icmp.c 27.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3
/*
 *	NET3:	Implementation of the ICMP protocol layer.
 *
4
 *		Alan Cox, <alan@lxorguk.ukuu.org.uk>
L
Linus Torvalds 已提交
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 *
 *	Some of the function names and the icmp unreach table for this
 *	module were derived from [icmp.c 1.0.11 06/02/93] by
 *	Ross Biro, Fred N. van Kempen, Mark Evans, Alan Cox, Gerhard Koerting.
 *	Other than that this module is a complete rewrite.
 *
 *	Fixes:
 *	Clemens Fruhwirth	:	introduce global icmp rate limiting
 *					with icmp type masking ability instead
 *					of broken per type icmp timeouts.
 *		Mike Shaver	:	RFC1122 checks.
 *		Alan Cox	:	Multicast ping reply as self.
 *		Alan Cox	:	Fix atomicity lockup in ip_build_xmit
 *					call.
 *		Alan Cox	:	Added 216,128 byte paths to the MTU
 *					code.
 *		Martin Mares	:	RFC1812 checks.
 *		Martin Mares	:	Can be configured to follow redirects
 *					if acting as a router _without_ a
 *					routing protocol (RFC 1812).
 *		Martin Mares	:	Echo requests may be configured to
 *					be ignored (RFC 1812).
 *		Martin Mares	:	Limitation of ICMP error message
 *					transmit rate (RFC 1812).
 *		Martin Mares	:	TOS and Precedence set correctly
 *					(RFC 1812).
 *		Martin Mares	:	Now copying as much data from the
 *					original packet as we can without
 *					exceeding 576 bytes (RFC 1812).
 *	Willy Konynenberg	:	Transparent proxying support.
 *		Keith Owens	:	RFC1191 correction for 4.2BSD based
 *					path MTU bug.
 *		Thomas Quinot	:	ICMP Dest Unreach codes up to 15 are
 *					valid (RFC 1812).
 *		Andi Kleen	:	Check all packet lengths properly
 *					and moved all kfree_skb() up to
 *					icmp_rcv.
 *		Andi Kleen	:	Move the rate limit bookkeeping
 *					into the dest entry and use a token
 *					bucket filter (thanks to ANK). Make
 *					the rates sysctl configurable.
 *		Yu Tianli	:	Fixed two ugly bugs in icmp_send
 *					- IP option length was accounted wrongly
 *					- ICMP header length was not accounted
 *					  at all.
 *              Tristan Greaves :       Added sysctl option to ignore bogus
 *              			broadcast responses from broken routers.
 *
 * To Fix:
 *
 *	- Should use skb_pull() instead of all the manual checking.
 *	  This would also greatly simply some upper layer error handlers. --AK
 *
 */

65 66
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
67 68 69 70 71 72 73 74
#include <linux/module.h>
#include <linux/types.h>
#include <linux/jiffies.h>
#include <linux/kernel.h>
#include <linux/fcntl.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/inet.h>
75
#include <linux/inetdevice.h>
L
Linus Torvalds 已提交
76 77 78
#include <linux/netdevice.h>
#include <linux/string.h>
#include <linux/netfilter_ipv4.h>
79
#include <linux/slab.h>
L
Linus Torvalds 已提交
80 81 82 83 84 85 86 87
#include <net/snmp.h>
#include <net/ip.h>
#include <net/route.h>
#include <net/protocol.h>
#include <net/icmp.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <net/raw.h>
88
#include <net/ping.h>
L
Linus Torvalds 已提交
89 90 91 92 93 94 95
#include <linux/skbuff.h>
#include <net/sock.h>
#include <linux/errno.h>
#include <linux/timer.h>
#include <linux/init.h>
#include <asm/uaccess.h>
#include <net/checksum.h>
96
#include <net/xfrm.h>
97
#include <net/inet_common.h>
98
#include <net/ip_fib.h>
L
Linus Torvalds 已提交
99 100 101 102 103 104 105 106 107 108 109 110

/*
 *	Build xmit assembly blocks
 */

struct icmp_bxm {
	struct sk_buff *skb;
	int offset;
	int data_len;

	struct {
		struct icmphdr icmph;
111
		__be32	       times[3];
L
Linus Torvalds 已提交
112 113
	} data;
	int head_len;
114
	struct ip_options_data replyopts;
L
Linus Torvalds 已提交
115 116 117 118 119
};

/* An array of errno for error messages from dest unreach. */
/* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */

120
const struct icmp_err icmp_err_convert[] = {
L
Linus Torvalds 已提交
121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
	{
		.errno = ENETUNREACH,	/* ICMP_NET_UNREACH */
		.fatal = 0,
	},
	{
		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNREACH */
		.fatal = 0,
	},
	{
		.errno = ENOPROTOOPT	/* ICMP_PROT_UNREACH */,
		.fatal = 1,
	},
	{
		.errno = ECONNREFUSED,	/* ICMP_PORT_UNREACH */
		.fatal = 1,
	},
	{
		.errno = EMSGSIZE,	/* ICMP_FRAG_NEEDED */
		.fatal = 0,
	},
	{
		.errno = EOPNOTSUPP,	/* ICMP_SR_FAILED */
		.fatal = 0,
	},
	{
		.errno = ENETUNREACH,	/* ICMP_NET_UNKNOWN */
		.fatal = 1,
	},
	{
		.errno = EHOSTDOWN,	/* ICMP_HOST_UNKNOWN */
		.fatal = 1,
	},
	{
		.errno = ENONET,	/* ICMP_HOST_ISOLATED */
		.fatal = 1,
	},
	{
		.errno = ENETUNREACH,	/* ICMP_NET_ANO	*/
		.fatal = 1,
	},
	{
		.errno = EHOSTUNREACH,	/* ICMP_HOST_ANO */
		.fatal = 1,
	},
	{
		.errno = ENETUNREACH,	/* ICMP_NET_UNR_TOS */
		.fatal = 0,
	},
	{
		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNR_TOS */
		.fatal = 0,
	},
	{
		.errno = EHOSTUNREACH,	/* ICMP_PKT_FILTERED */
		.fatal = 1,
	},
	{
		.errno = EHOSTUNREACH,	/* ICMP_PREC_VIOLATION */
		.fatal = 1,
	},
	{
		.errno = EHOSTUNREACH,	/* ICMP_PREC_CUTOFF */
		.fatal = 1,
	},
};
E
Eric Dumazet 已提交
186
EXPORT_SYMBOL(icmp_err_convert);
L
Linus Torvalds 已提交
187 188 189 190 191 192 193 194 195 196

/*
 *	ICMP control array. This specifies what to do with each ICMP.
 */

struct icmp_control {
	void (*handler)(struct sk_buff *skb);
	short   error;		/* This ICMP is classed as an error message */
};

197
static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
L
Linus Torvalds 已提交
198 199 200 201 202 203 204 205

/*
 *	The ICMP socket(s). This is the most convenient way to flow control
 *	our ICMP output as well as maintain a clean interface throughout
 *	all layers. All Socketless IP sends will soon be gone.
 *
 *	On SMP we have one ICMP socket per-cpu.
 */
206 207 208 209
static struct sock *icmp_sk(struct net *net)
{
	return net->ipv4.icmp_sk[smp_processor_id()];
}
L
Linus Torvalds 已提交
210

211
static inline struct sock *icmp_xmit_lock(struct net *net)
L
Linus Torvalds 已提交
212
{
213 214
	struct sock *sk;

L
Linus Torvalds 已提交
215 216
	local_bh_disable();

217 218
	sk = icmp_sk(net);

219
	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
L
Linus Torvalds 已提交
220 221 222 223
		/* This can happen if the output path signals a
		 * dst_link_failure() for an outgoing ICMP packet.
		 */
		local_bh_enable();
224
		return NULL;
L
Linus Torvalds 已提交
225
	}
226
	return sk;
L
Linus Torvalds 已提交
227 228
}

229
static inline void icmp_xmit_unlock(struct sock *sk)
L
Linus Torvalds 已提交
230
{
231
	spin_unlock_bh(&sk->sk_lock.slock);
L
Linus Torvalds 已提交
232 233 234 235 236 237
}

/*
 *	Send an ICMP frame.
 */

238
static inline bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
239
				      struct flowi4 *fl4, int type, int code)
L
Linus Torvalds 已提交
240
{
241
	struct dst_entry *dst = &rt->dst;
242
	bool rc = true;
L
Linus Torvalds 已提交
243 244 245 246 247 248 249 250 251 252

	if (type > NR_ICMP_TYPES)
		goto out;

	/* Don't limit PMTU discovery. */
	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
		goto out;

	/* No rate limit on loopback */
	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
253
		goto out;
L
Linus Torvalds 已提交
254 255

	/* Limit if icmp type is enabled in ratemask. */
256
	if ((1 << type) & net->ipv4.sysctl_icmp_ratemask) {
257
		struct inet_peer *peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, 1);
258
		rc = inet_peer_xrlim_allow(peer,
259
					   net->ipv4.sysctl_icmp_ratelimit);
260 261
		if (peer)
			inet_putpeer(peer);
262
	}
L
Linus Torvalds 已提交
263 264 265 266 267 268 269
out:
	return rc;
}

/*
 *	Maintain the counters used in the SNMP statistics for outgoing ICMP
 */
270
void icmp_out_count(struct net *net, unsigned char type)
L
Linus Torvalds 已提交
271
{
272
	ICMPMSGOUT_INC_STATS(net, type);
273
	ICMP_INC_STATS(net, ICMP_MIB_OUTMSGS);
L
Linus Torvalds 已提交
274 275 276 277 278 279 280 281 282 283
}

/*
 *	Checksum each fragment, and on the first include the headers and final
 *	checksum.
 */
static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
			  struct sk_buff *skb)
{
	struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
284
	__wsum csum;
L
Linus Torvalds 已提交
285 286 287 288 289 290 291 292 293 294 295 296

	csum = skb_copy_and_csum_bits(icmp_param->skb,
				      icmp_param->offset + offset,
				      to, len, 0);

	skb->csum = csum_block_add(skb->csum, csum, odd);
	if (icmp_pointers[icmp_param->data.icmph.type].error)
		nf_ct_attach(skb, icmp_param->skb);
	return 0;
}

static void icmp_push_reply(struct icmp_bxm *icmp_param,
297
			    struct flowi4 *fl4,
298
			    struct ipcm_cookie *ipc, struct rtable **rt)
L
Linus Torvalds 已提交
299
{
300
	struct sock *sk;
L
Linus Torvalds 已提交
301 302
	struct sk_buff *skb;

