xref: /freebsd/sys/netinet/ip_icmp.c (revision 8c0fec805f76bef04e007ca08552bd80ab64daf9)
1c398230bSWarner Losh /*-
2df8bae1dSRodney W. Grimes  * Copyright (c) 1982, 1986, 1988, 1993
3df8bae1dSRodney W. Grimes  *	The Regents of the University of California.  All rights reserved.
4df8bae1dSRodney W. Grimes  *
5df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
6df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
7df8bae1dSRodney W. Grimes  * are met:
8df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
9df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
10df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
11df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
12df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
13df8bae1dSRodney W. Grimes  * 4. Neither the name of the University nor the names of its contributors
14df8bae1dSRodney W. Grimes  *    may be used to endorse or promote products derived from this software
15df8bae1dSRodney W. Grimes  *    without specific prior written permission.
16df8bae1dSRodney W. Grimes  *
17df8bae1dSRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20df8bae1dSRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
28df8bae1dSRodney W. Grimes  *
29df8bae1dSRodney W. Grimes  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
30df8bae1dSRodney W. Grimes  */
31df8bae1dSRodney W. Grimes 
324b421e2dSMike Silbersack #include <sys/cdefs.h>
334b421e2dSMike Silbersack __FBSDID("$FreeBSD$");
344b421e2dSMike Silbersack 
356a800098SYoshinobu Inoue #include "opt_ipsec.h"
366a800098SYoshinobu Inoue 
37df8bae1dSRodney W. Grimes #include <sys/param.h>
38df8bae1dSRodney W. Grimes #include <sys/systm.h>
39df8bae1dSRodney W. Grimes #include <sys/mbuf.h>
40df8bae1dSRodney W. Grimes #include <sys/protosw.h>
41df8bae1dSRodney W. Grimes #include <sys/socket.h>
42df8bae1dSRodney W. Grimes #include <sys/time.h>
43df8bae1dSRodney W. Grimes #include <sys/kernel.h>
44b5e8ce9fSBruce Evans #include <sys/sysctl.h>
45603724d3SBjoern A. Zeeb #include <sys/vimage.h>
46df8bae1dSRodney W. Grimes 
47df8bae1dSRodney W. Grimes #include <net/if.h>
489494d596SBrooks Davis #include <net/if_types.h>
49df8bae1dSRodney W. Grimes #include <net/route.h>
50df8bae1dSRodney W. Grimes 
51df8bae1dSRodney W. Grimes #include <netinet/in.h>
5297d8d152SAndre Oppermann #include <netinet/in_pcb.h>
53df8bae1dSRodney W. Grimes #include <netinet/in_systm.h>
54df8bae1dSRodney W. Grimes #include <netinet/in_var.h>
55df8bae1dSRodney W. Grimes #include <netinet/ip.h>
56df8bae1dSRodney W. Grimes #include <netinet/ip_icmp.h>
57b5e8ce9fSBruce Evans #include <netinet/ip_var.h>
58ef39adf0SAndre Oppermann #include <netinet/ip_options.h>
5997d8d152SAndre Oppermann #include <netinet/tcp.h>
6097d8d152SAndre Oppermann #include <netinet/tcp_var.h>
6197d8d152SAndre Oppermann #include <netinet/tcpip.h>
62df8bae1dSRodney W. Grimes #include <netinet/icmp_var.h>
634b79449eSBjoern A. Zeeb #include <netinet/vinet.h>
64df8bae1dSRodney W. Grimes 
65b2630c29SGeorge V. Neville-Neil #ifdef IPSEC
66b9234fafSSam Leffler #include <netipsec/ipsec.h>
67b9234fafSSam Leffler #include <netipsec/key.h>
68b9234fafSSam Leffler #endif
69b9234fafSSam Leffler 
7072a52a35SJonathan Lemon #include <machine/in_cksum.h>
7172a52a35SJonathan Lemon 
72aed55708SRobert Watson #include <security/mac/mac_framework.h>
73aed55708SRobert Watson 
74df8bae1dSRodney W. Grimes /*
75df8bae1dSRodney W. Grimes  * ICMP routines: error generation, receive packet processing, and
76df8bae1dSRodney W. Grimes  * routines to turnaround packets back to the originator, and
77df8bae1dSRodney W. Grimes  * host table maintenance routines.
78df8bae1dSRodney W. Grimes  */
79df8bae1dSRodney W. Grimes 
8044e33a07SMarko Zec #ifdef VIMAGE_GLOBALS
81cc5934f5SMax Laier struct icmpstat	icmpstat;
8244e33a07SMarko Zec static int	icmpmaskrepl;
8344e33a07SMarko Zec static u_int	icmpmaskfake;
8444e33a07SMarko Zec static int	drop_redirect;
8544e33a07SMarko Zec static int	log_redirect;
8644e33a07SMarko Zec static int	icmplim;
8744e33a07SMarko Zec static int	icmplim_output;
8844e33a07SMarko Zec static char	reply_src[IFNAMSIZ];
8944e33a07SMarko Zec static int	icmp_rfi;
9044e33a07SMarko Zec static int	icmp_quotelen;
9144e33a07SMarko Zec static int	icmpbmcastecho;
9244e33a07SMarko Zec #endif
9344e33a07SMarko Zec 
948b615593SMarko Zec SYSCTL_V_STRUCT(V_NET, vnet_inet, _net_inet_icmp, ICMPCTL_STATS, stats,
958b615593SMarko Zec 	CTLFLAG_RW, icmpstat, icmpstat, "");
960312fbe9SPoul-Henning Kamp 
978b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
988b615593SMarko Zec 	CTLFLAG_RW, icmpmaskrepl, 0,
998b615593SMarko Zec 	"Reply to ICMP Address Mask Request packets.");
10057842a38SMatthew N. Dodd 
1018b615593SMarko Zec SYSCTL_V_UINT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW,
1028b615593SMarko Zec 	icmpmaskfake, 0, "Fake reply to ICMP Address Mask Request packets.");
1030312fbe9SPoul-Henning Kamp 
1048b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, drop_redirect,
1058b615593SMarko Zec 	CTLFLAG_RW, drop_redirect, 0, "Ignore ICMP redirects");
10618d3153eSDag-Erling Smørgrav 
1078b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, log_redirect,
1088b615593SMarko Zec 	CTLFLAG_RW, log_redirect, 0, "Log ICMP redirects to the console");
1096c3b5f69SDag-Erling Smørgrav 
1108b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, ICMPCTL_ICMPLIM, icmplim,
1118b615593SMarko Zec 	CTLFLAG_RW, icmplim, 0, "Maximum number of ICMP responses per second");
1125fce7fc4SMatthew Dillon 
1138b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, icmplim_output,
1148b615593SMarko Zec 	CTLFLAG_RW, icmplim_output, 0,
1158b615593SMarko Zec 	"Enable rate limiting of ICMP responses");
11651508de1SMatthew Dillon 
1178b615593SMarko Zec SYSCTL_V_STRING(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, reply_src,
1188b615593SMarko Zec 	CTLFLAG_RW, reply_src, IFNAMSIZ,
1198b615593SMarko Zec 	"icmp reply source for non-local packets.");
120b74d89bbSAndre Oppermann 
1218b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, reply_from_interface,
1228b615593SMarko Zec 	CTLFLAG_RW, icmp_rfi, 0, "ICMP reply from incoming interface for "
123a0866c8dSAndre Oppermann 	"non-local packets");
124a0866c8dSAndre Oppermann 
1258b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, quotelen, CTLFLAG_RW,
1268b615593SMarko Zec 	icmp_quotelen, 0, "Number of bytes from original packet to "
127e875dfb8SAndre Oppermann 	"quote in ICMP reply");
128e875dfb8SAndre Oppermann 
1295fce7fc4SMatthew Dillon /*
1305fce7fc4SMatthew Dillon  * ICMP broadcast echo sysctl
1315fce7fc4SMatthew Dillon  */
1325fce7fc4SMatthew Dillon 
1338b615593SMarko Zec SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_icmp, OID_AUTO, bmcastecho,
1348b615593SMarko Zec 	CTLFLAG_RW, icmpbmcastecho, 0, "");
1357022ea0aSGarrett Wollman 
13651508de1SMatthew Dillon 
137df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
138df8bae1dSRodney W. Grimes int	icmpprintfs = 0;
139df8bae1dSRodney W. Grimes #endif
140df8bae1dSRodney W. Grimes 
1414d77a549SAlfred Perlstein static void	icmp_reflect(struct mbuf *);
14202c1c707SAndre Oppermann static void	icmp_send(struct mbuf *, struct mbuf *);
1430312fbe9SPoul-Henning Kamp 
144df8bae1dSRodney W. Grimes extern	struct protosw inetsw[];
145df8bae1dSRodney W. Grimes 
14644e33a07SMarko Zec void
14744e33a07SMarko Zec icmp_init(void)
14844e33a07SMarko Zec {
14944e33a07SMarko Zec 	INIT_VNET_INET(curvnet);
15044e33a07SMarko Zec 
15144e33a07SMarko Zec 	V_icmpmaskrepl = 0;
15244e33a07SMarko Zec 	V_icmpmaskfake = 0;
15344e33a07SMarko Zec 	V_drop_redirect = 0;
15444e33a07SMarko Zec 	V_log_redirect = 0;
15544e33a07SMarko Zec 	V_icmplim = 200;
15644e33a07SMarko Zec 	V_icmplim_output = 1;
15744e33a07SMarko Zec 	V_icmp_rfi = 0;
15844e33a07SMarko Zec 	V_icmp_quotelen = 8;
15944e33a07SMarko Zec 	V_icmpbmcastecho = 0;
16044e33a07SMarko Zec }
16144e33a07SMarko Zec 
162df8bae1dSRodney W. Grimes /*
163df8bae1dSRodney W. Grimes  * Generate an error packet of type error
164df8bae1dSRodney W. Grimes  * in response to bad packet ip.
