1/*- 2 * Copyright (c) 1982, 1986, 1988, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 4. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94 30 */ 31 32#include <sys/cdefs.h> 33__FBSDID("$FreeBSD$"); 34 35#include "opt_inet.h" 36#include "opt_ipsec.h" 37 38#include <sys/param.h> 39#include <sys/systm.h> 40#include <sys/mbuf.h> 41#include <sys/protosw.h> 42#include <sys/socket.h> 43#include <sys/time.h> 44#include <sys/kernel.h> 45#include <sys/sysctl.h> 46#include <sys/syslog.h> 47 48#include <net/if.h> 49#include <net/if_types.h> 50#include <net/route.h> 51#include <net/vnet.h> 52 53#include <netinet/in.h> 54#include <netinet/in_pcb.h> 55#include <netinet/in_systm.h> 56#include <netinet/in_var.h> 57#include <netinet/ip.h> 58#include <netinet/ip_icmp.h> 59#include <netinet/ip_var.h> 60#include <netinet/ip_options.h> 61#include <netinet/tcp.h> 62#include <netinet/tcp_var.h> 63#include <netinet/tcpip.h> 64#include <netinet/icmp_var.h> 65 66#ifdef INET 67#ifdef IPSEC 68#include <netipsec/ipsec.h> 69#include <netipsec/key.h> 70#endif 71 72#include <machine/in_cksum.h> 73 74#include <security/mac/mac_framework.h> 75#endif /* INET */ 76 77/* 78 * ICMP routines: error generation, receive packet processing, and 79 * routines to turnaround packets back to the originator, and 80 * host table maintenance routines. 81 */ 82static VNET_DEFINE(int, icmplim) = 200; 83#define V_icmplim VNET(icmplim) 84SYSCTL_VNET_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW, 85 &VNET_NAME(icmplim), 0, 86 "Maximum number of ICMP responses per second"); 87 88static VNET_DEFINE(int, icmplim_output) = 1; 89#define V_icmplim_output VNET(icmplim_output) 90SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW, 91 &VNET_NAME(icmplim_output), 0, 92 "Enable logging of ICMP response rate limiting"); 93 94#ifdef INET 95VNET_PCPUSTAT_DEFINE(struct icmpstat, icmpstat); 96VNET_PCPUSTAT_SYSINIT(icmpstat); 97SYSCTL_VNET_PCPUSTAT(_net_inet_icmp, ICMPCTL_STATS, stats, struct icmpstat, 98 icmpstat, "ICMP statistics (struct icmpstat, netinet/icmp_var.h)"); 99 100#ifdef VIMAGE 101VNET_PCPUSTAT_SYSUNINIT(icmpstat); 102#endif /* VIMAGE */ 103 104static VNET_DEFINE(int, icmpmaskrepl) = 0; 105#define V_icmpmaskrepl VNET(icmpmaskrepl) 106SYSCTL_VNET_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW, 107 &VNET_NAME(icmpmaskrepl), 0, 108 "Reply to ICMP Address Mask Request packets."); 109 110static VNET_DEFINE(u_int, icmpmaskfake) = 0; 111#define V_icmpmaskfake VNET(icmpmaskfake) 112SYSCTL_VNET_UINT(_net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW, 113 &VNET_NAME(icmpmaskfake), 0, 114 "Fake reply to ICMP Address Mask Request packets."); 115 116VNET_DEFINE(int, drop_redirect) = 0; 117 118static VNET_DEFINE(int, log_redirect) = 0; 119#define V_log_redirect VNET(log_redirect) 120SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW, 121 &VNET_NAME(log_redirect), 0, 122 "Log ICMP redirects to the console"); 123 124static VNET_DEFINE(char, reply_src[IFNAMSIZ]); 125#define V_reply_src VNET(reply_src) 126SYSCTL_VNET_STRING(_net_inet_icmp, OID_AUTO, reply_src, CTLFLAG_RW, 127 &VNET_NAME(reply_src), IFNAMSIZ, 128 "icmp reply source for non-local packets."); 129 130static VNET_DEFINE(int, icmp_rfi) = 0; 131#define V_icmp_rfi VNET(icmp_rfi) 132SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, reply_from_interface, CTLFLAG_RW, 133 &VNET_NAME(icmp_rfi), 0, 134 "ICMP reply from incoming interface for non-local packets"); 135 136static