Re: [PATCH 11/11] centralize IPv4 fragment handling

[Vitezslav Samel]

Hi!

Please drop this patch, I found a bug in it, will repost later.

Thanks,

Vita

On Thu, Mar 13, 2014 at 12:16:42PM +0100, Vitezslav Samel wrote:
> Signed-off-by: Vitezslav Samel
>
> src/ipfrag.c   |    6 +++---
>  src/ipfrag.h   |   20 ++++++++++++++++++++
>  src/itrafmon.c |    8 ++------
>  src/packet.c   |    2 +-
>  4 files changed, 26 insertions(+), 10 deletions(-)
>
> diff --git a/src/ipfrag.c b/src/ipfrag.c
> index 76196e6..e38550a 100644
> --- a/src/ipfrag.c
> +++ b/src/ipfrag.c
> @@ -183,10 +183,10 @@ unsigned int processfragment(struct iphdr *packet, in_port_t *sport,
>     */
>
> dtmp = ftmp->fragdesclist;	/* Point to hole descriptors */
> offset = (ntohs(packet->frag_off) & 0x1fff) * 8;
> offset = ipv4_frag_offset(packet);
> lastbyte = (offset + (ntohs(packet->tot_len) - (packet->ihl) * 4)) - 1;
> if ((ntohs(packet->frag_off) & 0x1fff) == 0) {	/* first fragment? */
> if (ipv4_is_first_fragment(packet)) {	/* first fragment? */
> ftmp->firstin = 1;
> tpacket = ((char *) (packet)) + (packet->ihl * 4);
> if (packet->protocol == IPPROTO_TCP) {
>
> @@ -235,7 +235,7 @@ unsigned int processfragment(struct iphdr *packet, in_port_t *sport,
>    		ntmp->max = offset - 1;
>    	}
>    	if ((lastbyte < dtmp->max)
>     && (ntohs(packet->frag_off) & 0x2000)) {
>     && ipv4_more_fragments(packet)) {
> /*
>  * If last byte in fragment is less than the last byte of the
>  * hole descriptor, and more fragments, create a new hole
>
> diff --git a/src/ipfrag.h b/src/ipfrag.h
> index f20e6dd..8214859 100644
> --- a/src/ipfrag.h
> +++ b/src/ipfrag.h
> @@ -39,4 +39,24 @@ void destroyfraglist(void);
>  unsigned int processfragment(struct iphdr *packet, in_port_t *sport,
>    		     in_port_t *dport, int *firstin);
>
> +static inline unsigned int ipv4_frag_offset(struct iphdr *ip)
> +{
> return (ntohs(ip->frag_off) & 0x1fff) * 8;
>
> +}
>
> +static inline int ipv4_is_first_fragment(struct iphdr *ip)
> +{
> return (ntohs(ip->frag_off) & 0x1fff) == 0;
>
> +}
>
> +static inline int ipv4_is_fragmented(struct iphdr *ip)
> +{
> return (ntohs(ip->frag_off) & 0x3fff) != 0;
>
> +}
>
> +static inline int ipv4_more_fragments(struct iphdr *ip)
> +{
> return (ntohs(ip->frag_off) & 0x2000) != 0;
>
> +}
>
> #endif	/* IPTRAF_NG_IPFRAG_H */
> diff --git a/src/itrafmon.c b/src/itrafmon.c
> index 20c6f6c..dcac7fa 100644
> --- a/src/itrafmon.c
> +++ b/src/itrafmon.c
> @@ -584,8 +584,6 @@ void ipmon(time_t facilitytime, char *ifptr)
>    /* reattempt in updateentry() */
>    int pkt_result = 0;	/* Non-IP filter ok */
>
> int fragment = 0;	/* Set to 1 if not first fragment */
>
> int fd;
>
> int ch;
>
> @@ -1110,8 +1108,6 @@ void ipmon(time_t facilitytime, char *ifptr)
>    					   screen_idx, mode);
>    		}
>    	} else if (pkt.iphdr) {
> 	fragment =  ((ntohs(pkt.iphdr->frag_off) & 0x1fff) != 0);
> if (pkt_ip_protocol(&pkt) == IPPROTO_ICMP) {
>
> 	/*
>
> @@ -1128,7 +1124,7 @@ void ipmon(time_t facilitytime, char *ifptr)
>    			       IS_IP, pkt_ip_protocol(&pkt),
>    			       (char *) transpacket, ifname,
>    			       &revlook, rvnfd, logging, logfile,
> 		       fragment);
> 		       ipv4_is_first_fragment(pkt.iphdr));
>
> } else {
> 	if (pkt_ip_protocol(&pkt) == IPPROTO_ICMPV6
>
> @@ -1140,7 +1136,7 @@ void ipmon(time_t facilitytime, char *ifptr)
>    			       IS_IP, pkt_ip_protocol(&pkt),
>    			       (char *) transpacket, ifname,
>    			       &revlook, rvnfd, logging, logfile,
> 		       fragment);
> 		       0);
> }
> }
>
> diff --git a/src/packet.c b/src/packet.c
> index 5db8df9..c70d3e2 100644
> --- a/src/packet.c
> +++ b/src/packet.c
> @@ -213,7 +213,7 @@ again:
>    		/*
>    		 * Process TCP/UDP fragments
>    		 */
> 	if ((ntohs(ip->frag_off) & 0x3fff) != 0) {
> 	if (ipv4_is_fragmented(ip)) {
> 	int firstin = 0;
>
> 	/*
>
> -- 
> 1.7.8.4