1 /* $NetBSD: ip_reass.c,v 1.23 2022/05/31 08:43:16 andvar Exp $ */ 2 3 /* 4 * Copyright (c) 1982, 1986, 1988, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 32 */ 33 34 /* 35 * IP reassembly. 36 * 37 * Additive-Increase/Multiplicative-Decrease (AIMD) strategy for IP 38 * reassembly queue buffer management. 39 * 40 * We keep a count of total IP fragments (NB: not fragmented packets), 41 * awaiting reassembly (ip_nfrags) and a limit (ip_maxfrags) on fragments. 42 * If ip_nfrags exceeds ip_maxfrags the limit, we drop half the total 43 * fragments in reassembly queues. This AIMD policy avoids repeatedly 44 * deleting single packets under heavy fragmentation load (e.g., from lossy 45 * NFS peers). 46 */ 47 48 #include <sys/cdefs.h> 49 __KERNEL_RCSID(0, "$NetBSD: ip_reass.c,v 1.23 2022/05/31 08:43:16 andvar Exp $"); 50 51 #include <sys/param.h> 52 #include <sys/types.h> 53 54 #include <sys/malloc.h> 55 #include <sys/mbuf.h> 56 #include <sys/mutex.h> 57 #include <sys/pool.h> 58 #include <sys/queue.h> 59 #include <sys/sysctl.h> 60 #include <sys/systm.h> 61 62 #include <net/if.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/in_pcb.h> 68 #include <netinet/ip_var.h> 69 #include <netinet/ip_private.h> 70 #include <netinet/in_var.h> 71 72 /* 73 * IP reassembly queue structures. Each fragment being reassembled is 74 * attached to one of these structures. They are timed out after TTL 75 * drops to 0, and may also be reclaimed if memory becomes tight. 76 */ 77 78 typedef struct ipfr_qent { 79 TAILQ_ENTRY(ipfr_qent) ipqe_q; 80 struct ip * ipqe_ip; 81 struct mbuf * ipqe_m; 82 bool ipqe_mff; 83 uint16_t ipqe_off; 84 uint16_t ipqe_len; 85 } ipfr_qent_t; 86 87 TAILQ_HEAD(ipfr_qent_head, ipfr_qent); 88 89 typedef struct ipfr_queue { 90 LIST_ENTRY(ipfr_queue) ipq_q; /* to other reass headers */ 91 struct ipfr_qent_head ipq_fragq; /* queue of fragment entries */ 92 uint8_t ipq_ttl; /* time for reass q to live */ 93 uint8_t ipq_p; /* protocol of this fragment */ 94 uint16_t ipq_id; /* sequence id for reassembly */ 95 struct in_addr ipq_src; 96 struct in_addr ipq_dst; 97 uint16_t ipq_nfrags; /* frags in this queue entry */ 98 uint8_t ipq_tos; /* TOS of this fragment */ 99 int ipq_ipsec; /* IPsec flags */ 100 } ipfr_queue_t; 101 102 /* 103 * Hash table of IP reassembly queues. 104 */ 105 #define IPREASS_HASH_SHIFT 6 106 #define IPREASS_HASH_SIZE (1 << IPREASS_HASH_SHIFT) 107 #define IPREASS_HASH_MASK (IPREASS_HASH_SIZE - 1) 108 #define IPREASS_HASH(x, y) \ 109 (((((x) & 0xf) | ((((x) >> 8) & 0xf) << 4)) ^ (y)) & IPREASS_HASH_MASK) 110 111 static LIST_HEAD(, ipfr_queue) ip_frags[IPREASS_HASH_SIZE]; 112 static pool_cache_t ipfren_cache; 113 static kmutex_t ipfr_lock; 114 115 /* Number of packets in reassembly queue and total number of fragments. */ 116 static int ip_nfragpackets; 117 static int ip_nfrags; 118 119 /* Limits on packet and fragments. */ 120 static int ip_maxfragpackets; 121 static int ip_maxfrags; 122 123 /* 124 * Cached copy of nmbclusters. If nbclusters is different, recalculate 125 * IP parameters derived from nmbclusters. 