1/*
2 * Copyright (c) 2000-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
61 */
62/*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69#include <sys/param.h>
70#include <sys/systm.h>
71#include <sys/mbuf.h>
72#include <sys/mcache.h>
73#include <sys/protosw.h>
74#include <sys/socket.h>
75#include <sys/time.h>
76#include <sys/kernel.h>
77#include <sys/sysctl.h>
78
79#include <machine/endian.h>
80
81#include <net/if.h>
82#include <net/route.h>
83
84#define _IP_VHL
85#include <netinet/in.h>
86#include <netinet/in_systm.h>
87#include <netinet/in_var.h>
88#include <netinet/ip.h>
89#include <netinet/ip_icmp.h>
90#include <netinet/ip_var.h>
91#include <netinet/icmp_var.h>
92#include <netinet/tcp.h>
93#include <netinet/tcp_fsm.h>
94#include <netinet/tcp_seq.h>
95#include <netinet/tcp_timer.h>
96#include <netinet/tcp_var.h>
97#include <netinet/tcpip.h>
98
99#if IPSEC
100#include <netinet6/ipsec.h>
101#include <netkey/key.h>
102#endif
103
104#if NECP
105#include <net/necp.h>
106#endif /* NECP */
107
108 /* XXX This one should go in sys/mbuf.h. It is used to avoid that
109 * a firewall-generated packet loops forever through the firewall.
110 */
111#ifndef M_SKIP_FIREWALL
112#define M_SKIP_FIREWALL 0x4000
113#endif
114
115#if CONFIG_MACF_NET
116#include <security/mac_framework.h>
117#endif /* MAC_NET */
118
119
120/*
121 * ICMP routines: error generation, receive packet processing, and
122 * routines to turnaround packets back to the originator, and
123 * host table maintenance routines.
124 */
125
126struct icmpstat icmpstat;
127SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats,
128 CTLFLAG_RD | CTLFLAG_LOCKED,
129 &icmpstat, icmpstat, "");
130
131static int icmpmaskrepl = 0;
132SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
133 CTLFLAG_RW | CTLFLAG_LOCKED,
134 &icmpmaskrepl, 0, "");
135
136static int icmptimestamp = 0;
137SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp,
138 CTLFLAG_RW | CTLFLAG_LOCKED,
139 &icmptimestamp, 0, "");
140
141static int drop_redirect = 1;
142SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect,
143 CTLFLAG_RW | CTLFLAG_LOCKED,
144 &drop_redirect, 0, "");
145
146static int log_redirect = 0;
147SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect,
148 CTLFLAG_RW | CTLFLAG_LOCKED,
149 &log_redirect, 0, "");
150
151const static int icmp_datalen = 8;
152
153#if ICMP_BANDLIM
154
155/* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */
156#ifndef CONFIG_ICMP_BANDLIM
157#if !CONFIG_EMBEDDED
158#define CONFIG_ICMP_BANDLIM 250
159#else /* CONFIG_EMBEDDED */
160#define CONFIG_ICMP_BANDLIM 50
161#endif /* CONFIG_EMBEDDED */
162#endif /* CONFIG_ICMP_BANDLIM */
163
164/*
165 * ICMP error-response bandwidth limiting sysctl. If not enabled, sysctl
166 * variable content is -1 and read-only.
167 */
168
169static int icmplim = CONFIG_ICMP_BANDLIM;
170SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED,
171 &icmplim, 0, "");
172
173#else /* ICMP_BANDLIM */
174
175static int icmplim = -1;
176SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED,
177 &icmplim, 0, "");
178
179#endif /* ICMP_BANDLIM */
180
181/*
182 * ICMP broadcast echo sysctl
183 */
184
185static int icmpbmcastecho = 1;
186SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED,
187 &icmpbmcastecho, 0, "");
188
189#if (DEBUG | DEVELOPMENT)
190static int icmpprintfs = 0;
191SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,
192 &icmpprintfs, 0, "");
193#endif
194
195static void icmp_reflect(struct mbuf *);
196static void icmp_send(struct mbuf *, struct mbuf *);
197
198/*
199 * Generate an error packet of type error
200 * in response to bad packet ip.
201 */
202void
203icmp_error(
204 struct mbuf *n,
205 int type,
206 int code,
207 u_int32_t dest,
208 u_int32_t nextmtu)
209{
210 struct ip *oip = NULL;
211 struct ip *nip = NULL;
212 struct icmp *icp = NULL;
213 struct mbuf *m = NULL;
214 u_int32_t oiphlen = 0;
215 u_int32_t icmplen = 0;
216 u_int32_t icmpelen = 0;
217 u_int32_t nlen = 0;
218
219 VERIFY((u_int)type <= ICMP_MAXTYPE);
220 /* Expect 32-bit aligned data pointer on strict-align platforms */
221 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n);
222
223 if (type != ICMP_REDIRECT)
224 icmpstat.icps_error++;
225 /*
226 * Don't send error:
227 * if not the first fragment of message
228 * if original packet was a multicast or broadcast packet
229 * if the old packet protocol was ICMP
230 * error message, only known informational types.
231 */
232 if (n->m_flags & (M_BCAST|M_MCAST))
233 goto freeit;
234
235 /*
236 * Drop if IP header plus ICMP_MINLEN bytes are not contiguous
237 * in first mbuf.
