xnu-7195.60.75.tar.gz

[apple/xnu.git] / bsd / netinet / ip_icmp.c

diff --git a/bsd/netinet/ip_icmp.c b/bsd/netinet/ip_icmp.c
index 260449c30778ede4811e24cffb219073746e864a..14aa9c9603881d7397a786546706defab832a727 100644 (file)
--- a/bsd/netinet/ip_icmp.c
+++ b/bsd/netinet/ip_icmp.c
@@ -1,8 +1,8 @@
 /*
 /*

- * Copyright (c) 2000-2018 Apple Inc. All rights reserved.
+ * Copyright (c) 2000-2020 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*


@@ -80,6 +80,7 @@
 
 #include <net/if.h>
 #include <net/route.h>
 
 #include <net/if.h>
 #include <net/route.h>

+#include <net/content_filter.h>

 
 #define _IP_VHL
 #include <netinet/in.h>
 
 #define _IP_VHL
 #include <netinet/in.h>


@@ -105,17 +106,6 @@
 #include <net/necp.h>
 #endif /* NECP */
 
 #include <net/necp.h>
 #endif /* NECP */
 

- /* XXX This one should go in sys/mbuf.h. It is used to avoid that
- * a firewall-generated packet loops forever through the firewall.
- */
-#ifndef M_SKIP_FIREWALL
-#define M_SKIP_FIREWALL         0x4000
-#endif 
-
-#if CONFIG_MACF_NET
-#include <security/mac_framework.h>
-#endif /* MAC_NET */
-

 
 /*
  * ICMP routines: error generation, receive packet processing, and
 
 /*
  * ICMP routines: error generation, receive packet processing, and


@@ -123,77 +113,77 @@
  * host table maintenance routines.
  */
 
  * host table maintenance routines.
  */
 

-struct icmpstat icmpstat;
+struct  icmpstat icmpstat;

 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats,
     CTLFLAG_RD | CTLFLAG_LOCKED,
     &icmpstat, icmpstat, "");
 
 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats,
     CTLFLAG_RD | CTLFLAG_LOCKED,
     &icmpstat, icmpstat, "");
 

-static int     icmpmaskrepl = 0;
+static int      icmpmaskrepl = 0;

 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &icmpmaskrepl, 0, "");
 
 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &icmpmaskrepl, 0, "");
 

-static int     icmptimestamp = 0;
+static int      icmptimestamp = 0;

 SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &icmptimestamp, 0, "");
 
 SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &icmptimestamp, 0, "");
 

-static int     drop_redirect = 1;
+static int      drop_redirect = 1;

 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &drop_redirect, 0, "");
 
 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &drop_redirect, 0, "");
 

-static int     log_redirect = 0;
+static int      log_redirect = 0;

 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &log_redirect, 0, "");
 
 const static int icmp_datalen = 8;
 
 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect,
     CTLFLAG_RW | CTLFLAG_LOCKED,
     &log_redirect, 0, "");
 
 const static int icmp_datalen = 8;
 

-#if ICMP_BANDLIM 
+#if ICMP_BANDLIM

 
 /* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */
 #ifndef CONFIG_ICMP_BANDLIM
 
 /* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */
 #ifndef CONFIG_ICMP_BANDLIM

-#if !CONFIG_EMBEDDED
+#if XNU_TARGET_OS_OSX

 #define CONFIG_ICMP_BANDLIM 250
 #define CONFIG_ICMP_BANDLIM 250

-#else /* CONFIG_EMBEDDED */
+#else /* !XNU_TARGET_OS_OSX */

 #define CONFIG_ICMP_BANDLIM 50
 #define CONFIG_ICMP_BANDLIM 50

-#endif /* CONFIG_EMBEDDED */
+#endif /* !XNU_TARGET_OS_OSX */

 #endif /* CONFIG_ICMP_BANDLIM */
 
 #endif /* CONFIG_ICMP_BANDLIM */
 

-/*    
+/*

  * ICMP error-response bandwidth limiting sysctl.  If not enabled, sysctl
  *      variable content is -1 and read-only.
  * ICMP error-response bandwidth limiting sysctl.  If not enabled, sysctl
  *      variable content is -1 and read-only.

- */     
-    
+ */
+

 static int      icmplim = CONFIG_ICMP_BANDLIM;
 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED,
 static int      icmplim = CONFIG_ICMP_BANDLIM;
 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED,

-       &icmplim, 0, "");
+    &icmplim, 0, "");

 
 #else /* ICMP_BANDLIM */
 
 static int      icmplim = -1;
 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED,
 
 #else /* ICMP_BANDLIM */
 
 static int      icmplim = -1;
 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED,

-       &icmplim, 0, "");
-       
+    &icmplim, 0, "");
+

 #endif /* ICMP_BANDLIM */
 
 /*
  * ICMP broadcast echo sysctl
  */
 
 #endif /* ICMP_BANDLIM */
 
 /*
  * ICMP broadcast echo sysctl
  */
 

-static int     icmpbmcastecho = 1;
+static int      icmpbmcastecho = 1;

 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED,
 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED,

-       &icmpbmcastecho, 0, "");
+    &icmpbmcastecho, 0, "");

 
 #if (DEBUG | DEVELOPMENT)
 
 #if (DEBUG | DEVELOPMENT)

-static int     icmpprintfs = 0;
+static int      icmpprintfs = 0;

 SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,
 SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,

-       &icmpprintfs, 0, "");
+    &icmpprintfs, 0, "");

 #endif
 
 #endif
 

-static void    icmp_reflect(struct mbuf *);
-static void    icmp_send(struct mbuf *, struct mbuf *);
+static void     icmp_reflect(struct mbuf *);
+static void     icmp_send(struct mbuf *, struct mbuf *);

 
 /*
  * Generate an error packet of type error
 
 /*
  * Generate an error packet of type error


@@ -217,11 +207,14 @@ icmp_error(
        u_int32_t nlen = 0;
 
        VERIFY((u_int)type <= ICMP_MAXTYPE);
        u_int32_t nlen = 0;
 
        VERIFY((u_int)type <= ICMP_MAXTYPE);

+       VERIFY(code <= UINT8_MAX);
+

        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n);
 
        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n);
 

-       if (type != ICMP_REDIRECT)
+       if (type != ICMP_REDIRECT) {

                icmpstat.icps_error++;
                icmpstat.icps_error++;

+       }

        /*
         * Don't send error:
         *   if not the first fragment of message
        /*
         * Don't send error:
         *   if not the first fragment of message


@@ -229,34 +222,39 @@ icmp_error(
         *   if the old packet protocol was ICMP
         *   error message, only known informational types.
         */
         *   if the old packet protocol was ICMP
         *   error message, only known informational types.
         */

-       if (n->m_flags & (M_BCAST|M_MCAST))
+       if (n->m_flags & (M_BCAST | M_MCAST)) {

                goto freeit;
                goto freeit;

+       }

 
        /*
         * Drop if IP header plus ICMP_MINLEN bytes are not contiguous
         * in first mbuf.
         */
 
        /*
         * Drop if IP header plus ICMP_MINLEN bytes are not contiguous
         * in first mbuf.
         */

-       if (n->m_len < sizeof(struct ip) + ICMP_MINLEN)
+       if (n->m_len < sizeof(struct ip) + ICMP_MINLEN) {

                goto freeit;
                goto freeit;