165df8bae1dSRodney W. Grimes  */
166df8bae1dSRodney W. Grimes void
167d685b6eeSLuigi Rizzo icmp_error(struct mbuf *n, int type, int code, uint32_t dest, int mtu)
168df8bae1dSRodney W. Grimes {
1698b615593SMarko Zec 	INIT_VNET_INET(curvnet);
170df8bae1dSRodney W. Grimes 	register struct ip *oip = mtod(n, struct ip *), *nip;
171e86ebebcSAndre Oppermann 	register unsigned oiphlen = oip->ip_hl << 2;
172df8bae1dSRodney W. Grimes 	register struct icmp *icp;
173df8bae1dSRodney W. Grimes 	register struct mbuf *m;
174e86ebebcSAndre Oppermann 	unsigned icmplen, icmpelen, nlen;
175df8bae1dSRodney W. Grimes 
176e86ebebcSAndre Oppermann 	KASSERT((u_int)type <= ICMP_MAXTYPE, ("%s: illegal ICMP type", __func__));
177df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
178df8bae1dSRodney W. Grimes 	if (icmpprintfs)
179623ae52eSPoul-Henning Kamp 		printf("icmp_error(%p, %x, %d)\n", oip, type, code);
180df8bae1dSRodney W. Grimes #endif
181df8bae1dSRodney W. Grimes 	if (type != ICMP_REDIRECT)
182e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_error);
183df8bae1dSRodney W. Grimes 	/*
184e86ebebcSAndre Oppermann 	 * Don't send error:
185e86ebebcSAndre Oppermann 	 *  if the original packet was encrypted.
186e86ebebcSAndre Oppermann 	 *  if not the first fragment of message.
187e86ebebcSAndre Oppermann 	 *  in response to a multicast or broadcast packet.
188e86ebebcSAndre Oppermann 	 *  if the old packet protocol was an ICMP error message.
189df8bae1dSRodney W. Grimes 	 */
190cad1917dSHajimu UMEMOTO 	if (n->m_flags & M_DECRYPTED)
191cad1917dSHajimu UMEMOTO 		goto freeit;
192df8bae1dSRodney W. Grimes 	if (oip->ip_off & ~(IP_MF|IP_DF))
193df8bae1dSRodney W. Grimes 		goto freeit;
194e86ebebcSAndre Oppermann 	if (n->m_flags & (M_BCAST|M_MCAST))
195e86ebebcSAndre Oppermann 		goto freeit;
196df8bae1dSRodney W. Grimes 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
197e86ebebcSAndre Oppermann 	  n->m_len >= oiphlen + ICMP_MINLEN &&
198e86ebebcSAndre Oppermann 	  !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiphlen))->icmp_type)) {
199e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_oldicmp);
200df8bae1dSRodney W. Grimes 		goto freeit;
201df8bae1dSRodney W. Grimes 	}
202e86ebebcSAndre Oppermann 	/* Drop if IP header plus 8 bytes is not contignous in first mbuf. */
203e86ebebcSAndre Oppermann 	if (oiphlen + 8 > n->m_len)
204df8bae1dSRodney W. Grimes 		goto freeit;
205df8bae1dSRodney W. Grimes 	/*
206e86ebebcSAndre Oppermann 	 * Calculate length to quote from original packet and
207e86ebebcSAndre Oppermann 	 * prevent the ICMP mbuf from overflowing.
208e86ebebcSAndre Oppermann 	 * Unfortunatly this is non-trivial since ip_forward()
209e86ebebcSAndre Oppermann 	 * sends us truncated packets.
210df8bae1dSRodney W. Grimes 	 */
211e86ebebcSAndre Oppermann 	nlen = m_length(n, NULL);
212e86ebebcSAndre Oppermann 	if (oip->ip_p == IPPROTO_TCP) {
213e86ebebcSAndre Oppermann 		struct tcphdr *th;
214e86ebebcSAndre Oppermann 		int tcphlen;
215e86ebebcSAndre Oppermann 
216e86ebebcSAndre Oppermann 		if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
217e86ebebcSAndre Oppermann 		    n->m_next == NULL)
218e86ebebcSAndre Oppermann 			goto stdreply;
219e86ebebcSAndre Oppermann 		if (n->m_len < oiphlen + sizeof(struct tcphdr) &&
220e86ebebcSAndre Oppermann 		    ((n = m_pullup(n, oiphlen + sizeof(struct tcphdr))) == NULL))
221e86ebebcSAndre Oppermann 			goto freeit;
222e86ebebcSAndre Oppermann 		th = (struct tcphdr *)((caddr_t)oip + oiphlen);
223e86ebebcSAndre Oppermann 		tcphlen = th->th_off << 2;
224e86ebebcSAndre Oppermann 		if (tcphlen < sizeof(struct tcphdr))
225e86ebebcSAndre Oppermann 			goto freeit;
226e86ebebcSAndre Oppermann 		if (oip->ip_len < oiphlen + tcphlen)
227e86ebebcSAndre Oppermann 			goto freeit;
228e86ebebcSAndre Oppermann 		if (oiphlen + tcphlen > n->m_len && n->m_next == NULL)
229e86ebebcSAndre Oppermann 			goto stdreply;
230e86ebebcSAndre Oppermann 		if (n->m_len < oiphlen + tcphlen &&
231e86ebebcSAndre Oppermann 		    ((n = m_pullup(n, oiphlen + tcphlen)) == NULL))
232e86ebebcSAndre Oppermann 			goto freeit;
2338b615593SMarko Zec 		icmpelen = max(tcphlen, min(V_icmp_quotelen, oip->ip_len - oiphlen));
234e86ebebcSAndre Oppermann 	} else
2358b615593SMarko Zec stdreply:	icmpelen = max(8, min(V_icmp_quotelen, oip->ip_len - oiphlen));
236e86ebebcSAndre Oppermann 
237e86ebebcSAndre Oppermann 	icmplen = min(oiphlen + icmpelen, nlen);
238e86ebebcSAndre Oppermann 	if (icmplen < sizeof(struct ip))
239e86ebebcSAndre Oppermann 		goto freeit;
240e86ebebcSAndre Oppermann 
241e86ebebcSAndre Oppermann 	if (MHLEN > sizeof(struct ip) + ICMP_MINLEN + icmplen)
242e86ebebcSAndre Oppermann 		m = m_gethdr(M_DONTWAIT, MT_DATA);
243e86ebebcSAndre Oppermann 	else
244e86ebebcSAndre Oppermann 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
245df8bae1dSRodney W. Grimes 	if (m == NULL)
246df8bae1dSRodney W. Grimes 		goto freeit;
2470070e096SRobert Watson #ifdef MAC
248a13e21f7SRobert Watson 	mac_netinet_icmp_reply(n, m);
2490070e096SRobert Watson #endif
250e86ebebcSAndre Oppermann 	icmplen = min(icmplen, M_TRAILINGSPACE(m) - sizeof(struct ip) - ICMP_MINLEN);
251e86ebebcSAndre Oppermann 	m_align(m, ICMP_MINLEN + icmplen);
252e86ebebcSAndre Oppermann 	m->m_len = ICMP_MINLEN + icmplen;
2536b773dffSAndre Oppermann 
2548b07e49aSJulian Elischer 	/* XXX MRT  make the outgoing packet use the same FIB
2558b07e49aSJulian Elischer 	 * that was associated with the incoming packet
2568b07e49aSJulian Elischer 	 */
2578b07e49aSJulian Elischer 	M_SETFIB(m, M_GETFIB(n));
258df8bae1dSRodney W. Grimes 	icp = mtod(m, struct icmp *);
259e27b0c87SRobert Watson 	ICMPSTAT_INC(icps_outhist[type]);
260df8bae1dSRodney W. Grimes 	icp->icmp_type = type;
261df8bae1dSRodney W. Grimes 	if (type == ICMP_REDIRECT)
262df8bae1dSRodney W. Grimes 		icp->icmp_gwaddr.s_addr = dest;
263df8bae1dSRodney W. Grimes 	else {
264df8bae1dSRodney W. Grimes 		icp->icmp_void = 0;
265df8bae1dSRodney W. Grimes 		/*
266df8bae1dSRodney W. Grimes 		 * The following assignments assume an overlay with the
267e86ebebcSAndre Oppermann 		 * just zeroed icmp_void field.
