1caf43b02SWarner Losh /*- 251369649SPedro F. Giffuni * SPDX-License-Identifier: BSD-3-Clause 351369649SPedro F. Giffuni * 482cd038dSYoshinobu Inoue * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 582cd038dSYoshinobu Inoue * All rights reserved. 682cd038dSYoshinobu Inoue * 782cd038dSYoshinobu Inoue * Redistribution and use in source and binary forms, with or without 882cd038dSYoshinobu Inoue * modification, are permitted provided that the following conditions 982cd038dSYoshinobu Inoue * are met: 1082cd038dSYoshinobu Inoue * 1. Redistributions of source code must retain the above copyright 1182cd038dSYoshinobu Inoue * notice, this list of conditions and the following disclaimer. 1282cd038dSYoshinobu Inoue * 2. Redistributions in binary form must reproduce the above copyright 1382cd038dSYoshinobu Inoue * notice, this list of conditions and the following disclaimer in the 1482cd038dSYoshinobu Inoue * documentation and/or other materials provided with the distribution. 1582cd038dSYoshinobu Inoue * 3. Neither the name of the project nor the names of its contributors 1682cd038dSYoshinobu Inoue * may be used to endorse or promote products derived from this software 1782cd038dSYoshinobu Inoue * without specific prior written permission. 1882cd038dSYoshinobu Inoue * 1982cd038dSYoshinobu Inoue * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 2082cd038dSYoshinobu Inoue * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2182cd038dSYoshinobu Inoue * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2282cd038dSYoshinobu Inoue * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 2382cd038dSYoshinobu Inoue * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2482cd038dSYoshinobu Inoue * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2582cd038dSYoshinobu Inoue * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2682cd038dSYoshinobu Inoue * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2782cd038dSYoshinobu Inoue * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2882cd038dSYoshinobu Inoue * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2982cd038dSYoshinobu Inoue * SUCH DAMAGE. 30b48287a3SDavid E. O'Brien * 31b48287a3SDavid E. O'Brien * $KAME: frag6.c,v 1.33 2002/01/07 11:34:48 kjc Exp $ 3282cd038dSYoshinobu Inoue */ 3382cd038dSYoshinobu Inoue 34b48287a3SDavid E. O'Brien #include <sys/cdefs.h> 35b48287a3SDavid E. O'Brien __FBSDID("$FreeBSD$"); 36b48287a3SDavid E. O'Brien 37aaa46574SAdrian Chadd #include "opt_rss.h" 38aaa46574SAdrian Chadd 3982cd038dSYoshinobu Inoue #include <sys/param.h> 40f349c821SBjoern A. Zeeb #include <sys/systm.h> 411a3044faSBjoern A. Zeeb #include <sys/domain.h> 421a3044faSBjoern A. Zeeb #include <sys/eventhandler.h> 4380d7a853SJonathan T. Looney #include <sys/hash.h> 441a3044faSBjoern A. Zeeb #include <sys/kernel.h> 4582cd038dSYoshinobu Inoue #include <sys/malloc.h> 4682cd038dSYoshinobu Inoue #include <sys/mbuf.h> 4782cd038dSYoshinobu Inoue #include <sys/protosw.h> 4882cd038dSYoshinobu Inoue #include <sys/socket.h> 49757cb678SBjoern A. Zeeb #include <sys/sysctl.h> 5082cd038dSYoshinobu Inoue #include <sys/syslog.h> 5182cd038dSYoshinobu Inoue 5282cd038dSYoshinobu Inoue #include <net/if.h> 5376039bc8SGleb Smirnoff #include <net/if_var.h> 54aaa46574SAdrian Chadd #include <net/netisr.h> 5582cd038dSYoshinobu Inoue #include <net/route.h> 56eddfbb76SRobert Watson #include <net/vnet.h> 5782cd038dSYoshinobu Inoue 5882cd038dSYoshinobu Inoue #include <netinet/in.h> 5982cd038dSYoshinobu Inoue #include <netinet/in_var.h> 60686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h> 6182cd038dSYoshinobu Inoue #include <netinet6/ip6_var.h> 62686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp6.h> 6323d374aaSBjoern A. Zeeb #include <netinet/in_systm.h> /* For ECN definitions. */ 6423d374aaSBjoern A. Zeeb #include <netinet/ip.h> /* For ECN definitions. */ 6582cd038dSYoshinobu Inoue 661a3044faSBjoern A. Zeeb #ifdef MAC 674b908c8bSRobert Watson #include <security/mac/mac_framework.h> 681a3044faSBjoern A. Zeeb #endif 694b908c8bSRobert Watson 7023d374aaSBjoern A. Zeeb /* Reassembly headers are stored in hash buckets. */ 712ceeacbeSJonathan T. Looney #define IP6REASS_NHASH_LOG2 10 7280d7a853SJonathan T. Looney #define IP6REASS_NHASH (1 << IP6REASS_NHASH_LOG2) 7380d7a853SJonathan T. Looney #define IP6REASS_HMASK (IP6REASS_NHASH - 1) 7480d7a853SJonathan T. Looney 7580d7a853SJonathan T. Looney static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *, 7680d7a853SJonathan T. Looney uint32_t bucket __unused); 7780d7a853SJonathan T. Looney static void frag6_deq(struct ip6asfrag *, uint32_t bucket __unused); 7880d7a853SJonathan T. Looney static void frag6_insque_head(struct ip6q *, struct ip6q *, 791e9f3b73SJonathan T. Looney uint32_t bucket); 801e9f3b73SJonathan T. Looney static void frag6_remque(struct ip6q *, uint32_t bucket); 816bbdbbb8SHans Petter Selasky static void frag6_freef(struct ip6q *, uint32_t bucket); 8280d7a853SJonathan T. Looney 8380d7a853SJonathan T. Looney struct ip6qbucket { 8480d7a853SJonathan T. Looney struct ip6q ip6q; 8580d7a853SJonathan T. Looney struct mtx lock; 861e9f3b73SJonathan T. Looney int count; 8780d7a853SJonathan T. Looney }; 8880d7a853SJonathan T. Looney 891540a98eSBjoern A. Zeeb struct ip6asfrag { 901540a98eSBjoern A. Zeeb struct ip6asfrag *ip6af_down; 911540a98eSBjoern A. Zeeb struct ip6asfrag *ip6af_up; 921540a98eSBjoern A. Zeeb struct mbuf *ip6af_m; 931540a98eSBjoern A. Zeeb int ip6af_offset; /* offset in ip6af_m to next header */ 941540a98eSBjoern A. Zeeb int ip6af_frglen; /* fragmentable part length */ 951540a98eSBjoern A. Zeeb int ip6af_off; /* fragment offset */ 961540a98eSBjoern A. Zeeb u_int16_t ip6af_mff; /* more fragment bit in frag off */ 971540a98eSBjoern A. Zeeb }; 981540a98eSBjoern A. Zeeb 991540a98eSBjoern A. Zeeb #define IP6_REASS_MBUF(ip6af) (*(struct mbuf **)&((ip6af)->ip6af_m)) 1001540a98eSBjoern A. Zeeb 101487a161cSBjoern A. Zeeb static MALLOC_DEFINE(M_FRAG6, "frag6", "IPv6 fragment reassembly header"); 102487a161cSBjoern A. Zeeb 10367a10c46SBjoern A. Zeeb #ifdef VIMAGE 10467a10c46SBjoern A. Zeeb /* A flag to indicate if IPv6 fragmentation is initialized. */ 10567a10c46SBjoern A. Zeeb VNET_DEFINE_STATIC(bool, frag6_on); 10667a10c46SBjoern A. Zeeb #define V_frag6_on VNET(frag6_on) 10767a10c46SBjoern A. Zeeb #endif 10867a10c46SBjoern A. Zeeb 109757cb678SBjoern A. Zeeb /* System wide (global) maximum and count of packets in reassembly queues. */ 110757cb678SBjoern A. Zeeb static int ip6_maxfrags; 111757cb678SBjoern A. Zeeb static volatile u_int frag6_nfrags = 0; 112757cb678SBjoern A. Zeeb 113757cb678SBjoern A. Zeeb /* Maximum and current packets in per-VNET reassembly queue. */ 114757cb678SBjoern A. Zeeb VNET_DEFINE_STATIC(int, ip6_maxfragpackets); 11580d7a853SJonathan T. Looney VNET_DEFINE_STATIC(volatile u_int, frag6_nfragpackets); 116757cb678SBjoern A. Zeeb #define V_ip6_maxfragpackets VNET(ip6_maxfragpackets) 117757cb678SBjoern A. Zeeb #define V_frag6_nfragpackets VNET(frag6_nfragpackets) 118757cb678SBjoern A. Zeeb 119757cb678SBjoern A. Zeeb /* Maximum per-VNET reassembly queues per bucket and fragments per packet. */ 120757cb678SBjoern A. Zeeb VNET_DEFINE_STATIC(int, ip6_maxfragbucketsize); 121757cb678SBjoern A. Zeeb VNET_DEFINE_STATIC(int, ip6_maxfragsperpacket); 