xref: /freebsd/sys/netinet6/frag6.c (revision 195ebc7e9e4b129de810833791a19dfb4349d6a9)
1 /*-
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	$KAME: frag6.c,v 1.33 2002/01/07 11:34:48 kjc Exp $
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_mac.h"
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/domain.h>
42 #include <sys/protosw.h>
43 #include <sys/socket.h>
44 #include <sys/errno.h>
45 #include <sys/time.h>
46 #include <sys/kernel.h>
47 #include <sys/syslog.h>
48 #include <sys/vimage.h>
49 
50 #include <net/if.h>
51 #include <net/route.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_var.h>
55 #include <netinet/ip6.h>
56 #include <netinet6/ip6_var.h>
57 #include <netinet/icmp6.h>
58 #include <netinet/in_systm.h>	/* for ECN definitions */
59 #include <netinet/ip.h>		/* for ECN definitions */
60 #include <netinet6/vinet6.h>
61 
62 #include <security/mac/mac_framework.h>
63 
64 /*
65  * Define it to get a correct behavior on per-interface statistics.
66  * You will need to perform an extra routing table lookup, per fragment,
67  * to do it.  This may, or may not be, a performance hit.
68  */
69 #define IN6_IFSTAT_STRICT
70 
71 static void frag6_enq(struct ip6asfrag *, struct ip6asfrag *);
72 static void frag6_deq(struct ip6asfrag *);
73 static void frag6_insque(struct ip6q *, struct ip6q *);
74 static void frag6_remque(struct ip6q *);
75 static void frag6_freef(struct ip6q *);
76 
77 static struct mtx ip6qlock;
78 /*
79  * These fields all protected by ip6qlock.
80  */
81 #ifdef VIMAGE_GLOBALS
82 static u_int frag6_nfragpackets;
83 static u_int frag6_nfrags;
84 static struct	ip6q ip6q;	/* ip6 reassemble queue */
85 #endif
86 
87 #define	IP6Q_LOCK_INIT()	mtx_init(&ip6qlock, "ip6qlock", NULL, MTX_DEF);
88 #define	IP6Q_LOCK()		mtx_lock(&ip6qlock)
89 #define	IP6Q_TRYLOCK()		mtx_trylock(&ip6qlock)
90 #define	IP6Q_LOCK_ASSERT()	mtx_assert(&ip6qlock, MA_OWNED)
91 #define	IP6Q_UNLOCK()		mtx_unlock(&ip6qlock)
92 
93 static MALLOC_DEFINE(M_FTABLE, "fragment", "fragment reassembly header");
94 
95 /*
96  * Initialise reassembly queue and fragment identifier.
97  */
98 static void
99 frag6_change(void *tag)
100 {
101 	INIT_VNET_INET6(curvnet);
102 
103 	V_ip6_maxfragpackets = nmbclusters / 4;
104 	V_ip6_maxfrags = nmbclusters / 4;
105 }
106 
107 void
108 frag6_init(void)
109 {
110 	INIT_VNET_INET6(curvnet);
111 
112 	V_ip6q.ip6q_next = V_ip6q.ip6q_prev = &V_ip6q;
113 	V_ip6_maxfragpackets = nmbclusters / 4;
114 	V_ip6_maxfrags = nmbclusters / 4;
115 
116 	if (!IS_DEFAULT_VNET(curvnet))
117 		return;
118 
119 	IP6Q_LOCK_INIT();
120 	EVENTHANDLER_REGISTER(nmbclusters_change,
121 	    frag6_change, NULL, EVENTHANDLER_PRI_ANY);
122 }
123 
124 /*
125  * In RFC2460, fragment and reassembly rule do not agree with each other,
126  * in terms of next header field handling in fragment header.
127  * While the sender will use the same value for all of the fragmented packets,
128  * receiver is suggested not to check the consistency.
129  *
130  * fragment rule (p20):
131  *	(2) A Fragment header containing:
132  *	The Next Header value that identifies the first header of
133  *	the Fragmentable Part of the original packet.
134  *		-> next header field is same for all fragments
135  *
136  * reassembly rule (p21):
137  *	The Next Header field of the last header of the Unfragmentable
138  *	Part is obtained from the Next Header field of the first
139  *	fragment's Fragment header.
140  *		-> should grab it from the first fragment only
141  *
142  * The following note also contradicts with fragment rule - noone is going to
143  * send different fragment with different next header field.
144  *
145  * additional note (p22):
146  *	The Next Header values in the Fragment headers of different
147  *	fragments of the same original packet may differ.  Only the value
148  *	from the Offset zero fragment packet is used for reassembly.
149  *		-> should grab it from the first fragment only
150  *
151  * There is no explicit reason given in the RFC.  Historical reason maybe?
152  */
153 /*
154  * Fragment input
155  */
156 int
157 frag6_input(struct mbuf **mp, int *offp, int proto)
158 {
159 	INIT_VNET_INET6(curvnet);
160 	struct mbuf *m = *mp, *t;
161 	struct ip6_hdr *ip6;
162 	struct ip6_frag *ip6f;
163 	struct ip6q *q6;
164 	struct ip6asfrag *af6, *ip6af, *af6dwn;
165 #ifdef IN6_IFSTAT_STRICT
166 	struct in6_ifaddr *ia;
167 #endif
168 	int offset = *offp, nxt, i, next;
169 	int first_frag = 0;
170 	int fragoff, frgpartlen;	/* must be larger than u_int16_t */
171 	struct ifnet *dstifp;
172 	u_int8_t ecn, ecn0;
173 #if 0
174 	char ip6buf[INET6_ADDRSTRLEN];
175 #endif
176 
177 	ip6 = mtod(m, struct ip6_hdr *);
178 #ifndef PULLDOWN_TEST
179 	IP6_EXTHDR_CHECK(m, offset, sizeof(struct ip6_frag), IPPROTO_DONE);
180 	ip6f = (struct ip6_frag *)((caddr_t)ip6 + offset);
181 #else
182 	IP6_EXTHDR_GET(ip6f, struct ip6_frag *, m, offset, sizeof(*ip6f));
183 	if (ip6f == NULL)
184 		return (IPPROTO_DONE);
185 #endif
186 
187 	dstifp = NULL;
188 #ifdef IN6_IFSTAT_STRICT
189 	/* find the destination interface of the packet. */
190 	if ((ia = ip6_getdstifaddr(m)) != NULL)
191 		dstifp = ia->ia_ifp;
192 #else
193 	/* we are violating the spec, this is not the destination interface */
194 	if ((m->m_flags & M_PKTHDR) != 0)
195 		dstifp = m->m_pkthdr.rcvif;
196 #endif
197 
198 	/* jumbo payload can't contain a fragment header */
199 	if (ip6->ip6_plen == 0) {
200 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
201 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
202 		return IPPROTO_DONE;
203 	}
204 
205 	/*
206 	 * check whether fragment packet's fragment length is
207 	 * multiple of 8 octets.
208 	 * sizeof(struct ip6_frag) == 8
209 	 * sizeof(struct ip6_hdr) = 40
210 	 */
211 	if ((ip6f->ip6f_offlg & IP6F_MORE_FRAG) &&
212 	    (((ntohs(ip6->ip6_plen) - offset) & 0x7) != 0)) {
213 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
214 		    offsetof(struct ip6_hdr, ip6_plen));
215 		in6_ifstat_inc(dstifp, ifs6_reass_fail);
216 		return IPPROTO_DONE;
217 	}
218 
219 	V_ip6stat.ip6s_fragments++;
220 	in6_ifstat_inc(dstifp, ifs6_reass_reqd);
221 
222 	/* offset now points to data portion */
223 	offset += sizeof(struct ip6_frag);
224 
225 	IP6Q_LOCK();
226 
227 	/*
228 	 * Enforce upper bound on number of fragments.
229 	 * If maxfrag is 0, never accept fragments.
230 	 * If maxfrag is -1, accept all fragments without limitation.
231 	 */
232 	if (V_ip6_maxfrags < 0)
233 		;
234 	else if (V_frag6_nfrags >= (u_int)V_ip6_maxfrags)
235 		goto dropfrag;
236 
237 	for (q6 = V_ip6q.ip6q_next; q6 != &V_ip6q; q6 = q6->ip6q_next)
238 		if (ip6f->ip6f_ident == q6->ip6q_ident &&
239 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &q6->ip6q_src) &&
240 		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &q6->ip6q_dst)
241 #ifdef MAC
242 		    && mac_ip6q_match(m, q6)
243 #endif
244 		    )
245 			break;
246 
247 	if (q6 == &V_ip6q) {
248 		/*
249 		 * the first fragment to arrive, create a reassembly queue.
250 		 */
251 		first_frag = 1;
252 
253 		/*
254 		 * Enforce upper bound on number of fragmented packets
255 		 * for which we attempt reassembly;
256 		 * If maxfragpackets is 0, never accept fragments.
257 		 * If maxfragpackets is -1, accept all fragments without
258 		 * limitation.
259 		 */
260 		if (V_ip6_maxfragpackets < 0)
261 			;
262 		else if (V_frag6_nfragpackets >= (u_int)V_ip6_maxfragpackets)
263 			goto dropfrag;
264 		V_frag6_nfragpackets++;
265 		q6 = (struct ip6q *)malloc(sizeof(struct ip6q), M_FTABLE,
266 		    M_NOWAIT);
267 		if (q6 == NULL)
268 			goto dropfrag;
269 		bzero(q6, sizeof(*q6));
270 #ifdef MAC
271 		if (mac_ip6q_init(q6, M_NOWAIT) != 0) {
272 			free(q6, M_FTABLE);
273 			goto dropfrag;
274 		}
275 		mac_ip6q_create(m, q6);
276 #endif
277 		frag6_insque(q6, &V_ip6q);
278 
279 		/* ip6q_nxt will be filled afterwards, from 1st fragment */
280 		q6->ip6q_down	= q6->ip6q_up = (struct ip6asfrag *)q6;
281 #ifdef notyet
282 		q6->ip6q_nxtp	= (u_char *)nxtp;
283 #endif
284 		q6->ip6q_ident	= ip6f->ip6f_ident;
285 		q6->ip6q_ttl	= IPV6_FRAGTTL;
286 		q6->ip6q_src	= ip6->ip6_src;
287 		q6->ip6q_dst	= ip6->ip6_dst;
288 		q6->ip6q_ecn	=
289 		    (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
290 		q6->ip6q_unfrglen = -1;	/* The 1st fragment has not arrived. */
291 
292 		q6->ip6q_nfrag = 0;
293 	}
294 
295 	/*
296 	 * If it's the 1st fragment, record the length of the
297 	 * unfragmentable part and the next header of the fragment header.
298 	 */
299 	fragoff = ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK);
300 	if (fragoff == 0) {
301 		q6->ip6q_unfrglen = offset - sizeof(struct ip6_hdr) -
302 		    sizeof(struct ip6_frag);
303 		q6->ip6q_nxt = ip6f->ip6f_nxt;
304 	}
305 
306 	/*
307 	 * Check that the reassembled packet would not exceed 65535 bytes
308 	 * in size.
309 	 * If it would exceed, discard the fragment and return an ICMP error.
310 	 */
311 	frgpartlen = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) - offset;
312 	if (q6->ip6q_unfrglen >= 0) {
313 		/* The 1st fragment has already arrived. */
314 		if (q6->ip6q_unfrglen + fragoff + frgpartlen > IPV6_MAXPACKET) {
315 			icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
316 			    offset - sizeof(struct ip6_frag) +
317 			    offsetof(struct ip6_frag, ip6f_offlg));
318 			IP6Q_UNLOCK();
319 			return (IPPROTO_DONE);
320 		}
321 	} else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
322 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
323 		    offset - sizeof(struct ip6_frag) +
324 		    offsetof(struct ip6_frag, ip6f_offlg));
325 		IP6Q_UNLOCK();
326 		return (IPPROTO_DONE);
327 	}
328 	/*
329 	 * If it's the first fragment, do the above check for each
330 	 * fragment already stored in the reassembly queue.
