1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2019 Isilon Systems, LLC.
5 * Copyright (c) 2005-2014 Sandvine Incorporated. All rights reserved.
6 * Copyright (c) 2000 Darrell Anderson
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include <sys/cdefs.h>
32 #include "opt_inet.h"
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/errno.h>
37 #include <sys/socket.h>
38 #include <sys/sysctl.h>
39
40 #include <net/ethernet.h>
41 #include <net/if.h>
42 #include <net/if_arp.h>
43 #include <net/if_dl.h>
44 #include <net/if_types.h>
45 #include <net/if_var.h>
46
47 #include <netinet/in.h>
48 #include <netinet/in_systm.h>
49 #include <netinet/in_var.h>
50 #include <netinet/ip.h>
51 #include <netinet/ip_var.h>
52 #include <netinet/ip_options.h>
53 #include <netinet/udp.h>
54 #include <netinet/udp_var.h>
55
56 #include <machine/in_cksum.h>
57 #include <machine/pcb.h>
58
59 #include <net/debugnet.h>
60 #define DEBUGNET_INTERNAL
61 #include <net/debugnet_int.h>
62
63 int debugnet_arp_nretries = 3;
64 SYSCTL_INT(_net_debugnet, OID_AUTO, arp_nretries, CTLFLAG_RWTUN,
65 &debugnet_arp_nretries, 0,
66 "Number of ARP attempts before giving up");
67
68 /*
69 * Handler for IP packets: checks their sanity and then processes any debugnet
70 * ACK packets it finds.
71 *
72 * It needs to partially replicate the behaviour of ip_input() and udp_input().
73 *
74 * Parameters:
75 * pcb a pointer to the live debugnet PCB
76 * mb a pointer to an mbuf * containing the packet received
77 * Updates *mb if m_pullup et al change the pointer
78 * Assumes the calling function will take care of freeing the mbuf
79 */
80 void
debugnet_handle_ip(struct debugnet_pcb * pcb,struct mbuf ** mb)81 debugnet_handle_ip(struct debugnet_pcb *pcb, struct mbuf **mb)
82 {
83 struct ip *ip;
84 struct mbuf *m;
85 unsigned short hlen;
86
87 /* IP processing. */
88 m = *mb;
89 if (m->m_pkthdr.len < sizeof(struct ip)) {
90 DNETDEBUG("dropping packet too small for IP header\n");
91 return;
92 }
93 if (m->m_len < sizeof(struct ip)) {
94 m = m_pullup(m, sizeof(struct ip));
95 *mb = m;
96 if (m == NULL) {
97 DNETDEBUG("m_pullup failed\n");
98 return;
99 }
100 }
101 ip = mtod(m, struct ip *);
102
103 /* IP version. */
104 if (ip->ip_v != IPVERSION) {
105 DNETDEBUG("bad IP version %d\n", ip->ip_v);
106 return;
107 }
108
109 /* Header length. */
110 hlen = ip->ip_hl << 2;
111 if (hlen < sizeof(struct ip)) {
112 DNETDEBUG("bad IP header length (%hu)\n", hlen);
113 return;
114 }
115 if (hlen > m->m_len) {
116 m = m_pullup(m, hlen);
117 *mb = m;
118 if (m == NULL) {
119 DNETDEBUG("m_pullup failed\n");
120 return;
121 }
122 ip = mtod(m, struct ip *);
123 }
124 /* Ignore packets with IP options. */
125 if (hlen > sizeof(struct ip)) {
126 DNETDEBUG("drop packet with IP options\n");
127 return;
128 }
129
130 #ifdef INVARIANTS
131 if ((IN_LOOPBACK(ntohl(ip->ip_dst.s_addr)) ||
132 IN_LOOPBACK(ntohl(ip->ip_src.s_addr))) &&
133 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {
134 DNETDEBUG("Bad IP header (RFC1122)\n");
135 return;
136 }
137 #endif
138
139 /* Checksum. */
140 if ((m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) != 0) {
141 if ((m->m_pkthdr.csum_flags & CSUM_IP_VALID) == 0) {
142 DNETDEBUG("bad IP checksum\n");
143 return;
144 }
145 } else {
146 /* XXX */ ;
147 }
148
149 /* Convert fields to host byte order. */
150 ip->ip_len = ntohs(ip->ip_len);
151 if (ip->ip_len < hlen) {
