reassembly.c 19.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 fragment reassembly
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15
 *
 *	Based on: net/ipv4/ip_fragment.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

16 17
/*
 *	Fixes:
L
Linus Torvalds 已提交
18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
 *	Andi Kleen	Make it work with multiple hosts.
 *			More RFC compliance.
 *
 *      Horst von Brand Add missing #include <linux/string.h>
 *	Alexey Kuznetsov	SMP races, threading, cleanup.
 *	Patrick McHardy		LRU queue of frag heads for evictor.
 *	Mitsuru KANDA @USAGI	Register inet6_protocol{}.
 *	David Stevens and
 *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
 *				calculate ICV correctly.
 */
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
#include <linux/net.h>
#include <linux/list.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/jhash.h>
43
#include <linux/skbuff.h>
L
Linus Torvalds 已提交
44 45 46 47 48

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
49
#include <net/ip6_route.h>
L
Linus Torvalds 已提交
50 51 52 53 54
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
55
#include <net/inet_frag.h>
L
Linus Torvalds 已提交
56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71

struct ip6frag_skb_cb
{
	struct inet6_skb_parm	h;
	int			offset;
};

#define FRAG6_CB(skb)	((struct ip6frag_skb_cb*)((skb)->cb))


/*
 *	Equivalent of ipv4 struct ipq
 */

struct frag_queue
{
72
	struct inet_frag_queue	q;
L
Linus Torvalds 已提交
73

A
Al Viro 已提交
74
	__be32			id;		/* fragment id		*/
75
	u32			user;
L
Linus Torvalds 已提交
76 77 78 79 80 81 82 83
	struct in6_addr		saddr;
	struct in6_addr		daddr;

	int			iif;
	unsigned int		csum;
	__u16			nhoffset;
};

84
static struct inet_frags ip6_frags;
L
Linus Torvalds 已提交
85

86
int ip6_frag_nqueues(struct net *net)
87
{
88
	return net->ipv6.frags.nqueues;
89
}
L
Linus Torvalds 已提交
90

91
int ip6_frag_mem(struct net *net)
92
{
93
	return atomic_read(&net->ipv6.frags.mem);
94
}
L
Linus Torvalds 已提交
95

96 97 98
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
			  struct net_device *dev);

99 100 101 102
/*
 * callers should be careful not to use the hash value outside the ipfrag_lock
 * as doing so could race with ipfrag_hash_rnd being recalculated.
 */
103 104
unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
			     const struct in6_addr *daddr, u32 rnd)
L
Linus Torvalds 已提交
105 106 107
{
	u32 a, b, c;

A
Al Viro 已提交
108 109 110
	a = (__force u32)saddr->s6_addr32[0];
	b = (__force u32)saddr->s6_addr32[1];
	c = (__force u32)saddr->s6_addr32[2];
L
Linus Torvalds 已提交
111 112 113

	a += JHASH_GOLDEN_RATIO;
	b += JHASH_GOLDEN_RATIO;
114
	c += rnd;
L
Linus Torvalds 已提交
115 116
	__jhash_mix(a, b, c);

A
Al Viro 已提交
117 118 119
	a += (__force u32)saddr->s6_addr32[3];
	b += (__force u32)daddr->s6_addr32[0];
	c += (__force u32)daddr->s6_addr32[1];
L
Linus Torvalds 已提交
120 121
	__jhash_mix(a, b, c);

A
Al Viro 已提交
122 123 124
	a += (__force u32)daddr->s6_addr32[2];
	b += (__force u32)daddr->s6_addr32[3];
	c += (__force u32)id;
L
Linus Torvalds 已提交
125 126
	__jhash_mix(a, b, c);

127
	return c & (INETFRAGS_HASHSZ - 1);
L
Linus Torvalds 已提交
128
}
129
EXPORT_SYMBOL_GPL(inet6_hash_frag);
L
Linus Torvalds 已提交
130

