xref: /freebsd/sys/netinet/ip_icmp.c (revision 0fa02ea5f786ef02befd46f8f083f48c8cd9630b)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
34  * $FreeBSD$
35  */
36 
37 #include "opt_ipsec.h"
38 #include "opt_mac.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mac.h>
43 #include <sys/mbuf.h>
44 #include <sys/protosw.h>
45 #include <sys/socket.h>
46 #include <sys/time.h>
47 #include <sys/kernel.h>
48 #include <sys/sysctl.h>
49 
50 #include <net/if.h>
51 #include <net/if_types.h>
52 #include <net/route.h>
53 
54 #include <netinet/in.h>
55 #include <netinet/in_pcb.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/in_var.h>
58 #include <netinet/ip.h>
59 #include <netinet/ip_icmp.h>
60 #include <netinet/ip_var.h>
61 #include <netinet/tcp.h>
62 #include <netinet/tcp_var.h>
63 #include <netinet/tcpip.h>
64 #include <netinet/icmp_var.h>
65 
66 #ifdef IPSEC
67 #include <netinet6/ipsec.h>
68 #include <netkey/key.h>
69 #endif
70 
71 #ifdef FAST_IPSEC
72 #include <netipsec/ipsec.h>
73 #include <netipsec/key.h>
74 #define	IPSEC
75 #endif
76 
77 #include <machine/in_cksum.h>
78 
79 /*
80  * ICMP routines: error generation, receive packet processing, and
81  * routines to turnaround packets back to the originator, and
82  * host table maintenance routines.
83  */
84 
85 static struct	icmpstat icmpstat;
86 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RW,
87 	&icmpstat, icmpstat, "");
88 
89 static int	icmpmaskrepl = 0;
90 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
91 	&icmpmaskrepl, 0, "Reply to ICMP Address Mask Request packets.");
92 
93 static u_int	icmpmaskfake = 0;
94 SYSCTL_UINT(_net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW,
95 	&icmpmaskfake, 0, "Fake reply to ICMP Address Mask Request packets.");
96 
97 static int	drop_redirect = 0;
98 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
99 	&drop_redirect, 0, "");
100 
101 static int	log_redirect = 0;
102 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
103 	&log_redirect, 0, "");
104 
105 static int      icmplim = 200;
106 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
107 	&icmplim, 0, "");
108 
109 static int	icmplim_output = 1;
110 SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW,
111 	&icmplim_output, 0, "");
112 
113 /*
114  * ICMP broadcast echo sysctl
115  */
116 
117 static int	icmpbmcastecho = 0;
118 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
119 	&icmpbmcastecho, 0, "");
120 
121 
122 #ifdef ICMPPRINTFS
123 int	icmpprintfs = 0;
124 #endif
125 
126 static void	icmp_reflect(struct mbuf *);
127 static void	icmp_send(struct mbuf *, struct mbuf *);
128 static int	ip_next_mtu(int, int);
129 
130 extern	struct protosw inetsw[];
131 
132 /*
133  * Generate an error packet of type error
134  * in response to bad packet ip.
135  */
136 void
137 icmp_error(n, type, code, dest, destifp)
138 	struct mbuf *n;
139 	int type, code;
140 	n_long dest;
141 	struct ifnet *destifp;
142 {
143 	register struct ip *oip = mtod(n, struct ip *), *nip;
144 	register unsigned oiplen = oip->ip_hl << 2;
145 	register struct icmp *icp;
146 	register struct mbuf *m;
147 	unsigned icmplen;
148 
149 #ifdef ICMPPRINTFS
150 	if (icmpprintfs)
151 		printf("icmp_error(%p, %x, %d)\n", oip, type, code);
152 #endif
153 	if (type != ICMP_REDIRECT)
154 		icmpstat.icps_error++;
155 	/*
156 	 * Don't send error if not the first fragment of message.
157 	 * Don't error if the old packet protocol was ICMP
158 	 * error message, only known informational types.
