reassembly.c 19.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 fragment reassembly
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15
 *
 *	Based on: net/ipv4/ip_fragment.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

16 17
/*
 *	Fixes:
L
Linus Torvalds 已提交
18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
 *	Andi Kleen	Make it work with multiple hosts.
 *			More RFC compliance.
 *
 *      Horst von Brand Add missing #include <linux/string.h>
 *	Alexey Kuznetsov	SMP races, threading, cleanup.
 *	Patrick McHardy		LRU queue of frag heads for evictor.
 *	Mitsuru KANDA @USAGI	Register inet6_protocol{}.
 *	David Stevens and
 *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
 *				calculate ICV correctly.
 */
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
#include <linux/net.h>
#include <linux/list.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/jhash.h>
43
#include <linux/skbuff.h>
L
Linus Torvalds 已提交
44 45 46 47 48

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
49
#include <net/ip6_route.h>
L
Linus Torvalds 已提交
50 51 52 53 54
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
55
#include <net/inet_frag.h>
L
Linus Torvalds 已提交
56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71

struct ip6frag_skb_cb
{
	struct inet6_skb_parm	h;
	int			offset;
};

#define FRAG6_CB(skb)	((struct ip6frag_skb_cb*)((skb)->cb))


/*
 *	Equivalent of ipv4 struct ipq
 */

struct frag_queue
{
72
	struct inet_frag_queue	q;
L
Linus Torvalds 已提交
73

A
Al Viro 已提交
74
	__be32			id;		/* fragment id		*/
75
	u32			user;
L
Linus Torvalds 已提交
76 77 78 79 80 81 82 83
	struct in6_addr		saddr;
	struct in6_addr		daddr;

	int			iif;
	unsigned int		csum;
	__u16			nhoffset;
};

84
static struct inet_frags ip6_frags;
L
Linus Torvalds 已提交
85

86
int ip6_frag_nqueues(struct net *net)
87
{
88
	return net->ipv6.frags.nqueues;
89
}
L
Linus Torvalds 已提交
90

91
int ip6_frag_mem(struct net *net)
92
{
93
	return atomic_read(&net->ipv6.frags.mem);
94
}
L
Linus Torvalds 已提交
95

96 97 98
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
			  struct net_device *dev);

99 100 101 102
/*
 * callers should be careful not to use the hash value outside the ipfrag_lock
 * as doing so could race with ipfrag_hash_rnd being recalculated.
 */
103 104
unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
			     const struct in6_addr *daddr, u32 rnd)
L
Linus Torvalds 已提交
105 106 107
{
	u32 a, b, c;

A
Al Viro 已提交
108 109 110
	a = (__force u32)saddr->s6_addr32[0];
	b = (__force u32)saddr->s6_addr32[1];
	c = (__force u32)saddr->s6_addr32[2];
L
Linus Torvalds 已提交
111 112 113

	a += JHASH_GOLDEN_RATIO;
	b += JHASH_GOLDEN_RATIO;
114
	c += rnd;
L
Linus Torvalds 已提交
115 116
	__jhash_mix(a, b, c);

A
Al Viro 已提交
117 118 119
	a += (__force u32)saddr->s6_addr32[3];
	b += (__force u32)daddr->s6_addr32[0];
	c += (__force u32)daddr->s6_addr32[1];
L
Linus Torvalds 已提交
120 121
	__jhash_mix(a, b, c);

A
Al Viro 已提交
122 123 124
	a += (__force u32)daddr->s6_addr32[2];
	b += (__force u32)daddr->s6_addr32[3];
	c += (__force u32)id;
L
Linus Torvalds 已提交
125 126
	__jhash_mix(a, b, c);

127
	return c & (INETFRAGS_HASHSZ - 1);
L
Linus Torvalds 已提交
128
}
129
EXPORT_SYMBOL_GPL(inet6_hash_frag);
L
Linus Torvalds 已提交
130

131
static unsigned int ip6_hashfn(struct inet_frag_queue *q)
L
Linus Torvalds 已提交
132
{
133
	struct frag_queue *fq;
L
Linus Torvalds 已提交
134

