Context Navigation

source: rtems/cpukit/libnetworking/netinet/ip_icmp.c @ 4e8c729f

4.104.114.84.95

Last change on this file since 4e8c729f was 4e8c729f, checked in by Joel Sherrill <joel.sherrill@…>, on 05/20/05 at 18:56:42

2005-05-20 Eric Norum <norume@…>

PR 793/networking

libnetworking/netinet/ip_icmp.c: Malicious ICMP packet causes panic. Just ignore it.

Property mode set to 100644

File size: 18.4 KB

Rev	Line
[39e6e65a]	1	/*
	2	* Copyright (c) 1982, 1986, 1988, 1993
	3	* The Regents of the University of California. All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	* 4. Neither the name of the University nor the names of its contributors
	14	* may be used to endorse or promote products derived from this software
	15	* without specific prior written permission.
	16	*
	17	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
	18	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	19	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	20	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	21	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	22	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	23	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	24	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	25	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	26	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	27	* SUCH DAMAGE.
	28	*
	29	* @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
[e953e2df]	30	* $FreeBSD: src/sys/netinet/ip_icmp.c,v 1.98 2005/01/07 01:45:44 imp Exp $
	31	*/
	32
	33	/*
	34	* $Id$
[39e6e65a]	35	*/
	36
	37	#include <sys/param.h>
	38	#include <sys/systm.h>
	39	#include <sys/malloc.h>
	40	#include <sys/mbuf.h>
	41	#include <sys/protosw.h>
	42	#include <sys/socket.h>
	43	#include <sys/time.h>
	44	#include <sys/kernel.h>
	45	#include <sys/socket.h>
	46	#include <sys/sysctl.h>
	47
	48	#include <net/if.h>
	49	#include <net/route.h>
	50
	51	#define _IP_VHL
	52	#include <netinet/in.h>
	53	#include <netinet/in_systm.h>
	54	#include <netinet/in_var.h>
	55	#include <netinet/ip.h>
	56	#include <netinet/ip_icmp.h>
	57	#include <netinet/ip_var.h>
	58	#include <netinet/icmp_var.h>
	59
[e953e2df]	60	#ifdef IPSEC
	61	#include <netinet6/ipsec.h>
	62	#include <netkey/key.h>
	63	#endif
	64
	65	#ifdef FAST_IPSEC
	66	#include <netipsec/ipsec.h>
	67	#include <netipsec/key.h>
	68	#define IPSEC
	69	#endif
	70
	71	#include <machine/in_cksum.h>
	72
[39e6e65a]	73	/*
	74	* ICMP routines: error generation, receive packet processing, and
	75	* routines to turnaround packets back to the originator, and
	76	* host table maintenance routines.
	77	*/
	78
	79	struct icmpstat icmpstat;
	80	SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RD,
	81	&icmpstat, icmpstat, "");
	82
	83	static int icmpmaskrepl = 0;
	84	SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
	85	&icmpmaskrepl, 0, "");
	86
	87	static int icmpbmcastecho = 1;
	88	SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW, &icmpbmcastecho,
	89	0, "");
	90
[13e11f6]	91	/* #define ICMPPRINTFS 1 */
[39e6e65a]	92	#ifdef ICMPPRINTFS
	93	int icmpprintfs = 0;
	94	#endif
	95
[e953e2df]	96	static void icmp_reflect(struct mbuf *);
	97	static void icmp_send(struct mbuf , struct mbuf );
	98	static int ip_next_mtu(int, int);
[39e6e65a]	99
	100	extern struct protosw inetsw[];
	101
	102	/*
	103	* Generate an error packet of type error
	104	* in response to bad packet ip.
	105	*/
	106	void
	107	icmp_error(n, type, code, dest, destifp)
	108	struct mbuf *n;
	109	int type, code;
	110	n_long dest;
	111	struct ifnet *destifp;
	112	{
	113	register struct ip oip = mtod(n, struct ip ), *nip;
	114	register unsigned oiplen = IP_VHL_HL(oip->ip_vhl) << 2;
	115	register struct icmp *icp;
	116	register struct mbuf *m;
	117	unsigned icmplen;
	118
	119	#ifdef ICMPPRINTFS
	120	if (icmpprintfs)
	121	printf("icmp_error(%p, %x, %d)\n", oip, type, code);
	122	#endif
	123	if (type != ICMP_REDIRECT)
	124	icmpstat.icps_error++;
	125	/*
	126	* Don't send error if not the first fragment of message.
	127	* Don't error if the old packet protocol was ICMP
	128	* error message, only known informational types.
	129	*/
	130	if (oip->ip_off &~ (IP_MF\|IP_DF))
	131	goto freeit;
	132	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
	133	n->m_len >= oiplen + ICMP_MINLEN &&
	134	!ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
	135	icmpstat.icps_oldicmp++;
	136	goto freeit;
	137	}
	138	/* Don't send error in response to a multicast or broadcast packet */
	139	if (n->m_flags & (M_BCAST\|M_MCAST))
	140	goto freeit;
[4e8c729f]	141	/* Don't send error in response to malicious packet */
	142	icmplen = min(oiplen + 8, oip->ip_len);
	143	if (icmplen < sizeof(struct ip))
	144	goto freeit;
[39e6e65a]	145	/*
	146	* First, formulate icmp message
	147	*/
	148	m = m_gethdr(M_DONTWAIT, MT_HEADER);
	149	if (m == NULL)
	150	goto freeit;
[e953e2df]	151	#ifdef MAC
	152	mac_create_mbuf_netlayer(n, m);
	153	#endif
[39e6e65a]	154	m->m_len = icmplen + ICMP_MINLEN;
	155	MH_ALIGN(m, m->m_len);
	156	icp = mtod(m, struct icmp *);
	157	if ((u_int)type > ICMP_MAXTYPE)
	158	panic("icmp_error");
	159	icmpstat.icps_outhist[type]++;
	160	icp->icmp_type = type;
	161	if (type == ICMP_REDIRECT)
	162	icp->icmp_gwaddr.s_addr = dest;
	163	else {
	164	icp->icmp_void = 0;
	165	/*
	166	* The following assignments assume an overlay with the
	167	* zeroed icmp_void field.
	168	*/
	169	if (type == ICMP_PARAMPROB) {
	170	icp->icmp_pptr = code;
	171	code = 0;
	172	} else if (type == ICMP_UNREACH &&
	173	code == ICMP_UNREACH_NEEDFRAG && destifp) {
	174	icp->icmp_nextmtu = htons(destifp->if_mtu);
	175	}
	176	}
	177
	178	icp->icmp_code = code;
	179	bcopy((caddr_t)oip, (caddr_t)&icp->icmp_ip, icmplen);
	180	nip = &icp->icmp_ip;
	181	nip->ip_len = htons((u_short)(nip->ip_len + oiplen));
	182
	183	/*
	184	* Now, copy old ip header (without options)
	185	* in front of icmp message.
	186	*/
	187	if (m->m_data - sizeof(struct ip) < m->m_pktdat)
	188	panic("icmp len");
	189	m->m_data -= sizeof(struct ip);
	190	m->m_len += sizeof(struct ip);
	191	m->m_pkthdr.len = m->m_len;
	192	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
	193	nip = mtod(m, struct ip *);
	194	bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
	195	nip->ip_len = m->m_len;
	196	nip->ip_vhl = IP_VHL_BORING;
	197	nip->ip_p = IPPROTO_ICMP;
	198	nip->ip_tos = 0;
	199	icmp_reflect(m);
	200
	201	freeit:
	202	m_freem(n);
	203	}
	204
	205	static struct sockaddr_in icmpsrc = { sizeof (struct sockaddr_in), AF_INET };
	206	static struct sockaddr_in icmpdst = { sizeof (struct sockaddr_in), AF_INET };
	207	static struct sockaddr_in icmpgw = { sizeof (struct sockaddr_in), AF_INET };
	208
	209	/*
	210	* Process a received ICMP message.
	211	*/
	212	void
[e953e2df]	213	icmp_input(m, off)
	214	struct mbuf *m;
	215	int off;
[39e6e65a]	216	{
[e953e2df]	217	struct icmp *icp;
[39e6e65a]	218	struct in_ifaddr *ia;
[e953e2df]	219	struct ip ip = mtod(m, struct ip );
	220	int hlen = off;
	221	int icmplen = ip->ip_len;
	222	int i, code;
	223	void (ctlfunc)(int, struct sockaddr , void *);
[39e6e65a]	224
	225	/*
	226	* Locate icmp structure in mbuf, and check
	227	* that not corrupted and of at least minimum length.
	228	*/
	229	#ifdef ICMPPRINTFS
	230	if (icmpprintfs) {
	231	char buf[4 * sizeof "123"];
	232	strcpy(buf, inet_ntoa(ip->ip_src));
	233	printf("icmp_input from %s to %s, len %d\n",
	234	buf, inet_ntoa(ip->ip_dst), icmplen);
	235	}
	236	#endif
	237	if (icmplen < ICMP_MINLEN) {
	238	icmpstat.icps_tooshort++;
	239	goto freeit;
	240	}
	241	i = hlen + min(icmplen, ICMP_ADVLENMIN);
	242	if (m->m_len < i && (m = m_pullup(m, i)) == 0) {
	243	icmpstat.icps_tooshort++;
	244	return;
	245	}
	246	ip = mtod(m, struct ip *);
	247	m->m_len -= hlen;
	248	m->m_data += hlen;
	249	icp = mtod(m, struct icmp *);
	250	if (in_cksum(m, icmplen)) {
	251	icmpstat.icps_checksum++;
	252	goto freeit;
	253	}
	254	m->m_len += hlen;
	255	m->m_data -= hlen;
	256
	257	#ifdef ICMPPRINTFS
	258	if (icmpprintfs)
	259	printf("icmp_input, type %d code %d\n", icp->icmp_type,
	260	icp->icmp_code);
	261	#endif
	262
	263	/*
	264	* Message type specific processing.
	265	*/
	266	if (icp->icmp_type > ICMP_MAXTYPE)
	267	goto raw;
	268	icmpstat.icps_inhist[icp->icmp_type]++;
	269	code = icp->icmp_code;
	270	switch (icp->icmp_type) {
	271
	272	case ICMP_UNREACH:
	273	switch (code) {
	274	case ICMP_UNREACH_NET:
	275	case ICMP_UNREACH_HOST:
	276	case ICMP_UNREACH_PROTOCOL:
	277	case ICMP_UNREACH_PORT:
	278	case ICMP_UNREACH_SRCFAIL:
[e953e2df]	279	code = PRC_UNREACH_NET;
[39e6e65a]	280	break;
	281
	282	case ICMP_UNREACH_NEEDFRAG:
	283	code = PRC_MSGSIZE;
	284	break;
	285
	286	case ICMP_UNREACH_NET_UNKNOWN:
	287	case ICMP_UNREACH_NET_PROHIB:
	288	case ICMP_UNREACH_TOSNET:
	289	code = PRC_UNREACH_NET;
	290	break;
	291
	292	case ICMP_UNREACH_HOST_UNKNOWN:
	293	case ICMP_UNREACH_ISOLATED:
	294	case ICMP_UNREACH_HOST_PROHIB:
	295	case ICMP_UNREACH_TOSHOST:
	296	code = PRC_UNREACH_HOST;
	297	break;
	298
	299	case ICMP_UNREACH_FILTER_PROHIB:
	300	case ICMP_UNREACH_HOST_PRECEDENCE:
	301	case ICMP_UNREACH_PRECEDENCE_CUTOFF:
	302	code = PRC_UNREACH_PORT;
	303	break;
	304
	305	default:
	306	goto badcode;
	307	}
	308	goto deliver;
	309
	310	case ICMP_TIMXCEED:
	311	if (code > 1)
	312	goto badcode;
	313	code += PRC_TIMXCEED_INTRANS;
	314	goto deliver;
	315
	316	case ICMP_PARAMPROB:
	317	if (code > 1)
	318	goto badcode;
	319	code = PRC_PARAMPROB;
	320	goto deliver;
	321
	322	case ICMP_SOURCEQUENCH:
	323	if (code)
	324	goto badcode;
	325	code = PRC_QUENCH;
	326	deliver:
	327	/*
	328	* Problem with datagram; advise higher level routines.
	329	*/
	330	if (icmplen < ICMP_ADVLENMIN \|\| icmplen < ICMP_ADVLEN(icp) \|\|
	331	IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
	332	icmpstat.icps_badlen++;
	333	goto freeit;
	334	}
	335	NTOHS(icp->icmp_ip.ip_len);
	336	/* Discard ICMP's in response to multicast packets */
	337	if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
	338	goto badcode;
	339	#ifdef ICMPPRINTFS
	340	if (icmpprintfs)
	341	printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
	342	#endif
	343	icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
	344	#if 1
	345	/*
	346	* MTU discovery:
	347	* If we got a needfrag and there is a host route to the
	348	* original destination, and the MTU is not locked, then
	349	* set the MTU in the route to the suggested new value
	350	* (if given) and then notify as usual. The ULPs will
	351	* notice that the MTU has changed and adapt accordingly.
	352	* If no new MTU was suggested, then we guess a new one
