void cxtbuffer_free(connection *c)
{
if ( c == NULL )
return;
if ( c->s_ip )
ip_free(c->s_ip);
if ( c->d_ip )
ip_free(c->d_ip);
free(c);
c = NULL;
//cxt_free++;
}
/* Memory limiting on fragments. Evictor trashes the oldest
* fragment queue until we are back under the low threshold.
*/
static void ip_evictor(void)
{
int i, progress;
restart:
progress = 0;
/* FIXME: Make LRU queue of frag heads. -DaveM */
for (i = 0; i < IPQ_HASHSZ; i++) {
struct ipq *qp;
if (atomic_read(&ip_frag_mem) <= sysctl_ipfrag_low_thresh)
return;
/* We are in a BH context, so these queue
* accesses are safe. -DaveM
*/
qp = ipq_hash[i];
if (qp) {
/* find the oldest queue for this hash bucket */
while (qp->next)
qp = qp->next;
ip_free(qp);
progress = 1;
}
}
if (progress)
goto restart;
panic("ip_evictor: memcount");
}
static void ip_evictor(void)
{
while(ip_frag_mem>IPFRAG_LOW_THRESH)
{
if(!ipqueue)
panic("ip_evictor: memcount");
ip_free(ipqueue);
}
}
/* Oops- a fragment queue timed out. Kill it and send an ICMP reply. */
static void
ip_expire(unsigned long arg)
{
struct ipq *qp;
qp = (struct ipq *) arg;
/* Nuke the fragment queue. */
ip_free(qp);
}
/*
Memory limiting on fragments. Evictor trashes the oldest fragment
queue until we are back under the low threshold.
*/
static void
ip_evictor(void)
{
// fprintf(stderr, "ip_evict:numpack=%i\n", numpack);
while (this_host && this_host->ip_frag_mem > IPFRAG_LOW_THRESH) {
if (!this_host->ipqueue)
panic("ip_evictor: memcount");
ip_free(this_host->ipqueue);
}
}
/* Oops- a fragment queue timed out. Kill it and send an ICMP reply. */
static void
ip_expire(unsigned long arg, IP_THREAD_LOCAL_P ip_thread_local_p)
{
struct ipq *qp;
qp = (struct ipq *) arg;
/* Nuke the fragment queue. */
//! ip_free(qp);
ip_free(qp,ip_thread_local_p);
}
void test_ip4_parsing(void)
{
unsigned host, mask, not_flag;
PORTSET portset;
char **curip;
int ret;
IPADDRESS *adp;
char *ips[] = {
"138.26.1.24:25",
"1.1.1.1/255.255.255.0:444",
"1.1.1.1/16:25-28",
"1.1.1.1/255.255.255.255:25 27-29",
"z/24",
"0/0",
"0.0.0.0/0.0.0.0:25-26 28-29 31",
"0.0.0.0/0.0.2.0",
NULL
};
for(curip = ips; curip[0] != NULL; curip++)
{
portset_init(&portset);
/* network byte order stuff */
if((ret = ip4_parse(curip[0], 1, ¬_flag, &host, &mask, &portset)) != 0)
{
fprintf(stderr, "Unable to parse %s with ret %d\n", curip[0], ret);
}
else
{
printf("%c", not_flag ? '!' : ' ');
printf("%s/", inet_ntoa(*(struct in_addr *) &host));
printf("%s", inet_ntoa(*(struct in_addr *) &mask));
printf(" parsed successfully!\n");
}
/* host byte order stuff */
if((ret = ip4_parse(curip[0], 0, ¬_flag, &host, &mask, &portset)) != 0)
{
fprintf(stderr, "Unable to parse %s with ret %d\n", curip[0], ret);
}
else
{
adp = ip_new(IPV4_FAMILY);
ip_set(adp, &host, IPV4_FAMILY);
ip_fprint(stdout, adp);
fprintf(stdout, "*****************\n");
ip_free(adp);
}
}
return;
}
void del_node(struct ip_node *node)
{
struct ip_node *foo, *bar;
foo = node->children;
while (foo){
bar = foo;
foo = foo->next;
del_node(bar);
}
ip_free(node);
}
/*
Memory limiting on fragments. Evictor trashes the oldest fragment
queue until we are back under the low threshold.
*/
static void
//! ip_evictor(void)
ip_evictor(IP_THREAD_LOCAL_P ip_thread_local_p)
{
//! // fprintf(stderr, "ip_evict:numpack=%i\n", numpack);
// fprintf(stderr, "ip_evict:ip_thread_local_p->numpack=%i\n", ip_thread_local_p->numpack);
//! while (this_host->ip_frag_mem > IPFRAG_LOW_THRESH) {
while (ip_thread_local_p->this_host->ip_frag_mem > IPFRAG_LOW_THRESH) {
//! if (!this_host->ipqueue)
if (!ip_thread_local_p->this_host->ipqueue)
panic("ip_evictor: memcount");
//! ip_free(this_host->ipqueue);
ip_free(ip_thread_local_p->this_host->ipqueue,ip_thread_local_p);
}
}
static void
ip_evictor(void)
{
// fprintf(stderr, "ip_evict:numpack=%i\n", numpack);
// 如果当前host存在，并且当前host的内存大于了下限
while (this_host && this_host->ip_frag_mem > IPFRAG_LOW_THRESH)
{
// 如果对应的ip队列不为空
if (!this_host->ipqueue)
// 报错(好像会exit)
panic("ip_evictor: memcount");
// 释放当前的ipqueue, 一直到当前host的内存小于下限
ip_free(this_host->ipqueue);
}
}
/*
* Oops, a fragment queue timed out. Kill it and send an ICMP reply.
