1b2441318SGreg Kroah-Hartman // SPDX-License-Identifier: GPL-2.0 21da177e4SLinus Torvalds /* 31da177e4SLinus Torvalds * INET An implementation of the TCP/IP protocol suite for the LINUX 41da177e4SLinus Torvalds * operating system. INET is implemented using the BSD Socket 51da177e4SLinus Torvalds * interface as the means of communication with the user level. 61da177e4SLinus Torvalds * 71da177e4SLinus Torvalds * The IP fragmentation functionality. 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG> 10113aa838SAlan Cox * Alan Cox <alan@lxorguk.ukuu.org.uk> 111da177e4SLinus Torvalds * 121da177e4SLinus Torvalds * Fixes: 131da177e4SLinus Torvalds * Alan Cox : Split from ip.c , see ip_input.c for history. 141da177e4SLinus Torvalds * David S. Miller : Begin massive cleanup... 151da177e4SLinus Torvalds * Andi Kleen : Add sysctls. 161da177e4SLinus Torvalds * xxxx : Overlapfrag bug. 171da177e4SLinus Torvalds * Ultima : ip_expire() kernel panic. 181da177e4SLinus Torvalds * Bill Hawes : Frag accounting and evictor fixes. 191da177e4SLinus Torvalds * John McDonald : 0 length frag bug. 201da177e4SLinus Torvalds * Alexey Kuznetsov: SMP races, threading, cleanup. 211da177e4SLinus Torvalds * Patrick McHardy : LRU queue of frag heads for evictor. 221da177e4SLinus Torvalds */ 231da177e4SLinus Torvalds 24afd46503SJoe Perches #define pr_fmt(fmt) "IPv4: " fmt 25afd46503SJoe Perches 2689cee8b1SHerbert Xu #include <linux/compiler.h> 271da177e4SLinus Torvalds #include <linux/module.h> 281da177e4SLinus Torvalds #include <linux/types.h> 291da177e4SLinus Torvalds #include <linux/mm.h> 301da177e4SLinus Torvalds #include <linux/jiffies.h> 311da177e4SLinus Torvalds #include <linux/skbuff.h> 321da177e4SLinus Torvalds #include <linux/list.h> 331da177e4SLinus Torvalds #include <linux/ip.h> 341da177e4SLinus Torvalds #include <linux/icmp.h> 351da177e4SLinus Torvalds #include <linux/netdevice.h> 361da177e4SLinus Torvalds #include <linux/jhash.h> 371da177e4SLinus Torvalds #include <linux/random.h> 385a0e3ad6STejun Heo #include <linux/slab.h> 39e9017b55SShan Wei #include <net/route.h> 40e9017b55SShan Wei #include <net/dst.h> 411da177e4SLinus Torvalds #include <net/sock.h> 421da177e4SLinus Torvalds #include <net/ip.h> 431da177e4SLinus Torvalds #include <net/icmp.h> 441da177e4SLinus Torvalds #include <net/checksum.h> 4589cee8b1SHerbert Xu #include <net/inetpeer.h> 465ab11c98SPavel Emelyanov #include <net/inet_frag.h> 471da177e4SLinus Torvalds #include <linux/tcp.h> 481da177e4SLinus Torvalds #include <linux/udp.h> 491da177e4SLinus Torvalds #include <linux/inet.h> 501da177e4SLinus Torvalds #include <linux/netfilter_ipv4.h> 516623e3b2SEric Dumazet #include <net/inet_ecn.h> 52385add90SDavid Ahern #include <net/l3mdev.h> 531da177e4SLinus Torvalds 541da177e4SLinus Torvalds /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6 551da177e4SLinus Torvalds * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c 561da177e4SLinus Torvalds * as well. Or notify me, at least. --ANK 571da177e4SLinus Torvalds */ 58d4ad4d22SNikolay Aleksandrov static const char ip_frag_cache_name[] = "ip4-frags"; 5989cee8b1SHerbert Xu 601da177e4SLinus Torvalds struct ipfrag_skb_cb 611da177e4SLinus Torvalds { 621da177e4SLinus Torvalds struct inet_skb_parm h; 631da177e4SLinus Torvalds int offset; 641da177e4SLinus Torvalds }; 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds #define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds /* Describe an entry in the "incomplete datagrams" queue. */ 691da177e4SLinus Torvalds struct ipq { 705ab11c98SPavel Emelyanov struct inet_frag_queue q; 715ab11c98SPavel Emelyanov 721da177e4SLinus Torvalds u32 user; 7318277770SAl Viro __be32 saddr; 7418277770SAl Viro __be32 daddr; 7518277770SAl Viro __be16 id; 761da177e4SLinus Torvalds u8 protocol; 776623e3b2SEric Dumazet u8 ecn; /* RFC3168 support */ 78d6b915e2SFlorian Westphal u16 max_df_size; /* largest frag with DF set seen */ 7989cee8b1SHerbert Xu int iif; 80385add90SDavid Ahern int vif; /* L3 master device index */ 8189cee8b1SHerbert Xu unsigned int rid; 8289cee8b1SHerbert Xu struct inet_peer *peer; 831da177e4SLinus Torvalds }; 841da177e4SLinus Torvalds 85aa1f731eSFabian Frederick static u8 ip4_frag_ecn(u8 tos) 866623e3b2SEric Dumazet { 875173cc05SEric Dumazet return 1 << (tos & INET_ECN_MASK); 886623e3b2SEric Dumazet } 896623e3b2SEric Dumazet 907eb95156SPavel Emelyanov static struct inet_frags ip4_frags; 911da177e4SLinus Torvalds 926ddc0822SPavel Emelyanov int ip_frag_mem(struct net *net) 937eb95156SPavel Emelyanov { 94d433673eSJesper Dangaard Brouer return sum_frag_mem_limit(&net->ipv4.frags); 957eb95156SPavel Emelyanov } 961da177e4SLinus Torvalds 971706d587SHerbert Xu static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, 981706d587SHerbert Xu struct net_device *dev); 991706d587SHerbert Xu 100c6fda282SPavel Emelyanov struct ip4_create_arg { 101c6fda282SPavel Emelyanov struct iphdr *iph; 102c6fda282SPavel Emelyanov u32 user; 1039972f134SDavid Ahern int vif; 104c6fda282SPavel Emelyanov }; 105c6fda282SPavel Emelyanov 10618277770SAl Viro static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) 1071da177e4SLinus Torvalds { 108e7b519baSHannes Frederic Sowa net_get_random_once(&ip4_frags.rnd, sizeof(ip4_frags.rnd)); 10918277770SAl Viro return jhash_3words((__force u32)id << 16 | prot, 11018277770SAl Viro (__force u32)saddr, (__force u32)daddr, 111fb3cfe6eSFlorian Westphal ip4_frags.rnd); 1121da177e4SLinus Torvalds } 1131da177e4SLinus Torvalds 11436c77782SFlorian Westphal static unsigned int ip4_hashfn(const struct inet_frag_queue *q) 1151da177e4SLinus Torvalds { 11636c77782SFlorian Westphal const struct ipq *ipq; 1171da177e4SLinus Torvalds 118321a3a99SPavel Emelyanov ipq = container_of(q, struct ipq, q); 119321a3a99SPavel Emelyanov return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol); 1201da177e4SLinus Torvalds } 1211da177e4SLinus Torvalds 12236c77782SFlorian Westphal static bool ip4_frag_match(const struct inet_frag_queue *q, const void *a) 123abd6523dSPavel Emelyanov { 12436c77782SFlorian Westphal const struct ipq *qp; 12536c77782SFlorian Westphal const struct ip4_create_arg *arg = a; 126abd6523dSPavel Emelyanov 127abd6523dSPavel Emelyanov qp = container_of(q, struct ipq, q); 128a02cec21SEric Dumazet return qp->id == arg->iph->id && 129abd6523dSPavel Emelyanov qp->saddr == arg->iph->saddr && 130abd6523dSPavel Emelyanov qp->daddr == arg->iph->daddr && 131abd6523dSPavel Emelyanov qp->protocol == arg->iph->protocol && 1329972f134SDavid Ahern qp->user == arg->user && 1339972f134SDavid Ahern qp->vif == arg->vif; 134abd6523dSPavel Emelyanov } 135abd6523dSPavel Emelyanov 13636c77782SFlorian Westphal static void ip4_frag_init(struct inet_frag_queue *q, const void *a) 137c6fda282SPavel Emelyanov { 138c6fda282SPavel Emelyanov struct ipq *qp = container_of(q, struct ipq, q); 13954db0cc2SGao feng struct netns_ipv4 *ipv4 = container_of(q->net, struct netns_ipv4, 14054db0cc2SGao feng frags); 14154db0cc2SGao feng struct net *net = container_of(ipv4, struct net, ipv4); 14254db0cc2SGao feng 14336c77782SFlorian Westphal const struct ip4_create_arg *arg = a; 144c6fda282SPavel Emelyanov 145c6fda282SPavel Emelyanov qp->protocol = arg->iph->protocol; 146c6fda282SPavel Emelyanov qp->id = arg->iph->id; 1476623e3b2SEric Dumazet qp->ecn = ip4_frag_ecn(arg->iph->tos); 148c6fda282SPavel Emelyanov qp->saddr = arg->iph->saddr; 149c6fda282SPavel Emelyanov qp->daddr = arg->iph->daddr; 1509972f134SDavid Ahern qp->vif = arg->vif; 151c6fda282SPavel Emelyanov qp->user = arg->user; 1520fbf4cb2SNikolay Borisov qp->peer = q->net->max_dist ? 153192132b9SDavid Ahern inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, arg->vif, 1) : 154192132b9SDavid Ahern NULL; 155c6fda282SPavel Emelyanov } 156c6fda282SPavel Emelyanov 157aa1f731eSFabian Frederick static void ip4_frag_free(struct inet_frag_queue *q) 1581da177e4SLinus Torvalds { 1591e4b8287SPavel Emelyanov struct ipq *qp; 1601e4b8287SPavel Emelyanov 1611e4b8287SPavel Emelyanov qp = container_of(q, struct ipq, q); 1621e4b8287SPavel Emelyanov if (qp->peer) 1631e4b8287SPavel Emelyanov inet_putpeer(qp->peer); 1641da177e4SLinus Torvalds } 1651da177e4SLinus Torvalds 1661da177e4SLinus Torvalds 1671da177e4SLinus Torvalds /* Destruction primitives. */ 1681da177e4SLinus Torvalds 169aa1f731eSFabian Frederick static void ipq_put(struct ipq *ipq) 1701da177e4SLinus Torvalds { 171762cc408SPavel Emelyanov inet_frag_put(&ipq->q, &ip4_frags); 1721da177e4SLinus Torvalds } 1731da177e4SLinus Torvalds 1741da177e4SLinus Torvalds /* Kill ipq entry. It is not destroyed immediately, 1751da177e4SLinus Torvalds * because caller (and someone more) holds reference count. 1761da177e4SLinus Torvalds */ 1771da177e4SLinus Torvalds static void ipq_kill(struct ipq *ipq) 1781da177e4SLinus Torvalds { 179277e650dSPavel Emelyanov inet_frag_kill(&ipq->q, &ip4_frags); 1801da177e4SLinus Torvalds } 1811da177e4SLinus Torvalds 1825cf42280SAndy Zhou static bool frag_expire_skip_icmp(u32 user) 1835cf42280SAndy Zhou { 1845cf42280SAndy Zhou return user == IP_DEFRAG_AF_PACKET || 1855cf42280SAndy Zhou ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_IN, 1868bc04864SAndy Zhou __IP_DEFRAG_CONNTRACK_IN_END) || 1878bc04864SAndy Zhou ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_BRIDGE_IN, 1888bc04864SAndy Zhou __IP_DEFRAG_CONNTRACK_BRIDGE_IN); 1895cf42280SAndy Zhou } 1905cf42280SAndy Zhou 1911da177e4SLinus Torvalds /* 1921da177e4SLinus Torvalds * Oops, a fragment queue timed out. Kill it and send an ICMP reply. 1931da177e4SLinus Torvalds */ 19478802011SKees Cook static void ip_expire(struct timer_list *t) 1951da177e4SLinus Torvalds { 19678802011SKees Cook struct inet_frag_queue *frag = from_timer(frag, t, timer); 197e521db9dSPavel Emelyanov struct ipq *qp; 19884a3aa00SPavel Emelyanov struct net *net; 199e521db9dSPavel Emelyanov 20078802011SKees Cook qp = container_of(frag, struct ipq, q); 20184a3aa00SPavel Emelyanov net = container_of(qp->q.net, struct net, ipv4.frags); 2021da177e4SLinus Torvalds 203ec4fbd64SEric Dumazet rcu_read_lock(); 2045ab11c98SPavel Emelyanov spin_lock(&qp->q.lock); 2051da177e4SLinus Torvalds 20606aa8b8aSNikolay Aleksandrov if (qp->q.flags & INET_FRAG_COMPLETE) 2071da177e4SLinus Torvalds goto out; 2081da177e4SLinus Torvalds 2091da177e4SLinus Torvalds ipq_kill(qp); 210b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 2111da177e4SLinus Torvalds 212caaecdd3SNikolay Aleksandrov if (!inet_frag_evicting(&qp->q)) { 213ec4fbd64SEric Dumazet struct sk_buff *clone, *head = qp->q.fragments; 21464f3b9e2SEric Dumazet const struct iphdr *iph; 21564f3b9e2SEric Dumazet int err; 216cb84663eSDenis V. Lunev 217b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); 2182e404f63SNikolay Aleksandrov 2192e404f63SNikolay Aleksandrov if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) 2202e404f63SNikolay Aleksandrov goto out; 2212e404f63SNikolay Aleksandrov 22269df9d59SEric Dumazet head->dev = dev_get_by_index_rcu(net, qp->iif); 223e9017b55SShan Wei if (!head->dev) 224ec4fbd64SEric Dumazet goto out; 225ec4fbd64SEric Dumazet 226e9017b55SShan Wei 22797599dc7SEric Dumazet /* skb has no dst, perform route lookup again */ 22864f3b9e2SEric Dumazet iph = ip_hdr(head); 229c6cffba4SDavid S. Miller err = ip_route_input_noref(head, iph->daddr, iph->saddr, 230c10237e0SDavid S. Miller iph->tos, head->dev); 23164f3b9e2SEric Dumazet if (err) 232ec4fbd64SEric Dumazet goto out; 233e9017b55SShan Wei 2342e404f63SNikolay Aleksandrov /* Only an end host needs to send an ICMP 235e9017b55SShan Wei * "Fragment Reassembly Timeout" message, per RFC792. 236e9017b55SShan Wei */ 2375cf42280SAndy Zhou if (frag_expire_skip_icmp(qp->user) && 2385cf42280SAndy Zhou (skb_rtable(head)->rt_type != RTN_LOCAL)) 239ec4fbd64SEric Dumazet goto out; 240ec4fbd64SEric Dumazet 241ec4fbd64SEric Dumazet clone = skb_clone(head, GFP_ATOMIC); 242e9017b55SShan Wei 243e9017b55SShan Wei /* Send an ICMP "Fragment Reassembly Timeout" message. */ 244ec4fbd64SEric Dumazet if (clone) { 245ec4fbd64SEric Dumazet spin_unlock(&qp->q.lock); 246ec4fbd64SEric Dumazet icmp_send(clone, ICMP_TIME_EXCEEDED, 247ec4fbd64SEric Dumazet ICMP_EXC_FRAGTIME, 0); 248ec4fbd64SEric Dumazet consume_skb(clone); 249ec4fbd64SEric Dumazet goto out_rcu_unlock; 250ec4fbd64SEric Dumazet } 251d1c9ae6dSPatrick McHardy } 2521da177e4SLinus Torvalds out: 2535ab11c98SPavel Emelyanov spin_unlock(&qp->q.lock); 254ec4fbd64SEric Dumazet out_rcu_unlock: 255ec4fbd64SEric Dumazet rcu_read_unlock(); 2564b6cb5d8SPavel Emelyanov ipq_put(qp); 2571da177e4SLinus Torvalds } 2581da177e4SLinus Torvalds 259abd6523dSPavel Emelyanov /* Find the correct entry in the "incomplete datagrams" queue for 260abd6523dSPavel Emelyanov * this IP datagram, and create new one, if nothing is found. 261abd6523dSPavel Emelyanov */ 2629972f134SDavid Ahern static struct ipq *ip_find(struct net *net, struct iphdr *iph, 2639972f134SDavid Ahern u32 user, int vif) 2641da177e4SLinus Torvalds { 265c6fda282SPavel Emelyanov struct inet_frag_queue *q; 266c6fda282SPavel Emelyanov struct ip4_create_arg arg; 267abd6523dSPavel Emelyanov unsigned int hash; 2681da177e4SLinus Torvalds 269c6fda282SPavel Emelyanov arg.iph = iph; 270c6fda282SPavel Emelyanov arg.user = user; 2719972f134SDavid Ahern arg.vif = vif; 2729a375803SPavel Emelyanov 273abd6523dSPavel Emelyanov hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol); 274c6fda282SPavel Emelyanov 275ac18e750SPavel Emelyanov q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash); 2765a3da1feSHannes Frederic Sowa if (IS_ERR_OR_NULL(q)) { 2775a3da1feSHannes Frederic Sowa inet_frag_maybe_warn_overflow(q, pr_fmt()); 2781da177e4SLinus Torvalds return NULL; 2791da177e4SLinus Torvalds } 2805a3da1feSHannes Frederic Sowa return container_of(q, struct ipq, q); 2815a3da1feSHannes Frederic Sowa } 2821da177e4SLinus Torvalds 28389cee8b1SHerbert Xu /* Is the fragment too far ahead to be part of ipq? */ 284aa1f731eSFabian Frederick static int ip_frag_too_far(struct ipq *qp) 28589cee8b1SHerbert Xu { 28689cee8b1SHerbert Xu struct inet_peer *peer = qp->peer; 2870fbf4cb2SNikolay Borisov unsigned int max = qp->q.net->max_dist; 28889cee8b1SHerbert Xu unsigned int start, end; 28989cee8b1SHerbert Xu 29089cee8b1SHerbert Xu int rc; 29189cee8b1SHerbert Xu 29289cee8b1SHerbert Xu if (!peer || !max) 29389cee8b1SHerbert Xu return 0; 29489cee8b1SHerbert Xu 29589cee8b1SHerbert Xu start = qp->rid; 29689cee8b1SHerbert Xu end = atomic_inc_return(&peer->rid); 29789cee8b1SHerbert Xu qp->rid = end; 29889cee8b1SHerbert Xu 2995ab11c98SPavel Emelyanov rc = qp->q.fragments && (end - start) > max; 30089cee8b1SHerbert Xu 30189cee8b1SHerbert Xu if (rc) { 3027c73a6faSPavel Emelyanov struct net *net; 3037c73a6faSPavel Emelyanov 3047c73a6faSPavel Emelyanov net = container_of(qp->q.net, struct net, ipv4.frags); 305b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 30689cee8b1SHerbert Xu } 30789cee8b1SHerbert Xu 30889cee8b1SHerbert Xu return rc; 30989cee8b1SHerbert Xu } 31089cee8b1SHerbert Xu 31189cee8b1SHerbert Xu static int ip_frag_reinit(struct ipq *qp) 31289cee8b1SHerbert Xu { 31389cee8b1SHerbert Xu struct sk_buff *fp; 314d433673eSJesper Dangaard Brouer unsigned int sum_truesize = 0; 31589cee8b1SHerbert Xu 316b2fd5321SPavel Emelyanov if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) { 317edcb6918SReshetova, Elena refcount_inc(&qp->q.refcnt); 31889cee8b1SHerbert Xu return -ETIMEDOUT; 31989cee8b1SHerbert Xu } 32089cee8b1SHerbert Xu 3215ab11c98SPavel Emelyanov fp = qp->q.fragments; 32289cee8b1SHerbert Xu do { 32389cee8b1SHerbert Xu struct sk_buff *xp = fp->next; 324d433673eSJesper Dangaard Brouer 325d433673eSJesper Dangaard Brouer sum_truesize += fp->truesize; 326d433673eSJesper Dangaard Brouer kfree_skb(fp); 32789cee8b1SHerbert Xu fp = xp; 32889cee8b1SHerbert Xu } while (fp); 3290e60d245SFlorian Westphal sub_frag_mem_limit(qp->q.net, sum_truesize); 33089cee8b1SHerbert Xu 33106aa8b8aSNikolay Aleksandrov qp->q.flags = 0; 3325ab11c98SPavel Emelyanov qp->q.len = 0; 3335ab11c98SPavel Emelyanov qp->q.meat = 0; 3345ab11c98SPavel Emelyanov qp->q.fragments = NULL; 335d6bebca9SChangli Gao qp->q.fragments_tail = NULL; 33689cee8b1SHerbert Xu qp->iif = 0; 3376623e3b2SEric Dumazet qp->ecn = 0; 33889cee8b1SHerbert Xu 33989cee8b1SHerbert Xu return 0; 34089cee8b1SHerbert Xu } 34189cee8b1SHerbert Xu 3421da177e4SLinus Torvalds /* Add new segment to existing queue. */ 3431706d587SHerbert Xu static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) 3441da177e4SLinus Torvalds { 3451da177e4SLinus Torvalds struct sk_buff *prev, *next; 3461706d587SHerbert Xu struct net_device *dev; 347d6b915e2SFlorian Westphal unsigned int fragsize; 3481da177e4SLinus Torvalds int flags, offset; 3491da177e4SLinus Torvalds int ihl, end; 3501706d587SHerbert Xu int