1 /* (C) 1999-2001 Paul `Rusty' Russell 2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9 #include <linux/types.h> 10 #include <linux/ip.h> 11 #include <linux/netfilter.h> 12 #include <linux/module.h> 13 #include <linux/skbuff.h> 14 #include <net/route.h> 15 #include <net/ip.h> 16 17 #include <linux/netfilter_bridge.h> 18 #include <linux/netfilter_ipv4.h> 19 #include <net/netfilter/ipv4/nf_defrag_ipv4.h> 20 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 21 #include <net/netfilter/nf_conntrack.h> 22 #endif 23 #include <net/netfilter/nf_conntrack_zones.h> 24 25 static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb, 26 u_int32_t user) 27 { 28 int err; 29 30 skb_orphan(skb); 31 32 local_bh_disable(); 33 err = ip_defrag(net, skb, user); 34 local_bh_enable(); 35 36 if (!err) { 37 ip_send_check(ip_hdr(skb)); 38 skb->ignore_df = 1; 39 } 40 41 return err; 42 } 43 44 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, 45 struct sk_buff *skb) 46 { 47 u16 zone_id = NF_CT_DEFAULT_ZONE_ID; 48 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 49 if (skb->nfct) { 50 enum ip_conntrack_info ctinfo; 51 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 52 53 zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo)); 54 } 55 #endif 56 if (nf_bridge_in_prerouting(skb)) 57 return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id; 58 59 if (hooknum == NF_INET_PRE_ROUTING) 60 return IP_DEFRAG_CONNTRACK_IN + zone_id; 61 else 62 return IP_DEFRAG_CONNTRACK_OUT + zone_id; 63 } 64 65 static unsigned int ipv4_conntrack_defrag(void *priv, 66 struct sk_buff *skb, 67 const struct nf_hook_state *state) 68 { 69 struct sock *sk = skb->sk; 70 71 if (sk && sk_fullsock(sk) && (sk->sk_family == PF_INET) && 72 inet_sk(sk)->nodefrag) 73 return NF_ACCEPT; 74 75 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 76 #if !IS_ENABLED(CONFIG_NF_NAT) 77 /* Previously seen (loopback)? Ignore. Do this before 78 fragment check. */ 79 if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct)) 80 return NF_ACCEPT; 81 #endif 82 #endif 83 /* Gather fragments. */ 84 if (ip_is_fragment(ip_hdr(skb))) { 85 enum ip_defrag_users user = 86 nf_ct_defrag_user(state->hook, skb); 87 88 if (nf_ct_ipv4_gather_frags(state->net, skb, user)) 89 return NF_STOLEN; 90 } 91 return NF_ACCEPT; 92 } 93 94 static struct nf_hook_ops ipv4_defrag_ops[] = { 95 { 96 .hook = ipv4_conntrack_defrag, 97 .pf = NFPROTO_IPV4, 98 .hooknum = NF_INET_PRE_ROUTING, 99 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 100 }, 101 { 102 .hook = ipv4_conntrack_defrag, 103 .pf = NFPROTO_IPV4, 104 .hooknum = NF_INET_LOCAL_OUT, 105 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 106 }, 107 }; 108 109 static int __init nf_defrag_init(void) 110 { 111 return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops)); 112 } 113 114 static void __exit nf_defrag_fini(void) 115 { 116 nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops)); 117 } 118 119 void nf_defrag_ipv4_enable(void) 120 { 121 } 122 EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable); 123 124 module_init(nf_defrag_init); 125 module_exit(nf_defrag_fini); 126 127 MODULE_LICENSE("GPL"); 128