Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * IPv6 fragment reassembly |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 3 | * Linux INET6 implementation |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | * |
| 5 | * Authors: |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 6 | * Pedro Roque <roque@di.fc.ul.pt> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 7 | * |
| 8 | * $Id: reassembly.c,v 1.26 2001/03/07 22:00:57 davem Exp $ |
| 9 | * |
| 10 | * Based on: net/ipv4/ip_fragment.c |
| 11 | * |
| 12 | * This program is free software; you can redistribute it and/or |
| 13 | * modify it under the terms of the GNU General Public License |
| 14 | * as published by the Free Software Foundation; either version |
| 15 | * 2 of the License, or (at your option) any later version. |
| 16 | */ |
| 17 | |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 18 | /* |
| 19 | * Fixes: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 20 | * Andi Kleen Make it work with multiple hosts. |
| 21 | * More RFC compliance. |
| 22 | * |
| 23 | * Horst von Brand Add missing #include <linux/string.h> |
| 24 | * Alexey Kuznetsov SMP races, threading, cleanup. |
| 25 | * Patrick McHardy LRU queue of frag heads for evictor. |
| 26 | * Mitsuru KANDA @USAGI Register inet6_protocol{}. |
| 27 | * David Stevens and |
| 28 | * YOSHIFUJI,H. @USAGI Always remove fragment header to |
| 29 | * calculate ICV correctly. |
| 30 | */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 31 | #include <linux/errno.h> |
| 32 | #include <linux/types.h> |
| 33 | #include <linux/string.h> |
| 34 | #include <linux/socket.h> |
| 35 | #include <linux/sockios.h> |
| 36 | #include <linux/jiffies.h> |
| 37 | #include <linux/net.h> |
| 38 | #include <linux/list.h> |
| 39 | #include <linux/netdevice.h> |
| 40 | #include <linux/in6.h> |
| 41 | #include <linux/ipv6.h> |
| 42 | #include <linux/icmpv6.h> |
| 43 | #include <linux/random.h> |
| 44 | #include <linux/jhash.h> |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 45 | #include <linux/skbuff.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 46 | |
| 47 | #include <net/sock.h> |
| 48 | #include <net/snmp.h> |
| 49 | |
| 50 | #include <net/ipv6.h> |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 51 | #include <net/ip6_route.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | #include <net/protocol.h> |
| 53 | #include <net/transp_v6.h> |
| 54 | #include <net/rawv6.h> |
| 55 | #include <net/ndisc.h> |
| 56 | #include <net/addrconf.h> |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 57 | #include <net/inet_frag.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 58 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 59 | struct ip6frag_skb_cb |
| 60 | { |
| 61 | struct inet6_skb_parm h; |
| 62 | int offset; |
| 63 | }; |
| 64 | |
| 65 | #define FRAG6_CB(skb) ((struct ip6frag_skb_cb*)((skb)->cb)) |
| 66 | |
| 67 | |
| 68 | /* |
| 69 | * Equivalent of ipv4 struct ipq |
| 70 | */ |
| 71 | |
| 72 | struct frag_queue |
| 73 | { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 74 | struct inet_frag_queue q; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 76 | __be32 id; /* fragment id */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | struct in6_addr saddr; |
| 78 | struct in6_addr daddr; |
| 79 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | int iif; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 81 | unsigned int csum; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 82 | __u16 nhoffset; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 83 | }; |
| 84 | |
Pavel Emelyanov | 04128f2 | 2007-10-15 02:33:45 -0700 | [diff] [blame] | 85 | struct inet_frags_ctl ip6_frags_ctl __read_mostly = { |
| 86 | .high_thresh = 256 * 1024, |
| 87 | .low_thresh = 192 * 1024, |
| 88 | .timeout = IPV6_FRAG_TIMEOUT, |
| 89 | .secret_interval = 10 * 60 * HZ, |
| 90 | }; |
| 91 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 92 | static struct inet_frags ip6_frags; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 93 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 94 | int ip6_frag_nqueues(void) |
| 95 | { |
| 96 | return ip6_frags.nqueues; |
| 97 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 98 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 99 | int ip6_frag_mem(void) |
| 100 | { |
| 101 | return atomic_read(&ip6_frags.mem); |
| 102 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 103 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 104 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
| 105 | struct net_device *dev); |
| 106 | |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 107 | /* |
| 108 | * callers should be careful not to use the hash value outside the ipfrag_lock |
| 109 | * as doing so could race with ipfrag_hash_rnd being recalculated. |
