[linux-2.6-block.git] / net / ipv6 / netfilter / nf_conntrack_reasm.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * IPv6 fragment reassembly for connection tracking
 *
 * Copyright (C)2004 USAGI/WIDE Project
 *
 * Author:
 *	Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
 *
 * Based on: net/ipv6/reassembly.c
 */

#define pr_fmt(fmt) "IPv6-nf: " fmt

#include <linux/errno.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
#include <linux/net.h>
#include <linux/list.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/slab.h>

#include <net/sock.h>
#include <net/snmp.h>
#include <net/ipv6_frag.h>

#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
#include <net/inet_ecn.h>
#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
#include <linux/sysctl.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <net/netfilter/ipv6/nf_defrag_ipv6.h>

static const char nf_frags_cache_name[] = "nf-frags";

static struct inet_frags nf_frags;

#ifdef CONFIG_SYSCTL

static struct ctl_table nf_ct_frag6_sysctl_table[] = {
	{
		.procname	= "nf_conntrack_frag6_timeout",
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_jiffies,
	},
	{
		.procname	= "nf_conntrack_frag6_low_thresh",
		.maxlen		= sizeof(unsigned long),
		.mode		= 0644,
		.proc_handler	= proc_doulongvec_minmax,
	},
	{
		.procname	= "nf_conntrack_frag6_high_thresh",
		.maxlen		= sizeof(unsigned long),
		.mode		= 0644,
		.proc_handler	= proc_doulongvec_minmax,
	},
	{ }
};

static int nf_ct_frag6_sysctl_register(struct net *net)
{
	struct ctl_table *table;
	struct ctl_table_header *hdr;

	table = nf_ct_frag6_sysctl_table;
	if (!net_eq(net, &init_net)) {
		table = kmemdup(table, sizeof(nf_ct_frag6_sysctl_table),
				GFP_KERNEL);
		if (table == NULL)
			goto err_alloc;
	}

	table[0].data	= &net->nf_frag.fqdir->timeout;
	table[1].data	= &net->nf_frag.fqdir->low_thresh;
	table[1].extra2	= &net->nf_frag.fqdir->high_thresh;
	table[2].data	= &net->nf_frag.fqdir->high_thresh;
	table[2].extra1	= &net->nf_frag.fqdir->low_thresh;
	table[2].extra2	= &init_net.nf_frag.fqdir->high_thresh;

	hdr = register_net_sysctl(net, "net/netfilter", table);
	if (hdr == NULL)
		goto err_reg;

	net->nf_frag_frags_hdr = hdr;
	return 0;

err_reg:
	if (!net_eq(net, &init_net))
		kfree(table);
err_alloc:
	return -ENOMEM;
}

static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
{
	struct ctl_table *table;

	table = net->nf_frag_frags_hdr->ctl_table_arg;
	unregister_net_sysctl_table(net->nf_frag_frags_hdr);
	if (!net_eq(net, &init_net))
		kfree(table);
}

#else
static int nf_ct_frag6_sysctl_register(struct net *net)
{
	return 0;
}
static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
{
}
#endif

static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
			     struct sk_buff *prev_tail, struct net_device *dev);

static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
{
	return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK);
}

static void nf_ct_frag6_expire(struct timer_list *t)
{
	struct inet_frag_queue *frag = from_timer(frag, t, timer);
	struct frag_queue *fq;

	fq = container_of(frag, struct frag_queue, q);

	ip6frag_expire_frag_queue(fq->q.fqdir->net, fq);
}

/* Creation primitives. */
static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user,
				  const struct ipv6hdr *hdr, int iif)
{
	struct frag_v6_compare_key key = {
		.id = id,
		.saddr = hdr->saddr,
		.daddr = hdr->daddr,
		.user = user,
		.iif = iif,
	};
	struct inet_frag_queue *q;

	q = inet_frag_find(net->nf_frag.fqdir, &key);
	if (!q)
		return NULL;

	return container_of(q, struct frag_queue, q);
}


static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
			     const struct frag_hdr *fhdr, int nhoff)
{
	unsigned int payload_len;
	struct net_device *dev;
	struct sk_buff *prev;
	int offset, end, err;
	u8 ecn;

	if (fq->q.flags & INET_FRAG_COMPLETE) {
		pr_debug("Already completed\n");
		goto err;
	}

	payload_len = ntohs(ipv6_hdr(skb)->payload_len);

	offset = ntohs(fhdr->frag_off) & ~0x7;
	end = offset + (payload_len -
			((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));

	if ((unsigned int)end > IPV6_MAXPLEN) {
		pr_debug("offset is too large.\n");
		return -EINVAL;
	}

	ecn = ip6_frag_ecn(ipv6_hdr(skb));

	if (skb->ip_summed == CHECKSUM_COMPLETE) {
		const unsigned char *nh = skb_network_header(skb);
		skb->csum = csum_sub(skb->csum,
				     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
						  0));
	}

