1 /*- 2 * Copyright (c) 2018 The FreeBSD Foundation 3 * 4 * This software was developed by Mark Johnston under sponsorship from 5 * the FreeBSD Foundation. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions are 9 * met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in 14 * the documentation and/or other materials provided with the 15 * distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/param.h> 34 #include <sys/ioctl.h> 35 #include <sys/socket.h> 36 #include <sys/sysctl.h> 37 38 #include <net/bpf.h> 39 #include <net/if.h> 40 #include <netinet/in.h> 41 #include <netinet/ip.h> 42 #include <netinet/ip_var.h> 43 44 #include <err.h> 45 #include <errno.h> 46 #include <fcntl.h> 47 #include <ifaddrs.h> 48 #include <stdint.h> 49 #include <stdlib.h> 50 #include <time.h> 51 #include <unistd.h> 52 53 #include <atf-c.h> 54 55 struct lopacket { 56 u_int family; 57 struct ip hdr; 58 char payload[]; 59 }; 60 61 static void 62 update_cksum(struct ip *ip) 63 { 64 size_t i; 65 uint32_t cksum; 66 uint16_t *cksump; 67 68 ip->ip_sum = 0; 69 cksump = (uint16_t *)ip; 70 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++) 71 cksum += ntohs(*cksump); 72 cksum = (cksum >> 16) + (cksum & 0xffff); 73 cksum = ~(cksum + (cksum >> 16)); 74 ip->ip_sum = htons((uint16_t)cksum); 75 } 76 77 static struct lopacket * 78 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen) 79 { 80 struct ip *ip; 81 struct lopacket *packet; 82 size_t pktlen; 83 84 pktlen = sizeof(*packet) + payloadlen; 85 packet = malloc(pktlen); 86 ATF_REQUIRE(packet != NULL); 87 88 memset(packet, 0, pktlen); 89 packet->family = AF_INET; 90 91 ip = &packet->hdr; 92 ip->ip_hl = sizeof(struct ip) >> 2; 93 ip->ip_v = 4; 94 ip->ip_tos = 0; 95 ip->ip_len = htons(sizeof(*ip) + payloadlen); 96 ip->ip_id = 0; 97 ip->ip_off = 0; 98 ip->ip_ttl = 1; 99 ip->ip_p = IPPROTO_IP; 100 ip->ip_sum = 0; 101 ip->ip_src.s_addr = dstaddr; 102 ip->ip_dst.s_addr = dstaddr; 103 update_cksum(ip); 104 105 return (packet); 106 } 107 108 static void 109 free_lopacket(struct lopacket *packet) 110 { 111 112 free(packet); 113 } 114 115 static void 116 write_lopacket(int bpffd, struct lopacket *packet) 117 { 118 struct timespec ts; 119 ssize_t n; 120 size_t len; 121 122 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len); 123 n = write(bpffd, packet, len); 124 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno)); 125 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu", 126 n, len); 127 128 /* 129 * Loopback packets are dispatched asynchronously, give netisr some 130 * time. 131 */ 132 ts.tv_sec = 0; 133 ts.tv_nsec = 5000000; /* 5ms */ 134 (void)nanosleep(&ts, NULL); 135 } 136 137 static int 138 open_lobpf(in_addr_t *addrp) 139 { 140 struct ifreq ifr; 141 struct ifaddrs *ifa, *ifap; 142 int error, fd; 143 144 fd = open("/dev/bpf0", O_RDWR); 145 if (fd < 0 && errno == ENOENT) 146 atf_tc_skip("no BPF device available"); 147 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno)); 148 149 error = getifaddrs(&ifap); 150 ATF_REQUIRE(error == 0); 151 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) 152 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 && 153 ifa->ifa_addr->sa_family == AF_INET) 154 break; 155 if (ifa == NULL) 156 atf_tc_skip("no loopback address found"); 157 158 memset(&ifr, 0, sizeof(ifr)); 159 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ); 160 error = ioctl(fd, BIOCSETIF, &ifr); 161 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno)); 162 163 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr; 164 165 freeifaddrs(ifap); 166 167 return (fd); 168 } 169 170 static void 171 get_ipstat(struct ipstat *stat) 172 { 173 size_t len; 174 int error; 175 176 memset(stat, 0, sizeof(*stat)); 177 len = sizeof(*stat); 178 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0); 179 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s", 180 strerror(errno)); 181 ATF_REQUIRE(len == sizeof(*stat)); 182 } 183 184 #define CHECK_IP_COUNTER(oldp, newp, counter) \ 185 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \ 186 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \ 187 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter); 188 189 /* 190 * Make sure a fragment with MF set doesn't come after the last fragment of a 191 * packet. Make sure that multiple fragments with MF clear have the same offset 192 * and length. 