xref: /dragonfly/sys/netinet6/frag6.c (revision 896f2e3a) 
1 /*	$FreeBSD: src/sys/netinet6/frag6.c,v 1.2.2.6 2002/04/28 05:40:26 suz Exp $	*/
2 /*	$KAME: frag6.c,v 1.33 2002/01/07 11:34:48 kjc Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/mbuf.h>
37 #include <sys/domain.h>
38 #include <sys/protosw.h>
39 #include <sys/socket.h>
40 #include <sys/errno.h>
41 #include <sys/time.h>
42 #include <sys/kernel.h>
43 #include <sys/syslog.h>
44 #include <sys/thread2.h>
45 
46 #include <net/if.h>
47 #include <net/route.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/in_var.h>
51 #include <netinet/ip6.h>
52 #include <netinet6/ip6_var.h>
53 #include <netinet/icmp6.h>
54 
55 #include <net/net_osdep.h>
56 
57 /*
58  * Define it to get a correct behavior on per-interface statistics.
59  * You will need to perform an extra routing table lookup, per fragment,
60  * to do it.  This may, or may not be, a performance hit.
61  */
62 #define IN6_IFSTAT_STRICT
63 
64 static void frag6_enq (struct ip6asfrag *, struct ip6asfrag *);
65 static void frag6_deq (struct ip6asfrag *);
66 static void frag6_insque (struct ip6q *, struct ip6q *);
67 static void frag6_remque (struct ip6q *);
68 static void frag6_freef (struct ip6q *);
69 
70 /* XXX we eventually need splreass6, or some real semaphore */
71 int frag6_doing_reass;
72 u_int frag6_nfragpackets;
73 struct	ip6q ip6q;	/* ip6 reassemble queue */
74 
75 /* FreeBSD tweak */
76 MALLOC_DEFINE(M_FTABLE, "fragment", "fragment reassembly header");
77 
78 /*
79  * Initialise reassembly queue and fragment identifier.
80  */
81 void
82 frag6_init(void)
83 {
84 	struct timeval tv;
85 
86 	ip6_maxfragpackets = nmbclusters / 4;
87 
88 	/*
89 	 * in many cases, random() here does NOT return random number
90 	 * as initialization during bootstrap time occur in fixed order.
91 	 */
92 	microtime(&tv);
93 	ip6_id = krandom() ^ tv.tv_usec;
94 	ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q;
95 }
96 
97 /*
98  * In RFC2460, fragment and reassembly rule do not agree with each other,
99  * in terms of next header field handling in fragment header.
100  * While the sender will use the same value for all of the fragmented packets,
101  * receiver is suggested not to check the consistency.
102  *
103  * fragment rule (p20):
104  *	(2) A Fragment header containing:
105  *	The Next Header value that identifies the first header of
106  *	the Fragmentable Part of the original packet.
107  *		-> next header field is same for all fragments
108  *
109  * reassembly rule (p21):
110  *	The Next Header field of the last header of the Unfragmentable
111  *	Part is obtained from the Next Header field of the first
112  *	fragment's Fragment header.
113  *		-> should grab it from the first fragment only
114  *
115  * The following note also contradicts with fragment rule - noone is going to
116  * send different fragment with different next header field.
117  *
118  * additional note (p22):
119  *	The Next Header values in the Fragment headers of different
120  *	fragments of the same original packet may differ.  Only the value
121  *	from the Offset zero fragment packet is used for reassembly.
122  *		-> should grab it from the first fragment only
123  *
124  * There is no explicit reason given in the RFC.  Historical reason maybe?
