Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * INET An implementation of the TCP/IP protocol suite for the LINUX | |
3 | * operating system. INET is implemented using the BSD Socket | |
4 | * interface as the means of communication with the user level. | |
5 | * | |
6 | * The IP fragmentation functionality. | |
e905a9ed | 7 | * |
1da177e4 LT |
8 | * Version: $Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $ |
9 | * | |
10 | * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG> | |
11 | * Alan Cox <Alan.Cox@linux.org> | |
12 | * | |
13 | * Fixes: | |
14 | * Alan Cox : Split from ip.c , see ip_input.c for history. | |
15 | * David S. Miller : Begin massive cleanup... | |
16 | * Andi Kleen : Add sysctls. | |
17 | * xxxx : Overlapfrag bug. | |
18 | * Ultima : ip_expire() kernel panic. | |
19 | * Bill Hawes : Frag accounting and evictor fixes. | |
20 | * John McDonald : 0 length frag bug. | |
21 | * Alexey Kuznetsov: SMP races, threading, cleanup. | |
22 | * Patrick McHardy : LRU queue of frag heads for evictor. | |
23 | */ | |
24 | ||
89cee8b1 | 25 | #include <linux/compiler.h> |
1da177e4 LT |
26 | #include <linux/module.h> |
27 | #include <linux/types.h> | |
28 | #include <linux/mm.h> | |
29 | #include <linux/jiffies.h> | |
30 | #include <linux/skbuff.h> | |
31 | #include <linux/list.h> | |
32 | #include <linux/ip.h> | |
33 | #include <linux/icmp.h> | |
34 | #include <linux/netdevice.h> | |
35 | #include <linux/jhash.h> | |
36 | #include <linux/random.h> | |
37 | #include <net/sock.h> | |
38 | #include <net/ip.h> | |
39 | #include <net/icmp.h> | |
40 | #include <net/checksum.h> | |
89cee8b1 | 41 | #include <net/inetpeer.h> |
1da177e4 LT |
42 | #include <linux/tcp.h> |
43 | #include <linux/udp.h> | |
44 | #include <linux/inet.h> | |
45 | #include <linux/netfilter_ipv4.h> | |
46 | ||
47 | /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6 | |
48 | * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c | |
49 | * as well. Or notify me, at least. --ANK | |
50 | */ | |
51 | ||
52 | /* Fragment cache limits. We will commit 256K at one time. Should we | |
53 | * cross that limit we will prune down to 192K. This should cope with | |
54 | * even the most extreme cases without allowing an attacker to measurably | |
55 | * harm machine performance. | |
56 | */ | |
ab32ea5d BH |
57 | int sysctl_ipfrag_high_thresh __read_mostly = 256*1024; |
58 | int sysctl_ipfrag_low_thresh __read_mostly = 192*1024; | |
1da177e4 | 59 | |
ab32ea5d | 60 | int sysctl_ipfrag_max_dist __read_mostly = 64; |
89cee8b1 | 61 | |
1da177e4 LT |
62 | /* Important NOTE! Fragment queue must be destroyed before MSL expires. |
63 | * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL. | |
64 | */ | |
ab32ea5d | 65 | int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME; |
1da177e4 LT |
66 | |
67 | struct ipfrag_skb_cb | |
68 | { | |
69 | struct inet_skb_parm h; | |
70 | int offset; | |
71 | }; | |
72 | ||
73 | #define FRAG_CB(skb) ((struct ipfrag_skb_cb*)((skb)->cb)) | |
74 | ||
75 | /* Describe an entry in the "incomplete datagrams" queue. */ | |
76 | struct ipq { | |
e7c8a41e | 77 | struct hlist_node list; |
1da177e4 LT |
78 | struct list_head lru_list; /* lru list member */ |
79 | u32 user; | |
18277770 AV |
80 | __be32 saddr; |
81 | __be32 daddr; | |
82 | __be16 id; | |
1da177e4 LT |
