/*
- * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
*
* @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
*/
+/*
+ * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
+ * support for mandatory and extensible security protections. This notice
+ * is included in support of clause 2.2 (b) of the Apple Public License,
+ * Version 2.0.
+ */
#include <sys/param.h>
#include <sys/systm.h>
*/
#ifndef M_SKIP_FIREWALL
#define M_SKIP_FIREWALL 0x4000
-#endif
+#endif
+
+#if CONFIG_MACF_NET
+#include <security/mac_framework.h>
+#endif /* MAC_NET */
/*
* ICMP routines: error generation, receive packet processing, and
n_long dest,
struct ifnet *destifp)
{
- register struct ip *oip = mtod(n, struct ip *), *nip;
- register unsigned oiplen = IP_VHL_HL(oip->ip_vhl) << 2;
- register struct icmp *icp;
- register struct mbuf *m;
+ struct ip *oip = mtod(n, struct ip *), *nip;
+ unsigned oiplen = IP_VHL_HL(oip->ip_vhl) << 2;
+ struct icmp *icp;
+ struct mbuf *m;
unsigned icmplen;
#if ICMPPRINTFS
/*
* First, formulate icmp message
*/
- m = m_gethdr(M_DONTWAIT, MT_HEADER);
+ m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */
if (m == NULL)
goto freeit;
- if (n->m_flags & M_SKIP_FIREWALL) {
+ if (n->m_flags & M_SKIP_FIREWALL) {
/* set M_SKIP_FIREWALL to skip firewall check, since we're called from firewall */
m->m_flags |= M_SKIP_FIREWALL;
}
+#if CONFIG_MACF_NET
+ mac_mbuf_label_associate_netlayer(n, m);
+#endif
icmplen = min(oiplen + 8, oip->ip_len);
if (icmplen < sizeof(struct ip)) {
printf("icmp_error: bad length\n");
m->m_len += sizeof(struct ip);
m->m_pkthdr.len = m->m_len;
m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
- m->m_pkthdr.aux = NULL; /* for IPsec */
nip = mtod(m, struct ip *);
bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
nip->ip_len = m->m_len;
m_freem(n);
}
-static struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET };
-static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET };
-static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET };
+static struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET,
+ 0 , { 0 }, { 0,0,0,0,0,0,0,0 } };
+static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET,
+ 0 , { 0 }, { 0,0,0,0,0,0,0,0 } };
+static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET,
+ 0 , { 0 }, { 0,0,0,0,0,0,0,0 } };
/*
* Process a received ICMP message.
*/
void
-icmp_input(m, hlen)
- register struct mbuf *m;
- int hlen;
+icmp_input(struct mbuf *m, int hlen)
{
- register struct icmp *icp;
- register struct ip *ip = mtod(m, struct ip *);
+ struct icmp *icp;
+ struct ip *ip = mtod(m, struct ip *);
int icmplen = ip->ip_len;
- register int i;
+ int i;
struct in_ifaddr *ia;
void (*ctlfunc)(int, struct sockaddr *, void *);
int code;
- char ipv4str[MAX_IPv4_STR_LEN];
/*
* Locate icmp structure in mbuf, and check
#if ICMPPRINTFS
if (icmpprintfs) {
char buf[MAX_IPv4_STR_LEN];
+ char ipv4str[MAX_IPv4_STR_LEN];
printf("icmp_input from %s to %s, len %d\n",
inet_ntop(AF_INET, &ip->ip_src, buf, sizeof(buf)),
break;
if (ia->ia_ifp == 0) {
ifafree(&ia->ia_ifa);
- ia = 0;
+ ia = NULL;
break;
}
icp->icmp_type = ICMP_MASKREPLY;
* Reflect the ip packet back to the source
*/
static void
-icmp_reflect(m)
- struct mbuf *m;
+icmp_reflect(struct mbuf *m)
{
- register struct ip *ip = mtod(m, struct ip *);
- register struct in_ifaddr *ia;
+ struct ip *ip = mtod(m, struct ip *);
+ struct in_ifaddr *ia;
struct in_addr t;
- struct mbuf *opts = 0;
+ struct mbuf *opts = NULL;
int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
if (!in_canforward(ip->ip_src) &&
ifaref(&ia->ia_ifa);
}
lck_mtx_unlock(rt_mtx);
+#if CONFIG_MACF_NET
+ mac_netinet_icmp_reply(m);
+#endif
t = IA_SIN(ia)->sin_addr;
ip->ip_src = t;
ip->ip_ttl = ip_defttl;
ia = NULL;
if (optlen > 0) {
- register u_char *cp;
+ u_char *cp;
int opt, cnt;
u_int len;
*/
cp = (u_char *) (ip + 1);
if ((opts = ip_srcroute()) == 0 &&
- (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
+ (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */
opts->m_len = sizeof(struct in_addr);
mtod(opts, struct in_addr *)->s_addr = 0;
}
* after supplying a checksum.
*/
static void
-icmp_send(m, opts)
- register struct mbuf *m;
- struct mbuf *opts;
+icmp_send(struct mbuf *m, struct mbuf *opts)
{
- register struct ip *ip = mtod(m, struct ip *);
- register int hlen;
- register struct icmp *icp;
+ struct ip *ip = mtod(m, struct ip *);
+ int hlen;
+ struct icmp *icp;
struct route ro;
- char ipv4str[MAX_IPv4_STR_LEN];
hlen = IP_VHL_HL(ip->ip_vhl) << 2;
m->m_data += hlen;
icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
m->m_data -= hlen;
m->m_len += hlen;
- m->m_pkthdr.rcvif = 0;
- m->m_pkthdr.aux = NULL;
+ m->m_pkthdr.rcvif = NULL;
m->m_pkthdr.csum_data = 0;
m->m_pkthdr.csum_flags = 0;
#if ICMPPRINTFS
if (icmpprintfs) {
char buf[MAX_IPv4_STR_LEN];
+ char ipv4str[MAX_IPv4_STR_LEN];
printf("icmp_send dst %s src %s\n",
inet_ntop(AF_INET, &ip->ip_dst, buf, sizeof(buf)),
}
#endif
bzero(&ro, sizeof ro);
- (void) ip_output(m, opts, &ro, 0, NULL);
+ (void) ip_output(m, opts, &ro, 0, NULL, NULL);
if (ro.ro_rt)
rtfree(ro.ro_rt);
}
n_time
-iptime()
+iptime(void)
{
struct timeval atv;
u_long t;
* is returned; otherwise, a smaller value is returned.
*/
static int
-ip_next_mtu(mtu, dir)
- int mtu;
- int dir;
+ip_next_mtu(int mtu, int dir)
{
static int mtutab[] = {
65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
/* Like rip_attach but without root privilege enforcement */
__private_extern__ int
-icmp_dgram_attach(struct socket *so, int proto, struct proc *p)
+icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
{
struct inpcb *inp;
- int error, s;
+ int error;
inp = sotoinpcb(so);
if (inp)
error = soreserve(so, rip_sendspace, rip_recvspace);
if (error)
return error;
- s = splnet();
error = in_pcballoc(so, &ripcbinfo, p);
- splx(s);
if (error)
return error;
inp = (struct inpcb *)so->so_pcb;
__private_extern__ int
icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
{
- struct inpcb *inp = sotoinpcb(so);
- int error, optval;
+ int error;
if (sopt->sopt_level != IPPROTO_IP)
return (EINVAL);
}
#endif /* __APPLE__ */
-
projects / apple / xnu.git / blobdiff