VNET_DEFINE(int, icmp_quotelen) = 8; 137#define V_icmp_quotelen VNET(icmp_quotelen) 138SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, quotelen, CTLFLAG_RW, 139 &VNET_NAME(icmp_quotelen), 0, 140 "Number of bytes from original packet to quote in ICMP reply"); 141 142/* 143 * ICMP broadcast echo sysctl 144 */ 145static VNET_DEFINE(int, icmpbmcastecho) = 0; 146#define V_icmpbmcastecho VNET(icmpbmcastecho) 147SYSCTL_VNET_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW, 148 &VNET_NAME(icmpbmcastecho), 0, 149 ""); 150 151 152#ifdef ICMPPRINTFS 153int icmpprintfs = 0; 154#endif 155 156static void icmp_reflect(struct mbuf *); 157static void icmp_send(struct mbuf *, struct mbuf *); 158 159extern struct protosw inetsw[]; 160 161static int 162sysctl_net_icmp_drop_redir(SYSCTL_HANDLER_ARGS) 163{ 164 int error, new; 165 int i; 166 struct radix_node_head *rnh; 167 168 new = V_drop_redirect; 169 error = sysctl_handle_int(oidp, &new, 0, req); 170 if (error == 0 && req->newptr) { 171 new = (new != 0) ? 1 : 0; 172 173 if (new == V_drop_redirect) 174 return (0); 175 176 for (i = 0; i < rt_numfibs; i++) { 177 if ((rnh = rt_tables_get_rnh(i, AF_INET)) == NULL) 178 continue; 179 RADIX_NODE_HEAD_LOCK(rnh); 180 in_setmatchfunc(rnh, new); 181 RADIX_NODE_HEAD_UNLOCK(rnh); 182 } 183 184 V_drop_redirect = new; 185 } 186 187 return (error); 188} 189 190SYSCTL_VNET_PROC(_net_inet_icmp, OID_AUTO, drop_redirect, 191 CTLTYPE_INT|CTLFLAG_RW, 0, 0, 192 sysctl_net_icmp_drop_redir, "I", "Ignore ICMP redirects"); 193 194/* 195 * Kernel module interface for updating icmpstat. The argument is an index 196 * into icmpstat treated as an array of u_long. While this encodes the 197 * general layout of icmpstat into the caller, it doesn't encode its 198 * location, so that future changes to add, for example, per-CPU stats 199 * support won't cause binary compatibility problems for kernel modules. 200 */ 201void 202kmod_icmpstat_inc(int statnum) 203{ 204 205 counter_u64_add(VNET(icmpstat)[statnum], 1); 206} 207 208/* 209 * Generate an error packet of type error 210 * in response to bad packet ip. 211 */ 212void 213icmp_error(struct mbuf *n, int type, int code, uint32_t dest, int mtu) 214{ 215 register struct ip *oip = mtod(n, struct ip *), *nip; 216 register unsigned oiphlen = oip->ip_hl << 2; 217 register struct icmp *icp; 218 register struct mbuf *m; 219 unsigned icmplen, icmpelen, nlen; 220 221 KASSERT((u_int)type <= ICMP_MAXTYPE, ("%s: illegal ICMP type", __func__)); 222#ifdef ICMPPRINTFS 223 if (icmpprintfs) 224 printf("icmp_error(%p, %x, %d)\n", oip, type, code); 225#endif 226 if (type != ICMP_REDIRECT) 227 ICMPSTAT_INC(icps_error); 228 /* 229 * Don't send error: 230 * if the original packet was encrypted. 231 * if not the first fragment of message. 232 * in response to a multicast or broadcast packet. 233 * if the old packet protocol was an ICMP error message. 234 */ 235 if (n->m_flags & M_DECRYPTED) 236 goto freeit; 237 if (oip->ip_off & htons(~(IP_MF|IP_DF))) 238 goto freeit; 239 if (n->m_flags & (M_BCAST|M_MCAST)) 240 goto freeit; 241 if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT && 242 n->m_len >= oiphlen + ICMP_MINLEN && 243 !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiphlen))->icmp_type)) { 244 ICMPSTAT_INC(icps_oldicmp); 245 goto freeit; 246 } 247 /* Drop if IP header plus 8 bytes is not contignous in first mbuf. */ 248 if (oiphlen + 8 > n->m_len) 249 goto freeit; 250 /* 251 * Calculate length to quote from original packet and 252 * prevent the ICMP mbuf from overflowing. 