/*
- * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000-2018 Apple Inc. All rights reserved.
*
- * @APPLE_LICENSE_HEADER_START@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License"). You may not use this file except in compliance with the
- * License. Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
*
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
- * License for the specific language governing rights and limitations
- * under the License.
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
*
- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
/*
* Copyright (c) 1982, 1986, 1988, 1993
*
* @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
*/
+/*
+ * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
+ * support for mandatory and extensible security protections. This notice
+ * is included in support of clause 2.2 (b) of the Apple Public License,
+ * Version 2.0.
+ */
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/mbuf.h>
+#include <sys/mcache.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/kernel.h>
#include <sys/sysctl.h>
+#include <machine/endian.h>
+
#include <net/if.h>
#include <net/route.h>
#include <netkey/key.h>
#endif
-#if defined(NFAITH) && NFAITH > 0
-#include "faith.h"
-#include <net/if_types.h>
-#endif
+#if NECP
+#include <net/necp.h>
+#endif /* NECP */
+
+ /* XXX This one should go in sys/mbuf.h. It is used to avoid that
+ * a firewall-generated packet loops forever through the firewall.
+ */
+#ifndef M_SKIP_FIREWALL
+#define M_SKIP_FIREWALL 0x4000
+#endif
+
+#if CONFIG_MACF_NET
+#include <security/mac_framework.h>
+#endif /* MAC_NET */
+
/*
* ICMP routines: error generation, receive packet processing, and
* host table maintenance routines.
*/
-static struct icmpstat icmpstat;
-SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RD,
- &icmpstat, icmpstat, "");
+struct icmpstat icmpstat;
+SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats,
+ CTLFLAG_RD | CTLFLAG_LOCKED,
+ &icmpstat, icmpstat, "");
static int icmpmaskrepl = 0;
-SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
- &icmpmaskrepl, 0, "");
+SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
+ CTLFLAG_RW | CTLFLAG_LOCKED,
+ &icmpmaskrepl, 0, "");
static int icmptimestamp = 0;
-SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp, CTLFLAG_RW,
- &icmptimestamp, 0, "");
+SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp,
+ CTLFLAG_RW | CTLFLAG_LOCKED,
+ &icmptimestamp, 0, "");
-static int drop_redirect = 0;
-SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
- &drop_redirect, 0, "");
+static int drop_redirect = 1;
+SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect,
+ CTLFLAG_RW | CTLFLAG_LOCKED,
+ &drop_redirect, 0, "");
static int log_redirect = 0;
-SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
- &log_redirect, 0, "");
+SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect,
+ CTLFLAG_RW | CTLFLAG_LOCKED,
+ &log_redirect, 0, "");
+
+const static int icmp_datalen = 8;
#if ICMP_BANDLIM
-
+
+/* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */
+#ifndef CONFIG_ICMP_BANDLIM
+#if !CONFIG_EMBEDDED
+#define CONFIG_ICMP_BANDLIM 250
+#else /* CONFIG_EMBEDDED */
+#define CONFIG_ICMP_BANDLIM 50
+#endif /* CONFIG_EMBEDDED */
+#endif /* CONFIG_ICMP_BANDLIM */
+
/*
* ICMP error-response bandwidth limiting sysctl. If not enabled, sysctl
* variable content is -1 and read-only.
*/
-static int icmplim = 250;
-SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
+static int icmplim = CONFIG_ICMP_BANDLIM;
+SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED,
&icmplim, 0, "");
-#else
+
+#else /* ICMP_BANDLIM */
static int icmplim = -1;
-SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD,
+SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED,
&icmplim, 0, "");
-#endif
+#endif /* ICMP_BANDLIM */
/*
* ICMP broadcast echo sysctl
*/
static int icmpbmcastecho = 1;
-SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
+SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED,
&icmpbmcastecho, 0, "");
-
-#if ICMPPRINTFS
-int icmpprintfs = 0;
+#if (DEBUG | DEVELOPMENT)
+static int icmpprintfs = 0;
+SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,
+ &icmpprintfs, 0, "");
#endif
static void icmp_reflect(struct mbuf *);
static void icmp_send(struct mbuf *, struct mbuf *);
-static int ip_next_mtu(int, int);
-
-extern struct protosw inetsw[];
/*
* Generate an error packet of type error
struct mbuf *n,
int type,
int code,
- n_long dest,
- struct ifnet *destifp)
+ u_int32_t dest,
+ u_int32_t nextmtu)
{
- register struct ip *oip = mtod(n, struct ip *), *nip;
- register unsigned oiplen = IP_VHL_HL(oip->ip_vhl) << 2;
- register struct icmp *icp;
- register struct mbuf *m;
- unsigned icmplen;
-
-#if ICMPPRINTFS
- if (icmpprintfs)
- printf("icmp_error(%p, %x, %d)\n", oip, type, code);
-#endif
+ struct ip *oip = NULL;
+ struct ip *nip = NULL;
+ struct icmp *icp = NULL;
+ struct mbuf *m = NULL;
+ u_int32_t oiphlen = 0;
+ u_int32_t icmplen = 0;
+ u_int32_t icmpelen = 0;
+ u_int32_t nlen = 0;
+
+ VERIFY((u_int)type <= ICMP_MAXTYPE);
+ /* Expect 32-bit aligned data pointer on strict-align platforms */
+ MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n);
+
if (type != ICMP_REDIRECT)
icmpstat.icps_error++;
/*
- * Don't send error if not the first fragment of message.
- * Don't error if the old packet protocol was ICMP
- * error message, only known informational types.
+ * Don't send error:
+ * if not the first fragment of message
+ * if original packet was a multicast or broadcast packet
+ * if the old packet protocol was ICMP
+ * error message, only known informational types.
*/
- if (oip->ip_off &~ (IP_MF|IP_DF))
+ if (n->m_flags & (M_BCAST|M_MCAST))
+ goto freeit;
+
+ /*
+ * Drop if IP header plus ICMP_MINLEN bytes are not contiguous
+ * in first mbuf.
+ */
+ if (n->m_len < sizeof(struct ip) + ICMP_MINLEN)
goto freeit;
+
+ oip = mtod(n, struct ip *);
+ oiphlen = IP_VHL_HL(oip->ip_vhl) << 2;
+ if (n->m_len < oiphlen + ICMP_MINLEN)
+ goto freeit;
+
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 1)
+ printf("icmp_error(0x%llx, %x, %d)\n",
+ (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code);
+#endif
+
+ if (oip->ip_off & ~(IP_MF|IP_DF))
+ goto freeit;
+
if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
- n->m_len >= oiplen + ICMP_MINLEN &&
- !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
+ n->m_len >= oiphlen + ICMP_MINLEN &&
+ !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))->
+ icmp_type)) {
icmpstat.icps_oldicmp++;
goto freeit;
}
- /* Don't send error in response to a multicast or broadcast packet */
- if (n->m_flags & (M_BCAST|M_MCAST))
+
+ /*
+ * Calculate the length to quote from original packet and prevent
+ * the ICMP mbuf from overflowing.
+ * Unfortunatly this is non-trivial since ip_forward()
+ * sends us truncated packets.
+ */
+ nlen = m_length(n);
+ if (oip->ip_p == IPPROTO_TCP) {
+ struct tcphdr *th = NULL;
+ u_int16_t tcphlen = 0;
+
+ /*
+ * If the packet got truncated and TCP header
+ * is not contained in the packet, send out
+ * standard reply with only IP header as payload
+ */
+ if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
+ n->m_next == NULL)
+ goto stdreply;
+
+ /*
+ * Otherwise, pull up to get IP and TCP headers
+ * together
+ */
+ if (n->m_len < (oiphlen + sizeof(struct tcphdr)) &&
+ (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL)
+ goto freeit;
+
+ /*
+ * Reinit pointers derived from mbuf data pointer
+ * as things might have moved around with m_pullup
+ */
+ oip = mtod(n, struct ip *);
+ th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
+
+ if (th != ((struct tcphdr *)P2ROUNDDOWN(th,
+ sizeof(u_int32_t))))
+ goto freeit;
+ tcphlen = th->th_off << 2;
+
+ /* Sanity checks */
+ if (tcphlen < sizeof(struct tcphdr))
+ goto freeit;
+ if (oip->ip_len < (oiphlen + tcphlen))
+ goto freeit;
+ if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL)
+ goto stdreply;
+ if (n->m_len < (oiphlen + tcphlen) &&
+ (n = m_pullup(n, (oiphlen + tcphlen))) == NULL)
+ goto freeit;
+
+ /*
+ * Reinit pointers derived from mbuf data pointer
+ * as things might have moved around with m_pullup
+ */
+ oip = mtod(n, struct ip *);
+ th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
+
+ icmpelen = max(tcphlen, min(icmp_datalen,
+ (oip->ip_len - oiphlen)));
+ } else
+stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen,
+ (oip->ip_len - oiphlen)));
+
+ icmplen = min(oiphlen + icmpelen, nlen);
+ if (icmplen < sizeof(struct ip))
goto freeit;
+
/*
* First, formulate icmp message
+ * Allocate enough space for the IP header, ICMP header
+ * and the payload (part of the original message to be sent back).
