1/*
2 * Copyright (c) 1992 Regents of the University of California.
3 * All rights reserved.
4 *
5 * This software was developed by the Computer Systems Engineering group
6 * at Lawrence Berkeley Laboratory under DARPA contract BG 91-66 and
7 * contributed to Berkeley.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the University nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34/*
35 * The send and receive functions were originally implemented in udp.c and
36 * moved here. Also it is likely some more cleanup can be done, especially
37 * once we will implement the support for tcp.
38 */
39
40#include <sys/cdefs.h>
41__FBSDID("$FreeBSD: stable/11/stand/libsa/ip.c 346477 2019-04-21 03:43:27Z kevans $");
42
43#include <sys/param.h>
44#include <sys/socket.h>
45#include <sys/queue.h>
46
47#include <string.h>
48
49#include <net/if.h>
50#include <netinet/in.h>
51#include <netinet/if_ether.h>
52#include <netinet/in_systm.h>
53
54#include <netinet/ip.h>
55#include <netinet/ip_var.h>
56#include <netinet/udp.h>
57#include <netinet/udp_var.h>
58
59#include "stand.h"
60#include "net.h"
61
62typedef STAILQ_HEAD(ipqueue, ip_queue) ip_queue_t;
63struct ip_queue {
64	void		*ipq_pkt;
65	struct ip	*ipq_hdr;
66	STAILQ_ENTRY(ip_queue) ipq_next;
67};
68
69/*
70 * Fragment re-assembly queue.
71 */
72struct ip_reasm {
73	struct in_addr	ip_src;
74	struct in_addr	ip_dst;
75	uint16_t	ip_id;
76	uint8_t		ip_proto;
77	uint8_t		ip_ttl;
78	size_t		ip_total_size;
79	ip_queue_t	ip_queue;
80	void		*ip_pkt;
81	struct ip	*ip_hdr;
82	STAILQ_ENTRY(ip_reasm) ip_next;
83};
84
85STAILQ_HEAD(ire_list, ip_reasm) ire_list = STAILQ_HEAD_INITIALIZER(ire_list);
86
87/* Caller must leave room for ethernet and ip headers in front!! */
88ssize_t
89sendip(struct iodesc *d, void *pkt, size_t len, uint8_t proto)
90{
91	ssize_t cc;
92	struct ip *ip;
93	u_char *ea;
94
95#ifdef NET_DEBUG
96	if (debug) {
97		printf("sendip: proto: %x d=%p called.\n", proto, (void *)d);
98		if (d) {
99			printf("saddr: %s:%d",
100			    inet_ntoa(d->myip), ntohs(d->myport));
101			printf(" daddr: %s:%d\n",
102			    inet_ntoa(d->destip), ntohs(d->destport));
103		}
104	}
105#endif
106
107	ip = (struct ip *)pkt - 1;
108	len += sizeof(*ip);
109
110	bzero(ip, sizeof(*ip));
111
112	ip->ip_v = IPVERSION;			/* half-char */
113	ip->ip_hl = sizeof(*ip) >> 2;		/* half-char */
114	ip->ip_len = htons(len);
115	ip->ip_p = proto;			/* char */
116	ip->ip_ttl = IPDEFTTL;			/* char */
117	ip->ip_src = d->myip;
118	ip->ip_dst = d->destip;
119	ip->ip_sum = in_cksum(ip, sizeof(*ip));	 /* short, but special */
120
121	if (ip->ip_dst.s_addr == INADDR_BROADCAST || ip->ip_src.s_addr == 0 ||
122	    netmask == 0 || SAMENET(ip->ip_src, ip->ip_dst, netmask))
123		ea = arpwhohas(d, ip->ip_dst);
124	else
125		ea = arpwhohas(d, gateip);
126
127	cc = sendether(d, ip, len, ea, ETHERTYPE_IP);
128	if (cc == -1)
129		return (-1);
130	if (cc != len)
131		panic("sendip: bad write (%zd != %zd)", cc, len);
132	return (cc - sizeof(*ip));
133}
134
135static void
136ip_reasm_free(struct ip_reasm *ipr)
137{
138	struct ip_queue *ipq;
139
140	while ((ipq = STAILQ_FIRST(&ipr->ip_queue)) != NULL) {
141		STAILQ_REMOVE_HEAD(&ipr->ip_queue, ipq_next);
142		free(ipq->ipq_pkt);
143		free(ipq);
144	}
145	free(ipr->ip_pkt);
146	free(ipr);
147}
148
149static int
150ip_reasm_add(struct ip_reasm *ipr, void *pkt, struct ip *ip)
151{
152	struct ip_queue *ipq, *prev, *p;
153
154	if ((ipq = calloc(1, sizeof (*ipq))) == NULL)
155		return (1);
156
157	ipq->ipq_pkt = pkt;
158	ipq->ipq_hdr = ip;
159
160	prev = NULL;
161	STAILQ_FOREACH(p, &ipr->ip_queue, ipq_next) {
162		if ((ntohs(p->ipq_hdr->ip_off) & IP_OFFMASK) <
163		    (ntohs(ip->ip_off) & IP_OFFMASK)) {
164			prev = p;
165			continue;
166		}
167		if (prev == NULL)
168			break;
169
170		STAILQ_INSERT_AFTER(&ipr->ip_queue, prev, ipq, ipq_next);
171		return (0);
172	}
173	STAILQ_INSERT_HEAD(&ipr->ip_queue, ipq, ipq_next);
174	return (0);
175}
176
177/*
178 * Receive a IP packet and validate it is for us.
