BadVPN – Blame information for rev 1

Subversion Repositories:
Rev:
Rev Author Line No. Line
1 office 1 /**
2 * @file
3 *
4 * IPv6 fragmentation and reassembly.
5 */
6  
7 /*
8 * Copyright (c) 2010 Inico Technologies Ltd.
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without modification,
12 * are permitted provided that the following conditions are met:
13 *
14 * 1. Redistributions of source code must retain the above copyright notice,
15 * this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright notice,
17 * this list of conditions and the following disclaimer in the documentation
18 * and/or other materials provided with the distribution.
19 * 3. The name of the author may not be used to endorse or promote products
20 * derived from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
23 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
24 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
25 * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
26 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
27 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
30 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
31 * OF SUCH DAMAGE.
32 *
33 * This file is part of the lwIP TCP/IP stack.
34 *
35 * Author: Ivan Delamer <delamer@inicotech.com>
36 *
37 *
38 * Please coordinate changes and requests with Ivan Delamer
39 * <delamer@inicotech.com>
40 */
41  
42 #include "lwip/opt.h"
43 #include "lwip/ip6_frag.h"
44 #include "lwip/ip6.h"
45 #include "lwip/icmp6.h"
46 #include "lwip/nd6.h"
47 #include "lwip/ip.h"
48  
49 #include "lwip/pbuf.h"
50 #include "lwip/memp.h"
51 #include "lwip/stats.h"
52  
53 #include <string.h>
54  
55 #if LWIP_IPV6 && LWIP_IPV6_REASS /* don't build if not configured for use in lwipopts.h */
56  
57  
58 /** Setting this to 0, you can turn off checking the fragments for overlapping
59 * regions. The code gets a little smaller. Only use this if you know that
60 * overlapping won't occur on your network! */
61 #ifndef IP_REASS_CHECK_OVERLAP
62 #define IP_REASS_CHECK_OVERLAP 1
63 #endif /* IP_REASS_CHECK_OVERLAP */
64  
65 /** Set to 0 to prevent freeing the oldest datagram when the reassembly buffer is
66 * full (IP_REASS_MAX_PBUFS pbufs are enqueued). The code gets a little smaller.
67 * Datagrams will be freed by timeout only. Especially useful when MEMP_NUM_REASSDATA
68 * is set to 1, so one datagram can be reassembled at a time, only. */
69 #ifndef IP_REASS_FREE_OLDEST
70 #define IP_REASS_FREE_OLDEST 1
71 #endif /* IP_REASS_FREE_OLDEST */
72  
73 #if IPV6_FRAG_COPYHEADER
74 /* The number of bytes we need to "borrow" from (i.e., overwrite in) the header
75 * that precedes the fragment header for reassembly pruposes. */
76 #define IPV6_FRAG_REQROOM ((s16_t)(sizeof(struct ip6_reass_helper) - IP6_FRAG_HLEN))
77 #endif
78  
79 #define IP_REASS_FLAG_LASTFRAG 0x01
80  
81 /** This is a helper struct which holds the starting
82 * offset and the ending offset of this fragment to
83 * easily chain the fragments.
84 * It has the same packing requirements as the IPv6 header, since it replaces
85 * the Fragment Header in memory in incoming fragments to keep
86 * track of the various fragments.
87 */
88 #ifdef PACK_STRUCT_USE_INCLUDES
89 # include "arch/bpstruct.h"
90 #endif
91 PACK_STRUCT_BEGIN
92 struct ip6_reass_helper {
93 PACK_STRUCT_FIELD(struct pbuf *next_pbuf);
94 PACK_STRUCT_FIELD(u16_t start);
95 PACK_STRUCT_FIELD(u16_t end);
96 } PACK_STRUCT_STRUCT;
97 PACK_STRUCT_END
98 #ifdef PACK_STRUCT_USE_INCLUDES
99 # include "arch/epstruct.h"
100 #endif
101  
102 /* static variables */
103 static struct ip6_reassdata *reassdatagrams;
104 static u16_t ip6_reass_pbufcount;
105  
106 /* Forward declarations. */
107 static void ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr);
108 #if IP_REASS_FREE_OLDEST
109 static void ip6_reass_remove_oldest_datagram(struct ip6_reassdata *ipr, int pbufs_needed);
110 #endif /* IP_REASS_FREE_OLDEST */
111  
112 void
113 ip6_reass_tmr(void)
114 {
115 struct ip6_reassdata *r, *tmp;
116  
117 #if !IPV6_FRAG_COPYHEADER
118 LWIP_ASSERT("sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN, set IPV6_FRAG_COPYHEADER to 1",
119 sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN);
120 #endif /* !IPV6_FRAG_COPYHEADER */
121  
122 r = reassdatagrams;
123 while (r != NULL) {
124 /* Decrement the timer. Once it reaches 0,
125 * clean up the incomplete fragment assembly */
126 if (r->timer > 0) {
127 r->timer--;
128 r = r->next;
129 } else {
130 /* reassembly timed out */
131 tmp = r;
132 /* get the next pointer before freeing */
133 r = r->next;
134 /* free the helper struct and all enqueued pbufs */
135 ip6_reass_free_complete_datagram(tmp);
136 }
137 }
138 }
139  
140 /**
141 * Free a datagram (struct ip6_reassdata) and all its pbufs.
