xref: /freebsd/sys/netinet/ip_icmp.c (revision 3193579b66fd7067f898dbc54bdea81a0e6f9bd0)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
34  * $FreeBSD$
35  */
36 
37 #include "opt_ipsec.h"
38 #include "opt_mac.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mac.h>
43 #include <sys/mbuf.h>
44 #include <sys/protosw.h>
45 #include <sys/socket.h>
46 #include <sys/time.h>
47 #include <sys/kernel.h>
48 #include <sys/sysctl.h>
49 
50 #include <net/if.h>
51 #include <net/if_types.h>
52 #include <net/route.h>
53 
54 #include <netinet/in.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/in_var.h>
57 #include <netinet/ip.h>
58 #include <netinet/ip_icmp.h>
59 #include <netinet/ip_var.h>
60 #include <netinet/icmp_var.h>
61 
62 #ifdef IPSEC
63 #include <netinet6/ipsec.h>
64 #include <netkey/key.h>
65 #endif
66 
67 #ifdef FAST_IPSEC
68 #include <netipsec/ipsec.h>
69 #include <netipsec/key.h>
70 #define	IPSEC
71 #endif
72 
73 #include <machine/in_cksum.h>
74 
75 /*
76  * ICMP routines: error generation, receive packet processing, and
77  * routines to turnaround packets back to the originator, and
78  * host table maintenance routines.
79  */
80 
81 static struct	icmpstat icmpstat;
82 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RW,
83 	&icmpstat, icmpstat, "");
84 
85 static int	icmpmaskrepl = 0;
86 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
87 	&icmpmaskrepl, 0, "Reply to ICMP Address Mask Request packets.");
88 
89 static u_int	icmpmaskfake = 0;
90 SYSCTL_UINT(_net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW,
91 	&icmpmaskfake, 0, "Fake reply to ICMP Address Mask Request packets.");
92 
93 static int	drop_redirect = 0;
94 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
95 	&drop_redirect, 0, "");
96 
97 static int	log_redirect = 0;
98 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
99 	&log_redirect, 0, "");
100 
101 static int      icmplim = 200;
102 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
103 	&icmplim, 0, "");
104 
105 static int	icmplim_output = 1;
106 SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW,
107 	&icmplim_output, 0, "");
108 
109 /*
110  * ICMP broadcast echo sysctl
111  */
112 
113 static int	icmpbmcastecho = 0;
114 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
115 	&icmpbmcastecho, 0, "");
116 
117 
118 #ifdef ICMPPRINTFS
119 int	icmpprintfs = 0;
120 #endif
121 
122 static void	icmp_reflect(struct mbuf *);
123 static void	icmp_send(struct mbuf *, struct mbuf *);
124 static int	ip_next_mtu(int, int);
125 
126 extern	struct protosw inetsw[];
127 
128 /*
129  * Generate an error packet of type error
130  * in response to bad packet ip.
131  */
132 void
133 icmp_error(n, type, code, dest, destifp)
134 	struct mbuf *n;
135 	int type, code;
136 	n_long dest;
137 	struct ifnet *destifp;
138 {
139 	register struct ip *oip = mtod(n, struct ip *), *nip;
140 	register unsigned oiplen = oip->ip_hl << 2;
141 	register struct icmp *icp;
142 	register struct mbuf *m;
143 	unsigned icmplen;
144 
145 #ifdef ICMPPRINTFS
146 	if (icmpprintfs)
147 		printf("icmp_error(%p, %x, %d)\n", oip, type, code);
148 #endif
149 	if (type != ICMP_REDIRECT)
150 		icmpstat.icps_error++;
151 	/*
152 	 * Don't send error if not the first fragment of message.
153 	 * Don't error if the old packet protocol was ICMP
154 	 * error message, only known informational types.
