reassembly.c 19.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 fragment reassembly
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15
 *
 *	Based on: net/ipv4/ip_fragment.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

16 17
/*
 *	Fixes:
L
Linus Torvalds 已提交
18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
 *	Andi Kleen	Make it work with multiple hosts.
 *			More RFC compliance.
 *
 *      Horst von Brand Add missing #include <linux/string.h>
 *	Alexey Kuznetsov	SMP races, threading, cleanup.
 *	Patrick McHardy		LRU queue of frag heads for evictor.
 *	Mitsuru KANDA @USAGI	Register inet6_protocol{}.
 *	David Stevens and
 *	YOSHIFUJI,H. @USAGI	Always remove fragment header to
 *				calculate ICV correctly.
 */
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
#include <linux/net.h>
#include <linux/list.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/jhash.h>
43
#include <linux/skbuff.h>
L
Linus Torvalds 已提交
44 45 46 47 48

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
49
#include <net/ip6_route.h>
L
Linus Torvalds 已提交
50 51 52 53 54
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
55
#include <net/inet_frag.h>
L
Linus Torvalds 已提交
56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71

struct ip6frag_skb_cb
{
	struct inet6_skb_parm	h;
	int			offset;
};

#define FRAG6_CB(skb)	((struct ip6frag_skb_cb*)((skb)->cb))


/*
 *	Equivalent of ipv4 struct ipq
 */

struct frag_queue
{
72
	struct inet_frag_queue	q;
L
Linus Torvalds 已提交
73

A
Al Viro 已提交
74
	__be32			id;		/* fragment id		*/
L
Linus Torvalds 已提交
75 76 77 78 79 80 81 82
	struct in6_addr		saddr;
	struct in6_addr		daddr;

	int			iif;
	unsigned int		csum;
	__u16			nhoffset;
};

83
static struct inet_frags ip6_frags;
L
Linus Torvalds 已提交
84

85
int ip6_frag_nqueues(struct net *net)
86
{
87
	return net->ipv6.frags.nqueues;
88
}
L
Linus Torvalds 已提交
89

90
int ip6_frag_mem(struct net *net)
91
{
92
	return atomic_read(&net->ipv6.frags.mem);
93
}
L
Linus Torvalds 已提交
94

95 96 97
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
			  struct net_device *dev);

98 99 100 101
/*
 * callers should be careful not to use the hash value outside the ipfrag_lock
 * as doing so could race with ipfrag_hash_rnd being recalculated.
 */
102 103
unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
			     const struct in6_addr *daddr, u32 rnd)
L
Linus Torvalds 已提交
104 105 106
{
	u32 a, b, c;

A
Al Viro 已提交
107 108 109
	a = (__force u32)saddr->s6_addr32[0];
	b = (__force u32)saddr->s6_addr32[1];
	c = (__force u32)saddr->s6_addr32[2];
L
Linus Torvalds 已提交
110 111 112

	a += JHASH_GOLDEN_RATIO;
	b += JHASH_GOLDEN_RATIO;
113
	c += rnd;
L
Linus Torvalds 已提交
114 115
	__jhash_mix(a, b, c);

A
Al Viro 已提交
116 117 118
	a += (__force u32)saddr->s6_addr32[3];
	b += (__force u32)daddr->s6_addr32[0];
	c += (__force u32)daddr->s6_addr32[1];
L
Linus Torvalds 已提交
119 120
	__jhash_mix(a, b, c);

A
Al Viro 已提交
121 122 123
	a += (__force u32)daddr->s6_addr32[2];
	b += (__force u32)daddr->s6_addr32[3];
	c += (__force u32)id;
L
Linus Torvalds 已提交
124 125
	__jhash_mix(a, b, c);

126
	return c & (INETFRAGS_HASHSZ - 1);
L
Linus Torvalds 已提交
127
}
128
EXPORT_SYMBOL_GPL(inet6_hash_frag);
L
Linus Torvalds 已提交
129

