ip_reass.c revision 1.13.2.3
1 /* $NetBSD: ip_reass.c,v 1.13.2.3 2018/05/21 04:36:16 pgoyette Exp $ */ 2 3 /* 4 * Copyright (c) 1982, 1986, 1988, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 32 */ 33 34 /* 35 * IP reassembly. 36 * 37 * Additive-Increase/Multiplicative-Decrease (AIMD) strategy for IP 38 * reassembly queue buffer managment. 39 * 40 * We keep a count of total IP fragments (NB: not fragmented packets), 41 * awaiting reassembly (ip_nfrags) and a limit (ip_maxfrags) on fragments. 42 * If ip_nfrags exceeds ip_maxfrags the limit, we drop half the total 43 * fragments in reassembly queues. This AIMD policy avoids repeatedly 44 * deleting single packets under heavy fragmentation load (e.g., from lossy 45 * NFS peers). 46 */ 47 48 #include <sys/cdefs.h> 49 __KERNEL_RCSID(0, "$NetBSD: ip_reass.c,v 1.13.2.3 2018/05/21 04:36:16 pgoyette Exp $"); 50 51 #include <sys/param.h> 52 #include <sys/types.h> 53 54 #include <sys/malloc.h> 55 #include <sys/mbuf.h> 56 #include <sys/mutex.h> 57 #include <sys/pool.h> 58 #include <sys/queue.h> 59 #include <sys/sysctl.h> 60 #include <sys/systm.h> 61 62 #include <net/if.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/in_pcb.h> 68 #include <netinet/ip_var.h> 69 #include <netinet/ip_private.h> 70 #include <netinet/in_var.h> 71 72 /* 73 * IP reassembly queue structures. Each fragment being reassembled is 74 * attached to one of these structures. They are timed out after TTL 75 * drops to 0, and may also be reclaimed if memory becomes tight. 76 */ 77 78 typedef struct ipfr_qent { 79 TAILQ_ENTRY(ipfr_qent) ipqe_q; 80 struct ip * ipqe_ip; 81 struct mbuf * ipqe_m; 82 bool ipqe_mff; 83 } ipfr_qent_t; 84 85 TAILQ_HEAD(ipfr_qent_head, ipfr_qent); 86 87 typedef struct ipfr_queue { 88 LIST_ENTRY(ipfr_queue) ipq_q; /* to other reass headers */ 89 struct ipfr_qent_head ipq_fragq; /* queue of fragment entries */ 90 uint8_t ipq_ttl; /* time for reass q to live */ 91 uint8_t ipq_p; /* protocol of this fragment */ 92 uint16_t ipq_id; /* sequence id for reassembly */ 93 struct in_addr ipq_src; 94 struct in_addr ipq_dst; 95 uint16_t ipq_nfrags; /* frags in this queue entry */ 96 uint8_t ipq_tos; /* TOS of this fragment */ 97 int ipq_ipsec; /* IPsec flags */ 98 } ipfr_queue_t; 99 100 /* 101 * Hash table of IP reassembly queues. 102 */ 103 #define IPREASS_HASH_SHIFT 6 104 #define IPREASS_HASH_SIZE (1 << IPREASS_HASH_SHIFT) 105 #define IPREASS_HASH_MASK (IPREASS_HASH_SIZE - 1) 106 #define IPREASS_HASH(x, y) \ 107 (((((x) & 0xf) | ((((x) >> 8) & 0xf) << 4)) ^ (y)) & IPREASS_HASH_MASK) 108 109 static LIST_HEAD(, ipfr_queue) ip_frags[IPREASS_HASH_SIZE]; 110 static pool_cache_t ipfren_cache; 111 static kmutex_t ipfr_lock; 112 113 /* Number of packets in reassembly queue and total number of fragments. */ 114 static int ip_nfragpackets; 115 static int ip_nfrags; 116 117 /* Limits on packet and fragments. */ 118 static int ip_maxfragpackets; 119 static int ip_maxfrags; 120 121 /* 122 * Cached copy of nmbclusters. If nbclusters is different, recalculate 123 * IP parameters derived from nmbclusters. 