[457] | 1 | /**
|
---|
| 2 | * @file
|
---|
| 3 | *
|
---|
| 4 | * IPv6 fragmentation and reassembly.
|
---|
| 5 | */
|
---|
| 6 |
|
---|
| 7 | /*
|
---|
| 8 | * Copyright (c) 2010 Inico Technologies Ltd.
|
---|
| 9 | * All rights reserved.
|
---|
| 10 | *
|
---|
| 11 | * Redistribution and use in source and binary forms, with or without modification,
|
---|
| 12 | * are permitted provided that the following conditions are met:
|
---|
| 13 | *
|
---|
| 14 | * 1. Redistributions of source code must retain the above copyright notice,
|
---|
| 15 | * this list of conditions and the following disclaimer.
|
---|
| 16 | * 2. Redistributions in binary form must reproduce the above copyright notice,
|
---|
| 17 | * this list of conditions and the following disclaimer in the documentation
|
---|
| 18 | * and/or other materials provided with the distribution.
|
---|
| 19 | * 3. The name of the author may not be used to endorse or promote products
|
---|
| 20 | * derived from this software without specific prior written permission.
|
---|
| 21 | *
|
---|
| 22 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
|
---|
| 23 | * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
---|
| 24 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
|
---|
| 25 | * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
---|
| 26 | * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
---|
| 27 | * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
---|
| 28 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
---|
| 29 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
|
---|
| 30 | * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
|
---|
| 31 | * OF SUCH DAMAGE.
|
---|
| 32 | *
|
---|
| 33 | * This file is part of the lwIP TCP/IP stack.
|
---|
| 34 | *
|
---|
| 35 | * Author: Ivan Delamer <delamer@inicotech.com>
|
---|
| 36 | *
|
---|
| 37 | *
|
---|
| 38 | * Please coordinate changes and requests with Ivan Delamer
|
---|
| 39 | * <delamer@inicotech.com>
|
---|
| 40 | */
|
---|
| 41 |
|
---|
| 42 | #include "lwip/opt.h"
|
---|
| 43 | #include "lwip/ip6_frag.h"
|
---|
| 44 | #include "lwip/ip6.h"
|
---|
| 45 | #include "lwip/icmp6.h"
|
---|
| 46 | #include "lwip/nd6.h"
|
---|
| 47 | #include "lwip/ip.h"
|
---|
| 48 |
|
---|
| 49 | #include "lwip/pbuf.h"
|
---|
| 50 | #include "lwip/memp.h"
|
---|
| 51 | #include "lwip/stats.h"
|
---|
| 52 |
|
---|
| 53 | #include <string.h>
|
---|
| 54 |
|
---|
| 55 | #if LWIP_IPV6 && LWIP_IPV6_REASS /* don't build if not configured for use in lwipopts.h */
|
---|
| 56 |
|
---|
| 57 |
|
---|
| 58 | /** Setting this to 0, you can turn off checking the fragments for overlapping
|
---|
| 59 | * regions. The code gets a little smaller. Only use this if you know that
|
---|
| 60 | * overlapping won't occur on your network! */
|
---|
| 61 | #ifndef IP_REASS_CHECK_OVERLAP
|
---|
| 62 | #define IP_REASS_CHECK_OVERLAP 1
|
---|
| 63 | #endif /* IP_REASS_CHECK_OVERLAP */
|
---|
| 64 |
|
---|
| 65 | /** Set to 0 to prevent freeing the oldest datagram when the reassembly buffer is
|
---|
| 66 | * full (IP_REASS_MAX_PBUFS pbufs are enqueued). The code gets a little smaller.
|
---|
| 67 | * Datagrams will be freed by timeout only. Especially useful when MEMP_NUM_REASSDATA
|
---|
| 68 | * is set to 1, so one datagram can be reassembled at a time, only. */
|
---|
| 69 | #ifndef IP_REASS_FREE_OLDEST
|
---|
| 70 | #define IP_REASS_FREE_OLDEST 1
|
---|
| 71 | #endif /* IP_REASS_FREE_OLDEST */
|
---|
| 72 |
|
---|
| 73 | #if IPV6_FRAG_COPYHEADER
|
---|
| 74 | /* The number of bytes we need to "borrow" from (i.e., overwrite in) the header
|
---|
| 75 | * that precedes the fragment header for reassembly pruposes. */
|
---|
| 76 | #define IPV6_FRAG_REQROOM ((s16_t)(sizeof(struct ip6_reass_helper) - IP6_FRAG_HLEN))
|
---|
| 77 | #endif
|
---|
| 78 |
|
---|
| 79 | #define IP_REASS_FLAG_LASTFRAG 0x01
|
---|
| 80 |
|
---|
| 81 | /** This is a helper struct which holds the starting
|
---|
| 82 | * offset and the ending offset of this fragment to
|
---|
| 83 | * easily chain the fragments.
|
---|
| 84 | * It has the same packing requirements as the IPv6 header, since it replaces
|
---|
| 85 | * the Fragment Header in memory in incoming fragments to keep
|
---|
| 86 | * track of the various fragments.
|
---|
| 87 | */
|
---|
| 88 | #ifdef PACK_STRUCT_USE_INCLUDES
|
---|
| 89 | # include "arch/bpstruct.h"
|
---|
| 90 | #endif
|
---|
| 91 | PACK_STRUCT_BEGIN
|
---|
| 92 | struct ip6_reass_helper {
|
---|
| 93 | PACK_STRUCT_FIELD(struct pbuf *next_pbuf);
|
---|
| 94 | PACK_STRUCT_FIELD(u16_t start);
|
---|
| 95 | PACK_STRUCT_FIELD(u16_t end);
|
---|
| 96 | } PACK_STRUCT_STRUCT;
|
---|
| 97 | PACK_STRUCT_END
|
---|
| 98 | #ifdef PACK_STRUCT_USE_INCLUDES
|
---|
| 99 | # include "arch/epstruct.h"
|
---|
| 100 | #endif
|
---|
| 101 |
|
---|
| 102 | /* static variables */
|
---|
| 103 | static struct ip6_reassdata *reassdatagrams;
|
---|
| 104 | static u16_t ip6_reass_pbufcount;
|
---|
| 105 |
|
---|
| 106 | /* Forward declarations. */
|
---|
| 107 | static void ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr);
|
---|
| 108 | #if IP_REASS_FREE_OLDEST
|
---|
| 109 | static void ip6_reass_remove_oldest_datagram(struct ip6_reassdata *ipr, int pbufs_needed);
|
---|
| 110 | #endif /* IP_REASS_FREE_OLDEST */
|
---|
| 111 |
|
---|
| 112 | void
|
---|
| 113 | ip6_reass_tmr(void)
|
---|
| 114 | {
|
---|
| 115 | struct ip6_reassdata *r, *tmp;
|
---|
| 116 |
|
---|
| 117 | #if !IPV6_FRAG_COPYHEADER
|
---|
| 118 | LWIP_ASSERT("sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN, set IPV6_FRAG_COPYHEADER to 1",
|
---|
| 119 | sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN);
|
---|
| 120 | #endif /* !IPV6_FRAG_COPYHEADER */
|
---|
| 121 |
|
---|
| 122 | r = reassdatagrams;
|
---|
| 123 | while (r != NULL) {
|
---|
| 124 | /* Decrement the timer. Once it reaches 0,
|
---|
| 125 | * clean up the incomplete fragment assembly */
|
---|
| 126 | if (r->timer > 0) {
|
---|
| 127 | r->timer--;
|
---|
| 128 | r = r->next;
|
---|
| 129 | } else {
|
---|
| 130 | /* reassembly timed out */
|
---|
| 131 | tmp = r;
|
---|
| 132 | /* get the next pointer before freeing */
|
---|
| 133 | r = r->next;
|
---|
| 134 | /* free the helper struct and all enqueued pbufs */
|
---|
| 135 | ip6_reass_free_complete_datagram(tmp);
|
---|
| 136 | }
|
---|
| 137 | }
|
---|
| 138 | }
|
---|
| 139 |
|
---|
| 140 | /**
|
---|
| 141 | * Free a datagram (struct ip6_reassdata) and all its pbufs.
|
---|
| 142 | * Updates the total count of enqueued pbufs (ip6_reass_pbufcount),
|
---|
| 143 | * sends an ICMP time exceeded packet.
|
---|
| 144 | *
|
---|
| 145 | * @param ipr datagram to free
|
---|
| 146 | */
|
---|
| 147 | static void
|
---|
| 148 | ip6_reass_free_complete_datagram(struct ip6_reassdata *ipr)
|
---|
| 149 | {
|
---|
| 150 | struct ip6_reassdata *prev;
|
---|
| 151 | u16_t pbufs_freed = 0;
|
---|
| 152 | u16_t clen;
|
---|
| 153 | struct pbuf *p;
|
---|
| 154 | struct ip6_reass_helper *iprh;
|
---|
| 155 |
|
---|
| 156 | #if LWIP_ICMP6
|
---|
| 157 | iprh = (struct ip6_reass_helper *)ipr->p->payload;
|
---|
| 158 | if (iprh->start == 0) {
|
---|
| 159 | /* The first fragment was received, send ICMP time exceeded. */
|
---|
| 160 | /* First, de-queue the first pbuf from r->p. */
|
---|
| 161 | p = ipr->p;
|
---|
| 162 | ipr->p = iprh->next_pbuf;
|
---|
| 163 | /* Restore the part that we've overwritten with our helper structure, or we
|
---|
| 164 | * might send garbage (and disclose a pointer) in the ICMPv6 reply. */
|
---|
| 165 | MEMCPY(p->payload, ipr->orig_hdr, sizeof(iprh));
|
---|
| 166 | /* Then, move back to the original ipv6 header (we are now pointing to Fragment header).
|
---|
| 167 | This cannot fail since we already checked when receiving this fragment. */
|
---|
| 168 | if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr))) {
|
---|
| 169 | LWIP_ASSERT("ip6_reass_free: moving p->payload to ip6 header failed\n", 0);
|
---|
| 170 | }
|
---|
| 171 | else {
|
---|
| 172 | /* Reconstruct the zoned source and destination addresses, so that we do
|
---|
| 173 | * not end up sending the ICMP response over the wrong link. */
|
---|
| 174 | ip6_addr_t src_addr, dest_addr;
|
---|
| 175 | ip6_addr_copy_from_packed(src_addr, IPV6_FRAG_SRC(ipr));
|
---|
| 176 | ip6_addr_set_zone(&src_addr, ipr->src_zone);
|
---|
| 177 | ip6_addr_copy_from_packed(dest_addr, IPV6_FRAG_DEST(ipr));
|
---|
| 178 | ip6_addr_set_zone(&dest_addr, ipr->dest_zone);
|
---|
| 179 | /* Send the actual ICMP response. */
|
---|
| 180 | icmp6_time_exceeded_with_addrs(p, ICMP6_TE_FRAG, &src_addr, &dest_addr);
|
---|
| 181 | }
|
---|
| 182 | clen = pbuf_clen(p);
|
---|
| 183 | LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
|
---|
| 184 | pbufs_freed = (u16_t)(pbufs_freed + clen);
|
---|
| 185 | pbuf_free(p);
|
---|
| 186 | }
|
---|
| 187 | #endif /* LWIP_ICMP6 */
|
---|
| 188 |
|
---|
| 189 | /* First, free all received pbufs. The individual pbufs need to be released
|
---|
| 190 | separately as they have not yet been chained */
|
---|
| 191 | p = ipr->p;
|
---|
| 192 | while (p != NULL) {
|
---|
| 193 | struct pbuf *pcur;
|
---|
| 194 | iprh = (struct ip6_reass_helper *)p->payload;
|
---|
| 195 | pcur = p;
|
---|
| 196 | /* get the next pointer before freeing */
|
---|
| 197 | p = iprh->next_pbuf;
|
---|
| 198 | clen = pbuf_clen(pcur);
|
---|
| 199 | LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
|
---|
| 200 | pbufs_freed = (u16_t)(pbufs_freed + clen);
|
---|
| 201 | pbuf_free(pcur);
|
---|
| 202 | }
|
---|
| 203 |
|
---|
| 204 | /* Then, unchain the struct ip6_reassdata from the list and free it. */
|
---|
| 205 | if (ipr == reassdatagrams) {
|
---|
| 206 | reassdatagrams = ipr->next;
|
---|
| 207 | } else {
|
---|
| 208 | prev = reassdatagrams;
|
---|
| 209 | while (prev != NULL) {
|
---|
| 210 | if (prev->next == ipr) {
|
---|
| 211 | break;
|
---|
| 212 | }
|
---|
| 213 | prev = prev->next;
|
---|
| 214 | }
|
---|
| 215 | if (prev != NULL) {
|
---|
| 216 | prev->next = ipr->next;
|
---|
| 217 | }
|
---|
| 218 | }
|
---|
| 219 | memp_free(MEMP_IP6_REASSDATA, ipr);
|
---|
| 220 |
|
---|
| 221 | /* Finally, update number of pbufs in reassembly queue */
|
---|
| 222 | LWIP_ASSERT("ip_reass_pbufcount >= clen", ip6_reass_pbufcount >= pbufs_freed);
|
---|
| 223 | ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - pbufs_freed);
|
---|
| 224 | }
|
---|
| 225 |
|
---|
| 226 | #if IP_REASS_FREE_OLDEST
|
---|
| 227 | /**
|
---|
| 228 | * Free the oldest datagram to make room for enqueueing new fragments.
|
---|
| 229 | * The datagram ipr is not freed!
