1 /* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9 #include <linux/types.h>
10 #include <linux/ipv6.h>
11 #include <linux/in6.h>
12 #include <linux/netfilter.h>
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/icmp.h>
16 #include <linux/sysctl.h>
17 #include <net/ipv6_frag.h>
18
19 #include <linux/netfilter_ipv6.h>
20 #include <linux/netfilter_bridge.h>
21 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
22 #include <net/netfilter/nf_conntrack.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
24 #include <net/netfilter/nf_conntrack_l4proto.h>
25 #include <net/netfilter/nf_conntrack_core.h>
26 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
27 #endif
28 #include <net/netfilter/nf_conntrack_zones.h>
29 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
30
31 static DEFINE_MUTEX(defrag6_mutex);
32
nf_ct6_defrag_user(unsigned int hooknum,struct sk_buff * skb)33 static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
34 struct sk_buff *skb)
35 {
36 u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
37 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
38 if (skb_nfct(skb)) {
39 enum ip_conntrack_info ctinfo;
40 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
41
42 zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
43 }
44 #endif
45 if (nf_bridge_in_prerouting(skb))
46 return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
47
48 if (hooknum == NF_INET_PRE_ROUTING)
49 return IP6_DEFRAG_CONNTRACK_IN + zone_id;
50 else
51 return IP6_DEFRAG_CONNTRACK_OUT + zone_id;
52 }
53
ipv6_defrag(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)54 static unsigned int ipv6_defrag(void *priv,
55 struct sk_buff *skb,
56 const struct nf_hook_state *state)
57 {
58 int err;
59
60 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
61 /* Previously seen (loopback)? */
62 if (skb_nfct(skb) && !nf_ct_is_template((struct nf_conn *)skb_nfct(skb)))
63 return NF_ACCEPT;
64
65 if (skb->_nfct == IP_CT_UNTRACKED)
66 return NF_ACCEPT;
67 #endif
68
69 err = nf_ct_frag6_gather(state->net, skb,
70 nf_ct6_defrag_user(state->hook, skb));
71 /* queued */
72 if (err == -EINPROGRESS)
73 return NF_STOLEN;
74
75 return err == 0 ? NF_ACCEPT : NF_DROP;
76 }
77
78 static const struct nf_hook_ops ipv6_defrag_ops[] = {
79 {
80 .hook = ipv6_defrag,
81 .pf = NFPROTO_IPV6,
82 .hooknum = NF_INET_PRE_ROUTING,
83 .priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
84 },
85 {
86 .hook = ipv6_defrag,
87 .pf = NFPROTO_IPV6,
88 .hooknum = NF_INET_LOCAL_OUT,
89 .priority = NF_IP6_PRI_CONNTRACK_DEFRAG,
90 },
91 };
92
defrag6_net_exit(struct net * net)93 static void __net_exit defrag6_net_exit(struct net *net)
94 {
95 if (net->nf.defrag_ipv6) {
96 nf_unregister_net_hooks(net, ipv6_defrag_ops,
97 ARRAY_SIZE(ipv6_defrag_ops));
98 net->nf.defrag_ipv6 = false;
99 }
100 }
101
102 static struct pernet_operations defrag6_net_ops = {
103 .exit = defrag6_net_exit,
104 };
105
nf_defrag_init(void)106 static int __init nf_defrag_init(void)
107 {
108 int ret = 0;
109
110 ret = nf_ct_frag6_init();
111 if (ret < 0) {
112 pr_err("nf_defrag_ipv6: can't initialize frag6.\n");
113 return ret;
114 }
115 ret = register_pernet_subsys(&defrag6_net_ops);
116 if (ret < 0) {
117 pr_err("nf_defrag_ipv6: can't register pernet ops\n");
118 goto cleanup_frag6;
119 }
120 return ret;
121
122 cleanup_frag6:
123 nf_ct_frag6_cleanup();
124 return ret;
125
126 }
127
nf_defrag_fini(void)128 static void __exit nf_defrag_fini(void)
129 {
130 unregister_pernet_subsys(&defrag6_net_ops);
131 nf_ct_frag6_cleanup();
132 }
133
nf_defrag_ipv6_enable(struct net * net)134 int nf_defrag_ipv6_enable(struct net *net)
135 {
136 int err = 0;
137
138 might_sleep();
139
140 if (net->nf.defrag_ipv6)
141 return 0;
142
143 mutex_lock(&defrag6_mutex);
144 if (net->nf.defrag_ipv6)
145 goto out_unlock;
146
147 err = nf_register_net_hooks(net, ipv6_defrag_ops,
148 ARRAY_SIZE(ipv6_defrag_ops));
149 if (err == 0)
150 net->nf.defrag_ipv6 = true;
151
152 out_unlock:
153 mutex_unlock(&defrag6_mutex);
154 return err;
155 }
156 EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable);
157
158 module_init(nf_defrag_init);
159 module_exit(nf_defrag_fini);
160
161 MODULE_LICENSE("GPL");
162