131
static unsigned int ip6_hashfn(struct inet_frag_queue *q)
L
Linus Torvalds 已提交
132
{
133
	struct frag_queue *fq;
L
Linus Torvalds 已提交
134

135
	fq = container_of(q, struct frag_queue, q);
136
	return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd);
L
Linus Torvalds 已提交
137 138
}

139 140 141 142 143 144
int ip6_frag_match(struct inet_frag_queue *q, void *a)
{
	struct frag_queue *fq;
	struct ip6_create_arg *arg = a;

	fq = container_of(q, struct frag_queue, q);
145
	return (fq->id == arg->id && fq->user == arg->user &&
146 147 148 149 150
			ipv6_addr_equal(&fq->saddr, arg->src) &&
			ipv6_addr_equal(&fq->daddr, arg->dst));
}
EXPORT_SYMBOL(ip6_frag_match);

L
Linus Torvalds 已提交
151
/* Memory Tracking Functions. */
152 153
static inline void frag_kfree_skb(struct netns_frags *nf,
		struct sk_buff *skb, int *work)
L
Linus Torvalds 已提交
154 155 156
{
	if (work)
		*work -= skb->truesize;
157
	atomic_sub(skb->truesize, &nf->mem);
L
Linus Torvalds 已提交
158 159 160
	kfree_skb(skb);
}

161
void ip6_frag_init(struct inet_frag_queue *q, void *a)
L
Linus Torvalds 已提交
162
{
163 164 165 166
	struct frag_queue *fq = container_of(q, struct frag_queue, q);
	struct ip6_create_arg *arg = a;

	fq->id = arg->id;
167
	fq->user = arg->user;
168 169
	ipv6_addr_copy(&fq->saddr, arg->src);
	ipv6_addr_copy(&fq->daddr, arg->dst);
L
Linus Torvalds 已提交
170
}
171
EXPORT_SYMBOL(ip6_frag_init);
L
Linus Torvalds 已提交
172 173 174

/* Destruction primitives. */

175
static __inline__ void fq_put(struct frag_queue *fq)
L
Linus Torvalds 已提交
176
{
P
Pavel Emelyanov 已提交
177
	inet_frag_put(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
178 179 180 181 182 183 184
}

/* Kill fq entry. It is not destroyed immediately,
 * because caller (and someone more) holds reference count.
 */
static __inline__ void fq_kill(struct frag_queue *fq)
{
185
	inet_frag_kill(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
186 187
}

188
static void ip6_evictor(struct net *net, struct inet6_dev *idev)
L
Linus Torvalds 已提交
189
{
190 191
	int evicted;

192
	evicted = inet_frag_evictor(&net->ipv6.frags, &ip6_frags);
193
	if (evicted)
194
		IP6_ADD_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS, evicted);
L
Linus Torvalds 已提交
195 196 197 198
}

static void ip6_frag_expire(unsigned long data)
{
199
	struct frag_queue *fq;
200
	struct net_device *dev = NULL;
201
	struct net *net;
L
Linus Torvalds 已提交
202

203 204
	fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);

205
	spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
206

207
	if (fq->q.last_in & INET_FRAG_COMPLETE)
L
Linus Torvalds 已提交
208 209 210 211
		goto out;

	fq_kill(fq);

212
	net = container_of(fq->q.net, struct net, ipv6.frags);
E
Eric Dumazet 已提交
213 214
	rcu_read_lock();
	dev = dev_get_by_index_rcu(net, fq->iif);
215
	if (!dev)
E
Eric Dumazet 已提交
216
		goto out_rcu_unlock;
217

218 219
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
220

221
	/* Don't send error if the first segment did not arrive. */
222
	if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments)
E
Eric Dumazet 已提交
223
		goto out_rcu_unlock;
224 225 226 227 228 229

	/*
	   But use as source device on which LAST ARRIVED
	   segment was received. And do not use fq->dev
	   pointer directly, device might already disappeared.
	 */
230 231
	fq->q.fragments->dev = dev;
	icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
E
Eric Dumazet 已提交
232 233
out_rcu_unlock:
	rcu_read_unlock();
L
Linus Torvalds 已提交
234
out:
235
	spin_unlock(&fq->q.lock);
236
	fq_put(fq);
L
Linus Torvalds 已提交
237 238
}

