1 /*	$OpenBSD: ip_icmp.c,v 1.67 2005/06/30 08:51:31 markus Exp $	*/
2 /*	$NetBSD: ip_icmp.c,v 1.19 1996/02/13 23:42:22 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  *	This product includes software developed by the University of
46  *	California, Berkeley and its contributors.
47  *	This product includes software developed at the Information
48  *	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/mbuf.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/sysctl.h>
77 
78 #include <net/if.h>
79 #include <net/route.h>
80 
81 #include <netinet/in.h>
82 #include <netinet/in_systm.h>
83 #include <netinet/in_var.h>
84 #include <netinet/ip.h>
85 #include <netinet/ip_icmp.h>
86 #include <netinet/ip_var.h>
87 #include <netinet/icmp_var.h>
88 
89 /*
90  * ICMP routines: error generation, receive packet processing, and
91  * routines to turnaround packets back to the originator, and
92  * host table maintenance routines.
93  */
94 
95 int	icmpmaskrepl = 0;
96 int	icmpbmcastecho = 0;
97 int	icmptstamprepl = 1;
98 #ifdef ICMPPRINTFS
99 int	icmpprintfs = 0;
100 #endif
101 int	icmperrppslim = 100;
102 int	icmperrpps_count = 0;
103 struct timeval icmperrppslim_last;
104 int	icmp_rediraccept = 1;
105 int	icmp_redirtimeout = 10 * 60;
106 static struct rttimer_queue *icmp_redirect_timeout_q = NULL;
107 struct	icmpstat icmpstat;
108 
109 int *icmpctl_vars[ICMPCTL_MAXID] = ICMPCTL_VARS;
110 
111 void icmp_mtudisc_timeout(struct rtentry *, struct rttimer *);
112 int icmp_ratelimit(const struct in_addr *, const int, const int);
113 static void icmp_redirect_timeout(struct rtentry *, struct rttimer *);
114 
115 extern	struct protosw inetsw[];
116 
117 void
icmp_init(void)118 icmp_init(void)
119 {
120 	/*
121 	 * This is only useful if the user initializes redirtimeout to
122 	 * something other than zero.
123 	 */
124 	if (icmp_redirtimeout != 0) {
125 		icmp_redirect_timeout_q =
126 		    rt_timer_queue_create(icmp_redirtimeout);
127 	}
128 }
129 
130 struct mbuf *
icmp_do_error(struct mbuf * n,int type,int code,n_long dest,struct ifnet * destifp)131 icmp_do_error(struct mbuf *n, int type, int code, n_long dest,
132     struct ifnet *destifp)
133 {
134 	struct ip *oip = mtod(n, struct ip *), *nip;
135 	unsigned oiplen = oip->ip_hl << 2;
136 	struct icmp *icp;
137 	struct mbuf *m;
138 	struct m_tag *mtag;
139 	unsigned icmplen, mblen;
140 
141 #ifdef ICMPPRINTFS
142 	if (icmpprintfs)
143 		printf("icmp_error(%x, %d, %d)\n", oip, type, code);
144 #endif
145 	if (type != ICMP_REDIRECT)
146 		icmpstat.icps_error++;
147 	/*
148 	 * Don't send error if not the first fragment of message.
149 	 * Don't error if the old packet protocol was ICMP
150 	 * error message, only known informational types.
151 	 */
152 	if (oip->ip_off & htons(IP_OFFMASK))
153 		goto freeit;
154 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
155 	    n->m_len >= oiplen + ICMP_MINLEN &&
156 	    !ICMP_INFOTYPE(((struct icmp *)
157 	    ((caddr_t)oip + oiplen))->icmp_type)) {
158 		icmpstat.icps_oldicmp++;
159 		goto freeit;
160 	}
161 	/* Don't send error in response to a multicast or broadcast packet */
162 	if (n->m_flags & (M_BCAST|M_MCAST))
163 		goto freeit;
164 
165 	/*
166 	 * First, do a rate limitation check.
167 	 */
168 	if (icmp_ratelimit(&oip->ip_src, type, code))
169 		goto freeit;	/* XXX stat */
170 
171 	/*
172 	 * Now, formulate icmp message
173 	 */
174 	icmplen = oiplen + min(8, ntohs(oip->ip_len));
175 	/*
176 	 * Defend against mbuf chains shorter than oip->ip_len:
177 	 */
178 	mblen = 0;
179 	for (m = n; m && (mblen < icmplen); m = m->m_next)
180 		mblen += m->m_len;
181 	icmplen = min(mblen, icmplen);
182 
183 	/*
184 	 * As we are not required to return everything we have,
185 	 * we return whatever we can return at ease.
