xref: /freebsd/sys/netinet6/frag6.c (revision 9907aba3704685d2ab7138204fe99a81a312d62d)
1caf43b02SWarner Losh /*-
282cd038dSYoshinobu Inoue  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
382cd038dSYoshinobu Inoue  * All rights reserved.
482cd038dSYoshinobu Inoue  *
582cd038dSYoshinobu Inoue  * Redistribution and use in source and binary forms, with or without
682cd038dSYoshinobu Inoue  * modification, are permitted provided that the following conditions
782cd038dSYoshinobu Inoue  * are met:
882cd038dSYoshinobu Inoue  * 1. Redistributions of source code must retain the above copyright
982cd038dSYoshinobu Inoue  *    notice, this list of conditions and the following disclaimer.
1082cd038dSYoshinobu Inoue  * 2. Redistributions in binary form must reproduce the above copyright
1182cd038dSYoshinobu Inoue  *    notice, this list of conditions and the following disclaimer in the
1282cd038dSYoshinobu Inoue  *    documentation and/or other materials provided with the distribution.
1382cd038dSYoshinobu Inoue  * 3. Neither the name of the project nor the names of its contributors
1482cd038dSYoshinobu Inoue  *    may be used to endorse or promote products derived from this software
1582cd038dSYoshinobu Inoue  *    without specific prior written permission.
1682cd038dSYoshinobu Inoue  *
1782cd038dSYoshinobu Inoue  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
1882cd038dSYoshinobu Inoue  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1982cd038dSYoshinobu Inoue  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2082cd038dSYoshinobu Inoue  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
2182cd038dSYoshinobu Inoue  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2282cd038dSYoshinobu Inoue  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2382cd038dSYoshinobu Inoue  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2482cd038dSYoshinobu Inoue  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2582cd038dSYoshinobu Inoue  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2682cd038dSYoshinobu Inoue  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
2782cd038dSYoshinobu Inoue  * SUCH DAMAGE.
28b48287a3SDavid E. O'Brien  *
29b48287a3SDavid E. O'Brien  *	$KAME: frag6.c,v 1.33 2002/01/07 11:34:48 kjc Exp $
3082cd038dSYoshinobu Inoue  */
3182cd038dSYoshinobu Inoue 
32b48287a3SDavid E. O'Brien #include <sys/cdefs.h>
33b48287a3SDavid E. O'Brien __FBSDID("$FreeBSD$");
34b48287a3SDavid E. O'Brien 
35aaa46574SAdrian Chadd #include "opt_rss.h"
36aaa46574SAdrian Chadd 
3782cd038dSYoshinobu Inoue #include <sys/param.h>
3882cd038dSYoshinobu Inoue #include <sys/systm.h>
3982cd038dSYoshinobu Inoue #include <sys/malloc.h>
4082cd038dSYoshinobu Inoue #include <sys/mbuf.h>
4182cd038dSYoshinobu Inoue #include <sys/domain.h>
42ea8d1492SAlexander V. Chernikov #include <sys/eventhandler.h>
4382cd038dSYoshinobu Inoue #include <sys/protosw.h>
4482cd038dSYoshinobu Inoue #include <sys/socket.h>
4582cd038dSYoshinobu Inoue #include <sys/errno.h>
4682cd038dSYoshinobu Inoue #include <sys/time.h>
4782cd038dSYoshinobu Inoue #include <sys/kernel.h>
4882cd038dSYoshinobu Inoue #include <sys/syslog.h>
4982cd038dSYoshinobu Inoue 
5082cd038dSYoshinobu Inoue #include <net/if.h>
5176039bc8SGleb Smirnoff #include <net/if_var.h>
52aaa46574SAdrian Chadd #include <net/netisr.h>
5382cd038dSYoshinobu Inoue #include <net/route.h>
54eddfbb76SRobert Watson #include <net/vnet.h>
5582cd038dSYoshinobu Inoue 
5682cd038dSYoshinobu Inoue #include <netinet/in.h>
5782cd038dSYoshinobu Inoue #include <netinet/in_var.h>
58686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h>
5982cd038dSYoshinobu Inoue #include <netinet6/ip6_var.h>
60686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp6.h>
6159dfcba4SHajimu UMEMOTO #include <netinet/in_systm.h>	/* for ECN definitions */
6259dfcba4SHajimu UMEMOTO #include <netinet/ip.h>		/* for ECN definitions */
6382cd038dSYoshinobu Inoue 
644b908c8bSRobert Watson #include <security/mac/mac_framework.h>
654b908c8bSRobert Watson 
669233d8f3SDavid E. O'Brien static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *);
679233d8f3SDavid E. O'Brien static void frag6_deq(struct ip6asfrag *);
689233d8f3SDavid E. O'Brien static void frag6_insque(struct ip6q *, struct ip6q *);
699233d8f3SDavid E. O'Brien static void frag6_remque(struct ip6q *);
709233d8f3SDavid E. O'Brien static void frag6_freef(struct ip6q *);
7182cd038dSYoshinobu Inoue 
7231e8f7e5SHajimu UMEMOTO static struct mtx ip6qlock;
7331e8f7e5SHajimu UMEMOTO /*
7431e8f7e5SHajimu UMEMOTO  * These fields all protected by ip6qlock.
7531e8f7e5SHajimu UMEMOTO  */
763e288e62SDimitry Andric static VNET_DEFINE(u_int, frag6_nfragpackets);
773e288e62SDimitry Andric static VNET_DEFINE(u_int, frag6_nfrags);
783e288e62SDimitry Andric static VNET_DEFINE(struct ip6q, ip6q);	/* ip6 reassemble queue */
79eddfbb76SRobert Watson 
801e77c105SRobert Watson #define	V_frag6_nfragpackets		VNET(frag6_nfragpackets)
811e77c105SRobert Watson #define	V_frag6_nfrags			VNET(frag6_nfrags)
821e77c105SRobert Watson #define	V_ip6q				VNET(ip6q)
8382cd038dSYoshinobu Inoue 
8431e8f7e5SHajimu UMEMOTO #define	IP6Q_LOCK_INIT()	mtx_init(&ip6qlock, "ip6qlock", NULL, MTX_DEF);
8531e8f7e5SHajimu UMEMOTO #define	IP6Q_LOCK()		mtx_lock(&ip6qlock)
8631e8f7e5SHajimu UMEMOTO #define	IP6Q_TRYLOCK()		mtx_trylock(&ip6qlock)
879bcf770cSHajimu UMEMOTO #define	IP6Q_LOCK_ASSERT()	mtx_assert(&ip6qlock, MA_OWNED)
8831e8f7e5SHajimu UMEMOTO #define	IP6Q_UNLOCK()		mtx_unlock(&ip6qlock)
899888c401SHajimu UMEMOTO 
90959b7375SPoul-Henning Kamp static MALLOC_DEFINE(M_FTABLE, "fragment", "fragment reassembly header");
91686cdd19SJun-ichiro itojun Hagino 
9282cd038dSYoshinobu Inoue /*
9382cd038dSYoshinobu Inoue  * Initialise reassembly queue and fragment identifier.
