1 | /* |
2 | * Copyright (c) 2000-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* |
29 | * Copyright (c) 1982, 1986, 1988, 1993 |
30 | * The Regents of the University of California. All rights reserved. |
31 | * |
32 | * Redistribution and use in source and binary forms, with or without |
33 | * modification, are permitted provided that the following conditions |
34 | * are met: |
35 | * 1. Redistributions of source code must retain the above copyright |
36 | * notice, this list of conditions and the following disclaimer. |
37 | * 2. Redistributions in binary form must reproduce the above copyright |
38 | * notice, this list of conditions and the following disclaimer in the |
39 | * documentation and/or other materials provided with the distribution. |
40 | * 3. All advertising materials mentioning features or use of this software |
41 | * must display the following acknowledgement: |
42 | * This product includes software developed by the University of |
43 | * California, Berkeley and its contributors. |
44 | * 4. Neither the name of the University nor the names of its contributors |
45 | * may be used to endorse or promote products derived from this software |
46 | * without specific prior written permission. |
47 | * |
48 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
49 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
51 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
52 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
53 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
54 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
55 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
56 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
57 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
58 | * SUCH DAMAGE. |
59 | * |
60 | * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94 |
61 | */ |
62 | /* |
63 | * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce |
64 | * support for mandatory and extensible security protections. This notice |
65 | * is included in support of clause 2.2 (b) of the Apple Public License, |
66 | * Version 2.0. |
67 | */ |
68 | |
69 | #include <sys/param.h> |
70 | #include <sys/systm.h> |
71 | #include <sys/mbuf.h> |
72 | #include <sys/mcache.h> |
73 | #include <sys/protosw.h> |
74 | #include <sys/socket.h> |
75 | #include <sys/time.h> |
76 | #include <sys/kernel.h> |
77 | #include <sys/sysctl.h> |
78 | |
79 | #include <machine/endian.h> |
80 | |
81 | #include <net/if.h> |
82 | #include <net/route.h> |
83 | |
84 | #define _IP_VHL |
85 | #include <netinet/in.h> |
86 | #include <netinet/in_systm.h> |
87 | #include <netinet/in_var.h> |
88 | #include <netinet/ip.h> |
89 | #include <netinet/ip_icmp.h> |
90 | #include <netinet/ip_var.h> |
91 | #include <netinet/icmp_var.h> |
92 | #include <netinet/tcp.h> |
93 | #include <netinet/tcp_fsm.h> |
94 | #include <netinet/tcp_seq.h> |
95 | #include <netinet/tcp_timer.h> |
96 | #include <netinet/tcp_var.h> |
97 | #include <netinet/tcpip.h> |
98 | |
99 | #if IPSEC |
100 | #include <netinet6/ipsec.h> |
101 | #include <netkey/key.h> |
102 | #endif |
103 | |
104 | #if NECP |
105 | #include <net/necp.h> |
106 | #endif /* NECP */ |
107 | |
108 | /* XXX This one should go in sys/mbuf.h. It is used to avoid that |
109 | * a firewall-generated packet loops forever through the firewall. |
110 | */ |
111 | #ifndef M_SKIP_FIREWALL |
112 | #define M_SKIP_FIREWALL 0x4000 |
113 | #endif |
114 | |
115 | #if CONFIG_MACF_NET |
116 | #include <security/mac_framework.h> |
117 | #endif /* MAC_NET */ |
118 | |
119 | |
120 | /* |
121 | * ICMP routines: error generation, receive packet processing, and |
122 | * routines to turnaround packets back to the originator, and |
123 | * host table maintenance routines. |
124 | */ |
125 | |
126 | struct icmpstat icmpstat; |
127 | SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, |
128 | CTLFLAG_RD | CTLFLAG_LOCKED, |
129 | &icmpstat, icmpstat, "" ); |
130 | |
131 | static int icmpmaskrepl = 0; |
132 | SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, |
133 | CTLFLAG_RW | CTLFLAG_LOCKED, |
134 | &icmpmaskrepl, 0, "" ); |
135 | |
136 | static int icmptimestamp = 0; |
137 | SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp, |
138 | CTLFLAG_RW | CTLFLAG_LOCKED, |
139 | &icmptimestamp, 0, "" ); |
140 | |
141 | static int drop_redirect = 1; |
142 | SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, |
143 | CTLFLAG_RW | CTLFLAG_LOCKED, |
144 | &drop_redirect, 0, "" ); |
145 | |
146 | static int log_redirect = 0; |
147 | SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, |
148 | CTLFLAG_RW | CTLFLAG_LOCKED, |
149 | &log_redirect, 0, "" ); |
150 | |
151 | const static int icmp_datalen = 8; |
152 | |
153 | #if ICMP_BANDLIM |
154 | |
155 | /* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */ |
156 | #ifndef CONFIG_ICMP_BANDLIM |
157 | #if !CONFIG_EMBEDDED |
158 | #define CONFIG_ICMP_BANDLIM 250 |
159 | #else /* CONFIG_EMBEDDED */ |
160 | #define CONFIG_ICMP_BANDLIM 50 |
161 | #endif /* CONFIG_EMBEDDED */ |
162 | #endif /* CONFIG_ICMP_BANDLIM */ |
163 | |
164 | /* |
165 | * ICMP error-response bandwidth limiting sysctl. If not enabled, sysctl |
166 | * variable content is -1 and read-only. |
167 | */ |
168 | |
169 | static int icmplim = CONFIG_ICMP_BANDLIM; |