239
static __inline__ struct frag_queue *
240
fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst)
L
Linus Torvalds 已提交
241
{
242 243
	struct inet_frag_queue *q;
	struct ip6_create_arg arg;
244
	unsigned int hash;
L
Linus Torvalds 已提交
245

246
	arg.id = id;
247
	arg.user = IP6_DEFRAG_LOCAL_DELIVER;
248 249
	arg.src = src;
	arg.dst = dst;
250 251

	read_lock(&ip6_frags.lock);
252
	hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
L
Linus Torvalds 已提交
253

254
	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
255
	if (q == NULL)
256
		return NULL;
L
Linus Torvalds 已提交
257

258
	return container_of(q, struct frag_queue, q);
L
Linus Torvalds 已提交
259 260
}

261
static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
L
Linus Torvalds 已提交
262 263 264
			   struct frag_hdr *fhdr, int nhoff)
{
	struct sk_buff *prev, *next;
265
	struct net_device *dev;
L
Linus Torvalds 已提交
266
	int offset, end;
E
Eric Dumazet 已提交
267
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
268

269
	if (fq->q.last_in & INET_FRAG_COMPLETE)
L
Linus Torvalds 已提交
270 271 272
		goto err;

	offset = ntohs(fhdr->frag_off) & ~0x7;
273 274
	end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
L
Linus Torvalds 已提交
275 276

	if ((unsigned int)end > IPV6_MAXPLEN) {
E
Eric Dumazet 已提交
277
		IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
278
				 IPSTATS_MIB_INHDRERRORS);
279 280 281
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  ((u8 *)&fhdr->frag_off -
				   skb_network_header(skb)));
282
		return -1;
L
Linus Torvalds 已提交
283 284
	}

285 286
	if (skb->ip_summed == CHECKSUM_COMPLETE) {
		const unsigned char *nh = skb_network_header(skb);
287
		skb->csum = csum_sub(skb->csum,
288 289 290
				     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
						  0));
	}
L
Linus Torvalds 已提交
291 292 293 294 295 296

	/* Is this the final fragment? */
	if (!(fhdr->frag_off & htons(IP6_MF))) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrupted.
		 */
297
		if (end < fq->q.len ||
298
		    ((fq->q.last_in & INET_FRAG_LAST_IN) && end != fq->q.len))
L
Linus Torvalds 已提交
299
			goto err;
300
		fq->q.last_in |= INET_FRAG_LAST_IN;
301
		fq->q.len = end;
L
Linus Torvalds 已提交
302 303 304 305 306 307 308 309
	} else {
		/* Check if the fragment is rounded to 8 bytes.
		 * Required by the RFC.
		 */
		if (end & 0x7) {
			/* RFC2460 says always send parameter problem in
			 * this case. -DaveM
			 */
E
Eric Dumazet 已提交
310
			IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
311
					 IPSTATS_MIB_INHDRERRORS);
312
			icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
L
Linus Torvalds 已提交
313
					  offsetof(struct ipv6hdr, payload_len));
314
			return -1;
L
Linus Torvalds 已提交
315
		}
316
		if (end > fq->q.len) {
L
Linus Torvalds 已提交
317
			/* Some bits beyond end -> corruption. */
318
			if (fq->q.last_in & INET_FRAG_LAST_IN)
L
Linus Torvalds 已提交
319
				goto err;
320
			fq->q.len = end;
L
Linus Torvalds 已提交
321 322 323 324 325 326 327 328 329
		}
	}

	if (end == offset)
		goto err;

	/* Point into the IP datagram 'data' part. */
	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
		goto err;
330

331 332
	if (pskb_trim_rcsum(skb, end - offset))
		goto err;
L
Linus Torvalds 已提交
333 334 335 336 337 338

