reassembly.c 17.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 fragment reassembly
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17
 *
 *	$Id: reassembly.c,v 1.26 2001/03/07 22:00:57 davem Exp $
 *
 *	Based on: net/ipv4/ip_fragment.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

18 19
/*
 *	Fixes:
L
Linus Torvalds 已提交
20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
 *	Andi Kleen	Make it work with multiple hosts.
 *			More RFC compliance.
 *
 *      Horst von Brand Add missing #include <linux/string.h>
 *	Alexey Kuznetsov	SMP races, threading, cleanup.
 *	Patrick McHardy		LRU queue of frag heads for evictor.
 *	Mitsuru KANDA @USAGI	Register inet6_protocol{}.
 *	David Stevens and
 *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
 *				calculate ICV correctly.
 */
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
#include <linux/net.h>
#include <linux/list.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/jhash.h>
45
#include <linux/skbuff.h>
L
Linus Torvalds 已提交
46 47 48 49 50

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
51
#include <net/ip6_route.h>
L
Linus Torvalds 已提交
52 53 54 55 56
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
57
#include <net/inet_frag.h>
L
Linus Torvalds 已提交
58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73

struct ip6frag_skb_cb
{
	struct inet6_skb_parm	h;
	int			offset;
};

#define FRAG6_CB(skb)	((struct ip6frag_skb_cb*)((skb)->cb))


/*
 *	Equivalent of ipv4 struct ipq
 */

struct frag_queue
{
74
	struct inet_frag_queue	q;
L
Linus Torvalds 已提交
75

A
Al Viro 已提交
76
	__be32			id;		/* fragment id		*/
L
Linus Torvalds 已提交
77 78 79 80 81 82 83 84
	struct in6_addr		saddr;
	struct in6_addr		daddr;

	int			iif;
	unsigned int		csum;
	__u16			nhoffset;
};

85 86 87 88 89 90 91
struct inet_frags_ctl ip6_frags_ctl __read_mostly = {
	.high_thresh 	 = 256 * 1024,
	.low_thresh	 = 192 * 1024,
	.timeout	 = IPV6_FRAG_TIMEOUT,
	.secret_interval = 10 * 60 * HZ,
};

92
static struct inet_frags ip6_frags;
L
Linus Torvalds 已提交
93

94 95 96 97
int ip6_frag_nqueues(void)
{
	return ip6_frags.nqueues;
}
L
Linus Torvalds 已提交
98

99 100 101 102
int ip6_frag_mem(void)
{
	return atomic_read(&ip6_frags.mem);
}
L
Linus Torvalds 已提交
103

104 105 106
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
			  struct net_device *dev);

107 108 109 110
/*
 * callers should be careful not to use the hash value outside the ipfrag_lock
 * as doing so could race with ipfrag_hash_rnd being recalculated.
 */
A
Al Viro 已提交
111
static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
L
Linus Torvalds 已提交
112 113 114 115
			       struct in6_addr *daddr)
{
	u32 a, b, c;

A
Al Viro 已提交
116 117 118
	a = (__force u32)saddr->s6_addr32[0];
	b = (__force u32)saddr->s6_addr32[1];
	c = (__force u32)saddr->s6_addr32[2];
L
Linus Torvalds 已提交
119 120 121

	a += JHASH_GOLDEN_RATIO;
	b += JHASH_GOLDEN_RATIO;
122
	c += ip6_frags.rnd;
L
Linus Torvalds 已提交
123 124
	__jhash_mix(a, b, c);

A
Al Viro 已提交
125 126 127
	a += (__force u32)saddr->s6_addr32[3];
	b += (__force u32)daddr->s6_addr32[0];
	c += (__force u32)daddr->s6_addr32[1];
L
Linus Torvalds 已提交
128 129
	__jhash_mix(a, b, c);

A
Al Viro 已提交
130 131 132
	a += (__force u32)daddr->s6_addr32[2];
	b += (__force u32)daddr->s6_addr32[3];
	c += (__force u32)id;
L
Linus Torvalds 已提交
133 134
	__jhash_mix(a, b, c);