*/
- m = m_gethdr(M_DONTWAIT, MT_HEADER);
+ if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen))
+ m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */
+ else
+ m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
+
if (m == NULL)
goto freeit;
- icmplen = min(oiplen + 8, oip->ip_len);
- if (icmplen < sizeof(struct ip)) {
- printf("icmp_error: bad length\n");
- m_free(m);
- goto freeit;
- }
- m->m_len = icmplen + ICMP_MINLEN;
- MH_ALIGN(m, m->m_len);
+
+#if CONFIG_MACF_NET
+ mac_mbuf_label_associate_netlayer(n, m);
+#endif
+ /*
+ * Further refine the payload length to the space
+ * remaining in mbuf after including the IP header and ICMP
+ * header.
+ */
+ icmplen = min(icmplen, M_TRAILINGSPACE(m) -
+ sizeof(struct ip) - ICMP_MINLEN);
+ m_align(m, ICMP_MINLEN + icmplen);
+ m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */
+
icp = mtod(m, struct icmp *);
- if ((u_int)type > ICMP_MAXTYPE)
- panic("icmp_error");
icmpstat.icps_outhist[type]++;
icp->icmp_type = type;
if (type == ICMP_REDIRECT)
icp->icmp_pptr = code;
code = 0;
} else if (type == ICMP_UNREACH &&
- code == ICMP_UNREACH_NEEDFRAG && destifp) {
- icp->icmp_nextmtu = htons(destifp->if_mtu);
+ code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) {
+ icp->icmp_nextmtu = htons(nextmtu);
}
}
icp->icmp_code = code;
+
+ /*
+ * Copy icmplen worth of content from original
+ * mbuf (n) to the new packet after ICMP header.
+ */
m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
nip = &icp->icmp_ip;
/*
* Convert fields to network representation.
*/
+#if BYTE_ORDER != BIG_ENDIAN
HTONS(nip->ip_len);
HTONS(nip->ip_off);
-
+#endif
/*
- * Now, copy old ip header (without options)
- * in front of icmp message.
- */
- if (m->m_data - sizeof(struct ip) < m->m_pktdat)
- panic("icmp len");
+ * Set up ICMP message mbuf and copy old IP header (without options
+ * in front of ICMP message.
+ * If the original mbuf was meant to bypass the firewall, the error
+ * reply should bypass as well.
+ */
+ m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
m->m_data -= sizeof(struct ip);
m->m_len += sizeof(struct ip);
m->m_pkthdr.len = m->m_len;
m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
- m->m_pkthdr.aux = NULL; /* for IPsec */
nip = mtod(m, struct ip *);
bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
nip->ip_len = m->m_len;
nip->ip_vhl = IP_VHL_BORING;
nip->ip_p = IPPROTO_ICMP;
nip->ip_tos = 0;
+ nip->ip_off = 0;
icmp_reflect(m);
-
freeit:
m_freem(n);
}
-static struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET };
-static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET };
-static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET };
-
/*
* Process a received ICMP message.
*/
void
-icmp_input(m, hlen)
- register struct mbuf *m;
- int hlen;
+icmp_input(struct mbuf *m, int hlen)
{
- register struct icmp *icp;
- register struct ip *ip = mtod(m, struct ip *);
- int icmplen = ip->ip_len;
- register int i;
+ struct sockaddr_in icmpsrc, icmpdst, icmpgw;
+ struct icmp *icp;
+ struct ip *ip = mtod(m, struct ip *);
+ int icmplen;
+ int i;
struct in_ifaddr *ia;
- void (*ctlfunc)(int, struct sockaddr *, void *);
+ void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
int code;
- char ipv4str[MAX_IPv4_STR_LEN];
+
+ /* Expect 32-bit aligned data pointer on strict-align platforms */
+ MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
+
+ icmplen = ip->ip_len;
/*
* Locate icmp structure in mbuf, and check
* that not corrupted and of at least minimum length.
*/
-#if ICMPPRINTFS
- if (icmpprintfs) {
- char buf[MAX_IPv4_STR_LEN];
-
- printf("icmp_input from %s to %s, len %d\n",
- inet_ntop(AF_INET, &ip->ip_src, buf, sizeof(buf)),
- inet_ntop(AF_INET, &ip->ip_dst, ipv4str, sizeof(ipv4str)),
- icmplen);
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 2) {
+ char src_str[MAX_IPv4_STR_LEN];
+ char dst_str[MAX_IPv4_STR_LEN];
+
+ inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
+ inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
+ printf("%s: from %s to %s, len %d\n",
+ __func__, src_str, dst_str, icmplen);
}
#endif
if (icmplen < ICMP_MINLEN) {
m->m_len += hlen;
m->m_data -= hlen;
-#if defined(NFAITH) && 0 < NFAITH
- if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
- /*
- * Deliver very specific ICMP type only.