238 */
239 if (n->m_len < sizeof(struct ip) + ICMP_MINLEN)
240 goto freeit;
241
242 oip = mtod(n, struct ip *);
243 oiphlen = IP_VHL_HL(oip->ip_vhl) << 2;
244 if (n->m_len < oiphlen + ICMP_MINLEN)
245 goto freeit;
246
247#if (DEBUG | DEVELOPMENT)
248 if (icmpprintfs > 1)
249 printf("icmp_error(0x%llx, %x, %d)\n",
250 (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code);
251#endif
252
253 if (oip->ip_off & ~(IP_MF|IP_DF))
254 goto freeit;
255
256 if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
257 n->m_len >= oiphlen + ICMP_MINLEN &&
258 !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))->
259 icmp_type)) {
260 icmpstat.icps_oldicmp++;
261 goto freeit;
262 }
263
264 /*
265 * Calculate the length to quote from original packet and prevent
266 * the ICMP mbuf from overflowing.
267 * Unfortunatly this is non-trivial since ip_forward()
268 * sends us truncated packets.
269 */
270 nlen = m_length(n);
271 if (oip->ip_p == IPPROTO_TCP) {
272 struct tcphdr *th = NULL;
273 u_int16_t tcphlen = 0;
274
275 /*
276 * If the packet got truncated and TCP header
277 * is not contained in the packet, send out
278 * standard reply with only IP header as payload
279 */
280 if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
281 n->m_next == NULL)
282 goto stdreply;
283
284 /*
285 * Otherwise, pull up to get IP and TCP headers
286 * together
287 */
288 if (n->m_len < (oiphlen + sizeof(struct tcphdr)) &&
289 (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL)
290 goto freeit;
291
292 /*
293 * Reinit pointers derived from mbuf data pointer
294 * as things might have moved around with m_pullup
295 */
296 oip = mtod(n, struct ip *);
297 th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
298
299 if (th != ((struct tcphdr *)P2ROUNDDOWN(th,
300 sizeof(u_int32_t))))
301 goto freeit;
302 tcphlen = th->th_off << 2;
303
304 /* Sanity checks */
305 if (tcphlen < sizeof(struct tcphdr))
306 goto freeit;
307 if (oip->ip_len < (oiphlen + tcphlen))
308 goto freeit;
309 if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL)
310 goto stdreply;
311 if (n->m_len < (oiphlen + tcphlen) &&
312 (n = m_pullup(n, (oiphlen + tcphlen))) == NULL)
313 goto freeit;
314
315 /*
316 * Reinit pointers derived from mbuf data pointer
317 * as things might have moved around with m_pullup
318 */
319 oip = mtod(n, struct ip *);
320 th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
321
322 icmpelen = max(tcphlen, min(icmp_datalen,
323 (oip->ip_len - oiphlen)));
324 } else
325stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen,
326 (oip->ip_len - oiphlen)));
327
328 icmplen = min(oiphlen + icmpelen, nlen);
329 if (icmplen < sizeof(struct ip))
330 goto freeit;
331
332 /*
333 * First, formulate icmp message
334 * Allocate enough space for the IP header, ICMP header
335 * and the payload (part of the original message to be sent back).
336 */
337 if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen))
338 m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */
339 else
340 m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
341
342 if (m == NULL)
343 goto freeit;
344
345#if CONFIG_MACF_NET
346 mac_mbuf_label_associate_netlayer(n, m);
347#endif
348 /*
349 * Further refine the payload length to the space
350 * remaining in mbuf after including the IP header and ICMP
351 * header.
352 */
353 icmplen = min(icmplen, M_TRAILINGSPACE(m) -
354 sizeof(struct ip) - ICMP_MINLEN);
355 m_align(m, ICMP_MINLEN + icmplen);
356 m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */
357
358 icp = mtod(m, struct icmp *);
359 icmpstat.icps_outhist[type]++;
360 icp->icmp_type = type;
361 if (type == ICMP_REDIRECT)
362 icp->icmp_gwaddr.s_addr = dest;
363 else {
364 icp->icmp_void = 0;
365 /*
366 * The following assignments assume an overlay with the
367 * zeroed icmp_void field.
368 */
369 if (type == ICMP_PARAMPROB) {
370 icp->icmp_pptr = code;
371 code = 0;
372 } else if (type == ICMP_UNREACH &&
373 code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) {
374 icp->icmp_nextmtu = htons(nextmtu);
375 }
376 }
377
378 icp->icmp_code = code;
379
380 /*
381 * Copy icmplen worth of content from original
382 * mbuf (n) to the new packet after ICMP header.
383 */
384 m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
385 nip = &icp->icmp_ip;
386
387 /*
388 * Convert fields to network representation.
389 */
390#if BYTE_ORDER != BIG_ENDIAN
391 HTONS(nip->ip_len);
392 HTONS(nip->ip_off);
393#endif
394 /*
395 * Set up ICMP message mbuf and copy old IP header (without options
396 * in front of ICMP message.
397 * If the original mbuf was meant to bypass the firewall, the error
398 * reply should bypass as well.