135
	fq = container_of(q, struct frag_queue, q);
136
	return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd);
L
Linus Torvalds 已提交
137 138
}

139 140 141 142 143 144
int ip6_frag_match(struct inet_frag_queue *q, void *a)
{
	struct frag_queue *fq;
	struct ip6_create_arg *arg = a;

	fq = container_of(q, struct frag_queue, q);
145
	return (fq->id == arg->id && fq->user == arg->user &&
146 147 148 149 150
			ipv6_addr_equal(&fq->saddr, arg->src) &&
			ipv6_addr_equal(&fq->daddr, arg->dst));
}
EXPORT_SYMBOL(ip6_frag_match);

L
Linus Torvalds 已提交
151
/* Memory Tracking Functions. */
152 153
static inline void frag_kfree_skb(struct netns_frags *nf,
		struct sk_buff *skb, int *work)
L
Linus Torvalds 已提交
154 155 156
{
	if (work)
		*work -= skb->truesize;
157
	atomic_sub(skb->truesize, &nf->mem);
L
Linus Torvalds 已提交
158 159 160
	kfree_skb(skb);
}

161
void ip6_frag_init(struct inet_frag_queue *q, void *a)
L
Linus Torvalds 已提交
162
{
163 164 165 166
	struct frag_queue *fq = container_of(q, struct frag_queue, q);
	struct ip6_create_arg *arg = a;

	fq->id = arg->id;
167
	fq->user = arg->user;
168 169
	ipv6_addr_copy(&fq->saddr, arg->src);
	ipv6_addr_copy(&fq->daddr, arg->dst);
L
Linus Torvalds 已提交
170
}
171
EXPORT_SYMBOL(ip6_frag_init);
L
Linus Torvalds 已提交
172 173 174

/* Destruction primitives. */

175
static __inline__ void fq_put(struct frag_queue *fq)
L
Linus Torvalds 已提交
176
{
P
Pavel Emelyanov 已提交
177
	inet_frag_put(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
178 179 180 181 182 183 184
}

/* Kill fq entry. It is not destroyed immediately,
 * because caller (and someone more) holds reference count.
 */
static __inline__ void fq_kill(struct frag_queue *fq)
{
185
	inet_frag_kill(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
186 187
}

188
static void ip6_evictor(struct net *net, struct inet6_dev *idev)
L
Linus Torvalds 已提交
189
{
190 191
	int evicted;

192
	evicted = inet_frag_evictor(&net->ipv6.frags, &ip6_frags);
193
	if (evicted)
194
		IP6_ADD_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS, evicted);
L
Linus Torvalds 已提交
195 196 197 198
}

static void ip6_frag_expire(unsigned long data)
{
199
	struct frag_queue *fq;
200
	struct net_device *dev = NULL;
201
	struct net *net;
L
Linus Torvalds 已提交
202

203 204
	fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);

205
	spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
206

207
	if (fq->q.last_in & INET_FRAG_COMPLETE)
L
Linus Torvalds 已提交
208 209 210 211
		goto out;

	fq_kill(fq);

212
	net = container_of(fq->q.net, struct net, ipv6.frags);
E
Eric Dumazet 已提交
213 214
	rcu_read_lock();
	dev = dev_get_by_index_rcu(net, fq->iif);
215
	if (!dev)
E
Eric Dumazet 已提交
216
		goto out_rcu_unlock;
217

218 219
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
220

221
	/* Don't send error if the first segment did not arrive. */
222
	if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments)
E
Eric Dumazet 已提交
223
		goto out_rcu_unlock;
224 225 226 227 228 229

	/*
	   But use as source device on which LAST ARRIVED
	   segment was received. And do not use fq->dev
	   pointer directly, device might already disappeared.
	 */
230 231
	fq->q.fragments->dev = dev;
	icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
E
Eric Dumazet 已提交
232 233
out_rcu_unlock:
	rcu_read_unlock();
L
Linus Torvalds 已提交
234
out:
235
	spin_unlock(&fq->q.lock);
236
	fq_put(fq);
L
Linus Torvalds 已提交
237 238
}