170 | SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED, |
171 | &icmplim, 0, "" ); |
172 | |
173 | #else /* ICMP_BANDLIM */ |
174 | |
175 | static int icmplim = -1; |
176 | SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED, |
177 | &icmplim, 0, "" ); |
178 | |
179 | #endif /* ICMP_BANDLIM */ |
180 | |
181 | /* |
182 | * ICMP broadcast echo sysctl |
183 | */ |
184 | |
185 | static int icmpbmcastecho = 1; |
186 | SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED, |
187 | &icmpbmcastecho, 0, "" ); |
188 | |
189 | #if (DEBUG | DEVELOPMENT) |
190 | static int icmpprintfs = 0; |
191 | SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED, |
192 | &icmpprintfs, 0, "" ); |
193 | #endif |
194 | |
195 | static void icmp_reflect(struct mbuf *); |
196 | static void icmp_send(struct mbuf *, struct mbuf *); |
197 | |
198 | /* |
199 | * Generate an error packet of type error |
200 | * in response to bad packet ip. |
201 | */ |
202 | void |
203 | icmp_error( |
204 | struct mbuf *n, |
205 | int type, |
206 | int code, |
207 | u_int32_t dest, |
208 | u_int32_t nextmtu) |
209 | { |
210 | struct ip *oip = NULL; |
211 | struct ip *nip = NULL; |
212 | struct icmp *icp = NULL; |
213 | struct mbuf *m = NULL; |
214 | u_int32_t oiphlen = 0; |
215 | u_int32_t icmplen = 0; |
216 | u_int32_t icmpelen = 0; |
217 | u_int32_t nlen = 0; |
218 | |
219 | VERIFY((u_int)type <= ICMP_MAXTYPE); |
220 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
221 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n); |
222 | |
223 | if (type != ICMP_REDIRECT) |
224 | icmpstat.icps_error++; |
225 | /* |
226 | * Don't send error: |
227 | * if not the first fragment of message |
228 | * if original packet was a multicast or broadcast packet |
229 | * if the old packet protocol was ICMP |
230 | * error message, only known informational types. |
231 | */ |
232 | if (n->m_flags & (M_BCAST|M_MCAST)) |
233 | goto freeit; |
234 | |
235 | /* |
236 | * Drop if IP header plus ICMP_MINLEN bytes are not contiguous |
237 | * in first mbuf. |
238 | */ |
239 | if (n->m_len < sizeof(struct ip) + ICMP_MINLEN) |
240 | goto freeit; |
241 | |
242 | oip = mtod(n, struct ip *); |
243 | oiphlen = IP_VHL_HL(oip->ip_vhl) << 2; |
244 | if (n->m_len < oiphlen + ICMP_MINLEN) |
245 | goto freeit; |
246 | |
247 | #if (DEBUG | DEVELOPMENT) |
248 | if (icmpprintfs > 1) |
249 | printf("icmp_error(0x%llx, %x, %d)\n" , |
250 | (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code); |
251 | #endif |
252 | |
253 | if (oip->ip_off & ~(IP_MF|IP_DF)) |
254 | goto freeit; |
255 | |
256 | if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT && |
257 | n->m_len >= oiphlen + ICMP_MINLEN && |
258 | !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))-> |
259 | icmp_type)) { |
260 | icmpstat.icps_oldicmp++; |
261 | goto freeit; |
262 | } |
263 | |
264 | /* |
265 | * Calculate the length to quote from original packet and prevent |
266 | * the ICMP mbuf from overflowing. |
267 | * Unfortunatly this is non-trivial since ip_forward() |
268 | * sends us truncated packets. |
269 | */ |
270 | nlen = m_length(n); |
271 | if (oip->ip_p == IPPROTO_TCP) { |
272 | struct tcphdr *th = NULL; |
273 | u_int16_t tcphlen = 0; |
274 | |
275 | /* |
276 | * If the packet got truncated and TCP header |
277 | * is not contained in the packet, send out |
278 | * standard reply with only IP header as payload |
279 | */ |
280 | if (oiphlen + sizeof(struct tcphdr) > n->m_len && |
281 | n->m_next == NULL) |
282 | goto stdreply; |
283 | |
284 | /* |
285 | * Otherwise, pull up to get IP and TCP headers |
286 | * together |
287 | */ |
288 | if (n->m_len < (oiphlen + sizeof(struct tcphdr)) && |
289 | (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL) |
290 | goto freeit; |
291 | |
292 | /* |
293 | * Reinit pointers derived from mbuf data pointer |
294 | * as things might have moved around with m_pullup |
295 | */ |
296 | oip = mtod(n, struct ip *); |
297 | th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen); |
298 | |
299 | if (th != ((struct tcphdr *)P2ROUNDDOWN(th, |
300 | sizeof(u_int32_t)))) |
301 | goto freeit; |
302 | tcphlen = th->th_off << 2; |
303 | |
304 | /* Sanity checks */ |
305 | if (tcphlen < sizeof(struct tcphdr)) |
306 | goto freeit; |
307 | if (oip->ip_len < (oiphlen + tcphlen)) |
308 | goto freeit; |
309 | if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL) |
310 | goto stdreply; |
311 | if (n->m_len < (oiphlen + tcphlen) && |
312 | (n = m_pullup(n, (oiphlen + tcphlen))) == NULL) |
313 | goto freeit; |
314 | |
315 | /* |
316 | * Reinit pointers derived from mbuf data pointer |
317 | * as things might have moved around with m_pullup |
318 | */ |
319 | oip = mtod(n, struct ip *); |
320 | th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen); |
321 | |
322 | icmpelen = max(tcphlen, min(icmp_datalen, |
323 | (oip->ip_len - oiphlen))); |
324 | } else |
325 | stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen, |
326 | (oip->ip_len - oiphlen))); |
327 | |
328 | icmplen = min(oiphlen + icmpelen, nlen); |
329 | if (icmplen < sizeof(struct ip)) |
330 | goto freeit; |
331 | |
332 | /* |
333 | * First, formulate icmp message |
334 | * Allocate enough space for the IP header, ICMP header |
335 | * and the payload (part of the original message to be sent back). |
