[net-next-2.6.git] / net / ipv4 / ip_fragment.c

/*
 * INET		An implementation of the TCP/IP protocol suite for the LINUX
 *		operating system.  INET is implemented using the  BSD Socket
 *		interface as the means of communication with the user level.
 *
 *		The IP fragmentation functionality.
 *		
 * Version:	$Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $
 *
 * Authors:	Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
 *		Alan Cox <Alan.Cox@linux.org>
 *
 * Fixes:
 *		Alan Cox	:	Split from ip.c , see ip_input.c for history.
 *		David S. Miller :	Begin massive cleanup...
 *		Andi Kleen	:	Add sysctls.
 *		xxxx		:	Overlapfrag bug.
 *		Ultima          :       ip_expire() kernel panic.
 *		Bill Hawes	:	Frag accounting and evictor fixes.
 *		John McDonald	:	0 length frag bug.
 *		Alexey Kuznetsov:	SMP races, threading, cleanup.
 *		Patrick McHardy :	LRU queue of frag heads for evictor.
 */

#include <linux/compiler.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/mm.h>
#include <linux/jiffies.h>
#include <linux/skbuff.h>
#include <linux/list.h>
#include <linux/ip.h>
#include <linux/icmp.h>
#include <linux/netdevice.h>
#include <linux/jhash.h>
#include <linux/random.h>
#include <net/sock.h>
#include <net/ip.h>
#include <net/icmp.h>
#include <net/checksum.h>
#include <net/inetpeer.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/inet.h>
#include <linux/netfilter_ipv4.h>

/* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
 * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
 * as well. Or notify me, at least. --ANK
 */

/* Fragment cache limits. We will commit 256K at one time. Should we
 * cross that limit we will prune down to 192K. This should cope with
 * even the most extreme cases without allowing an attacker to measurably
 * harm machine performance.
 */
int sysctl_ipfrag_high_thresh __read_mostly = 256*1024;
int sysctl_ipfrag_low_thresh __read_mostly = 192*1024;

int sysctl_ipfrag_max_dist __read_mostly = 64;

/* Important NOTE! Fragment queue must be destroyed before MSL expires.
 * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL.
 */
int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME;

struct ipfrag_skb_cb
{
	struct inet_skb_parm	h;
	int			offset;
};

#define FRAG_CB(skb)	((struct ipfrag_skb_cb*)((skb)->cb))

/* Describe an entry in the "incomplete datagrams" queue. */
struct ipq {
	struct hlist_node list;
	struct list_head lru_list;	/* lru list member 			*/
	u32		user;
	u32		saddr;
	u32		daddr;
	u16		id;
	u8		protocol;
	u8		last_in;
#define COMPLETE		4
#define FIRST_IN		2
#define LAST_IN			1

	struct sk_buff	*fragments;	/* linked list of received fragments	*/
	int		len;		/* total length of original datagram	*/
	int		meat;
	spinlock_t	lock;
	atomic_t	refcnt;
	struct timer_list timer;	/* when will this queue expire?		*/
	struct timeval	stamp;
	int             iif;
	unsigned int    rid;
	struct inet_peer *peer;
};

/* Hash table. */

#define IPQ_HASHSZ	64

/* Per-bucket lock is easy to add now. */
static struct hlist_head ipq_hash[IPQ_HASHSZ];
static DEFINE_RWLOCK(ipfrag_lock);
static u32 ipfrag_hash_rnd;
static LIST_HEAD(ipq_lru_list);
int ip_frag_nqueues = 0;

static __inline__ void __ipq_unlink(struct ipq *qp)
{
	hlist_del(&qp->list);
	list_del(&qp->lru_list);
	ip_frag_nqueues--;
}

static __inline__ void ipq_unlink(struct ipq *ipq)
{
	write_lock(&ipfrag_lock);
	__ipq_unlink(ipq);
	write_unlock(&ipfrag_lock);
}

static unsigned int ipqhashfn(u16 id, u32 saddr, u32 daddr, u8 prot)
{
	return jhash_3words((u32)id << 16 | prot, saddr, daddr,
			    ipfrag_hash_rnd) & (IPQ_HASHSZ - 1);
}

static struct timer_list ipfrag_secret_timer;
int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ;

static void ipfrag_secret_rebuild(unsigned long dummy)
{
	unsigned long now = jiffies;
	int i;

	write_lock(&ipfrag_lock);
	get_random_bytes(&ipfrag_hash_rnd, sizeof(u32));
	for (i = 0; i < IPQ_HASHSZ; i++) {
		struct ipq *q;
		struct hlist_node *p, *n;

		hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) {
			unsigned int hval = ipqhashfn(q->id, q->saddr,
						      q->daddr, q->protocol);

			if (hval != i) {
				hlist_del(&q->list);

				/* Relink to new hash chain. */
				hlist_add_head(&q->list, &ipq_hash[hval]);
			}
		}
	}
	write_unlock(&ipfrag_lock);

	mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval);
}

atomic_t ip_frag_mem = ATOMIC_INIT(0);	/* Memory used for fragments */

/* Memory Tracking Functions. */
static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work)
{
	if (work)
		*work -= skb->truesize;
	atomic_sub(skb->truesize, &ip_frag_mem);
	kfree_skb(skb);
}

static __inline__ void frag_free_queue(struct ipq *qp, int *work)
{
	if (work)
		*work -= sizeof(struct ipq);
	atomic_sub(sizeof(struct ipq), &ip_frag_mem);
	kfree(qp);
}

static __inline__ struct ipq *frag_alloc_queue(void)
{
	struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC);

	if(!qp)
		return NULL;
	atomic_add(sizeof(struct ipq), &ip_frag_mem);
	return qp;
}


/* Destruction primitives. */

/* Complete destruction of ipq. */
static void ip_frag_destroy(struct ipq *qp, int *work)
{
	struct sk_buff *fp;