	/* Is this the final fragment? */
	if (!(fhdr->frag_off & htons(IP6_MF))) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrupted.
		 */
		if (end < fq->q.len ||
		    ((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len)) {
			pr_debug("already received last fragment\n");
			goto err;
		}
		fq->q.flags |= INET_FRAG_LAST_IN;
		fq->q.len = end;
	} else {
		/* Check if the fragment is rounded to 8 bytes.
		 * Required by the RFC.
		 */
		if (end & 0x7) {
			/* RFC2460 says always send parameter problem in
			 * this case. -DaveM
			 */
			pr_debug("end of fragment not rounded to 8 bytes.\n");
			inet_frag_kill(&fq->q);
			return -EPROTO;
		}
		if (end > fq->q.len) {
			/* Some bits beyond end -> corruption. */
			if (fq->q.flags & INET_FRAG_LAST_IN) {
				pr_debug("last packet already reached.\n");
				goto err;
			}
			fq->q.len = end;
		}
	}

	if (end == offset)
		goto err;

	/* Point into the IP datagram 'data' part. */
	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) {
		pr_debug("queue: message is too short.\n");
		goto err;
	}
	if (pskb_trim_rcsum(skb, end - offset)) {
		pr_debug("Can't trim\n");
		goto err;
	}

	/* Note : skb->rbnode and skb->dev share the same location. */
	dev = skb->dev;
	/* Makes sure compiler wont do silly aliasing games */
	barrier();

	prev = fq->q.fragments_tail;
	err = inet_frag_queue_insert(&fq->q, skb, offset, end);
	if (err) {
		if (err == IPFRAG_DUP) {
			/* No error for duplicates, pretend they got queued. */
			kfree_skb(skb);
			return -EINPROGRESS;
		}
		goto insert_error;
	}

	if (dev)
		fq->iif = dev->ifindex;

	fq->q.stamp = skb->tstamp;
	fq->q.meat += skb->len;
	fq->ecn |= ecn;
	if (payload_len > fq->q.max_size)
		fq->q.max_size = payload_len;
	add_frag_mem_limit(fq->q.fqdir, skb->truesize);

	/* The first fragment.
	 * nhoffset is obtained from the first fragment, of course.
	 */
	if (offset == 0) {
		fq->nhoffset = nhoff;
		fq->q.flags |= INET_FRAG_FIRST_IN;
	}

	if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
	    fq->q.meat == fq->q.len) {
		unsigned long orefdst = skb->_skb_refdst;

		skb->_skb_refdst = 0UL;
		err = nf_ct_frag6_reasm(fq, skb, prev, dev);
		skb->_skb_refdst = orefdst;

		/* After queue has assumed skb ownership, only 0 or
		 * -EINPROGRESS must be returned.
		 */
		return err ? -EINPROGRESS : 0;
	}

	skb_dst_drop(skb);
	return -EINPROGRESS;

insert_error:
	inet_frag_kill(&fq->q);
err:
	skb_dst_drop(skb);
	return -EINVAL;
}

/*
 *	Check if this packet is complete.
 *
 *	It is called with locked fq, and caller must check that
 *	queue is eligible for reassembly i.e. it is not COMPLETE,
 *	the last and the first frames arrived and all the bits are here.
 */
static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
			     struct sk_buff *prev_tail, struct net_device *dev)
{
	void *reasm_data;
	int payload_len;
	u8 ecn;

	inet_frag_kill(&fq->q);

	ecn = ip_frag_ecn_table[fq->ecn];
	if (unlikely(ecn == 0xff))
		goto err;

	reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
	if (!reasm_data)
		goto err;

	payload_len = ((skb->data - skb_network_header(skb)) -
		       sizeof(struct ipv6hdr) + fq->q.len -
		       sizeof(struct frag_hdr));
	if (payload_len > IPV6_MAXPLEN) {
		net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
				    payload_len);
		goto err;
	}

	/* We have to remove fragment header from datagram and to relocate
	 * header in order to calculate ICV correctly. */
	skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
	memmove(skb->head + sizeof(struct frag_hdr), skb->head,
		(skb->data - skb->head) - sizeof(struct frag_hdr));
	skb->mac_header += sizeof(struct frag_hdr);
	skb->network_header += sizeof(struct frag_hdr);

	skb_reset_transport_header(skb);

	inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);

	skb->ignore_df = 1;
	skb->dev = dev;
	ipv6_hdr(skb)->payload_len = htons(payload_len);
	ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
	IP6CB(skb)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;

	/* Yes, and fold redundant checksum back. 8) */
	if (skb->ip_summed == CHECKSUM_COMPLETE)
		skb->csum = csum_partial(skb_network_header(skb),
					 skb_network_header_len(skb),
					 skb->csum);

	fq->q.rb_fragments = RB_ROOT;
	fq->q.fragments_tail = NULL;
	fq->q.last_run_head = NULL;

	return 0;

err:
	inet_frag_kill(&fq->q);
	return -EINVAL;
}

/*
 * find the header just before Fragment Header.
 *
 * if success return 0 and set ...
 * (*prevhdrp): the value of "Next Header Field" in the header
 *		just before Fragment Header.
 * (*prevhoff): the offset of "Next Header Field" in the header
 *		just before Fragment Header.
 * (*fhoff)   : the offset of Fragment Header.
 *
 * Based on ipv6_skip_hdr() in net/ipv6/exthdr.c
 *
 */
static int
find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
{
	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
	const int netoff = skb_network_offset(skb);
	u8 prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
	int start = netoff + sizeof(struct ipv6hdr);
	int len = skb->len - start;
	u8 prevhdr = NEXTHDR_IPV6;

