1 /*
2 * Copyright (c) 2000-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $FreeBSD: src/sys/netinet6/frag6.c,v 1.2.2.5 2001/07/03 11:01:50 ume Exp $ */
30 /* $KAME: frag6.c,v 1.31 2001/05/17 13:45:34 jinmei Exp $ */
31
32 /*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61 #include <sys/param.h>
62 #include <sys/systm.h>
63 #include <sys/malloc.h>
64 #include <sys/mcache.h>
65 #include <sys/mbuf.h>
66 #include <sys/domain.h>
67 #include <sys/protosw.h>
68 #include <sys/socket.h>
69 #include <sys/errno.h>
70 #include <sys/time.h>
71 #include <sys/kernel.h>
72 #include <sys/syslog.h>
73 #include <kern/queue.h>
74 #include <kern/locks.h>
75 #include <kern/uipc_domain.h>
76
77 #include <net/droptap.h>
78 #include <net/if.h>
79 #include <net/route.h>
80
81 #include <netinet/in.h>
82 #include <netinet/in_var.h>
83 #include <netinet/ip.h>
84 #include <netinet/ip_var.h>
85 #include <netinet/ip6.h>
86 #include <netinet6/ip6_var.h>
87 #include <netinet/icmp6.h>
88
89 #include <net/net_osdep.h>
90 #include <dev/random/randomdev.h>
91
92 /*
93 * Define it to get a correct behavior on per-interface statistics.
94 */
95 #define IN6_IFSTAT_STRICT
96 struct ip6asfrag {
97 struct ip6asfrag *ip6af_down;
98 struct ip6asfrag *ip6af_up;
99 struct mbuf *ip6af_m;
100 int ip6af_offset; /* offset in ip6af_m to next header */
101 int ip6af_frglen; /* fragmentable part length */
102 int ip6af_off; /* fragment offset */
103 u_int16_t ip6af_mff; /* more fragment bit in frag off */
104 };
105
106 #define IP6_REASS_MBUF(ip6af) ((ip6af)->ip6af_m)
107
108 MBUFQ_HEAD(fq6_head);
109
110 static void frag6_save_context(struct mbuf *, uintptr_t);
111 static void frag6_scrub_context(struct mbuf *);
112 static int frag6_restore_context(struct mbuf *);
113
114 static void frag6_icmp6_paramprob_error(struct fq6_head *);
115 static void frag6_icmp6_timeex_error(struct fq6_head *);
116
117 static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *);
118 static void frag6_deq(struct ip6asfrag *);
119 static void frag6_insque(struct ip6q *, struct ip6q *);
120 static void frag6_remque(struct ip6q *);
121 static void frag6_purgef(struct ip6q *, struct fq6_head *, struct fq6_head *);
122 static void frag6_freef(struct ip6q *, struct fq6_head *, struct fq6_head *);
123
124 static int frag6_timeout_run; /* frag6 timer is scheduled to run */
125 static void frag6_timeout(void *);
126 static void frag6_sched_timeout(void);
127
128 static struct ip6q *ip6q_alloc(void);
129 static void ip6q_free(struct ip6q *);
130 static void ip6q_updateparams(void);
131 static struct ip6asfrag *ip6af_alloc(void);
132 static void ip6af_free(struct ip6asfrag *);
133
134 static LCK_GRP_DECLARE(ip6qlock_grp, "ip6qlock");
135 static LCK_MTX_DECLARE(ip6qlock, &ip6qlock_grp);
136
137 /* IPv6 fragment reassembly queues (protected by ip6qlock) */
138 static struct ip6q ip6q; /* ip6 reassembly queues */
139 static int ip6_maxfragpackets; /* max packets in reass queues */
140 static u_int32_t frag6_nfragpackets; /* # of packets in reass queues */
141 static int ip6_maxfrags; /* max fragments in reass queues */
142 static u_int32_t frag6_nfrags; /* # of fragments in reass queues */
143 static u_int32_t ip6q_limit; /* ip6q allocation limit */
144 static u_int32_t ip6q_count; /* current # of allocated ip6q's */
145 static u_int32_t ip6af_limit; /* ip6asfrag allocation limit */
146 static u_int32_t ip6af_count; /* current # of allocated ip6asfrag's */
147
148 static int sysctl_maxfragpackets SYSCTL_HANDLER_ARGS;
149 static int sysctl_maxfrags SYSCTL_HANDLER_ARGS;
150
151 SYSCTL_DECL(_net_inet6_ip6);
152
153 SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGPACKETS, maxfragpackets,
154 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxfragpackets, 0,
155 sysctl_maxfragpackets, "I",
156 "Maximum number of IPv6 fragment reassembly queue entries");
157
158 SYSCTL_UINT(_net_inet6_ip6, OID_AUTO, fragpackets,
159 CTLFLAG_RD | CTLFLAG_LOCKED, &frag6_nfragpackets, 0,
160 "Current number of IPv6 fragment reassembly queue entries");
161
162 SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGS, maxfrags,
163 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxfrags, 0,
164 sysctl_maxfrags, "I", "Maximum number of IPv6 fragments allowed");
165
166 /*
167 * Initialise reassembly queue and fragment identifier.
168 */
169 void
frag6_init(void)170 frag6_init(void)
171 {
172 lck_mtx_lock(&ip6qlock);
173 /* Initialize IPv6 reassembly queue. */
174 ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q;
175
176 /* same limits as IPv4 */
177 ip6_maxfragpackets = 8192;
178 ip6_maxfrags = ip6_maxfragpackets * 2;
179 ip6q_updateparams();
180 lck_mtx_unlock(&ip6qlock);
181 }
182
183 static void
frag6_save_context(struct mbuf * m,uintptr_t val)184 frag6_save_context(struct mbuf *m, uintptr_t val)
185 {
186 m->m_pkthdr.pkt_hdr = __unsafe_forge_single(void *, val);
187 }
188
189 static void
frag6_scrub_context(struct mbuf * m)190 frag6_scrub_context(struct mbuf *m)
191 {
192 m->m_pkthdr.pkt_hdr = NULL;
193 }
194
195 static int
frag6_restore_context(struct mbuf * m)196 frag6_restore_context(struct mbuf *m)
197 {
198 return (int)m->m_pkthdr.pkt_hdr;
199 }
200
201 /*
202 * Send any deferred ICMP param problem error messages; caller must not be
203 * holding ip6qlock and is expected to have saved the per-packet parameter
204 * value via frag6_save_context().
