xref: /freebsd/sys/netinet/ip_icmp.c (revision f7c4bd95ba735bd6a5454b4953945a99cefbb80c)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_ipsec.h"
36 #include "opt_mac.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/protosw.h>
42 #include <sys/socket.h>
43 #include <sys/time.h>
44 #include <sys/kernel.h>
45 #include <sys/sysctl.h>
46 
47 #include <net/if.h>
48 #include <net/if_types.h>
49 #include <net/route.h>
50 
51 #include <netinet/in.h>
52 #include <netinet/in_pcb.h>
53 #include <netinet/in_systm.h>
54 #include <netinet/in_var.h>
55 #include <netinet/ip.h>
56 #include <netinet/ip_icmp.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/ip_options.h>
59 #include <netinet/tcp.h>
60 #include <netinet/tcp_var.h>
61 #include <netinet/tcpip.h>
62 #include <netinet/icmp_var.h>
63 
64 #ifdef IPSEC
65 #include <netipsec/ipsec.h>
66 #include <netipsec/key.h>
67 #endif
68 
69 #include <machine/in_cksum.h>
70 
71 #include <security/mac/mac_framework.h>
72 
73 /*
74  * ICMP routines: error generation, receive packet processing, and
75  * routines to turnaround packets back to the originator, and
76  * host table maintenance routines.
77  */
78 
79 struct	icmpstat icmpstat;
80 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RW,
81 	&icmpstat, icmpstat, "");
82 
83 static int	icmpmaskrepl = 0;
84 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
85 	&icmpmaskrepl, 0, "Reply to ICMP Address Mask Request packets.");
86 
87 static u_int	icmpmaskfake = 0;
88 SYSCTL_UINT(_net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW,
89 	&icmpmaskfake, 0, "Fake reply to ICMP Address Mask Request packets.");
90 
91 static int	drop_redirect = 0;
92 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
93 	&drop_redirect, 0, "Ignore ICMP redirects");
94 
95 static int	log_redirect = 0;
96 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
97 	&log_redirect, 0, "Log ICMP redirects to the console");
98 
99 static int      icmplim = 200;
100 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
101 	&icmplim, 0, "Maximum number of ICMP responses per second");
102 
103 static int	icmplim_output = 1;
104 SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW,
105 	&icmplim_output, 0, "Enable rate limiting of ICMP responses");
106 
107 static char	reply_src[IFNAMSIZ];
108 SYSCTL_STRING(_net_inet_icmp, OID_AUTO, reply_src, CTLFLAG_RW,
109 	&reply_src, IFNAMSIZ, "icmp reply source for non-local packets.");
110 
111 static int	icmp_rfi = 0;
112 SYSCTL_INT(_net_inet_icmp, OID_AUTO, reply_from_interface, CTLFLAG_RW,
113 	&icmp_rfi, 0, "ICMP reply from incoming interface for "
114 	"non-local packets");
115 
116 static int	icmp_quotelen = 8;
117 SYSCTL_INT(_net_inet_icmp, OID_AUTO, quotelen, CTLFLAG_RW,
118 	&icmp_quotelen, 0, "Number of bytes from original packet to "
119 	"quote in ICMP reply");
120 
121 /*
122  * ICMP broadcast echo sysctl
123  */
124 
125 static int	icmpbmcastecho = 0;
126 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
127 	&icmpbmcastecho, 0, "");
128 
129 
130 #ifdef ICMPPRINTFS
131 int	icmpprintfs = 0;
132 #endif
133 
134 static void	icmp_reflect(struct mbuf *);
135 static void	icmp_send(struct mbuf *, struct mbuf *);
136 
137 extern	struct protosw inetsw[];
138 
139 /*
140  * Generate an error packet of type error
141  * in response to bad packet ip.