135
	return c & (INETFRAGS_HASHSZ - 1);
L
Linus Torvalds 已提交
136 137
}

138
static unsigned int ip6_hashfn(struct inet_frag_queue *q)
L
Linus Torvalds 已提交
139
{
140
	struct frag_queue *fq;
L
Linus Torvalds 已提交
141

142 143
	fq = container_of(q, struct frag_queue, q);
	return ip6qhashfn(fq->id, &fq->saddr, &fq->daddr);
L
Linus Torvalds 已提交
144 145 146 147 148 149 150
}

/* Memory Tracking Functions. */
static inline void frag_kfree_skb(struct sk_buff *skb, int *work)
{
	if (work)
		*work -= skb->truesize;
151
	atomic_sub(skb->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
152 153 154
	kfree_skb(skb);
}

155
static void ip6_frag_free(struct inet_frag_queue *fq)
L
Linus Torvalds 已提交
156
{
157
	kfree(container_of(fq, struct frag_queue, q));
L
Linus Torvalds 已提交
158 159 160 161
}

static inline struct frag_queue *frag_alloc_queue(void)
{
162
	struct frag_queue *fq = kzalloc(sizeof(struct frag_queue), GFP_ATOMIC);
L
Linus Torvalds 已提交
163 164 165

	if(!fq)
		return NULL;
166
	atomic_add(sizeof(struct frag_queue), &ip6_frags.mem);
L
Linus Torvalds 已提交
167 168 169 170 171
	return fq;
}

/* Destruction primitives. */

172
static __inline__ void fq_put(struct frag_queue *fq)
L
Linus Torvalds 已提交
173
{
174
	if (atomic_dec_and_test(&fq->q.refcnt))
175
		inet_frag_destroy(&fq->q, &ip6_frags, NULL);
L
Linus Torvalds 已提交
176 177 178 179 180 181 182
}

/* Kill fq entry. It is not destroyed immediately,
 * because caller (and someone more) holds reference count.
 */
static __inline__ void fq_kill(struct frag_queue *fq)
{
183
	inet_frag_kill(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
184 185
}

186
static void ip6_evictor(struct inet6_dev *idev)
L
Linus Torvalds 已提交
187
{
188 189 190 191 192
	int evicted;

	evicted = inet_frag_evictor(&ip6_frags);
	if (evicted)
		IP6_ADD_STATS_BH(idev, IPSTATS_MIB_REASMFAILS, evicted);
L
Linus Torvalds 已提交
193 194 195 196 197
}

static void ip6_frag_expire(unsigned long data)
{
	struct frag_queue *fq = (struct frag_queue *) data;
198
	struct net_device *dev = NULL;
L
Linus Torvalds 已提交
199

200
	spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
201

202
	if (fq->q.last_in & COMPLETE)
L
Linus Torvalds 已提交
203 204 205 206
		goto out;

	fq_kill(fq);

207
	dev = dev_get_by_index(&init_net, fq->iif);
208 209 210 211 212 213 214
	if (!dev)
		goto out;

	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
	rcu_read_unlock();
L
Linus Torvalds 已提交
215

216
	/* Don't send error if the first segment did not arrive. */
217
	if (!(fq->q.last_in&FIRST_IN) || !fq->q.fragments)
218 219 220 221 222 223 224
		goto out;

	/*
	   But use as source device on which LAST ARRIVED
	   segment was received. And do not use fq->dev
	   pointer directly, device might already disappeared.
	 */
225 226
	fq->q.fragments->dev = dev;
	icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
L
Linus Torvalds 已提交
227
out:
228 229
	if (dev)
		dev_put(dev);
230
	spin_unlock(&fq->q.lock);
231
	fq_put(fq);
L
Linus Torvalds 已提交
232 233 234 235 236
}

/* Creation primitives. */


237
static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
L
Linus Torvalds 已提交
238 239
{
	struct frag_queue *fq;
240
	unsigned int hash;
241 242 243
#ifdef CONFIG_SMP
	struct hlist_node *n;
#endif
L
Linus Torvalds 已提交
244