+       }

 
        oip = mtod(n, struct ip *);
        oiphlen = IP_VHL_HL(oip->ip_vhl) << 2;
 
        oip = mtod(n, struct ip *);
        oiphlen = IP_VHL_HL(oip->ip_vhl) << 2;

-       if (n->m_len < oiphlen + ICMP_MINLEN)
+       if (n->m_len < oiphlen + ICMP_MINLEN) {

                goto freeit;
                goto freeit;

+       }

 
 #if (DEBUG | DEVELOPMENT)
 
 #if (DEBUG | DEVELOPMENT)

-       if (icmpprintfs > 1)
+       if (icmpprintfs > 1) {

                printf("icmp_error(0x%llx, %x, %d)\n",
                    (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code);
                printf("icmp_error(0x%llx, %x, %d)\n",
                    (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code);

+       }

 #endif
 
 #endif
 

-       if (oip->ip_off & ~(IP_MF|IP_DF))
+       if (oip->ip_off & ~(IP_MF | IP_DF)) {

                goto freeit;
                goto freeit;

+       }

 
        if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
            n->m_len >= oiphlen + ICMP_MINLEN &&
            !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))->
 
        if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
            n->m_len >= oiphlen + ICMP_MINLEN &&
            !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))->

-               icmp_type)) {
+           icmp_type)) {

                icmpstat.icps_oldicmp++;
                goto freeit;
        }
                icmpstat.icps_oldicmp++;
                goto freeit;
        }


@@ -278,16 +276,18 @@ icmp_error(
                 * standard reply with only IP header as payload
                 */
                if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
                 * standard reply with only IP header as payload
                 */
                if (oiphlen + sizeof(struct tcphdr) > n->m_len &&

-                   n->m_next == NULL)
+                   n->m_next == NULL) {

                        goto stdreply;
                        goto stdreply;

+               }

 
                /*
                 * Otherwise, pull up to get IP and TCP headers
                 * together
                 */
                if (n->m_len < (oiphlen + sizeof(struct tcphdr)) &&
 
                /*
                 * Otherwise, pull up to get IP and TCP headers
                 * together
                 */
                if (n->m_len < (oiphlen + sizeof(struct tcphdr)) &&

-                   (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL)
+                   (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL) {

                        goto freeit;
                        goto freeit;

+               }

 
                /*
                 * Reinit pointers derived from mbuf data pointer
 
                /*
                 * Reinit pointers derived from mbuf data pointer


@@ -297,20 +297,26 @@ icmp_error(
                th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
 
                if (th != ((struct tcphdr *)P2ROUNDDOWN(th,
                th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
 
                if (th != ((struct tcphdr *)P2ROUNDDOWN(th,

-                   sizeof(u_int32_t))))
+                   sizeof(u_int32_t))) ||
+                   ((th->th_off << 2) > UINT16_MAX)) {

                        goto freeit;
                        goto freeit;

-               tcphlen = th->th_off << 2;
+               }
+               tcphlen = (uint16_t)(th->th_off << 2);

 
                /* Sanity checks */
 
                /* Sanity checks */

-               if (tcphlen < sizeof(struct tcphdr))
+               if (tcphlen < sizeof(struct tcphdr)) {

                        goto freeit;
                        goto freeit;

-               if (oip->ip_len < (oiphlen + tcphlen))
+               }
+               if (oip->ip_len < (oiphlen + tcphlen)) {

                        goto freeit;
                        goto freeit;

-               if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL)
+               }
+               if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL) {

                        goto stdreply;
                        goto stdreply;

+               }

                if (n->m_len < (oiphlen + tcphlen) &&
                if (n->m_len < (oiphlen + tcphlen) &&

-                   (n = m_pullup(n, (oiphlen + tcphlen))) == NULL)
+                   (n = m_pullup(n, (oiphlen + tcphlen))) == NULL) {

                        goto freeit;
                        goto freeit;

+               }

 
                /*
                 * Reinit pointers derived from mbuf data pointer
 
                /*
                 * Reinit pointers derived from mbuf data pointer


@@ -321,61 +327,62 @@ icmp_error(
 
                icmpelen = max(tcphlen, min(icmp_datalen,
                    (oip->ip_len - oiphlen)));
 
                icmpelen = max(tcphlen, min(icmp_datalen,
                    (oip->ip_len - oiphlen)));

-       } else
-stdreply:      icmpelen = max(ICMP_MINLEN, min(icmp_datalen,
+       } else {
+stdreply:       icmpelen = max(ICMP_MINLEN, min(icmp_datalen,

                    (oip->ip_len - oiphlen)));
                    (oip->ip_len - oiphlen)));

+       }

 
        icmplen = min(oiphlen + icmpelen, nlen);
 
        icmplen = min(oiphlen + icmpelen, nlen);

-       if (icmplen < sizeof(struct ip))
+       if (icmplen < sizeof(struct ip)) {

                goto freeit;
                goto freeit;

+       }

 
        /*
         * First, formulate icmp message
         * Allocate enough space for the IP header, ICMP header
         * and the payload (part of the original message to be sent back).
         */
 
        /*
         * First, formulate icmp message
         * Allocate enough space for the IP header, ICMP header
         * and the payload (part of the original message to be sent back).
         */

-       if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen))
-               m = m_gethdr(M_DONTWAIT, MT_HEADER);    /* MAC-OK */
-       else
+       if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen)) {
+               m = m_gethdr(M_DONTWAIT, MT_HEADER);    /* MAC-OK */
+       } else {

                m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
                m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);

+       }

 
 

-       if (m == NULL)
+       if (m == NULL) {

                goto freeit;
                goto freeit;

+       }

 
 

-#if CONFIG_MACF_NET
-       mac_mbuf_label_associate_netlayer(n, m);
-#endif

        /*
         * Further refine the payload length to the space
         * remaining in mbuf after including the IP header and ICMP
         * header.
         */
        /*
         * Further refine the payload length to the space
         * remaining in mbuf after including the IP header and ICMP
         * header.
         */

-       icmplen = min(icmplen, M_TRAILINGSPACE(m) -
-           sizeof(struct ip) - ICMP_MINLEN);
+       icmplen = min(icmplen, (u_int)M_TRAILINGSPACE(m) -
+           (u_int)(sizeof(struct ip) - ICMP_MINLEN));

        m_align(m, ICMP_MINLEN + icmplen);
        m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */
 
        icp = mtod(m, struct icmp *);
        icmpstat.icps_outhist[type]++;
        m_align(m, ICMP_MINLEN + icmplen);
        m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */
 
        icp = mtod(m, struct icmp *);
        icmpstat.icps_outhist[type]++;

-       icp->icmp_type = type;
-       if (type == ICMP_REDIRECT)
+       icp->icmp_type = (u_char)type;
+       if (type == ICMP_REDIRECT) {

                icp->icmp_gwaddr.s_addr = dest;
                icp->icmp_gwaddr.s_addr = dest;

-       else {
+       } else {

                icp->icmp_void = 0;
                /*
                 * The following assignments assume an overlay with the
                 * zeroed icmp_void field.
                 */
                if (type == ICMP_PARAMPROB) {
                icp->icmp_void = 0;
                /*
                 * The following assignments assume an overlay with the
                 * zeroed icmp_void field.
                 */
                if (type == ICMP_PARAMPROB) {

-                       icp->icmp_pptr = code;
+                       icp->icmp_pptr = (u_char)code;

                        code = 0;
                } else if (type == ICMP_UNREACH &&
                    code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) {
                        code = 0;
                } else if (type == ICMP_UNREACH &&
                    code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) {

-                       icp->icmp_nextmtu = htons(nextmtu);
+                       icp->icmp_nextmtu = htons((uint16_t)nextmtu);

                }
        }
 
                }
        }
 

-       icp->icmp_code = code;
+       icp->icmp_code = (u_char)code;

 
        /*
         * Copy icmplen worth of content from original
 
        /*
         * Copy icmplen worth of content from original


@@ -394,17 +401,14 @@ stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen,
        /*
         * Set up ICMP message mbuf and copy old IP header (without options
         * in front of ICMP message.
        /*
         * Set up ICMP message mbuf and copy old IP header (without options
         * in front of ICMP message.