142  */
143 void
144 icmp_error(struct mbuf *n, int type, int code, n_long dest, int mtu)
145 {
146 	register struct ip *oip = mtod(n, struct ip *), *nip;
147 	register unsigned oiphlen = oip->ip_hl << 2;
148 	register struct icmp *icp;
149 	register struct mbuf *m;
150 	unsigned icmplen, icmpelen, nlen;
151 
152 	KASSERT((u_int)type <= ICMP_MAXTYPE, ("%s: illegal ICMP type", __func__));
153 #ifdef ICMPPRINTFS
154 	if (icmpprintfs)
155 		printf("icmp_error(%p, %x, %d)\n", oip, type, code);
156 #endif
157 	if (type != ICMP_REDIRECT)
158 		icmpstat.icps_error++;
159 	/*
160 	 * Don't send error:
161 	 *  if the original packet was encrypted.
162 	 *  if not the first fragment of message.
163 	 *  in response to a multicast or broadcast packet.
164 	 *  if the old packet protocol was an ICMP error message.
165 	 */
166 	if (n->m_flags & M_DECRYPTED)
167 		goto freeit;
168 	if (oip->ip_off & ~(IP_MF|IP_DF))
169 		goto freeit;
170 	if (n->m_flags & (M_BCAST|M_MCAST))
171 		goto freeit;
172 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
173 	  n->m_len >= oiphlen + ICMP_MINLEN &&
174 	  !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiphlen))->icmp_type)) {
175 		icmpstat.icps_oldicmp++;
176 		goto freeit;
177 	}
178 	/* Drop if IP header plus 8 bytes is not contignous in first mbuf. */
179 	if (oiphlen + 8 > n->m_len)
180 		goto freeit;
181 	/*
182 	 * Calculate length to quote from original packet and
183 	 * prevent the ICMP mbuf from overflowing.
184 	 * Unfortunatly this is non-trivial since ip_forward()
185 	 * sends us truncated packets.
186 	 */
187 	nlen = m_length(n, NULL);
188 	if (oip->ip_p == IPPROTO_TCP) {
189 		struct tcphdr *th;
190 		int tcphlen;
191 
192 		if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
193 		    n->m_next == NULL)
194 			goto stdreply;
195 		if (n->m_len < oiphlen + sizeof(struct tcphdr) &&
196 		    ((n = m_pullup(n, oiphlen + sizeof(struct tcphdr))) == NULL))
197 			goto freeit;
198 		th = (struct tcphdr *)((caddr_t)oip + oiphlen);
199 		tcphlen = th->th_off << 2;
200 		if (tcphlen < sizeof(struct tcphdr))
201 			goto freeit;
202 		if (oip->ip_len < oiphlen + tcphlen)
203 			goto freeit;
204 		if (oiphlen + tcphlen > n->m_len && n->m_next == NULL)
205 			goto stdreply;
206 		if (n->m_len < oiphlen + tcphlen &&
207 		    ((n = m_pullup(n, oiphlen + tcphlen)) == NULL))
208 			goto freeit;
209 		icmpelen = max(tcphlen, min(icmp_quotelen, oip->ip_len - oiphlen));
210 	} else
211 stdreply:	icmpelen = max(8, min(icmp_quotelen, oip->ip_len - oiphlen));
212 
213 	icmplen = min(oiphlen + icmpelen, nlen);
214 	if (icmplen < sizeof(struct ip))
215 		goto freeit;
216 
217 	if (MHLEN > sizeof(struct ip) + ICMP_MINLEN + icmplen)
218 		m = m_gethdr(M_DONTWAIT, MT_DATA);
219 	else
220 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
221 	if (m == NULL)
222 		goto freeit;
223 #ifdef MAC
224 	mac_netinet_icmp_reply(n, m);
225 #endif
226 	icmplen = min(icmplen, M_TRAILINGSPACE(m) - sizeof(struct ip) - ICMP_MINLEN);
227 	m_align(m, ICMP_MINLEN + icmplen);
228 	m->m_len = ICMP_MINLEN + icmplen;
229 
230 	/* XXX MRT  make the outgoing packet use the same FIB
231 	 * that was associated with the incoming packet
232 	 */
233 	M_SETFIB(m, M_GETFIB(n));
234 	icp = mtod(m, struct icmp *);
235 	icmpstat.icps_outhist[type]++;
236 	icp->icmp_type = type;
237 	if (type == ICMP_REDIRECT)
238 		icp->icmp_gwaddr.s_addr = dest;
239 	else {
240 		icp->icmp_void = 0;
241 		/*
242 		 * The following assignments assume an overlay with the
243 		 * just zeroed icmp_void field.