126 */ 127 static int ip_nmbclusters; 128 129 /* 130 * IP reassembly TTL machinery for multiplicative drop. 131 */ 132 static u_int fragttl_histo[IPFRAGTTL + 1]; 133 134 static struct sysctllog *ip_reass_sysctllog; 135 136 void sysctl_ip_reass_setup(void); 137 static void ip_nmbclusters_changed(void); 138 139 static struct mbuf * ip_reass(ipfr_qent_t *, ipfr_queue_t *, u_int); 140 static u_int ip_reass_ttl_decr(u_int ticks); 141 static void ip_reass_drophalf(void); 142 static void ip_freef(ipfr_queue_t *); 143 144 /* 145 * ip_reass_init: 146 * 147 * Initialization of IP reassembly mechanism. 148 */ 149 void 150 ip_reass_init(void) 151 { 152 int i; 153 154 ipfren_cache = pool_cache_init(sizeof(ipfr_qent_t), coherency_unit, 155 0, 0, "ipfrenpl", NULL, IPL_NET, NULL, NULL, NULL); 156 mutex_init(&ipfr_lock, MUTEX_DEFAULT, IPL_VM); 157 158 for (i = 0; i < IPREASS_HASH_SIZE; i++) { 159 LIST_INIT(&ip_frags[i]); 160 } 161 ip_maxfragpackets = 200; 162 ip_maxfrags = 0; 163 ip_nmbclusters_changed(); 164 165 sysctl_ip_reass_setup(); 166 } 167 168 void 169 sysctl_ip_reass_setup(void) 170 { 171 172 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL, 173 CTLFLAG_PERMANENT, 174 CTLTYPE_NODE, "inet", 175 SYSCTL_DESCR("PF_INET related settings"), 176 NULL, 0, NULL, 0, 177 CTL_NET, PF_INET, CTL_EOL); 178 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL, 179 CTLFLAG_PERMANENT, 180 CTLTYPE_NODE, "ip", 181 SYSCTL_DESCR("IPv4 related settings"), 182 NULL, 0, NULL, 0, 183 CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL); 184 185 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL, 186 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 187 CTLTYPE_INT, "maxfragpackets", 188 SYSCTL_DESCR("Maximum number of fragments to retain for " 189 "possible reassembly"), 190 NULL, 0, &ip_maxfragpackets, 0, 191 CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MAXFRAGPACKETS, CTL_EOL); 192 } 193 194 #define CHECK_NMBCLUSTER_PARAMS() \ 195 do { \ 196 if (__predict_false(ip_nmbclusters != nmbclusters)) \ 197 ip_nmbclusters_changed(); \ 198 } while (/*CONSTCOND*/0) 199 200 /* 201 * Compute IP limits derived from the value of nmbclusters. 202 */ 203 static void 204 ip_nmbclusters_changed(void) 205 { 206 ip_maxfrags = nmbclusters / 4; 207 ip_nmbclusters = nmbclusters; 208 } 209 210 /* 211 * ip_reass: 212 * 213 * Take incoming datagram fragment and try to reassemble it into whole 214 * datagram. If a chain for reassembly of this datagram already exists, 215 * then it is given as 'fp'; otherwise have to make a chain. 216 */ 217 static struct mbuf * 218 ip_reass(ipfr_qent_t *ipqe, ipfr_queue_t *fp, const u_int hash) 219 { 220 struct ip *ip = ipqe->ipqe_ip; 221 const int hlen = ip->ip_hl << 2; 222 struct mbuf *m = ipqe->ipqe_m, *t; 223 int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR); 224 ipfr_qent_t *nq, *p, *q; 225 int i, next; 226 227 KASSERT(mutex_owned(&ipfr_lock)); 228 229 /* 230 * Presence of header sizes in mbufs would confuse code below. 