1 /*-
2 * Copyright (c) 2018 The FreeBSD Foundation
3 *
4 * This software was developed by Mark Johnston under sponsorship from
5 * the FreeBSD Foundation.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions are
9 * met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30 #include <sys/param.h>
31 #include <sys/ioctl.h>
32 #include <sys/socket.h>
33 #include <sys/sysctl.h>
34
35 #include <net/bpf.h>
36 #include <net/if.h>
37 #include <netinet/in.h>
38 #include <netinet/ip.h>
39 #include <netinet/ip_var.h>
40
41 #include <err.h>
42 #include <errno.h>
43 #include <fcntl.h>
44 #include <ifaddrs.h>
45 #include <stdint.h>
46 #include <stdlib.h>
47 #include <time.h>
48 #include <unistd.h>
49
50 #include <atf-c.h>
51
52 struct lopacket {
53 u_int family;
54 struct ip hdr;
55 char payload[];
56 };
57
58 static void
update_cksum(struct ip * ip)59 update_cksum(struct ip *ip)
60 {
61 size_t i;
62 uint32_t cksum;
63 uint8_t *cksump;
64 uint16_t tmp;
65
66 ip->ip_sum = 0;
67 cksump = (char *)ip;
68 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(uint16_t); i++) {
69 tmp = *cksump++;
70 tmp = tmp << 8 | *cksump++;
71 cksum += ntohs(tmp);
72 }
73 cksum = (cksum >> 16) + (cksum & 0xffff);
74 cksum = ~(cksum + (cksum >> 16));
75 ip->ip_sum = htons((uint16_t)cksum);
76 }
77
78 static struct lopacket *
alloc_lopacket(in_addr_t dstaddr,size_t payloadlen)79 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen)
80 {
81 struct ip *ip;
82 struct lopacket *packet;
83 size_t pktlen;
84
85 pktlen = sizeof(*packet) + payloadlen;
86 packet = malloc(pktlen);
87 ATF_REQUIRE(packet != NULL);
88
89 memset(packet, 0, pktlen);
90 packet->family = AF_INET;
91
92 ip = &packet->hdr;
93 ip->ip_hl = sizeof(struct ip) >> 2;
94 ip->ip_v = 4;
95 ip->ip_tos = 0;
96 ip->ip_len = htons(sizeof(*ip) + payloadlen);
97 ip->ip_id = 0;
98 ip->ip_off = 0;
99 ip->ip_ttl = 1;
100 ip->ip_p = IPPROTO_IP;
101 ip->ip_sum = 0;
102 ip->ip_src.s_addr = dstaddr;
103 ip->ip_dst.s_addr = dstaddr;
104 update_cksum(ip);
105
106 return (packet);
107 }
108
109 static void
free_lopacket(struct lopacket * packet)110 free_lopacket(struct lopacket *packet)
111 {
112
113 free(packet);
114 }
115
116 static void
write_lopacket(int bpffd,struct lopacket * packet)117 write_lopacket(int bpffd, struct lopacket *packet)
118 {
119 struct timespec ts;
120 ssize_t n;
121 size_t len;
122
123 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len);
124 n = write(bpffd, packet, len);
125 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno));
126 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu",
127 n, len);
128
129 /*
130 * Loopback packets are dispatched asynchronously, give netisr some
131 * time.