331 	 */
332 	if (fragoff == 0) {
333 		for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
334 		     af6 = af6dwn) {
335 			af6dwn = af6->ip6af_down;
336 
337 			if (q6->ip6q_unfrglen + af6->ip6af_off + af6->ip6af_frglen >
338 			    IPV6_MAXPACKET) {
339 				struct mbuf *merr = IP6_REASS_MBUF(af6);
340 				struct ip6_hdr *ip6err;
341 				int erroff = af6->ip6af_offset;
342 
343 				/* dequeue the fragment. */
344 				frag6_deq(af6);
345 				free(af6, M_FTABLE);
346 
347 				/* adjust pointer. */
348 				ip6err = mtod(merr, struct ip6_hdr *);
349 
350 				/*
351 				 * Restore source and destination addresses
352 				 * in the erroneous IPv6 header.
353 				 */
354 				ip6err->ip6_src = q6->ip6q_src;
355 				ip6err->ip6_dst = q6->ip6q_dst;
356 
357 				icmp6_error(merr, ICMP6_PARAM_PROB,
358 				    ICMP6_PARAMPROB_HEADER,
359 				    erroff - sizeof(struct ip6_frag) +
360 				    offsetof(struct ip6_frag, ip6f_offlg));
361 			}
362 		}
363 	}
364 
365 	ip6af = (struct ip6asfrag *)malloc(sizeof(struct ip6asfrag), M_FTABLE,
366 	    M_NOWAIT);
367 	if (ip6af == NULL)
368 		goto dropfrag;
369 	bzero(ip6af, sizeof(*ip6af));
370 	ip6af->ip6af_mff = ip6f->ip6f_offlg & IP6F_MORE_FRAG;
371 	ip6af->ip6af_off = fragoff;
372 	ip6af->ip6af_frglen = frgpartlen;
373 	ip6af->ip6af_offset = offset;
374 	IP6_REASS_MBUF(ip6af) = m;
375 
376 	if (first_frag) {
377 		af6 = (struct ip6asfrag *)q6;
378 		goto insert;
379 	}
380 
381 	/*
382 	 * Handle ECN by comparing this segment with the first one;
383 	 * if CE is set, do not lose CE.
384 	 * drop if CE and not-ECT are mixed for the same packet.
385 	 */
386 	ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
387 	ecn0 = q6->ip6q_ecn;
388 	if (ecn == IPTOS_ECN_CE) {
389 		if (ecn0 == IPTOS_ECN_NOTECT) {
390 			free(ip6af, M_FTABLE);
391 			goto dropfrag;
392 		}
393 		if (ecn0 != IPTOS_ECN_CE)
394 			q6->ip6q_ecn = IPTOS_ECN_CE;
395 	}
396 	if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) {
397 		free(ip6af, M_FTABLE);
398 		goto dropfrag;
399 	}
400 
401 	/*
402 	 * Find a segment which begins after this one does.
403 	 */
404 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
405 	     af6 = af6->ip6af_down)
406 		if (af6->ip6af_off > ip6af->ip6af_off)
407 			break;
408 
409 #if 0
410 	/*
411 	 * If there is a preceding segment, it may provide some of
412 	 * our data already.  If so, drop the data from the incoming
413 	 * segment.  If it provides all of our data, drop us.
414 	 */
415 	if (af6->ip6af_up != (struct ip6asfrag *)q6) {
416 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
417 			- ip6af->ip6af_off;
418 		if (i > 0) {
419 			if (i >= ip6af->ip6af_frglen)
420 				goto dropfrag;
421 			m_adj(IP6_REASS_MBUF(ip6af), i);
422 			ip6af->ip6af_off += i;
423 			ip6af->ip6af_frglen -= i;
424 		}
425 	}
426 
427 	/*
428 	 * While we overlap succeeding segments trim them or,
429 	 * if they are completely covered, dequeue them.
430 	 */
431 	while (af6 != (struct ip6asfrag *)q6 &&
432 	       ip6af->ip6af_off + ip6af->ip6af_frglen > af6->ip6af_off) {
433 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
434 		if (i < af6->ip6af_frglen) {
435 			af6->ip6af_frglen -= i;
436 			af6->ip6af_off += i;
437 			m_adj(IP6_REASS_MBUF(af6), i);
438 			break;
439 		}
440 		af6 = af6->ip6af_down;
441 		m_freem(IP6_REASS_MBUF(af6->ip6af_up));
442 		frag6_deq(af6->ip6af_up);
443 	}
444 #else
445 	/*
446 	 * If the incoming framgent overlaps some existing fragments in
447 	 * the reassembly queue, drop it, since it is dangerous to override
448 	 * existing fragments from a security point of view.
