Commit 106e4c26 authored by Balazs Scheidler's avatar Balazs Scheidler Committed by Patrick McHardy

tproxy: kick out TIME_WAIT sockets in case a new connection comes in with the same tuple

Without tproxy redirections an incoming SYN kicks out conflicting
TIME_WAIT sockets, in order to handle clients that reuse ports
within the TIME_WAIT period.

The same mechanism didn't work in case TProxy is involved in finding
the proper socket, as the time_wait processing code looked up the
listening socket assuming that the listener addr/port matches those
of the established connection.

This is not the case with TProxy as the listener addr/port is possibly
changed with the tproxy rule.
Signed-off-by: default avatarBalazs Scheidler <bazsi@balabit.hu>
Signed-off-by: default avatarKOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent d86bef73
...@@ -8,12 +8,16 @@ ...@@ -8,12 +8,16 @@
#include <net/inet_sock.h> #include <net/inet_sock.h>
#include <net/tcp.h> #include <net/tcp.h>
#define NFT_LOOKUP_ANY 0
#define NFT_LOOKUP_LISTENER 1
#define NFT_LOOKUP_ESTABLISHED 2
/* look up and get a reference to a matching socket */ /* look up and get a reference to a matching socket */
extern struct sock * extern struct sock *
nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
const __be32 saddr, const __be32 daddr, const __be32 saddr, const __be32 daddr,
const __be16 sport, const __be16 dport, const __be16 sport, const __be16 dport,
const struct net_device *in, bool listening); const struct net_device *in, int lookup_type);
static inline void static inline void
nf_tproxy_put_sock(struct sock *sk) nf_tproxy_put_sock(struct sock *sk)
......
...@@ -22,21 +22,34 @@ struct sock * ...@@ -22,21 +22,34 @@ struct sock *
nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
const __be32 saddr, const __be32 daddr, const __be32 saddr, const __be32 daddr,
const __be16 sport, const __be16 dport, const __be16 sport, const __be16 dport,
const struct net_device *in, bool listening_only) const struct net_device *in, int lookup_type)
{ {
struct sock *sk; struct sock *sk;
/* look up socket */ /* look up socket */
switch (protocol) { switch (protocol) {
case IPPROTO_TCP: case IPPROTO_TCP:
if (listening_only) switch (lookup_type) {
sk = __inet_lookup_listener(net, &tcp_hashinfo, case NFT_LOOKUP_ANY:
daddr, ntohs(dport),
in->ifindex);
else
sk = __inet_lookup(net, &tcp_hashinfo, sk = __inet_lookup(net, &tcp_hashinfo,
saddr, sport, daddr, dport, saddr, sport, daddr, dport,
in->ifindex); in->ifindex);
break;
case NFT_LOOKUP_LISTENER:
sk = inet_lookup_listener(net, &tcp_hashinfo,
daddr, dport,
in->ifindex);
break;
case NFT_LOOKUP_ESTABLISHED:
sk = inet_lookup_established(net, &tcp_hashinfo,
saddr, sport, daddr, dport,
in->ifindex);
break;
default:
WARN_ON(1);
sk = NULL;
break;
}
break; break;
case IPPROTO_UDP: case IPPROTO_UDP:
sk = udp4_lib_lookup(net, saddr, sport, daddr, dport, sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
...@@ -47,8 +60,8 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, ...@@ -47,8 +60,8 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol,
sk = NULL; sk = NULL;
} }
pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, listener only: %d, sock %p\n", pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n",
protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), listening_only, sk); protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk);
return sk; return sk;
} }
......
...@@ -24,6 +24,57 @@ ...@@ -24,6 +24,57 @@
#include <net/netfilter/ipv4/nf_defrag_ipv4.h> #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
#include <net/netfilter/nf_tproxy_core.h> #include <net/netfilter/nf_tproxy_core.h>
/**
* tproxy_handle_time_wait() - handle TCP TIME_WAIT reopen redirections
* @skb: The skb being processed.
* @par: Iptables target parameters.
* @sk: The TIME_WAIT TCP socket found by the lookup.
*
* We have to handle SYN packets arriving to TIME_WAIT sockets
* differently: instead of reopening the connection we should rather
* redirect the new connection to the proxy if there's a listener
* socket present.
*
* tproxy_handle_time_wait() consumes the socket reference passed in.
*
* Returns the listener socket if there's one, the TIME_WAIT socket if
* no such listener is found, or NULL if the TCP header is incomplete.
*/
static struct sock *
tproxy_handle_time_wait(struct sk_buff *skb, const struct xt_action_param *par, struct sock *sk)
{
const struct iphdr *iph = ip_hdr(skb);
const struct xt_tproxy_target_info *tgi = par->targinfo;
struct tcphdr _hdr, *hp;
hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
if (hp == NULL) {
inet_twsk_put(inet_twsk(sk));
return NULL;
}
if (hp->syn && !hp->rst && !hp->ack && !hp->fin) {
/* SYN to a TIME_WAIT socket, we'd rather redirect it
* to a listener socket if there's one */
struct sock *sk2;
sk2 = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr,
hp->source, tgi->lport ? tgi->lport : hp->dest,
par->in, NFT_LOOKUP_LISTENER);
if (sk2) {
/* yeah, there's one, let's kill the TIME_WAIT
* socket and redirect to the listener
*/
inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
inet_twsk_put(inet_twsk(sk));
sk = sk2;
}
}
return sk;
}
static unsigned int static unsigned int
tproxy_tg(struct sk_buff *skb, const struct xt_action_param *par) tproxy_tg(struct sk_buff *skb, const struct xt_action_param *par)
{ {
...@@ -37,11 +88,18 @@ tproxy_tg(struct sk_buff *skb, const struct xt_action_param *par) ...@@ -37,11 +88,18 @@ tproxy_tg(struct sk_buff *skb, const struct xt_action_param *par)
return NF_DROP; return NF_DROP;
sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
iph->saddr, iph->saddr, iph->daddr,
tgi->laddr ? tgi->laddr : iph->daddr, hp->source, hp->dest,
hp->source, par->in, NFT_LOOKUP_ESTABLISHED);
tgi->lport ? tgi->lport : hp->dest,
par->in, true); /* UDP has no TCP_TIME_WAIT state, so we never enter here */
if (sk && sk->sk_state == TCP_TIME_WAIT)
sk = tproxy_handle_time_wait(skb, par, sk);
else if (!sk)
sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol,
iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr,
hp->source, tgi->lport ? tgi->lport : hp->dest,
par->in, NFT_LOOKUP_LISTENER);
/* NOTE: assign_sock consumes our sk reference */ /* NOTE: assign_sock consumes our sk reference */
if (sk && nf_tproxy_assign_sock(skb, sk)) { if (sk && nf_tproxy_assign_sock(skb, sk)) {
......
...@@ -142,7 +142,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par, ...@@ -142,7 +142,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
#endif #endif
sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol,
saddr, daddr, sport, dport, par->in, false); saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY);
if (sk != NULL) { if (sk != NULL) {
bool wildcard; bool wildcard;
bool transparent = true; bool transparent = true;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment