1 /*-
2 * Copyright (c) 2018 The FreeBSD Foundation
3 *
4 * This software was developed by Mark Johnston under sponsorship from
5 * the FreeBSD Foundation.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions are
9 * met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in
14 * the documentation and/or other materials provided with the
15 * distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30 #include <sys/param.h>
31 #include <sys/ioctl.h>
32 #include <sys/socket.h>
33 #include <sys/sysctl.h>
34
35 #include <net/bpf.h>
36 #include <net/if.h>
37 #include <netinet/in.h>
38 #include <netinet/ip.h>
39 #include <netinet/ip_var.h>
40
41 #include <err.h>
42 #include <errno.h>
43 #include <fcntl.h>
44 #include <ifaddrs.h>
45 #include <stdint.h>
46 #include <stdlib.h>
47 #include <time.h>
48 #include <unistd.h>
49
50 #include <atf-c.h>
51
52 struct lopacket {
53 u_int family;
54 struct ip hdr;
55 char payload[];
56 };
57
58 static uint16_t
in_cksum(void * data,size_t len)59 in_cksum(void *data, size_t len)
60 {
61 uint16_t *cksump;
62 size_t i;
63 uint32_t cksum;
64
65 ATF_REQUIRE(len % 2 == 0);
66 cksump = (uint16_t *)data;
67 cksum = 0;
68 for (i = 0; i < len / sizeof(uint16_t); i++)
69 cksum += *cksump++;
70 while ((cksum >> 16) != 0)
71 cksum = (cksum & 0xffff) + (cksum >> 16);
72 return ((uint16_t)~cksum);
73 }
74
75 static void
update_cksum(struct ip * ip)76 update_cksum(struct ip *ip)
77 {
78 ip->ip_sum = 0;
79 ip->ip_sum = in_cksum(ip, sizeof(struct ip));
80 }
81
82 static struct lopacket *
alloc_lopacket(in_addr_t dstaddr,size_t payloadlen)83 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen)
84 {
85 struct ip *ip;
86 struct lopacket *packet;
87 size_t pktlen;
88
89 pktlen = sizeof(*packet) + payloadlen;
90 packet = malloc(pktlen);
91 ATF_REQUIRE(packet != NULL);
92
93 memset(packet, 0, pktlen);
94 packet->family = AF_INET;
95
96 ip = &packet->hdr;
97 ip->ip_hl = sizeof(struct ip) >> 2;
98 ip->ip_v = 4;
99 ip->ip_tos = 0;
100 ip->ip_len = htons(sizeof(*ip) + payloadlen);
101 ip->ip_id = 0;
102 ip->ip_off = 0;
103 ip->ip_ttl = 1;
104 ip->ip_p = IPPROTO_IP;
105 ip->ip_sum = 0;
106 ip->ip_src.s_addr = dstaddr;
107 ip->ip_dst.s_addr = dstaddr;
108 update_cksum(ip);
109
110 return (packet);
111 }
112
113 static void
free_lopacket(struct lopacket * packet)114 free_lopacket(struct lopacket *packet)
115 {
116
117 free(packet);
118 }
119
120 static void
write_lopacket(int bpffd,struct lopacket * packet)121 write_lopacket(int bpffd, struct lopacket *packet)
122 {
123 struct timespec ts;
124 ssize_t n;
125 size_t len;
126
127 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len);
128 n = write(bpffd, packet, len);
129 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno));
130 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu",
131 n, len);
132
133 /*
134 * Loopback packets are dispatched asynchronously, give netisr some
135 * time.
136 */
137 ts.tv_sec = 0;
138 ts.tv_nsec = 5000000; /* 5ms */
139 (void)nanosleep(&ts, NULL);
140 }
141
142 static int
open_lobpf(in_addr_t * addrp)143 open_lobpf(in_addr_t *addrp)
144 {
145 struct ifreq ifr;
146 struct ifaddrs *ifa, *ifap;
147 int error, fd;
148
149 fd = open("/dev/bpf0", O_RDWR);
150 if (fd < 0 && errno == ENOENT)
151 atf_tc_skip("no BPF device available");
152 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno));
153
154 error = getifaddrs(&ifap);
155 ATF_REQUIRE(error == 0);
156 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
157 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 &&
158 ifa->ifa_addr->sa_family == AF_INET)
159 break;
160 if (ifa == NULL)
161 atf_tc_skip("no loopback address found");
162
163 memset(&ifr, 0, sizeof(ifr));
164 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ);
165 error = ioctl(fd, BIOCSETIF, &ifr);
166 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno));
167
168 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr;
169
170 freeifaddrs(ifap);
171
172 return (fd);
173 }
174
175 static void
get_ipstat(struct ipstat * stat)176 get_ipstat(struct ipstat *stat)
177 {
178 size_t len;
179 int error;
180
181 memset(stat, 0, sizeof(*stat));
182 len = sizeof(*stat);
183 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0);
184 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s",
185 strerror(errno));
186 ATF_REQUIRE(len == sizeof(*stat));
187 }
188
189 #define CHECK_IP_COUNTER(oldp, newp, counter) \
190 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \
191 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \
192 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter);
193
194 /*
195 * Make sure a fragment with MF set doesn't come after the last fragment of a
196 * packet. Make sure that multiple fragments with MF clear have the same offset
197 * and length.
198 */
199 ATF_TC(ip_reass__multiple_last_fragments);
ATF_TC_HEAD(ip_reass__multiple_last_fragments,tc)200 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc)
201 {
202 atf_tc_set_md_var(tc, "require.user", "root");
203 }
ATF_TC_BODY(ip_reass__multiple_last_fragments,tc)204 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc)
205 {
206 struct ipstat old, new;
207 struct ip *ip;
208 struct lopacket *packet1, *packet2, *packet3, *packet4;
209 in_addr_t addr;
210 int error, fd;
211 uint16_t ipid;
212
213 fd = open_lobpf(&addr);
214 ipid = arc4random_uniform(UINT16_MAX + 1);
215
216 packet1 = alloc_lopacket(addr, 16);
217 ip = &packet1->hdr;
218 ip->ip_id = ipid;
219 ip->ip_off = htons(0x10);
220 update_cksum(ip);
221
222 packet2 = alloc_lopacket(addr, 16);
223 ip = &packet2->hdr;
224 ip->ip_id = ipid;
225 ip->ip_off = htons(0x20);
226 update_cksum(ip);
227
228 packet3 = alloc_lopacket(addr, 16);
229 ip = &packet3->hdr;
230 ip->ip_id = ipid;
231 ip->ip_off = htons(0x8);
232 update_cksum(ip);
233
234 packet4 = alloc_lopacket(addr, 32);
235 ip = &packet4->hdr;
236 ip->ip_id = ipid;
237 ip->ip_off = htons(0x10);
238 update_cksum(ip);
239
240 write_lopacket(fd, packet1);
241
242 /* packet2 comes after packet1. */
243 get_ipstat(&old);
244 write_lopacket(fd, packet2);
245 get_ipstat(&new);
246 CHECK_IP_COUNTER(&old, &new, fragdropped);
247
248 /* packet2 comes after packet1 and has MF set. */
249 packet2->hdr.ip_off = htons(IP_MF | 0x20);
250 update_cksum(&packet2->hdr);
251 get_ipstat(&old);
252 write_lopacket(fd, packet2);
253 get_ipstat(&new);
254 CHECK_IP_COUNTER(&old, &new, fragdropped);
255
256 /* packet3 comes before packet1 but overlaps. */
257 get_ipstat(&old);
258 write_lopacket(fd, packet3);
259 get_ipstat(&new);
260 CHECK_IP_COUNTER(&old, &new, fragdropped);
261
262 /* packet4 has the same offset as packet1 but is longer. */
263 get_ipstat(&old);
264 write_lopacket(fd, packet4);
265 get_ipstat(&new);
266 CHECK_IP_COUNTER(&old, &new, fragdropped);
267
268 error = close(fd);
269 ATF_REQUIRE(error == 0);
270 free_lopacket(packet1);
271 free_lopacket(packet2);
272 free_lopacket(packet3);
273 free_lopacket(packet4);
274 }
275
276 /*
277 * Make sure that we reject zero-length fragments.
