1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
248b1de4cSPatrick McHardy /*
348b1de4cSPatrick McHardy * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
448b1de4cSPatrick McHardy */
548b1de4cSPatrick McHardy
648b1de4cSPatrick McHardy #include <linux/module.h>
748b1de4cSPatrick McHardy #include <linux/skbuff.h>
848b1de4cSPatrick McHardy #include <asm/unaligned.h>
948b1de4cSPatrick McHardy #include <net/tcp.h>
1048b1de4cSPatrick McHardy #include <net/netns/generic.h>
1110c04a8eSPablo Neira Ayuso #include <linux/proc_fs.h>
1248b1de4cSPatrick McHardy
13d7f9b2f1SFernando Fernandez Mancera #include <linux/netfilter_ipv6.h>
14f0c1aab2SPablo Neira Ayuso #include <linux/netfilter/nf_synproxy.h>
15308ac914SDaniel Borkmann
1648b1de4cSPatrick McHardy #include <net/netfilter/nf_conntrack.h>
17d7f9b2f1SFernando Fernandez Mancera #include <net/netfilter/nf_conntrack_ecache.h>
1848b1de4cSPatrick McHardy #include <net/netfilter/nf_conntrack_extend.h>
1948b1de4cSPatrick McHardy #include <net/netfilter/nf_conntrack_seqadj.h>
2048b1de4cSPatrick McHardy #include <net/netfilter/nf_conntrack_synproxy.h>
21308ac914SDaniel Borkmann #include <net/netfilter/nf_conntrack_zones.h>
22d7f9b2f1SFernando Fernandez Mancera #include <net/netfilter/nf_synproxy.h>
2348b1de4cSPatrick McHardy
24c7d03a00SAlexey Dobriyan unsigned int synproxy_net_id;
2548b1de4cSPatrick McHardy EXPORT_SYMBOL_GPL(synproxy_net_id);
2648b1de4cSPatrick McHardy
27f4a87e7bSPatrick McHardy bool
synproxy_parse_options(const struct sk_buff * skb,unsigned int doff,const struct tcphdr * th,struct synproxy_options * opts)2848b1de4cSPatrick McHardy synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
2948b1de4cSPatrick McHardy const struct tcphdr *th, struct synproxy_options *opts)
3048b1de4cSPatrick McHardy {
3148b1de4cSPatrick McHardy int length = (th->doff * 4) - sizeof(*th);
3248b1de4cSPatrick McHardy u8 buf[40], *ptr;
3348b1de4cSPatrick McHardy
345fc177abSMaxim Mikityanskiy if (unlikely(length < 0))
355fc177abSMaxim Mikityanskiy return false;
365fc177abSMaxim Mikityanskiy
3748b1de4cSPatrick McHardy ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
38f4a87e7bSPatrick McHardy if (ptr == NULL)
39f4a87e7bSPatrick McHardy return false;
4048b1de4cSPatrick McHardy
4148b1de4cSPatrick McHardy opts->options = 0;
4248b1de4cSPatrick McHardy while (length > 0) {
4348b1de4cSPatrick McHardy int opcode = *ptr++;
4448b1de4cSPatrick McHardy int opsize;
4548b1de4cSPatrick McHardy
4648b1de4cSPatrick McHardy switch (opcode) {
4748b1de4cSPatrick McHardy case TCPOPT_EOL:
48f4a87e7bSPatrick McHardy return true;
4948b1de4cSPatrick McHardy case TCPOPT_NOP:
5048b1de4cSPatrick McHardy length--;
5148b1de4cSPatrick McHardy continue;
5248b1de4cSPatrick McHardy default:
535fc177abSMaxim Mikityanskiy if (length < 2)
545fc177abSMaxim Mikityanskiy return true;
5548b1de4cSPatrick McHardy opsize = *ptr++;
5648b1de4cSPatrick McHardy if (opsize < 2)
57f4a87e7bSPatrick McHardy return true;
5848b1de4cSPatrick McHardy if (opsize > length)
59f4a87e7bSPatrick McHardy return true;
6048b1de4cSPatrick McHardy
6148b1de4cSPatrick McHardy switch (opcode) {
6248b1de4cSPatrick McHardy case TCPOPT_MSS:
6348b1de4cSPatrick McHardy if (opsize == TCPOLEN_MSS) {
648c0bb787SFernando Fernandez Mancera opts->mss_option = get_unaligned_be16(ptr);
65d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_MSS;
6648b1de4cSPatrick McHardy }
6748b1de4cSPatrick McHardy break;
6848b1de4cSPatrick McHardy case TCPOPT_WINDOW:
6948b1de4cSPatrick McHardy if (opsize == TCPOLEN_WINDOW) {
7048b1de4cSPatrick McHardy opts->wscale = *ptr;
71122868b3SGao Feng if (opts->wscale > TCP_MAX_WSCALE)
72122868b3SGao Feng opts->wscale = TCP_MAX_WSCALE;
73d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_WSCALE;
7448b1de4cSPatrick McHardy }
7548b1de4cSPatrick McHardy break;
7648b1de4cSPatrick McHardy case TCPOPT_TIMESTAMP:
7748b1de4cSPatrick McHardy if (opsize == TCPOLEN_TIMESTAMP) {
7848b1de4cSPatrick McHardy opts->tsval = get_unaligned_be32(ptr);
7948b1de4cSPatrick McHardy opts->tsecr = get_unaligned_be32(ptr + 4);
80d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_TIMESTAMP;
8148b1de4cSPatrick McHardy }
8248b1de4cSPatrick McHardy break;
8348b1de4cSPatrick McHardy case TCPOPT_SACK_PERM:
8448b1de4cSPatrick McHardy if (opsize == TCPOLEN_SACK_PERM)
85d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_SACK_PERM;
8648b1de4cSPatrick McHardy break;
8748b1de4cSPatrick McHardy }
8848b1de4cSPatrick McHardy
8948b1de4cSPatrick McHardy ptr += opsize - 2;
9048b1de4cSPatrick McHardy length -= opsize;
9148b1de4cSPatrick McHardy }
9248b1de4cSPatrick McHardy }
93f4a87e7bSPatrick McHardy return true;
9448b1de4cSPatrick McHardy }
9548b1de4cSPatrick McHardy EXPORT_SYMBOL_GPL(synproxy_parse_options);
9648b1de4cSPatrick McHardy
97d7f9b2f1SFernando Fernandez Mancera static unsigned int
synproxy_options_size(const struct synproxy_options * opts)98d7f9b2f1SFernando Fernandez Mancera synproxy_options_size(const struct synproxy_options *opts)
9948b1de4cSPatrick McHardy {
10048b1de4cSPatrick McHardy unsigned int size = 0;
10148b1de4cSPatrick McHardy
102d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_MSS)
10348b1de4cSPatrick McHardy size += TCPOLEN_MSS_ALIGNED;
104d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
10548b1de4cSPatrick McHardy size += TCPOLEN_TSTAMP_ALIGNED;
106d7f9b2f1SFernando Fernandez Mancera else if (opts->options & NF_SYNPROXY_OPT_SACK_PERM)
10748b1de4cSPatrick McHardy size += TCPOLEN_SACKPERM_ALIGNED;
108d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_WSCALE)
10948b1de4cSPatrick McHardy size += TCPOLEN_WSCALE_ALIGNED;
11048b1de4cSPatrick McHardy
11148b1de4cSPatrick McHardy return size;
11248b1de4cSPatrick McHardy }
11348b1de4cSPatrick McHardy
114d7f9b2f1SFernando Fernandez Mancera static void
synproxy_build_options(struct tcphdr * th,const struct synproxy_options * opts)11548b1de4cSPatrick McHardy synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
11648b1de4cSPatrick McHardy {
11748b1de4cSPatrick McHardy __be32 *ptr = (__be32 *)(th + 1);
11848b1de4cSPatrick McHardy u8 options = opts->options;
11948b1de4cSPatrick McHardy
120d7f9b2f1SFernando Fernandez Mancera if (options & NF_SYNPROXY_OPT_MSS)
12148b1de4cSPatrick McHardy *ptr++ = htonl((TCPOPT_MSS << 24) |
12248b1de4cSPatrick McHardy (TCPOLEN_MSS << 16) |
1238c0bb787SFernando Fernandez Mancera opts->mss_option);
12448b1de4cSPatrick McHardy
125d7f9b2f1SFernando Fernandez Mancera if (options & NF_SYNPROXY_OPT_TIMESTAMP) {
126d7f9b2f1SFernando Fernandez Mancera if (options & NF_SYNPROXY_OPT_SACK_PERM)
12748b1de4cSPatrick McHardy *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
12848b1de4cSPatrick McHardy (TCPOLEN_SACK_PERM << 16) |
12948b1de4cSPatrick McHardy (TCPOPT_TIMESTAMP << 8) |
13048b1de4cSPatrick McHardy TCPOLEN_TIMESTAMP);
13148b1de4cSPatrick McHardy else
13248b1de4cSPatrick McHardy *ptr++ = htonl((TCPOPT_NOP << 24) |
13348b1de4cSPatrick McHardy (TCPOPT_NOP << 16) |
13448b1de4cSPatrick McHardy (TCPOPT_TIMESTAMP << 8) |
13548b1de4cSPatrick McHardy TCPOLEN_TIMESTAMP);
13648b1de4cSPatrick McHardy
13748b1de4cSPatrick McHardy *ptr++ = htonl(opts->tsval);
13848b1de4cSPatrick McHardy *ptr++ = htonl(opts->tsecr);
139d7f9b2f1SFernando Fernandez Mancera } else if (options & NF_SYNPROXY_OPT_SACK_PERM)
14048b1de4cSPatrick McHardy *ptr++ = htonl((TCPOPT_NOP << 24) |
14148b1de4cSPatrick McHardy (TCPOPT_NOP << 16) |
14248b1de4cSPatrick McHardy (TCPOPT_SACK_PERM << 8) |
14348b1de4cSPatrick McHardy TCPOLEN_SACK_PERM);
14448b1de4cSPatrick McHardy
145d7f9b2f1SFernando Fernandez Mancera if (options & NF_SYNPROXY_OPT_WSCALE)
14648b1de4cSPatrick McHardy *ptr++ = htonl((TCPOPT_NOP << 24) |
14748b1de4cSPatrick McHardy (TCPOPT_WINDOW << 16) |
14848b1de4cSPatrick McHardy (TCPOLEN_WINDOW << 8) |
14948b1de4cSPatrick McHardy opts->wscale);
15048b1de4cSPatrick McHardy }
15148b1de4cSPatrick McHardy
synproxy_init_timestamp_cookie(const struct nf_synproxy_info * info,struct synproxy_options * opts)152d7f9b2f1SFernando Fernandez Mancera void synproxy_init_timestamp_cookie(const struct nf_synproxy_info *info,
15348b1de4cSPatrick McHardy struct synproxy_options *opts)
15448b1de4cSPatrick McHardy {
15548b1de4cSPatrick McHardy opts->tsecr = opts->tsval;
1569a568de4SEric Dumazet opts->tsval = tcp_time_stamp_raw() & ~0x3f;
15748b1de4cSPatrick McHardy
158d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_WSCALE) {
159c1898c4cSMartin Topholm opts->tsval |= opts->wscale;
160c1898c4cSMartin Topholm opts->wscale = info->wscale;
161c1898c4cSMartin Topholm } else
16248b1de4cSPatrick McHardy opts->tsval |= 0xf;
16348b1de4cSPatrick McHardy
164d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_SACK_PERM)
16548b1de4cSPatrick McHardy opts->tsval |= 1 << 4;
16648b1de4cSPatrick McHardy
167d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_ECN)
16848b1de4cSPatrick McHardy opts->tsval |= 1 << 5;
16948b1de4cSPatrick McHardy }
17048b1de4cSPatrick McHardy EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);
17148b1de4cSPatrick McHardy
172d7f9b2f1SFernando Fernandez Mancera static void
synproxy_check_timestamp_cookie(struct synproxy_options * opts)173d7f9b2f1SFernando Fernandez Mancera synproxy_check_timestamp_cookie(struct synproxy_options *opts)
17448b1de4cSPatrick McHardy {
17548b1de4cSPatrick McHardy opts->wscale = opts->tsecr & 0xf;
17648b1de4cSPatrick McHardy if (opts->wscale != 0xf)
177d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_WSCALE;
17848b1de4cSPatrick McHardy
179d7f9b2f1SFernando Fernandez Mancera opts->options |= opts->tsecr & (1 << 4) ? NF_SYNPROXY_OPT_SACK_PERM : 0;
18048b1de4cSPatrick McHardy
181d7f9b2f1SFernando Fernandez Mancera opts->options |= opts->tsecr & (1 << 5) ? NF_SYNPROXY_OPT_ECN : 0;
18248b1de4cSPatrick McHardy }