122757cb678SBjoern A. Zeeb #define V_ip6_maxfragbucketsize VNET(ip6_maxfragbucketsize) 123757cb678SBjoern A. Zeeb #define V_ip6_maxfragsperpacket VNET(ip6_maxfragsperpacket) 124757cb678SBjoern A. Zeeb 125757cb678SBjoern A. Zeeb /* Per-VNET reassembly queue buckets. */ 1269cb1a47aSBjoern A. Zeeb VNET_DEFINE_STATIC(struct ip6qbucket, ip6qb[IP6REASS_NHASH]); 1279cb1a47aSBjoern A. Zeeb VNET_DEFINE_STATIC(uint32_t, ip6qb_hashseed); 1289cb1a47aSBjoern A. Zeeb #define V_ip6qb VNET(ip6qb) 1299cb1a47aSBjoern A. Zeeb #define V_ip6qb_hashseed VNET(ip6qb_hashseed) 13082cd038dSYoshinobu Inoue 1319cb1a47aSBjoern A. Zeeb #define IP6QB_LOCK(_b) mtx_lock(&V_ip6qb[(_b)].lock) 1329cb1a47aSBjoern A. Zeeb #define IP6QB_TRYLOCK(_b) mtx_trylock(&V_ip6qb[(_b)].lock) 1339cb1a47aSBjoern A. Zeeb #define IP6QB_LOCK_ASSERT(_b) mtx_assert(&V_ip6qb[(_b)].lock, MA_OWNED) 1349cb1a47aSBjoern A. Zeeb #define IP6QB_UNLOCK(_b) mtx_unlock(&V_ip6qb[(_b)].lock) 1359cb1a47aSBjoern A. Zeeb #define IP6QB_HEAD(_b) (&V_ip6qb[(_b)].ip6q) 1369888c401SHajimu UMEMOTO 13782cd038dSYoshinobu Inoue /* 1382ceeacbeSJonathan T. Looney * By default, limit the number of IP6 fragments across all reassembly 1392ceeacbeSJonathan T. Looney * queues to 1/32 of the total number of mbuf clusters. 1402ceeacbeSJonathan T. Looney * 1412ceeacbeSJonathan T. Looney * Limit the total number of reassembly queues per VNET to the 1422ceeacbeSJonathan T. Looney * IP6 fragment limit, but ensure the limit will not allow any bucket 1432ceeacbeSJonathan T. Looney * to grow above 100 items. (The bucket limit is 1442ceeacbeSJonathan T. Looney * IP_MAXFRAGPACKETS / (IPREASS_NHASH / 2), so the 50 is the correct 1452ceeacbeSJonathan T. Looney * multiplier to reach a 100-item limit.) 1462ceeacbeSJonathan T. Looney * The 100-item limit was chosen as brief testing seems to show that 1472ceeacbeSJonathan T. Looney * this produces "reasonable" performance on some subset of systems 1482ceeacbeSJonathan T. Looney * under DoS attack. 1492ceeacbeSJonathan T. Looney */ 1502ceeacbeSJonathan T. Looney #define IP6_MAXFRAGS (nmbclusters / 32) 1512ceeacbeSJonathan T. Looney #define IP6_MAXFRAGPACKETS (imin(IP6_MAXFRAGS, IP6REASS_NHASH * 50)) 1522ceeacbeSJonathan T. Looney 153757cb678SBjoern A. Zeeb 1542ceeacbeSJonathan T. Looney /* 155757cb678SBjoern A. Zeeb * Sysctls and helper function. 15682cd038dSYoshinobu Inoue */ 157757cb678SBjoern A. Zeeb SYSCTL_DECL(_net_inet6_ip6); 158757cb678SBjoern A. Zeeb 15965456706SBjoern A. Zeeb SYSCTL_UINT(_net_inet6_ip6, OID_AUTO, frag6_nfrags, 16065456706SBjoern A. Zeeb CTLFLAG_RD, __DEVOLATILE(u_int *, &frag6_nfrags), 0, 16165456706SBjoern A. Zeeb "Global number of IPv6 fragments across all reassembly queues."); 16265456706SBjoern A. Zeeb 163757cb678SBjoern A. Zeeb static void 16409b361c7SBjoern A. Zeeb frag6_set_bucketsize(void) 1651e9f3b73SJonathan T. Looney { 1661e9f3b73SJonathan T. Looney int i; 1671e9f3b73SJonathan T. Looney 1681e9f3b73SJonathan T. Looney if ((i = V_ip6_maxfragpackets) > 0) 1691e9f3b73SJonathan T. Looney V_ip6_maxfragbucketsize = imax(i / (IP6REASS_NHASH / 2), 1); 1701e9f3b73SJonathan T. Looney } 1711e9f3b73SJonathan T. Looney 172757cb678SBjoern A. Zeeb SYSCTL_INT(_net_inet6_ip6, IPV6CTL_MAXFRAGS, maxfrags, 173757cb678SBjoern A. Zeeb CTLFLAG_RW, &ip6_maxfrags, 0, 174757cb678SBjoern A. Zeeb "Maximum allowed number of outstanding IPv6 packet fragments. " 175757cb678SBjoern A. Zeeb "A value of 0 means no fragmented packets will be accepted, while a " 176757cb678SBjoern A. Zeeb "a value of -1 means no limit"); 177757cb678SBjoern A. Zeeb 178757cb678SBjoern A. Zeeb static int 179757cb678SBjoern A. Zeeb sysctl_ip6_maxfragpackets(SYSCTL_HANDLER_ARGS) 180757cb678SBjoern A. Zeeb { 181757cb678SBjoern A. Zeeb int error, val; 182757cb678SBjoern A. Zeeb 183757cb678SBjoern A. Zeeb val = V_ip6_maxfragpackets; 184757cb678SBjoern A. Zeeb error = sysctl_handle_int(oidp, &val, 0, req); 185757cb678SBjoern A. Zeeb if (error != 0 || !req->newptr) 186757cb678SBjoern A. Zeeb return (error); 187757cb678SBjoern A. Zeeb V_ip6_maxfragpackets = val; 188757cb678SBjoern A. Zeeb frag6_set_bucketsize(); 189757cb678SBjoern A. Zeeb return (0); 190757cb678SBjoern A. Zeeb } 191757cb678SBjoern A. Zeeb SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGPACKETS, maxfragpackets, 192757cb678SBjoern A. Zeeb CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW, NULL, 0, 193757cb678SBjoern A. Zeeb sysctl_ip6_maxfragpackets, "I", 194757cb678SBjoern A. Zeeb "Default maximum number of outstanding fragmented IPv6 packets. " 195757cb678SBjoern A. Zeeb "A value of 0 means no fragmented packets will be accepted, while a " 196757cb678SBjoern A. Zeeb "a value of -1 means no limit"); 197757cb678SBjoern A. Zeeb SYSCTL_INT(_net_inet6_ip6, IPV6CTL_MAXFRAGSPERPACKET, maxfragsperpacket, 198757cb678SBjoern A. Zeeb CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_maxfragsperpacket), 0, 199757cb678SBjoern A. Zeeb "Maximum allowed number of fragments per packet"); 200757cb678SBjoern A. Zeeb SYSCTL_INT(_net_inet6_ip6, IPV6CTL_MAXFRAGBUCKETSIZE, maxfragbucketsize, 201757cb678SBjoern A. Zeeb CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip6_maxfragbucketsize), 0, 202757cb678SBjoern A. Zeeb "Maximum number of reassembly queues per hash bucket"); 203757cb678SBjoern A. Zeeb 204757cb678SBjoern A. Zeeb 205757cb678SBjoern A. Zeeb /* 206c00464a2SBjoern A. Zeeb * Remove the IPv6 fragmentation header from the mbuf. 207c00464a2SBjoern A. Zeeb */ 208c00464a2SBjoern A. Zeeb int 209c00464a2SBjoern A. Zeeb ip6_deletefraghdr(struct mbuf *m, int offset, int wait) 210c00464a2SBjoern A. Zeeb { 2115778b399SBjoern A. Zeeb struct ip6_hdr *ip6; 212c00464a2SBjoern A. Zeeb struct mbuf *t; 213c00464a2SBjoern A. Zeeb 214c00464a2SBjoern A. Zeeb /* Delete frag6 header. */ 215c00464a2SBjoern A. Zeeb if (m->m_len >= offset + sizeof(struct ip6_frag)) { 2165778b399SBjoern A. Zeeb 217c00464a2SBjoern A. Zeeb /* This is the only possible case with !PULLDOWN_TEST. */ 2185778b399SBjoern A. Zeeb ip6 = mtod(m, struct ip6_hdr *); 219c00464a2SBjoern A. Zeeb bcopy(ip6, (char *)ip6 + sizeof(struct ip6_frag), 220c00464a2SBjoern A. Zeeb offset); 221c00464a2SBjoern A. Zeeb m->m_data += sizeof(struct ip6_frag); 222c00464a2SBjoern A. Zeeb m->m_len -= sizeof(struct ip6_frag); 223c00464a2SBjoern A. Zeeb } else { 2245778b399SBjoern A. Zeeb 225c00464a2SBjoern A. Zeeb /* This comes with no copy if the boundary is on cluster. */ 226c00464a2SBjoern A. Zeeb if ((t = m_split(m, offset, wait)) == NULL) 227c00464a2SBjoern A. Zeeb return (ENOMEM); 228c00464a2SBjoern A. Zeeb m_adj(t, sizeof(struct ip6_frag)); 229c00464a2SBjoern A. Zeeb m_cat(m, t); 230c00464a2SBjoern A. Zeeb } 231c00464a2SBjoern A. Zeeb 232c00464a2SBjoern A. Zeeb m->m_flags |= M_FRAGMENTED; 233c00464a2SBjoern A. Zeeb return (0); 234c00464a2SBjoern A. Zeeb } 235c00464a2SBjoern A. Zeeb 236c00464a2SBjoern A. Zeeb /* 23723d374aaSBjoern A. Zeeb * Free a fragment reassembly header and all associated datagrams. 