| 110 | */ |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 111 | static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 112 | struct in6_addr *daddr) |
| 113 | { |
| 114 | u32 a, b, c; |
| 115 | |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 116 | a = (__force u32)saddr->s6_addr32[0]; |
| 117 | b = (__force u32)saddr->s6_addr32[1]; |
| 118 | c = (__force u32)saddr->s6_addr32[2]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 119 | |
| 120 | a += JHASH_GOLDEN_RATIO; |
| 121 | b += JHASH_GOLDEN_RATIO; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 122 | c += ip6_frags.rnd; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 123 | __jhash_mix(a, b, c); |
| 124 | |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 125 | a += (__force u32)saddr->s6_addr32[3]; |
| 126 | b += (__force u32)daddr->s6_addr32[0]; |
| 127 | c += (__force u32)daddr->s6_addr32[1]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 128 | __jhash_mix(a, b, c); |
| 129 | |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 130 | a += (__force u32)daddr->s6_addr32[2]; |
| 131 | b += (__force u32)daddr->s6_addr32[3]; |
| 132 | c += (__force u32)id; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 133 | __jhash_mix(a, b, c); |
| 134 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 135 | return c & (INETFRAGS_HASHSZ - 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 136 | } |
| 137 | |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame^] | 138 | static unsigned int ip6_hashfn(struct inet_frag_queue *q) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 139 | { |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame^] | 140 | struct frag_queue *fq; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 141 | |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame^] | 142 | fq = container_of(q, struct frag_queue, q); |
| 143 | return ip6qhashfn(fq->id, &fq->saddr, &fq->daddr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 144 | } |
| 145 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 146 | /* Memory Tracking Functions. */ |
| 147 | static inline void frag_kfree_skb(struct sk_buff *skb, int *work) |
| 148 | { |
| 149 | if (work) |
| 150 | *work -= skb->truesize; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 151 | atomic_sub(skb->truesize, &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 152 | kfree_skb(skb); |
| 153 | } |
| 154 | |
| 155 | static inline void frag_free_queue(struct frag_queue *fq, int *work) |
| 156 | { |
| 157 | if (work) |
| 158 | *work -= sizeof(struct frag_queue); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 159 | atomic_sub(sizeof(struct frag_queue), &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | kfree(fq); |
| 161 | } |
| 162 | |
| 163 | static inline struct frag_queue *frag_alloc_queue(void) |
| 164 | { |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 165 | struct frag_queue *fq = kzalloc(sizeof(struct frag_queue), GFP_ATOMIC); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | |
| 167 | if(!fq) |
| 168 | return NULL; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 169 | atomic_add(sizeof(struct frag_queue), &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 170 | return fq; |
| 171 | } |
| 172 | |
| 173 | /* Destruction primitives. */ |
| 174 | |
| 175 | /* Complete destruction of fq. */ |
| 176 | static void ip6_frag_destroy(struct frag_queue *fq, int *work) |
| 177 | { |
| 178 | struct sk_buff *fp; |
| 179 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 180 | BUG_TRAP(fq->q.last_in&COMPLETE); |
| 181 | BUG_TRAP(del_timer(&fq->q.timer) == 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 182 | |
| 183 | /* Release all fragment data. */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 184 | fp = fq->q.fragments; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 185 | while (fp) { |
| 186 | struct sk_buff *xp = fp->next; |
| 187 | |
| 188 | frag_kfree_skb(fp, work); |
| 189 | fp = xp; |
| 190 | } |
| 191 | |
| 192 | frag_free_queue(fq, work); |
| 193 | } |
| 194 | |
| 195 | static __inline__ void fq_put(struct frag_queue *fq, int *work) |
| 196 | { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 197 | if (atomic_dec_and_test(&fq->q.refcnt)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 198 | ip6_frag_destroy(fq, work); |
| 199 | } |
| 200 | |
| 201 | /* Kill fq entry. It is not destroyed immediately, |
| 202 | * because caller (and someone more) holds reference count. |
| 203 | */ |
| 204 | static __inline__ void fq_kill(struct frag_queue *fq) |
| 205 | { |
Pavel Emelyanov | 277e650 | 2007-10-15 02:37:18 -0700 | [diff] [blame] | 206 | inet_frag_kill(&fq->q, &ip6_frags); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 207 | } |
| 208 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 209 | static void ip6_evictor(struct inet6_dev *idev) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 210 | { |
