1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * INET An implementation of the TCP/IP protocol suite for the LINUX 4 * operating system. INET is implemented using the BSD Socket 5 * interface as the means of communication with the user level. 6 * 7 * The IP fragmentation functionality. 8 * 9 * Authors: Fred N. van Kempen <waltje@uWalt.NL.Mugnet.ORG> 10 * Alan Cox <alan@lxorguk.ukuu.org.uk> 11 * 12 * Fixes: 13 * Alan Cox : Split from ip.c , see ip_input.c for history. 14 * David S. Miller : Begin massive cleanup... 15 * Andi Kleen : Add sysctls. 16 * xxxx : Overlapfrag bug. 17 * Ultima : ip_expire() kernel panic. 18 * Bill Hawes : Frag accounting and evictor fixes. 19 * John McDonald : 0 length frag bug. 20 * Alexey Kuznetsov: SMP races, threading, cleanup. 21 * Patrick McHardy : LRU queue of frag heads for evictor. 22 */ 23 24 #define pr_fmt(fmt) "IPv4: " fmt 25 26 #include <linux/compiler.h> 27 #include <linux/module.h> 28 #include <linux/types.h> 29 #include <linux/mm.h> 30 #include <linux/jiffies.h> 31 #include <linux/skbuff.h> 32 #include <linux/list.h> 33 #include <linux/ip.h> 34 #include <linux/icmp.h> 35 #include <linux/netdevice.h> 36 #include <linux/jhash.h> 37 #include <linux/random.h> 38 #include <linux/slab.h> 39 #include <net/route.h> 40 #include <net/dst.h> 41 #include <net/sock.h> 42 #include <net/ip.h> 43 #include <net/icmp.h> 44 #include <net/checksum.h> 45 #include <net/inetpeer.h> 46 #include <net/inet_frag.h> 47 #include <linux/tcp.h> 48 #include <linux/udp.h> 49 #include <linux/inet.h> 50 #include <linux/netfilter_ipv4.h> 51 #include <net/inet_ecn.h> 52 #include <net/l3mdev.h> 53 54 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6 55 * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c 56 * as well. Or notify me, at least. --ANK 57 */ 58 static const char ip_frag_cache_name[] = "ip4-frags"; 59 60 /* Describe an entry in the "incomplete datagrams" queue. */ 61 struct ipq { 62 struct inet_frag_queue q; 63 64 u8 ecn; /* RFC3168 support */ 65 u16 max_df_size; /* largest frag with DF set seen */ 66 int iif; 67 unsigned int rid; 68 struct inet_peer *peer; 69 }; 70 71 static u8 ip4_frag_ecn(u8 tos) 72 { 73 return 1 << (tos & INET_ECN_MASK); 74 } 75 76 static struct inet_frags ip4_frags; 77 78 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, 79 struct sk_buff *prev_tail, struct net_device *dev); 80 81 82 static void ip4_frag_init(struct inet_frag_queue *q, const void *a) 83 { 84 struct ipq *qp = container_of(q, struct ipq, q); 85 const struct frag_v4_compare_key *key = a; 86 struct net *net = q->fqdir->net; 87 struct inet_peer *p = NULL; 88 89 q->key.v4 = *key; 90 qp->ecn = 0; 91 if (q->fqdir->max_dist) { 92 rcu_read_lock(); 93 p = inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif); 94 if (p && !refcount_inc_not_zero(&p->refcnt)) 95 p = NULL; 96 rcu_read_unlock(); 97 } 98 qp->peer = p; 99 } 100 101 static void ip4_frag_free(struct inet_frag_queue *q) 102 { 103 struct ipq *qp; 104 105 qp = container_of(q, struct ipq, q); 106 if (qp->peer) 107 inet_putpeer(qp->peer); 108 } 109 110 111 /* Destruction primitives. */ 112 113 static void ipq_put(struct ipq *ipq) 114 { 115 inet_frag_put(&ipq->q); 116 } 117 118 /* Kill ipq entry. It is not destroyed immediately, 119 * because caller (and someone more) holds reference count. 