9482cd038dSYoshinobu Inoue  */
954f590175SPaul Saab static void
964f590175SPaul Saab frag6_change(void *tag)
974f590175SPaul Saab {
984f590175SPaul Saab 
99603724d3SBjoern A. Zeeb 	V_ip6_maxfragpackets = nmbclusters / 4;
100603724d3SBjoern A. Zeeb 	V_ip6_maxfrags = nmbclusters / 4;
1014f590175SPaul Saab }
1024f590175SPaul Saab 
10382cd038dSYoshinobu Inoue void
1041272577eSXin LI frag6_init(void)
10582cd038dSYoshinobu Inoue {
10682cd038dSYoshinobu Inoue 
107603724d3SBjoern A. Zeeb 	V_ip6_maxfragpackets = nmbclusters / 4;
108603724d3SBjoern A. Zeeb 	V_ip6_maxfrags = nmbclusters / 4;
10982cea7e6SBjoern A. Zeeb 	V_ip6q.ip6q_next = V_ip6q.ip6q_prev = &V_ip6q;
1101ed81b73SMarko Zec 
1111ed81b73SMarko Zec 	if (!IS_DEFAULT_VNET(curvnet))
1121ed81b73SMarko Zec 		return;
11396c2b042SJesper Skriver 
1141ed81b73SMarko Zec 	EVENTHANDLER_REGISTER(nmbclusters_change,
1151ed81b73SMarko Zec 	    frag6_change, NULL, EVENTHANDLER_PRI_ANY);
11682cea7e6SBjoern A. Zeeb 
11782cea7e6SBjoern A. Zeeb 	IP6Q_LOCK_INIT();
11882cd038dSYoshinobu Inoue }
11982cd038dSYoshinobu Inoue 
12082cd038dSYoshinobu Inoue /*
121686cdd19SJun-ichiro itojun Hagino  * In RFC2460, fragment and reassembly rule do not agree with each other,
122686cdd19SJun-ichiro itojun Hagino  * in terms of next header field handling in fragment header.
123686cdd19SJun-ichiro itojun Hagino  * While the sender will use the same value for all of the fragmented packets,
124686cdd19SJun-ichiro itojun Hagino  * receiver is suggested not to check the consistency.
125686cdd19SJun-ichiro itojun Hagino  *
126686cdd19SJun-ichiro itojun Hagino  * fragment rule (p20):
127686cdd19SJun-ichiro itojun Hagino  *	(2) A Fragment header containing:
128686cdd19SJun-ichiro itojun Hagino  *	The Next Header value that identifies the first header of
129686cdd19SJun-ichiro itojun Hagino  *	the Fragmentable Part of the original packet.
130686cdd19SJun-ichiro itojun Hagino  *		-> next header field is same for all fragments
131686cdd19SJun-ichiro itojun Hagino  *
132686cdd19SJun-ichiro itojun Hagino  * reassembly rule (p21):
133686cdd19SJun-ichiro itojun Hagino  *	The Next Header field of the last header of the Unfragmentable
134686cdd19SJun-ichiro itojun Hagino  *	Part is obtained from the Next Header field of the first
135686cdd19SJun-ichiro itojun Hagino  *	fragment's Fragment header.
136686cdd19SJun-ichiro itojun Hagino  *		-> should grab it from the first fragment only
137686cdd19SJun-ichiro itojun Hagino  *
138686cdd19SJun-ichiro itojun Hagino  * The following note also contradicts with fragment rule - no one is going to
139686cdd19SJun-ichiro itojun Hagino  * send different fragment with different next header field.
140686cdd19SJun-ichiro itojun Hagino  *
141686cdd19SJun-ichiro itojun Hagino  * additional note (p22):
142686cdd19SJun-ichiro itojun Hagino  *	The Next Header values in the Fragment headers of different
143686cdd19SJun-ichiro itojun Hagino  *	fragments of the same original packet may differ.  Only the value
144686cdd19SJun-ichiro itojun Hagino  *	from the Offset zero fragment packet is used for reassembly.
145686cdd19SJun-ichiro itojun Hagino  *		-> should grab it from the first fragment only
146686cdd19SJun-ichiro itojun Hagino  *
147686cdd19SJun-ichiro itojun Hagino  * There is no explicit reason given in the RFC.  Historical reason maybe?
148686cdd19SJun-ichiro itojun Hagino  */
149686cdd19SJun-ichiro itojun Hagino /*
15082cd038dSYoshinobu Inoue  * Fragment input
15182cd038dSYoshinobu Inoue  */
15282cd038dSYoshinobu Inoue int
1531272577eSXin LI frag6_input(struct mbuf **mp, int *offp, int proto)
15482cd038dSYoshinobu Inoue {
15582cd038dSYoshinobu Inoue 	struct mbuf *m = *mp, *t;
15682cd038dSYoshinobu Inoue 	struct ip6_hdr *ip6;
15782cd038dSYoshinobu Inoue 	struct ip6_frag *ip6f;
15882cd038dSYoshinobu Inoue 	struct ip6q *q6;
159686cdd19SJun-ichiro itojun Hagino 	struct ip6asfrag *af6, *ip6af, *af6dwn;
1602a5aafceSHajimu UMEMOTO 	struct in6_ifaddr *ia;
16182cd038dSYoshinobu Inoue 	int offset = *offp, nxt, i, next;
16282cd038dSYoshinobu Inoue 	int first_frag = 0;
163686cdd19SJun-ichiro itojun Hagino 	int fragoff, frgpartlen;	/* must be larger than u_int16_t */
16482cd038dSYoshinobu Inoue 	struct ifnet *dstifp;
16559dfcba4SHajimu UMEMOTO 	u_int8_t ecn, ecn0;
166aaa46574SAdrian Chadd #ifdef RSS
167aaa46574SAdrian Chadd 	struct m_tag *mtag;
168aaa46574SAdrian Chadd 	struct ip6_direct_ctx *ip6dc;
169aaa46574SAdrian Chadd #endif
170aaa46574SAdrian Chadd 
1711d54aa3bSBjoern A. Zeeb #if 0
1721d54aa3bSBjoern A. Zeeb 	char ip6buf[INET6_ADDRSTRLEN];
1731d54aa3bSBjoern A. Zeeb #endif
17482cd038dSYoshinobu Inoue 
17582cd038dSYoshinobu Inoue 	ip6 = mtod(m, struct ip6_hdr *);
176686cdd19SJun-ichiro itojun Hagino #ifndef PULLDOWN_TEST
177686cdd19SJun-ichiro itojun Hagino 	IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), IPPROTO_DONE);
17882cd038dSYoshinobu Inoue 	ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset);
179686cdd19SJun-ichiro itojun Hagino #else
180686cdd19SJun-ichiro itojun Hagino 	IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f));
181686cdd19SJun-ichiro itojun Hagino 	if (ip6f == NULL)
18240e39bbbSHajimu UMEMOTO 		return (IPPROTO_DONE);
183686cdd19SJun-ichiro itojun Hagino #endif
18482cd038dSYoshinobu Inoue 
18582cd038dSYoshinobu Inoue 	dstifp = NULL;
18682cd038dSYoshinobu Inoue 	/* find the destination interface of the packet. */
1873e88eb90SAndrey V. Elsukov 	ia = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */);
1883e88eb90SAndrey V. Elsukov 	if (ia != NULL) {
1892a5aafceSHajimu UMEMOTO 		dstifp = ia->ia_ifp;
1908c0fec80SRobert Watson 		ifa_free(&ia->ia_ifa);
1918c0fec80SRobert Watson 	}
19282cd038dSYoshinobu Inoue 	/* jumbo payload can't contain a fragment header */
19382cd038dSYoshinobu Inoue 	if (ip6->ip6_plen == 0) {
19482cd038dSYoshinobu Inoue 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
19582cd038dSYoshinobu Inoue 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
19682cd038dSYoshinobu Inoue 		return IPPROTO_DONE;
19782cd038dSYoshinobu Inoue 	}
19882cd038dSYoshinobu Inoue 
19982cd038dSYoshinobu Inoue 	/*
20082cd038dSYoshinobu Inoue 	 * check whether fragment packet's fragment length is
20182cd038dSYoshinobu Inoue 	 * multiple of 8 octets.