130
static unsigned int ip6_hashfn(struct inet_frag_queue *q)
L
Linus Torvalds 已提交
131
{
132
	struct frag_queue *fq;
L
Linus Torvalds 已提交
133

134
	fq = container_of(q, struct frag_queue, q);
135
	return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd);
L
Linus Torvalds 已提交
136 137
}

138 139 140 141 142 143 144 145 146 147 148 149
int ip6_frag_match(struct inet_frag_queue *q, void *a)
{
	struct frag_queue *fq;
	struct ip6_create_arg *arg = a;

	fq = container_of(q, struct frag_queue, q);
	return (fq->id == arg->id &&
			ipv6_addr_equal(&fq->saddr, arg->src) &&
			ipv6_addr_equal(&fq->daddr, arg->dst));
}
EXPORT_SYMBOL(ip6_frag_match);

L
Linus Torvalds 已提交
150
/* Memory Tracking Functions. */
151 152
static inline void frag_kfree_skb(struct netns_frags *nf,
		struct sk_buff *skb, int *work)
L
Linus Torvalds 已提交
153 154 155
{
	if (work)
		*work -= skb->truesize;
156
	atomic_sub(skb->truesize, &nf->mem);
L
Linus Torvalds 已提交
157 158 159
	kfree_skb(skb);
}

160
void ip6_frag_init(struct inet_frag_queue *q, void *a)
L
Linus Torvalds 已提交
161
{
162 163 164 165 166 167
	struct frag_queue *fq = container_of(q, struct frag_queue, q);
	struct ip6_create_arg *arg = a;

	fq->id = arg->id;
	ipv6_addr_copy(&fq->saddr, arg->src);
	ipv6_addr_copy(&fq->daddr, arg->dst);
L
Linus Torvalds 已提交
168
}
169
EXPORT_SYMBOL(ip6_frag_init);
L
Linus Torvalds 已提交
170 171 172

/* Destruction primitives. */

173
static __inline__ void fq_put(struct frag_queue *fq)
L
Linus Torvalds 已提交
174
{
P
Pavel Emelyanov 已提交
175
	inet_frag_put(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
176 177 178 179 180 181 182
}

/* Kill fq entry. It is not destroyed immediately,
 * because caller (and someone more) holds reference count.
 */
static __inline__ void fq_kill(struct frag_queue *fq)
{
183
	inet_frag_kill(&fq->q, &ip6_frags);
L
Linus Torvalds 已提交
184 185
}

186
static void ip6_evictor(struct net *net, struct inet6_dev *idev)
L
Linus Torvalds 已提交
187
{
188 189
	int evicted;

190
	evicted = inet_frag_evictor(&net->ipv6.frags, &ip6_frags);
191 192
	if (evicted)
		IP6_ADD_STATS_BH(idev, IPSTATS_MIB_REASMFAILS, evicted);
L
Linus Torvalds 已提交
193 194 195 196
}

static void ip6_frag_expire(unsigned long data)
{
197
	struct frag_queue *fq;
198
	struct net_device *dev = NULL;
199
	struct net *net;
L
Linus Torvalds 已提交
200

201 202
	fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);

203
	spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
204

205
	if (fq->q.last_in & INET_FRAG_COMPLETE)
L
Linus Torvalds 已提交
206 207 208 209
		goto out;

	fq_kill(fq);

210 211
	net = container_of(fq->q.net, struct net, ipv6.frags);
	dev = dev_get_by_index(net, fq->iif);
212 213 214 215 216 217 218
	if (!dev)
		goto out;

	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
	rcu_read_unlock();
L
Linus Torvalds 已提交
219

220
	/* Don't send error if the first segment did not arrive. */
221
	if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments)
222 223 224 225 226 227 228
		goto out;