| 211 | struct frag_queue *fq; |
| 212 | struct list_head *tmp; |
| 213 | int work; |
| 214 | |
Pavel Emelyanov | 04128f2 | 2007-10-15 02:33:45 -0700 | [diff] [blame] | 215 | work = atomic_read(&ip6_frags.mem) - ip6_frags_ctl.low_thresh; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 216 | if (work <= 0) |
| 217 | return; |
| 218 | |
| 219 | while(work > 0) { |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 220 | read_lock(&ip6_frags.lock); |
| 221 | if (list_empty(&ip6_frags.lru_list)) { |
| 222 | read_unlock(&ip6_frags.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 223 | return; |
| 224 | } |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 225 | tmp = ip6_frags.lru_list.next; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 226 | fq = list_entry(tmp, struct frag_queue, q.lru_list); |
| 227 | atomic_inc(&fq->q.refcnt); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 228 | read_unlock(&ip6_frags.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 229 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 230 | spin_lock(&fq->q.lock); |
| 231 | if (!(fq->q.last_in&COMPLETE)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | fq_kill(fq); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 233 | spin_unlock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 234 | |
| 235 | fq_put(fq, &work); |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 236 | IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 237 | } |
| 238 | } |
| 239 | |
| 240 | static void ip6_frag_expire(unsigned long data) |
| 241 | { |
| 242 | struct frag_queue *fq = (struct frag_queue *) data; |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 243 | struct net_device *dev = NULL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 244 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 245 | spin_lock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 246 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 247 | if (fq->q.last_in & COMPLETE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 248 | goto out; |
| 249 | |
| 250 | fq_kill(fq); |
| 251 | |
Eric W. Biederman | 881d966 | 2007-09-17 11:56:21 -0700 | [diff] [blame] | 252 | dev = dev_get_by_index(&init_net, fq->iif); |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 253 | if (!dev) |
| 254 | goto out; |
| 255 | |
| 256 | rcu_read_lock(); |
| 257 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); |
| 258 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); |
| 259 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 260 | |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 261 | /* Don't send error if the first segment did not arrive. */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 262 | if (!(fq->q.last_in&FIRST_IN) || !fq->q.fragments) |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 263 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 264 | |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 265 | /* |
| 266 | But use as source device on which LAST ARRIVED |
| 267 | segment was received. And do not use fq->dev |
| 268 | pointer directly, device might already disappeared. |
| 269 | */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 270 | fq->q.fragments->dev = dev; |
| 271 | icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 272 | out: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 273 | if (dev) |
| 274 | dev_put(dev); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 275 | spin_unlock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 276 | fq_put(fq, NULL); |
| 277 | } |
| 278 | |
| 279 | /* Creation primitives. */ |
| 280 | |
| 281 | |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 282 | static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 283 | { |
| 284 | struct frag_queue *fq; |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 285 | unsigned int hash; |
Yasuyuki Kozakai | e7c8a41 | 2005-11-16 12:55:37 -0800 | [diff] [blame] | 286 | #ifdef CONFIG_SMP |
| 287 | struct hlist_node *n; |
| 288 | #endif |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 289 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 290 | write_lock(&ip6_frags.lock); |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 291 | hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 292 | #ifdef CONFIG_SMP |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 293 | hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) { |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 294 | if (fq->id == fq_in->id && |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 295 | ipv6_addr_equal(&fq_in->saddr, &fq->saddr) && |