449 	 * We don't know which fragment is the bad guy - here we trust
450 	 * fragment that came in earlier, with no real reason.
451 	 *
452 	 * Note: due to changes after disabling this part, mbuf passed to
453 	 * m_adj() below now does not meet the requirement.
454 	 */
455 	if (af6->ip6af_up != (struct ip6asfrag *)q6) {
456 		i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
457 			- ip6af->ip6af_off;
458 		if (i > 0) {
459 #if 0				/* suppress the noisy log */
460 			log(LOG_ERR, "%d bytes of a fragment from %s "
461 			    "overlaps the previous fragment\n",
462 			    i, ip6_sprintf(ip6buf, &q6->ip6q_src));
463 #endif
464 			free(ip6af, M_FTABLE);
465 			goto dropfrag;
466 		}
467 	}
468 	if (af6 != (struct ip6asfrag *)q6) {
469 		i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
470 		if (i > 0) {
471 #if 0				/* suppress the noisy log */
472 			log(LOG_ERR, "%d bytes of a fragment from %s "
473 			    "overlaps the succeeding fragment",
474 			    i, ip6_sprintf(ip6buf, &q6->ip6q_src));
475 #endif
476 			free(ip6af, M_FTABLE);
477 			goto dropfrag;
478 		}
479 	}
480 #endif
481 
482 insert:
483 #ifdef MAC
484 	if (!first_frag)
485 		mac_ip6q_update(m, q6);
486 #endif
487 
488 	/*
489 	 * Stick new segment in its place;
490 	 * check for complete reassembly.
491 	 * Move to front of packet queue, as we are
492 	 * the most recently active fragmented packet.
493 	 */
494 	frag6_enq(ip6af, af6->ip6af_up);
495 	V_frag6_nfrags++;
496 	q6->ip6q_nfrag++;
497 #if 0 /* xxx */
498 	if (q6 != V_ip6q.ip6q_next) {
499 		frag6_remque(q6);
500 		frag6_insque(q6, &V_ip6q);
501 	}
502 #endif
503 	next = 0;
504 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
505 	     af6 = af6->ip6af_down) {
506 		if (af6->ip6af_off != next) {
507 			IP6Q_UNLOCK();
508 			return IPPROTO_DONE;
509 		}
510 		next += af6->ip6af_frglen;
511 	}
512 	if (af6->ip6af_up->ip6af_mff) {
513 		IP6Q_UNLOCK();
514 		return IPPROTO_DONE;
515 	}
516 
517 	/*
518 	 * Reassembly is complete; concatenate fragments.
519 	 */
520 	ip6af = q6->ip6q_down;
521 	t = m = IP6_REASS_MBUF(ip6af);
522 	af6 = ip6af->ip6af_down;
523 	frag6_deq(ip6af);
524 	while (af6 != (struct ip6asfrag *)q6) {
525 		af6dwn = af6->ip6af_down;
526 		frag6_deq(af6);
527 		while (t->m_next)
528 			t = t->m_next;
529 		t->m_next = IP6_REASS_MBUF(af6);
530 		m_adj(t->m_next, af6->ip6af_offset);
531 		free(af6, M_FTABLE);
532 		af6 = af6dwn;
533 	}
534 
535 	/* adjust offset to point where the original next header starts */
536 	offset = ip6af->ip6af_offset - sizeof(struct ip6_frag);
537 	free(ip6af, M_FTABLE);
538 	ip6 = mtod(m, struct ip6_hdr *);
539 	ip6->ip6_plen = htons((u_short)next + offset - sizeof(struct ip6_hdr));
540 	if (q6->ip6q_ecn == IPTOS_ECN_CE)
541 		ip6->ip6_flow |= htonl(IPTOS_ECN_CE << 20);
542 	nxt = q6->ip6q_nxt;
543 #ifdef notyet
544 	*q6->ip6q_nxtp = (u_char)(nxt & 0xff);
545 #endif
546 
547 	/* Delete frag6 header */
548 	if (m->m_len >= offset + sizeof(struct ip6_frag)) {
549 		/* This is the only possible case with !PULLDOWN_TEST */
550 		ovbcopy((caddr_t)ip6, (caddr_t)ip6 + sizeof(struct ip6_frag),
551 		    offset);
552 		m->m_data += sizeof(struct ip6_frag);
553 		m->m_len -= sizeof(struct ip6_frag);
554 	} else {
555 		/* this comes with no copy if the boundary is on cluster */
556 		if ((t = m_split(m, offset, M_DONTWAIT)) == NULL) {
557 			frag6_remque(q6);
558 			V_frag6_nfrags -= q6->ip6q_nfrag;
559 #ifdef MAC
560 			mac_ip6q_destroy(q6);
561 #endif
562 			free(q6, M_FTABLE);
563 			V_frag6_nfragpackets--;
564 			goto dropfrag;
565 		}
566 		m_adj(t, sizeof(struct ip6_frag));
567 		m_cat(m, t);
568 	}
569 
570 	/*
571 	 * Store NXT to the original.
