From: KOVACS Krisztian <hidden@sch.bme.hu>
I appreciate the submission, but the 2.6.25 merge window is so far

away that I'm personally not really going to look seriously into any

non-trivial new work like this until we sort out all the regressions

we've already added this week for the 2.6.24 merge window :-)

-

Hi David,
Sure, definitely makes sense. I'll resend these once things have settled

down with 2.4.24.
--

 KOVACS Krisztian

-

Netfilter connection tracking requires all IPv4 packets to be defragmented.

Both the socket match and the TPROXY target depend on this functionality, so

this patch separates the Netfilter IPv4 defrag hooks into a separate module.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/net/netfilter/ipv4/nf_defrag_ipv4.h    |    6 ++

 net/ipv4/netfilter/Kconfig                     |    5 +

 net/ipv4/netfilter/Makefile                    |    3 +

 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |   55 +-------------

 net/ipv4/netfilter/nf_defrag_ipv4.c            |   94 ++++++++++++++++++++++++

 5 files changed, 110 insertions(+), 53 deletions(-)
diff --git a/include/net/netfilter/ipv4/nf_defrag_ipv4.h b/include/net/netfilter/ipv4/nf_defrag_ipv4.h

new file mode 100644

index 0000000..6b00ea3

--- /dev/null

+++ b/include/net/netfilter/ipv4/nf_defrag_ipv4.h

@@ -0,0 +1,6 @@

+#ifndef _NF_DEFRAG_IPV4_H

+#define _NF_DEFRAG_IPV4_H

+

+extern void nf_defrag_ipv4_enable(void);

+

+#endif /* _NF_DEFRAG_IPV4_H */

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig

index fa97947..c9108de 100644

--- a/net/ipv4/netfilter/Kconfig

+++ b/net/ipv4/netfilter/Kconfig

@@ -5,9 +5,14 @@

 menu "IP: Netfilter Configuration"

 	depends on INET && NETFILTER
+config NF_DEFRAG_IPV4

+	tristate

+	default n

+

 config NF_CONNTRACK_IPV4

 	tristate "IPv4 connection tracking support (required for NAT)"

 	depends on NF_CONNTRACK

+	select NF_DEFRAG_IPV4

 	---help---

 	  Connection tracking keeps a record of what packets have passed

 	  through your machine, in order to figure out how they are related

diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile

index 409d273..6504de5 100644

--- a/net/ipv4/netfilter/Makefile

+++ b/net/ipv4/netfilter/Makefile

@@ -18,6 +18,9 @@ obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
 obj-$(CONFIG_NF_NAT) += nf_nat.o
+# defrag

+obj-$(CONFIG_NF_DEFRAG_IPV4) += nf_defrag_ipv4.o

+

 # NAT helpers (nf_conn...
[ message continues ]

The iptables tproxy code has to be able to do UDP socket hash lookups,

so we have to provide an exported lookup function for this purpose.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/net/udp.h |    4 ++++

 net/ipv4/udp.c    |    8 ++++++++

 2 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/include/net/udp.h b/include/net/udp.h

index 98755eb..3efae7d 100644

--- a/include/net/udp.h

+++ b/include/net/udp.h

@@ -138,6 +138,10 @@ extern int 	udp_lib_setsockopt(struct sock *sk, int level, int optname,

 				   char __user *optval, int optlen,

 				   int (*push_pending_frames)(struct sock *));
+extern struct sock *udp4_lib_lookup(__be32 saddr, __be16 sport,

+				    __be32 daddr, __be16 dport,

+				    int dif);

+

 DECLARE_SNMP_STAT(struct udp_mib, udp_statistics);

 /*

  * 	SNMP statistics for UDP and UDP-Lite

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c

index cb9fc58..053d5c4 100644

--- a/net/ipv4/udp.c

+++ b/net/ipv4/udp.c

@@ -294,6 +294,14 @@ static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,

 	return result;

 }
+struct sock *udp4_lib_lookup(__be32 saddr, __be16 sport,

+			       __be32 daddr, __be16 dport,

+			       int dif)

+{

+	return __udp4_lib_lookup(saddr, sport, daddr, dport, dif, udp_hash);