83 | u8 protocol; |
84 | u8 last_in; | |
85 | #define COMPLETE 4 | |
86 | #define FIRST_IN 2 | |
87 | #define LAST_IN 1 | |
88 | ||
89 | struct sk_buff *fragments; /* linked list of received fragments */ | |
90 | int len; /* total length of original datagram */ | |
91 | int meat; | |
92 | spinlock_t lock; | |
93 | atomic_t refcnt; | |
94 | struct timer_list timer; /* when will this queue expire? */ | |
b7aa0bf7 | 95 | ktime_t stamp; |
89cee8b1 HX |
96 | int iif; |
97 | unsigned int rid; | |
98 | struct inet_peer *peer; | |
1da177e4 LT |
99 | }; |
100 | ||
101 | /* Hash table. */ | |
102 | ||
103 | #define IPQ_HASHSZ 64 | |
104 | ||
105 | /* Per-bucket lock is easy to add now. */ | |
e7c8a41e | 106 | static struct hlist_head ipq_hash[IPQ_HASHSZ]; |
1da177e4 LT |
107 | static DEFINE_RWLOCK(ipfrag_lock); |
108 | static u32 ipfrag_hash_rnd; | |
109 | static LIST_HEAD(ipq_lru_list); | |
110 | int ip_frag_nqueues = 0; | |
111 | ||
1706d587 HX |
112 | static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
113 | struct net_device *dev); | |
114 | ||
1da177e4 LT |
115 | static __inline__ void __ipq_unlink(struct ipq *qp) |
116 | { | |
e7c8a41e | 117 | hlist_del(&qp->list); |
1da177e4 LT |
118 | list_del(&qp->lru_list); |
119 | ip_frag_nqueues--; | |
120 | } | |
121 | ||
122 | static __inline__ void ipq_unlink(struct ipq *ipq) | |
123 | { | |
124 | write_lock(&ipfrag_lock); | |
125 | __ipq_unlink(ipq); | |
126 | write_unlock(&ipfrag_lock); | |
127 | } | |
128 | ||
18277770 | 129 | static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) |
1da177e4 | 130 | { |
18277770 AV |
131 | return jhash_3words((__force u32)id << 16 | prot, |
132 | (__force u32)saddr, (__force u32)daddr, | |
1da177e4 LT |
133 | ipfrag_hash_rnd) & (IPQ_HASHSZ - 1); |
134 | } | |
135 | ||
136 | static struct timer_list ipfrag_secret_timer; | |
ab32ea5d | 137 | int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ; |
1da177e4 LT |
138 | |
139 | static void ipfrag_secret_rebuild(unsigned long dummy) | |
140 | { | |
141 | unsigned long now = jiffies; | |
142 | int i; | |
143 | ||
144 | write_lock(&ipfrag_lock); | |
145 | get_random_bytes(&ipfrag_hash_rnd, sizeof(u32)); | |
146 | for (i = 0; i < IPQ_HASHSZ; i++) { | |
147 | struct ipq *q; | |
e7c8a41e | 148 | struct hlist_node *p, *n; |
1da177e4 | 149 | |
e7c8a41e | 150 | hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) { |
1da177e4 LT |
151 | unsigned int hval = ipqhashfn(q->id, q->saddr, |
152 | q->daddr, q->protocol); | |
153 | ||
154 | if (hval != i) { | |
e7c8a41e | 155 | hlist_del(&q->list); |
1da177e4 LT |
156 | |
157 | /* Relink to new hash chain. */ | |
e7c8a41e | 158 | hlist_add_head(&q->list, &ipq_hash[hval]); |
1da177e4 | 159 | } |
1da177e4 LT |
160 | } |
161 | } | |
162 | write_unlock(&ipfrag_lock); | |
163 | ||
164 | mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval); | |
165 | } | |
166 | ||
167 | atomic_t ip_frag_mem = ATOMIC_INIT(0); /* Memory used for fragments */ | |
168 | ||
169 | /* Memory Tracking Functions. */ | |
170 | static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work) | |
171 | { | |
172 | if (work) | |
173 | *work -= skb->truesize; | |
174 | atomic_sub(skb->truesize, &ip_frag_mem); | |
175 | kfree_skb(skb); | |
176 | } | |
177 | ||
178 | static __inline__ void frag_free_queue(struct ipq *qp, int *work) | |