239
static __inline__ struct frag_queue *
240
fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
241
	struct inet6_dev *idev)
L
Linus Torvalds 已提交
242
{
243 244
	struct inet_frag_queue *q;
	struct ip6_create_arg arg;
245
	unsigned int hash;
L
Linus Torvalds 已提交
246

247
	arg.id = id;
248
	arg.user = IP6_DEFRAG_LOCAL_DELIVER;
249 250
	arg.src = src;
	arg.dst = dst;
251 252

	read_lock(&ip6_frags.lock);
253
	hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
L
Linus Torvalds 已提交
254

255
	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
256 257
	if (q == NULL)
		goto oom;
L
Linus Torvalds 已提交
258

259
	return container_of(q, struct frag_queue, q);
L
Linus Torvalds 已提交
260 261

oom:
262
	IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
263 264 265
	return NULL;
}

266
static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
L
Linus Torvalds 已提交
267 268 269
			   struct frag_hdr *fhdr, int nhoff)
{
	struct sk_buff *prev, *next;
270
	struct net_device *dev;
L
Linus Torvalds 已提交
271
	int offset, end;
E
Eric Dumazet 已提交
272
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
273

274
	if (fq->q.last_in & INET_FRAG_COMPLETE)
L
Linus Torvalds 已提交
275 276 277
		goto err;

	offset = ntohs(fhdr->frag_off) & ~0x7;
278 279
	end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
L
Linus Torvalds 已提交
280 281

	if ((unsigned int)end > IPV6_MAXPLEN) {
E
Eric Dumazet 已提交
282
		IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
283
				 IPSTATS_MIB_INHDRERRORS);
284 285 286
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  ((u8 *)&fhdr->frag_off -
				   skb_network_header(skb)));
287
		return -1;
L
Linus Torvalds 已提交
288 289
	}

290 291
	if (skb->ip_summed == CHECKSUM_COMPLETE) {
		const unsigned char *nh = skb_network_header(skb);
292
		skb->csum = csum_sub(skb->csum,
293 294 295
				     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
						  0));
	}
L
Linus Torvalds 已提交
296 297 298 299 300 301

	/* Is this the final fragment? */
	if (!(fhdr->frag_off & htons(IP6_MF))) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrupted.
		 */
302
		if (end < fq->q.len ||
303
		    ((fq->q.last_in & INET_FRAG_LAST_IN) && end != fq->q.len))
L
Linus Torvalds 已提交
304
			goto err;
305
		fq->q.last_in |= INET_FRAG_LAST_IN;
306
		fq->q.len = end;
L
Linus Torvalds 已提交
307 308 309 310 311 312 313 314
	} else {
		/* Check if the fragment is rounded to 8 bytes.
		 * Required by the RFC.
		 */
		if (end & 0x7) {
			/* RFC2460 says always send parameter problem in
			 * this case. -DaveM
			 */
E
Eric Dumazet 已提交
315
			IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
316
					 IPSTATS_MIB_INHDRERRORS);
317
			icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
L
Linus Torvalds 已提交
318
					  offsetof(struct ipv6hdr, payload_len));
319
			return -1;
L
Linus Torvalds 已提交
320
		}
321
		if (end > fq->q.len) {
L
Linus Torvalds 已提交
322
			/* Some bits beyond end -> corruption. */
323
			if (fq->q.last_in & INET_FRAG_LAST_IN)
L
Linus Torvalds 已提交
324
				goto err;
325
			fq->q.len = end;
L
Linus Torvalds 已提交
326 327 328 329 330 331 332 333 334
		}
	}

	if (end == offset)
		goto err;

	/* Point into the IP datagram 'data' part. */
	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
		goto err;
335

336 337
	if (pskb_trim_rcsum(skb, end - offset))
		goto err;
L
Linus Torvalds 已提交
338 339 340 341 342 343

