1 /*
2 * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/mbuf.h>
72 #include <sys/mcache.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/time.h>
76 #include <sys/kernel.h>
77 #include <sys/sysctl.h>
78
79 #include <machine/endian.h>
80
81 #include <net/if.h>
82 #include <net/route.h>
83 #include <net/content_filter.h>
84
85 #define _IP_VHL
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/in_var.h>
89 #include <netinet/ip.h>
90 #include <netinet/ip_icmp.h>
91 #include <netinet/ip_var.h>
92 #include <netinet/icmp_var.h>
93 #include <netinet/tcp.h>
94 #include <netinet/tcp_fsm.h>
95 #include <netinet/tcp_seq.h>
96 #include <netinet/tcp_timer.h>
97 #include <netinet/tcp_var.h>
98 #include <netinet/tcpip.h>
99
100 #if IPSEC
101 #include <netinet6/ipsec.h>
102 #include <netkey/key.h>
103 #endif
104
105 #if NECP
106 #include <net/necp.h>
107 #endif /* NECP */
108
109 #include <net/sockaddr_utils.h>
110
111 /*
112 * ICMP routines: error generation, receive packet processing, and
113 * routines to turnaround packets back to the originator, and
114 * host table maintenance routines.
115 */
116
117 struct icmpstat icmpstat;
118 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats,
119 CTLFLAG_RD | CTLFLAG_LOCKED,
120 &icmpstat, icmpstat, "");
121
122 static int icmpmaskrepl = 0;
123 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl,
124 CTLFLAG_RW | CTLFLAG_LOCKED,
125 &icmpmaskrepl, 0, "");
126
127 static int icmptimestamp = 0;
128 SYSCTL_INT(_net_inet_icmp, ICMPCTL_TIMESTAMP, timestamp,
129 CTLFLAG_RW | CTLFLAG_LOCKED,
130 &icmptimestamp, 0, "");
131
132 static int drop_redirect = 1;
133 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect,
134 CTLFLAG_RW | CTLFLAG_LOCKED,
135 &drop_redirect, 0, "");
136
137 static int log_redirect = 0;
138 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect,
139 CTLFLAG_RW | CTLFLAG_LOCKED,
140 &log_redirect, 0, "");
141
142 const static int icmp_datalen = 8;
143 /*
144 * ICMP broadcast echo sysctl
145 */
146 static int icmpbmcastecho = 1;
147 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW | CTLFLAG_LOCKED,
148 &icmpbmcastecho, 0, "");
149
150 #if (DEBUG | DEVELOPMENT)
151 static int icmpprintfs = 0;
152 SYSCTL_INT(_net_inet_icmp, OID_AUTO, verbose, CTLFLAG_RW | CTLFLAG_LOCKED,
153 &icmpprintfs, 0, "");
154 #endif
155
156 static void icmp_reflect(struct mbuf *);
157 static void icmp_send(struct mbuf *, struct mbuf *);
158
159 /*
160 * Generate packet gencount for ICMP for a given error type
161 * and code.
162 * We do it this way to ensure we only dedup the packets that belong
163 * to the same type, which is usually what port scanning and other such
164 * attack vectors depend on.
165 */
166 static uint32_t
icmp_error_packet_gencount(int type,int code)167 icmp_error_packet_gencount(int type, int code)
168 {
169 return (PF_INET << 24) | (type << 16) | (code << 8);
170 }
171
172 static int suppress_icmp_port_unreach = 0;
173 SYSCTL_INT(_net_inet_icmp, OID_AUTO, suppress_icmp_port_unreach,
174 CTLFLAG_RW | CTLFLAG_LOCKED,
175 &suppress_icmp_port_unreach, 0,
176 "Suppress ICMP destination unreachable type with code port unreachable");
177
178 /*
179 * Generate an error packet of type error
180 * in response to bad packet ip.
181 */
182 void
icmp_error(struct mbuf * n,int type,int code,u_int32_t dest,u_int32_t nextmtu)183 icmp_error(
184 struct mbuf *n,
185 int type,
186 int code,
187 u_int32_t dest,
188 u_int32_t nextmtu)
189 {
190 struct ip *oip = NULL;
191 struct ip *nip = NULL;
192 struct icmp *icp = NULL;
193 struct mbuf *m = NULL;
194 u_int32_t oiphlen = 0;
195 u_int32_t icmplen = 0;
196 u_int32_t icmpelen = 0;
197 u_int32_t nlen = 0;
198
199 VERIFY((u_int)type <= ICMP_MAXTYPE);
200 VERIFY(code <= UINT8_MAX);
201
202 /* Expect 32-bit aligned data pointer on strict-align platforms */
203 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(n);
204
205 if (type != ICMP_REDIRECT) {
206 icmpstat.icps_error++;
207 }
208
209 if (suppress_icmp_port_unreach &&
210 type == ICMP_UNREACH && code == ICMP_UNREACH_PORT) {
211 goto freeit;
212 }
213 /*
214 * Don't send error:
215 * if not the first fragment of message
216 * if original packet was a multicast or broadcast packet
217 * if the old packet protocol was ICMP
218 * error message, only known informational types.
219 */
220 if (n->m_flags & (M_BCAST | M_MCAST)) {
221 goto freeit;
222 }
223
224 /*
225 * Drop if IP header plus ICMP_MINLEN bytes are not contiguous
226 * in first mbuf.
