xref: /netbsd-src/sys/netinet6/frag6.c (revision c38e7cc395b1472a774ff828e46123de44c628e9) 
1 /*	$NetBSD: frag6.c,v 1.73 2018/05/03 07:25:49 maxv Exp $	*/
2 /*	$KAME: frag6.c,v 1.40 2002/05/27 21:40:31 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: frag6.c,v 1.73 2018/05/03 07:25:49 maxv Exp $");
35 
36 #ifdef _KERNEL_OPT
37 #include "opt_net_mpsafe.h"
38 #endif
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/errno.h>
44 #include <sys/time.h>
45 #include <sys/kmem.h>
46 #include <sys/kernel.h>
47 #include <sys/syslog.h>
48 
49 #include <net/if.h>
50 #include <net/route.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/in_var.h>
54 #include <netinet/ip6.h>
55 #include <netinet6/ip6_var.h>
56 #include <netinet6/ip6_private.h>
57 #include <netinet/icmp6.h>
58 
59 /*
60  * IPv6 reassembly queue structure. Each fragment being reassembled is
61  * attached to one of these structures.
62  *
63  * XXX: Would be better to use TAILQ.
64  */
65 struct	ip6q {
66 	u_int32_t	ip6q_head;
67 	u_int16_t	ip6q_len;
68 	u_int8_t	ip6q_nxt;	/* ip6f_nxt in first fragment */
69 	u_int8_t	ip6q_hlim;
70 	struct ip6asfrag *ip6q_down;
71 	struct ip6asfrag *ip6q_up;
72 	u_int32_t	ip6q_ident;
73 	u_int8_t	ip6q_ttl;
74 	struct in6_addr	ip6q_src, ip6q_dst;
75 	struct ip6q	*ip6q_next;
76 	struct ip6q	*ip6q_prev;
77 	int		ip6q_unfrglen;	/* len of unfragmentable part */
78 	int		ip6q_nfrag;	/* # of fragments */
79 };
80 
81 struct	ip6asfrag {
82 	u_int32_t	ip6af_head;
83 	u_int16_t	ip6af_len;
84 	u_int8_t	ip6af_nxt;
85 	u_int8_t	ip6af_hlim;
86 	/* must not override the above members during reassembling */
87 	struct ip6asfrag *ip6af_down;
88 	struct ip6asfrag *ip6af_up;
89 	struct mbuf	*ip6af_m;
90 	int		ip6af_offset;	/* offset in ip6af_m to next header */
91 	int		ip6af_frglen;	/* fragmentable part length */
92 	int		ip6af_off;	/* fragment offset */
93 	bool		ip6af_mff;	/* more fragment bit in frag off */
94 };
95 
96 static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *);
97 static void frag6_deq(struct ip6asfrag *);
98 static void frag6_insque(struct ip6q *, struct ip6q *);
99 static void frag6_remque(struct ip6q *);
100 static void frag6_freef(struct ip6q *);
101 
102 static int frag6_drainwanted;
103 
104 static u_int frag6_nfragpackets;
105 static u_int frag6_nfrags;
106 static struct ip6q ip6q;	/* ip6 reassembly queue */
107 
108 /* Protects ip6q */
109 static kmutex_t	frag6_lock __cacheline_aligned;
110 
111 /*
112  * Initialise reassembly queue and fragment identifier.
113  */
114 void
115 frag6_init(void)
116 {
117 
118 	ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q;
119 	mutex_init(&frag6_lock, MUTEX_DEFAULT, IPL_NET);
120 }
121 
122 /*
123  * IPv6 fragment input.
124  *
125  * In RFC2460, fragment and reassembly rule do not agree with each other,
126  * in terms of next header field handling in fragment header.
127  * While the sender will use the same value for all of the fragmented packets,
128  * receiver is suggested not to check the consistency.
129  *
130  * fragment rule (p20):
131  *	(2) A Fragment header containing:
132  *	The Next Header value that identifies the first header of
133  *	the Fragmentable Part of the original packet.
134  *		-> next header field is same for all fragments
135  *
136  * reassembly rule (p21):
137  *	The Next Header field of the last header of the Unfragmentable
138  *	Part is obtained from the Next Header field of the first
139  *	fragment's Fragment header.