	/* Find out which fragments are in front and at the back of us
	 * in the chain of fragments so far.  We must know where to put
	 * this fragment, right?
	 */
	prev = NULL;
344
	for(next = fq->q.fragments; next != NULL; next = next->next) {
L
Linus Torvalds 已提交
345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
		if (FRAG6_CB(next)->offset >= offset)
			break;	/* bingo! */
		prev = next;
	}

	/* We found where to put this one.  Check for overlap with
	 * preceding fragment, and, if needed, align things so that
	 * any overlaps are eliminated.
	 */
	if (prev) {
		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;

		if (i > 0) {
			offset += i;
			if (end <= offset)
				goto err;
			if (!pskb_pull(skb, i))
				goto err;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
	}

	/* Look for overlap with succeeding segments.
	 * If we can merge fragments, do it.
	 */
	while (next && FRAG6_CB(next)->offset < end) {
		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */

		if (i < next->len) {
			/* Eat head of the next overlapped fragment
			 * and leave the loop. The next ones cannot overlap.
			 */
			if (!pskb_pull(next, i))
				goto err;
			FRAG6_CB(next)->offset += i;	/* next fragment */
381
			fq->q.meat -= i;
L
Linus Torvalds 已提交
382 383 384 385 386 387 388 389 390 391 392 393 394 395
			if (next->ip_summed != CHECKSUM_UNNECESSARY)
				next->ip_summed = CHECKSUM_NONE;
			break;
		} else {
			struct sk_buff *free_it = next;

			/* Old fragment is completely overridden with
			 * new one drop it.
			 */
			next = next->next;

			if (prev)
				prev->next = next;
			else
396
				fq->q.fragments = next;
L
Linus Torvalds 已提交
397

398
			fq->q.meat -= free_it->len;
399
			frag_kfree_skb(fq->q.net, free_it, NULL);
L
Linus Torvalds 已提交
400 401 402 403 404 405 406 407 408 409
		}
	}

	FRAG6_CB(skb)->offset = offset;

	/* Insert this fragment in the chain of fragments. */
	skb->next = next;
	if (prev)
		prev->next = skb;
	else
410
		fq->q.fragments = skb;
L
Linus Torvalds 已提交
411

412 413 414 415 416
	dev = skb->dev;
	if (dev) {
		fq->iif = dev->ifindex;
		skb->dev = NULL;
	}
417 418
	fq->q.stamp = skb->tstamp;
	fq->q.meat += skb->len;
419
	atomic_add(skb->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
420 421 422 423 424 425

	/* The first fragment.
	 * nhoffset is obtained from the first fragment, of course.
	 */
	if (offset == 0) {
		fq->nhoffset = nhoff;
426
		fq->q.last_in |= INET_FRAG_FIRST_IN;
L
Linus Torvalds 已提交
427
	}
428

429 430
	if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
	    fq->q.meat == fq->q.len)
431 432
		return ip6_frag_reasm(fq, prev, dev);

433
	write_lock(&ip6_frags.lock);
434
	list_move_tail(&fq->q.lru_list, &fq->q.net->lru_list);
435
	write_unlock(&ip6_frags.lock);
436
	return -1;
L
Linus Torvalds 已提交
437 438

err:
E
Eric Dumazet 已提交
439
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
440
		      IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
441
	kfree_skb(skb);
442
	return -1;
L
Linus Torvalds 已提交
443 444 445 446 447 448 449 450 451 452 453
}

/*
 *	Check if this packet is complete.
 *	Returns NULL on failure by any reason, and pointer
 *	to current nexthdr field in reassembled frame.
 *
 *	It is called with locked fq, and caller must check that
 *	queue is eligible for reassembly i.e. it is not COMPLETE,
 *	the last and the first frames arrived and all the bits are here.
 */
454
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
L
Linus Torvalds 已提交
455 456
			  struct net_device *dev)
{
457
	struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
458
	struct sk_buff *fp, *head = fq->q.fragments;
L
Linus Torvalds 已提交
459 460 461 462 463
	int    payload_len;
	unsigned int nhoff;

	fq_kill(fq);

