// Copyright (c) 2006-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// ip6_frag.cpp - hook for IPv6 fragment header

//

#include "frag.h"

#include <icmp6_hdr.h>	// for ICMP Type symbols

#include <ext_hdr.h>	// for IPv6 fragment header

#include "ip6_frag.h"

#include <in_pkt.h>

#include <in_chk.h>

#include <timeout.h>

#include "tcpip_ini.h"

#include "inet6log.h"

//	TIp6FragmentHeader

//	******************

//	This header is at the beginning of each fragment in the

//	fragment queue. This attempts to be the same size as

//	the real IPv6 fragment header (8 octets), but the code

//	should work with any size of this [use of this specific

//	size avoids some TrimStart() calls in some cases.]

//

class TIp6FragmentHeader

	{

public:

	TUint iOffset;		// Offset of this fragment (bytes)

	TUint iLength;		// Lenght of this fragment (bytes)

	};

//

//	RIp6Fragment

//	************

//	The IP6 fragment data structure is an RMBufChain containing

//	- TIp6FragmentHeader

//	- followed by fragment content

//	This is the interface to the RMBufFragQ class, a collection

//	of required methods for accessing the fragment information and

//	a join operation.

//

class RIp6Fragment : public RMBufFrag

	{

public:

	// Internal utility to the other methods. Assumes that the fragment

	// start is properly aligned to be cast into class pointer.

	inline TIp6FragmentHeader *Header() const { return (TIp6FragmentHeader *)(First()->Ptr()); }

	// Return offset of the fragment (bytes)

	TUint Offset() const {return Header()->iOffset;}

	// Return length of the fragment (bytes)

	// (Does not include the fragment header, using

	// this->Length() will give larger value that

	// includes the header)

	TUint FragmentLength() const {return Header()->iLength;}

	// Join another fragment to this one

	void Join(RIp6Fragment& aFrag)

		{

		TInt overlap = Offset() + FragmentLength() - aFrag.Offset();

		if (overlap < 0)

			{

			aFrag.Free();	// Should panic? This should not happen!

			User::Panic(_L("DEBUG"), 0);

			}

		else

			{

			Header()->iLength += aFrag.FragmentLength() - overlap;

			aFrag.TrimStart(sizeof(TIp6FragmentHeader) + overlap);

			Append(aFrag);

			}

		}

	};

//

//	CFragmentHandler

//	****************

//

class CAssembly;

class CFragmentHandler : public CFragmentHeaderHook

	{

public:

	CFragmentHandler(MNetworkService *aNetwork) : CFragmentHeaderHook(aNetwork) {}

	~CFragmentHandler();

	inline MNetworkService *Network() { return iNetwork; }

	CAssembly *LookupL(const RMBufRecvInfo &aInfo, TUint32 aId, TUint aVersion);

	void ConstructL();

	void Cancel(CAssembly *aAssembly);

	void CancelAll();

	TInt ApplyL(RMBufHookPacket &aPacket, RMBufRecvInfo &aInfo);

	void Fragment(RMBufPacketBase &aPacket, TInt aMtu, RMBufPktQ &aFragQ);

	MTimeoutManager *iTimeoutManager;

	CAssembly *iCache;

	//

	TInt iCount;	// Current incomplete assemblies

	TInt iMaxCount;	// Maximum number of assemblies

	TInt iTotal;	// Total amount of RMBuf space allocated to assemblies (bytes)

	TInt iMaxTotal;	// Maximum allowed amount of RMBuf space

private:

	TInt Ip6ApplyL(RMBufRecvPacket &aPacket, RMBufRecvInfo &aInfo, const TInet6HeaderFragment &aHdr);

	TInt Ip4ApplyL(RMBufRecvPacket &aPacket, RMBufRecvInfo &aInfo, const TInet6HeaderIP4 &aHdr);

	void Ip6Fragment(RMBufPacketBase &aPacket, TInt aMtu, RMBufPktQ &aFragQ, TInet6HeaderIP &aHdr);

	void Ip4Fragment(RMBufPacketBase &aPacket, TInt aMtu, RMBufPktQ &aFragQ, TInet6HeaderIP4 &aHdr);

	//

	// iFagmentId is only used for IPv6. For IPv4, the Id is already in

	// in each IP packet.