244 		 */
245 		if (type == ICMP_PARAMPROB) {
246 			icp->icmp_pptr = code;
247 			code = 0;
248 		} else if (type == ICMP_UNREACH &&
249 			code == ICMP_UNREACH_NEEDFRAG && mtu) {
250 			icp->icmp_nextmtu = htons(mtu);
251 		}
252 	}
253 	icp->icmp_code = code;
254 
255 	/*
256 	 * Copy the quotation into ICMP message and
257 	 * convert quoted IP header back to network representation.
258 	 */
259 	m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
260 	nip = &icp->icmp_ip;
261 	nip->ip_len = htons(nip->ip_len);
262 	nip->ip_off = htons(nip->ip_off);
263 
264 	/*
265 	 * Set up ICMP message mbuf and copy old IP header (without options
266 	 * in front of ICMP message.
267 	 * If the original mbuf was meant to bypass the firewall, the error
268 	 * reply should bypass as well.
269 	 */
270 	m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
271 	m->m_data -= sizeof(struct ip);
272 	m->m_len += sizeof(struct ip);
273 	m->m_pkthdr.len = m->m_len;
274 	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
275 	nip = mtod(m, struct ip *);
276 	bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
277 	nip->ip_len = m->m_len;
278 	nip->ip_v = IPVERSION;
279 	nip->ip_hl = 5;
280 	nip->ip_p = IPPROTO_ICMP;
281 	nip->ip_tos = 0;
282 	icmp_reflect(m);
283 
284 freeit:
285 	m_freem(n);
286 }
287 
288 /*
289  * Process a received ICMP message.
290  */
291 void
292 icmp_input(struct mbuf *m, int off)
293 {
294 	struct icmp *icp;
295 	struct in_ifaddr *ia;
296 	struct ip *ip = mtod(m, struct ip *);
297 	struct sockaddr_in icmpsrc, icmpdst, icmpgw;
298 	int hlen = off;
299 	int icmplen = ip->ip_len;
300 	int i, code;
301 	void (*ctlfunc)(int, struct sockaddr *, void *);
302 	int fibnum;
303 
304 	/*
305 	 * Locate icmp structure in mbuf, and check
306 	 * that not corrupted and of at least minimum length.
307 	 */
308 #ifdef ICMPPRINTFS
309 	if (icmpprintfs) {
310 		char buf[4 * sizeof "123"];
311 		strcpy(buf, inet_ntoa(ip->ip_src));
312 		printf("icmp_input from %s to %s, len %d\n",
313 		       buf, inet_ntoa(ip->ip_dst), icmplen);
314 	}
315 #endif
316 	if (icmplen < ICMP_MINLEN) {
317 		icmpstat.icps_tooshort++;
318 		goto freeit;
319 	}
320 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
321 	if (m->m_len < i && (m = m_pullup(m, i)) == 0)  {
322 		icmpstat.icps_tooshort++;
323 		return;
324 	}
325 	ip = mtod(m, struct ip *);
326 	m->m_len -= hlen;
327 	m->m_data += hlen;
328 	icp = mtod(m, struct icmp *);
329 	if (in_cksum(m, icmplen)) {
330 		icmpstat.icps_checksum++;
331 		goto freeit;
332 	}
333 	m->m_len += hlen;
334 	m->m_data -= hlen;
335 
336 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
337 		/*
338 		 * Deliver very specific ICMP type only.
339 		 */
340 		switch (icp->icmp_type) {
341 		case ICMP_UNREACH:
342 		case ICMP_TIMXCEED:
343 			break;
344 		default:
345 			goto freeit;
346 		}
347 	}
348 
349 #ifdef ICMPPRINTFS
350 	if (icmpprintfs)
351 		printf("icmp_input, type %d code %d\n", icp->icmp_type,
352 		    icp->icmp_code);
353 #endif
354 
355 	/*
356 	 * Message type specific processing.