227 */
228 if (n->m_len < sizeof(struct ip) + ICMP_MINLEN) {
229 goto freeit;
230 }
231
232 oip = mtod(n, struct ip *);
233 oiphlen = IP_VHL_HL(oip->ip_vhl) << 2;
234 if (n->m_len < oiphlen + ICMP_MINLEN) {
235 goto freeit;
236 }
237
238 #if (DEBUG | DEVELOPMENT)
239 if (icmpprintfs > 1) {
240 printf("icmp_error(0x%llx, %x, %d)\n",
241 (uint64_t)VM_KERNEL_ADDRPERM(oip), type, code);
242 }
243 #endif
244
245 if (oip->ip_off & ~(IP_MF | IP_DF)) {
246 goto freeit;
247 }
248
249 if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
250 n->m_len >= oiphlen + ICMP_MINLEN) {
251 struct icmp oicp = {0};
252 memcpy(&oicp, mtodo(n, oiphlen), ICMP_MINLEN);
253 if (!ICMP_INFOTYPE(oicp.icmp_type)) {
254 icmpstat.icps_oldicmp++;
255 goto freeit;
256 }
257 }
258
259 /*
260 * Calculate the length to quote from original packet and prevent
261 * the ICMP mbuf from overflowing.
262 * Unfortunatly this is non-trivial since ip_forward()
263 * sends us truncated packets.
264 */
265 nlen = m_length(n);
266 if (oip->ip_p == IPPROTO_TCP) {
267 struct tcphdr *th = NULL;
268 u_int16_t tcphlen = 0;
269
270 /*
271 * If the packet got truncated and TCP header
272 * is not contained in the packet, send out
273 * standard reply with only IP header as payload
274 */
275 if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
276 n->m_next == NULL) {
277 goto stdreply;
278 }
279
280 /*
281 * Otherwise, pull up to get IP and TCP headers
282 * together
283 */
284 if (n->m_len < (oiphlen + sizeof(struct tcphdr)) &&
285 (n = m_pullup(n, (oiphlen + sizeof(struct tcphdr)))) == NULL) {
286 goto freeit;
287 }
288
289 /*
290 * Reinit pointers derived from mbuf data pointer
291 * as things might have moved around with m_pullup
292 */
293 oip = mtod(n, struct ip *);
294 th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
295
296 if (th != ((struct tcphdr *)P2ROUNDDOWN(th,
297 sizeof(u_int32_t))) ||
298 ((th->th_off << 2) > UINT16_MAX)) {
299 goto freeit;
300 }
301 tcphlen = (uint16_t)(th->th_off << 2);
302
303 /* Sanity checks */
304 if (tcphlen < sizeof(struct tcphdr)) {
305 goto freeit;
306 }
307 if (oip->ip_len < (oiphlen + tcphlen)) {
308 goto freeit;
309 }
310 if ((oiphlen + tcphlen) > n->m_len && n->m_next == NULL) {
311 goto stdreply;
312 }
313 if (n->m_len < (oiphlen + tcphlen) &&
314 (n = m_pullup(n, (oiphlen + tcphlen))) == NULL) {
315 goto freeit;
316 }
317
318 /*
319 * Reinit pointers derived from mbuf data pointer
320 * as things might have moved around with m_pullup
321 */
322 oip = mtod(n, struct ip *);
323 th = (struct tcphdr *)(void *)((caddr_t)oip + oiphlen);
324
325 icmpelen = max(tcphlen, min(icmp_datalen,
326 (oip->ip_len - oiphlen)));
327 } else {
328 stdreply: icmpelen = max(ICMP_MINLEN, min(icmp_datalen,
329 (oip->ip_len - oiphlen)));
330 }
331
332 icmplen = min(oiphlen + icmpelen, nlen);
333 if (icmplen < sizeof(struct ip)) {
334 goto freeit;
335 }
336
337 /*
338 * First, formulate icmp message
339 * Allocate enough space for the IP header, ICMP header
340 * and the payload (part of the original message to be sent back).
341 */
342 if (MHLEN > (sizeof(struct ip) + ICMP_MINLEN + icmplen)) {
343 m = m_gethdr(M_DONTWAIT, MT_HEADER); /* MAC-OK */
344 } else {
345 m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
346 }
347
348 if (m == NULL) {
349 goto freeit;
350 }
351
352 /*
353 * Further refine the payload length to the space
354 * remaining in mbuf after including the IP header and ICMP
355 * header.
356 */
357 icmplen = min(icmplen, (u_int)M_TRAILINGSPACE(m) -
358 (u_int)(sizeof(struct ip) - ICMP_MINLEN));
359 m_align(m, ICMP_MINLEN + icmplen);
360 m->m_len = ICMP_MINLEN + icmplen; /* for ICMP header and data */
361
362 icp = mtod(m, struct icmp *);
363 icmpstat.icps_outhist[type]++;
364 icp->icmp_type = (u_char)type;
365 if (type == ICMP_REDIRECT) {
366 icp->icmp_gwaddr.s_addr = dest;
367 } else {
368 icp->icmp_void = 0;
369 /*
370 * The following assignments assume an overlay with the
371 * zeroed icmp_void field.
372 */
373 if (type == ICMP_PARAMPROB) {
374 icp->icmp_pptr = (u_char)code;
375 code = 0;
376 } else if (type == ICMP_UNREACH &&
377 code == ICMP_UNREACH_NEEDFRAG && nextmtu != 0) {
378 icp->icmp_nextmtu = htons((uint16_t)nextmtu);
379 }
380 }
381
382 icp->icmp_code = (u_char)code;
383
384 /*
385 * Copy icmplen worth of content from original
386 * mbuf (n) to the new packet after ICMP header.
387 */
388 m_copydata(n, 0, icmplen, mtod(m, caddr_t) + offsetof(struct icmp, icmp_ip));
389 nip = &icp->icmp_ip;
390
391 /*
392 * Convert fields to network representation.