253 * Unfortunatly this is non-trivial since ip_forward() 254 * sends us truncated packets. 255 */ 256 nlen = m_length(n, NULL); 257 if (oip->ip_p == IPPROTO_TCP) { 258 struct tcphdr *th; 259 int tcphlen; 260 261 if (oiphlen + sizeof(struct tcphdr) > n->m_len && 262 n->m_next == NULL) 263 goto stdreply; 264 if (n->m_len < oiphlen + sizeof(struct tcphdr) && 265 ((n = m_pullup(n, oiphlen + sizeof(struct tcphdr))) == NULL)) 266 goto freeit; 267 th = (struct tcphdr *)((caddr_t)oip + oiphlen); 268 tcphlen = th->th_off << 2; 269 if (tcphlen < sizeof(struct tcphdr)) 270 goto freeit; 271 if (ntohs(oip->ip_len) < oiphlen + tcphlen) 272 goto freeit; 273 if (oiphlen + tcphlen > n->m_len && n->m_next == NULL) 274 goto stdreply; 275 if (n->m_len < oiphlen + tcphlen && 276 ((n = m_pullup(n, oiphlen + tcphlen)) == NULL)) 277 goto freeit; 278 icmpelen = max(tcphlen, min(V_icmp_quotelen, 279 ntohs(oip->ip_len) - oiphlen)); 280 } else 281stdreply: icmpelen = max(8, min(V_icmp_quotelen, ntohs(oip->ip_len) - oiphlen)); 282 283 icmplen = min(oiphlen + icmpelen, nlen); 284 if (icmplen < sizeof(struct ip)) 285 goto freeit; 286 287 if (MHLEN > sizeof(struct ip) + ICMP_MINLEN + icmplen) 288 m = m_gethdr(M_NOWAIT, MT_DATA); 289 else 290 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 291 if (m == NULL) 292 goto freeit; 293#ifdef MAC 294 mac_netinet_icmp_reply(n, m); 295#endif 296 icmplen = min(icmplen, M_TRAILINGSPACE(m) - sizeof(struct ip) - ICMP_MINLEN); 297 m_align(m, ICMP_MINLEN + icmplen); 298 m->m_len = ICMP_MINLEN + icmplen; 299 300 /* XXX MRT make the outgoing packet use the same FIB 301 * that was associated with the incoming packet 302 */ 303 M_SETFIB(m, M_GETFIB(n)); 304 icp = mtod(m, struct icmp *); 305 ICMPSTAT_INC(icps_outhist[type]); 306 icp->icmp_type = type; 307 if (type == ICMP_REDIRECT) 308 icp->icmp_gwaddr.s_addr = dest; 309 else { 310 icp->icmp_void = 0; 311 /* 312 * The following assignments assume an overlay with the 313 * just zeroed icmp_void field. 314 */ 315 if (type == ICMP_PARAMPROB) { 316 icp->icmp_pptr = code; 317 code = 0; 318 } else if (type == ICMP_UNREACH && 319 code == ICMP_UNREACH_NEEDFRAG && mtu) { 320 icp->icmp_nextmtu = htons(mtu); 321 } 322 } 323 icp->icmp_code = code; 324 325 /* 326 * Copy the quotation into ICMP message and 327 * convert quoted IP header back to network representation. 328 */ 329 m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip); 330 nip = &icp->icmp_ip; 331 332 /* 333 * Set up ICMP message mbuf and copy old IP header (without options 334 * in front of ICMP message. 335 * If the original mbuf was meant to bypass the firewall, the error 336 * reply should bypass as well. 337 */ 338 m->m_flags |= n->m_flags & M_SKIP_FIREWALL; 339 m->m_data -= sizeof(struct ip); 340 m->m_len += sizeof(struct ip); 341 m->m_pkthdr.len = m->m_len; 342 m->m_pkthdr.rcvif = n->m_pkthdr.rcvif; 343 nip = mtod(m, struct ip *); 344 bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip)); 345 nip->ip_len = htons(m->m_len); 346 nip->ip_v = IPVERSION; 347 nip->ip_hl = 5; 348 nip->ip_p = IPPROTO_ICMP; 349 nip->ip_tos = 0; 350 icmp_reflect(m); 351 352freeit: 353 m_freem(n); 354} 355 356/* 357 * Process a received ICMP message. 