1/*-
2 * Copyright (c) 2018 The FreeBSD Foundation
3 *
4 * This software was developed by Mark Johnston under sponsorship from
5 * the FreeBSD Foundation.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions are
9 * met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in
14 *    the documentation and/or other materials provided with the
15 *    distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30#include <sys/param.h>
31#include <sys/ioctl.h>
32#include <sys/socket.h>
33#include <sys/sysctl.h>
34
35#include <net/bpf.h>
36#include <net/if.h>
37#include <netinet/in.h>
38#include <netinet/ip.h>
39#include <netinet/ip_var.h>
40
41#include <err.h>
42#include <errno.h>
43#include <fcntl.h>
44#include <ifaddrs.h>
45#include <stdint.h>
46#include <stdlib.h>
47#include <time.h>
48#include <unistd.h>
49
50#include <atf-c.h>
51
52struct lopacket {
53	u_int		family;
54	struct ip	hdr;
55	char		payload[];
56};
57
58static void
59update_cksum(struct ip *ip)
60{
61	size_t i;
62	uint32_t cksum;
63	uint16_t *cksump;
64
65	ip->ip_sum = 0;
66	cksump = (uint16_t *)ip;
67	for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++)
68		cksum += ntohs(*cksump);
69	cksum = (cksum >> 16) + (cksum & 0xffff);
70	cksum = ~(cksum + (cksum >> 16));
71	ip->ip_sum = htons((uint16_t)cksum);
72}
73
74static struct lopacket *
75alloc_lopacket(in_addr_t dstaddr, size_t payloadlen)
76{
77	struct ip *ip;
78	struct lopacket *packet;
79	size_t pktlen;
80
81	pktlen = sizeof(*packet) + payloadlen;
82	packet = malloc(pktlen);
83	ATF_REQUIRE(packet != NULL);
84
85	memset(packet, 0, pktlen);
86	packet->family = AF_INET;
87
88	ip = &packet->hdr;
89	ip->ip_hl = sizeof(struct ip) >> 2;
90	ip->ip_v = 4;
91	ip->ip_tos = 0;
92	ip->ip_len = htons(sizeof(*ip) + payloadlen);
93	ip->ip_id = 0;
94	ip->ip_off = 0;
95	ip->ip_ttl = 1;
96	ip->ip_p = IPPROTO_IP;
97	ip->ip_sum = 0;
98	ip->ip_src.s_addr = dstaddr;
99	ip->ip_dst.s_addr = dstaddr;
100	update_cksum(ip);
101
102	return (packet);
103}
104
105static void
106free_lopacket(struct lopacket *packet)
107{
108
109	free(packet);
110}
111
112static void
113write_lopacket(int bpffd, struct lopacket *packet)
114{
115	struct timespec ts;
116	ssize_t n;
117	size_t len;
118
119	len = sizeof(packet->family) + ntohs(packet->hdr.ip_len);
120	n = write(bpffd, packet, len);
121	ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno));
122	ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu",
123	    n, len);
124
125	/*
126	 * Loopback packets are dispatched asynchronously, give netisr some
127	 * time.