142 * Updates the total count of enqueued pbufs (ip6_reass_pbufcount),
143 * sends an ICMP time exceeded packet.
144 *
145 * @param ipr datagram to free
146 */
147 static void
148 ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
149 {
150 struct ip6_reassdata *prev;
151 u16_t pbufs_freed = 0;
152 u16_t clen;
153 struct pbuf *p;
154 struct ip6_reass_helper *iprh;
155  
156 #if LWIP_ICMP6
157 iprh = (struct ip6_reass_helper *)ipr->p->payload;
158 if (iprh->start == 0) {
159 /* The first fragment was received, send ICMP time exceeded. */
160 /* First, de-queue the first pbuf from r->p. */
161 p = ipr->p;
162 ipr->p = iprh->next_pbuf;
163 /* Restore the part that we've overwritten with our helper structure, or we
164 * might send garbage (and disclose a pointer) in the ICMPv6 reply. */
165 MEMCPY(p->payload, ipr->orig_hdr, sizeof(iprh));
166 /* Then, move back to the original ipv6 header (we are now pointing to Fragment header).
167 This cannot fail since we already checked when receiving this fragment. */
168 if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr))) {
169 LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
170 }
171 else {
172 /* Reconstruct the zoned source and destination addresses, so that we do
173 * not end up sending the ICMP response over the wrong link. */
174 ip6_addr_t src_addr, dest_addr;
175 ip6_addr_copy_from_packed(src_addr, IPV6_FRAG_SRC(ipr));
176 ip6_addr_set_zone(&src_addr, ipr->src_zone);
177 ip6_addr_copy_from_packed(dest_addr, IPV6_FRAG_DEST(ipr));
178 ip6_addr_set_zone(&dest_addr, ipr->dest_zone);
179 /* Send the actual ICMP response. */
180 icmp6_time_exceeded_with_addrs(p, ICMP6_TE_FRAG, &src_addr, &dest_addr);
181 }
182 clen = pbuf_clen(p);
183 LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
184 pbufs_freed = (u16_t)(pbufs_freed + clen);
185 pbuf_free(p);
186 }
187 #endif /* LWIP_ICMP6 */
188  
189 /* First, free all received pbufs. The individual pbufs need to be released
190 separately as they have not yet been chained */
191 p = ipr->p;
192 while (p != NULL) {
193 struct pbuf *pcur;
194 iprh = (struct ip6_reass_helper *)p->payload;
195 pcur = p;
196 /* get the next pointer before freeing */
197 p = iprh->next_pbuf;
198 clen = pbuf_clen(pcur);
199 LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
200 pbufs_freed = (u16_t)(pbufs_freed + clen);
201 pbuf_free(pcur);
202 }
203  
204 /* Then, unchain the struct ip6_reassdata from the list and free it. */
205 if (ipr == reassdatagrams) {
206 reassdatagrams = ipr->next;
207 } else {
208 prev = reassdatagrams;
209 while (prev != NULL) {
210 if (prev->next == ipr) {
211 break;
212 }
213 prev = prev->next;
214 }
215 if (prev != NULL) {
216 prev->next = ipr->next;
217 }
218 }
219 memp_free(MEMP_IP6_REASSDATA, ipr);
220  
221 /* Finally, update number of pbufs in reassembly queue */
222 LWIP_ASSERT("ip_reass_pbufcount >= clen", ip6_reass_pbufcount >= pbufs_freed);
223 ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - pbufs_freed);
224 }
225  
226 #if IP_REASS_FREE_OLDEST
227 /**
228 * Free the oldest datagram to make room for enqueueing new fragments.
229 * The datagram ipr is not freed!
