d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b3ea6ecd42
freebsd-skq/sys/netinet/ip_icmp.c

930 lines
24 KiB
C
Raw Normal View History

BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
/*
* Copyright (c) 1982, 1986, 1988, 1993
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 4. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
$Id$ -> $FreeBSD$
1999-08-28 01:08:13 +00:00
* $FreeBSD$
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
*/
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
#include "opt_ipsec.h"
Introduce support for Mandatory Access Control and extensible kernel access control. Add support for labeling most out-going ICMP messages using an appropriate MAC entry point. Currently, we do not explicitly label packet reflect (timestamp, echo request) ICMP events, implicitly using the originating packet label since the mbuf is reused. This will be made explicit at some point. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-01 03:53:04 +00:00
#include "opt_mac.h"
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <sys/param.h>
#include <sys/systm.h>
Introduce support for Mandatory Access Control and extensible kernel access control. Add support for labeling most out-going ICMP messages using an appropriate MAC entry point. Currently, we do not explicitly label packet reflect (timestamp, echo request) ICMP events, implicitly using the originating packet label since the mbuf is reused. This will be made explicit at some point. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-01 03:53:04 +00:00
#include <sys/mac.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <sys/mbuf.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/kernel.h>
Add and move declarations to fix all of the warnings from `gcc -Wimplicit' (except in netccitt, netiso and netns) and most of the warnings from `gcc -Wnested-externs'. Fix all the bugs found. There were no serious ones.
1995-03-16 18:17:34 +00:00
#include <sys/sysctl.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <net/if.h>
Make faith loadable, unloadable, and clonable.
2001-09-25 18:40:52 +00:00
#include <net/if_types.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <net/route.h>
#include <netinet/in.h>
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
#include <netinet/in_pcb.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <netinet/in_systm.h>
#include <netinet/in_var.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
Add and move declarations to fix all of the warnings from `gcc -Wimplicit' (except in netccitt, netiso and netns) and most of the warnings from `gcc -Wnested-externs'. Fix all the bugs found. There were no serious ones.
1995-03-16 18:17:34 +00:00
#include <netinet/ip_var.h>
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
#include <netinet/tcp.h>
#include <netinet/tcp_var.h>
#include <netinet/tcpip.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#include <netinet/icmp_var.h>
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
#ifdef IPSEC
#include <netinet6/ipsec.h>
#include <netkey/key.h>
#endif
Tie new "Fast IPsec" code into the build. This involves the usual configuration stuff as well as conditional code in the IPv4 and IPv6 areas. Everything is conditional on FAST_IPSEC which is mutually exclusive with IPSEC (KAME IPsec implmentation). As noted previously, don't use FAST_IPSEC with INET6 at the moment. Reviewed by: KAME, rwatson Approved by: silence Supported by: Vernier Networks
2002-10-16 02:25:05 +00:00
#ifdef FAST_IPSEC
#include <netipsec/ipsec.h>
#include <netipsec/key.h>
#define IPSEC
#endif
Add #include <machine/in_cksum.h>, in order to pick up the checksum inline functions and prototypes.
2000-05-06 18:19:58 +00:00
#include <machine/in_cksum.h>
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
/*
* ICMP routines: error generation, receive packet processing, and
* routines to turnaround packets back to the originator, and
* host table maintenance routines.
*/
Tweak existing header and other build infrastructure to be able to build pf/pflog/pfsync as modules. Do not list them in NOTES or modules/Makefile (i.e. do not connect it to any (automatic) builds - yet). Approved by: bms(mentor)
2004-02-26 03:53:54 +00:00
struct icmpstat icmpstat;
Add netstat(1) knob to reset net.inet.{ip|icmp|tcp|udp|igmp}.stats. For example, ``netstat -s -p ip -z'' will show and reset IP stats. PR: bin/17338
2001-06-23 17:17:59 +00:00
SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RW,
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
&icmpstat, icmpstat, "");
static int icmpmaskrepl = 0;
SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
Add a sysctl node allowing the specification of an address mask to use when replying to ICMP Address Mask Request packets.
2003-03-21 15:43:06 +00:00
&icmpmaskrepl, 0, "Reply to ICMP Address Mask Request packets.");
static u_int icmpmaskfake = 0;
SYSCTL_UINT(_net_inet_icmp, OID_AUTO, maskfake, CTLFLAG_RW,
&icmpmaskfake, 0, "Fake reply to ICMP Address Mask Request packets.");
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
Add net.inet.icmp.log_redirect and net.inet.icmp.drop_redirect, for respectively logging and dropping ICMP REDIRECT packets. Note that there is no rate limiting on the log messages, so log_redirect should be used with caution (preferrably only for debugging purposes).
1999-08-10 09:45:33 +00:00
static int drop_redirect = 0;
SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
&drop_redirect, 0, "");
Reorder.
1999-09-14 16:40:28 +00:00
static int log_redirect = 0;
SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
&log_redirect, 0, "");
Mitigate the stream.c attacks o Drop all broadcast and multicast source addresses in tcp_input. o Enable ICMP_BANDLIM in GENERIC. o Change default to 200/s from 100/s. This will still stop the attack, but is conservative enough to do this close to code freeze. This is not the optimal patch for the problem, but is likely the least intrusive patch that can be made for this. Obtained from: Don Lewis and Matt Dillon. Reviewed by: freebsd-security
2000-01-28 06:13:09 +00:00
static int icmplim = 200;
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
&icmplim, 0, "");
Cleanup icmp_var.h, make icmp bandlim sysctl permanent but if ICMP_BANDLIM option not defined the sysctl int value is set to -1 and read-only. #ifdef KERNEL's added appropriately to wall off visibility of kernel routines from user code.
1998-12-04 04:21:25 +00:00
sysctl'ize ICMP_BANDLIM and ICMP_BANDLIM_SUPPRESS_OUTPUT. Suggested by: des/nbm
2000-05-22 16:12:28 +00:00
static int icmplim_output = 1;
SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW,
&icmplim_output, 0, "");
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
o IFNAMSIZ does include the trailing \0. Approved by: andre o Document net.inet.icmp.reply_src.
2004-05-07 01:24:53 +00:00
static char reply_src[IFNAMSIZ];
Add sysctl net.inet.icmp.reply_src to specify the interface name used for the ICMP reply source in reponse to packets which are not directly addressed to us. By default continue with with normal source selection. Reviewed by: bms
2004-02-02 22:53:16 +00:00
SYSCTL_STRING(_net_inet_icmp, OID_AUTO, reply_src, CTLFLAG_RW,
&reply_src, IFNAMSIZ, "icmp reply source for non-local packets.");
Cleanup icmp_var.h, make icmp bandlim sysctl permanent but if ICMP_BANDLIM option not defined the sysctl int value is set to -1 and read-only. #ifdef KERNEL's added appropriately to wall off visibility of kernel routines from user code.
1998-12-04 04:21:25 +00:00
/*
* ICMP broadcast echo sysctl
*/
Turn off replies to ICMP echo requests for broadcast and multicast addresses by default. Add a knob "icmp_bmcastecho" to "rc.network" to allow this behaviour to be controlled from "rc.conf". Document the controlling sysctl variable "net.inet.icmp.bmcastecho" in sysctl(3). Reviewed by: dg, jkh Reminded on -hackers by: Steinar Haug <sthaug@nethelp.no>
1998-09-15 10:49:03 +00:00
static int icmpbmcastecho = 0;
Add net.inet.icmp.log_redirect and net.inet.icmp.drop_redirect, for respectively logging and dropping ICMP REDIRECT packets. Note that there is no rate limiting on the log messages, so log_redirect should be used with caution (preferrably only for debugging purposes).
1999-08-10 09:45:33 +00:00
SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
&icmpbmcastecho, 0, "");
Configurably don't reply to broadcast or multicast echos. There are still potential problems with other automatic-reply ICMPs, but some of them may depend on broadcast/multicast to operate. (This code can simply be moved to the `reflect' label to generalize it.)
1997-08-25 01:25:31 +00:00
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#ifdef ICMPPRINTFS
int icmpprintfs = 0;
#endif
Remove __P.
2002-03-19 21:25:46 +00:00
static void icmp_reflect(struct mbuf *);
Remove the global one-level rtcache variable and associated complex locking and rework ip_rtaddr() to do its own rtlookup. Adopt all its callers to this and make ip_output() callable with NULL rt pointer. Reviewed by: sam (mentor)
2003-11-14 21:48:57 +00:00
static void icmp_send(struct mbuf *, struct mbuf *);
Remove __P.
2002-03-19 21:25:46 +00:00
static int ip_next_mtu(int, int);
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
extern struct protosw inetsw[];
/*
* Generate an error packet of type error
* in response to bad packet ip.
