1 /*- 2 * Copyright (c) 2018 The FreeBSD Foundation 3 * 4 * This software was developed by Mark Johnston under sponsorship from 5 * the FreeBSD Foundation. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions are 9 * met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the 15 * distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 #include <sys/param.h> 32 #include <sys/ioctl.h> 33 #include <sys/socket.h> 34 #include <sys/sysctl.h> 35 36 #include <net/bpf.h> 37 #include <net/if.h> 38 #include <netinet/in.h> 39 #include <netinet/ip.h> 40 #include <netinet/ip_var.h> 41 42 #include <err.h> 43 #include <errno.h> 44 #include <fcntl.h> 45 #include <ifaddrs.h> 46 #include <stdint.h> 47 #include <stdlib.h> 48 #include <time.h> 49 #include <unistd.h> 50 51 #include <atf-c.h> 52 53 struct lopacket { 54 u_int family; 55 struct ip hdr; 56 char payload[]; 57 }; 58 59 static void 60 update_cksum(struct ip *ip) 61 { 62 size_t i; 63 uint32_t cksum; 64 uint16_t *cksump; 65 66 ip->ip_sum = 0; 67 cksump = (uint16_t *)ip; 68 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++) 69 cksum += ntohs(*cksump); 70 cksum = (cksum >> 16) + (cksum & 0xffff); 71 cksum = ~(cksum + (cksum >> 16)); 72 ip->ip_sum = htons((uint16_t)cksum); 73 } 74 75 static struct lopacket * 76 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen) 77 { 78 struct ip *ip; 79 struct lopacket *packet; 80 size_t pktlen; 81 82 pktlen = sizeof(*packet) + payloadlen; 83 packet = malloc(pktlen); 84 ATF_REQUIRE(packet != NULL); 85 86 memset(packet, 0, pktlen); 87 packet->family = AF_INET; 88 89 ip = &packet->hdr; 90 ip->ip_hl = sizeof(struct ip) >> 2; 91 ip->ip_v = 4; 92 ip->ip_tos = 0; 93 ip->ip_len = htons(sizeof(*ip) + payloadlen); 94 ip->ip_id = 0; 95 ip->ip_off = 0; 96 ip->ip_ttl = 1; 97 ip->ip_p = IPPROTO_IP; 98 ip->ip_sum = 0; 99 ip->ip_src.s_addr = dstaddr; 100 ip->ip_dst.s_addr = dstaddr; 101 update_cksum(ip); 102 103 return (packet); 104 } 105 106 static void 107 free_lopacket(struct lopacket *packet) 108 { 109 110 free(packet); 111 } 112 113 static void 114 write_lopacket(int bpffd, struct lopacket *packet) 115 { 116 struct timespec ts; 117 ssize_t n; 118 size_t len; 119 120 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len); 121 n = write(bpffd, packet, len); 122 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno)); 123 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu", 124 n, len); 125 126 /* 127 * Loopback packets are dispatched asynchronously, give netisr some 128 * time. 129 */ 130 ts.tv_sec = 0; 131 ts.tv_nsec = 5000000; /* 5ms */ 132 (void)nanosleep(&ts, NULL); 133 } 134 135 static int 136 open_lobpf(in_addr_t *addrp) 137 { 138 struct ifreq ifr; 139 struct ifaddrs *ifa, *ifap; 140 int error, fd; 141 142 fd = open("/dev/bpf0", O_RDWR); 143 if (fd < 0 && errno == ENOENT) 144 atf_tc_skip("no BPF device available"); 145 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno)); 146 147 error = getifaddrs(&ifap); 148 ATF_REQUIRE(error == 0); 149 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) 150 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 && 151 ifa->ifa_addr->sa_family == AF_INET) 152 break; 153 if (ifa == NULL) 154 atf_tc_skip("no loopback address found"); 155 156 memset(&ifr, 0, sizeof(ifr)); 157 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ); 158 error = ioctl(fd, BIOCSETIF, &ifr); 159 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno)); 160 161 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr; 162 163 freeifaddrs(ifap); 164 165 return (fd); 166 } 167 168 static void 169 get_ipstat(struct ipstat *stat) 170 { 171 size_t len; 172 int error; 173 174 memset(stat, 0, sizeof(*stat)); 175 len = sizeof(*stat); 176 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0); 177 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s", 178 strerror(errno)); 179 ATF_REQUIRE(len == sizeof(*stat)); 180 } 181 182 #define CHECK_IP_COUNTER(oldp, newp, counter) \ 183 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \ 184 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \ 185 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter); 186 187 /* 188 * Make sure a fragment with MF set doesn't come after the last fragment of a 189 * packet. Make sure that multiple fragments with MF clear have the same offset 190 * and length. 