336 | */ |
337 | if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen)) |
338 | m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */ |
339 | else |
340 | m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR); |
341 | |
342 | if (m == NULL) |
343 | goto freeit; |
344 | |
345 | #if CONFIG_MACF_NET |
346 | mac_mbuf_label_associate_netlayer(n, m); |
347 | #endif |
348 | /* |
349 | * Further refine the payload length to the space |
350 | * remaining in mbuf after including the IP header and ICMP |
351 | * header. |
352 | */ |
353 | icmplen = min(icmplen, M_TRAILINGSPACE(m) - |
354 | sizeof(struct ip) - ICMP_MINLEN); |
355 | m_align(m, ICMP_MINLEN + icmplen); |
356 | m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */ |
357 | |
358 | icp = mtod(m, struct icmp *); |
359 | icmpstat.icps_outhist[type]++; |
360 | icp->icmp_type = type; |
361 | if (type == ICMP_REDIRECT) |
362 | icp->icmp_gwaddr.s_addr = dest; |
363 | else { |
364 | icp->icmp_void = 0; |
365 | /* |
366 | * The following assignments assume an overlay with the |
367 | * zeroed icmp_void field. |
368 | */ |
369 | if (type == ICMP_PARAMPROB) { |
370 | icp->icmp_pptr = code; |
371 | code = 0; |
372 | } else if (type == ICMP_UNREACH && |
373 | code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) { |
374 | icp->icmp_nextmtu = htons(nextmtu); |
375 | } |
376 | } |
377 | |
378 | icp->icmp_code = code; |
379 | |
380 | /* |
381 | * Copy icmplen worth of content from original |
382 | * mbuf (n) to the new packet after ICMP header. |
383 | */ |
384 | m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip); |
385 | nip = &icp->icmp_ip; |
386 | |
387 | /* |
388 | * Convert fields to network representation. |
389 | */ |
390 | #if BYTE_ORDER != BIG_ENDIAN |
391 | HTONS(nip->ip_len); |
392 | HTONS(nip->ip_off); |
393 | #endif |
394 | /* |
395 | * Set up ICMP message mbuf and copy old IP header (without options |
396 | * in front of ICMP message. |
397 | * If the original mbuf was meant to bypass the firewall, the error |
398 | * reply should bypass as well. |
399 | */ |
400 | m->m_flags |= n->m_flags & M_SKIP_FIREWALL; |
401 | m->m_data -= sizeof(struct ip); |
402 | m->m_len += sizeof(struct ip); |
403 | m->m_pkthdr.len = m->m_len; |
404 | m->m_pkthdr.rcvif = n->m_pkthdr.rcvif; |
405 | nip = mtod(m, struct ip *); |
406 | bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip)); |
407 | nip->ip_len = m->m_len; |
408 | nip->ip_vhl = IP_VHL_BORING; |
409 | nip->ip_p = IPPROTO_ICMP; |
410 | nip->ip_tos = 0; |
411 | nip->ip_off = 0; |
412 | icmp_reflect(m); |
413 | freeit: |
414 | m_freem(n); |
415 | } |
416 | |
417 | /* |
418 | * Process a received ICMP message. |
419 | */ |
420 | void |
421 | icmp_input(struct mbuf *m, int hlen) |
422 | { |
423 | struct sockaddr_in icmpsrc, icmpdst, icmpgw; |
424 | struct icmp *icp; |
425 | struct ip *ip = mtod(m, struct ip *); |
426 | int icmplen; |
427 | int i; |
428 | struct in_ifaddr *ia; |
429 | void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *); |
430 | int code; |
431 | |
432 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
433 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
434 | |
435 | icmplen = ip->ip_len; |
436 | |
437 | /* |
438 | * Locate icmp structure in mbuf, and check |
439 | * that not corrupted and of at least minimum length. |
440 | */ |
441 | #if (DEBUG | DEVELOPMENT) |
442 | if (icmpprintfs > 2) { |
443 | char src_str[MAX_IPv4_STR_LEN]; |
444 | char dst_str[MAX_IPv4_STR_LEN]; |
445 | |
446 | inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str)); |
447 | inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str)); |
448 | printf("%s: from %s to %s, len %d\n" , |
449 | __func__, src_str, dst_str, icmplen); |
450 | } |
451 | #endif |
452 | if (icmplen < ICMP_MINLEN) { |
453 | icmpstat.icps_tooshort++; |
454 | goto freeit; |
455 | } |
456 | i = hlen + min(icmplen, ICMP_ADVLENMIN); |
457 | if (m->m_len < i && (m = m_pullup(m, i)) == 0) { |
458 | icmpstat.icps_tooshort++; |
459 | return; |
460 | } |
461 | ip = mtod(m, struct ip *); |
462 | m->m_len -= hlen; |
463 | m->m_data += hlen; |
464 | icp = mtod(m, struct icmp *); |
465 | if (in_cksum(m, icmplen)) { |
466 | icmpstat.icps_checksum++; |
467 | goto freeit; |
468 | } |
469 | m->m_len += hlen; |
470 | m->m_data -= hlen; |
471 | |
472 | #if (DEBUG | DEVELOPMENT) |
473 | if (icmpprintfs > 2) |
474 | printf("icmp_input, type %d code %d\n" , icp->icmp_type, |
475 | icp->icmp_code); |
476 | #endif |
477 | |
478 | /* |
479 | * Message type specific processing. |
480 | */ |
481 | if (icp->icmp_type > ICMP_MAXTYPE) |
482 | goto raw; |
483 | |
484 | /* Initialize */ |
485 | bzero(&icmpsrc, sizeof (icmpsrc)); |
486 | icmpsrc.sin_len = sizeof (struct sockaddr_in); |
487 | icmpsrc.sin_family = AF_INET; |
488 | bzero(&icmpdst, sizeof (icmpdst)); |
489 | icmpdst.sin_len = sizeof (struct sockaddr_in); |
490 | icmpdst.sin_family = AF_INET; |
491 | bzero(&icmpgw, sizeof (icmpgw)); |
492 | icmpgw.sin_len = sizeof (struct sockaddr_in); |
493 | icmpgw.sin_family = AF_INET; |
494 | |
495 | icmpstat.icps_inhist[icp->icmp_type]++; |
496 | code = icp->icmp_code; |
497 | switch (icp->icmp_type) { |
498 | |
499 | case ICMP_UNREACH: |
500 | switch (code) { |
501 | case ICMP_UNREACH_NET: |