152 DNETDEBUG("IP packet smaller (%hu) than header (%hu)\n",
153 ip->ip_len, hlen);
154 return;
155 }
156 if (m->m_pkthdr.len < ip->ip_len) {
157 DNETDEBUG("IP packet bigger (%hu) than ethernet packet (%d)\n",
158 ip->ip_len, m->m_pkthdr.len);
159 return;
160 }
161 if (m->m_pkthdr.len > ip->ip_len) {
162 /* Truncate the packet to the IP length. */
163 if (m->m_len == m->m_pkthdr.len) {
164 m->m_len = ip->ip_len;
165 m->m_pkthdr.len = ip->ip_len;
166 } else
167 m_adj(m, ip->ip_len - m->m_pkthdr.len);
168 }
169
170 ip->ip_off = ntohs(ip->ip_off);
171
172 /* Check that the source is the server's IP. */
173 if (ip->ip_src.s_addr != pcb->dp_server) {
174 DNETDEBUG("drop packet not from server (from 0x%x)\n",
175 ip->ip_src.s_addr);
176 return;
177 }
178
179 /* Check if the destination IP is ours. */
180 if (ip->ip_dst.s_addr != pcb->dp_client) {
181 DNETDEBUGV("drop packet not to our IP\n");
182 return;
183 }
184
185 if (ip->ip_p != IPPROTO_UDP) {
186 DNETDEBUG("drop non-UDP packet\n");
187 return;
188 }
189
190 /* Do not deal with fragments. */
191 if ((ip->ip_off & (IP_MF | IP_OFFMASK)) != 0) {
192 DNETDEBUG("drop fragmented packet\n");
193 return;
194 }
195
196 if ((m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) != 0) {
197 if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID) == 0) {
198 DNETDEBUG("bad UDP checksum\n");
199 return;
200 }
201 } else {
202 /* XXX */ ;
203 }
204
205 /* UDP custom is to have packet length not include IP header. */
206 ip->ip_len -= hlen;
207
208 /* Checked above before decoding IP header. */
209 MPASS(m->m_pkthdr.len >= sizeof(struct ipovly));
210
211 /* Put the UDP header at start of chain. */
212 m_adj(m, sizeof(struct ipovly));
213 debugnet_handle_udp(pcb, mb);
214 }
215
216 /*
217 * Builds and sends a single ARP request to locate the L2 address for a given
218 * INET address.
219 *
220 * Return value:
221 * 0 on success
222 * errno on error
223 */
224 static int
debugnet_send_arp(struct debugnet_pcb * pcb,in_addr_t dst)225 debugnet_send_arp(struct debugnet_pcb *pcb, in_addr_t dst)
226 {
227 struct ether_addr bcast;
228 struct arphdr *ah;
229 struct ifnet *ifp;
230 struct mbuf *m;
231 int pktlen;
232
233 ifp = pcb->dp_ifp;
234
235 /* Fill-up a broadcast address. */
236 memset(&bcast, 0xFF, ETHER_ADDR_LEN);
237 m = m_gethdr(M_NOWAIT, MT_DATA);
238 if (m == NULL) {
239 printf("%s: Out of mbufs\n", __func__);
240 return (ENOBUFS);
241 }
242 pktlen = arphdr_len2(ETHER_ADDR_LEN, sizeof(struct in_addr));
243 m->m_len = pktlen;
244 m->m_pkthdr.len = pktlen;
245 MH_ALIGN(m, pktlen);
246 ah = mtod(m, struct arphdr *);
247 ah->ar_hrd = htons(ARPHRD_ETHER);
248 ah->ar_pro = htons(ETHERTYPE_IP);
249 ah->ar_hln = ETHER_ADDR_LEN;
250 ah->ar_pln = sizeof(struct in_addr);
251 ah->ar_op = htons(ARPOP_REQUEST);
252 memcpy(ar_sha(ah), IF_LLADDR(ifp), ETHER_ADDR_LEN);
253 ((struct in_addr *)ar_spa(ah))->s_addr = pcb->dp_client;
254 bzero(ar_tha(ah), ETHER_ADDR_LEN);
255 ((struct in_addr *)ar_tpa(ah))->s_addr = dst;
256 return (debugnet_ether_output(m, ifp, bcast, ETHERTYPE_ARP));
257 }
258
259 /*
260 * Handler for ARP packets: checks their sanity and then
261 * 1. If the ARP is a request for our IP, respond with our MAC address
262 * 2. If the ARP is a response from our server, record its MAC address
263 *
264 * It needs to replicate partially the behaviour of arpintr() and
265 * in_arpinput().
