Transparent Proxying Patches, Take 3

ip_route_output() contains a check to make sure that no flows with non-local source IP addresses are routed. This obviously makes using such addresses impossible.

This patch introduces a flowi flag which makes omitting this check possible. The new flag provides a way of handling transparent and non-transparent connections differently.

Signed-off-by Julian Anastasov <[email protected]>

Signed-off-by KOVACS Krisztian <[email protected]>

This patch introduces the IP_TRANSPARENT socket option: enabling that will make the IPv4 routing omit the non-local source address check on output. Setting IP_TRANSPARENT requires NET_ADMIN capability.

Signed-off-by KOVACS Krisztian <[email protected]>

Setting IP_TRANSPARENT is not really useful without allowing non-local binds for the socket. To make user-space code simpler we allow these binds even if IP_TRANSPARENT is set but IP_FREEBIND is not.

Signed-off-by Tóth László Attila <[email protected]>

The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to incoming packets. The non-local source address check on output bites us again, as replies for transparently redirected traffic won't have a chance to leave the node.

This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing the route lookup for those replies. Transparent replies are enabled if the listening socket has the transparent socket flag set.

include/net/ip.h                |    3 +++
include/net/request_sock.h      |    3 ++-
net/ipv4/inet_connection_sock.c |    2 ++
net/ipv4/ip_output.c            |    6 +++++-
net/ipv4/syncookies.c           |    2 ++
net/ipv4/tcp_ipv4.c             |   17 ++++++++++-------
net/ipv4/tcp_minisocks.c        |    3 ++-
net/ipv6/tcp_ipv6.c             |    5 +++--
8 files changed, 29 insertions(+), 12 deletions(-)

Quoted 6 lines

The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to incoming packets. The non-local source address check on output bites us again, as replies for transparently redirected traffic won't have a chance to leave the node.

Quoted 3 lines

This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing the route lookup for those replies. Transparent replies are enabled if the listening socket has the transparent socket flag set.

I needed to add extra patches to actually compile it cleanly....

Quoted 10 lines

include/net/ip.h                |    3 +++
include/net/request_sock.h      |    3 ++-
net/ipv4/inet_connection_sock.c |    2 ++
net/ipv4/ip_output.c            |    6 +++++-
net/ipv4/syncookies.c           |    2 ++
net/ipv4/tcp_ipv4.c             |   17 ++++++++++-------
net/ipv4/tcp_minisocks.c        |    3 ++-
net/ipv6/tcp_ipv6.c             |    5 +++--
8 files changed, 29 insertions(+), 12 deletions(-)

Signed-off-by Jan Engelhardt <[email protected]>

part 2/2.

Quoted 1 line

Signed-off-by Jan Engelhardt <[email protected]>

---
 net/ipv6/tcp_ipv6.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: linux-2.6.22.3/net/ipv6/tcp_ipv6.c
===================================================================

net/ipv6/tcp_ipv6.c +0 -1

@@ -73,7 +73,7 @@
 static struct socket *tcp6_socket;
 
 static void	tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
-static void	tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct

request_sock *req); +static void tcp_v6_reqsk_send_ack(struct sk_buff
*skb, struct request_sock *req, int); static
void tcp_v6_send_check(struct sock *sk, int len,

net/ipv6/tcp_ipv6.c +0 -1

 				  struct sk_buff *skb);

@@ -1195,7 +1195,7 @@ static void tcp_v6_timewait_ack(struct s
 	inet_twsk_put(tw);
 }
 
-static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct

request_sock *req) +static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req, int reply_flags) {
tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1,
tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent); } -
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 11 lines

---
 net/ipv6/tcp_ipv6.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: linux-2.6.22.3/net/ipv6/tcp_ipv6.c
===================================================================

net/ipv6/tcp_ipv6.c +0 -0

@@ -73,7 +73,7 @@
 static struct socket *tcp6_socket;
 

Quoted 6 lines

net/ipv6/tcp_ipv6.c +0 -1

 static void	tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
-static void	tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct

request_sock *req); +static void tcp_v6_reqsk_send_ack(struct sk_buff
*skb, struct request_sock *req, int); static
void tcp_v6_send_check(struct sock *sk, int len,
struct sk_buff *skb);

This is already _in_ the patch I've sent.