err = -ENOENT; 3516623e3b2SEric Dumazet u8 ecn; 3521da177e4SLinus Torvalds 35306aa8b8aSNikolay Aleksandrov if (qp->q.flags & INET_FRAG_COMPLETE) 3541da177e4SLinus Torvalds goto err; 3551da177e4SLinus Torvalds 35689cee8b1SHerbert Xu if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) && 3571706d587SHerbert Xu unlikely(ip_frag_too_far(qp)) && 3581706d587SHerbert Xu unlikely(err = ip_frag_reinit(qp))) { 35989cee8b1SHerbert Xu ipq_kill(qp); 36089cee8b1SHerbert Xu goto err; 36189cee8b1SHerbert Xu } 36289cee8b1SHerbert Xu 3636623e3b2SEric Dumazet ecn = ip4_frag_ecn(ip_hdr(skb)->tos); 364eddc9ec5SArnaldo Carvalho de Melo offset = ntohs(ip_hdr(skb)->frag_off); 3651da177e4SLinus Torvalds flags = offset & ~IP_OFFSET; 3661da177e4SLinus Torvalds offset &= IP_OFFSET; 3671da177e4SLinus Torvalds offset <<= 3; /* offset is in 8-byte chunks */ 368c9bdd4b5SArnaldo Carvalho de Melo ihl = ip_hdrlen(skb); 3691da177e4SLinus Torvalds 3701da177e4SLinus Torvalds /* Determine the position of this fragment. */ 3710848f642SEdward Hyunkoo Jee end = offset + skb->len - skb_network_offset(skb) - ihl; 3721706d587SHerbert Xu err = -EINVAL; 3731da177e4SLinus Torvalds 3741da177e4SLinus Torvalds /* Is this the final fragment? */ 3751da177e4SLinus Torvalds if ((flags & IP_MF) == 0) { 3761da177e4SLinus Torvalds /* If we already have some bits beyond end 37742b2aa86SJustin P. Mattock * or have different end, the segment is corrupted. 3781da177e4SLinus Torvalds */ 3795ab11c98SPavel Emelyanov if (end < qp->q.len || 38006aa8b8aSNikolay Aleksandrov ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len)) 3811da177e4SLinus Torvalds goto err; 38206aa8b8aSNikolay Aleksandrov qp->q.flags |= INET_FRAG_LAST_IN; 3835ab11c98SPavel Emelyanov qp->q.len = end; 3841da177e4SLinus Torvalds } else { 3851da177e4SLinus Torvalds if (end&7) { 3861da177e4SLinus Torvalds end &= ~7; 3871da177e4SLinus Torvalds if (skb->ip_summed != CHECKSUM_UNNECESSARY) 3881da177e4SLinus Torvalds skb->ip_summed = CHECKSUM_NONE; 3891da177e4SLinus Torvalds } 3905ab11c98SPavel Emelyanov if (end > qp->q.len) { 3911da177e4SLinus Torvalds /* Some bits beyond end -> corruption. */ 39206aa8b8aSNikolay Aleksandrov if (qp->q.flags & INET_FRAG_LAST_IN) 3931da177e4SLinus Torvalds goto err; 3945ab11c98SPavel Emelyanov qp->q.len = end; 3951da177e4SLinus Torvalds } 3961da177e4SLinus Torvalds } 3971da177e4SLinus Torvalds if (end == offset) 3981da177e4SLinus Torvalds goto err; 3991da177e4SLinus Torvalds 4001706d587SHerbert Xu err = -ENOMEM; 4010848f642SEdward Hyunkoo Jee if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) 4021da177e4SLinus Torvalds goto err; 4031706d587SHerbert Xu 4041706d587SHerbert Xu err = pskb_trim_rcsum(skb, end - offset); 4051706d587SHerbert Xu if (err) 4061da177e4SLinus Torvalds goto err; 4071da177e4SLinus Torvalds 4081da177e4SLinus Torvalds /* Find out which fragments are in front and at the back of us 4091da177e4SLinus Torvalds * in the chain of fragments so far. We must know where to put 4101da177e4SLinus Torvalds * this fragment, right? 4111da177e4SLinus Torvalds */ 412d6bebca9SChangli Gao prev = qp->q.fragments_tail; 413d6bebca9SChangli Gao if (!prev || FRAG_CB(prev)->offset < offset) { 414d6bebca9SChangli Gao next = NULL; 415d6bebca9SChangli Gao goto found; 416d6bebca9SChangli Gao } 4171da177e4SLinus Torvalds prev = NULL; 4185ab11c98SPavel Emelyanov for (next = qp->q.fragments; next != NULL; next = next->next) { 4191da177e4SLinus Torvalds if (FRAG_CB(next)->offset >= offset) 4201da177e4SLinus Torvalds break; /* bingo! */ 4211da177e4SLinus Torvalds prev = next; 4221da177e4SLinus Torvalds } 4231da177e4SLinus Torvalds 424d6bebca9SChangli Gao found: 4251da177e4SLinus Torvalds /* We found where to put this one. Check for overlap with 4261da177e4SLinus Torvalds * preceding fragment, and, if needed, align things so that 4271da177e4SLinus Torvalds * any overlaps are eliminated. 4281da177e4SLinus Torvalds */ 4291da177e4SLinus Torvalds if (prev) { 4301da177e4SLinus Torvalds int i = (FRAG_CB(prev)->offset + prev->len) - offset; 4311da177e4SLinus Torvalds 4321da177e4SLinus Torvalds if (i > 0) { 4331da177e4SLinus Torvalds offset += i; 4341706d587SHerbert Xu err = -EINVAL; 4351da177e4SLinus Torvalds if (end <= offset) 4361da177e4SLinus Torvalds goto err; 4371706d587SHerbert Xu err = -ENOMEM; 4381da177e4SLinus Torvalds if (!pskb_pull(skb, i)) 4391da177e4SLinus Torvalds goto err; 4401da177e4SLinus Torvalds if (skb->ip_summed != CHECKSUM_UNNECESSARY) 4411da177e4SLinus Torvalds skb->ip_summed = CHECKSUM_NONE; 4421da177e4SLinus Torvalds } 4431da177e4SLinus Torvalds } 4441da177e4SLinus Torvalds 4451706d587SHerbert Xu err = -ENOMEM; 4461706d587SHerbert Xu 4471da177e4SLinus Torvalds while (next && FRAG_CB(next)->offset < end) { 4481da177e4SLinus Torvalds int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ 4491da177e4SLinus Torvalds 4501da177e4SLinus Torvalds if (i < next->len) { 4511da177e4SLinus Torvalds /* Eat head of the next overlapped fragment 4521da177e4SLinus Torvalds * and leave the loop. The next ones cannot overlap. 