18348b1de4cSPatrick McHardy
184d7f9b2f1SFernando Fernandez Mancera static unsigned int
synproxy_tstamp_adjust(struct sk_buff * skb,unsigned int protoff,struct tcphdr * th,struct nf_conn * ct,enum ip_conntrack_info ctinfo,const struct nf_conn_synproxy * synproxy)185d7f9b2f1SFernando Fernandez Mancera synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff,
186d7f9b2f1SFernando Fernandez Mancera struct tcphdr *th, struct nf_conn *ct,
18748b1de4cSPatrick McHardy enum ip_conntrack_info ctinfo,
18848b1de4cSPatrick McHardy const struct nf_conn_synproxy *synproxy)
18948b1de4cSPatrick McHardy {
19048b1de4cSPatrick McHardy unsigned int optoff, optend;
191851345c5SFlorian Westphal __be32 *ptr, old;
19248b1de4cSPatrick McHardy
19348b1de4cSPatrick McHardy if (synproxy->tsoff == 0)
19448b1de4cSPatrick McHardy return 1;
19548b1de4cSPatrick McHardy
19648b1de4cSPatrick McHardy optoff = protoff + sizeof(struct tcphdr);
19748b1de4cSPatrick McHardy optend = protoff + th->doff * 4;
19848b1de4cSPatrick McHardy
1992cf6bffcSFlorian Westphal if (skb_ensure_writable(skb, optend))
20048b1de4cSPatrick McHardy return 0;
20148b1de4cSPatrick McHardy
20248b1de4cSPatrick McHardy while (optoff < optend) {
20348b1de4cSPatrick McHardy unsigned char *op = skb->data + optoff;
20448b1de4cSPatrick McHardy
20548b1de4cSPatrick McHardy switch (op[0]) {
20648b1de4cSPatrick McHardy case TCPOPT_EOL:
20748b1de4cSPatrick McHardy return 1;
20848b1de4cSPatrick McHardy case TCPOPT_NOP:
20948b1de4cSPatrick McHardy optoff++;
21048b1de4cSPatrick McHardy continue;
21148b1de4cSPatrick McHardy default:
21248b1de4cSPatrick McHardy if (optoff + 1 == optend ||
21348b1de4cSPatrick McHardy optoff + op[1] > optend ||
21448b1de4cSPatrick McHardy op[1] < 2)
21548b1de4cSPatrick McHardy return 0;
21648b1de4cSPatrick McHardy if (op[0] == TCPOPT_TIMESTAMP &&
21748b1de4cSPatrick McHardy op[1] == TCPOLEN_TIMESTAMP) {
21848b1de4cSPatrick McHardy if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
219851345c5SFlorian Westphal ptr = (__be32 *)&op[2];
22048b1de4cSPatrick McHardy old = *ptr;
22148b1de4cSPatrick McHardy *ptr = htonl(ntohl(*ptr) -
22248b1de4cSPatrick McHardy synproxy->tsoff);
22348b1de4cSPatrick McHardy } else {
224851345c5SFlorian Westphal ptr = (__be32 *)&op[6];
22548b1de4cSPatrick McHardy old = *ptr;
22648b1de4cSPatrick McHardy *ptr = htonl(ntohl(*ptr) +
22748b1de4cSPatrick McHardy synproxy->tsoff);
22848b1de4cSPatrick McHardy }
22948b1de4cSPatrick McHardy inet_proto_csum_replace4(&th->check, skb,
2304b048d6dSTom Herbert old, *ptr, false);
23148b1de4cSPatrick McHardy return 1;
23248b1de4cSPatrick McHardy }
23348b1de4cSPatrick McHardy optoff += op[1];
23448b1de4cSPatrick McHardy }
23548b1de4cSPatrick McHardy }
23648b1de4cSPatrick McHardy return 1;
23748b1de4cSPatrick McHardy }
23848b1de4cSPatrick McHardy
23948b1de4cSPatrick McHardy #ifdef CONFIG_PROC_FS
synproxy_cpu_seq_start(struct seq_file * seq,loff_t * pos)24048b1de4cSPatrick McHardy static void *synproxy_cpu_seq_start(struct seq_file *seq, loff_t *pos)
24148b1de4cSPatrick McHardy {
24248b1de4cSPatrick McHardy struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
24348b1de4cSPatrick McHardy int cpu;
24448b1de4cSPatrick McHardy
24548b1de4cSPatrick McHardy if (*pos == 0)
24648b1de4cSPatrick McHardy return SEQ_START_TOKEN;
24748b1de4cSPatrick McHardy
24848b1de4cSPatrick McHardy for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
24948b1de4cSPatrick McHardy if (!cpu_possible(cpu))
25048b1de4cSPatrick McHardy continue;
25148b1de4cSPatrick McHardy *pos = cpu + 1;
25248b1de4cSPatrick McHardy return per_cpu_ptr(snet->stats, cpu);
25348b1de4cSPatrick McHardy }
25448b1de4cSPatrick McHardy
25548b1de4cSPatrick McHardy return NULL;
25648b1de4cSPatrick McHardy }
25748b1de4cSPatrick McHardy
synproxy_cpu_seq_next(struct seq_file * seq,void * v,loff_t * pos)25848b1de4cSPatrick McHardy static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
25948b1de4cSPatrick McHardy {
26048b1de4cSPatrick McHardy struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
26148b1de4cSPatrick McHardy int cpu;
26248b1de4cSPatrick McHardy
26348b1de4cSPatrick McHardy for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
26448b1de4cSPatrick McHardy if (!cpu_possible(cpu))
26548b1de4cSPatrick McHardy continue;
26648b1de4cSPatrick McHardy *pos = cpu + 1;
26748b1de4cSPatrick McHardy return per_cpu_ptr(snet->stats, cpu);
26848b1de4cSPatrick McHardy }
269bb71f846SVasily Averin (*pos)++;
27048b1de4cSPatrick McHardy return NULL;
27148b1de4cSPatrick McHardy }
27248b1de4cSPatrick McHardy
synproxy_cpu_seq_stop(struct seq_file * seq,void * v)27348b1de4cSPatrick McHardy static void synproxy_cpu_seq_stop(struct seq_file *seq, void *v)
27448b1de4cSPatrick McHardy {
27548b1de4cSPatrick McHardy return;
27648b1de4cSPatrick McHardy }
27748b1de4cSPatrick McHardy
synproxy_cpu_seq_show(struct seq_file * seq,void * v)27848b1de4cSPatrick McHardy static int synproxy_cpu_seq_show(struct seq_file *seq, void *v)
27948b1de4cSPatrick McHardy {
28048b1de4cSPatrick McHardy struct synproxy_stats *stats = v;
28148b1de4cSPatrick McHardy
28248b1de4cSPatrick McHardy if (v == SEQ_START_TOKEN) {
283cdec2685Ssimran singhal seq_puts(seq, "entries\t\tsyn_received\t"
28448b1de4cSPatrick McHardy "cookie_invalid\tcookie_valid\t"
28548b1de4cSPatrick McHardy "cookie_retrans\tconn_reopened\n");
28648b1de4cSPatrick McHardy return 0;
28748b1de4cSPatrick McHardy }
28848b1de4cSPatrick McHardy
28948b1de4cSPatrick McHardy seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
29048b1de4cSPatrick McHardy stats->syn_received,
29148b1de4cSPatrick McHardy stats->cookie_invalid,
29248b1de4cSPatrick McHardy stats->cookie_valid,
29348b1de4cSPatrick McHardy stats->cookie_retrans,
29448b1de4cSPatrick McHardy stats->conn_reopened);
29548b1de4cSPatrick McHardy
29648b1de4cSPatrick McHardy return 0;
29748b1de4cSPatrick McHardy }
29848b1de4cSPatrick McHardy
29948b1de4cSPatrick McHardy static const struct seq_operations synproxy_cpu_seq_ops = {
30048b1de4cSPatrick McHardy .start = synproxy_cpu_seq_start,
30148b1de4cSPatrick McHardy .next = synproxy_cpu_seq_next,
30248b1de4cSPatrick McHardy .stop = synproxy_cpu_seq_stop,
30348b1de4cSPatrick McHardy .show = synproxy_cpu_seq_show,
30448b1de4cSPatrick McHardy };
30548b1de4cSPatrick McHardy
synproxy_proc_init(struct net * net)30648b1de4cSPatrick McHardy static int __net_init synproxy_proc_init(struct net *net)
30748b1de4cSPatrick McHardy {
308c3506372SChristoph Hellwig if (!proc_create_net("synproxy", 0444, net->proc_net_stat,
309c3506372SChristoph Hellwig &synproxy_cpu_seq_ops, sizeof(struct seq_net_private)))
31048b1de4cSPatrick McHardy return -ENOMEM;
31148b1de4cSPatrick McHardy return 0;
31248b1de4cSPatrick McHardy }
31348b1de4cSPatrick McHardy
synproxy_proc_exit(struct net * net)31448b1de4cSPatrick McHardy static void __net_exit synproxy_proc_exit(struct net *net)
31548b1de4cSPatrick McHardy {
31648b1de4cSPatrick McHardy remove_proc_entry("synproxy", net->proc_net_stat);
31748b1de4cSPatrick McHardy }
31848b1de4cSPatrick McHardy #else
synproxy_proc_init(struct net * net)31948b1de4cSPatrick McHardy static int __net_init synproxy_proc_init(struct net *net)
32048b1de4cSPatrick McHardy {
32148b1de4cSPatrick McHardy return 0;
32248b1de4cSPatrick McHardy }
32348b1de4cSPatrick McHardy
synproxy_proc_exit(struct net * net)32448b1de4cSPatrick McHardy static void __net_exit synproxy_proc_exit(struct net *net)
32548b1de4cSPatrick McHardy {
32648b1de4cSPatrick McHardy return;
32748b1de4cSPatrick McHardy }
32848b1de4cSPatrick McHardy #endif /* CONFIG_PROC_FS */
32948b1de4cSPatrick McHardy
synproxy_net_init(struct net * net)33048b1de4cSPatrick McHardy static int __net_init synproxy_net_init(struct net *net)
33148b1de4cSPatrick McHardy {
33248b1de4cSPatrick McHardy struct synproxy_net *snet = synproxy_pernet(net);
33348b1de4cSPatrick McHardy struct nf_conn *ct;
33448b1de4cSPatrick McHardy int err = -ENOMEM;
33548b1de4cSPatrick McHardy
336308ac914SDaniel Borkmann ct = nf_ct_tmpl_alloc(net, &nf_ct_zone_dflt, GFP_KERNEL);
3371a727c63SDan Carpenter if (!ct)
33848b1de4cSPatrick McHardy goto err1;
33948b1de4cSPatrick McHardy
34048b1de4cSPatrick McHardy if (!nfct_seqadj_ext_add(ct))
34148b1de4cSPatrick McHardy goto err2;
34248b1de4cSPatrick McHardy if (!nfct_synproxy_ext_add(ct))
34348b1de4cSPatrick McHardy goto err2;
34448b1de4cSPatrick McHardy
3450838aa7fSPablo Neira Ayuso __set_bit(IPS_CONFIRMED_BIT, &ct->status);
34648b1de4cSPatrick McHardy snet->tmpl = ct;
34748b1de4cSPatrick McHardy
34848b1de4cSPatrick McHardy snet->stats = alloc_percpu(struct synproxy_stats);
34948b1de4cSPatrick McHardy if (snet->stats == NULL)
35048b1de4cSPatrick McHardy goto err2;
35148b1de4cSPatrick McHardy
35248b1de4cSPatrick McHardy err = synproxy_proc_init(net);
35348b1de4cSPatrick McHardy if (err < 0)
35448b1de4cSPatrick McHardy goto err3;
35548b1de4cSPatrick McHardy
35648b1de4cSPatrick McHardy return 0;
35748b1de4cSPatrick McHardy
35848b1de4cSPatrick McHardy err3:
35948b1de4cSPatrick McHardy free_percpu(snet->stats);
36048b1de4cSPatrick McHardy err2:
3619cf94eabSDaniel Borkmann nf_ct_tmpl_free(ct);
36248b1de4cSPatrick McHardy err1:
36348b1de4cSPatrick McHardy return err;
36448b1de4cSPatrick McHardy }
36548b1de4cSPatrick McHardy
synproxy_net_exit(struct net * net)36648b1de4cSPatrick McHardy static void __net_exit synproxy_net_exit(struct net *net)
36748b1de4cSPatrick McHardy {
36848b1de4cSPatrick McHardy struct synproxy_net *snet = synproxy_pernet(net);
36948b1de4cSPatrick McHardy
370e53376beSPablo Neira Ayuso nf_ct_put(snet->tmpl);
37148b1de4cSPatrick McHardy synproxy_proc_exit(net);
37248b1de4cSPatrick McHardy free_percpu(snet->stats);
37348b1de4cSPatrick McHardy }
37448b1de4cSPatrick McHardy