Signed-off-by Jan Engelhardt <[email protected]>

---
 net/dccp/dccp.h      |    3 ++-
 net/dccp/minisocks.c |    3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

Index: linux-2.6.22.1/net/dccp/dccp.h
===================================================================

net/dccp/dccp.h +0 -1

@@ -209,7 +209,8 @@ extern int  dccp_retransmit_skb(struct s
 
 extern void dccp_send_ack(struct sock *sk);
 extern void dccp_send_delayed_ack(struct sock *sk);
-extern void dccp_reqsk_send_ack(struct sk_buff *sk, struct

request_sock *rsk); +extern void dccp_reqsk_send_ack(struct sk_buff
*sk, struct request_sock *rsk, + int reply_flags);

extern void dccp_send_sync(struct sock *sk, const u64 seq,
const enum dccp_pkt_type pkt_type);
Index: linux-2.6.22.1/net/dccp/minisocks.c
===================================================================

The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to incoming packets. The non-local source address check on output bites us again, as replies for transparently redirected traffic won't have a chance to leave the node.

This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing the route lookup for those replies. Transparent replies are enabled if the listening socket has the transparent socket flag set.

Signed-off-by KOVACS Krisztian <[email protected]>

---

include/net/request_sock.h +0 -0

index 7aed02c..b9c8974 100644

net/ipv4/tcp_ipv4.c +1 -1

index e089a97..7ae47e6 100644
@@ -625,7 +626,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
 
 static void tcp_v4_send_ack(struct tcp_timewait_sock *twsk,
 			    struct sk_buff *skb, u32 seq, u32 ack,
-			    u32 win, u32 ts)
+			    u32 win, u32 ts, int reply_flags)
 {
 	struct tcphdr *th = tcp_hdr(skb);
 	struct {

Quoted 12 lines · KOVACS Krisztian

The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to incoming packets. The non-local source address check on output bites us again, as replies for transparently redirected traffic won't have a chance to leave the node.

This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing the route lookup for those replies. Transparent replies are enabled if the listening socket has the transparent socket flag set.

Signed-off-by KOVACS Krisztian <[email protected]>

---

include/net/request_sock.h struct request_sock_ops { · line 38

Quoted 11 lines

include/net/request_sock.h +2 -1

index 7aed02c..b9c8974 100644
@@ -34,7 +34,8 @@ struct request_sock_ops {
 				       struct request_sock *req,
 				       struct dst_entry *dst);
 	void		(*send_ack)(struct sk_buff *skb,
-				    struct request_sock *req);
+				    struct request_sock *req,
+				    int reply_flags);

How about putting the flags in the request_sock?

Quoted 5 lines

(quoted diff) +0 -0

b/net/ipv4/inet_connection_sock.c index fbe7714..26b9dbe 100644

net/ipv4/inet_connection_sock.c +0 -0

@@ -321,6 +321,8 @@ struct dst_entry* inet_csk_route_req(struct sock

net/ipv4/inet_connection_sock.c struct dst_entry* inet_csk_route_req(struct sock *sk, · line 325

Quoted 5 lines

net/ipv4/inet_connection_sock.c +2 -0

 *sk, .saddr = ireq->loc_addr,
 					.tos = RT_CONN_FLAGS(sk) } },
 			    .proto = sk->sk_protocol,
+			    .flags = inet_sk(sk)->transparent ?
+					FLOWI_FLAG_ANYSRC : 0,

Introducing a function (sk_flowi_flags(sk) or something) might make it a bit nicer to look at.

Quoted 7 lines

net/ipv4/tcp_ipv4.c +0 -0

index e089a97..7ae47e6 100644
@@ -625,7 +626,7 @@ static void tcp_v4_send_reset(struct sock *sk,
 struct sk_buff *skb)
 

net/ipv4/tcp_ipv4.c static void tcp_v4_send_ack(struct · line 705

Quoted 12 lines

net/ipv4/tcp_ipv4.c +1 -1

 static void tcp_v4_send_ack(struct tcp_timewait_sock *twsk,
 			    struct sk_buff *skb, u32 seq, u32 ack,
-			    u32 win, u32 ts)
+			    u32 win, u32 ts, int reply_flags)
 {
 	struct tcphdr *th = tcp_hdr(skb);

net/ipv4/tcp_ipv4.c +1 -0

 	struct {

@@ -701,36 +702,37 @@ static void tcp_v4_send_ack(struct
 tcp_timewait_sock *twsk, arg.iov[0].iov_len);
 	}
 #endif
+	arg.flags = reply_flags;

Shouldn't this use twsk->transparent?

Current TCP code relies on the local port of the listening socket being the same as the destination address of the incoming connection. Port redirection used by many transparent proxying techniques obviously breaks this, so we have to store the original destination port address.

This patch extends struct inet_request_sock and stores the incoming destination port value there. It also modifies the handshake code to use that value as the source port when sending reply packets.

