ip_fragment.c revision 5ab11c98d3a950faf6922b6166e5f8fc874590e7
11da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* 21da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * INET An implementation of the TCP/IP protocol suite for the LINUX 31da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * operating system. INET is implemented using the BSD Socket 41da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * interface as the means of communication with the user level. 51da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 61da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * The IP fragmentation functionality. 7e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki * 81da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Version: $Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $ 91da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG> 111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Alan Cox <Alan.Cox@linux.org> 121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Fixes: 141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Alan Cox : Split from ip.c , see ip_input.c for history. 151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * David S. Miller : Begin massive cleanup... 161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Andi Kleen : Add sysctls. 171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * xxxx : Overlapfrag bug. 181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Ultima : ip_expire() kernel panic. 191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Bill Hawes : Frag accounting and evictor fixes. 201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * John McDonald : 0 length frag bug. 211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Alexey Kuznetsov: SMP races, threading, cleanup. 221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Patrick McHardy : LRU queue of frag heads for evictor. 231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu#include <linux/compiler.h> 261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/module.h> 271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/types.h> 281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/mm.h> 291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/jiffies.h> 301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/skbuff.h> 311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/list.h> 321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/ip.h> 331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/icmp.h> 341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/netdevice.h> 351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/jhash.h> 361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/random.h> 371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/sock.h> 381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/ip.h> 391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/icmp.h> 401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/checksum.h> 4189cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu#include <net/inetpeer.h> 425ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov#include <net/inet_frag.h> 431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/tcp.h> 441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/udp.h> 451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/inet.h> 461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/netfilter_ipv4.h> 471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6 491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c 501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * as well. Or notify me, at least. --ANK 511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Fragment cache limits. We will commit 256K at one time. Should we 541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * cross that limit we will prune down to 192K. This should cope with 551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * even the most extreme cases without allowing an attacker to measurably 561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * harm machine performance. 571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 58ab32ea5d8a760e7dd4339634e95d7be24ee5b842Brian Haleyint sysctl_ipfrag_high_thresh __read_mostly = 256*1024; 59ab32ea5d8a760e7dd4339634e95d7be24ee5b842Brian Haleyint sysctl_ipfrag_low_thresh __read_mostly = 192*1024; 601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 61ab32ea5d8a760e7dd4339634e95d7be24ee5b842Brian Haleyint sysctl_ipfrag_max_dist __read_mostly = 64; 6289cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Important NOTE! Fragment queue must be destroyed before MSL expires. 641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL. 651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 66ab32ea5d8a760e7dd4339634e95d7be24ee5b842Brian Haleyint sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME; 671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstruct ipfrag_skb_cb 691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct inet_skb_parm h; 711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int offset; 721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#define FRAG_CB(skb) ((struct ipfrag_skb_cb*)((skb)->cb)) 751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Describe an entry in the "incomplete datagrams" queue. */ 771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstruct ipq { 785ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov struct inet_frag_queue q; 795ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov 801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds u32 user; 81182777700d912a69824245e9ee99148ac0aa57d7Al Viro __be32 saddr; 82182777700d912a69824245e9ee99148ac0aa57d7Al Viro __be32 daddr; 83182777700d912a69824245e9ee99148ac0aa57d7Al Viro __be16 id; 841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds u8 protocol; 8589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu int iif; 8689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu unsigned int rid; 8789cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu struct inet_peer *peer; 881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Hash table. */ 911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#define IPQ_HASHSZ 64 931da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Per-bucket lock is easy to add now. */ 95e7c8a41e817f381ac5c2a59ecc81b483bd68a7dfYasuyuki Kozakaistatic struct hlist_head ipq_hash[IPQ_HASHSZ]; 961da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic DEFINE_RWLOCK(ipfrag_lock); 971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic u32 ipfrag_hash_rnd; 981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic LIST_HEAD(ipq_lru_list); 991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsint ip_frag_nqueues = 0; 1001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1011706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xustatic int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, 1021706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu struct net_device *dev); 1031706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 1041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ void __ipq_unlink(struct ipq *qp) 1051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1065ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_del(&qp->q.list); 1075ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov list_del(&qp->q.lru_list); 1081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ip_frag_nqueues--; 1091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ void ipq_unlink(struct ipq *ipq) 1121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_lock(&ipfrag_lock); 1141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds __ipq_unlink(ipq); 1151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_unlock(&ipfrag_lock); 1161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 118182777700d912a69824245e9ee99148ac0aa57d7Al Virostatic unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) 1191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 120182777700d912a69824245e9ee99148ac0aa57d7Al Viro return jhash_3words((__force u32)id << 16 | prot, 121182777700d912a69824245e9ee99148ac0aa57d7Al Viro (__force u32)saddr, (__force u32)daddr, 1221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipfrag_hash_rnd) & (IPQ_HASHSZ - 1); 1231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic struct timer_list ipfrag_secret_timer; 126ab32ea5d8a760e7dd4339634e95d7be24ee5b842Brian Haleyint sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ; 1271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic void ipfrag_secret_rebuild(unsigned long dummy) 1291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds unsigned long now = jiffies; 1311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i; 1321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_lock(&ipfrag_lock); 1341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds get_random_bytes(&ipfrag_hash_rnd, sizeof(u32)); 1351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds for (i = 0; i < IPQ_HASHSZ; i++) { 1361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *q; 137e7c8a41e817f381ac5c2a59ecc81b483bd68a7dfYasuyuki Kozakai struct hlist_node *p, *n; 1381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1395ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], q.list) { 1401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds unsigned int hval = ipqhashfn(q->id, q->saddr, 1411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds q->daddr, q->protocol); 1421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (hval != i) { 1445ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_del(&q->q.list); 1451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Relink to new hash chain. */ 1475ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_add_head(&q->q.list, &ipq_hash[hval]); 1481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_unlock(&ipfrag_lock); 1521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval); 1541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsatomic_t ip_frag_mem = ATOMIC_INIT(0); /* Memory used for fragments */ 1571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1581da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Memory Tracking Functions. */ 1591da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work) 1601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (work) 1621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds *work -= skb->truesize; 1631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_sub(skb->truesize, &ip_frag_mem); 1641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds kfree_skb(skb); 1651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ void frag_free_queue(struct ipq *qp, int *work) 1681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (work) 1701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds *work -= sizeof(struct ipq); 1711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_sub(sizeof(struct ipq), &ip_frag_mem); 1721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds kfree(qp); 1731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ struct ipq *frag_alloc_queue(void) 1761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC); 1781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 179132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger if (!qp) 1801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return NULL; 1811da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_add(sizeof(struct ipq), &ip_frag_mem); 1821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return qp; 1831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Destruction primitives. */ 1871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Complete destruction of ipq. */ 1891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic void ip_frag_destroy(struct ipq *qp, int *work) 1901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct sk_buff *fp; 1921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1935ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov BUG_TRAP(qp->q.last_in&COMPLETE); 1945ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov BUG_TRAP(del_timer(&qp->q.timer) == 0); 1951da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 19689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu if (qp->peer) 19789cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu inet_putpeer(qp->peer); 19889cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 1991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Release all fragment data. */ 2005ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov fp = qp->q.fragments; 2011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds while (fp) { 2021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct sk_buff *xp = fp->next; 2031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds frag_kfree_skb(fp, work); 2051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fp = xp; 2061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Finally, release the queue descriptor itself. */ 2091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds frag_free_queue(qp, work); 2101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ void ipq_put(struct ipq *ipq, int *work) 2131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 2145ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (atomic_dec_and_test(&ipq->q.refcnt)) 2151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ip_frag_destroy(ipq, work); 2161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Kill ipq entry. It is not destroyed immediately, 2191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * because caller (and someone more) holds reference count. 2201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 2211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic void ipq_kill(struct ipq *ipq) 2221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 2235ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (del_timer(&ipq->q.timer)) 2245ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_dec(&ipq->q.refcnt); 2251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2265ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (!(ipq->q.last_in & COMPLETE)) { 2271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_unlink(ipq); 2285ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_dec(&ipq->q.refcnt); 2295ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov ipq->q.last_in |= COMPLETE; 2301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 233e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki/* Memory limiting on fragments. Evictor trashes the oldest 2341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * fragment queue until we are back under the threshold. 