Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * IPv6 fragment reassembly |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 3 | * Linux INET6 implementation |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | * |
| 5 | * Authors: |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 6 | * Pedro Roque <roque@di.fc.ul.pt> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 7 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 8 | * Based on: net/ipv4/ip_fragment.c |
| 9 | * |
| 10 | * This program is free software; you can redistribute it and/or |
| 11 | * modify it under the terms of the GNU General Public License |
| 12 | * as published by the Free Software Foundation; either version |
| 13 | * 2 of the License, or (at your option) any later version. |
| 14 | */ |
| 15 | |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 16 | /* |
| 17 | * Fixes: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 | * Andi Kleen Make it work with multiple hosts. |
| 19 | * More RFC compliance. |
| 20 | * |
| 21 | * Horst von Brand Add missing #include <linux/string.h> |
| 22 | * Alexey Kuznetsov SMP races, threading, cleanup. |
| 23 | * Patrick McHardy LRU queue of frag heads for evictor. |
| 24 | * Mitsuru KANDA @USAGI Register inet6_protocol{}. |
| 25 | * David Stevens and |
| 26 | * YOSHIFUJI,H. @USAGI Always remove fragment header to |
| 27 | * calculate ICV correctly. |
| 28 | */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 29 | #include <linux/errno.h> |
| 30 | #include <linux/types.h> |
| 31 | #include <linux/string.h> |
| 32 | #include <linux/socket.h> |
| 33 | #include <linux/sockios.h> |
| 34 | #include <linux/jiffies.h> |
| 35 | #include <linux/net.h> |
| 36 | #include <linux/list.h> |
| 37 | #include <linux/netdevice.h> |
| 38 | #include <linux/in6.h> |
| 39 | #include <linux/ipv6.h> |
| 40 | #include <linux/icmpv6.h> |
| 41 | #include <linux/random.h> |
| 42 | #include <linux/jhash.h> |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 43 | #include <linux/skbuff.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | |
| 45 | #include <net/sock.h> |
| 46 | #include <net/snmp.h> |
| 47 | |
| 48 | #include <net/ipv6.h> |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 49 | #include <net/ip6_route.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 50 | #include <net/protocol.h> |
| 51 | #include <net/transp_v6.h> |
| 52 | #include <net/rawv6.h> |
| 53 | #include <net/ndisc.h> |
| 54 | #include <net/addrconf.h> |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 55 | #include <net/inet_frag.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 56 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 57 | struct ip6frag_skb_cb |
| 58 | { |
| 59 | struct inet6_skb_parm h; |
| 60 | int offset; |
| 61 | }; |
| 62 | |
| 63 | #define FRAG6_CB(skb) ((struct ip6frag_skb_cb*)((skb)->cb)) |
| 64 | |
| 65 | |
| 66 | /* |
| 67 | * Equivalent of ipv4 struct ipq |
| 68 | */ |
| 69 | |
| 70 | struct frag_queue |
| 71 | { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 72 | struct inet_frag_queue q; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 73 | |
Al Viro | e69a4ad | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 74 | __be32 id; /* fragment id */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | struct in6_addr saddr; |
| 76 | struct in6_addr daddr; |
| 77 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | int iif; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 79 | unsigned int csum; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 80 | __u16 nhoffset; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 81 | }; |
| 82 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 83 | static struct inet_frags ip6_frags; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 84 | |
Pavel Emelyanov | e5a2bb842 | 2008-01-22 06:06:23 -0800 | [diff] [blame] | 85 | int ip6_frag_nqueues(struct net *net) |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 86 | { |
Pavel Emelyanov | e5a2bb842 | 2008-01-22 06:06:23 -0800 | [diff] [blame] | 87 | return net->ipv6.frags.nqueues; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 88 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 89 | |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 90 | int ip6_frag_mem(struct net *net) |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 91 | { |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 92 | return atomic_read(&net->ipv6.frags.mem); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 93 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 94 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 95 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
| 96 | struct net_device *dev); |
| 97 | |
Zach Brown | f6596f9 | 2006-04-10 16:05:34 -0700 | [diff] [blame] | 98 | /* |
| 99 | * callers should be careful not to use the hash value outside the ipfrag_lock |
| 100 | * as doing so could race with ipfrag_hash_rnd being recalculated. |
| 101 | */ |
Al Viro | e69a4ad | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 102 | static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 103 | struct in6_addr *daddr) |
| 104 | { |
| 105 | u32 a, b, c; |
| 106 | |
Al Viro | e69a4ad | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 107 | a = (__force u32)saddr->s6_addr32[0]; |
| 108 | b = (__force u32)saddr->s6_addr32[1]; |
| 109 | c = (__force u32)saddr->s6_addr32[2]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 110 | |
| 111 | a += JHASH_GOLDEN_RATIO; |