-        * If the original mbuf was meant to bypass the firewall, the error
-        * reply should bypass as well.
-         */
-       m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
+        */

        m->m_data -= sizeof(struct ip);
        m->m_len += sizeof(struct ip);
        m->m_pkthdr.len = m->m_len;
        m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
        nip = mtod(m, struct ip *);
        bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
        m->m_data -= sizeof(struct ip);
        m->m_len += sizeof(struct ip);
        m->m_pkthdr.len = m->m_len;
        m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
        nip = mtod(m, struct ip *);
        bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));

-       nip->ip_len = m->m_len;
+       nip->ip_len = (uint16_t)m->m_len;

        nip->ip_vhl = IP_VHL_BORING;
        nip->ip_p = IPPROTO_ICMP;
        nip->ip_tos = 0;
        nip->ip_vhl = IP_VHL_BORING;
        nip->ip_p = IPPROTO_ICMP;
        nip->ip_tos = 0;


@@ -428,6 +432,7 @@ icmp_input(struct mbuf *m, int hlen)
        struct in_ifaddr *ia;
        void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
        int code;
        struct in_ifaddr *ia;
        void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
        int code;

+       boolean_t should_log_redirect = false;

 
        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);


@@ -439,7 +444,7 @@ icmp_input(struct mbuf *m, int hlen)
         * that not corrupted and of at least minimum length.
         */
 #if (DEBUG | DEVELOPMENT)
         * that not corrupted and of at least minimum length.
         */
 #if (DEBUG | DEVELOPMENT)

-       if (icmpprintfs  > 2) {
+       if (icmpprintfs > 2) {

                char src_str[MAX_IPv4_STR_LEN];
                char dst_str[MAX_IPv4_STR_LEN];
 
                char src_str[MAX_IPv4_STR_LEN];
                char dst_str[MAX_IPv4_STR_LEN];
 


@@ -454,7 +459,7 @@ icmp_input(struct mbuf *m, int hlen)
                goto freeit;
        }
        i = hlen + min(icmplen, ICMP_ADVLENMIN);
                goto freeit;
        }
        i = hlen + min(icmplen, ICMP_ADVLENMIN);

-       if (m->m_len < i && (m = m_pullup(m, i)) == 0)  {
+       if (m->m_len < i && (m = m_pullup(m, i)) == 0) {

                icmpstat.icps_tooshort++;
                return;
        }
                icmpstat.icps_tooshort++;
                return;
        }


@@ -470,109 +475,119 @@ icmp_input(struct mbuf *m, int hlen)
        m->m_data -= hlen;
 
 #if (DEBUG | DEVELOPMENT)
        m->m_data -= hlen;
 
 #if (DEBUG | DEVELOPMENT)

-       if (icmpprintfs > 2)
+       if (icmpprintfs > 2) {

                printf("icmp_input, type %d code %d\n", icp->icmp_type,
                    icp->icmp_code);
                printf("icmp_input, type %d code %d\n", icp->icmp_type,
                    icp->icmp_code);

+       }

 #endif
 
        /*
         * Message type specific processing.
         */
 #endif
 
        /*
         * Message type specific processing.
         */

-       if (icp->icmp_type > ICMP_MAXTYPE)
+       if (icp->icmp_type > ICMP_MAXTYPE) {

                goto raw;
                goto raw;

+       }

 
        /* Initialize */
 
        /* Initialize */

-       bzero(&icmpsrc, sizeof (icmpsrc));
-       icmpsrc.sin_len = sizeof (struct sockaddr_in);
+       bzero(&icmpsrc, sizeof(icmpsrc));
+       icmpsrc.sin_len = sizeof(struct sockaddr_in);

        icmpsrc.sin_family = AF_INET;
        icmpsrc.sin_family = AF_INET;

-       bzero(&icmpdst, sizeof (icmpdst));
-       icmpdst.sin_len = sizeof (struct sockaddr_in);
+       bzero(&icmpdst, sizeof(icmpdst));
+       icmpdst.sin_len = sizeof(struct sockaddr_in);

        icmpdst.sin_family = AF_INET;
        icmpdst.sin_family = AF_INET;

-       bzero(&icmpgw, sizeof (icmpgw));
-       icmpgw.sin_len = sizeof (struct sockaddr_in);
+       bzero(&icmpgw, sizeof(icmpgw));
+       icmpgw.sin_len = sizeof(struct sockaddr_in);

        icmpgw.sin_family = AF_INET;
 
        icmpstat.icps_inhist[icp->icmp_type]++;
        code = icp->icmp_code;
        switch (icp->icmp_type) {
        icmpgw.sin_family = AF_INET;
 
        icmpstat.icps_inhist[icp->icmp_type]++;
        code = icp->icmp_code;
        switch (icp->icmp_type) {

-

        case ICMP_UNREACH:
                switch (code) {
        case ICMP_UNREACH:
                switch (code) {

-                       case ICMP_UNREACH_NET:
-                       case ICMP_UNREACH_HOST:
-                       case ICMP_UNREACH_SRCFAIL:
-                       case ICMP_UNREACH_NET_UNKNOWN:
-                       case ICMP_UNREACH_HOST_UNKNOWN:
-                       case ICMP_UNREACH_ISOLATED:
-                       case ICMP_UNREACH_TOSNET:
-                       case ICMP_UNREACH_TOSHOST:
-                       case ICMP_UNREACH_HOST_PRECEDENCE:
-                       case ICMP_UNREACH_PRECEDENCE_CUTOFF:
-                               code = PRC_UNREACH_NET;
-                               break;
+               case ICMP_UNREACH_NET:
+               case ICMP_UNREACH_HOST:
+               case ICMP_UNREACH_SRCFAIL:
+               case ICMP_UNREACH_NET_UNKNOWN:
+               case ICMP_UNREACH_HOST_UNKNOWN:
+               case ICMP_UNREACH_ISOLATED:
+               case ICMP_UNREACH_TOSNET:
+               case ICMP_UNREACH_TOSHOST:
+               case ICMP_UNREACH_HOST_PRECEDENCE:
+               case ICMP_UNREACH_PRECEDENCE_CUTOFF:
+                       code = PRC_UNREACH_NET;
+                       break;

 
 

