X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/2d21ac55c334faf3a56e5634905ed6987fc787d4..d9a64523371fa019c4575bb400cbbc3a50ac9903:/bsd/netinet/ip_icmp.c diff --git a/bsd/netinet/ip_icmp.c b/bsd/netinet/ip_icmp.c index 3ed8a2d45..260449c30 100644 --- a/bsd/netinet/ip_icmp.c +++ b/bsd/netinet/ip_icmp.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000-2007 Apple Inc. All rights reserved. + * Copyright (c) 2000-2018 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * @@ -69,12 +69,15 @@ #include #include #include +#include #include #include #include #include #include +#include + #include #include @@ -98,10 +101,9 @@ #include #endif -#if defined(NFAITH) && NFAITH > 0 -#include "faith.h" -#include -#endif +#if NECP +#include +#endif /* NECP */ /* XXX This one should go in sys/mbuf.h. It is used to avoid that * a firewall-generated packet loops forever through the firewall. @@ -114,68 +116,84 @@ #include #endif /* MAC_NET */ + /* * ICMP routines: error generation, receive packet processing, and * routines to turnaround packets back to the originator, and * host table maintenance routines. */ -static struct icmpstat icmpstat; -SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RD, - &icmpstat, icmpstat, ""); +struct icmpstat icmpstat; +SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, + CTLFLAG_RD | CTLFLAG_LOCKED, + &icmpstat, icmpstat, ""); static int icmpmaskrepl = 0; -SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW, - &icmpmaskrepl, 0, ""); +SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, + CTLFLAG_RW | CTLFLAG_LOCKED, + &icmpmaskrepl, 0, ""); static int icmptimestamp = 0; -SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp, CTLFLAG_RW, - &icmptimestamp, 0, ""); +SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp, + CTLFLAG_RW | CTLFLAG_LOCKED, + &icmptimestamp, 0, ""); -static int drop_redirect = 0; -SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW, - &drop_redirect, 0, ""); +static int drop_redirect = 1; +SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, + CTLFLAG_RW | CTLFLAG_LOCKED, + &drop_redirect, 0, ""); static int log_redirect = 0; -SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW, - &log_redirect, 0, ""); +SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, + CTLFLAG_RW | CTLFLAG_LOCKED, + &log_redirect, 0, ""); + +const static int icmp_datalen = 8; #if ICMP_BANDLIM - + +/* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */ +#ifndef CONFIG_ICMP_BANDLIM +#if !CONFIG_EMBEDDED +#define CONFIG_ICMP_BANDLIM 250 +#else /* CONFIG_EMBEDDED */ +#define CONFIG_ICMP_BANDLIM 50 +#endif /* CONFIG_EMBEDDED */ +#endif /* CONFIG_ICMP_BANDLIM */ + /* * ICMP error-response bandwidth limiting sysctl. If not enabled, sysctl * variable content is -1 and read-only. */ -static int icmplim = 250; -SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW, +static int icmplim = CONFIG_ICMP_BANDLIM; +SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED, &icmplim, 0, ""); -#else + +#else /* ICMP_BANDLIM */ static int icmplim = -1; -SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD, +SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED, &icmplim, 0, ""); -#endif +#endif /* ICMP_BANDLIM */ /* * ICMP broadcast echo sysctl */ static int icmpbmcastecho = 1; -SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW, +SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED, &icmpbmcastecho, 0, ""); - -#if ICMPPRINTFS -int icmpprintfs = 0; +#if (DEBUG | DEVELOPMENT) +static int icmpprintfs = 0; +SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED, + &icmpprintfs, 0, ""); #endif static void icmp_reflect(struct mbuf *); static void icmp_send(struct mbuf *, struct mbuf *); -static int ip_next_mtu(int, int); - -extern