4531da177e4SLinus Torvalds */ 4541da177e4SLinus Torvalds if (!pskb_pull(next, i)) 4551da177e4SLinus Torvalds goto err; 4561da177e4SLinus Torvalds FRAG_CB(next)->offset += i; 4575ab11c98SPavel Emelyanov qp->q.meat -= i; 4581da177e4SLinus Torvalds if (next->ip_summed != CHECKSUM_UNNECESSARY) 4591da177e4SLinus Torvalds next->ip_summed = CHECKSUM_NONE; 4601da177e4SLinus Torvalds break; 4611da177e4SLinus Torvalds } else { 4621da177e4SLinus Torvalds struct sk_buff *free_it = next; 4631da177e4SLinus Torvalds 46447c6bf77SPeter Zijlstra /* Old fragment is completely overridden with 4651da177e4SLinus Torvalds * new one drop it. 4661da177e4SLinus Torvalds */ 4671da177e4SLinus Torvalds next = next->next; 4681da177e4SLinus Torvalds 4691da177e4SLinus Torvalds if (prev) 4701da177e4SLinus Torvalds prev->next = next; 4711da177e4SLinus Torvalds else 4725ab11c98SPavel Emelyanov qp->q.fragments = next; 4731da177e4SLinus Torvalds 4745ab11c98SPavel Emelyanov qp->q.meat -= free_it->len; 4750e60d245SFlorian Westphal sub_frag_mem_limit(qp->q.net, free_it->truesize); 476d433673eSJesper Dangaard Brouer kfree_skb(free_it); 4771da177e4SLinus Torvalds } 4781da177e4SLinus Torvalds } 4791da177e4SLinus Torvalds 4801da177e4SLinus Torvalds FRAG_CB(skb)->offset = offset; 4811da177e4SLinus Torvalds 4821da177e4SLinus Torvalds /* Insert this fragment in the chain of fragments. */ 4831da177e4SLinus Torvalds skb->next = next; 484d6bebca9SChangli Gao if (!next) 485d6bebca9SChangli Gao qp->q.fragments_tail = skb; 4861da177e4SLinus Torvalds if (prev) 4871da177e4SLinus Torvalds prev->next = skb; 4881da177e4SLinus Torvalds else 4895ab11c98SPavel Emelyanov qp->q.fragments = skb; 4901da177e4SLinus Torvalds 4911706d587SHerbert Xu dev = skb->dev; 4921706d587SHerbert Xu if (dev) { 4931706d587SHerbert Xu qp->iif = dev->ifindex; 4941da177e4SLinus Torvalds skb->dev = NULL; 4951706d587SHerbert Xu } 4965ab11c98SPavel Emelyanov qp->q.stamp = skb->tstamp; 4975ab11c98SPavel Emelyanov qp->q.meat += skb->len; 4986623e3b2SEric Dumazet qp->ecn |= ecn; 4990e60d245SFlorian Westphal add_frag_mem_limit(qp->q.net, skb->truesize); 5001da177e4SLinus Torvalds if (offset == 0) 50106aa8b8aSNikolay Aleksandrov qp->q.flags |= INET_FRAG_FIRST_IN; 5021da177e4SLinus Torvalds 503d6b915e2SFlorian Westphal fragsize = skb->len + ihl; 504d6b915e2SFlorian Westphal 505d6b915e2SFlorian Westphal if (fragsize > qp->q.max_size) 506d6b915e2SFlorian Westphal qp->q.max_size = fragsize; 507d6b915e2SFlorian Westphal 5085f2d04f1SPatrick McHardy if (ip_hdr(skb)->frag_off & htons(IP_DF) && 509d6b915e2SFlorian Westphal fragsize > qp->max_df_size) 510d6b915e2SFlorian Westphal qp->max_df_size = fragsize; 5115f2d04f1SPatrick McHardy 51206aa8b8aSNikolay Aleksandrov if (qp->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && 51397599dc7SEric Dumazet qp->q.meat == qp->q.len) { 51497599dc7SEric Dumazet unsigned long orefdst = skb->_skb_refdst; 5151706d587SHerbert Xu 51697599dc7SEric Dumazet skb->_skb_refdst = 0UL; 51797599dc7SEric Dumazet err = ip_frag_reasm(qp, prev, dev); 51897599dc7SEric Dumazet skb->_skb_refdst = orefdst; 51997599dc7SEric Dumazet return err; 52097599dc7SEric Dumazet } 52197599dc7SEric Dumazet 52297599dc7SEric Dumazet skb_dst_drop(skb); 5231706d587SHerbert Xu return -EINPROGRESS; 5241da177e4SLinus Torvalds 5251da177e4SLinus Torvalds err: 5261da177e4SLinus Torvalds kfree_skb(skb); 5271706d587SHerbert Xu return err; 5281da177e4SLinus Torvalds } 5291da177e4SLinus Torvalds 5301da177e4SLinus Torvalds 5311da177e4SLinus Torvalds /* Build a new IP datagram from all its fragments. */ 5321da177e4SLinus Torvalds 5331706d587SHerbert Xu static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, 5341706d587SHerbert Xu struct net_device *dev) 5351da177e4SLinus Torvalds { 5362bad35b7SJorge Boncompte [DTI2] struct net *net = container_of(qp->q.net, struct net, ipv4.frags); 5371da177e4SLinus Torvalds struct iphdr *iph; 5385ab11c98SPavel Emelyanov struct sk_buff *fp, *head = qp->q.fragments; 5391da177e4SLinus Torvalds int len; 5401da177e4SLinus Torvalds int ihlen; 5411706d587SHerbert Xu int err; 5425173cc05SEric Dumazet u8 ecn; 5431da177e4SLinus Torvalds 5441da177e4SLinus Torvalds ipq_kill(qp); 5451da177e4SLinus Torvalds 546be991971SHannes Frederic Sowa ecn = ip_frag_ecn_table[qp->ecn]; 5475173cc05SEric Dumazet if (unlikely(ecn == 0xff)) { 5485173cc05SEric Dumazet err = -EINVAL; 5495173cc05SEric Dumazet goto out_fail; 5505173cc05SEric Dumazet } 5511706d587SHerbert Xu /* Make the one we just received the head. */ 5521706d587SHerbert Xu if (prev) { 5531706d587SHerbert Xu head = prev->next; 5541706d587SHerbert Xu fp = skb_clone(head, GFP_ATOMIC); 5551706d587SHerbert Xu if (!fp) 5561706d587SHerbert Xu goto out_nomem; 5571706d587SHerbert Xu 5581706d587SHerbert Xu fp->next = head->next; 559d6bebca9SChangli Gao if (!fp->next) 560d6bebca9SChangli Gao qp->q.fragments_tail = fp; 5611706d587SHerbert Xu prev->next = fp; 5621706d587SHerbert Xu 5635ab11c98SPavel Emelyanov skb_morph(head, qp->q.fragments); 5645ab11c98SPavel Emelyanov head->next = qp->q.fragments->next; 5651706d587SHerbert Xu 566cbf8f7bbSEric Dumazet consume_skb(qp->q.fragments); 5675ab11c98SPavel Emelyanov qp->q.fragments = head; 5681706d587SHerbert Xu } 5691706d587SHerbert Xu 57051456b29SIan Morris WARN_ON(!head); 571547b792cSIlpo Järvinen WARN_ON(FRAG_CB(head)->offset != 0); 5721da177e4SLinus Torvalds 5731da177e4SLinus Torvalds /* Allocate a new buffer for the datagram. */ 574c9bdd4b5SArnaldo Carvalho de Melo ihlen = ip_hdrlen(head); 5755ab11c98SPavel Emelyanov len = ihlen + qp->q.len; 5761da177e4SLinus Torvalds 5771706d587SHerbert Xu err = -E2BIG; 5781da177e4SLinus Torvalds if (len > 65535) 5791da177e4SLinus Torvalds goto out_oversize; 5801da177e4SLinus Torvalds 5811da177e4SLinus Torvalds /* Head of list must not be cloned. */ 58214bbd6a5SPravin B Shelar if (skb_unclone(head, GFP_ATOMIC)) 5831da177e4SLinus Torvalds goto out_nomem; 5841da177e4SLinus Torvalds 5851da177e4SLinus Torvalds /* If the first fragment is fragmented itself, we split 5861da177e4SLinus Torvalds * it to two chunks: the first with data and paged part 5871da177e4SLinus