-                       case ICMP_UNREACH_NEEDFRAG:
-                               code = PRC_MSGSIZE;
-                               break;
+               case ICMP_UNREACH_NEEDFRAG:
+                       code = PRC_MSGSIZE;
+                       break;

 
 

-                       /*
-                        * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
-                        * Treat subcodes 2,3 as immediate RST
-                        */
-                       case ICMP_UNREACH_PROTOCOL:
-                       case ICMP_UNREACH_PORT:
-                               code = PRC_UNREACH_PORT;
-                               break;
+               /*
+                * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
+                * Treat subcodes 2,3 as immediate RST
+                */
+               case ICMP_UNREACH_PROTOCOL:
+               case ICMP_UNREACH_PORT:
+                       code = PRC_UNREACH_PORT;
+                       break;

 
 

-                       case ICMP_UNREACH_NET_PROHIB:
-                       case ICMP_UNREACH_HOST_PROHIB:
-                       case ICMP_UNREACH_FILTER_PROHIB:
-                               code = PRC_UNREACH_ADMIN_PROHIB;
-                               break;
+               case ICMP_UNREACH_NET_PROHIB:
+               case ICMP_UNREACH_HOST_PROHIB:
+               case ICMP_UNREACH_FILTER_PROHIB:
+                       code = PRC_UNREACH_ADMIN_PROHIB;
+                       break;

 
 

-                       default:
-                               goto badcode;
+               default:
+                       goto badcode;

                }
                goto deliver;
 
        case ICMP_TIMXCEED:
                }
                goto deliver;
 
        case ICMP_TIMXCEED:

-               if (code > 1)
+               if (code > 1) {

                        goto badcode;
                        goto badcode;

+               }

                code += PRC_TIMXCEED_INTRANS;
                goto deliver;
 
        case ICMP_PARAMPROB:
                code += PRC_TIMXCEED_INTRANS;
                goto deliver;
 
        case ICMP_PARAMPROB:

-               if (code > 1)
+               if (code > 1) {

                        goto badcode;
                        goto badcode;

+               }

                code = PRC_PARAMPROB;
                goto deliver;
 
        case ICMP_SOURCEQUENCH:
                code = PRC_PARAMPROB;
                goto deliver;
 
        case ICMP_SOURCEQUENCH:

-               if (code)
+               if (code) {

                        goto badcode;
                        goto badcode;

+               }

                code = PRC_QUENCH;
                code = PRC_QUENCH;

-       deliver:
+deliver:

                /*
                 * Problem with datagram; advise higher level routines.
                 */
                if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp)
                    || IP_VHL_HL(icp->icmp_ip.ip_vhl) <
                /*
                 * Problem with datagram; advise higher level routines.
                 */
                if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp)
                    || IP_VHL_HL(icp->icmp_ip.ip_vhl) <

-                   (sizeof(struct ip) >> 2)) {
+                   (sizeof(struct ip) >> 2) ||
+                   (m = m_pullup(m, hlen + ICMP_ADVLEN(icp))) == NULL) {

                        icmpstat.icps_badlen++;
                        goto freeit;
                }
 
                        icmpstat.icps_badlen++;
                        goto freeit;
                }
 

+               ip = mtod(m, struct ip *);
+               icp = (struct icmp *)(void *)(mtod(m, uint8_t *) + hlen);
+

 #if BYTE_ORDER != BIG_ENDIAN
                NTOHS(icp->icmp_ip.ip_len);
 #endif
 
                /* Discard ICMP's in response to multicast packets */
 #if BYTE_ORDER != BIG_ENDIAN
                NTOHS(icp->icmp_ip.ip_len);
 #endif
 
                /* Discard ICMP's in response to multicast packets */

-               if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
+               if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr))) {

                        goto badcode;
                        goto badcode;

+               }

 #if (DEBUG | DEVELOPMENT)
 #if (DEBUG | DEVELOPMENT)

-               if (icmpprintfs > 2)
+               if (icmpprintfs > 2) {

                        printf("deliver to protocol %d\n",
                            icp->icmp_ip.ip_p);
                        printf("deliver to protocol %d\n",
                            icp->icmp_ip.ip_p);

+               }

 #endif
                icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
 
 #endif
                icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
 


@@ -588,24 +603,24 @@ icmp_input(struct mbuf *m, int hlen)
                        lck_mtx_unlock(inet_domain_mutex);
 
                        (*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
                        lck_mtx_unlock(inet_domain_mutex);
 
                        (*ctlfunc)(code, (struct sockaddr *)&icmpsrc,

-                                  (void *)&icp->icmp_ip, m->m_pkthdr.rcvif);
+                           (void *)&icp->icmp_ip, m->m_pkthdr.rcvif);

 
                        lck_mtx_lock(inet_domain_mutex);
                }
                break;
 
 
                        lck_mtx_lock(inet_domain_mutex);
                }
                break;
 

-       badcode:
+badcode:

                icmpstat.icps_badcode++;
                break;
 
        case ICMP_ECHO:
                icmpstat.icps_badcode++;
                break;
 
        case ICMP_ECHO:

-               if ((m->m_flags & (M_MCAST | M_BCAST))) {               
+               if ((m->m_flags & (M_MCAST | M_BCAST))) {

                        if (icmpbmcastecho == 0) {
                                icmpstat.icps_bmcastecho++;
                                break;
                        }
                }
                        if (icmpbmcastecho == 0) {
                                icmpstat.icps_bmcastecho++;
                                break;
                        }
                }

-               
+

                /*
                 * rdar://18644769
                 * Do not reply when the destination is link local multicast or broadcast
                /*
                 * rdar://18644769
                 * Do not reply when the destination is link local multicast or broadcast


@@ -631,15 +646,16 @@ icmp_input(struct mbuf *m, int hlen)
 
                icp->icmp_type = ICMP_ECHOREPLY;
 #if ICMP_BANDLIM
 
                icp->icmp_type = ICMP_ECHOREPLY;
 #if ICMP_BANDLIM

-               if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
+               if (badport_bandlim(BANDLIM_ICMP_ECHO)) {

                        goto freeit;
                        goto freeit;

-               else
+               } else

 #endif
 #endif

-                       goto reflect;
+               goto reflect;

 
        case ICMP_TSTAMP:
 
        case ICMP_TSTAMP:

-               if (icmptimestamp == 0)
+               if (icmptimestamp == 0) {

                        break;
                        break;

+               }

 
                if (!icmpbmcastecho
                    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
 
                if (!icmpbmcastecho
                    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {


@@ -652,25 +668,26 @@ icmp_input(struct mbuf *m, int hlen)
                }
                icp->icmp_type = ICMP_TSTAMPREPLY;
                icp->icmp_rtime = iptime();
                }
                icp->icmp_type = ICMP_TSTAMPREPLY;
                icp->icmp_rtime = iptime();

-               icp->icmp_ttime = icp->icmp_rtime;      /* bogus, do later! */
+               icp->icmp_ttime = icp->icmp_rtime;      /* bogus, do later! */

 #if ICMP_BANDLIM
 #if ICMP_BANDLIM

-               if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
+               if (badport_bandlim(BANDLIM_ICMP_TSTAMP)) {

                        goto freeit;
                        goto freeit;

-               else
+               } else

 #endif
 #endif

-                       goto reflect;
+               goto reflect;

 
        case ICMP_MASKREQ:
 
        case ICMP_MASKREQ:

