1 /* $OpenBSD: ip_icmp.c,v 1.67 2005/06/30 08:51:31 markus Exp $ */
2 /* $NetBSD: ip_icmp.c,v 1.19 1996/02/13 23:42:22 christos Exp $ */
3
4 /*
5 * Copyright (c) 1982, 1986, 1988, 1993
6 * The Regents of the University of California. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the University nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
33 *
34 * NRL grants permission for redistribution and use in source and binary
35 * forms, with or without modification, of the software and documentation
36 * created at NRL provided that the following conditions are met:
37 *
38 * 1. Redistributions of source code must retain the above copyright
39 * notice, this list of conditions and the following disclaimer.
40 * 2. Redistributions in binary form must reproduce the above copyright
41 * notice, this list of conditions and the following disclaimer in the
42 * documentation and/or other materials provided with the distribution.
43 * 3. All advertising materials mentioning features or use of this software
44 * must display the following acknowledgements:
45 * This product includes software developed by the University of
46 * California, Berkeley and its contributors.
47 * This product includes software developed at the Information
48 * Technology Division, US Naval Research Laboratory.
49 * 4. Neither the name of the NRL nor the names of its contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
52 *
53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64 *
65 * The views and conclusions contained in the software and documentation
66 * are those of the authors and should not be interpreted as representing
67 * official policies, either expressed or implied, of the US Naval
68 * Research Laboratory (NRL).
69 */
70
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/mbuf.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/sysctl.h>
77
78 #include <net/if.h>
79 #include <net/route.h>
80
81 #include <netinet/in.h>
82 #include <netinet/in_systm.h>
83 #include <netinet/in_var.h>
84 #include <netinet/ip.h>
85 #include <netinet/ip_icmp.h>
86 #include <netinet/ip_var.h>
87 #include <netinet/icmp_var.h>
88
89 /*
90 * ICMP routines: error generation, receive packet processing, and
91 * routines to turnaround packets back to the originator, and
92 * host table maintenance routines.
93 */
94
95 int icmpmaskrepl = 0;
96 int icmpbmcastecho = 0;
97 int icmptstamprepl = 1;
98 #ifdef ICMPPRINTFS
99 int icmpprintfs = 0;
100 #endif
101 int icmperrppslim = 100;
102 int icmperrpps_count = 0;
103 struct timeval icmperrppslim_last;
104 int icmp_rediraccept = 1;
105 int icmp_redirtimeout = 10 * 60;
106 static struct rttimer_queue *icmp_redirect_timeout_q = NULL;
107 struct icmpstat icmpstat;
108
109 int *icmpctl_vars[ICMPCTL_MAXID] = ICMPCTL_VARS;
110
111 void icmp_mtudisc_timeout(struct rtentry *, struct rttimer *);
112 int icmp_ratelimit(const struct in_addr *, const int, const int);
113 static void icmp_redirect_timeout(struct rtentry *, struct rttimer *);
114
115 extern struct protosw inetsw[];
116
117 void
icmp_init(void)118 icmp_init(void)
119 {
120 /*
121 * This is only useful if the user initializes redirtimeout to
122 * something other than zero.
123 */
124 if (icmp_redirtimeout != 0) {
125 icmp_redirect_timeout_q =
126 rt_timer_queue_create(icmp_redirtimeout);
127 }
128 }
129
130 struct mbuf *
icmp_do_error(struct mbuf * n,int type,int code,n_long dest,struct ifnet * destifp)131 icmp_do_error(struct mbuf *n, int type, int code, n_long dest,
132 struct ifnet *destifp)
133 {
134 struct ip *oip = mtod(n, struct ip *), *nip;
135 unsigned oiplen = oip->ip_hl << 2;
136 struct icmp *icp;
137 struct mbuf *m;
138 struct m_tag *mtag;
139 unsigned icmplen, mblen;
140
141 #ifdef ICMPPRINTFS
142 if (icmpprintfs)
143 printf("icmp_error(%x, %d, %d)\n", oip, type, code);
144 #endif
145 if (type != ICMP_REDIRECT)
146 icmpstat.icps_error++;
147 /*
148 * Don't send error if not the first fragment of message.
149 * Don't error if the old packet protocol was ICMP
150 * error message, only known informational types.