303
	sk = icmp_sk(dev_net((*rt)->dst.dev));
304
	if (ip_append_data(sk, fl4, icmp_glue_bits, icmp_param,
305 306
			   icmp_param->data_len+icmp_param->head_len,
			   icmp_param->head_len,
E
Eric Dumazet 已提交
307 308
			   ipc, rt, MSG_DONTWAIT) < 0) {
		ICMP_INC_STATS_BH(sock_net(sk), ICMP_MIB_OUTERRORS);
309
		ip_flush_pending_frames(sk);
E
Eric Dumazet 已提交
310
	} else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
311
		struct icmphdr *icmph = icmp_hdr(skb);
312
		__wsum csum = 0;
L
Linus Torvalds 已提交
313 314
		struct sk_buff *skb1;

315
		skb_queue_walk(&sk->sk_write_queue, skb1) {
L
Linus Torvalds 已提交
316 317 318 319 320 321 322
			csum = csum_add(csum, skb1->csum);
		}
		csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
						 (char *)icmph,
						 icmp_param->head_len, csum);
		icmph->checksum = csum_fold(csum);
		skb->ip_summed = CHECKSUM_NONE;
323
		ip_push_pending_frames(sk, fl4);
L
Linus Torvalds 已提交
324 325 326 327 328 329 330 331 332 333
	}
}

/*
 *	Driving logic for building and sending ICMP messages.
 */

static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
{
	struct ipcm_cookie ipc;
E
Eric Dumazet 已提交
334
	struct rtable *rt = skb_rtable(skb);
335
	struct net *net = dev_net(rt->dst.dev);
336
	struct flowi4 fl4;
337 338
	struct sock *sk;
	struct inet_sock *inet;
339
	__be32 daddr, saddr;
L
Linus Torvalds 已提交
340

341
	if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
342
		return;
L
Linus Torvalds 已提交
343

344 345
	sk = icmp_xmit_lock(net);
	if (sk == NULL)
L
Linus Torvalds 已提交
346
		return;
347
	inet = inet_sk(sk);
L
Linus Torvalds 已提交
348 349 350

	icmp_param->data.icmph.checksum = 0;

351
	inet->tos = ip_hdr(skb)->tos;
352
	daddr = ipc.addr = ip_hdr(skb)->saddr;
353
	saddr = fib_compute_spec_dst(skb);
L
Linus Torvalds 已提交
354
	ipc.opt = NULL;
355
	ipc.tx_flags = 0;
356 357 358
	ipc.ttl = 0;
	ipc.tos = -1;

359 360 361 362
	if (icmp_param->replyopts.opt.opt.optlen) {
		ipc.opt = &icmp_param->replyopts.opt;
		if (ipc.opt->opt.srr)
			daddr = icmp_param->replyopts.opt.opt.faddr;
L
Linus Torvalds 已提交
363
	}
364 365
	memset(&fl4, 0, sizeof(fl4));
	fl4.daddr = daddr;
366
	fl4.saddr = saddr;
367 368 369 370 371 372
	fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
	fl4.flowi4_proto = IPPROTO_ICMP;
	security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
	rt = ip_route_output_key(net, &fl4);
	if (IS_ERR(rt))
		goto out_unlock;
373
	if (icmpv4_xrlim_allow(net, rt, &fl4, icmp_param->data.icmph.type,
L
Linus Torvalds 已提交
374
			       icmp_param->data.icmph.code))
375
		icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
L
Linus Torvalds 已提交
376 377
	ip_rt_put(rt);
out_unlock:
378
	icmp_xmit_unlock(sk);
L
Linus Torvalds 已提交
379 380
}

381 382 383
static struct rtable *icmp_route_lookup(struct net *net,
					struct flowi4 *fl4,
					struct sk_buff *skb_in,
384
					const struct iphdr *iph,
385 386 387 388 389
					__be32 saddr, u8 tos,
					int type, int code,
					struct icmp_bxm *param)
{
	struct rtable *rt, *rt2;
390
	struct flowi4 fl4_dec;
391 392
	int err;

393 394 395 396 397 398 399 400 401 402
	memset(fl4, 0, sizeof(*fl4));
	fl4->daddr = (param->replyopts.opt.opt.srr ?
		      param->replyopts.opt.opt.faddr : iph->saddr);
	fl4->saddr = saddr;
	fl4->flowi4_tos = RT_TOS(tos);
	fl4->flowi4_proto = IPPROTO_ICMP;
	fl4->fl4_icmp_type = type;
	fl4->fl4_icmp_code = code;
	security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
	rt = __ip_route_output_key(net, fl4);
403 404
	if (IS_ERR(rt))
		return rt;
405 406 407 408

	/* No need to clone since we're just using its address. */
	rt2 = rt;

409
	rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
410
					   flowi4_to_flowi(fl4), NULL, 0);
411
	if (!IS_ERR(rt)) {
412 413
		if (rt != rt2)
			return rt;
414
	} else if (PTR_ERR(rt) == -EPERM) {
415
		rt = NULL;
416 417
	} else
		return rt;
418