-               if (icmpmaskrepl == 0)
+               if (icmpmaskrepl == 0) {

                        break;
                        break;

+               }

                /*
                 * We are not able to respond with all ones broadcast
                 * unless we receive it over a point-to-point interface.
                 */
                /*
                 * We are not able to respond with all ones broadcast
                 * unless we receive it over a point-to-point interface.
                 */

-               if (icmplen < ICMP_MASKLEN)
+               if (icmplen < ICMP_MASKLEN) {

                        break;
                        break;

+               }

                switch (ip->ip_dst.s_addr) {
                switch (ip->ip_dst.s_addr) {

-

                case INADDR_BROADCAST:
                case INADDR_ANY:
                        icmpdst.sin_addr = ip->ip_src;
                case INADDR_BROADCAST:
                case INADDR_ANY:
                        icmpdst.sin_addr = ip->ip_src;


@@ -680,9 +697,10 @@ icmp_input(struct mbuf *m, int hlen)
                        icmpdst.sin_addr = ip->ip_dst;
                }
                ia = (struct in_ifaddr *)ifaof_ifpforaddr(
                        icmpdst.sin_addr = ip->ip_dst;
                }
                ia = (struct in_ifaddr *)ifaof_ifpforaddr(

-                           (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
-               if (ia == 0)
+                       (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
+               if (ia == 0) {

                        break;
                        break;

+               }

                IFA_LOCK(&ia->ia_ifa);
                if (ia->ia_ifp == 0) {
                        IFA_UNLOCK(&ia->ia_ifa);
                IFA_LOCK(&ia->ia_ifa);
                if (ia->ia_ifp == 0) {
                        IFA_UNLOCK(&ia->ia_ifa);


@@ -693,45 +711,39 @@ icmp_input(struct mbuf *m, int hlen)
                icp->icmp_type = ICMP_MASKREPLY;
                icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
                if (ip->ip_src.s_addr == 0) {
                icp->icmp_type = ICMP_MASKREPLY;
                icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
                if (ip->ip_src.s_addr == 0) {

-                       if (ia->ia_ifp->if_flags & IFF_BROADCAST)
-                           ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
-                       else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
-                           ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
+                       if (ia->ia_ifp->if_flags & IFF_BROADCAST) {
+                               ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
+                       } else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) {
+                               ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
+                       }

                }
                IFA_UNLOCK(&ia->ia_ifa);
                IFA_REMREF(&ia->ia_ifa);
 reflect:
                }
                IFA_UNLOCK(&ia->ia_ifa);
                IFA_REMREF(&ia->ia_ifa);
 reflect:

-               ip->ip_len += hlen;     /* since ip_input deducts this */
+               ip->ip_len += hlen;     /* since ip_input deducts this */

                icmpstat.icps_reflect++;
                icmpstat.icps_outhist[icp->icmp_type]++;
                icmp_reflect(m);
                return;
 
        case ICMP_REDIRECT:
                icmpstat.icps_reflect++;
                icmpstat.icps_outhist[icp->icmp_type]++;
                icmp_reflect(m);
                return;
 
        case ICMP_REDIRECT:

-               if (log_redirect) {
-                       u_int32_t src, dst, gw;
-
-                       src = ntohl(ip->ip_src.s_addr);
-                       dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
-                       gw = ntohl(icp->icmp_gwaddr.s_addr);
-                       printf("icmp redirect from %d.%d.%d.%d: "
-                              "%d.%d.%d.%d => %d.%d.%d.%d\n",
-                              (int)(src >> 24), (int)((src >> 16) & 0xff),
-                              (int)((src >> 8) & 0xff), (int)(src & 0xff),
-                              (int)(dst >> 24), (int)((dst >> 16) & 0xff),
-                              (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
-                              (int)(gw >> 24), (int)((gw >> 16) & 0xff),
-                              (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
-               }
-               if (drop_redirect)
+               if (drop_redirect) {

                        break;
                        break;

-               if (code > 3)
+               }
+               if (code > 3) {

                        goto badcode;
                        goto badcode;

+               }

                if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
                    IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
                        icmpstat.icps_badlen++;
                        break;
                }
                if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
                    IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
                        icmpstat.icps_badlen++;
                        break;
                }

+
+#if (DEBUG | DEVELOPMENT)
+               should_log_redirect = log_redirect || (icmpprintfs > 0);
+#else
+               should_log_redirect = log_redirect;
+#endif

                /*
                 * Short circuit routing redirects to force
                 * immediate change in the kernel's routing
                /*
                 * Short circuit routing redirects to force
                 * immediate change in the kernel's routing


@@ -741,20 +753,22 @@ reflect:
                 */
                icmpgw.sin_addr = ip->ip_src;
                icmpdst.sin_addr = icp->icmp_gwaddr;
                 */
                icmpgw.sin_addr = ip->ip_src;
                icmpdst.sin_addr = icp->icmp_gwaddr;

-#if (DEBUG | DEVELOPMENT)
-               if (icmpprintfs > 0) {
+
+               if (should_log_redirect) {
+                       char src_str[MAX_IPv4_STR_LEN];

                        char dst_str[MAX_IPv4_STR_LEN];
                        char gw_str[MAX_IPv4_STR_LEN];
 
                        char dst_str[MAX_IPv4_STR_LEN];
                        char gw_str[MAX_IPv4_STR_LEN];
 

+                       inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));

                        inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str));
                        inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str));
                        inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str));
                        inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str));

-                       printf("%s: redirect dst %s to %s\n", __func__, dst_str, gw_str);
+                       printf("%s: redirect dst %s to %s from %s\n", __func__,
+                           dst_str, gw_str, src_str);

                }
                }

-#endif

                icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
                rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc,
                icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
                rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc,

-                 (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST,
-                 (struct sockaddr *)&icmpgw, NULL);
+                   (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST,
+                   (struct sockaddr *)&icmpgw, NULL);

                pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
 #if IPSEC
                key_sa_routechange((struct sockaddr *)&icmpsrc);
                pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
 #if IPSEC
                key_sa_routechange((struct sockaddr *)&icmpsrc);


@@ -798,9 +812,9 @@ icmp_reflect(struct mbuf *m)
 
        if (!in_canforward(ip->ip_src) &&
            ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
 
        if (!in_canforward(ip->ip_src) &&
            ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=

-            (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
-               m_freem(m);     /* Bad return address */
-               goto done;      /* Ip_output() will check for broadcast */
+           (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
+               m_freem(m);     /* Bad return address */
+               goto done;      /* Ip_output() will check for broadcast */

        }
        t = ip->ip_dst;
        ip->ip_dst = ip->ip_src;
        }
        t = ip->ip_dst;
        ip->ip_dst = ip->ip_src;


@@ -839,13 +853,14 @@ match:
        lck_rw_done(in_ifaddr_rwlock);
 
        /* Initialize */
        lck_rw_done(in_ifaddr_rwlock);
 
        /* Initialize */

-       bzero(&icmpdst, sizeof (icmpdst));
-       icmpdst.sin_len = sizeof (struct sockaddr_in);
+       bzero(&icmpdst, sizeof(icmpdst));
+       icmpdst.sin_len = sizeof(struct sockaddr_in);

        icmpdst.sin_family = AF_INET;
        icmpdst.sin_addr = t;
        icmpdst.sin_family = AF_INET;
        icmpdst.sin_addr = t;

-       if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif)
+       if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif) {

                ia = (struct in_ifaddr *)ifaof_ifpforaddr(
                        (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
                ia = (struct in_ifaddr *)ifaof_ifpforaddr(
                        (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);

+       }

        /*
         * The following happens if the packet was not addressed to us,
         * and was received on an interface with no IP address.
        /*
         * The following happens if the packet was not addressed to us,
         * and was received on an interface with no IP address.