268df8bae1dSRodney W. Grimes 		 */
269df8bae1dSRodney W. Grimes 		if (type == ICMP_PARAMPROB) {
270df8bae1dSRodney W. Grimes 			icp->icmp_pptr = code;
271df8bae1dSRodney W. Grimes 			code = 0;
272df8bae1dSRodney W. Grimes 		} else if (type == ICMP_UNREACH &&
273c773494eSAndre Oppermann 			code == ICMP_UNREACH_NEEDFRAG && mtu) {
274c773494eSAndre Oppermann 			icp->icmp_nextmtu = htons(mtu);
275df8bae1dSRodney W. Grimes 		}
276df8bae1dSRodney W. Grimes 	}
277df8bae1dSRodney W. Grimes 	icp->icmp_code = code;
27804287599SRuslan Ermilov 
27904287599SRuslan Ermilov 	/*
280e86ebebcSAndre Oppermann 	 * Copy the quotation into ICMP message and
281e86ebebcSAndre Oppermann 	 * convert quoted IP header back to network representation.
28204287599SRuslan Ermilov 	 */
283e86ebebcSAndre Oppermann 	m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
284e86ebebcSAndre Oppermann 	nip = &icp->icmp_ip;
285fd8e4ebcSMike Barcroft 	nip->ip_len = htons(nip->ip_len);
286fd8e4ebcSMike Barcroft 	nip->ip_off = htons(nip->ip_off);
287df8bae1dSRodney W. Grimes 
288df8bae1dSRodney W. Grimes 	/*
289e86ebebcSAndre Oppermann 	 * Set up ICMP message mbuf and copy old IP header (without options
290e86ebebcSAndre Oppermann 	 * in front of ICMP message.
291c550f220SMax Laier 	 * If the original mbuf was meant to bypass the firewall, the error
292c550f220SMax Laier 	 * reply should bypass as well.
293c550f220SMax Laier 	 */
294c550f220SMax Laier 	m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
295df8bae1dSRodney W. Grimes 	m->m_data -= sizeof(struct ip);
296df8bae1dSRodney W. Grimes 	m->m_len += sizeof(struct ip);
297df8bae1dSRodney W. Grimes 	m->m_pkthdr.len = m->m_len;
298df8bae1dSRodney W. Grimes 	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
299df8bae1dSRodney W. Grimes 	nip = mtod(m, struct ip *);
300df8bae1dSRodney W. Grimes 	bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
301df8bae1dSRodney W. Grimes 	nip->ip_len = m->m_len;
30253be11f6SPoul-Henning Kamp 	nip->ip_v = IPVERSION;
30353be11f6SPoul-Henning Kamp 	nip->ip_hl = 5;
304df8bae1dSRodney W. Grimes 	nip->ip_p = IPPROTO_ICMP;
305df8bae1dSRodney W. Grimes 	nip->ip_tos = 0;
306df8bae1dSRodney W. Grimes 	icmp_reflect(m);
307df8bae1dSRodney W. Grimes 
308df8bae1dSRodney W. Grimes freeit:
309df8bae1dSRodney W. Grimes 	m_freem(n);
310df8bae1dSRodney W. Grimes }
311df8bae1dSRodney W. Grimes 
312df8bae1dSRodney W. Grimes /*
313df8bae1dSRodney W. Grimes  * Process a received ICMP message.
314df8bae1dSRodney W. Grimes  */
315df8bae1dSRodney W. Grimes void
316f2565d68SRobert Watson icmp_input(struct mbuf *m, int off)
317df8bae1dSRodney W. Grimes {
3188b615593SMarko Zec 	INIT_VNET_INET(curvnet);
31916d6c90fSAndre Oppermann 	struct icmp *icp;
320df8bae1dSRodney W. Grimes 	struct in_ifaddr *ia;
32116d6c90fSAndre Oppermann 	struct ip *ip = mtod(m, struct ip *);
32216d6c90fSAndre Oppermann 	struct sockaddr_in icmpsrc, icmpdst, icmpgw;
32316d6c90fSAndre Oppermann 	int hlen = off;
32416d6c90fSAndre Oppermann 	int icmplen = ip->ip_len;
32516d6c90fSAndre Oppermann 	int i, code;
3264d77a549SAlfred Perlstein 	void (*ctlfunc)(int, struct sockaddr *, void *);
3278b07e49aSJulian Elischer 	int fibnum;
328df8bae1dSRodney W. Grimes 
329df8bae1dSRodney W. Grimes 	/*
330df8bae1dSRodney W. Grimes 	 * Locate icmp structure in mbuf, and check
331df8bae1dSRodney W. Grimes 	 * that not corrupted and of at least minimum length.
332df8bae1dSRodney W. Grimes 	 */
333df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
3342b758395SGarrett Wollman 	if (icmpprintfs) {
3352b758395SGarrett Wollman 		char buf[4 * sizeof "123"];
3362b758395SGarrett Wollman 		strcpy(buf, inet_ntoa(ip->ip_src));
3372b758395SGarrett Wollman 		printf("icmp_input from %s to %s, len %d\n",
3382b758395SGarrett Wollman 		       buf, inet_ntoa(ip->ip_dst), icmplen);
3392b758395SGarrett Wollman 	}
340df8bae1dSRodney W. Grimes #endif
341df8bae1dSRodney W. Grimes 	if (icmplen < ICMP_MINLEN) {
342e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_tooshort);
343df8bae1dSRodney W. Grimes 		goto freeit;
344df8bae1dSRodney W. Grimes 	}
345df8bae1dSRodney W. Grimes 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
346df8bae1dSRodney W. Grimes 	if (m->m_len < i && (m = m_pullup(m, i)) == 0)  {
347e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_tooshort);
348df8bae1dSRodney W. Grimes 		return;
349df8bae1dSRodney W. Grimes 	}
350df8bae1dSRodney W. Grimes 	ip = mtod(m, struct ip *);
351df8bae1dSRodney W. Grimes 	m->m_len -= hlen;
352df8bae1dSRodney W. Grimes 	m->m_data += hlen;
353df8bae1dSRodney W. Grimes 	icp = mtod(m, struct icmp *);
354df8bae1dSRodney W. Grimes 	if (in_cksum(m, icmplen)) {
355e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_checksum);
356df8bae1dSRodney W. Grimes 		goto freeit;
357df8bae1dSRodney W. Grimes 	}
358df8bae1dSRodney W. Grimes 	m->m_len += hlen;
359df8bae1dSRodney W. Grimes 	m->m_data -= hlen;
360df8bae1dSRodney W. Grimes 
3616a800098SYoshinobu Inoue 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
3626a800098SYoshinobu Inoue 		/*
3636a800098SYoshinobu Inoue 		 * Deliver very specific ICMP type only.
3646a800098SYoshinobu Inoue 		 */
3656a800098SYoshinobu Inoue 		switch (icp->icmp_type) {
3666a800098SYoshinobu Inoue 		case ICMP_UNREACH:
3676a800098SYoshinobu Inoue 		case ICMP_TIMXCEED:
3686a800098SYoshinobu Inoue 			break;
3696a800098SYoshinobu Inoue 		default:
3706a800098SYoshinobu Inoue 			goto freeit;
3716a800098SYoshinobu Inoue 		}
3726a800098SYoshinobu Inoue 	}
3736a800098SYoshinobu Inoue 
374df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
375df8bae1dSRodney W. Grimes 	if (icmpprintfs)
376df8bae1dSRodney W. Grimes 		printf("icmp_input, type %d code %d\n", icp->icmp_type,
377df8bae1dSRodney W. Grimes 		    icp->icmp_code);
378df8bae1dSRodney W. Grimes #endif
3795b7ee6edSGarrett Wollman 
3805b7ee6edSGarrett Wollman 	/*
3815b7ee6edSGarrett Wollman 	 * Message type specific processing.