128	 */
129	ts.tv_sec = 0;
130	ts.tv_nsec = 5000000; /* 5ms */
131	(void)nanosleep(&ts, NULL);
132}
133
134static int
135open_lobpf(in_addr_t *addrp)
136{
137	struct ifreq ifr;
138	struct ifaddrs *ifa, *ifap;
139	int error, fd;
140
141	fd = open("/dev/bpf0", O_RDWR);
142	if (fd < 0 && errno == ENOENT)
143		atf_tc_skip("no BPF device available");
144	ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno));
145
146	error = getifaddrs(&ifap);
147	ATF_REQUIRE(error == 0);
148	for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
149		if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 &&
150		    ifa->ifa_addr->sa_family == AF_INET)
151			break;
152	if (ifa == NULL)
153		atf_tc_skip("no loopback address found");
154
155	memset(&ifr, 0, sizeof(ifr));
156	strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ);
157	error = ioctl(fd, BIOCSETIF, &ifr);
158	ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno));
159
160	*addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr;
161
162	freeifaddrs(ifap);
163
164	return (fd);
165}
166
167static void
168get_ipstat(struct ipstat *stat)
169{
170	size_t len;
171	int error;
172
173	memset(stat, 0, sizeof(*stat));
174	len = sizeof(*stat);
175	error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0);
176	ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s",
177	    strerror(errno));
178	ATF_REQUIRE(len == sizeof(*stat));
179}
180
181#define	CHECK_IP_COUNTER(oldp, newp, counter)				\
182	ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \
183	    "ips_" #counter " wasn't incremented (%ju vs. %ju)",	\
184	    (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter);
185
186/*
187 * Make sure a fragment with MF set doesn't come after the last fragment of a
188 * packet.  Make sure that multiple fragments with MF clear have the same offset
189 * and length.
190 */
191ATF_TC(ip_reass__multiple_last_fragments);
192ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc)
193{
194	atf_tc_set_md_var(tc, "require.user", "root");
195}
196ATF_TC_BODY(ip_reass__multiple_last_fragments, tc)
197{
198	struct ipstat old, new;
199	struct ip *ip;
200	struct lopacket *packet1, *packet2, *packet3, *packet4;
201	in_addr_t addr;
202	int error, fd;
203	uint16_t ipid;
204
205	fd = open_lobpf(&addr);
206	ipid = arc4random_uniform(UINT16_MAX + 1);
207
208	packet1 = alloc_lopacket(addr, 16);
209	ip = &packet1->hdr;
210	ip->ip_id = ipid;
211	ip->ip_off = htons(0x10);
212	update_cksum(ip);
213
214	packet2 = alloc_lopacket(addr, 16);
215	ip = &packet2->hdr;
216	ip->ip_id = ipid;
217	ip->ip_off = htons(0x20);
218	update_cksum(ip);
219
220	packet3 = alloc_lopacket(addr, 16);
221	ip = &packet3->hdr;
222	ip->ip_id = ipid;
223	ip->ip_off = htons(0x8);
224	update_cksum(ip);
225
226	packet4 = alloc_lopacket(addr, 32);
227	ip = &packet4->hdr;
228	ip->ip_id = ipid;
229	ip->ip_off = htons(0x10);
230	update_cksum(ip);
231
232	write_lopacket(fd, packet1);
233
234	/* packet2 comes after packet1. */
235	get_ipstat(&old);
236	write_lopacket(fd, packet2);
237	get_ipstat(&new);
238	CHECK_IP_COUNTER(&old, &new, fragdropped);
239
240	/* packet2 comes after packet1 and has MF set. */
241	packet2->hdr.ip_off = htons(IP_MF | 0x20);
242	update_cksum(&packet2->hdr);
243	get_ipstat(&old);
244	write_lopacket(fd, packet2);
245	get_ipstat(&new);
246	CHECK_IP_COUNTER(&old, &new, fragdropped);
247
248	/* packet3 comes before packet1 but overlaps. */
249	get_ipstat(&old);
250	write_lopacket(fd, packet3);
251	get_ipstat(&new);
252	CHECK_IP_COUNTER(&old, &new, fragdropped);
253
254	/* packet4 has the same offset as packet1 but is longer. */
255	get_ipstat(&old);
256	write_lopacket(fd, packet4);
257	get_ipstat(&new);
258	CHECK_IP_COUNTER(&old, &new, fragdropped);
259
260	error = close(fd);
261	ATF_REQUIRE(error == 0);
262	free_lopacket(packet1);
263	free_lopacket(packet2);
264	free_lopacket(packet3);
265	free_lopacket(packet4);
266}
267
268/*
269 * Make sure that we reject zero-length fragments.