120 */ 121 static void ipq_kill(struct ipq *ipq) 122 { 123 inet_frag_kill(&ipq->q); 124 } 125 126 static bool frag_expire_skip_icmp(u32 user) 127 { 128 return user == IP_DEFRAG_AF_PACKET || 129 ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_IN, 130 __IP_DEFRAG_CONNTRACK_IN_END) || 131 ip_defrag_user_in_between(user, IP_DEFRAG_CONNTRACK_BRIDGE_IN, 132 __IP_DEFRAG_CONNTRACK_BRIDGE_IN); 133 } 134 135 /* 136 * Oops, a fragment queue timed out. Kill it and send an ICMP reply. 137 */ 138 static void ip_expire(struct timer_list *t) 139 { 140 enum skb_drop_reason reason = SKB_DROP_REASON_FRAG_REASM_TIMEOUT; 141 struct inet_frag_queue *frag = from_timer(frag, t, timer); 142 const struct iphdr *iph; 143 struct sk_buff *head = NULL; 144 struct net *net; 145 struct ipq *qp; 146 147 qp = container_of(frag, struct ipq, q); 148 net = qp->q.fqdir->net; 149 150 rcu_read_lock(); 151 152 /* Paired with WRITE_ONCE() in fqdir_pre_exit(). */ 153 if (READ_ONCE(qp->q.fqdir->dead)) 154 goto out_rcu_unlock; 155 156 spin_lock(&qp->q.lock); 157 158 if (qp->q.flags & INET_FRAG_COMPLETE) 159 goto out; 160 161 qp->q.flags |= INET_FRAG_DROP; 162 ipq_kill(qp); 163 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 164 __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); 165 166 if (!(qp->q.flags & INET_FRAG_FIRST_IN)) 167 goto out; 168 169 /* sk_buff::dev and sk_buff::rbnode are unionized. So we 170 * pull the head out of the tree in order to be able to 171 * deal with head->dev. 172 */ 173 head = inet_frag_pull_head(&qp->q); 174 if (!head) 175 goto out; 176 head->dev = dev_get_by_index_rcu(net, qp->iif); 177 if (!head->dev) 178 goto out; 179 180 181 /* skb has no dst, perform route lookup again */ 182 iph = ip_hdr(head); 183 reason = ip_route_input_noref(head, iph->daddr, iph->saddr, 184 ip4h_dscp(iph), head->dev); 185 if (reason) 186 goto out; 187 188 /* Only an end host needs to send an ICMP 189 * "Fragment Reassembly Timeout" message, per RFC792. 190 */ 191 reason = SKB_DROP_REASON_FRAG_REASM_TIMEOUT; 192 if (frag_expire_skip_icmp(qp->q.key.v4.user) && 193 (skb_rtable(head)->rt_type != RTN_LOCAL)) 194 goto out; 195 196 spin_unlock(&qp->q.lock); 197 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); 198 goto out_rcu_unlock; 199 200 out: 201 spin_unlock(&qp->q.lock); 202 out_rcu_unlock: 203 rcu_read_unlock(); 204 kfree_skb_reason(head, reason); 205 ipq_put(qp); 206 } 207 208 /* Find the correct entry in the "incomplete datagrams" queue for 209 * this IP datagram, and create new one, if nothing is found. 210 */ 211 static struct ipq *ip_find(struct net *net, struct iphdr *iph, 212 u32 user, int vif) 213 { 214 struct frag_v4_compare_key key = { 215 .saddr = iph->saddr, 216 .daddr = iph->daddr, 217 .user = user, 218 .vif = vif, 219 .id = iph->id, 220 .protocol = iph->protocol, 221 }; 222 struct inet_frag_queue *q; 223 224 q = inet_frag_find(net->ipv4.fqdir, &key); 225 if (!q) 226 return NULL; 227 228 return container_of(q, struct ipq, q); 229 } 230 231 /* Is the fragment too far ahead to be part of ipq? */ 232 static int ip_frag_too_far(struct ipq *qp) 233 { 234 struct inet_peer *peer = qp->peer; 235 unsigned int max = qp->q.fqdir->max_dist; 236 unsigned int start, end; 237 238 int rc; 239 240 if (!peer || !max) 241 return 0; 242 243 start = qp->rid; 244 end = atomic_inc_return(&peer->rid); 245 qp->rid = end; 246 247 rc = qp->q.fragments_tail && (end - start) > max; 248 249 if (rc) 250 __IP_INC_STATS(qp->q.fqdir->net, IPSTATS_MIB_REASMFAILS); 251 252 return rc; 253 } 254 255 static int ip_frag_reinit(struct