245
	write_lock(&ip6_frags.lock);
246
	hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr);
L
Linus Torvalds 已提交
247
#ifdef CONFIG_SMP
248
	hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) {
249
		if (fq->id == fq_in->id &&
L
Linus Torvalds 已提交
250 251
		    ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
		    ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
252
			atomic_inc(&fq->q.refcnt);
253
			write_unlock(&ip6_frags.lock);
254
			fq_in->q.last_in |= COMPLETE;
255
			fq_put(fq_in);
L
Linus Torvalds 已提交
256 257 258 259 260 261
			return fq;
		}
	}
#endif
	fq = fq_in;

262
	if (!mod_timer(&fq->q.timer, jiffies + ip6_frags_ctl.timeout))
263
		atomic_inc(&fq->q.refcnt);
L
Linus Torvalds 已提交
264

265
	atomic_inc(&fq->q.refcnt);
266
	hlist_add_head(&fq->q.list, &ip6_frags.hash[hash]);
267
	INIT_LIST_HEAD(&fq->q.lru_list);
268 269 270
	list_add_tail(&fq->q.lru_list, &ip6_frags.lru_list);
	ip6_frags.nqueues++;
	write_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
271 272 273 274 275
	return fq;
}


static struct frag_queue *
A
Al Viro 已提交
276
ip6_frag_create(__be32 id, struct in6_addr *src, struct in6_addr *dst,
277
		struct inet6_dev *idev)
L
Linus Torvalds 已提交
278 279 280 281 282 283 284 285 286 287
{
	struct frag_queue *fq;

	if ((fq = frag_alloc_queue()) == NULL)
		goto oom;

	fq->id = id;
	ipv6_addr_copy(&fq->saddr, src);
	ipv6_addr_copy(&fq->daddr, dst);

288 289 290 291 292
	init_timer(&fq->q.timer);
	fq->q.timer.function = ip6_frag_expire;
	fq->q.timer.data = (long) fq;
	spin_lock_init(&fq->q.lock);
	atomic_set(&fq->q.refcnt, 1);
L
Linus Torvalds 已提交
293

294
	return ip6_frag_intern(fq);
L
Linus Torvalds 已提交
295 296

oom:
297
	IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
298 299 300 301
	return NULL;
}

static __inline__ struct frag_queue *
A
Al Viro 已提交
302
fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
303
	struct inet6_dev *idev)
L
Linus Torvalds 已提交
304 305
{
	struct frag_queue *fq;
306
	struct hlist_node *n;
307
	unsigned int hash;
L
Linus Torvalds 已提交
308

309
	read_lock(&ip6_frags.lock);
310
	hash = ip6qhashfn(id, src, dst);
311
	hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) {
312
		if (fq->id == id &&
L
Linus Torvalds 已提交
313 314
		    ipv6_addr_equal(src, &fq->saddr) &&
		    ipv6_addr_equal(dst, &fq->daddr)) {
315
			atomic_inc(&fq->q.refcnt);
316
			read_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
317 318 319
			return fq;
		}
	}
320
	read_unlock(&ip6_frags.lock);
L
Linus Torvalds 已提交
321

322
	return ip6_frag_create(id, src, dst, idev);
L
Linus Torvalds 已提交
323 324 325
}


326
static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
L
Linus Torvalds 已提交
327 328 329
			   struct frag_hdr *fhdr, int nhoff)
{
	struct sk_buff *prev, *next;
330
	struct net_device *dev;
L
Linus Torvalds 已提交
331 332
	int offset, end;

333
	if (fq->q.last_in & COMPLETE)
L
Linus Torvalds 已提交
334 335 336
		goto err;

	offset = ntohs(fhdr->frag_off) & ~0x7;
337 338
	end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
L
Linus Torvalds 已提交
339 340

	if ((unsigned int)end > IPV6_MAXPLEN) {
341 342
		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
				 IPSTATS_MIB_INHDRERRORS);
343 344 345
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  ((u8 *)&fhdr->frag_off -
				   skb_network_header(skb)));
346
		return -1;
L
Linus Torvalds 已提交
347 348
	}

349 350
	if (skb->ip_summed == CHECKSUM_COMPLETE) {
		const unsigned char *nh = skb_network_header(skb);
351
		skb->csum = csum_sub(skb->csum,
352 353 354
				     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
						  0));
	}
L
Linus Torvalds 已提交
355 356 357 358 359 360