179 */
180static ssize_t
181readipv4(struct iodesc *d, void **pkt, void **payload, time_t tleft,
182    uint8_t proto)
183{
184	ssize_t n;
185	size_t hlen;
186	struct ether_header *eh;
187	struct ip *ip;
188	struct udphdr *uh;
189	uint16_t etype;		/* host order */
190	char *ptr;
191	struct ip_reasm *ipr;
192	struct ip_queue *ipq, *last;
193
194#ifdef NET_DEBUG
195	if (debug)
196		printf("readip: called\n");
197#endif
198
199	ip = NULL;
200	ptr = NULL;
201	n = readether(d, (void **)&ptr, (void **)&ip, tleft, &etype);
202	if (n == -1 || n < sizeof(*ip) + sizeof(*uh)) {
203		free(ptr);
204		return (-1);
205	}
206
207	/* Ethernet address checks now in readether() */
208
209	/* Need to respond to ARP requests. */
210	if (etype == ETHERTYPE_ARP) {
211		struct arphdr *ah = (void *)ip;
212		if (ah->ar_op == htons(ARPOP_REQUEST)) {
213			/* Send ARP reply */
214			arp_reply(d, ah);
215		}
216		free(ptr);
217		errno = EAGAIN;	/* Call me again. */
218		return (-1);
219	}
220
221	if (etype != ETHERTYPE_IP) {
222#ifdef NET_DEBUG
223		if (debug)
224			printf("readip: not IP. ether_type=%x\n", etype);
225#endif
226		free(ptr);
227		return (-1);
228	}
229
230	/* Check ip header */
231	if (ip->ip_v != IPVERSION ||	/* half char */
232	    ip->ip_p != proto) {
233#ifdef NET_DEBUG
234		if (debug) {
235			printf("readip: IP version or proto. ip_v=%d ip_p=%d\n",
236			    ip->ip_v, ip->ip_p);
237		}
238#endif
239		free(ptr);
240		return (-1);
241	}
242
243	hlen = ip->ip_hl << 2;
244	if (hlen < sizeof(*ip) ||
245	    in_cksum(ip, hlen) != 0) {
246#ifdef NET_DEBUG
247		if (debug)
248			printf("readip: short hdr or bad cksum.\n");
249#endif
250		free(ptr);
251		return (-1);
252	}
253	if (n < ntohs(ip->ip_len)) {
254#ifdef NET_DEBUG
255		if (debug)
256			printf("readip: bad length %d < %d.\n",
257			       (int)n, ntohs(ip->ip_len));
258#endif
259		free(ptr);
260		return (-1);
261	}
262	if (d->myip.s_addr && ip->ip_dst.s_addr != d->myip.s_addr) {
263#ifdef NET_DEBUG
264		if (debug) {
265			printf("readip: bad saddr %s != ", inet_ntoa(d->myip));
266			printf("%s\n", inet_ntoa(ip->ip_dst));
267		}
268#endif
269		free(ptr);
270		return (-1);
271	}
272
273	/* Unfragmented packet. */
274	if ((ntohs(ip->ip_off) & IP_MF) == 0 &&
275	    (ntohs(ip->ip_off) & IP_OFFMASK) == 0) {
276		uh = (struct udphdr *)((uintptr_t)ip + sizeof (*ip));
277		/* If there were ip options, make them go away */
278		if (hlen != sizeof(*ip)) {
279			bcopy(((u_char *)ip) + hlen, uh, uh->uh_ulen - hlen);
280			ip->ip_len = htons(sizeof(*ip));
281			n -= hlen - sizeof(*ip);
282		}
283
284		n = (n > (ntohs(ip->ip_len) - sizeof(*ip))) ?