ipq *qp) 256 { 257 unsigned int sum_truesize = 0; 258 259 if (!mod_timer(&qp->q.timer, jiffies + qp->q.fqdir->timeout)) { 260 refcount_inc(&qp->q.refcnt); 261 return -ETIMEDOUT; 262 } 263 264 sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments, 265 SKB_DROP_REASON_FRAG_TOO_FAR); 266 sub_frag_mem_limit(qp->q.fqdir, sum_truesize); 267 268 qp->q.flags = 0; 269 qp->q.len = 0; 270 qp->q.meat = 0; 271 qp->q.rb_fragments = RB_ROOT; 272 qp->q.fragments_tail = NULL; 273 qp->q.last_run_head = NULL; 274 qp->iif = 0; 275 qp->ecn = 0; 276 277 return 0; 278 } 279 280 /* Add new segment to existing queue. */ 281 static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) 282 { 283 struct net *net = qp->q.fqdir->net; 284 int ihl, end, flags, offset; 285 struct sk_buff *prev_tail; 286 struct net_device *dev; 287 unsigned int fragsize; 288 int err = -ENOENT; 289 SKB_DR(reason); 290 u8 ecn; 291 292 /* If reassembly is already done, @skb must be a duplicate frag. */ 293 if (qp->q.flags & INET_FRAG_COMPLETE) { 294 SKB_DR_SET(reason, DUP_FRAG); 295 goto err; 296 } 297 298 if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) && 299 unlikely(ip_frag_too_far(qp)) && 300 unlikely(err = ip_frag_reinit(qp))) { 301 ipq_kill(qp); 302 goto err; 303 } 304 305 ecn = ip4_frag_ecn(ip_hdr(skb)->tos); 306 offset = ntohs(ip_hdr(skb)->frag_off); 307 flags = offset & ~IP_OFFSET; 308 offset &= IP_OFFSET; 309 offset <<= 3; /* offset is in 8-byte chunks */ 310 ihl = ip_hdrlen(skb); 311 312 /* Determine the position of this fragment. */ 313 end = offset + skb->len - skb_network_offset(skb) - ihl; 314 err = -EINVAL; 315 316 /* Is this the final fragment? */ 317 if ((flags & IP_MF) == 0) { 318 /* If we already have some bits beyond end 319 * or have different end, the segment is corrupted. 320 */ 321 if (end < qp->q.len || 322 ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len)) 323 goto discard_qp; 324 qp->q.flags |= INET_FRAG_LAST_IN; 325 qp->q.len = end; 326 } else { 327 if (end&7) { 328 end &= ~7; 329 if (skb->ip_summed != CHECKSUM_UNNECESSARY) 330 skb->ip_summed = CHECKSUM_NONE; 331 } 332 if (end > qp->q.len) { 333 /* Some bits beyond end -> corruption. */ 334 if (qp->q.flags & INET_FRAG_LAST_IN) 335 goto discard_qp; 336 qp->q.len = end; 337 } 338 } 339 if (end == offset) 340 goto discard_qp; 341 342 err = -ENOMEM; 343 if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) 344 goto discard_qp; 345 346 err = pskb_trim_rcsum(skb, end - offset); 347 if (err) 348 goto discard_qp; 349 350 /* Note : skb->rbnode and skb->dev share the same location. */ 351 dev = skb->dev; 352 /* Makes sure compiler wont do silly aliasing games */ 353 barrier(); 354 355 prev_tail = qp->q.fragments_tail; 356 err = inet_frag_queue_insert(&qp->q, skb, offset, end); 357 if (err) 358 goto insert_error; 359 360 if (dev) 361 qp->iif = dev->ifindex; 362 363 qp->q.stamp = skb->tstamp; 364 qp->q.tstamp_type = skb->tstamp_type; 365 qp->q.meat += skb->len; 366 qp->ecn |= ecn; 367 add_frag_mem_limit(qp->q.fqdir, skb->truesize); 368 if (offset == 0) 369 qp->q.flags |= INET_FRAG_FIRST_IN; 370 371 fragsize = skb->len + ihl; 372 373 if (fragsize > qp->q.max_size) 374 qp->q.max_size = fragsize; 375 376 if (ip_hdr(skb)->frag_off & htons(IP_DF) && 377 fragsize > qp->max_df_size) 378 qp->max_df_size = fragsize; 379 380 if (qp->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && 381 qp->q.meat == qp->q.len) { 382 unsigned long