238757cb678SBjoern A. Zeeb */ 2394f590175SPaul Saab static void 240c00464a2SBjoern A. Zeeb frag6_freef(struct ip6q *q6, uint32_t bucket) 2414f590175SPaul Saab { 2425778b399SBjoern A. Zeeb struct ip6_hdr *ip6; 243c00464a2SBjoern A. Zeeb struct ip6asfrag *af6, *down6; 2445778b399SBjoern A. Zeeb struct mbuf *m; 2454f590175SPaul Saab 2469cb1a47aSBjoern A. Zeeb IP6QB_LOCK_ASSERT(bucket); 247c00464a2SBjoern A. Zeeb 248c00464a2SBjoern A. Zeeb for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; 249c00464a2SBjoern A. Zeeb af6 = down6) { 250c00464a2SBjoern A. Zeeb 2515778b399SBjoern A. Zeeb m = IP6_REASS_MBUF(af6); 252c00464a2SBjoern A. Zeeb down6 = af6->ip6af_down; 253c00464a2SBjoern A. Zeeb frag6_deq(af6, bucket); 254c00464a2SBjoern A. Zeeb 255c00464a2SBjoern A. Zeeb /* 256c00464a2SBjoern A. Zeeb * Return ICMP time exceeded error for the 1st fragment. 257c00464a2SBjoern A. Zeeb * Just free other fragments. 258c00464a2SBjoern A. Zeeb */ 259a55383e7SHans Petter Selasky if (af6->ip6af_off == 0 && m->m_pkthdr.rcvif != NULL) { 260c00464a2SBjoern A. Zeeb 26123d374aaSBjoern A. Zeeb /* Adjust pointer. */ 262c00464a2SBjoern A. Zeeb ip6 = mtod(m, struct ip6_hdr *); 263c00464a2SBjoern A. Zeeb 26423d374aaSBjoern A. Zeeb /* Restore source and destination addresses. */ 265c00464a2SBjoern A. Zeeb ip6->ip6_src = q6->ip6q_src; 266c00464a2SBjoern A. Zeeb ip6->ip6_dst = q6->ip6q_dst; 267c00464a2SBjoern A. Zeeb 268c00464a2SBjoern A. Zeeb icmp6_error(m, ICMP6_TIME_EXCEEDED, 269c00464a2SBjoern A. Zeeb ICMP6_TIME_EXCEED_REASSEMBLY, 0); 270c00464a2SBjoern A. Zeeb } else 271c00464a2SBjoern A. Zeeb m_freem(m); 27223d374aaSBjoern A. Zeeb 273c00464a2SBjoern A. Zeeb free(af6, M_FRAG6); 2742adfd64fSJonathan T. Looney } 275c00464a2SBjoern A. Zeeb frag6_remque(q6, bucket); 276c00464a2SBjoern A. Zeeb atomic_subtract_int(&frag6_nfrags, q6->ip6q_nfrag); 277c00464a2SBjoern A. Zeeb #ifdef MAC 278c00464a2SBjoern A. Zeeb mac_ip6q_destroy(q6); 279c00464a2SBjoern A. Zeeb #endif 280c00464a2SBjoern A. Zeeb free(q6, M_FRAG6); 281c00464a2SBjoern A. Zeeb atomic_subtract_int(&V_frag6_nfragpackets, 1); 28282cd038dSYoshinobu Inoue } 28382cd038dSYoshinobu Inoue 28482cd038dSYoshinobu Inoue /* 285a55383e7SHans Petter Selasky * Drain off all datagram fragments belonging to 286a55383e7SHans Petter Selasky * the given network interface. 287a55383e7SHans Petter Selasky */ 288a55383e7SHans Petter Selasky static void 289a55383e7SHans Petter Selasky frag6_cleanup(void *arg __unused, struct ifnet *ifp) 290a55383e7SHans Petter Selasky { 291a55383e7SHans Petter Selasky struct ip6q *q6, *q6n, *head; 292a55383e7SHans Petter Selasky struct ip6asfrag *af6; 293a55383e7SHans Petter Selasky struct mbuf *m; 294a55383e7SHans Petter Selasky int i; 295a55383e7SHans Petter Selasky 296a55383e7SHans Petter Selasky KASSERT(ifp != NULL, ("%s: ifp is NULL", __func__)); 297a55383e7SHans Petter Selasky 29867a10c46SBjoern A. Zeeb #ifdef VIMAGE 29967a10c46SBjoern A. Zeeb /* 30067a10c46SBjoern A. Zeeb * Skip processing if IPv6 reassembly is not initialised or 30167a10c46SBjoern A. Zeeb * torn down by frag6_destroy(). 30267a10c46SBjoern A. Zeeb */ 30367a10c46SBjoern A. Zeeb if (!V_frag6_on) 30467a10c46SBjoern A. Zeeb return; 30567a10c46SBjoern A. Zeeb #endif 30667a10c46SBjoern A. Zeeb 307a55383e7SHans Petter Selasky CURVNET_SET_QUIET(ifp->if_vnet); 308a55383e7SHans Petter Selasky for (i = 0; i < IP6REASS_NHASH; i++) { 309a55383e7SHans Petter Selasky IP6QB_LOCK(i); 310a55383e7SHans Petter Selasky head = IP6QB_HEAD(i); 311a55383e7SHans Petter Selasky /* Scan fragment list. */ 312a55383e7SHans Petter Selasky for (q6 = head->ip6q_next; q6 != head; q6 = q6n) { 313a55383e7SHans Petter Selasky q6n = q6->ip6q_next; 314a55383e7SHans Petter Selasky 315a55383e7SHans Petter Selasky for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; 316a55383e7SHans Petter Selasky af6 = af6->ip6af_down) { 317a55383e7SHans Petter Selasky m = IP6_REASS_MBUF(af6); 318a55383e7SHans Petter Selasky 319a55383e7SHans Petter Selasky /* clear no longer valid rcvif pointer */ 320a55383e7SHans Petter Selasky if (m->m_pkthdr.rcvif == ifp) 321a55383e7SHans Petter Selasky m->m_pkthdr.rcvif = NULL; 322a55383e7SHans Petter Selasky } 323a55383e7SHans Petter Selasky } 324a55383e7SHans Petter Selasky IP6QB_UNLOCK(i); 325a55383e7SHans Petter Selasky } 326a55383e7SHans Petter Selasky CURVNET_RESTORE(); 327a55383e7SHans Petter Selasky } 328a55383e7SHans Petter Selasky EVENTHANDLER_DEFINE(ifnet_departure_event, frag6_cleanup, NULL, 0); 329a55383e7SHans Petter Selasky 330a55383e7SHans Petter Selasky /* 33123d374aaSBjoern A. Zeeb * Like in RFC2460, in RFC8200, fragment and reassembly rules do not agree with 33223d374aaSBjoern A. Zeeb * each other, in terms of next header field handling in fragment header. 333686cdd19SJun-ichiro itojun Hagino * While the sender will use the same value for all of the fragmented packets, 33423d374aaSBjoern A. Zeeb * receiver is suggested not to check for consistency. 335686cdd19SJun-ichiro itojun Hagino * 33623d374aaSBjoern A. Zeeb * Fragment rules (p18,p19): 337686cdd19SJun-ichiro itojun Hagino * (2) A Fragment header containing: 33823d374aaSBjoern A. Zeeb * The Next Header value that identifies the first header 33923d374aaSBjoern A. Zeeb * after the Per-Fragment headers of the original packet. 340686cdd19SJun-ichiro itojun Hagino * -> next header field is same for all fragments 341686cdd19SJun-ichiro itojun Hagino * 34223d374aaSBjoern A. Zeeb * Reassembly rule (p20): 34323d374aaSBjoern A. Zeeb * The Next Header field of the last header of the Per-Fragment 34423d374aaSBjoern A. Zeeb * headers is obtained from the Next Header field of the first 345686cdd19SJun-ichiro itojun Hagino * fragment's Fragment header. 346686cdd19SJun-ichiro itojun Hagino * -> should grab it from the first fragment only 347686cdd19SJun-ichiro itojun Hagino * 348686cdd19SJun-ichiro itojun Hagino * The following note also contradicts with fragment rule - no one is going to 349686cdd19SJun-ichiro itojun Hagino * send different fragment with different next header field. 350686cdd19SJun-ichiro itojun Hagino * 35123d374aaSBjoern A. Zeeb * Additional note (p22) [not an error]: 352686cdd19SJun-ichiro itojun Hagino * The Next Header values in the Fragment headers of different 353686cdd19SJun-ichiro itojun Hagino * fragments of the same original packet may differ. Only the value 354686cdd19SJun-ichiro itojun Hagino * from the Offset zero fragment packet is used for reassembly. 355686cdd19SJun-ichiro itojun Hagino * -> should grab it from the first fragment only 356686cdd19SJun-ichiro itojun Hagino * 357686cdd19SJun-ichiro itojun Hagino * There is no explicit reason given in the RFC. Historical reason maybe? 358686cdd19SJun-ichiro itojun Hagino */ 359686cdd19SJun-ichiro itojun Hagino /* 36023d374aaSBjoern A. Zeeb * Fragment input. 