159 	 */
160 	if (oip->ip_off &~ (IP_MF|IP_DF))
161 		goto freeit;
162 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
163 	  n->m_len >= oiplen + ICMP_MINLEN &&
164 	  !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
165 		icmpstat.icps_oldicmp++;
166 		goto freeit;
167 	}
168 	/* Don't send error in response to a multicast or broadcast packet */
169 	if (n->m_flags & (M_BCAST|M_MCAST))
170 		goto freeit;
171 	/*
172 	 * First, formulate icmp message
173 	 */
174 	m = m_gethdr(M_DONTWAIT, MT_HEADER);
175 	if (m == NULL)
176 		goto freeit;
177 #ifdef MAC
178 	mac_create_mbuf_netlayer(n, m);
179 #endif
180 	icmplen = min(oiplen + 8, oip->ip_len);
181 	if (icmplen < sizeof(struct ip))
182 		panic("icmp_error: bad length");
183 	m->m_len = icmplen + ICMP_MINLEN;
184 	MH_ALIGN(m, m->m_len);
185 	icp = mtod(m, struct icmp *);
186 	if ((u_int)type > ICMP_MAXTYPE)
187 		panic("icmp_error");
188 	icmpstat.icps_outhist[type]++;
189 	icp->icmp_type = type;
190 	if (type == ICMP_REDIRECT)
191 		icp->icmp_gwaddr.s_addr = dest;
192 	else {
193 		icp->icmp_void = 0;
194 		/*
195 		 * The following assignments assume an overlay with the
196 		 * zeroed icmp_void field.
197 		 */
198 		if (type == ICMP_PARAMPROB) {
199 			icp->icmp_pptr = code;
200 			code = 0;
201 		} else if (type == ICMP_UNREACH &&
202 			code == ICMP_UNREACH_NEEDFRAG && destifp) {
203 			icp->icmp_nextmtu = htons(destifp->if_mtu);
204 		}
205 	}
206 
207 	icp->icmp_code = code;
208 	m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
209 	nip = &icp->icmp_ip;
210 
211 	/*
212 	 * Convert fields to network representation.
213 	 */
214 	nip->ip_len = htons(nip->ip_len);
215 	nip->ip_off = htons(nip->ip_off);
216 
217 	/*
218 	 * Now, copy old ip header (without options)
219 	 * in front of icmp message.
220 	 */
221 	if (m->m_data - sizeof(struct ip) < m->m_pktdat)
222 		panic("icmp len");
223 	m->m_data -= sizeof(struct ip);
224 	m->m_len += sizeof(struct ip);
225 	m->m_pkthdr.len = m->m_len;
226 	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
227 	nip = mtod(m, struct ip *);
228 	bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
229 	nip->ip_len = m->m_len;
230 	nip->ip_v = IPVERSION;
231 	nip->ip_hl = 5;
232 	nip->ip_p = IPPROTO_ICMP;
233 	nip->ip_tos = 0;
234 	icmp_reflect(m);
235 
236 freeit:
237 	m_freem(n);
238 }
239 
240 /*
241  * Process a received ICMP message.
242  */
243 void
244 icmp_input(m, off)
245 	struct mbuf *m;
246 	int off;
247 {
248 	struct icmp *icp;
249 	struct in_ifaddr *ia;
250 	struct ip *ip = mtod(m, struct ip *);
251 	struct sockaddr_in icmpsrc, icmpdst, icmpgw;
252 	int hlen = off;
253 	int icmplen = ip->ip_len;
254 	int i, code;
255 	void (*ctlfunc)(int, struct sockaddr *, void *);
256 
257 	/*
258 	 * Locate icmp structure in mbuf, and check
259 	 * that not corrupted and of at least minimum length.
260 	 */
261 #ifdef ICMPPRINTFS
262 	if (icmpprintfs) {
263 		char buf[4 * sizeof "123"];
264 		strcpy(buf, inet_ntoa(ip->ip_src));
265 		printf("icmp_input from %s to %s, len %d\n",
266 		       buf, inet_ntoa(ip->ip_dst), icmplen);
267 	}
268 #endif
269 	if (icmplen < ICMP_MINLEN) {
270 		icmpstat.icps_tooshort++;
271 		goto freeit;
272 	}
273 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
274 	if (m->m_len < i && (m = m_pullup(m, i)) == 0)  {
275 		icmpstat.icps_tooshort++;
276 		return;
277 	}
278 	ip = mtod(m, struct ip *);
279 	m->m_len -= hlen;
280 	m->m_data += hlen;
281 	icp = mtod(m, struct icmp *);
282 	if (in_cksum(m, icmplen)) {
283 		icmpstat.icps_checksum++;
284 		goto freeit;
285 	}
286 	m->m_len += hlen;
287 	m->m_data -= hlen;
288 
289 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
290 		/*
291 		 * Deliver very specific ICMP type only.
