]>
Commit | Line | Data |
---|---|---|
b0d623f7 | 1 | /* |
eb6b6ca3 | 2 | * Copyright (c) 2000-2020 Apple Inc. All rights reserved. |
b0d623f7 A |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ | |
0a7de745 | 5 | * |
b0d623f7 A |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License | |
8 | * Version 2.0 (the 'License'). You may not use this file except in | |
9 | * compliance with the License. The rights granted to you under the License | |
10 | * may not be used to create, or enable the creation or redistribution of, | |
11 | * unlawful or unlicensed copies of an Apple operating system, or to | |
12 | * circumvent, violate, or enable the circumvention or violation of, any | |
13 | * terms of an Apple operating system software license agreement. | |
0a7de745 | 14 | * |
b0d623f7 A |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. | |
0a7de745 | 17 | * |
b0d623f7 A |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER | |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, | |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, | |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. | |
23 | * Please see the License for the specific language governing rights and | |
24 | * limitations under the License. | |
0a7de745 | 25 | * |
b0d623f7 A |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ | |
28 | ||
9bccf70c A |
29 | /* $FreeBSD: src/sys/netinet6/frag6.c,v 1.2.2.5 2001/07/03 11:01:50 ume Exp $ */ |
30 | /* $KAME: frag6.c,v 1.31 2001/05/17 13:45:34 jinmei Exp $ */ | |
1c79356b A |
31 | |
32 | /* | |
33 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. | |
34 | * All rights reserved. | |
35 | * | |
36 | * Redistribution and use in source and binary forms, with or without | |
37 | * modification, are permitted provided that the following conditions | |
38 | * are met: | |
39 | * 1. Redistributions of source code must retain the above copyright | |
40 | * notice, this list of conditions and the following disclaimer. | |
41 | * 2. Redistributions in binary form must reproduce the above copyright | |
42 | * notice, this list of conditions and the following disclaimer in the | |
43 | * documentation and/or other materials provided with the distribution. | |
44 | * 3. Neither the name of the project nor the names of its contributors | |
45 | * may be used to endorse or promote products derived from this software | |
46 | * without specific prior written permission. | |
47 | * | |
48 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND | |
49 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | |
51 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE | |
52 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | |
53 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | |
54 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
55 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | |
56 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | |
57 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | |
58 | * SUCH DAMAGE. | |
59 | */ | |
60 | ||
61 | #include <sys/param.h> | |
62 | #include <sys/systm.h> | |
63 | #include <sys/malloc.h> | |
316670eb | 64 | #include <sys/mcache.h> |
1c79356b A |
65 | #include <sys/mbuf.h> |
66 | #include <sys/domain.h> | |
67 | #include <sys/protosw.h> | |
68 | #include <sys/socket.h> | |
69 | #include <sys/errno.h> | |
70 | #include <sys/time.h> | |
71 | #include <sys/kernel.h> | |
72 | #include <sys/syslog.h> | |
73 | #include <kern/queue.h> | |
91447636 | 74 | #include <kern/locks.h> |
1c79356b A |
75 | |
76 | #include <net/if.h> | |
77 | #include <net/route.h> | |
78 | ||
79 | #include <netinet/in.h> | |
80 | #include <netinet/in_var.h> | |
6d2010ae | 81 | #include <netinet/ip.h> |
5ba3f43e | 82 | #include <netinet/ip_var.h> |
1c79356b A |
83 | #include <netinet/ip6.h> |
84 | #include <netinet6/ip6_var.h> | |
1c79356b A |
85 | #include <netinet/icmp6.h> |
86 | ||
87 | #include <net/net_osdep.h> | |
39236c6e | 88 | #include <dev/random/randomdev.h> |
1c79356b A |
89 | |
90 | /* | |
91 | * Define it to get a correct behavior on per-interface statistics. | |
1c79356b A |
92 | */ |
93 | #define IN6_IFSTAT_STRICT | |
94 | ||
39236c6e A |
95 | MBUFQ_HEAD(fq6_head); |
96 | ||
97 | static void frag6_save_context(struct mbuf *, int); | |
98 | static void frag6_scrub_context(struct mbuf *); | |
99 | static int frag6_restore_context(struct mbuf *); | |
100 | ||
101 | static void frag6_icmp6_paramprob_error(struct fq6_head *); | |
102 | static void frag6_icmp6_timeex_error(struct fq6_head *); | |
103 | ||
91447636 A |
104 | static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *); |
105 | static void frag6_deq(struct ip6asfrag *); | |
106 | static void frag6_insque(struct ip6q *, struct ip6q *); | |
107 | static void frag6_remque(struct ip6q *); | |
39236c6e A |
108 | static void frag6_freef(struct ip6q *, struct fq6_head *, struct fq6_head *); |
109 | ||
0a7de745 | 110 | static int frag6_timeout_run; /* frag6 timer is scheduled to run */ |
39236c6e A |
111 | static void frag6_timeout(void *); |
112 | static void frag6_sched_timeout(void); | |
113 | ||
114 | static struct ip6q *ip6q_alloc(int); | |
115 | static void ip6q_free(struct ip6q *); | |
116 | static void ip6q_updateparams(void); | |
117 | static struct ip6asfrag *ip6af_alloc(int); | |
118 | static void ip6af_free(struct ip6asfrag *); | |
119 | ||
120 | decl_lck_mtx_data(static, ip6qlock); | |
0a7de745 A |
121 | static lck_attr_t *ip6qlock_attr; |
122 | static lck_grp_t *ip6qlock_grp; | |
123 | static lck_grp_attr_t *ip6qlock_grp_attr; | |
39236c6e A |
124 | |
125 | /* IPv6 fragment reassembly queues (protected by ip6qlock) */ | |
0a7de745 A |
126 | static struct ip6q ip6q; /* ip6 reassembly queues */ |
127 | static int ip6_maxfragpackets; /* max packets in reass queues */ | |
128 | static u_int32_t frag6_nfragpackets; /* # of packets in reass queues */ | |
129 | static int ip6_maxfrags; /* max fragments in reass queues */ | |
130 | static u_int32_t frag6_nfrags; /* # of fragments in reass queues */ | |