Signed-off-by KOVACS Krisztian <[email protected]>

---

include/net/inet_sock.h +3 -0

index e86832d..5339089 100644
@@ -65,6 +65,9 @@ struct inet_request_sock {
 #endif
 	__be32			loc_addr;
 	__be32			rmt_addr;
+#if defined(CONFIG_NETFILTER_TPROXY) || defined(CONFIG_NETFILTER_TPROXY_MODULE)
+	__be16			loc_port;
+#endif
 	__be16			rmt_port;
 	u16			snd_wscale : 4, 
 				rcv_wscale : 4, 

include/net/tcp.h +3 -0

index 54053de..927d235 100644
@@ -980,6 +980,9 @@ static inline void tcp_openreq_init(struct request_sock *req,
 	ireq->acked = 0;
 	ireq->ecn_ok = 0;
 	ireq->rmt_port = tcp_hdr(skb)->source;
+#if defined(CONFIG_NETFILTER_TPROXY) || defined(CONFIG_NETFILTER_TPROXY_MODULE)
+	ireq->loc_port = tcp_hdr(skb)->dest;
+#endif
 }
 
 extern void tcp_enter_memory_pressure(void);

net/ipv4/inet_connection_sock.c +0 -0

index 26b9dbe..f47d966 100644

ipv4/tcp_output.c
index 666d8a5..69dd230 100644

Quoted 49 lines · KOVACS Krisztian

Current TCP code relies on the local port of the listening socket being the same as the destination address of the incoming connection. Port redirection used by many transparent proxying techniques obviously breaks this, so we have to store the original destination port address.

This patch extends struct inet_request_sock and stores the incoming destination port value there. It also modifies the handshake code to use that value as the source port when sending reply packets.

Signed-off-by KOVACS Krisztian <[email protected]>

---

include/net/inet_sock.h +2 -0

index e86832d..5339089 100644
@@ -65,6 +65,9 @@ struct inet_request_sock {
 #endif
 	__be32			loc_addr;
 	__be32			rmt_addr;
+#if defined(CONFIG_NETFILTER_TPROXY) ||
 defined(CONFIG_NETFILTER_TPROXY_MODULE) +	__be16			loc_port;
+#endif
 	__be16			rmt_port;
 	u16			snd_wscale : 4,
 				rcv_wscale : 4,

include/net/tcp.h +1 -0

index 54053de..927d235 100644
@@ -980,6 +980,9 @@ static inline void tcp_openreq_init(struct
 request_sock *req, ireq->acked = 0;
 	ireq->ecn_ok = 0;
 	ireq->rmt_port = tcp_hdr(skb)->source;
+#if defined(CONFIG_NETFILTER_TPROXY) ||

defined(CONFIG_NETFILTER_TPROXY_MODULE) + ireq->loc_port =
tcp_hdr(skb)->dest;

include/net/tcp.h +1 -0

+#endif
 }
 
 extern void tcp_enter_memory_pressure(void);

(quoted diff) +0 -0

b/net/ipv4/inet_connection_sock.c index 26b9dbe..f47d966 100644

net/ipv4/inet_connection_sock.c +0 -0

@@ -502,6 +502,10 @@ struct sock *inet_csk_clone(struct sock *sk,
 const struct request_sock *req, newicsk->icsk_bind_hash = NULL;
 

net/ipv4/inet_connection_sock.c struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req, · line 507

Quoted 6 lines

net/ipv4/inet_connection_sock.c +1 -0

 		inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
+#if defined(CONFIG_IP_NF_TPROXY) ||

defined(CONFIG_IP_NF_TPROXY_MODULE) + inet_sk(newsk)->num =
ntohs(inet_rsk(req)->loc_port);

net/ipv4/inet_connection_sock.c +1 -0

+		inet_sk(newsk)->sport = inet_rsk(req)->loc_port;

Why do you store the port twice here?

Quoted 7 lines

ipv4/tcp_output.c
index 666d8a5..69dd230 100644

net/ipv4/tcp_output.c +0 -0

@@ -2153,7 +2153,11 @@ struct sk_buff * tcp_make_synack(struct sock
 *sk, struct dst_entry *dst, th->syn = 1;
 	th->ack = 1;

net/ipv4/tcp_output.c struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst, · line 2160

Quoted 6 lines

net/ipv4/tcp_output.c +3 -0

 	TCP_ECN_make_synack(req, th);
+#if defined(CONFIG_IP_NF_TPROXY) ||
 defined(CONFIG_IP_NF_TPROXY_MODULE) +	th->source = ireq->loc_port;
+#else
 	th->source = inet_sk(sk)->sport;
+#endif

I think this should simply use loc_port unconditionally.