| 296 | ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 297 | atomic_inc(&fq->q.refcnt); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 298 | write_unlock(&ip6_frags.lock); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 299 | fq_in->q.last_in |= COMPLETE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 300 | fq_put(fq_in, NULL); |
| 301 | return fq; |
| 302 | } |
| 303 | } |
| 304 | #endif |
| 305 | fq = fq_in; |
| 306 | |
Pavel Emelyanov | 04128f2 | 2007-10-15 02:33:45 -0700 | [diff] [blame] | 307 | if (!mod_timer(&fq->q.timer, jiffies + ip6_frags_ctl.timeout)) |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 308 | atomic_inc(&fq->q.refcnt); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 309 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 310 | atomic_inc(&fq->q.refcnt); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 311 | hlist_add_head(&fq->q.list, &ip6_frags.hash[hash]); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 312 | INIT_LIST_HEAD(&fq->q.lru_list); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 313 | list_add_tail(&fq->q.lru_list, &ip6_frags.lru_list); |
| 314 | ip6_frags.nqueues++; |
| 315 | write_unlock(&ip6_frags.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 316 | return fq; |
| 317 | } |
| 318 | |
| 319 | |
| 320 | static struct frag_queue * |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 321 | ip6_frag_create(__be32 id, struct in6_addr *src, struct in6_addr *dst, |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 322 | struct inet6_dev *idev) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 323 | { |
| 324 | struct frag_queue *fq; |
| 325 | |
| 326 | if ((fq = frag_alloc_queue()) == NULL) |
| 327 | goto oom; |
| 328 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 329 | fq->id = id; |
| 330 | ipv6_addr_copy(&fq->saddr, src); |
| 331 | ipv6_addr_copy(&fq->daddr, dst); |
| 332 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 333 | init_timer(&fq->q.timer); |
| 334 | fq->q.timer.function = ip6_frag_expire; |
| 335 | fq->q.timer.data = (long) fq; |
| 336 | spin_lock_init(&fq->q.lock); |
| 337 | atomic_set(&fq->q.refcnt, 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 338 | |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 339 | return ip6_frag_intern(fq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 340 | |
| 341 | oom: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 342 | IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 343 | return NULL; |
| 344 | } |
| 345 | |
| 346 | static __inline__ struct frag_queue * |
Al Viro | e69a4adc | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 347 | fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst, |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 348 | struct inet6_dev *idev) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 349 | { |
| 350 | struct frag_queue *fq; |
Yasuyuki Kozakai | e7c8a41 | 2005-11-16 12:55:37 -0800 | [diff] [blame] | 351 | struct hlist_node *n; |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 352 | unsigned int hash; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 353 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 354 | read_lock(&ip6_frags.lock); |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 355 | hash = ip6qhashfn(id, src, dst); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 356 | hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) { |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 357 | if (fq->id == id && |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 358 | ipv6_addr_equal(src, &fq->saddr) && |
| 359 | ipv6_addr_equal(dst, &fq->daddr)) { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 360 | atomic_inc(&fq->q.refcnt); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 361 | read_unlock(&ip6_frags.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 362 | return fq; |
| 363 | } |
| 364 | } |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 365 | read_unlock(&ip6_frags.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 366 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 367 | return ip6_frag_create(id, src, dst, idev); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 368 | } |
| 369 | |
| 370 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 371 | static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 372 | struct frag_hdr *fhdr, int nhoff) |
| 373 | { |
| 374 | struct sk_buff *prev, *next; |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 375 | struct net_device *dev; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 376 | int offset, end; |
| 377 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 378 | if (fq->q.last_in & COMPLETE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 379 | goto err; |
| 380 | |
| 381 | offset = ntohs(fhdr->frag_off) & ~0x7; |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 382 | end = offset + (ntohs(ipv6_hdr(skb)->payload_len) - |
