1 /*
2 * Copyright (c) 2000-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $FreeBSD: src/sys/netinet6/frag6.c,v 1.2.2.5 2001/07/03 11:01:50 ume Exp $ */
30 /* $KAME: frag6.c,v 1.31 2001/05/17 13:45:34 jinmei Exp $ */
31
32 /*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61 #include <sys/param.h>
62 #include <sys/systm.h>
63 #include <sys/malloc.h>
64 #include <sys/mcache.h>
65 #include <sys/mbuf.h>
66 #include <sys/domain.h>
67 #include <sys/protosw.h>
68 #include <sys/socket.h>
69 #include <sys/errno.h>
70 #include <sys/time.h>
71 #include <sys/kernel.h>
72 #include <sys/syslog.h>
73 #include <kern/queue.h>
74 #include <kern/locks.h>
75
76 #include <net/droptap.h>
77 #include <net/if.h>
78 #include <net/route.h>
79
80 #include <netinet/in.h>
81 #include <netinet/in_var.h>
82 #include <netinet/ip.h>
83 #include <netinet/ip_var.h>
84 #include <netinet/ip6.h>
85 #include <netinet6/ip6_var.h>
86 #include <netinet/icmp6.h>
87
88 #include <net/net_osdep.h>
89 #include <dev/random/randomdev.h>
90
91 /*
92 * Define it to get a correct behavior on per-interface statistics.
93 */
94 #define IN6_IFSTAT_STRICT
95 struct ip6asfrag {
96 struct ip6asfrag *ip6af_down;
97 struct ip6asfrag *ip6af_up;
98 struct mbuf *ip6af_m;
99 int ip6af_offset; /* offset in ip6af_m to next header */
100 int ip6af_frglen; /* fragmentable part length */
101 int ip6af_off; /* fragment offset */
102 u_int16_t ip6af_mff; /* more fragment bit in frag off */
103 };
104
105 #define IP6_REASS_MBUF(ip6af) ((ip6af)->ip6af_m)
106
107 MBUFQ_HEAD(fq6_head);
108
109 static void frag6_save_context(struct mbuf *, uintptr_t);
110 static void frag6_scrub_context(struct mbuf *);
111 static int frag6_restore_context(struct mbuf *);
112
113 static void frag6_icmp6_paramprob_error(struct fq6_head *);
114 static void frag6_icmp6_timeex_error(struct fq6_head *);
115
116 static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *);
117 static void frag6_deq(struct ip6asfrag *);
118 static void frag6_insque(struct ip6q *, struct ip6q *);
119 static void frag6_remque(struct ip6q *);
120 static void frag6_purgef(struct ip6q *, struct fq6_head *, struct fq6_head *);
121 static void frag6_freef(struct ip6q *, struct fq6_head *, struct fq6_head *);
122
123 static int frag6_timeout_run; /* frag6 timer is scheduled to run */
124 static void frag6_timeout(void *);
125 static void frag6_sched_timeout(void);
126
127 static struct ip6q *ip6q_alloc(void);
128 static void ip6q_free(struct ip6q *);
129 static void ip6q_updateparams(void);
130 static struct ip6asfrag *ip6af_alloc(void);
131 static void ip6af_free(struct ip6asfrag *);
132
133 static LCK_GRP_DECLARE(ip6qlock_grp, "ip6qlock");
134 static LCK_MTX_DECLARE(ip6qlock, &ip6qlock_grp);
135
136 /* IPv6 fragment reassembly queues (protected by ip6qlock) */
137 static struct ip6q ip6q; /* ip6 reassembly queues */
138 static int ip6_maxfragpackets; /* max packets in reass queues */
139 static u_int32_t frag6_nfragpackets; /* # of packets in reass queues */
140 static int ip6_maxfrags; /* max fragments in reass queues */
141 static u_int32_t frag6_nfrags; /* # of fragments in reass queues */
142 static u_int32_t ip6q_limit; /* ip6q allocation limit */
143 static u_int32_t ip6q_count; /* current # of allocated ip6q's */
144 static u_int32_t ip6af_limit; /* ip6asfrag allocation limit */
145 static u_int32_t ip6af_count; /* current # of allocated ip6asfrag's */
146
147 static int sysctl_maxfragpackets SYSCTL_HANDLER_ARGS;
148 static int sysctl_maxfrags SYSCTL_HANDLER_ARGS;
149
150 SYSCTL_DECL(_net_inet6_ip6);
151
152 SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGPACKETS, maxfragpackets,
153 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxfragpackets, 0,
154 sysctl_maxfragpackets, "I",
155 "Maximum number of IPv6 fragment reassembly queue entries");
156
157 SYSCTL_UINT(_net_inet6_ip6, OID_AUTO, fragpackets,
158 CTLFLAG_RD | CTLFLAG_LOCKED, &frag6_nfragpackets, 0,
159 "Current number of IPv6 fragment reassembly queue entries");
160
161 SYSCTL_PROC(_net_inet6_ip6, IPV6CTL_MAXFRAGS, maxfrags,
162 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxfrags, 0,
163 sysctl_maxfrags, "I", "Maximum number of IPv6 fragments allowed");
164
165 /*
166 * Initialise reassembly queue and fragment identifier.
167 */
168 void
frag6_init(void)169 frag6_init(void)
170 {
171 lck_mtx_lock(&ip6qlock);
172 /* Initialize IPv6 reassembly queue. */
173 ip6q.ip6q_next = ip6q.ip6q_prev = &ip6q;
174
175 /* same limits as IPv4 */
176 ip6_maxfragpackets = nmbclusters / 32;
177 ip6_maxfrags = ip6_maxfragpackets * 2;
178 ip6q_updateparams();
179 lck_mtx_unlock(&ip6qlock);
180 }
181
182 static void
frag6_save_context(struct mbuf * m,uintptr_t val)183 frag6_save_context(struct mbuf *m, uintptr_t val)
184 {
185 m->m_pkthdr.pkt_hdr = __unsafe_forge_single(void *, val);
186 }
187
188 static void
frag6_scrub_context(struct mbuf * m)189 frag6_scrub_context(struct mbuf *m)
190 {
191 m->m_pkthdr.pkt_hdr = NULL;
192 }
193
194 static int
frag6_restore_context(struct mbuf * m)195 frag6_restore_context(struct mbuf *m)
196 {
197 return (int)m->m_pkthdr.pkt_hdr;
198 }
199
200 /*
201 * Send any deferred ICMP param problem error messages; caller must not be
202 * holding ip6qlock and is expected to have saved the per-packet parameter
203 * value via frag6_save_context().
