1 /* 6LoWPAN fragment reassembly 2 * 3 * 4 * Authors: 5 * Alexander Aring <aar@pengutronix.de> 6 * 7 * Based on: net/ipv6/reassembly.c 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 */ 14 15 #define pr_fmt(fmt) "6LoWPAN: " fmt 16 17 #include <linux/net.h> 18 #include <linux/list.h> 19 #include <linux/netdevice.h> 20 #include <linux/random.h> 21 #include <linux/jhash.h> 22 #include <linux/skbuff.h> 23 #include <linux/slab.h> 24 #include <linux/export.h> 25 26 #include <net/ieee802154_netdev.h> 27 #include <net/6lowpan.h> 28 #include <net/ipv6.h> 29 #include <net/inet_frag.h> 30 31 #include "6lowpan_i.h" 32 33 static const char lowpan_frags_cache_name[] = "lowpan-frags"; 34 35 static struct inet_frags lowpan_frags; 36 37 static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, 38 struct sk_buff *prev, struct net_device *ldev); 39 40 static void lowpan_frag_init(struct inet_frag_queue *q, const void *a) 41 { 42 const struct frag_lowpan_compare_key *key = a; 43 struct lowpan_frag_queue *fq; 44 45 fq = container_of(q, struct lowpan_frag_queue, q); 46 47 BUILD_BUG_ON(sizeof(*key) > sizeof(q->key)); 48 memcpy(&q->key, key, sizeof(*key)); 49 } 50 51 static void lowpan_frag_expire(struct timer_list *t) 52 { 53 struct inet_frag_queue *frag = from_timer(frag, t, timer); 54 struct frag_queue *fq; 55 struct net *net; 56 57 fq = container_of(frag, struct frag_queue, q); 58 net = container_of(fq->q.net, struct net, ieee802154_lowpan.frags); 59 60 spin_lock(&fq->q.lock); 61 62 if (fq->q.flags & INET_FRAG_COMPLETE) 63 goto out; 64 65 inet_frag_kill(&fq->q); 66 out: 67 spin_unlock(&fq->q.lock); 68 inet_frag_put(&fq->q); 69 } 70 71 static inline struct lowpan_frag_queue * 72 fq_find(struct net *net, const struct lowpan_802154_cb *cb, 73 const struct ieee802154_addr *src, 74 const struct ieee802154_addr *dst) 75 { 76 struct netns_ieee802154_lowpan *ieee802154_lowpan = 77 net_ieee802154_lowpan(net); 78 struct frag_lowpan_compare_key key = { 79 .tag = cb->d_tag, 80 .d_size = cb->d_size, 81 .src = *src, 82 .dst = *dst, 83 }; 84 struct inet_frag_queue *q; 85 86 q = inet_frag_find(&ieee802154_lowpan->frags, &key); 87 if (!q) 88 return NULL; 89 90 return container_of(q, struct lowpan_frag_queue, q); 91 } 92 93 static int lowpan_frag_queue(struct lowpan_frag_queue *fq, 94 struct sk_buff *skb, u8 frag_type) 95 { 96 struct sk_buff *prev, *next; 97 struct net_device *ldev; 98 int end, offset; 99 100 if (fq->q.flags & INET_FRAG_COMPLETE) 101 goto err; 102 103 offset = lowpan_802154_cb(skb)->d_offset << 3; 104 end = lowpan_802154_cb(skb)->d_size; 105 106 /* Is this the final fragment? */ 107 if (offset + skb->len == end) { 108 /* If we already have some bits beyond end 109 * or have different end, the segment is corrupted. 110 */ 111 if (end < fq->q.len || 112 ((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len)) 113 goto err; 114 fq->q.flags |= INET_FRAG_LAST_IN; 115 fq->q.len = end; 116 } else { 117 if (end > fq->q.len) { 118 /* Some bits beyond end -> corruption. */ 119 if (fq->q.flags & INET_FRAG_LAST_IN) 120 goto err; 121 fq->q.len = end; 122 } 123 } 124 125 /* Find out which fragments are in front and at the back of us 126 * in the chain of fragments so far. We must know where to put 127 * this fragment, right? 