Torvalds * and the second, holding only fragments. */ 58821dc3301SDavid S. Miller if (skb_has_frag_list(head)) { 5891da177e4SLinus Torvalds struct sk_buff *clone; 5901da177e4SLinus Torvalds int i, plen = 0; 5911da177e4SLinus Torvalds 59251456b29SIan Morris clone = alloc_skb(0, GFP_ATOMIC); 59351456b29SIan Morris if (!clone) 5941da177e4SLinus Torvalds goto out_nomem; 5951da177e4SLinus Torvalds clone->next = head->next; 5961da177e4SLinus Torvalds head->next = clone; 5971da177e4SLinus Torvalds skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; 598d7fcf1a5SDavid S. Miller skb_frag_list_init(head); 5991da177e4SLinus Torvalds for (i = 0; i < skb_shinfo(head)->nr_frags; i++) 6009e903e08SEric Dumazet plen += skb_frag_size(&skb_shinfo(head)->frags[i]); 6011da177e4SLinus Torvalds clone->len = clone->data_len = head->data_len - plen; 6021da177e4SLinus Torvalds head->data_len -= clone->len; 6031da177e4SLinus Torvalds head->len -= clone->len; 6041da177e4SLinus Torvalds clone->csum = 0; 6051da177e4SLinus Torvalds clone->ip_summed = head->ip_summed; 6060e60d245SFlorian Westphal add_frag_mem_limit(qp->q.net, clone->truesize); 6071da177e4SLinus Torvalds } 6081da177e4SLinus Torvalds 60914fe22e3SFlorian Westphal skb_shinfo(head)->frag_list = head->next; 610d56f90a7SArnaldo Carvalho de Melo skb_push(head, head->data - skb_network_header(head)); 6111da177e4SLinus Torvalds 61214fe22e3SFlorian Westphal for (fp=head->next; fp; fp = fp->next) { 61314fe22e3SFlorian Westphal head->data_len += fp->len; 61414fe22e3SFlorian Westphal head->len += fp->len; 6151da177e4SLinus Torvalds if (head->ip_summed != fp->ip_summed) 6161da177e4SLinus Torvalds head->ip_summed = CHECKSUM_NONE; 61784fa7933SPatrick McHardy else if (head->ip_summed == CHECKSUM_COMPLETE) 6181da177e4SLinus Torvalds head->csum = csum_add(head->csum, fp->csum); 6191da177e4SLinus Torvalds head->truesize += fp->truesize; 6201da177e4SLinus Torvalds } 6215510b3c2SDavid S. Miller sub_frag_mem_limit(qp->q.net, head->truesize); 6221da177e4SLinus Torvalds 6231da177e4SLinus Torvalds head->next = NULL; 6241da177e4SLinus Torvalds head->dev = dev; 6255ab11c98SPavel Emelyanov head->tstamp = qp->q.stamp; 626d6b915e2SFlorian Westphal IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size); 6271da177e4SLinus Torvalds 628eddc9ec5SArnaldo Carvalho de Melo iph = ip_hdr(head); 6291da177e4SLinus Torvalds iph->tot_len = htons(len); 6305173cc05SEric Dumazet iph->tos |= ecn; 631d6b915e2SFlorian Westphal 632d6b915e2SFlorian Westphal /* When we set IP_DF on a refragmented skb we must also force a 633d6b915e2SFlorian Westphal * call to ip_fragment to avoid forwarding a DF-skb of size s while 634d6b915e2SFlorian Westphal * original sender only sent fragments of size f (where f < s). 635d6b915e2SFlorian Westphal * 636d6b915e2SFlorian Westphal * We only set DF/IPSKB_FRAG_PMTU if such DF fragment was the largest 637d6b915e2SFlorian Westphal * frag seen to avoid sending tiny DF-fragments in case skb was built 638d6b915e2SFlorian Westphal * from one very small df-fragment and one large non-df frag. 639d6b915e2SFlorian Westphal */ 640d6b915e2SFlorian Westphal if (qp->max_df_size == qp->q.max_size) { 641d6b915e2SFlorian Westphal IPCB(head)->flags |= IPSKB_FRAG_PMTU; 642d6b915e2SFlorian Westphal iph->frag_off = htons(IP_DF); 643d6b915e2SFlorian Westphal } else { 644d6b915e2SFlorian Westphal iph->frag_off = 0; 645d6b915e2SFlorian Westphal } 646d6b915e2SFlorian Westphal 6470848f642SEdward Hyunkoo Jee ip_send_check(iph); 6480848f642SEdward Hyunkoo Jee 649b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMOKS); 6505ab11c98SPavel Emelyanov qp->q.fragments = NULL; 651d6bebca9SChangli Gao qp->q.fragments_tail = NULL; 6521706d587SHerbert Xu return 0; 6531da177e4SLinus Torvalds 6541da177e4SLinus Torvalds out_nomem: 655ba7a46f1SJoe Perches net_dbg_ratelimited("queue_glue: no memory for gluing queue %p\n", qp); 65645542479SDavid Howells err = -ENOMEM; 6571da177e4SLinus Torvalds goto out_fail; 6581da177e4SLinus Torvalds out_oversize: 659e87cc472SJoe Perches net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->saddr); 6601da177e4SLinus Torvalds out_fail: 661b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 6621706d587SHerbert Xu return err; 6631da177e4SLinus Torvalds } 6641da177e4SLinus Torvalds 6651da177e4SLinus Torvalds /* Process an incoming IP datagram fragment. */ 66619bcf9f2SEric W. Biederman int ip_defrag(struct net *net, struct sk_buff *skb, u32 user) 6671da177e4SLinus Torvalds { 6689972f134SDavid Ahern struct net_device *dev = skb->dev ? : skb_dst(skb)->dev; 669385add90SDavid Ahern int vif = l3mdev_master_ifindex_rcu(dev); 6701da177e4SLinus Torvalds struct ipq *qp; 6711da177e4SLinus Torvalds 672b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS); 6738282f274SJoe Stringer skb_orphan(skb); 6741da177e4SLinus Torvalds 6751da177e4SLinus Torvalds /* Lookup (or create) queue header */ 6769972f134SDavid Ahern qp = ip_find(net, ip_hdr(skb), user, vif); 67700db4124SIan Morris if (qp) { 6781706d587SHerbert Xu int ret; 6791da177e4SLinus Torvalds 6805ab11c98SPavel Emelyanov spin_lock(&qp->q.lock); 6811da177e4SLinus Torvalds 6821706d587SHerbert Xu ret = ip_frag_queue(qp, skb); 6831da177e4SLinus Torvalds 6845ab11c98SPavel Emelyanov spin_unlock(&qp->q.lock); 6854b6cb5d8SPavel Emelyanov ipq_put(qp); 686776c729eSHerbert Xu return ret; 6871da177e4SLinus Torvalds } 6881da177e4SLinus Torvalds 689b45386efSEric Dumazet __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 6901da177e4SLinus Torvalds kfree_skb(skb); 691776c729eSHerbert Xu return -ENOMEM; 6921da177e4SLinus