3825b7ee6edSGarrett Wollman 	 */
383df8bae1dSRodney W. Grimes 	if (icp->icmp_type > ICMP_MAXTYPE)
384df8bae1dSRodney W. Grimes 		goto raw;
38516d6c90fSAndre Oppermann 
38616d6c90fSAndre Oppermann 	/* Initialize */
38716d6c90fSAndre Oppermann 	bzero(&icmpsrc, sizeof(icmpsrc));
38816d6c90fSAndre Oppermann 	icmpsrc.sin_len = sizeof(struct sockaddr_in);
38916d6c90fSAndre Oppermann 	icmpsrc.sin_family = AF_INET;
39016d6c90fSAndre Oppermann 	bzero(&icmpdst, sizeof(icmpdst));
39116d6c90fSAndre Oppermann 	icmpdst.sin_len = sizeof(struct sockaddr_in);
39216d6c90fSAndre Oppermann 	icmpdst.sin_family = AF_INET;
39316d6c90fSAndre Oppermann 	bzero(&icmpgw, sizeof(icmpgw));
39416d6c90fSAndre Oppermann 	icmpgw.sin_len = sizeof(struct sockaddr_in);
39516d6c90fSAndre Oppermann 	icmpgw.sin_family = AF_INET;
39616d6c90fSAndre Oppermann 
397e27b0c87SRobert Watson 	ICMPSTAT_INC(icps_inhist[icp->icmp_type]);
398df8bae1dSRodney W. Grimes 	code = icp->icmp_code;
399df8bae1dSRodney W. Grimes 	switch (icp->icmp_type) {
400df8bae1dSRodney W. Grimes 
401df8bae1dSRodney W. Grimes 	case ICMP_UNREACH:
402df8bae1dSRodney W. Grimes 		switch (code) {
403df8bae1dSRodney W. Grimes 			case ICMP_UNREACH_NET:
404df8bae1dSRodney W. Grimes 			case ICMP_UNREACH_HOST:
405df8bae1dSRodney W. Grimes 			case ICMP_UNREACH_SRCFAIL:
406e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_NET_UNKNOWN:
407e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_HOST_UNKNOWN:
408e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_ISOLATED:
409e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_TOSNET:
410e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_TOSHOST:
411e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_HOST_PRECEDENCE:
412e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_PRECEDENCE_CUTOFF:
413e4bb5b05SJonathan Lemon 				code = PRC_UNREACH_NET;
414df8bae1dSRodney W. Grimes 				break;
415df8bae1dSRodney W. Grimes 
416df8bae1dSRodney W. Grimes 			case ICMP_UNREACH_NEEDFRAG:
417df8bae1dSRodney W. Grimes 				code = PRC_MSGSIZE;
418df8bae1dSRodney W. Grimes 				break;
419df8bae1dSRodney W. Grimes 
420e4bb5b05SJonathan Lemon 			/*
421e4bb5b05SJonathan Lemon 			 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
422e4bb5b05SJonathan Lemon 			 * Treat subcodes 2,3 as immediate RST
423e4bb5b05SJonathan Lemon 			 */
424e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_PROTOCOL:
425e4bb5b05SJonathan Lemon 			case ICMP_UNREACH_PORT:
426b77d155dSJesper Skriver 				code = PRC_UNREACH_PORT;
427b11d7a4aSPoul-Henning Kamp 				break;
42890fcbbd6SPoul-Henning Kamp 
42990fcbbd6SPoul-Henning Kamp 			case ICMP_UNREACH_NET_PROHIB:
43090fcbbd6SPoul-Henning Kamp 			case ICMP_UNREACH_HOST_PROHIB:
4319c4b2574SPaul Traina 			case ICMP_UNREACH_FILTER_PROHIB:
43290fcbbd6SPoul-Henning Kamp 				code = PRC_UNREACH_ADMIN_PROHIB;
433b11d7a4aSPoul-Henning Kamp 				break;
434b11d7a4aSPoul-Henning Kamp 
435df8bae1dSRodney W. Grimes 			default:
436df8bae1dSRodney W. Grimes 				goto badcode;
437df8bae1dSRodney W. Grimes 		}
438df8bae1dSRodney W. Grimes 		goto deliver;
439df8bae1dSRodney W. Grimes 
440df8bae1dSRodney W. Grimes 	case ICMP_TIMXCEED:
441df8bae1dSRodney W. Grimes 		if (code > 1)
442df8bae1dSRodney W. Grimes 			goto badcode;
443df8bae1dSRodney W. Grimes 		code += PRC_TIMXCEED_INTRANS;
444df8bae1dSRodney W. Grimes 		goto deliver;
445df8bae1dSRodney W. Grimes 
446df8bae1dSRodney W. Grimes 	case ICMP_PARAMPROB:
447df8bae1dSRodney W. Grimes 		if (code > 1)
448df8bae1dSRodney W. Grimes 			goto badcode;
449df8bae1dSRodney W. Grimes 		code = PRC_PARAMPROB;
450df8bae1dSRodney W. Grimes 		goto deliver;
451df8bae1dSRodney W. Grimes 
452df8bae1dSRodney W. Grimes 	case ICMP_SOURCEQUENCH:
453df8bae1dSRodney W. Grimes 		if (code)
454df8bae1dSRodney W. Grimes 			goto badcode;
455df8bae1dSRodney W. Grimes 		code = PRC_QUENCH;
456df8bae1dSRodney W. Grimes 	deliver:
457df8bae1dSRodney W. Grimes 		/*
458df8bae1dSRodney W. Grimes 		 * Problem with datagram; advise higher level routines.
459df8bae1dSRodney W. Grimes 		 */
460df8bae1dSRodney W. Grimes 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
46153be11f6SPoul-Henning Kamp 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
462e27b0c87SRobert Watson 			ICMPSTAT_INC(icps_badlen);
463df8bae1dSRodney W. Grimes 			goto freeit;
464df8bae1dSRodney W. Grimes 		}
465fd8e4ebcSMike Barcroft 		icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
4665b7ee6edSGarrett Wollman 		/* Discard ICMP's in response to multicast packets */
4675b7ee6edSGarrett Wollman 		if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
4685b7ee6edSGarrett Wollman 			goto badcode;
469df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
470df8bae1dSRodney W. Grimes 		if (icmpprintfs)
471df8bae1dSRodney W. Grimes 			printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
472df8bae1dSRodney W. Grimes #endif
473df8bae1dSRodney W. Grimes 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
4746a800098SYoshinobu Inoue 		/*
4756a800098SYoshinobu Inoue 		 * XXX if the packet contains [IPv4 AH TCP], we can't make a
4766a800098SYoshinobu Inoue 		 * notification to TCP layer.