36182cd038dSYoshinobu Inoue */ 36282cd038dSYoshinobu Inoue int 3631272577eSXin LI frag6_input(struct mbuf **mp, int *offp, int proto) 36482cd038dSYoshinobu Inoue { 3655778b399SBjoern A. Zeeb struct ifnet *dstifp; 366a55383e7SHans Petter Selasky struct ifnet *srcifp; 3675778b399SBjoern A. Zeeb struct in6_ifaddr *ia6; 36882cd038dSYoshinobu Inoue struct ip6_hdr *ip6; 36982cd038dSYoshinobu Inoue struct ip6_frag *ip6f; 37080d7a853SJonathan T. Looney struct ip6q *head, *q6; 3715778b399SBjoern A. Zeeb struct ip6asfrag *af6, *af6dwn, *ip6af; 3725778b399SBjoern A. Zeeb struct mbuf *m, *t; 373505e91f5SKristof Provost uint32_t hashkey[(sizeof(struct in6_addr) * 2 + 374505e91f5SKristof Provost sizeof(ip6f->ip6f_ident)) / sizeof(uint32_t)]; 3759cb1a47aSBjoern A. Zeeb uint32_t bucket, *hashkeyp; 3765778b399SBjoern A. Zeeb int fragoff, frgpartlen; /* Must be larger than uint16_t. */ 3775778b399SBjoern A. Zeeb int nxt, offset, plen; 3785778b399SBjoern A. Zeeb uint8_t ecn, ecn0; 3795778b399SBjoern A. Zeeb bool only_frag; 380aaa46574SAdrian Chadd #ifdef RSS 381aaa46574SAdrian Chadd struct ip6_direct_ctx *ip6dc; 3825778b399SBjoern A. Zeeb struct m_tag *mtag; 383aaa46574SAdrian Chadd #endif 384aaa46574SAdrian Chadd 3855778b399SBjoern A. Zeeb m = *mp; 3865778b399SBjoern A. Zeeb offset = *offp; 3875778b399SBjoern A. Zeeb 38882cd038dSYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 389686cdd19SJun-ichiro itojun Hagino #ifndef PULLDOWN_TEST 390686cdd19SJun-ichiro itojun Hagino IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), IPPROTO_DONE); 39182cd038dSYoshinobu Inoue ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset); 392686cdd19SJun-ichiro itojun Hagino #else 393686cdd19SJun-ichiro itojun Hagino IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f)); 394686cdd19SJun-ichiro itojun Hagino if (ip6f == NULL) 39540e39bbbSHajimu UMEMOTO return (IPPROTO_DONE); 396686cdd19SJun-ichiro itojun Hagino #endif 39782cd038dSYoshinobu Inoue 398a55383e7SHans Petter Selasky /* 399a55383e7SHans Petter Selasky * Store receive network interface pointer for later. 400a55383e7SHans Petter Selasky */ 401a55383e7SHans Petter Selasky srcifp = m->m_pkthdr.rcvif; 402a55383e7SHans Petter Selasky 40382cd038dSYoshinobu Inoue dstifp = NULL; 40423d374aaSBjoern A. Zeeb /* Find the destination interface of the packet. */ 4055778b399SBjoern A. Zeeb ia6 = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */); 4065778b399SBjoern A. Zeeb if (ia6 != NULL) { 4075778b399SBjoern A. Zeeb dstifp = ia6->ia_ifp; 4085778b399SBjoern A. Zeeb ifa_free(&ia6->ia_ifa); 4098c0fec80SRobert Watson } 41023d374aaSBjoern A. Zeeb 41123d374aaSBjoern A. Zeeb /* Jumbo payload cannot contain a fragment header. */ 41282cd038dSYoshinobu Inoue if (ip6->ip6_plen == 0) { 41382cd038dSYoshinobu Inoue icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset); 41482cd038dSYoshinobu Inoue in6_ifstat_inc(dstifp, ifs6_reass_fail); 4155778b399SBjoern A. Zeeb return (IPPROTO_DONE); 41682cd038dSYoshinobu Inoue } 41782cd038dSYoshinobu Inoue 41882cd038dSYoshinobu Inoue /* 41923d374aaSBjoern A. Zeeb * Check whether fragment packet's fragment length is a 42023d374aaSBjoern A. Zeeb * multiple of 8 octets (unless it is the last one). 42182cd038dSYoshinobu Inoue * sizeof(struct ip6_frag) == 8 42282cd038dSYoshinobu Inoue * sizeof(struct ip6_hdr) = 40 42382cd038dSYoshinobu Inoue */ 42482cd038dSYoshinobu Inoue if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) && 42582cd038dSYoshinobu Inoue (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) { 42606cd0a3fSHajimu UMEMOTO icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, 427686cdd19SJun-ichiro itojun Hagino offsetof(struct ip6_hdr, ip6_plen)); 42882cd038dSYoshinobu Inoue in6_ifstat_inc(dstifp, ifs6_reass_fail); 4295778b399SBjoern A. Zeeb return (IPPROTO_DONE); 43082cd038dSYoshinobu Inoue } 43182cd038dSYoshinobu Inoue 4329cb8d207SAndrey V. Elsukov IP6STAT_INC(ip6s_fragments); 43382cd038dSYoshinobu Inoue in6_ifstat_inc(dstifp, ifs6_reass_reqd); 43482cd038dSYoshinobu Inoue 43523d374aaSBjoern A. Zeeb /* Offset now points to data portion. */ 43682cd038dSYoshinobu Inoue offset += sizeof(struct ip6_frag); 43782cd038dSYoshinobu Inoue 4384018ea9aSBjoern A. Zeeb /* 4392946a941STom Jones * Handle "atomic" fragments (offset and m bit set to 0) upfront, 44023d374aaSBjoern A. Zeeb * unrelated to any reassembly. Still need to remove the frag hdr. 44123d374aaSBjoern A. Zeeb * See RFC 6946 and section 4.5 of RFC 8200. 4424018ea9aSBjoern A. Zeeb */ 4434018ea9aSBjoern A. Zeeb if ((ip6f->ip6f_offlg & ~IP6F_RESERVED_MASK) == 0) { 4442946a941STom Jones IP6STAT_INC(ip6s_atomicfrags); 44523d374aaSBjoern A. Zeeb /* XXX-BZ handle correctly. */ 4464018ea9aSBjoern A. Zeeb in6_ifstat_inc(dstifp, ifs6_reass_ok); 4474018ea9aSBjoern A. Zeeb *offp = offset; 448a4061289SAndrey V. Elsukov m->m_flags |= M_FRAGMENTED; 4494018ea9aSBjoern A. Zeeb return (ip6f->ip6f_nxt); 4504018ea9aSBjoern A. Zeeb } 4514018ea9aSBjoern A. Zeeb 4525f9f192dSJonathan T. Looney /* Get fragment length and discard 0-byte fragments. */ 4535f9f192dSJonathan T. Looney frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset; 4545f9f192dSJonathan T. Looney if (frgpartlen == 0) { 4555f9f192dSJonathan T. Looney icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, 4565f9f192dSJonathan T. Looney offsetof(struct ip6_hdr, ip6_plen)); 4575f9f192dSJonathan T. Looney in6_ifstat_inc(dstifp, ifs6_reass_fail); 4585f9f192dSJonathan T. Looney IP6STAT_INC(ip6s_fragdropped); 4595778b399SBjoern A. Zeeb return (IPPROTO_DONE); 4605f9f192dSJonathan T. Looney } 4615f9f192dSJonathan T. Looney 46223d374aaSBjoern A. Zeeb /* Generate a hash value for fragment bucket selection. */ 46380d7a853SJonathan T. Looney hashkeyp = hashkey; 46480d7a853SJonathan T. Looney memcpy(hashkeyp, &ip6->ip6_src, sizeof(struct in6_addr)); 46580d7a853SJonathan T. Looney hashkeyp += sizeof(struct in6_addr) / sizeof(*hashkeyp); 46680d7a853SJonathan T. Looney memcpy(hashkeyp, &ip6->ip6_dst, sizeof(struct in6_addr)); 46780d7a853SJonathan T. Looney hashkeyp += sizeof(struct in6_addr) / sizeof(*hashkeyp); 46880d7a853SJonathan T. Looney *hashkeyp = ip6f->ip6f_ident; 4699cb1a47aSBjoern A. Zeeb bucket = jenkins_hash32(hashkey, nitems(hashkey), V_ip6qb_hashseed); 4709cb1a47aSBjoern A. Zeeb bucket &= IP6REASS_HMASK; 4719cb1a47aSBjoern A. Zeeb head = IP6QB_HEAD(bucket); 4729cb1a47aSBjoern A. Zeeb IP6QB_LOCK(bucket); 4739888c401SHajimu UMEMOTO 4749888c401SHajimu UMEMOTO /* 47523d374aaSBjoern A. Zeeb * Enforce upper bound on number of fragments for the entire system. 4769888c401SHajimu UMEMOTO * If maxfrag is 0, never accept fragments. 4779888c401SHajimu UMEMOTO * If maxfrag is -1, accept all fragments without limitation. 4789888c401SHajimu UMEMOTO */ 4792adfd64fSJonathan T. Looney if (ip6_maxfrags < 0) 4809888c401SHajimu UMEMOTO ; 4812adfd64fSJonathan T. Looney else if (atomic_load_int(&frag6_nfrags) >= (u_int)ip6_maxfrags) 4829888c401SHajimu UMEMOTO goto dropfrag; 48333841545SHajimu UMEMOTO 48480d7a853SJonathan T. Looney for (q6 = head->ip6q_next; q6 != head; q6 = q6->ip6q_next) 48582cd038dSYoshinobu Inoue if (ip6f->ip6f_ident == q6->ip6q_ident && 48682cd038dSYoshinobu Inoue IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) && 4874b908c8bSRobert Watson IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst) 4884b908c8bSRobert Watson #ifdef MAC 4894b908c8bSRobert Watson && mac_ip6q_match(m, q6) 4904b908c8bSRobert Watson #endif 4914b908c8bSRobert Watson ) 49282cd038dSYoshinobu Inoue break; 49382cd038dSYoshinobu Inoue 4945778b399SBjoern A. Zeeb only_frag = false; 49580d7a853SJonathan T. Looney if (q6 == head) { 49623d374aaSBjoern A. Zeeb 4975778b399SBjoern A. Zeeb /* A first fragment to arrive creates a reassembly queue. */ 4985778b399SBjoern A. Zeeb only_frag = true; 49982cd038dSYoshinobu Inoue 50082cd038dSYoshinobu Inoue /* 50182cd038dSYoshinobu Inoue * Enforce upper bound on number of fragmented packets 50282cd038dSYoshinobu Inoue * for which we attempt reassembly; 5039888c401SHajimu UMEMOTO * If maxfragpackets is 0, never accept fragments. 