151 */
152 if (oip->ip_off & htons(IP_OFFMASK))
153 goto freeit;
154 if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
155 n->m_len >= oiplen + ICMP_MINLEN &&
156 !ICMP_INFOTYPE(((struct icmp *)
157 ((caddr_t)oip + oiplen))->icmp_type)) {
158 icmpstat.icps_oldicmp++;
159 goto freeit;
160 }
161 /* Don't send error in response to a multicast or broadcast packet */
162 if (n->m_flags & (M_BCAST|M_MCAST))
163 goto freeit;
164
165 /*
166 * First, do a rate limitation check.
167 */
168 if (icmp_ratelimit(&oip->ip_src, type, code))
169 goto freeit; /* XXX stat */
170
171 /*
172 * Now, formulate icmp message
173 */
174 icmplen = oiplen + min(8, ntohs(oip->ip_len));
175 /*
176 * Defend against mbuf chains shorter than oip->ip_len:
177 */
178 mblen = 0;
179 for (m = n; m && (mblen < icmplen); m = m->m_next)
180 mblen += m->m_len;
181 icmplen = min(mblen, icmplen);
182
183 /*
184 * As we are not required to return everything we have,
185 * we return whatever we can return at ease.
186 *
187 * Note that ICMP datagrams longer than 576 octets are out of spec
188 * according to RFC1812;
189 */
190
191 KASSERT(ICMP_MINLEN <= MCLBYTES);
192
193 if (icmplen + ICMP_MINLEN > MCLBYTES)
194 icmplen = MCLBYTES - ICMP_MINLEN - sizeof (struct ip);
195
196 m = m_gethdr(M_DONTWAIT, MT_HEADER);
197 if (m && (sizeof (struct ip) + icmplen + ICMP_MINLEN > MHLEN)) {
198 MCLGET(m, M_DONTWAIT);
199 if ((m->m_flags & M_EXT) == 0) {
200 m_freem(m);
201 m = NULL;
202 }
203 }
204 if (m == NULL)
205 goto freeit;
206 m->m_len = icmplen + ICMP_MINLEN;
207 if ((m->m_flags & M_EXT) == 0)
208 MH_ALIGN(m, m->m_len);
209 icp = mtod(m, struct icmp *);
210 if ((u_int)type > ICMP_MAXTYPE)
211 panic("icmp_error");
212 icmpstat.icps_outhist[type]++;
213 icp->icmp_type = type;
214 if (type == ICMP_REDIRECT)
215 icp->icmp_gwaddr.s_addr = dest;
216 else {
217 icp->icmp_void = 0;
218 /*
219 * The following assignments assume an overlay with the
220 * zeroed icmp_void field.
221 */
222 if (type == ICMP_PARAMPROB) {
223 icp->icmp_pptr = code;
224 code = 0;
225 } else if (type == ICMP_UNREACH &&
226 code == ICMP_UNREACH_NEEDFRAG && destifp)
227 icp->icmp_nextmtu = htons(destifp->if_mtu);
228 }
229
230 icp->icmp_code = code;
231 m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
232
233 /*
234 * Now, copy old ip header (without options)
235 * in front of icmp message.
236 */
237 if ((m->m_flags & M_EXT) == 0 &&
238 m->m_data - sizeof(struct ip) < m->m_pktdat)
239 panic("icmp len");
240 m->m_data -= sizeof(struct ip);
241 m->m_len += sizeof(struct ip);
242 m->m_pkthdr.len = m->m_len;
243 m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
244 nip = mtod(m, struct ip *);
245 /* ip_v set in ip_output */
246 nip->ip_hl = sizeof(struct ip) >> 2;
247 nip->ip_tos = 0;
248 nip->ip_len = htons(m->m_len);
249 /* ip_id set in ip_output */
250 nip->ip_off = 0;
251 /* ip_ttl set in icmp_reflect */
252 nip->ip_p = IPPROTO_ICMP;
253 nip->ip_src = oip->ip_src;
254 nip->ip_dst = oip->ip_dst;
255 /* move PF_GENERATED m_tag to new packet, if it exists */
256 mtag = m_tag_find(n, PACKET_TAG_PF_GENERATED, NULL);
257 if (mtag != NULL) {
258 m_tag_unlink(n, mtag);
259 m_tag_prepend(m, mtag);
260 }
261
262 m_freem(n);
263 return (m);
264
265 freeit:
266 m_freem(n);
267 return (NULL);
268 }
269
270 /*
271 * Generate an error packet of type error
272 * in response to bad packet ip.