	353	* less than the current value. If the new MTU is
	354	* unreasonably small (arbitrarily set at 296), then
	355	* we reset the MTU to the interface value and enable the
	356	* lock bit, indicating that we are no longer doing MTU
	357	* discovery.
	358	*/
	359	if (code == PRC_MSGSIZE) {
	360	struct rtentry *rt;
	361	int mtu;
	362
	363	rt = rtalloc1((struct sockaddr *)&icmpsrc, 0,
	364	RTF_CLONING \| RTF_PRCLONING);
	365	if (rt && (rt->rt_flags & RTF_HOST)
	366	&& !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
	367	mtu = ntohs(icp->icmp_nextmtu);
	368	if (!mtu)
	369	mtu = ip_next_mtu(rt->rt_rmx.rmx_mtu,
	370	1);
	371	#ifdef DEBUG_MTUDISC
	372	printf("MTU for %s reduced to %d\n",
	373	inet_ntoa(icmpsrc.sin_addr), mtu);
	374	#endif
	375	if (mtu < 296) {
	376	/* rt->rt_rmx.rmx_mtu =
	377	rt->rt_ifp->if_mtu; */
	378	rt->rt_rmx.rmx_locks \|= RTV_MTU;
	379	} else if (rt->rt_rmx.rmx_mtu > mtu) {
	380	rt->rt_rmx.rmx_mtu = mtu;
	381	}
	382	}
	383	if (rt)
	384	RTFREE(rt);
	385	}
	386
	387	#endif
	388	ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
	389	if (ctlfunc)
	390	(ctlfunc)(code, (struct sockaddr )&icmpsrc,
	391	(void *)&icp->icmp_ip);
	392	break;
	393
	394	badcode:
	395	icmpstat.icps_badcode++;
	396	break;
	397
	398	case ICMP_ECHO:
	399	if (!icmpbmcastecho
	400	&& (m->m_flags & (M_MCAST \| M_BCAST)) != 0
	401	&& IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
	402	icmpstat.icps_bmcastecho++;
	403	break;
	404	}
	405	icp->icmp_type = ICMP_ECHOREPLY;
	406	goto reflect;
	407
	408	case ICMP_TSTAMP:
	409	if (!icmpbmcastecho
	410	&& (m->m_flags & (M_MCAST \| M_BCAST)) != 0
	411	&& IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
	412	icmpstat.icps_bmcasttstamp++;
	413	break;
	414	}
	415	if (icmplen < ICMP_TSLEN) {
	416	icmpstat.icps_badlen++;
	417	break;
	418	}
	419	icp->icmp_type = ICMP_TSTAMPREPLY;
	420	icp->icmp_rtime = iptime();
	421	icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
	422	goto reflect;
	423
	424	case ICMP_MASKREQ:
	425	#define satosin(sa) ((struct sockaddr_in *)(sa))
	426	if (icmpmaskrepl == 0)
	427	break;
	428	/*
	429	* We are not able to respond with all ones broadcast
	430	* unless we receive it over a point-to-point interface.
	431	*/
	432	if (icmplen < ICMP_MASKLEN)
	433	break;
	434	switch (ip->ip_dst.s_addr) {
	435
	436	case INADDR_BROADCAST:
	437	case INADDR_ANY:
	438	icmpdst.sin_addr = ip->ip_src;
	439	break;
	440
	441	default:
	442	icmpdst.sin_addr = ip->ip_dst;
	443	}
	444	ia = (struct in_ifaddr *)ifaof_ifpforaddr(
	445	(struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
	446	if (ia == 0)
	447	break;
	448	if (ia->ia_ifp == 0)
	449	break;
	450	icp->icmp_type = ICMP_MASKREPLY;
	451	icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
	452	if (ip->ip_src.s_addr == 0) {
	453	if (ia->ia_ifp->if_flags & IFF_BROADCAST)
	454	ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
	455	else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
	456	ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
	457	}
	458	reflect:
	459	ip->ip_len += hlen; /* since ip_input deducts this */
	460	icmpstat.icps_reflect++;
	461	icmpstat.icps_outhist[icp->icmp_type]++;
	462	icmp_reflect(m);
	463	return;
	464
	465	case ICMP_REDIRECT:
	466	if (code > 3)
	467	goto badcode;
	468	if (icmplen < ICMP_ADVLENMIN \|\| icmplen < ICMP_ADVLEN(icp) \|\|
	469	IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
	470	icmpstat.icps_badlen++;
	471	break;
	472	}
	473	/*
	474	* Short circuit routing redirects to force
	475	* immediate change in the kernel's routing