230 *
231 * @param ipr ip6_reassdata for the current fragment
232 * @param pbufs_needed number of pbufs needed to enqueue
233 * (used for freeing other datagrams if not enough space)
234 */
235 static void
236 ip6_reass_remove_oldest_datagram(struct ip6_reassdata *ipr, int pbufs_needed)
237 {
238 struct ip6_reassdata *r, *oldest;
239  
240 /* Free datagrams until being allowed to enqueue 'pbufs_needed' pbufs,
241 * but don't free the current datagram! */
242 do {
243 r = oldest = reassdatagrams;
244 while (r != NULL) {
245 if (r != ipr) {
246 if (r->timer <= oldest->timer) {
247 /* older than the previous oldest */
248 oldest = r;
249 }
250 }
251 r = r->next;
252 }
253 if (oldest == ipr) {
254 /* nothing to free, ipr is the only element on the list */
255 return;
256 }
257 if (oldest != NULL) {
258 ip6_reass_free_complete_datagram(oldest);
259 }
260 } while (((ip6_reass_pbufcount + pbufs_needed) > IP_REASS_MAX_PBUFS) && (reassdatagrams != NULL));
261 }
262 #endif /* IP_REASS_FREE_OLDEST */
263  
264 /**
265 * Reassembles incoming IPv6 fragments into an IPv6 datagram.
266 *
267 * @param p points to the IPv6 Fragment Header
268 * @return NULL if reassembly is incomplete, pbuf pointing to
269 * IPv6 Header if reassembly is complete
270 */
271 struct pbuf *
272 ip6_reass(struct pbuf *p)
273 {
274 struct ip6_reassdata *ipr, *ipr_prev;
275 struct ip6_reass_helper *iprh, *iprh_tmp, *iprh_prev=NULL;
276 struct ip6_frag_hdr *frag_hdr;
277 u16_t offset, len, start, end;
278 ptrdiff_t hdrdiff;
279 u16_t clen;
280 u8_t valid = 1;
281 struct pbuf *q, *next_pbuf;
282  
283 IP6_FRAG_STATS_INC(ip6_frag.recv);
284  
285 /* ip6_frag_hdr must be in the first pbuf, not chained. Checked by caller. */
286 LWIP_ASSERT("IPv6 fragment header does not fit in first pbuf",
287 p->len >= sizeof(struct ip6_frag_hdr));
288  
289 frag_hdr = (struct ip6_frag_hdr *) p->payload;
290  
291 clen = pbuf_clen(p);
292  
293 offset = lwip_ntohs(frag_hdr->_fragment_offset);
294  
295 /* Calculate fragment length from IPv6 payload length.
296 * Adjust for headers before Fragment Header.
297 * And finally adjust by Fragment Header length. */
298 len = lwip_ntohs(ip6_current_header()->_plen);
299 hdrdiff = (u8_t*)p->payload - (const u8_t*)ip6_current_header();
300 LWIP_ASSERT("not a valid pbuf (ip6_input check missing?)", hdrdiff <= 0xFFFF);
301 LWIP_ASSERT("not a valid pbuf (ip6_input check missing?)", hdrdiff >= IP6_HLEN);
302 hdrdiff -= IP6_HLEN;
303 hdrdiff += IP6_FRAG_HLEN;
304 if (hdrdiff > len) {
305 IP6_FRAG_STATS_INC(ip6_frag.proterr);
306 goto nullreturn;
307 }
308 len = (u16_t)(len - hdrdiff);
309 start = (offset & IP6_FRAG_OFFSET_MASK);
310 if (start > (0xFFFF - len)) {
311 /* u16_t overflow, cannot handle this */
312 IP6_FRAG_STATS_INC(ip6_frag.proterr);
313 goto nullreturn;
314 }
315  
316 /* Look for the datagram the fragment belongs to in the current datagram queue,
317 * remembering the previous in the queue for later dequeueing. */
318 for (ipr = reassdatagrams, ipr_prev = NULL; ipr != NULL; ipr = ipr->next) {
319 /* Check if the incoming fragment matches the one currently present
320 in the reassembly buffer. If so, we proceed with copying the
321 fragment into the buffer. */
322 if ((frag_hdr->_identification == ipr->identification) &&
323 ip6_addr_cmp_packed(ip6_current_src_addr(), &(IPV6_FRAG_SRC(ipr)), ipr->src_zone) &&
324 ip6_addr_cmp_packed(ip6_current_dest_addr(), &(IPV6_FRAG_DEST(ipr)), ipr->dest_zone)) {
325 IP6_FRAG_STATS_INC(ip6_frag.cachehit);
326 break;
327 }
328 ipr_prev = ipr;
329 }
330  
331 if (ipr == NULL) {
332 /* Enqueue a new datagram into the datagram queue */
333 ipr = (struct ip6_reassdata *)memp_malloc(MEMP_IP6_REASSDATA);
334 if (ipr == NULL) {
335 #if IP_REASS_FREE_OLDEST
336 /* Make room and try again. */
337 ip6_reass_remove_oldest_datagram(ipr, clen);
338 ipr = (struct ip6_reassdata *)memp_malloc(MEMP_IP6_REASSDATA);
339 if (ipr != NULL) {
340 /* re-search ipr_prev since it might have been removed */
341 for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr_prev = ipr_prev->next) {
342 if (ipr_prev->next == ipr) {
343 break;
344 }
345 }
346 } else
347 #endif /* IP_REASS_FREE_OLDEST */
348 {
349 IP6_FRAG_STATS_INC(ip6_frag.memerr);
350 goto nullreturn;
351 }
352 }
353  
354 memset(ipr, 0, sizeof(struct ip6_reassdata));
355 ipr->timer = IPV6_REASS_MAXAGE;
356  
357 /* enqueue the new structure to the front of the list */
358 ipr->next = reassdatagrams;
359 reassdatagrams = ipr;
360  
361 /* Use the current IPv6 header for src/dest address reference.
