1 /* 6LoWPAN fragment reassembly
5 * Alexander Aring <aar@pengutronix.de>
7 * Based on: net/ipv6/reassembly.c
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
15 #define pr_fmt(fmt) "6LoWPAN: " fmt
17 #include <linux/net.h>
18 #include <linux/list.h>
19 #include <linux/netdevice.h>
20 #include <linux/random.h>
21 #include <linux/jhash.h>
22 #include <linux/skbuff.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
26 #include <net/ieee802154_netdev.h>
27 #include <net/6lowpan.h>
29 #include <net/inet_frag.h>
31 #include "6lowpan_i.h"
33 static const char lowpan_frags_cache_name
[] = "lowpan-frags";
35 static struct inet_frags lowpan_frags
;
37 static int lowpan_frag_reasm(struct lowpan_frag_queue
*fq
,
38 struct sk_buff
*prev
, struct net_device
*ldev
);
40 static void lowpan_frag_init(struct inet_frag_queue
*q
, const void *a
)
42 const struct frag_lowpan_compare_key
*key
= a
;
43 struct lowpan_frag_queue
*fq
;
45 fq
= container_of(q
, struct lowpan_frag_queue
, q
);
47 BUILD_BUG_ON(sizeof(*key
) > sizeof(q
->key
));
48 memcpy(&q
->key
, key
, sizeof(*key
));
51 static void lowpan_frag_expire(struct timer_list
*t
)
53 struct inet_frag_queue
*frag
= from_timer(frag
, t
, timer
);
54 struct frag_queue
*fq
;
57 fq
= container_of(frag
, struct frag_queue
, q
);
58 net
= container_of(fq
->q
.net
, struct net
, ieee802154_lowpan
.frags
);
60 spin_lock(&fq
->q
.lock
);
62 if (fq
->q
.flags
& INET_FRAG_COMPLETE
)
65 inet_frag_kill(&fq
->q
);
67 spin_unlock(&fq
->q
.lock
);
68 inet_frag_put(&fq
->q
);
71 static inline struct lowpan_frag_queue
*
72 fq_find(struct net
*net
, const struct lowpan_802154_cb
*cb
,
73 const struct ieee802154_addr
*src
,
74 const struct ieee802154_addr
*dst
)
76 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
77 net_ieee802154_lowpan(net
);
78 struct frag_lowpan_compare_key key
= {
84 struct inet_frag_queue
*q
;
86 q
= inet_frag_find(&ieee802154_lowpan
->frags
, &key
);
87 if (IS_ERR_OR_NULL(q
)) {
88 inet_frag_maybe_warn_overflow(q
, pr_fmt());
91 return container_of(q
, struct lowpan_frag_queue
, q
);
94 static int lowpan_frag_queue(struct lowpan_frag_queue
*fq
,
95 struct sk_buff
*skb
, u8 frag_type
)
97 struct sk_buff
*prev
, *next
;
98 struct net_device
*ldev
;
101 if (fq
->q
.flags
& INET_FRAG_COMPLETE
)
104 offset
= lowpan_802154_cb(skb
)->d_offset
<< 3;
105 end
= lowpan_802154_cb(skb
)->d_size
;
107 /* Is this the final fragment? */
108 if (offset
+ skb
->len
== end
) {
109 /* If we already have some bits beyond end
110 * or have different end, the segment is corrupted.
112 if (end
< fq
->q
.len
||
113 ((fq
->q
.flags
& INET_FRAG_LAST_IN
) && end
!= fq
->q
.len
))
115 fq
->q
.flags
|= INET_FRAG_LAST_IN
;
118 if (end
> fq
->q
.len
) {
119 /* Some bits beyond end -> corruption. */
120 if (fq
->q
.flags
& INET_FRAG_LAST_IN
)
126 /* Find out which fragments are in front and at the back of us
127 * in the chain of fragments so far. We must know where to put
128 * this fragment, right?
130 prev
= fq
->q
.fragments_tail
;
132 lowpan_802154_cb(prev
)->d_offset
<
133 lowpan_802154_cb(skb
)->d_offset
) {
138 for (next
= fq
->q
.fragments
; next
!= NULL
; next
= next
->next
) {
139 if (lowpan_802154_cb(next
)->d_offset
>=
140 lowpan_802154_cb(skb
)->d_offset
)
146 /* Insert this fragment in the chain of fragments. */
149 fq
->q
.fragments_tail
= skb
;
153 fq
->q
.fragments
= skb
;
159 fq
->q
.stamp
= skb
->tstamp
;
160 if (frag_type
== LOWPAN_DISPATCH_FRAG1
)
161 fq
->q
.flags
|= INET_FRAG_FIRST_IN
;
163 fq
->q
.meat
+= skb
->len
;
164 add_frag_mem_limit(fq
->q
.net
, skb
->truesize
);
166 if (fq
->q
.flags
== (INET_FRAG_FIRST_IN
| INET_FRAG_LAST_IN
) &&
167 fq
->q
.meat
== fq
->q
.len
) {
169 unsigned long orefdst
= skb
->_skb_refdst
;
171 skb
->_skb_refdst
= 0UL;
172 res
= lowpan_frag_reasm(fq
, prev
, ldev
);
173 skb
->_skb_refdst
= orefdst
;
183 /* Check if this packet is complete.