204 */
205 static void
frag6_icmp6_paramprob_error(struct fq6_head * diq6)206 frag6_icmp6_paramprob_error(struct fq6_head *diq6)
207 {
208 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_NOTOWNED);
209
210 if (!MBUFQ_EMPTY(diq6)) {
211 mbuf_ref_t merr, merr_tmp;
212 int param;
213 MBUFQ_FOREACH_SAFE(merr, diq6, merr_tmp) {
214 MBUFQ_REMOVE(diq6, merr);
215 MBUFQ_NEXT(merr) = NULL;
216 param = frag6_restore_context(merr);
217 frag6_scrub_context(merr);
218 icmp6_error(merr, ICMP6_PARAM_PROB,
219 ICMP6_PARAMPROB_HEADER, param);
220 }
221 }
222 }
223
224 /*
225 * Send any deferred ICMP time exceeded error messages;
226 * caller must not be holding ip6qlock.
227 */
228 static void
frag6_icmp6_timeex_error(struct fq6_head * diq6)229 frag6_icmp6_timeex_error(struct fq6_head *diq6)
230 {
231 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_NOTOWNED);
232
233 if (!MBUFQ_EMPTY(diq6)) {
234 mbuf_ref_t m, m_tmp;
235 MBUFQ_FOREACH_SAFE(m, diq6, m_tmp) {
236 MBUFQ_REMOVE(diq6, m);
237 MBUFQ_NEXT(m) = NULL;
238 icmp6_error_flag(m, ICMP6_TIME_EXCEEDED,
239 ICMP6_TIME_EXCEED_REASSEMBLY, 0, 0);
240 }
241 }
242 }
243
244 /*
245 * In RFC2460, fragment and reassembly rule do not agree with each other,
246 * in terms of next header field handling in fragment header.
247 * While the sender will use the same value for all of the fragmented packets,
248 * receiver is suggested not to check the consistency.
249 *
250 * fragment rule (p20):
251 * (2) A Fragment header containing:
252 * The Next Header value that identifies the first header of
253 * the Fragmentable Part of the original packet.
254 * -> next header field is same for all fragments
255 *
256 * reassembly rule (p21):
257 * The Next Header field of the last header of the Unfragmentable
258 * Part is obtained from the Next Header field of the first
259 * fragment's Fragment header.
260 * -> should grab it from the first fragment only
261 *
262 * The following note also contradicts with fragment rule - noone is going to
263 * send different fragment with different next header field.
264 *
265 * additional note (p22):
266 * The Next Header values in the Fragment headers of different
267 * fragments of the same original packet may differ. Only the value
268 * from the Offset zero fragment packet is used for reassembly.
269 * -> should grab it from the first fragment only
270 *
271 * There is no explicit reason given in the RFC. Historical reason maybe?
272 */
273 /*
274 * Fragment input
275 */
276 int
frag6_input(struct mbuf ** mp,int * offp,int proto)277 frag6_input(struct mbuf **mp, int *offp, int proto)
278 {
279 #pragma unused(proto)
280 mbuf_ref_t m = *mp, t = NULL;
281 struct ip6_hdr *ip6 = NULL;
282 struct ip6_frag *__single ip6f = NULL;
283 struct ip6q *__single q6 = NULL;
284 struct ip6asfrag *__single af6 = NULL, *__single ip6af = NULL, *__single af6dwn = NULL;
285 int offset = *offp, i = 0, next = 0;
286 u_int8_t nxt = 0;
287 int first_frag = 0;
288 int fragoff = 0, frgpartlen = 0; /* must be larger than u_int16_t */
289 ifnet_ref_t dstifp = NULL;
290 u_int8_t ecn = 0, ecn0 = 0;
291 uint32_t csum = 0, csum_flags = 0;
292 struct fq6_head diq6 = {};
293 int locked = 0;
294 boolean_t drop_fragq = FALSE;
295 int local_ip6q_unfrglen;
296 u_int8_t local_ip6q_nxt;
297 drop_reason_t drop_reason = DROP_REASON_UNSPECIFIED;
298
299 VERIFY(m->m_flags & M_PKTHDR);
300
301 MBUFQ_INIT(&diq6); /* for deferred ICMP param problem errors */
302
303 /* Expect 32-bit aligned data pointer on strict-align platforms */
304 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
305
306 IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), goto done);
307 ip6 = mtod(m, struct ip6_hdr *);
308 ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset);
309
310 #ifdef IN6_IFSTAT_STRICT
311 /* find the destination interface of the packet. */
312 if (m->m_pkthdr.pkt_flags & PKTF_IFAINFO) {
313 uint32_t idx;
314
315 if (ip6_getdstifaddr_info(m, &idx, NULL) == 0) {
316 if (idx > 0 && idx <= if_index) {
317 ifnet_head_lock_shared();
318 dstifp = ifindex2ifnet[idx];
319 ifnet_head_done();
320 }
321 }
322 }
323 #endif /* IN6_IFSTAT_STRICT */
324
325 /* we are violating the spec, this may not be the dst interface */
326 if (dstifp == NULL) {
327 dstifp = m->m_pkthdr.rcvif;
328 }
329
330 /* jumbo payload can't contain a fragment header */
331 if (ip6->ip6_plen == 0) {
332 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
333 in6_ifstat_inc(dstifp, ifs6_reass_fail);
334 m = NULL;
335 goto done;
336 }
337
338 /*
339 * check whether fragment packet's fragment length is
340 * multiple of 8 octets.
