xref: /linux/net/ieee802154/6lowpan/reassembly.c (revision d003d772e64df08af04ee63609d47169ee82ae0e) 
1 /*	6LoWPAN fragment reassembly
2  *
3  *
4  *	Authors:
5  *	Alexander Aring		<aar@pengutronix.de>
6  *
7  *	Based on: net/ipv6/reassembly.c
8  *
9  *	This program is free software; you can redistribute it and/or
10  *	modify it under the terms of the GNU General Public License
11  *	as published by the Free Software Foundation; either version
12  *	2 of the License, or (at your option) any later version.
13  */
14 
15 #define pr_fmt(fmt) "6LoWPAN: " fmt
16 
17 #include <linux/net.h>
18 #include <linux/list.h>
19 #include <linux/netdevice.h>
20 #include <linux/random.h>
21 #include <linux/jhash.h>
22 #include <linux/skbuff.h>
23 #include <linux/slab.h>
24 #include <linux/export.h>
25 
26 #include <net/ieee802154_netdev.h>
27 #include <net/6lowpan.h>
28 #include <net/ipv6_frag.h>
29 #include <net/inet_frag.h>
30 #include <net/ip.h>
31 
32 #include "6lowpan_i.h"
33 
34 static const char lowpan_frags_cache_name[] = "lowpan-frags";
35 
36 static struct inet_frags lowpan_frags;
37 
38 static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *skb,
39 			     struct sk_buff *prev,  struct net_device *ldev);
40 
41 static void lowpan_frag_init(struct inet_frag_queue *q, const void *a)
42 {
43 	const struct frag_lowpan_compare_key *key = a;
44 
45 	BUILD_BUG_ON(sizeof(*key) > sizeof(q->key));
46 	memcpy(&q->key, key, sizeof(*key));
47 }
48 
49 static void lowpan_frag_expire(struct timer_list *t)
50 {
51 	struct inet_frag_queue *frag = from_timer(frag, t, timer);
52 	struct frag_queue *fq;
53 
54 	fq = container_of(frag, struct frag_queue, q);
55 
56 	spin_lock(&fq->q.lock);
57 
58 	if (fq->q.flags & INET_FRAG_COMPLETE)
59 		goto out;
60 
61 	inet_frag_kill(&fq->q);
62 out:
63 	spin_unlock(&fq->q.lock);
64 	inet_frag_put(&fq->q);
65 }
66 
67 static inline struct lowpan_frag_queue *
68 fq_find(struct net *net, const struct lowpan_802154_cb *cb,
69 	const struct ieee802154_addr *src,
70 	const struct ieee802154_addr *dst)
71 {
72 	struct netns_ieee802154_lowpan *ieee802154_lowpan =
73 		net_ieee802154_lowpan(net);
74 	struct frag_lowpan_compare_key key = {};
75 	struct inet_frag_queue *q;
76 
77 	key.tag = cb->d_tag;
78 	key.d_size = cb->d_size;
79 	key.src = *src;
80 	key.dst = *dst;
81 
82 	q = inet_frag_find(&ieee802154_lowpan->frags, &key);
83 	if (!q)
84 		return NULL;
85 
86 	return container_of(q, struct lowpan_frag_queue, q);
87 }
88 
89 static int lowpan_frag_queue(struct lowpan_frag_queue *fq,
90 			     struct sk_buff *skb, u8 frag_type)
91 {
92 	struct sk_buff *prev_tail;
93 	struct net_device *ldev;
94 	int end, offset, err;
95 
96 	/* inet_frag_queue_* functions use skb->cb; see struct ipfrag_skb_cb
97 	 * in inet_fragment.c
98 	 */
99 	BUILD_BUG_ON(sizeof(struct lowpan_802154_cb) > sizeof(struct inet_skb_parm));
100 	BUILD_BUG_ON(sizeof(struct lowpan_802154_cb) > sizeof(struct inet6_skb_parm));
101 
102 	if (fq->q.flags & INET_FRAG_COMPLETE)
103 		goto err;
104 
105 	offset = lowpan_802154_cb(skb)->d_offset << 3;
106 	end = lowpan_802154_cb(skb)->d_size;
107 
108 	/* Is this the final fragment? */
109 	if (offset + skb->len == end) {
110 		/* If we already have some bits beyond end
111 		 * or have different end, the segment is corrupted.
112 		 */
113 		if (end < fq->q.len ||
114 		    ((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len))
115 			goto err;
116 		fq->q.flags |= INET_FRAG_LAST_IN;
117 		fq->q.len = end;
118 	} else {
119 		if (end > fq->q.len) {
120 			/* Some bits beyond end -> corruption. */
121 			if (fq->q.flags & INET_FRAG_LAST_IN)
122 				goto err;
123 			fq->q.len = end;
124 		}
125 	}
126 
127 	ldev = skb->dev;
128 	if (ldev)
129 		skb->dev = NULL;
130 	barrier();
131 
132 	prev_tail = fq->q.fragments_tail;
133 	err = inet_frag_queue_insert(&fq->q, skb, offset, end);
134 	if (err)
135 		goto err;
136 
137 	fq->q.stamp = skb->tstamp;
138 	if (frag_type == LOWPAN_DISPATCH_FRAG1)
139 		fq->q.flags |= INET_FRAG_FIRST_IN;
140 
141 	fq->q.meat += skb->len;
142 	add_frag_mem_limit(fq->q.net, skb->truesize);
143 
144 	if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
145 	    fq->q.meat == fq->q.len) {
146 		int res;
147 		unsigned long orefdst = skb->_skb_refdst;
148 
149 		skb->_skb_refdst = 0UL;
150 		res = lowpan_frag_reasm(fq, skb, prev_tail, ldev);
151 		skb->_skb_refdst = orefdst;
152 		return res;
153 	}
154 	skb_dst_drop(skb);
155 
156 	return -1;
157 err:
158 	kfree_skb(skb);
159 	return -1;
160 }
161 
162 /*	Check if this packet is complete.
163  *
164  *	It is called with locked fq, and caller must check that
165  *	queue is eligible for reassembly i.e. it is not COMPLETE,
166  *	the last and the first frames arrived and all the bits are here.
167  */
168 static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *skb,
169 			     struct sk_buff *prev_tail, struct net_device *ldev)
170 {
171 	void *reasm_data;
172 
173 	inet_frag_kill(&fq->q);
174 
175 	reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
176 	if (!reasm_data)
177 		goto out_oom;
178 	inet_frag_reasm_finish(&fq->q, skb, reasm_data);
179 
180 	skb->dev = ldev;
181 	skb->tstamp = fq->q.stamp;
182 	fq->q.rb_fragments = RB_ROOT;
183 	fq->q.fragments_tail = NULL;
184 	fq->q.last_run_head = NULL;
185 
186 	return 1;
187 out_oom:
188 	net_dbg_ratelimited("lowpan_frag_reasm: no memory for reassembly\n");
189 	return -1;
190 }
191 
192 static int lowpan_frag_rx_handlers_result(struct sk_buff *skb,
193 					  lowpan_rx_result res)
194 {
195 	switch (res) {
196 	case RX_QUEUED:
197 		return NET_RX_SUCCESS;
198 	case RX_CONTINUE:
199 		/* nobody cared about this packet */
200 		net_warn_ratelimited("%s: received unknown dispatch\n",
201 				     __func__);
202 
203 		/* fall-through */
204 	default:
205 		/* all others failure */
206 		return NET_RX_DROP;
207 	}
208 }
209 
210 static lowpan_rx_result lowpan_frag_rx_h_iphc(struct sk_buff *skb)
211 {
212 	int ret;
213 
214 	if (!lowpan_is_iphc(*skb_network_header(skb)))
215 		return RX_CONTINUE;
216 
217 	ret = lowpan_iphc_decompress(skb);
218 	if (ret < 0)
219 		return RX_DROP;
220 
221 	return RX_QUEUED;
222 }
223 
224 static int lowpan_invoke_frag_rx_handlers(struct sk_buff *skb)
225 {
226 	lowpan_rx_result res;
227 
228 #define CALL_RXH(rxh)			\
229 	do {				\
230 		res = rxh(skb);	\
231 		if (res != RX_CONTINUE)	\
