iptables目标TEE

最新推荐文章于 2024-01-11 17:44:32 发布

原创最新推荐文章于 2024-01-11 17:44:32 发布 · 1.6k 阅读

5 ·

CC 4.0 BY-SA版权

文章标签：

#网络 #运维 #linux

netfilter防火墙专栏收录该内容

75 篇文章

订阅专栏

本文详细介绍了iptables中的TEE目标选项，用于将特定源或目的地址的网络数据包重定向到另一个网关。在给定的拓扑中，通过配置iptables规则，实现了192.168.1.105与192.168.1.111之间的ICMP交互报文被重定向到192.168.1.114进行处理。同时，文章展示了TEE目标的内核模块、初始化函数、配置检查以及数据包复制过程，涉及到nf_dup_ipv4和nf_dup_ipv6。此外，还提到了设备事件监听，以应对设备状态变化时对出接口索引的影响。

TEE目标帮助信息如下。

# iptables -j TEE -h

TEE target options:
  --gateway IPADDR    Route packet via the gateway given by address
  --oif NAME          Include oif in route calculation

如下测试拓扑：

                               iptables
  |---------------|        |---------------|       |---------------|
  |               |        |               |       |               |
  | 192.168.1.105 |--------| 192.168.1.111 |-------| 192.168.1.114 | 
  |               |        |               |       |               |
  |---------------|        |---------------|       |---------------|

在主机192.168.1.111上配置如下的策略，将与192.168.1.105交互的icmp报文重定向到主机192.168.1.114。

# iptables -t mangle -A PREROUTING -s 192.168.1.105 -p icmp  -j TEE --gateway 192.168.1.114
# iptables -t mangle -A POSTROUTING -d 192.168.1.105 -p icmp  -j TEE --gateway 192.168.1.114
#
# iptables -t mangle -L -v -n
Chain PREROUTING (policy ACCEPT 603 packets, 138K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    8   672 TEE        icmp --  *      *       192.168.1.105        0.0.0.0/0            TEE gw:192.168.1.114

Chain POSTROUTING (policy ACCEPT 27 packets, 2884 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   12  1008 TEE        icmp --  *      *       0.0.0.0/0            192.168.1.105        TEE gw:192.168.1.114

在主机192.168.1.105执行ping操作。

# ping 192.168.1.111
PING 192.168.1.111 (192.168.1.111) 56(84) bytes of data.
64 bytes from 192.168.1.111: icmp_seq=1 ttl=64 time=0.164 ms
64 bytes from 192.168.1.111: icmp_seq=2 ttl=64 time=0.162 ms
^C
--- 192.168.1.111 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1026ms
rtt min/avg/max/mdev = 0.162/0.163/0.164/0.001 ms

在主机192.168.1.114执行tcpdump，可以看到主机1.105和1.111的icmp交互报文。

# tcpdump -i ens32 icmp 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens32, link-type EN10MB (Ethernet), capture size 262144 bytes
09:42:47.244221 IP 192.168.1.105 > 192.168.1.111: ICMP echo request, id 14, seq 1, length 64
09:42:47.244221 IP 192.168.1.111 > 192.168.1.105: ICMP echo reply, id 14, seq 1, length 64
09:42:48.269820 IP 192.168.1.105 > 192.168.1.111: ICMP echo request, id 14, seq 2, length 64
09:42:48.269820 IP 192.168.1.111 > 192.168.1.105: ICMP echo reply, id 14, seq 2, length 64
^C
4 packets captured
4 packets received by filter
0 packets dropped by kernel

TEE目标使用到如下的模块：

$ lsmod | grep nf
nf_dup_ipv6            16384  1 xt_TEE
nf_dup_ipv4            16384  1 xt_TEE

TEE目标

初始化函数tee_tg_init如下，其注册了命名空间结构，以及TEE目标结构tee_tg_reg。

static struct pernet_operations tee_net_ops = {
    .init = tee_net_init,
    .id   = &tee_net_id,
    .size = sizeof(struct tee_net),
};
static struct notifier_block tee_netdev_notifier = {
    .notifier_call = tee_netdev_event,
};
static int __init tee_tg_init(void)
{
    ret = register_pernet_subsys(&tee_net_ops);

    ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));

    ret = register_netdevice_notifier(&tee_netdev_notifier);

