The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/ip_icmp.c

Version: -  FREEBSD  -  FREEBSD11  -  FREEBSD10  -  FREEBSD9  -  FREEBSD92  -  FREEBSD91  -  FREEBSD90  -  FREEBSD8  -  FREEBSD82  -  FREEBSD81  -  FREEBSD80  -  FREEBSD7  -  FREEBSD74  -  FREEBSD73  -  FREEBSD72  -  FREEBSD71  -  FREEBSD70  -  FREEBSD6  -  FREEBSD64  -  FREEBSD63  -  FREEBSD62  -  FREEBSD61  -  FREEBSD60  -  FREEBSD5  -  FREEBSD55  -  FREEBSD54  -  FREEBSD53  -  FREEBSD52  -  FREEBSD51  -  FREEBSD50  -  FREEBSD4  -  FREEBSD3  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1982, 1986, 1988, 1993
    3  *      The Regents of the University of California.  All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  * 4. Neither the name of the University nor the names of its contributors
   14  *    may be used to endorse or promote products derived from this software
   15  *    without specific prior written permission.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   27  * SUCH DAMAGE.
   28  *
   29  *      @(#)ip_icmp.c   8.2 (Berkeley) 1/4/94
   30  */
   31 
   32 #include <sys/cdefs.h>
   33 __FBSDID("$FreeBSD: releng/8.2/sys/netinet/ip_icmp.c 211542 2010-08-21 11:01:40Z andre $");
   34 
   35 #include "opt_ipsec.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h>
   39 #include <sys/mbuf.h>
   40 #include <sys/protosw.h>
   41 #include <sys/socket.h>
   42 #include <sys/time.h>
   43 #include <sys/kernel.h>
   44 #include <sys/sysctl.h>
   45 #include <sys/syslog.h>
   46 
   47 #include <net/if.h>
   48 #include <net/if_types.h>
   49 #include <net/route.h>
   50 #include <net/vnet.h>
   51 
   52 #include <netinet/in.h>
   53 #include <netinet/in_pcb.h>
   54 #include <netinet/in_systm.h>
   55 #include <netinet/in_var.h>
   56 #include <netinet/ip.h>
   57 #include <netinet/ip_icmp.h>
   58 #include <netinet/ip_var.h>
   59 #include <netinet/ip_options.h>
   60 #include <netinet/tcp.h>
   61 #include <netinet/tcp_var.h>
   62 #include <netinet/tcpip.h>
   63 #include <netinet/icmp_var.h>
   64 
   65 #ifdef IPSEC
   66 #include <netipsec/ipsec.h>
   67 #include <netipsec/key.h>
   68 #endif
   69 
   70 #include <machine/in_cksum.h>
   71 
   72 #include <security/mac/mac_framework.h>
   73 
   74 /*
   75  * ICMP routines: error generation, receive packet processing, and
   76  * routines to turnaround packets back to the originator, and
   77  * host table maintenance routines.
   78  */
   79 VNET_DEFINE(struct icmpstat, icmpstat);
   80 SYSCTL_VNET_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RW,
   81         &VNET_NAME(icmpstat), icmpstat, "");
   82 
   83 static VNET_DEFINE(int, icmpmaskrepl) = 0;
   84 #define V_icmpmaskrepl                  VNET(icmpmaskrepl)
   85 SYSCTL_VNET_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
   86         &VNET_NAME(icmpmaskrepl), 0,
   87         "Reply to ICMP Address Mask Request packets.");
   88 
   89 static VNET_DEFINE(u_int, icmpmaskfake) = 0;
   90 #define V_icmpmaskfake                  VNET(icmpmaskfake)
   91 SYSCTL_VNET_UINT(_net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW,
   92         &VNET_NAME(icmpmaskfake), 0,
   93         "Fake reply to ICMP Address Mask Request packets.");
   94 
   95 static VNET_DEFINE(int, drop_redirect) = 0;
   96 #define V_drop_redirect                 VNET(drop_redirect)
   97 SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
   98         &VNET_NAME(drop_redirect), 0,
   99         "Ignore ICMP redirects");
  100 
  101 static VNET_DEFINE(int, log_redirect) = 0;
  102 #define V_log_redirect                  VNET(log_redirect)
  103 SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
  104         &VNET_NAME(log_redirect), 0,
  105         "Log ICMP redirects to the console");
  106 
  107 static VNET_DEFINE(int, icmplim) = 200;
  108 #define V_icmplim                       VNET(icmplim)
  109 SYSCTL_VNET_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
  110         &VNET_NAME(icmplim), 0,
  111         "Maximum number of ICMP responses per second");
  112 
  113 static VNET_DEFINE(int, icmplim_output) = 1;
  114 #define V_icmplim_output                VNET(icmplim_output)
  115 SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW,