| 383 | ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1))); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 384 | |
| 385 | if ((unsigned int)end > IPV6_MAXPLEN) { |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 386 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), |
| 387 | IPSTATS_MIB_INHDRERRORS); |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 388 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
| 389 | ((u8 *)&fhdr->frag_off - |
| 390 | skb_network_header(skb))); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 391 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 392 | } |
| 393 | |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 394 | if (skb->ip_summed == CHECKSUM_COMPLETE) { |
| 395 | const unsigned char *nh = skb_network_header(skb); |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 396 | skb->csum = csum_sub(skb->csum, |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 397 | csum_partial(nh, (u8 *)(fhdr + 1) - nh, |
| 398 | 0)); |
| 399 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 400 | |
| 401 | /* Is this the final fragment? */ |
| 402 | if (!(fhdr->frag_off & htons(IP6_MF))) { |
| 403 | /* If we already have some bits beyond end |
| 404 | * or have different end, the segment is corrupted. |
| 405 | */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 406 | if (end < fq->q.len || |
| 407 | ((fq->q.last_in & LAST_IN) && end != fq->q.len)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 408 | goto err; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 409 | fq->q.last_in |= LAST_IN; |
| 410 | fq->q.len = end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 411 | } else { |
| 412 | /* Check if the fragment is rounded to 8 bytes. |
| 413 | * Required by the RFC. |
| 414 | */ |
| 415 | if (end & 0x7) { |
| 416 | /* RFC2460 says always send parameter problem in |
| 417 | * this case. -DaveM |
| 418 | */ |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 419 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), |
| 420 | IPSTATS_MIB_INHDRERRORS); |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 421 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 422 | offsetof(struct ipv6hdr, payload_len)); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 423 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 424 | } |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 425 | if (end > fq->q.len) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 426 | /* Some bits beyond end -> corruption. */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 427 | if (fq->q.last_in & LAST_IN) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 428 | goto err; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 429 | fq->q.len = end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 430 | } |
| 431 | } |
| 432 | |
| 433 | if (end == offset) |
| 434 | goto err; |
| 435 | |
| 436 | /* Point into the IP datagram 'data' part. */ |
| 437 | if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) |
| 438 | goto err; |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 439 | |
Stephen Hemminger | 42ca89c | 2005-09-08 12:57:43 -0700 | [diff] [blame] | 440 | if (pskb_trim_rcsum(skb, end - offset)) |
| 441 | goto err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 442 | |
| 443 | /* Find out which fragments are in front and at the back of us |
| 444 | * in the chain of fragments so far. We must know where to put |
| 445 | * this fragment, right? |
| 446 | */ |
| 447 | prev = NULL; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 448 | for(next = fq->q.fragments; next != NULL; next = next->next) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 449 | if (FRAG6_CB(next)->offset >= offset) |
| 450 | break; /* bingo! */ |
| 451 | prev = next; |
| 452 | } |
| 453 | |
| 454 | /* We found where to put this one. Check for overlap with |
| 455 | * preceding fragment, and, if needed, align things so that |
| 456 | * any overlaps are eliminated. |
| 457 | */ |
| 458 | if (prev) { |
| 459 | int i = (FRAG6_CB(prev)->offset + prev->len) - offset; |
| 460 | |
| 461 | if (i > 0) { |
| 462 | offset += i; |
| 463 | if (end <= offset) |
| 464 | goto err; |
| 465 | if (!pskb_pull(skb, i)) |
| 466 | goto err; |
| 467 | if (skb->ip_summed != CHECKSUM_UNNECESSARY) |
| 468 | skb->ip_summed = CHECKSUM_NONE; |
| 469 | } |
| 470 | } |
| 471 | |
| 472 | /* Look for overlap with succeeding segments. |
| 473 | * If we can merge fragments, do it. |
| 474 | */ |
| 475 | while (next && FRAG6_CB(next)->offset < end) { |
| 476 | int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */ |
| 477 | |
| 478 | if (i < next->len) { |
| 479 | /* Eat head of the next overlapped fragment |
| 480 | * and leave the loop. The next ones cannot overlap. |
| 481 | */ |
| 482 | if (!pskb_pull(next, i)) |
| 483 | goto err; |