464 465 466 467 468 469 470 471 472 473 474
	/* Make the one we just received the head. */
	if (prev) {
		head = prev->next;
		fp = skb_clone(head, GFP_ATOMIC);

		if (!fp)
			goto out_oom;

		fp->next = head->next;
		prev->next = fp;

475 476
		skb_morph(head, fq->q.fragments);
		head->next = fq->q.fragments->next;
477

478 479
		kfree_skb(fq->q.fragments);
		fq->q.fragments = head;
480 481
	}

482 483
	WARN_ON(head == NULL);
	WARN_ON(FRAG6_CB(head)->offset != 0);
L
Linus Torvalds 已提交
484 485

	/* Unfragmented part is taken from the first segment. */
486
	payload_len = ((head->data - skb_network_header(head)) -
487
		       sizeof(struct ipv6hdr) + fq->q.len -
488
		       sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
489 490 491 492 493 494 495 496 497 498
	if (payload_len > IPV6_MAXPLEN)
		goto out_oversize;

	/* Head of list must not be cloned. */
	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
		goto out_oom;

	/* If the first fragment is fragmented itself, we split
	 * it to two chunks: the first with data and paged part
	 * and the second, holding only fragments. */
499
	if (skb_has_frags(head)) {
L
Linus Torvalds 已提交
500 501 502 503 504 505 506 507
		struct sk_buff *clone;
		int i, plen = 0;

		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
			goto out_oom;
		clone->next = head->next;
		head->next = clone;
		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
508
		skb_frag_list_init(head);
L
Linus Torvalds 已提交
509 510 511 512 513 514 515
		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
			plen += skb_shinfo(head)->frags[i].size;
		clone->len = clone->data_len = head->data_len - plen;
		head->data_len -= clone->len;
		head->len -= clone->len;
		clone->csum = 0;
		clone->ip_summed = head->ip_summed;
516
		atomic_add(clone->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
517 518 519 520 521
	}

	/* We have to remove fragment header from datagram and to relocate
	 * header in order to calculate ICV correctly. */
	nhoff = fq->nhoffset;
522
	skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
523
	memmove(head->head + sizeof(struct frag_hdr), head->head,
L
Linus Torvalds 已提交
524
		(head->data - head->head) - sizeof(struct frag_hdr));
525 526
	head->mac_header += sizeof(struct frag_hdr);
	head->network_header += sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
527 528

	skb_shinfo(head)->frag_list = head->next;
529
	skb_reset_transport_header(head);
530
	skb_push(head, head->data - skb_network_header(head));
531
	atomic_sub(head->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
532 533 534 535 536 537

	for (fp=head->next; fp; fp = fp->next) {
		head->data_len += fp->len;
		head->len += fp->len;
		if (head->ip_summed != fp->ip_summed)
			head->ip_summed = CHECKSUM_NONE;
538
		else if (head->ip_summed == CHECKSUM_COMPLETE)
L
Linus Torvalds 已提交
539 540
			head->csum = csum_add(head->csum, fp->csum);
		head->truesize += fp->truesize;
541
		atomic_sub(fp->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
542 543 544 545
	}

	head->next = NULL;
	head->dev = dev;
546
	head->tstamp = fq->q.stamp;
547
	ipv6_hdr(head)->payload_len = htons(payload_len);
548
	IP6CB(head)->nhoff = nhoff;
L
Linus Torvalds 已提交
549 550

	/* Yes, and fold redundant checksum back. 8) */
551
	if (head->ip_summed == CHECKSUM_COMPLETE)
552
		head->csum = csum_partial(skb_network_header(head),
553
					  skb_network_header_len(head),
554
					  head->csum);
L
Linus Torvalds 已提交
555

