1/* 2 * Transparent proxy support for Linux/iptables 3 * 4 * Copyright (c) 2006-2007 BalaBit IT Ltd. 5 * Author: Balazs Scheidler, Krisztian Kovacs 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 */ 12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13#include <linux/module.h> 14#include <linux/skbuff.h> 15#include <linux/ip.h> 16#include <net/checksum.h> 17#include <net/udp.h> 18#include <net/inet_sock.h> 19 20#include <linux/netfilter/x_tables.h> 21#include <linux/netfilter_ipv4/ip_tables.h> 22#include <linux/netfilter/xt_TPROXY.h> 23 24#include <net/netfilter/ipv4/nf_defrag_ipv4.h> 25#include <net/netfilter/nf_tproxy_core.h> 26 27static unsigned int 28tproxy_tg(struct sk_buff *skb, const struct xt_action_param *par) 29{ 30 const struct iphdr *iph = ip_hdr(skb); 31 const struct xt_tproxy_target_info *tgi = par->targinfo; 32 struct udphdr _hdr, *hp; 33 struct sock *sk; 34 35 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); 36 if (hp == NULL) 37 return NF_DROP; 38 39 sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, 40 iph->saddr, 41 tgi->laddr ? tgi->laddr : iph->daddr, 42 hp->source, 43 tgi->lport ? tgi->lport : hp->dest, 44 par->in, true); 45 46 /* NOTE: assign_sock consumes our sk reference */ 47 if (sk && nf_tproxy_assign_sock(skb, sk)) { 48 /* This should be in a separate target, but we don't do multiple 49 targets on the same rule yet */ 50 skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value; 51 52 pr_debug("redirecting: proto %u %08x:%u -> %08x:%u, mark: %x\n", 53 iph->protocol, ntohl(iph->daddr), ntohs(hp->dest), 54 ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark); 55 return NF_ACCEPT; 56 } 57 58 pr_debug("no socket, dropping: proto %u %08x:%u -> %08x:%u, mark: %x\n", 59 iph->protocol, ntohl(iph->daddr), ntohs(hp->dest), 60 ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark); 61 return NF_DROP; 62} 63 64static int tproxy_tg_check(const struct xt_tgchk_param *par) 65{ 66 const struct ipt_ip *i = par->entryinfo; 67 68 if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) 69 && !(i->invflags & IPT_INV_PROTO)) 70 return 0; 71 72 pr_info("Can be used only in combination with " 73 "either -p tcp or -p udp\n"); 74 return -EINVAL; 75} 76 77static struct xt_target tproxy_tg_reg __read_mostly = { 78 .name = "TPROXY", 79 .family = AF_INET, 80 .table = "mangle", 81 .target = tproxy_tg, 82 .targetsize = sizeof(struct xt_tproxy_target_info), 83 .checkentry = tproxy_tg_check, 84 .hooks = 1 << NF_INET_PRE_ROUTING, 85 .me = THIS_MODULE, 86}; 87 88static int __init tproxy_tg_init(void) 89{ 90 nf_defrag_ipv4_enable(); 91 return xt_register_target(&tproxy_tg_reg); 92} 93 94static void __exit tproxy_tg_exit(void) 95{ 96 xt_unregister_target(&tproxy_tg_reg); 97} 98 99module_init(tproxy_tg_init); 100module_exit(tproxy_tg_exit); 101MODULE_LICENSE("GPL"); 102MODULE_AUTHOR("Krisztian Kovacs"); 103MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target module."); 104MODULE_ALIAS("ipt_TPROXY"); 105