205 */
206 static void
frag6_icmp6_paramprob_error(struct fq6_head * diq6)207 frag6_icmp6_paramprob_error(struct fq6_head *diq6)
208 {
209 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_NOTOWNED);
210
211 if (!MBUFQ_EMPTY(diq6)) {
212 mbuf_ref_t merr, merr_tmp;
213 int param;
214 MBUFQ_FOREACH_SAFE(merr, diq6, merr_tmp) {
215 MBUFQ_REMOVE(diq6, merr);
216 MBUFQ_NEXT(merr) = NULL;
217 param = frag6_restore_context(merr);
218 frag6_scrub_context(merr);
219 icmp6_error(merr, ICMP6_PARAM_PROB,
220 ICMP6_PARAMPROB_HEADER, param);
221 }
222 }
223 }
224
225 /*
226 * Send any deferred ICMP time exceeded error messages;
227 * caller must not be holding ip6qlock.
228 */
229 static void
frag6_icmp6_timeex_error(struct fq6_head * diq6)230 frag6_icmp6_timeex_error(struct fq6_head *diq6)
231 {
232 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_NOTOWNED);
233
234 if (!MBUFQ_EMPTY(diq6)) {
235 mbuf_ref_t m, m_tmp;
236 MBUFQ_FOREACH_SAFE(m, diq6, m_tmp) {
237 MBUFQ_REMOVE(diq6, m);
238 MBUFQ_NEXT(m) = NULL;
239 icmp6_error_flag(m, ICMP6_TIME_EXCEEDED,
240 ICMP6_TIME_EXCEED_REASSEMBLY, 0, 0);
241 }
242 }
243 }
244
245 /*
246 * In RFC2460, fragment and reassembly rule do not agree with each other,
247 * in terms of next header field handling in fragment header.
248 * While the sender will use the same value for all of the fragmented packets,
249 * receiver is suggested not to check the consistency.
250 *
251 * fragment rule (p20):
252 * (2) A Fragment header containing:
253 * The Next Header value that identifies the first header of
254 * the Fragmentable Part of the original packet.
255 * -> next header field is same for all fragments
256 *
257 * reassembly rule (p21):
258 * The Next Header field of the last header of the Unfragmentable
259 * Part is obtained from the Next Header field of the first
260 * fragment's Fragment header.
261 * -> should grab it from the first fragment only
262 *
263 * The following note also contradicts with fragment rule - noone is going to
264 * send different fragment with different next header field.
265 *
266 * additional note (p22):
267 * The Next Header values in the Fragment headers of different
268 * fragments of the same original packet may differ. Only the value
269 * from the Offset zero fragment packet is used for reassembly.
270 * -> should grab it from the first fragment only
271 *
272 * There is no explicit reason given in the RFC. Historical reason maybe?
273 */
274 /*
275 * Fragment input
276 */
277 int
frag6_input(struct mbuf ** mp,int * offp,int proto)278 frag6_input(struct mbuf **mp, int *offp, int proto)
279 {
280 #pragma unused(proto)
281 mbuf_ref_t m = *mp, t = NULL;
282 struct ip6_hdr *ip6 = NULL;
283 struct ip6_frag *__single ip6f = NULL;
284 struct ip6q *__single q6 = NULL;
285 struct ip6asfrag *__single af6 = NULL, *__single ip6af = NULL, *__single af6dwn = NULL;
286 int offset = *offp, i = 0, next = 0;
287 u_int8_t nxt = 0;
288 int first_frag = 0;
289 int fragoff = 0, frgpartlen = 0; /* must be larger than u_int16_t */
290 ifnet_ref_t dstifp = NULL;
291 u_int8_t ecn = 0, ecn0 = 0;
292 uint32_t csum = 0, csum_flags = 0;
293 struct fq6_head diq6 = {};
294 int locked = 0;
295 boolean_t drop_fragq = FALSE;
296 int local_ip6q_unfrglen;
297 u_int8_t local_ip6q_nxt;
298 drop_reason_t drop_reason = DROP_REASON_UNSPECIFIED;
299
300 VERIFY(m->m_flags & M_PKTHDR);
301
302 MBUFQ_INIT(&diq6); /* for deferred ICMP param problem errors */
303
304 /* Expect 32-bit aligned data pointer on strict-align platforms */
305 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
306
307 IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), goto done);
308 ip6 = mtod(m, struct ip6_hdr *);
309 ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset);
310
311 #ifdef IN6_IFSTAT_STRICT
312 /* find the destination interface of the packet. */
313 if (m->m_pkthdr.pkt_flags & PKTF_IFAINFO) {
314 uint32_t idx;
315
316 if (ip6_getdstifaddr_info(m, &idx, NULL) == 0) {
317 if (idx > 0 && idx <= if_index) {
318 ifnet_head_lock_shared();
319 dstifp = ifindex2ifnet[idx];
320 ifnet_head_done();
321 }
322 }
323 }
324 #endif /* IN6_IFSTAT_STRICT */
325
326 /* we are violating the spec, this may not be the dst interface */
327 if (dstifp == NULL) {
328 dstifp = m->m_pkthdr.rcvif;
329 }
330
331 /* jumbo payload can't contain a fragment header */
332 if (ip6->ip6_plen == 0) {
333 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
334 in6_ifstat_inc(dstifp, ifs6_reass_fail);
335 m = NULL;
336 goto done;
337 }
338
339 /*
340 * check whether fragment packet's fragment length is
341 * multiple of 8 octets.