*/
static void ip_expire(unsigned long arg)
{
struct ipq *qp = (struct ipq *) arg;
if(!qp->fragments)
{
#ifdef IP_EXPIRE_DEBUG
printk("warning: possible ip-expire attack\n");
#endif
goto out;
}
/* Send an ICMP "Fragment Reassembly Timeout" message. */
ip_statistics.IpReasmTimeout++;
ip_statistics.IpReasmFails++;
icmp_send(qp->fragments->skb, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
out:
/* Nuke the fragment queue. */
ip_free(qp);
}
static void ip_expire(unsigned long arg)
{
struct ipq *qp;
qp = (struct ipq *)arg;
/*
* Send an ICMP "Fragment Reassembly Timeout" message.
*/
ip_statistics.IpReasmTimeout++;
ip_statistics.IpReasmFails++;
/* This if is always true... shrug */
if(qp->fragments!=NULL)
icmp_send(qp->fragments->skb,ICMP_TIME_EXCEEDED,
ICMP_EXC_FRAGTIME, 0, qp->dev);
/*
* Nuke the fragment queue.
*/
ip_free(qp);
}
void got_packet (u_char *useless,const struct pcap_pkthdr *pheader, const u_char *packet) {
if ( intr_flag != 0 ) { check_interupt(); }
inpacket = 1;
tstamp = pheader->ts;
/* are we dumping */
if (mode & MODE_DUMP) {
time_t now = time(NULL);
/* check if we should roll on time */
if( ( roll_time != 0 ) &&
( now >= (roll_time_last + roll_time) ) )
{
roll_time_last = now;
printf("Rolling on time.\n");
dump_file_roll();
}
dump_file_offset = (uint64_t)ftell((FILE *)dump_handle);
/* check if we should roll on size */
if ( (roll_size > 0) &&
(dump_file_offset >= roll_size) )
{
printf("Rolling on size.\n");
dump_file_roll();
}
/* write the packet */
pcap_dump((u_char *)dump_handle, pheader, packet);
if ( dump_with_flush )
pcap_dump_flush(dump_handle);
}
else if ( mode & MODE_FILE ) {
read_file_offset = (uint64_t)ftell(pcap_file(handle)) - pheader->caplen - 16;
}
/* printf("[*] Got network packet...\n"); */
ether_header *eth_hdr;
eth_hdr = (ether_header *) (packet);
u_short eth_type;
eth_type = ntohs(eth_hdr->eth_ip_type);
int eth_header_len;
eth_header_len = ETHERNET_HEADER_LEN;
vlanid = 0;
if ( eth_type == ETHERNET_TYPE_8021Q ) {
/* printf("[*] ETHERNET TYPE 8021Q\n"); */
eth_type = ntohs(eth_hdr->eth_8_ip_type);
eth_header_len +=4;
vlanid = ntohs(eth_hdr->eth_8_vid);
}
else if ( eth_type == (ETHERNET_TYPE_802Q1MT|ETHERNET_TYPE_802Q1MT2|ETHERNET_TYPE_802Q1MT3|ETHERNET_TYPE_8021AD) ) {
/* printf("[*] ETHERNET TYPE 802Q1MT\n"); */
eth_type = ntohs(eth_hdr->eth_82_ip_type);
eth_header_len +=8;
vlanid = ntohs(eth_hdr->eth_82_vid);
}
/* zero-ise our structure, simplifies our hashing later on */
int ip_tracked = 0;
ip_t *ip_src = calloc(1, sizeof(ip_t));
ip_t *ip_dst = calloc(1, sizeof(ip_t));
if ( eth_type == ETHERNET_TYPE_IP ) {
/* printf("[*] Got IPv4 Packet...\n"); */
ip4_header *ip4;
ip4 = (ip4_header *) (packet + eth_header_len);
ip_set(&ip_config, ip_src, &ip4->ip_src, AF_INET);
ip_set(&ip_config, ip_dst, &ip4->ip_dst, AF_INET);
if ( ip4->ip_p == IP_PROTO_TCP ) {
tcp_header *tcph;
tcph = (tcp_header *) (packet + eth_header_len + (IP_HL(ip4)*4));
/* printf("[*] IPv4 PROTOCOL TYPE TCP:\n"); */
ip_tracked = cx_track(ip_src, tcph->src_port, ip_dst, tcph->dst_port, ip4->ip_p, pheader->len, tcph->t_flags, tstamp, AF_INET);
}
else if (ip4->ip_p == IP_PROTO_UDP) {
udp_header *udph;
udph = (udp_header *) (packet + eth_header_len + (IP_HL(ip4)*4));
/* printf("[*] IPv4 PROTOCOL TYPE UDP:\n"); */
ip_tracked = cx_track(ip_src, udph->src_port, ip_dst, udph->dst_port, ip4->ip_p, pheader->len, 0, tstamp, AF_INET);
}
else if (ip4->ip_p == IP_PROTO_ICMP) {
icmp_header *icmph;
icmph = (icmp_header *) (packet + eth_header_len + (IP_HL(ip4)*4));
/* printf("[*] IP PROTOCOL TYPE ICMP\n"); */
ip_tracked = cx_track(ip_src, icmph->s_icmp_id, ip_dst, icmph->s_icmp_id, ip4->ip_p, pheader->len, 0, tstamp, AF_INET);
}
else {
/* printf("[*] IPv4 PROTOCOL TYPE OTHER: %d\n",ip4->ip_p); */
ip_tracked = cx_track(ip_src, ip4->ip_p, ip_dst, ip4->ip_p, ip4->ip_p, pheader->len, 0, tstamp, AF_INET);
}
}
else if ( eth_type == ETHERNET_TYPE_IPV6) {
/* printf("[*] Got IPv6 Packet...\n"); */
ip6_header *ip6;
ip6 = (ip6_header *) (packet + eth_header_len);
ip_set(&ip_config, ip_src, &ip6->ip_src, AF_INET6);
ip_set(&ip_config, ip_dst, &ip6->ip_dst, AF_INET6);
if ( ip6->next == IP_PROTO_TCP ) {
tcp_header *tcph;
tcph = (tcp_header *) (packet + eth_header_len + IP6_HEADER_LEN);
/* printf("[*] IPv6 PROTOCOL TYPE TCP:\n"); */
ip_tracked = cx_track(ip_src, tcph->src_port, ip_dst, tcph->dst_port, ip6->next, pheader->len, tcph->t_flags, tstamp, AF_INET6);
}
else if (ip6->next == IP_PROTO_UDP) {
udp_header *udph;
udph = (udp_header *) (packet + eth_header_len + IP6_HEADER_LEN);
/* printf("[*] IPv6 PROTOCOL TYPE UDP:\n"); */
ip_tracked = cx_track(ip_src, udph->src_port, ip_dst, udph->dst_port, ip6->next, pheader->len, 0, tstamp, AF_INET6);
}
else if (ip6->next == IP6_PROTO_ICMP) {
//icmp6_header *icmph;
//icmph = (icmp6_header *) (packet + eth_header_len + IP6_HEADER_LEN);
/* printf("[*] IPv6 PROTOCOL TYPE ICMP\n"); */
ip_tracked = cx_track(ip_src, ip6->hop_lmt, ip_dst, ip6->hop_lmt, ip6->next, pheader->len, 0, tstamp, AF_INET6);
}
else {
/* printf("[*] IPv6 PROTOCOL TYPE OTHER: %d\n",ip6->next); */
ip_tracked = cx_track(ip_src, ip6->next, ip_dst, ip6->next, ip6->next, pheader->len, 0, tstamp, AF_INET6);
}
}
if ( ip_tracked == 0 )
{
if (ip_src != NULL) ip_free(ip_src);
if (ip_dst != NULL) ip_free(ip_dst);
}
inpacket = 0;
return;
(void) useless;
/* else { */
/* printf("[*] ETHERNET TYPE : %x\n", eth_hdr->eth_ip_type); */
/* return; */
/* } */
}
/*
Build a new IP datagram from all its fragments.