	/*
	   But use as source device on which LAST ARRIVED
	   segment was received. And do not use fq->dev
	   pointer directly, device might already disappeared.
	 */
229 230
	fq->q.fragments->dev = dev;
	icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
L
Linus Torvalds 已提交
231
out:
232 233
	if (dev)
		dev_put(dev);
234
	spin_unlock(&fq->q.lock);
235
	fq_put(fq);
L
Linus Torvalds 已提交
236 237
}

238
static __inline__ struct frag_queue *
239
fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
240
	struct inet6_dev *idev)
L
Linus Torvalds 已提交
241
{
242 243
	struct inet_frag_queue *q;
	struct ip6_create_arg arg;
244
	unsigned int hash;
L
Linus Torvalds 已提交
245

246 247 248
	arg.id = id;
	arg.src = src;
	arg.dst = dst;
249 250

	read_lock(&ip6_frags.lock);
251
	hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
L
Linus Torvalds 已提交
252

253
	q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
254 255
	if (q == NULL)
		goto oom;
L
Linus Torvalds 已提交
256

257
	return container_of(q, struct frag_queue, q);
L
Linus Torvalds 已提交
258 259

oom:
260
	IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
261 262 263
	return NULL;
}

264
static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
L
Linus Torvalds 已提交
265 266 267
			   struct frag_hdr *fhdr, int nhoff)
{
	struct sk_buff *prev, *next;
268
	struct net_device *dev;
L
Linus Torvalds 已提交
269 270
	int offset, end;

271
	if (fq->q.last_in & INET_FRAG_COMPLETE)
L
Linus Torvalds 已提交
272 273 274
		goto err;

	offset = ntohs(fhdr->frag_off) & ~0x7;
275 276
	end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
L
Linus Torvalds 已提交
277 278

	if ((unsigned int)end > IPV6_MAXPLEN) {
279 280
		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
				 IPSTATS_MIB_INHDRERRORS);
281 282 283
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
				  ((u8 *)&fhdr->frag_off -
				   skb_network_header(skb)));
284
		return -1;
L
Linus Torvalds 已提交
285 286
	}

287 288
	if (skb->ip_summed == CHECKSUM_COMPLETE) {
		const unsigned char *nh = skb_network_header(skb);
289
		skb->csum = csum_sub(skb->csum,
290 291 292
				     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
						  0));
	}
L
Linus Torvalds 已提交
293 294 295 296 297 298

	/* Is this the final fragment? */
	if (!(fhdr->frag_off & htons(IP6_MF))) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrupted.
		 */
299
		if (end < fq->q.len ||
300
		    ((fq->q.last_in & INET_FRAG_LAST_IN) && end != fq->q.len))
L
Linus Torvalds 已提交
301
			goto err;
302
		fq->q.last_in |= INET_FRAG_LAST_IN;
303
		fq->q.len = end;
L
Linus Torvalds 已提交
304 305 306 307 308 309 310 311
	} else {
		/* Check if the fragment is rounded to 8 bytes.
		 * Required by the RFC.
		 */
		if (end & 0x7) {
			/* RFC2460 says always send parameter problem in
			 * this case. -DaveM
			 */
312 313
			IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
					 IPSTATS_MIB_INHDRERRORS);
314
			icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
L
Linus Torvalds 已提交
315
					  offsetof(struct ipv6hdr, payload_len));
316
			return -1;
L
Linus Torvalds 已提交
317
		}
318
		if (end > fq->q.len) {
L
Linus Torvalds 已提交
319
			/* Some bits beyond end -> corruption. */
320
			if (fq->q.last_in & INET_FRAG_LAST_IN)
L
Linus Torvalds 已提交
321
				goto err;
322
			fq->q.len = end;
L
Linus Torvalds 已提交
323 324 325 326 327 328 329 330 331
		}
	}

	if (end == offset)
		goto err;

	/* Point into the IP datagram 'data' part. */
	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
		goto err;
332

333 334
	if (pskb_trim_rcsum(skb, end - offset))
		goto err;
L
Linus Torvalds 已提交
335 336 337 338 339 340