@@ -861,14 +876,11 @@ match:
                IFA_ADDREF(&ia->ia_ifa);
                lck_rw_done(in_ifaddr_rwlock);
        }
                IFA_ADDREF(&ia->ia_ifa);
                lck_rw_done(in_ifaddr_rwlock);
        }

-#if CONFIG_MACF_NET
-       mac_netinet_icmp_reply(m);
-#endif

        IFA_LOCK_SPIN(&ia->ia_ifa);
        t = IA_SIN(ia)->sin_addr;
        IFA_UNLOCK(&ia->ia_ifa);
        ip->ip_src = t;
        IFA_LOCK_SPIN(&ia->ia_ifa);
        t = IA_SIN(ia)->sin_addr;
        IFA_UNLOCK(&ia->ia_ifa);
        ip->ip_src = t;

-       ip->ip_ttl = ip_defttl;
+       ip->ip_ttl = (u_char)ip_defttl;

        IFA_REMREF(&ia->ia_ifa);
        ia = NULL;
 
        IFA_REMREF(&ia->ia_ifa);
        ia = NULL;
 


@@ -883,52 +895,57 @@ match:
                 */
                cp = (u_char *) (ip + 1);
                if ((opts = ip_srcroute()) == 0 &&
                 */
                cp = (u_char *) (ip + 1);
                if ((opts = ip_srcroute()) == 0 &&

-                   (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */
+                   (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */

                        opts->m_len = sizeof(struct in_addr);
                        mtod(opts, struct in_addr *)->s_addr = 0;
                }
                if (opts) {
 #if (DEBUG | DEVELOPMENT)
                        opts->m_len = sizeof(struct in_addr);
                        mtod(opts, struct in_addr *)->s_addr = 0;
                }
                if (opts) {
 #if (DEBUG | DEVELOPMENT)

-                   if (icmpprintfs > 1)
-                           printf("icmp_reflect optlen %d rt %d => ",
-                               optlen, opts->m_len);
+                       if (icmpprintfs > 1) {
+                               printf("icmp_reflect optlen %d rt %d => ",
+                                   optlen, opts->m_len);
+                       }

 #endif
 #endif

-                   for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
-                           opt = cp[IPOPT_OPTVAL];
-                           if (opt == IPOPT_EOL)
-                                   break;
-                           if (opt == IPOPT_NOP)
-                                   len = 1;
-                           else {
-                                   if (cnt < IPOPT_OLEN + sizeof(*cp))
-                                           break;
-                                   len = cp[IPOPT_OLEN];
-                                   if (len < IPOPT_OLEN + sizeof(*cp) ||
-                                       len > cnt)
-                                           break;
-                           }
-                           /*
-                            * Should check for overflow, but it "can't happen"
-                            */
-                           if (opt == IPOPT_RR || opt == IPOPT_TS ||
-                               opt == IPOPT_SECURITY) {
-                                   bcopy((caddr_t)cp,
-                                       mtod(opts, caddr_t) + opts->m_len, len);
-                                   opts->m_len += len;
-                           }
-                   }
-                   /* Terminate & pad, if necessary */
-                   cnt = opts->m_len % 4;
-                   if (cnt) {
-                           for (; cnt < 4; cnt++) {
-                                   *(mtod(opts, caddr_t) + opts->m_len) =
-                                       IPOPT_EOL;
-                                   opts->m_len++;
-                           }
-                   }
+                       for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
+                               opt = cp[IPOPT_OPTVAL];
+                               if (opt == IPOPT_EOL) {
+                                       break;
+                               }
+                               if (opt == IPOPT_NOP) {
+                                       len = 1;
+                               } else {
+                                       if (cnt < IPOPT_OLEN + sizeof(*cp)) {
+                                               break;
+                                       }
+                                       len = cp[IPOPT_OLEN];
+                                       if (len < IPOPT_OLEN + sizeof(*cp) ||
+                                           len > cnt) {
+                                               break;
+                                       }
+                               }
+                               /*
+                                * Should check for overflow, but it "can't happen"
+                                */
+                               if (opt == IPOPT_RR || opt == IPOPT_TS ||
+                                   opt == IPOPT_SECURITY) {
+                                       bcopy((caddr_t)cp,
+                                           mtod(opts, caddr_t) + opts->m_len, len);
+                                       opts->m_len += len;
+                               }
+                       }
+                       /* Terminate & pad, if necessary */
+                       cnt = opts->m_len % 4;
+                       if (cnt) {
+                               for (; cnt < 4; cnt++) {
+                                       *(mtod(opts, caddr_t) + opts->m_len) =
+                                           IPOPT_EOL;
+                                       opts->m_len++;
+                               }
+                       }

 #if (DEBUG | DEVELOPMENT)
 #if (DEBUG | DEVELOPMENT)

-                   if (icmpprintfs > 1)
-                           printf("%d\n", opts->m_len);
+                       if (icmpprintfs > 1) {
+                               printf("%d\n", opts->m_len);
+                       }

 #endif
                }
                /*
 #endif
                }
                /*


@@ -938,17 +955,19 @@ match:
                ip->ip_len -= optlen;
                ip->ip_vhl = IP_VHL_BORING;
                m->m_len -= optlen;
                ip->ip_len -= optlen;
                ip->ip_vhl = IP_VHL_BORING;
                m->m_len -= optlen;

-               if (m->m_flags & M_PKTHDR)
+               if (m->m_flags & M_PKTHDR) {

                        m->m_pkthdr.len -= optlen;
                        m->m_pkthdr.len -= optlen;

+               }

                optlen += sizeof(struct ip);
                bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
                optlen += sizeof(struct ip);
                bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),

-                        (unsigned)(m->m_len - sizeof(struct ip)));
+                   (unsigned)(m->m_len - sizeof(struct ip)));

        }
        }

-       m->m_flags &= ~(M_BCAST|M_MCAST);
+       m->m_flags &= ~(M_BCAST | M_MCAST);

        icmp_send(m, opts);
 done:
        icmp_send(m, opts);
 done:

-       if (opts)
+       if (opts) {

                (void)m_free(opts);
                (void)m_free(opts);

+       }

 }
 
 /*
 }
 
 /*


@@ -1008,8 +1027,8 @@ iptime(void)
        u_int32_t t;
 
        getmicrotime(&atv);
        u_int32_t t;
 
        getmicrotime(&atv);

-       t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
-       return (htonl(t));
+       t = (atv.tv_sec % (24 * 60 * 60)) * 1000 + atv.tv_usec / 1000;
+       return htonl(t);

 }
 
 #if 1
 }
 
 #if 1


@@ -1028,8 +1047,9 @@ ip_next_mtu(int mtu, int dir)
        int i;
 
        for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
        int i;
 
        for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {

-               if (mtu >= mtutab[i])
+               if (mtu >= mtutab[i]) {

                        break;
                        break;