140  *		-> should grab it from the first fragment only
141  *
142  * The following note also contradicts with fragment rule - noone is going to
143  * send different fragment with different next header field.
144  *
145  * additional note (p22):
146  *	The Next Header values in the Fragment headers of different
147  *	fragments of the same original packet may differ.  Only the value
148  *	from the Offset zero fragment packet is used for reassembly.
149  *		-> should grab it from the first fragment only
150  *
151  * There is no explicit reason given in the RFC.  Historical reason maybe?
152  *
153  * XXX: It would be better to use a pool, rather than kmem.
154  */
155 int
156 frag6_input(struct mbuf **mp, int *offp, int proto)
157 {
158 	struct rtentry *rt;
159 	struct mbuf *m = *mp, *t;
160 	struct ip6_hdr *ip6;
161 	struct ip6_frag *ip6f;
162 	struct ip6q *q6;
163 	struct ip6asfrag *af6, *ip6af, *af6dwn;
164 	int offset = *offp, nxt, i, next;
165 	int first_frag = 0;
166 	int fragoff, frgpartlen;	/* must be larger than u_int16_t */
167 	struct ifnet *dstifp;
168 	static struct route ro;
169 	union {
170 		struct sockaddr		dst;
171 		struct sockaddr_in6	dst6;
172 	} u;
173 
174 	ip6 = mtod(m, struct ip6_hdr *);
175 	IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f));
176 	if (ip6f == NULL)
177 		return IPPROTO_DONE;
178 
179 	dstifp = NULL;
180 	/* find the destination interface of the packet. */
181 	sockaddr_in6_init(&u.dst6, &ip6->ip6_dst, 0, 0, 0);
182 	if ((rt = rtcache_lookup(&ro, &u.dst)) != NULL && rt->rt_ifa != NULL)
183 		dstifp = ((struct in6_ifaddr *)rt->rt_ifa)->ia_ifp;
184 
185 	/* jumbo payload can't contain a fragment header */
186 	if (ip6->ip6_plen == 0) {
187 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
188 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
189 		goto done;
190 	}
191 
192 	/*
193 	 * Check whether fragment packet's fragment length is non-zero and
194 	 * multiple of 8 octets.
195 	 * sizeof(struct ip6_frag) == 8
196 	 * sizeof(struct ip6_hdr) = 40
197 	 */
198 	if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
199 	    (((ntohs(ip6->ip6_plen) - offset) == 0) ||
200 	     ((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
201 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
202 		    offsetof(struct ip6_hdr, ip6_plen));
203 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
204 		goto done;
205 	}
206 
207 	IP6_STATINC(IP6_STAT_FRAGMENTS);
208 	in6_ifstat_inc(dstifp, ifs6_reass_reqd);
209 
210 	/* offset now points to data portion */
211 	offset += sizeof(struct ip6_frag);
212 
213 	/*
214 	 * RFC6946: A host that receives an IPv6 packet which includes
215 	 * a Fragment Header with the "Fragment Offset" equal to 0 and
216 	 * the "M" bit equal to 0 MUST process such packet in isolation
217 	 * from any other packets/fragments.
218 	 *
219 	 * XXX: Would be better to remove this fragment header entirely,
220 	 * for us not to get confused later when looking back at the
221 	 * previous headers in the chain.
222 	 */
223 	fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
224 	if (fragoff == 0 && !(ip6f->ip6f_offlg & IP6F_MORE_FRAG)) {
225 		IP6_STATINC(IP6_STAT_REASSEMBLED);
226 		in6_ifstat_inc(dstifp, ifs6_reass_ok);
227 		*offp = offset;
228 		rtcache_unref(rt, &ro);
229 		return ip6f->ip6f_nxt;
230 	}
231 
232 	mutex_enter(&frag6_lock);
233 
234 	/*
235 	 * Enforce upper bound on number of fragments.
236 	 * If maxfrag is 0, never accept fragments.
237 	 * If maxfrag is -1, accept all fragments without limitation.
238 	 */
239 	if (ip6_maxfrags < 0)
240 		;
241 	else if (frag6_nfrags >= (u_int)ip6_maxfrags)
242 		goto dropfrag;
243 
244 	for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next)
245 		if (ip6f->ip6f_ident == q6->ip6q_ident &&
246 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) &&
247 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst))
248 			break;
249 
250 	if (q6 == &ip6q) {
251 		/*
252 		 * the first fragment to arrive, create a reassembly queue.