5049888c401SHajimu UMEMOTO * If maxfragpackets is -1, accept all fragments without 5059888c401SHajimu UMEMOTO * limitation. 50682cd038dSYoshinobu Inoue */ 507603724d3SBjoern A. Zeeb if (V_ip6_maxfragpackets < 0) 50833841545SHajimu UMEMOTO ; 5099cb1a47aSBjoern A. Zeeb else if (V_ip6qb[bucket].count >= V_ip6_maxfragbucketsize || 5101e9f3b73SJonathan T. Looney atomic_load_int(&V_frag6_nfragpackets) >= 51180d7a853SJonathan T. Looney (u_int)V_ip6_maxfragpackets) 51233841545SHajimu UMEMOTO goto dropfrag; 51380d7a853SJonathan T. Looney atomic_add_int(&V_frag6_nfragpackets, 1); 51423d374aaSBjoern A. Zeeb 51523d374aaSBjoern A. Zeeb /* Allocate IPv6 fragement packet queue entry. */ 516487a161cSBjoern A. Zeeb q6 = (struct ip6q *)malloc(sizeof(struct ip6q), M_FRAG6, 517487a161cSBjoern A. Zeeb M_NOWAIT | M_ZERO); 51882cd038dSYoshinobu Inoue if (q6 == NULL) 51982cd038dSYoshinobu Inoue goto dropfrag; 5204b908c8bSRobert Watson #ifdef MAC 5214b908c8bSRobert Watson if (mac_ip6q_init(q6, M_NOWAIT) != 0) { 522487a161cSBjoern A. Zeeb free(q6, M_FRAG6); 5234b908c8bSRobert Watson goto dropfrag; 5244b908c8bSRobert Watson } 5254b908c8bSRobert Watson mac_ip6q_create(m, q6); 5264b908c8bSRobert Watson #endif 5279cb1a47aSBjoern A. Zeeb frag6_insque_head(q6, head, bucket); 52882cd038dSYoshinobu Inoue 52923d374aaSBjoern A. Zeeb /* ip6q_nxt will be filled afterwards, from 1st fragment. */ 53082cd038dSYoshinobu Inoue q6->ip6q_down = q6->ip6q_up = (struct ip6asfrag *)q6; 531686cdd19SJun-ichiro itojun Hagino #ifdef notyet 532686cdd19SJun-ichiro itojun Hagino q6->ip6q_nxtp = (u_char *)nxtp; 533686cdd19SJun-ichiro itojun Hagino #endif 53482cd038dSYoshinobu Inoue q6->ip6q_ident = ip6f->ip6f_ident; 53582cd038dSYoshinobu Inoue q6->ip6q_ttl = IPV6_FRAGTTL; 53682cd038dSYoshinobu Inoue q6->ip6q_src = ip6->ip6_src; 53782cd038dSYoshinobu Inoue q6->ip6q_dst = ip6->ip6_dst; 5385e9510e3SJINMEI Tatuya q6->ip6q_ecn = 5395e9510e3SJINMEI Tatuya (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; 54082cd038dSYoshinobu Inoue q6->ip6q_unfrglen = -1; /* The 1st fragment has not arrived. */ 5419888c401SHajimu UMEMOTO 5429888c401SHajimu UMEMOTO q6->ip6q_nfrag = 0; 54382cd038dSYoshinobu Inoue } 54482cd038dSYoshinobu Inoue 54582cd038dSYoshinobu Inoue /* 54623d374aaSBjoern A. Zeeb * If it is the 1st fragment, record the length of the 54782cd038dSYoshinobu Inoue * unfragmentable part and the next header of the fragment header. 54882cd038dSYoshinobu Inoue */ 54982cd038dSYoshinobu Inoue fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK); 55082cd038dSYoshinobu Inoue if (fragoff == 0) { 55106cd0a3fSHajimu UMEMOTO q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr) - 55206cd0a3fSHajimu UMEMOTO sizeof(struct ip6_frag); 55382cd038dSYoshinobu Inoue q6->ip6q_nxt = ip6f->ip6f_nxt; 55482cd038dSYoshinobu Inoue } 55582cd038dSYoshinobu Inoue 55682cd038dSYoshinobu Inoue /* 55782cd038dSYoshinobu Inoue * Check that the reassembled packet would not exceed 65535 bytes 55882cd038dSYoshinobu Inoue * in size. 55982cd038dSYoshinobu Inoue * If it would exceed, discard the fragment and return an ICMP error. 56082cd038dSYoshinobu Inoue */ 56182cd038dSYoshinobu Inoue if (q6->ip6q_unfrglen >= 0) { 56282cd038dSYoshinobu Inoue /* The 1st fragment has already arrived. */ 56382cd038dSYoshinobu Inoue if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) { 56482cd038dSYoshinobu Inoue icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, 565686cdd19SJun-ichiro itojun Hagino offset - sizeof(struct ip6_frag) + 566686cdd19SJun-ichiro itojun Hagino offsetof(struct ip6_frag, ip6f_offlg)); 5679cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 56882cd038dSYoshinobu Inoue return (IPPROTO_DONE); 56982cd038dSYoshinobu Inoue } 57006cd0a3fSHajimu UMEMOTO } else if (fragoff + frgpartlen > IPV6_MAXPACKET) { 57182cd038dSYoshinobu Inoue icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, 572686cdd19SJun-ichiro itojun Hagino offset - sizeof(struct ip6_frag) + 573686cdd19SJun-ichiro itojun Hagino offsetof(struct ip6_frag, ip6f_offlg)); 5749cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 57582cd038dSYoshinobu Inoue return (IPPROTO_DONE); 57682cd038dSYoshinobu Inoue } 57782cd038dSYoshinobu Inoue /* 57823d374aaSBjoern A. Zeeb * If it is the first fragment, do the above check for each 57982cd038dSYoshinobu Inoue * fragment already stored in the reassembly queue. 58082cd038dSYoshinobu Inoue */ 58182cd038dSYoshinobu Inoue if (fragoff == 0) { 58282cd038dSYoshinobu Inoue for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; 58382cd038dSYoshinobu Inoue af6 = af6dwn) { 58482cd038dSYoshinobu Inoue af6dwn = af6->ip6af_down; 58582cd038dSYoshinobu Inoue 58682cd038dSYoshinobu Inoue if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen > 58782cd038dSYoshinobu Inoue IPV6_MAXPACKET) { 58882cd038dSYoshinobu Inoue struct ip6_hdr *ip6err; 5895778b399SBjoern A. Zeeb struct mbuf *merr; 5905778b399SBjoern A. Zeeb int erroff; 5915778b399SBjoern A. Zeeb 5925778b399SBjoern A. Zeeb merr = IP6_REASS_MBUF(af6); 5935778b399SBjoern A. Zeeb erroff = af6->ip6af_offset; 59482cd038dSYoshinobu Inoue 59523d374aaSBjoern A. Zeeb /* Dequeue the fragment. */ 5969cb1a47aSBjoern A. Zeeb frag6_deq(af6, bucket); 597487a161cSBjoern A. Zeeb free(af6, M_FRAG6); 59882cd038dSYoshinobu Inoue 599a55383e7SHans Petter Selasky /* Set a valid receive interface pointer. */ 600a55383e7SHans Petter Selasky merr->m_pkthdr.rcvif = srcifp; 601a55383e7SHans Petter Selasky 60223d374aaSBjoern A. Zeeb /* Adjust pointer. */ 60382cd038dSYoshinobu Inoue ip6err = mtod(merr, struct ip6_hdr *); 60482cd038dSYoshinobu Inoue 60582cd038dSYoshinobu Inoue /* 60682cd038dSYoshinobu Inoue * Restore source and destination addresses 60782cd038dSYoshinobu Inoue * in the erroneous IPv6 header. 60882cd038dSYoshinobu Inoue */ 60982cd038dSYoshinobu Inoue ip6err->ip6_src = q6->ip6q_src; 61082cd038dSYoshinobu Inoue ip6err->ip6_dst = q6->ip6q_dst; 61182cd038dSYoshinobu Inoue 61282cd038dSYoshinobu Inoue icmp6_error(merr, ICMP6_PARAM_PROB, 61382cd038dSYoshinobu Inoue ICMP6_PARAMPROB_HEADER, 614686cdd19SJun-ichiro itojun Hagino erroff - sizeof(struct ip6_frag) + 615686cdd19SJun-ichiro itojun Hagino offsetof(struct ip6_frag, ip6f_offlg)); 61682cd038dSYoshinobu Inoue } 61782cd038dSYoshinobu Inoue } 61882cd038dSYoshinobu Inoue } 61982cd038dSYoshinobu Inoue 62023d374aaSBjoern A. Zeeb /* Allocate an IPv6 fragement queue entry for this fragmented part. */ 621487a161cSBjoern A. Zeeb ip6af = (struct ip6asfrag *)malloc(sizeof(struct ip6asfrag), M_FRAG6, 622487a161cSBjoern A. Zeeb M_NOWAIT | M_ZERO); 623686cdd19SJun-ichiro itojun Hagino if (ip6af == NULL) 624686cdd19SJun-ichiro itojun Hagino goto dropfrag; 62582cd038dSYoshinobu Inoue ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG; 62682cd038dSYoshinobu Inoue ip6af->ip6af_off = fragoff; 62782cd038dSYoshinobu Inoue ip6af->ip6af_frglen = frgpartlen; 62882cd038dSYoshinobu Inoue ip6af->ip6af_offset = offset; 62982cd038dSYoshinobu Inoue IP6_REASS_MBUF(ip6af) = m; 63082cd038dSYoshinobu Inoue 6315778b399SBjoern A. Zeeb if (only_frag) { 63282cd038dSYoshinobu Inoue af6 = (struct ip6asfrag *)q6; 63382cd038dSYoshinobu Inoue goto insert; 63482cd038dSYoshinobu Inoue } 63582cd038dSYoshinobu Inoue 63623d374aaSBjoern A. Zeeb /* Do duplicate, condition, and boundry checks. */ 63782cd038dSYoshinobu Inoue /* 63859dfcba4SHajimu UMEMOTO * Handle ECN by comparing this segment with the first one; 63959dfcba4SHajimu UMEMOTO * if CE is set, do not lose CE. 64023d374aaSBjoern A. Zeeb * Drop if CE and not-ECT are mixed for the same packet. 