netfilter: iptables socket match

Add iptables 'socket' match, which matches packets for which a TCP/UDP
socket lookup succeeds.

Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index ed1dcfb..f6c8072 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -778,6 +778,21 @@ config NETFILTER_XT_MATCH_SCTP
          If you want to compile it as a module, say M here and read
          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_SOCKET
+       tristate '"socket" match support (EXPERIMENTAL)'
+       depends on EXPERIMENTAL
+       depends on NETFILTER_TPROXY
+       depends on NETFILTER_XTABLES
+       depends on NETFILTER_ADVANCED
+       select NF_DEFRAG_IPV4
+       help
+         This option adds a `socket' match, which can be used to match
+         packets for which a TCP or UDP socket lookup finds a valid socket.
+         It can be used in combination with the MARK target and policy
+         routing to implement full featured non-locally bound sockets.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_MATCH_STATE
        tristate '"state" match support'
        depends on NETFILTER_XTABLES

diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index fc8bbb4..1cdc3a1 100644 (file)
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o

diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
new file mode 100644 (file)
index 0000000..ac9db17
--- /dev/null
+++ b/net/netfilter/xt_socket.c
@@ -0,0 +1,192 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (C) 2007-2008 BalaBit IT Ltd.
+ * Author: Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <net/tcp.h>
+#include <net/udp.h>
+#include <net/icmp.h>
+#include <net/sock.h>
+#include <net/inet_sock.h>
+#include <net/netfilter/nf_tproxy_core.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#define XT_SOCKET_HAVE_CONNTRACK 1
+#include <net/netfilter/nf_conntrack.h>
+#endif
+
+static int
+extract_icmp_fields(const struct sk_buff *skb,
+                   u8 *protocol,
+                   __be32 *raddr,
+                   __be32 *laddr,
+                   __be16 *rport,
+                   __be16 *lport)
+{
+       unsigned int outside_hdrlen = ip_hdrlen(skb);
+       struct iphdr *inside_iph, _inside_iph;
+       struct icmphdr *icmph, _icmph;
+       __be16 *ports, _ports[2];
+
+       icmph = skb_header_pointer(skb, outside_hdrlen,
+                                  sizeof(_icmph), &_icmph);
+       if (icmph == NULL)
+               return 1;
+
+       switch (icmph->type) {
+       case ICMP_DEST_UNREACH:
+       case ICMP_SOURCE_QUENCH:
+       case ICMP_REDIRECT:
+       case ICMP_TIME_EXCEEDED:
+       case ICMP_PARAMETERPROB:
+               break;
+       default:
+               return 1;
+       }
+
+       inside_iph = skb_header_pointer(skb, outside_hdrlen +
+                                       sizeof(struct icmphdr),
+                                       sizeof(_inside_iph), &_inside_iph);
+       if (inside_iph == NULL)
+               return 1;
+
+       if (inside_iph->protocol != IPPROTO_TCP &&
+           inside_iph->protocol != IPPROTO_UDP)
+               return 1;
+
+       ports = skb_header_pointer(skb, outside_hdrlen +
+                                  sizeof(struct icmphdr) +
+                                  (inside_iph->ihl << 2),
+                                  sizeof(_ports), &_ports);
+       if (ports == NULL)
+               return 1;
+
+       /* the inside IP packet is the one quoted from our side, thus
+        * its saddr is the local address */
+       *protocol = inside_iph->protocol;
+       *laddr = inside_iph->saddr;
+       *lport = ports[0];
+       *raddr = inside_iph->daddr;
+       *rport = ports[1];
+
+       return 0;
+}
+
+
+static bool
+socket_mt(const struct sk_buff *skb,
+         const struct net_device *in,
+         const struct net_device *out,
+         const struct xt_match *match,
+         const void *matchinfo,
+         int offset,
+         unsigned int protoff,
+         bool *hotdrop)
+{
+       const struct iphdr *iph = ip_hdr(skb);
+       struct udphdr _hdr, *hp = NULL;
+       struct sock *sk;
+       __be32 daddr, saddr;
+       __be16 dport, sport;
+       u8 protocol;
+#ifdef XT_SOCKET_HAVE_CONNTRACK
+       struct nf_conn const *ct;
+       enum ip_conntrack_info ctinfo;
+#endif
+
+       if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
+               hp = skb_header_pointer(skb, ip_hdrlen(skb),
+                                       sizeof(_hdr), &_hdr);
+               if (hp == NULL)
+                       return false;
+
+               protocol = iph->protocol;
+               saddr = iph->saddr;
+               sport = hp->source;
+               daddr = iph->daddr;
+               dport = hp->dest;
+
+       } else if (iph->protocol == IPPROTO_ICMP) {
+               if (extract_icmp_fields(skb, &protocol, &saddr, &daddr,
+                                       &sport, &dport))
+                       return false;
+       } else {
+               return false;
+       }
+
+#ifdef XT_SOCKET_HAVE_CONNTRACK
+       /* Do the lookup with the original socket address in case this is a
+        * reply packet of an established SNAT-ted connection. */
+
+       ct = nf_ct_get(skb, &ctinfo);
+       if (ct && (ct != &nf_conntrack_untracked) &&
+           ((iph->protocol != IPPROTO_ICMP &&
+             ctinfo == IP_CT_IS_REPLY + IP_CT_ESTABLISHED) ||
+            (iph->protocol == IPPROTO_ICMP &&
+             ctinfo == IP_CT_IS_REPLY + IP_CT_RELATED)) &&
+           (ct->status & IPS_SRC_NAT_DONE)) {
+
+               daddr = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
+               dport = (iph->protocol == IPPROTO_TCP) ?
+                       ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port :
+                       ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
+       }
+#endif
+
+       sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
+                                  saddr, daddr, sport, dport, in, false);
+       if (sk != NULL) {
+               bool wildcard = (inet_sk(sk)->rcv_saddr == 0);
+
+               nf_tproxy_put_sock(sk);
+               if (wildcard)
+                       sk = NULL;
+       }
+
+       pr_debug("socket match: proto %u %08x:%u -> %08x:%u "
+                "(orig %08x:%u) sock %p\n",
+                protocol, ntohl(saddr), ntohs(sport),
+                ntohl(daddr), ntohs(dport),
+                ntohl(iph->daddr), hp ? ntohs(hp->dest) : 0, sk);
+
+       return (sk != NULL);
+}
+
+static struct xt_match socket_mt_reg __read_mostly = {
+       .name           = "socket",
+       .family         = AF_INET,
+       .match          = socket_mt,
+       .hooks          = 1 << NF_INET_PRE_ROUTING,
+       .me             = THIS_MODULE,
+};
+
+static int __init socket_mt_init(void)
+{
+       nf_defrag_ipv4_enable();
+       return xt_register_match(&socket_mt_reg);
+}
+
+static void __exit socket_mt_exit(void)
+{
+       xt_unregister_match(&socket_mt_reg);
+}
+
+module_init(socket_mt_init);
+module_exit(socket_mt_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Krisztian Kovacs, Balazs Scheidler");
+MODULE_DESCRIPTION("x_tables socket match module");
+MODULE_ALIAS("ipt_socket");