155 	 */
156 	if (oip->ip_off &~ (IP_MF|IP_DF))
157 		goto freeit;
158 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
159 	  n->m_len >= oiplen + ICMP_MINLEN &&
160 	  !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
161 		icmpstat.icps_oldicmp++;
162 		goto freeit;
163 	}
164 	/* Don't send error in response to a multicast or broadcast packet */
165 	if (n->m_flags & (M_BCAST|M_MCAST))
166 		goto freeit;
167 	/*
168 	 * First, formulate icmp message
169 	 */
170 	m = m_gethdr(M_DONTWAIT, MT_HEADER);
171 	if (m == NULL)
172 		goto freeit;
173 #ifdef MAC
174 	mac_create_mbuf_netlayer(n, m);
175 #endif
176 	icmplen = min(oiplen + 8, oip->ip_len);
177 	if (icmplen < sizeof(struct ip))
178 		panic("icmp_error: bad length");
179 	m->m_len = icmplen + ICMP_MINLEN;
180 	MH_ALIGN(m, m->m_len);
181 	icp = mtod(m, struct icmp *);
182 	if ((u_int)type > ICMP_MAXTYPE)
183 		panic("icmp_error");
184 	icmpstat.icps_outhist[type]++;
185 	icp->icmp_type = type;
186 	if (type == ICMP_REDIRECT)
187 		icp->icmp_gwaddr.s_addr = dest;
188 	else {
189 		icp->icmp_void = 0;
190 		/*
191 		 * The following assignments assume an overlay with the
192 		 * zeroed icmp_void field.
193 		 */
194 		if (type == ICMP_PARAMPROB) {
195 			icp->icmp_pptr = code;
196 			code = 0;
197 		} else if (type == ICMP_UNREACH &&
198 			code == ICMP_UNREACH_NEEDFRAG && destifp) {
199 			icp->icmp_nextmtu = htons(destifp->if_mtu);
200 		}
201 	}
202 
203 	icp->icmp_code = code;
204 	m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
205 	nip = &icp->icmp_ip;
206 
207 	/*
208 	 * Convert fields to network representation.
209 	 */
210 	nip->ip_len = htons(nip->ip_len);
211 	nip->ip_off = htons(nip->ip_off);
212 
213 	/*
214 	 * Now, copy old ip header (without options)
215 	 * in front of icmp message.
216 	 */
217 	if (m->m_data - sizeof(struct ip) < m->m_pktdat)
218 		panic("icmp len");
219 	m->m_data -= sizeof(struct ip);
220 	m->m_len += sizeof(struct ip);
221 	m->m_pkthdr.len = m->m_len;
222 	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
223 	nip = mtod(m, struct ip *);
224 	bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
225 	nip->ip_len = m->m_len;
226 	nip->ip_v = IPVERSION;
227 	nip->ip_hl = 5;
228 	nip->ip_p = IPPROTO_ICMP;
229 	nip->ip_tos = 0;
230 	icmp_reflect(m);
231 
232 freeit:
233 	m_freem(n);
234 }
235 
236 /*
237  * Process a received ICMP message.
238  */
239 void
240 icmp_input(m, off)
241 	struct mbuf *m;
242 	int off;
243 {
244 	struct icmp *icp;
245 	struct in_ifaddr *ia;
246 	struct ip *ip = mtod(m, struct ip *);
247 	struct sockaddr_in icmpsrc, icmpdst, icmpgw;
248 	int hlen = off;
249 	int icmplen = ip->ip_len;
250 	int i, code;
251 	void (*ctlfunc)(int, struct sockaddr *, void *);
252 
253 	/*
254 	 * Locate icmp structure in mbuf, and check
255 	 * that not corrupted and of at least minimum length.
256 	 */
257 #ifdef ICMPPRINTFS
258 	if (icmpprintfs) {
259 		char buf[4 * sizeof "123"];
260 		strcpy(buf, inet_ntoa(ip->ip_src));
261 		printf("icmp_input from %s to %s, len %d\n",
262 		       buf, inet_ntoa(ip->ip_dst), icmplen);
263 	}
264 #endif
265 	if (icmplen < ICMP_MINLEN) {
266 		icmpstat.icps_tooshort++;
267 		goto freeit;
268 	}
269 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
270 	if (m->m_len < i && (m = m_pullup(m, i)) == 0)  {
271 		icmpstat.icps_tooshort++;
272 		return;
273 	}
274 	ip = mtod(m, struct ip *);
275 	m->m_len -= hlen;
276 	m->m_data += hlen;
277 	icp = mtod(m, struct icmp *);
278 	if (in_cksum(m, icmplen)) {
279 		icmpstat.icps_checksum++;
280 		goto freeit;
281 	}
282 	m->m_len += hlen;
283 	m->m_data -= hlen;
284 
285 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
286 		/*
287 		 * Deliver very specific ICMP type only.