	BUG_TRAP(qp->last_in&COMPLETE);
	BUG_TRAP(del_timer(&qp->timer) == 0);

	if (qp->peer)
		inet_putpeer(qp->peer);

	/* Release all fragment data. */
	fp = qp->fragments;
	while (fp) {
		struct sk_buff *xp = fp->next;

		frag_kfree_skb(fp, work);
		fp = xp;
	}

	/* Finally, release the queue descriptor itself. */
	frag_free_queue(qp, work);
}

static __inline__ void ipq_put(struct ipq *ipq, int *work)
{
	if (atomic_dec_and_test(&ipq->refcnt))
		ip_frag_destroy(ipq, work);
}

/* Kill ipq entry. It is not destroyed immediately,
 * because caller (and someone more) holds reference count.
 */
static void ipq_kill(struct ipq *ipq)
{
	if (del_timer(&ipq->timer))
		atomic_dec(&ipq->refcnt);

	if (!(ipq->last_in & COMPLETE)) {
		ipq_unlink(ipq);
		atomic_dec(&ipq->refcnt);
		ipq->last_in |= COMPLETE;
	}
}

/* Memory limiting on fragments.  Evictor trashes the oldest 
 * fragment queue until we are back under the threshold.
 */
static void ip_evictor(void)
{
	struct ipq *qp;
	struct list_head *tmp;
	int work;

	work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh;
	if (work <= 0)
		return;

	while (work > 0) {
		read_lock(&ipfrag_lock);
		if (list_empty(&ipq_lru_list)) {
			read_unlock(&ipfrag_lock);
			return;
		}
		tmp = ipq_lru_list.next;
		qp = list_entry(tmp, struct ipq, lru_list);
		atomic_inc(&qp->refcnt);
		read_unlock(&ipfrag_lock);

		spin_lock(&qp->lock);
		if (!(qp->last_in&COMPLETE))
			ipq_kill(qp);
		spin_unlock(&qp->lock);

		ipq_put(qp, &work);
		IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	}
}

/*
 * Oops, a fragment queue timed out.  Kill it and send an ICMP reply.
 */
static void ip_expire(unsigned long arg)
{
	struct ipq *qp = (struct ipq *) arg;

	spin_lock(&qp->lock);

	if (qp->last_in & COMPLETE)
		goto out;

	ipq_kill(qp);

	IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);

	if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) {
		struct sk_buff *head = qp->fragments;
		/* Send an ICMP "Fragment Reassembly Timeout" message. */
		if ((head->dev = dev_get_by_index(qp->iif)) != NULL) {
			icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
			dev_put(head->dev);
		}
	}
out:
	spin_unlock(&qp->lock);
	ipq_put(qp, NULL);
}

/* Creation primitives. */

static struct ipq *ip_frag_intern(struct ipq *qp_in)
{
	struct ipq *qp;
#ifdef CONFIG_SMP
	struct hlist_node *n;
#endif
	unsigned int hash;

	write_lock(&ipfrag_lock);
	hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr,
			 qp_in->protocol);
#ifdef CONFIG_SMP
	/* With SMP race we have to recheck hash table, because
	 * such entry could be created on other cpu, while we
	 * promoted read lock to write lock.
	 */
	hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
		if(qp->id == qp_in->id		&&
		   qp->saddr == qp_in->saddr	&&
		   qp->daddr == qp_in->daddr	&&
		   qp->protocol == qp_in->protocol &&
		   qp->user == qp_in->user) {
			atomic_inc(&qp->refcnt);
			write_unlock(&ipfrag_lock);
			qp_in->last_in |= COMPLETE;
			ipq_put(qp_in, NULL);
			return qp;
		}
	}
#endif
	qp = qp_in;

	if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time))
		atomic_inc(&qp->refcnt);

	atomic_inc(&qp->refcnt);
	hlist_add_head(&qp->list, &ipq_hash[hash]);
	INIT_LIST_HEAD(&qp->lru_list);
	list_add_tail(&qp->lru_list, &ipq_lru_list);
	ip_frag_nqueues++;
	write_unlock(&ipfrag_lock);
	return qp;
}

/* Add an entry to the 'ipq' queue for a newly received IP datagram. */
static struct ipq *ip_frag_create(struct iphdr *iph, u32 user)
{
	struct ipq *qp;

	if ((qp = frag_alloc_queue()) == NULL)
		goto out_nomem;

	qp->protocol = iph->protocol;
	qp->last_in = 0;
	qp->id = iph->id;
	qp->saddr = iph->saddr;
	qp->daddr = iph->daddr;
	qp->user = user;
	qp->len = 0;
	qp->meat = 0;
	qp->fragments = NULL;
	qp->iif = 0;
	qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL;

	/* Initialize a timer for this entry. */
	init_timer(&qp->timer);
	qp->timer.data = (unsigned long) qp;	/* pointer to queue	*/
	qp->timer.function = ip_expire;		/* expire function	*/
	spin_lock_init(&qp->lock);
	atomic_set(&qp->refcnt, 1);

	return ip_frag_intern(qp);

out_nomem:
	LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
	return NULL;
}