342 * sizeof(struct ip6_frag) == 8
343 * sizeof(struct ip6_hdr) = 40
344 */
345 if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
346 (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
347 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
348 offsetof(struct ip6_hdr, ip6_plen));
349 in6_ifstat_inc(dstifp, ifs6_reass_fail);
350 m = NULL;
351 goto done;
352 }
353
354 /* If ip6_maxfragpackets or ip6_maxfrags is 0, never accept fragments */
355 if (ip6_maxfragpackets == 0 || ip6_maxfrags == 0) {
356 ip6stat.ip6s_fragments++;
357 ip6stat.ip6s_fragdropped++;
358 in6_ifstat_inc(dstifp, ifs6_reass_fail);
359 m_drop(m, DROPTAP_FLAG_DIR_IN | DROPTAP_FLAG_L2_MISSING, DROP_REASON_IP_FRAG_NOT_ACCEPTED,
360 NULL, 0);
361 m = NULL;
362 goto done;
363 }
364
365 /* offset now points to data portion */
366 offset += sizeof(struct ip6_frag);
367
368 /*
369 * RFC 6946: Handle "atomic" fragments (offset and m bit set to 0)
370 * upfront, unrelated to any reassembly. Just skip the fragment header.
371 */
372 if ((ip6f->ip6f_offlg & ~IP6F_RESERVED_MASK) == 0) {
373 /*
374 * Mark packet as reassembled.
375 * In ICMPv6 processing, we drop certain
376 * NDP messages that are not expected to
377 * have fragment header based on recommendations
378 * against security vulnerability as described in
379 * RFC 6980.
380 * Treat atomic fragments as re-assembled packets as well.
381 */
382 m->m_pkthdr.pkt_flags |= PKTF_REASSEMBLED;
383 ip6stat.ip6s_atmfrag_rcvd++;
384 in6_ifstat_inc(dstifp, ifs6_atmfrag_rcvd);
385 *mp = m;
386 *offp = offset;
387 return ip6f->ip6f_nxt;
388 }
389
390 /*
391 * Leverage partial checksum offload for simple UDP/IP fragments,
392 * as that is the most common case.
393 *
394 * Perform 1's complement adjustment of octets that got included/
395 * excluded in the hardware-calculated checksum value. Also take
396 * care of any trailing bytes and subtract out their partial sum.
397 */
398 if (ip6f->ip6f_nxt == IPPROTO_UDP &&
399 offset == (sizeof(*ip6) + sizeof(*ip6f)) &&
400 (m->m_pkthdr.csum_flags &
401 (CSUM_DATA_VALID | CSUM_PARTIAL | CSUM_PSEUDO_HDR)) ==
402 (CSUM_DATA_VALID | CSUM_PARTIAL)) {
403 uint32_t start = m->m_pkthdr.csum_rx_start;
404 uint32_t ip_len = (sizeof(*ip6) + ntohs(ip6->ip6_plen));
405 int32_t trailer = (m_pktlen(m) - ip_len);
406 uint32_t swbytes = (uint32_t)trailer;
407
408 csum = m->m_pkthdr.csum_rx_val;
409
410 ASSERT(trailer >= 0);
411 if (start != offset || trailer != 0) {
412 uint16_t s = 0, d = 0;
413
414 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
415 s = ip6->ip6_src.s6_addr16[1];
416 ip6->ip6_src.s6_addr16[1] = 0;
417 }
418 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
419 d = ip6->ip6_dst.s6_addr16[1];
420 ip6->ip6_dst.s6_addr16[1] = 0;
421 }
422
423 /* callee folds in sum */
424 csum = m_adj_sum16(m, start, offset,
425 (ip_len - offset), csum);
426 if (offset > start) {
427 swbytes += (offset - start);
428 } else {
429 swbytes += (start - offset);
430 }
431
432 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
433 ip6->ip6_src.s6_addr16[1] = s;
434 }
435 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
436 ip6->ip6_dst.s6_addr16[1] = d;
437 }
438 }
439 csum_flags = m->m_pkthdr.csum_flags;
440
441 if (swbytes != 0) {
442 udp_in6_cksum_stats(swbytes);
443 }
444 if (trailer != 0) {
445 m_adj(m, -trailer);
446 }
447 } else {
448 csum = 0;
449 csum_flags = 0;
450 }
451
452 /* Invalidate checksum */
453 m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
454
455 ip6stat.ip6s_fragments++;
456 in6_ifstat_inc(dstifp, ifs6_reass_reqd);
457
458 lck_mtx_lock(&ip6qlock);
459 locked = 1;
460
461 for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next) {
462 if (ip6f->ip6f_ident == q6->ip6q_ident &&
463 in6_are_addr_equal_scoped(&ip6->ip6_src, &q6->ip6q_src, ip6_input_getsrcifscope(m), q6->ip6q_src_ifscope) &&
464 in6_are_addr_equal_scoped(&ip6->ip6_dst, &q6->ip6q_dst, ip6_input_getdstifscope(m), q6->ip6q_dst_ifscope)) {
465 break;
466 }
467 }
468
469 if (q6 == &ip6q) {
470 /*
471 * Create a reassembly queue as this is the first fragment to
472 * arrive.
473 * By first frag, we don't mean the one with offset 0, but
474 * any of the fragments of the fragmented packet that has
475 * reached us first.
476 */
477 first_frag = 1;
478
479 q6 = ip6q_alloc();
480 if (q6 == NULL) {
481 drop_reason = DROP_REASON_IP_FRAG_TOO_MANY;
482 goto dropfrag;
483 }
484
485 frag6_insque(q6, &ip6q);
486 frag6_nfragpackets++;
487
488 /* ip6q_nxt will be filled afterwards, from 1st fragment */
489 q6->ip6q_down = q6->ip6q_up = (struct ip6asfrag *)q6;
490 #ifdef notyet
491 q6->ip6q_nxtp = (u_char *)nxtp;
492 #endif
493 q6->ip6q_ident = ip6f->ip6f_ident;
494 q6->ip6q_ttl = IPV6_FRAGTTL;
495 q6->ip6q_src = ip6->ip6_src;
496 q6->ip6q_dst = ip6->ip6_dst;
497 q6->ip6q_dst_ifscope = IN6_IS_SCOPE_EMBED(&q6->ip6q_dst) ? ip6_input_getdstifscope(m) : IFSCOPE_NONE;
498 q6->ip6q_src_ifscope = IN6_IS_SCOPE_EMBED(&q6->ip6q_src) ? ip6_input_getsrcifscope(m) : IFSCOPE_NONE;
499 q6->ip6q_ecn =
500 (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
501 q6->ip6q_unfrglen = -1; /* The 1st fragment has not arrived. */
502
503 q6->ip6q_nfrag = 0;
504 q6->ip6q_flags = 0;
505
506 /*
507 * If the first fragment has valid checksum offload
508 * info, the rest of fragments are eligible as well.