| 112 | b += JHASH_GOLDEN_RATIO; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 113 | c += ip6_frags.rnd; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 114 | __jhash_mix(a, b, c); |
| 115 | |
Al Viro | e69a4ad | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 116 | a += (__force u32)saddr->s6_addr32[3]; |
| 117 | b += (__force u32)daddr->s6_addr32[0]; |
| 118 | c += (__force u32)daddr->s6_addr32[1]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 119 | __jhash_mix(a, b, c); |
| 120 | |
Al Viro | e69a4ad | 2006-11-14 20:56:00 -0800 | [diff] [blame] | 121 | a += (__force u32)daddr->s6_addr32[2]; |
| 122 | b += (__force u32)daddr->s6_addr32[3]; |
| 123 | c += (__force u32)id; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 124 | __jhash_mix(a, b, c); |
| 125 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 126 | return c & (INETFRAGS_HASHSZ - 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 127 | } |
| 128 | |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame] | 129 | static unsigned int ip6_hashfn(struct inet_frag_queue *q) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 130 | { |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame] | 131 | struct frag_queue *fq; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 132 | |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame] | 133 | fq = container_of(q, struct frag_queue, q); |
| 134 | return ip6qhashfn(fq->id, &fq->saddr, &fq->daddr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 135 | } |
| 136 | |
Pavel Emelyanov | abd6523 | 2007-10-17 19:47:21 -0700 | [diff] [blame] | 137 | int ip6_frag_match(struct inet_frag_queue *q, void *a) |
| 138 | { |
| 139 | struct frag_queue *fq; |
| 140 | struct ip6_create_arg *arg = a; |
| 141 | |
| 142 | fq = container_of(q, struct frag_queue, q); |
| 143 | return (fq->id == arg->id && |
| 144 | ipv6_addr_equal(&fq->saddr, arg->src) && |
| 145 | ipv6_addr_equal(&fq->daddr, arg->dst)); |
| 146 | } |
| 147 | EXPORT_SYMBOL(ip6_frag_match); |
| 148 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 149 | /* Memory Tracking Functions. */ |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 150 | static inline void frag_kfree_skb(struct netns_frags *nf, |
| 151 | struct sk_buff *skb, int *work) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 152 | { |
| 153 | if (work) |
| 154 | *work -= skb->truesize; |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 155 | atomic_sub(skb->truesize, &nf->mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 156 | kfree_skb(skb); |
| 157 | } |
| 158 | |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 159 | void ip6_frag_init(struct inet_frag_queue *q, void *a) |
| 160 | { |
| 161 | struct frag_queue *fq = container_of(q, struct frag_queue, q); |
| 162 | struct ip6_create_arg *arg = a; |
| 163 | |
| 164 | fq->id = arg->id; |
| 165 | ipv6_addr_copy(&fq->saddr, arg->src); |
| 166 | ipv6_addr_copy(&fq->daddr, arg->dst); |
| 167 | } |
| 168 | EXPORT_SYMBOL(ip6_frag_init); |
| 169 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 170 | /* Destruction primitives. */ |
| 171 | |
Pavel Emelyanov | 4b6cb5d | 2007-10-15 02:41:09 -0700 | [diff] [blame] | 172 | static __inline__ void fq_put(struct frag_queue *fq) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 173 | { |
Pavel Emelyanov | 762cc40 | 2007-10-15 02:41:56 -0700 | [diff] [blame] | 174 | inet_frag_put(&fq->q, &ip6_frags); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 175 | } |
| 176 | |
| 177 | /* Kill fq entry. It is not destroyed immediately, |
| 178 | * because caller (and someone more) holds reference count. |
| 179 | */ |
| 180 | static __inline__ void fq_kill(struct frag_queue *fq) |
| 181 | { |
Pavel Emelyanov | 277e650 | 2007-10-15 02:37:18 -0700 | [diff] [blame] | 182 | inet_frag_kill(&fq->q, &ip6_frags); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | } |
| 184 | |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 185 | static void ip6_evictor(struct net *net, struct inet6_dev *idev) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | { |
Pavel Emelyanov | 8e7999c | 2007-10-15 02:40:06 -0700 | [diff] [blame] | 187 | int evicted; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 188 | |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 189 | evicted = inet_frag_evictor(&net->ipv6.frags, &ip6_frags); |
Pavel Emelyanov | 8e7999c | 2007-10-15 02:40:06 -0700 | [diff] [blame] | 190 | if (evicted) |
| 191 | IP6_ADD_STATS_BH(idev, IPSTATS_MIB_REASMFAILS, evicted); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 192 | } |
| 193 | |
| 194 | static void ip6_frag_expire(unsigned long data) |
| 195 | { |
Pavel Emelyanov | e521db9 | 2007-10-17 19:45:23 -0700 | [diff] [blame] | 196 | struct frag_queue *fq; |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 197 | struct net_device *dev = NULL; |
Daniel Lezcano | 4ac2ccd | 2008-05-02 17:02:03 -0700 | [diff] [blame] | 198 | struct net *net; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 199 | |
Pavel Emelyanov | e521db9 | 2007-10-17 19:45:23 -0700 | [diff] [blame] | 200 | fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); |
| 201 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 202 | spin_lock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 203 | |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 204 | if (fq->q.last_in & INET_FRAG_COMPLETE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 205 | goto out; |
| 206 | |
| 207 | fq_kill(fq); |
| 208 | |
Daniel Lezcano | 4ac2ccd | 2008-05-02 17:02:03 -0700 | [diff] [blame] | 209 | net = container_of(fq->q.net, struct net, ipv6.frags); |