341 * sizeof(struct ip6_frag) == 8
342 * sizeof(struct ip6_hdr) = 40
343 */
344 if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
345 (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
346 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
347 offsetof(struct ip6_hdr, ip6_plen));
348 in6_ifstat_inc(dstifp, ifs6_reass_fail);
349 m = NULL;
350 goto done;
351 }
352
353 /* If ip6_maxfragpackets or ip6_maxfrags is 0, never accept fragments */
354 if (ip6_maxfragpackets == 0 || ip6_maxfrags == 0) {
355 ip6stat.ip6s_fragments++;
356 ip6stat.ip6s_fragdropped++;
357 in6_ifstat_inc(dstifp, ifs6_reass_fail);
358 m_drop(m, DROPTAP_FLAG_DIR_IN | DROPTAP_FLAG_L2_MISSING, DROP_REASON_IP_FRAG_NOT_ACCEPTED,
359 NULL, 0);
360 m = NULL;
361 goto done;
362 }
363
364 /* offset now points to data portion */
365 offset += sizeof(struct ip6_frag);
366
367 /*
368 * RFC 6946: Handle "atomic" fragments (offset and m bit set to 0)
369 * upfront, unrelated to any reassembly. Just skip the fragment header.
370 */
371 if ((ip6f->ip6f_offlg & ~IP6F_RESERVED_MASK) == 0) {
372 /*
373 * Mark packet as reassembled.
374 * In ICMPv6 processing, we drop certain
375 * NDP messages that are not expected to
376 * have fragment header based on recommendations
377 * against security vulnerability as described in
378 * RFC 6980.
379 * Treat atomic fragments as re-assembled packets as well.
380 */
381 m->m_pkthdr.pkt_flags |= PKTF_REASSEMBLED;
382 ip6stat.ip6s_atmfrag_rcvd++;
383 in6_ifstat_inc(dstifp, ifs6_atmfrag_rcvd);
384 *mp = m;
385 *offp = offset;
386 return ip6f->ip6f_nxt;
387 }
388
389 /*
390 * Leverage partial checksum offload for simple UDP/IP fragments,
391 * as that is the most common case.
392 *
393 * Perform 1's complement adjustment of octets that got included/
394 * excluded in the hardware-calculated checksum value. Also take
395 * care of any trailing bytes and subtract out their partial sum.
396 */
397 if (ip6f->ip6f_nxt == IPPROTO_UDP &&
398 offset == (sizeof(*ip6) + sizeof(*ip6f)) &&
399 (m->m_pkthdr.csum_flags &
400 (CSUM_DATA_VALID | CSUM_PARTIAL | CSUM_PSEUDO_HDR)) ==
401 (CSUM_DATA_VALID | CSUM_PARTIAL)) {
402 uint32_t start = m->m_pkthdr.csum_rx_start;
403 uint32_t ip_len = (sizeof(*ip6) + ntohs(ip6->ip6_plen));
404 int32_t trailer = (m_pktlen(m) - ip_len);
405 uint32_t swbytes = (uint32_t)trailer;
406
407 csum = m->m_pkthdr.csum_rx_val;
408
409 ASSERT(trailer >= 0);
410 if (start != offset || trailer != 0) {
411 uint16_t s = 0, d = 0;
412
413 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
414 s = ip6->ip6_src.s6_addr16[1];
415 ip6->ip6_src.s6_addr16[1] = 0;
416 }
417 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
418 d = ip6->ip6_dst.s6_addr16[1];
419 ip6->ip6_dst.s6_addr16[1] = 0;
420 }
421
422 /* callee folds in sum */
423 csum = m_adj_sum16(m, start, offset,
424 (ip_len - offset), csum);
425 if (offset > start) {
426 swbytes += (offset - start);
427 } else {
428 swbytes += (start - offset);
429 }
430
431 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
432 ip6->ip6_src.s6_addr16[1] = s;
433 }
434 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
435 ip6->ip6_dst.s6_addr16[1] = d;
436 }
437 }
438 csum_flags = m->m_pkthdr.csum_flags;
439
440 if (swbytes != 0) {
441 udp_in6_cksum_stats(swbytes);
442 }
443 if (trailer != 0) {
444 m_adj(m, -trailer);
445 }
446 } else {
447 csum = 0;
448 csum_flags = 0;
449 }
450
451 /* Invalidate checksum */
452 m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
453
454 ip6stat.ip6s_fragments++;
455 in6_ifstat_inc(dstifp, ifs6_reass_reqd);
456
457 lck_mtx_lock(&ip6qlock);
458 locked = 1;
459
460 for (q6 = ip6q.ip6q_next; q6 != &ip6q; q6 = q6->ip6q_next) {
461 if (ip6f->ip6f_ident == q6->ip6q_ident &&
462 in6_are_addr_equal_scoped(&ip6->ip6_src, &q6->ip6q_src, ip6_input_getsrcifscope(m), q6->ip6q_src_ifscope) &&
463 in6_are_addr_equal_scoped(&ip6->ip6_dst, &q6->ip6q_dst, ip6_input_getdstifscope(m), q6->ip6q_dst_ifscope)) {
464 break;
465 }
466 }
467
468 if (q6 == &ip6q) {
469 /*
470 * Create a reassembly queue as this is the first fragment to
471 * arrive.
472 * By first frag, we don't mean the one with offset 0, but
473 * any of the fragments of the fragmented packet that has
474 * reached us first.
475 */
476 first_frag = 1;
477
478 q6 = ip6q_alloc();
479 if (q6 == NULL) {
480 drop_reason = DROP_REASON_IP_FRAG_TOO_MANY;
481 goto dropfrag;
482 }
483
484 frag6_insque(q6, &ip6q);
485 frag6_nfragpackets++;
486
487 /* ip6q_nxt will be filled afterwards, from 1st fragment */
488 q6->ip6q_down = q6->ip6q_up = (struct ip6asfrag *)q6;
489 #ifdef notyet
490 q6->ip6q_nxtp = (u_char *)nxtp;
491 #endif
492 q6->ip6q_ident = ip6f->ip6f_ident;
493 q6->ip6q_ttl = IPV6_FRAGTTL;
494 q6->ip6q_src = ip6->ip6_src;
495 q6->ip6q_dst = ip6->ip6_dst;
496 q6->ip6q_dst_ifscope = IN6_IS_SCOPE_EMBED(&q6->ip6q_dst) ? ip6_input_getdstifscope(m) : IFSCOPE_NONE;
497 q6->ip6q_src_ifscope = IN6_IS_SCOPE_EMBED(&q6->ip6q_src) ? ip6_input_getsrcifscope(m) : IFSCOPE_NONE;
498 q6->ip6q_ecn =
499 (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
500 q6->ip6q_unfrglen = -1; /* The 1st fragment has not arrived. */
501
502 q6->ip6q_nfrag = 0;
503 q6->ip6q_flags = 0;
504
505 /*
506 * If the first fragment has valid checksum offload
507 * info, the rest of fragments are eligible as well.