357 	 */
358 	if (icp->icmp_type > ICMP_MAXTYPE)
359 		goto raw;
360 
361 	/* Initialize */
362 	bzero(&icmpsrc, sizeof(icmpsrc));
363 	icmpsrc.sin_len = sizeof(struct sockaddr_in);
364 	icmpsrc.sin_family = AF_INET;
365 	bzero(&icmpdst, sizeof(icmpdst));
366 	icmpdst.sin_len = sizeof(struct sockaddr_in);
367 	icmpdst.sin_family = AF_INET;
368 	bzero(&icmpgw, sizeof(icmpgw));
369 	icmpgw.sin_len = sizeof(struct sockaddr_in);
370 	icmpgw.sin_family = AF_INET;
371 
372 	icmpstat.icps_inhist[icp->icmp_type]++;
373 	code = icp->icmp_code;
374 	switch (icp->icmp_type) {
375 
376 	case ICMP_UNREACH:
377 		switch (code) {
378 			case ICMP_UNREACH_NET:
379 			case ICMP_UNREACH_HOST:
380 			case ICMP_UNREACH_SRCFAIL:
381 			case ICMP_UNREACH_NET_UNKNOWN:
382 			case ICMP_UNREACH_HOST_UNKNOWN:
383 			case ICMP_UNREACH_ISOLATED:
384 			case ICMP_UNREACH_TOSNET:
385 			case ICMP_UNREACH_TOSHOST:
386 			case ICMP_UNREACH_HOST_PRECEDENCE:
387 			case ICMP_UNREACH_PRECEDENCE_CUTOFF:
388 				code = PRC_UNREACH_NET;
389 				break;
390 
391 			case ICMP_UNREACH_NEEDFRAG:
392 				code = PRC_MSGSIZE;
393 				break;
394 
395 			/*
396 			 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
397 			 * Treat subcodes 2,3 as immediate RST
398 			 */
399 			case ICMP_UNREACH_PROTOCOL:
400 			case ICMP_UNREACH_PORT:
401 				code = PRC_UNREACH_PORT;
402 				break;
403 
404 			case ICMP_UNREACH_NET_PROHIB:
405 			case ICMP_UNREACH_HOST_PROHIB:
406 			case ICMP_UNREACH_FILTER_PROHIB:
407 				code = PRC_UNREACH_ADMIN_PROHIB;
408 				break;
409 
410 			default:
411 				goto badcode;
412 		}
413 		goto deliver;
414 
415 	case ICMP_TIMXCEED:
416 		if (code > 1)
417 			goto badcode;
418 		code += PRC_TIMXCEED_INTRANS;
419 		goto deliver;
420 
421 	case ICMP_PARAMPROB:
422 		if (code > 1)
423 			goto badcode;
424 		code = PRC_PARAMPROB;
425 		goto deliver;
426 
427 	case ICMP_SOURCEQUENCH:
428 		if (code)
429 			goto badcode;
430 		code = PRC_QUENCH;
431 	deliver:
432 		/*
433 		 * Problem with datagram; advise higher level routines.
434 		 */
435 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
436 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
437 			icmpstat.icps_badlen++;
438 			goto freeit;
439 		}
440 		icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
441 		/* Discard ICMP's in response to multicast packets */
442 		if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
443 			goto badcode;
444 #ifdef ICMPPRINTFS
445 		if (icmpprintfs)
446 			printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
447 #endif
448 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
449 		/*
450 		 * XXX if the packet contains [IPv4 AH TCP], we can't make a
451 		 * notification to TCP layer.
