1 /*
2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * %sccs.include.redist.c%
6 *
7 * @(#)ip_icmp.c 8.2 (Berkeley) 01/04/94
8 */
9
10 #include <sys/param.h>
11 #include <sys/systm.h>
12 #include <sys/malloc.h>
13 #include <sys/mbuf.h>
14 #include <sys/protosw.h>
15 #include <sys/socket.h>
16 #include <sys/time.h>
17 #include <sys/kernel.h>
18
19 #include <net/if.h>
20 #include <net/route.h>
21
22 #include <netinet/in.h>
23 #include <netinet/in_systm.h>
24 #include <netinet/in_var.h>
25 #include <netinet/ip.h>
26 #include <netinet/ip_icmp.h>
27 #include <netinet/icmp_var.h>
28
29 /*
30 * ICMP routines: error generation, receive packet processing, and
31 * routines to turnaround packets back to the originator, and
32 * host table maintenance routines.
33 */
34
35 int icmpmaskrepl = 0;
36 #ifdef ICMPPRINTFS
37 int icmpprintfs = 0;
38 #endif
39
40 extern struct protosw inetsw[];
41
42 /*
43 * Generate an error packet of type error
44 * in response to bad packet ip.
45 */
46 void
icmp_error(n,type,code,dest,destifp)47 icmp_error(n, type, code, dest, destifp)
48 struct mbuf *n;
49 int type, code;
50 n_long dest;
51 struct ifnet *destifp;
52 {
53 register struct ip *oip = mtod(n, struct ip *), *nip;
54 register unsigned oiplen = oip->ip_hl << 2;
55 register struct icmp *icp;
56 register struct mbuf *m;
57 unsigned icmplen;
58
59 #ifdef ICMPPRINTFS
60 if (icmpprintfs)
61 printf("icmp_error(%x, %d, %d)\n", oip, type, code);
62 #endif
63 if (type != ICMP_REDIRECT)
64 icmpstat.icps_error++;
65 /*
66 * Don't send error if not the first fragment of message.
67 * Don't error if the old packet protocol was ICMP
68 * error message, only known informational types.
69 */
70 if (oip->ip_off &~ (IP_MF|IP_DF))
71 goto freeit;
72 if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
73 n->m_len >= oiplen + ICMP_MINLEN &&
74 !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
75 icmpstat.icps_oldicmp++;
76 goto freeit;
77 }
78 /* Don't send error in response to a multicast or broadcast packet */
79 if (n->m_flags & (M_BCAST|M_MCAST))
80 goto freeit;
81 /*
82 * First, formulate icmp message
83 */
84 m = m_gethdr(M_DONTWAIT, MT_HEADER);
85 if (m == NULL)
86 goto freeit;
87 icmplen = oiplen + min(8, oip->ip_len);
88 m->m_len = icmplen + ICMP_MINLEN;
89 MH_ALIGN(m, m->m_len);
90 icp = mtod(m, struct icmp *);
91 if ((u_int)type > ICMP_MAXTYPE)
92 panic("icmp_error");
93 icmpstat.icps_outhist[type]++;
94 icp->icmp_type = type;
95 if (type == ICMP_REDIRECT)
96 icp->icmp_gwaddr.s_addr = dest;
97 else {
98 icp->icmp_void = 0;
99 /*
100 * The following assignments assume an overlay with the
101 * zeroed icmp_void field.
102 */
103 if (type == ICMP_PARAMPROB) {
104 icp->icmp_pptr = code;
105 code = 0;
106 } else if (type == ICMP_UNREACH &&
107 code == ICMP_UNREACH_NEEDFRAG && destifp) {
108 icp->icmp_nextmtu = htons(destifp->if_mtu);
109 }
110 }
111
112 icp->icmp_code = code;
113 bcopy((caddr_t)oip, (caddr_t)&icp->icmp_ip, icmplen);
114 nip = &icp->icmp_ip;
115 nip->ip_len = htons((u_short)(nip->ip_len + oiplen));
116
117 /*
118 * Now, copy old ip header (without options)
119 * in front of icmp message.
120 */
121 if (m->m_data - sizeof(struct ip) < m->m_pktdat)
122 panic("icmp len");
123 m->m_data -= sizeof(struct ip);
124 m->m_len += sizeof(struct ip);
125 m->m_pkthdr.len = m->m_len;
126 m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
127 nip = mtod(m, struct ip *);
128 bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
129 nip->ip_len = m->m_len;
130 nip->ip_hl = sizeof(struct ip) >> 2;
131 nip->ip_p = IPPROTO_ICMP;
132 nip->ip_tos = 0;
133 icmp_reflect(m);
134
135 freeit:
136 m_freem(n);
137 }
138
139 static struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET };
140 static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET };
141 static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET };
142 struct sockaddr_in icmpmask = { 8, 0 };
143
144 /*
145 * Process a received ICMP message.