| 484 | FRAG6_CB(next)->offset += i; /* next fragment */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 485 | fq->q.meat -= i; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 486 | if (next->ip_summed != CHECKSUM_UNNECESSARY) |
| 487 | next->ip_summed = CHECKSUM_NONE; |
| 488 | break; |
| 489 | } else { |
| 490 | struct sk_buff *free_it = next; |
| 491 | |
| 492 | /* Old fragment is completely overridden with |
| 493 | * new one drop it. |
| 494 | */ |
| 495 | next = next->next; |
| 496 | |
| 497 | if (prev) |
| 498 | prev->next = next; |
| 499 | else |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 500 | fq->q.fragments = next; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 501 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 502 | fq->q.meat -= free_it->len; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 503 | frag_kfree_skb(free_it, NULL); |
| 504 | } |
| 505 | } |
| 506 | |
| 507 | FRAG6_CB(skb)->offset = offset; |
| 508 | |
| 509 | /* Insert this fragment in the chain of fragments. */ |
| 510 | skb->next = next; |
| 511 | if (prev) |
| 512 | prev->next = skb; |
| 513 | else |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 514 | fq->q.fragments = skb; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 515 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 516 | dev = skb->dev; |
| 517 | if (dev) { |
| 518 | fq->iif = dev->ifindex; |
| 519 | skb->dev = NULL; |
| 520 | } |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 521 | fq->q.stamp = skb->tstamp; |
| 522 | fq->q.meat += skb->len; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 523 | atomic_add(skb->truesize, &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 524 | |
| 525 | /* The first fragment. |
| 526 | * nhoffset is obtained from the first fragment, of course. |
| 527 | */ |
| 528 | if (offset == 0) { |
| 529 | fq->nhoffset = nhoff; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 530 | fq->q.last_in |= FIRST_IN; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 531 | } |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 532 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 533 | if (fq->q.last_in == (FIRST_IN | LAST_IN) && fq->q.meat == fq->q.len) |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 534 | return ip6_frag_reasm(fq, prev, dev); |
| 535 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 536 | write_lock(&ip6_frags.lock); |
| 537 | list_move_tail(&fq->q.lru_list, &ip6_frags.lru_list); |
| 538 | write_unlock(&ip6_frags.lock); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 539 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 540 | |
| 541 | err: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 542 | IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 543 | kfree_skb(skb); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 544 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 545 | } |
| 546 | |
| 547 | /* |
| 548 | * Check if this packet is complete. |
| 549 | * Returns NULL on failure by any reason, and pointer |
| 550 | * to current nexthdr field in reassembled frame. |
| 551 | * |
| 552 | * It is called with locked fq, and caller must check that |
| 553 | * queue is eligible for reassembly i.e. it is not COMPLETE, |
| 554 | * the last and the first frames arrived and all the bits are here. |
| 555 | */ |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 556 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 557 | struct net_device *dev) |
| 558 | { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 559 | struct sk_buff *fp, *head = fq->q.fragments; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 560 | int payload_len; |
| 561 | unsigned int nhoff; |
| 562 | |
| 563 | fq_kill(fq); |
| 564 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 565 | /* Make the one we just received the head. */ |
| 566 | if (prev) { |
| 567 | head = prev->next; |
| 568 | fp = skb_clone(head, GFP_ATOMIC); |
| 569 | |
| 570 | if (!fp) |
| 571 | goto out_oom; |
| 572 | |
| 573 | fp->next = head->next; |
| 574 | prev->next = fp; |
| 575 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 576 | skb_morph(head, fq->q.fragments); |
| 577 | head->next = fq->q.fragments->next; |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 578 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 579 | kfree_skb(fq->q.fragments); |
| 580 | fq->q.fragments = head; |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 581 | } |
| 582 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 583 | BUG_TRAP(head != NULL); |
| 584 | BUG_TRAP(FRAG6_CB(head)->offset == 0); |
| 585 | |
