1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/mbuf.h>
72 #include <sys/mcache.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/time.h>
76 #include <sys/kernel.h>
77 #include <sys/sysctl.h>
78
79 #include <machine/endian.h>
80
81 #include <net/if.h>
82 #include <net/route.h>
83 #include <net/content_filter.h>
84
85 #define _IP_VHL
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/in_var.h>
89 #include <netinet/ip.h>
90 #include <netinet/ip_icmp.h>
91 #include <netinet/ip_var.h>
92 #include <netinet/icmp_var.h>
93 #include <netinet/tcp.h>
94 #include <netinet/tcp_fsm.h>
95 #include <netinet/tcp_seq.h>
96 #include <netinet/tcp_timer.h>
97 #include <netinet/tcp_var.h>
98 #include <netinet/tcpip.h>
99
100 #if IPSEC
101 #include <netinet6/ipsec.h>
102 #include <netkey/key.h>
103 #endif
104
105 #if NECP
106 #include <net/necp.h>
107 #endif /* NECP */
108
109
110 /*
111 * ICMP routines: error generation, receive packet processing, and
112 * routines to turnaround packets back to the originator, and
113 * host table maintenance routines.
114 */
115
116 struct icmpstat icmpstat;
117 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats,
118 CTLFLAG_RD | CTLFLAG_LOCKED,
119 &icmpstat, icmpstat, "");
120
121 static int icmpmaskrepl = 0;
122 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
123 CTLFLAG_RW | CTLFLAG_LOCKED,
124 &icmpmaskrepl, 0, "");
125
126 static int icmptimestamp = 0;
127 SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp,
128 CTLFLAG_RW | CTLFLAG_LOCKED,
129 &icmptimestamp, 0, "");
130
131 static int drop_redirect = 1;
132 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect,
133 CTLFLAG_RW | CTLFLAG_LOCKED,
134 &drop_redirect, 0, "");
135
136 static int log_redirect = 0;
137 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect,
138 CTLFLAG_RW | CTLFLAG_LOCKED,
139 &log_redirect, 0, "");
140
141 const static int icmp_datalen = 8;
142
143 #if ICMP_BANDLIM
144 /* Default values in case CONFIG_ICMP_BANDLIM is not defined in the MASTER file */
145 #ifndef CONFIG_ICMP_BANDLIM
146 #if XNU_TARGET_OS_OSX
147 #define CONFIG_ICMP_BANDLIM 250
148 #else /* !XNU_TARGET_OS_OSX */
149 #define CONFIG_ICMP_BANDLIM 50
150 #endif /* !XNU_TARGET_OS_OSX */
151 #endif /* CONFIG_ICMP_BANDLIM */
152
153 /*
154 * ICMP error-response bandwidth limiting sysctl. If not enabled, sysctl
155 * variable content is -1 and read-only.
156 */
157
158 static int icmplim = CONFIG_ICMP_BANDLIM;
159 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW | CTLFLAG_LOCKED,
160 &icmplim, 0, "");
161 #else /* ICMP_BANDLIM */
162 static int icmplim = -1;
163 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD | CTLFLAG_LOCKED,
164 &icmplim, 0, "");
165 #endif /* ICMP_BANDLIM */
166
167 static int icmplim_random_incr = CONFIG_ICMP_BANDLIM;
168 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM_INCR, icmplim_random_incr, CTLFLAG_RW | CTLFLAG_LOCKED,
169 &icmplim_random_incr, 0, "");
170
171 /*
172 * ICMP broadcast echo sysctl
173 */
174
175 static int icmpbmcastecho = 1;
176 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED,
177 &icmpbmcastecho, 0, "");
178
179 #if (DEBUG | DEVELOPMENT)
180 static int icmpprintfs = 0;
181 SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,
182 &icmpprintfs, 0, "");
183 #endif
184
185 static void icmp_reflect(struct mbuf *);
186 static void icmp_send(struct mbuf *, struct mbuf *);
187
188 /*
189 * Generate an error packet of type error
190 * in response to bad packet ip.
191 */
192 void
icmp_error(struct mbuf * n,int type,int code,u_int32_t dest,u_int32_t nextmtu)193 icmp_error(
194 struct mbuf *n,
195 int type,
196 int code,
197 u_int32_t dest,
198 u_int32_t nextmtu)
199 {
200 struct ip *oip = NULL;
201 struct ip *nip = NULL;
202 struct icmp *icp = NULL;
203 struct mbuf *m = NULL;
204 u_int32_t oiphlen = 0;
205 u_int32_t icmplen = 0;
206 u_int32_t icmpelen = 0;
207 u_int32_t nlen = 0;
208
209 VERIFY((u_int)type <= ICMP_MAXTYPE);
210 VERIFY(code <= UINT8_MAX);
211
212 /* Expect 32-bit aligned data pointer on strict-align platforms */
213 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n);
214
215 if (type != ICMP_REDIRECT) {
216 icmpstat.icps_error++;
217 }
218 /*
219 * Don't send error:
220 * if not the first fragment of message
221 * if original packet was a multicast or broadcast packet
222 * if the old packet protocol was ICMP
223 * error message, only known informational types.
224 */
225 if (n->m_flags & (M_BCAST | M_MCAST)) {
226 goto freeit;
227 }
228
229 /*
230 * Drop if IP header plus ICMP_MINLEN bytes are not contiguous
231 * in first mbuf.
