xref: /dflybsd-src/sys/netinet/ip_icmp.c (revision 1f8e62c9ab8d2ecdefffbdf2ef5ed3db7376c6ec)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
34  * $FreeBSD: src/sys/netinet/ip_icmp.c,v 1.39.2.19 2003/01/24 05:11:34 sam Exp $
35  * $DragonFly: src/sys/netinet/ip_icmp.c,v 1.19 2005/01/06 17:59:32 hsu Exp $
36  */
37 
38 #include "opt_ipsec.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/protosw.h>
44 #include <sys/socket.h>
45 #include <sys/time.h>
46 #include <sys/kernel.h>
47 #include <sys/sysctl.h>
48 #include <sys/in_cksum.h>
49 
50 #include <machine/stdarg.h>
51 
52 #include <net/if.h>
53 #include <net/if_types.h>
54 #include <net/route.h>
55 
56 #define _IP_VHL
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip.h>
61 #include <netinet/ip_icmp.h>
62 #include <netinet/ip_var.h>
63 #include <netinet/icmp_var.h>
64 
65 #ifdef IPSEC
66 #include <netinet6/ipsec.h>
67 #include <netproto/key/key.h>
68 #endif
69 
70 #ifdef FAST_IPSEC
71 #include <netproto/ipsec/ipsec.h>
72 #include <netproto/ipsec/key.h>
73 #define	IPSEC
74 #endif
75 
76 /*
77  * ICMP routines: error generation, receive packet processing, and
78  * routines to turnaround packets back to the originator, and
79  * host table maintenance routines.
80  */
81 
82 struct icmpstat icmpstat;
83 SYSCTL_STRUCT(_net_inet_icmp, ICMPCTL_STATS, stats, CTLFLAG_RW,
84 	&icmpstat, icmpstat, "");
85 
86 static int	icmpmaskrepl = 0;
87 SYSCTL_INT(_net_inet_icmp, ICMPCTL_MASKREPL, maskrepl, CTLFLAG_RW,
88 	&icmpmaskrepl, 0, "");
89 
90 static int	drop_redirect = 0;
91 SYSCTL_INT(_net_inet_icmp, OID_AUTO, drop_redirect, CTLFLAG_RW,
92 	&drop_redirect, 0, "");
93 
94 static int	log_redirect = 0;
95 SYSCTL_INT(_net_inet_icmp, OID_AUTO, log_redirect, CTLFLAG_RW,
96 	&log_redirect, 0, "");
97 
98 #ifdef ICMP_BANDLIM
99 
100 /*
101  * ICMP error-response bandwidth limiting sysctl.  If not enabled, sysctl
102  *      variable content is -1 and read-only.
103  */
104 
105 static int      icmplim = 200;
106 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RW,
107 	&icmplim, 0, "");
108 #else
109 
110 static int      icmplim = -1;
111 SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim, CTLFLAG_RD,
112 	&icmplim, 0, "");
113 
114 #endif
115 
116 static int	icmplim_output = 1;
117 SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_RW,
118 	&icmplim_output, 0, "");
119 
120 /*
121  * ICMP broadcast echo sysctl
122  */
123 
124 static int	icmpbmcastecho = 0;
125 SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW,
126 	&icmpbmcastecho, 0, "");
127 
128 
129 #ifdef ICMPPRINTFS
130 int	icmpprintfs = 0;
131 #endif
132 
133 static void	icmp_reflect (struct mbuf *);
134 static void	icmp_send (struct mbuf *, struct mbuf *, struct route *);
135 static int	ip_next_mtu (int, int);
136 
137 extern	struct protosw inetsw[];
138 
139 /*
140  * Generate an error packet of type error
141  * in response to bad packet ip.
142  */
143 void
144 icmp_error(n, type, code, dest, destifp)
145 	struct mbuf *n;
146 	int type, code;
147 	n_long dest;
148 	struct ifnet *destifp;
149 {
150 	struct ip *oip = mtod(n, struct ip *), *nip;
151 	unsigned oiplen = IP_VHL_HL(oip->ip_vhl) << 2;
152 	struct icmp *icp;
153 	struct mbuf *m;
154 	unsigned icmplen;
155 
156 #ifdef ICMPPRINTFS
157 	if (icmpprintfs)
158 		printf("icmp_error(%p, %x, %d)\n", oip, type, code);
159 #endif
160 	if (type != ICMP_REDIRECT)
161 		icmpstat.icps_error++;
162 	/*
163 	 * Don't send error if the original packet was encrypted.