| 210 | dev = dev_get_by_index(net, fq->iif); |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 211 | if (!dev) |
| 212 | goto out; |
| 213 | |
| 214 | rcu_read_lock(); |
| 215 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); |
| 216 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); |
| 217 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 218 | |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 219 | /* Don't send error if the first segment did not arrive. */ |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 220 | if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments) |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 221 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 222 | |
Ingo Oeser | 78c784c | 2006-03-20 23:01:17 -0800 | [diff] [blame] | 223 | /* |
| 224 | But use as source device on which LAST ARRIVED |
| 225 | segment was received. And do not use fq->dev |
| 226 | pointer directly, device might already disappeared. |
| 227 | */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 228 | fq->q.fragments->dev = dev; |
| 229 | icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 230 | out: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 231 | if (dev) |
| 232 | dev_put(dev); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 233 | spin_unlock(&fq->q.lock); |
Pavel Emelyanov | 4b6cb5d | 2007-10-15 02:41:09 -0700 | [diff] [blame] | 234 | fq_put(fq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 235 | } |
| 236 | |
Pavel Emelyanov | abd6523 | 2007-10-17 19:47:21 -0700 | [diff] [blame] | 237 | static __inline__ struct frag_queue * |
Pavel Emelyanov | ac18e75 | 2008-01-22 06:02:14 -0800 | [diff] [blame] | 238 | fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst, |
Pavel Emelyanov | abd6523 | 2007-10-17 19:47:21 -0700 | [diff] [blame] | 239 | struct inet6_dev *idev) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 240 | { |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 241 | struct inet_frag_queue *q; |
| 242 | struct ip6_create_arg arg; |
Pavel Emelyanov | abd6523 | 2007-10-17 19:47:21 -0700 | [diff] [blame] | 243 | unsigned int hash; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 244 | |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 245 | arg.id = id; |
| 246 | arg.src = src; |
| 247 | arg.dst = dst; |
Pavel Emelyanov | 9a37580 | 2008-06-27 20:06:08 -0700 | [diff] [blame] | 248 | |
| 249 | read_lock(&ip6_frags.lock); |
Pavel Emelyanov | abd6523 | 2007-10-17 19:47:21 -0700 | [diff] [blame] | 250 | hash = ip6qhashfn(id, src, dst); |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 251 | |
Pavel Emelyanov | ac18e75 | 2008-01-22 06:02:14 -0800 | [diff] [blame] | 252 | q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 253 | if (q == NULL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 254 | goto oom; |
| 255 | |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 256 | return container_of(q, struct frag_queue, q); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 257 | |
| 258 | oom: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 259 | IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 260 | return NULL; |
| 261 | } |
| 262 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 263 | static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 264 | struct frag_hdr *fhdr, int nhoff) |
| 265 | { |
| 266 | struct sk_buff *prev, *next; |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 267 | struct net_device *dev; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 268 | int offset, end; |
| 269 | |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 270 | if (fq->q.last_in & INET_FRAG_COMPLETE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 271 | goto err; |
| 272 | |
| 273 | offset = ntohs(fhdr->frag_off) & ~0x7; |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 274 | end = offset + (ntohs(ipv6_hdr(skb)->payload_len) - |
| 275 | ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1))); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 276 | |
| 277 | if ((unsigned int)end > IPV6_MAXPLEN) { |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 278 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), |
| 279 | IPSTATS_MIB_INHDRERRORS); |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 280 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
| 281 | ((u8 *)&fhdr->frag_off - |
| 282 | skb_network_header(skb))); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 283 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 284 | } |
| 285 | |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 286 | if (skb->ip_summed == CHECKSUM_COMPLETE) { |
| 287 | const unsigned char *nh = skb_network_header(skb); |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 288 | skb->csum = csum_sub(skb->csum, |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 289 | csum_partial(nh, (u8 *)(fhdr + 1) - nh, |
| 290 | 0)); |
| 291 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 292 | |
| 293 | /* Is this the final fragment? */ |
| 294 | if (!(fhdr->frag_off & htons(IP6_MF))) { |
| 295 | /* If we already have some bits beyond end |
| 296 | * or have different end, the segment is corrupted. |
| 297 | */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 298 | if (end < fq->q.len || |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 299 | ((fq->q.last_in & INET_FRAG_LAST_IN) && end != fq->q.len)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 300 | goto err; |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 301 | fq->q.last_in |= INET_FRAG_LAST_IN; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 302 | fq->q.len = end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 303 | } else { |