232 */
233 if (n->m_len < sizeof(struct ip) + ICMP_MINLEN) {
234 goto freeit;
235 }
236
237 oip = mtod(n, struct ip *);
238 oiphlen = IP_VHL_HL(oip->ip_vhl) << 2;
239 if (n->m_len < oiphlen + ICMP_MINLEN) {
240 goto freeit;
241 }
242
243 #if (DEBUG | DEVELOPMENT)
244 if (icmpprintfs > 1) {
245 printf("icmp_error(0x%llx, %x, %d)\n",
246 (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code);
247 }
248 #endif
249
250 if (oip->ip_off & ~(IP_MF | IP_DF)) {
251 goto freeit;
252 }
253
254 if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
255 n->m_len >= oiphlen + ICMP_MINLEN &&
256 !ICMP_INFOTYPE(((struct icmp *)(void *)((caddr_t)oip + oiphlen))->
257 icmp_type)) {
258 icmpstat.icps_oldicmp++;
259 goto freeit;
260 }
261
262 /*
263 * Calculate the length to quote from original packet and prevent
264 * the ICMP mbuf from overflowing.
265 * Unfortunatly this is non-trivial since ip_forward()
266 * sends us truncated packets.
267 */
268 nlen = m_length(n);
269 if (oip->ip_p == IPPROTO_TCP) {
270 struct tcphdr *th = NULL;
271 u_int16_t tcphlen = 0;
272
273 /*
274 * If the packet got truncated and TCP header
275 * is not contained in the packet, send out
276 * standard reply with only IP header as payload
277 */
278 if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
279 n->m_next == NULL) {
280 goto stdreply;
281 }
282
283 /*
284 * Otherwise, pull up to get IP and TCP headers
285 * together
286 */
287 if (n->m_len < (oiphlen + sizeof(struct tcphdr)) &&
288 (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL) {
289 goto freeit;
290 }
291
292 /*
293 * Reinit pointers derived from mbuf data pointer
294 * as things might have moved around with m_pullup
295 */
296 oip = mtod(n, struct ip *);
297 th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
298
299 if (th != ((struct tcphdr *)P2ROUNDDOWN(th,
300 sizeof(u_int32_t))) ||
301 ((th->th_off << 2) > UINT16_MAX)) {
302 goto freeit;
303 }
304 tcphlen = (uint16_t)(th->th_off << 2);
305
306 /* Sanity checks */
307 if (tcphlen < sizeof(struct tcphdr)) {
308 goto freeit;
309 }
310 if (oip->ip_len < (oiphlen + tcphlen)) {
311 goto freeit;
312 }
313 if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL) {
314 goto stdreply;
315 }
316 if (n->m_len < (oiphlen + tcphlen) &&
317 (n = m_pullup(n, (oiphlen + tcphlen))) == NULL) {
318 goto freeit;
319 }
320
321 /*
322 * Reinit pointers derived from mbuf data pointer
323 * as things might have moved around with m_pullup
324 */
325 oip = mtod(n, struct ip *);
326 th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
327
328 icmpelen = max(tcphlen, min(icmp_datalen,
329 (oip->ip_len - oiphlen)));
330 } else {
331 stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen,
332 (oip->ip_len - oiphlen)));
333 }
334
335 icmplen = min(oiphlen + icmpelen, nlen);
336 if (icmplen < sizeof(struct ip)) {
337 goto freeit;
338 }
339
340 /*
341 * First, formulate icmp message
342 * Allocate enough space for the IP header, ICMP header
343 * and the payload (part of the original message to be sent back).
344 */
345 if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen)) {
346 m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */
347 } else {
348 m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
349 }
350
351 if (m == NULL) {
352 goto freeit;
353 }
354
355 /*
356 * Further refine the payload length to the space
357 * remaining in mbuf after including the IP header and ICMP
358 * header.
359 */
360 icmplen = min(icmplen, (u_int)M_TRAILINGSPACE(m) -
361 (u_int)(sizeof(struct ip) - ICMP_MINLEN));
362 m_align(m, ICMP_MINLEN + icmplen);
363 m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */
364
365 icp = mtod(m, struct icmp *);
366 icmpstat.icps_outhist[type]++;
367 icp->icmp_type = (u_char)type;
368 if (type == ICMP_REDIRECT) {
369 icp->icmp_gwaddr.s_addr = dest;
370 } else {
371 icp->icmp_void = 0;
372 /*
373 * The following assignments assume an overlay with the
374 * zeroed icmp_void field.
375 */
376 if (type == ICMP_PARAMPROB) {
377 icp->icmp_pptr = (u_char)code;
378 code = 0;
379 } else if (type == ICMP_UNREACH &&
380 code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) {
381 icp->icmp_nextmtu = htons((uint16_t)nextmtu);
382 }
383 }
384
385 icp->icmp_code = (u_char)code;
386
387 /*
388 * Copy icmplen worth of content from original
389 * mbuf (n) to the new packet after ICMP header.
390 */
391 m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
392 nip = &icp->icmp_ip;
393
394 /*
395 * Convert fields to network representation.
396 */
397 #if BYTE_ORDER != BIG_ENDIAN
398 HTONS(nip->ip_len);
399 HTONS(nip->ip_off);
400 #endif
401 /*
402 * Set up ICMP message mbuf and copy old IP header (without options
403 * in front of ICMP message.
404 */
405 m->m_data -= sizeof(struct ip);
406 m->m_len += sizeof(struct ip);
407 m->m_pkthdr.len = m->m_len;
408 m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
409 nip = mtod(m, struct ip *);
410 bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
411 nip->ip_len = (uint16_t)m->m_len;
412 nip->ip_vhl = IP_VHL_BORING;
413 nip->ip_p = IPPROTO_ICMP;
414 nip->ip_tos = 0;
415 nip->ip_off = 0;
416 icmp_reflect(m);
417 freeit:
418 m_freem(n);
419 }
420
421 /*
422 * Process a received ICMP message.