146 */
147 void
icmp_input(m,hlen)148 icmp_input(m, hlen)
149 register struct mbuf *m;
150 int hlen;
151 {
152 register struct icmp *icp;
153 register struct ip *ip = mtod(m, struct ip *);
154 int icmplen = ip->ip_len;
155 register int i;
156 struct in_ifaddr *ia;
157 void (*ctlfunc) __P((int, struct sockaddr *, struct ip *));
158 int code;
159 extern u_char ip_protox[];
160
161 /*
162 * Locate icmp structure in mbuf, and check
163 * that not corrupted and of at least minimum length.
164 */
165 #ifdef ICMPPRINTFS
166 if (icmpprintfs)
167 printf("icmp_input from %x to %x, len %d\n",
168 ntohl(ip->ip_src.s_addr), ntohl(ip->ip_dst.s_addr),
169 icmplen);
170 #endif
171 if (icmplen < ICMP_MINLEN) {
172 icmpstat.icps_tooshort++;
173 goto freeit;
174 }
175 i = hlen + min(icmplen, ICMP_ADVLENMIN);
176 if (m->m_len < i && (m = m_pullup(m, i)) == 0) {
177 icmpstat.icps_tooshort++;
178 return;
179 }
180 ip = mtod(m, struct ip *);
181 m->m_len -= hlen;
182 m->m_data += hlen;
183 icp = mtod(m, struct icmp *);
184 if (in_cksum(m, icmplen)) {
185 icmpstat.icps_checksum++;
186 goto freeit;
187 }
188 m->m_len += hlen;
189 m->m_data -= hlen;
190
191 #ifdef ICMPPRINTFS
192 /*
193 * Message type specific processing.
194 */
195 if (icmpprintfs)
196 printf("icmp_input, type %d code %d\n", icp->icmp_type,
197 icp->icmp_code);
198 #endif
199 if (icp->icmp_type > ICMP_MAXTYPE)
200 goto raw;
201 icmpstat.icps_inhist[icp->icmp_type]++;
202 code = icp->icmp_code;
203 switch (icp->icmp_type) {
204
205 case ICMP_UNREACH:
206 switch (code) {
207 case ICMP_UNREACH_NET:
208 case ICMP_UNREACH_HOST:
209 case ICMP_UNREACH_PROTOCOL:
210 case ICMP_UNREACH_PORT:
211 case ICMP_UNREACH_SRCFAIL:
212 code += PRC_UNREACH_NET;
213 break;
214
215 case ICMP_UNREACH_NEEDFRAG:
216 code = PRC_MSGSIZE;
217 break;
218
219 case ICMP_UNREACH_NET_UNKNOWN:
220 case ICMP_UNREACH_NET_PROHIB:
221 case ICMP_UNREACH_TOSNET:
222 code = PRC_UNREACH_NET;
223 break;
224
225 case ICMP_UNREACH_HOST_UNKNOWN:
226 case ICMP_UNREACH_ISOLATED:
227 case ICMP_UNREACH_HOST_PROHIB:
228 case ICMP_UNREACH_TOSHOST:
229 code = PRC_UNREACH_HOST;
230 break;
231
232 default:
233 goto badcode;
234 }
235 goto deliver;
236
237 case ICMP_TIMXCEED:
238 if (code > 1)
239 goto badcode;
240 code += PRC_TIMXCEED_INTRANS;
241 goto deliver;
242
243 case ICMP_PARAMPROB:
244 if (code > 1)
245 goto badcode;
246 code = PRC_PARAMPROB;
247 goto deliver;
248
249 case ICMP_SOURCEQUENCH:
250 if (code)
251 goto badcode;
252 code = PRC_QUENCH;
253 deliver:
254 /*
255 * Problem with datagram; advise higher level routines.