131 | static u_int32_t ip6q_limit; /* ip6q allocation limit */ | |
132 | static u_int32_t ip6q_count; /* current # of allocated ip6q's */ | |
133 | static u_int32_t ip6af_limit; /* ip6asfrag allocation limit */ | |
134 | static u_int32_t ip6af_count; /* current # of allocated ip6asfrag's */ | |
39236c6e A |
135 | |
136 | static int sysctl_maxfragpackets SYSCTL_HANDLER_ARGS; | |
137 | static int sysctl_maxfrags SYSCTL_HANDLER_ARGS; | |
138 | ||
139 | SYSCTL_DECL(_net_inet6_ip6); | |
140 | ||
141 | SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGPACKETS, maxfragpackets, | |
142 | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxfragpackets, 0, | |
143 | sysctl_maxfragpackets, "I", | |
144 | "Maximum number of IPv6 fragment reassembly queue entries"); | |
145 | ||
146 | SYSCTL_UINT(_net_inet6_ip6, OID_AUTO, fragpackets, | |
147 | CTLFLAG_RD | CTLFLAG_LOCKED, &frag6_nfragpackets, 0, | |
148 | "Current number of IPv6 fragment reassembly queue entries"); | |
149 | ||
150 | SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGS, maxfrags, | |
151 | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxfrags, 0, | |
152 | sysctl_maxfrags, "I", "Maximum number of IPv6 fragments allowed"); | |
1c79356b | 153 | |
1c79356b A |
154 | /* |
155 | * Initialise reassembly queue and fragment identifier. | |
156 | */ | |
157 | void | |
39236c6e | 158 | frag6_init(void) |
1c79356b | 159 | { |
39236c6e | 160 | /* ip6q_alloc() uses mbufs for IPv6 fragment queue structures */ |
0a7de745 | 161 | _CASSERT(sizeof(struct ip6q) <= _MLEN); |
39236c6e | 162 | /* ip6af_alloc() uses mbufs for IPv6 fragment queue structures */ |
0a7de745 | 163 | _CASSERT(sizeof(struct ip6asfrag) <= _MLEN); |
39236c6e A |
164 | |
165 | /* IPv6 fragment reassembly queue lock */ | |
166 | ip6qlock_grp_attr = lck_grp_attr_alloc_init(); | |
167 | ip6qlock_grp = lck_grp_alloc_init("ip6qlock", ip6qlock_grp_attr); | |
168 | ip6qlock_attr = lck_attr_alloc_init(); | |
169 | lck_mtx_init(&ip6qlock, ip6qlock_grp, ip6qlock_attr); | |
170 | ||
171 | lck_mtx_lock(&ip6qlock); | |
172 | /* Initialize IPv6 reassembly queue. */ | |
173 | ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q; | |
1c79356b | 174 | |
39236c6e | 175 | /* same limits as IPv4 */ |
483a1d10 | 176 | ip6_maxfragpackets = nmbclusters / 32; |
39236c6e A |
177 | ip6_maxfrags = ip6_maxfragpackets * 2; |
178 | ip6q_updateparams(); | |
179 | lck_mtx_unlock(&ip6qlock); | |
180 | } | |
9bccf70c | 181 | |
39236c6e A |
182 | static void |
183 | frag6_save_context(struct mbuf *m, int val) | |
184 | { | |
185 | m->m_pkthdr.pkt_hdr = (void *)(uintptr_t)val; | |
186 | } | |
187 | ||
188 | static void | |
189 | frag6_scrub_context(struct mbuf *m) | |
190 | { | |
191 | m->m_pkthdr.pkt_hdr = NULL; | |
192 | } | |
193 | ||
194 | static int | |
195 | frag6_restore_context(struct mbuf *m) | |
196 | { | |
0a7de745 | 197 | return (int)m->m_pkthdr.pkt_hdr; |
39236c6e A |
198 | } |
199 | ||
200 | /* | |
201 | * Send any deferred ICMP param problem error messages; caller must not be | |
202 | * holding ip6qlock and is expected to have saved the per-packet parameter | |
203 | * value via frag6_save_context(). | |
204 | */ | |
205 | static void | |
206 | frag6_icmp6_paramprob_error(struct fq6_head *diq6) | |
207 | { | |
5ba3f43e | 208 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_NOTOWNED); |
39236c6e A |
209 | |
210 | if (!MBUFQ_EMPTY(diq6)) { | |
211 | struct mbuf *merr, *merr_tmp; | |
212 | int param; | |
213 | MBUFQ_FOREACH_SAFE(merr, diq6, merr_tmp) { | |
214 | MBUFQ_REMOVE(diq6, merr); | |
215 | MBUFQ_NEXT(merr) = NULL; | |
216 | param = frag6_restore_context(merr); | |
217 | frag6_scrub_context(merr); | |
218 | icmp6_error(merr, ICMP6_PARAM_PROB, | |
219 | ICMP6_PARAMPROB_HEADER, param); | |
220 | } | |
221 | } | |
222 | } | |
223 | ||
224 | /* | |
225 | * Send any deferred ICMP time exceeded error messages; | |
226 | * caller must not be holding ip6qlock. | |
227 | */ | |
228 | static void | |
229 | frag6_icmp6_timeex_error(struct fq6_head *diq6) | |
230 | { | |
5ba3f43e | 231 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_NOTOWNED); |
39236c6e A |
232 | |
233 | if (!MBUFQ_EMPTY(diq6)) { | |
234 | struct mbuf *m, *m_tmp; | |
235 | MBUFQ_FOREACH_SAFE(m, diq6, m_tmp) { | |
236 | MBUFQ_REMOVE(diq6, m); | |
237 | MBUFQ_NEXT(m) = NULL; | |
3e170ce0 A |
238 | icmp6_error_flag(m, ICMP6_TIME_EXCEEDED, |
239 | ICMP6_TIME_EXCEED_REASSEMBLY, 0, 0); | |
39236c6e A |
240 | } |
241 | } | |
1c79356b A |
242 | } |
243 | ||
244 | /* | |
245 | * In RFC2460, fragment and reassembly rule do not agree with each other, | |
246 | * in terms of next header field handling in fragment header. | |
247 | * While the sender will use the same value for all of the fragmented packets, | |
248 | * receiver is suggested not to check the consistency. | |
249 | * | |
250 | * fragment rule (p20): | |
251 | * (2) A Fragment header containing: | |
252 | * The Next Header value that identifies the first header of | |
253 | * the Fragmentable Part of the original packet. | |
254 | * -> next header field is same for all fragments | |
255 | * | |
256 | * reassembly rule (p21): | |
257 | * The Next Header field of the last header of the Unfragmentable | |
258 | * Part is obtained from the Next Header field of the first | |
259 | * fragment's Fragment header. | |
260 | * -> should grab it from the first fragment only | |
261 | * | |
262 | * The following note also contradicts with fragment rule - noone is going to | |
263 | * send different fragment with different next header field. | |
264 | * | |
265 | * additional note (p22): | |
266 | * The Next Header values in the Fragment headers of different | |
267 | * fragments of the same original packet may differ. Only the value | |
268 | * from the Offset zero fragment packet is used for reassembly. | |
269 | * -> should grab it from the first fragment only | |
270 | * | |
271 | * There is no explicit reason given in the RFC. Historical reason maybe? | |
272 | */ | |
273 | /* | |
274 | * Fragment input | |