285		    ntohs(ip->ip_len) - sizeof(*ip) : n;
286		*pkt = ptr;
287		*payload = (void *)((uintptr_t)ip + sizeof(*ip));
288		return (n);
289	}
290
291	STAILQ_FOREACH(ipr, &ire_list, ip_next) {
292		if (ipr->ip_src.s_addr == ip->ip_src.s_addr &&
293		    ipr->ip_dst.s_addr == ip->ip_dst.s_addr &&
294		    ipr->ip_id == ip->ip_id &&
295		    ipr->ip_proto == ip->ip_p)
296			break;
297	}
298
299	/* Allocate new reassembly entry */
300	if (ipr == NULL) {
301		if ((ipr = calloc(1, sizeof (*ipr))) == NULL) {
302			free(ptr);
303			return (-1);
304		}
305
306		ipr->ip_src = ip->ip_src;
307		ipr->ip_dst = ip->ip_dst;
308		ipr->ip_id = ip->ip_id;
309		ipr->ip_proto = ip->ip_p;
310		ipr->ip_ttl = MAXTTL;
311		STAILQ_INIT(&ipr->ip_queue);
312		STAILQ_INSERT_TAIL(&ire_list, ipr, ip_next);
313	}
314
315	if (ip_reasm_add(ipr, ptr, ip) != 0) {
316		STAILQ_REMOVE(&ire_list, ipr, ip_reasm, ip_next);
317		free(ipr);
318		free(ptr);
319		return (-1);
320	}
321
322	if ((ntohs(ip->ip_off) & IP_MF) == 0) {
323		ipr->ip_total_size = (8 * (ntohs(ip->ip_off) & IP_OFFMASK));
324		ipr->ip_total_size += n + sizeof (*ip);
325		ipr->ip_total_size += sizeof (struct ether_header);
326
327		ipr->ip_pkt = malloc(ipr->ip_total_size + 2);
328		if (ipr->ip_pkt == NULL) {
329			STAILQ_REMOVE(&ire_list, ipr, ip_reasm, ip_next);
330			ip_reasm_free(ipr);
331			return (-1);
332		}
333	}
334
335	/*
336	 * If we do not have re-assembly buffer ipr->ip_pkt, we are still
337	 * missing fragments, so just restart the read.
338	 */
339	if (ipr->ip_pkt == NULL) {
340		errno = EAGAIN;
341		return (-1);
342	}
343
344	/*
345	 * Walk the packet list in reassembly queue, if we got all the
346	 * fragments, build the packet.
347	 */
348	n = 0;
349	last = NULL;
350	STAILQ_FOREACH(ipq, &ipr->ip_queue, ipq_next) {
351		if ((ntohs(ipq->ipq_hdr->ip_off) & IP_OFFMASK) != n / 8) {
352			STAILQ_REMOVE(&ire_list, ipr, ip_reasm, ip_next);
353			ip_reasm_free(ipr);
354			return (-1);
355		}
356
357		n += ntohs(ipq->ipq_hdr->ip_len) - (ipq->ipq_hdr->ip_hl << 2);
358		last = ipq;
359	}
360	if ((ntohs(last->ipq_hdr->ip_off) & IP_MF) != 0) {
361		errno = EAGAIN;
362		return (-1);
363	}
364
365	ipq = STAILQ_FIRST(&ipr->ip_queue);
366	/* Fabricate ethernet header */
367	eh = (struct ether_header *)((uintptr_t)ipr->ip_pkt + 2);
368	bcopy((void *)((uintptr_t)ipq->ipq_pkt + 2), eh, sizeof (*eh));
369
370	/* Fabricate IP header */
371	ipr->ip_hdr = (struct ip *)((uintptr_t)eh + sizeof (*eh));
372	bcopy(ipq->ipq_hdr, ipr->ip_hdr, sizeof (*ipr->ip_hdr));
373	ipr->ip_hdr->ip_hl = sizeof (*ipr->ip_hdr) >> 2;
374	ipr->ip_hdr->ip_len = htons(n);
375	ipr->ip_hdr->ip_sum = 0;
376	ipr->ip_hdr->ip_sum = in_cksum(ipr->ip_hdr, sizeof (*ipr->ip_hdr));
377
378	n = 0;
379	ptr = (char *)((uintptr_t)ipr->ip_hdr + sizeof (*ipr->ip_hdr));
380	STAILQ_FOREACH(ipq, &ipr->ip_queue, ipq_next) {
381		char *data;
382		size_t len;
383
384		hlen = ipq->ipq_hdr->ip_hl << 2;
385		len = ntohs(ipq->ipq_hdr->ip_len) - hlen;
386		data = (char *)((uintptr_t)ipq->ipq_hdr + hlen);
387
388		bcopy(data, ptr + n, len);
389		n += len;
390	}
391
392	*pkt = ipr->ip_pkt;
393	ipr->ip_pkt = NULL;	/* Avoid free from ip_reasm_free() */
394	*payload = ptr;
395
396	/* Clean up the reassembly list */
397	while ((ipr = STAILQ_FIRST(&ire_list)) != NULL) {
398		STAILQ_REMOVE_HEAD(&ire_list, ip_next);
399		ip_reasm_free(ipr);
400	}
401	return (n);
402}
403
404/*
405 * Receive a IP packet.
406 */
407ssize_t
408readip(struct iodesc *d, void **pkt, void **payload, time_t tleft,
409    uint8_t proto)
410{
411	time_t t;
412	ssize_t ret = -1;
413
414	t = getsecs();
415	while ((getsecs() - t) < tleft) {
416		errno = 0;
417		ret = readipv4(d, pkt, payload, tleft, proto);
418		if (ret >= 0)
419			return (ret);
420		/* Bubble up the error if it wasn't successful */
421		if (errno != EAGAIN)
422			return (-1);
423	}
424	/* We've exhausted tleft; timeout */
425	errno = ETIMEDOUT;
426	return (-1);
427}
428