*/
void
icmp_error(n, type, code, dest, destifp)
struct mbuf *n;
int type, code;
n_long dest;
struct ifnet *destifp;
{
register struct ip *oip = mtod(n, struct ip *), *nip;
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
register unsigned oiplen = oip->ip_hl << 2;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
register struct icmp *icp;
register struct mbuf *m;
Tweak existing header and other build infrastructure to be able to build pf/pflog/pfsync as modules. Do not list them in NOTES or modules/Makefile (i.e. do not connect it to any (automatic) builds - yet). Approved by: bms(mentor)
2004-02-26 03:53:54 +00:00
register struct m_tag *mtag;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
unsigned icmplen;
#ifdef ICMPPRINTFS
if (icmpprintfs)
GCC cleanup. Reviewed by: Submitted by: Obtained from:
1994-10-02 17:48:58 +00:00
printf("icmp_error(%p, %x, %d)\n", oip, type, code);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#endif
if (type != ICMP_REDIRECT)
icmpstat.icps_error++;
/*
do not send icmp response if the original packet is encrypted. Obtained from: KAME MFC after: 1 week
2004-06-07 09:56:59 +00:00
* Don't send error if the original packet was encrypted.
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
* Don't send error if not the first fragment of message.
* Don't error if the old packet protocol was ICMP
* error message, only known informational types.
*/
do not send icmp response if the original packet is encrypted. Obtained from: KAME MFC after: 1 week
2004-06-07 09:56:59 +00:00
if (n->m_flags & M_DECRYPTED)
goto freeit;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (oip->ip_off &~ (IP_MF|IP_DF))
goto freeit;
if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
n->m_len >= oiplen + ICMP_MINLEN &&
!ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
icmpstat.icps_oldicmp++;
goto freeit;
}
/* Don't send error in response to a multicast or broadcast packet */
if (n->m_flags & (M_BCAST|M_MCAST))
goto freeit;
/*
* First, formulate icmp message
*/
Back out M_* changes, per decision of the TRB. Approved by: trb
2003-02-19 05:47:46 +00:00
m = m_gethdr(M_DONTWAIT, MT_HEADER);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (m == NULL)
goto freeit;
Introduce support for Mandatory Access Control and extensible kernel access control. Add support for labeling most out-going ICMP messages using an appropriate MAC entry point. Currently, we do not explicitly label packet reflect (timestamp, echo request) ICMP events, implicitly using the originating packet label since the mbuf is reused. This will be made explicit at some point. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-01 03:53:04 +00:00
#ifdef MAC
mac_create_mbuf_netlayer(n, m);
#endif
Fixed the bug I have introduced in icmp_error() in revision 1.44. The amount of data we copy from the original IP datagram into the ICMP message was computed incorrectly for IP packets with payload less than 8 bytes.
2000-11-02 09:46:23 +00:00
icmplen = min(oiplen + 8, oip->ip_len);
It was possible for ip_forward() to supply to icmp_error() an IP header with ip_len in network byte order. For certain values of ip_len, this could cause icmp_error() to write beyond the end of an mbuf, causing mbuf free-list corruption. This problem was observed during generation of ICMP redirects. We now make quite sure that the copy of the IP header kept for icmp_error() is stored in a non-shared mbuf header so that it will not be modified by ip_output(). Also: - Calculate the correct number of bytes that need to be retained for icmp_error(), instead of assuming that 64 is enough (it's not). - In icmp_error(), use m_copydata instead of bcopy() to copy from the supplied mbuf chain, in case the first 8 bytes of IP payload are not stored directly after the IP header. - Sanity-check ip_len in icmp_error(), and panic if it is less than sizeof(struct ip). Incoming packets with bad ip_len values are discarded in ip_input(), so this should only be triggered by bugs in the code, not by bad packets. This patch results from code and suggestions from Ruslan, Bosko, Jonathan Lemon and Matt Dillon, with important testing by Mike Tancsa, who could reproduce this problem at will. Reported by: Mike Tancsa <mike@sentex.net> Reviewed by: ru, bmilekic, jlemon, dillon
2001-03-08 19:03:26 +00:00
if (icmplen < sizeof(struct ip))
panic("icmp_error: bad length");
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
m->m_len = icmplen + ICMP_MINLEN;
MH_ALIGN(m, m->m_len);
icp = mtod(m, struct icmp *);
if ((u_int)type > ICMP_MAXTYPE)
panic("icmp_error");
icmpstat.icps_outhist[type]++;
icp->icmp_type = type;
if (type == ICMP_REDIRECT)
icp->icmp_gwaddr.s_addr = dest;
else {
icp->icmp_void = 0;
Remove trailing whitespace.
1995-05-30 08:16:23 +00:00
/*
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
* The following assignments assume an overlay with the
* zeroed icmp_void field.
*/
if (type == ICMP_PARAMPROB) {
icp->icmp_pptr = code;
code = 0;
} else if (type == ICMP_UNREACH &&
code == ICMP_UNREACH_NEEDFRAG && destifp) {
icp->icmp_nextmtu = htons(destifp->if_mtu);
}
}
icp->icmp_code = code;
It was possible for ip_forward() to supply to icmp_error() an IP header with ip_len in network byte order. For certain values of ip_len, this could cause icmp_error() to write beyond the end of an mbuf, causing mbuf free-list corruption. This problem was observed during generation of ICMP redirects. We now make quite sure that the copy of the IP header kept for icmp_error() is stored in a non-shared mbuf header so that it will not be modified by ip_output(). Also: - Calculate the correct number of bytes that need to be retained for icmp_error(), instead of assuming that 64 is enough (it's not). - In icmp_error(), use m_copydata instead of bcopy() to copy from the supplied mbuf chain, in case the first 8 bytes of IP payload are not stored directly after the IP header. - Sanity-check ip_len in icmp_error(), and panic if it is less than sizeof(struct ip). Incoming packets with bad ip_len values are discarded in ip_input(), so this should only be triggered by bugs in the code, not by bad packets. This patch results from code and suggestions from Ruslan, Bosko, Jonathan Lemon and Matt Dillon, with important testing by Mike Tancsa, who could reproduce this problem at will. Reported by: Mike Tancsa <mike@sentex.net> Reviewed by: ru, bmilekic, jlemon, dillon
2001-03-08 19:03:26 +00:00
m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
nip = &icp->icmp_ip;
Fixed broken ICMP error generation, unified conversion of IP header fields between host and network byte order. The details: o icmp_error() now does not add IP header length. This fixes the problem when icmp_error() is called from ip_forward(). In this case the ip_len of the original IP datagram returned with ICMP error was wrong. o icmp_error() expects all three fields, ip_len, ip_id and ip_off in host byte order, so DTRT and convert these fields back to network byte order before sending a message. This fixes the problem described in PR 16240 and PR 20877 (ip_id field was returned in host byte order). o ip_ttl decrement operation in ip_forward() was moved down to make sure that it does not corrupt the copy of original IP datagram passed later to icmp_error(). o A copy of original IP datagram in ip_forward() was made a read-write, independent copy. This fixes the problem I first reported to Garrett Wollman and Bill Fenner and later put in audit trail of PR 16240: ip_output() (not always) converts fields of original datagram to network byte order, but because copy (mcopy) and its original (m) most likely share the same mbuf cluster, ip_output()'s manipulations on original also corrupted the copy. o ip_output() now expects all three fields, ip_len, ip_off and (what is significant) ip_id in host byte order. It was a headache for years that ip_id was handled differently. The only compatibility issue here is the raw IP socket interface with IP_HDRINCL socket option set and a non-zero ip_id field, but ip.4 manual page was unclear on whether in this case ip_id field should be in host or network byte order.
2000-09-01 12:33:03 +00:00
/*
* Convert fields to network representation.
*/
o Move NTOHL() and associated macros into <sys/param.h>. These are deprecated in favor of the POSIX-defined lowercase variants. o Change all occurrences of NTOHL() and associated marcros in the source tree to use the lowercase function variants. o Add missing license bits to sparc64's <machine/endian.h>. Approved by: jake o Clean up <machine/endian.h> files. o Remove unused __uint16_swap_uint32() from i386's <machine/endian.h>. o Remove prototypes for non-existent bswapXX() functions. o Include <machine/endian.h> in <arpa/inet.h> to define the POSIX-required ntohl() family of functions. o Do similar things to expose the ntohl() family in libstand, <netinet/in.h>, and <sys/param.h>. o Prepend underscores to the ntohl() family to help deal with complexities associated with having MD (asm and inline) versions, and having to prevent exposure of these functions in other headers that happen to make use of endian-specific defines. o Create weak aliases to the canonical function name to help deal with third-party software forgetting to include an appropriate header. o Remove some now unneeded pollution from <sys/types.h>. o Add missing <arpa/inet.h> includes in userland. Tested on: alpha, i386 Reviewed by: bde, jake, tmm
2002-02-18 20:35:27 +00:00
nip->ip_len = htons(nip->ip_len);
nip->ip_off = htons(nip->ip_off);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
/*
* Now, copy old ip header (without options)
* in front of icmp message.
