1 // SPDX-License-Identifier: GPL-2.0-only 2 /* (C) 1999-2001 Paul `Rusty' Russell 3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 4 */ 5 6 #include <linux/types.h> 7 #include <linux/ip.h> 8 #include <linux/netfilter.h> 9 #include <linux/module.h> 10 #include <linux/skbuff.h> 11 #include <net/netns/generic.h> 12 #include <net/route.h> 13 #include <net/ip.h> 14 15 #include <linux/netfilter_bridge.h> 16 #include <linux/netfilter_ipv4.h> 17 #include <net/netfilter/ipv4/nf_defrag_ipv4.h> 18 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 19 #include <net/netfilter/nf_conntrack.h> 20 #endif 21 #include <net/netfilter/nf_conntrack_zones.h> 22 23 static DEFINE_MUTEX(defrag4_mutex); 24 25 static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb, 26 u_int32_t user) 27 { 28 int err; 29 30 local_bh_disable(); 31 err = ip_defrag(net, skb, user); 32 local_bh_enable(); 33 34 if (!err) 35 skb->ignore_df = 1; 36 37 return err; 38 } 39 40 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, 41 struct sk_buff *skb) 42 { 43 u16 zone_id = NF_CT_DEFAULT_ZONE_ID; 44 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 45 if (skb_nfct(skb)) { 46 enum ip_conntrack_info ctinfo; 47 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 48 49 zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo)); 50 } 51 #endif 52 if (nf_bridge_in_prerouting(skb)) 53 return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id; 54 55 if (hooknum == NF_INET_PRE_ROUTING) 56 return IP_DEFRAG_CONNTRACK_IN + zone_id; 57 else 58 return IP_DEFRAG_CONNTRACK_OUT + zone_id; 59 } 60 61 static unsigned int ipv4_conntrack_defrag(void *priv, 62 struct sk_buff *skb, 63 const struct nf_hook_state *state) 64 { 65 struct sock *sk = skb->sk; 66 67 if (sk && sk_fullsock(sk) && (sk->sk_family == PF_INET) && 68 inet_sk(sk)->nodefrag) 69 return NF_ACCEPT; 70 71 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 72 #if !IS_ENABLED(CONFIG_NF_NAT) 73 /* Previously seen (loopback)? Ignore. Do this before 74 fragment check. */ 75 if (skb_nfct(skb) && !nf_ct_is_template((struct nf_conn *)skb_nfct(skb))) 76 return NF_ACCEPT; 77 #endif 78 if (skb->_nfct == IP_CT_UNTRACKED) 79 return NF_ACCEPT; 80 #endif 81 /* Gather fragments. */ 82 if (ip_is_fragment(ip_hdr(skb))) { 83 enum ip_defrag_users user = 84 nf_ct_defrag_user(state->hook, skb); 85 86 if (nf_ct_ipv4_gather_frags(state->net, skb, user)) 87 return NF_STOLEN; 88 } 89 return NF_ACCEPT; 90 } 91 92 static const struct nf_hook_ops ipv4_defrag_ops[] = { 93 { 94 .hook = ipv4_conntrack_defrag, 95 .pf = NFPROTO_IPV4, 96 .hooknum = NF_INET_PRE_ROUTING, 97 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 98 }, 99 { 100 .hook = ipv4_conntrack_defrag, 101 .pf = NFPROTO_IPV4, 102 .hooknum = NF_INET_LOCAL_OUT, 103 .priority = NF_IP_PRI_CONNTRACK_DEFRAG, 104 }, 105 }; 106 107 static void __net_exit defrag4_net_exit(struct net *net) 108 { 109 if (net->nf.defrag_ipv4) { 110 nf_unregister_net_hooks(net, ipv4_defrag_ops, 111 ARRAY_SIZE(ipv4_defrag_ops)); 112 net->nf.defrag_ipv4 = false; 113 } 114 } 115 116 static struct pernet_operations defrag4_net_ops = { 117 .exit = defrag4_net_exit, 118 }; 119 120 static int __init nf_defrag_init(void) 121 { 122 return register_pernet_subsys(&defrag4_net_ops); 123 } 124 125 static void __exit nf_defrag_fini(void) 126 { 127 unregister_pernet_subsys(&defrag4_net_ops); 128 } 129 130 int nf_defrag_ipv4_enable(struct net *net) 131 { 132 int err = 0; 133 134 might_sleep(); 135 136 if (net->nf.defrag_ipv4) 137 return 0; 138 139 mutex_lock(&defrag4_mutex); 140 if (net->nf.defrag_ipv4) 141 goto out_unlock; 142 143 err = nf_register_net_hooks(net, ipv4_defrag_ops, 144 ARRAY_SIZE(ipv4_defrag_ops)); 145 if (err == 0) 146 net->nf.defrag_ipv4 = true; 147 148 out_unlock: 149 mutex_unlock(&defrag4_mutex); 150 return err; 151 } 152 EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable); 153 154 module_init(nf_defrag_init); 155 module_exit(nf_defrag_fini); 156 157 MODULE_LICENSE("GPL"); 158