393 */
394 #if BYTE_ORDER != BIG_ENDIAN
395 HTONS(nip->ip_len);
396 HTONS(nip->ip_off);
397 #endif
398 /*
399 * Set up ICMP message mbuf and copy old IP header (without options
400 * in front of ICMP message.
401 */
402 m->m_data -= sizeof(struct ip);
403 m->m_len += sizeof(struct ip);
404 m->m_pkthdr.len = m->m_len;
405 m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
406 /*
407 * To avoid some flavors of port scanning and other attacks,
408 * use packet suppression without using any other sort of
409 * rate limiting with static bounds.
410 * XXX Not setting PKTF_FLOW_ID here because we were concerned
411 * about it triggering regression elsewhere outside of network stack
412 * where there might be an assumption around flow ID being non-zero.
413 * It should be noted though that previously if PKTF_FLOW_ID was not
414 * set, PF would have generated flow hash irrespective of ICMPv4/v6
415 * type. That doesn't happen now and PF only computes hash for ICMP
416 * types that need state creation (which is not true of error types).
417 * It would have been a problem because we really want all the ICMP
418 * error type packets to share the same flow ID for global suppression.
419 */
420 m->m_pkthdr.comp_gencnt = icmp_error_packet_gencount(type, code);
421
422 nip = mtod(m, struct ip *);
423 bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
424 nip->ip_len = (uint16_t)m->m_len;
425 nip->ip_vhl = IP_VHL_BORING;
426 nip->ip_p = IPPROTO_ICMP;
427 nip->ip_tos = 0;
428 nip->ip_off = 0;
429 icmp_reflect(m);
430 freeit:
431 m_freem(n);
432 }
433
434 /*
435 * Process a received ICMP message.
436 */
437 void
icmp_input(struct mbuf * m,int hlen)438 icmp_input(struct mbuf *m, int hlen)
439 {
440 struct sockaddr_in icmpsrc, icmpdst, icmpgw;
441 struct icmp *icp;
442 struct ip *ip = mtod(m, struct ip *);
443 int icmplen;
444 int i;
445 struct in_ifaddr *ia;
446 void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
447 int code;
448 boolean_t should_log_redirect = false;
449
450 /* Expect 32-bit aligned data pointer on strict-align platforms */
451 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
452
453 icmplen = ip->ip_len;
454
455 /*
456 * Locate icmp structure in mbuf, and check
457 * that not corrupted and of at least minimum length.
458 */
459 #if (DEBUG | DEVELOPMENT)
460 if (icmpprintfs > 2) {
461 char src_str[MAX_IPv4_STR_LEN];
462 char dst_str[MAX_IPv4_STR_LEN];
463
464 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
465 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
466 printf("%s: from %s to %s, len %d\n",
467 __func__, src_str, dst_str, icmplen);
468 }
469 #endif
470 if (icmplen < ICMP_MINLEN) {
471 icmpstat.icps_tooshort++;
472 goto freeit;
473 }
474 i = hlen + min(icmplen, ICMP_ADVLENMIN);
475 if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
476 icmpstat.icps_tooshort++;
477 return;
478 }
479 /* Reset the pointers, since `m_pullup' might have moved `m'. `icp' is reset below. */
480 ip = mtod(m, struct ip *);
481
482 m->m_len -= hlen;
483 m->m_data += hlen;
484 // Forging because we might not have the full size of one struct icmp,
485 // but we have enough bytes to work with
486 icp = __unsafe_forge_single(struct icmp *, mtod(m, struct icmp *));
487 if (in_cksum(m, icmplen) != 0) {
488 icmpstat.icps_checksum++;
489 goto freeit;
490 }
491 m->m_len += hlen;
492 m->m_data -= hlen;
493
494 #if (DEBUG | DEVELOPMENT)
495 if (icmpprintfs > 2) {
496 printf("icmp_input, type %d code %d\n", icp->icmp_type,
497 icp->icmp_code);
498 }
499 #endif
500
501 /*
502 * Message type specific processing.
503 */
504 if (icp->icmp_type > ICMP_MAXTYPE) {
505 goto raw;
506 }
507
508 /* Initialize */
509 SOCKADDR_ZERO(&icmpsrc, sizeof(icmpsrc));
510 icmpsrc.sin_len = sizeof(struct sockaddr_in);
511 icmpsrc.sin_family = AF_INET;
512 SOCKADDR_ZERO(&icmpdst, sizeof(icmpdst));
513 icmpdst.sin_len = sizeof(struct sockaddr_in);
514 icmpdst.sin_family = AF_INET;
515 SOCKADDR_ZERO(&icmpgw, sizeof(icmpgw));
516 icmpgw.sin_len = sizeof(struct sockaddr_in);
517 icmpgw.sin_family = AF_INET;
518
519 icmpstat.icps_inhist[icp->icmp_type]++;
520 code = icp->icmp_code;
521 switch (icp->icmp_type) {
522 case ICMP_UNREACH:
523 switch (code) {
524 case ICMP_UNREACH_NET:
525 case ICMP_UNREACH_HOST:
526 case ICMP_UNREACH_SRCFAIL:
527 case ICMP_UNREACH_NET_UNKNOWN:
528 case ICMP_UNREACH_HOST_UNKNOWN:
529 case ICMP_UNREACH_ISOLATED:
530 case ICMP_UNREACH_TOSNET:
531 case ICMP_UNREACH_TOSHOST:
532 case ICMP_UNREACH_HOST_PRECEDENCE:
533 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
534 code = PRC_UNREACH_NET;
535 break;
536
537 case ICMP_UNREACH_NEEDFRAG:
538 code = PRC_MSGSIZE;
539 break;
540
541 /*
542 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
543 * Treat subcodes 2,3 as immediate RST
544 */
545 case ICMP_UNREACH_PROTOCOL:
546 case ICMP_UNREACH_PORT:
547 code = PRC_UNREACH_PORT;
548 break;
549
550 case ICMP_UNREACH_NET_PROHIB:
551 case ICMP_UNREACH_HOST_PROHIB:
552 case ICMP_UNREACH_FILTER_PROHIB:
553 code = PRC_UNREACH_ADMIN_PROHIB;
554 break;
555
556 default:
557 goto badcode;
558 }
559 goto deliver;
560
561 case ICMP_TIMXCEED:
562 if (code > 1) {
563 goto badcode;
564 }
565 code += PRC_TIMXCEED_INTRANS;
566 goto deliver;
567
568 case ICMP_PARAMPROB:
569 if (code > 1) {
570 goto badcode;
571 }
572 code = PRC_PARAMPROB;
573 goto deliver;
574
575 case ICMP_SOURCEQUENCH:
576 if (code) {
577 goto badcode;
578 }
579 code = PRC_QUENCH;
580 deliver:
581 /*
582 * Problem with datagram; advise higher level routines.