419
	err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
420 421 422
	if (err)
		goto relookup_failed;

423 424
	if (inet_addr_type(net, fl4_dec.saddr) == RTN_LOCAL) {
		rt2 = __ip_route_output_key(net, &fl4_dec);
425 426
		if (IS_ERR(rt2))
			err = PTR_ERR(rt2);
427
	} else {
428
		struct flowi4 fl4_2 = {};
429 430
		unsigned long orefdst;

431
		fl4_2.daddr = fl4_dec.saddr;
432
		rt2 = ip_route_output_key(net, &fl4_2);
433 434
		if (IS_ERR(rt2)) {
			err = PTR_ERR(rt2);
435
			goto relookup_failed;
436
		}
437 438
		/* Ugh! */
		orefdst = skb_in->_skb_refdst; /* save old refdst */
439
		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
440 441 442 443 444 445 446 447 448 449
				     RT_TOS(tos), rt2->dst.dev);

		dst_release(&rt2->dst);
		rt2 = skb_rtable(skb_in);
		skb_in->_skb_refdst = orefdst; /* restore old refdst */
	}

	if (err)
		goto relookup_failed;

450
	rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
451
					    flowi4_to_flowi(&fl4_dec), NULL,
452
					    XFRM_LOOKUP_ICMP);
453
	if (!IS_ERR(rt2)) {
454
		dst_release(&rt->dst);
455
		memcpy(fl4, &fl4_dec, sizeof(*fl4));
456
		rt = rt2;
457 458 459 460 461 462 463
	} else if (PTR_ERR(rt2) == -EPERM) {
		if (rt)
			dst_release(&rt->dst);
		return rt2;
	} else {
		err = PTR_ERR(rt2);
		goto relookup_failed;
464 465 466 467 468 469 470 471
	}
	return rt;

relookup_failed:
	if (rt)
		return rt;
	return ERR_PTR(err);
}
L
Linus Torvalds 已提交
472 473 474 475 476 477 478 479 480 481 482 483

/*
 *	Send an ICMP message in response to a situation
 *
 *	RFC 1122: 3.2.2	MUST send at least the IP header and 8 bytes of header.
 *		  MAY send more (we do).
 *			MUST NOT change this header information.
 *			MUST NOT reply to a multicast/broadcast IP address.
 *			MUST NOT reply to a multicast/broadcast MAC address.
 *			MUST reply to only the first fragment.
 */

A
Al Viro 已提交
484
void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
L
Linus Torvalds 已提交
485 486 487
{
	struct iphdr *iph;
	int room;
488
	struct icmp_bxm *icmp_param;
E
Eric Dumazet 已提交
489
	struct rtable *rt = skb_rtable(skb_in);
L
Linus Torvalds 已提交
490
	struct ipcm_cookie ipc;
491
	struct flowi4 fl4;
A
Al Viro 已提交
492
	__be32 saddr;
L
Linus Torvalds 已提交
493
	u8  tos;
494
	struct net *net;
495
	struct sock *sk;
L
Linus Torvalds 已提交
496 497 498

	if (!rt)
		goto out;
499
	net = dev_net(rt->dst.dev);
L
Linus Torvalds 已提交
500 501 502 503 504 505

	/*
	 *	Find the original header. It is expected to be valid, of course.
	 *	Check this, icmp_send is called from the most obscure devices
	 *	sometimes.
	 */
506
	iph = ip_hdr(skb_in);
L
Linus Torvalds 已提交
507

508
	if ((u8 *)iph < skb_in->head ||
509 510
	    (skb_network_header(skb_in) + sizeof(*iph)) >
	    skb_tail_pointer(skb_in))
L
Linus Torvalds 已提交
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543
		goto out;

	/*
	 *	No replies to physical multicast/broadcast
	 */
	if (skb_in->pkt_type != PACKET_HOST)
		goto out;

	/*
	 *	Now check at the protocol level
	 */
	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
		goto out;

	/*
	 *	Only reply to fragment 0. We byte re-order the constant
	 *	mask for efficiency.
	 */
	if (iph->frag_off & htons(IP_OFFSET))
		goto out;

	/*
	 *	If we send an ICMP error to an ICMP error a mess would result..
	 */
	if (icmp_pointers[type].error) {
		/*
		 *	We are an error, check if we are replying to an
		 *	ICMP error
		 */
		if (iph->protocol == IPPROTO_ICMP) {
			u8 _inner_type, *itp;

			itp = skb_header_pointer(skb_in,
544
						 skb_network_header(skb_in) +
L
Linus Torvalds 已提交
545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563
						 (iph->ihl << 2) +
						 offsetof(struct icmphdr,
							  type) -
						 skb_in->data,
						 sizeof(_inner_type),
						 &_inner_type);
			if (itp == NULL)
				goto out;

			/*
			 *	Assume any unknown ICMP type is an error. This
			 *	isn't specified by the RFC, but think about it..
			 */
			if (*itp > NR_ICMP_TYPES ||
			    icmp_pointers[*itp].error)
				goto out;
		}
	}

564 565 566 567
	icmp_param = kmalloc(sizeof(*icmp_param), GFP_ATOMIC);
	if (!icmp_param)
		return;