423 */
424 void
icmp_input(struct mbuf * m,int hlen)425 icmp_input(struct mbuf *m, int hlen)
426 {
427 struct sockaddr_in icmpsrc, icmpdst, icmpgw;
428 struct icmp *icp;
429 struct ip *ip = mtod(m, struct ip *);
430 int icmplen;
431 int i;
432 struct in_ifaddr *ia;
433 void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
434 int code;
435 boolean_t should_log_redirect = false;
436
437 /* Expect 32-bit aligned data pointer on strict-align platforms */
438 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
439
440 icmplen = ip->ip_len;
441
442 /*
443 * Locate icmp structure in mbuf, and check
444 * that not corrupted and of at least minimum length.
445 */
446 #if (DEBUG | DEVELOPMENT)
447 if (icmpprintfs > 2) {
448 char src_str[MAX_IPv4_STR_LEN];
449 char dst_str[MAX_IPv4_STR_LEN];
450
451 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
452 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
453 printf("%s: from %s to %s, len %d\n",
454 __func__, src_str, dst_str, icmplen);
455 }
456 #endif
457 if (icmplen < ICMP_MINLEN) {
458 icmpstat.icps_tooshort++;
459 goto freeit;
460 }
461 i = hlen + min(icmplen, ICMP_ADVLENMIN);
462 if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
463 icmpstat.icps_tooshort++;
464 return;
465 }
466 /* Re-seat the pointers, since `m_pullup' might have moved `m'. `icp' is re-seated below. */
467 ip = mtod(m, struct ip *);
468
469 m->m_len -= hlen;
470 m->m_data += hlen;
471 icp = mtod(m, struct icmp *);
472 if (in_cksum(m, icmplen) != 0) {
473 icmpstat.icps_checksum++;
474 goto freeit;
475 }
476 m->m_len += hlen;
477 m->m_data -= hlen;
478
479 #if (DEBUG | DEVELOPMENT)
480 if (icmpprintfs > 2) {
481 printf("icmp_input, type %d code %d\n", icp->icmp_type,
482 icp->icmp_code);
483 }
484 #endif
485
486 /*
487 * Message type specific processing.
488 */
489 if (icp->icmp_type > ICMP_MAXTYPE) {
490 goto raw;
491 }
492
493 /* Initialize */
494 bzero(&icmpsrc, sizeof(icmpsrc));
495 icmpsrc.sin_len = sizeof(struct sockaddr_in);
496 icmpsrc.sin_family = AF_INET;
497 bzero(&icmpdst, sizeof(icmpdst));
498 icmpdst.sin_len = sizeof(struct sockaddr_in);
499 icmpdst.sin_family = AF_INET;
500 bzero(&icmpgw, sizeof(icmpgw));
501 icmpgw.sin_len = sizeof(struct sockaddr_in);
502 icmpgw.sin_family = AF_INET;
503
504 icmpstat.icps_inhist[icp->icmp_type]++;
505 code = icp->icmp_code;
506 switch (icp->icmp_type) {
507 case ICMP_UNREACH:
508 switch (code) {
509 case ICMP_UNREACH_NET:
510 case ICMP_UNREACH_HOST:
511 case ICMP_UNREACH_SRCFAIL:
512 case ICMP_UNREACH_NET_UNKNOWN:
513 case ICMP_UNREACH_HOST_UNKNOWN:
514 case ICMP_UNREACH_ISOLATED:
515 case ICMP_UNREACH_TOSNET:
516 case ICMP_UNREACH_TOSHOST:
517 case ICMP_UNREACH_HOST_PRECEDENCE:
518 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
519 code = PRC_UNREACH_NET;
520 break;
521
522 case ICMP_UNREACH_NEEDFRAG:
523 code = PRC_MSGSIZE;
524 break;
525
526 /*
527 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
528 * Treat subcodes 2,3 as immediate RST
529 */
530 case ICMP_UNREACH_PROTOCOL:
531 case ICMP_UNREACH_PORT:
532 code = PRC_UNREACH_PORT;
533 break;
534
535 case ICMP_UNREACH_NET_PROHIB:
536 case ICMP_UNREACH_HOST_PROHIB:
537 case ICMP_UNREACH_FILTER_PROHIB:
538 code = PRC_UNREACH_ADMIN_PROHIB;
539 break;
540
541 default:
542 goto badcode;
543 }
544 goto deliver;
545
546 case ICMP_TIMXCEED:
547 if (code > 1) {
548 goto badcode;
549 }
550 code += PRC_TIMXCEED_INTRANS;
551 goto deliver;
552
553 case ICMP_PARAMPROB:
554 if (code > 1) {
555 goto badcode;
556 }
557 code = PRC_PARAMPROB;
558 goto deliver;
559
560 case ICMP_SOURCEQUENCH:
561 if (code) {
562 goto badcode;
563 }
564 code = PRC_QUENCH;
565 deliver:
566 /*
567 * Problem with datagram; advise higher level routines.
568 */
569 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp)
570 || IP_VHL_HL(icp->icmp_ip.ip_vhl) <
571 (sizeof(struct ip) >> 2) ||
572 (m = m_pullup(m, hlen + ICMP_ADVLEN(icp))) == NULL) {
573 icmpstat.icps_badlen++;
574 goto freeit;
575 }
576
577 /* Re-seat the pointers, since `m_pullup' might have moved `m'*/
578 ip = mtod(m, struct ip *);
579 icp = (struct icmp *)(void *)(mtod(m, uint8_t *) + hlen);
580
581 #if BYTE_ORDER != BIG_ENDIAN
582 NTOHS(icp->icmp_ip.ip_len);
583 #endif
584
585 /* Discard ICMP's in response to multicast packets */
586 if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr))) {
587 goto badcode;
588 }
589 #if (DEBUG | DEVELOPMENT)
590 if (icmpprintfs > 2) {
591 printf("deliver to protocol %d\n",
592 icp->icmp_ip.ip_p);
593 }
594 #endif
595 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
596
597 /*
598 * if the packet contains [IPv4 AH TCP], we can't make a
599 * notification to TCP layer.