  116         &VNET_NAME(icmplim_output), 0,
  117         "Enable rate limiting of ICMP responses");
  118 
  119 static VNET_DEFINE(char, reply_src[IFNAMSIZ]);
  120 #define V_reply_src                     VNET(reply_src)
  121 SYSCTL_VNET_STRING(_net_inet_icmp, OID_AUTO, reply_src, CTLFLAG_RW,
  122         &VNET_NAME(reply_src), IFNAMSIZ,
  123         "icmp reply source for non-local packets.");
  124 
  125 static VNET_DEFINE(int, icmp_rfi) = 0;
  126 #define V_icmp_rfi                      VNET(icmp_rfi)
  127 SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, reply_from_interface, CTLFLAG_RW,
  128         &VNET_NAME(icmp_rfi), 0,
  129         "ICMP reply from incoming interface for non-local packets");
  130 
  131 static VNET_DEFINE(int, icmp_quotelen) = 8;
  132 #define V_icmp_quotelen                 VNET(icmp_quotelen)
  133 SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, quotelen, CTLFLAG_RW,
  134         &VNET_NAME(icmp_quotelen), 0,
  135         "Number of bytes from original packet to quote in ICMP reply");
  136 
  137 /*
  138  * ICMP broadcast echo sysctl
  139  */
  140 static VNET_DEFINE(int, icmpbmcastecho) = 0;
  141 #define V_icmpbmcastecho                VNET(icmpbmcastecho)
  142 SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
  143         &VNET_NAME(icmpbmcastecho), 0,
  144         "");
  145 
  146 
  147 #ifdef ICMPPRINTFS
  148 int     icmpprintfs = 0;
  149 #endif
  150 
  151 static void     icmp_reflect(struct mbuf *);
  152 static void     icmp_send(struct mbuf *, struct mbuf *);
  153 
  154 extern  struct protosw inetsw[];
  155 
  156 /*
  157  * Kernel module interface for updating icmpstat.  The argument is an index
  158  * into icmpstat treated as an array of u_long.  While this encodes the
  159  * general layout of icmpstat into the caller, it doesn't encode its
  160  * location, so that future changes to add, for example, per-CPU stats
  161  * support won't cause binary compatibility problems for kernel modules.
  162  */
  163 void
  164 kmod_icmpstat_inc(int statnum)
  165 {
  166 
  167         (*((u_long *)&V_icmpstat + statnum))++;
  168 }
  169 
  170 /*
  171  * Generate an error packet of type error
  172  * in response to bad packet ip.
  173  */
  174 void
  175 icmp_error(struct mbuf *n, int type, int code, uint32_t dest, int mtu)
  176 {
  177         register struct ip *oip = mtod(n, struct ip *), *nip;
  178         register unsigned oiphlen = oip->ip_hl << 2;
  179         register struct icmp *icp;
  180         register struct mbuf *m;
  181         unsigned icmplen, icmpelen, nlen;
  182 
  183         KASSERT((u_int)type <= ICMP_MAXTYPE, ("%s: illegal ICMP type", __func__));
  184 #ifdef ICMPPRINTFS
  185         if (icmpprintfs)
  186                 printf("icmp_error(%p, %x, %d)\n", oip, type, code);
  187 #endif
  188         if (type != ICMP_REDIRECT)
  189                 ICMPSTAT_INC(icps_error);
  190         /*
  191          * Don't send error:
  192          *  if the original packet was encrypted.
  193          *  if not the first fragment of message.
  194          *  in response to a multicast or broadcast packet.
  195          *  if the old packet protocol was an ICMP error message.
  196          */
  197         if (n->m_flags & M_DECRYPTED)
  198                 goto freeit;
  199         if (oip->ip_off & ~(IP_MF|IP_DF))
  200                 goto freeit;
  201         if (n->m_flags & (M_BCAST|M_MCAST))
  202                 goto freeit;
  203         if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
  204           n->m_len >= oiphlen + ICMP_MINLEN &&
  205           !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiphlen))->icmp_type)) {
  206                 ICMPSTAT_INC(icps_oldicmp);
  207                 goto freeit;
  208         }
  209         /* Drop if IP header plus 8 bytes is not contignous in first mbuf. */
  210         if (oiphlen + 8 > n->m_len)
  211                 goto freeit;
  212         /*
  213          * Calculate length to quote from original packet and
  214          * prevent the ICMP mbuf from overflowing.
  215          * Unfortunatly this is non-trivial since ip_forward()
  216          * sends us truncated packets.