275 | */ | |
276 | int | |
6d2010ae | 277 | frag6_input(struct mbuf **mp, int *offp, int proto) |
1c79356b | 278 | { |
6d2010ae | 279 | #pragma unused(proto) |
eb6b6ca3 A |
280 | struct mbuf *m = *mp, *t = NULL; |
281 | struct ip6_hdr *ip6 = NULL; | |
282 | struct ip6_frag *ip6f = NULL; | |
283 | struct ip6q *q6 = NULL; | |
284 | struct ip6asfrag *af6 = NULL, *ip6af = NULL, *af6dwn = NULL; | |
285 | int offset = *offp, nxt = 0, i = 0, next = 0; | |
1c79356b | 286 | int first_frag = 0; |
eb6b6ca3 | 287 | int fragoff = 0, frgpartlen = 0; /* must be larger than u_int16_t */ |
39236c6e | 288 | struct ifnet *dstifp = NULL; |
eb6b6ca3 A |
289 | u_int8_t ecn = 0, ecn0 = 0; |
290 | uint32_t csum = 0, csum_flags = 0; | |
291 | struct fq6_head diq6 = {}; | |
39236c6e | 292 | int locked = 0; |
6d2010ae | 293 | |
39236c6e A |
294 | VERIFY(m->m_flags & M_PKTHDR); |
295 | ||
0a7de745 | 296 | MBUFQ_INIT(&diq6); /* for deferred ICMP param problem errors */ |
1c79356b | 297 | |
316670eb A |
298 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
299 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); | |
300 | ||
39236c6e | 301 | IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), goto done); |
eb6b6ca3 | 302 | ip6 = mtod(m, struct ip6_hdr *); |
1c79356b | 303 | ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset); |
1c79356b | 304 | |
1c79356b A |
305 | #ifdef IN6_IFSTAT_STRICT |
306 | /* find the destination interface of the packet. */ | |
39236c6e A |
307 | if (m->m_pkthdr.pkt_flags & PKTF_IFAINFO) { |
308 | uint32_t idx; | |
309 | ||
310 | if (ip6_getdstifaddr_info(m, &idx, NULL) == 0) { | |
311 | if (idx > 0 && idx <= if_index) { | |
312 | ifnet_head_lock_shared(); | |
313 | dstifp = ifindex2ifnet[idx]; | |
314 | ifnet_head_done(); | |
315 | } | |
b0d623f7 | 316 | } |
1c79356b | 317 | } |
39236c6e A |
318 | #endif /* IN6_IFSTAT_STRICT */ |
319 | ||
320 | /* we are violating the spec, this may not be the dst interface */ | |
0a7de745 | 321 | if (dstifp == NULL) { |
1c79356b | 322 | dstifp = m->m_pkthdr.rcvif; |
0a7de745 | 323 | } |
1c79356b A |
324 | |
325 | /* jumbo payload can't contain a fragment header */ | |
326 | if (ip6->ip6_plen == 0) { | |
327 | icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset); | |
328 | in6_ifstat_inc(dstifp, ifs6_reass_fail); | |
39236c6e A |
329 | m = NULL; |
330 | goto done; | |
1c79356b A |
331 | } |
332 | ||
333 | /* | |
334 | * check whether fragment packet's fragment length is | |
335 | * multiple of 8 octets. | |
336 | * sizeof(struct ip6_frag) == 8 | |
337 | * sizeof(struct ip6_hdr) = 40 | |
338 | */ | |
339 | if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) && | |
340 | (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) { | |
39236c6e A |
341 | icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, |
342 | offsetof(struct ip6_hdr, ip6_plen)); | |
1c79356b | 343 | in6_ifstat_inc(dstifp, ifs6_reass_fail); |
39236c6e A |
344 | m = NULL; |
345 | goto done; | |
346 | } | |
347 | ||
348 | /* If ip6_maxfragpackets or ip6_maxfrags is 0, never accept fragments */ | |
349 | if (ip6_maxfragpackets == 0 || ip6_maxfrags == 0) { | |
350 | ip6stat.ip6s_fragments++; | |
351 | ip6stat.ip6s_fragdropped++; | |
352 | in6_ifstat_inc(dstifp, ifs6_reass_fail); | |
353 | m_freem(m); | |
354 | m = NULL; | |
355 | goto done; | |
1c79356b A |
356 | } |
357 | ||
1c79356b A |
358 | /* offset now points to data portion */ |
359 | offset += sizeof(struct ip6_frag); | |
360 | ||
39037602 A |
361 | /* |
362 | * RFC 6946: Handle "atomic" fragments (offset and m bit set to 0) | |
363 | * upfront, unrelated to any reassembly. Just skip the fragment header. | |
364 | */ | |
365 | if ((ip6f->ip6f_offlg & ~IP6F_RESERVED_MASK) == 0) { | |
366 | /* | |
cb323159 | 367 | * Mark packet as reassembled. |
39037602 A |
368 | * In ICMPv6 processing, we drop certain |
369 | * NDP messages that are not expected to | |
370 | * have fragment header based on recommendations | |
371 | * against security vulnerability as described in | |
372 | * RFC 6980. | |
cb323159 | 373 | * Treat atomic fragments as re-assembled packets as well. |
39037602 | 374 | */ |
cb323159 | 375 | m->m_pkthdr.pkt_flags |= PKTF_REASSEMBLED; |
39037602 A |
376 | ip6stat.ip6s_atmfrag_rcvd++; |
377 | in6_ifstat_inc(dstifp, ifs6_atmfrag_rcvd); | |
eb6b6ca3 | 378 | *mp = m; |
39037602 | 379 | *offp = offset; |
0a7de745 | 380 | return ip6f->ip6f_nxt; |
39037602 A |
381 | } |
382 | ||
91447636 | 383 | /* |
39236c6e A |
384 | * Leverage partial checksum offload for simple UDP/IP fragments, |
385 | * as that is the most common case. | |
386 | * | |
387 | * Perform 1's complement adjustment of octets that got included/ | |
5ba3f43e A |
388 | * excluded in the hardware-calculated checksum value. Also take |
389 | * care of any trailing bytes and subtract out their partial sum. | |
91447636 | 390 | */ |
39236c6e | 391 | if (ip6f->ip6f_nxt == IPPROTO_UDP && |
0a7de745 | 392 | offset == (sizeof(*ip6) + sizeof(*ip6f)) && |
39236c6e A |
393 | (m->m_pkthdr.csum_flags & |
394 | (CSUM_DATA_VALID | CSUM_PARTIAL | CSUM_PSEUDO_HDR)) == | |
395 | (CSUM_DATA_VALID | CSUM_PARTIAL)) { | |
5ba3f43e | 396 | uint32_t start = m->m_pkthdr.csum_rx_start; |
0a7de745 | 397 | uint32_t ip_len = (sizeof(*ip6) + ntohs(ip6->ip6_plen)); |
5ba3f43e A |
398 | int32_t trailer = (m_pktlen(m) - ip_len); |
399 | uint32_t swbytes = (uint32_t)trailer; | |
39236c6e | 400 | |
39236c6e A |
401 | csum = m->m_pkthdr.csum_rx_val; |
402 | ||
5ba3f43e A |
403 | ASSERT(trailer >= 0); |
404 | if (start != offset || trailer != 0) { | |
405 | uint16_t s = 0, d = 0; | |
39236c6e A |
406 | |
407 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) { | |
408 | s = ip6->ip6_src.s6_addr16[1]; | |
0a7de745 | 409 | ip6->ip6_src.s6_addr16[1] = 0; |
39236c6e A |
410 | } |
411 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) { | |
412 | d = ip6->ip6_dst.s6_addr16[1]; | |
413 | ip6->ip6_dst.s6_addr16[1] = 0; | |
414 | } | |
415 | ||
416 | /* callee folds in sum */ | |
5ba3f43e A |
