1 /* 6LoWPAN fragment reassembly
5 * Alexander Aring <aar@pengutronix.de>
7 * Based on: net/ipv6/reassembly.c
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
15 #define pr_fmt(fmt) "6LoWPAN: " fmt
17 #include <linux/net.h>
18 #include <linux/list.h>
19 #include <linux/netdevice.h>
20 #include <linux/random.h>
21 #include <linux/jhash.h>
22 #include <linux/skbuff.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
26 #include <net/ieee802154_netdev.h>
27 #include <net/6lowpan.h>
29 #include <net/inet_frag.h>
31 #include "6lowpan_i.h"
33 static const char lowpan_frags_cache_name
[] = "lowpan-frags";
35 static struct inet_frags lowpan_frags
;
37 static int lowpan_frag_reasm(struct lowpan_frag_queue
*fq
,
38 struct sk_buff
*prev
, struct net_device
*ldev
);
40 static void lowpan_frag_init(struct inet_frag_queue
*q
, const void *a
)
42 const struct frag_lowpan_compare_key
*key
= a
;
43 struct lowpan_frag_queue
*fq
;
45 fq
= container_of(q
, struct lowpan_frag_queue
, q
);
47 BUILD_BUG_ON(sizeof(*key
) > sizeof(q
->key
));
48 memcpy(&q
->key
, key
, sizeof(*key
));
51 static void lowpan_frag_expire(struct timer_list
*t
)
53 struct inet_frag_queue
*frag
= from_timer(frag
, t
, timer
);
54 struct frag_queue
*fq
;
57 fq
= container_of(frag
, struct frag_queue
, q
);
58 net
= container_of(fq
->q
.net
, struct net
, ieee802154_lowpan
.frags
);
60 spin_lock(&fq
->q
.lock
);
62 if (fq
->q
.flags
& INET_FRAG_COMPLETE
)
65 inet_frag_kill(&fq
->q
);
67 spin_unlock(&fq
->q
.lock
);
68 inet_frag_put(&fq
->q
);
71 static inline struct lowpan_frag_queue
*
72 fq_find(struct net
*net
, const struct lowpan_802154_cb
*cb
,
73 const struct ieee802154_addr
*src
,
74 const struct ieee802154_addr
*dst
)
76 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
77 net_ieee802154_lowpan(net
);
78 struct frag_lowpan_compare_key key
= {
84 struct inet_frag_queue
*q
;
86 q
= inet_frag_find(&ieee802154_lowpan
->frags
, &key
);
90 return container_of(q
, struct lowpan_frag_queue
, q
);
93 static int lowpan_frag_queue(struct lowpan_frag_queue
*fq
,
94 struct sk_buff
*skb
, u8 frag_type
)
96 struct sk_buff
*prev
, *next
;
97 struct net_device
*ldev
;
100 if (fq
->q
.flags
& INET_FRAG_COMPLETE
)
103 offset
= lowpan_802154_cb(skb
)->d_offset
<< 3;
104 end
= lowpan_802154_cb(skb
)->d_size
;
106 /* Is this the final fragment? */
107 if (offset
+ skb
->len
== end
) {
108 /* If we already have some bits beyond end
109 * or have different end, the segment is corrupted.
111 if (end
< fq
->q
.len
||
112 ((fq
->q
.flags
& INET_FRAG_LAST_IN
) && end
!= fq
->q
.len
))
114 fq
->q
.flags
|= INET_FRAG_LAST_IN
;
117 if (end
> fq
->q
.len
) {
118 /* Some bits beyond end -> corruption. */
119 if (fq
->q
.flags
& INET_FRAG_LAST_IN
)
125 /* Find out which fragments are in front and at the back of us
126 * in the chain of fragments so far. We must know where to put
127 * this fragment, right?
129 prev
= fq
->q
.fragments_tail
;
131 lowpan_802154_cb(prev
)->d_offset
<
132 lowpan_802154_cb(skb
)->d_offset
) {
137 for (next
= fq
->q
.fragments
; next
!= NULL
; next
= next
->next
) {
138 if (lowpan_802154_cb(next
)->d_offset
>=
139 lowpan_802154_cb(skb
)->d_offset
)
145 /* Insert this fragment in the chain of fragments. */
148 fq
->q
.fragments_tail
= skb
;
152 fq
->q
.fragments
= skb
;
158 fq
->q
.stamp
= skb
->tstamp
;
159 if (frag_type
== LOWPAN_DISPATCH_FRAG1
)
160 fq
->q
.flags
|= INET_FRAG_FIRST_IN
;
162 fq
->q
.meat
+= skb
->len
;
163 add_frag_mem_limit(fq
->q
.net
, skb
->truesize
);
165 if (fq
->q
.flags
== (INET_FRAG_FIRST_IN
| INET_FRAG_LAST_IN
) &&
166 fq
->q
.meat
== fq
->q
.len
) {
168 unsigned long orefdst
= skb
->_skb_refdst
;
170 skb
->_skb_refdst
= 0UL;
171 res
= lowpan_frag_reasm(fq
, prev
, ldev
);
172 skb
->_skb_refdst
= orefdst
;
182 /* Check if this packet is complete.