509 */
510 if (csum_flags != 0) {
511 q6->ip6q_csum = csum;
512 q6->ip6q_csum_flags = csum_flags;
513 }
514 }
515
516 if (q6->ip6q_flags & IP6QF_DIRTY) {
517 drop_reason = DROP_REASON_IP6_FRAG_OVERLAPPING;
518 goto dropfrag;
519 }
520
521 local_ip6q_unfrglen = q6->ip6q_unfrglen;
522 local_ip6q_nxt = q6->ip6q_nxt;
523
524 /*
525 * If it's the 1st fragment, record the length of the
526 * unfragmentable part and the next header of the fragment header.
527 * Assume the first fragement to arrive will be correct.
528 * We do not have any duplicate checks here yet so another packet
529 * with fragoff == 0 could come and overwrite the ip6q_unfrglen
530 * and worse, the next header, at any time.
531 */
532 fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
533 if (fragoff == 0 && local_ip6q_unfrglen == -1) {
534 local_ip6q_unfrglen = offset - sizeof(struct ip6_hdr) -
535 sizeof(struct ip6_frag);
536 local_ip6q_nxt = ip6f->ip6f_nxt;
537 /* XXX ECN? */
538 }
539
540 /*
541 * Check that the reassembled packet would not exceed 65535 bytes
542 * in size.
543 * If it would exceed, discard the fragment and return an ICMP error.
544 */
545 frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
546 if (local_ip6q_unfrglen >= 0) {
547 /* The 1st fragment has already arrived. */
548 if (local_ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
549 lck_mtx_unlock(&ip6qlock);
550 locked = 0;
551 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
552 offset - sizeof(struct ip6_frag) +
553 offsetof(struct ip6_frag, ip6f_offlg));
554 m = NULL;
555 goto done;
556 }
557 } else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
558 lck_mtx_unlock(&ip6qlock);
559 locked = 0;
560 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
561 offset - sizeof(struct ip6_frag) +
562 offsetof(struct ip6_frag, ip6f_offlg));
563 m = NULL;
564 goto done;
565 }
566 /*
567 * If it's the first fragment, do the above check for each
568 * fragment already stored in the reassembly queue.
569 */
570 if (fragoff == 0) {
571 /*
572 * https://tools.ietf.org/html/rfc8200#page-20
573 * If the first fragment does not include all headers through an
574 * Upper-Layer header, then that fragment should be discarded and
575 * an ICMP Parameter Problem, Code 3, message should be sent to
576 * the source of the fragment, with the Pointer field set to zero.
577 */
578 if (!ip6_pkt_has_ulp(m)) {
579 lck_mtx_unlock(&ip6qlock);
580 locked = 0;
581 icmp6_error(m, ICMP6_PARAM_PROB,
582 ICMP6_PARAMPROB_FIRSTFRAG_INCOMP_HDR, 0);
583 m = NULL;
584 goto done;
585 }
586 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
587 af6 = af6dwn) {
588 af6dwn = af6->ip6af_down;
589
590 if (local_ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
591 IPV6_MAXPACKET) {
592 mbuf_ref_t merr = IP6_REASS_MBUF(af6);
593 struct ip6_hdr *__single ip6err;
594 int erroff = af6->ip6af_offset;
595
596 /* dequeue the fragment. */
597 frag6_deq(af6);
598 ip6af_free(af6);
599
600 /* adjust pointer. */
601 ip6err = mtod(merr, struct ip6_hdr *);
602
603 /*
604 * Restore source and destination addresses
605 * in the erroneous IPv6 header.
606 */
607 ip6err->ip6_src = q6->ip6q_src;
608 ip6err->ip6_dst = q6->ip6q_dst;
609 ip6_output_setdstifscope(m, q6->ip6q_dst_ifscope, NULL);
610 ip6_output_setsrcifscope(m, q6->ip6q_src_ifscope, NULL);
611 frag6_save_context(merr,
612 erroff - sizeof(struct ip6_frag) +
613 offsetof(struct ip6_frag, ip6f_offlg));
614
615 MBUFQ_ENQUEUE(&diq6, merr);
616 }
617 }
618 }
619
620 ip6af = ip6af_alloc();
621 if (ip6af == NULL) {
622 drop_reason = DROP_REASON_IP_FRAG_TOO_MANY;
623 goto dropfrag;
624 }
625
626 ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG;
627 ip6af->ip6af_off = fragoff;
628 ip6af->ip6af_frglen = frgpartlen;
629 ip6af->ip6af_offset = offset;
630 IP6_REASS_MBUF(ip6af) = m;
631
632 if (first_frag) {
633 af6 = (struct ip6asfrag *)q6;
634 goto insert;
635 }
636
637 /*
638 * Handle ECN by comparing this segment with the first one;
639 * if CE is set, do not lose CE.
640 * drop if CE and not-ECT are mixed for the same packet.
641 */
642 ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
643 ecn0 = q6->ip6q_ecn;
644 if (ecn == IPTOS_ECN_CE) {
645 if (ecn0 == IPTOS_ECN_NOTECT) {
646 ip6af_free(ip6af);
647 drop_reason = DROP_REASON_IP6_FRAG_MIXED_CE;
648 goto dropfrag;
649 }
650 if (ecn0 != IPTOS_ECN_CE) {
651 q6->ip6q_ecn = IPTOS_ECN_CE;
652 }
653 }
654 if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) {
655 ip6af_free(ip6af);
656 drop_reason = DROP_REASON_IP6_FRAG_MIXED_CE;
657 goto dropfrag;
658 }
659
660 /*
661 * Find a segment which begins after this one does.
662 */
663 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
664 af6 = af6->ip6af_down) {
665 if (af6->ip6af_off > ip6af->ip6af_off) {
666 break;
667 }
668 }
669
670 /*
671 * As per RFC 8200 reassembly rules, we MUST drop the entire
672 * chain of fragments for a packet to be assembled, if we receive
673 * any overlapping fragments.
674 * https://tools.ietf.org/html/rfc8200#page-20
675 *
676 * To avoid more conditional code, just reuse frag6_freef and defer
677 * its call to post fragment insertion in the queue.