	/* Find out which fragments are in front and at the back of us
	 * in the chain of fragments so far.  We must know where to put
	 * this fragment, right?
	 */
	prev = NULL;
339
	for(next = fq->q.fragments; next != NULL; next = next->next) {
L
Linus Torvalds 已提交
340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375
		if (FRAG6_CB(next)->offset >= offset)
			break;	/* bingo! */
		prev = next;
	}

	/* We found where to put this one.  Check for overlap with
	 * preceding fragment, and, if needed, align things so that
	 * any overlaps are eliminated.
	 */
	if (prev) {
		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;

		if (i > 0) {
			offset += i;
			if (end <= offset)
				goto err;
			if (!pskb_pull(skb, i))
				goto err;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
	}

	/* Look for overlap with succeeding segments.
	 * If we can merge fragments, do it.
	 */
	while (next && FRAG6_CB(next)->offset < end) {
		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */

		if (i < next->len) {
			/* Eat head of the next overlapped fragment
			 * and leave the loop. The next ones cannot overlap.
			 */
			if (!pskb_pull(next, i))
				goto err;
			FRAG6_CB(next)->offset += i;	/* next fragment */
376
			fq->q.meat -= i;
L
Linus Torvalds 已提交
377 378 379 380 381 382 383 384 385 386 387 388 389 390
			if (next->ip_summed != CHECKSUM_UNNECESSARY)
				next->ip_summed = CHECKSUM_NONE;
			break;
		} else {
			struct sk_buff *free_it = next;

			/* Old fragment is completely overridden with
			 * new one drop it.
			 */
			next = next->next;

			if (prev)
				prev->next = next;
			else
391
				fq->q.fragments = next;
L
Linus Torvalds 已提交
392

393
			fq->q.meat -= free_it->len;
394
			frag_kfree_skb(fq->q.net, free_it, NULL);
L
Linus Torvalds 已提交
395 396 397 398 399 400 401 402 403 404
		}
	}

	FRAG6_CB(skb)->offset = offset;

	/* Insert this fragment in the chain of fragments. */
	skb->next = next;
	if (prev)
		prev->next = skb;
	else
405
		fq->q.fragments = skb;
L
Linus Torvalds 已提交
406

407 408 409 410 411
	dev = skb->dev;
	if (dev) {
		fq->iif = dev->ifindex;
		skb->dev = NULL;
	}
412 413
	fq->q.stamp = skb->tstamp;
	fq->q.meat += skb->len;
414
	atomic_add(skb->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
415 416 417 418 419 420

	/* The first fragment.
	 * nhoffset is obtained from the first fragment, of course.
	 */
	if (offset == 0) {
		fq->nhoffset = nhoff;
421
		fq->q.last_in |= INET_FRAG_FIRST_IN;
L
Linus Torvalds 已提交
422
	}
423

424 425
	if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
	    fq->q.meat == fq->q.len)
426 427
		return ip6_frag_reasm(fq, prev, dev);

428
	write_lock(&ip6_frags.lock);
429
	list_move_tail(&fq->q.lru_list, &fq->q.net->lru_list);
430
	write_unlock(&ip6_frags.lock);
431
	return -1;
L
Linus Torvalds 已提交
432 433

err:
E
Eric Dumazet 已提交
434
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
435
		      IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
436
	kfree_skb(skb);
437
	return -1;
L
Linus Torvalds 已提交
438 439 440 441 442 443 444 445 446 447 448
}

/*
 *	Check if this packet is complete.
 *	Returns NULL on failure by any reason, and pointer
 *	to current nexthdr field in reassembled frame.
 *
 *	It is called with locked fq, and caller must check that
 *	queue is eligible for reassembly i.e. it is not COMPLETE,
 *	the last and the first frames arrived and all the bits are here.
 */
449
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
L
Linus Torvalds 已提交
450 451
			  struct net_device *dev)
{
452
	struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
453
	struct sk_buff *fp, *head = fq->q.fragments;
L
Linus Torvalds 已提交
454 455 456 457 458
	int    payload_len;
	unsigned int nhoff;

	fq_kill(fq);