399 */
400 m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
401 m->m_data -= sizeof(struct ip);
402 m->m_len += sizeof(struct ip);
403 m->m_pkthdr.len = m->m_len;
404 m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
405 nip = mtod(m, struct ip *);
406 bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
407 nip->ip_len = m->m_len;
408 nip->ip_vhl = IP_VHL_BORING;
409 nip->ip_p = IPPROTO_ICMP;
410 nip->ip_tos = 0;
411 nip->ip_off = 0;
412 icmp_reflect(m);
413freeit:
414 m_freem(n);
415}
416
417/*
418 * Process a received ICMP message.
419 */
420void
421icmp_input(struct mbuf *m, int hlen)
422{
423 struct sockaddr_in icmpsrc, icmpdst, icmpgw;
424 struct icmp *icp;
425 struct ip *ip = mtod(m, struct ip *);
426 int icmplen;
427 int i;
428 struct in_ifaddr *ia;
429 void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
430 int code;
431
432 /* Expect 32-bit aligned data pointer on strict-align platforms */
433 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
434
435 icmplen = ip->ip_len;
436
437 /*
438 * Locate icmp structure in mbuf, and check
439 * that not corrupted and of at least minimum length.
440 */
441#if (DEBUG | DEVELOPMENT)
442 if (icmpprintfs > 2) {
443 char src_str[MAX_IPv4_STR_LEN];
444 char dst_str[MAX_IPv4_STR_LEN];
445
446 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
447 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
448 printf("%s: from %s to %s, len %d\n",
449 __func__, src_str, dst_str, icmplen);
450 }
451#endif
452 if (icmplen < ICMP_MINLEN) {
453 icmpstat.icps_tooshort++;
454 goto freeit;
455 }
456 i = hlen + min(icmplen, ICMP_ADVLENMIN);
457 if (m->m_len < i && (m = m_pullup(m, i)) == 0) {
458 icmpstat.icps_tooshort++;
459 return;
460 }
461 ip = mtod(m, struct ip *);
462 m->m_len -= hlen;
463 m->m_data += hlen;
464 icp = mtod(m, struct icmp *);
465 if (in_cksum(m, icmplen)) {
466 icmpstat.icps_checksum++;
467 goto freeit;
468 }
469 m->m_len += hlen;
470 m->m_data -= hlen;
471
472#if (DEBUG | DEVELOPMENT)
473 if (icmpprintfs > 2)
474 printf("icmp_input, type %d code %d\n", icp->icmp_type,
475 icp->icmp_code);
476#endif
477
478 /*
479 * Message type specific processing.
480 */
481 if (icp->icmp_type > ICMP_MAXTYPE)
482 goto raw;
483
484 /* Initialize */
485 bzero(&icmpsrc, sizeof (icmpsrc));
486 icmpsrc.sin_len = sizeof (struct sockaddr_in);
487 icmpsrc.sin_family = AF_INET;
488 bzero(&icmpdst, sizeof (icmpdst));
489 icmpdst.sin_len = sizeof (struct sockaddr_in);
490 icmpdst.sin_family = AF_INET;
491 bzero(&icmpgw, sizeof (icmpgw));
492 icmpgw.sin_len = sizeof (struct sockaddr_in);
493 icmpgw.sin_family = AF_INET;
494
495 icmpstat.icps_inhist[icp->icmp_type]++;
496 code = icp->icmp_code;
497 switch (icp->icmp_type) {
498
499 case ICMP_UNREACH:
500 switch (code) {
501 case ICMP_UNREACH_NET:
502 case ICMP_UNREACH_HOST:
503 case ICMP_UNREACH_SRCFAIL:
504 case ICMP_UNREACH_NET_UNKNOWN:
505 case ICMP_UNREACH_HOST_UNKNOWN:
506 case ICMP_UNREACH_ISOLATED:
507 case ICMP_UNREACH_TOSNET:
508 case ICMP_UNREACH_TOSHOST:
509 case ICMP_UNREACH_HOST_PRECEDENCE:
510 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
511 code = PRC_UNREACH_NET;
512 break;
513
514 case ICMP_UNREACH_NEEDFRAG:
515 code = PRC_MSGSIZE;
516 break;
517
518 /*
519 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
520 * Treat subcodes 2,3 as immediate RST
521 */
522 case ICMP_UNREACH_PROTOCOL:
523 case ICMP_UNREACH_PORT:
524 code = PRC_UNREACH_PORT;
525 break;
526
527 case ICMP_UNREACH_NET_PROHIB:
528 case ICMP_UNREACH_HOST_PROHIB:
529 case ICMP_UNREACH_FILTER_PROHIB:
530 code = PRC_UNREACH_ADMIN_PROHIB;
531 break;
532
533 default:
534 goto badcode;
535 }
536 goto deliver;
537
538 case ICMP_TIMXCEED:
539 if (code > 1)
540 goto badcode;
541 code += PRC_TIMXCEED_INTRANS;
542 goto deliver;
543
544 case ICMP_PARAMPROB:
545 if (code > 1)
546 goto badcode;
547 code = PRC_PARAMPROB;
548 goto deliver;
549
550 case ICMP_SOURCEQUENCH:
551 if (code)
552 goto badcode;
553 code = PRC_QUENCH;
554 deliver:
555 /*
556 * Problem with datagram; advise higher level routines.