20282cd038dSYoshinobu Inoue 	 * sizeof(struct ip6_frag) == 8
20382cd038dSYoshinobu Inoue 	 * sizeof(struct ip6_hdr) = 40
20482cd038dSYoshinobu Inoue 	 */
20582cd038dSYoshinobu Inoue 	if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
20682cd038dSYoshinobu Inoue 	    (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
20706cd0a3fSHajimu UMEMOTO 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
208686cdd19SJun-ichiro itojun Hagino 		    offsetof(struct ip6_hdr, ip6_plen));
20982cd038dSYoshinobu Inoue 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
21082cd038dSYoshinobu Inoue 		return IPPROTO_DONE;
21182cd038dSYoshinobu Inoue 	}
21282cd038dSYoshinobu Inoue 
2139cb8d207SAndrey V. Elsukov 	IP6STAT_INC(ip6s_fragments);
21482cd038dSYoshinobu Inoue 	in6_ifstat_inc(dstifp, ifs6_reass_reqd);
21582cd038dSYoshinobu Inoue 
216686cdd19SJun-ichiro itojun Hagino 	/* offset now points to data portion */
21782cd038dSYoshinobu Inoue 	offset += sizeof(struct ip6_frag);
21882cd038dSYoshinobu Inoue 
2194018ea9aSBjoern A. Zeeb 	/*
220fd291ae3SBjoern A. Zeeb 	 * RFC 6946: Handle "atomic" fragments (offset and m bit set to 0)
221fd291ae3SBjoern A. Zeeb 	 * upfront, unrelated to any reassembly.  Just skip the fragment header.
2224018ea9aSBjoern A. Zeeb 	 */
2234018ea9aSBjoern A. Zeeb 	if ((ip6f->ip6f_offlg & ~IP6F_RESERVED_MASK) == 0) {
2244018ea9aSBjoern A. Zeeb 		/* XXX-BZ we want dedicated counters for this. */
2259cb8d207SAndrey V. Elsukov 		IP6STAT_INC(ip6s_reassembled);
2264018ea9aSBjoern A. Zeeb 		in6_ifstat_inc(dstifp, ifs6_reass_ok);
2274018ea9aSBjoern A. Zeeb 		*offp = offset;
2284018ea9aSBjoern A. Zeeb 		return (ip6f->ip6f_nxt);
2294018ea9aSBjoern A. Zeeb 	}
2304018ea9aSBjoern A. Zeeb 
2319888c401SHajimu UMEMOTO 	IP6Q_LOCK();
2329888c401SHajimu UMEMOTO 
2339888c401SHajimu UMEMOTO 	/*
2349888c401SHajimu UMEMOTO 	 * Enforce upper bound on number of fragments.
2359888c401SHajimu UMEMOTO 	 * If maxfrag is 0, never accept fragments.
2369888c401SHajimu UMEMOTO 	 * If maxfrag is -1, accept all fragments without limitation.
2379888c401SHajimu UMEMOTO 	 */
238603724d3SBjoern A. Zeeb 	if (V_ip6_maxfrags < 0)
2399888c401SHajimu UMEMOTO 		;
240603724d3SBjoern A. Zeeb 	else if (V_frag6_nfrags >= (u_int)V_ip6_maxfrags)
2419888c401SHajimu UMEMOTO 		goto dropfrag;
24233841545SHajimu UMEMOTO 
243603724d3SBjoern A. Zeeb 	for (q6 = V_ip6q.ip6q_next; q6 != &V_ip6q; q6 = q6->ip6q_next)
24482cd038dSYoshinobu Inoue 		if (ip6f->ip6f_ident == q6->ip6q_ident &&
24582cd038dSYoshinobu Inoue 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) &&
2464b908c8bSRobert Watson 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst)
2474b908c8bSRobert Watson #ifdef MAC
2484b908c8bSRobert Watson 		    && mac_ip6q_match(m, q6)
2494b908c8bSRobert Watson #endif
2504b908c8bSRobert Watson 		    )
25182cd038dSYoshinobu Inoue 			break;
25282cd038dSYoshinobu Inoue 
253603724d3SBjoern A. Zeeb 	if (q6 == &V_ip6q) {
25482cd038dSYoshinobu Inoue 		/*
25582cd038dSYoshinobu Inoue 		 * the first fragment to arrive, create a reassembly queue.
25682cd038dSYoshinobu Inoue 		 */
25782cd038dSYoshinobu Inoue 		first_frag = 1;
25882cd038dSYoshinobu Inoue 
25982cd038dSYoshinobu Inoue 		/*
26082cd038dSYoshinobu Inoue 		 * Enforce upper bound on number of fragmented packets
26182cd038dSYoshinobu Inoue 		 * for which we attempt reassembly;
2629888c401SHajimu UMEMOTO 		 * If maxfragpackets is 0, never accept fragments.
2639888c401SHajimu UMEMOTO 		 * If maxfragpackets is -1, accept all fragments without
2649888c401SHajimu UMEMOTO 		 * limitation.
26582cd038dSYoshinobu Inoue 		 */
266603724d3SBjoern A. Zeeb 		if (V_ip6_maxfragpackets < 0)
26733841545SHajimu UMEMOTO 			;
268603724d3SBjoern A. Zeeb 		else if (V_frag6_nfragpackets >= (u_int)V_ip6_maxfragpackets)
26933841545SHajimu UMEMOTO 			goto dropfrag;
270603724d3SBjoern A. Zeeb 		V_frag6_nfragpackets++;
27182cd038dSYoshinobu Inoue 		q6 = (struct ip6q *)malloc(sizeof(struct ip6q), M_FTABLE,
2728c0dd0e4SHajimu UMEMOTO 		    M_NOWAIT);
27382cd038dSYoshinobu Inoue 		if (q6 == NULL)
27482cd038dSYoshinobu Inoue 			goto dropfrag;
275686cdd19SJun-ichiro itojun Hagino 		bzero(q6, sizeof(*q6));
2764b908c8bSRobert Watson #ifdef MAC
2774b908c8bSRobert Watson 		if (mac_ip6q_init(q6, M_NOWAIT) != 0) {
2784b908c8bSRobert Watson 			free(q6, M_FTABLE);
2794b908c8bSRobert Watson 			goto dropfrag;
2804b908c8bSRobert Watson 		}
2814b908c8bSRobert Watson 		mac_ip6q_create(m, q6);
2824b908c8bSRobert Watson #endif
283603724d3SBjoern A. Zeeb 		frag6_insque(q6, &V_ip6q);
28482cd038dSYoshinobu Inoue 
285686cdd19SJun-ichiro itojun Hagino 		/* ip6q_nxt will be filled afterwards, from 1st fragment */
28682cd038dSYoshinobu Inoue 		q6->ip6q_down	= q6->ip6q_up = (struct ip6asfrag *)q6;
287686cdd19SJun-ichiro itojun Hagino #ifdef notyet
288686cdd19SJun-ichiro itojun Hagino 		q6->ip6q_nxtp	= (u_char *)nxtp;
289686cdd19SJun-ichiro itojun Hagino #endif
29082cd038dSYoshinobu Inoue 		q6->ip6q_ident	= ip6f->ip6f_ident;
29182cd038dSYoshinobu Inoue 		q6->ip6q_ttl	= IPV6_FRAGTTL;
29282cd038dSYoshinobu Inoue 		q6->ip6q_src	= ip6->ip6_src;
29382cd038dSYoshinobu Inoue 		q6->ip6q_dst	= ip6->ip6_dst;
2945e9510e3SJINMEI Tatuya 		q6->ip6q_ecn	=
2955e9510e3SJINMEI Tatuya 		    (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
29682cd038dSYoshinobu Inoue 		q6->ip6q_unfrglen = -1;	/* The 1st fragment has not arrived. */
2979888c401SHajimu UMEMOTO 
2989888c401SHajimu UMEMOTO 		q6->ip6q_nfrag = 0;
29982cd038dSYoshinobu Inoue 	}
30082cd038dSYoshinobu Inoue 
30182cd038dSYoshinobu Inoue 	/*
30282cd038dSYoshinobu Inoue 	 * If it's the 1st fragment, record the length of the
30382cd038dSYoshinobu Inoue 	 * unfragmentable part and the next header of the fragment header.