358 */ 359void 360icmp_input(struct mbuf *m, int off) 361{ 362 struct icmp *icp; 363 struct in_ifaddr *ia; 364 struct ip *ip = mtod(m, struct ip *); 365 struct sockaddr_in icmpsrc, icmpdst, icmpgw; 366 int hlen = off; 367 int icmplen = ntohs(ip->ip_len) - off; 368 int i, code; 369 void (*ctlfunc)(int, struct sockaddr *, void *); 370 int fibnum; 371 372 /* 373 * Locate icmp structure in mbuf, and check 374 * that not corrupted and of at least minimum length. 375 */ 376#ifdef ICMPPRINTFS 377 if (icmpprintfs) { 378 char buf[4 * sizeof "123"]; 379 strcpy(buf, inet_ntoa(ip->ip_src)); 380 printf("icmp_input from %s to %s, len %d\n", 381 buf, inet_ntoa(ip->ip_dst), icmplen); 382 } 383#endif 384 if (icmplen < ICMP_MINLEN) { 385 ICMPSTAT_INC(icps_tooshort); 386 goto freeit; 387 } 388 i = hlen + min(icmplen, ICMP_ADVLENMIN); 389 if (m->m_len < i && (m = m_pullup(m, i)) == NULL) { 390 ICMPSTAT_INC(icps_tooshort); 391 return; 392 } 393 ip = mtod(m, struct ip *); 394 m->m_len -= hlen; 395 m->m_data += hlen; 396 icp = mtod(m, struct icmp *); 397 if (in_cksum(m, icmplen)) { 398 ICMPSTAT_INC(icps_checksum); 399 goto freeit; 400 } 401 m->m_len += hlen; 402 m->m_data -= hlen; 403 404 if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) { 405 /* 406 * Deliver very specific ICMP type only. 407 */ 408 switch (icp->icmp_type) { 409 case ICMP_UNREACH: 410 case ICMP_TIMXCEED: 411 break; 412 default: 413 goto freeit; 414 } 415 } 416 417#ifdef ICMPPRINTFS 418 if (icmpprintfs) 419 printf("icmp_input, type %d code %d\n", icp->icmp_type, 420 icp->icmp_code); 421#endif 422 423 /* 424 * Message type specific processing. 425 */ 426 if (icp->icmp_type > ICMP_MAXTYPE) 427 goto raw; 428 429 /* Initialize */ 430 bzero(&icmpsrc, sizeof(icmpsrc)); 431 icmpsrc.sin_len = sizeof(struct sockaddr_in); 432 icmpsrc.sin_family = AF_INET; 433 bzero(&icmpdst, sizeof(icmpdst)); 434 icmpdst.sin_len = sizeof(struct sockaddr_in); 435 icmpdst.sin_family = AF_INET; 436 bzero(&icmpgw, sizeof(icmpgw)); 437 icmpgw.sin_len = sizeof(struct sockaddr_in); 438 icmpgw.sin_family = AF_INET; 439 440 ICMPSTAT_INC(icps_inhist[icp->icmp_type]); 441 code = icp->icmp_code; 442 switch (icp->icmp_type) { 443 444 case ICMP_UNREACH: 445 switch (code) { 446 case ICMP_UNREACH_NET: 447 case ICMP_UNREACH_HOST: 448 case ICMP_UNREACH_SRCFAIL: 449 case ICMP_UNREACH_NET_UNKNOWN: 450 case ICMP_UNREACH_HOST_UNKNOWN: 451 case ICMP_UNREACH_ISOLATED: 452 case ICMP_UNREACH_TOSNET: 453 case ICMP_UNREACH_TOSHOST: 454 case ICMP_UNREACH_HOST_PRECEDENCE: 455 case ICMP_UNREACH_PRECEDENCE_CUTOFF: 456 code = PRC_UNREACH_NET; 457 break; 458 459 case ICMP_UNREACH_NEEDFRAG: 460 code = PRC_MSGSIZE; 461 break; 462 463 /* 464 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9. 465 * Treat subcodes 2,3 as immediate RST 466 */ 467 case ICMP_UNREACH_PROTOCOL: 468 case ICMP_UNREACH_PORT: 469 code = PRC_UNREACH_PORT; 470 break; 471 472 case ICMP_UNREACH_NET_PROHIB: 473 case ICMP_UNREACH_HOST_PROHIB: 474 case ICMP_UNREACH_FILTER_PROHIB: 475 code = PRC_UNREACH_ADMIN_PROHIB; 476 break; 477 478 default: 479 goto badcode; 480 } 481 goto deliver; 482 483 case ICMP_TIMXCEED: 484 if (code > 1) 485 goto badcode; 486 code += PRC_TIMXCEED_INTRANS; 487 goto deliver; 488 489 case ICMP_PARAMPROB: 490 if (code > 1) 491 goto badcode; 492 code = PRC_PARAMPROB; 493 goto deliver; 494 495 case ICMP_SOURCEQUENCH: 496 if (code) 497 goto badcode; 498 code = PRC_QUENCH; 499 deliver: 500 /* 501 * Problem with datagram; advise higher level routines. 