Commit d7f9b2f1 authored by Fernando Fernandez Mancera's avatar Fernando Fernandez Mancera Committed by Pablo Neira Ayuso
Browse files

netfilter: synproxy: extract SYNPROXY infrastructure from {ipt, ip6t}_SYNPROXY 



Add common functions into nf_synproxy_core.c to prepare for nftables support.
The prototypes of the functions used by {ipt, ip6t}_SYNPROXY are in the new
file nf_synproxy.h

Signed-off-by: default avatarFernando Fernandez Mancera <ffmancera@riseup.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3006a522

include/net/netfilter/nf_conntrack_synproxy.h

+2 −11
Original line number Diff line number Diff line
@@ -72,21 +72,12 @@ struct synproxy_options { 
};



struct tcphdr;

struct xt_synproxy_info;

struct nf_synproxy_info;

bool synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,

			    const struct tcphdr *th,

			    struct synproxy_options *opts);

unsigned int synproxy_options_size(const struct synproxy_options *opts);

void synproxy_build_options(struct tcphdr *th,

			    const struct synproxy_options *opts);



void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,

void synproxy_init_timestamp_cookie(const struct nf_synproxy_info *info,

				    struct synproxy_options *opts);

void synproxy_check_timestamp_cookie(struct synproxy_options *opts);



unsigned int synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff,

				    struct tcphdr *th, struct nf_conn *ct,

				    enum ip_conntrack_info ctinfo,

				    const struct nf_conn_synproxy *synproxy);



#endif /* _NF_CONNTRACK_SYNPROXY_H */

include/net/netfilter/nf_synproxy.h

0 → 100644
+44 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

#ifndef _NF_SYNPROXY_SHARED_H

#define _NF_SYNPROXY_SHARED_H



#include <linux/module.h>

#include <linux/skbuff.h>

#include <net/ip6_checksum.h>

#include <net/ip6_route.h>

#include <net/tcp.h>



#include <net/netfilter/nf_conntrack_seqadj.h>

#include <net/netfilter/nf_conntrack_synproxy.h>



void synproxy_send_client_synack(struct net *net, const struct sk_buff *skb,

				 const struct tcphdr *th,

				 const struct synproxy_options *opts);



bool synproxy_recv_client_ack(struct net *net,

			      const struct sk_buff *skb,

			      const struct tcphdr *th,

			      struct synproxy_options *opts, u32 recv_seq);



unsigned int ipv4_synproxy_hook(void *priv, struct sk_buff *skb,

				const struct nf_hook_state *nhs);

int nf_synproxy_ipv4_init(struct synproxy_net *snet, struct net *net);

void nf_synproxy_ipv4_fini(struct synproxy_net *snet, struct net *net);



#if IS_ENABLED(CONFIG_IPV6)

void synproxy_send_client_synack_ipv6(struct net *net,

				      const struct sk_buff *skb,

				      const struct tcphdr *th,

				      const struct synproxy_options *opts);



bool synproxy_recv_client_ack_ipv6(struct net *net, const struct sk_buff *skb,

				   const struct tcphdr *th,

				   struct synproxy_options *opts, u32 recv_seq);



unsigned int ipv6_synproxy_hook(void *priv, struct sk_buff *skb,

				const struct nf_hook_state *nhs);

int nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net);

void nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net);

#endif /* CONFIG_IPV6 */



#endif /* _NF_SYNPROXY_SHARED_H */

net/ipv4/netfilter/ipt_SYNPROXY.c

+6 −388
Original line number Diff line number Diff line
@@ -6,258 +6,11 @@ 
 * published by the Free Software Foundation.

 */



#include <linux/module.h>

#include <linux/skbuff.h>

#include <net/tcp.h>



#include <linux/netfilter_ipv4/ip_tables.h>

#include <linux/netfilter/x_tables.h>

#include <linux/netfilter/xt_SYNPROXY.h>

#include <net/netfilter/nf_conntrack.h>

#include <net/netfilter/nf_conntrack_seqadj.h>

#include <net/netfilter/nf_conntrack_synproxy.h>

#include <net/netfilter/nf_conntrack_ecache.h>



static struct iphdr *

synproxy_build_ip(struct net *net, struct sk_buff *skb, __be32 saddr,

		  __be32 daddr)

{

	struct iphdr *iph;



	skb_reset_network_header(skb);

	iph = skb_put(skb, sizeof(*iph));

	iph->version	= 4;

	iph->ihl	= sizeof(*iph) / 4;

	iph->tos	= 0;

	iph->id		= 0;

	iph->frag_off	= htons(IP_DF);

	iph->ttl	= net->ipv4.sysctl_ip_default_ttl;

	iph->protocol	= IPPROTO_TCP;

	iph->check	= 0;

	iph->saddr	= saddr;

	iph->daddr	= daddr;



	return iph;