452 		 */
453 		ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
454 		if (ctlfunc)
455 			(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
456 				   (void *)&icp->icmp_ip);
457 		break;
458 
459 	badcode:
460 		icmpstat.icps_badcode++;
461 		break;
462 
463 	case ICMP_ECHO:
464 		if (!icmpbmcastecho
465 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
466 			icmpstat.icps_bmcastecho++;
467 			break;
468 		}
469 		icp->icmp_type = ICMP_ECHOREPLY;
470 		if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
471 			goto freeit;
472 		else
473 			goto reflect;
474 
475 	case ICMP_TSTAMP:
476 		if (!icmpbmcastecho
477 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
478 			icmpstat.icps_bmcasttstamp++;
479 			break;
480 		}
481 		if (icmplen < ICMP_TSLEN) {
482 			icmpstat.icps_badlen++;
483 			break;
484 		}
485 		icp->icmp_type = ICMP_TSTAMPREPLY;
486 		icp->icmp_rtime = iptime();
487 		icp->icmp_ttime = icp->icmp_rtime;	/* bogus, do later! */
488 		if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
489 			goto freeit;
490 		else
491 			goto reflect;
492 
493 	case ICMP_MASKREQ:
494 		if (icmpmaskrepl == 0)
495 			break;
496 		/*
497 		 * We are not able to respond with all ones broadcast
498 		 * unless we receive it over a point-to-point interface.
499 		 */
500 		if (icmplen < ICMP_MASKLEN)
501 			break;
502 		switch (ip->ip_dst.s_addr) {
503 
504 		case INADDR_BROADCAST:
505 		case INADDR_ANY:
506 			icmpdst.sin_addr = ip->ip_src;
507 			break;
508 
509 		default:
510 			icmpdst.sin_addr = ip->ip_dst;
511 		}
512 		ia = (struct in_ifaddr *)ifaof_ifpforaddr(
513 			    (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
514 		if (ia == 0)
515 			break;
516 		if (ia->ia_ifp == 0)
517 			break;
518 		icp->icmp_type = ICMP_MASKREPLY;
519 		if (icmpmaskfake == 0)
520 			icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
521 		else
522 			icp->icmp_mask = icmpmaskfake;
523 		if (ip->ip_src.s_addr == 0) {
524 			if (ia->ia_ifp->if_flags & IFF_BROADCAST)
525 			    ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
526 			else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
527 			    ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
528 		}
529 reflect:
530 		ip->ip_len += hlen;	/* since ip_input deducts this */
531 		icmpstat.icps_reflect++;
532 		icmpstat.icps_outhist[icp->icmp_type]++;
533 		icmp_reflect(m);
534 		return;
535 
536 	case ICMP_REDIRECT:
537 		if (log_redirect) {
538 			u_long src, dst, gw;
539 
540 			src = ntohl(ip->ip_src.s_addr);
541 			dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
542 			gw = ntohl(icp->icmp_gwaddr.s_addr);
543 			printf("icmp redirect from %d.%d.%d.%d: "
544 			       "%d.%d.%d.%d => %d.%d.%d.%d\n",
545 			       (int)(src >> 24), (int)((src >> 16) & 0xff),
546 			       (int)((src >> 8) & 0xff), (int)(src & 0xff),
547 			       (int)(dst >> 24), (int)((dst >> 16) & 0xff),
548 			       (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
549 			       (int)(gw >> 24), (int)((gw >> 16) & 0xff),
550 			       (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
551 		}
552 		/*
553 		 * RFC1812 says we must ignore ICMP redirects if we
554 		 * are acting as router.
555 		 */
556 		if (drop_redirect || ipforwarding)
557 			break;
558 		if (code > 3)
559 			goto badcode;
560 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
561 		    icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
562 			icmpstat.icps_badlen++;
563 			break;
564 		}
565 		/*
566 		 * Short circuit routing redirects to force
567 		 * immediate change in the kernel's routing
568 		 * tables.  The message is also handed to anyone
569 		 * listening on a raw socket (e.g. the routing
570 		 * daemon for use in updating its tables).