2351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 2361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic void ip_evictor(void) 2371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 2381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp; 2391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct list_head *tmp; 2401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int work; 2411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh; 2431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (work <= 0) 2441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return; 2451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds while (work > 0) { 2471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds read_lock(&ipfrag_lock); 2481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (list_empty(&ipq_lru_list)) { 2491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds read_unlock(&ipfrag_lock); 2501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return; 2511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds tmp = ipq_lru_list.next; 2535ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp = list_entry(tmp, struct ipq, q.lru_list); 2545ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_inc(&qp->q.refcnt); 2551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds read_unlock(&ipfrag_lock); 2561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2575ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_lock(&qp->q.lock); 2585ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (!(qp->q.last_in&COMPLETE)) 2591da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_kill(qp); 2605ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_unlock(&qp->q.lock); 2611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_put(qp, &work); 2631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 2641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* 2681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Oops, a fragment queue timed out. Kill it and send an ICMP reply. 2691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 2701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic void ip_expire(unsigned long arg) 2711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 2721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp = (struct ipq *) arg; 2731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2745ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_lock(&qp->q.lock); 2751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2765ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (qp->q.last_in & COMPLETE) 2771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out; 2781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2791da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_kill(qp); 2801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2811da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT); 2821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 2831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2845ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if ((qp->q.last_in&FIRST_IN) && qp->q.fragments != NULL) { 2855ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov struct sk_buff *head = qp->q.fragments; 2861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Send an ICMP "Fragment Reassembly Timeout" message. */ 287881d966b48b035ab3f3aeaae0f3d3f9b584f45b2Eric W. Biederman if ((head->dev = dev_get_by_index(&init_net, qp->iif)) != NULL) { 2881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); 2891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds dev_put(head->dev); 2901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsout: 2935ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_unlock(&qp->q.lock); 2941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_put(qp, NULL); 2951da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2961da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Creation primitives. */ 2981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 29955c0022e53452360064ea264c41410c70565d9f8David S. Millerstatic struct ipq *ip_frag_intern(struct ipq *qp_in) 3001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 3011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp; 302e7c8a41e817f381ac5c2a59ecc81b483bd68a7dfYasuyuki Kozakai#ifdef CONFIG_SMP 303e7c8a41e817f381ac5c2a59ecc81b483bd68a7dfYasuyuki Kozakai struct hlist_node *n; 304e7c8a41e817f381ac5c2a59ecc81b483bd68a7dfYasuyuki Kozakai#endif 30555c0022e53452360064ea264c41410c70565d9f8David S. Miller unsigned int hash; 30655c0022e53452360064ea264c41410c70565d9f8David S. Miller 3071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_lock(&ipfrag_lock); 30855c0022e53452360064ea264c41410c70565d9f8David S. Miller hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr, 30955c0022e53452360064ea264c41410c70565d9f8David S. Miller qp_in->protocol); 3101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#ifdef CONFIG_SMP 3111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* With SMP race we have to recheck hash table, because 3121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * such entry could be created on other cpu, while we 3131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * promoted read lock to write lock. 3141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 3155ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_for_each_entry(qp, n, &ipq_hash[hash], q.list) { 316132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger if (qp->id == qp_in->id && 317132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->saddr == qp_in->saddr && 318132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->daddr == qp_in->daddr && 319132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->protocol == qp_in->protocol && 320132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->user == qp_in->user) { 3215ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_inc(&qp->q.refcnt); 3221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_unlock(&ipfrag_lock); 3235ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp_in->q.last_in |= COMPLETE; 3241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_put(qp_in, NULL); 3251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return qp; 3261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 3271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 3281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#endif 3291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp = qp_in; 3301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3315ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (!mod_timer(&qp->q.timer, jiffies + sysctl_ipfrag_time)) 3325ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_inc(&qp->q.refcnt); 3331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3345ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_inc(&qp->q.refcnt); 3355ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_add_head(&qp->q.list, &ipq_hash[hash]); 3365ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov INIT_LIST_HEAD(&qp->q.lru_list); 3375ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov list_add_tail(&qp->q.lru_list, &ipq_lru_list); 3381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ip_frag_nqueues++; 3391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_unlock(&ipfrag_lock); 3401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return qp; 3411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 3421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Add an entry to the 'ipq' queue for a newly received IP datagram. */ 34455c0022e53452360064ea264c41410c70565d9f8David S. Millerstatic struct ipq *ip_frag_create(struct iphdr *iph, u32 user) 3451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 3461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp; 3471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if ((qp = frag_alloc_queue()) == NULL) 3491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out_nomem; 3501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp->protocol = iph->protocol; 3525ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.last_in = 0; 3531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp->id = iph->id; 3541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp->saddr = iph->saddr; 3551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp->daddr = iph->daddr; 3561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp->user = user; 3575ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.len = 0; 3585ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.meat = 0; 3595ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.fragments = NULL; 3601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds qp->iif = 0; 36189cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL; 3621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Initialize a timer for this entry. */ 3645ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov init_timer(&qp->q.timer); 3655ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.timer.data = (unsigned long) qp; /* pointer to queue */ 3665ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.timer.function = ip_expire; /* expire function */ 3675ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_lock_init(&qp->q.lock); 3685ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_set(&qp->q.refcnt, 1); 3691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 37055c0022e53452360064ea264c41410c70565d9f8David S. Miller return ip_frag_intern(qp); 3711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsout_nomem: 37364ce207306debd7157f47282be94770407bec01cPatrick McHardy LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n"); 3741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return NULL; 3751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 3761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Find the correct entry in the "incomplete datagrams" queue for 3781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * this IP datagram, and create new one, if nothing is found. 3791da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 3801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic inline struct ipq *ip_find(struct iphdr *iph, u32 user) 3811da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 38276ab608d86cf1ef5c5c46819b5733eb9f9f964f8Alexey Dobriyan __be16 id = iph->id; 383182777700d912a69824245e9ee99148ac0aa57d7Al Viro __be32 saddr = iph->saddr; 384182777700d912a69824245e9ee99148ac0aa57d7Al Viro __be32 daddr = iph->daddr; 3851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds __u8 protocol = iph->protocol; 38655c0022e53452360064ea264c41410c70565d9f8David S. Miller unsigned int hash; 3871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp; 388e7c8a41e817f381ac5c2a59ecc81b483bd68a7dfYasuyuki Kozakai struct hlist_node *n; 3891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds read_lock(&ipfrag_lock); 39155c0022e53452360064ea264c41410c70565d9f8David S. Miller hash = ipqhashfn(id, saddr, daddr, protocol); 3925ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov hlist_for_each_entry(qp, n, &ipq_hash[hash], q.list) { 393132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger if (qp->id == id && 394132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->saddr == saddr && 395132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->daddr == daddr && 396132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->protocol == protocol && 397132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger qp->user == user) { 3985ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_inc(&qp->q.refcnt); 3991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds read_unlock(&ipfrag_lock); 4001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return qp; 4011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 4021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 4031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds read_unlock(&ipfrag_lock); 4041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 40555c0022e53452360064ea264c41410c70565d9f8David S. Miller return ip_frag_create(iph, user); 4061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 4071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 40889cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu/* Is the fragment too far ahead to be part of ipq? */ 40989cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xustatic inline int ip_frag_too_far(struct ipq *qp) 41089cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu{ 41189cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu struct inet_peer *peer = qp->peer; 41289cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu unsigned int max = sysctl_ipfrag_max_dist; 41389cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu unsigned int start, end; 41489cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 41589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu int rc; 41689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 41789cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu if (!peer || !max) 41889cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu return 0; 41989cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 42089cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu start = qp->rid; 42189cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu end = atomic_inc_return(&peer->rid); 42289cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu qp->rid = end; 42389cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 4245ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov rc = qp->q.fragments && (end - start) > max; 42589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 42689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu if (rc) { 42789cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 42889cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu } 42989cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 43089cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu return rc; 43189cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu} 43289cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 43389cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xustatic int ip_frag_reinit(struct ipq *qp) 43489cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu{ 43589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu struct sk_buff *fp; 43689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 4375ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (!mod_timer(&qp->q.timer, jiffies + sysctl_ipfrag_time)) { 4385ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov atomic_inc(&qp->q.refcnt); 43989cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu return -ETIMEDOUT; 44089cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu } 44189cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 4425ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov fp = qp->q.fragments; 44389cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu do { 44489cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu struct sk_buff *xp = fp->next; 44589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu frag_kfree_skb(fp, NULL); 44689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu fp = xp; 44789cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu } while (fp); 44889cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 4495ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.last_in = 0; 