64159dfcba4SHajimu UMEMOTO */ 64259dfcba4SHajimu UMEMOTO ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; 6435e9510e3SJINMEI Tatuya ecn0 = q6->ip6q_ecn; 64459dfcba4SHajimu UMEMOTO if (ecn == IPTOS_ECN_CE) { 64559dfcba4SHajimu UMEMOTO if (ecn0 == IPTOS_ECN_NOTECT) { 646487a161cSBjoern A. Zeeb free(ip6af, M_FRAG6); 64759dfcba4SHajimu UMEMOTO goto dropfrag; 64859dfcba4SHajimu UMEMOTO } 64959dfcba4SHajimu UMEMOTO if (ecn0 != IPTOS_ECN_CE) 6505e9510e3SJINMEI Tatuya q6->ip6q_ecn = IPTOS_ECN_CE; 65159dfcba4SHajimu UMEMOTO } 65259dfcba4SHajimu UMEMOTO if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) { 653487a161cSBjoern A. Zeeb free(ip6af, M_FRAG6); 65459dfcba4SHajimu UMEMOTO goto dropfrag; 65559dfcba4SHajimu UMEMOTO } 65659dfcba4SHajimu UMEMOTO 65723d374aaSBjoern A. Zeeb /* Find a fragmented part which begins after this one does. */ 65882cd038dSYoshinobu Inoue for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; 65982cd038dSYoshinobu Inoue af6 = af6->ip6af_down) 66082cd038dSYoshinobu Inoue if (af6->ip6af_off > ip6af->ip6af_off) 66182cd038dSYoshinobu Inoue break; 66282cd038dSYoshinobu Inoue 66382cd038dSYoshinobu Inoue /* 66482cd038dSYoshinobu Inoue * If the incoming framgent overlaps some existing fragments in 66523d374aaSBjoern A. Zeeb * the reassembly queue, drop both the new fragment and the 66623d374aaSBjoern A. Zeeb * entire reassembly queue. However, if the new fragment 66723d374aaSBjoern A. Zeeb * is an exact duplicate of an existing fragment, only silently 66823d374aaSBjoern A. Zeeb * drop the existing fragment and leave the fragmentation queue 66923d374aaSBjoern A. Zeeb * unchanged, as allowed by the RFC. (RFC 8200, 4.5) 67082cd038dSYoshinobu Inoue */ 67182cd038dSYoshinobu Inoue if (af6->ip6af_up != (struct ip6asfrag *)q6) { 6725778b399SBjoern A. Zeeb if (af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen - 6735778b399SBjoern A. Zeeb ip6af->ip6af_off > 0) { 674487a161cSBjoern A. Zeeb free(ip6af, M_FRAG6); 67582cd038dSYoshinobu Inoue goto dropfrag; 67682cd038dSYoshinobu Inoue } 67782cd038dSYoshinobu Inoue } 67882cd038dSYoshinobu Inoue if (af6 != (struct ip6asfrag *)q6) { 6795778b399SBjoern A. Zeeb if (ip6af->ip6af_off + ip6af->ip6af_frglen - 6805778b399SBjoern A. Zeeb af6->ip6af_off > 0) { 681487a161cSBjoern A. Zeeb free(ip6af, M_FRAG6); 68282cd038dSYoshinobu Inoue goto dropfrag; 68382cd038dSYoshinobu Inoue } 68482cd038dSYoshinobu Inoue } 68582cd038dSYoshinobu Inoue 68682cd038dSYoshinobu Inoue insert: 6874b908c8bSRobert Watson #ifdef MAC 6885778b399SBjoern A. Zeeb if (!only_frag) 6894b908c8bSRobert Watson mac_ip6q_update(m, q6); 6904b908c8bSRobert Watson #endif 69182cd038dSYoshinobu Inoue 69282cd038dSYoshinobu Inoue /* 69323d374aaSBjoern A. Zeeb * Stick new segment in its place; check for complete reassembly. 69423d374aaSBjoern A. Zeeb * If not complete, check fragment limit. Move to front of packet 69523d374aaSBjoern A. Zeeb * queue, as we are the most recently active fragmented packet. 69682cd038dSYoshinobu Inoue */ 6979cb1a47aSBjoern A. Zeeb frag6_enq(ip6af, af6->ip6af_up, bucket); 6982adfd64fSJonathan T. Looney atomic_add_int(&frag6_nfrags, 1); 6999888c401SHajimu UMEMOTO q6->ip6q_nfrag++; 7005778b399SBjoern A. Zeeb plen = 0; 70182cd038dSYoshinobu Inoue for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; 70282cd038dSYoshinobu Inoue af6 = af6->ip6af_down) { 7035778b399SBjoern A. Zeeb if (af6->ip6af_off != plen) { 70403c99d76SJonathan T. Looney if (q6->ip6q_nfrag > V_ip6_maxfragsperpacket) { 705198fdaedSTom Jones IP6STAT_ADD(ip6s_fragdropped, q6->ip6q_nfrag); 7069cb1a47aSBjoern A. Zeeb frag6_freef(q6, bucket); 70703c99d76SJonathan T. Looney } 7089cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 7095778b399SBjoern A. Zeeb return (IPPROTO_DONE); 71082cd038dSYoshinobu Inoue } 7115778b399SBjoern A. Zeeb plen += af6->ip6af_frglen; 71282cd038dSYoshinobu Inoue } 71382cd038dSYoshinobu Inoue if (af6->ip6af_up->ip6af_mff) { 71403c99d76SJonathan T. Looney if (q6->ip6q_nfrag > V_ip6_maxfragsperpacket) { 715198fdaedSTom Jones IP6STAT_ADD(ip6s_fragdropped, q6->ip6q_nfrag); 7169cb1a47aSBjoern A. Zeeb frag6_freef(q6, bucket); 71703c99d76SJonathan T. Looney } 7189cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 7195778b399SBjoern A. Zeeb return (IPPROTO_DONE); 72082cd038dSYoshinobu Inoue } 72182cd038dSYoshinobu Inoue 72223d374aaSBjoern A. Zeeb /* Reassembly is complete; concatenate fragments. */ 72382cd038dSYoshinobu Inoue ip6af = q6->ip6q_down; 72482cd038dSYoshinobu Inoue t = m = IP6_REASS_MBUF(ip6af); 72582cd038dSYoshinobu Inoue af6 = ip6af->ip6af_down; 7269cb1a47aSBjoern A. Zeeb frag6_deq(ip6af, bucket); 72782cd038dSYoshinobu Inoue while (af6 != (struct ip6asfrag *)q6) { 7289907aba3SAndrey V. Elsukov m->m_pkthdr.csum_flags &= 7299907aba3SAndrey V. Elsukov IP6_REASS_MBUF(af6)->m_pkthdr.csum_flags; 7309907aba3SAndrey V. Elsukov m->m_pkthdr.csum_data += 7319907aba3SAndrey V. Elsukov IP6_REASS_MBUF(af6)->m_pkthdr.csum_data; 7329907aba3SAndrey V. Elsukov 733686cdd19SJun-ichiro itojun Hagino af6dwn = af6->ip6af_down; 7349cb1a47aSBjoern A. Zeeb frag6_deq(af6, bucket); 73582cd038dSYoshinobu Inoue while (t->m_next) 73682cd038dSYoshinobu Inoue t = t->m_next; 737ba99cc0bSAlexander V. Chernikov m_adj(IP6_REASS_MBUF(af6), af6->ip6af_offset); 73809b0b8c0SNavdeep Parhar m_demote_pkthdr(IP6_REASS_MBUF(af6)); 739ba99cc0bSAlexander V. Chernikov m_cat(t, IP6_REASS_MBUF(af6)); 740487a161cSBjoern A. Zeeb free(af6, M_FRAG6); 741686cdd19SJun-ichiro itojun Hagino af6 = af6dwn; 74282cd038dSYoshinobu Inoue } 74382cd038dSYoshinobu Inoue 7449907aba3SAndrey V. Elsukov while (m->m_pkthdr.csum_data & 0xffff0000) 7459907aba3SAndrey V. Elsukov m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) + 7469907aba3SAndrey V. Elsukov (m->m_pkthdr.csum_data >> 16); 7479907aba3SAndrey V. Elsukov 74823d374aaSBjoern A. Zeeb /* Adjust offset to point where the original next header starts. */ 74982cd038dSYoshinobu Inoue offset = ip6af->ip6af_offset - sizeof(struct ip6_frag); 750487a161cSBjoern A. Zeeb free(ip6af, M_FRAG6); 751686cdd19SJun-ichiro itojun Hagino ip6 = mtod(m, struct ip6_hdr *); 7525778b399SBjoern A. Zeeb ip6->ip6_plen = htons((u_short)plen + offset - sizeof(struct ip6_hdr)); 7535e9510e3SJINMEI Tatuya if (q6->ip6q_ecn == IPTOS_ECN_CE) 7545e9510e3SJINMEI Tatuya ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20); 75582cd038dSYoshinobu Inoue nxt = q6->ip6q_nxt; 75682cd038dSYoshinobu Inoue 7570b438b0fSGleb Smirnoff if (ip6_deletefraghdr(m, offset, M_NOWAIT) != 0) { 7589cb1a47aSBjoern A. Zeeb frag6_remque(q6, bucket); 7592adfd64fSJonathan T. Looney atomic_subtract_int(&frag6_nfrags, q6->ip6q_nfrag); 7604b908c8bSRobert Watson #ifdef MAC 7614b908c8bSRobert Watson mac_ip6q_destroy(q6); 7624b908c8bSRobert Watson #endif 763487a161cSBjoern A. Zeeb free(q6, M_FRAG6); 76480d7a853SJonathan T. Looney atomic_subtract_int(&V_frag6_nfragpackets, 1); 7650b438b0fSGleb Smirnoff 766686cdd19SJun-ichiro itojun Hagino goto dropfrag; 76782cd038dSYoshinobu Inoue } 76882cd038dSYoshinobu Inoue 76923d374aaSBjoern A. Zeeb /* Set nxt(-hdr field value) to the original value. */ 77068e0e5a6SAndrey