232 			goto rxh_next;	\
233 	} while (0)
234 
235 	/* likely at first */
236 	CALL_RXH(lowpan_frag_rx_h_iphc);
237 	CALL_RXH(lowpan_rx_h_ipv6);
238 
239 rxh_next:
240 	return lowpan_frag_rx_handlers_result(skb, res);
241 #undef CALL_RXH
242 }
243 
244 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK	0x07
245 #define LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT	8
246 
247 static int lowpan_get_cb(struct sk_buff *skb, u8 frag_type,
248 			 struct lowpan_802154_cb *cb)
249 {
250 	bool fail;
251 	u8 high = 0, low = 0;
252 	__be16 d_tag = 0;
253 
254 	fail = lowpan_fetch_skb(skb, &high, 1);
255 	fail |= lowpan_fetch_skb(skb, &low, 1);
256 	/* remove the dispatch value and use first three bits as high value
257 	 * for the datagram size
258 	 */
259 	cb->d_size = (high & LOWPAN_FRAG_DGRAM_SIZE_HIGH_MASK) <<
260 		LOWPAN_FRAG_DGRAM_SIZE_HIGH_SHIFT | low;
261 	fail |= lowpan_fetch_skb(skb, &d_tag, 2);
262 	cb->d_tag = ntohs(d_tag);
263 
264 	if (frag_type == LOWPAN_DISPATCH_FRAGN) {
265 		fail |= lowpan_fetch_skb(skb, &cb->d_offset, 1);
266 	} else {
267 		skb_reset_network_header(skb);
268 		cb->d_offset = 0;
269 		/* check if datagram_size has ipv6hdr on FRAG1 */
270 		fail |= cb->d_size < sizeof(struct ipv6hdr);
271 		/* check if we can dereference the dispatch value */
272 		fail |= !skb->len;
273 	}
274 
275 	if (unlikely(fail))
276 		return -EIO;
277 
278 	return 0;
279 }
280 
281 int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type)
282 {
283 	struct lowpan_frag_queue *fq;
284 	struct net *net = dev_net(skb->dev);
285 	struct lowpan_802154_cb *cb = lowpan_802154_cb(skb);
286 	struct ieee802154_hdr hdr = {};
287 	int err;
288 
289 	if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0)
290 		goto err;
291 
292 	err = lowpan_get_cb(skb, frag_type, cb);
293 	if (err < 0)
294 		goto err;
295 
296 	if (frag_type == LOWPAN_DISPATCH_FRAG1) {
297 		err = lowpan_invoke_frag_rx_handlers(skb);
298 		if (err == NET_RX_DROP)
299 			goto err;
300 	}
301 
302 	if (cb->d_size > IPV6_MIN_MTU) {
303 		net_warn_ratelimited("lowpan_frag_rcv: datagram size exceeds MTU\n");
304 		goto err;
305 	}
306 
307 	fq = fq_find(net, cb, &hdr.source, &hdr.dest);
308 	if (fq != NULL) {
309 		int ret;
310 
311 		spin_lock(&fq->q.lock);
312 		ret = lowpan_frag_queue(fq, skb, frag_type);
313 		spin_unlock(&fq->q.lock);
314 
315 		inet_frag_put(&fq->q);
316 		return ret;
317 	}
318 
319 err:
320 	kfree_skb(skb);
321 	return -1;
322 }
323 
324 #ifdef CONFIG_SYSCTL
325 
326 static struct ctl_table lowpan_frags_ns_ctl_table[] = {
327 	{
328 		.procname	= "6lowpanfrag_high_thresh",
329 		.data		= &init_net.ieee802154_lowpan.frags.high_thresh,
330 		.maxlen		= sizeof(unsigned long),
331 		.mode		= 0644,
332 		.proc_handler	= proc_doulongvec_minmax,
333 		.extra1		= &init_net.ieee802154_lowpan.frags.low_thresh
334 	},
335 	{
336 		.procname	= "6lowpanfrag_low_thresh",
337 		.data		= &init_net.ieee802154_lowpan.frags.low_thresh,
338 		.maxlen		= sizeof(unsigned long),
339 		.mode		= 0644,
340 		.proc_handler	= proc_doulongvec_minmax,
