1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (C) 2013-2019 B.A.T.M.A.N. contributors: 3 * 4 * Martin Hundebøll <martin@hundeboll.net> 5 */ 6 7 #include "fragmentation.h" 8 #include "main.h" 9 10 #include <linux/atomic.h> 11 #include <linux/byteorder/generic.h> 12 #include <linux/errno.h> 13 #include <linux/etherdevice.h> 14 #include <linux/gfp.h> 15 #include <linux/if_ether.h> 16 #include <linux/jiffies.h> 17 #include <linux/kernel.h> 18 #include <linux/lockdep.h> 19 #include <linux/netdevice.h> 20 #include <linux/skbuff.h> 21 #include <linux/slab.h> 22 #include <linux/spinlock.h> 23 #include <linux/string.h> 24 #include <uapi/linux/batadv_packet.h> 25 26 #include "hard-interface.h" 27 #include "originator.h" 28 #include "routing.h" 29 #include "send.h" 30 #include "soft-interface.h" 31 32 /** 33 * batadv_frag_clear_chain() - delete entries in the fragment buffer chain 34 * @head: head of chain with entries. 35 * @dropped: whether the chain is cleared because all fragments are dropped 36 * 37 * Free fragments in the passed hlist. Should be called with appropriate lock. 38 */ 39 static void batadv_frag_clear_chain(struct hlist_head *head, bool dropped) 40 { 41 struct batadv_frag_list_entry *entry; 42 struct hlist_node *node; 43 44 hlist_for_each_entry_safe(entry, node, head, list) { 45 hlist_del(&entry->list); 46 47 if (dropped) 48 kfree_skb(entry->skb); 49 else 50 consume_skb(entry->skb); 51 52 kfree(entry); 53 } 54 } 55 56 /** 57 * batadv_frag_purge_orig() - free fragments associated to an orig 58 * @orig_node: originator to free fragments from 59 * @check_cb: optional function to tell if an entry should be purged 60 */ 61 void batadv_frag_purge_orig(struct batadv_orig_node *orig_node, 62 bool (*check_cb)(struct batadv_frag_table_entry *)) 63 { 64 struct batadv_frag_table_entry *chain; 65 u8 i; 66 67 for (i = 0; i < BATADV_FRAG_BUFFER_COUNT; i++) { 68 chain = &orig_node->fragments[i]; 69 spin_lock_bh(&chain->lock); 70 71 if (!check_cb || check_cb(chain)) { 72 batadv_frag_clear_chain(&chain->fragment_list, true); 73 chain->size = 0; 74 } 75 76 spin_unlock_bh(&chain->lock); 77 } 78 } 79 80 /** 81 * batadv_frag_size_limit() - maximum possible size of packet to be fragmented 82 * 83 * Return: the maximum size of payload that can be fragmented. 84 */ 85 static int batadv_frag_size_limit(void) 86 { 87 int limit = BATADV_FRAG_MAX_FRAG_SIZE; 88 89 limit -= sizeof(struct batadv_frag_packet); 90 limit *= BATADV_FRAG_MAX_FRAGMENTS; 91 92 return limit; 93 } 94 95 /** 96 * batadv_frag_init_chain() - check and prepare fragment chain for new fragment 97 * @chain: chain in fragments table to init 98 * @seqno: sequence number of the received fragment 99 * 100 * Make chain ready for a fragment with sequence number "seqno". Delete existing 101 * entries if they have an "old" sequence number. 102 * 103 * Caller must hold chain->lock. 104 * 105 * Return: true if chain is empty and caller can just insert the new fragment 106 * without searching for the right position. 