	while (nexthdr != NEXTHDR_FRAGMENT) {
		struct ipv6_opt_hdr hdr;
		int hdrlen;

		if (!ipv6_ext_hdr(nexthdr)) {
			return -1;
		}
		if (nexthdr == NEXTHDR_NONE) {
			pr_debug("next header is none\n");
			return -1;
		}
		if (len < (int)sizeof(struct ipv6_opt_hdr)) {
			pr_debug("too short\n");
			return -1;
		}
		if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
			BUG();
		if (nexthdr == NEXTHDR_AUTH)
			hdrlen = ipv6_authlen(&hdr);
		else
			hdrlen = ipv6_optlen(&hdr);

		prevhdr = nexthdr;
		prev_nhoff = start;

		nexthdr = hdr.nexthdr;
		len -= hdrlen;
		start += hdrlen;
	}

	if (len < 0)
		return -1;

	*prevhdrp = prevhdr;
	*prevhoff = prev_nhoff;
	*fhoff = start;

	return 0;
}

int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
{
	u16 savethdr = skb->transport_header;
	int fhoff, nhoff, ret;
	struct frag_hdr *fhdr;
	struct frag_queue *fq;
	struct ipv6hdr *hdr;
	u8 prevhdr;

	/* Jumbo payload inhibits frag. header */
	if (ipv6_hdr(skb)->payload_len == 0) {
		pr_debug("payload len = 0\n");
		return 0;
	}

	if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
		return 0;

	if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
		return -ENOMEM;

	skb_set_transport_header(skb, fhoff);
	hdr = ipv6_hdr(skb);
	fhdr = (struct frag_hdr *)skb_transport_header(skb);

	skb_orphan(skb);
	fq = fq_find(net, fhdr->identification, user, hdr,
		     skb->dev ? skb->dev->ifindex : 0);
	if (fq == NULL) {
		pr_debug("Can't find and can't create new queue\n");
		return -ENOMEM;
	}

	spin_lock_bh(&fq->q.lock);

	ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff);
	if (ret == -EPROTO) {
		skb->transport_header = savethdr;
		ret = 0;
	}

	spin_unlock_bh(&fq->q.lock);
	inet_frag_put(&fq->q);
	return ret;
}
EXPORT_SYMBOL_GPL(nf_ct_frag6_gather);

static int nf_ct_net_init(struct net *net)
{
	int res;

	res = fqdir_init(&net->nf_frag.fqdir, &nf_frags, net);
	if (res < 0)
		return res;

	net->nf_frag.fqdir->high_thresh = IPV6_FRAG_HIGH_THRESH;
	net->nf_frag.fqdir->low_thresh = IPV6_FRAG_LOW_THRESH;
	net->nf_frag.fqdir->timeout = IPV6_FRAG_TIMEOUT;

	res = nf_ct_frag6_sysctl_register(net);
	if (res < 0)
		fqdir_exit(net->nf_frag.fqdir);
	return res;
}

static void nf_ct_net_pre_exit(struct net *net)
{
	fqdir_pre_exit(net->nf_frag.fqdir);
}

static void nf_ct_net_exit(struct net *net)
{
	nf_ct_frags6_sysctl_unregister(net);
	fqdir_exit(net->nf_frag.fqdir);
}

static struct pernet_operations nf_ct_net_ops = {
	.init		= nf_ct_net_init,
	.pre_exit	= nf_ct_net_pre_exit,
	.exit		= nf_ct_net_exit,
};

static const struct rhashtable_params nfct_rhash_params = {
	.head_offset		= offsetof(struct inet_frag_queue, node),
	.hashfn			= ip6frag_key_hashfn,
	.obj_hashfn		= ip6frag_obj_hashfn,
	.obj_cmpfn		= ip6frag_obj_cmpfn,
	.automatic_shrinking	= true,
};

int nf_ct_frag6_init(void)
{
	int ret = 0;

	nf_frags.constructor = ip6frag_init;
	nf_frags.destructor = NULL;
	nf_frags.qsize = sizeof(struct frag_queue);
	nf_frags.frag_expire = nf_ct_frag6_expire;
	nf_frags.frags_cache_name = nf_frags_cache_name;
	nf_frags.rhash_params = nfct_rhash_params;
	ret = inet_frags_init(&nf_frags);
	if (ret)
		goto out;
	ret = register_pernet_subsys(&nf_ct_net_ops);
	if (ret)
		inet_frags_fini(&nf_frags);