417 | csum = m_adj_sum16(m, start, offset, |
418 | (ip_len - offset), csum); | |
0a7de745 | 419 | if (offset > start) { |
5ba3f43e | 420 | swbytes += (offset - start); |
0a7de745 | 421 | } else { |
5ba3f43e | 422 | swbytes += (start - offset); |
0a7de745 | 423 | } |
39236c6e | 424 | |
0a7de745 | 425 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) { |
39236c6e | 426 | ip6->ip6_src.s6_addr16[1] = s; |
0a7de745 A |
427 | } |
428 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) { | |
39236c6e | 429 | ip6->ip6_dst.s6_addr16[1] = d; |
0a7de745 | 430 | } |
39236c6e A |
431 | } |
432 | csum_flags = m->m_pkthdr.csum_flags; | |
5ba3f43e | 433 | |
0a7de745 | 434 | if (swbytes != 0) { |
5ba3f43e | 435 | udp_in6_cksum_stats(swbytes); |
0a7de745 A |
436 | } |
437 | if (trailer != 0) { | |
5ba3f43e | 438 | m_adj(m, -trailer); |
0a7de745 | 439 | } |
39236c6e A |
440 | } else { |
441 | csum = 0; | |
442 | csum_flags = 0; | |
443 | } | |
444 | ||
445 | /* Invalidate checksum */ | |
446 | m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID; | |
447 | ||
448 | ip6stat.ip6s_fragments++; | |
449 | in6_ifstat_inc(dstifp, ifs6_reass_reqd); | |
450 | ||
451 | lck_mtx_lock(&ip6qlock); | |
452 | locked = 1; | |
91447636 | 453 | |
0a7de745 | 454 | for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next) { |
1c79356b A |
455 | if (ip6f->ip6f_ident == q6->ip6q_ident && |
456 | IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) && | |
0a7de745 | 457 | IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst)) { |
1c79356b | 458 | break; |
0a7de745 A |
459 | } |
460 | } | |
1c79356b A |
461 | |
462 | if (q6 == &ip6q) { | |
463 | /* | |
464 | * the first fragment to arrive, create a reassembly queue. | |
465 | */ | |
466 | first_frag = 1; | |
1c79356b | 467 | |
39236c6e | 468 | q6 = ip6q_alloc(M_DONTWAIT); |
0a7de745 | 469 | if (q6 == NULL) { |
1c79356b | 470 | goto dropfrag; |
0a7de745 | 471 | } |
1c79356b A |
472 | |
473 | frag6_insque(q6, &ip6q); | |
39236c6e | 474 | frag6_nfragpackets++; |
1c79356b A |
475 | |
476 | /* ip6q_nxt will be filled afterwards, from 1st fragment */ | |
0a7de745 | 477 | q6->ip6q_down = q6->ip6q_up = (struct ip6asfrag *)q6; |
9bccf70c | 478 | #ifdef notyet |
0a7de745 | 479 | q6->ip6q_nxtp = (u_char *)nxtp; |
1c79356b | 480 | #endif |
0a7de745 A |
481 | q6->ip6q_ident = ip6f->ip6f_ident; |
482 | q6->ip6q_ttl = IPV6_FRAGTTL; | |
483 | q6->ip6q_src = ip6->ip6_src; | |
484 | q6->ip6q_dst = ip6->ip6_dst; | |
485 | q6->ip6q_ecn = | |
6d2010ae | 486 | (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; |
0a7de745 | 487 | q6->ip6q_unfrglen = -1; /* The 1st fragment has not arrived. */ |
91447636 | 488 | |
39236c6e A |
489 | q6->ip6q_nfrag = 0; |
490 | ||
491 | /* | |
492 | * If the first fragment has valid checksum offload | |
493 | * info, the rest of fragments are eligible as well. | |
494 | */ | |
495 | if (csum_flags != 0) { | |
496 | q6->ip6q_csum = csum; | |
497 | q6->ip6q_csum_flags = csum_flags; | |
498 | } | |
1c79356b A |
499 | } |
500 | ||
501 | /* | |
502 | * If it's the 1st fragment, record the length of the | |
503 | * unfragmentable part and the next header of the fragment header. | |
504 | */ | |
505 | fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK); | |
506 | if (fragoff == 0) { | |
39236c6e A |
507 | q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr) - |
508 | sizeof(struct ip6_frag); | |
1c79356b A |
509 | q6->ip6q_nxt = ip6f->ip6f_nxt; |
510 | } | |
511 | ||
512 | /* | |
513 | * Check that the reassembled packet would not exceed 65535 bytes | |
514 | * in size. | |
515 | * If it would exceed, discard the fragment and return an ICMP error. | |
516 | */ | |
517 | frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset; | |
518 | if (q6->ip6q_unfrglen >= 0) { | |
519 | /* The 1st fragment has already arrived. */ | |
520 | if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) { | |
39236c6e A |
521 | lck_mtx_unlock(&ip6qlock); |
522 | locked = 0; | |
1c79356b | 523 | icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, |
39236c6e A |
524 | offset - sizeof(struct ip6_frag) + |
525 | offsetof(struct ip6_frag, ip6f_offlg)); | |
526 | m = NULL; | |
527 | goto done; | |
1c79356b | 528 | } |
39236c6e A |
529 | } else if (fragoff + frgpartlen > IPV6_MAXPACKET) { |
530 | lck_mtx_unlock(&ip6qlock); | |
531 | locked = 0; | |
1c79356b | 532 | icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, |
39236c6e A |
533 | offset - sizeof(struct ip6_frag) + |
534 | offsetof(struct ip6_frag, ip6f_offlg)); | |
535 | m = NULL; | |
536 | goto done; | |
1c79356b A |
537 | } |
538 | /* | |
539 | * If it's the first fragment, do the above check for each | |
540 | * fragment already stored in the reassembly queue. | |
541 | */ | |
542 | if (fragoff == 0) { | |
eb6b6ca3 A |
543 | /* |
544 | * https://tools.ietf.org/html/rfc8200#page-20 | |
545 | * If the first fragment does not include all headers through an | |
546 | * Upper-Layer header, then that fragment should be discarded and | |
547 | * an ICMP Parameter Problem, Code 3, message should be sent to | |
548 | * the source of the fragment, with the Pointer field set to zero. | |
549 | */ | |
550 | if (!ip6_pkt_has_ulp(m)) { | |
551 | lck_mtx_unlock(&ip6qlock); | |
552 | locked = 0; | |
553 | icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, 0); | |
554 | m = NULL; | |
555 | goto done; | |
556 | } | |
1c79356b | 557 | for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; |
0a7de745 | 558 | af6 = af6dwn) { |
1c79356b A |
559 | af6dwn = af6->ip6af_down; |
560 | ||
561 | if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen > | |
562 | IPV6_MAXPACKET) { | |
563 | struct mbuf *merr = IP6_REASS_MBUF(af6); | |
564 | struct ip6_hdr *ip6err; | |
565 | int erroff = af6->ip6af_offset; | |
566 | ||
567 | /* dequeue the fragment. */ | |
568 | frag6_deq(af6); | |
39236c6e | 569 | ip6af_free(af6); |
1c79356b A |
570 | |
571 | /* adjust pointer. */ | |
572 | ip6err = mtod(merr, struct ip6_hdr *); | |
573 | ||
574 | /* | |
575 | * Restore source and destination addresses | |