124 */ 125 static int ip_nmbclusters; 126 127 /* 128 * IP reassembly TTL machinery for multiplicative drop. 129 */ 130 static u_int fragttl_histo[IPFRAGTTL + 1]; 131 132 static struct sysctllog *ip_reass_sysctllog; 133 134 void sysctl_ip_reass_setup(void); 135 static void ip_nmbclusters_changed(void); 136 137 static struct mbuf * ip_reass(ipfr_qent_t *, ipfr_queue_t *, u_int); 138 static u_int ip_reass_ttl_decr(u_int ticks); 139 static void ip_reass_drophalf(void); 140 static void ip_freef(ipfr_queue_t *); 141 142 /* 143 * ip_reass_init: 144 * 145 * Initialization of IP reassembly mechanism. 146 */ 147 void 148 ip_reass_init(void) 149 { 150 int i; 151 152 ipfren_cache = pool_cache_init(sizeof(ipfr_qent_t), coherency_unit, 153 0, 0, "ipfrenpl", NULL, IPL_NET, NULL, NULL, NULL); 154 mutex_init(&ipfr_lock, MUTEX_DEFAULT, IPL_VM); 155 156 for (i = 0; i < IPREASS_HASH_SIZE; i++) { 157 LIST_INIT(&ip_frags[i]); 158 } 159 ip_maxfragpackets = 200; 160 ip_maxfrags = 0; 161 ip_nmbclusters_changed(); 162 163 sysctl_ip_reass_setup(); 164 } 165 166 void 167 sysctl_ip_reass_setup(void) 168 { 169 170 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL, 171 CTLFLAG_PERMANENT, 172 CTLTYPE_NODE, "inet", 173 SYSCTL_DESCR("PF_INET related settings"), 174 NULL, 0, NULL, 0, 175 CTL_NET, PF_INET, CTL_EOL); 176 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL, 177 CTLFLAG_PERMANENT, 178 CTLTYPE_NODE, "ip", 179 SYSCTL_DESCR("IPv4 related settings"), 180 NULL, 0, NULL, 0, 181 CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL); 182 183 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL, 184 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 185 CTLTYPE_INT, "maxfragpackets", 186 SYSCTL_DESCR("Maximum number of fragments to retain for " 187 "possible reassembly"), 188 NULL, 0, &ip_maxfragpackets, 0, 189 CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MAXFRAGPACKETS, CTL_EOL); 190 } 191 192 #define CHECK_NMBCLUSTER_PARAMS() \ 193 do { \ 194 if (__predict_false(ip_nmbclusters != nmbclusters)) \ 195 ip_nmbclusters_changed(); \ 196 } while (/*CONSTCOND*/0) 197 198 /* 199 * Compute IP limits derived from the value of nmbclusters. 200 */ 201 static void 202 ip_nmbclusters_changed(void) 203 { 204 ip_maxfrags = nmbclusters / 4; 205 ip_nmbclusters = nmbclusters; 206 } 207 208 /* 209 * ip_reass: 210 * 211 * Take incoming datagram fragment and try to reassemble it into whole 212 * datagram. If a chain for reassembly of this datagram already exists, 213 * then it is given as 'fp'; otherwise have to make a chain. 214 */ 215 static struct mbuf * 216 ip_reass(ipfr_qent_t *ipqe, ipfr_queue_t *fp, const u_int hash) 217 { 218 struct ip *ip = ipqe->ipqe_ip, *qip; 219 const int hlen = ip->ip_hl << 2; 220 struct mbuf *m = ipqe->ipqe_m, *t; 221 int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR); 222 ipfr_qent_t *nq, *p, *q; 223 int i, next; 224 225 KASSERT(mutex_owned(&ipfr_lock)); 226 227 /* 228 * Presence of header sizes in mbufs would confuse code below. 