1 /*- 2 * Copyright (c) 2018 The FreeBSD Foundation 3 * 4 * This software was developed by Mark Johnston under sponsorship from 5 * the FreeBSD Foundation. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions are 9 * met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the 15 * distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/param.h> 31 #include <sys/ioctl.h> 32 #include <sys/socket.h> 33 #include <sys/sysctl.h> 34 35 #include <net/bpf.h> 36 #include <net/if.h> 37 #include <netinet/in.h> 38 #include <netinet/ip.h> 39 #include <netinet/ip_var.h> 40 41 #include <err.h> 42 #include <errno.h> 43 #include <fcntl.h> 44 #include <ifaddrs.h> 45 #include <stdint.h> 46 #include <stdlib.h> 47 #include <time.h> 48 #include <unistd.h> 49 50 #include <atf-c.h> 51 52 struct lopacket { 53 u_int family; 54 struct ip hdr; 55 char payload[]; 56 }; 57 58 static void 59 update_cksum(struct ip *ip) 60 { 61 size_t i; 62 uint32_t cksum; 63 uint8_t *cksump; 64 uint16_t tmp; 65 66 ip->ip_sum = 0; 67 cksump = (char *)ip; 68 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(uint16_t); i++) { 69 tmp = *cksump++; 70 tmp = tmp << 8 | *cksump++; 71 cksum += ntohs(tmp); 72 } 73 cksum = (cksum >> 16) + (cksum & 0xffff); 74 cksum = ~(cksum + (cksum >> 16)); 75 ip->ip_sum = htons((uint16_t)cksum); 76 } 77 78 static struct lopacket * 79 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen) 80 { 81 struct ip *ip; 82 struct lopacket *packet; 83 size_t pktlen; 84 85 pktlen = sizeof(*packet) + payloadlen; 86 packet = malloc(pktlen); 87 ATF_REQUIRE(packet != NULL); 88 89 memset(packet, 0, pktlen); 90 packet->family = AF_INET; 91 92 ip = &packet->hdr; 93 ip->ip_hl = sizeof(struct ip) >> 2; 94 ip->ip_v = 4; 95 ip->ip_tos = 0; 96 ip->ip_len = htons(sizeof(*ip) + payloadlen); 97 ip->ip_id = 0; 98 ip->ip_off = 0; 99 ip->ip_ttl = 1; 100 ip->ip_p = IPPROTO_IP; 101 ip->ip_sum = 0; 102 ip->ip_src.s_addr = dstaddr; 103 ip->ip_dst.s_addr = dstaddr; 104 update_cksum(ip); 105 106 return (packet); 107 } 108 109 static void 110 free_lopacket(struct lopacket *packet) 111 { 112 113 free(packet); 114 } 115 116 static void 117 write_lopacket(int bpffd, struct lopacket *packet) 118 { 119 struct timespec ts; 120 ssize_t n; 121 size_t len; 122 123 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len); 124 n = write(bpffd, packet, len); 125 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno)); 126 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu", 127 n, len); 128 129 /* 130 * Loopback packets are dispatched asynchronously, give netisr some 131 * time. 132 */ 133 ts.tv_sec = 0; 134 ts.tv_nsec = 5000000; /* 5ms */ 135 (void)nanosleep(&ts, NULL); 136 } 137 138 static int 139 open_lobpf(in_addr_t *addrp) 140 { 141 struct ifreq ifr; 142 struct ifaddrs *ifa, *ifap; 143 int error, fd; 144 145 fd = open("/dev/bpf0", O_RDWR); 146 if (fd < 0 && errno == ENOENT) 147 atf_tc_skip("no BPF device available"); 148 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno)); 149 150 error = getifaddrs(&ifap); 151 ATF_REQUIRE(error == 0); 152 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) 153 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 && 154 ifa->ifa_addr->sa_family == AF_INET) 155 break; 156 if (ifa == NULL) 157 atf_tc_skip("no loopback address found"); 158 159 memset(&ifr, 0, sizeof(ifr)); 160 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ); 161 error = ioctl(fd, BIOCSETIF, &ifr); 162 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno)); 163 164 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr; 165 166 freeifaddrs(ifap); 167 168 return (fd); 169 } 170 171 static void 172 get_ipstat(struct ipstat *stat) 173 { 174 size_t len; 175 int error; 176 177 memset(stat, 0, sizeof(*stat)); 178 len = sizeof(*stat); 179 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0); 180 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s", 181 strerror(errno)); 182 ATF_REQUIRE(len == sizeof(*stat)); 183 } 184 185 #define CHECK_IP_COUNTER(oldp, newp, counter) \ 186 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \ 187 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \ 188 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter); 189 190 /* 191 * Make sure a fragment with MF set doesn't come after the last fragment of a 192 * packet. Make sure that multiple fragments with MF clear have the same offset 193 * and length. 