+}

+EXPORT_SYMBOL_GPL(udp4_lib_lookup);

+

 static inline struct sock *udp_v4_mcast_next(struct sock *sk,

 					     __be16 loc_port, __be32 loc_addr,

 					     __be16 rmt_port, __be32 rmt_addr,
-

The iptables tproxy core is a module that contains the common routines used by

various tproxy related modules (TPROXY target and socket match)
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/net/netfilter/nf_tproxy_core.h |   32 +++++++++++

 net/netfilter/Kconfig                  |   13 ++++

 net/netfilter/Makefile                 |    3 +

 net/netfilter/nf_tproxy_core.c         |   96 ++++++++++++++++++++++++++++++++

 4 files changed, 144 insertions(+), 0 deletions(-)
diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h

new file mode 100644

index 0000000..2fac3ad

--- /dev/null

+++ b/include/net/netfilter/nf_tproxy_core.h

@@ -0,0 +1,32 @@

+#ifndef _NF_TPROXY_CORE_H

+#define _NF_TPROXY_CORE_H

+

+#include <linux/types.h>

+#include <linux/in.h>

+#include <linux/skbuff.h>

+#include <net/sock.h>

+#include <net/inet_sock.h>

+#include <net/tcp.h>

+

+/* look up and get a reference to a matching socket */

+extern struct sock *

+nf_tproxy_get_sock_v4(const u8 protocol,

+		      const __be32 saddr, const __be32 daddr,

+		      const __be16 sport, const __be16 dport,

+		      const struct net_device *in, bool listening);

+

+static inline void

+nf_tproxy_put_sock(struct sock *sk)

+{

+	/* TIME_WAIT inet sockets have to be handled differently */

+	if ((sk->sk_protocol == IPPROTO_TCP) && (sk->sk_state == TCP_TIME_WAIT))

+		inet_twsk_put(inet_twsk(sk));

+	else

+		sock_put(sk);

+}

+

+/* assign a socket to the skb -- consumes sk */

+int

+nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk);

+

+#endif

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig

index d7a600a..5bb4afb 100644

--- a/net/netfilter/Kconfig

+++ b/net/netfilter/Kconfig

@@ -257,6 +257,19 @@ config NF_CT_NETLINK

 	help

 	  This option enables support for a netlink-based userspace interface
+# transparent proxy support

+config NETFILTER_TPROXY

+	tristate "Transparent proxying sup...
[ message continues ]

Current TCP code relies on the local port of the listening socket

being the same as the destination address of the incoming

connection. Port redirection used by many transparent proxying

techniques obviously breaks this, so we have to store the original

destination port address.
This patch extends struct inet_request_sock and stores the incoming

destination port value there. It also modifies the handshake code to

use that value as the source port when sending reply packets.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/net/inet_sock.h         |    2 +-

 include/net/tcp.h               |    1 +

 net/ipv4/inet_connection_sock.c |    2 ++

 net/ipv4/syncookies.c           |    1 +

 net/ipv4/tcp_output.c           |    2 +-

 5 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h

index 517efe7..d7e2a52 100644

--- a/include/net/inet_sock.h

+++ b/include/net/inet_sock.h

@@ -61,8 +61,8 @@ struct inet_request_sock {

 	struct request_sock	req;

 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

 	u16			inet6_rsk_offset;

-	/* 2 bytes hole, try to pack */

 #endif

+	__be16			loc_port;

 	__be32			loc_addr;

 	__be32			rmt_addr;

 	__be16			rmt_port;

diff --git a/include/net/tcp.h b/include/net/tcp.h

index 92049e6..13bd06f 100644

--- a/include/net/tcp.h

+++ b/include/net/tcp.h

@@ -1006,6 +1006,7 @@ static inline void tcp_openreq_init(struct request_sock *req,

 	ireq->acked = 0;

 	ireq->ecn_ok = 0;

 	ireq->rmt_port = tcp_hdr(skb)->source;

+	ireq->loc_port = tcp_hdr(skb)->dest;

 }
 extern void tcp_enter_memory_pressure(void);

