netfilter: defrag: only register defrag functionality if needed

nf_defrag modules for ipv4 and ipv6 export an empty stub function. Any module that needs the defragmentation hooks registered simply 'calls' this empty function to create a phony module dependency -- modprobe will then load the defrag module too. This extends netfilter ipv4/ipv6 defragmentation modules to delay the hook registration until the functionality is requested within a network namespace instead of module load time for all namespaces. Hooks are only un-registered on module unload or when a namespace that used such defrag functionality exits. We have to use struct net for this as the register hooks can be called before netns initialization here from the ipv4/ipv6 conntrack module init path. There is no unregister functionality support, defrag will always be active once it was requested inside a net namespace. The reason is that defrag has impact on nft and iptables rulesets (without defrag we might see framents).

Florian Westphal committed 10 years ago

Commit 834184b1 parent 481fa379 files · +136 −21Browse files

Unified · Split

9 files

include/net/netfilter/ipv4/nf_defrag_ipv4.h +2 −1
include/net/netfilter/ipv6/nf_defrag_ipv6.h +2 −1
include/net/netns/netfilter.h +6 −0
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +6 −1
net/ipv4/netfilter/nf_defrag_ipv4.c +38 −3
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +6 −1
net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +38 −4
net/netfilter/xt_TPROXY.c +10 −5
net/netfilter/xt_socket.c +28 −5

include/net/netfilter/ipv4/nf_defrag_ipv4.h+2−1

@@ -1,6 +1,7 @@
1	#ifndef _NF_DEFRAG_IPV4_H	1	#ifndef _NF_DEFRAG_IPV4_H
2	#define _NF_DEFRAG_IPV4_H	2	#define _NF_DEFRAG_IPV4_H
3		3
4	void nf_defrag_ipv4_enable(void);	4	struct net;
		5	int nf_defrag_ipv4_enable(struct net *);
5		6
6	#endif /* _NF_DEFRAG_IPV4_H */	7	#endif /* _NF_DEFRAG_IPV4_H */

include/net/netfilter/ipv6/nf_defrag_ipv6.h+2−1

@@ -1,7 +1,8 @@
1	#ifndef _NF_DEFRAG_IPV6_H	1	#ifndef _NF_DEFRAG_IPV6_H
2	#define _NF_DEFRAG_IPV6_H	2	#define _NF_DEFRAG_IPV6_H
3		3
4	void nf_defrag_ipv6_enable(void);	4	struct net;
		5	int nf_defrag_ipv6_enable(struct net *);
5		6
6	int nf_ct_frag6_init(void);	7	int nf_ct_frag6_init(void);
7	void nf_ct_frag6_cleanup(void);	8	void nf_ct_frag6_cleanup(void);

include/net/netns/netfilter.h+6−0

@@ -17,5 +17,11 @@ struct netns_nf { · 16 unmodified lines
17	struct ctl_table_header *nf_log_dir_header;	17	struct ctl_table_header *nf_log_dir_header;
18	#endif	18	#endif
19	struct nf_hook_entry __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];	19	struct nf_hook_entry __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
		20	#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
		21	bool defrag_ipv4;
		22	#endif
		23	#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
		24	bool defrag_ipv6;
		25	#endif
20	};	26	};
21	#endif	27	#endif

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c+6−1

 	if (cnet->users > 1)
 		goto out_unlock;
+	err = nf_defrag_ipv4_enable(net);
+	if (err) {
+		cnet->users = 0;
+		goto out_unlock;
+	}
 	err = nf_register_net_hooks(net, ipv4_conntrack_ops,
 				    ARRAY_SIZE(ipv4_conntrack_ops));
 	int ret = 0;
 	need_conntrack();
-	nf_defrag_ipv4_enable();
 	ret = nf_register_sockopt(&so_getorigdst);
 	if (ret < 0) {