30482cd038dSYoshinobu Inoue 	 */
30582cd038dSYoshinobu Inoue 	fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
30682cd038dSYoshinobu Inoue 	if (fragoff == 0) {
30706cd0a3fSHajimu UMEMOTO 		q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr) -
30806cd0a3fSHajimu UMEMOTO 		    sizeof(struct ip6_frag);
30982cd038dSYoshinobu Inoue 		q6->ip6q_nxt = ip6f->ip6f_nxt;
31082cd038dSYoshinobu Inoue 	}
31182cd038dSYoshinobu Inoue 
31282cd038dSYoshinobu Inoue 	/*
31382cd038dSYoshinobu Inoue 	 * Check that the reassembled packet would not exceed 65535 bytes
31482cd038dSYoshinobu Inoue 	 * in size.
31582cd038dSYoshinobu Inoue 	 * If it would exceed, discard the fragment and return an ICMP error.
31682cd038dSYoshinobu Inoue 	 */
31782cd038dSYoshinobu Inoue 	frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
31882cd038dSYoshinobu Inoue 	if (q6->ip6q_unfrglen >= 0) {
31982cd038dSYoshinobu Inoue 		/* The 1st fragment has already arrived. */
32082cd038dSYoshinobu Inoue 		if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
32182cd038dSYoshinobu Inoue 			icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
322686cdd19SJun-ichiro itojun Hagino 			    offset - sizeof(struct ip6_frag) +
323686cdd19SJun-ichiro itojun Hagino 			    offsetof(struct ip6_frag, ip6f_offlg));
3249888c401SHajimu UMEMOTO 			IP6Q_UNLOCK();
32582cd038dSYoshinobu Inoue 			return (IPPROTO_DONE);
32682cd038dSYoshinobu Inoue 		}
32706cd0a3fSHajimu UMEMOTO 	} else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
32882cd038dSYoshinobu Inoue 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
329686cdd19SJun-ichiro itojun Hagino 		    offset - sizeof(struct ip6_frag) +
330686cdd19SJun-ichiro itojun Hagino 		    offsetof(struct ip6_frag, ip6f_offlg));
3319888c401SHajimu UMEMOTO 		IP6Q_UNLOCK();
33282cd038dSYoshinobu Inoue 		return (IPPROTO_DONE);
33382cd038dSYoshinobu Inoue 	}
33482cd038dSYoshinobu Inoue 	/*
33582cd038dSYoshinobu Inoue 	 * If it's the first fragment, do the above check for each
33682cd038dSYoshinobu Inoue 	 * fragment already stored in the reassembly queue.
33782cd038dSYoshinobu Inoue 	 */
33882cd038dSYoshinobu Inoue 	if (fragoff == 0) {
33982cd038dSYoshinobu Inoue 		for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
34082cd038dSYoshinobu Inoue 		     af6 = af6dwn) {
34182cd038dSYoshinobu Inoue 			af6dwn = af6->ip6af_down;
34282cd038dSYoshinobu Inoue 
34382cd038dSYoshinobu Inoue 			if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
34482cd038dSYoshinobu Inoue 			    IPV6_MAXPACKET) {
34582cd038dSYoshinobu Inoue 				struct mbuf *merr = IP6_REASS_MBUF(af6);
34682cd038dSYoshinobu Inoue 				struct ip6_hdr *ip6err;
34782cd038dSYoshinobu Inoue 				int erroff = af6->ip6af_offset;
34882cd038dSYoshinobu Inoue 
34982cd038dSYoshinobu Inoue 				/* dequeue the fragment. */
35082cd038dSYoshinobu Inoue 				frag6_deq(af6);
351686cdd19SJun-ichiro itojun Hagino 				free(af6, M_FTABLE);
35282cd038dSYoshinobu Inoue 
35382cd038dSYoshinobu Inoue 				/* adjust pointer. */
35482cd038dSYoshinobu Inoue 				ip6err = mtod(merr, struct ip6_hdr *);
35582cd038dSYoshinobu Inoue 
35682cd038dSYoshinobu Inoue 				/*
35782cd038dSYoshinobu Inoue 				 * Restore source and destination addresses
35882cd038dSYoshinobu Inoue 				 * in the erroneous IPv6 header.
35982cd038dSYoshinobu Inoue 				 */
36082cd038dSYoshinobu Inoue 				ip6err->ip6_src = q6->ip6q_src;
36182cd038dSYoshinobu Inoue 				ip6err->ip6_dst = q6->ip6q_dst;
36282cd038dSYoshinobu Inoue 
36382cd038dSYoshinobu Inoue 				icmp6_error(merr, ICMP6_PARAM_PROB,
36482cd038dSYoshinobu Inoue 				    ICMP6_PARAMPROB_HEADER,
365686cdd19SJun-ichiro itojun Hagino 				    erroff - sizeof(struct ip6_frag) +
366686cdd19SJun-ichiro itojun Hagino 				    offsetof(struct ip6_frag, ip6f_offlg));
36782cd038dSYoshinobu Inoue 			}
36882cd038dSYoshinobu Inoue 		}
36982cd038dSYoshinobu Inoue 	}
37082cd038dSYoshinobu Inoue 
371686cdd19SJun-ichiro itojun Hagino 	ip6af = (struct ip6asfrag *)malloc(sizeof(struct ip6asfrag), M_FTABLE,
3728c0dd0e4SHajimu UMEMOTO 	    M_NOWAIT);
373686cdd19SJun-ichiro itojun Hagino 	if (ip6af == NULL)
374686cdd19SJun-ichiro itojun Hagino 		goto dropfrag;
375686cdd19SJun-ichiro itojun Hagino 	bzero(ip6af, sizeof(*ip6af));
37682cd038dSYoshinobu Inoue 	ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG;
37782cd038dSYoshinobu Inoue 	ip6af->ip6af_off = fragoff;
37882cd038dSYoshinobu Inoue 	ip6af->ip6af_frglen = frgpartlen;
37982cd038dSYoshinobu Inoue 	ip6af->ip6af_offset = offset;
38082cd038dSYoshinobu Inoue 	IP6_REASS_MBUF(ip6af) = m;
38182cd038dSYoshinobu Inoue 
38282cd038dSYoshinobu Inoue 	if (first_frag) {
38382cd038dSYoshinobu Inoue 		af6 = (struct ip6asfrag *)q6;
38482cd038dSYoshinobu Inoue 		goto insert;
38582cd038dSYoshinobu Inoue 	}
38682cd038dSYoshinobu Inoue 
38782cd038dSYoshinobu Inoue 	/*
38859dfcba4SHajimu UMEMOTO 	 * Handle ECN by comparing this segment with the first one;
38959dfcba4SHajimu UMEMOTO 	 * if CE is set, do not lose CE.
39059dfcba4SHajimu UMEMOTO 	 * drop if CE and not-ECT are mixed for the same packet.
39159dfcba4SHajimu UMEMOTO 	 */
39259dfcba4SHajimu UMEMOTO 	ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
3935e9510e3SJINMEI Tatuya 	ecn0 = q6->ip6q_ecn;
39459dfcba4SHajimu UMEMOTO 	if (ecn == IPTOS_ECN_CE) {
39559dfcba4SHajimu UMEMOTO 		if (ecn0 == IPTOS_ECN_NOTECT) {
39659dfcba4SHajimu UMEMOTO 			free(ip6af, M_FTABLE);
39759dfcba4SHajimu UMEMOTO 			goto dropfrag;
39859dfcba4SHajimu UMEMOTO 		}
39959dfcba4SHajimu UMEMOTO 		if (ecn0 != IPTOS_ECN_CE)
4005e9510e3SJINMEI Tatuya 			q6->ip6q_ecn = IPTOS_ECN_CE;
40159dfcba4SHajimu UMEMOTO 	}
40259dfcba4SHajimu UMEMOTO 	if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) {
40359dfcba4SHajimu UMEMOTO 		free(ip6af, M_FTABLE);
40459dfcba4SHajimu UMEMOTO 		goto dropfrag;
40559dfcba4SHajimu UMEMOTO 	}
40659dfcba4SHajimu UMEMOTO 
40759dfcba4SHajimu UMEMOTO 	/*
40882cd038dSYoshinobu Inoue 	 * Find a segment which begins after this one does.
