1 /* (C) 1999-2001 Paul `Rusty' Russell
2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8 
9 #include <linux/types.h>
10 #include <linux/ip.h>
11 #include <linux/netfilter.h>
12 #include <linux/module.h>
13 #include <linux/skbuff.h>
14 #include <net/route.h>
15 #include <net/ip.h>
16 
17 #include <linux/netfilter_bridge.h>
18 #include <linux/netfilter_ipv4.h>
19 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
20 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
21 #include <net/netfilter/nf_conntrack.h>
22 #endif
23 #include <net/netfilter/nf_conntrack_zones.h>
24 
25 static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
26 {
27 	int err;
28 
29 	skb_orphan(skb);
30 
31 	local_bh_disable();
32 	err = ip_defrag(skb, user);
33 	local_bh_enable();
34 
35 	if (!err) {
36 		ip_send_check(ip_hdr(skb));
37 		skb->ignore_df = 1;
38 	}
39 
40 	return err;
41 }
42 
43 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
44 					      struct sk_buff *skb)
45 {
46 	u16 zone = NF_CT_DEFAULT_ZONE;
47 
48 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
49 	if (skb->nfct)
50 		zone = nf_ct_zone((struct nf_conn *)skb->nfct);
51 #endif
52 
53 #ifdef CONFIG_BRIDGE_NETFILTER
54 	if (skb->nf_bridge &&
55 	    skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
56 		return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
57 #endif
58 	if (hooknum == NF_INET_PRE_ROUTING)
59 		return IP_DEFRAG_CONNTRACK_IN + zone;
60 	else
61 		return IP_DEFRAG_CONNTRACK_OUT + zone;
62 }
63 
64 static unsigned int ipv4_conntrack_defrag(const struct nf_hook_ops *ops,
65 					  struct sk_buff *skb,
66 					  const struct net_device *in,
67 					  const struct net_device *out,
68 					  int (*okfn)(struct sk_buff *))
69 {
70 	struct sock *sk = skb->sk;
71 	struct inet_sock *inet = inet_sk(skb->sk);
72 
73 	if (sk && (sk->sk_family == PF_INET) &&
74 	    inet->nodefrag)
75 		return NF_ACCEPT;
76 
77 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
78 #if !IS_ENABLED(CONFIG_NF_NAT)
79 	/* Previously seen (loopback)?  Ignore.  Do this before
80 	   fragment check. */
81 	if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
82 		return NF_ACCEPT;
83 #endif
84 #endif
85 	/* Gather fragments. */
86 	if (ip_is_fragment(ip_hdr(skb))) {
87 		enum ip_defrag_users user =
88 			nf_ct_defrag_user(ops->hooknum, skb);
89 
90 		if (nf_ct_ipv4_gather_frags(skb, user))
91 			return NF_STOLEN;
92 	}
93 	return NF_ACCEPT;
94 }
95 
96 static struct nf_hook_ops ipv4_defrag_ops[] = {
97 	{
98 		.hook		= ipv4_conntrack_defrag,
99 		.owner		= THIS_MODULE,
100 		.pf		= NFPROTO_IPV4,
101 		.hooknum	= NF_INET_PRE_ROUTING,
102 		.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,
103 	},
104 	{
105 		.hook           = ipv4_conntrack_defrag,
106 		.owner          = THIS_MODULE,
107 		.pf             = NFPROTO_IPV4,
108 		.hooknum        = NF_INET_LOCAL_OUT,
109 		.priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
110 	},
111 };
112 
113 static int __init nf_defrag_init(void)
114 {
115 	return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
116 }
117 
118 static void __exit nf_defrag_fini(void)
119 {
120 	nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
121 }
122 
123 void nf_defrag_ipv4_enable(void)
124 {
125 }
126 EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);
127 
128 module_init(nf_defrag_init);
129 module_exit(nf_defrag_fini);
130 
131 MODULE_LICENSE("GPL");
132