1 /* $NetBSD: ip_reass.c,v 1.23 2022/05/31 08:43:16 andvar Exp $ */
2
3 /*
4 * Copyright (c) 1982, 1986, 1988, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the University nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
32 */
33
34 /*
35 * IP reassembly.
36 *
37 * Additive-Increase/Multiplicative-Decrease (AIMD) strategy for IP
38 * reassembly queue buffer management.
39 *
40 * We keep a count of total IP fragments (NB: not fragmented packets),
41 * awaiting reassembly (ip_nfrags) and a limit (ip_maxfrags) on fragments.
42 * If ip_nfrags exceeds ip_maxfrags the limit, we drop half the total
43 * fragments in reassembly queues. This AIMD policy avoids repeatedly
44 * deleting single packets under heavy fragmentation load (e.g., from lossy
45 * NFS peers).
46 */
47
48 #include <sys/cdefs.h>
49 __KERNEL_RCSID(0, "$NetBSD: ip_reass.c,v 1.23 2022/05/31 08:43:16 andvar Exp $");
50
51 #include <sys/param.h>
52 #include <sys/types.h>
53
54 #include <sys/malloc.h>
55 #include <sys/mbuf.h>
56 #include <sys/mutex.h>
57 #include <sys/pool.h>
58 #include <sys/queue.h>
59 #include <sys/sysctl.h>
60 #include <sys/systm.h>
61
62 #include <net/if.h>
63
64 #include <netinet/in.h>
65 #include <netinet/in_systm.h>
66 #include <netinet/ip.h>
67 #include <netinet/in_pcb.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/ip_private.h>
70 #include <netinet/in_var.h>
71
72 /*
73 * IP reassembly queue structures. Each fragment being reassembled is
74 * attached to one of these structures. They are timed out after TTL
75 * drops to 0, and may also be reclaimed if memory becomes tight.
76 */
77
78 typedef struct ipfr_qent {
79 TAILQ_ENTRY(ipfr_qent) ipqe_q;
80 struct ip * ipqe_ip;
81 struct mbuf * ipqe_m;
82 bool ipqe_mff;
83 uint16_t ipqe_off;
84 uint16_t ipqe_len;
85 } ipfr_qent_t;
86
87 TAILQ_HEAD(ipfr_qent_head, ipfr_qent);
88
89 typedef struct ipfr_queue {
90 LIST_ENTRY(ipfr_queue) ipq_q; /* to other reass headers */
91 struct ipfr_qent_head ipq_fragq; /* queue of fragment entries */
92 uint8_t ipq_ttl; /* time for reass q to live */
93 uint8_t ipq_p; /* protocol of this fragment */
94 uint16_t ipq_id; /* sequence id for reassembly */
95 struct in_addr ipq_src;
96 struct in_addr ipq_dst;
97 uint16_t ipq_nfrags; /* frags in this queue entry */
98 uint8_t ipq_tos; /* TOS of this fragment */
99 int ipq_ipsec; /* IPsec flags */
100 } ipfr_queue_t;
101
102 /*
103 * Hash table of IP reassembly queues.
104 */
105 #define IPREASS_HASH_SHIFT 6
106 #define IPREASS_HASH_SIZE (1 << IPREASS_HASH_SHIFT)
107 #define IPREASS_HASH_MASK (IPREASS_HASH_SIZE - 1)
108 #define IPREASS_HASH(x, y) \
109 (((((x) & 0xf) | ((((x) >> 8) & 0xf) << 4)) ^ (y)) & IPREASS_HASH_MASK)
110
111 static LIST_HEAD(, ipfr_queue) ip_frags[IPREASS_HASH_SIZE];
112 static pool_cache_t ipfren_cache;
113 static kmutex_t ipfr_lock;
114
115 /* Number of packets in reassembly queue and total number of fragments. */
116 static int ip_nfragpackets;
117 static int ip_nfrags;
118
119 /* Limits on packet and fragments. */
120 static int ip_maxfragpackets;
121 static int ip_maxfrags;
122
123 /*
124 * Cached copy of nmbclusters. If nbclusters is different, recalculate
125 * IP parameters derived from nmbclusters.