459 460 461 462 463 464 465 466 467 468 469
	/* Make the one we just received the head. */
	if (prev) {
		head = prev->next;
		fp = skb_clone(head, GFP_ATOMIC);

		if (!fp)
			goto out_oom;

		fp->next = head->next;
		prev->next = fp;

470 471
		skb_morph(head, fq->q.fragments);
		head->next = fq->q.fragments->next;
472

473 474
		kfree_skb(fq->q.fragments);
		fq->q.fragments = head;
475 476
	}

477 478
	WARN_ON(head == NULL);
	WARN_ON(FRAG6_CB(head)->offset != 0);
L
Linus Torvalds 已提交
479 480

	/* Unfragmented part is taken from the first segment. */
481
	payload_len = ((head->data - skb_network_header(head)) -
482
		       sizeof(struct ipv6hdr) + fq->q.len -
483
		       sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
484 485 486 487 488 489 490 491 492 493
	if (payload_len > IPV6_MAXPLEN)
		goto out_oversize;

	/* Head of list must not be cloned. */
	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
		goto out_oom;

	/* If the first fragment is fragmented itself, we split
	 * it to two chunks: the first with data and paged part
	 * and the second, holding only fragments. */
494
	if (skb_has_frags(head)) {
L
Linus Torvalds 已提交
495 496 497 498 499 500 501 502
		struct sk_buff *clone;
		int i, plen = 0;

		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
			goto out_oom;
		clone->next = head->next;
		head->next = clone;
		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
503
		skb_frag_list_init(head);
L
Linus Torvalds 已提交
504 505 506 507 508 509 510
		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
			plen += skb_shinfo(head)->frags[i].size;
		clone->len = clone->data_len = head->data_len - plen;
		head->data_len -= clone->len;
		head->len -= clone->len;
		clone->csum = 0;
		clone->ip_summed = head->ip_summed;
511
		atomic_add(clone->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
512 513 514 515 516
	}

	/* We have to remove fragment header from datagram and to relocate
	 * header in order to calculate ICV correctly. */
	nhoff = fq->nhoffset;
517
	skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
518
	memmove(head->head + sizeof(struct frag_hdr), head->head,
L
Linus Torvalds 已提交
519
		(head->data - head->head) - sizeof(struct frag_hdr));
520 521
	head->mac_header += sizeof(struct frag_hdr);
	head->network_header += sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
522 523

	skb_shinfo(head)->frag_list = head->next;
524
	skb_reset_transport_header(head);
525
	skb_push(head, head->data - skb_network_header(head));
526
	atomic_sub(head->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
527 528 529 530 531 532

	for (fp=head->next; fp; fp = fp->next) {
		head->data_len += fp->len;
		head->len += fp->len;
		if (head->ip_summed != fp->ip_summed)
			head->ip_summed = CHECKSUM_NONE;
533
		else if (head->ip_summed == CHECKSUM_COMPLETE)
L
Linus Torvalds 已提交
534 535
			head->csum = csum_add(head->csum, fp->csum);
		head->truesize += fp->truesize;
536
		atomic_sub(fp->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
537 538 539 540
	}

	head->next = NULL;
	head->dev = dev;
541
	head->tstamp = fq->q.stamp;
542
	ipv6_hdr(head)->payload_len = htons(payload_len);
543
	IP6CB(head)->nhoff = nhoff;
L
Linus Torvalds 已提交
544 545

	/* Yes, and fold redundant checksum back. 8) */
546
	if (head->ip_summed == CHECKSUM_COMPLETE)
547
		head->csum = csum_partial(skb_network_header(head),
548
					  skb_network_header_len(head),
549
					  head->csum);
L
Linus Torvalds 已提交
550