	/* Find out which fragments are in front and at the back of us
	 * in the chain of fragments so far.  We must know where to put
	 * this fragment, right?
	 */
	prev = NULL;
341
	for(next = fq->q.fragments; next != NULL; next = next->next) {
L
Linus Torvalds 已提交
342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377
		if (FRAG6_CB(next)->offset >= offset)
			break;	/* bingo! */
		prev = next;
	}

	/* We found where to put this one.  Check for overlap with
	 * preceding fragment, and, if needed, align things so that
	 * any overlaps are eliminated.
	 */
	if (prev) {
		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;

		if (i > 0) {
			offset += i;
			if (end <= offset)
				goto err;
			if (!pskb_pull(skb, i))
				goto err;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
	}

	/* Look for overlap with succeeding segments.
	 * If we can merge fragments, do it.
	 */
	while (next && FRAG6_CB(next)->offset < end) {
		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */

		if (i < next->len) {
			/* Eat head of the next overlapped fragment
			 * and leave the loop. The next ones cannot overlap.
			 */
			if (!pskb_pull(next, i))
				goto err;
			FRAG6_CB(next)->offset += i;	/* next fragment */
378
			fq->q.meat -= i;
L
Linus Torvalds 已提交
379 380 381 382 383 384 385 386 387 388 389 390 391 392
			if (next->ip_summed != CHECKSUM_UNNECESSARY)
				next->ip_summed = CHECKSUM_NONE;
			break;
		} else {
			struct sk_buff *free_it = next;

			/* Old fragment is completely overridden with
			 * new one drop it.
			 */
			next = next->next;

			if (prev)
				prev->next = next;
			else
393
				fq->q.fragments = next;
L
Linus Torvalds 已提交
394

395
			fq->q.meat -= free_it->len;
396
			frag_kfree_skb(fq->q.net, free_it, NULL);
L
Linus Torvalds 已提交
397 398 399 400 401 402 403 404 405 406
		}
	}

	FRAG6_CB(skb)->offset = offset;

	/* Insert this fragment in the chain of fragments. */
	skb->next = next;
	if (prev)
		prev->next = skb;
	else
407
		fq->q.fragments = skb;
L
Linus Torvalds 已提交
408

409 410 411 412 413
	dev = skb->dev;
	if (dev) {
		fq->iif = dev->ifindex;
		skb->dev = NULL;
	}
414 415
	fq->q.stamp = skb->tstamp;
	fq->q.meat += skb->len;
416
	atomic_add(skb->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
417 418 419 420 421 422

	/* The first fragment.
	 * nhoffset is obtained from the first fragment, of course.
	 */
	if (offset == 0) {
		fq->nhoffset = nhoff;
423
		fq->q.last_in |= INET_FRAG_FIRST_IN;
L
Linus Torvalds 已提交
424
	}
425

426 427
	if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
	    fq->q.meat == fq->q.len)
428 429
		return ip6_frag_reasm(fq, prev, dev);

430
	write_lock(&ip6_frags.lock);
431
	list_move_tail(&fq->q.lru_list, &fq->q.net->lru_list);
432
	write_unlock(&ip6_frags.lock);
433
	return -1;
L
Linus Torvalds 已提交
434 435

err:
436
	IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
437
	kfree_skb(skb);
438
	return -1;
L
Linus Torvalds 已提交
439 440 441 442 443 444 445 446 447 448 449
}

/*
 *	Check if this packet is complete.
 *	Returns NULL on failure by any reason, and pointer
 *	to current nexthdr field in reassembled frame.
 *
 *	It is called with locked fq, and caller must check that
 *	queue is eligible for reassembly i.e. it is not COMPLETE,
 *	the last and the first frames arrived and all the bits are here.
 */
450
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
L
Linus Torvalds 已提交
451 452
			  struct net_device *dev)
{
453
	struct sk_buff *fp, *head = fq->q.fragments;
L
Linus Torvalds 已提交
454 455 456 457 458
	int    payload_len;
	unsigned int nhoff;

	fq_kill(fq);