186 	 *
187 	 * Note that ICMP datagrams longer than 576 octets are out of spec
188 	 * according to RFC1812;
189 	 */
190 
191 	KASSERT(ICMP_MINLEN <= MCLBYTES);
192 
193 	if (icmplen + ICMP_MINLEN > MCLBYTES)
194 		icmplen = MCLBYTES - ICMP_MINLEN - sizeof (struct ip);
195 
196 	m = m_gethdr(M_DONTWAIT, MT_HEADER);
197 	if (m && (sizeof (struct ip) + icmplen + ICMP_MINLEN > MHLEN)) {
198 		MCLGET(m, M_DONTWAIT);
199 		if ((m->m_flags & M_EXT) == 0) {
200 			m_freem(m);
201 			m = NULL;
202 		}
203 	}
204 	if (m == NULL)
205 		goto freeit;
206 	m->m_len = icmplen + ICMP_MINLEN;
207 	if ((m->m_flags & M_EXT) == 0)
208 		MH_ALIGN(m, m->m_len);
209 	icp = mtod(m, struct icmp *);
210 	if ((u_int)type > ICMP_MAXTYPE)
211 		panic("icmp_error");
212 	icmpstat.icps_outhist[type]++;
213 	icp->icmp_type = type;
214 	if (type == ICMP_REDIRECT)
215 		icp->icmp_gwaddr.s_addr = dest;
216 	else {
217 		icp->icmp_void = 0;
218 		/*
219 		 * The following assignments assume an overlay with the
220 		 * zeroed icmp_void field.
221 		 */
222 		if (type == ICMP_PARAMPROB) {
223 			icp->icmp_pptr = code;
224 			code = 0;
225 		} else if (type == ICMP_UNREACH &&
226 		    code == ICMP_UNREACH_NEEDFRAG && destifp)
227 			icp->icmp_nextmtu = htons(destifp->if_mtu);
228 	}
229 
230 	icp->icmp_code = code;
231 	m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
232 
233 	/*
234 	 * Now, copy old ip header (without options)
235 	 * in front of icmp message.
236 	 */
237 	if ((m->m_flags & M_EXT) == 0 &&
238 	    m->m_data - sizeof(struct ip) < m->m_pktdat)
239 		panic("icmp len");
240 	m->m_data -= sizeof(struct ip);
241 	m->m_len += sizeof(struct ip);
242 	m->m_pkthdr.len = m->m_len;
243 	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
244 	nip = mtod(m, struct ip *);
245 	/* ip_v set in ip_output */
246 	nip->ip_hl = sizeof(struct ip) >> 2;
247 	nip->ip_tos = 0;
248 	nip->ip_len = htons(m->m_len);
249 	/* ip_id set in ip_output */
250 	nip->ip_off = 0;
251 	/* ip_ttl set in icmp_reflect */
252 	nip->ip_p = IPPROTO_ICMP;
253 	nip->ip_src = oip->ip_src;
254 	nip->ip_dst = oip->ip_dst;
255 	/* move PF_GENERATED m_tag to new packet, if it exists */
256 	mtag = m_tag_find(n, PACKET_TAG_PF_GENERATED, NULL);
257 	if (mtag != NULL) {
258 		m_tag_unlink(n, mtag);
259 		m_tag_prepend(m, mtag);
260 	}
261 
262 	m_freem(n);
263 	return (m);
264 
265 freeit:
266 	m_freem(n);
267 	return (NULL);
268 }
269 
270 /*
271  * Generate an error packet of type error
272  * in response to bad packet ip.
273  *
274  * The ip packet inside has ip_off and ip_len in host byte order.
275  */
276 void
icmp_error(struct mbuf * n,int type,int code,n_long dest,struct ifnet * destifp)277 icmp_error(struct mbuf *n, int type, int code, n_long dest,
278     struct ifnet *destifp)
279 {
280 	struct mbuf *m;
281 
282 	m = icmp_do_error(n, type, code, dest, destifp);
283 	if (m != NULL)
284 		icmp_reflect(m);
285 }
286 
287 struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET };
288 static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET };
289 static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET };
290 struct sockaddr_in icmpmask = { 8, 0 };
291 
292 /*
293  * Process a received ICMP message.