  217          */
  218         nlen = m_length(n, NULL);
  219         if (oip->ip_p == IPPROTO_TCP) {
  220                 struct tcphdr *th;
  221                 int tcphlen;
  222 
  223                 if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
  224                     n->m_next == NULL)
  225                         goto stdreply;
  226                 if (n->m_len < oiphlen + sizeof(struct tcphdr) &&
  227                     ((n = m_pullup(n, oiphlen + sizeof(struct tcphdr))) == NULL))
  228                         goto freeit;
  229                 th = (struct tcphdr *)((caddr_t)oip + oiphlen);
  230                 tcphlen = th->th_off << 2;
  231                 if (tcphlen < sizeof(struct tcphdr))
  232                         goto freeit;
  233                 if (oip->ip_len < oiphlen + tcphlen)
  234                         goto freeit;
  235                 if (oiphlen + tcphlen > n->m_len && n->m_next == NULL)
  236                         goto stdreply;
  237                 if (n->m_len < oiphlen + tcphlen && 
  238                     ((n = m_pullup(n, oiphlen + tcphlen)) == NULL))
  239                         goto freeit;
  240                 icmpelen = max(tcphlen, min(V_icmp_quotelen, oip->ip_len - oiphlen));
  241         } else
  242 stdreply:       icmpelen = max(8, min(V_icmp_quotelen, oip->ip_len - oiphlen));
  243 
  244         icmplen = min(oiphlen + icmpelen, nlen);
  245         if (icmplen < sizeof(struct ip))
  246                 goto freeit;
  247 
  248         if (MHLEN > sizeof(struct ip) + ICMP_MINLEN + icmplen)
  249                 m = m_gethdr(M_DONTWAIT, MT_DATA);
  250         else
  251                 m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
  252         if (m == NULL)
  253                 goto freeit;
  254 #ifdef MAC
  255         mac_netinet_icmp_reply(n, m);
  256 #endif
  257         icmplen = min(icmplen, M_TRAILINGSPACE(m) - sizeof(struct ip) - ICMP_MINLEN);
  258         m_align(m, ICMP_MINLEN + icmplen);
  259         m->m_len = ICMP_MINLEN + icmplen;
  260 
  261         /* XXX MRT  make the outgoing packet use the same FIB
  262          * that was associated with the incoming packet
  263          */
  264         M_SETFIB(m, M_GETFIB(n));
  265         icp = mtod(m, struct icmp *);
  266         ICMPSTAT_INC(icps_outhist[type]);
  267         icp->icmp_type = type;
  268         if (type == ICMP_REDIRECT)
  269                 icp->icmp_gwaddr.s_addr = dest;
  270         else {
  271                 icp->icmp_void = 0;
  272                 /*
  273                  * The following assignments assume an overlay with the
  274                  * just zeroed icmp_void field.
  275                  */
  276                 if (type == ICMP_PARAMPROB) {
  277                         icp->icmp_pptr = code;
  278                         code = 0;
  279                 } else if (type == ICMP_UNREACH &&
  280                         code == ICMP_UNREACH_NEEDFRAG && mtu) {
  281                         icp->icmp_nextmtu = htons(mtu);
  282                 }
  283         }
  284         icp->icmp_code = code;
  285 
  286         /*
  287          * Copy the quotation into ICMP message and
  288          * convert quoted IP header back to network representation.
  289          */
  290         m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
  291         nip = &icp->icmp_ip;
  292         nip->ip_len = htons(nip->ip_len);
  293         nip->ip_off = htons(nip->ip_off);
  294 
  295         /*
  296          * Set up ICMP message mbuf and copy old IP header (without options
  297          * in front of ICMP message.
  298          * If the original mbuf was meant to bypass the firewall, the error
  299          * reply should bypass as well.
  300          */
  301         m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
  302         m->m_data -= sizeof(struct ip);
  303         m->m_len += sizeof(struct ip);
  304         m->m_pkthdr.len = m->m_len;
  305         m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
  306         nip = mtod(m, struct ip *);
  307         bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
  308         nip->ip_len = m->m_len;
  309         nip->ip_v = IPVERSION;
  310         nip->ip_hl = 5;
  311         nip->ip_p = IPPROTO_ICMP;
  312         nip->ip_tos = 0;
  313         icmp_reflect(m);
  314 
  315 freeit:
  316         m_freem(n);
  317 }
  318 
  319 /*
  320  * Process a received ICMP message.
  321  */
  322 void
  323 icmp_input(struct mbuf *m, int off)
  324 {
  325         struct icmp *icp;
  326         struct in_ifaddr *ia;
  327         struct ip *ip = mtod(m, struct ip *);
  328         struct sockaddr_in icmpsrc, icmpdst, icmpgw;
  329         int hlen = off;
  330         int icmplen = ip->ip_len;
  331         int i, code;
  332         void (*ctlfunc)(int, struct sockaddr *, void *);
  333         int fibnum;
  334 
  335         /*
  336          * Locate icmp structure in mbuf, and check
  337          * that not corrupted and of at least minimum length.
  338          */
  339 #ifdef ICMPPRINTFS
  340         if (icmpprintfs) {
  341                 char buf[4 * sizeof "123"];
  342                 strcpy(buf, inet_ntoa(ip->ip_src));
  343                 printf("icmp_input from %s to %s, len %d\n",
  344                        buf, inet_ntoa(ip->ip_dst), icmplen);
  345         }
  346 #endif
  347         if (icmplen < ICMP_MINLEN) {
  348                 ICMPSTAT_INC(icps_tooshort);
  349                 goto freeit;
  350         }
  351         i = hlen + min(icmplen, ICMP_ADVLENMIN);
  352         if (m->m_len < i && (m = m_pullup(m, i)) == NULL)  {
  353                 ICMPSTAT_INC(icps_tooshort);
  354                 return;
  355         }
  356         ip = mtod(m, struct ip *);
  357         m->m_len -= hlen;
  358         m->m_data += hlen;
  359         icp = mtod(m, struct icmp *);
  360         if (in_cksum(m, icmplen)) {
  361                 ICMPSTAT_INC(icps_checksum);
  362                 goto freeit;
  363         }
  364         m->m_len += hlen;
  365         m->m_data -= hlen;
  366 
  367         if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
  368                 /*
  369                  * Deliver very specific ICMP type only.
  370                  */
  371                 switch (icp->icmp_type) {
  372                 case ICMP_UNREACH:
  373                 case ICMP_TIMXCEED:
  374                         break;
  375                 default:
  376                         goto freeit;
  377                 }
  378         }
  379 
  380 #ifdef ICMPPRINTFS
  381         if (icmpprintfs)
  382                 printf("icmp_input, type %d code %d\n", icp->icmp_type,
  383                     icp->icmp_code);
  384 #endif
  385 
  386         /*
  387          * Message type specific processing.
  388          */
  389         if (icp->icmp_type > ICMP_MAXTYPE)
  390                 goto raw;
  391 
  392         /* Initialize */
  393         bzero(&icmpsrc, sizeof(icmpsrc));
  394         icmpsrc.sin_len = sizeof(struct sockaddr_in);
  395         icmpsrc.sin_family = AF_INET;
  396         bzero(&icmpdst, sizeof(icmpdst));
  397         icmpdst.sin_len = sizeof(struct sockaddr_in);
  398         icmpdst.sin_family = AF_INET;
  399         bzero(&icmpgw, sizeof(icmpgw));
  400         icmpgw.sin_len = sizeof(struct sockaddr_in);
  401         icmpgw.sin_family = AF_INET;
  402 
  403         ICMPSTAT_INC(icps_inhist[icp->icmp_type]);
  404         code = icp->icmp_code;
  405         switch (icp->icmp_type) {
  406 
  407         case ICMP_UNREACH:
  408                 switch (code) {
  409                         case ICMP_UNREACH_NET:
  410                         case ICMP_UNREACH_HOST:
  411                         case ICMP_UNREACH_SRCFAIL:
  412                         case ICMP_UNREACH_NET_UNKNOWN:
  413                         case ICMP_UNREACH_HOST_UNKNOWN:
  414                         case ICMP_UNREACH_ISOLATED:
  415                         case ICMP_UNREACH_TOSNET:
  416                         case ICMP_UNREACH_TOSHOST:
  417                         case ICMP_UNREACH_HOST_PRECEDENCE:
  418                         case ICMP_UNREACH_PRECEDENCE_CUTOFF:
  419                                 code = PRC_UNREACH_NET;
  420                                 break;
  421 
  422                         case ICMP_UNREACH_NEEDFRAG:
  423                                 code = PRC_MSGSIZE;
  424                                 break;
  425 
  426                         /*
  427                          * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
  428                          * Treat subcodes 2,3 as immediate RST
  429                          */
  430                         case ICMP_UNREACH_PROTOCOL:
  431                         case ICMP_UNREACH_PORT:
  432                                 code = PRC_UNREACH_PORT;
  433                                 break;
  434 
  435                         case ICMP_UNREACH_NET_PROHIB:
  436                         case ICMP_UNREACH_HOST_PROHIB:
  437                         case ICMP_UNREACH_FILTER_PROHIB:
  438                                 code = PRC_UNREACH_ADMIN_PROHIB;
  439                                 break;
  440 
  441                         default:
  442                                 goto badcode;
  443                 }
  444                 goto deliver;
  445 
  446         case ICMP_TIMXCEED:
  447                 if (code > 1)
  448                         goto badcode;
  449                 code += PRC_TIMXCEED_INTRANS;
  450                 goto deliver;
  451 
  452         case ICMP_PARAMPROB:
  453                 if (code > 1)
  454                         goto badcode;
  455                 code = PRC_PARAMPROB;
  456                 goto deliver;
  457 
  458         case ICMP_SOURCEQUENCH:
  459                 if (code)
  460                         goto badcode;
  461                 code = PRC_QUENCH;
  462         deliver:
  463                 /*
  464                  * Problem with datagram; advise higher level routines.