FIXME: We copy here because we lack an effective way of handling
lists of bits on input. Until the new skb data handling is in I'm
not going to touch this with a bargepole.
*/
static char *
//! ip_glue(struct ipq * qp)
ip_glue(struct ipq * qp,IP_THREAD_LOCAL_P ip_thread_local_p)
{
char *skb;
struct ip *iph;
struct ipfrag *fp;
char *ptr;
int count, len;
/* Allocate a new buffer for the datagram. */
len = qp->ihlen + qp->len;
if (len > 65535) {
// NETDEBUG(printk("Oversized IP packet from %s.\n", int_ntoa(qp->iph->ip_src.s_addr)));
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERSIZED, qp->iph, 0);
//! ip_free(qp);
ip_free(qp,ip_thread_local_p);
return NULL;
}
if ((skb = (char *) malloc(len)) == NULL) {
// NETDEBUG(printk("IP: queue_glue: no memory for gluing queue %p\n", qp));
nids_params.no_mem("ip_glue");
//! ip_free(qp);
ip_free(qp,ip_thread_local_p);
return (NULL);
}
/* Fill in the basic details. */
ptr = skb;
memcpy(ptr, ((unsigned char *) qp->iph), qp->ihlen);
ptr += qp->ihlen;
count = 0;
/* Copy the data portions of all fragments into the new buffer. */
fp = qp->fragments;
while (fp != NULL) {
if (fp->len < 0 || fp->offset + qp->ihlen + fp->len > len) {
//NETDEBUG(printk("Invalid fragment list: Fragment over size.\n"));
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_INVLIST, qp->iph, 0);
//! ip_free(qp);
ip_free(qp,ip_thread_local_p);
//kfree_skb(skb, FREE_WRITE);
//ip_statistics.IpReasmFails++;
free(skb);
return NULL;
}
memcpy((ptr + fp->offset), fp->ptr, fp->len);
count += fp->len;
fp = fp->next;
}
/* We glued together all fragments, so remove the queue entry. */
//! ip_free(qp);
ip_free(qp,ip_thread_local_p);
/* Done with all fragments. Fixup the new IP header. */
iph = (struct ip *) skb;
iph->ip_off = 0;
iph->ip_len = htons((iph->ip_hl * 4) + count);
// skb->ip_hdr = iph;
return (skb);
}
static struct sk_buff *ip_glue(struct ipq *qp)
{
struct sk_buff *skb;
struct iphdr *iph;
struct ipfrag *fp;
unsigned char *ptr;
int count, len;
/*
* Allocate a new buffer for the datagram.
*/
len = qp->ihlen + qp->len;
if(len>65535)
{
NETDEBUG(printk("Oversized IP packet from %s.\n", in_ntoa(qp->iph->saddr)));
ip_statistics.IpReasmFails++;
ip_free(qp);
return NULL;
}
if ((skb = dev_alloc_skb(len)) == NULL)
{
ip_statistics.IpReasmFails++;
NETDEBUG(printk("IP: queue_glue: no memory for gluing queue %p\n", qp));
ip_free(qp);
return(NULL);
}
/* Fill in the basic details. */
skb_put(skb,len);
skb->h.raw = skb->data;
skb->free = 1;
/* Copy the original IP headers into the new buffer. */
ptr = (unsigned char *) skb->h.raw;
memcpy(ptr, ((unsigned char *) qp->iph), qp->ihlen);
ptr += qp->ihlen;
count = 0;
/* Copy the data portions of all fragments into the new buffer. */
fp = qp->fragments;
while(fp != NULL)
{
if (fp->len < 0 || fp->offset+qp->ihlen+fp->len > skb->len)
{
NETDEBUG(printk("Invalid fragment list: Fragment over size.\n"));
ip_free(qp);
kfree_skb(skb,FREE_WRITE);
ip_statistics.IpReasmFails++;
return NULL;
}
memcpy((ptr + fp->offset), fp->ptr, fp->len);
count += fp->len;
fp = fp->next;
}
skb->pkt_type = qp->fragments->skb->pkt_type;
skb->protocol = qp->fragments->skb->protocol;
/* We glued together all fragments, so remove the queue entry. */
ip_free(qp);
/* Done with all fragments. Fixup the new IP header. */
iph = skb->h.iph;
iph->frag_off = 0;
iph->tot_len = htons((iph->ihl * 4) + count);
skb->ip_hdr = iph;
ip_statistics.IpReasmOKs++;
return(skb);
}
/* Process an incoming IP datagram fragment. */
static char *
ip_defrag(struct ip *iph, struct sk_buff *skb)
{
struct ipfrag *prev, *next, *tmp;
struct ipfrag *tfp;
struct ipq *qp;
char *skb2;
unsigned char *ptr;
int flags, offset;
int i, ihl, end;
if (!hostfrag_find(iph) && skb)
hostfrag_create(iph);
/* Start by cleaning up the memory. */
if (this_host)
if (this_host->ip_frag_mem > IPFRAG_HIGH_THRESH)
ip_evictor();
/* Find the entry of this IP datagram in the "incomplete datagrams" queue. */
if (this_host)
qp = ip_find(iph);
else
qp = 0;
/* Is this a non-fragmented datagram? */
offset = ntohs(iph->ip_off);
flags = offset & ~IP_OFFSET;
offset &= IP_OFFSET;
if (((flags & IP_MF) == 0) && (offset == 0)) {
if (qp != NULL)
ip_free(qp); /* Fragmented frame replaced by full
unfragmented copy */
return 0;
}
/* ip_evictor() could have removed all queues for the current host */
if (!this_host)
hostfrag_create(iph);
offset <<= 3; /* offset is in 8-byte chunks */
ihl = iph->ip_hl * 4;
/*
If the queue already existed, keep restarting its timer as long as
we still are receiving fragments. Otherwise, create a fresh queue
entry.