583 */
584 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp)
585 || IP_VHL_HL(icp->icmp_ip.ip_vhl) <
586 (sizeof(struct ip) >> 2) ||
587 (m = m_pullup(m, hlen + ICMP_ADVLEN(icp))) == NULL) {
588 icmpstat.icps_badlen++;
589 goto freeit;
590 }
591
592 /* Reset the pointers, since `m_pullup' might have moved `m'*/
593 ip = mtod(m, struct ip *);
594 icp = __unsafe_forge_single(struct icmp *, mtodo(m, hlen));
595
596 #if BYTE_ORDER != BIG_ENDIAN
597 NTOHS(icp->icmp_ip.ip_len);
598 #endif
599
600 /* Discard ICMP's in response to multicast packets */
601 if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr))) {
602 goto badcode;
603 }
604 #if (DEBUG | DEVELOPMENT)
605 if (icmpprintfs > 2) {
606 printf("deliver to protocol %d\n",
607 icp->icmp_ip.ip_p);
608 }
609 #endif
610 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
611
612 /*
613 * if the packet contains [IPv4 AH TCP], we can't make a
614 * notification to TCP layer.
615 */
616 ctlfunc = ip_protox[icp->icmp_ip.ip_p]->pr_ctlinput;
617
618 if (ctlfunc) {
619 struct ipctlparam ctl_param = {
620 .ipc_m = m,
621 .ipc_icmp = icp,
622 .ipc_icmp_ip = &icp->icmp_ip,
623 .ipc_off = hlen + offsetof(struct icmp, icmp_ip) + (IP_VHL_HL(icp->icmp_ip.ip_vhl) << 2)
624 };
625 LCK_MTX_ASSERT(inet_domain_mutex, LCK_MTX_ASSERT_OWNED);
626
627 lck_mtx_unlock(inet_domain_mutex);
628
629 (*ctlfunc)(code, SA(&icmpsrc),
630 (void *)&ctl_param, m->m_pkthdr.rcvif);
631
632 lck_mtx_lock(inet_domain_mutex);
633 }
634 break;
635
636 badcode:
637 icmpstat.icps_badcode++;
638 break;
639
640 case ICMP_ECHO:
641 if ((m->m_flags & (M_MCAST | M_BCAST))) {
642 if (icmpbmcastecho == 0) {
643 icmpstat.icps_bmcastecho++;
644 break;
645 }
646 }
647
648 /*
649 * rdar://18644769
650 * Do not reply when the destination is link local multicast or broadcast
651 * and the source is not from a directly connected subnet
652 */
653 if ((IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr)) ||
654 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) &&
655 in_localaddr(ip->ip_src) == 0) {
656 icmpstat.icps_bmcastecho++;
657 #if (DEBUG | DEVELOPMENT)
658 if (icmpprintfs > 0) {
659 char src_str[MAX_IPv4_STR_LEN];
660 char dst_str[MAX_IPv4_STR_LEN];
661
662 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
663 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
664 printf("%s: non local (B|M)CAST %s to %s, len %d\n",
665 __func__, src_str, dst_str, icmplen);
666 }
667 #endif
668 break;
669 }
670
671 icp->icmp_type = ICMP_ECHOREPLY;
672 goto reflect;
673
674 case ICMP_TSTAMP:
675 if (icmptimestamp == 0) {
676 break;
677 }
678
679 if (!icmpbmcastecho
680 && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
681 icmpstat.icps_bmcasttstamp++;
682 break;
683 }
684 if (icmplen < ICMP_TSLEN) {
685 icmpstat.icps_badlen++;
686 break;
687 }
688 icp->icmp_type = ICMP_TSTAMPREPLY;
689 icp->icmp_rtime = iptime();
690 icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
691 goto reflect;
692
693 case ICMP_MASKREQ:
694 if (icmpmaskrepl == 0) {
695 break;
696 }
697 /*
698 * We are not able to respond with all ones broadcast
699 * unless we receive it over a point-to-point interface.
