The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/frag6.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*      $OpenBSD: frag6.c,v 1.27 2008/11/23 13:30:59 claudio Exp $      */
    2 /*      $KAME: frag6.c,v 1.40 2002/05/27 21:40:31 itojun Exp $  */
    3 
    4 /*
    5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/param.h>
   34 #include <sys/systm.h>
   35 #include <sys/malloc.h>
   36 #include <sys/mbuf.h>
   37 #include <sys/domain.h>
   38 #include <sys/protosw.h>
   39 #include <sys/socket.h>
   40 #include <sys/errno.h>
   41 #include <sys/time.h>
   42 #include <sys/kernel.h>
   43 #include <sys/syslog.h>
   44 
   45 #include <net/if.h>
   46 #include <net/route.h>
   47 
   48 #include <netinet/in.h>
   49 #include <netinet/in_var.h>
   50 #include <netinet/ip6.h>
   51 #include <netinet6/ip6_var.h>
   52 #include <netinet/icmp6.h>
   53 #include <netinet/in_systm.h>   /* for ECN definitions */
   54 #include <netinet/ip.h>         /* for ECN definitions */
   55 
   56 #include <dev/rndvar.h>
   57 
   58 /*
   59  * Define it to get a correct behavior on per-interface statistics.
   60  * You will need to perform an extra routing table lookup, per fragment,
   61  * to do it.  This may, or may not be, a performance hit.
   62  */
   63 #define IN6_IFSTAT_STRICT
   64 
   65 static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *);
   66 static void frag6_deq(struct ip6asfrag *);
   67 static void frag6_insque(struct ip6q *, struct ip6q *);
   68 static void frag6_remque(struct ip6q *);
   69 static void frag6_freef(struct ip6q *);
   70 
   71 static int ip6q_locked;
   72 u_int frag6_nfragpackets;
   73 u_int frag6_nfrags;
   74 struct  ip6q ip6q;      /* ip6 reassemble queue */
   75 
   76 static __inline int ip6q_lock_try(void);
   77 static __inline void ip6q_unlock(void);
   78 
   79 static __inline int
   80 ip6q_lock_try()
   81 {
   82         int s;
   83 
   84         /* Use splvm() due to mbuf allocation. */
   85         s = splvm();
   86         if (ip6q_locked) {
   87                 splx(s);
   88                 return (0);
   89         }
   90         ip6q_locked = 1;
   91         splx(s);
   92         return (1);
   93 }
   94 
   95 static __inline void
   96 ip6q_unlock()
   97 {
   98         int s;
   99 
  100         s = splvm();
  101         ip6q_locked = 0;
  102         splx(s);
  103 }
  104 
  105 #ifdef DIAGNOSTIC
  106 #define IP6Q_LOCK()                                                     \
  107 do {                                                                    \
  108         if (ip6q_lock_try() == 0) {                                     \
  109                 printf("%s:%d: ip6q already locked\n", __FILE__, __LINE__); \
  110                 panic("ip6q_lock");                                     \
  111         }                                                               \
  112 } while (0)
  113 #define IP6Q_LOCK_CHECK()                                               \
  114 do {                                                                    \
  115         if (ip6q_locked == 0) {                                         \
  116                 printf("%s:%d: ip6q lock not held\n", __FILE__, __LINE__); \
  117                 panic("ip6q lock check");                               \
  118         }                                                               \
  119 } while (0)
  120 #else
  121 #define IP6Q_LOCK()             (void) ip6q_lock_try()
  122 #define IP6Q_LOCK_CHECK()       /* nothing */
  123 #endif
  124 
  125 #define IP6Q_UNLOCK()           ip6q_unlock()
  126 
  127 #ifndef offsetof                /* XXX */
  128 #define offsetof(type, member)  ((size_t)(&((type *)0)->member))
  129 #endif
  130 
  131 /*
  132  * Initialise reassembly queue and fragment identifier.
  133  */
  134 void
  135 frag6_init()
  136 {
  137 
  138         ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q;
  139 }
  140 
  141 /*
  142  * In RFC2460, fragment and reassembly rule do not agree with each other,
  143  * in terms of next header field handling in fragment header.