struct protosw inetsw[]; /* * Generate an error packet of type error @@ -186,63 +204,158 @@ icmp_error( struct mbuf *n, int type, int code, - n_long dest, - struct ifnet *destifp) + u_int32_t dest, + u_int32_t nextmtu) { - struct ip *oip = mtod(n, struct ip *), *nip; - unsigned oiplen = IP_VHL_HL(oip->ip_vhl) << 2; - struct icmp *icp; - struct mbuf *m; - unsigned icmplen; + struct ip *oip = NULL; + struct ip *nip = NULL; + struct icmp *icp = NULL; + struct mbuf *m = NULL; + u_int32_t oiphlen = 0; + u_int32_t icmplen = 0; + u_int32_t icmpelen = 0; + u_int32_t nlen = 0; + + VERIFY((u_int)type <= ICMP_MAXTYPE); + /* Expect 32-bit aligned data pointer on strict-align platforms */ + MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n); -#if ICMPPRINTFS - if (icmpprintfs) - printf("icmp_error(%p, %x, %d)\n", oip, type, code); -#endif if (type != ICMP_REDIRECT) icmpstat.icps_error++; /* - * Don't send error if not the first fragment of message. - * Don't error if the old packet protocol was ICMP - * error message, only known informational types. + * Don't send error: + * if not the first fragment of message + * if original packet was a multicast or broadcast packet + * if the old packet protocol was ICMP + * error message, only known informational types. + */ + if (n->m_flags & (M_BCAST|M_MCAST)) + goto freeit; + + /* + * Drop if IP header plus ICMP_MINLEN bytes are not contiguous + * in first mbuf. */ - if (oip->ip_off &~ (IP_MF|IP_DF)) + if (n->m_len < sizeof(struct ip) + ICMP_MINLEN) goto freeit; + + oip = mtod(n, struct ip *); + oiphlen = IP_VHL_HL(oip->ip_vhl) << 2; + if (n->m_len < oiphlen + ICMP_MINLEN) + goto freeit; + +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 1) + printf("icmp_error(0x%llx, %x, %d)\n", + (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code); +#endif + + if (oip->ip_off & ~(IP_MF|IP_DF)) + goto freeit; + if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT && - n->m_len >= oiplen + ICMP_MINLEN && - !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) { + n->m_len >= oiphlen + ICMP_MINLEN && + !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))-> + icmp_type)) { icmpstat.icps_oldicmp++; goto freeit; } - /* Don't send error in response to a multicast or broadcast packet */ - if (n->m_flags & (M_BCAST|M_MCAST)) + + /* + * Calculate the length to quote from original packet and prevent + * the ICMP mbuf from overflowing. + * Unfortunatly this is non-trivial since ip_forward() + * sends us truncated packets. + */ + nlen = m_length(n); + if (oip->ip_p == IPPROTO_TCP) { + struct tcphdr *th = NULL; + u_int16_t tcphlen = 0; + + /* + * If the packet got truncated and TCP header + * is not contained in the packet, send out + * standard reply with only IP header as payload + */ + if (oiphlen + sizeof(struct tcphdr) > n->m_len && + n->m_next == NULL) + goto stdreply; + + /* + * Otherwise, pull up to get IP and TCP headers + * together + */ + if (n->m_len < (oiphlen + sizeof(struct tcphdr)) && + (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL) + goto freeit; + + /* + * Reinit pointers derived from mbuf data pointer + * as things might have moved around with m_pullup + */ + oip = mtod(n, struct ip *); + th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen); + + if (th != ((struct tcphdr *)P2ROUNDDOWN(th, + sizeof(u_int32_t)))) + goto freeit; + tcphlen = th->th_off << 2; + + /* Sanity checks */ + if (tcphlen < sizeof(struct tcphdr)) + goto freeit; + if (oip->ip_len < (oiphlen + tcphlen)) + goto freeit; + if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL) + goto stdreply; + if (n->m_len < (oiphlen + tcphlen) && + (n = m_pullup(n, (oiphlen + tcphlen))) == NULL) + goto freeit; + + /* + * Reinit pointers derived from mbuf data pointer + * as things might have moved around with m_pullup + */ + oip = mtod(n, struct ip *); + th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen); + + icmpelen = max(tcphlen, min(icmp_datalen, + (oip->ip_len - oiphlen))); + } else +stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen, + (oip->ip_len - oiphlen))); + + icmplen = min(oiphlen + icmpelen, nlen); + if (icmplen < sizeof(struct ip)) goto freeit; + /* * First, formulate icmp message + * Allocate enough space for the IP header, ICMP header + * and the payload (part of the original message to be sent back). */ - m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */ + if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen)) + m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */ + else + m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR); + if (m == NULL) goto freeit; - if (n->m_flags & M_SKIP_FIREWALL) { - /* set M_SKIP_FIREWALL to skip firewall check, since we're called from firewall */ - m->m_flags |= M_SKIP_FIREWALL; - } - #if CONFIG_MACF_NET mac_mbuf_label_associate_netlayer(n, m); #endif - icmplen = min(oiplen + 8, oip->ip_len); - if (icmplen < sizeof(struct ip)) { - printf("icmp_error: bad length\n"); - m_free(m); - goto freeit; - } - m->m_len = icmplen + ICMP_MINLEN; - MH_ALIGN(m, m->m_len); + /* + * Further refine the payload length to the space + * remaining in mbuf after including the IP header and ICMP + * header. + */ + icmplen = min(icmplen, M_TRAILINGSPACE(m) - + sizeof(struct ip) - ICMP_MINLEN); + m_align(m, ICMP_MINLEN + icmplen); + m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */ + icp = mtod(m, struct icmp *); - if ((u_int)type > ICMP_MAXTYPE) - panic("icmp_error"); icmpstat.icps_outhist[type]++; icp->icmp_type = type; if (type == ICMP_REDIRECT) @@ -257,27 +370,34 @@ icmp_error( icp->icmp_pptr = code; code = 0; } else if (type == ICMP_UNREACH && - code == ICMP_UNREACH_NEEDFRAG && destifp) { - icp->icmp_nextmtu = htons(destifp->if_mtu); + code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) { + icp->icmp_nextmtu = htons(nextmtu); } } icp->icmp_code = code; + + /* + * Copy icmplen worth of content from original + * mbuf (n) to the new packet after ICMP header. + */ m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip); nip = &icp->icmp_ip; /* * Convert fields to network representation. */ +#if BYTE_ORDER != BIG_ENDIAN HTONS(nip->ip_len); HTONS(nip->ip_off); - +#endif /* - * Now, copy old ip header (without options) - * in front of icmp message. - */ - if (m->m_data - sizeof(struct ip) < m->m_pktdat) - panic("icmp len"); + * Set up ICMP message mbuf and copy old IP header (without options + * in front of ICMP message. + * If the original mbuf was meant to bypass the firewall, the error + * reply should bypass as well. + */ + m->m_flags |= n->m_flags & M_SKIP_FIREWALL; m->m_data -= sizeof(struct ip); m->m_len += sizeof(struct ip); m->m_pkthdr.len = m->m_len; @@ -288,46 +408,45 @@ icmp_error( nip->ip_vhl = IP_VHL_BORING; nip->ip_p = IPPROTO_ICMP; nip->ip_tos = 0; + nip->ip_off = 0; icmp_reflect(m); - freeit: m_freem(n); } -static struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET, - 0 , { 0 }, { 0,0,0,0,0,0,0,0 } }; -static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET, - 0 , { 0 }, { 0,0,0,0,0,0,0,0 } }; -static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET, - 0 , { 0 }, { 0,0,0,0,0,0,0,0 } }; - /* * Process a received ICMP message. */ void icmp_input(struct mbuf *m, int hlen) { + struct sockaddr_in icmpsrc, icmpdst, icmpgw; struct icmp *icp; struct ip *ip = mtod(m, struct ip *); - int icmplen = ip->ip_len; + int icmplen; int i; struct in_ifaddr *ia; - void (*ctlfunc)(int, struct sockaddr *, void *); + void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *); int