reassembly.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775
  1. /*
  2. * IPv6 fragment reassembly
  3. * Linux INET6 implementation
  4. *
  5. * Authors:
  6. * Pedro Roque <roque@di.fc.ul.pt>
  7. *
  8. * $Id: reassembly.c,v 1.1.1.1 2007/06/12 07:27:14 eyryu Exp $
  9. *
  10. * Based on: net/ipv4/ip_fragment.c
  11. *
  12. * This program is free software; you can redistribute it and/or
  13. * modify it under the terms of the GNU General Public License
  14. * as published by the Free Software Foundation; either version
  15. * 2 of the License, or (at your option) any later version.
  16. */
  17. /*
  18. * Fixes:
  19. * Andi Kleen Make it work with multiple hosts.
  20. * More RFC compliance.
  21. *
  22. * Horst von Brand Add missing #include <linux/string.h>
  23. * Alexey Kuznetsov SMP races, threading, cleanup.
  24. * Patrick McHardy LRU queue of frag heads for evictor.
  25. * Mitsuru KANDA @USAGI Register inet6_protocol{}.
  26. * David Stevens and
  27. * YOSHIFUJI,H. @USAGI Always remove fragment header to
  28. * calculate ICV correctly.
  29. */
  30. #include <linux/errno.h>
  31. #include <linux/types.h>
  32. #include <linux/string.h>
  33. #include <linux/socket.h>
  34. #include <linux/sockios.h>
  35. #include <linux/jiffies.h>
  36. #include <linux/net.h>
  37. #include <linux/list.h>
  38. #include <linux/netdevice.h>
  39. #include <linux/in6.h>
  40. #include <linux/ipv6.h>
  41. #include <linux/icmpv6.h>
  42. #include <linux/random.h>
  43. #include <linux/jhash.h>
  44. #include <net/sock.h>
  45. #include <net/snmp.h>
  46. #include <net/ipv6.h>
  47. #include <net/ip6_route.h>
  48. #include <net/protocol.h>
  49. #include <net/transp_v6.h>
  50. #include <net/rawv6.h>
  51. #include <net/ndisc.h>
  52. #include <net/addrconf.h>
  53. int sysctl_ip6frag_high_thresh __read_mostly = 256*1024;
  54. int sysctl_ip6frag_low_thresh __read_mostly = 192*1024;
  55. int sysctl_ip6frag_time __read_mostly = IPV6_FRAG_TIMEOUT;
  56. struct ip6frag_skb_cb
  57. {
  58. struct inet6_skb_parm h;
  59. int offset;
  60. };
  61. #define FRAG6_CB(skb) ((struct ip6frag_skb_cb*)((skb)->cb))
  62. /*
  63. * Equivalent of ipv4 struct ipq
  64. */
  65. struct frag_queue
  66. {
  67. struct hlist_node list;
  68. struct list_head lru_list; /* lru list member */
  69. __be32 id; /* fragment id */
  70. struct in6_addr saddr;
  71. struct in6_addr daddr;
  72. spinlock_t lock;
  73. atomic_t refcnt;
  74. struct timer_list timer; /* expire timer */
  75. struct sk_buff *fragments;
  76. int len;
  77. int meat;
  78. int iif;
  79. struct timeval stamp;
  80. unsigned int csum;
  81. __u8 last_in; /* has first/last segment arrived? */
  82. #define COMPLETE 4
  83. #define FIRST_IN 2
  84. #define LAST_IN 1
  85. __u16 nhoffset;
  86. };
  87. /* Hash table. */
  88. #define IP6Q_HASHSZ 64
  89. static struct hlist_head ip6_frag_hash[IP6Q_HASHSZ];
  90. static DEFINE_RWLOCK(ip6_frag_lock);
  91. static u32 ip6_frag_hash_rnd;
  92. static LIST_HEAD(ip6_frag_lru_list);
  93. int ip6_frag_nqueues = 0;
  94. static __inline__ void __fq_unlink(struct frag_queue *fq)
  95. {
  96. hlist_del(&fq->list);
  97. list_del(&fq->lru_list);
  98. ip6_frag_nqueues--;
  99. }
  100. static __inline__ void fq_unlink(struct frag_queue *fq)
  101. {
  102. write_lock(&ip6_frag_lock);
  103. __fq_unlink(fq);
  104. write_unlock(&ip6_frag_lock);
  105. }
  106. /*
  107. * callers should be careful not to use the hash value outside the ipfrag_lock
  108. * as doing so could race with ipfrag_hash_rnd being recalculated.