362 * Eventually, we will replace it when we get the first fragment
363 * (it might be this one, in any case, it is done later). */
364 /* need to use the none-const pointer here: */
365 ipr->iphdr = ip_data.current_ip6_header;
366 #if IPV6_FRAG_COPYHEADER
367 MEMCPY(&ipr->src, &ip6_current_header()->src, sizeof(ipr->src));
368 MEMCPY(&ipr->dest, &ip6_current_header()->dest, sizeof(ipr->dest));
369 #endif /* IPV6_FRAG_COPYHEADER */
370 #if LWIP_IPV6_SCOPES
371 /* Also store the address zone information.
372 * @todo It is possible that due to netif destruction and recreation, the
373 * stored zones end up resolving to a different interface. In that case, we
374 * risk sending a "time exceeded" ICMP response over the wrong link.
375 * Ideally, netif destruction would clean up matching pending reassembly
376 * structures, but custom zone mappings would make that non-trivial. */
377 ipr->src_zone = ip6_addr_zone(ip6_current_src_addr());
378 ipr->dest_zone = ip6_addr_zone(ip6_current_dest_addr());
379 #endif /* LWIP_IPV6_SCOPES */
380 /* copy the fragmented packet id. */
381 ipr->identification = frag_hdr->_identification;
382  
383 /* copy the nexth field */
384 ipr->nexth = frag_hdr->_nexth;
385 }
386  
387 /* Check if we are allowed to enqueue more datagrams. */
388 if ((ip6_reass_pbufcount + clen) > IP_REASS_MAX_PBUFS) {
389 #if IP_REASS_FREE_OLDEST
390 ip6_reass_remove_oldest_datagram(ipr, clen);
391 if ((ip6_reass_pbufcount + clen) <= IP_REASS_MAX_PBUFS) {
392 /* re-search ipr_prev since it might have been removed */
393 for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr_prev = ipr_prev->next) {
394 if (ipr_prev->next == ipr) {
395 break;
396 }
397 }
398 } else
399 #endif /* IP_REASS_FREE_OLDEST */
400 {
401 /* @todo: send ICMPv6 time exceeded here? */
402 /* drop this pbuf */
403 IP6_FRAG_STATS_INC(ip6_frag.memerr);
404 goto nullreturn;
405 }
406 }
407  
408 /* Overwrite Fragment Header with our own helper struct. */
409 #if IPV6_FRAG_COPYHEADER
410 if (IPV6_FRAG_REQROOM > 0) {
411 /* Make room for struct ip6_reass_helper (only required if sizeof(void*) > 4).
412 This cannot fail since we already checked when receiving this fragment. */
413 u8_t hdrerr = pbuf_header_force(p, IPV6_FRAG_REQROOM);
414 LWIP_UNUSED_ARG(hdrerr); /* in case of LWIP_NOASSERT */
415 LWIP_ASSERT("no room for struct ip6_reass_helper", hdrerr == 0);
416 }
417 #else /* IPV6_FRAG_COPYHEADER */
418 LWIP_ASSERT("sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN, set IPV6_FRAG_COPYHEADER to 1",
419 sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN);
420 #endif /* IPV6_FRAG_COPYHEADER */
421  
422 /* Prepare the pointer to the helper structure, and its initial values.