V. Elsukov m_copyback(m, ip6_get_prevhdr(m, offset), sizeof(uint8_t), 77168e0e5a6SAndrey V. Elsukov (caddr_t)&nxt); 77282cd038dSYoshinobu Inoue 7739cb1a47aSBjoern A. Zeeb frag6_remque(q6, bucket); 7742adfd64fSJonathan T. Looney atomic_subtract_int(&frag6_nfrags, q6->ip6q_nfrag); 7754b908c8bSRobert Watson #ifdef MAC 7764b908c8bSRobert Watson mac_ip6q_reassemble(q6, m); 7774b908c8bSRobert Watson mac_ip6q_destroy(q6); 7784b908c8bSRobert Watson #endif 779487a161cSBjoern A. Zeeb free(q6, M_FRAG6); 78080d7a853SJonathan T. Looney atomic_subtract_int(&V_frag6_nfragpackets, 1); 78182cd038dSYoshinobu Inoue 78282cd038dSYoshinobu Inoue if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */ 7835778b399SBjoern A. Zeeb 7845778b399SBjoern A. Zeeb plen = 0; 78582cd038dSYoshinobu Inoue for (t = m; t; t = t->m_next) 78682cd038dSYoshinobu Inoue plen += t->m_len; 78782cd038dSYoshinobu Inoue m->m_pkthdr.len = plen; 788a55383e7SHans Petter Selasky /* Set a valid receive interface pointer. */ 789a55383e7SHans Petter Selasky m->m_pkthdr.rcvif = srcifp; 79082cd038dSYoshinobu Inoue } 79182cd038dSYoshinobu Inoue 792aaa46574SAdrian Chadd #ifdef RSS 793aaa46574SAdrian Chadd mtag = m_tag_alloc(MTAG_ABI_IPV6, IPV6_TAG_DIRECT, sizeof(*ip6dc), 794aaa46574SAdrian Chadd M_NOWAIT); 795aaa46574SAdrian Chadd if (mtag == NULL) 796aaa46574SAdrian Chadd goto dropfrag; 797aaa46574SAdrian Chadd 798aaa46574SAdrian Chadd ip6dc = (struct ip6_direct_ctx *)(mtag + 1); 799aaa46574SAdrian Chadd ip6dc->ip6dc_nxt = nxt; 800aaa46574SAdrian Chadd ip6dc->ip6dc_off = offset; 801aaa46574SAdrian Chadd 802aaa46574SAdrian Chadd m_tag_prepend(m, mtag); 803aaa46574SAdrian Chadd #endif 804aaa46574SAdrian Chadd 8059cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 8069cb8d207SAndrey V. Elsukov IP6STAT_INC(ip6s_reassembled); 80782cd038dSYoshinobu Inoue in6_ifstat_inc(dstifp, ifs6_reass_ok); 80882cd038dSYoshinobu Inoue 809aaa46574SAdrian Chadd #ifdef RSS 81023d374aaSBjoern A. Zeeb /* Queue/dispatch for reprocessing. */ 811aaa46574SAdrian Chadd netisr_dispatch(NETISR_IPV6_DIRECT, m); 8125778b399SBjoern A. Zeeb return (IPPROTO_DONE); 813aaa46574SAdrian Chadd #endif 814aaa46574SAdrian Chadd 81523d374aaSBjoern A. Zeeb /* Tell launch routine the next header. */ 81682cd038dSYoshinobu Inoue *mp = m; 81782cd038dSYoshinobu Inoue *offp = offset; 81882cd038dSYoshinobu Inoue 8195778b399SBjoern A. Zeeb return (nxt); 82082cd038dSYoshinobu Inoue 82182cd038dSYoshinobu Inoue dropfrag: 8229cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 82382cd038dSYoshinobu Inoue in6_ifstat_inc(dstifp, ifs6_reass_fail); 8249cb8d207SAndrey V. Elsukov IP6STAT_INC(ip6s_fragdropped); 82582cd038dSYoshinobu Inoue m_freem(m); 8265778b399SBjoern A. Zeeb return (IPPROTO_DONE); 82782cd038dSYoshinobu Inoue } 82882cd038dSYoshinobu Inoue 82982cd038dSYoshinobu Inoue /* 83033841545SHajimu UMEMOTO * IPv6 reassembling timer processing; 83123d374aaSBjoern A. Zeeb * if a timer expires on a reassembly queue, discard it. 83282cd038dSYoshinobu Inoue */ 83382cd038dSYoshinobu Inoue void 8341272577eSXin LI frag6_slowtimo(void) 83582cd038dSYoshinobu Inoue { 8368b615593SMarko Zec VNET_ITERATOR_DECL(vnet_iter); 83780d7a853SJonathan T. Looney struct ip6q *head, *q6; 8389cb1a47aSBjoern A. Zeeb uint32_t bucket; 83982cd038dSYoshinobu Inoue 8405ee847d3SRobert Watson VNET_LIST_RLOCK_NOSLEEP(); 8418b615593SMarko Zec VNET_FOREACH(vnet_iter) { 8428b615593SMarko Zec CURVNET_SET(vnet_iter); 8439cb1a47aSBjoern A. Zeeb for (bucket = 0; bucket < IP6REASS_NHASH; bucket++) { 8449cb1a47aSBjoern A. Zeeb IP6QB_LOCK(bucket); 8459cb1a47aSBjoern A. Zeeb head = IP6QB_HEAD(bucket); 84680d7a853SJonathan T. Looney q6 = head->ip6q_next; 8471e9f3b73SJonathan T. Looney if (q6 == NULL) { 8481e9f3b73SJonathan T. Looney /* 8491e9f3b73SJonathan T. Looney * XXXJTL: This should never happen. This 8501e9f3b73SJonathan T. Looney * should turn into an assertion. 8511e9f3b73SJonathan T. Looney */ 8529cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 8531e9f3b73SJonathan T. Looney continue; 8541e9f3b73SJonathan T. Looney } 85580d7a853SJonathan T. Looney while (q6 != head) { 85682cd038dSYoshinobu Inoue --q6->ip6q_ttl; 85782cd038dSYoshinobu Inoue q6 = q6->ip6q_next; 85882cd038dSYoshinobu Inoue if (q6->ip6q_prev->ip6q_ttl == 0) { 859198fdaedSTom Jones IP6STAT_ADD(ip6s_fragtimeout, 860198fdaedSTom Jones q6->ip6q_prev->ip6q_nfrag); 86182cd038dSYoshinobu Inoue /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ 8629cb1a47aSBjoern A. Zeeb frag6_freef(q6->ip6q_prev, bucket); 86382cd038dSYoshinobu Inoue } 86482cd038dSYoshinobu Inoue } 86582cd038dSYoshinobu Inoue /* 86682cd038dSYoshinobu Inoue * If we are over the maximum number of fragments 86782cd038dSYoshinobu Inoue * (due to the limit being lowered), drain off 86882cd038dSYoshinobu Inoue * enough to get down to the new limit. 8691e9f3b73SJonathan T. Looney * Note that we drain all reassembly queues if 8701e9f3b73SJonathan T. Looney * maxfragpackets is 0 (fragmentation is disabled), 87123d374aaSBjoern A. Zeeb * and do not enforce a limit when maxfragpackets 8721e9f3b73SJonathan T. Looney * is negative. 87382cd038dSYoshinobu Inoue */ 8741e9f3b73SJonathan T. Looney while ((V_ip6_maxfragpackets == 0 || 8751e9f3b73SJonathan T. Looney (V_ip6_maxfragpackets > 0 && 8769cb1a47aSBjoern A. Zeeb V_ip6qb[bucket].count > V_ip6_maxfragbucketsize)) && 87780d7a853SJonathan T. Looney head->ip6q_prev != head) { 878198fdaedSTom Jones IP6STAT_ADD(ip6s_fragoverflow, 879198fdaedSTom Jones q6->ip6q_prev->ip6q_nfrag); 88082cd038dSYoshinobu Inoue /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ 8819cb1a47aSBjoern A. Zeeb frag6_freef(head->ip6q_prev, bucket); 88280d7a853SJonathan T. Looney } 8839cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 88482cd038dSYoshinobu Inoue } 8851e9f3b73SJonathan T. Looney /* 8861e9f3b73SJonathan T. Looney * If we are still over the maximum number of fragmented 8871e9f3b73SJonathan T. Looney * packets, drain off enough to get down to the new limit. 8881e9f3b73SJonathan T. Looney */ 8899cb1a47aSBjoern A. Zeeb bucket = 0; 8901e9f3b73SJonathan T. Looney while (V_ip6_maxfragpackets >= 0 && 8911e9f3b73SJonathan T. Looney atomic_load_int(&V_frag6_nfragpackets) > 8921e9f3b73SJonathan T. Looney (u_int)V_ip6_maxfragpackets) { 8939cb1a47aSBjoern A. Zeeb IP6QB_LOCK(bucket); 8949cb1a47aSBjoern A. Zeeb head = IP6QB_HEAD(bucket); 8951e9f3b73SJonathan T. Looney if (head->ip6q_prev != head) { 896198fdaedSTom Jones IP6STAT_ADD(ip6s_fragoverflow, 897198fdaedSTom Jones q6->ip6q_prev->ip6q_nfrag); 8981e9f3b73SJonathan T. Looney /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ 8999cb1a47aSBjoern A. Zeeb frag6_freef(head->ip6q_prev, bucket); 9001e9f3b73SJonathan T. Looney } 9019cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 9029cb1a47aSBjoern A. Zeeb bucket = (bucket + 1) % IP6REASS_NHASH; 9031e9f3b73SJonathan T. Looney } 9048b615593SMarko Zec CURVNET_RESTORE(); 9058b615593SMarko Zec } 9065ee847d3SRobert Watson VNET_LIST_RUNLOCK_NOSLEEP(); 90782cd038dSYoshinobu Inoue } 90882cd038dSYoshinobu Inoue 90923d374aaSBjoern A. Zeeb /* 91023d374aaSBjoern A. Zeeb * Eventhandler to adjust limits in case nmbclusters change. 