4505ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.len = 0; 4515ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.meat = 0; 4525ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.fragments = NULL; 45389cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu qp->iif = 0; 45489cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 45589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu return 0; 45689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu} 45789cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 4581da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Add new segment to existing queue. */ 4591706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xustatic int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) 4601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 4611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct sk_buff *prev, *next; 4621706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu struct net_device *dev; 4631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int flags, offset; 4641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int ihl, end; 4651706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu int err = -ENOENT; 4661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 4675ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (qp->q.last_in & COMPLETE) 4681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 4691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 47089cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) && 4711706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu unlikely(ip_frag_too_far(qp)) && 4721706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu unlikely(err = ip_frag_reinit(qp))) { 47389cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu ipq_kill(qp); 47489cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu goto err; 47589cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu } 47689cee8b1cbb9dac40c92ef1968aea2b45f82fd18Herbert Xu 477eddc9ec53be2ecdbf4efe0efd4a83052594f0ac0Arnaldo Carvalho de Melo offset = ntohs(ip_hdr(skb)->frag_off); 4781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds flags = offset & ~IP_OFFSET; 4791da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds offset &= IP_OFFSET; 4801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds offset <<= 3; /* offset is in 8-byte chunks */ 481c9bdd4b5257406b0608385d19c40b5511decf4f6Arnaldo Carvalho de Melo ihl = ip_hdrlen(skb); 4821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 4831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Determine the position of this fragment. */ 484e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki end = offset + skb->len - ihl; 4851706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -EINVAL; 4861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 4871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Is this the final fragment? */ 4881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if ((flags & IP_MF) == 0) { 4891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* If we already have some bits beyond end 4901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * or have different end, the segment is corrrupted. 4911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 4925ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (end < qp->q.len || 4935ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov ((qp->q.last_in & LAST_IN) && end != qp->q.len)) 4941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 4955ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.last_in |= LAST_IN; 4965ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.len = end; 4971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } else { 4981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (end&7) { 4991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds end &= ~7; 5001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (skb->ip_summed != CHECKSUM_UNNECESSARY) 5011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds skb->ip_summed = CHECKSUM_NONE; 5021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5035ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (end > qp->q.len) { 5041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Some bits beyond end -> corruption. */ 5055ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (qp->q.last_in & LAST_IN) 5061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5075ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.len = end; 5081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (end == offset) 5111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5131706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -ENOMEM; 5141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (pskb_pull(skb, ihl) == NULL) 5151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5161706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 5171706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = pskb_trim_rcsum(skb, end - offset); 5181706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu if (err) 5191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Find out which fragments are in front and at the back of us 5221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * in the chain of fragments so far. We must know where to put 5231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * this fragment, right? 5241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 5251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds prev = NULL; 5265ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov for (next = qp->q.fragments; next != NULL; next = next->next) { 5271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (FRAG_CB(next)->offset >= offset) 5281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; /* bingo! */ 5291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds prev = next; 5301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* We found where to put this one. Check for overlap with 5331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * preceding fragment, and, if needed, align things so that 5341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * any overlaps are eliminated. 5351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 5361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (prev) { 5371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i = (FRAG_CB(prev)->offset + prev->len) - offset; 5381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (i > 0) { 5401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds offset += i; 5411706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -EINVAL; 5421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (end <= offset) 5431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5441706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -ENOMEM; 5451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!pskb_pull(skb, i)) 5461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (skb->ip_summed != CHECKSUM_UNNECESSARY) 5481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds skb->ip_summed = CHECKSUM_NONE; 5491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5521706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -ENOMEM; 5531706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 5541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds while (next && FRAG_CB(next)->offset < end) { 5551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ 5561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (i < next->len) { 5581da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Eat head of the next overlapped fragment 5591da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * and leave the loop. The next ones cannot overlap. 