37548b1de4cSPatrick McHardy static struct pernet_operations synproxy_net_ops = {
37648b1de4cSPatrick McHardy .init = synproxy_net_init,
37748b1de4cSPatrick McHardy .exit = synproxy_net_exit,
37848b1de4cSPatrick McHardy .id = &synproxy_net_id,
37948b1de4cSPatrick McHardy .size = sizeof(struct synproxy_net),
38048b1de4cSPatrick McHardy };
38148b1de4cSPatrick McHardy
synproxy_core_init(void)38248b1de4cSPatrick McHardy static int __init synproxy_core_init(void)
38348b1de4cSPatrick McHardy {
3841015c3deSFlorian Westphal return register_pernet_subsys(&synproxy_net_ops);
38548b1de4cSPatrick McHardy }
38648b1de4cSPatrick McHardy
synproxy_core_exit(void)38748b1de4cSPatrick McHardy static void __exit synproxy_core_exit(void)
38848b1de4cSPatrick McHardy {
38948b1de4cSPatrick McHardy unregister_pernet_subsys(&synproxy_net_ops);
39048b1de4cSPatrick McHardy }
39148b1de4cSPatrick McHardy
39248b1de4cSPatrick McHardy module_init(synproxy_core_init);
39348b1de4cSPatrick McHardy module_exit(synproxy_core_exit);
39448b1de4cSPatrick McHardy
395d7f9b2f1SFernando Fernandez Mancera static struct iphdr *
synproxy_build_ip(struct net * net,struct sk_buff * skb,__be32 saddr,__be32 daddr)396d7f9b2f1SFernando Fernandez Mancera synproxy_build_ip(struct net *net, struct sk_buff *skb, __be32 saddr,
397d7f9b2f1SFernando Fernandez Mancera __be32 daddr)
398d7f9b2f1SFernando Fernandez Mancera {
399d7f9b2f1SFernando Fernandez Mancera struct iphdr *iph;
400d7f9b2f1SFernando Fernandez Mancera
401d7f9b2f1SFernando Fernandez Mancera skb_reset_network_header(skb);
402d7f9b2f1SFernando Fernandez Mancera iph = skb_put(skb, sizeof(*iph));
403d7f9b2f1SFernando Fernandez Mancera iph->version = 4;
404d7f9b2f1SFernando Fernandez Mancera iph->ihl = sizeof(*iph) / 4;
405d7f9b2f1SFernando Fernandez Mancera iph->tos = 0;
406d7f9b2f1SFernando Fernandez Mancera iph->id = 0;
407d7f9b2f1SFernando Fernandez Mancera iph->frag_off = htons(IP_DF);
408*8281b7ecSKuniyuki Iwashima iph->ttl = READ_ONCE(net->ipv4.sysctl_ip_default_ttl);
409d7f9b2f1SFernando Fernandez Mancera iph->protocol = IPPROTO_TCP;
410d7f9b2f1SFernando Fernandez Mancera iph->check = 0;
411d7f9b2f1SFernando Fernandez Mancera iph->saddr = saddr;
412d7f9b2f1SFernando Fernandez Mancera iph->daddr = daddr;
413d7f9b2f1SFernando Fernandez Mancera
414d7f9b2f1SFernando Fernandez Mancera return iph;
415d7f9b2f1SFernando Fernandez Mancera }
416d7f9b2f1SFernando Fernandez Mancera
417d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_tcp(struct net * net,const struct sk_buff * skb,struct sk_buff * nskb,struct nf_conntrack * nfct,enum ip_conntrack_info ctinfo,struct iphdr * niph,struct tcphdr * nth,unsigned int tcp_hdr_size)418d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp(struct net *net,
419d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, struct sk_buff *nskb,
420d7f9b2f1SFernando Fernandez Mancera struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
421d7f9b2f1SFernando Fernandez Mancera struct iphdr *niph, struct tcphdr *nth,
422d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size)
423d7f9b2f1SFernando Fernandez Mancera {
424d7f9b2f1SFernando Fernandez Mancera nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);
425d7f9b2f1SFernando Fernandez Mancera nskb->ip_summed = CHECKSUM_PARTIAL;
426d7f9b2f1SFernando Fernandez Mancera nskb->csum_start = (unsigned char *)nth - nskb->head;
427d7f9b2f1SFernando Fernandez Mancera nskb->csum_offset = offsetof(struct tcphdr, check);
428d7f9b2f1SFernando Fernandez Mancera
429d7f9b2f1SFernando Fernandez Mancera skb_dst_set_noref(nskb, skb_dst(skb));
430d7f9b2f1SFernando Fernandez Mancera nskb->protocol = htons(ETH_P_IP);
43146d6c5aeSJason A. Donenfeld if (ip_route_me_harder(net, nskb->sk, nskb, RTN_UNSPEC))
432d7f9b2f1SFernando Fernandez Mancera goto free_nskb;
433d7f9b2f1SFernando Fernandez Mancera
434d7f9b2f1SFernando Fernandez Mancera if (nfct) {
435d7f9b2f1SFernando Fernandez Mancera nf_ct_set(nskb, (struct nf_conn *)nfct, ctinfo);
436d7f9b2f1SFernando Fernandez Mancera nf_conntrack_get(nfct);
437d7f9b2f1SFernando Fernandez Mancera }
438d7f9b2f1SFernando Fernandez Mancera
439d7f9b2f1SFernando Fernandez Mancera ip_local_out(net, nskb->sk, nskb);
440d7f9b2f1SFernando Fernandez Mancera return;
441d7f9b2f1SFernando Fernandez Mancera
442d7f9b2f1SFernando Fernandez Mancera free_nskb:
443d7f9b2f1SFernando Fernandez Mancera kfree_skb(nskb);
444d7f9b2f1SFernando Fernandez Mancera }
445d7f9b2f1SFernando Fernandez Mancera
446d7f9b2f1SFernando Fernandez Mancera void
synproxy_send_client_synack(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts)447d7f9b2f1SFernando Fernandez Mancera synproxy_send_client_synack(struct net *net,
448d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, const struct tcphdr *th,
449d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts)
450d7f9b2f1SFernando Fernandez Mancera {
451d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
452d7f9b2f1SFernando Fernandez Mancera struct iphdr *iph, *niph;
453d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
454d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
455b83329fbSFernando Fernandez Mancera u16 mss = opts->mss_encode;
456d7f9b2f1SFernando Fernandez Mancera
457d7f9b2f1SFernando Fernandez Mancera iph = ip_hdr(skb);
458d7f9b2f1SFernando Fernandez Mancera
459d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
460d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
461d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
462d7f9b2f1SFernando Fernandez Mancera if (!nskb)
463d7f9b2f1SFernando Fernandez Mancera return;
464d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
465d7f9b2f1SFernando Fernandez Mancera
466d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
467d7f9b2f1SFernando Fernandez Mancera
468d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
469d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
470d7f9b2f1SFernando Fernandez Mancera nth->source = th->dest;
471d7f9b2f1SFernando Fernandez Mancera nth->dest = th->source;
472d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(__cookie_v4_init_sequence(iph, th, &mss));
473d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = htonl(ntohl(th->seq) + 1);
474d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
475d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_ECN)
476d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) |= TCP_FLAG_ECE;
477d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
478d7f9b2f1SFernando Fernandez Mancera nth->window = 0;
479d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
480d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
481d7f9b2f1SFernando Fernandez Mancera
482d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
483d7f9b2f1SFernando Fernandez Mancera
484d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp(net, skb, nskb, skb_nfct(skb),
485d7f9b2f1SFernando Fernandez Mancera IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
486d7f9b2f1SFernando Fernandez Mancera }
487d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(synproxy_send_client_synack);
488d7f9b2f1SFernando Fernandez Mancera
489d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_server_syn(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts,u32 recv_seq)490d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_syn(struct net *net,
491d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, const struct tcphdr *th,
492d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts, u32 recv_seq)
493d7f9b2f1SFernando Fernandez Mancera {
494d7f9b2f1SFernando Fernandez Mancera struct synproxy_net *snet = synproxy_pernet(net);
495d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
496d7f9b2f1SFernando Fernandez Mancera struct iphdr *iph, *niph;
497d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
498d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
499d7f9b2f1SFernando Fernandez Mancera
500d7f9b2f1SFernando Fernandez Mancera iph = ip_hdr(skb);
501d7f9b2f1SFernando Fernandez Mancera
502d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
503d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
504d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
505d7f9b2f1SFernando Fernandez Mancera if (!nskb)
506d7f9b2f1SFernando Fernandez Mancera return;
507d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
508d7f9b2f1SFernando Fernandez Mancera
509d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
510d7f9b2f1SFernando Fernandez Mancera
511d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
512d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
513d7f9b2f1SFernando Fernandez Mancera nth->source = th->source;
514d7f9b2f1SFernando Fernandez Mancera nth->dest = th->dest;
515d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(recv_seq - 1);
516d7f9b2f1SFernando Fernandez Mancera /* ack_seq is used to relay our ISN to the synproxy hook to initialize
517d7f9b2f1SFernando Fernandez Mancera * sequence number translation once a connection tracking entry exists.
518d7f9b2f1SFernando Fernandez Mancera */
519d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = htonl(ntohl(th->ack_seq) - 1);
520d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_SYN;
521d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_ECN)
522d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
523d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
524d7f9b2f1SFernando Fernandez Mancera nth->window = th->window;
525d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
526d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
527d7f9b2f1SFernando Fernandez Mancera
528d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
529d7f9b2f1SFernando Fernandez Mancera
530d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp(net, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
