1 /* SPDX-License-Identifier: GPL-2.0 */ 1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _IPV6_FRAG_H 2 #ifndef _IPV6_FRAG_H
3 #define _IPV6_FRAG_H 3 #define _IPV6_FRAG_H
4 #include <linux/icmpv6.h> <<
5 #include <linux/kernel.h> 4 #include <linux/kernel.h>
6 #include <net/addrconf.h> 5 #include <net/addrconf.h>
7 #include <net/ipv6.h> 6 #include <net/ipv6.h>
8 #include <net/inet_frag.h> 7 #include <net/inet_frag.h>
9 8
10 enum ip6_defrag_users { 9 enum ip6_defrag_users {
11 IP6_DEFRAG_LOCAL_DELIVER, 10 IP6_DEFRAG_LOCAL_DELIVER,
12 IP6_DEFRAG_CONNTRACK_IN, 11 IP6_DEFRAG_CONNTRACK_IN,
13 __IP6_DEFRAG_CONNTRACK_IN = IP6_ 12 __IP6_DEFRAG_CONNTRACK_IN = IP6_DEFRAG_CONNTRACK_IN + USHRT_MAX,
14 IP6_DEFRAG_CONNTRACK_OUT, 13 IP6_DEFRAG_CONNTRACK_OUT,
15 __IP6_DEFRAG_CONNTRACK_OUT = IP6_ 14 __IP6_DEFRAG_CONNTRACK_OUT = IP6_DEFRAG_CONNTRACK_OUT + USHRT_MAX,
16 IP6_DEFRAG_CONNTRACK_BRIDGE_IN, 15 IP6_DEFRAG_CONNTRACK_BRIDGE_IN,
17 __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6 16 __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX,
18 }; 17 };
19 18
20 /* 19 /*
21 * Equivalent of ipv4 struct ip 20 * Equivalent of ipv4 struct ip
22 */ 21 */
23 struct frag_queue { 22 struct frag_queue {
24 struct inet_frag_queue q; 23 struct inet_frag_queue q;
25 24
26 int iif; 25 int iif;
27 __u16 nhoffset; 26 __u16 nhoffset;
28 u8 ecn; 27 u8 ecn;
29 }; 28 };
30 29
31 #if IS_ENABLED(CONFIG_IPV6) 30 #if IS_ENABLED(CONFIG_IPV6)
32 static inline void ip6frag_init(struct inet_fr 31 static inline void ip6frag_init(struct inet_frag_queue *q, const void *a)
33 { 32 {
34 struct frag_queue *fq = container_of(q 33 struct frag_queue *fq = container_of(q, struct frag_queue, q);
35 const struct frag_v6_compare_key *key 34 const struct frag_v6_compare_key *key = a;
36 35
37 q->key.v6 = *key; 36 q->key.v6 = *key;
38 fq->ecn = 0; 37 fq->ecn = 0;
39 } 38 }
40 39
41 static inline u32 ip6frag_key_hashfn(const voi 40 static inline u32 ip6frag_key_hashfn(const void *data, u32 len, u32 seed)
42 { 41 {
43 return jhash2(data, 42 return jhash2(data,
44 sizeof(struct frag_v6_co 43 sizeof(struct frag_v6_compare_key) / sizeof(u32), seed);
45 } 44 }
46 45
47 static inline u32 ip6frag_obj_hashfn(const voi 46 static inline u32 ip6frag_obj_hashfn(const void *data, u32 len, u32 seed)
48 { 47 {
49 const struct inet_frag_queue *fq = dat 48 const struct inet_frag_queue *fq = data;
50 49
51 return jhash2((const u32 *)&fq->key.v6 50 return jhash2((const u32 *)&fq->key.v6,
52 sizeof(struct frag_v6_co 51 sizeof(struct frag_v6_compare_key) / sizeof(u32), seed);
53 } 52 }
54 53
55 static inline int 54 static inline int
56 ip6frag_obj_cmpfn(struct rhashtable_compare_ar 55 ip6frag_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr)
57 { 56 {
58 const struct frag_v6_compare_key *key 57 const struct frag_v6_compare_key *key = arg->key;
59 const struct inet_frag_queue *fq = ptr 58 const struct inet_frag_queue *fq = ptr;
60 59
61 return !!memcmp(&fq->key, key, sizeof( 60 return !!memcmp(&fq->key, key, sizeof(*key));
62 } 61 }
63 62
64 static inline void 63 static inline void
65 ip6frag_expire_frag_queue(struct net *net, str 64 ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)
66 { 65 {
67 struct net_device *dev = NULL; 66 struct net_device *dev = NULL;
68 struct sk_buff *head; 67 struct sk_buff *head;
69 68
70 rcu_read_lock(); 69 rcu_read_lock();
71 /* Paired with the WRITE_ONCE() in fqd <<
72 if (READ_ONCE(fq->q.fqdir->dead)) <<
73 goto out_rcu_unlock; <<
74 spin_lock(&fq->q.lock); 70 spin_lock(&fq->q.lock);
75 71
76 if (fq->q.flags & INET_FRAG_COMPLETE) 72 if (fq->q.flags & INET_FRAG_COMPLETE)
77 goto out; 73 goto out;
78 74
79 fq->q.flags |= INET_FRAG_DROP; <<
80 inet_frag_kill(&fq->q); 75 inet_frag_kill(&fq->q);
81 76
82 dev = dev_get_by_index_rcu(net, fq->ii 77 dev = dev_get_by_index_rcu(net, fq->iif);
83 if (!dev) 78 if (!dev)
84 goto out; 79 goto out;
85 80
86 __IP6_INC_STATS(net, __in6_dev_get(dev 81 __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
87 __IP6_INC_STATS(net, __in6_dev_get(dev 82 __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
88 83
89 /* Don't send error if the first segme 84 /* Don't send error if the first segment did not arrive. */
90 if (!(fq->q.flags & INET_FRAG_FIRST_IN 85 if (!(fq->q.flags & INET_FRAG_FIRST_IN))
91 goto out; 86 goto out;
92 87
93 /* sk_buff::dev and sk_buff::rbnode ar 88 /* sk_buff::dev and sk_buff::rbnode are unionized. So we
94 * pull the head out of the tree in or 89 * pull the head out of the tree in order to be able to
95 * deal with head->dev. 90 * deal with head->dev.
96 */ 91 */
97 head = inet_frag_pull_head(&fq->q); 92 head = inet_frag_pull_head(&fq->q);
98 if (!head) 93 if (!head)
99 goto out; 94 goto out;
100 95
101 head->dev = dev; 96 head->dev = dev;
102 spin_unlock(&fq->q.lock); 97 spin_unlock(&fq->q.lock);
103 98
104 icmpv6_send(head, ICMPV6_TIME_EXCEED, 99 icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);
105 kfree_skb_reason(head, SKB_DROP_REASON !! 100 kfree_skb(head);
106 goto out_rcu_unlock; 101 goto out_rcu_unlock;
107 102
108 out: 103 out:
109 spin_unlock(&fq->q.lock); 104 spin_unlock(&fq->q.lock);
110 out_rcu_unlock: 105 out_rcu_unlock:
111 rcu_read_unlock(); 106 rcu_read_unlock();
112 inet_frag_put(&fq->q); 107 inet_frag_put(&fq->q);
113 } 108 }
114 <<
115 /* Check if the upper layer header is truncate <<
116 static inline bool <<
117 ipv6frag_thdr_truncated(struct sk_buff *skb, i <<
118 { <<
119 u8 nexthdr = *nexthdrp; <<
120 __be16 frag_off; <<
121 int offset; <<
122 <<
123 offset = ipv6_skip_exthdr(skb, start, <<
124 if (offset < 0 || (frag_off & htons(IP <<
125 return false; <<
126 switch (nexthdr) { <<
127 case NEXTHDR_TCP: <<
128 offset += sizeof(struct tcphdr <<
129 break; <<
130 case NEXTHDR_UDP: <<
131 offset += sizeof(struct udphdr <<
132 break; <<
133 case NEXTHDR_ICMP: <<
134 offset += sizeof(struct icmp6h <<
135 break; <<
136 default: <<
137 offset += 1; <<
138 } <<
139 if (offset > skb->len) <<
140 return true; <<
141 return false; <<
142 } <<
143 <<
144 #endif 109 #endif
145 #endif 110 #endif
146 111
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.