132 */
133 ts.tv_sec = 0;
134 ts.tv_nsec = 5000000; /* 5ms */
135 (void)nanosleep(&ts, NULL);
136 }
137
138 static int
open_lobpf(in_addr_t * addrp)139 open_lobpf(in_addr_t *addrp)
140 {
141 struct ifreq ifr;
142 struct ifaddrs *ifa, *ifap;
143 int error, fd;
144
145 fd = open("/dev/bpf0", O_RDWR);
146 if (fd < 0 && errno == ENOENT)
147 atf_tc_skip("no BPF device available");
148 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno));
149
150 error = getifaddrs(&ifap);
151 ATF_REQUIRE(error == 0);
152 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
153 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 &&
154 ifa->ifa_addr->sa_family == AF_INET)
155 break;
156 if (ifa == NULL)
157 atf_tc_skip("no loopback address found");
158
159 memset(&ifr, 0, sizeof(ifr));
160 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ);
161 error = ioctl(fd, BIOCSETIF, &ifr);
162 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno));
163
164 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr;
165
166 freeifaddrs(ifap);
167
168 return (fd);
169 }
170
171 static void
get_ipstat(struct ipstat * stat)172 get_ipstat(struct ipstat *stat)
173 {
174 size_t len;
175 int error;
176
177 memset(stat, 0, sizeof(*stat));
178 len = sizeof(*stat);
179 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0);
180 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s",
181 strerror(errno));
182 ATF_REQUIRE(len == sizeof(*stat));
183 }
184
185 #define CHECK_IP_COUNTER(oldp, newp, counter) \
186 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \
187 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \
188 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter);
189
190 /*
191 * Make sure a fragment with MF set doesn't come after the last fragment of a
192 * packet. Make sure that multiple fragments with MF clear have the same offset
193 * and length.
194 */
195 ATF_TC(ip_reass__multiple_last_fragments);
ATF_TC_HEAD(ip_reass__multiple_last_fragments,tc)196 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc)
197 {
198 atf_tc_set_md_var(tc, "require.user", "root");
199 }
ATF_TC_BODY(ip_reass__multiple_last_fragments,tc)200 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc)
201 {
202 struct ipstat old, new;
203 struct ip *ip;
204 struct lopacket *packet1, *packet2, *packet3, *packet4;
205 in_addr_t addr;
206 int error, fd;
207 uint16_t ipid;
208
209 fd = open_lobpf(&addr);
210 ipid = arc4random_uniform(UINT16_MAX + 1);
211
212 packet1 = alloc_lopacket(addr, 16);
213 ip = &packet1->hdr;
214 ip->ip_id = ipid;
215 ip->ip_off = htons(0x10);
216 update_cksum(ip);
217
218 packet2 = alloc_lopacket(addr, 16);
219 ip = &packet2->hdr;
220 ip->ip_id = ipid;
221 ip->ip_off = htons(0x20);
222 update_cksum(ip);
223
224 packet3 = alloc_lopacket(addr, 16);
225 ip = &packet3->hdr;
226 ip->ip_id = ipid;
227 ip->ip_off = htons(0x8);
228 update_cksum(ip);
229
230 packet4 = alloc_lopacket(addr, 32);
231 ip = &packet4->hdr;
232 ip->ip_id = ipid;
233 ip->ip_off = htons(0x10);
234 update_cksum(ip);
235
236 write_lopacket(fd, packet1);
237
238 /* packet2 comes after packet1. */
239 get_ipstat(&old);
240 write_lopacket(fd, packet2);
241 get_ipstat(&new);
242 CHECK_IP_COUNTER(&old, &new, fragdropped);
243
244 /* packet2 comes after packet1 and has MF set. */
245 packet2->hdr.ip_off = htons(IP_MF | 0x20);
246 update_cksum(&packet2->hdr);
247 get_ipstat(&old);
248 write_lopacket(fd, packet2);
249 get_ipstat(&new);
250 CHECK_IP_COUNTER(&old, &new, fragdropped);
251
252 /* packet3 comes before packet1 but overlaps. */
253 get_ipstat(&old);
254 write_lopacket(fd, packet3);
255 get_ipstat(&new);
256 CHECK_IP_COUNTER(&old, &new, fragdropped);
257
258 /* packet4 has the same offset as packet1 but is longer. */
259 get_ipstat(&old);
260 write_lopacket(fd, packet4);
261 get_ipstat(&new);
262 CHECK_IP_COUNTER(&old, &new, fragdropped);
263
264 error = close(fd);
265 ATF_REQUIRE(error == 0);
266 free_lopacket(packet1);
267 free_lopacket(packet2);
268 free_lopacket(packet3);
269 free_lopacket(packet4);
270 }
271
272 /*
273 * Make sure that we reject zero-length fragments.