556
	rcu_read_lock();
557
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
558
	rcu_read_unlock();
559
	fq->q.fragments = NULL;
L
Linus Torvalds 已提交
560 561 562 563 564 565 566 567 568 569
	return 1;

out_oversize:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
	goto out_fail;
out_oom:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
out_fail:
570
	rcu_read_lock();
571
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
572
	rcu_read_unlock();
L
Linus Torvalds 已提交
573 574 575
	return -1;
}

576
static int ipv6_frag_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
577 578 579
{
	struct frag_hdr *fhdr;
	struct frag_queue *fq;
580
	struct ipv6hdr *hdr = ipv6_hdr(skb);
E
Eric Dumazet 已提交
581
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
582

E
Eric Dumazet 已提交
583
	IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
L
Linus Torvalds 已提交
584 585

	/* Jumbo payload inhibits frag. header */
586 587 588
	if (hdr->payload_len==0)
		goto fail_hdr;

589
	if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
590 591
				 sizeof(struct frag_hdr))))
		goto fail_hdr;
L
Linus Torvalds 已提交
592

593
	hdr = ipv6_hdr(skb);
594
	fhdr = (struct frag_hdr *)skb_transport_header(skb);
L
Linus Torvalds 已提交
595 596 597

	if (!(fhdr->frag_off & htons(0xFFF9))) {
		/* It is not a fragmented frame */
598
		skb->transport_header += sizeof(struct frag_hdr);
599
		IP6_INC_STATS_BH(net,
E
Eric Dumazet 已提交
600
				 ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
L
Linus Torvalds 已提交
601

602
		IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
L
Linus Torvalds 已提交
603 604 605
		return 1;
	}

606
	if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
E
Eric Dumazet 已提交
607
		ip6_evictor(net, ip6_dst_idev(skb_dst(skb)));
L
Linus Torvalds 已提交
608

609
	if ((fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
E
Eric Dumazet 已提交
610
			  ip6_dst_idev(skb_dst(skb)))) != NULL) {
611
		int ret;
L
Linus Torvalds 已提交
612

613
		spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
614

615
		ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
L
Linus Torvalds 已提交
616

617
		spin_unlock(&fq->q.lock);
618
		fq_put(fq);
L
Linus Torvalds 已提交
619 620 621
		return ret;
	}

E
Eric Dumazet 已提交
622
	IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
623 624
	kfree_skb(skb);
	return -1;
625 626

fail_hdr:
E
Eric Dumazet 已提交
627
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
628 629
	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb_network_header_len(skb));
	return -1;
L
Linus Torvalds 已提交
630 631
}

632
static const struct inet6_protocol frag_protocol =
L
Linus Torvalds 已提交
633 634 635 636 637
{
	.handler	=	ipv6_frag_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

638
#ifdef CONFIG_SYSCTL
639
static struct ctl_table ip6_frags_ns_ctl_table[] = {
640 641
	{
		.procname	= "ip6frag_high_thresh",
642
		.data		= &init_net.ipv6.frags.high_thresh,
643 644
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
645
		.proc_handler	= proc_dointvec
646 647 648
	},
	{
		.procname	= "ip6frag_low_thresh",
649
		.data		= &init_net.ipv6.frags.low_thresh,
650 651
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
652
		.proc_handler	= proc_dointvec
653 654 655
	},
	{
		.procname	= "ip6frag_time",
656
		.data		= &init_net.ipv6.frags.timeout,
657 658
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
659
		.proc_handler	= proc_dointvec_jiffies,
660
	},
661 662 663 664
	{ }
};

static struct ctl_table ip6_frags_ctl_table[] = {
665 666
	{
		.procname	= "ip6frag_secret_interval",
667
		.data		= &ip6_frags.secret_interval,
668 669
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
670
		.proc_handler	= proc_dointvec_jiffies,
671 672 673 674
	},
	{ }
};

675
static int ip6_frags_ns_sysctl_register(struct net *net)
676
{
677
	struct ctl_table *table;
678 679
	struct ctl_table_header *hdr;

680
	table = ip6_frags_ns_ctl_table;
O
Octavian Purdila 已提交
681
	if (!net_eq(net, &init_net)) {
682
		table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
683 684 685
		if (table == NULL)
			goto err_alloc;