292 		 */
293 		switch (icp->icmp_type) {
294 		case ICMP_UNREACH:
295 		case ICMP_TIMXCEED:
296 			break;
297 		default:
298 			goto freeit;
299 		}
300 	}
301 
302 #ifdef ICMPPRINTFS
303 	if (icmpprintfs)
304 		printf("icmp_input, type %d code %d\n", icp->icmp_type,
305 		    icp->icmp_code);
306 #endif
307 
308 	/*
309 	 * Message type specific processing.
310 	 */
311 	if (icp->icmp_type > ICMP_MAXTYPE)
312 		goto raw;
313 
314 	/* Initialize */
315 	bzero(&icmpsrc, sizeof(icmpsrc));
316 	icmpsrc.sin_len = sizeof(struct sockaddr_in);
317 	icmpsrc.sin_family = AF_INET;
318 	bzero(&icmpdst, sizeof(icmpdst));
319 	icmpdst.sin_len = sizeof(struct sockaddr_in);
320 	icmpdst.sin_family = AF_INET;
321 	bzero(&icmpgw, sizeof(icmpgw));
322 	icmpgw.sin_len = sizeof(struct sockaddr_in);
323 	icmpgw.sin_family = AF_INET;
324 
325 	icmpstat.icps_inhist[icp->icmp_type]++;
326 	code = icp->icmp_code;
327 	switch (icp->icmp_type) {
328 
329 	case ICMP_UNREACH:
330 		switch (code) {
331 			case ICMP_UNREACH_NET:
332 			case ICMP_UNREACH_HOST:
333 			case ICMP_UNREACH_SRCFAIL:
334 			case ICMP_UNREACH_NET_UNKNOWN:
335 			case ICMP_UNREACH_HOST_UNKNOWN:
336 			case ICMP_UNREACH_ISOLATED:
337 			case ICMP_UNREACH_TOSNET:
338 			case ICMP_UNREACH_TOSHOST:
339 			case ICMP_UNREACH_HOST_PRECEDENCE:
340 			case ICMP_UNREACH_PRECEDENCE_CUTOFF:
341 				code = PRC_UNREACH_NET;
342 				break;
343 
344 			case ICMP_UNREACH_NEEDFRAG:
345 				code = PRC_MSGSIZE;
346 				break;
347 
348 			/*
349 			 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
350 			 * Treat subcodes 2,3 as immediate RST
351 			 */
352 			case ICMP_UNREACH_PROTOCOL:
353 			case ICMP_UNREACH_PORT:
354 				code = PRC_UNREACH_PORT;
355 				break;
356 
357 			case ICMP_UNREACH_NET_PROHIB:
358 			case ICMP_UNREACH_HOST_PROHIB:
359 			case ICMP_UNREACH_FILTER_PROHIB:
360 				code = PRC_UNREACH_ADMIN_PROHIB;
361 				break;
362 
363 			default:
364 				goto badcode;
365 		}
366 		goto deliver;
367 
368 	case ICMP_TIMXCEED:
369 		if (code > 1)
370 			goto badcode;
371 		code += PRC_TIMXCEED_INTRANS;
372 		goto deliver;
373 
374 	case ICMP_PARAMPROB:
375 		if (code > 1)
376 			goto badcode;
377 		code = PRC_PARAMPROB;
378 		goto deliver;
379 
380 	case ICMP_SOURCEQUENCH:
381 		if (code)
382 			goto badcode;
383 		code = PRC_QUENCH;
384 	deliver:
385 		/*
386 		 * Problem with datagram; advise higher level routines.