253 		 */
254 		first_frag = 1;
255 
256 		/*
257 		 * Enforce upper bound on number of fragmented packets
258 		 * for which we attempt reassembly;
259 		 * If maxfragpackets is 0, never accept fragments.
260 		 * If maxfragpackets is -1, accept all fragments without
261 		 * limitation.
262 		 */
263 		if (ip6_maxfragpackets < 0)
264 			;
265 		else if (frag6_nfragpackets >= (u_int)ip6_maxfragpackets)
266 			goto dropfrag;
267 		frag6_nfragpackets++;
268 
269 		q6 = kmem_intr_zalloc(sizeof(struct ip6q), KM_NOSLEEP);
270 		if (q6 == NULL) {
271 			goto dropfrag;
272 		}
273 		frag6_insque(q6, &ip6q);
274 
275 		/* ip6q_nxt will be filled afterwards, from 1st fragment */
276 		q6->ip6q_down	= q6->ip6q_up = (struct ip6asfrag *)q6;
277 		q6->ip6q_ident	= ip6f->ip6f_ident;
278 		q6->ip6q_ttl 	= IPV6_FRAGTTL;
279 		q6->ip6q_src	= ip6->ip6_src;
280 		q6->ip6q_dst	= ip6->ip6_dst;
281 		q6->ip6q_unfrglen = -1;	/* The 1st fragment has not arrived. */
282 
283 		q6->ip6q_nfrag = 0;
284 	}
285 
286 	/*
287 	 * If it's the 1st fragment, record the length of the
288 	 * unfragmentable part and the next header of the fragment header.
289 	 */
290 	if (fragoff == 0) {
291 		q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr) -
292 		    sizeof(struct ip6_frag);
293 		q6->ip6q_nxt = ip6f->ip6f_nxt;
294 	}
295 
296 	/*
297 	 * Check that the reassembled packet would not exceed 65535 bytes
298 	 * in size. If it would exceed, discard the fragment and return an
299 	 * ICMP error.
300 	 */
301 	frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
302 	if (q6->ip6q_unfrglen >= 0) {
303 		/* The 1st fragment has already arrived. */
304 		if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
305 			mutex_exit(&frag6_lock);
306 			icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
307 			    offset - sizeof(struct ip6_frag) +
308 			    offsetof(struct ip6_frag, ip6f_offlg));
309 			goto done;
310 		}
311 	} else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
312 		mutex_exit(&frag6_lock);
313 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
314 		    offset - sizeof(struct ip6_frag) +
315 		    offsetof(struct ip6_frag, ip6f_offlg));
316 		goto done;
317 	}
318 
319 	/*
320 	 * If it's the first fragment, do the above check for each
321 	 * fragment already stored in the reassembly queue.
322 	 */
323 	if (fragoff == 0) {
324 		for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
325 		     af6 = af6dwn) {
326 			af6dwn = af6->ip6af_down;
327 
328 			if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
329 			    IPV6_MAXPACKET) {
330 				struct mbuf *merr = af6->ip6af_m;
331 				struct ip6_hdr *ip6err;
332 				int erroff = af6->ip6af_offset;
333 
334 				/* dequeue the fragment. */
335 				frag6_deq(af6);
336 				kmem_intr_free(af6, sizeof(struct ip6asfrag));
337 
338 				/* adjust pointer. */
339 				ip6err = mtod(merr, struct ip6_hdr *);
340 
341 				/*
342 				 * Restore source and destination addresses
343 				 * in the erroneous IPv6 header.