*/
if (qp != NULL) {
/* ANK. If the first fragment is received, we should remember the correct
IP header (with options) */
if (offset == 0) {
qp->ihlen = ihl;
memcpy(qp->iph, iph, ihl + 8);
}
del_timer(&qp->timer);
qp->timer.expires = jiffies() + IP_FRAG_TIME; /* about 30 seconds */
qp->timer.data = (unsigned long) qp; /* pointer to queue */
qp->timer.function = ip_expire; /* expire function */
add_timer(&qp->timer);
}
else {
/* If we failed to create it, then discard the frame. */
if ((qp = ip_create(iph)) == NULL) {
kfree_skb(skb, FREE_READ);
return NULL;
}
}
/* Attempt to construct an oversize packet. */
if (ntohs(iph->ip_len) + (int) offset > 65535) {
// NETDEBUG(printk("Oversized packet received from %s\n", int_ntoa(iph->ip_src.s_addr)));
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERSIZED, iph, 0);
kfree_skb(skb, FREE_READ);
return NULL;
}
/* Determine the position of this fragment. */
end = offset + ntohs(iph->ip_len) - ihl;
/* Point into the IP datagram 'data' part. */
ptr = (unsigned char *)(skb->data + ihl);
/* Is this the final fragment? */
if ((flags & IP_MF) == 0)
qp->len = end;
/*
Find out which fragments are in front and at the back of us in the
chain of fragments so far. We must know where to put this
fragment, right?
*/
prev = NULL;
for (next = qp->fragments; next != NULL; next = next->next) {
if (next->offset >= offset)
break; /* bingo! */
prev = next;
}
/*
We found where to put this one. Check for overlap with preceding
fragment, and, if needed, align things so that any overlaps are
eliminated.
*/
if (prev != NULL && offset < prev->end) {
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERLAP, iph, 0);
i = prev->end - offset;
offset += i; /* ptr into datagram */
ptr += i; /* ptr into fragment data */
}
/*
Look for overlap with succeeding segments.
If we can merge fragments, do it.
*/
for (tmp = next; tmp != NULL; tmp = tfp) {
tfp = tmp->next;
if (tmp->offset >= end)
break; /* no overlaps at all */
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERLAP, iph, 0);
i = end - next->offset; /* overlap is 'i' bytes */
tmp->len -= i; /* so reduce size of */
tmp->offset += i; /* next fragment */
tmp->ptr += i;
/*
If we get a frag size of <= 0, remove it and the packet that it
goes with. We never throw the new frag away, so the frag being
dumped has always been charged for.
*/
if (tmp->len <= 0) {
if (tmp->prev != NULL)
tmp->prev->next = tmp->next;
else
qp->fragments = tmp->next;
if (tmp->next != NULL)
tmp->next->prev = tmp->prev;
next = tfp; /* We have killed the original next frame */
frag_kfree_skb(tmp->skb, FREE_READ);
frag_kfree_s(tmp, sizeof(struct ipfrag));
}
}
/* Insert this fragment in the chain of fragments. */
tfp = NULL;
tfp = ip_frag_create(offset, end, skb, ptr);
/*
No memory to save the fragment - so throw the lot. If we failed
the frag_create we haven't charged the queue.
*/
if (!tfp) {
nids_params.no_mem("ip_defrag");
kfree_skb(skb, FREE_READ);
return NULL;
}
/* From now on our buffer is charged to the queues. */
tfp->prev = prev;
tfp->next = next;
if (prev != NULL)
prev->next = tfp;
else
qp->fragments = tfp;
if (next != NULL)
next->prev = tfp;
/*
OK, so we inserted this new fragment into the chain. Check if we
now have a full IP datagram which we can bump up to the IP
layer...
