net/ipv6/netfilter/ip6t_SYNPROXY.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
   4  */
   5
   6 #include <linux/netfilter_ipv6/ip6_tables.h>
   7 #include <linux/netfilter/x_tables.h>
   8 #include <linux/netfilter/xt_SYNPROXY.h>
   9
  10 #include <net/netfilter/nf_synproxy.h>
  11
  12 static unsigned int
  13 synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
  14 {
  15         const struct xt_synproxy_info *info = par->targinfo;
  16         struct net *net = xt_net(par);
  17         struct synproxy_net *snet = synproxy_pernet(net);
  18         struct synproxy_options opts = {};
  19         struct tcphdr *th, _th;
  20
  21         if (nf_ip6_checksum(skb, xt_hooknum(par), par->thoff, IPPROTO_TCP))
  22                 return NF_DROP;
  23
  24         th = skb_header_pointer(skb, par->thoff, sizeof(_th), &_th);
  25         if (th == NULL)
  26                 return NF_DROP;
  27
  28         if (!synproxy_parse_options(skb, par->thoff, th, &opts))
  29                 return NF_DROP;
  30
  31         if (th->syn && !(th->ack || th->fin || th->rst)) {
  32                 /* Initial SYN from client */
  33                 this_cpu_inc(snet->stats->syn_received);
  34
  35                 if (th->ece && th->cwr)
  36                         opts.options |= XT_SYNPROXY_OPT_ECN;
  37
  38                 opts.options &= info->options;
  39                 if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
  40                         synproxy_init_timestamp_cookie(info, &opts);
  41                 else
  42                         opts.options &= ~(XT_SYNPROXY_OPT_WSCALE |
  43                                           XT_SYNPROXY_OPT_SACK_PERM |
  44                                           XT_SYNPROXY_OPT_ECN);
  45
  46                 synproxy_send_client_synack_ipv6(net, skb, th, &opts);
  47                 consume_skb(skb);
  48                 return NF_STOLEN;
  49
  50         } else if (th->ack && !(th->fin || th->rst || th->syn)) {
  51                 /* ACK from client */
  52                 if (synproxy_recv_client_ack_ipv6(net, skb, th, &opts,
  53                                                   ntohl(th->seq))) {
  54                         consume_skb(skb);
  55                         return NF_STOLEN;
  56                 } else {
  57                         return NF_DROP;
  58                 }
  59         }
  60
  61         return XT_CONTINUE;
  62 }
  63
  64 static int synproxy_tg6_check(const struct xt_tgchk_param *par)
  65 {
  66         struct synproxy_net *snet = synproxy_pernet(par->net);
  67         const struct ip6t_entry *e = par->entryinfo;
  68         int err;
  69
  70         if (!(e->ipv6.flags & IP6T_F_PROTO) ||
  71             e->ipv6.proto != IPPROTO_TCP ||
  72             e->ipv6.invflags & XT_INV_PROTO)
  73                 return -EINVAL;
  74
  75         err = nf_ct_netns_get(par->net, par->family);
  76         if (err)
  77                 return err;
  78
  79         err = nf_synproxy_ipv6_init(snet, par->net);
  80         if (err) {
  81                 nf_ct_netns_put(par->net, par->family);
  82                 return err;
  83         }
  84
  85         return err;
  86 }
  87
  88 static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par)
  89 {
  90         struct synproxy_net *snet = synproxy_pernet(par->net);
  91
  92         nf_synproxy_ipv6_fini(snet, par->net);
  93         nf_ct_netns_put(par->net, par->family);
  94 }
  95
  96 static struct xt_target synproxy_tg6_reg __read_mostly = {
  97         .name           = "SYNPROXY",
  98         .family         = NFPROTO_IPV6,
  99         .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
 100         .target         = synproxy_tg6,
 101         .targetsize     = sizeof(struct xt_synproxy_info),
 102         .checkentry     = synproxy_tg6_check,
 103         .destroy        = synproxy_tg6_destroy,
 104         .me             = THIS_MODULE,
 105 };
 106
 107 static int __init synproxy_tg6_init(void)
 108 {
 109         return xt_register_target(&synproxy_tg6_reg);
 110 }
 111
 112 static void __exit synproxy_tg6_exit(void)
 113 {
 114         xt_unregister_target(&synproxy_tg6_reg);
 115 }
 116
 117 module_init(synproxy_tg6_init);
 118 module_exit(synproxy_tg6_exit);
 119
 120 MODULE_LICENSE("GPL");
 121 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");