700 */
701 if (icmplen < ICMP_MASKLEN) {
702 break;
703 }
704 switch (ip->ip_dst.s_addr) {
705 case INADDR_BROADCAST:
706 case INADDR_ANY:
707 icmpdst.sin_addr = ip->ip_src;
708 break;
709
710 default:
711 icmpdst.sin_addr = ip->ip_dst;
712 }
713 ia = ifatoia(ifaof_ifpforaddr(SA(&icmpdst),
714 m->m_pkthdr.rcvif));
715 if (ia == 0) {
716 break;
717 }
718 IFA_LOCK(&ia->ia_ifa);
719 if (ia->ia_ifp == 0) {
720 IFA_UNLOCK(&ia->ia_ifa);
721 ifa_remref(&ia->ia_ifa);
722 ia = NULL;
723 break;
724 }
725 icp->icmp_type = ICMP_MASKREPLY;
726 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
727 if (ip->ip_src.s_addr == 0) {
728 if (ia->ia_ifp->if_flags & IFF_BROADCAST) {
729 ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
730 } else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) {
731 ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
732 }
733 }
734 IFA_UNLOCK(&ia->ia_ifa);
735 ifa_remref(&ia->ia_ifa);
736 reflect:
737 ip->ip_len += hlen; /* since ip_input deducts this */
738 icmpstat.icps_reflect++;
739 icmpstat.icps_outhist[icp->icmp_type]++;
740 icmp_reflect(m);
741 return;
742
743 case ICMP_REDIRECT:
744 if (drop_redirect) {
745 break;
746 }
747 if (code > 3) {
748 goto badcode;
749 }
750 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
751 IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
752 icmpstat.icps_badlen++;
753 break;
754 }
755
756 #if (DEBUG | DEVELOPMENT)
757 should_log_redirect = log_redirect || (icmpprintfs > 0);
758 #else
759 should_log_redirect = log_redirect;
760 #endif
761 /*
762 * Short circuit routing redirects to force
763 * immediate change in the kernel's routing
764 * tables. The message is also handed to anyone
765 * listening on a raw socket (e.g. the routing
766 * daemon for use in updating its tables).
767 */
768 icmpgw.sin_addr = ip->ip_src;
769 icmpdst.sin_addr = icp->icmp_gwaddr;
770
771 if (should_log_redirect) {
772 char src_str[MAX_IPv4_STR_LEN];
773 char dst_str[MAX_IPv4_STR_LEN];
774 char gw_str[MAX_IPv4_STR_LEN];
775
776 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
777 inet_ntop(AF_INET, &icp->icmp_ip.ip_dst, dst_str, sizeof(dst_str));
778 inet_ntop(AF_INET, &icp->icmp_gwaddr, gw_str, sizeof(gw_str));
779 printf("%s: redirect dst %s to %s from %s\n", __func__,
780 dst_str, gw_str, src_str);
781 }
782 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
783 rtredirect(m->m_pkthdr.rcvif, SA(&icmpsrc),
784 SA(&icmpdst), NULL, RTF_GATEWAY | RTF_HOST,
785 SA(&icmpgw), NULL);
786 pfctlinput(PRC_REDIRECT_HOST, SA(&icmpsrc));
787 #if IPSEC
788 key_sa_routechange(SA(&icmpsrc));
789 #endif
790 break;
791
792 /*
793 * No kernel processing for the following;
794 * just fall through to send to raw listener.
795 */
796 case ICMP_ECHOREPLY:
797 case ICMP_ROUTERADVERT:
798 case ICMP_ROUTERSOLICIT:
799 case ICMP_TSTAMPREPLY:
800 case ICMP_IREQREPLY:
801 case ICMP_MASKREPLY:
802 default:
803 break;
804 }
805
806 raw:
807 rip_input(m, hlen);
808 return;
809
810 freeit:
811 m_freem(m);
812 }
813
814 /*
815 * Reflect the ip packet back to the source
816 */
817 static void
icmp_reflect(struct mbuf * m)818 icmp_reflect(struct mbuf *m)
819 {
820 struct ip *ip = mtod(m, struct ip *);
821 struct sockaddr_in icmpdst;
822 struct in_ifaddr *ia;
823 struct in_addr t;
824 struct mbuf *opts = NULL;
825 int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
826
827 if (!in_canforward(ip->ip_src) &&
828 ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
829 (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
830 m_freem(m); /* Bad return address */
831 goto done; /* Ip_output() will check for broadcast */
832 }
833 t = ip->ip_dst;
834 ip->ip_dst = ip->ip_src;
835 /*
836 * If the incoming packet was addressed directly to us,
837 * use dst as the src for the reply. Otherwise (broadcast
838 * or anonymous), use the address which corresponds
839 * to the incoming interface.
840 */
841 lck_rw_lock_shared(&in_ifaddr_rwlock);
842 TAILQ_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash) {
843 IFA_LOCK(&ia->ia_ifa);
844 if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr) {
845 ifa_addref(&ia->ia_ifa);
846 IFA_UNLOCK(&ia->ia_ifa);
847 goto match;
848 }
849 IFA_UNLOCK(&ia->ia_ifa);
850 }
851 /*
852 * Slow path; check for broadcast addresses. Find a source
853 * IP address to use when replying to the broadcast request;
854 * let IP handle the source interface selection work.
855 */
856 for (ia = in_ifaddrhead.tqh_first; ia; ia = ia->ia_link.tqe_next) {
857 IFA_LOCK(&ia->ia_ifa);
858 if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) &&
859 t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr) {
860 ifa_addref(&ia->ia_ifa);
861 IFA_UNLOCK(&ia->ia_ifa);
862 break;
863 }
864 IFA_UNLOCK(&ia->ia_ifa);
865 }
866 match:
867 lck_rw_done(&in_ifaddr_rwlock);
868
869 /* Initialize */
870 SOCKADDR_ZERO(&icmpdst, sizeof(icmpdst));
871 icmpdst.sin_len = sizeof(struct sockaddr_in);
872 icmpdst.sin_family = AF_INET;
873 icmpdst.sin_addr = t;
874 if ((ia == NULL) && m->m_pkthdr.rcvif) {
875 ia = ifatoia(ifaof_ifpforaddr(SA(&icmpdst),
876 m->m_pkthdr.rcvif));
877 }
878 /*
879 * The following happens if the packet was not addressed to us,
880 * and was received on an interface with no IP address.