294  */
295 void
icmp_input(struct mbuf * m,...)296 icmp_input(struct mbuf *m, ...)
297 {
298 	struct icmp *icp;
299 	struct ip *ip = mtod(m, struct ip *);
300 	int icmplen;
301 	int i;
302 	struct in_ifaddr *ia;
303 	void *(*ctlfunc)(int, struct sockaddr *, void *);
304 	int code;
305 	extern u_char ip_protox[];
306 	int hlen;
307 	va_list ap;
308 	struct rtentry *rt;
309 
310 	va_start(ap, m);
311 	hlen = va_arg(ap, int);
312 	va_end(ap);
313 
314 	/*
315 	 * Locate icmp structure in mbuf, and check
316 	 * that not corrupted and of at least minimum length.
317 	 */
318 	icmplen = ntohs(ip->ip_len) - hlen;
319 #ifdef ICMPPRINTFS
320 	if (icmpprintfs) {
321 		char buf[4 * sizeof("123")];
322 
323 		strlcpy(buf, inet_ntoa(ip->ip_dst), sizeof buf);
324 		printf("icmp_input from %s to %s, len %d\n",
325 		    inet_ntoa(ip->ip_src), buf, icmplen);
326 	}
327 #endif
328 	if (icmplen < ICMP_MINLEN) {
329 		icmpstat.icps_tooshort++;
330 		goto freeit;
331 	}
332 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
333 	if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
334 		icmpstat.icps_tooshort++;
335 		return;
336 	}
337 	ip = mtod(m, struct ip *);
338 	m->m_len -= hlen;
339 	m->m_data += hlen;
340 	icp = mtod(m, struct icmp *);
341 	if (in_cksum(m, icmplen)) {
342 		icmpstat.icps_checksum++;
343 		goto freeit;
344 	}
345 	m->m_len += hlen;
346 	m->m_data -= hlen;
347 
348 #ifdef ICMPPRINTFS
349 	/*
350 	 * Message type specific processing.
351 	 */
352 	if (icmpprintfs)
353 		printf("icmp_input, type %d code %d\n", icp->icmp_type,
354 		    icp->icmp_code);
355 #endif
356 	if (icp->icmp_type > ICMP_MAXTYPE)
357 		goto raw;
358 	icmpstat.icps_inhist[icp->icmp_type]++;
359 	code = icp->icmp_code;
360 	switch (icp->icmp_type) {
361 
362 	case ICMP_UNREACH:
363 		switch (code) {
364 		case ICMP_UNREACH_NET:
365 		case ICMP_UNREACH_HOST:
366 		case ICMP_UNREACH_PROTOCOL:
367 		case ICMP_UNREACH_PORT:
368 		case ICMP_UNREACH_SRCFAIL:
369 			code += PRC_UNREACH_NET;
370 			break;
371 
372 		case ICMP_UNREACH_NEEDFRAG:
373 			code = PRC_MSGSIZE;
374 			break;
375 
376 		case ICMP_UNREACH_NET_UNKNOWN:
377 		case ICMP_UNREACH_NET_PROHIB:
378 		case ICMP_UNREACH_TOSNET:
379 			code = PRC_UNREACH_NET;
380 			break;
381 
382 		case ICMP_UNREACH_HOST_UNKNOWN:
383 		case ICMP_UNREACH_ISOLATED:
384 		case ICMP_UNREACH_HOST_PROHIB:
385 		case ICMP_UNREACH_TOSHOST:
386 		case ICMP_UNREACH_FILTER_PROHIB:
387 		case ICMP_UNREACH_HOST_PRECEDENCE:
388 		case ICMP_UNREACH_PRECEDENCE_CUTOFF:
389 			code = PRC_UNREACH_HOST;
390 			break;
391 
392 		default:
393 			goto badcode;
394 		}
395 		goto deliver;
396 
397 	case ICMP_TIMXCEED:
398 		if (code > 1)
399 			goto badcode;
400 		code += PRC_TIMXCEED_INTRANS;
401 		goto deliver;
402 
403 	case ICMP_PARAMPROB:
404 		if (code > 1)
405 			goto badcode;
406 		code = PRC_PARAMPROB;
407 		goto deliver;
408 
409 	case ICMP_SOURCEQUENCH:
410 		if (code)
411 			goto badcode;
412 		code = PRC_QUENCH;
413 	deliver:
414 		/* Free packet atttributes */
415 		if (m->m_flags & M_PKTHDR)
416 			m_tag_delete_chain(m, NULL);
417 
418 		/*
419 		 * Problem with datagram; advise higher level routines.