|
---|
| 230 | *
|
---|
| 231 | * @param ipr ip6_reassdata for the current fragment
|
---|
| 232 | * @param pbufs_needed number of pbufs needed to enqueue
|
---|
| 233 | * (used for freeing other datagrams if not enough space)
|
---|
| 234 | */
|
---|
| 235 | static void
|
---|
| 236 | ip6_reass_remove_oldest_datagram(struct ip6_reassdata *ipr, int pbufs_needed)
|
---|
| 237 | {
|
---|
| 238 | struct ip6_reassdata *r, *oldest;
|
---|
| 239 |
|
---|
| 240 | /* Free datagrams until being allowed to enqueue 'pbufs_needed' pbufs,
|
---|
| 241 | * but don't free the current datagram! */
|
---|
| 242 | do {
|
---|
| 243 | r = oldest = reassdatagrams;
|
---|
| 244 | while (r != NULL) {
|
---|
| 245 | if (r != ipr) {
|
---|
| 246 | if (r->timer <= oldest->timer) {
|
---|
| 247 | /* older than the previous oldest */
|
---|
| 248 | oldest = r;
|
---|
| 249 | }
|
---|
| 250 | }
|
---|
| 251 | r = r->next;
|
---|
| 252 | }
|
---|
| 253 | if (oldest == ipr) {
|
---|
| 254 | /* nothing to free, ipr is the only element on the list */
|
---|
| 255 | return;
|
---|
| 256 | }
|
---|
| 257 | if (oldest != NULL) {
|
---|
| 258 | ip6_reass_free_complete_datagram(oldest);
|
---|
| 259 | }
|
---|
| 260 | } while (((ip6_reass_pbufcount + pbufs_needed) > IP_REASS_MAX_PBUFS) && (reassdatagrams != NULL));
|
---|
| 261 | }
|
---|
| 262 | #endif /* IP_REASS_FREE_OLDEST */
|
---|
| 263 |
|
---|
| 264 | /**
|
---|
| 265 | * Reassembles incoming IPv6 fragments into an IPv6 datagram.
|
---|
| 266 | *
|
---|
| 267 | * @param p points to the IPv6 Fragment Header
|
---|
| 268 | * @return NULL if reassembly is incomplete, pbuf pointing to
|
---|
| 269 | * IPv6 Header if reassembly is complete
|
---|
| 270 | */
|
---|
| 271 | struct pbuf *
|
---|
| 272 | ip6_reass(struct pbuf *p)
|
---|
| 273 | {
|
---|
| 274 | struct ip6_reassdata *ipr, *ipr_prev;
|
---|
| 275 | struct ip6_reass_helper *iprh, *iprh_tmp, *iprh_prev=NULL;
|
---|
| 276 | struct ip6_frag_hdr *frag_hdr;
|
---|
| 277 | u16_t offset, len, start, end;
|
---|
| 278 | ptrdiff_t hdrdiff;
|
---|
| 279 | u16_t clen;
|
---|
| 280 | u8_t valid = 1;
|
---|
| 281 | struct pbuf *q, *next_pbuf;
|
---|
| 282 |
|
---|
| 283 | IP6_FRAG_STATS_INC(ip6_frag.recv);
|
---|
| 284 |
|
---|
| 285 | /* ip6_frag_hdr must be in the first pbuf, not chained. Checked by caller. */
|
---|
| 286 | LWIP_ASSERT("IPv6 fragment header does not fit in first pbuf",
|
---|
| 287 | p->len >= sizeof(struct ip6_frag_hdr));
|
---|
| 288 |
|
---|
| 289 | frag_hdr = (struct ip6_frag_hdr *) p->payload;
|
---|
| 290 |
|
---|
| 291 | clen = pbuf_clen(p);
|
---|
| 292 |
|
---|
| 293 | offset = lwip_ntohs(frag_hdr->_fragment_offset);
|
---|
| 294 |
|
---|
| 295 | /* Calculate fragment length from IPv6 payload length.
|
---|
| 296 | * Adjust for headers before Fragment Header.
|
---|
| 297 | * And finally adjust by Fragment Header length. */
|
---|
| 298 | len = lwip_ntohs(ip6_current_header()->_plen);
|
---|
| 299 | hdrdiff = (u8_t*)p->payload - (const u8_t*)ip6_current_header();
|
---|
| 300 | LWIP_ASSERT("not a valid pbuf (ip6_input check missing?)", hdrdiff <= 0xFFFF);
|
---|
| 301 | LWIP_ASSERT("not a valid pbuf (ip6_input check missing?)", hdrdiff >= IP6_HLEN);
|
---|
| 302 | hdrdiff -= IP6_HLEN;
|
---|
| 303 | hdrdiff += IP6_FRAG_HLEN;
|
---|
| 304 | if (hdrdiff > len) {
|
---|
| 305 | IP6_FRAG_STATS_INC(ip6_frag.proterr);
|
---|
| 306 | goto nullreturn;
|
---|
| 307 | }
|
---|
| 308 | len = (u16_t)(len - hdrdiff);
|
---|
| 309 | start = (offset & IP6_FRAG_OFFSET_MASK);
|
---|
| 310 | if (start > (0xFFFF - len)) {
|
---|
| 311 | /* u16_t overflow, cannot handle this */
|
---|
| 312 | IP6_FRAG_STATS_INC(ip6_frag.proterr);
|
---|
| 313 | goto nullreturn;
|
---|
| 314 | }
|
---|
| 315 |
|
---|
| 316 | /* Look for the datagram the fragment belongs to in the current datagram queue,
|
---|
| 317 | * remembering the previous in the queue for later dequeueing. */
|
---|
| 318 | for (ipr = reassdatagrams, ipr_prev = NULL; ipr != NULL; ipr = ipr->next) {
|
---|
| 319 | /* Check if the incoming fragment matches the one currently present
|
---|
| 320 | in the reassembly buffer. If so, we proceed with copying the
|
---|
| 321 | fragment into the buffer. */
|
---|
| 322 | if ((frag_hdr->_identification == ipr->identification) &&
|
---|
| 323 | ip6_addr_cmp_packed(ip6_current_src_addr(), &(IPV6_FRAG_SRC(ipr)), ipr->src_zone) &&
|
---|
| 324 | ip6_addr_cmp_packed(ip6_current_dest_addr(), &(IPV6_FRAG_DEST(ipr)), ipr->dest_zone)) {
|
---|
| 325 | IP6_FRAG_STATS_INC(ip6_frag.cachehit);
|
---|
| 326 | break;
|
---|
| 327 | }
|
---|
| 328 | ipr_prev = ipr;
|
---|
| 329 | }
|
---|
| 330 |
|
---|
| 331 | if (ipr == NULL) {
|
---|
| 332 | /* Enqueue a new datagram into the datagram queue */
|
---|
| 333 | ipr = (struct ip6_reassdata *)memp_malloc(MEMP_IP6_REASSDATA);
|
---|
| 334 | if (ipr == NULL) {
|
---|
| 335 | #if IP_REASS_FREE_OLDEST
|
---|
| 336 | /* Make room and try again. */
|
---|
| 337 | ip6_reass_remove_oldest_datagram(ipr, clen);
|
---|
| 338 | ipr = (struct ip6_reassdata *)memp_malloc(MEMP_IP6_REASSDATA);
|
---|
| 339 | if (ipr != NULL) {
|
---|
| 340 | /* re-search ipr_prev since it might have been removed */
|
---|
| 341 | for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr_prev = ipr_prev->next) {
|
---|
| 342 | if (ipr_prev->next == ipr) {
|
---|
| 343 | break;
|
---|
| 344 | }
|
---|
| 345 | }
|
---|
| 346 | } else
|
---|
| 347 | #endif /* IP_REASS_FREE_OLDEST */
|
---|
| 348 | {
|
---|
| 349 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 350 | goto nullreturn;
|
---|
| 351 | }
|
---|
| 352 | }
|
---|
| 353 |
|
---|
| 354 | memset(ipr, 0, sizeof(struct ip6_reassdata));
|
---|
| 355 | ipr->timer = IPV6_REASS_MAXAGE;
|
---|
| 356 |
|
---|
| 357 | /* enqueue the new structure to the front of the list */
|
---|
| 358 | ipr->next = reassdatagrams;
|
---|
| 359 | reassdatagrams = ipr;
|
---|
| 360 |
|
---|
| 361 | /* Use the current IPv6 header for src/dest address reference.