231 */ 232 m->m_data += hlen; 233 m->m_len -= hlen; 234 235 /* 236 * We are about to add a fragment; increment frag count. 237 */ 238 ip_nfrags++; 239 240 /* 241 * If first fragment to arrive, create a reassembly queue. 242 */ 243 if (fp == NULL) { 244 /* 245 * Enforce upper bound on number of fragmented packets 246 * for which we attempt reassembly: a) if maxfrag is 0, 247 * never accept fragments b) if maxfrag is -1, accept 248 * all fragments without limitation. 249 */ 250 if (ip_maxfragpackets < 0) { 251 /* no limit */ 252 } else if (ip_nfragpackets >= ip_maxfragpackets) { 253 goto dropfrag; 254 } 255 fp = malloc(sizeof(ipfr_queue_t), M_FTABLE, M_NOWAIT); 256 if (fp == NULL) { 257 goto dropfrag; 258 } 259 ip_nfragpackets++; 260 TAILQ_INIT(&fp->ipq_fragq); 261 fp->ipq_nfrags = 1; 262 fp->ipq_ttl = IPFRAGTTL; 263 fp->ipq_p = ip->ip_p; 264 fp->ipq_id = ip->ip_id; 265 fp->ipq_tos = ip->ip_tos; 266 fp->ipq_ipsec = ipsecflags; 267 fp->ipq_src = ip->ip_src; 268 fp->ipq_dst = ip->ip_dst; 269 LIST_INSERT_HEAD(&ip_frags[hash], fp, ipq_q); 270 p = NULL; 271 goto insert; 272 } else { 273 fp->ipq_nfrags++; 274 } 275 276 /* 277 * Find a segment which begins after this one does. 278 */ 279 TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) { 280 if (q->ipqe_off > ipqe->ipqe_off) 281 break; 282 } 283 if (q != NULL) { 284 p = TAILQ_PREV(q, ipfr_qent_head, ipqe_q); 285 } else { 286 p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head); 287 } 288 289 /* 290 * Look at the preceding segment. 291 * 292 * If it provides some of our data already, in part or entirely, trim 293 * us or drop us. 294 * 295 * If a preceding segment exists, and was marked as the last segment, 296 * drop us. 297 */ 298 if (p != NULL) { 299 i = p->ipqe_off + p->ipqe_len - ipqe->ipqe_off; 300 if (i > 0) { 301 if (i >= ipqe->ipqe_len) { 302 goto dropfrag; 303 } 304 m_adj(ipqe->ipqe_m, i); 305 ipqe->ipqe_off = ipqe->ipqe_off + i; 306 ipqe->ipqe_len = ipqe->ipqe_len - i; 307 } 308 } 309 if (p != NULL && !p->ipqe_mff) { 310 goto dropfrag; 311 } 312 313 /* 314 * Look at the segments that follow. 315 * 316 * If we cover them, in part or entirely, trim them or dequeue them. 317 * 318 * If a following segment exists, and we are marked as the last 319 * segment, drop us. 320 */ 321 while (q != NULL) { 322 i = ipqe->ipqe_off + ipqe->ipqe_len - q->ipqe_off; 323 if (i <= 0) { 324 break; 325 } 326 if (i < q->ipqe_len) { 327 q->ipqe_off = q->ipqe_off + i; 328 q->ipqe_len = q->ipqe_len - i; 329 m_adj(q->ipqe_m, i); 330 break; 331 } 332 nq = TAILQ_NEXT(q, ipqe_q); 333 m_freem(q->ipqe_m); 334 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q); 335 pool_cache_put(ipfren_cache, q); 336 fp->ipq_nfrags--; 337 ip_nfrags--; 338 q = nq; 339 } 340 if (q != NULL && !ipqe->ipqe_mff) { 341 goto dropfrag; 342 } 343 344 insert: 345 /* 346 * Stick new segment in its place; check for complete reassembly. 