420 		 */
421 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
422 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
423 			icmpstat.icps_badlen++;
424 			goto freeit;
425 		}
426 		if (IN_MULTICAST(icp->icmp_ip.ip_dst.s_addr))
427 			goto badcode;
428 #ifdef INET6
429 		/* Get more contiguous data for a v6 in v4 ICMP message. */
430 		if (icp->icmp_ip.ip_p == IPPROTO_IPV6) {
431 			if (icmplen < ICMP_V6ADVLENMIN ||
432 			    icmplen < ICMP_V6ADVLEN(icp)) {
433 				icmpstat.icps_badlen++;
434 				goto freeit;
435 			} else {
436 				if ((m = m_pullup(m, (ip->ip_hl << 2) +
437 				    ICMP_V6ADVLEN(icp))) == NULL) {
438 					icmpstat.icps_tooshort++;
439 					return;
440 				}
441 				ip = mtod(m, struct ip *);
442 				icp = (struct icmp *)
443 				    (m->m_data + (ip->ip_hl << 2));
444 			}
445 		}
446 #endif /* INET6 */
447 #ifdef ICMPPRINTFS
448 		if (icmpprintfs)
449 			printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
450 #endif
451 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
452 		/*
453 		 * XXX if the packet contains [IPv4 AH TCP], we can't make a
454 		 * notification to TCP layer.
455 		 */
456 		ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
457 		if (ctlfunc)
458 			(*ctlfunc)(code, sintosa(&icmpsrc), &icp->icmp_ip);
459 		break;
460 
461 	badcode:
462 		icmpstat.icps_badcode++;
463 		break;
464 
465 	case ICMP_ECHO:
466 		if (!icmpbmcastecho &&
467 		    (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
468 			icmpstat.icps_bmcastecho++;
469 			break;
470 		}
471 		icp->icmp_type = ICMP_ECHOREPLY;
472 		goto reflect;
473 
474 	case ICMP_TSTAMP:
475 		if (icmptstamprepl == 0)
476 			break;
477 
478 		if (!icmpbmcastecho &&
479 		    (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
480 			icmpstat.icps_bmcastecho++;
481 			break;
482 		}
483 		if (icmplen < ICMP_TSLEN) {
484 			icmpstat.icps_badlen++;
485 			break;
486 		}
487 		icp->icmp_type = ICMP_TSTAMPREPLY;
488 		icp->icmp_rtime = iptime();
489 		icp->icmp_ttime = icp->icmp_rtime;	/* bogus, do later! */
490 		goto reflect;
491 
492 	case ICMP_MASKREQ:
493 		if (icmpmaskrepl == 0)
494 			break;
495 		/*
496 		 * We are not able to respond with all ones broadcast
497 		 * unless we receive it over a point-to-point interface.
498 		 */
499 		if (icmplen < ICMP_MASKLEN) {
500 			icmpstat.icps_badlen++;
501 			break;
502 		}
503 		if (ip->ip_dst.s_addr == INADDR_BROADCAST ||
504 		    ip->ip_dst.s_addr == INADDR_ANY)
505 			icmpdst.sin_addr = ip->ip_src;
506 		else
507 			icmpdst.sin_addr = ip->ip_dst;
508 		if (m->m_pkthdr.rcvif == NULL)
509 			break;
510 		ia = ifatoia(ifaof_ifpforaddr(sintosa(&icmpdst),
511 		    m->m_pkthdr.rcvif));
512 		if (ia == 0)
513 			break;
514 		icp->icmp_type = ICMP_MASKREPLY;
515 		icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
516 		if (ip->ip_src.s_addr == 0) {
517 			if (ia->ia_ifp->if_flags & IFF_BROADCAST)
518 				ip->ip_src = ia->ia_broadaddr.sin_addr;
519 			else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
520 				ip->ip_src = ia->ia_dstaddr.sin_addr;
521 		}
522 reflect:
523 		/* Free packet atttributes */
524 		if (m->m_flags & M_PKTHDR)
525 			m_tag_delete_chain(m, NULL);
526 
527 		icmpstat.icps_reflect++;
528 		icmpstat.icps_outhist[icp->icmp_type]++;
529 		icmp_reflect(m);
530 		return;
531 
532 	case ICMP_REDIRECT:
533 		/* Free packet atttributes */
534 		if (m->m_flags & M_PKTHDR)
535 			m_tag_delete_chain(m, NULL);
536 		if (icmp_rediraccept == 0)
537 			goto freeit;
538 		if (code > 3)
539 			goto badcode;
540 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
541 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
542 			icmpstat.icps_badlen++;
543 			break;
544 		}
545 		/*
546 		 * Short circuit routing redirects to force
547 		 * immediate change in the kernel's routing
548 		 * tables.  The message is also handed to anyone
549 		 * listening on a raw socket (e.g. the routing
550 		 * daemon for use in updating its tables).