	476	* tables. The message is also handed to anyone
	477	* listening on a raw socket (e.g. the routing
	478	* daemon for use in updating its tables).
	479	*/
	480	icmpgw.sin_addr = ip->ip_src;
	481	icmpdst.sin_addr = icp->icmp_gwaddr;
	482	#ifdef ICMPPRINTFS
	483	if (icmpprintfs) {
	484	char buf[4 * sizeof "123"];
	485	strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
	486
	487	printf("redirect dst %s to %s\n",
	488	buf, inet_ntoa(icp->icmp_gwaddr));
	489	}
	490	#endif
	491	icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
	492	rtredirect((struct sockaddr *)&icmpsrc,
	493	(struct sockaddr *)&icmpdst,
	494	(struct sockaddr *)0, RTF_GATEWAY \| RTF_HOST,
	495	(struct sockaddr )&icmpgw, (struct rtentry *)0);
	496	pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
	497	break;
	498
	499	/*
	500	* No kernel processing for the following;
	501	* just fall through to send to raw listener.
	502	*/
	503	case ICMP_ECHOREPLY:
	504	case ICMP_ROUTERADVERT:
	505	case ICMP_ROUTERSOLICIT:
	506	case ICMP_TSTAMPREPLY:
	507	case ICMP_IREQREPLY:
	508	case ICMP_MASKREPLY:
	509	default:
	510	break;
	511	}
	512
	513	raw:
	514	rip_input(m, hlen);
	515	return;
	516
	517	freeit:
	518	m_freem(m);
	519	}
	520
	521	/*
	522	* Reflect the ip packet back to the source
	523	*/
	524	static void
	525	icmp_reflect(m)
	526	struct mbuf *m;
	527	{
[e953e2df]	528	struct ip ip = mtod(m, struct ip );
	529	struct in_ifaddr *ia;
[39e6e65a]	530	struct in_addr t;
	531	struct mbuf *opts = 0;
	532	int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
	533
	534	if (!in_canforward(ip->ip_src) &&
	535	((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
	536	(IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
	537	m_freem(m); /* Bad return address */
	538	goto done; /* Ip_output() will check for broadcast */
	539	}
	540	t = ip->ip_dst;
	541	ip->ip_dst = ip->ip_src;
	542	/*
	543	* If the incoming packet was addressed directly to us,
	544	* use dst as the src for the reply. Otherwise (broadcast
	545	* or anonymous), use the address which corresponds
	546	* to the incoming interface.
	547	*/
	548	for (ia = in_ifaddr; ia; ia = ia->ia_next) {
	549	if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
	550	break;
	551	if (ia->ia_ifp && (ia->ia_ifp->if_flags & IFF_BROADCAST) &&
	552	t.s_addr == satosin(&ia->ia_broadaddr)->sin_addr.s_addr)
	553	break;
	554	}
	555	icmpdst.sin_addr = t;
	556	if ((ia == (struct in_ifaddr *)0) && m->m_pkthdr.rcvif)
	557	ia = (struct in_ifaddr *)ifaof_ifpforaddr(
	558	(struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
	559	/*
	560	* The following happens if the packet was not addressed to us,
	561	* and was received on an interface with no IP address.
	562	*/
	563	if (ia == (struct in_ifaddr *)0)
	564	ia = in_ifaddr;
	565	t = IA_SIN(ia)->sin_addr;
	566	ip->ip_src = t;
	567	ip->ip_ttl = MAXTTL;
	568
	569	if (optlen > 0) {
	570	register u_char *cp;
	571	int opt, cnt;
	572	u_int len;
	573
	574	/*
	575	* Retrieve any source routing from the incoming packet;
	576	* add on any record-route or timestamp options.
	577	*/
	578	cp = (u_char *) (ip + 1);
	579	if ((opts = ip_srcroute()) == 0 &&
	580	(opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
	581	opts->m_len = sizeof(struct in_addr);
	582	mtod(opts, struct in_addr *)->s_addr = 0;
	583	}
	584	if (opts) {
	585	#ifdef ICMPPRINTFS
	586	if (icmpprintfs)
	587	printf("icmp_reflect optlen %d rt %d => ",
	588	optlen, opts->m_len);
	589	#endif
	590	for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