5601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 5611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!pskb_pull(next, i)) 5621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto err; 5631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds FRAG_CB(next)->offset += i; 5645ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.meat -= i; 5651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (next->ip_summed != CHECKSUM_UNNECESSARY) 5661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds next->ip_summed = CHECKSUM_NONE; 5671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; 5681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } else { 5691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct sk_buff *free_it = next; 5701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 57147c6bf7760bb8021bf7782f05bcd3b9f73ed2c2ePeter Zijlstra /* Old fragment is completely overridden with 5721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * new one drop it. 5731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 5741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds next = next->next; 5751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (prev) 5771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds prev->next = next; 5781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds else 5795ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.fragments = next; 5801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5815ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.meat -= free_it->len; 5821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds frag_kfree_skb(free_it, NULL); 5831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 5851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds FRAG_CB(skb)->offset = offset; 5871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Insert this fragment in the chain of fragments. */ 5891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds skb->next = next; 5901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (prev) 5911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds prev->next = skb; 5921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds else 5935ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.fragments = skb; 5941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 5951706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu dev = skb->dev; 5961706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu if (dev) { 5971706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu qp->iif = dev->ifindex; 5981706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu skb->dev = NULL; 5991706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu } 6005ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.stamp = skb->tstamp; 6015ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.meat += skb->len; 6021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_add(skb->truesize, &ip_frag_mem); 6031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (offset == 0) 6045ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.last_in |= FIRST_IN; 6051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6065ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov if (qp->q.last_in == (FIRST_IN | LAST_IN) && qp->q.meat == qp->q.len) 6071706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu return ip_frag_reasm(qp, prev, dev); 6081706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 6091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_lock(&ipfrag_lock); 6105ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov list_move_tail(&qp->q.lru_list, &ipq_lru_list); 6111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds write_unlock(&ipfrag_lock); 6121706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu return -EINPROGRESS; 6131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldserr: 6151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds kfree_skb(skb); 6161706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu return err; 6171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 6181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Build a new IP datagram from all its fragments. */ 6211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6221706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xustatic int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, 6231706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu struct net_device *dev) 6241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 6251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct iphdr *iph; 6265ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov struct sk_buff *fp, *head = qp->q.fragments; 6271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int len; 6281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int ihlen; 6291706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu int err; 6301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_kill(qp); 6321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6331706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu /* Make the one we just received the head. */ 6341706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu if (prev) { 6351706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu head = prev->next; 6361706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu fp = skb_clone(head, GFP_ATOMIC); 6371706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 6381706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu if (!fp) 6391706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu goto out_nomem; 6401706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 6411706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu fp->next = head->next; 6421706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu prev->next = fp; 6431706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 6445ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov skb_morph(head, qp->q.fragments); 6455ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov head->next = qp->q.fragments->next; 6461706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 6475ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov kfree_skb(qp->q.fragments); 6485ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.fragments = head; 6491706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu } 6501706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu 6511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds BUG_TRAP(head != NULL); 6521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds BUG_TRAP(FRAG_CB(head)->offset == 0); 6531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Allocate a new buffer for the datagram. */ 655c9bdd4b5257406b0608385d19c40b5511decf4f6Arnaldo Carvalho de Melo ihlen = ip_hdrlen(head); 6565ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov len = ihlen + qp->q.len; 6571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6581706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -E2BIG; 659132adf54639cf7dd9315e8df89c2faa59f6e46d9Stephen Hemminger if (len > 65535) 6601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out_oversize; 6611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Head of list must not be cloned. */ 6631706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu err = -ENOMEM; 6641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) 