126 */
127 static int ip_nmbclusters;
128
129 /*
130 * IP reassembly TTL machinery for multiplicative drop.
131 */
132 static u_int fragttl_histo[IPFRAGTTL + 1];
133
134 static struct sysctllog *ip_reass_sysctllog;
135
136 void sysctl_ip_reass_setup(void);
137 static void ip_nmbclusters_changed(void);
138
139 static struct mbuf * ip_reass(ipfr_qent_t *, ipfr_queue_t *, u_int);
140 static u_int ip_reass_ttl_decr(u_int ticks);
141 static void ip_reass_drophalf(void);
142 static void ip_freef(ipfr_queue_t *);
143
144 /*
145 * ip_reass_init:
146 *
147 * Initialization of IP reassembly mechanism.
148 */
149 void
ip_reass_init(void)150 ip_reass_init(void)
151 {
152 int i;
153
154 ipfren_cache = pool_cache_init(sizeof(ipfr_qent_t), coherency_unit,
155 0, 0, "ipfrenpl", NULL, IPL_NET, NULL, NULL, NULL);
156 mutex_init(&ipfr_lock, MUTEX_DEFAULT, IPL_VM);
157
158 for (i = 0; i < IPREASS_HASH_SIZE; i++) {
159 LIST_INIT(&ip_frags[i]);
160 }
161 ip_maxfragpackets = 200;
162 ip_maxfrags = 0;
163 ip_nmbclusters_changed();
164
165 sysctl_ip_reass_setup();
166 }
167
168 void
sysctl_ip_reass_setup(void)169 sysctl_ip_reass_setup(void)
170 {
171
172 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL,
173 CTLFLAG_PERMANENT,
174 CTLTYPE_NODE, "inet",
175 SYSCTL_DESCR("PF_INET related settings"),
176 NULL, 0, NULL, 0,
177 CTL_NET, PF_INET, CTL_EOL);
178 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL,
179 CTLFLAG_PERMANENT,
180 CTLTYPE_NODE, "ip",
181 SYSCTL_DESCR("IPv4 related settings"),
182 NULL, 0, NULL, 0,
183 CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL);
184
185 sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL,
186 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
187 CTLTYPE_INT, "maxfragpackets",
188 SYSCTL_DESCR("Maximum number of fragments to retain for "
189 "possible reassembly"),
190 NULL, 0, &ip_maxfragpackets, 0,
191 CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MAXFRAGPACKETS, CTL_EOL);
192 }
193
194 #define CHECK_NMBCLUSTER_PARAMS() \
195 do { \
196 if (__predict_false(ip_nmbclusters != nmbclusters)) \
197 ip_nmbclusters_changed(); \
198 } while (/*CONSTCOND*/0)
199
200 /*
201 * Compute IP limits derived from the value of nmbclusters.
202 */
203 static void
ip_nmbclusters_changed(void)204 ip_nmbclusters_changed(void)
205 {
206 ip_maxfrags = nmbclusters / 4;
207 ip_nmbclusters = nmbclusters;
208 }
209
210 /*
211 * ip_reass:
212 *
213 * Take incoming datagram fragment and try to reassemble it into whole
214 * datagram. If a chain for reassembly of this datagram already exists,
215 * then it is given as 'fp'; otherwise have to make a chain.
216 */
217 static struct mbuf *
ip_reass(ipfr_qent_t * ipqe,ipfr_queue_t * fp,const u_int hash)218 ip_reass(ipfr_qent_t *ipqe, ipfr_queue_t *fp, const u_int hash)
219 {
220 struct ip *ip = ipqe->ipqe_ip;
221 const int hlen = ip->ip_hl << 2;
222 struct mbuf *m = ipqe->ipqe_m, *t;
223 int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR);
224 ipfr_qent_t *nq, *p, *q;
225 int i, next;
226
227 KASSERT(mutex_owned(&ipfr_lock));
228
229 /*
230 * Presence of header sizes in mbufs would confuse code below.
231 */
232 m->m_data += hlen;
233 m->m_len -= hlen;
234
235 /*
236 * We are about to add a fragment; increment frag count.