/* Find the correct entry in the "incomplete datagrams" queue for
 * this IP datagram, and create new one, if nothing is found.
 */
static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
{
	__be16 id = iph->id;
	__u32 saddr = iph->saddr;
	__u32 daddr = iph->daddr;
	__u8 protocol = iph->protocol;
	unsigned int hash;
	struct ipq *qp;
	struct hlist_node *n;

	read_lock(&ipfrag_lock);
	hash = ipqhashfn(id, saddr, daddr, protocol);
	hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
		if(qp->id == id		&&
		   qp->saddr == saddr	&&
		   qp->daddr == daddr	&&
		   qp->protocol == protocol &&
		   qp->user == user) {
			atomic_inc(&qp->refcnt);
			read_unlock(&ipfrag_lock);
			return qp;
		}
	}
	read_unlock(&ipfrag_lock);

	return ip_frag_create(iph, user);
}

/* Is the fragment too far ahead to be part of ipq? */
static inline int ip_frag_too_far(struct ipq *qp)
{
	struct inet_peer *peer = qp->peer;
	unsigned int max = sysctl_ipfrag_max_dist;
	unsigned int start, end;

	int rc;

	if (!peer || !max)
		return 0;

	start = qp->rid;
	end = atomic_inc_return(&peer->rid);
	qp->rid = end;

	rc = qp->fragments && (end - start) > max;

	if (rc) {
		IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	}

	return rc;
}

static int ip_frag_reinit(struct ipq *qp)
{
	struct sk_buff *fp;

	if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) {
		atomic_inc(&qp->refcnt);
		return -ETIMEDOUT;
	}

	fp = qp->fragments;
	do {
		struct sk_buff *xp = fp->next;
		frag_kfree_skb(fp, NULL);
		fp = xp;
	} while (fp);

	qp->last_in = 0;
	qp->len = 0;
	qp->meat = 0;
	qp->fragments = NULL;
	qp->iif = 0;

	return 0;
}

/* Add new segment to existing queue. */
static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
{
	struct sk_buff *prev, *next;
	int flags, offset;
	int ihl, end;

	if (qp->last_in & COMPLETE)
		goto err;

	if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
	    unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) {
		ipq_kill(qp);
		goto err;
	}

 	offset = ntohs(skb->nh.iph->frag_off);
	flags = offset & ~IP_OFFSET;
	offset &= IP_OFFSET;
	offset <<= 3;		/* offset is in 8-byte chunks */
 	ihl = skb->nh.iph->ihl * 4;

	/* Determine the position of this fragment. */
 	end = offset + skb->len - ihl;

	/* Is this the final fragment? */
	if ((flags & IP_MF) == 0) {
		/* If we already have some bits beyond end
		 * or have different end, the segment is corrrupted.
		 */
		if (end < qp->len ||
		    ((qp->last_in & LAST_IN) && end != qp->len))
			goto err;
		qp->last_in |= LAST_IN;
		qp->len = end;
	} else {
		if (end&7) {
			end &= ~7;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
		if (end > qp->len) {
			/* Some bits beyond end -> corruption. */
			if (qp->last_in & LAST_IN)
				goto err;
			qp->len = end;
		}
	}
	if (end == offset)
		goto err;

	if (pskb_pull(skb, ihl) == NULL)
		goto err;
	if (pskb_trim_rcsum(skb, end-offset))
		goto err;

	/* Find out which fragments are in front and at the back of us
	 * in the chain of fragments so far.  We must know where to put
	 * this fragment, right?
	 */
	prev = NULL;
	for(next = qp->fragments; next != NULL; next = next->next) {
		if (FRAG_CB(next)->offset >= offset)
			break;	/* bingo! */
		prev = next;
	}

	/* We found where to put this one.  Check for overlap with
	 * preceding fragment, and, if needed, align things so that
	 * any overlaps are eliminated.
	 */
	if (prev) {
		int i = (FRAG_CB(prev)->offset + prev->len) - offset;

		if (i > 0) {
			offset += i;
			if (end <= offset)
				goto err;
			if (!pskb_pull(skb, i))
				goto err;
			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
				skb->ip_summed = CHECKSUM_NONE;
		}
	}

	while (next && FRAG_CB(next)->offset < end) {
		int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */

		if (i < next->len) {
			/* Eat head of the next overlapped fragment
			 * and leave the loop. The next ones cannot overlap.
			 */
			if (!pskb_pull(next, i))
				goto err;
			FRAG_CB(next)->offset += i;
			qp->meat -= i;
			if (next->ip_summed != CHECKSUM_UNNECESSARY)
				next->ip_summed = CHECKSUM_NONE;
			break;
		} else {
			struct sk_buff *free_it = next;

			/* Old fragmnet is completely overridden with
			 * new one drop it.
			 */
			next = next->next;

			if (prev)
				prev->next = next;
			else
				qp->fragments = next;

			qp->meat -= free_it->len;
			frag_kfree_skb(free_it, NULL);
		}
	}

	FRAG_CB(skb)->offset = offset;

	/* Insert this fragment in the chain of fragments. */
	skb->next = next;
	if (prev)
		prev->next = skb;
	else
		qp->fragments = skb;

 	if (skb->dev)
 		qp->iif = skb->dev->ifindex;
	skb->dev = NULL;
	skb_get_timestamp(skb, &qp->stamp);
	qp->meat += skb->len;
	atomic_add(skb->truesize, &ip_frag_mem);
	if (offset == 0)
		qp->last_in |= FIRST_IN;

	write_lock(&ipfrag_lock);
	list_move_tail(&qp->lru_list, &ipq_lru_list);
	write_unlock(&ipfrag_lock);

	return;

err:
	kfree_skb(skb);
}


/* Build a new IP datagram from all its fragments. */

static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
{
	struct iphdr *iph;
	struct sk_buff *fp, *head = qp->fragments;
	int len;
	int ihlen;

	ipq_kill(qp);

	BUG_TRAP(head != NULL);
	BUG_TRAP(FRAG_CB(head)->offset == 0);

	/* Allocate a new buffer for the datagram. */
	ihlen = head->nh.iph->ihl*4;
	len = ihlen + qp->len;

	if(len > 65535)
		goto out_oversize;

	/* Head of list must not be cloned. */
	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
		goto out_nomem;

	/* If the first fragment is fragmented itself, we split
	 * it to two chunks: the first with data and paged part
	 * and the second, holding only fragments. */
	if (skb_shinfo(head)->frag_list) {
		struct sk_buff *clone;
		int i, plen = 0;

		if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
			goto out_nomem;
		clone->next = head->next;
		head->next = clone;
		skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
		skb_shinfo(head)->frag_list = NULL;
		for (i=0; i<skb_shinfo(head)->nr_frags; i++)
			plen += skb_shinfo(head)->frags[i].size;
		clone->len = clone->data_len = head->data_len - plen;
		head->data_len -= clone->len;
		head->len -= clone->len;
		clone->csum = 0;
		clone->ip_summed = head->ip_summed;
		atomic_add(clone->truesize, &ip_frag_mem);
	}

	skb_shinfo(head)->frag_list = head->next;
	skb_push(head, head->data - head->nh.raw);
	atomic_sub(head->truesize, &ip_frag_mem);

	for (fp=head->next; fp; fp = fp->next) {
		head->data_len += fp->len;
		head->len += fp->len;
		if (head->ip_summed != fp->ip_summed)
			head->ip_summed = CHECKSUM_NONE;
		else if (head->ip_summed == CHECKSUM_COMPLETE)
			head->csum = csum_add(head->csum, fp->csum);
		head->truesize += fp->truesize;
		atomic_sub(fp->truesize, &ip_frag_mem);
	}

	head->next = NULL;
	head->dev = dev;
	skb_set_timestamp(head, &qp->stamp);

	iph = head->nh.iph;
	iph->frag_off = 0;
	iph->tot_len = htons(len);
	IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
	qp->fragments = NULL;
	return head;

out_nomem:
 	LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
			      "queue %p\n", qp);
	goto out_fail;
out_oversize:
	if (net_ratelimit())
		printk(KERN_INFO
			"Oversized IP packet from %d.%d.%d.%d.\n",
			NIPQUAD(qp->saddr));
out_fail:
	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	return NULL;
}

/* Process an incoming IP datagram fragment. */
struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user)
{
	struct iphdr *iph = skb->nh.iph;
	struct ipq *qp;
	struct net_device *dev;
	
	IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);

	/* Start by cleaning up the memory. */
	if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
		ip_evictor();

	dev = skb->dev;

	/* Lookup (or create) queue header */
	if ((qp = ip_find(iph, user)) != NULL) {
		struct sk_buff *ret = NULL;

		spin_lock(&qp->lock);

		ip_frag_queue(qp, skb);

		if (qp->last_in == (FIRST_IN|LAST_IN) &&
		    qp->meat == qp->len)
			ret = ip_frag_reasm(qp, dev);

		spin_unlock(&qp->lock);
		ipq_put(qp, NULL);
		return ret;
	}

	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	kfree_skb(skb);
	return NULL;
}

void ipfrag_init(void)
{
	ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
				 (jiffies ^ (jiffies >> 6)));

	init_timer(&ipfrag_secret_timer);
	ipfrag_secret_timer.function = ipfrag_secret_rebuild;
	ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval;
	add_timer(&ipfrag_secret_timer);
}

EXPORT_SYMBOL(ip_defrag);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* INET An implementation of the TCP/IP protocol suite for the LINUX
	3	* operating system. INET is implemented using the BSD Socket
	4	* interface as the means of communication with the user level.
	5	*
	6	* The IP fragmentation functionality.
	7	*
	8	* Version: $Id: ip_fragment.c,v 1.59 2002/01/12 07:54:56 davem Exp $
	9	*
	10	* Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG>
	11	* Alan Cox <Alan.Cox@linux.org>
	12	*
	13	* Fixes:
	14	* Alan Cox : Split from ip.c , see ip_input.c for history.
	15	* David S. Miller : Begin massive cleanup...
	16	* Andi Kleen : Add sysctls.
	17	* xxxx : Overlapfrag bug.
	18	* Ultima : ip_expire() kernel panic.
	19	* Bill Hawes : Frag accounting and evictor fixes.
	20	* John McDonald : 0 length frag bug.
	21	* Alexey Kuznetsov: SMP races, threading, cleanup.
	22	* Patrick McHardy : LRU queue of frag heads for evictor.
	23	*/
	24
89cee8b1	25	#include <linux/compiler.h>
1da177e4 LT	26	#include <linux/module.h>
	27	#include <linux/types.h>
	28	#include <linux/mm.h>
	29	#include <linux/jiffies.h>
	30	#include <linux/skbuff.h>
	31	#include <linux/list.h>
	32	#include <linux/ip.h>
	33	#include <linux/icmp.h>
	34	#include <linux/netdevice.h>
	35	#include <linux/jhash.h>
	36	#include <linux/random.h>
	37	#include <net/sock.h>
	38	#include <net/ip.h>
	39	#include <net/icmp.h>
	40	#include <net/checksum.h>
89cee8b1	41	#include <net/inetpeer.h>
1da177e4 LT	42	#include <linux/tcp.h>
	43	#include <linux/udp.h>
	44	#include <linux/inet.h>
	45	#include <linux/netfilter_ipv4.h>
	46
	47	/* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
	48	* code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
	49	* as well. Or notify me, at least. --ANK
	50	*/
	51
	52	/* Fragment cache limits. We will commit 256K at one time. Should we
	53	* cross that limit we will prune down to 192K. This should cope with
	54	* even the most extreme cases without allowing an attacker to measurably
	55	* harm machine performance.
	56	*/
ab32ea5d BH	57	int sysctl_ipfrag_high_thresh __read_mostly = 256*1024;
ab32ea5d BH	58	int sysctl_ipfrag_low_thresh __read_mostly = 192*1024;
1da177e4	59
ab32ea5d	60	int sysctl_ipfrag_max_dist __read_mostly = 64;
89cee8b1	61
1da177e4 LT	62	/* Important NOTE! Fragment queue must be destroyed before MSL expires.
	63	* RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL.
	64	*/
ab32ea5d	65	int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME;
1da177e4 LT	66
	67	struct ipfrag_skb_cb
	68	{
	69	struct inet_skb_parm h;
	70	int offset;
	71	};
	72
	73	#define FRAG_CB(skb) ((struct ipfrag_skb_cb*)((skb)->cb))
	74
	75	/* Describe an entry in the "incomplete datagrams" queue. */
	76	struct ipq {
e7c8a41e	77	struct hlist_node list;
1da177e4 LT	78	struct list_head lru_list; /* lru list member */
	79	u32 user;
	80	u32 saddr;
	81	u32 daddr;
	82	u16 id;
	83	u8 protocol;
	84	u8 last_in;
	85	#define COMPLETE 4
	86	#define FIRST_IN 2
	87	#define LAST_IN 1
	88
	89	struct sk_buff fragments; / linked list of received fragments */
	90	int len; /* total length of original datagram */
	91	int meat;
	92	spinlock_t lock;
	93	atomic_t refcnt;
	94	struct timer_list timer; /* when will this queue expire? */
1da177e4	95	struct timeval stamp;
89cee8b1 HX	96	int iif;
	97	unsigned int rid;
	98	struct inet_peer *peer;
1da177e4 LT	99	};
	100
	101	/* Hash table. */
	102
	103	#define IPQ_HASHSZ 64
	104
	105	/* Per-bucket lock is easy to add now. */
e7c8a41e	106	static struct hlist_head ipq_hash[IPQ_HASHSZ];
1da177e4 LT	107	static DEFINE_RWLOCK(ipfrag_lock);
	108	static u32 ipfrag_hash_rnd;
	109	static LIST_HEAD(ipq_lru_list);
	110	int ip_frag_nqueues = 0;
	111
	112	static __inline__ void __ipq_unlink(struct ipq *qp)
	113	{
e7c8a41e	114	hlist_del(&qp->list);
1da177e4 LT	115	list_del(&qp->lru_list);
	116	ip_frag_nqueues--;
	117	}
	118
	119	static __inline__ void ipq_unlink(struct ipq *ipq)
	120	{
	121	write_lock(&ipfrag_lock);
	122	__ipq_unlink(ipq);
	123	write_unlock(&ipfrag_lock);
	124	}
	125
	126	static unsigned int ipqhashfn(u16 id, u32 saddr, u32 daddr, u8 prot)
	127	{
	128	return jhash_3words((u32)id << 16 \| prot, saddr, daddr,
	129	ipfrag_hash_rnd) & (IPQ_HASHSZ - 1);
	130	}
	131
	132	static struct timer_list ipfrag_secret_timer;
ab32ea5d	133	int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ;
1da177e4 LT	134
	135	static void ipfrag_secret_rebuild(unsigned long dummy)
	136	{
	137	unsigned long now = jiffies;
	138	int i;
	139
	140	write_lock(&ipfrag_lock);
	141	get_random_bytes(&ipfrag_hash_rnd, sizeof(u32));
	142	for (i = 0; i < IPQ_HASHSZ; i++) {
	143	struct ipq *q;
e7c8a41e	144	struct hlist_node p, n;
1da177e4	145
e7c8a41e	146	hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) {
1da177e4 LT	147	unsigned int hval = ipqhashfn(q->id, q->saddr,
	148	q->daddr, q->protocol);
	149
	150	if (hval != i) {
e7c8a41e	151	hlist_del(&q->list);
1da177e4 LT	152
1da177e4 LT	153	/* Relink to new hash chain. */
e7c8a41e	154	hlist_add_head(&q->list, &ipq_hash[hval]);
1da177e4	155	}
1da177e4 LT	156	}
	157	}
	158	write_unlock(&ipfrag_lock);
	159
	160	mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval);
	161	}
	162
	163	atomic_t ip_frag_mem = ATOMIC_INIT(0); /* Memory used for fragments */
	164
	165	/* Memory Tracking Functions. */
	166	static __inline__ void frag_kfree_skb(struct sk_buff skb, int work)
	167	{
	168	if (work)
	169	*work -= skb->truesize;
	170	atomic_sub(skb->truesize, &ip_frag_mem);
	171	kfree_skb(skb);
	172	}
	173
	174	static __inline__ void frag_free_queue(struct ipq qp, int work)
	175	{
	176	if (work)
	177	*work -= sizeof(struct ipq);
	178	atomic_sub(sizeof(struct ipq), &ip_frag_mem);
	179	kfree(qp);
	180	}
	181
	182	static __inline__ struct ipq *frag_alloc_queue(void)
	183	{
	184	struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC);
	185
	186	if(!qp)
	187	return NULL;
	188	atomic_add(sizeof(struct ipq), &ip_frag_mem);
	189	return qp;
	190	}
	191
	192
	193	/* Destruction primitives. */
	194
	195	/* Complete destruction of ipq. */
	196	static void ip_frag_destroy(struct ipq qp, int work)
	197	{
	198	struct sk_buff *fp;
	199
	200	BUG_TRAP(qp->last_in&COMPLETE);
	201	BUG_TRAP(del_timer(&qp->timer) == 0);
	202
89cee8b1 HX	203	if (qp->peer)
	204	inet_putpeer(qp->peer);
	205
1da177e4 LT	206	/* Release all fragment data. */
	207	fp = qp->fragments;
	208	while (fp) {
	209	struct sk_buff *xp = fp->next;
	210
	211	frag_kfree_skb(fp, work);
	212	fp = xp;
	213	}
	214
	215	/* Finally, release the queue descriptor itself. */
	216	frag_free_queue(qp, work);
	217	}
	218
	219	static __inline__ void ipq_put(struct ipq ipq, int work)
	220	{
	221	if (atomic_dec_and_test(&ipq->refcnt))
	222	ip_frag_destroy(ipq, work);
	223	}
	224
	225	/* Kill ipq entry. It is not destroyed immediately,
	226	* because caller (and someone more) holds reference count.
	227	*/
	228	static void ipq_kill(struct ipq *ipq)
	229	{
	230	if (del_timer(&ipq->timer))
	231	atomic_dec(&ipq->refcnt);
	232
	233	if (!(ipq->last_in & COMPLETE)) {
	234	ipq_unlink(ipq);
	235	atomic_dec(&ipq->refcnt);
	236	ipq->last_in \|= COMPLETE;
	237	}
	238	}
	239
	240	/* Memory limiting on fragments. Evictor trashes the oldest
	241	* fragment queue until we are back under the threshold.
	242	*/
	243	static void ip_evictor(void)
	244	{
	245	struct ipq *qp;
	246	struct list_head *tmp;
	247	int work;
	248
	249	work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh;
	250	if (work <= 0)
	251	return;
	252
	253	while (work > 0) {
	254	read_lock(&ipfrag_lock);
	255	if (list_empty(&ipq_lru_list)) {
	256	read_unlock(&ipfrag_lock);
	257	return;
	258	}
	259	tmp = ipq_lru_list.next;
	260	qp = list_entry(tmp, struct ipq, lru_list);
	261	atomic_inc(&qp->refcnt);
	262	read_unlock(&ipfrag_lock);
	263
	264	spin_lock(&qp->lock);
	265	if (!(qp->last_in&COMPLETE))
	266	ipq_kill(qp);
	267	spin_unlock(&qp->lock);
	268
	269	ipq_put(qp, &work);
270	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
271	}
272	}
273
274	/*
275	* Oops, a fragment queue timed out. Kill it and send an ICMP reply.
276	*/
277	static void ip_expire(unsigned long arg)
278	{
279	struct ipq qp = (struct ipq ) arg;
280
281	spin_lock(&qp->lock);
282
283	if (qp->last_in & COMPLETE)
284	goto out;
285
286	ipq_kill(qp);
287
288	IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
289	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
290
291	if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) {
292	struct sk_buff *head = qp->fragments;
293	/* Send an ICMP "Fragment Reassembly Timeout" message. */
294	if ((head->dev = dev_get_by_index(qp->iif)) != NULL) {
295	icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
296	dev_put(head->dev);
297	}
298	}
299	out:
300	spin_unlock(&qp->lock);
301	ipq_put(qp, NULL);
302	}
303
304	/* Creation primitives. */
305
55c0022e	306	static struct ipq ip_frag_intern(struct ipq qp_in)
1da177e4 LT	307	{
1da177e4 LT	308	struct ipq *qp;
e7c8a41e YK	309	#ifdef CONFIG_SMP
	310	struct hlist_node *n;
	311	#endif
55c0022e DM	312	unsigned int hash;
55c0022e DM	313
1da177e4	314	write_lock(&ipfrag_lock);
55c0022e DM	315	hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr,
55c0022e DM	316	qp_in->protocol);
1da177e4 LT	317	#ifdef CONFIG_SMP
	318	/* With SMP race we have to recheck hash table, because
	319	* such entry could be created on other cpu, while we
	320	* promoted read lock to write lock.
	321	*/
e7c8a41e	322	hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
1da177e4 LT	323	if(qp->id == qp_in->id &&
	324	qp->saddr == qp_in->saddr &&
	325	qp->daddr == qp_in->daddr &&
	326	qp->protocol == qp_in->protocol &&
	327	qp->user == qp_in->user) {
	328	atomic_inc(&qp->refcnt);
	329	write_unlock(&ipfrag_lock);
	330	qp_in->last_in \|= COMPLETE;
	331	ipq_put(qp_in, NULL);
	332	return qp;
	333	}
	334	}
	335	#endif
	336	qp = qp_in;
	337
	338	if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time))
	339	atomic_inc(&qp->refcnt);
	340
	341	atomic_inc(&qp->refcnt);
e7c8a41e	342	hlist_add_head(&qp->list, &ipq_hash[hash]);
1da177e4 LT	343	INIT_LIST_HEAD(&qp->lru_list);
	344	list_add_tail(&qp->lru_list, &ipq_lru_list);
	345	ip_frag_nqueues++;
	346	write_unlock(&ipfrag_lock);
	347	return qp;
	348	}
	349
	350	/* Add an entry to the 'ipq' queue for a newly received IP datagram. */
55c0022e	351	static struct ipq ip_frag_create(struct iphdr iph, u32 user)
1da177e4 LT	352	{
	353	struct ipq *qp;
	354
	355	if ((qp = frag_alloc_queue()) == NULL)
	356	goto out_nomem;
	357
	358	qp->protocol = iph->protocol;
	359	qp->last_in = 0;
	360	qp->id = iph->id;
	361	qp->saddr = iph->saddr;
	362	qp->daddr = iph->daddr;
	363	qp->user = user;
	364	qp->len = 0;
	365	qp->meat = 0;
	366	qp->fragments = NULL;
	367	qp->iif = 0;
89cee8b1	368	qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL;
1da177e4 LT	369
	370	/* Initialize a timer for this entry. */
	371	init_timer(&qp->timer);
	372	qp->timer.data = (unsigned long) qp; /* pointer to queue */
	373	qp->timer.function = ip_expire; /* expire function */
	374	spin_lock_init(&qp->lock);
	375	atomic_set(&qp->refcnt, 1);
	376
55c0022e	377	return ip_frag_intern(qp);
1da177e4 LT	378
1da177e4 LT	379	out_nomem:
64ce2073	380	LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
1da177e4 LT	381	return NULL;
	382	}
	383
	384	/* Find the correct entry in the "incomplete datagrams" queue for
	385	* this IP datagram, and create new one, if nothing is found.
	386	*/
	387	static inline struct ipq ip_find(struct iphdr iph, u32 user)
	388	{
76ab608d	389	__be16 id = iph->id;
1da177e4 LT	390	__u32 saddr = iph->saddr;
	391	__u32 daddr = iph->daddr;
	392	__u8 protocol = iph->protocol;
55c0022e	393	unsigned int hash;
1da177e4	394	struct ipq *qp;
e7c8a41e	395	struct hlist_node *n;
1da177e4 LT	396
1da177e4 LT	397	read_lock(&ipfrag_lock);
55c0022e	398	hash = ipqhashfn(id, saddr, daddr, protocol);
e7c8a41e	399	hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
1da177e4 LT	400	if(qp->id == id &&
	401	qp->saddr == saddr &&
	402	qp->daddr == daddr &&
	403	qp->protocol == protocol &&
	404	qp->user == user) {
	405	atomic_inc(&qp->refcnt);
	406	read_unlock(&ipfrag_lock);
	407	return qp;
	408	}
	409	}
	410	read_unlock(&ipfrag_lock);
	411
55c0022e	412	return ip_frag_create(iph, user);
1da177e4 LT	413	}
1da177e4 LT	414
89cee8b1 HX	415	/* Is the fragment too far ahead to be part of ipq? */
	416	static inline int ip_frag_too_far(struct ipq *qp)
	417	{
	418	struct inet_peer *peer = qp->peer;
	419	unsigned int max = sysctl_ipfrag_max_dist;
	420	unsigned int start, end;
	421
	422	int rc;
	423
	424	if (!peer \|\| !max)
	425	return 0;
	426
	427	start = qp->rid;
	428	end = atomic_inc_return(&peer->rid);
	429	qp->rid = end;
	430
	431	rc = qp->fragments && (end - start) > max;
	432
	433	if (rc) {
	434	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	435	}
	436
	437	return rc;
	438	}
	439
	440	static int ip_frag_reinit(struct ipq *qp)
	441	{
	442	struct sk_buff *fp;
	443
	444	if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) {
	445	atomic_inc(&qp->refcnt);
	446	return -ETIMEDOUT;
	447	}
	448
	449	fp = qp->fragments;
	450	do {
	451	struct sk_buff *xp = fp->next;
	452	frag_kfree_skb(fp, NULL);
	453	fp = xp;
	454	} while (fp);
	455
	456	qp->last_in = 0;
	457	qp->len = 0;
	458	qp->meat = 0;
	459	qp->fragments = NULL;
	460	qp->iif = 0;
	461
	462	return 0;
	463	}
	464
1da177e4 LT	465	/* Add new segment to existing queue. */
	466	static void ip_frag_queue(struct ipq qp, struct sk_buff skb)
	467	{
	468	struct sk_buff prev, next;
	469	int flags, offset;
	470	int ihl, end;
	471
	472	if (qp->last_in & COMPLETE)
	473	goto err;
	474
89cee8b1 HX	475	if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
	476	unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) {
	477	ipq_kill(qp);
	478	goto err;
	479	}
	480
1da177e4 LT	481	offset = ntohs(skb->nh.iph->frag_off);
	482	flags = offset & ~IP_OFFSET;
	483	offset &= IP_OFFSET;
	484	offset <<= 3; /* offset is in 8-byte chunks */
	485	ihl = skb->nh.iph->ihl * 4;
	486
	487	/* Determine the position of this fragment. */
	488	end = offset + skb->len - ihl;
	489
	490	/* Is this the final fragment? */
	491	if ((flags & IP_MF) == 0) {
	492	/* If we already have some bits beyond end
	493	* or have different end, the segment is corrrupted.
	494	*/
	495	if (end < qp->len \|\|
	496	((qp->last_in & LAST_IN) && end != qp->len))
	497	goto err;
	498	qp->last_in \|= LAST_IN;
	499	qp->len = end;
	500	} else {
	501	if (end&7) {
	502	end &= ~7;
	503	if (skb->ip_summed != CHECKSUM_UNNECESSARY)
	504	skb->ip_summed = CHECKSUM_NONE;
	505	}
	506	if (end > qp->len) {
	507	/* Some bits beyond end -> corruption. */
	508	if (qp->last_in & LAST_IN)
	509	goto err;
	510	qp->len = end;
	511	}
	512	}
	513	if (end == offset)
	514	goto err;
	515
	516	if (pskb_pull(skb, ihl) == NULL)
	517	goto err;
48bc41a4	518	if (pskb_trim_rcsum(skb, end-offset))
1da177e4 LT	519	goto err;
	520
	521	/* Find out which fragments are in front and at the back of us
	522	* in the chain of fragments so far. We must know where to put
	523	* this fragment, right?
	524	*/
	525	prev = NULL;
	526	for(next = qp->fragments; next != NULL; next = next->next) {
	527	if (FRAG_CB(next)->offset >= offset)
	528	break; /* bingo! */
	529	prev = next;
	530	}
	531
	532	/* We found where to put this one. Check for overlap with
	533	* preceding fragment, and, if needed, align things so that
	534	* any overlaps are eliminated.
	535	*/
	536	if (prev) {
	537	int i = (FRAG_CB(prev)->offset + prev->len) - offset;
	538
	539	if (i > 0) {
	540	offset += i;
	541	if (end <= offset)
	542	goto err;
	543	if (!pskb_pull(skb, i))
	544	goto err;
	545	if (skb->ip_summed != CHECKSUM_UNNECESSARY)
	546	skb->ip_summed = CHECKSUM_NONE;
	547	}
	548	}
	549
	550	while (next && FRAG_CB(next)->offset < end) {
	551	int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */
	552
	553	if (i < next->len) {
	554	/* Eat head of the next overlapped fragment
	555	* and leave the loop. The next ones cannot overlap.
	556	*/
	557	if (!pskb_pull(next, i))
	558	goto err;
	559	FRAG_CB(next)->offset += i;
	560	qp->meat -= i;
	561	if (next->ip_summed != CHECKSUM_UNNECESSARY)
	562	next->ip_summed = CHECKSUM_NONE;
	563	break;
	564	} else {
	565	struct sk_buff *free_it = next;
	566
	567	/* Old fragmnet is completely overridden with
	568	* new one drop it.
	569	*/
	570	next = next->next;
	571
	572	if (prev)
	573	prev->next = next;
	574	else
	575	qp->fragments = next;
	576
	577	qp->meat -= free_it->len;
	578	frag_kfree_skb(free_it, NULL);
	579	}
	580	}
	581
	582	FRAG_CB(skb)->offset = offset;
583
584	/* Insert this fragment in the chain of fragments. */
585	skb->next = next;
586	if (prev)
587	prev->next = skb;
588	else
589	qp->fragments = skb;
590
591	if (skb->dev)
592	qp->iif = skb->dev->ifindex;
593	skb->dev = NULL;
a61bbcf2	594	skb_get_timestamp(skb, &qp->stamp);
1da177e4 LT	595	qp->meat += skb->len;
	596	atomic_add(skb->truesize, &ip_frag_mem);
	597	if (offset == 0)
	598	qp->last_in \|= FIRST_IN;
	599
	600	write_lock(&ipfrag_lock);
	601	list_move_tail(&qp->lru_list, &ipq_lru_list);
	602	write_unlock(&ipfrag_lock);
	603
	604	return;
	605
	606	err:
	607	kfree_skb(skb);
	608	}
	609
	610
	611	/* Build a new IP datagram from all its fragments. */
	612
	613	static struct sk_buff ip_frag_reasm(struct ipq qp, struct net_device *dev)
	614	{
	615	struct iphdr *iph;
	616	struct sk_buff fp, head = qp->fragments;
	617	int len;
	618	int ihlen;
	619
	620	ipq_kill(qp);
	621
	622	BUG_TRAP(head != NULL);
	623	BUG_TRAP(FRAG_CB(head)->offset == 0);
	624
	625	/* Allocate a new buffer for the datagram. */
	626	ihlen = head->nh.iph->ihl*4;
	627	len = ihlen + qp->len;
	628
	629	if(len > 65535)
	630	goto out_oversize;
	631
	632	/* Head of list must not be cloned. */
	633	if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
	634	goto out_nomem;
	635
	636	/* If the first fragment is fragmented itself, we split
	637	* it to two chunks: the first with data and paged part
	638	* and the second, holding only fragments. */
	639	if (skb_shinfo(head)->frag_list) {
	640	struct sk_buff *clone;
	641	int i, plen = 0;
	642
	643	if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
	644	goto out_nomem;
	645	clone->next = head->next;
	646	head->next = clone;
	647	skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
	648	skb_shinfo(head)->frag_list = NULL;
	649	for (i=0; i<skb_shinfo(head)->nr_frags; i++)
	650	plen += skb_shinfo(head)->frags[i].size;
	651	clone->len = clone->data_len = head->data_len - plen;
	652	head->data_len -= clone->len;
	653	head->len -= clone->len;
	654	clone->csum = 0;
	655	clone->ip_summed = head->ip_summed;
	656	atomic_add(clone->truesize, &ip_frag_mem);
	657	}
	658
659	skb_shinfo(head)->frag_list = head->next;
660	skb_push(head, head->data - head->nh.raw);
661	atomic_sub(head->truesize, &ip_frag_mem);
662
663	for (fp=head->next; fp; fp = fp->next) {
664	head->data_len += fp->len;
665	head->len += fp->len;
666	if (head->ip_summed != fp->ip_summed)
667	head->ip_summed = CHECKSUM_NONE;
84fa7933	668	else if (head->ip_summed == CHECKSUM_COMPLETE)
1da177e4 LT	669	head->csum = csum_add(head->csum, fp->csum);
	670	head->truesize += fp->truesize;
	671	atomic_sub(fp->truesize, &ip_frag_mem);
	672	}
	673
	674	head->next = NULL;
	675	head->dev = dev;
a61bbcf2	676	skb_set_timestamp(head, &qp->stamp);
1da177e4 LT	677
	678	iph = head->nh.iph;
	679	iph->frag_off = 0;
	680	iph->tot_len = htons(len);
	681	IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
	682	qp->fragments = NULL;
	683	return head;
	684
	685	out_nomem:
64ce2073 PM	686	LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
64ce2073 PM	687	"queue %p\n", qp);
1da177e4 LT	688	goto out_fail;
	689	out_oversize:
	690	if (net_ratelimit())
	691	printk(KERN_INFO
	692	"Oversized IP packet from %d.%d.%d.%d.\n",
	693	NIPQUAD(qp->saddr));
	694	out_fail:
	695	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	696	return NULL;
	697	}
	698
	699	/* Process an incoming IP datagram fragment. */
	700	struct sk_buff ip_defrag(struct sk_buff skb, u32 user)
	701	{
	702	struct iphdr *iph = skb->nh.iph;
	703	struct ipq *qp;
	704	struct net_device *dev;
	705
	706	IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
	707
	708	/* Start by cleaning up the memory. */
	709	if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
	710	ip_evictor();
	711
	712	dev = skb->dev;
	713
	714	/* Lookup (or create) queue header */
	715	if ((qp = ip_find(iph, user)) != NULL) {
	716	struct sk_buff *ret = NULL;
	717
	718	spin_lock(&qp->lock);
	719
	720	ip_frag_queue(qp, skb);
	721
	722	if (qp->last_in == (FIRST_IN\|LAST_IN) &&
	723	qp->meat == qp->len)
	724	ret = ip_frag_reasm(qp, dev);
	725
	726	spin_unlock(&qp->lock);
	727	ipq_put(qp, NULL);
	728	return ret;
	729	}
	730
	731	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
	732	kfree_skb(skb);
	733	return NULL;
	734	}
	735
	736	void ipfrag_init(void)
	737	{
	738	ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
	739	(jiffies ^ (jiffies >> 6)));
	740
	741	init_timer(&ipfrag_secret_timer);
	742	ipfrag_secret_timer.function = ipfrag_secret_rebuild;
	743	ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval;
	744	add_timer(&ipfrag_secret_timer);
	745	}
	746
	747	EXPORT_SYMBOL(ip_defrag);