1 /*-
2 * Copyright (c) 2018 The FreeBSD Foundation
3 *
4 * This software was developed by Mark Johnston under sponsorship from
5 * the FreeBSD Foundation.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions are
9 * met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30 #include <sys/param.h>
31 #include <sys/ioctl.h>
32 #include <sys/socket.h>
33 #include <sys/sysctl.h>
34
35 #include <net/bpf.h>
36 #include <net/if.h>
37 #include <netinet/in.h>
38 #include <netinet/ip.h>
39 #include <netinet/ip_var.h>
40
41 #include <err.h>
42 #include <errno.h>
43 #include <fcntl.h>
44 #include <ifaddrs.h>
45 #include <stdint.h>
46 #include <stdlib.h>
47 #include <time.h>
48 #include <unistd.h>
49
50 #include <atf-c.h>
51
52 struct lopacket {
53 u_int family;
54 struct ip hdr;
55 char payload[];
56 };
57
58 static void
update_cksum(struct ip * ip)59 update_cksum(struct ip *ip)
60 {
61 size_t i;
62 uint32_t cksum;
63 uint16_t *cksump;
64
65 ip->ip_sum = 0;
66 cksump = (uint16_t *)ip;
67 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++)
68 cksum += ntohs(*cksump);
69 cksum = (cksum >> 16) + (cksum & 0xffff);
70 cksum = ~(cksum + (cksum >> 16));
71 ip->ip_sum = htons((uint16_t)cksum);
72 }
73
74 static struct lopacket *
alloc_lopacket(in_addr_t dstaddr,size_t payloadlen)75 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen)
76 {
77 struct ip *ip;
78 struct lopacket *packet;
79 size_t pktlen;
80
81 pktlen = sizeof(*packet) + payloadlen;
82 packet = malloc(pktlen);
83 ATF_REQUIRE(packet != NULL);
84
85 memset(packet, 0, pktlen);
86 packet->family = AF_INET;
87
88 ip = &packet->hdr;
89 ip->ip_hl = sizeof(struct ip) >> 2;
90 ip->ip_v = 4;
91 ip->ip_tos = 0;
92 ip->ip_len = htons(sizeof(*ip) + payloadlen);
93 ip->ip_id = 0;
94 ip->ip_off = 0;
95 ip->ip_ttl = 1;
96 ip->ip_p = IPPROTO_IP;
97 ip->ip_sum = 0;
98 ip->ip_src.s_addr = dstaddr;
99 ip->ip_dst.s_addr = dstaddr;
100 update_cksum(ip);
101
102 return (packet);
103 }
104
105 static void
free_lopacket(struct lopacket * packet)106 free_lopacket(struct lopacket *packet)
107 {
108
109 free(packet);
110 }
111
112 static void
write_lopacket(int bpffd,struct lopacket * packet)113 write_lopacket(int bpffd, struct lopacket *packet)
114 {
115 struct timespec ts;
116 ssize_t n;
117 size_t len;
118
119 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len);
120 n = write(bpffd, packet, len);
121 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno));
122 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu",
123 n, len);
124
125 /*
126 * Loopback packets are dispatched asynchronously, give netisr some
127 * time.