128 */ 129 prev = fq->q.fragments_tail; 130 if (!prev || 131 lowpan_802154_cb(prev)->d_offset < 132 lowpan_802154_cb(skb)->d_offset) { 133 next = NULL; 134 goto found; 135 } 136 prev = NULL; 137 for (next = fq->q.fragments; next != NULL; next = next->next) { 138 if (lowpan_802154_cb(next)->d_offset >= 139 lowpan_802154_cb(skb)->d_offset) 140 break; /* bingo! */ 141 prev = next; 142 } 143 144 found: 145 /* Insert this fragment in the chain of fragments. */ 146 skb->next = next; 147 if (!next) 148 fq->q.fragments_tail = skb; 149 if (prev) 150 prev->next = skb; 151 else 152 fq->q.fragments = skb; 153 154 ldev = skb->dev; 155 if (ldev) 156 skb->dev = NULL; 157 158 fq->q.stamp = skb->tstamp; 159 if (frag_type == LOWPAN_DISPATCH_FRAG1) 160 fq->q.flags |= INET_FRAG_FIRST_IN; 161 162 fq->q.meat += skb->len; 163 add_frag_mem_limit(fq->q.net, skb->truesize); 164 165 if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && 166 fq->q.meat == fq->q.len) { 167 int res; 168 unsigned long orefdst = skb->_skb_refdst; 169 170 skb->_skb_refdst = 0UL; 171 res = lowpan_frag_reasm(fq, prev, ldev); 172 skb->_skb_refdst = orefdst; 173 return res; 174 } 175 176 return -1; 177 err: 178 kfree_skb(skb); 179 return -1; 180 } 181 182 /* Check if this packet is complete. 183 * Returns NULL on failure by any reason, and pointer 184 * to current nexthdr field in reassembled frame. 185 * 186 * It is called with locked fq, and caller must check that 187 * queue is eligible for reassembly i.e. it is not COMPLETE, 188 * the last and the first frames arrived and all the bits are here. 189 */ 190 static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev, 191 struct net_device *ldev) 192 { 193 struct sk_buff *fp, *head = fq->q.fragments; 194 int sum_truesize; 195 196 inet_frag_kill(&fq->q); 197 198 /* Make the one we just received the head. */ 199 if (prev) { 200 head = prev->next; 201 fp = skb_clone(head, GFP_ATOMIC); 202 203 if (!fp) 204 goto out_oom; 205 206 fp->next = head->next; 207 if (!fp->next) 208 fq->q.fragments_tail = fp; 209 prev->next = fp; 210 211 skb_morph(head, fq->q.fragments); 212 head->next = fq->q.fragments->next; 213 214 consume_skb(fq->q.fragments); 215 fq->q.fragments = head; 216 } 217 218 /* Head of list must not be cloned. */ 219 if (skb_unclone(head, GFP_ATOMIC)) 220 goto out_oom; 221 222 /* If the first fragment is fragmented itself, we split 223 * it to two chunks: the first with data and paged part 224 * and the second, holding only fragments. 225 */ 226 if (skb_has_frag_list(head)) { 227 struct sk_buff *clone; 228 int i, plen = 0; 229 230 clone = alloc_skb(0, GFP_ATOMIC); 231 if (!clone) 232 goto out_oom; 233 clone->next = head->next; 234 head->next = clone; 235 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; 236 skb_frag_list_init(head); 237 for (i = 0; i < skb_shinfo(head)->nr_frags; i++) 238 plen += skb_frag_size(&skb_shinfo(head)->frags[i]); 239 clone->len = head->data_len - plen; 240 clone->data_len = clone->len; 241 head->data_len -= clone->len; 242 head->len -= clone->len; 243 add_frag_mem_limit(fq->q.net, clone->truesize); 244 } 245 246 WARN_ON(head == NULL); 247 248 sum_truesize = head->truesize; 249 for (fp = head->next; fp;) { 250 bool headstolen; 251 int delta; 252 struct sk_buff *next = fp->next; 253 254 sum_truesize += fp->truesize; 255 if (skb_try_coalesce(head, fp, &headstolen, &delta)) { 256 kfree_skb_partial(fp, headstolen); 257 } else { 258 if (!skb_shinfo(head)->frag_list) 259 skb_shinfo(head)->frag_list = fp; 260 head->data_len += fp->len; 261 head->len += fp->len; 262 head->truesize += fp->truesize; 263 } 264 fp = next; 265 } 266 sub_frag_mem_limit(fq->q.net, sum_truesize); 267 268 head->next = NULL; 269 head->dev = ldev; 270 head->tstamp = fq->q.stamp; 271 272 fq->q.fragments = NULL; 273 fq->q.fragments_tail = NULL; 274 275 return 1; 276 out_oom: 277 net_dbg_ratelimited("lowpan_frag_reasm: no memory for reassembly\n"); 278 return -1; 279 } 280 281 static int lowpan_frag_rx_handlers_result(struct sk_buff *skb, 282 lowpan_rx_result res) 283 { 284 switch (res) { 285 case RX_QUEUED: 286 return NET_RX_SUCCESS; 287 case RX_CONTINUE: 288 /* nobody cared about this packet */ 289 net_warn_ratelimited("%s: received unknown dispatch\n", 290 __func__); 291 292 /* fall-through */ 293 default: 294 /* all others failure */ 295 return NET_RX_DROP; 296 } 297 } 298 299 static lowpan_rx_result lowpan_frag_rx_h_iphc(struct sk_buff *skb) 300 { 301 int ret; 302 303 if (!lowpan_is_iphc(*skb_network_header(skb))) 304 return RX_CONTINUE; 305 306 ret = lowpan_iphc_decompress(skb); 307 if (ret < 0) 308 return RX_DROP; 309 310 return RX_QUEUED; 311 } 312 313 static int lowpan_invoke_frag_rx_handlers(struct sk_buff *skb) 314 { 315 lowpan_rx_result res; 316 317 #define CALL_RXH(rxh) \ 318 do { \ 319 res = rxh(skb); \ 320 if (res != RX_CONTINUE) \ 321 goto rxh_next; \ 322 } while (0) 323 324 /* likely at first */ 325 CALL_RXH(lowpan_frag_rx_h_iphc); 326 CALL_RXH(lowpan_rx_h_ipv6); 327 328 rxh_next: 329 return lowpan_frag_rx_handlers_result(skb, res); 330 #undef CALL_RXH 331 } 332 333 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK 0x07 334 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT 8 335 336 static int lowpan_get_cb(struct sk_buff *skb, u8 frag_type, 337 struct lowpan_802154_cb *cb) 338 { 339 bool fail; 340 u8 high = 0, low = 0; 341 __be16 d_tag = 0; 342 343 fail = lowpan_fetch_skb(skb, &high, 1); 344 fail |= lowpan_fetch_skb(skb, &low, 1); 345 /* remove the dispatch value and use first three bits as high value 346 * for the datagram size 347 */ 348 cb->d_size = (high & LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK) << 349 LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT | low; 350 fail |= lowpan_fetch_skb(skb, &d_tag, 2); 351 cb->d_tag = ntohs(d_tag); 352 353 if (frag_type == LOWPAN_DISPATCH_FRAGN) { 354 fail |= lowpan_fetch_skb(skb, &cb->d_offset, 1); 355 } else { 356 skb_reset_network_header(skb); 357 cb->d_offset = 0; 358 /* check if datagram_size has ipv6hdr on FRAG1 */ 359 fail |= cb->d_size < sizeof(struct ipv6hdr); 360 /* check if we can dereference the dispatch value */ 361 fail |= !skb->len; 362 } 363 364 if (unlikely(fail)) 365 return -EIO; 366 367 return 0; 368 } 369 370 int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) 371 { 372 struct lowpan_frag_queue *fq; 373 struct net *net = dev_net(skb->dev); 374 struct lowpan_802154_cb *cb = lowpan_802154_cb(skb); 375 struct ieee802154_hdr hdr; 376 int err; 377 378 if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) 379 goto err; 380 381 err = lowpan_get_cb(skb, frag_type, cb); 382 if (err < 0) 383 goto err; 384 385 if (frag_type == LOWPAN_DISPATCH_FRAG1) { 386 err = lowpan_invoke_frag_rx_handlers(skb); 387 if (err == NET_RX_DROP) 388 goto err; 389 } 390 391 if (cb->d_size > IPV6_MIN_MTU) { 392 net_warn_ratelimited("lowpan_frag_rcv: datagram size exceeds MTU\n"); 393 goto err; 394 } 395 396 fq = fq_find(net, cb, &hdr.source, &hdr.dest); 397 if (fq != NULL) { 