571 		 */
572 		icmpgw.sin_addr = ip->ip_src;
573 		icmpdst.sin_addr = icp->icmp_gwaddr;
574 #ifdef	ICMPPRINTFS
575 		if (icmpprintfs) {
576 			char buf[4 * sizeof "123"];
577 			strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
578 
579 			printf("redirect dst %s to %s\n",
580 			       buf, inet_ntoa(icp->icmp_gwaddr));
581 		}
582 #endif
583 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
584 		for ( fibnum = 0; fibnum < rt_numfibs; fibnum++) {
585 			in_rtredirect((struct sockaddr *)&icmpsrc,
586 			  (struct sockaddr *)&icmpdst,
587 			  (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
588 			  (struct sockaddr *)&icmpgw, fibnum);
589 		}
590 		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
591 #ifdef IPSEC
592 		key_sa_routechange((struct sockaddr *)&icmpsrc);
593 #endif
594 		break;
595 
596 	/*
597 	 * No kernel processing for the following;
598 	 * just fall through to send to raw listener.
599 	 */
600 	case ICMP_ECHOREPLY:
601 	case ICMP_ROUTERADVERT:
602 	case ICMP_ROUTERSOLICIT:
603 	case ICMP_TSTAMPREPLY:
604 	case ICMP_IREQREPLY:
605 	case ICMP_MASKREPLY:
606 	default:
607 		break;
608 	}
609 
610 raw:
611 	rip_input(m, off);
612 	return;
613 
614 freeit:
615 	m_freem(m);
616 }
617 
618 /*
619  * Reflect the ip packet back to the source
620  */
621 static void
622 icmp_reflect(struct mbuf *m)
623 {
624 	struct ip *ip = mtod(m, struct ip *);
625 	struct ifaddr *ifa;
626 	struct ifnet *ifn;
627 	struct in_ifaddr *ia;
628 	struct in_addr t;
629 	struct mbuf *opts = 0;
630 	int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
631 
632 	if (IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
633 	    IN_EXPERIMENTAL(ntohl(ip->ip_src.s_addr)) ||
634 	    IN_ZERONET(ntohl(ip->ip_src.s_addr)) ) {
635 		m_freem(m);	/* Bad return address */
636 		icmpstat.icps_badaddr++;
637 		goto done;	/* Ip_output() will check for broadcast */
638 	}
639 
640 	t = ip->ip_dst;
641 	ip->ip_dst = ip->ip_src;
642 
643 	/*
644 	 * Source selection for ICMP replies:
645 	 *
646 	 * If the incoming packet was addressed directly to one of our
647 	 * own addresses, use dst as the src for the reply.
648 	 */
649 	LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash)
650 		if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
651 			goto match;
652 	/*
653 	 * If the incoming packet was addressed to one of our broadcast
654 	 * addresses, use the first non-broadcast address which corresponds
655 	 * to the incoming interface.
656 	 */
657 	if (m->m_pkthdr.rcvif != NULL &&
658 	    m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
659 		TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
660 			if (ifa->ifa_addr->sa_family != AF_INET)
661 				continue;
662 			ia = ifatoia(ifa);
663 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
664 			    t.s_addr)
665 				goto match;
666 		}
667 	}
668 	/*
669 	 * If the packet was transiting through us, use the address of
670 	 * the interface the packet came through in.  If that interface
671 	 * doesn't have a suitable IP address, the normal selection
672 	 * criteria apply.
673 	 */
674 	if (icmp_rfi && m->m_pkthdr.rcvif != NULL) {
675 		TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
676 			if (ifa->ifa_addr->sa_family != AF_INET)
677 				continue;
678 			ia = ifatoia(ifa);
679 			goto match;
680 		}
681 	}
682 	/*
683 	 * If the incoming packet was not addressed directly to us, use
684 	 * designated interface for icmp replies specified by sysctl
685 	 * net.inet.icmp.reply_src (default not set). Otherwise continue
686 	 * with normal source selection.
687 	 */
688 	if (reply_src[0] != '\0' && (ifn = ifunit(reply_src))) {
689 		TAILQ_FOREACH(ifa, &ifn->if_addrhead, ifa_link) {
690 			if (ifa->ifa_addr->sa_family != AF_INET)
691 				continue;
692 			ia = ifatoia(ifa);
693 			goto match;
694 		}
695 	}
696 	/*
697 	 * If the packet was transiting through us, use the address of
698 	 * the interface that is the closest to the packet source.
699 	 * When we don't have a route back to the packet source, stop here
700 	 * and drop the packet.