678 */
679 if (af6->ip6af_up != (struct ip6asfrag *)q6) {
680 if (af6->ip6af_up->ip6af_off == ip6af->ip6af_off) {
681 if (af6->ip6af_up->ip6af_frglen != ip6af->ip6af_frglen) {
682 drop_fragq = TRUE;
683 } else {
684 /*
685 * XXX Ideally we should be comparing the entire
686 * packet here but for now just use off and fraglen
687 * to ignore a duplicate fragment.
688 */
689 ip6af_free(ip6af);
690 drop_reason = DROP_REASON_IP6_FRAG_OVERLAPPING;
691 goto dropfrag;
692 }
693 } else {
694 i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
695 - ip6af->ip6af_off;
696 if (i > 0) {
697 drop_fragq = TRUE;
698 }
699 }
700 }
701
702 if (af6 != (struct ip6asfrag *)q6) {
703 /*
704 * Given that we break when af6->ip6af_off > ip6af->ip6af_off,
705 * we shouldn't need a check for duplicate fragment here.
706 * For now just assert.
707 */
708 VERIFY(af6->ip6af_off != ip6af->ip6af_off);
709 i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
710 if (i > 0) {
711 drop_fragq = TRUE;
712 }
713 }
714
715 /*
716 * If this fragment contains similar checksum offload info
717 * as that of the existing ones, accumulate checksum. Otherwise,
718 * invalidate checksum offload info for the entire datagram.
719 */
720 if (csum_flags != 0 && csum_flags == q6->ip6q_csum_flags) {
721 q6->ip6q_csum += csum;
722 } else if (q6->ip6q_csum_flags != 0) {
723 q6->ip6q_csum_flags = 0;
724 }
725
726 insert:
727 /*
728 * Stick new segment in its place;
729 * check for complete reassembly.
730 * Move to front of packet queue, as we are
731 * the most recently active fragmented packet.
732 */
733 frag6_enq(ip6af, af6->ip6af_up);
734 frag6_nfrags++;
735 q6->ip6q_nfrag++;
736
737 /*
738 * This holds true, when we receive overlapping fragments.
739 * We must silently drop all the fragments we have received
740 * so far.
741 * Also mark q6 as dirty, so as to not add any new fragments to it.
742 * Make sure even q6 marked dirty is kept till timer expires for
743 * reassembly and when that happens, silenty get rid of q6
744 */
745 if (drop_fragq) {
746 struct fq6_head dfq6 = {0};
747 MBUFQ_INIT(&dfq6); /* for deferred frees */
748 q6->ip6q_flags |= IP6QF_DIRTY;
749 /* Purge all the fragments but do not free q6 */
750 frag6_purgef(q6, &dfq6, NULL);
751 af6 = NULL;
752
753 /* free fragments that need to be freed */
754 if (!MBUFQ_EMPTY(&dfq6)) {
755 MBUFQ_DROP_AND_DRAIN(&dfq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP6_FRAG_OVERLAPPING);
756 }
757 VERIFY(MBUFQ_EMPTY(&dfq6));
758 /*
759 * Just in case the above logic got anything added
760 * to diq6, drain it.
761 * Please note that these mbufs are not present in the
762 * fragment queue and are added to diq6 for sending
763 * ICMPv6 error.
764 * Given that the current fragment was an overlapping
765 * fragment and the RFC requires us to not send any
766 * ICMPv6 errors while purging the entire queue.
767 * Just empty it out.
768 */
769 if (!MBUFQ_EMPTY(&diq6)) {
770 MBUFQ_DROP_AND_DRAIN(&diq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP6_FRAG_OVERLAPPING);
771 }
772 VERIFY(MBUFQ_EMPTY(&diq6));
773 /*
774 * MBUFQ_DRAIN would have drained all the mbufs
775 * in the fragment queue.
776 * This shouldn't be needed as we are returning IPPROTO_DONE
777 * from here but change the passed mbuf pointer to NULL.
778 */
779 *mp = NULL;
780 lck_mtx_unlock(&ip6qlock);
781 return IPPROTO_DONE;
782 }
783
784 /*
785 * We're keeping the fragment.
786 */
787 q6->ip6q_unfrglen = local_ip6q_unfrglen;
788 q6->ip6q_nxt = local_ip6q_nxt;
789
790 next = 0;
791 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
792 af6 = af6->ip6af_down) {
793 if (af6->ip6af_off != next) {
794 lck_mtx_unlock(&ip6qlock);
795 locked = 0;
796 m = NULL;
797 goto done;
798 }
799 next += af6->ip6af_frglen;
800 }
801 if (af6->ip6af_up->ip6af_mff) {
802 lck_mtx_unlock(&ip6qlock);
803 locked = 0;
804 m = NULL;
805 goto done;
806 }
807
808 /*
809 * Reassembly is complete; concatenate fragments.
810 */
811 ip6af = q6->ip6q_down;
812 t = m = IP6_REASS_MBUF(ip6af);
813 af6 = ip6af->ip6af_down;
814 frag6_deq(ip6af);
815 while (af6 != (struct ip6asfrag *)q6) {
816 af6dwn = af6->ip6af_down;
817 frag6_deq(af6);
818 while (t->m_next) {
819 t = t->m_next;
820 }
821 t->m_next = IP6_REASS_MBUF(af6);
822 m_adj(t->m_next, af6->ip6af_offset);
823 ip6af_free(af6);
824 af6 = af6dwn;
825 }
826
827 /*
828 * Store partial hardware checksum info from the fragment queue;
829 * the receive start offset is set to 40 bytes (see code at the
830 * top of this routine.)