*/
if (m->m_data - sizeof(struct ip) < m->m_pktdat)
panic("icmp len");
m->m_data -= sizeof(struct ip);
m->m_len += sizeof(struct ip);
m->m_pkthdr.len = m->m_len;
m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
nip = mtod(m, struct ip *);
bcopy((caddr_t)oip, (caddr_t)nip, sizeof(struct ip));
nip->ip_len = m->m_len;
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
nip->ip_v = IPVERSION;
nip->ip_hl = 5;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
nip->ip_p = IPPROTO_ICMP;
nip->ip_tos = 0;
Tweak existing header and other build infrastructure to be able to build pf/pflog/pfsync as modules. Do not list them in NOTES or modules/Makefile (i.e. do not connect it to any (automatic) builds - yet). Approved by: bms(mentor)
2004-02-26 03:53:54 +00:00
/*
* XXX: Move PF_GENERATED m_tag to new packet, if it exists.
* This should be replaced by unified flags/tags for
* pf/ipfw/ipf and future pfil_hook applications.
*/
mtag = m_tag_find(n, PACKET_TAG_PF_GENERATED, NULL);
if (mtag != NULL) {
m_tag_unlink(n, mtag);
m_tag_prepend(m, mtag);
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icmp_reflect(m);
freeit:
m_freem(n);
}
/*
* Process a received ICMP message.
*/
void
Patches from Keiichi SHIMA <keiichi@iij.ad.jp> to make ip use the standard protosw structure again. Obtained from: Well, KAME I guess.
2001-09-03 20:03:55 +00:00
icmp_input(m, off)
Move global variables for icmp_input() to its stack. With SMP or preemption two CPUs can be in the same function at the same time and clobber each others variables. Remove register declaration from local variables. Reviewed by: sam (mentor)
2003-11-13 00:32:13 +00:00
struct mbuf *m;
Patches from Keiichi SHIMA <keiichi@iij.ad.jp> to make ip use the standard protosw structure again. Obtained from: Well, KAME I guess.
2001-09-03 20:03:55 +00:00
int off;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
{
Move global variables for icmp_input() to its stack. With SMP or preemption two CPUs can be in the same function at the same time and clobber each others variables. Remove register declaration from local variables. Reviewed by: sam (mentor)
2003-11-13 00:32:13 +00:00
struct icmp *icp;
struct in_ifaddr *ia;
struct ip *ip = mtod(m, struct ip *);
struct sockaddr_in icmpsrc, icmpdst, icmpgw;
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
int hlen = off;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
int icmplen = ip->ip_len;
Move global variables for icmp_input() to its stack. With SMP or preemption two CPUs can be in the same function at the same time and clobber each others variables. Remove register declaration from local variables. Reviewed by: sam (mentor)
2003-11-13 00:32:13 +00:00
int i, code;
Remove __P.
2002-03-19 21:25:46 +00:00
void (*ctlfunc)(int, struct sockaddr *, void *);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
/*
* Locate icmp structure in mbuf, and check
* that not corrupted and of at least minimum length.
*/
#ifdef ICMPPRINTFS
Fix long-standing bug in ICMPPRINTFS code where NTOHL was used instead of ntohl for printing IP addresses, by instead substituting inet_ntoa() to produce human-readable output. Obtained from: 4.4-Lite-2
1995-08-29 17:49:04 +00:00
if (icmpprintfs) {
char buf[4 * sizeof "123"];
strcpy(buf, inet_ntoa(ip->ip_src));
printf("icmp_input from %s to %s, len %d\n",
buf, inet_ntoa(ip->ip_dst), icmplen);
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#endif
if (icmplen < ICMP_MINLEN) {
icmpstat.icps_tooshort++;
goto freeit;
}
i = hlen + min(icmplen, ICMP_ADVLENMIN);
if (m->m_len < i && (m = m_pullup(m, i)) == 0) {
icmpstat.icps_tooshort++;
return;
}
ip = mtod(m, struct ip *);
m->m_len -= hlen;
m->m_data += hlen;
icp = mtod(m, struct icmp *);
if (in_cksum(m, icmplen)) {
icmpstat.icps_checksum++;
goto freeit;
}
m->m_len += hlen;
m->m_data -= hlen;
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
/*
* Deliver very specific ICMP type only.
*/
switch (icp->icmp_type) {
case ICMP_UNREACH:
case ICMP_TIMXCEED:
break;
default:
goto freeit;
}
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#ifdef ICMPPRINTFS
if (icmpprintfs)
printf("icmp_input, type %d code %d\n", icp->icmp_type,
icp->icmp_code);
#endif
ICMP messages received from broken hosts which reply to multicast packets were mistakenly delivered, rather than getting thrown out, which caused substantial lossage. Submitted by: Bill Fenner <fenner@parc.xerox.com>
1995-07-10 16:16:00 +00:00
/*
* Message type specific processing.
*/
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (icp->icmp_type > ICMP_MAXTYPE)
goto raw;
Move global variables for icmp_input() to its stack. With SMP or preemption two CPUs can be in the same function at the same time and clobber each others variables. Remove register declaration from local variables. Reviewed by: sam (mentor)
2003-11-13 00:32:13 +00:00
/* Initialize */
bzero(&icmpsrc, sizeof(icmpsrc));
icmpsrc.sin_len = sizeof(struct sockaddr_in);
icmpsrc.sin_family = AF_INET;
bzero(&icmpdst, sizeof(icmpdst));
icmpdst.sin_len = sizeof(struct sockaddr_in);
icmpdst.sin_family = AF_INET;
bzero(&icmpgw, sizeof(icmpgw));
icmpgw.sin_len = sizeof(struct sockaddr_in);
icmpgw.sin_family = AF_INET;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icmpstat.icps_inhist[icp->icmp_type]++;
code = icp->icmp_code;
switch (icp->icmp_type) {
case ICMP_UNREACH:
switch (code) {
case ICMP_UNREACH_NET:
case ICMP_UNREACH_HOST:
case ICMP_UNREACH_SRCFAIL:
Allow ICMP unreachables which map into PRC_UNREACH_ADMIN_PROHIB to reset TCP connections which are in the SYN_SENT state, if the sequence number in the echoed ICMP reply is correct. This behavior can be controlled by the sysctl net.inet.tcp.icmp_may_rst. Currently, only subtypes 2,3,10,11,12 are treated as such (port, protocol and administrative unreachables). Assocaiate an error code with these resets which is reported to the user application: ENETRESET. Disallow resetting TCP sessions which are not in a SYN_SENT state. Reviewed by: jesper, -net
2001-02-23 20:51:46 +00:00
case ICMP_UNREACH_NET_UNKNOWN:
case ICMP_UNREACH_HOST_UNKNOWN:
case ICMP_UNREACH_ISOLATED:
case ICMP_UNREACH_TOSNET:
case ICMP_UNREACH_TOSHOST:
case ICMP_UNREACH_HOST_PRECEDENCE:
case ICMP_UNREACH_PRECEDENCE_CUTOFF:
code = PRC_UNREACH_NET;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
break;
case ICMP_UNREACH_NEEDFRAG:
code = PRC_MSGSIZE;
break;
Remove trailing whitespace.
1995-05-30 08:16:23 +00:00
Allow ICMP unreachables which map into PRC_UNREACH_ADMIN_PROHIB to reset TCP connections which are in the SYN_SENT state, if the sequence number in the echoed ICMP reply is correct. This behavior can be controlled by the sysctl net.inet.tcp.icmp_may_rst. Currently, only subtypes 2,3,10,11,12 are treated as such (port, protocol and administrative unreachables). Assocaiate an error code with these resets which is reported to the user application: ENETRESET. Disallow resetting TCP sessions which are not in a SYN_SENT state. Reviewed by: jesper, -net
2001-02-23 20:51:46 +00:00
/*
* RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
* Treat subcodes 2,3 as immediate RST
*/
case ICMP_UNREACH_PROTOCOL:
case ICMP_UNREACH_PORT:
MFC candidate. Change code from PRC_UNREACH_ADMIN_PROHIB to PRC_UNREACH_PORT for ICMP_UNREACH_PROTOCOL and ICMP_UNREACH_PORT And let TCP treat PRC_UNREACH_PORT like PRC_UNREACH_ADMIN_PROHIB This should fix the case where port unreachables for udp returned ENETRESET instead of ECONNREFUSED Problem found by: Bill Fenner <fenner@research.att.com> Reviewed by: jlemon
2001-03-28 14:13:19 +00:00
code = PRC_UNREACH_PORT;
Remove unneeded loop increment in src/sys/netinet/in_pcb.c:in_pcbnotify Add new PRC_UNREACH_ADMIN_PROHIB in sys/sys/protosw.h Remove condition on TCP in src/sys/netinet/ip_icmp.c:icmp_input In src/sys/netinet/ip_icmp.c:icmp_input set code = PRC_UNREACH_ADMIN_PROHIB or PRC_UNREACH_HOST for all unreachables except ICMP_UNREACH_NEEDFRAG Rename sysctl icmp_admin_prohib_like_rst to icmp_unreach_like_rst to reflect the fact that we also react on ICMP unreachables that are not administrative prohibited. Also update the comments to reflect this. In sys/netinet/tcp_subr.c:tcp_ctlinput add code to treat PRC_UNREACH_ADMIN_PROHIB and PRC_UNREACH_HOST different. PR: 23986 Submitted by: Jesper Skriver <jesper@skriver.dk>
2001-02-18 09:34:55 +00:00
break;
We currently does not react to ICMP administratively prohibited messages send by routers when they deny our traffic, this causes a timeout when trying to connect to TCP ports/services on a remote host, which is blocked by routers or firewalls. rfc1122 (Requirements for Internet Hosts) section 3.2.2.1 actually requi re that we treat such a message for a TCP session, that we treat it like if we had recieved a RST. quote begin. A Destination Unreachable message that is received MUST be reported to the transport layer. The transport layer SHOULD use the information appropriately; for example, see Sections 4.1.3.3, 4.2.3.9, and 4.2.4 below. A transport protocol that has its own mechanism for notifying the sender that a port is unreachable (e.g., TCP, which sends RST segments) MUST nevertheless accept an ICMP Port Unreachable for the same purpose. quote end. I've written a small extension that implement this, it also create a sysctl "net.inet.tcp.icmp_admin_prohib_like_rst" to control if this new behaviour is activated. When it's activated (set to 1) we'll treat a ICMP administratively prohibited message (icmp type 3 code 9, 10 and 13) for a TCP sessions, as if we recived a TCP RST, but only if the TCP session is in SYN_SENT state. The reason for only reacting when in SYN_SENT state, is that this will solve the problem, and at the same time minimize the risk of this being abused. I suggest that we enable this new behaviour by default, but it would be a change of current behaviour, so if people prefer to leave it disabled by default, at least for now, this would be ok for me, the attached diff actually have the sysctl set to 0 by default. PR: 23086 Submitted by: Jesper Skriver <jesper@skriver.dk>
2000-12-16 19:42:06 +00:00
Allow ICMP unreachables which map into PRC_UNREACH_ADMIN_PROHIB to reset TCP connections which are in the SYN_SENT state, if the sequence number in the echoed ICMP reply is correct. This behavior can be controlled by the sysctl net.inet.tcp.icmp_may_rst. Currently, only subtypes 2,3,10,11,12 are treated as such (port, protocol and administrative unreachables). Assocaiate an error code with these resets which is reported to the user application: ENETRESET. Disallow resetting TCP sessions which are not in a SYN_SENT state. Reviewed by: jesper, -net
2001-02-23 20:51:46 +00:00
case ICMP_UNREACH_NET_PROHIB:
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
case ICMP_UNREACH_HOST_PROHIB:
Handle ICMP codes defined in RFC1812 more appropriately
1996-09-20 08:23:54 +00:00
case ICMP_UNREACH_FILTER_PROHIB:
Remove unneeded loop increment in src/sys/netinet/in_pcb.c:in_pcbnotify Add new PRC_UNREACH_ADMIN_PROHIB in sys/sys/protosw.h Remove condition on TCP in src/sys/netinet/ip_icmp.c:icmp_input In src/sys/netinet/ip_icmp.c:icmp_input set code = PRC_UNREACH_ADMIN_PROHIB or PRC_UNREACH_HOST for all unreachables except ICMP_UNREACH_NEEDFRAG Rename sysctl icmp_admin_prohib_like_rst to icmp_unreach_like_rst to reflect the fact that we also react on ICMP unreachables that are not administrative prohibited. Also update the comments to reflect this. In sys/netinet/tcp_subr.c:tcp_ctlinput add code to treat PRC_UNREACH_ADMIN_PROHIB and PRC_UNREACH_HOST different. PR: 23986 Submitted by: Jesper Skriver <jesper@skriver.dk>
2001-02-18 09:34:55 +00:00
code = PRC_UNREACH_ADMIN_PROHIB;
break;
We currently does not react to ICMP administratively prohibited messages send by routers when they deny our traffic, this causes a timeout when trying to connect to TCP ports/services on a remote host, which is blocked by routers or firewalls. rfc1122 (Requirements for Internet Hosts) section 3.2.2.1 actually requi re that we treat such a message for a TCP session, that we treat it like if we had recieved a RST. quote begin. A Destination Unreachable message that is received MUST be reported to the transport layer. The transport layer SHOULD use the information appropriately; for example, see Sections 4.1.3.3, 4.2.3.9, and 4.2.4 below. A transport protocol that has its own mechanism for notifying the sender that a port is unreachable (e.g., TCP, which sends RST segments) MUST nevertheless accept an ICMP Port Unreachable for the same purpose. quote end. I've written a small extension that implement this, it also create a sysctl "net.inet.tcp.icmp_admin_prohib_like_rst" to control if this new behaviour is activated. When it's activated (set to 1) we'll treat a ICMP administratively prohibited message (icmp type 3 code 9, 10 and 13) for a TCP sessions, as if we recived a TCP RST, but only if the TCP session is in SYN_SENT state. The reason for only reacting when in SYN_SENT state, is that this will solve the problem, and at the same time minimize the risk of this being abused. I suggest that we enable this new behaviour by default, but it would be a change of current behaviour, so if people prefer to leave it disabled by default, at least for now, this would be ok for me, the attached diff actually have the sysctl set to 0 by default. PR: 23086 Submitted by: Jesper Skriver <jesper@skriver.dk>
2000-12-16 19:42:06 +00:00
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
default:
goto badcode;
}
goto deliver;
case ICMP_TIMXCEED:
if (code > 1)
goto badcode;
code += PRC_TIMXCEED_INTRANS;
goto deliver;
case ICMP_PARAMPROB:
if (code > 1)
goto badcode;
code = PRC_PARAMPROB;
goto deliver;
case ICMP_SOURCEQUENCH:
if (code)
goto badcode;
code = PRC_QUENCH;
deliver:
/*
* Problem with datagram; advise higher level routines.
*/
if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icmpstat.icps_badlen++;
goto freeit;
}
o Move NTOHL() and associated macros into <sys/param.h>. These are deprecated in favor of the POSIX-defined lowercase variants. o Change all occurrences of NTOHL() and associated marcros in the source tree to use the lowercase function variants. o Add missing license bits to sparc64's <machine/endian.h>. Approved by: jake o Clean up <machine/endian.h> files. o Remove unused __uint16_swap_uint32() from i386's <machine/endian.h>. o Remove prototypes for non-existent bswapXX() functions. o Include <machine/endian.h> in <arpa/inet.h> to define the POSIX-required ntohl() family of functions. o Do similar things to expose the ntohl() family in libstand, <netinet/in.h>, and <sys/param.h>. o Prepend underscores to the ntohl() family to help deal with complexities associated with having MD (asm and inline) versions, and having to prevent exposure of these functions in other headers that happen to make use of endian-specific defines. o Create weak aliases to the canonical function name to help deal with third-party software forgetting to include an appropriate header. o Remove some now unneeded pollution from <sys/types.h>. o Add missing <arpa/inet.h> includes in userland. Tested on: alpha, i386 Reviewed by: bde, jake, tmm
2002-02-18 20:35:27 +00:00
icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
ICMP messages received from broken hosts which reply to multicast packets were mistakenly delivered, rather than getting thrown out, which caused substantial lossage. Submitted by: Bill Fenner <fenner@parc.xerox.com>
1995-07-10 16:16:00 +00:00
/* Discard ICMP's in response to multicast packets */
if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
goto badcode;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#ifdef ICMPPRINTFS
if (icmpprintfs)
printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
#endif
icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
Initial back-end support for IP MTU discovery, gated on MTUDISC. The support for TCP has yet to be written.
1995-09-18 15:51:40 +00:00
/*
* MTU discovery:
* If we got a needfrag and there is a host route to the
* original destination, and the MTU is not locked, then
* set the MTU in the route to the suggested new value
* (if given) and then notify as usual. The ULPs will
* notice that the MTU has changed and adapt accordingly.