576 | * in the erroneous IPv6 header. | |
577 | */ | |
578 | ip6err->ip6_src = q6->ip6q_src; | |
579 | ip6err->ip6_dst = q6->ip6q_dst; | |
580 | ||
39236c6e | 581 | frag6_save_context(merr, |
0a7de745 | 582 | erroff - sizeof(struct ip6_frag) + |
39236c6e A |
583 | offsetof(struct ip6_frag, ip6f_offlg)); |
584 | ||
585 | MBUFQ_ENQUEUE(&diq6, merr); | |
1c79356b A |
586 | } |
587 | } | |
588 | } | |
589 | ||
39236c6e | 590 | ip6af = ip6af_alloc(M_DONTWAIT); |
0a7de745 | 591 | if (ip6af == NULL) { |
1c79356b | 592 | goto dropfrag; |
0a7de745 | 593 | } |
39236c6e | 594 | |
1c79356b A |
595 | ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG; |
596 | ip6af->ip6af_off = fragoff; | |
597 | ip6af->ip6af_frglen = frgpartlen; | |
598 | ip6af->ip6af_offset = offset; | |
599 | IP6_REASS_MBUF(ip6af) = m; | |
600 | ||
601 | if (first_frag) { | |
602 | af6 = (struct ip6asfrag *)q6; | |
603 | goto insert; | |
604 | } | |
605 | ||
6d2010ae A |
606 | /* |
607 | * Handle ECN by comparing this segment with the first one; | |
608 | * if CE is set, do not lose CE. | |
609 | * drop if CE and not-ECT are mixed for the same packet. | |
610 | */ | |
611 | ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; | |
612 | ecn0 = q6->ip6q_ecn; | |
613 | if (ecn == IPTOS_ECN_CE) { | |
614 | if (ecn0 == IPTOS_ECN_NOTECT) { | |
39236c6e | 615 | ip6af_free(ip6af); |
6d2010ae A |
616 | goto dropfrag; |
617 | } | |
0a7de745 | 618 | if (ecn0 != IPTOS_ECN_CE) { |
6d2010ae | 619 | q6->ip6q_ecn = IPTOS_ECN_CE; |
0a7de745 | 620 | } |
6d2010ae A |
621 | } |
622 | if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) { | |
39236c6e | 623 | ip6af_free(ip6af); |
6d2010ae A |
624 | goto dropfrag; |
625 | } | |
626 | ||
1c79356b A |
627 | /* |
628 | * Find a segment which begins after this one does. | |
629 | */ | |
630 | for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; | |
0a7de745 A |
631 | af6 = af6->ip6af_down) { |
632 | if (af6->ip6af_off > ip6af->ip6af_off) { | |
1c79356b | 633 | break; |
0a7de745 A |
634 | } |
635 | } | |
1c79356b A |
636 | |
637 | #if 0 | |
638 | /* | |
639 | * If there is a preceding segment, it may provide some of | |
640 | * our data already. If so, drop the data from the incoming | |
641 | * segment. If it provides all of our data, drop us. | |
39236c6e A |
642 | * |
643 | * If some of the data is dropped from the preceding | |
644 | * segment, then it's checksum is invalidated. | |
1c79356b A |
645 | */ |
646 | if (af6->ip6af_up != (struct ip6asfrag *)q6) { | |
647 | i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen | |
0a7de745 | 648 | - ip6af->ip6af_off; |
1c79356b | 649 | if (i > 0) { |
0a7de745 | 650 | if (i >= ip6af->ip6af_frglen) { |
1c79356b | 651 | goto dropfrag; |
0a7de745 | 652 | } |
1c79356b | 653 | m_adj(IP6_REASS_MBUF(ip6af), i); |
39236c6e | 654 | q6->ip6q_csum_flags = 0; |
1c79356b A |
655 | ip6af->ip6af_off += i; |
656 | ip6af->ip6af_frglen -= i; | |
657 | } | |
658 | } | |
659 | ||
660 | /* | |
661 | * While we overlap succeeding segments trim them or, | |
662 | * if they are completely covered, dequeue them. | |
663 | */ | |
664 | while (af6 != (struct ip6asfrag *)q6 && | |
0a7de745 | 665 | ip6af->ip6af_off + ip6af->ip6af_frglen > af6->ip6af_off) { |
1c79356b A |
666 | i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off; |
667 | if (i < af6->ip6af_frglen) { | |
668 | af6->ip6af_frglen -= i; | |
669 | af6->ip6af_off += i; | |
670 | m_adj(IP6_REASS_MBUF(af6), i); | |
39236c6e | 671 | q6->ip6q_csum_flags = 0; |
1c79356b A |
672 | break; |
673 | } | |
674 | af6 = af6->ip6af_down; | |
675 | m_freem(IP6_REASS_MBUF(af6->ip6af_up)); | |
676 | frag6_deq(af6->ip6af_up); | |
677 | } | |
678 | #else | |
679 | /* | |
680 | * If the incoming framgent overlaps some existing fragments in | |
681 | * the reassembly queue, drop it, since it is dangerous to override | |
682 | * existing fragments from a security point of view. | |
6d2010ae A |
683 | * We don't know which fragment is the bad guy - here we trust |
684 | * fragment that came in earlier, with no real reason. | |
685 | * | |
686 | * Note: due to changes after disabling this part, mbuf passed to | |
687 | * m_adj() below now does not meet the requirement. | |
1c79356b A |
688 | */ |
689 | if (af6->ip6af_up != (struct ip6asfrag *)q6) { | |
690 | i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen | |
0a7de745 | 691 | - ip6af->ip6af_off; |
1c79356b | 692 | if (i > 0) { |
0a7de745 | 693 | #if 0 /* suppress the noisy log */ |
1c79356b A |
694 | log(LOG_ERR, "%d bytes of a fragment from %s " |
695 | "overlaps the previous fragment\n", | |
696 | i, ip6_sprintf(&q6->ip6q_src)); | |
9bccf70c | 697 | #endif |
39236c6e | 698 | ip6af_free(ip6af); |
1c79356b A |
699 | goto dropfrag; |
700 | } | |
701 | } | |
702 | if (af6 != (struct ip6asfrag *)q6) { | |
703 | i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off; | |
704 | if (i > 0) { | |
0a7de745 | 705 | #if 0 /* suppress the noisy log */ |
1c79356b A |
706 | log(LOG_ERR, "%d bytes of a fragment from %s " |
707 | "overlaps the succeeding fragment", | |
708 | i, ip6_sprintf(&q6->ip6q_src)); | |
9bccf70c | 709 | #endif |
39236c6e | 710 | ip6af_free(ip6af); |
1c79356b A |
711 | goto dropfrag; |
712 | } | |
713 | } | |
714 | #endif | |
715 | ||
39236c6e A |
716 | /* |
717 | * If this fragment contains similar checksum offload info | |
718 | * as that of the existing ones, accumulate checksum. Otherwise, | |
719 | * invalidate checksum offload info for the entire datagram. | |
720 | */ | |
0a7de745 | 721 | if (csum_flags != 0 && csum_flags == q6->ip6q_csum_flags) { |
39236c6e | 722 | q6->ip6q_csum += csum; |
0a7de745 | 723 | } else if (q6->ip6q_csum_flags != 0) { |
39236c6e | 724 | q6->ip6q_csum_flags = 0; |
0a7de745 | 725 | } |
39236c6e | 726 | |
1c79356b A |
727 | insert: |
728 | ||
729 | /* | |
730 | * Stick new segment in its place; | |
731 | * check for complete reassembly. | |
732 | * Move to front of packet queue, as we are | |
733 | * the most recently active fragmented packet. | |