184 * Returns NULL on failure by any reason, and pointer
185 * to current nexthdr field in reassembled frame.
187 * It is called with locked fq, and caller must check that
188 * queue is eligible for reassembly i.e. it is not COMPLETE,
189 * the last and the first frames arrived and all the bits are here.
191 static int lowpan_frag_reasm(struct lowpan_frag_queue
*fq
, struct sk_buff
*prev
,
192 struct net_device
*ldev
)
194 struct sk_buff
*fp
, *head
= fq
->q
.fragments
;
197 inet_frag_kill(&fq
->q
);
199 /* Make the one we just received the head. */
202 fp
= skb_clone(head
, GFP_ATOMIC
);
207 fp
->next
= head
->next
;
209 fq
->q
.fragments_tail
= fp
;
212 skb_morph(head
, fq
->q
.fragments
);
213 head
->next
= fq
->q
.fragments
->next
;
215 consume_skb(fq
->q
.fragments
);
216 fq
->q
.fragments
= head
;
219 /* Head of list must not be cloned. */
220 if (skb_unclone(head
, GFP_ATOMIC
))
223 /* If the first fragment is fragmented itself, we split
224 * it to two chunks: the first with data and paged part
225 * and the second, holding only fragments.
227 if (skb_has_frag_list(head
)) {
228 struct sk_buff
*clone
;
231 clone
= alloc_skb(0, GFP_ATOMIC
);
234 clone
->next
= head
->next
;
236 skb_shinfo(clone
)->frag_list
= skb_shinfo(head
)->frag_list
;
237 skb_frag_list_init(head
);
238 for (i
= 0; i
< skb_shinfo(head
)->nr_frags
; i
++)
239 plen
+= skb_frag_size(&skb_shinfo(head
)->frags
[i
]);
240 clone
->len
= head
->data_len
- plen
;
241 clone
->data_len
= clone
->len
;
242 head
->data_len
-= clone
->len
;
243 head
->len
-= clone
->len
;
244 add_frag_mem_limit(fq
->q
.net
, clone
->truesize
);
247 WARN_ON(head
== NULL
);
249 sum_truesize
= head
->truesize
;
250 for (fp
= head
->next
; fp
;) {
253 struct sk_buff
*next
= fp
->next
;
255 sum_truesize
+= fp
->truesize
;
256 if (skb_try_coalesce(head
, fp
, &headstolen
, &delta
)) {
257 kfree_skb_partial(fp
, headstolen
);
259 if (!skb_shinfo(head
)->frag_list
)
260 skb_shinfo(head
)->frag_list
= fp
;
261 head
->data_len
+= fp
->len
;
262 head
->len
+= fp
->len
;
263 head
->truesize
+= fp
->truesize
;
267 sub_frag_mem_limit(fq
->q
.net
, sum_truesize
);
271 head
->tstamp
= fq
->q
.stamp
;
273 fq
->q
.fragments
= NULL
;
274 fq
->q
.fragments_tail
= NULL
;
278 net_dbg_ratelimited("lowpan_frag_reasm: no memory for reassembly\n");
282 static int lowpan_frag_rx_handlers_result(struct sk_buff
*skb
,
283 lowpan_rx_result res
)
287 return NET_RX_SUCCESS
;
289 /* nobody cared about this packet */
290 net_warn_ratelimited("%s: received unknown dispatch\n",
295 /* all others failure */
300 static lowpan_rx_result
lowpan_frag_rx_h_iphc(struct sk_buff
*skb
)
304 if (!lowpan_is_iphc(*skb_network_header(skb
)))
307 ret
= lowpan_iphc_decompress(skb
);
314 static int lowpan_invoke_frag_rx_handlers(struct sk_buff
*skb
)
316 lowpan_rx_result res
;
318 #define CALL_RXH(rxh) \
321 if (res != RX_CONTINUE) \
325 /* likely at first */
326 CALL_RXH(lowpan_frag_rx_h_iphc
);
327 CALL_RXH(lowpan_rx_h_ipv6
);
330 return lowpan_frag_rx_handlers_result(skb
, res
);
334 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK 0x07
335 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT 8
337 static int lowpan_get_cb(struct sk_buff
*skb
, u8 frag_type
,
338 struct lowpan_802154_cb
*cb
)
341 u8 high
= 0, low
= 0;
344 fail
= lowpan_fetch_skb(skb
, &high
, 1);
345 fail
|= lowpan_fetch_skb(skb
, &low
, 1);
346 /* remove the dispatch value and use first three bits as high value
347 * for the datagram size
349 cb
->d_size
= (high
& LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK
) <<
350 LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT
| low
;
351 fail
|= lowpan_fetch_skb(skb
, &d_tag
, 2);
352 cb
->d_tag
= ntohs(d_tag
);
354 if (frag_type
== LOWPAN_DISPATCH_FRAGN
) {
355 fail
|= lowpan_fetch_skb(skb
, &cb
->d_offset
, 1);
357 skb_reset_network_header(skb
);
359 /* check if datagram_size has ipv6hdr on FRAG1 */
360 fail
|= cb
->d_size
< sizeof(struct ipv6hdr
);
361 /* check if we can dereference the dispatch value */
371 int lowpan_frag_rcv(struct sk_buff
*skb
, u8 frag_type
)
373 struct lowpan_frag_queue
*fq
;
374 struct net
*net
= dev_net(skb
->dev
);
375 struct lowpan_802154_cb
*cb
= lowpan_802154_cb(skb
);
376 struct ieee802154_hdr hdr
;
379 if (ieee802154_hdr_peek_addrs(skb
, &hdr
) < 0)
382 err
= lowpan_get_cb(skb
, frag_type
, cb
);
386 if (frag_type
== LOWPAN_DISPATCH_FRAG1
) {
387 err
= lowpan_invoke_frag_rx_handlers(skb
);
388 if (err
== NET_RX_DROP
)
392 if (cb
->d_size
> IPV6_MIN_MTU
) {
393 net_warn_ratelimited("lowpan_frag_rcv: datagram size exceeds MTU\n");
397 fq
= fq_find(net
, cb
, &hdr
.source
, &hdr
.dest
);
401 spin_lock(&fq
->q
.lock
);
402 ret
= lowpan_frag_queue(fq
, skb
, frag_type
);
403 spin_unlock(&fq
->q
.lock
);
405 inet_frag_put(&fq
->q
);
417 static struct ctl_table lowpan_frags_ns_ctl_table
[] = {
419 .procname
= "6lowpanfrag_high_thresh",
420 .data
= &init_net
.ieee802154_lowpan
.frags
.high_thresh
,
421 .maxlen
= sizeof(int),
423 .proc_handler
= proc_dointvec_minmax
,
424 .extra1
= &init_net
.ieee802154_lowpan
.frags
.low_thresh
427 .procname
= "6lowpanfrag_low_thresh",
428 .data
= &init_net
.ieee802154_lowpan
.frags
.low_thresh
,
429 .maxlen
= sizeof(int),
431 .proc_handler
= proc_dointvec_minmax
,
433 .extra2
= &init_net
.ieee802154_lowpan
.frags
.high_thresh
436 .procname
= "6lowpanfrag_time",
437 .data
= &init_net
.ieee802154_lowpan
.frags
.timeout
,
438 .maxlen
= sizeof(int),
440 .proc_handler
= proc_dointvec_jiffies
,
445 /* secret interval has been deprecated */
446 static int lowpan_frags_secret_interval_unused
;
447 static struct ctl_table lowpan_frags_ctl_table
[] = {
449 .procname
= "6lowpanfrag_secret_interval",
450 .data
= &lowpan_frags_secret_interval_unused
,
451 .maxlen
= sizeof(int),
453 .proc_handler
= proc_dointvec_jiffies
,
458 static int __net_init
lowpan_frags_ns_sysctl_register(struct net
*net
)
460 struct ctl_table
*table
;
461 struct ctl_table_header
*hdr
;
462 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
463 net_ieee802154_lowpan(net
);
465 table
= lowpan_frags_ns_ctl_table
;
466 if (!net_eq(net
, &init_net
)) {
467 table
= kmemdup(table
, sizeof(lowpan_frags_ns_ctl_table
),
472 table
[0].data
= &ieee802154_lowpan
->frags
.high_thresh
;
473 table
[0].extra1
= &ieee802154_lowpan
->frags
.low_thresh
;
474 table
[0].extra2
= &init_net
.ieee802154_lowpan
.frags
.high_thresh
;
475 table
[1].data
= &ieee802154_lowpan
->frags
.low_thresh
;
476 table
[1].extra2
= &ieee802154_lowpan
->frags
.high_thresh
;
477 table
[2].data
= &ieee802154_lowpan
->frags
.timeout
;
479 /* Don't export sysctls to unprivileged users */
480 if (net
->user_ns
!= &init_user_ns
)
481 table
[0].procname
= NULL
;
484 hdr
= register_net_sysctl(net
, "net/ieee802154/6lowpan", table
);
488 ieee802154_lowpan
->sysctl
.frags_hdr
= hdr
;
492 if (!net_eq(net
, &init_net
))
498 static void __net_exit
lowpan_frags_ns_sysctl_unregister(struct net
*net
)
500 struct ctl_table
*table
;
501 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
502 net_ieee802154_lowpan(net
);
504 table
= ieee802154_lowpan
->sysctl
.frags_hdr
->ctl_table_arg
;
505 unregister_net_sysctl_table(ieee802154_lowpan
->sysctl
.frags_hdr
);
506 if (!net_eq(net
, &init_net
))
510 static struct ctl_table_header
*lowpan_ctl_header
;
512 static int __init
lowpan_frags_sysctl_register(void)
514 lowpan_ctl_header
= register_net_sysctl(&init_net
,
515 "net/ieee802154/6lowpan",
516 lowpan_frags_ctl_table
);
517 return lowpan_ctl_header
== NULL
? -ENOMEM
: 0;
520 static void lowpan_frags_sysctl_unregister(void)
522 unregister_net_sysctl_table(lowpan_ctl_header
);
525 static inline int lowpan_frags_ns_sysctl_register(struct net
*net
)
530 static inline void lowpan_frags_ns_sysctl_unregister(struct net
*net
)
534 static inline int __init
lowpan_frags_sysctl_register(void)
539 static inline void lowpan_frags_sysctl_unregister(void)
544 static int __net_init
lowpan_frags_init_net(struct net
*net
)
546 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
547 net_ieee802154_lowpan(net
);
550 ieee802154_lowpan
->frags
.high_thresh
= IPV6_FRAG_HIGH_THRESH
;
551 ieee802154_lowpan
->frags
.low_thresh
= IPV6_FRAG_LOW_THRESH
;
552 ieee802154_lowpan
->frags
.timeout
= IPV6_FRAG_TIMEOUT
;
553 ieee802154_lowpan
->frags
.f
= &lowpan_frags
;
555 res
= inet_frags_init_net(&ieee802154_lowpan
->frags
);
558 res
= lowpan_frags_ns_sysctl_register(net
);
560 inet_frags_exit_net(&ieee802154_lowpan
->frags
);
564 static void __net_exit
lowpan_frags_exit_net(struct net
*net
)
566 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
567 net_ieee802154_lowpan(net
);
569 lowpan_frags_ns_sysctl_unregister(net
);
570 inet_frags_exit_net(&ieee802154_lowpan
->frags
);
573 static struct pernet_operations lowpan_frags_ops
= {
574 .init
= lowpan_frags_init_net
,
575 .exit
= lowpan_frags_exit_net
,
578 static u32
lowpan_key_hashfn(const void *data
, u32 len
, u32 seed
)
581 sizeof(struct frag_lowpan_compare_key
) / sizeof(u32
), seed
);
584 static u32
lowpan_obj_hashfn(const void *data
, u32 len
, u32 seed
)
586 const struct inet_frag_queue
*fq
= data
;
588 return jhash2((const u32
*)&fq
->key
,
589 sizeof(struct frag_lowpan_compare_key
) / sizeof(u32
), seed
);
592 static int lowpan_obj_cmpfn(struct rhashtable_compare_arg
*arg
, const void *ptr
)
594 const struct frag_lowpan_compare_key
*key
= arg
->key
;
595 const struct inet_frag_queue
*fq
= ptr
;
597 return !!memcmp(&fq
->key
, key
, sizeof(*key
));
600 static const struct rhashtable_params lowpan_rhash_params
= {
601 .head_offset
= offsetof(struct inet_frag_queue
, node
),
602 .hashfn
= lowpan_key_hashfn
,
603 .obj_hashfn
= lowpan_obj_hashfn
,
604 .obj_cmpfn
= lowpan_obj_cmpfn
,
605 .automatic_shrinking
= true,
608 int __init
lowpan_net_frag_init(void)
612 lowpan_frags
.constructor
= lowpan_frag_init
;
613 lowpan_frags
.destructor
= NULL
;
614 lowpan_frags
.qsize
= sizeof(struct frag_queue
);
615 lowpan_frags
.frag_expire
= lowpan_frag_expire
;
616 lowpan_frags
.frags_cache_name
= lowpan_frags_cache_name
;
617 lowpan_frags
.rhash_params
= lowpan_rhash_params
;
618 ret
= inet_frags_init(&lowpan_frags
);
622 ret
= lowpan_frags_sysctl_register();
626 ret
= register_pernet_subsys(&lowpan_frags_ops
);
632 lowpan_frags_sysctl_unregister();
634 inet_frags_fini(&lowpan_frags
);
638 void lowpan_net_frag_exit(void)
640 inet_frags_fini(&lowpan_frags
);
641 lowpan_frags_sysctl_unregister();
642 unregister_pernet_subsys(&lowpan_frags_ops
);