551 		 */
552 		icmpgw.sin_addr = ip->ip_src;
553 		icmpdst.sin_addr = icp->icmp_gwaddr;
554 #ifdef	ICMPPRINTFS
555 		if (icmpprintfs) {
556 			char buf[4 * sizeof("123")];
557 			strlcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst),
558 			    sizeof buf);
559 
560 			printf("redirect dst %s to %s\n",
561 			    buf, inet_ntoa(icp->icmp_gwaddr));
562 		}
563 #endif
564 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
565 		rt = NULL;
566 		rtredirect(sintosa(&icmpsrc), sintosa(&icmpdst),
567 		    (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
568 		    sintosa(&icmpgw), (struct rtentry **)&rt);
569 		if (rt != NULL && icmp_redirtimeout != 0) {
570 			(void)rt_timer_add(rt, icmp_redirect_timeout,
571 			    icmp_redirect_timeout_q);
572 		}
573 		if (rt != NULL)
574 			rtfree(rt);
575 		pfctlinput(PRC_REDIRECT_HOST, sintosa(&icmpsrc));
576 		break;
577 
578 	/*
579 	 * No kernel processing for the following;
580 	 * just fall through to send to raw listener.
581 	 */
582 	case ICMP_ECHOREPLY:
583 	case ICMP_ROUTERADVERT:
584 	case ICMP_ROUTERSOLICIT:
585 	case ICMP_TSTAMPREPLY:
586 	case ICMP_IREQREPLY:
587 	case ICMP_MASKREPLY:
588 	case ICMP_TRACEROUTE:
589 	case ICMP_DATACONVERR:
590 	case ICMP_MOBILE_REDIRECT:
591 	case ICMP_IPV6_WHEREAREYOU:
592 	case ICMP_IPV6_IAMHERE:
593 	case ICMP_MOBILE_REGREQUEST:
594 	case ICMP_MOBILE_REGREPLY:
595 	case ICMP_PHOTURIS:
596 	default:
597 		break;
598 	}
599 
600 raw:
601 	rip_input(m);
602 	return;
603 
604 freeit:
605 	m_freem(m);
606 }
607 
608 /*
609  * Reflect the ip packet back to the source
610  */
611 void
icmp_reflect(struct mbuf * m)612 icmp_reflect(struct mbuf *m)
613 {
614 	struct ip *ip = mtod(m, struct ip *);
615 	struct in_ifaddr *ia;
616 	struct in_addr t;
617 	struct mbuf *opts = 0;
618 	int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
619 
620 	if (!in_canforward(ip->ip_src) &&
621 	    ((ip->ip_src.s_addr & IN_CLASSA_NET) !=
622 	    htonl(IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
623 		m_freem(m);	/* Bad return address */
624 		goto done;	/* ip_output() will check for broadcast */
625 	}
626 	t = ip->ip_dst;
627 	ip->ip_dst = ip->ip_src;
628 	/*
629 	 * If the incoming packet was addressed directly to us,
630 	 * use dst as the src for the reply.  Otherwise (broadcast
631 	 * or anonymous), use the address which corresponds
632 	 * to the incoming interface.
633 	 */
634 	for (ia = in_ifaddr.tqh_first; ia; ia = ia->ia_list.tqe_next) {
635 		if (t.s_addr == ia->ia_addr.sin_addr.s_addr)
636 			break;
637 		if ((ia->ia_ifp->if_flags & IFF_BROADCAST) &&
638 		    t.s_addr == ia->ia_broadaddr.sin_addr.s_addr)
639 			break;
640 	}
641 	icmpdst.sin_addr = t;
642 	if ((ia == (struct in_ifaddr *)0) && (m->m_pkthdr.rcvif != NULL))
643 		ia = ifatoia(ifaof_ifpforaddr(sintosa(&icmpdst),
644 		    m->m_pkthdr.rcvif));
645 	/*
646 	 * The following happens if the packet was not addressed to us,
647 	 * and was received on an interface with no IP address.