125  */
126 /*
127  * Fragment input
128  */
129 int
130 frag6_input(struct mbuf **mp, int *offp, int proto)
131 {
132 	struct mbuf *m = *mp, *t;
133 	struct ip6_hdr *ip6;
134 	struct ip6_frag *ip6f;
135 	struct ip6q *q6;
136 	struct ip6asfrag *af6, *ip6af, *af6dwn;
137 	int offset = *offp, nxt, i, next;
138 	int first_frag = 0;
139 	int fragoff, frgpartlen;	/* must be larger than u_int16_t */
140 	struct ifnet *dstifp;
141 #ifdef IN6_IFSTAT_STRICT
142 	static struct route_in6 ro;
143 	struct sockaddr_in6 *dst;
144 #endif
145 
146 	ip6 = mtod(m, struct ip6_hdr *);
147 #ifndef PULLDOWN_TEST
148 	IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), IPPROTO_DONE);
149 	ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset);
150 #else
151 	IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f));
152 	if (ip6f == NULL)
153 		return IPPROTO_DONE;
154 #endif
155 
156 	dstifp = NULL;
157 #ifdef IN6_IFSTAT_STRICT
158 	/* find the destination interface of the packet. */
159 	dst = (struct sockaddr_in6 *)&ro.ro_dst;
160 	if (ro.ro_rt &&
161 	    (!(ro.ro_rt->rt_flags & RTF_UP) ||
162 	     !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
163 		rtfree(ro.ro_rt);
164 		ro.ro_rt = NULL;
165 	}
166 	if (ro.ro_rt == NULL) {
167 		bzero(dst, sizeof(*dst));
168 		dst->sin6_family = AF_INET6;
169 		dst->sin6_len = sizeof(struct sockaddr_in6);
170 		dst->sin6_addr = ip6->ip6_dst;
171 	}
172 	rtalloc((struct route *)&ro);
173 	if (ro.ro_rt != NULL && ro.ro_rt->rt_ifa != NULL)
174 		dstifp = ((struct in6_ifaddr *)ro.ro_rt->rt_ifa)->ia_ifp;
175 #else
176 	/* we are violating the spec, this is not the destination interface */
177 	if (m->m_flags & M_PKTHDR)
178 		dstifp = m->m_pkthdr.rcvif;
179 #endif
180 
181 	/* jumbo payload can't contain a fragment header */
182 	if (ip6->ip6_plen == 0) {
183 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
184 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
185 		return IPPROTO_DONE;
186 	}
187 
188 	/*
189 	 * check whether fragment packet's fragment length is
190 	 * multiple of 8 octets.
191 	 * sizeof(struct ip6_frag) == 8
192 	 * sizeof(struct ip6_hdr) = 40
193 	 */
194 	if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
195 	    (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
196 		icmp6_error(m, ICMP6_PARAM_PROB,
197 			    ICMP6_PARAMPROB_HEADER,
198 			    offsetof(struct ip6_hdr, ip6_plen));
199 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
200 		return IPPROTO_DONE;
201 	}
202 
203 	ip6stat.ip6s_fragments++;
204 	in6_ifstat_inc(dstifp, ifs6_reass_reqd);
205 
206 	/* offset now points to data portion */
207 	offset += sizeof(struct ip6_frag);
208 
209 	frag6_doing_reass = 1;
210 
211 	for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next)
212 		if (ip6f->ip6f_ident == q6->ip6q_ident &&
213 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) &&
214 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst))
215 			break;
216 
217 	if (q6 == &ip6q) {
218 		/*
219 		 * the first fragment to arrive, create a reassembly queue.
220 		 */
221 		first_frag = 1;
222 
223 		/*
224 		 * Enforce upper bound on number of fragmented packets
225 		 * for which we attempt reassembly;
226 		 * If maxfrag is 0, never accept fragments.
227 		 * If maxfrag is -1, accept all fragments without limitation.
228 		 */
229 		if (ip6_maxfragpackets < 0)
230 			;
231 		else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets)
232 			goto dropfrag;
233 		frag6_nfragpackets++;
234 		q6 = (struct ip6q *)kmalloc(sizeof(struct ip6q), M_FTABLE,
235 			M_NOWAIT | M_ZERO);
236 		if (q6 == NULL)
237 			goto dropfrag;
238 
239 		frag6_insque(q6, &ip6q);
240 
241 		/* ip6q_nxt will be filled afterwards, from 1st fragment */
242 		q6->ip6q_down	= q6->ip6q_up = (struct ip6asfrag *)q6;
243 #ifdef notyet
244 		q6->ip6q_nxtp	= (u_char *)nxtp;
245 #endif
246 		q6->ip6q_ident	= ip6f->ip6f_ident;
247 		q6->ip6q_arrive = 0; /* Is it used anywhere? */
248 		q6->ip6q_ttl 	= IPV6_FRAGTTL;
249 		q6->ip6q_src	= ip6->ip6_src;
250 		q6->ip6q_dst	= ip6->ip6_dst;
251 		q6->ip6q_unfrglen = -1;	/* The 1st fragment has not arrived. */
252 	}
253 
254 	/*
255 	 * If it's the 1st fragment, record the length of the
256 	 * unfragmentable part and the next header of the fragment header.