Quoted 7 lines

Quoted 7 lines

ipv4/tcp_output.c
index 666d8a5..69dd230 100644

net/ipv4/tcp_output.c +0 -0

@@ -2153,7 +2153,11 @@ struct sk_buff * tcp_make_synack(struct sock
 *sk, struct dst_entry *dst, th->syn = 1;
 	th->ack = 1;

Quoted 8 lines

net/ipv4/tcp_output.c struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst, · line 2160

Quoted 6 lines

net/ipv4/tcp_output.c +3 -0

 	TCP_ECN_make_synack(req, th);
+#if defined(CONFIG_IP_NF_TPROXY) ||
 defined(CONFIG_IP_NF_TPROXY_MODULE) +	th->source = ireq->loc_port;
+#else
 	th->source = inet_sk(sk)->sport;
+#endif

I think this should simply use loc_port unconditionally.

Unfortunately ireq->loc_port does not exist unless tproxy is enabled in the config. (We could remove all these #ifdefs but that would mean extending inet_request_sock with 2 bytes even if tproxy is not enabled.)

Quoted 17 lines · KOVACS Krisztian

Quoted 15 lines

net/ipv4/tcp_output.c struct sk_buff * tcp_make_synack(struct sock · line 2160

Quoted 13 lines

ipv4/tcp_output.c
index 666d8a5..69dd230 100644

net/ipv4/tcp_output.c +3 -0

@@ -2153,7 +2153,11 @@ struct sk_buff * tcp_make_synack(struct sock
 *sk, struct dst_entry *dst, th->syn = 1;
 	th->ack = 1;
 	TCP_ECN_make_synack(req, th);
+#if defined(CONFIG_IP_NF_TPROXY) ||
 defined(CONFIG_IP_NF_TPROXY_MODULE) +	th->source = ireq->loc_port;
+#else
 	th->source = inet_sk(sk)->sport;
+#endif

I think this should simply use loc_port unconditionally.

Quoted 3 lines

Unfortunately ireq->loc_port does not exist unless tproxy is enabled in the config. (We could remove all these #ifdefs but that would mean extending inet_request_sock with 2 bytes even if tproxy is not enabled.)

There's a 2 byte hole with IPv6 where you could put this in. I think even without IPv6 the small waste is not worth the increased testing complexity.

Netfilter connection tracking requires all IPv4 packets to be defragmented. Both the socket match and the TPROXY target depend on this functionality, so this patch separates the Netfilter IPv4 defrag hooks into a separate module.

Signed-off-by KOVACS Krisztian <[email protected]>

The iptables tproxy core is a module that contains the common routines used by various tproxy related modules (TPROXY target and socket match)

Signed-off-by KOVACS Krisztian <[email protected]>

Add iptables 'socket' match, which matches packets for which a TCP/UDP socket lookup succeeds.

---

+static struct xt_match socket_matches[] = {

The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.)

net/netfilter/xt_TPROXY.c new file +18 -0

+static unsigned int
+tproxy_target(struct sk_buff **pskb, const struct net_device *in,
+              const struct net_device *out, unsigned int hooknum,
+              const struct xt_target *target, const void *targinfo)
+{
+	const struct xt_tproxy_info *tgi = targinfo;
+	const struct iphdr *iph = ip_hdr(*pskb);
+	struct sk_buff *skb = *pskb;
+	struct udphdr _hdr, *hp;
+
+	/* TCP/UDP only */
+	if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP)
+		return NF_ACCEPT;
+
+	hp = skb_header_pointer(*pskb, iph->ihl * 4, sizeof(_hdr), &_hdr);
+	if (hp == NULL)
+		return NF_DROP;
+

include/linux/netfilter/xt_TPROXY.h line 14

Quoted 6 lines · KOVACS Krisztian

include/linux/netfilter/xt_TPROXY.h new file +6 -0

+struct ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	unsigned long mark_mask;
+	unsigned long mark_value;
+};

Cannot use unsigned long, as its size is not fixed.

(other nitpicks that were already in xt_socket)

Review

Quoted 5 lines

(quoted diff) +5 -0

+	/* NOTE: assign_sock consumes our sk reference */
+	if (sk && nf_tproxy_assign_sock(skb, sk)) {
+		/* This should be in a separate target, but we don't do multiple
+		   targets on the same rule yet */
+		skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;

I guess you mean | instead of ^ here.

Review

Quoted 9 lines

(quoted diff) +8 -0

+#ifdef CONFIG_COMPAT
+struct compat_ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	__be16 __pad1;
+	compat_ulong_t mark_mask;
+	compat_ulong_t mark_value;
+};

Uhm, that's a bit cumbersome. By reordering, we can get all the alignment done without any premature compat code.