237 */
238 ip_nfrags++;
239
240 /*
241 * If first fragment to arrive, create a reassembly queue.
242 */
243 if (fp == NULL) {
244 /*
245 * Enforce upper bound on number of fragmented packets
246 * for which we attempt reassembly: a) if maxfrag is 0,
247 * never accept fragments b) if maxfrag is -1, accept
248 * all fragments without limitation.
249 */
250 if (ip_maxfragpackets < 0) {
251 /* no limit */
252 } else if (ip_nfragpackets >= ip_maxfragpackets) {
253 goto dropfrag;
254 }
255 fp = malloc(sizeof(ipfr_queue_t), M_FTABLE, M_NOWAIT);
256 if (fp == NULL) {
257 goto dropfrag;
258 }
259 ip_nfragpackets++;
260 TAILQ_INIT(&fp->ipq_fragq);
261 fp->ipq_nfrags = 1;
262 fp->ipq_ttl = IPFRAGTTL;
263 fp->ipq_p = ip->ip_p;
264 fp->ipq_id = ip->ip_id;
265 fp->ipq_tos = ip->ip_tos;
266 fp->ipq_ipsec = ipsecflags;
267 fp->ipq_src = ip->ip_src;
268 fp->ipq_dst = ip->ip_dst;
269 LIST_INSERT_HEAD(&ip_frags[hash], fp, ipq_q);
270 p = NULL;
271 goto insert;
272 } else {
273 fp->ipq_nfrags++;
274 }
275
276 /*
277 * Find a segment which begins after this one does.
278 */
279 TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) {
280 if (q->ipqe_off > ipqe->ipqe_off)
281 break;
282 }
283 if (q != NULL) {
284 p = TAILQ_PREV(q, ipfr_qent_head, ipqe_q);
285 } else {
286 p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head);
287 }
288
289 /*
290 * Look at the preceding segment.
291 *
292 * If it provides some of our data already, in part or entirely, trim
293 * us or drop us.
294 *
295 * If a preceding segment exists, and was marked as the last segment,
296 * drop us.
297 */
298 if (p != NULL) {
299 i = p->ipqe_off + p->ipqe_len - ipqe->ipqe_off;
300 if (i > 0) {
301 if (i >= ipqe->ipqe_len) {
302 goto dropfrag;
303 }
304 m_adj(ipqe->ipqe_m, i);
305 ipqe->ipqe_off = ipqe->ipqe_off + i;
306 ipqe->ipqe_len = ipqe->ipqe_len - i;
307 }
308 }
309 if (p != NULL && !p->ipqe_mff) {
310 goto dropfrag;
311 }
312
313 /*
314 * Look at the segments that follow.
315 *
316 * If we cover them, in part or entirely, trim them or dequeue them.
317 *
318 * If a following segment exists, and we are marked as the last
319 * segment, drop us.
320 */
321 while (q != NULL) {
322 i = ipqe->ipqe_off + ipqe->ipqe_len - q->ipqe_off;
323 if (i <= 0) {
324 break;
325 }
326 if (i < q->ipqe_len) {
327 q->ipqe_off = q->ipqe_off + i;
328 q->ipqe_len = q->ipqe_len - i;
329 m_adj(q->ipqe_m, i);
330 break;
331 }
332 nq = TAILQ_NEXT(q, ipqe_q);
333 m_freem(q->ipqe_m);
334 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q);
335 pool_cache_put(ipfren_cache, q);
336 fp->ipq_nfrags--;
337 ip_nfrags--;
338 q = nq;
339 }
340 if (q != NULL && !ipqe->ipqe_mff) {
341 goto dropfrag;
342 }
343
344 insert:
345 /*
346 * Stick new segment in its place; check for complete reassembly.