600 */
601 ctlfunc = ip_protox[icp->icmp_ip.ip_p]->pr_ctlinput;
602
603 if (ctlfunc) {
604 struct ipctlparam ctl_param = {
605 .ipc_m = m,
606 .ipc_icmp = icp,
607 .ipc_icmp_ip = &icp->icmp_ip,
608 .ipc_off = hlen + offsetof(struct icmp, icmp_ip) + (IP_VHL_HL(icp->icmp_ip.ip_vhl) << 2)
609 };
610 LCK_MTX_ASSERT(inet_domain_mutex, LCK_MTX_ASSERT_OWNED);
611
612 lck_mtx_unlock(inet_domain_mutex);
613
614 (*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
615 (void *)&ctl_param, m->m_pkthdr.rcvif);
616
617 lck_mtx_lock(inet_domain_mutex);
618 }
619 break;
620
621 badcode:
622 icmpstat.icps_badcode++;
623 break;
624
625 case ICMP_ECHO:
626 if ((m->m_flags & (M_MCAST | M_BCAST))) {
627 if (icmpbmcastecho == 0) {
628 icmpstat.icps_bmcastecho++;
629 break;
630 }
631 }
632
633 /*
634 * rdar://18644769
635 * Do not reply when the destination is link local multicast or broadcast
636 * and the source is not from a directly connected subnet
637 */
638 if ((IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr)) ||
639 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) &&
640 in_localaddr(ip->ip_src) == 0) {
641 icmpstat.icps_bmcastecho++;
642 #if (DEBUG | DEVELOPMENT)
643 if (icmpprintfs > 0) {
644 char src_str[MAX_IPv4_STR_LEN];
645 char dst_str[MAX_IPv4_STR_LEN];
646
647 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
648 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
649 printf("%s: non local (B|M)CAST %s to %s, len %d\n",
650 __func__, src_str, dst_str, icmplen);
651 }
652 #endif
653 break;
654 }
655
656 icp->icmp_type = ICMP_ECHOREPLY;
657 #if ICMP_BANDLIM
658 if (badport_bandlim(BANDLIM_ICMP_ECHO)) {
659 goto freeit;
660 } else
661 #endif
662 goto reflect;
663
664 case ICMP_TSTAMP:
665 if (icmptimestamp == 0) {
666 break;
667 }
668
669 if (!icmpbmcastecho
670 && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
671 icmpstat.icps_bmcasttstamp++;
672 break;
673 }
674 if (icmplen < ICMP_TSLEN) {
675 icmpstat.icps_badlen++;
676 break;
677 }
678 icp->icmp_type = ICMP_TSTAMPREPLY;
679 icp->icmp_rtime = iptime();
680 icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
681 #if ICMP_BANDLIM
682 if (badport_bandlim(BANDLIM_ICMP_TSTAMP)) {
683 goto freeit;
684 } else
685 #endif
686 goto reflect;
687
688 case ICMP_MASKREQ:
689 if (icmpmaskrepl == 0) {
690 break;
691 }
692 /*
693 * We are not able to respond with all ones broadcast
694 * unless we receive it over a point-to-point interface.
695 */
696 if (icmplen < ICMP_MASKLEN) {
697 break;
698 }
699 switch (ip->ip_dst.s_addr) {
700 case INADDR_BROADCAST:
701 case INADDR_ANY:
702 icmpdst.sin_addr = ip->ip_src;
703 break;
704
705 default:
706 icmpdst.sin_addr = ip->ip_dst;
707 }
708 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
709 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
710 if (ia == 0) {
711 break;
712 }
713 IFA_LOCK(&ia->ia_ifa);
714 if (ia->ia_ifp == 0) {
715 IFA_UNLOCK(&ia->ia_ifa);
716 IFA_REMREF(&ia->ia_ifa);
717 ia = NULL;
718 break;
719 }
720 icp->icmp_type = ICMP_MASKREPLY;
721 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
722 if (ip->ip_src.s_addr == 0) {
723 if (ia->ia_ifp->if_flags & IFF_BROADCAST) {
724 ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
725 } else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) {
726 ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
727 }
728 }
729 IFA_UNLOCK(&ia->ia_ifa);
730 IFA_REMREF(&ia->ia_ifa);
731 reflect:
732 ip->ip_len += hlen; /* since ip_input deducts this */
733 icmpstat.icps_reflect++;
734 icmpstat.icps_outhist[icp->icmp_type]++;
735 icmp_reflect(m);
736 return;
737
738 case ICMP_REDIRECT:
739 if (drop_redirect) {
740 break;
741 }
742 if (code > 3) {
743 goto badcode;
744 }
745 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
746 IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
747 icmpstat.icps_badlen++;
748 break;
749 }
750
751 #if (DEBUG | DEVELOPMENT)
752 should_log_redirect = log_redirect || (icmpprintfs > 0);
753 #else
754 should_log_redirect = log_redirect;
755 #endif
756 /*
757 * Short circuit routing redirects to force
758 * immediate change in the kernel's routing
759 * tables. The message is also handed to anyone
760 * listening on a raw socket (e.g. the routing
761 * daemon for use in updating its tables).