734 | */ | |
735 | frag6_enq(ip6af, af6->ip6af_up); | |
91447636 A |
736 | frag6_nfrags++; |
737 | q6->ip6q_nfrag++; | |
1c79356b A |
738 | #if 0 /* xxx */ |
739 | if (q6 != ip6q.ip6q_next) { | |
740 | frag6_remque(q6); | |
741 | frag6_insque(q6, &ip6q); | |
742 | } | |
743 | #endif | |
744 | next = 0; | |
745 | for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; | |
0a7de745 | 746 | af6 = af6->ip6af_down) { |
1c79356b | 747 | if (af6->ip6af_off != next) { |
39236c6e A |
748 | lck_mtx_unlock(&ip6qlock); |
749 | locked = 0; | |
750 | m = NULL; | |
751 | goto done; | |
1c79356b A |
752 | } |
753 | next += af6->ip6af_frglen; | |
754 | } | |
755 | if (af6->ip6af_up->ip6af_mff) { | |
39236c6e A |
756 | lck_mtx_unlock(&ip6qlock); |
757 | locked = 0; | |
758 | m = NULL; | |
759 | goto done; | |
1c79356b A |
760 | } |
761 | ||
762 | /* | |
763 | * Reassembly is complete; concatenate fragments. | |
764 | */ | |
765 | ip6af = q6->ip6q_down; | |
766 | t = m = IP6_REASS_MBUF(ip6af); | |
767 | af6 = ip6af->ip6af_down; | |
768 | frag6_deq(ip6af); | |
769 | while (af6 != (struct ip6asfrag *)q6) { | |
770 | af6dwn = af6->ip6af_down; | |
771 | frag6_deq(af6); | |
0a7de745 | 772 | while (t->m_next) { |
1c79356b | 773 | t = t->m_next; |
0a7de745 | 774 | } |
1c79356b A |
775 | t->m_next = IP6_REASS_MBUF(af6); |
776 | m_adj(t->m_next, af6->ip6af_offset); | |
39236c6e | 777 | ip6af_free(af6); |
1c79356b A |
778 | af6 = af6dwn; |
779 | } | |
780 | ||
39236c6e A |
781 | /* |
782 | * Store partial hardware checksum info from the fragment queue; | |
783 | * the receive start offset is set to 40 bytes (see code at the | |
784 | * top of this routine.) | |
785 | */ | |
786 | if (q6->ip6q_csum_flags != 0) { | |
787 | csum = q6->ip6q_csum; | |
788 | ||
789 | ADDCARRY(csum); | |
790 | ||
791 | m->m_pkthdr.csum_rx_val = csum; | |
0a7de745 | 792 | m->m_pkthdr.csum_rx_start = sizeof(struct ip6_hdr); |
39236c6e A |
793 | m->m_pkthdr.csum_flags = q6->ip6q_csum_flags; |
794 | } else if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) || | |
795 | (m->m_pkthdr.pkt_flags & PKTF_LOOP)) { | |
796 | /* loopback checksums are always OK */ | |
797 | m->m_pkthdr.csum_data = 0xffff; | |
39236c6e A |
798 | m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR; |
799 | } | |
800 | ||
1c79356b A |
801 | /* adjust offset to point where the original next header starts */ |
802 | offset = ip6af->ip6af_offset - sizeof(struct ip6_frag); | |
39236c6e | 803 | ip6af_free(ip6af); |
1c79356b A |
804 | ip6 = mtod(m, struct ip6_hdr *); |
805 | ip6->ip6_plen = htons((u_short)next + offset - sizeof(struct ip6_hdr)); | |
806 | ip6->ip6_src = q6->ip6q_src; | |
807 | ip6->ip6_dst = q6->ip6q_dst; | |
0a7de745 | 808 | if (q6->ip6q_ecn == IPTOS_ECN_CE) { |
6d2010ae | 809 | ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20); |
0a7de745 | 810 | } |
6d2010ae | 811 | |
1c79356b | 812 | nxt = q6->ip6q_nxt; |
39236c6e | 813 | #ifdef notyet |
1c79356b A |
814 | *q6->ip6q_nxtp = (u_char)(nxt & 0xff); |
815 | #endif | |
816 | ||
6d2010ae A |
817 | /* Delete frag6 header */ |
818 | if (m->m_len >= offset + sizeof(struct ip6_frag)) { | |
819 | /* This is the only possible case with !PULLDOWN_TEST */ | |
1c79356b | 820 | ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag), |
39236c6e | 821 | offset); |
1c79356b A |
822 | m->m_data += sizeof(struct ip6_frag); |
823 | m->m_len -= sizeof(struct ip6_frag); | |
824 | } else { | |
825 | /* this comes with no copy if the boundary is on cluster */ | |
826 | if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) { | |
827 | frag6_remque(q6); | |
1c79356b | 828 | frag6_nfragpackets--; |
39236c6e A |
829 | frag6_nfrags -= q6->ip6q_nfrag; |
830 | ip6q_free(q6); | |
1c79356b A |
831 | goto dropfrag; |
832 | } | |
833 | m_adj(t, sizeof(struct ip6_frag)); | |
834 | m_cat(m, t); | |
835 | } | |
836 | ||
837 | /* | |
838 | * Store NXT to the original. | |
839 | */ | |
840 | { | |
841 | char *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */ | |
842 | *prvnxtp = nxt; | |
843 | } | |
844 | ||
845 | frag6_remque(q6); | |
1c79356b | 846 | frag6_nfragpackets--; |
39236c6e A |
847 | frag6_nfrags -= q6->ip6q_nfrag; |
848 | ip6q_free(q6); | |
849 | ||
0a7de745 | 850 | if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */ |
39236c6e | 851 | m_fixhdr(m); |
39037602 A |
852 | /* |
853 | * Mark packet as reassembled | |
854 | * In ICMPv6 processing, we drop certain | |
855 | * NDP messages that are not expected to | |
856 | * have fragment header based on recommendations | |
857 | * against security vulnerability as described in | |
858 | * RFC 6980. | |
859 | */ | |
860 | m->m_pkthdr.pkt_flags |= PKTF_REASSEMBLED; | |
861 | } | |
1c79356b | 862 | ip6stat.ip6s_reassembled++; |
1c79356b A |
863 | |
864 | /* | |
865 | * Tell launch routine the next header | |
866 | */ | |
1c79356b A |
867 | *mp = m; |
868 | *offp = offset; | |
869 | ||
39236c6e A |
870 | /* arm the purge timer if not already and if there's work to do */ |
871 | frag6_sched_timeout(); | |
872 | lck_mtx_unlock(&ip6qlock); | |
873 | in6_ifstat_inc(dstifp, ifs6_reass_ok); | |
874 | frag6_icmp6_paramprob_error(&diq6); | |
875 | VERIFY(MBUFQ_EMPTY(&diq6)); | |
0a7de745 | 876 | return nxt; |
39236c6e A |
877 | |
878 | done: | |
879 | VERIFY(m == NULL); | |
eb6b6ca3 | 880 | *mp = m; |
39236c6e A |
881 | if (!locked) { |
882 | if (frag6_nfragpackets == 0) { | |
883 | frag6_icmp6_paramprob_error(&diq6); | |
884 | VERIFY(MBUFQ_EMPTY(&diq6)); | |
0a7de745 | 885 | return IPPROTO_DONE; |
39236c6e A |
886 | } |
887 | lck_mtx_lock(&ip6qlock); | |
888 | } | |
889 | /* arm the purge timer if not already and if there's work to do */ | |
890 | frag6_sched_timeout(); | |
891 | lck_mtx_unlock(&ip6qlock); | |
892 | frag6_icmp6_paramprob_error(&diq6); | |
893 | VERIFY(MBUFQ_EMPTY(&diq6)); | |
0a7de745 | 894 | return IPPROTO_DONE; |
39236c6e A |
895 | |
896 | dropfrag: | |
1c79356b | 897 | ip6stat.ip6s_fragdropped++; |
39236c6e A |
898 | /* arm the purge timer if not already and if there's work to do */ |
