#ifndef _NF_TPROXY_H_
|
#define _NF_TPROXY_H_
|
|
#include <net/tcp.h>
|
|
enum nf_tproxy_lookup_t {
|
NF_TPROXY_LOOKUP_LISTENER,
|
NF_TPROXY_LOOKUP_ESTABLISHED,
|
};
|
|
static inline bool nf_tproxy_sk_is_transparent(struct sock *sk)
|
{
|
if (inet_sk_transparent(sk))
|
return true;
|
|
sock_gen_put(sk);
|
return false;
|
}
|
|
/* assign a socket to the skb -- consumes sk */
|
static inline void nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
|
{
|
skb_orphan(skb);
|
skb->sk = sk;
|
skb->destructor = sock_edemux;
|
}
|
|
__be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr);
|
|
/**
|
* nf_tproxy_handle_time_wait4 - handle IPv4 TCP TIME_WAIT reopen redirections
|
* @skb: The skb being processed.
|
* @laddr: IPv4 address to redirect to or zero.
|
* @lport: TCP port to redirect to or zero.
|
* @sk: The TIME_WAIT TCP socket found by the lookup.
|
*
|
* We have to handle SYN packets arriving to TIME_WAIT sockets
|
* differently: instead of reopening the connection we should rather
|
* redirect the new connection to the proxy if there's a listener
|
* socket present.
|
*
|
* nf_tproxy_handle_time_wait4() consumes the socket reference passed in.
|
*
|
* Returns the listener socket if there's one, the TIME_WAIT socket if
|
* no such listener is found, or NULL if the TCP header is incomplete.
|
*/
|
struct sock *
|
nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
|
__be32 laddr, __be16 lport, struct sock *sk);
|
|
/*
|
* This is used when the user wants to intercept a connection matching
|
* an explicit iptables rule. In this case the sockets are assumed
|
* matching in preference order:
|
*
|
* - match: if there's a fully established connection matching the
|
* _packet_ tuple, it is returned, assuming the redirection
|
* already took place and we process a packet belonging to an
|
* established connection
|
*
|
* - match: if there's a listening socket matching the redirection
|
* (e.g. on-port & on-ip of the connection), it is returned,
|
* regardless if it was bound to 0.0.0.0 or an explicit
|
* address. The reasoning is that if there's an explicit rule, it
|
* does not really matter if the listener is bound to an interface
|
* or to 0. The user already stated that he wants redirection
|
* (since he added the rule).
|
*
|
* Please note that there's an overlap between what a TPROXY target
|
* and a socket match will match. Normally if you have both rules the
|
* "socket" match will be the first one, effectively all packets
|
* belonging to established connections going through that one.
|
*/
|
struct sock *
|
nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
|
const u8 protocol,
|
const __be32 saddr, const __be32 daddr,
|
const __be16 sport, const __be16 dport,
|
const struct net_device *in,
|
const enum nf_tproxy_lookup_t lookup_type);
|
|
const struct in6_addr *
|
nf_tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
|
const struct in6_addr *daddr);
|
|
/**
|
* nf_tproxy_handle_time_wait6 - handle IPv6 TCP TIME_WAIT reopen redirections
|
* @skb: The skb being processed.
|
* @tproto: Transport protocol.
|
* @thoff: Transport protocol header offset.
|
* @net: Network namespace.
|
* @laddr: IPv6 address to redirect to.
|
* @lport: TCP port to redirect to or zero.
|
* @sk: The TIME_WAIT TCP socket found by the lookup.
|
*
|
* We have to handle SYN packets arriving to TIME_WAIT sockets
|
* differently: instead of reopening the connection we should rather
|
* redirect the new connection to the proxy if there's a listener
|
* socket present.
|
*
|
* nf_tproxy_handle_time_wait6() consumes the socket reference passed in.
|
*
|
* Returns the listener socket if there's one, the TIME_WAIT socket if
|
* no such listener is found, or NULL if the TCP header is incomplete.
|
*/
|
struct sock *
|
nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
|
struct net *net,
|
const struct in6_addr *laddr,
|
const __be16 lport,
|
struct sock *sk);
|
|
struct sock *
|
nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
|
const u8 protocol,
|
const struct in6_addr *saddr, const struct in6_addr *daddr,
|
const __be16 sport, const __be16 dport,
|
const struct net_device *in,
|
const enum nf_tproxy_lookup_t lookup_type);
|
|
#endif /* _NF_TPROXY_H_ */
|