命名空间初始化时，初始化空间中TEE使用的链表priv_list，以及锁。

static int __net_init tee_net_init(struct net *net)
{
    struct tee_net *tn = net_generic(net, tee_net_id);

    INIT_LIST_HEAD(&tn->priv_list);
    mutex_init(&tn->lock);

目标结构tee_tg_reg定义如下，包括IPv4和IPv6两个部分。

static struct xt_target tee_tg_reg[] __read_mostly = {
    {
        .name       = "TEE",
        .revision   = 1,
        .family     = NFPROTO_IPV4,
        .target     = tee_tg4,
        .targetsize = sizeof(struct xt_tee_tginfo),
        .usersize   = offsetof(struct xt_tee_tginfo, priv),
        .checkentry = tee_tg_check,
        .destroy    = tee_tg_destroy,
        .me         = THIS_MODULE,
    },
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
    {
        .name       = "TEE",
        .revision   = 1,
        .family     = NFPROTO_IPV6,
        .target     = tee_tg6,
        .targetsize = sizeof(struct xt_tee_tginfo),
        .usersize   = offsetof(struct xt_tee_tginfo, priv),
        .checkentry = tee_tg_check,
        .destroy    = tee_tg_destroy,
        .me         = THIS_MODULE,
    },
#endif

配置检查函数如下，首先网关配置项–gateway的值不能为零。

static int tee_tg_check(const struct xt_tgchk_param *par)
{
    struct tee_net *tn = net_generic(par->net, tee_net_id);
    struct xt_tee_tginfo *info = par->targinfo;
    struct xt_tee_priv *priv;

    /* 0.0.0.0 and :: not allowed */
    if (memcmp(&info->gw, &tee_zero_address, sizeof(tee_zero_address)) == 0)
        return -EINVAL;

如果出接口为合法的字符串，分配TEE私有结构xt_tee_priv，根据接口名称找到接口索引，赋值与私有接口中，并将TEE私有接口连接到命名空间的TEE链表中priv_list。

    if (info->oif[0]) {
        if (info->oif[sizeof(info->oif)-1] != '\0')
            return -EINVAL;

        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
        priv->tginfo  = info;
        priv->oif     = -1;
        info->priv    = priv;
        dev = dev_get_by_name(par->net, info->oif);
        if (dev) {
            priv->oif = dev->ifindex;
            dev_put(dev);
        }
        mutex_lock(&tn->lock);
        list_add(&priv->list, &tn->priv_list);
        mutex_unlock(&tn->lock);
    } else
        info->priv = NULL;
    static_key_slow_inc(&xt_tee_enabled);

对于IPv4协议，使用nf_dup_ipv4复制数据包。对于IPv6协议，使用nf_dup_ipv6复制数据包。前提是出接口索引值有效。

static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{
    const struct xt_tee_tginfo *info = par->targinfo;
    int oif = info->priv ? info->priv->oif : 0;

    nf_dup_ipv4(xt_net(par), skb, xt_hooknum(par), &info->gw.in, oif);
    return XT_CONTINUE;
}
static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
    const struct xt_tee_tginfo *info = par->targinfo;
    int oif = info->priv ? info->priv->oif : 0;

    nf_dup_ipv6(xt_net(par), skb, xt_hooknum(par), &info->gw.in6, oif);
    return XT_CONTINUE;

设备事件

监听设备注册、撤销和修改名称等事件，更新出接口的索引值。

static int tee_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
    struct net_device *dev = netdev_notifier_info_to_dev(ptr);
    struct net *net = dev_net(dev);
    struct tee_net *tn = net_generic(net, tee_net_id);
    struct xt_tee_priv *priv;

    mutex_lock(&tn->lock);
    list_for_each_entry(priv, &tn->priv_list, list) {
        switch (event) {
        case NETDEV_REGISTER:
            if (!strcmp(dev->name, priv->tginfo->oif))
                priv->oif = dev->ifindex;
            break;
        case NETDEV_UNREGISTER:
            if (dev->ifindex == priv->oif)
                priv->oif = -1;
            break;
        case NETDEV_CHANGENAME:
            if (!strcmp(dev->name, priv->tginfo->oif))
                priv->oif = dev->ifindex;
            else if (dev->ifindex == priv->oif)
                priv->oif = -1;

内核版本 5.10