347 */
348 if (p == NULL) {
349 TAILQ_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q);
350 } else {
351 TAILQ_INSERT_AFTER(&fp->ipq_fragq, p, ipqe, ipqe_q);
352 }
353 next = 0;
354 TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) {
355 if (q->ipqe_off != next) {
356 mutex_exit(&ipfr_lock);
357 return NULL;
358 }
359 next += q->ipqe_len;
360 }
361 p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head);
362 if (p->ipqe_mff) {
363 mutex_exit(&ipfr_lock);
364 return NULL;
365 }
366
367 /*
368 * Reassembly is complete. Check for a bogus message size.
369 */
370 q = TAILQ_FIRST(&fp->ipq_fragq);
371 ip = q->ipqe_ip;
372 if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) {
373 IP_STATINC(IP_STAT_TOOLONG);
374 ip_freef(fp);
375 mutex_exit(&ipfr_lock);
376 return NULL;
377 }
378 LIST_REMOVE(fp, ipq_q);
379 ip_nfrags -= fp->ipq_nfrags;
380 ip_nfragpackets--;
381 mutex_exit(&ipfr_lock);
382
383 /* Concatenate all fragments. */
384 m = q->ipqe_m;
385 t = m->m_next;
386 m->m_next = NULL;
387 m_cat(m, t);
388 nq = TAILQ_NEXT(q, ipqe_q);
389 pool_cache_put(ipfren_cache, q);
390
391 for (q = nq; q != NULL; q = nq) {
392 t = q->ipqe_m;
393 nq = TAILQ_NEXT(q, ipqe_q);
394 pool_cache_put(ipfren_cache, q);
395 m_remove_pkthdr(t);
396 m_cat(m, t);
397 }
398
399 /*
400 * Create header for new packet by modifying header of first
401 * packet. Dequeue and discard fragment reassembly header. Make
402 * header visible.
403 */
404 ip->ip_len = htons((ip->ip_hl << 2) + next);
405 ip->ip_off = htons(0);
406 ip->ip_src = fp->ipq_src;
407 ip->ip_dst = fp->ipq_dst;
408 free(fp, M_FTABLE);
409
410 m->m_len += (ip->ip_hl << 2);
411 m->m_data -= (ip->ip_hl << 2);
412
413 /* Fix up mbuf. XXX This should be done elsewhere. */
414 {
415 KASSERT(m->m_flags & M_PKTHDR);
416 int plen = 0;
417 for (t = m; t; t = t->m_next) {
418 plen += t->m_len;
419 }
420 m->m_pkthdr.len = plen;
421 m->m_pkthdr.csum_flags = 0;
422 }
423 return m;
424
425 dropfrag:
426 if (fp != NULL) {
427 fp->ipq_nfrags--;
428 }
429 ip_nfrags--;
430 IP_STATINC(IP_STAT_FRAGDROPPED);
431 mutex_exit(&ipfr_lock);
432
433 pool_cache_put(ipfren_cache, ipqe);
434 m_freem(m);
435 return NULL;
436 }
437
438 /*
439 * ip_freef:
440 *
441 * Free a fragment reassembly header and all associated datagrams.
442 */
443 static void
ip_freef(ipfr_queue_t * fp)444 ip_freef(ipfr_queue_t *fp)
445 {
446 ipfr_qent_t *q;
447
448 KASSERT(mutex_owned(&ipfr_lock));
449
450 LIST_REMOVE(fp, ipq_q);
451 ip_nfrags -= fp->ipq_nfrags;
452 ip_nfragpackets--;
453
454 while ((q = TAILQ_FIRST(&fp->ipq_fragq)) != NULL) {
455 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q);
456 m_freem(q->ipqe_m);
457 pool_cache_put(ipfren_cache, q);
458 }
459 free(fp, M_FTABLE);
460 }
461
462 /*
463 * ip_reass_ttl_decr:
464 *
465 * Decrement TTL of all reasembly queue entries by `ticks'. Count
466 * number of distinct fragments (as opposed to partial, fragmented
467 * datagrams) in the reassembly queue. While we traverse the entire
468 * reassembly queue, compute and return the median TTL over all
469 * fragments.