  144  * While the sender will use the same value for all of the fragmented packets,
  145  * receiver is suggested not to check the consistency.
  146  *
  147  * fragment rule (p20):
  148  *      (2) A Fragment header containing:
  149  *      The Next Header value that identifies the first header of
  150  *      the Fragmentable Part of the original packet.
  151  *              -> next header field is same for all fragments
  152  *
  153  * reassembly rule (p21):
  154  *      The Next Header field of the last header of the Unfragmentable
  155  *      Part is obtained from the Next Header field of the first
  156  *      fragment's Fragment header.
  157  *              -> should grab it from the first fragment only
  158  *
  159  * The following note also contradicts with fragment rule - noone is going to
  160  * send different fragment with different next header field.
  161  *
  162  * additional note (p22):
  163  *      The Next Header values in the Fragment headers of different
  164  *      fragments of the same original packet may differ.  Only the value
  165  *      from the Offset zero fragment packet is used for reassembly.
  166  *              -> should grab it from the first fragment only
  167  *
  168  * There is no explicit reason given in the RFC.  Historical reason maybe?
  169  */
  170 /*
  171  * Fragment input
  172  */
  173 int
  174 frag6_input(struct mbuf **mp, int *offp, int proto)
  175 {
  176         struct mbuf *m = *mp, *t;
  177         struct ip6_hdr *ip6;
  178         struct ip6_frag *ip6f;
  179         struct ip6q *q6;
  180         struct ip6asfrag *af6, *ip6af, *af6dwn;
  181         int offset = *offp, nxt, i, next;
  182         int first_frag = 0;
  183         int fragoff, frgpartlen;        /* must be larger than u_int16_t */
  184         struct ifnet *dstifp;
  185 #ifdef IN6_IFSTAT_STRICT
  186         static struct route_in6 ro;
  187         struct sockaddr_in6 *dst;
  188 #endif
  189         u_int8_t ecn, ecn0;
  190 
  191         ip6 = mtod(m, struct ip6_hdr *);
  192         IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f));
  193         if (ip6f == NULL)
  194                 return IPPROTO_DONE;
  195 
  196         dstifp = NULL;
  197 #ifdef IN6_IFSTAT_STRICT
  198         /* find the destination interface of the packet. */
  199         dst = (struct sockaddr_in6 *)&ro.ro_dst;
  200         if (ro.ro_rt && ((ro.ro_rt->rt_flags & RTF_UP) == 0
  201           || !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
  202                 RTFREE(ro.ro_rt);
  203                 ro.ro_rt = (struct rtentry *)0;
  204         }
  205         if (ro.ro_rt == NULL) {
  206                 bzero(dst, sizeof(*dst));
  207                 dst->sin6_family = AF_INET6;
  208                 dst->sin6_len = sizeof(struct sockaddr_in6);
  209                 dst->sin6_addr = ip6->ip6_dst;
  210         }
  211 
  212         rtalloc_mpath((struct route *)&ro, &ip6->ip6_src.s6_addr32[0], 0);
  213 
  214         if (ro.ro_rt != NULL && ro.ro_rt->rt_ifa != NULL)
  215                 dstifp = ((struct in6_ifaddr *)ro.ro_rt->rt_ifa)->ia_ifp;
  216 #else
  217         /* we are violating the spec, this is not the destination interface */
  218         if ((m->m_flags & M_PKTHDR) != 0)
  219                 dstifp = m->m_pkthdr.rcvif;
  220 #endif
  221 
  222         /* jumbo payload can't contain a fragment header */
  223         if (ip6->ip6_plen == 0) {
  224                 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
  225                 in6_ifstat_inc(dstifp, ifs6_reass_fail);
  226                 return IPPROTO_DONE;
  227         }
  228 
  229         /*
  230          * check whether fragment packet's fragment length is
  231          * multiple of 8 octets.
