2 * IPv6 fragment reassembly for connection tracking
4 * Copyright (C)2004 USAGI/WIDE Project
7 * Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
9 * Based on: net/ipv6/reassembly.c
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version
14 * 2 of the License, or (at your option) any later version.
17 #include <linux/config.h>
18 #include <linux/errno.h>
19 #include <linux/types.h>
20 #include <linux/string.h>
21 #include <linux/socket.h>
22 #include <linux/sockios.h>
23 #include <linux/jiffies.h>
24 #include <linux/net.h>
25 #include <linux/list.h>
26 #include <linux/netdevice.h>
27 #include <linux/in6.h>
28 #include <linux/ipv6.h>
29 #include <linux/icmpv6.h>
30 #include <linux/random.h>
31 #include <linux/jhash.h>
37 #include <net/protocol.h>
38 #include <net/transp_v6.h>
39 #include <net/rawv6.h>
40 #include <net/ndisc.h>
41 #include <net/addrconf.h>
42 #include <linux/sysctl.h>
43 #include <linux/netfilter.h>
44 #include <linux/netfilter_ipv6.h>
45 #include <linux/kernel.h>
46 #include <linux/module.h>
51 #define DEBUGP(format, args...)
54 #define NF_CT_FRAG6_HIGH_THRESH 262144 /* == 256*1024 */
55 #define NF_CT_FRAG6_LOW_THRESH 196608 /* == 192*1024 */
56 #define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
58 unsigned int nf_ct_frag6_high_thresh = 256*1024;
59 unsigned int nf_ct_frag6_low_thresh = 192*1024;
60 unsigned long nf_ct_frag6_timeout = IPV6_FRAG_TIMEOUT;
62 struct nf_ct_frag6_skb_cb
64 struct inet6_skb_parm h;
69 #define NFCT_FRAG6_CB(skb) ((struct nf_ct_frag6_skb_cb*)((skb)->cb))
71 struct nf_ct_frag6_queue
73 struct hlist_node list;
74 struct list_head lru_list; /* lru list member */
76 __u32 id; /* fragment id */
77 struct in6_addr saddr;
78 struct in6_addr daddr;
82 struct timer_list timer; /* expire timer */
83 struct sk_buff *fragments;
88 __u8 last_in; /* has first/last segment arrived? */
97 #define FRAG6Q_HASHSZ 64
99 static struct hlist_head nf_ct_frag6_hash[FRAG6Q_HASHSZ];
100 static DEFINE_RWLOCK(nf_ct_frag6_lock);
101 static u32 nf_ct_frag6_hash_rnd;
102 static LIST_HEAD(nf_ct_frag6_lru_list);
103 int nf_ct_frag6_nqueues = 0;
105 static __inline__ void __fq_unlink(struct nf_ct_frag6_queue *fq)
107 hlist_del(&fq->list);
108 list_del(&fq->lru_list);
109 nf_ct_frag6_nqueues--;
112 static __inline__ void fq_unlink(struct nf_ct_frag6_queue *fq)
114 write_lock(&nf_ct_frag6_lock);
116 write_unlock(&nf_ct_frag6_lock);
119 static unsigned int ip6qhashfn(u32 id, struct in6_addr *saddr,
120 struct in6_addr *daddr)
