src: Add tproxy support

This patch adds support for transparent proxy functionality which is
supported in ip, ip6 and inet tables.

The syntax is the following:
	tproxy [{|ip|ip6}] to {<ip address>|:<port>|<ip address>:<port>}

It looks for a socket listening on the specified address or port and
assigns it to the matching packet.

In an inet table, a packet matches for both families until address is
specified.
Network protocol family has to be specified **only** in inet tables if
address is specified.

As transparent proxy support is implemented for sockets with layer 4
information, a transport protocol header criterion has to be set in the
same rule. eg. 'meta l4proto tcp' or 'udp dport 4444'

Example ruleset:
	table ip x {
		chain y {
			type filter hook prerouting priority -150; policy accept;
			tcp dport ntp tproxy to 1.1.1.1
			udp dport ssh tproxy to :2222
		}
	}
	table ip6 x {
		chain y {
			type filter hook prerouting priority -150; policy accept;
			tcp dport ntp tproxy to [dead::beef]
			udp dport ssh tproxy to :2222
		}
	}
	table inet x {
		chain y {
			type filter hook prerouting priority -150; policy accept;
			tcp dport 321 tproxy to :ssh
			tcp dport 99 tproxy ip to 1.1.1.1:999
			udp dport 155 tproxy ip6 to [dead::beef]:smux
		}
	}

Signed-off-by: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 11 insertions, 0 deletions

diff --git a/include/statement.h b/include/statement.h
index 5a907aa4..7840e9d2 100644
--- a/include/statement.h
+++ b/include/statement.h
@@ -128,6 +128,15 @@ struct nat_stmt {
 extern struct stmt *nat_stmt_alloc(const struct location *loc,
 				   enum nft_nat_etypes type);
 
+struct tproxy_stmt {
+	struct expr	*addr;
+	struct expr	*port;
+	uint8_t		family;
+	uint8_t		table_family; /* only used for printing the rule */
+};
+
+extern struct stmt *tproxy_stmt_alloc(const struct location *loc);
+
 struct queue_stmt {
 	struct expr		*queue;
 	uint16_t		flags;
@@ -271,6 +280,7 @@ enum stmt_types {
 	STMT_LOG,
 	STMT_REJECT,
 	STMT_NAT,
+	STMT_TPROXY,
 	STMT_QUEUE,
 	STMT_CT,
 	STMT_SET,
@@ -337,6 +347,7 @@ struct stmt {
 		struct limit_stmt	limit;
 		struct reject_stmt	reject;
 		struct nat_stmt		nat;
+		struct tproxy_stmt	tproxy;
 		struct queue_stmt	queue;
 		struct quota_stmt	quota;
 		struct ct_stmt		ct;