40982cd038dSYoshinobu Inoue 	 */
41082cd038dSYoshinobu Inoue 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
41182cd038dSYoshinobu Inoue 	     af6 = af6->ip6af_down)
41282cd038dSYoshinobu Inoue 		if (af6->ip6af_off > ip6af->ip6af_off)
41382cd038dSYoshinobu Inoue 			break;
41482cd038dSYoshinobu Inoue 
415686cdd19SJun-ichiro itojun Hagino #if 0
416686cdd19SJun-ichiro itojun Hagino 	/*
417686cdd19SJun-ichiro itojun Hagino 	 * If there is a preceding segment, it may provide some of
418686cdd19SJun-ichiro itojun Hagino 	 * our data already.  If so, drop the data from the incoming
419686cdd19SJun-ichiro itojun Hagino 	 * segment.  If it provides all of our data, drop us.
420686cdd19SJun-ichiro itojun Hagino 	 */
421686cdd19SJun-ichiro itojun Hagino 	if (af6->ip6af_up != (struct ip6asfrag *)q6) {
422686cdd19SJun-ichiro itojun Hagino 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
423686cdd19SJun-ichiro itojun Hagino 			- ip6af->ip6af_off;
424686cdd19SJun-ichiro itojun Hagino 		if (i > 0) {
425686cdd19SJun-ichiro itojun Hagino 			if (i >= ip6af->ip6af_frglen)
426686cdd19SJun-ichiro itojun Hagino 				goto dropfrag;
427686cdd19SJun-ichiro itojun Hagino 			m_adj(IP6_REASS_MBUF(ip6af), i);
428686cdd19SJun-ichiro itojun Hagino 			ip6af->ip6af_off += i;
429686cdd19SJun-ichiro itojun Hagino 			ip6af->ip6af_frglen -= i;
430686cdd19SJun-ichiro itojun Hagino 		}
431686cdd19SJun-ichiro itojun Hagino 	}
432686cdd19SJun-ichiro itojun Hagino 
433686cdd19SJun-ichiro itojun Hagino 	/*
434686cdd19SJun-ichiro itojun Hagino 	 * While we overlap succeeding segments trim them or,
435686cdd19SJun-ichiro itojun Hagino 	 * if they are completely covered, dequeue them.
436686cdd19SJun-ichiro itojun Hagino 	 */
437686cdd19SJun-ichiro itojun Hagino 	while (af6 != (struct ip6asfrag *)q6 &&
438686cdd19SJun-ichiro itojun Hagino 	       ip6af->ip6af_off + ip6af->ip6af_frglen > af6->ip6af_off) {
439686cdd19SJun-ichiro itojun Hagino 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
440686cdd19SJun-ichiro itojun Hagino 		if (i < af6->ip6af_frglen) {
441686cdd19SJun-ichiro itojun Hagino 			af6->ip6af_frglen -= i;
442686cdd19SJun-ichiro itojun Hagino 			af6->ip6af_off += i;
443686cdd19SJun-ichiro itojun Hagino 			m_adj(IP6_REASS_MBUF(af6), i);
444686cdd19SJun-ichiro itojun Hagino 			break;
445686cdd19SJun-ichiro itojun Hagino 		}
446686cdd19SJun-ichiro itojun Hagino 		af6 = af6->ip6af_down;
447686cdd19SJun-ichiro itojun Hagino 		m_freem(IP6_REASS_MBUF(af6->ip6af_up));
448686cdd19SJun-ichiro itojun Hagino 		frag6_deq(af6->ip6af_up);
449686cdd19SJun-ichiro itojun Hagino 	}
450686cdd19SJun-ichiro itojun Hagino #else
45182cd038dSYoshinobu Inoue 	/*
45282cd038dSYoshinobu Inoue 	 * If the incoming framgent overlaps some existing fragments in
45382cd038dSYoshinobu Inoue 	 * the reassembly queue, drop it, since it is dangerous to override
45482cd038dSYoshinobu Inoue 	 * existing fragments from a security point of view.
4559888c401SHajimu UMEMOTO 	 * We don't know which fragment is the bad guy - here we trust
4569888c401SHajimu UMEMOTO 	 * fragment that came in earlier, with no real reason.
4575e9510e3SJINMEI Tatuya 	 *
4585e9510e3SJINMEI Tatuya 	 * Note: due to changes after disabling this part, mbuf passed to
4595e9510e3SJINMEI Tatuya 	 * m_adj() below now does not meet the requirement.
46082cd038dSYoshinobu Inoue 	 */
46182cd038dSYoshinobu Inoue 	if (af6->ip6af_up != (struct ip6asfrag *)q6) {
46282cd038dSYoshinobu Inoue 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
46382cd038dSYoshinobu Inoue 			- ip6af->ip6af_off;
46482cd038dSYoshinobu Inoue 		if (i > 0) {
4652bf76779SMunechika SUMIKAWA #if 0				/* suppress the noisy log */
46682cd038dSYoshinobu Inoue 			log(LOG_ERR, "%d bytes of a fragment from %s "
46782cd038dSYoshinobu Inoue 			    "overlaps the previous fragment\n",
4681d54aa3bSBjoern A. Zeeb 			    i, ip6_sprintf(ip6buf, &q6->ip6q_src));
4692bf76779SMunechika SUMIKAWA #endif
4702bf76779SMunechika SUMIKAWA 			free(ip6af, M_FTABLE);
47182cd038dSYoshinobu Inoue 			goto dropfrag;
47282cd038dSYoshinobu Inoue 		}
47382cd038dSYoshinobu Inoue 	}
47482cd038dSYoshinobu Inoue 	if (af6 != (struct ip6asfrag *)q6) {
47582cd038dSYoshinobu Inoue 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
47682cd038dSYoshinobu Inoue 		if (i > 0) {
4772bf76779SMunechika SUMIKAWA #if 0				/* suppress the noisy log */
47882cd038dSYoshinobu Inoue 			log(LOG_ERR, "%d bytes of a fragment from %s "
47982cd038dSYoshinobu Inoue 			    "overlaps the succeeding fragment",
4801d54aa3bSBjoern A. Zeeb 			    i, ip6_sprintf(ip6buf, &q6->ip6q_src));
4812bf76779SMunechika SUMIKAWA #endif
4822bf76779SMunechika SUMIKAWA 			free(ip6af, M_FTABLE);
48382cd038dSYoshinobu Inoue 			goto dropfrag;
48482cd038dSYoshinobu Inoue 		}
48582cd038dSYoshinobu Inoue 	}
486686cdd19SJun-ichiro itojun Hagino #endif
48782cd038dSYoshinobu Inoue 
48882cd038dSYoshinobu Inoue insert:
4894b908c8bSRobert Watson #ifdef MAC
4904b908c8bSRobert Watson 	if (!first_frag)
4914b908c8bSRobert Watson 		mac_ip6q_update(m, q6);
4924b908c8bSRobert Watson #endif
49382cd038dSYoshinobu Inoue 
49482cd038dSYoshinobu Inoue 	/*
49582cd038dSYoshinobu Inoue 	 * Stick new segment in its place;
49682cd038dSYoshinobu Inoue 	 * check for complete reassembly.
49782cd038dSYoshinobu Inoue 	 * Move to front of packet queue, as we are
49882cd038dSYoshinobu Inoue 	 * the most recently active fragmented packet.
