1 /*- 2 * Copyright (c) 2018 The FreeBSD Foundation 3 * 4 * This software was developed by Mark Johnston under sponsorship from 5 * the FreeBSD Foundation. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions are 9 * met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the 15 * distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/param.h> 31 #include <sys/ioctl.h> 32 #include <sys/socket.h> 33 #include <sys/sysctl.h> 34 35 #include <net/bpf.h> 36 #include <net/if.h> 37 #include <netinet/in.h> 38 #include <netinet/ip.h> 39 #include <netinet/ip_var.h> 40 41 #include <err.h> 42 #include <errno.h> 43 #include <fcntl.h> 44 #include <ifaddrs.h> 45 #include <stdint.h> 46 #include <stdlib.h> 47 #include <time.h> 48 #include <unistd.h> 49 50 #include <atf-c.h> 51 52 struct lopacket { 53 u_int family; 54 struct ip hdr; 55 char payload[]; 56 }; 57 58 static void 59 update_cksum(struct ip *ip) 60 { 61 size_t i; 62 uint32_t cksum; 63 uint16_t *cksump; 64 65 ip->ip_sum = 0; 66 cksump = (uint16_t *)ip; 67 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++) 68 cksum += ntohs(*cksump); 69 cksum = (cksum >> 16) + (cksum & 0xffff); 70 cksum = ~(cksum + (cksum >> 16)); 71 ip->ip_sum = htons((uint16_t)cksum); 72 } 73 74 static struct lopacket * 75 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen) 76 { 77 struct ip *ip; 78 struct lopacket *packet; 79 size_t pktlen; 80 81 pktlen = sizeof(*packet) + payloadlen; 82 packet = malloc(pktlen); 83 ATF_REQUIRE(packet != NULL); 84 85 memset(packet, 0, pktlen); 86 packet->family = AF_INET; 87 88 ip = &packet->hdr; 89 ip->ip_hl = sizeof(struct ip) >> 2; 90 ip->ip_v = 4; 91 ip->ip_tos = 0; 92 ip->ip_len = htons(sizeof(*ip) + payloadlen); 93 ip->ip_id = 0; 94 ip->ip_off = 0; 95 ip->ip_ttl = 1; 96 ip->ip_p = IPPROTO_IP; 97 ip->ip_sum = 0; 98 ip->ip_src.s_addr = dstaddr; 99 ip->ip_dst.s_addr = dstaddr; 100 update_cksum(ip); 101 102 return (packet); 103 } 104 105 static void 106 free_lopacket(struct lopacket *packet) 107 { 108 109 free(packet); 110 } 111 112 static void 113 write_lopacket(int bpffd, struct lopacket *packet) 114 { 115 struct timespec ts; 116 ssize_t n; 117 size_t len; 118 119 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len); 120 n = write(bpffd, packet, len); 121 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno)); 122 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu", 123 n, len); 124 125 /* 126 * Loopback packets are dispatched asynchronously, give netisr some 127 * time. 128 */ 129 ts.tv_sec = 0; 130 ts.tv_nsec = 5000000; /* 5ms */ 131 (void)nanosleep(&ts, NULL); 132 } 133 134 static int 135 open_lobpf(in_addr_t *addrp) 136 { 137 struct ifreq ifr; 138 struct ifaddrs *ifa, *ifap; 139 int error, fd; 140 141 fd = open("/dev/bpf0", O_RDWR); 142 if (fd < 0 && errno == ENOENT) 143 atf_tc_skip("no BPF device available"); 144 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno)); 145 146 error = getifaddrs(&ifap); 147 ATF_REQUIRE(error == 0); 148 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) 149 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 && 150 ifa->ifa_addr->sa_family == AF_INET) 151 break; 152 if (ifa == NULL) 153 atf_tc_skip("no loopback address found"); 154 155 memset(&ifr, 0, sizeof(ifr)); 156 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ); 157 error = ioctl(fd, BIOCSETIF, &ifr); 158 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno)); 159 160 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr; 161 162 freeifaddrs(ifap); 163 164 return (fd); 165 } 166 167 static void 168 get_ipstat(struct ipstat *stat) 169 { 170 size_t len; 171 int error; 172 173 memset(stat, 0, sizeof(*stat)); 174 len = sizeof(*stat); 175 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0); 176 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s", 177 strerror(errno)); 178 ATF_REQUIRE(len == sizeof(*stat)); 179 } 180 181 #define CHECK_IP_COUNTER(oldp, newp, counter) \ 182 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \ 183 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \ 184 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter); 185 186 /* 187 * Make sure a fragment with MF set doesn't come after the last fragment of a 188 * packet. Make sure that multiple fragments with MF clear have the same offset 189 * and length. 