out:
	return ret;
}

void nf_ct_frag6_cleanup(void)
{
	unregister_pernet_subsys(&nf_ct_net_ops);
	inet_frags_fini(&nf_frags);
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
9fb9cbb1 YK	2	/*
	3	* IPv6 fragment reassembly for connection tracking
	4	*
	5	* Copyright (C)2004 USAGI/WIDE Project
	6	*
	7	* Author:
	8	* Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
	9	*
	10	* Based on: net/ipv6/reassembly.c
9fb9cbb1 YK	11	*/
9fb9cbb1 YK	12
5a3da1fe HFS	13	#define pr_fmt(fmt) "IPv6-nf: " fmt
5a3da1fe HFS	14
9fb9cbb1 YK	15	#include <linux/errno.h>
	16	#include <linux/types.h>
	17	#include <linux/string.h>
	18	#include <linux/socket.h>
	19	#include <linux/sockios.h>
	20	#include <linux/jiffies.h>
	21	#include <linux/net.h>
	22	#include <linux/list.h>
	23	#include <linux/netdevice.h>
	24	#include <linux/in6.h>
	25	#include <linux/ipv6.h>
	26	#include <linux/icmpv6.h>
	27	#include <linux/random.h>
5a0e3ad6	28	#include <linux/slab.h>
9fb9cbb1 YK	29
	30	#include <net/sock.h>
	31	#include <net/snmp.h>
70b095c8	32	#include <net/ipv6_frag.h>
9fb9cbb1	33
9fb9cbb1 YK	34	#include <net/protocol.h>
	35	#include <net/transp_v6.h>
	36	#include <net/rawv6.h>
	37	#include <net/ndisc.h>
	38	#include <net/addrconf.h>
b8dd6a22	39	#include <net/inet_ecn.h>
99fa5f53	40	#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
9fb9cbb1 YK	41	#include <linux/sysctl.h>
	42	#include <linux/netfilter.h>
	43	#include <linux/netfilter_ipv6.h>
	44	#include <linux/kernel.h>
	45	#include <linux/module.h>
bced94ed	46	#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
9fb9cbb1	47
d4ad4d22	48	static const char nf_frags_cache_name[] = "nf-frags";
9fb9cbb1	49
7eb95156	50	static struct inet_frags nf_frags;
9fb9cbb1	51
8d8354d2	52	#ifdef CONFIG_SYSCTL
1bab4c75	53
be9e9163	54	static struct ctl_table nf_ct_frag6_sysctl_table[] = {
8d8354d2 PE	55	{
8d8354d2 PE	56	.procname = "nf_conntrack_frag6_timeout",
8d8354d2 PE	57	.maxlen = sizeof(unsigned int),
8d8354d2 PE	58	.mode = 0644,
6d9f239a	59	.proc_handler = proc_dointvec_jiffies,
8d8354d2 PE	60	},
8d8354d2 PE	61	{
8d8354d2	62	.procname = "nf_conntrack_frag6_low_thresh",
3e67f106	63	.maxlen = sizeof(unsigned long),
8d8354d2	64	.mode = 0644,
3e67f106	65	.proc_handler = proc_doulongvec_minmax,
8d8354d2 PE	66	},
8d8354d2 PE	67	{
8d8354d2	68	.procname = "nf_conntrack_frag6_high_thresh",
3e67f106	69	.maxlen = sizeof(unsigned long),
8d8354d2	70	.mode = 0644,
3e67f106	71	.proc_handler = proc_doulongvec_minmax,
8d8354d2	72	},
f8572d8f	73	{ }
8d8354d2	74	};
e97c3e27	75
f1df1374	76	static int nf_ct_frag6_sysctl_register(struct net *net)
c038a767 AW	77	{
	78	struct ctl_table *table;
	79	struct ctl_table_header *hdr;
	80
	81	table = nf_ct_frag6_sysctl_table;
	82	if (!net_eq(net, &init_net)) {
	83	table = kmemdup(table, sizeof(nf_ct_frag6_sysctl_table),
	84	GFP_KERNEL);
	85	if (table == NULL)
	86	goto err_alloc;
c038a767 AW	87	}
c038a767 AW	88
4907abc6 ED	89	table[0].data = &net->nf_frag.fqdir->timeout;
	90	table[1].data = &net->nf_frag.fqdir->low_thresh;
	91	table[1].extra2 = &net->nf_frag.fqdir->high_thresh;
	92	table[2].data = &net->nf_frag.fqdir->high_thresh;
	93	table[2].extra1 = &net->nf_frag.fqdir->low_thresh;
	94	table[2].extra2 = &init_net.nf_frag.fqdir->high_thresh;
3bb13dd4	95
c038a767 AW	96	hdr = register_net_sysctl(net, "net/netfilter", table);
	97	if (hdr == NULL)
	98	goto err_reg;
	99
9ce7bc03	100	net->nf_frag_frags_hdr = hdr;
c038a767 AW	101	return 0;
	102
	103	err_reg:
	104	if (!net_eq(net, &init_net))
	105	kfree(table);
	106	err_alloc:
	107	return -ENOMEM;
	108	}
	109
	110	static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
	111	{
	112	struct ctl_table *table;
	113