124 a = saddr->s6_addr32[0];
125 b = saddr->s6_addr32[1];
126 c = saddr->s6_addr32[2];
128 a += JHASH_GOLDEN_RATIO;
129 b += JHASH_GOLDEN_RATIO;
130 c += nf_ct_frag6_hash_rnd;
131 __jhash_mix(a, b, c);
133 a += saddr->s6_addr32[3];
134 b += daddr->s6_addr32[0];
135 c += daddr->s6_addr32[1];
136 __jhash_mix(a, b, c);
138 a += daddr->s6_addr32[2];
139 b += daddr->s6_addr32[3];
141 __jhash_mix(a, b, c);
143 return c & (FRAG6Q_HASHSZ - 1);
146 static struct timer_list nf_ct_frag6_secret_timer;
147 int nf_ct_frag6_secret_interval = 10 * 60 * HZ;
149 static void nf_ct_frag6_secret_rebuild(unsigned long dummy)
151 unsigned long now = jiffies;
154 write_lock(&nf_ct_frag6_lock);
155 get_random_bytes(&nf_ct_frag6_hash_rnd, sizeof(u32));
156 for (i = 0; i < FRAG6Q_HASHSZ; i++) {
157 struct nf_ct_frag6_queue *q;
158 struct hlist_node *p, *n;
160 hlist_for_each_entry_safe(q, p, n, &nf_ct_frag6_hash[i], list) {
161 unsigned int hval = ip6qhashfn(q->id,
166 /* Relink to new hash chain. */
167 hlist_add_head(&q->list,
168 &nf_ct_frag6_hash[hval]);
172 write_unlock(&nf_ct_frag6_lock);
174 mod_timer(&nf_ct_frag6_secret_timer, now + nf_ct_frag6_secret_interval);
177 atomic_t nf_ct_frag6_mem = ATOMIC_INIT(0);
179 /* Memory Tracking Functions. */
180 static inline void frag_kfree_skb(struct sk_buff *skb, unsigned int *work)
183 *work -= skb->truesize;
184 atomic_sub(skb->truesize, &nf_ct_frag6_mem);
185 if (NFCT_FRAG6_CB(skb)->orig)
186 kfree_skb(NFCT_FRAG6_CB(skb)->orig);
191 static inline void frag_free_queue(struct nf_ct_frag6_queue *fq,
195 *work -= sizeof(struct nf_ct_frag6_queue);
196 atomic_sub(sizeof(struct nf_ct_frag6_queue), &nf_ct_frag6_mem);
200 static inline struct nf_ct_frag6_queue *frag_alloc_queue(void)
202 struct nf_ct_frag6_queue *fq = kmalloc(sizeof(struct nf_ct_frag6_queue), GFP_ATOMIC);
206 atomic_add(sizeof(struct nf_ct_frag6_queue), &nf_ct_frag6_mem);
210 /* Destruction primitives. */
212 /* Complete destruction of fq. */
213 static void nf_ct_frag6_destroy(struct nf_ct_frag6_queue *fq,
218 BUG_TRAP(fq->last_in&COMPLETE);
219 BUG_TRAP(del_timer(&fq->timer) == 0);
221 /* Release all fragment data. */
224 struct sk_buff *xp = fp->next;
226 frag_kfree_skb(fp, work);
230 frag_free_queue(fq, work);
233 static __inline__ void fq_put(struct nf_ct_frag6_queue *fq, unsigned int *work)
235 if (atomic_dec_and_test(&fq->refcnt))
236 nf_ct_frag6_destroy(fq, work);
239 /* Kill fq entry. It is not destroyed immediately,
240 * because caller (and someone more) holds reference count.