*/
if (ip_done(qp)) {
skb2 = ip_glue(qp); /* glue together the fragments */
fprintf(stderr,"this is ipfragment.sd");
return (skb2);
}
return (NULL);
}
void GreensFunction3DRadInf::makeRnTable(RealVector& RnTable,
Real r, Real t) const
{
RnTable.clear();
const Real sigma(getSigma());
const Real D(getD());
const Real kf(getkf());
{
// First, estimate the size of p_corr, and if it's small enough,
// we don't need to calculate it in the first place.
const Real pirr(p_irr(r, t, r0, kf, D, sigma));
const Real ipfree_max(ip_free(M_PI, r, t) * 2 * M_PI * r * r);
if(fabs((pirr - ipfree_max) / ipfree_max) < 1e-8)
{
return;
}
}
const Real pfreemax(p_free_max(r, r0, t, D));
gsl_integration_workspace*
workspace(gsl_integration_workspace_alloc(2000));
Real Rn_prev(0.0);
const Real RnFactor(1.0 / (4.0 * M_PI * sqrt(r * r0)));
const Real integrationTolerance(pfreemax / RnFactor * THETA_TOLERANCE);
const Real truncationTolerance(pfreemax * THETA_TOLERANCE * 1e-1);
unsigned int n(0);
for (;;)
{
const Real Rn(this->Rn(n, r, t, workspace,
integrationTolerance));
RnTable.push_back(Rn);
// truncate when converged enough.
const Real absRn(fabs(Rn));
if(absRn * RnFactor < truncationTolerance &&
absRn < Rn_prev)
{
break;
}
if(n >= this->MAX_ORDER)
{
log_.info("GreensFunction3DRadInf: Rn didn't converge");
break;
}
Rn_prev = fabs(Rn);
++n;
}
gsl_integration_workspace_free(workspace);
}
/* Process an incoming IP datagram fragment. */
struct sk_buff *ip_defrag(struct sk_buff *skb)
{
struct iphdr *iph = skb->nh.iph;
struct ipfrag *prev, *next, *tmp, *tfp;
struct ipq *qp;
unsigned char *ptr;
int flags, offset;
int i, ihl, end;
ip_statistics.IpReasmReqds++;
/* Start by cleaning up the memory. */
if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
ip_evictor();
/*
* Look for the entry for this IP datagram in the
* "incomplete datagrams" queue. If found, the
* timer is removed.
*/
qp = ip_find(iph, skb->dst);
/* Is this a non-fragmented datagram? */
offset = ntohs(iph->frag_off);
flags = offset & ~IP_OFFSET;
offset &= IP_OFFSET;
offset <<= 3; /* offset is in 8-byte chunks */
ihl = iph->ihl * 4;
/*
* Check whether to create a fresh queue entry. If the
* queue already exists, its timer will be restarted as
* long as we continue to receive fragments.
*/
if (qp) {
/* ANK. If the first fragment is received,
* we should remember the correct IP header (with options)
*/
if (offset == 0) {
/* Fragmented frame replaced by unfragmented copy? */
if ((flags & IP_MF) == 0)
goto out_freequeue;
qp->ihlen = ihl;
memcpy(qp->iph, iph, (ihl + 8));
}
} else {
/* Fragmented frame replaced by unfragmented copy? */
if ((offset == 0) && ((flags & IP_MF) == 0))
goto out_skb;
/* If we failed to create it, then discard the frame. */
qp = ip_create(skb, iph);
if (!qp)
goto out_freeskb;
}
/* Attempt to construct an oversize packet. */
if((ntohs(iph->tot_len) + ((int) offset)) > 65535)
goto out_oversize;
/* Determine the position of this fragment. */
end = offset + ntohs(iph->tot_len) - ihl;
/* Is this the final fragment? */
if ((flags & IP_MF) == 0)
qp->len = end;
/* Find out which fragments are in front and at the back of us
* in the chain of fragments so far. We must know where to put
* this fragment, right?
*/
prev = NULL;
for(next = qp->fragments; next != NULL; next = next->next) {
if (next->offset >= offset)
break; /* bingo! */
prev = next;
}
/* Point into the IP datagram 'data' part. */
ptr = skb->data + ihl;
/* We found where to put this one. Check for overlap with
* preceding fragment, and, if needed, align things so that
* any overlaps are eliminated.
*/
if ((prev != NULL) && (offset < prev->end)) {
i = prev->end - offset;
offset += i; /* ptr into datagram */
ptr += i; /* ptr into fragment data */
}
/* Look for overlap with succeeding segments.
* If we can merge fragments, do it.
*/
for (tmp = next; tmp != NULL; tmp = tfp) {
tfp = tmp->next;
if (tmp->offset >= end)
break; /* no overlaps at all */
i = end - next->offset; /* overlap is 'i' bytes */
tmp->len -= i; /* so reduce size of */
tmp->offset += i; /* next fragment */
tmp->ptr += i;
/* If we get a frag size of <= 0, remove it and the packet
* that it goes with.
*/
if (tmp->len <= 0) {
if (tmp->prev != NULL)
tmp->prev->next = tmp->next;
else
qp->fragments = tmp->next;
if (tmp->next != NULL)
tmp->next->prev = tmp->prev;
/* We have killed the original next frame. */
next = tfp;
frag_kfree_skb(tmp->skb);
frag_kfree_s(tmp, sizeof(struct ipfrag));
}
}
/*
* Create a fragment to hold this skb.
* No memory to save the fragment? throw the lot ...
*/
tfp = ip_frag_create(offset, end, skb, ptr);
if (!tfp)
goto out_freeskb;
/* Insert this fragment in the chain of fragments. */
tfp->prev = prev;
tfp->next = next;
if (prev != NULL)
prev->next = tfp;
else
qp->fragments = tfp;
if (next != NULL)
next->prev = tfp;
/* OK, so we inserted this new fragment into the chain.
* Check if we now have a full IP datagram which we can
* bump up to the IP layer...
*/
if (ip_done(qp)) {
/* Glue together the fragments. */
skb = ip_glue(qp);
/* Free the queue entry. */
out_freequeue:
ip_free(qp);
out_skb:
return skb;
}
/*
* The queue is still active ... reset its timer.
*/
out_timer:
mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time); /* ~ 30 seconds */
out:
return NULL;
/*
* Error exits ... we need to reset the timer if there's a queue.
*/
out_oversize:
if (net_ratelimit())
printk(KERN_INFO "Oversized packet received from %d.%d.%d.%d\n",
NIPQUAD(iph->saddr));
/* the skb isn't in a fragment, so fall through to free it */
out_freeskb:
kfree_skb(skb);
ip_statistics.IpReasmFails++;
if (qp)
goto out_timer;
goto out;
}
//
// 输入:
// 一个给定的ip队列，这个队列应该是完整的
// 返回:
// 一个ip报文
static char *
ip_glue(struct ipq * qp)
{
char *skb;
// 指向一个ip，到时候用来给新生成的ip字段赋值
struct ip *iph;
// 指向一个ip碎片
struct ipfrag *fp;
// 执向一个字节
unsigned char *ptr;
// 计数器、长度
int count, len;
/* Allocate a new buffer for the datagram. */
// 长度 = 头长度 + 队列长度, 队列是所有ip碎片，不包括头长度
len = qp->ihlen + qp->len;
// 如果大于65535B 太大了，返回
if (len > 65535)
{
// NETDEBUG(printk("Oversized IP packet from %s.\n", int_ntoa(qp->iph->ip_src.s_addr)));
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERSIZED, qp->iph, 0);
ip_free(qp);
return NULL;
}
// 如果使用malloc失败，返回
if ((skb = (char *) malloc(len)) == NULL)
{
// NETDEBUG(printk("IP: queue_glue: no memory for gluing queue %p\n", qp));
nids_params.no_mem("ip_glue");
ip_free(qp);
return (NULL);
}
/* Fill in the basic details. */
// 首先将指针，指向skb，一个最新分配的空间
ptr = (unsigned char *)skb;
// 将头拷贝过来
memcpy(ptr, ((unsigned char *) qp->iph), qp->ihlen);
ptr += qp->ihlen;
// count应该是用来记录偏移量的
count = 0;
/* Copy the data portions of all fragments into the new buffer. */
// 遍历队列中的所有碎片
fp = qp->fragments;
while (fp != NULL)
{
// 如果碎片大小为0， 或者， 碎片的偏移量过大， 则出错，释放空间，返回
if (fp->len < 0 || fp->offset + qp->ihlen + fp->len > len)
{
//NETDEBUG(printk("Invalid fragment list: Fragment over size.\n"));
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_INVLIST, qp->iph, 0);
ip_free(qp);
//kfree_skb(skb, FREE_WRITE);
//ip_statistics.IpReasmFails++;
free(skb);
return NULL;
}
// 否则拷贝当前碎片
memcpy((ptr + fp->offset), fp->ptr, fp->len);
// 长度增加(通常这个会是fp->end - fp->offset -1)
count += fp->len;
fp = fp->next;
}
/* We glued together all fragments, so remove the queue entry. */
// 循环结束之后，释放当前队列--因为出列结束而释放
ip_free(qp);
/* Done with all fragments. Fixup the new IP header. */
// 将最新生成的ip结构保存下来
iph = (struct ip *) skb;
// 偏移量初始化为0
iph->ip_off = 0;
// 计算长度
iph->ip_len = htons((iph->ip_hl * 4) + count);
// skb->ip_hdr = iph;
// 返回生成的ip
return (skb);
}
// 每重组一个ip碎片，就会更新对应ipq的timer
//
//
static char *
ip_defrag(struct ip *iph, struct sk_buff *skb)
{
struct ipfrag *prev, *next, *tmp;
// 指向一个碎片
struct ipfrag *tfp;
// 指向一个队列
struct ipq *qp;
// 用来放返回值
char *skb2;
// 用来进行字节操作
unsigned char *ptr;
int flags, offset;
int i, ihl, end;
// 如果成功更新全局变量this_host, 并且skb是有内容的
if (!hostfrag_find(iph) && skb)
// 生成一个碎片
hostfrag_create(iph);
/* Start by cleaning up the memory. */
// 如果当前host不为空
if (this_host)
// 如果大于上限
if (this_host->ip_frag_mem > IPFRAG_HIGH_THRESH)
// 裁剪掉一些ip碎片，直到 ip_frag_mem < IPFRAG_LOW_THRESH
ip_evictor();
/* Find the entry of this IP datagram in the "incomplete datagrams" queue. */
// 如果host存在
if (this_host)
// 找到与这个ip头相关的ip队列
qp = ip_find(iph);
else
// 否则设置队列为空
qp = 0;
/* Is this a non-fragmented datagram? */
// ip_off是一个16位的字段，高3位用来保存标志信息，低12位用来保存当前碎片的偏移
offset = ntohs(iph->ip_off); /* 先把ip_offset这个字段取出来 */
// 把高3位取出来
flags = offset & ~IP_OFFSET;
// 把低13位取出来
offset &= IP_OFFSET;
// IP_MF==0表示当前收到是碎片后面没有碎片了，并且当前收到碎片是第一个碎片，
// 显然当前碎片虽在的ip报文仅仅有一个碎片
// 那么当前碎片(刚刚收到的碎片)并不需要重组，因此可以返回了
if (((flags & IP_MF) == 0) && (offset == 0))
{
// 如果队列不为空就释放掉
if (qp != NULL)
ip_free(qp); /* Fragmented frame replaced by full unfragmented copy */
return 0;
}
/* ip_evictor() could have removed all queues for the current host */
// 如果host全部被移出了，那么重新创建一个，针对当前ip头的host
// 但是，这个host并不会包括任何东西，它是一个空的，没有ip队列
if (!this_host)
hostfrag_create(iph);
// 计算offset和头长度
// 这个offset是刚刚收到的这个碎片的offset
offset <<= 3; /* offset is in 8-byte chunks */
ihl = iph->ip_hl * 4;
/*
If the queue already existed, keep restarting its timer as long as
we still are receiving fragments. Otherwise, create a fresh queue
entry.
*/
// 如果队列存在
if (qp != NULL)
{
/* ANK. If the first fragment is received, we should remember the correct
IP header (with options) */
// 如果偏移量为0，可能是该pi报文中的第一个碎片，因此要把前8字节保存下来
if (offset == 0)
{
// 保存头长度
qp->ihlen = ihl;
// 拷贝头信息+8字节
memcpy(qp->iph, iph, ihl + 8);
}
// 停止计时
del_timer(&qp->timer);
// 重新计时
qp->timer.expires = jiffies() + IP_FRAG_TIME; /* about 30 seconds */
// 设置关联
qp->timer.data = (unsigned long) qp; /* pointer to queue */
// 注册回调函数
qp->timer.function = ip_expire; /* expire function */
// 添加计数器
add_timer(&qp->timer);
}
// 否则队列不存在
else
{
/* If we failed to create it, then discard the frame. */
// 试图创建一个
if ((qp = ip_create(iph)) == NULL)
{
// 如果创建队列失败，那么释放当前碎片的空间并返回
kfree_skb(skb, FREE_READ);
return NULL;
}
}
/* Attempt to construct an oversize packet. */
// 如果头+长度 超长， 释放空间
if (ntohs(iph->ip_len) + (int) offset > 65535)
{
// NETDEBUG(printk("Oversized packet received from %s\n", int_ntoa(iph->ip_src.s_addr)));
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERSIZED, iph, 0);
kfree_skb(skb, FREE_READ);
return NULL;
}
/* Determine the position of this fragment. */
// 刚刚收到的碎片分组 + 刚刚收到的碎片ip包大小 - 刚刚收到的碎片ip包头大小
// = 刚刚收到的分组的结尾
end = offset + ntohs(iph->ip_len) - ihl;
/* Point into the IP datagram 'data' part. */
// 将指针，指向刚刚收到的碎片ip包的数据开头部分
// prt 指向肉
ptr = (unsigned char *)(skb->data + ihl);
/* Is this the final fragment? */
// 如果这是最后一个碎片，那么，整个队列的长度，就是当前的end
// 否则qp->len会在后面更改，因为会有重叠部分
if ((flags & IP_MF) == 0)
qp->len = end;
/*
Find out which fragments are in front and at the back of us in the
chain of fragments so far. We must know where to put this
fragment, right?
*/
prev = NULL;
// 给定一个offset,在所有的fragments中找到第一个
// 拥有不小于给定offset的offset的碎片，然后终止循环
// 由此可以猜测，这一个函数，其实是将某一个新来的碎片插入到
// 队列合适的位置，保证offset升序排列
// next 指向的是第一个不小于当前offset的碎片
// pre指向的是前一个碎片
for (next = qp->fragments; next != NULL; next = next->next)
{
if (next->offset >= offset)
break; /* bingo! */
prev = next;
}
/*--------------------------------------------------------------
注意:
next 指向的是第一个排在当前碎片后面的 碎片；
pre 指向的是第一个排在当前碎片前面的 碎片。
next 有可能offset与当前碎片的offset一样
----------------------------------------------------------------*/
/*
We found where to put this one. Check for overlap with preceding
fragment, and, if needed, align things so that any overlaps are
eliminated.
*/
// 如果有排在当前碎片前面的分组，并且， 该分组的结束比当前分组的offset大
// 说明有重叠，应噶修正当前offset，以先来的为准
if (prev != NULL && offset < prev->end)
{
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERLAP, iph, 0);
i = prev->end - offset;
// 将当前收到的碎片的offset增加i
offset += i; /* ptr into datagram */
// 将当前收到的碎片的指正向后移动i
ptr += i; /* ptr into fragment data */
}
/*
Look for overlap with succeeding segments.
If we can merge fragments, do it.
*/
// 现在往后查看是否有重叠的
// 从next开始
for (tmp = next; tmp != NULL; tmp = tfp)
{
// temp总是等于next
tfp = tmp->next;
// 如果next的 offset >= 当前分组的end，那就没有问题
if (tmp->offset >= end)
break; /* no overlaps at all */
// 否则警报
nids_params.syslog(NIDS_WARN_IP, NIDS_WARN_IP_OVERLAP, iph, 0);
// 记录当前的结束与下一个碎片的开始重叠多少
i = end - next->offset; /* overlap is 'i' bytes */
// 将next碎片的长度减少i
tmp->len -= i; /* so reduce size of */
// 将next碎片的开始增加i
tmp->offset += i; /* next fragment */
// 将指针也要向后移动i
tmp->ptr += i;
/*
If we get a frag size of <= 0, remove it and the packet that it
goes with. We never throw the new frag away, so the frag being
dumped has always been charged for.
*/
// 如果此时next碎片的长度小于0， 那么摘掉next节点
if (tmp->len <= 0)
{
if (tmp->prev != NULL)
tmp->prev->next = tmp->next;
else
qp->fragments = tmp->next;
if (tmp->next != NULL)
tmp->next->prev = tmp->prev;
// tfp原来就等于next->next，所以原来的next节点被摘掉了
next = tfp; /* We have killed the original "next" frame */
// 释放掉frag节点对应的内存
frag_kfree_skb(tmp->skb, FREE_READ);
// 释放掉frag节点
frag_kfree_s(tmp, sizeof(struct ipfrag));
}
}
/* Insert this fragment in the chain of fragments. */
tfp = NULL;
// offset是刚刚接收到的碎片偏移，按字节
// end 是刚刚接收到的碎片的结束字节
// skb 是传进来的一个内存空间，应该事先分配好
// prt 是指向这个碎片第一个数据的指针
tfp = ip_frag_create(offset, end, skb, ptr);
/*---------------------------------------------------
注意:
ip_frag_create函数只是创建一个ip_frag，还没有吧
它挂载到队列中
-----------------------------------------------------*/
/*
No memory to save the fragment - so throw the lot. If we failed
the frag_create we haven't charged the queue.
*/
if (!tfp)
{
nids_params.no_mem("ip_defrag");
kfree_skb(skb, FREE_READ);
return NULL;
}
/* From now on our buffer is charged to the queues. */
// 将刚刚创建的ip_frag挂载到队列中去了
tfp->prev = prev;
tfp->next = next;
if (prev != NULL)
prev->next = tfp;
else
qp->fragments = tfp;
if (next != NULL)
next->prev = tfp;
/*
OK, so we inserted this new fragment into the chain. Check if we
now have a full IP datagram which we can bump up to the IP
layer...