508 */
509 if (csum_flags != 0) {
510 q6->ip6q_csum = csum;
511 q6->ip6q_csum_flags = csum_flags;
512 }
513 }
514
515 if (q6->ip6q_flags & IP6QF_DIRTY) {
516 drop_reason = DROP_REASON_IP6_FRAG_OVERLAPPING;
517 goto dropfrag;
518 }
519
520 local_ip6q_unfrglen = q6->ip6q_unfrglen;
521 local_ip6q_nxt = q6->ip6q_nxt;
522
523 /*
524 * If it's the 1st fragment, record the length of the
525 * unfragmentable part and the next header of the fragment header.
526 * Assume the first fragement to arrive will be correct.
527 * We do not have any duplicate checks here yet so another packet
528 * with fragoff == 0 could come and overwrite the ip6q_unfrglen
529 * and worse, the next header, at any time.
530 */
531 fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
532 if (fragoff == 0 && local_ip6q_unfrglen == -1) {
533 local_ip6q_unfrglen = offset - sizeof(struct ip6_hdr) -
534 sizeof(struct ip6_frag);
535 local_ip6q_nxt = ip6f->ip6f_nxt;
536 /* XXX ECN? */
537 }
538
539 /*
540 * Check that the reassembled packet would not exceed 65535 bytes
541 * in size.
542 * If it would exceed, discard the fragment and return an ICMP error.
543 */
544 frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
545 if (local_ip6q_unfrglen >= 0) {
546 /* The 1st fragment has already arrived. */
547 if (local_ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
548 lck_mtx_unlock(&ip6qlock);
549 locked = 0;
550 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
551 offset - sizeof(struct ip6_frag) +
552 offsetof(struct ip6_frag, ip6f_offlg));
553 m = NULL;
554 goto done;
555 }
556 } else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
557 lck_mtx_unlock(&ip6qlock);
558 locked = 0;
559 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
560 offset - sizeof(struct ip6_frag) +
561 offsetof(struct ip6_frag, ip6f_offlg));
562 m = NULL;
563 goto done;
564 }
565 /*
566 * If it's the first fragment, do the above check for each
567 * fragment already stored in the reassembly queue.
568 */
569 if (fragoff == 0) {
570 /*
571 * https://tools.ietf.org/html/rfc8200#page-20
572 * If the first fragment does not include all headers through an
573 * Upper-Layer header, then that fragment should be discarded and
574 * an ICMP Parameter Problem, Code 3, message should be sent to
575 * the source of the fragment, with the Pointer field set to zero.
576 */
577 if (!ip6_pkt_has_ulp(m)) {
578 lck_mtx_unlock(&ip6qlock);
579 locked = 0;
580 icmp6_error(m, ICMP6_PARAM_PROB,
581 ICMP6_PARAMPROB_FIRSTFRAG_INCOMP_HDR, 0);
582 m = NULL;
583 goto done;
584 }
585 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
586 af6 = af6dwn) {
587 af6dwn = af6->ip6af_down;
588
589 if (local_ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
590 IPV6_MAXPACKET) {
591 mbuf_ref_t merr = IP6_REASS_MBUF(af6);
592 struct ip6_hdr *__single ip6err;
593 int erroff = af6->ip6af_offset;
594
595 /* dequeue the fragment. */
596 frag6_deq(af6);
597 ip6af_free(af6);
598
599 /* adjust pointer. */
600 ip6err = mtod(merr, struct ip6_hdr *);
601
602 /*
603 * Restore source and destination addresses
604 * in the erroneous IPv6 header.
605 */
606 ip6err->ip6_src = q6->ip6q_src;
607 ip6err->ip6_dst = q6->ip6q_dst;
608 ip6_output_setdstifscope(m, q6->ip6q_dst_ifscope, NULL);
609 ip6_output_setsrcifscope(m, q6->ip6q_src_ifscope, NULL);
610 frag6_save_context(merr,
611 erroff - sizeof(struct ip6_frag) +
612 offsetof(struct ip6_frag, ip6f_offlg));
613
614 MBUFQ_ENQUEUE(&diq6, merr);
615 }
616 }
617 }
618
619 ip6af = ip6af_alloc();
620 if (ip6af == NULL) {
621 drop_reason = DROP_REASON_IP_FRAG_TOO_MANY;
622 goto dropfrag;
623 }
624
625 ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG;
626 ip6af->ip6af_off = fragoff;
627 ip6af->ip6af_frglen = frgpartlen;
628 ip6af->ip6af_offset = offset;
629 IP6_REASS_MBUF(ip6af) = m;
630
631 if (first_frag) {
632 af6 = (struct ip6asfrag *)q6;
633 goto insert;
634 }
635
636 /*
637 * Handle ECN by comparing this segment with the first one;
638 * if CE is set, do not lose CE.
639 * drop if CE and not-ECT are mixed for the same packet.
640 */
641 ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
642 ecn0 = q6->ip6q_ecn;
643 if (ecn == IPTOS_ECN_CE) {
644 if (ecn0 == IPTOS_ECN_NOTECT) {
645 ip6af_free(ip6af);
646 drop_reason = DROP_REASON_IP6_FRAG_MIXED_CE;
647 goto dropfrag;
648 }
649 if (ecn0 != IPTOS_ECN_CE) {
650 q6->ip6q_ecn = IPTOS_ECN_CE;
651 }
652 }
653 if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) {
654 ip6af_free(ip6af);
655 drop_reason = DROP_REASON_IP6_FRAG_MIXED_CE;
656 goto dropfrag;
657 }
658
659 /*
660 * Find a segment which begins after this one does.
661 */
662 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
663 af6 = af6->ip6af_down) {
664 if (af6->ip6af_off > ip6af->ip6af_off) {
665 break;
666 }
667 }
668
669 /*
670 * As per RFC 8200 reassembly rules, we MUST drop the entire
671 * chain of fragments for a packet to be assembled, if we receive
672 * any overlapping fragments.
673 * https://tools.ietf.org/html/rfc8200#page-20
674 *
675 * To avoid more conditional code, just reuse frag6_freef and defer
676 * its call to post fragment insertion in the queue.