648 	 */
649 	if (ia == (struct in_ifaddr *)0) {
650 		struct sockaddr_in *dst;
651 		struct route ro;
652 
653 		bzero((caddr_t) &ro, sizeof(ro));
654 		dst = satosin(&ro.ro_dst);
655 		dst->sin_family = AF_INET;
656 		dst->sin_len = sizeof(*dst);
657 		dst->sin_addr = t;
658 
659 		rtalloc(&ro);
660 		if (ro.ro_rt == 0) {
661 			ipstat.ips_noroute++;
662 			m_freem(m);
663 			goto done;
664 		}
665 
666 		ia = ifatoia(ro.ro_rt->rt_ifa);
667 		ro.ro_rt->rt_use++;
668 		RTFREE(ro.ro_rt);
669 	}
670 
671 	t = ia->ia_addr.sin_addr;
672 	ip->ip_src = t;
673 	ip->ip_ttl = MAXTTL;
674 
675 	if (optlen > 0) {
676 		u_char *cp;
677 		int opt, cnt;
678 		u_int len;
679 
680 		/*
681 		 * Retrieve any source routing from the incoming packet;
682 		 * add on any record-route or timestamp options.
683 		 */
684 		cp = (u_char *) (ip + 1);
685 		if ((opts = ip_srcroute()) == 0 &&
686 		    (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
687 			opts->m_len = sizeof(struct in_addr);
688 			mtod(opts, struct in_addr *)->s_addr = 0;
689 		}
690 		if (opts) {
691 #ifdef ICMPPRINTFS
692 			if (icmpprintfs)
693 				printf("icmp_reflect optlen %d rt %d => ",
694 				    optlen, opts->m_len);
695 #endif
696 			for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
697 				opt = cp[IPOPT_OPTVAL];
698 				if (opt == IPOPT_EOL)
699 					break;
700 				if (opt == IPOPT_NOP)
701 					len = 1;
702 				else {
703 					if (cnt < IPOPT_OLEN + sizeof(*cp))
704 						break;
705 					len = cp[IPOPT_OLEN];
706 					if (len < IPOPT_OLEN + sizeof(*cp) ||
707 					    len > cnt)
708 						break;
709 				}
710 				/*
711 				 * Should check for overflow, but it
712 				 * "can't happen"
713 				 */
714 				if (opt == IPOPT_RR || opt == IPOPT_TS ||
715 				    opt == IPOPT_SECURITY) {
716 					bcopy((caddr_t)cp,
717 					    mtod(opts, caddr_t) + opts->m_len,
718 					    len);
719 					opts->m_len += len;
720 				}
721 			}
722 			/* Terminate & pad, if necessary */
723 			if ((cnt = opts->m_len % 4) != 0)
724 				for (; cnt < 4; cnt++) {
725 					*(mtod(opts, caddr_t) + opts->m_len) =
726 					    IPOPT_EOL;
727 					opts->m_len++;
728 				}
729 #ifdef ICMPPRINTFS
730 			if (icmpprintfs)
731 				printf("%d\n", opts->m_len);
732 #endif
733 		}
734 		/*
735 		 * Now strip out original options by copying rest of first
736 		 * mbuf's data back, and adjust the IP length.
737 		 */
738 		ip->ip_len = htons(ntohs(ip->ip_len) - optlen);
739 		ip->ip_hl = sizeof(struct ip) >> 2;
740 		m->m_len -= optlen;
741 		if (m->m_flags & M_PKTHDR)
742 			m->m_pkthdr.len -= optlen;
743 		optlen += sizeof(struct ip);
744 		bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
745 		    (unsigned)(m->m_len - sizeof(struct ip)));
746 	}
747 	m->m_flags &= ~(M_BCAST|M_MCAST);
748 	icmp_send(m, opts);
749 done:
750 	if (opts)
751 		(void)m_free(opts);
752 }
753 
754 /*
755  * Send an icmp packet back to the ip level,
756  * after supplying a checksum.