568 569
	sk = icmp_xmit_lock(net);
	if (sk == NULL)
570
		goto out_free;
L
Linus Torvalds 已提交
571 572 573 574 575 576

	/*
	 *	Construct source address and options.
	 */

	saddr = iph->daddr;
577
	if (!(rt->rt_flags & RTCF_LOCAL)) {
578 579
		struct net_device *dev = NULL;

580
		rcu_read_lock();
581 582
		if (rt_is_input_route(rt) &&
		    net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
583
			dev = dev_get_by_index_rcu(net, inet_iif(skb_in));
584

585
		if (dev)
586
			saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
587
		else
588
			saddr = 0;
589
		rcu_read_unlock();
590
	}
L
Linus Torvalds 已提交
591 592 593 594 595

	tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
					   IPTOS_PREC_INTERNETCONTROL) :
					  iph->tos;

596
	if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb_in))
597
		goto out_unlock;
L
Linus Torvalds 已提交
598 599 600 601 602 603


	/*
	 *	Prepare data for ICMP header.
	 */

604 605 606 607 608 609
	icmp_param->data.icmph.type	 = type;
	icmp_param->data.icmph.code	 = code;
	icmp_param->data.icmph.un.gateway = info;
	icmp_param->data.icmph.checksum	 = 0;
	icmp_param->skb	  = skb_in;
	icmp_param->offset = skb_network_offset(skb_in);
610
	inet_sk(sk)->tos = tos;
L
Linus Torvalds 已提交
611
	ipc.addr = iph->saddr;
612
	ipc.opt = &icmp_param->replyopts.opt;
613
	ipc.tx_flags = 0;
614 615
	ipc.ttl = 0;
	ipc.tos = -1;
L
Linus Torvalds 已提交
616

617
	rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos,
618
			       type, code, icmp_param);
619 620
	if (IS_ERR(rt))
		goto out_unlock;
L
Linus Torvalds 已提交
621

622
	if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code))
L
Linus Torvalds 已提交
623 624 625 626
		goto ende;

	/* RFC says return as much as we can without exceeding 576 bytes. */

627
	room = dst_mtu(&rt->dst);
L
Linus Torvalds 已提交
628 629
	if (room > 576)
		room = 576;
630
	room -= sizeof(struct iphdr) + icmp_param->replyopts.opt.opt.optlen;
L
Linus Torvalds 已提交
631 632
	room -= sizeof(struct icmphdr);

633 634 635 636
	icmp_param->data_len = skb_in->len - icmp_param->offset;
	if (icmp_param->data_len > room)
		icmp_param->data_len = room;
	icmp_param->head_len = sizeof(struct icmphdr);
L
Linus Torvalds 已提交
637

638
	icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
L
Linus Torvalds 已提交
639 640 641
ende:
	ip_rt_put(rt);
out_unlock:
642
	icmp_xmit_unlock(sk);
643 644
out_free:
	kfree(icmp_param);
L
Linus Torvalds 已提交
645 646
out:;
}
E
Eric Dumazet 已提交
647
EXPORT_SYMBOL(icmp_send);
L
Linus Torvalds 已提交
648 649


650 651 652 653 654 655
static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
{
	const struct iphdr *iph = (const struct iphdr *) skb->data;
	const struct net_protocol *ipprot;
	int protocol = iph->protocol;

656 657 658 659 660 661
	/* Checkin full IP header plus 8 bytes of protocol to
	 * avoid additional coding at protocol handlers.
	 */
	if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
		return;

662 663 664 665 666 667 668 669 670
	raw_icmp_error(skb, protocol, info);

	rcu_read_lock();
	ipprot = rcu_dereference(inet_protos[protocol]);
	if (ipprot && ipprot->err_handler)
		ipprot->err_handler(skb, info);
	rcu_read_unlock();
}

671 672 673 674 675 676 677 678 679 680
static bool icmp_tag_validation(int proto)
{
	bool ok;

	rcu_read_lock();
	ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
	rcu_read_unlock();
	return ok;
}

L
Linus Torvalds 已提交
681
/*
R
Rami Rosen 已提交
682 683
 *	Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
 *	ICMP_PARAMETERPROB.
L
Linus Torvalds 已提交
684 685 686 687
 */

static void icmp_unreach(struct sk_buff *skb)
{
688
	const struct iphdr *iph;
L
Linus Torvalds 已提交
689
	struct icmphdr *icmph;
690
	struct net *net;
691
	u32 info = 0;
692

E
Eric Dumazet 已提交
693
	net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
694 695 696 697 698 699 700 701 702 703

	/*
	 *	Incomplete header ?
	 * 	Only checks for the IP header, there should be an
	 *	additional check for longer headers in upper levels.
	 */

	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
		goto out_err;