- */
- switch (icp->icmp_type) {
- case ICMP_UNREACH:
- case ICMP_TIMXCEED:
- break;
- default:
- goto freeit;
- }
- }
-#endif
-
-#if ICMPPRINTFS
- if (icmpprintfs)
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 2)
printf("icmp_input, type %d code %d\n", icp->icmp_type,
icp->icmp_code);
#endif
*/
if (icp->icmp_type > ICMP_MAXTYPE)
goto raw;
+
+ /* Initialize */
+ bzero(&icmpsrc, sizeof (icmpsrc));
+ icmpsrc.sin_len = sizeof (struct sockaddr_in);
+ icmpsrc.sin_family = AF_INET;
+ bzero(&icmpdst, sizeof (icmpdst));
+ icmpdst.sin_len = sizeof (struct sockaddr_in);
+ icmpdst.sin_family = AF_INET;
+ bzero(&icmpgw, sizeof (icmpgw));
+ icmpgw.sin_len = sizeof (struct sockaddr_in);
+ icmpgw.sin_family = AF_INET;
+
icmpstat.icps_inhist[icp->icmp_type]++;
code = icp->icmp_code;
switch (icp->icmp_type) {
/*
* Problem with datagram; advise higher level routines.
*/
- if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
- IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
+ if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp)
+ || IP_VHL_HL(icp->icmp_ip.ip_vhl) <
+ (sizeof(struct ip) >> 2)) {
icmpstat.icps_badlen++;
goto freeit;
}
+
+#if BYTE_ORDER != BIG_ENDIAN
NTOHS(icp->icmp_ip.ip_len);
+#endif
+
/* Discard ICMP's in response to multicast packets */
if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
goto badcode;
-#if ICMPPRINTFS
- if (icmpprintfs)
- printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 2)
+ printf("deliver to protocol %d\n",
+ icp->icmp_ip.ip_p);
#endif
icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
-#if 1
- /*
- * MTU discovery:
- * If we got a needfrag and there is a host route to the
- * original destination, and the MTU is not locked, then
- * set the MTU in the route to the suggested new value
- * (if given) and then notify as usual. The ULPs will
- * notice that the MTU has changed and adapt accordingly.
- * If no new MTU was suggested, then we guess a new one
- * less than the current value. If the new MTU is
- * unreasonably small (defined by sysctl tcp_minmss), then
- * we reset the MTU to the interface value and enable the
- * lock bit, indicating that we are no longer doing MTU
- * discovery.
- */
- if (code == PRC_MSGSIZE) {
- struct rtentry *rt;
- int mtu;
-
- rt = rtalloc1((struct sockaddr *)&icmpsrc, 0,
- RTF_CLONING | RTF_PRCLONING);
- if (rt && (rt->rt_flags & RTF_HOST)
- && !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
- mtu = ntohs(icp->icmp_nextmtu);
- if (!mtu)
- mtu = ip_next_mtu(rt->rt_rmx.rmx_mtu,
- 1);
-#if DEBUG_MTUDISC
- printf("MTU for %s reduced to %d\n",
- inet_ntop(AF_INET, &icmpsrc.sin_addr, ipv4str,
- sizeof(ipv4str)),
- mtu);
-#endif
- if (mtu < max(296, (tcp_minmss + sizeof(struct tcpiphdr)))) {
- /* rt->rt_rmx.rmx_mtu =
- rt->rt_ifp->if_mtu; */
- rt->rt_rmx.rmx_locks |= RTV_MTU;
- } else if (rt->rt_rmx.rmx_mtu > mtu) {
- rt->rt_rmx.rmx_mtu = mtu;
- }
- }
- if (rt)
- rtfree(rt);
- }
-#endif
/*
- * XXX if the packet contains [IPv4 AH TCP], we can't make a
+ * if the packet contains [IPv4 AH TCP], we can't make a
* notification to TCP layer.