881 */
882 if (ia == NULL) {
883 lck_rw_lock_shared(&in_ifaddr_rwlock);
884 ia = in_ifaddrhead.tqh_first;
885 if (ia == NULL) {/* no address yet, bail out */
886 lck_rw_done(&in_ifaddr_rwlock);
887 m_freem(m);
888 goto done;
889 }
890 ifa_addref(&ia->ia_ifa);
891 lck_rw_done(&in_ifaddr_rwlock);
892 }
893 IFA_LOCK_SPIN(&ia->ia_ifa);
894 t = IA_SIN(ia)->sin_addr;
895 IFA_UNLOCK(&ia->ia_ifa);
896 ip->ip_src = t;
897 ip->ip_ttl = (u_char)ip_defttl;
898 ifa_remref(&ia->ia_ifa);
899 ia = NULL;
900
901 if (optlen > 0) {
902 u_char *cp;
903 int opt, cnt;
904 u_int len;
905
906 /*
907 * Retrieve any source routing from the incoming packet;
908 * add on any record-route or timestamp options.
909 */
910 cp = (u_char *) (ip + 1);
911 if ((opts = ip_srcroute()) == 0 &&
912 (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) { /* MAC-OK */
913 opts->m_len = sizeof(struct in_addr);
914 mtod(opts, struct in_addr *)->s_addr = 0;
915 }
916 if (opts) {
917 #if (DEBUG | DEVELOPMENT)
918 if (icmpprintfs > 1) {
919 printf("icmp_reflect optlen %d rt %d => ",
920 optlen, opts->m_len);
921 }
922 #endif
923 for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
924 opt = cp[IPOPT_OPTVAL];
925 if (opt == IPOPT_EOL) {
926 break;
927 }
928 if (opt == IPOPT_NOP) {
929 len = 1;
930 } else {
931 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
932 break;
933 }
934 len = cp[IPOPT_OLEN];
935 if (len < IPOPT_OLEN + sizeof(*cp) ||
936 len > cnt) {
937 break;
938 }
939 }
940 /*
941 * Should check for overflow, but it "can't happen"
942 */
943 if (opt == IPOPT_RR || opt == IPOPT_TS ||
944 opt == IPOPT_SECURITY) {
945 bcopy((caddr_t)cp,
946 mtod(opts, caddr_t) + opts->m_len, len);
947 opts->m_len += len;
948 }
949 }
950 /* Terminate & pad, if necessary */
951 cnt = opts->m_len % 4;
952 if (cnt) {
953 for (; cnt < 4; cnt++) {
954 *(mtod(opts, caddr_t) + opts->m_len) =
955 IPOPT_EOL;
956 opts->m_len++;
957 }
958 }
959 #if (DEBUG | DEVELOPMENT)
960 if (icmpprintfs > 1) {
961 printf("%d\n", opts->m_len);
962 }
963 #endif
964 }
965 /*
966 * Now strip out original options by copying rest of first
967 * mbuf's data back, and adjust the IP length.
968 */
969 ip->ip_len -= optlen;
970 ip->ip_vhl = IP_VHL_BORING;
971 m->m_len -= optlen;
972 if (m->m_flags & M_PKTHDR) {
973 m->m_pkthdr.len -= optlen;
974 }
975 optlen += sizeof(struct ip);
976 bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
977 (unsigned)(m->m_len - sizeof(struct ip)));
978 }
979 m->m_flags &= ~(M_BCAST | M_MCAST);
980 icmp_send(m, opts);
981 done:
982 if (opts) {
983 (void)m_free(opts);
984 }
985 }
986
987 /*
988 * Send an icmp packet back to the ip level,
989 * after supplying a checksum.
990 */
991 static void
icmp_send(struct mbuf * m,struct mbuf * opts)992 icmp_send(struct mbuf *m, struct mbuf *opts)
993 {
994 struct ip *ip = mtod(m, struct ip *);
995 int hlen;
996 struct icmp *icp;
997 struct route ro;
998 struct ip_out_args ipoa;
999
1000 bzero(&ipoa, sizeof(ipoa));
1001 ipoa.ipoa_boundif = IFSCOPE_NONE;
1002 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF | IPOAF_BOUND_SRCADDR;
1003 ipoa.ipoa_sotc = SO_TC_UNSPEC;
1004 ipoa.ipoa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1005
1006 if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
1007 ipoa.ipoa_boundif = m->m_pkthdr.rcvif->if_index;
1008 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
1009 }
1010
1011 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1012 m->m_data += hlen;
1013 m->m_len -= hlen;
1014 icp = __unsafe_forge_single(struct icmp *, mtod(m, struct icmp *));
1015 icp->icmp_cksum = 0;
1016 icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
1017 m->m_data -= hlen;
1018 m->m_len += hlen;
1019 m->m_pkthdr.rcvif = NULL;
1020 m->m_pkthdr.csum_data = 0;
1021 m->m_pkthdr.csum_flags = 0;
1022 #if (DEBUG | DEVELOPMENT)
1023 if (icmpprintfs > 2) {
1024 char src_str[MAX_IPv4_STR_LEN];
1025 char dst_str[MAX_IPv4_STR_LEN];
1026
1027 inet_ntop(AF_INET, &ip->ip_src, src_str, sizeof(src_str));
1028 inet_ntop(AF_INET, &ip->ip_dst, dst_str, sizeof(dst_str));
1029 printf("%s: dst %s src %s\n", __func__, dst_str, src_str);
1030 }
1031 #endif
1032 bzero(&ro, sizeof ro);
1033 (void) ip_output(m, opts, &ro, IP_OUTARGS, NULL, &ipoa);
1034 ROUTE_RELEASE(&ro);
1035 }
1036
1037 u_int32_t
iptime(void)1038 iptime(void)
1039 {
1040 struct timeval atv;
1041 u_int32_t t;
1042
1043 getmicrotime(&atv);
1044 t = (atv.tv_sec % (24 * 60 * 60)) * 1000 + atv.tv_usec / 1000;
1045 return htonl(t);
1046 }
1047
1048 #if 1
1049 /*
1050 * Return the next larger or smaller MTU plateau (table from RFC 1191)
1051 * given current value MTU. If DIR is less than zero, a larger plateau
1052 * is returned; otherwise, a smaller value is returned.