}



static void

synproxy_send_tcp(struct net *net,

		  const struct sk_buff *skb, struct sk_buff *nskb,

		  struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,

		  struct iphdr *niph, struct tcphdr *nth,

		  unsigned int tcp_hdr_size)

{

	nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);

	nskb->ip_summed   = CHECKSUM_PARTIAL;

	nskb->csum_start  = (unsigned char *)nth - nskb->head;

	nskb->csum_offset = offsetof(struct tcphdr, check);



	skb_dst_set_noref(nskb, skb_dst(skb));

	nskb->protocol = htons(ETH_P_IP);

	if (ip_route_me_harder(net, nskb, RTN_UNSPEC))

		goto free_nskb;



	if (nfct) {

		nf_ct_set(nskb, (struct nf_conn *)nfct, ctinfo);

		nf_conntrack_get(nfct);

	}



	ip_local_out(net, nskb->sk, nskb);

	return;



free_nskb:

	kfree_skb(nskb);

}



static void

synproxy_send_client_synack(struct net *net,

			    const struct sk_buff *skb, const struct tcphdr *th,

			    const struct synproxy_options *opts)

{

	struct sk_buff *nskb;

	struct iphdr *iph, *niph;

	struct tcphdr *nth;

	unsigned int tcp_hdr_size;

	u16 mss = opts->mss;



	iph = ip_hdr(skb);



	tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);

	nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,

			 GFP_ATOMIC);

	if (nskb == NULL)

		return;

	skb_reserve(nskb, MAX_TCP_HEADER);



	niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);



	skb_reset_transport_header(nskb);

	nth = skb_put(nskb, tcp_hdr_size);

	nth->source	= th->dest;

	nth->dest	= th->source;

	nth->seq	= htonl(__cookie_v4_init_sequence(iph, th, &mss));

	nth->ack_seq	= htonl(ntohl(th->seq) + 1);

	tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;

	if (opts->options & XT_SYNPROXY_OPT_ECN)

		tcp_flag_word(nth) |= TCP_FLAG_ECE;

	nth->doff	= tcp_hdr_size / 4;

	nth->window	= 0;

	nth->check	= 0;

	nth->urg_ptr	= 0;



	synproxy_build_options(nth, opts);



	synproxy_send_tcp(net, skb, nskb, skb_nfct(skb),

			  IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);

}



static void

synproxy_send_server_syn(struct net *net,

			 const struct sk_buff *skb, const struct tcphdr *th,

			 const struct synproxy_options *opts, u32 recv_seq)

{

	struct synproxy_net *snet = synproxy_pernet(net);

	struct sk_buff *nskb;

	struct iphdr *iph, *niph;

	struct tcphdr *nth;

	unsigned int tcp_hdr_size;



	iph = ip_hdr(skb);



	tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);

	nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,

			 GFP_ATOMIC);

	if (nskb == NULL)

		return;

	skb_reserve(nskb, MAX_TCP_HEADER);



	niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);



	skb_reset_transport_header(nskb);

	nth = skb_put(nskb, tcp_hdr_size);

	nth->source	= th->source;

	nth->dest	= th->dest;

	nth->seq	= htonl(recv_seq - 1);

	/* ack_seq is used to relay our ISN to the synproxy hook to initialize

	 * sequence number translation once a connection tracking entry exists.