179 | { | |
180 | if (work) | |
181 | *work -= sizeof(struct ipq); | |
182 | atomic_sub(sizeof(struct ipq), &ip_frag_mem); | |
183 | kfree(qp); | |
184 | } | |
185 | ||
186 | static __inline__ struct ipq *frag_alloc_queue(void) | |
187 | { | |
188 | struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC); | |
189 | ||
132adf54 | 190 | if (!qp) |
1da177e4 LT |
191 | return NULL; |
192 | atomic_add(sizeof(struct ipq), &ip_frag_mem); | |
193 | return qp; | |
194 | } | |
195 | ||
196 | ||
197 | /* Destruction primitives. */ | |
198 | ||
199 | /* Complete destruction of ipq. */ | |
200 | static void ip_frag_destroy(struct ipq *qp, int *work) | |
201 | { | |
202 | struct sk_buff *fp; | |
203 | ||
204 | BUG_TRAP(qp->last_in&COMPLETE); | |
205 | BUG_TRAP(del_timer(&qp->timer) == 0); | |
206 | ||
89cee8b1 HX |
207 | if (qp->peer) |
208 | inet_putpeer(qp->peer); | |
209 | ||
1da177e4 LT |
210 | /* Release all fragment data. */ |
211 | fp = qp->fragments; | |
212 | while (fp) { | |
213 | struct sk_buff *xp = fp->next; | |
214 | ||
215 | frag_kfree_skb(fp, work); | |
216 | fp = xp; | |
217 | } | |
218 | ||
219 | /* Finally, release the queue descriptor itself. */ | |
220 | frag_free_queue(qp, work); | |
221 | } | |
222 | ||
223 | static __inline__ void ipq_put(struct ipq *ipq, int *work) | |
224 | { | |
225 | if (atomic_dec_and_test(&ipq->refcnt)) | |
226 | ip_frag_destroy(ipq, work); | |
227 | } | |
228 | ||
229 | /* Kill ipq entry. It is not destroyed immediately, | |
230 | * because caller (and someone more) holds reference count. | |
231 | */ | |
232 | static void ipq_kill(struct ipq *ipq) | |
233 | { | |
234 | if (del_timer(&ipq->timer)) | |
235 | atomic_dec(&ipq->refcnt); | |
236 | ||
237 | if (!(ipq->last_in & COMPLETE)) { | |
238 | ipq_unlink(ipq); | |
239 | atomic_dec(&ipq->refcnt); | |
240 | ipq->last_in |= COMPLETE; | |
241 | } | |
242 | } | |
243 | ||
e905a9ed | 244 | /* Memory limiting on fragments. Evictor trashes the oldest |
1da177e4 LT |
245 | * fragment queue until we are back under the threshold. |
246 | */ | |
247 | static void ip_evictor(void) | |
248 | { | |
249 | struct ipq *qp; | |
250 | struct list_head *tmp; | |
251 | int work; | |
252 | ||
253 | work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh; | |
254 | if (work <= 0) | |
255 | return; | |
256 | ||
257 | while (work > 0) { | |
258 | read_lock(&ipfrag_lock); | |
259 | if (list_empty(&ipq_lru_list)) { | |
260 | read_unlock(&ipfrag_lock); | |
261 | return; | |
262 | } | |
263 | tmp = ipq_lru_list.next; | |
264 | qp = list_entry(tmp, struct ipq, lru_list); | |
265 | atomic_inc(&qp->refcnt); | |
266 | read_unlock(&ipfrag_lock); | |
267 | ||
268 | spin_lock(&qp->lock); | |
269 | if (!(qp->last_in&COMPLETE)) | |
270 | ipq_kill(qp); | |
271 | spin_unlock(&qp->lock); | |
272 | ||
273 | ipq_put(qp, &work); | |
274 | IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); | |
275 | } | |
276 | } | |
277 | ||
278 | /* | |
279 | * Oops, a fragment queue timed out. Kill it and send an ICMP reply. | |
280 | */ | |
281 | static void ip_expire(unsigned long arg) | |
282 | { | |
283 | struct ipq *qp = (struct ipq *) arg; | |
284 | ||
285 | spin_lock(&qp->lock); | |
286 | ||
287 | if (qp->last_in & COMPLETE) | |
288 | goto out; | |
289 | ||
290 | ipq_kill(qp); | |
291 | ||
292 | IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT); | |