423 * Do not yet write to the structure itself, as we still have to make a
424 * backup of the original data, and we should not do that until we know for
425 * sure that we are going to add this packet to the list. */
426 iprh = (struct ip6_reass_helper *)p->payload;
427 next_pbuf = NULL;
428 end = (u16_t)(start + len);
429  
430 /* find the right place to insert this pbuf */
431 /* Iterate through until we either get to the end of the list (append),
432 * or we find on with a larger offset (insert). */
433 for (q = ipr->p; q != NULL;) {
434 iprh_tmp = (struct ip6_reass_helper*)q->payload;
435 if (start < iprh_tmp->start) {
436 #if IP_REASS_CHECK_OVERLAP
437 if (end > iprh_tmp->start) {
438 /* fragment overlaps with following, throw away */
439 IP6_FRAG_STATS_INC(ip6_frag.proterr);
440 goto nullreturn;
441 }
442 if (iprh_prev != NULL) {
443 if (start < iprh_prev->end) {
444 /* fragment overlaps with previous, throw away */
445 IP6_FRAG_STATS_INC(ip6_frag.proterr);
446 goto nullreturn;
447 }
448 }
449 #endif /* IP_REASS_CHECK_OVERLAP */
450 /* the new pbuf should be inserted before this */
451 next_pbuf = q;
452 if (iprh_prev != NULL) {
453 /* not the fragment with the lowest offset */
454 iprh_prev->next_pbuf = p;
455 } else {
456 /* fragment with the lowest offset */
457 ipr->p = p;
458 }
459 break;
460 } else if (start == iprh_tmp->start) {
461 /* received the same datagram twice: no need to keep the datagram */
462 goto nullreturn;
463 #if IP_REASS_CHECK_OVERLAP
464 } else if (start < iprh_tmp->end) {
465 /* overlap: no need to keep the new datagram */
466 IP6_FRAG_STATS_INC(ip6_frag.proterr);
467 goto nullreturn;
468 #endif /* IP_REASS_CHECK_OVERLAP */
469 } else {
470 /* Check if the fragments received so far have no gaps. */
471 if (iprh_prev != NULL) {
472 if (iprh_prev->end != iprh_tmp->start) {
473 /* There is a fragment missing between the current
474 * and the previous fragment */
475 valid = 0;
476 }
477 }
478 }
479 q = iprh_tmp->next_pbuf;
480 iprh_prev = iprh_tmp;
481 }
482  
483 /* If q is NULL, then we made it to the end of the list. Determine what to do now */
484 if (q == NULL) {
485 if (iprh_prev != NULL) {
486 /* this is (for now), the fragment with the highest offset:
487 * chain it to the last fragment */
488 #if IP_REASS_CHECK_OVERLAP
489 LWIP_ASSERT("check fragments don't overlap", iprh_prev->end <= start);
490 #endif /* IP_REASS_CHECK_OVERLAP */
491 iprh_prev->next_pbuf = p;
492 if (iprh_prev->end != start) {
493 valid = 0;
494 }
495 } else {
496 #if IP_REASS_CHECK_OVERLAP
497 LWIP_ASSERT("no previous fragment, this must be the first fragment!",
498 ipr->p == NULL);
499 #endif /* IP_REASS_CHECK_OVERLAP */
500 /* this is the first fragment we ever received for this ip datagram */
501 ipr->p = p;
502 }
503 }
504  
505 /* Track the current number of pbufs current 'in-flight', in order to limit
506 the number of fragments that may be enqueued at any one time */
507 ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount + clen);
508  
509 /* Remember IPv6 header if this is the first fragment. */
510 if (start == 0) {
511 /* need to use the none-const pointer here: */
512 ipr->iphdr = ip_data.current_ip6_header;
513 /* Make a backup of the part of the packet data that we are about to
514 * overwrite, so that we can restore the original later. */
515 MEMCPY(ipr->orig_hdr, p->payload, sizeof(*iprh));
516 /* For IPV6_FRAG_COPYHEADER there is no need to copy src/dst again, as they
517 * will be the same as they were. With LWIP_IPV6_SCOPES, the same applies
518 * to the source/destination zones. */
519 }
520 /* Only after the backup do we get to fill in the actual helper structure. */
521 iprh->next_pbuf = next_pbuf;
522 iprh->start = start;
523 iprh->end = end;
524  
525 /* If this is the last fragment, calculate total packet length. */
526 if ((offset & IP6_FRAG_MORE_FLAG) == 0) {
527 ipr->datagram_len = iprh->end;
528 }
529  
530 /* Additional validity tests: we have received first and last fragment. */
531 iprh_tmp = (struct ip6_reass_helper*)ipr->p->payload;
532 if (iprh_tmp->start != 0) {
533 valid = 0;
534 }
535 if (ipr->datagram_len == 0) {
536 valid = 0;
537 }
538  
539 /* Final validity test: no gaps between current and last fragment. */
540 iprh_prev = iprh;
541 q = iprh->next_pbuf;
542 while ((q != NULL) && valid) {
543 iprh = (struct ip6_reass_helper*)q->payload;
544 if (iprh_prev->end != iprh->start) {
545 valid = 0;
546 break;
547 }
548 iprh_prev = iprh;
549 q = iprh->next_pbuf;
550 }
551  
552 if (valid) {
553 /* All fragments have been received */
554 struct ip6_hdr* iphdr_ptr;
555  
556 /* chain together the pbufs contained within the ip6_reassdata list. */
557 iprh = (struct ip6_reass_helper*) ipr->p->payload;
558 while (iprh != NULL) {
559 next_pbuf = iprh->next_pbuf;
560 if (next_pbuf != NULL) {
561 /* Save next helper struct (will be hidden in next step). */
562 iprh_tmp = (struct ip6_reass_helper*)next_pbuf->payload;
563  
564 /* hide the fragment header for every succeeding fragment */
565 pbuf_remove_header(next_pbuf, IP6_FRAG_HLEN);
566 #if IPV6_FRAG_COPYHEADER
567 if (IPV6_FRAG_REQROOM > 0) {
568 /* hide the extra bytes borrowed from ip6_hdr for struct ip6_reass_helper */
569 u8_t hdrerr = pbuf_remove_header(next_pbuf, IPV6_FRAG_REQROOM);
570 LWIP_UNUSED_ARG(hdrerr); /* in case of LWIP_NOASSERT */
571 LWIP_ASSERT("no room for struct ip6_reass_helper", hdrerr == 0);
572 }
573 #endif
574 pbuf_cat(ipr->p, next_pbuf);
575 }
576 else {
577 iprh_tmp = NULL;
578 }
579  
580 iprh = iprh_tmp;
581 }
582  
583 /* Get the first pbuf. */
584 p = ipr->p;
585  
586 #if IPV6_FRAG_COPYHEADER
587 if (IPV6_FRAG_REQROOM > 0) {
588 u8_t hdrerr;
589 /* Restore (only) the bytes that we overwrote beyond the fragment header.