Find below a patch that makes me happy, and compiles. :)

[ xtification comes at no cost, even if it's ipv4-only.
Although it is just a guess, I suppose xt_ is going to replace ipt_ and ip6t_ even if some matches/targets are not all-protocol ]

===

The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.)

(originally from: KOVACS Krisztian <[email protected]>)

A few cleanups and fixes.

Signed-off-by Jan Engelhardt <[email protected]>

---

 include/linux/netfilter/xt_TPROXY.h |   16 ++++++
 net/netfilter/Kconfig               |   12 ++++
 net/netfilter/Makefile              |    1
 net/netfilter/xt_TPROXY.c           |   92

++++++++++++++++++++++++++++++++++++ 4 files changed, 121 insertions(+)

Index: linux-2.6.23/include/linux/netfilter/xt_TPROXY.h
===================================================================

include/linux/netfilter/xt_TPROXY.h new file +16 -0

@@ -0,0 +1,16 @@
+#ifndef _XT_TPROXY_H
+#define _XT_TPROXY_H
+
+/*
+ * TPROXY target is capable of marking the packet to perform
+ * redirection. We can get rid of that whenever we get support for
+ * mutliple targets in the same rule.
+ */
+struct xt_tproxy_info {
+	u_int32_t mark_mask;
+	u_int32_t mark_value;
+	__be32 laddr;
+	__be16 lport;
+};
+
+#endif /* _XT_TPROXY_H */

Index: linux-2.6.23/net/netfilter/Kconfig
===================================================================

net/netfilter/Kconfig +12 -0

@@ -363,6 +363,18 @@ config NETFILTER_XT_TARGET_NOTRACK
 	  If you want to compile it as a module, say M here and read
 	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_TARGET_TPROXY
+	tristate '"TPROXY" target support'
+	depends on NETFILTER_TPROXY
+	depends on NETFILTER_XTABLES
+	help
+	  This option adds a "TPROXY" target, which is somewhat similar to
+	  REDIRECT. It can only be used in the tproxy table and is useful
+	  to redirect traffic to a transparent proxy. It does _not_ depend
+	  on Netfilter connection tracking.
+
+	  To compile it as a module, choose M here. If unsure, say N.
+
 config NETFILTER_XT_TARGET_TRACE
 	tristate  '"TRACE" target support'
 	depends on NETFILTER_XTABLES

Index: linux-2.6.23/net/netfilter/Makefile
===================================================================

net/netfilter/Makefile +1 -0

@@ -50,6 +50,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG)
 obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_TPROXY) += xt_TPROXY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
 

Index: linux-2.6.23/net/netfilter/xt_TPROXY.c
===================================================================

net/netfilter/xt_TPROXY.c new file +7 -0

@@ -0,0 +1,92 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (c) 2006-2007 BalaBit IT Ltd.
+ * Author: Balazs Scheidler, Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or

modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation.
+ *
+ */

net/netfilter/xt_TPROXY.c new file +49 -0

+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+#include <net/inet_sock.h>
+#include <net/udp.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_TPROXY.h>
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#include <net/netfilter/nf_tproxy_core.h>
+
+static unsigned int
+tproxy_target(struct sk_buff **pskb, const struct net_device *in,
+              const struct net_device *out, unsigned int hooknum,
+              const struct xt_target *target, const void *targinfo)
+{
+	const struct xt_tproxy_info *tgi = targinfo;
+	const struct iphdr *iph = ip_hdr(*pskb);
+	struct sk_buff *skb = *pskb;
+	struct udphdr _hdr, *hp;
+	struct sock *sk;
+
+	/* TCP/UDP only */
+	if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP)
+		return NF_ACCEPT;
+
+	hp = skb_header_pointer(*pskb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
+	if (hp == NULL)
+		return NF_DROP;
+
+	sk = nf_tproxy_get_sock_v4(iph->protocol, iph->saddr,
+	     tgi->laddr ? tgi->laddr : iph->daddr, hp->source,
+	     tgi->lport ? tgi->lport : hp->dest, in, true);
+
+	/* NOTE: assign_sock consumes our sk reference */
+	if (sk != NULL && nf_tproxy_assign_sock(skb, sk) != 0) {
+		/*
+		 * This should be in a separate target, but we do not do
+		 * multiple targets on the same rule yet.
+		 */
+		skb->mark = (skb->mark & ~tgi->mark_mask) | tgi->mark_value;
+
+		pr_debug("redirecting: proto %u %08x:%u -> %08x:%u, mark: %x\n",
+		         iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),
+		         ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+		return NF_ACCEPT;
+	}
+
+	pr_debug("no socket, dropping: proto %u %08x:%u -> %08x:%u, mark:

