reassembly.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * IPv6 fragment reassembly
  4. * Linux INET6 implementation
  5. *
  6. * Authors:
  7. * Pedro Roque <roque@di.fc.ul.pt>
  8. *
  9. * Based on: net/ipv4/ip_fragment.c
  10. */
  11. /*
  12. * Fixes:
  13. * Andi Kleen Make it work with multiple hosts.
  14. * More RFC compliance.
  15. *
  16. * Horst von Brand Add missing #include <linux/string.h>
  17. * Alexey Kuznetsov SMP races, threading, cleanup.
  18. * Patrick McHardy LRU queue of frag heads for evictor.
  19. * Mitsuru KANDA @USAGI Register inet6_protocol{}.
  20. * David Stevens and
  21. * YOSHIFUJI,H. @USAGI Always remove fragment header to
  22. * calculate ICV correctly.
  23. */
  24. #define pr_fmt(fmt) "IPv6: " fmt
  25. #include <linux/errno.h>
  26. #include <linux/types.h>
  27. #include <linux/string.h>
  28. #include <linux/socket.h>
  29. #include <linux/sockios.h>
  30. #include <linux/jiffies.h>
  31. #include <linux/net.h>
  32. #include <linux/list.h>
  33. #include <linux/netdevice.h>
  34. #include <linux/in6.h>
  35. #include <linux/ipv6.h>
  36. #include <linux/icmpv6.h>
  37. #include <linux/random.h>
  38. #include <linux/jhash.h>
  39. #include <linux/skbuff.h>
  40. #include <linux/slab.h>
  41. #include <linux/export.h>
  42. #include <linux/tcp.h>
  43. #include <linux/udp.h>
  44. #include <net/sock.h>
  45. #include <net/snmp.h>
  46. #include <net/ipv6.h>
  47. #include <net/ip6_route.h>
  48. #include <net/protocol.h>
  49. #include <net/transp_v6.h>
  50. #include <net/rawv6.h>
  51. #include <net/ndisc.h>
  52. #include <net/addrconf.h>
  53. #include <net/ipv6_frag.h>
  54. #include <net/inet_ecn.h>
  55. static const char ip6_frag_cache_name[] = "ip6-frags";
  56. static u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
  57. {
  58. return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK);
  59. }
  60. static struct inet_frags ip6_frags;
  61. static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
  62. struct sk_buff *prev_tail, struct net_device *dev);
  63. static void ip6_frag_expire(struct timer_list *t)
  64. {
  65. struct inet_frag_queue *frag = from_timer(frag, t, timer);
  66. struct frag_queue *fq;
  67. fq = container_of(frag, struct frag_queue, q);
  68. ip6frag_expire_frag_queue(fq->q.fqdir->net, fq);
  69. }
  70. static struct frag_queue *
  71. fq_find(struct net *net, __be32 id, const struct ipv6hdr *hdr, int iif)
  72. {
  73. struct frag_v6_compare_key key = {
  74. .id = id,
  75. .saddr = hdr->saddr,
  76. .daddr = hdr->daddr,
  77. .user = IP6_DEFRAG_LOCAL_DELIVER,
  78. .iif = iif,
  79. };
  80. struct inet_frag_queue *q;
  81. if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST |
  82. IPV6_ADDR_LINKLOCAL)))
  83. key.iif = 0;
  84. q = inet_frag_find(net->ipv6.fqdir, &key);
  85. if (!q)
  86. return NULL;
  87. return container_of(q, struct frag_queue, q);
  88. }
  89. static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
  90. struct frag_hdr *fhdr, int nhoff,
  91. u32 *prob_offset)
  92. {
  93. struct net *net = dev_net(skb_dst(skb)->dev);
  94. int offset, end, fragsize;
  95. struct sk_buff *prev_tail;
  96. struct net_device *dev;
  97. int err = -ENOENT;
  98. u8 ecn;
  99. if (fq->q.flags & INET_FRAG_COMPLETE)
  100. goto err;
  101. err = -EINVAL;
  102. offset = ntohs(fhdr->frag_off) & ~0x7;
  103. end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
  104. ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
  105. if ((unsigned int)end > IPV6_MAXPLEN) {
  106. *prob_offset = (u8 *)&fhdr->frag_off - skb_network_header(skb);
  107. /* note that if prob_offset is set, the skb is freed elsewhere,
  108. * we do not free it here.