502 */ 503 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) || 504 icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) { 505 ICMPSTAT_INC(icps_badlen); 506 goto freeit; 507 } 508 /* Discard ICMP's in response to multicast packets */ 509 if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr))) 510 goto badcode; 511#ifdef ICMPPRINTFS 512 if (icmpprintfs) 513 printf("deliver to protocol %d\n", icp->icmp_ip.ip_p); 514#endif 515 icmpsrc.sin_addr = icp->icmp_ip.ip_dst; 516 /* 517 * XXX if the packet contains [IPv4 AH TCP], we can't make a 518 * notification to TCP layer. 519 */ 520 ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput; 521 if (ctlfunc) 522 (*ctlfunc)(code, (struct sockaddr *)&icmpsrc, 523 (void *)&icp->icmp_ip); 524 break; 525 526 badcode: 527 ICMPSTAT_INC(icps_badcode); 528 break; 529 530 case ICMP_ECHO: 531 if (!V_icmpbmcastecho 532 && (m->m_flags & (M_MCAST | M_BCAST)) != 0) { 533 ICMPSTAT_INC(icps_bmcastecho); 534 break; 535 } 536 icp->icmp_type = ICMP_ECHOREPLY; 537 if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0) 538 goto freeit; 539 else 540 goto reflect; 541 542 case ICMP_TSTAMP: 543 if (!V_icmpbmcastecho 544 && (m->m_flags & (M_MCAST | M_BCAST)) != 0) { 545 ICMPSTAT_INC(icps_bmcasttstamp); 546 break; 547 } 548 if (icmplen < ICMP_TSLEN) { 549 ICMPSTAT_INC(icps_badlen); 550 break; 551 } 552 icp->icmp_type = ICMP_TSTAMPREPLY; 553 icp->icmp_rtime = iptime(); 554 icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */ 555 if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0) 556 goto freeit; 557 else 558 goto reflect; 559 560 case ICMP_MASKREQ: 561 if (V_icmpmaskrepl == 0) 562 break; 563 /* 564 * We are not able to respond with all ones broadcast 565 * unless we receive it over a point-to-point interface. 566 */ 567 if (icmplen < ICMP_MASKLEN) 568 break; 569 switch (ip->ip_dst.s_addr) { 570 571 case INADDR_BROADCAST: 572 case INADDR_ANY: 573 icmpdst.sin_addr = ip->ip_src; 574 break; 575 576 default: 577 icmpdst.sin_addr = ip->ip_dst; 578 } 579 ia = (struct in_ifaddr *)ifaof_ifpforaddr( 580 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif); 581 if (ia == NULL) 582 break; 583 if (ia->ia_ifp == NULL) { 584 ifa_free(&ia->ia_ifa); 585 break; 586 } 587 icp->icmp_type = ICMP_MASKREPLY; 588 if (V_icmpmaskfake == 0) 589 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr; 590 else 591 icp->icmp_mask = V_icmpmaskfake; 592 if (ip->ip_src.s_addr == 0) { 593 if (ia->ia_ifp->if_flags & IFF_BROADCAST) 594 ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr; 595 else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) 596 ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr; 597 } 598 ifa_free(&ia->ia_ifa); 599reflect: 600 ICMPSTAT_INC(icps_reflect); 601 ICMPSTAT_INC(icps_outhist[icp->icmp_type]); 602 icmp_reflect(m); 603 return; 604 605 case ICMP_REDIRECT: 606 if (V_log_redirect) { 607 u_long src, dst, gw; 608 609 src = ntohl(ip->ip_src.s_addr); 610 dst = ntohl(icp->icmp_ip.ip_dst.s_addr); 611 gw = ntohl(icp->icmp_gwaddr.s_addr); 612 printf("icmp redirect from %d.%d.%d.%d: " 613 "%d.%d.%d.%d => %d.%d.%d.%d\n", 614 (int)(src >> 24), (int)((src >> 16) & 0xff), 615 (int)((src >> 8) & 0xff), (int)(src & 0xff), 616 (int)(dst >> 24), (int)((dst >> 16) & 0xff), 617 (int)((dst >> 8) & 0xff), (int)(dst & 0xff), 618 (int)(gw >> 24), (int)((gw >> 16) & 0xff), 619 (int)((gw >> 8) & 0xff), (int)(gw & 0xff)); 620 } 621 /* 622 * RFC1812 says we must ignore ICMP redirects if we 623 * are acting as router. 