*/
// 检查是否完整
if (ip_done(qp))
{
skb2 = ip_glue(qp); /* glue together the fragments */
return (skb2);
}
// 如果没有完整，那么返回空，继续执行
return (NULL);
}
int main(int argc, char **argv)
{
int k, ec=0;
FILE *f=NULL;
bfspace *p=NULL;
ip *i=NULL;
cell w,h;
int ssize = DEFAULT_STACK_SIZE;
int sssize = DEFAULT_STACKSTACK_SIZE;
global_argv = argv;
global_argc = argc;
if (argc < 2)
usage();
fungeprog_arg = -1;
for(k=1; k<argc; k++)
{
#ifndef FBBI_MINIMAL
if((!strcmp(argv[k], "-F")) || (!strcmp(argv[k], "-not-fast")) || (!strcmp(argv[k], "--not-fast"))) fast=0;
if((!strcmp(argv[k], "-f")) || (!strcmp(argv[k], "-fast")) || (!strcmp(argv[k], "--fast"))) fast=1;
if((!strcmp(argv[k], "-w")) || (!strcmp(argv[k], "-warn")) || (!strcmp(argv[k], "--warn"))) warn=1;
if((!strcmp(argv[k], "-t")) || (!strcmp(argv[k], "-trace")) || (!strcmp(argv[k], "--trace"))) trace=1;
if((!strcmp(argv[k], "-s")) || (!strcmp(argv[k], "-script")) || (!strcmp(argv[k], "--script"))) script = 1;
if((!strcmp(argv[k], "-u")) || (!strcmp(argv[k], "-unefunge")) || (!strcmp(argv[k], "--unefunge"))) une = 1;
if((!strcmp(argv[k], "-93")) || (!strcmp(argv[k], "-befunge93")) || (!strcmp(argv[k], "--befunge-93")) || (!strcmp(argv[k], "--befunge93"))) b93 = 1;
if((!strcmp(argv[k], "-mc")) || (!strcmp(argv[k], "-maxcells")) || (!strcmp(argv[k], "--max-cells")) || (!strcmp(argv[k], "--maxcells")))
{
ssize = atoi(argv[++k]);
} else if((!strcmp(argv[k], "-ms")) || (!strcmp(argv[k], "-maxstacks")) || (!strcmp(argv[k], "--max-stacks")) || (!strcmp(argv[k], "--maxstacks")))
{
sssize = atoi(argv[++k]);
} else
#endif
if(argv[k][0] != '-') {
fungeprog_arg = k;
break;
}
}
if (fungeprog_arg == -1)
usage();
/* initialize */
srand(time(0));
DEBUG("Allocating Funge-Space");
if ((p = bfspace_alloc(NULL)) != NULL)
{
DEBUG("Allocating IP");
if ((i = ip_alloc(p, ssize, sssize)) != NULL)
{
DEBUG("Opening Source File");
if ((f=fopen(argv[fungeprog_arg],"r")) != NULL)
{
#ifdef FBBI_MSDOS
#ifndef FBBI_ANSI
setmode(fileno(f), O_BINARY);
#endif
#endif
DEBUG("Reading Source File");
if (bfspace_fread(i->bs, f, 0, 0, &w, &h, 0))
{
fclose(f);
#ifndef FBBI_MINIMAL
if ((w > 79) || (h > 24))
{
if(b93 && warn)
fprintf(stderr, "fbbi warning: "
"source too large for Befunge-93-Space (%ld x %ld)\n", w+1, h+1);
}
if (h >= 1)
{
if(une && warn)
fprintf(stderr, "fbbi warning: "
"source too large for Unefunge-98-Space (%ld x %ld)\n", w+1, h+1);
}
if (script)
{
while (bfspace_fetch(i->bs, 0, i->y)
== ((long)0 | (long)'#'))
i->y++;
}
#endif
DEBUG("* Begin Interpret *");
while (!i->hm)
{
DEBUG("Moving IP");
ip_move(i);
#ifndef FBBI_MINIMAL
if(bpt && i->x == bx && i->y == by) trace=1;
#endif
DEBUG("Getting Instruction");
i->ir = bfspace_fetch(i->bs, i->x, i->y);
#ifndef FBBI_MINIMAL
if (b93 && ((i->x < 0) || (i->y < 0) || (i->x > 79) || (i->y > 24)) )
{
if(warn)
fprintf(stderr, "fbbi warning: "
"beyond Befunge-93-Space at (%ld,%ld)\n", i->x, i->y);
}
if (trace)
{
perform_trace(i);
if (i->hm) break;
}
#endif
DEBUG("Executing Instruction");
if (i->sm && ((char)i->ir != '"'))
{
ip_push(i, i->ir);
} else
{
if ((i->ir < 32) || (i->ir > 126))
{
fi_unimp(i);
} else
{
#ifndef FBBI_MINIMAL
if(b93) b93instable[(char)i->ir-32](i);
else
#endif
instable[(char)i->ir-32](i);
}
}
}
DEBUG("* End Interpret *");
ec = (int)i->ec;
DEBUG("Freeing IP");
ip_free(i);
DEBUG("Freeing Funge-Space");
bfspace_free(p);
} else
{
DEBUG("Freeing IP");
ip_free(i);
DEBUG("Freeing Funge-Space");
bfspace_free(p);
fclose(f);
#ifndef FBBI_MINIMAL
fprintf(stderr, "fbbi error: can't load file\n");
#endif
exit(1);
}
} else
{
DEBUG("Freeing IP");
ip_free(i);
DEBUG("Freeing Funge-Space");
bfspace_free(p);
#ifndef FBBI_MINIMAL
fprintf(stderr, "fbbi error: can't open file\n");
#endif
exit(1);
}
} else
{
DEBUG("Freeing Funge-Space");
bfspace_free(p);
#ifndef FBBI_MINIMAL
fprintf(stderr, "fbbi error: can't allocate ip\n");
#endif
exit(1);
}
} else
{
#ifndef FBBI_MINIMAL
fprintf(stderr, "fbbi error: can't allocate befunge-space\n");
#endif
exit(1);
}
return ec;
}