557 */
558 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp)
559 || IP_VHL_HL(icp->icmp_ip.ip_vhl) <
560 (sizeof(struct ip) >> 2)) {
561 icmpstat.icps_badlen++;
562 goto freeit;
563 }
564
565#if BYTE_ORDER != BIG_ENDIAN
566 NTOHS(icp->icmp_ip.ip_len);
567#endif
568
569 /* Discard ICMP's in response to multicast packets */
570 if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
571 goto badcode;
572#if (DEBUG | DEVELOPMENT)
573 if (icmpprintfs > 2)
574 printf("deliver to protocol %d\n",
575 icp->icmp_ip.ip_p);
576#endif
577 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
578
579 /*
580 * if the packet contains [IPv4 AH TCP], we can't make a
581 * notification to TCP layer.
582 */
583 ctlfunc = ip_protox[icp->icmp_ip.ip_p]->pr_ctlinput;
584
585 if (ctlfunc) {
586 LCK_MTX_ASSERT(inet_domain_mutex, LCK_MTX_ASSERT_OWNED);
587
588 lck_mtx_unlock(inet_domain_mutex);
589
590 (*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
591 (void *)&icp->icmp_ip, m->m_pkthdr.rcvif);
592
593 lck_mtx_lock(inet_domain_mutex);
594 }
595 break;
596
597 badcode:
598 icmpstat.icps_badcode++;
599 break;
600
601 case ICMP_ECHO:
602 if ((m->m_flags & (M_MCAST | M_BCAST))) {
603 if (icmpbmcastecho == 0) {
604 icmpstat.icps_bmcastecho++;
605 break;
606 }
607 }
608
609 /*
610 * rdar://18644769
611 * Do not reply when the destination is link local multicast or broadcast
612 * and the source is not from a directly connected subnet
613 */
614 if ((IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr)) ||
615 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) &&
616 in_localaddr(ip->ip_src) == 0) {
617 icmpstat.icps_bmcastecho++;
618#if (DEBUG | DEVELOPMENT)
619 if (icmpprintfs > 0) {
620 char src_str[MAX_IPv4_STR_LEN];
621 char dst_str[MAX_IPv4_STR_LEN];
622
623 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
624 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
625 printf("%s: non local (B|M)CAST %s to %s, len %d\n",
626 __func__, src_str, dst_str, icmplen);
627 }
628#endif
629 break;
630 }
631
632 icp->icmp_type = ICMP_ECHOREPLY;
633#if ICMP_BANDLIM
634 if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
635 goto freeit;
636 else
637#endif
638 goto reflect;
639
640 case ICMP_TSTAMP:
641 if (icmptimestamp == 0)
642 break;
643
644 if (!icmpbmcastecho
645 && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
646 icmpstat.icps_bmcasttstamp++;
647 break;
648 }
649 if (icmplen < ICMP_TSLEN) {
650 icmpstat.icps_badlen++;
651 break;
652 }
653 icp->icmp_type = ICMP_TSTAMPREPLY;
654 icp->icmp_rtime = iptime();
655 icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
656#if ICMP_BANDLIM
657 if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
658 goto freeit;
659 else
660#endif
661 goto reflect;
662
663 case ICMP_MASKREQ:
664 if (icmpmaskrepl == 0)
665 break;
666 /*
667 * We are not able to respond with all ones broadcast
668 * unless we receive it over a point-to-point interface.
669 */
670 if (icmplen < ICMP_MASKLEN)
671 break;
672 switch (ip->ip_dst.s_addr) {
673
674 case INADDR_BROADCAST:
675 case INADDR_ANY:
676 icmpdst.sin_addr = ip->ip_src;
677 break;
678
679 default:
680 icmpdst.sin_addr = ip->ip_dst;
681 }
682 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
683 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
684 if (ia == 0)
685 break;
686 IFA_LOCK(&ia->ia_ifa);
687 if (ia->ia_ifp == 0) {
688 IFA_UNLOCK(&ia->ia_ifa);
689 IFA_REMREF(&ia->ia_ifa);
690 ia = NULL;
691 break;
692 }
693 icp->icmp_type = ICMP_MASKREPLY;
694 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
695 if (ip->ip_src.s_addr == 0) {
696 if (ia->ia_ifp->if_flags & IFF_BROADCAST)
697 ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
698 else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
699 ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
700 }
701 IFA_UNLOCK(&ia->ia_ifa);
702 IFA_REMREF(&ia->ia_ifa);
703reflect:
704 ip->ip_len += hlen; /* since ip_input deducts this */
705 icmpstat.icps_reflect++;
706 icmpstat.icps_outhist[icp->icmp_type]++;
707 icmp_reflect(m);
708 return;
709
710 case ICMP_REDIRECT:
711 if (log_redirect) {
712 u_int32_t src, dst, gw;
713
714 src = ntohl(ip->ip_src.s_addr);
715 dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
716 gw = ntohl(icp->icmp_gwaddr.s_addr);
717 printf("icmp redirect from %d.%d.%d.%d: "
718 "%d.%d.%d.%d => %d.%d.%d.%d\n",
719 (int)(src >> 24), (int)((src >> 16) & 0xff),
720 (int)((src >> 8) & 0xff), (int)(src & 0xff),
721 (int)(dst >> 24), (int)((dst >> 16) & 0xff),
722 (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
723 (int)(gw >> 24), (int)((gw >> 16) & 0xff),
724 (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
725 }
726 if (drop_redirect)
727 break;
728 if (code > 3)
729 goto badcode;
730 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
731 IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
732 icmpstat.icps_badlen++;
733 break;
734 }
735 /*
736 * Short circuit routing redirects to force
737 * immediate change in the kernel's routing
738 * tables. The message is also handed to anyone
739 * listening on a raw socket (e.g. the routing
740 * daemon for use in updating its tables).