  109. */
  110. return -1;
  111. }
  112. ecn = ip6_frag_ecn(ipv6_hdr(skb));
  113. if (skb->ip_summed == CHECKSUM_COMPLETE) {
  114. const unsigned char *nh = skb_network_header(skb);
  115. skb->csum = csum_sub(skb->csum,
  116. csum_partial(nh, (u8 *)(fhdr + 1) - nh,
  117. 0));
  118. }
  119. /* Is this the final fragment? */
  120. if (!(fhdr->frag_off & htons(IP6_MF))) {
  121. /* If we already have some bits beyond end
  122. * or have different end, the segment is corrupted.
  123. */
  124. if (end < fq->q.len ||
  125. ((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len))
  126. goto discard_fq;
  127. fq->q.flags |= INET_FRAG_LAST_IN;
  128. fq->q.len = end;
  129. } else {
  130. /* Check if the fragment is rounded to 8 bytes.
  131. * Required by the RFC.
  132. */
  133. if (end & 0x7) {
  134. /* RFC2460 says always send parameter problem in
  135. * this case. -DaveM
  136. */
  137. *prob_offset = offsetof(struct ipv6hdr, payload_len);
  138. return -1;
  139. }
  140. if (end > fq->q.len) {
  141. /* Some bits beyond end -> corruption. */
  142. if (fq->q.flags & INET_FRAG_LAST_IN)
  143. goto discard_fq;
  144. fq->q.len = end;
  145. }
  146. }
  147. if (end == offset)
  148. goto discard_fq;
  149. err = -ENOMEM;
  150. /* Point into the IP datagram 'data' part. */
  151. if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
  152. goto discard_fq;
  153. err = pskb_trim_rcsum(skb, end - offset);
  154. if (err)
  155. goto discard_fq;
  156. /* Note : skb->rbnode and skb->dev share the same location. */
  157. dev = skb->dev;
  158. /* Makes sure compiler wont do silly aliasing games */
  159. barrier();
  160. prev_tail = fq->q.fragments_tail;
  161. err = inet_frag_queue_insert(&fq->q, skb, offset, end);
  162. if (err)
  163. goto insert_error;
  164. if (dev)
  165. fq->iif = dev->ifindex;
  166. fq->q.stamp = skb->tstamp;
  167. fq->q.meat += skb->len;
  168. fq->ecn |= ecn;
  169. add_frag_mem_limit(fq->q.fqdir, skb->truesize);
  170. fragsize = -skb_network_offset(skb) + skb->len;
  171. if (fragsize > fq->q.max_size)
  172. fq->q.max_size = fragsize;
  173. /* The first fragment.
  174. * nhoffset is obtained from the first fragment, of course.
  175. */
  176. if (offset == 0) {
  177. fq->nhoffset = nhoff;
  178. fq->q.flags |= INET_FRAG_FIRST_IN;
  179. }
  180. if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
  181. fq->q.meat == fq->q.len) {
  182. unsigned long orefdst = skb->_skb_refdst;
  183. skb->_skb_refdst = 0UL;
  184. err = ip6_frag_reasm(fq, skb, prev_tail, dev);
  185. skb->_skb_refdst = orefdst;
  186. return err;
  187. }
  188. skb_dst_drop(skb);
  189. return -EINPROGRESS;
  190. insert_error:
  191. if (err == IPFRAG_DUP) {
  192. kfree_skb(skb);
  193. return -EINVAL;
  194. }
  195. err = -EINVAL;
  196. __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
  197. IPSTATS_MIB_REASM_OVERLAPS);
  198. discard_fq:
  199. inet_frag_kill(&fq->q);
  200. __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
  201. IPSTATS_MIB_REASMFAILS);
  202. err:
  203. kfree_skb(skb);
  204. return err;
  205. }
  206. /*
  207. * Check if this packet is complete.
  208. *
  209. * It is called with locked fq, and caller must check that
  210. * queue is eligible for reassembly i.e. it is not COMPLETE,
  211. * the last and the first frames arrived and all the bits are here.