470 */
471 static u_int
ip_reass_ttl_decr(u_int ticks)472 ip_reass_ttl_decr(u_int ticks)
473 {
474 u_int nfrags, median, dropfraction, keepfraction;
475 ipfr_queue_t *fp, *nfp;
476 int i;
477
478 nfrags = 0;
479 memset(fragttl_histo, 0, sizeof(fragttl_histo));
480
481 for (i = 0; i < IPREASS_HASH_SIZE; i++) {
482 for (fp = LIST_FIRST(&ip_frags[i]); fp != NULL; fp = nfp) {
483 fp->ipq_ttl = ((fp->ipq_ttl <= ticks) ?
484 0 : fp->ipq_ttl - ticks);
485 nfp = LIST_NEXT(fp, ipq_q);
486 if (fp->ipq_ttl == 0) {
487 IP_STATINC(IP_STAT_FRAGTIMEOUT);
488 ip_freef(fp);
489 } else {
490 nfrags += fp->ipq_nfrags;
491 fragttl_histo[fp->ipq_ttl] += fp->ipq_nfrags;
492 }
493 }
494 }
495
496 KASSERT(ip_nfrags == nfrags);
497
498 /* Find median (or other drop fraction) in histogram. */
499 dropfraction = (ip_nfrags / 2);
500 keepfraction = ip_nfrags - dropfraction;
501 for (i = IPFRAGTTL, median = 0; i >= 0; i--) {
502 median += fragttl_histo[i];
503 if (median >= keepfraction)
504 break;
505 }
506
507 /* Return TTL of median (or other fraction). */
508 return (u_int)i;
509 }
510
511 static void
ip_reass_drophalf(void)512 ip_reass_drophalf(void)
513 {
514 u_int median_ticks;
515
516 KASSERT(mutex_owned(&ipfr_lock));
517
518 /*
519 * Compute median TTL of all fragments, and count frags
520 * with that TTL or lower (roughly half of all fragments).
521 */
522 median_ticks = ip_reass_ttl_decr(0);
523
524 /* Drop half. */
525 median_ticks = ip_reass_ttl_decr(median_ticks);
526 }
527
528 /*
529 * ip_reass_drain: drain off all datagram fragments. Do not acquire
530 * softnet_lock as can be called from hardware interrupt context.
531 */
532 void
ip_reass_drain(void)533 ip_reass_drain(void)
534 {
535
536 /*
537 * We may be called from a device's interrupt context. If
538 * the ipq is already busy, just bail out now.
539 */
540 if (mutex_tryenter(&ipfr_lock)) {
541 /*
542 * Drop half the total fragments now. If more mbufs are
543 * needed, we will be called again soon.
544 */
545 ip_reass_drophalf();
546 mutex_exit(&ipfr_lock);
547 }
548 }
549
550 /*
551 * ip_reass_slowtimo:
552 *
553 * If a timer expires on a reassembly queue, discard it.
554 */
555 void
ip_reass_slowtimo(void)556 ip_reass_slowtimo(void)
557 {
558 static u_int dropscanidx = 0;
559 u_int i, median_ttl;
560
561 mutex_enter(&ipfr_lock);
562
563 /* Age TTL of all fragments by 1 tick .*/
564 median_ttl = ip_reass_ttl_decr(1);
565
566 /* Make sure fragment limit is up-to-date. */
567 CHECK_NMBCLUSTER_PARAMS();
568
569 /* If we have too many fragments, drop the older half. */
570 if (ip_nfrags > ip_maxfrags) {
571 ip_reass_ttl_decr(median_ttl);
572 }
573
574 /*
575 * If we are over the maximum number of fragmented packets (due to
576 * the limit being lowered), drain off enough to get down to the
577 * new limit. Start draining from the reassembly hashqueue most
578 * recently drained.
579 */
580 if (ip_maxfragpackets < 0)
581 ;
582 else {
583 int wrapped = 0;
584
585 i = dropscanidx;
586 while (ip_nfragpackets > ip_maxfragpackets && wrapped == 0) {
587 while (LIST_FIRST(&ip_frags[i]) != NULL) {
588 ip_freef(LIST_FIRST(&ip_frags[i]));
589 }
590 if (++i >= IPREASS_HASH_SIZE) {
591 i = 0;
592 }
593 /*
594 * Do not scan forever even if fragment counters are
595 * wrong: stop after scanning entire reassembly queue.