551
	rcu_read_lock();
552
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
553
	rcu_read_unlock();
554
	fq->q.fragments = NULL;
L
Linus Torvalds 已提交
555 556 557 558 559 560 561 562 563 564
	return 1;

out_oversize:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
	goto out_fail;
out_oom:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
out_fail:
565
	rcu_read_lock();
566
	IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
567
	rcu_read_unlock();
L
Linus Torvalds 已提交
568 569 570
	return -1;
}

571
static int ipv6_frag_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
572 573 574
{
	struct frag_hdr *fhdr;
	struct frag_queue *fq;
575
	struct ipv6hdr *hdr = ipv6_hdr(skb);
E
Eric Dumazet 已提交
576
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
577

E
Eric Dumazet 已提交
578
	IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
L
Linus Torvalds 已提交
579 580

	/* Jumbo payload inhibits frag. header */
581 582 583
	if (hdr->payload_len==0)
		goto fail_hdr;

584
	if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
585 586
				 sizeof(struct frag_hdr))))
		goto fail_hdr;
L
Linus Torvalds 已提交
587

588
	hdr = ipv6_hdr(skb);
589
	fhdr = (struct frag_hdr *)skb_transport_header(skb);
L
Linus Torvalds 已提交
590 591 592

	if (!(fhdr->frag_off & htons(0xFFF9))) {
		/* It is not a fragmented frame */
593
		skb->transport_header += sizeof(struct frag_hdr);
594
		IP6_INC_STATS_BH(net,
E
Eric Dumazet 已提交
595
				 ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
L
Linus Torvalds 已提交
596

597
		IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
L
Linus Torvalds 已提交
598 599 600
		return 1;
	}

601
	if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
E
Eric Dumazet 已提交
602
		ip6_evictor(net, ip6_dst_idev(skb_dst(skb)));
L
Linus Torvalds 已提交
603

604 605
	fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr);
	if (fq != NULL) {
606
		int ret;
L
Linus Torvalds 已提交
607

608
		spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
609

610
		ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
L
Linus Torvalds 已提交
611

612
		spin_unlock(&fq->q.lock);
613
		fq_put(fq);
L
Linus Torvalds 已提交
614 615 616
		return ret;
	}

E
Eric Dumazet 已提交
617
	IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
618 619
	kfree_skb(skb);
	return -1;
620 621

fail_hdr:
E
Eric Dumazet 已提交
622
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
623 624
	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb_network_header_len(skb));
	return -1;
L
Linus Torvalds 已提交
625 626
}

627
static const struct inet6_protocol frag_protocol =
L
Linus Torvalds 已提交
628 629 630 631 632
{
	.handler	=	ipv6_frag_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

633
#ifdef CONFIG_SYSCTL
634
static struct ctl_table ip6_frags_ns_ctl_table[] = {
635 636
	{
		.procname	= "ip6frag_high_thresh",
637
		.data		= &init_net.ipv6.frags.high_thresh,
638 639
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
640
		.proc_handler	= proc_dointvec
641 642 643
	},
	{
		.procname	= "ip6frag_low_thresh",
644
		.data		= &init_net.ipv6.frags.low_thresh,
645 646
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
647
		.proc_handler	= proc_dointvec
648 649 650
	},
	{
		.procname	= "ip6frag_time",
651
		.data		= &init_net.ipv6.frags.timeout,
652 653
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
654
		.proc_handler	= proc_dointvec_jiffies,
655
	},
656 657 658 659
	{ }
};

static struct ctl_table ip6_frags_ctl_table[] = {
660 661
	{
		.procname	= "ip6frag_secret_interval",
662
		.data		= &ip6_frags.secret_interval,
663 664
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
665
		.proc_handler	= proc_dointvec_jiffies,
666 667 668 669
	},
	{ }
};

670
static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
671
{
672
	struct ctl_table *table;
673 674
	struct ctl_table_header *hdr;

675
	table = ip6_frags_ns_ctl_table;
O
Octavian Purdila 已提交
676
	if (!net_eq(net, &init_net)) {
677
		table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
678 679 680
		if (table == NULL)
			goto err_alloc;