| 304 | /* Check if the fragment is rounded to 8 bytes. |
| 305 | * Required by the RFC. |
| 306 | */ |
| 307 | if (end & 0x7) { |
| 308 | /* RFC2460 says always send parameter problem in |
| 309 | * this case. -DaveM |
| 310 | */ |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 311 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), |
| 312 | IPSTATS_MIB_INHDRERRORS); |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 313 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 314 | offsetof(struct ipv6hdr, payload_len)); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 315 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 316 | } |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 317 | if (end > fq->q.len) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 318 | /* Some bits beyond end -> corruption. */ |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 319 | if (fq->q.last_in & INET_FRAG_LAST_IN) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 320 | goto err; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 321 | fq->q.len = end; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 322 | } |
| 323 | } |
| 324 | |
| 325 | if (end == offset) |
| 326 | goto err; |
| 327 | |
| 328 | /* Point into the IP datagram 'data' part. */ |
| 329 | if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) |
| 330 | goto err; |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 331 | |
Stephen Hemminger | 42ca89c | 2005-09-08 12:57:43 -0700 | [diff] [blame] | 332 | if (pskb_trim_rcsum(skb, end - offset)) |
| 333 | goto err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 334 | |
| 335 | /* Find out which fragments are in front and at the back of us |
| 336 | * in the chain of fragments so far. We must know where to put |
| 337 | * this fragment, right? |
| 338 | */ |
| 339 | prev = NULL; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 340 | for(next = fq->q.fragments; next != NULL; next = next->next) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 341 | if (FRAG6_CB(next)->offset >= offset) |
| 342 | break; /* bingo! */ |
| 343 | prev = next; |
| 344 | } |
| 345 | |
| 346 | /* We found where to put this one. Check for overlap with |
| 347 | * preceding fragment, and, if needed, align things so that |
| 348 | * any overlaps are eliminated. |
| 349 | */ |
| 350 | if (prev) { |
| 351 | int i = (FRAG6_CB(prev)->offset + prev->len) - offset; |
| 352 | |
| 353 | if (i > 0) { |
| 354 | offset += i; |
| 355 | if (end <= offset) |
| 356 | goto err; |
| 357 | if (!pskb_pull(skb, i)) |
| 358 | goto err; |
| 359 | if (skb->ip_summed != CHECKSUM_UNNECESSARY) |
| 360 | skb->ip_summed = CHECKSUM_NONE; |
| 361 | } |
| 362 | } |
| 363 | |
| 364 | /* Look for overlap with succeeding segments. |
| 365 | * If we can merge fragments, do it. |
| 366 | */ |
| 367 | while (next && FRAG6_CB(next)->offset < end) { |
| 368 | int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */ |
| 369 | |
| 370 | if (i < next->len) { |
| 371 | /* Eat head of the next overlapped fragment |
| 372 | * and leave the loop. The next ones cannot overlap. |
| 373 | */ |
| 374 | if (!pskb_pull(next, i)) |
| 375 | goto err; |
| 376 | FRAG6_CB(next)->offset += i; /* next fragment */ |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 377 | fq->q.meat -= i; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 378 | if (next->ip_summed != CHECKSUM_UNNECESSARY) |
| 379 | next->ip_summed = CHECKSUM_NONE; |
| 380 | break; |
| 381 | } else { |
| 382 | struct sk_buff *free_it = next; |
| 383 | |
| 384 | /* Old fragment is completely overridden with |
| 385 | * new one drop it. |
| 386 | */ |
| 387 | next = next->next; |
| 388 | |
| 389 | if (prev) |
| 390 | prev->next = next; |
| 391 | else |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 392 | fq->q.fragments = next; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 393 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 394 | fq->q.meat -= free_it->len; |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 395 | frag_kfree_skb(fq->q.net, free_it, NULL); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 396 | } |
| 397 | } |
| 398 | |
| 399 | FRAG6_CB(skb)->offset = offset; |
| 400 | |
| 401 | /* Insert this fragment in the chain of fragments. */ |
| 402 | skb->next = next; |
| 403 | if (prev) |
| 404 | prev->next = skb; |
| 405 | else |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 406 | fq->q.fragments = skb; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 407 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 408 | dev = skb->dev; |
| 409 | if (dev) { |
| 410 | fq->iif = dev->ifindex; |
| 411 | skb->dev = NULL; |
| 412 | } |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 413 | fq->q.stamp = skb->tstamp; |
| 414 | fq->q.meat += skb->len; |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 415 | atomic_add(skb->truesize, &fq->q.net->mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 416 | |
| 417 | /* The first fragment. |
| 418 | * nhoffset is obtained from the first fragment, of course. |
| 419 | */ |
| 420 | if (offset == 0) { |
| 421 | fq->nhoffset = nhoff; |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 422 | fq->q.last_in |= INET_FRAG_FIRST_IN; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 423 | } |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 424 | |
Joe Perches | bc578a5 | 2008-03-28 16:35:27 -0700 | [diff] [blame] | 425 | if (fq->q.last_in == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && |
| 426 | fq->q.meat == fq->q.len) |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 427 | return ip6_frag_reasm(fq, prev, dev); |
| 428 | |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 429 | write_lock(&ip6_frags.lock); |
Pavel Emelyanov | 3140c25 | 2008-01-22 06:11:48 -0800 | [diff] [blame] | 430 | list_move_tail(&fq->q.lru_list, &fq->q.net->lru_list); |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 431 | write_unlock(&ip6_frags.lock); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 432 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 433 | |
| 434 | err: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 435 | IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 436 | kfree_skb(skb); |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 437 | return -1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 438 | } |
| 439 | |
| 440 | /* |
| 441 | * Check if this packet is complete. |
| 442 | * Returns NULL on failure by any reason, and pointer |
| 443 | * to current nexthdr field in reassembled frame. |
| 444 | * |
| 445 | * It is called with locked fq, and caller must check that |
| 446 | * queue is eligible for reassembly i.e. it is not COMPLETE, |
| 447 | * the last and the first frames arrived and all the bits are here. |
| 448 | */ |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 449 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 450 | struct net_device *dev) |
| 451 | { |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 452 | struct sk_buff *fp, *head = fq->q.fragments; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 453 | int payload_len; |
| 454 | unsigned int nhoff; |
| 455 | |
| 456 | fq_kill(fq); |
| 457 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 458 | /* Make the one we just received the head. */ |
| 459 | if (prev) { |
| 460 | head = prev->next; |
| 461 | fp = skb_clone(head, GFP_ATOMIC); |
| 462 | |
| 463 | if (!fp) |
| 464 | goto out_oom; |
| 465 | |
| 466 | fp->next = head->next; |
| 467 | prev->next = fp; |
| 468 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 469 | skb_morph(head, fq->q.fragments); |
| 470 | head->next = fq->q.fragments->next; |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 471 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 472 | kfree_skb(fq->q.fragments); |
| 473 | fq->q.fragments = head; |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 474 | } |
| 475 | |
Ilpo Järvinen | 547b792 | 2008-07-25 21:43:18 -0700 | [diff] [blame] | 476 | WARN_ON(head == NULL); |
| 477 | WARN_ON(FRAG6_CB(head)->offset != 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 478 | |
| 479 | /* Unfragmented part is taken from the first segment. */ |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 480 | payload_len = ((head->data - skb_network_header(head)) - |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 481 | sizeof(struct ipv6hdr) + fq->q.len - |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 482 | sizeof(struct frag_hdr)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 483 | if (payload_len > IPV6_MAXPLEN) |
| 484 | goto out_oversize; |
| 485 | |
| 486 | /* Head of list must not be cloned. */ |
| 487 | if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) |
| 488 | goto out_oom; |
| 489 | |
| 490 | /* If the first fragment is fragmented itself, we split |
| 491 | * it to two chunks: the first with data and paged part |
| 492 | * and the second, holding only fragments. */ |
| 493 | if (skb_shinfo(head)->frag_list) { |
| 494 | struct sk_buff *clone; |
| 495 | int i, plen = 0; |
| 496 | |
| 497 | if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) |
| 498 | goto out_oom; |
| 499 | clone->next = head->next; |
| 500 | head->next = clone; |
| 501 | skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; |
| 502 | skb_shinfo(head)->frag_list = NULL; |
| 503 | for (i=0; i<skb_shinfo(head)->nr_frags; i++) |
| 504 | plen += skb_shinfo(head)->frags[i].size; |
| 505 | clone->len = clone->data_len = head->data_len - plen; |
| 506 | head->data_len -= clone->len; |
| 507 | head->len -= clone->len; |
| 508 | clone->csum = 0; |
| 509 | clone->ip_summed = head->ip_summed; |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 510 | atomic_add(clone->truesize, &fq->q.net->mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 511 | } |
| 512 | |
| 513 | /* We have to remove fragment header from datagram and to relocate |
| 514 | * header in order to calculate ICV correctly. */ |
| 515 | nhoff = fq->nhoffset; |
Arnaldo Carvalho de Melo | b0e380b | 2007-04-10 21:21:55 -0700 | [diff] [blame] | 516 | skb_network_header(head)[nhoff] = skb_transport_header(head)[0]; |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 517 | memmove(head->head + sizeof(struct frag_hdr), head->head, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 518 | (head->data - head->head) - sizeof(struct frag_hdr)); |
Arnaldo Carvalho de Melo | b0e380b | 2007-04-10 21:21:55 -0700 | [diff] [blame] | 519 | head->mac_header += sizeof(struct frag_hdr); |
| 520 | head->network_header += sizeof(struct frag_hdr); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 521 | |
| 522 | skb_shinfo(head)->frag_list = head->next; |
Arnaldo Carvalho de Melo | badff6d | 2007-03-13 13:06:52 -0300 | [diff] [blame] | 523 | skb_reset_transport_header(head); |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 524 | skb_push(head, head->data - skb_network_header(head)); |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 525 | atomic_sub(head->truesize, &fq->q.net->mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 526 | |