  212. */
  213. static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
  214. struct sk_buff *prev_tail, struct net_device *dev)
  215. {
  216. struct net *net = fq->q.fqdir->net;
  217. unsigned int nhoff;
  218. void *reasm_data;
  219. int payload_len;
  220. u8 ecn;
  221. inet_frag_kill(&fq->q);
  222. ecn = ip_frag_ecn_table[fq->ecn];
  223. if (unlikely(ecn == 0xff))
  224. goto out_fail;
  225. reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
  226. if (!reasm_data)
  227. goto out_oom;
  228. payload_len = ((skb->data - skb_network_header(skb)) -
  229. sizeof(struct ipv6hdr) + fq->q.len -
  230. sizeof(struct frag_hdr));
  231. if (payload_len > IPV6_MAXPLEN)
  232. goto out_oversize;
  233. /* We have to remove fragment header from datagram and to relocate
  234. * header in order to calculate ICV correctly. */
  235. nhoff = fq->nhoffset;
  236. skb_network_header(skb)[nhoff] = skb_transport_header(skb)[0];
  237. memmove(skb->head + sizeof(struct frag_hdr), skb->head,
  238. (skb->data - skb->head) - sizeof(struct frag_hdr));
  239. if (skb_mac_header_was_set(skb))
  240. skb->mac_header += sizeof(struct frag_hdr);
  241. skb->network_header += sizeof(struct frag_hdr);
  242. skb_reset_transport_header(skb);
  243. inet_frag_reasm_finish(&fq->q, skb, reasm_data, true);
  244. skb->dev = dev;
  245. ipv6_hdr(skb)->payload_len = htons(payload_len);
  246. ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
  247. IP6CB(skb)->nhoff = nhoff;
  248. IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
  249. IP6CB(skb)->frag_max_size = fq->q.max_size;
  250. /* Yes, and fold redundant checksum back. 8) */
  251. skb_postpush_rcsum(skb, skb_network_header(skb),
  252. skb_network_header_len(skb));
  253. rcu_read_lock();
  254. __IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), IPSTATS_MIB_REASMOKS);
  255. rcu_read_unlock();
  256. fq->q.rb_fragments = RB_ROOT;
  257. fq->q.fragments_tail = NULL;
  258. fq->q.last_run_head = NULL;
  259. return 1;
  260. out_oversize:
  261. net_dbg_ratelimited("ip6_frag_reasm: payload len = %d\n", payload_len);
  262. goto out_fail;
  263. out_oom:
  264. net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
  265. out_fail:
  266. rcu_read_lock();
  267. __IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), IPSTATS_MIB_REASMFAILS);
  268. rcu_read_unlock();
  269. inet_frag_kill(&fq->q);
  270. return -1;
  271. }
  272. static int ipv6_frag_rcv(struct sk_buff *skb)
  273. {
  274. struct frag_hdr *fhdr;
  275. struct frag_queue *fq;
  276. const struct ipv6hdr *hdr = ipv6_hdr(skb);
  277. struct net *net = dev_net(skb_dst(skb)->dev);
  278. u8 nexthdr;
  279. int iif;
  280. if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
  281. goto fail_hdr;
  282. __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
  283. /* Jumbo payload inhibits frag. header */
  284. if (hdr->payload_len == 0)
  285. goto fail_hdr;
  286. if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
  287. sizeof(struct frag_hdr))))
  288. goto fail_hdr;
  289. hdr = ipv6_hdr(skb);
  290. fhdr = (struct frag_hdr *)skb_transport_header(skb);
  291. if (!(fhdr->frag_off & htons(IP6_OFFSET | IP6_MF))) {
  292. /* It is not a fragmented frame */
  293. skb->transport_header += sizeof(struct frag_hdr);
  294. __IP6_INC_STATS(net,
  295. ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
  296. IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
  297. IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
  298. IP6CB(skb)->frag_max_size = ntohs(hdr->payload_len) +
  299. sizeof(struct ipv6hdr);
  300. return 1;
  301. }
  302. /* RFC 8200, Section 4.5 Fragment Header:
  303. * If the first fragment does not include all headers through an
  304. * Upper-Layer header, then that fragment should be discarded and
  305. * an ICMP Parameter Problem, Code 3, message should be sent to
  306. * the source of the fragment, with the Pointer field set to zero.