344 				 */
345 				ip6err->ip6_src = q6->ip6q_src;
346 				ip6err->ip6_dst = q6->ip6q_dst;
347 
348 				icmp6_error(merr, ICMP6_PARAM_PROB,
349 				    ICMP6_PARAMPROB_HEADER,
350 				    erroff - sizeof(struct ip6_frag) +
351 				    offsetof(struct ip6_frag, ip6f_offlg));
352 			}
353 		}
354 	}
355 
356 	ip6af = kmem_intr_zalloc(sizeof(struct ip6asfrag), KM_NOSLEEP);
357 	if (ip6af == NULL) {
358 		goto dropfrag;
359 	}
360 	ip6af->ip6af_head = ip6->ip6_flow;
361 	ip6af->ip6af_len = ip6->ip6_plen;
362 	ip6af->ip6af_nxt = ip6->ip6_nxt;
363 	ip6af->ip6af_hlim = ip6->ip6_hlim;
364 	ip6af->ip6af_mff = (ip6f->ip6f_offlg & IP6F_MORE_FRAG) != 0;
365 	ip6af->ip6af_off = fragoff;
366 	ip6af->ip6af_frglen = frgpartlen;
367 	ip6af->ip6af_offset = offset;
368 	ip6af->ip6af_m = m;
369 
370 	if (first_frag) {
371 		af6 = (struct ip6asfrag *)q6;
372 		goto insert;
373 	}
374 
375 	/*
376 	 * Find a segment which begins after this one does.
377 	 */
378 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
379 	     af6 = af6->ip6af_down)
380 		if (af6->ip6af_off > ip6af->ip6af_off)
381 			break;
382 
383 	/*
384 	 * If the incoming fragment overlaps some existing fragments in
385 	 * the reassembly queue - drop it as per RFC 5722.
386 	 */
387 	if (af6->ip6af_up != (struct ip6asfrag *)q6) {
388 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
389 			- ip6af->ip6af_off;
390 		if (i > 0) {
391 			kmem_intr_free(ip6af, sizeof(struct ip6asfrag));
392 			goto dropfrag;
393 		}
394 	}
395 	if (af6 != (struct ip6asfrag *)q6) {
396 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
397 		if (i > 0) {
398 			kmem_intr_free(ip6af, sizeof(struct ip6asfrag));
399 			goto dropfrag;
400 		}
401 	}
402 
403 insert:
404 	/*
405 	 * Stick new segment in its place.
406 	 */
407 	frag6_enq(ip6af, af6->ip6af_up);
408 	frag6_nfrags++;
409 	q6->ip6q_nfrag++;
410 
411 	/*
412 	 * Check for complete reassembly.
413 	 */
414 	next = 0;
415 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
416 	     af6 = af6->ip6af_down) {
417 		if (af6->ip6af_off != next) {
418 			mutex_exit(&frag6_lock);
419 			goto done;
420 		}
421 		next += af6->ip6af_frglen;
422 	}
423 	if (af6->ip6af_up->ip6af_mff) {
424 		mutex_exit(&frag6_lock);
425 		goto done;
426 	}
427 
428 	/*
429 	 * Reassembly is complete; concatenate fragments.
430 	 */
431 	ip6af = q6->ip6q_down;
432 	t = m = ip6af->ip6af_m;
433 	af6 = ip6af->ip6af_down;
434 	frag6_deq(ip6af);
435 	while (af6 != (struct ip6asfrag *)q6) {
436 		af6dwn = af6->ip6af_down;
437 		frag6_deq(af6);
438 		while (t->m_next)
439 			t = t->m_next;
440 		t->m_next = af6->ip6af_m;
441 		m_adj(t->m_next, af6->ip6af_offset);
442 		m_remove_pkthdr(t->m_next);
443 		kmem_intr_free(af6, sizeof(struct ip6asfrag));
444 		af6 = af6dwn;
445 	}
446 
447 	/* adjust offset to point where the original next header starts */
448 	offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
449 	kmem_intr_free(ip6af, sizeof(struct ip6asfrag));
450 	ip6 = mtod(m, struct ip6_hdr *);
451 	ip6->ip6_plen = htons(next + offset - sizeof(struct ip6_hdr));
452 	ip6->ip6_src = q6->ip6q_src;
453 	ip6->ip6_dst = q6->ip6q_dst;
454 	nxt = q6->ip6q_nxt;
455 
456 	/*
457 	 * Delete frag6 header.