831 */
832 if (q6->ip6q_csum_flags != 0) {
833 csum = q6->ip6q_csum;
834
835 ADDCARRY(csum);
836
837 m->m_pkthdr.csum_rx_val = (u_int16_t)csum;
838 m->m_pkthdr.csum_rx_start = sizeof(struct ip6_hdr);
839 m->m_pkthdr.csum_flags = q6->ip6q_csum_flags;
840 } else if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) ||
841 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) {
842 /* loopback checksums are always OK */
843 m->m_pkthdr.csum_data = 0xffff;
844 m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
845 }
846
847 /* adjust offset to point where the original next header starts */
848 offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
849 ip6af_free(ip6af);
850 ip6 = mtod(m, struct ip6_hdr *);
851 ip6->ip6_plen = htons((uint16_t)(next + offset - sizeof(struct ip6_hdr)));
852 ip6->ip6_src = q6->ip6q_src;
853 ip6->ip6_dst = q6->ip6q_dst;
854 ip6_output_setdstifscope(m, q6->ip6q_dst_ifscope, NULL);
855 ip6_output_setsrcifscope(m, q6->ip6q_src_ifscope, NULL);
856 if (q6->ip6q_ecn == IPTOS_ECN_CE) {
857 ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20);
858 }
859
860 nxt = q6->ip6q_nxt;
861 #ifdef notyet
862 *q6->ip6q_nxtp = (u_char)(nxt & 0xff);
863 #endif
864
865 /* Delete frag6 header */
866 if (m->m_len >= offset + sizeof(struct ip6_frag)) {
867 /* This is the only possible case with !PULLDOWN_TEST */
868 ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag),
869 offset);
870 m->m_data += sizeof(struct ip6_frag);
871 m->m_len -= sizeof(struct ip6_frag);
872 } else {
873 /* this comes with no copy if the boundary is on cluster */
874 if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) {
875 frag6_remque(q6);
876 frag6_nfragpackets--;
877 frag6_nfrags -= q6->ip6q_nfrag;
878 ip6q_free(q6);
879 goto dropfrag;
880 }
881 m_adj(t, sizeof(struct ip6_frag));
882 m_cat(m, t);
883 }
884
885 /*
886 * Store NXT to the original.
887 */
888 {
889 char *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */
890 *prvnxtp = nxt;
891 }
892
893 frag6_remque(q6);
894 frag6_nfragpackets--;
895 frag6_nfrags -= q6->ip6q_nfrag;
896 ip6q_free(q6);
897
898 if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */
899 m_fixhdr(m);
900 /*
901 * Mark packet as reassembled
902 * In ICMPv6 processing, we drop certain
903 * NDP messages that are not expected to
904 * have fragment header based on recommendations
905 * against security vulnerability as described in
906 * RFC 6980.
907 */
908 m->m_pkthdr.pkt_flags |= PKTF_REASSEMBLED;
909 }
910 ip6stat.ip6s_reassembled++;
911
912 /*
913 * Tell launch routine the next header
914 */
915 *mp = m;
916 *offp = offset;
917
918 /* arm the purge timer if not already and if there's work to do */
919 frag6_sched_timeout();
920 lck_mtx_unlock(&ip6qlock);
921 in6_ifstat_inc(dstifp, ifs6_reass_ok);
922 frag6_icmp6_paramprob_error(&diq6);
923 VERIFY(MBUFQ_EMPTY(&diq6));
924 return nxt;
925
926 done:
927 VERIFY(m == NULL);
928 *mp = m;
929 if (!locked) {
930 if (frag6_nfragpackets == 0) {
931 frag6_icmp6_paramprob_error(&diq6);
932 VERIFY(MBUFQ_EMPTY(&diq6));
933 return IPPROTO_DONE;
934 }
935 lck_mtx_lock(&ip6qlock);
936 }
937 /* arm the purge timer if not already and if there's work to do */
938 frag6_sched_timeout();
939 lck_mtx_unlock(&ip6qlock);
940 frag6_icmp6_paramprob_error(&diq6);
941 VERIFY(MBUFQ_EMPTY(&diq6));
942 return IPPROTO_DONE;
943
944 dropfrag:
945 ip6stat.ip6s_fragdropped++;
946 /* arm the purge timer if not already and if there's work to do */
947 frag6_sched_timeout();
948 lck_mtx_unlock(&ip6qlock);
949 in6_ifstat_inc(dstifp, ifs6_reass_fail);
950 m_drop(m, DROPTAP_FLAG_DIR_IN | DROPTAP_FLAG_L2_MISSING, drop_reason, NULL, 0);
951 *mp = NULL;
952 frag6_icmp6_paramprob_error(&diq6);
953 VERIFY(MBUFQ_EMPTY(&diq6));
954 return IPPROTO_DONE;
955 }
956
957 /*
958 * This routine removes the enqueued frames from the passed fragment
959 * header and enqueues those to dfq6 which is an out-arg for the dequeued
960 * fragments.
961 * If the caller also provides diq6, this routine also enqueues the 0 offset
962 * fragment to that list as it potentially gets used by the caller
963 * to prepare the relevant ICMPv6 error message (time exceeded or
964 * param problem).
965 * It leaves the fragment header object (q6) intact.
966 */
967 static void
frag6_purgef(struct ip6q * q6,struct fq6_head * dfq6,struct fq6_head * diq6)968 frag6_purgef(struct ip6q *q6, struct fq6_head *dfq6, struct fq6_head *diq6)
969 {
970 struct ip6asfrag *__single af6 = NULL;
971 struct ip6asfrag *__single down6 = NULL;
972
973 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
974
975 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
976 af6 = down6) {
977 mbuf_ref_t m = IP6_REASS_MBUF(af6);
978
979 down6 = af6->ip6af_down;
980 frag6_deq(af6);
981
982 /*
983 * If caller wants to generate ICMP time-exceeded,
984 * as indicated by the argument diq6, return it for
985 * the first fragment and add others to the fragment
986 * free queue.
987 */
988 if (af6->ip6af_off == 0 && diq6 != NULL) {
989 struct ip6_hdr *__single ip6;
990
991 /* adjust pointer */
992 ip6 = mtod(m, struct ip6_hdr *);
993
994 /* restore source and destination addresses */
995 ip6->ip6_src = q6->ip6q_src;
996 ip6->ip6_dst = q6->ip6q_dst;
997 ip6_output_setdstifscope(m, q6->ip6q_dst_ifscope, NULL);
998 ip6_output_setsrcifscope(m, q6->ip6q_src_ifscope, NULL);
999 MBUFQ_ENQUEUE(diq6, m);
1000 } else {
1001 MBUFQ_ENQUEUE(dfq6, m);
1002 }
1003 ip6af_free(af6);
1004 }
1005 }
1006
1007 /*
1008 * This routine removes the enqueued frames from the passed fragment
1009 * header and enqueues those to dfq6 which is an out-arg for the dequeued
1010 * fragments.