398 int ret; 399 400 spin_lock(&fq->q.lock); 401 ret = lowpan_frag_queue(fq, skb, frag_type); 402 spin_unlock(&fq->q.lock); 403 404 inet_frag_put(&fq->q); 405 return ret; 406 } 407 408 err: 409 kfree_skb(skb); 410 return -1; 411 } 412 413 #ifdef CONFIG_SYSCTL 414 static long zero; 415 416 static struct ctl_table lowpan_frags_ns_ctl_table[] = { 417 { 418 .procname = "6lowpanfrag_high_thresh", 419 .data = &init_net.ieee802154_lowpan.frags.high_thresh, 420 .maxlen = sizeof(unsigned long), 421 .mode = 0644, 422 .proc_handler = proc_doulongvec_minmax, 423 .extra1 = &init_net.ieee802154_lowpan.frags.low_thresh 424 }, 425 { 426 .procname = "6lowpanfrag_low_thresh", 427 .data = &init_net.ieee802154_lowpan.frags.low_thresh, 428 .maxlen = sizeof(unsigned long), 429 .mode = 0644, 430 .proc_handler = proc_doulongvec_minmax, 431 .extra1 = &zero, 432 .extra2 = &init_net.ieee802154_lowpan.frags.high_thresh 433 }, 434 { 435 .procname = "6lowpanfrag_time", 436 .data = &init_net.ieee802154_lowpan.frags.timeout, 437 .maxlen = sizeof(int), 438 .mode = 0644, 439 .proc_handler = proc_dointvec_jiffies, 440 }, 441 { } 442 }; 443 444 /* secret interval has been deprecated */ 445 static int lowpan_frags_secret_interval_unused; 446 static struct ctl_table lowpan_frags_ctl_table[] = { 447 { 448 .procname = "6lowpanfrag_secret_interval", 449 .data = &lowpan_frags_secret_interval_unused, 450 .maxlen = sizeof(int), 451 .mode = 0644, 452 .proc_handler = proc_dointvec_jiffies, 453 }, 454 { } 455 }; 456 457 static int __net_init lowpan_frags_ns_sysctl_register(struct net *net) 458 { 459 struct ctl_table *table; 460 struct ctl_table_header *hdr; 461 struct netns_ieee802154_lowpan *ieee802154_lowpan = 462 net_ieee802154_lowpan(net); 463 464 table = lowpan_frags_ns_ctl_table; 465 if (!net_eq(net, &init_net)) { 466 table = kmemdup(table, sizeof(lowpan_frags_ns_ctl_table), 467 GFP_KERNEL); 468 if (table == NULL) 469 goto err_alloc; 470 471 table[0].data = &ieee802154_lowpan->frags.high_thresh; 472 table[0].extra1 = &ieee802154_lowpan->frags.low_thresh; 473 table[0].extra2 = &init_net.ieee802154_lowpan.frags.high_thresh; 474 table[1].data = &ieee802154_lowpan->frags.low_thresh; 475 table[1].extra2 = &ieee802154_lowpan->frags.high_thresh; 476 table[2].data = &ieee802154_lowpan->frags.timeout; 477 478 /* Don't export sysctls to unprivileged users */ 479 if (net->user_ns != &init_user_ns) 480 table[0].procname = NULL; 481 } 482 483 hdr = register_net_sysctl(net, "net/ieee802154/6lowpan", table); 484 if (hdr == NULL) 485 goto err_reg; 486 487 ieee802154_lowpan->sysctl.frags_hdr = hdr; 488 return 0; 489 490 err_reg: 491 if (!net_eq(net, &init_net)) 492 kfree(table); 493 err_alloc: 494 return -ENOMEM; 495 } 496 497 static void __net_exit lowpan_frags_ns_sysctl_unregister(struct net *net) 498 { 499 struct ctl_table *table; 500 struct netns_ieee802154_lowpan *ieee802154_lowpan = 501 net_ieee802154_lowpan(net); 502 503 table = ieee802154_lowpan->sysctl.frags_hdr->ctl_table_arg; 504 unregister_net_sysctl_table(ieee802154_lowpan->sysctl.frags_hdr); 505 if (!net_eq(net, &init_net)) 506 kfree(table); 507 } 508 509 static struct ctl_table_header *lowpan_ctl_header; 510 511 static int __init lowpan_frags_sysctl_register(void) 512 { 513 lowpan_ctl_header = register_net_sysctl(&init_net, 514 "net/ieee802154/6lowpan", 515 lowpan_frags_ctl_table); 516 return lowpan_ctl_header == NULL ? -ENOMEM : 0; 517 } 518 