	/* Is this the final fragment? */
	if (!(fhdr->frag_off & htons(IP6_MF))) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrupted.
		 */
361 362
		if (end < fq->q.len ||
		    ((fq->q.last_in & LAST_IN) && end != fq->q.len))
L
Linus Torvalds 已提交
363
			goto err;
364 365
		fq->q.last_in |= LAST_IN;
		fq->q.len = end;
L
Linus Torvalds 已提交
366 367 368 369 370 371 372 373
	} else {
		/* Check if the fragment is rounded to 8 bytes.
		 * Required by the RFC.
		 */
		if (end & 0x7) {
			/* RFC2460 says always send parameter problem in
			 * this case. -DaveM
			 */
374 375
			IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
					 IPSTATS_MIB_INHDRERRORS);
376
			icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
L
Linus Torvalds 已提交
377
					  offsetof(struct ipv6hdr, payload_len));
378
			return -1;
L
Linus Torvalds 已提交
379
		}
380
		if (end > fq->q.len) {
L
Linus Torvalds 已提交
381
			/* Some bits beyond end -> corruption. */
382
			if (fq->q.last_in & LAST_IN)
L
Linus Torvalds 已提交
383
				goto err;
384
			fq->q.len = end;
L
Linus Torvalds 已提交
385 386 387 388 389 390 391 392 393
		}
	}

	if (end == offset)
		goto err;

	/* Point into the IP datagram 'data' part. */
	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
		goto err;
394

395 396
	if (pskb_trim_rcsum(skb, end - offset))
		goto err;
L
Linus Torvalds 已提交
397 398 399 400 401 402

	/* Find out which fragments are in front and at the back of us
	 * in the chain of fragments so far.  We must know where to put
	 * this fragment, right?
	 */
	prev = NULL;
403
	for(next = fq->q.fragments; next != NULL; next = next->next) {
L
Linus Torvalds 已提交
404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439
		if (FRAG6_CB(next)->offset >= offset)
			break;	/* bingo! */
		prev = next;
	}

	/* We found where to put this one.  Check for overlap with
	 * preceding fragment, and, if needed, align things so that
	 * any overlaps are eliminated.
	 */
	if (prev) {
		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;

		if (i > 0) {
			offset += i;
			if (end <= offset)
				goto err;
			if (!pskb_pull(skb, i))
				goto err;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
	}

	/* Look for overlap with succeeding segments.
	 * If we can merge fragments, do it.
	 */
	while (next && FRAG6_CB(next)->offset < end) {
		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */

		if (i < next->len) {
			/* Eat head of the next overlapped fragment
			 * and leave the loop. The next ones cannot overlap.
			 */
			if (!pskb_pull(next, i))
				goto err;
			FRAG6_CB(next)->offset += i;	/* next fragment */
440
			fq->q.meat -= i;
L
Linus Torvalds 已提交
441 442 443 444 445 446 447 448 449 450 451 452 453 454
			if (next->ip_summed != CHECKSUM_UNNECESSARY)
				next->ip_summed = CHECKSUM_NONE;
			break;
		} else {
			struct sk_buff *free_it = next;

			/* Old fragment is completely overridden with
			 * new one drop it.
			 */
			next = next->next;

			if (prev)
				prev->next = next;
			else
455
				fq->q.fragments = next;
L
Linus Torvalds 已提交
456

457
			fq->q.meat -= free_it->len;
L
Linus Torvalds 已提交
458 459 460 461 462 463 464 465 466 467 468
			frag_kfree_skb(free_it, NULL);
		}
	}

	FRAG6_CB(skb)->offset = offset;

	/* Insert this fragment in the chain of fragments. */
	skb->next = next;
	if (prev)
		prev->next = skb;
	else
469
		fq->q.fragments = skb;
L
Linus Torvalds 已提交
470

471 472 473 474 475
	dev = skb->dev;
	if (dev) {
		fq->iif = dev->ifindex;
		skb->dev = NULL;
	}
476 477
	fq->q.stamp = skb->tstamp;
	fq->q.meat += skb->len;
478
	atomic_add(skb->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
479 480 481 482 483 484