387 		 */
388 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
389 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
390 			icmpstat.icps_badlen++;
391 			goto freeit;
392 		}
393 		icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
394 		/* Discard ICMP's in response to multicast packets */
395 		if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
396 			goto badcode;
397 #ifdef ICMPPRINTFS
398 		if (icmpprintfs)
399 			printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
400 #endif
401 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
402 
403 		/*
404 		 * MTU discovery:
405 		 * If we got a needfrag and there is a host route to the
406 		 * original destination, and the MTU is not locked, then
407 		 * set the MTU in the route to the suggested new value
408 		 * (if given) and then notify as usual.  The ULPs will
409 		 * notice that the MTU has changed and adapt accordingly.
410 		 * If no new MTU was suggested, then we guess a new one
411 		 * less than the current value.  If the new MTU is
412 		 * unreasonably small, then we don't update the MTU value.
413 		 *
414 		 * XXX: All this should be done in tcp_mtudisc() because
415 		 * the way we do it now, everyone can send us bogus ICMP
416 		 * MSGSIZE packets for any destination. By doing this far
417 		 * higher in the chain we have a matching tcp connection.
418 		 * Thus spoofing is much harder. However there is no easy
419 		 * non-hackish way to pass the new MTU up to tcp_mtudisc().
420 		 * Also see next XXX regarding IPv4 AH TCP.
421 		 */
422 		if (code == PRC_MSGSIZE) {
423 			int mtu;
424 			struct in_conninfo inc;
425 
426 			bzero(&inc, sizeof(inc));
427 			inc.inc_flags = 0; /* IPv4 */
428 			inc.inc_faddr = icmpsrc.sin_addr;
429 
430 			mtu = ntohs(icp->icmp_nextmtu);
431 			if (!mtu)
432 				mtu = ip_next_mtu(mtu, 1);
433 
434 			if (mtu >= 256 + sizeof(struct tcpiphdr))
435 				tcp_hc_updatemtu(&inc, mtu);
436 
437 #ifdef DEBUG_MTUDISC
438 			printf("MTU for %s reduced to %d\n",
439 				inet_ntoa(icmpsrc.sin_addr), mtu);
440 #endif
441 		}
442 
443 		/*
444 		 * XXX if the packet contains [IPv4 AH TCP], we can't make a
445 		 * notification to TCP layer.
446 		 */
447 		ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
448 		if (ctlfunc)
449 			(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
450 				   (void *)&icp->icmp_ip);
451 		break;
452 
453 	badcode:
454 		icmpstat.icps_badcode++;
455 		break;
456 
457 	case ICMP_ECHO:
458 		if (!icmpbmcastecho
459 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
460 			icmpstat.icps_bmcastecho++;
461 			break;
462 		}
463 		icp->icmp_type = ICMP_ECHOREPLY;
464 		if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
465 			goto freeit;
466 		else
467 			goto reflect;
468 
469 	case ICMP_TSTAMP:
470 		if (!icmpbmcastecho
471 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
472 			icmpstat.icps_bmcasttstamp++;
473 			break;
474 		}
475 		if (icmplen < ICMP_TSLEN) {
476 			icmpstat.icps_badlen++;
477 			break;
478 		}
479 		icp->icmp_type = ICMP_TSTAMPREPLY;
480 		icp->icmp_rtime = iptime();
481 		icp->icmp_ttime = icp->icmp_rtime;	/* bogus, do later! */
482 		if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
483 			goto freeit;
484 		else
485 			goto reflect;
486 
487 	case ICMP_MASKREQ:
488 		if (icmpmaskrepl == 0)
489 			break;
490 		/*
491 		 * We are not able to respond with all ones broadcast
492 		 * unless we receive it over a point-to-point interface.