128 */
129 ts.tv_sec = 0;
130 ts.tv_nsec = 5000000; /* 5ms */
131 (void)nanosleep(&ts, NULL);
132 }
133
134 static int
open_lobpf(in_addr_t * addrp)135 open_lobpf(in_addr_t *addrp)
136 {
137 struct ifreq ifr;
138 struct ifaddrs *ifa, *ifap;
139 int error, fd;
140
141 fd = open("/dev/bpf0", O_RDWR);
142 if (fd < 0 && errno == ENOENT)
143 atf_tc_skip("no BPF device available");
144 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno));
145
146 error = getifaddrs(&ifap);
147 ATF_REQUIRE(error == 0);
148 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
149 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 &&
150 ifa->ifa_addr->sa_family == AF_INET)
151 break;
152 if (ifa == NULL)
153 atf_tc_skip("no loopback address found");
154
155 memset(&ifr, 0, sizeof(ifr));
156 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ);
157 error = ioctl(fd, BIOCSETIF, &ifr);
158 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno));
159
160 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr;
161
162 freeifaddrs(ifap);
163
164 return (fd);
165 }
166
167 static void
get_ipstat(struct ipstat * stat)168 get_ipstat(struct ipstat *stat)
169 {
170 size_t len;
171 int error;
172
173 memset(stat, 0, sizeof(*stat));
174 len = sizeof(*stat);
175 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0);
176 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s",
177 strerror(errno));
178 ATF_REQUIRE(len == sizeof(*stat));
179 }
180
181 #define CHECK_IP_COUNTER(oldp, newp, counter) \
182 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \
183 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \
184 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter);
185
186 /*
187 * Make sure a fragment with MF set doesn't come after the last fragment of a
188 * packet. Make sure that multiple fragments with MF clear have the same offset
189 * and length.
190 */
191 ATF_TC(ip_reass__multiple_last_fragments);
ATF_TC_HEAD(ip_reass__multiple_last_fragments,tc)192 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc)
193 {
194 atf_tc_set_md_var(tc, "require.user", "root");
195 }
ATF_TC_BODY(ip_reass__multiple_last_fragments,tc)196 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc)
197 {
198 struct ipstat old, new;
199 struct ip *ip;
200 struct lopacket *packet1, *packet2, *packet3, *packet4;
201 in_addr_t addr;
202 int error, fd;
203 uint16_t ipid;
204
205 fd = open_lobpf(&addr);
206 ipid = arc4random_uniform(UINT16_MAX + 1);
207
208 packet1 = alloc_lopacket(addr, 16);
209 ip = &packet1->hdr;
210 ip->ip_id = ipid;
211 ip->ip_off = htons(0x10);
212 update_cksum(ip);
213
214 packet2 = alloc_lopacket(addr, 16);
215 ip = &packet2->hdr;
216 ip->ip_id = ipid;
217 ip->ip_off = htons(0x20);
218 update_cksum(ip);
219
220 packet3 = alloc_lopacket(addr, 16);
221 ip = &packet3->hdr;
222 ip->ip_id = ipid;
223 ip->ip_off = htons(0x8);
224 update_cksum(ip);
225
226 packet4 = alloc_lopacket(addr, 32);
227 ip = &packet4->hdr;
228 ip->ip_id = ipid;
229 ip->ip_off = htons(0x10);
230 update_cksum(ip);
231
232 write_lopacket(fd, packet1);
233
234 /* packet2 comes after packet1. */
235 get_ipstat(&old);
236 write_lopacket(fd, packet2);
237 get_ipstat(&new);
238 CHECK_IP_COUNTER(&old, &new, fragdropped);
239
240 /* packet2 comes after packet1 and has MF set. */
241 packet2->hdr.ip_off = htons(IP_MF | 0x20);
242 update_cksum(&packet2->hdr);
243 get_ipstat(&old);
244 write_lopacket(fd, packet2);
245 get_ipstat(&new);
246 CHECK_IP_COUNTER(&old, &new, fragdropped);
247
248 /* packet3 comes before packet1 but overlaps. */
249 get_ipstat(&old);
250 write_lopacket(fd, packet3);
251 get_ipstat(&new);
252 CHECK_IP_COUNTER(&old, &new, fragdropped);
253
254 /* packet4 has the same offset as packet1 but is longer. */
255 get_ipstat(&old);
256 write_lopacket(fd, packet4);
257 get_ipstat(&new);
258 CHECK_IP_COUNTER(&old, &new, fragdropped);
259
260 error = close(fd);
261 ATF_REQUIRE(error == 0);
262 free_lopacket(packet1);
263 free_lopacket(packet2);
264 free_lopacket(packet3);
265 free_lopacket(packet4);
266 }
267
268 /*
269 * Make sure that we reject zero-length fragments.