  109. */
  110. static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
  111. struct in6_addr *daddr)
  112. {
  113. u32 a, b, c;
  114. a = (__force u32)saddr->s6_addr32[0];
  115. b = (__force u32)saddr->s6_addr32[1];
  116. c = (__force u32)saddr->s6_addr32[2];
  117. a += JHASH_GOLDEN_RATIO;
  118. b += JHASH_GOLDEN_RATIO;
  119. c += ip6_frag_hash_rnd;
  120. __jhash_mix(a, b, c);
  121. a += (__force u32)saddr->s6_addr32[3];
  122. b += (__force u32)daddr->s6_addr32[0];
  123. c += (__force u32)daddr->s6_addr32[1];
  124. __jhash_mix(a, b, c);
  125. a += (__force u32)daddr->s6_addr32[2];
  126. b += (__force u32)daddr->s6_addr32[3];
  127. c += (__force u32)id;
  128. __jhash_mix(a, b, c);
  129. return c & (IP6Q_HASHSZ - 1);
  130. }
  131. static struct timer_list ip6_frag_secret_timer;
  132. int sysctl_ip6frag_secret_interval __read_mostly = 10 * 60 * HZ;
  133. static void ip6_frag_secret_rebuild(unsigned long dummy)
  134. {
  135. unsigned long now = jiffies;
  136. int i;
  137. write_lock(&ip6_frag_lock);
  138. get_random_bytes(&ip6_frag_hash_rnd, sizeof(u32));
  139. for (i = 0; i < IP6Q_HASHSZ; i++) {
  140. struct frag_queue *q;
  141. struct hlist_node *p, *n;
  142. hlist_for_each_entry_safe(q, p, n, &ip6_frag_hash[i], list) {
  143. unsigned int hval = ip6qhashfn(q->id,
  144. &q->saddr,
  145. &q->daddr);
  146. if (hval != i) {
  147. hlist_del(&q->list);
  148. /* Relink to new hash chain. */
  149. hlist_add_head(&q->list,
  150. &ip6_frag_hash[hval]);
  151. }
  152. }
  153. }
  154. write_unlock(&ip6_frag_lock);
  155. mod_timer(&ip6_frag_secret_timer, now + sysctl_ip6frag_secret_interval);
  156. }
  157. atomic_t ip6_frag_mem = ATOMIC_INIT(0);
  158. /* Memory Tracking Functions. */
  159. static inline void frag_kfree_skb(struct sk_buff *skb, int *work)
  160. {
  161. if (work)
  162. *work -= skb->truesize;
  163. atomic_sub(skb->truesize, &ip6_frag_mem);
  164. kfree_skb(skb);
  165. }
  166. static inline void frag_free_queue(struct frag_queue *fq, int *work)
  167. {
  168. if (work)
  169. *work -= sizeof(struct frag_queue);
  170. atomic_sub(sizeof(struct frag_queue), &ip6_frag_mem);
  171. kfree(fq);
  172. }
  173. static inline struct frag_queue *frag_alloc_queue(void)
  174. {
  175. struct frag_queue *fq = kzalloc(sizeof(struct frag_queue), GFP_ATOMIC);
  176. if(!fq)
  177. return NULL;
  178. atomic_add(sizeof(struct frag_queue), &ip6_frag_mem);
  179. return fq;
  180. }
  181. /* Destruction primitives. */
  182. /* Complete destruction of fq. */
  183. static void ip6_frag_destroy(struct frag_queue *fq, int *work)
  184. {
  185. struct sk_buff *fp;
  186. BUG_TRAP(fq->last_in&COMPLETE);
  187. BUG_TRAP(del_timer(&fq->timer) == 0);
  188. /* Release all fragment data. */
  189. fp = fq->fragments;
  190. while (fp) {
  191. struct sk_buff *xp = fp->next;
  192. frag_kfree_skb(fp, work);
  193. fp = xp;
  194. }
  195. frag_free_queue(fq, work);
  196. }
  197. static __inline__ void fq_put(struct frag_queue *fq, int *work)
  198. {
  199. if (atomic_dec_and_test(&fq->refcnt))
  200. ip6_frag_destroy(fq, work);
  201. }
  202. /* Kill fq entry. It is not destroyed immediately,
  203. * because caller (and someone more) holds reference count.