229 */ 230 m->m_data += hlen; 231 m->m_len -= hlen; 232 233 #ifdef notyet 234 /* Make sure fragment limit is up-to-date. */ 235 CHECK_NMBCLUSTER_PARAMS(); 236 237 /* If we have too many fragments, drop the older half. */ 238 if (ip_nfrags >= ip_maxfrags) { 239 ip_reass_drophalf(void); 240 } 241 #endif 242 243 /* 244 * We are about to add a fragment; increment frag count. 245 */ 246 ip_nfrags++; 247 248 /* 249 * If first fragment to arrive, create a reassembly queue. 250 */ 251 if (fp == NULL) { 252 /* 253 * Enforce upper bound on number of fragmented packets 254 * for which we attempt reassembly: a) if maxfrag is 0, 255 * never accept fragments b) if maxfrag is -1, accept 256 * all fragments without limitation. 257 */ 258 if (ip_maxfragpackets < 0) 259 ; 260 else if (ip_nfragpackets >= ip_maxfragpackets) { 261 goto dropfrag; 262 } 263 fp = malloc(sizeof(ipfr_queue_t), M_FTABLE, M_NOWAIT); 264 if (fp == NULL) { 265 goto dropfrag; 266 } 267 ip_nfragpackets++; 268 TAILQ_INIT(&fp->ipq_fragq); 269 fp->ipq_nfrags = 1; 270 fp->ipq_ttl = IPFRAGTTL; 271 fp->ipq_p = ip->ip_p; 272 fp->ipq_id = ip->ip_id; 273 fp->ipq_tos = ip->ip_tos; 274 fp->ipq_ipsec = ipsecflags; 275 fp->ipq_src = ip->ip_src; 276 fp->ipq_dst = ip->ip_dst; 277 LIST_INSERT_HEAD(&ip_frags[hash], fp, ipq_q); 278 p = NULL; 279 goto insert; 280 } else { 281 fp->ipq_nfrags++; 282 } 283 284 /* 285 * Find a segment which begins after this one does. 286 */ 287 TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) { 288 if (ntohs(q->ipqe_ip->ip_off) > ntohs(ip->ip_off)) 289 break; 290 } 291 if (q != NULL) { 292 p = TAILQ_PREV(q, ipfr_qent_head, ipqe_q); 293 } else { 294 p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head); 295 } 296 297 /* 298 * If there is a preceding segment, it may provide some of our 299 * data already. If so, drop the data from the incoming segment. 300 * If it provides all of our data, drop us. 301 */ 302 if (p != NULL) { 303 i = ntohs(p->ipqe_ip->ip_off) + ntohs(p->ipqe_ip->ip_len) - 304 ntohs(ip->ip_off); 305 if (i > 0) { 306 if (i >= ntohs(ip->ip_len)) { 307 goto dropfrag; 308 } 309 m_adj(ipqe->ipqe_m, i); 310 ip->ip_off = htons(ntohs(ip->ip_off) + i); 311 ip->ip_len = htons(ntohs(ip->ip_len) - i); 312 } 313 } 314 315 /* 316 * While we overlap succeeding segments trim them or, if they are 317 * completely covered, dequeue them. 318 */ 319 while (q != NULL) { 320 size_t end; 321 322 qip = q->ipqe_ip; 323 end = ntohs(ip->ip_off) + ntohs(ip->ip_len); 324 if (end <= ntohs(qip->ip_off)) { 325 break; 326 } 327 i = end - ntohs(qip->ip_off); 328 if (i < ntohs(qip->ip_len)) { 329 qip->ip_len = htons(ntohs(qip->ip_len) - i); 330 qip->ip_off = htons(ntohs(qip->ip_off) + i); 331 m_adj(q->ipqe_m, i); 332 break; 333 } 334 nq = TAILQ_NEXT(q, ipqe_q); 335 m_freem(q->ipqe_m); 336 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q); 337 pool_cache_put(ipfren_cache, q); 338 fp->ipq_nfrags--; 339 ip_nfrags--; 340 q = nq; 341 } 342 343 insert: 344 /* 345 * Stick new segment in its place; check for complete reassembly. 