590 * Those bytes may belong to either the IPv6 header or an extension
591 * header placed before the fragment header. */
592 MEMCPY(p->payload, ipr->orig_hdr, IPV6_FRAG_REQROOM);
593 /* get back room for struct ip6_reass_helper (only required if sizeof(void*) > 4) */
594 hdrerr = pbuf_remove_header(p, IPV6_FRAG_REQROOM);
595 LWIP_UNUSED_ARG(hdrerr); /* in case of LWIP_NOASSERT */
596 LWIP_ASSERT("no room for struct ip6_reass_helper", hdrerr == 0);
597 }
598 #endif
599  
600 /* We need to get rid of the fragment header itself, which is somewhere in
601 * the middle of the packet (but still in the first pbuf of the chain).
602 * Getting rid of the header is required by RFC 2460 Sec. 4.5 and necessary
603 * in order to be able to reassemble packets that are close to full size
604 * (i.e., around 65535 bytes). We simply move up all the headers before the
605 * fragment header, including the IPv6 header, and adjust the payload start
606 * accordingly. This works because all these headers are in the first pbuf
607 * of the chain, and because the caller adjusts all its pointers on
608 * successful reassembly. */
609 MEMMOVE((u8_t*)ipr->iphdr + sizeof(struct ip6_frag_hdr), ipr->iphdr,
610 (size_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr));
611  
612 /* This is where the IPv6 header is now. */
613 iphdr_ptr = (struct ip6_hdr*)((u8_t*)ipr->iphdr +
614 sizeof(struct ip6_frag_hdr));
615  
616 /* Adjust datagram length by adding header lengths. */
617 ipr->datagram_len = (u16_t)(ipr->datagram_len + ((u8_t*)p->payload - (u8_t*)iphdr_ptr)
618 - IP6_HLEN);
619  
620 /* Set payload length in ip header. */
621 iphdr_ptr->_plen = lwip_htons(ipr->datagram_len);
622  
623 /* With the fragment header gone, we now need to adjust the next-header
624 * field of whatever header was originally before it. Since the packet made
625 * it through the original header processing routines at least up to the
626 * fragment header, we do not need any further sanity checks here. */
627 if (IP6H_NEXTH(iphdr_ptr) == IP6_NEXTH_FRAGMENT) {
628 iphdr_ptr->_nexth = ipr->nexth;
629 } else {
630 u8_t *ptr = (u8_t *)iphdr_ptr + IP6_HLEN;
631 while (*ptr != IP6_NEXTH_FRAGMENT) {
632 ptr += 8 * (1 + ptr[1]);
633 }
634 *ptr = ipr->nexth;
635 }
636  
637 /* release the resources allocated for the fragment queue entry */
638 if (reassdatagrams == ipr) {
639 /* it was the first in the list */
640 reassdatagrams = ipr->next;
641 } else {
642 /* it wasn't the first, so it must have a valid 'prev' */
643 LWIP_ASSERT("sanity check linked list", ipr_prev != NULL);
644 ipr_prev->next = ipr->next;
645 }
646 memp_free(MEMP_IP6_REASSDATA, ipr);
647  
648 /* adjust the number of pbufs currently queued for reassembly. */
649 clen = pbuf_clen(p);
650 LWIP_ASSERT("ip6_reass_pbufcount >= clen", ip6_reass_pbufcount >= clen);
651 ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - clen);
652  
653 /* Move pbuf back to IPv6 header. This should never fail. */
654 if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)iphdr_ptr))) {
655 LWIP_ASSERT("ip6_reass: moving p->payload to ip6 header failed\n", 0);
656 pbuf_free(p);
657 return NULL;
658 }
659  
660 /* Return the pbuf chain */
661 return p;
662 }
663 /* the datagram is not (yet?) reassembled completely */
664 return NULL;
665  
666 nullreturn:
667 IP6_FRAG_STATS_INC(ip6_frag.drop);
668 pbuf_free(p);