256 */
257 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
258 icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
259 icmpstat.icps_badlen++;
260 goto freeit;
261 }
262 NTOHS(icp->icmp_ip.ip_len);
263 #ifdef ICMPPRINTFS
264 if (icmpprintfs)
265 printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
266 #endif
267 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
268 if (ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput)
269 (*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
270 &icp->icmp_ip);
271 break;
272
273 badcode:
274 icmpstat.icps_badcode++;
275 break;
276
277 case ICMP_ECHO:
278 icp->icmp_type = ICMP_ECHOREPLY;
279 goto reflect;
280
281 case ICMP_TSTAMP:
282 if (icmplen < ICMP_TSLEN) {
283 icmpstat.icps_badlen++;
284 break;
285 }
286 icp->icmp_type = ICMP_TSTAMPREPLY;
287 icp->icmp_rtime = iptime();
288 icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
289 goto reflect;
290
291 case ICMP_MASKREQ:
292 #define satosin(sa) ((struct sockaddr_in *)(sa))
293 if (icmpmaskrepl == 0)
294 break;
295 /*
296 * We are not able to respond with all ones broadcast
297 * unless we receive it over a point-to-point interface.
298 */
299 if (icmplen < ICMP_MASKLEN)
300 break;
301 switch (ip->ip_dst.s_addr) {
302
303 case INADDR_BROADCAST:
304 case INADDR_ANY:
305 icmpdst.sin_addr = ip->ip_src;
306 break;
307
308 default:
309 icmpdst.sin_addr = ip->ip_dst;
310 }
311 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
312 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
313 if (ia == 0)
314 break;
315 icp->icmp_type = ICMP_MASKREPLY;
316 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
317 if (ip->ip_src.s_addr == 0) {
318 if (ia->ia_ifp->if_flags & IFF_BROADCAST)
319 ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
320 else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
321 ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
322 }
323 reflect:
324 ip->ip_len += hlen; /* since ip_input deducts this */
325 icmpstat.icps_reflect++;
326 icmpstat.icps_outhist[icp->icmp_type]++;
327 icmp_reflect(m);
328 return;
329
330 case ICMP_REDIRECT:
331 if (code > 3)
332 goto badcode;
333 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
334 icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
335 icmpstat.icps_badlen++;
336 break;
337 }
338 /*
339 * Short circuit routing redirects to force
340 * immediate change in the kernel's routing
341 * tables. The message is also handed to anyone
342 * listening on a raw socket (e.g. the routing
343 * daemon for use in updating its tables).
344 */
345 icmpgw.sin_addr = ip->ip_src;
346 icmpdst.sin_addr = icp->icmp_gwaddr;
347 #ifdef ICMPPRINTFS
348 if (icmpprintfs)
349 printf("redirect dst %x to %x\n", icp->icmp_ip.ip_dst,
350 icp->icmp_gwaddr);
351 #endif
352 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
353 rtredirect((struct sockaddr *)&icmpsrc,
354 (struct sockaddr *)&icmpdst,
355 (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
356 (struct sockaddr *)&icmpgw, (struct rtentry **)0);
357 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
358 break;
359
360 /*
361 * No kernel processing for the following;
362 * just fall through to send to raw listener.
363 */
364 case ICMP_ECHOREPLY:
365 case ICMP_ROUTERADVERT:
366 case ICMP_ROUTERSOLICIT:
367 case ICMP_TSTAMPREPLY:
368 case ICMP_IREQREPLY:
369 case ICMP_MASKREPLY:
370 default:
371 break;
372 }
373
374 raw:
375 rip_input(m);
376 return;
377
378 freeit:
379 m_freem(m);
380 }
381
382 /*
383 * Reflect the ip packet back to the source
384 */
385 void
icmp_reflect(m)386 icmp_reflect(m)
387 struct mbuf *m;
388 {
389 register struct ip *ip = mtod(m, struct ip *);
390 register struct in_ifaddr *ia;
391 struct in_addr t;
392 struct mbuf *opts = 0, *ip_srcroute();
393 int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
394
395 if (!in_canforward(ip->ip_src) &&
396 ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
397 (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
398 m_freem(m); /* Bad return address */
399 goto done; /* Ip_output() will check for broadcast */
400 }
401 t = ip->ip_dst;
402 ip->ip_dst = ip->ip_src;
403 /*
404 * If the incoming packet was addressed directly to us,
405 * use dst as the src for the reply. Otherwise (broadcast
406 * or anonymous), use the address which corresponds
407 * to the incoming interface.
408 */
409 for (ia = in_ifaddr; ia; ia = ia->ia_next) {
410 if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
411 break;
412 if ((ia->ia_ifp->if_flags & IFF_BROADCAST) &&
413 t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr)
414 break;
415 }
416 icmpdst.sin_addr = t;
417 if (ia == (struct in_ifaddr *)0)
418 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
419 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
420 /*
421 * The following happens if the packet was not addressed to us,
422 * and was received on an interface with no IP address.
423 */
424 if (ia == (struct in_ifaddr *)0)
425 ia = in_ifaddr;
426 t = IA_SIN(ia)->sin_addr;
427 ip->ip_src = t;
428 ip->ip_ttl = MAXTTL;
429
430 if (optlen > 0) {
431 register u_char *cp;
432 int opt, cnt;
433 u_int len;
434
435 /*
436 * Retrieve any source routing from the incoming packet;
437 * add on any record-route or timestamp options.
438 */
439 cp = (u_char *) (ip + 1);
440 if ((opts = ip_srcroute()) == 0 &&
441 (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
442 opts->m_len = sizeof(struct in_addr);
443 mtod(opts, struct in_addr *)->s_addr = 0;
444 }
445 if (opts) {
446 #ifdef ICMPPRINTFS
447 if (icmpprintfs)
448 printf("icmp_reflect optlen %d rt %d => ",
449 optlen, opts->m_len);
450 #endif
451 for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
452 opt = cp[IPOPT_OPTVAL];
453 if (opt == IPOPT_EOL)
454 break;
455 if (opt == IPOPT_NOP)
456 len = 1;
457 else {
458 len = cp[IPOPT_OLEN];
459 if (len <= 0 || len > cnt)
460 break;
461 }
462 /*
463 * Should check for overflow, but it "can't happen"
464 */
465 if (opt == IPOPT_RR || opt == IPOPT_TS ||
466 opt == IPOPT_SECURITY) {
467 bcopy((caddr_t)cp,
468 mtod(opts, caddr_t) + opts->m_len, len);
469 opts->m_len += len;
470 }
471 }
472 /* Terminate & pad, if necessary */
473 if (cnt = opts->m_len % 4) {
474 for (; cnt < 4; cnt++) {
475 *(mtod(opts, caddr_t) + opts->m_len) =
476 IPOPT_EOL;
477 opts->m_len++;
478 }
479 }
480 #ifdef ICMPPRINTFS
481 if (icmpprintfs)
482 printf("%d\n", opts->m_len);
483 #endif
484 }
485 /*
486 * Now strip out original options by copying rest of first
487 * mbuf's data back, and adjust the IP length.
488 */
489 ip->ip_len -= optlen;
490 ip->ip_hl = sizeof(struct ip) >> 2;
491 m->m_len -= optlen;
492 if (m->m_flags & M_PKTHDR)
493 m->m_pkthdr.len -= optlen;
494 optlen += sizeof(struct ip);
495 bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
496 (unsigned)(m->m_len - sizeof(struct ip)));
497 }
498 m->m_flags &= ~(M_BCAST|M_MCAST);
499 icmp_send(m, opts);
500 done:
501 if (opts)
502 (void)m_free(opts);
503 }
504
505 /*
506 * Send an icmp packet back to the ip level,
507 * after supplying a checksum.
508 */
509 void
icmp_send(m,opts)510 icmp_send(m, opts)
511 register struct mbuf *m;
512 struct mbuf *opts;
513 {
514 register struct ip *ip = mtod(m, struct ip *);
515 register int hlen;
516 register struct icmp *icp;
517
518 hlen = ip->ip_hl << 2;
519 m->m_data += hlen;
520 m->m_len -= hlen;
521 icp = mtod(m, struct icmp *);
522 icp->icmp_cksum = 0;
523 icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
524 m->m_data -= hlen;
525 m->m_len += hlen;
526 #ifdef ICMPPRINTFS
527 if (icmpprintfs)
528 printf("icmp_send dst %x src %x\n", ip->ip_dst, ip->ip_src);
529 #endif
530 (void) ip_output(m, opts, NULL, 0, NULL);
531 }
532
533 n_time
iptime()534 iptime()
535 {
536 struct timeval atv;
537 u_long t;
538
539 microtime(&atv);
540 t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
541 return (htonl(t));
542 }
543
544 int
icmp_sysctl(name,namelen,oldp,oldlenp,newp,newlen)545 icmp_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
546 int *name;
547 u_int namelen;
548 void *oldp;
549 size_t *oldlenp;
550 void *newp;
551 size_t newlen;
552 {
553
554 /* All sysctl names at this level are terminal. */
555 if (namelen != 1)
556 return (ENOTDIR);
557
558 switch (name[0]) {
559 case ICMPCTL_MASKREPL:
560 return (sysctl_int(oldp, oldlenp, newp, newlen, &icmpmaskrepl));
561 default:
562 return (ENOPROTOOPT);
563 }
564 /* NOTREACHED */
565 }
566