164 	 * Don't send error if not the first fragment of message.
165 	 * Don't error if the old packet protocol was ICMP
166 	 * error message, only known informational types.
167 	 */
168 	if (n->m_flags & M_DECRYPTED)
169 		goto freeit;
170 	if (oip->ip_off &~ (IP_MF|IP_DF))
171 		goto freeit;
172 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
173 	  n->m_len >= oiplen + ICMP_MINLEN &&
174 	  !ICMP_INFOTYPE(((struct icmp *)((caddr_t)oip + oiplen))->icmp_type)) {
175 		icmpstat.icps_oldicmp++;
176 		goto freeit;
177 	}
178 	/* Don't send error in response to a multicast or broadcast packet */
179 	if (n->m_flags & (M_BCAST|M_MCAST))
180 		goto freeit;
181 	/*
182 	 * First, formulate icmp message
183 	 */
184 	m = m_gethdr(MB_DONTWAIT, MT_HEADER);
185 	if (m == NULL)
186 		goto freeit;
187 	icmplen = min(oiplen + 8, oip->ip_len);
188 	if (icmplen < sizeof(struct ip))
189 		panic("icmp_error: bad length");
190 	m->m_len = icmplen + ICMP_MINLEN;
191 	MH_ALIGN(m, m->m_len);
192 	icp = mtod(m, struct icmp *);
193 	if ((u_int)type > ICMP_MAXTYPE)
194 		panic("icmp_error");
195 	icmpstat.icps_outhist[type]++;
196 	icp->icmp_type = type;
197 	if (type == ICMP_REDIRECT)
198 		icp->icmp_gwaddr.s_addr = dest;
199 	else {
200 		icp->icmp_void = 0;
201 		/*
202 		 * The following assignments assume an overlay with the
203 		 * zeroed icmp_void field.
204 		 */
205 		if (type == ICMP_PARAMPROB) {
206 			icp->icmp_pptr = code;
207 			code = 0;
208 		} else if (type == ICMP_UNREACH &&
209 			code == ICMP_UNREACH_NEEDFRAG && destifp) {
210 			icp->icmp_nextmtu = htons(destifp->if_mtu);
211 		}
212 	}
213 
214 	icp->icmp_code = code;
215 	m_copydata(n, 0, icmplen, (caddr_t)&icp->icmp_ip);
216 	nip = &icp->icmp_ip;
217 
218 	/*
219 	 * Convert fields to network representation.
220 	 */
221 	nip->ip_len = htons(nip->ip_len);
222 	nip->ip_off = htons(nip->ip_off);
223 
224 	/*
225 	 * Now, copy old ip header (without options)
226 	 * in front of icmp message.
227 	 */
228 	if (m->m_data - sizeof(struct ip) < m->m_pktdat)
229 		panic("icmp len");
230 	m->m_data -= sizeof(struct ip);
231 	m->m_len += sizeof(struct ip);
232 	m->m_pkthdr.len = m->m_len;
233 	m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
234 	nip = mtod(m, struct ip *);
235 	bcopy(oip, nip, sizeof(struct ip));
236 	nip->ip_len = m->m_len;
237 	nip->ip_vhl = IP_VHL_BORING;
238 	nip->ip_p = IPPROTO_ICMP;
239 	nip->ip_tos = 0;
240 	m->m_pkthdr.pf_flags |= n->m_pkthdr.pf_flags & PF_MBUF_GENERATED;
241 	icmp_reflect(m);
242 
243 freeit:
244 	m_freem(n);
245 }
246 
247 /*
248  * Process a received ICMP message.
249  */
250 void
251 icmp_input(struct mbuf *m, ...)
252 {
253 	struct sockaddr_in icmpsrc = { sizeof(struct sockaddr_in), AF_INET };
254 	struct sockaddr_in icmpdst = { sizeof(struct sockaddr_in), AF_INET };
255 	struct sockaddr_in icmpgw = { sizeof(struct sockaddr_in), AF_INET };
256 	struct icmp *icp;
257 	struct in_ifaddr *ia;
258 	struct ip *ip = mtod(m, struct ip *);
259 	void (*ctlfunc) (int, struct sockaddr *, void *);
260 	int icmplen = ip->ip_len;
261 	int i, hlen;
262 	int code, off, proto;
263 	__va_list ap;
264 
265 	__va_start(ap, m);
266 	off = __va_arg(ap, int);
267 	proto = __va_arg(ap, int);
268 	__va_end(ap);
269 
270 	hlen = off;
271 
272 	/*
273 	 * Locate icmp structure in mbuf, and check
274 	 * that not corrupted and of at least minimum length.