899 | frag6_sched_timeout(); | |
900 | lck_mtx_unlock(&ip6qlock); | |
901 | in6_ifstat_inc(dstifp, ifs6_reass_fail); | |
1c79356b | 902 | m_freem(m); |
eb6b6ca3 | 903 | *mp = NULL; |
39236c6e A |
904 | frag6_icmp6_paramprob_error(&diq6); |
905 | VERIFY(MBUFQ_EMPTY(&diq6)); | |
0a7de745 | 906 | return IPPROTO_DONE; |
1c79356b A |
907 | } |
908 | ||
909 | /* | |
910 | * Free a fragment reassembly header and all | |
911 | * associated datagrams. | |
912 | */ | |
913 | void | |
39236c6e | 914 | frag6_freef(struct ip6q *q6, struct fq6_head *dfq6, struct fq6_head *diq6) |
1c79356b A |
915 | { |
916 | struct ip6asfrag *af6, *down6; | |
917 | ||
5ba3f43e | 918 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e | 919 | |
1c79356b | 920 | for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6; |
0a7de745 | 921 | af6 = down6) { |
1c79356b A |
922 | struct mbuf *m = IP6_REASS_MBUF(af6); |
923 | ||
924 | down6 = af6->ip6af_down; | |
925 | frag6_deq(af6); | |
926 | ||
927 | /* | |
928 | * Return ICMP time exceeded error for the 1st fragment. | |
929 | * Just free other fragments. | |
930 | */ | |
931 | if (af6->ip6af_off == 0) { | |
932 | struct ip6_hdr *ip6; | |
933 | ||
934 | /* adjust pointer */ | |
935 | ip6 = mtod(m, struct ip6_hdr *); | |
936 | ||
6d2010ae | 937 | /* restore source and destination addresses */ |
1c79356b A |
938 | ip6->ip6_src = q6->ip6q_src; |
939 | ip6->ip6_dst = q6->ip6q_dst; | |
39236c6e A |
940 | |
941 | MBUFQ_ENQUEUE(diq6, m); | |
942 | } else { | |
943 | MBUFQ_ENQUEUE(dfq6, m); | |
944 | } | |
945 | ip6af_free(af6); | |
1c79356b A |
946 | } |
947 | frag6_remque(q6); | |
1c79356b | 948 | frag6_nfragpackets--; |
39236c6e A |
949 | frag6_nfrags -= q6->ip6q_nfrag; |
950 | ip6q_free(q6); | |
1c79356b A |
951 | } |
952 | ||
953 | /* | |
954 | * Put an ip fragment on a reassembly chain. | |
955 | * Like insque, but pointers in middle of structure. | |
956 | */ | |
957 | void | |
39236c6e | 958 | frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6) |
1c79356b | 959 | { |
5ba3f43e | 960 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e | 961 | |
1c79356b A |
962 | af6->ip6af_up = up6; |
963 | af6->ip6af_down = up6->ip6af_down; | |
964 | up6->ip6af_down->ip6af_up = af6; | |
965 | up6->ip6af_down = af6; | |
966 | } | |
967 | ||
968 | /* | |
969 | * To frag6_enq as remque is to insque. | |
970 | */ | |
971 | void | |
39236c6e | 972 | frag6_deq(struct ip6asfrag *af6) |
1c79356b | 973 | { |
5ba3f43e | 974 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e | 975 | |
1c79356b A |
976 | af6->ip6af_up->ip6af_down = af6->ip6af_down; |
977 | af6->ip6af_down->ip6af_up = af6->ip6af_up; | |
978 | } | |
979 | ||
980 | void | |
39236c6e | 981 | frag6_insque(struct ip6q *new, struct ip6q *old) |
1c79356b | 982 | { |
5ba3f43e | 983 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e | 984 | |
1c79356b A |
985 | new->ip6q_prev = old; |
986 | new->ip6q_next = old->ip6q_next; | |
0a7de745 | 987 | old->ip6q_next->ip6q_prev = new; |
1c79356b A |
988 | old->ip6q_next = new; |
989 | } | |
990 | ||
991 | void | |
39236c6e | 992 | frag6_remque(struct ip6q *p6) |
1c79356b | 993 | { |
5ba3f43e | 994 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e | 995 | |
1c79356b A |
996 | p6->ip6q_prev->ip6q_next = p6->ip6q_next; |
997 | p6->ip6q_next->ip6q_prev = p6->ip6q_prev; | |
998 | } | |
999 | ||
1000 | /* | |
9bccf70c | 1001 | * IPv6 reassembling timer processing; |
1c79356b A |
1002 | * if a timer expires on a reassembly |
1003 | * queue, discard it. | |
1004 | */ | |
39236c6e A |
1005 | static void |
1006 | frag6_timeout(void *arg) | |
1c79356b | 1007 | { |
39236c6e A |
1008 | #pragma unused(arg) |
1009 | struct fq6_head dfq6, diq6; | |
1c79356b | 1010 | struct ip6q *q6; |
1c79356b | 1011 | |
0a7de745 A |
1012 | MBUFQ_INIT(&dfq6); /* for deferred frees */ |
1013 | MBUFQ_INIT(&diq6); /* for deferred ICMP time exceeded errors */ | |
39236c6e A |
1014 | |
1015 | /* | |
1016 | * Update coarse-grained networking timestamp (in sec.); the idea | |
1017 | * is to piggy-back on the timeout callout to update the counter | |
1018 | * returnable via net_uptime(). | |
1019 | */ | |
1020 | net_update_uptime(); | |
1021 | ||
1022 | lck_mtx_lock(&ip6qlock); | |
1c79356b | 1023 | q6 = ip6q.ip6q_next; |
0a7de745 | 1024 | if (q6) { |
1c79356b A |
1025 | while (q6 != &ip6q) { |
1026 | --q6->ip6q_ttl; | |
1027 | q6 = q6->ip6q_next; | |
1028 | if (q6->ip6q_prev->ip6q_ttl == 0) { | |
1029 | ip6stat.ip6s_fragtimeout++; | |
1030 | /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ | |
39236c6e | 1031 | frag6_freef(q6->ip6q_prev, &dfq6, &diq6); |
1c79356b A |
1032 | } |
1033 | } | |
0a7de745 | 1034 | } |
1c79356b A |
1035 | /* |
1036 | * If we are over the maximum number of fragments | |
1037 | * (due to the limit being lowered), drain off | |
1038 | * enough to get down to the new limit. | |
1039 | */ | |
39236c6e A |
1040 | if (ip6_maxfragpackets >= 0) { |
1041 | while (frag6_nfragpackets > (unsigned)ip6_maxfragpackets && | |
1042 | ip6q.ip6q_prev) { | |
1043 | ip6stat.ip6s_fragoverflow++; | |
1044 | /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ | |
1045 | frag6_freef(ip6q.ip6q_prev, &dfq6, &diq6); | |
1046 | } | |
1047 | } | |
1048 | /* re-arm the purge timer if there's work to do */ | |
1049 | frag6_timeout_run = 0; | |
1050 | frag6_sched_timeout(); | |
1051 | lck_mtx_unlock(&ip6qlock); | |
1052 | ||
1053 | /* free fragments that need to be freed */ | |
0a7de745 | 1054 | if (!MBUFQ_EMPTY(&dfq6)) { |
39236c6e | 1055 | MBUFQ_DRAIN(&dfq6); |
0a7de745 | 1056 | } |
39236c6e A |
1057 | |
1058 | frag6_icmp6_timeex_error(&diq6); | |
1059 | ||
1060 | VERIFY(MBUFQ_EMPTY(&dfq6)); | |
1061 | VERIFY(MBUFQ_EMPTY(&diq6)); | |
1062 | } | |
1063 | ||
1064 | static void | |
1065 | frag6_sched_timeout(void) | |
1066 | { | |
5ba3f43e | 1067 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e A |
1068 | |
1069 | if (!frag6_timeout_run && frag6_nfragpackets > 0) { | |
1070 | frag6_timeout_run = 1; | |
1071 | timeout(frag6_timeout, NULL, hz); | |
