iptables目标TEE

TEE目标帮助信息如下。

# iptables -j TEE -hTEE target options:--gateway IPADDR    Route packet via the gateway given by address--oif NAME          Include oif in route calculation

如下测试拓扑：

                               iptables|---------------|        |---------------|       |---------------||               |        |               |       |               || 192.168.1.105 |--------| 192.168.1.111 |-------| 192.168.1.114 | |               |        |               |       |               ||---------------|        |---------------|       |---------------|

在主机192.168.1.111上配置如下的策略，将与192.168.1.105交互的icmp报文重定向到主机192.168.1.114。

# iptables -t mangle -A PREROUTING -s 192.168.1.105 -p icmp  -j TEE --gateway 192.168.1.114
# iptables -t mangle -A POSTROUTING -d 192.168.1.105 -p icmp  -j TEE --gateway 192.168.1.114
#
# iptables -t mangle -L -v -n
Chain PREROUTING (policy ACCEPT 603 packets, 138K bytes)pkts bytes target     prot opt in     out     source               destination         8   672 TEE        icmp --  *      *       192.168.1.105        0.0.0.0/0            TEE gw:192.168.1.114Chain POSTROUTING (policy ACCEPT 27 packets, 2884 bytes)pkts bytes target     prot opt in     out     source               destination         12  1008 TEE        icmp --  *      *       0.0.0.0/0            192.168.1.105        TEE gw:192.168.1.114

在主机192.168.1.105执行ping操作。

# ping 192.168.1.111
PING 192.168.1.111 (192.168.1.111) 56(84) bytes of data.
64 bytes from 192.168.1.111: icmp_seq=1 ttl=64 time=0.164 ms
64 bytes from 192.168.1.111: icmp_seq=2 ttl=64 time=0.162 ms
^C
--- 192.168.1.111 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1026ms
rtt min/avg/max/mdev = 0.162/0.163/0.164/0.001 ms

在主机192.168.1.114执行tcpdump，可以看到主机1.105和1.111的icmp交互报文。

# tcpdump -i ens32 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens32, link-type EN10MB (Ethernet), capture size 262144 bytes
09:42:47.244221 IP 192.168.1.105 > 192.168.1.111: ICMP echo request, id 14, seq 1, length 64
09:42:47.244221 IP 192.168.1.111 > 192.168.1.105: ICMP echo reply, id 14, seq 1, length 64
09:42:48.269820 IP 192.168.1.105 > 192.168.1.111: ICMP echo request, id 14, seq 2, length 64
09:42:48.269820 IP 192.168.1.111 > 192.168.1.105: ICMP echo reply, id 14, seq 2, length 64
^C
4 packets captured
4 packets received by filter
0 packets dropped by kernel

TEE目标使用到如下的模块：

$ lsmod | grep nf
nf_dup_ipv6            16384  1 xt_TEE
nf_dup_ipv4            16384  1 xt_TEE

TEE目标

初始化函数tee_tg_init如下，其注册了命名空间结构，以及TEE目标结构tee_tg_reg。

static struct pernet_operations tee_net_ops = {.init = tee_net_init,.id   = &tee_net_id,.size = sizeof(struct tee_net),
};
static struct notifier_block tee_netdev_notifier = {.notifier_call = tee_netdev_event,
};
static int __init tee_tg_init(void)
{ret = register_pernet_subsys(&tee_net_ops);ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));ret = register_netdevice_notifier(&tee_netdev_notifier);

命名空间初始化时，初始化空间中TEE使用的链表priv_list，以及锁。

static int __net_init tee_net_init(struct net *net)
{struct tee_net *tn = net_generic(net, tee_net_id);INIT_LIST_HEAD(&tn->priv_list);mutex_init(&tn->lock);

目标结构tee_tg_reg定义如下，包括IPv4和IPv6两个部分。

static struct xt_target tee_tg_reg[] __read_mostly = {{.name       = "TEE",.revision   = 1,.family     = NFPROTO_IPV4,.target     = tee_tg4,.targetsize = sizeof(struct xt_tee_tginfo),.usersize   = offsetof(struct xt_tee_tginfo, priv),.checkentry = tee_tg_check,.destroy    = tee_tg_destroy,.me         = THIS_MODULE,},
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES){.name       = "TEE",.revision   = 1,.family     = NFPROTO_IPV6,.target     = tee_tg6,.targetsize = sizeof(struct xt_tee_tginfo),.usersize   = offsetof(struct xt_tee_tginfo, priv),.checkentry = tee_tg_check,.destroy    = tee_tg_destroy,.me         = THIS_MODULE,},
#endif

配置检查函数如下，首先网关配置项–gateway的值不能为零。

static int tee_tg_check(const struct xt_tgchk_param *par)
{struct tee_net *tn = net_generic(par->net, tee_net_id);struct xt_tee_tginfo *info = par->targinfo;struct xt_tee_priv *priv;/* 0.0.0.0 and :: not allowed */if (memcmp(&info->gw, &tee_zero_address, sizeof(tee_zero_address)) == 0)return -EINVAL;

如果出接口为合法的字符串，分配TEE私有结构xt_tee_priv，根据接口名称找到接口索引，赋值与私有接口中，并将TEE私有接口连接到命名空间的TEE链表中priv_list。

    if (info->oif[0]) {if (info->oif[sizeof(info->oif)-1] != '\0')return -EINVAL;priv = kzalloc(sizeof(*priv), GFP_KERNEL);priv->tginfo  = info;priv->oif     = -1;info->priv    = priv;dev = dev_get_by_name(par->net, info->oif);if (dev) {priv->oif = dev->ifindex;dev_put(dev);}mutex_lock(&tn->lock);list_add(&priv->list, &tn->priv_list);mutex_unlock(&tn->lock);} elseinfo->priv = NULL;static_key_slow_inc(&xt_tee_enabled);

对于IPv4协议，使用nf_dup_ipv4复制数据包。对于IPv6协议，使用nf_dup_ipv6复制数据包。前提是出接口索引值有效。

static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{const struct xt_tee_tginfo *info = par->targinfo;int oif = info->priv ? info->priv->oif : 0;nf_dup_ipv4(xt_net(par), skb, xt_hooknum(par), &info->gw.in, oif);return XT_CONTINUE;
}
static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{const struct xt_tee_tginfo *info = par->targinfo;int oif = info->priv ? info->priv->oif : 0;nf_dup_ipv6(xt_net(par), skb, xt_hooknum(par), &info->gw.in6, oif);return XT_CONTINUE;

设备事件

监听设备注册、撤销和修改名称等事件，更新出接口的索引值。

static int tee_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
{struct net_device *dev = netdev_notifier_info_to_dev(ptr);struct net *net = dev_net(dev);struct tee_net *tn = net_generic(net, tee_net_id);struct xt_tee_priv *priv;mutex_lock(&tn->lock);list_for_each_entry(priv, &tn->priv_list, list) {switch (event) {case NETDEV_REGISTER:if (!strcmp(dev->name, priv->tginfo->oif))priv->oif = dev->ifindex;break;case NETDEV_UNREGISTER:if (dev->ifindex == priv->oif)priv->oif = -1;break;case NETDEV_CHANGENAME:if (!strcmp(dev->name, priv->tginfo->oif))priv->oif = dev->ifindex;else if (dev->ifindex == priv->oif)priv->oif = -1;

内核版本 5.10