1011 * If the caller also provides diq6, this routine also enqueues the 0 offset
1012 * fragment to that list as it potentially gets used by the caller
1013 * to prepare the relevant ICMPv6 error message (time exceeded or
1014 * param problem).
1015 * It also remove the fragment header object from the queue and frees it.
1016 */
1017 static void
frag6_freef(struct ip6q * q6,struct fq6_head * dfq6,struct fq6_head * diq6)1018 frag6_freef(struct ip6q *q6, struct fq6_head *dfq6, struct fq6_head *diq6)
1019 {
1020 frag6_purgef(q6, dfq6, diq6);
1021 frag6_remque(q6);
1022 frag6_nfragpackets--;
1023 frag6_nfrags -= q6->ip6q_nfrag;
1024 ip6q_free(q6);
1025 }
1026
1027 /*
1028 * Put an ip fragment on a reassembly chain.
1029 * Like insque, but pointers in middle of structure.
1030 */
1031 void
frag6_enq(struct ip6asfrag * af6,struct ip6asfrag * up6)1032 frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
1033 {
1034 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1035
1036 af6->ip6af_up = up6;
1037 af6->ip6af_down = up6->ip6af_down;
1038 up6->ip6af_down->ip6af_up = af6;
1039 up6->ip6af_down = af6;
1040 }
1041
1042 /*
1043 * To frag6_enq as remque is to insque.
1044 */
1045 void
frag6_deq(struct ip6asfrag * af6)1046 frag6_deq(struct ip6asfrag *af6)
1047 {
1048 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1049
1050 af6->ip6af_up->ip6af_down = af6->ip6af_down;
1051 af6->ip6af_down->ip6af_up = af6->ip6af_up;
1052 }
1053
1054 void
frag6_insque(struct ip6q * new,struct ip6q * old)1055 frag6_insque(struct ip6q *new, struct ip6q *old)
1056 {
1057 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1058
1059 new->ip6q_prev = old;
1060 new->ip6q_next = old->ip6q_next;
1061 old->ip6q_next->ip6q_prev = new;
1062 old->ip6q_next = new;
1063 }
1064
1065 void
frag6_remque(struct ip6q * p6)1066 frag6_remque(struct ip6q *p6)
1067 {
1068 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1069
1070 p6->ip6q_prev->ip6q_next = p6->ip6q_next;
1071 p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
1072 }
1073
1074 /*
1075 * IPv6 reassembling timer processing;
1076 * if a timer expires on a reassembly
1077 * queue, discard it.
1078 */
1079 static void
frag6_timeout(void * arg)1080 frag6_timeout(void *arg)
1081 {
1082 #pragma unused(arg)
1083 struct fq6_head dfq6, diq6;
1084 struct fq6_head *__single diq6_tmp = NULL;
1085 struct ip6q *__single q6;
1086
1087 MBUFQ_INIT(&dfq6); /* for deferred frees */
1088 MBUFQ_INIT(&diq6); /* for deferred ICMP time exceeded errors */
1089
1090 /*
1091 * Update coarse-grained networking timestamp (in sec.); the idea
1092 * is to piggy-back on the timeout callout to update the counter
1093 * returnable via net_uptime().
1094 */
1095 net_update_uptime();
1096
1097 lck_mtx_lock(&ip6qlock);
1098 q6 = ip6q.ip6q_next;
1099 if (q6) {
1100 while (q6 != &ip6q) {
1101 --q6->ip6q_ttl;
1102 q6 = q6->ip6q_next;
1103 if (q6->ip6q_prev->ip6q_ttl == 0) {
1104 ip6stat.ip6s_fragtimeout++;
1105 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
1106 /*
1107 * Avoid sending ICMPv6 Time Exceeded for fragment headers
1108 * that are marked dirty.
1109 */
1110 diq6_tmp = (q6->ip6q_prev->ip6q_flags & IP6QF_DIRTY) ?
1111 NULL : &diq6;
1112 frag6_freef(q6->ip6q_prev, &dfq6, diq6_tmp);
1113 }
1114 }
1115 }
1116 /*
1117 * If we are over the maximum number of fragments
1118 * (due to the limit being lowered), drain off
1119 * enough to get down to the new limit.
1120 */
1121 if (ip6_maxfragpackets >= 0) {
1122 while (frag6_nfragpackets > (unsigned)ip6_maxfragpackets &&
1123 ip6q.ip6q_prev) {
1124 ip6stat.ip6s_fragoverflow++;
1125 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
1126 /*
1127 * Avoid sending ICMPv6 Time Exceeded for fragment headers
1128 * that are marked dirty.
1129 */
1130 diq6_tmp = (ip6q.ip6q_prev->ip6q_flags & IP6QF_DIRTY) ?
1131 NULL : &diq6;
1132 frag6_freef(ip6q.ip6q_prev, &dfq6, diq6_tmp);
1133 }
1134 }
1135 /* re-arm the purge timer if there's work to do */
1136 frag6_timeout_run = 0;
1137 frag6_sched_timeout();
1138 lck_mtx_unlock(&ip6qlock);
1139
1140 /* free fragments that need to be freed */
1141 if (!MBUFQ_EMPTY(&dfq6)) {
1142 MBUFQ_DROP_AND_DRAIN(&dfq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP_FRAG_TIMEOUT);
1143 }
1144
1145 frag6_icmp6_timeex_error(&diq6);
1146
1147 VERIFY(MBUFQ_EMPTY(&dfq6));
1148 VERIFY(MBUFQ_EMPTY(&diq6));
1149 }
1150
1151 static void
frag6_sched_timeout(void)1152 frag6_sched_timeout(void)
1153 {
1154 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1155
1156 if (!frag6_timeout_run && frag6_nfragpackets > 0) {
1157 frag6_timeout_run = 1;
1158 timeout(frag6_timeout, NULL, hz);
1159 }
1160 }
1161
1162 /*
1163 * Drain off all datagram fragments.