%x\n", + iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),

net/netfilter/xt_TPROXY.c new file +29 -0

+	         ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+	return NF_DROP;
+}
+
+static struct xt_target xt_tproxy_reg = {
+	.name       = "TPROXY",
+	.family     = AF_INET,
+	.table      = "mangle",
+	.target     = tproxy_target,
+	.targetsize = sizeof(struct xt_tproxy_info),
+	.hooks      = 1 << NF_IP_PRE_ROUTING,
+	.me         = THIS_MODULE,
+};
+
+static int __init xt_tproxy_init(void)
+{
+	nf_defrag_ipv4_enable();
+	return xt_register_target(&xt_tproxy_reg);
+}
+
+static void __exit xt_tproxy_exit(void)
+{
+	xt_unregister_target(&xt_tproxy_reg);
+}
+
+module_init(xt_tproxy_init);
+module_exit(xt_tproxy_exit);
+MODULE_AUTHOR("Krisztian Kovacs");
+MODULE_DESCRIPTION("Netfilter transparent proxy (TPROXY) target

module"); +MODULE_LICENSE("GPL");

net/netfilter/xt_TPROXY.c new file +1 -1

+MODULE_ALIAS("ipt_TPROXY");
-

To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.)

Signed-off-by KOVACS Krisztian <[email protected]>

---
+++ b/include/linux/netfilter_ipv4/ipt_TPROXY.h

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +1 -0

@@ -0,0 +1,14 @@
+#ifndef _IPT_TPROXY_H_target

net/netfilter/xt_TPROXY.c new file +64 -0

new file mode 100644
index 0000000..8603421
@@ -0,0 +1,139 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (c) 2006-2007 BalaBit IT Ltd.
+ * Author: Balazs Scheidler, Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+#include <net/udp.h>
+#include <net/inet_sock.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ipt_TPROXY.h>
+
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#include <net/netfilter/nf_tproxy_core.h>
+
+static unsigned int
+target(struct sk_buff **pskb,
+       const struct net_device *in,
+       const struct net_device *out,
+       unsigned int hooknum,
+       const struct xt_target *target,
+       const void *targinfo)
+{
+	const struct iphdr *iph = ip_hdr(*pskb);
+	const struct ipt_tproxy_target_info *tgi =
+		(const struct ipt_tproxy_target_info *) targinfo;
+	struct sk_buff *skb = *pskb;
+	struct udphdr _hdr, *hp;
+	struct sock *sk;
+
+	/* TCP/UDP only */
+	if ((iph->protocol != IPPROTO_TCP) &&
+	    (iph->protocol != IPPROTO_UDP))
+		return NF_ACCEPT;
+
+	hp = skb_header_pointer(*pskb, iph->ihl * 4, sizeof(_hdr), &_hdr);
+	if (hp == NULL)
+		return NF_DROP;
+
+	sk = nf_tproxy_get_sock_v4(iph->protocol,
+				   iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr,
+				   hp->source, tgi->lport ? tgi->lport : hp->dest,
+				   in, true);
 
+
+	/* NOTE: assign_sock consumes our sk reference */
+	if (sk && nf_tproxy_assign_sock(skb, sk)) {
+		/* This should be in a separate target, but we don't do multiple
+		   targets on the same rule yet */
+		skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
+
+		pr_debug("redirecting: proto %d %08x:%d -> %08x:%d, mark: %x\n",
+			 iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),
+			 ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+		return NF_ACCEPT;

All this compat stuff becomes unnecessary with fixed size types.

Quoted 14 lines · KOVACS Krisztian

The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.)

Signed-off-by KOVACS Krisztian <[email protected]>

---
+++ b/include/linux/netfilter_ipv4/ipt_TPROXY.h

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +5 -0

@@ -0,0 +1,14 @@
+#ifndef _IPT_TPROXY_H_target
+#define _IPT_TPROXY_H_target
+
+/* TPROXY target is capable of marking the packet to perform
+ * redirection. We can get rid of that whenever we get support for

include/linux/netfilter_ipv4/ipt_TPROXY.h line 11

Quoted 6 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +6 -0

+ * mutliple targets in the same rule. */
+struct ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	unsigned long mark_mask;
+	unsigned long mark_value;

This should use fixed size types.