686 687
		table[0].data = &net->ipv6.frags.high_thresh;
		table[1].data = &net->ipv6.frags.low_thresh;
688
		table[2].data = &net->ipv6.frags.timeout;
689 690 691 692 693 694 695 696 697 698
	}

	hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table);
	if (hdr == NULL)
		goto err_reg;

	net->ipv6.sysctl.frags_hdr = hdr;
	return 0;

err_reg:
O
Octavian Purdila 已提交
699
	if (!net_eq(net, &init_net))
700 701 702 703 704
		kfree(table);
err_alloc:
	return -ENOMEM;
}

705
static void ip6_frags_ns_sysctl_unregister(struct net *net)
706 707 708 709 710
{
	struct ctl_table *table;

	table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
	unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
711 712
	if (!net_eq(net, &init_net))
		kfree(table);
713
}
714 715 716 717 718 719 720 721 722 723 724 725 726 727

static struct ctl_table_header *ip6_ctl_header;

static int ip6_frags_sysctl_register(void)
{
	ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path,
			ip6_frags_ctl_table);
	return ip6_ctl_header == NULL ? -ENOMEM : 0;
}

static void ip6_frags_sysctl_unregister(void)
{
	unregister_net_sysctl_table(ip6_ctl_header);
}
728
#else
729
static inline int ip6_frags_ns_sysctl_register(struct net *net)
730
{
731 732
	return 0;
}
733

734
static inline void ip6_frags_ns_sysctl_unregister(struct net *net)
735 736
{
}
737 738 739 740 741 742 743 744 745

static inline int ip6_frags_sysctl_register(void)
{
	return 0;
}

static inline void ip6_frags_sysctl_unregister(void)
{
}
746
#endif
D
Daniel Lezcano 已提交
747

748 749
static int ipv6_frags_init_net(struct net *net)
{
750 751
	net->ipv6.frags.high_thresh = 256 * 1024;
	net->ipv6.frags.low_thresh = 192 * 1024;
752
	net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT;
753

754 755
	inet_frags_init_net(&net->ipv6.frags);

756
	return ip6_frags_ns_sysctl_register(net);
757 758
}

759 760
static void ipv6_frags_exit_net(struct net *net)
{
761
	ip6_frags_ns_sysctl_unregister(net);
762 763 764 765 766 767 768 769
	inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
}

static struct pernet_operations ip6_frags_ops = {
	.init = ipv6_frags_init_net,
	.exit = ipv6_frags_exit_net,
};

770
int __init ipv6_frag_init(void)
L
Linus Torvalds 已提交
771
{
772
	int ret;
L
Linus Torvalds 已提交
773

774 775 776
	ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT);
	if (ret)
		goto out;
777

778 779 780 781
	ret = ip6_frags_sysctl_register();
	if (ret)
		goto err_sysctl;

782 783 784
	ret = register_pernet_subsys(&ip6_frags_ops);
	if (ret)
		goto err_pernet;
785

786
	ip6_frags.hashfn = ip6_hashfn;
787
	ip6_frags.constructor = ip6_frag_init;
788
	ip6_frags.destructor = NULL;
789 790
	ip6_frags.skb_free = NULL;
	ip6_frags.qsize = sizeof(struct frag_queue);
791
	ip6_frags.match = ip6_frag_match;
792
	ip6_frags.frag_expire = ip6_frag_expire;
793
	ip6_frags.secret_interval = 10 * 60 * HZ;
794
	inet_frags_init(&ip6_frags);
795 796
out:
	return ret;
797 798

err_pernet:
799 800
	ip6_frags_sysctl_unregister();
err_sysctl:
801 802
	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
	goto out;
803 804 805 806 807
}

void ipv6_frag_exit(void)
{
	inet_frags_fini(&ip6_frags);
808
	ip6_frags_sysctl_unregister();
809
	unregister_pernet_subsys(&ip6_frags_ops);
810
	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
L
Linus Torvalds 已提交
811
}