346 */ 347 if (p == NULL) { 348 TAILQ_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q); 349 } else { 350 TAILQ_INSERT_AFTER(&fp->ipq_fragq, p, ipqe, ipqe_q); 351 } 352 next = 0; 353 TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) { 354 qip = q->ipqe_ip; 355 if (ntohs(qip->ip_off) != next) { 356 mutex_exit(&ipfr_lock); 357 return NULL; 358 } 359 next += ntohs(qip->ip_len); 360 } 361 p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head); 362 if (p->ipqe_mff) { 363 mutex_exit(&ipfr_lock); 364 return NULL; 365 } 366 367 /* 368 * Reassembly is complete. Check for a bogus message size. 369 */ 370 q = TAILQ_FIRST(&fp->ipq_fragq); 371 ip = q->ipqe_ip; 372 if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) { 373 IP_STATINC(IP_STAT_TOOLONG); 374 ip_freef(fp); 375 mutex_exit(&ipfr_lock); 376 return NULL; 377 } 378 LIST_REMOVE(fp, ipq_q); 379 ip_nfrags -= fp->ipq_nfrags; 380 ip_nfragpackets--; 381 mutex_exit(&ipfr_lock); 382 383 /* Concatenate all fragments. */ 384 m = q->ipqe_m; 385 t = m->m_next; 386 m->m_next = NULL; 387 m_cat(m, t); 388 nq = TAILQ_NEXT(q, ipqe_q); 389 pool_cache_put(ipfren_cache, q); 390 391 for (q = nq; q != NULL; q = nq) { 392 t = q->ipqe_m; 393 nq = TAILQ_NEXT(q, ipqe_q); 394 pool_cache_put(ipfren_cache, q); 395 m_remove_pkthdr(t); 396 m_cat(m, t); 397 } 398 399 /* 400 * Create header for new packet by modifying header of first 401 * packet. Dequeue and discard fragment reassembly header. Make 402 * header visible. 403 */ 404 ip->ip_len = htons((ip->ip_hl << 2) + next); 405 ip->ip_src = fp->ipq_src; 406 ip->ip_dst = fp->ipq_dst; 407 free(fp, M_FTABLE); 408 409 m->m_len += (ip->ip_hl << 2); 410 m->m_data -= (ip->ip_hl << 2); 411 412 /* Fix up mbuf. XXX This should be done elsewhere. */ 413 { 414 KASSERT(m->m_flags & M_PKTHDR); 415 int plen = 0; 416 for (t = m; t; t = t->m_next) { 417 plen += t->m_len; 418 } 419 m->m_pkthdr.len = plen; 420 m->m_pkthdr.csum_flags = 0; 421 } 422 return m; 423 424 dropfrag: 425 if (fp != NULL) { 426 fp->ipq_nfrags--; 427 } 428 ip_nfrags--; 429 IP_STATINC(IP_STAT_FRAGDROPPED); 430 mutex_exit(&ipfr_lock); 431 432 pool_cache_put(ipfren_cache, ipqe); 433 m_freem(m); 434 return NULL; 435 } 436 437 /* 438 * ip_freef: 439 * 440 * Free a fragment reassembly header and all associated datagrams. 441 */ 442 static void 443 ip_freef(ipfr_queue_t *fp) 444 { 445 ipfr_qent_t *q; 446 447 KASSERT(mutex_owned(&ipfr_lock)); 448 449 LIST_REMOVE(fp, ipq_q); 450 ip_nfrags -= fp->ipq_nfrags; 451 ip_nfragpackets--; 452 453 while ((q = TAILQ_FIRST(&fp->ipq_fragq)) != NULL) { 454 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q); 455 m_freem(q->ipqe_m); 456 pool_cache_put(ipfren_cache, q); 457 } 458 free(fp, M_FTABLE); 459 } 460 461 /* 462 * ip_reass_ttl_decr: 463 * 464 * Decrement TTL of all reasembly queue entries by `ticks'. Count 465 * number of distinct fragments (as opposed to partial, fragmented 466 * datagrams) inthe reassembly queue. While we traverse the entire 467 * reassembly queue, compute and return the median TTL over all 468 * fragments. 469 */ 470 static u_int 471 ip_reass_ttl_decr(u_int ticks) 472 { 473 u_int nfrags, median, dropfraction, keepfraction; 474 ipfr_queue_t *fp, *nfp; 475 int i; 476 477 nfrags = 0; 478 memset(fragttl_histo, 0, sizeof(fragttl_histo)); 479 480 for (i = 0; i < IPREASS_HASH_SIZE; i++) { 481 for (fp = LIST_FIRST(&ip_frags[i]); fp != NULL; fp = nfp) { 482 fp->ipq_ttl = ((fp->ipq_ttl <= ticks) ? 