624 */ 625 if (V_drop_redirect || V_ipforwarding) 626 break; 627 if (code > 3) 628 goto badcode; 629 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) || 630 icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) { 631 ICMPSTAT_INC(icps_badlen); 632 break; 633 } 634 /* 635 * Short circuit routing redirects to force 636 * immediate change in the kernel's routing 637 * tables. The message is also handed to anyone 638 * listening on a raw socket (e.g. the routing 639 * daemon for use in updating its tables). 640 */ 641 icmpgw.sin_addr = ip->ip_src; 642 icmpdst.sin_addr = icp->icmp_gwaddr; 643#ifdef ICMPPRINTFS 644 if (icmpprintfs) { 645 char buf[4 * sizeof "123"]; 646 strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst)); 647 648 printf("redirect dst %s to %s\n", 649 buf, inet_ntoa(icp->icmp_gwaddr)); 650 } 651#endif 652 icmpsrc.sin_addr = icp->icmp_ip.ip_dst; 653 for ( fibnum = 0; fibnum < rt_numfibs; fibnum++) { 654 in_rtredirect((struct sockaddr *)&icmpsrc, 655 (struct sockaddr *)&icmpdst, 656 (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST, 657 (struct sockaddr *)&icmpgw, fibnum); 658 } 659 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc); 660#ifdef IPSEC 661 key_sa_routechange((struct sockaddr *)&icmpsrc); 662#endif 663 break; 664 665 /* 666 * No kernel processing for the following; 667 * just fall through to send to raw listener. 668 */ 669 case ICMP_ECHOREPLY: 670 case ICMP_ROUTERADVERT: 671 case ICMP_ROUTERSOLICIT: 672 case ICMP_TSTAMPREPLY: 673 case ICMP_IREQREPLY: 674 case ICMP_MASKREPLY: 675 default: 676 break; 677 } 678 679raw: 680 rip_input(m, off); 681 return; 682 683freeit: 684 m_freem(m); 685} 686 687/* 688 * Reflect the ip packet back to the source 689 */ 690static void 691icmp_reflect(struct mbuf *m) 692{ 693 struct ip *ip = mtod(m, struct ip *); 694 struct ifaddr *ifa; 695 struct ifnet *ifp; 696 struct in_ifaddr *ia; 697 struct in_addr t; 698 struct mbuf *opts = 0; 699 int optlen = (ip->ip_hl << 2) - sizeof(struct ip); 700 701 if (IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 702 IN_EXPERIMENTAL(ntohl(ip->ip_src.s_addr)) || 703 IN_ZERONET(ntohl(ip->ip_src.s_addr)) ) { 704 m_freem(m); /* Bad return address */ 705 ICMPSTAT_INC(icps_badaddr); 706 goto done; /* Ip_output() will check for broadcast */ 707 } 708 709 t = ip->ip_dst; 710 ip->ip_dst = ip->ip_src; 711 712 /* 713 * Source selection for ICMP replies: 714 * 715 * If the incoming packet was addressed directly to one of our 716 * own addresses, use dst as the src for the reply. 717 */ 718 IN_IFADDR_RLOCK(); 719 LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) { 720 if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) { 721 t = IA_SIN(ia)->sin_addr; 722 IN_IFADDR_RUNLOCK(); 723 goto match; 724 } 725 } 726 IN_IFADDR_RUNLOCK(); 727 728 /* 729 * If the incoming packet was addressed to one of our broadcast 730 * addresses, use the first non-broadcast address which corresponds 731 * to the incoming interface. 732 */ 733 ifp = m->m_pkthdr.rcvif; 734 if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) { 735 IF_ADDR_RLOCK(ifp); 736 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 737 if (ifa->ifa_addr->sa_family != AF_INET) 738 continue; 739 ia = ifatoia(ifa); 740 if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr == 741 t.s_addr) { 742 t = IA_SIN(ia)->sin_addr; 743 IF_ADDR_RUNLOCK(ifp); 744 goto match; 745 } 746 } 747 IF_ADDR_RUNLOCK(ifp); 748 } 749 /* 750 * If the packet was transiting through us, use the address of 751 * the interface the packet came through in. If that interface 752 * doesn't have a suitable IP address, the normal selection 753 * criteria apply. 