  465                  */
  466                 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
  467                     icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
  468                         ICMPSTAT_INC(icps_badlen);
  469                         goto freeit;
  470                 }
  471                 icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
  472                 /* Discard ICMP's in response to multicast packets */
  473                 if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
  474                         goto badcode;
  475 #ifdef ICMPPRINTFS
  476                 if (icmpprintfs)
  477                         printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
  478 #endif
  479                 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
  480                 /*
  481                  * XXX if the packet contains [IPv4 AH TCP], we can't make a
  482                  * notification to TCP layer.
  483                  */
  484                 ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
  485                 if (ctlfunc)
  486                         (*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
  487                                    (void *)&icp->icmp_ip);
  488                 break;
  489 
  490         badcode:
  491                 ICMPSTAT_INC(icps_badcode);
  492                 break;
  493 
  494         case ICMP_ECHO:
  495                 if (!V_icmpbmcastecho
  496                     && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
  497                         ICMPSTAT_INC(icps_bmcastecho);
  498                         break;
  499                 }
  500                 icp->icmp_type = ICMP_ECHOREPLY;
  501                 if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
  502                         goto freeit;
  503                 else
  504                         goto reflect;
  505 
  506         case ICMP_TSTAMP:
  507                 if (!V_icmpbmcastecho
  508                     && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
  509                         ICMPSTAT_INC(icps_bmcasttstamp);
  510                         break;
  511                 }
  512                 if (icmplen < ICMP_TSLEN) {
  513                         ICMPSTAT_INC(icps_badlen);
  514                         break;
  515                 }
  516                 icp->icmp_type = ICMP_TSTAMPREPLY;
  517                 icp->icmp_rtime = iptime();
  518                 icp->icmp_ttime = icp->icmp_rtime;      /* bogus, do later! */
  519                 if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
  520                         goto freeit;
  521                 else
  522                         goto reflect;
  523 
  524         case ICMP_MASKREQ:
  525                 if (V_icmpmaskrepl == 0)
  526                         break;
  527                 /*
  528                  * We are not able to respond with all ones broadcast
  529                  * unless we receive it over a point-to-point interface.
  530                  */
  531                 if (icmplen < ICMP_MASKLEN)
  532                         break;
  533                 switch (ip->ip_dst.s_addr) {
  534 
  535                 case INADDR_BROADCAST:
  536                 case INADDR_ANY:
  537                         icmpdst.sin_addr = ip->ip_src;
  538                         break;
  539 
  540                 default:
  541                         icmpdst.sin_addr = ip->ip_dst;
  542                 }
  543                 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
  544                             (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
  545                 if (ia == NULL)
  546                         break;
  547                 if (ia->ia_ifp == NULL) {
  548                         ifa_free(&ia->ia_ifa);
  549                         break;
  550                 }
  551                 icp->icmp_type = ICMP_MASKREPLY;
  552                 if (V_icmpmaskfake == 0)
  553                         icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
  554                 else
  555                         icp->icmp_mask = V_icmpmaskfake;
  556                 if (ip->ip_src.s_addr == 0) {
  557                         if (ia->ia_ifp->if_flags & IFF_BROADCAST)
  558                             ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
  559                         else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
  560                             ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
  561                 }
  562                 ifa_free(&ia->ia_ifa);
  563 reflect:
  564                 ip->ip_len += hlen;     /* since ip_input deducts this */
  565                 ICMPSTAT_INC(icps_reflect);
  566                 ICMPSTAT_INC(icps_outhist[icp->icmp_type]);
  567                 icmp_reflect(m);
  568                 return;
  569 
  570         case ICMP_REDIRECT:
  571                 if (V_log_redirect) {
  572                         u_long src, dst, gw;
  573 
  574                         src = ntohl(ip->ip_src.s_addr);
  575                         dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
  576                         gw = ntohl(icp->icmp_gwaddr.s_addr);
  577                         printf("icmp redirect from %d.%d.%d.%d: "
  578                                "%d.%d.%d.%d => %d.%d.%d.%d\n",
  579                                (int)(src >> 24), (int)((src >> 16) & 0xff),
  580                                (int)((src >> 8) & 0xff), (int)(src & 0xff),
  581                                (int)(dst >> 24), (int)((dst >> 16) & 0xff),
  582                                (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
  583                                (int)(gw >> 24), (int)((gw >> 16) & 0xff),
  584                                (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
  585                 }
  586                 /*
  587                  * RFC1812 says we must ignore ICMP redirects if we
  588                  * are acting as router.
  589                  */
  590                 if (V_drop_redirect || V_ipforwarding)
  591                         break;
  592                 if (code > 3)
  593                         goto badcode;
  594                 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
  595                     icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
  596                         ICMPSTAT_INC(icps_badlen);
  597                         break;
  598                 }
  599                 /*
  600                  * Short circuit routing redirects to force
  601                  * immediate change in the kernel's routing
  602                  * tables.  The message is also handed to anyone
  603                  * listening on a raw socket (e.g. the routing
  604                  * daemon for use in updating its tables).