762 */
763 icmpgw.sin_addr = ip->ip_src;
764 icmpdst.sin_addr = icp->icmp_gwaddr;
765
766 if (should_log_redirect) {
767 char src_str[MAX_IPv4_STR_LEN];
768 char dst_str[MAX_IPv4_STR_LEN];
769 char gw_str[MAX_IPv4_STR_LEN];
770
771 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
772 inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str));
773 inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str));
774 printf("%s: redirect dst %s to %s from %s\n", __func__,
775 dst_str, gw_str, src_str);
776 }
777 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
778 rtredirect(m->m_pkthdr.rcvif, (struct sockaddr *)&icmpsrc,
779 (struct sockaddr *)&icmpdst, NULL, RTF_GATEWAY | RTF_HOST,
780 (struct sockaddr *)&icmpgw, NULL);
781 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
782 #if IPSEC
783 key_sa_routechange((struct sockaddr *)&icmpsrc);
784 #endif
785 break;
786
787 /*
788 * No kernel processing for the following;
789 * just fall through to send to raw listener.
790 */
791 case ICMP_ECHOREPLY:
792 case ICMP_ROUTERADVERT:
793 case ICMP_ROUTERSOLICIT:
794 case ICMP_TSTAMPREPLY:
795 case ICMP_IREQREPLY:
796 case ICMP_MASKREPLY:
797 default:
798 break;
799 }
800
801 raw:
802 rip_input(m, hlen);
803 return;
804
805 freeit:
806 m_freem(m);
807 }
808
809 /*
810 * Reflect the ip packet back to the source
811 */
812 static void
icmp_reflect(struct mbuf * m)813 icmp_reflect(struct mbuf *m)
814 {
815 struct ip *ip = mtod(m, struct ip *);
816 struct sockaddr_in icmpdst;
817 struct in_ifaddr *ia;
818 struct in_addr t;
819 struct mbuf *opts = NULL;
820 int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
821
822 if (!in_canforward(ip->ip_src) &&
823 ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
824 (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
825 m_freem(m); /* Bad return address */
826 goto done; /* Ip_output() will check for broadcast */
827 }
828 t = ip->ip_dst;
829 ip->ip_dst = ip->ip_src;
830 /*
831 * If the incoming packet was addressed directly to us,
832 * use dst as the src for the reply. Otherwise (broadcast
833 * or anonymous), use the address which corresponds
834 * to the incoming interface.
835 */
836 lck_rw_lock_shared(&in_ifaddr_rwlock);
837 TAILQ_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) {
838 IFA_LOCK(&ia->ia_ifa);
839 if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) {
840 IFA_ADDREF_LOCKED(&ia->ia_ifa);
841 IFA_UNLOCK(&ia->ia_ifa);
842 goto match;
843 }
844 IFA_UNLOCK(&ia->ia_ifa);
845 }
846 /*
847 * Slow path; check for broadcast addresses. Find a source
848 * IP address to use when replying to the broadcast request;
849 * let IP handle the source interface selection work.
850 */
851 for (ia = in_ifaddrhead.tqh_first; ia; ia = ia->ia_link.tqe_next) {
852 IFA_LOCK(&ia->ia_ifa);
853 if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) &&
854 t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) {
855 IFA_ADDREF_LOCKED(&ia->ia_ifa);
856 IFA_UNLOCK(&ia->ia_ifa);
857 break;
858 }
859 IFA_UNLOCK(&ia->ia_ifa);
860 }
861 match:
862 lck_rw_done(&in_ifaddr_rwlock);
863
864 /* Initialize */
865 bzero(&icmpdst, sizeof(icmpdst));
866 icmpdst.sin_len = sizeof(struct sockaddr_in);
867 icmpdst.sin_family = AF_INET;
868 icmpdst.sin_addr = t;
869 if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif) {
870 ia = (struct in_ifaddr *)ifaof_ifpforaddr(
871 (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
872 }
873 /*
874 * The following happens if the packet was not addressed to us,
875 * and was received on an interface with no IP address.
876 */
877 if (ia == (struct in_ifaddr *)0) {
878 lck_rw_lock_shared(&in_ifaddr_rwlock);
879 ia = in_ifaddrhead.tqh_first;
880 if (ia == (struct in_ifaddr *)0) {/* no address yet, bail out */
881 lck_rw_done(&in_ifaddr_rwlock);
882 m_freem(m);
883 goto done;
884 }
885 IFA_ADDREF(&ia->ia_ifa);
886 lck_rw_done(&in_ifaddr_rwlock);
887 }
888 IFA_LOCK_SPIN(&ia->ia_ifa);
889 t = IA_SIN(ia)->sin_addr;
890 IFA_UNLOCK(&ia->ia_ifa);
891 ip->ip_src = t;
892 ip->ip_ttl = (u_char)ip_defttl;
893 IFA_REMREF(&ia->ia_ifa);
894 ia = NULL;
895
896 if (optlen > 0) {
897 u_char *cp;
898 int opt, cnt;
899 u_int len;
900
901 /*
902 * Retrieve any source routing from the incoming packet;
903 * add on any record-route or timestamp options.