257 	 */
258 	fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
259 	if (fragoff == 0) {
260 		q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr)
261 			- sizeof(struct ip6_frag);
262 		q6->ip6q_nxt = ip6f->ip6f_nxt;
263 	}
264 
265 	/*
266 	 * Check that the reassembled packet would not exceed 65535 bytes
267 	 * in size.
268 	 * If it would exceed, discard the fragment and return an ICMP error.
269 	 */
270 	frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
271 	if (q6->ip6q_unfrglen >= 0) {
272 		/* The 1st fragment has already arrived. */
273 		if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
274 			icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
275 				    offset - sizeof(struct ip6_frag) +
276 					offsetof(struct ip6_frag, ip6f_offlg));
277 			frag6_doing_reass = 0;
278 			return (IPPROTO_DONE);
279 		}
280 	}
281 	else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
282 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
283 			    offset - sizeof(struct ip6_frag) +
284 				offsetof(struct ip6_frag, ip6f_offlg));
285 		frag6_doing_reass = 0;
286 		return (IPPROTO_DONE);
287 	}
288 	/*
289 	 * If it's the first fragment, do the above check for each
290 	 * fragment already stored in the reassembly queue.
291 	 */
292 	if (fragoff == 0) {
293 		for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
294 		     af6 = af6dwn) {
295 			af6dwn = af6->ip6af_down;
296 
297 			if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
298 			    IPV6_MAXPACKET) {
299 				struct mbuf *merr = IP6_REASS_MBUF(af6);
300 				struct ip6_hdr *ip6err;
301 				int erroff = af6->ip6af_offset;
302 
303 				/* dequeue the fragment. */
304 				frag6_deq(af6);
305 				kfree(af6, M_FTABLE);
306 
307 				/* adjust pointer. */
308 				ip6err = mtod(merr, struct ip6_hdr *);
309 
310 				/*
311 				 * Restore source and destination addresses
312 				 * in the erroneous IPv6 header.
313 				 */
314 				ip6err->ip6_src = q6->ip6q_src;
315 				ip6err->ip6_dst = q6->ip6q_dst;
316 
317 				icmp6_error(merr, ICMP6_PARAM_PROB,
318 					    ICMP6_PARAMPROB_HEADER,
319 					    erroff - sizeof(struct ip6_frag) +
320 						offsetof(struct ip6_frag, ip6f_offlg));
321 			}
322 		}
323 	}
324 
325 	ip6af = (struct ip6asfrag *)kmalloc(sizeof(struct ip6asfrag), M_FTABLE,
326 	    M_NOWAIT | M_ZERO);
327 	if (ip6af == NULL)
328 		goto dropfrag;
329 	ip6af->ip6af_head = ip6->ip6_flow;
330 	ip6af->ip6af_len = ip6->ip6_plen;
331 	ip6af->ip6af_nxt = ip6->ip6_nxt;
332 	ip6af->ip6af_hlim = ip6->ip6_hlim;
333 	ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG;
334 	ip6af->ip6af_off = fragoff;
335 	ip6af->ip6af_frglen = frgpartlen;
336 	ip6af->ip6af_offset = offset;
337 	IP6_REASS_MBUF(ip6af) = m;
338 
339 	if (first_frag) {
340 		af6 = (struct ip6asfrag *)q6;
341 		goto insert;
342 	}
343 
344 	/*
345 	 * Find a segment which begins after this one does.
346 	 */
347 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
348 	     af6 = af6->ip6af_down)
349 		if (af6->ip6af_off > ip6af->ip6af_off)
350 			break;
351 
352 	/*
353 	 * RFC 5722: Drop overlapping fragments
354 	 */
355 	if (af6->ip6af_up != (struct ip6asfrag *)q6) {
356 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
357 			- ip6af->ip6af_off;
358 		if (i > 0) {
359 			kfree(ip6af, M_FTABLE);
360 			goto dropfrag;
361 		}
362 	}
363 	if (af6 != (struct ip6asfrag *)q6) {
364 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
365 		if (i > 0) {
366 			kfree(ip6af, M_FTABLE);
367 			goto dropfrag;
368 		}
369 	}
370 
371 insert:
372 
373 	/*
374 	 * Stick new segment in its place;
375 	 * check for complete reassembly.
376 	 * Move to front of packet queue, as we are
377 	 * the most recently active fragmented packet.