572 	 */
573 	{
574 		char *prvnxtp = ip6_get_prevhdr(m, offset); /* XXX */
575 		*prvnxtp = nxt;
576 	}
577 
578 	frag6_remque(q6);
579 	V_frag6_nfrags -= q6->ip6q_nfrag;
580 #ifdef MAC
581 	mac_ip6q_reassemble(q6, m);
582 	mac_ip6q_destroy(q6);
583 #endif
584 	free(q6, M_FTABLE);
585 	V_frag6_nfragpackets--;
586 
587 	if (m->m_flags & M_PKTHDR) { /* Isn't it always true? */
588 		int plen = 0;
589 		for (t = m; t; t = t->m_next)
590 			plen += t->m_len;
591 		m->m_pkthdr.len = plen;
592 	}
593 
594 	V_ip6stat.ip6s_reassembled++;
595 	in6_ifstat_inc(dstifp, ifs6_reass_ok);
596 
597 	/*
598 	 * Tell launch routine the next header
599 	 */
600 
601 	*mp = m;
602 	*offp = offset;
603 
604 	IP6Q_UNLOCK();
605 	return nxt;
606 
607  dropfrag:
608 	IP6Q_UNLOCK();
609 	in6_ifstat_inc(dstifp, ifs6_reass_fail);
610 	V_ip6stat.ip6s_fragdropped++;
611 	m_freem(m);
612 	return IPPROTO_DONE;
613 }
614 
615 /*
616  * Free a fragment reassembly header and all
617  * associated datagrams.
618  */
619 void
620 frag6_freef(struct ip6q *q6)
621 {
622 	INIT_VNET_INET6(curvnet);
623 	struct ip6asfrag *af6, *down6;
624 
625 	IP6Q_LOCK_ASSERT();
626 
627 	for (af6 = q6->ip6q_down; af6 != (struct ip6asfrag *)q6;
628 	     af6 = down6) {
629 		struct mbuf *m = IP6_REASS_MBUF(af6);
630 
631 		down6 = af6->ip6af_down;
632 		frag6_deq(af6);
633 
634 		/*
635 		 * Return ICMP time exceeded error for the 1st fragment.
636 		 * Just free other fragments.
637 		 */
638 		if (af6->ip6af_off == 0) {
639 			struct ip6_hdr *ip6;
640 
641 			/* adjust pointer */
642 			ip6 = mtod(m, struct ip6_hdr *);
643 
644 			/* restore source and destination addresses */
645 			ip6->ip6_src = q6->ip6q_src;
646 			ip6->ip6_dst = q6->ip6q_dst;
647 
648 			icmp6_error(m, ICMP6_TIME_EXCEEDED,
649 				    ICMP6_TIME_EXCEED_REASSEMBLY, 0);
650 		} else
651 			m_freem(m);
652 		free(af6, M_FTABLE);
653 	}
654 	frag6_remque(q6);
655 	V_frag6_nfrags -= q6->ip6q_nfrag;
656 #ifdef MAC
657 	mac_ip6q_destroy(q6);
658 #endif
659 	free(q6, M_FTABLE);
660 	V_frag6_nfragpackets--;
661 }
662 
663 /*
664  * Put an ip fragment on a reassembly chain.
