1 files changed, 67 insertions, 20 deletions

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index b7c41654dde5..0ad6035f6366 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -45,6 +45,7 @@
 #include <linux/udp.h>
 #include <linux/inet.h>
 #include <linux/netfilter_ipv4.h>
+#include <net/inet_ecn.h>
 
 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
  * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
@@ -70,11 +71,46 @@ struct ipq {
         __be32          daddr;
         __be16          id;
         u8              protocol;
+        u8              ecn; /* RFC3168 support */
         int             iif;
         unsigned int    rid;
         struct inet_peer *peer;
 };
 
+/* RFC 3168 support :
+ * We want to check ECN values of all fragments, do detect invalid combinations.
+ * In ipq->ecn, we store the OR value of each ip4_frag_ecn() fragment value.
+ */
+#define IPFRAG_ECN_NOT_ECT      0x01 /* one frag had ECN_NOT_ECT */
+#define IPFRAG_ECN_ECT_1        0x02 /* one frag had ECN_ECT_1 */
+#define IPFRAG_ECN_ECT_0        0x04 /* one frag had ECN_ECT_0 */
+#define IPFRAG_ECN_CE           0x08 /* one frag had ECN_CE */
+
+static inline u8 ip4_frag_ecn(u8 tos)
+{
+        return 1 << (tos & INET_ECN_MASK);
+}
+
+/* Given the OR values of all fragments, apply RFC 3168 5.3 requirements
+ * Value : 0xff if frame should be dropped.
+ *         0 or INET_ECN_CE value, to be ORed in to final iph->tos field
+ */
+static const u8 ip4_frag_ecn_table[16] = {
+        /* at least one fragment had CE, and others ECT_0 or ECT_1 */
+        [IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0]                      = INET_ECN_CE,
+        [IPFRAG_ECN_CE | IPFRAG_ECN_ECT_1]                      = INET_ECN_CE,
+        [IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0 | IPFRAG_ECN_ECT_1]   = INET_ECN_CE,
+
+        /* invalid combinations : drop frame */
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE] = 0xff,
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_ECT_0] = 0xff,
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_ECT_1] = 0xff,
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_ECT_0 | IPFRAG_ECN_ECT_1] = 0xff,
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0] = 0xff,
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE | IPFRAG_ECN_ECT_1] = 0xff,
+        [IPFRAG_ECN_NOT_ECT | IPFRAG_ECN_CE | IPFRAG_ECN_ECT_0 | IPFRAG_ECN_ECT_1] = 0xff,
+};
+
 static struct inet_frags ip4_frags;
 
 int ip_frag_nqueues(struct net *net)
@@ -116,11 +152,11 @@ static int ip4_frag_match(struct inet_frag_queue *q, void *a)
         struct ip4_create_arg *arg = a;
 
         qp = container_of(q, struct ipq, q);
-        return (qp->id == arg->iph->id &&
+        return  qp->id == arg->iph->id &&
                         qp->saddr == arg->iph->saddr &&
                         qp->daddr == arg->iph->daddr &&
                         qp->protocol == arg->iph->protocol &&
-                        qp->user == arg->user);
+                        qp->user == arg->user;
 }
 
 /* Memory Tracking Functions. */
@@ -137,11 +173,12 @@ static void ip4_frag_init(struct inet_frag_queue *q, void *a)
 
         qp->protocol = arg->iph->protocol;
         qp->id = arg->iph->id;
+        qp->ecn = ip4_frag_ecn(arg->iph->tos);
         qp->saddr = arg->iph->saddr;
         qp->daddr = arg->iph->daddr;
         qp->user = arg->user;
         qp->peer = sysctl_ipfrag_max_dist ?
-                inet_getpeer(arg->iph->saddr, 1) : NULL;
+                inet_getpeer_v4(arg->iph->saddr, 1) : NULL;
 }
 
 static __inline__ void ip4_frag_free(struct inet_frag_queue *q)
@@ -204,31 +241,30 @@ static void ip_expire(unsigned long arg)
 
         if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
                 struct sk_buff *head = qp->q.fragments;
+                const struct iphdr *iph;
+                int err;
 
                 rcu_read_lock();
                 head->dev = dev_get_by_index_rcu(net, qp->iif);
                 if (!head->dev)
                         goto out_rcu_unlock;
 
+                /* skb dst is stale, drop it, and perform route lookup again */
+                skb_dst_drop(head);
+                iph = ip_hdr(head);
+                err = ip_route_input_noref(head, iph->daddr, iph->saddr,
+                                           iph->tos, head->dev);
+                if (err)
+                        goto out_rcu_unlock;
+
                 /*
-                 * Only search router table for the head fragment,
-                 * when defraging timeout at PRE_ROUTING HOOK.
+                 * Only an end host needs to send an ICMP
+                 * "Fragment Reassembly Timeout" message, per RFC792.
                  */
-                if (qp->user == IP_DEFRAG_CONNTRACK_IN && !skb_dst(head)) {
-                        const struct iphdr *iph = ip_hdr(head);
-                        int err = ip_route_input(head, iph->daddr, iph->saddr,
-                                                 iph->tos, head->dev);
-                        if (unlikely(err))
-                                goto out_rcu_unlock;
-
-                        /*
-                         * Only an end host needs to send an ICMP
-                         * "Fragment Reassembly Timeout" message, per RFC792.
-                         */
-                        if (skb_rtable(head)->rt_type != RTN_LOCAL)
-                                goto out_rcu_unlock;
+                if (qp->user == IP_DEFRAG_CONNTRACK_IN &&
+                    skb_rtable(head)->rt_type != RTN_LOCAL)
+                        goto out_rcu_unlock;
 
-                }
 
                 /* Send an ICMP "Fragment Reassembly Timeout" message. */
                 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
@@ -316,6 +352,7 @@ static int ip_frag_reinit(struct ipq *qp)
         qp->q.fragments = NULL;
         qp->q.fragments_tail = NULL;
         qp->iif = 0;
+        qp->ecn = 0;
 
         return 0;
 }
@@ -328,6 +365,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
         int flags, offset;
         int ihl, end;
         int err = -ENOENT;
+        u8 ecn;
 
         if (qp->q.last_in & INET_FRAG_COMPLETE)
                 goto err;
@@ -339,6 +377,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                 goto err;
         }
 
+        ecn = ip4_frag_ecn(ip_hdr(skb)->tos);
         offset = ntohs(ip_hdr(skb)->frag_off);
         flags = offset & ~IP_OFFSET;
         offset &= IP_OFFSET;
@@ -472,6 +511,7 @@ found:
         }
         qp->q.stamp = skb->tstamp;
         qp->q.meat += skb->len;
+        qp->ecn |= ecn;
         atomic_add(skb->truesize, &qp->q.net->mem);
         if (offset == 0)
                 qp->q.last_in |= INET_FRAG_FIRST_IN;
@@ -502,9 +542,15 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         int len;
         int ihlen;
         int err;
+        u8 ecn;
 
         ipq_kill(qp);
 
+        ecn = ip4_frag_ecn_table[qp->ecn];
+        if (unlikely(ecn == 0xff)) {
+                err = -EINVAL;
+                goto out_fail;
+        }
         /* Make the one we just received the head. */
         if (prev) {
                 head = prev->next;
@@ -542,7 +588,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
@@ -583,6 +629,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         iph = ip_hdr(head);
         iph->frag_off = 0;
         iph->tot_len = htons(len);
+        iph->tos |= ecn;
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
         qp->q.fragments = NULL;
         qp->q.fragments_tail = NULL;