code; + /* Expect 32-bit aligned data pointer on strict-align platforms */ + MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); + + icmplen = ip->ip_len; + /* * Locate icmp structure in mbuf, and check * that not corrupted and of at least minimum length. */ -#if ICMPPRINTFS - if (icmpprintfs) { - char buf[MAX_IPv4_STR_LEN]; - char ipv4str[MAX_IPv4_STR_LEN]; - - printf("icmp_input from %s to %s, len %d\n", - inet_ntop(AF_INET, &ip->ip_src, buf, sizeof(buf)), - inet_ntop(AF_INET, &ip->ip_dst, ipv4str, sizeof(ipv4str)), - icmplen); +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 2) { + char src_str[MAX_IPv4_STR_LEN]; + char dst_str[MAX_IPv4_STR_LEN]; + + inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str)); + inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str)); + printf("%s: from %s to %s, len %d\n", + __func__, src_str, dst_str, icmplen); } #endif if (icmplen < ICMP_MINLEN) { @@ -350,23 +469,8 @@ icmp_input(struct mbuf *m, int hlen) m->m_len += hlen; m->m_data -= hlen; -#if defined(NFAITH) && 0 < NFAITH - if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) { - /* - * Deliver very specific ICMP type only. - */ - switch (icp->icmp_type) { - case ICMP_UNREACH: - case ICMP_TIMXCEED: - break; - default: - goto freeit; - } - } -#endif - -#if ICMPPRINTFS - if (icmpprintfs) +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 2) printf("icmp_input, type %d code %d\n", icp->icmp_type, icp->icmp_code); #endif @@ -376,6 +480,18 @@ icmp_input(struct mbuf *m, int hlen) */ if (icp->icmp_type > ICMP_MAXTYPE) goto raw; + + /* Initialize */ + bzero(&icmpsrc, sizeof (icmpsrc)); + icmpsrc.sin_len = sizeof (struct sockaddr_in); + icmpsrc.sin_family = AF_INET; + bzero(&icmpdst, sizeof (icmpdst)); + icmpdst.sin_len = sizeof (struct sockaddr_in); + icmpdst.sin_family = AF_INET; + bzero(&icmpgw, sizeof (icmpgw)); + icmpgw.sin_len = sizeof (struct sockaddr_in); + icmpgw.sin_family = AF_INET; + icmpstat.icps_inhist[icp->icmp_type]++; code = icp->icmp_code; switch (icp->icmp_type) { @@ -439,74 +555,43 @@ icmp_input(struct mbuf *m, int hlen) /* * Problem with datagram; advise higher level routines. */ - if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) || - IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) { + if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) + || IP_VHL_HL(icp->icmp_ip.ip_vhl) < + (sizeof(struct ip) >> 2)) { icmpstat.icps_badlen++; goto freeit; } + +#if BYTE_ORDER != BIG_ENDIAN NTOHS(icp->icmp_ip.ip_len); +#endif + /* Discard ICMP's in response to multicast packets */ if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr))) goto badcode; -#if ICMPPRINTFS - if (icmpprintfs) - printf("deliver to protocol %d\n", icp->icmp_ip.ip_p); +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 2) + printf("deliver to protocol %d\n", + icp->icmp_ip.ip_p); #endif icmpsrc.sin_addr = icp->icmp_ip.ip_dst; -#if 1 - /* - * MTU discovery: - * If we got a needfrag and there is a host route to the - * original destination, and the MTU is not locked, then - * set the MTU in the route to the suggested new value - * (if given) and then notify as usual. The ULPs will - * notice that the MTU has changed and adapt accordingly. - * If no new MTU was suggested, then we guess a new one - * less than the current value. If the new MTU is - * unreasonably small (defined by sysctl tcp_minmss), then - * we reset the MTU to the interface value and enable the - * lock bit, indicating that we are no longer doing MTU - * discovery. - */ - if (code == PRC_MSGSIZE) { - struct rtentry *rt; - int mtu; - - rt = rtalloc1((struct sockaddr *)&icmpsrc, 0, - RTF_CLONING | RTF_PRCLONING); - if (rt && (rt->rt_flags & RTF_HOST) - && !