677 */
678 if (af6->ip6af_up != (struct ip6asfrag *)q6) {
679 if (af6->ip6af_up->ip6af_off == ip6af->ip6af_off) {
680 if (af6->ip6af_up->ip6af_frglen != ip6af->ip6af_frglen) {
681 drop_fragq = TRUE;
682 } else {
683 /*
684 * XXX Ideally we should be comparing the entire
685 * packet here but for now just use off and fraglen
686 * to ignore a duplicate fragment.
687 */
688 ip6af_free(ip6af);
689 drop_reason = DROP_REASON_IP6_FRAG_OVERLAPPING;
690 goto dropfrag;
691 }
692 } else {
693 i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
694 - ip6af->ip6af_off;
695 if (i > 0) {
696 drop_fragq = TRUE;
697 }
698 }
699 }
700
701 if (af6 != (struct ip6asfrag *)q6) {
702 /*
703 * Given that we break when af6->ip6af_off > ip6af->ip6af_off,
704 * we shouldn't need a check for duplicate fragment here.
705 * For now just assert.
706 */
707 VERIFY(af6->ip6af_off != ip6af->ip6af_off);
708 i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
709 if (i > 0) {
710 drop_fragq = TRUE;
711 }
712 }
713
714 /*
715 * If this fragment contains similar checksum offload info
716 * as that of the existing ones, accumulate checksum. Otherwise,
717 * invalidate checksum offload info for the entire datagram.
718 */
719 if (csum_flags != 0 && csum_flags == q6->ip6q_csum_flags) {
720 q6->ip6q_csum += csum;
721 } else if (q6->ip6q_csum_flags != 0) {
722 q6->ip6q_csum_flags = 0;
723 }
724
725 insert:
726 /*
727 * Stick new segment in its place;
728 * check for complete reassembly.
729 * Move to front of packet queue, as we are
730 * the most recently active fragmented packet.
731 */
732 frag6_enq(ip6af, af6->ip6af_up);
733 frag6_nfrags++;
734 q6->ip6q_nfrag++;
735
736 /*
737 * This holds true, when we receive overlapping fragments.
738 * We must silently drop all the fragments we have received
739 * so far.
740 * Also mark q6 as dirty, so as to not add any new fragments to it.
741 * Make sure even q6 marked dirty is kept till timer expires for
742 * reassembly and when that happens, silenty get rid of q6
743 */
744 if (drop_fragq) {
745 struct fq6_head dfq6 = {0};
746 MBUFQ_INIT(&dfq6); /* for deferred frees */
747 q6->ip6q_flags |= IP6QF_DIRTY;
748 /* Purge all the fragments but do not free q6 */
749 frag6_purgef(q6, &dfq6, NULL);
750 af6 = NULL;
751
752 /* free fragments that need to be freed */
753 if (!MBUFQ_EMPTY(&dfq6)) {
754 MBUFQ_DROP_AND_DRAIN(&dfq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP6_FRAG_OVERLAPPING);
755 }
756 VERIFY(MBUFQ_EMPTY(&dfq6));
757 /*
758 * Just in case the above logic got anything added
759 * to diq6, drain it.
760 * Please note that these mbufs are not present in the
761 * fragment queue and are added to diq6 for sending
762 * ICMPv6 error.
763 * Given that the current fragment was an overlapping
764 * fragment and the RFC requires us to not send any
765 * ICMPv6 errors while purging the entire queue.
766 * Just empty it out.
767 */
768 if (!MBUFQ_EMPTY(&diq6)) {
769 MBUFQ_DROP_AND_DRAIN(&diq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP6_FRAG_OVERLAPPING);
770 }
771 VERIFY(MBUFQ_EMPTY(&diq6));
772 /*
773 * MBUFQ_DRAIN would have drained all the mbufs
774 * in the fragment queue.
775 * This shouldn't be needed as we are returning IPPROTO_DONE
776 * from here but change the passed mbuf pointer to NULL.
777 */
778 *mp = NULL;
779 lck_mtx_unlock(&ip6qlock);
780 return IPPROTO_DONE;
781 }
782
783 /*
784 * We're keeping the fragment.
785 */
786 q6->ip6q_unfrglen = local_ip6q_unfrglen;
787 q6->ip6q_nxt = local_ip6q_nxt;
788
789 next = 0;
790 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
791 af6 = af6->ip6af_down) {
792 if (af6->ip6af_off != next) {
793 lck_mtx_unlock(&ip6qlock);
794 locked = 0;
795 m = NULL;
796 goto done;
797 }
798 next += af6->ip6af_frglen;
799 }
800 if (af6->ip6af_up->ip6af_mff) {
801 lck_mtx_unlock(&ip6qlock);
802 locked = 0;
803 m = NULL;
804 goto done;
805 }
806
807 /*
808 * Reassembly is complete; concatenate fragments.
809 */
810 ip6af = q6->ip6q_down;
811 t = m = IP6_REASS_MBUF(ip6af);
812 af6 = ip6af->ip6af_down;
813 frag6_deq(ip6af);
814 while (af6 != (struct ip6asfrag *)q6) {
815 af6dwn = af6->ip6af_down;
816 frag6_deq(af6);
817 while (t->m_next) {
818 t = t->m_next;
819 }
820 t->m_next = IP6_REASS_MBUF(af6);
821 m_adj(t->m_next, af6->ip6af_offset);
822 ip6af_free(af6);
823 af6 = af6dwn;
824 }
825
826 /*
827 * Store partial hardware checksum info from the fragment queue;
828 * the receive start offset is set to 40 bytes (see code at the
829 * top of this routine.)