net/ipv4/netfilter/nf_defrag_ipv4.c+38−3

@@ -11,6 +11,7 @@ · 10 unmodified lines
11	#include <linux/netfilter.h>	11	#include <linux/netfilter.h>
12	#include <linux/module.h>	12	#include <linux/module.h>
13	#include <linux/skbuff.h>	13	#include <linux/skbuff.h>
		14	#include <net/netns/generic.h>
14	#include <net/route.h>	15	#include <net/route.h>
15	#include <net/ip.h>	16	#include <net/ip.h>
16		17
@@ -22,6 +23,8 @@ · 5 unmodified lines
22	#endif	23	#endif
23	#include <net/netfilter/nf_conntrack_zones.h>	24	#include <net/netfilter/nf_conntrack_zones.h>
24		25
		26	static DEFINE_MUTEX(defrag4_mutex);
		27
25	static int nf_ct_ipv4_gather_frags(struct net net, struct sk_buff skb,	28	static int nf_ct_ipv4_gather_frags(struct net net, struct sk_buff skb,
26	u_int32_t user)	29	u_int32_t user)
27	{	30	{
@@ -102,18 +105,50 @@ static struct nf_hook_ops ipv4_defrag_ops[] = { · 74 unmodified lines
102	},	105	},
103	};	106	};
104		107
		108	static void __net_exit defrag4_net_exit(struct net *net)
		109	{
		110	if (net->nf.defrag_ipv4) {
		111	nf_unregister_net_hooks(net, ipv4_defrag_ops,
		112	ARRAY_SIZE(ipv4_defrag_ops));
		113	net->nf.defrag_ipv4 = false;
		114	}
		115	}
		116
		117	static struct pernet_operations defrag4_net_ops = {
		118	.exit = defrag4_net_exit,
		119	};
		120
105	static int __init nf_defrag_init(void)	121	static int __init nf_defrag_init(void)
106	{	122	{
107	return nf_register_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));	123	return register_pernet_subsys(&defrag4_net_ops);
108	}	124	}
109		125
110	static void __exit nf_defrag_fini(void)	126	static void __exit nf_defrag_fini(void)
111	{	127	{
112	nf_unregister_hooks(ipv4_defrag_ops, ARRAY_SIZE(ipv4_defrag_ops));	128	unregister_pernet_subsys(&defrag4_net_ops);
113	}	129	}
114		130
115	void nf_defrag_ipv4_enable(void)	131	int nf_defrag_ipv4_enable(struct net *net)
116	{	132	{
		133	int err = 0;
		134
		135	might_sleep();
		136
		137	if (net->nf.defrag_ipv4)
		138	return 0;
		139
		140	mutex_lock(&defrag4_mutex);
		141	if (net->nf.defrag_ipv4)
		142	goto out_unlock;
		143
		144	err = nf_register_net_hooks(net, ipv4_defrag_ops,
		145	ARRAY_SIZE(ipv4_defrag_ops));
		146	if (err == 0)
		147	net->nf.defrag_ipv4 = true;
		148
		149	out_unlock:
		150	mutex_unlock(&defrag4_mutex);
		151	return err;
117	}	152	}
118	EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);	153	EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable);
119		154

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c+6−1

 	if (cnet->users > 1)
 		goto out_unlock;
+	err = nf_defrag_ipv6_enable(net);
+	if (err < 0) {
+		cnet->users = 0;
+		goto out_unlock;
+	}
 	err = nf_register_net_hooks(net, ipv6_conntrack_ops,
 				    ARRAY_SIZE(ipv6_conntrack_ops));
 	if (err)
 	int ret = 0;
 	need_conntrack();
-	nf_defrag_ipv6_enable();
 	ret = nf_register_sockopt(&so_getorigdst6);
 	if (ret < 0) {

net/ipv6/netfilter/nf_defrag_ipv6_hooks.c+38−4

@@ -30,6 +30,8 @@ · 29 unmodified lines
30	#include <net/netfilter/nf_conntrack_zones.h>	30	#include <net/netfilter/nf_conntrack_zones.h>
31	#include <net/netfilter/ipv6/nf_defrag_ipv6.h>	31	#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
32		32
		33	static DEFINE_MUTEX(defrag6_mutex);
		34
33	static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,	35	static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
34	struct sk_buff *skb)	36	struct sk_buff *skb)
35	{	37	{
@@ -87,6 +89,19 @@ static struct nf_hook_ops ipv6_defrag_ops[] = { · 51 unmodified lines
87	},	89	},
88	};	90	};
89		91
		92	static void __net_exit defrag6_net_exit(struct net *net)
		93	{
		94	if (net->nf.defrag_ipv6) {
		95	nf_unregister_net_hooks(net, ipv6_defrag_ops,
		96	ARRAY_SIZE(ipv6_defrag_ops));
		97	net->nf.defrag_ipv6 = false;
		98	}
		99	}
		100
		101	static struct pernet_operations defrag6_net_ops = {
		102	.exit = defrag6_net_exit,
		103	};
		104
90	static int __init nf_defrag_init(void)	105	static int __init nf_defrag_init(void)
91	{	106	{
92	int ret = 0;	107	int ret = 0;
@@ -96,9 +111,9 @@ static int __init nf_defrag_init(void) · 3 unmodified lines
96	pr_err("nf_defrag_ipv6: can't initialize frag6.\n");	111	pr_err("nf_defrag_ipv6: can't initialize frag6.\n");
97	return ret;	112	return ret;
98	}	113	}
99	ret = nf_register_hooks(ipv6_defrag_ops, ARRAY_SIZE(ipv6_defrag_ops));	114	ret = register_pernet_subsys(&defrag6_net_ops);
100	if (ret < 0) {	115	if (ret < 0) {
101	pr_err("nf_defrag_ipv6: can't register hooks\n");	116	pr_err("nf_defrag_ipv6: can't register pernet ops\n");
102	goto cleanup_frag6;	117	goto cleanup_frag6;
103	}	118	}
104	return ret;	119	return ret;
@@ -111,12 +126,31 @@ cleanup_frag6: · 6 unmodified lines
111		126
112	static void __exit nf_defrag_fini(void)	127	static void __exit nf_defrag_fini(void)
113	{	128	{
114	nf_unregister_hooks(ipv6_defrag_ops, ARRAY_SIZE(ipv6_defrag_ops));	129	unregister_pernet_subsys(&defrag6_net_ops);
115	nf_ct_frag6_cleanup();	130	nf_ct_frag6_cleanup();
116	}	131	}
117		132
118	void nf_defrag_ipv6_enable(void)	133	int nf_defrag_ipv6_enable(struct net *net)
119	{	134	{
		135	int err = 0;
		136
		137	might_sleep();
		138
		139	if (net->nf.defrag_ipv6)
		140	return 0;
		141
		142	mutex_lock(&defrag6_mutex);
		143	if (net->nf.defrag_ipv6)
		144	goto out_unlock;
		145
		146	err = nf_register_net_hooks(net, ipv6_defrag_ops,
		147	ARRAY_SIZE(ipv6_defrag_ops));
		148	if (err == 0)
		149	net->nf.defrag_ipv6 = true;
		150
		151	out_unlock:
		152	mutex_unlock(&defrag6_mutex);
		153	return err;
120	}	154	}
121	EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable);	155	EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable);
122		156