669 return NULL;
670 }
671  
672 #endif /* LWIP_IPV6 && LWIP_IPV6_REASS */
673  
674 #if LWIP_IPV6 && LWIP_IPV6_FRAG
675  
676 #if !LWIP_NETIF_TX_SINGLE_PBUF
677 /** Allocate a new struct pbuf_custom_ref */
678 static struct pbuf_custom_ref*
679 ip6_frag_alloc_pbuf_custom_ref(void)
680 {
681 return (struct pbuf_custom_ref*)memp_malloc(MEMP_FRAG_PBUF);
682 }
683  
684 /** Free a struct pbuf_custom_ref */
685 static void
686 ip6_frag_free_pbuf_custom_ref(struct pbuf_custom_ref* p)
687 {
688 LWIP_ASSERT("p != NULL", p != NULL);
689 memp_free(MEMP_FRAG_PBUF, p);
690 }
691  
692 /** Free-callback function to free a 'struct pbuf_custom_ref', called by
693 * pbuf_free. */
694 static void
695 ip6_frag_free_pbuf_custom(struct pbuf *p)
696 {
697 struct pbuf_custom_ref *pcr = (struct pbuf_custom_ref*)p;
698 LWIP_ASSERT("pcr != NULL", pcr != NULL);
699 LWIP_ASSERT("pcr == p", (void*)pcr == (void*)p);
700 if (pcr->original != NULL) {
701 pbuf_free(pcr->original);
702 }
703 ip6_frag_free_pbuf_custom_ref(pcr);
704 }
705 #endif /* !LWIP_NETIF_TX_SINGLE_PBUF */
706  
707 /**
708 * Fragment an IPv6 datagram if too large for the netif or path MTU.
709 *
710 * Chop the datagram in MTU sized chunks and send them in order
711 * by pointing PBUF_REFs into p
712 *
713 * @param p ipv6 packet to send
714 * @param netif the netif on which to send
715 * @param dest destination ipv6 address to which to send
716 *
717 * @return ERR_OK if sent successfully, err_t otherwise
718 */
719 err_t
720 ip6_frag(struct pbuf *p, struct netif *netif, const ip6_addr_t *dest)
721 {
722 struct ip6_hdr *original_ip6hdr;
723 struct ip6_hdr *ip6hdr;
724 struct ip6_frag_hdr *frag_hdr;
725 struct pbuf *rambuf;
726 #if !LWIP_NETIF_TX_SINGLE_PBUF
727 struct pbuf *newpbuf;
728 u16_t newpbuflen = 0;
729 u16_t left_to_copy;
730 #endif
731 static u32_t identification;
732 u16_t left, cop;
733 const u16_t mtu = nd6_get_destination_mtu(dest, netif);
734 const u16_t nfb = (u16_t)((mtu - (IP6_HLEN + IP6_FRAG_HLEN)) & IP6_FRAG_OFFSET_MASK);
735 u16_t fragment_offset = 0;
736 u16_t last;
737 u16_t poff = IP6_HLEN;
738  
739 identification++;
740  
741 original_ip6hdr = (struct ip6_hdr *)p->payload;
742  
743 /* @todo we assume there are no options in the unfragmentable part (IPv6 header). */
744 LWIP_ASSERT("p->tot_len >= IP6_HLEN", p->tot_len >= IP6_HLEN);
745 left = (u16_t)(p->tot_len - IP6_HLEN);
746  
747 while (left) {
748 last = (left <= nfb);
749  
750 /* Fill this fragment */
751 cop = last ? left : nfb;
752  
753 #if LWIP_NETIF_TX_SINGLE_PBUF
754 rambuf = pbuf_alloc(PBUF_IP, cop + IP6_FRAG_HLEN, PBUF_RAM);
755 if (rambuf == NULL) {
756 IP6_FRAG_STATS_INC(ip6_frag.memerr);
757 return ERR_MEM;
758 }
759 LWIP_ASSERT("this needs a pbuf in one piece!",
760 (rambuf->len == rambuf->tot_len) && (rambuf->next == NULL));
761 poff += pbuf_copy_partial(p, (u8_t*)rambuf->payload + IP6_FRAG_HLEN, cop, poff);
762 /* make room for the IP header */
763 if (pbuf_add_header(rambuf, IP6_HLEN)) {
764 pbuf_free(rambuf);
765 IP6_FRAG_STATS_INC(ip6_frag.memerr);
766 return ERR_MEM;
767 }
768 /* fill in the IP header */
769 SMEMCPY(rambuf->payload, original_ip6hdr, IP6_HLEN);
770 ip6hdr = (struct ip6_hdr *)rambuf->payload;
771 frag_hdr = (struct ip6_frag_hdr *)((u8_t*)rambuf->payload + IP6_HLEN);
772 #else
773 /* When not using a static buffer, create a chain of pbufs.
