From: KOVACS Krisztian <hidden@balabit•hu>
To: netdev@vger•kernel.org, netfilter-devel@vger•kernel.org
Cc: Balazs Scheidler <bazsi@balabit•hu>,
Patrick McHardy <kaber@trash•net>,
David Miller <davem@davemloft•net>
Subject: [PATCH v2 6/9] tproxy: added IPv6 socket lookup function to nf_tproxy_core
Date: Thu, 21 Oct 2010 12:47:09 +0200 [thread overview]
Message-ID: <20101021104709.5192.34304.stgit@este.odu> (raw)
In-Reply-To: <20101021104709.5192.31249.stgit@este.odu>
From: Balazs Scheidler <bazsi@balabit•hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit•hu>
Signed-off-by: KOVACS Krisztian <hidden@balabit•hu>
---
include/net/netfilter/nf_tproxy_core.h | 72 ++++++++++++++++++++++++++++++++
1 files changed, 71 insertions(+), 1 deletions(-)
diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h
index 1027d7f..cd85b3b 100644
--- a/include/net/netfilter/nf_tproxy_core.h
+++ b/include/net/netfilter/nf_tproxy_core.h
@@ -5,7 +5,8 @@
#include <linux/in.h>
#include <linux/skbuff.h>
#include <net/sock.h>
-#include <net/inet_sock.h>
+#include <net/inet_hashtables.h>
+#include <net/inet6_hashtables.h>
#include <net/tcp.h>
#define NFT_LOOKUP_ANY 0
@@ -130,6 +131,75 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
return sk;
}
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static inline struct sock *
+nf_tproxy_get_sock_v6(struct net *net, const u8 protocol,
+ const struct in6_addr *saddr, const struct in6_addr *daddr,
+ const __be16 sport, const __be16 dport,
+ const struct net_device *in, int lookup_type)
+{
+ struct sock *sk;
+
+ /* look up socket */
+ switch (protocol) {
+ case IPPROTO_TCP:
+ switch (lookup_type) {
+ case NFT_LOOKUP_ANY:
+ sk = inet6_lookup(net, &tcp_hashinfo,
+ saddr, sport, daddr, dport,
+ in->ifindex);
+ break;
+ case NFT_LOOKUP_LISTENER:
+ sk = inet6_lookup_listener(net, &tcp_hashinfo,
+ daddr, ntohs(dport),
+ in->ifindex);
+
+ /* NOTE: we return listeners even if bound to
+ * 0.0.0.0, those are filtered out in
+ * xt_socket, since xt_TPROXY needs 0 bound
+ * listeners too */
+
+ break;
+ case NFT_LOOKUP_ESTABLISHED:
+ sk = __inet6_lookup_established(net, &tcp_hashinfo,
+ saddr, sport, daddr, ntohs(dport),
+ in->ifindex);
+ break;
+ default:
+ WARN_ON(1);
+ sk = NULL;
+ break;
+ }
+ break;
+ case IPPROTO_UDP:
+ sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
+ in->ifindex);
+ if (sk && lookup_type != NFT_LOOKUP_ANY) {
+ int connected = (sk->sk_state == TCP_ESTABLISHED);
+ int wildcard = ipv6_addr_any(&inet6_sk(sk)->rcv_saddr);
+
+ /* NOTE: we return listeners even if bound to
+ * 0.0.0.0, those are filtered out in
+ * xt_socket, since xt_TPROXY needs 0 bound
+ * listeners too */
+ if ((lookup_type == NFT_LOOKUP_ESTABLISHED && (!connected || wildcard)) ||
+ (lookup_type == NFT_LOOKUP_LISTENER && connected)) {
+ sock_put(sk);
+ sk = NULL;
+ }
+ }
+ break;
+ default:
+ WARN_ON(1);
+ sk = NULL;
+ }
+
+ pr_debug("tproxy socket lookup: proto %u %pI6:%u -> %pI6:%u, lookup type: %d, sock %p\n",
+ protocol, saddr, ntohs(sport), daddr, ntohs(dport), lookup_type, sk);
+
+ return sk;
+}
+#endif
static inline void
nf_tproxy_put_sock(struct sock *sk)
next prev parent reply other threads:[~2010-10-21 10:47 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-21 10:47 [PATCH v2 0/9] tproxy: add IPv6 support KOVACS Krisztian
2010-10-21 10:47 ` [PATCH v2 1/9] tproxy: split off ipv6 defragmentation to a separate module KOVACS Krisztian
2010-10-21 11:30 ` Patrick McHardy
2010-10-21 11:43 ` KOVACS Krisztian
2010-10-21 14:04 ` Patrick McHardy
2010-10-21 22:19 ` Eric Dumazet
2010-10-25 9:38 ` KOVACS Krisztian
2010-10-25 10:14 ` Eric Dumazet
2010-10-25 20:42 ` Patrick McHardy
2010-10-25 20:54 ` David Miller
2010-10-21 10:47 ` KOVACS Krisztian [this message]
2010-10-21 14:12 ` [PATCH v2 6/9] tproxy: added IPv6 socket lookup function to nf_tproxy_core Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 7/9] tproxy: added IPv6 support to the TPROXY target KOVACS Krisztian
2010-10-21 14:17 ` Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 3/9] tproxy: added udp6_lib_lookup function KOVACS Krisztian
2010-10-21 14:06 ` Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 4/9] tproxy: added tproxy sockopt interface in the IPV6 layer KOVACS Krisztian
2010-10-21 14:09 ` Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 2/9] tproxy: added const specifiers to udp lookup functions KOVACS Krisztian
2010-10-21 14:05 ` Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 5/9] tproxy: allow non-local binds of IPv6 sockets if IP_TRANSPARENT is enabled KOVACS Krisztian
2010-10-21 14:11 ` Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 9/9] tproxy: use the interface primary IP address as a default value for --on-ip KOVACS Krisztian
2010-10-21 14:21 ` Patrick McHardy
2010-10-21 14:26 ` Amos Jeffries
2010-10-21 14:48 ` Patrick McHardy
2010-10-21 10:47 ` [PATCH v2 8/9] tproxy: added IPv6 support to the socket match KOVACS Krisztian
2010-10-21 14:20 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20101021104709.5192.34304.stgit@este.odu \
--to=hidden@balabit$(echo .)hu \
--cc=bazsi@balabit$(echo .)hu \
--cc=davem@davemloft$(echo .)net \
--cc=kaber@trash$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox