1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * INET An implementation of the TCP/IP protocol suite for the LINUX
4 * operating system. INET is implemented using the BSD Socket
5 * interface as the means of communication with the user level.
6 *
7 * The IP fragmentation functionality.
8 *
9 * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
10 * Alan Cox <alan@lxorguk.ukuu.org.uk>
11 *
12 * Fixes:
13 * Alan Cox : Split from ip.c , see ip_input.c for history.
14 * David S. Miller : Begin massive cleanup...
15 * Andi Kleen : Add sysctls.
16 * xxxx : Overlapfrag bug.
17 * Ultima : ip_expire() kernel panic.
18 * Bill Hawes : Frag accounting and evictor fixes.
19 * John McDonald : 0 length frag bug.
20 * Alexey Kuznetsov: SMP races, threading, cleanup.
21 * Patrick McHardy : LRU queue of frag heads for evictor.
22 */
23
24 #define pr_fmt(fmt) "IPv4: " fmt
25
26 #include <linux/compiler.h>
27 #include <linux/module.h>
28 #include <linux/types.h>
29 #include <linux/mm.h>
30 #include <linux/jiffies.h>
31 #include <linux/skbuff.h>
32 #include <linux/list.h>
33 #include <linux/ip.h>
34 #include <linux/icmp.h>
35 #include <linux/netdevice.h>
36 #include <linux/jhash.h>
37 #include <linux/random.h>
38 #include <linux/slab.h>
39 #include <net/route.h>
40 #include <net/dst.h>
41 #include <net/sock.h>
42 #include <net/ip.h>
43 #include <net/icmp.h>
44 #include <net/checksum.h>
45 #include <net/inetpeer.h>
46 #include <net/inet_frag.h>
47 #include <linux/tcp.h>
48 #include <linux/udp.h>
49 #include <linux/inet.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <net/inet_ecn.h>
52 #include <net/l3mdev.h>
53
54 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
55 * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
56 * as well. Or notify me, at least. --ANK
57 */
58 static const char ip_frag_cache_name[] = "ip4-frags";
59
60 /* Use skb->cb to track consecutive/adjacent fragments coming at
61 * the end of the queue. Nodes in the rb-tree queue will
62 * contain "runs" of one or more adjacent fragments.
63 *
64 * Invariants:
65 * - next_frag is NULL at the tail of a "run";
66 * - the head of a "run" has the sum of all fragment lengths in frag_run_len.
67 */
68 struct ipfrag_skb_cb {
69 struct inet_skb_parm h;
70 struct sk_buff *next_frag;
71 int frag_run_len;
72 };
73
74 #define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb))
75
ip4_frag_init_run(struct sk_buff * skb)76 static void ip4_frag_init_run(struct sk_buff *skb)
77 {
78 BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb));
79
80 FRAG_CB(skb)->next_frag = NULL;
81 FRAG_CB(skb)->frag_run_len = skb->len;
82 }
83
84 /* Append skb to the last "run". */
ip4_frag_append_to_last_run(struct inet_frag_queue * q,struct sk_buff * skb)85 static void ip4_frag_append_to_last_run(struct inet_frag_queue *q,
86 struct sk_buff *skb)
87 {
88 RB_CLEAR_NODE(&skb->rbnode);
89 FRAG_CB(skb)->next_frag = NULL;
90
91 FRAG_CB(q->last_run_head)->frag_run_len += skb->len;
92 FRAG_CB(q->fragments_tail)->next_frag = skb;
93 q->fragments_tail = skb;
94 }
95
96 /* Create a new "run" with the skb. */
ip4_frag_create_run(struct inet_frag_queue * q,struct sk_buff * skb)97 static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb)
98 {
99 if (q->last_run_head)
100 rb_link_node(&skb->rbnode, &q->last_run_head->rbnode,
101 &q->last_run_head->rbnode.rb_right);
102 else
103 rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node);
104 rb_insert_color(&skb->rbnode, &q->rb_fragments);
105
106 ip4_frag_init_run(skb);
107 q->fragments_tail = skb;
108 q->last_run_head = skb;
109 }
110
111 /* Describe an entry in the "incomplete datagrams" queue. */
112 struct ipq {
113 struct inet_frag_queue q;
114
115 u8 ecn; /* RFC3168 support */
116 u16 max_df_size; /* largest frag with DF set seen */
117 int iif;
118 unsigned int rid;
119 struct inet_peer *peer;
120 };
121
ip4_frag_ecn(u8 tos)122 static u8 ip4_frag_ecn(u8 tos)
123 {
124 return 1 << (tos & INET_ECN_MASK);
125 }
126
127 static struct inet_frags ip4_frags;
128
129 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
130 struct sk_buff *prev_tail, struct net_device *dev);
131
132
ip4_frag_init(struct inet_frag_queue * q,const void * a)133 static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
134 {
135 struct ipq *qp = container_of(q, struct ipq, q);
136 struct netns_ipv4 *ipv4 = container_of(q->net, struct netns_ipv4,
137 frags);
138 struct net *net = container_of(ipv4, struct net, ipv4);
139
140 const struct frag_v4_compare_key *key = a;
141
142 q->key.v4 = *key;
143 qp->ecn = 0;
144 qp->peer = q->net->max_dist ?
145 inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) :
146 NULL;
147 }
148
ip4_frag_free(struct inet_frag_queue * q)149 static void ip4_frag_free(struct inet_frag_queue *q)
150 {
151 struct ipq *qp;
152
153 qp = container_of(q, struct ipq, q);
154 if (qp->peer)
155 inet_putpeer(qp->peer);
156 }
157
158
159 /* Destruction primitives. */
160
ipq_put(struct ipq * ipq)161 static void ipq_put(struct ipq *ipq)
162 {
163 inet_frag_put(&ipq->q);
164 }
165
166 /* Kill ipq entry. It is not destroyed immediately,
167 * because caller (and someone more) holds reference count.
168 */
ipq_kill(struct ipq * ipq)169 static void ipq_kill(struct ipq *ipq)
170 {
171 inet_frag_kill(&ipq->q);
172 }
173
frag_expire_skip_icmp(u32 user)174 static bool frag_expire_skip_icmp(u32 user)
175 {
176 return user == IP_DEFRAG_AF_PACKET ||
177 ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_IN,
178 __IP_DEFRAG_CONNTRACK_IN_END) ||
179 ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_BRIDGE_IN,
180 __IP_DEFRAG_CONNTRACK_BRIDGE_IN);
181 }
182
183 /*
184 * Oops, a fragment queue timed out. Kill it and send an ICMP reply.
185 */
ip_expire(struct timer_list * t)186 static void ip_expire(struct timer_list *t)
187 {
188 struct inet_frag_queue *frag = from_timer(frag, t, timer);
189 const struct iphdr *iph;
190 struct sk_buff *head = NULL;
191 struct net *net;
192 struct ipq *qp;
193 int err;
194
195 qp = container_of(frag, struct ipq, q);
196 net = container_of(qp->q.net, struct net, ipv4.frags);
197
198 rcu_read_lock();
199 spin_lock(&qp->q.lock);
200
201 if (qp->q.flags & INET_FRAG_COMPLETE)
202 goto out;
203
204 ipq_kill(qp);
205 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
206 __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT);
207
208 if (!(qp->q.flags & INET_FRAG_FIRST_IN))
209 goto out;
210
211 /* sk_buff::dev and sk_buff::rbnode are unionized. So we
212 * pull the head out of the tree in order to be able to
213 * deal with head->dev.
214 */
215 if (qp->q.fragments) {
216 head = qp->q.fragments;
217 qp->q.fragments = head->next;
218 } else {
219 head = skb_rb_first(&qp->q.rb_fragments);
220 if (!head)
221 goto out;
222 if (FRAG_CB(head)->next_frag)
223 rb_replace_node(&head->rbnode,
224 &FRAG_CB(head)->next_frag->rbnode,
225 &qp->q.rb_fragments);
226 else
227 rb_erase(&head->rbnode, &qp->q.rb_fragments);
228 memset(&head->rbnode, 0, sizeof(head->rbnode));
229 barrier();
230 }
231 if (head == qp->q.fragments_tail)
232 qp->q.fragments_tail = NULL;
233
234 sub_frag_mem_limit(qp->q.net, head->truesize);
235
236 head->dev = dev_get_by_index_rcu(net, qp->iif);
237 if (!head->dev)
238 goto out;
239
240
241 /* skb has no dst, perform route lookup again */
242 iph = ip_hdr(head);
243 err = ip_route_input_noref(head, iph->daddr, iph->saddr,
244 iph->tos, head->dev);
245 if (err)
246 goto out;
247
248 /* Only an end host needs to send an ICMP
249 * "Fragment Reassembly Timeout" message, per RFC792.
250 */
251 if (frag_expire_skip_icmp(qp->q.key.v4.user) &&
252 (skb_rtable(head)->rt_type != RTN_LOCAL))
253 goto out;
254
255 spin_unlock(&qp->q.lock);
256 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
257 goto out_rcu_unlock;
258
259 out:
260 spin_unlock(&qp->q.lock);
261 out_rcu_unlock:
262 rcu_read_unlock();
263 if (head)
264 kfree_skb(head);
265 ipq_put(qp);
266 }
267
268 /* Find the correct entry in the "incomplete datagrams" queue for
269 * this IP datagram, and create new one, if nothing is found.
270 */
ip_find(struct net * net,struct iphdr * iph,u32 user,int vif)271 static struct ipq *ip_find(struct net *net, struct iphdr *iph,
272 u32 user, int vif)
273 {
274 struct frag_v4_compare_key key = {
275 .saddr = iph->saddr,
276 .daddr = iph->daddr,
277 .user = user,
278 .vif = vif,
279 .id = iph->id,
280 .protocol = iph->protocol,
281 };
282 struct inet_frag_queue *q;
283
284 q = inet_frag_find(&net->ipv4.frags, &key);
285 if (!q)
286 return NULL;
287
288 return container_of(q, struct ipq, q);
289 }
290
291 /* Is the fragment too far ahead to be part of ipq? */
ip_frag_too_far(struct ipq * qp)292 static int ip_frag_too_far(struct ipq *qp)
293 {
294 struct inet_peer *peer = qp->peer;
295 unsigned int max = qp->q.net->max_dist;
296 unsigned int start, end;
297
298 int rc;
299
300 if (!peer || !max)
301 return 0;
302
303 start = qp->rid;
304 end = atomic_inc_return(&peer->rid);
305 qp->rid = end;
306
307 rc = qp->q.fragments_tail && (end - start) > max;
308
309 if (rc) {
310 struct net *net;
311
312 net = container_of(qp->q.net, struct net, ipv4.frags);
313 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
314 }
315
316 return rc;
317 }
318
ip_frag_reinit(struct ipq * qp)319 static int ip_frag_reinit(struct ipq *qp)
320 {
321 unsigned int sum_truesize = 0;
322
323 if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) {
324 refcount_inc(&qp->q.refcnt);
325 return -ETIMEDOUT;
326 }
327
328 sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments);
329 sub_frag_mem_limit(qp->q.net, sum_truesize);
330
331 qp->q.flags = 0;
332 qp->q.len = 0;
333 qp->q.meat = 0;
334 qp->q.fragments = NULL;
335 qp->q.rb_fragments = RB_ROOT;
336 qp->q.fragments_tail = NULL;
337 qp->q.last_run_head = NULL;
338 qp->iif = 0;
339 qp->ecn = 0;
340
341 return 0;
342 }
343
344 /* Add new segment to existing queue. */
ip_frag_queue(struct ipq * qp,struct sk_buff * skb)345 static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
346 {
347 struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
348 struct rb_node **rbn, *parent;
349 struct sk_buff *skb1, *prev_tail;
350 struct net_device *dev;
351 unsigned int fragsize;
352 int flags, offset;
353 int ihl, end;
354 int err = -ENOENT;
355 u8 ecn;
356
357 if (qp->q.flags & INET_FRAG_COMPLETE)
358 goto err;
359
360 if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
361 unlikely(ip_frag_too_far(qp)) &&
362 unlikely(err = ip_frag_reinit(qp))) {
363 ipq_kill(qp);
364 goto err;
365 }
366
367 ecn = ip4_frag_ecn(ip_hdr(skb)->tos);
368 offset = ntohs(ip_hdr(skb)->frag_off);
369 flags = offset & ~IP_OFFSET;
370 offset &= IP_OFFSET;
371 offset <<= 3; /* offset is in 8-byte chunks */
372 ihl = ip_hdrlen(skb);
373
374 /* Determine the position of this fragment. */
375 end = offset + skb->len - skb_network_offset(skb) - ihl;
376 err = -EINVAL;
377
378 /* Is this the final fragment? */
379 if ((flags & IP_MF) == 0) {
380 /* If we already have some bits beyond end
381 * or have different end, the segment is corrupted.
382 */
383 if (end < qp->q.len ||
384 ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len))
385 goto err;
386 qp->q.flags |= INET_FRAG_LAST_IN;
387 qp->q.len = end;
388 } else {
389 if (end&7) {
390 end &= ~7;
391 if (skb->ip_summed != CHECKSUM_UNNECESSARY)
392 skb->ip_summed = CHECKSUM_NONE;
393 }
394 if (end > qp->q.len) {
395 /* Some bits beyond end -> corruption. */
396 if (qp->q.flags & INET_FRAG_LAST_IN)
397 goto err;
398 qp->q.len = end;
399 }
400 }
401 if (end == offset)
402 goto err;
403
404 err = -ENOMEM;
405 if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
406 goto err;
407
408 err = pskb_trim_rcsum(skb, end - offset);
409 if (err)
410 goto err;
411
412 /* Note : skb->rbnode and skb->dev share the same location. */
413 dev = skb->dev;
414 /* Makes sure compiler wont do silly aliasing games */
415 barrier();
416
417 /* RFC5722, Section 4, amended by Errata ID : 3089
418 * When reassembling an IPv6 datagram, if
419 * one or more its constituent fragments is determined to be an
420 * overlapping fragment, the entire datagram (and any constituent
421 * fragments) MUST be silently discarded.
422 *
423 * We do the same here for IPv4 (and increment an snmp counter).
424 */
425
426 /* Find out where to put this fragment. */
427 prev_tail = qp->q.fragments_tail;
428 if (!prev_tail)
429 ip4_frag_create_run(&qp->q, skb); /* First fragment. */
430 else if (prev_tail->ip_defrag_offset + prev_tail->len < end) {
431 /* This is the common case: skb goes to the end. */
432 /* Detect and discard overlaps. */
433 if (offset < prev_tail->ip_defrag_offset + prev_tail->len)
434 goto discard_qp;
435 if (offset == prev_tail->ip_defrag_offset + prev_tail->len)
436 ip4_frag_append_to_last_run(&qp->q, skb);
437 else
438 ip4_frag_create_run(&qp->q, skb);
439 } else {
440 /* Binary search. Note that skb can become the first fragment,
441 * but not the last (covered above).
442 */
443 rbn = &qp->q.rb_fragments.rb_node;
444 do {
445 parent = *rbn;
446 skb1 = rb_to_skb(parent);
447 if (end <= skb1->ip_defrag_offset)
448 rbn = &parent->rb_left;
449 else if (offset >= skb1->ip_defrag_offset +
450 FRAG_CB(skb1)->frag_run_len)
451 rbn = &parent->rb_right;
452 else /* Found an overlap with skb1. */
453 goto discard_qp;
454 } while (*rbn);
455 /* Here we have parent properly set, and rbn pointing to
456 * one of its NULL left/right children. Insert skb.
457 */
458 ip4_frag_init_run(skb);
459 rb_link_node(&skb->rbnode, parent, rbn);
460 rb_insert_color(&skb->rbnode, &qp->q.rb_fragments);
461 }
462
463 if (dev)
464 qp->iif = dev->ifindex;
465 skb->ip_defrag_offset = offset;
466
467 qp->q.stamp = skb->tstamp;
468 qp->q.meat += skb->len;
469 qp->ecn |= ecn;
470 add_frag_mem_limit(qp->q.net, skb->truesize);
471 if (offset == 0)
472 qp->q.flags |= INET_FRAG_FIRST_IN;
473
474 fragsize = skb->len + ihl;
475
476 if (fragsize > qp->q.max_size)
477 qp->q.max_size = fragsize;
478
479 if (ip_hdr(skb)->frag_off & htons(IP_DF) &&
480 fragsize > qp->max_df_size)
481 qp->max_df_size = fragsize;
482
483 if (qp->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
484 qp->q.meat == qp->q.len) {
485 unsigned long orefdst = skb->_skb_refdst;
486
487 skb->_skb_refdst = 0UL;
488 err = ip_frag_reasm(qp, skb, prev_tail, dev);
489 skb->_skb_refdst = orefdst;
490 return err;
491 }
492
493 skb_dst_drop(skb);
494 return -EINPROGRESS;
495
496 discard_qp:
497 inet_frag_kill(&qp->q);
498 err = -EINVAL;
499 __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
500 err:
501 kfree_skb(skb);
502 return err;
503 }
504
505 /* Build a new IP datagram from all its fragments. */
ip_frag_reasm(struct ipq * qp,struct sk_buff * skb,struct sk_buff * prev_tail,struct net_device * dev)506 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
507 struct sk_buff *prev_tail, struct net_device *dev)
508 {
509 struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
510 struct iphdr *iph;
511 struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments);
512 struct sk_buff **nextp; /* To build frag_list. */
513 struct rb_node *rbn;
514 int len;
515 int ihlen;
516 int err;
517 u8 ecn;
518
519 ipq_kill(qp);
520
521 ecn = ip_frag_ecn_table[qp->ecn];
522 if (unlikely(ecn == 0xff)) {
523 err = -EINVAL;
524 goto out_fail;
525 }
526 /* Make the one we just received the head. */
527 if (head != skb) {
528 fp = skb_clone(skb, GFP_ATOMIC);
529 if (!fp)
530 goto out_nomem;
531 FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
532 if (RB_EMPTY_NODE(&skb->rbnode))
533 FRAG_CB(prev_tail)->next_frag = fp;
534 else
535 rb_replace_node(&skb->rbnode, &fp->rbnode,
536 &qp->q.rb_fragments);
537 if (qp->q.fragments_tail == skb)
538 qp->q.fragments_tail = fp;
539 skb_morph(skb, head);
540 FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
541 rb_replace_node(&head->rbnode, &skb->rbnode,
542 &qp->q.rb_fragments);
543 consume_skb(head);
544 head = skb;
545 }
546
547 WARN_ON(head->ip_defrag_offset != 0);
548
549 /* Allocate a new buffer for the datagram. */
550 ihlen = ip_hdrlen(head);
551 len = ihlen + qp->q.len;
552
553 err = -E2BIG;
554 if (len > 65535)
555 goto out_oversize;
556
557 /* Head of list must not be cloned. */
558 if (skb_unclone(head, GFP_ATOMIC))
559 goto out_nomem;
560
561 /* If the first fragment is fragmented itself, we split
562 * it to two chunks: the first with data and paged part
563 * and the second, holding only fragments. */
564 if (skb_has_frag_list(head)) {
565 struct sk_buff *clone;
566 int i, plen = 0;
567
568 clone = alloc_skb(0, GFP_ATOMIC);
569 if (!clone)
570 goto out_nomem;
571 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
572 skb_frag_list_init(head);
573 for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
574 plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
575 clone->len = clone->data_len = head->data_len - plen;
576 head->truesize += clone->truesize;
577 clone->csum = 0;
578 clone->ip_summed = head->ip_summed;
579 add_frag_mem_limit(qp->q.net, clone->truesize);
580 skb_shinfo(head)->frag_list = clone;
581 nextp = &clone->next;
582 } else {
583 nextp = &skb_shinfo(head)->frag_list;
584 }
585
586 skb_push(head, head->data - skb_network_header(head));
587
588 /* Traverse the tree in order, to build frag_list. */
589 fp = FRAG_CB(head)->next_frag;
590 rbn = rb_next(&head->rbnode);
591 rb_erase(&head->rbnode, &qp->q.rb_fragments);
592 while (rbn || fp) {
593 /* fp points to the next sk_buff in the current run;
594 * rbn points to the next run.
595 */
596 /* Go through the current run. */
597 while (fp) {
598 *nextp = fp;
599 nextp = &fp->next;
600 fp->prev = NULL;
601 memset(&fp->rbnode, 0, sizeof(fp->rbnode));
602 fp->sk = NULL;
603 head->data_len += fp->len;
604 head->len += fp->len;
605 if (head->ip_summed != fp->ip_summed)
606 head->ip_summed = CHECKSUM_NONE;
607 else if (head->ip_summed == CHECKSUM_COMPLETE)
608 head->csum = csum_add(head->csum, fp->csum);
609 head->truesize += fp->truesize;
610 fp = FRAG_CB(fp)->next_frag;
611 }
612 /* Move to the next run. */
613 if (rbn) {
614 struct rb_node *rbnext = rb_next(rbn);
615
616 fp = rb_to_skb(rbn);
617 rb_erase(rbn, &qp->q.rb_fragments);
618 rbn = rbnext;
619 }
620 }
621 sub_frag_mem_limit(qp->q.net, head->truesize);
622
623 *nextp = NULL;
624 head->next = NULL;
625 head->prev = NULL;
626 head->dev = dev;
627 head->tstamp = qp->q.stamp;
628 IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
629
630 iph = ip_hdr(head);
631 iph->tot_len = htons(len);
632 iph->tos |= ecn;
633
634 /* When we set IP_DF on a refragmented skb we must also force a
635 * call to ip_fragment to avoid forwarding a DF-skb of size s while
636 * original sender only sent fragments of size f (where f < s).
637 *
638 * We only set DF/IPSKB_FRAG_PMTU if such DF fragment was the largest
639 * frag seen to avoid sending tiny DF-fragments in case skb was built
640 * from one very small df-fragment and one large non-df frag.
641 */
642 if (qp->max_df_size == qp->q.max_size) {
643 IPCB(head)->flags |= IPSKB_FRAG_PMTU;
644 iph->frag_off = htons(IP_DF);
645 } else {
646 iph->frag_off = 0;
647 }
648
649 ip_send_check(iph);
650
651 __IP_INC_STATS(net, IPSTATS_MIB_REASMOKS);
652 qp->q.fragments = NULL;
653 qp->q.rb_fragments = RB_ROOT;
654 qp->q.fragments_tail = NULL;
655 qp->q.last_run_head = NULL;
656 return 0;
657
658 out_nomem:
659 net_dbg_ratelimited("queue_glue: no memory for gluing queue %p\n", qp);
660 err = -ENOMEM;
661 goto out_fail;
662 out_oversize:
663 net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr);
664 out_fail:
665 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
666 return err;
667 }
668
669 /* Process an incoming IP datagram fragment. */
ip_defrag(struct net * net,struct sk_buff * skb,u32 user)670 int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
671 {
672 struct net_device *dev = skb->dev ? : skb_dst(skb)->dev;
673 int vif = l3mdev_master_ifindex_rcu(dev);
674 struct ipq *qp;
675
676 __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
677 skb_orphan(skb);
678
679 /* Lookup (or create) queue header */
680 qp = ip_find(net, ip_hdr(skb), user, vif);
681 if (qp) {
682 int ret;
683
684 spin_lock(&qp->q.lock);
685
686 ret = ip_frag_queue(qp, skb);
687
688 spin_unlock(&qp->q.lock);
689 ipq_put(qp);
690 return ret;
691 }
692
693 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
694 kfree_skb(skb);
695 return -ENOMEM;
696 }
697 EXPORT_SYMBOL(ip_defrag);
698
ip_check_defrag(struct net * net,struct sk_buff * skb,u32 user)699 struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
700 {
701 struct iphdr iph;
702 int netoff;
703 u32 len;
704
705 if (skb->protocol != htons(ETH_P_IP))
706 return skb;
707
708 netoff = skb_network_offset(skb);
709
710 if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
711 return skb;
712
713 if (iph.ihl < 5 || iph.version != 4)
714 return skb;
715
716 len = ntohs(iph.tot_len);
717 if (skb->len < netoff + len || len < (iph.ihl * 4))
718 return skb;
719
720 if (ip_is_fragment(&iph)) {
721 skb = skb_share_check(skb, GFP_ATOMIC);
722 if (skb) {
723 if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
724 return skb;
725 if (pskb_trim_rcsum(skb, netoff + len))
726 return skb;
727 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
728 if (ip_defrag(net, skb, user))
729 return NULL;
730 skb_clear_hash(skb);
731 }
732 }
733 return skb;
734 }
735 EXPORT_SYMBOL(ip_check_defrag);
736
inet_frag_rbtree_purge(struct rb_root * root)737 unsigned int inet_frag_rbtree_purge(struct rb_root *root)
738 {
739 struct rb_node *p = rb_first(root);
740 unsigned int sum = 0;
741
742 while (p) {
743 struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode);
744
745 p = rb_next(p);
746 rb_erase(&skb->rbnode, root);
747 while (skb) {
748 struct sk_buff *next = FRAG_CB(skb)->next_frag;
749
750 sum += skb->truesize;
751 kfree_skb(skb);
752 skb = next;
753 }
754 }
755 return sum;
756 }
757 EXPORT_SYMBOL(inet_frag_rbtree_purge);
758
759 #ifdef CONFIG_SYSCTL
760 static int dist_min;
761
762 static struct ctl_table ip4_frags_ns_ctl_table[] = {
763 {
764 .procname = "ipfrag_high_thresh",
765 .data = &init_net.ipv4.frags.high_thresh,
766 .maxlen = sizeof(unsigned long),
767 .mode = 0644,
768 .proc_handler = proc_doulongvec_minmax,
769 .extra1 = &init_net.ipv4.frags.low_thresh
770 },
771 {
772 .procname = "ipfrag_low_thresh",
773 .data = &init_net.ipv4.frags.low_thresh,
774 .maxlen = sizeof(unsigned long),
775 .mode = 0644,
776 .proc_handler = proc_doulongvec_minmax,
777 .extra2 = &init_net.ipv4.frags.high_thresh
778 },
779 {
780 .procname = "ipfrag_time",
781 .data = &init_net.ipv4.frags.timeout,
782 .maxlen = sizeof(int),
783 .mode = 0644,
784 .proc_handler = proc_dointvec_jiffies,
785 },
786 {
787 .procname = "ipfrag_max_dist",
788 .data = &init_net.ipv4.frags.max_dist,
789 .maxlen = sizeof(int),
790 .mode = 0644,
791 .proc_handler = proc_dointvec_minmax,
792 .extra1 = &dist_min,
793 },
794 { }
795 };
796
797 /* secret interval has been deprecated */
798 static int ip4_frags_secret_interval_unused;
799 static struct ctl_table ip4_frags_ctl_table[] = {
800 {
801 .procname = "ipfrag_secret_interval",
802 .data = &ip4_frags_secret_interval_unused,
803 .maxlen = sizeof(int),
804 .mode = 0644,
805 .proc_handler = proc_dointvec_jiffies,
806 },
807 { }
808 };
809
ip4_frags_ns_ctl_register(struct net * net)810 static int __net_init ip4_frags_ns_ctl_register(struct net *net)
811 {
812 struct ctl_table *table;
813 struct ctl_table_header *hdr;
814
815 table = ip4_frags_ns_ctl_table;
816 if (!net_eq(net, &init_net)) {
817 table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
818 if (!table)
819 goto err_alloc;
820
821 table[0].data = &net->ipv4.frags.high_thresh;
822 table[0].extra1 = &net->ipv4.frags.low_thresh;
823 table[0].extra2 = &init_net.ipv4.frags.high_thresh;
824 table[1].data = &net->ipv4.frags.low_thresh;
825 table[1].extra2 = &net->ipv4.frags.high_thresh;
826 table[2].data = &net->ipv4.frags.timeout;
827 table[3].data = &net->ipv4.frags.max_dist;
828 }
829
830 hdr = register_net_sysctl(net, "net/ipv4", table);
831 if (!hdr)
832 goto err_reg;
833
834 net->ipv4.frags_hdr = hdr;
835 return 0;
836
837 err_reg:
838 if (!net_eq(net, &init_net))
839 kfree(table);
840 err_alloc:
841 return -ENOMEM;
842 }
843
ip4_frags_ns_ctl_unregister(struct net * net)844 static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
845 {
846 struct ctl_table *table;
847
848 table = net->ipv4.frags_hdr->ctl_table_arg;
849 unregister_net_sysctl_table(net->ipv4.frags_hdr);
850 kfree(table);
851 }
852
ip4_frags_ctl_register(void)853 static void __init ip4_frags_ctl_register(void)
854 {
855 register_net_sysctl(&init_net, "net/ipv4", ip4_frags_ctl_table);
856 }
857 #else
ip4_frags_ns_ctl_register(struct net * net)858 static int ip4_frags_ns_ctl_register(struct net *net)
859 {
860 return 0;
861 }
862
ip4_frags_ns_ctl_unregister(struct net * net)863 static void ip4_frags_ns_ctl_unregister(struct net *net)
864 {
865 }
866
ip4_frags_ctl_register(void)867 static void __init ip4_frags_ctl_register(void)
868 {
869 }
870 #endif
871
ipv4_frags_init_net(struct net * net)872 static int __net_init ipv4_frags_init_net(struct net *net)
873 {
874 int res;
875
876 /* Fragment cache limits.
877 *
878 * The fragment memory accounting code, (tries to) account for
879 * the real memory usage, by measuring both the size of frag
880 * queue struct (inet_frag_queue (ipv4:ipq/ipv6:frag_queue))
881 * and the SKB's truesize.
882 *
883 * A 64K fragment consumes 129736 bytes (44*2944)+200
884 * (1500 truesize == 2944, sizeof(struct ipq) == 200)
885 *
886 * We will commit 4MB at one time. Should we cross that limit
887 * we will prune down to 3MB, making room for approx 8 big 64K
888 * fragments 8x128k.
889 */
890 net->ipv4.frags.high_thresh = 4 * 1024 * 1024;
891 net->ipv4.frags.low_thresh = 3 * 1024 * 1024;
892 /*
893 * Important NOTE! Fragment queue must be destroyed before MSL expires.
894 * RFC791 is wrong proposing to prolongate timer each fragment arrival
895 * by TTL.
896 */
897 net->ipv4.frags.timeout = IP_FRAG_TIME;
898
899 net->ipv4.frags.max_dist = 64;
900 net->ipv4.frags.f = &ip4_frags;
901
902 res = inet_frags_init_net(&net->ipv4.frags);
903 if (res < 0)
904 return res;
905 res = ip4_frags_ns_ctl_register(net);
906 if (res < 0)
907 inet_frags_exit_net(&net->ipv4.frags);
908 return res;
909 }
910
ipv4_frags_exit_net(struct net * net)911 static void __net_exit ipv4_frags_exit_net(struct net *net)
912 {
913 ip4_frags_ns_ctl_unregister(net);
914 inet_frags_exit_net(&net->ipv4.frags);
915 }
916
917 static struct pernet_operations ip4_frags_ops = {
918 .init = ipv4_frags_init_net,
919 .exit = ipv4_frags_exit_net,
920 };
921
922
ip4_key_hashfn(const void * data,u32 len,u32 seed)923 static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed)
924 {
925 return jhash2(data,
926 sizeof(struct frag_v4_compare_key) / sizeof(u32), seed);
927 }
928
ip4_obj_hashfn(const void * data,u32 len,u32 seed)929 static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed)
930 {
931 const struct inet_frag_queue *fq = data;
932
933 return jhash2((const u32 *)&fq->key.v4,
934 sizeof(struct frag_v4_compare_key) / sizeof(u32), seed);
935 }
936
ip4_obj_cmpfn(struct rhashtable_compare_arg * arg,const void * ptr)937 static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr)
938 {
939 const struct frag_v4_compare_key *key = arg->key;
940 const struct inet_frag_queue *fq = ptr;
941
942 return !!memcmp(&fq->key, key, sizeof(*key));
943 }
944
945 static const struct rhashtable_params ip4_rhash_params = {
946 .head_offset = offsetof(struct inet_frag_queue, node),
947 .key_offset = offsetof(struct inet_frag_queue, key),
948 .key_len = sizeof(struct frag_v4_compare_key),
949 .hashfn = ip4_key_hashfn,
950 .obj_hashfn = ip4_obj_hashfn,
951 .obj_cmpfn = ip4_obj_cmpfn,
952 .automatic_shrinking = true,
953 };
954
ipfrag_init(void)955 void __init ipfrag_init(void)
956 {
957 ip4_frags.constructor = ip4_frag_init;
958 ip4_frags.destructor = ip4_frag_free;
959 ip4_frags.qsize = sizeof(struct ipq);
960 ip4_frags.frag_expire = ip_expire;
961 ip4_frags.frags_cache_name = ip_frag_cache_name;
962 ip4_frags.rhash_params = ip4_rhash_params;
963 if (inet_frags_init(&ip4_frags))
964 panic("IP: failed to allocate ip4_frags cache\n");
965 ip4_frags_ctl_register();
966 register_pernet_subsys(&ip4_frags_ops);
967 }
968