904 */
905 cp = (u_char *) (ip + 1);
906 if ((opts = ip_srcroute()) == 0 &&
907 (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */
908 opts->m_len = sizeof(struct in_addr);
909 mtod(opts, struct in_addr *)->s_addr = 0;
910 }
911 if (opts) {
912 #if (DEBUG | DEVELOPMENT)
913 if (icmpprintfs > 1) {
914 printf("icmp_reflect optlen %d rt %d => ",
915 optlen, opts->m_len);
916 }
917 #endif
918 for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
919 opt = cp[IPOPT_OPTVAL];
920 if (opt == IPOPT_EOL) {
921 break;
922 }
923 if (opt == IPOPT_NOP) {
924 len = 1;
925 } else {
926 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
927 break;
928 }
929 len = cp[IPOPT_OLEN];
930 if (len < IPOPT_OLEN + sizeof(*cp) ||
931 len > cnt) {
932 break;
933 }
934 }
935 /*
936 * Should check for overflow, but it "can't happen"
937 */
938 if (opt == IPOPT_RR || opt == IPOPT_TS ||
939 opt == IPOPT_SECURITY) {
940 bcopy((caddr_t)cp,
941 mtod(opts, caddr_t) + opts->m_len, len);
942 opts->m_len += len;
943 }
944 }
945 /* Terminate & pad, if necessary */
946 cnt = opts->m_len % 4;
947 if (cnt) {
948 for (; cnt < 4; cnt++) {
949 *(mtod(opts, caddr_t) + opts->m_len) =
950 IPOPT_EOL;
951 opts->m_len++;
952 }
953 }
954 #if (DEBUG | DEVELOPMENT)
955 if (icmpprintfs > 1) {
956 printf("%d\n", opts->m_len);
957 }
958 #endif
959 }
960 /*
961 * Now strip out original options by copying rest of first
962 * mbuf's data back, and adjust the IP length.
963 */
964 ip->ip_len -= optlen;
965 ip->ip_vhl = IP_VHL_BORING;
966 m->m_len -= optlen;
967 if (m->m_flags & M_PKTHDR) {
968 m->m_pkthdr.len -= optlen;
969 }
970 optlen += sizeof(struct ip);
971 bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
972 (unsigned)(m->m_len - sizeof(struct ip)));
973 }
974 m->m_flags &= ~(M_BCAST | M_MCAST);
975 icmp_send(m, opts);
976 done:
977 if (opts) {
978 (void)m_free(opts);
979 }
980 }
981
982 /*
983 * Send an icmp packet back to the ip level,
984 * after supplying a checksum.
985 */
986 static void
icmp_send(struct mbuf * m,struct mbuf * opts)987 icmp_send(struct mbuf *m, struct mbuf *opts)
988 {
989 struct ip *ip = mtod(m, struct ip *);
990 int hlen;
991 struct icmp *icp;
992 struct route ro;
993 struct ip_out_args ipoa;
994
995 bzero(&ipoa, sizeof(ipoa));
996 ipoa.ipoa_boundif = IFSCOPE_NONE;
997 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF | IPOAF_BOUND_SRCADDR;
998 ipoa.ipoa_sotc = SO_TC_UNSPEC;
999 ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1000
1001 if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
1002 ipoa.ipoa_boundif = m->m_pkthdr.rcvif->if_index;
1003 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
1004 }
1005
1006 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1007 m->m_data += hlen;
1008 m->m_len -= hlen;
1009 icp = mtod(m, struct icmp *);
1010 icp->icmp_cksum = 0;
1011 icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
1012 m->m_data -= hlen;
1013 m->m_len += hlen;
1014 m->m_pkthdr.rcvif = NULL;
1015 m->m_pkthdr.csum_data = 0;
1016 m->m_pkthdr.csum_flags = 0;
1017 #if (DEBUG | DEVELOPMENT)
1018 if (icmpprintfs > 2) {
1019 char src_str[MAX_IPv4_STR_LEN];
1020 char dst_str[MAX_IPv4_STR_LEN];
1021
1022 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
1023 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
1024 printf("%s: dst %s src %s\n", __func__, dst_str, src_str);
1025 }
1026 #endif
1027 bzero(&ro, sizeof ro);
1028 (void) ip_output(m, opts, &ro, IP_OUTARGS, NULL, &ipoa);
1029 ROUTE_RELEASE(&ro);
1030 }
1031
1032 u_int32_t
iptime(void)1033 iptime(void)
1034 {
1035 struct timeval atv;
1036 u_int32_t t;
1037
1038 getmicrotime(&atv);
1039 t = (atv.tv_sec % (24 * 60 * 60)) * 1000 + atv.tv_usec / 1000;
1040 return htonl(t);
1041 }
1042
1043 #if 1
1044 /*
1045 * Return the next larger or smaller MTU plateau (table from RFC 1191)
1046 * given current value MTU. If DIR is less than zero, a larger plateau
1047 * is returned; otherwise, a smaller value is returned.
1048 */
1049 int
ip_next_mtu(int mtu,int dir)1050 ip_next_mtu(int mtu, int dir)
1051 {
1052 static int mtutab[] = {
1053 65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
1054 68, 0
1055 };
1056 int i;
1057
1058 for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
1059 if (mtu >= mtutab[i]) {
1060 break;
1061 }
1062 }
1063
1064 if (dir < 0) {
1065 if (i == 0) {
1066 return 0;
1067 } else {
1068 return mtutab[i - 1];
1069 }
1070 } else {
1071 if (mtutab[i] == 0) {
1072 return 0;
1073 } else if (mtu > mtutab[i]) {
1074 return mtutab[i];
1075 } else {
1076 return mtutab[i + 1];
1077 }
1078 }
1079 }
1080 #endif
1081
1082 #if ICMP_BANDLIM
1083
1084 /*
1085 * badport_bandlim() - check for ICMP bandwidth limit
1086 * Returns false when it is ok to send ICMP error and true to limit sending
1087 * of ICMP error.
1088 *
1089 * For now we separate the TCP and UDP subsystems w/ different 'which'
1090 * values. We may eventually remove this separation (and simplify the
1091 * code further).