|
---|
| 362 | * Eventually, we will replace it when we get the first fragment
|
---|
| 363 | * (it might be this one, in any case, it is done later). */
|
---|
| 364 | /* need to use the none-const pointer here: */
|
---|
| 365 | ipr->iphdr = ip_data.current_ip6_header;
|
---|
| 366 | #if IPV6_FRAG_COPYHEADER
|
---|
| 367 | MEMCPY(&ipr->src, &ip6_current_header()->src, sizeof(ipr->src));
|
---|
| 368 | MEMCPY(&ipr->dest, &ip6_current_header()->dest, sizeof(ipr->dest));
|
---|
| 369 | #endif /* IPV6_FRAG_COPYHEADER */
|
---|
| 370 | #if LWIP_IPV6_SCOPES
|
---|
| 371 | /* Also store the address zone information.
|
---|
| 372 | * @todo It is possible that due to netif destruction and recreation, the
|
---|
| 373 | * stored zones end up resolving to a different interface. In that case, we
|
---|
| 374 | * risk sending a "time exceeded" ICMP response over the wrong link.
|
---|
| 375 | * Ideally, netif destruction would clean up matching pending reassembly
|
---|
| 376 | * structures, but custom zone mappings would make that non-trivial. */
|
---|
| 377 | ipr->src_zone = ip6_addr_zone(ip6_current_src_addr());
|
---|
| 378 | ipr->dest_zone = ip6_addr_zone(ip6_current_dest_addr());
|
---|
| 379 | #endif /* LWIP_IPV6_SCOPES */
|
---|
| 380 | /* copy the fragmented packet id. */
|
---|
| 381 | ipr->identification = frag_hdr->_identification;
|
---|
| 382 |
|
---|
| 383 | /* copy the nexth field */
|
---|
| 384 | ipr->nexth = frag_hdr->_nexth;
|
---|
| 385 | }
|
---|
| 386 |
|
---|
| 387 | /* Check if we are allowed to enqueue more datagrams. */
|
---|
| 388 | if ((ip6_reass_pbufcount + clen) > IP_REASS_MAX_PBUFS) {
|
---|
| 389 | #if IP_REASS_FREE_OLDEST
|
---|
| 390 | ip6_reass_remove_oldest_datagram(ipr, clen);
|
---|
| 391 | if ((ip6_reass_pbufcount + clen) <= IP_REASS_MAX_PBUFS) {
|
---|
| 392 | /* re-search ipr_prev since it might have been removed */
|
---|
| 393 | for (ipr_prev = reassdatagrams; ipr_prev != NULL; ipr_prev = ipr_prev->next) {
|
---|
| 394 | if (ipr_prev->next == ipr) {
|
---|
| 395 | break;
|
---|
| 396 | }
|
---|
| 397 | }
|
---|
| 398 | } else
|
---|
| 399 | #endif /* IP_REASS_FREE_OLDEST */
|
---|
| 400 | {
|
---|
| 401 | /* @todo: send ICMPv6 time exceeded here? */
|
---|
| 402 | /* drop this pbuf */
|
---|
| 403 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 404 | goto nullreturn;
|
---|
| 405 | }
|
---|
| 406 | }
|
---|
| 407 |
|
---|
| 408 | /* Overwrite Fragment Header with our own helper struct. */
|
---|
| 409 | #if IPV6_FRAG_COPYHEADER
|
---|
| 410 | if (IPV6_FRAG_REQROOM > 0) {
|
---|
| 411 | /* Make room for struct ip6_reass_helper (only required if sizeof(void*) > 4).
|
---|
| 412 | This cannot fail since we already checked when receiving this fragment. */
|
---|
| 413 | u8_t hdrerr = pbuf_header_force(p, IPV6_FRAG_REQROOM);
|
---|
| 414 | LWIP_UNUSED_ARG(hdrerr); /* in case of LWIP_NOASSERT */
|
---|
| 415 | LWIP_ASSERT("no room for struct ip6_reass_helper", hdrerr == 0);
|
---|
| 416 | }
|
---|
| 417 | #else /* IPV6_FRAG_COPYHEADER */
|
---|
| 418 | LWIP_ASSERT("sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN, set IPV6_FRAG_COPYHEADER to 1",
|
---|
| 419 | sizeof(struct ip6_reass_helper) <= IP6_FRAG_HLEN);
|
---|
| 420 | #endif /* IPV6_FRAG_COPYHEADER */
|
---|
| 421 |
|
---|
| 422 | /* Prepare the pointer to the helper structure, and its initial values.