183 * Returns NULL on failure by any reason, and pointer
184 * to current nexthdr field in reassembled frame.
186 * It is called with locked fq, and caller must check that
187 * queue is eligible for reassembly i.e. it is not COMPLETE,
188 * the last and the first frames arrived and all the bits are here.
190 static int lowpan_frag_reasm(struct lowpan_frag_queue
*fq
, struct sk_buff
*prev
,
191 struct net_device
*ldev
)
193 struct sk_buff
*fp
, *head
= fq
->q
.fragments
;
196 inet_frag_kill(&fq
->q
);
198 /* Make the one we just received the head. */
201 fp
= skb_clone(head
, GFP_ATOMIC
);
206 fp
->next
= head
->next
;
208 fq
->q
.fragments_tail
= fp
;
211 skb_morph(head
, fq
->q
.fragments
);
212 head
->next
= fq
->q
.fragments
->next
;
214 consume_skb(fq
->q
.fragments
);
215 fq
->q
.fragments
= head
;
218 /* Head of list must not be cloned. */
219 if (skb_unclone(head
, GFP_ATOMIC
))
222 /* If the first fragment is fragmented itself, we split
223 * it to two chunks: the first with data and paged part
224 * and the second, holding only fragments.
226 if (skb_has_frag_list(head
)) {
227 struct sk_buff
*clone
;
230 clone
= alloc_skb(0, GFP_ATOMIC
);
233 clone
->next
= head
->next
;
235 skb_shinfo(clone
)->frag_list
= skb_shinfo(head
)->frag_list
;
236 skb_frag_list_init(head
);
237 for (i
= 0; i
< skb_shinfo(head
)->nr_frags
; i
++)
238 plen
+= skb_frag_size(&skb_shinfo(head
)->frags
[i
]);
239 clone
->len
= head
->data_len
- plen
;
240 clone
->data_len
= clone
->len
;
241 head
->data_len
-= clone
->len
;
242 head
->len
-= clone
->len
;
243 add_frag_mem_limit(fq
->q
.net
, clone
->truesize
);
246 WARN_ON(head
== NULL
);
248 sum_truesize
= head
->truesize
;
249 for (fp
= head
->next
; fp
;) {
252 struct sk_buff
*next
= fp
->next
;
254 sum_truesize
+= fp
->truesize
;
255 if (skb_try_coalesce(head
, fp
, &headstolen
, &delta
)) {
256 kfree_skb_partial(fp
, headstolen
);
258 if (!skb_shinfo(head
)->frag_list
)
259 skb_shinfo(head
)->frag_list
= fp
;
260 head
->data_len
+= fp
->len
;
261 head
->len
+= fp
->len
;
262 head
->truesize
+= fp
->truesize
;
266 sub_frag_mem_limit(fq
->q
.net
, sum_truesize
);
270 head
->tstamp
= fq
->q
.stamp
;
272 fq
->q
.fragments
= NULL
;
273 fq
->q
.fragments_tail
= NULL
;
277 net_dbg_ratelimited("lowpan_frag_reasm: no memory for reassembly\n");
281 static int lowpan_frag_rx_handlers_result(struct sk_buff
*skb
,
282 lowpan_rx_result res
)
286 return NET_RX_SUCCESS
;
288 /* nobody cared about this packet */
289 net_warn_ratelimited("%s: received unknown dispatch\n",
294 /* all others failure */
299 static lowpan_rx_result
lowpan_frag_rx_h_iphc(struct sk_buff
*skb
)
303 if (!lowpan_is_iphc(*skb_network_header(skb
)))
306 ret
= lowpan_iphc_decompress(skb
);
313 static int lowpan_invoke_frag_rx_handlers(struct sk_buff
*skb
)
315 lowpan_rx_result res
;
317 #define CALL_RXH(rxh) \
320 if (res != RX_CONTINUE) \
324 /* likely at first */
325 CALL_RXH(lowpan_frag_rx_h_iphc
);
326 CALL_RXH(lowpan_rx_h_ipv6
);
329 return lowpan_frag_rx_handlers_result(skb
, res
);
333 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK 0x07
334 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT 8
336 static int lowpan_get_cb(struct sk_buff
*skb
, u8 frag_type
,
337 struct lowpan_802154_cb
*cb
)
340 u8 high
= 0, low
= 0;
343 fail
= lowpan_fetch_skb(skb
, &high
, 1);
344 fail
|= lowpan_fetch_skb(skb
, &low
, 1);
345 /* remove the dispatch value and use first three bits as high value
346 * for the datagram size
348 cb
->d_size
= (high
& LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK
) <<
349 LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT
| low
;
350 fail
|= lowpan_fetch_skb(skb
, &d_tag
, 2);
351 cb
->d_tag
= ntohs(d_tag
);
353 if (frag_type
== LOWPAN_DISPATCH_FRAGN
) {
354 fail
|= lowpan_fetch_skb(skb
, &cb
->d_offset
, 1);
356 skb_reset_network_header(skb
);
358 /* check if datagram_size has ipv6hdr on FRAG1 */
359 fail
|= cb
->d_size
< sizeof(struct ipv6hdr
);
360 /* check if we can dereference the dispatch value */
370 int lowpan_frag_rcv(struct sk_buff
*skb
, u8 frag_type
)
372 struct lowpan_frag_queue
*fq
;
373 struct net
*net
= dev_net(skb
->dev
);
374 struct lowpan_802154_cb
*cb
= lowpan_802154_cb(skb
);
375 struct ieee802154_hdr hdr
;
378 if (ieee802154_hdr_peek_addrs(skb
, &hdr
) < 0)
381 err
= lowpan_get_cb(skb
, frag_type
, cb
);
385 if (frag_type
== LOWPAN_DISPATCH_FRAG1
) {
386 err
= lowpan_invoke_frag_rx_handlers(skb
);
387 if (err
== NET_RX_DROP
)
391 if (cb
->d_size
> IPV6_MIN_MTU
) {
392 net_warn_ratelimited("lowpan_frag_rcv: datagram size exceeds MTU\n");
396 fq
= fq_find(net
, cb
, &hdr
.source
, &hdr
.dest
);
400 spin_lock(&fq
->q
.lock
);
401 ret
= lowpan_frag_queue(fq
, skb
, frag_type
);
402 spin_unlock(&fq
->q
.lock
);
404 inet_frag_put(&fq
->q
);
416 static struct ctl_table lowpan_frags_ns_ctl_table
[] = {
418 .procname
= "6lowpanfrag_high_thresh",
419 .data
= &init_net
.ieee802154_lowpan
.frags
.high_thresh
,
420 .maxlen
= sizeof(unsigned long),
422 .proc_handler
= proc_doulongvec_minmax
,
423 .extra1
= &init_net
.ieee802154_lowpan
.frags
.low_thresh
426 .procname
= "6lowpanfrag_low_thresh",
427 .data
= &init_net
.ieee802154_lowpan
.frags
.low_thresh
,
428 .maxlen
= sizeof(unsigned long),
430 .proc_handler
= proc_doulongvec_minmax
,
432 .extra2
= &init_net
.ieee802154_lowpan
.frags
.high_thresh
435 .procname
= "6lowpanfrag_time",
436 .data
= &init_net
.ieee802154_lowpan
.frags
.timeout
,
437 .maxlen
= sizeof(int),
439 .proc_handler
= proc_dointvec_jiffies
,
444 /* secret interval has been deprecated */
445 static int lowpan_frags_secret_interval_unused
;
446 static struct ctl_table lowpan_frags_ctl_table
[] = {
448 .procname
= "6lowpanfrag_secret_interval",
449 .data
= &lowpan_frags_secret_interval_unused
,
450 .maxlen
= sizeof(int),
452 .proc_handler
= proc_dointvec_jiffies
,
457 static int __net_init
lowpan_frags_ns_sysctl_register(struct net
*net
)
459 struct ctl_table
*table
;
460 struct ctl_table_header
*hdr
;
461 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
462 net_ieee802154_lowpan(net
);
464 table
= lowpan_frags_ns_ctl_table
;
465 if (!net_eq(net
, &init_net
)) {
466 table
= kmemdup(table
, sizeof(lowpan_frags_ns_ctl_table
),
471 table
[0].data
= &ieee802154_lowpan
->frags
.high_thresh
;
472 table
[0].extra1
= &ieee802154_lowpan
->frags
.low_thresh
;
473 table
[0].extra2
= &init_net
.ieee802154_lowpan
.frags
.high_thresh
;
474 table
[1].data
= &ieee802154_lowpan
->frags
.low_thresh
;
475 table
[1].extra2
= &ieee802154_lowpan
->frags
.high_thresh
;
476 table
[2].data
= &ieee802154_lowpan
->frags
.timeout
;
478 /* Don't export sysctls to unprivileged users */
479 if (net
->user_ns
!= &init_user_ns
)
480 table
[0].procname
= NULL
;
483 hdr
= register_net_sysctl(net
, "net/ieee802154/6lowpan", table
);
487 ieee802154_lowpan
->sysctl
.frags_hdr
= hdr
;
491 if (!net_eq(net
, &init_net
))
497 static void __net_exit
lowpan_frags_ns_sysctl_unregister(struct net
*net
)
499 struct ctl_table
*table
;
500 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
501 net_ieee802154_lowpan(net
);
503 table
= ieee802154_lowpan
->sysctl
.frags_hdr
->ctl_table_arg
;
504 unregister_net_sysctl_table(ieee802154_lowpan
->sysctl
.frags_hdr
);
505 if (!net_eq(net
, &init_net
))
509 static struct ctl_table_header
*lowpan_ctl_header
;
511 static int __init
lowpan_frags_sysctl_register(void)
513 lowpan_ctl_header
= register_net_sysctl(&init_net
,
514 "net/ieee802154/6lowpan",
515 lowpan_frags_ctl_table
);
516 return lowpan_ctl_header
== NULL
? -ENOMEM
: 0;
519 static void lowpan_frags_sysctl_unregister(void)
521 unregister_net_sysctl_table(lowpan_ctl_header
);
524 static inline int lowpan_frags_ns_sysctl_register(struct net
*net
)
529 static inline void lowpan_frags_ns_sysctl_unregister(struct net
*net
)
533 static inline int __init
lowpan_frags_sysctl_register(void)
538 static inline void lowpan_frags_sysctl_unregister(void)
543 static int __net_init
lowpan_frags_init_net(struct net
*net
)
545 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
546 net_ieee802154_lowpan(net
);
549 ieee802154_lowpan
->frags
.high_thresh
= IPV6_FRAG_HIGH_THRESH
;
550 ieee802154_lowpan
->frags
.low_thresh
= IPV6_FRAG_LOW_THRESH
;
551 ieee802154_lowpan
->frags
.timeout
= IPV6_FRAG_TIMEOUT
;
552 ieee802154_lowpan
->frags
.f
= &lowpan_frags
;
554 res
= inet_frags_init_net(&ieee802154_lowpan
->frags
);
557 res
= lowpan_frags_ns_sysctl_register(net
);
559 inet_frags_exit_net(&ieee802154_lowpan
->frags
);
563 static void __net_exit
lowpan_frags_exit_net(struct net
*net
)
565 struct netns_ieee802154_lowpan
*ieee802154_lowpan
=
566 net_ieee802154_lowpan(net
);
568 lowpan_frags_ns_sysctl_unregister(net
);
569 inet_frags_exit_net(&ieee802154_lowpan
->frags
);
572 static struct pernet_operations lowpan_frags_ops
= {
573 .init
= lowpan_frags_init_net
,
574 .exit
= lowpan_frags_exit_net
,
577 static u32
lowpan_key_hashfn(const void *data
, u32 len
, u32 seed
)
580 sizeof(struct frag_lowpan_compare_key
) / sizeof(u32
), seed
);
583 static u32
lowpan_obj_hashfn(const void *data
, u32 len
, u32 seed
)
585 const struct inet_frag_queue
*fq
= data
;
587 return jhash2((const u32
*)&fq
->key
,
588 sizeof(struct frag_lowpan_compare_key
) / sizeof(u32
), seed
);
591 static int lowpan_obj_cmpfn(struct rhashtable_compare_arg
*arg
, const void *ptr
)
593 const struct frag_lowpan_compare_key
*key
= arg
->key
;
594 const struct inet_frag_queue
*fq
= ptr
;
596 return !!memcmp(&fq
->key
, key
, sizeof(*key
));
599 static const struct rhashtable_params lowpan_rhash_params
= {
600 .head_offset
= offsetof(struct inet_frag_queue
, node
),
601 .hashfn
= lowpan_key_hashfn
,
602 .obj_hashfn
= lowpan_obj_hashfn
,
603 .obj_cmpfn
= lowpan_obj_cmpfn
,
604 .automatic_shrinking
= true,
607 int __init
lowpan_net_frag_init(void)
611 lowpan_frags
.constructor
= lowpan_frag_init
;
612 lowpan_frags
.destructor
= NULL
;
613 lowpan_frags
.qsize
= sizeof(struct frag_queue
);
614 lowpan_frags
.frag_expire
= lowpan_frag_expire
;
615 lowpan_frags
.frags_cache_name
= lowpan_frags_cache_name
;
616 lowpan_frags
.rhash_params
= lowpan_rhash_params
;
617 ret
= inet_frags_init(&lowpan_frags
);
621 ret
= lowpan_frags_sysctl_register();
625 ret
= register_pernet_subsys(&lowpan_frags_ops
);
631 lowpan_frags_sysctl_unregister();
633 inet_frags_fini(&lowpan_frags
);
637 void lowpan_net_frag_exit(void)
639 inet_frags_fini(&lowpan_frags
);
640 lowpan_frags_sysctl_unregister();
641 unregister_pernet_subsys(&lowpan_frags_ops
);