270 */
271 ATF_TC(ip_reass__zero_length_fragment);
ATF_TC_HEAD(ip_reass__zero_length_fragment,tc)272 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc)
273 {
274 atf_tc_set_md_var(tc, "require.user", "root");
275 }
ATF_TC_BODY(ip_reass__zero_length_fragment,tc)276 ATF_TC_BODY(ip_reass__zero_length_fragment, tc)
277 {
278 struct ipstat old, new;
279 struct ip *ip;
280 struct lopacket *packet1, *packet2;
281 in_addr_t addr;
282 int error, fd;
283 uint16_t ipid;
284
285 fd = open_lobpf(&addr);
286 ipid = arc4random_uniform(UINT16_MAX + 1);
287
288 /*
289 * Create two packets, one with MF set, one without.
290 */
291 packet1 = alloc_lopacket(addr, 0);
292 ip = &packet1->hdr;
293 ip->ip_id = ipid;
294 ip->ip_off = htons(IP_MF | 0x10);
295 update_cksum(ip);
296
297 packet2 = alloc_lopacket(addr, 0);
298 ip = &packet2->hdr;
299 ip->ip_id = ~ipid;
300 ip->ip_off = htons(0x10);
301 update_cksum(ip);
302
303 get_ipstat(&old);
304 write_lopacket(fd, packet1);
305 get_ipstat(&new);
306 CHECK_IP_COUNTER(&old, &new, toosmall);
307 CHECK_IP_COUNTER(&old, &new, fragdropped);
308
309 get_ipstat(&old);
310 write_lopacket(fd, packet2);
311 get_ipstat(&new);
312 CHECK_IP_COUNTER(&old, &new, toosmall);
313 CHECK_IP_COUNTER(&old, &new, fragdropped);
314
315 error = close(fd);
316 ATF_REQUIRE(error == 0);
317 free_lopacket(packet1);
318 free_lopacket(packet2);
319 }
320
321 ATF_TC(ip_reass__large_fragment);
ATF_TC_HEAD(ip_reass__large_fragment,tc)322 ATF_TC_HEAD(ip_reass__large_fragment, tc)
323 {
324 atf_tc_set_md_var(tc, "require.user", "root");
325 }
ATF_TC_BODY(ip_reass__large_fragment,tc)326 ATF_TC_BODY(ip_reass__large_fragment, tc)
327 {
328 struct ipstat old, new;
329 struct ip *ip;
330 struct lopacket *packet1, *packet2;
331 in_addr_t addr;
332 int error, fd;
333 uint16_t ipid;
334
335 fd = open_lobpf(&addr);
336 ipid = arc4random_uniform(UINT16_MAX + 1);
337
338 /*
339 * Create two packets, one with MF set, one without.
340 *
341 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check.
342 */
343 packet1 = alloc_lopacket(addr, 16);
344 ip = &packet1->hdr;
345 ip->ip_id = ipid;
346 ip->ip_off = htons(IP_MF | 0x1fff);
347 update_cksum(ip);
348
349 packet2 = alloc_lopacket(addr, 16);
350 ip = &packet2->hdr;
351 ip->ip_id = ipid;
352 ip->ip_off = htons(0x1fff);
353 update_cksum(ip);
354
355 get_ipstat(&old);
356 write_lopacket(fd, packet1);
357 get_ipstat(&new);
358 CHECK_IP_COUNTER(&old, &new, toolong);
359 CHECK_IP_COUNTER(&old, &new, fragdropped);
360
361 get_ipstat(&old);
362 write_lopacket(fd, packet2);
363 get_ipstat(&new);
364 CHECK_IP_COUNTER(&old, &new, toolong);
365 CHECK_IP_COUNTER(&old, &new, fragdropped);
366
367 error = close(fd);
368 ATF_REQUIRE(error == 0);
369 free_lopacket(packet1);
370 free_lopacket(packet2);
371 }
372
ATF_TP_ADD_TCS(tp)373 ATF_TP_ADD_TCS(tp)
374 {
375 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments);
376 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment);
377 ATF_TP_ADD_TC(tp, ip_reass__large_fragment);
378
379 return (atf_no_error());
380 }
381