275 	 */
276 #ifdef ICMPPRINTFS
277 	if (icmpprintfs) {
278 		char buf[sizeof "aaa.bbb.ccc.ddd"];
279 
280 		strcpy(buf, inet_ntoa(ip->ip_src));
281 		printf("icmp_input from %s to %s, len %d\n",
282 		       buf, inet_ntoa(ip->ip_dst), icmplen);
283 	}
284 #endif
285 	if (icmplen < ICMP_MINLEN) {
286 		icmpstat.icps_tooshort++;
287 		goto freeit;
288 	}
289 	i = hlen + min(icmplen, ICMP_ADVLENMIN);
290 	if (m->m_len < i && (m = m_pullup(m, i)) == 0)  {
291 		icmpstat.icps_tooshort++;
292 		return;
293 	}
294 	ip = mtod(m, struct ip *);
295 	m->m_len -= hlen;
296 	m->m_data += hlen;
297 	icp = mtod(m, struct icmp *);
298 	if (in_cksum(m, icmplen)) {
299 		icmpstat.icps_checksum++;
300 		goto freeit;
301 	}
302 	m->m_len += hlen;
303 	m->m_data -= hlen;
304 
305 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
306 		/*
307 		 * Deliver very specific ICMP type only.
308 		 */
309 		switch (icp->icmp_type) {
310 		case ICMP_UNREACH:
311 		case ICMP_TIMXCEED:
312 			break;
313 		default:
314 			goto freeit;
315 		}
316 	}
317 
318 #ifdef ICMPPRINTFS
319 	if (icmpprintfs)
320 		printf("icmp_input, type %d code %d\n", icp->icmp_type,
321 		    icp->icmp_code);
322 #endif
323 
324 	/*
325 	 * Message type specific processing.
326 	 */
327 	if (icp->icmp_type > ICMP_MAXTYPE)
328 		goto raw;
329 	icmpstat.icps_inhist[icp->icmp_type]++;
330 	code = icp->icmp_code;
331 	switch (icp->icmp_type) {
332 
333 	case ICMP_UNREACH:
334 		switch (code) {
335 			case ICMP_UNREACH_NET:
336 			case ICMP_UNREACH_HOST:
337 			case ICMP_UNREACH_SRCFAIL:
338 			case ICMP_UNREACH_NET_UNKNOWN:
339 			case ICMP_UNREACH_HOST_UNKNOWN:
340 			case ICMP_UNREACH_ISOLATED:
341 			case ICMP_UNREACH_TOSNET:
342 			case ICMP_UNREACH_TOSHOST:
343 			case ICMP_UNREACH_HOST_PRECEDENCE:
344 			case ICMP_UNREACH_PRECEDENCE_CUTOFF:
345 				code = PRC_UNREACH_NET;
346 				break;
347 
348 			case ICMP_UNREACH_NEEDFRAG:
349 				code = PRC_MSGSIZE;
350 				break;
351 
352 			/*
353 			 * RFC 1122, Sections 3.2.2.1 and 4.2.3.9.
354 			 * Treat subcodes 2,3 as immediate RST
355 			 */
356 			case ICMP_UNREACH_PROTOCOL:
357 			case ICMP_UNREACH_PORT:
358 				code = PRC_UNREACH_PORT;
359 				break;
360 
361 			case ICMP_UNREACH_NET_PROHIB:
362 			case ICMP_UNREACH_HOST_PROHIB:
363 			case ICMP_UNREACH_FILTER_PROHIB:
364 				code = PRC_UNREACH_ADMIN_PROHIB;
365 				break;
366 
367 			default:
368 				goto badcode;
369 		}
370 		goto deliver;
371 
372 	case ICMP_TIMXCEED:
373 		if (code > 1)
374 			goto badcode;
375 		code += PRC_TIMXCEED_INTRANS;
376 		goto deliver;
377 
378 	case ICMP_PARAMPROB:
379 		if (code > 1)
380 			goto badcode;
381 		code = PRC_PARAMPROB;
382 		goto deliver;
383 
384 	case ICMP_SOURCEQUENCH:
385 		if (code)
386 			goto badcode;
387 		code = PRC_QUENCH;
388 	deliver:
389 		/*
390 		 * Problem with datagram; advise higher level routines.