704
	icmph = icmp_hdr(skb);
705
	iph   = (const struct iphdr *)skb->data;
L
Linus Torvalds 已提交
706 707 708 709 710 711 712 713 714 715 716 717

	if (iph->ihl < 5) /* Mangled header, drop. */
		goto out_err;

	if (icmph->type == ICMP_DEST_UNREACH) {
		switch (icmph->code & 15) {
		case ICMP_NET_UNREACH:
		case ICMP_HOST_UNREACH:
		case ICMP_PROT_UNREACH:
		case ICMP_PORT_UNREACH:
			break;
		case ICMP_FRAG_NEEDED:
718 719 720 721 722 723
			/* for documentation of the ip_no_pmtu_disc
			 * values please see
			 * Documentation/networking/ip-sysctl.txt
			 */
			switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
			default:
724
				LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
725
					       &iph->daddr);
726 727 728 729 730 731 732 733
				break;
			case 2:
				goto out;
			case 3:
				if (!icmp_tag_validation(iph->protocol))
					goto out;
				/* fall through */
			case 0:
734
				info = ntohs(icmph->un.frag.mtu);
L
Linus Torvalds 已提交
735 736 737 738 739
				if (!info)
					goto out;
			}
			break;
		case ICMP_SR_FAILED:
740
			LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: Source Route Failed\n"),
741
				       &iph->daddr);
L
Linus Torvalds 已提交
742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762
			break;
		default:
			break;
		}
		if (icmph->code > NR_ICMP_UNREACH)
			goto out;
	} else if (icmph->type == ICMP_PARAMETERPROB)
		info = ntohl(icmph->un.gateway) >> 24;

	/*
	 *	Throw it at our lower layers
	 *
	 *	RFC 1122: 3.2.2 MUST extract the protocol ID from the passed
	 *		  header.
	 *	RFC 1122: 3.2.2.1 MUST pass ICMP unreach messages to the
	 *		  transport layer.
	 *	RFC 1122: 3.2.2.2 MUST pass ICMP time expired messages to
	 *		  transport layer.
	 */

	/*
L
Lucas De Marchi 已提交
763
	 *	Check the other end isn't violating RFC 1122. Some routers send
L
Linus Torvalds 已提交
764 765 766 767 768
	 *	bogus responses to broadcast frames. If you see this message
	 *	first check your netmask matches at both ends, if it does then
	 *	get the other vendor to fix their kit.
	 */

769
	if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses &&
770
	    inet_addr_type(net, iph->daddr) == RTN_BROADCAST) {
771 772 773 774
		net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n",
				     &ip_hdr(skb)->saddr,
				     icmph->type, icmph->code,
				     &iph->daddr, skb->dev->name);
L
Linus Torvalds 已提交
775 776 777
		goto out;
	}

778
	icmp_socket_deliver(skb, info);
L
Linus Torvalds 已提交
779 780 781 782

out:
	return;
out_err:
783
	ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
L
Linus Torvalds 已提交
784 785 786 787 788 789 790 791 792 793
	goto out;
}


/*
 *	Handle ICMP_REDIRECT.
 */

static void icmp_redirect(struct sk_buff *skb)
{
794 795 796 797
	if (skb->len < sizeof(struct iphdr)) {
		ICMP_INC_STATS_BH(dev_net(skb->dev), ICMP_MIB_INERRORS);
		return;
	}
L
Linus Torvalds 已提交
798 799

	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
800
		return;
801

802
	icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway);
L
Linus Torvalds 已提交
803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818
}

/*
 *	Handle ICMP_ECHO ("ping") requests.
 *
 *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
 *		  requests.
 *	RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
 *		  included in the reply.
 *	RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
 *		  echo requests, MUST have default=NOT.
 *	See also WRT handling of options once they are done and working.
 */

static void icmp_echo(struct sk_buff *skb)
{
819 820
	struct net *net;

E
Eric Dumazet 已提交
821
	net = dev_net(skb_dst(skb)->dev);
822
	if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
L
Linus Torvalds 已提交
823 824
		struct icmp_bxm icmp_param;

825
		icmp_param.data.icmph	   = *icmp_hdr(skb);
L
Linus Torvalds 已提交
826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843
		icmp_param.data.icmph.type = ICMP_ECHOREPLY;
		icmp_param.skb		   = skb;
		icmp_param.offset	   = 0;
		icmp_param.data_len	   = skb->len;
		icmp_param.head_len	   = sizeof(struct icmphdr);
		icmp_reply(&icmp_param, skb);
	}
}

/*
 *	Handle ICMP Timestamp requests.
 *	RFC 1122: 3.2.2.8 MAY implement ICMP timestamp requests.
 *		  SHOULD be in the kernel for minimum random latency.
 *		  MUST be accurate to a few minutes.
 *		  MUST be updated at least at 15Hz.
 */
static void icmp_timestamp(struct sk_buff *skb)
{
844
	struct timespec tv;
L
Linus Torvalds 已提交
845 846 847 848 849 850 851 852 853 854
	struct icmp_bxm icmp_param;
	/*
	 *	Too short.
	 */
	if (skb->len < 4)
		goto out_err;