273 *
274 * The ip packet inside has ip_off and ip_len in host byte order.
275 */
276 void
icmp_error(struct mbuf * n,int type,int code,n_long dest,struct ifnet * destifp)277 icmp_error(struct mbuf *n, int type, int code, n_long dest,
278 struct ifnet *destifp)
279 {
280 struct mbuf *m;
281
282 m = icmp_do_error(n, type, code, dest, destifp);
283 if (m != NULL)
284 icmp_reflect(m);
285 }
286
287 struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET };
288 static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET };
289 static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET };
290 struct sockaddr_in icmpmask = { 8, 0 };
291
292 /*
293 * Process a received ICMP message.
294 */
295 void
icmp_input(struct mbuf * m,...)296 icmp_input(struct mbuf *m, ...)
297 {
298 struct icmp *icp;
299 struct ip *ip = mtod(m, struct ip *);
300 int icmplen;
301 int i;
302 struct in_ifaddr *ia;
303 void *(*ctlfunc)(int, struct sockaddr *, void *);
304 int code;
305 extern u_char ip_protox[];
306 int hlen;
307 va_list ap;
308 struct rtentry *rt;
309
310 va_start(ap, m);
311 hlen = va_arg(ap, int);
312 va_end(ap);
313
314 /*
315 * Locate icmp structure in mbuf, and check
316 * that not corrupted and of at least minimum length.
317 */
318 icmplen = ntohs(ip->ip_len) - hlen;
319 #ifdef ICMPPRINTFS
320 if (icmpprintfs) {
321 char buf[4 * sizeof("123")];
322
323 strlcpy(buf, inet_ntoa(ip->ip_dst), sizeof buf);
324 printf("icmp_input from %s to %s, len %d\n",
325 inet_ntoa(ip->ip_src), buf, icmplen);
326 }
327 #endif
328 if (icmplen < ICMP_MINLEN) {
329 icmpstat.icps_tooshort++;
330 goto freeit;
331 }
332 i = hlen + min(icmplen, ICMP_ADVLENMIN);
333 if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
334 icmpstat.icps_tooshort++;
335 return;
336 }
337 ip = mtod(m, struct ip *);
338 m->m_len -= hlen;
339 m->m_data += hlen;
340 icp = mtod(m, struct icmp *);
341 if (in_cksum(m, icmplen)) {
342 icmpstat.icps_checksum++;
343 goto freeit;
344 }
345 m->m_len += hlen;
346 m->m_data -= hlen;
347
348 #ifdef ICMPPRINTFS
349 /*
350 * Message type specific processing.
351 */
352 if (icmpprintfs)
353 printf("icmp_input, type %d code %d\n", icp->icmp_type,
354 icp->icmp_code);
355 #endif
356 if (icp->icmp_type > ICMP_MAXTYPE)
357 goto raw;
358 icmpstat.icps_inhist[icp->icmp_type]++;
359 code = icp->icmp_code;
360 switch (icp->icmp_type) {
361
362 case ICMP_UNREACH:
363 switch (code) {
364 case ICMP_UNREACH_NET:
365 case ICMP_UNREACH_HOST:
366 case ICMP_UNREACH_PROTOCOL:
367 case ICMP_UNREACH_PORT:
368 case ICMP_UNREACH_SRCFAIL:
369 code += PRC_UNREACH_NET;
370 break;
371
372 case ICMP_UNREACH_NEEDFRAG:
373 code = PRC_MSGSIZE;
374 break;
375
376 case ICMP_UNREACH_NET_UNKNOWN:
377 case ICMP_UNREACH_NET_PROHIB:
378 case ICMP_UNREACH_TOSNET:
379 code = PRC_UNREACH_NET;
380 break;
381
382 case ICMP_UNREACH_HOST_UNKNOWN:
383 case ICMP_UNREACH_ISOLATED:
384 case ICMP_UNREACH_HOST_PROHIB:
385 case ICMP_UNREACH_TOSHOST:
386 case ICMP_UNREACH_FILTER_PROHIB:
387 case ICMP_UNREACH_HOST_PRECEDENCE:
388 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
389 code = PRC_UNREACH_HOST;
390 break;
391
392 default:
393 goto badcode;
394 }
395 goto deliver;
396
397 case ICMP_TIMXCEED:
398 if (code > 1)
399 goto badcode;
400 code += PRC_TIMXCEED_INTRANS;
401 goto deliver;
402
403 case ICMP_PARAMPROB:
404 if (code > 1)
405 goto badcode;
406 code = PRC_PARAMPROB;
407 goto deliver;
408
409 case ICMP_SOURCEQUENCH:
410 if (code)
411 goto badcode;
412 code = PRC_QUENCH;
413 deliver:
414 /* Free packet atttributes */
415 if (m->m_flags & M_PKTHDR)
416 m_tag_delete_chain(m, NULL);
417
418 /*
419 * Problem with datagram; advise higher level routines.