242 static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
244 if (del_timer(&fq->timer))
245 atomic_dec(&fq->refcnt);
247 if (!(fq->last_in & COMPLETE)) {
249 atomic_dec(&fq->refcnt);
250 fq->last_in |= COMPLETE;
254 static void nf_ct_frag6_evictor(void)
256 struct nf_ct_frag6_queue *fq;
257 struct list_head *tmp;
260 work = atomic_read(&nf_ct_frag6_mem);
261 if (work <= nf_ct_frag6_low_thresh)
264 work -= nf_ct_frag6_low_thresh;
266 read_lock(&nf_ct_frag6_lock);
267 if (list_empty(&nf_ct_frag6_lru_list)) {
268 read_unlock(&nf_ct_frag6_lock);
271 tmp = nf_ct_frag6_lru_list.next;
273 fq = list_entry(tmp, struct nf_ct_frag6_queue, lru_list);
274 atomic_inc(&fq->refcnt);
275 read_unlock(&nf_ct_frag6_lock);
277 spin_lock(&fq->lock);
278 if (!(fq->last_in&COMPLETE))
280 spin_unlock(&fq->lock);
286 static void nf_ct_frag6_expire(unsigned long data)
288 struct nf_ct_frag6_queue *fq = (struct nf_ct_frag6_queue *) data;
290 spin_lock(&fq->lock);
292 if (fq->last_in & COMPLETE)
298 spin_unlock(&fq->lock);
302 /* Creation primitives. */
304 static struct nf_ct_frag6_queue *nf_ct_frag6_intern(unsigned int hash,
305 struct nf_ct_frag6_queue *fq_in)
307 struct nf_ct_frag6_queue *fq;
309 struct hlist_node *n;
312 write_lock(&nf_ct_frag6_lock);
314 hlist_for_each_entry(fq, n, &nf_ct_frag6_hash[hash], list) {
315 if (fq->id == fq_in->id &&
316 ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
317 ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
318 atomic_inc(&fq->refcnt);
319 write_unlock(&nf_ct_frag6_lock);
320 fq_in->last_in |= COMPLETE;
328 if (!mod_timer(&fq->timer, jiffies + nf_ct_frag6_timeout))
329 atomic_inc(&fq->refcnt);
331 atomic_inc(&fq->refcnt);
332 hlist_add_head(&fq->list, &nf_ct_frag6_hash[hash]);
333 INIT_LIST_HEAD(&fq->lru_list);
334 list_add_tail(&fq->lru_list, &nf_ct_frag6_lru_list);
335 nf_ct_frag6_nqueues++;
336 write_unlock(&nf_ct_frag6_lock);
341 static struct nf_ct_frag6_queue *
342 nf_ct_frag6_create(unsigned int hash, u32 id, struct in6_addr *src, struct in6_addr *dst)
344 struct nf_ct_frag6_queue *fq;
346 if ((fq = frag_alloc_queue()) == NULL) {
347 DEBUGP("Can't alloc new queue\n");
351 memset(fq, 0, sizeof(struct nf_ct_frag6_queue));
354 ipv6_addr_copy(&fq->saddr, src);
355 ipv6_addr_copy(&fq->daddr, dst);
357 init_timer(&fq->timer);
358 fq->timer.function = nf_ct_frag6_expire;
359 fq->timer.data = (long) fq;
360 spin_lock_init(&fq->lock);
361 atomic_set(&fq->refcnt, 1);
363 return nf_ct_frag6_intern(hash, fq);
369 static __inline__ struct nf_ct_frag6_queue *
370 fq_find(u32 id, struct in6_addr *src, struct in6_addr *dst)
372 struct nf_ct_frag6_queue *fq;
373 struct hlist_node *n;
374 unsigned int hash = ip6qhashfn(id, src, dst);
376 read_lock(&nf_ct_frag6_lock);
377 hlist_for_each_entry(fq, n, &nf_ct_frag6_hash[hash], list) {
379 ipv6_addr_equal(src, &fq->saddr) &&
380 ipv6_addr_equal(dst, &fq->daddr)) {
381 atomic_inc(&fq->refcnt);
382 read_unlock(&nf_ct_frag6_lock);
386 read_unlock(&nf_ct_frag6_lock);
388 return nf_ct_frag6_create(hash, id, src, dst);
392 static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
393 struct frag_hdr *fhdr, int nhoff)
395 struct sk_buff *prev, *next;
398 if (fq->last_in & COMPLETE) {
399 DEBUGP("Allready completed\n");
403 offset = ntohs(fhdr->frag_off) & ~0x7;
404 end = offset + (ntohs(skb->nh.ipv6h->payload_len) -
405 ((u8 *) (fhdr + 1) - (u8 *) (skb->nh.ipv6h + 1)));
407 if ((unsigned int)end > IPV6_MAXPLEN) {
408 DEBUGP("offset is too large.\n");
412 if (skb->ip_summed == CHECKSUM_HW)
413 skb->csum = csum_sub(skb->csum,
414 csum_partial(skb->nh.raw,
415 (u8*)(fhdr + 1) - skb->nh.raw,
418 /* Is this the final fragment? */
419 if (!(fhdr->frag_off & htons(IP6_MF))) {
420 /* If we already have some bits beyond end
421 * or have different end, the segment is corrupted.
