1 /* (C) 1999-2001 Paul `Rusty' Russell 2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9 #include <linux/types.h> 10 #include <linux/ip.h> 11 #include <linux/netfilter.h> 12 #include <linux/module.h> 13 #include <linux/skbuff.h> 14 #include <net/route.h> 15 #include <net/ip.h> 16 17 #include <linux/netfilter_bridge.h> 18 #include <linux/netfilter_ipv4.h> 19 #include <net/netfilter/ipv4/nf_defrag_ipv4.h> 20 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 21 #include <net/netfilter/nf_conntrack.h> 22 #endif 23 #include <net/netfilter/nf_conntrack_zones.h> 24 25 static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user) 26 { 27 int err; 28 29 skb_orphan(skb); 30 31 local_bh_disable(); 32 err = ip_defrag(skb, user); 33 local_bh_enable(); 34 35 if (!err) { 36 ip_send_check(ip_hdr(skb)); 37 skb->ignore_df = 1; 38 } 39 40 return err; 41 } 42 43 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, 44 struct sk_buff *skb) 45 { 46 u16 zone = NF_CT_DEFAULT_ZONE; 47 48 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 49 if (skb->nfct) 50 zone = nf_ct_zone((struct nf_conn *)skb->nfct); 51 #endif 52 53 #ifdef CONFIG_BRIDGE_NETFILTER 54 if (skb->nf_bridge && 55 skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING) 56 return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone; 57 #endif 58 if (hooknum == NF_INET_PRE_ROUTING) 59 return IP_DEFRAG_CONNTRACK_IN + zone; 60 else 61 return IP_DEFRAG_CONNTRACK_OUT + zone; 62 } 63 64 static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops, 65 struct sk_buff *skb, 66 const struct net_device *in, 67 const struct net_device *out, 68 int (*okfn)(struct sk_buff *)) 69 { 70 struct sock *sk = skb->sk; 71 struct inet_sock *inet = inet_sk(skb->sk); 72 73 if (sk && (sk->sk_family == PF_INET) && 74 inet->nodefrag) 75 return NF_ACCEPT; 76 77 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 78 #if !IS_ENABLED(CONFIG_NF_NAT) 79 /* Previously seen (loopback)? Ignore. Do this before 80 fragment check. */ 81 if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct)) 82 return NF_ACCEPT; 83 #endif 84 #endif 85 /* Gather fragments. */ 86 if (ip_is_fragment(ip_hdr(skb))) { 87 enum ip_defrag_users user = 88 nf_ct_defrag_user(ops->hooknum, skb); 89 90 if (nf_ct_ipv4_gather_frags(skb, user)) 91 return NF_STOLEN; 92 } 93 return NF_ACCEPT; 94 } 95 96 static struct nf_hook_ops ipv4_defrag_ops[] = { 97 { 98 .hook = ipv4_conntrack_defrag, 99 .owner = THIS_MODULE, 100 .pf = NFPROTO_IPV4, 101 .hooknum = NF_INET_PRE_ROUTING, 102 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 103 }, 104 { 105 .hook = ipv4_conntrack_defrag, 106 .owner = THIS_MODULE, 107 .pf = NFPROTO_IPV4, 108 .hooknum = NF_INET_LOCAL_OUT, 109 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 110 }, 111 }; 112 113 static int __init nf_defrag_init(void) 114 { 115 return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops)); 116 } 117 118 static void __exit nf_defrag_fini(void) 119 { 120 nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops)); 121 } 122 123 void nf_defrag_ipv4_enable(void) 124 { 125 } 126 EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable); 127 128 module_init(nf_defrag_init); 129 module_exit(nf_defrag_fini); 130 131 MODULE_LICENSE("GPL"); 132