LXR linux/net/ipv4/netfilter/nf_defrag

   1/* (C) 1999-2001 Paul `Rusty' Russell
   2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3 *
   4 * This program is free software; you can redistribute it and/or modify
   5 * it under the terms of the GNU General Public License version 2 as
   6 * published by the Free Software Foundation.
   7 */
   8
   9#include <linux/types.h>
  10#include <linux/ip.h>
  11#include <linux/netfilter.h>
  12#include <linux/module.h>
  13#include <linux/skbuff.h>
  14#include <net/route.h>
  15#include <net/ip.h>
  16
  17#include <linux/netfilter_ipv4.h>
  18#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
  19
  20/* Returns new sk_buff, or NULL */
  21static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
  22{
  23        int err;
  24
  25        skb_orphan(skb);
  26
  27        local_bh_disable();
  28        err = ip_defrag(skb, user);
  29        local_bh_enable();
  30
  31        if (!err)
  32                ip_send_check(ip_hdr(skb));
  33
  34        return err;
  35}
  36
  37static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
  38                                          struct sk_buff *skb,
  39                                          const struct net_device *in,
  40                                          const struct net_device *out,
  41                                          int (*okfn)(struct sk_buff *))
  42{
  43#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
  44#if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
  45        /* Previously seen (loopback)?  Ignore.  Do this before
  46           fragment check. */
  47        if (skb->nfct)
  48                return NF_ACCEPT;
  49#endif
  50#endif
  51        /* Gather fragments. */
  52        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
  53                if (nf_ct_ipv4_gather_frags(skb,
  54                                            hooknum == NF_INET_PRE_ROUTING ?
  55                                            IP_DEFRAG_CONNTRACK_IN :
  56                                            IP_DEFRAG_CONNTRACK_OUT))
  57                        return NF_STOLEN;
  58        }
  59        return NF_ACCEPT;
  60}
  61
  62static struct nf_hook_ops ipv4_defrag_ops[] = {
  63        {
  64                .hook           = ipv4_conntrack_defrag,
  65                .owner          = THIS_MODULE,
  66                .pf             = PF_INET,
  67                .hooknum        = NF_INET_PRE_ROUTING,
  68                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
  69        },
  70        {
  71                .hook           = ipv4_conntrack_defrag,
  72                .owner          = THIS_MODULE,
  73                .pf             = PF_INET,
  74                .hooknum        = NF_INET_LOCAL_OUT,
  75                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
  76        },
  77};
  78
  79static int __init nf_defrag_init(void)
  80{
  81        return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
  82}
  83
  84static void __exit nf_defrag_fini(void)
  85{
  86        nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));
  87}
  88
  89void nf_defrag_ipv4_enable(void)
  90{
  91}
  92EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);
  93
  94module_init(nf_defrag_init);
  95module_exit(nf_defrag_fini);
  96
  97MODULE_LICENSE("GPL");
  98