| 586 | /* Unfragmented part is taken from the first segment. */ |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 587 | payload_len = ((head->data - skb_network_header(head)) - |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 588 | sizeof(struct ipv6hdr) + fq->q.len - |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 589 | sizeof(struct frag_hdr)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 590 | if (payload_len > IPV6_MAXPLEN) |
| 591 | goto out_oversize; |
| 592 | |
| 593 | /* Head of list must not be cloned. */ |
| 594 | if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) |
| 595 | goto out_oom; |
| 596 | |
| 597 | /* If the first fragment is fragmented itself, we split |
| 598 | * it to two chunks: the first with data and paged part |
| 599 | * and the second, holding only fragments. */ |
| 600 | if (skb_shinfo(head)->frag_list) { |
| 601 | struct sk_buff *clone; |
| 602 | int i, plen = 0; |
| 603 | |
| 604 | if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) |
| 605 | goto out_oom; |
| 606 | clone->next = head->next; |
| 607 | head->next = clone; |
| 608 | skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; |
| 609 | skb_shinfo(head)->frag_list = NULL; |
| 610 | for (i=0; i<skb_shinfo(head)->nr_frags; i++) |
| 611 | plen += skb_shinfo(head)->frags[i].size; |
| 612 | clone->len = clone->data_len = head->data_len - plen; |
| 613 | head->data_len -= clone->len; |
| 614 | head->len -= clone->len; |
| 615 | clone->csum = 0; |
| 616 | clone->ip_summed = head->ip_summed; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 617 | atomic_add(clone->truesize, &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 618 | } |
| 619 | |
| 620 | /* We have to remove fragment header from datagram and to relocate |
| 621 | * header in order to calculate ICV correctly. */ |
| 622 | nhoff = fq->nhoffset; |
Arnaldo Carvalho de Melo | b0e380b | 2007-04-10 21:21:55 -0700 | [diff] [blame] | 623 | skb_network_header(head)[nhoff] = skb_transport_header(head)[0]; |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 624 | memmove(head->head + sizeof(struct frag_hdr), head->head, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 625 | (head->data - head->head) - sizeof(struct frag_hdr)); |
Arnaldo Carvalho de Melo | b0e380b | 2007-04-10 21:21:55 -0700 | [diff] [blame] | 626 | head->mac_header += sizeof(struct frag_hdr); |
| 627 | head->network_header += sizeof(struct frag_hdr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 628 | |
| 629 | skb_shinfo(head)->frag_list = head->next; |
Arnaldo Carvalho de Melo | badff6d | 2007-03-13 13:06:52 -0300 | [diff] [blame] | 630 | skb_reset_transport_header(head); |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 631 | skb_push(head, head->data - skb_network_header(head)); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 632 | atomic_sub(head->truesize, &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 633 | |
| 634 | for (fp=head->next; fp; fp = fp->next) { |
| 635 | head->data_len += fp->len; |
| 636 | head->len += fp->len; |
| 637 | if (head->ip_summed != fp->ip_summed) |
| 638 | head->ip_summed = CHECKSUM_NONE; |
Patrick McHardy | 84fa793 | 2006-08-29 16:44:56 -0700 | [diff] [blame] | 639 | else if (head->ip_summed == CHECKSUM_COMPLETE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 640 | head->csum = csum_add(head->csum, fp->csum); |
| 641 | head->truesize += fp->truesize; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 642 | atomic_sub(fp->truesize, &ip6_frags.mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 643 | } |
| 644 | |
| 645 | head->next = NULL; |
| 646 | head->dev = dev; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 647 | head->tstamp = fq->q.stamp; |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 648 | ipv6_hdr(head)->payload_len = htons(payload_len); |
Patrick McHardy | 951dbc8 | 2006-01-06 23:02:34 -0800 | [diff] [blame] | 649 | IP6CB(head)->nhoff = nhoff; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 650 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 651 | /* Yes, and fold redundant checksum back. 8) */ |
Patrick McHardy | 84fa793 | 2006-08-29 16:44:56 -0700 | [diff] [blame] | 652 | if (head->ip_summed == CHECKSUM_COMPLETE) |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 653 | head->csum = csum_partial(skb_network_header(head), |
Arnaldo Carvalho de Melo | cfe1fc7 | 2007-03-16 17:26:39 -0300 | [diff] [blame] | 654 | skb_network_header_len(head), |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 655 | head->csum); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 656 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 657 | rcu_read_lock(); |
| 658 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS); |
| 659 | rcu_read_unlock(); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 660 | fq->q.fragments = NULL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 661 | return 1; |
| 662 | |
| 663 | out_oversize: |
| 664 | if (net_ratelimit()) |
| 665 | printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len); |