	/*
	 *	Fill in the current time as ms since midnight UT:
	 */
855 856 857
	getnstimeofday(&tv);
	icmp_param.data.times[1] = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC +
					 tv.tv_nsec / NSEC_PER_MSEC);
L
Linus Torvalds 已提交
858 859 860
	icmp_param.data.times[2] = icmp_param.data.times[1];
	if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
		BUG();
861
	icmp_param.data.icmph	   = *icmp_hdr(skb);
L
Linus Torvalds 已提交
862 863 864 865 866 867 868 869 870 871
	icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
	icmp_param.data.icmph.code = 0;
	icmp_param.skb		   = skb;
	icmp_param.offset	   = 0;
	icmp_param.data_len	   = 0;
	icmp_param.head_len	   = sizeof(struct icmphdr) + 12;
	icmp_reply(&icmp_param, skb);
out:
	return;
out_err:
E
Eric Dumazet 已提交
872
	ICMP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
L
Linus Torvalds 已提交
873 874 875 876 877 878 879 880 881 882 883 884 885
	goto out;
}

static void icmp_discard(struct sk_buff *skb)
{
}

/*
 *	Deal with incoming ICMP packets.
 */
int icmp_rcv(struct sk_buff *skb)
{
	struct icmphdr *icmph;
E
Eric Dumazet 已提交
886
	struct rtable *rt = skb_rtable(skb);
887
	struct net *net = dev_net(rt->dst.dev);
L
Linus Torvalds 已提交
888

889
	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
890
		struct sec_path *sp = skb_sec_path(skb);
891 892
		int nh;

893
		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
894 895 896
				 XFRM_STATE_ICMP))
			goto drop;

897 898 899 900 901 902 903 904 905 906 907 908
		if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
			goto drop;

		nh = skb_network_offset(skb);
		skb_set_network_header(skb, sizeof(*icmph));

		if (!xfrm4_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
			goto drop;

		skb_set_network_header(skb, nh);
	}

909
	ICMP_INC_STATS_BH(net, ICMP_MIB_INMSGS);
L
Linus Torvalds 已提交
910 911

	switch (skb->ip_summed) {
912
	case CHECKSUM_COMPLETE:
913
		if (!csum_fold(skb->csum))
L
Linus Torvalds 已提交
914
			break;
915
		/* fall through */
L
Linus Torvalds 已提交
916
	case CHECKSUM_NONE:
917 918
		skb->csum = 0;
		if (__skb_checksum_complete(skb))
919
			goto csum_error;
L
Linus Torvalds 已提交
920 921
	}

922 923
	if (!pskb_pull(skb, sizeof(*icmph)))
		goto error;
L
Linus Torvalds 已提交
924

925
	icmph = icmp_hdr(skb);
L
Linus Torvalds 已提交
926

927
	ICMPMSGIN_INC_STATS_BH(net, icmph->type);
L
Linus Torvalds 已提交
928 929 930 931 932 933 934 935 936 937 938 939 940 941
	/*
	 *	18 is the highest 'known' ICMP type. Anything else is a mystery
	 *
	 *	RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
	 *		  discarded.
	 */
	if (icmph->type > NR_ICMP_TYPES)
		goto error;


	/*
	 *	Parse the ICMP message
	 */

942
	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
L
Linus Torvalds 已提交
943 944 945 946 947 948
		/*
		 *	RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
		 *	  silently ignored (we let user decide with a sysctl).
		 *	RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
		 *	  discarded if to broadcast/multicast.
		 */
949 950
		if ((icmph->type == ICMP_ECHO ||
		     icmph->type == ICMP_TIMESTAMP) &&
951
		    net->ipv4.sysctl_icmp_echo_ignore_broadcasts) {
L
Linus Torvalds 已提交
952 953 954 955 956 957 958
			goto error;
		}
		if (icmph->type != ICMP_ECHO &&
		    icmph->type != ICMP_TIMESTAMP &&
		    icmph->type != ICMP_ADDRESS &&
		    icmph->type != ICMP_ADDRESSREPLY) {
			goto error;
959
		}
L
Linus Torvalds 已提交
960 961 962 963 964 965 966
	}

	icmp_pointers[icmph->type].handler(skb);

drop:
	kfree_skb(skb);
	return 0;
967 968
csum_error:
	ICMP_INC_STATS_BH(net, ICMP_MIB_CSUMERRORS);
L
Linus Torvalds 已提交
969
error:
970
	ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
L
Linus Torvalds 已提交
971 972 973
	goto drop;
}

974 975 976
void icmp_err(struct sk_buff *skb, u32 info)
{
	struct iphdr *iph = (struct iphdr *)skb->data;
977 978
	int offset = iph->ihl<<2;
	struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset);
979 980 981 982 983 984 985 986 987
	int type = icmp_hdr(skb)->type;
	int code = icmp_hdr(skb)->code;
	struct net *net = dev_net(skb->dev);

	/*
	 * Use ping_err to handle all icmp errors except those
	 * triggered by ICMP_ECHOREPLY which sent from kernel.
	 */
	if (icmph->type != ICMP_ECHOREPLY) {
988
		ping_err(skb, offset, info);
989 990 991 992 993 994 995 996 997
		return;
	}

	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ICMP, 0);
	else if (type == ICMP_REDIRECT)
		ipv4_redirect(skb, net, 0, 0, IPPROTO_ICMP, 0);
}