*/
ctlfunc = ip_protox[icp->icmp_ip.ip_p]->pr_ctlinput;
- if (ctlfunc)
+
+ if (ctlfunc) {
+ LCK_MTX_ASSERT(inet_domain_mutex, LCK_MTX_ASSERT_OWNED);
+
+ lck_mtx_unlock(inet_domain_mutex);
+
(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
- (void *)&icp->icmp_ip);
+ (void *)&icp->icmp_ip, m->m_pkthdr.rcvif);
+
+ lck_mtx_lock(inet_domain_mutex);
+ }
break;
badcode:
break;
case ICMP_ECHO:
- if (!icmpbmcastecho
- && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
+ if ((m->m_flags & (M_MCAST | M_BCAST))) {
+ if (icmpbmcastecho == 0) {
+ icmpstat.icps_bmcastecho++;
+ break;
+ }
+ }
+
+ /*
+ * rdar://18644769
+ * Do not reply when the destination is link local multicast or broadcast
+ * and the source is not from a directly connected subnet
+ */
+ if ((IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr)) ||
+ in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) &&
+ in_localaddr(ip->ip_src) == 0) {
icmpstat.icps_bmcastecho++;
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 0) {
+ char src_str[MAX_IPv4_STR_LEN];
+ char dst_str[MAX_IPv4_STR_LEN];
+
+ inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
+ inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
+ printf("%s: non local (B|M)CAST %s to %s, len %d\n",
+ __func__, src_str, dst_str, icmplen);
+ }
+#endif
break;
}
+
icp->icmp_type = ICMP_ECHOREPLY;
#if ICMP_BANDLIM
if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
goto reflect;
case ICMP_TSTAMP:
-
if (icmptimestamp == 0)
break;
goto reflect;
case ICMP_MASKREQ:
-#define satosin(sa) ((struct sockaddr_in *)(sa))
if (icmpmaskrepl == 0)
break;
/*
(struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
if (ia == 0)
break;
+ IFA_LOCK(&ia->ia_ifa);
if (ia->ia_ifp == 0) {
- ifafree(&ia->ia_ifa);
- ia = 0;
+ IFA_UNLOCK(&ia->ia_ifa);
+ IFA_REMREF(&ia->ia_ifa);
+ ia = NULL;
break;
}
icp->icmp_type = ICMP_MASKREPLY;
else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
}
- ifafree(&ia->ia_ifa);
+ IFA_UNLOCK(&ia->ia_ifa);
+ IFA_REMREF(&ia->ia_ifa);
reflect:
ip->ip_len += hlen; /* since ip_input deducts this */
icmpstat.icps_reflect++;
case ICMP_REDIRECT:
if (log_redirect) {
- u_long src, dst, gw;
+ u_int32_t src, dst, gw;
src = ntohl(ip->ip_src.s_addr);
dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
*/
icmpgw.sin_addr = ip->ip_src;
icmpdst.sin_addr = icp->icmp_gwaddr;
-#if ICMPPRINTFS
- if (icmpprintfs) {
- char buf[MAX_IPv4_STR_LEN];
-
- printf("redirect dst %s to %s\n",
- inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, buf, sizeof(buf)),
- inet_ntop(AF_INET, &icp->icmp_gwaddr, ipv4str,
- sizeof(ipv4str)));
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 0) {
+ char dst_str[MAX_IPv4_STR_LEN];
+ char gw_str[MAX_IPv4_STR_LEN];
+
+ inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str));
+ inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str));
+ printf("%s: redirect dst %s to %s\n", __func__, dst_str, gw_str);
}
#endif
icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
- rtredirect((struct sockaddr *)&icmpsrc,
- (struct sockaddr *)&icmpdst,
- (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
- (struct sockaddr *)&icmpgw, (struct rtentry **)0);
+ rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc,
+ (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST,
+ (struct sockaddr *)&icmpgw, NULL);
pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
#if IPSEC
key_sa_routechange((struct sockaddr *)&icmpsrc);
* Reflect the ip packet back to the source
*/
static void
-icmp_reflect(m)
- struct mbuf *m;
+icmp_reflect(struct mbuf *m)
{
- register struct ip *ip = mtod(m, struct ip *);
- register struct in_ifaddr *ia;
+ struct ip *ip = mtod(m, struct ip *);
+ struct sockaddr_in icmpdst;
+ struct in_ifaddr *ia;
struct in_addr t;
- struct mbuf *opts = 0;
+ struct mbuf *opts = NULL;
int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
if (!in_canforward(ip->ip_src) &&
* or anonymous), use the address which corresponds
* to the incoming interface.
*/
- lck_mtx_lock(rt_mtx);
+ lck_rw_lock_shared(in_ifaddr_rwlock);
+ TAILQ_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) {
+ IFA_LOCK(&ia->ia_ifa);
+ if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) {
+ IFA_ADDREF_LOCKED(&ia->ia_ifa);
+ IFA_UNLOCK(&ia->ia_ifa);
+ goto match;
+ }
+ IFA_UNLOCK(&ia->ia_ifa);
+ }
+ /*
+ * Slow path; check for broadcast addresses. Find a source
+ * IP address to use when replying to the broadcast request;
+ * let IP handle the source interface selection work.