493 		 */
494 		if (icmplen < ICMP_MASKLEN)
495 			break;
496 		switch (ip->ip_dst.s_addr) {
497 
498 		case INADDR_BROADCAST:
499 		case INADDR_ANY:
500 			icmpdst.sin_addr = ip->ip_src;
501 			break;
502 
503 		default:
504 			icmpdst.sin_addr = ip->ip_dst;
505 		}
506 		ia = (struct in_ifaddr *)ifaof_ifpforaddr(
507 			    (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
508 		if (ia == 0)
509 			break;
510 		if (ia->ia_ifp == 0)
511 			break;
512 		icp->icmp_type = ICMP_MASKREPLY;
513 		if (icmpmaskfake == 0)
514 			icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
515 		else
516 			icp->icmp_mask = icmpmaskfake;
517 		if (ip->ip_src.s_addr == 0) {
518 			if (ia->ia_ifp->if_flags & IFF_BROADCAST)
519 			    ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
520 			else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
521 			    ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
522 		}
523 reflect:
524 		ip->ip_len += hlen;	/* since ip_input deducts this */
525 		icmpstat.icps_reflect++;
526 		icmpstat.icps_outhist[icp->icmp_type]++;
527 		icmp_reflect(m);
528 		return;
529 
530 	case ICMP_REDIRECT:
531 		if (log_redirect) {
532 			u_long src, dst, gw;
533 
534 			src = ntohl(ip->ip_src.s_addr);
535 			dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
536 			gw = ntohl(icp->icmp_gwaddr.s_addr);
537 			printf("icmp redirect from %d.%d.%d.%d: "
538 			       "%d.%d.%d.%d => %d.%d.%d.%d\n",
539 			       (int)(src >> 24), (int)((src >> 16) & 0xff),
540 			       (int)((src >> 8) & 0xff), (int)(src & 0xff),
541 			       (int)(dst >> 24), (int)((dst >> 16) & 0xff),
542 			       (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
543 			       (int)(gw >> 24), (int)((gw >> 16) & 0xff),
544 			       (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
545 		}
546 		if (drop_redirect)
547 			break;
548 		if (code > 3)
549 			goto badcode;
550 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
551 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
552 			icmpstat.icps_badlen++;
553 			break;
554 		}
555 		/*
556 		 * Short circuit routing redirects to force
557 		 * immediate change in the kernel's routing
558 		 * tables.  The message is also handed to anyone
559 		 * listening on a raw socket (e.g. the routing
560 		 * daemon for use in updating its tables).
561 		 */
562 		icmpgw.sin_addr = ip->ip_src;
563 		icmpdst.sin_addr = icp->icmp_gwaddr;
564 #ifdef	ICMPPRINTFS
565 		if (icmpprintfs) {
566 			char buf[4 * sizeof "123"];
567 			strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
568 
569 			printf("redirect dst %s to %s\n",
570 			       buf, inet_ntoa(icp->icmp_gwaddr));
571 		}
572 #endif
573 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
574 		rtredirect((struct sockaddr *)&icmpsrc,
575 		  (struct sockaddr *)&icmpdst,
576 		  (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
577 		  (struct sockaddr *)&icmpgw);
578 		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
579 #ifdef IPSEC
580 		key_sa_routechange((struct sockaddr *)&icmpsrc);
581 #endif
582 		break;
583 
584 	/*
585 	 * No kernel processing for the following;
586 	 * just fall through to send to raw listener.
587 	 */
588 	case ICMP_ECHOREPLY:
589 	case ICMP_ROUTERADVERT:
590 	case ICMP_ROUTERSOLICIT:
591 	case ICMP_TSTAMPREPLY:
592 	case ICMP_IREQREPLY:
593 	case ICMP_MASKREPLY:
594 	default:
595 		break;
596 	}
597 
598 raw:
599 	rip_input(m, off);
600 	return;
601 
602 freeit:
603 	m_freem(m);
604 }
605 
606 /*
607  * Reflect the ip packet back to the source
608  */
609 static void
610 icmp_reflect(m)
611 	struct mbuf *m;
612 {
613 	struct ip *ip = mtod(m, struct ip *);
614 	struct ifaddr *ifa;
615 	struct in_ifaddr *ia;
616 	struct in_addr t;
617 	struct mbuf *opts = 0;
618 	int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
619 
620 	if (!in_canforward(ip->ip_src) &&
621 	    ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
622 	     (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
623 		m_freem(m);	/* Bad return address */
624 		icmpstat.icps_badaddr++;
625 		goto done;	/* Ip_output() will check for broadcast */
626 	}
627 	t = ip->ip_dst;
628 	ip->ip_dst = ip->ip_src;
629 	/*
630 	 * If the incoming packet was addressed directly to us,
631 	 * use dst as the src for the reply.  Otherwise (broadcast
632 	 * or anonymous), use the address which corresponds
633 	 * to the incoming interface.