  232          * sizeof(struct ip6_frag) == 8
  233          * sizeof(struct ip6_hdr) = 40
  234          */
  235         if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
  236             (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
  237                 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
  238                     offsetof(struct ip6_hdr, ip6_plen));
  239                 in6_ifstat_inc(dstifp, ifs6_reass_fail);
  240                 return IPPROTO_DONE;
  241         }
  242 
  243         ip6stat.ip6s_fragments++;
  244         in6_ifstat_inc(dstifp, ifs6_reass_reqd);
  245         
  246         /* offset now points to data portion */
  247         offset += sizeof(struct ip6_frag);
  248 
  249         IP6Q_LOCK();
  250 
  251         /*
  252          * Enforce upper bound on number of fragments.
  253          * If maxfrag is 0, never accept fragments.
  254          * If maxfrag is -1, accept all fragments without limitation.
  255          */
  256         if (ip6_maxfrags < 0)
  257                 ;
  258         else if (frag6_nfrags >= (u_int)ip6_maxfrags)
  259                 goto dropfrag;
  260 
  261         for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next)
  262                 if (ip6f->ip6f_ident == q6->ip6q_ident &&
  263                     IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) &&
  264                     IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst))
  265                         break;
  266 
  267         if (q6 == &ip6q) {
  268                 /*
  269                  * the first fragment to arrive, create a reassembly queue.
  270                  */
  271                 first_frag = 1;
  272 
  273                 /*
  274                  * Enforce upper bound on number of fragmented packets
  275                  * for which we attempt reassembly;
  276                  * If maxfragpackets is 0, never accept fragments.
  277                  * If maxfragpackets is -1, accept all fragments without
  278                  * limitation.
  279                  */
  280                 if (ip6_maxfragpackets < 0)
  281                         ;
  282                 else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets)
  283                         goto dropfrag;
  284                 frag6_nfragpackets++;
  285                 q6 = malloc(sizeof(*q6), M_FTABLE, M_DONTWAIT | M_ZERO);
  286                 if (q6 == NULL)
  287                         goto dropfrag;
  288 
  289                 frag6_insque(q6, &ip6q);
  290 
  291                 /* ip6q_nxt will be filled afterwards, from 1st fragment */
  292                 q6->ip6q_down   = q6->ip6q_up = (struct ip6asfrag *)q6;
  293 #ifdef notyet
  294                 q6->ip6q_nxtp   = (u_char *)nxtp;
  295 #endif
  296                 q6->ip6q_ident  = ip6f->ip6f_ident;
  297                 q6->ip6q_arrive = 0; /* Is it used anywhere? */
  298                 q6->ip6q_ttl    = IPV6_FRAGTTL;
  299                 q6->ip6q_src    = ip6->ip6_src;
  300                 q6->ip6q_dst    = ip6->ip6_dst;
  301                 q6->ip6q_unfrglen = -1; /* The 1st fragment has not arrived. */
  302 
  303                 q6->ip6q_nfrag = 0;
  304         }
  305 
  306         /*
  307          * If it's the 1st fragment, record the length of the
  308          * unfragmentable part and the next header of the fragment header.
  309          */
  310         fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
  311         if (fragoff == 0) {
  312                 q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr) -
  313                     sizeof(struct ip6_frag);
  314                 q6->ip6q_nxt = ip6f->ip6f_nxt;
  315         }
  316 
  317         /*
  318          * Check that the reassembled packet would not exceed 65535 bytes
  319          * in size.
  320          * If it would exceed, discard the fragment and return an ICMP error.
  321          */
  322         frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
  323         if (q6->ip6q_unfrglen >= 0) {
  324                 /* The 1st fragment has already arrived. */
  325                 if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
  326                         icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
  327                             offset - sizeof(struct ip6_frag) +
  328                             offsetof(struct ip6_frag, ip6f_offlg));
  329                         IP6Q_UNLOCK();
  330                         return (IPPROTO_DONE);
  331                 }
  332         } else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
  333                 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
  334                             offset - sizeof(struct ip6_frag) +
  335                                 offsetof(struct ip6_frag, ip6f_offlg));
  336                 IP6Q_UNLOCK();
  337                 return (IPPROTO_DONE);
  338         }
  339         /*
  340          * If it's the first fragment, do the above check for each
  341          * fragment already stored in the reassembly queue.