293 | IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); | |
294 | ||
295 | if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) { | |
296 | struct sk_buff *head = qp->fragments; | |
297 | /* Send an ICMP "Fragment Reassembly Timeout" message. */ | |
881d966b | 298 | if ((head->dev = dev_get_by_index(&init_net, qp->iif)) != NULL) { |
1da177e4 LT |
299 | icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); |
300 | dev_put(head->dev); | |
301 | } | |
302 | } | |
303 | out: | |
304 | spin_unlock(&qp->lock); | |
305 | ipq_put(qp, NULL); | |
306 | } | |
307 | ||
308 | /* Creation primitives. */ | |
309 | ||
55c0022e | 310 | static struct ipq *ip_frag_intern(struct ipq *qp_in) |
1da177e4 LT |
311 | { |
312 | struct ipq *qp; | |
e7c8a41e YK |
313 | #ifdef CONFIG_SMP |
314 | struct hlist_node *n; | |
315 | #endif | |
55c0022e DM |
316 | unsigned int hash; |
317 | ||
1da177e4 | 318 | write_lock(&ipfrag_lock); |
55c0022e DM |
319 | hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr, |
320 | qp_in->protocol); | |
1da177e4 LT |
321 | #ifdef CONFIG_SMP |
322 | /* With SMP race we have to recheck hash table, because | |
323 | * such entry could be created on other cpu, while we | |
324 | * promoted read lock to write lock. | |
325 | */ | |
e7c8a41e | 326 | hlist_for_each_entry(qp, n, &ipq_hash[hash], list) { |
132adf54 SH |
327 | if (qp->id == qp_in->id && |
328 | qp->saddr == qp_in->saddr && | |
329 | qp->daddr == qp_in->daddr && | |
330 | qp->protocol == qp_in->protocol && | |
331 | qp->user == qp_in->user) { | |
1da177e4 LT |
332 | atomic_inc(&qp->refcnt); |
333 | write_unlock(&ipfrag_lock); | |
334 | qp_in->last_in |= COMPLETE; | |
335 | ipq_put(qp_in, NULL); | |
336 | return qp; | |
337 | } | |
338 | } | |
339 | #endif | |
340 | qp = qp_in; | |
341 | ||
342 | if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) | |
343 | atomic_inc(&qp->refcnt); | |
344 | ||
345 | atomic_inc(&qp->refcnt); | |
e7c8a41e | 346 | hlist_add_head(&qp->list, &ipq_hash[hash]); |
1da177e4 LT |
347 | INIT_LIST_HEAD(&qp->lru_list); |
348 | list_add_tail(&qp->lru_list, &ipq_lru_list); | |
349 | ip_frag_nqueues++; | |
350 | write_unlock(&ipfrag_lock); | |
351 | return qp; | |
352 | } | |
353 | ||
354 | /* Add an entry to the 'ipq' queue for a newly received IP datagram. */ | |
55c0022e | 355 | static struct ipq *ip_frag_create(struct iphdr *iph, u32 user) |
1da177e4 LT |
356 | { |
357 | struct ipq *qp; | |
358 | ||
359 | if ((qp = frag_alloc_queue()) == NULL) | |
360 | goto out_nomem; | |
361 | ||
362 | qp->protocol = iph->protocol; | |
363 | qp->last_in = 0; | |
364 | qp->id = iph->id; | |
365 | qp->saddr = iph->saddr; | |
366 | qp->daddr = iph->daddr; | |
367 | qp->user = user; | |
368 | qp->len = 0; | |
369 | qp->meat = 0; | |
370 | qp->fragments = NULL; | |
371 | qp->iif = 0; | |
89cee8b1 | 372 | qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL; |
1da177e4 LT |
373 | |
374 | /* Initialize a timer for this entry. */ | |
375 | init_timer(&qp->timer); | |
376 | qp->timer.data = (unsigned long) qp; /* pointer to queue */ | |
377 | qp->timer.function = ip_expire; /* expire function */ | |
378 | spin_lock_init(&qp->lock); | |
379 | atomic_set(&qp->refcnt, 1); | |
380 | ||
55c0022e | 381 | return ip_frag_intern(qp); |
1da177e4 LT |
382 | |
383 | out_nomem: | |