4776a800098SYoshinobu Inoue 		 */
478623ae52eSPoul-Henning Kamp 		ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
479623ae52eSPoul-Henning Kamp 		if (ctlfunc)
480df8bae1dSRodney W. Grimes 			(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
481b62d102cSBruce Evans 				   (void *)&icp->icmp_ip);
482df8bae1dSRodney W. Grimes 		break;
483df8bae1dSRodney W. Grimes 
484df8bae1dSRodney W. Grimes 	badcode:
485e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_badcode);
486df8bae1dSRodney W. Grimes 		break;
487df8bae1dSRodney W. Grimes 
488df8bae1dSRodney W. Grimes 	case ICMP_ECHO:
4898b615593SMarko Zec 		if (!V_icmpbmcastecho
490d311884fSDavid Greenman 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
491e27b0c87SRobert Watson 			ICMPSTAT_INC(icps_bmcastecho);
4927022ea0aSGarrett Wollman 			break;
4937022ea0aSGarrett Wollman 		}
494df8bae1dSRodney W. Grimes 		icp->icmp_type = ICMP_ECHOREPLY;
495a57815efSBosko Milekic 		if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
49609f81a46SBosko Milekic 			goto freeit;
49709f81a46SBosko Milekic 		else
498df8bae1dSRodney W. Grimes 			goto reflect;
499df8bae1dSRodney W. Grimes 
500df8bae1dSRodney W. Grimes 	case ICMP_TSTAMP:
5018b615593SMarko Zec 		if (!V_icmpbmcastecho
502d311884fSDavid Greenman 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
503e27b0c87SRobert Watson 			ICMPSTAT_INC(icps_bmcasttstamp);
504fe0fb8abSGarrett Wollman 			break;
505fe0fb8abSGarrett Wollman 		}
506df8bae1dSRodney W. Grimes 		if (icmplen < ICMP_TSLEN) {
507e27b0c87SRobert Watson 			ICMPSTAT_INC(icps_badlen);
508df8bae1dSRodney W. Grimes 			break;
509df8bae1dSRodney W. Grimes 		}
510df8bae1dSRodney W. Grimes 		icp->icmp_type = ICMP_TSTAMPREPLY;
511df8bae1dSRodney W. Grimes 		icp->icmp_rtime = iptime();
512df8bae1dSRodney W. Grimes 		icp->icmp_ttime = icp->icmp_rtime;	/* bogus, do later! */
513a57815efSBosko Milekic 		if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
51409f81a46SBosko Milekic 			goto freeit;
51509f81a46SBosko Milekic 		else
516df8bae1dSRodney W. Grimes 			goto reflect;
517df8bae1dSRodney W. Grimes 
518df8bae1dSRodney W. Grimes 	case ICMP_MASKREQ:
5198b615593SMarko Zec 		if (V_icmpmaskrepl == 0)
520df8bae1dSRodney W. Grimes 			break;
521df8bae1dSRodney W. Grimes 		/*
522df8bae1dSRodney W. Grimes 		 * We are not able to respond with all ones broadcast
523df8bae1dSRodney W. Grimes 		 * unless we receive it over a point-to-point interface.
524df8bae1dSRodney W. Grimes 		 */
525df8bae1dSRodney W. Grimes 		if (icmplen < ICMP_MASKLEN)
526df8bae1dSRodney W. Grimes 			break;
527df8bae1dSRodney W. Grimes 		switch (ip->ip_dst.s_addr) {
528df8bae1dSRodney W. Grimes 
529df8bae1dSRodney W. Grimes 		case INADDR_BROADCAST:
530df8bae1dSRodney W. Grimes 		case INADDR_ANY:
531df8bae1dSRodney W. Grimes 			icmpdst.sin_addr = ip->ip_src;
532df8bae1dSRodney W. Grimes 			break;
533df8bae1dSRodney W. Grimes 
534df8bae1dSRodney W. Grimes 		default:
535df8bae1dSRodney W. Grimes 			icmpdst.sin_addr = ip->ip_dst;
536df8bae1dSRodney W. Grimes 		}
537df8bae1dSRodney W. Grimes 		ia = (struct in_ifaddr *)ifaof_ifpforaddr(
538df8bae1dSRodney W. Grimes 			    (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
5398c0fec80SRobert Watson 		if (ia == NULL)
540df8bae1dSRodney W. Grimes 			break;
5418c0fec80SRobert Watson 		if (ia->ia_ifp == NULL) {
5428c0fec80SRobert Watson 			ifa_free(&ia->ia_ifa);
5437e6f7714SPoul-Henning Kamp 			break;
5448c0fec80SRobert Watson 		}
545df8bae1dSRodney W. Grimes 		icp->icmp_type = ICMP_MASKREPLY;
5468b615593SMarko Zec 		if (V_icmpmaskfake == 0)
547df8bae1dSRodney W. Grimes 			icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
54857842a38SMatthew N. Dodd 		else
5498b615593SMarko Zec 			icp->icmp_mask = V_icmpmaskfake;
550df8bae1dSRodney W. Grimes 		if (ip->ip_src.s_addr == 0) {
551df8bae1dSRodney W. Grimes 			if (ia->ia_ifp->if_flags & IFF_BROADCAST)
552df8bae1dSRodney W. Grimes 			    ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
553df8bae1dSRodney W. Grimes 			else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
554df8bae1dSRodney W. Grimes 			    ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
555df8bae1dSRodney W. Grimes 		}
5568c0fec80SRobert Watson 		ifa_free(&ia->ia_ifa);
557df8bae1dSRodney W. Grimes reflect:
558df8bae1dSRodney W. Grimes 		ip->ip_len += hlen;	/* since ip_input deducts this */
559e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_reflect);
560e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_outhist[icp->icmp_type]);
561df8bae1dSRodney W. Grimes 		icmp_reflect(m);
562df8bae1dSRodney W. Grimes 		return;
563df8bae1dSRodney W. Grimes 
564df8bae1dSRodney W. Grimes 	case ICMP_REDIRECT:
5658b615593SMarko Zec 		if (V_log_redirect) {
56618d3153eSDag-Erling Smørgrav 			u_long src, dst, gw;
56718d3153eSDag-Erling Smørgrav 
56818d3153eSDag-Erling Smørgrav 			src = ntohl(ip->ip_src.s_addr);
56918d3153eSDag-Erling Smørgrav 			dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
57018d3153eSDag-Erling Smørgrav 			gw = ntohl(icp->icmp_gwaddr.s_addr);
57118d3153eSDag-Erling Smørgrav 			printf("icmp redirect from %d.%d.%d.%d: "
57218d3153eSDag-Erling Smørgrav 			       "%d.%d.%d.%d => %d.%d.%d.%d\n",
57318d3153eSDag-Erling Smørgrav 			       (int)(src >> 24), (int)((src >> 16) & 0xff),
57418d3153eSDag-Erling Smørgrav 			       (int)((src >> 8) & 0xff), (int)(src & 0xff),
57518d3153eSDag-Erling Smørgrav 			       (int)(dst >> 24), (int)((dst >> 16) & 0xff),
57618d3153eSDag-Erling Smørgrav 			       (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
57718d3153eSDag-Erling Smørgrav 			       (int)(gw >> 24), (int)((gw >> 16) & 0xff),
57818d3153eSDag-Erling Smørgrav 			       (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
57918d3153eSDag-Erling Smørgrav 		}
58087c3bd27SAndre Oppermann 		/*
58187c3bd27SAndre Oppermann 		 * RFC1812 says we must ignore ICMP redirects if we
58287c3bd27SAndre Oppermann 		 * are acting as router.
58387c3bd27SAndre Oppermann 		 */
5848b615593SMarko Zec 		if (V_drop_redirect || V_ipforwarding)
58518d3153eSDag-Erling Smørgrav 			break;
586df8bae1dSRodney W. Grimes 		if (code > 3)
587df8bae1dSRodney W. Grimes 			goto badcode;
588df8bae1dSRodney W. Grimes 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
58953be11f6SPoul-Henning Kamp 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
590e27b0c87SRobert Watson 			ICMPSTAT_INC(icps_badlen);
591df8bae1dSRodney W. Grimes 			break;
592df8bae1dSRodney W. Grimes 		}
593df8bae1dSRodney W. Grimes 		/*
594df8bae1dSRodney W. Grimes 		 * Short circuit routing redirects to force
595df8bae1dSRodney W. Grimes 		 * immediate change in the kernel's routing
596df8bae1dSRodney W. Grimes 		 * tables.  The message is also handed to anyone
597df8bae1dSRodney W. Grimes 		 * listening on a raw socket (e.g. the routing
598df8bae1dSRodney W. Grimes 		 * daemon for use in updating its tables).
599df8bae1dSRodney W. Grimes 		 */
600df8bae1dSRodney W. Grimes 		icmpgw.sin_addr = ip->ip_src;
601df8bae1dSRodney W. Grimes 		icmpdst.sin_addr = icp->icmp_gwaddr;
602df8bae1dSRodney W. Grimes #ifdef	ICMPPRINTFS
6032b758395SGarrett Wollman 		if (icmpprintfs) {
6042b758395SGarrett Wollman 			char buf[4 * sizeof "123"];
6052b758395SGarrett Wollman 			strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
6062b758395SGarrett Wollman 
6072b758395SGarrett Wollman 			printf("redirect dst %s to %s\n",
6082b758395SGarrett Wollman 			       buf, inet_ntoa(icp->icmp_gwaddr));
6092b758395SGarrett Wollman 		}
610df8bae1dSRodney W. Grimes #endif
611df8bae1dSRodney W. Grimes 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
6128b07e49aSJulian Elischer 		for ( fibnum = 0; fibnum < rt_numfibs; fibnum++) {
6138b07e49aSJulian Elischer 			in_rtredirect((struct sockaddr *)&icmpsrc,
614df8bae1dSRodney W. Grimes 			  (struct sockaddr *)&icmpdst,
615df8bae1dSRodney W. Grimes 			  (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
6168b07e49aSJulian Elischer 			  (struct sockaddr *)&icmpgw, fibnum);
6178b07e49aSJulian Elischer 		}
618df8bae1dSRodney W. Grimes 		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
619b2630c29SGeorge V. Neville-Neil #ifdef IPSEC
6206a800098SYoshinobu Inoue 		key_sa_routechange((struct sockaddr *)&icmpsrc);
6216a800098SYoshinobu Inoue #endif
622df8bae1dSRodney W. Grimes 		break;
623df8bae1dSRodney W. Grimes 
624df8bae1dSRodney W. Grimes 	/*
625df8bae1dSRodney W. Grimes 	 * No kernel processing for the following;
626df8bae1dSRodney W. Grimes 	 * just fall through to send to raw listener.