6651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out_nomem; 6661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* If the first fragment is fragmented itself, we split 6681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * it to two chunks: the first with data and paged part 6691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * and the second, holding only fragments. */ 6701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (skb_shinfo(head)->frag_list) { 6711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct sk_buff *clone; 6721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i, plen = 0; 6731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) 6751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out_nomem; 6761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds clone->next = head->next; 6771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->next = clone; 6781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; 6791da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds skb_shinfo(head)->frag_list = NULL; 6801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds for (i=0; i<skb_shinfo(head)->nr_frags; i++) 6811da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds plen += skb_shinfo(head)->frags[i].size; 6821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds clone->len = clone->data_len = head->data_len - plen; 6831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->data_len -= clone->len; 6841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->len -= clone->len; 6851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds clone->csum = 0; 6861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds clone->ip_summed = head->ip_summed; 6871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_add(clone->truesize, &ip_frag_mem); 6881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 6891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds skb_shinfo(head)->frag_list = head->next; 691d56f90a7c96da5187f0cdf07ee7434fe6aa78bbcArnaldo Carvalho de Melo skb_push(head, head->data - skb_network_header(head)); 6921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_sub(head->truesize, &ip_frag_mem); 6931da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 6941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds for (fp=head->next; fp; fp = fp->next) { 6951da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->data_len += fp->len; 6961da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->len += fp->len; 6971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (head->ip_summed != fp->ip_summed) 6981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->ip_summed = CHECKSUM_NONE; 69984fa7933a33f806bbbaae6775e87459b1ec584c0Patrick McHardy else if (head->ip_summed == CHECKSUM_COMPLETE) 7001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->csum = csum_add(head->csum, fp->csum); 7011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->truesize += fp->truesize; 7021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds atomic_sub(fp->truesize, &ip_frag_mem); 7031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 7041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->next = NULL; 7061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds head->dev = dev; 7075ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov head->tstamp = qp->q.stamp; 7081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 709eddc9ec53be2ecdbf4efe0efd4a83052594f0ac0Arnaldo Carvalho de Melo iph = ip_hdr(head); 7101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds iph->frag_off = 0; 7111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds iph->tot_len = htons(len); 7121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS); 7135ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov qp->q.fragments = NULL; 7141706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu return 0; 7151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsout_nomem: 717e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing " 71864ce207306debd7157f47282be94770407bec01cPatrick McHardy "queue %p\n", qp); 7191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out_fail; 7201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsout_oversize: 7211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (net_ratelimit()) 7221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds printk(KERN_INFO 7231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds "Oversized IP packet from %d.%d.%d.%d.\n", 7241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds NIPQUAD(qp->saddr)); 7251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsout_fail: 7261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 7271706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu return err; 7281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 7291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* Process an incoming IP datagram fragment. */ 731776c729e8d91b2740583a2169678f2d3f383458bHerbert Xuint ip_defrag(struct sk_buff *skb, u32 user) 7321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 7331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipq *qp; 734e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki 7351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS); 7361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Start by cleaning up the memory. */ 7381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh) 7391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ip_evictor(); 7401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Lookup (or create) queue header */ 742eddc9ec53be2ecdbf4efe0efd4a83052594f0ac0Arnaldo Carvalho de Melo if ((qp = ip_find(ip_hdr(skb), user)) != NULL) { 7431706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu int ret; 7441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7455ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_lock(&qp->q.lock); 7461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7471706d58763c36133d7fce6cc78b1444fd40db28cHerbert Xu ret = ip_frag_queue(qp, skb); 7481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7495ab11c98d3a950faf6922b6166e5f8fc874590e7Pavel Emelyanov spin_unlock(&qp->q.lock); 7501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipq_put(qp, NULL); 751776c729e8d91b2740583a2169678f2d3f383458bHerbert Xu return ret; 7521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 7531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); 7551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds kfree_skb(skb); 756776c729e8d91b2740583a2169678f2d3f383458bHerbert Xu return -ENOMEM; 7571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 7581da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 759b7aa0bf70c4afb9e38be25f5c0922498d0f8684cEric Dumazetvoid __init ipfrag_init(void) 7601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 7611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^ 7621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds (jiffies ^ (jiffies >> 6))); 7631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds init_timer(&ipfrag_secret_timer); 7651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipfrag_secret_timer.function = ipfrag_secret_rebuild; 7661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval; 7671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds add_timer(&ipfrag_secret_timer); 7681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 7691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 7701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus TorvaldsEXPORT_SYMBOL(ip_defrag); 771