64ce2073 | 384 | LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n"); |
1da177e4 LT |
385 | return NULL; |
386 | } | |
387 | ||
388 | /* Find the correct entry in the "incomplete datagrams" queue for | |
389 | * this IP datagram, and create new one, if nothing is found. | |
390 | */ | |
391 | static inline struct ipq *ip_find(struct iphdr *iph, u32 user) | |
392 | { | |
76ab608d | 393 | __be16 id = iph->id; |
18277770 AV |
394 | __be32 saddr = iph->saddr; |
395 | __be32 daddr = iph->daddr; | |
1da177e4 | 396 | __u8 protocol = iph->protocol; |
55c0022e | 397 | unsigned int hash; |
1da177e4 | 398 | struct ipq *qp; |
e7c8a41e | 399 | struct hlist_node *n; |
1da177e4 LT |
400 | |
401 | read_lock(&ipfrag_lock); | |
55c0022e | 402 | hash = ipqhashfn(id, saddr, daddr, protocol); |
e7c8a41e | 403 | hlist_for_each_entry(qp, n, &ipq_hash[hash], list) { |
132adf54 SH |
404 | if (qp->id == id && |
405 | qp->saddr == saddr && | |
406 | qp->daddr == daddr && | |
407 | qp->protocol == protocol && | |
408 | qp->user == user) { | |
1da177e4 LT |
409 | atomic_inc(&qp->refcnt); |
410 | read_unlock(&ipfrag_lock); | |
411 | return qp; | |
412 | } | |
413 | } | |
414 | read_unlock(&ipfrag_lock); | |
415 | ||
55c0022e | 416 | return ip_frag_create(iph, user); |
1da177e4 LT |
417 | } |
418 | ||
89cee8b1 HX |
419 | /* Is the fragment too far ahead to be part of ipq? */ |
420 | static inline int ip_frag_too_far(struct ipq *qp) | |
421 | { | |
422 | struct inet_peer *peer = qp->peer; | |
423 | unsigned int max = sysctl_ipfrag_max_dist; | |
424 | unsigned int start, end; | |
425 | ||
426 | int rc; | |
427 | ||
428 | if (!peer || !max) | |
429 | return 0; | |
430 | ||
431 | start = qp->rid; | |
432 | end = atomic_inc_return(&peer->rid); | |
433 | qp->rid = end; | |
434 | ||
435 | rc = qp->fragments && (end - start) > max; | |
436 | ||
437 | if (rc) { | |
438 | IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); | |
439 | } | |
440 | ||
441 | return rc; | |
442 | } | |
443 | ||
444 | static int ip_frag_reinit(struct ipq *qp) | |
445 | { | |
446 | struct sk_buff *fp; | |
447 | ||
448 | if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) { | |
449 | atomic_inc(&qp->refcnt); | |
450 | return -ETIMEDOUT; | |
451 | } | |
452 | ||
453 | fp = qp->fragments; | |
454 | do { | |
455 | struct sk_buff *xp = fp->next; | |
456 | frag_kfree_skb(fp, NULL); | |
457 | fp = xp; | |
458 | } while (fp); | |
459 | ||
460 | qp->last_in = 0; | |
461 | qp->len = 0; | |
462 | qp->meat = 0; | |
463 | qp->fragments = NULL; | |
464 | qp->iif = 0; | |
465 | ||
466 | return 0; | |
467 | } | |
468 | ||
1da177e4 | 469 | /* Add new segment to existing queue. */ |
1706d587 | 470 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
1da177e4 LT |
471 | { |
472 | struct sk_buff *prev, *next; | |
1706d587 | 473 | struct net_device *dev; |
1da177e4 LT |
474 | int flags, offset; |
475 | int ihl, end; | |
1706d587 | 476 | int err = -ENOENT; |
1da177e4 LT |
477 | |
478 | if (qp->last_in & COMPLETE) | |
479 | goto err; | |
480 | ||
89cee8b1 | 481 | if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) && |
1706d587 HX |
482 | unlikely(ip_frag_too_far(qp)) && |
483 | unlikely(err = ip_frag_reinit(qp))) { | |
89cee8b1 HX |
484 | ipq_kill(qp); |
485 | goto err; | |
486 | } | |
487 | ||
eddc9ec5 | 488 | offset = ntohs(ip_hdr(skb)->frag_off); |
