1 /* $NetBSD: t_ip_reass.c,v 1.2 2022/11/30 06:06:36 ozaki-r Exp $ */
2
3 /*-
4 * Copyright (c) 2018 The FreeBSD Foundation
5 *
6 * This software was developed by Mark Johnston under sponsorship from
7 * the FreeBSD Foundation.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions are
11 * met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 #include <sys/cdefs.h>
33
34 #ifdef __NetBSD__
35 __RCSID("$NetBSD: t_ip_reass.c,v 1.2 2022/11/30 06:06:36 ozaki-r Exp $");
36 #define USE_RUMPKERNEL 1
37 #else
38 __FBSDID("$FreeBSD$");
39 #endif
40
41 #include <sys/param.h>
42 #include <sys/ioctl.h>
43 #include <sys/socket.h>
44 #include <sys/sysctl.h>
45
46 #include <net/bpf.h>
47 #include <net/if.h>
48 #include <netinet/in.h>
49 #include <netinet/ip.h>
50 #include <netinet/ip_var.h>
51
52 #include <err.h>
53 #include <errno.h>
54 #include <fcntl.h>
55 #include <ifaddrs.h>
56 #include <stdint.h>
57 #include <stdlib.h>
58 #include <time.h>
59 #include <unistd.h>
60
61 #ifdef USE_RUMPKERNEL
62 #include <netinet/if_ether.h>
63 #include <rump/rump.h>
64 #include <rump/rump_syscalls.h>
65 #include "h_macros.h"
66
67 #define ioctl rump_sys_ioctl
68 #define close rump_sys_close
69 #define write rump_sys_write
70 #endif
71
72 #include <atf-c.h>
73
74 #ifdef __NetBSD__
75 struct ipstat {
76 uint64_t ips_ipstat[IP_NSTATS];
77 };
78 #endif
79
80 struct lopacket {
81 u_int family;
82 struct ip hdr;
83 char payload[];
84 };
85
86 static void
update_cksum(struct ip * ip)87 update_cksum(struct ip *ip)
88 {
89 size_t i;
90 uint32_t cksum;
91 uint16_t *cksump;
92
93 ip->ip_sum = 0;
94 cksump = (uint16_t *)ip;
95 for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++)
96 cksum += ntohs(*cksump);
97 cksum = (cksum >> 16) + (cksum & 0xffff);
98 cksum = ~(cksum + (cksum >> 16));
99 ip->ip_sum = htons((uint16_t)cksum);
100 }
101
102 static struct lopacket *
alloc_lopacket(in_addr_t dstaddr,size_t payloadlen)103 alloc_lopacket(in_addr_t dstaddr, size_t payloadlen)
104 {
105 struct ip *ip;
106 struct lopacket *packet;
107 size_t pktlen;
108
109 pktlen = sizeof(*packet) + payloadlen;
110 packet = malloc(pktlen);
111 ATF_REQUIRE(packet != NULL);
112
113 memset(packet, 0, pktlen);
114 packet->family = AF_INET;
115
116 ip = &packet->hdr;
117 ip->ip_hl = sizeof(struct ip) >> 2;
118 ip->ip_v = 4;
119 ip->ip_tos = 0;
120 ip->ip_len = htons(sizeof(*ip) + payloadlen);
121 ip->ip_id = 0;
122 ip->ip_off = 0;
123 ip->ip_ttl = 1;
124 ip->ip_p = IPPROTO_IP;
125 ip->ip_sum = 0;
126 ip->ip_src.s_addr = dstaddr;
127 ip->ip_dst.s_addr = dstaddr;
128 update_cksum(ip);
129
130 return (packet);
131 }
132
133 static void
free_lopacket(struct lopacket * packet)134 free_lopacket(struct lopacket *packet)
135 {
136
137 free(packet);
138 }
139
140 static void
write_lopacket(int bpffd,struct lopacket * packet)141 write_lopacket(int bpffd, struct lopacket *packet)
142 {
143 struct timespec ts;
144 ssize_t n;
145 size_t len;
146
147 len = sizeof(packet->family) + ntohs(packet->hdr.ip_len);
148 n = write(bpffd, packet, len);
149 ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno));
150 ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu",
151 n, len);
152
153 /*
154 * Loopback packets are dispatched asynchronously, give netisr some
155 * time.