net/netfilter/xt_TPROXY.c+10−5

 static int tproxy_tg6_check(const struct xt_tgchk_param *par)
 {
 	const struct ip6t_ip6 *i = par->entryinfo;
+	int err;
+	err = nf_defrag_ipv6_enable(par->net);
+	if (err)
+		return err;
 	if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
 	    !(i->invflags & IP6T_INV_PROTO))
 static int tproxy_tg4_check(const struct xt_tgchk_param *par)
 {
 	const struct ipt_ip *i = par->entryinfo;
+	int err;
+	err = nf_defrag_ipv4_enable(par->net);
+	if (err)
+		return err;
 	if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
 	    && !(i->invflags & IPT_INV_PROTO))
 static int __init tproxy_tg_init(void)
 {
-	nf_defrag_ipv4_enable();
-#ifdef XT_TPROXY_HAVE_IPV6
-	nf_defrag_ipv6_enable();
-#endif
 	return xt_register_targets(tproxy_tg_reg, ARRAY_SIZE(tproxy_tg_reg));
 }

net/netfilter/xt_socket.c+28−5

 }
 #endif
+static int socket_mt_enable_defrag(struct net *net, int family)
+{
+	switch (family) {
+	case NFPROTO_IPV4:
+		return nf_defrag_ipv4_enable(net);
+#ifdef XT_SOCKET_HAVE_IPV6
+	case NFPROTO_IPV6:
+		return nf_defrag_ipv6_enable(net);
+#endif
+	}
+	WARN_ONCE(1, "Unknown family %d\n", family);
+	return 0;
+}
 static int socket_mt_v1_check(const struct xt_mtchk_param *par)
 {
 	const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
+	int err;
+	err = socket_mt_enable_defrag(par->net, par->family);
+	if (err)
+		return err;
 	if (info->flags & ~XT_SOCKET_FLAGS_V1) {
 		pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
 static int socket_mt_v2_check(const struct xt_mtchk_param *par)
 {
 	const struct xt_socket_mtinfo2 *info = (struct xt_socket_mtinfo2 *) par->matchinfo;
+	int err;
+	err = socket_mt_enable_defrag(par->net, par->family);
+	if (err)
+		return err;
 	if (info->flags & ~XT_SOCKET_FLAGS_V2) {
 		pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
 {
 	const struct xt_socket_mtinfo3 *info =
 				    (struct xt_socket_mtinfo3 *)par->matchinfo;
+	int err;
+	err = socket_mt_enable_defrag(par->net, par->family);
+	if (err)
+		return err;
 	if (info->flags & ~XT_SOCKET_FLAGS_V3) {
 		pr_info("unknown flags 0x%x\n",
 			info->flags & ~XT_SOCKET_FLAGS_V3);
 static int __init socket_mt_init(void)
 {
-	nf_defrag_ipv4_enable();
-#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
-	nf_defrag_ipv6_enable();
-#endif
 	return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
 }

netfilter: defrag: only register defrag functionality if needed

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code