627df8bae1dSRodney W. Grimes 	 */
628df8bae1dSRodney W. Grimes 	case ICMP_ECHOREPLY:
629df8bae1dSRodney W. Grimes 	case ICMP_ROUTERADVERT:
630df8bae1dSRodney W. Grimes 	case ICMP_ROUTERSOLICIT:
631df8bae1dSRodney W. Grimes 	case ICMP_TSTAMPREPLY:
632df8bae1dSRodney W. Grimes 	case ICMP_IREQREPLY:
633df8bae1dSRodney W. Grimes 	case ICMP_MASKREPLY:
634df8bae1dSRodney W. Grimes 	default:
635df8bae1dSRodney W. Grimes 		break;
636df8bae1dSRodney W. Grimes 	}
637df8bae1dSRodney W. Grimes 
638df8bae1dSRodney W. Grimes raw:
639f0ffb944SJulian Elischer 	rip_input(m, off);
640df8bae1dSRodney W. Grimes 	return;
641df8bae1dSRodney W. Grimes 
642df8bae1dSRodney W. Grimes freeit:
643df8bae1dSRodney W. Grimes 	m_freem(m);
644df8bae1dSRodney W. Grimes }
645df8bae1dSRodney W. Grimes 
646df8bae1dSRodney W. Grimes /*
647df8bae1dSRodney W. Grimes  * Reflect the ip packet back to the source
648df8bae1dSRodney W. Grimes  */
6490312fbe9SPoul-Henning Kamp static void
650f2565d68SRobert Watson icmp_reflect(struct mbuf *m)
651df8bae1dSRodney W. Grimes {
6528b615593SMarko Zec 	INIT_VNET_INET(curvnet);
653ca925d9cSJonathan Lemon 	struct ip *ip = mtod(m, struct ip *);
654ca925d9cSJonathan Lemon 	struct ifaddr *ifa;
65533c4f96dSRobert Watson 	struct ifnet *ifp;
656ca925d9cSJonathan Lemon 	struct in_ifaddr *ia;
657df8bae1dSRodney W. Grimes 	struct in_addr t;
658b5e8ce9fSBruce Evans 	struct mbuf *opts = 0;
65953be11f6SPoul-Henning Kamp 	int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
660df8bae1dSRodney W. Grimes 
6616b9ff6b7SGeorge V. Neville-Neil 	if (IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
6626b9ff6b7SGeorge V. Neville-Neil 	    IN_EXPERIMENTAL(ntohl(ip->ip_src.s_addr)) ||
6636b9ff6b7SGeorge V. Neville-Neil 	    IN_ZERONET(ntohl(ip->ip_src.s_addr)) ) {
664df8bae1dSRodney W. Grimes 		m_freem(m);	/* Bad return address */
665e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_badaddr);
666df8bae1dSRodney W. Grimes 		goto done;	/* Ip_output() will check for broadcast */
667df8bae1dSRodney W. Grimes 	}
6686b9ff6b7SGeorge V. Neville-Neil 
669df8bae1dSRodney W. Grimes 	t = ip->ip_dst;
670df8bae1dSRodney W. Grimes 	ip->ip_dst = ip->ip_src;
6711488eac8SAndre Oppermann 
672df8bae1dSRodney W. Grimes 	/*
6731488eac8SAndre Oppermann 	 * Source selection for ICMP replies:
6741488eac8SAndre Oppermann 	 *
6751488eac8SAndre Oppermann 	 * If the incoming packet was addressed directly to one of our
6761488eac8SAndre Oppermann 	 * own addresses, use dst as the src for the reply.
677df8bae1dSRodney W. Grimes 	 */
67833c4f96dSRobert Watson 	LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) {
67933c4f96dSRobert Watson 		if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) {
68033c4f96dSRobert Watson 			t = IA_SIN(ia)->sin_addr;
681ca925d9cSJonathan Lemon 			goto match;
68233c4f96dSRobert Watson 		}
68333c4f96dSRobert Watson 	}
6841488eac8SAndre Oppermann 	/*
6851488eac8SAndre Oppermann 	 * If the incoming packet was addressed to one of our broadcast
6861488eac8SAndre Oppermann 	 * addresses, use the first non-broadcast address which corresponds
6871488eac8SAndre Oppermann 	 * to the incoming interface.
6881488eac8SAndre Oppermann 	 */
68933c4f96dSRobert Watson 	ifp = m->m_pkthdr.rcvif;
69033c4f96dSRobert Watson 	if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) {
69133c4f96dSRobert Watson 		IF_ADDR_LOCK(ifp);
69233c4f96dSRobert Watson 		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
693ca925d9cSJonathan Lemon 			if (ifa->ifa_addr->sa_family != AF_INET)
694ca925d9cSJonathan Lemon 				continue;
695ca925d9cSJonathan Lemon 			ia = ifatoia(ifa);
696ca925d9cSJonathan Lemon 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
69733c4f96dSRobert Watson 			    t.s_addr) {
69833c4f96dSRobert Watson 				t = IA_SIN(ia)->sin_addr;
69933c4f96dSRobert Watson 				IF_ADDR_UNLOCK(ifp);
700ca925d9cSJonathan Lemon 				goto match;
701df8bae1dSRodney W. Grimes 			}
702ca925d9cSJonathan Lemon 		}
70333c4f96dSRobert Watson 		IF_ADDR_UNLOCK(ifp);
70433c4f96dSRobert Watson 	}
7051488eac8SAndre Oppermann 	/*
706a0866c8dSAndre Oppermann 	 * If the packet was transiting through us, use the address of
707a0866c8dSAndre Oppermann 	 * the interface the packet came through in.  If that interface
708a0866c8dSAndre Oppermann 	 * doesn't have a suitable IP address, the normal selection
709a0866c8dSAndre Oppermann 	 * criteria apply.
710a0866c8dSAndre Oppermann 	 */
71133c4f96dSRobert Watson 	if (V_icmp_rfi && ifp != NULL) {
71233c4f96dSRobert Watson 		IF_ADDR_LOCK(ifp);
71333c4f96dSRobert Watson 		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
714a0866c8dSAndre Oppermann 			if (ifa->ifa_addr->sa_family != AF_INET)
715a0866c8dSAndre Oppermann 				continue;
716a0866c8dSAndre Oppermann 			ia = ifatoia(ifa);
71733c4f96dSRobert Watson 			t = IA_SIN(ia)->sin_addr;
71833c4f96dSRobert Watson 			IF_ADDR_UNLOCK(ifp);
719a0866c8dSAndre Oppermann 			goto match;
720a0866c8dSAndre Oppermann 		}
72133c4f96dSRobert Watson 		IF_ADDR_UNLOCK(ifp);
722a0866c8dSAndre Oppermann 	}
723a0866c8dSAndre Oppermann 	/*
724b74d89bbSAndre Oppermann 	 * If the incoming packet was not addressed directly to us, use
725b74d89bbSAndre Oppermann 	 * designated interface for icmp replies specified by sysctl
726b74d89bbSAndre Oppermann 	 * net.inet.icmp.reply_src (default not set). Otherwise continue
727b74d89bbSAndre Oppermann 	 * with normal source selection.
728b74d89bbSAndre Oppermann 	 */
72933c4f96dSRobert Watson 	if (V_reply_src[0] != '\0' && (ifp = ifunit(V_reply_src))) {
73033c4f96dSRobert Watson 		IF_ADDR_LOCK(ifp);
73133c4f96dSRobert Watson 		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
732b74d89bbSAndre Oppermann 			if (ifa->ifa_addr->sa_family != AF_INET)
733b74d89bbSAndre Oppermann 				continue;
734b74d89bbSAndre Oppermann 			ia = ifatoia(ifa);
73533c4f96dSRobert Watson 			t = IA_SIN(ia)->sin_addr;
73633c4f96dSRobert Watson 			IF_ADDR_UNLOCK(ifp);
737b74d89bbSAndre Oppermann 			goto match;
738b74d89bbSAndre Oppermann 		}
73933c4f96dSRobert Watson 		IF_ADDR_UNLOCK(ifp);
740b74d89bbSAndre Oppermann 	}
741b74d89bbSAndre Oppermann 	/*
7421488eac8SAndre Oppermann 	 * If the packet was transiting through us, use the address of
7431488eac8SAndre Oppermann 	 * the interface that is the closest to the packet source.