|
---|
| 423 | * Do not yet write to the structure itself, as we still have to make a
|
---|
| 424 | * backup of the original data, and we should not do that until we know for
|
---|
| 425 | * sure that we are going to add this packet to the list. */
|
---|
| 426 | iprh = (struct ip6_reass_helper *)p->payload;
|
---|
| 427 | next_pbuf = NULL;
|
---|
| 428 | end = (u16_t)(start + len);
|
---|
| 429 |
|
---|
| 430 | /* find the right place to insert this pbuf */
|
---|
| 431 | /* Iterate through until we either get to the end of the list (append),
|
---|
| 432 | * or we find on with a larger offset (insert). */
|
---|
| 433 | for (q = ipr->p; q != NULL;) {
|
---|
| 434 | iprh_tmp = (struct ip6_reass_helper*)q->payload;
|
---|
| 435 | if (start < iprh_tmp->start) {
|
---|
| 436 | #if IP_REASS_CHECK_OVERLAP
|
---|
| 437 | if (end > iprh_tmp->start) {
|
---|
| 438 | /* fragment overlaps with following, throw away */
|
---|
| 439 | IP6_FRAG_STATS_INC(ip6_frag.proterr);
|
---|
| 440 | goto nullreturn;
|
---|
| 441 | }
|
---|
| 442 | if (iprh_prev != NULL) {
|
---|
| 443 | if (start < iprh_prev->end) {
|
---|
| 444 | /* fragment overlaps with previous, throw away */
|
---|
| 445 | IP6_FRAG_STATS_INC(ip6_frag.proterr);
|
---|
| 446 | goto nullreturn;
|
---|
| 447 | }
|
---|
| 448 | }
|
---|
| 449 | #endif /* IP_REASS_CHECK_OVERLAP */
|
---|
| 450 | /* the new pbuf should be inserted before this */
|
---|
| 451 | next_pbuf = q;
|
---|
| 452 | if (iprh_prev != NULL) {
|
---|
| 453 | /* not the fragment with the lowest offset */
|
---|
| 454 | iprh_prev->next_pbuf = p;
|
---|
| 455 | } else {
|
---|
| 456 | /* fragment with the lowest offset */
|
---|
| 457 | ipr->p = p;
|
---|
| 458 | }
|
---|
| 459 | break;
|
---|
| 460 | } else if (start == iprh_tmp->start) {
|
---|
| 461 | /* received the same datagram twice: no need to keep the datagram */
|
---|
| 462 | goto nullreturn;
|
---|
| 463 | #if IP_REASS_CHECK_OVERLAP
|
---|
| 464 | } else if (start < iprh_tmp->end) {
|
---|
| 465 | /* overlap: no need to keep the new datagram */
|
---|
| 466 | IP6_FRAG_STATS_INC(ip6_frag.proterr);
|
---|
| 467 | goto nullreturn;
|
---|
| 468 | #endif /* IP_REASS_CHECK_OVERLAP */
|
---|
| 469 | } else {
|
---|
| 470 | /* Check if the fragments received so far have no gaps. */
|
---|
| 471 | if (iprh_prev != NULL) {
|
---|
| 472 | if (iprh_prev->end != iprh_tmp->start) {
|
---|
| 473 | /* There is a fragment missing between the current
|
---|
| 474 | * and the previous fragment */
|
---|
| 475 | valid = 0;
|
---|
| 476 | }
|
---|
| 477 | }
|
---|
| 478 | }
|
---|
| 479 | q = iprh_tmp->next_pbuf;
|
---|
| 480 | iprh_prev = iprh_tmp;
|
---|
| 481 | }
|
---|
| 482 |
|
---|
| 483 | /* If q is NULL, then we made it to the end of the list. Determine what to do now */
|
---|
| 484 | if (q == NULL) {
|
---|
| 485 | if (iprh_prev != NULL) {
|
---|
| 486 | /* this is (for now), the fragment with the highest offset:
|
---|
| 487 | * chain it to the last fragment */
|
---|
| 488 | #if IP_REASS_CHECK_OVERLAP
|
---|
| 489 | LWIP_ASSERT("check fragments don't overlap", iprh_prev->end <= start);
|
---|
| 490 | #endif /* IP_REASS_CHECK_OVERLAP */
|
---|
| 491 | iprh_prev->next_pbuf = p;
|
---|
| 492 | if (iprh_prev->end != start) {
|
---|
| 493 | valid = 0;
|
---|
| 494 | }
|
---|
| 495 | } else {
|
---|
| 496 | #if IP_REASS_CHECK_OVERLAP
|
---|
| 497 | LWIP_ASSERT("no previous fragment, this must be the first fragment!",
|
---|
| 498 | ipr->p == NULL);
|
---|
| 499 | #endif /* IP_REASS_CHECK_OVERLAP */
|
---|
| 500 | /* this is the first fragment we ever received for this ip datagram */
|
---|
| 501 | ipr->p = p;
|
---|
| 502 | }
|
---|
| 503 | }
|
---|
| 504 |
|
---|
| 505 | /* Track the current number of pbufs current 'in-flight', in order to limit
|
---|
| 506 | the number of fragments that may be enqueued at any one time */
|
---|
| 507 | ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount + clen);
|
---|
| 508 |
|
---|
| 509 | /* Remember IPv6 header if this is the first fragment. */
|
---|
| 510 | if (start == 0) {
|
---|
| 511 | /* need to use the none-const pointer here: */
|
---|
| 512 | ipr->iphdr = ip_data.current_ip6_header;
|
---|
| 513 | /* Make a backup of the part of the packet data that we are about to
|
---|
| 514 | * overwrite, so that we can restore the original later. */
|
---|
| 515 | MEMCPY(ipr->orig_hdr, p->payload, sizeof(*iprh));
|
---|
| 516 | /* For IPV6_FRAG_COPYHEADER there is no need to copy src/dst again, as they
|
---|
| 517 | * will be the same as they were. With LWIP_IPV6_SCOPES, the same applies
|
---|
| 518 | * to the source/destination zones. */
|
---|
| 519 | }
|
---|
| 520 | /* Only after the backup do we get to fill in the actual helper structure. */
|
---|
| 521 | iprh->next_pbuf = next_pbuf;
|
---|
| 522 | iprh->start = start;
|
---|
| 523 | iprh->end = end;
|
---|
| 524 |
|
---|
| 525 | /* If this is the last fragment, calculate total packet length. */
|
---|
| 526 | if ((offset & IP6_FRAG_MORE_FLAG) == 0) {
|
---|
| 527 | ipr->datagram_len = iprh->end;
|
---|
| 528 | }
|
---|
| 529 |
|
---|
| 530 | /* Additional validity tests: we have received first and last fragment. */
|
---|
| 531 | iprh_tmp = (struct ip6_reass_helper*)ipr->p->payload;
|
---|
| 532 | if (iprh_tmp->start != 0) {
|
---|
| 533 | valid = 0;
|
---|
| 534 | }
|
---|
| 535 | if (ipr->datagram_len == 0) {
|
---|
| 536 | valid = 0;
|
---|
| 537 | }
|