	/* The first fragment.
	 * nhoffset is obtained from the first fragment, of course.
	 */
	if (offset == 0) {
		fq->nhoffset = nhoff;
485
		fq->q.last_in |= FIRST_IN;
L
Linus Torvalds 已提交
486
	}
487

488
	if (fq->q.last_in == (FIRST_IN | LAST_IN) && fq->q.meat == fq->q.len)
489 490
		return ip6_frag_reasm(fq, prev, dev);

491 492 493
	write_lock(&ip6_frags.lock);
	list_move_tail(&fq->q.lru_list, &ip6_frags.lru_list);
	write_unlock(&ip6_frags.lock);
494
	return -1;
L
Linus Torvalds 已提交
495 496

err:
497
	IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
498
	kfree_skb(skb);
499
	return -1;
L
Linus Torvalds 已提交
500 501 502 503 504 505 506 507 508 509 510
}

/*
 *	Check if this packet is complete.
 *	Returns NULL on failure by any reason, and pointer
 *	to current nexthdr field in reassembled frame.
 *
 *	It is called with locked fq, and caller must check that
 *	queue is eligible for reassembly i.e. it is not COMPLETE,
 *	the last and the first frames arrived and all the bits are here.
 */
511
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
L
Linus Torvalds 已提交
512 513
			  struct net_device *dev)
{
514
	struct sk_buff *fp, *head = fq->q.fragments;
L
Linus Torvalds 已提交
515 516 517 518 519
	int    payload_len;
	unsigned int nhoff;

	fq_kill(fq);

520 521 522 523 524 525 526 527 528 529 530
	/* Make the one we just received the head. */
	if (prev) {
		head = prev->next;
		fp = skb_clone(head, GFP_ATOMIC);

		if (!fp)
			goto out_oom;

		fp->next = head->next;
		prev->next = fp;

531 532
		skb_morph(head, fq->q.fragments);
		head->next = fq->q.fragments->next;
533

534 535
		kfree_skb(fq->q.fragments);
		fq->q.fragments = head;
536 537
	}

L
Linus Torvalds 已提交
538 539 540 541
	BUG_TRAP(head != NULL);
	BUG_TRAP(FRAG6_CB(head)->offset == 0);

	/* Unfragmented part is taken from the first segment. */
542
	payload_len = ((head->data - skb_network_header(head)) -
543
		       sizeof(struct ipv6hdr) + fq->q.len -
544
		       sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571
	if (payload_len > IPV6_MAXPLEN)
		goto out_oversize;

	/* Head of list must not be cloned. */
	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
		goto out_oom;

	/* If the first fragment is fragmented itself, we split
	 * it to two chunks: the first with data and paged part
	 * and the second, holding only fragments. */
	if (skb_shinfo(head)->frag_list) {
		struct sk_buff *clone;
		int i, plen = 0;

		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
			goto out_oom;
		clone->next = head->next;
		head->next = clone;
		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
		skb_shinfo(head)->frag_list = NULL;
		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
			plen += skb_shinfo(head)->frags[i].size;
		clone->len = clone->data_len = head->data_len - plen;
		head->data_len -= clone->len;
		head->len -= clone->len;
		clone->csum = 0;
		clone->ip_summed = head->ip_summed;
572
		atomic_add(clone->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
573 574 575 576 577
	}

	/* We have to remove fragment header from datagram and to relocate
	 * header in order to calculate ICV correctly. */
	nhoff = fq->nhoffset;
578
	skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
579
	memmove(head->head + sizeof(struct frag_hdr), head->head,
L
Linus Torvalds 已提交
580
		(head->data - head->head) - sizeof(struct frag_hdr));
581 582
	head->mac_header += sizeof(struct frag_hdr);
	head->network_header += sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
583 584

	skb_shinfo(head)->frag_list = head->next;
585
	skb_reset_transport_header(head);
586
	skb_push(head, head->data - skb_network_header(head));
587
	atomic_sub(head->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
588 589 590 591 592 593