  307. */
  308. nexthdr = hdr->nexthdr;
  309. if (ipv6frag_thdr_truncated(skb, skb_transport_offset(skb), &nexthdr)) {
  310. __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
  311. IPSTATS_MIB_INHDRERRORS);
  312. icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0);
  313. return -1;
  314. }
  315. iif = skb->dev ? skb->dev->ifindex : 0;
  316. fq = fq_find(net, fhdr->identification, hdr, iif);
  317. if (fq) {
  318. u32 prob_offset = 0;
  319. int ret;
  320. spin_lock(&fq->q.lock);
  321. fq->iif = iif;
  322. ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff,
  323. &prob_offset);
  324. spin_unlock(&fq->q.lock);
  325. inet_frag_put(&fq->q);
  326. if (prob_offset) {
  327. __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
  328. IPSTATS_MIB_INHDRERRORS);
  329. /* icmpv6_param_prob() calls kfree_skb(skb) */
  330. icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, prob_offset);
  331. }
  332. return ret;
  333. }
  334. __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMFAILS);
  335. kfree_skb(skb);
  336. return -1;
  337. fail_hdr:
  338. __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
  339. IPSTATS_MIB_INHDRERRORS);
  340. icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb_network_header_len(skb));
  341. return -1;
  342. }
  343. static const struct inet6_protocol frag_protocol = {
  344. .handler = ipv6_frag_rcv,
  345. .flags = INET6_PROTO_NOPOLICY,
  346. };
  347. #ifdef CONFIG_SYSCTL
  348. static struct ctl_table ip6_frags_ns_ctl_table[] = {
  349. {
  350. .procname = "ip6frag_high_thresh",
  351. .maxlen = sizeof(unsigned long),
  352. .mode = 0644,
  353. .proc_handler = proc_doulongvec_minmax,
  354. },
  355. {
  356. .procname = "ip6frag_low_thresh",
  357. .maxlen = sizeof(unsigned long),
  358. .mode = 0644,
  359. .proc_handler = proc_doulongvec_minmax,
  360. },
  361. {
  362. .procname = "ip6frag_time",
  363. .maxlen = sizeof(int),
  364. .mode = 0644,
  365. .proc_handler = proc_dointvec_jiffies,
  366. },
  367. { }
  368. };
  369. /* secret interval has been deprecated */
  370. static int ip6_frags_secret_interval_unused;
  371. static struct ctl_table ip6_frags_ctl_table[] = {
  372. {
  373. .procname = "ip6frag_secret_interval",
  374. .data = &ip6_frags_secret_interval_unused,
  375. .maxlen = sizeof(int),
  376. .mode = 0644,
  377. .proc_handler = proc_dointvec_jiffies,
  378. },
  379. { }
  380. };
  381. static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
  382. {
  383. struct ctl_table *table;
  384. struct ctl_table_header *hdr;
  385. table = ip6_frags_ns_ctl_table;
  386. if (!net_eq(net, &init_net)) {
  387. table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
  388. if (!table)
  389. goto err_alloc;
  390. }
  391. table[0].data = &net->ipv6.fqdir->high_thresh;
  392. table[0].extra1 = &net->ipv6.fqdir->low_thresh;
  393. table[1].data = &net->ipv6.fqdir->low_thresh;
  394. table[1].extra2 = &net->ipv6.fqdir->high_thresh;
  395. table[2].data = &net->ipv6.fqdir->timeout;
  396. hdr = register_net_sysctl(net, "net/ipv6", table);
  397. if (!hdr)
  398. goto err_reg;
  399. net->ipv6.sysctl.frags_hdr = hdr;
  400. return 0;
  401. err_reg:
  402. if (!net_eq(net, &init_net))
  403. kfree(table);
  404. err_alloc:
  405. return -ENOMEM;
  406. }
  407. static void __net_exit ip6_frags_ns_sysctl_unregister(struct net *net)
  408. {
  409. struct ctl_table *table;