	//

	TInt iFragmentId;

	};

//

//	CAssembly

//	*********

//	The data structure for a partially assembled packet

//

class CAssembly : public CBase

	{

	friend class CFragmentHandler;

	friend class CFragmentLinkage;

	CAssembly(CFragmentHandler &aHandler, const TIp6Addr &aSrc, const TIp6Addr &aDst, TInt aId, TInt aVersion);

	~CAssembly();

	TInt AddFragmentL(RMBufRecvPacket &aPacket, TInt aTrim, TInt aLength, TInt aOffset, TUint32 aFh0);

	TInt Add(RMBufRecvPacket &aPacket, TInt aTrim, TInt aLength, TInt aOffset, TUint32 aFh0 = 0);

	TInt CompletePacket(TInt aRestoreFH = 0);

	void Timeout();

public:

	//

	// Linkage and management

	//

	CFragmentHandler &iHandler;

	CAssembly *iNext;		// Linkage of the assemblies in the cache

	RTimeout iTimeout;		// Timer hook

#ifndef _LOG

protected:

#endif

	const TUint8 iVersion;	// Need to have, because TAHI wants FH in IPv6 TimeExceeded ICMP

	TUint iIsDead:1;		// =1, if this assembly is "dead" (matching fragments are dropped)

	const TUint32 iId;		// Fragment identification

	const TIp6Addr iSrcAddr;

	const TIp6Addr iDstAddr;

	TUint32 iFH0;			// Saved first 32 bits of the first FH (for TAHI)

	TInt32 iLength;			// Total length of the fragmentable part, when

							// known (e.g. last fragment received).

							// [As 32 bit int is used, there shouuld be no

							// overflow or wrap around problems because

							// offset field is only 16 bits (in bytes)]

	TInt iTotal;			// The amount of "iTotal" from this assembly.

	//

	// The unfragmentable part of the first fragment (if received)

	//

	RMBufRecvPacket iHead;

	RMBufFragQ<RIp6Fragment> iQueue;

	};

//

//	CFragmentLinkage

//	****************

//	Glue to bind timeout callback from the timeout manager into Timeout() call

//	on the CAssembly.

//

//	*NOTE*

//		This kludgery is all static and compile time, and only used in the constructor

//		of CFragmentAssembly following this.

//

// This ungainly manoevure is forced on us because the offset is not evaluated early enough by GCC3.4 to be

// passed as a template parameter

#if defined(__X86GCC__) || defined(__GCCE__)

#define KAssemblyTimeoutOffset 12

__ASSERT_COMPILE(KAssemblyTimeoutOffset == _FOFF(CAssembly, iTimeout));

#else

#define KAssemblyTimeoutOffset _FOFF(CAssembly, iTimeout)

#endif

class CFragmentLinkage : public TimeoutLinkage<CAssembly, KAssemblyTimeoutOffset>

	{

public:

	static void Timeout(RTimeout &aLink, const TTime & /*aNow*/, TAny * /*aPtr*/)

		{

		Object(aLink)->Timeout();

		}

	};

#ifdef _LOG

//

//	LogPrintId

//	**********

//	Purely for LOG output, should not be compiled in the final release

//

static void LogPrintId(const TDesC &aText, const CAssembly &a)

	{

	TInetAddr src, dst;

	TBuf<70> sbuf;

	TBuf<70> dbuf;

	src.SetAddress(a.iSrcAddr);

	dst.SetAddress(a.iDstAddr);

	src.OutputWithScope(sbuf);

	dst.OutputWithScope(dbuf);

	Log::Printf(_L("%S [src=%S dst=%S id=%d] (%d)"), &aText, &sbuf, &dbuf, a.iId, a.iHandler.iCount);

	}

#endif

//

//	CFragmentHandler::Cancel

//	************************

//	Cancel a specific assembly (delete it)

//

void CFragmentHandler::Cancel(CAssembly *aAssembly)

	{

	for (CAssembly **h = &iCache; *h != NULL; h = &(*h)->iNext)

		if (aAssembly == *h)

			{

			*h = aAssembly->iNext;

			delete aAssembly;

			break;

			}

	// Should panic, if a was not found from the list! -- msa

	}

//

//	CFragmentHandler::CancelAll

//	***************************

//	Cancel all packets waiting for assembly (delete all)

//

void CFragmentHandler::CancelAll()

	{

	CAssembly *a;

	while ((a = iCache) != NULL)

		{

		iCache = a->iNext;

		delete a;

		}

	}

//

//	ApplyL

//	******

//	Called when an IP packet contain IPv6 fragment header.

//	(does not care whether outer IP header is v4 or v6, both work!)

//

TInt CFragmentHandler::ApplyL(RMBufHookPacket &aPacket, RMBufRecvInfo &aInfo)

	{

	for (;;)	// *NOT REAL LOOP, JUST A CONSTRUCT TO ENABLE USE OF 'break!

		{

		if (aInfo.iProtocol != STATIC_CAST(TInt, KProtocolInet6Fragment))

			break;	// Incorrect call, should only get IPv6 fragments here!