107 */ 108 static bool batadv_frag_init_chain(struct batadv_frag_table_entry *chain, 109 u16 seqno) 110 { 111 lockdep_assert_held(&chain->lock); 112 113 if (chain->seqno == seqno) 114 return false; 115 116 if (!hlist_empty(&chain->fragment_list)) 117 batadv_frag_clear_chain(&chain->fragment_list, true); 118 119 chain->size = 0; 120 chain->seqno = seqno; 121 122 return true; 123 } 124 125 /** 126 * batadv_frag_insert_packet() - insert a fragment into a fragment chain 127 * @orig_node: originator that the fragment was received from 128 * @skb: skb to insert 129 * @chain_out: list head to attach complete chains of fragments to 130 * 131 * Insert a new fragment into the reverse ordered chain in the right table 132 * entry. The hash table entry is cleared if "old" fragments exist in it. 133 * 134 * Return: true if skb is buffered, false on error. If the chain has all the 135 * fragments needed to merge the packet, the chain is moved to the passed head 136 * to avoid locking the chain in the table. 137 */ 138 static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, 139 struct sk_buff *skb, 140 struct hlist_head *chain_out) 141 { 142 struct batadv_frag_table_entry *chain; 143 struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr; 144 struct batadv_frag_list_entry *frag_entry_last = NULL; 145 struct batadv_frag_packet *frag_packet; 146 u8 bucket; 147 u16 seqno, hdr_size = sizeof(struct batadv_frag_packet); 148 bool ret = false; 149 150 /* Linearize packet to avoid linearizing 16 packets in a row when doing 151 * the later merge. Non-linear merge should be added to remove this 152 * linearization. 153 */ 154 if (skb_linearize(skb) < 0) 155 goto err; 156 157 frag_packet = (struct batadv_frag_packet *)skb->data; 158 seqno = ntohs(frag_packet->seqno); 159 bucket = seqno % BATADV_FRAG_BUFFER_COUNT; 160 161 frag_entry_new = kmalloc(sizeof(*frag_entry_new), GFP_ATOMIC); 162 if (!frag_entry_new) 163 goto err; 164 165 frag_entry_new->skb = skb; 166 frag_entry_new->no = frag_packet->no; 167 168 /* Select entry in the "chain table" and delete any prior fragments 169 * with another sequence number. batadv_frag_init_chain() returns true, 170 * if the list is empty at return. 171 */ 172 chain = &orig_node->fragments[bucket]; 173 spin_lock_bh(&chain->lock); 174 if (batadv_frag_init_chain(chain, seqno)) { 175 hlist_add_head(&frag_entry_new->list, &chain->fragment_list); 176 chain->size = skb->len - hdr_size; 177 chain->timestamp = jiffies; 178 chain->total_size = ntohs(frag_packet->total_size); 179 ret = true; 180 goto out; 181 } 182 183 /* Find the position for the new fragment. */ 184 hlist_for_each_entry(frag_entry_curr, &chain->fragment_list, list) { 185 /* Drop packet if fragment already exists. */ 186 if (frag_entry_curr->no == frag_entry_new->no) 187 goto err_unlock; 188 189 /* Order fragments from highest to lowest. */ 190 if (frag_entry_curr->no < frag_entry_new->no) { 191 hlist_add_before(&frag_entry_new->list, 192 &frag_entry_curr->list); 193 chain->size += skb->len - hdr_size; 194 chain->timestamp = jiffies; 195 ret = true; 196 goto out; 197 } 198 199 /* store current entry because it could be the last in list */ 200 frag_entry_last = frag_entry_curr; 201 } 202 203 /* Reached the end of the list, so insert after 'frag_entry_last'. */ 204 if (likely(frag_entry_last)) { 205 hlist_add_behind(&frag_entry_new->list, &frag_entry_last->list); 206 chain->size += skb->len - hdr_size; 207 chain->timestamp = jiffies; 208 ret = true; 209 } 210 211 out: 212 if (chain->size > batadv_frag_size_limit() || 213 chain->total_size != ntohs(frag_packet->total_size) || 214 chain->total_size > batadv_frag_size_limit()) { 215 /* Clear chain if total size of either the list or the packet 216 * exceeds the maximum size of one merged packet. Don't allow 217 * packets to have different total_size. 218 */ 219 batadv_frag_clear_chain(&chain->fragment_list, true); 220 chain->size = 0; 221 } else if (ntohs(frag_packet->total_size) == chain->size) { 222 /* All fragments received. Hand over chain to caller. */ 223 hlist_move_list(&chain->fragment_list, chain_out); 224 chain->size = 0; 225 } 226 227 err_unlock: 228 spin_unlock_bh(&chain->lock); 229 230 err: 231 if (!ret) { 232 kfree(frag_entry_new); 233 kfree_skb(skb); 234 } 235 236 return ret; 237 } 238 239 /** 240 * batadv_frag_merge_packets() - merge a chain of fragments 241 * @chain: head of chain with fragments 242 * 243 * Expand the first skb in the chain and copy the content of the remaining 244 * skb's into the expanded one. After doing so, clear the chain. 245 * 246 * Return: the merged skb or NULL on error. 247 */ 248 static struct sk_buff * 249 batadv_frag_merge_packets(struct hlist_head *chain) 250 { 251 struct batadv_frag_packet *packet; 252 struct batadv_frag_list_entry *entry; 253 struct sk_buff *skb_out; 254 int size, hdr_size = sizeof(struct batadv_frag_packet); 255 bool dropped = false; 256 257 /* Remove first entry, as this is the destination for the rest of the 258 * fragments. 259 */ 260 entry = hlist_entry(chain->first, struct batadv_frag_list_entry, list); 261 hlist_del(&entry->list); 262 skb_out = entry->skb; 263 kfree(entry); 264 265 packet = (struct batadv_frag_packet *)skb_out->data; 266 size = ntohs(packet->total_size) + hdr_size; 267 268 /* Make room for the rest of the fragments. */ 269 if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { 270 kfree_skb(skb_out); 271 skb_out = NULL; 272 dropped = true; 273 goto free; 274 } 275 276 /* Move the existing MAC header to just before the payload. (Override 277 * the fragment header.) 278 */ 279 skb_pull(skb_out, hdr_size); 280 skb_out->ip_summed = CHECKSUM_NONE; 281 memmove(skb_out->data - ETH_HLEN, skb_mac_header(skb_out), ETH_HLEN); 282 skb_set_mac_header(skb_out, -ETH_HLEN); 283 skb_reset_network_header(skb_out); 284 skb_reset_transport_header(skb_out); 285 286 /* Copy the payload of the each fragment into the last skb */ 287 hlist_for_each_entry(entry, chain, list) { 288 size = entry->skb->len - hdr_size; 289 skb_put_data(skb_out, entry->skb->data + hdr_size, size); 290 } 291 292 free: 293 /* Locking is not needed, because 'chain' is not part of any orig. */ 294 batadv_frag_clear_chain(chain, dropped); 295 return skb_out; 296 } 297 298 /** 299 * batadv_frag_skb_buffer() - buffer fragment for later merge 300 * @skb: skb to buffer 301 * @orig_node_src: originator that the skb is received from 302 * 303 * Add fragment to buffer and merge fragments if possible. 304 * 305 * There are three possible outcomes: 1) Packet is merged: Return true and 306 * set *skb to merged packet; 2) Packet is buffered: Return true and set *skb 307 * to NULL; 3) Error: Return false and free skb. 308 * 309 * Return: true when packet is merged or buffered, false when skb is not not 310 * used. 311 */ 312 bool batadv_frag_skb_buffer(struct sk_buff **skb, 313 struct batadv_orig_node *orig_node_src) 314 { 315 struct sk_buff *skb_out = NULL; 316 struct hlist_head head = HLIST_HEAD_INIT; 317 bool ret = false; 318 319 /* Add packet to buffer and table entry if merge is possible. */ 320 if (!batadv_frag_insert_packet(orig_node_src, *skb, &head)) 321 goto out_err; 322 323 /* Leave if more fragments are needed to merge. */ 324 if (hlist_empty(&head)) 325 goto out; 326 327 skb_out = batadv_frag_merge_packets(&head); 328 if (!skb_out) 329 goto out_err; 330 331 out: 332 ret = true; 333 out_err: 334 *skb = skb_out; 335 return