378 	 */
379 	frag6_enq(ip6af, af6->ip6af_up);
380 #if 0 /* xxx */
381 	if (q6 != ip6q.ip6q_next) {
382 		frag6_remque(q6);
383 		frag6_insque(q6, &ip6q);
384 	}
385 #endif
386 	next = 0;
387 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
388 	     af6 = af6->ip6af_down) {
389 		if (af6->ip6af_off != next) {
390 			frag6_doing_reass = 0;
391 			return IPPROTO_DONE;
392 		}
393 		next += af6->ip6af_frglen;
394 	}
395 	if (af6->ip6af_up->ip6af_mff) {
396 		frag6_doing_reass = 0;
397 		return IPPROTO_DONE;
398 	}
399 
400 	/*
401 	 * Reassembly is complete; concatenate fragments.
402 	 */
403 	ip6af = q6->ip6q_down;
404 	t = m = IP6_REASS_MBUF(ip6af);
405 	af6 = ip6af->ip6af_down;
406 	frag6_deq(ip6af);
407 	while (af6 != (struct ip6asfrag *)q6) {
408 		af6dwn = af6->ip6af_down;
409 		frag6_deq(af6);
410 		while (t->m_next)
411 			t = t->m_next;
412 		t->m_next = IP6_REASS_MBUF(af6);
413 		m_adj(t->m_next, af6->ip6af_offset);
414 		kfree(af6, M_FTABLE);
415 		af6 = af6dwn;
416 	}
417 
418 	/* adjust offset to point where the original next header starts */
419 	offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
420 	kfree(ip6af, M_FTABLE);
421 	ip6 = mtod(m, struct ip6_hdr *);
422 	ip6->ip6_plen = htons((u_short)next + offset - sizeof(struct ip6_hdr));
423 	ip6->ip6_src = q6->ip6q_src;
424 	ip6->ip6_dst = q6->ip6q_dst;
425 	nxt = q6->ip6q_nxt;
426 #ifdef notyet
427 	*q6->ip6q_nxtp = (u_char)(nxt & 0xff);
428 #endif
429 
430 	/*
431 	 * Delete frag6 header with as a few cost as possible.
432 	 */
433 	if (offset < m->m_len) {
434 		ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag),
435 			offset);
436 		m->m_data += sizeof(struct ip6_frag);
437 		m->m_len -= sizeof(struct ip6_frag);
438 	} else {
439 		/* this comes with no copy if the boundary is on cluster */
440 		if ((t = m_split(m, offset, M_NOWAIT)) == NULL) {
441 			frag6_remque(q6);
442 			kfree(q6, M_FTABLE);
443 			frag6_nfragpackets--;
444 			goto dropfrag;
445 		}
446 		m_adj(t, sizeof(struct ip6_frag));
447 		m_cat(m, t);
448 	}
449 
450 	/*
451 	 * Store NXT to the original.
452 	 */
453 	{
454 		char *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */
455 		*prvnxtp = nxt;
456 	}
457 
458 	frag6_remque(q6);
459 	kfree(q6, M_FTABLE);
460 	frag6_nfragpackets--;
461 
462 	if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */
463 		int plen = 0;
464 		for (t = m; t; t = t->m_next)
465 			plen += t->m_len;
466 		m->m_pkthdr.len = plen;
467 	}
468 
469 	ip6stat.ip6s_reassembled++;
470 	in6_ifstat_inc(dstifp, ifs6_reass_ok);
471 
472 	/*
473 	 * Reassembly complete, return the next protocol.
474 	 * Be sure to clear M_HASH to force the packet
475 	 * to be re-characterized.
476 	 */
477 	m->m_flags &= ~M_HASH;
478 
479 	*mp = m;
480 	*offp = offset;
481 
482 	frag6_doing_reass = 0;
483 	return nxt;
484 
485 dropfrag:
486 	in6_ifstat_inc(dstifp, ifs6_reass_fail);
487 	ip6stat.ip6s_fragdropped++;
488 	m_freem(m);
489 	frag6_doing_reass = 0;
490 	return IPPROTO_DONE;
491 }
492 
493 /*
494  * Free a fragment reassembly header and all
495  * associated datagrams.
496  */
497 void
498 frag6_freef(struct ip6q *q6)
499 {
500 	struct ip6asfrag *af6, *down6;
501 
502 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
503 	     af6 = down6) {
504 		struct mbuf *m = IP6_REASS_MBUF(af6);
505 
506 		down6 = af6->ip6af_down;
507 		frag6_deq(af6);
508 
509 		/*
510 		 * Return ICMP time exceeded error for the 1st fragment.