* If no new MTU was suggested, then we guess a new one
* less than the current value. If the new MTU is
Limiters and sanity checks for TCP MSS (maximum segement size) resource exhaustion attacks. For network link optimization TCP can adjust its MSS and thus packet size according to the observed path MTU. This is done dynamically based on feedback from the remote host and network components along the packet path. This information can be abused to pretend an extremely low path MTU. The resource exhaustion works in two ways: o during tcp connection setup the advertized local MSS is exchanged between the endpoints. The remote endpoint can set this arbitrarily low (except for a minimum MTU of 64 octets enforced in the BSD code). When the local host is sending data it is forced to send many small IP packets instead of a large one. For example instead of the normal TCP payload size of 1448 it forces TCP payload size of 12 (MTU 64) and thus we have a 120 times increase in workload and packets. On fast links this quickly saturates the local CPU and may also hit pps processing limites of network components along the path. This type of attack is particularly effective for servers where the attacker can download large files (WWW and FTP). We mitigate it by enforcing a minimum MTU settable by sysctl net.inet.tcp.minmss defaulting to 256 octets. o the local host is reveiving data on a TCP connection from the remote host. The local host has no control over the packet size the remote host is sending. The remote host may chose to do what is described in the first attack and send the data in packets with an TCP payload of at least one byte. For each packet the tcp_input() function will be entered, the packet is processed and a sowakeup() is signalled to the connected process. For example an attack with 2 Mbit/s gives 4716 packets per second and the same amount of sowakeup()s to the process (and context switches). This type of attack is particularly effective for servers where the attacker can upload large amounts of data. Normally this is the case with WWW server where large POSTs can be made. We mitigate this by calculating the average MSS payload per second. If it goes below 'net.inet.tcp.minmss' and the pps rate is above 'net.inet.tcp.minmssoverload' defaulting to 1000 this particular TCP connection is resetted and dropped. MITRE CVE: CAN-2004-0002 Reviewed by: sam (mentor) MFC after: 1 day
2004-01-08 17:40:07 +00:00
* unreasonably small (defined by sysctl tcp_minmss), then
* we don't update the MTU value.
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
*
* XXX: All this should be done in tcp_mtudisc() because
* the way we do it now, everyone can send us bogus ICMP
* MSGSIZE packets for any destination. By doing this far
* higher in the chain we have a matching tcp connection.
* Thus spoofing is much harder. However there is no easy
* non-hackish way to pass the new MTU up to tcp_mtudisc().
* Also see next XXX regarding IPv4 AH TCP.
Initial back-end support for IP MTU discovery, gated on MTUDISC. The support for TCP has yet to be written.
1995-09-18 15:51:40 +00:00
*/
if (code == PRC_MSGSIZE) {
int mtu;
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
struct in_conninfo inc;
bzero(&inc, sizeof(inc));
inc.inc_flags = 0; /* IPv4 */
inc.inc_faddr = icmpsrc.sin_addr;
mtu = ntohs(icp->icmp_nextmtu);
if (!mtu)
mtu = ip_next_mtu(mtu, 1);
Limiters and sanity checks for TCP MSS (maximum segement size) resource exhaustion attacks. For network link optimization TCP can adjust its MSS and thus packet size according to the observed path MTU. This is done dynamically based on feedback from the remote host and network components along the packet path. This information can be abused to pretend an extremely low path MTU. The resource exhaustion works in two ways: o during tcp connection setup the advertized local MSS is exchanged between the endpoints. The remote endpoint can set this arbitrarily low (except for a minimum MTU of 64 octets enforced in the BSD code). When the local host is sending data it is forced to send many small IP packets instead of a large one. For example instead of the normal TCP payload size of 1448 it forces TCP payload size of 12 (MTU 64) and thus we have a 120 times increase in workload and packets. On fast links this quickly saturates the local CPU and may also hit pps processing limites of network components along the path. This type of attack is particularly effective for servers where the attacker can download large files (WWW and FTP). We mitigate it by enforcing a minimum MTU settable by sysctl net.inet.tcp.minmss defaulting to 256 octets. o the local host is reveiving data on a TCP connection from the remote host. The local host has no control over the packet size the remote host is sending. The remote host may chose to do what is described in the first attack and send the data in packets with an TCP payload of at least one byte. For each packet the tcp_input() function will be entered, the packet is processed and a sowakeup() is signalled to the connected process. For example an attack with 2 Mbit/s gives 4716 packets per second and the same amount of sowakeup()s to the process (and context switches). This type of attack is particularly effective for servers where the attacker can upload large amounts of data. Normally this is the case with WWW server where large POSTs can be made. We mitigate this by calculating the average MSS payload per second. If it goes below 'net.inet.tcp.minmss' and the pps rate is above 'net.inet.tcp.minmssoverload' defaulting to 1000 this particular TCP connection is resetted and dropped. MITRE CVE: CAN-2004-0002 Reviewed by: sam (mentor) MFC after: 1 day
2004-01-08 17:40:07 +00:00
if (mtu >= max(296, (tcp_minmss +
sizeof(struct tcpiphdr))))
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
tcp_hc_updatemtu(&inc, mtu);
Initial back-end support for IP MTU discovery, gated on MTUDISC. The support for TCP has yet to be written.
1995-09-18 15:51:40 +00:00
Added a conditionalized printf for debugging MTU discovery.
1995-12-08 16:46:06 +00:00
#ifdef DEBUG_MTUDISC
Introduce tcp_hostcache and remove the tcp specific metrics from the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
2003-11-20 20:07:39 +00:00
printf("MTU for %s reduced to %d\n",
inet_ntoa(icmpsrc.sin_addr), mtu);
Added a conditionalized printf for debugging MTU discovery.
1995-12-08 16:46:06 +00:00
#endif
Initial back-end support for IP MTU discovery, gated on MTUDISC. The support for TCP has yet to be written.
1995-09-18 15:51:40 +00:00
}
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
/*
* XXX if the packet contains [IPv4 AH TCP], we can't make a
* notification to TCP layer.
*/
GCC cleanup. Reviewed by: Submitted by: Obtained from:
1994-10-02 17:48:58 +00:00
ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
if (ctlfunc)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
Uniformized pr_ctlinput protosw functions. The third arg is now `void *' instead of caddr_t and it isn't optional (it never was). Most of the netipx (and netns) pr_ctlinput functions abuse the second arg instead of using the third arg but fixing this is beyond the scope of this round of changes.
1995-12-16 02:14:44 +00:00
(void *)&icp->icmp_ip);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
break;
badcode:
icmpstat.icps_badcode++;
break;
case ICMP_ECHO:
Configurably don't reply to broadcast or multicast echos. There are still potential problems with other automatic-reply ICMPs, but some of them may depend on broadcast/multicast to operate. (This code can simply be moved to the `reflect' label to generalize it.)
1997-08-25 01:25:31 +00:00
if (!icmpbmcastecho
Fixed logic in the test to drop ICMP echo and timestamp packets when net.inet.ip.icmp.bmcastecho = 0 by removing the extra check for the address being a multicast address. The test now relies on the link layer flags that indicate it was received via multicast. The previous logic was broken and replied to ICMP echo/timestamp broadcasts even when the sysctl option disallowed them. Reviewed by: wollman
1998-05-26 11:34:30 +00:00
&& (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
Configurably don't reply to broadcast or multicast echos. There are still potential problems with other automatic-reply ICMPs, but some of them may depend on broadcast/multicast to operate. (This code can simply be moved to the `reflect' label to generalize it.)
1997-08-25 01:25:31 +00:00
icmpstat.icps_bmcastecho++;
break;
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icp->icmp_type = ICMP_ECHOREPLY;
Clean up RST ratelimiting. Previously, ratelimiting occured before tests were performed to determine if the received packet should be reset. This created erroneous ratelimiting and false alarms in some cases. The code has now been reorganized so that the checks for validity come before the call to badport_bandlim. Additionally, a few changes in the symbolic names of the bandlim types have been made, as well as a clarification of exactly which type each RST case falls under. Submitted by: Mike Silbersack <silby@silby.com>
2001-02-11 07:39:51 +00:00
if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
Change the following: 1. ICMP ECHO and TSTAMP replies are now rate limited. 2. RSTs generated due to packets sent to open and unopen ports are now limited by seperate counters. 3. Each rate limiting queue now has its own description, as follows: Limiting icmp unreach response from 439 to 200 packets per second Limiting closed port RST response from 283 to 200 packets per second Limiting open port RST response from 18724 to 200 packets per second Limiting icmp ping response from 211 to 200 packets per second Limiting icmp tstamp response from 394 to 200 packets per second Submitted by: Mike Silbersack <silby@silby.com>
2000-12-15 21:45:49 +00:00
goto freeit;
else
goto reflect;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
case ICMP_TSTAMP:
ICMP Timestamp Request messages could have harbored the same sort of problem as Echo Requests when broad/multicast. When multicast echo responses are disabled, also do the same for timestamp responses.