288 		 */
289 		switch (icp->icmp_type) {
290 		case ICMP_UNREACH:
291 		case ICMP_TIMXCEED:
292 			break;
293 		default:
294 			goto freeit;
295 		}
296 	}
297 
298 #ifdef ICMPPRINTFS
299 	if (icmpprintfs)
300 		printf("icmp_input, type %d code %d\n", icp->icmp_type,
301 		    icp->icmp_code);
302 #endif
303 
304 	/*
305 	 * Message type specific processing.
306 	 */
307 	if (icp->icmp_type > ICMP_MAXTYPE)
308 		goto raw;
309 
310 	/* Initialize */
311 	bzero(&icmpsrc, sizeof(icmpsrc));
312 	icmpsrc.sin_len = sizeof(struct sockaddr_in);
313 	icmpsrc.sin_family = AF_INET;
314 	bzero(&icmpdst, sizeof(icmpdst));
315 	icmpdst.sin_len = sizeof(struct sockaddr_in);
316 	icmpdst.sin_family = AF_INET;
317 	bzero(&icmpgw, sizeof(icmpgw));
318 	icmpgw.sin_len = sizeof(struct sockaddr_in);
319 	icmpgw.sin_family = AF_INET;
320 
321 	icmpstat.icps_inhist[icp->icmp_type]++;
322 	code = icp->icmp_code;
323 	switch (icp->icmp_type) {
324 
325 	case ICMP_UNREACH:
326 		switch (code) {
327 			case ICMP_UNREACH_NET:
328 			case ICMP_UNREACH_HOST:
329 			case ICMP_UNREACH_SRCFAIL:
330 			case ICMP_UNREACH_NET_UNKNOWN:
331 			case ICMP_UNREACH_HOST_UNKNOWN:
332 			case ICMP_UNREACH_ISOLATED:
333 			case ICMP_UNREACH_TOSNET:
334 			case ICMP_UNREACH_TOSHOST:
335 			case ICMP_UNREACH_HOST_PRECEDENCE:
336 			case ICMP_UNREACH_PRECEDENCE_CUTOFF:
337 				code = PRC_UNREACH_NET;
338 				break;
339 
340 			case ICMP_UNREACH_NEEDFRAG:
341 				code = PRC_MSGSIZE;
342 				break;
343 
344 			/*
345 			 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
346 			 * Treat subcodes 2,3 as immediate RST
347 			 */
348 			case ICMP_UNREACH_PROTOCOL:
349 			case ICMP_UNREACH_PORT:
350 				code = PRC_UNREACH_PORT;
351 				break;
352 
353 			case ICMP_UNREACH_NET_PROHIB:
354 			case ICMP_UNREACH_HOST_PROHIB:
355 			case ICMP_UNREACH_FILTER_PROHIB:
356 				code = PRC_UNREACH_ADMIN_PROHIB;
357 				break;
358 
359 			default:
360 				goto badcode;
361 		}
362 		goto deliver;
363 
364 	case ICMP_TIMXCEED:
365 		if (code > 1)
366 			goto badcode;
367 		code += PRC_TIMXCEED_INTRANS;
368 		goto deliver;
369 
370 	case ICMP_PARAMPROB:
371 		if (code > 1)
372 			goto badcode;
373 		code = PRC_PARAMPROB;
374 		goto deliver;
375 
376 	case ICMP_SOURCEQUENCH:
377 		if (code)
378 			goto badcode;
379 		code = PRC_QUENCH;
380 	deliver:
381 		/*
382 		 * Problem with datagram; advise higher level routines.
383 		 */
384 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
385 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
386 			icmpstat.icps_badlen++;
387 			goto freeit;
388 		}
389 		icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
390 		/* Discard ICMP's in response to multicast packets */
391 		if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
392 			goto badcode;
393 #ifdef ICMPPRINTFS
394 		if (icmpprintfs)
395 			printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
396 #endif
397 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
398 #if 1
399 		/*
400 		 * MTU discovery:
401 		 * If we got a needfrag and there is a host route to the
402 		 * original destination, and the MTU is not locked, then
403 		 * set the MTU in the route to the suggested new value
404 		 * (if given) and then notify as usual.  The ULPs will
405 		 * notice that the MTU has changed and adapt accordingly.