| 666 | goto out_fail; |
| 667 | out_oom: |
| 668 | if (net_ratelimit()) |
| 669 | printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n"); |
| 670 | out_fail: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 671 | rcu_read_lock(); |
| 672 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); |
| 673 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 674 | return -1; |
| 675 | } |
| 676 | |
Patrick McHardy | 951dbc8 | 2006-01-06 23:02:34 -0800 | [diff] [blame] | 677 | static int ipv6_frag_rcv(struct sk_buff **skbp) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 678 | { |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 679 | struct sk_buff *skb = *skbp; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 680 | struct frag_hdr *fhdr; |
| 681 | struct frag_queue *fq; |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 682 | struct ipv6hdr *hdr = ipv6_hdr(skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 683 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 684 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 685 | |
| 686 | /* Jumbo payload inhibits frag. header */ |
| 687 | if (hdr->payload_len==0) { |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 688 | IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS); |
Arnaldo Carvalho de Melo | cfe1fc7 | 2007-03-16 17:26:39 -0300 | [diff] [blame] | 689 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
| 690 | skb_network_header_len(skb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 691 | return -1; |
| 692 | } |
Arnaldo Carvalho de Melo | ea2ae17 | 2007-04-25 17:55:53 -0700 | [diff] [blame] | 693 | if (!pskb_may_pull(skb, (skb_transport_offset(skb) + |
| 694 | sizeof(struct frag_hdr)))) { |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 695 | IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS); |
Arnaldo Carvalho de Melo | cfe1fc7 | 2007-03-16 17:26:39 -0300 | [diff] [blame] | 696 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
| 697 | skb_network_header_len(skb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 698 | return -1; |
| 699 | } |
| 700 | |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 701 | hdr = ipv6_hdr(skb); |
Arnaldo Carvalho de Melo | 9c70220 | 2007-04-25 18:04:18 -0700 | [diff] [blame] | 702 | fhdr = (struct frag_hdr *)skb_transport_header(skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 703 | |
| 704 | if (!(fhdr->frag_off & htons(0xFFF9))) { |
| 705 | /* It is not a fragmented frame */ |
Arnaldo Carvalho de Melo | b0e380b | 2007-04-10 21:21:55 -0700 | [diff] [blame] | 706 | skb->transport_header += sizeof(struct frag_hdr); |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 707 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 708 | |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 709 | IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 710 | return 1; |
| 711 | } |
| 712 | |
Pavel Emelyanov | 04128f2 | 2007-10-15 02:33:45 -0700 | [diff] [blame] | 713 | if (atomic_read(&ip6_frags.mem) > ip6_frags_ctl.high_thresh) |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 714 | ip6_evictor(ip6_dst_idev(skb->dst)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 715 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 716 | if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr, |
| 717 | ip6_dst_idev(skb->dst))) != NULL) { |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 718 | int ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 719 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 720 | spin_lock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 721 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 722 | ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 723 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 724 | spin_unlock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 725 | fq_put(fq, NULL); |
| 726 | return ret; |
| 727 | } |
| 728 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 729 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 730 | kfree_skb(skb); |
| 731 | return -1; |
| 732 | } |
| 733 | |
| 734 | static struct inet6_protocol frag_protocol = |
| 735 | { |
| 736 | .handler = ipv6_frag_rcv, |
| 737 | .flags = INET6_PROTO_NOPOLICY, |
| 738 | }; |
| 739 | |
| 740 | void __init ipv6_frag_init(void) |
| 741 | { |
| 742 | if (inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT) < 0) |
| 743 | printk(KERN_ERR "ipv6_frag_init: Could not register protocol\n"); |
| 744 | |
Pavel Emelyanov | 04128f2 | 2007-10-15 02:33:45 -0700 | [diff] [blame] | 745 | ip6_frags.ctl = &ip6_frags_ctl; |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame^] | 746 | ip6_frags.hashfn = ip6_hashfn; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 747 | inet_frags_init(&ip6_frags); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 748 | } |