7441488eac8SAndre Oppermann 	 * When we don't have a route back to the packet source, stop here
7451488eac8SAndre Oppermann 	 * and drop the packet.
7461488eac8SAndre Oppermann 	 */
7478b07e49aSJulian Elischer 	ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m));
7480d4bef5dSDima Dorfman 	if (ia == NULL) {
7490d4bef5dSDima Dorfman 		m_freem(m);
750e27b0c87SRobert Watson 		ICMPSTAT_INC(icps_noroute);
7510d4bef5dSDima Dorfman 		goto done;
7520d4bef5dSDima Dorfman 	}
75333c4f96dSRobert Watson 	t = IA_SIN(ia)->sin_addr;
7548c0fec80SRobert Watson 	ifa_free(&ia->ia_ifa);
755ca925d9cSJonathan Lemon match:
756baee0c3eSRobert Watson #ifdef MAC
757a13e21f7SRobert Watson 	mac_netinet_icmp_replyinplace(m);
758baee0c3eSRobert Watson #endif
759df8bae1dSRodney W. Grimes 	ip->ip_src = t;
760603724d3SBjoern A. Zeeb 	ip->ip_ttl = V_ip_defttl;
761df8bae1dSRodney W. Grimes 
762df8bae1dSRodney W. Grimes 	if (optlen > 0) {
763df8bae1dSRodney W. Grimes 		register u_char *cp;
764df8bae1dSRodney W. Grimes 		int opt, cnt;
765df8bae1dSRodney W. Grimes 		u_int len;
766df8bae1dSRodney W. Grimes 
767df8bae1dSRodney W. Grimes 		/*
768df8bae1dSRodney W. Grimes 		 * Retrieve any source routing from the incoming packet;
769df8bae1dSRodney W. Grimes 		 * add on any record-route or timestamp options.
770df8bae1dSRodney W. Grimes 		 */
771df8bae1dSRodney W. Grimes 		cp = (u_char *) (ip + 1);
772e0982661SAndre Oppermann 		if ((opts = ip_srcroute(m)) == 0 &&
77334333b16SAndre Oppermann 		    (opts = m_gethdr(M_DONTWAIT, MT_DATA))) {
774df8bae1dSRodney W. Grimes 			opts->m_len = sizeof(struct in_addr);
775df8bae1dSRodney W. Grimes 			mtod(opts, struct in_addr *)->s_addr = 0;
776df8bae1dSRodney W. Grimes 		}
777df8bae1dSRodney W. Grimes 		if (opts) {
778df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
779df8bae1dSRodney W. Grimes 		    if (icmpprintfs)
780df8bae1dSRodney W. Grimes 			    printf("icmp_reflect optlen %d rt %d => ",
781df8bae1dSRodney W. Grimes 				optlen, opts->m_len);
782df8bae1dSRodney W. Grimes #endif
783df8bae1dSRodney W. Grimes 		    for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
784df8bae1dSRodney W. Grimes 			    opt = cp[IPOPT_OPTVAL];
785df8bae1dSRodney W. Grimes 			    if (opt == IPOPT_EOL)
786df8bae1dSRodney W. Grimes 				    break;
787df8bae1dSRodney W. Grimes 			    if (opt == IPOPT_NOP)
788df8bae1dSRodney W. Grimes 				    len = 1;
789df8bae1dSRodney W. Grimes 			    else {
790707d00a3SJonathan Lemon 				    if (cnt < IPOPT_OLEN + sizeof(*cp))
791707d00a3SJonathan Lemon 					    break;
792df8bae1dSRodney W. Grimes 				    len = cp[IPOPT_OLEN];
793707d00a3SJonathan Lemon 				    if (len < IPOPT_OLEN + sizeof(*cp) ||
794707d00a3SJonathan Lemon 				        len > cnt)
795df8bae1dSRodney W. Grimes 					    break;
796df8bae1dSRodney W. Grimes 			    }
797df8bae1dSRodney W. Grimes 			    /*
798df8bae1dSRodney W. Grimes 			     * Should check for overflow, but it "can't happen"
799df8bae1dSRodney W. Grimes 			     */
800df8bae1dSRodney W. Grimes 			    if (opt == IPOPT_RR || opt == IPOPT_TS ||
801df8bae1dSRodney W. Grimes 				opt == IPOPT_SECURITY) {
802df8bae1dSRodney W. Grimes 				    bcopy((caddr_t)cp,
803df8bae1dSRodney W. Grimes 					mtod(opts, caddr_t) + opts->m_len, len);
804df8bae1dSRodney W. Grimes 				    opts->m_len += len;
805df8bae1dSRodney W. Grimes 			    }
806df8bae1dSRodney W. Grimes 		    }
807df8bae1dSRodney W. Grimes 		    /* Terminate & pad, if necessary */
808623ae52eSPoul-Henning Kamp 		    cnt = opts->m_len % 4;
809623ae52eSPoul-Henning Kamp 		    if (cnt) {
810df8bae1dSRodney W. Grimes 			    for (; cnt < 4; cnt++) {
811df8bae1dSRodney W. Grimes 				    *(mtod(opts, caddr_t) + opts->m_len) =
812df8bae1dSRodney W. Grimes 					IPOPT_EOL;
813df8bae1dSRodney W. Grimes 				    opts->m_len++;
814df8bae1dSRodney W. Grimes 			    }
815df8bae1dSRodney W. Grimes 		    }
816df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
817df8bae1dSRodney W. Grimes 		    if (icmpprintfs)
818df8bae1dSRodney W. Grimes 			    printf("%d\n", opts->m_len);
819df8bae1dSRodney W. Grimes #endif
820df8bae1dSRodney W. Grimes 		}
821df8bae1dSRodney W. Grimes 		/*
822df8bae1dSRodney W. Grimes 		 * Now strip out original options by copying rest of first
823df8bae1dSRodney W. Grimes 		 * mbuf's data back, and adjust the IP length.
824df8bae1dSRodney W. Grimes 		 */
825df8bae1dSRodney W. Grimes 		ip->ip_len -= optlen;
82653be11f6SPoul-Henning Kamp 		ip->ip_v = IPVERSION;
82753be11f6SPoul-Henning Kamp 		ip->ip_hl = 5;
828df8bae1dSRodney W. Grimes 		m->m_len -= optlen;
829df8bae1dSRodney W. Grimes 		if (m->m_flags & M_PKTHDR)
830df8bae1dSRodney W. Grimes 			m->m_pkthdr.len -= optlen;
831df8bae1dSRodney W. Grimes 		optlen += sizeof(struct ip);
832df8bae1dSRodney W. Grimes 		bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
833df8bae1dSRodney W. Grimes 			 (unsigned)(m->m_len - sizeof(struct ip)));
834df8bae1dSRodney W. Grimes 	}
8359c855a36SSam Leffler 	m_tag_delete_nonpersistent(m);
836df8bae1dSRodney W. Grimes 	m->m_flags &= ~(M_BCAST|M_MCAST);
83702c1c707SAndre Oppermann 	icmp_send(m, opts);
838df8bae1dSRodney W. Grimes done:
839df8bae1dSRodney W. Grimes 	if (opts)
840df8bae1dSRodney W. Grimes 		(void)m_free(opts);
841df8bae1dSRodney W. Grimes }
842df8bae1dSRodney W. Grimes 
843df8bae1dSRodney W. Grimes /*
844df8bae1dSRodney W. Grimes  * Send an icmp packet back to the ip level,
845df8bae1dSRodney W. Grimes  * after supplying a checksum.