| 527 | for (fp=head->next; fp; fp = fp->next) { |
| 528 | head->data_len += fp->len; |
| 529 | head->len += fp->len; |
| 530 | if (head->ip_summed != fp->ip_summed) |
| 531 | head->ip_summed = CHECKSUM_NONE; |
Patrick McHardy | 84fa793 | 2006-08-29 16:44:56 -0700 | [diff] [blame] | 532 | else if (head->ip_summed == CHECKSUM_COMPLETE) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 533 | head->csum = csum_add(head->csum, fp->csum); |
| 534 | head->truesize += fp->truesize; |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 535 | atomic_sub(fp->truesize, &fq->q.net->mem); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 536 | } |
| 537 | |
| 538 | head->next = NULL; |
| 539 | head->dev = dev; |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 540 | head->tstamp = fq->q.stamp; |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 541 | ipv6_hdr(head)->payload_len = htons(payload_len); |
Patrick McHardy | 951dbc8 | 2006-01-06 23:02:34 -0800 | [diff] [blame] | 542 | IP6CB(head)->nhoff = nhoff; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 543 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 544 | /* Yes, and fold redundant checksum back. 8) */ |
Patrick McHardy | 84fa793 | 2006-08-29 16:44:56 -0700 | [diff] [blame] | 545 | if (head->ip_summed == CHECKSUM_COMPLETE) |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 546 | head->csum = csum_partial(skb_network_header(head), |
Arnaldo Carvalho de Melo | cfe1fc7 | 2007-03-16 17:26:39 -0300 | [diff] [blame] | 547 | skb_network_header_len(head), |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 548 | head->csum); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 549 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 550 | rcu_read_lock(); |
| 551 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS); |
| 552 | rcu_read_unlock(); |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 553 | fq->q.fragments = NULL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 554 | return 1; |
| 555 | |
| 556 | out_oversize: |
| 557 | if (net_ratelimit()) |
| 558 | printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len); |
| 559 | goto out_fail; |
| 560 | out_oom: |
| 561 | if (net_ratelimit()) |
| 562 | printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n"); |
| 563 | out_fail: |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 564 | rcu_read_lock(); |
| 565 | IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); |
| 566 | rcu_read_unlock(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 567 | return -1; |
| 568 | } |
| 569 | |
Herbert Xu | e5bbef2 | 2007-10-15 12:50:28 -0700 | [diff] [blame] | 570 | static int ipv6_frag_rcv(struct sk_buff *skb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 571 | { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 572 | struct frag_hdr *fhdr; |
| 573 | struct frag_queue *fq; |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 574 | struct ipv6hdr *hdr = ipv6_hdr(skb); |
Pavel Emelyanov | ac18e75 | 2008-01-22 06:02:14 -0800 | [diff] [blame] | 575 | struct net *net; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 576 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 577 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 578 | |
| 579 | /* Jumbo payload inhibits frag. header */ |
| 580 | if (hdr->payload_len==0) { |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 581 | IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS); |
Arnaldo Carvalho de Melo | cfe1fc7 | 2007-03-16 17:26:39 -0300 | [diff] [blame] | 582 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
| 583 | skb_network_header_len(skb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 584 | return -1; |
| 585 | } |
Arnaldo Carvalho de Melo | ea2ae17 | 2007-04-25 17:55:53 -0700 | [diff] [blame] | 586 | if (!pskb_may_pull(skb, (skb_transport_offset(skb) + |
| 587 | sizeof(struct frag_hdr)))) { |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 588 | IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS); |
Arnaldo Carvalho de Melo | cfe1fc7 | 2007-03-16 17:26:39 -0300 | [diff] [blame] | 589 | icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, |
| 590 | skb_network_header_len(skb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 591 | return -1; |
| 592 | } |
| 593 | |
Arnaldo Carvalho de Melo | 0660e03 | 2007-04-25 17:54:47 -0700 | [diff] [blame] | 594 | hdr = ipv6_hdr(skb); |
Arnaldo Carvalho de Melo | 9c70220 | 2007-04-25 18:04:18 -0700 | [diff] [blame] | 595 | fhdr = (struct frag_hdr *)skb_transport_header(skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 596 | |
| 597 | if (!(fhdr->frag_off & htons(0xFFF9))) { |
| 598 | /* It is not a fragmented frame */ |
Arnaldo Carvalho de Melo | b0e380b | 2007-04-10 21:21:55 -0700 | [diff] [blame] | 599 | skb->transport_header += sizeof(struct frag_hdr); |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 600 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 601 | |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 602 | IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 603 | return 1; |
| 604 | } |
| 605 | |
YOSHIFUJI Hideaki | c346dca | 2008-03-25 21:47:49 +0900 | [diff] [blame] | 606 | net = dev_net(skb->dev); |
Pavel Emelyanov | e31e0bdc7 | 2008-01-22 06:10:13 -0800 | [diff] [blame] | 607 | if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh) |
Pavel Emelyanov | 6ddc082 | 2008-01-22 06:07:25 -0800 | [diff] [blame] | 608 | ip6_evictor(net, ip6_dst_idev(skb->dst)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 609 | |