341 		.extra2		= &init_net.ieee802154_lowpan.frags.high_thresh
342 	},
343 	{
344 		.procname	= "6lowpanfrag_time",
345 		.data		= &init_net.ieee802154_lowpan.frags.timeout,
346 		.maxlen		= sizeof(int),
347 		.mode		= 0644,
348 		.proc_handler	= proc_dointvec_jiffies,
349 	},
350 	{ }
351 };
352 
353 /* secret interval has been deprecated */
354 static int lowpan_frags_secret_interval_unused;
355 static struct ctl_table lowpan_frags_ctl_table[] = {
356 	{
357 		.procname	= "6lowpanfrag_secret_interval",
358 		.data		= &lowpan_frags_secret_interval_unused,
359 		.maxlen		= sizeof(int),
360 		.mode		= 0644,
361 		.proc_handler	= proc_dointvec_jiffies,
362 	},
363 	{ }
364 };
365 
366 static int __net_init lowpan_frags_ns_sysctl_register(struct net *net)
367 {
368 	struct ctl_table *table;
369 	struct ctl_table_header *hdr;
370 	struct netns_ieee802154_lowpan *ieee802154_lowpan =
371 		net_ieee802154_lowpan(net);
372 
373 	table = lowpan_frags_ns_ctl_table;
374 	if (!net_eq(net, &init_net)) {
375 		table = kmemdup(table, sizeof(lowpan_frags_ns_ctl_table),
376 				GFP_KERNEL);
377 		if (table == NULL)
378 			goto err_alloc;
379 
380 		table[0].data = &ieee802154_lowpan->frags.high_thresh;
381 		table[0].extra1 = &ieee802154_lowpan->frags.low_thresh;
382 		table[1].data = &ieee802154_lowpan->frags.low_thresh;
383 		table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;
384 		table[2].data = &ieee802154_lowpan->frags.timeout;
385 
386 		/* Don't export sysctls to unprivileged users */
387 		if (net->user_ns != &init_user_ns)
388 			table[0].procname = NULL;
389 	}
390 
391 	hdr = register_net_sysctl(net, "net/ieee802154/6lowpan", table);
392 	if (hdr == NULL)
393 		goto err_reg;
394 
395 	ieee802154_lowpan->sysctl.frags_hdr = hdr;
396 	return 0;
397 
398 err_reg:
399 	if (!net_eq(net, &init_net))
400 		kfree(table);
401 err_alloc:
402 	return -ENOMEM;
403 }
404 
405 static void __net_exit lowpan_frags_ns_sysctl_unregister(struct net *net)
406 {
407 	struct ctl_table *table;
408 	struct netns_ieee802154_lowpan *ieee802154_lowpan =
409 		net_ieee802154_lowpan(net);
410 
411 	table = ieee802154_lowpan->sysctl.frags_hdr->ctl_table_arg;
412 	unregister_net_sysctl_table(ieee802154_lowpan->sysctl.frags_hdr);
413 	if (!net_eq(net, &init_net))
414 		kfree(table);
415 }
416 
417 static struct ctl_table_header *lowpan_ctl_header;
418 
419 static int __init lowpan_frags_sysctl_register(void)
420 {
421 	lowpan_ctl_header = register_net_sysctl(&init_net,
422 						"net/ieee802154/6lowpan",
423 						lowpan_frags_ctl_table);
424 	return lowpan_ctl_header == NULL ? -ENOMEM : 0;
425 }
426 
427 static void lowpan_frags_sysctl_unregister(void)
428 {
429 	unregister_net_sysctl_table(lowpan_ctl_header);
430 }
431 #else
432 static inline int lowpan_frags_ns_sysctl_register(struct net *net)
433 {
434 	return 0;
435 }
436 
437 static inline void lowpan_frags_ns_sysctl_unregister(struct net *net)
438 {
439 }
440 
441 static inline int __init lowpan_frags_sysctl_register(void)
442 {
443 	return 0;
444 }
445 
446 static inline void lowpan_frags_sysctl_unregister(void)