830 */
831 if (q6->ip6q_csum_flags != 0) {
832 csum = q6->ip6q_csum;
833
834 ADDCARRY(csum);
835
836 m->m_pkthdr.csum_rx_val = (u_int16_t)csum;
837 m->m_pkthdr.csum_rx_start = sizeof(struct ip6_hdr);
838 m->m_pkthdr.csum_flags = q6->ip6q_csum_flags;
839 } else if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) ||
840 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) {
841 /* loopback checksums are always OK */
842 m->m_pkthdr.csum_data = 0xffff;
843 m->m_pkthdr.csum_flags = CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
844 }
845
846 /* adjust offset to point where the original next header starts */
847 offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
848 ip6af_free(ip6af);
849 ip6 = mtod(m, struct ip6_hdr *);
850 ip6->ip6_plen = htons((uint16_t)(next + offset - sizeof(struct ip6_hdr)));
851 ip6->ip6_src = q6->ip6q_src;
852 ip6->ip6_dst = q6->ip6q_dst;
853 ip6_output_setdstifscope(m, q6->ip6q_dst_ifscope, NULL);
854 ip6_output_setsrcifscope(m, q6->ip6q_src_ifscope, NULL);
855 if (q6->ip6q_ecn == IPTOS_ECN_CE) {
856 ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20);
857 }
858
859 nxt = q6->ip6q_nxt;
860 #ifdef notyet
861 *q6->ip6q_nxtp = (u_char)(nxt & 0xff);
862 #endif
863
864 /* Delete frag6 header */
865 if (m->m_len >= offset + sizeof(struct ip6_frag)) {
866 /* This is the only possible case with !PULLDOWN_TEST */
867 ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag),
868 offset);
869 m->m_data += sizeof(struct ip6_frag);
870 m->m_len -= sizeof(struct ip6_frag);
871 } else {
872 /* this comes with no copy if the boundary is on cluster */
873 if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) {
874 frag6_remque(q6);
875 frag6_nfragpackets--;
876 frag6_nfrags -= q6->ip6q_nfrag;
877 ip6q_free(q6);
878 goto dropfrag;
879 }
880 m_adj(t, sizeof(struct ip6_frag));
881 m_cat(m, t);
882 }
883
884 /*
885 * Store NXT to the original.
886 */
887 {
888 char *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */
889 *prvnxtp = nxt;
890 }
891
892 frag6_remque(q6);
893 frag6_nfragpackets--;
894 frag6_nfrags -= q6->ip6q_nfrag;
895 ip6q_free(q6);
896
897 if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */
898 m_fixhdr(m);
899 /*
900 * Mark packet as reassembled
901 * In ICMPv6 processing, we drop certain
902 * NDP messages that are not expected to
903 * have fragment header based on recommendations
904 * against security vulnerability as described in
905 * RFC 6980.
906 */
907 m->m_pkthdr.pkt_flags |= PKTF_REASSEMBLED;
908 }
909 ip6stat.ip6s_reassembled++;
910
911 /*
912 * Tell launch routine the next header
913 */
914 *mp = m;
915 *offp = offset;
916
917 /* arm the purge timer if not already and if there's work to do */
918 frag6_sched_timeout();
919 lck_mtx_unlock(&ip6qlock);
920 in6_ifstat_inc(dstifp, ifs6_reass_ok);
921 frag6_icmp6_paramprob_error(&diq6);
922 VERIFY(MBUFQ_EMPTY(&diq6));
923 return nxt;
924
925 done:
926 VERIFY(m == NULL);
927 *mp = m;
928 if (!locked) {
929 if (frag6_nfragpackets == 0) {
930 frag6_icmp6_paramprob_error(&diq6);
931 VERIFY(MBUFQ_EMPTY(&diq6));
932 return IPPROTO_DONE;
933 }
934 lck_mtx_lock(&ip6qlock);
935 }
936 /* arm the purge timer if not already and if there's work to do */
937 frag6_sched_timeout();
938 lck_mtx_unlock(&ip6qlock);
939 frag6_icmp6_paramprob_error(&diq6);
940 VERIFY(MBUFQ_EMPTY(&diq6));
941 return IPPROTO_DONE;
942
943 dropfrag:
944 ip6stat.ip6s_fragdropped++;
945 /* arm the purge timer if not already and if there's work to do */
946 frag6_sched_timeout();
947 lck_mtx_unlock(&ip6qlock);
948 in6_ifstat_inc(dstifp, ifs6_reass_fail);
949 m_drop(m, DROPTAP_FLAG_DIR_IN | DROPTAP_FLAG_L2_MISSING, drop_reason, NULL, 0);
950 *mp = NULL;
951 frag6_icmp6_paramprob_error(&diq6);
952 VERIFY(MBUFQ_EMPTY(&diq6));
953 return IPPROTO_DONE;
954 }
955
956 /*
957 * This routine removes the enqueued frames from the passed fragment
958 * header and enqueues those to dfq6 which is an out-arg for the dequeued
959 * fragments.
960 * If the caller also provides diq6, this routine also enqueues the 0 offset
961 * fragment to that list as it potentially gets used by the caller
962 * to prepare the relevant ICMPv6 error message (time exceeded or
963 * param problem).
964 * It leaves the fragment header object (q6) intact.
965 */
966 static void
frag6_purgef(struct ip6q * q6,struct fq6_head * dfq6,struct fq6_head * diq6)967 frag6_purgef(struct ip6q *q6, struct fq6_head *dfq6, struct fq6_head *diq6)
968 {
969 struct ip6asfrag *__single af6 = NULL;
970 struct ip6asfrag *__single down6 = NULL;
971
972 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
973
974 for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
975 af6 = down6) {
976 mbuf_ref_t m = IP6_REASS_MBUF(af6);
977
978 down6 = af6->ip6af_down;
979 frag6_deq(af6);
980
981 /*
982 * If caller wants to generate ICMP time-exceeded,
983 * as indicated by the argument diq6, return it for
984 * the first fragment and add others to the fragment
985 * free queue.
986 */
987 if (af6->ip6af_off == 0 && diq6 != NULL) {
988 struct ip6_hdr *__single ip6;
989
990 /* adjust pointer */
991 ip6 = mtod(m, struct ip6_hdr *);
992
993 /* restore source and destination addresses */
994 ip6->ip6_src = q6->ip6q_src;
995 ip6->ip6_dst = q6->ip6q_dst;
996 ip6_output_setdstifscope(m, q6->ip6q_dst_ifscope, NULL);
997 ip6_output_setsrcifscope(m, q6->ip6q_src_ifscope, NULL);
998 MBUFQ_ENQUEUE(diq6, m);
999 } else {
1000 MBUFQ_ENQUEUE(dfq6, m);
1001 }
1002 ip6af_free(af6);
1003 }
1004 }
1005
1006 /*
1007 * This routine removes the enqueued frames from the passed fragment
1008 * header and enqueues those to dfq6 which is an out-arg for the dequeued
1009 * fragments.
1010 * If the caller also provides diq6, this routine also enqueues the 0 offset
1011 * fragment to that list as it potentially gets used by the caller
1012 * to prepare the relevant ICMPv6 error message (time exceeded or
1013 * param problem).
1014 * It also remove the fragment header object from the queue and frees it.
1015 */
1016 static void
frag6_freef(struct ip6q * q6,struct fq6_head * dfq6,struct fq6_head * diq6)1017 frag6_freef(struct ip6q *q6, struct fq6_head *dfq6, struct fq6_head *diq6)
1018 {
1019 frag6_purgef(q6, dfq6, diq6);
1020 frag6_remque(q6);
1021 frag6_nfragpackets--;
1022 frag6_nfrags -= q6->ip6q_nfrag;
1023 ip6q_free(q6);
1024 }
1025
1026 /*
1027 * Put an ip fragment on a reassembly chain.
1028 * Like insque, but pointers in middle of structure.
1029 */
1030 void
frag6_enq(struct ip6asfrag * af6,struct ip6asfrag * up6)1031 frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
1032 {
1033 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1034
1035 af6->ip6af_up = up6;
1036 af6->ip6af_down = up6->ip6af_down;
1037 up6->ip6af_down->ip6af_up = af6;
1038 up6->ip6af_down = af6;
1039 }
1040
1041 /*
1042 * To frag6_enq as remque is to insque.
1043 */
1044 void
frag6_deq(struct ip6asfrag * af6)1045 frag6_deq(struct ip6asfrag *af6)
1046 {
1047 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1048
1049 af6->ip6af_up->ip6af_down = af6->ip6af_down;
1050 af6->ip6af_down->ip6af_up = af6->ip6af_up;
1051 }
1052
1053 void
frag6_insque(struct ip6q * new,struct ip6q * old)1054 frag6_insque(struct ip6q *new, struct ip6q *old)
1055 {
1056 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1057
1058 new->ip6q_prev = old;
1059 new->ip6q_next = old->ip6q_next;
1060 old->ip6q_next->ip6q_prev = new;
1061 old->ip6q_next = new;
1062 }
1063
1064 void
frag6_remque(struct ip6q * p6)1065 frag6_remque(struct ip6q *p6)
1066 {
1067 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1068
1069 p6->ip6q_prev->ip6q_next = p6->ip6q_next;
1070 p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
1071 }
1072
1073 /*
1074 * IPv6 reassembling timer processing;
1075 * if a timer expires on a reassembly
1076 * queue, discard it.
1077 */
1078 static void
frag6_timeout(void * arg)1079 frag6_timeout(void *arg)
1080 {
1081 #pragma unused(arg)
1082 struct fq6_head dfq6, diq6;
1083 struct fq6_head *__single diq6_tmp = NULL;
1084 struct ip6q *__single q6;
1085
1086 MBUFQ_INIT(&dfq6); /* for deferred frees */
1087 MBUFQ_INIT(&diq6); /* for deferred ICMP time exceeded errors */
1088
1089 /*
1090 * Update coarse-grained networking timestamp (in sec.); the idea
1091 * is to piggy-back on the timeout callout to update the counter
1092 * returnable via net_uptime().
1093 */
1094 net_update_uptime();
1095
1096 lck_mtx_lock(&ip6qlock);
1097 q6 = ip6q.ip6q_next;
1098 if (q6) {
1099 while (q6 != &ip6q) {
1100 --q6->ip6q_ttl;
1101 q6 = q6->ip6q_next;
1102 if (q6->ip6q_prev->ip6q_ttl == 0) {
1103 ip6stat.ip6s_fragtimeout++;
1104 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
1105 /*
1106 * Avoid sending ICMPv6 Time Exceeded for fragment headers
1107 * that are marked dirty.
1108 */
1109 diq6_tmp = (q6->ip6q_prev->ip6q_flags & IP6QF_DIRTY) ?
1110 NULL : &diq6;
1111 frag6_freef(q6->ip6q_prev, &dfq6, diq6_tmp);
1112 }
1113 }
1114 }
1115 /*
1116 * If we are over the maximum number of fragments
1117 * (due to the limit being lowered), drain off
1118 * enough to get down to the new limit.
1119 */
1120 if (ip6_maxfragpackets >= 0) {
1121 while (frag6_nfragpackets > (unsigned)ip6_maxfragpackets &&
1122 ip6q.ip6q_prev) {
1123 ip6stat.ip6s_fragoverflow++;
1124 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
1125 /*
1126 * Avoid sending ICMPv6 Time Exceeded for fragment headers
1127 * that are marked dirty.
1128 */
1129 diq6_tmp = (ip6q.ip6q_prev->ip6q_flags & IP6QF_DIRTY) ?
1130 NULL : &diq6;
1131 frag6_freef(ip6q.ip6q_prev, &dfq6, diq6_tmp);
1132 }
1133 }
1134 /* re-arm the purge timer if there's work to do */
1135 frag6_timeout_run = 0;
1136 frag6_sched_timeout();
1137 lck_mtx_unlock(&ip6qlock);
1138
1139 /* free fragments that need to be freed */
1140 if (!MBUFQ_EMPTY(&dfq6)) {
1141 MBUFQ_DROP_AND_DRAIN(&dfq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP_FRAG_TIMEOUT);
1142 }
1143
1144 frag6_icmp6_timeex_error(&diq6);
1145
1146 VERIFY(MBUFQ_EMPTY(&dfq6));
1147 VERIFY(MBUFQ_EMPTY(&diq6));
1148 }
1149
1150 static void
frag6_sched_timeout(void)1151 frag6_sched_timeout(void)
1152 {
1153 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1154
1155 if (!frag6_timeout_run && frag6_nfragpackets > 0) {
1156 frag6_timeout_run = 1;
1157 timeout(frag6_timeout, NULL, hz);
1158 }
1159 }
1160
1161 /*
1162 * Drain off all datagram fragments.