193 */ 194 ATF_TC(ip_reass__multiple_last_fragments); 195 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc) 196 { 197 atf_tc_set_md_var(tc, "require.user", "root"); 198 } 199 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc) 200 { 201 struct ipstat old, new; 202 struct ip *ip; 203 struct lopacket *packet1, *packet2, *packet3, *packet4; 204 in_addr_t addr; 205 int error, fd; 206 uint16_t ipid; 207 208 fd = open_lobpf(&addr); 209 ipid = arc4random_uniform(UINT16_MAX + 1); 210 211 packet1 = alloc_lopacket(addr, 16); 212 ip = &packet1->hdr; 213 ip->ip_id = ipid; 214 ip->ip_off = htons(0x10); 215 update_cksum(ip); 216 217 packet2 = alloc_lopacket(addr, 16); 218 ip = &packet2->hdr; 219 ip->ip_id = ipid; 220 ip->ip_off = htons(0x20); 221 update_cksum(ip); 222 223 packet3 = alloc_lopacket(addr, 16); 224 ip = &packet3->hdr; 225 ip->ip_id = ipid; 226 ip->ip_off = htons(0x8); 227 update_cksum(ip); 228 229 packet4 = alloc_lopacket(addr, 32); 230 ip = &packet4->hdr; 231 ip->ip_id = ipid; 232 ip->ip_off = htons(0x10); 233 update_cksum(ip); 234 235 write_lopacket(fd, packet1); 236 237 /* packet2 comes after packet1. */ 238 get_ipstat(&old); 239 write_lopacket(fd, packet2); 240 get_ipstat(&new); 241 CHECK_IP_COUNTER(&old, &new, fragdropped); 242 243 /* packet2 comes after packet1 and has MF set. */ 244 packet2->hdr.ip_off = htons(IP_MF | 0x20); 245 update_cksum(&packet2->hdr); 246 get_ipstat(&old); 247 write_lopacket(fd, packet2); 248 get_ipstat(&new); 249 CHECK_IP_COUNTER(&old, &new, fragdropped); 250 251 /* packet3 comes before packet1 but overlaps. */ 252 get_ipstat(&old); 253 write_lopacket(fd, packet3); 254 get_ipstat(&new); 255 CHECK_IP_COUNTER(&old, &new, fragdropped); 256 257 /* packet4 has the same offset as packet1 but is longer. */ 258 get_ipstat(&old); 259 write_lopacket(fd, packet4); 260 get_ipstat(&new); 261 CHECK_IP_COUNTER(&old, &new, fragdropped); 262 263 error = close(fd); 264 ATF_REQUIRE(error == 0); 265 free_lopacket(packet1); 266 free_lopacket(packet2); 267 free_lopacket(packet3); 268 free_lopacket(packet4); 269 } 270 271 /* 272 * Make sure that we reject zero-length fragments. 273 */ 274 ATF_TC(ip_reass__zero_length_fragment); 275 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc) 276 { 277 atf_tc_set_md_var(tc, "require.user", "root"); 278 } 279 ATF_TC_BODY(ip_reass__zero_length_fragment, tc) 280 { 281 struct ipstat old, new; 282 struct ip *ip; 283 struct lopacket *packet1, *packet2; 284 in_addr_t addr; 285 int error, fd; 286 uint16_t ipid; 287 288 fd = open_lobpf(&addr); 289 ipid = arc4random_uniform(UINT16_MAX + 1); 290 291 /* 292 * Create two packets, one with MF set, one without. 293 */ 294 packet1 = alloc_lopacket(addr, 0); 295 ip = &packet1->hdr; 296 ip->ip_id = ipid; 297 ip->ip_off = htons(IP_MF | 0x10); 298 update_cksum(ip); 299 300 packet2 = alloc_lopacket(addr, 0); 301 ip = &packet2->hdr; 302 ip->ip_id = ~ipid; 303 ip->ip_off = htons(0x10); 304 update_cksum(ip); 305 306 get_ipstat(&old); 307 write_lopacket(fd, packet1); 308 get_ipstat(&new); 309 CHECK_IP_COUNTER(&old, &new, toosmall); 310 CHECK_IP_COUNTER(&old, &new, fragdropped); 311 312 get_ipstat(&old); 313 write_lopacket(fd, packet2); 314 get_ipstat(&new); 315 CHECK_IP_COUNTER(&old, &new, toosmall); 316 CHECK_IP_COUNTER(&old, &new, fragdropped); 317 318 error = close(fd); 319 ATF_REQUIRE(error == 0); 320 free_lopacket(packet1); 321 free_lopacket(packet2); 322 } 323 324 ATF_TC(ip_reass__large_fragment); 325 ATF_TC_HEAD(ip_reass__large_fragment, tc) 326 { 327 atf_tc_set_md_var(tc, "require.user", "root"); 328 } 329 ATF_TC_BODY(ip_reass__large_fragment, tc) 330 { 331 struct ipstat old, new; 332 struct ip *ip; 333 struct lopacket *packet1, *packet2; 334 in_addr_t addr; 335 int error, fd; 336 uint16_t ipid; 337 338 fd = open_lobpf(&addr); 339 ipid = arc4random_uniform(UINT16_MAX + 1); 340 341 /* 342 * Create two packets, one with MF set, one without. 343 * 344 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check. 345 */ 346 packet1 = alloc_lopacket(addr, 16); 347 ip = &packet1->hdr; 348 ip->ip_id = ipid; 349 ip->ip_off = htons(IP_MF | 0x1fff); 350 update_cksum(ip); 351 352 packet2 = alloc_lopacket(addr, 16); 353 ip = &packet2->hdr; 354 ip->ip_id = ipid; 355 ip->ip_off = htons(0x1fff); 356 update_cksum(ip); 357 358 get_ipstat(&old); 359 write_lopacket(fd, packet1); 360 get_ipstat(&new); 361 CHECK_IP_COUNTER(&old, &new, toolong); 362 CHECK_IP_COUNTER(&old, &new, fragdropped); 363 364 get_ipstat(&old); 365 write_lopacket(fd, packet2); 366 get_ipstat(&new); 367 CHECK_IP_COUNTER(&old, &new, toolong); 368 CHECK_IP_COUNTER(&old, &new, fragdropped); 369 370 error = close(fd); 371 ATF_REQUIRE(error == 0); 372 free_lopacket(packet1); 373 free_lopacket(packet2); 374 } 375 376 ATF_TP_ADD_TCS(tp) 377 { 378 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments); 379 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment); 380 ATF_TP_ADD_TC(tp, ip_reass__large_fragment); 381 382 return (atf_no_error()); 383 } 384