  204. */
  205. static __inline__ void fq_kill(struct frag_queue *fq)
  206. {
  207. if (del_timer(&fq->timer))
  208. atomic_dec(&fq->refcnt);
  209. if (!(fq->last_in & COMPLETE)) {
  210. fq_unlink(fq);
  211. atomic_dec(&fq->refcnt);
  212. fq->last_in |= COMPLETE;
  213. }
  214. }
  215. static void ip6_evictor(struct inet6_dev *idev)
  216. {
  217. struct frag_queue *fq;
  218. struct list_head *tmp;
  219. int work;
  220. work = atomic_read(&ip6_frag_mem) - sysctl_ip6frag_low_thresh;
  221. if (work <= 0)
  222. return;
  223. while(work > 0) {
  224. read_lock(&ip6_frag_lock);
  225. if (list_empty(&ip6_frag_lru_list)) {
  226. read_unlock(&ip6_frag_lock);
  227. return;
  228. }
  229. tmp = ip6_frag_lru_list.next;
  230. fq = list_entry(tmp, struct frag_queue, lru_list);
  231. atomic_inc(&fq->refcnt);
  232. read_unlock(&ip6_frag_lock);
  233. spin_lock(&fq->lock);
  234. if (!(fq->last_in&COMPLETE))
  235. fq_kill(fq);
  236. spin_unlock(&fq->lock);
  237. fq_put(fq, &work);
  238. IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
  239. }
  240. }
  241. static void ip6_frag_expire(unsigned long data)
  242. {
  243. struct frag_queue *fq = (struct frag_queue *) data;
  244. struct net_device *dev = NULL;
  245. spin_lock(&fq->lock);
  246. if (fq->last_in & COMPLETE)
  247. goto out;
  248. fq_kill(fq);
  249. dev = dev_get_by_index(fq->iif);
  250. if (!dev)
  251. goto out;
  252. rcu_read_lock();
  253. IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
  254. IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
  255. rcu_read_unlock();
  256. /* Don't send error if the first segment did not arrive. */
  257. if (!(fq->last_in&FIRST_IN) || !fq->fragments)
  258. goto out;
  259. /*
  260. But use as source device on which LAST ARRIVED
  261. segment was received. And do not use fq->dev
  262. pointer directly, device might already disappeared.
  263. */
  264. fq->fragments->dev = dev;
  265. icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
  266. out:
  267. if (dev)
  268. dev_put(dev);
  269. spin_unlock(&fq->lock);
  270. fq_put(fq, NULL);
  271. }
  272. /* Creation primitives. */
  273. static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
  274. {
  275. struct frag_queue *fq;
  276. unsigned int hash;
  277. #ifdef CONFIG_SMP
  278. struct hlist_node *n;
  279. #endif
  280. write_lock(&ip6_frag_lock);
  281. hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr);
  282. #ifdef CONFIG_SMP
  283. hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
  284. if (fq->id == fq_in->id &&
  285. ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
  286. ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
  287. atomic_inc(&fq->refcnt);
  288. write_unlock(&ip6_frag_lock);
  289. fq_in->last_in |= COMPLETE;
  290. fq_put(fq_in, NULL);
  291. return fq;
  292. }
  293. }
  294. #endif
  295. fq = fq_in;
  296. if (!mod_timer(&fq->timer, jiffies + sysctl_ip6frag_time))
  297. atomic_inc(&fq->refcnt);
  298. atomic_inc(&fq->refcnt);
  299. hlist_add_head(&fq->list, &ip6_frag_hash[hash]);
  300. INIT_LIST_HEAD(&fq->lru_list);
  301. list_add_tail(&fq->lru_list, &ip6_frag_lru_list);
  302. ip6_frag_nqueues++;
  303. write_unlock(&ip6_frag_lock);
  304. return fq;
  305. }
  306. static struct frag_queue *
  307. ip6_frag_create(__be32 id, struct in6_addr *src, struct in6_addr *dst,
  308. struct inet6_dev *idev)
  309. {
  310. struct frag_queue *fq;
  311. if ((fq = frag_alloc_queue()) == NULL)
  312. goto oom;
  313. fq->id = id;
  314. ipv6_addr_copy(&fq->saddr, src);
  315. ipv6_addr_copy(&fq->daddr, dst);
  316. init_timer(&fq->timer);
  317. fq->timer.function = ip6_frag_expire;
  318. fq->timer.data = (long) fq;
  319. spin_lock_init(&fq->lock);