L
Linus Torvalds 已提交
998 999 1000
/*
 *	This table is the definition of how we handle ICMP.
 */
1001
static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
L
Linus Torvalds 已提交
1002
	[ICMP_ECHOREPLY] = {
1003
		.handler = ping_rcv,
L
Linus Torvalds 已提交
1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060
	},
	[1] = {
		.handler = icmp_discard,
		.error = 1,
	},
	[2] = {
		.handler = icmp_discard,
		.error = 1,
	},
	[ICMP_DEST_UNREACH] = {
		.handler = icmp_unreach,
		.error = 1,
	},
	[ICMP_SOURCE_QUENCH] = {
		.handler = icmp_unreach,
		.error = 1,
	},
	[ICMP_REDIRECT] = {
		.handler = icmp_redirect,
		.error = 1,
	},
	[6] = {
		.handler = icmp_discard,
		.error = 1,
	},
	[7] = {
		.handler = icmp_discard,
		.error = 1,
	},
	[ICMP_ECHO] = {
		.handler = icmp_echo,
	},
	[9] = {
		.handler = icmp_discard,
		.error = 1,
	},
	[10] = {
		.handler = icmp_discard,
		.error = 1,
	},
	[ICMP_TIME_EXCEEDED] = {
		.handler = icmp_unreach,
		.error = 1,
	},
	[ICMP_PARAMETERPROB] = {
		.handler = icmp_unreach,
		.error = 1,
	},
	[ICMP_TIMESTAMP] = {
		.handler = icmp_timestamp,
	},
	[ICMP_TIMESTAMPREPLY] = {
		.handler = icmp_discard,
	},
	[ICMP_INFO_REQUEST] = {
		.handler = icmp_discard,
	},
1061
	[ICMP_INFO_REPLY] = {
L
Linus Torvalds 已提交
1062 1063 1064
		.handler = icmp_discard,
	},
	[ICMP_ADDRESS] = {
1065
		.handler = icmp_discard,
L
Linus Torvalds 已提交
1066 1067
	},
	[ICMP_ADDRESSREPLY] = {
1068
		.handler = icmp_discard,
L
Linus Torvalds 已提交
1069 1070 1071
	},
};

1072
static void __net_exit icmp_sk_exit(struct net *net)
L
Linus Torvalds 已提交
1073 1074 1075
{
	int i;

1076
	for_each_possible_cpu(i)
1077
		inet_ctl_sock_destroy(net->ipv4.icmp_sk[i]);
1078 1079
	kfree(net->ipv4.icmp_sk);
	net->ipv4.icmp_sk = NULL;
1080
}
L
Linus Torvalds 已提交
1081

1082
static int __net_init icmp_sk_init(struct net *net)
1083 1084 1085
{
	int i, err;

1086 1087 1088
	net->ipv4.icmp_sk =
		kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
	if (net->ipv4.icmp_sk == NULL)
1089 1090
		return -ENOMEM;

1091
	for_each_possible_cpu(i) {
1092
		struct sock *sk;
L
Linus Torvalds 已提交
1093

1094 1095
		err = inet_ctl_sock_create(&sk, PF_INET,
					   SOCK_RAW, IPPROTO_ICMP, net);
L
Linus Torvalds 已提交
1096
		if (err < 0)
1097
			goto fail;
L
Linus Torvalds 已提交
1098

1099
		net->ipv4.icmp_sk[i] = sk;
L
Linus Torvalds 已提交
1100 1101

		/* Enough space for 2 64K ICMP packets, including
E
Eric Dumazet 已提交
1102
		 * sk_buff/skb_shared_info struct overhead.
L
Linus Torvalds 已提交
1103
		 */
E
Eric Dumazet 已提交
1104
		sk->sk_sndbuf =	2 * SKB_TRUESIZE(64 * 1024);
L
Linus Torvalds 已提交
1105

1106 1107 1108 1109
		/*
		 * Speedup sock_wfree()
		 */
		sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1110
		inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
L
Linus Torvalds 已提交
1111
	}
1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135

	/* Control parameters for ECHO replies. */
	net->ipv4.sysctl_icmp_echo_ignore_all = 0;
	net->ipv4.sysctl_icmp_echo_ignore_broadcasts = 1;

	/* Control parameter - ignore bogus broadcast responses? */
	net->ipv4.sysctl_icmp_ignore_bogus_error_responses = 1;

	/*
	 * 	Configurable global rate limit.
	 *
	 *	ratelimit defines tokens/packet consumed for dst->rate_token
	 *	bucket ratemask defines which icmp types are ratelimited by
	 *	setting	it's bit position.
	 *
	 *	default:
	 *	dest unreachable (3), source quench (4),
	 *	time exceeded (11), parameter problem (12)
	 */

	net->ipv4.sysctl_icmp_ratelimit = 1 * HZ;
	net->ipv4.sysctl_icmp_ratemask = 0x1818;
	net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;

1136 1137 1138
	return 0;

fail:
1139
	for_each_possible_cpu(i)
1140
		inet_ctl_sock_destroy(net->ipv4.icmp_sk[i]);
1141
	kfree(net->ipv4.icmp_sk);
1142
	return err;
L
Linus Torvalds 已提交
1143 1144
}

1145 1146 1147 1148 1149 1150 1151
static struct pernet_operations __net_initdata icmp_sk_ops = {
       .init = icmp_sk_init,
       .exit = icmp_sk_exit,
};

int __init icmp_init(void)
{
E
Eric W. Biederman 已提交
1152
	return register_pernet_subsys(&icmp_sk_ops);
1153
}