531d7f9b2f1SFernando Fernandez Mancera niph, nth, tcp_hdr_size);
532d7f9b2f1SFernando Fernandez Mancera }
533d7f9b2f1SFernando Fernandez Mancera
534d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_server_ack(struct net * net,const struct ip_ct_tcp * state,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts)535d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_ack(struct net *net,
536d7f9b2f1SFernando Fernandez Mancera const struct ip_ct_tcp *state,
537d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, const struct tcphdr *th,
538d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts)
539d7f9b2f1SFernando Fernandez Mancera {
540d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
541d7f9b2f1SFernando Fernandez Mancera struct iphdr *iph, *niph;
542d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
543d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
544d7f9b2f1SFernando Fernandez Mancera
545d7f9b2f1SFernando Fernandez Mancera iph = ip_hdr(skb);
546d7f9b2f1SFernando Fernandez Mancera
547d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
548d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
549d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
550d7f9b2f1SFernando Fernandez Mancera if (!nskb)
551d7f9b2f1SFernando Fernandez Mancera return;
552d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
553d7f9b2f1SFernando Fernandez Mancera
554d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
555d7f9b2f1SFernando Fernandez Mancera
556d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
557d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
558d7f9b2f1SFernando Fernandez Mancera nth->source = th->dest;
559d7f9b2f1SFernando Fernandez Mancera nth->dest = th->source;
560d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(ntohl(th->ack_seq));
561d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = htonl(ntohl(th->seq) + 1);
562d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_ACK;
563d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
564d7f9b2f1SFernando Fernandez Mancera nth->window = htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
565d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
566d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
567d7f9b2f1SFernando Fernandez Mancera
568d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
569d7f9b2f1SFernando Fernandez Mancera
570d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp(net, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
571d7f9b2f1SFernando Fernandez Mancera }
572d7f9b2f1SFernando Fernandez Mancera
573d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_client_ack(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts)574d7f9b2f1SFernando Fernandez Mancera synproxy_send_client_ack(struct net *net,
575d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, const struct tcphdr *th,
576d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts)
577d7f9b2f1SFernando Fernandez Mancera {
578d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
579d7f9b2f1SFernando Fernandez Mancera struct iphdr *iph, *niph;
580d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
581d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
582d7f9b2f1SFernando Fernandez Mancera
583d7f9b2f1SFernando Fernandez Mancera iph = ip_hdr(skb);
584d7f9b2f1SFernando Fernandez Mancera
585d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
586d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
587d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
588d7f9b2f1SFernando Fernandez Mancera if (!nskb)
589d7f9b2f1SFernando Fernandez Mancera return;
590d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
591d7f9b2f1SFernando Fernandez Mancera
592d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
593d7f9b2f1SFernando Fernandez Mancera
594d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
595d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
596d7f9b2f1SFernando Fernandez Mancera nth->source = th->source;
597d7f9b2f1SFernando Fernandez Mancera nth->dest = th->dest;
598d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(ntohl(th->seq) + 1);
599d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = th->ack_seq;
600d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_ACK;
601d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
602d7f9b2f1SFernando Fernandez Mancera nth->window = htons(ntohs(th->window) >> opts->wscale);
603d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
604d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
605d7f9b2f1SFernando Fernandez Mancera
606d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
607d7f9b2f1SFernando Fernandez Mancera
608d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp(net, skb, nskb, skb_nfct(skb),
609d7f9b2f1SFernando Fernandez Mancera IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
610d7f9b2f1SFernando Fernandez Mancera }
611d7f9b2f1SFernando Fernandez Mancera
612d7f9b2f1SFernando Fernandez Mancera bool
synproxy_recv_client_ack(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,struct synproxy_options * opts,u32 recv_seq)613d7f9b2f1SFernando Fernandez Mancera synproxy_recv_client_ack(struct net *net,
614d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, const struct tcphdr *th,
615d7f9b2f1SFernando Fernandez Mancera struct synproxy_options *opts, u32 recv_seq)
616d7f9b2f1SFernando Fernandez Mancera {
617d7f9b2f1SFernando Fernandez Mancera struct synproxy_net *snet = synproxy_pernet(net);
618d7f9b2f1SFernando Fernandez Mancera int mss;
619d7f9b2f1SFernando Fernandez Mancera
620d7f9b2f1SFernando Fernandez Mancera mss = __cookie_v4_check(ip_hdr(skb), th, ntohl(th->ack_seq) - 1);
621d7f9b2f1SFernando Fernandez Mancera if (mss == 0) {
622d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->cookie_invalid);
623d7f9b2f1SFernando Fernandez Mancera return false;
624d7f9b2f1SFernando Fernandez Mancera }
625d7f9b2f1SFernando Fernandez Mancera
626d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->cookie_valid);
6278c0bb787SFernando Fernandez Mancera opts->mss_option = mss;
628d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_MSS;
629d7f9b2f1SFernando Fernandez Mancera
630d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
631d7f9b2f1SFernando Fernandez Mancera synproxy_check_timestamp_cookie(opts);
632d7f9b2f1SFernando Fernandez Mancera
633d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_syn(net, skb, th, opts, recv_seq);
634d7f9b2f1SFernando Fernandez Mancera return true;
635d7f9b2f1SFernando Fernandez Mancera }
636d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(synproxy_recv_client_ack);
637d7f9b2f1SFernando Fernandez Mancera
638d7f9b2f1SFernando Fernandez Mancera unsigned int
ipv4_synproxy_hook(void * priv,struct sk_buff * skb,const struct nf_hook_state * nhs)639d7f9b2f1SFernando Fernandez Mancera ipv4_synproxy_hook(void *priv, struct sk_buff *skb,
640d7f9b2f1SFernando Fernandez Mancera const struct nf_hook_state *nhs)
641d7f9b2f1SFernando Fernandez Mancera {
642d7f9b2f1SFernando Fernandez Mancera struct net *net = nhs->net;
643d7f9b2f1SFernando Fernandez Mancera struct synproxy_net *snet = synproxy_pernet(net);
644d7f9b2f1SFernando Fernandez Mancera enum ip_conntrack_info ctinfo;
645d7f9b2f1SFernando Fernandez Mancera struct nf_conn *ct;
646d7f9b2f1SFernando Fernandez Mancera struct nf_conn_synproxy *synproxy;
647d7f9b2f1SFernando Fernandez Mancera struct synproxy_options opts = {};
648d7f9b2f1SFernando Fernandez Mancera const struct ip_ct_tcp *state;
649d7f9b2f1SFernando Fernandez Mancera struct tcphdr *th, _th;
650d7f9b2f1SFernando Fernandez Mancera unsigned int thoff;
651d7f9b2f1SFernando Fernandez Mancera
652d7f9b2f1SFernando Fernandez Mancera ct = nf_ct_get(skb, &ctinfo);
653d7f9b2f1SFernando Fernandez Mancera if (!ct)
654d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
655d7f9b2f1SFernando Fernandez Mancera
656d7f9b2f1SFernando Fernandez Mancera synproxy = nfct_synproxy(ct);
657d7f9b2f1SFernando Fernandez Mancera if (!synproxy)
658d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
659d7f9b2f1SFernando Fernandez Mancera
660d7f9b2f1SFernando Fernandez Mancera if (nf_is_loopback_packet(skb) ||
661d7f9b2f1SFernando Fernandez Mancera ip_hdr(skb)->protocol != IPPROTO_TCP)
662d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
663d7f9b2f1SFernando Fernandez Mancera
664d7f9b2f1SFernando Fernandez Mancera thoff = ip_hdrlen(skb);
665d7f9b2f1SFernando Fernandez Mancera th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
666d7f9b2f1SFernando Fernandez Mancera if (!th)
667d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
668d7f9b2f1SFernando Fernandez Mancera
669d7f9b2f1SFernando Fernandez Mancera state = &ct->proto.tcp;
670d7f9b2f1SFernando Fernandez Mancera switch (state->state) {
671d7f9b2f1SFernando Fernandez Mancera case TCP_CONNTRACK_CLOSE:
672e971ceb8SFernando Fernandez Mancera if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
673d7f9b2f1SFernando Fernandez Mancera nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
674d7f9b2f1SFernando Fernandez Mancera ntohl(th->seq) + 1);
675d7f9b2f1SFernando Fernandez Mancera break;
676d7f9b2f1SFernando Fernandez Mancera }
677d7f9b2f1SFernando Fernandez Mancera
678d7f9b2f1SFernando Fernandez Mancera if (!th->syn || th->ack ||
679d7f9b2f1SFernando Fernandez Mancera CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
680d7f9b2f1SFernando Fernandez Mancera break;
681d7f9b2f1SFernando Fernandez Mancera
682d7f9b2f1SFernando Fernandez Mancera /* Reopened connection - reset the sequence number and timestamp
683d7f9b2f1SFernando Fernandez Mancera * adjustments, they will get initialized once the connection is
684d7f9b2f1SFernando Fernandez Mancera * reestablished.