  605                  */
  606                 icmpgw.sin_addr = ip->ip_src;
  607                 icmpdst.sin_addr = icp->icmp_gwaddr;
  608 #ifdef  ICMPPRINTFS
  609                 if (icmpprintfs) {
  610                         char buf[4 * sizeof "123"];
  611                         strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
  612 
  613                         printf("redirect dst %s to %s\n",
  614                                buf, inet_ntoa(icp->icmp_gwaddr));
  615                 }
  616 #endif
  617                 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
  618                 for ( fibnum = 0; fibnum < rt_numfibs; fibnum++) {
  619                         in_rtredirect((struct sockaddr *)&icmpsrc,
  620                           (struct sockaddr *)&icmpdst,
  621                           (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
  622                           (struct sockaddr *)&icmpgw, fibnum);
  623                 }
  624                 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
  625 #ifdef IPSEC
  626                 key_sa_routechange((struct sockaddr *)&icmpsrc);
  627 #endif
  628                 break;
  629 
  630         /*
  631          * No kernel processing for the following;
  632          * just fall through to send to raw listener.
  633          */
  634         case ICMP_ECHOREPLY:
  635         case ICMP_ROUTERADVERT:
  636         case ICMP_ROUTERSOLICIT:
  637         case ICMP_TSTAMPREPLY:
  638         case ICMP_IREQREPLY:
  639         case ICMP_MASKREPLY:
  640         default:
  641                 break;
  642         }
  643 
  644 raw:
  645         rip_input(m, off);
  646         return;
  647 
  648 freeit:
  649         m_freem(m);
  650 }
  651 
  652 /*
  653  * Reflect the ip packet back to the source
  654  */
  655 static void
  656 icmp_reflect(struct mbuf *m)
  657 {
  658         struct ip *ip = mtod(m, struct ip *);
  659         struct ifaddr *ifa;
  660         struct ifnet *ifp;
  661         struct in_ifaddr *ia;
  662         struct in_addr t;
  663         struct mbuf *opts = 0;
  664         int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
  665 
  666         if (IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
  667             IN_EXPERIMENTAL(ntohl(ip->ip_src.s_addr)) ||
  668             IN_ZERONET(ntohl(ip->ip_src.s_addr)) ) {
  669                 m_freem(m);     /* Bad return address */
  670                 ICMPSTAT_INC(icps_badaddr);
  671                 goto done;      /* Ip_output() will check for broadcast */
  672         }
  673 
  674         t = ip->ip_dst;
  675         ip->ip_dst = ip->ip_src;
  676 
  677         /*
  678          * Source selection for ICMP replies:
  679          *
  680          * If the incoming packet was addressed directly to one of our
  681          * own addresses, use dst as the src for the reply.
  682          */
  683         IN_IFADDR_RLOCK();
  684         LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) {
  685                 if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) {
  686                         t = IA_SIN(ia)->sin_addr;
  687                         IN_IFADDR_RUNLOCK();
  688                         goto match;
  689                 }
  690         }
  691         IN_IFADDR_RUNLOCK();
  692 
  693         /*
  694          * If the incoming packet was addressed to one of our broadcast
  695          * addresses, use the first non-broadcast address which corresponds
  696          * to the incoming interface.
  697          */
  698         ifp = m->m_pkthdr.rcvif;
  699         if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) {
  700                 IF_ADDR_LOCK(ifp);
  701                 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
  702                         if (ifa->ifa_addr->sa_family != AF_INET)
  703                                 continue;
  704                         ia = ifatoia(ifa);
  705                         if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
  706                             t.s_addr) {
  707                                 t = IA_SIN(ia)->sin_addr;
  708                                 IF_ADDR_UNLOCK(ifp);
  709                                 goto match;
  710                         }
  711                 }
  712                 IF_ADDR_UNLOCK(ifp);
  713         }
  714         /*
  715          * If the packet was transiting through us, use the address of
  716          * the interface the packet came through in.  If that interface
  717          * doesn't have a suitable IP address, the normal selection
  718          * criteria apply.
  719          */
  720         if (V_icmp_rfi && ifp != NULL) {
  721                 IF_ADDR_LOCK(ifp);
  722                 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
  723                         if (ifa->ifa_addr->sa_family != AF_INET)
  724                                 continue;
  725                         ia = ifatoia(ifa);
  726                         t = IA_SIN(ia)->sin_addr;
  727                         IF_ADDR_UNLOCK(ifp);
  728                         goto match;
  729                 }
  730                 IF_ADDR_UNLOCK(ifp);
  731         }
  732         /*
  733          * If the incoming packet was not addressed directly to us, use
  734          * designated interface for icmp replies specified by sysctl
  735          * net.inet.icmp.reply_src (default not set). Otherwise continue
  736          * with normal source selection.