741 */
742 icmpgw.sin_addr = ip->ip_src;
743 icmpdst.sin_addr = icp->icmp_gwaddr;
744#if (DEBUG | DEVELOPMENT)
745 if (icmpprintfs > 0) {
746 char dst_str[MAX_IPv4_STR_LEN];
747 char gw_str[MAX_IPv4_STR_LEN];
748
749 inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str));
750 inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str));
751 printf("%s: redirect dst %s to %s\n", __func__, dst_str, gw_str);
752 }
753#endif
754 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
755 rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc,
756 (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST,
757 (struct sockaddr *)&icmpgw, NULL);
758 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
759#if IPSEC
760 key_sa_routechange((struct sockaddr *)&icmpsrc);
761#endif
762 break;
763
764 /*
765 * No kernel processing for the following;
766 * just fall through to send to raw listener.
767 */
768 case ICMP_ECHOREPLY:
769 case ICMP_ROUTERADVERT:
770 case ICMP_ROUTERSOLICIT:
771 case ICMP_TSTAMPREPLY:
772 case ICMP_IREQREPLY:
773 case ICMP_MASKREPLY:
774 default:
775 break;
776 }
777
778raw:
779 rip_input(m, hlen);
780 return;
781
782freeit:
783 m_freem(m);
784}
785
786/*
787 * Reflect the ip packet back to the source
788 */
789static void
790icmp_reflect(struct mbuf *m)
791{
792 struct ip *ip = mtod(m, struct ip *);
793 struct sockaddr_in icmpdst;
794 struct in_ifaddr *ia;
795 struct in_addr t;
796 struct mbuf *opts = NULL;
797 int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
798
799 if (!in_canforward(ip->ip_src) &&
800 ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
801 (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
802 m_freem(m); /* Bad return address */
803 goto done; /* Ip_output() will check for broadcast */
804 }
805 t = ip->ip_dst;
806 ip->ip_dst = ip->ip_src;
807 /*
808 * If the incoming packet was addressed directly to us,
809 * use dst as the src for the reply. Otherwise (broadcast
810 * or anonymous), use the address which corresponds
811 * to the incoming interface.
812 */
813 lck_rw_lock_shared(in_ifaddr_rwlock);
814 TAILQ_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) {
815 IFA_LOCK(&ia->ia_ifa);
816 if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) {
817 IFA_ADDREF_LOCKED(&ia->ia_ifa);
818 IFA_UNLOCK(&ia->ia_ifa);
819 goto match;
820 }
821 IFA_UNLOCK(&ia->ia_ifa);
822 }
823 /*
824 * Slow path; check for broadcast addresses. Find a source
825 * IP address to use when replying to the broadcast request;
826 * let IP handle the source interface selection work.
827 */
828 for (ia = in_ifaddrhead.tqh_first; ia; ia = ia->ia_link.tqe_next) {
829 IFA_LOCK(&ia->ia_ifa);
830 if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) &&
831 t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) {
832 IFA_ADDREF_LOCKED(&ia->ia_ifa);
833 IFA_UNLOCK(&ia->ia_ifa);
834 break;
835 }
836 IFA_UNLOCK(&ia->ia_ifa);
837 }
838match:
839 lck_rw_done(in_ifaddr_rwlock);
840
841 /* Initialize */
842 bzero(&icmpdst, sizeof (icmpdst));
843 icmpdst.sin_len = sizeof (struct sockaddr_in);
844 icmpdst.sin_family = AF_INET;
845 icmpdst.sin_addr = t;
846 if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif)
847 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
848 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
849 /*
850 * The following happens if the packet was not addressed to us,
851 * and was received on an interface with no IP address.
852 */
853 if (ia == (struct in_ifaddr *)0) {
854 lck_rw_lock_shared(in_ifaddr_rwlock);
855 ia = in_ifaddrhead.tqh_first;
856 if (ia == (struct in_ifaddr *)0) {/* no address yet, bail out */
857 lck_rw_done(in_ifaddr_rwlock);
858 m_freem(m);
859 goto done;
860 }
861 IFA_ADDREF(&ia->ia_ifa);
862 lck_rw_done(in_ifaddr_rwlock);
863 }
864#if CONFIG_MACF_NET
865 mac_netinet_icmp_reply(m);
866#endif
867 IFA_LOCK_SPIN(&ia->ia_ifa);
868 t = IA_SIN(ia)->sin_addr;
869 IFA_UNLOCK(&ia->ia_ifa);
870 ip->ip_src = t;
871 ip->ip_ttl = ip_defttl;
872 IFA_REMREF(&ia->ia_ifa);
873 ia = NULL;
874
875 if (optlen > 0) {
876 u_char *cp;
877 int opt, cnt;
878 u_int len;
879
880 /*
881 * Retrieve any source routing from the incoming packet;
882 * add on any record-route or timestamp options.