701 	 */
702 	ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m));
703 	if (ia == NULL) {
704 		m_freem(m);
705 		icmpstat.icps_noroute++;
706 		goto done;
707 	}
708 match:
709 #ifdef MAC
710 	mac_netinet_icmp_replyinplace(m);
711 #endif
712 	t = IA_SIN(ia)->sin_addr;
713 	ip->ip_src = t;
714 	ip->ip_ttl = ip_defttl;
715 
716 	if (optlen > 0) {
717 		register u_char *cp;
718 		int opt, cnt;
719 		u_int len;
720 
721 		/*
722 		 * Retrieve any source routing from the incoming packet;
723 		 * add on any record-route or timestamp options.
724 		 */
725 		cp = (u_char *) (ip + 1);
726 		if ((opts = ip_srcroute(m)) == 0 &&
727 		    (opts = m_gethdr(M_DONTWAIT, MT_DATA))) {
728 			opts->m_len = sizeof(struct in_addr);
729 			mtod(opts, struct in_addr *)->s_addr = 0;
730 		}
731 		if (opts) {
732 #ifdef ICMPPRINTFS
733 		    if (icmpprintfs)
734 			    printf("icmp_reflect optlen %d rt %d => ",
735 				optlen, opts->m_len);
736 #endif
737 		    for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
738 			    opt = cp[IPOPT_OPTVAL];
739 			    if (opt == IPOPT_EOL)
740 				    break;
741 			    if (opt == IPOPT_NOP)
742 				    len = 1;
743 			    else {
744 				    if (cnt < IPOPT_OLEN + sizeof(*cp))
745 					    break;
746 				    len = cp[IPOPT_OLEN];
747 				    if (len < IPOPT_OLEN + sizeof(*cp) ||
748 				        len > cnt)
749 					    break;
750 			    }
751 			    /*
752 			     * Should check for overflow, but it "can't happen"
753 			     */
754 			    if (opt == IPOPT_RR || opt == IPOPT_TS ||
755 				opt == IPOPT_SECURITY) {
756 				    bcopy((caddr_t)cp,
757 					mtod(opts, caddr_t) + opts->m_len, len);
758 				    opts->m_len += len;
759 			    }
760 		    }
761 		    /* Terminate & pad, if necessary */
762 		    cnt = opts->m_len % 4;
763 		    if (cnt) {
764 			    for (; cnt < 4; cnt++) {
765 				    *(mtod(opts, caddr_t) + opts->m_len) =
766 					IPOPT_EOL;
767 				    opts->m_len++;
768 			    }
769 		    }
770 #ifdef ICMPPRINTFS
771 		    if (icmpprintfs)
772 			    printf("%d\n", opts->m_len);
773 #endif
774 		}
775 		/*
776 		 * Now strip out original options by copying rest of first
777 		 * mbuf's data back, and adjust the IP length.
778 		 */
779 		ip->ip_len -= optlen;
780 		ip->ip_v = IPVERSION;
781 		ip->ip_hl = 5;
782 		m->m_len -= optlen;
783 		if (m->m_flags & M_PKTHDR)
784 			m->m_pkthdr.len -= optlen;
785 		optlen += sizeof(struct ip);
786 		bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
787 			 (unsigned)(m->m_len - sizeof(struct ip)));
788 	}
789 	m_tag_delete_nonpersistent(m);
790 	m->m_flags &= ~(M_BCAST|M_MCAST);
791 	icmp_send(m, opts);
792 done:
793 	if (opts)
794 		(void)m_free(opts);
795 }
796 
797 /*
798  * Send an icmp packet back to the ip level,
799  * after supplying a checksum.