685d7f9b2f1SFernando Fernandez Mancera */
686d7f9b2f1SFernando Fernandez Mancera nf_ct_seqadj_init(ct, ctinfo, 0);
687d7f9b2f1SFernando Fernandez Mancera synproxy->tsoff = 0;
688d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->conn_reopened);
689954d8297SGustavo A. R. Silva fallthrough;
690d7f9b2f1SFernando Fernandez Mancera case TCP_CONNTRACK_SYN_SENT:
691d7f9b2f1SFernando Fernandez Mancera if (!synproxy_parse_options(skb, thoff, th, &opts))
692d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
693d7f9b2f1SFernando Fernandez Mancera
694d7f9b2f1SFernando Fernandez Mancera if (!th->syn && th->ack &&
695d7f9b2f1SFernando Fernandez Mancera CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
696d7f9b2f1SFernando Fernandez Mancera /* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,
697d7f9b2f1SFernando Fernandez Mancera * therefore we need to add 1 to make the SYN sequence
698d7f9b2f1SFernando Fernandez Mancera * number match the one of first SYN.
699d7f9b2f1SFernando Fernandez Mancera */
700d7f9b2f1SFernando Fernandez Mancera if (synproxy_recv_client_ack(net, skb, th, &opts,
701d7f9b2f1SFernando Fernandez Mancera ntohl(th->seq) + 1)) {
702d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->cookie_retrans);
703d7f9b2f1SFernando Fernandez Mancera consume_skb(skb);
704d7f9b2f1SFernando Fernandez Mancera return NF_STOLEN;
705d7f9b2f1SFernando Fernandez Mancera } else {
706d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
707d7f9b2f1SFernando Fernandez Mancera }
708d7f9b2f1SFernando Fernandez Mancera }
709d7f9b2f1SFernando Fernandez Mancera
710d7f9b2f1SFernando Fernandez Mancera synproxy->isn = ntohl(th->ack_seq);
711d7f9b2f1SFernando Fernandez Mancera if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP)
712d7f9b2f1SFernando Fernandez Mancera synproxy->its = opts.tsecr;
713d7f9b2f1SFernando Fernandez Mancera
714d7f9b2f1SFernando Fernandez Mancera nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
715d7f9b2f1SFernando Fernandez Mancera break;
716d7f9b2f1SFernando Fernandez Mancera case TCP_CONNTRACK_SYN_RECV:
717d7f9b2f1SFernando Fernandez Mancera if (!th->syn || !th->ack)
718d7f9b2f1SFernando Fernandez Mancera break;
719d7f9b2f1SFernando Fernandez Mancera
720d7f9b2f1SFernando Fernandez Mancera if (!synproxy_parse_options(skb, thoff, th, &opts))
721d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
722d7f9b2f1SFernando Fernandez Mancera
723d7f9b2f1SFernando Fernandez Mancera if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP) {
724d7f9b2f1SFernando Fernandez Mancera synproxy->tsoff = opts.tsval - synproxy->its;
725d7f9b2f1SFernando Fernandez Mancera nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
726d7f9b2f1SFernando Fernandez Mancera }
727d7f9b2f1SFernando Fernandez Mancera
728d7f9b2f1SFernando Fernandez Mancera opts.options &= ~(NF_SYNPROXY_OPT_MSS |
729d7f9b2f1SFernando Fernandez Mancera NF_SYNPROXY_OPT_WSCALE |
730d7f9b2f1SFernando Fernandez Mancera NF_SYNPROXY_OPT_SACK_PERM);
731d7f9b2f1SFernando Fernandez Mancera
732d7f9b2f1SFernando Fernandez Mancera swap(opts.tsval, opts.tsecr);
733d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_ack(net, state, skb, th, &opts);
734d7f9b2f1SFernando Fernandez Mancera
735d7f9b2f1SFernando Fernandez Mancera nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
736d7f9b2f1SFernando Fernandez Mancera nf_conntrack_event_cache(IPCT_SEQADJ, ct);
737d7f9b2f1SFernando Fernandez Mancera
738d7f9b2f1SFernando Fernandez Mancera swap(opts.tsval, opts.tsecr);
739d7f9b2f1SFernando Fernandez Mancera synproxy_send_client_ack(net, skb, th, &opts);
740d7f9b2f1SFernando Fernandez Mancera
741d7f9b2f1SFernando Fernandez Mancera consume_skb(skb);
742d7f9b2f1SFernando Fernandez Mancera return NF_STOLEN;
743d7f9b2f1SFernando Fernandez Mancera default:
744d7f9b2f1SFernando Fernandez Mancera break;
745d7f9b2f1SFernando Fernandez Mancera }
746d7f9b2f1SFernando Fernandez Mancera
747d7f9b2f1SFernando Fernandez Mancera synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);
748d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
749d7f9b2f1SFernando Fernandez Mancera }
750d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(ipv4_synproxy_hook);
751d7f9b2f1SFernando Fernandez Mancera
752d7f9b2f1SFernando Fernandez Mancera static const struct nf_hook_ops ipv4_synproxy_ops[] = {
753d7f9b2f1SFernando Fernandez Mancera {
754d7f9b2f1SFernando Fernandez Mancera .hook = ipv4_synproxy_hook,
755d7f9b2f1SFernando Fernandez Mancera .pf = NFPROTO_IPV4,
756d7f9b2f1SFernando Fernandez Mancera .hooknum = NF_INET_LOCAL_IN,
757d7f9b2f1SFernando Fernandez Mancera .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
758d7f9b2f1SFernando Fernandez Mancera },
759d7f9b2f1SFernando Fernandez Mancera {
760d7f9b2f1SFernando Fernandez Mancera .hook = ipv4_synproxy_hook,
761d7f9b2f1SFernando Fernandez Mancera .pf = NFPROTO_IPV4,
762d7f9b2f1SFernando Fernandez Mancera .hooknum = NF_INET_POST_ROUTING,
763d7f9b2f1SFernando Fernandez Mancera .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
764d7f9b2f1SFernando Fernandez Mancera },
765d7f9b2f1SFernando Fernandez Mancera };
766d7f9b2f1SFernando Fernandez Mancera
nf_synproxy_ipv4_init(struct synproxy_net * snet,struct net * net)767d7f9b2f1SFernando Fernandez Mancera int nf_synproxy_ipv4_init(struct synproxy_net *snet, struct net *net)
768d7f9b2f1SFernando Fernandez Mancera {
769d7f9b2f1SFernando Fernandez Mancera int err;
770d7f9b2f1SFernando Fernandez Mancera
771d7f9b2f1SFernando Fernandez Mancera if (snet->hook_ref4 == 0) {
772d7f9b2f1SFernando Fernandez Mancera err = nf_register_net_hooks(net, ipv4_synproxy_ops,
773d7f9b2f1SFernando Fernandez Mancera ARRAY_SIZE(ipv4_synproxy_ops));
774d7f9b2f1SFernando Fernandez Mancera if (err)
775d7f9b2f1SFernando Fernandez Mancera return err;
776d7f9b2f1SFernando Fernandez Mancera }
777d7f9b2f1SFernando Fernandez Mancera
778d7f9b2f1SFernando Fernandez Mancera snet->hook_ref4++;
77972c5e118SColin Ian King return 0;
780d7f9b2f1SFernando Fernandez Mancera }
781d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(nf_synproxy_ipv4_init);
782d7f9b2f1SFernando Fernandez Mancera
nf_synproxy_ipv4_fini(struct synproxy_net * snet,struct net * net)783d7f9b2f1SFernando Fernandez Mancera void nf_synproxy_ipv4_fini(struct synproxy_net *snet, struct net *net)
784d7f9b2f1SFernando Fernandez Mancera {
785d7f9b2f1SFernando Fernandez Mancera snet->hook_ref4--;
786d7f9b2f1SFernando Fernandez Mancera if (snet->hook_ref4 == 0)
787d7f9b2f1SFernando Fernandez Mancera nf_unregister_net_hooks(net, ipv4_synproxy_ops,
788d7f9b2f1SFernando Fernandez Mancera ARRAY_SIZE(ipv4_synproxy_ops));
789d7f9b2f1SFernando Fernandez Mancera }
790d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(nf_synproxy_ipv4_fini);
791d7f9b2f1SFernando Fernandez Mancera
792d7f9b2f1SFernando Fernandez Mancera #if IS_ENABLED(CONFIG_IPV6)
793d7f9b2f1SFernando Fernandez Mancera static struct ipv6hdr *
synproxy_build_ip_ipv6(struct net * net,struct sk_buff * skb,const struct in6_addr * saddr,const struct in6_addr * daddr)794d7f9b2f1SFernando Fernandez Mancera synproxy_build_ip_ipv6(struct net *net, struct sk_buff *skb,
795d7f9b2f1SFernando Fernandez Mancera const struct in6_addr *saddr,
796d7f9b2f1SFernando Fernandez Mancera const struct in6_addr *daddr)
797d7f9b2f1SFernando Fernandez Mancera {
798d7f9b2f1SFernando Fernandez Mancera struct ipv6hdr *iph;
799d7f9b2f1SFernando Fernandez Mancera
800d7f9b2f1SFernando Fernandez Mancera skb_reset_network_header(skb);
801d7f9b2f1SFernando Fernandez Mancera iph = skb_put(skb, sizeof(*iph));
802d7f9b2f1SFernando Fernandez Mancera ip6_flow_hdr(iph, 0, 0);
803d7f9b2f1SFernando Fernandez Mancera iph->hop_limit = net->ipv6.devconf_all->hop_limit;
804d7f9b2f1SFernando Fernandez Mancera iph->nexthdr = IPPROTO_TCP;
805d7f9b2f1SFernando Fernandez Mancera iph->saddr = *saddr;
806d7f9b2f1SFernando Fernandez Mancera iph->daddr = *daddr;
807d7f9b2f1SFernando Fernandez Mancera
808d7f9b2f1SFernando Fernandez Mancera return iph;