665  * Like insque, but pointers in middle of structure.
666  */
667 void
668 frag6_enq(struct ip6asfrag *af6, struct ip6asfrag *up6)
669 {
670 
671 	IP6Q_LOCK_ASSERT();
672 
673 	af6->ip6af_up = up6;
674 	af6->ip6af_down = up6->ip6af_down;
675 	up6->ip6af_down->ip6af_up = af6;
676 	up6->ip6af_down = af6;
677 }
678 
679 /*
680  * To frag6_enq as remque is to insque.
681  */
682 void
683 frag6_deq(struct ip6asfrag *af6)
684 {
685 
686 	IP6Q_LOCK_ASSERT();
687 
688 	af6->ip6af_up->ip6af_down = af6->ip6af_down;
689 	af6->ip6af_down->ip6af_up = af6->ip6af_up;
690 }
691 
692 void
693 frag6_insque(struct ip6q *new, struct ip6q *old)
694 {
695 
696 	IP6Q_LOCK_ASSERT();
697 
698 	new->ip6q_prev = old;
699 	new->ip6q_next = old->ip6q_next;
700 	old->ip6q_next->ip6q_prev= new;
701 	old->ip6q_next = new;
702 }
703 
704 void
705 frag6_remque(struct ip6q *p6)
706 {
707 
708 	IP6Q_LOCK_ASSERT();
709 
710 	p6->ip6q_prev->ip6q_next = p6->ip6q_next;
711 	p6->ip6q_next->ip6q_prev = p6->ip6q_prev;
712 }
713 
714 /*
715  * IPv6 reassembling timer processing;
716  * if a timer expires on a reassembly
717  * queue, discard it.
718  */
719 void
720 frag6_slowtimo(void)
721 {
722 	VNET_ITERATOR_DECL(vnet_iter);
723 	struct ip6q *q6;
724 
725 	IP6Q_LOCK();
726 	VNET_LIST_RLOCK();
727 	VNET_FOREACH(vnet_iter) {
728 		CURVNET_SET(vnet_iter);
729 		INIT_VNET_INET6(vnet_iter);
730 		q6 = V_ip6q.ip6q_next;
731 		if (q6)
732 			while (q6 != &V_ip6q) {
733 				--q6->ip6q_ttl;
734 				q6 = q6->ip6q_next;
735 				if (q6->ip6q_prev->ip6q_ttl == 0) {
736 					V_ip6stat.ip6s_fragtimeout++;
737 					/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
738 					frag6_freef(q6->ip6q_prev);
739 				}
740 			}
741 		/*
742 		 * If we are over the maximum number of fragments
743 		 * (due to the limit being lowered), drain off
744 		 * enough to get down to the new limit.
745 		 */
746 		while (V_frag6_nfragpackets > (u_int)V_ip6_maxfragpackets &&
747 		    V_ip6q.ip6q_prev) {
748 			V_ip6stat.ip6s_fragoverflow++;
749 			/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
750 			frag6_freef(V_ip6q.ip6q_prev);
751 		}
752 		CURVNET_RESTORE();
753 	}
754 	VNET_LIST_RUNLOCK();
755 	IP6Q_UNLOCK();
756 }
757 
758 /*
759  * Drain off all datagram fragments.
760  */
761 void
762 frag6_drain(void)
763 {
764 	VNET_ITERATOR_DECL(vnet_iter);
765 
766 	if (IP6Q_TRYLOCK() == 0)
767 		return;
768 	VNET_LIST_RLOCK();
769 	VNET_FOREACH(vnet_iter) {
770 		CURVNET_SET(vnet_iter);
771 		INIT_VNET_INET6(vnet_iter);
772 		while (V_ip6q.ip6q_next != &V_ip6q) {
773 			V_ip6stat.ip6s_fragdropped++;
774 			/* XXX in6_ifstat_inc(ifp, ifs6_reass_fail) */
775 			frag6_freef(V_ip6q.ip6q_next);
776 		}
777 		CURVNET_RESTORE();
778 	}
779 	VNET_LIST_RUNLOCK();
780 	IP6Q_UNLOCK();
781 }
782