156 */
157 ts.tv_sec = 0;
158 ts.tv_nsec = 5000000; /* 5ms */
159 (void)nanosleep(&ts, NULL);
160 }
161
162 static int
open_lobpf(in_addr_t * addrp)163 open_lobpf(in_addr_t *addrp)
164 {
165 struct ifreq ifr;
166 struct ifaddrs *ifa, *ifap;
167 int error, fd;
168
169 #ifdef USE_RUMPKERNEL
170 rump_init();
171 RL(fd = rump_sys_open("/dev/bpf", O_RDWR));
172 #else
173 fd = open("/dev/bpf0", O_RDWR);
174 if (fd < 0 && errno == ENOENT)
175 atf_tc_skip("no BPF device available");
176 ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno));
177 #endif
178
179 error = getifaddrs(&ifap);
180 ATF_REQUIRE(error == 0);
181 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
182 if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 &&
183 ifa->ifa_addr->sa_family == AF_INET)
184 break;
185 if (ifa == NULL)
186 atf_tc_skip("no loopback address found");
187
188 memset(&ifr, 0, sizeof(ifr));
189 strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ);
190 error = ioctl(fd, BIOCSETIF, &ifr);
191 ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno));
192
193 *addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr;
194
195 freeifaddrs(ifap);
196
197 return (fd);
198 }
199
200 static void
get_ipstat(struct ipstat * stat)201 get_ipstat(struct ipstat *stat)
202 {
203 size_t len;
204 int error;
205
206 memset(stat, 0, sizeof(*stat));
207 len = sizeof(*stat);
208 error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0);
209 ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s",
210 strerror(errno));
211 ATF_REQUIRE(len == sizeof(*stat));
212 }
213
214 #ifdef __NetBSD__
215 #define CHECK_IP_COUNTER(oldp, newp, counter) \
216 ATF_REQUIRE_MSG((oldp)->ips_ipstat[counter] < (newp)->ips_ipstat[counter], \
217 "ips_" #counter " wasn't incremented (%ju vs. %ju)", \
218 (uintmax_t)old.ips_ipstat[counter], (uintmax_t)new.ips_ipstat[counter]);
219 #define fragdropped IP_STAT_FRAGDROPPED
220 #define toosmall IP_STAT_TOOSMALL
221 #define toolong IP_STAT_TOOLONG
222 #define badfrags IP_STAT_BADFRAGS
223 #else
224 #define CHECK_IP_COUNTER(oldp, newp, counter) \
225 ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \
226 #counter " wasn't incremented (%ju vs. %ju)", \
227 (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter);
228 #endif
229
230 /*
231 * Make sure a fragment with MF set doesn't come after the last fragment of a
232 * packet. Make sure that multiple fragments with MF clear have the same offset
233 * and length.
234 */
235 ATF_TC(ip_reass__multiple_last_fragments);
ATF_TC_HEAD(ip_reass__multiple_last_fragments,tc)236 ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc)
237 {
238 atf_tc_set_md_var(tc, "require.user", "root");
239 }
ATF_TC_BODY(ip_reass__multiple_last_fragments,tc)240 ATF_TC_BODY(ip_reass__multiple_last_fragments, tc)
241 {
242 struct ipstat old, new;
243 struct ip *ip;
244 struct lopacket *packet1, *packet2, *packet3, *packet4;
245 in_addr_t addr;
246 int error, fd;
247 uint16_t ipid;
248
249 fd = open_lobpf(&addr);
250 ipid = arc4random_uniform(UINT16_MAX + 1);
251
252 packet1 = alloc_lopacket(addr, 16);
253 ip = &packet1->hdr;
254 ip->ip_id = ipid;
255 ip->ip_off = htons(0x10);
256 update_cksum(ip);
257
258 packet2 = alloc_lopacket(addr, 16);
259 ip = &packet2->hdr;
260 ip->ip_id = ipid;
261 ip->ip_off = htons(0x20);
262 update_cksum(ip);
263
264 packet3 = alloc_lopacket(addr, 16);
265 ip = &packet3->hdr;
266 ip->ip_id = ipid;
267 ip->ip_off = htons(0x8);
268 update_cksum(ip);
269
270 packet4 = alloc_lopacket(addr, 32);
271 ip = &packet4->hdr;
272 ip->ip_id = ipid;
273 ip->ip_off = htons(0x10);
274 update_cksum(ip);
275
276 write_lopacket(fd, packet1);
277
278 /* packet2 comes after packet1. */
279 get_ipstat(&old);
280 write_lopacket(fd, packet2);
281 get_ipstat(&new);
282 CHECK_IP_COUNTER(&old, &new, fragdropped);
283
284 /* packet2 comes after packet1 and has MF set. */
285 packet2->hdr.ip_off = htons(IP_MF | 0x20);
286 update_cksum(&packet2->hdr);
287 get_ipstat(&old);
288 write_lopacket(fd, packet2);
289 get_ipstat(&new);
290 CHECK_IP_COUNTER(&old, &new, fragdropped);
291
292 /* packet3 comes before packet1 but overlaps. */
293 get_ipstat(&old);
294 write_lopacket(fd, packet3);
295 get_ipstat(&new);
296 CHECK_IP_COUNTER(&old, &new, fragdropped);
297
298 /* packet4 has the same offset as packet1 but is longer. */
299 get_ipstat(&old);
300 write_lopacket(fd, packet4);
301 get_ipstat(&new);
302 CHECK_IP_COUNTER(&old, &new, fragdropped);
303
304 error = close(fd);
305 ATF_REQUIRE(error == 0);
306 free_lopacket(packet1);
307 free_lopacket(packet2);
308 free_lopacket(packet3);
309 free_lopacket(packet4);
310 }
311
312 /*
313 * Make sure that we reject zero-length fragments.