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c

index 1667cd8..eda765f 100644

--- a/net/ipv4/inet_connection_sock.c

+++ b/net/ipv4/inet_connection_sock.c

@@ -515,6 +515,8 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,

 		newicsk->icsk_bind_hash = NULL;
 		inet_sk(newsk)->dport = ...
[ message continues ]

Set FLOWI_FLAG_ANYSRC in flowi->flags if the socket has the

transparent socket option set. This way we selectively enable certain

connections with non-local source addresses to be routed.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/net/route.h |    4 ++++

 1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/include/net/route.h b/include/net/route.h

index 88fed3c..9788cc2 100644

--- a/include/net/route.h

+++ b/include/net/route.h

@@ -158,6 +158,10 @@ static inline int ip_route_connect(struct rtable **rp, __be32 dst,

 					 .dport = dport } } };
 	int err;

+

+	if (inet_sk(sk)->transparent)

+		fl.flags |= FLOWI_FLAG_ANYSRC;

+

 	if (!dst || !src) {

 		err = __ip_route_output_key(rp, &fl);

 		if (err)
-

The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to

incoming packets. The non-local source address check on output bites

us again, as replies for transparently redirected traffic won't have a

chance to leave the node.
This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing

the route lookup for those replies. Transparent replies are enabled if

the listening socket has the transparent socket flag set.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/net/inet_sock.h         |    8 +++++++-

 include/net/ip.h                |    9 +++++++++

 net/ipv4/inet_connection_sock.c |    1 +

 net/ipv4/ip_output.c            |    4 +++-

 net/ipv4/syncookies.c           |    1 +

 net/ipv4/tcp_ipv4.c             |   11 ++++++++---

 6 files changed, 29 insertions(+), 5 deletions(-)
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h

index e86832d..517efe7 100644

--- a/include/net/inet_sock.h

+++ b/include/net/inet_sock.h

@@ -72,7 +72,8 @@ struct inet_request_sock {

 				sack_ok	   : 1,

 				wscale_ok  : 1,

 				ecn_ok	   : 1,

-				acked	   : 1;

+				acked	   : 1,

+				no_srccheck: 1;

 	struct ip_options	*opt;

 };
@@ -191,4 +192,9 @@ static inline int inet_sk_ehashfn(const struct sock *sk)

 	return inet_ehashfn(laddr, lport, faddr, fport);

 }
+static inline __u8 inet_sk_flowi_flags(const struct sock *sk)

+{

+	return inet_sk(sk)->transparent ? FLOWI_FLAG_ANYSRC : 0;

+}

+

 #endif	/* _INET_SOCK_H */

diff --git a/include/net/ip.h b/include/net/ip.h

index 3af3ed9..5ea3813 100644

--- a/include/net/ip.h

+++ b/include/net/ip.h

@@ -29,6 +29,7 @@
 #include <net/inet_sock.h>

 #include <net/snmp.h>

+#include <net/flow.h>
 struct sock;
@@ -140,12 +141,20 @@ static inline void ip_tr_mc_map(__be32 addr, char *buf)
 struct ip_reply_arg {

 	struct kvec iov[1];

+	int	    flags;

 	__wsum 	    csum;

 	int	    csumoffset; /* u16 offset of csum in iov[0].iov_base */

 				/* -1 if not needed */ ...
[ message continues ]

Setting IP_TRANSPARENT is not really useful without allowing non-local

binds for the socket. To make user-space code simpler we allow these binds

even if IP_TRANSPARENT is set but IP_FREEBIND is not.
Signed-off-by: Tóth László Attila <panther@balabit.hu>

Acked-by: Patrick McHardy <kaber@trash.net>

---
 net/ipv4/af_inet.c |    2 +-

 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c

index 621b128..4049a74 100644

--- a/net/ipv4/af_inet.c

+++ b/net/ipv4/af_inet.c

@@ -451,7 +451,7 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)

 	 */

 	err = -EADDRNOTAVAIL;

 	if (!sysctl_ip_nonlocal_bind &&

-	    !inet->freebind &&

+	    !(inet->freebind || inet->transparent) &&

 	    addr->sin_addr.s_addr != INADDR_ANY &&

 	    chk_addr_ret != RTN_LOCAL &&

 	    chk_addr_ret != RTN_MULTICAST &&
-

This patch introduces the IP_TRANSPARENT socket option: enabling that will make

the IPv4 routing omit the non-local source address check on output. Setting

IP_TRANSPARENT requires NET_ADMIN capability.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

