X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/1c79356b52d46aa6b508fb032f5ae709b1f2897b..6d2010ae8f7a6078e10b361c6962983bab233e0f:/bsd/netinet6/frag6.c diff --git a/bsd/netinet6/frag6.c b/bsd/netinet6/frag6.c index f9434d42d..b6b68b920 100644 --- a/bsd/netinet6/frag6.c +++ b/bsd/netinet6/frag6.c @@ -1,4 +1,33 @@ -/* $KAME: frag6.c,v 1.23 2000/02/28 16:18:11 itojun Exp $ */ +/* + * Copyright (c) 2000-2010 Apple Inc. All rights reserved. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ + * + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. The rights granted to you under the License + * may not be used to create, or enable the creation or redistribution of, + * unlawful or unlicensed copies of an Apple operating system, or to + * circumvent, violate, or enable the circumvention or violation of, any + * terms of an Apple operating system software license agreement. + * + * Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, + * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ + */ + +/* $FreeBSD: src/sys/netinet6/frag6.c,v 1.2.2.5 2001/07/03 11:01:50 ume Exp $ */ +/* $KAME: frag6.c,v 1.31 2001/05/17 13:45:34 jinmei Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -41,17 +70,16 @@ #include #include #include +#include #include #include #include #include +#include #include #include -#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined(__OpenBSD__) && !(defined(__bsdi__) && _BSDI_VERSION >= 199802) && !defined(__APPLE__) -#include -#endif #include #include @@ -63,25 +91,20 @@ */ #define IN6_IFSTAT_STRICT -static void frag6_enq __P((struct ip6asfrag *, struct ip6asfrag *)); -static void frag6_deq __P((struct ip6asfrag *)); -static void frag6_insque __P((struct ip6q *, struct ip6q *)); -static void frag6_remque __P((struct ip6q *)); -static void frag6_freef __P((struct ip6q *)); +static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *); +static void frag6_deq(struct ip6asfrag *); +static void frag6_insque(struct ip6q *, struct ip6q *); +static void frag6_remque(struct ip6q *); +static void frag6_freef(struct ip6q *); +/* XXX we eventually need splreass6, or some real semaphore */ int frag6_doing_reass; u_int frag6_nfragpackets; +static u_int frag6_nfrags; struct ip6q ip6q; /* ip6 reassemble queue */ -/* FreeBSD tweak */ -#if !defined(M_FTABLE) && (defined(__FreeBSD__) && __FreeBSD__ >= 3) -MALLOC_DEFINE(M_FTABLE, "fragment", "fragment reassembly header"); -#endif - -#ifndef offsetof /* XXX */ -#define offsetof(type, member) ((size_t)(&((type *)0)->member)) -#endif +extern lck_mtx_t *inet6_domain_mutex; /* * Initialise reassembly queue and fragment identifier. */ @@ -90,13 +113,16 @@ frag6_init() { struct timeval tv; + ip6_maxfragpackets = nmbclusters / 32; + ip6_maxfrags = nmbclusters / 4; + /* * in many cases, random() here does NOT return random number * as initialization during bootstrap time occur in fixed order. */ microtime(&tv); - ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q; ip6_id = random() ^ tv.tv_usec; + ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q; } /* @@ -130,12 +156,13 @@ frag6_init() */ /* * Fragment input + * NOTE: this function is called with the inet6_domain_mutex held from ip6_input. + * inet6_domain_mutex is protecting he frag6 queue manipulation. */ int -frag6_input(mp, offp, proto) - struct mbuf **mp; - int *offp, proto; +frag6_input(struct mbuf **mp, int *offp, int proto) { +#pragma unused(proto) struct mbuf *m = *mp, *t; struct ip6_hdr *ip6; struct ip6_frag *ip6f; @@ -145,14 +172,17 @@ frag6_input(mp, offp, proto) int first_frag = 0; int fragoff, frgpartlen; /* must be larger than u_int16_t */ struct ifnet *dstifp; + struct ifaddr *ifa = NULL; + u_int8_t ecn, ecn0; + #ifdef IN6_IFSTAT_STRICT - static struct route_in6 ro; + struct route_in6 ro; struct sockaddr_in6 *dst; #endif ip6 = mtod(m, struct ip6_hdr *); #ifndef PULLDOWN_TEST - IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), IPPROTO_DONE); + IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), return IPPROTO_DONE); ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset); #else IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f)); @@ -163,26 +193,23 @@ frag6_input(mp, offp, proto) dstifp = NULL; #ifdef IN6_IFSTAT_STRICT /* find the destination interface of the packet. */ + bzero(&ro, sizeof (ro)); dst = (struct sockaddr_in6 *)&ro.ro_dst; - if (ro.ro_rt - && ((ro.ro_rt->rt_flags & RTF_UP) == 0 - || !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) { - RTFREE(ro.ro_rt); - ro.ro_rt = (struct rtentry *)0; - } - if (ro.ro_rt == NULL) { - bzero(dst, sizeof(*dst)); - dst->sin6_family = AF_INET6; - dst->sin6_len = sizeof(struct sockaddr_in6); - dst->sin6_addr = ip6->ip6_dst; - } -#ifndef __bsdi__ + dst->sin6_family = AF_INET6; + dst->sin6_len = sizeof (struct sockaddr_in6); + dst->sin6_addr = ip6->ip6_dst; + rtalloc((struct route *)&ro); -#else - rtcalloc((struct route *)&ro); -#endif - if (ro.ro_rt != NULL && ro.ro_rt->rt_ifa != NULL) - dstifp = ((struct in6_ifaddr *)ro.ro_rt->rt_ifa)->ia_ifp; + if (ro.ro_rt != NULL) { + RT_LOCK(ro.ro_rt); + if ((ifa = ro.ro_rt->rt_ifa) != NULL) { + IFA_ADDREF(ifa); + dstifp = ((struct in6_ifaddr *)ro.ro_rt->rt_ifa)->ia_ifp; + } + RT_UNLOCK(ro.ro_rt); + rtfree(ro.ro_rt); + ro.ro_rt = NULL; + } #else /* we are violating the spec, this is not the destination interface */ if ((m->m_flags & M_PKTHDR) != 0) @@ -193,6 +220,8 @@ frag6_input(mp, offp, proto) if (ip6->ip6_plen == 0) { icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset); in6_ifstat_inc(dstifp, ifs6_reass_fail); + if (ifa != NULL) + IFA_REMREF(ifa); return IPPROTO_DONE; } @@ -208,6 +237,8 @@ frag6_input(mp, offp, proto) ICMP6_PARAMPROB_HEADER, offsetof(struct ip6_hdr, ip6_plen)); in6_ifstat_inc(dstifp, ifs6_reass_fail); + if (ifa != NULL) + IFA_REMREF(ifa); return IPPROTO_DONE; } @@ -217,6 +248,18 @@ frag6_input(mp, offp, proto) /* offset now points to data portion */ offset += sizeof(struct ip6_frag); + frag6_doing_reass = 1; + + /* + * Enforce upper bound on number of fragments. + * If maxfrag is 0, never accept fragments. + * If maxfrag is -1, accept all fragments without limitation. + */ + if (ip6_maxfrags < 0) + ; + else if (frag6_nfrags >= (u_int)ip6_maxfrags) + goto dropfrag; + for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next) if (ip6f->ip6f_ident == q6->ip6q_ident && IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) && @@ -228,7 +271,6 @@ frag6_input(mp, offp, proto) * the first fragment to arrive, create a reassembly queue. */ first_frag = 1; - frag6_nfragpackets++; /* * Enforce upper bound on number of fragmented packets @@ -236,11 +278,11 @@ frag6_input(mp, offp, proto) * If maxfrag is 0, never accept fragments. * If maxfrag is -1, accept all fragments without limitation. */ - if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets) { - ip6stat.ip6s_fragoverflow++; - in6_ifstat_inc(dstifp, ifs6_reass_fail); - frag6_freef(ip6q.ip6q_prev); - } + if (ip6_maxfragpackets < 0) + ; + else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets) + goto dropfrag; + frag6_nfragpackets++; q6 = (struct ip6q *)_MALLOC(sizeof(struct ip6q), M_FTABLE, M_DONTWAIT); if (q6 == NULL) @@ -251,15 +293,18 @@ frag6_input(mp, offp, proto) /* ip6q_nxt will be filled afterwards, from 1st fragment */ q6->ip6q_down = q6->ip6q_up = (struct ip6asfrag *)q6; -#if notyet +#ifdef notyet q6->ip6q_nxtp = (u_char *)nxtp; #endif q6->ip6q_ident = ip6f->ip6f_ident; - q6->ip6q_arrive = 0; /* Is it used anywhere? */ q6->ip6q_ttl = IPV6_FRAGTTL; q6->ip6q_src = ip6->ip6_src; q6->ip6q_dst = ip6->ip6_dst; + q6->ip6q_ecn = + (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; q6->ip6q_unfrglen = -1; /* The 1st fragment has not arrived. */ + + q6->ip6q_nfrag = 0; } /* @@ -285,6 +330,9 @@ frag6_input(mp, offp, proto) icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset - sizeof(struct ip6_frag) + offsetof(struct ip6_frag, ip6f_offlg)); + frag6_doing_reass = 0; + if (ifa != NULL) + IFA_REMREF(ifa); return(IPPROTO_DONE); } } @@ -292,6 +340,9 @@ frag6_input(mp, offp, proto) icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset - sizeof(struct ip6_frag) + offsetof(struct ip6_frag, ip6f_offlg)); + frag6_doing_reass = 0; + if (ifa != NULL) + IFA_REMREF(ifa); return(IPPROTO_DONE); } /* @@ -311,7 +362,7 @@ frag6_input(mp, offp, proto) /* dequeue the fragment. */ frag6_deq(af6); - _FREE(af6, M_FTABLE); + FREE(af6, M_FTABLE); /* adjust pointer. */ ip6err = mtod(merr, struct ip6_hdr *); @@ -336,10 +387,6 @@ frag6_input(mp, offp, proto) if (ip6af == NULL) goto dropfrag; bzero(ip6af, sizeof(*ip6af)); - ip6af->ip6af_head = ip6->ip6_flow; - ip6af->ip6af_len = ip6->ip6_plen; - ip6af->ip6af_nxt = ip6->ip6_nxt; - ip6af->ip6af_hlim = ip6->ip6_hlim; ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG; ip6af->ip6af_off = fragoff; ip6af->ip6af_frglen = frgpartlen; @@ -351,6 +398,26 @@ frag6_input(mp, offp, proto) goto insert; } + /* + * Handle ECN by comparing this segment with the first one; + * if CE is set, do not lose CE. + * drop if CE and not-ECT are mixed for the same packet. + */ + ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; + ecn0 = q6->ip6q_ecn; + if (ecn == IPTOS_ECN_CE) { + if (ecn0 == IPTOS_ECN_NOTECT) { + FREE(ip6af, M_FTABLE); + goto dropfrag; + } + if (ecn0 != IPTOS_ECN_CE) + q6->ip6q_ecn = IPTOS_ECN_CE; + } + if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) { + FREE(ip6af, M_FTABLE); + goto dropfrag; + } + /* * Find a segment which begins after this one does. */ @@ -399,23 +466,34 @@ frag6_input(mp, offp, proto) * If the incoming framgent overlaps some existing fragments in * the reassembly queue, drop it, since it is dangerous to override * existing fragments from a security point of view. + * We don't know which fragment is the bad guy - here we trust + * fragment that came in earlier, with no real reason. + * + * Note: due to changes after disabling this part, mbuf passed to + * m_adj() below now does not meet the requirement. */ if (af6->ip6af_up != (struct ip6asfrag *)q6) { i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen - ip6af->ip6af_off; if (i > 0) { +#if 0 /* suppress the noisy log */ log(LOG_ERR, "%d bytes of a fragment from %s " "overlaps the previous fragment\n", i, ip6_sprintf(&q6->ip6q_src)); +#endif + FREE(ip6af, M_FTABLE); goto dropfrag; } } if (af6 != (struct ip6asfrag *)q6) { i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off; if (i > 0) { +#if 0 /* suppress the noisy log */ log(LOG_ERR, "%d bytes of a fragment from %s " "overlaps the succeeding fragment", i, ip6_sprintf(&q6->ip6q_src)); +#endif + FREE(ip6af, M_FTABLE); goto dropfrag; } } @@ -430,6 +508,8 @@ insert: * the most recently active fragmented packet. */ frag6_enq(ip6af, af6->ip6af_up); + frag6_nfrags++; + q6->ip6q_nfrag++; #if 0 /* xxx */ if (q6 != ip6q.ip6q_next) { frag6_remque(q6); @@ -441,12 +521,16 @@ insert: af6 = af6->ip6af_down) { if (af6->ip6af_off != next) { frag6_doing_reass = 0; + if (ifa != NULL) + IFA_REMREF(ifa); return IPPROTO_DONE; } next += af6->ip6af_frglen; } if (af6->ip6af_up->ip6af_mff) { frag6_doing_reass = 0; + if (ifa != NULL) + IFA_REMREF(ifa); return IPPROTO_DONE; } @@ -464,26 +548,28 @@ insert: t = t->m_next; t->m_next = IP6_REASS_MBUF(af6); m_adj(t->m_next, af6->ip6af_offset); - _FREE(af6, M_FTABLE); + FREE(af6, M_FTABLE); af6 = af6dwn; } /* adjust offset to point where the original next header starts */ offset = ip6af->ip6af_offset - sizeof(struct ip6_frag); - _FREE(ip6af, M_FTABLE); + FREE(ip6af, M_FTABLE); ip6 = mtod(m, struct ip6_hdr *); ip6->ip6_plen = htons((u_short)next + offset - sizeof(struct ip6_hdr)); ip6->ip6_src = q6->ip6q_src; ip6->ip6_dst = q6->ip6q_dst; + if (q6->ip6q_ecn == IPTOS_ECN_CE) + ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20); + nxt = q6->ip6q_nxt; #if notyet *q6->ip6q_nxtp = (u_char)(nxt & 0xff); #endif - /* - * Delete frag6 header with as a few cost as possible. - */ - if (offset < m->m_len) { + /* Delete frag6 header */ + if (m->m_len >= offset + sizeof(struct ip6_frag)) { + /* This is the only possible case with !PULLDOWN_TEST */ ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag), offset); m->m_data += sizeof(struct ip6_frag); @@ -492,7 +578,8 @@ insert: /* this comes with no copy if the boundary is on cluster */ if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) { frag6_remque(q6); - _FREE(q6, M_FTABLE); + frag6_nfrags -= q6->ip6q_nfrag; + FREE(q6, M_FTABLE); frag6_nfragpackets--; goto dropfrag; } @@ -509,7 +596,8 @@ insert: } frag6_remque(q6); - _FREE(q6, M_FTABLE); + frag6_nfrags -= q6->ip6q_nfrag; + FREE(q6, M_FTABLE); frag6_nfragpackets--; if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */ @@ -530,12 +618,17 @@ insert: *offp = offset; frag6_doing_reass = 0; + if (ifa != NULL) + IFA_REMREF(ifa); return nxt; dropfrag: in6_ifstat_inc(dstifp, ifs6_reass_fail); ip6stat.ip6s_fragdropped++; m_freem(m); + frag6_doing_reass = 0; + if (ifa != NULL) + IFA_REMREF(ifa); return IPPROTO_DONE; } @@ -566,19 +659,19 @@ frag6_freef(q6) /* adjust pointer */ ip6 = mtod(m, struct ip6_hdr *); - /* restoure source and destination addresses */ + /* restore source and destination addresses */ ip6->ip6_src = q6->ip6q_src; ip6->ip6_dst = q6->ip6q_dst; - icmp6_error(m, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_REASSEMBLY, 0); } else m_freem(m); - _FREE(af6, M_FTABLE); + FREE(af6, M_FTABLE); } frag6_remque(q6); - _FREE(q6, M_FTABLE); + frag6_nfrags -= q6->ip6q_nfrag; + FREE(q6, M_FTABLE); frag6_nfragpackets--; } @@ -626,7 +719,7 @@ frag6_remque(p6) } /* - * IP timer processing; + * IPv6 reassembling timer processing; * if a timer expires on a reassembly * queue, discard it. */ @@ -634,19 +727,7 @@ void frag6_slowtimo() { struct ip6q *q6; - int s; -#ifdef __APPLE__ - boolean_t funnel_state; - funnel_state = thread_set_funneled(TRUE); -#endif -#ifdef __NetBSD__ - s = splsoftnet(); -#else - s = splnet(); -#endif -#if 0 - extern struct route_in6 ip6_forward_rt; -#endif + lck_mtx_lock(inet6_domain_mutex); frag6_doing_reass = 1; q6 = ip6q.ip6q_next; @@ -665,33 +746,14 @@ frag6_slowtimo() * (due to the limit being lowered), drain off * enough to get down to the new limit. */ - while (frag6_nfragpackets > (u_int)ip6_maxfragpackets) { + while (frag6_nfragpackets > (u_int)ip6_maxfragpackets && + ip6q.ip6q_prev) { ip6stat.ip6s_fragoverflow++; /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ frag6_freef(ip6q.ip6q_prev); } frag6_doing_reass = 0; - -#if 0 - /* - * Routing changes might produce a better route than we last used; - * make sure we notice eventually, even if forwarding only for one - * destination and the cache is never replaced. - */ - if (ip6_forward_rt.ro_rt) { - RTFREE(ip6_forward_rt.ro_rt); - ip6_forward_rt.ro_rt = 0; - } - if (ipsrcchk_rt.ro_rt) { - RTFREE(ipsrcchk_rt.ro_rt); - ipsrcchk_rt.ro_rt = 0; - } -#endif - - splx(s); -#ifdef __APPLE__ - (void) thread_set_funneled(funnel_state); -#endif + lck_mtx_unlock(inet6_domain_mutex); } /* @@ -702,9 +764,11 @@ frag6_drain() { if (frag6_doing_reass) return; + lck_mtx_lock(inet6_domain_mutex); while (ip6q.ip6q_next != &ip6q) { ip6stat.ip6s_fragdropped++; /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */ frag6_freef(ip6q.ip6q_next); } + lck_mtx_unlock(inet6_domain_mutex); }