420 */
421 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
422 icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
423 icmpstat.icps_badlen++;
424 goto freeit;
425 }
426 if (IN_MULTICAST(icp->icmp_ip.ip_dst.s_addr))
427 goto badcode;
428 #ifdef INET6
429 /* Get more contiguous data for a v6 in v4 ICMP message. */
430 if (icp->icmp_ip.ip_p == IPPROTO_IPV6) {
431 if (icmplen < ICMP_V6ADVLENMIN ||
432 icmplen < ICMP_V6ADVLEN(icp)) {
433 icmpstat.icps_badlen++;
434 goto freeit;
435 } else {
436 if ((m = m_pullup(m, (ip->ip_hl << 2) +
437 ICMP_V6ADVLEN(icp))) == NULL) {
438 icmpstat.icps_tooshort++;
439 return;
440 }
441 ip = mtod(m, struct ip *);
442 icp = (struct icmp *)
443 (m->m_data + (ip->ip_hl << 2));
444 }
445 }
446 #endif /* INET6 */
447 #ifdef ICMPPRINTFS
448 if (icmpprintfs)
449 printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
450 #endif
451 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
452 /*
453 * XXX if the packet contains [IPv4 AH TCP], we can't make a
454 * notification to TCP layer.
455 */
456 ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
457 if (ctlfunc)
458 (*ctlfunc)(code, sintosa(&icmpsrc), &icp->icmp_ip);
459 break;
460
461 badcode:
462 icmpstat.icps_badcode++;
463 break;
464
465 case ICMP_ECHO:
466 if (!icmpbmcastecho &&
467 (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
468 icmpstat.icps_bmcastecho++;
469 break;
470 }
471 icp->icmp_type = ICMP_ECHOREPLY;
472 goto reflect;
473
474 case ICMP_TSTAMP:
475 if (icmptstamprepl == 0)
476 break;
477
478 if (!icmpbmcastecho &&
479 (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
480 icmpstat.icps_bmcastecho++;
481 break;
482 }
483 if (icmplen < ICMP_TSLEN) {
484 icmpstat.icps_badlen++;
485 break;
486 }
487 icp->icmp_type = ICMP_TSTAMPREPLY;
488 icp->icmp_rtime = iptime();
489 icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
490 goto reflect;
491
492 case ICMP_MASKREQ:
493 if (icmpmaskrepl == 0)
494 break;
495 /*
496 * We are not able to respond with all ones broadcast
497 * unless we receive it over a point-to-point interface.