Acked-by: Patrick McHardy <kaber@trash.net>

---
 include/linux/in.h               |    1 +

 include/net/inet_sock.h          |    3 ++-

 include/net/inet_timewait_sock.h |    3 ++-

 include/net/route.h              |    1 +

 net/ipv4/inet_timewait_sock.c    |    1 +

 net/ipv4/ip_sockglue.c           |   12 +++++++++++-

 6 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/include/linux/in.h b/include/linux/in.h

index 3975cbf..d8c55ab 100644

--- a/include/linux/in.h

+++ b/include/linux/in.h

@@ -75,6 +75,7 @@ struct in_addr {

 #define IP_IPSEC_POLICY	16

 #define IP_XFRM_POLICY	17

 #define IP_PASSSEC	18

+#define IP_TRANSPARENT	19
 /* BSD compatibility */

 #define IP_RECVRETOPTS	IP_RETOPTS

diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h

index 62daf21..e86832d 100644

--- a/include/net/inet_sock.h

+++ b/include/net/inet_sock.h

@@ -128,7 +128,8 @@ struct inet_sock {

 				is_icsk:1,

 				freebind:1,

 				hdrincl:1,

-				mc_loop:1;

+				mc_loop:1,

+				transparent:1;

 	int			mc_index;

 	__be32			mc_addr;

 	struct ip_mc_socklist	*mc_list;

diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h

index abaff05..6cf717f 100644

--- a/include/net/inet_timewait_sock.h

+++ b/include/net/inet_timewait_sock.h

@@ -127,7 +127,8 @@ struct inet_timewait_sock {

 	__be16			tw_dport;

 	__u16			tw_num;

 	/* And these are ours. */

-	__u8			tw_ipv6only:1;

+	__u8			tw_ipv6only:1,

+				tw_transparent:1;

 	/* 15 bits hole, try to pack */

 	__u16			tw_ipv6_offset;

 	int			tw_timeout;

diff --git a/include/net/route.h b/include/net/route.h

index f7ce625..88fed3c 100644

--- a/include/net/route.h

+++ b/include/net/route.h

@@ -27,6 +27,7 @@

 #include <net/dst.h>

 #inclu...
[ message continues ]

ip_route_output() contains a check to make sure that no flows with

non-local source IP addresses are routed. This obviously makes using

such addresses impossible.
This patch introduces a flowi flag which makes omitting this check

possible. The new flag provides a way of handling transparent and

non-transparent connections differently.
Signed-off-by: Julian Anastasov <ja@ssi.bg>

Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

Acked-by: Patrick McHardy <kaber@trash.net>

---
 include/net/flow.h |    1 +

 net/ipv4/route.c   |   20 +++++++++++++-------

 2 files changed, 14 insertions(+), 7 deletions(-)
diff --git a/include/net/flow.h b/include/net/flow.h

index af59fa5..c734d50 100644

--- a/include/net/flow.h

+++ b/include/net/flow.h

@@ -49,6 +49,7 @@ struct flowi {

 	__u8	proto;

 	__u8	flags;

 #define FLOWI_FLAG_MULTIPATHOLDROUTE 0x01

+#define FLOWI_FLAG_ANYSRC 0x02

 	union {

 		struct {

 			__be16	sport;

diff --git a/net/ipv4/route.c b/net/ipv4/route.c

index 21b12de..6f7e4cb 100644

--- a/net/ipv4/route.c

+++ b/net/ipv4/route.c

@@ -2155,11 +2155,6 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)

 		    ZERONET(oldflp->fl4_src))

 			goto out;
-		/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */

-		dev_out = ip_dev_find(oldflp->fl4_src);

-		if (dev_out == NULL)

-			goto out;

-

 		/* I removed check for oif == dev_out->oif here.