883 */
884 cp = (u_char *) (ip + 1);
885 if ((opts = ip_srcroute()) == 0 &&
886 (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */
887 opts->m_len = sizeof(struct in_addr);
888 mtod(opts, struct in_addr *)->s_addr = 0;
889 }
890 if (opts) {
891#if (DEBUG | DEVELOPMENT)
892 if (icmpprintfs > 1)
893 printf("icmp_reflect optlen %d rt %d => ",
894 optlen, opts->m_len);
895#endif
896 for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
897 opt = cp[IPOPT_OPTVAL];
898 if (opt == IPOPT_EOL)
899 break;
900 if (opt == IPOPT_NOP)
901 len = 1;
902 else {
903 if (cnt < IPOPT_OLEN + sizeof(*cp))
904 break;
905 len = cp[IPOPT_OLEN];
906 if (len < IPOPT_OLEN + sizeof(*cp) ||
907 len > cnt)
908 break;
909 }
910 /*
911 * Should check for overflow, but it "can't happen"
912 */
913 if (opt == IPOPT_RR || opt == IPOPT_TS ||
914 opt == IPOPT_SECURITY) {
915 bcopy((caddr_t)cp,
916 mtod(opts, caddr_t) + opts->m_len, len);
917 opts->m_len += len;
918 }
919 }
920 /* Terminate & pad, if necessary */
921 cnt = opts->m_len % 4;
922 if (cnt) {
923 for (; cnt < 4; cnt++) {
924 *(mtod(opts, caddr_t) + opts->m_len) =
925 IPOPT_EOL;
926 opts->m_len++;
927 }
928 }
929#if (DEBUG | DEVELOPMENT)
930 if (icmpprintfs > 1)
931 printf("%d\n", opts->m_len);
932#endif
933 }
934 /*
935 * Now strip out original options by copying rest of first
936 * mbuf's data back, and adjust the IP length.
937 */
938 ip->ip_len -= optlen;
939 ip->ip_vhl = IP_VHL_BORING;
940 m->m_len -= optlen;
941 if (m->m_flags & M_PKTHDR)
942 m->m_pkthdr.len -= optlen;
943 optlen += sizeof(struct ip);
944 bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
945 (unsigned)(m->m_len - sizeof(struct ip)));
946 }
947 m->m_flags &= ~(M_BCAST|M_MCAST);
948 icmp_send(m, opts);
949done:
950 if (opts)
951 (void)m_free(opts);
952}
953
954/*
955 * Send an icmp packet back to the ip level,
956 * after supplying a checksum.
957 */
958static void
959icmp_send(struct mbuf *m, struct mbuf *opts)
960{
961 struct ip *ip = mtod(m, struct ip *);
962 int hlen;
963 struct icmp *icp;
964 struct route ro;
965 struct ip_out_args ipoa;
966
967 bzero(&ipoa, sizeof(ipoa));
968 ipoa.ipoa_boundif = IFSCOPE_NONE;
969 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF | IPOAF_BOUND_SRCADDR;
970 ipoa.ipoa_sotc = SO_TC_UNSPEC;
971 ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
972
973 if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
974 ipoa.ipoa_boundif = m->m_pkthdr.rcvif->if_index;
975 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
976 }
977
978 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
979 m->m_data += hlen;
980 m->m_len -= hlen;
981 icp = mtod(m, struct icmp *);
982 icp->icmp_cksum = 0;
983 icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
984 m->m_data -= hlen;
985 m->m_len += hlen;
986 m->m_pkthdr.rcvif = NULL;
987 m->m_pkthdr.csum_data = 0;
988 m->m_pkthdr.csum_flags = 0;
989#if (DEBUG | DEVELOPMENT)
990 if (icmpprintfs > 2) {
991 char src_str[MAX_IPv4_STR_LEN];
992 char dst_str[MAX_IPv4_STR_LEN];
993
994 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
995 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
996 printf("%s: dst %s src %s\n", __func__, dst_str, src_str);
997 }
998#endif
999 bzero(&ro, sizeof ro);
1000 (void) ip_output(m, opts, &ro, IP_OUTARGS, NULL, &ipoa);
1001 ROUTE_RELEASE(&ro);
1002}
1003
1004u_int32_t
1005iptime(void)
1006{
1007 struct timeval atv;
1008 u_int32_t t;
1009
1010 getmicrotime(&atv);
1011 t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
1012 return (htonl(t));
1013}
1014
1015#if 1
1016/*
1017 * Return the next larger or smaller MTU plateau (table from RFC 1191)
1018 * given current value MTU. If DIR is less than zero, a larger plateau
1019 * is returned; otherwise, a smaller value is returned.
1020 */
1021int
1022ip_next_mtu(int mtu, int dir)
1023{
1024 static int mtutab[] = {
1025 65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
1026 68, 0
1027 };
1028 int i;
1029
1030 for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
1031 if (mtu >= mtutab[i])
1032 break;
1033 }
1034
1035 if (dir < 0) {
1036 if (i == 0) {
1037 return 0;
1038 } else {
1039 return mtutab[i - 1];
1040 }
1041 } else {
1042 if (mtutab[i] == 0) {
1043 return 0;
1044 } else if(mtu > mtutab[i]) {
1045 return mtutab[i];
1046 } else {
1047 return mtutab[i + 1];
1048 }
1049 }
1050}
1051#endif
1052
1053#if ICMP_BANDLIM
1054
1055/*
1056 * badport_bandlim() - check for ICMP bandwidth limit
1057 *
1058 * Return 0 if it is ok to send an ICMP error response, -1 if we have
1059 * hit our bandwidth limit and it is not ok.