Pavel Emelyanov | ac18e75 | 2008-01-22 06:02:14 -0800 | [diff] [blame] | 610 | if ((fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 611 | ip6_dst_idev(skb->dst))) != NULL) { |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 612 | int ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 613 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 614 | spin_lock(&fq->q.lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 615 | |
Herbert Xu | f61944e | 2007-10-15 01:28:47 -0700 | [diff] [blame] | 616 | ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 617 | |
Pavel Emelyanov | 5ab11c9 | 2007-10-15 02:24:19 -0700 | [diff] [blame] | 618 | spin_unlock(&fq->q.lock); |
Pavel Emelyanov | 4b6cb5d | 2007-10-15 02:41:09 -0700 | [diff] [blame] | 619 | fq_put(fq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 620 | return ret; |
| 621 | } |
| 622 | |
YOSHIFUJI Hideaki | a11d206 | 2006-11-04 20:11:37 +0900 | [diff] [blame] | 623 | IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 624 | kfree_skb(skb); |
| 625 | return -1; |
| 626 | } |
| 627 | |
| 628 | static struct inet6_protocol frag_protocol = |
| 629 | { |
| 630 | .handler = ipv6_frag_rcv, |
| 631 | .flags = INET6_PROTO_NOPOLICY, |
| 632 | }; |
| 633 | |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 634 | #ifdef CONFIG_SYSCTL |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 635 | static struct ctl_table ip6_frags_ns_ctl_table[] = { |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 636 | { |
| 637 | .ctl_name = NET_IPV6_IP6FRAG_HIGH_THRESH, |
| 638 | .procname = "ip6frag_high_thresh", |
Pavel Emelyanov | e31e0bdc7 | 2008-01-22 06:10:13 -0800 | [diff] [blame] | 639 | .data = &init_net.ipv6.frags.high_thresh, |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 640 | .maxlen = sizeof(int), |
| 641 | .mode = 0644, |
| 642 | .proc_handler = &proc_dointvec |
| 643 | }, |
| 644 | { |
| 645 | .ctl_name = NET_IPV6_IP6FRAG_LOW_THRESH, |
| 646 | .procname = "ip6frag_low_thresh", |
Pavel Emelyanov | e31e0bdc7 | 2008-01-22 06:10:13 -0800 | [diff] [blame] | 647 | .data = &init_net.ipv6.frags.low_thresh, |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 648 | .maxlen = sizeof(int), |
| 649 | .mode = 0644, |
| 650 | .proc_handler = &proc_dointvec |
| 651 | }, |
| 652 | { |
| 653 | .ctl_name = NET_IPV6_IP6FRAG_TIME, |
| 654 | .procname = "ip6frag_time", |
Pavel Emelyanov | b2fd532 | 2008-01-22 06:09:37 -0800 | [diff] [blame] | 655 | .data = &init_net.ipv6.frags.timeout, |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 656 | .maxlen = sizeof(int), |
| 657 | .mode = 0644, |
| 658 | .proc_handler = &proc_dointvec_jiffies, |
| 659 | .strategy = &sysctl_jiffies, |
| 660 | }, |
Pavel Emelyanov | 7d291eb | 2008-05-19 13:53:02 -0700 | [diff] [blame] | 661 | { } |
| 662 | }; |
| 663 | |
| 664 | static struct ctl_table ip6_frags_ctl_table[] = { |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 665 | { |
| 666 | .ctl_name = NET_IPV6_IP6FRAG_SECRET_INTERVAL, |
| 667 | .procname = "ip6frag_secret_interval", |
Pavel Emelyanov | 3b4bc4a | 2008-01-22 06:11:04 -0800 | [diff] [blame] | 668 | .data = &ip6_frags.secret_interval, |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 669 | .maxlen = sizeof(int), |
| 670 | .mode = 0644, |
| 671 | .proc_handler = &proc_dointvec_jiffies, |
| 672 | .strategy = &sysctl_jiffies |
| 673 | }, |
| 674 | { } |
| 675 | }; |
Daniel Lezcano | 7d460db | 2008-01-18 23:52:35 -0800 | [diff] [blame] | 676 | |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 677 | static int ip6_frags_ns_sysctl_register(struct net *net) |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 678 | { |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 679 | struct ctl_table *table; |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 680 | struct ctl_table_header *hdr; |
| 681 | |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 682 | table = ip6_frags_ns_ctl_table; |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 683 | if (net != &init_net) { |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 684 | table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL); |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 685 | if (table == NULL) |
| 686 | goto err_alloc; |
| 687 | |
Pavel Emelyanov | e31e0bdc7 | 2008-01-22 06:10:13 -0800 | [diff] [blame] | 688 | table[0].data = &net->ipv6.frags.high_thresh; |
| 689 | table[1].data = &net->ipv6.frags.low_thresh; |
Pavel Emelyanov | b2fd532 | 2008-01-22 06:09:37 -0800 | [diff] [blame] | 690 | table[2].data = &net->ipv6.frags.timeout; |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 691 | } |
| 692 | |
| 693 | hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table); |
| 694 | if (hdr == NULL) |
| 695 | goto err_reg; |
| 696 | |
| 697 | net->ipv6.sysctl.frags_hdr = hdr; |
| 698 | return 0; |
| 699 | |
| 700 | err_reg: |
| 701 | if (net != &init_net) |
| 702 | kfree(table); |
| 703 | err_alloc: |
| 704 | return -ENOMEM; |
| 705 | } |
| 706 | |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 707 | static void ip6_frags_ns_sysctl_unregister(struct net *net) |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 708 | { |
| 709 | struct ctl_table *table; |
| 710 | |
| 711 | table = net->ipv6.sysctl.frags_hdr->ctl_table_arg; |
| 712 | unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr); |
| 713 | kfree(table); |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 714 | } |
Pavel Emelyanov | 7d291eb | 2008-05-19 13:53:02 -0700 | [diff] [blame] | 715 | |
| 716 | static struct ctl_table_header *ip6_ctl_header; |
| 717 | |
| 718 | static int ip6_frags_sysctl_register(void) |