Torvalds } 6934bc2f18bSEric Dumazet EXPORT_SYMBOL(ip_defrag); 6941da177e4SLinus Torvalds 69519bcf9f2SEric W. Biederman struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) 696bc416d97SEric Dumazet { 6971bf3751eSJohannes Berg struct iphdr iph; 6983e32e733SAlexander Drozdov int netoff; 699bc416d97SEric Dumazet u32 len; 700bc416d97SEric Dumazet 701bc416d97SEric Dumazet if (skb->protocol != htons(ETH_P_IP)) 702bc416d97SEric Dumazet return skb; 703bc416d97SEric Dumazet 7043e32e733SAlexander Drozdov netoff = skb_network_offset(skb); 7053e32e733SAlexander Drozdov 7063e32e733SAlexander Drozdov if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0) 707bc416d97SEric Dumazet return skb; 708bc416d97SEric Dumazet 7091bf3751eSJohannes Berg if (iph.ihl < 5 || iph.version != 4) 710bc416d97SEric Dumazet return skb; 711bc416d97SEric Dumazet 7121bf3751eSJohannes Berg len = ntohs(iph.tot_len); 7133e32e733SAlexander Drozdov if (skb->len < netoff + len || len < (iph.ihl * 4)) 7141bf3751eSJohannes Berg return skb; 7151bf3751eSJohannes Berg 7161bf3751eSJohannes Berg if (ip_is_fragment(&iph)) { 717bc416d97SEric Dumazet skb = skb_share_check(skb, GFP_ATOMIC); 718bc416d97SEric Dumazet if (skb) { 7193e32e733SAlexander Drozdov if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) 7201bf3751eSJohannes Berg return skb; 7213e32e733SAlexander Drozdov if (pskb_trim_rcsum(skb, netoff + len)) 722bc416d97SEric Dumazet return skb; 723bc416d97SEric Dumazet memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 72419bcf9f2SEric W. Biederman if (ip_defrag(net, skb, user)) 725bc416d97SEric Dumazet return NULL; 7267539fadcSTom Herbert skb_clear_hash(skb); 727bc416d97SEric Dumazet } 728bc416d97SEric Dumazet } 729bc416d97SEric Dumazet return skb; 730bc416d97SEric Dumazet } 731bc416d97SEric Dumazet EXPORT_SYMBOL(ip_check_defrag); 732bc416d97SEric Dumazet 7338d8354d2SPavel Emelyanov #ifdef CONFIG_SYSCTL 7348d8354d2SPavel Emelyanov static int zero; 7358d8354d2SPavel Emelyanov 7360a64b4b8SPavel Emelyanov static struct ctl_table ip4_frags_ns_ctl_table[] = { 7378d8354d2SPavel Emelyanov { 7388d8354d2SPavel Emelyanov .procname = "ipfrag_high_thresh", 739e31e0bdcSPavel Emelyanov .data = &init_net.ipv4.frags.high_thresh, 7408d8354d2SPavel Emelyanov .maxlen = sizeof(int), 7418d8354d2SPavel Emelyanov .mode = 0644, 7421bab4c75SNikolay Aleksandrov .proc_handler = proc_dointvec_minmax, 7431bab4c75SNikolay Aleksandrov .extra1 = &init_net.ipv4.frags.low_thresh 7448d8354d2SPavel Emelyanov }, 7458d8354d2SPavel Emelyanov { 7468d8354d2SPavel Emelyanov .procname = "ipfrag_low_thresh", 747e31e0bdcSPavel Emelyanov .data = &init_net.ipv4.frags.low_thresh, 7488d8354d2SPavel Emelyanov .maxlen = sizeof(int), 7498d8354d2SPavel Emelyanov .mode = 0644, 7501bab4c75SNikolay Aleksandrov .proc_handler = proc_dointvec_minmax, 7511bab4c75SNikolay Aleksandrov .extra1 = &zero, 7521bab4c75SNikolay Aleksandrov .extra2 = &init_net.ipv4.frags.high_thresh 7538d8354d2SPavel Emelyanov }, 7548d8354d2SPavel Emelyanov { 7558d8354d2SPavel Emelyanov .procname = "ipfrag_time", 756b2fd5321SPavel Emelyanov .data = &init_net.ipv4.frags.timeout, 7578d8354d2SPavel Emelyanov .maxlen = sizeof(int), 7588d8354d2SPavel Emelyanov .mode = 0644, 7596d9f239aSAlexey Dobriyan .proc_handler = proc_dointvec_jiffies, 7608d8354d2SPavel Emelyanov }, 7610fbf4cb2SNikolay Borisov { 7620fbf4cb2SNikolay Borisov .procname = "ipfrag_max_dist", 7630fbf4cb2SNikolay Borisov .data = &init_net.ipv4.frags.max_dist, 7640fbf4cb2SNikolay Borisov .maxlen = sizeof(int), 7650fbf4cb2SNikolay Borisov .mode = 0644, 7660fbf4cb2SNikolay Borisov .proc_handler = proc_dointvec_minmax, 7670fbf4cb2SNikolay Borisov .extra1 = &zero 7680fbf4cb2SNikolay Borisov }, 7697d291ebbSPavel Emelyanov { } 7707d291ebbSPavel Emelyanov }; 7717d291ebbSPavel Emelyanov 772e3a57d18SFlorian Westphal /* secret interval has been deprecated */ 773e3a57d18SFlorian Westphal static int ip4_frags_secret_interval_unused; 7747d291ebbSPavel Emelyanov static struct ctl_table ip4_frags_ctl_table[] = { 7758d8354d2SPavel Emelyanov { 7768d8354d2SPavel Emelyanov .procname = "ipfrag_secret_interval", 777e3a57d18SFlorian Westphal .data = &ip4_frags_secret_interval_unused, 7788d8354d2SPavel Emelyanov .maxlen = sizeof(int), 7798d8354d2SPavel Emelyanov .mode = 0644, 7806d9f239aSAlexey Dobriyan .proc_handler = proc_dointvec_jiffies, 7818d8354d2SPavel Emelyanov }, 7828d8354d2SPavel Emelyanov { } 7838d8354d2SPavel Emelyanov }; 7848d8354d2SPavel Emelyanov 7852c8c1e72SAlexey Dobriyan static int __net_init ip4_frags_ns_ctl_register(struct net *net) 7868d8354d2SPavel Emelyanov { 787e4a2d5c2SPavel Emelyanov struct ctl_table *table; 7888d8354d2SPavel Emelyanov struct ctl_table_header *hdr; 7898d8354d2SPavel Emelyanov 7900a64b4b8SPavel Emelyanov table = ip4_frags_ns_ctl_table; 79109ad9bc7SOctavian Purdila if (!net_eq(net, &init_net)) { 7920a64b4b8SPavel Emelyanov table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL); 79351456b29SIan Morris if (!table) 794e4a2d5c2SPavel Emelyanov goto err_alloc; 795e4a2d5c2SPavel Emelyanov 796e31e0bdcSPavel Emelyanov table[0].data = &net->ipv4.frags.high_thresh; 7971bab4c75SNikolay Aleksandrov table[0].extra1 = &net->ipv4.frags.low_thresh; 7981bab4c75SNikolay Aleksandrov table[0].extra2 = &init_net.ipv4.frags.high_thresh; 799e31e0bdcSPavel Emelyanov table[1].data = &net->ipv4.frags.low_thresh; 8001bab4c75SNikolay Aleksandrov table[1].extra2 = &net->ipv4.frags.high_thresh; 801b2fd5321SPavel Emelyanov table[2].data = &net->ipv4.frags.timeout; 8020fbf4cb2SNikolay Borisov table[3].data = &net->ipv4.frags.max_dist; 