  320. atomic_set(&fq->refcnt, 1);
  321. return ip6_frag_intern(fq);
  322. oom:
  323. IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
  324. return NULL;
  325. }
  326. static __inline__ struct frag_queue *
  327. fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
  328. struct inet6_dev *idev)
  329. {
  330. struct frag_queue *fq;
  331. struct hlist_node *n;
  332. unsigned int hash;
  333. read_lock(&ip6_frag_lock);
  334. hash = ip6qhashfn(id, src, dst);
  335. hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
  336. if (fq->id == id &&
  337. ipv6_addr_equal(src, &fq->saddr) &&
  338. ipv6_addr_equal(dst, &fq->daddr)) {
  339. atomic_inc(&fq->refcnt);
  340. read_unlock(&ip6_frag_lock);
  341. return fq;
  342. }
  343. }
  344. read_unlock(&ip6_frag_lock);
  345. return ip6_frag_create(id, src, dst, idev);
  346. }
  347. static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
  348. struct frag_hdr *fhdr, int nhoff)
  349. {
  350. struct sk_buff *prev, *next;
  351. int offset, end;
  352. if (fq->last_in & COMPLETE)
  353. goto err;
  354. offset = ntohs(fhdr->frag_off) & ~0x7;
  355. end = offset + (ntohs(skb->nh.ipv6h->payload_len) -
  356. ((u8 *) (fhdr + 1) - (u8 *) (skb->nh.ipv6h + 1)));
  357. if ((unsigned int)end > IPV6_MAXPLEN) {
  358. IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
  359. IPSTATS_MIB_INHDRERRORS);
  360. icmpv6_param_prob(skb,ICMPV6_HDR_FIELD, (u8*)&fhdr->frag_off - skb->nh.raw);
  361. return;
  362. }
  363. if (skb->ip_summed == CHECKSUM_COMPLETE)
  364. skb->csum = csum_sub(skb->csum,
  365. csum_partial(skb->nh.raw, (u8*)(fhdr+1)-skb->nh.raw, 0));
  366. /* Is this the final fragment? */
  367. if (!(fhdr->frag_off & htons(IP6_MF))) {
  368. /* If we already have some bits beyond end
  369. * or have different end, the segment is corrupted.
  370. */
  371. if (end < fq->len ||
  372. ((fq->last_in & LAST_IN) && end != fq->len))
  373. goto err;
  374. fq->last_in |= LAST_IN;
  375. fq->len = end;
  376. } else {
  377. /* Check if the fragment is rounded to 8 bytes.
  378. * Required by the RFC.
  379. */
  380. if (end & 0x7) {
  381. /* RFC2460 says always send parameter problem in
  382. * this case. -DaveM
  383. */
  384. IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
  385. IPSTATS_MIB_INHDRERRORS);
  386. icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
  387. offsetof(struct ipv6hdr, payload_len));
  388. return;
  389. }
  390. if (end > fq->len) {
  391. /* Some bits beyond end -> corruption. */
  392. if (fq->last_in & LAST_IN)
  393. goto err;
  394. fq->len = end;
  395. }
  396. }
  397. if (end == offset)
  398. goto err;
  399. /* Point into the IP datagram 'data' part. */
  400. if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
  401. goto err;
  402. if (pskb_trim_rcsum(skb, end - offset))
  403. goto err;
  404. /* Find out which fragments are in front and at the back of us
  405. * in the chain of fragments so far. We must know where to put
  406. * this fragment, right?
  407. */
  408. prev = NULL;
  409. for(next = fq->fragments; next != NULL; next = next->next) {
  410. if (FRAG6_CB(next)->offset >= offset)
  411. break; /* bingo! */
  412. prev = next;
  413. }
  414. /* We found where to put this one. Check for overlap with
  415. * preceding fragment, and, if needed, align things so that
  416. * any overlaps are eliminated.
  417. */
  418. if (prev) {
  419. int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
  420. if (i > 0) {
  421. offset += i;
  422. if (end <= offset)
  423. goto err;
  424. if (!pskb_pull(skb, i))
  425. goto err;
  426. if (skb->ip_summed != CHECKSUM_UNNECESSARY)
  427. skb->ip_summed = CHECKSUM_NONE;
  428. }
  429. }
  430. /* Look for overlap with succeeding segments.