1163 */
1164 void
frag6_drain(void)1165 frag6_drain(void)
1166 {
1167 struct fq6_head dfq6, diq6;
1168 struct fq6_head *__single diq6_tmp = NULL;
1169
1170 MBUFQ_INIT(&dfq6); /* for deferred frees */
1171 MBUFQ_INIT(&diq6); /* for deferred ICMP time exceeded errors */
1172
1173 lck_mtx_lock(&ip6qlock);
1174 while (ip6q.ip6q_next != &ip6q) {
1175 ip6stat.ip6s_fragdropped++;
1176 /* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
1177 /*
1178 * Avoid sending ICMPv6 Time Exceeded for fragment headers
1179 * that are marked dirty.
1180 */
1181 diq6_tmp = (ip6q.ip6q_next->ip6q_flags & IP6QF_DIRTY) ?
1182 NULL : &diq6;
1183 frag6_freef(ip6q.ip6q_next, &dfq6, diq6_tmp);
1184 }
1185 lck_mtx_unlock(&ip6qlock);
1186
1187 /* free fragments that need to be freed */
1188 if (!MBUFQ_EMPTY(&dfq6)) {
1189 MBUFQ_DROP_AND_DRAIN(&dfq6, DROPTAP_FLAG_DIR_IN, DROP_REASON_IP_FRAG_DRAINED);
1190 }
1191
1192 frag6_icmp6_timeex_error(&diq6);
1193
1194 VERIFY(MBUFQ_EMPTY(&dfq6));
1195 VERIFY(MBUFQ_EMPTY(&diq6));
1196 }
1197
1198 static struct ip6q *
ip6q_alloc(void)1199 ip6q_alloc(void)
1200 {
1201 struct ip6q *__single q6;
1202
1203 /*
1204 * See comments in ip6q_updateparams(). Keep the count separate
1205 * from frag6_nfragpackets since the latter represents the elements
1206 * already in the reassembly queues.
1207 */
1208 if (ip6q_limit > 0 && ip6q_count > ip6q_limit) {
1209 return NULL;
1210 }
1211
1212 q6 = kalloc_type(struct ip6q, Z_NOWAIT | Z_ZERO);
1213 if (q6 != NULL) {
1214 os_atomic_inc(&ip6q_count, relaxed);
1215 }
1216 return q6;
1217 }
1218
1219 static void
ip6q_free(struct ip6q * q6)1220 ip6q_free(struct ip6q *q6)
1221 {
1222 kfree_type(struct ip6q, q6);
1223 os_atomic_dec(&ip6q_count, relaxed);
1224 }
1225
1226 static struct ip6asfrag *
ip6af_alloc(void)1227 ip6af_alloc(void)
1228 {
1229 struct ip6asfrag *__single af6;
1230
1231 /*
1232 * See comments in ip6q_updateparams(). Keep the count separate
1233 * from frag6_nfrags since the latter represents the elements
1234 * already in the reassembly queues.
1235 */
1236 if (ip6af_limit > 0 && ip6af_count > ip6af_limit) {
1237 return NULL;
1238 }
1239
1240 af6 = kalloc_type(struct ip6asfrag, Z_NOWAIT | Z_ZERO);
1241 if (af6 != NULL) {
1242 os_atomic_inc(&ip6af_count, relaxed);
1243 }
1244 return af6;
1245 }
1246
1247 static void
ip6af_free(struct ip6asfrag * af6)1248 ip6af_free(struct ip6asfrag *af6)
1249 {
1250 kfree_type(struct ip6asfrag, af6);
1251 os_atomic_dec(&ip6af_count, relaxed);
1252 }
1253
1254 static void
ip6q_updateparams(void)1255 ip6q_updateparams(void)
1256 {
1257 LCK_MTX_ASSERT(&ip6qlock, LCK_MTX_ASSERT_OWNED);
1258 /*
1259 * -1 for unlimited allocation.
1260 */
1261 if (ip6_maxfragpackets < 0) {
1262 ip6q_limit = 0;
1263 }
1264 if (ip6_maxfrags < 0) {
1265 ip6af_limit = 0;
1266 }
1267 /*
1268 * Positive number for specific bound.
1269 */
1270 if (ip6_maxfragpackets > 0) {
1271 ip6q_limit = ip6_maxfragpackets;
1272 }
1273 if (ip6_maxfrags > 0) {
1274 ip6af_limit = ip6_maxfrags;
1275 }
1276 /*
1277 * Zero specifies no further fragment queue allocation -- set the
1278 * bound very low, but rely on implementation elsewhere to actually
1279 * prevent allocation and reclaim current queues.
1280 */
1281 if (ip6_maxfragpackets == 0) {
1282 ip6q_limit = 1;
1283 }
1284 if (ip6_maxfrags == 0) {
1285 ip6af_limit = 1;
1286 }
1287 /*
1288 * Arm the purge timer if not already and if there's work to do
1289 */
1290 frag6_sched_timeout();
1291 }
1292
1293 static int
1294 sysctl_maxfragpackets SYSCTL_HANDLER_ARGS
1295 {
1296 #pragma unused(arg1, arg2)
1297 int error, i;
1298
1299 lck_mtx_lock(&ip6qlock);
1300 i = ip6_maxfragpackets;
1301 error = sysctl_handle_int(oidp, &i, 0, req);
1302 if (error || req->newptr == USER_ADDR_NULL) {
1303 goto done;
1304 }
1305 /* impose bounds */
1306 if (i < -1 || i > (nmbclusters / 4)) {
1307 error = EINVAL;
1308 goto done;
1309 }
1310 ip6_maxfragpackets = i;
1311 ip6q_updateparams();
1312 done:
1313 lck_mtx_unlock(&ip6qlock);
1314 return error;
1315 }
1316
1317 static int
1318 sysctl_maxfrags SYSCTL_HANDLER_ARGS
1319 {
1320 #pragma unused(arg1, arg2)
1321 int error, i;
1322
1323 lck_mtx_lock(&ip6qlock);
1324 i = ip6_maxfrags;
1325 error = sysctl_handle_int(oidp, &i, 0, req);
1326 if (error || req->newptr == USER_ADDR_NULL) {
1327 goto done;
1328 }
1329 /* impose bounds */
1330 if (i < -1 || i > (nmbclusters / 4)) {
1331 error = EINVAL;
1332 goto done;
1333 }
1334 ip6_maxfrags = i;
1335 ip6q_updateparams(); /* see if we need to arm timer */
1336 done:
1337 lck_mtx_unlock(&ip6qlock);
1338 return error;
1339 }
1340