orefdst = skb->_skb_refdst; 383 384 skb->_skb_refdst = 0UL; 385 err = ip_frag_reasm(qp, skb, prev_tail, dev); 386 skb->_skb_refdst = orefdst; 387 if (err) 388 inet_frag_kill(&qp->q); 389 return err; 390 } 391 392 skb_dst_drop(skb); 393 skb_orphan(skb); 394 return -EINPROGRESS; 395 396 insert_error: 397 if (err == IPFRAG_DUP) { 398 SKB_DR_SET(reason, DUP_FRAG); 399 err = -EINVAL; 400 goto err; 401 } 402 err = -EINVAL; 403 __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS); 404 discard_qp: 405 inet_frag_kill(&qp->q); 406 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 407 err: 408 kfree_skb_reason(skb, reason); 409 return err; 410 } 411 412 static bool ip_frag_coalesce_ok(const struct ipq *qp) 413 { 414 return qp->q.key.v4.user == IP_DEFRAG_LOCAL_DELIVER; 415 } 416 417 /* Build a new IP datagram from all its fragments. */ 418 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, 419 struct sk_buff *prev_tail, struct net_device *dev) 420 { 421 struct net *net = qp->q.fqdir->net; 422 struct iphdr *iph; 423 void *reasm_data; 424 int len, err; 425 u8 ecn; 426 427 ipq_kill(qp); 428 429 ecn = ip_frag_ecn_table[qp->ecn]; 430 if (unlikely(ecn == 0xff)) { 431 err = -EINVAL; 432 goto out_fail; 433 } 434 435 /* Make the one we just received the head. */ 436 reasm_data = inet_frag_reasm_prepare(&qp->q, skb, prev_tail); 437 if (!reasm_data) 438 goto out_nomem; 439 440 len = ip_hdrlen(skb) + qp->q.len; 441 err = -E2BIG; 442 if (len > 65535) 443 goto out_oversize; 444 445 inet_frag_reasm_finish(&qp->q, skb, reasm_data, 446 ip_frag_coalesce_ok(qp)); 447 448 skb->dev = dev; 449 IPCB(skb)->frag_max_size = max(qp->max_df_size, qp->q.max_size); 450 451 iph = ip_hdr(skb); 452 iph->tot_len = htons(len); 453 iph->tos |= ecn; 454 455 /* When we set IP_DF on a refragmented skb we must also force a 456 * call to ip_fragment to avoid forwarding a DF-skb of size s while 457 * original sender only sent fragments of size f (where f < s). 458 * 459 * We only set DF/IPSKB_FRAG_PMTU if such DF fragment was the largest 460 * frag seen to avoid sending tiny DF-fragments in case skb was built 461 * from one very small df-fragment and one large non-df frag. 462 */ 463 if (qp->max_df_size == qp->q.max_size) { 464 IPCB(skb)->flags |= IPSKB_FRAG_PMTU; 465 iph->frag_off = htons(IP_DF); 466 } else { 467 iph->frag_off = 0; 468 } 469 470 ip_send_check(iph); 471 472 __IP_INC_STATS(net, IPSTATS_MIB_REASMOKS); 473 qp->q.rb_fragments = RB_ROOT; 474 qp->q.fragments_tail = NULL; 475 qp->q.last_run_head = NULL; 476 return 0; 477 478 out_nomem: 479 net_dbg_ratelimited("queue_glue: no memory for gluing queue %p\n", qp); 480 err = -ENOMEM; 481 goto out_fail; 482 out_oversize: 483 net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr); 484 out_fail: 485 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 486 return err; 487 } 488 489 /* Process an incoming IP datagram fragment. */ 490 int ip_defrag(struct net *net, struct sk_buff *skb, u32 user) 491 { 492 struct net_device *dev = skb->dev ? : skb_dst(skb)->dev; 493 int vif = l3mdev_master_ifindex_rcu(dev); 494 struct ipq *qp; 495 496 __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS); 497 498 /* Lookup (or create) queue header */ 499 qp = ip_find(net, ip_hdr(skb), user, vif); 500 if (qp) { 501 int ret; 502 503 spin_lock(&qp->q.lock); 504 505 ret = ip_frag_queue(qp, skb); 506 507 spin_unlock(&qp->q.lock); 508 ipq_put(qp); 509 return ret; 510 } 511 512 __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); 513 kfree_skb(skb); 514 return -ENOMEM; 515 } 516 EXPORT_SYMBOL(ip_defrag); 517 518 struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) 519 { 520 struct iphdr iph; 521 int netoff; 522 u32 len; 523 524 if (skb->protocol != htons(ETH_P_IP)) 525 return skb; 526 527 netoff = skb_network_offset(skb); 528 529 if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0) 530 return skb; 531 532 if (iph.ihl < 5 || iph.version != 4) 533 return skb; 534 535 len = ntohs(iph.tot_len); 536 if (skb->len < netoff + len || len < (iph.ihl * 4)) 537 return skb; 538 539 if (ip_is_fragment(&iph)) { 540 skb = skb_share_check(skb, GFP_ATOMIC); 541 if (skb) { 542 if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) { 543 kfree_skb(skb); 544 return NULL; 545 } 546 if (pskb_trim_rcsum(skb, netoff + len)) { 547 kfree_skb(skb); 548 return NULL; 549 } 550 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 551 if (ip_defrag(net, skb, user)) 552 return NULL; 553 skb_clear_hash(skb); 554 } 555 } 556 return skb; 557 } 558 EXPORT_SYMBOL(ip_check_defrag); 559 560 #ifdef CONFIG_SYSCTL 561 static int dist_min; 562 563 static struct ctl_table ip4_frags_ns_ctl_table[] = { 564 { 565 .procname = "ipfrag_high_thresh", 566 .maxlen = sizeof(unsigned long), 567 .mode = 0644, 568 .proc_handler = proc_doulongvec_minmax, 569 }, 570 { 571 .procname = "ipfrag_low_thresh", 572 .maxlen = sizeof(unsigned long), 573 .mode = 0644, 574 .proc_handler = proc_doulongvec_minmax, 575 }, 576 { 577 .procname = "ipfrag_time", 578 .maxlen = sizeof(int), 579 .mode = 0644, 580 .proc_handler = proc_dointvec_jiffies, 581 }, 582 { 583 .procname = "ipfrag_max_dist", 584 .maxlen = sizeof(int), 585 .mode = 0644, 586 .proc_handler = proc_dointvec_minmax, 587 .extra1 = &dist_min, 588 }, 589 }; 590 591 /* secret interval has been deprecated */ 592 static int ip4_frags_secret_interval_unused; 593 static struct ctl_table ip4_frags_ctl_table[] = { 594 { 595 .procname = "ipfrag_secret_interval", 596 .data = &ip4_frags_secret_interval_unused, 597 .maxlen = sizeof(int), 598 .mode = 0644, 599 .proc_handler = proc_dointvec_jiffies, 600 }, 601 }; 602 603 static int __net_init ip4_frags_ns_ctl_register(struct net *net) 604 { 605 struct ctl_table *table; 606 struct ctl_table_header *hdr; 607 608 table = ip4_frags_ns_ctl_table; 609 if (!net_eq(net, &init_net)) { 610 table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL); 611 if (!table) 612 goto err_alloc; 613 614 } 615 table[0].data = &net->ipv4.fqdir->high_thresh; 616 table[0].extra1 = &net->ipv4.fqdir->low_thresh; 617 table[1].data = &net->ipv4.fqdir->low_thresh; 618 table[1].extra2 = &net->ipv4.fqdir->high_thresh; 619 table[2].data = &net->ipv4.fqdir->timeout; 620 table[3].data = &net->ipv4.fqdir->max_dist; 621 622 hdr = register_net_sysctl_sz(net, "net/ipv4", table, 623 ARRAY_SIZE(ip4_frags_ns_ctl_table)); 624 if (!hdr) 625 goto err_reg; 626 627 net->ipv4.frags_hdr = hdr; 628 return 0; 629 630 err_reg: 631 if (!net_eq(net, &init_net)) 632 kfree(table); 633 err_alloc: 634 return -ENOMEM; 635 } 636 637 static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net) 638 { 639 const struct ctl_table *table; 640 641 table = net->ipv4.frags_hdr->ctl_table_arg; 642 unregister_net_sysctl_table(net->ipv4.frags_hdr); 643 kfree(table); 644 } 645 646 static void __init ip4_frags_ctl_register(void) 647 { 648 register_net_sysctl(&init_net, "net/ipv4", ip4_frags_ctl_table); 649 } 650 #else 651 static int ip4_frags_ns_ctl_register(struct net *net) 652 { 653 return 0; 654 } 655 656 static void ip4_frags_ns_ctl_unregister(struct net *net) 657 { 658 } 659 660 static void __init ip4_frags_ctl_register(void) 661 { 662 } 663 #endif 664 665 static int __net_init ipv4_frags_init_net(struct net *net) 666 { 667 int res; 668 669 res = fqdir_init(&net->ipv4.fqdir, &ip4_frags, net); 670 if (res < 0) 671 return res; 672 /* Fragment cache limits. 