459 460 461 462 463 464 465 466 467 468 469
	/* Make the one we just received the head. */
	if (prev) {
		head = prev->next;
		fp = skb_clone(head, GFP_ATOMIC);

		if (!fp)
			goto out_oom;

		fp->next = head->next;
		prev->next = fp;

470 471
		skb_morph(head, fq->q.fragments);
		head->next = fq->q.fragments->next;
472

473 474
		kfree_skb(fq->q.fragments);
		fq->q.fragments = head;
475 476
	}

477 478
	WARN_ON(head == NULL);
	WARN_ON(FRAG6_CB(head)->offset != 0);
L
Linus Torvalds 已提交
479 480

	/* Unfragmented part is taken from the first segment. */
481
	payload_len = ((head->data - skb_network_header(head)) -
482
		       sizeof(struct ipv6hdr) + fq->q.len -
483
		       sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510
	if (payload_len > IPV6_MAXPLEN)
		goto out_oversize;

	/* Head of list must not be cloned. */
	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
		goto out_oom;

	/* If the first fragment is fragmented itself, we split
	 * it to two chunks: the first with data and paged part
	 * and the second, holding only fragments. */
	if (skb_shinfo(head)->frag_list) {
		struct sk_buff *clone;
		int i, plen = 0;

		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
			goto out_oom;
		clone->next = head->next;
		head->next = clone;
		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
		skb_shinfo(head)->frag_list = NULL;
		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
			plen += skb_shinfo(head)->frags[i].size;
		clone->len = clone->data_len = head->data_len - plen;
		head->data_len -= clone->len;
		head->len -= clone->len;
		clone->csum = 0;
		clone->ip_summed = head->ip_summed;
511
		atomic_add(clone->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
512 513 514 515 516
	}

	/* We have to remove fragment header from datagram and to relocate
	 * header in order to calculate ICV correctly. */
	nhoff = fq->nhoffset;
517
	skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
518
	memmove(head->head + sizeof(struct frag_hdr), head->head,
L
Linus Torvalds 已提交
519
		(head->data - head->head) - sizeof(struct frag_hdr));
520 521
	head->mac_header += sizeof(struct frag_hdr);
	head->network_header += sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
522 523

	skb_shinfo(head)->frag_list = head->next;
524
	skb_reset_transport_header(head);
525
	skb_push(head, head->data - skb_network_header(head));
526
	atomic_sub(head->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
527 528 529 530 531 532

	for (fp=head->next; fp; fp = fp->next) {
		head->data_len += fp->len;
		head->len += fp->len;
		if (head->ip_summed != fp->ip_summed)
			head->ip_summed = CHECKSUM_NONE;
533
		else if (head->ip_summed == CHECKSUM_COMPLETE)
L
Linus Torvalds 已提交
534 535
			head->csum = csum_add(head->csum, fp->csum);
		head->truesize += fp->truesize;
536
		atomic_sub(fp->truesize, &fq->q.net->mem);
L
Linus Torvalds 已提交
537 538 539 540
	}

	head->next = NULL;
	head->dev = dev;
541
	head->tstamp = fq->q.stamp;
542
	ipv6_hdr(head)->payload_len = htons(payload_len);
543
	IP6CB(head)->nhoff = nhoff;
L
Linus Torvalds 已提交
544 545

	/* Yes, and fold redundant checksum back. 8) */
546
	if (head->ip_summed == CHECKSUM_COMPLETE)
547
		head->csum = csum_partial(skb_network_header(head),
548
					  skb_network_header_len(head),
549
					  head->csum);
L
Linus Torvalds 已提交
550

551 552 553
	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
	rcu_read_unlock();
554
	fq->q.fragments = NULL;
L
Linus Torvalds 已提交
555 556 557 558 559 560 561 562 563 564
	return 1;

out_oversize:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
	goto out_fail;
out_oom:
	if (net_ratelimit())
		printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
out_fail:
565 566 567
	rcu_read_lock();
	IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
	rcu_read_unlock();
L
Linus Torvalds 已提交
568 569 570
	return -1;
}