  737          */
  738         if (V_reply_src[0] != '\0' && (ifp = ifunit(V_reply_src))) {
  739                 IF_ADDR_LOCK(ifp);
  740                 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
  741                         if (ifa->ifa_addr->sa_family != AF_INET)
  742                                 continue;
  743                         ia = ifatoia(ifa);
  744                         t = IA_SIN(ia)->sin_addr;
  745                         IF_ADDR_UNLOCK(ifp);
  746                         goto match;
  747                 }
  748                 IF_ADDR_UNLOCK(ifp);
  749         }
  750         /*
  751          * If the packet was transiting through us, use the address of
  752          * the interface that is the closest to the packet source.
  753          * When we don't have a route back to the packet source, stop here
  754          * and drop the packet.
  755          */
  756         ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m));
  757         if (ia == NULL) {
  758                 m_freem(m);
  759                 ICMPSTAT_INC(icps_noroute);
  760                 goto done;
  761         }
  762         t = IA_SIN(ia)->sin_addr;
  763         ifa_free(&ia->ia_ifa);
  764 match:
  765 #ifdef MAC
  766         mac_netinet_icmp_replyinplace(m);
  767 #endif
  768         ip->ip_src = t;
  769         ip->ip_ttl = V_ip_defttl;
  770 
  771         if (optlen > 0) {
  772                 register u_char *cp;
  773                 int opt, cnt;
  774                 u_int len;
  775 
  776                 /*
  777                  * Retrieve any source routing from the incoming packet;
  778                  * add on any record-route or timestamp options.
  779                  */
  780                 cp = (u_char *) (ip + 1);
  781                 if ((opts = ip_srcroute(m)) == 0 &&
  782                     (opts = m_gethdr(M_DONTWAIT, MT_DATA))) {
  783                         opts->m_len = sizeof(struct in_addr);
  784                         mtod(opts, struct in_addr *)->s_addr = 0;
  785                 }
  786                 if (opts) {
  787 #ifdef ICMPPRINTFS
  788                     if (icmpprintfs)
  789                             printf("icmp_reflect optlen %d rt %d => ",
  790                                 optlen, opts->m_len);
  791 #endif
  792                     for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
  793                             opt = cp[IPOPT_OPTVAL];
  794                             if (opt == IPOPT_EOL)
  795                                     break;
  796                             if (opt == IPOPT_NOP)
  797                                     len = 1;
  798                             else {
  799                                     if (cnt < IPOPT_OLEN + sizeof(*cp))
  800                                             break;
  801                                     len = cp[IPOPT_OLEN];
  802                                     if (len < IPOPT_OLEN + sizeof(*cp) ||
  803                                         len > cnt)
  804                                             break;
  805                             }
  806                             /*
  807                              * Should check for overflow, but it "can't happen"
  808                              */
  809                             if (opt == IPOPT_RR || opt == IPOPT_TS ||
  810                                 opt == IPOPT_SECURITY) {
  811                                     bcopy((caddr_t)cp,
  812                                         mtod(opts, caddr_t) + opts->m_len, len);
  813                                     opts->m_len += len;
  814                             }
  815                     }
  816                     /* Terminate & pad, if necessary */
  817                     cnt = opts->m_len % 4;
  818                     if (cnt) {
  819                             for (; cnt < 4; cnt++) {
  820                                     *(mtod(opts, caddr_t) + opts->m_len) =
  821                                         IPOPT_EOL;
  822                                     opts->m_len++;
  823                             }
  824                     }
  825 #ifdef ICMPPRINTFS
  826                     if (icmpprintfs)
  827                             printf("%d\n", opts->m_len);
  828 #endif
  829                 }
  830                 /*
  831                  * Now strip out original options by copying rest of first
  832                  * mbuf's data back, and adjust the IP length.
  833                  */
  834                 ip->ip_len -= optlen;
  835                 ip->ip_v = IPVERSION;
  836                 ip->ip_hl = 5;
  837                 m->m_len -= optlen;
  838                 if (m->m_flags & M_PKTHDR)
  839                         m->m_pkthdr.len -= optlen;
  840                 optlen += sizeof(struct ip);
  841                 bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
  842                          (unsigned)(m->m_len - sizeof(struct ip)));
  843         }
  844         m_tag_delete_nonpersistent(m);
  845         m->m_flags &= ~(M_BCAST|M_MCAST);
  846         icmp_send(m, opts);
  847 done:
  848         if (opts)
  849                 (void)m_free(opts);
  850 }
  851 
  852 /*
  853  * Send an icmp packet back to the ip level,
  854  * after supplying a checksum.