266 *
267 * Parameters:
268 * pcb a pointer to the live debugnet PCB
269 * mb a pointer to an mbuf * containing the packet received
270 * Updates *mb if m_pullup et al change the pointer
271 * Assumes the calling function will take care of freeing the mbuf
272 */
273 void
debugnet_handle_arp(struct debugnet_pcb * pcb,struct mbuf ** mb)274 debugnet_handle_arp(struct debugnet_pcb *pcb, struct mbuf **mb)
275 {
276 char buf[INET_ADDRSTRLEN];
277 struct in_addr isaddr, itaddr;
278 struct ether_addr dst;
279 struct mbuf *m;
280 struct arphdr *ah;
281 struct ifnet *ifp;
282 uint8_t *enaddr;
283 int req_len, op;
284
285 m = *mb;
286 ifp = m->m_pkthdr.rcvif;
287 if (m->m_len < sizeof(struct arphdr)) {
288 m = m_pullup(m, sizeof(struct arphdr));
289 *mb = m;
290 if (m == NULL) {
291 DNETDEBUG("runt packet: m_pullup failed\n");
292 return;
293 }
294 }
295
296 ah = mtod(m, struct arphdr *);
297 if (ntohs(ah->ar_hrd) != ARPHRD_ETHER) {
298 DNETDEBUG("unknown hardware address 0x%2D)\n",
299 (unsigned char *)&ah->ar_hrd, "");
300 return;
301 }
302 if (ntohs(ah->ar_pro) != ETHERTYPE_IP) {
303 DNETDEBUG("drop ARP for unknown protocol %d\n",
304 ntohs(ah->ar_pro));
305 return;
306 }
307 req_len = arphdr_len2(ifp->if_addrlen, sizeof(struct in_addr));
308 if (m->m_len < req_len) {
309 m = m_pullup(m, req_len);
310 *mb = m;
311 if (m == NULL) {
312 DNETDEBUG("runt packet: m_pullup failed\n");
313 return;
314 }
315 }
316 ah = mtod(m, struct arphdr *);
317
318 op = ntohs(ah->ar_op);
319 memcpy(&isaddr, ar_spa(ah), sizeof(isaddr));
320 memcpy(&itaddr, ar_tpa(ah), sizeof(itaddr));
321 enaddr = (uint8_t *)IF_LLADDR(ifp);
322
323 if (memcmp(ar_sha(ah), enaddr, ifp->if_addrlen) == 0) {
324 DNETDEBUG("ignoring ARP from myself\n");
325 return;
326 }
327
328 if (isaddr.s_addr == pcb->dp_client) {
329 printf("%s: %*D is using my IP address %s!\n", __func__,
330 ifp->if_addrlen, (u_char *)ar_sha(ah), ":",
331 inet_ntoa_r(isaddr, buf));
332 return;
333 }
334
335 if (memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen) == 0) {
336 DNETDEBUG("ignoring ARP from broadcast address\n");
337 return;
338 }
339
340 if (op == ARPOP_REPLY) {
341 if (isaddr.s_addr != pcb->dp_gateway &&
342 isaddr.s_addr != pcb->dp_server) {
343 inet_ntoa_r(isaddr, buf);
344 DNETDEBUG("ignoring ARP reply from %s (not configured"
345 " server or gateway)\n", buf);
346 return;
347 }
348 memcpy(pcb->dp_gw_mac.octet, ar_sha(ah),
349 min(ah->ar_hln, ETHER_ADDR_LEN));
350
351 DNETDEBUG("got server MAC address %6D\n",
352 pcb->dp_gw_mac.octet, ":");
353
354 MPASS(pcb->dp_state == DN_STATE_INIT);
355 pcb->dp_state = DN_STATE_HAVE_GW_MAC;
356 return;
357 }
358
359 if (op != ARPOP_REQUEST) {
360 DNETDEBUG("ignoring ARP non-request/reply\n");
361 return;
362 }
363
364 if (itaddr.s_addr != pcb->dp_client) {
365 DNETDEBUG("ignoring ARP not to our IP\n");
366 return;
367 }
368
369 memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln);
370 memcpy(ar_sha(ah), enaddr, ah->ar_hln);
371 memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
372 memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
373 ah->ar_op = htons(ARPOP_REPLY);
374 ah->ar_pro = htons(ETHERTYPE_IP);
375 m->m_flags &= ~(M_BCAST|M_MCAST);
376 m->m_len = arphdr_len(ah);
377 m->m_pkthdr.len = m->m_len;
378
379 memcpy(dst.octet, ar_tha(ah), ETHER_ADDR_LEN);
380 debugnet_ether_output(m, ifp, dst, ETHERTYPE_ARP);
381 *mb = NULL;
382 }
383
384 /*
385 * Sends ARP requests to locate the server and waits for a response.