406 		 * If no new MTU was suggested, then we guess a new one
407 		 * less than the current value.  If the new MTU is
408 		 * unreasonably small (arbitrarily set at 296), then
409 		 * we reset the MTU to the interface value and enable the
410 		 * lock bit, indicating that we are no longer doing MTU
411 		 * discovery.
412 		 */
413 		if (code == PRC_MSGSIZE) {
414 			struct rtentry *rt;
415 			int mtu;
416 
417 			rt = rtalloc1((struct sockaddr *)&icmpsrc, 0,
418 				      RTF_CLONING | RTF_PRCLONING);
419 			if (rt && (rt->rt_flags & RTF_HOST)
420 			    && !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
421 				mtu = ntohs(icp->icmp_nextmtu);
422 				if (!mtu)
423 					mtu = ip_next_mtu(rt->rt_rmx.rmx_mtu,
424 							  1);
425 #ifdef DEBUG_MTUDISC
426 				printf("MTU for %s reduced to %d\n",
427 					inet_ntoa(icmpsrc.sin_addr), mtu);
428 #endif
429 				if (mtu < 296) {
430 					/* rt->rt_rmx.rmx_mtu =
431 						rt->rt_ifp->if_mtu; */
432 					rt->rt_rmx.rmx_locks |= RTV_MTU;
433 				} else if (rt->rt_rmx.rmx_mtu > mtu) {
434 					rt->rt_rmx.rmx_mtu = mtu;
435 				}
436 			}
437 			if (rt)
438 				rtfree(rt);
439 		}
440 
441 #endif
442 		/*
443 		 * XXX if the packet contains [IPv4 AH TCP], we can't make a
444 		 * notification to TCP layer.
445 		 */
446 		ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
447 		if (ctlfunc)
448 			(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
449 				   (void *)&icp->icmp_ip);
450 		break;
451 
452 	badcode:
453 		icmpstat.icps_badcode++;
454 		break;
455 
456 	case ICMP_ECHO:
457 		if (!icmpbmcastecho
458 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
459 			icmpstat.icps_bmcastecho++;
460 			break;
461 		}
462 		icp->icmp_type = ICMP_ECHOREPLY;
463 		if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
464 			goto freeit;
465 		else
466 			goto reflect;
467 
468 	case ICMP_TSTAMP:
469 		if (!icmpbmcastecho
470 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
471 			icmpstat.icps_bmcasttstamp++;
472 			break;
473 		}
474 		if (icmplen < ICMP_TSLEN) {
475 			icmpstat.icps_badlen++;
476 			break;
477 		}
478 		icp->icmp_type = ICMP_TSTAMPREPLY;
479 		icp->icmp_rtime = iptime();
480 		icp->icmp_ttime = icp->icmp_rtime;	/* bogus, do later! */
481 		if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
482 			goto freeit;
483 		else
484 			goto reflect;
485 
486 	case ICMP_MASKREQ:
487 		if (icmpmaskrepl == 0)
488 			break;
489 		/*
490 		 * We are not able to respond with all ones broadcast
491 		 * unless we receive it over a point-to-point interface.