  410. table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
  411. unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
  412. if (!net_eq(net, &init_net))
  413. kfree(table);
  414. }
  415. static struct ctl_table_header *ip6_ctl_header;
  416. static int ip6_frags_sysctl_register(void)
  417. {
  418. ip6_ctl_header = register_net_sysctl(&init_net, "net/ipv6",
  419. ip6_frags_ctl_table);
  420. return ip6_ctl_header == NULL ? -ENOMEM : 0;
  421. }
  422. static void ip6_frags_sysctl_unregister(void)
  423. {
  424. unregister_net_sysctl_table(ip6_ctl_header);
  425. }
  426. #else
  427. static int ip6_frags_ns_sysctl_register(struct net *net)
  428. {
  429. return 0;
  430. }
  431. static void ip6_frags_ns_sysctl_unregister(struct net *net)
  432. {
  433. }
  434. static int ip6_frags_sysctl_register(void)
  435. {
  436. return 0;
  437. }
  438. static void ip6_frags_sysctl_unregister(void)
  439. {
  440. }
  441. #endif
  442. static int __net_init ipv6_frags_init_net(struct net *net)
  443. {
  444. int res;
  445. res = fqdir_init(&net->ipv6.fqdir, &ip6_frags, net);
  446. if (res < 0)
  447. return res;
  448. net->ipv6.fqdir->high_thresh = IPV6_FRAG_HIGH_THRESH;
  449. net->ipv6.fqdir->low_thresh = IPV6_FRAG_LOW_THRESH;
  450. net->ipv6.fqdir->timeout = IPV6_FRAG_TIMEOUT;
  451. res = ip6_frags_ns_sysctl_register(net);
  452. if (res < 0)
  453. fqdir_exit(net->ipv6.fqdir);
  454. return res;
  455. }
  456. static void __net_exit ipv6_frags_pre_exit_net(struct net *net)
  457. {
  458. fqdir_pre_exit(net->ipv6.fqdir);
  459. }
  460. static void __net_exit ipv6_frags_exit_net(struct net *net)
  461. {
  462. ip6_frags_ns_sysctl_unregister(net);
  463. fqdir_exit(net->ipv6.fqdir);
  464. }
  465. static struct pernet_operations ip6_frags_ops = {
  466. .init = ipv6_frags_init_net,
  467. .pre_exit = ipv6_frags_pre_exit_net,
  468. .exit = ipv6_frags_exit_net,
  469. };
  470. static const struct rhashtable_params ip6_rhash_params = {
  471. .head_offset = offsetof(struct inet_frag_queue, node),
  472. .hashfn = ip6frag_key_hashfn,
  473. .obj_hashfn = ip6frag_obj_hashfn,
  474. .obj_cmpfn = ip6frag_obj_cmpfn,
  475. .automatic_shrinking = true,
  476. };
  477. int __init ipv6_frag_init(void)
  478. {
  479. int ret;
  480. ip6_frags.constructor = ip6frag_init;
  481. ip6_frags.destructor = NULL;
  482. ip6_frags.qsize = sizeof(struct frag_queue);
  483. ip6_frags.frag_expire = ip6_frag_expire;
  484. ip6_frags.frags_cache_name = ip6_frag_cache_name;
  485. ip6_frags.rhash_params = ip6_rhash_params;
  486. ret = inet_frags_init(&ip6_frags);
  487. if (ret)
  488. goto out;
  489. ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT);
  490. if (ret)
  491. goto err_protocol;
  492. ret = ip6_frags_sysctl_register();
  493. if (ret)
  494. goto err_sysctl;
  495. ret = register_pernet_subsys(&ip6_frags_ops);
  496. if (ret)
  497. goto err_pernet;
  498. out:
  499. return ret;
  500. err_pernet:
  501. ip6_frags_sysctl_unregister();
  502. err_sysctl:
  503. inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
  504. err_protocol:
  505. inet_frags_fini(&ip6_frags);
  506. goto out;
  507. }
  508. void ipv6_frag_exit(void)
  509. {
  510. ip6_frags_sysctl_unregister();
  511. unregister_pernet_subsys(&ip6_frags_ops);
  512. inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
  513. inet_frags_fini(&ip6_frags);
  514. }