+               }

        }
 
        if (dir < 0) {
        }
 
        if (dir < 0) {


@@ -1041,7 +1061,7 @@ ip_next_mtu(int mtu, int dir)
        } else {
                if (mtutab[i] == 0) {
                        return 0;
        } else {
                if (mtutab[i] == 0) {
                        return 0;

-               } else if(mtu > mtutab[i]) {
+               } else if (mtu > mtutab[i]) {

                        return mtutab[i];
                } else {
                        return mtutab[i + 1];
                        return mtutab[i];
                } else {
                        return mtutab[i + 1];


@@ -1056,7 +1076,7 @@ ip_next_mtu(int mtu, int dir)
  * badport_bandlim() - check for ICMP bandwidth limit
  *
  *     Return 0 if it is ok to send an ICMP error response, -1 if we have
  * badport_bandlim() - check for ICMP bandwidth limit
  *
  *     Return 0 if it is ok to send an ICMP error response, -1 if we have

- *     hit our bandwidth limit and it is not ok.  
+ *     hit our bandwidth limit and it is not ok.

  *
  *     If icmplim is <= 0, the feature is disabled and 0 is returned.
  *
  *
  *     If icmplim is <= 0, the feature is disabled and 0 is returned.
  *


@@ -1067,17 +1087,17 @@ ip_next_mtu(int mtu, int dir)
  *     Note that the printing of the error message is delayed so we can
  *     properly print the icmp error rate that the system was trying to do
  *     (i.e. 22000/100 pps, etc...).  This can cause long delays in printing
  *     Note that the printing of the error message is delayed so we can
  *     properly print the icmp error rate that the system was trying to do
  *     (i.e. 22000/100 pps, etc...).  This can cause long delays in printing

- *     the 'final' error, but it doesn't make sense to solve the printing 
+ *     the 'final' error, but it doesn't make sense to solve the printing

  *     delay with more complex code.
  */
 
  *     delay with more complex code.
  */
 

-int
+boolean_t

 badport_bandlim(int which)
 {
        static uint64_t lticks[BANDLIM_MAX + 1];
        static int lpackets[BANDLIM_MAX + 1];
 badport_bandlim(int which)
 {
        static uint64_t lticks[BANDLIM_MAX + 1];
        static int lpackets[BANDLIM_MAX + 1];

-       uint64_t time = net_uptime();
-       int secs;
+       uint64_t time;
+       uint64_t secs;

 
        const char *bandlimittype[] = {
                "Limiting icmp unreach response",
 
        const char *bandlimittype[] = {
                "Limiting icmp unreach response",


@@ -1085,16 +1105,15 @@ badport_bandlim(int which)
                "Limiting icmp tstamp response",
                "Limiting closed port RST response",
                "Limiting open port RST response"
                "Limiting icmp tstamp response",
                "Limiting closed port RST response",
                "Limiting open port RST response"

-               };
+       };

 
 

-       /*
-        * Return ok status if feature disabled or argument out of
-        * ranage.
-        */
+       /* Return ok status if feature disabled or argument out of range. */

 
 

-       if (icmplim <= 0 || which > BANDLIM_MAX || which < 0)
-               return(0);
+       if (icmplim <= 0 || which > BANDLIM_MAX || which < 0) {
+               return false;
+       }

 
 

+       time = net_uptime();

        secs = time - lticks[which];
 
        /*
        secs = time - lticks[which];
 
        /*


@@ -1104,10 +1123,10 @@ badport_bandlim(int which)
        if (secs > 1) {
                if (lpackets[which] > icmplim) {
                        printf("%s from %d to %d packets per second\n",
        if (secs > 1) {
                if (lpackets[which] > icmplim) {
                        printf("%s from %d to %d packets per second\n",

-                               bandlimittype[which],
-                               lpackets[which],
-                               icmplim
-                       );
+                           bandlimittype[which],
+                           lpackets[which],
+                           icmplim
+                           );

                }
                lticks[which] = time;
                lpackets[which] = 0;
                }
                lticks[which] = time;
                lpackets[which] = 0;


@@ -1118,9 +1137,9 @@ badport_bandlim(int which)
         */
 
        if (++lpackets[which] > icmplim) {
         */
 
        if (++lpackets[which] > icmplim) {

-               return(-1);
+               return true;

        }
        }

-       return(0);
+       return false;

 }
 
 #endif
 }
 
 #endif


@@ -1153,43 +1172,46 @@ __private_extern__ int icmp_dgram_attach(struct socket *so, int proto, struct pr
 __private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt);
 
 __private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = {
 __private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt);
 
 __private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = {

-       .pru_abort =            rip_abort,
-       .pru_attach =           icmp_dgram_attach,
-       .pru_bind =             rip_bind,
-       .pru_connect =          rip_connect,
-       .pru_control =          in_control,
-       .pru_detach =           rip_detach,
-       .pru_disconnect =       rip_disconnect,
-       .pru_peeraddr =         in_getpeeraddr,
-       .pru_send =             icmp_dgram_send,
-       .pru_shutdown =         rip_shutdown,
-       .pru_sockaddr =         in_getsockaddr,
-       .pru_sosend =           sosend,
-       .pru_soreceive =        soreceive,
+       .pru_abort =            rip_abort,
+       .pru_attach =           icmp_dgram_attach,
+       .pru_bind =             rip_bind,
+       .pru_connect =          rip_connect,
+       .pru_control =          in_control,
+       .pru_detach =           rip_detach,
+       .pru_disconnect =       rip_disconnect,
+       .pru_peeraddr =         in_getpeeraddr,
+       .pru_send =             icmp_dgram_send,
+       .pru_shutdown =         rip_shutdown,
+       .pru_sockaddr =         in_getsockaddr,
+       .pru_sosend =           sosend,
+       .pru_soreceive =        soreceive,

 };
 
 /* Like rip_attach but without root privilege enforcement */
 __private_extern__ int
 icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
 {
 };
 
 /* Like rip_attach but without root privilege enforcement */
 __private_extern__ int
 icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
 {

-        struct inpcb *inp;
-        int error;
-
-        inp = sotoinpcb(so);
-        if (inp)
-                panic("icmp_dgram_attach");
-
-        error = soreserve(so, rip_sendspace, rip_recvspace);
-        if (error)
-                return error;
-        error = in_pcballoc(so, &ripcbinfo, p);
-        if (error)
-                return error;
-        inp = (struct inpcb *)so->so_pcb;       
-        inp->inp_vflag |= INP_IPV4;
-        inp->inp_ip_p = IPPROTO_ICMP;
-        inp->inp_ip_ttl = ip_defttl;
-        return 0;
+       struct inpcb *inp;
+       int error;
+
+       inp = sotoinpcb(so);
+       if (inp) {
+               panic("icmp_dgram_attach");
+       }
+
+       error = soreserve(so, rip_sendspace, rip_recvspace);
+       if (error) {
+               return error;
+       }
+       error = in_pcballoc(so, &ripcbinfo, p);
+       if (error) {
+               return error;
+       }
+       inp = (struct inpcb *)so->so_pcb;
+       inp->inp_vflag |= INP_IPV4;
+       inp->inp_ip_p = IPPROTO_ICMP;
+       inp->inp_ip_ttl = (u_char)ip_defttl;
+       return 0;