347 */ 348 if (p == NULL) { 349 TAILQ_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q); 350 } else { 351 TAILQ_INSERT_AFTER(&fp->ipq_fragq, p, ipqe, ipqe_q); 352 } 353 next = 0; 354 TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) { 355 if (q->ipqe_off != next) { 356 mutex_exit(&ipfr_lock); 357 return NULL; 358 } 359 next += q->ipqe_len; 360 } 361 p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head); 362 if (p->ipqe_mff) { 363 mutex_exit(&ipfr_lock); 364 return NULL; 365 } 366 367 /* 368 * Reassembly is complete. Check for a bogus message size. 369 */ 370 q = TAILQ_FIRST(&fp->ipq_fragq); 371 ip = q->ipqe_ip; 372 if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) { 373 IP_STATINC(IP_STAT_TOOLONG); 374 ip_freef(fp); 375 mutex_exit(&ipfr_lock); 376 return NULL; 377 } 378 LIST_REMOVE(fp, ipq_q); 379 ip_nfrags -= fp->ipq_nfrags; 380 ip_nfragpackets--; 381 mutex_exit(&ipfr_lock); 382 383 /* Concatenate all fragments. */ 384 m = q->ipqe_m; 385 t = m->m_next; 386 m->m_next = NULL; 387 m_cat(m, t); 388 nq = TAILQ_NEXT(q, ipqe_q); 389 pool_cache_put(ipfren_cache, q); 390 391 for (q = nq; q != NULL; q = nq) { 392 t = q->ipqe_m; 393 nq = TAILQ_NEXT(q, ipqe_q); 394 pool_cache_put(ipfren_cache, q); 395 m_remove_pkthdr(t); 396 m_cat(m, t); 397 } 398 399 /* 400 * Create header for new packet by modifying header of first 401 * packet. Dequeue and discard fragment reassembly header. Make 402 * header visible. 403 */ 404 ip->ip_len = htons((ip->ip_hl << 2) + next); 405 ip->ip_off = htons(0); 406 ip->ip_src = fp->ipq_src; 407 ip->ip_dst = fp->ipq_dst; 408 free(fp, M_FTABLE); 409 410 m->m_len += (ip->ip_hl << 2); 411 m->m_data -= (ip->ip_hl << 2); 412 413 /* Fix up mbuf. XXX This should be done elsewhere. */ 414 { 415 KASSERT(m->m_flags & M_PKTHDR); 416 int plen = 0; 417 for (t = m; t; t = t->m_next) { 418 plen += t->m_len; 419 } 420 m->m_pkthdr.len = plen; 421 m->m_pkthdr.csum_flags = 0; 422 } 423 return m; 424 425 dropfrag: 426 if (fp != NULL) { 427 fp->ipq_nfrags--; 428 } 429 ip_nfrags--; 430 IP_STATINC(IP_STAT_FRAGDROPPED); 431 mutex_exit(&ipfr_lock); 432 433 pool_cache_put(ipfren_cache, ipqe); 434 m_freem(m); 435 return NULL; 436 } 437 438 /* 439 * ip_freef: 440 * 441 * Free a fragment reassembly header and all associated datagrams. 442 */ 443 static void 444 ip_freef(ipfr_queue_t *fp) 445 { 446 ipfr_qent_t *q; 447 448 KASSERT(mutex_owned(&ipfr_lock)); 449 450 LIST_REMOVE(fp, ipq_q); 451 ip_nfrags -= fp->ipq_nfrags; 452 ip_nfragpackets--; 453 454 while ((q = TAILQ_FIRST(&fp->ipq_fragq)) != NULL) { 455 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q); 456 m_freem(q->ipqe_m); 457 pool_cache_put(ipfren_cache, q); 458 } 459 free(fp, M_FTABLE); 460 } 461 462 /* 463 * ip_reass_ttl_decr: 464 * 465 * Decrement TTL of all reasembly queue entries by `ticks'. Count 466 * number of distinct fragments (as opposed to partial, fragmented 467 * datagrams) in the reassembly queue. While we traverse the entire 468 * reassembly queue, compute and return the median TTL over all 469 * fragments. 