492 		 */
493 		if (icmplen < ICMP_MASKLEN)
494 			break;
495 		switch (ip->ip_dst.s_addr) {
496 
497 		case INADDR_BROADCAST:
498 		case INADDR_ANY:
499 			icmpdst.sin_addr = ip->ip_src;
500 			break;
501 
502 		default:
503 			icmpdst.sin_addr = ip->ip_dst;
504 		}
505 		ia = (struct in_ifaddr *)ifaof_ifpforaddr(
506 			    (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
507 		if (ia == 0)
508 			break;
509 		if (ia->ia_ifp == 0)
510 			break;
511 		icp->icmp_type = ICMP_MASKREPLY;
512 		if (icmpmaskfake == 0)
513 			icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
514 		else
515 			icp->icmp_mask = icmpmaskfake;
516 		if (ip->ip_src.s_addr == 0) {
517 			if (ia->ia_ifp->if_flags & IFF_BROADCAST)
518 			    ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
519 			else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
520 			    ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
521 		}
522 reflect:
523 		ip->ip_len += hlen;	/* since ip_input deducts this */
524 		icmpstat.icps_reflect++;
525 		icmpstat.icps_outhist[icp->icmp_type]++;
526 		icmp_reflect(m);
527 		return;
528 
529 	case ICMP_REDIRECT:
530 		if (log_redirect) {
531 			u_long src, dst, gw;
532 
533 			src = ntohl(ip->ip_src.s_addr);
534 			dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
535 			gw = ntohl(icp->icmp_gwaddr.s_addr);
536 			printf("icmp redirect from %d.%d.%d.%d: "
537 			       "%d.%d.%d.%d => %d.%d.%d.%d\n",
538 			       (int)(src >> 24), (int)((src >> 16) & 0xff),
539 			       (int)((src >> 8) & 0xff), (int)(src & 0xff),
540 			       (int)(dst >> 24), (int)((dst >> 16) & 0xff),
541 			       (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
542 			       (int)(gw >> 24), (int)((gw >> 16) & 0xff),
543 			       (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
544 		}
545 		if (drop_redirect)
546 			break;
547 		if (code > 3)
548 			goto badcode;
549 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
550 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
551 			icmpstat.icps_badlen++;
552 			break;
553 		}
554 		/*
555 		 * Short circuit routing redirects to force
556 		 * immediate change in the kernel's routing
557 		 * tables.  The message is also handed to anyone
558 		 * listening on a raw socket (e.g. the routing
559 		 * daemon for use in updating its tables).
560 		 */
561 		icmpgw.sin_addr = ip->ip_src;
562 		icmpdst.sin_addr = icp->icmp_gwaddr;
563 #ifdef	ICMPPRINTFS
564 		if (icmpprintfs) {
565 			char buf[4 * sizeof "123"];
566 			strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
567 
568 			printf("redirect dst %s to %s\n",
569 			       buf, inet_ntoa(icp->icmp_gwaddr));
570 		}
571 #endif
572 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
573 		rtredirect((struct sockaddr *)&icmpsrc,
574 		  (struct sockaddr *)&icmpdst,
575 		  (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
576 		  (struct sockaddr *)&icmpgw);
577 		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
578 #ifdef IPSEC
579 		key_sa_routechange((struct sockaddr *)&icmpsrc);
580 #endif
581 		break;
582 
583 	/*
584 	 * No kernel processing for the following;
585 	 * just fall through to send to raw listener.
586 	 */
587 	case ICMP_ECHOREPLY:
588 	case ICMP_ROUTERADVERT:
589 	case ICMP_ROUTERSOLICIT:
590 	case ICMP_TSTAMPREPLY:
591 	case ICMP_IREQREPLY:
592 	case ICMP_MASKREPLY:
593 	default:
594 		break;
595 	}
596 
597 raw:
598 	rip_input(m, off);
599 	return;
600 
601 freeit:
602 	m_freem(m);
603 }
604 
605 /*
606  * Reflect the ip packet back to the source
607  */
608 static void
609 icmp_reflect(m)
610 	struct mbuf *m;
611 {
612 	struct ip *ip = mtod(m, struct ip *);
613 	struct ifaddr *ifa;
614 	struct in_ifaddr *ia;
615 	struct in_addr t;
616 	struct mbuf *opts = 0;
617 	int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
618 
619 	if (!in_canforward(ip->ip_src) &&
620 	    ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
621 	     (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
622 		m_freem(m);	/* Bad return address */
623 		icmpstat.icps_badaddr++;
624 		goto done;	/* Ip_output() will check for broadcast */
625 	}
626 	t = ip->ip_dst;
627 	ip->ip_dst = ip->ip_src;
628 	/*
629 	 * If the incoming packet was addressed directly to us,
630 	 * use dst as the src for the reply.  Otherwise (broadcast
631 	 * or anonymous), use the address which corresponds
632 	 * to the incoming interface.