  342          */
  343         if (fragoff == 0) {
  344                 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
  345                      af6 = af6dwn) {
  346                         af6dwn = af6->ip6af_down;
  347 
  348                         if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
  349                             IPV6_MAXPACKET) {
  350                                 struct mbuf *merr = IP6_REASS_MBUF(af6);
  351                                 struct ip6_hdr *ip6err;
  352                                 int erroff = af6->ip6af_offset;
  353 
  354                                 /* dequeue the fragment. */
  355                                 frag6_deq(af6);
  356                                 free(af6, M_FTABLE);
  357 
  358                                 /* adjust pointer. */
  359                                 ip6err = mtod(merr, struct ip6_hdr *);
  360 
  361                                 /*
  362                                  * Restore source and destination addresses
  363                                  * in the erroneous IPv6 header.
  364                                  */
  365                                 ip6err->ip6_src = q6->ip6q_src;
  366                                 ip6err->ip6_dst = q6->ip6q_dst;
  367 
  368                                 icmp6_error(merr, ICMP6_PARAM_PROB,
  369                                     ICMP6_PARAMPROB_HEADER,
  370                                     erroff - sizeof(struct ip6_frag) +
  371                                     offsetof(struct ip6_frag, ip6f_offlg));
  372                         }
  373                 }
  374         }
  375 
  376         ip6af = malloc(sizeof(*ip6af), M_FTABLE, M_DONTWAIT | M_ZERO);
  377         if (ip6af == NULL)
  378                 goto dropfrag;
  379         ip6af->ip6af_head = ip6->ip6_flow;
  380         ip6af->ip6af_len = ip6->ip6_plen;
  381         ip6af->ip6af_nxt = ip6->ip6_nxt;
  382         ip6af->ip6af_hlim = ip6->ip6_hlim;
  383         ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG;
  384         ip6af->ip6af_off = fragoff;
  385         ip6af->ip6af_frglen = frgpartlen;
  386         ip6af->ip6af_offset = offset;
  387         IP6_REASS_MBUF(ip6af) = m;
  388 
  389         if (first_frag) {
  390                 af6 = (struct ip6asfrag *)q6;
  391                 goto insert;
  392         }
  393 
  394         /*
  395          * Handle ECN by comparing this segment with the first one;
  396          * if CE is set, do not lose CE.
  397          * drop if CE and not-ECT are mixed for the same packet.
  398          */
  399         ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
  400         ecn0 = (ntohl(q6->ip6q_down->ip6af_head) >> 20) & IPTOS_ECN_MASK;
  401         if (ecn == IPTOS_ECN_CE) {
  402                 if (ecn0 == IPTOS_ECN_NOTECT) {
  403                         free(ip6af, M_FTABLE);
  404                         goto dropfrag;
  405                 }
  406                 if (ecn0 != IPTOS_ECN_CE)
  407                         q6->ip6q_down->ip6af_head |= htonl(IPTOS_ECN_CE << 20);
  408         }
  409         if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) {
  410                 free(ip6af, M_FTABLE);
  411                 goto dropfrag;
  412         }
  413 
  414         /*
  415          * Find a segment which begins after this one does.
  416          */
  417         for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
  418              af6 = af6->ip6af_down)
  419                 if (af6->ip6af_off > ip6af->ip6af_off)
  420                         break;
  421 
  422 #if 0
  423         /*
  424          * If there is a preceding segment, it may provide some of
  425          * our data already.  If so, drop the data from the incoming
  426          * segment.  If it provides all of our data, drop us.
  427          */
  428         if (af6->ip6af_up != (struct ip6asfrag *)q6) {
  429                 i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
  430                         - ip6af->ip6af_off;
  431                 if (i > 0) {
  432                         if (i >= ip6af->ip6af_frglen)
  433                                 goto dropfrag;
  434                         m_adj(IP6_REASS_MBUF(ip6af), i);
  435                         ip6af->ip6af_off += i;
  436                         ip6af->ip6af_frglen -= i;
  437                 }
  438         }
  439 
  440         /*
  441          * While we overlap succeeding segments trim them or,
  442          * if they are completely covered, dequeue them.