470 */ 471 static u_int 472 ip_reass_ttl_decr(u_int ticks) 473 { 474 u_int nfrags, median, dropfraction, keepfraction; 475 ipfr_queue_t *fp, *nfp; 476 int i; 477 478 nfrags = 0; 479 memset(fragttl_histo, 0, sizeof(fragttl_histo)); 480 481 for (i = 0; i < IPREASS_HASH_SIZE; i++) { 482 for (fp = LIST_FIRST(&ip_frags[i]); fp != NULL; fp = nfp) { 483 fp->ipq_ttl = ((fp->ipq_ttl <= ticks) ? 484 0 : fp->ipq_ttl - ticks); 485 nfp = LIST_NEXT(fp, ipq_q); 486 if (fp->ipq_ttl == 0) { 487 IP_STATINC(IP_STAT_FRAGTIMEOUT); 488 ip_freef(fp); 489 } else { 490 nfrags += fp->ipq_nfrags; 491 fragttl_histo[fp->ipq_ttl] += fp->ipq_nfrags; 492 } 493 } 494 } 495 496 KASSERT(ip_nfrags == nfrags); 497 498 /* Find median (or other drop fraction) in histogram. */ 499 dropfraction = (ip_nfrags / 2); 500 keepfraction = ip_nfrags - dropfraction; 501 for (i = IPFRAGTTL, median = 0; i >= 0; i--) { 502 median += fragttl_histo[i]; 503 if (median >= keepfraction) 504 break; 505 } 506 507 /* Return TTL of median (or other fraction). */ 508 return (u_int)i; 509 } 510 511 static void 512 ip_reass_drophalf(void) 513 { 514 u_int median_ticks; 515 516 KASSERT(mutex_owned(&ipfr_lock)); 517 518 /* 519 * Compute median TTL of all fragments, and count frags 520 * with that TTL or lower (roughly half of all fragments). 521 */ 522 median_ticks = ip_reass_ttl_decr(0); 523 524 /* Drop half. */ 525 median_ticks = ip_reass_ttl_decr(median_ticks); 526 } 527 528 /* 529 * ip_reass_drain: drain off all datagram fragments. Do not acquire 530 * softnet_lock as can be called from hardware interrupt context. 531 */ 532 void 533 ip_reass_drain(void) 534 { 535 536 /* 537 * We may be called from a device's interrupt context. If 538 * the ipq is already busy, just bail out now. 539 */ 540 if (mutex_tryenter(&ipfr_lock)) { 541 /* 542 * Drop half the total fragments now. If more mbufs are 543 * needed, we will be called again soon. 544 */ 545 ip_reass_drophalf(); 546 mutex_exit(&ipfr_lock); 547 } 548 } 549 550 /* 551 * ip_reass_slowtimo: 552 * 553 * If a timer expires on a reassembly queue, discard it. 554 */ 555 void 556 ip_reass_slowtimo(void) 557 { 558 static u_int dropscanidx = 0; 559 u_int i, median_ttl; 560 561 mutex_enter(&ipfr_lock); 562 563 /* Age TTL of all fragments by 1 tick .*/ 564 median_ttl = ip_reass_ttl_decr(1); 565 566 /* Make sure fragment limit is up-to-date. */ 567 CHECK_NMBCLUSTER_PARAMS(); 568 569 /* If we have too many fragments, drop the older half. */ 570 if (ip_nfrags > ip_maxfrags) { 571 ip_reass_ttl_decr(median_ttl); 572 } 573 574 /* 575 * If we are over the maximum number of fragmented packets (due to 576 * the limit being lowered), drain off enough to get down to the 577 * new limit. Start draining from the reassembly hashqueue most 578 * recently drained. 579 */ 580 if (ip_maxfragpackets < 0) 581 ; 582 else { 583 int wrapped = 0; 584 585 i = dropscanidx; 586 while (ip_nfragpackets > ip_maxfragpackets && wrapped == 0) { 587 while (LIST_FIRST(&ip_frags[i]) != NULL) { 588 ip_freef(LIST_FIRST(&ip_frags[i])); 589 } 590 if (++i >= IPREASS_HASH_SIZE) { 591 i = 0; 592 } 593 /* 594 * Do not scan forever even if fragment counters are 595 * wrong: stop after scanning entire reassembly queue. 