424 ((fq->last_in & LAST_IN) && end != fq->len)) {
425 DEBUGP("already received last fragment\n");
428 fq->last_in |= LAST_IN;
431 /* Check if the fragment is rounded to 8 bytes.
432 * Required by the RFC.
435 /* RFC2460 says always send parameter problem in
438 DEBUGP("the end of this fragment is not rounded to 8 bytes.\n");
442 /* Some bits beyond end -> corruption. */
443 if (fq->last_in & LAST_IN) {
444 DEBUGP("last packet already reached.\n");
454 /* Point into the IP datagram 'data' part. */
455 if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) {
456 DEBUGP("queue: message is too short.\n");
459 if (pskb_trim_rcsum(skb, end - offset)) {
460 DEBUGP("Can't trim\n");
464 /* Find out which fragments are in front and at the back of us
465 * in the chain of fragments so far. We must know where to put
466 * this fragment, right?
469 for (next = fq->fragments; next != NULL; next = next->next) {
470 if (NFCT_FRAG6_CB(next)->offset >= offset)
475 /* We found where to put this one. Check for overlap with
476 * preceding fragment, and, if needed, align things so that
477 * any overlaps are eliminated.
480 int i = (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset;
488 if (!pskb_pull(skb, i)) {
489 DEBUGP("Can't pull\n");
492 if (skb->ip_summed != CHECKSUM_UNNECESSARY)
493 skb->ip_summed = CHECKSUM_NONE;
497 /* Look for overlap with succeeding segments.
498 * If we can merge fragments, do it.
500 while (next && NFCT_FRAG6_CB(next)->offset < end) {
501 /* overlap is 'i' bytes */
502 int i = end - NFCT_FRAG6_CB(next)->offset;
505 /* Eat head of the next overlapped fragment
506 * and leave the loop. The next ones cannot overlap.
508 DEBUGP("Eat head of the overlapped parts.: %d", i);
509 if (!pskb_pull(next, i))
513 NFCT_FRAG6_CB(next)->offset += i;
515 if (next->ip_summed != CHECKSUM_UNNECESSARY)
516 next->ip_summed = CHECKSUM_NONE;
519 struct sk_buff *free_it = next;
521 /* Old fragmnet is completely overridden with
529 fq->fragments = next;
531 fq->meat -= free_it->len;
532 frag_kfree_skb(free_it, NULL);
536 NFCT_FRAG6_CB(skb)->offset = offset;
538 /* Insert this fragment in the chain of fragments. */
546 skb_get_timestamp(skb, &fq->stamp);
547 fq->meat += skb->len;
548 atomic_add(skb->truesize, &nf_ct_frag6_mem);
550 /* The first fragment.
551 * nhoffset is obtained from the first fragment, of course.
554 fq->nhoffset = nhoff;
555 fq->last_in |= FIRST_IN;
557 write_lock(&nf_ct_frag6_lock);
558 list_move_tail(&fq->lru_list, &nf_ct_frag6_lru_list);
559 write_unlock(&nf_ct_frag6_lock);
567 * Check if this packet is complete.
568 * Returns NULL on failure by any reason, and pointer
569 * to current nexthdr field in reassembled frame.
571 * It is called with locked fq, and caller must check that
572 * queue is eligible for reassembly i.e. it is not COMPLETE,
573 * the last and the first frames arrived and all the bits are here.