502 | case ICMP_UNREACH_HOST: |
503 | case ICMP_UNREACH_SRCFAIL: |
504 | case ICMP_UNREACH_NET_UNKNOWN: |
505 | case ICMP_UNREACH_HOST_UNKNOWN: |
506 | case ICMP_UNREACH_ISOLATED: |
507 | case ICMP_UNREACH_TOSNET: |
508 | case ICMP_UNREACH_TOSHOST: |
509 | case ICMP_UNREACH_HOST_PRECEDENCE: |
510 | case ICMP_UNREACH_PRECEDENCE_CUTOFF: |
511 | code = PRC_UNREACH_NET; |
512 | break; |
513 | |
514 | case ICMP_UNREACH_NEEDFRAG: |
515 | code = PRC_MSGSIZE; |
516 | break; |
517 | |
518 | /* |
519 | * RFC 1122, Sections 3.2.2.1 and 4.2.3.9. |
520 | * Treat subcodes 2,3 as immediate RST |
521 | */ |
522 | case ICMP_UNREACH_PROTOCOL: |
523 | case ICMP_UNREACH_PORT: |
524 | code = PRC_UNREACH_PORT; |
525 | break; |
526 | |
527 | case ICMP_UNREACH_NET_PROHIB: |
528 | case ICMP_UNREACH_HOST_PROHIB: |
529 | case ICMP_UNREACH_FILTER_PROHIB: |
530 | code = PRC_UNREACH_ADMIN_PROHIB; |
531 | break; |
532 | |
533 | default: |
534 | goto badcode; |
535 | } |
536 | goto deliver; |
537 | |
538 | case ICMP_TIMXCEED: |
539 | if (code > 1) |
540 | goto badcode; |
541 | code += PRC_TIMXCEED_INTRANS; |
542 | goto deliver; |
543 | |
544 | case ICMP_PARAMPROB: |
545 | if (code > 1) |
546 | goto badcode; |
547 | code = PRC_PARAMPROB; |
548 | goto deliver; |
549 | |
550 | case ICMP_SOURCEQUENCH: |
551 | if (code) |
552 | goto badcode; |
553 | code = PRC_QUENCH; |
554 | deliver: |
555 | /* |
556 | * Problem with datagram; advise higher level routines. |
557 | */ |
558 | if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) |
559 | || IP_VHL_HL(icp->icmp_ip.ip_vhl) < |
560 | (sizeof(struct ip) >> 2)) { |
561 | icmpstat.icps_badlen++; |
562 | goto freeit; |
563 | } |
564 | |
565 | #if BYTE_ORDER != BIG_ENDIAN |
566 | NTOHS(icp->icmp_ip.ip_len); |
567 | #endif |
568 | |
569 | /* Discard ICMP's in response to multicast packets */ |
570 | if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr))) |
571 | goto badcode; |
572 | #if (DEBUG | DEVELOPMENT) |
573 | if (icmpprintfs > 2) |
574 | printf("deliver to protocol %d\n" , |
575 | icp->icmp_ip.ip_p); |
576 | #endif |
577 | icmpsrc.sin_addr = icp->icmp_ip.ip_dst; |
578 | |
579 | /* |
580 | * if the packet contains [IPv4 AH TCP], we can't make a |
581 | * notification to TCP layer. |
582 | */ |
583 | ctlfunc = ip_protox[icp->icmp_ip.ip_p]->pr_ctlinput; |
584 | |
585 | if (ctlfunc) { |
586 | LCK_MTX_ASSERT(inet_domain_mutex, LCK_MTX_ASSERT_OWNED); |
587 | |
588 | lck_mtx_unlock(inet_domain_mutex); |
589 | |
590 | (*ctlfunc)(code, (struct sockaddr *)&icmpsrc, |
591 | (void *)&icp->icmp_ip, m->m_pkthdr.rcvif); |
592 | |
593 | lck_mtx_lock(inet_domain_mutex); |
594 | } |
595 | break; |
596 | |
597 | badcode: |
598 | icmpstat.icps_badcode++; |
599 | break; |
600 | |
601 | case ICMP_ECHO: |
602 | if ((m->m_flags & (M_MCAST | M_BCAST))) { |
603 | if (icmpbmcastecho == 0) { |
604 | icmpstat.icps_bmcastecho++; |
605 | break; |
606 | } |
607 | } |
608 | |
609 | /* |
610 | * rdar://18644769 |
611 | * Do not reply when the destination is link local multicast or broadcast |
612 | * and the source is not from a directly connected subnet |
613 | */ |
614 | if ((IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr)) || |
615 | in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) && |
616 | in_localaddr(ip->ip_src) == 0) { |
617 | icmpstat.icps_bmcastecho++; |
618 | #if (DEBUG | DEVELOPMENT) |
619 | if (icmpprintfs > 0) { |
620 | char src_str[MAX_IPv4_STR_LEN]; |
621 | char dst_str[MAX_IPv4_STR_LEN]; |
622 | |
623 | inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str)); |
624 | inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str)); |
625 | printf("%s: non local (B|M)CAST %s to %s, len %d\n" , |
626 | __func__, src_str, dst_str, icmplen); |
627 | } |
628 | #endif |
629 | break; |
630 | } |
631 | |
632 | icp->icmp_type = ICMP_ECHOREPLY; |
633 | #if ICMP_BANDLIM |
634 | if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0) |
635 | goto freeit; |
636 | else |
637 | #endif |
638 | goto reflect; |
639 | |
640 | case ICMP_TSTAMP: |
641 | if (icmptimestamp == 0) |
642 | break; |
643 | |
644 | if (!icmpbmcastecho |
645 | && (m->m_flags & (M_MCAST | M_BCAST)) != 0) { |
646 | icmpstat.icps_bmcasttstamp++; |
647 | break; |
648 | } |
649 | if (icmplen < ICMP_TSLEN) { |
650 | icmpstat.icps_badlen++; |
651 | break; |
652 | } |
653 | icp->icmp_type = ICMP_TSTAMPREPLY; |
654 | icp->icmp_rtime = iptime(); |
655 | icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */ |
656 | #if ICMP_BANDLIM |
657 | if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0) |
658 | goto freeit; |
659 | else |
660 | #endif |
661 | goto reflect; |
662 | |
663 | case ICMP_MASKREQ: |
664 | if (icmpmaskrepl == 0) |
665 | break; |
666 | /* |
667 | * We are not able to respond with all ones broadcast |
668 | * unless we receive it over a point-to-point interface. |
669 | */ |
670 | if (icmplen < ICMP_MASKLEN) |
671 | break; |
672 | switch (ip->ip_dst.s_addr) { |
673 | |
674 | case INADDR_BROADCAST: |
675 | case INADDR_ANY: |
676 | icmpdst.sin_addr = ip->ip_src; |
677 | break; |
678 | |
679 | default: |
680 | icmpdst.sin_addr = ip->ip_dst; |
681 | } |
682 | ia = (struct in_ifaddr *)ifaof_ifpforaddr( |
683 | (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif); |
684 | if (ia == 0) |
685 | break; |