511 		 * Just free other fragments.
512 		 */
513 		if (af6->ip6af_off == 0) {
514 			struct ip6_hdr *ip6;
515 
516 			/* adjust pointer */
517 			ip6 = mtod(m, struct ip6_hdr *);
518 
519 			/* restoure source and destination addresses */
520 			ip6->ip6_src = q6->ip6q_src;
521 			ip6->ip6_dst = q6->ip6q_dst;
522 
523 			icmp6_error(m, ICMP6_TIME_EXCEEDED,
524 				    ICMP6_TIME_EXCEED_REASSEMBLY, 0);
525 		} else
526 			m_freem(m);
527 		kfree(af6, M_FTABLE);
528 	}
529 	frag6_remque(q6);
530 	kfree(q6, M_FTABLE);
531 	frag6_nfragpackets--;
532 }
533 
534 /*
535  * Put an ip fragment on a reassembly chain.
536  * Like insque, but pointers in middle of structure.
537  */
538 void
539 frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
540 {
541 	af6->ip6af_up = up6;
542 	af6->ip6af_down = up6->ip6af_down;
543 	up6->ip6af_down->ip6af_up = af6;
544 	up6->ip6af_down = af6;
545 }
546 
547 /*
548  * To frag6_enq as remque is to insque.
549  */
550 void
551 frag6_deq(struct ip6asfrag *af6)
552 {
553 	af6->ip6af_up->ip6af_down = af6->ip6af_down;
554 	af6->ip6af_down->ip6af_up = af6->ip6af_up;
555 }
556 
557 void
558 frag6_insque(struct ip6q *new, struct ip6q *old)
559 {
560 	new->ip6q_prev = old;
561 	new->ip6q_next = old->ip6q_next;
562 	old->ip6q_next->ip6q_prev= new;
563 	old->ip6q_next = new;
564 }
565 
566 void
567 frag6_remque(struct ip6q *p6)
568 {
569 	p6->ip6q_prev->ip6q_next = p6->ip6q_next;
570 	p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
571 }
572 
573 /*
574  * IPv6 reassembling timer processing;
575  * if a timer expires on a reassembly
576  * queue, discard it.
577  */
578 void
579 frag6_slowtimo(void)
580 {
581 	struct ip6q *q6;
582 
583 	crit_enter();
584 	frag6_doing_reass = 1;
585 	q6 = ip6q.ip6q_next;
586 	if (q6)
587 		while (q6 != &ip6q) {
588 			--q6->ip6q_ttl;
589 			q6 = q6->ip6q_next;
590 			if (q6->ip6q_prev->ip6q_ttl == 0) {
591 				ip6stat.ip6s_fragtimeout++;
592 				/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
593 				frag6_freef(q6->ip6q_prev);
594 			}
595 		}
596 	/*
597 	 * If we are over the maximum number of fragments
598 	 * (due to the limit being lowered), drain off
599 	 * enough to get down to the new limit.
600 	 */
601 	while (frag6_nfragpackets > (u_int)ip6_maxfragpackets &&
602 	    ip6q.ip6q_prev) {
603 		ip6stat.ip6s_fragoverflow++;
604 		/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
605 		frag6_freef(ip6q.ip6q_prev);
606 	}
607 	frag6_doing_reass = 0;
608 
609 #if 0
610 	/*
611 	 * Routing changes might produce a better route than we last used;
612 	 * make sure we notice eventually, even if forwarding only for one
613 	 * destination and the cache is never replaced.
614 	 */
615 	if (ip6_forward_rt.ro_rt) {
616 		RTFREE(ip6_forward_rt.ro_rt);
617 		ip6_forward_rt.ro_rt = NULL;
618 	}
619 	if (ipsrcchk_rt.ro_rt) {
620 		RTFREE(ipsrcchk_rt.ro_rt);
621 		ipsrcchk_rt.ro_rt = NULL;
622 	}
623 #endif
624 
625 	crit_exit();
626 }
627 
628 /*
629  * Drain off all datagram fragments.
630  */
631 void
632 frag6_drain(void)
633 {
634 	if (frag6_doing_reass)
635 		return;
636 	while (ip6q.ip6q_next != &ip6q) {
637 		ip6stat.ip6s_fragdropped++;
638 		/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
639 		frag6_freef(ip6q.ip6q_next);
640 	}
641 }
642