190 */ 191 ATF_TC(ip_reass__multiple_last_fragments); 192 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc) 193 { 194 atf_tc_set_md_var(tc, "require.user", "root"); 195 } 196 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc) 197 { 198 struct ipstat old, new; 199 struct ip *ip; 200 struct lopacket *packet1, *packet2, *packet3, *packet4; 201 in_addr_t addr; 202 int error, fd; 203 uint16_t ipid; 204 205 fd = open_lobpf(&addr); 206 ipid = arc4random_uniform(UINT16_MAX + 1); 207 208 packet1 = alloc_lopacket(addr, 16); 209 ip = &packet1->hdr; 210 ip->ip_id = ipid; 211 ip->ip_off = htons(0x10); 212 update_cksum(ip); 213 214 packet2 = alloc_lopacket(addr, 16); 215 ip = &packet2->hdr; 216 ip->ip_id = ipid; 217 ip->ip_off = htons(0x20); 218 update_cksum(ip); 219 220 packet3 = alloc_lopacket(addr, 16); 221 ip = &packet3->hdr; 222 ip->ip_id = ipid; 223 ip->ip_off = htons(0x8); 224 update_cksum(ip); 225 226 packet4 = alloc_lopacket(addr, 32); 227 ip = &packet4->hdr; 228 ip->ip_id = ipid; 229 ip->ip_off = htons(0x10); 230 update_cksum(ip); 231 232 write_lopacket(fd, packet1); 233 234 /* packet2 comes after packet1. */ 235 get_ipstat(&old); 236 write_lopacket(fd, packet2); 237 get_ipstat(&new); 238 CHECK_IP_COUNTER(&old, &new, fragdropped); 239 240 /* packet2 comes after packet1 and has MF set. */ 241 packet2->hdr.ip_off = htons(IP_MF | 0x20); 242 update_cksum(&packet2->hdr); 243 get_ipstat(&old); 244 write_lopacket(fd, packet2); 245 get_ipstat(&new); 246 CHECK_IP_COUNTER(&old, &new, fragdropped); 247 248 /* packet3 comes before packet1 but overlaps. */ 249 get_ipstat(&old); 250 write_lopacket(fd, packet3); 251 get_ipstat(&new); 252 CHECK_IP_COUNTER(&old, &new, fragdropped); 253 254 /* packet4 has the same offset as packet1 but is longer. */ 255 get_ipstat(&old); 256 write_lopacket(fd, packet4); 257 get_ipstat(&new); 258 CHECK_IP_COUNTER(&old, &new, fragdropped); 259 260 error = close(fd); 261 ATF_REQUIRE(error == 0); 262 free_lopacket(packet1); 263 free_lopacket(packet2); 264 free_lopacket(packet3); 265 free_lopacket(packet4); 266 } 267 268 /* 269 * Make sure that we reject zero-length fragments. 270 */ 271 ATF_TC(ip_reass__zero_length_fragment); 272 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc) 273 { 274 atf_tc_set_md_var(tc, "require.user", "root"); 275 } 276 ATF_TC_BODY(ip_reass__zero_length_fragment, tc) 277 { 278 struct ipstat old, new; 279 struct ip *ip; 280 struct lopacket *packet1, *packet2; 281 in_addr_t addr; 282 int error, fd; 283 uint16_t ipid; 284 285 fd = open_lobpf(&addr); 286 ipid = arc4random_uniform(UINT16_MAX + 1); 287 288 /* 289 * Create two packets, one with MF set, one without. 290 */ 291 packet1 = alloc_lopacket(addr, 0); 292 ip = &packet1->hdr; 293 ip->ip_id = ipid; 294 ip->ip_off = htons(IP_MF | 0x10); 295 update_cksum(ip); 296 297 packet2 = alloc_lopacket(addr, 0); 298 ip = &packet2->hdr; 299 ip->ip_id = ~ipid; 300 ip->ip_off = htons(0x10); 301 update_cksum(ip); 302 303 get_ipstat(&old); 304 write_lopacket(fd, packet1); 305 get_ipstat(&new); 306 CHECK_IP_COUNTER(&old, &new, toosmall); 307 CHECK_IP_COUNTER(&old, &new, fragdropped); 308 309 get_ipstat(&old); 310 write_lopacket(fd, packet2); 311 get_ipstat(&new); 312 CHECK_IP_COUNTER(&old, &new, toosmall); 313 CHECK_IP_COUNTER(&old, &new, fragdropped); 314 315 error = close(fd); 316 ATF_REQUIRE(error == 0); 317 free_lopacket(packet1); 318 free_lopacket(packet2); 319 } 320 321 ATF_TC(ip_reass__large_fragment); 322 ATF_TC_HEAD(ip_reass__large_fragment, tc) 323 { 324 atf_tc_set_md_var(tc, "require.user", "root"); 325 } 326 ATF_TC_BODY(ip_reass__large_fragment, tc) 327 { 328 struct ipstat old, new; 329 struct ip *ip; 330 struct lopacket *packet1, *packet2; 331 in_addr_t addr; 332 int error, fd; 333 uint16_t ipid; 334 335 fd = open_lobpf(&addr); 336 ipid = arc4random_uniform(UINT16_MAX + 1); 337 338 /* 339 * Create two packets, one with MF set, one without. 340 * 341 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check. 342 */ 343 packet1 = alloc_lopacket(addr, 16); 344 ip = &packet1->hdr; 345 ip->ip_id = ipid; 346 ip->ip_off = htons(IP_MF | 0x1fff); 347 update_cksum(ip); 348 349 packet2 = alloc_lopacket(addr, 16); 350 ip = &packet2->hdr; 351 ip->ip_id = ipid; 352 ip->ip_off = htons(0x1fff); 353 update_cksum(ip); 354 355 get_ipstat(&old); 356 write_lopacket(fd, packet1); 357 get_ipstat(&new); 358 CHECK_IP_COUNTER(&old, &new, toolong); 359 CHECK_IP_COUNTER(&old, &new, fragdropped); 360 361 get_ipstat(&old); 362 write_lopacket(fd, packet2); 363 get_ipstat(&new); 364 CHECK_IP_COUNTER(&old, &new, toolong); 365 CHECK_IP_COUNTER(&old, &new, fragdropped); 366 367 error = close(fd); 368 ATF_REQUIRE(error == 0); 369 free_lopacket(packet1); 370 free_lopacket(packet2); 371 } 372 373 ATF_TP_ADD_TCS(tp) 374 { 375 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments); 376 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment); 377 ATF_TP_ADD_TC(tp, ip_reass__large_fragment); 378 379 return (atf_no_error()); 380 } 381