[deliverable/linux.git] / net / ipv4 / netfilter / nf_defrag_ipv4.c

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/route.h>
#include <net/ip.h>

#include <linux/netfilter_bridge.h>
#include <linux/netfilter_ipv4.h>
#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
#include <net/netfilter/nf_conntrack.h>
#endif
#include <net/netfilter/nf_conntrack_zones.h>

static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,
				   u_int32_t user)
{
	int err;

	local_bh_disable();
	err = ip_defrag(net, skb, user);
	local_bh_enable();

	if (!err)
		skb->ignore_df = 1;

	return err;
}

static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
					      struct sk_buff *skb)
{
	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
	if (skb->nfct) {
		enum ip_conntrack_info ctinfo;
		const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);

		zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
	}
#endif
	if (nf_bridge_in_prerouting(skb))
		return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;

	if (hooknum == NF_INET_PRE_ROUTING)
		return IP_DEFRAG_CONNTRACK_IN + zone_id;
	else
		return IP_DEFRAG_CONNTRACK_OUT + zone_id;
}

static unsigned int ipv4_conntrack_defrag(void *priv,
					  struct sk_buff *skb,
					  const struct nf_hook_state *state)
{
	struct sock *sk = skb->sk;

	if (sk && sk_fullsock(sk) && (sk->sk_family == PF_INET) &&
	    inet_sk(sk)->nodefrag)
		return NF_ACCEPT;

#if IS_ENABLED(CONFIG_NF_CONNTRACK)
#if !IS_ENABLED(CONFIG_NF_NAT)
	/* Previously seen (loopback)?  Ignore.  Do this before
	   fragment check. */
	if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
		return NF_ACCEPT;
#endif
#endif
	/* Gather fragments. */
	if (ip_is_fragment(ip_hdr(skb))) {
		enum ip_defrag_users user =
			nf_ct_defrag_user(state->hook, skb);

		if (nf_ct_ipv4_gather_frags(state->net, skb, user))
			return NF_STOLEN;
	}
	return NF_ACCEPT;
}

static struct nf_hook_ops ipv4_defrag_ops[] = {
	{
		.hook		= ipv4_conntrack_defrag,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_PRE_ROUTING,
		.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,
	},
	{
		.hook           = ipv4_conntrack_defrag,
		.pf             = NFPROTO_IPV4,
		.hooknum        = NF_INET_LOCAL_OUT,
		.priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
	},
};

static int __init nf_defrag_init(void)
{
	return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
}

static void __exit nf_defrag_fini(void)
{
	nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
}

void nf_defrag_ipv4_enable(void)
{
}
EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);

module_init(nf_defrag_init);
module_exit(nf_defrag_fini);

MODULE_LICENSE("GPL");
Commit	Line	Data
73e4022f KK	1	/* (C) 1999-2001 Paul `Rusty' Russell
	2	* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/types.h>
	10	#include <linux/ip.h>
	11	#include <linux/netfilter.h>
	12	#include <linux/module.h>
	13	#include <linux/skbuff.h>
	14	#include <net/route.h>
	15	#include <net/ip.h>
	16
8fa9ff68	17	#include <linux/netfilter_bridge.h>
73e4022f KK	18	#include <linux/netfilter_ipv4.h>
73e4022f KK	19	#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
24de3d37	20	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
76780373	21	#include <net/netfilter/nf_conntrack.h>
37ee3d5b PM	22	#endif
37ee3d5b PM	23	#include <net/netfilter/nf_conntrack_zones.h>
73e4022f	24
19bcf9f2 EB	25	static int nf_ct_ipv4_gather_frags(struct net net, struct sk_buff skb,
19bcf9f2 EB	26	u_int32_t user)
73e4022f KK	27	{
	28	int err;
	29
73e4022f	30	local_bh_disable();
19bcf9f2	31	err = ip_defrag(net, skb, user);
73e4022f KK	32	local_bh_enable();
73e4022f KK	33
5f547391	34	if (!err)
60ff7467	35	skb->ignore_df = 1;
73e4022f KK	36
	37	return err;
	38	}
	39
8fa9ff68 PM	40	static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
	41	struct sk_buff *skb)
	42	{
308ac914	43	u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
24de3d37	44	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
deedb590 DB	45	if (skb->nfct) {
	46	enum ip_conntrack_info ctinfo;
	47	const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
	48
	49	zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
	50	}
37ee3d5b	51	#endif
72b1e5e4	52	if (nf_bridge_in_prerouting(skb))
308ac914	53	return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
72b1e5e4	54
8fa9ff68	55	if (hooknum == NF_INET_PRE_ROUTING)
308ac914	56	return IP_DEFRAG_CONNTRACK_IN + zone_id;
8fa9ff68	57	else
308ac914	58	return IP_DEFRAG_CONNTRACK_OUT + zone_id;
8fa9ff68 PM	59	}
8fa9ff68 PM	60
06198b34	61	static unsigned int ipv4_conntrack_defrag(void *priv,
73e4022f	62	struct sk_buff *skb,
238e54c9	63	const struct nf_hook_state *state)
73e4022f	64	{
cbdd769a	65	struct sock *sk = skb->sk;
7b2ff18e	66
f668f5f7 ED	67	if (sk && sk_fullsock(sk) && (sk->sk_family == PF_INET) &&
f668f5f7 ED	68	inet_sk(sk)->nodefrag)
7b2ff18e JO	69	return NF_ACCEPT;
7b2ff18e JO	70
24de3d37 DJ	71	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
24de3d37 DJ	72	#if !IS_ENABLED(CONFIG_NF_NAT)
73e4022f KK	73	/* Previously seen (loopback)? Ignore. Do this before
73e4022f KK	74	fragment check. */
b2a15a60	75	if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
73e4022f KK	76	return NF_ACCEPT;
73e4022f KK	77	#endif
38f7ac3e	78	#endif
73e4022f	79	/* Gather fragments. */
56f8a75c	80	if (ip_is_fragment(ip_hdr(skb))) {
795aa6ef	81	enum ip_defrag_users user =
082a758f	82	nf_ct_defrag_user(state->hook, skb);
795aa6ef	83
19bcf9f2	84	if (nf_ct_ipv4_gather_frags(state->net, skb, user))
73e4022f KK	85	return NF_STOLEN;
	86	}
	87	return NF_ACCEPT;
	88	}
	89
	90	static struct nf_hook_ops ipv4_defrag_ops[] = {
	91	{
	92	.hook = ipv4_conntrack_defrag,
89a48e35	93	.pf = NFPROTO_IPV4,
73e4022f KK	94	.hooknum = NF_INET_PRE_ROUTING,
	95	.priority = NF_IP_PRI_CONNTRACK_DEFRAG,
	96	},
	97	{
	98	.hook = ipv4_conntrack_defrag,
89a48e35	99	.pf = NFPROTO_IPV4,
73e4022f KK	100	.hooknum = NF_INET_LOCAL_OUT,
	101	.priority = NF_IP_PRI_CONNTRACK_DEFRAG,
	102	},
	103	};
	104
	105	static int __init nf_defrag_init(void)
	106	{
	107	return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
	108	}
	109
	110	static void __exit nf_defrag_fini(void)
	111	{
	112	nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
	113	}
	114
	115	void nf_defrag_ipv4_enable(void)
	116	{
	117	}
	118	EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);
	119
	120	module_init(nf_defrag_init);
	121	module_exit(nf_defrag_fini);
	122
	123	MODULE_LICENSE("GPL");