809d7f9b2f1SFernando Fernandez Mancera }
810d7f9b2f1SFernando Fernandez Mancera
811d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_tcp_ipv6(struct net * net,const struct sk_buff * skb,struct sk_buff * nskb,struct nf_conntrack * nfct,enum ip_conntrack_info ctinfo,struct ipv6hdr * niph,struct tcphdr * nth,unsigned int tcp_hdr_size)812d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp_ipv6(struct net *net,
813d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb, struct sk_buff *nskb,
814d7f9b2f1SFernando Fernandez Mancera struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
815d7f9b2f1SFernando Fernandez Mancera struct ipv6hdr *niph, struct tcphdr *nth,
816d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size)
817d7f9b2f1SFernando Fernandez Mancera {
818d7f9b2f1SFernando Fernandez Mancera struct dst_entry *dst;
819d7f9b2f1SFernando Fernandez Mancera struct flowi6 fl6;
820d7f9b2f1SFernando Fernandez Mancera int err;
821d7f9b2f1SFernando Fernandez Mancera
822d7f9b2f1SFernando Fernandez Mancera nth->check = ~tcp_v6_check(tcp_hdr_size, &niph->saddr, &niph->daddr, 0);
823d7f9b2f1SFernando Fernandez Mancera nskb->ip_summed = CHECKSUM_PARTIAL;
824d7f9b2f1SFernando Fernandez Mancera nskb->csum_start = (unsigned char *)nth - nskb->head;
825d7f9b2f1SFernando Fernandez Mancera nskb->csum_offset = offsetof(struct tcphdr, check);
826d7f9b2f1SFernando Fernandez Mancera
827d7f9b2f1SFernando Fernandez Mancera memset(&fl6, 0, sizeof(fl6));
828d7f9b2f1SFernando Fernandez Mancera fl6.flowi6_proto = IPPROTO_TCP;
829d7f9b2f1SFernando Fernandez Mancera fl6.saddr = niph->saddr;
830d7f9b2f1SFernando Fernandez Mancera fl6.daddr = niph->daddr;
831d7f9b2f1SFernando Fernandez Mancera fl6.fl6_sport = nth->source;
832d7f9b2f1SFernando Fernandez Mancera fl6.fl6_dport = nth->dest;
833d7f9b2f1SFernando Fernandez Mancera security_skb_classify_flow((struct sk_buff *)skb,
8343df98d79SPaul Moore flowi6_to_flowi_common(&fl6));
835d7f9b2f1SFernando Fernandez Mancera err = nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
836d7f9b2f1SFernando Fernandez Mancera if (err) {
837d7f9b2f1SFernando Fernandez Mancera goto free_nskb;
838d7f9b2f1SFernando Fernandez Mancera }
839d7f9b2f1SFernando Fernandez Mancera
840d7f9b2f1SFernando Fernandez Mancera dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
841d7f9b2f1SFernando Fernandez Mancera if (IS_ERR(dst))
842d7f9b2f1SFernando Fernandez Mancera goto free_nskb;
843d7f9b2f1SFernando Fernandez Mancera
844d7f9b2f1SFernando Fernandez Mancera skb_dst_set(nskb, dst);
845d7f9b2f1SFernando Fernandez Mancera
846d7f9b2f1SFernando Fernandez Mancera if (nfct) {
847d7f9b2f1SFernando Fernandez Mancera nf_ct_set(nskb, (struct nf_conn *)nfct, ctinfo);
848d7f9b2f1SFernando Fernandez Mancera nf_conntrack_get(nfct);
849d7f9b2f1SFernando Fernandez Mancera }
850d7f9b2f1SFernando Fernandez Mancera
851d7f9b2f1SFernando Fernandez Mancera ip6_local_out(net, nskb->sk, nskb);
852d7f9b2f1SFernando Fernandez Mancera return;
853d7f9b2f1SFernando Fernandez Mancera
854d7f9b2f1SFernando Fernandez Mancera free_nskb:
855d7f9b2f1SFernando Fernandez Mancera kfree_skb(nskb);
856d7f9b2f1SFernando Fernandez Mancera }
857d7f9b2f1SFernando Fernandez Mancera
858d7f9b2f1SFernando Fernandez Mancera void
synproxy_send_client_synack_ipv6(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts)859d7f9b2f1SFernando Fernandez Mancera synproxy_send_client_synack_ipv6(struct net *net,
860d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb,
861d7f9b2f1SFernando Fernandez Mancera const struct tcphdr *th,
862d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts)
863d7f9b2f1SFernando Fernandez Mancera {
864d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
865d7f9b2f1SFernando Fernandez Mancera struct ipv6hdr *iph, *niph;
866d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
867d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
868b83329fbSFernando Fernandez Mancera u16 mss = opts->mss_encode;
869d7f9b2f1SFernando Fernandez Mancera
870d7f9b2f1SFernando Fernandez Mancera iph = ipv6_hdr(skb);
871d7f9b2f1SFernando Fernandez Mancera
872d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
873d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
874d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
875d7f9b2f1SFernando Fernandez Mancera if (!nskb)
876d7f9b2f1SFernando Fernandez Mancera return;
877d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
878d7f9b2f1SFernando Fernandez Mancera
879d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip_ipv6(net, nskb, &iph->daddr, &iph->saddr);
880d7f9b2f1SFernando Fernandez Mancera
881d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
882d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
883d7f9b2f1SFernando Fernandez Mancera nth->source = th->dest;
884d7f9b2f1SFernando Fernandez Mancera nth->dest = th->source;
885d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(nf_ipv6_cookie_init_sequence(iph, th, &mss));
886d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = htonl(ntohl(th->seq) + 1);
887d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
888d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_ECN)
889d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) |= TCP_FLAG_ECE;
890d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
891d7f9b2f1SFernando Fernandez Mancera nth->window = 0;
892d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
893d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
894d7f9b2f1SFernando Fernandez Mancera
895d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
896d7f9b2f1SFernando Fernandez Mancera
897d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp_ipv6(net, skb, nskb, skb_nfct(skb),
898d7f9b2f1SFernando Fernandez Mancera IP_CT_ESTABLISHED_REPLY, niph, nth,
899d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size);
900d7f9b2f1SFernando Fernandez Mancera }
901d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(synproxy_send_client_synack_ipv6);
902d7f9b2f1SFernando Fernandez Mancera
903d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_server_syn_ipv6(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts,u32 recv_seq)904d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_syn_ipv6(struct net *net, const struct sk_buff *skb,
905d7f9b2f1SFernando Fernandez Mancera const struct tcphdr *th,
906d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts, u32 recv_seq)
907d7f9b2f1SFernando Fernandez Mancera {
908d7f9b2f1SFernando Fernandez Mancera struct synproxy_net *snet = synproxy_pernet(net);
909d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
910d7f9b2f1SFernando Fernandez Mancera struct ipv6hdr *iph, *niph;
911d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
912d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
913d7f9b2f1SFernando Fernandez Mancera
914d7f9b2f1SFernando Fernandez Mancera iph = ipv6_hdr(skb);
915d7f9b2f1SFernando Fernandez Mancera
916d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
917d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
918d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
919d7f9b2f1SFernando Fernandez Mancera if (!nskb)
920d7f9b2f1SFernando Fernandez Mancera return;
921d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
922d7f9b2f1SFernando Fernandez Mancera
923d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip_ipv6(net, nskb, &iph->saddr, &iph->daddr);
924d7f9b2f1SFernando Fernandez Mancera
925d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
926d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
927d7f9b2f1SFernando Fernandez Mancera nth->source = th->source;
928d7f9b2f1SFernando Fernandez Mancera nth->dest = th->dest;
929d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(recv_seq - 1);
930d7f9b2f1SFernando Fernandez Mancera /* ack_seq is used to relay our ISN to the synproxy hook to initialize
931d7f9b2f1SFernando Fernandez Mancera * sequence number translation once a connection tracking entry exists.