| 719 | { |
| 720 | ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path, |
| 721 | ip6_frags_ctl_table); |
| 722 | return ip6_ctl_header == NULL ? -ENOMEM : 0; |
| 723 | } |
| 724 | |
| 725 | static void ip6_frags_sysctl_unregister(void) |
| 726 | { |
| 727 | unregister_net_sysctl_table(ip6_ctl_header); |
| 728 | } |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 729 | #else |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 730 | static inline int ip6_frags_ns_sysctl_register(struct net *net) |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 731 | { |
| 732 | return 0; |
| 733 | } |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 734 | |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 735 | static inline void ip6_frags_ns_sysctl_unregister(struct net *net) |
Pavel Emelyanov | e4a2d5c | 2008-01-22 06:08:36 -0800 | [diff] [blame] | 736 | { |
| 737 | } |
Pavel Emelyanov | 7d291eb | 2008-05-19 13:53:02 -0700 | [diff] [blame] | 738 | |
| 739 | static inline int ip6_frags_sysctl_register(void) |
| 740 | { |
| 741 | return 0; |
| 742 | } |
| 743 | |
| 744 | static inline void ip6_frags_sysctl_unregister(void) |
| 745 | { |
| 746 | } |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 747 | #endif |
| 748 | |
| 749 | static int ipv6_frags_init_net(struct net *net) |
| 750 | { |
Pavel Emelyanov | e31e0bdc7 | 2008-01-22 06:10:13 -0800 | [diff] [blame] | 751 | net->ipv6.frags.high_thresh = 256 * 1024; |
| 752 | net->ipv6.frags.low_thresh = 192 * 1024; |
Pavel Emelyanov | b2fd532 | 2008-01-22 06:09:37 -0800 | [diff] [blame] | 753 | net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 754 | |
Pavel Emelyanov | e5a2bb842 | 2008-01-22 06:06:23 -0800 | [diff] [blame] | 755 | inet_frags_init_net(&net->ipv6.frags); |
| 756 | |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 757 | return ip6_frags_ns_sysctl_register(net); |
Daniel Lezcano | e71e034 | 2008-01-10 02:56:03 -0800 | [diff] [blame] | 758 | } |
| 759 | |
Pavel Emelyanov | 81566e8 | 2008-01-22 06:12:39 -0800 | [diff] [blame] | 760 | static void ipv6_frags_exit_net(struct net *net) |
| 761 | { |
Pavel Emelyanov | 0a64b4b | 2008-05-19 13:51:29 -0700 | [diff] [blame] | 762 | ip6_frags_ns_sysctl_unregister(net); |
Pavel Emelyanov | 81566e8 | 2008-01-22 06:12:39 -0800 | [diff] [blame] | 763 | inet_frags_exit_net(&net->ipv6.frags, &ip6_frags); |
| 764 | } |
| 765 | |
| 766 | static struct pernet_operations ip6_frags_ops = { |
| 767 | .init = ipv6_frags_init_net, |
| 768 | .exit = ipv6_frags_exit_net, |
| 769 | }; |
| 770 | |
Daniel Lezcano | 853cbba | 2007-12-11 02:24:29 -0800 | [diff] [blame] | 771 | int __init ipv6_frag_init(void) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 772 | { |
Daniel Lezcano | 853cbba | 2007-12-11 02:24:29 -0800 | [diff] [blame] | 773 | int ret; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 774 | |
Daniel Lezcano | 853cbba | 2007-12-11 02:24:29 -0800 | [diff] [blame] | 775 | ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
| 776 | if (ret) |
| 777 | goto out; |
Daniel Lezcano | e71e034 | 2008-01-10 02:56:03 -0800 | [diff] [blame] | 778 | |
Pavel Emelyanov | 7d291eb | 2008-05-19 13:53:02 -0700 | [diff] [blame] | 779 | ret = ip6_frags_sysctl_register(); |
| 780 | if (ret) |
| 781 | goto err_sysctl; |
| 782 | |
Pavel Emelyanov | 0002c63 | 2008-05-19 13:52:28 -0700 | [diff] [blame] | 783 | ret = register_pernet_subsys(&ip6_frags_ops); |
| 784 | if (ret) |
| 785 | goto err_pernet; |
Pavel Emelyanov | 8d8354d | 2008-01-22 05:58:31 -0800 | [diff] [blame] | 786 | |
Pavel Emelyanov | 321a3a9 | 2007-10-15 02:38:08 -0700 | [diff] [blame] | 787 | ip6_frags.hashfn = ip6_hashfn; |
Pavel Emelyanov | c6fda28 | 2007-10-17 19:46:47 -0700 | [diff] [blame] | 788 | ip6_frags.constructor = ip6_frag_init; |
Pavel Emelyanov | c954770 | 2007-10-17 19:48:26 -0700 | [diff] [blame] | 789 | ip6_frags.destructor = NULL; |
Pavel Emelyanov | 1e4b828 | 2007-10-15 02:39:14 -0700 | [diff] [blame] | 790 | ip6_frags.skb_free = NULL; |
| 791 | ip6_frags.qsize = sizeof(struct frag_queue); |
Pavel Emelyanov | abd6523 | 2007-10-17 19:47:21 -0700 | [diff] [blame] | 792 | ip6_frags.match = ip6_frag_match; |
Pavel Emelyanov | e521db9 | 2007-10-17 19:45:23 -0700 | [diff] [blame] | 793 | ip6_frags.frag_expire = ip6_frag_expire; |
Pavel Emelyanov | 3b4bc4a | 2008-01-22 06:11:04 -0800 | [diff] [blame] | 794 | ip6_frags.secret_interval = 10 * 60 * HZ; |
Pavel Emelyanov | 7eb9515 | 2007-10-15 02:31:52 -0700 | [diff] [blame] | 795 | inet_frags_init(&ip6_frags); |
Daniel Lezcano | 853cbba | 2007-12-11 02:24:29 -0800 | [diff] [blame] | 796 | out: |
| 797 | return ret; |
Pavel Emelyanov | 0002c63 | 2008-05-19 13:52:28 -0700 | [diff] [blame] | 798 | |
| 799 | err_pernet: |
Pavel Emelyanov | 7d291eb | 2008-05-19 13:53:02 -0700 | [diff] [blame] | 800 | ip6_frags_sysctl_unregister(); |
| 801 | err_sysctl: |
Pavel Emelyanov | 0002c63 | 2008-05-19 13:52:28 -0700 | [diff] [blame] | 802 | inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
| 803 | goto out; |
Daniel Lezcano | 853cbba | 2007-12-11 02:24:29 -0800 | [diff] [blame] | 804 | } |
| 805 | |
| 806 | void ipv6_frag_exit(void) |
| 807 | { |
| 808 | inet_frags_fini(&ip6_frags); |
Pavel Emelyanov | 7d291eb | 2008-05-19 13:53:02 -0700 | [diff] [blame] | 809 | ip6_frags_sysctl_unregister(); |
Pavel Emelyanov | 81566e8 | 2008-01-22 06:12:39 -0800 | [diff] [blame] | 810 | unregister_pernet_subsys(&ip6_frags_ops); |
Daniel Lezcano | 853cbba | 2007-12-11 02:24:29 -0800 | [diff] [blame] | 811 | inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 812 | } |