483 0 : fp->ipq_ttl - ticks); 484 nfp = LIST_NEXT(fp, ipq_q); 485 if (fp->ipq_ttl == 0) { 486 IP_STATINC(IP_STAT_FRAGTIMEOUT); 487 ip_freef(fp); 488 } else { 489 nfrags += fp->ipq_nfrags; 490 fragttl_histo[fp->ipq_ttl] += fp->ipq_nfrags; 491 } 492 } 493 } 494 495 KASSERT(ip_nfrags == nfrags); 496 497 /* Find median (or other drop fraction) in histogram. */ 498 dropfraction = (ip_nfrags / 2); 499 keepfraction = ip_nfrags - dropfraction; 500 for (i = IPFRAGTTL, median = 0; i >= 0; i--) { 501 median += fragttl_histo[i]; 502 if (median >= keepfraction) 503 break; 504 } 505 506 /* Return TTL of median (or other fraction). */ 507 return (u_int)i; 508 } 509 510 static void 511 ip_reass_drophalf(void) 512 { 513 u_int median_ticks; 514 515 KASSERT(mutex_owned(&ipfr_lock)); 516 517 /* 518 * Compute median TTL of all fragments, and count frags 519 * with that TTL or lower (roughly half of all fragments). 520 */ 521 median_ticks = ip_reass_ttl_decr(0); 522 523 /* Drop half. */ 524 median_ticks = ip_reass_ttl_decr(median_ticks); 525 } 526 527 /* 528 * ip_reass_drain: drain off all datagram fragments. Do not acquire 529 * softnet_lock as can be called from hardware interrupt context. 530 */ 531 void 532 ip_reass_drain(void) 533 { 534 535 /* 536 * We may be called from a device's interrupt context. If 537 * the ipq is already busy, just bail out now. 538 */ 539 if (mutex_tryenter(&ipfr_lock)) { 540 /* 541 * Drop half the total fragments now. If more mbufs are 542 * needed, we will be called again soon. 543 */ 544 ip_reass_drophalf(); 545 mutex_exit(&ipfr_lock); 546 } 547 } 548 549 /* 550 * ip_reass_slowtimo: 551 * 552 * If a timer expires on a reassembly queue, discard it. 553 */ 554 void 555 ip_reass_slowtimo(void) 556 { 557 static u_int dropscanidx = 0; 558 u_int i, median_ttl; 559 560 mutex_enter(&ipfr_lock); 561 562 /* Age TTL of all fragments by 1 tick .*/ 563 median_ttl = ip_reass_ttl_decr(1); 564 565 /* Make sure fragment limit is up-to-date. */ 566 CHECK_NMBCLUSTER_PARAMS(); 567 568 /* If we have too many fragments, drop the older half. */ 569 if (ip_nfrags > ip_maxfrags) { 570 ip_reass_ttl_decr(median_ttl); 571 } 572 573 /* 574 * If we are over the maximum number of fragmented packets (due to 575 * the limit being lowered), drain off enough to get down to the 576 * new limit. Start draining from the reassembly hashqueue most 577 * recently drained. 578 */ 579 if (ip_maxfragpackets < 0) 580 ; 581 else { 582 int wrapped = 0; 583 584 i = dropscanidx; 585 while (ip_nfragpackets > ip_maxfragpackets && wrapped == 0) { 586 while (LIST_FIRST(&ip_frags[i]) != NULL) { 587 ip_freef(LIST_FIRST(&ip_frags[i])); 588 } 589 if (++i >= IPREASS_HASH_SIZE) { 590 i = 0; 591 } 592 /* 593 * Do not scan forever even if fragment counters are 594 * wrong: stop after scanning entire reassembly queue. 