686 | IFA_LOCK(&ia->ia_ifa); |
687 | if (ia->ia_ifp == 0) { |
688 | IFA_UNLOCK(&ia->ia_ifa); |
689 | IFA_REMREF(&ia->ia_ifa); |
690 | ia = NULL; |
691 | break; |
692 | } |
693 | icp->icmp_type = ICMP_MASKREPLY; |
694 | icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr; |
695 | if (ip->ip_src.s_addr == 0) { |
696 | if (ia->ia_ifp->if_flags & IFF_BROADCAST) |
697 | ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr; |
698 | else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) |
699 | ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr; |
700 | } |
701 | IFA_UNLOCK(&ia->ia_ifa); |
702 | IFA_REMREF(&ia->ia_ifa); |
703 | reflect: |
704 | ip->ip_len += hlen; /* since ip_input deducts this */ |
705 | icmpstat.icps_reflect++; |
706 | icmpstat.icps_outhist[icp->icmp_type]++; |
707 | icmp_reflect(m); |
708 | return; |
709 | |
710 | case ICMP_REDIRECT: |
711 | if (log_redirect) { |
712 | u_int32_t src, dst, gw; |
713 | |
714 | src = ntohl(ip->ip_src.s_addr); |
715 | dst = ntohl(icp->icmp_ip.ip_dst.s_addr); |
716 | gw = ntohl(icp->icmp_gwaddr.s_addr); |
717 | printf("icmp redirect from %d.%d.%d.%d: " |
718 | "%d.%d.%d.%d => %d.%d.%d.%d\n" , |
719 | (int)(src >> 24), (int)((src >> 16) & 0xff), |
720 | (int)((src >> 8) & 0xff), (int)(src & 0xff), |
721 | (int)(dst >> 24), (int)((dst >> 16) & 0xff), |
722 | (int)((dst >> 8) & 0xff), (int)(dst & 0xff), |
723 | (int)(gw >> 24), (int)((gw >> 16) & 0xff), |
724 | (int)((gw >> 8) & 0xff), (int)(gw & 0xff)); |
725 | } |
726 | if (drop_redirect) |
727 | break; |
728 | if (code > 3) |
729 | goto badcode; |
730 | if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) || |
731 | IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) { |
732 | icmpstat.icps_badlen++; |
733 | break; |
734 | } |
735 | /* |
736 | * Short circuit routing redirects to force |
737 | * immediate change in the kernel's routing |
738 | * tables. The message is also handed to anyone |
739 | * listening on a raw socket (e.g. the routing |
740 | * daemon for use in updating its tables). |
741 | */ |
742 | icmpgw.sin_addr = ip->ip_src; |
743 | icmpdst.sin_addr = icp->icmp_gwaddr; |
744 | #if (DEBUG | DEVELOPMENT) |
745 | if (icmpprintfs > 0) { |
746 | char dst_str[MAX_IPv4_STR_LEN]; |
747 | char gw_str[MAX_IPv4_STR_LEN]; |
748 | |
749 | inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str)); |
750 | inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str)); |
751 | printf("%s: redirect dst %s to %s\n" , __func__, dst_str, gw_str); |
752 | } |
753 | #endif |
754 | icmpsrc.sin_addr = icp->icmp_ip.ip_dst; |
755 | rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc, |
756 | (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST, |
757 | (struct sockaddr *)&icmpgw, NULL); |
758 | pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc); |
759 | #if IPSEC |
760 | key_sa_routechange((struct sockaddr *)&icmpsrc); |
761 | #endif |
762 | break; |
763 | |
764 | /* |
765 | * No kernel processing for the following; |
766 | * just fall through to send to raw listener. |
767 | */ |
768 | case ICMP_ECHOREPLY: |
769 | case ICMP_ROUTERADVERT: |
770 | case ICMP_ROUTERSOLICIT: |
771 | case ICMP_TSTAMPREPLY: |
772 | case ICMP_IREQREPLY: |
773 | case ICMP_MASKREPLY: |
774 | default: |
775 | break; |
776 | } |
777 | |
778 | raw: |
779 | rip_input(m, hlen); |
780 | return; |
781 | |
782 | freeit: |
783 | m_freem(m); |
784 | } |
785 | |
786 | /* |
787 | * Reflect the ip packet back to the source |
788 | */ |
789 | static void |
790 | icmp_reflect(struct mbuf *m) |
791 | { |
792 | struct ip *ip = mtod(m, struct ip *); |
793 | struct sockaddr_in icmpdst; |
794 | struct in_ifaddr *ia; |
795 | struct in_addr t; |
796 | struct mbuf *opts = NULL; |
797 | int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip); |
798 | |
799 | if (!in_canforward(ip->ip_src) && |
800 | ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) != |
801 | (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) { |
802 | m_freem(m); /* Bad return address */ |
803 | goto done; /* Ip_output() will check for broadcast */ |
804 | } |
805 | t = ip->ip_dst; |
806 | ip->ip_dst = ip->ip_src; |
807 | /* |
808 | * If the incoming packet was addressed directly to us, |
809 | * use dst as the src for the reply. Otherwise (broadcast |
810 | * or anonymous), use the address which corresponds |
811 | * to the incoming interface. |
812 | */ |
813 | lck_rw_lock_shared(in_ifaddr_rwlock); |
814 | TAILQ_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) { |
815 | IFA_LOCK(&ia->ia_ifa); |
816 | if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) { |
817 | IFA_ADDREF_LOCKED(&ia->ia_ifa); |
818 | IFA_UNLOCK(&ia->ia_ifa); |
819 | goto match; |
820 | } |
821 | IFA_UNLOCK(&ia->ia_ifa); |
822 | } |
823 | /* |
824 | * Slow path; check for broadcast addresses. Find a source |
825 | * IP address to use when replying to the broadcast request; |
826 | * let IP handle the source interface selection work. |
827 | */ |
828 | for (ia = in_ifaddrhead.tqh_first; ia; ia = ia->ia_link.tqe_next) { |
829 | IFA_LOCK(&ia->ia_ifa); |
830 | if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) && |
831 | t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) { |
832 | IFA_ADDREF_LOCKED(&ia->ia_ifa); |
833 | IFA_UNLOCK(&ia->ia_ifa); |
834 | break; |
835 | } |