681 682
		table[0].data = &net->ipv6.frags.high_thresh;
		table[1].data = &net->ipv6.frags.low_thresh;
683
		table[2].data = &net->ipv6.frags.timeout;
684 685 686 687 688 689 690 691 692 693
	}

	hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table);
	if (hdr == NULL)
		goto err_reg;

	net->ipv6.sysctl.frags_hdr = hdr;
	return 0;

err_reg:
O
Octavian Purdila 已提交
694
	if (!net_eq(net, &init_net))
695 696 697 698 699
		kfree(table);
err_alloc:
	return -ENOMEM;
}

700
static void __net_exit ip6_frags_ns_sysctl_unregister(struct net *net)
701 702 703 704 705
{
	struct ctl_table *table;

	table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
	unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
706 707
	if (!net_eq(net, &init_net))
		kfree(table);
708
}
709 710 711 712 713 714 715 716 717 718 719 720 721 722

static struct ctl_table_header *ip6_ctl_header;

static int ip6_frags_sysctl_register(void)
{
	ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path,
			ip6_frags_ctl_table);
	return ip6_ctl_header == NULL ? -ENOMEM : 0;
}

static void ip6_frags_sysctl_unregister(void)
{
	unregister_net_sysctl_table(ip6_ctl_header);
}
723
#else
724
static inline int ip6_frags_ns_sysctl_register(struct net *net)
725
{
726 727
	return 0;
}
728

729
static inline void ip6_frags_ns_sysctl_unregister(struct net *net)
730 731
{
}
732 733 734 735 736 737 738 739 740

static inline int ip6_frags_sysctl_register(void)
{
	return 0;
}

static inline void ip6_frags_sysctl_unregister(void)
{
}
741
#endif
D
Daniel Lezcano 已提交
742

743
static int __net_init ipv6_frags_init_net(struct net *net)
744
{
745 746
	net->ipv6.frags.high_thresh = 256 * 1024;
	net->ipv6.frags.low_thresh = 192 * 1024;
747
	net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT;
748

749 750
	inet_frags_init_net(&net->ipv6.frags);

751
	return ip6_frags_ns_sysctl_register(net);
752 753
}

754
static void __net_exit ipv6_frags_exit_net(struct net *net)
755
{
756
	ip6_frags_ns_sysctl_unregister(net);
757 758 759 760 761 762 763 764
	inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
}

static struct pernet_operations ip6_frags_ops = {
	.init = ipv6_frags_init_net,
	.exit = ipv6_frags_exit_net,
};

765
int __init ipv6_frag_init(void)
L
Linus Torvalds 已提交
766
{
767
	int ret;
L
Linus Torvalds 已提交
768

769 770 771
	ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT);
	if (ret)
		goto out;
772

773 774 775 776
	ret = ip6_frags_sysctl_register();
	if (ret)
		goto err_sysctl;

777 778 779
	ret = register_pernet_subsys(&ip6_frags_ops);
	if (ret)
		goto err_pernet;
780

781
	ip6_frags.hashfn = ip6_hashfn;
782
	ip6_frags.constructor = ip6_frag_init;
783
	ip6_frags.destructor = NULL;
784 785
	ip6_frags.skb_free = NULL;
	ip6_frags.qsize = sizeof(struct frag_queue);
786
	ip6_frags.match = ip6_frag_match;
787
	ip6_frags.frag_expire = ip6_frag_expire;
788
	ip6_frags.secret_interval = 10 * 60 * HZ;
789
	inet_frags_init(&ip6_frags);
790 791
out:
	return ret;
792 793

err_pernet:
794 795
	ip6_frags_sysctl_unregister();
err_sysctl:
796 797
	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
	goto out;
798 799 800 801 802
}

void ipv6_frag_exit(void)
{
	inet_frags_fini(&ip6_frags);
803
	ip6_frags_sysctl_unregister();
804
	unregister_pernet_subsys(&ip6_frags_ops);
805
	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
L
Linus Torvalds 已提交
806
}