1164 */
1165 void
frag6_drain(void)1166 frag6_drain(void)
1167 {
1168 struct fq6_head dfq6, diq6;
1169 struct fq6_head *__single diq6_tmp = NULL;
1170
1171 MBUFQ_INIT(&dfq6); /* for deferred frees */
1172 MBUFQ_INIT(&diq6); /* for deferred ICMP time exceeded errors */
1173
1174 lck_mtx_lock(&ip6qlock);
1175 while (ip6q.ip6q_next != &ip6q) {
1176 ip6stat.ip6s_fragdropped++;
1177 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
1178 /*
1179 * Avoid sending ICMPv6 Time Exceeded for fragment headers
1180 * that are marked dirty.
1181 */
1182 diq6_tmp = (ip6q.ip6q_next->ip6q_flags & IP6QF_DIRTY) ?
1183 NULL : &diq6;
1184 frag6_freef(ip6q.ip6q_next, &dfq6, diq6_tmp);
1185 }
1186 lck_mtx_unlock(&ip6qlock);
1187
1188 /* free fragments that need to be freed */
1189 if (!MBUFQ_EMPTY(&dfq6)) {
1190 MBUFQ_DROP_AND_DRAIN(&dfq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP_FRAG_DRAINED);
1191 }
1192
1193 frag6_icmp6_timeex_error(&diq6);
1194
1195 VERIFY(MBUFQ_EMPTY(&dfq6));
1196 VERIFY(MBUFQ_EMPTY(&diq6));
1197 }
1198
1199 static struct ip6q *
ip6q_alloc(void)1200 ip6q_alloc(void)
1201 {
1202 struct ip6q *__single q6;
1203
1204 /*
1205 * See comments in ip6q_updateparams(). Keep the count separate
1206 * from frag6_nfragpackets since the latter represents the elements
1207 * already in the reassembly queues.
1208 */
1209 if (ip6q_limit > 0 && ip6q_count > ip6q_limit) {
1210 return NULL;
1211 }
1212
1213 q6 = kalloc_type(struct ip6q, Z_NOWAIT | Z_ZERO);
1214 if (q6 != NULL) {
1215 os_atomic_inc(&ip6q_count, relaxed);
1216 }
1217 return q6;
1218 }
1219
1220 static void
ip6q_free(struct ip6q * q6)1221 ip6q_free(struct ip6q *q6)
1222 {
1223 kfree_type(struct ip6q, q6);
1224 os_atomic_dec(&ip6q_count, relaxed);
1225 }
1226
1227 static struct ip6asfrag *
ip6af_alloc(void)1228 ip6af_alloc(void)
1229 {
1230 struct ip6asfrag *__single af6;
1231
1232 /*
1233 * See comments in ip6q_updateparams(). Keep the count separate
1234 * from frag6_nfrags since the latter represents the elements
1235 * already in the reassembly queues.
1236 */
1237 if (ip6af_limit > 0 && ip6af_count > ip6af_limit) {
1238 return NULL;
1239 }
1240
1241 af6 = kalloc_type(struct ip6asfrag, Z_NOWAIT | Z_ZERO);
1242 if (af6 != NULL) {
1243 os_atomic_inc(&ip6af_count, relaxed);
1244 }
1245 return af6;
1246 }
1247
1248 static void
ip6af_free(struct ip6asfrag * af6)1249 ip6af_free(struct ip6asfrag *af6)
1250 {
1251 kfree_type(struct ip6asfrag, af6);
1252 os_atomic_dec(&ip6af_count, relaxed);
1253 }
1254
1255 static void
ip6q_updateparams(void)1256 ip6q_updateparams(void)
1257 {
1258 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1259 /*
1260 * -1 for unlimited allocation.
1261 */
1262 if (ip6_maxfragpackets < 0) {
1263 ip6q_limit = 0;
1264 }
1265 if (ip6_maxfrags < 0) {
1266 ip6af_limit = 0;
1267 }
1268 /*
1269 * Positive number for specific bound.
1270 */
1271 if (ip6_maxfragpackets > 0) {
1272 ip6q_limit = ip6_maxfragpackets;
1273 }
1274 if (ip6_maxfrags > 0) {
1275 ip6af_limit = ip6_maxfrags;
1276 }
1277 /*
1278 * Zero specifies no further fragment queue allocation -- set the
1279 * bound very low, but rely on implementation elsewhere to actually
1280 * prevent allocation and reclaim current queues.
1281 */
1282 if (ip6_maxfragpackets == 0) {
1283 ip6q_limit = 1;
1284 }
1285 if (ip6_maxfrags == 0) {
1286 ip6af_limit = 1;
1287 }
1288 /*
1289 * Arm the purge timer if not already and if there's work to do
1290 */
1291 frag6_sched_timeout();
1292 }
1293
1294 static int
1295 sysctl_maxfragpackets SYSCTL_HANDLER_ARGS
1296 {
1297 #pragma unused(arg1, arg2)
1298 int error, i;
1299
1300 lck_mtx_lock(&ip6qlock);
1301 i = ip6_maxfragpackets;
1302 error = sysctl_handle_int(oidp, &i, 0, req);
1303 if (error || req->newptr == USER_ADDR_NULL) {
1304 goto done;
1305 }
1306 /* impose bounds */
1307 if (i < -1) {
1308 error = EINVAL;
1309 goto done;
1310 }
1311 ip6_maxfragpackets = i;
1312 ip6q_updateparams();
1313 done:
1314 lck_mtx_unlock(&ip6qlock);
1315 return error;
1316 }
1317
1318 static int
1319 sysctl_maxfrags SYSCTL_HANDLER_ARGS
1320 {
1321 #pragma unused(arg1, arg2)
1322 int error, i;
1323
1324 lck_mtx_lock(&ip6qlock);
1325 i = ip6_maxfrags;
1326 error = sysctl_handle_int(oidp, &i, 0, req);
1327 if (error || req->newptr == USER_ADDR_NULL) {
1328 goto done;
1329 }
1330 /* impose bounds */
1331 if (i < -1) {
1332 error = EINVAL;
1333 goto done;
1334 }
1335 ip6_maxfrags = i;
1336 ip6q_updateparams(); /* see if we need to arm timer */
1337 done:
1338 lck_mtx_unlock(&ip6qlock);
1339 return error;
1340 }
1341