1092 *
1093 * Note that the printing of the error message is delayed so we can
1094 * properly print the icmp error rate that the system was trying to do
1095 * (i.e. 22000/100 pps, etc...). This can cause long delays in printing
1096 * the 'final' error, but it doesn't make sense to solve the printing
1097 * delay with more complex code.
1098 */
1099
1100 boolean_t
badport_bandlim(int which)1101 badport_bandlim(int which)
1102 {
1103 static uint64_t lticks[BANDLIM_MAX + 1];
1104 static int lpackets[BANDLIM_MAX + 1];
1105 uint64_t time;
1106 uint64_t secs;
1107 static boolean_t is_initialized = FALSE;
1108 static int icmplim_random;
1109 const char *bandlimittype[] = {
1110 "Limiting icmp unreach response",
1111 "Limiting icmp ping response",
1112 "Limiting icmp tstamp response",
1113 "Limiting closed port RST response",
1114 "Limiting open port RST response"
1115 };
1116
1117 /* Return ok status if feature disabled or argument out of range. */
1118
1119 if (icmplim <= 0 || which > BANDLIM_MAX || which < 0) {
1120 return false;
1121 }
1122
1123 if (is_initialized == FALSE) {
1124 if (icmplim_random_incr > 0 &&
1125 icmplim <= INT32_MAX - (icmplim_random_incr + 1)) {
1126 icmplim_random = icmplim + (random() % icmplim_random_incr) + 1;
1127 }
1128 is_initialized = TRUE;
1129 }
1130
1131 time = net_uptime();
1132 secs = time - lticks[which];
1133
1134 /*
1135 * reset stats when cumulative delta exceeds one second.
1136 */
1137
1138 if (secs > 1) {
1139 if (lpackets[which] > icmplim_random) {
1140 printf("%s from %d to %d packets per second\n",
1141 bandlimittype[which],
1142 lpackets[which],
1143 icmplim_random
1144 );
1145 }
1146 lticks[which] = time;
1147 lpackets[which] = 0;
1148 }
1149
1150 /*
1151 * bump packet count
1152 */
1153 if (++lpackets[which] > icmplim_random) {
1154 /*
1155 * After hitting the randomized limit, we further randomize the
1156 * behavior of how we apply rate limitation.
1157 * We rate limit based on probability that increases with the
1158 * increase in lpackets[which] count.
1159 */
1160 if ((random() % (lpackets[which] - icmplim_random)) != 0) {
1161 return true;
1162 }
1163 }
1164 return false;
1165 }
1166
1167 #endif
1168
1169 #if __APPLE__
1170
1171 /*
1172 * Non-privileged ICMP socket operations
1173 * - send ICMP echo request
1174 * - all ICMP
1175 * - limited socket options
1176 */
1177
1178 #include <netinet/ip_icmp.h>
1179 #include <netinet/in_pcb.h>
1180
1181 extern u_int32_t rip_sendspace;
1182 extern u_int32_t rip_recvspace;
1183 extern struct inpcbinfo ripcbinfo;
1184
1185 int rip_abort(struct socket *);
1186 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
1187 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
1188 int rip_detach(struct socket *);
1189 int rip_disconnect(struct socket *);
1190 int rip_shutdown(struct socket *);
1191
1192 __private_extern__ int icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, struct mbuf *control, struct proc *p);
1193 __private_extern__ int icmp_dgram_attach(struct socket *so, int proto, struct proc *p);
1194 __private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt);
1195
1196 __private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = {
1197 .pru_abort = rip_abort,
1198 .pru_attach = icmp_dgram_attach,
1199 .pru_bind = rip_bind,
1200 .pru_connect = rip_connect,
1201 .pru_control = in_control,
1202 .pru_detach = rip_detach,
1203 .pru_disconnect = rip_disconnect,
1204 .pru_peeraddr = in_getpeeraddr,
1205 .pru_send = icmp_dgram_send,
1206 .pru_shutdown = rip_shutdown,
1207 .pru_sockaddr = in_getsockaddr,
1208 .pru_sosend = sosend,
1209 .pru_soreceive = soreceive,
1210 };
1211
1212 /* Like rip_attach but without root privilege enforcement */
1213 __private_extern__ int
icmp_dgram_attach(struct socket * so,__unused int proto,struct proc * p)1214 icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
1215 {
1216 struct inpcb *inp;
1217 int error;
1218
1219 inp = sotoinpcb(so);
1220 if (inp) {
1221 panic("icmp_dgram_attach");
1222 }
1223
1224 error = soreserve(so, rip_sendspace, rip_recvspace);
1225 if (error) {
1226 return error;
1227 }
1228 error = in_pcballoc(so, &ripcbinfo, p);
1229 if (error) {
1230 return error;
1231 }
1232 inp = (struct inpcb *)so->so_pcb;
1233 inp->inp_vflag |= INP_IPV4;
1234 inp->inp_ip_p = IPPROTO_ICMP;
1235 inp->inp_ip_ttl = (u_char)ip_defttl;
1236 return 0;
1237 }
1238
1239 /*
1240 * Raw IP socket option processing.
