1 // SPDX-License-Identifier: GPL-2.0-only 2 /* (C) 1999-2001 Paul `Rusty' Russell 3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> 4 */ 5 6 #include <linux/types.h> 7 #include <linux/ipv6.h> 8 #include <linux/in6.h> 9 #include <linux/netfilter.h> 10 #include <linux/module.h> 11 #include <linux/skbuff.h> 12 #include <linux/icmp.h> 13 #include <linux/rcupdate.h> 14 #include <linux/sysctl.h> 15 #include <net/ipv6_frag.h> 16 17 #include <linux/netfilter_ipv6.h> 18 #include <linux/netfilter_bridge.h> 19 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 20 #include <net/netfilter/nf_conntrack.h> 21 #include <net/netfilter/nf_conntrack_helper.h> 22 #include <net/netfilter/nf_conntrack_l4proto.h> 23 #include <net/netfilter/nf_conntrack_core.h> 24 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> 25 #endif 26 #include <net/netfilter/nf_conntrack_zones.h> 27 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 28 29 static DEFINE_MUTEX(defrag6_mutex); 30 31 static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, 32 struct sk_buff *skb) 33 { 34 u16 zone_id = NF_CT_DEFAULT_ZONE_ID; 35 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 36 if (skb_nfct(skb)) { 37 enum ip_conntrack_info ctinfo; 38 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 39 40 zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo)); 41 } 42 #endif 43 if (nf_bridge_in_prerouting(skb)) 44 return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id; 45 46 if (hooknum == NF_INET_PRE_ROUTING) 47 return IP6_DEFRAG_CONNTRACK_IN + zone_id; 48 else 49 return IP6_DEFRAG_CONNTRACK_OUT + zone_id; 50 } 51 52 static unsigned int ipv6_defrag(void *priv, 53 struct sk_buff *skb, 54 const struct nf_hook_state *state) 55 { 56 int err; 57 58 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 59 /* Previously seen (loopback)? */ 60 if (skb_nfct(skb) && !nf_ct_is_template((struct nf_conn *)skb_nfct(skb))) 61 return NF_ACCEPT; 62 63 if (skb->_nfct == IP_CT_UNTRACKED) 64 return NF_ACCEPT; 65 #endif 66 67 err = nf_ct_frag6_gather(state->net, skb, 68 nf_ct6_defrag_user(state->hook, skb)); 69 /* queued */ 70 if (err == -EINPROGRESS) 71 return NF_STOLEN; 72 73 return err == 0 ? NF_ACCEPT : NF_DROP; 74 } 75 76 static const struct nf_hook_ops ipv6_defrag_ops[] = { 77 { 78 .hook = ipv6_defrag, 79 .pf = NFPROTO_IPV6, 80 .hooknum = NF_INET_PRE_ROUTING, 81 .priority = NF_IP6_PRI_CONNTRACK_DEFRAG, 82 }, 83 { 84 .hook = ipv6_defrag, 85 .pf = NFPROTO_IPV6, 86 .hooknum = NF_INET_LOCAL_OUT, 87 .priority = NF_IP6_PRI_CONNTRACK_DEFRAG, 88 }, 89 }; 90 91 static void __net_exit defrag6_net_exit(struct net *net) 92 { 93 if (net->nf.defrag_ipv6_users) { 94 nf_unregister_net_hooks(net, ipv6_defrag_ops, 95 ARRAY_SIZE(ipv6_defrag_ops)); 96 net->nf.defrag_ipv6_users = 0; 97 } 98 } 99 100 static const struct nf_defrag_hook defrag_hook = { 101 .owner = THIS_MODULE, 102 .enable = nf_defrag_ipv6_enable, 103 .disable = nf_defrag_ipv6_disable, 104 }; 105 106 static struct pernet_operations defrag6_net_ops = { 107 .exit = defrag6_net_exit, 108 }; 109 110 static int __init nf_defrag_init(void) 111 { 112 int ret = 0; 113 114 ret = nf_ct_frag6_init(); 115 if (ret < 0) { 116 pr_err("nf_defrag_ipv6: can't initialize frag6.\n"); 117 return ret; 118 } 119 ret = register_pernet_subsys(&defrag6_net_ops); 120 if (ret < 0) { 121 pr_err("nf_defrag_ipv6: can't register pernet ops\n"); 122 goto cleanup_frag6; 123 } 124 125 rcu_assign_pointer(nf_defrag_v6_hook, &defrag_hook); 126 127 return ret; 128 129 cleanup_frag6: 130 nf_ct_frag6_cleanup(); 131 return ret; 132 133 } 134 135 static void __exit nf_defrag_fini(void) 136 { 137 rcu_assign_pointer(nf_defrag_v6_hook, NULL); 138 unregister_pernet_subsys(&defrag6_net_ops); 139 nf_ct_frag6_cleanup(); 140 } 141 142 int nf_defrag_ipv6_enable(struct net *net) 143 { 144 int err = 0; 145 146 mutex_lock(&defrag6_mutex); 147 if (net->nf.defrag_ipv6_users == UINT_MAX) { 148 err = -EOVERFLOW; 149 goto out_unlock; 150 } 151 152 if (net->nf.defrag_ipv6_users) { 153 net->nf.defrag_ipv6_users++; 154 goto out_unlock; 155 } 156 157 err = nf_register_net_hooks(net, ipv6_defrag_ops, 158 ARRAY_SIZE(ipv6_defrag_ops)); 159 if (err == 0) 160 net->nf.defrag_ipv6_users = 1; 161 162 out_unlock: 163 mutex_unlock(&defrag6_mutex); 164 return err; 165 } 166 EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable); 167 168 void nf_defrag_ipv6_disable(struct net *net) 169 { 170 mutex_lock(&defrag6_mutex); 171 if (net->nf.defrag_ipv6_users) { 172 net->nf.defrag_ipv6_users--; 173 if (net->nf.defrag_ipv6_users == 0) 174 nf_unregister_net_hooks(net, ipv6_defrag_ops, 175 ARRAY_SIZE(ipv6_defrag_ops)); 176 } 177 mutex_unlock(&defrag6_mutex); 178 } 179 EXPORT_SYMBOL_GPL(nf_defrag_ipv6_disable); 180 181 module_init(nf_defrag_init); 182 module_exit(nf_defrag_fini); 183 184 MODULE_LICENSE("GPL"); 185