  443          */
  444         while (af6 != (struct ip6asfrag *)q6 &&
  445                ip6af->ip6af_off + ip6af->ip6af_frglen > af6->ip6af_off) {
  446                 i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
  447                 if (i < af6->ip6af_frglen) {
  448                         af6->ip6af_frglen -= i;
  449                         af6->ip6af_off += i;
  450                         m_adj(IP6_REASS_MBUF(af6), i);
  451                         break;
  452                 }
  453                 af6 = af6->ip6af_down;
  454                 m_freem(IP6_REASS_MBUF(af6->ip6af_up));
  455                 frag6_deq(af6->ip6af_up);
  456         }
  457 #else
  458         /*
  459          * If the incoming fragment overlaps some existing fragments in
  460          * the reassembly queue, drop it, since it is dangerous to override
  461          * existing fragments from a security point of view.
  462          * We don't know which fragment is the bad guy - here we trust
  463          * fragment that came in earlier, with no real reason.
  464          */
  465         if (af6->ip6af_up != (struct ip6asfrag *)q6) {
  466                 i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
  467                         - ip6af->ip6af_off;
  468                 if (i > 0) {
  469 #if 0                           /* suppress the noisy log */
  470                         log(LOG_ERR, "%d bytes of a fragment from %s "
  471                             "overlaps the previous fragment\n",
  472                             i, ip6_sprintf(&q6->ip6q_src));
  473 #endif
  474                         free(ip6af, M_FTABLE);
  475                         goto dropfrag;
  476                 }
  477         }
  478         if (af6 != (struct ip6asfrag *)q6) {
  479                 i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
  480                 if (i > 0) {
  481 #if 0                           /* suppress the noisy log */
  482                         log(LOG_ERR, "%d bytes of a fragment from %s "
  483                             "overlaps the succeeding fragment",
  484                             i, ip6_sprintf(&q6->ip6q_src));
  485 #endif
  486                         free(ip6af, M_FTABLE);
  487                         goto dropfrag;
  488                 }
  489         }
  490 #endif
  491 
  492 insert:
  493 
  494         /*
  495          * Stick new segment in its place;
  496          * check for complete reassembly.
  497          * Move to front of packet queue, as we are
  498          * the most recently active fragmented packet.
  499          */
  500         frag6_enq(ip6af, af6->ip6af_up);
  501         frag6_nfrags++;
  502         q6->ip6q_nfrag++;
  503 #if 0 /* xxx */
  504         if (q6 != ip6q.ip6q_next) {
  505                 frag6_remque(q6);
  506                 frag6_insque(q6, &ip6q);
  507         }
  508 #endif
  509         next = 0;
  510         for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
  511              af6 = af6->ip6af_down) {
  512                 if (af6->ip6af_off != next) {
  513                         IP6Q_UNLOCK();
  514                         return IPPROTO_DONE;
  515                 }
  516                 next += af6->ip6af_frglen;
  517         }
  518         if (af6->ip6af_up->ip6af_mff) {
  519                 IP6Q_UNLOCK();
  520                 return IPPROTO_DONE;
  521         }
  522 
  523         /*
  524          * Reassembly is complete; concatenate fragments.
  525          */
  526         ip6af = q6->ip6q_down;
  527         t = m = IP6_REASS_MBUF(ip6af);
  528         af6 = ip6af->ip6af_down;
  529         frag6_deq(ip6af);
  530         while (af6 != (struct ip6asfrag *)q6) {
  531                 af6dwn = af6->ip6af_down;
  532                 frag6_deq(af6);
  533                 while (t->m_next)
  534                         t = t->m_next;
  535                 t->m_next = IP6_REASS_MBUF(af6);
  536                 m_adj(t->m_next, af6->ip6af_offset);
  537                 free(af6, M_FTABLE);
  538                 af6 = af6dwn;
  539         }
  540 
  541         /* adjust offset to point where the original next header starts */
  542         offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
  543         free(ip6af, M_FTABLE);
  544         ip6 = mtod(m, struct ip6_hdr *);
  545         ip6->ip6_plen = htons((u_short)next + offset - sizeof(struct ip6_hdr));
  546         ip6->ip6_src = q6->ip6q_src;
  547         ip6->ip6_dst = q6->ip6q_dst;
  548         nxt = q6->ip6q_nxt;
  549 #ifdef notyet
  550         *q6->ip6q_nxtp = (u_char)(nxt & 0xff);
  551 #endif
  552 
  553         /*
  554          * Delete frag6 header with as a few cost as possible.