634 	 */
635 	LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash)
636 		if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
637 			goto match;
638 	if (m->m_pkthdr.rcvif != NULL &&
639 	    m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
640 		TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
641 			if (ifa->ifa_addr->sa_family != AF_INET)
642 				continue;
643 			ia = ifatoia(ifa);
644 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
645 			    t.s_addr)
646 				goto match;
647 		}
648 	}
649 	ia = ip_rtaddr(ip->ip_dst);
650 	/* We need a route to do anything useful. */
651 	if (ia == NULL) {
652 		m_freem(m);
653 		icmpstat.icps_noroute++;
654 		goto done;
655 	}
656 match:
657 #ifdef MAC
658 	mac_reflect_mbuf_icmp(m);
659 #endif
660 	t = IA_SIN(ia)->sin_addr;
661 	ip->ip_src = t;
662 	ip->ip_ttl = ip_defttl;
663 
664 	if (optlen > 0) {
665 		register u_char *cp;
666 		int opt, cnt;
667 		u_int len;
668 
669 		/*
670 		 * Retrieve any source routing from the incoming packet;
671 		 * add on any record-route or timestamp options.
672 		 */
673 		cp = (u_char *) (ip + 1);
674 		if ((opts = ip_srcroute()) == 0 &&
675 		    (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
676 			opts->m_len = sizeof(struct in_addr);
677 			mtod(opts, struct in_addr *)->s_addr = 0;
678 		}
679 		if (opts) {
680 #ifdef ICMPPRINTFS
681 		    if (icmpprintfs)
682 			    printf("icmp_reflect optlen %d rt %d => ",
683 				optlen, opts->m_len);
684 #endif
685 		    for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
686 			    opt = cp[IPOPT_OPTVAL];
687 			    if (opt == IPOPT_EOL)
688 				    break;
689 			    if (opt == IPOPT_NOP)
690 				    len = 1;
691 			    else {
692 				    if (cnt < IPOPT_OLEN + sizeof(*cp))
693 					    break;
694 				    len = cp[IPOPT_OLEN];
695 				    if (len < IPOPT_OLEN + sizeof(*cp) ||
696 				        len > cnt)
697 					    break;
698 			    }
699 			    /*
700 			     * Should check for overflow, but it "can't happen"
701 			     */
702 			    if (opt == IPOPT_RR || opt == IPOPT_TS ||
703 				opt == IPOPT_SECURITY) {
704 				    bcopy((caddr_t)cp,
705 					mtod(opts, caddr_t) + opts->m_len, len);
706 				    opts->m_len += len;
707 			    }
708 		    }
709 		    /* Terminate & pad, if necessary */
710 		    cnt = opts->m_len % 4;
711 		    if (cnt) {
712 			    for (; cnt < 4; cnt++) {
713 				    *(mtod(opts, caddr_t) + opts->m_len) =
714 					IPOPT_EOL;
715 				    opts->m_len++;
716 			    }
717 		    }
718 #ifdef ICMPPRINTFS
719 		    if (icmpprintfs)
720 			    printf("%d\n", opts->m_len);
721 #endif
722 		}
723 		/*
724 		 * Now strip out original options by copying rest of first
725 		 * mbuf's data back, and adjust the IP length.
726 		 */
727 		ip->ip_len -= optlen;
728 		ip->ip_v = IPVERSION;
729 		ip->ip_hl = 5;
730 		m->m_len -= optlen;
731 		if (m->m_flags & M_PKTHDR)
732 			m->m_pkthdr.len -= optlen;
733 		optlen += sizeof(struct ip);
734 		bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
735 			 (unsigned)(m->m_len - sizeof(struct ip)));
736 	}
737 	m_tag_delete_nonpersistent(m);
738 	m->m_flags &= ~(M_BCAST|M_MCAST);
739 	icmp_send(m, opts);
740 done:
741 	if (opts)
742 		(void)m_free(opts);
743 }
744 
745 /*
746  * Send an icmp packet back to the ip level,
747  * after supplying a checksum.