(rt->rt_rmx.rmx_locks & RTV_MTU)) { - mtu = ntohs(icp->icmp_nextmtu); - if (!mtu) - mtu = ip_next_mtu(rt->rt_rmx.rmx_mtu, - 1); -#if DEBUG_MTUDISC - printf("MTU for %s reduced to %d\n", - inet_ntop(AF_INET, &icmpsrc.sin_addr, ipv4str, - sizeof(ipv4str)), - mtu); -#endif - if (mtu < max(296, (tcp_minmss + sizeof(struct tcpiphdr)))) { - /* rt->rt_rmx.rmx_mtu = - rt->rt_ifp->if_mtu; */ - rt->rt_rmx.rmx_locks |= RTV_MTU; - } else if (rt->rt_rmx.rmx_mtu > mtu) { - rt->rt_rmx.rmx_mtu = mtu; - } - } - if (rt) - rtfree(rt); - } -#endif /* - * XXX if the packet contains [IPv4 AH TCP], we can't make a + * if the packet contains [IPv4 AH TCP], we can't make a * notification to TCP layer. */ ctlfunc = ip_protox[icp->icmp_ip.ip_p]->pr_ctlinput; - if (ctlfunc) + + if (ctlfunc) { + LCK_MTX_ASSERT(inet_domain_mutex, LCK_MTX_ASSERT_OWNED); + + lck_mtx_unlock(inet_domain_mutex); + (*ctlfunc)(code, (struct sockaddr *)&icmpsrc, - (void *)&icp->icmp_ip); + (void *)&icp->icmp_ip, m->m_pkthdr.rcvif); + + lck_mtx_lock(inet_domain_mutex); + } break; badcode: @@ -514,11 +599,36 @@ icmp_input(struct mbuf *m, int hlen) break; case ICMP_ECHO: - if (!icmpbmcastecho - && (m->m_flags & (M_MCAST | M_BCAST)) != 0) { + if ((m->m_flags & (M_MCAST | M_BCAST))) { + if (icmpbmcastecho == 0) { + icmpstat.icps_bmcastecho++; + break; + } + } + + /* + * rdar://18644769 + * Do not reply when the destination is link local multicast or broadcast + * and the source is not from a directly connected subnet + */ + if ((IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr)) || + in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) && + in_localaddr(ip->ip_src) == 0) { icmpstat.icps_bmcastecho++; +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 0) { + char src_str[MAX_IPv4_STR_LEN]; + char dst_str[MAX_IPv4_STR_LEN]; + + inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str)); + inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str)); + printf("%s: non local (B|M)CAST %s to %s, len %d\n", + __func__, src_str, dst_str, icmplen); + } +#endif break; } + icp->icmp_type = ICMP_ECHOREPLY; #if ICMP_BANDLIM if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0) @@ -528,7 +638,6 @@ icmp_input(struct mbuf *m, int hlen) goto reflect; case ICMP_TSTAMP: - if (icmptimestamp == 0) break; @@ -552,7 +661,6 @@ icmp_input(struct mbuf *m, int hlen) goto reflect; case ICMP_MASKREQ: -#define satosin(sa) ((struct sockaddr_in *)(sa)) if (icmpmaskrepl == 0) break; /* @@ -575,8 +683,10 @@ icmp_input(struct mbuf *m, int hlen) (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif); if (ia == 0) break; + IFA_LOCK(&ia->ia_ifa); if (ia->ia_ifp == 0) { - ifafree(&ia->ia_ifa); + IFA_UNLOCK(&ia->ia_ifa); + IFA_REMREF(&ia->ia_ifa); ia = NULL; break; } @@ -588,7 +698,8 @@ icmp_input(struct mbuf *m, int hlen) else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr; } - ifafree(&ia->ia_ifa); + IFA_UNLOCK(&ia->ia_ifa); + IFA_REMREF(&ia->ia_ifa); reflect: ip->ip_len += hlen; /* since ip_input deducts this */ icmpstat.icps_reflect++; @@ -598,7 +709,7 @@ reflect: case ICMP_REDIRECT: if (log_redirect) { - u_long src, dst, gw; + u_int32_t src, dst, gw; src = ntohl(ip->ip_src.s_addr); dst = ntohl(icp->icmp_ip.ip_dst.s_addr); @@ -630,21 +741,20 @@ reflect: */ icmpgw.sin_addr = ip->ip_src; icmpdst.sin_addr = icp->icmp_gwaddr; -#if ICMPPRINTFS - if (icmpprintfs) { - char buf[MAX_IPv4_STR_LEN]; - - printf("redirect dst %s to %s\n", - inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, buf, sizeof(buf)), - inet_ntop(AF_INET, &icp->icmp_gwaddr, ipv4str, - sizeof(ipv4str))); +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 0) { + char dst_str[MAX_IPv4_STR_LEN]; + char gw_str[MAX_IPv4_STR_LEN]; + + inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str)); + inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str)); + printf("%s: redirect dst %s to %s\n", __func__, dst_str, gw_str); } #endif icmpsrc.sin_addr = icp->icmp_ip.ip_dst; - rtredirect((struct sockaddr *)&icmpsrc, - (struct sockaddr *)&icmpdst, - (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST, - (struct sockaddr *)&icmpgw, (struct rtentry **)0); + rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc, + (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST, + (struct sockaddr *)&icmpgw, NULL); pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc); #if IPSEC key_sa_routechange((struct sockaddr *)&icmpsrc); @@ -680,6 +790,7 @@ static void icmp_reflect(struct mbuf *m) { struct ip *ip = mtod(m, struct ip *); + struct sockaddr_in icmpdst; struct in_ifaddr *ia; struct in_addr t; struct mbuf *opts = NULL; @@ -699,16 +810,38 @@ icmp_reflect(struct mbuf *m) * or anonymous), use the address which corresponds * to the incoming interface. */ - lck_mtx_lock(rt_mtx); + lck_rw_lock_shared(in_ifaddr_rwlock); + TAILQ_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) { + IFA_LOCK(&ia->ia_ifa); + if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) { + IFA_ADDREF_LOCKED(&ia->ia_ifa); + IFA_UNLOCK(&ia->ia_ifa); + goto match; + } + IFA_UNLOCK(&ia->ia_ifa); + } + /* + * Slow path; check for broadcast addresses. Find a source + * IP address to use when replying to the broadcast request; + * let IP handle the source interface selection work. + */ for (ia = in_ifaddrhead.tqh_first; ia; ia = ia->ia_link.tqe_next) { - if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) - break; + IFA_LOCK(&ia->ia_ifa); if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) && - t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) + t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) { + IFA_ADDREF_LOCKED(&ia->ia_ifa); + IFA_UNLOCK(&ia->ia_ifa); break; + } + IFA_UNLOCK(&ia->ia_ifa); } - if (ia) - ifaref(&ia->ia_ifa); +match: + lck_rw_done(in_ifaddr_rwlock); + + /* Initialize */ + bzero(&icmpdst, sizeof (icmpdst)); + icmpdst.sin_len = sizeof (struct sockaddr_in); + icmpdst.sin_family = AF_INET; icmpdst.sin_addr = t; if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif) ia = (struct in_ifaddr *)ifaof_ifpforaddr( @@ -718,22 +851,25 @@ icmp_reflect(struct mbuf *m) * and was received on an interface with no IP address. */ if (ia == (struct in_ifaddr *)0) { + lck_rw_lock_shared(in_ifaddr_rwlock); ia = in_ifaddrhead.tqh_first; if (ia == (struct in_ifaddr *)0) {/* no address yet, bail out */ + lck_rw_done(in_ifaddr_rwlock); m_freem(m); - lck_mtx_unlock(rt_mtx); goto done; } - ifaref(&ia->ia_ifa); + IFA_ADDREF(&ia->ia_ifa); + lck_rw_done(in_ifaddr_rwlock); } - lck_mtx_unlock(rt_mtx); #if CONFIG_MACF_NET mac_netinet_icmp_reply(m); #endif + IFA_LOCK_SPIN(&ia->ia_ifa); t = IA_SIN(ia)->sin_addr; + IFA_UNLOCK(&ia->ia_ifa); ip->ip_src = t; ip->ip_ttl = ip_defttl; - ifafree(&ia->ia_ifa); + IFA_REMREF(&ia->ia_ifa); ia = NULL; if (optlen > 0) { @@ -752,8 +888,8 @@ icmp_reflect(struct mbuf *m) mtod(opts, struct in_addr *)->s_addr = 0; } if (opts) { -#if ICMPPRINTFS - if (icmpprintfs) +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 1) printf("icmp_reflect optlen %d rt %d => ", optlen, opts->m_len); #endif @@ -790,8 +926,8 @@ icmp_reflect(struct mbuf *m) opts->m_len++; } } -#if ICMPPRINTFS - if (icmpprintfs) +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 1) printf("%d\n", opts->m_len); #endif } @@ -826,6 +962,18 @@ icmp_send(struct mbuf *m, struct mbuf *opts) int hlen; struct icmp *icp; struct route ro; + struct ip_out_args ipoa; + + bzero(&ipoa, sizeof(ipoa)); + ipoa.ipoa_boundif = IFSCOPE_NONE; + ipoa.ipoa_flags = IPOAF_SELECT_SRCIF | IPOAF_BOUND_SRCADDR; + ipoa.ipoa_sotc = SO_TC_UNSPEC; + ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC; + + if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) { + ipoa.ipoa_boundif = m->m_pkthdr.rcvif->if_index; + ipoa.ipoa_flags |= IPOAF_BOUND_IF; + } hlen = IP_VHL_HL(ip->ip_vhl) << 2; m->m_data += hlen; @@ -838,29 +986,28 @@ icmp_send(struct mbuf *m, struct mbuf *opts) m->m_pkthdr.rcvif = NULL; m->m_pkthdr.csum_data = 0; m->m_pkthdr.csum_flags = 0; -#if ICMPPRINTFS - if (icmpprintfs) { - char buf[MAX_IPv4_STR_LEN]; - char ipv4str[MAX_IPv4_STR_LEN]; - - printf("icmp_send dst %s src %s\n", - inet_ntop(AF_INET, &ip->ip_dst, buf, sizeof(buf)), - inet_ntop(AF_INET, &ip->ip_src, ipv4str, sizeof(ipv4str))); +#if (DEBUG | DEVELOPMENT) + if (icmpprintfs > 2) { + char src_str[MAX_IPv4_STR_LEN]; + char dst_str[MAX_IPv4_STR_LEN]; + + inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str)); + inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str)); + printf("%s: dst %s src %s\n", __func__, dst_str, src_str); } #endif bzero(&ro, sizeof ro); - (void) ip_output(m, opts, &ro, 0, NULL, NULL); - if (ro.ro_rt) - rtfree(ro.ro_rt); + (void) ip_output(m, opts, &ro, IP_OUTARGS, NULL, &ipoa); + ROUTE_RELEASE(&ro); } -n_time +u_int32_t iptime(void) { struct timeval atv; - u_long t; + u_int32_t t; - microtime(&atv); + getmicrotime(&atv); t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000; return (htonl(t)); } @@ -871,7 +1018,7 @@ iptime(void) * given current value MTU. If DIR is less than zero, a larger plateau * is returned; otherwise, a smaller value is returned. */ -static int +int ip_next_mtu(int mtu, int dir) { static int mtutab[] = { @@ -927,9 +1074,9 @@ ip_next_mtu(int mtu, int dir) int badport_bandlim(int which) { - static struct timeval lticks[BANDLIM_MAX + 1]; + static uint64_t lticks[BANDLIM_MAX + 1]; static int lpackets[BANDLIM_MAX + 1]; - struct timeval time; + uint64_t time = net_uptime(); int secs; const char *bandlimittype[] = { @@ -948,15 +1095,13 @@ badport_bandlim(int which) if (icmplim <= 0 || which > BANDLIM_MAX || which < 0) return(0); - getmicrouptime(&time); + secs = time - lticks[which]; - secs = time.tv_sec - lticks[which].tv_sec ; - /* * reset stats when cumulative delta exceeds one second. */ - if ((secs > 1) || (secs == 1 && (lticks[which].tv_usec > time.tv_usec))) { + if (secs > 1) { if (lpackets[which] > icmplim) { printf("%s from %d to %d packets per second\n", bandlimittype[which], @@ -964,8 +1109,7 @@ badport_bandlim(int which) icmplim ); } - lticks[which].tv_sec = time.tv_sec; - lticks[which].tv_usec = time.tv_usec; + lticks[which] = time; lpackets[which] = 0; } @@ -993,9 +1137,8 @@ badport_bandlim(int which) #include #include -extern struct domain inetdomain; -extern u_long rip_sendspace; -extern u_long rip_recvspace; +extern u_int32_t rip_sendspace; +extern u_int32_t rip_recvspace; extern struct inpcbinfo ripcbinfo; int rip_abort(struct socket *); @@ -1010,11 +1153,19 @@ __private_extern__ int icmp_dgram_attach(struct socket *so, int proto, struct pr __private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt); __private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = { - rip_abort, pru_accept_notsupp, icmp_dgram_attach, rip_bind, rip_connect, - pru_connect2_notsupp, in_control, rip_detach, rip_disconnect, - pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp, - pru_rcvoob_notsupp, icmp_dgram_send, pru_sense_null, rip_shutdown, - in_setsockaddr, sosend, soreceive, pru_sopoll_notsupp + .pru_abort = rip_abort, + .pru_attach = icmp_dgram_attach, + .pru_bind = rip_bind, + .pru_connect = rip_connect, + .pru_control = in_control, + .pru_detach = rip_detach, + .pru_disconnect = rip_disconnect, + .pru_peeraddr = in_getpeeraddr, + .pru_send = icmp_dgram_send, + .pru_shutdown = rip_shutdown, + .pru_sockaddr = in_getsockaddr, + .pru_sosend = sosend, + .pru_soreceive = soreceive, }; /* Like rip_attach but without root privilege enforcement */ @@ -1062,6 +1213,7 @@ icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt) case IP_RECVDSTADDR: case IP_RETOPTS: case IP_MULTICAST_IF: + case IP_MULTICAST_IFINDEX: case IP_MULTICAST_TTL: case IP_MULTICAST_LOOP: case IP_ADD_MEMBERSHIP: @@ -1070,14 +1222,13 @@ icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt) case IP_PORTRANGE: case IP_RECVIF: case IP_IPSEC_POLICY: -#if defined(NFAITH) && NFAITH > 0 - case IP_FAITH: -#endif case IP_STRIPHDR: case IP_RECVTTL: + case IP_BOUND_IF: + case IP_NO_IFT_CELLULAR: error = rip_ctloutput(so, sopt); break; - + default: error = EINVAL; break; @@ -1087,8 +1238,8 @@ icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt) } __private_extern__ int -icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, - struct mbuf *control, struct proc *p) +icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, + struct sockaddr *nam, struct mbuf *control, struct proc *p) { struct ip *ip; struct inpcb *inp = sotoinpcb(so); @@ -1096,10 +1247,24 @@ icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *n struct icmp *icp; struct in_ifaddr *ia = NULL; int icmplen; + int error = EINVAL; + + if (inp == NULL +#if NECP + || (necp_socket_should_use_flow_divert(inp)) +#endif /* NECP */ + ) { + if (inp != NULL) + error = EPROTOTYPE; + goto bad; + } if ((inp->inp_flags & INP_HDRINCL) != 0) { + /* Expect 32-bit aligned data ptr on strict-align platforms */ + MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); /* - * This is not raw IP, we liberal only for fields TOS, id and TTL + * This is not raw IP, we liberal only for fields TOS, + * id and TTL. */ ip = mtod(m, struct ip *); @@ -1113,37 +1278,45 @@ icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *n goto bad; if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len) goto bad; - /* Bogus fragments can tie up peer resources */ - if (ip->ip_off != 0) + /* Bogus fragments can tie up peer resources */ + if ((ip->ip_off & ~IP_DF) != 0) goto bad; /* Allow only ICMP even for user provided IP header */ if (ip->ip_p != IPPROTO_ICMP) goto bad; - /* To prevent spoofing, specified source address must be one of ours */ + /* + * To prevent spoofing, specified source address must + * be one of ours. + */ if (ip->ip_src.s_addr != INADDR_ANY) { socket_unlock(so, 0); - lck_mtx_lock(rt_mtx); + lck_rw_lock_shared(in_ifaddr_rwlock); if (TAILQ_EMPTY(&in_ifaddrhead)) { - lck_mtx_unlock(rt_mtx); + lck_rw_done(in_ifaddr_rwlock); socket_lock(so, 0); goto bad; } - TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) { - if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_src.s_addr) { - lck_mtx_unlock(rt_mtx); + TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr), + ia_hash) { + IFA_LOCK(&ia->ia_ifa); + if (IA_SIN(ia)->sin_addr.s_addr == + ip->ip_src.s_addr) { + IFA_UNLOCK(&ia->ia_ifa); + lck_rw_done(in_ifaddr_rwlock); socket_lock(so, 0); goto ours; } + IFA_UNLOCK(&ia->ia_ifa); } - lck_mtx_unlock(rt_mtx); + lck_rw_done(in_ifaddr_rwlock); socket_lock(so, 0); goto bad; } ours: /* Do not trust we got a valid checksum */ ip->ip_sum = 0; - - icp = (struct icmp *)(((char *)m->m_data) + hlen); + + icp = (struct icmp *)(void *)(((char *)m->m_data) + hlen); icmplen = m->m_pkthdr.len - hlen; } else { if ((icmplen = m->m_pkthdr.len) < ICMP_MINLEN) { @@ -1170,10 +1343,16 @@ ours: default: goto bad; } - return rip_send(so, flags, m, nam, control, p); + return (rip_send(so, flags, m, nam, control, p)); bad: - m_freem(m); - return EINVAL; + VERIFY(error != 0); + + if (m != NULL) + m_freem(m); + if (control != NULL) + m_freem(control); + + return (error); } #endif /* __APPLE__ */