932d7f9b2f1SFernando Fernandez Mancera */
933d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = htonl(ntohl(th->ack_seq) - 1);
934d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_SYN;
935d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_ECN)
936d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) |= TCP_FLAG_ECE | TCP_FLAG_CWR;
937d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
938d7f9b2f1SFernando Fernandez Mancera nth->window = th->window;
939d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
940d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
941d7f9b2f1SFernando Fernandez Mancera
942d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
943d7f9b2f1SFernando Fernandez Mancera
944d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp_ipv6(net, skb, nskb, &snet->tmpl->ct_general,
945d7f9b2f1SFernando Fernandez Mancera IP_CT_NEW, niph, nth, tcp_hdr_size);
946d7f9b2f1SFernando Fernandez Mancera }
947d7f9b2f1SFernando Fernandez Mancera
948d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_server_ack_ipv6(struct net * net,const struct ip_ct_tcp * state,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts)949d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_ack_ipv6(struct net *net, const struct ip_ct_tcp *state,
950d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb,
951d7f9b2f1SFernando Fernandez Mancera const struct tcphdr *th,
952d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts)
953d7f9b2f1SFernando Fernandez Mancera {
954d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
955d7f9b2f1SFernando Fernandez Mancera struct ipv6hdr *iph, *niph;
956d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
957d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
958d7f9b2f1SFernando Fernandez Mancera
959d7f9b2f1SFernando Fernandez Mancera iph = ipv6_hdr(skb);
960d7f9b2f1SFernando Fernandez Mancera
961d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
962d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
963d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
964d7f9b2f1SFernando Fernandez Mancera if (!nskb)
965d7f9b2f1SFernando Fernandez Mancera return;
966d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
967d7f9b2f1SFernando Fernandez Mancera
968d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip_ipv6(net, nskb, &iph->daddr, &iph->saddr);
969d7f9b2f1SFernando Fernandez Mancera
970d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
971d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
972d7f9b2f1SFernando Fernandez Mancera nth->source = th->dest;
973d7f9b2f1SFernando Fernandez Mancera nth->dest = th->source;
974d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(ntohl(th->ack_seq));
975d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = htonl(ntohl(th->seq) + 1);
976d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_ACK;
977d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
978d7f9b2f1SFernando Fernandez Mancera nth->window = htons(state->seen[IP_CT_DIR_ORIGINAL].td_maxwin);
979d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
980d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
981d7f9b2f1SFernando Fernandez Mancera
982d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
983d7f9b2f1SFernando Fernandez Mancera
984d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp_ipv6(net, skb, nskb, NULL, 0, niph, nth,
985d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size);
986d7f9b2f1SFernando Fernandez Mancera }
987d7f9b2f1SFernando Fernandez Mancera
988d7f9b2f1SFernando Fernandez Mancera static void
synproxy_send_client_ack_ipv6(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,const struct synproxy_options * opts)989d7f9b2f1SFernando Fernandez Mancera synproxy_send_client_ack_ipv6(struct net *net, const struct sk_buff *skb,
990d7f9b2f1SFernando Fernandez Mancera const struct tcphdr *th,
991d7f9b2f1SFernando Fernandez Mancera const struct synproxy_options *opts)
992d7f9b2f1SFernando Fernandez Mancera {
993d7f9b2f1SFernando Fernandez Mancera struct sk_buff *nskb;
994d7f9b2f1SFernando Fernandez Mancera struct ipv6hdr *iph, *niph;
995d7f9b2f1SFernando Fernandez Mancera struct tcphdr *nth;
996d7f9b2f1SFernando Fernandez Mancera unsigned int tcp_hdr_size;
997d7f9b2f1SFernando Fernandez Mancera
998d7f9b2f1SFernando Fernandez Mancera iph = ipv6_hdr(skb);
999d7f9b2f1SFernando Fernandez Mancera
1000d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
1001d7f9b2f1SFernando Fernandez Mancera nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER,
1002d7f9b2f1SFernando Fernandez Mancera GFP_ATOMIC);
1003d7f9b2f1SFernando Fernandez Mancera if (!nskb)
1004d7f9b2f1SFernando Fernandez Mancera return;
1005d7f9b2f1SFernando Fernandez Mancera skb_reserve(nskb, MAX_TCP_HEADER);
1006d7f9b2f1SFernando Fernandez Mancera
1007d7f9b2f1SFernando Fernandez Mancera niph = synproxy_build_ip_ipv6(net, nskb, &iph->saddr, &iph->daddr);
1008d7f9b2f1SFernando Fernandez Mancera
1009d7f9b2f1SFernando Fernandez Mancera skb_reset_transport_header(nskb);
1010d7f9b2f1SFernando Fernandez Mancera nth = skb_put(nskb, tcp_hdr_size);
1011d7f9b2f1SFernando Fernandez Mancera nth->source = th->source;
1012d7f9b2f1SFernando Fernandez Mancera nth->dest = th->dest;
1013d7f9b2f1SFernando Fernandez Mancera nth->seq = htonl(ntohl(th->seq) + 1);
1014d7f9b2f1SFernando Fernandez Mancera nth->ack_seq = th->ack_seq;
1015d7f9b2f1SFernando Fernandez Mancera tcp_flag_word(nth) = TCP_FLAG_ACK;
1016d7f9b2f1SFernando Fernandez Mancera nth->doff = tcp_hdr_size / 4;
1017d7f9b2f1SFernando Fernandez Mancera nth->window = htons(ntohs(th->window) >> opts->wscale);
1018d7f9b2f1SFernando Fernandez Mancera nth->check = 0;
1019d7f9b2f1SFernando Fernandez Mancera nth->urg_ptr = 0;
1020d7f9b2f1SFernando Fernandez Mancera
1021d7f9b2f1SFernando Fernandez Mancera synproxy_build_options(nth, opts);
1022d7f9b2f1SFernando Fernandez Mancera
1023d7f9b2f1SFernando Fernandez Mancera synproxy_send_tcp_ipv6(net, skb, nskb, skb_nfct(skb),
1024d7f9b2f1SFernando Fernandez Mancera IP_CT_ESTABLISHED_REPLY, niph, nth,
1025d7f9b2f1SFernando Fernandez Mancera tcp_hdr_size);
1026d7f9b2f1SFernando Fernandez Mancera }
1027d7f9b2f1SFernando Fernandez Mancera
1028d7f9b2f1SFernando Fernandez Mancera bool
synproxy_recv_client_ack_ipv6(struct net * net,const struct sk_buff * skb,const struct tcphdr * th,struct synproxy_options * opts,u32 recv_seq)1029d7f9b2f1SFernando Fernandez Mancera synproxy_recv_client_ack_ipv6(struct net *net,
1030d7f9b2f1SFernando Fernandez Mancera const struct sk_buff *skb,
1031d7f9b2f1SFernando Fernandez Mancera const struct tcphdr *th,
1032d7f9b2f1SFernando Fernandez Mancera struct synproxy_options *opts, u32 recv_seq)
1033d7f9b2f1SFernando Fernandez Mancera {
1034d7f9b2f1SFernando Fernandez Mancera struct synproxy_net *snet = synproxy_pernet(net);
1035d7f9b2f1SFernando Fernandez Mancera int mss;
1036d7f9b2f1SFernando Fernandez Mancera
103722f2efd3SPablo Neira Ayuso mss = nf_cookie_v6_check(ipv6_hdr(skb), th, ntohl(th->ack_seq) - 1);
1038d7f9b2f1SFernando Fernandez Mancera if (mss == 0) {
1039d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->cookie_invalid);
1040d7f9b2f1SFernando Fernandez Mancera return false;
1041d7f9b2f1SFernando Fernandez Mancera }
1042d7f9b2f1SFernando Fernandez Mancera
1043d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->cookie_valid);
10448c0bb787SFernando Fernandez Mancera opts->mss_option = mss;
1045d7f9b2f1SFernando Fernandez Mancera opts->options |= NF_SYNPROXY_OPT_MSS;
1046d7f9b2f1SFernando Fernandez Mancera
1047d7f9b2f1SFernando Fernandez Mancera if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
1048d7f9b2f1SFernando Fernandez Mancera synproxy_check_timestamp_cookie(opts);
1049d7f9b2f1SFernando Fernandez Mancera
1050d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_syn_ipv6(net, skb, th, opts, recv_seq);
1051d7f9b2f1SFernando Fernandez Mancera return true;
1052d7f9b2f1SFernando Fernandez Mancera }
1053d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(synproxy_recv_client_ack_ipv6);
1054d7f9b2f1SFernando Fernandez Mancera
1055d7f9b2f1SFernando Fernandez Mancera unsigned int
ipv6_synproxy_hook(void * priv,struct sk_buff * skb,const struct nf_hook_state * nhs)1056d7f9b2f1SFernando Fernandez Mancera ipv6_synproxy_hook(void *priv, struct sk_buff *skb,
1057d7f9b2f1SFernando Fernandez Mancera const struct nf_hook_state *nhs)
1058d7f9b2f1SFernando Fernandez Mancera {
1059d7f9b2f1SFernando Fernandez Mancera struct net *net = nhs->net;
1060d7f9b2f1SFernando Fernandez Mancera struct synproxy_net *snet = synproxy_pernet(net);
1061d7f9b2f1SFernando Fernandez Mancera enum ip_conntrack_info ctinfo;
1062d7f9b2f1SFernando Fernandez Mancera struct nf_conn *ct;
1063d7f9b2f1SFernando Fernandez Mancera struct nf_conn_synproxy *synproxy;
1064d7f9b2f1SFernando Fernandez Mancera struct synproxy_options opts = {};
1065d7f9b2f1SFernando Fernandez Mancera const struct ip_ct_tcp *state;
1066d7f9b2f1SFernando Fernandez Mancera struct tcphdr *th, _th;
1067d7f9b2f1SFernando Fernandez Mancera __be16 frag_off;
1068d7f9b2f1SFernando Fernandez Mancera u8 nexthdr;
1069d7f9b2f1SFernando Fernandez Mancera int thoff;
1070d7f9b2f1SFernando Fernandez Mancera
1071d7f9b2f1SFernando Fernandez Mancera ct = nf_ct_get(skb, &ctinfo);
1072d7f9b2f1SFernando Fernandez Mancera if (!ct)
1073d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
1074d7f9b2f1SFernando Fernandez Mancera
1075d7f9b2f1SFernando Fernandez Mancera synproxy = nfct_synproxy(ct);
1076d7f9b2f1SFernando Fernandez Mancera if (!synproxy)
1077d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
1078d7f9b2f1SFernando Fernandez Mancera
1079d7f9b2f1SFernando Fernandez Mancera if (nf_is_loopback_packet(skb))
1080d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
1081d7f9b2f1SFernando Fernandez Mancera
1082d7f9b2f1SFernando Fernandez Mancera nexthdr = ipv6_hdr(skb)->nexthdr;
1083d7f9b2f1SFernando Fernandez Mancera thoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
1084d7f9b2f1SFernando Fernandez Mancera &frag_off);
1085d7f9b2f1SFernando Fernandez Mancera if (thoff < 0 || nexthdr != IPPROTO_TCP)
1086d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
1087d7f9b2f1SFernando Fernandez Mancera
1088d7f9b2f1SFernando Fernandez Mancera th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
1089d7f9b2f1SFernando Fernandez Mancera if (!th)
1090d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
1091d7f9b2f1SFernando Fernandez Mancera
1092d7f9b2f1SFernando Fernandez Mancera state = &ct->proto.tcp;
1093d7f9b2f1SFernando Fernandez Mancera switch (state->state) {
1094d7f9b2f1SFernando Fernandez Mancera case TCP_CONNTRACK_CLOSE:
1095e971ceb8SFernando Fernandez Mancera if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
1096d7f9b2f1SFernando Fernandez Mancera nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
1097d7f9b2f1SFernando Fernandez Mancera ntohl(th->seq) + 1);
1098d7f9b2f1SFernando Fernandez Mancera break;
1099d7f9b2f1SFernando Fernandez Mancera }
1100d7f9b2f1SFernando Fernandez Mancera
1101d7f9b2f1SFernando Fernandez Mancera if (!th->syn || th->ack ||
1102d7f9b2f1SFernando Fernandez Mancera CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
1103d7f9b2f1SFernando Fernandez Mancera break;
1104d7f9b2f1SFernando Fernandez Mancera
1105d7f9b2f1SFernando Fernandez Mancera /* Reopened connection - reset the sequence number and timestamp
1106d7f9b2f1SFernando Fernandez Mancera * adjustments, they will get initialized once the connection is
1107d7f9b2f1SFernando Fernandez Mancera * reestablished.