575 static struct sk_buff *
576 nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
578 struct sk_buff *fp, *op, *head = fq->fragments;
583 BUG_TRAP(head != NULL);
584 BUG_TRAP(NFCT_FRAG6_CB(head)->offset == 0);
586 /* Unfragmented part is taken from the first segment. */
587 payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len - sizeof(struct frag_hdr);
588 if (payload_len > IPV6_MAXPLEN) {
589 DEBUGP("payload len is too large.\n");
593 /* Head of list must not be cloned. */
594 if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) {
595 DEBUGP("skb is cloned but can't expand head");
599 /* If the first fragment is fragmented itself, we split
600 * it to two chunks: the first with data and paged part
601 * and the second, holding only fragments. */
602 if (skb_shinfo(head)->frag_list) {
603 struct sk_buff *clone;
606 if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) {
607 DEBUGP("Can't alloc skb\n");
610 clone->next = head->next;
612 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
613 skb_shinfo(head)->frag_list = NULL;
614 for (i=0; i<skb_shinfo(head)->nr_frags; i++)
615 plen += skb_shinfo(head)->frags[i].size;
616 clone->len = clone->data_len = head->data_len - plen;
617 head->data_len -= clone->len;
618 head->len -= clone->len;
620 clone->ip_summed = head->ip_summed;
622 NFCT_FRAG6_CB(clone)->orig = NULL;
623 atomic_add(clone->truesize, &nf_ct_frag6_mem);
626 /* We have to remove fragment header from datagram and to relocate
627 * header in order to calculate ICV correctly. */
628 head->nh.raw[fq->nhoffset] = head->h.raw[0];
629 memmove(head->head + sizeof(struct frag_hdr), head->head,
630 (head->data - head->head) - sizeof(struct frag_hdr));
631 head->mac.raw += sizeof(struct frag_hdr);
632 head->nh.raw += sizeof(struct frag_hdr);
634 skb_shinfo(head)->frag_list = head->next;
635 head->h.raw = head->data;
636 skb_push(head, head->data - head->nh.raw);
637 atomic_sub(head->truesize, &nf_ct_frag6_mem);
639 for (fp=head->next; fp; fp = fp->next) {
640 head->data_len += fp->len;
641 head->len += fp->len;
642 if (head->ip_summed != fp->ip_summed)
643 head->ip_summed = CHECKSUM_NONE;
644 else if (head->ip_summed == CHECKSUM_HW)
645 head->csum = csum_add(head->csum, fp->csum);
646 head->truesize += fp->truesize;
647 atomic_sub(fp->truesize, &nf_ct_frag6_mem);
652 skb_set_timestamp(head, &fq->stamp);
653 head->nh.ipv6h->payload_len = htons(payload_len);
655 /* Yes, and fold redundant checksum back. 8) */
656 if (head->ip_summed == CHECKSUM_HW)
657 head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
659 fq->fragments = NULL;
661 /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
662 fp = skb_shinfo(head)->frag_list;
663 if (NFCT_FRAG6_CB(fp)->orig == NULL)
664 /* at above code, head skb is divided into two skbs. */
667 op = NFCT_FRAG6_CB(head)->orig;
668 for (; fp; fp = fp->next) {
669 struct sk_buff *orig = NFCT_FRAG6_CB(fp)->orig;
673 NFCT_FRAG6_CB(fp)->orig = NULL;
680 printk(KERN_DEBUG "nf_ct_frag6_reasm: payload len = %d\n", payload_len);
684 printk(KERN_DEBUG "nf_ct_frag6_reasm: no memory for reassembly\n");
690 * find the header just before Fragment Header.
692 * if success return 0 and set ...
693 * (*prevhdrp): the value of "Next Header Field" in the header
694 * just before Fragment Header.
695 * (*prevhoff): the offset of "Next Header Field" in the header
696 * just before Fragment Header.
697 * (*fhoff) : the offset of Fragment Header.