 }
 
 /*
 }
 
 /*


@@ -1198,43 +1220,45 @@ icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
 __private_extern__ int
 icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
 {
 __private_extern__ int
 icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
 {

-       int     error;
+       int     error;

 
 

-       if (sopt->sopt_level != IPPROTO_IP)
-               return (EINVAL);
+       if (sopt->sopt_level != IPPROTO_IP) {
+               return EINVAL;
+       }

 
        switch (sopt->sopt_name) {
 
        switch (sopt->sopt_name) {

-               case IP_OPTIONS:
-               case IP_HDRINCL:
-               case IP_TOS:
-               case IP_TTL:
-               case IP_RECVOPTS:
-               case IP_RECVRETOPTS:
-               case IP_RECVDSTADDR:
-               case IP_RETOPTS:
-               case IP_MULTICAST_IF:
-               case IP_MULTICAST_IFINDEX:
-               case IP_MULTICAST_TTL:
-               case IP_MULTICAST_LOOP:
-               case IP_ADD_MEMBERSHIP:
-               case IP_DROP_MEMBERSHIP:
-               case IP_MULTICAST_VIF:
-               case IP_PORTRANGE:
-               case IP_RECVIF:
-               case IP_IPSEC_POLICY:
-               case IP_STRIPHDR:
-               case IP_RECVTTL:
-               case IP_BOUND_IF:
-               case IP_NO_IFT_CELLULAR:
-                       error = rip_ctloutput(so, sopt);
-                       break;
+       case IP_OPTIONS:
+       case IP_HDRINCL:
+       case IP_TOS:
+       case IP_TTL:
+       case IP_RECVOPTS:
+       case IP_RECVRETOPTS:
+       case IP_RECVDSTADDR:
+       case IP_RETOPTS:
+       case IP_MULTICAST_IF:
+       case IP_MULTICAST_IFINDEX:
+       case IP_MULTICAST_TTL:
+       case IP_MULTICAST_LOOP:
+       case IP_ADD_MEMBERSHIP:
+       case IP_DROP_MEMBERSHIP:
+       case IP_MULTICAST_VIF:
+       case IP_PORTRANGE:
+       case IP_RECVIF:
+       case IP_IPSEC_POLICY:
+       case IP_STRIPHDR:
+       case IP_RECVTTL:
+       case IP_BOUND_IF:
+       case IP_DONTFRAG:
+       case IP_NO_IFT_CELLULAR:
+               error = rip_ctloutput(so, sopt);
+               break;

 
 

-               default:
-                       error = EINVAL;
-                       break;
+       default:
+               error = EINVAL;
+               break;

        }
 
        }
 

-       return (error);
+       return error;

 }
 
 __private_extern__ int
 }
 
 __private_extern__ int


@@ -1245,21 +1269,32 @@ icmp_dgram_send(struct socket *so, int flags, struct mbuf *m,
        struct inpcb *inp = sotoinpcb(so);
        int hlen;
        struct icmp *icp;
        struct inpcb *inp = sotoinpcb(so);
        int hlen;
        struct icmp *icp;

-        struct in_ifaddr *ia = NULL;
+       struct in_ifaddr *ia = NULL;

        int icmplen;
        int error = EINVAL;
        int icmplen;
        int error = EINVAL;

+       int inp_flags = inp ? inp->inp_flags : 0;

 
        if (inp == NULL
 #if NECP
 
        if (inp == NULL
 #if NECP

-               || (necp_socket_should_use_flow_divert(inp))
+           || (necp_socket_should_use_flow_divert(inp))

 #endif /* NECP */
 #endif /* NECP */

-               ) {
-               if (inp != NULL)
+           ) {
+               if (inp != NULL) {

                        error = EPROTOTYPE;
                        error = EPROTOTYPE;

+               }

                goto bad;
        }
 
                goto bad;
        }
 

-       if ((inp->inp_flags & INP_HDRINCL) != 0) {
+#if CONTENT_FILTER
+       /*
+        * If socket is subject to Content Filter, get inp_flags from saved state
+        */
+       if (so->so_cfil_db && nam == NULL) {
+               cfil_dgram_peek_socket_state(m, &inp_flags);
+       }
+#endif
+
+       if ((inp_flags & INP_HDRINCL) != 0) {

                /* Expect 32-bit aligned data ptr on strict-align platforms */
                MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
                /*
                /* Expect 32-bit aligned data ptr on strict-align platforms */
                MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
                /*


@@ -1274,16 +1309,20 @@ icmp_dgram_send(struct socket *so, int flags, struct mbuf *m,
                        goto bad;
                }
                /* Only IPv4 */
                        goto bad;
                }
                /* Only IPv4 */

-               if (IP_VHL_V(ip->ip_vhl) != 4)
+               if (IP_VHL_V(ip->ip_vhl) != 4) {

                        goto bad;
                        goto bad;

-               if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len)
+               }
+               if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len) {

                        goto bad;
                        goto bad;

+               }

                /* Bogus fragments can tie up peer resources */
                /* Bogus fragments can tie up peer resources */

-               if ((ip->ip_off & ~IP_DF) !=  0)
+               if ((ip->ip_off & ~IP_DF) != 0) {

                        goto bad;
                        goto bad;

+               }

                /* Allow only ICMP even for user provided IP header */
                /* Allow only ICMP even for user provided IP header */

-               if (ip->ip_p != IPPROTO_ICMP)
+               if (ip->ip_p != IPPROTO_ICMP) {

                        goto bad;
                        goto bad;

+               }

                /*
                 * To prevent spoofing, specified source address must
                 * be one of ours.
                /*
                 * To prevent spoofing, specified source address must
                 * be one of ours.


@@ -1327,32 +1366,37 @@ ours:
        /*
         * Allow only to send request types with code 0
         */
        /*
         * Allow only to send request types with code 0
         */

-       if (icp->icmp_code != 0)
+       if (icp->icmp_code != 0) {

                goto bad;
                goto bad;

+       }

        switch (icp->icmp_type) {
        switch (icp->icmp_type) {

-               case ICMP_ECHO:
-                       break;
-               case ICMP_TSTAMP:
-                       if (icmplen != 20)
-                               goto bad;
-                       break;
-               case ICMP_MASKREQ:
-                       if (icmplen != 12)
-                               goto bad;
-                       break;
-               default:
+       case ICMP_ECHO:
+               break;
+       case ICMP_TSTAMP:
+               if (icmplen != 20) {

                        goto bad;
                        goto bad;

+               }
+               break;
+       case ICMP_MASKREQ:
+               if (icmplen != 12) {
+                       goto bad;
+               }
+               break;
+       default:
+               goto bad;

        }
        }

-       return (rip_send(so, flags, m, nam, control, p));
+       return rip_send(so, flags, m, nam, control, p);

 bad:
        VERIFY(error != 0);
 
 bad:
        VERIFY(error != 0);
 

-       if (m != NULL)
+       if (m != NULL) {

                m_freem(m);
                m_freem(m);

-       if (control != NULL)
+       }
+       if (control != NULL) {

                m_freem(control);
                m_freem(control);

+       }

 
 

-       return (error);
+       return error;

 }
 
 #endif /* __APPLE__ */
 }
 
 #endif /* __APPLE__ */