91123d374aaSBjoern A. Zeeb */ 912c00464a2SBjoern A. Zeeb static void 913c00464a2SBjoern A. Zeeb frag6_change(void *tag) 914c00464a2SBjoern A. Zeeb { 915c00464a2SBjoern A. Zeeb VNET_ITERATOR_DECL(vnet_iter); 916c00464a2SBjoern A. Zeeb 917c00464a2SBjoern A. Zeeb ip6_maxfrags = IP6_MAXFRAGS; 918c00464a2SBjoern A. Zeeb VNET_LIST_RLOCK_NOSLEEP(); 919c00464a2SBjoern A. Zeeb VNET_FOREACH(vnet_iter) { 920c00464a2SBjoern A. Zeeb CURVNET_SET(vnet_iter); 921c00464a2SBjoern A. Zeeb V_ip6_maxfragpackets = IP6_MAXFRAGPACKETS; 922c00464a2SBjoern A. Zeeb frag6_set_bucketsize(); 923c00464a2SBjoern A. Zeeb CURVNET_RESTORE(); 924c00464a2SBjoern A. Zeeb } 925c00464a2SBjoern A. Zeeb VNET_LIST_RUNLOCK_NOSLEEP(); 926c00464a2SBjoern A. Zeeb } 927c00464a2SBjoern A. Zeeb 928c00464a2SBjoern A. Zeeb /* 929c00464a2SBjoern A. Zeeb * Initialise reassembly queue and fragment identifier. 930c00464a2SBjoern A. Zeeb */ 931c00464a2SBjoern A. Zeeb void 932c00464a2SBjoern A. Zeeb frag6_init(void) 933c00464a2SBjoern A. Zeeb { 934c00464a2SBjoern A. Zeeb struct ip6q *q6; 9359cb1a47aSBjoern A. Zeeb uint32_t bucket; 936c00464a2SBjoern A. Zeeb 937c00464a2SBjoern A. Zeeb V_ip6_maxfragpackets = IP6_MAXFRAGPACKETS; 938c00464a2SBjoern A. Zeeb frag6_set_bucketsize(); 9399cb1a47aSBjoern A. Zeeb for (bucket = 0; bucket < IP6REASS_NHASH; bucket++) { 9409cb1a47aSBjoern A. Zeeb q6 = IP6QB_HEAD(bucket); 941c00464a2SBjoern A. Zeeb q6->ip6q_next = q6->ip6q_prev = q6; 9429cb1a47aSBjoern A. Zeeb mtx_init(&V_ip6qb[bucket].lock, "ip6qlock", NULL, MTX_DEF); 9439cb1a47aSBjoern A. Zeeb V_ip6qb[bucket].count = 0; 944c00464a2SBjoern A. Zeeb } 9459cb1a47aSBjoern A. Zeeb V_ip6qb_hashseed = arc4random(); 946c00464a2SBjoern A. Zeeb V_ip6_maxfragsperpacket = 64; 94767a10c46SBjoern A. Zeeb #ifdef VIMAGE 94867a10c46SBjoern A. Zeeb V_frag6_on = true; 94967a10c46SBjoern A. Zeeb #endif 950c00464a2SBjoern A. Zeeb if (!IS_DEFAULT_VNET(curvnet)) 951c00464a2SBjoern A. Zeeb return; 952c00464a2SBjoern A. Zeeb 953c00464a2SBjoern A. Zeeb ip6_maxfrags = IP6_MAXFRAGS; 954c00464a2SBjoern A. Zeeb EVENTHANDLER_REGISTER(nmbclusters_change, 955c00464a2SBjoern A. Zeeb frag6_change, NULL, EVENTHANDLER_PRI_ANY); 956c00464a2SBjoern A. Zeeb } 957c00464a2SBjoern A. Zeeb 95882cd038dSYoshinobu Inoue /* 95982cd038dSYoshinobu Inoue * Drain off all datagram fragments. 96082cd038dSYoshinobu Inoue */ 96167a10c46SBjoern A. Zeeb static void 96267a10c46SBjoern A. Zeeb frag6_drain_one(void) 96382cd038dSYoshinobu Inoue { 96480d7a853SJonathan T. Looney struct ip6q *head; 9659cb1a47aSBjoern A. Zeeb uint32_t bucket; 9669888c401SHajimu UMEMOTO 9679cb1a47aSBjoern A. Zeeb for (bucket = 0; bucket < IP6REASS_NHASH; bucket++) { 96867a10c46SBjoern A. Zeeb IP6QB_LOCK(bucket); 9699cb1a47aSBjoern A. Zeeb head = IP6QB_HEAD(bucket); 97080d7a853SJonathan T. Looney while (head->ip6q_next != head) { 9719cb8d207SAndrey V. Elsukov IP6STAT_INC(ip6s_fragdropped); 97282cd038dSYoshinobu Inoue /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ 9739cb1a47aSBjoern A. Zeeb frag6_freef(head->ip6q_next, bucket); 97480d7a853SJonathan T. Looney } 9759cb1a47aSBjoern A. Zeeb IP6QB_UNLOCK(bucket); 97682cd038dSYoshinobu Inoue } 97767a10c46SBjoern A. Zeeb } 97867a10c46SBjoern A. Zeeb 97967a10c46SBjoern A. Zeeb void 98067a10c46SBjoern A. Zeeb frag6_drain(void) 98167a10c46SBjoern A. Zeeb { 98267a10c46SBjoern A. Zeeb VNET_ITERATOR_DECL(vnet_iter); 98367a10c46SBjoern A. Zeeb 98467a10c46SBjoern A. Zeeb VNET_LIST_RLOCK_NOSLEEP(); 98567a10c46SBjoern A. Zeeb VNET_FOREACH(vnet_iter) { 98667a10c46SBjoern A. Zeeb CURVNET_SET(vnet_iter); 98767a10c46SBjoern A. Zeeb frag6_drain_one(); 9888b615593SMarko Zec CURVNET_RESTORE(); 9898b615593SMarko Zec } 9905ee847d3SRobert Watson VNET_LIST_RUNLOCK_NOSLEEP(); 99182cd038dSYoshinobu Inoue } 992e5ee7060SGleb Smirnoff 99367a10c46SBjoern A. Zeeb #ifdef VIMAGE 99467a10c46SBjoern A. Zeeb /* 99567a10c46SBjoern A. Zeeb * Clear up IPv6 reassembly structures. 99667a10c46SBjoern A. Zeeb */ 99767a10c46SBjoern A. Zeeb void 99867a10c46SBjoern A. Zeeb frag6_destroy(void) 99967a10c46SBjoern A. Zeeb { 100067a10c46SBjoern A. Zeeb uint32_t bucket; 100167a10c46SBjoern A. Zeeb 100267a10c46SBjoern A. Zeeb frag6_drain_one(); 100367a10c46SBjoern A. Zeeb V_frag6_on = false; 100467a10c46SBjoern A. Zeeb for (bucket = 0; bucket < IP6REASS_NHASH; bucket++) { 100567a10c46SBjoern A. Zeeb KASSERT(V_ip6qb[bucket].count == 0, 100667a10c46SBjoern A. Zeeb ("%s: V_ip6qb[%d] (%p) count not 0 (%d)", __func__, 100767a10c46SBjoern A. Zeeb bucket, &V_ip6qb[bucket], V_ip6qb[bucket].count)); 100867a10c46SBjoern A. Zeeb mtx_destroy(&V_ip6qb[bucket].lock); 100967a10c46SBjoern A. Zeeb } 101067a10c46SBjoern A. Zeeb } 101167a10c46SBjoern A. Zeeb #endif 101267a10c46SBjoern A. Zeeb 1013c00464a2SBjoern A. Zeeb /* 1014c00464a2SBjoern A. Zeeb * Put an ip fragment on a reassembly chain. 1015c00464a2SBjoern A. Zeeb * Like insque, but pointers in middle of structure. 1016c00464a2SBjoern A. Zeeb */ 1017c00464a2SBjoern A. Zeeb static void 1018c00464a2SBjoern A. Zeeb frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6, 1019c00464a2SBjoern A. Zeeb uint32_t bucket __unused) 1020e5ee7060SGleb Smirnoff { 1021e5ee7060SGleb Smirnoff 10229cb1a47aSBjoern A. Zeeb IP6QB_LOCK_ASSERT(bucket); 1023c00464a2SBjoern A. Zeeb 1024c00464a2SBjoern A. Zeeb af6->ip6af_up = up6; 1025c00464a2SBjoern A. Zeeb af6->ip6af_down = up6->ip6af_down; 1026c00464a2SBjoern A. Zeeb up6->ip6af_down->ip6af_up = af6; 1027c00464a2SBjoern A. Zeeb up6->ip6af_down = af6; 1028e5ee7060SGleb Smirnoff } 1029e5ee7060SGleb Smirnoff 1030c00464a2SBjoern A. Zeeb /* 1031c00464a2SBjoern A. Zeeb * To frag6_enq as remque is to insque. 1032c00464a2SBjoern A. Zeeb */ 1033c00464a2SBjoern A. Zeeb static void 1034c00464a2SBjoern A. Zeeb frag6_deq(struct ip6asfrag *af6, uint32_t bucket __unused) 1035c00464a2SBjoern A. Zeeb { 1036c00464a2SBjoern A. Zeeb 10379cb1a47aSBjoern A. Zeeb IP6QB_LOCK_ASSERT(bucket); 1038c00464a2SBjoern A. Zeeb 1039c00464a2SBjoern A. Zeeb af6->ip6af_up->ip6af_down = af6->ip6af_down; 1040c00464a2SBjoern A. Zeeb af6->ip6af_down->ip6af_up = af6->ip6af_up; 1041c00464a2SBjoern A. Zeeb } 1042c00464a2SBjoern A. Zeeb 1043c00464a2SBjoern A. Zeeb static void 1044c00464a2SBjoern A. Zeeb frag6_insque_head(struct ip6q *new, struct ip6q *old, uint32_t bucket) 1045c00464a2SBjoern A. Zeeb { 1046c00464a2SBjoern A. Zeeb 10479cb1a47aSBjoern A. Zeeb IP6QB_LOCK_ASSERT(bucket); 10489cb1a47aSBjoern A. Zeeb KASSERT(IP6QB_HEAD(bucket) == old, 1049c00464a2SBjoern A. Zeeb ("%s: attempt to insert at head of wrong bucket" 1050c00464a2SBjoern A. Zeeb " (bucket=%u, old=%p)", __func__, bucket, old)); 1051c00464a2SBjoern A. Zeeb 1052c00464a2SBjoern A. Zeeb new->ip6q_prev = old; 1053c00464a2SBjoern A. Zeeb new->ip6q_next = old->ip6q_next; 1054c00464a2SBjoern A. Zeeb old->ip6q_next->ip6q_prev= new; 1055c00464a2SBjoern A. Zeeb old->ip6q_next = new; 10569cb1a47aSBjoern A. Zeeb V_ip6qb[bucket].count++; 1057c00464a2SBjoern A. Zeeb } 1058c00464a2SBjoern A. Zeeb 1059c00464a2SBjoern A. Zeeb static void 1060c00464a2SBjoern A. Zeeb frag6_remque(struct ip6q *p6, uint32_t bucket) 1061c00464a2SBjoern A. Zeeb { 1062c00464a2SBjoern A. Zeeb 10639cb1a47aSBjoern A. Zeeb IP6QB_LOCK_ASSERT(bucket); 1064c00464a2SBjoern A. Zeeb 1065c00464a2SBjoern A. Zeeb p6->ip6q_prev->ip6q_next = p6->ip6q_next; 1066c00464a2SBjoern A. Zeeb p6->ip6q_next->ip6q_prev = p6->ip6q_prev; 10679cb1a47aSBjoern A. Zeeb V_ip6qb[bucket].count--; 1068e5ee7060SGleb Smirnoff } 1069