+ */
for (ia = in_ifaddrhead.tqh_first; ia; ia = ia->ia_link.tqe_next) {
- if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
- break;
+ IFA_LOCK(&ia->ia_ifa);
if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) &&
- t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr)
+ t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) {
+ IFA_ADDREF_LOCKED(&ia->ia_ifa);
+ IFA_UNLOCK(&ia->ia_ifa);
break;
+ }
+ IFA_UNLOCK(&ia->ia_ifa);
}
- if (ia)
- ifaref(&ia->ia_ifa);
+match:
+ lck_rw_done(in_ifaddr_rwlock);
+
+ /* Initialize */
+ bzero(&icmpdst, sizeof (icmpdst));
+ icmpdst.sin_len = sizeof (struct sockaddr_in);
+ icmpdst.sin_family = AF_INET;
icmpdst.sin_addr = t;
if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif)
ia = (struct in_ifaddr *)ifaof_ifpforaddr(
* and was received on an interface with no IP address.
*/
if (ia == (struct in_ifaddr *)0) {
+ lck_rw_lock_shared(in_ifaddr_rwlock);
ia = in_ifaddrhead.tqh_first;
- ifaref(&ia->ia_ifa);
+ if (ia == (struct in_ifaddr *)0) {/* no address yet, bail out */
+ lck_rw_done(in_ifaddr_rwlock);
+ m_freem(m);
+ goto done;
+ }
+ IFA_ADDREF(&ia->ia_ifa);
+ lck_rw_done(in_ifaddr_rwlock);
}
- lck_mtx_unlock(rt_mtx);
+#if CONFIG_MACF_NET
+ mac_netinet_icmp_reply(m);
+#endif
+ IFA_LOCK_SPIN(&ia->ia_ifa);
t = IA_SIN(ia)->sin_addr;
+ IFA_UNLOCK(&ia->ia_ifa);
ip->ip_src = t;
ip->ip_ttl = ip_defttl;
- ifafree(&ia->ia_ifa);
+ IFA_REMREF(&ia->ia_ifa);
ia = NULL;
if (optlen > 0) {
- register u_char *cp;
+ u_char *cp;
int opt, cnt;
u_int len;
*/
cp = (u_char *) (ip + 1);
if ((opts = ip_srcroute()) == 0 &&
- (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
+ (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */
opts->m_len = sizeof(struct in_addr);
mtod(opts, struct in_addr *)->s_addr = 0;
}
if (opts) {
-#if ICMPPRINTFS
- if (icmpprintfs)
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 1)
printf("icmp_reflect optlen %d rt %d => ",
optlen, opts->m_len);
#endif
opts->m_len++;
}
}
-#if ICMPPRINTFS
- if (icmpprintfs)
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 1)
printf("%d\n", opts->m_len);
#endif
}
* after supplying a checksum.
*/
static void
-icmp_send(m, opts)
- register struct mbuf *m;
- struct mbuf *opts;
+icmp_send(struct mbuf *m, struct mbuf *opts)
{
- register struct ip *ip = mtod(m, struct ip *);
- register int hlen;
- register struct icmp *icp;
+ struct ip *ip = mtod(m, struct ip *);
+ int hlen;
+ struct icmp *icp;
struct route ro;
- char ipv4str[MAX_IPv4_STR_LEN];
+ struct ip_out_args ipoa;
+
+ bzero(&ipoa, sizeof(ipoa));
+ ipoa.ipoa_boundif = IFSCOPE_NONE;
+ ipoa.ipoa_flags = IPOAF_SELECT_SRCIF | IPOAF_BOUND_SRCADDR;
+ ipoa.ipoa_sotc = SO_TC_UNSPEC;
+ ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
+
+ if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
+ ipoa.ipoa_boundif = m->m_pkthdr.rcvif->if_index;
+ ipoa.ipoa_flags |= IPOAF_BOUND_IF;
+ }
hlen = IP_VHL_HL(ip->ip_vhl) << 2;
m->m_data += hlen;
icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
m->m_data -= hlen;
m->m_len += hlen;
- m->m_pkthdr.rcvif = 0;
- m->m_pkthdr.aux = NULL;
+ m->m_pkthdr.rcvif = NULL;
m->m_pkthdr.csum_data = 0;
m->m_pkthdr.csum_flags = 0;
-#if ICMPPRINTFS
- if (icmpprintfs) {
- char buf[MAX_IPv4_STR_LEN];
-
- printf("icmp_send dst %s src %s\n",
- inet_ntop(AF_INET, &ip->ip_dst, buf, sizeof(buf)),
- inet_ntop(AF_INET, &ip->ip_src, ipv4str, sizeof(ipv4str)));
+#if (DEBUG | DEVELOPMENT)
