1/* (C) 1999-2001 Paul `Rusty' Russell 2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9#include <linux/types.h> 10#include <linux/ip.h> 11#include <linux/netfilter.h> 12#include <linux/module.h> 13#include <linux/skbuff.h> 14#include <net/route.h> 15#include <net/ip.h> 16 17#include <linux/netfilter_bridge.h> 18#include <linux/netfilter_ipv4.h> 19#include <net/netfilter/ipv4/nf_defrag_ipv4.h> 20#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 21#include <net/netfilter/nf_conntrack.h> 22#endif 23#include <net/netfilter/nf_conntrack_zones.h> 24 25/* Returns new sk_buff, or NULL */ 26static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user) 27{ 28 int err; 29 30 skb_orphan(skb); 31 32 local_bh_disable(); 33 err = ip_defrag(skb, user); 34 local_bh_enable(); 35 36 if (!err) 37 ip_send_check(ip_hdr(skb)); 38 39 return err; 40} 41 42static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, 43 struct sk_buff *skb) 44{ 45 u16 zone = NF_CT_DEFAULT_ZONE; 46 47#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 48 if (skb->nfct) 49 zone = nf_ct_zone((struct nf_conn *)skb->nfct); 50#endif 51 52#ifdef CONFIG_BRIDGE_NETFILTER 53 if (skb->nf_bridge && 54 skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING) 55 return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone; 56#endif 57 if (hooknum == NF_INET_PRE_ROUTING) 58 return IP_DEFRAG_CONNTRACK_IN + zone; 59 else 60 return IP_DEFRAG_CONNTRACK_OUT + zone; 61} 62 63static unsigned int ipv4_conntrack_defrag(unsigned int hooknum, 64 struct sk_buff *skb, 65 const struct net_device *in, 66 const struct net_device *out, 67 int (*okfn)(struct sk_buff *)) 68{ 69 struct sock *sk = skb->sk; 70 struct inet_sock *inet = inet_sk(skb->sk); 71 72 if (sk && (sk->sk_family == PF_INET) && 73 inet->nodefrag) 74 return NF_ACCEPT; 75 76#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 77#if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE) 78 /* Previously seen (loopback)? Ignore. Do this before 79 fragment check. */ 80 if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct)) 81 return NF_ACCEPT; 82#endif 83#endif 84 /* Gather fragments. */ 85 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 86 enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb); 87 if (nf_ct_ipv4_gather_frags(skb, user)) 88 return NF_STOLEN; 89 } 90 return NF_ACCEPT; 91} 92 93static struct nf_hook_ops ipv4_defrag_ops[] = { 94 { 95 .hook = ipv4_conntrack_defrag, 96 .owner = THIS_MODULE, 97 .pf = PF_INET, 98 .hooknum = NF_INET_PRE_ROUTING, 99 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 100 }, 101 { 102 .hook = ipv4_conntrack_defrag, 103 .owner = THIS_MODULE, 104 .pf = PF_INET, 105 .hooknum = NF_INET_LOCAL_OUT, 106 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 107 }, 108}; 109 110static int __init nf_defrag_init(void) 111{ 112 return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops)); 113} 114 115static void __exit nf_defrag_fini(void) 116{ 117 nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops)); 118} 119 120void nf_defrag_ipv4_enable(void) 121{ 122} 123EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable); 124 125module_init(nf_defrag_init); 126module_exit(nf_defrag_fini); 127 128MODULE_LICENSE("GPL"); 129