	for (fp=head->next; fp; fp = fp->next) {
		head->data_len += fp->len;
		head->len += fp->len;
		if (head->ip_summed != fp->ip_summed)
			head->ip_summed = CHECKSUM_NONE;
594
		else if (head->ip_summed == CHECKSUM_COMPLETE)
L
Linus Torvalds 已提交
595 596
			head->csum = csum_add(head->csum, fp->csum);
		head->truesize += fp->truesize;
597
		atomic_sub(fp->truesize, &ip6_frags.mem);
L
Linus Torvalds 已提交
598 599 600 601
	}

	head->next = NULL;
	head->dev = dev;
602
	head->tstamp = fq->q.stamp;
603
	ipv6_hdr(head)->payload_len = htons(payload_len);
604
	IP6CB(head)->nhoff = nhoff;
L
Linus Torvalds 已提交
605 606

	/* Yes, and fold redundant checksum back. 8) */
607
	if (head->ip_summed == CHECKSUM_COMPLETE)
608
		head->csum = csum_partial(skb_network_header(head),
609
					  skb_network_header_len(head),
610
					  head->csum);
L
Linus Torvalds 已提交
611

612 613 614
	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
	rcu_read_unlock();
615
	fq->q.fragments = NULL;
L
Linus Torvalds 已提交
616 617 618 619 620 621 622 623 624 625
	return 1;

out_oversize:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
	goto out_fail;
out_oom:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
out_fail:
626 627 628
	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
	rcu_read_unlock();
L
Linus Torvalds 已提交
629 630 631
	return -1;
}

632
static int ipv6_frag_rcv(struct sk_buff **skbp)
L
Linus Torvalds 已提交
633
{
634
	struct sk_buff *skb = *skbp;
L
Linus Torvalds 已提交
635 636
	struct frag_hdr *fhdr;
	struct frag_queue *fq;
637
	struct ipv6hdr *hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
638

639
	IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
L
Linus Torvalds 已提交
640 641 642

	/* Jumbo payload inhibits frag. header */
	if (hdr->payload_len==0) {
643
		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
644 645
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  skb_network_header_len(skb));
L
Linus Torvalds 已提交
646 647
		return -1;
	}
648 649
	if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
				 sizeof(struct frag_hdr)))) {
650
		IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
651 652
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  skb_network_header_len(skb));
L
Linus Torvalds 已提交
653 654 655
		return -1;
	}

656
	hdr = ipv6_hdr(skb);
657
	fhdr = (struct frag_hdr *)skb_transport_header(skb);
L
Linus Torvalds 已提交
658 659 660

	if (!(fhdr->frag_off & htons(0xFFF9))) {
		/* It is not a fragmented frame */
661
		skb->transport_header += sizeof(struct frag_hdr);
662
		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS);
L
Linus Torvalds 已提交
663

664
		IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
L
Linus Torvalds 已提交
665 666 667
		return 1;
	}

668
	if (atomic_read(&ip6_frags.mem) > ip6_frags_ctl.high_thresh)
669
		ip6_evictor(ip6_dst_idev(skb->dst));
L
Linus Torvalds 已提交
670

671 672
	if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr,
			  ip6_dst_idev(skb->dst))) != NULL) {
673
		int ret;
L
Linus Torvalds 已提交
674

675
		spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
676

677
		ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
L
Linus Torvalds 已提交
678

679
		spin_unlock(&fq->q.lock);
680
		fq_put(fq);
L
Linus Torvalds 已提交
681 682 683
		return ret;
	}

684
	IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
685 686 687 688 689 690 691 692 693 694 695 696 697 698 699
	kfree_skb(skb);
	return -1;
}

static struct inet6_protocol frag_protocol =
{
	.handler	=	ipv6_frag_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

void __init ipv6_frag_init(void)
{
	if (inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT) < 0)
		printk(KERN_ERR "ipv6_frag_init: Could not register protocol\n");

700
	ip6_frags.ctl = &ip6_frags_ctl;
701
	ip6_frags.hashfn = ip6_hashfn;
702 703 704
	ip6_frags.destructor = ip6_frag_free;
	ip6_frags.skb_free = NULL;
	ip6_frags.qsize = sizeof(struct frag_queue);
705
	inet_frags_init(&ip6_frags);
L
Linus Torvalds 已提交
706
}