		TInet6Packet<TInet6HeaderFragment> fh(aPacket, aInfo.iOffset);

		if (fh.iHdr == NULL)

			break;	// Drop! (packet too short)

		if (aInfo.iIcmp == 0)

			return Ip6ApplyL(aPacket, aInfo, *fh.iHdr);

		if (aInfo.iIcmp != KProtocolInet6Icmp)

			break;	// Only IPv6 complaints should get this far, drop!

		const TInt offset = aInfo.iOffset - aInfo.iOffsetIp;	// Relative offset within problem packet

		if (aInfo.iType == KInet6ICMP_ParameterProblem &&	// A parameter problem...

			offset <= (TInt)aInfo.iParameter &&				// after start of this header?

			STATIC_CAST(TUint, offset + sizeof(TInet6HeaderFragment)) > STATIC_CAST(TUint, aInfo.iParameter))		// and before end of this header?

				break;		// Drop! (someone doesn't like my fragments!)

		//

		// Error is not Fragment Header specific, pass it on in the chain

		// Skip over header, pass error processing to the next header

		aInfo.iPrevNextHdr = (TUint16)aInfo.iOffset;	// Fragment next header is at +0

		aInfo.iProtocol = fh.iHdr->NextHeader();

		aInfo.iOffset += sizeof(TInet6HeaderFragment);

		return KIp6Hook_DONE;

		// WAS NOT LOOP, BE SURE TO EXIT IT ALWAYS!

		}

	aPacket.Free();

	return -1;

	}

//

//	Fragment

//	********

//	Called when an outgoing IP packet needs to be fragmented

//

void CFragmentHandler::Fragment(RMBufPacketBase &aPacket, TInt aMtu, RMBufPktQ &aFragQ)

	{

	//

	// Decide on which fragmenting from the IP header.

	//

	TIpHeader *ip = ((RMBufPacketPeek &)aPacket).GetIpHeader();

	if (ip)

		if (ip->ip4.Version() == 4)

			Ip4Fragment(aPacket, aMtu, aFragQ, ip->ip4);

		else if (ip->ip4.Version() == 6)

			Ip6Fragment(aPacket, aMtu, aFragQ, ip->ip6);

	}

//	CAssembly

//	*********

//

CAssembly::CAssembly(CFragmentHandler &aHandler, const TIp6Addr &aSrc, const TIp6Addr &aDst, TInt aId, TInt aVersion)

 : iHandler(aHandler), iTimeout(CFragmentLinkage::Timeout), iVersion((TUint8)aVersion), iId(aId),

	iSrcAddr(aSrc), iDstAddr(aDst), iLength(65536)

	{

	}

//	CAssembly::~CAssebly()

//	**********************

//

CAssembly::~CAssembly()

	{

	iHandler.iTotal -= iTotal;

	--iHandler.iCount;

	LOG(LogPrintId(_L("CAssebly::~CAssebly():"), *this));

	iTimeout.Cancel();

	iQueue.Free();

	iHead.Free();

	}

LOCAL_C TInt CompareStructures()

	{

	return sizeof(TIp6FragmentHeader) - sizeof(TInet6HeaderFragment);

	}

//

//	CAssembly::CompletePacket

//	*************************

//	Merge the iHead and first fragment into a complete packet

//	(including the IPv4/IPv6 header stuff!)

//

//	Returns,

//	== KErrNone, if packet in iHead built

//	!= KErrNone, if no packet available

//

//	*NOTE*

//		this is also used when reassembly timeout hits, thus the

//		"complete" can also be an incomplete packet (including

//		only the first fragment).

//

TInt CAssembly::CompletePacket(TInt aRestoreFH)

	{

	if (iHead.IsEmpty())

		return -1;

	RMBufRecvInfo *const info = iHead.Info();

	RIp6Fragment first;

	iQueue.Remove(first);

	TInt length = first.Header()->iLength;

	ASSERT(first.Header()->iOffset == 0);

	if (aRestoreFH)

		{

		// *********************************************************

		// TAHI tester wants the returned ICMP to include the FH on

		// time exceeded message. This is for that...

		// *********************************************************

		const TInt adjust = CompareStructures();

		// As the value of adjust is known by compile time, compiler should eliminate

		// unnecessary code below (although, it may give a warnings about constants

		// being compared--this is indication that code elimination should work!)

		if (adjust > 0)

			first.TrimStart(adjust);

		else if (adjust < 0)

			{

			TInt err = first.Prepend(-adjust);

			if (err!=KErrNone)

				{

				first.Free();

				return -1;

				}

			}

		TInet6HeaderFragment fake_fh;

		*(TUint32 *)&fake_fh = iFH0;	// Saved 1st word of original FH

		fake_fh.SetId(iId);				// ..and this SetId cover all of FH

										// (there is no need to zero anything else)

		first.CopyIn(TPtrC8((TUint8 *)&fake_fh, sizeof(TInet6HeaderFragment)), 0);

		// .. ugh, KProtocolInet6Fragment is TInt, casting to TUint8* might

		// cause "endian problems", thus this copy to true TUint8 variable... -- msa

		const TUint8 proto = KProtocolInet6Fragment;

		iHead.CopyIn(TPtrC8((TUint8 *)&proto, 1), info->iPrevNextHdr);

		length += sizeof(TInet6HeaderFragment);

		iLength = length;

		}

	else

		first.TrimStart(sizeof(TIp6FragmentHeader));

	if (length > iLength)

		{

		//

		// Just to deal with some overlapping fragment, which extends

		// beyond the last fragment... (iLength is initialized to

		// 65536 and is only less, when last fragment has arrived!)

		length = iLength;

		first.TrimEnd(length);

		}

	iHead.Append(first);

	//

	// Fix info and IP header

	//

	//

	// Only the iLength needs to be updated, all other fields in the info

	// must already have the correct values!

	//

	info->iLength = info->iOffset + length;

	TInet6Packet<TIpHeader> ip(iHead, info->iOffsetIp);

	if (ip.iHdr)

		{

		TInt ver = ip.iHdr->ip4.Version();

		if (ver == 4)

			{

			if (ip.iLength >= ip.iHdr->ip4.HeaderLength() &&

				info->iLength < 65536)

				{

				// ..just to be tidy, make sure M=0 (nobody really cares) -- msa

				ip.iHdr->ip4.SetFlags((TUint8)(ip.iHdr->ip4.Flags() & ~KInet4IP_MF));

				ip.iHdr->ip4.SetTotalLength(info->iLength);

				return KErrNone;

				}

			}

		else if (ver == 6)

			{

			if (ip.iLength >= TInet6HeaderIP::MinHeaderLength() &&

				  STATIC_CAST(TUint, info->iLength) < STATIC_CAST(TUint, 65536 + sizeof(TInet6HeaderIP)))

				{

				ip.iHdr->ip6.SetPayloadLength(info->iLength - sizeof(TInet6HeaderIP));

				return KErrNone;

				}

			}

		}

	return -1;

	}

//

//	CAssembly::Add

//	**********************

//

TInt CAssembly::Add(RMBufRecvPacket &aPacket, TInt aTrim, TInt aOffset, TInt aLength, TUint32 aFH0)

	{

		if (iIsDead == 0)

			{

			TInt ret = 0; // [ = 0, only to silence compiler]

			TRAPD(err, ret = AddFragmentL(aPacket, aTrim, aOffset, aLength, aFH0));

			if (err == KErrNone)

				return ret;

			//

			// AddFragmentL left, change the Assembly into "dead" state

			// (and make sure all unnecessary resources are released)

			//

			iIsDead = 1;

			iHead.Free();

			iQueue.Free();

			iHandler.iTotal -= iTotal;

			iTotal = 0;

			}

		ASSERT(iTotal == 0);

		//

		// The hook return code = -1 (=> packet handled and released)

		//

		aPacket.Free();

		return -1;

	}

//	CAssembly::AddFragmentL

//	***********************

//  This should only be called from Add, which must trap the leaves and 

//

//	returns

//		standard inbound hook return codes

//	leaves

//		when assembly should be declared "dead" (seed "Add")

//

TInt CAssembly::AddFragmentL(RMBufRecvPacket &aPacket, TInt aTrim, TInt aOffset, TInt aLength, TUint32 aFH0)

	{

	RMBufRecvInfo *info = aPacket.Info();

	if (aOffset == 0)

		{

		//

		// Processing the first fragment (offset == 0!)

		//

		if (!iHead.IsEmpty())

			aTrim += info->iOffset;

		else

			{

			const TInt unfrag = info->iOffset;	// = Unfragmentable length (bytes)

			iTotal += unfrag;

			iHandler.iTotal += unfrag;

			iHead.Assign(aPacket);

			iHead.SplitL(unfrag, aPacket);

			iHead.SetInfo(info);

			aPacket.SetInfo(NULL);

			//

			// Patch in the next header field

			//

			iHead.CopyIn(TPtrC8((TUint8 *)&info->iProtocol, 1), info->iPrevNextHdr);

			//

			// This fragment is assigned as the first fragment. Save the FH0 for it.

			// (if there are multiple "first fragments", the first received is used)

			// (Only needed for IPv6 and to generate TAHI-compatible ICMP Time Exceeded)

			// *NOTE* The full first word is saved because, the reserved bits must be

			// kept also, if someone is using them -- msa

			iFH0 = aFH0;

			}

		}

	else

		aTrim += info->iOffset;