633 	 */
634 	LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash)
635 		if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
636 			goto match;
637 	if (m->m_pkthdr.rcvif != NULL &&
638 	    m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
639 		TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
640 			if (ifa->ifa_addr->sa_family != AF_INET)
641 				continue;
642 			ia = ifatoia(ifa);
643 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
644 			    t.s_addr)
645 				goto match;
646 		}
647 	}
648 	ia = ip_rtaddr(ip->ip_dst);
649 	/* We need a route to do anything useful. */
650 	if (ia == NULL) {
651 		m_freem(m);
652 		icmpstat.icps_noroute++;
653 		goto done;
654 	}
655 match:
656 #ifdef MAC
657 	mac_reflect_mbuf_icmp(m);
658 #endif
659 	t = IA_SIN(ia)->sin_addr;
660 	ip->ip_src = t;
661 	ip->ip_ttl = ip_defttl;
662 
663 	if (optlen > 0) {
664 		register u_char *cp;
665 		int opt, cnt;
666 		u_int len;
667 
668 		/*
669 		 * Retrieve any source routing from the incoming packet;
670 		 * add on any record-route or timestamp options.
671 		 */
672 		cp = (u_char *) (ip + 1);
673 		if ((opts = ip_srcroute()) == 0 &&
674 		    (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
675 			opts->m_len = sizeof(struct in_addr);
676 			mtod(opts, struct in_addr *)->s_addr = 0;
677 		}
678 		if (opts) {
679 #ifdef ICMPPRINTFS
680 		    if (icmpprintfs)
681 			    printf("icmp_reflect optlen %d rt %d => ",
682 				optlen, opts->m_len);
683 #endif
684 		    for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
685 			    opt = cp[IPOPT_OPTVAL];
686 			    if (opt == IPOPT_EOL)
687 				    break;
688 			    if (opt == IPOPT_NOP)
689 				    len = 1;
690 			    else {
691 				    if (cnt < IPOPT_OLEN + sizeof(*cp))
692 					    break;
693 				    len = cp[IPOPT_OLEN];
694 				    if (len < IPOPT_OLEN + sizeof(*cp) ||
695 				        len > cnt)
696 					    break;
697 			    }
698 			    /*
699 			     * Should check for overflow, but it "can't happen"
700 			     */
701 			    if (opt == IPOPT_RR || opt == IPOPT_TS ||
702 				opt == IPOPT_SECURITY) {
703 				    bcopy((caddr_t)cp,
704 					mtod(opts, caddr_t) + opts->m_len, len);
705 				    opts->m_len += len;
706 			    }
707 		    }
708 		    /* Terminate & pad, if necessary */
709 		    cnt = opts->m_len % 4;
710 		    if (cnt) {
711 			    for (; cnt < 4; cnt++) {
712 				    *(mtod(opts, caddr_t) + opts->m_len) =
713 					IPOPT_EOL;
714 				    opts->m_len++;
715 			    }
716 		    }
717 #ifdef ICMPPRINTFS
718 		    if (icmpprintfs)
719 			    printf("%d\n", opts->m_len);
720 #endif
721 		}
722 		/*
723 		 * Now strip out original options by copying rest of first
724 		 * mbuf's data back, and adjust the IP length.
725 		 */
726 		ip->ip_len -= optlen;
727 		ip->ip_v = IPVERSION;
728 		ip->ip_hl = 5;
729 		m->m_len -= optlen;
730 		if (m->m_flags & M_PKTHDR)
731 			m->m_pkthdr.len -= optlen;
732 		optlen += sizeof(struct ip);
733 		bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
734 			 (unsigned)(m->m_len - sizeof(struct ip)));
735 	}
736 	m_tag_delete_nonpersistent(m);
737 	m->m_flags &= ~(M_BCAST|M_MCAST);
738 	icmp_send(m, opts);
739 done:
740 	if (opts)
741 		(void)m_free(opts);
742 }
743 
744 /*
745  * Send an icmp packet back to the ip level,
746  * after supplying a checksum.