274 */
275 ATF_TC(ip_reass__zero_length_fragment);
ATF_TC_HEAD(ip_reass__zero_length_fragment,tc)276 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc)
277 {
278 atf_tc_set_md_var(tc, "require.user", "root");
279 }
ATF_TC_BODY(ip_reass__zero_length_fragment,tc)280 ATF_TC_BODY(ip_reass__zero_length_fragment, tc)
281 {
282 struct ipstat old, new;
283 struct ip *ip;
284 struct lopacket *packet1, *packet2;
285 in_addr_t addr;
286 int error, fd;
287 uint16_t ipid;
288
289 fd = open_lobpf(&addr);
290 ipid = arc4random_uniform(UINT16_MAX + 1);
291
292 /*
293 * Create two packets, one with MF set, one without.
294 */
295 packet1 = alloc_lopacket(addr, 0);
296 ip = &packet1->hdr;
297 ip->ip_id = ipid;
298 ip->ip_off = htons(IP_MF | 0x10);
299 update_cksum(ip);
300
301 packet2 = alloc_lopacket(addr, 0);
302 ip = &packet2->hdr;
303 ip->ip_id = ~ipid;
304 ip->ip_off = htons(0x10);
305 update_cksum(ip);
306
307 get_ipstat(&old);
308 write_lopacket(fd, packet1);
309 get_ipstat(&new);
310 CHECK_IP_COUNTER(&old, &new, toosmall);
311 CHECK_IP_COUNTER(&old, &new, fragdropped);
312
313 get_ipstat(&old);
314 write_lopacket(fd, packet2);
315 get_ipstat(&new);
316 CHECK_IP_COUNTER(&old, &new, toosmall);
317 CHECK_IP_COUNTER(&old, &new, fragdropped);
318
319 error = close(fd);
320 ATF_REQUIRE(error == 0);
321 free_lopacket(packet1);
322 free_lopacket(packet2);
323 }
324
325 ATF_TC(ip_reass__large_fragment);
ATF_TC_HEAD(ip_reass__large_fragment,tc)326 ATF_TC_HEAD(ip_reass__large_fragment, tc)
327 {
328 atf_tc_set_md_var(tc, "require.user", "root");
329 }
ATF_TC_BODY(ip_reass__large_fragment,tc)330 ATF_TC_BODY(ip_reass__large_fragment, tc)
331 {
332 struct ipstat old, new;
333 struct ip *ip;
334 struct lopacket *packet1, *packet2;
335 in_addr_t addr;
336 int error, fd;
337 uint16_t ipid;
338
339 fd = open_lobpf(&addr);
340 ipid = arc4random_uniform(UINT16_MAX + 1);
341
342 /*
343 * Create two packets, one with MF set, one without.
344 *
345 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check.
346 */
347 packet1 = alloc_lopacket(addr, 16);
348 ip = &packet1->hdr;
349 ip->ip_id = ipid;
350 ip->ip_off = htons(IP_MF | 0x1fff);
351 update_cksum(ip);
352
353 packet2 = alloc_lopacket(addr, 16);
354 ip = &packet2->hdr;
355 ip->ip_id = ipid;
356 ip->ip_off = htons(0x1fff);
357 update_cksum(ip);
358
359 get_ipstat(&old);
360 write_lopacket(fd, packet1);
361 get_ipstat(&new);
362 CHECK_IP_COUNTER(&old, &new, toolong);
363 CHECK_IP_COUNTER(&old, &new, fragdropped);
364
365 get_ipstat(&old);
366 write_lopacket(fd, packet2);
367 get_ipstat(&new);
368 CHECK_IP_COUNTER(&old, &new, toolong);
369 CHECK_IP_COUNTER(&old, &new, fragdropped);
370
371 error = close(fd);
372 ATF_REQUIRE(error == 0);
373 free_lopacket(packet1);
374 free_lopacket(packet2);
375 }
376
ATF_TP_ADD_TCS(tp)377 ATF_TP_ADD_TCS(tp)
378 {
379 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments);
380 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment);
381 ATF_TP_ADD_TC(tp, ip_reass__large_fragment);
382
383 return (atf_no_error());
384 }
385