9ce7bc03 ED	114	table = net->nf_frag_frags_hdr->ctl_table_arg;
9ce7bc03 ED	115	unregister_net_sysctl_table(net->nf_frag_frags_hdr);
c038a767 AW	116	if (!net_eq(net, &init_net))
	117	kfree(table);
	118	}
	119
	120	#else
f1df1374	121	static int nf_ct_frag6_sysctl_register(struct net *net)
c038a767 AW	122	{
	123	return 0;
	124	}
	125	static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
	126	{
	127	}
8d8354d2 PE	128	#endif
8d8354d2 PE	129
997dd964 PO	130	static int nf_ct_frag6_reasm(struct frag_queue fq, struct sk_buff skb,
	131	struct sk_buff prev_tail, struct net_device dev);
	132
b8dd6a22 HFS	133	static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
	134	{
	135	return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK);
	136	}
	137
78802011	138	static void nf_ct_frag6_expire(struct timer_list *t)
9fb9cbb1	139	{
78802011	140	struct inet_frag_queue *frag = from_timer(frag, t, timer);
b836c99f	141	struct frag_queue *fq;
9fb9cbb1	142
78802011	143	fq = container_of(frag, struct frag_queue, q);
9fb9cbb1	144
a39aca67	145	ip6frag_expire_frag_queue(fq->q.fqdir->net, fq);
9fb9cbb1 YK	146	}
	147
	148	/* Creation primitives. */
648700f7 ED	149	static struct frag_queue fq_find(struct net net, __be32 id, u32 user,
648700f7 ED	150	const struct ipv6hdr *hdr, int iif)
9fb9cbb1	151	{
648700f7 ED	152	struct frag_v6_compare_key key = {
	153	.id = id,
	154	.saddr = hdr->saddr,
	155	.daddr = hdr->daddr,
	156	.user = user,
	157	.iif = iif,
	158	};
2588fe1d	159	struct inet_frag_queue *q;
9fb9cbb1	160
4907abc6	161	q = inet_frag_find(net->nf_frag.fqdir, &key);
2d44ed22	162	if (!q)
5a3da1fe	163	return NULL;
2d44ed22	164
b836c99f	165	return container_of(q, struct frag_queue, q);
9fb9cbb1 YK	166	}
9fb9cbb1 YK	167
9fb9cbb1	168
b836c99f	169	static int nf_ct_frag6_queue(struct frag_queue fq, struct sk_buff skb,
58c0fb0d	170	const struct frag_hdr *fhdr, int nhoff)
9fb9cbb1	171	{
4cdd3408	172	unsigned int payload_len;
997dd964 PO	173	struct net_device *dev;
	174	struct sk_buff *prev;
	175	int offset, end, err;
b8dd6a22	176	u8 ecn;
9fb9cbb1	177
06aa8b8a	178	if (fq->q.flags & INET_FRAG_COMPLETE) {
698f9315	179	pr_debug("Already completed\n");
9fb9cbb1 YK	180	goto err;
	181	}
	182
4cdd3408 PM	183	payload_len = ntohs(ipv6_hdr(skb)->payload_len);
4cdd3408 PM	184
9fb9cbb1	185	offset = ntohs(fhdr->frag_off) & ~0x7;
4cdd3408	186	end = offset + (payload_len -
0660e03f	187	((u8 )(fhdr + 1) - (u8 )(ipv6_hdr(skb) + 1)));
9fb9cbb1 YK	188
9fb9cbb1 YK	189	if ((unsigned int)end > IPV6_MAXPLEN) {
0d53778e	190	pr_debug("offset is too large.\n");
83f1999c	191	return -EINVAL;
9fb9cbb1 YK	192	}
9fb9cbb1 YK	193
b8dd6a22 HFS	194	ecn = ip6_frag_ecn(ipv6_hdr(skb));
b8dd6a22 HFS	195
d56f90a7 ACM	196	if (skb->ip_summed == CHECKSUM_COMPLETE) {
d56f90a7 ACM	197	const unsigned char *nh = skb_network_header(skb);
1ab1457c	198	skb->csum = csum_sub(skb->csum,
d56f90a7	199	csum_partial(nh, (u8 *)(fhdr + 1) - nh,
9fb9cbb1	200	0));
d56f90a7	201	}
9fb9cbb1 YK	202
	203	/* Is this the final fragment? */
	204	if (!(fhdr->frag_off & htons(IP6_MF))) {
	205	/* If we already have some bits beyond end
	206	* or have different end, the segment is corrupted.
	207	*/
5ab11c98	208	if (end < fq->q.len \|\|
06aa8b8a	209	((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len)) {
0d53778e	210	pr_debug("already received last fragment\n");
9fb9cbb1 YK	211	goto err;
9fb9cbb1 YK	212	}
06aa8b8a	213	fq->q.flags \|= INET_FRAG_LAST_IN;
5ab11c98	214	fq->q.len = end;
9fb9cbb1 YK	215	} else {
	216	/* Check if the fragment is rounded to 8 bytes.
	217	* Required by the RFC.
	218	*/
	219	if (end & 0x7) {
	220	/* RFC2460 says always send parameter problem in
	221	* this case. -DaveM
