Re: [PATCH/RFC 09/10] iptables TPROXY target

[Patrick McHardy <kaber@trash.net>]

KOVACS Krisztian wrote:

> diff --git a/net/ipv4/netfilter/ipt_TPROXY.c b/net/ipv4/netfilter/ipt_TPROXY.c
> new file mode 100644
> index 0000000..6f64717
> --- /dev/null
> +++ b/net/ipv4/netfilter/ipt_TPROXY.c

> +static unsigned int
> +target(struct sk_buff **pskb,
> +       const struct net_device *in,
> +       const struct net_device *out,
> +       unsigned int hooknum,
> +       const struct xt_target *target,
> +       const void *targinfo)
> +{
> +	const struct iphdr *iph = (*pskb)->nh.iph;
> +	unsigned int verdict = NF_ACCEPT;
> +	struct sk_buff *skb = *pskb;
> +	struct udphdr _hdr, *hp;
> +	struct sock *sk;
> +
> +	/* TCP/UDP only */
> +	if ((iph->protocol != IPPROTO_TCP) &&
> +	    (iph->protocol != IPPROTO_UDP))
> +		return NF_ACCEPT;
> +
> +	if (in == NULL)
> +		return NF_ACCEPT;
> +
> +	if ((skb->dst != NULL) || (skb->ip_tproxy == 1))
> +		return NF_ACCEPT;
> +
> +	hp = skb_header_pointer(*pskb, iph->ihl * 4, sizeof(_hdr), &_hdr);
> +	if (hp == NULL)
> +		return NF_DROP;
> +
> +	sk = ip_tproxy_get_sock(iph->protocol,
> +				iph->saddr, iph->daddr,
> +				hp->source, hp->dest, in);
> +	if (sk != NULL) {
> +		if (ip_tproxy_do_divert(skb, sk, 0, in) < 0)
> +			verdict = NF_DROP;
> +		sock_put(sk);

Missing time wait socket handling.

> +	}
> +
> +	return verdict;
> +}
> +
> +static int
> +checkentry(const char *tablename,
> +	   const void *e,
> +	   const struct xt_target *target,
> +           void *targinfo,
> +           unsigned int hook_mask)
> +{
> +	/* checks are now done by the x_tables core based on
> +	 * information specified in the ipt_target structure */
> +	return 1;
> +}

The function is optional, you can simply delete it.

> +
> +static struct ipt_target ipt_tproxy_reg = {
> +	.name		= "TPROXY",
> +	.target		= target,
> +	.targetsize	= sizeof(struct ipt_tproxy_target_info),
> +	.table		= "tproxy",
> +	.checkentry	= checkentry,
> +	.me		= THIS_MODULE,
> +};
> +
> +static int __init init(void)
> +{
> +	if (ipt_register_target(&ipt_tproxy_reg))
> +		return -EINVAL;

This should return the result of ipt_register_target.