49982cd038dSYoshinobu Inoue 	 */
50082cd038dSYoshinobu Inoue 	frag6_enq(ip6af, af6->ip6af_up);
501603724d3SBjoern A. Zeeb 	V_frag6_nfrags++;
5029888c401SHajimu UMEMOTO 	q6->ip6q_nfrag++;
503686cdd19SJun-ichiro itojun Hagino #if 0 /* xxx */
504603724d3SBjoern A. Zeeb 	if (q6 != V_ip6q.ip6q_next) {
505686cdd19SJun-ichiro itojun Hagino 		frag6_remque(q6);
506603724d3SBjoern A. Zeeb 		frag6_insque(q6, &V_ip6q);
507686cdd19SJun-ichiro itojun Hagino 	}
508686cdd19SJun-ichiro itojun Hagino #endif
50982cd038dSYoshinobu Inoue 	next = 0;
51082cd038dSYoshinobu Inoue 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
51182cd038dSYoshinobu Inoue 	     af6 = af6->ip6af_down) {
51282cd038dSYoshinobu Inoue 		if (af6->ip6af_off != next) {
5139888c401SHajimu UMEMOTO 			IP6Q_UNLOCK();
51482cd038dSYoshinobu Inoue 			return IPPROTO_DONE;
51582cd038dSYoshinobu Inoue 		}
51682cd038dSYoshinobu Inoue 		next += af6->ip6af_frglen;
51782cd038dSYoshinobu Inoue 	}
51882cd038dSYoshinobu Inoue 	if (af6->ip6af_up->ip6af_mff) {
5199888c401SHajimu UMEMOTO 		IP6Q_UNLOCK();
52082cd038dSYoshinobu Inoue 		return IPPROTO_DONE;
52182cd038dSYoshinobu Inoue 	}
52282cd038dSYoshinobu Inoue 
52382cd038dSYoshinobu Inoue 	/*
52482cd038dSYoshinobu Inoue 	 * Reassembly is complete; concatenate fragments.
52582cd038dSYoshinobu Inoue 	 */
52682cd038dSYoshinobu Inoue 	ip6af = q6->ip6q_down;
52782cd038dSYoshinobu Inoue 	t = m = IP6_REASS_MBUF(ip6af);
52882cd038dSYoshinobu Inoue 	af6 = ip6af->ip6af_down;
529686cdd19SJun-ichiro itojun Hagino 	frag6_deq(ip6af);
53082cd038dSYoshinobu Inoue 	while (af6 != (struct ip6asfrag *)q6) {
531*9907aba3SAndrey V. Elsukov 		m->m_pkthdr.csum_flags &=
532*9907aba3SAndrey V. Elsukov 		    IP6_REASS_MBUF(af6)->m_pkthdr.csum_flags;
533*9907aba3SAndrey V. Elsukov 		m->m_pkthdr.csum_data +=
534*9907aba3SAndrey V. Elsukov 		    IP6_REASS_MBUF(af6)->m_pkthdr.csum_data;
535*9907aba3SAndrey V. Elsukov 
536686cdd19SJun-ichiro itojun Hagino 		af6dwn = af6->ip6af_down;
537686cdd19SJun-ichiro itojun Hagino 		frag6_deq(af6);
53882cd038dSYoshinobu Inoue 		while (t->m_next)
53982cd038dSYoshinobu Inoue 			t = t->m_next;
540ba99cc0bSAlexander V. Chernikov 		m_adj(IP6_REASS_MBUF(af6), af6->ip6af_offset);
541ba99cc0bSAlexander V. Chernikov 		m_cat(t, IP6_REASS_MBUF(af6));
542686cdd19SJun-ichiro itojun Hagino 		free(af6, M_FTABLE);
543686cdd19SJun-ichiro itojun Hagino 		af6 = af6dwn;
54482cd038dSYoshinobu Inoue 	}
54582cd038dSYoshinobu Inoue 
546*9907aba3SAndrey V. Elsukov 	while (m->m_pkthdr.csum_data & 0xffff0000)
547*9907aba3SAndrey V. Elsukov 		m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) +
548*9907aba3SAndrey V. Elsukov 		    (m->m_pkthdr.csum_data >> 16);
549*9907aba3SAndrey V. Elsukov 
55082cd038dSYoshinobu Inoue 	/* adjust offset to point where the original next header starts */
55182cd038dSYoshinobu Inoue 	offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
552686cdd19SJun-ichiro itojun Hagino 	free(ip6af, M_FTABLE);
553686cdd19SJun-ichiro itojun Hagino 	ip6 = mtod(m, struct ip6_hdr *);
55482cd038dSYoshinobu Inoue 	ip6->ip6_plen = htons((u_short)next + offset - sizeof(struct ip6_hdr));
5555e9510e3SJINMEI Tatuya 	if (q6->ip6q_ecn == IPTOS_ECN_CE)
5565e9510e3SJINMEI Tatuya 		ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20);
55782cd038dSYoshinobu Inoue 	nxt = q6->ip6q_nxt;
558686cdd19SJun-ichiro itojun Hagino #ifdef notyet
559686cdd19SJun-ichiro itojun Hagino 	*q6->ip6q_nxtp = (u_char)(nxt & 0xff);
560686cdd19SJun-ichiro itojun Hagino #endif
56182cd038dSYoshinobu Inoue 
5620b438b0fSGleb Smirnoff 	if (ip6_deletefraghdr(m, offset, M_NOWAIT) != 0) {
563686cdd19SJun-ichiro itojun Hagino 		frag6_remque(q6);
564603724d3SBjoern A. Zeeb 		V_frag6_nfrags -= q6->ip6q_nfrag;
5654b908c8bSRobert Watson #ifdef MAC
5664b908c8bSRobert Watson 		mac_ip6q_destroy(q6);
5674b908c8bSRobert Watson #endif
568686cdd19SJun-ichiro itojun Hagino 		free(q6, M_FTABLE);
569603724d3SBjoern A. Zeeb 		V_frag6_nfragpackets--;
5700b438b0fSGleb Smirnoff 
571686cdd19SJun-ichiro itojun Hagino 		goto dropfrag;
57282cd038dSYoshinobu Inoue 	}
57382cd038dSYoshinobu Inoue 
57482cd038dSYoshinobu Inoue 	/*
57582cd038dSYoshinobu Inoue 	 * Store NXT to the original.
57682cd038dSYoshinobu Inoue 	 */
57782cd038dSYoshinobu Inoue 	{
57882cd038dSYoshinobu Inoue 		char *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */
57982cd038dSYoshinobu Inoue 		*prvnxtp = nxt;
58082cd038dSYoshinobu Inoue 	}
58182cd038dSYoshinobu Inoue 
58282cd038dSYoshinobu Inoue 	frag6_remque(q6);
583603724d3SBjoern A. Zeeb 	V_frag6_nfrags -= q6->ip6q_nfrag;
5844b908c8bSRobert Watson #ifdef MAC
5854b908c8bSRobert Watson 	mac_ip6q_reassemble(q6, m);
5864b908c8bSRobert Watson 	mac_ip6q_destroy(q6);
5874b908c8bSRobert Watson #endif
58882cd038dSYoshinobu Inoue 	free(q6, M_FTABLE);
589603724d3SBjoern A. Zeeb 	V_frag6_nfragpackets--;
59082cd038dSYoshinobu Inoue 
59182cd038dSYoshinobu Inoue 	if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */
59282cd038dSYoshinobu Inoue 		int plen = 0;
59382cd038dSYoshinobu Inoue 		for (t = m; t; t = t->m_next)
59482cd038dSYoshinobu Inoue 			plen += t->m_len;
59582cd038dSYoshinobu Inoue 		m->m_pkthdr.len = plen;
59682cd038dSYoshinobu Inoue 	}
59782cd038dSYoshinobu Inoue 
598aaa46574SAdrian Chadd #ifdef RSS
599aaa46574SAdrian Chadd 	mtag = m_tag_alloc(MTAG_ABI_IPV6, IPV6_TAG_DIRECT, sizeof(*ip6dc),
600aaa46574SAdrian Chadd 	    M_NOWAIT);
601aaa46574SAdrian Chadd 	if (mtag == NULL)
602aaa46574SAdrian Chadd 		goto dropfrag;
603aaa46574SAdrian Chadd 
604aaa46574SAdrian Chadd 	ip6dc = (struct ip6_direct_ctx *)(mtag + 1);
605aaa46574SAdrian Chadd 	ip6dc->ip6dc_nxt = nxt;
606aaa46574SAdrian Chadd 	ip6dc->ip6dc_off = offset;
607aaa46574SAdrian Chadd 
608aaa46574SAdrian Chadd 	m_tag_prepend(m, mtag);
609aaa46574SAdrian Chadd #endif
610aaa46574SAdrian Chadd 
611aaa46574SAdrian Chadd 	IP6Q_UNLOCK();
6129cb8d207SAndrey V. Elsukov 	IP6STAT_INC(ip6s_reassembled);
61382cd038dSYoshinobu Inoue 	in6_ifstat_inc(dstifp, ifs6_reass_ok);
61482cd038dSYoshinobu Inoue 
615aaa46574SAdrian Chadd #ifdef RSS
616aaa46574SAdrian Chadd 	/*
617aaa46574SAdrian Chadd 	 * Queue/dispatch for reprocessing.