846df8bae1dSRodney W. Grimes  */
8470312fbe9SPoul-Henning Kamp static void
848f2565d68SRobert Watson icmp_send(struct mbuf *m, struct mbuf *opts)
849df8bae1dSRodney W. Grimes {
850df8bae1dSRodney W. Grimes 	register struct ip *ip = mtod(m, struct ip *);
851df8bae1dSRodney W. Grimes 	register int hlen;
852df8bae1dSRodney W. Grimes 	register struct icmp *icp;
853df8bae1dSRodney W. Grimes 
85453be11f6SPoul-Henning Kamp 	hlen = ip->ip_hl << 2;
855df8bae1dSRodney W. Grimes 	m->m_data += hlen;
856df8bae1dSRodney W. Grimes 	m->m_len -= hlen;
857df8bae1dSRodney W. Grimes 	icp = mtod(m, struct icmp *);
858df8bae1dSRodney W. Grimes 	icp->icmp_cksum = 0;
859df8bae1dSRodney W. Grimes 	icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
860df8bae1dSRodney W. Grimes 	m->m_data -= hlen;
861df8bae1dSRodney W. Grimes 	m->m_len += hlen;
86294446a2eSArchie Cobbs 	m->m_pkthdr.rcvif = (struct ifnet *)0;
863df8bae1dSRodney W. Grimes #ifdef ICMPPRINTFS
8642b758395SGarrett Wollman 	if (icmpprintfs) {
8652b758395SGarrett Wollman 		char buf[4 * sizeof "123"];
8662b758395SGarrett Wollman 		strcpy(buf, inet_ntoa(ip->ip_dst));
8672b758395SGarrett Wollman 		printf("icmp_send dst %s src %s\n",
8682b758395SGarrett Wollman 		       buf, inet_ntoa(ip->ip_src));
8692b758395SGarrett Wollman 	}
870df8bae1dSRodney W. Grimes #endif
87102c1c707SAndre Oppermann 	(void) ip_output(m, opts, NULL, 0, NULL, NULL);
872df8bae1dSRodney W. Grimes }
873df8bae1dSRodney W. Grimes 
874d685b6eeSLuigi Rizzo /*
875d685b6eeSLuigi Rizzo  * Return milliseconds since 00:00 GMT in network format.
876d685b6eeSLuigi Rizzo  */
877d685b6eeSLuigi Rizzo uint32_t
878f2565d68SRobert Watson iptime(void)
879df8bae1dSRodney W. Grimes {
880df8bae1dSRodney W. Grimes 	struct timeval atv;
881df8bae1dSRodney W. Grimes 	u_long t;
882df8bae1dSRodney W. Grimes 
88316cd6db0SBill Fumerola 	getmicrotime(&atv);
884df8bae1dSRodney W. Grimes 	t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
885df8bae1dSRodney W. Grimes 	return (htonl(t));
886df8bae1dSRodney W. Grimes }
887df8bae1dSRodney W. Grimes 
8885cbf3e08SGarrett Wollman /*
8895cbf3e08SGarrett Wollman  * Return the next larger or smaller MTU plateau (table from RFC 1191)
8905cbf3e08SGarrett Wollman  * given current value MTU.  If DIR is less than zero, a larger plateau
8915cbf3e08SGarrett Wollman  * is returned; otherwise, a smaller value is returned.
8925cbf3e08SGarrett Wollman  */
8931aedbd9cSAndre Oppermann int
894f2565d68SRobert Watson ip_next_mtu(int mtu, int dir)
8955cbf3e08SGarrett Wollman {
8965cbf3e08SGarrett Wollman 	static int mtutab[] = {
8974c037f8dSAndre Oppermann 		65535, 32000, 17914, 8166, 4352, 2002, 1492, 1280, 1006, 508,
8984c037f8dSAndre Oppermann 		296, 68, 0
8995cbf3e08SGarrett Wollman 	};
90006003a1eSAndre Oppermann 	int i, size;
9015cbf3e08SGarrett Wollman 
90206003a1eSAndre Oppermann 	size = (sizeof mtutab) / (sizeof mtutab[0]);
90306003a1eSAndre Oppermann 	if (dir >= 0) {
9041c0b0f52SGleb Smirnoff 		for (i = 0; i < size; i++)
90506003a1eSAndre Oppermann 			if (mtu > mtutab[i])
9065cbf3e08SGarrett Wollman 				return mtutab[i];
9075cbf3e08SGarrett Wollman 	} else {
90806003a1eSAndre Oppermann 		for (i = size - 1; i >= 0; i--)
90906003a1eSAndre Oppermann 			if (mtu < mtutab[i])
91006003a1eSAndre Oppermann 				return mtutab[i];
91106003a1eSAndre Oppermann 		if (mtu == mtutab[0])
91206003a1eSAndre Oppermann 			return mtutab[0];
9135cbf3e08SGarrett Wollman 	}
91406003a1eSAndre Oppermann 	return 0;
9155cbf3e08SGarrett Wollman }
91651508de1SMatthew Dillon 
91751508de1SMatthew Dillon 
91851508de1SMatthew Dillon /*
91951508de1SMatthew Dillon  * badport_bandlim() - check for ICMP bandwidth limit
92051508de1SMatthew Dillon  *
92151508de1SMatthew Dillon  *	Return 0 if it is ok to send an ICMP error response, -1 if we have
92251508de1SMatthew Dillon  *	hit our bandwidth limit and it is not ok.
92351508de1SMatthew Dillon  *
92451508de1SMatthew Dillon  *	If icmplim is <= 0, the feature is disabled and 0 is returned.
92551508de1SMatthew Dillon  *
92651508de1SMatthew Dillon  *	For now we separate the TCP and UDP subsystems w/ different 'which'
92751508de1SMatthew Dillon  *	values.  We may eventually remove this separation (and simplify the
92851508de1SMatthew Dillon  *	code further).
92951508de1SMatthew Dillon  *
93051508de1SMatthew Dillon  *	Note that the printing of the error message is delayed so we can
93151508de1SMatthew Dillon  *	properly print the icmp error rate that the system was trying to do
93251508de1SMatthew Dillon  *	(i.e. 22000/100 pps, etc...).  This can cause long delays in printing
93351508de1SMatthew Dillon  *	the 'final' error, but it doesn't make sense to solve the printing
93451508de1SMatthew Dillon  *	delay with more complex code.
93551508de1SMatthew Dillon  */
93651508de1SMatthew Dillon 
93751508de1SMatthew Dillon int
93851508de1SMatthew Dillon badport_bandlim(int which)
93951508de1SMatthew Dillon {
9408b615593SMarko Zec 	INIT_VNET_INET(curvnet);
9418b615593SMarko Zec 
94200f21882SSam Leffler #define	N(a)	(sizeof (a) / sizeof (a[0]))
94300f21882SSam Leffler 	static struct rate {
94400f21882SSam Leffler 		const char	*type;
94500f21882SSam Leffler 		struct timeval	lasttime;
946439dfb0cSStefan Farfeleder 		int		curpps;
94700f21882SSam Leffler 	} rates[BANDLIM_MAX+1] = {
94800f21882SSam Leffler 		{ "icmp unreach response" },
94900f21882SSam Leffler 		{ "icmp ping response" },
95000f21882SSam Leffler 		{ "icmp tstamp response" },
95100f21882SSam Leffler 		{ "closed port RST response" },
95208af97b7SRobert Watson 		{ "open port RST response" },
95308af97b7SRobert Watson 		{ "icmp6 unreach response" }
95409f81a46SBosko Milekic 	};
95551508de1SMatthew Dillon 
95651508de1SMatthew Dillon 	/*
95700f21882SSam Leffler 	 * Return ok status if feature disabled or argument out of range.
95851508de1SMatthew Dillon 	 */
9598b615593SMarko Zec 	if (V_icmplim > 0 && (u_int) which < N(rates)) {
96000f21882SSam Leffler 		struct rate *r = &rates[which];
96100f21882SSam Leffler 		int opps = r->curpps;
96251508de1SMatthew Dillon 
9638b615593SMarko Zec 		if (!ppsratecheck(&r->lasttime, &r->curpps, V_icmplim))
96400f21882SSam Leffler 			return -1;	/* discard packet */
96551508de1SMatthew Dillon 		/*
96600f21882SSam Leffler 		 * If we've dropped below the threshold after having
96700f21882SSam Leffler 		 * rate-limited traffic print the message.  This preserves
96800f21882SSam Leffler 		 * the previous behaviour at the expense of added complexity.
96951508de1SMatthew Dillon 		 */
9708b615593SMarko Zec 		if (V_icmplim_output && opps > V_icmplim)
97100f21882SSam Leffler 			printf("Limiting %s from %d to %d packets/sec\n",
9728b615593SMarko Zec 				r->type, opps, V_icmplim);
97351508de1SMatthew Dillon 	}
97400f21882SSam Leffler 	return 0;			/* okay to send packet */
97500f21882SSam Leffler #undef N
97651508de1SMatthew Dillon }
977