1053 */
1054 int
ip_next_mtu(int mtu,int dir)1055 ip_next_mtu(int mtu, int dir)
1056 {
1057 static int mtutab[] = {
1058 65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
1059 68, 0
1060 };
1061 int i;
1062
1063 for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
1064 if (mtu >= mtutab[i]) {
1065 break;
1066 }
1067 }
1068
1069 if (dir < 0) {
1070 if (i == 0) {
1071 return 0;
1072 } else {
1073 return mtutab[i - 1];
1074 }
1075 } else {
1076 if (mtutab[i] == 0) {
1077 return 0;
1078 } else if (mtu > mtutab[i]) {
1079 return mtutab[i];
1080 } else {
1081 return mtutab[i + 1];
1082 }
1083 }
1084 }
1085 #endif
1086
1087 #if __APPLE__
1088
1089 /*
1090 * Non-privileged ICMP socket operations
1091 * - send ICMP echo request
1092 * - all ICMP
1093 * - limited socket options
1094 */
1095
1096 #include <netinet/ip_icmp.h>
1097 #include <netinet/in_pcb.h>
1098
1099 extern u_int32_t rip_sendspace;
1100 extern u_int32_t rip_recvspace;
1101 extern struct inpcbinfo ripcbinfo;
1102
1103 int rip_abort(struct socket *);
1104 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
1105 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
1106 int rip_detach(struct socket *);
1107 int rip_disconnect(struct socket *);
1108 int rip_shutdown(struct socket *);
1109
1110 __private_extern__ int icmp_dgram_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, struct mbuf *control, struct proc *p);
1111 __private_extern__ int icmp_dgram_attach(struct socket *so, int proto, struct proc *p);
1112 __private_extern__ int icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt);
1113
1114 __private_extern__ struct pr_usrreqs icmp_dgram_usrreqs = {
1115 .pru_abort = rip_abort,
1116 .pru_attach = icmp_dgram_attach,
1117 .pru_bind = rip_bind,
1118 .pru_connect = rip_connect,
1119 .pru_control = in_control,
1120 .pru_detach = rip_detach,
1121 .pru_disconnect = rip_disconnect,
1122 .pru_peeraddr = in_getpeeraddr,
1123 .pru_send = icmp_dgram_send,
1124 .pru_shutdown = rip_shutdown,
1125 .pru_sockaddr = in_getsockaddr,
1126 .pru_sosend = sosend,
1127 .pru_soreceive = soreceive,
1128 };
1129
1130 /* Like rip_attach but without root privilege enforcement */
1131 __private_extern__ int
icmp_dgram_attach(struct socket * so,__unused int proto,struct proc * p)1132 icmp_dgram_attach(struct socket *so, __unused int proto, struct proc *p)
1133 {
1134 struct inpcb *inp;
1135 int error;
1136
1137 inp = sotoinpcb(so);
1138 if (inp) {
1139 panic("icmp_dgram_attach");
1140 }
1141
1142 error = soreserve(so, rip_sendspace, rip_recvspace);
1143 if (error) {
1144 return error;
1145 }
1146 error = in_pcballoc(so, &ripcbinfo, p);
1147 if (error) {
1148 return error;
1149 }
1150 inp = (struct inpcb *)so->so_pcb;
1151 inp->inp_vflag |= INP_IPV4;
1152 inp->inp_ip_p = IPPROTO_ICMP;
1153 inp->inp_ip_ttl = (u_char)ip_defttl;
1154 return 0;
1155 }
1156
1157 /*
1158 * Raw IP socket option processing.
