~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/netfilter/nf_defrag_ipv4.c

Version: ~ [ linux-6.1-rc7 ] ~ [ linux-6.0.10 ] ~ [ linux-5.19.17 ] ~ [ linux-5.18.19 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.80 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.156 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.225 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.267 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.300 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.334 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* (C) 1999-2001 Paul `Rusty' Russell
  2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  */
  8 
  9 #include <linux/types.h>
 10 #include <linux/ip.h>
 11 #include <linux/netfilter.h>
 12 #include <linux/module.h>
 13 #include <linux/skbuff.h>
 14 #include <net/route.h>
 15 #include <net/ip.h>
 16 
 17 #include <linux/netfilter_bridge.h>
 18 #include <linux/netfilter_ipv4.h>
 19 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 20 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 21 #include <net/netfilter/nf_conntrack.h>
 22 #endif
 23 #include <net/netfilter/nf_conntrack_zones.h>
 24 
 25 static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,
 26                                    u_int32_t user)
 27 {
 28         int err;
 29 
 30         local_bh_disable();
 31         err = ip_defrag(net, skb, user);
 32         local_bh_enable();
 33 
 34         if (!err)
 35                 skb->ignore_df = 1;
 36 
 37         return err;
 38 }
 39 
 40 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
 41                                               struct sk_buff *skb)
 42 {
 43         u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 44 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 45         if (skb->nfct) {
 46                 enum ip_conntrack_info ctinfo;
 47                 const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 48 
 49                 zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
 50         }
 51 #endif
 52         if (nf_bridge_in_prerouting(skb))
 53                 return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
 54 
 55         if (hooknum == NF_INET_PRE_ROUTING)
 56                 return IP_DEFRAG_CONNTRACK_IN + zone_id;
 57         else
 58                 return IP_DEFRAG_CONNTRACK_OUT + zone_id;
 59 }
 60 
 61 static unsigned int ipv4_conntrack_defrag(void *priv,
 62                                           struct sk_buff *skb,
 63                                           const struct nf_hook_state *state)
 64 {
 65         struct sock *sk = skb->sk;
 66 
 67         if (sk && sk_fullsock(sk) && (sk->sk_family == PF_INET) &&
 68             inet_sk(sk)->nodefrag)
 69                 return NF_ACCEPT;
 70 
 71 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 72 #if !IS_ENABLED(CONFIG_NF_NAT)
 73         /* Previously seen (loopback)?  Ignore.  Do this before
 74            fragment check. */
 75         if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
 76                 return NF_ACCEPT;
 77 #endif
 78 #endif
 79         /* Gather fragments. */
 80         if (ip_is_fragment(ip_hdr(skb))) {
 81                 enum ip_defrag_users user =
 82                         nf_ct_defrag_user(state->hook, skb);
 83 
 84                 if (nf_ct_ipv4_gather_frags(state->net, skb, user))
 85                         return NF_STOLEN;
 86         }
 87         return NF_ACCEPT;
 88 }
 89 
 90 static struct nf_hook_ops ipv4_defrag_ops[] = {
 91         {
 92                 .hook           = ipv4_conntrack_defrag,
 93                 .pf             = NFPROTO_IPV4,
 94                 .hooknum        = NF_INET_PRE_ROUTING,
 95                 .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 96         },
 97         {
 98                 .hook           = ipv4_conntrack_defrag,
 99                 .pf             = NFPROTO_IPV4,
100                 .hooknum        = NF_INET_LOCAL_OUT,
101                 .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
102         },
103 };
104 
105 static int __init nf_defrag_init(void)
106 {
107         return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
108 }
109 
110 static void __exit nf_defrag_fini(void)
111 {
112         nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
113 }
114 
115 void nf_defrag_ipv4_enable(void)
116 {
117 }
118 EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);
119 
120 module_init(nf_defrag_init);
121 module_exit(nf_defrag_fini);
122 
123 MODULE_LICENSE("GPL");
124 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp