xref: /netbsd-src/sys/netinet/ip_reass.c (revision 181254a7b1bdde6873432bffef2d2decc4b5c22f) 
1 /*	$NetBSD: ip_reass.c,v 1.21 2018/10/12 05:41:18 maxv Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
32  */
33 
34 /*
35  * IP reassembly.
36  *
37  * Additive-Increase/Multiplicative-Decrease (AIMD) strategy for IP
38  * reassembly queue buffer managment.
39  *
40  * We keep a count of total IP fragments (NB: not fragmented packets),
41  * awaiting reassembly (ip_nfrags) and a limit (ip_maxfrags) on fragments.
42  * If ip_nfrags exceeds ip_maxfrags the limit, we drop half the total
43  * fragments in reassembly queues.  This AIMD policy avoids repeatedly
44  * deleting single packets under heavy fragmentation load (e.g., from lossy
45  * NFS peers).
46  */
47 
48 #include <sys/cdefs.h>
49 __KERNEL_RCSID(0, "$NetBSD: ip_reass.c,v 1.21 2018/10/12 05:41:18 maxv Exp $");
50 
51 #include <sys/param.h>
52 #include <sys/types.h>
53 
54 #include <sys/malloc.h>
55 #include <sys/mbuf.h>
56 #include <sys/mutex.h>
57 #include <sys/pool.h>
58 #include <sys/queue.h>
59 #include <sys/sysctl.h>
60 #include <sys/systm.h>
61 
62 #include <net/if.h>
63 
64 #include <netinet/in.h>
65 #include <netinet/in_systm.h>
66 #include <netinet/ip.h>
67 #include <netinet/in_pcb.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/ip_private.h>
70 #include <netinet/in_var.h>
71 
72 /*
73  * IP reassembly queue structures.  Each fragment being reassembled is
74  * attached to one of these structures.  They are timed out after TTL
75  * drops to 0, and may also be reclaimed if memory becomes tight.
76  */
77 
78 typedef struct ipfr_qent {
79 	TAILQ_ENTRY(ipfr_qent)	ipqe_q;
80 	struct ip *		ipqe_ip;
81 	struct mbuf *		ipqe_m;
82 	bool			ipqe_mff;
83 	uint16_t		ipqe_off;
84 	uint16_t		ipqe_len;
85 } ipfr_qent_t;
86 
87 TAILQ_HEAD(ipfr_qent_head, ipfr_qent);
88 
89 typedef struct ipfr_queue {
90 	LIST_ENTRY(ipfr_queue)	ipq_q;		/* to other reass headers */
91 	struct ipfr_qent_head	ipq_fragq;	/* queue of fragment entries */
92 	uint8_t			ipq_ttl;	/* time for reass q to live */
93 	uint8_t			ipq_p;		/* protocol of this fragment */
94 	uint16_t		ipq_id;		/* sequence id for reassembly */
95 	struct in_addr		ipq_src;
96 	struct in_addr		ipq_dst;
97 	uint16_t		ipq_nfrags;	/* frags in this queue entry */
98 	uint8_t			ipq_tos;	/* TOS of this fragment */
99 	int			ipq_ipsec;	/* IPsec flags */
100 } ipfr_queue_t;
101 
102 /*
103  * Hash table of IP reassembly queues.
104  */
105 #define	IPREASS_HASH_SHIFT	6
106 #define	IPREASS_HASH_SIZE	(1 << IPREASS_HASH_SHIFT)
107 #define	IPREASS_HASH_MASK	(IPREASS_HASH_SIZE - 1)
108 #define	IPREASS_HASH(x, y) \
109 	(((((x) & 0xf) | ((((x) >> 8) & 0xf) << 4)) ^ (y)) & IPREASS_HASH_MASK)
110 
111 static LIST_HEAD(, ipfr_queue)	ip_frags[IPREASS_HASH_SIZE];
112 static pool_cache_t	ipfren_cache;
113 static kmutex_t		ipfr_lock;
114 
115 /* Number of packets in reassembly queue and total number of fragments. */
116 static int		ip_nfragpackets;
117 static int		ip_nfrags;
118 
119 /* Limits on packet and fragments. */
120 static int		ip_maxfragpackets;
121 static int		ip_maxfrags;
122 
123 /*
124  * Cached copy of nmbclusters.  If nbclusters is different, recalculate
125  * IP parameters derived from nmbclusters.
126  */
127 static int		ip_nmbclusters;
128 
129 /*
130  * IP reassembly TTL machinery for multiplicative drop.
131  */
132 static u_int		fragttl_histo[IPFRAGTTL + 1];
133 
134 static struct sysctllog *ip_reass_sysctllog;
135 
136 void			sysctl_ip_reass_setup(void);
137 static void		ip_nmbclusters_changed(void);
138 
139 static struct mbuf *	ip_reass(ipfr_qent_t *, ipfr_queue_t *, u_int);
140 static u_int		ip_reass_ttl_decr(u_int ticks);
141 static void		ip_reass_drophalf(void);
142 static void		ip_freef(ipfr_queue_t *);
143 
144 /*
145  * ip_reass_init:
146  *
147  *	Initialization of IP reassembly mechanism.
148  */
149 void
150 ip_reass_init(void)
151 {
152 	int i;
153 
154 	ipfren_cache = pool_cache_init(sizeof(ipfr_qent_t), coherency_unit,
155 	    0, 0, "ipfrenpl", NULL, IPL_NET, NULL, NULL, NULL);
156 	mutex_init(&ipfr_lock, MUTEX_DEFAULT, IPL_VM);
157 
158 	for (i = 0; i < IPREASS_HASH_SIZE; i++) {
159 		LIST_INIT(&ip_frags[i]);
160 	}
161 	ip_maxfragpackets = 200;
162 	ip_maxfrags = 0;
163 	ip_nmbclusters_changed();
164 
165 	sysctl_ip_reass_setup();
166 }
167 
168 void
169 sysctl_ip_reass_setup(void)
170 {
171 
172 	sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL,
173 		CTLFLAG_PERMANENT,
174 		CTLTYPE_NODE, "inet",
175 		SYSCTL_DESCR("PF_INET related settings"),
176 		NULL, 0, NULL, 0,
177 		CTL_NET, PF_INET, CTL_EOL);
178 	sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL,
179 		CTLFLAG_PERMANENT,
180 		CTLTYPE_NODE, "ip",
181 		SYSCTL_DESCR("IPv4 related settings"),
182 		NULL, 0, NULL, 0,
183 		CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL);
184 
185 	sysctl_createv(&ip_reass_sysctllog, 0, NULL, NULL,
186 		CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
187 		CTLTYPE_INT, "maxfragpackets",
188 		SYSCTL_DESCR("Maximum number of fragments to retain for "
189 			     "possible reassembly"),
190 		NULL, 0, &ip_maxfragpackets, 0,
191 		CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MAXFRAGPACKETS, CTL_EOL);
192 }
193 
194 #define CHECK_NMBCLUSTER_PARAMS()				\
195 do {								\
196 	if (__predict_false(ip_nmbclusters != nmbclusters))	\
197 		ip_nmbclusters_changed();			\
198 } while (/*CONSTCOND*/0)
199 
200 /*
201  * Compute IP limits derived from the value of nmbclusters.
202  */
203 static void
204 ip_nmbclusters_changed(void)
205 {
206 	ip_maxfrags = nmbclusters / 4;
207 	ip_nmbclusters = nmbclusters;
208 }
209 
210 /*
211  * ip_reass:
212  *
213  *	Take incoming datagram fragment and try to reassemble it into whole
214  *	datagram.  If a chain for reassembly of this datagram already exists,
215  *	then it is given as 'fp'; otherwise have to make a chain.
216  */
217 static struct mbuf *
218 ip_reass(ipfr_qent_t *ipqe, ipfr_queue_t *fp, const u_int hash)
219 {
220 	struct ip *ip = ipqe->ipqe_ip;
221 	const int hlen = ip->ip_hl << 2;
222 	struct mbuf *m = ipqe->ipqe_m, *t;
223 	int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR);
224 	ipfr_qent_t *nq, *p, *q;
225 	int i, next;
226 
227 	KASSERT(mutex_owned(&ipfr_lock));
228 
229 	/*
230 	 * Presence of header sizes in mbufs would confuse code below.
231 	 */
232 	m->m_data += hlen;
233 	m->m_len -= hlen;
234 
235 	/*
236 	 * We are about to add a fragment; increment frag count.
237 	 */
238 	ip_nfrags++;
239 
240 	/*
241 	 * If first fragment to arrive, create a reassembly queue.
242 	 */
243 	if (fp == NULL) {
244 		/*
245 		 * Enforce upper bound on number of fragmented packets
246 		 * for which we attempt reassembly:  a) if maxfrag is 0,
247 		 * never accept fragments  b) if maxfrag is -1, accept
248 		 * all fragments without limitation.
249 		 */
250 		if (ip_maxfragpackets < 0) {
251 			/* no limit */
252 		} else if (ip_nfragpackets >= ip_maxfragpackets) {
253 			goto dropfrag;
254 		}
255 		fp = malloc(sizeof(ipfr_queue_t), M_FTABLE, M_NOWAIT);
256 		if (fp == NULL) {
257 			goto dropfrag;
258 		}
259 		ip_nfragpackets++;
260 		TAILQ_INIT(&fp->ipq_fragq);
261 		fp->ipq_nfrags = 1;
262 		fp->ipq_ttl = IPFRAGTTL;
263 		fp->ipq_p = ip->ip_p;
264 		fp->ipq_id = ip->ip_id;
265 		fp->ipq_tos = ip->ip_tos;
266 		fp->ipq_ipsec = ipsecflags;
267 		fp->ipq_src = ip->ip_src;
268 		fp->ipq_dst = ip->ip_dst;
269 		LIST_INSERT_HEAD(&ip_frags[hash], fp, ipq_q);
270 		p = NULL;
271 		goto insert;
272 	} else {
273 		fp->ipq_nfrags++;
274 	}
275 
276 	/*
277 	 * Find a segment which begins after this one does.
278 	 */
279 	TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) {
280 		if (q->ipqe_off > ipqe->ipqe_off)
281 			break;
282 	}
283 	if (q != NULL) {
284 		p = TAILQ_PREV(q, ipfr_qent_head, ipqe_q);
285 	} else {
286 		p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head);
287 	}
288 
289 	/*
290 	 * Look at the preceding segment.
291 	 *
292 	 * If it provides some of our data already, in part or entirely, trim
293 	 * us or drop us.
294 	 *
295 	 * If a preceding segment exists, and was marked as the last segment,
296 	 * drop us.
297 	 */
298 	if (p != NULL) {
299 		i = p->ipqe_off + p->ipqe_len - ipqe->ipqe_off;
300 		if (i > 0) {
301 			if (i >= ipqe->ipqe_len) {
302 				goto dropfrag;
303 			}
304 			m_adj(ipqe->ipqe_m, i);
305 			ipqe->ipqe_off = ipqe->ipqe_off + i;
306 			ipqe->ipqe_len = ipqe->ipqe_len - i;
307 		}
308 	}
309 	if (p != NULL && !p->ipqe_mff) {
310 		goto dropfrag;
311 	}
312 
313 	/*
314 	 * Look at the segments that follow.
315 	 *
316 	 * If we cover them, in part or entirely, trim them or dequeue them.
317 	 *
318 	 * If a following segment exists, and we are marked as the last
319 	 * segment, drop us.
320 	 */
321 	while (q != NULL) {
322 		i = ipqe->ipqe_off + ipqe->ipqe_len - q->ipqe_off;
323 		if (i <= 0) {
324 			break;
325 		}
326 		if (i < q->ipqe_len) {
327 			q->ipqe_off = q->ipqe_off + i;
328 			q->ipqe_len = q->ipqe_len - i;
329 			m_adj(q->ipqe_m, i);
330 			break;
331 		}
332 		nq = TAILQ_NEXT(q, ipqe_q);
333 		m_freem(q->ipqe_m);
334 		TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q);
335 		pool_cache_put(ipfren_cache, q);
336 		fp->ipq_nfrags--;
337 		ip_nfrags--;
338 		q = nq;
339 	}
340 	if (q != NULL && !ipqe->ipqe_mff) {
341 		goto dropfrag;
342 	}
343 
344 insert:
345 	/*
346 	 * Stick new segment in its place; check for complete reassembly.
347 	 */
348 	if (p == NULL) {
349 		TAILQ_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q);
350 	} else {
351 		TAILQ_INSERT_AFTER(&fp->ipq_fragq, p, ipqe, ipqe_q);
352 	}
353 	next = 0;
354 	TAILQ_FOREACH(q, &fp->ipq_fragq, ipqe_q) {
355 		if (q->ipqe_off != next) {
356 			mutex_exit(&ipfr_lock);
357 			return NULL;
358 		}
359 		next += q->ipqe_len;
360 	}
361 	p = TAILQ_LAST(&fp->ipq_fragq, ipfr_qent_head);
362 	if (p->ipqe_mff) {
363 		mutex_exit(&ipfr_lock);
364 		return NULL;
365 	}
366 
367 	/*
368 	 * Reassembly is complete.  Check for a bogus message size.
369 	 */
370 	q = TAILQ_FIRST(&fp->ipq_fragq);
371 	ip = q->ipqe_ip;
372 	if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) {
373 		IP_STATINC(IP_STAT_TOOLONG);
374 		ip_freef(fp);
375 		mutex_exit(&ipfr_lock);
376 		return NULL;
377 	}
378 	LIST_REMOVE(fp, ipq_q);
379 	ip_nfrags -= fp->ipq_nfrags;
380 	ip_nfragpackets--;
381 	mutex_exit(&ipfr_lock);
382 
383 	/* Concatenate all fragments. */
384 	m = q->ipqe_m;
385 	t = m->m_next;
386 	m->m_next = NULL;
387 	m_cat(m, t);
388 	nq = TAILQ_NEXT(q, ipqe_q);
389 	pool_cache_put(ipfren_cache, q);
390 
391 	for (q = nq; q != NULL; q = nq) {
392 		t = q->ipqe_m;
393 		nq = TAILQ_NEXT(q, ipqe_q);
394 		pool_cache_put(ipfren_cache, q);
395 		m_remove_pkthdr(t);
396 		m_cat(m, t);
397 	}
398 
399 	/*
400 	 * Create header for new packet by modifying header of first
401 	 * packet.  Dequeue and discard fragment reassembly header.  Make
402 	 * header visible.
403 	 */
404 	ip->ip_len = htons((ip->ip_hl << 2) + next);
405 	ip->ip_off = htons(0);
406 	ip->ip_src = fp->ipq_src;
407 	ip->ip_dst = fp->ipq_dst;
408 	free(fp, M_FTABLE);
409 
410 	m->m_len += (ip->ip_hl << 2);
411 	m->m_data -= (ip->ip_hl << 2);
412 
413 	/* Fix up mbuf.  XXX This should be done elsewhere. */
414 	{
415 		KASSERT(m->m_flags & M_PKTHDR);
416 		int plen = 0;
417 		for (t = m; t; t = t->m_next) {
418 			plen += t->m_len;
419 		}
420 		m->m_pkthdr.len = plen;
421 		m->m_pkthdr.csum_flags = 0;
422 	}
423 	return m;
424 
425 dropfrag:
426 	if (fp != NULL) {
427 		fp->ipq_nfrags--;
428 	}
429 	ip_nfrags--;
430 	IP_STATINC(IP_STAT_FRAGDROPPED);
431 	mutex_exit(&ipfr_lock);
432 
433 	pool_cache_put(ipfren_cache, ipqe);
434 	m_freem(m);
435 	return NULL;
436 }
437 
438 /*
439  * ip_freef:
440  *
441  *	Free a fragment reassembly header and all associated datagrams.
442  */
443 static void
444 ip_freef(ipfr_queue_t *fp)
445 {
446 	ipfr_qent_t *q;
447 
448 	KASSERT(mutex_owned(&ipfr_lock));
449 
450 	LIST_REMOVE(fp, ipq_q);
451 	ip_nfrags -= fp->ipq_nfrags;
452 	ip_nfragpackets--;
453 
454 	while ((q = TAILQ_FIRST(&fp->ipq_fragq)) != NULL) {
455 		TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q);
456 		m_freem(q->ipqe_m);
457 		pool_cache_put(ipfren_cache, q);
458 	}
459 	free(fp, M_FTABLE);
460 }
461 
462 /*
463  * ip_reass_ttl_decr:
464  *
465  *	Decrement TTL of all reasembly queue entries by `ticks'.  Count
466  *	number of distinct fragments (as opposed to partial, fragmented
467  *	datagrams) inthe reassembly queue.  While we  traverse the entire
468  *	reassembly queue, compute and return the median TTL over all
469  *	fragments.
470  */
471 static u_int
472 ip_reass_ttl_decr(u_int ticks)
473 {
474 	u_int nfrags, median, dropfraction, keepfraction;
475 	ipfr_queue_t *fp, *nfp;
476 	int i;
477 
478 	nfrags = 0;
479 	memset(fragttl_histo, 0, sizeof(fragttl_histo));
480 
481 	for (i = 0; i < IPREASS_HASH_SIZE; i++) {
482 		for (fp = LIST_FIRST(&ip_frags[i]); fp != NULL; fp = nfp) {
483 			fp->ipq_ttl = ((fp->ipq_ttl <= ticks) ?
484 			    0 : fp->ipq_ttl - ticks);
485 			nfp = LIST_NEXT(fp, ipq_q);
486 			if (fp->ipq_ttl == 0) {
487 				IP_STATINC(IP_STAT_FRAGTIMEOUT);
488 				ip_freef(fp);
489 			} else {
490 				nfrags += fp->ipq_nfrags;
491 				fragttl_histo[fp->ipq_ttl] += fp->ipq_nfrags;
492 			}
493 		}
494 	}
495 
496 	KASSERT(ip_nfrags == nfrags);
497 
498 	/* Find median (or other drop fraction) in histogram. */
499 	dropfraction = (ip_nfrags / 2);
500 	keepfraction = ip_nfrags - dropfraction;
501 	for (i = IPFRAGTTL, median = 0; i >= 0; i--) {
502 		median += fragttl_histo[i];
503 		if (median >= keepfraction)
504 			break;
505 	}
506 
507 	/* Return TTL of median (or other fraction). */
508 	return (u_int)i;
509 }
510 
511 static void
512 ip_reass_drophalf(void)
513 {
514 	u_int median_ticks;
515 
516 	KASSERT(mutex_owned(&ipfr_lock));
517 
518 	/*
519 	 * Compute median TTL of all fragments, and count frags
520 	 * with that TTL or lower (roughly half of all fragments).
521 	 */
522 	median_ticks = ip_reass_ttl_decr(0);
523 
524 	/* Drop half. */
525 	median_ticks = ip_reass_ttl_decr(median_ticks);
526 }
527 
528 /*
529  * ip_reass_drain: drain off all datagram fragments.  Do not acquire
530  * softnet_lock as can be called from hardware interrupt context.
531  */
532 void
533 ip_reass_drain(void)
534 {
535 
536 	/*
537 	 * We may be called from a device's interrupt context.  If
538 	 * the ipq is already busy, just bail out now.
539 	 */
540 	if (mutex_tryenter(&ipfr_lock)) {
541 		/*
542 		 * Drop half the total fragments now. If more mbufs are
543 		 * needed, we will be called again soon.
544 		 */
545 		ip_reass_drophalf();
546 		mutex_exit(&ipfr_lock);
547 	}
548 }
549 
550 /*
551  * ip_reass_slowtimo:
552  *
553  *	If a timer expires on a reassembly queue, discard it.
554  */
555 void
556 ip_reass_slowtimo(void)
557 {
558 	static u_int dropscanidx = 0;
559 	u_int i, median_ttl;
560 
561 	mutex_enter(&ipfr_lock);
562 
563 	/* Age TTL of all fragments by 1 tick .*/
564 	median_ttl = ip_reass_ttl_decr(1);
565 
566 	/* Make sure fragment limit is up-to-date. */
567 	CHECK_NMBCLUSTER_PARAMS();
568 
569 	/* If we have too many fragments, drop the older half. */
570 	if (ip_nfrags > ip_maxfrags) {
571 		ip_reass_ttl_decr(median_ttl);
572 	}
573 
574 	/*
575 	 * If we are over the maximum number of fragmented packets (due to
576 	 * the limit being lowered), drain off enough to get down to the
577 	 * new limit.  Start draining from the reassembly hashqueue most
578 	 * recently drained.
579 	 */
580 	if (ip_maxfragpackets < 0)
581 		;
582 	else {
583 		int wrapped = 0;
584 
585 		i = dropscanidx;
586 		while (ip_nfragpackets > ip_maxfragpackets && wrapped == 0) {
587 			while (LIST_FIRST(&ip_frags[i]) != NULL) {
588 				ip_freef(LIST_FIRST(&ip_frags[i]));
589 			}
590 			if (++i >= IPREASS_HASH_SIZE) {
591 				i = 0;
592 			}
593 			/*
594 			 * Do not scan forever even if fragment counters are
595 			 * wrong: stop after scanning entire reassembly queue.
596 			 */
597 			if (i == dropscanidx) {
598 				wrapped = 1;
599 			}
600 		}
601 		dropscanidx = i;
602 	}
603 	mutex_exit(&ipfr_lock);
604 }
605 
606 /*
607  * ip_reass_packet: generic routine to perform IP reassembly.
608  *
609  * => Passed fragment should have IP_MF flag and/or offset set.
610  * => Fragment should not have other than IP_MF flags set.
611  *
612  * => Returns 0 on success or error otherwise.
613  * => On complete, m0 represents a constructed final packet.
614  */
615 int
616 ip_reass_packet(struct mbuf **m0)
617 {
618 	struct mbuf *m = *m0;
619 	struct ip *ip = mtod(m, struct ip *);
620 	const int hlen = ip->ip_hl << 2;
621 	const int len = ntohs(ip->ip_len);
622 	int ipsecflags = m->m_flags & (M_DECRYPTED|M_AUTHIPHDR);
623 	ipfr_queue_t *fp;
624 	ipfr_qent_t *ipqe;
625 	u_int hash, off, flen;
626 	bool mff;
627 
628 	/*
629 	 * Prevent TCP blind data attacks by not allowing non-initial
630 	 * fragments to start at less than 68 bytes (minimal fragment
631 	 * size) and making sure the first fragment is at least 68
632 	 * bytes.
633 	 */
634 	off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
635 	if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) {
636 		IP_STATINC(IP_STAT_BADFRAGS);
637 		return EINVAL;
638 	}
639 
640 	if (off + len > IP_MAXPACKET) {
641 		IP_STATINC(IP_STAT_TOOLONG);
642 		return EINVAL;
643 	}
644 
645 	/*
646 	 * Fragment length and MF flag.  Make sure that fragments have
647 	 * a data length which is non-zero and multiple of 8 bytes.
648 	 */
649 	flen = ntohs(ip->ip_len) - hlen;
650 	mff = (ip->ip_off & htons(IP_MF)) != 0;
651 	if (mff && (flen == 0 || (flen & 0x7) != 0)) {
652 		IP_STATINC(IP_STAT_BADFRAGS);
653 		return EINVAL;
654 	}
655 
656 	/* Look for queue of fragments of this datagram. */
657 	mutex_enter(&ipfr_lock);
658 	hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);
659 	LIST_FOREACH(fp, &ip_frags[hash], ipq_q) {
660 		if (ip->ip_id != fp->ipq_id)
661 			continue;
662 		if (!in_hosteq(ip->ip_src, fp->ipq_src))
663 			continue;
664 		if (!in_hosteq(ip->ip_dst, fp->ipq_dst))
665 			continue;
666 		if (ip->ip_p != fp->ipq_p)
667 			continue;
668 		break;
669 	}
670 
671 	if (fp) {
672 		/* All fragments must have the same IPsec flags. */
673 		if (fp->ipq_ipsec != ipsecflags) {
674 			IP_STATINC(IP_STAT_BADFRAGS);
675 			mutex_exit(&ipfr_lock);
676 			return EINVAL;
677 		}
678 
679 		/* Make sure that TOS matches previous fragments. */
680 		if (fp->ipq_tos != ip->ip_tos) {
681 			IP_STATINC(IP_STAT_BADFRAGS);
682 			mutex_exit(&ipfr_lock);
683 			return EINVAL;
684 		}
685 	}
686 
687 	/*
688 	 * Create new entry and attempt to reassembly.
689 	 */
690 	IP_STATINC(IP_STAT_FRAGMENTS);
691 	ipqe = pool_cache_get(ipfren_cache, PR_NOWAIT);
692 	if (ipqe == NULL) {
693 		IP_STATINC(IP_STAT_RCVMEMDROP);
694 		mutex_exit(&ipfr_lock);
695 		return ENOMEM;
696 	}
697 	ipqe->ipqe_mff = mff;
698 	ipqe->ipqe_m = m;
699 	ipqe->ipqe_ip = ip;
700 	ipqe->ipqe_off = off;
701 	ipqe->ipqe_len = flen;
702 
703 	*m0 = ip_reass(ipqe, fp, hash);
704 	if (*m0) {
705 		/* Note that finally reassembled. */
706 		IP_STATINC(IP_STAT_REASSEMBLED);
707 	}
708 	return 0;
709 }
710