	591	opt = cp[IPOPT_OPTVAL];
	592	if (opt == IPOPT_EOL)
	593	break;
	594	if (opt == IPOPT_NOP)
	595	len = 1;
	596	else {
[e953e2df]	597	if (cnt < IPOPT_OLEN + sizeof(*cp))
	598	break;
[39e6e65a]	599	len = cp[IPOPT_OLEN];
[e953e2df]	600	if (len < IPOPT_OLEN + sizeof(*cp) \|\|
	601	len > cnt)
[39e6e65a]	602	break;
	603	}
	604	/*
	605	* Should check for overflow, but it "can't happen"
	606	*/
	607	if (opt == IPOPT_RR \|\| opt == IPOPT_TS \|\|
	608	opt == IPOPT_SECURITY) {
	609	bcopy((caddr_t)cp,
	610	mtod(opts, caddr_t) + opts->m_len, len);
	611	opts->m_len += len;
	612	}
	613	}
	614	/* Terminate & pad, if necessary */
	615	cnt = opts->m_len % 4;
	616	if (cnt) {
	617	for (; cnt < 4; cnt++) {
	618	*(mtod(opts, caddr_t) + opts->m_len) =
	619	IPOPT_EOL;
	620	opts->m_len++;
	621	}
	622	}
	623	#ifdef ICMPPRINTFS
	624	if (icmpprintfs)
	625	printf("%d\n", opts->m_len);
	626	#endif
	627	}
	628	/*
	629	* Now strip out original options by copying rest of first
	630	* mbuf's data back, and adjust the IP length.
	631	*/
	632	ip->ip_len -= optlen;
	633	ip->ip_vhl = IP_VHL_BORING;
	634	m->m_len -= optlen;
	635	if (m->m_flags & M_PKTHDR)
	636	m->m_pkthdr.len -= optlen;
	637	optlen += sizeof(struct ip);
	638	bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
	639	(unsigned)(m->m_len - sizeof(struct ip)));
	640	}
	641	m->m_flags &= ~(M_BCAST\|M_MCAST);
	642	icmp_send(m, opts);
	643	done:
	644	if (opts)
	645	(void)m_free(opts);
	646	}
	647
	648	/*
	649	* Send an icmp packet back to the ip level,
	650	* after supplying a checksum.
	651	*/
	652	static void
	653	icmp_send(m, opts)
	654	register struct mbuf *m;
	655	struct mbuf *opts;
	656	{
	657	register struct ip ip = mtod(m, struct ip );
	658	register int hlen;
	659	register struct icmp *icp;
	660	struct route ro;
	661
	662	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
	663	m->m_data += hlen;
	664	m->m_len -= hlen;
	665	icp = mtod(m, struct icmp *);
	666	icp->icmp_cksum = 0;
	667	icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
	668	m->m_data -= hlen;
	669	m->m_len += hlen;
	670	#ifdef ICMPPRINTFS
	671	if (icmpprintfs) {
	672	char buf[4 * sizeof "123"];
	673	strcpy(buf, inet_ntoa(ip->ip_dst));
	674	printf("icmp_send dst %s src %s\n",
	675	buf, inet_ntoa(ip->ip_src));
	676	}
	677	#endif
	678	bzero(&ro, sizeof ro);
	679	(void) ip_output(m, opts, &ro, 0, NULL);
	680	if (ro.ro_rt)
	681	RTFREE(ro.ro_rt);
	682	}
	683
	684	n_time
	685	iptime()
	686	{
	687	struct timeval atv;
	688	u_long t;
	689
	690	microtime(&atv);
	691	t = (atv.tv_sec % (246060)) * 1000 + atv.tv_usec / 1000;
	692	return (htonl(t));
	693	}
	694
	695	#if 1
	696	/*
	697	* Return the next larger or smaller MTU plateau (table from RFC 1191)
	698	* given current value MTU. If DIR is less than zero, a larger plateau
	699	* is returned; otherwise, a smaller value is returned.
	700	*/
	701	static int
	702	ip_next_mtu(mtu, dir)
	703	int mtu;
	704	int dir;
	705	{
	706	static int mtutab[] = {
	707	65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
	708	68, 0
	709	};
	710	int i;
	711
	712	for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
	713	if (mtu >= mtutab[i])
	714	break;
	715	}
	716
	717	if (dir < 0) {
	718	if (i == 0) {
	719	return 0;
	720	} else {
	721	return mtutab[i - 1];
	722	}
	723	} else {
	724	if (mtutab[i] == 0) {
	725	return 0;
	726	} else if(mtu > mtutab[i]) {
	727	return mtutab[i];
	728	} else {
	729	return mtutab[i + 1];
	730	}
	731	}
	732	}
	733	#endif

Note: See TracBrowser for help on using the repository browser.

Download in other formats: