; struct sockaddr_in sin; struct in_tproxy itp; char ch; int i; signal(SIGINT, sigint); sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == -1) { perror("socket"); return -1; } i = 1; if (setsockopt(sock, SOL_IP, SO_REUSEADDR, &i, sizeof(i)) == -1) { perror("SO_REUSEADDR"); return -1; } /* check tproxy version */ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ sin.sin_family = AF_INET; inet_aton(LOCAL_IP, &sin.sin_addr); sin.sin_port = htons(9999); if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("bind"); return -1; } /* assign foreign address */ itp.op = TPROXY_ASSIGN; inet_aton(FOREIGN_IP, (struct in_addr *) &itp.v.addr.faddr); itp.v.addr.fport = htons(2000); if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } /* set listen flag */ itp.op = TPROXY_FLAGS; itp.v.flags = ITP_LISTEN; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); return -1; } /* listen */ if (listen(sock, 255) == -1) { perror("listen"); return -1; } while (!sigint_received) { int len = sizeof(sin); int newsock; if ((newsock = accept(sock, (struct sockaddr *) &sin, &len)) == -1) { perror("accept"); return -1; } printf("accepted a connection: %08x:%04x\n", sin.sin_addr.s_addr, sin.sin_port); ch = 'A'; for (i = 0; i < 1000; i++) { write(newsock, &ch, 1); } close(newsock); } close(sock); return 0; } cttproxy-2.6.18-2.0.6/examples/foreign-udp-connect-alloc.c0000664000175000017500000000420010017606172022333 0ustar hiddenhidden#include #include #include #include #include #include #include /* an IP address bound to one of the local interfaces */ #define LOCAL_IP "1.2.3.4" /* the IP address to use as source address */ #define FOREIGN_IP "10.0.0.1" /* IP address to connect to */ #define DEST_IP "192.168.1.1" int main() { int sock; struct sockaddr_in sin; struct in_tproxy itp; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock == -1) { perror("socket"); return -1; } /* check tproxy version */ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ sin.sin_family = AF_INET; inet_aton(LOCAL_IP, &sin.sin_addr); sin.sin_port = htons(9999); if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("bind"); return -1; } /* assign foreign address, without specifying exact foreign port */ itp.op = TPROXY_ASSIGN; inet_aton(FOREIGN_IP, (struct in_addr *) &itp.v.addr.faddr); itp.v.addr.fport = htons(0); if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } /* allocate foreign port */ itp.op = TPROXY_ALLOC; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ALLOC)"); return -1; } /* set connect flag on socket */ itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); return -1; } /* connect */ inet_aton(DEST_IP, &sin.sin_addr); sin.sin_port = htons(10000); if (connect(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("connect"); return -1; } write(sock, "1234\n", 5); close(sock); return 0; } cttproxy-2.6.18-2.0.6/ChangeLog0000644000175000017500000005562610547470347015220 0ustar hiddenhidden2007-01-05 Krisztian Kovacs * version 2.0.6 released 2006-12-11 Krisztian Kovacs * kernel/patches/nat_delete.patch: fix SMP-unsafeness, we were using tuplehash entry returned by ip_conntrack_tuple_taken() without locking * kernel/iptable_tproxy.c (ip_tproxy_setsockopt_unassign): don't try to use time-wait sockets as full TCP sockets, may have caused panics in the past 2006-09-12 Krisztian Kovacs * version 2.0.5 released 2006-09-07 Krisztian Kovacs * kernel/iptable_tproxy.c (ip_tproxy_setup_nat_bidir): do not declare mr as static, as it's not protected by any locks and thus not SMP safe 2006-08-28 Krisztian Kovacs * kernel/iptable_tproxy.c (ip_tproxy_fn): don't check if the sockref has the TF_NAT_ONCE flag set before NAT-ting the new connection: the same TCP connection can be in NEW state more than once, and it's an error not to NAT all of them 2006-08-09 Krisztian Kovacs * kernel/iptable_tproxy.c (ip_tproxy_setsockopt_flags): fix typo leading to NAT reservations not being allocated for outbound connections 2006-04-12 Krisztian Kovacs * kernel/iptable_tproxy.c (ip_tproxy_print_sockref): don't grab the tproxy lock again * kernel/iptable_tproxy.c: fix compilation problem with newer gcc versions 2006-02-09 Krisztian Kovacs * version 2.0.4 released * kernel/iptable_tproxy.c (ip_tproxy_confirm, ip_tproxy_fn): fix related list corruption for broadcast packets 2005-11-02 Krisztian Kovacs * version 2.0.3 released * ugly SMP deadlock on Linux >= 2.6.11 fixed * updated for Linux 2.6.14 2005-07-22 Krisztian Kovacs * version 2.0.2 released * don't add non-UDP conntracks to the related list of the sockref; after all it's not strictly necessary for TCP and this way we can avoid conntrack leaks for sure * updated for Linux 2.6.12 2005-04-11 Krisztian Kovacs * version 2.0.1 released 2005-04-08 Krisztian Kovacs * kernel/iptable_tproxy.c (ip_tproxy_get_sk_proto): fix compilation problems * kernel/patches/210-net-protocol_callbacks.patch: call tproxy unhash callback from tcp_timewait_kill(), the callback functions now have a proto argument * kernel/iptable_tproxy.c (ip_tproxy_close): add proto argument and don't do a lookup * kernel/iptable_tproxy.c (init_or_cleanup, ip_tproxy_setup_nat_unidir): skb->nfct was reorganized in 2.6.10, keep up with changes 2005-03-31 Krisztian Kovacs * kernel/iptable_tproxy.c (init_or_cleanup): print copyright information when loading the module (fixes #5606) * kernel/iptable_tproxy.c (ip_tproxy_setsockopt_assign): return with -EEXIST instead of -EINVAL if a sockref is already assigned to the same local address * kernel/iptable_tproxy.c (ip_tproxy_get_sk_proto): check if sk->prot is valid before dereferencing 2005-01-10 Krisztian Kovacs * kernel/patch/nat_delete.patch: resync with conntrack and nat code changes in current linux kernels, __death_by_timeout() does not free conntrack entry unconditionally anymore 2004-11-16 Krisztian Kovacs * kernel/patch/220-net-ip_sockglue.patch: don't return IP_ORIGADDRS CMSG if entries in IPCB were not set 2004-10-06 Krisztian Kovacs * version 2.0.0 released * README: updated, added warning message about incompatibility with any former stable TProxy version 2004-10-04 Krisztian Kovacs * README: updated to cover the new setsockopt API * kernel/patch/220-net-ip_sockglue.patch: extend skb cb size 2004-09-30 Krisztian Kovacs * kernel/iptable_tproxy.c: bumped version number to 2.0.0 * kernel/*.{c,h}: added GPL and copyright headers * kernel/patch/*.patch: added #ifdefs around core patches, so that if TProxy is disabled in the kernel config no significant changes are made 2004-06-03 Krisztian Kovacs * development version 1.9.6 released 2004-05-28 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setup_nat_unidir): create a copy of cloned skbs before modifying the packet (fixes #4002) 2004-05-26 Krisztian Kovacs * kernel/iptable_tproxy.c (ip_tproxy_print_sockref): print number of socket which share the sockref 2004-05-18 Krisztian Kovacs * kernel/patch/nat_delete.patch: fix a deadlock in __destroy_conntrack() 2004-05-13 Krisztian Kovacs * development version 1.9.5 released * iptable_tproxy.c (sockref_listen_cmp): omit checking of remote endpoint if it is zero * iptable_tproxy.c (ip_tproxy_setsockopt_unassign): fix debug message * kernel/patch/271-netfilter-confirm_hook.patch: add description to the diff * iptable_tproxy.c (ip_tproxy_setsockopt_unassign): free NAT reservations only if unhashing the sockref is necessary * iptable_tproxy.c (ip_tproxy_nat_reserved_free): new function, checks if the sockref has any NAT reservations allocated and frees them * iptable_tproxy.c (ip_tproxy_setsockopt_unassign): handle mark-only sockrefs separately, based on the socket count: decrease socket counter, and unhash if there are no sockets left * iptable_tproxy.c (ip_tproxy_setsockopt_assign): increase socket count if sharing the sockref * iptable_tproxy.c: rewrap long lines 2004-05-03 Krisztian Kovacs * development version 1.9.4 released * iptable_tproxy.c (init_or_cleanup): initialize confirm and destroy hooks * patches/*: created an exported callback function pointer to make it possible to hook conntrack confirmation * iptable_tproxy.c (ip_tproxy_fn): don't add the conntrack entry to the related list of the matching sockref, now this is done after the conntrack entry has been confirmed * iptable_tproxy.c (ip_tproxy_setup_nat_bidir): flags argument added * iptable_tproxy.c (ip_tproxy_setup_nat): the last argument is no more a boolean, but a bitmask field; TN_BIDIR (same as the old bidir argument) and TN_STOREREF (store a reference to the sockref in the conntrack entry if NAT setup was successful) are the possible flags * iptable_tproxy.c (ip_tproxy_conntrack_destroyed): new function, called when a conntrack entry is destroyed; checks if the conntrack has a reference to a sockref, and unrefs if necessary * iptable_tproxy.c (ip_tproxy_confirmed): new function, adds the confirmed conntrack to the related list of the sockref (tproxy_fn now stores a reference to the sockref in the conntrack entry instead of adding the conntrack to the related list) 2004-04-14 Krisztian Kovacs * ip_tproxy.h: renamed struct _in_tproxy_addr to in_tproxy_addr 2004-04-09 Krisztian Kovacs * iptable_tproxy.c (init_or_cleanup): removed unnecessary clean_preops label * iptable_tproxy.c (ip_tproxy_sockref_table_free): use macros for traversing hash chains * iptable_tproxy.c (ip_tproxy_sockref_find_foreign): use macros for list traversal * iptable_tproxy.c (ip_tproxy_sockref_find_local): use macros for list traversal * iptable_tproxy.c (ip_tproxy_kill_related): use macros for list traversal, make safety checks in debug version only * iptable_tproxy.c (ip_tproxy_relatedct_add): use macros for list traversal, changed order of checking the IPS_TPROXY_RELATED flag and checking if it's already present in the same list 2004-04-07 Krisztian Kovacs * development version 1.9.3 released * mkdiff.sh: updated to handle split patchtree 2004-04-05 Krisztian Kovacs * patch/04-netfilter-ip_nat_setup_info_flags.patch: remove unused IP_NAT_TPROXY flag * patch/0?-*.patch: split tproxy.diff into multiple parts, and add some comment to each of them * iptable_tproxy.c (ip_tproxy_kill_related): call the conntrack entry's timeout function instead of death_by_timeout() * patch/nat_reserved.patch: added const qualifiers to new arguments of ip_nat_used_tuple() 2004-03-30 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setsockopt_flags): do allocation of NAT reservation after successfully checking and setting the new flags * iptable_tproxy.c (init_or_cleanup): register Netfilter hooks after registering the table, the kernel may call ipt_do_table() on an uninitialized table otherwise * patch/nat_reserved.patch: the NAT reservation code uses a new hash function, and now destroys the "nat_reserved" slab cache at module unload * patch/nat_delete.patch: adapted to the tcp-window-tracking code, did not work well with original TCP conntrack code 2004-03-04 Krisztian Kovacs * tproxy.diff: fixed include/linux/net.h, now compiles on non-SMP configs 2004-02-27 Krisztian Kovacs * development version 1.9.2 released * ip_tproxy.h: added definition of IP_RECVORIGADDRS, IP_ORIGADDRS and struct in_origaddrs (only for userspace) * tests/*.c: updated to use setsockopt() instead of getsockopt() for version compatibility detection 2004-02-26 Krisztian Kovacs * nat_reserved.patch: added * nat_reserved_tproxy_exports.patch: added * nat_delete.patch: added * ipt_TPROXY.c: ported to Linux 2.6 * ipt_tproxy.c: ported to Linux 2.6 * iptable_tproxy.c: ported to Linux 2.6 * tproxy.diff: removed unused code, changed value of IP_RECVORIGADDRS and IP_ORIGADDRS (these are the same now) (causes binary incompatibility), ported to Linux 2.6 * iptable_tproxy.c: made NAT reservation support optional, now should compile without NAT reservation support in the kernel * ip_tproxy.h: changed value of IP_TPROXY (causes binary incompatibility) 2004-02-25 Krisztian Kovacs * ipt_tproxy.c (fini): decrease reference count only for kernels <= 2.4.24 * ipt_tproxy.c (init): decrease reference count only for kernels <= 2.4.24 * iptable_tproxy.c (ip_tproxy_setsockopt_version): don't check for CAP_NET_ADMIN * iptable_tproxy.c (ip_tproxy_getsockopt_version): don't check for CAP_NET_ADMIN 2004-02-23 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_getsockopt_query): don't check for CAP_NET_ADMIN * iptable_tproxy.c (ip_tproxy_getsockopt_flags): don't check for CAP_NET_ADMIN * iptable_tproxy.c (ip_tproxy_setsockopt): add ip_tproxy_setsockopt_version(), which checks if TProxy is compatible with the specified version. getsockopt(TPROXY_VERSION) now does not perform compatibility checks, only returns the version number. 2004-01-29 Krisztian Kovacs * development version 1.9.1 released * iptable_tproxy.c (ip_tproxy_setsockopt_assign): fix a few typos in the comments * iptable_tproxy.c (ip_tproxy_sockref_uniq): fix typos in the comments 2004-01-26 Krisztian Kovacs * iptable_tproxy.c: corrected duplicate macro problems, version checking works * iptable_tproxy.c (ip_tproxy_getsockopt_version): fixed typo in function name * iptable_tproxy.c (ip_tproxy_getsockopt): fixed typo, len is a pointer * tests/*: rewrote examples to use the new interface 2004-01-23 Krisztian Kovacs * iptable_tproxy.c, ip_tproxy.h: implemented new userspace interface 2004-01-16 Krisztian Kovacs * tproxy.diff: removed ip_nat_update_hashes() from patch, refreshed to apply clean on a NAT reservation patched kernel * iptable_tproxy.c (ip_tproxy_setsockopt_assign): allow assigning multiple mark-only sockrefs on a single local address * iptable_tproxy.c (ip_tproxy_sockref_uniq): fix setting of TF_NAT_PEER flag if peer address is known 2004-01-15 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setsockopt_assign): do not set connect only flag if clashing sockref is mark only 2004-01-13 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_getsockopt): added a few debug messages * iptable_tproxy.c (ip_tproxy_setsockopt_connect): don't do anything in case of mark only sockrefs * iptable_tproxy.c (ip_tproxy_setsockopt_alloc): don't do anything in case of mark only sockrefs * iptable_tproxy.c (ip_tproxy_setsockopt_flags): don't set anything in case of mark only sockrefs * iptable_tproxy.c (ip_tproxy_setsockopt_assign): set connect only only if the sockref with the same foreign address does not have its remote endpoint specified * iptable_tproxy.c (ip_tproxy_sockref_uniq): change arguments, now it accepts a sockref, moved NAT reservation and foreign port rehashing inside the function (so it needs ip_tproxy_lock write locked) * iptable_tproxy.c (ip_tproxy_setup_nat_bidir): set IP_NAT_RANGE_USE_RESERVED flag for every sockref where TF_NAT_RESERVED flag is true 2004-01-09 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_nat_reserve): added ntohs() to port display correct port numbers in debug message * iptable_tproxy.c (ip_tproxy_setsockopt_assign): added a few useful debug messages * iptable_tproxy.c (ip_tproxy_setsockopt_assign): do not allocate NAT reservation if exact foreign port is not given * iptable_tproxy.c (ip_tproxy_setsockopt_connect): new debug message to display new raddr:rport pair * iptable_tproxy.c (ip_tproxy_sockopts): added IP_TPROXY_CONNECT to the range of registered sockopts 2004-01-08 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setsockopt_flags): clear user-settable flags before setting new bits * iptable_tproxy.c (ip_tproxy_setsockopt): split ip_tproxy_setsockopt(), now every operation has its own function called by ip_tproxy_setsockopt() 2004-01-07 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setsockopt): clear TF_NAT_RESERVED and TF_NAT_PEER flags when unassigning socket * iptable_tproxy.c (ip_tproxy_setsockopt): fix setting of sr->flags in IP_TPROXY_FLAGS handler, added a debug message for invalid combinations of flags * iptable_tproxy.c (ip_tproxy_fn): drop packet if ip_tproxy_setup_nat() fails after the tproxy table lookup 2003-12-18 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setsockopt): new NAT reservation handling, reservations are now registered at ASSIGN, FLAGS, or CONNECT, based on SO_REUSEADDR and the type of the sockref * iptable_tproxy.c (ip_tproxy_setsockopt): implemented new IP_TPROXY_CONNECT sockopt, semantics for setting the ITP_ESTABLISHED flag has changed, instead of connect()-ing before setting the flag the sockref has to be explicitly connected using IP_TPROXY_CONNECT * ip_tproxy.h: added new sockopt, to be able to set remote address explicitly (IP_TPROXY_CONNECT) 2003-12-08 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setup_nat_bidir): removed call to ip_nat_update_hashes(), kernel > 2.4.22 does not need it 2003-12-05 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_setsockopt): ASSIGN locking fix, avoid a possible race 2003-12-03 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_seq_*): cleaned up, _start does not allocate memory now * iptable_tproxy.c (ip_tproxy_seq_*): proc interface rewritten to use seq_file * iptable_tproxy.c (ip_tproxy_setup_nat_bidir): allow use of reserved NAT manips * iptable_tproxy.c (ip_tproxy_sockref_uniq): byte order conversion when reserving manip added * iptable_tproxy.c (ip_tproxy_setsockopt): free NAT reservation at UNASSIGN * iptable_tproxy.c (ip_tproxy_sockopts): register new IP_TPROXY_ALLOC sockopt * tproxy.diff: sysctl_local_port_range is exported now * tests: updated Makefile, added foreign-udp-connect-alloc.c 2003-12-02 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_sockref_uniq): if a unique entry is found, reserve the port in NAT * iptable_tproxy.c (ip_tproxy_setsockopt): added IP_TPROXY_ALLOC socket option, which causes immediate allocation (and reservation in the NAT core) of foreign port * iptable_tproxy.c (ip_tproxy_setsockopt): foreign port is not allocated automatically if the TF_LISTEN flag is set on a sockref 2003-11-25 Krisztian Kovacs * iptable_tproxy.c (ip_tproxy_rehash_fport): changed list_prepend() to list_append(), this way the _oldest_ matching entry is found first * iptable_tproxy.c (ip_tproxy_hash): changed list_prepend() to list_append(), this way the _oldest_ matching entry is found first * iptable_tproxy.c (ip_tproxy_fn): drop packet and do not set TF_NAT_APPLIED when applying the NAT mapping failed * iptable_tproxy.c (ip_tproxy_setup_nat): set IPS_TPROXY only if applying the mapping succeeded * iptable_tproxy.c (ip_tproxy_fn): drops the packet if skb_copy_bits() fails 2003-11-21 Krisztian Kovacs * changed setting and clearing of IPS_TPROXY_RELATED to use atomic bit operations * ip_tproxy_setup_nat_bidir(): fixed a possible deadlock (between ip_nat_lock and ip_tproxy_lock) * ip_tproxy_print_sockref(): changed format of the proc entry lines 2003-11-13 Krisztian Kovacs * ip_tproxy_setsockopt(): readded ip_tproxy_sockref_uniq() to make it possible to autobind a foreign port on a "listening" sockref * ip_tproxy_find_local(): changed raddr and rport arguments to u32 and u16 * ip_tproxy_save_orig_addrs(): uses skb_copy_bits() to get original addresses and ports 2003-10-28 Krisztian Kovacs * version 1.1.3 released 2003-10-27 Krisztian Kovacs * updated README, when installing the iptables patch, one has to make .tproxy-test executable * added a few comments to iptable_tproxy.c * introduced new conntrack entry flag IPS_TPROXY_RELATED, it means that the conntrack entry was already added to the related list of a sockref * changed sockref's relatedlock to spinlock instead of rwlock, as it was locked for writing only anyway * ip_tproxy_fn(): fixed a possible conntrack entry leak, add conntrack entry to the related list only if it's not unidirectionally mapped, since it would not get dereferenced by ip_nat_setup_unidir() * ip_tproxy_sockref_table_free(): fixed a possible conntrack entry leak, now related connections are dereferenced * ip_tproxy_fn(): fixed handling of TF_NAT_ONCE 2003-10-20 Krisztian Kovacs * changed log messages: every message begins with 'IP_TPROXY' now * development version 1.1.2 released 2003-10-17 Krisztian Kovacs * fixed while loop in ip_tproxy_relatedct_add(), caused system hangs * changed ip_tproxy_kill_related() to ignore cmp function if NULL, thus cmp functions always returning true are not needed * fix UDP and TCP connect conntrack entry deletion: all related entries are deleted 2003-10-10 Krisztian Kovacs * development version 1.1.1 released 2003-10-09 Krisztian Kovacs * added check to ip_tproxy_relatedct_add() to avoid adding the same conntrack to the list more than once * added assigned_to field to sockref, contains pointer to socket to which the sockref was assigned (solves problem with TCP listen and mark-only sockets) 2003-10-08 Krisztian Kovacs * removed nf_sock_release() facility, added two ugly callbacks instead (was necessary because inet_release() was not the right place to unassign the socket) 2003-09-29 Krisztian Kovacs * fixed foreign port rehashing: it did not work if TF_NAT_ONCE was not set * fixed assignment of addresses with unspecified foreign port 2003-09-23 Krisztian Kovacs * added and fixed debug messages 2003-09-22 Krisztian Kovacs * fixed UNASSIGN, mark-only sockrefs were not freed * added a new column to the proc interface, containing the number of related conntrack entries * rewrote header check of ip_tproxy_fn() to be compatible with nonlinear skbs 2003-09-18 Krisztian Kovacs * when rehashing sockref, get new foreign port from conntrack tuple instead of last nat manip entry 2003-09-17 Krisztian Kovacs * faster conntrack deletion, related connection tracking entries are collected in sockrefs, deletion is based on that list * added rehashing of sockref entries after source port assignment (fixes problems related to removing own port allocation mechanism) * added mkdiff.sh, which generates all-in-one diff 2003-09-10 Krisztian Kovacs * removed source port allocation, source ports are now allocated by ip_nat_setup_info(), based on the local source port 2003-09-09 Krisztian Kovacs * removed flags entry from ip_conntrack, added a IPS_TPROXY instead 2003-09-08 Krisztian Kovacs * added proc interface for tproxy hash table * added tv_hashed field to sockrefs, which contains the timeval when the entry was added to the hash 2003-08-10 Balazs Scheidler * released version #23 * do not add NAT hash entries when ip_nat_setup_info() returns failure, fixes a possible infinite loop in interrupt context 2003-08-06 Balazs Scheidler * released version #22 * fixed a port allocation problem which sometimes caused EAGAINs 2003-08-05 Balazs Scheidler * released version #21 * fixed unresolved external reference problem 2003-08-01 Balazs Scheidler * released version #20 * fixed port allocation race (the famous IP_TPROXY: socket already assigned problem) * fixed tproxy entry deletion problem 2003-07-26 Balazs Scheidler * released version #18 * fixed a NAT setup bug, which sometimes caused problems with retransmitted frames (nat_info->initialized was not properly checked) * fixed a close() race which caused tproxy mapping errors (the entry from the TCP hash was removed first, thus the userspace proxy might grab a port which was still used in the tproxy hash) * removed ip_tproxy_kill_conntracks() call for TCP connections as it was _very_ slow, a better solution might be needed 2003-07-09 Balazs Scheidler * changed tproxy hook priorities to run _after_ mangle * ip_nat_tftp.c and ip_nat_amanda.c were added in 2.4.21 and previous release missed the ip_nat_setup_info() patch in these files 2003-06-20 Balazs Scheidler * updated to kernel 2.4.21 (use IPS_CONFIRMED_BIT instead of the list pointers to indiciate that our conntrack entry is already in the hash) 2003-05-26 bazsi * updated kernel patch to version #14, which removes colliding conntrack entries * updated iptables patch to use IPTABLES_VERSION instead of NETFILTER_VERSION (to make it compile on 1.2.7a or later) cttproxy-2.6.18-2.0.6/patch_tree/0002775000175000017500000000000010533330214015531 5ustar hiddenhiddencttproxy-2.6.18-2.0.6/patch_tree/02-tproxy.patch0000644000175000017500000024446310547474234020367 0ustar hiddenhiddendiff --git a/include/linux/in.h b/include/linux/in.h index 94f557f..37d8c5d 100644 --- a/include/linux/in.h +++ b/include/linux/in.h @@ -77,6 +77,10 @@ #define IP_PASSSEC 18 /* BSD compatibility */ #define IP_RECVRETOPTS IP_RETOPTS +/* TProxy original addresses */ +#define IP_ORIGADDRS 11273 +#define IP_RECVORIGADDRS IP_ORIGADDRS + /* IP_MTU_DISCOVER values */ #define IP_PMTUDISC_DONT 0 /* Never send DF frames */ #define IP_PMTUDISC_WANT 1 /* Use per route hints */ @@ -173,6 +177,13 @@ struct in_pktinfo struct in_addr ipi_addr; }; +struct in_origaddrs { + struct in_addr ioa_srcaddr; + struct in_addr ioa_dstaddr; + unsigned short int ioa_srcport; + unsigned short int ioa_dstport; +}; + /* Structure describing an Internet (IP) socket address. */ #define __SOCK_SIZE__ 16 /* sizeof(struct sockaddr) */ struct sockaddr_in { diff --git a/include/linux/net.h b/include/linux/net.h index b20c53c..0f8aa16 100644 --- a/include/linux/net.h +++ b/include/linux/net.h @@ -208,6 +208,11 @@ extern int kernel_recvmsg(struct struct kvec *vec, size_t num, size_t len, int flags); +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +extern void (*ip_tproxy_tcp_unhashed)(struct sock *, int proto); +extern void (*ip_tproxy_udp_unhashed)(struct sock *, int proto); +#endif + #ifndef CONFIG_SMP #define SOCKOPS_WRAPPED(name) name #define SOCKOPS_WRAP(name, fam) diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h index d2e4bd7..81392e5 100644 --- a/include/linux/netfilter/nf_conntrack_common.h +++ b/include/linux/netfilter/nf_conntrack_common.h @@ -73,6 +73,15 @@ enum ip_conntrack_status { /* Connection has fixed timeout. */ IPS_FIXED_TIMEOUT_BIT = 10, IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT), + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + /* Connection is tproxy-ed */ + IPS_TPROXY_BIT = 11, + IPS_TPROXY = (1 << IPS_TPROXY_BIT), + + IPS_TPROXY_RELATED_BIT = 12, + IPS_TPROXY_RELATED = (1 << IPS_TPROXY_RELATED_BIT), +#endif }; /* Connection tracking event bits */ diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h index 440e444..4369150 100644 --- a/include/linux/netfilter_ipv4/ip_conntrack.h +++ b/include/linux/netfilter_ipv4/ip_conntrack.h @@ -114,6 +114,14 @@ #if defined(CONFIG_IP_NF_TARGET_MASQUERA int masq_index; #endif } nat; + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + union _tproxy_data { + void *sockref; + struct list_head related; + } tproxy; +#endif /* CONFIG_IP_NF_TPROXY */ + #endif /* CONFIG_IP_NF_NAT_NEEDED */ #if defined(CONFIG_IP_NF_CONNTRACK_MARK) @@ -249,6 +257,11 @@ #ifdef CONFIG_IP_NF_NAT_NRES extern void (*ip_conntrack_expect_destroyed)(struct ip_conntrack_expect *exp); #endif +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +/* Call me when a conntrack is confirmed. */ +extern void (*ip_conntrack_confirmed)(struct ip_conntrack *conntrack); +#endif + /* Fake conntrack entry for untracked connections */ extern struct ip_conntrack ip_conntrack_untracked; diff --git a/include/linux/netfilter_ipv4/ip_nat.h b/include/linux/netfilter_ipv4/ip_nat.h index 0337a85..7f16465 100644 --- a/include/linux/netfilter_ipv4/ip_nat.h +++ b/include/linux/netfilter_ipv4/ip_nat.h @@ -16,6 +16,7 @@ #define HOOK2MANIP(hooknum) ((hooknum) ! #define IP_NAT_RANGE_MAP_IPS 1 #define IP_NAT_RANGE_PROTO_SPECIFIED 2 +#define IP_NAT_RANGE_BYPASS_HELPERS 4 #ifdef CONFIG_IP_NF_NAT_NRES #define IP_NAT_RANGE_USE_RESERVED 8 @@ -55,6 +56,9 @@ struct ip_nat_multi_range_compat #ifdef __KERNEL__ #include +/* call this to signal dependency on the NAT hooks */ +extern void need_nat_hooks(void); + /* Protects NAT hash tables, and NAT-private part of conntracks. */ extern rwlock_t ip_nat_lock; diff --git a/include/linux/netfilter_ipv4/ip_nat_core.h b/include/linux/netfilter_ipv4/ip_nat_core.h index 30db23f..a2120ed 100644 --- a/include/linux/netfilter_ipv4/ip_nat_core.h +++ b/include/linux/netfilter_ipv4/ip_nat_core.h @@ -15,4 +15,13 @@ extern int ip_nat_icmp_reply_translation struct ip_conntrack *ct, enum ip_nat_manip_type manip, enum ip_conntrack_dir dir); + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +extern int ip_nat_manip_pkt(u_int16_t proto, + struct sk_buff **pskb, + unsigned int iphdroff, + const struct ip_conntrack_tuple *target, + enum ip_nat_manip_type maniptype); +#endif + #endif /* _IP_NAT_CORE_H */ diff --git a/include/linux/netfilter_ipv4/ip_tproxy.h b/include/linux/netfilter_ipv4/ip_tproxy.h new file mode 100644 index 0000000..49f6fd8 --- /dev/null +++ b/include/linux/netfilter_ipv4/ip_tproxy.h @@ -0,0 +1,78 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2002-2004 BalaBit IT Ltd. + * Author: Balázs Scheidler + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#ifndef _IP_TPROXY_H +#define _IP_TPROXY_H + +#ifdef __KERNEL__ +#include +#include +#else +#include +#ifndef IP_RECVORIGADDRS +#define IP_RECVORIGADDRS 11273 +#define IP_ORIGADDRS IP_RECVORIGADDRS +struct in_origaddrs { + struct in_addr ioa_srcaddr; + struct in_addr ioa_dstaddr; + unsigned short int ioa_srcport; + unsigned short int ioa_dstport; +}; +#endif +#endif + +/* + * used in setsockopt(SOL_IP, IP_TPROXY) should not collide + * with values in + */ + +#define IP_TPROXY 11274 + +/* tproxy operations */ +enum { + TPROXY_VERSION = 0, + TPROXY_ASSIGN, + TPROXY_UNASSIGN, + TPROXY_QUERY, + TPROXY_FLAGS, + TPROXY_ALLOC, + TPROXY_CONNECT +}; + +/* bitfields in IP_TPROXY_FLAGS */ +#define ITP_CONNECT 0x00000001 +#define ITP_LISTEN 0x00000002 +#define ITP_ESTABLISHED 0x00000004 + +#define ITP_ONCE 0x00010000 +#define ITP_MARK 0x00020000 +#define ITP_APPLIED 0x00040000 +#define ITP_UNIDIR 0x00080000 + +struct in_tproxy_addr{ + struct in_addr faddr; + u_int16_t fport; +}; + +struct in_tproxy { + /* fixed part, should not change between versions */ + u_int32_t op; + /* extensible part */ + union _in_args { + u_int32_t version; + struct in_tproxy_addr addr; + u_int32_t flags; + } v; +}; + +#endif + diff --git a/include/linux/netfilter_ipv4/ipt_TPROXY.h b/include/linux/netfilter_ipv4/ipt_TPROXY.h new file mode 100644 index 0000000..81043d0 --- /dev/null +++ b/include/linux/netfilter_ipv4/ipt_TPROXY.h @@ -0,0 +1,28 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2002-2004 BalaBit IT Ltd. + * Author: Balázs Scheidler + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#ifndef _IPT_TPROXY_H_target +#define _IPT_TPROXY_H_target + +struct ipt_tproxy_target_info { + u_int16_t lport; + u_int32_t laddr; +}; + +struct ipt_tproxy_user_info { + int changed; + u_int16_t lport; + u_int32_t laddr; +}; + +#endif /*_IPT_TPROXY_H_target*/ + diff --git a/include/net/ip.h b/include/net/ip.h index 98f9084..9dd33f5 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -41,6 +41,17 @@ #define IPSKB_XFRM_TUNNEL_SIZE 2 #define IPSKB_XFRM_TRANSFORMED 4 #define IPSKB_FRAG_COMPLETE 8 #define IPSKB_REROUTED 16 + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + + /* these fields unfortunately do not fit into the 40 bytes of + * allocated cb space... we have to allocate at least 48 bytes */ + + u32 orig_srcaddr; + u32 orig_dstaddr; + u16 orig_srcport; + u16 orig_dstport; +#endif }; struct ipcm_cookie diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index 95fac55..585b319 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -61,6 +61,10 @@ void inet_bind_hash(struct sock *sk, str inet_csk(sk)->icsk_bind_hash = tb; } +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +void (*ip_tproxy_tcp_unhashed)(struct sock *sk, int proto) = NULL; +#endif + /* * Get rid of any references to a local port held by the given sock. */ @@ -70,6 +74,13 @@ static void __inet_put_port(struct inet_ struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash]; struct inet_bind_bucket *tb; +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + /* ugly tproxy unassign hook + * FIXME: now DCCP also uses this code */ + if (ip_tproxy_tcp_unhashed) + ip_tproxy_tcp_unhashed(sk, IPPROTO_TCP); +#endif + spin_lock(&head->lock); tb = inet_csk(sk)->icsk_bind_hash; __sk_del_bind_node(sk); diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index cdd8053..c2d1bfc 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -30,6 +30,13 @@ void __inet_twsk_kill(struct inet_timewa sk_node_init(&tw->tw_node); write_unlock(&ehead->lock); +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + /* ugly tproxy unassign hook + * FIXME: now DCCP also uses this code */ + if (ip_tproxy_tcp_unhashed) + ip_tproxy_tcp_unhashed((struct sock *)tw, IPPROTO_TCP); +#endif + /* Disassociate with bind bucket. */ bhead = &hashinfo->bhash[inet_bhashfn(tw->tw_num, hashinfo->bhash_size)]; spin_lock(&bhead->lock); diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 2d05c41..5f95815 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -50,6 +50,7 @@ #define IP_CMSG_TOS 4 #define IP_CMSG_RECVOPTS 8 #define IP_CMSG_RETOPTS 16 #define IP_CMSG_PASSSEC 32 +#define IP_CMSG_ORIGADDRS 64 /* * SOL_IP control messages. @@ -127,6 +128,25 @@ static void ip_cmsg_recv_security(struct security_release_secctx(secdata, seclen); } +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + +void ip_cmsg_recv_origaddrs(struct msghdr *msg, struct sk_buff *skb) +{ + struct in_origaddrs ioa; + + /* don't return original addresses if they were not set by tproxy*/ + if (IPCB(skb)->orig_dstaddr == 0 || IPCB(skb)->orig_dstport == 0) + return; + + ioa.ioa_srcaddr.s_addr = IPCB(skb)->orig_srcaddr; + ioa.ioa_srcport = IPCB(skb)->orig_srcport; + ioa.ioa_dstaddr.s_addr = IPCB(skb)->orig_dstaddr; + ioa.ioa_dstport = IPCB(skb)->orig_dstport; + + put_cmsg(msg, SOL_IP, IP_ORIGADDRS, sizeof(ioa), &ioa); +} + +#endif void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb) { @@ -161,6 +181,13 @@ void ip_cmsg_recv(struct msghdr *msg, st if (flags & 1) ip_cmsg_recv_security(msg, skb); + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + if ((flags>>=1) == 0) + return; + if (flags & 1) + ip_cmsg_recv_origaddrs(msg, skb); +#endif } int ip_cmsg_send(struct msghdr *msg, struct ipcm_cookie *ipc) @@ -416,6 +443,9 @@ static int do_ip_setsockopt(struct sock (1<= sizeof(int)) { @@ -506,6 +536,14 @@ #endif else inet->cmsg_flags &= ~IP_CMSG_PASSSEC; break; +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + case IP_RECVORIGADDRS: + if (val) + inet->cmsg_flags |= IP_CMSG_ORIGADDRS; + else + inet->cmsg_flags &= ~IP_CMSG_ORIGADDRS; + break; +#endif case IP_TOS: /* This sets both TOS and Precedence */ if (sk->sk_type == SOCK_STREAM) { val &= ~3; @@ -1014,6 +1052,11 @@ #endif case IP_PASSSEC: val = (inet->cmsg_flags & IP_CMSG_PASSSEC) != 0; break; +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + case IP_RECVORIGADDRS: + val = (inet->cmsg_flags & IP_CMSG_ORIGADDRS) != 0; + break; +#endif case IP_TOS: val = inet->tos; break; diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index ac751c7..5e9ed04 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -215,6 +215,33 @@ config IP_NF_SIP To compile it as a module, choose M here. If unsure, say Y. +config IP_NF_TPROXY + tristate "Transparent proxying" + depends on IP_NF_NAT + help + Transparent proxying. For more information see + http://www.balabit.com/downloads/tproxy. + + To compile it as a module, choose M here. If unsure, say Y. + +config IP_NF_MATCH_TPROXY + tristate "tproxy match support" + depends on IP_NF_TPROXY + help + Match transparently proxied connections. + + To compile it as a module, choose M here. If unsure, say N. + +config IP_NF_TARGET_TPROXY + tristate "TPROXY target support" + depends on IP_NF_TPROXY + help + This option adds a `TPROXY' target, which is almost the same as REDIRECT. + It can only be used in the tproxy table, and is useful to redirect + traffic to a transparent proxy. + + To compile it as a module, choose M here. If unsure, say N. + config IP_NF_QUEUE tristate "IP Userspace queueing via NETLINK (OBSOLETE)" help diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile index 3ded4a3..729ecf2 100644 --- a/net/ipv4/netfilter/Makefile +++ b/net/ipv4/netfilter/Makefile @@ -51,6 +51,7 @@ obj-$(CONFIG_IP_NF_FILTER) += iptable_fi obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o +obj-$(CONFIG_IP_NF_TPROXY) += iptable_tproxy.o # matches obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o @@ -63,6 +64,7 @@ obj-$(CONFIG_IP_NF_MATCH_DSCP) += ipt_ds obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o +obj-$(CONFIG_IP_NF_MATCH_TPROXY) += ipt_tproxy.o # targets obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o @@ -79,6 +81,7 @@ obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_U obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o +obj-$(CONFIG_IP_NF_TARGET_TPROXY) += ipt_TPROXY.o # generic ARP tables obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c index f9349bf..b96427b 100644 --- a/net/ipv4/netfilter/ip_conntrack_core.c +++ b/net/ipv4/netfilter/ip_conntrack_core.c @@ -78,6 +78,9 @@ struct ip_conntrack ip_conntrack_untrack unsigned int ip_ct_log_invalid; static LIST_HEAD(unconfirmed); static int ip_conntrack_vmalloc; +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +void (*ip_conntrack_confirmed)(struct ip_conntrack *conntrack) = NULL; +#endif static unsigned int ip_conntrack_next_id; static unsigned int ip_conntrack_expect_next_id; @@ -500,6 +503,13 @@ __ip_conntrack_confirm(struct sk_buff ** set_bit(IPS_CONFIRMED_BIT, &ct->status); CONNTRACK_STAT_INC(insert); write_unlock_bh(&ip_conntrack_lock); + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + /* Call confirmed hook */ + if (ip_conntrack_confirmed) + ip_conntrack_confirmed(ct); +#endif + if (ct->helper) ip_conntrack_event_cache(IPCT_HELPER, *pskb); #ifdef CONFIG_IP_NF_NAT_NEEDED diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c index c050399..260c281 100644 --- a/net/ipv4/netfilter/ip_conntrack_standalone.c +++ b/net/ipv4/netfilter/ip_conntrack_standalone.c @@ -918,6 +918,9 @@ EXPORT_SYMBOL(ip_ct_get_tuple); EXPORT_SYMBOL(invert_tuplepr); EXPORT_SYMBOL(ip_conntrack_alter_reply); EXPORT_SYMBOL(ip_conntrack_destroyed); +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +EXPORT_SYMBOL_GPL(ip_conntrack_confirmed); +#endif EXPORT_SYMBOL(need_conntrack); EXPORT_SYMBOL(ip_conntrack_helper_register); EXPORT_SYMBOL(ip_conntrack_helper_unregister); diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c index d40df7e..262f36e 100644 --- a/net/ipv4/netfilter/ip_nat_core.c +++ b/net/ipv4/netfilter/ip_nat_core.c @@ -43,6 +43,7 @@ #define DEBUGP(format, args...) #endif DEFINE_RWLOCK(ip_nat_lock); +EXPORT_SYMBOL_GPL(ip_nat_lock); /* Calculated at init based on memory size */ static unsigned int ip_nat_htable_size; @@ -738,8 +739,8 @@ ip_nat_setup_info(struct ip_conntrack *c EXPORT_SYMBOL(ip_nat_setup_info); /* Returns true if succeeded. */ -static int -manip_pkt(u_int16_t proto, +int +ip_nat_manip_pkt(u_int16_t proto, struct sk_buff **pskb, unsigned int iphdroff, const struct ip_conntrack_tuple *target, @@ -774,6 +775,7 @@ manip_pkt(u_int16_t proto, } return 1; } +EXPORT_SYMBOL_GPL(ip_nat_manip_pkt); /* Do packet manipulations according to ip_nat_setup_info. */ unsigned int ip_nat_packet(struct ip_conntrack *ct, @@ -801,7 +803,7 @@ unsigned int ip_nat_packet(struct ip_con /* We are aiming to look like inverse of other direction. */ invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); - if (!manip_pkt(target.dst.protonum, pskb, 0, &target, mtype)) + if (!ip_nat_manip_pkt(target.dst.protonum, pskb, 0, &target, mtype)) return NF_DROP; } return NF_ACCEPT; @@ -866,7 +868,7 @@ int ip_nat_icmp_reply_translation(struct pass all hooks (locally-generated ICMP). Consider incoming packet: PREROUTING (DST manip), routing produces ICMP, goes through POSTROUTING (which must correct the DST manip). */ - if (!manip_pkt(inside->ip.protocol, pskb, + if (!ip_nat_manip_pkt(inside->ip.protocol, pskb, (*pskb)->nh.iph->ihl*4 + sizeof(inside->icmp), &ct->tuplehash[!dir].tuple, @@ -893,7 +895,7 @@ int ip_nat_icmp_reply_translation(struct if (ct->status & statusbit) { invert_tuplepr(&target, &ct->tuplehash[!dir].tuple); - if (!manip_pkt(0, pskb, 0, &target, manip)) + if (!ip_nat_manip_pkt(0, pskb, 0, &target, manip)) return 0; } diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c index 17de077..594ff50 100644 --- a/net/ipv4/netfilter/ip_nat_standalone.c +++ b/net/ipv4/netfilter/ip_nat_standalone.c @@ -298,6 +298,13 @@ ip_nat_adjust(unsigned int hooknum, return NF_ACCEPT; } +/* Modules depending on the NAT hooks but not using symbols from this module + should call this */ +void need_nat_hooks(void) +{ +} +EXPORT_SYMBOL_GPL(need_nat_hooks); + /* We must be after connection tracking and before packet filtering. */ static struct nf_hook_ops ip_nat_ops[] = { diff --git a/net/ipv4/netfilter/ipt_TPROXY.c b/net/ipv4/netfilter/ipt_TPROXY.c new file mode 100644 index 0000000..ac45abf --- /dev/null +++ b/net/ipv4/netfilter/ipt_TPROXY.c @@ -0,0 +1,92 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2002-2004 BalaBit IT Ltd. + * Author: Balázs Scheidler + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include +#include +#include +#include + +#include +#include + +static unsigned int +target(struct sk_buff **pskb, + const struct net_device *in, + const struct net_device *out, + unsigned int hooknum, + const struct xt_target *target, + const void *targinfo, + void *userinfo) +{ + const struct ipt_tproxy_target_info *tproxyinfo = targinfo; + struct ipt_tproxy_user_info *tproxy_ui = userinfo; + + if (userinfo) { + tproxy_ui->changed = 1; + tproxy_ui->lport = tproxyinfo->lport; + tproxy_ui->laddr = tproxyinfo->laddr; + return NF_ACCEPT; + } + else + return NF_DROP; +} + +static int +checkentry(const char *tablename, + const void *e, + const struct xt_target *target, + void *targinfo, + unsigned int targinfosize, + unsigned int hook_mask) +{ + if (targinfosize != IPT_ALIGN(sizeof(struct ipt_tproxy_target_info))) { + printk(KERN_WARNING "TPROXY: targinfosize %u != %Zu\n", + targinfosize, + IPT_ALIGN(sizeof(struct ipt_tproxy_target_info))); + return 0; + } + + if (strcmp(tablename, "tproxy") != 0) { + printk(KERN_WARNING "TPROXY: can only be called from \"tproxy\" table, not \"%s\"\n", tablename); + return 0; + } + + return 1; +} + +static struct ipt_target ipt_tproxy_reg = { + .name = "TPROXY", + .target = target, + .targetsize = sizeof(struct ipt_tproxy_target_info), + .checkentry = checkentry, + .me = THIS_MODULE, +}; + +static int __init init(void) +{ + if (ipt_register_target(&ipt_tproxy_reg)) + return -EINVAL; + + return 0; +} + +static void __exit fini(void) +{ + ipt_unregister_target(&ipt_tproxy_reg); +} + +module_init(init); +module_exit(fini); +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Balázs Scheidler "); +MODULE_DESCRIPTION("Netfilter transparent proxy TPROXY target module."); + diff --git a/net/ipv4/netfilter/ipt_tproxy.c b/net/ipv4/netfilter/ipt_tproxy.c new file mode 100644 index 0000000..04b589e --- /dev/null +++ b/net/ipv4/netfilter/ipt_tproxy.c @@ -0,0 +1,75 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2002-2004 BalaBit IT Ltd. + * Author: Balázs Scheidler + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include +#include +#include +#include +#include + +static int +match(const struct sk_buff *skb, + const struct net_device *in, + const struct net_device *out, + const struct xt_match *match, + const void *matchinfo, + int offset, + unsigned int protoff, + int *hotdrop) +{ + enum ip_conntrack_info ctinfo; + struct ip_conntrack *ct; + + ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo); + if (ct) + return ct->status & IPS_TPROXY; + else + return 0; +} + +static int check(const char *tablename, + const void *ip_void, + const struct xt_match *match, + void *matchinfo, + unsigned int matchsize, + unsigned int hook_mask) +{ + if (matchsize != 0) + return 0; + + return 1; +} + +static struct ipt_match tproxy_match = { + .name = "tproxy", + .match = &match, + .matchsize = 0, + .checkentry = &check, + .me = THIS_MODULE, +}; + +static int __init init(void) +{ + return ipt_register_match(&tproxy_match); +} + +static void __exit fini(void) +{ + ipt_unregister_match(&tproxy_match); +} + +module_init(init); +module_exit(fini); +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Balázs Scheidler "); +MODULE_DESCRIPTION("Netfilter transparent proxy iptables match module."); + diff --git a/net/ipv4/netfilter/iptable_tproxy.c b/net/ipv4/netfilter/iptable_tproxy.c new file mode 100644 index 0000000..ea35da7 --- /dev/null +++ b/net/ipv4/netfilter/iptable_tproxy.c @@ -0,0 +1,1990 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2002-2004 BalaBit IT Ltd. + * Author: Balázs Scheidler, Krisztián Kovács + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include + +#include + +#define ASSERT_READ_LOCK(x) +#define ASSERT_WRITE_LOCK(x) +DEFINE_RWLOCK(ip_tproxy_lock); + +#include + +#define TPROXY_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT)) + +#if 0 +#define DEBUGP printk +#else +#define DEBUGP(args...) +#endif + +#define TPROXY_MAJOR_VERSION 2 +#define TPROXY_MINOR_VERSION 0 +#define TPROXY_PATCH_VERSION 6 + +#define TPROXY_FULL_VERSION ((TPROXY_MAJOR_VERSION << 24) | \ + (TPROXY_MINOR_VERSION << 16) | \ + TPROXY_PATCH_VERSION) + +#define MAJOR_VERSION(x) ((x >> 24) & 0xff) +#define MINOR_VERSION(x) ((x >> 16) & 0xff) +#define PATCH_VERSION(x) (x & 0xffff) + +/* simple and buggy, but enough for us */ +#define MIN(a,b) ((a < b) ? a : b) + +static struct +{ + struct ipt_replace repl; + struct ipt_standard entries[2]; + struct ipt_error term; +} initial_table __initdata += { { "tproxy", TPROXY_VALID_HOOKS, 3, + sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error), + { [NF_IP_PRE_ROUTING] 0, + [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) }, + { [NF_IP_PRE_ROUTING] 0, + [NF_IP_LOCAL_OUT] sizeof(struct ipt_standard) }, + 0, NULL, { } }, + { + /* PRE_ROUTING */ + { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ipt_entry), + sizeof(struct ipt_standard), + 0, { 0, 0 }, { } }, + { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } }, + /* LOCAL_OUT */ + { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ipt_entry), + sizeof(struct ipt_standard), + 0, { 0, 0 }, { } }, + { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, + -NF_ACCEPT - 1 } } + }, + /* ERROR */ + { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, + 0, + sizeof(struct ipt_entry), + sizeof(struct ipt_error), + 0, { 0, 0 }, { } }, + { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } }, + { } }, + "ERROR" + } + } +}; + +static struct ipt_table tproxy_table = { + .name = "tproxy", + .valid_hooks = TPROXY_VALID_HOOKS, + .lock = RW_LOCK_UNLOCKED, + .me = THIS_MODULE, + .af = AF_INET, +}; + +static void (*ip_conntrack_destroyed_old)(struct ip_conntrack *ct) = NULL; + +/* NAT entry setup flags */ +#define TN_BIDIR 1 +#define TN_STOREREF 2 + +/* user settable flags */ +#define TF_NAT_ONCE 0x00000001 /* this entry is applied only once */ +#define TF_LISTEN 0x00000002 /* this entry is meant for listening */ +#define TF_CONNECT 0x00000004 /* this entry is meant for connecting */ +#define TF_UNIDIR 0x00000008 /* this entry is a listening UDP socket, + and only an unidirectional nat is to be applied */ + +/* state flags */ +#define TF_HASHED 0x00010000 /* entry hashed in hashtable */ +#define TF_CONNECT_ONLY 0x00020000 /* conflicting foreign address */ +#define TF_MARK_ONLY 0x00040000 /* have packets in this session mark as tproxy but don't apply translation */ +#define TF_NAT_APPLIED 0x00080000 /* NAT already applied, ignore this entry during NAT search */ +#define TF_ORPHAN 0x00100000 /* Parent (listening) socket was closed */ + +#ifdef CONFIG_IP_NF_NAT_NRES +#define TF_NAT_RESERVED 0x00200000 /* a NAT reservation was allocated for the sockref's foreign address */ +#define TF_NAT_PEER 0x00400000 /* raddr was also specified at NAT reservation */ +#endif + +#define TF_STATE_MASK 0xffff0000 + +struct ip_tproxy_sockref; + +struct ip_tproxy_hash +{ + struct list_head list; + struct ip_tproxy_sockref *sockref; +}; + +struct ip_tproxy_sockref +{ + int flags; + atomic_t references; + + u8 proto; + + /* foreign address associated with a local socket */ + u32 faddr; + u16 fport; + + /* local socket address */ + u32 laddr; + u16 lport; + + /* remote addresses, needed for datagram protocols when the peer + * sends the packet triggering the NAT translation. (as there might + * be multiple sockrefs on the same foreign address). + */ + u32 raddr; + u16 rport; + + /* hash chains indexed by local and foreign addresses */ + struct ip_tproxy_hash bylocal, byforeign; + + /* lock protecting access to related list */ + spinlock_t relatedlock; + /* number of related connections */ + atomic_t related; + /* list of related connections */ + struct list_head relatedct; + + /* socket which we were assigned to */ + struct sock *assigned_to; + + /* How many sockets use this sockref? Used for mark-only sockrefs, + * which can be shared between multiple sockets bound to the same local + * address */ + atomic_t socket_count; + + /* when was this entry inserted in hash */ + struct timespec tv_hashed; +}; + +static int hashsize = 0; +module_param(hashsize, uint, 0600); + +int ip_tproxy_htable_size = 127; +struct list_head *ip_tproxy_bylocal; +struct list_head *ip_tproxy_byforeign; +kmem_cache_t *ip_tproxy_sockref_table; +int ip_tproxy_htable_count = 0; +struct ip_conntrack ip_tproxy_fake_ct; + +static u32 +ip_tproxy_hash_fn(u32 addr, u16 port, u8 proto) +{ + return ntohl(addr + (port<<8) + proto) % ip_tproxy_htable_size; +} + +/* allocate memory and initialize a sockref structure */ +static struct ip_tproxy_sockref * +ip_tproxy_sockref_new(void) +{ + struct ip_tproxy_sockref *sr; + + sr = kmem_cache_zalloc(ip_tproxy_sockref_table, GFP_ATOMIC); + if (!sr) + return NULL; + + atomic_set(&sr->references, 1); + sr->bylocal.sockref = sr; + sr->byforeign.sockref = sr; + sr->relatedlock = SPIN_LOCK_UNLOCKED; + INIT_LIST_HEAD(&sr->relatedct); + atomic_set(&sr->socket_count, 1); + + return sr; +} + +/* increase reference count for a sockref entry */ +static inline void +ip_tproxy_sockref_ref(struct ip_tproxy_sockref *sr) +{ + atomic_inc(&sr->references); +} + +/* decrease refcount for the entry, and free the structure if needed */ +static inline void +ip_tproxy_sockref_unref(struct ip_tproxy_sockref *sr) +{ + if (atomic_dec_and_test(&sr->references)) { + kmem_cache_free(ip_tproxy_sockref_table, sr); + } +} + +/* put a sockref entry in the hash tables */ +static void +ip_tproxy_hash(struct ip_tproxy_sockref *sr) +{ + u32 fhash = ip_tproxy_hash_fn(sr->faddr, sr->fport, sr->proto); + u32 lhash = ip_tproxy_hash_fn(sr->laddr, sr->lport, sr->proto); + + sr->flags |= TF_HASHED; + sr->tv_hashed = xtime; + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_hash(): hashing sockref, " + "lhash=%d, fhash=%d, %p, %02x, %08x:%04x -> %08x:%04x\n", + lhash, fhash, sr, sr->proto, sr->laddr, + sr->lport, sr->faddr, sr->fport); + + ip_tproxy_sockref_ref(sr); + + list_append(&ip_tproxy_bylocal[lhash], &sr->bylocal); + list_append(&ip_tproxy_byforeign[fhash], &sr->byforeign); + ip_tproxy_htable_count++; +} + +/* delete sockref from the hash tables */ +static void +ip_tproxy_unhash(struct ip_tproxy_sockref *sr) +{ + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_hash(): unhashing sockref, " + "%p, %02x, %08x:%04x -> %08x:%04x\n", + sr, sr->proto, sr->laddr, sr->lport, sr->faddr, sr->fport); + + if (sr->flags & TF_HASHED) { + list_del(&sr->bylocal.list); + list_del(&sr->byforeign.list); + sr->flags &= ~TF_HASHED; + ip_tproxy_sockref_unref(sr); + ip_tproxy_htable_count--; + } + else { + printk(KERN_WARNING "IP_TPROXY: unhashing a sockref which was " + "not hashed before, %p, flags=%x\n", + sr, sr->flags); + } +} + +/* change the fport of the sockref to the specified value, and modify foreign hash + * accordingly (used when not specifying an exact foreign port, and NAT allocates a + * free port number for the sockref) */ +static void +ip_tproxy_rehash_fport(struct ip_tproxy_sockref *sr, u16 fport) +{ + u32 fhash = ip_tproxy_hash_fn(sr->faddr, fport, sr->proto); + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_rehash_fport(): rehashing sockref, " + "%p, %02x, %08x:%04x -> %08x:%04x, new fport %04x\n", + sr, sr->proto, sr->laddr, sr->lport, + sr->faddr, sr->fport, fport); + + if (sr->flags & TF_HASHED) { + list_del(&sr->byforeign.list); + sr->fport = fport; + list_append(&ip_tproxy_byforeign[fhash], &sr->byforeign); + } +} + +/* add a conntrack entry to the related list of the sockref */ +static void +ip_tproxy_relatedct_add(struct ip_tproxy_sockref *sr, struct ip_conntrack *ct) +{ +#ifdef IP_TPROXY_DEBUG + struct ip_conntrack *p; +#endif + + if (test_and_set_bit(IPS_TPROXY_RELATED_BIT, &ct->status)) { + /* this conntrack is already related to another sockref! */ + return; + } + + spin_lock_bh(&sr->relatedlock); + +#ifdef IP_TPROXY_DEBUG + /* check if it's already in the list */ + list_for_each_entry(p, &sr->relatedct, tproxy.related) { + if (ct == p) + goto out; + } +#endif + + /* each related conntrack adds one to the reference count of the sockref */ + ip_tproxy_sockref_ref(sr); + atomic_inc(&sr->related); + /* since we store a pointer to the conntrack, we should get a reference */ + atomic_inc(&ct->ct_general.use); + list_add(&ct->tproxy.related, &sr->relatedct); + +#ifdef IP_TPROXY_DEBUG +out: +#endif + spin_unlock_bh(&sr->relatedlock); +} + +/* called by conntrack when a connection is confirmed */ +static void +ip_tproxy_confirmed(struct ip_conntrack *ct) +{ + struct ip_tproxy_sockref *sr = (struct ip_tproxy_sockref *)ct->tproxy.sockref; + + /* check if it was marked by tproxy and not yet a related sockref */ + if (test_bit(IPS_TPROXY_BIT, &ct->status) && + !test_bit(IPS_TPROXY_RELATED_BIT, &ct->status) && + sr) { + ct->tproxy.sockref = NULL; + + /* put it on the sockref's related list */ + if (sr->proto == IPPROTO_UDP) + ip_tproxy_relatedct_add(sr, ct); + + /* drop reference to sockref */ + ip_tproxy_sockref_unref(sr); + } +} + +/* called by conntrack when a connection is destroyed */ +static void +ip_tproxy_conntrack_destroyed(struct ip_conntrack *ct) +{ + /* check if it's not confirmed, but marked by tproxy */ + if (!is_confirmed(ct) && + !test_bit(IPS_TPROXY_RELATED_BIT, &ct->status) && + test_and_clear_bit(IPS_TPROXY_BIT, &ct->status) && + ct->tproxy.sockref != NULL) { + /* drop reference */ + ip_tproxy_sockref_unref((struct ip_tproxy_sockref *)ct->tproxy.sockref); + ct->tproxy.sockref = NULL; + } + + if (ip_conntrack_destroyed_old) + ip_conntrack_destroyed_old(ct); +} + +static int +sockref_listen_cmp(const struct ip_tproxy_sockref *sr, const u32 raddr, const u16 rport, + const struct ip_conntrack *ct) +{ + return (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip == sr->faddr) && + (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.all == sr->fport) && + (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum == sr->proto) && + ((raddr == 0) || (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip == raddr)) && + ((rport == 0) || (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == rport)); +} + +/* delete matching related connections from the sockref's list and delete them from + * the conntrack hash if requested */ +static void +ip_tproxy_kill_related(struct ip_tproxy_sockref *sr, u32 raddr, u16 rport, + int cmpfn(const struct ip_tproxy_sockref *, const u32 raddr, + const u16 rport, const struct ip_conntrack *), + int delete) +{ + struct ip_conntrack *ct, *p; + + spin_lock_bh(&sr->relatedlock); + + list_for_each_entry_safe(ct, p, &sr->relatedct, tproxy.related) { + /* if a compare function was given, don't delete unmatched entries */ + if (cmpfn && !cmpfn(sr, raddr, rport, ct)) + continue; + + /* delete the conntrack entry from our related list, update related counter */ + list_del(&ct->tproxy.related); + atomic_dec(&sr->related); + +#ifdef CONFIG_NETFILTER_DEBUG + /* clear IPS_TPROXY_RELATED flag from the conntrack */ + if (!test_and_clear_bit(IPS_TPROXY_RELATED_BIT, &ct->status)) { + /* this is a bug: IPS_TPROXY_RELATED is not set for a conntrack? */ + printk(KERN_WARNING "IP_TPROXY: IPS_TPROXY_RELATED not set " + "for a related conntrack\n"); + } +#endif + + /* should we delete the entry from the conntrack hash? */ + if (delete && del_timer(&ct->timeout)) + ct->timeout.function((unsigned long)ct); + + /* unreference conntrack and sockref */ + ip_conntrack_put(ct); + ip_tproxy_sockref_unref(sr); + } + + spin_unlock_bh(&sr->relatedlock); +} + +/* remove/kill related connections for the given sockref */ +static void +ip_tproxy_kill_conntracks(struct ip_tproxy_sockref *sr, + u32 raddr, u16 rport, int delete) +{ + if (sr->flags & TF_CONNECT) { + /* this is an established UDP "connection" or a CONNECT-ed + * sockref, we delete all related connections from our list */ + ip_tproxy_kill_related(sr, raddr, rport, NULL, delete); + } else if (sr->flags & TF_LISTEN) { + /* for listening sockrefs, we have to delete one specific + * connection only, with both endpoints matching */ + ip_tproxy_kill_related(sr, raddr, rport, sockref_listen_cmp, delete); + } +} + +static void *ip_tproxy_seq_start(struct seq_file *seq, loff_t *pos) +{ + /* we use seq_file->private pointer as an int */ + unsigned int *bucket = (unsigned int *)&seq->private; + + read_lock_bh(&ip_tproxy_lock); + + if (*pos >= ip_tproxy_htable_size) + return NULL; + + *bucket = *pos; + return bucket; +} + +static void *ip_tproxy_seq_next(struct seq_file *seq, void *v, loff_t *pos) +{ + unsigned int *bucket = (unsigned int *)v; + + *pos = ++(*bucket); + if (*pos > ip_tproxy_htable_size) + return NULL; + + return bucket; +} + +static void ip_tproxy_seq_stop(struct seq_file *seq, void *v) +{ + read_unlock_bh(&ip_tproxy_lock); +} + +/* print information about a sockref, used by the procfs interface */ +static unsigned int +ip_tproxy_print_sockref(const struct ip_tproxy_hash *h, struct seq_file *seq) +{ + struct ip_tproxy_sockref *sr = h->sockref; + + IP_NF_ASSERT(sr); + + return seq_printf(seq, "%05d %08x:%04x %08x:%04x %08x:%04x %08x %05u %06u %10ld:%06ld\n", + sr->proto, sr->faddr, sr->fport, sr->laddr, + sr->lport, sr->raddr, sr->rport, sr->flags, + atomic_read(&sr->related), atomic_read(&sr->socket_count), + sr->tv_hashed.tv_sec, sr->tv_hashed.tv_nsec) ? 1 : 0; +} + +static int ip_tproxy_seq_show(struct seq_file *seq, void *v) +{ + unsigned int *bucket = (unsigned int *)v; + + if (LIST_FIND(&ip_tproxy_bylocal[*bucket], ip_tproxy_print_sockref, + struct ip_tproxy_hash *, seq)) + return 1; + + return 0; +} + +static struct seq_operations ip_tproxy_seq_ops = { + .start = ip_tproxy_seq_start, + .next = ip_tproxy_seq_next, + .stop = ip_tproxy_seq_stop, + .show = ip_tproxy_seq_show +}; + +static int ip_tproxy_proc_open(struct inode *inode, struct file *file) +{ + return seq_open(file, &ip_tproxy_seq_ops); +} + +static struct file_operations ip_tproxy_file_ops = { + .owner = THIS_MODULE, + .open = ip_tproxy_proc_open, + .read = seq_read, + .llseek = seq_lseek, + .release = seq_release +}; + +/* lookup sockref based on the local address. refcount is not incremented on the returned sockref */ +struct ip_tproxy_sockref * +ip_tproxy_sockref_find_local(u32 addr, u16 port, u8 proto, int fresh, u32 raddr, u16 rport) +{ + u32 hash = ip_tproxy_hash_fn(addr, port, proto); + struct ip_tproxy_hash *h; + struct ip_tproxy_sockref *sr, *best = NULL; + + ASSERT_READ_LOCK(&ip_tproxy_bylocal[hash]); + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_sockref_find_local(): " + "entered, %08x:%04x\n", addr, port); + + list_for_each_entry(h, &ip_tproxy_bylocal[hash], list) { + sr = h->sockref; + + DEBUGP(KERN_DEBUG "IP_TPROXY: sockref_cmpfn_local(): sr: %08x:%04x " + "(foreign: %08x:%04x remote: %08x:%04x), searched: " + "%08x:%04x (remote: %08x:%04x)\n", + sr->laddr, sr->lport, sr->faddr, sr->fport, + sr->raddr, sr->rport, addr, port, raddr, rport); + + if (sr->laddr == addr && sr->lport == port && sr->proto == proto) { + /* fresh means orphaned entries should be skipped */ + if (fresh && (sr->flags & TF_ORPHAN)) + continue; + + if (raddr == 0 && rport == 0) { + /* not interested in remote address */ + return sr; + } + else if (sr->raddr == raddr && sr->rport == rport) { + /* complete match */ + return sr; + } + else if (sr->raddr == 0 && sr->rport == 0) { + /* unconnected sockref if complete match not found */ + best = sr; + } + } + } + + return best; +} + +/* lookup sockref based on the foreign address. refcount is not incremented on the returned sockref */ +struct ip_tproxy_sockref * +ip_tproxy_sockref_find_foreign(u32 addr, u16 port, u8 proto, u32 raddr, u16 rport) +{ + u32 hash = ip_tproxy_hash_fn(addr, port, proto); + struct ip_tproxy_hash *h; + struct ip_tproxy_sockref *sr, *best = NULL; + + ASSERT_READ_LOCK(&ip_tproxy_byforeign[hash]); + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_sockref_find_foreign(): " + "entered, %08x:%04x\n", addr, port); + + list_for_each_entry(h, &ip_tproxy_byforeign[hash], list) { + sr = h->sockref; + + DEBUGP(KERN_DEBUG "IP_TPROXY: sockref_cmpfn_foreign(): sr: %08x:%04x " + "(remote: %08x:%04x), searched: %08x:%04x (remote: %08x:%04x)\n", + sr->faddr, sr->fport, sr->raddr, sr->rport, addr, port, raddr, rport); + + if (sr->faddr == addr && sr->fport == port && sr->proto == proto) { + if (raddr == 0 && rport == 0) { + /* not interested in remote address */ + return sr; + } + else if (sr->raddr == raddr && sr->rport == rport) { + /* complete match */ + return sr; + } + else if (sr->raddr == 0 && sr->rport == 0) { + /* unconnected sockref if complete match not found */ + best = sr; + } + } + } + + return best; +} + +/* delete all sockrefs currently in the hash tables + * FIXME: we might have a race here. If our hook is running while to module + * is unloading, bad things might happen. */ +static void +ip_tproxy_sockref_table_free(void) +{ + int i; + struct ip_tproxy_hash *h, *p; + + for (i = 0; i < ip_tproxy_htable_size; i++) { + list_for_each_entry_safe(h, p, &ip_tproxy_bylocal[i], list) { + list_del(&h->list); + ip_tproxy_kill_conntracks(h->sockref, 0, 0, 0); + ip_tproxy_sockref_unref(h->sockref); + } + ip_tproxy_byforeign[i].prev = ip_tproxy_byforeign[i].next = &ip_tproxy_byforeign[i]; + } +} + +/* determine ip address of the interface the packet came in */ +static u32 +ip_tproxy_determine_local_ip(struct sk_buff *skb, int hooknum) +{ + struct in_device *indev; + u32 ip; + + if (hooknum == NF_IP_LOCAL_OUT) + return htonl(0x7f000001); + + indev = in_dev_get(skb->dev); + + if (!indev) { + printk(KERN_WARNING "IP_TPROXY: No IP protocol on incoming " + "interface during redirect, dropping packet.\n"); + return 0; + } + if (!indev->ifa_list) { + printk(KERN_WARNING "IP_TPROXY: No IP address on incoming " + "interface during redirect, dropping packet.\n"); + in_dev_put(indev); + return 0; + } + + ip = indev->ifa_list->ifa_local; + in_dev_put(indev); + + return ip; +} + +/* setup a bidirectional NAT mapping for the given connection, using the values specified by + * the assigned sockref */ +static int +ip_tproxy_setup_nat_bidir(struct ip_conntrack *ct, int hooknum, struct ip_tproxy_sockref *sr, unsigned int flags) +{ + struct ip_nat_range range; + u32 newip = 0; + u16 newport = 0; + int res; + + if (is_confirmed(ct) || ip_nat_initialized(ct, HOOK2MANIP(hooknum))) { + return NF_ACCEPT; + } + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_setup_nat(): adding nat " + "entry hooknum=%d %08x:%04x -> %08x:%04x\n", hooknum, sr->laddr, + sr->lport, sr->faddr, sr->fport); + + range.flags = IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_BYPASS_HELPERS; + + if (hooknum == NF_IP_POST_ROUTING) { + /* in POSTROUTING we perform an SNAT to the foreign address */ + newip = sr->faddr; + newport = sr->fport; + } + else if (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT) { + /* in PREROUTING and LOCAL_OUT we perform a DNAT to our socket address */ + + newip = sr->laddr; + newport = sr->lport; + } + + range.min_ip = range.max_ip = newip; + + /* if port number was specified */ + if (newport != 0) { + if (sr->proto == IPPROTO_TCP) { + range.min.tcp.port = range.max.tcp.port = newport; + range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; + } + else if (sr->proto == IPPROTO_UDP) { + range.min.udp.port = range.max.udp.port = newport; + range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; + } +#ifdef CONFIG_IP_NF_NAT_NRES + if (sr->flags & TF_NAT_RESERVED) + range.flags |= IP_NAT_RANGE_USE_RESERVED; +#endif + } + + res = ip_nat_setup_info(ct, &range, hooknum); + + if (res != NF_ACCEPT) { + printk(KERN_WARNING "IP_TPROXY: error applying NAT mapping, " + "hooknum=%d %08x:%04x -> %08x:%04x\n", + hooknum, sr->laddr, sr->lport, newip, newport); + } + else { + /* we store a reference to the sockref in the conntrack */ + if (!test_and_set_bit(IPS_TPROXY_BIT, &ct->status)) { + if (flags & TN_STOREREF) { + ip_tproxy_sockref_ref(sr); + ct->tproxy.sockref = sr; + } + } + + if ((newport == 0) && (ct->status & IPS_SRC_NAT) && (sr->flags & TF_HASHED)) { + u16 fport = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all; + write_lock_bh(&ip_tproxy_lock); + /* FIXME: necessary and correct? */ + ip_tproxy_rehash_fport(sr, fport); + write_unlock_bh(&ip_tproxy_lock); + } + } + + return res; +} + +/* redirect incoming packet to the appropriate local port (UDP specific) */ +static int +ip_tproxy_setup_nat_unidir(struct sk_buff **pskb, int hooknum, struct ip_tproxy_sockref *sr) +{ + enum ip_nat_manip_type manip_type; + struct sk_buff *skb = *pskb; + struct ip_conntrack_tuple tuple; + + /* free the original conntrack entry, and assign the fake one */ + nf_conntrack_put(skb->nfct); + skb->nfct = &ip_tproxy_fake_ct.ct_general; + skb->nfctinfo = IP_CT_NEW; + nf_conntrack_get(skb->nfct); + + /* fill tuple structure with new information */ + tuple.dst.protonum = skb->nh.iph->protocol; + + if (hooknum == NF_IP_POST_ROUTING) { + /* in POSTROUTING we perform an SNAT to the foreign address */ + tuple.src.ip = sr->faddr; + tuple.src.u.udp.port = sr->fport; + manip_type = IP_NAT_MANIP_SRC; + } else if (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT) { + /* in PREROUTING and LOCAL_OUT we perform a DNAT to our socket address */ + tuple.dst.ip = sr->laddr; + tuple.dst.u.udp.port = sr->lport; + manip_type = IP_NAT_MANIP_DST; + } else + return NF_DROP; + + /* manipulate packet "by hand" */ + if (unlikely(!ip_nat_manip_pkt(skb->nh.iph->protocol, pskb, 0, &tuple, manip_type))) { + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_setup_nat_unidir(): " + "failed to rewrite packet header\n"); + return NF_DROP; + } + + return NF_ACCEPT; +} + +/* setup NAT for the packet */ +static int +ip_tproxy_setup_nat(struct sk_buff **pskb, int hooknum, struct ip_tproxy_sockref *sr, unsigned int flags) +{ + if (sr->proto == IPPROTO_TCP || (flags & TN_BIDIR)) { + struct ip_conntrack *ct; + enum ip_conntrack_info ctinfo; + + ct = ip_conntrack_get(*pskb, &ctinfo); + return ip_tproxy_setup_nat_bidir(ct, hooknum, sr, flags); + } else if (sr->proto == IPPROTO_UDP) + return ip_tproxy_setup_nat_unidir(pskb, hooknum, sr); + + return NF_DROP; +} + +/* This is a gross hack */ +static void +ip_tproxy_save_orig_addrs(struct sk_buff *skb) +{ + struct iphdr *iph = skb->nh.iph; + u16 *tports, _tports[2]; + + tports = skb_header_pointer(skb, iph->ihl * 4, sizeof(_tports), &_tports); + if (tports != NULL) { + IPCB(skb)->orig_srcaddr = iph->saddr; + IPCB(skb)->orig_srcport = tports[0]; + IPCB(skb)->orig_dstaddr = iph->daddr; + IPCB(skb)->orig_dstport = tports[1]; + } +} + +/* tproxy Netfilter hook */ +static unsigned int +ip_tproxy_fn(unsigned int hooknum, + struct sk_buff **pskb, + const struct net_device *in, + const struct net_device *out, + int (*okfn)(struct sk_buff *)) +{ + struct ip_conntrack *ct; + enum ip_conntrack_info ctinfo; + unsigned int verdict = NF_ACCEPT; + + ct = ip_conntrack_get(*pskb, &ctinfo); + + if (ct && ctinfo == IP_CT_NEW) { + struct iphdr *iph = (*pskb)->nh.iph; + u16 *tports, _tports[2]; + struct ip_tproxy_sockref *sr = NULL; + + tports = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl * 4, + sizeof(_tports), &_tports); + if (tports == NULL) { + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_fn(): " + "failed to copy protocol header\n"); + return NF_DROP; + } + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_fn(): new connection, " + "hook=%d, %08x:%04x -> %08x:%04x\n", + hooknum, iph->saddr, tports[0], iph->daddr, tports[1]); + + ip_tproxy_save_orig_addrs(*pskb); + read_lock_bh(&ip_tproxy_lock); + if (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT) { + + /* + * We either received a connection from the network (PREROUTING case) + * or a local process generated one (LOCAL_OUT case). + * + * In either case we check whether a proxy bound to the + * destination of this connection. + * + * As a special case we check in LOCAL_OUT whether the + * connection was initiated by a local proxy, and if it + * was we mark the connection as such and skip the + * tproxy table. + */ + + /* destination address is interesting */ + + sr = ip_tproxy_sockref_find_foreign(iph->daddr, tports[1], + iph->protocol, iph->saddr, tports[0]); + + if (sr && sr->flags & TF_ORPHAN) { + /* This sockref is orphaned, the listening socket is already unassigned, + * so it should not be used for setting up NAT for a new connection. */ + sr = NULL; + } + + if (sr && (sr->flags & (TF_LISTEN|TF_MARK_ONLY)) == 0) { + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_fn(PREROUTING), " + "entry found but flags = 0\n"); + sr = NULL; + } + + if (hooknum == NF_IP_LOCAL_OUT && + !sr && + (sr = ip_tproxy_sockref_find_local(iph->saddr, tports[0], + iph->protocol, 1, iph->daddr, + tports[1]))) { + DEBUGP("IP_TPROXY: tproxy initiated session in local " + "output, sr->flags=%04x\n", sr->flags); + if ((sr->flags & TF_MARK_ONLY) == 0) + sr = NULL; + } + } + else if (hooknum == NF_IP_POST_ROUTING) { + + /* + * We detected a new connection just leaving this box, so + * we now have a chance to add a translation changing + * the source address of all packets. We want to do this + * if the connection was initiated by a transparent proxy + * which registered another address to rewrite the source into. + * + * A proxy registered an entry if find_local returns non-NULL. + */ + + /* source address is interesting */ + + sr = ip_tproxy_sockref_find_local(iph->saddr, tports[0], iph->protocol, + 1, iph->daddr, tports[1]); + if (sr && (sr->flags & (TF_CONNECT|TF_MARK_ONLY)) == 0) { + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_fn(POSTROUTING), " + "entry found but flags = 0\n"); + sr = NULL; + } + } + else { + printk(KERN_WARNING "IP_TPROXY: hook function called at hooks other " + "than NF_IP_PRE_ROUTING, NF_IP_POST_ROUTING or " + "NF_IP_LOCAL_OUT, hooknum=%d\n", hooknum); + verdict = NF_DROP; + } + + /* + * sockref will not be freed, as the hash is read locked here + * and by the time we unlock it we own a reference + */ + + if (sr) { + if (sr->flags & TF_MARK_ONLY) { + /* + * A MARK_ONLY entry indicates that although the proxy + * doesn't want any address rewrite to be performed + * it registered its connection as one originating + * from a transparent proxy, so -m tproxy matches it. + * + * It is a convinience feature, so administrators + * can simply let tproxied traffic through their filter + * table. + */ + DEBUGP(KERN_DEBUG "IP_TPROXY: mark only entry...\n"); + + if (!test_and_set_bit(IPS_TPROXY_BIT, &ct->status)) + ct->tproxy.sockref = NULL; + + sr = NULL; + } + else { + /* we'll have a reference to the sockref after releasing the lock */ + ip_tproxy_sockref_ref(sr); + } + } + read_unlock_bh(&ip_tproxy_lock); + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_fn(): sockref looked up, sr=%p\n", sr); + if (sr) { + + /* sockref found it is a real translation as + * MARK_ONLY was handled above so we apply the + * necessary NAT function + */ + + /* apply NAT mapping */ + unsigned int dirflag = !(sr->flags & TF_UNIDIR) ? TN_BIDIR : 0; + if (ip_tproxy_setup_nat(pskb, hooknum, sr, dirflag | TN_STOREREF) == NF_ACCEPT) { + /* FIXME: hmm. there might be races involved + * with TF_NAT_APPLIED, as another processor + * might be processing the same sockref. + */ + sr->flags |= TF_NAT_APPLIED; + } else { + /* Applying the NAT mapping failed, we should drop the packet */ + verdict = NF_DROP; + } + + /* drop reference */ + ip_tproxy_sockref_unref(sr); + } /* if (sr) */ + else if (!test_bit(IPS_TPROXY_BIT, &ct->status) && + (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT)) { + + struct ipt_tproxy_user_info ui; + + /* there was no matching sockref, so we consult the + * TPROXY table + */ + + ui.changed = 0; + verdict = ipt_do_table(pskb, hooknum, in, out, &tproxy_table, &ui); + if (ui.changed && verdict == NF_ACCEPT) { + struct ip_tproxy_sockref sr; + u32 laddr; + u16 lport; + + /* packet was redirected */ + if (ui.lport == 0) + lport = tports[1]; + else + lport = ui.lport; + + if (ui.laddr == 0) + laddr = ip_tproxy_determine_local_ip(*pskb, hooknum); + else + laddr = ui.laddr; + + memset(&sr, 0, sizeof(sr)); + + DEBUGP(KERN_DEBUG "IP_TPROXY: performing redirect to %08x:%04x\n", + laddr, lport); + + sr.laddr = laddr; + sr.lport = lport; + sr.proto = iph->protocol; + if (!ip_tproxy_setup_nat(pskb, hooknum, &sr, 0)) + verdict = NF_DROP; + } + } + } + + return verdict; +} + +/* hack: get layer 3 protocol type */ +static inline int +ip_tproxy_get_sk_proto(struct sock *sk) +{ + /* FIXME: this is insane, I've seen crashes where + * sk->prot == NULL, so we have to check before accessing + * its fields. */ + if (sk->sk_prot == NULL || + sk->sk_prot->name == NULL) + return 0; + + if (strcmp(sk->sk_prot->name, "TCP") == 0) + return IPPROTO_TCP; + else if (strcmp(sk->sk_prot->name, "UDP") == 0) + return IPPROTO_UDP; + else + return 0; +} + +#ifdef CONFIG_IP_NF_NAT_NRES +static inline struct ip_nat_reserved * +ip_tproxy_nat_reserve(const u32 faddr, const u16 fport, int proto, const u32 raddr, const u16 rport) +{ + struct ip_conntrack_manip m = {.ip = faddr, .u = {.all = fport}}; + struct ip_conntrack_manip p = {.ip = raddr, .u = {.all = rport}}; + struct ip_nat_reserved *res; + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_nat_reserve proto %u foreign " + "%u.%u.%u.%u:%u peer %u.%u.%u.%u:%u\n", + proto, NIPQUAD(faddr), ntohs(fport), NIPQUAD(raddr), ntohs(rport)); + + write_lock_bh(&ip_nat_lock); + res = __ip_nat_reserved_new_hash(&m, proto, (raddr && rport) ? &p : NULL); + write_unlock_bh(&ip_nat_lock); + + return res; +} + +static void +ip_tproxy_nat_reserved_free(struct ip_tproxy_sockref *sr) +{ + struct ip_nat_reserved *res; + struct ip_conntrack_manip m = {.ip = sr->faddr, .u = {.all = sr->fport}}; + struct ip_conntrack_manip p = {.ip = sr->raddr, .u = {.all = sr->rport}}; + + /* free NAT reservation */ + if (sr->flags & TF_NAT_RESERVED) { + write_lock_bh(&ip_nat_lock); + if (sr->flags & TF_NAT_PEER) + res = __ip_nat_reserved_unhash(&m, sr->proto, &p); + else + res = __ip_nat_reserved_unhash(&m, sr->proto, NULL); + write_unlock_bh(&ip_nat_lock); + + if (res) { + sr->flags &= ~(TF_NAT_RESERVED | TF_NAT_PEER); + __ip_nat_reserved_free(res); + } + } +} +#endif + +/* This routine dynamically allocates a foreign port if the proxy requests this + * by setting fport to 0. We try to use the same algorithm the local stack + * uses to allocate a port. The routine itself is only used when we need to + * allocate a foreign port _before_ sending the first packet, standard connect + * sockets get their foreign port allocated by the NAT subsystem. */ +static inline int +ip_tproxy_sockref_uniq(struct ip_tproxy_sockref *sr) +{ + int min, max, rover, left; + static int ip_tproxy_port_rover = 0; + + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_sockref_uniq\n"); + min = sysctl_local_port_range[0]; + max = sysctl_local_port_range[1]; + rover = ip_tproxy_port_rover; + left = (max - min) + 1; + do { + rover++; + if (rover < min || rover > max) + rover = min; + if (ip_tproxy_sockref_find_foreign(sr->faddr, htons(rover), + sr->proto, sr->raddr, + sr->rport) == NULL) { +#ifdef CONFIG_IP_NF_NAT_NRES + /* unique entry found, try to reserve in NAT */ + if (ip_tproxy_nat_reserve(sr->faddr, htons(rover), sr->proto, sr->raddr, sr->rport)) +#endif + break; + } + } while (--left > 0); + + if (left == 0) { + printk(KERN_WARNING "IP_TPROXY: out of free foreign ports, " + "increase local_port_range\n"); + return 0; + } else if (rover == 0) { + printk(KERN_WARNING "IP_TPROXY: hm?? ip_tproxy_sockref_uniq, " + "left != 0 && rover == 0\n"); + } else { + /* succeeded */ + DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_sockref_uniq, " + "allocated port=%d\n", rover); + + ip_tproxy_port_rover = rover; + +#ifdef CONFIG_IP_NF_NAT_NRES + sr->flags |= TF_NAT_RESERVED; + if (sr->raddr && sr->rport) + sr->flags |= TF_NAT_PEER; +#endif + ip_tproxy_rehash_fport(sr, htons(rover)); + } + + return rover; +} + +static int +ip_tproxy_setsockopt_version(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0; + u_int32_t ver = itp->v.version; + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_VERSION\n"); + + if ((MAJOR_VERSION(ver) != TPROXY_MAJOR_VERSION) || + (MINOR_VERSION(ver) > TPROXY_MINOR_VERSION)) + res = -EINVAL; + + return res; +} + +static int +ip_tproxy_setsockopt_assign(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int foreign_matches, res = 0; + struct ip_tproxy_sockref *sr, *tsr = NULL; + struct inet_sock *inet = inet_sk(sk); + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ASSIGN %08x:%04x\n", + inet->rcv_saddr, inet->sport); + + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + + if ((sk->sk_socket == NULL) || + (sk->sk_socket->state != SS_UNCONNECTED)) { + DEBUGP(KERN_DEBUG "IP_TPROXY: socket is not SS_UNCONNECTED " + "during assign\n"); + return -EINVAL; + } + + if (!inet->rcv_saddr || !inet->sport) + return -EINVAL; + + read_lock_bh(&ip_tproxy_lock); + + DEBUGP(KERN_DEBUG "IP_TPROXY: count=%d\n", ip_tproxy_htable_count); + + /* check if this socket was already assigned a sockref */ + sr = ip_tproxy_sockref_find_local(inet->rcv_saddr, inet->sport, proto, 0, 0, 0); + + /* NOTE: this is a HACK, and trusts the userspace app. + We allow to assign multiple sockrefs to a single + local addr:port pair _iff_ the foreign address is + 0.0.0.0:0 to allow UDP sessions to be bound to + the same socket while keeping the 'mark as + tproxy' packet mechanism. + + Maybe we should assign sockrefs to the struct sock * + address instead. + */ + if (sr) { + if (itp->v.addr.faddr.s_addr || itp->v.addr.fport) { + printk("IP_TPROXY: socket already assigned, reuse=%d, " + "%08x:%04x, sr->faddr=%08x:%04x, flags=%x, " + "sr->tv_hashed=%ld:%ld\n", sk->sk_reuse, + inet->rcv_saddr, inet->sport, sr->faddr, sr->fport, + sr->flags, sr->tv_hashed.tv_sec, sr->tv_hashed.tv_nsec); + res = -EEXIST; + goto read_unlk; + } else { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ASSIGN local address " + "already taken, sharing this sockref\n"); + + /* increase socket count of sockref, indicating that it is + * shared between multiple sockets */ + atomic_inc(&sr->socket_count); + goto read_unlk; + } + } + + /* check if the foreign address specified has already been taken. + * if it has, the socket can only be used for connecting, provided + * sk->sk_reuse is true, otherwise fail */ + + if (itp->v.addr.faddr.s_addr && itp->v.addr.fport != 0 && + (tsr = ip_tproxy_sockref_find_foreign(itp->v.addr.faddr.s_addr, itp->v.addr.fport, proto, 0, 0))) { + if (!sk->sk_reuse) { + res = -EADDRINUSE; + goto read_unlk; + } + foreign_matches = 1; + } else { + foreign_matches = 0; + } + + /* we performed all checks, now allocate and fill a new + * sockref */ + + sr = ip_tproxy_sockref_new(); + if (!sr) { + printk(KERN_WARNING "IP_TPROXY: drained? cannot allocate sockref\n"); + res = -ENOBUFS; + goto read_unlk; + } + sr->flags = 0; + sr->proto = proto; + sr->faddr = itp->v.addr.faddr.s_addr; + sr->fport = itp->v.addr.fport; + sr->laddr = inet->rcv_saddr; + sr->lport = inet->sport; + sr->assigned_to = sk; + + if (itp->v.addr.faddr.s_addr == 0) { + /* we store the local address as foreign as well + * for mark only connections, so find_foreign + * finds this entry as well */ + + sr->flags |= TF_MARK_ONLY; + sr->faddr = sr->laddr; + sr->fport = sr->lport; + } + else if (foreign_matches) { + /* sk->sk_reuse was true */ + /* if the existing sockref is mark only, or has its remote + * endpoint specified, we have a chance not to clash with it, + * otherwise this sockref will be connect-only */ + + if ((tsr->flags & TF_MARK_ONLY) || (tsr->raddr != 0 && tsr->rport != 0)) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ASSIGN omitting " + "CONNECT_ONLY, other sockref is mark-only or connected\n"); + } else { + sr->flags |= TF_CONNECT_ONLY; + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ASSIGN setting " + "sr %p CONNECT_ONLY\n", sr); + } + } + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ASSIGN sr %p faddr:fport " + "%08x:%04x flags %08x\n", sr, sr->faddr, sr->fport, sr->flags); + +#ifdef CONFIG_IP_NF_NAT_NRES + /* If SO_REUSE is not set and foreign port was specified, we should + * allocate a NAT reservation right now. This mode is used by range + * binds, so being pessimistic at NAT reservation clash checks causes + * the caller to proceed to the next port and try again. */ + if (itp->v.addr.faddr.s_addr && itp->v.addr.fport && + !foreign_matches && !sk->sk_reuse) { + /* we should register a NAT reservatinon */ + if (ip_tproxy_nat_reserve(sr->faddr, sr->fport, proto, 0, 0)) { + sr->flags |= TF_NAT_RESERVED; + sr->flags &= ~TF_NAT_PEER; + } else { + /* failed to register NAT reservation, bail out */ + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ASSIGN cannot " + "register NAT reservation %08x:%04x\n", + sr->faddr, sr->fport); + + res = -EINVAL; + ip_tproxy_sockref_unref(sr); + goto read_unlk; + } + } +#endif + + read_unlock_bh(&ip_tproxy_lock); + write_lock_bh(&ip_tproxy_lock); + /* here we should check if we've won the race: if a sockref is in the + * local hash by the time we acquired the write lock, we've lost */ + if (!(tsr = ip_tproxy_sockref_find_local(inet->rcv_saddr, + inet->sport, proto, 0, 0, 0))) + ip_tproxy_hash(sr); + write_unlock_bh(&ip_tproxy_lock); + + if (tsr) { + /* we've lost the race */ + res = -EINVAL; + } + + /* the hashtable stores a reference, if hashing succeeded */ + ip_tproxy_sockref_unref(sr); + + return res; + + read_unlk: + read_unlock_bh(&ip_tproxy_lock); + return res; +} + +static int +ip_tproxy_setsockopt_unassign(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0, unhash = 0; + u32 saddr, daddr; + u16 sport, dport; + struct ip_tproxy_sockref *sr; + + /* connection and time_wait socksets have to be handled differently */ + if (sk->sk_state == TCP_TIME_WAIT) { + struct inet_timewait_sock *tw = inet_twsk(sk); + saddr = tw->tw_rcv_saddr; + daddr = tw->tw_daddr; + sport = tw->tw_sport; + dport = tw->tw_dport; + } else { + struct inet_sock *inet = inet_sk(sk); + saddr = inet->rcv_saddr; + daddr = inet->daddr; + sport = inet->sport; + dport = inet->dport; + } + + /* break the connection between this socket and + * a foreign address. This is implicitly performed + * when the socket is closed */ + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN %08x:%04x\n", saddr, sport); + + write_lock_bh(&ip_tproxy_lock); + sr = ip_tproxy_sockref_find_local(saddr, sport, proto, 0, daddr, dport); + + if (!sr) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN not unhashing socket, " + "%08x:%04x, proto=%d, sk->state=%d\n", + saddr, sport, proto, sk->sk_socket ? sk->sk_socket->state : -1); + res = -ENOENT; + goto write_unlk; + } + + /* Delete appropriate related connections and set 'unhash' if + * we have to unhash the sockref. */ + + /* Handle mark-only sockrefs separately: mark-only sockrefs don't have + * related conntrack entries, so there is no need to bother to delete + * the correct one from the related list. However, mark-only entries + * can be shared, which means that more than one sockets are bound to + * the same local address, and they are using the same sockref to have + * matching connections marked. Because of this, we may unhash the + * sockref only if there are no sockets left */ + if (sr->flags & TF_MARK_ONLY) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN unassigning " + "mark-only sockref %08x:%04x\n", saddr, sport); + if (atomic_dec_and_test(&sr->socket_count)) { + /* this was the last socket using this sockref */ + unhash = 1; + } + } else switch (proto) { + case IPPROTO_TCP: + if ((sr->flags & TF_LISTEN)) { + if (sr->assigned_to != sk) { + /* unassigning the socket of a connection + * established to a listening socket */ + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN unassigning " + "TCP listen related %08x:%04x -> %08x:%04x\n", + daddr, dport, saddr, sport); + } else { + /* unassigning a listening socket, don't destroy just mark invalid */ + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN unassigning " + "TCP listen socket %08x:%04x\n", saddr, sport); + sr->flags |= TF_ORPHAN; + sr->assigned_to = NULL; + } + + /* we have to unhash if there are no more related + * connections and the listening socket is closed as + * well */ + if (!atomic_read(&sr->related) && !sr->assigned_to) + unhash = 1; + + } else if (sr->flags & TF_CONNECT) { + /* unassigning a connect socket */ + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN unassigning " + "TCP connect %08x:%04x\n", saddr, sport); + unhash = 1; + } + break; + + case IPPROTO_UDP: + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN unassigning UDP " + "%08x:%04x\n", saddr, sport); + ip_tproxy_kill_conntracks(sr, 0, 0, 1); + unhash = 1; + break; + } + + /* unhash sockref if we don't need it anymore */ + if (unhash) { +#ifdef CONFIG_IP_NF_NAT_NRES + ip_tproxy_nat_reserved_free(sr); +#endif + ip_tproxy_unhash(sr); + } + + write_unlk: + write_unlock_bh(&ip_tproxy_lock); + + return res; +} + +static int +ip_tproxy_setsockopt_flags(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0; + struct ip_tproxy_sockref *sr; + u_int32_t flags = itp->v.flags; + struct inet_sock *inet = inet_sk(sk); + + /* specify translation flags for this socket */ + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS %08x:%04x\n", + inet->rcv_saddr, inet->sport); + + /* we don't check CAP_NET_ADMIN here, it was checked when this entry was hashed */ + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS flags to set %08x\n", + flags); + + /* FIXME: since read locks cannot be upgraded, we need a write lock if + * foreign port allocation will be needed... */ + write_lock_bh(&ip_tproxy_lock); + sr = ip_tproxy_sockref_find_local(inet->rcv_saddr, inet->sport, proto, + 0, inet->daddr, inet->dport); + if (!sr) { + res = -ENOENT; + goto write_unlk; + } + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS sr %p flags %08x\n", sr, sr->flags); + + /* Don't do anything in case of MARK_ONLY sockrefs */ + if (sr->flags & TF_MARK_ONLY) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS sr %p mark only, " + "doing nothing\n", sr); + goto write_unlk; + } + + /* clear user-settable flags */ + sr->flags &= TF_STATE_MASK; + + /* set TF_CONNECT/TF_LISTEN if needed */ + switch (flags & (ITP_CONNECT | ITP_LISTEN | ITP_ESTABLISHED)) { + case ITP_CONNECT: + sr->flags |= TF_CONNECT; + ip_tproxy_kill_conntracks(sr, 0, 0, 1); + break; + case ITP_LISTEN: + if (sr->flags & TF_CONNECT_ONLY) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS sr %p: " + "trying to set ITP_LISTEN on a connect only sockref\n", + sr); + res = -EINVAL; + break; + } + sr->flags |= TF_LISTEN; + ip_tproxy_kill_conntracks(sr, 0, 0, 1); + break; + case ITP_ESTABLISHED: + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS: establishing sr %p " + "raddr:rport %08x:%04x daddr:dport %08x:%04x\n", + sr, sr->raddr, sr->rport, inet->daddr, inet->dport); + + if (sr->raddr == 0 || sr->rport == 0) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS sr %p: " + "trying to set ITP_ESTABLISHED on a not connected sockref\n", + sr); + res = -EINVAL; + } + sr->flags |= TF_LISTEN | TF_CONNECT; + ip_tproxy_kill_conntracks(sr, 0, 0, 1); + break; + default: + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS sr %p: " + "invalid combination of flags %x\n", sr, flags); + /* FIXME: indicate error, if no CONNECT/LISTEN/ESTABLISHED was given? */ + break; + } + + /* Set TF_NAT_ONCE and TF_UNIDIR if needed */ + sr->flags |= (flags & ITP_ONCE ? TF_NAT_ONCE : 0) | + (flags & ITP_UNIDIR ? TF_UNIDIR : 0); + +#ifdef CONFIG_IP_NF_NAT_NRES + /* reserve NAT mappings if raddr is specified and sk->sk_reuse is set */ + if (flags & (ITP_CONNECT | ITP_ESTABLISHED) && + sr->faddr && sr->fport && sr->raddr && sr->rport && sk->sk_reuse) { + if (ip_tproxy_nat_reserve(sr->faddr, sr->fport, proto, sr->raddr, sr->rport)) { + sr->flags |= (TF_NAT_RESERVED | TF_NAT_PEER); + } else { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS sr %p: " + "failed to register NAT reservation\n", sr); + res = -EINVAL; + goto write_unlk; + } + } +#endif + + write_unlk: + write_unlock_bh(&ip_tproxy_lock); + + return res; +} + +static int +ip_tproxy_setsockopt_alloc(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0; + struct ip_tproxy_sockref *sr; + struct inet_sock *inet = inet_sk(sk); + + /* we'd like to force allocation of a unique foreign address, if one's not specified */ + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ALLOC %08x:%04x\n", + inet->rcv_saddr, inet->sport); + + write_lock_bh(&ip_tproxy_lock); + sr = ip_tproxy_sockref_find_local(inet->rcv_saddr, inet->sport, proto, 0, inet->daddr, inet->dport); + if (!sr) { + res = -ENOENT; + goto write_unlk; + } + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_ALLOC sr %p, current foreign " + "%08x:%04x\n", sr, sr->faddr, sr->fport); + + if (sr->flags & TF_MARK_ONLY) { + DEBUGP("IP_TPROXY: IP_TPROXY_ALLOC sr %p mark only, " + "doing nothing\n", sr); + goto write_unlk; + } + + if (sr->faddr && sr->fport) { + /* foreign port already assigned */ + res = -EINVAL; + goto write_unlk; + } + + if (ip_tproxy_sockref_uniq(sr) == 0) { + /* allocating a foreign port failed */ + DEBUGP(KERN_DEBUG "IP_TPROXY: failed to allocate foreign port " + "for listening sockref\n"); + res = -EFAULT; + goto write_unlk; + } + + write_unlk: + write_unlock_bh(&ip_tproxy_lock); + + return res; +} + +static int +ip_tproxy_setsockopt_connect(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0; + struct ip_tproxy_sockref *sr; + struct inet_sock *inet = inet_sk(sk); + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_CONNECT %08x:%04x\n", + inet->rcv_saddr, inet->sport); + + /* Look up in the local sockref hash */ + read_lock_bh(&ip_tproxy_lock); + sr = ip_tproxy_sockref_find_local(inet->rcv_saddr, inet->sport, proto, + 0, inet->daddr, inet->dport); + if (!sr) { + res = -ENOENT; + goto read_unlk; + } + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_CONNECT sr %p, current " + "raddr:rport %08x:%04x\n", sr, sr->raddr, sr->rport); + + if (sr->flags & TF_MARK_ONLY) { + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_CONNECT sr %p " + "mark only\n", sr); + goto read_unlk; + } + + /* store remote address */ + if (itp->v.addr.faddr.s_addr && itp->v.addr.fport) { + sr->raddr = itp->v.addr.faddr.s_addr; + sr->rport = itp->v.addr.fport; + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_CONNECT sr %p, " + "new raddr:rport %08x:%04x\n", sr, sr->raddr, sr->rport); + } + + read_unlk: + read_unlock_bh(&ip_tproxy_lock); + + return res; +} + +static int +ip_tproxy_setsockopt(struct sock *sk, int optval, void __user *user, unsigned int len) +{ + int proto; + int res = 0; + unsigned int mlen; + struct in_tproxy itp; + + /* get protocol number of the socket */ + if ((proto = ip_tproxy_get_sk_proto(sk)) == 0) + return -EINVAL; + + if (len < sizeof(itp.op) + sizeof(itp.v.version)) + return -EINVAL; + + mlen = MIN(sizeof(itp), len); + + if (copy_from_user(&itp, user, mlen)) + return -EFAULT; + + switch (itp.op) { + case TPROXY_VERSION: + res = ip_tproxy_setsockopt_version(sk, proto, &itp); + break; + case TPROXY_ASSIGN: + res = ip_tproxy_setsockopt_assign(sk, proto, &itp); + break; + case TPROXY_UNASSIGN: + res = ip_tproxy_setsockopt_unassign(sk, proto, &itp); + break; + case TPROXY_FLAGS: + res = ip_tproxy_setsockopt_flags(sk, proto, &itp); + break; + case TPROXY_ALLOC: + res = ip_tproxy_setsockopt_alloc(sk, proto, &itp); + break; + case TPROXY_CONNECT: + res = ip_tproxy_setsockopt_connect(sk, proto, &itp); + break; + default: + res = -ENOPROTOOPT; + break; + } + + return res; +} + +static int +ip_tproxy_getsockopt_version(struct sock *sk, int proto, struct in_tproxy *itp) +{ + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_VERSION\n"); + + itp->v.version = TPROXY_FULL_VERSION; + + return 0; +} + +static int +ip_tproxy_getsockopt_query(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0; + struct ip_tproxy_sockref *sr; + struct inet_sock *inet = inet_sk(sk); + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_QUERY %08x:%04x\n", + inet->rcv_saddr, inet->sport); + + read_lock_bh(&ip_tproxy_lock); + + sr = ip_tproxy_sockref_find_local(inet->rcv_saddr, inet->sport, proto, + 0, inet->daddr, inet->dport); + if (sr) { + itp->v.addr.faddr.s_addr = sr->faddr; + itp->v.addr.fport = sr->fport; + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_QUERY found sr %p " + "faddr:fport %08x:%04x\n", sr, sr->faddr, sr->fport); + } else + res = -ENOENT; + + read_unlock_bh(&ip_tproxy_lock); + + return res; +} + +static int +ip_tproxy_getsockopt_flags(struct sock *sk, int proto, struct in_tproxy *itp) +{ + int res = 0; + u_int32_t flags; + struct ip_tproxy_sockref *sr; + struct inet_sock *inet = inet_sk(sk); + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS get %08x:%04x\n", + inet->rcv_saddr, inet->sport); + + read_lock_bh(&ip_tproxy_lock); + + sr = ip_tproxy_sockref_find_local(inet->rcv_saddr, inet->sport, proto, + 0, inet->daddr, inet->dport); + if (!sr) { + res = -ENOENT; + goto read_unlk; + } + + flags = 0; + if ((sr->flags & (TF_CONNECT+TF_LISTEN)) == (TF_CONNECT+TF_LISTEN)) + flags |= ITP_ESTABLISHED; + else if (sr->flags & TF_CONNECT) + flags |= ITP_CONNECT; + else if (sr->flags & TF_LISTEN) + flags |= ITP_LISTEN; + + if (sr->flags & TF_UNIDIR) + flags |= ITP_UNIDIR; + if (sr->flags & TF_NAT_ONCE) + flags |= ITP_ONCE; + if (sr->flags & TF_MARK_ONLY) + flags |= ITP_MARK; + if (sr->flags & TF_NAT_APPLIED) + flags |= ITP_APPLIED; + + DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_FLAGS found sr %p faddr:fport " + "%08x:%04x flags %08x\n", sr, sr->faddr, sr->fport, sr->flags); + + itp->v.flags = flags; + + read_unlk: + read_unlock_bh(&ip_tproxy_lock); + + return res; +} + +static int +ip_tproxy_getsockopt(struct sock *sk, int optval, void __user *user, int *len) +{ + int proto; + int res = 0; + unsigned int mlen; + struct in_tproxy itp; + + if ((proto = ip_tproxy_get_sk_proto(sk)) == 0) + return -EINVAL; + + if (*len < sizeof(itp.op) + sizeof(itp.v.version)) + return -EINVAL; + + mlen = MIN(sizeof(itp), *len); + + if (copy_from_user(&itp, user, mlen)) + return -EFAULT; + + switch (itp.op) { + case TPROXY_VERSION: + res = ip_tproxy_getsockopt_version(sk, proto, &itp); + break; + case TPROXY_QUERY: + res = ip_tproxy_getsockopt_query(sk, proto, &itp); + break; + case TPROXY_FLAGS: + res = ip_tproxy_getsockopt_flags(sk, proto, &itp); + break; + default: + res = -ENOPROTOOPT; + break; + } + + /* copy data to userspace */ + /* FIXME: we do this even when res != 0, is this a problem? */ + if (copy_to_user(user, &itp, mlen)) + res = -EFAULT; + + return res; +} + +/* callback function: called when a socket gets unhashed by the UDP or TCP stack */ +static void +ip_tproxy_close(struct sock *sk, int proto) +{ + if (proto) + ip_tproxy_setsockopt_unassign(sk, proto, NULL); +} + +/* fake timeout function needed by the fake conntrack entry, in theory, it never + * runs */ +static void +ip_tproxy_fake_timeout(unsigned long null_ptr) +{ + printk("IP_TPROXY: Fake timeout called!"); +} + +static struct nf_hook_ops ip_tproxy_pre_ops = { + .hook = ip_tproxy_fn, + .owner = THIS_MODULE, + .pf = PF_INET, + .hooknum = NF_IP_PRE_ROUTING, + .priority = -130 +}; + +static struct nf_hook_ops ip_tproxy_post_ops = { + .hook = ip_tproxy_fn, + .owner = THIS_MODULE, + .pf = PF_INET, + .hooknum = NF_IP_POST_ROUTING, + .priority = -130 +}; + +static struct nf_hook_ops ip_tproxy_local_out_ops = { + .hook = ip_tproxy_fn, + .owner = THIS_MODULE, + .pf = PF_INET, + .hooknum = NF_IP_LOCAL_OUT, + .priority = -130 +}; + +static struct nf_sockopt_ops ip_tproxy_sockopts = { + .pf = PF_INET, + .set_optmin = IP_TPROXY, + .set_optmax = IP_TPROXY + 1, + .set = ip_tproxy_setsockopt, + .get_optmin = IP_TPROXY, + .get_optmax = IP_TPROXY + 1, + .get = ip_tproxy_getsockopt, +}; + +/* init or cleanup the tproxy module */ +static int +init_or_cleanup(int startup) +{ + int ret = 0; + int i; + struct proc_dir_entry *proc; + + if (!startup) { + goto clean_all; + } + + /* we depend on the NAT hooks being operational */ + need_nat_hooks(); + + /* use our own fake conntrack entry, which indicates that packet was + tproxied, this let's us use the same -m tproxy match in our filter + rules. The original idea of using a fake conntrack entry to avoid + conntracking is by Jozsef Kadlecsik */ + + atomic_set(&ip_tproxy_fake_ct.ct_general.use, 1); + ip_tproxy_fake_ct.timeout.function = ip_tproxy_fake_timeout; + ip_tproxy_fake_ct.status |= IPS_CONFIRMED | IPS_TPROXY | IPS_NAT_DONE_MASK; + + ip_tproxy_sockref_table = kmem_cache_create("ip_tproxy", sizeof(struct ip_tproxy_sockref), 0, + SLAB_HWCACHE_ALIGN, NULL, NULL); + + if (!ip_tproxy_sockref_table) { + ret = -ENOMEM; + goto clean_nothing; + } + + if (hashsize) + ip_tproxy_htable_size = hashsize; + else + ip_tproxy_htable_size = 127; + + ip_tproxy_bylocal = (struct list_head *) vmalloc(sizeof(struct list_head) * + ip_tproxy_htable_size * 2); + if (!ip_tproxy_bylocal) { + ret = -ENOMEM; + goto clean_sockref_table; + } + ip_tproxy_byforeign = (struct list_head *) ip_tproxy_bylocal + ip_tproxy_htable_size; + + for (i = 0; i < ip_tproxy_htable_size; i++) { + INIT_LIST_HEAD(&ip_tproxy_bylocal[i]); + INIT_LIST_HEAD(&ip_tproxy_byforeign[i]); + } + + proc = proc_net_create("tproxy", 0, NULL); + if (!proc) goto clean_sockref_hash; + proc->proc_fops = &ip_tproxy_file_ops; + + ret = ipt_register_table(&tproxy_table, &initial_table.repl); + if (ret < 0) { + printk("IP_TPROXY: can't register tproxy table.\n"); + goto clean_proc; + } + + ret = nf_register_hook(&ip_tproxy_local_out_ops); + if (ret < 0) { + printk("IP_TPROXY: can't register local out hook.\n"); + goto clean_table; + } + + ret = nf_register_hook(&ip_tproxy_post_ops); + if (ret < 0) { + printk("IP_TPROXY: can't register postrouting hook.\n"); + goto clean_loops; + } + + ret = nf_register_hook(&ip_tproxy_pre_ops); + if (ret < 0) { + printk("IP_TPROXY: can't register prerouting hook.\n"); + goto clean_postops; + } + + nf_register_sockopt(&ip_tproxy_sockopts); + + ip_tproxy_udp_unhashed = ip_tproxy_close; + ip_tproxy_tcp_unhashed = ip_tproxy_close; + + /* initialize confirm and destroy callbacks */ + ip_conntrack_confirmed = ip_tproxy_confirmed; + ip_conntrack_destroyed_old = ip_conntrack_destroyed; + ip_conntrack_destroyed = ip_tproxy_conntrack_destroyed; + + printk("IP_TPROXY: Transparent proxy support initialized 2.0.6\n" + "IP_TPROXY: Copyright (c) 2002-2006 BalaBit IT Ltd.\n"); + return ret; + + clean_all: + ip_conntrack_destroyed = ip_conntrack_destroyed_old; + ip_conntrack_confirmed = NULL; + + ip_tproxy_udp_unhashed = NULL; + ip_tproxy_tcp_unhashed = NULL; + + nf_unregister_sockopt(&ip_tproxy_sockopts); + + nf_unregister_hook(&ip_tproxy_pre_ops); + + clean_postops: + nf_unregister_hook(&ip_tproxy_post_ops); + + clean_loops: + nf_unregister_hook(&ip_tproxy_local_out_ops); + + clean_table: + ipt_unregister_table(&tproxy_table); + + clean_proc: + proc_net_remove("tproxy"); + + clean_sockref_hash: + ip_tproxy_sockref_table_free(); + vfree(ip_tproxy_bylocal); + + clean_sockref_table: + kmem_cache_destroy(ip_tproxy_sockref_table); + + clean_nothing: + return ret; +} + +static int __init init(void) +{ + return init_or_cleanup(1); +} + +static void __exit fini(void) +{ + init_or_cleanup(0); +} + +module_init(init); +module_exit(fini); +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Balázs Scheidler "); +MODULE_DESCRIPTION("Netfilter transparent proxy core module."); diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 4b04c3e..6e8071c 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1886,6 +1886,10 @@ EXPORT_SYMBOL(tcp_v4_remember_stamp); EXPORT_SYMBOL(tcp_v4_send_check); EXPORT_SYMBOL(tcp_v4_syn_recv_sock); +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +EXPORT_SYMBOL(ip_tproxy_tcp_unhashed); +#endif + #ifdef CONFIG_PROC_FS EXPORT_SYMBOL(tcp_proc_register); EXPORT_SYMBOL(tcp_proc_unregister); diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 624e2b2..f7a95b9 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -27,6 +27,7 @@ #include #include #include #include +#include #ifdef CONFIG_SYSCTL #define SYNC_INIT 0 /* let the user enable it */ diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index f136cec..263e1e8 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -207,8 +207,18 @@ static void udp_v4_hash(struct sock *sk) BUG(); } +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +void (*ip_tproxy_udp_unhashed)(struct sock *sk, int proto) = NULL; +#endif + static void udp_v4_unhash(struct sock *sk) { +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + /* ugly tproxy unassign hook */ + if (ip_tproxy_udp_unhashed) + ip_tproxy_udp_unhashed(sk, IPPROTO_UDP); +#endif + write_lock_bh(&udp_hash_lock); if (sk_del_node_init(sk)) { inet_sk(sk)->num = 0; @@ -1586,6 +1596,10 @@ EXPORT_SYMBOL(udp_prot); EXPORT_SYMBOL(udp_sendmsg); EXPORT_SYMBOL(udp_poll); +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) +EXPORT_SYMBOL(ip_tproxy_udp_unhashed); +#endif + #ifdef CONFIG_PROC_FS EXPORT_SYMBOL(udp_proc_register); EXPORT_SYMBOL(udp_proc_unregister); cttproxy-2.6.18-2.0.6/patch_tree/03-nat_delete.patch0000644000175000017500000002544710547474236021130 0ustar hiddenhiddendiff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h index 81392e5..b727243 100644 --- a/include/linux/netfilter/nf_conntrack_common.h +++ b/include/linux/netfilter/nf_conntrack_common.h @@ -81,6 +81,9 @@ #if defined(CONFIG_IP_NF_TPROXY) || defi IPS_TPROXY_RELATED_BIT = 12, IPS_TPROXY_RELATED = (1 << IPS_TPROXY_RELATED_BIT), + + IPS_MAY_DELETE_BIT = 12, + IPS_MAY_DELETE = (1 << IPS_MAY_DELETE_BIT), #endif }; diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h index 4369150..44c19ad 100644 --- a/include/linux/netfilter_ipv4/ip_conntrack.h +++ b/include/linux/netfilter_ipv4/ip_conntrack.h @@ -244,6 +244,8 @@ static inline void ip_ct_refresh(struct __ip_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0); } +extern void __death_by_timeout(unsigned long ul_conntrack); + /* These are for NAT. Icky. */ /* Update TCP window tracking data when NAT mangles the packet */ extern void ip_conntrack_tcp_update(struct sk_buff *skb, diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c index b96427b..4ee301a 100644 --- a/net/ipv4/netfilter/ip_conntrack_core.c +++ b/net/ipv4/netfilter/ip_conntrack_core.c @@ -366,6 +366,50 @@ destroy_conntrack(struct nf_conntrack *n ip_conntrack_free(ct); } +static void +__destroy_conntrack(struct nf_conntrack *nfct) +{ + struct ip_conntrack *ct = (struct ip_conntrack *)nfct; + struct ip_conntrack_protocol *proto; + + DEBUGP("destroy_conntrack(%p)\n", ct); + IP_NF_ASSERT(atomic_read(&nfct->use) == 0); + IP_NF_ASSERT(!timer_pending(&ct->timeout)); + + ip_conntrack_event(IPCT_DESTROY, ct); + set_bit(IPS_DYING_BIT, &ct->status); + + /* To make sure we don't get any weird locking issues here: + * destroy_conntrack() MUST NOT be called with a write lock + * to ip_conntrack_lock!!! -HW */ + proto = __ip_conntrack_proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum); + if (proto && proto->destroy) + proto->destroy(ct); + + if (ip_conntrack_destroyed) + ip_conntrack_destroyed(ct); + + /* Expectations will have been removed in clean_from_lists, + * except TFTP can create an expectation on the first packet, + * before connection is in the list, so we need to clean here, + * too. */ + ip_ct_remove_expectations(ct); + + /* We overload first tuple to link into unconfirmed list. */ + if (!is_confirmed(ct)) { + BUG_ON(list_empty(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list)); + list_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list); + } + + CONNTRACK_STAT_INC(delete); + + if (ct->master) + ip_conntrack_put(ct->master); + + DEBUGP("destroy_conntrack: returning ct=%p to slab\n", ct); + ip_conntrack_free(ct); +} + static void death_by_timeout(unsigned long ul_conntrack) { struct ip_conntrack *ct = (void *)ul_conntrack; @@ -379,6 +423,19 @@ static void death_by_timeout(unsigned lo ip_conntrack_put(ct); } +void __death_by_timeout(unsigned long ul_conntrack) +{ + struct ip_conntrack *ct = (void *)ul_conntrack; + + /* Inside lock so preempt is disabled on module removal path. + * Otherwise we can get spurious warnings. */ + CONNTRACK_STAT_INC(delete_list); + clean_from_lists(ct); + + if (atomic_dec_and_test(&ct->ct_general.use)) + __destroy_conntrack((struct nf_conntrack *)ct); +} + static inline int conntrack_tuple_cmp(const struct ip_conntrack_tuple_hash *i, const struct ip_conntrack_tuple *tuple, diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c index fb920e7..fd51229 100644 --- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c +++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c @@ -31,6 +31,7 @@ #include #include +#include #include #include #include @@ -983,6 +984,15 @@ static int tcp_packet(struct ip_conntrac NULL, "ip_ct_tcp: invalid SYN"); return -NF_ACCEPT; } +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + case TCP_CONNTRACK_TIME_WAIT: + /* Set MAY_DELETE if NAT subsystem may drop connection when it is clashing */ + if (test_bit(IPS_TPROXY_BIT, &conntrack->status)) { + DEBUGP(KERN_DEBUG "Marking TPROXY-related TIME_WAIT conntrack entry MAY_DELETE\n"); + set_bit(IPS_MAY_DELETE_BIT, &conntrack->status); + } + break; +#endif case TCP_CONNTRACK_CLOSE: if (index == TCP_RST_SET && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status) diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c index 260c281..6f7c072 100644 --- a/net/ipv4/netfilter/ip_conntrack_standalone.c +++ b/net/ipv4/netfilter/ip_conntrack_standalone.c @@ -972,3 +972,6 @@ #if defined(CONFIG_IP_NF_CONNTRACK_NETLI EXPORT_SYMBOL_GPL(ip_ct_port_tuple_to_nfattr); EXPORT_SYMBOL_GPL(ip_ct_port_nfattr_to_tuple); #endif +#if defined(CONFIG_IP_NF_TPROXY) || defined(CONFIG_IP_NF_TPROXY_MODULE) +EXPORT_SYMBOL_GPL(__death_by_timeout); +#endif diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c index 262f36e..47bbe94 100644 --- a/net/ipv4/netfilter/ip_nat_core.c +++ b/net/ipv4/netfilter/ip_nat_core.c @@ -26,6 +26,7 @@ #include #define ASSERT_READ_LOCK(x) #define ASSERT_WRITE_LOCK(x) +#include #include #include #include @@ -122,6 +123,15 @@ static void ip_nat_cleanup_conntrack(str write_unlock_bh(&ip_nat_lock); } +static void __ip_nat_cleanup_conntrack(struct ip_conntrack *conn) +{ + if (!(conn->status & IPS_NAT_DONE_MASK)) + return; + + list_del(&conn->nat.info.bysource); +} + + /* We do checksum mangling, so if they were wrong before they're still * wrong. Also works for incomplete packets (eg. ICMP dest * unreachables.) */ @@ -251,7 +261,8 @@ __ip_nat_reserved_new_hash(const struct const struct ip_conntrack_manip *peer) { struct ip_nat_reserved *res; - unsigned int h; + struct ip_conntrack_tuple_hash *h = NULL; + unsigned int hash; DEBUGP("__ip_nat_reserved_new_hash: manip proto %u %u.%u.%u.%u:%u\n", proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); @@ -283,25 +294,61 @@ __ip_nat_reserved_new_hash(const struct .dst = {.protonum = proto, .ip = manip->ip, .u = {.all = manip->u.all}}}; + struct ip_conntrack *ctrack; + + h = ip_conntrack_find_get(&t, NULL); + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + if ((h != NULL) && + (ctrack = tuplehash_to_ctrack(h)) && + test_bit(IPS_MAY_DELETE_BIT, &ctrack->status)) { + DEBUGP("Deleting old conntrack entry for NAT\n"); + __ip_nat_cleanup_conntrack(ctrack); + ctrack->status &= ~IPS_NAT_DONE_MASK; + if (del_timer(&ctrack->timeout)) + ctrack->timeout.function((unsigned long)ctrack); + ip_conntrack_put(ctrack); + h = NULL; + } +#endif - if (ip_conntrack_tuple_taken(&t, NULL)) { + if (h) { DEBUGP("__ip_nat_reserved_new_hash: manip clashes with an already existing connection\n"); + ip_conntrack_put(tuplehash_to_ctrack(h)); return NULL; } } else { /* Strong check: we have only a manip, unfortunately we scan the whole conntrack * hash for possible clashing connections... */ - struct ip_conntrack_tuple_hash *h = NULL; unsigned int i; + int repeat; + struct ip_conntrack *ctrack; - read_lock_bh(&ip_conntrack_lock); + write_lock_bh(&ip_conntrack_lock); for (i = 0; !h && i < ip_conntrack_htable_size; i++) { - h = LIST_FIND(&ip_conntrack_hash[i], clashing_ct_cmp, - struct ip_conntrack_tuple_hash *, manip); + do { + repeat = 0; + h = LIST_FIND(&ip_conntrack_hash[i], clashing_ct_cmp, + struct ip_conntrack_tuple_hash *, manip); +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + if ((h != NULL) && + (ctrack = tuplehash_to_ctrack(h)) && + test_bit(IPS_MAY_DELETE_BIT, &ctrack->status)) { + DEBUGP("Deleting old conntrack entry for NAT\n"); + __ip_nat_cleanup_conntrack(ctrack); + ctrack->status &= ~IPS_NAT_DONE_MASK; + if (del_timer(&ctrack->timeout)) + __death_by_timeout((unsigned long)ctrack); + h = NULL; + repeat = 1; + } +#endif + } while (repeat); + /* there's a clashing connection, break */ if (h) break; } - read_unlock_bh(&ip_conntrack_lock); + write_unlock_bh(&ip_conntrack_lock); if (h) { DEBUGP("__ip_nat_reserved_new_hash: manip clashes with an already existing connection\n"); return NULL; @@ -320,9 +367,9 @@ __ip_nat_reserved_new_hash(const struct res->peer = *peer; /* put it into the hash */ - h = hash_nat_reserved(manip, peer, proto); + hash = hash_nat_reserved(manip, peer, proto); atomic_inc(&ip_nat_reserved_count); - list_prepend(&natreserved[h], &res->hash); + list_prepend(&natreserved[hash], &res->hash); DEBUGP("__ip_nat_reserved_new_hash: hashed manip proto %u %u.%u.%u.%u:%u\n", proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); @@ -497,6 +544,8 @@ ip_nat_used_tuple(const struct ip_conntr We could keep a separate hash if this proves too slow. */ struct ip_conntrack_tuple reply; + struct ip_conntrack_tuple_hash *h; + struct ip_conntrack *ctrack; #ifdef CONFIG_IP_NF_NAT_NRES struct ip_nat_reserved *res; @@ -512,8 +561,29 @@ #ifdef CONFIG_IP_NF_NAT_NRES } #endif + /* check if it's taken by an existing connection */ invert_tuplepr(&reply, tuple); - return ip_conntrack_tuple_taken(&reply, ignored_conntrack); + h = ip_conntrack_find_get(&reply, ignored_conntrack); + +#if defined(CONFIG_IP_NF_TPROXY) || defined (CONFIG_IP_NF_TPROXY_MODULE) + /* check if that conntrack is marked MAY_DELETE, if so, get rid of it... */ + if ((h != NULL) && + (ctrack = tuplehash_to_ctrack(h)) && + test_bit(IPS_MAY_DELETE_BIT, &ctrack->status)) { + DEBUGP("Deleting old conntrack entry for NAT\n"); + __ip_nat_cleanup_conntrack(ctrack); + ctrack->status &= ~IPS_NAT_DONE_MASK; + if (del_timer(&ctrack->timeout)) + ctrack->timeout.function((unsigned long)ctrack); + ip_conntrack_put(ctrack); + h = NULL; + } +#endif + + if (h) + ip_conntrack_put(tuplehash_to_ctrack(h)); + + return h != NULL; } EXPORT_SYMBOL(ip_nat_used_tuple); diff --git a/net/ipv4/netfilter/iptable_tproxy.c b/net/ipv4/netfilter/iptable_tproxy.c index ea35da7..4b46463 100644 --- a/net/ipv4/netfilter/iptable_tproxy.c +++ b/net/ipv4/netfilter/iptable_tproxy.c @@ -1356,7 +1356,7 @@ ip_tproxy_setsockopt_unassign(struct soc if (!sr) { DEBUGP(KERN_DEBUG "IP_TPROXY: IP_TPROXY_UNASSIGN not unhashing socket, " "%08x:%04x, proto=%d, sk->state=%d\n", - saddr, sport, proto, sk->sk_socket ? sk->sk_socket->state : -1); + saddr, sport, proto, sk->sk_state); res = -ENOENT; goto write_unlk; } cttproxy-2.6.18-2.0.6/patch_tree/01-nat_reservations.patch0000644000175000017500000006167210547474230022402 0ustar hiddenhiddendiff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h index 51dbec1..440e444 100644 --- a/include/linux/netfilter_ipv4/ip_conntrack.h +++ b/include/linux/netfilter_ipv4/ip_conntrack.h @@ -164,6 +164,11 @@ #ifdef CONFIG_IP_NF_NAT_NEEDED /* Direction relative to the master connection. */ enum ip_conntrack_dir dir; #endif + +#ifdef CONFIG_IP_NF_NAT_NRES + /* List of registered reservations */ + struct list_head reserved_list; +#endif }; #define IP_CT_EXPECT_PERMANENT 0x1 @@ -239,6 +244,10 @@ extern void ip_conntrack_tcp_update(stru /* Call me when a conntrack is destroyed. */ extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack); +#ifdef CONFIG_IP_NF_NAT_NRES +/* Call when an expectation is destroyed. */ +extern void (*ip_conntrack_expect_destroyed)(struct ip_conntrack_expect *exp); +#endif /* Fake conntrack entry for untracked connections */ extern struct ip_conntrack ip_conntrack_untracked; diff --git a/include/linux/netfilter_ipv4/ip_nat.h b/include/linux/netfilter_ipv4/ip_nat.h index e9f5ed1..0337a85 100644 --- a/include/linux/netfilter_ipv4/ip_nat.h +++ b/include/linux/netfilter_ipv4/ip_nat.h @@ -17,6 +17,10 @@ #define HOOK2MANIP(hooknum) ((hooknum) ! #define IP_NAT_RANGE_MAP_IPS 1 #define IP_NAT_RANGE_PROTO_SPECIFIED 2 +#ifdef CONFIG_IP_NF_NAT_NRES +#define IP_NAT_RANGE_USE_RESERVED 8 +#endif + /* NAT sequence number modifications */ struct ip_nat_seq { /* position of the last TCP sequence number @@ -63,6 +67,18 @@ struct ip_nat_info struct ip_conntrack; +#ifdef CONFIG_IP_NF_NAT_NRES +/* Structure to store reserved manips */ +struct ip_nat_reserved { + struct list_head hash; /* Hash chain */ + struct list_head exp; /* Per-expectation list */ + atomic_t use; /* Reference count */ + struct ip_conntrack_manip manip; /* Reserved manip */ + struct ip_conntrack_manip peer; /* Peer (optional) */ + u_int16_t proto; /* Protocol number of reserved manip */ +}; +#endif + /* Set up the info structure to map into this range. */ extern unsigned int ip_nat_setup_info(struct ip_conntrack *conntrack, const struct ip_nat_range *range, @@ -70,12 +86,45 @@ extern unsigned int ip_nat_setup_info(st /* Is this tuple already taken? (not by us)*/ extern int ip_nat_used_tuple(const struct ip_conntrack_tuple *tuple, - const struct ip_conntrack *ignored_conntrack); + const struct ip_conntrack *ignored_conntrack, + const enum ip_nat_manip_type maniptype, + const unsigned int flags); /* Calculate relative checksum. */ extern u_int16_t ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck); + +#ifdef CONFIG_IP_NF_NAT_NRES +struct ip_conntrack_expect; + +/* NAT port reservation: allocate and hash a new entry */ +extern struct ip_nat_reserved *__ip_nat_reserved_new_hash(const struct ip_conntrack_manip *manip, + const u_int16_t proto, const struct ip_conntrack_manip *peer); + +/* NAT port reservation: unhash an entry */ +extern struct ip_nat_reserved *__ip_nat_reserved_unhash(const struct ip_conntrack_manip *manip, + const u_int16_t proto, const struct ip_conntrack_manip *peer); + +/* NAT port reservation: free a reservation */ +extern void __ip_nat_reserved_free(struct ip_nat_reserved *res); + +/* NAT port reservation: register a new reservation */ +extern int ip_nat_reserved_register(struct ip_conntrack_expect *exp, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer); + +/* NAT port reservation: unregister a reservation */ +extern int ip_nat_reserved_unregister(struct ip_conntrack_expect *exp, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer); + +/* NAT port reservation: unregister all reservations for a given expectation */ +extern void ip_nat_reserved_unregister_all(struct ip_conntrack_expect *exp); +#endif /*CONFIG_IP_NF_NAT_NRES*/ + #else /* !__KERNEL__: iptables wants this to compile. */ #define ip_nat_multi_range ip_nat_multi_range_compat #endif /*__KERNEL__*/ diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index ef0b5aa..ac751c7 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -474,6 +474,16 @@ config IP_NF_TARGET_SAME To compile it as a module, choose M here. If unsure, say N. +config IP_NF_NAT_NRES + bool "NAT reservations support" + depends on IP_NF_NAT + help + This option enables support for NAT reservations. This makes + transparent proxying more reliable, but unneeded if you don't + need TProxy support. + + If unsure, say 'N'. + config IP_NF_NAT_SNMP_BASIC tristate "Basic SNMP-ALG support (EXPERIMENTAL)" depends on EXPERIMENTAL && IP_NF_NAT diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c index aa45917..f9349bf 100644 --- a/net/ipv4/netfilter/ip_conntrack_core.c +++ b/net/ipv4/netfilter/ip_conntrack_core.c @@ -63,6 +63,9 @@ DEFINE_RWLOCK(ip_conntrack_lock); atomic_t ip_conntrack_count = ATOMIC_INIT(0); void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack) = NULL; +#ifdef CONFIG_IP_NF_NAT_NRES +void (*ip_conntrack_expect_destroyed)(struct ip_conntrack_expect *expect) = NULL; +#endif LIST_HEAD(ip_conntrack_expect_list); struct ip_conntrack_protocol *ip_ct_protos[MAX_IP_CT_PROTO]; static LIST_HEAD(helpers); @@ -207,6 +210,12 @@ void ip_ct_unlink_expect(struct ip_connt list_del(&exp->list); CONNTRACK_STAT_INC(expect_delete); exp->master->expecting--; + +#ifdef CONFIG_IP_NF_NAT_NRES + if (ip_conntrack_expect_destroyed) + ip_conntrack_expect_destroyed(exp); +#endif + ip_conntrack_expect_put(exp); } @@ -952,6 +961,9 @@ struct ip_conntrack_expect *ip_conntrack } new->master = me; atomic_set(&new->use, 1); +#ifdef CONFIG_IP_NF_NAT_NRES + INIT_LIST_HEAD(&new->reserved_list); +#endif return new; } diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c index 7a9fa04..c050399 100644 --- a/net/ipv4/netfilter/ip_conntrack_standalone.c +++ b/net/ipv4/netfilter/ip_conntrack_standalone.c @@ -930,6 +930,9 @@ EXPORT_SYMBOL_GPL(__ip_conntrack_expect_ EXPORT_SYMBOL_GPL(ip_conntrack_expect_find); EXPORT_SYMBOL(ip_conntrack_expect_related); EXPORT_SYMBOL(ip_conntrack_unexpect_related); +#ifdef CONFIG_IP_NF_NAT_NRES +EXPORT_SYMBOL(ip_conntrack_expect_destroyed); +#endif EXPORT_SYMBOL_GPL(ip_conntrack_expect_list); EXPORT_SYMBOL_GPL(ip_ct_unlink_expect); diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c index 1741d55..d40df7e 100644 --- a/net/ipv4/netfilter/ip_nat_core.c +++ b/net/ipv4/netfilter/ip_nat_core.c @@ -14,6 +14,7 @@ #include #include #include #include +#include #include #include #include @@ -46,6 +47,12 @@ DEFINE_RWLOCK(ip_nat_lock); /* Calculated at init based on memory size */ static unsigned int ip_nat_htable_size; +#ifdef CONFIG_IP_NF_NAT_NRES +static kmem_cache_t *ip_nat_reserved_cachep; +static atomic_t ip_nat_reserved_count; +static struct list_head *natreserved; +#endif + static struct list_head *bysource; #define MAX_IP_NAT_PROTO 256 @@ -90,6 +97,19 @@ hash_by_src(const struct ip_conntrack_tu tuple->dst.protonum, 0) % ip_nat_htable_size; } +#ifdef CONFIG_IP_NF_NAT_NRES +static inline unsigned int +hash_nat_reserved(const struct ip_conntrack_manip *foreign, + const struct ip_conntrack_manip *peer, + const u_int16_t proto) +{ + return jhash_3words(foreign->ip, + (proto << 16) + foreign->u.all, + (peer ? (peer->ip + peer->u.all) : 0), + 0) % ip_nat_htable_size; +} +#endif + /* Noone using conntrack by the time this called. */ static void ip_nat_cleanup_conntrack(struct ip_conntrack *conn) { @@ -113,10 +133,362 @@ ip_nat_cheat_check(u_int32_t oldvalinv, } EXPORT_SYMBOL(ip_nat_cheat_check); +#ifdef CONFIG_IP_NF_NAT_NRES +static inline int +reserved_manip_cmp(const struct ip_nat_reserved *i, + const struct ip_conntrack_manip *manip, + const u_int16_t proto) +{ + DEBUGP("reserved_manip_cmp: manip proto %u %u.%u.%u.%u:%u, " + "reservation proto %u %u.%u.%u.%u:%u\n peer %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all), + i->proto, NIPQUAD(i->manip.ip), ntohs(i->manip.u.all), + NIPQUAD(i->peer.ip), ntohs(i->peer.u.all)); + return (i->proto == proto && + i->manip.ip == manip->ip && i->manip.u.all == manip->u.all); +} + +static inline int +reserved_manip_cmp_peer(const struct ip_nat_reserved *i, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + DEBUGP("reserved_manip_cmp_peer: manip proto %u %u.%u.%u.%u:%u peer %u.%u.%u.%u:%u, " + "reservation proto %u %u.%u.%u.%u:%u peer %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all), + NIPQUAD(peer->ip), ntohs(peer->u.all), + i->proto, NIPQUAD(i->manip.ip), ntohs(i->manip.u.all), + NIPQUAD(i->peer.ip), ntohs(i->peer.u.all)); + + return (i->proto == proto && + i->manip.ip == manip->ip && i->manip.u.all == manip->u.all && + ((i->peer.ip == 0) || (i->peer.ip == peer->ip && i->peer.u.all == peer->u.all))); +} + +static inline int +reserved_manip_cmp_peer_exact(const struct ip_nat_reserved *i, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + DEBUGP("reserved_manip_cmp_peer_exact: manip proto %u %u.%u.%u.%u:%u peer %u.%u.%u.%u:%u, " + "reservation proto %u %u.%u.%u.%u:%u peer %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all), + NIPQUAD(peer->ip), ntohs(peer->u.all), + i->proto, NIPQUAD(i->manip.ip), ntohs(i->manip.u.all), + NIPQUAD(i->peer.ip), ntohs(i->peer.u.all)); + + return (i->proto == proto && + i->manip.ip == manip->ip && i->manip.u.all == manip->u.all && + i->peer.ip == peer->ip && i->peer.u.all == peer->u.all); +} + +/* Is this manip reserved? + * exact means full peer match is required, used for reservation deletion */ +static struct ip_nat_reserved * +__ip_nat_reserved_find_manip(const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer, + const int exact) +{ + struct ip_nat_reserved *i; + unsigned int h = hash_nat_reserved(manip, peer, proto); + + DEBUGP("__ip_nat_reserved_find_manip: find proto %u %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); + + if (peer) { + if (exact) + i = LIST_FIND(&natreserved[h], reserved_manip_cmp_peer_exact, + struct ip_nat_reserved *, manip, proto, peer); + else + i = LIST_FIND(&natreserved[h], reserved_manip_cmp_peer, + struct ip_nat_reserved *, manip, proto, peer); + } else + i = LIST_FIND(&natreserved[h], reserved_manip_cmp, + struct ip_nat_reserved *, manip, proto); + + return i; +} + +/* Is this tuple clashing with a reserved manip? */ +static struct ip_nat_reserved * +__ip_nat_reserved_find_tuple(const struct ip_conntrack_tuple *tuple, + enum ip_nat_manip_type maniptype) +{ + struct ip_conntrack_manip m = {.ip = tuple->dst.ip, .u = {.all = tuple->dst.u.all}}; + + if (maniptype == IP_NAT_MANIP_SRC) { + DEBUGP("__ip_nat_reserved_find_tuple: IP_NAT_MANIP_SRC search\n"); + return __ip_nat_reserved_find_manip(&tuple->src, tuple->dst.protonum, &m, 0); + } else { + DEBUGP("__ip_nat_reserved_find_tuple: IP_NAT_MANIP_DST search\n"); + return __ip_nat_reserved_find_manip(&m, tuple->dst.protonum, &tuple->src, 0); + } +} + +static inline int +clashing_ct_cmp(const struct ip_conntrack_tuple_hash *i, const void *data) +{ + const struct ip_conntrack_manip *m = (struct ip_conntrack_manip *) data; + const struct ip_conntrack_tuple *t = &i->tuple; + + /* FIXME: every connection has two entries, we should check only the REPLY direction */ + + DEBUGP("clashing_ct_cmp: manip %u.%u.%u.%u:%u ct reply src %u.%u.%u.%u:%u dst %u.%u.%u.%u:%u\n", + NIPQUAD(m->ip), ntohs(m->u.all), NIPQUAD(t->src.ip), ntohs(t->src.u.all), + NIPQUAD(t->dst.ip), ntohs(t->dst.u.all)); + return (((t->src.ip == m->ip) && (t->src.u.all == m->u.all)) || + ((t->dst.ip == m->ip) && (t->dst.u.all == m->u.all))); +} + +/* Create a new reservation */ +struct ip_nat_reserved * +__ip_nat_reserved_new_hash(const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + struct ip_nat_reserved *res; + unsigned int h; + + DEBUGP("__ip_nat_reserved_new_hash: manip proto %u %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); + + /* check if it's already reserved */ + if (__ip_nat_reserved_find_manip(manip, proto, peer, 1)) { + DEBUGP("__ip_nat_reserved_new_hash: already reserved\n"); + return NULL; + } + + /* FIXME: check if a clashing connection exists... This is problematic, + * since the final decision in ip_nat_used_tuple() is based on a full + * tuple, but we only have a manip... =(:< */ + + /* Current solutuion: we provide two methods for checking: + * - Strong check: in this case, the conntrack table is scanned if an + * already existing connection uses the manip in its REPLY direction. + * if such a conntrack entry is found, the mapping fails. This check is + * extremely pessimistic, since it fails to register reservations which could + * happily coexist with current conntracks if the other side of the tuple is + * different... + * - Exact check: if the callee provides a peer manip, then an exact lookup + * can be made in the conntrack hash. This is a more fine-grained check. + */ + + if (peer) { + /* Exact check */ + struct ip_conntrack_tuple t = {.src = *peer, + .dst = {.protonum = proto, + .ip = manip->ip, + .u = {.all = manip->u.all}}}; + + if (ip_conntrack_tuple_taken(&t, NULL)) { + DEBUGP("__ip_nat_reserved_new_hash: manip clashes with an already existing connection\n"); + return NULL; + } + } else { + /* Strong check: we have only a manip, unfortunately we scan the whole conntrack + * hash for possible clashing connections... */ + struct ip_conntrack_tuple_hash *h = NULL; + unsigned int i; + + read_lock_bh(&ip_conntrack_lock); + for (i = 0; !h && i < ip_conntrack_htable_size; i++) { + h = LIST_FIND(&ip_conntrack_hash[i], clashing_ct_cmp, + struct ip_conntrack_tuple_hash *, manip); + if (h) + break; + } + read_unlock_bh(&ip_conntrack_lock); + if (h) { + DEBUGP("__ip_nat_reserved_new_hash: manip clashes with an already existing connection\n"); + return NULL; + } + } + + /* else allocate a new structure */ + res = kmem_cache_alloc(ip_nat_reserved_cachep, GFP_ATOMIC); + if (!res) + return NULL; + + memset(res, 0, sizeof(*res)); + res->proto = proto; + res->manip = *manip; + if (peer) + res->peer = *peer; + + /* put it into the hash */ + h = hash_nat_reserved(manip, peer, proto); + atomic_inc(&ip_nat_reserved_count); + list_prepend(&natreserved[h], &res->hash); + DEBUGP("__ip_nat_reserved_new_hash: hashed manip proto %u %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); + + return res; +} +EXPORT_SYMBOL_GPL(__ip_nat_reserved_new_hash); + +/* Register a new reservation */ +static int +__ip_nat_reserved_register(struct ip_conntrack_expect *expect, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + struct ip_nat_reserved *res; + + DEBUGP("__ip_nat_reserved_register: registering proto %u %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); + + /* allocate and put into the hash */ + res = __ip_nat_reserved_new_hash(manip, proto, peer); + if (!res) + return 0; + + /* append to the per-expectation reserved list */ + list_append(&expect->reserved_list, &res->exp); + + return 1; +} + +int +ip_nat_reserved_register(struct ip_conntrack_expect *expect, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + int ret; + + write_lock_bh(&ip_nat_lock); + + ret = __ip_nat_reserved_register(expect, manip, proto, peer); + + write_unlock_bh(&ip_nat_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(ip_nat_reserved_register); + +/* Unhash a reservation */ +struct ip_nat_reserved * +__ip_nat_reserved_unhash(const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + struct ip_nat_reserved *res; + + DEBUGP("__ip_nat_reserved_unhash: unhashing proto %u %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); + + /* check if it's really reserved */ + if (!(res = __ip_nat_reserved_find_manip(manip, proto, peer, 1))) { + DEBUGP("__ip_nat_reserved_unhash: trying to unreg a nonexisting reservation\n"); + return NULL; + } + + /* delete from the hash table */ + list_del(&res->hash); + + atomic_dec(&ip_nat_reserved_count); + + return res; +} +EXPORT_SYMBOL_GPL(__ip_nat_reserved_unhash); + +/* Return a reservation structure into the slab cache */ +void +__ip_nat_reserved_free(struct ip_nat_reserved *res) +{ + kmem_cache_free(ip_nat_reserved_cachep, res); +} +EXPORT_SYMBOL_GPL(__ip_nat_reserved_free); + +/* Unregister a reservation */ +static int +__ip_nat_reserved_unregister(struct ip_conntrack_expect *expect, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + struct ip_nat_reserved *res; + + DEBUGP("__ip_nat_reserved_unregister: unregistering proto %u %u.%u.%u.%u:%u\n", + proto, NIPQUAD(manip->ip), ntohs(manip->u.all)); + + /* look up and unhash */ + res = __ip_nat_reserved_unhash(manip, proto, peer); + if (!res) + return 0; + + /* delete from the per-expectation list */ + list_del(&res->exp); + + /* free the structure */ + __ip_nat_reserved_free(res); + + return 1; +} + +int +ip_nat_reserved_unregister(struct ip_conntrack_expect *expect, + const struct ip_conntrack_manip *manip, + const u_int16_t proto, + const struct ip_conntrack_manip *peer) +{ + int ret; + + write_lock_bh(&ip_nat_lock); + + ret = __ip_nat_reserved_unregister(expect, manip, proto, peer); + + write_unlock_bh(&ip_nat_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(ip_nat_reserved_unregister); + +/* Unregister all reservations for a given expectation */ +void +ip_nat_reserved_unregister_all(struct ip_conntrack_expect *expect) +{ + struct list_head *i; + struct ip_nat_reserved *res; + + DEBUGP("ip_nat_reserved_unregister_all: deleting all reservations for expectation %p\n", + expect); + + write_lock_bh(&ip_nat_lock); + + i = expect->reserved_list.next; + while (i != &expect->reserved_list) { + res = list_entry(i, struct ip_nat_reserved, exp); + i = i->next; + + /* clear from lists */ + list_del(&res->hash); + list_del(&res->exp); + + kmem_cache_free(ip_nat_reserved_cachep, res); + } + + write_unlock_bh(&ip_nat_lock); +} +EXPORT_SYMBOL_GPL(ip_nat_reserved_unregister_all); + +static void +ip_nat_reserved_cleanup_expect(struct ip_conntrack_expect *expect) +{ + ip_nat_reserved_unregister_all(expect); +} +#endif /* CONFIG_IP_NF_NAT_NRES */ + /* Is this tuple already taken? (not by us) */ int ip_nat_used_tuple(const struct ip_conntrack_tuple *tuple, - const struct ip_conntrack *ignored_conntrack) + const struct ip_conntrack *ignored_conntrack, + const enum ip_nat_manip_type maniptype, + const unsigned int flags) { /* Conntrack tracking doesn't keep track of outgoing tuples; only incoming ones. NAT means they don't have a fixed mapping, @@ -124,6 +496,20 @@ ip_nat_used_tuple(const struct ip_conntr We could keep a separate hash if this proves too slow. */ struct ip_conntrack_tuple reply; +#ifdef CONFIG_IP_NF_NAT_NRES + struct ip_nat_reserved *res; + + /* check if the tuple is reserved if there are any reservations */ + if (atomic_read(&ip_nat_reserved_count)) { + read_lock_bh(&ip_nat_lock); + res = __ip_nat_reserved_find_tuple(tuple, maniptype); + read_unlock_bh(&ip_nat_lock); + + /* If we may not allocate reserved ports, return */ + if (!(flags & IP_NAT_RANGE_USE_RESERVED) && res) + return 1; + } +#endif invert_tuplepr(&reply, tuple); return ip_conntrack_tuple_taken(&reply, ignored_conntrack); @@ -262,7 +648,7 @@ get_unique_tuple(struct ip_conntrack_tup if (maniptype == IP_NAT_MANIP_SRC) { if (find_appropriate_src(orig_tuple, tuple, range)) { DEBUGP("get_unique_tuple: Found current src map\n"); - if (!ip_nat_used_tuple(tuple, conntrack)) + if (!ip_nat_used_tuple(tuple, conntrack, maniptype, range->flags)) return; } } @@ -280,7 +666,7 @@ get_unique_tuple(struct ip_conntrack_tup /* Only bother mapping if it's not already in range and unique */ if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) || proto->in_range(tuple, maniptype, &range->min, &range->max)) - && !ip_nat_used_tuple(tuple, conntrack)) { + && !ip_nat_used_tuple(tuple, conntrack, maniptype, range->flags)) { ip_nat_proto_put(proto); return; } @@ -596,10 +982,29 @@ static int __init ip_nat_init(void) /* Leave them the same for the moment. */ ip_nat_htable_size = ip_conntrack_htable_size; +#ifdef CONFIG_IP_NF_NAT_NRES + /* Create nat_reserved slab cache */ + ip_nat_reserved_cachep = kmem_cache_create("ip_nat_reserved", + sizeof(struct ip_nat_reserved), 0, + SLAB_HWCACHE_ALIGN, NULL, NULL); + if (!ip_nat_reserved_cachep) { + printk(KERN_ERR "Unable to create ip_nat_reserved slab cache\n"); + return -ENOMEM; + } +#endif + /* One vmalloc for both hash tables */ +#ifndef CONFIG_IP_NF_NAT_NRES bysource = vmalloc(sizeof(struct list_head) * ip_nat_htable_size); +#else + bysource = vmalloc(sizeof(struct list_head) * ip_nat_htable_size * 2); +#endif if (!bysource) - return -ENOMEM; + goto free_reserved_slab; + +#ifdef CONFIG_IP_NF_NAT_NRES + natreserved = bysource + ip_nat_htable_size; +#endif /* Sew in builtin protocols. */ write_lock_bh(&ip_nat_lock); @@ -612,15 +1017,28 @@ static int __init ip_nat_init(void) for (i = 0; i < ip_nat_htable_size; i++) { INIT_LIST_HEAD(&bysource[i]); +#ifdef CONFIG_IP_NF_NAT_NRES + INIT_LIST_HEAD(&natreserved[i]); +#endif } /* FIXME: Man, this is a hack. */ IP_NF_ASSERT(ip_conntrack_destroyed == NULL); ip_conntrack_destroyed = &ip_nat_cleanup_conntrack; +#ifdef CONFIG_IP_NF_NAT_NRES + IP_NF_ASSERT(ip_conntrack_expect_destroyed == NULL); + ip_conntrack_expect_destroyed = &ip_nat_reserved_cleanup_expect; +#endif /* Initialize fake conntrack so that NAT will skip it */ ip_conntrack_untracked.status |= IPS_NAT_DONE_MASK; return 0; + +free_reserved_slab: +#ifdef CONFIG_IP_NF_NAT_NRES + kmem_cache_destroy(ip_nat_reserved_cachep); +#endif + return -ENOMEM; } /* Clear NAT section of all conntracks, in case we're loaded again. */ @@ -635,6 +1053,10 @@ static void __exit ip_nat_cleanup(void) { ip_ct_iterate_cleanup(&clean_nat, NULL); ip_conntrack_destroyed = NULL; +#ifdef CONFIG_IP_NF_NAT_NRES + ip_conntrack_expect_destroyed = NULL; + kmem_cache_destroy(ip_nat_reserved_cachep); +#endif vfree(bysource); } diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c index 38acfdf..9d6211c 100644 --- a/net/ipv4/netfilter/ip_nat_proto_gre.c +++ b/net/ipv4/netfilter/ip_nat_proto_gre.c @@ -88,7 +88,7 @@ gre_unique_tuple(struct ip_conntrack_tup for (i = 0; i < range_size; i++, key++) { *keyptr = htons(min + key % range_size); - if (!ip_nat_used_tuple(tuple, conntrack)) + if (!ip_nat_used_tuple(tuple, conntrack, maniptype, range->flags)) return 1; } diff --git a/net/ipv4/netfilter/ip_nat_proto_icmp.c b/net/ipv4/netfilter/ip_nat_proto_icmp.c index 31a3f4c..de48dd9 100644 --- a/net/ipv4/netfilter/ip_nat_proto_icmp.c +++ b/net/ipv4/netfilter/ip_nat_proto_icmp.c @@ -46,7 +46,7 @@ icmp_unique_tuple(struct ip_conntrack_tu for (i = 0; i < range_size; i++, id++) { tuple->src.u.icmp.id = htons(ntohs(range->min.icmp.id) + (id % range_size)); - if (!ip_nat_used_tuple(tuple, conntrack)) + if (!ip_nat_used_tuple(tuple, conntrack, maniptype, range->flags)) return 1; } return 0; diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c index a3d1407..7f325ca 100644 --- a/net/ipv4/netfilter/ip_nat_proto_tcp.c +++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c @@ -77,7 +77,7 @@ tcp_unique_tuple(struct ip_conntrack_tup for (i = 0; i < range_size; i++, port++) { *portptr = htons(min + port % range_size); - if (!ip_nat_used_tuple(tuple, conntrack)) { + if (!ip_nat_used_tuple(tuple, conntrack, maniptype, range->flags)) { return 1; } } diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c index ec6053f..54b1fe8 100644 --- a/net/ipv4/netfilter/ip_nat_proto_udp.c +++ b/net/ipv4/netfilter/ip_nat_proto_udp.c @@ -76,7 +76,7 @@ udp_unique_tuple(struct ip_conntrack_tup for (i = 0; i < range_size; i++, port++) { *portptr = htons(min + port % range_size); - if (!ip_nat_used_tuple(tuple, conntrack)) + if (!ip_nat_used_tuple(tuple, conntrack, maniptype, range->flags)) return 1; } return 0; cttproxy-2.6.18-2.0.6/LICENSE0000664000175000017500000004311006770226140014427 0ustar hiddenhidden GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. cttproxy-2.6.18-2.0.6/iptables/0002775000175000017500000000000010547471035015232 5ustar hiddenhiddencttproxy-2.6.18-2.0.6/iptables/iptables-1.2.7a-cttproxy-04.diff0000664000175000017500000001337207664401304022610 0ustar hiddenhiddendiff -urN --exclude-from iptables-exclude iptables-1.2.5-vanilla/extensions/.tproxy-test iptables-1.2.5-TPROXY-ng/extensions/.tproxy-test --- iptables-1.2.5-vanilla/extensions/.tproxy-test Thu Jan 1 01:00:00 1970 +++ iptables-1.2.5-TPROXY-ng/extensions/.tproxy-test Wed Jun 5 14:06:56 2002 @@ -0,0 +1,3 @@ +#!/bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_TPROXY.h ] && echo TPROXY +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_tproxy.c ] && echo tproxy diff -urN --exclude-from iptables-exclude iptables-1.2.5-vanilla/extensions/libipt_TPROXY.c iptables-1.2.5-TPROXY-ng/extensions/libipt_TPROXY.c --- iptables-1.2.5-vanilla/extensions/libipt_TPROXY.c Thu Jan 1 01:00:00 1970 +++ iptables-1.2.5-TPROXY-ng/extensions/libipt_TPROXY.c Mon Jun 17 18:35:09 2002 @@ -0,0 +1,138 @@ +/* Shared library add-on to iptables to add TPROXY target support. */ +#include +#include +#include +#include + +#include +#include +#include + +struct tosinfo { + struct ipt_entry_target t; + struct ipt_tproxy_target_info tproxy; +}; + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"TPROXY target v%s options:\n" +" --on-port port Redirect connection to port, or the original port if 0\n" +" --on-ip ip Optionally redirect to the given IP\n", +IPTABLES_VERSION); +} + +static struct option opts[] = { + { "on-port", 1, 0, '1' }, + { "on-ip", 1, 0, '2' }, + { 0 } +}; + +/* Initialize the target. */ +static void +init(struct ipt_entry_target *t, unsigned int *nfcache) +{ +} + +static void +parse_tproxy_lport(const unsigned char *s, struct ipt_tproxy_target_info *info) +{ + int lport; + + if (string_to_number(s, 0, 65535, &lport) != -1) + info->lport = htons(lport); + else + exit_error(PARAMETER_PROBLEM, "bad --on-proxy `%s'", s); + +} + +static void +parse_tproxy_laddr(const unsigned char *s, struct ipt_tproxy_target_info *info) +{ + struct in_addr *laddr; + + if ((laddr = dotted_to_addr(s)) == NULL) + exit_error(PARAMETER_PROBLEM, "bad --on-ip `%s'", s); + info->laddr = laddr->s_addr; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + struct ipt_entry_target **target) +{ + struct ipt_tproxy_target_info *tproxyinfo + = (struct ipt_tproxy_target_info *)(*target)->data; + + switch (c) { + case '1': + if (*flags) + exit_error(PARAMETER_PROBLEM, + "TPROXY target: Can't specify --to-port twice"); + parse_tproxy_lport(optarg, tproxyinfo); + *flags = 1; + break; + case '2': + parse_tproxy_laddr(optarg, tproxyinfo); + break; + + default: + return 0; + } + + return 1; +} + +static void +final_check(unsigned int flags) +{ + if (!flags) + exit_error(PARAMETER_PROBLEM, + "TPROXY target: Parameter --on-port is required"); +} + +/* Prints out the targinfo. */ +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_target *target, + int numeric) +{ + const struct ipt_tproxy_target_info *tproxyinfo = + (const struct ipt_tproxy_target_info *)target->data; + printf("TPROXY redirect %s:%d", addr_to_dotted((struct in_addr *) &tproxyinfo->laddr), ntohs(tproxyinfo->lport)); +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ +static void +save(const struct ipt_ip *ip, const struct ipt_entry_target *target) +{ + const struct ipt_tproxy_target_info *tproxyinfo = + (const struct ipt_tproxy_target_info *)target->data; + + printf("--on-port %d ", ntohs(tproxyinfo->lport)); + printf("--on-ip %s ", addr_to_dotted((struct in_addr *) &tproxyinfo->laddr)); +} + +struct iptables_target tproxy += { NULL, + "TPROXY", + IPTABLES_VERSION, + IPT_ALIGN(sizeof(struct ipt_tproxy_target_info)), + IPT_ALIGN(sizeof(struct ipt_tproxy_target_info)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_target(&tproxy); +} diff -urN --exclude-from iptables-exclude iptables-1.2.5-vanilla/extensions/libipt_tproxy.c iptables-1.2.5-TPROXY-ng/extensions/libipt_tproxy.c --- iptables-1.2.5-vanilla/extensions/libipt_tproxy.c Thu Jan 1 01:00:00 1970 +++ iptables-1.2.5-TPROXY-ng/extensions/libipt_tproxy.c Wed Jun 5 14:16:08 2002 @@ -0,0 +1,77 @@ +/* Shared library add-on to iptables to add tproxy matching support. */ +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ +} + +static struct option opts[] = { + {0} +}; + +/* Initialize the match. */ +static void +init(struct ipt_entry_match *m, unsigned int *nfcache) +{ + /* Can't cache this */ + *nfcache |= NFC_UNKNOWN; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + unsigned int *nfcache, + struct ipt_entry_match **match) +{ + return 0; +} + +static void +final_check(unsigned int flags) +{ +} + +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_match *match, + int numeric) +{ + printf("tproxy "); +} + +static void +save(const struct ipt_ip *ip, const struct ipt_entry_match *match) +{ +} + +static +struct iptables_match tproxy += { NULL, + "tproxy", + IPTABLES_VERSION, + 0, + 0, + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_match(&tproxy); +} cttproxy-2.6.18-2.0.6/iptables/iptables-1.3-cttproxy.diff0000600000175000017500000001374010332153151022035 0ustar hiddenhiddendiff -Pdpru iptables-1.3.1~/extensions/.tproxy-test iptables-1.3.1/extensions/.tproxy-test --- iptables-1.3.1~/extensions/.tproxy-test 1970-01-01 01:00:00.000000000 +0100 +++ iptables-1.3.1/extensions/.tproxy-test 2005-07-13 20:02:04.000000000 +0200 @@ -0,0 +1,3 @@ +#!/bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_TPROXY.h ] && echo TPROXY +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_tproxy.c ] && echo tproxy diff -Pdpru iptables-1.3.1~/extensions/libipt_TPROXY.c iptables-1.3.1/extensions/libipt_TPROXY.c --- iptables-1.3.1~/extensions/libipt_TPROXY.c 1970-01-01 01:00:00.000000000 +0100 +++ iptables-1.3.1/extensions/libipt_TPROXY.c 2005-07-13 20:28:14.000000000 +0200 @@ -0,0 +1,137 @@ +/* Shared library add-on to iptables to add TPROXY target support. */ +#include +#include +#include +#include + +#include +#include +#include + +struct tosinfo { + struct ipt_entry_target t; + struct ipt_tproxy_target_info tproxy; +}; + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"TPROXY target v%s options:\n" +" --on-port port Redirect connection to port, or the original port if 0\n" +" --on-ip ip Optionally redirect to the given IP\n", +IPTABLES_VERSION); +} + +static struct option opts[] = { + { "on-port", 1, 0, '1' }, + { "on-ip", 1, 0, '2' }, + { 0 } +}; + +/* Initialize the target. */ +static void +init(struct ipt_entry_target *t, unsigned int *nfcache) +{ +} + +static void +parse_tproxy_lport(const unsigned char *s, struct ipt_tproxy_target_info *info) +{ + int lport; + + if (string_to_number(s, 0, 65535, &lport) != -1) + info->lport = htons(lport); + else + exit_error(PARAMETER_PROBLEM, "bad --on-proxy `%s'", s); + +} + +static void +parse_tproxy_laddr(const unsigned char *s, struct ipt_tproxy_target_info *info) +{ + struct in_addr *laddr; + + if ((laddr = dotted_to_addr(s)) == NULL) + exit_error(PARAMETER_PROBLEM, "bad --on-ip `%s'", s); + info->laddr = laddr->s_addr; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + struct ipt_entry_target **target) +{ + struct ipt_tproxy_target_info *tproxyinfo + = (struct ipt_tproxy_target_info *)(*target)->data; + + switch (c) { + case '1': + if (*flags) + exit_error(PARAMETER_PROBLEM, + "TPROXY target: Can't specify --to-port twice"); + parse_tproxy_lport(optarg, tproxyinfo); + *flags = 1; + break; + case '2': + parse_tproxy_laddr(optarg, tproxyinfo); + break; + + default: + return 0; + } + + return 1; +} + +static void +final_check(unsigned int flags) +{ + if (!flags) + exit_error(PARAMETER_PROBLEM, + "TPROXY target: Parameter --on-port is required"); +} + +/* Prints out the targinfo. */ +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_target *target, + int numeric) +{ + const struct ipt_tproxy_target_info *tproxyinfo = + (const struct ipt_tproxy_target_info *)target->data; + printf("TPROXY redirect %s:%d", addr_to_dotted((struct in_addr *) &tproxyinfo->laddr), ntohs(tproxyinfo->lport)); +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ +static void +save(const struct ipt_ip *ip, const struct ipt_entry_target *target) +{ + const struct ipt_tproxy_target_info *tproxyinfo = + (const struct ipt_tproxy_target_info *)target->data; + + printf("--on-port %d ", ntohs(tproxyinfo->lport)); + printf("--on-ip %s ", addr_to_dotted((struct in_addr *) &tproxyinfo->laddr)); +} + +static struct iptables_target tproxy = { + .name = "TPROXY", + .version = IPTABLES_VERSION, + .size = IPT_ALIGN(sizeof(struct ipt_tproxy_target_info)), + .userspacesize = IPT_ALIGN(sizeof(struct ipt_tproxy_target_info)), + .help = help, + .init = init, + .parse = parse, + .final_check = final_check, + .print = print, + .save = save, + .extra_opts = opts, +}; + +void _init(void) +{ + register_target(&tproxy); +} diff -Pdpru iptables-1.3.1~/extensions/libipt_tproxy.c iptables-1.3.1/extensions/libipt_tproxy.c --- iptables-1.3.1~/extensions/libipt_tproxy.c 1970-01-01 01:00:00.000000000 +0100 +++ iptables-1.3.1/extensions/libipt_tproxy.c 2005-07-13 20:28:02.000000000 +0200 @@ -0,0 +1,75 @@ +/* Shared library add-on to iptables to add tproxy matching support. */ +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ +} + +static struct option opts[] = { + {0} +}; + +/* Initialize the match. */ +static void +init(struct ipt_entry_match *m, unsigned int *nfcache) +{ + /* Can't cache this */ + *nfcache |= NFC_UNKNOWN; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + unsigned int *nfcache, + struct ipt_entry_match **match) +{ + return 0; +} + +static void +final_check(unsigned int flags) +{ +} + +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_match *match, + int numeric) +{ + printf("tproxy "); +} + +static void +save(const struct ipt_ip *ip, const struct ipt_entry_match *match) +{ +} + +static struct iptables_match tproxy = { + .name = "tproxy", + .version = IPTABLES_VERSION, + .size = 0, + .userspacesize = 0, + .help = help, + .init = init, + .parse = parse, + .final_check = final_check, + .print = print, + .save = save, + .extra_opts = opts, +}; + +void _init(void) +{ + register_match(&tproxy); +} cttproxy-2.6.18-2.0.6/README0000664000175000017500000004334010501474216014303 0ustar hiddenhidden These are my patches against Linux kernel 2.6 to implement transparent proxy functions. The author of the transparent proxy patches is me, Balázs Scheidler, you can reach me at bazsi at balabit dot hu. The latest version can always be found at http://www.balabit.com/products/oss/tproxy ************************************************************************** WARNING: The API of TProxy 2.0 has changed since the 1.2 version. As of version 2.0, TProxy is _not_binary_compatible_ with any of the older stable releases, and you have to make some (trivial) changes to your source code to make it compile using TProxy 2.0. ************************************************************************** What does the term 'proxy' mean? -------------------------------- A proxy is a server-like program, receiving requests from clients, forwarding those requests to the real server on behalf of users, and returning the response as it arrives. Proxies read and parse the application protocol, and reject invalid traffic. As most attacks violate the application protocol, disallowing protocol violations usually protects against attacks. What is transparent proxying? ----------------------------- To simplify management tasks of clients sitting behind proxy firewalls, the technique 'transparent proxying' was invented. Transparent proxying means that the presence of the proxy is invisible to the user. Transparent proxying however requires kernel support. We have a 'REDIRECT' target, isn't that enough? ---------------------------------------------- Real transparent proxying requires the following three features from the IP stack of the computer it is running on: 1. Redirect sessions destined to the outer network to a local process using a packet filter rule. 2. Make it possible for a process to listen to connections on a foreign address. 3. Make it possible for a process to initiate a connection with a foreign address as a source. Item #1 is usually provided by packet filtering packages like Netfilter/IPTables, IPFilter. (yes, this is the REDIRECT target) All three were provided in Linux kernels 2.2.x, but support for this was removed. How to install it? ------------------ Patch your kernel using the patches in the tarball. Not all patches are mandatory, however: the 04-nat_delete.diff is completely optional, you only need that if you are experiencing conntrack entry clashes with a lot of TCP connections. If you think you need it, you're probably wrong. If you somehow decided that you need it, then you _have_to_ apply Jozsef Kadlecsik's TCP window tracking patch as well: 00-tcp_window_tracking.diff. This patch is considered useful anyway, and is included in Linux 2.6.9. To apply all patches except the 04-nat_delete: cd /usr/src/linux for i in /patch_tree/0{1,2,3}*.diff; do cat $i | patch -p1; done then enable conntrack, nat and tproxy support in your kernel config. If you enable NAT reservation support you'll have a higher chance of detecting problems with clashing connections at the cost of losing some performance. Prior to starting a program using transparent proxy functions the module iptable_tproxy.o must be loaded. It is _not_ autoloaded by default. You'll also have to patch your iptables userspace by using the following command: cd /usr/src/iptables-1.3.X cat /iptables/iptables-1.3-cttproxy.diff | patch -p1 chmod +x extensions/.tproxy-test make KERNELDIR=/usr/src/linux Of course you might need to change the path in the examples above. How to start using it? ---------------------- This implementation of transparent proxying works by creating implicit NAT rules. This means that redirection, foreign address listen, and foreign address connect (the three features required for transparent proxying) all create a NAT mapping of some sort. NOTE: that this doesn't mean that the 'nat' table will be modified in any way. Now let's see what happens when a proxy tries to use the required tproxy features I outlined earlier. 1. Redirection This is easy, as this was already supported by iptables. Redirection is equivalent with the following nat rule: iptables -t nat -A PREROUTING -j DNAT --to-dest --to-port is one the IP address of the interface where the packet entered the IP stack is the port where the proxy was bound to To indicate that this is not simple NAT rule, a separate table named 'tproxy' was created: iptables -t tproxy -A PREROUTING -j TPROXY --on-port The local IP address is determined automatically, but can be overridden by the --on-ip parameter. 2. Listening for connections on a foreign address There are protocols which use more than a single TCP channel for communication. The best example is FTP which uses a command channel for sending commands, and a data channel to transfer the body of files. The secondary channel can be established in both active and passive mode, active meaning the server connects back to the client, passive meaning the client connects to the server on another port. Let's see the passive case, when the client establishes a connection to the address returned in the response of the PASV FTP command. As the presence of the proxy is transparent to the client, the target IP address of the secondary channel (e.g. the address in the PASV response) is the server (and not the firewall) and this connection must also be handled by the proxy. The first solution that comes to mind is to add a a TPROXY rule automatically (e.g. to redirect a connection destined to a given server on a given port to a local process), however it is not feasible, adding rules on the fly should not be required as it would mess the administrator's own rules, the NAT translation should be done implicitly without touching the user rulebase. To do this on a Linux 2.2 kernel it was enough to call bind() on a socket with a foreign IP address, and if a new connection to the given foreign IP was routed through the firewall the connection was intercepted. This solution however distracted the core network kernel hackers and removed this feature. This implementation tries to make the transparent proxy features independent from the core network stack, therefore it works a bit differently: * the proxy binds to a local address first * the proxy then issues an IP_TPROXY setsockopt, requesting a TPROXY_ASSIGN operation. TPROXY_ASSIGN registers the local address the proxy bound to, with the foreign address it is interested in. This relationship is stored in a hash table within the iptable_tproxy module. * as a final step the proxy instructs the kernel that it wants to LISTEN for connections, this is done by calling the IP_TPROXY setsockopt with TPROXY_FLAGS as the operation and a flags value of ITP_LISTEN. When this setup is complete, the kernel (more exactly a netfilter hook registered at PREROUTING) generates a NAT mapping if there is a registered socket for incoming NEW connections. 3. Initiating connections with a foreign address as a source Similarly to the case outlined above, it is sometimes necessary to be able to initiate a connection with a foreign IP address as a source. Imagine the active FTP case when the FTP client listens for connections with source address equal to the server. Another example: a webserver in your DMZ which does access control based on client IP address. If the proxy could not initiate connections with foreign IP address, the webserver would see the inner IP address of the firewall itself. In Linux 2.2 this was accomplished by bind()-ing to a foreign address prior calling connect(), and it worked. In this tproxy patch it is done somewhat similar to the case 2 outlined above. * the proxy binds to a local address first * the proxy then issues an TPROXY_ASSIGN operation. TPROXY_ASSIGN registers the local address the proxy bound to, with the foreign address it wants its source address to be changed to. This relationship is stored in a hash table within the iptable_tproxy module. * as a final step the proxy instructs the kernel that it wants to initiate a connection, this is done by calling the IP_TPROXY setsockopt with the TPROXY_FLAGS operation and a flags value of ITP_CONNECT. How to use it? -------------- So you now know how this tproxy thing works, and what its aims have been. This section serves as an introduction on how this works out in practice. The only proxy firewall which supports the features above is Zorp. Zorp is an application level proxy firewall suite designed with three main goals: * the best application layer protocol analysis (unknown protocol elements are rejected instead of let through, proxies work according to RFCs) * flexibility, decisions are scriptable, requests can be rewritten etc. (imagine a firewall which changes server based on HTTP request, normal HTTP requests go to an Apache, WebDAV requests to another apache, possibly running under a different uid) * modularity, proxies are not individual entities, they can be attached together, embedded part of protocols can be further analyzed. (transport protocols such as SSL/TLS can be decrypted on the fly, and the decypted stream fed into another proxy, so URL filtering within HTTPS is possible) That's it about the marketing stuff, Zorp is available at http://www.balabit.hu/en/downloads/zorp-gpl/ So how to build a ruleset for a real-life proxy firewall? Storing the ruleset ------------------- Some people like storing their ruleset as a shell script which invokes the necessary iptables commands. As I don't like mixing executable code and data we use the format defined by iptables-save & iptables-restore. As raw iptables-restore format has no macro possibility we created a frontend named iptables-utils where a couple of scripts help the creation and maintenance of a packet filter rulesets. Here's an outline of the iptables-utils approach: * the following files are used by iptables-utils: - iptables.conf.in: contains our ruleset before processing, this is a user supplied file, we are going to edit this with our favourite editor - iptables.conf.var: contains our macro definitions, it might contain a series of C like #define statements. I say C like because macro substition differs from cpp. - iptables.conf.new: when processing conf.in & conf.var our new ruleset will be generated here - iptables.conf: is our current ruleset, iptables.conf.new is copied here if found to be correct * the ruleset is maintained the following way: - you edit either iptables.conf.in or iptables.conf.var - you process your modifications by the command 'iptables-gen', this will result in a iptables.conf.new to be generated - you test your new ruleset by invoking 'iptables-test', this script loads the new ruleset, waits a couple of seconds and reloads the old ruleset, if you made a mistake you are still not closed out from the system - if the new ruleset is ok, you invoke 'iptables-commit' which overwrites iptables.conf with iptables.conf.new and loads the ruleset Using iptables-utils is absolutely beneficial in the long term as the number of system-closeouts dramatically decreased, which is good if you are hundreds of miles of away from the firewall. Macro expansion is not simple substition, if a macro contains several words the rule where the macro is referenced is copied, at the end you get a new rule for each word in your macro. For instance: iptables.conf.var: #define SSH_PERMITTED 1.2.3.4 1.2.3.5 iptables.conf.in: -A INPUT -p tcp -m tcp -s SSH_PERMITTED --dport 22 -j ACCEPT You will get two rules the first with 1.2.3.4 substituted, the second with 1.2.3.5 substituted. Identifying firewall neighbourhood ---------------------------------- The aim for the firewall is to be a border between different security zones. A simple firewall has two zones: 'internal network' and 'external network'. A more complex firewall might have more zones, I built firewalls with more than 10 ethernet interfaces myself. The first task is to name those zones, the name should be short but still identifiable. Let's name the zones this way: internal network: 'intra' external network: 'inter' demilitarized zone: 'dmz' In our example a single firewall will be used, the DMZ will be one of the zones of our firewall. Naming the chains ----------------- In addition to the standard chains provided by iptables (INPUT, OUTPUT etc) we will create separate chains for each security zone. Each security zone will have two chains: * a chain which contains rules for traffic which passes the firewall * a chain which contains rules for traffic destined to the firewall The first one will be prefixed by PR which stands for PRoxy rules, the second one will be prefixed by LO which stands for LOcal rules. Proxy rules will be placed into the 'tproxy' table, local rules will be placed into the 'filter' table. If we assume that all traffic goes through proxies we won't need NAT nor mangle rules. (of course we can add further finetuning to our rulebase, like limiting the number of SYNs etc) Jumping to our chains --------------------- We have two set of chains for each security zone, LOxxx chains are processed in the filter table, INPUT chain. PRxxx chains are processed in the tproxy table, PREROUTING/OUTPUT chain. Our filter/INPUT chain will be something like this: ... -A INPUT -m tproxy -j ACCEPT -A INPUT -i -j LOintra -A INPUT -i -j LOinter -A INPUT -i -j LOdmz -A INPUT -j DROP This means that all permitted traffic must be enabled in their specific chain or will be dropped on the INPUT chain. Of course logging dropped packets would be a good idea. It is important to mention that our FORWARD chain should contain a single DROP rule as we don't forward packets. Each LOxxx chain should look like this: -A LOintra -p tcp --dport 22 -j ACCEPT ... permit each service ... -A LOintra -j DROP Of course our LOxxx chains might be different for each zone, as we might permit SSH access from the intranet only. Note the '-m tproxy' rule at the front of other rules, it allows all traffic redirected by any TPROXY feature to pass the filter table. (this includes TPROXY redirections, and foreign-bound traffic) We took care about local services provided by the firewall, let's make our proxying rules now. Our tproxy/PREROUTING chain will be something like this: -A PREROUTING -i -d ! -j PRintra -A PREROUTING -i -d ! -j PRinter -A PREROUTING -i -d ! -j PRdmz A PRxxx chain should something like this: -A PRintra -d 0/0 --dport 80 -j TPROXY --on-port 50080 ... repeat the above rule for each service ... At the end of a PRxxx chain no DROP should be performed, as unmodified sessions will be stopped when the filter table is evaluated. The port number specified by TPROXY rules should match the port number where the transparent proxy (Zorp in our example) will be bound. Zorp configuration ------------------ The configuration in iptables rules and Zorp must match, a short Zorp policy which is bound to 50080 (matching the example rule above) is below: from Zorp.Core import * from Zorp.Http import * InetZone('intranet', '192.168.1.0/24', inbound_services=[], outbound_services=["*"]) InetZone('dmz', '10.0.0.0/24', inbound_services=[], outbound_services=[]) InetZone('internet', '0.0.0.0/0', inbound_services['*'], outbound_services=[]) def intra(): Service('intra_HTTP', HttpProxy) Listener(SockAddrInet('', 50080), 'intra_HTTP') The example might be indented, as Python is sensitive to indenting, please unindent it so that lines start on the first column. How it works? ------------- Within the tproxy module in the kernel there's a table describing the relationship between local sockets and a non-local IP address/port pair. A local socket is referenced by its local IP/port, therefore all sockets to be used for transparent proxy purposes must be bound to a local IP prior anything can be done. To connect from, or listen on a foreign address an entry to this table must be added. To add a translation table entry, create a socket (bind it to a local interface), and call the setsockopt IP_TPROXY at level SOL_IP with a structure describing the operation TPROXY_ASSIGN and the nonlocal address (struct in_tproxy). If this setsockopt succeeds, specify what you want to do with the given socket, by calling TPROXY_FLAGS with the combination of the bits in in_tproxy.h: /* bitfields in TPROXY_FLAGS */ #define ITP_CONNECT 0x00000001 #define ITP_LISTEN 0x00000002 ITP_CONNECT means you want to initiate a connection, ITP_LISTEN means you want to accept connections on the foreign address specified in TPROXY_ASSIGN.