1060 *
1061 * If icmplim is <= 0, the feature is disabled and 0 is returned.
1062 *
1063 * For now we separate the TCP and UDP subsystems w/ different 'which'
1064 * values. We may eventually remove this separation (and simplify the
1065 * code further).
1066 *
1067 * Note that the printing of the error message is delayed so we can
1068 * properly print the icmp error rate that the system was trying to do
1069 * (i.e. 22000/100 pps, etc...). This can cause long delays in printing
1070 * the 'final' error, but it doesn't make sense to solve the printing
1071 * delay with more complex code.
1072 */
1073
1074int
1075badport_bandlim(int which)
1076{
1077 static uint64_t lticks[BANDLIM_MAX + 1];
1078 static int lpackets[BANDLIM_MAX + 1];
1079 uint64_t time = net_uptime();
1080 int secs;
1081
1082 const char *bandlimittype[] = {
1083 "Limiting icmp unreach response",
1084 "Limiting icmp ping response",
1085 "Limiting icmp tstamp response",
1086 "Limiting closed port RST response",
1087 "Limiting open port RST response"
1088 };
1089
1090 /*
1091 * Return ok status if feature disabled or argument out of
1092 * ranage.
1093 */
1094
1095 if (icmplim <= 0 || which > BANDLIM_MAX || which < 0)
1096 return(0);
1097
1098 secs = time - lticks[which];
1099
1100 /*
1101 * reset stats when cumulative delta exceeds one second.
1102 */
1103
1104 if (secs > 1) {
1105 if (lpackets[which] > icmplim) {
1106 printf("%s from %d to %d packets per second\n",
1107 bandlimittype[which],
1108 lpackets[which],
1109 icmplim
1110 );
1111 }
1112 lticks[which] = time;
1113 lpackets[which] = 0;
1114 }
1115
1116 /*
1117 * bump packet count
1118 */
1119
1120 if (++lpackets[which] > icmplim) {
1121 return(-1);
1122 }
1123 return(0);
1124}
1125
1126#endif
1127
1128#if __APPLE__
1129
1130/*
1131 * Non-privileged ICMP socket operations
1132 * - send ICMP echo request
1133 * - all ICMP
1134 * - limited socket options
1135 */
1136
1137#include <netinet/ip_icmp.h>
1138#include <netinet/in_pcb.h>
1139
1140extern u_int32_t rip_sendspace;
1141extern u_int32_t rip_recvspace;
1142extern struct inpcbinfo ripcbinfo;
1143
1144int rip_abort(struct socket *);
1145int rip_bind(struct socket *, struct sockaddr *, struct proc *);
1146int rip_connect(struct socket *, struct sockaddr *, struct proc *);
1147int rip_detach(struct socket *);
1148int rip_disconnect(struct socket *);
1149int rip_shutdown(struct socket *);
1150
1151__private_extern__ int icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, struct mbuf *control, struct proc *p);
1152__private_extern__ int icmp_dgram_attach(struct socket *so, int proto, struct proc *p);
1153__private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt);
1154
1155__private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = {
1156 .pru_abort = rip_abort,
1157 .pru_attach = icmp_dgram_attach,
1158 .pru_bind = rip_bind,
1159 .pru_connect = rip_connect,
1160 .pru_control = in_control,
1161 .pru_detach = rip_detach,
1162 .pru_disconnect = rip_disconnect,
1163 .pru_peeraddr = in_getpeeraddr,
1164 .pru_send = icmp_dgram_send,
1165 .pru_shutdown = rip_shutdown,
1166 .pru_sockaddr = in_getsockaddr,
1167 .pru_sosend = sosend,
1168 .pru_soreceive = soreceive,
1169};
1170
1171/* Like rip_attach but without root privilege enforcement */
1172__private_extern__ int
1173icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
1174{
1175 struct inpcb *inp;
1176 int error;
1177
1178 inp = sotoinpcb(so);
1179 if (inp)
1180 panic("icmp_dgram_attach");
1181
1182 error = soreserve(so, rip_sendspace, rip_recvspace);
1183 if (error)
1184 return error;
1185 error = in_pcballoc(so, &ripcbinfo, p);
1186 if (error)
1187 return error;
1188 inp = (struct inpcb *)so->so_pcb;
1189 inp->inp_vflag |= INP_IPV4;
1190 inp->inp_ip_p = IPPROTO_ICMP;
1191 inp->inp_ip_ttl = ip_defttl;
1192 return 0;
1193}
1194
1195/*
1196 * Raw IP socket option processing.