1da177e4 LT |
489 | flags = offset & ~IP_OFFSET; |
490 | offset &= IP_OFFSET; | |
491 | offset <<= 3; /* offset is in 8-byte chunks */ | |
c9bdd4b5 | 492 | ihl = ip_hdrlen(skb); |
1da177e4 LT |
493 | |
494 | /* Determine the position of this fragment. */ | |
e905a9ed | 495 | end = offset + skb->len - ihl; |
1706d587 | 496 | err = -EINVAL; |
1da177e4 LT |
497 | |
498 | /* Is this the final fragment? */ | |
499 | if ((flags & IP_MF) == 0) { | |
500 | /* If we already have some bits beyond end | |
501 | * or have different end, the segment is corrrupted. | |
502 | */ | |
503 | if (end < qp->len || | |
504 | ((qp->last_in & LAST_IN) && end != qp->len)) | |
505 | goto err; | |
506 | qp->last_in |= LAST_IN; | |
507 | qp->len = end; | |
508 | } else { | |
509 | if (end&7) { | |
510 | end &= ~7; | |
511 | if (skb->ip_summed != CHECKSUM_UNNECESSARY) | |
512 | skb->ip_summed = CHECKSUM_NONE; | |
513 | } | |
514 | if (end > qp->len) { | |
515 | /* Some bits beyond end -> corruption. */ | |
516 | if (qp->last_in & LAST_IN) | |
517 | goto err; | |
518 | qp->len = end; | |
519 | } | |
520 | } | |
521 | if (end == offset) | |
522 | goto err; | |
523 | ||
1706d587 | 524 | err = -ENOMEM; |
1da177e4 LT |
525 | if (pskb_pull(skb, ihl) == NULL) |
526 | goto err; | |
1706d587 HX |
527 | |
528 | err = pskb_trim_rcsum(skb, end - offset); | |
529 | if (err) | |
1da177e4 LT |
530 | goto err; |
531 | ||
532 | /* Find out which fragments are in front and at the back of us | |
533 | * in the chain of fragments so far. We must know where to put | |
534 | * this fragment, right? | |
535 | */ | |
536 | prev = NULL; | |
132adf54 | 537 | for (next = qp->fragments; next != NULL; next = next->next) { |
1da177e4 LT |
538 | if (FRAG_CB(next)->offset >= offset) |
539 | break; /* bingo! */ | |
540 | prev = next; | |
541 | } | |
542 | ||
543 | /* We found where to put this one. Check for overlap with | |
544 | * preceding fragment, and, if needed, align things so that | |
545 | * any overlaps are eliminated. | |
546 | */ | |
547 | if (prev) { | |
548 | int i = (FRAG_CB(prev)->offset + prev->len) - offset; | |
549 | ||
550 | if (i > 0) { | |
551 | offset += i; | |
1706d587 | 552 | err = -EINVAL; |
1da177e4 LT |
553 | if (end <= offset) |
554 | goto err; | |
1706d587 | 555 | err = -ENOMEM; |
1da177e4 LT |
556 | if (!pskb_pull(skb, i)) |
557 | goto err; | |
558 | if (skb->ip_summed != CHECKSUM_UNNECESSARY) | |
559 | skb->ip_summed = CHECKSUM_NONE; | |
560 | } | |
561 | } | |
562 | ||
1706d587 HX |
563 | err = -ENOMEM; |
564 | ||
1da177e4 LT |
565 | while (next && FRAG_CB(next)->offset < end) { |
566 | int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ | |
567 | ||
568 | if (i < next->len) { | |
569 | /* Eat head of the next overlapped fragment | |
570 | * and leave the loop. The next ones cannot overlap. | |
571 | */ | |
572 | if (!pskb_pull(next, i)) | |
573 | goto err; | |
574 | FRAG_CB(next)->offset += i; | |
575 | qp->meat -= i; | |
576 | if (next->ip_summed != CHECKSUM_UNNECESSARY) | |
577 | next->ip_summed = CHECKSUM_NONE; | |
578 | break; | |
579 | } else { | |
580 | struct sk_buff *free_it = next; | |
581 | ||
47c6bf77 | 582 | /* Old fragment is completely overridden with |
1da177e4 LT |
583 | * new one drop it. |
584 | */ | |
585 | next = next->next; | |
586 | ||
587 | if (prev) | |