800  */
801 static void
802 icmp_send(struct mbuf *m, struct mbuf *opts)
803 {
804 	register struct ip *ip = mtod(m, struct ip *);
805 	register int hlen;
806 	register struct icmp *icp;
807 
808 	hlen = ip->ip_hl << 2;
809 	m->m_data += hlen;
810 	m->m_len -= hlen;
811 	icp = mtod(m, struct icmp *);
812 	icp->icmp_cksum = 0;
813 	icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
814 	m->m_data -= hlen;
815 	m->m_len += hlen;
816 	m->m_pkthdr.rcvif = (struct ifnet *)0;
817 #ifdef ICMPPRINTFS
818 	if (icmpprintfs) {
819 		char buf[4 * sizeof "123"];
820 		strcpy(buf, inet_ntoa(ip->ip_dst));
821 		printf("icmp_send dst %s src %s\n",
822 		       buf, inet_ntoa(ip->ip_src));
823 	}
824 #endif
825 	(void) ip_output(m, opts, NULL, 0, NULL, NULL);
826 }
827 
828 n_time
829 iptime(void)
830 {
831 	struct timeval atv;
832 	u_long t;
833 
834 	getmicrotime(&atv);
835 	t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
836 	return (htonl(t));
837 }
838 
839 /*
840  * Return the next larger or smaller MTU plateau (table from RFC 1191)
841  * given current value MTU.  If DIR is less than zero, a larger plateau
842  * is returned; otherwise, a smaller value is returned.
843  */
844 int
845 ip_next_mtu(int mtu, int dir)
846 {
847 	static int mtutab[] = {
848 		65535, 32000, 17914, 8166, 4352, 2002, 1492, 1280, 1006, 508,
849 		296, 68, 0
850 	};
851 	int i, size;
852 
853 	size = (sizeof mtutab) / (sizeof mtutab[0]);
854 	if (dir >= 0) {
855 		for (i = 0; i < size; i++)
856 			if (mtu > mtutab[i])
857 				return mtutab[i];
858 	} else {
859 		for (i = size - 1; i >= 0; i--)
860 			if (mtu < mtutab[i])
861 				return mtutab[i];
862 		if (mtu == mtutab[0])
863 			return mtutab[0];
864 	}
865 	return 0;
866 }
867 
868 
869 /*
870  * badport_bandlim() - check for ICMP bandwidth limit
871  *
872  *	Return 0 if it is ok to send an ICMP error response, -1 if we have
873  *	hit our bandwidth limit and it is not ok.
874  *
875  *	If icmplim is <= 0, the feature is disabled and 0 is returned.
876  *
877  *	For now we separate the TCP and UDP subsystems w/ different 'which'
878  *	values.  We may eventually remove this separation (and simplify the
879  *	code further).
880  *
881  *	Note that the printing of the error message is delayed so we can
882  *	properly print the icmp error rate that the system was trying to do
883  *	(i.e. 22000/100 pps, etc...).  This can cause long delays in printing
884  *	the 'final' error, but it doesn't make sense to solve the printing
885  *	delay with more complex code.
886  */
887 
888 int
889 badport_bandlim(int which)
890 {
891 #define	N(a)	(sizeof (a) / sizeof (a[0]))
892 	static struct rate {
893 		const char	*type;
894 		struct timeval	lasttime;
895 		int		curpps;
896 	} rates[BANDLIM_MAX+1] = {
897 		{ "icmp unreach response" },
898 		{ "icmp ping response" },
899 		{ "icmp tstamp response" },
900 		{ "closed port RST response" },
901 		{ "open port RST response" },
902 		{ "icmp6 unreach response" }
903 	};
904 
905 	/*
906 	 * Return ok status if feature disabled or argument out of range.
907 	 */
908 	if (icmplim > 0 && (u_int) which < N(rates)) {
909 		struct rate *r = &rates[which];
910 		int opps = r->curpps;
911 
912 		if (!ppsratecheck(&r->lasttime, &r->curpps, icmplim))
913 			return -1;	/* discard packet */
914 		/*
915 		 * If we've dropped below the threshold after having
916 		 * rate-limited traffic print the message.  This preserves
917 		 * the previous behaviour at the expense of added complexity.
918 		 */
919 		if (icmplim_output && opps > icmplim)
920 			printf("Limiting %s from %d to %d packets/sec\n",
921 				r->type, opps, icmplim);
922 	}
923 	return 0;			/* okay to send packet */
924 #undef N
925 }
926