---|
| 538 |
|
---|
| 539 | /* Final validity test: no gaps between current and last fragment. */
|
---|
| 540 | iprh_prev = iprh;
|
---|
| 541 | q = iprh->next_pbuf;
|
---|
| 542 | while ((q != NULL) && valid) {
|
---|
| 543 | iprh = (struct ip6_reass_helper*)q->payload;
|
---|
| 544 | if (iprh_prev->end != iprh->start) {
|
---|
| 545 | valid = 0;
|
---|
| 546 | break;
|
---|
| 547 | }
|
---|
| 548 | iprh_prev = iprh;
|
---|
| 549 | q = iprh->next_pbuf;
|
---|
| 550 | }
|
---|
| 551 |
|
---|
| 552 | if (valid) {
|
---|
| 553 | /* All fragments have been received */
|
---|
| 554 | struct ip6_hdr* iphdr_ptr;
|
---|
| 555 |
|
---|
| 556 | /* chain together the pbufs contained within the ip6_reassdata list. */
|
---|
| 557 | iprh = (struct ip6_reass_helper*) ipr->p->payload;
|
---|
| 558 | while (iprh != NULL) {
|
---|
| 559 | next_pbuf = iprh->next_pbuf;
|
---|
| 560 | if (next_pbuf != NULL) {
|
---|
| 561 | /* Save next helper struct (will be hidden in next step). */
|
---|
| 562 | iprh_tmp = (struct ip6_reass_helper*)next_pbuf->payload;
|
---|
| 563 |
|
---|
| 564 | /* hide the fragment header for every succeeding fragment */
|
---|
| 565 | pbuf_remove_header(next_pbuf, IP6_FRAG_HLEN);
|
---|
| 566 | #if IPV6_FRAG_COPYHEADER
|
---|
| 567 | if (IPV6_FRAG_REQROOM > 0) {
|
---|
| 568 | /* hide the extra bytes borrowed from ip6_hdr for struct ip6_reass_helper */
|
---|
| 569 | u8_t hdrerr = pbuf_remove_header(next_pbuf, IPV6_FRAG_REQROOM);
|
---|
| 570 | LWIP_UNUSED_ARG(hdrerr); /* in case of LWIP_NOASSERT */
|
---|
| 571 | LWIP_ASSERT("no room for struct ip6_reass_helper", hdrerr == 0);
|
---|
| 572 | }
|
---|
| 573 | #endif
|
---|
| 574 | pbuf_cat(ipr->p, next_pbuf);
|
---|
| 575 | }
|
---|
| 576 | else {
|
---|
| 577 | iprh_tmp = NULL;
|
---|
| 578 | }
|
---|
| 579 |
|
---|
| 580 | iprh = iprh_tmp;
|
---|
| 581 | }
|
---|
| 582 |
|
---|
| 583 | /* Get the first pbuf. */
|
---|
| 584 | p = ipr->p;
|
---|
| 585 |
|
---|
| 586 | #if IPV6_FRAG_COPYHEADER
|
---|
| 587 | if (IPV6_FRAG_REQROOM > 0) {
|
---|
| 588 | u8_t hdrerr;
|
---|
| 589 | /* Restore (only) the bytes that we overwrote beyond the fragment header.
|
---|
| 590 | * Those bytes may belong to either the IPv6 header or an extension
|
---|
| 591 | * header placed before the fragment header. */
|
---|
| 592 | MEMCPY(p->payload, ipr->orig_hdr, IPV6_FRAG_REQROOM);
|
---|
| 593 | /* get back room for struct ip6_reass_helper (only required if sizeof(void*) > 4) */
|
---|
| 594 | hdrerr = pbuf_remove_header(p, IPV6_FRAG_REQROOM);
|
---|
| 595 | LWIP_UNUSED_ARG(hdrerr); /* in case of LWIP_NOASSERT */
|
---|
| 596 | LWIP_ASSERT("no room for struct ip6_reass_helper", hdrerr == 0);
|
---|
| 597 | }
|
---|
| 598 | #endif
|
---|
| 599 |
|
---|
| 600 | /* We need to get rid of the fragment header itself, which is somewhere in
|
---|
| 601 | * the middle of the packet (but still in the first pbuf of the chain).
|
---|
| 602 | * Getting rid of the header is required by RFC 2460 Sec. 4.5 and necessary
|
---|
| 603 | * in order to be able to reassemble packets that are close to full size
|
---|
| 604 | * (i.e., around 65535 bytes). We simply move up all the headers before the
|
---|
| 605 | * fragment header, including the IPv6 header, and adjust the payload start
|
---|
| 606 | * accordingly. This works because all these headers are in the first pbuf
|
---|
| 607 | * of the chain, and because the caller adjusts all its pointers on
|
---|
| 608 | * successful reassembly. */
|
---|
| 609 | MEMMOVE((u8_t*)ipr->iphdr + sizeof(struct ip6_frag_hdr), ipr->iphdr,
|
---|
| 610 | (size_t)((u8_t*)p->payload - (u8_t*)ipr->iphdr));
|
---|
| 611 |
|
---|
| 612 | /* This is where the IPv6 header is now. */
|
---|
| 613 | iphdr_ptr = (struct ip6_hdr*)((u8_t*)ipr->iphdr +
|
---|
| 614 | sizeof(struct ip6_frag_hdr));
|
---|
| 615 |
|
---|
| 616 | /* Adjust datagram length by adding header lengths. */
|
---|
| 617 | ipr->datagram_len = (u16_t)(ipr->datagram_len + ((u8_t*)p->payload - (u8_t*)iphdr_ptr)
|
---|
| 618 | - IP6_HLEN);
|
---|
| 619 |
|
---|
| 620 | /* Set payload length in ip header. */
|
---|
| 621 | iphdr_ptr->_plen = lwip_htons(ipr->datagram_len);
|
---|
| 622 |
|
---|
| 623 | /* With the fragment header gone, we now need to adjust the next-header
|
---|
| 624 | * field of whatever header was originally before it. Since the packet made
|
---|
| 625 | * it through the original header processing routines at least up to the
|
---|
| 626 | * fragment header, we do not need any further sanity checks here. */
|
---|
| 627 | if (IP6H_NEXTH(iphdr_ptr) == IP6_NEXTH_FRAGMENT) {
|
---|
| 628 | iphdr_ptr->_nexth = ipr->nexth;
|
---|
| 629 | } else {
|
---|
| 630 | u8_t *ptr = (u8_t *)iphdr_ptr + IP6_HLEN;
|
---|
| 631 | while (*ptr != IP6_NEXTH_FRAGMENT) {
|
---|
| 632 | ptr += 8 * (1 + ptr[1]);
|
---|
| 633 | }
|
---|
| 634 | *ptr = ipr->nexth;
|
---|
| 635 | }
|
---|
| 636 |
|
---|
| 637 | /* release the resources allocated for the fragment queue entry */
|
---|
| 638 | if (reassdatagrams == ipr) {
|
---|
| 639 | /* it was the first in the list */
|
---|
| 640 | reassdatagrams = ipr->next;
|
---|
| 641 | } else {
|
---|
| 642 | /* it wasn't the first, so it must have a valid 'prev' */
|
---|
| 643 | LWIP_ASSERT("sanity check linked list", ipr_prev != NULL);
|
---|
| 644 | ipr_prev->next = ipr->next;
|
---|
| 645 | }
|
---|
| 646 | memp_free(MEMP_IP6_REASSDATA, ipr);
|
---|
| 647 |
|
---|