588 | prev->next = next; | |
589 | else | |
590 | qp->fragments = next; | |
591 | ||
592 | qp->meat -= free_it->len; | |
593 | frag_kfree_skb(free_it, NULL); | |
594 | } | |
595 | } | |
596 | ||
597 | FRAG_CB(skb)->offset = offset; | |
598 | ||
599 | /* Insert this fragment in the chain of fragments. */ | |
600 | skb->next = next; | |
601 | if (prev) | |
602 | prev->next = skb; | |
603 | else | |
604 | qp->fragments = skb; | |
605 | ||
1706d587 HX |
606 | dev = skb->dev; |
607 | if (dev) { | |
608 | qp->iif = dev->ifindex; | |
609 | skb->dev = NULL; | |
610 | } | |
b7aa0bf7 | 611 | qp->stamp = skb->tstamp; |
1da177e4 LT |
612 | qp->meat += skb->len; |
613 | atomic_add(skb->truesize, &ip_frag_mem); | |
614 | if (offset == 0) | |
615 | qp->last_in |= FIRST_IN; | |
616 | ||
1706d587 HX |
617 | if (qp->last_in == (FIRST_IN | LAST_IN) && qp->meat == qp->len) |
618 | return ip_frag_reasm(qp, prev, dev); | |
619 | ||
1da177e4 LT |
620 | write_lock(&ipfrag_lock); |
621 | list_move_tail(&qp->lru_list, &ipq_lru_list); | |
622 | write_unlock(&ipfrag_lock); | |
1706d587 | 623 | return -EINPROGRESS; |
1da177e4 LT |
624 | |
625 | err: | |
626 | kfree_skb(skb); | |
1706d587 | 627 | return err; |
1da177e4 LT |
628 | } |
629 | ||
630 | ||
631 | /* Build a new IP datagram from all its fragments. */ | |
632 | ||
1706d587 HX |
633 | static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
634 | struct net_device *dev) | |
1da177e4 LT |
635 | { |
636 | struct iphdr *iph; | |
637 | struct sk_buff *fp, *head = qp->fragments; | |
638 | int len; | |
639 | int ihlen; | |
1706d587 | 640 | int err; |
1da177e4 LT |
641 | |
642 | ipq_kill(qp); | |
643 | ||
1706d587 HX |
644 | /* Make the one we just received the head. */ |
645 | if (prev) { | |
646 | head = prev->next; | |
647 | fp = skb_clone(head, GFP_ATOMIC); | |
648 | ||
649 | if (!fp) | |
650 | goto out_nomem; | |
651 | ||
652 | fp->next = head->next; | |
653 | prev->next = fp; | |
654 | ||
655 | skb_morph(head, qp->fragments); | |
656 | head->next = qp->fragments->next; | |
657 | ||
658 | kfree_skb(qp->fragments); | |
659 | qp->fragments = head; | |
660 | } | |
661 | ||
1da177e4 LT |
662 | BUG_TRAP(head != NULL); |
663 | BUG_TRAP(FRAG_CB(head)->offset == 0); | |
664 | ||
665 | /* Allocate a new buffer for the datagram. */ | |
c9bdd4b5 | 666 | ihlen = ip_hdrlen(head); |
1da177e4 LT |
667 | len = ihlen + qp->len; |
668 | ||
1706d587 | 669 | err = -E2BIG; |
132adf54 | 670 | if (len > 65535) |
1da177e4 LT |
671 | goto out_oversize; |
672 | ||
673 | /* Head of list must not be cloned. */ | |
1706d587 | 674 | err = -ENOMEM; |
1da177e4 LT |
675 | if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) |
676 | goto out_nomem; | |
677 | ||
678 | /* If the first fragment is fragmented itself, we split | |
679 | * it to two chunks: the first with data and paged part | |
680 | * and the second, holding only fragments. */ | |
681 | if (skb_shinfo(head)->frag_list) { | |
682 | struct sk_buff *clone; | |
683 | int i, plen = 0; | |
684 | ||
685 | if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) | |
686 | goto out_nomem; | |
687 | clone->next = head->next; | |
688 | head->next = clone; | |
689 | skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; | |
690 | skb_shinfo(head)->frag_list = NULL; | |
691 | for (i=0; i<skb_shinfo(head)->nr_frags; i++) | |