  431. * If we can merge fragments, do it.
  432. */
  433. while (next && FRAG6_CB(next)->offset < end) {
  434. int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
  435. if (i < next->len) {
  436. /* Eat head of the next overlapped fragment
  437. * and leave the loop. The next ones cannot overlap.
  438. */
  439. if (!pskb_pull(next, i))
  440. goto err;
  441. FRAG6_CB(next)->offset += i; /* next fragment */
  442. fq->meat -= i;
  443. if (next->ip_summed != CHECKSUM_UNNECESSARY)
  444. next->ip_summed = CHECKSUM_NONE;
  445. break;
  446. } else {
  447. struct sk_buff *free_it = next;
  448. /* Old fragment is completely overridden with
  449. * new one drop it.
  450. */
  451. next = next->next;
  452. if (prev)
  453. prev->next = next;
  454. else
  455. fq->fragments = next;
  456. fq->meat -= free_it->len;
  457. frag_kfree_skb(free_it, NULL);
  458. }
  459. }
  460. FRAG6_CB(skb)->offset = offset;
  461. /* Insert this fragment in the chain of fragments. */
  462. skb->next = next;
  463. if (prev)
  464. prev->next = skb;
  465. else
  466. fq->fragments = skb;
  467. if (skb->dev)
  468. fq->iif = skb->dev->ifindex;
  469. skb->dev = NULL;
  470. skb_get_timestamp(skb, &fq->stamp);
  471. fq->meat += skb->len;
  472. atomic_add(skb->truesize, &ip6_frag_mem);
  473. /* The first fragment.
  474. * nhoffset is obtained from the first fragment, of course.
  475. */
  476. if (offset == 0) {
  477. fq->nhoffset = nhoff;
  478. fq->last_in |= FIRST_IN;
  479. }
  480. write_lock(&ip6_frag_lock);
  481. list_move_tail(&fq->lru_list, &ip6_frag_lru_list);
  482. write_unlock(&ip6_frag_lock);
  483. return;
  484. err:
  485. IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
  486. kfree_skb(skb);
  487. }
  488. /*
  489. * Check if this packet is complete.
  490. * Returns NULL on failure by any reason, and pointer
  491. * to current nexthdr field in reassembled frame.
  492. *
  493. * It is called with locked fq, and caller must check that
  494. * queue is eligible for reassembly i.e. it is not COMPLETE,
  495. * the last and the first frames arrived and all the bits are here.
  496. */
  497. static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
  498. struct net_device *dev)
  499. {
  500. struct sk_buff *fp, *head = fq->fragments;
  501. int payload_len;
  502. unsigned int nhoff;
  503. fq_kill(fq);
  504. BUG_TRAP(head != NULL);
  505. BUG_TRAP(FRAG6_CB(head)->offset == 0);
  506. /* Unfragmented part is taken from the first segment. */
  507. payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len - sizeof(struct frag_hdr);
  508. if (payload_len > IPV6_MAXPLEN)
  509. goto out_oversize;
  510. /* Head of list must not be cloned. */
  511. if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
  512. goto out_oom;
  513. /* If the first fragment is fragmented itself, we split
  514. * it to two chunks: the first with data and paged part
  515. * and the second, holding only fragments. */
  516. if (skb_shinfo(head)->frag_list) {
  517. struct sk_buff *clone;
  518. int i, plen = 0;
  519. if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
  520. goto out_oom;
  521. clone->next = head->next;
  522. head->next = clone;
  523. skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
  524. skb_shinfo(head)->frag_list = NULL;
  525. for (i=0; i<skb_shinfo(head)->nr_frags; i++)
  526. plen += skb_shinfo(head)->frags[i].size;
  527. clone->len = clone->data_len = head->data_len - plen;
  528. head->data_len -= clone->len;
  529. head->len -= clone->len;
  530. clone->csum = 0;
  531. clone->ip_summed = head->ip_summed;
  532. atomic_add(clone->truesize, &ip6_frag_mem);
  533. }
  534. /* We have to remove fragment header from datagram and to relocate
  535. * header in order to calculate ICV correctly. */
  536. nhoff = fq->nhoffset;
  537. head->nh.raw[nhoff] = head->h.raw[0];
  538. memmove(head->head + sizeof(struct frag_hdr), head->head,
  539. (head->data - head->head) - sizeof(struct frag_hdr));
  540. head->mac.raw += sizeof(struct frag_hdr);