618aaa46574SAdrian Chadd 	 */
619aaa46574SAdrian Chadd 	netisr_dispatch(NETISR_IPV6_DIRECT, m);
620aaa46574SAdrian Chadd 	return IPPROTO_DONE;
621aaa46574SAdrian Chadd #endif
622aaa46574SAdrian Chadd 
62382cd038dSYoshinobu Inoue 	/*
62482cd038dSYoshinobu Inoue 	 * Tell launch routine the next header
62582cd038dSYoshinobu Inoue 	 */
62682cd038dSYoshinobu Inoue 
62782cd038dSYoshinobu Inoue 	*mp = m;
62882cd038dSYoshinobu Inoue 	*offp = offset;
62982cd038dSYoshinobu Inoue 
63082cd038dSYoshinobu Inoue 	return nxt;
63182cd038dSYoshinobu Inoue 
63282cd038dSYoshinobu Inoue  dropfrag:
63331e8f7e5SHajimu UMEMOTO 	IP6Q_UNLOCK();
63482cd038dSYoshinobu Inoue 	in6_ifstat_inc(dstifp, ifs6_reass_fail);
6359cb8d207SAndrey V. Elsukov 	IP6STAT_INC(ip6s_fragdropped);
63682cd038dSYoshinobu Inoue 	m_freem(m);
63782cd038dSYoshinobu Inoue 	return IPPROTO_DONE;
63882cd038dSYoshinobu Inoue }
63982cd038dSYoshinobu Inoue 
64082cd038dSYoshinobu Inoue /*
64182cd038dSYoshinobu Inoue  * Free a fragment reassembly header and all
64282cd038dSYoshinobu Inoue  * associated datagrams.
64382cd038dSYoshinobu Inoue  */
64482cd038dSYoshinobu Inoue void
6451272577eSXin LI frag6_freef(struct ip6q *q6)
64682cd038dSYoshinobu Inoue {
64782cd038dSYoshinobu Inoue 	struct ip6asfrag *af6, *down6;
64882cd038dSYoshinobu Inoue 
6499bcf770cSHajimu UMEMOTO 	IP6Q_LOCK_ASSERT();
6509888c401SHajimu UMEMOTO 
65182cd038dSYoshinobu Inoue 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
65282cd038dSYoshinobu Inoue 	     af6 = down6) {
65382cd038dSYoshinobu Inoue 		struct mbuf *m = IP6_REASS_MBUF(af6);
65482cd038dSYoshinobu Inoue 
65582cd038dSYoshinobu Inoue 		down6 = af6->ip6af_down;
65682cd038dSYoshinobu Inoue 		frag6_deq(af6);
65782cd038dSYoshinobu Inoue 
65882cd038dSYoshinobu Inoue 		/*
65982cd038dSYoshinobu Inoue 		 * Return ICMP time exceeded error for the 1st fragment.
66082cd038dSYoshinobu Inoue 		 * Just free other fragments.
66182cd038dSYoshinobu Inoue 		 */
66282cd038dSYoshinobu Inoue 		if (af6->ip6af_off == 0) {
66382cd038dSYoshinobu Inoue 			struct ip6_hdr *ip6;
66482cd038dSYoshinobu Inoue 
66582cd038dSYoshinobu Inoue 			/* adjust pointer */
66682cd038dSYoshinobu Inoue 			ip6 = mtod(m, struct ip6_hdr *);
66782cd038dSYoshinobu Inoue 
66806cd0a3fSHajimu UMEMOTO 			/* restore source and destination addresses */
66982cd038dSYoshinobu Inoue 			ip6->ip6_src = q6->ip6q_src;
67082cd038dSYoshinobu Inoue 			ip6->ip6_dst = q6->ip6q_dst;
67182cd038dSYoshinobu Inoue 
67282cd038dSYoshinobu Inoue 			icmp6_error(m, ICMP6_TIME_EXCEEDED,
67382cd038dSYoshinobu Inoue 				    ICMP6_TIME_EXCEED_REASSEMBLY, 0);
674686cdd19SJun-ichiro itojun Hagino 		} else
67582cd038dSYoshinobu Inoue 			m_freem(m);
676686cdd19SJun-ichiro itojun Hagino 		free(af6, M_FTABLE);
67782cd038dSYoshinobu Inoue 	}
67882cd038dSYoshinobu Inoue 	frag6_remque(q6);
679603724d3SBjoern A. Zeeb 	V_frag6_nfrags -= q6->ip6q_nfrag;
6804b908c8bSRobert Watson #ifdef MAC
6814b908c8bSRobert Watson 	mac_ip6q_destroy(q6);
6824b908c8bSRobert Watson #endif
68382cd038dSYoshinobu Inoue 	free(q6, M_FTABLE);
684603724d3SBjoern A. Zeeb 	V_frag6_nfragpackets--;
68582cd038dSYoshinobu Inoue }
68682cd038dSYoshinobu Inoue 
68782cd038dSYoshinobu Inoue /*
68882cd038dSYoshinobu Inoue  * Put an ip fragment on a reassembly chain.
68982cd038dSYoshinobu Inoue  * Like insque, but pointers in middle of structure.
69082cd038dSYoshinobu Inoue  */
69182cd038dSYoshinobu Inoue void
6921272577eSXin LI frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
69382cd038dSYoshinobu Inoue {
6949888c401SHajimu UMEMOTO 
6959bcf770cSHajimu UMEMOTO 	IP6Q_LOCK_ASSERT();
6969888c401SHajimu UMEMOTO 
69782cd038dSYoshinobu Inoue 	af6->ip6af_up = up6;
69882cd038dSYoshinobu Inoue 	af6->ip6af_down = up6->ip6af_down;
69982cd038dSYoshinobu Inoue 	up6->ip6af_down->ip6af_up = af6;
70082cd038dSYoshinobu Inoue 	up6->ip6af_down = af6;
70182cd038dSYoshinobu Inoue }
70282cd038dSYoshinobu Inoue 
70382cd038dSYoshinobu Inoue /*
70482cd038dSYoshinobu Inoue  * To frag6_enq as remque is to insque.