692 | plen += skb_shinfo(head)->frags[i].size; | |
693 | clone->len = clone->data_len = head->data_len - plen; | |
694 | head->data_len -= clone->len; | |
695 | head->len -= clone->len; | |
696 | clone->csum = 0; | |
697 | clone->ip_summed = head->ip_summed; | |
698 | atomic_add(clone->truesize, &ip_frag_mem); | |
699 | } | |
700 | ||
701 | skb_shinfo(head)->frag_list = head->next; | |
d56f90a7 | 702 | skb_push(head, head->data - skb_network_header(head)); |
1da177e4 LT |
703 | atomic_sub(head->truesize, &ip_frag_mem); |
704 | ||
705 | for (fp=head->next; fp; fp = fp->next) { | |
706 | head->data_len += fp->len; | |
707 | head->len += fp->len; | |
708 | if (head->ip_summed != fp->ip_summed) | |
709 | head->ip_summed = CHECKSUM_NONE; | |
84fa7933 | 710 | else if (head->ip_summed == CHECKSUM_COMPLETE) |
1da177e4 LT |
711 | head->csum = csum_add(head->csum, fp->csum); |
712 | head->truesize += fp->truesize; | |
713 | atomic_sub(fp->truesize, &ip_frag_mem); | |
714 | } | |
715 | ||
716 | head->next = NULL; | |
717 | head->dev = dev; | |
b7aa0bf7 | 718 | head->tstamp = qp->stamp; |
1da177e4 | 719 | |
eddc9ec5 | 720 | iph = ip_hdr(head); |
1da177e4 LT |
721 | iph->frag_off = 0; |
722 | iph->tot_len = htons(len); | |
723 | IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS); | |
724 | qp->fragments = NULL; | |
1706d587 | 725 | return 0; |
1da177e4 LT |
726 | |
727 | out_nomem: | |
e905a9ed | 728 | LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing " |
64ce2073 | 729 | "queue %p\n", qp); |
1da177e4 LT |
730 | goto out_fail; |
731 | out_oversize: | |
732 | if (net_ratelimit()) | |
733 | printk(KERN_INFO | |
734 | "Oversized IP packet from %d.%d.%d.%d.\n", | |
735 | NIPQUAD(qp->saddr)); | |
736 | out_fail: | |
737 | IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); | |
1706d587 | 738 | return err; |
1da177e4 LT |
739 | } |
740 | ||
741 | /* Process an incoming IP datagram fragment. */ | |
776c729e | 742 | int ip_defrag(struct sk_buff *skb, u32 user) |
1da177e4 | 743 | { |
1da177e4 | 744 | struct ipq *qp; |
e905a9ed | 745 | |
1da177e4 LT |
746 | IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS); |
747 | ||
748 | /* Start by cleaning up the memory. */ | |
749 | if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh) | |
750 | ip_evictor(); | |
751 | ||
1da177e4 | 752 | /* Lookup (or create) queue header */ |
eddc9ec5 | 753 | if ((qp = ip_find(ip_hdr(skb), user)) != NULL) { |
1706d587 | 754 | int ret; |
1da177e4 LT |
755 | |
756 | spin_lock(&qp->lock); | |
757 | ||
1706d587 | 758 | ret = ip_frag_queue(qp, skb); |
1da177e4 LT |
759 | |
760 | spin_unlock(&qp->lock); | |
761 | ipq_put(qp, NULL); | |
776c729e | 762 | return ret; |
1da177e4 LT |
763 | } |
764 | ||
765 | IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS); | |
766 | kfree_skb(skb); | |
776c729e | 767 | return -ENOMEM; |
1da177e4 LT |
768 | } |
769 | ||
b7aa0bf7 | 770 | void __init ipfrag_init(void) |
1da177e4 LT |
771 | { |
772 | ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^ | |
773 | (jiffies ^ (jiffies >> 6))); | |
774 | ||
775 | init_timer(&ipfrag_secret_timer); | |
776 | ipfrag_secret_timer.function = ipfrag_secret_rebuild; | |
777 | ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval; | |
778 | add_timer(&ipfrag_secret_timer); | |
779 | } | |
780 | ||
781 | EXPORT_SYMBOL(ip_defrag); |