1241 */
1242 __private_extern__ int
icmp_dgram_ctloutput(struct socket * so,struct sockopt * sopt)1243 icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
1244 {
1245 int error;
1246
1247 if (sopt->sopt_level != IPPROTO_IP) {
1248 return EINVAL;
1249 }
1250
1251 switch (sopt->sopt_name) {
1252 case IP_OPTIONS:
1253 case IP_HDRINCL:
1254 case IP_TOS:
1255 case IP_TTL:
1256 case IP_RECVOPTS:
1257 case IP_RECVRETOPTS:
1258 case IP_RECVDSTADDR:
1259 case IP_RETOPTS:
1260 case IP_MULTICAST_IF:
1261 case IP_MULTICAST_IFINDEX:
1262 case IP_MULTICAST_TTL:
1263 case IP_MULTICAST_LOOP:
1264 case IP_ADD_MEMBERSHIP:
1265 case IP_DROP_MEMBERSHIP:
1266 case IP_MULTICAST_VIF:
1267 case IP_PORTRANGE:
1268 case IP_RECVIF:
1269 case IP_IPSEC_POLICY:
1270 case IP_STRIPHDR:
1271 case IP_RECVTTL:
1272 case IP_BOUND_IF:
1273 case IP_DONTFRAG:
1274 case IP_NO_IFT_CELLULAR:
1275 error = rip_ctloutput(so, sopt);
1276 break;
1277
1278 default:
1279 error = EINVAL;
1280 break;
1281 }
1282
1283 return error;
1284 }
1285
1286 __private_extern__ int
icmp_dgram_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1287 icmp_dgram_send(struct socket *so, int flags, struct mbuf *m,
1288 struct sockaddr *nam, struct mbuf *control, struct proc *p)
1289 {
1290 struct ip *ip;
1291 struct inpcb *inp = sotoinpcb(so);
1292 int hlen;
1293 struct icmp *icp;
1294 struct in_ifaddr *ia = NULL;
1295 int icmplen;
1296 int error = EINVAL;
1297 int inp_flags = inp ? inp->inp_flags : 0;
1298
1299 if (inp == NULL
1300 #if NECP
1301 || (necp_socket_should_use_flow_divert(inp))
1302 #endif /* NECP */
1303 ) {
1304 if (inp != NULL) {
1305 error = EPROTOTYPE;
1306 }
1307 goto bad;
1308 }
1309
1310 #if CONTENT_FILTER
1311 /*
1312 * If socket is subject to Content Filter, get inp_flags from saved state
1313 */
1314 if (CFIL_DGRAM_FILTERED(so) && nam == NULL) {
1315 cfil_dgram_peek_socket_state(m, &inp_flags);
1316 }
1317 #endif
1318
1319 if ((inp_flags & INP_HDRINCL) != 0) {
1320 /* Expect 32-bit aligned data ptr on strict-align platforms */
1321 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
1322 /*
1323 * This is not raw IP, we liberal only for fields TOS,
1324 * id and TTL.
1325 */
1326 ip = mtod(m, struct ip *);
1327
1328 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1329 /* Some sanity checks */
1330 if (m->m_pkthdr.len < hlen + ICMP_MINLEN) {
1331 goto bad;
1332 }
1333 /* Only IPv4 */
1334 if (IP_VHL_V(ip->ip_vhl) != 4) {
1335 goto bad;
1336 }
1337 if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len) {
1338 goto bad;
1339 }
1340 /* Bogus fragments can tie up peer resources */
1341 if ((ip->ip_off & ~IP_DF) != 0) {
1342 goto bad;
1343 }
1344 /* Allow only ICMP even for user provided IP header */
1345 if (ip->ip_p != IPPROTO_ICMP) {
1346 goto bad;
1347 }
1348 /*
1349 * To prevent spoofing, specified source address must
1350 * be one of ours.
1351 */
1352 if (ip->ip_src.s_addr != INADDR_ANY) {
1353 socket_unlock(so, 0);
1354 lck_rw_lock_shared(&in_ifaddr_rwlock);
1355 if (TAILQ_EMPTY(&in_ifaddrhead)) {
1356 lck_rw_done(&in_ifaddr_rwlock);
1357 socket_lock(so, 0);
1358 goto bad;
1359 }
1360 TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr),
1361 ia_hash) {
1362 IFA_LOCK(&ia->ia_ifa);
1363 if (IA_SIN(ia)->sin_addr.s_addr ==
1364 ip->ip_src.s_addr) {
1365 IFA_UNLOCK(&ia->ia_ifa);
1366 lck_rw_done(&in_ifaddr_rwlock);
1367 socket_lock(so, 0);
1368 goto ours;
1369 }
1370 IFA_UNLOCK(&ia->ia_ifa);
1371 }
1372 lck_rw_done(&in_ifaddr_rwlock);
1373 socket_lock(so, 0);
1374 goto bad;
1375 }
1376 ours:
1377 /* Do not trust we got a valid checksum */
1378 ip->ip_sum = 0;
1379
1380 icp = (struct icmp *)(void *)(((char *)m->m_data) + hlen);
1381 icmplen = m->m_pkthdr.len - hlen;
1382 } else {
1383 if ((icmplen = m->m_pkthdr.len) < ICMP_MINLEN) {
1384 goto bad;
1385 }
1386 icp = mtod(m, struct icmp *);
1387 }
1388 /*
1389 * Allow only to send request types with code 0
1390 */
1391 if (icp->icmp_code != 0) {
1392 goto bad;
1393 }
1394 switch (icp->icmp_type) {
1395 case ICMP_ECHO:
1396 break;
1397 case ICMP_TSTAMP:
1398 if (icmplen != 20) {
1399 goto bad;
1400 }
1401 break;
1402 case ICMP_MASKREQ:
1403 if (icmplen != 12) {
1404 goto bad;
1405 }
1406 break;
1407 default:
1408 goto bad;
1409 }
1410 return rip_send(so, flags, m, nam, control, p);
1411 bad:
1412 VERIFY(error != 0);
1413
1414 if (m != NULL) {
1415 m_freem(m);
1416 }
1417 if (control != NULL) {
1418 m_freem(control);
1419 }
1420
1421 return error;
1422 }
1423
1424 #endif /* __APPLE__ */
1425