ret; 336 } 337 338 /** 339 * batadv_frag_skb_fwd() - forward fragments that would exceed MTU when merged 340 * @skb: skb to forward 341 * @recv_if: interface that the skb is received on 342 * @orig_node_src: originator that the skb is received from 343 * 344 * Look up the next-hop of the fragments payload and check if the merged packet 345 * will exceed the MTU towards the next-hop. If so, the fragment is forwarded 346 * without merging it. 347 * 348 * Return: true if the fragment is consumed/forwarded, false otherwise. 349 */ 350 bool batadv_frag_skb_fwd(struct sk_buff *skb, 351 struct batadv_hard_iface *recv_if, 352 struct batadv_orig_node *orig_node_src) 353 { 354 struct batadv_priv *bat_priv = netdev_priv(recv_if->soft_iface); 355 struct batadv_orig_node *orig_node_dst; 356 struct batadv_neigh_node *neigh_node = NULL; 357 struct batadv_frag_packet *packet; 358 u16 total_size; 359 bool ret = false; 360 361 packet = (struct batadv_frag_packet *)skb->data; 362 orig_node_dst = batadv_orig_hash_find(bat_priv, packet->dest); 363 if (!orig_node_dst) 364 goto out; 365 366 neigh_node = batadv_find_router(bat_priv, orig_node_dst, recv_if); 367 if (!neigh_node) 368 goto out; 369 370 /* Forward the fragment, if the merged packet would be too big to 371 * be assembled. 372 */ 373 total_size = ntohs(packet->total_size); 374 if (total_size > neigh_node->if_incoming->net_dev->mtu) { 375 batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_FWD); 376 batadv_add_counter(bat_priv, BATADV_CNT_FRAG_FWD_BYTES, 377 skb->len + ETH_HLEN); 378 379 packet->ttl--; 380 batadv_send_unicast_skb(skb, neigh_node); 381 ret = true; 382 } 383 384 out: 385 if (orig_node_dst) 386 batadv_orig_node_put(orig_node_dst); 387 if (neigh_node) 388 batadv_neigh_node_put(neigh_node); 389 return ret; 390 } 391 392 /** 393 * batadv_frag_create() - create a fragment from skb 394 * @skb: skb to create fragment from 395 * @frag_head: header to use in new fragment 396 * @fragment_size: size of new fragment 397 * 398 * Split the passed skb into two fragments: A new one with size matching the 399 * passed mtu and the old one with the rest. The new skb contains data from the 400 * tail of the old skb. 401 * 402 * Return: the new fragment, NULL on error. 403 */ 404 static struct sk_buff *batadv_frag_create(struct sk_buff *skb, 405 struct batadv_frag_packet *frag_head, 406 unsigned int fragment_size) 407 { 408 struct sk_buff *skb_fragment; 409 unsigned int header_size = sizeof(*frag_head); 410 unsigned int mtu = fragment_size + header_size; 411 412 skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN); 413 if (!skb_fragment) 414 goto err; 415 416 skb_fragment->priority = skb->priority; 417 418 /* Eat the last mtu-bytes of the skb */ 419 skb_reserve(skb_fragment, header_size + ETH_HLEN); 420 skb_split(skb, skb_fragment, skb->len - fragment_size); 421 422 /* Add the header */ 423 skb_push(skb_fragment, header_size); 424 memcpy(skb_fragment->data, frag_head, header_size); 425 426 err: 427 return skb_fragment; 428 } 429 430 /** 431 * batadv_frag_send_packet() - create up to 16 fragments from the passed skb 432 * @skb: skb to create fragments from 433 * @orig_node: final destination of the created fragments 434 * @neigh_node: next-hop of the created fragments 435 * 436 * Return: the netdev tx status or a negative errno code on a failure 437 */ 438 int batadv_frag_send_packet(struct sk_buff *skb, 439 struct batadv_orig_node *orig_node, 440 struct batadv_neigh_node *neigh_node) 441 { 442 struct batadv_priv *bat_priv; 443 struct batadv_hard_iface *primary_if = NULL; 444 struct batadv_frag_packet frag_header; 445 struct sk_buff *skb_fragment; 446 unsigned int mtu = neigh_node->if_incoming->net_dev->mtu; 447 unsigned int header_size = sizeof(frag_header); 448 unsigned int max_fragment_size, num_fragments; 449 int ret; 450 451 /* To avoid merge and refragmentation at next-hops we never send 452 * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE 453 */ 454 mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE); 455 max_fragment_size = mtu - header_size; 456 457 if (skb->len == 0 || max_fragment_size == 0) 458 return -EINVAL; 459 460 num_fragments = (skb->len - 1) / max_fragment_size + 1; 461 max_fragment_size = (skb->len - 1) / num_fragments + 1; 462 463 /* Don't even try to fragment, if we need more than 16 fragments */ 464 if (num_fragments > BATADV_FRAG_MAX_FRAGMENTS) { 465 ret = -EAGAIN; 466 goto free_skb; 467 } 468 469 bat_priv = orig_node->bat_priv; 470 primary_if = batadv_primary_if_get_selected(bat_priv); 471 if (!primary_if) { 472 ret = -EINVAL; 473 goto free_skb; 474 } 475 476 /* Create one header to be copied to all fragments */ 477 frag_header.packet_type = BATADV_UNICAST_FRAG; 478 frag_header.version = BATADV_COMPAT_VERSION; 479 frag_header.ttl = BATADV_TTL; 480 frag_header.seqno = htons(atomic_inc_return(&bat_priv->frag_seqno)); 481 frag_header.reserved = 0; 482 frag_header.no = 0; 483 frag_header.total_size = htons(skb->len); 484 485 /* skb->priority values from 256->263 are magic values to 486 * directly indicate a specific 802.1d priority. This is used 487 * to allow 802.1d priority to be passed directly in from VLAN 488 * tags, etc. 489 */ 490 if (skb->priority >= 256 && skb->priority <= 263) 491 frag_header.priority = skb->priority - 256; 492 else 493 frag_header.priority = 0; 494 495 ether_addr_copy(frag_header.orig, primary_if->net_dev->dev_addr); 496 ether_addr_copy(frag_header.dest, orig_node->orig); 497 498 /* Eat and send fragments from the tail of skb */ 499 while (skb->len > max_fragment_size) { 500 /* The initial check in this function should cover this case */ 501 if (unlikely(frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1)) { 502 ret = -EINVAL; 503 goto put_primary_if; 504 } 505 506 skb_fragment = batadv_frag_create(skb, &frag_header, 507 max_fragment_size); 508 if (!skb_fragment) { 509 ret = -ENOMEM; 510 goto put_primary_if; 511 } 512 513 batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_TX); 514 batadv_add_counter(bat_priv, BATADV_CNT_FRAG_TX_BYTES, 515 skb_fragment->len + ETH_HLEN); 516 ret = batadv_send_unicast_skb(skb_fragment, neigh_node); 517 if (ret != NET_XMIT_SUCCESS) { 518 ret = NET_XMIT_DROP; 519 goto put_primary_if; 520 } 521 522 frag_header.no++; 523 } 524 525 /* Make room for the fragment header. */ 526 if (batadv_skb_head_push(skb, header_size) < 0 || 527 pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) { 528 ret = -ENOMEM; 529 goto put_primary_if; 530 } 531 532 memcpy(skb->data, &frag_header, header_size); 533 534 /* Send the last fragment */ 535 batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_TX); 536 batadv_add_counter(bat_priv, BATADV_CNT_FRAG_TX_BYTES, 537 skb->len + ETH_HLEN); 538 ret = batadv_send_unicast_skb(skb, neigh_node); 539 /* skb was consumed */ 540 skb = NULL; 541 542 put_primary_if: 543 batadv_hardif_put(primary_if); 544 free_skb: 545 kfree_skb(skb); 546 547 return ret; 548 } 549