Quoted 75 lines

net/netfilter/xt_TPROXY.c new file +7 -0

new file mode 100644
index 0000000..8603421
@@ -0,0 +1,139 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (c) 2006-2007 BalaBit IT Ltd.
+ * Author: Balazs Scheidler, Krisztian Kovacs
+ *
+ * This program is free software; you can redistribute it and/or

modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation.
+ *
+ */

net/netfilter/xt_TPROXY.c new file +56 -0

+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+#include <net/udp.h>
+#include <net/inet_sock.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ipt_TPROXY.h>
+
+#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#include <net/netfilter/nf_tproxy_core.h>
+
+static unsigned int
+target(struct sk_buff **pskb,
+       const struct net_device *in,
+       const struct net_device *out,
+       unsigned int hooknum,
+       const struct xt_target *target,
+       const void *targinfo)
+{
+	const struct iphdr *iph = ip_hdr(*pskb);
+	const struct ipt_tproxy_target_info *tgi =
+		(const struct ipt_tproxy_target_info *) targinfo;
+	struct sk_buff *skb = *pskb;
+	struct udphdr _hdr, *hp;
+	struct sock *sk;
+
+	/* TCP/UDP only */
+	if ((iph->protocol != IPPROTO_TCP) &&
+	    (iph->protocol != IPPROTO_UDP))
+		return NF_ACCEPT;
+
+	hp = skb_header_pointer(*pskb, iph->ihl * 4, sizeof(_hdr), &_hdr);
+	if (hp == NULL)
+		return NF_DROP;
+
+	sk = nf_tproxy_get_sock_v4(iph->protocol,
+				   iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr,
+				   hp->source, tgi->lport ? tgi->lport : hp->dest,
+				   in, true);
 
+
+	/* NOTE: assign_sock consumes our sk reference */
+	if (sk && nf_tproxy_assign_sock(skb, sk)) {
+		/* This should be in a separate target, but we don't do multiple
+		   targets on the same rule yet */
+		skb->mark = (skb->mark & ~tgi->mark_mask) ^ tgi->mark_value;
+
+		pr_debug("redirecting: proto %d %08x:%d -> %08x:%d, mark: %x\n",
+			 iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),
+			 ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+		return NF_ACCEPT;
+	}
+	else {
+		pr_debug("no socket, dropping: proto %d %08x:%d -> %08x:%d, mark:

%x\n", + iph->protocol, ntohl(iph->daddr), ntohs(hp->dest),

net/netfilter/xt_TPROXY.c line 74

Quoted 6 lines

net/netfilter/xt_TPROXY.c new file +6 -0

+			 ntohl(tgi->laddr), ntohs(tgi->lport), skb->mark);
+		return NF_DROP;
+	}
+}
+
+#ifdef CONFIG_COMPAT

All this compat stuff becomes unnecessary with fixed size types.

Quoted 10 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h line 11

Quoted 8 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +8 -0

+/* TPROXY target is capable of marking the packet to perform
+ * redirection. We can get rid of that whenever we get support for
+ * mutliple targets in the same rule. */
+struct ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	unsigned long mark_mask;
+	unsigned long mark_value;

This should use fixed size types.

Yes, but marks are unsigned longs, aren't they? So if we restrict this to say 32bit then we lose the ability to use the upper half of the mark...

Quoted 11 lines · KOVACS Krisztian

Quoted 10 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h line 11

Quoted 8 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +8 -0

+/* TPROXY target is capable of marking the packet to perform
+ * redirection. We can get rid of that whenever we get support for
+ * mutliple targets in the same rule. */
+struct ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	unsigned long mark_mask;
+	unsigned long mark_value;

This should use fixed size types.

Quoted 2 lines

Yes, but marks are unsigned longs, aren't they? So if we restrict this to say 32bit then we lose the ability to use the upper half of the mark...

longs are 32 and 64 bits, resp. A 64-bit kernel with a 32-bit userland, well it speaks for itself.

The more I am puzzled as to why xt_MARK.h, xt_mark.h, xt_CONNMARK.h, xt_connmark.h use longs, and not uint32_t! Only xt_SECMARK.h does it right...

Patrick, is this a longstanding 'bug'?

Hi Patrick,

Quoted 16 lines · Patrick McHardy

Quoted 14 lines · KOVACS Krisztian

The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.)

Signed-off-by KOVACS Krisztian <[email protected]>

---
+++ b/include/linux/netfilter_ipv4/ipt_TPROXY.h

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +5 -0

@@ -0,0 +1,14 @@
+#ifndef _IPT_TPROXY_H_target
+#define _IPT_TPROXY_H_target
+
+/* TPROXY target is capable of marking the packet to perform
+ * redirection. We can get rid of that whenever we get support for

Quoted 9 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h line 11

Quoted 7 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +6 -0

+ * mutliple targets in the same rule. */
+struct ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	unsigned long mark_mask;
+	unsigned long mark_value;

This should use fixed size types.

Yes, but marks are unsigned longs, aren't they? So if we restrict this to say 32bit then we lose the ability to use the upper half of the mark...

Quoted 28 lines · KOVACS Krisztian

Hi Patrick,

Quoted 24 lines · Patrick McHardy

Quoted 11 lines · KOVACS Krisztian

The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. Additionally, it's possible to manipulate the packet mark if and only if a socket has been found. (We need this because we cannot use multiple targets in the same iptables rule.)

Signed-off-by KOVACS Krisztian <[email protected]>

---
+++ b/include/linux/netfilter_ipv4/ipt_TPROXY.h

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +1 -0

@@ -0,0 +1,14 @@
+#ifndef _IPT_TPROXY_H_target

include/linux/netfilter_ipv4/ipt_TPROXY.h line 11

Quoted 10 lines

include/linux/netfilter_ipv4/ipt_TPROXY.h new file +10 -0

+#define _IPT_TPROXY_H_target
+
+/* TPROXY target is capable of marking the packet to perform
+ * redirection. We can get rid of that whenever we get support for
+ * mutliple targets in the same rule. */
+struct ipt_tproxy_target_info {
+	__be32 laddr;
+	__be16 lport;
+	unsigned long mark_mask;
+	unsigned long mark_value;

This should use fixed size types.

Quoted 3 lines

Yes, but marks are unsigned longs, aren't they? So if we restrict this to say 32bit then we lose the ability to use the upper half of the mark...

No, marks are 32 bit for a long time now. The unsigned longs in the mark target and matches are just there for compatiblity.

(BTW, going to sleep now, will continue tommorrow)

Hi Patrick,

These patches are our (Balazs, Attila and me) third try at providing Linux 2.2-like transparent proxying support for Linux 2.6. During the 5th Netfilter Workshop in Karlsruhe, Germany we tried to come up with an even more lightweight approach not requiring the modification of the IPv4 routing code at all.

The most important changes relative to the previous versions[1,2] are:
* the tproxy table is gone, TPROXY targets need to be added to the mangle table instead
* the tproxy match is gone, a new "socket" match is introduced
* instead of using a separate routing trick to divert packets to the local IP stack inside the TProxy target, we are now using stock routing decisions, and need a bit in the packet MARK field, and perform diversion by using an advanced routing rule (this hopefully makes it possible to implement IPv6 support in the future
* instead of IP_FREEBIND we are using a setsockopt named IP_TRANSPARENT which requires CAP_NET_ADMIN privilege
* in previous patches the output routing decision was commented out, it is now correctly decided whether a packet belongs to a tproxied connection or not.

Usage is a bit more complicated compared to the previous approach, but it's certainly not rocket science:

# iptables rules necessary:
# create a chain named DIVERT
iptables -t mangle -N DIVERT
# everything that matches "-m socket" should go to the local stack
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
# connections to be redirected should use the TPROXY target, which sets # up redirection, and marks the packet according to its 'tproxy-mark' # argument
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \
   --tproxy-mark 0x1/0x1 --on-port 50080
# DIVERT chain: mark packets and accept
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

# set up advanced routing rules to deliver our marked packets locally
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100

The proxy code needs to be modified as well, but these are really lightweight:
before binding, the IP_TRANSPARENT sockopt needs to be enabled on the socket. This implies IP_FREEBIND, so after enabling this socket option non-local binds will work and if you got your iptables/iproute setup right non-local traffic will be delivered to/from the socket. A netcat patch demonstrating this is available[4] as an example.

Some word about the patches:

* output path (patches 1-5): these modifications make it possible to output IPv4 datagrams with non-local IP addresses by:
- introducing a new flowi flag (FLOWI_FLAG_ANYSRC) which disables the source address check in ip_route_output_slow() [3]
- adding the IP_TRANSPARENT socket option (setting this requires CAP_NET_ADMIN)
- setting FLOWI_FLAG_ANYSRC if IP_TRANSPARENT is enabled for the originating socket
- set FLOWI_FLAG_ANYSRC where appropriate for sending reply packets generated by the kernel; this requires extending the ip_reply_arg structure with a flags field and adding an IP_REPLY_ARG_NOSRCCHECK flag

* input patch (patches 6-13): these changes implement redirection support for TCP plus the iptables socket match and TPROXY target -- these provide the actual user interface:
- split IPv4 defragmentation into a separate module, as this is needed by both our target and match
- add a 'socket' match which does a socket lookup based on the destination tuple in the packet and matches is a socket has been found
- add a 'TPROXY' target which looks up a socket based on a modified IP/port tuple and stores the socket reference in the skb
- modifying the TCP/UDP input paths to use the stored socket reference if present

All kinds of comments welcome. Patrick, I'd like to ask you to review these patches and if no issues are found by you or by anyone on the list, please consider merging them.

Thanks for posting these patches. I'll gladly review them, but the patches touching things outside of netfilter need to go through netdev and Dave for merging.