571
static int ipv6_frag_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
572 573 574
{
	struct frag_hdr *fhdr;
	struct frag_queue *fq;
575
	struct ipv6hdr *hdr = ipv6_hdr(skb);
576
	struct net *net;
L
Linus Torvalds 已提交
577

578
	IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
L
Linus Torvalds 已提交
579 580

	/* Jumbo payload inhibits frag. header */
581 582 583
	if (hdr->payload_len==0)
		goto fail_hdr;

584
	if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
585 586
				 sizeof(struct frag_hdr))))
		goto fail_hdr;
L
Linus Torvalds 已提交
587

588
	hdr = ipv6_hdr(skb);
589
	fhdr = (struct frag_hdr *)skb_transport_header(skb);
L
Linus Torvalds 已提交
590 591 592

	if (!(fhdr->frag_off & htons(0xFFF9))) {
		/* It is not a fragmented frame */
593
		skb->transport_header += sizeof(struct frag_hdr);
594
		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS);
L
Linus Torvalds 已提交
595

596
		IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
L
Linus Torvalds 已提交
597 598 599
		return 1;
	}

600
	net = dev_net(skb->dev);
601
	if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
602
		ip6_evictor(net, ip6_dst_idev(skb->dst));
L
Linus Torvalds 已提交
603

604
	if ((fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
605
			  ip6_dst_idev(skb->dst))) != NULL) {
606
		int ret;
L
Linus Torvalds 已提交
607

608
		spin_lock(&fq->q.lock);
L
Linus Torvalds 已提交
609

610
		ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
L
Linus Torvalds 已提交
611

612
		spin_unlock(&fq->q.lock);
613
		fq_put(fq);
L
Linus Torvalds 已提交
614 615 616
		return ret;
	}

617
	IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
L
Linus Torvalds 已提交
618 619
	kfree_skb(skb);
	return -1;
620 621 622 623 624

fail_hdr:
	IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb_network_header_len(skb));
	return -1;
L
Linus Torvalds 已提交
625 626 627 628 629 630 631 632
}

static struct inet6_protocol frag_protocol =
{
	.handler	=	ipv6_frag_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

633
#ifdef CONFIG_SYSCTL
634
static struct ctl_table ip6_frags_ns_ctl_table[] = {
635 636 637
	{
		.ctl_name	= NET_IPV6_IP6FRAG_HIGH_THRESH,
		.procname	= "ip6frag_high_thresh",
638
		.data		= &init_net.ipv6.frags.high_thresh,
639 640 641 642 643 644 645
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec
	},
	{
		.ctl_name	= NET_IPV6_IP6FRAG_LOW_THRESH,
		.procname	= "ip6frag_low_thresh",
646
		.data		= &init_net.ipv6.frags.low_thresh,
647 648 649 650 651 652 653
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec
	},
	{
		.ctl_name	= NET_IPV6_IP6FRAG_TIME,
		.procname	= "ip6frag_time",
654
		.data		= &init_net.ipv6.frags.timeout,
655 656 657 658 659
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
		.strategy	= &sysctl_jiffies,
	},
660 661 662 663
	{ }
};

static struct ctl_table ip6_frags_ctl_table[] = {
664 665 666
	{
		.ctl_name	= NET_IPV6_IP6FRAG_SECRET_INTERVAL,
		.procname	= "ip6frag_secret_interval",
667
		.data		= &ip6_frags.secret_interval,
668 669 670 671 672 673 674 675
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= &proc_dointvec_jiffies,
		.strategy	= &sysctl_jiffies
	},
	{ }
};

676
static int ip6_frags_ns_sysctl_register(struct net *net)
677
{
678
	struct ctl_table *table;
679 680
	struct ctl_table_header *hdr;