 		   It was wrong for two reasons:

 		   1. ip_dev_find(saddr) can return wrong iface, if saddr is

@@ -2170,6 +2165,11 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
 		if (oldflp->oif == 0

 		    && (MULTICAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF))) {

+			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */

+			dev_out = ip_dev_find(oldflp->fl4_src);

+			if (dev_out == NULL)

+				goto out;

+

 			/* Special hack: user can direct multicasts

 			   and limited broadcast via neces...
[ message continues ]

Add basic usage instructions to Documentation/networking.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 Documentation/networking/tproxy.txt |   62 +++++++++++++++++++++++++++++++++++

 1 files changed, 62 insertions(+), 0 deletions(-)
diff --git a/Documentation/networking/tproxy.txt b/Documentation/networking/tproxy.txt

new file mode 100644

index 0000000..dfcb613

--- /dev/null

+++ b/Documentation/networking/tproxy.txt

@@ -0,0 +1,62 @@

+Transparent proxy support

+=========================

+

+This feature adds Linux 2.2-like transparent proxy support to current kernels.

+To use it, enable NETFILTER_TPROXY, the socket match and the TPROXY target in

+your kernel config. You will need policy routing too, so be sure to enable that

+as well.

+

+1. Making non-local sockets work

+================================

+

+The idea is that you identify packets with destination address matching a local

+socket your box, set the packet mark to a certain value, and then match on that

+value using policy routing to have those packets delivered locally:

+

+# iptables -t mangle -N DIVERT

+# iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

+# iptables -t mangle -A DIVERT -j MARK --set-mark 1

+# iptables -t mangle -A DIVERT -j ACCEPT

+

+# ip rule add fwmark 1 lookup 100

+# ip route add local 0.0.0.0/0 dev lo table 100

+

+Because of certain restrictions in the IPv4 routing output code you'll have to

+modify your application to allow it sending datagrams _from_ non-local IP

+addresses. All you have to do is to enable the (SOL_IP, IP_TRANSPARENT) socket

+option before calling bind:

+

+fd = socket(AF_INET, SOCK_STREAM, 0);

+/* - 8< -*/

+int value = 1;

+setsockopt(fd, SOL_IP, IP_TRANSPARENT, &value, sizeof(value));

+/* - 8< -*/

+name.sin_family = AF_INET;

+name.sin_port = htons(0xCAFE);

+name.sin_addr.s_addr = htonl(0xDEADBEEF);

+bind(fd, &name, sizeof(name));

+

+A trivial patch for netcat is available here:

+http://people.netfilter.org/hidden/tpr...
[ message continues ]

Use the socket cached in the TPROXY target if it's present.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 net/ipv4/udp.c |    8 ++++++++

 1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c

index 053d5c4..6592689 100644

--- a/net/ipv4/udp.c

+++ b/net/ipv4/udp.c

@@ -1158,6 +1158,14 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],

 	if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))

 		return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
+#if defined(CONFIG_NETFILTER_TPROXY) || defined(CONFIG_NETFILTER_TPROXY_MODULE)

+	if (unlikely(skb->sk)) {

+		/* steal reference */

+		sk = skb->sk;

+		skb->destructor = NULL;

+		skb->sk = NULL;

+	} else

+#endif

 	sk = __udp4_lib_lookup(saddr, uh->source, daddr, uh->dest,

 			       skb->dev->ifindex, udptable        );
-

Use the socket cached in the TPROXY target if it's present.
Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 net/ipv4/tcp_ipv4.c |    8 ++++++++

 1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c

index fb471b0..90ee2ca 100644

--- a/net/ipv4/tcp_ipv4.c

+++ b/net/ipv4/tcp_ipv4.c

@@ -1662,6 +1662,14 @@ int tcp_v4_rcv(struct sk_buff *skb)

 	TCP_SKB_CB(skb)->flags	 = iph->tos;

 	TCP_SKB_CB(skb)->sacked	 = 0;
+#if defined(CONFIG_NETFILTER_TPROXY) || defined(CONFIG_NETFILTER_TPROXY_MODULE)

+	if (unlikely(skb->sk)) {

+		/* steal reference */

+		sk = skb->sk;

+		skb->destructor = NULL;

+		skb->sk = NULL;