1997-08-25 16:29:27 +00:00
if (!icmpbmcastecho
Fixed logic in the test to drop ICMP echo and timestamp packets when net.inet.ip.icmp.bmcastecho = 0 by removing the extra check for the address being a multicast address. The test now relies on the link layer flags that indicate it was received via multicast. The previous logic was broken and replied to ICMP echo/timestamp broadcasts even when the sysctl option disallowed them. Reviewed by: wollman
1998-05-26 11:34:30 +00:00
&& (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
ICMP Timestamp Request messages could have harbored the same sort of problem as Echo Requests when broad/multicast. When multicast echo responses are disabled, also do the same for timestamp responses.
1997-08-25 16:29:27 +00:00
icmpstat.icps_bmcasttstamp++;
break;
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (icmplen < ICMP_TSLEN) {
icmpstat.icps_badlen++;
break;
}
icp->icmp_type = ICMP_TSTAMPREPLY;
icp->icmp_rtime = iptime();
icp->icmp_ttime = icp->icmp_rtime; /* bogus, do later! */
Clean up RST ratelimiting. Previously, ratelimiting occured before tests were performed to determine if the received packet should be reset. This created erroneous ratelimiting and false alarms in some cases. The code has now been reorganized so that the checks for validity come before the call to badport_bandlim. Additionally, a few changes in the symbolic names of the bandlim types have been made, as well as a clarification of exactly which type each RST case falls under. Submitted by: Mike Silbersack <silby@silby.com>
2001-02-11 07:39:51 +00:00
if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
Change the following: 1. ICMP ECHO and TSTAMP replies are now rate limited. 2. RSTs generated due to packets sent to open and unopen ports are now limited by seperate counters. 3. Each rate limiting queue now has its own description, as follows: Limiting icmp unreach response from 439 to 200 packets per second Limiting closed port RST response from 283 to 200 packets per second Limiting open port RST response from 18724 to 200 packets per second Limiting icmp ping response from 211 to 200 packets per second Limiting icmp tstamp response from 394 to 200 packets per second Submitted by: Mike Silbersack <silby@silby.com>
2000-12-15 21:45:49 +00:00
goto freeit;
else
goto reflect;
Remove trailing whitespace.
1995-05-30 08:16:23 +00:00
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
case ICMP_MASKREQ:
if (icmpmaskrepl == 0)
break;
/*
* We are not able to respond with all ones broadcast
* unless we receive it over a point-to-point interface.
*/
if (icmplen < ICMP_MASKLEN)
break;
switch (ip->ip_dst.s_addr) {
case INADDR_BROADCAST:
case INADDR_ANY:
icmpdst.sin_addr = ip->ip_src;
break;
default:
icmpdst.sin_addr = ip->ip_dst;
}
ia = (struct in_ifaddr *)ifaof_ifpforaddr(
(struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
if (ia == 0)
break;
Fix two cases where ia->ia_ifp could be NULL.
1996-04-02 12:26:10 +00:00
if (ia->ia_ifp == 0)
break;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icp->icmp_type = ICMP_MASKREPLY;
Add a sysctl node allowing the specification of an address mask to use when replying to ICMP Address Mask Request packets.
2003-03-21 15:43:06 +00:00
if (icmpmaskfake == 0)
icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
else
icp->icmp_mask = icmpmaskfake;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (ip->ip_src.s_addr == 0) {
if (ia->ia_ifp->if_flags & IFF_BROADCAST)
ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
}
reflect:
ip->ip_len += hlen; /* since ip_input deducts this */
icmpstat.icps_reflect++;
icmpstat.icps_outhist[icp->icmp_type]++;
icmp_reflect(m);
return;
case ICMP_REDIRECT:
Add net.inet.icmp.log_redirect and net.inet.icmp.drop_redirect, for respectively logging and dropping ICMP REDIRECT packets. Note that there is no rate limiting on the log messages, so log_redirect should be used with caution (preferrably only for debugging purposes).
1999-08-10 09:45:33 +00:00
if (log_redirect) {
u_long src, dst, gw;
src = ntohl(ip->ip_src.s_addr);
dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
gw = ntohl(icp->icmp_gwaddr.s_addr);
printf("icmp redirect from %d.%d.%d.%d: "
"%d.%d.%d.%d => %d.%d.%d.%d\n",
(int)(src >> 24), (int)((src >> 16) & 0xff),
(int)((src >> 8) & 0xff), (int)(src & 0xff),
(int)(dst >> 24), (int)((dst >> 16) & 0xff),
(int)((dst >> 8) & 0xff), (int)(dst & 0xff),
(int)(gw >> 24), (int)((gw >> 16) & 0xff),
(int)((gw >> 8) & 0xff), (int)(gw & 0xff));
}
According to RFC1812 we have to ignore ICMP redirects when we are acting as router (ipforwarding enabled). This doesn't fix the problem that host routes from ICMP redirects are never removed from the kernel routing table but removes the problem for machines doing packet forwarding. Reviewed by: sam (mentor)
2004-01-06 23:20:07 +00:00
/*
* RFC1812 says we must ignore ICMP redirects if we
* are acting as router.
*/
if (drop_redirect || ipforwarding)
Add net.inet.icmp.log_redirect and net.inet.icmp.drop_redirect, for respectively logging and dropping ICMP REDIRECT packets. Note that there is no rate limiting on the log messages, so log_redirect should be used with caution (preferrably only for debugging purposes).
1999-08-10 09:45:33 +00:00
break;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (code > 3)
goto badcode;
if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icmpstat.icps_badlen++;
break;
}
/*
* Short circuit routing redirects to force
* immediate change in the kernel's routing
* tables. The message is also handed to anyone
* listening on a raw socket (e.g. the routing
* daemon for use in updating its tables).
*/
icmpgw.sin_addr = ip->ip_src;
icmpdst.sin_addr = icp->icmp_gwaddr;
#ifdef ICMPPRINTFS
Fix long-standing bug in ICMPPRINTFS code where NTOHL was used instead of ntohl for printing IP addresses, by instead substituting inet_ntoa() to produce human-readable output. Obtained from: 4.4-Lite-2
1995-08-29 17:49:04 +00:00
if (icmpprintfs) {
char buf[4 * sizeof "123"];
strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
printf("redirect dst %s to %s\n",
buf, inet_ntoa(icp->icmp_gwaddr));
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#endif
icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
rtredirect((struct sockaddr *)&icmpsrc,
(struct sockaddr *)&icmpdst,
(struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
Locking for updates to routing table entries. Each rtentry gets a mutex that covers updates to the contents. Note this is separate from holding a reference and/or locking the routing table itself. Other/related changes: o rtredirect loses the final parameter by which an rtentry reference may be returned; this was never used and added unwarranted complexity for locking. o minor style cleanups to routing code (e.g. ansi-fy function decls) o remove the logic to bump the refcnt on the parent of cloned routes, we assume the parent will remain as long as the clone; doing this avoids a circularity in locking during delete o convert some timeouts to MPSAFE callouts Notes: 1. rt_mtx in struct rtentry is guarded by #ifdef _KERNEL as user-level applications cannot/do-no know about mutex's. Doing this requires that the mutex be the last element in the structure. A better solution is to introduce an externalized version of struct rtentry but this is a major task because of the intertwining of rtentry and other data structures that are visible to user applications. 2. There are known LOR's that are expected to go away with forthcoming work to eliminate many held references. If not these will be resolved prior to release. 3. ATM changes are untested. Sponsored by: FreeBSD Foundation Obtained from: BSD/OS (partly)
2003-10-04 03:44:50 +00:00
(struct sockaddr *)&icmpgw);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
IPSEC support in the kernel. pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
1999-12-22 19:13:38 +00:00
#ifdef IPSEC
key_sa_routechange((struct sockaddr *)&icmpsrc);
#endif
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
break;
/*
* No kernel processing for the following;
* just fall through to send to raw listener.
*/
case ICMP_ECHOREPLY:
case ICMP_ROUTERADVERT:
case ICMP_ROUTERSOLICIT:
case ICMP_TSTAMPREPLY:
case ICMP_IREQREPLY:
case ICMP_MASKREPLY:
default:
break;
}
raw:
Patches from Keiichi SHIMA <keiichi@iij.ad.jp> to make ip use the standard protosw structure again. Obtained from: Well, KAME I guess.
2001-09-03 20:03:55 +00:00
rip_input(m, off);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
return;
freeit:
m_freem(m);
}
/*
* Reflect the ip packet back to the source
*/
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
static void
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
icmp_reflect(m)
struct mbuf *m;
{
Add a hash table that contains the list of internet addresses, and use this in place of the in_ifaddr list when appropriate. This improves performance on hosts which have a large number of IP aliases.
2001-09-29 04:34:11 +00:00
struct ip *ip = mtod(m, struct ip *);
struct ifaddr *ifa;
Add sysctl net.inet.icmp.reply_src to specify the interface name used for the ICMP reply source in reponse to packets which are not directly addressed to us. By default continue with with normal source selection. Reviewed by: bms
2004-02-02 22:53:16 +00:00
struct ifnet *ifn;
Add a hash table that contains the list of internet addresses, and use this in place of the in_ifaddr list when appropriate. This improves performance on hosts which have a large number of IP aliases.
2001-09-29 04:34:11 +00:00
struct in_ifaddr *ia;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
struct in_addr t;
Add and move declarations to fix all of the warnings from `gcc -Wimplicit' (except in netccitt, netiso and netns) and most of the warnings from `gcc -Wnested-externs'. Fix all the bugs found. There were no serious ones.
1995-03-16 18:17:34 +00:00
struct mbuf *opts = 0;
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (!in_canforward(ip->ip_src) &&
((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
(IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
m_freem(m); /* Bad return address */
- Make ip_rtaddr() global, and use it to look up the correct source address in icmp_reflect(). - Two new "struct icmpstat" members: icps_badaddr and icps_noroute. PR: kern/31575 Obtained from: BSD/OS MFC after: 1 week
2001-11-30 10:40:28 +00:00
icmpstat.icps_badaddr++;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
goto done; /* Ip_output() will check for broadcast */
}
t = ip->ip_dst;
ip->ip_dst = ip->ip_src;
More verbose description of the source ip address selection for ICMP replies. Reviewed by: bms
2004-02-02 22:17:09 +00:00
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
/*
More verbose description of the source ip address selection for ICMP replies. Reviewed by: bms
2004-02-02 22:17:09 +00:00
* Source selection for ICMP replies:
*
* If the incoming packet was addressed directly to one of our
* own addresses, use dst as the src for the reply.
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
*/
Add a hash table that contains the list of internet addresses, and use this in place of the in_ifaddr list when appropriate. This improves performance on hosts which have a large number of IP aliases.
2001-09-29 04:34:11 +00:00
LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
Add a hash table that contains the list of internet addresses, and use this in place of the in_ifaddr list when appropriate. This improves performance on hosts which have a large number of IP aliases.
2001-09-29 04:34:11 +00:00
goto match;
More verbose description of the source ip address selection for ICMP replies. Reviewed by: bms
2004-02-02 22:17:09 +00:00
/*
* If the incoming packet was addressed to one of our broadcast
* addresses, use the first non-broadcast address which corresponds
* to the incoming interface.
*/
Fix a panic condition in icmp_reflect() introduced in rev. 1.61. (We should be able to handle locally originated IP packets, and these do not have m_pkthdr.rcvif set.) PR: kern/32806, kern/33766 Reviewed by: luigi Fix tested by: Maxim Konovalov <maxim@macomnet.ru>, Erwin Lansing <erwin@lansing.dk>
2002-01-11 12:13:57 +00:00
if (m->m_pkthdr.rcvif != NULL &&
m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
Add a hash table that contains the list of internet addresses, and use this in place of the in_ifaddr list when appropriate. This improves performance on hosts which have a large number of IP aliases.
2001-09-29 04:34:11 +00:00
TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
if (ifa->ifa_addr->sa_family != AF_INET)
continue;
whitespace fixes.
2001-12-14 19:32:47 +00:00
ia = ifatoia(ifa);
if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
t.s_addr)
goto match;
}
}
Add sysctl net.inet.icmp.reply_src to specify the interface name used for the ICMP reply source in reponse to packets which are not directly addressed to us. By default continue with with normal source selection. Reviewed by: bms
2004-02-02 22:53:16 +00:00
/*
* If the incoming packet was not addressed directly to us, use
* designated interface for icmp replies specified by sysctl
* net.inet.icmp.reply_src (default not set). Otherwise continue
* with normal source selection.
*/
if (reply_src[0] != '\0' && (ifn = ifunit(reply_src))) {
TAILQ_FOREACH(ifa, &ifn->if_addrhead, ifa_link) {
if (ifa->ifa_addr->sa_family != AF_INET)
continue;
ia = ifatoia(ifa);
goto match;
}
}
More verbose description of the source ip address selection for ICMP replies. Reviewed by: bms
2004-02-02 22:17:09 +00:00
/*
* If the packet was transiting through us, use the address of
* the interface that is the closest to the packet source.
* When we don't have a route back to the packet source, stop here
* and drop the packet.
*/
Remove the global one-level rtcache variable and associated complex locking and rework ip_rtaddr() to do its own rtlookup. Adopt all its callers to this and make ip_output() callable with NULL rt pointer. Reviewed by: sam (mentor)
2003-11-14 21:48:57 +00:00
ia = ip_rtaddr(ip->ip_dst);
In icmp_reflect(): If the packet was not addressed to us and was received on an interface without an IP address, try to find a non-loopback AF_INET address to use. If that fails, drop it. Previously, we used the address at the top of the in_ifaddrhead list, which didn't make much sense, and would cause a panic if there were no AF_INET addresses configured on the system. PR: 29337, 30524 Reviewed by: ru, jlemon Obtained from: NetBSD
2001-11-27 19:58:09 +00:00
if (ia == NULL) {
m_freem(m);
- Make ip_rtaddr() global, and use it to look up the correct source address in icmp_reflect(). - Two new "struct icmpstat" members: icps_badaddr and icps_noroute. PR: kern/31575 Obtained from: BSD/OS MFC after: 1 week
2001-11-30 10:40:28 +00:00
icmpstat.icps_noroute++;
In icmp_reflect(): If the packet was not addressed to us and was received on an interface without an IP address, try to find a non-loopback AF_INET address to use. If that fails, drop it. Previously, we used the address at the top of the in_ifaddrhead list, which didn't make much sense, and would cause a panic if there were no AF_INET addresses configured on the system. PR: 29337, 30524 Reviewed by: ru, jlemon Obtained from: NetBSD
2001-11-27 19:58:09 +00:00
goto done;
}
Add a hash table that contains the list of internet addresses, and use this in place of the in_ifaddr list when appropriate. This improves performance on hosts which have a large number of IP aliases.
2001-09-29 04:34:11 +00:00
match:
Introduce two new MAC Framework and MAC policy entry points: mac_reflect_mbuf_icmp() mac_reflect_mbuf_tcp() These entry points permit MAC policies to do "update in place" changes to the labels on ICMP and TCP mbuf headers when an ICMP or TCP response is generated to a packet outside of the context of an existing socket. For example, in respond to a ping or a RST packet to a SYN on a closed port. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-21 18:39:16 +00:00
#ifdef MAC
mac_reflect_mbuf_icmp(m);
#endif
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
t = IA_SIN(ia)->sin_addr;
ip->ip_src = t;
Make it possible to use IP_TTL and IP_TOS setsockopt(2) options on certain types of SOCK_RAW sockets. Also, use the ip.ttl MIB variable instead of MAXTTL constant as the default time-to-live value for outgoing IP packets all over the place, as we already do this for TCP and UDP. Reviewed by: wollman
2001-03-09 12:22:51 +00:00
ip->ip_ttl = ip_defttl;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
if (optlen > 0) {
register u_char *cp;
int opt, cnt;
u_int len;
/*
* Retrieve any source routing from the incoming packet;
* add on any record-route or timestamp options.
*/
cp = (u_char *) (ip + 1);
if ((opts = ip_srcroute()) == 0 &&
Back out M_* changes, per decision of the TRB. Approved by: trb
2003-02-19 05:47:46 +00:00
(opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
opts->m_len = sizeof(struct in_addr);
mtod(opts, struct in_addr *)->s_addr = 0;
}
if (opts) {
#ifdef ICMPPRINTFS
if (icmpprintfs)
printf("icmp_reflect optlen %d rt %d => ",
optlen, opts->m_len);
#endif
for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
opt = cp[IPOPT_OPTVAL];
if (opt == IPOPT_EOL)
break;
if (opt == IPOPT_NOP)
len = 1;
else {
Add boundary checks against IP options. Obtained from: OpenBSD
2000-06-02 20:18:38 +00:00
if (cnt < IPOPT_OLEN + sizeof(*cp))
break;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
len = cp[IPOPT_OLEN];
Add boundary checks against IP options. Obtained from: OpenBSD
2000-06-02 20:18:38 +00:00
if (len < IPOPT_OLEN + sizeof(*cp) ||
len > cnt)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
break;
}
/*
* Should check for overflow, but it "can't happen"
*/
Remove trailing whitespace.