681
	table = ip6_frags_ns_ctl_table;
682
	if (net != &init_net) {
683
		table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
684 685 686
		if (table == NULL)
			goto err_alloc;

687 688
		table[0].data = &net->ipv6.frags.high_thresh;
		table[1].data = &net->ipv6.frags.low_thresh;
689
		table[2].data = &net->ipv6.frags.timeout;
690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705
	}

	hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table);
	if (hdr == NULL)
		goto err_reg;

	net->ipv6.sysctl.frags_hdr = hdr;
	return 0;

err_reg:
	if (net != &init_net)
		kfree(table);
err_alloc:
	return -ENOMEM;
}

706
static void ip6_frags_ns_sysctl_unregister(struct net *net)
707 708 709 710 711 712
{
	struct ctl_table *table;

	table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
	unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
	kfree(table);
713
}
714 715 716 717 718 719 720 721 722 723 724 725 726 727

static struct ctl_table_header *ip6_ctl_header;

static int ip6_frags_sysctl_register(void)
{
	ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path,
			ip6_frags_ctl_table);
	return ip6_ctl_header == NULL ? -ENOMEM : 0;
}

static void ip6_frags_sysctl_unregister(void)
{
	unregister_net_sysctl_table(ip6_ctl_header);
}
728
#else
729
static inline int ip6_frags_ns_sysctl_register(struct net *net)
730
{
731 732
	return 0;
}
733

734
static inline void ip6_frags_ns_sysctl_unregister(struct net *net)
735 736
{
}
737 738 739 740 741 742 743 744 745

static inline int ip6_frags_sysctl_register(void)
{
	return 0;
}

static inline void ip6_frags_sysctl_unregister(void)
{
}
746
#endif
D
Daniel Lezcano 已提交
747

748 749
static int ipv6_frags_init_net(struct net *net)
{
750 751
	net->ipv6.frags.high_thresh = 256 * 1024;
	net->ipv6.frags.low_thresh = 192 * 1024;
752
	net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT;
753

754 755
	inet_frags_init_net(&net->ipv6.frags);

756
	return ip6_frags_ns_sysctl_register(net);
757 758
}

759 760
static void ipv6_frags_exit_net(struct net *net)
{
761
	ip6_frags_ns_sysctl_unregister(net);
762 763 764 765 766 767 768 769
	inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
}

static struct pernet_operations ip6_frags_ops = {
	.init = ipv6_frags_init_net,
	.exit = ipv6_frags_exit_net,
};

770
int __init ipv6_frag_init(void)
L
Linus Torvalds 已提交
771
{
772
	int ret;
L
Linus Torvalds 已提交
773

774 775 776
	ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT);
	if (ret)
		goto out;
777

778 779 780 781
	ret = ip6_frags_sysctl_register();
	if (ret)
		goto err_sysctl;

782 783 784
	ret = register_pernet_subsys(&ip6_frags_ops);
	if (ret)
		goto err_pernet;
785

786
	ip6_frags.hashfn = ip6_hashfn;
787
	ip6_frags.constructor = ip6_frag_init;
788
	ip6_frags.destructor = NULL;
789 790
	ip6_frags.skb_free = NULL;
	ip6_frags.qsize = sizeof(struct frag_queue);
791
	ip6_frags.match = ip6_frag_match;
792
	ip6_frags.frag_expire = ip6_frag_expire;
793
	ip6_frags.secret_interval = 10 * 60 * HZ;
794
	inet_frags_init(&ip6_frags);
795 796
out:
	return ret;
797 798

err_pernet:
799 800
	ip6_frags_sysctl_unregister();
err_sysctl:
801 802
	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
	goto out;
803 804 805 806 807
}

void ipv6_frag_exit(void)
{
	inet_frags_fini(&ip6_frags);
808
	ip6_frags_sysctl_unregister();
809
	unregister_pernet_subsys(&ip6_frags_ops);
810
	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
L
Linus Torvalds 已提交
811
}