596 */ 597 if (i == dropscanidx) { 598 wrapped = 1; 599 } 600 } 601 dropscanidx = i; 602 } 603 mutex_exit(&ipfr_lock); 604 } 605 606 /* 607 * ip_reass_packet: generic routine to perform IP reassembly. 608 * 609 * => Passed fragment should have IP_MF flag and/or offset set. 610 * => Fragment should not have other than IP_MF flags set. 611 * 612 * => Returns 0 on success or error otherwise. 613 * => On complete, m0 represents a constructed final packet. 614 */ 615 int 616 ip_reass_packet(struct mbuf **m0) 617 { 618 struct mbuf *m = *m0; 619 struct ip *ip = mtod(m, struct ip *); 620 const int hlen = ip->ip_hl << 2; 621 const int len = ntohs(ip->ip_len); 622 int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR); 623 ipfr_queue_t *fp; 624 ipfr_qent_t *ipqe; 625 u_int hash, off, flen; 626 bool mff; 627 628 /* 629 * Prevent TCP blind data attacks by not allowing non-initial 630 * fragments to start at less than 68 bytes (minimal fragment 631 * size) and making sure the first fragment is at least 68 632 * bytes. 633 */ 634 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 635 if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { 636 IP_STATINC(IP_STAT_BADFRAGS); 637 return EINVAL; 638 } 639 640 if (off + len > IP_MAXPACKET) { 641 IP_STATINC(IP_STAT_TOOLONG); 642 return EINVAL; 643 } 644 645 /* 646 * Fragment length and MF flag. Make sure that fragments have 647 * a data length which is non-zero and multiple of 8 bytes. 648 */ 649 flen = ntohs(ip->ip_len) - hlen; 650 mff = (ip->ip_off & htons(IP_MF)) != 0; 651 if (mff && (flen == 0 || (flen & 0x7) != 0)) { 652 IP_STATINC(IP_STAT_BADFRAGS); 653 return EINVAL; 654 } 655 656 /* Look for queue of fragments of this datagram. */ 657 mutex_enter(&ipfr_lock); 658 hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id); 659 LIST_FOREACH(fp, &ip_frags[hash], ipq_q) { 660 if (ip->ip_id != fp->ipq_id) 661 continue; 662 if (!in_hosteq(ip->ip_src, fp->ipq_src)) 663 continue; 664 if (!in_hosteq(ip->ip_dst, fp->ipq_dst)) 665 continue; 666 if (ip->ip_p != fp->ipq_p) 667 continue; 668 break; 669 } 670 671 if (fp) { 672 /* All fragments must have the same IPsec flags. */ 673 if (fp->ipq_ipsec != ipsecflags) { 674 IP_STATINC(IP_STAT_BADFRAGS); 675 mutex_exit(&ipfr_lock); 676 return EINVAL; 677 } 678 679 /* Make sure that TOS matches previous fragments. */ 680 if (fp->ipq_tos != ip->ip_tos) { 681 IP_STATINC(IP_STAT_BADFRAGS); 682 mutex_exit(&ipfr_lock); 683 return EINVAL; 684 } 685 } 686 687 /* 688 * Create new entry and attempt to reassembly. 689 */ 690 IP_STATINC(IP_STAT_FRAGMENTS); 691 ipqe = pool_cache_get(ipfren_cache, PR_NOWAIT); 692 if (ipqe == NULL) { 693 IP_STATINC(IP_STAT_RCVMEMDROP); 694 mutex_exit(&ipfr_lock); 695 return ENOMEM; 696 } 697 ipqe->ipqe_mff = mff; 698 ipqe->ipqe_m = m; 699 ipqe->ipqe_ip = ip; 700 ipqe->ipqe_off = off; 701 ipqe->ipqe_len = flen; 702 703 *m0 = ip_reass(ipqe, fp, hash); 704 if (*m0) { 705 /* Note that finally reassembled. */ 706 IP_STATINC(IP_STAT_REASSEMBLED); 707 } 708 return 0; 709 } 710
Indexes created Sat Sep 20 22:09:52 GMT 2025