cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

ip6t_SYNPROXY.c (3182B)

      1// SPDX-License-Identifier: GPL-2.0-only
      2/*
      3 * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
      4 */
      5
      6#include <linux/netfilter_ipv6/ip6_tables.h>
      7#include <linux/netfilter/x_tables.h>
      8#include <linux/netfilter/xt_SYNPROXY.h>
      9
     10#include <net/netfilter/nf_synproxy.h>
     11
     12static unsigned int
     13synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
     14{
     15	const struct xt_synproxy_info *info = par->targinfo;
     16	struct net *net = xt_net(par);
     17	struct synproxy_net *snet = synproxy_pernet(net);
     18	struct synproxy_options opts = {};
     19	struct tcphdr *th, _th;
     20
     21	if (nf_ip6_checksum(skb, xt_hooknum(par), par->thoff, IPPROTO_TCP))
     22		return NF_DROP;
     23
     24	th = skb_header_pointer(skb, par->thoff, sizeof(_th), &_th);
     25	if (th == NULL)
     26		return NF_DROP;
     27
     28	if (!synproxy_parse_options(skb, par->thoff, th, &opts))
     29		return NF_DROP;
     30
     31	if (th->syn && !(th->ack || th->fin || th->rst)) {
     32		/* Initial SYN from client */
     33		this_cpu_inc(snet->stats->syn_received);
     34
     35		if (th->ece && th->cwr)
     36			opts.options |= XT_SYNPROXY_OPT_ECN;
     37
     38		opts.options &= info->options;
     39		opts.mss_encode = opts.mss_option;
     40		opts.mss_option = info->mss;
     41		if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
     42			synproxy_init_timestamp_cookie(info, &opts);
     43		else
     44			opts.options &= ~(XT_SYNPROXY_OPT_WSCALE |
     45					  XT_SYNPROXY_OPT_SACK_PERM |
     46					  XT_SYNPROXY_OPT_ECN);
     47
     48		synproxy_send_client_synack_ipv6(net, skb, th, &opts);
     49		consume_skb(skb);
     50		return NF_STOLEN;
     51
     52	} else if (th->ack && !(th->fin || th->rst || th->syn)) {
     53		/* ACK from client */
     54		if (synproxy_recv_client_ack_ipv6(net, skb, th, &opts,
     55						  ntohl(th->seq))) {
     56			consume_skb(skb);
     57			return NF_STOLEN;
     58		} else {
     59			return NF_DROP;
     60		}
     61	}
     62
     63	return XT_CONTINUE;
     64}
     65
     66static int synproxy_tg6_check(const struct xt_tgchk_param *par)
     67{
     68	struct synproxy_net *snet = synproxy_pernet(par->net);
     69	const struct ip6t_entry *e = par->entryinfo;
     70	int err;
     71
     72	if (!(e->ipv6.flags & IP6T_F_PROTO) ||
     73	    e->ipv6.proto != IPPROTO_TCP ||
     74	    e->ipv6.invflags & XT_INV_PROTO)
     75		return -EINVAL;
     76
     77	err = nf_ct_netns_get(par->net, par->family);
     78	if (err)
     79		return err;
     80
     81	err = nf_synproxy_ipv6_init(snet, par->net);
     82	if (err) {
     83		nf_ct_netns_put(par->net, par->family);
     84		return err;
     85	}
     86
     87	return err;
     88}
     89
     90static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par)
     91{
     92	struct synproxy_net *snet = synproxy_pernet(par->net);
     93
     94	nf_synproxy_ipv6_fini(snet, par->net);
     95	nf_ct_netns_put(par->net, par->family);
     96}
     97
     98static struct xt_target synproxy_tg6_reg __read_mostly = {
     99	.name		= "SYNPROXY",
    100	.family		= NFPROTO_IPV6,
    101	.hooks		= (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
    102	.target		= synproxy_tg6,
    103	.targetsize	= sizeof(struct xt_synproxy_info),
    104	.checkentry	= synproxy_tg6_check,
    105	.destroy	= synproxy_tg6_destroy,
    106	.me		= THIS_MODULE,
    107};
    108
    109static int __init synproxy_tg6_init(void)
    110{
    111	return xt_register_target(&synproxy_tg6_reg);
    112}
    113
    114static void __exit synproxy_tg6_exit(void)
    115{
    116	xt_unregister_target(&synproxy_tg6_reg);
    117}
    118
    119module_init(synproxy_tg6_init);
    120module_exit(synproxy_tg6_exit);
    121
    122MODULE_LICENSE("GPL");
    123MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
    124MODULE_DESCRIPTION("Intercept IPv6 TCP connections and establish them using syncookies");