386 * We first try to ARP the server itself, and fall back to the provided
387 * gateway if the server appears to be off-link.
388 *
389 * Return value:
390 * 0 on success
391 * errno on error
392 */
393 int
debugnet_arp_gw(struct debugnet_pcb * pcb)394 debugnet_arp_gw(struct debugnet_pcb *pcb)
395 {
396 in_addr_t dst;
397 int error, polls, retries;
398
399 dst = pcb->dp_server;
400 restart:
401 for (retries = 0; retries < debugnet_arp_nretries; retries++) {
402 error = debugnet_send_arp(pcb, dst);
403 if (error != 0)
404 return (error);
405 for (polls = 0; polls < debugnet_npolls &&
406 pcb->dp_state < DN_STATE_HAVE_GW_MAC; polls++) {
407 debugnet_network_poll(pcb);
408 DELAY(500);
409 }
410 if (pcb->dp_state >= DN_STATE_HAVE_GW_MAC)
411 break;
412 printf("(ARP retry)");
413 }
414 if (pcb->dp_state >= DN_STATE_HAVE_GW_MAC)
415 return (0);
416 if (dst == pcb->dp_server) {
417 printf("\nFailed to ARP server");
418 if (pcb->dp_gateway != INADDR_ANY) {
419 printf(", trying to reach gateway...\n");
420 dst = pcb->dp_gateway;
421 goto restart;
422 } else
423 printf(".\n");
424 } else
425 printf("\nFailed to ARP gateway.\n");
426
427 return (ETIMEDOUT);
428 }
429
430 /*
431 * Unreliable IPv4 transmission of an mbuf chain to the debugnet server
432 * Note: can't handle fragmentation; fails if the packet is larger than
433 * ifp->if_mtu after adding the UDP/IP headers
434 *
435 * Parameters:
436 * pcb The debugnet context block
437 * m mbuf chain
438 *
439 * Returns:
440 * int see errno.h, 0 for success
441 */
442 int
debugnet_ip_output(struct debugnet_pcb * pcb,struct mbuf * m)443 debugnet_ip_output(struct debugnet_pcb *pcb, struct mbuf *m)
444 {
445 struct udphdr *udp;
446 struct ifnet *ifp;
447 struct ip *ip;
448
449 MPASS(pcb->dp_state >= DN_STATE_HAVE_GW_MAC);
450
451 ifp = pcb->dp_ifp;
452
453 M_PREPEND(m, sizeof(*ip), M_NOWAIT);
454 if (m == NULL) {
455 printf("%s: out of mbufs\n", __func__);
456 return (ENOBUFS);
457 }
458
459 if (m->m_pkthdr.len > ifp->if_mtu) {
460 printf("%s: Packet is too big: %d > MTU %u\n", __func__,
461 m->m_pkthdr.len, ifp->if_mtu);
462 m_freem(m);
463 return (ENOBUFS);
464 }
465
466 ip = mtod(m, void *);
467 udp = (void *)(ip + 1);
468
469 memset(ip, 0, offsetof(struct ip, ip_p));
470 ip->ip_p = IPPROTO_UDP;
471 ip->ip_sum = udp->uh_ulen;
472 ip->ip_src = (struct in_addr) { pcb->dp_client };
473 ip->ip_dst = (struct in_addr) { pcb->dp_server };
474
475 /* Compute UDP-IPv4 checksum. */
476 udp->uh_sum = in_cksum(m, m->m_pkthdr.len);
477 if (udp->uh_sum == 0)
478 udp->uh_sum = 0xffff;
479
480 ip->ip_v = IPVERSION;
481 ip->ip_hl = sizeof(*ip) >> 2;
482 ip->ip_tos = 0;
483 ip->ip_len = htons(m->m_pkthdr.len);
484 ip->ip_id = 0;
485 ip->ip_off = htons(IP_DF);
486 ip->ip_ttl = 255;
487 ip->ip_sum = 0;
488 ip->ip_sum = in_cksum(m, sizeof(struct ip));
489
490 return (debugnet_ether_output(m, ifp, pcb->dp_gw_mac, ETHERTYPE_IP));
491 }
492