498 */
499 if (icmplen < ICMP_MASKLEN) {
500 icmpstat.icps_badlen++;
501 break;
502 }
503 if (ip->ip_dst.s_addr == INADDR_BROADCAST ||
504 ip->ip_dst.s_addr == INADDR_ANY)
505 icmpdst.sin_addr = ip->ip_src;
506 else
507 icmpdst.sin_addr = ip->ip_dst;
508 if (m->m_pkthdr.rcvif == NULL)
509 break;
510 ia = ifatoia(ifaof_ifpforaddr(sintosa(&icmpdst),
511 m->m_pkthdr.rcvif));
512 if (ia == 0)
513 break;
514 icp->icmp_type = ICMP_MASKREPLY;
515 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
516 if (ip->ip_src.s_addr == 0) {
517 if (ia->ia_ifp->if_flags & IFF_BROADCAST)
518 ip->ip_src = ia->ia_broadaddr.sin_addr;
519 else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
520 ip->ip_src = ia->ia_dstaddr.sin_addr;
521 }
522 reflect:
523 /* Free packet atttributes */
524 if (m->m_flags & M_PKTHDR)
525 m_tag_delete_chain(m, NULL);
526
527 icmpstat.icps_reflect++;
528 icmpstat.icps_outhist[icp->icmp_type]++;
529 icmp_reflect(m);
530 return;
531
532 case ICMP_REDIRECT:
533 /* Free packet atttributes */
534 if (m->m_flags & M_PKTHDR)
535 m_tag_delete_chain(m, NULL);
536 if (icmp_rediraccept == 0)
537 goto freeit;
538 if (code > 3)
539 goto badcode;
540 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
541 icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
542 icmpstat.icps_badlen++;
543 break;
544 }
545 /*
546 * Short circuit routing redirects to force
547 * immediate change in the kernel's routing
548 * tables. The message is also handed to anyone
549 * listening on a raw socket (e.g. the routing
550 * daemon for use in updating its tables).
551 */
552 icmpgw.sin_addr = ip->ip_src;
553 icmpdst.sin_addr = icp->icmp_gwaddr;
554 #ifdef ICMPPRINTFS
555 if (icmpprintfs) {
556 char buf[4 * sizeof("123")];
557 strlcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst),
558 sizeof buf);
559
560 printf("redirect dst %s to %s\n",
561 buf, inet_ntoa(icp->icmp_gwaddr));
562 }
563 #endif
564 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
565 rt = NULL;
566 rtredirect(sintosa(&icmpsrc), sintosa(&icmpdst),
567 (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
568 sintosa(&icmpgw), (struct rtentry **)&rt);
569 if (rt != NULL && icmp_redirtimeout != 0) {
570 (void)rt_timer_add(rt, icmp_redirect_timeout,
571 icmp_redirect_timeout_q);
572 }
573 if (rt != NULL)
574 rtfree(rt);
575 pfctlinput(PRC_REDIRECT_HOST, sintosa(&icmpsrc));
576 break;
577
578 /*
579 * No kernel processing for the following;
580 * just fall through to send to raw listener.
581 */
582 case ICMP_ECHOREPLY:
583 case ICMP_ROUTERADVERT:
584 case ICMP_ROUTERSOLICIT:
585 case ICMP_TSTAMPREPLY:
586 case ICMP_IREQREPLY:
587 case ICMP_MASKREPLY:
588 case ICMP_TRACEROUTE:
589 case ICMP_DATACONVERR:
590 case ICMP_MOBILE_REDIRECT:
591 case ICMP_IPV6_WHEREAREYOU:
592 case ICMP_IPV6_IAMHERE:
593 case ICMP_MOBILE_REGREQUEST:
594 case ICMP_MOBILE_REGREPLY:
595 case ICMP_PHOTURIS:
596 default:
597 break;
598 }
599
600 raw:
601 rip_input(m);
602 return;
603
604 freeit:
605 m_freem(m);
606 }
607
608 /*
609 * Reflect the ip packet back to the source
610 */
611 void
icmp_reflect(struct mbuf * m)612 icmp_reflect(struct mbuf *m)
613 {
614 struct ip *ip = mtod(m, struct ip *);
615 struct in_ifaddr *ia;
616 struct in_addr t;
617 struct mbuf *opts = 0;
618 int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
619
620 if (!in_canforward(ip->ip_src) &&
621 ((ip->ip_src.s_addr & IN_CLASSA_NET) !=
622 htonl(IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
623 m_freem(m); /* Bad return address */
624 goto done; /* ip_output() will check for broadcast */
625 }
626 t = ip->ip_dst;
627 ip->ip_dst = ip->ip_src;
628 /*
629 * If the incoming packet was addressed directly to us,
630 * use dst as the src for the reply. Otherwise (broadcast
631 * or anonymous), use the address which corresponds
632 * to the incoming interface.