803e4a2d5c2SPavel Emelyanov } 804e4a2d5c2SPavel Emelyanov 805ec8f23ceSEric W. Biederman hdr = register_net_sysctl(net, "net/ipv4", table); 80651456b29SIan Morris if (!hdr) 807e4a2d5c2SPavel Emelyanov goto err_reg; 808e4a2d5c2SPavel Emelyanov 809e4a2d5c2SPavel Emelyanov net->ipv4.frags_hdr = hdr; 810e4a2d5c2SPavel Emelyanov return 0; 811e4a2d5c2SPavel Emelyanov 812e4a2d5c2SPavel Emelyanov err_reg: 81309ad9bc7SOctavian Purdila if (!net_eq(net, &init_net)) 814e4a2d5c2SPavel Emelyanov kfree(table); 815e4a2d5c2SPavel Emelyanov err_alloc: 816e4a2d5c2SPavel Emelyanov return -ENOMEM; 817e4a2d5c2SPavel Emelyanov } 818e4a2d5c2SPavel Emelyanov 8192c8c1e72SAlexey Dobriyan static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net) 820e4a2d5c2SPavel Emelyanov { 821e4a2d5c2SPavel Emelyanov struct ctl_table *table; 822e4a2d5c2SPavel Emelyanov 823e4a2d5c2SPavel Emelyanov table = net->ipv4.frags_hdr->ctl_table_arg; 824e4a2d5c2SPavel Emelyanov unregister_net_sysctl_table(net->ipv4.frags_hdr); 825e4a2d5c2SPavel Emelyanov kfree(table); 8268d8354d2SPavel Emelyanov } 8277d291ebbSPavel Emelyanov 82857a02c39SFabian Frederick static void __init ip4_frags_ctl_register(void) 8297d291ebbSPavel Emelyanov { 83043444757SEric W. Biederman register_net_sysctl(&init_net, "net/ipv4", ip4_frags_ctl_table); 8317d291ebbSPavel Emelyanov } 8328d8354d2SPavel Emelyanov #else 833aa1f731eSFabian Frederick static int ip4_frags_ns_ctl_register(struct net *net) 8348d8354d2SPavel Emelyanov { 8358d8354d2SPavel Emelyanov return 0; 8368d8354d2SPavel Emelyanov } 837e4a2d5c2SPavel Emelyanov 838aa1f731eSFabian Frederick static void ip4_frags_ns_ctl_unregister(struct net *net) 839e4a2d5c2SPavel Emelyanov { 840e4a2d5c2SPavel Emelyanov } 8417d291ebbSPavel Emelyanov 842aa1f731eSFabian Frederick static void __init ip4_frags_ctl_register(void) 8437d291ebbSPavel Emelyanov { 8447d291ebbSPavel Emelyanov } 8458d8354d2SPavel Emelyanov #endif 8468d8354d2SPavel Emelyanov 8472c8c1e72SAlexey Dobriyan static int __net_init ipv4_frags_init_net(struct net *net) 8488d8354d2SPavel Emelyanov { 849787bea77SEric Dumazet int res; 850787bea77SEric Dumazet 851c2a93660SJesper Dangaard Brouer /* Fragment cache limits. 852c2a93660SJesper Dangaard Brouer * 853c2a93660SJesper Dangaard Brouer * The fragment memory accounting code, (tries to) account for 854c2a93660SJesper Dangaard Brouer * the real memory usage, by measuring both the size of frag 855c2a93660SJesper Dangaard Brouer * queue struct (inet_frag_queue (ipv4:ipq/ipv6:frag_queue)) 856c2a93660SJesper Dangaard Brouer * and the SKB's truesize. 857c2a93660SJesper Dangaard Brouer * 858c2a93660SJesper Dangaard Brouer * A 64K fragment consumes 129736 bytes (44*2944)+200 859c2a93660SJesper Dangaard Brouer * (1500 truesize == 2944, sizeof(struct ipq) == 200) 860c2a93660SJesper Dangaard Brouer * 861c2a93660SJesper Dangaard Brouer * We will commit 4MB at one time. Should we cross that limit 862c2a93660SJesper Dangaard Brouer * we will prune down to 3MB, making room for approx 8 big 64K 863c2a93660SJesper Dangaard Brouer * fragments 8x128k. 864e31e0bdcSPavel Emelyanov */ 865c2a93660SJesper Dangaard Brouer net->ipv4.frags.high_thresh = 4 * 1024 * 1024; 866c2a93660SJesper Dangaard Brouer net->ipv4.frags.low_thresh = 3 * 1024 * 1024; 867e31e0bdcSPavel Emelyanov /* 868b2fd5321SPavel Emelyanov * Important NOTE! Fragment queue must be destroyed before MSL expires. 869b2fd5321SPavel Emelyanov * RFC791 is wrong proposing to prolongate timer each fragment arrival 870b2fd5321SPavel Emelyanov * by TTL. 871b2fd5321SPavel Emelyanov */ 872b2fd5321SPavel Emelyanov net->ipv4.frags.timeout = IP_FRAG_TIME; 873b2fd5321SPavel Emelyanov 8740fbf4cb2SNikolay Borisov net->ipv4.frags.max_dist = 64; 8750fbf4cb2SNikolay Borisov 876787bea77SEric Dumazet res = inet_frags_init_net(&net->ipv4.frags); 877787bea77SEric Dumazet if (res < 0) 878787bea77SEric Dumazet return res; 879787bea77SEric Dumazet res = ip4_frags_ns_ctl_register(net); 880787bea77SEric Dumazet if (res < 0) 881787bea77SEric Dumazet inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); 882787bea77SEric Dumazet return res; 8838d8354d2SPavel Emelyanov } 8848d8354d2SPavel Emelyanov 8852c8c1e72SAlexey Dobriyan static void __net_exit ipv4_frags_exit_net(struct net *net) 88681566e83SPavel Emelyanov { 8870a64b4b8SPavel Emelyanov ip4_frags_ns_ctl_unregister(net); 88881566e83SPavel Emelyanov inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); 88981566e83SPavel Emelyanov } 89081566e83SPavel Emelyanov 89181566e83SPavel Emelyanov static struct pernet_operations ip4_frags_ops = { 89281566e83SPavel Emelyanov .init = ipv4_frags_init_net, 89381566e83SPavel Emelyanov .exit = ipv4_frags_exit_net, 89481566e83SPavel Emelyanov }; 89581566e83SPavel Emelyanov 896b7aa0bf7SEric Dumazet void __init ipfrag_init(void) 8971da177e4SLinus Torvalds { 8987d291ebbSPavel Emelyanov ip4_frags_ctl_register(); 89981566e83SPavel Emelyanov register_pernet_subsys(&ip4_frags_ops); 900321a3a99SPavel Emelyanov ip4_frags.hashfn = ip4_hashfn; 901c6fda282SPavel Emelyanov ip4_frags.constructor = ip4_frag_init; 9021e4b8287SPavel Emelyanov ip4_frags.destructor = ip4_frag_free; 9031e4b8287SPavel Emelyanov ip4_frags.qsize = sizeof(struct ipq); 904abd6523dSPavel Emelyanov ip4_frags.match = ip4_frag_match; 905e521db9dSPavel Emelyanov ip4_frags.frag_expire = ip_expire; 906d4ad4d22SNikolay Aleksandrov ip4_frags.frags_cache_name = ip_frag_cache_name; 907d4ad4d22SNikolay Aleksandrov if (inet_frags_init(&ip4_frags)) 908d4ad4d22SNikolay Aleksandrov panic("IP: failed to allocate ip4_frags cache\n"); 9091da177e4SLinus Torvalds } 910