1c79356b | 1072 | } |
1c79356b A |
1073 | } |
1074 | ||
1075 | /* | |
1076 | * Drain off all datagram fragments. | |
1077 | */ | |
1078 | void | |
39236c6e | 1079 | frag6_drain(void) |
1c79356b | 1080 | { |
39236c6e A |
1081 | struct fq6_head dfq6, diq6; |
1082 | ||
0a7de745 A |
1083 | MBUFQ_INIT(&dfq6); /* for deferred frees */ |
1084 | MBUFQ_INIT(&diq6); /* for deferred ICMP time exceeded errors */ | |
39236c6e A |
1085 | |
1086 | lck_mtx_lock(&ip6qlock); | |
1c79356b A |
1087 | while (ip6q.ip6q_next != &ip6q) { |
1088 | ip6stat.ip6s_fragdropped++; | |
1089 | /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ | |
39236c6e A |
1090 | frag6_freef(ip6q.ip6q_next, &dfq6, &diq6); |
1091 | } | |
1092 | lck_mtx_unlock(&ip6qlock); | |
1093 | ||
1094 | /* free fragments that need to be freed */ | |
0a7de745 | 1095 | if (!MBUFQ_EMPTY(&dfq6)) { |
39236c6e | 1096 | MBUFQ_DRAIN(&dfq6); |
0a7de745 | 1097 | } |
39236c6e A |
1098 | |
1099 | frag6_icmp6_timeex_error(&diq6); | |
1100 | ||
1101 | VERIFY(MBUFQ_EMPTY(&dfq6)); | |
1102 | VERIFY(MBUFQ_EMPTY(&diq6)); | |
1103 | } | |
1104 | ||
1105 | static struct ip6q * | |
1106 | ip6q_alloc(int how) | |
1107 | { | |
1108 | struct mbuf *t; | |
1109 | struct ip6q *q6; | |
1110 | ||
1111 | /* | |
1112 | * See comments in ip6q_updateparams(). Keep the count separate | |
1113 | * from frag6_nfragpackets since the latter represents the elements | |
1114 | * already in the reassembly queues. | |
1115 | */ | |
0a7de745 A |
1116 | if (ip6q_limit > 0 && ip6q_count > ip6q_limit) { |
1117 | return NULL; | |
1118 | } | |
39236c6e A |
1119 | |
1120 | t = m_get(how, MT_FTABLE); | |
1121 | if (t != NULL) { | |
1122 | atomic_add_32(&ip6q_count, 1); | |
1123 | q6 = mtod(t, struct ip6q *); | |
0a7de745 | 1124 | bzero(q6, sizeof(*q6)); |
39236c6e A |
1125 | } else { |
1126 | q6 = NULL; | |
1127 | } | |
0a7de745 | 1128 | return q6; |
39236c6e A |
1129 | } |
1130 | ||
1131 | static void | |
1132 | ip6q_free(struct ip6q *q6) | |
1133 | { | |
1134 | (void) m_free(dtom(q6)); | |
1135 | atomic_add_32(&ip6q_count, -1); | |
1136 | } | |
1137 | ||
1138 | static struct ip6asfrag * | |
1139 | ip6af_alloc(int how) | |
1140 | { | |
1141 | struct mbuf *t; | |
1142 | struct ip6asfrag *af6; | |
1143 | ||
1144 | /* | |
1145 | * See comments in ip6q_updateparams(). Keep the count separate | |
1146 | * from frag6_nfrags since the latter represents the elements | |
1147 | * already in the reassembly queues. | |
1148 | */ | |
0a7de745 A |
1149 | if (ip6af_limit > 0 && ip6af_count > ip6af_limit) { |
1150 | return NULL; | |
1151 | } | |
39236c6e A |
1152 | |
1153 | t = m_get(how, MT_FTABLE); | |
1154 | if (t != NULL) { | |
1155 | atomic_add_32(&ip6af_count, 1); | |
1156 | af6 = mtod(t, struct ip6asfrag *); | |
0a7de745 | 1157 | bzero(af6, sizeof(*af6)); |
39236c6e A |
1158 | } else { |
1159 | af6 = NULL; | |
1160 | } | |
0a7de745 | 1161 | return af6; |
39236c6e A |
1162 | } |
1163 | ||
1164 | static void | |
1165 | ip6af_free(struct ip6asfrag *af6) | |
1166 | { | |
1167 | (void) m_free(dtom(af6)); | |
1168 | atomic_add_32(&ip6af_count, -1); | |
1169 | } | |
1170 | ||
1171 | static void | |
1172 | ip6q_updateparams(void) | |
1173 | { | |
5ba3f43e | 1174 | LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED); |
39236c6e A |
1175 | /* |
1176 | * -1 for unlimited allocation. | |
1177 | */ | |
0a7de745 | 1178 | if (ip6_maxfragpackets < 0) { |
39236c6e | 1179 | ip6q_limit = 0; |
0a7de745 A |
1180 | } |
1181 | if (ip6_maxfrags < 0) { | |
39236c6e | 1182 | ip6af_limit = 0; |
0a7de745 | 1183 | } |
39236c6e A |
1184 | /* |
1185 | * Positive number for specific bound. | |
1186 | */ | |
0a7de745 | 1187 | if (ip6_maxfragpackets > 0) { |
39236c6e | 1188 | ip6q_limit = ip6_maxfragpackets; |
0a7de745 A |
1189 | } |
1190 | if (ip6_maxfrags > 0) { | |
39236c6e | 1191 | ip6af_limit = ip6_maxfrags; |
0a7de745 | 1192 | } |
39236c6e A |
1193 | /* |
1194 | * Zero specifies no further fragment queue allocation -- set the | |
1195 | * bound very low, but rely on implementation elsewhere to actually | |
1196 | * prevent allocation and reclaim current queues. | |
1197 | */ | |
0a7de745 | 1198 | if (ip6_maxfragpackets == 0) { |
39236c6e | 1199 | ip6q_limit = 1; |
0a7de745 A |
1200 | } |
1201 | if (ip6_maxfrags == 0) { | |
39236c6e | 1202 | ip6af_limit = 1; |
0a7de745 | 1203 | } |
39236c6e A |
1204 | /* |
1205 | * Arm the purge timer if not already and if there's work to do | |
1206 | */ | |
1207 | frag6_sched_timeout(); | |
1208 | } | |
1209 | ||
1210 | static int | |
1211 | sysctl_maxfragpackets SYSCTL_HANDLER_ARGS | |
1212 | { | |
1213 | #pragma unused(arg1, arg2) | |
1214 | int error, i; | |
1215 | ||
1216 | lck_mtx_lock(&ip6qlock); | |
1217 | i = ip6_maxfragpackets; | |
1218 | error = sysctl_handle_int(oidp, &i, 0, req); | |
0a7de745 | 1219 | if (error || req->newptr == USER_ADDR_NULL) { |
39236c6e | 1220 | goto done; |
0a7de745 | 1221 | } |
39236c6e A |
1222 | /* impose bounds */ |
1223 | if (i < -1 || i > (nmbclusters / 4)) { | |
1224 | error = EINVAL; | |
1225 | goto done; | |
1226 | } | |
1227 | ip6_maxfragpackets = i; | |
1228 | ip6q_updateparams(); | |
1229 | done: | |
1230 | lck_mtx_unlock(&ip6qlock); | |
0a7de745 | 1231 | return error; |
39236c6e A |
1232 | } |
1233 | ||
1234 | static int | |
1235 | sysctl_maxfrags SYSCTL_HANDLER_ARGS | |
1236 | { | |
1237 | #pragma unused(arg1, arg2) | |
1238 | int error, i; | |
1239 | ||
1240 | lck_mtx_lock(&ip6qlock); | |
1241 | i = ip6_maxfrags; | |
1242 | error = sysctl_handle_int(oidp, &i, 0, req); | |
0a7de745 | 1243 | if (error || req->newptr == USER_ADDR_NULL) { |
39236c6e | 1244 | goto done; |
0a7de745 | 1245 | } |
39236c6e A |
1246 | /* impose bounds */ |
1247 | if (i < -1 || i > (nmbclusters / 4)) { | |
1248 | error = EINVAL; | |
1249 | goto done; | |
1c79356b | 1250 | } |
0a7de745 A |
1251 | ip6_maxfrags = i; |
1252 | ip6q_updateparams(); /* see if we need to arm timer */ | |
39236c6e A |
1253 | done: |
1254 | lck_mtx_unlock(&ip6qlock); | |
0a7de745 | 1255 | return error; |
1c79356b | 1256 | } |