1159 */
1160 __private_extern__ int
icmp_dgram_ctloutput(struct socket * so,struct sockopt * sopt)1161 icmp_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
1162 {
1163 int error;
1164
1165 /* Allow <SOL_SOCKET,SO_BINDTODEVICE> at this level */
1166 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_BINDTODEVICE) {
1167 return rip_ctloutput(so, sopt);;
1168 }
1169
1170 if (sopt->sopt_level != IPPROTO_IP) {
1171 return EINVAL;
1172 }
1173
1174 switch (sopt->sopt_name) {
1175 case IP_OPTIONS:
1176 case IP_HDRINCL:
1177 case IP_TOS:
1178 case IP_TTL:
1179 case IP_RECVOPTS:
1180 case IP_RECVRETOPTS:
1181 case IP_RECVDSTADDR:
1182 case IP_RETOPTS:
1183 case IP_MULTICAST_IF:
1184 case IP_MULTICAST_IFINDEX:
1185 case IP_MULTICAST_TTL:
1186 case IP_MULTICAST_LOOP:
1187 case IP_ADD_MEMBERSHIP:
1188 case IP_DROP_MEMBERSHIP:
1189 case IP_MULTICAST_VIF:
1190 case IP_PORTRANGE:
1191 case IP_RECVIF:
1192 case IP_IPSEC_POLICY:
1193 case IP_STRIPHDR:
1194 case IP_RECVTTL:
1195 case IP_BOUND_IF:
1196 case IP_DONTFRAG:
1197 case IP_NO_IFT_CELLULAR:
1198 error = rip_ctloutput(so, sopt);
1199 break;
1200
1201 default:
1202 error = EINVAL;
1203 break;
1204 }
1205
1206 return error;
1207 }
1208
1209 __private_extern__ int
icmp_dgram_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1210 icmp_dgram_send(struct socket *so, int flags, struct mbuf *m,
1211 struct sockaddr *nam, struct mbuf *control, struct proc *p)
1212 {
1213 struct ip *ip;
1214 struct inpcb *inp = sotoinpcb(so);
1215 int hlen;
1216 struct icmp *icp;
1217 struct in_ifaddr *ia = NULL;
1218 int icmplen;
1219 int error = EINVAL;
1220 int inp_flags = inp ? inp->inp_flags : 0;
1221
1222 if (inp == NULL
1223 #if NECP
1224 || (necp_socket_should_use_flow_divert(inp))
1225 #endif /* NECP */
1226 ) {
1227 if (inp != NULL) {
1228 error = EPROTOTYPE;
1229 }
1230 goto bad;
1231 }
1232
1233 #if CONTENT_FILTER
1234 /*
1235 * If socket is subject to Content Filter, get inp_flags from saved state
1236 */
1237 if (CFIL_DGRAM_FILTERED(so) && nam == NULL) {
1238 cfil_dgram_peek_socket_state(m, &inp_flags);
1239 }
1240 #endif
1241
1242 if ((inp_flags & INP_HDRINCL) != 0) {
1243 /* Expect 32-bit aligned data ptr on strict-align platforms */
1244 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
1245
1246 if (m->m_pkthdr.len < sizeof(struct ip)) {
1247 goto bad;
1248 }
1249
1250 /*
1251 * This is not raw IP, we liberal only for fields TOS,
1252 * id and TTL.
1253 */
1254 ip = mtod(m, struct ip *);
1255
1256 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1257 /* Some sanity checks */
1258 if (m->m_pkthdr.len < hlen + ICMP_MINLEN) {
1259 goto bad;
1260 }
1261 /* Only IPv4 */
1262 if (IP_VHL_V(ip->ip_vhl) != 4) {
1263 goto bad;
1264 }
1265 if (hlen < 20 || hlen > 40 || ip->ip_len != m->m_pkthdr.len) {
1266 goto bad;
1267 }
1268 /* Bogus fragments can tie up peer resources */
1269 if ((ip->ip_off & ~IP_DF) != 0) {
1270 goto bad;
1271 }
1272 /* Allow only ICMP even for user provided IP header */
1273 if (ip->ip_p != IPPROTO_ICMP) {
1274 goto bad;
1275 }
1276 /*
1277 * To prevent spoofing, specified source address must
1278 * be one of ours.
1279 */
1280 if (ip->ip_src.s_addr != INADDR_ANY) {
1281 socket_unlock(so, 0);
1282 lck_rw_lock_shared(&in_ifaddr_rwlock);
1283 if (TAILQ_EMPTY(&in_ifaddrhead)) {
1284 lck_rw_done(&in_ifaddr_rwlock);
1285 socket_lock(so, 0);
1286 goto bad;
1287 }
1288 TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr),
1289 ia_hash) {
1290 IFA_LOCK(&ia->ia_ifa);
1291 if (IA_SIN(ia)->sin_addr.s_addr ==
1292 ip->ip_src.s_addr) {
1293 IFA_UNLOCK(&ia->ia_ifa);
1294 lck_rw_done(&in_ifaddr_rwlock);
1295 socket_lock(so, 0);
1296 goto ours;
1297 }
1298 IFA_UNLOCK(&ia->ia_ifa);
1299 }
1300 lck_rw_done(&in_ifaddr_rwlock);
1301 socket_lock(so, 0);
1302 goto bad;
1303 }
1304 ours:
1305 /* Do not trust we got a valid checksum */
1306 ip->ip_sum = 0;
1307
1308 icp = __unsafe_forge_single(struct icmp *, mtodo(m, hlen));
1309 icmplen = m->m_pkthdr.len - hlen;
1310 } else {
1311 if ((icmplen = m->m_pkthdr.len) < ICMP_MINLEN) {
1312 goto bad;
1313 }
1314 icp = __unsafe_forge_single(struct icmp *, mtod(m, struct icmp *));
1315 }
1316 /*
1317 * Allow only to send request types with code 0
1318 */
1319 if (icp->icmp_code != 0) {
1320 goto bad;
1321 }
1322 switch (icp->icmp_type) {
1323 case ICMP_ECHO:
1324 break;
1325 case ICMP_TSTAMP:
1326 if (icmplen != 20) {
1327 goto bad;
1328 }
1329 break;
1330 case ICMP_MASKREQ:
1331 if (icmplen != 12) {
1332 goto bad;
1333 }
1334 break;
1335 default:
1336 goto bad;
1337 }
1338 return rip_send(so, flags, m, nam, control, p);
1339 bad:
1340 VERIFY(error != 0);
1341
1342 if (m != NULL) {
1343 m_freem(m);
1344 }
1345 if (control != NULL) {
1346 m_freem(control);
1347 }
1348
1349 return error;
1350 }
1351
1352 #endif /* __APPLE__ */
1353