194 */ 195 ATF_TC(ip_reass__multiple_last_fragments); 196 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc) 197 { 198 atf_tc_set_md_var(tc, "require.user", "root"); 199 } 200 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc) 201 { 202 struct ipstat old, new; 203 struct ip *ip; 204 struct lopacket *packet1, *packet2, *packet3, *packet4; 205 in_addr_t addr; 206 int error, fd; 207 uint16_t ipid; 208 209 fd = open_lobpf(&addr); 210 ipid = arc4random_uniform(UINT16_MAX + 1); 211 212 packet1 = alloc_lopacket(addr, 16); 213 ip = &packet1->hdr; 214 ip->ip_id = ipid; 215 ip->ip_off = htons(0x10); 216 update_cksum(ip); 217 218 packet2 = alloc_lopacket(addr, 16); 219 ip = &packet2->hdr; 220 ip->ip_id = ipid; 221 ip->ip_off = htons(0x20); 222 update_cksum(ip); 223 224 packet3 = alloc_lopacket(addr, 16); 225 ip = &packet3->hdr; 226 ip->ip_id = ipid; 227 ip->ip_off = htons(0x8); 228 update_cksum(ip); 229 230 packet4 = alloc_lopacket(addr, 32); 231 ip = &packet4->hdr; 232 ip->ip_id = ipid; 233 ip->ip_off = htons(0x10); 234 update_cksum(ip); 235 236 write_lopacket(fd, packet1); 237 238 /* packet2 comes after packet1. */ 239 get_ipstat(&old); 240 write_lopacket(fd, packet2); 241 get_ipstat(&new); 242 CHECK_IP_COUNTER(&old, &new, fragdropped); 243 244 /* packet2 comes after packet1 and has MF set. */ 245 packet2->hdr.ip_off = htons(IP_MF | 0x20); 246 update_cksum(&packet2->hdr); 247 get_ipstat(&old); 248 write_lopacket(fd, packet2); 249 get_ipstat(&new); 250 CHECK_IP_COUNTER(&old, &new, fragdropped); 251 252 /* packet3 comes before packet1 but overlaps. */ 253 get_ipstat(&old); 254 write_lopacket(fd, packet3); 255 get_ipstat(&new); 256 CHECK_IP_COUNTER(&old, &new, fragdropped); 257 258 /* packet4 has the same offset as packet1 but is longer. */ 259 get_ipstat(&old); 260 write_lopacket(fd, packet4); 261 get_ipstat(&new); 262 CHECK_IP_COUNTER(&old, &new, fragdropped); 263 264 error = close(fd); 265 ATF_REQUIRE(error == 0); 266 free_lopacket(packet1); 267 free_lopacket(packet2); 268 free_lopacket(packet3); 269 free_lopacket(packet4); 270 } 271 272 /* 273 * Make sure that we reject zero-length fragments. 274 */ 275 ATF_TC(ip_reass__zero_length_fragment); 276 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc) 277 { 278 atf_tc_set_md_var(tc, "require.user", "root"); 279 } 280 ATF_TC_BODY(ip_reass__zero_length_fragment, tc) 281 { 282 struct ipstat old, new; 283 struct ip *ip; 284 struct lopacket *packet1, *packet2; 285 in_addr_t addr; 286 int error, fd; 287 uint16_t ipid; 288 289 fd = open_lobpf(&addr); 290 ipid = arc4random_uniform(UINT16_MAX + 1); 291 292 /* 293 * Create two packets, one with MF set, one without. 294 */ 295 packet1 = alloc_lopacket(addr, 0); 296 ip = &packet1->hdr; 297 ip->ip_id = ipid; 298 ip->ip_off = htons(IP_MF | 0x10); 299 update_cksum(ip); 300 301 packet2 = alloc_lopacket(addr, 0); 302 ip = &packet2->hdr; 303 ip->ip_id = ~ipid; 304 ip->ip_off = htons(0x10); 305 update_cksum(ip); 306 307 get_ipstat(&old); 308 write_lopacket(fd, packet1); 309 get_ipstat(&new); 310 CHECK_IP_COUNTER(&old, &new, toosmall); 311 CHECK_IP_COUNTER(&old, &new, fragdropped); 312 313 get_ipstat(&old); 314 write_lopacket(fd, packet2); 315 get_ipstat(&new); 316 CHECK_IP_COUNTER(&old, &new, toosmall); 317 CHECK_IP_COUNTER(&old, &new, fragdropped); 318 319 error = close(fd); 320 ATF_REQUIRE(error == 0); 321 free_lopacket(packet1); 322 free_lopacket(packet2); 323 } 324 325 ATF_TC(ip_reass__large_fragment); 326 ATF_TC_HEAD(ip_reass__large_fragment, tc) 327 { 328 atf_tc_set_md_var(tc, "require.user", "root"); 329 } 330 ATF_TC_BODY(ip_reass__large_fragment, tc) 331 { 332 struct ipstat old, new; 333 struct ip *ip; 334 struct lopacket *packet1, *packet2; 335 in_addr_t addr; 336 int error, fd; 337 uint16_t ipid; 338 339 fd = open_lobpf(&addr); 340 ipid = arc4random_uniform(UINT16_MAX + 1); 341 342 /* 343 * Create two packets, one with MF set, one without. 344 * 345 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check. 346 */ 347 packet1 = alloc_lopacket(addr, 16); 348 ip = &packet1->hdr; 349 ip->ip_id = ipid; 350 ip->ip_off = htons(IP_MF | 0x1fff); 351 update_cksum(ip); 352 353 packet2 = alloc_lopacket(addr, 16); 354 ip = &packet2->hdr; 355 ip->ip_id = ipid; 356 ip->ip_off = htons(0x1fff); 357 update_cksum(ip); 358 359 get_ipstat(&old); 360 write_lopacket(fd, packet1); 361 get_ipstat(&new); 362 CHECK_IP_COUNTER(&old, &new, toolong); 363 CHECK_IP_COUNTER(&old, &new, fragdropped); 364 365 get_ipstat(&old); 366 write_lopacket(fd, packet2); 367 get_ipstat(&new); 368 CHECK_IP_COUNTER(&old, &new, toolong); 369 CHECK_IP_COUNTER(&old, &new, fragdropped); 370 371 error = close(fd); 372 ATF_REQUIRE(error == 0); 373 free_lopacket(packet1); 374 free_lopacket(packet2); 375 } 376 377 ATF_TP_ADD_TCS(tp) 378 { 379 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments); 380 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment); 381 ATF_TP_ADD_TC(tp, ip_reass__large_fragment); 382 383 return (atf_no_error()); 384 } 385