836 | IFA_UNLOCK(&ia->ia_ifa); |
837 | } |
838 | match: |
839 | lck_rw_done(in_ifaddr_rwlock); |
840 | |
841 | /* Initialize */ |
842 | bzero(&icmpdst, sizeof (icmpdst)); |
843 | icmpdst.sin_len = sizeof (struct sockaddr_in); |
844 | icmpdst.sin_family = AF_INET; |
845 | icmpdst.sin_addr = t; |
846 | if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif) |
847 | ia = (struct in_ifaddr *)ifaof_ifpforaddr( |
848 | (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif); |
849 | /* |
850 | * The following happens if the packet was not addressed to us, |
851 | * and was received on an interface with no IP address. |
852 | */ |
853 | if (ia == (struct in_ifaddr *)0) { |
854 | lck_rw_lock_shared(in_ifaddr_rwlock); |
855 | ia = in_ifaddrhead.tqh_first; |
856 | if (ia == (struct in_ifaddr *)0) {/* no address yet, bail out */ |
857 | lck_rw_done(in_ifaddr_rwlock); |
858 | m_freem(m); |
859 | goto done; |
860 | } |
861 | IFA_ADDREF(&ia->ia_ifa); |
862 | lck_rw_done(in_ifaddr_rwlock); |
863 | } |
864 | #if CONFIG_MACF_NET |
865 | mac_netinet_icmp_reply(m); |
866 | #endif |
867 | IFA_LOCK_SPIN(&ia->ia_ifa); |
868 | t = IA_SIN(ia)->sin_addr; |
869 | IFA_UNLOCK(&ia->ia_ifa); |
870 | ip->ip_src = t; |
871 | ip->ip_ttl = ip_defttl; |
872 | IFA_REMREF(&ia->ia_ifa); |
873 | ia = NULL; |
874 | |
875 | if (optlen > 0) { |
876 | u_char *cp; |
877 | int opt, cnt; |
878 | u_int len; |
879 | |
880 | /* |
881 | * Retrieve any source routing from the incoming packet; |
882 | * add on any record-route or timestamp options. |
883 | */ |
884 | cp = (u_char *) (ip + 1); |
885 | if ((opts = ip_srcroute()) == 0 && |
886 | (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */ |
887 | opts->m_len = sizeof(struct in_addr); |
888 | mtod(opts, struct in_addr *)->s_addr = 0; |
889 | } |
890 | if (opts) { |
891 | #if (DEBUG | DEVELOPMENT) |
892 | if (icmpprintfs > 1) |
893 | printf("icmp_reflect optlen %d rt %d => " , |
894 | optlen, opts->m_len); |
895 | #endif |
896 | for (cnt = optlen; cnt > 0; cnt -= len, cp += len) { |
897 | opt = cp[IPOPT_OPTVAL]; |
898 | if (opt == IPOPT_EOL) |
899 | break; |
900 | if (opt == IPOPT_NOP) |
901 | len = 1; |
902 | else { |
903 | if (cnt < IPOPT_OLEN + sizeof(*cp)) |
904 | break; |
905 | len = cp[IPOPT_OLEN]; |
906 | if (len < IPOPT_OLEN + sizeof(*cp) || |
907 | len > cnt) |
908 | break; |
909 | } |
910 | /* |
911 | * Should check for overflow, but it "can't happen" |
912 | */ |
913 | if (opt == IPOPT_RR || opt == IPOPT_TS || |
914 | opt == IPOPT_SECURITY) { |
915 | bcopy((caddr_t)cp, |
916 | mtod(opts, caddr_t) + opts->m_len, len); |
917 | opts->m_len += len; |
918 | } |
919 | } |
920 | /* Terminate & pad, if necessary */ |
921 | cnt = opts->m_len % 4; |
922 | if (cnt) { |
923 | for (; cnt < 4; cnt++) { |
924 | *(mtod(opts, caddr_t) + opts->m_len) = |
925 | IPOPT_EOL; |
926 | opts->m_len++; |
927 | } |
928 | } |
929 | #if (DEBUG | DEVELOPMENT) |
930 | if (icmpprintfs > 1) |
931 | printf("%d\n" , opts->m_len); |
932 | #endif |
933 | } |
934 | /* |
935 | * Now strip out original options by copying rest of first |
936 | * mbuf's data back, and adjust the IP length. |
937 | */ |
938 | ip->ip_len -= optlen; |
939 | ip->ip_vhl = IP_VHL_BORING; |
940 | m->m_len -= optlen; |
941 | if (m->m_flags & M_PKTHDR) |
942 | m->m_pkthdr.len -= optlen; |
943 | optlen += sizeof(struct ip); |
944 | bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1), |
945 | (unsigned)(m->m_len - sizeof(struct ip))); |
946 | } |
947 | m->m_flags &= ~(M_BCAST|M_MCAST); |
948 | icmp_send(m, opts); |
949 | done: |
950 | if (opts) |
951 | (void)m_free(opts); |
952 | } |
953 | |
954 | /* |
955 | * Send an icmp packet back to the ip level, |
956 | * after supplying a checksum. |
957 | */ |
958 | static void |
959 | icmp_send(struct mbuf *m, struct mbuf *opts) |
960 | { |
961 | struct ip *ip = mtod(m, struct ip *); |
962 | int hlen; |
963 | struct icmp *icp; |
964 | struct route ro; |
965 | struct ip_out_args ipoa; |
966 | |
967 | bzero(&ipoa, sizeof(ipoa)); |
968 | ipoa.ipoa_boundif = IFSCOPE_NONE; |
969 | ipoa.ipoa_flags = IPOAF_SELECT_SRCIF | IPOAF_BOUND_SRCADDR; |
970 | ipoa.ipoa_sotc = SO_TC_UNSPEC; |
971 | ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC; |
972 | |
973 | if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) { |
974 | ipoa.ipoa_boundif = m->m_pkthdr.rcvif->if_index; |
975 | ipoa.ipoa_flags |= IPOAF_BOUND_IF; |
976 | } |
977 | |
978 | hlen = IP_VHL_HL(ip->ip_vhl) << 2; |
979 | m->m_data += hlen; |
980 | m->m_len -= hlen; |
981 | icp = mtod(m, struct icmp *); |
982 | icp->icmp_cksum = 0; |
983 | icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen); |
984 | m->m_data -= hlen; |
985 | m->m_len += hlen; |
986 | m->m_pkthdr.rcvif = NULL; |
987 | m->m_pkthdr.csum_data = 0; |
988 | m->m_pkthdr.csum_flags = 0; |
989 | #if (DEBUG | DEVELOPMENT) |
990 | if (icmpprintfs > 2) { |
991 | char src_str[MAX_IPv4_STR_LEN]; |
992 | char dst_str[MAX_IPv4_STR_LEN]; |
993 | |
994 | inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str)); |
995 | inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str)); |
996 | printf("%s: dst %s src %s\n" , __func__, dst_str, src_str); |
997 | } |
998 | #endif |
999 | bzero(&ro, sizeof ro); |
1000 | (void) ip_output(m, opts, &ro, IP_OUTARGS, NULL, &ipoa); |