  555          */
  556         if (offset < m->m_len) {
  557                 ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag),
  558                         offset);
  559                 m->m_data += sizeof(struct ip6_frag);
  560                 m->m_len -= sizeof(struct ip6_frag);
  561         } else {
  562                 /* this comes with no copy if the boundary is on cluster */
  563                 if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) {
  564                         frag6_remque(q6);
  565                         frag6_nfrags -= q6->ip6q_nfrag;
  566                         free(q6, M_FTABLE);
  567                         frag6_nfragpackets--;
  568                         goto dropfrag;
  569                 }
  570                 m_adj(t, sizeof(struct ip6_frag));
  571                 m_cat(m, t);
  572         }
  573 
  574         /*
  575          * Store NXT to the original.
  576          */
  577         {
  578                 u_int8_t *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */
  579                 *prvnxtp = nxt;
  580         }
  581 
  582         frag6_remque(q6);
  583         frag6_nfrags -= q6->ip6q_nfrag;
  584         free(q6, M_FTABLE);
  585         frag6_nfragpackets--;
  586 
  587         if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */
  588                 int plen = 0;
  589                 for (t = m; t; t = t->m_next)
  590                         plen += t->m_len;
  591                 m->m_pkthdr.len = plen;
  592         }
  593         
  594         ip6stat.ip6s_reassembled++;
  595         in6_ifstat_inc(dstifp, ifs6_reass_ok);
  596 
  597         /*
  598          * Tell launch routine the next header
  599          */
  600 
  601         *mp = m;
  602         *offp = offset;
  603 
  604         IP6Q_UNLOCK();
  605         return nxt;
  606 
  607  dropfrag:
  608         in6_ifstat_inc(dstifp, ifs6_reass_fail);
  609         ip6stat.ip6s_fragdropped++;
  610         m_freem(m);
  611         IP6Q_UNLOCK();
  612         return IPPROTO_DONE;
  613 }
  614 
  615 /*
  616  * Free a fragment reassembly header and all
  617  * associated datagrams.
  618  */
  619 void
  620 frag6_freef(struct ip6q *q6)
  621 {
  622         struct ip6asfrag *af6, *down6;
  623 
  624         IP6Q_LOCK_CHECK();
  625 
  626         for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
  627              af6 = down6) {
  628                 struct mbuf *m = IP6_REASS_MBUF(af6);
  629 
  630                 down6 = af6->ip6af_down;
  631                 frag6_deq(af6);
  632 
  633                 /*
  634                  * Return ICMP time exceeded error for the 1st fragment.
  635                  * Just free other fragments.
  636                  */
  637                 if (af6->ip6af_off == 0) {
  638                         struct ip6_hdr *ip6;
  639 
  640                         /* adjust pointer */
  641                         ip6 = mtod(m, struct ip6_hdr *);
  642 
  643                         /* restoure source and destination addresses */
  644                         ip6->ip6_src = q6->ip6q_src;
  645                         ip6->ip6_dst = q6->ip6q_dst;
  646 
  647                         icmp6_error(m, ICMP6_TIME_EXCEEDED,
  648                                     ICMP6_TIME_EXCEED_REASSEMBLY, 0);
  649                 } else
  650                         m_freem(m);
  651                 free(af6, M_FTABLE);
  652         }
  653         frag6_remque(q6);
  654         frag6_nfrags -= q6->ip6q_nfrag;
  655         free(q6, M_FTABLE);
  656         frag6_nfragpackets--;
  657 }
  658 
  659 /*
  660  * Put an ip fragment on a reassembly chain.