447 {
448 }
449 #endif
450 
451 static int __net_init lowpan_frags_init_net(struct net *net)
452 {
453 	struct netns_ieee802154_lowpan *ieee802154_lowpan =
454 		net_ieee802154_lowpan(net);
455 	int res;
456 
457 	ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
458 	ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH;
459 	ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT;
460 	ieee802154_lowpan->frags.f = &lowpan_frags;
461 
462 	res = inet_frags_init_net(&ieee802154_lowpan->frags);
463 	if (res < 0)
464 		return res;
465 	res = lowpan_frags_ns_sysctl_register(net);
466 	if (res < 0)
467 		inet_frags_exit_net(&ieee802154_lowpan->frags);
468 	return res;
469 }
470 
471 static void __net_exit lowpan_frags_exit_net(struct net *net)
472 {
473 	struct netns_ieee802154_lowpan *ieee802154_lowpan =
474 		net_ieee802154_lowpan(net);
475 
476 	lowpan_frags_ns_sysctl_unregister(net);
477 	inet_frags_exit_net(&ieee802154_lowpan->frags);
478 }
479 
480 static struct pernet_operations lowpan_frags_ops = {
481 	.init = lowpan_frags_init_net,
482 	.exit = lowpan_frags_exit_net,
483 };
484 
485 static u32 lowpan_key_hashfn(const void *data, u32 len, u32 seed)
486 {
487 	return jhash2(data,
488 		      sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed);
489 }
490 
491 static u32 lowpan_obj_hashfn(const void *data, u32 len, u32 seed)
492 {
493 	const struct inet_frag_queue *fq = data;
494 
495 	return jhash2((const u32 *)&fq->key,
496 		      sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed);
497 }
498 
499 static int lowpan_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr)
500 {
501 	const struct frag_lowpan_compare_key *key = arg->key;
502 	const struct inet_frag_queue *fq = ptr;
503 
504 	return !!memcmp(&fq->key, key, sizeof(*key));
505 }
506 
507 static const struct rhashtable_params lowpan_rhash_params = {
508 	.head_offset		= offsetof(struct inet_frag_queue, node),
509 	.hashfn			= lowpan_key_hashfn,
510 	.obj_hashfn		= lowpan_obj_hashfn,
511 	.obj_cmpfn		= lowpan_obj_cmpfn,
512 	.automatic_shrinking	= true,
513 };
514 
515 int __init lowpan_net_frag_init(void)
516 {
517 	int ret;
518 
519 	lowpan_frags.constructor = lowpan_frag_init;
520 	lowpan_frags.destructor = NULL;
521 	lowpan_frags.qsize = sizeof(struct frag_queue);
522 	lowpan_frags.frag_expire = lowpan_frag_expire;
523 	lowpan_frags.frags_cache_name = lowpan_frags_cache_name;
524 	lowpan_frags.rhash_params = lowpan_rhash_params;
525 	ret = inet_frags_init(&lowpan_frags);
526 	if (ret)
527 		goto out;
528 
529 	ret = lowpan_frags_sysctl_register();
530 	if (ret)
531 		goto err_sysctl;
532 
533 	ret = register_pernet_subsys(&lowpan_frags_ops);
534 	if (ret)
535 		goto err_pernet;
536 out:
537 	return ret;
538 err_pernet:
539 	lowpan_frags_sysctl_unregister();
540 err_sysctl:
541 	inet_frags_fini(&lowpan_frags);
542 	return ret;
543 }
544 
545 void lowpan_net_frag_exit(void)
546 {
547 	inet_frags_fini(&lowpan_frags);
548 	lowpan_frags_sysctl_unregister();
549 	unregister_pernet_subsys(&lowpan_frags_ops);
550 }
551