757  */
758 void
icmp_send(struct mbuf * m,struct mbuf * opts)759 icmp_send(struct mbuf *m, struct mbuf *opts)
760 {
761 	struct ip *ip = mtod(m, struct ip *);
762 	int hlen;
763 	struct icmp *icp;
764 
765 	hlen = ip->ip_hl << 2;
766 	m->m_data += hlen;
767 	m->m_len -= hlen;
768 	icp = mtod(m, struct icmp *);
769 	icp->icmp_cksum = 0;
770 	icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
771 	m->m_data -= hlen;
772 	m->m_len += hlen;
773 #ifdef ICMPPRINTFS
774 	if (icmpprintfs) {
775 		char buf[4 * sizeof("123")];
776 
777 		strlcpy(buf, inet_ntoa(ip->ip_dst), sizeof buf);
778 		printf("icmp_send dst %s src %s\n",
779 		    buf, inet_ntoa(ip->ip_src));
780 	}
781 #endif
782 	(void)ip_output(m, opts, (void *)NULL, 0, (void *)NULL, (void *)NULL);
783 }
784 
785 n_time
iptime(void)786 iptime(void)
787 {
788 	struct timeval atv;
789 	u_long t;
790 
791 	microtime(&atv);
792 	t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
793 	return (htonl(t));
794 }
795 
796 int
icmp_sysctl(int * name,u_int namelen,void * oldp,size_t * oldlenp,void * newp,size_t newlen)797 icmp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
798     size_t newlen)
799 {
800 
801 	/* All sysctl names at this level are terminal. */
802 	if (namelen != 1)
803 		return (ENOTDIR);
804 
805 	switch (name[0]) {
806 	case ICMPCTL_REDIRTIMEOUT: {
807 		int error;
808 
809 		error = sysctl_int(oldp, oldlenp, newp, newlen,
810 		    &icmp_redirtimeout);
811 		if (icmp_redirect_timeout_q != NULL) {
812 			if (icmp_redirtimeout == 0) {
813 				rt_timer_queue_destroy(icmp_redirect_timeout_q,
814 				    TRUE);
815 				icmp_redirect_timeout_q = NULL;
816 			} else
817 				rt_timer_queue_change(icmp_redirect_timeout_q,
818 				    icmp_redirtimeout);
819 		} else if (icmp_redirtimeout > 0) {
820 			icmp_redirect_timeout_q =
821 			    rt_timer_queue_create(icmp_redirtimeout);
822 		}
823 		return (error);
824 
825 		break;
826 	}
827 	default:
828 		if (name[0] < ICMPCTL_MAXID)
829 			return (sysctl_int_arr(icmpctl_vars, name, namelen,
830 			    oldp, oldlenp, newp, newlen));
831 		return (ENOPROTOOPT);
832 	}
833 	/* NOTREACHED */
834 }
835 
836 struct rtentry *
icmp_mtudisc_clone(struct sockaddr * dst)837 icmp_mtudisc_clone(struct sockaddr *dst)
838 {
839 	struct rtentry *rt;
840 	int error;
841 
842 	rt = rtalloc1(dst, 1);
843 	if (rt == 0)
844 		return (NULL);
845 
846 	/* If we didn't get a host route, allocate one */
847 
848 	if ((rt->rt_flags & RTF_HOST) == 0) {
849 		struct rtentry *nrt;
850 
851 		error = rtrequest((int) RTM_ADD, dst,
852 		    (struct sockaddr *) rt->rt_gateway,
853 		    (struct sockaddr *) 0,
854 		    RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt);
855 		if (error) {
856 			rtfree(rt);
857 			return (NULL);
858 		}
859 		nrt->rt_rmx = rt->rt_rmx;
860 		rtfree(rt);
861 		rt = nrt;
862 	}
863 	error = rt_timer_add(rt, icmp_mtudisc_timeout, ip_mtudisc_timeout_q);
864 	if (error) {
865 		rtfree(rt);
866 		return (NULL);
867 	}
868 
869 	return (rt);
870 }
871 
872 void
icmp_mtudisc(struct icmp * icp)873 icmp_mtudisc(struct icmp *icp)
874 {
875 	struct rtentry *rt;
876 	struct sockaddr *dst = sintosa(&icmpsrc);
877 	u_long mtu = ntohs(icp->icmp_nextmtu);  /* Why a long?  IPv6 */
878 
879 	/* Table of common MTUs: */
880 
881 	static u_short mtu_table[] = {
882 		65535, 65280, 32000, 17914, 9180, 8166,
883 		4352, 2002, 1492, 1006, 508, 296, 68, 0