754 */ 755 if (V_icmp_rfi && ifp != NULL) { 756 IF_ADDR_RLOCK(ifp); 757 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 758 if (ifa->ifa_addr->sa_family != AF_INET) 759 continue; 760 ia = ifatoia(ifa); 761 t = IA_SIN(ia)->sin_addr; 762 IF_ADDR_RUNLOCK(ifp); 763 goto match; 764 } 765 IF_ADDR_RUNLOCK(ifp); 766 } 767 /* 768 * If the incoming packet was not addressed directly to us, use 769 * designated interface for icmp replies specified by sysctl 770 * net.inet.icmp.reply_src (default not set). Otherwise continue 771 * with normal source selection. 772 */ 773 if (V_reply_src[0] != '\0' && (ifp = ifunit(V_reply_src))) { 774 IF_ADDR_RLOCK(ifp); 775 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 776 if (ifa->ifa_addr->sa_family != AF_INET) 777 continue; 778 ia = ifatoia(ifa); 779 t = IA_SIN(ia)->sin_addr; 780 IF_ADDR_RUNLOCK(ifp); 781 goto match; 782 } 783 IF_ADDR_RUNLOCK(ifp); 784 } 785 /* 786 * If the packet was transiting through us, use the address of 787 * the interface that is the closest to the packet source. 788 * When we don't have a route back to the packet source, stop here 789 * and drop the packet. 790 */ 791 ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m)); 792 if (ia == NULL) { 793 m_freem(m); 794 ICMPSTAT_INC(icps_noroute); 795 goto done; 796 } 797 t = IA_SIN(ia)->sin_addr; 798 ifa_free(&ia->ia_ifa); 799match: 800#ifdef MAC 801 mac_netinet_icmp_replyinplace(m); 802#endif 803 ip->ip_src = t; 804 ip->ip_ttl = V_ip_defttl; 805 806 if (optlen > 0) { 807 register u_char *cp; 808 int opt, cnt; 809 u_int len; 810 811 /* 812 * Retrieve any source routing from the incoming packet; 813 * add on any record-route or timestamp options. 814 */ 815 cp = (u_char *) (ip + 1); 816 if ((opts = ip_srcroute(m)) == 0 && 817 (opts = m_gethdr(M_NOWAIT, MT_DATA))) { 818 opts->m_len = sizeof(struct in_addr); 819 mtod(opts, struct in_addr *)->s_addr = 0; 820 } 821 if (opts) { 822#ifdef ICMPPRINTFS 823 if (icmpprintfs) 824 printf("icmp_reflect optlen %d rt %d => ", 825 optlen, opts->m_len); 826#endif 827 for (cnt = optlen; cnt > 0; cnt -= len, cp += len) { 828 opt = cp[IPOPT_OPTVAL]; 829 if (opt == IPOPT_EOL) 830 break; 831 if (opt == IPOPT_NOP) 832 len = 1; 833 else { 834 if (cnt < IPOPT_OLEN + sizeof(*cp)) 835 break; 836 len = cp[IPOPT_OLEN]; 837 if (len < IPOPT_OLEN + sizeof(*cp) || 838 len > cnt) 839 break; 840 } 841 /* 842 * Should check for overflow, but it "can't happen" 843 */ 844 if (opt == IPOPT_RR || opt == IPOPT_TS || 845 opt == IPOPT_SECURITY) { 846 bcopy((caddr_t)cp, 847 mtod(opts, caddr_t) + opts->m_len, len); 848 opts->m_len += len; 849 } 850 } 851 /* Terminate & pad, if necessary */ 852 cnt = opts->m_len % 4; 853 if (cnt) { 854 for (; cnt < 4; cnt++) { 855 *(mtod(opts, caddr_t) + opts->m_len) = 856 IPOPT_EOL; 857 opts->m_len++; 858 } 859 } 860#ifdef ICMPPRINTFS 861 if (icmpprintfs) 862 printf("%d\n", opts->m_len); 863#endif 864 } 865 ip_stripoptions(m); 866 } 867 m_tag_delete_nonpersistent(m); 868 m->m_flags &= ~(M_BCAST|M_MCAST); 869 icmp_send(m, opts); 870done: 871 if (opts) 872 (void)m_free(opts); 873} 874 875/* 876 * Send an icmp packet back to the ip level, 877 * after supplying a checksum. 