595 */ 596 if (i == dropscanidx) { 597 wrapped = 1; 598 } 599 } 600 dropscanidx = i; 601 } 602 mutex_exit(&ipfr_lock); 603 } 604 605 /* 606 * ip_reass_packet: generic routine to perform IP reassembly. 607 * 608 * => Passed fragment should have IP_MF flag and/or offset set. 609 * => Fragment should not have other than IP_MF flags set. 610 * 611 * => Returns 0 on success or error otherwise. 612 * => On complete, m0 represents a constructed final packet. 613 */ 614 int 615 ip_reass_packet(struct mbuf **m0, struct ip *ip) 616 { 617 const int hlen = ip->ip_hl << 2; 618 const int len = ntohs(ip->ip_len); 619 struct mbuf *m = *m0; 620 int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR); 621 ipfr_queue_t *fp; 622 ipfr_qent_t *ipqe; 623 u_int hash, off, flen; 624 bool mff; 625 626 /* 627 * Prevent TCP blind data attacks by not allowing non-initial 628 * fragments to start at less than 68 bytes (minimal fragment 629 * size) and making sure the first fragment is at least 68 630 * bytes. 631 */ 632 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 633 if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { 634 IP_STATINC(IP_STAT_BADFRAGS); 635 return EINVAL; 636 } 637 638 if (off + len > IP_MAXPACKET) { 639 IP_STATINC(IP_STAT_TOOLONG); 640 return EINVAL; 641 } 642 643 /* 644 * Fragment length and MF flag. Make sure that fragments have 645 * a data length which is non-zero and multiple of 8 bytes. 646 */ 647 flen = ntohs(ip->ip_len) - hlen; 648 mff = (ip->ip_off & htons(IP_MF)) != 0; 649 if (mff && (flen == 0 || (flen & 0x7) != 0)) { 650 IP_STATINC(IP_STAT_BADFRAGS); 651 return EINVAL; 652 } 653 654 /* 655 * Adjust total IP length to not reflect header and convert 656 * offset of this to bytes. XXX: clobbers struct ip. 657 */ 658 ip->ip_len = htons(flen); 659 ip->ip_off = htons(off); 660 661 /* Look for queue of fragments of this datagram. */ 662 mutex_enter(&ipfr_lock); 663 hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id); 664 LIST_FOREACH(fp, &ip_frags[hash], ipq_q) { 665 if (ip->ip_id != fp->ipq_id) 666 continue; 667 if (!in_hosteq(ip->ip_src, fp->ipq_src)) 668 continue; 669 if (!in_hosteq(ip->ip_dst, fp->ipq_dst)) 670 continue; 671 if (ip->ip_p != fp->ipq_p) 672 continue; 673 break; 674 } 675 676 if (fp) { 677 /* All fragments must have the same IPsec flags. */ 678 if (fp->ipq_ipsec != ipsecflags) { 679 IP_STATINC(IP_STAT_BADFRAGS); 680 mutex_exit(&ipfr_lock); 681 return EINVAL; 682 } 683 684 /* Make sure that TOS matches previous fragments. */ 685 if (fp->ipq_tos != ip->ip_tos) { 686 IP_STATINC(IP_STAT_BADFRAGS); 687 mutex_exit(&ipfr_lock); 688 return EINVAL; 689 } 690 } 691 692 /* 693 * Create new entry and attempt to reassembly. 694 */ 695 IP_STATINC(IP_STAT_FRAGMENTS); 696 ipqe = pool_cache_get(ipfren_cache, PR_NOWAIT); 697 if (ipqe == NULL) { 698 IP_STATINC(IP_STAT_RCVMEMDROP); 699 mutex_exit(&ipfr_lock); 700 return ENOMEM; 701 } 702 ipqe->ipqe_mff = mff; 703 ipqe->ipqe_m = m; 704 ipqe->ipqe_ip = ip; 705 706 *m0 = ip_reass(ipqe, fp, hash); 707 if (*m0) { 708 /* Note that finally reassembled. */ 709 IP_STATINC(IP_STAT_REASSEMBLED); 710 } 711 return 0; 712 } 713
Indexes created Wed Oct 22 13:09:56 GMT 2025