633 */
634 for (ia = in_ifaddr.tqh_first; ia; ia = ia->ia_list.tqe_next) {
635 if (t.s_addr == ia->ia_addr.sin_addr.s_addr)
636 break;
637 if ((ia->ia_ifp->if_flags & IFF_BROADCAST) &&
638 t.s_addr == ia->ia_broadaddr.sin_addr.s_addr)
639 break;
640 }
641 icmpdst.sin_addr = t;
642 if ((ia == (struct in_ifaddr *)0) && (m->m_pkthdr.rcvif != NULL))
643 ia = ifatoia(ifaof_ifpforaddr(sintosa(&icmpdst),
644 m->m_pkthdr.rcvif));
645 /*
646 * The following happens if the packet was not addressed to us,
647 * and was received on an interface with no IP address.
648 */
649 if (ia == (struct in_ifaddr *)0) {
650 struct sockaddr_in *dst;
651 struct route ro;
652
653 bzero((caddr_t) &ro, sizeof(ro));
654 dst = satosin(&ro.ro_dst);
655 dst->sin_family = AF_INET;
656 dst->sin_len = sizeof(*dst);
657 dst->sin_addr = t;
658
659 rtalloc(&ro);
660 if (ro.ro_rt == 0) {
661 ipstat.ips_noroute++;
662 m_freem(m);
663 goto done;
664 }
665
666 ia = ifatoia(ro.ro_rt->rt_ifa);
667 ro.ro_rt->rt_use++;
668 RTFREE(ro.ro_rt);
669 }
670
671 t = ia->ia_addr.sin_addr;
672 ip->ip_src = t;
673 ip->ip_ttl = MAXTTL;
674
675 if (optlen > 0) {
676 u_char *cp;
677 int opt, cnt;
678 u_int len;
679
680 /*
681 * Retrieve any source routing from the incoming packet;
682 * add on any record-route or timestamp options.
683 */
684 cp = (u_char *) (ip + 1);
685 if ((opts = ip_srcroute()) == 0 &&
686 (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
687 opts->m_len = sizeof(struct in_addr);
688 mtod(opts, struct in_addr *)->s_addr = 0;
689 }
690 if (opts) {
691 #ifdef ICMPPRINTFS
692 if (icmpprintfs)
693 printf("icmp_reflect optlen %d rt %d => ",
694 optlen, opts->m_len);
695 #endif
696 for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
697 opt = cp[IPOPT_OPTVAL];
698 if (opt == IPOPT_EOL)
699 break;
700 if (opt == IPOPT_NOP)
701 len = 1;
702 else {
703 if (cnt < IPOPT_OLEN + sizeof(*cp))
704 break;
705 len = cp[IPOPT_OLEN];
706 if (len < IPOPT_OLEN + sizeof(*cp) ||
707 len > cnt)
708 break;
709 }
710 /*
711 * Should check for overflow, but it
712 * "can't happen"
713 */
714 if (opt == IPOPT_RR || opt == IPOPT_TS ||
715 opt == IPOPT_SECURITY) {
716 bcopy((caddr_t)cp,
717 mtod(opts, caddr_t) + opts->m_len,
718 len);
719 opts->m_len += len;
720 }
721 }
722 /* Terminate & pad, if necessary */
723 if ((cnt = opts->m_len % 4) != 0)
724 for (; cnt < 4; cnt++) {
725 *(mtod(opts, caddr_t) + opts->m_len) =
726 IPOPT_EOL;
727 opts->m_len++;
728 }
729 #ifdef ICMPPRINTFS
730 if (icmpprintfs)
731 printf("%d\n", opts->m_len);
732 #endif
733 }
734 /*
735 * Now strip out original options by copying rest of first
736 * mbuf's data back, and adjust the IP length.
737 */
738 ip->ip_len = htons(ntohs(ip->ip_len) - optlen);
739 ip->ip_hl = sizeof(struct ip) >> 2;
740 m->m_len -= optlen;
741 if (m->m_flags & M_PKTHDR)
742 m->m_pkthdr.len -= optlen;
743 optlen += sizeof(struct ip);
744 bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
745 (unsigned)(m->m_len - sizeof(struct ip)));
746 }
747 m->m_flags &= ~(M_BCAST|M_MCAST);
748 icmp_send(m, opts);
749 done:
750 if (opts)
751 (void)m_free(opts);
752 }
753
754 /*
755 * Send an icmp packet back to the ip level,
756 * after supplying a checksum.