747  */
748 static void
749 icmp_send(m, opts)
750 	register struct mbuf *m;
751 	struct mbuf *opts;
752 {
753 	register struct ip *ip = mtod(m, struct ip *);
754 	register int hlen;
755 	register struct icmp *icp;
756 
757 	hlen = ip->ip_hl << 2;
758 	m->m_data += hlen;
759 	m->m_len -= hlen;
760 	icp = mtod(m, struct icmp *);
761 	icp->icmp_cksum = 0;
762 	icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
763 	m->m_data -= hlen;
764 	m->m_len += hlen;
765 	m->m_pkthdr.rcvif = (struct ifnet *)0;
766 #ifdef ICMPPRINTFS
767 	if (icmpprintfs) {
768 		char buf[4 * sizeof "123"];
769 		strcpy(buf, inet_ntoa(ip->ip_dst));
770 		printf("icmp_send dst %s src %s\n",
771 		       buf, inet_ntoa(ip->ip_src));
772 	}
773 #endif
774 	(void) ip_output(m, opts, NULL, 0, NULL, NULL);
775 }
776 
777 n_time
778 iptime()
779 {
780 	struct timeval atv;
781 	u_long t;
782 
783 	getmicrotime(&atv);
784 	t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
785 	return (htonl(t));
786 }
787 
788 #if 1
789 /*
790  * Return the next larger or smaller MTU plateau (table from RFC 1191)
791  * given current value MTU.  If DIR is less than zero, a larger plateau
792  * is returned; otherwise, a smaller value is returned.
793  */
794 static int
795 ip_next_mtu(mtu, dir)
796 	int mtu;
797 	int dir;
798 {
799 	static int mtutab[] = {
800 		65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
801 		68, 0
802 	};
803 	int i;
804 
805 	for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
806 		if (mtu >= mtutab[i])
807 			break;
808 	}
809 
810 	if (dir < 0) {
811 		if (i == 0) {
812 			return 0;
813 		} else {
814 			return mtutab[i - 1];
815 		}
816 	} else {
817 		if (mtutab[i] == 0) {
818 			return 0;
819 		} else if(mtu > mtutab[i]) {
820 			return mtutab[i];
821 		} else {
822 			return mtutab[i + 1];
823 		}
824 	}
825 }
826 #endif
827 
828 
829 /*
830  * badport_bandlim() - check for ICMP bandwidth limit
831  *
832  *	Return 0 if it is ok to send an ICMP error response, -1 if we have
833  *	hit our bandwidth limit and it is not ok.
834  *
835  *	If icmplim is <= 0, the feature is disabled and 0 is returned.
836  *
837  *	For now we separate the TCP and UDP subsystems w/ different 'which'
838  *	values.  We may eventually remove this separation (and simplify the
839  *	code further).
840  *
841  *	Note that the printing of the error message is delayed so we can
842  *	properly print the icmp error rate that the system was trying to do
843  *	(i.e. 22000/100 pps, etc...).  This can cause long delays in printing
844  *	the 'final' error, but it doesn't make sense to solve the printing
845  *	delay with more complex code.
846  */
847 
848 int
849 badport_bandlim(int which)
850 {
851 #define	N(a)	(sizeof (a) / sizeof (a[0]))
852 	static struct rate {
853 		const char	*type;
854 		struct timeval	lasttime;
855 		int		curpps;;
856 	} rates[BANDLIM_MAX+1] = {
857 		{ "icmp unreach response" },
858 		{ "icmp ping response" },
859 		{ "icmp tstamp response" },
860 		{ "closed port RST response" },
861 		{ "open port RST response" }
862 	};
863 
864 	/*
865 	 * Return ok status if feature disabled or argument out of range.
866 	 */
867 	if (icmplim > 0 && (u_int) which < N(rates)) {
868 		struct rate *r = &rates[which];
869 		int opps = r->curpps;
870 
871 		if (!ppsratecheck(&r->lasttime, &r->curpps, icmplim))
872 			return -1;	/* discard packet */
873 		/*
874 		 * If we've dropped below the threshold after having
875 		 * rate-limited traffic print the message.  This preserves
876 		 * the previous behaviour at the expense of added complexity.
877 		 */
878 		if (icmplim_output && opps > icmplim)
879 			printf("Limiting %s from %d to %d packets/sec\n",
880 				r->type, opps, icmplim);
881 	}
882 	return 0;			/* okay to send packet */
883 #undef N
884 }
885