391 		 */
392 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
393 		    IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
394 			icmpstat.icps_badlen++;
395 			goto freeit;
396 		}
397 		icp->icmp_ip.ip_len = ntohs(icp->icmp_ip.ip_len);
398 		/* Discard ICMP's in response to multicast packets */
399 		if (IN_MULTICAST(ntohl(icp->icmp_ip.ip_dst.s_addr)))
400 			goto badcode;
401 #ifdef ICMPPRINTFS
402 		if (icmpprintfs)
403 			printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
404 #endif
405 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
406 #if 1
407 		/*
408 		 * MTU discovery:
409 		 * If we got a needfrag and there is a host route to the
410 		 * original destination, and the MTU is not locked, then
411 		 * set the MTU in the route to the suggested new value
412 		 * (if given) and then notify as usual.  The ULPs will
413 		 * notice that the MTU has changed and adapt accordingly.
414 		 * If no new MTU was suggested, then we guess a new one
415 		 * less than the current value.  If the new MTU is
416 		 * unreasonably small (arbitrarily set at 296), then
417 		 * we reset the MTU to the interface value and enable the
418 		 * lock bit, indicating that we are no longer doing MTU
419 		 * discovery.
420 		 */
421 		if (code == PRC_MSGSIZE) {
422 			struct rtentry *rt;
423 			int mtu;
424 
425 			rt = rtpurelookup((struct sockaddr *)&icmpsrc);
426 			if (rt != NULL && (rt->rt_flags & RTF_HOST) &&
427 			    !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
428 				mtu = ntohs(icp->icmp_nextmtu);
429 				if (!mtu)
430 					mtu = ip_next_mtu(rt->rt_rmx.rmx_mtu,
431 							  1);
432 #ifdef DEBUG_MTUDISC
433 				printf("MTU for %s reduced to %d\n",
434 					inet_ntoa(icmpsrc.sin_addr), mtu);
435 #endif
436 				if (mtu < 296) {
437 					/* rt->rt_rmx.rmx_mtu =
438 						rt->rt_ifp->if_mtu; */
439 					rt->rt_rmx.rmx_locks |= RTV_MTU;
440 				} else if (rt->rt_rmx.rmx_mtu > mtu) {
441 					rt->rt_rmx.rmx_mtu = mtu;
442 				}
443 			}
444 			if (rt != NULL)
445 				--rt->rt_refcnt;
446 		}
447 
448 #endif
449 		/*
450 		 * XXX if the packet contains [IPv4 AH TCP], we can't make a
451 		 * notification to TCP layer.
452 		 */
453 		ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
454 		if (ctlfunc)
455 			(*ctlfunc)(code, (struct sockaddr *)&icmpsrc,
456 				   &icp->icmp_ip);
457 		break;
458 
459 	badcode:
460 		icmpstat.icps_badcode++;
461 		break;
462 
463 	case ICMP_ECHO:
464 		if (!icmpbmcastecho
465 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
466 			icmpstat.icps_bmcastecho++;
467 			break;
468 		}
469 		icp->icmp_type = ICMP_ECHOREPLY;
470 #ifdef ICMP_BANDLIM
471 		if (badport_bandlim(BANDLIM_ICMP_ECHO) < 0)
472 			goto freeit;
473 		else
474 #endif
475 			goto reflect;
476 
477 	case ICMP_TSTAMP:
478 		if (!icmpbmcastecho
479 		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0) {
480 			icmpstat.icps_bmcasttstamp++;
481 			break;
482 		}
483 		if (icmplen < ICMP_TSLEN) {
484 			icmpstat.icps_badlen++;
485 			break;
486 		}
487 		icp->icmp_type = ICMP_TSTAMPREPLY;
488 		icp->icmp_rtime = iptime();
489 		icp->icmp_ttime = icp->icmp_rtime;	/* bogus, do later! */
490 #ifdef ICMP_BANDLIM
491 		if (badport_bandlim(BANDLIM_ICMP_TSTAMP) < 0)
492 			goto freeit;
493 		else
494 #endif
495 			goto reflect;
496 
497 	case ICMP_MASKREQ:
498 		if (icmpmaskrepl == 0)
499 			break;
500 		/*
501 		 * We are not able to respond with all ones broadcast
502 		 * unless we receive it over a point-to-point interface.