519 static void lowpan_frags_sysctl_unregister(void) 520 { 521 unregister_net_sysctl_table(lowpan_ctl_header); 522 } 523 #else 524 static inline int lowpan_frags_ns_sysctl_register(struct net *net) 525 { 526 return 0; 527 } 528 529 static inline void lowpan_frags_ns_sysctl_unregister(struct net *net) 530 { 531 } 532 533 static inline int __init lowpan_frags_sysctl_register(void) 534 { 535 return 0; 536 } 537 538 static inline void lowpan_frags_sysctl_unregister(void) 539 { 540 } 541 #endif 542 543 static int __net_init lowpan_frags_init_net(struct net *net) 544 { 545 struct netns_ieee802154_lowpan *ieee802154_lowpan = 546 net_ieee802154_lowpan(net); 547 int res; 548 549 ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; 550 ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; 551 ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; 552 ieee802154_lowpan->frags.f = &lowpan_frags; 553 554 res = inet_frags_init_net(&ieee802154_lowpan->frags); 555 if (res < 0) 556 return res; 557 res = lowpan_frags_ns_sysctl_register(net); 558 if (res < 0) 559 inet_frags_exit_net(&ieee802154_lowpan->frags); 560 return res; 561 } 562 563 static void __net_exit lowpan_frags_exit_net(struct net *net) 564 { 565 struct netns_ieee802154_lowpan *ieee802154_lowpan = 566 net_ieee802154_lowpan(net); 567 568 lowpan_frags_ns_sysctl_unregister(net); 569 inet_frags_exit_net(&ieee802154_lowpan->frags); 570 } 571 572 static struct pernet_operations lowpan_frags_ops = { 573 .init = lowpan_frags_init_net, 574 .exit = lowpan_frags_exit_net, 575 }; 576 577 static u32 lowpan_key_hashfn(const void *data, u32 len, u32 seed) 578 { 579 return jhash2(data, 580 sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); 581 } 582 583 static u32 lowpan_obj_hashfn(const void *data, u32 len, u32 seed) 584 { 585 const struct inet_frag_queue *fq = data; 586 587 return jhash2((const u32 *)&fq->key, 588 sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); 589 } 590 591 static int lowpan_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) 592 { 593 const struct frag_lowpan_compare_key *key = arg->key; 594 const struct inet_frag_queue *fq = ptr; 595 596 return !!memcmp(&fq->key, key, sizeof(*key)); 597 } 598 599 static const struct rhashtable_params lowpan_rhash_params = { 600 .head_offset = offsetof(struct inet_frag_queue, node), 601 .hashfn = lowpan_key_hashfn, 602 .obj_hashfn = lowpan_obj_hashfn, 603 .obj_cmpfn = lowpan_obj_cmpfn, 604 .automatic_shrinking = true, 605 }; 606 607 int __init lowpan_net_frag_init(void) 608 { 609 int ret; 610 611 lowpan_frags.constructor = lowpan_frag_init; 612 lowpan_frags.destructor = NULL; 613 lowpan_frags.qsize = sizeof(struct frag_queue); 614 lowpan_frags.frag_expire = lowpan_frag_expire; 615 lowpan_frags.frags_cache_name = lowpan_frags_cache_name; 616 lowpan_frags.rhash_params = lowpan_rhash_params; 617 ret = inet_frags_init(&lowpan_frags); 618 if (ret) 619 goto out; 620 621 ret = lowpan_frags_sysctl_register(); 622 if (ret) 623 goto err_sysctl; 624 625 ret = register_pernet_subsys(&lowpan_frags_ops); 626 if (ret) 627 goto err_pernet; 628 out: 629 return ret; 630 err_pernet: 631 lowpan_frags_sysctl_unregister(); 632 err_sysctl: 633 inet_frags_fini(&lowpan_frags); 634 return ret; 635 } 636 637 void lowpan_net_frag_exit(void) 638 { 639 inet_frags_fini(&lowpan_frags); 640 lowpan_frags_sysctl_unregister(); 641 unregister_pernet_subsys(&lowpan_frags_ops); 642 } 643