458 	 */
459 	if (m->m_len >= offset + sizeof(struct ip6_frag)) {
460 		memmove((char *)ip6 + sizeof(struct ip6_frag), ip6, offset);
461 		m->m_data += sizeof(struct ip6_frag);
462 		m->m_len -= sizeof(struct ip6_frag);
463 	} else {
464 		/* this comes with no copy if the boundary is on cluster */
465 		if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) {
466 			frag6_remque(q6);
467 			frag6_nfrags -= q6->ip6q_nfrag;
468 			kmem_intr_free(q6, sizeof(struct ip6q));
469 			frag6_nfragpackets--;
470 			goto dropfrag;
471 		}
472 		m_adj(t, sizeof(struct ip6_frag));
473 		m_cat(m, t);
474 	}
475 
476 	frag6_remque(q6);
477 	frag6_nfrags -= q6->ip6q_nfrag;
478 	kmem_intr_free(q6, sizeof(struct ip6q));
479 	frag6_nfragpackets--;
480 
481 	{
482 		KASSERT(m->m_flags & M_PKTHDR);
483 		int plen = 0;
484 		for (t = m; t; t = t->m_next) {
485 			plen += t->m_len;
486 		}
487 		m->m_pkthdr.len = plen;
488 		/* XXX XXX: clear csum_flags? */
489 	}
490 
491 	/*
492 	 * Restore NXT to the original.
493 	 */
494 	{
495 		const int prvnxt = ip6_get_prevhdr(m, offset);
496 		uint8_t *prvnxtp;
497 
498 		IP6_EXTHDR_GET(prvnxtp, uint8_t *, m, prvnxt,
499 		    sizeof(*prvnxtp));
500 		if (prvnxtp == NULL) {
501 			goto dropfrag;
502 		}
503 		*prvnxtp = nxt;
504 	}
505 
506 	IP6_STATINC(IP6_STAT_REASSEMBLED);
507 	in6_ifstat_inc(dstifp, ifs6_reass_ok);
508 	rtcache_unref(rt, &ro);
509 	mutex_exit(&frag6_lock);
510 
511 	/*
512 	 * Tell launch routine the next header.
513 	 */
514 	*mp = m;
515 	*offp = offset;
516 	return nxt;
517 
518  dropfrag:
519 	mutex_exit(&frag6_lock);
520 	in6_ifstat_inc(dstifp, ifs6_reass_fail);
521 	IP6_STATINC(IP6_STAT_FRAGDROPPED);
522 	m_freem(m);
523  done:
524 	rtcache_unref(rt, &ro);
525 	return IPPROTO_DONE;
526 }
527 
528 int
529 ip6_reass_packet(struct mbuf **mp, int offset)
530 {
531 
532 	if (frag6_input(mp, &offset, IPPROTO_IPV6) == IPPROTO_DONE) {
533 		*mp = NULL;
534 		return EINVAL;
535 	}
536 	return 0;
537 }
538 
539 /*
540  * Free a fragment reassembly header and all
541  * associated datagrams.
542  */
543 static void
544 frag6_freef(struct ip6q *q6)
545 {
546 	struct ip6asfrag *af6, *down6;
547 
548 	KASSERT(mutex_owned(&frag6_lock));
549 
550 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
551 	     af6 = down6) {
552 		struct mbuf *m = af6->ip6af_m;
553 
554 		down6 = af6->ip6af_down;
555 		frag6_deq(af6);
556 
557 		/*
558 		 * Return ICMP time exceeded error for the 1st fragment.
559 		 * Just free other fragments.
560 		 */
561 		if (af6->ip6af_off == 0) {
562 			struct ip6_hdr *ip6;
563 
564 			/* adjust pointer */
565 			ip6 = mtod(m, struct ip6_hdr *);
566 
567 			/* restore source and destination addresses */
568 			ip6->ip6_src = q6->ip6q_src;
569 			ip6->ip6_dst = q6->ip6q_dst;
570 
571 			icmp6_error(m, ICMP6_TIME_EXCEEDED,
572 				    ICMP6_TIME_EXCEED_REASSEMBLY, 0);
573 		} else {
574 			m_freem(m);
575 		}
576 		kmem_intr_free(af6, sizeof(struct ip6asfrag));
577 	}
578 
579 	frag6_remque(q6);
580 	frag6_nfrags -= q6->ip6q_nfrag;
581 	kmem_intr_free(q6, sizeof(struct ip6q));
582 	frag6_nfragpackets--;
583 }
584 
585 /*
586  * Put an ip fragment on a reassembly chain.