503 		 */
504 		if (icmplen < ICMP_MASKLEN)
505 			break;
506 		switch (ip->ip_dst.s_addr) {
507 
508 		case INADDR_BROADCAST:
509 		case INADDR_ANY:
510 			icmpdst.sin_addr = ip->ip_src;
511 			break;
512 
513 		default:
514 			icmpdst.sin_addr = ip->ip_dst;
515 		}
516 		ia = (struct in_ifaddr *)ifaof_ifpforaddr(
517 			    (struct sockaddr *)&icmpdst, m->m_pkthdr.rcvif);
518 		if (ia == 0)
519 			break;
520 		if (ia->ia_ifp == 0)
521 			break;
522 		icp->icmp_type = ICMP_MASKREPLY;
523 		icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
524 		if (ip->ip_src.s_addr == 0) {
525 			if (ia->ia_ifp->if_flags & IFF_BROADCAST)
526 			    ip->ip_src = satosin(&ia->ia_broadaddr)->sin_addr;
527 			else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
528 			    ip->ip_src = satosin(&ia->ia_dstaddr)->sin_addr;
529 		}
530 reflect:
531 		ip->ip_len += hlen;	/* since ip_input deducts this */
532 		icmpstat.icps_reflect++;
533 		icmpstat.icps_outhist[icp->icmp_type]++;
534 		icmp_reflect(m);
535 		return;
536 
537 	case ICMP_REDIRECT:
538 		if (log_redirect) {
539 			u_long src, dst, gw;
540 
541 			src = ntohl(ip->ip_src.s_addr);
542 			dst = ntohl(icp->icmp_ip.ip_dst.s_addr);
543 			gw = ntohl(icp->icmp_gwaddr.s_addr);
544 			printf("icmp redirect from %d.%d.%d.%d: "
545 			       "%d.%d.%d.%d => %d.%d.%d.%d\n",
546 			       (int)(src >> 24), (int)((src >> 16) & 0xff),
547 			       (int)((src >> 8) & 0xff), (int)(src & 0xff),
548 			       (int)(dst >> 24), (int)((dst >> 16) & 0xff),
549 			       (int)((dst >> 8) & 0xff), (int)(dst & 0xff),
550 			       (int)(gw >> 24), (int)((gw >> 16) & 0xff),
551 			       (int)((gw >> 8) & 0xff), (int)(gw & 0xff));
552 		}
553 		if (drop_redirect)
554 			break;
555 		if (code > 3)
556 			goto badcode;
557 		if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
558 		    IP_VHL_HL(icp->icmp_ip.ip_vhl) < (sizeof(struct ip) >> 2)) {
559 			icmpstat.icps_badlen++;
560 			break;
561 		}
562 		/*
563 		 * Short circuit routing redirects to force
564 		 * immediate change in the kernel's routing
565 		 * tables.  The message is also handed to anyone
566 		 * listening on a raw socket (e.g. the routing
567 		 * daemon for use in updating its tables).
568 		 */
569 		icmpgw.sin_addr = ip->ip_src;
570 		icmpdst.sin_addr = icp->icmp_gwaddr;
571 #ifdef	ICMPPRINTFS
572 		if (icmpprintfs) {
573 			char buf[sizeof "aaa.bbb.ccc.ddd"];
574 
575 			strcpy(buf, inet_ntoa(icp->icmp_ip.ip_dst));
576 			printf("redirect dst %s to %s\n",
577 			       buf, inet_ntoa(icp->icmp_gwaddr));
578 		}
579 #endif
580 		icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
581 		rtredirect((struct sockaddr *)&icmpsrc,
582 		  (struct sockaddr *)&icmpdst,
583 		  (struct sockaddr *)0, RTF_GATEWAY | RTF_HOST,
584 		  (struct sockaddr *)&icmpgw, (struct rtentry **)0);
585 		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc);
586 #ifdef IPSEC
587 		key_sa_routechange((struct sockaddr *)&icmpsrc);
588 #endif
589 		break;
590 
591 	/*
592 	 * No kernel processing for the following;
593 	 * just fall through to send to raw listener.