	 */

	nth->ack_seq	= htonl(ntohl(th->ack_seq) - 1);

	tcp_flag_word(nth) = TCP_FLAG_SYN;

	if (opts->options & XT_SYNPROXY_OPT_ECN)

		tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;

	nth->doff	= tcp_hdr_size / 4;

	nth->window	= th->window;

	nth->check	= 0;

	nth->urg_ptr	= 0;



	synproxy_build_options(nth, opts);



	synproxy_send_tcp(net, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,

			  niph, nth, tcp_hdr_size);

}



static void

synproxy_send_server_ack(struct net *net,

			 const struct ip_ct_tcp *state,

			 const struct sk_buff *skb, const struct tcphdr *th,

			 const struct synproxy_options *opts)

{

	struct sk_buff *nskb;

	struct iphdr *iph, *niph;

	struct tcphdr *nth;

	unsigned int tcp_hdr_size;



	iph = ip_hdr(skb);



	tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);

	nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,

			 GFP_ATOMIC);

	if (nskb == NULL)

		return;

	skb_reserve(nskb, MAX_TCP_HEADER);



	niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);



	skb_reset_transport_header(nskb);

	nth = skb_put(nskb, tcp_hdr_size);

	nth->source	= th->dest;

	nth->dest	= th->source;

	nth->seq	= htonl(ntohl(th->ack_seq));

	nth->ack_seq	= htonl(ntohl(th->seq) + 1);

	tcp_flag_word(nth) = TCP_FLAG_ACK;

	nth->doff	= tcp_hdr_size / 4;

	nth->window	= htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);

	nth->check	= 0;

	nth->urg_ptr	= 0;



	synproxy_build_options(nth, opts);



	synproxy_send_tcp(net, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);

}



static void

synproxy_send_client_ack(struct net *net,

			 const struct sk_buff *skb, const struct tcphdr *th,

			 const struct synproxy_options *opts)

{

	struct sk_buff *nskb;

	struct iphdr *iph, *niph;

	struct tcphdr *nth;

	unsigned int tcp_hdr_size;



	iph = ip_hdr(skb);



	tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);

	nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,

			 GFP_ATOMIC);

	if (nskb == NULL)

		return;

	skb_reserve(nskb, MAX_TCP_HEADER);



	niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);



	skb_reset_transport_header(nskb);

	nth = skb_put(nskb, tcp_hdr_size);

	nth->source	= th->source;

	nth->dest	= th->dest;

	nth->seq	= htonl(ntohl(th->seq) + 1);

	nth->ack_seq	= th->ack_seq;

	tcp_flag_word(nth) = TCP_FLAG_ACK;

	nth->doff	= tcp_hdr_size / 4;

	nth->window	= htons(ntohs(th->window) >> opts->wscale);

	nth->check	= 0;

	nth->urg_ptr	= 0;



	synproxy_build_options(nth, opts);



	synproxy_send_tcp(net, skb, nskb, skb_nfct(skb),

			  IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);

}



static bool

synproxy_recv_client_ack(struct net *net,

			 const struct sk_buff *skb, const struct tcphdr *th,

			 struct synproxy_options *opts, u32 recv_seq)

{

	struct synproxy_net *snet = synproxy_pernet(net);

	int mss;



	mss = __cookie_v4_check(ip_hdr(skb), th, ntohl(th->ack_seq) - 1);

	if (mss == 0) {

		this_cpu_inc(snet->stats->cookie_invalid);

		return false;

	}



	this_cpu_inc(snet->stats->cookie_valid);

	opts->mss = mss;

	opts->options |= XT_SYNPROXY_OPT_MSS;



	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)

		synproxy_check_timestamp_cookie(opts);



	synproxy_send_server_syn(net, skb, th, opts, recv_seq);

	return true;

}

#include <net/netfilter/nf_synproxy.h>



static unsigned int

synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
@@ -309,135 +62,6 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par) 
	return XT_CONTINUE;

}



static unsigned int ipv4_synproxy_hook(void *priv,

				       struct sk_buff *skb,

				       const struct nf_hook_state *nhs)

{

	struct net *net = nhs->net;

	struct synproxy_net *snet = synproxy_pernet(net);

	enum ip_conntrack_info ctinfo;

	struct nf_conn *ct;

	struct nf_conn_synproxy *synproxy;

	struct synproxy_options opts = {};

	const struct ip_ct_tcp *state;

	struct tcphdr *th, _th;

	unsigned int thoff;



	ct = nf_ct_get(skb, &ctinfo);

	if (ct == NULL)

		return NF_ACCEPT;



	synproxy = nfct_synproxy(ct);

	if (synproxy == NULL)

		return NF_ACCEPT;



	if (nf_is_loopback_packet(skb) ||

	    ip_hdr(skb)->protocol != IPPROTO_TCP)

		return NF_ACCEPT;



	thoff = ip_hdrlen(skb);

	th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);

	if (th == NULL)

		return NF_DROP;



	state = &ct->proto.tcp;

	switch (state->state) {

	case TCP_CONNTRACK_CLOSE:

		if (th->rst && !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {

			nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -

						      ntohl(th->seq) + 1);

			break;

		}



		if (!th->syn || th->ack ||

		    CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)

			break;



		/* Reopened connection - reset the sequence number and timestamp

		 * adjustments, they will get initialized once the connection is

		 * reestablished.