699 * Based on ipv6_skip_hdr() in net/ipv6/exthdr.c
703 find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
705 u8 nexthdr = skb->nh.ipv6h->nexthdr;
706 u8 prev_nhoff = (u8 *)&skb->nh.ipv6h->nexthdr - skb->data;
707 int start = (u8 *)(skb->nh.ipv6h+1) - skb->data;
708 int len = skb->len - start;
709 u8 prevhdr = NEXTHDR_IPV6;
711 while (nexthdr != NEXTHDR_FRAGMENT) {
712 struct ipv6_opt_hdr hdr;
715 if (!ipv6_ext_hdr(nexthdr)) {
718 if (len < (int)sizeof(struct ipv6_opt_hdr)) {
719 DEBUGP("too short\n");
722 if (nexthdr == NEXTHDR_NONE) {
723 DEBUGP("next header is none\n");
726 if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
728 if (nexthdr == NEXTHDR_AUTH)
729 hdrlen = (hdr.hdrlen+2)<<2;
731 hdrlen = ipv6_optlen(&hdr);
736 nexthdr = hdr.nexthdr;
745 *prevhoff = prev_nhoff;
751 struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
753 struct sk_buff *clone;
754 struct net_device *dev = skb->dev;
755 struct frag_hdr *fhdr;
756 struct nf_ct_frag6_queue *fq;
760 struct sk_buff *ret_skb = NULL;
762 /* Jumbo payload inhibits frag. header */
763 if (skb->nh.ipv6h->payload_len == 0) {
764 DEBUGP("payload len = 0\n");
768 if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
771 clone = skb_clone(skb, GFP_ATOMIC);
773 DEBUGP("Can't clone skb\n");
777 NFCT_FRAG6_CB(clone)->orig = skb;
779 if (!pskb_may_pull(clone, fhoff + sizeof(*fhdr))) {
780 DEBUGP("message is too short.\n");
784 clone->h.raw = clone->data + fhoff;
785 hdr = clone->nh.ipv6h;
786 fhdr = (struct frag_hdr *)clone->h.raw;
788 if (!(fhdr->frag_off & htons(0xFFF9))) {
789 DEBUGP("Invalid fragment offset\n");
790 /* It is not a fragmented frame */
794 if (atomic_read(&nf_ct_frag6_mem) > nf_ct_frag6_high_thresh)
795 nf_ct_frag6_evictor();
797 fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
799 DEBUGP("Can't find and can't create new queue\n");
803 spin_lock(&fq->lock);
805 if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
806 spin_unlock(&fq->lock);
807 DEBUGP("Can't insert skb to queue\n");
812 if (fq->last_in == (FIRST_IN|LAST_IN) && fq->meat == fq->len) {
813 ret_skb = nf_ct_frag6_reasm(fq, dev);
815 DEBUGP("Can't reassemble fragmented packets\n");
817 spin_unlock(&fq->lock);
827 void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
828 struct net_device *in, struct net_device *out,
829 int (*okfn)(struct sk_buff *))
831 struct sk_buff *s, *s2;
833 for (s = NFCT_FRAG6_CB(skb)->orig; s;) {
834 nf_conntrack_put_reasm(s->nfct_reasm);
835 nf_conntrack_get_reasm(skb);
839 NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn,
840 NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
843 nf_conntrack_put_reasm(skb);
846 int nf_ct_frag6_kfree_frags(struct sk_buff *skb)
848 struct sk_buff *s, *s2;
850 for (s = NFCT_FRAG6_CB(skb)->orig; s; s = s2) {
861 int nf_ct_frag6_init(void)
863 nf_ct_frag6_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
864 (jiffies ^ (jiffies >> 6)));
866 init_timer(&nf_ct_frag6_secret_timer);
867 nf_ct_frag6_secret_timer.function = nf_ct_frag6_secret_rebuild;
868 nf_ct_frag6_secret_timer.expires = jiffies
869 + nf_ct_frag6_secret_interval;
870 add_timer(&nf_ct_frag6_secret_timer);
875 void nf_ct_frag6_cleanup(void)
877 del_timer(&nf_ct_frag6_secret_timer);
878 nf_ct_frag6_low_thresh = 0;
879 nf_ct_frag6_evictor();