  541. head->nh.raw += sizeof(struct frag_hdr);
  542. skb_shinfo(head)->frag_list = head->next;
  543. head->h.raw = head->data;
  544. skb_push(head, head->data - head->nh.raw);
  545. atomic_sub(head->truesize, &ip6_frag_mem);
  546. for (fp=head->next; fp; fp = fp->next) {
  547. head->data_len += fp->len;
  548. head->len += fp->len;
  549. if (head->ip_summed != fp->ip_summed)
  550. head->ip_summed = CHECKSUM_NONE;
  551. else if (head->ip_summed == CHECKSUM_COMPLETE)
  552. head->csum = csum_add(head->csum, fp->csum);
  553. head->truesize += fp->truesize;
  554. atomic_sub(fp->truesize, &ip6_frag_mem);
  555. }
  556. head->next = NULL;
  557. head->dev = dev;
  558. skb_set_timestamp(head, &fq->stamp);
  559. head->nh.ipv6h->payload_len = htons(payload_len);
  560. IP6CB(head)->nhoff = nhoff;
  561. *skb_in = head;
  562. /* Yes, and fold redundant checksum back. 8) */
  563. if (head->ip_summed == CHECKSUM_COMPLETE)
  564. head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
  565. rcu_read_lock();
  566. IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
  567. rcu_read_unlock();
  568. fq->fragments = NULL;
  569. return 1;
  570. out_oversize:
  571. if (net_ratelimit())
  572. printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
  573. goto out_fail;
  574. out_oom:
  575. if (net_ratelimit())
  576. printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
  577. out_fail:
  578. rcu_read_lock();
  579. IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
  580. rcu_read_unlock();
  581. return -1;
  582. }
  583. static int ipv6_frag_rcv(struct sk_buff **skbp)
  584. {
  585. struct sk_buff *skb = *skbp;
  586. struct net_device *dev = skb->dev;
  587. struct frag_hdr *fhdr;
  588. struct frag_queue *fq;
  589. struct ipv6hdr *hdr;
  590. hdr = skb->nh.ipv6h;
  591. IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
  592. /* Jumbo payload inhibits frag. header */
  593. if (hdr->payload_len==0) {
  594. IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
  595. icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
  596. return -1;
  597. }
  598. if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+sizeof(struct frag_hdr))) {
  599. IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
  600. icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
  601. return -1;
  602. }
  603. hdr = skb->nh.ipv6h;
  604. fhdr = (struct frag_hdr *)skb->h.raw;
  605. if (!(fhdr->frag_off & htons(0xFFF9))) {
  606. /* It is not a fragmented frame */
  607. skb->h.raw += sizeof(struct frag_hdr);
  608. IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS);
  609. IP6CB(skb)->nhoff = (u8*)fhdr - skb->nh.raw;
  610. return 1;
  611. }
  612. if (atomic_read(&ip6_frag_mem) > sysctl_ip6frag_high_thresh)
  613. ip6_evictor(ip6_dst_idev(skb->dst));
  614. if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr,
  615. ip6_dst_idev(skb->dst))) != NULL) {
  616. int ret = -1;
  617. spin_lock(&fq->lock);
  618. ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
  619. if (fq->last_in == (FIRST_IN|LAST_IN) &&
  620. fq->meat == fq->len)
  621. ret = ip6_frag_reasm(fq, skbp, dev);
  622. spin_unlock(&fq->lock);
  623. fq_put(fq, NULL);
  624. return ret;
  625. }
  626. IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
  627. kfree_skb(skb);
  628. return -1;
  629. }
  630. static struct inet6_protocol frag_protocol =
  631. {
  632. .handler = ipv6_frag_rcv,
  633. .flags = INET6_PROTO_NOPOLICY,
  634. };
  635. void __init ipv6_frag_init(void)
  636. {
  637. if (inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT) < 0)
  638. printk(KERN_ERR "ipv6_frag_init: Could not register protocol\n");
  639. ip6_frag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
  640. (jiffies ^ (jiffies >> 6)));
  641. init_timer(&ip6_frag_secret_timer);
  642. ip6_frag_secret_timer.function = ip6_frag_secret_rebuild;
  643. ip6_frag_secret_timer.expires = jiffies + sysctl_ip6frag_secret_interval;
  644. add_timer(&ip6_frag_secret_timer);
  645. }