314 */
315 ATF_TC(ip_reass__zero_length_fragment);
ATF_TC_HEAD(ip_reass__zero_length_fragment,tc)316 ATF_TC_HEAD(ip_reass__zero_length_fragment, tc)
317 {
318 atf_tc_set_md_var(tc, "require.user", "root");
319 }
ATF_TC_BODY(ip_reass__zero_length_fragment,tc)320 ATF_TC_BODY(ip_reass__zero_length_fragment, tc)
321 {
322 struct ipstat old, new;
323 struct ip *ip;
324 struct lopacket *packet1, *packet2;
325 in_addr_t addr;
326 int error, fd;
327 uint16_t ipid;
328
329 fd = open_lobpf(&addr);
330 ipid = arc4random_uniform(UINT16_MAX + 1);
331
332 /*
333 * Create two packets, one with MF set, one without.
334 */
335 packet1 = alloc_lopacket(addr, 0);
336 ip = &packet1->hdr;
337 ip->ip_id = ipid;
338 ip->ip_off = htons(IP_MF | 0x10);
339 update_cksum(ip);
340
341 packet2 = alloc_lopacket(addr, 0);
342 ip = &packet2->hdr;
343 ip->ip_id = ~ipid;
344 ip->ip_off = htons(0x10);
345 update_cksum(ip);
346
347 get_ipstat(&old);
348 write_lopacket(fd, packet1);
349 get_ipstat(&new);
350 #ifdef __NetBSD__
351 CHECK_IP_COUNTER(&old, &new, badfrags);
352 #else
353 CHECK_IP_COUNTER(&old, &new, toosmall);
354 CHECK_IP_COUNTER(&old, &new, fragdropped);
355 #endif
356
357 get_ipstat(&old);
358 write_lopacket(fd, packet2);
359 get_ipstat(&new);
360 /* NetBSD doesn't reject a packet of zero length w/o MF */
361 #ifndef __NetBSD__
362 CHECK_IP_COUNTER(&old, &new, toosmall);
363 CHECK_IP_COUNTER(&old, &new, fragdropped);
364 #endif
365
366 error = close(fd);
367 ATF_REQUIRE(error == 0);
368 free_lopacket(packet1);
369 free_lopacket(packet2);
370 }
371
372 ATF_TC(ip_reass__large_fragment);
ATF_TC_HEAD(ip_reass__large_fragment,tc)373 ATF_TC_HEAD(ip_reass__large_fragment, tc)
374 {
375 atf_tc_set_md_var(tc, "require.user", "root");
376 }
ATF_TC_BODY(ip_reass__large_fragment,tc)377 ATF_TC_BODY(ip_reass__large_fragment, tc)
378 {
379 struct ipstat old, new;
380 struct ip *ip;
381 struct lopacket *packet1, *packet2;
382 in_addr_t addr;
383 int error, fd;
384 uint16_t ipid;
385
386 fd = open_lobpf(&addr);
387 ipid = arc4random_uniform(UINT16_MAX + 1);
388
389 /*
390 * Create two packets, one with MF set, one without.
391 *
392 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check.
393 */
394 packet1 = alloc_lopacket(addr, 16);
395 ip = &packet1->hdr;
396 ip->ip_id = ipid;
397 ip->ip_off = htons(IP_MF | 0x1fff);
398 update_cksum(ip);
399
400 packet2 = alloc_lopacket(addr, 16);
401 ip = &packet2->hdr;
402 ip->ip_id = ipid;
403 ip->ip_off = htons(0x1fff);
404 update_cksum(ip);
405
406 get_ipstat(&old);
407 write_lopacket(fd, packet1);
408 get_ipstat(&new);
409 CHECK_IP_COUNTER(&old, &new, toolong);
410 #ifndef __NetBSD__
411 CHECK_IP_COUNTER(&old, &new, fragdropped);
412 #endif
413
414 get_ipstat(&old);
415 write_lopacket(fd, packet2);
416 get_ipstat(&new);
417 CHECK_IP_COUNTER(&old, &new, toolong);
418 #ifndef __NetBSD__
419 CHECK_IP_COUNTER(&old, &new, fragdropped);
420 #endif
421
422 error = close(fd);
423 ATF_REQUIRE(error == 0);
424 free_lopacket(packet1);
425 free_lopacket(packet2);
426 }
427
ATF_TP_ADD_TCS(tp)428 ATF_TP_ADD_TCS(tp)
429 {
430 ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments);
431 ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment);
432 ATF_TP_ADD_TC(tp, ip_reass__large_fragment);
433
434 return (atf_no_error());
435 }
436