  855  */
  856 static void
  857 icmp_send(struct mbuf *m, struct mbuf *opts)
  858 {
  859         register struct ip *ip = mtod(m, struct ip *);
  860         register int hlen;
  861         register struct icmp *icp;
  862 
  863         hlen = ip->ip_hl << 2;
  864         m->m_data += hlen;
  865         m->m_len -= hlen;
  866         icp = mtod(m, struct icmp *);
  867         icp->icmp_cksum = 0;
  868         icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
  869         m->m_data -= hlen;
  870         m->m_len += hlen;
  871         m->m_pkthdr.rcvif = (struct ifnet *)0;
  872 #ifdef ICMPPRINTFS
  873         if (icmpprintfs) {
  874                 char buf[4 * sizeof "123"];
  875                 strcpy(buf, inet_ntoa(ip->ip_dst));
  876                 printf("icmp_send dst %s src %s\n",
  877                        buf, inet_ntoa(ip->ip_src));
  878         }
  879 #endif
  880         (void) ip_output(m, opts, NULL, 0, NULL, NULL);
  881 }
  882 
  883 /*
  884  * Return milliseconds since 00:00 GMT in network format.
  885  */
  886 uint32_t
  887 iptime(void)
  888 {
  889         struct timeval atv;
  890         u_long t;
  891 
  892         getmicrotime(&atv);
  893         t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
  894         return (htonl(t));
  895 }
  896 
  897 /*
  898  * Return the next larger or smaller MTU plateau (table from RFC 1191)
  899  * given current value MTU.  If DIR is less than zero, a larger plateau
  900  * is returned; otherwise, a smaller value is returned.
  901  */
  902 int
  903 ip_next_mtu(int mtu, int dir)
  904 {
  905         static int mtutab[] = {
  906                 65535, 32000, 17914, 8166, 4352, 2002, 1492, 1280, 1006, 508,
  907                 296, 68, 0
  908         };
  909         int i, size;
  910 
  911         size = (sizeof mtutab) / (sizeof mtutab[0]);
  912         if (dir >= 0) {
  913                 for (i = 0; i < size; i++)
  914                         if (mtu > mtutab[i])
  915                                 return mtutab[i];
  916         } else {
  917                 for (i = size - 1; i >= 0; i--)
  918                         if (mtu < mtutab[i])
  919                                 return mtutab[i];
  920                 if (mtu == mtutab[0])
  921                         return mtutab[0];
  922         }
  923         return 0;
  924 }
  925 
  926 
  927 /*
  928  * badport_bandlim() - check for ICMP bandwidth limit
  929  *
  930  *      Return 0 if it is ok to send an ICMP error response, -1 if we have
  931  *      hit our bandwidth limit and it is not ok.
  932  *
  933  *      If icmplim is <= 0, the feature is disabled and 0 is returned.
  934  *
  935  *      For now we separate the TCP and UDP subsystems w/ different 'which'
  936  *      values.  We may eventually remove this separation (and simplify the
  937  *      code further).
  938  *
  939  *      Note that the printing of the error message is delayed so we can
  940  *      properly print the icmp error rate that the system was trying to do
  941  *      (i.e. 22000/100 pps, etc...).  This can cause long delays in printing
  942  *      the 'final' error, but it doesn't make sense to solve the printing
  943  *      delay with more complex code.
  944  */
  945 
  946 int
  947 badport_bandlim(int which)
  948 {
  949 
  950 #define N(a)    (sizeof (a) / sizeof (a[0]))
  951         static struct rate {
  952                 const char      *type;
  953                 struct timeval  lasttime;
  954                 int             curpps;
  955         } rates[BANDLIM_MAX+1] = {
  956                 { "icmp unreach response" },
  957                 { "icmp ping response" },
  958                 { "icmp tstamp response" },
  959                 { "closed port RST response" },
  960                 { "open port RST response" },
  961                 { "icmp6 unreach response" }
  962         };
  963 
  964         /*
  965          * Return ok status if feature disabled or argument out of range.
  966          */
  967         if (V_icmplim > 0 && (u_int) which < N(rates)) {
  968                 struct rate *r = &rates[which];
  969                 int opps = r->curpps;
  970 
  971                 if (!ppsratecheck(&r->lasttime, &r->curpps, V_icmplim))
  972                         return -1;      /* discard packet */
  973                 /*
  974                  * If we've dropped below the threshold after having
  975                  * rate-limited traffic print the message.  This preserves
  976                  * the previous behaviour at the expense of added complexity.
  977                  */
  978                 if (V_icmplim_output && opps > V_icmplim)
  979                         log(LOG_NOTICE, "Limiting %s from %d to %d packets/sec\n",
  980                                 r->type, opps, V_icmplim);
  981         }
  982         return 0;                       /* okay to send packet */
  983 #undef N
  984 }

Cache object: 078ca582dc71d95db125b4de1dee72e5


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.