1995-05-30 08:16:23 +00:00
if (opt == IPOPT_RR || opt == IPOPT_TS ||
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
opt == IPOPT_SECURITY) {
bcopy((caddr_t)cp,
mtod(opts, caddr_t) + opts->m_len, len);
opts->m_len += len;
}
}
/* Terminate & pad, if necessary */
GCC cleanup. Reviewed by: Submitted by: Obtained from:
1994-10-02 17:48:58 +00:00
cnt = opts->m_len % 4;
if (cnt) {
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
for (; cnt < 4; cnt++) {
*(mtod(opts, caddr_t) + opts->m_len) =
IPOPT_EOL;
opts->m_len++;
}
}
#ifdef ICMPPRINTFS
if (icmpprintfs)
printf("%d\n", opts->m_len);
#endif
}
/*
* Now strip out original options by copying rest of first
* mbuf's data back, and adjust the IP length.
*/
ip->ip_len -= optlen;
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
ip->ip_v = IPVERSION;
ip->ip_hl = 5;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
m->m_len -= optlen;
if (m->m_flags & M_PKTHDR)
m->m_pkthdr.len -= optlen;
optlen += sizeof(struct ip);
bcopy((caddr_t)ip + optlen, (caddr_t)(ip + 1),
(unsigned)(m->m_len - sizeof(struct ip)));
}
Introduce the notion of "persistent mbuf tags"; these are tags that stay with an mbuf until it is reclaimed. This is in contrast to tags that vanish when an mbuf chain passes through an interface. Persistent tags are used, for example, by MAC labels. Add an m_tag_delete_nonpersistent function to strip non-persistent tags from mbufs and use it to strip such tags from packets as they pass through the loopback interface and when turned around by icmp. This fixes problems with "tag leakage". Pointed out by: Jonathan Stone Reviewed by: Robert Watson
2003-10-29 05:40:07 +00:00
m_tag_delete_nonpersistent(m);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
m->m_flags &= ~(M_BCAST|M_MCAST);
Remove the global one-level rtcache variable and associated complex locking and rework ip_rtaddr() to do its own rtlookup. Adopt all its callers to this and make ip_output() callable with NULL rt pointer. Reviewed by: sam (mentor)
2003-11-14 21:48:57 +00:00
icmp_send(m, opts);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
done:
if (opts)
(void)m_free(opts);
}
/*
* Send an icmp packet back to the ip level,
* after supplying a checksum.
*/
New style sysctl & staticize alot of stuff.
1995-11-14 20:34:56 +00:00
static void
Remove the global one-level rtcache variable and associated complex locking and rework ip_rtaddr() to do its own rtlookup. Adopt all its callers to this and make ip_output() callable with NULL rt pointer. Reviewed by: sam (mentor)
2003-11-14 21:48:57 +00:00
icmp_send(m, opts)
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
register struct mbuf *m;
struct mbuf *opts;
{
register struct ip *ip = mtod(m, struct ip *);
register int hlen;
register struct icmp *icp;
Fix two instances of variant struct definitions in sys/netinet: Remove the never completed _IP_VHL version, it has not caught on anywhere and it would make us incompatible with other BSD netstacks to retain this version. Add a CTASSERT protecting sizeof(struct ip) == 20. Don't let the size of struct ipq depend on the IPDIVERT option. This is a functional no-op commit. Approved by: re
2002-10-20 22:52:07 +00:00
hlen = ip->ip_hl << 2;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
m->m_data += hlen;
m->m_len -= hlen;
icp = mtod(m, struct icmp *);
icp->icmp_cksum = 0;
icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
m->m_data -= hlen;
m->m_len += hlen;
When an incoming packet is reflected back as an ICMP reply, make sure we zero "m->m_pkthdr.rcvif", otherwise ipfw may wrongly match the outgoing packet. PR: kern/9723 Submitted by: David Malone <dwmalone@maths.tcd.ie>
1999-03-06 23:10:42 +00:00
m->m_pkthdr.rcvif = (struct ifnet *)0;
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#ifdef ICMPPRINTFS
Fix long-standing bug in ICMPPRINTFS code where NTOHL was used instead of ntohl for printing IP addresses, by instead substituting inet_ntoa() to produce human-readable output. Obtained from: 4.4-Lite-2
1995-08-29 17:49:04 +00:00
if (icmpprintfs) {
char buf[4 * sizeof "123"];
strcpy(buf, inet_ntoa(ip->ip_dst));
printf("icmp_send dst %s src %s\n",
buf, inet_ntoa(ip->ip_src));
}
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
#endif
Remove the global one-level rtcache variable and associated complex locking and rework ip_rtaddr() to do its own rtlookup. Adopt all its callers to this and make ip_output() callable with NULL rt pointer. Reviewed by: sam (mentor)
2003-11-14 21:48:57 +00:00
(void) ip_output(m, opts, NULL, 0, NULL, NULL);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
}
n_time
iptime()
{
struct timeval atv;
u_long t;
Use getmicrotime() instead of microtime() when timestamping ICMP packets, the former is quicker and accurate enough for use here. Submitted by: Jason Slagle <raistlin@toledolink.com> (on IRC) Reviewed by: phk
2000-12-16 21:39:48 +00:00
getmicrotime(&atv);
BSD 4.4 Lite Kernel Sources
1994-05-24 10:09:53 +00:00
t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
return (htonl(t));
}
Initial back-end support for IP MTU discovery, gated on MTUDISC. The support for TCP has yet to be written.
1995-09-18 15:51:40 +00:00
/*
* Return the next larger or smaller MTU plateau (table from RFC 1191)
* given current value MTU. If DIR is less than zero, a larger plateau
* is returned; otherwise, a smaller value is returned.
*/
Another mega commit to staticize things.
1995-12-14 09:55:16 +00:00
static int
Initial back-end support for IP MTU discovery, gated on MTUDISC. The support for TCP has yet to be written.
1995-09-18 15:51:40 +00:00
ip_next_mtu(mtu, dir)
int mtu;
int dir;
{
static int mtutab[] = {
65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
68, 0
};
int i;
for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
if (mtu >= mtutab[i])
break;
}
if (dir < 0) {
if (i == 0) {
return 0;
} else {
return mtutab[i - 1];
}
} else {
if (mtutab[i] == 0) {
return 0;
} else if(mtu > mtutab[i]) {
return mtutab[i];
} else {
return mtutab[i + 1];
}
}
}
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
/*
* badport_bandlim() - check for ICMP bandwidth limit
*
* Return 0 if it is ok to send an ICMP error response, -1 if we have
* hit our bandwidth limit and it is not ok.
*
* If icmplim is <= 0, the feature is disabled and 0 is returned.
*
* For now we separate the TCP and UDP subsystems w/ different 'which'
* values. We may eventually remove this separation (and simplify the
* code further).
*
* Note that the printing of the error message is delayed so we can
* properly print the icmp error rate that the system was trying to do
* (i.e. 22000/100 pps, etc...). This can cause long delays in printing
* the 'final' error, but it doesn't make sense to solve the printing
* delay with more complex code.
*/
int
badport_bandlim(int which)
{
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
#define N(a) (sizeof (a) / sizeof (a[0]))
static struct rate {
const char *type;
struct timeval lasttime;
Remove erroneous semicolons.
2004-07-13 16:06:19 +00:00
int curpps;
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
} rates[BANDLIM_MAX+1] = {
{ "icmp unreach response" },
{ "icmp ping response" },
{ "icmp tstamp response" },
{ "closed port RST response" },
{ "open port RST response" }
};
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
/*
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
* Return ok status if feature disabled or argument out of range.
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
*/
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
if (icmplim > 0 && (u_int) which < N(rates)) {
struct rate *r = &rates[which];
int opps = r->curpps;
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
if (!ppsratecheck(&r->lasttime, &r->curpps, icmplim))
return -1; /* discard packet */
/*
* If we've dropped below the threshold after having
* rate-limited traffic print the message. This preserves
* the previous behaviour at the expense of added complexity.
*/
correct style bogons
2002-12-30 18:45:31 +00:00
if (icmplim_output && opps > icmplim)
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
printf("Limiting %s from %d to %d packets/sec\n",
correct style bogons
2002-12-30 18:45:31 +00:00
r->type, opps, icmplim);
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
}
replace the special-purpose rate-limiting code with the general facility just added; this tries to maintain the same behaviour vis a vis printing the rate-limiting messages but need tweaking
2002-12-21 00:08:20 +00:00
return 0; /* okay to send packet */
#undef N
Reviewed by: freebsd-current Add ICMP_BANDLIM option and 'net.inet.icmp.icmplim' sysctl. If option is specified in kernel config, icmplim defaults to 100 pps. Setting it to 0 will disable the feature. This feature limits ICMP error responses for packets sent to bad tcp or udp ports, which does a lot to help the machine handle network D.O.S. attacks. The kernel will report packet rates that exceed the limit at a rate of one kernel printf per second. There is one issue in regards to the 'tail end' of an attack... the kernel will not output the last report until some unrelated and valid icmp error packet is return at some point after the attack is over. This is a minor reporting issue only.
1998-12-03 20:23:21 +00:00
}
Reference in New Issue Copy Permalink