| 648 | /* adjust the number of pbufs currently queued for reassembly. */
|
---|
| 649 | clen = pbuf_clen(p);
|
---|
| 650 | LWIP_ASSERT("ip6_reass_pbufcount >= clen", ip6_reass_pbufcount >= clen);
|
---|
| 651 | ip6_reass_pbufcount = (u16_t)(ip6_reass_pbufcount - clen);
|
---|
| 652 |
|
---|
| 653 | /* Move pbuf back to IPv6 header. This should never fail. */
|
---|
| 654 | if (pbuf_header_force(p, (s16_t)((u8_t*)p->payload - (u8_t*)iphdr_ptr))) {
|
---|
| 655 | LWIP_ASSERT("ip6_reass: moving p->payload to ip6 header failed\n", 0);
|
---|
| 656 | pbuf_free(p);
|
---|
| 657 | return NULL;
|
---|
| 658 | }
|
---|
| 659 |
|
---|
| 660 | /* Return the pbuf chain */
|
---|
| 661 | return p;
|
---|
| 662 | }
|
---|
| 663 | /* the datagram is not (yet?) reassembled completely */
|
---|
| 664 | return NULL;
|
---|
| 665 |
|
---|
| 666 | nullreturn:
|
---|
| 667 | IP6_FRAG_STATS_INC(ip6_frag.drop);
|
---|
| 668 | pbuf_free(p);
|
---|
| 669 | return NULL;
|
---|
| 670 | }
|
---|
| 671 |
|
---|
| 672 | #endif /* LWIP_IPV6 && LWIP_IPV6_REASS */
|
---|
| 673 |
|
---|
| 674 | #if LWIP_IPV6 && LWIP_IPV6_FRAG
|
---|
| 675 |
|
---|
| 676 | #if !LWIP_NETIF_TX_SINGLE_PBUF
|
---|
| 677 | /** Allocate a new struct pbuf_custom_ref */
|
---|
| 678 | static struct pbuf_custom_ref*
|
---|
| 679 | ip6_frag_alloc_pbuf_custom_ref(void)
|
---|
| 680 | {
|
---|
| 681 | return (struct pbuf_custom_ref*)memp_malloc(MEMP_FRAG_PBUF);
|
---|
| 682 | }
|
---|
| 683 |
|
---|
| 684 | /** Free a struct pbuf_custom_ref */
|
---|
| 685 | static void
|
---|
| 686 | ip6_frag_free_pbuf_custom_ref(struct pbuf_custom_ref* p)
|
---|
| 687 | {
|
---|
| 688 | LWIP_ASSERT("p != NULL", p != NULL);
|
---|
| 689 | memp_free(MEMP_FRAG_PBUF, p);
|
---|
| 690 | }
|
---|
| 691 |
|
---|
| 692 | /** Free-callback function to free a 'struct pbuf_custom_ref', called by
|
---|
| 693 | * pbuf_free. */
|
---|
| 694 | static void
|
---|
| 695 | ip6_frag_free_pbuf_custom(struct pbuf *p)
|
---|
| 696 | {
|
---|
| 697 | struct pbuf_custom_ref *pcr = (struct pbuf_custom_ref*)p;
|
---|
| 698 | LWIP_ASSERT("pcr != NULL", pcr != NULL);
|
---|
| 699 | LWIP_ASSERT("pcr == p", (void*)pcr == (void*)p);
|
---|
| 700 | if (pcr->original != NULL) {
|
---|
| 701 | pbuf_free(pcr->original);
|
---|
| 702 | }
|
---|
| 703 | ip6_frag_free_pbuf_custom_ref(pcr);
|
---|
| 704 | }
|
---|
| 705 | #endif /* !LWIP_NETIF_TX_SINGLE_PBUF */
|
---|
| 706 |
|
---|
| 707 | /**
|
---|
| 708 | * Fragment an IPv6 datagram if too large for the netif or path MTU.
|
---|
| 709 | *
|
---|
| 710 | * Chop the datagram in MTU sized chunks and send them in order
|
---|
| 711 | * by pointing PBUF_REFs into p
|
---|
| 712 | *
|
---|
| 713 | * @param p ipv6 packet to send
|
---|
| 714 | * @param netif the netif on which to send
|
---|
| 715 | * @param dest destination ipv6 address to which to send
|
---|
| 716 | *
|
---|
| 717 | * @return ERR_OK if sent successfully, err_t otherwise
|
---|
| 718 | */
|
---|
| 719 | err_t
|
---|
| 720 | ip6_frag(struct pbuf *p, struct netif *netif, const ip6_addr_t *dest)
|
---|
| 721 | {
|
---|
| 722 | struct ip6_hdr *original_ip6hdr;
|
---|
| 723 | struct ip6_hdr *ip6hdr;
|
---|
| 724 | struct ip6_frag_hdr *frag_hdr;
|
---|
| 725 | struct pbuf *rambuf;
|
---|
| 726 | #if !LWIP_NETIF_TX_SINGLE_PBUF
|
---|
| 727 | struct pbuf *newpbuf;
|
---|
| 728 | u16_t newpbuflen = 0;
|
---|
| 729 | u16_t left_to_copy;
|
---|
| 730 | #endif
|
---|
| 731 | static u32_t identification;
|
---|
| 732 | u16_t left, cop;
|
---|
| 733 | const u16_t mtu = nd6_get_destination_mtu(dest, netif);
|
---|
| 734 | const u16_t nfb = (u16_t)((mtu - (IP6_HLEN + IP6_FRAG_HLEN)) & IP6_FRAG_OFFSET_MASK);
|
---|
| 735 | u16_t fragment_offset = 0;
|
---|
| 736 | u16_t last;
|
---|
| 737 | u16_t poff = IP6_HLEN;
|
---|
| 738 |
|
---|
| 739 | identification++;
|
---|
| 740 |
|
---|
| 741 | original_ip6hdr = (struct ip6_hdr *)p->payload;
|
---|
| 742 |
|
---|
| 743 | /* @todo we assume there are no options in the unfragmentable part (IPv6 header). */
|
---|
| 744 | LWIP_ASSERT("p->tot_len >= IP6_HLEN", p->tot_len >= IP6_HLEN);
|
---|
| 745 | left = (u16_t)(p->tot_len - IP6_HLEN);
|
---|
| 746 |
|
---|
| 747 | while (left) {
|
---|
| 748 | last = (left <= nfb);
|
---|
| 749 |
|
---|
| 750 | /* Fill this fragment */
|
---|
| 751 | cop = last ? left : nfb;
|
---|
| 752 |
|
---|
| 753 | #if LWIP_NETIF_TX_SINGLE_PBUF
|
---|
| 754 | rambuf = pbuf_alloc(PBUF_IP, cop + IP6_FRAG_HLEN, PBUF_RAM);
|
---|
| 755 | if (rambuf == NULL) {
|
---|
| 756 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 757 | return ERR_MEM;
|
---|
| 758 | }
|
---|
| 759 | LWIP_ASSERT("this needs a pbuf in one piece!",
|
---|
| 760 | (rambuf->len == rambuf->tot_len) && (rambuf->next == NULL));
|
---|
| 761 | poff += pbuf_copy_partial(p, (u8_t*)rambuf->payload + IP6_FRAG_HLEN, cop, poff);
|
---|
| 762 | /* make room for the IP header */
|
---|
| 763 | if (pbuf_add_header(rambuf, IP6_HLEN)) {
|
---|
| 764 | pbuf_free(rambuf);
|
---|
| 765 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 766 | return ERR_MEM;
|
---|
| 767 | }
|
---|
| 768 | /* fill in the IP header */
|
---|
| 769 | SMEMCPY(rambuf->payload, original_ip6hdr, IP6_HLEN);
|
---|
| 770 | ip6hdr = (struct ip6_hdr *)rambuf->payload;
|
---|
| 771 | frag_hdr = (struct ip6_frag_hdr *)((u8_t*)rambuf->payload + IP6_HLEN);
|
---|
| 772 | #else
|
---|
| 773 | /* When not using a static buffer, create a chain of pbufs.