278 */
279 ATF_TC(ip_reass__zero_length_fragment);
ATF_TC_HEAD(ip_reass__zero_length_fragment,tc)280 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc)
281 {
282 atf_tc_set_md_var(tc, "require.user", "root");
283 }
ATF_TC_BODY(ip_reass__zero_length_fragment,tc)284 ATF_TC_BODY(ip_reass__zero_length_fragment, tc)
285 {
286 struct ipstat old, new;
287 struct ip *ip;
288 struct lopacket *packet1, *packet2;
289 in_addr_t addr;
290 int error, fd;
291 uint16_t ipid;
292
293 fd = open_lobpf(&addr);
294 ipid = arc4random_uniform(UINT16_MAX + 1);
295
296 /*
297 * Create two packets, one with MF set, one without.
298 */
299 packet1 = alloc_lopacket(addr, 0);
300 ip = &packet1->hdr;
301 ip->ip_id = ipid;
302 ip->ip_off = htons(IP_MF | 0x10);
303 update_cksum(ip);
304
305 packet2 = alloc_lopacket(addr, 0);
306 ip = &packet2->hdr;
307 ip->ip_id = ~ipid;
308 ip->ip_off = htons(0x10);
309 update_cksum(ip);
310
311 get_ipstat(&old);
312 write_lopacket(fd, packet1);
313 get_ipstat(&new);
314 CHECK_IP_COUNTER(&old, &new, toosmall);
315 CHECK_IP_COUNTER(&old, &new, fragdropped);
316
317 get_ipstat(&old);
318 write_lopacket(fd, packet2);
319 get_ipstat(&new);
320 CHECK_IP_COUNTER(&old, &new, toosmall);
321 CHECK_IP_COUNTER(&old, &new, fragdropped);
322
323 error = close(fd);
324 ATF_REQUIRE(error == 0);
325 free_lopacket(packet1);
326 free_lopacket(packet2);
327 }
328
329 ATF_TC(ip_reass__large_fragment);
ATF_TC_HEAD(ip_reass__large_fragment,tc)330 ATF_TC_HEAD(ip_reass__large_fragment, tc)
331 {
332 atf_tc_set_md_var(tc, "require.user", "root");
333 }
ATF_TC_BODY(ip_reass__large_fragment,tc)334 ATF_TC_BODY(ip_reass__large_fragment, tc)
335 {
336 struct ipstat old, new;
337 struct ip *ip;
338 struct lopacket *packet1, *packet2;
339 in_addr_t addr;
340 int error, fd;
341 uint16_t ipid;
342
343 fd = open_lobpf(&addr);
344 ipid = arc4random_uniform(UINT16_MAX + 1);
345
346 /*
347 * Create two packets, one with MF set, one without.
348 *
349 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check.
350 */
351 packet1 = alloc_lopacket(addr, 16);
352 ip = &packet1->hdr;
353 ip->ip_id = ipid;
354 ip->ip_off = htons(IP_MF | 0x1fff);
355 update_cksum(ip);
356
357 packet2 = alloc_lopacket(addr, 16);
358 ip = &packet2->hdr;
359 ip->ip_id = ipid;
360 ip->ip_off = htons(0x1fff);
361 update_cksum(ip);
362
363 get_ipstat(&old);
364 write_lopacket(fd, packet1);
365 get_ipstat(&new);
366 CHECK_IP_COUNTER(&old, &new, toolong);
367 CHECK_IP_COUNTER(&old, &new, fragdropped);
368
369 get_ipstat(&old);
370 write_lopacket(fd, packet2);
371 get_ipstat(&new);
372 CHECK_IP_COUNTER(&old, &new, toolong);
373 CHECK_IP_COUNTER(&old, &new, fragdropped);
374
375 error = close(fd);
376 ATF_REQUIRE(error == 0);
377 free_lopacket(packet1);
378 free_lopacket(packet2);
379 }
380
ATF_TP_ADD_TCS(tp)381 ATF_TP_ADD_TCS(tp)
382 {
383 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments);
384 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment);
385 ATF_TP_ADD_TC(tp, ip_reass__large_fragment);
386
387 return (atf_no_error());
388 }
389