270 */
271ATF_TC(ip_reass__zero_length_fragment);
272ATF_TC_HEAD(ip_reass__zero_length_fragment, tc)
273{
274	atf_tc_set_md_var(tc, "require.user", "root");
275}
276ATF_TC_BODY(ip_reass__zero_length_fragment, tc)
277{
278	struct ipstat old, new;
279	struct ip *ip;
280	struct lopacket *packet1, *packet2;
281	in_addr_t addr;
282	int error, fd;
283	uint16_t ipid;
284
285	fd = open_lobpf(&addr);
286	ipid = arc4random_uniform(UINT16_MAX + 1);
287
288	/*
289	 * Create two packets, one with MF set, one without.
290	 */
291	packet1 = alloc_lopacket(addr, 0);
292	ip = &packet1->hdr;
293	ip->ip_id = ipid;
294	ip->ip_off = htons(IP_MF | 0x10);
295	update_cksum(ip);
296
297	packet2 = alloc_lopacket(addr, 0);
298	ip = &packet2->hdr;
299	ip->ip_id = ~ipid;
300	ip->ip_off = htons(0x10);
301	update_cksum(ip);
302
303	get_ipstat(&old);
304	write_lopacket(fd, packet1);
305	get_ipstat(&new);
306	CHECK_IP_COUNTER(&old, &new, toosmall);
307	CHECK_IP_COUNTER(&old, &new, fragdropped);
308
309	get_ipstat(&old);
310	write_lopacket(fd, packet2);
311	get_ipstat(&new);
312	CHECK_IP_COUNTER(&old, &new, toosmall);
313	CHECK_IP_COUNTER(&old, &new, fragdropped);
314
315	error = close(fd);
316	ATF_REQUIRE(error == 0);
317	free_lopacket(packet1);
318	free_lopacket(packet2);
319}
320
321ATF_TC(ip_reass__large_fragment);
322ATF_TC_HEAD(ip_reass__large_fragment, tc)
323{
324	atf_tc_set_md_var(tc, "require.user", "root");
325}
326ATF_TC_BODY(ip_reass__large_fragment, tc)
327{
328	struct ipstat old, new;
329	struct ip *ip;
330	struct lopacket *packet1, *packet2;
331	in_addr_t addr;
332	int error, fd;
333	uint16_t ipid;
334
335	fd = open_lobpf(&addr);
336	ipid = arc4random_uniform(UINT16_MAX + 1);
337
338	/*
339	 * Create two packets, one with MF set, one without.
340	 *
341	 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check.
342	 */
343	packet1 = alloc_lopacket(addr, 16);
344	ip = &packet1->hdr;
345	ip->ip_id = ipid;
346	ip->ip_off = htons(IP_MF | 0x1fff);
347	update_cksum(ip);
348
349	packet2 = alloc_lopacket(addr, 16);
350	ip = &packet2->hdr;
351	ip->ip_id = ipid;
352	ip->ip_off = htons(0x1fff);
353	update_cksum(ip);
354
355	get_ipstat(&old);
356	write_lopacket(fd, packet1);
357	get_ipstat(&new);
358	CHECK_IP_COUNTER(&old, &new, toolong);
359	CHECK_IP_COUNTER(&old, &new, fragdropped);
360
361	get_ipstat(&old);
362	write_lopacket(fd, packet2);
363	get_ipstat(&new);
364	CHECK_IP_COUNTER(&old, &new, toolong);
365	CHECK_IP_COUNTER(&old, &new, fragdropped);
366
367	error = close(fd);
368	ATF_REQUIRE(error == 0);
369	free_lopacket(packet1);
370	free_lopacket(packet2);
371}
372
373ATF_TP_ADD_TCS(tp)
374{
375	ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments);
376	ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment);
377	ATF_TP_ADD_TC(tp, ip_reass__large_fragment);
378
379	return (atf_no_error());
380}
381