  661  * Like insque, but pointers in middle of structure.
  662  */
  663 void
  664 frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
  665 {
  666 
  667         IP6Q_LOCK_CHECK();
  668 
  669         af6->ip6af_up = up6;
  670         af6->ip6af_down = up6->ip6af_down;
  671         up6->ip6af_down->ip6af_up = af6;
  672         up6->ip6af_down = af6;
  673 }
  674 
  675 /*
  676  * To frag6_enq as remque is to insque.
  677  */
  678 void
  679 frag6_deq(struct ip6asfrag *af6)
  680 {
  681 
  682         IP6Q_LOCK_CHECK();
  683 
  684         af6->ip6af_up->ip6af_down = af6->ip6af_down;
  685         af6->ip6af_down->ip6af_up = af6->ip6af_up;
  686 }
  687 
  688 void
  689 frag6_insque(struct ip6q *new, struct ip6q *old)
  690 {
  691 
  692         IP6Q_LOCK_CHECK();
  693 
  694         new->ip6q_prev = old;
  695         new->ip6q_next = old->ip6q_next;
  696         old->ip6q_next->ip6q_prev= new;
  697         old->ip6q_next = new;
  698 }
  699 
  700 void
  701 frag6_remque(struct ip6q *p6)
  702 {
  703 
  704         IP6Q_LOCK_CHECK();
  705 
  706         p6->ip6q_prev->ip6q_next = p6->ip6q_next;
  707         p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
  708 }
  709 
  710 /*
  711  * IPv6 reassembling timer processing;
  712  * if a timer expires on a reassembly
  713  * queue, discard it.
  714  */
  715 void
  716 frag6_slowtimo()
  717 {
  718         struct ip6q *q6;
  719         int s = splsoftnet();
  720 
  721         IP6Q_LOCK();
  722         q6 = ip6q.ip6q_next;
  723         if (q6)
  724                 while (q6 != &ip6q) {
  725                         --q6->ip6q_ttl;
  726                         q6 = q6->ip6q_next;
  727                         if (q6->ip6q_prev->ip6q_ttl == 0) {
  728                                 ip6stat.ip6s_fragtimeout++;
  729                                 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
  730                                 frag6_freef(q6->ip6q_prev);
  731                         }
  732                 }
  733         /*
  734          * If we are over the maximum number of fragments
  735          * (due to the limit being lowered), drain off
  736          * enough to get down to the new limit.
  737          */
  738         while (frag6_nfragpackets > (u_int)ip6_maxfragpackets &&
  739             ip6q.ip6q_prev) {
  740                 ip6stat.ip6s_fragoverflow++;
  741                 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
  742                 frag6_freef(ip6q.ip6q_prev);
  743         }
  744         IP6Q_UNLOCK();
  745 
  746 #if 0
  747         /*
  748          * Routing changes might produce a better route than we last used;
  749          * make sure we notice eventually, even if forwarding only for one
  750          * destination and the cache is never replaced.
  751          */
  752         if (ip6_forward_rt.ro_rt) {
  753                 RTFREE(ip6_forward_rt.ro_rt);
  754                 ip6_forward_rt.ro_rt = 0;
  755         }
  756         if (ipsrcchk_rt.ro_rt) {
  757                 RTFREE(ipsrcchk_rt.ro_rt);
  758                 ipsrcchk_rt.ro_rt = 0;
  759         }
  760 #endif
  761 
  762         splx(s);
  763 }
  764 
  765 /*
  766  * Drain off all datagram fragments.
  767  */
  768 void
  769 frag6_drain()
  770 {
  771 
  772         if (ip6q_lock_try() == 0)
  773                 return;
  774         while (ip6q.ip6q_next != &ip6q) {
  775                 ip6stat.ip6s_fragdropped++;
  776                 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
  777                 frag6_freef(ip6q.ip6q_next);
  778         }
  779         IP6Q_UNLOCK();
  780 }

Cache object: 621255ff548765f2adc68854b50e2f00


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.