878 */ 879static void 880icmp_send(struct mbuf *m, struct mbuf *opts) 881{ 882 register struct ip *ip = mtod(m, struct ip *); 883 register int hlen; 884 register struct icmp *icp; 885 886 hlen = ip->ip_hl << 2; 887 m->m_data += hlen; 888 m->m_len -= hlen; 889 icp = mtod(m, struct icmp *); 890 icp->icmp_cksum = 0; 891 icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen); 892 m->m_data -= hlen; 893 m->m_len += hlen; 894 m->m_pkthdr.rcvif = (struct ifnet *)0; 895#ifdef ICMPPRINTFS 896 if (icmpprintfs) { 897 char buf[4 * sizeof "123"]; 898 strcpy(buf, inet_ntoa(ip->ip_dst)); 899 printf("icmp_send dst %s src %s\n", 900 buf, inet_ntoa(ip->ip_src)); 901 } 902#endif 903 (void) ip_output(m, opts, NULL, 0, NULL, NULL); 904} 905 906/* 907 * Return milliseconds since 00:00 GMT in network format. 908 */ 909uint32_t 910iptime(void) 911{ 912 struct timeval atv; 913 u_long t; 914 915 getmicrotime(&atv); 916 t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000; 917 return (htonl(t)); 918} 919 920/* 921 * Return the next larger or smaller MTU plateau (table from RFC 1191) 922 * given current value MTU. If DIR is less than zero, a larger plateau 923 * is returned; otherwise, a smaller value is returned. 924 */ 925int 926ip_next_mtu(int mtu, int dir) 927{ 928 static int mtutab[] = { 929 65535, 32000, 17914, 8166, 4352, 2002, 1492, 1280, 1006, 508, 930 296, 68, 0 931 }; 932 int i, size; 933 934 size = (sizeof mtutab) / (sizeof mtutab[0]); 935 if (dir >= 0) { 936 for (i = 0; i < size; i++) 937 if (mtu > mtutab[i]) 938 return mtutab[i]; 939 } else { 940 for (i = size - 1; i >= 0; i--) 941 if (mtu < mtutab[i]) 942 return mtutab[i]; 943 if (mtu == mtutab[0]) 944 return mtutab[0]; 945 } 946 return 0; 947} 948#endif /* INET */ 949 950 951/* 952 * badport_bandlim() - check for ICMP bandwidth limit 953 * 954 * Return 0 if it is ok to send an ICMP error response, -1 if we have 955 * hit our bandwidth limit and it is not ok. 956 * 957 * If icmplim is <= 0, the feature is disabled and 0 is returned. 958 * 959 * For now we separate the TCP and UDP subsystems w/ different 'which' 960 * values. We may eventually remove this separation (and simplify the 961 * code further). 962 * 963 * Note that the printing of the error message is delayed so we can 964 * properly print the icmp error rate that the system was trying to do 965 * (i.e. 22000/100 pps, etc...). This can cause long delays in printing 966 * the 'final' error, but it doesn't make sense to solve the printing 967 * delay with more complex code. 968 */ 969 970int 971badport_bandlim(int which) 972{ 973 974#define N(a) (sizeof (a) / sizeof (a[0])) 975 static struct rate { 976 const char *type; 977 struct timeval lasttime; 978 int curpps; 979 } rates[BANDLIM_MAX+1] = { 980 { "icmp unreach response" }, 981 { "icmp ping response" }, 982 { "icmp tstamp response" }, 983 { "closed port RST response" }, 984 { "open port RST response" }, 985 { "icmp6 unreach response" }, 986 { "sctp ootb response" } 987 }; 988 989 /* 990 * Return ok status if feature disabled or argument out of range. 991 */ 992 if (V_icmplim > 0 && (u_int) which < N(rates)) { 993 struct rate *r = &rates[which]; 994 int opps = r->curpps; 995 996 if (!ppsratecheck(&r->lasttime, &r->curpps, V_icmplim)) 997 return -1; /* discard packet */ 998 /* 999 * If we've dropped below the threshold after having 1000 * rate-limited traffic print the message. This preserves 1001 * the previous behaviour at the expense of added complexity. 1002 */ 1003 if (V_icmplim_output && opps > V_icmplim) 1004 log(LOG_NOTICE, "Limiting %s from %d to %d packets/sec\n", 1005 r->type, opps, V_icmplim); 1006 } 1007 return 0; /* okay to send packet */ 1008#undef N 1009} 1010