|
---|
| 774 | * The first will be a PBUF_RAM holding the link, IPv6, and Fragment header.
|
---|
| 775 | * The rest will be PBUF_REFs mirroring the pbuf chain to be fragged,
|
---|
| 776 | * but limited to the size of an mtu.
|
---|
| 777 | */
|
---|
| 778 | rambuf = pbuf_alloc(PBUF_LINK, IP6_HLEN + IP6_FRAG_HLEN, PBUF_RAM);
|
---|
| 779 | if (rambuf == NULL) {
|
---|
| 780 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 781 | return ERR_MEM;
|
---|
| 782 | }
|
---|
| 783 | LWIP_ASSERT("this needs a pbuf in one piece!",
|
---|
| 784 | (p->len >= (IP6_HLEN)));
|
---|
| 785 | SMEMCPY(rambuf->payload, original_ip6hdr, IP6_HLEN);
|
---|
| 786 | ip6hdr = (struct ip6_hdr *)rambuf->payload;
|
---|
| 787 | frag_hdr = (struct ip6_frag_hdr *)((u8_t*)rambuf->payload + IP6_HLEN);
|
---|
| 788 |
|
---|
| 789 | /* Can just adjust p directly for needed offset. */
|
---|
| 790 | p->payload = (u8_t *)p->payload + poff;
|
---|
| 791 | p->len = (u16_t)(p->len - poff);
|
---|
| 792 | p->tot_len = (u16_t)(p->tot_len - poff);
|
---|
| 793 |
|
---|
| 794 | left_to_copy = cop;
|
---|
| 795 | while (left_to_copy) {
|
---|
| 796 | struct pbuf_custom_ref *pcr;
|
---|
| 797 | newpbuflen = (left_to_copy < p->len) ? left_to_copy : p->len;
|
---|
| 798 | /* Is this pbuf already empty? */
|
---|
| 799 | if (!newpbuflen) {
|
---|
| 800 | p = p->next;
|
---|
| 801 | continue;
|
---|
| 802 | }
|
---|
| 803 | pcr = ip6_frag_alloc_pbuf_custom_ref();
|
---|
| 804 | if (pcr == NULL) {
|
---|
| 805 | pbuf_free(rambuf);
|
---|
| 806 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 807 | return ERR_MEM;
|
---|
| 808 | }
|
---|
| 809 | /* Mirror this pbuf, although we might not need all of it. */
|
---|
| 810 | newpbuf = pbuf_alloced_custom(PBUF_RAW, newpbuflen, PBUF_REF, &pcr->pc, p->payload, newpbuflen);
|
---|
| 811 | if (newpbuf == NULL) {
|
---|
| 812 | ip6_frag_free_pbuf_custom_ref(pcr);
|
---|
| 813 | pbuf_free(rambuf);
|
---|
| 814 | IP6_FRAG_STATS_INC(ip6_frag.memerr);
|
---|
| 815 | return ERR_MEM;
|
---|
| 816 | }
|
---|
| 817 | pbuf_ref(p);
|
---|
| 818 | pcr->original = p;
|
---|
| 819 | pcr->pc.custom_free_function = ip6_frag_free_pbuf_custom;
|
---|
| 820 |
|
---|
| 821 | /* Add it to end of rambuf's chain, but using pbuf_cat, not pbuf_chain
|
---|
| 822 | * so that it is removed when pbuf_dechain is later called on rambuf.
|
---|
| 823 | */
|
---|
| 824 | pbuf_cat(rambuf, newpbuf);
|
---|
| 825 | left_to_copy = (u16_t)(left_to_copy - newpbuflen);
|
---|
| 826 | if (left_to_copy) {
|
---|
| 827 | p = p->next;
|
---|
| 828 | }
|
---|
| 829 | }
|
---|
| 830 | poff = newpbuflen;
|
---|
| 831 | #endif /* LWIP_NETIF_TX_SINGLE_PBUF */
|
---|
| 832 |
|
---|
| 833 | /* Set headers */
|
---|
| 834 | frag_hdr->_nexth = original_ip6hdr->_nexth;
|
---|
| 835 | frag_hdr->reserved = 0;
|
---|
| 836 | frag_hdr->_fragment_offset = lwip_htons((u16_t)((fragment_offset & IP6_FRAG_OFFSET_MASK) | (last ? 0 : IP6_FRAG_MORE_FLAG)));
|
---|
| 837 | frag_hdr->_identification = lwip_htonl(identification);
|
---|
| 838 |
|
---|
| 839 | IP6H_NEXTH_SET(ip6hdr, IP6_NEXTH_FRAGMENT);
|
---|
| 840 | IP6H_PLEN_SET(ip6hdr, (u16_t)(cop + IP6_FRAG_HLEN));
|
---|
| 841 |
|
---|
| 842 | /* No need for separate header pbuf - we allowed room for it in rambuf
|
---|
| 843 | * when allocated.
|
---|
| 844 | */
|
---|
| 845 | IP6_FRAG_STATS_INC(ip6_frag.xmit);
|
---|
| 846 | netif->output_ip6(netif, rambuf, dest);
|
---|
| 847 |
|
---|
| 848 | /* Unfortunately we can't reuse rambuf - the hardware may still be
|
---|
| 849 | * using the buffer. Instead we free it (and the ensuing chain) and
|
---|
| 850 | * recreate it next time round the loop. If we're lucky the hardware
|
---|
| 851 | * will have already sent the packet, the free will really free, and
|
---|
| 852 | * there will be zero memory penalty.
|
---|
| 853 | */
|
---|
| 854 |
|
---|
| 855 | pbuf_free(rambuf);
|
---|
| 856 | left = (u16_t)(left - cop);
|
---|
| 857 | fragment_offset = (u16_t)(fragment_offset + cop);
|
---|
| 858 | }
|
---|
| 859 | return ERR_OK;
|
---|
| 860 | }
|
---|
| 861 |
|
---|
| 862 | #endif /* LWIP_IPV6 && LWIP_IPV6_FRAG */
|
---|