673 * 674 * The fragment memory accounting code, (tries to) account for 675 * the real memory usage, by measuring both the size of frag 676 * queue struct (inet_frag_queue (ipv4:ipq/ipv6:frag_queue)) 677 * and the SKB's truesize. 678 * 679 * A 64K fragment consumes 129736 bytes (44*2944)+200 680 * (1500 truesize == 2944, sizeof(struct ipq) == 200) 681 * 682 * We will commit 4MB at one time. Should we cross that limit 683 * we will prune down to 3MB, making room for approx 8 big 64K 684 * fragments 8x128k. 685 */ 686 net->ipv4.fqdir->high_thresh = 4 * 1024 * 1024; 687 net->ipv4.fqdir->low_thresh = 3 * 1024 * 1024; 688 /* 689 * Important NOTE! Fragment queue must be destroyed before MSL expires. 690 * RFC791 is wrong proposing to prolongate timer each fragment arrival 691 * by TTL. 692 */ 693 net->ipv4.fqdir->timeout = IP_FRAG_TIME; 694 695 net->ipv4.fqdir->max_dist = 64; 696 697 res = ip4_frags_ns_ctl_register(net); 698 if (res < 0) 699 fqdir_exit(net->ipv4.fqdir); 700 return res; 701 } 702 703 static void __net_exit ipv4_frags_pre_exit_net(struct net *net) 704 { 705 fqdir_pre_exit(net->ipv4.fqdir); 706 } 707 708 static void __net_exit ipv4_frags_exit_net(struct net *net) 709 { 710 ip4_frags_ns_ctl_unregister(net); 711 fqdir_exit(net->ipv4.fqdir); 712 } 713 714 static struct pernet_operations ip4_frags_ops = { 715 .init = ipv4_frags_init_net, 716 .pre_exit = ipv4_frags_pre_exit_net, 717 .exit = ipv4_frags_exit_net, 718 }; 719 720 721 static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed) 722 { 723 return jhash2(data, 724 sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); 725 } 726 727 static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed) 728 { 729 const struct inet_frag_queue *fq = data; 730 731 return jhash2((const u32 *)&fq->key.v4, 732 sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); 733 } 734 735 static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) 736 { 737 const struct frag_v4_compare_key *key = arg->key; 738 const struct inet_frag_queue *fq = ptr; 739 740 return !!memcmp(&fq->key, key, sizeof(*key)); 741 } 742 743 static const struct rhashtable_params ip4_rhash_params = { 744 .head_offset = offsetof(struct inet_frag_queue, node), 745 .key_offset = offsetof(struct inet_frag_queue, key), 746 .key_len = sizeof(struct frag_v4_compare_key), 747 .hashfn = ip4_key_hashfn, 748 .obj_hashfn = ip4_obj_hashfn, 749 .obj_cmpfn = ip4_obj_cmpfn, 750 .automatic_shrinking = true, 751 }; 752 753 void __init ipfrag_init(void) 754 { 755 ip4_frags.constructor = ip4_frag_init; 756 ip4_frags.destructor = ip4_frag_free; 757 ip4_frags.qsize = sizeof(struct ipq); 758 ip4_frags.frag_expire = ip_expire; 759 ip4_frags.frags_cache_name = ip_frag_cache_name; 760 ip4_frags.rhash_params = ip4_rhash_params; 761 if (inet_frags_init(&ip4_frags)) 762 panic("IP: failed to allocate ip4_frags cache\n"); 763 ip4_frags_ctl_register(); 764 register_pernet_subsys(&ip4_frags_ops); 765 } 766