884 	};
885 
886 	rt = icmp_mtudisc_clone(dst);
887 	if (rt == 0)
888 		return;
889 
890 	if (mtu == 0) {
891 		int i = 0;
892 
893 		mtu = ntohs(icp->icmp_ip.ip_len);
894 		/* Some 4.2BSD-based routers incorrectly adjust the ip_len */
895 		if (mtu > rt->rt_rmx.rmx_mtu && rt->rt_rmx.rmx_mtu != 0)
896 			mtu -= (icp->icmp_ip.ip_hl << 2);
897 
898 		/* If we still can't guess a value, try the route */
899 
900 		if (mtu == 0) {
901 			mtu = rt->rt_rmx.rmx_mtu;
902 
903 			/* If no route mtu, default to the interface mtu */
904 
905 			if (mtu == 0)
906 				mtu = rt->rt_ifp->if_mtu;
907 		}
908 
909 		for (i = 0; i < sizeof(mtu_table) / sizeof(mtu_table[0]); i++)
910 			if (mtu > mtu_table[i]) {
911 				mtu = mtu_table[i];
912 				break;
913 			}
914 	}
915 
916 	/*
917 	 * XXX:   RTV_MTU is overloaded, since the admin can set it
918 	 *	  to turn off PMTU for a route, and the kernel can
919 	 *	  set it to indicate a serious problem with PMTU
920 	 *	  on a route.  We should be using a separate flag
921 	 *	  for the kernel to indicate this.
922 	 */
923 
924 	if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) {
925 		if (mtu < 296 || mtu > rt->rt_ifp->if_mtu)
926 			rt->rt_rmx.rmx_locks |= RTV_MTU;
927 		else if (rt->rt_rmx.rmx_mtu > mtu ||
928 		    rt->rt_rmx.rmx_mtu == 0)
929 			rt->rt_rmx.rmx_mtu = mtu;
930 	}
931 
932 	rtfree(rt);
933 }
934 
935 void
icmp_mtudisc_timeout(struct rtentry * rt,struct rttimer * r)936 icmp_mtudisc_timeout(struct rtentry *rt, struct rttimer *r)
937 {
938 	if (rt == NULL)
939 		panic("icmp_mtudisc_timeout:  bad route to timeout");
940 	if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
941 	    (RTF_DYNAMIC | RTF_HOST)) {
942 		void *(*ctlfunc)(int, struct sockaddr *, void *);
943 		extern u_char ip_protox[];
944 		struct sockaddr_in sa;
945 
946 		sa = *(struct sockaddr_in *)rt_key(rt);
947 		rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt),
948 		    rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
949 
950 		/* Notify TCP layer of increased Path MTU estimate */
951 		ctlfunc = inetsw[ip_protox[IPPROTO_TCP]].pr_ctlinput;
952 		if (ctlfunc)
953 			(*ctlfunc)(PRC_MTUINC,(struct sockaddr *)&sa, NULL);
954 	} else
955 		if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
956 			rt->rt_rmx.rmx_mtu = 0;
957 }
958 
959 /*
960  * Perform rate limit check.
961  * Returns 0 if it is okay to send the icmp packet.
962  * Returns 1 if the router SHOULD NOT send this icmp packet due to rate
963  * limitation.
964  *
965  * XXX per-destination/type check necessary?
966  */
967 int
icmp_ratelimit(const struct in_addr * dst,const int type,const int code)968 icmp_ratelimit(const struct in_addr *dst, const int type, const int code)
969 {
970 
971 	/* PPS limit */
972 	if (!ppsratecheck(&icmperrppslim_last, &icmperrpps_count,
973 	    icmperrppslim))
974 		return 1;
975 
976 	/*okay to send*/
977 	return 0;
978 }
979 
980 static void
icmp_redirect_timeout(struct rtentry * rt,struct rttimer * r)981 icmp_redirect_timeout(struct rtentry *rt, struct rttimer *r)
982 {
983 	if (rt == NULL)
984 		panic("icmp_redirect_timeout:  bad route to timeout");
985 	if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
986 	    (RTF_DYNAMIC | RTF_HOST)) {
987 		rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt),
988 		    rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
989 	}
990 }
991