1001 | ROUTE_RELEASE(&ro); |
1002 | } |
1003 | |
1004 | u_int32_t |
1005 | iptime(void) |
1006 | { |
1007 | struct timeval atv; |
1008 | u_int32_t t; |
1009 | |
1010 | getmicrotime(&atv); |
1011 | t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000; |
1012 | return (htonl(t)); |
1013 | } |
1014 | |
1015 | #if 1 |
1016 | /* |
1017 | * Return the next larger or smaller MTU plateau (table from RFC 1191) |
1018 | * given current value MTU. If DIR is less than zero, a larger plateau |
1019 | * is returned; otherwise, a smaller value is returned. |
1020 | */ |
1021 | int |
1022 | ip_next_mtu(int mtu, int dir) |
1023 | { |
1024 | static int mtutab[] = { |
1025 | 65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296, |
1026 | 68, 0 |
1027 | }; |
1028 | int i; |
1029 | |
1030 | for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) { |
1031 | if (mtu >= mtutab[i]) |
1032 | break; |
1033 | } |
1034 | |
1035 | if (dir < 0) { |
1036 | if (i == 0) { |
1037 | return 0; |
1038 | } else { |
1039 | return mtutab[i - 1]; |
1040 | } |
1041 | } else { |
1042 | if (mtutab[i] == 0) { |
1043 | return 0; |
1044 | } else if(mtu > mtutab[i]) { |
1045 | return mtutab[i]; |
1046 | } else { |
1047 | return mtutab[i + 1]; |
1048 | } |
1049 | } |
1050 | } |
1051 | #endif |
1052 | |
1053 | #if ICMP_BANDLIM |
1054 | |
1055 | /* |
1056 | * badport_bandlim() - check for ICMP bandwidth limit |
1057 | * |
1058 | * Return 0 if it is ok to send an ICMP error response, -1 if we have |
1059 | * hit our bandwidth limit and it is not ok. |
1060 | * |
1061 | * If icmplim is <= 0, the feature is disabled and 0 is returned. |
1062 | * |
1063 | * For now we separate the TCP and UDP subsystems w/ different 'which' |
1064 | * values. We may eventually remove this separation (and simplify the |
1065 | * code further). |
1066 | * |
1067 | * Note that the printing of the error message is delayed so we can |
1068 | * properly print the icmp error rate that the system was trying to do |
1069 | * (i.e. 22000/100 pps, etc...). This can cause long delays in printing |
1070 | * the 'final' error, but it doesn't make sense to solve the printing |
1071 | * delay with more complex code. |
1072 | */ |
1073 | |
1074 | int |
1075 | badport_bandlim(int which) |
1076 | { |
1077 | static uint64_t lticks[BANDLIM_MAX + 1]; |
1078 | static int lpackets[BANDLIM_MAX + 1]; |
1079 | uint64_t time = net_uptime(); |
1080 | int secs; |
1081 | |
1082 | const char *bandlimittype[] = { |
1083 | "Limiting icmp unreach response" , |
1084 | "Limiting icmp ping response" , |
1085 | "Limiting icmp tstamp response" , |
1086 | "Limiting closed port RST response" , |
1087 | "Limiting open port RST response" |
1088 | }; |
1089 | |
1090 | /* |
1091 | * Return ok status if feature disabled or argument out of |
1092 | * ranage. |
1093 | */ |
1094 | |
1095 | if (icmplim <= 0 || which > BANDLIM_MAX || which < 0) |
1096 | return(0); |
1097 | |
1098 | secs = time - lticks[which]; |
1099 | |
1100 | /* |
1101 | * reset stats when cumulative delta exceeds one second. |
1102 | */ |
1103 | |
1104 | if (secs > 1) { |
1105 | if (lpackets[which] > icmplim) { |
1106 | printf("%s from %d to %d packets per second\n" , |
1107 | bandlimittype[which], |
1108 | lpackets[which], |
1109 | icmplim |
1110 | ); |
1111 | } |
1112 | lticks[which] = time; |
1113 | lpackets[which] = 0; |
1114 | } |
1115 | |
1116 | /* |
1117 | * bump packet count |
1118 | */ |
1119 | |
1120 | if (++lpackets[which] > icmplim) { |
1121 | return(-1); |
1122 | } |
1123 | return(0); |
1124 | } |
1125 | |
1126 | #endif |
1127 | |
1128 | #if __APPLE__ |
1129 | |
1130 | /* |
1131 | * Non-privileged ICMP socket operations |
1132 | * - send ICMP echo request |
1133 | * - all ICMP |
1134 | * - limited socket options |
1135 | */ |
1136 | |
1137 | #include <netinet/ip_icmp.h> |
1138 | #include <netinet/in_pcb.h> |
1139 | |
1140 | extern u_int32_t rip_sendspace; |
1141 | extern u_int32_t rip_recvspace; |
1142 | extern struct inpcbinfo ripcbinfo; |
1143 | |
1144 | int rip_abort(struct socket *); |
1145 | int rip_bind(struct socket *, struct sockaddr *, struct proc *); |
1146 | int rip_connect(struct socket *, struct sockaddr *, struct proc *); |
1147 | int rip_detach(struct socket *); |
1148 | int rip_disconnect(struct socket *); |
1149 | int rip_shutdown(struct socket *); |
1150 | |
1151 | __private_extern__ int icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, struct mbuf *control, struct proc *p); |
1152 | __private_extern__ int icmp_dgram_attach(struct socket *so, int proto, struct proc *p); |
1153 | __private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt); |
1154 | |
1155 | __private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = { |
1156 | .pru_abort = rip_abort, |
1157 | .pru_attach = icmp_dgram_attach, |
1158 | .pru_bind = rip_bind, |
1159 | .pru_connect = rip_connect, |
1160 | .pru_control = in_control, |
1161 | .pru_detach = rip_detach, |
1162 | .pru_disconnect = rip_disconnect, |
1163 | .pru_peeraddr = in_getpeeraddr, |
1164 | .pru_send = icmp_dgram_send, |
1165 | .pru_shutdown = rip_shutdown, |
1166 | .pru_sockaddr = in_getsockaddr, |
1167 | .pru_sosend = sosend, |
1168 | .pru_soreceive = soreceive, |
1169 | }; |
1170 | |
1171 | /* Like rip_attach but without root privilege enforcement */ |