+ if (icmpprintfs > 2) {
+ char src_str[MAX_IPv4_STR_LEN];
+ char dst_str[MAX_IPv4_STR_LEN];
+
+ inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
+ inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
+ printf("%s: dst %s src %s\n", __func__, dst_str, src_str);
}
#endif
bzero(&ro, sizeof ro);
- (void) ip_output(m, opts, &ro, 0, NULL);
- if (ro.ro_rt)
- rtfree(ro.ro_rt);
+ (void) ip_output(m, opts, &ro, IP_OUTARGS, NULL, &ipoa);
+ ROUTE_RELEASE(&ro);
}
-n_time
-iptime()
+u_int32_t
+iptime(void)
{
struct timeval atv;
- u_long t;
+ u_int32_t t;
- microtime(&atv);
+ getmicrotime(&atv);
t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
return (htonl(t));
}
* given current value MTU. If DIR is less than zero, a larger plateau
* is returned; otherwise, a smaller value is returned.
*/
-static int
-ip_next_mtu(mtu, dir)
- int mtu;
- int dir;
+int
+ip_next_mtu(int mtu, int dir)
{
static int mtutab[] = {
65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
int
badport_bandlim(int which)
{
- static struct timeval lticks[BANDLIM_MAX + 1];
+ static uint64_t lticks[BANDLIM_MAX + 1];
static int lpackets[BANDLIM_MAX + 1];
- struct timeval time;
+ uint64_t time = net_uptime();
int secs;
const char *bandlimittype[] = {
if (icmplim <= 0 || which > BANDLIM_MAX || which < 0)
return(0);
- getmicrouptime(&time);
+ secs = time - lticks[which];
- secs = time.tv_sec - lticks[which].tv_sec ;
-
/*
* reset stats when cumulative delta exceeds one second.
*/
- if ((secs > 1) || (secs == 1 && (lticks[which].tv_usec > time.tv_usec))) {
+ if (secs > 1) {
if (lpackets[which] > icmplim) {
printf("%s from %d to %d packets per second\n",
bandlimittype[which],
icmplim
);
}
- lticks[which].tv_sec = time.tv_sec;
- lticks[which].tv_usec = time.tv_usec;
+ lticks[which] = time;
lpackets[which] = 0;
}
#include <netinet/ip_icmp.h>
#include <netinet/in_pcb.h>
-extern struct domain inetdomain;
-extern u_long rip_sendspace;
-extern u_long rip_recvspace;
+extern u_int32_t rip_sendspace;
+extern u_int32_t rip_recvspace;
extern struct inpcbinfo ripcbinfo;
int rip_abort(struct socket *);
__private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt);
__private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = {
- rip_abort, pru_accept_notsupp, icmp_dgram_attach, rip_bind, rip_connect,
- pru_connect2_notsupp, in_control, rip_detach, rip_disconnect,
- pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp,
- pru_rcvoob_notsupp, icmp_dgram_send, pru_sense_null, rip_shutdown,
- in_setsockaddr, sosend, soreceive, pru_sopoll_notsupp
+ .pru_abort = rip_abort,
+ .pru_attach = icmp_dgram_attach,
+ .pru_bind = rip_bind,
+ .pru_connect = rip_connect,
+ .pru_control = in_control,
+ .pru_detach = rip_detach,
+ .pru_disconnect = rip_disconnect,
+ .pru_peeraddr = in_getpeeraddr,
+ .pru_send = icmp_dgram_send,
+ .pru_shutdown = rip_shutdown,
+ .pru_sockaddr = in_getsockaddr,
+ .pru_sosend = sosend,
+ .pru_soreceive = soreceive,
};
/* Like rip_attach but without root privilege enforcement */
__private_extern__ int
-icmp_dgram_attach(struct socket *so, int proto, struct proc *p)
+icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
{
struct inpcb *inp;
- int error, s;
+ int error;
inp = sotoinpcb(so);
if (inp)
error = soreserve(so, rip_sendspace, rip_recvspace);
if (error)
return error;
- s = splnet();
error = in_pcballoc(so, &ripcbinfo, p);
- splx(s);
if (error)
return error;
inp = (struct inpcb *)so->so_pcb;