1197 */
1198__private_extern__ int
1199icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
1200{
1201 int error;
1202
1203 if (sopt->sopt_level != IPPROTO_IP)
1204 return (EINVAL);
1205
1206 switch (sopt->sopt_name) {
1207 case IP_OPTIONS:
1208 case IP_HDRINCL:
1209 case IP_TOS:
1210 case IP_TTL:
1211 case IP_RECVOPTS:
1212 case IP_RECVRETOPTS:
1213 case IP_RECVDSTADDR:
1214 case IP_RETOPTS:
1215 case IP_MULTICAST_IF:
1216 case IP_MULTICAST_IFINDEX:
1217 case IP_MULTICAST_TTL:
1218 case IP_MULTICAST_LOOP:
1219 case IP_ADD_MEMBERSHIP:
1220 case IP_DROP_MEMBERSHIP:
1221 case IP_MULTICAST_VIF:
1222 case IP_PORTRANGE:
1223 case IP_RECVIF:
1224 case IP_IPSEC_POLICY:
1225 case IP_STRIPHDR:
1226 case IP_RECVTTL:
1227 case IP_BOUND_IF:
1228 case IP_NO_IFT_CELLULAR:
1229 error = rip_ctloutput(so, sopt);
1230 break;
1231
1232 default:
1233 error = EINVAL;
1234 break;
1235 }
1236
1237 return (error);
1238}
1239
1240__private_extern__ int
1241icmp_dgram_send(struct socket *so, int flags, struct mbuf *m,
1242 struct sockaddr *nam, struct mbuf *control, struct proc *p)
1243{
1244 struct ip *ip;
1245 struct inpcb *inp = sotoinpcb(so);
1246 int hlen;
1247 struct icmp *icp;
1248 struct in_ifaddr *ia = NULL;
1249 int icmplen;
1250 int error = EINVAL;
1251
1252 if (inp == NULL
1253#if NECP
1254 || (necp_socket_should_use_flow_divert(inp))
1255#endif /* NECP */
1256 ) {
1257 if (inp != NULL)
1258 error = EPROTOTYPE;
1259 goto bad;
1260 }
1261
1262 if ((inp->inp_flags & INP_HDRINCL) != 0) {
1263 /* Expect 32-bit aligned data ptr on strict-align platforms */
1264 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
1265 /*
1266 * This is not raw IP, we liberal only for fields TOS,
1267 * id and TTL.
1268 */
1269 ip = mtod(m, struct ip *);
1270
1271 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1272 /* Some sanity checks */
1273 if (m->m_pkthdr.len < hlen + ICMP_MINLEN) {
1274 goto bad;
1275 }
1276 /* Only IPv4 */
1277 if (IP_VHL_V(ip->ip_vhl) != 4)
1278 goto bad;
1279 if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len)
1280 goto bad;
1281 /* Bogus fragments can tie up peer resources */
1282 if ((ip->ip_off & ~IP_DF) != 0)
1283 goto bad;
1284 /* Allow only ICMP even for user provided IP header */
1285 if (ip->ip_p != IPPROTO_ICMP)
1286 goto bad;
1287 /*
1288 * To prevent spoofing, specified source address must
1289 * be one of ours.
1290 */
1291 if (ip->ip_src.s_addr != INADDR_ANY) {
1292 socket_unlock(so, 0);
1293 lck_rw_lock_shared(in_ifaddr_rwlock);
1294 if (TAILQ_EMPTY(&in_ifaddrhead)) {
1295 lck_rw_done(in_ifaddr_rwlock);
1296 socket_lock(so, 0);
1297 goto bad;
1298 }
1299 TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr),
1300 ia_hash) {
1301 IFA_LOCK(&ia->ia_ifa);
1302 if (IA_SIN(ia)->sin_addr.s_addr ==
1303 ip->ip_src.s_addr) {
1304 IFA_UNLOCK(&ia->ia_ifa);
1305 lck_rw_done(in_ifaddr_rwlock);
1306 socket_lock(so, 0);
1307 goto ours;
1308 }
1309 IFA_UNLOCK(&ia->ia_ifa);
1310 }
1311 lck_rw_done(in_ifaddr_rwlock);
1312 socket_lock(so, 0);
1313 goto bad;
1314 }
1315ours:
1316 /* Do not trust we got a valid checksum */
1317 ip->ip_sum = 0;
1318
1319 icp = (struct icmp *)(void *)(((char *)m->m_data) + hlen);
1320 icmplen = m->m_pkthdr.len - hlen;
1321 } else {
1322 if ((icmplen = m->m_pkthdr.len) < ICMP_MINLEN) {
1323 goto bad;
1324 }
1325 icp = mtod(m, struct icmp *);
1326 }
1327 /*
1328 * Allow only to send request types with code 0
1329 */
1330 if (icp->icmp_code != 0)
1331 goto bad;
1332 switch (icp->icmp_type) {
1333 case ICMP_ECHO:
1334 break;
1335 case ICMP_TSTAMP:
1336 if (icmplen != 20)
1337 goto bad;
1338 break;
1339 case ICMP_MASKREQ:
1340 if (icmplen != 12)
1341 goto bad;
1342 break;
1343 default:
1344 goto bad;
1345 }
1346 return (rip_send(so, flags, m, nam, control, p));
1347bad:
1348 VERIFY(error != 0);
1349
1350 if (m != NULL)
1351 m_freem(m);
1352 if (control != NULL)
1353 m_freem(control);
1354
1355 return (error);
1356}
1357
1358#endif /* __APPLE__ */
1359