+	} else

+#endif

 	sk = __inet_lookup(&tcp_hashinfo, iph->saddr, th->source,

 			   iph->daddr, th->dest, inet_iif(skb));

 	if (!sk)
-

The TPROXY target implements redirection of non-local TCP/UDP traffic to local

sockets. Additionally, it's possible to manipulate the packet mark if and only

if a socket has been found. (We need this because we cannot use multiple

targets in the same iptables rule.)
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>

Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 include/linux/netfilter/xt_TPROXY.h |   14 ++++

 net/netfilter/Kconfig               |   14 ++++

 net/netfilter/Makefile              |    1

 net/netfilter/xt_TPROXY.c           |  113 +++++++++++++++++++++++++++++++++++

 4 files changed, 142 insertions(+), 0 deletions(-)
diff --git a/include/linux/netfilter/xt_TPROXY.h b/include/linux/netfilter/xt_TPROXY.h

new file mode 100644

index 0000000..152e8f9

--- /dev/null

+++ b/include/linux/netfilter/xt_TPROXY.h

@@ -0,0 +1,14 @@

+#ifndef _XT_TPROXY_H_target

+#define _XT_TPROXY_H_target

+

+/* TPROXY target is capable of marking the packet to perform

+ * redirection. We can get rid of that whenever we get support for

+ * mutliple targets in the same rule. */

+struct xt_tproxy_target_info {

+	u_int32_t mark_mask;

+	u_int32_t mark_value;

+	__be32 laddr;

+	__be16 lport;

+};

+

+#endif /* _XT_TPROXY_H_target */

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig

index 47976b5..c80f08a 100644

--- a/net/netfilter/Kconfig

+++ b/net/netfilter/Kconfig

@@ -366,6 +366,20 @@ config NETFILTER_XT_TARGET_NOTRACK

 	  If you want to compile it as a module, say M here and read

 	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+config NETFILTER_XT_TARGET_TPROXY

+	tristate '"TPROXY" target support (EXPERIMENTAL)'

+	depends on EXPERIMENTAL

+	depends on NETFILTER_TPROXY

+	depends on NETFILTER_XTABLES

+	select NF_DEFRAG_IPV4

+	help

+	  This option adds a `TPROXY' target, which is somewhat similar to

+	  REDIRECT.  It can only be used in the mangle table and is useful

+	  to redirect traffic to a transparent proxy.  It does _n...
[ message continues ]

Add iptables 'socket' match, which matches packets for which a TCP/UDP

socket lookup succeeds.
Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>

Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>

---
 net/netfilter/Kconfig     |   14 ++++++

 net/netfilter/Makefile    |    1

 net/netfilter/xt_socket.c |   99 +++++++++++++++++++++++++++++++++++++++++++++

 3 files changed, 114 insertions(+), 0 deletions(-)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig

index 5bb4afb..47976b5 100644

--- a/net/netfilter/Kconfig

+++ b/net/netfilter/Kconfig

@@ -635,6 +635,20 @@ config NETFILTER_XT_MATCH_SCTP

 	  If you want to compile it as a module, say M here and read

 	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+config NETFILTER_XT_MATCH_SOCKET

+	tristate '"socket" match support (EXPERIMENTAL)'

+	depends on EXPERIMENTAL

+	depends on NETFILTER_TPROXY

+	depends on NETFILTER_XTABLES

+	select NF_DEFRAG_IPV4

+	help

+	  This option adds a `socket' match, which can be used to match

+	  packets for which a TCP or UDP socket lookup finds a valid socket.

+	  It can be used in combination with the MARK target and policy

+	  routing to implement full featured non-locally bound sockets.

+

+	  To compile it as a module, choose M here.  If unsure, say N.

+

 config NETFILTER_XT_MATCH_STATE

 	tristate '"state" match support'

 	depends on NETFILTER_XTABLES

diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile

index 5066297..2303ef3 100644

--- a/net/netfilter/Makefile

+++ b/net/netfilter/Makefile

@@ -73,6 +73,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o

 obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o

 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o

 obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o

+obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o

 obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o

 obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o

 obj-$(CONFIG_NETFILTER_XT_MATCH_STRING)...
[ message continues ]