	222	*/
0d53778e	223	pr_debug("end of fragment not rounded to 8 bytes.\n");
093ba729	224	inet_frag_kill(&fq->q);
83f1999c	225	return -EPROTO;
9fb9cbb1	226	}
5ab11c98	227	if (end > fq->q.len) {
9fb9cbb1	228	/* Some bits beyond end -> corruption. */
06aa8b8a	229	if (fq->q.flags & INET_FRAG_LAST_IN) {
0d53778e	230	pr_debug("last packet already reached.\n");
9fb9cbb1 YK	231	goto err;
9fb9cbb1 YK	232	}
5ab11c98	233	fq->q.len = end;
9fb9cbb1 YK	234	}
	235	}
	236
	237	if (end == offset)
	238	goto err;
	239
	240	/* Point into the IP datagram 'data' part. */
	241	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) {
0d53778e	242	pr_debug("queue: message is too short.\n");
9fb9cbb1 YK	243	goto err;
9fb9cbb1 YK	244	}
b38dfee3	245	if (pskb_trim_rcsum(skb, end - offset)) {
0d53778e	246	pr_debug("Can't trim\n");
b38dfee3	247	goto err;
9fb9cbb1 YK	248	}
9fb9cbb1 YK	249
997dd964 PO	250	/* Note : skb->rbnode and skb->dev share the same location. */
997dd964 PO	251	dev = skb->dev;
f2d1c724 ED	252	/* Makes sure compiler wont do silly aliasing games */
f2d1c724 ED	253	barrier();
9fb9cbb1	254
997dd964 PO	255	prev = fq->q.fragments_tail;
997dd964 PO	256	err = inet_frag_queue_insert(&fq->q, skb, offset, end);
8a3dca63 GN	257	if (err) {
	258	if (err == IPFRAG_DUP) {
	259	/* No error for duplicates, pretend they got queued. */
	260	kfree_skb(skb);
	261	return -EINPROGRESS;
	262	}
997dd964	263	goto insert_error;
8a3dca63	264	}
997dd964 PO	265
	266	if (dev)
	267	fq->iif = dev->ifindex;
9fb9cbb1	268
5ab11c98 PE	269	fq->q.stamp = skb->tstamp;
5ab11c98 PE	270	fq->q.meat += skb->len;
b8dd6a22	271	fq->ecn \|= ecn;
4cdd3408 PM	272	if (payload_len > fq->q.max_size)
4cdd3408 PM	273	fq->q.max_size = payload_len;
6ce3b4dc	274	add_frag_mem_limit(fq->q.fqdir, skb->truesize);
9fb9cbb1 YK	275
	276	/* The first fragment.
	277	* nhoffset is obtained from the first fragment, of course.
	278	*/
	279	if (offset == 0) {
	280	fq->nhoffset = nhoff;
06aa8b8a	281	fq->q.flags \|= INET_FRAG_FIRST_IN;
9fb9cbb1	282	}
3ef0eb0d	283
997dd964 PO	284	if (fq->q.flags == (INET_FRAG_FIRST_IN \| INET_FRAG_LAST_IN) &&
	285	fq->q.meat == fq->q.len) {
	286	unsigned long orefdst = skb->_skb_refdst;
9fb9cbb1	287
997dd964 PO	288	skb->_skb_refdst = 0UL;
	289	err = nf_ct_frag6_reasm(fq, skb, prev, dev);
	290	skb->_skb_refdst = orefdst;
a0d56cb9 GN	291
	292	/* After queue has assumed skb ownership, only 0 or
	293	* -EINPROGRESS must be returned.
	294	*/
	295	return err ? -EINPROGRESS : 0;
997dd964 PO	296	}
	297
	298	skb_dst_drop(skb);
	299	return -EINPROGRESS;
	300
	301	insert_error:
093ba729	302	inet_frag_kill(&fq->q);
9fb9cbb1	303	err:
997dd964	304	skb_dst_drop(skb);
83f1999c	305	return -EINVAL;
9fb9cbb1 YK	306	}
	307
	308	/*
	309	* Check if this packet is complete.
9fb9cbb1 YK	310	*
	311	* It is called with locked fq, and caller must check that
	312	* queue is eligible for reassembly i.e. it is not COMPLETE,
	313	* the last and the first frames arrived and all the bits are here.
	314	*/
997dd964 PO	315	static int nf_ct_frag6_reasm(struct frag_queue fq, struct sk_buff skb,
997dd964 PO	316	struct sk_buff prev_tail, struct net_device dev)
9fb9cbb1	317	{
997dd964 PO	318	void *reasm_data;
997dd964 PO	319	int payload_len;
b8dd6a22	320	u8 ecn;
9fb9cbb1	321
093ba729	322	inet_frag_kill(&fq->q);
9fb9cbb1	323
b8dd6a22 HFS	324	ecn = ip_frag_ecn_table[fq->ecn];
b8dd6a22 HFS	325	if (unlikely(ecn == 0xff))
997dd964	326	goto err;
b8dd6a22	327
997dd964 PO	328	reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
	329	if (!reasm_data)
	330	goto err;
	331
	332	payload_len = ((skb->data - skb_network_header(skb)) -
5ab11c98	333	sizeof(struct ipv6hdr) + fq->q.len -
d56f90a7	334	sizeof(struct frag_hdr));
9fb9cbb1	335	if (payload_len > IPV6_MAXPLEN) {
daaa7d64 FW	336	net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
daaa7d64 FW	337	payload_len);
997dd964	338	goto err;
029f7f3b FW	339	}
029f7f3b FW	340
9fb9cbb1 YK	341	/* We have to remove fragment header from datagram and to relocate
9fb9cbb1 YK	342	* header in order to calculate ICV correctly. */
997dd964 PO	343	skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
	344	memmove(skb->head + sizeof(struct frag_hdr), skb->head,
	345	(skb->data - skb->head) - sizeof(struct frag_hdr));
	346	skb->mac_header += sizeof(struct frag_hdr);
	347	skb->network_header += sizeof(struct frag_hdr);
	348
	349	skb_reset_transport_header(skb);
9fb9cbb1	350
891584f4	351	inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
997dd964 PO	352
	353	skb->ignore_df = 1;
	354	skb->dev = dev;
	355	ipv6_hdr(skb)->payload_len = htons(payload_len);
	356	ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
	357	IP6CB(skb)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
9fb9cbb1 YK	358
9fb9cbb1 YK	359	/* Yes, and fold redundant checksum back. 8) */
997dd964 PO	360	if (skb->ip_summed == CHECKSUM_COMPLETE)
	361	skb->csum = csum_partial(skb_network_header(skb),
	362	skb_network_header_len(skb),
	363	skb->csum);
9fb9cbb1	364
fa0f5273	365	fq->q.rb_fragments = RB_ROOT;
ea8fbe8f	366	fq->q.fragments_tail = NULL;
997dd964 PO	367	fq->q.last_run_head = NULL;
	368
	369	return 0;
9fb9cbb1	370
997dd964 PO	371	err:
	372	inet_frag_kill(&fq->q);
	373	return -EINVAL;
9fb9cbb1 YK	374	}
	375
	376	/*
	377	* find the header just before Fragment Header.
	378	*
	379	* if success return 0 and set ...
	380	* (*prevhdrp): the value of "Next Header Field" in the header
	381	* just before Fragment Header.
	382	* (*prevhoff): the offset of "Next Header Field" in the header
	383	* just before Fragment Header.
	384	* (*fhoff) : the offset of Fragment Header.
	385	*
	386	* Based on ipv6_skip_hdr() in net/ipv6/exthdr.c
	387	*
	388	*/
	389	static int
	390	find_prev_fhdr(struct sk_buff skb, u8 prevhdrp, int prevhoff, int fhoff)
	391	{
0660e03f	392	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
6b88dd96 ACM	393	const int netoff = skb_network_offset(skb);
	394	u8 prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
	395	int start = netoff + sizeof(struct ipv6hdr);
9fb9cbb1 YK	396	int len = skb->len - start;
	397	u8 prevhdr = NEXTHDR_IPV6;
	398
1ab1457c YH	399	while (nexthdr != NEXTHDR_FRAGMENT) {
	400	struct ipv6_opt_hdr hdr;
	401	int hdrlen;
9fb9cbb1 YK	402
	403	if (!ipv6_ext_hdr(nexthdr)) {
	404	return -1;
	405	}
1ab1457c	406	if (nexthdr == NEXTHDR_NONE) {
0d53778e	407	pr_debug("next header is none\n");
9fb9cbb1 YK	408	return -1;
9fb9cbb1 YK	409	}
d1238d53 CP	410	if (len < (int)sizeof(struct ipv6_opt_hdr)) {
	411	pr_debug("too short\n");
	412	return -1;
	413	}
1ab1457c YH	414	if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
	415	BUG();
	416	if (nexthdr == NEXTHDR_AUTH)
416e8126	417	hdrlen = ipv6_authlen(&hdr);
1ab1457c YH	418	else
1ab1457c YH	419	hdrlen = ipv6_optlen(&hdr);
9fb9cbb1 YK	420
	421	prevhdr = nexthdr;
	422	prev_nhoff = start;
	423
1ab1457c YH	424	nexthdr = hdr.nexthdr;
	425	len -= hdrlen;
	426	start += hdrlen;
	427	}
9fb9cbb1 YK	428
	429	if (len < 0)
	430	return -1;
	431
	432	*prevhdrp = prevhdr;
	433	*prevhoff = prev_nhoff;
	434	*fhoff = start;
	435
	436	return 0;
	437	}
	438
daaa7d64	439	int nf_ct_frag6_gather(struct net net, struct sk_buff skb, u32 user)
9fb9cbb1	440	{
83f1999c	441	u16 savethdr = skb->transport_header;
daaa7d64	442	int fhoff, nhoff, ret;
9fb9cbb1	443	struct frag_hdr *fhdr;
b836c99f	444	struct frag_queue *fq;
9fb9cbb1	445	struct ipv6hdr *hdr;
9fb9cbb1	446	u8 prevhdr;
9fb9cbb1 YK	447
9fb9cbb1 YK	448	/* Jumbo payload inhibits frag. header */
0660e03f	449	if (ipv6_hdr(skb)->payload_len == 0) {
0d53778e	450	pr_debug("payload len = 0\n");
9b57da06	451	return 0;
9fb9cbb1 YK	452	}
	453
	454	if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
9b57da06	455	return 0;
9fb9cbb1	456
029f7f3b	457	if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
daaa7d64	458	return -ENOMEM;
9fb9cbb1	459
029f7f3b FW	460	skb_set_transport_header(skb, fhoff);
	461	hdr = ipv6_hdr(skb);
	462	fhdr = (struct frag_hdr *)skb_transport_header(skb);
9fb9cbb1	463
48cac18e	464	skb_orphan(skb);
648700f7 ED	465	fq = fq_find(net, fhdr->identification, user, hdr,
648700f7 ED	466	skb->dev ? skb->dev->ifindex : 0);
9fb9cbb1	467	if (fq == NULL) {
0d53778e	468	pr_debug("Can't find and can't create new queue\n");
daaa7d64	469	return -ENOMEM;
9fb9cbb1 YK	470	}
9fb9cbb1 YK	471
b9c69896	472	spin_lock_bh(&fq->q.lock);
9fb9cbb1	473
83f1999c	474	ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff);
997dd964 PO	475	if (ret == -EPROTO) {
	476	skb->transport_header = savethdr;
	477	ret = 0;
9fb9cbb1 YK	478	}
9fb9cbb1 YK	479
daaa7d64	480	spin_unlock_bh(&fq->q.lock);
093ba729	481	inet_frag_put(&fq->q);
daaa7d64	482	return ret;
9fb9cbb1	483	}
5b490047	484	EXPORT_SYMBOL_GPL(nf_ct_frag6_gather);
9fb9cbb1	485
c038a767 AW	486	static int nf_ct_net_init(struct net *net)
c038a767 AW	487	{
787bea77 ED	488	int res;
787bea77 ED	489
a39aca67	490	res = fqdir_init(&net->nf_frag.fqdir, &nf_frags, net);
787bea77 ED	491	if (res < 0)
787bea77 ED	492	return res;
4907abc6 ED	493
	494	net->nf_frag.fqdir->high_thresh = IPV6_FRAG_HIGH_THRESH;
	495	net->nf_frag.fqdir->low_thresh = IPV6_FRAG_LOW_THRESH;
	496	net->nf_frag.fqdir->timeout = IPV6_FRAG_TIMEOUT;
	497
787bea77 ED	498	res = nf_ct_frag6_sysctl_register(net);
787bea77 ED	499	if (res < 0)
4907abc6	500	fqdir_exit(net->nf_frag.fqdir);
787bea77	501	return res;
c038a767 AW	502	}
c038a767 AW	503
d5dd8879 ED	504	static void nf_ct_net_pre_exit(struct net *net)
	505	{
	506	fqdir_pre_exit(net->nf_frag.fqdir);
	507	}
	508
c038a767 AW	509	static void nf_ct_net_exit(struct net *net)
	510	{
	511	nf_ct_frags6_sysctl_unregister(net);
4907abc6	512	fqdir_exit(net->nf_frag.fqdir);
c038a767 AW	513	}
	514
	515	static struct pernet_operations nf_ct_net_ops = {
d5dd8879 ED	516	.init = nf_ct_net_init,
	517	.pre_exit = nf_ct_net_pre_exit,
	518	.exit = nf_ct_net_exit,
c038a767 AW	519	};
c038a767 AW	520
70b095c8 FW	521	static const struct rhashtable_params nfct_rhash_params = {
	522	.head_offset = offsetof(struct inet_frag_queue, node),
	523	.hashfn = ip6frag_key_hashfn,
	524	.obj_hashfn = ip6frag_obj_hashfn,
	525	.obj_cmpfn = ip6frag_obj_cmpfn,
	526	.automatic_shrinking = true,
	527	};
	528
9fb9cbb1 YK	529	int nf_ct_frag6_init(void)
9fb9cbb1 YK	530	{
c038a767 AW	531	int ret = 0;
c038a767 AW	532
70b095c8	533	nf_frags.constructor = ip6frag_init;
c9547709	534	nf_frags.destructor = NULL;
b836c99f	535	nf_frags.qsize = sizeof(struct frag_queue);
e521db9d	536	nf_frags.frag_expire = nf_ct_frag6_expire;
d4ad4d22	537	nf_frags.frags_cache_name = nf_frags_cache_name;
70b095c8	538	nf_frags.rhash_params = nfct_rhash_params;
d4ad4d22 NA	539	ret = inet_frags_init(&nf_frags);
	540	if (ret)
	541	goto out;
c038a767 AW	542	ret = register_pernet_subsys(&nf_ct_net_ops);
c038a767 AW	543	if (ret)
e97c3e27	544	inet_frags_fini(&nf_frags);
e97c3e27	545
d4ad4d22	546	out:
c038a767	547	return ret;
9fb9cbb1 YK	548	}
	549
	550	void nf_ct_frag6_cleanup(void)
	551	{
c038a767	552	unregister_pernet_subsys(&nf_ct_net_ops);
7eb95156	553	inet_frags_fini(&nf_frags);
9fb9cbb1	554	}