1172 | __private_extern__ int |
1173 | icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p) |
1174 | { |
1175 | struct inpcb *inp; |
1176 | int error; |
1177 | |
1178 | inp = sotoinpcb(so); |
1179 | if (inp) |
1180 | panic("icmp_dgram_attach" ); |
1181 | |
1182 | error = soreserve(so, rip_sendspace, rip_recvspace); |
1183 | if (error) |
1184 | return error; |
1185 | error = in_pcballoc(so, &ripcbinfo, p); |
1186 | if (error) |
1187 | return error; |
1188 | inp = (struct inpcb *)so->so_pcb; |
1189 | inp->inp_vflag |= INP_IPV4; |
1190 | inp->inp_ip_p = IPPROTO_ICMP; |
1191 | inp->inp_ip_ttl = ip_defttl; |
1192 | return 0; |
1193 | } |
1194 | |
1195 | /* |
1196 | * Raw IP socket option processing. |
1197 | */ |
1198 | __private_extern__ int |
1199 | icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt) |
1200 | { |
1201 | int error; |
1202 | |
1203 | if (sopt->sopt_level != IPPROTO_IP) |
1204 | return (EINVAL); |
1205 | |
1206 | switch (sopt->sopt_name) { |
1207 | case IP_OPTIONS: |
1208 | case IP_HDRINCL: |
1209 | case IP_TOS: |
1210 | case IP_TTL: |
1211 | case IP_RECVOPTS: |
1212 | case IP_RECVRETOPTS: |
1213 | case IP_RECVDSTADDR: |
1214 | case IP_RETOPTS: |
1215 | case IP_MULTICAST_IF: |
1216 | case IP_MULTICAST_IFINDEX: |
1217 | case IP_MULTICAST_TTL: |
1218 | case IP_MULTICAST_LOOP: |
1219 | case IP_ADD_MEMBERSHIP: |
1220 | case IP_DROP_MEMBERSHIP: |
1221 | case IP_MULTICAST_VIF: |
1222 | case IP_PORTRANGE: |
1223 | case IP_RECVIF: |
1224 | case IP_IPSEC_POLICY: |
1225 | case IP_STRIPHDR: |
1226 | case IP_RECVTTL: |
1227 | case IP_BOUND_IF: |
1228 | case IP_NO_IFT_CELLULAR: |
1229 | error = rip_ctloutput(so, sopt); |
1230 | break; |
1231 | |
1232 | default: |
1233 | error = EINVAL; |
1234 | break; |
1235 | } |
1236 | |
1237 | return (error); |
1238 | } |
1239 | |
1240 | __private_extern__ int |
1241 | icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, |
1242 | struct sockaddr *nam, struct mbuf *control, struct proc *p) |
1243 | { |
1244 | struct ip *ip; |
1245 | struct inpcb *inp = sotoinpcb(so); |
1246 | int hlen; |
1247 | struct icmp *icp; |
1248 | struct in_ifaddr *ia = NULL; |
1249 | int icmplen; |
1250 | int error = EINVAL; |
1251 | |
1252 | if (inp == NULL |
1253 | #if NECP |
1254 | || (necp_socket_should_use_flow_divert(inp)) |
1255 | #endif /* NECP */ |
1256 | ) { |
1257 | if (inp != NULL) |
1258 | error = EPROTOTYPE; |
1259 | goto bad; |
1260 | } |
1261 | |
1262 | if ((inp->inp_flags & INP_HDRINCL) != 0) { |
1263 | /* Expect 32-bit aligned data ptr on strict-align platforms */ |
1264 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
1265 | /* |
1266 | * This is not raw IP, we liberal only for fields TOS, |
1267 | * id and TTL. |
1268 | */ |
1269 | ip = mtod(m, struct ip *); |
1270 | |
1271 | hlen = IP_VHL_HL(ip->ip_vhl) << 2; |
1272 | /* Some sanity checks */ |
1273 | if (m->m_pkthdr.len < hlen + ICMP_MINLEN) { |
1274 | goto bad; |
1275 | } |
1276 | /* Only IPv4 */ |
1277 | if (IP_VHL_V(ip->ip_vhl) != 4) |
1278 | goto bad; |
1279 | if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len) |
1280 | goto bad; |
1281 | /* Bogus fragments can tie up peer resources */ |
1282 | if ((ip->ip_off & ~IP_DF) != 0) |
1283 | goto bad; |
1284 | /* Allow only ICMP even for user provided IP header */ |
1285 | if (ip->ip_p != IPPROTO_ICMP) |
1286 | goto bad; |
1287 | /* |
1288 | * To prevent spoofing, specified source address must |
1289 | * be one of ours. |
1290 | */ |
1291 | if (ip->ip_src.s_addr != INADDR_ANY) { |
1292 | socket_unlock(so, 0); |
1293 | lck_rw_lock_shared(in_ifaddr_rwlock); |
1294 | if (TAILQ_EMPTY(&in_ifaddrhead)) { |
1295 | lck_rw_done(in_ifaddr_rwlock); |
1296 | socket_lock(so, 0); |
1297 | goto bad; |
1298 | } |
1299 | TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr), |
1300 | ia_hash) { |
1301 | IFA_LOCK(&ia->ia_ifa); |
1302 | if (IA_SIN(ia)->sin_addr.s_addr == |
1303 | ip->ip_src.s_addr) { |
1304 | IFA_UNLOCK(&ia->ia_ifa); |
1305 | lck_rw_done(in_ifaddr_rwlock); |
1306 | socket_lock(so, 0); |
1307 | goto ours; |
1308 | } |
1309 | IFA_UNLOCK(&ia->ia_ifa); |
1310 | } |
1311 | lck_rw_done(in_ifaddr_rwlock); |
1312 | socket_lock(so, 0); |
1313 | goto bad; |
1314 | } |
1315 | ours: |
1316 | /* Do not trust we got a valid checksum */ |
1317 | ip->ip_sum = 0; |
1318 | |
1319 | icp = (struct icmp *)(void *)(((char *)m->m_data) + hlen); |
1320 | icmplen = m->m_pkthdr.len - hlen; |
1321 | } else { |
1322 | if ((icmplen = m->m_pkthdr.len) < ICMP_MINLEN) { |
1323 | goto bad; |
1324 | } |
1325 | icp = mtod(m, struct icmp *); |
1326 | } |
1327 | /* |
1328 | * Allow only to send request types with code 0 |
1329 | */ |
1330 | if (icp->icmp_code != 0) |
1331 | goto bad; |
1332 | switch (icp->icmp_type) { |
1333 | case ICMP_ECHO: |
1334 | break; |
1335 | case ICMP_TSTAMP: |
1336 | if (icmplen != 20) |
1337 | goto bad; |
1338 | break; |
1339 | case ICMP_MASKREQ: |
1340 | if (icmplen != 12) |
1341 | goto bad; |
1342 | break; |
1343 | default: |
1344 | goto bad; |
1345 | } |
1346 | return (rip_send(so, flags, m, nam, control, p)); |
1347 | bad: |
1348 | VERIFY(error != 0); |
1349 | |
1350 | if (m != NULL) |
1351 | m_freem(m); |
1352 | if (control != NULL) |
1353 | m_freem(control); |
1354 | |
1355 | return (error); |
1356 | } |
1357 | |
1358 | #endif /* __APPLE__ */ |
1359 | |