1108d7f9b2f1SFernando Fernandez Mancera */
1109d7f9b2f1SFernando Fernandez Mancera nf_ct_seqadj_init(ct, ctinfo, 0);
1110d7f9b2f1SFernando Fernandez Mancera synproxy->tsoff = 0;
1111d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->conn_reopened);
1112954d8297SGustavo A. R. Silva fallthrough;
1113d7f9b2f1SFernando Fernandez Mancera case TCP_CONNTRACK_SYN_SENT:
1114d7f9b2f1SFernando Fernandez Mancera if (!synproxy_parse_options(skb, thoff, th, &opts))
1115d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
1116d7f9b2f1SFernando Fernandez Mancera
1117d7f9b2f1SFernando Fernandez Mancera if (!th->syn && th->ack &&
1118d7f9b2f1SFernando Fernandez Mancera CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
1119d7f9b2f1SFernando Fernandez Mancera /* Keep-Alives are sent with SEG.SEQ = SND.NXT-1,
1120d7f9b2f1SFernando Fernandez Mancera * therefore we need to add 1 to make the SYN sequence
1121d7f9b2f1SFernando Fernandez Mancera * number match the one of first SYN.
1122d7f9b2f1SFernando Fernandez Mancera */
1123d7f9b2f1SFernando Fernandez Mancera if (synproxy_recv_client_ack_ipv6(net, skb, th, &opts,
1124d7f9b2f1SFernando Fernandez Mancera ntohl(th->seq) + 1)) {
1125d7f9b2f1SFernando Fernandez Mancera this_cpu_inc(snet->stats->cookie_retrans);
1126d7f9b2f1SFernando Fernandez Mancera consume_skb(skb);
1127d7f9b2f1SFernando Fernandez Mancera return NF_STOLEN;
1128d7f9b2f1SFernando Fernandez Mancera } else {
1129d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
1130d7f9b2f1SFernando Fernandez Mancera }
1131d7f9b2f1SFernando Fernandez Mancera }
1132d7f9b2f1SFernando Fernandez Mancera
1133d7f9b2f1SFernando Fernandez Mancera synproxy->isn = ntohl(th->ack_seq);
1134d7f9b2f1SFernando Fernandez Mancera if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP)
1135d7f9b2f1SFernando Fernandez Mancera synproxy->its = opts.tsecr;
1136d7f9b2f1SFernando Fernandez Mancera
1137d7f9b2f1SFernando Fernandez Mancera nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
1138d7f9b2f1SFernando Fernandez Mancera break;
1139d7f9b2f1SFernando Fernandez Mancera case TCP_CONNTRACK_SYN_RECV:
1140d7f9b2f1SFernando Fernandez Mancera if (!th->syn || !th->ack)
1141d7f9b2f1SFernando Fernandez Mancera break;
1142d7f9b2f1SFernando Fernandez Mancera
1143d7f9b2f1SFernando Fernandez Mancera if (!synproxy_parse_options(skb, thoff, th, &opts))
1144d7f9b2f1SFernando Fernandez Mancera return NF_DROP;
1145d7f9b2f1SFernando Fernandez Mancera
1146d7f9b2f1SFernando Fernandez Mancera if (opts.options & NF_SYNPROXY_OPT_TIMESTAMP) {
1147d7f9b2f1SFernando Fernandez Mancera synproxy->tsoff = opts.tsval - synproxy->its;
1148d7f9b2f1SFernando Fernandez Mancera nf_conntrack_event_cache(IPCT_SYNPROXY, ct);
1149d7f9b2f1SFernando Fernandez Mancera }
1150d7f9b2f1SFernando Fernandez Mancera
1151d7f9b2f1SFernando Fernandez Mancera opts.options &= ~(NF_SYNPROXY_OPT_MSS |
1152d7f9b2f1SFernando Fernandez Mancera NF_SYNPROXY_OPT_WSCALE |
1153d7f9b2f1SFernando Fernandez Mancera NF_SYNPROXY_OPT_SACK_PERM);
1154d7f9b2f1SFernando Fernandez Mancera
1155d7f9b2f1SFernando Fernandez Mancera swap(opts.tsval, opts.tsecr);
1156d7f9b2f1SFernando Fernandez Mancera synproxy_send_server_ack_ipv6(net, state, skb, th, &opts);
1157d7f9b2f1SFernando Fernandez Mancera
1158d7f9b2f1SFernando Fernandez Mancera nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
1159d7f9b2f1SFernando Fernandez Mancera nf_conntrack_event_cache(IPCT_SEQADJ, ct);
1160d7f9b2f1SFernando Fernandez Mancera
1161d7f9b2f1SFernando Fernandez Mancera swap(opts.tsval, opts.tsecr);
1162d7f9b2f1SFernando Fernandez Mancera synproxy_send_client_ack_ipv6(net, skb, th, &opts);
1163d7f9b2f1SFernando Fernandez Mancera
1164d7f9b2f1SFernando Fernandez Mancera consume_skb(skb);
1165d7f9b2f1SFernando Fernandez Mancera return NF_STOLEN;
1166d7f9b2f1SFernando Fernandez Mancera default:
1167d7f9b2f1SFernando Fernandez Mancera break;
1168d7f9b2f1SFernando Fernandez Mancera }
1169d7f9b2f1SFernando Fernandez Mancera
1170d7f9b2f1SFernando Fernandez Mancera synproxy_tstamp_adjust(skb, thoff, th, ct, ctinfo, synproxy);
1171d7f9b2f1SFernando Fernandez Mancera return NF_ACCEPT;
1172d7f9b2f1SFernando Fernandez Mancera }
1173d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(ipv6_synproxy_hook);
1174d7f9b2f1SFernando Fernandez Mancera
1175d7f9b2f1SFernando Fernandez Mancera static const struct nf_hook_ops ipv6_synproxy_ops[] = {
1176d7f9b2f1SFernando Fernandez Mancera {
1177d7f9b2f1SFernando Fernandez Mancera .hook = ipv6_synproxy_hook,
1178d7f9b2f1SFernando Fernandez Mancera .pf = NFPROTO_IPV6,
1179d7f9b2f1SFernando Fernandez Mancera .hooknum = NF_INET_LOCAL_IN,
1180d7f9b2f1SFernando Fernandez Mancera .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
1181d7f9b2f1SFernando Fernandez Mancera },
1182d7f9b2f1SFernando Fernandez Mancera {
1183d7f9b2f1SFernando Fernandez Mancera .hook = ipv6_synproxy_hook,
1184d7f9b2f1SFernando Fernandez Mancera .pf = NFPROTO_IPV6,
1185d7f9b2f1SFernando Fernandez Mancera .hooknum = NF_INET_POST_ROUTING,
1186d7f9b2f1SFernando Fernandez Mancera .priority = NF_IP_PRI_CONNTRACK_CONFIRM - 1,
1187d7f9b2f1SFernando Fernandez Mancera },
1188d7f9b2f1SFernando Fernandez Mancera };
1189d7f9b2f1SFernando Fernandez Mancera
1190d7f9b2f1SFernando Fernandez Mancera int
nf_synproxy_ipv6_init(struct synproxy_net * snet,struct net * net)1191d7f9b2f1SFernando Fernandez Mancera nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net)
1192d7f9b2f1SFernando Fernandez Mancera {
1193d7f9b2f1SFernando Fernandez Mancera int err;
1194d7f9b2f1SFernando Fernandez Mancera
1195d7f9b2f1SFernando Fernandez Mancera if (snet->hook_ref6 == 0) {
1196d7f9b2f1SFernando Fernandez Mancera err = nf_register_net_hooks(net, ipv6_synproxy_ops,
1197d7f9b2f1SFernando Fernandez Mancera ARRAY_SIZE(ipv6_synproxy_ops));
1198d7f9b2f1SFernando Fernandez Mancera if (err)
1199d7f9b2f1SFernando Fernandez Mancera return err;
1200d7f9b2f1SFernando Fernandez Mancera }
1201d7f9b2f1SFernando Fernandez Mancera
1202d7f9b2f1SFernando Fernandez Mancera snet->hook_ref6++;
120372c5e118SColin Ian King return 0;
1204d7f9b2f1SFernando Fernandez Mancera }
1205d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(nf_synproxy_ipv6_init);
1206d7f9b2f1SFernando Fernandez Mancera
1207d7f9b2f1SFernando Fernandez Mancera void
nf_synproxy_ipv6_fini(struct synproxy_net * snet,struct net * net)1208d7f9b2f1SFernando Fernandez Mancera nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net)
1209d7f9b2f1SFernando Fernandez Mancera {
1210d7f9b2f1SFernando Fernandez Mancera snet->hook_ref6--;
1211d7f9b2f1SFernando Fernandez Mancera if (snet->hook_ref6 == 0)
1212d7f9b2f1SFernando Fernandez Mancera nf_unregister_net_hooks(net, ipv6_synproxy_ops,
1213d7f9b2f1SFernando Fernandez Mancera ARRAY_SIZE(ipv6_synproxy_ops));
1214d7f9b2f1SFernando Fernandez Mancera }
1215d7f9b2f1SFernando Fernandez Mancera EXPORT_SYMBOL_GPL(nf_synproxy_ipv6_fini);
1216d7f9b2f1SFernando Fernandez Mancera #endif /* CONFIG_IPV6 */
1217d7f9b2f1SFernando Fernandez Mancera
121848b1de4cSPatrick McHardy MODULE_LICENSE("GPL");
121948b1de4cSPatrick McHardy MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
12204cacc395SRob Gill MODULE_DESCRIPTION("nftables SYNPROXY expression support");
1221