748  */
749 static void
750 icmp_send(m, opts)
751 	register struct mbuf *m;
752 	struct mbuf *opts;
753 {
754 	register struct ip *ip = mtod(m, struct ip *);
755 	register int hlen;
756 	register struct icmp *icp;
757 
758 	hlen = ip->ip_hl << 2;
759 	m->m_data += hlen;
760 	m->m_len -= hlen;
761 	icp = mtod(m, struct icmp *);
762 	icp->icmp_cksum = 0;
763 	icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
764 	m->m_data -= hlen;
765 	m->m_len += hlen;
766 	m->m_pkthdr.rcvif = (struct ifnet *)0;
767 #ifdef ICMPPRINTFS
768 	if (icmpprintfs) {
769 		char buf[4 * sizeof "123"];
770 		strcpy(buf, inet_ntoa(ip->ip_dst));
771 		printf("icmp_send dst %s src %s\n",
772 		       buf, inet_ntoa(ip->ip_src));
773 	}
774 #endif
775 	(void) ip_output(m, opts, NULL, 0, NULL, NULL);
776 }
777 
778 n_time
779 iptime()
780 {
781 	struct timeval atv;
782 	u_long t;
783 
784 	getmicrotime(&atv);
785 	t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
786 	return (htonl(t));
787 }
788 
789 /*
790  * Return the next larger or smaller MTU plateau (table from RFC 1191)
791  * given current value MTU.  If DIR is less than zero, a larger plateau
792  * is returned; otherwise, a smaller value is returned.
793  */
794 static int
795 ip_next_mtu(mtu, dir)
796 	int mtu;
797 	int dir;
798 {
799 	static int mtutab[] = {
800 		65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
801 		68, 0
802 	};
803 	int i;
804 
805 	for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
806 		if (mtu >= mtutab[i])
807 			break;
808 	}
809 
810 	if (dir < 0) {
811 		if (i == 0) {
812 			return 0;
813 		} else {
814 			return mtutab[i - 1];
815 		}
816 	} else {
817 		if (mtutab[i] == 0) {
818 			return 0;
819 		} else if(mtu > mtutab[i]) {
820 			return mtutab[i];
821 		} else {
822 			return mtutab[i + 1];
823 		}
824 	}
825 }
826 
827 
828 /*
829  * badport_bandlim() - check for ICMP bandwidth limit
830  *
831  *	Return 0 if it is ok to send an ICMP error response, -1 if we have
832  *	hit our bandwidth limit and it is not ok.
833  *
834  *	If icmplim is <= 0, the feature is disabled and 0 is returned.
835  *
836  *	For now we separate the TCP and UDP subsystems w/ different 'which'
837  *	values.  We may eventually remove this separation (and simplify the
838  *	code further).
839  *
840  *	Note that the printing of the error message is delayed so we can
841  *	properly print the icmp error rate that the system was trying to do
842  *	(i.e. 22000/100 pps, etc...).  This can cause long delays in printing
843  *	the 'final' error, but it doesn't make sense to solve the printing
844  *	delay with more complex code.
845  */
846 
847 int
848 badport_bandlim(int which)
849 {
850 #define	N(a)	(sizeof (a) / sizeof (a[0]))
851 	static struct rate {
852 		const char	*type;
853 		struct timeval	lasttime;
854 		int		curpps;;
855 	} rates[BANDLIM_MAX+1] = {
856 		{ "icmp unreach response" },
857 		{ "icmp ping response" },
858 		{ "icmp tstamp response" },
859 		{ "closed port RST response" },
860 		{ "open port RST response" }
861 	};
862 
863 	/*
864 	 * Return ok status if feature disabled or argument out of range.
865 	 */
866 	if (icmplim > 0 && (u_int) which < N(rates)) {
867 		struct rate *r = &rates[which];
868 		int opps = r->curpps;
869 
870 		if (!ppsratecheck(&r->lasttime, &r->curpps, icmplim))
871 			return -1;	/* discard packet */
872 		/*
873 		 * If we've dropped below the threshold after having
874 		 * rate-limited traffic print the message.  This preserves
875 		 * the previous behaviour at the expense of added complexity.
876 		 */
877 		if (icmplim_output && opps > icmplim)
878 			printf("Limiting %s from %d to %d packets/sec\n",
879 				r->type, opps, icmplim);
880 	}
881 	return 0;			/* okay to send packet */
882 #undef N
883 }
884