774 * The first will be a PBUF_RAM holding the link, IPv6, and Fragment header.
775 * The rest will be PBUF_REFs mirroring the pbuf chain to be fragged,
776 * but limited to the size of an mtu.
777 */
778 rambuf = pbuf_alloc(PBUF_LINK, IP6_HLEN + IP6_FRAG_HLEN, PBUF_RAM);
779 if (rambuf == NULL) {
780 IP6_FRAG_STATS_INC(ip6_frag.memerr);
781 return ERR_MEM;
782 }
783 LWIP_ASSERT("this needs a pbuf in one piece!",
784 (p->len >= (IP6_HLEN)));
785 SMEMCPY(rambuf->payload, original_ip6hdr, IP6_HLEN);
786 ip6hdr = (struct ip6_hdr *)rambuf->payload;
787 frag_hdr = (struct ip6_frag_hdr *)((u8_t*)rambuf->payload + IP6_HLEN);
788  
789 /* Can just adjust p directly for needed offset. */
790 p->payload = (u8_t *)p->payload + poff;
791 p->len = (u16_t)(p->len - poff);
792 p->tot_len = (u16_t)(p->tot_len - poff);
793  
794 left_to_copy = cop;
795 while (left_to_copy) {
796 struct pbuf_custom_ref *pcr;
797 newpbuflen = (left_to_copy < p->len) ? left_to_copy : p->len;
798 /* Is this pbuf already empty? */
799 if (!newpbuflen) {
800 p = p->next;
801 continue;
802 }
803 pcr = ip6_frag_alloc_pbuf_custom_ref();
804 if (pcr == NULL) {
805 pbuf_free(rambuf);
806 IP6_FRAG_STATS_INC(ip6_frag.memerr);
807 return ERR_MEM;
808 }
809 /* Mirror this pbuf, although we might not need all of it. */
810 newpbuf = pbuf_alloced_custom(PBUF_RAW, newpbuflen, PBUF_REF, &pcr->pc, p->payload, newpbuflen);
811 if (newpbuf == NULL) {
812 ip6_frag_free_pbuf_custom_ref(pcr);
813 pbuf_free(rambuf);
814 IP6_FRAG_STATS_INC(ip6_frag.memerr);
815 return ERR_MEM;
816 }
817 pbuf_ref(p);
818 pcr->original = p;
819 pcr->pc.custom_free_function = ip6_frag_free_pbuf_custom;
820  
821 /* Add it to end of rambuf's chain, but using pbuf_cat, not pbuf_chain
822 * so that it is removed when pbuf_dechain is later called on rambuf.
823 */
824 pbuf_cat(rambuf, newpbuf);
825 left_to_copy = (u16_t)(left_to_copy - newpbuflen);
826 if (left_to_copy) {
827 p = p->next;
828 }
829 }
830 poff = newpbuflen;
831 #endif /* LWIP_NETIF_TX_SINGLE_PBUF */
832  
833 /* Set headers */
834 frag_hdr->_nexth = original_ip6hdr->_nexth;
835 frag_hdr->reserved = 0;
836 frag_hdr->_fragment_offset = lwip_htons((u16_t)((fragment_offset & IP6_FRAG_OFFSET_MASK) | (last ? 0 : IP6_FRAG_MORE_FLAG)));
837 frag_hdr->_identification = lwip_htonl(identification);
838  
839 IP6H_NEXTH_SET(ip6hdr, IP6_NEXTH_FRAGMENT);
840 IP6H_PLEN_SET(ip6hdr, (u16_t)(cop + IP6_FRAG_HLEN));
841  
842 /* No need for separate header pbuf - we allowed room for it in rambuf
843 * when allocated.
844 */
845 IP6_FRAG_STATS_INC(ip6_frag.xmit);
846 netif->output_ip6(netif, rambuf, dest);
847  
848 /* Unfortunately we can't reuse rambuf - the hardware may still be
849 * using the buffer. Instead we free it (and the ensuing chain) and
850 * recreate it next time round the loop. If we're lucky the hardware
851 * will have already sent the packet, the free will really free, and
852 * there will be zero memory penalty.
853 */
854  
855 pbuf_free(rambuf);
856 left = (u16_t)(left - cop);
857 fragment_offset = (u16_t)(fragment_offset + cop);
858 }
859 return ERR_OK;
860 }
861  
862 #endif /* LWIP_IPV6 && LWIP_IPV6_FRAG */