__private_extern__ int
icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
{
- struct inpcb *inp = sotoinpcb(so);
- int error, optval;
+ int error;
if (sopt->sopt_level != IPPROTO_IP)
return (EINVAL);
case IP_RECVDSTADDR:
case IP_RETOPTS:
case IP_MULTICAST_IF:
+ case IP_MULTICAST_IFINDEX:
case IP_MULTICAST_TTL:
case IP_MULTICAST_LOOP:
case IP_ADD_MEMBERSHIP:
case IP_PORTRANGE:
case IP_RECVIF:
case IP_IPSEC_POLICY:
-#if defined(NFAITH) && NFAITH > 0
- case IP_FAITH:
-#endif
case IP_STRIPHDR:
case IP_RECVTTL:
+ case IP_BOUND_IF:
+ case IP_NO_IFT_CELLULAR:
error = rip_ctloutput(so, sopt);
break;
-
+
default:
error = EINVAL;
break;
}
__private_extern__ int
-icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
- struct mbuf *control, struct proc *p)
+icmp_dgram_send(struct socket *so, int flags, struct mbuf *m,
+ struct sockaddr *nam, struct mbuf *control, struct proc *p)
{
struct ip *ip;
struct inpcb *inp = sotoinpcb(so);
struct icmp *icp;
struct in_ifaddr *ia = NULL;
int icmplen;
+ int error = EINVAL;
+
+ if (inp == NULL
+#if NECP
+ || (necp_socket_should_use_flow_divert(inp))
+#endif /* NECP */
+ ) {
+ if (inp != NULL)
+ error = EPROTOTYPE;
+ goto bad;
+ }
if ((inp->inp_flags & INP_HDRINCL) != 0) {
+ /* Expect 32-bit aligned data ptr on strict-align platforms */
+ MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
/*
- * This is not raw IP, we liberal only for fields TOS, id and TTL
+ * This is not raw IP, we liberal only for fields TOS,
+ * id and TTL.
*/
ip = mtod(m, struct ip *);
goto bad;
if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len)
goto bad;
- /* Bogus fragments can tie up peer resources */
- if (ip->ip_off != 0)
+ /* Bogus fragments can tie up peer resources */
+ if ((ip->ip_off & ~IP_DF) != 0)
goto bad;
/* Allow only ICMP even for user provided IP header */
if (ip->ip_p != IPPROTO_ICMP)
goto bad;
- /* To prevent spoofing, specified source address must be one of ours */
+ /*
+ * To prevent spoofing, specified source address must
+ * be one of ours.
+ */
if (ip->ip_src.s_addr != INADDR_ANY) {
socket_unlock(so, 0);
- lck_mtx_lock(rt_mtx);
+ lck_rw_lock_shared(in_ifaddr_rwlock);
if (TAILQ_EMPTY(&in_ifaddrhead)) {
- lck_mtx_unlock(rt_mtx);
+ lck_rw_done(in_ifaddr_rwlock);
socket_lock(so, 0);
goto bad;
}
- TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
- if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_src.s_addr) {
- lck_mtx_unlock(rt_mtx);
+ TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr),
+ ia_hash) {
+ IFA_LOCK(&ia->ia_ifa);
+ if (IA_SIN(ia)->sin_addr.s_addr ==
+ ip->ip_src.s_addr) {
+ IFA_UNLOCK(&ia->ia_ifa);
+ lck_rw_done(in_ifaddr_rwlock);
socket_lock(so, 0);
goto ours;
}
+ IFA_UNLOCK(&ia->ia_ifa);
}
- lck_mtx_unlock(rt_mtx);
+ lck_rw_done(in_ifaddr_rwlock);
socket_lock(so, 0);
goto bad;
}
ours:
/* Do not trust we got a valid checksum */
ip->ip_sum = 0;
-
- icp = (struct icmp *)(((char *)m->m_data) + hlen);
+
+ icp = (struct icmp *)(void *)(((char *)m->m_data) + hlen);
icmplen = m->m_pkthdr.len - hlen;
} else {
if ((icmplen = m->m_pkthdr.len) < ICMP_MINLEN) {
default:
goto bad;
}
- return rip_send(so, flags, m, nam, control, p);
+ return (rip_send(so, flags, m, nam, control, p));
bad:
- m_freem(m);
- return EINVAL;
+ VERIFY(error != 0);
+
+ if (m != NULL)
+ m_freem(m);
+ if (control != NULL)
+ m_freem(control);
+
+ return (error);
}
#endif /* __APPLE__ */
-
projects / apple / xnu.git / blobdiff