70582cd038dSYoshinobu Inoue  */
70682cd038dSYoshinobu Inoue void
7071272577eSXin LI frag6_deq(struct ip6asfrag *af6)
70882cd038dSYoshinobu Inoue {
7099888c401SHajimu UMEMOTO 
7109bcf770cSHajimu UMEMOTO 	IP6Q_LOCK_ASSERT();
7119888c401SHajimu UMEMOTO 
71282cd038dSYoshinobu Inoue 	af6->ip6af_up->ip6af_down = af6->ip6af_down;
71382cd038dSYoshinobu Inoue 	af6->ip6af_down->ip6af_up = af6->ip6af_up;
71482cd038dSYoshinobu Inoue }
71582cd038dSYoshinobu Inoue 
71682cd038dSYoshinobu Inoue void
7171272577eSXin LI frag6_insque(struct ip6q *new, struct ip6q *old)
71882cd038dSYoshinobu Inoue {
7199888c401SHajimu UMEMOTO 
7209bcf770cSHajimu UMEMOTO 	IP6Q_LOCK_ASSERT();
7219888c401SHajimu UMEMOTO 
72282cd038dSYoshinobu Inoue 	new->ip6q_prev = old;
72382cd038dSYoshinobu Inoue 	new->ip6q_next = old->ip6q_next;
72482cd038dSYoshinobu Inoue 	old->ip6q_next->ip6q_prev= new;
72582cd038dSYoshinobu Inoue 	old->ip6q_next = new;
72682cd038dSYoshinobu Inoue }
72782cd038dSYoshinobu Inoue 
72882cd038dSYoshinobu Inoue void
7291272577eSXin LI frag6_remque(struct ip6q *p6)
73082cd038dSYoshinobu Inoue {
7319888c401SHajimu UMEMOTO 
7329bcf770cSHajimu UMEMOTO 	IP6Q_LOCK_ASSERT();
7339888c401SHajimu UMEMOTO 
73482cd038dSYoshinobu Inoue 	p6->ip6q_prev->ip6q_next = p6->ip6q_next;
73582cd038dSYoshinobu Inoue 	p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
73682cd038dSYoshinobu Inoue }
73782cd038dSYoshinobu Inoue 
73882cd038dSYoshinobu Inoue /*
73933841545SHajimu UMEMOTO  * IPv6 reassembling timer processing;
74082cd038dSYoshinobu Inoue  * if a timer expires on a reassembly
74182cd038dSYoshinobu Inoue  * queue, discard it.
74282cd038dSYoshinobu Inoue  */
74382cd038dSYoshinobu Inoue void
7441272577eSXin LI frag6_slowtimo(void)
74582cd038dSYoshinobu Inoue {
7468b615593SMarko Zec 	VNET_ITERATOR_DECL(vnet_iter);
74782cd038dSYoshinobu Inoue 	struct ip6q *q6;
74882cd038dSYoshinobu Inoue 
7495ee847d3SRobert Watson 	VNET_LIST_RLOCK_NOSLEEP();
7509888c401SHajimu UMEMOTO 	IP6Q_LOCK();
7518b615593SMarko Zec 	VNET_FOREACH(vnet_iter) {
7528b615593SMarko Zec 		CURVNET_SET(vnet_iter);
753603724d3SBjoern A. Zeeb 		q6 = V_ip6q.ip6q_next;
75482cd038dSYoshinobu Inoue 		if (q6)
755603724d3SBjoern A. Zeeb 			while (q6 != &V_ip6q) {
75682cd038dSYoshinobu Inoue 				--q6->ip6q_ttl;
75782cd038dSYoshinobu Inoue 				q6 = q6->ip6q_next;
75882cd038dSYoshinobu Inoue 				if (q6->ip6q_prev->ip6q_ttl == 0) {
7599cb8d207SAndrey V. Elsukov 					IP6STAT_INC(ip6s_fragtimeout);
76082cd038dSYoshinobu Inoue 					/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
76182cd038dSYoshinobu Inoue 					frag6_freef(q6->ip6q_prev);
76282cd038dSYoshinobu Inoue 				}
76382cd038dSYoshinobu Inoue 			}
76482cd038dSYoshinobu Inoue 		/*
76582cd038dSYoshinobu Inoue 		 * If we are over the maximum number of fragments
76682cd038dSYoshinobu Inoue 		 * (due to the limit being lowered), drain off
76782cd038dSYoshinobu Inoue 		 * enough to get down to the new limit.
76882cd038dSYoshinobu Inoue 		 */
769603724d3SBjoern A. Zeeb 		while (V_frag6_nfragpackets > (u_int)V_ip6_maxfragpackets &&
770603724d3SBjoern A. Zeeb 		    V_ip6q.ip6q_prev) {
7719cb8d207SAndrey V. Elsukov 			IP6STAT_INC(ip6s_fragoverflow);
77282cd038dSYoshinobu Inoue 			/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
773603724d3SBjoern A. Zeeb 			frag6_freef(V_ip6q.ip6q_prev);
77482cd038dSYoshinobu Inoue 		}
7758b615593SMarko Zec 		CURVNET_RESTORE();
7768b615593SMarko Zec 	}
7779888c401SHajimu UMEMOTO 	IP6Q_UNLOCK();
7785ee847d3SRobert Watson 	VNET_LIST_RUNLOCK_NOSLEEP();
77982cd038dSYoshinobu Inoue }
78082cd038dSYoshinobu Inoue 
78182cd038dSYoshinobu Inoue /*
78282cd038dSYoshinobu Inoue  * Drain off all datagram fragments.
78382cd038dSYoshinobu Inoue  */
78482cd038dSYoshinobu Inoue void
7851272577eSXin LI frag6_drain(void)
78682cd038dSYoshinobu Inoue {
7878b615593SMarko Zec 	VNET_ITERATOR_DECL(vnet_iter);
7889888c401SHajimu UMEMOTO 
7895ee847d3SRobert Watson 	VNET_LIST_RLOCK_NOSLEEP();
7905ee847d3SRobert Watson 	if (IP6Q_TRYLOCK() == 0) {
7915ee847d3SRobert Watson 		VNET_LIST_RUNLOCK_NOSLEEP();
79282cd038dSYoshinobu Inoue 		return;
7935ee847d3SRobert Watson 	}
7948b615593SMarko Zec 	VNET_FOREACH(vnet_iter) {
7958b615593SMarko Zec 		CURVNET_SET(vnet_iter);
796603724d3SBjoern A. Zeeb 		while (V_ip6q.ip6q_next != &V_ip6q) {
7979cb8d207SAndrey V. Elsukov 			IP6STAT_INC(ip6s_fragdropped);
79882cd038dSYoshinobu Inoue 			/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
799603724d3SBjoern A. Zeeb 			frag6_freef(V_ip6q.ip6q_next);
80082cd038dSYoshinobu Inoue 		}
8018b615593SMarko Zec 		CURVNET_RESTORE();
8028b615593SMarko Zec 	}
8039888c401SHajimu UMEMOTO 	IP6Q_UNLOCK();
8045ee847d3SRobert Watson 	VNET_LIST_RUNLOCK_NOSLEEP();
80582cd038dSYoshinobu Inoue }
806e5ee7060SGleb Smirnoff 
807e5ee7060SGleb Smirnoff int
808e5ee7060SGleb Smirnoff ip6_deletefraghdr(struct mbuf *m, int offset, int wait)
809e5ee7060SGleb Smirnoff {
810e5ee7060SGleb Smirnoff 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
811e5ee7060SGleb Smirnoff 	struct mbuf *t;
812e5ee7060SGleb Smirnoff 
813e5ee7060SGleb Smirnoff 	/* Delete frag6 header. */
814e5ee7060SGleb Smirnoff 	if (m->m_len >= offset + sizeof(struct ip6_frag)) {
815e5ee7060SGleb Smirnoff 		/* This is the only possible case with !PULLDOWN_TEST. */
816e5ee7060SGleb Smirnoff 		bcopy(ip6, (char *)ip6 + sizeof(struct ip6_frag),
817e5ee7060SGleb Smirnoff 		    offset);
818e5ee7060SGleb Smirnoff 		m->m_data += sizeof(struct ip6_frag);
819e5ee7060SGleb Smirnoff 		m->m_len -= sizeof(struct ip6_frag);
820e5ee7060SGleb Smirnoff 	} else {
821e5ee7060SGleb Smirnoff 		/* This comes with no copy if the boundary is on cluster. */
822e5ee7060SGleb Smirnoff 		if ((t = m_split(m, offset, wait)) == NULL)
823e5ee7060SGleb Smirnoff 			return (ENOMEM);
824e5ee7060SGleb Smirnoff 		m_adj(t, sizeof(struct ip6_frag));
825e5ee7060SGleb Smirnoff 		m_cat(m, t);
826e5ee7060SGleb Smirnoff 	}
827e5ee7060SGleb Smirnoff 
828e5ee7060SGleb Smirnoff 	return (0);
829e5ee7060SGleb Smirnoff }
830