		 */

		nf_ct_seqadj_init(ct, ctinfo, 0);

		synproxy->tsoff = 0;

		this_cpu_inc(snet->stats->conn_reopened);



		/* fall through */

	case TCP_CONNTRACK_SYN_SENT:

		if (!synproxy_parse_options(skb, thoff, th, &opts))

			return NF_DROP;



		if (!th->syn && th->ack &&

		    CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {

			/* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,

			 * therefore we need to add 1 to make the SYN sequence

			 * number match the one of first SYN.

			 */

			if (synproxy_recv_client_ack(net, skb, th, &opts,

						     ntohl(th->seq) + 1)) {

				this_cpu_inc(snet->stats->cookie_retrans);

				consume_skb(skb);

				return NF_STOLEN;

			} else {

				return NF_DROP;

			}

		}



		synproxy->isn = ntohl(th->ack_seq);

		if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)

			synproxy->its = opts.tsecr;



		nf_conntrack_event_cache(IPCT_SYNPROXY, ct);

		break;

	case TCP_CONNTRACK_SYN_RECV:

		if (!th->syn || !th->ack)

			break;



		if (!synproxy_parse_options(skb, thoff, th, &opts))

			return NF_DROP;



		if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP) {

			synproxy->tsoff = opts.tsval - synproxy->its;

			nf_conntrack_event_cache(IPCT_SYNPROXY, ct);

		}



		opts.options &= ~(XT_SYNPROXY_OPT_MSS |

				  XT_SYNPROXY_OPT_WSCALE |

				  XT_SYNPROXY_OPT_SACK_PERM);



		swap(opts.tsval, opts.tsecr);

		synproxy_send_server_ack(net, state, skb, th, &opts);



		nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));

		nf_conntrack_event_cache(IPCT_SEQADJ, ct);



		swap(opts.tsval, opts.tsecr);

		synproxy_send_client_ack(net, skb, th, &opts);



		consume_skb(skb);

		return NF_STOLEN;

	default:

		break;

	}



	synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);

	return NF_ACCEPT;

}



static const struct nf_hook_ops ipv4_synproxy_ops[] = {

	{

		.hook		= ipv4_synproxy_hook,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM - 1,

	},

	{

		.hook		= ipv4_synproxy_hook,

		.pf		= NFPROTO_IPV4,

		.hooknum	= NF_INET_POST_ROUTING,

		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM - 1,

	},

};



static int synproxy_tg4_check(const struct xt_tgchk_param *par)

{

	struct synproxy_net *snet = synproxy_pernet(par->net);
@@ -452,14 +76,11 @@ static int synproxy_tg4_check(const struct xt_tgchk_param *par) 
	if (err)

		return err;



	if (snet->hook_ref4 == 0) {

		err = nf_register_net_hooks(par->net, ipv4_synproxy_ops,

					    ARRAY_SIZE(ipv4_synproxy_ops));

	err = nf_synproxy_ipv4_init(snet, par->net);

	if (err) {

		nf_ct_netns_put(par->net, par->family);

		return err;

	}

	}



	snet->hook_ref4++;

	return err;
@@ -469,10 +90,7 @@ static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par) 
{

	struct synproxy_net *snet = synproxy_pernet(par->net);



	snet->hook_ref4--;

	if (snet->hook_ref4 == 0)

		nf_unregister_net_hooks(par->net, ipv4_synproxy_ops,

					ARRAY_SIZE(ipv4_synproxy_ops));

	nf_synproxy_ipv4_fini(snet, par->net);

	nf_ct_netns_put(par->net, par->family);

}

net/ipv6/netfilter/ip6t_SYNPROXY.c

+9 −411

File changed.

Preview size limit exceeded, changes collapsed.

net/netfilter/nf_synproxy_core.c

+859 −37

File changed.

Preview size limit exceeded, changes collapsed.

CRA Git | Maintained and supported by SUSTech CRA and CCSE