596 */
597 if (i == dropscanidx) {
598 wrapped = 1;
599 }
600 }
601 dropscanidx = i;
602 }
603 mutex_exit(&ipfr_lock);
604 }
605
606 /*
607 * ip_reass_packet: generic routine to perform IP reassembly.
608 *
609 * => Passed fragment should have IP_MF flag and/or offset set.
610 * => Fragment should not have other than IP_MF flags set.
611 *
612 * => Returns 0 on success or error otherwise.
613 * => On complete, m0 represents a constructed final packet.
614 */
615 int
ip_reass_packet(struct mbuf ** m0)616 ip_reass_packet(struct mbuf **m0)
617 {
618 struct mbuf *m = *m0;
619 struct ip *ip = mtod(m, struct ip *);
620 const int hlen = ip->ip_hl << 2;
621 const int len = ntohs(ip->ip_len);
622 int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR);
623 ipfr_queue_t *fp;
624 ipfr_qent_t *ipqe;
625 u_int hash, off, flen;
626 bool mff;
627
628 /*
629 * Prevent TCP blind data attacks by not allowing non-initial
630 * fragments to start at less than 68 bytes (minimal fragment
631 * size) and making sure the first fragment is at least 68
632 * bytes.
633 */
634 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
635 if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) {
636 IP_STATINC(IP_STAT_BADFRAGS);
637 return EINVAL;
638 }
639
640 if (off + len > IP_MAXPACKET) {
641 IP_STATINC(IP_STAT_TOOLONG);
642 return EINVAL;
643 }
644
645 /*
646 * Fragment length and MF flag. Make sure that fragments have
647 * a data length which is non-zero and multiple of 8 bytes.
648 */
649 flen = ntohs(ip->ip_len) - hlen;
650 mff = (ip->ip_off & htons(IP_MF)) != 0;
651 if (mff && (flen == 0 || (flen & 0x7) != 0)) {
652 IP_STATINC(IP_STAT_BADFRAGS);
653 return EINVAL;
654 }
655
656 /* Look for queue of fragments of this datagram. */
657 mutex_enter(&ipfr_lock);
658 hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);
659 LIST_FOREACH(fp, &ip_frags[hash], ipq_q) {
660 if (ip->ip_id != fp->ipq_id)
661 continue;
662 if (!in_hosteq(ip->ip_src, fp->ipq_src))
663 continue;
664 if (!in_hosteq(ip->ip_dst, fp->ipq_dst))
665 continue;
666 if (ip->ip_p != fp->ipq_p)
667 continue;
668 break;
669 }
670
671 if (fp) {
672 /* All fragments must have the same IPsec flags. */
673 if (fp->ipq_ipsec != ipsecflags) {
674 IP_STATINC(IP_STAT_BADFRAGS);
675 mutex_exit(&ipfr_lock);
676 return EINVAL;
677 }
678
679 /* Make sure that TOS matches previous fragments. */
680 if (fp->ipq_tos != ip->ip_tos) {
681 IP_STATINC(IP_STAT_BADFRAGS);
682 mutex_exit(&ipfr_lock);
683 return EINVAL;
684 }
685 }
686
687 /*
688 * Create new entry and attempt to reassembly.
689 */
690 IP_STATINC(IP_STAT_FRAGMENTS);
691 ipqe = pool_cache_get(ipfren_cache, PR_NOWAIT);
692 if (ipqe == NULL) {
693 IP_STATINC(IP_STAT_RCVMEMDROP);
694 mutex_exit(&ipfr_lock);
695 return ENOMEM;
696 }
697 ipqe->ipqe_mff = mff;
698 ipqe->ipqe_m = m;
699 ipqe->ipqe_ip = ip;
700 ipqe->ipqe_off = off;
701 ipqe->ipqe_len = flen;
702
703 *m0 = ip_reass(ipqe, fp, hash);
704 if (*m0) {
705 /* Note that finally reassembled. */
706 IP_STATINC(IP_STAT_REASSEMBLED);
707 }
708 return 0;
709 }
710