757 */
758 void
icmp_send(struct mbuf * m,struct mbuf * opts)759 icmp_send(struct mbuf *m, struct mbuf *opts)
760 {
761 struct ip *ip = mtod(m, struct ip *);
762 int hlen;
763 struct icmp *icp;
764
765 hlen = ip->ip_hl << 2;
766 m->m_data += hlen;
767 m->m_len -= hlen;
768 icp = mtod(m, struct icmp *);
769 icp->icmp_cksum = 0;
770 icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
771 m->m_data -= hlen;
772 m->m_len += hlen;
773 #ifdef ICMPPRINTFS
774 if (icmpprintfs) {
775 char buf[4 * sizeof("123")];
776
777 strlcpy(buf, inet_ntoa(ip->ip_dst), sizeof buf);
778 printf("icmp_send dst %s src %s\n",
779 buf, inet_ntoa(ip->ip_src));
780 }
781 #endif
782 (void)ip_output(m, opts, (void *)NULL, 0, (void *)NULL, (void *)NULL);
783 }
784
785 n_time
iptime(void)786 iptime(void)
787 {
788 struct timeval atv;
789 u_long t;
790
791 microtime(&atv);
792 t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
793 return (htonl(t));
794 }
795
796 int
icmp_sysctl(int * name,u_int namelen,void * oldp,size_t * oldlenp,void * newp,size_t newlen)797 icmp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
798 size_t newlen)
799 {
800
801 /* All sysctl names at this level are terminal. */
802 if (namelen != 1)
803 return (ENOTDIR);
804
805 switch (name[0]) {
806 case ICMPCTL_REDIRTIMEOUT: {
807 int error;
808
809 error = sysctl_int(oldp, oldlenp, newp, newlen,
810 &icmp_redirtimeout);
811 if (icmp_redirect_timeout_q != NULL) {
812 if (icmp_redirtimeout == 0) {
813 rt_timer_queue_destroy(icmp_redirect_timeout_q,
814 TRUE);
815 icmp_redirect_timeout_q = NULL;
816 } else
817 rt_timer_queue_change(icmp_redirect_timeout_q,
818 icmp_redirtimeout);
819 } else if (icmp_redirtimeout > 0) {
820 icmp_redirect_timeout_q =
821 rt_timer_queue_create(icmp_redirtimeout);
822 }
823 return (error);
824
825 break;
826 }
827 default:
828 if (name[0] < ICMPCTL_MAXID)
829 return (sysctl_int_arr(icmpctl_vars, name, namelen,
830 oldp, oldlenp, newp, newlen));
831 return (ENOPROTOOPT);
832 }
833 /* NOTREACHED */
834 }
835
836 struct rtentry *
icmp_mtudisc_clone(struct sockaddr * dst)837 icmp_mtudisc_clone(struct sockaddr *dst)
838 {
839 struct rtentry *rt;
840 int error;
841
842 rt = rtalloc1(dst, 1);
843 if (rt == 0)
844 return (NULL);
845
846 /* If we didn't get a host route, allocate one */
847
848 if ((rt->rt_flags & RTF_HOST) == 0) {
849 struct rtentry *nrt;
850
851 error = rtrequest((int) RTM_ADD, dst,
852 (struct sockaddr *) rt->rt_gateway,
853 (struct sockaddr *) 0,
854 RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt);
855 if (error) {
856 rtfree(rt);
857 return (NULL);
858 }
859 nrt->rt_rmx = rt->rt_rmx;
860 rtfree(rt);
861 rt = nrt;
862 }
863 error = rt_timer_add(rt, icmp_mtudisc_timeout, ip_mtudisc_timeout_q);
864 if (error) {
865 rtfree(rt);
866 return (NULL);
867 }
868
869 return (rt);
870 }
871
872 void
icmp_mtudisc(struct icmp * icp)873 icmp_mtudisc(struct icmp *icp)
874 {
875 struct rtentry *rt;
876 struct sockaddr *dst = sintosa(&icmpsrc);
877 u_long mtu = ntohs(icp->icmp_nextmtu); /* Why a long? IPv6 */
878
879 /* Table of common MTUs: */
880
881 static u_short mtu_table[] = {
882 65535, 65280, 32000, 17914, 9180, 8166,
883 4352, 2002, 1492, 1006, 508, 296, 68, 0
884 };
885
886 rt = icmp_mtudisc_clone(dst);
887 if (rt == 0)
888 return;
889
890 if (mtu == 0) {
891 int i = 0;
892
893 mtu = ntohs(icp->icmp_ip.ip_len);
894 /* Some 4.2BSD-based routers incorrectly adjust the ip_len */
895 if (mtu > rt->rt_rmx.rmx_mtu && rt->rt_rmx.rmx_mtu != 0)
896 mtu -= (icp->icmp_ip.ip_hl << 2);
897
898 /* If we still can't guess a value, try the route */
899
900 if (mtu == 0) {
901 mtu = rt->rt_rmx.rmx_mtu;
902
903 /* If no route mtu, default to the interface mtu */
904
905 if (mtu == 0)
906 mtu = rt->rt_ifp->if_mtu;
907 }
908
909 for (i = 0; i < sizeof(mtu_table) / sizeof(mtu_table[0]); i++)
910 if (mtu > mtu_table[i]) {
911 mtu = mtu_table[i];
912 break;
913 }
914 }
915
916 /*
917 * XXX: RTV_MTU is overloaded, since the admin can set it
918 * to turn off PMTU for a route, and the kernel can
919 * set it to indicate a serious problem with PMTU
920 * on a route. We should be using a separate flag
921 * for the kernel to indicate this.
922 */
923
924 if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) {
925 if (mtu < 296 || mtu > rt->rt_ifp->if_mtu)
926 rt->rt_rmx.rmx_locks |= RTV_MTU;
927 else if (rt->rt_rmx.rmx_mtu > mtu ||
928 rt->rt_rmx.rmx_mtu == 0)
929 rt->rt_rmx.rmx_mtu = mtu;
930 }
931
932 rtfree(rt);
933 }
934
935 void
icmp_mtudisc_timeout(struct rtentry * rt,struct rttimer * r)936 icmp_mtudisc_timeout(struct rtentry *rt, struct rttimer *r)
937 {
938 if (rt == NULL)
939 panic("icmp_mtudisc_timeout: bad route to timeout");
940 if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
941 (RTF_DYNAMIC | RTF_HOST)) {
942 void *(*ctlfunc)(int, struct sockaddr *, void *);
943 extern u_char ip_protox[];
944 struct sockaddr_in sa;
945
946 sa = *(struct sockaddr_in *)rt_key(rt);
947 rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt),
948 rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
949
950 /* Notify TCP layer of increased Path MTU estimate */
951 ctlfunc = inetsw[ip_protox[IPPROTO_TCP]].pr_ctlinput;
952 if (ctlfunc)
953 (*ctlfunc)(PRC_MTUINC,(struct sockaddr *)&sa, NULL);
954 } else
955 if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
956 rt->rt_rmx.rmx_mtu = 0;
957 }
958
959 /*
960 * Perform rate limit check.
961 * Returns 0 if it is okay to send the icmp packet.
962 * Returns 1 if the router SHOULD NOT send this icmp packet due to rate
963 * limitation.
964 *
965 * XXX per-destination/type check necessary?
966 */
967 int
icmp_ratelimit(const struct in_addr * dst,const int type,const int code)968 icmp_ratelimit(const struct in_addr *dst, const int type, const int code)
969 {
970
971 /* PPS limit */
972 if (!ppsratecheck(&icmperrppslim_last, &icmperrpps_count,
973 icmperrppslim))
974 return 1;
975
976 /*okay to send*/
977 return 0;
978 }
979
980 static void
icmp_redirect_timeout(struct rtentry * rt,struct rttimer * r)981 icmp_redirect_timeout(struct rtentry *rt, struct rttimer *r)
982 {
983 if (rt == NULL)
984 panic("icmp_redirect_timeout: bad route to timeout");
985 if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
986 (RTF_DYNAMIC | RTF_HOST)) {
987 rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt),
988 rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
989 }
990 }
991