191 */ 192 ATF_TC(ip_reass__multiple_last_fragments); 193 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc) 194 { 195 atf_tc_set_md_var(tc, "require.user", "root"); 196 } 197 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc) 198 { 199 struct ipstat old, new; 200 struct ip *ip; 201 struct lopacket *packet1, *packet2, *packet3, *packet4; 202 in_addr_t addr; 203 int error, fd; 204 uint16_t ipid; 205 206 fd = open_lobpf(&addr); 207 ipid = arc4random_uniform(UINT16_MAX + 1); 208 209 packet1 = alloc_lopacket(addr, 16); 210 ip = &packet1->hdr; 211 ip->ip_id = ipid; 212 ip->ip_off = htons(0x10); 213 update_cksum(ip); 214 215 packet2 = alloc_lopacket(addr, 16); 216 ip = &packet2->hdr; 217 ip->ip_id = ipid; 218 ip->ip_off = htons(0x20); 219 update_cksum(ip); 220 221 packet3 = alloc_lopacket(addr, 16); 222 ip = &packet3->hdr; 223 ip->ip_id = ipid; 224 ip->ip_off = htons(0x8); 225 update_cksum(ip); 226 227 packet4 = alloc_lopacket(addr, 32); 228 ip = &packet4->hdr; 229 ip->ip_id = ipid; 230 ip->ip_off = htons(0x10); 231 update_cksum(ip); 232 233 write_lopacket(fd, packet1); 234 235 /* packet2 comes after packet1. */ 236 get_ipstat(&old); 237 write_lopacket(fd, packet2); 238 get_ipstat(&new); 239 CHECK_IP_COUNTER(&old, &new, fragdropped); 240 241 /* packet2 comes after packet1 and has MF set. */ 242 packet2->hdr.ip_off = htons(IP_MF | 0x20); 243 update_cksum(&packet2->hdr); 244 get_ipstat(&old); 245 write_lopacket(fd, packet2); 246 get_ipstat(&new); 247 CHECK_IP_COUNTER(&old, &new, fragdropped); 248 249 /* packet3 comes before packet1 but overlaps. */ 250 get_ipstat(&old); 251 write_lopacket(fd, packet3); 252 get_ipstat(&new); 253 CHECK_IP_COUNTER(&old, &new, fragdropped); 254 255 /* packet4 has the same offset as packet1 but is longer. */ 256 get_ipstat(&old); 257 write_lopacket(fd, packet4); 258 get_ipstat(&new); 259 CHECK_IP_COUNTER(&old, &new, fragdropped); 260 261 error = close(fd); 262 ATF_REQUIRE(error == 0); 263 free_lopacket(packet1); 264 free_lopacket(packet2); 265 free_lopacket(packet3); 266 free_lopacket(packet4); 267 } 268 269 /* 270 * Make sure that we reject zero-length fragments. 271 */ 272 ATF_TC(ip_reass__zero_length_fragment); 273 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc) 274 { 275 atf_tc_set_md_var(tc, "require.user", "root"); 276 } 277 ATF_TC_BODY(ip_reass__zero_length_fragment, tc) 278 { 279 struct ipstat old, new; 280 struct ip *ip; 281 struct lopacket *packet1, *packet2; 282 in_addr_t addr; 283 int error, fd; 284 uint16_t ipid; 285 286 fd = open_lobpf(&addr); 287 ipid = arc4random_uniform(UINT16_MAX + 1); 288 289 /* 290 * Create two packets, one with MF set, one without. 291 */ 292 packet1 = alloc_lopacket(addr, 0); 293 ip = &packet1->hdr; 294 ip->ip_id = ipid; 295 ip->ip_off = htons(IP_MF | 0x10); 296 update_cksum(ip); 297 298 packet2 = alloc_lopacket(addr, 0); 299 ip = &packet2->hdr; 300 ip->ip_id = ~ipid; 301 ip->ip_off = htons(0x10); 302 update_cksum(ip); 303 304 get_ipstat(&old); 305 write_lopacket(fd, packet1); 306 get_ipstat(&new); 307 CHECK_IP_COUNTER(&old, &new, toosmall); 308 CHECK_IP_COUNTER(&old, &new, fragdropped); 309 310 get_ipstat(&old); 311 write_lopacket(fd, packet2); 312 get_ipstat(&new); 313 CHECK_IP_COUNTER(&old, &new, toosmall); 314 CHECK_IP_COUNTER(&old, &new, fragdropped); 315 316 error = close(fd); 317 ATF_REQUIRE(error == 0); 318 free_lopacket(packet1); 319 free_lopacket(packet2); 320 } 321 322 ATF_TC(ip_reass__large_fragment); 323 ATF_TC_HEAD(ip_reass__large_fragment, tc) 324 { 325 atf_tc_set_md_var(tc, "require.user", "root"); 326 } 327 ATF_TC_BODY(ip_reass__large_fragment, tc) 328 { 329 struct ipstat old, new; 330 struct ip *ip; 331 struct lopacket *packet1, *packet2; 332 in_addr_t addr; 333 int error, fd; 334 uint16_t ipid; 335 336 fd = open_lobpf(&addr); 337 ipid = arc4random_uniform(UINT16_MAX + 1); 338 339 /* 340 * Create two packets, one with MF set, one without. 341 * 342 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check. 343 */ 344 packet1 = alloc_lopacket(addr, 16); 345 ip = &packet1->hdr; 346 ip->ip_id = ipid; 347 ip->ip_off = htons(IP_MF | 0x1fff); 348 update_cksum(ip); 349 350 packet2 = alloc_lopacket(addr, 16); 351 ip = &packet2->hdr; 352 ip->ip_id = ipid; 353 ip->ip_off = htons(0x1fff); 354 update_cksum(ip); 355 356 get_ipstat(&old); 357 write_lopacket(fd, packet1); 358 get_ipstat(&new); 359 CHECK_IP_COUNTER(&old, &new, toolong); 360 CHECK_IP_COUNTER(&old, &new, fragdropped); 361 362 get_ipstat(&old); 363 write_lopacket(fd, packet2); 364 get_ipstat(&new); 365 CHECK_IP_COUNTER(&old, &new, toolong); 366 CHECK_IP_COUNTER(&old, &new, fragdropped); 367 368 error = close(fd); 369 ATF_REQUIRE(error == 0); 370 free_lopacket(packet1); 371 free_lopacket(packet2); 372 } 373 374 ATF_TP_ADD_TCS(tp) 375 { 376 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments); 377 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment); 378 ATF_TP_ADD_TC(tp, ip_reass__large_fragment); 379 380 return (atf_no_error()); 381 } 382