587  * Like insque, but pointers in middle of structure.
588  */
589 void
590 frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
591 {
592 
593 	KASSERT(mutex_owned(&frag6_lock));
594 
595 	af6->ip6af_up = up6;
596 	af6->ip6af_down = up6->ip6af_down;
597 	up6->ip6af_down->ip6af_up = af6;
598 	up6->ip6af_down = af6;
599 }
600 
601 /*
602  * To frag6_enq as remque is to insque.
603  */
604 void
605 frag6_deq(struct ip6asfrag *af6)
606 {
607 
608 	KASSERT(mutex_owned(&frag6_lock));
609 
610 	af6->ip6af_up->ip6af_down = af6->ip6af_down;
611 	af6->ip6af_down->ip6af_up = af6->ip6af_up;
612 }
613 
614 /*
615  * Insert newq after oldq.
616  */
617 void
618 frag6_insque(struct ip6q *newq, struct ip6q *oldq)
619 {
620 
621 	KASSERT(mutex_owned(&frag6_lock));
622 
623 	newq->ip6q_prev = oldq;
624 	newq->ip6q_next = oldq->ip6q_next;
625 	oldq->ip6q_next->ip6q_prev = newq;
626 	oldq->ip6q_next = newq;
627 }
628 
629 /*
630  * Unlink p6.
631  */
632 void
633 frag6_remque(struct ip6q *p6)
634 {
635 
636 	KASSERT(mutex_owned(&frag6_lock));
637 
638 	p6->ip6q_prev->ip6q_next = p6->ip6q_next;
639 	p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
640 }
641 
642 void
643 frag6_fasttimo(void)
644 {
645 
646 	SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
647 
648 	if (frag6_drainwanted) {
649 		frag6_drain();
650 		frag6_drainwanted = 0;
651 	}
652 
653 	SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
654 }
655 
656 /*
657  * IPv6 reassembling timer processing;
658  * if a timer expires on a reassembly
659  * queue, discard it.
660  */
661 void
662 frag6_slowtimo(void)
663 {
664 	struct ip6q *q6;
665 
666 	SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
667 
668 	mutex_enter(&frag6_lock);
669 	q6 = ip6q.ip6q_next;
670 	if (q6) {
671 		while (q6 != &ip6q) {
672 			--q6->ip6q_ttl;
673 			q6 = q6->ip6q_next;
674 			if (q6->ip6q_prev->ip6q_ttl == 0) {
675 				IP6_STATINC(IP6_STAT_FRAGTIMEOUT);
676 				/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
677 				frag6_freef(q6->ip6q_prev);
678 			}
679 		}
680 	}
681 
682 	/*
683 	 * If we are over the maximum number of fragments
684 	 * (due to the limit being lowered), drain off
685 	 * enough to get down to the new limit.
686 	 */
687 	while (frag6_nfragpackets > (u_int)ip6_maxfragpackets &&
688 	    ip6q.ip6q_prev) {
689 		IP6_STATINC(IP6_STAT_FRAGOVERFLOW);
690 		/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
691 		frag6_freef(ip6q.ip6q_prev);
692 	}
693 	mutex_exit(&frag6_lock);
694 
695 	SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
696 
697 #if 0
698 	/*
699 	 * Routing changes might produce a better route than we last used;
700 	 * make sure we notice eventually, even if forwarding only for one
701 	 * destination and the cache is never replaced.
702 	 */
703 	rtcache_free(&ip6_forward_rt);
704 	rtcache_free(&ipsrcchk_rt);
705 #endif
706 }
707 
708 void
709 frag6_drainstub(void)
710 {
711 	frag6_drainwanted = 1;
712 }
713 
714 /*
715  * Drain off all datagram fragments.
716  */
717 void
718 frag6_drain(void)
719 {
720 
721 	if (mutex_tryenter(&frag6_lock)) {
722 		while (ip6q.ip6q_next != &ip6q) {
723 			IP6_STATINC(IP6_STAT_FRAGDROPPED);
724 			/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
725 			frag6_freef(ip6q.ip6q_next);
726 		}
727 		mutex_exit(&frag6_lock);
728 	}
729 }
730