594 	 */
595 	case ICMP_ECHOREPLY:
596 	case ICMP_ROUTERADVERT:
597 	case ICMP_ROUTERSOLICIT:
598 	case ICMP_TSTAMPREPLY:
599 	case ICMP_IREQREPLY:
600 	case ICMP_MASKREPLY:
601 	default:
602 		break;
603 	}
604 
605 raw:
606 	rip_input(m, off, proto);
607 	return;
608 
609 freeit:
610 	m_freem(m);
611 }
612 
613 /*
614  * Reflect the ip packet back to the source
615  */
616 static void
617 icmp_reflect(m)
618 	struct mbuf *m;
619 {
620 	struct ip *ip = mtod(m, struct ip *);
621 	struct ifaddr *ifa;
622 	struct in_ifaddr *ia;
623 	struct in_addr t;
624 	struct mbuf *opts = 0;
625 	int optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
626 	struct route *ro = NULL, rt;
627 
628 	if (!in_canforward(ip->ip_src) &&
629 	    ((ntohl(ip->ip_src.s_addr) & IN_CLASSA_NET) !=
630 	     (IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
631 		m_freem(m);	/* Bad return address */
632 		icmpstat.icps_badaddr++;
633 		goto done;	/* Ip_output() will check for broadcast */
634 	}
635 	t = ip->ip_dst;
636 	ip->ip_dst = ip->ip_src;
637 	ro = &rt;
638 	bzero(ro, sizeof *ro);
639 	/*
640 	 * If the incoming packet was addressed directly to us,
641 	 * use dst as the src for the reply.  Otherwise (broadcast
642 	 * or anonymous), use the address which corresponds
643 	 * to the incoming interface.
644 	 */
645 	LIST_FOREACH(ia, INADDR_HASH(t.s_addr), ia_hash)
646 		if (t.s_addr == IA_SIN(ia)->sin_addr.s_addr)
647 			goto match;
648 	if (m->m_pkthdr.rcvif != NULL &&
649 	    m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
650 		TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
651 			if (ifa->ifa_addr->sa_family != AF_INET)
652 				continue;
653 			ia = ifatoia(ifa);
654 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
655 			    t.s_addr)
656 				goto match;
657 		}
658 	}
659 	ia = ip_rtaddr(ip->ip_dst, ro);
660 	/* We need a route to do anything useful. */
661 	if (ia == NULL) {
662 		m_freem(m);
663 		icmpstat.icps_noroute++;
664 		goto done;
665 	}
666 match:
667 	t = IA_SIN(ia)->sin_addr;
668 	ip->ip_src = t;
669 	ip->ip_ttl = ip_defttl;
670 
671 	if (optlen > 0) {
672 		u_char *cp;
673 		int opt, cnt;
674 		u_int len;
675 
676 		/*
677 		 * Retrieve any source routing from the incoming packet;
678 		 * add on any record-route or timestamp options.
679 		 */
680 		cp = (u_char *) (ip + 1);
681 		if ((opts = ip_srcroute()) == 0 &&
682 		    (opts = m_gethdr(MB_DONTWAIT, MT_HEADER))) {
683 			opts->m_len = sizeof(struct in_addr);
684 			mtod(opts, struct in_addr *)->s_addr = 0;
685 		}
686 		if (opts) {
687 #ifdef ICMPPRINTFS
688 			if (icmpprintfs)
689 				printf("icmp_reflect optlen %d rt %d => ",
690 				       optlen, opts->m_len);
691 #endif
692 			for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
693 				opt = cp[IPOPT_OPTVAL];
694 				if (opt == IPOPT_EOL)
695 					break;
696 				if (opt == IPOPT_NOP)
697 					len = 1;
698 				else {
699 					if (cnt < IPOPT_OLEN + sizeof *cp)
700 						break;
701 					len = cp[IPOPT_OLEN];
702 					if (len < IPOPT_OLEN + sizeof *cp ||
703 					    len > cnt)
704 					break;
705 				}
706 				/*
707 				 * Should check for overflow, but it
708 				 * "can't happen".
709 				 */
710 				if (opt == IPOPT_RR || opt == IPOPT_TS ||
711 				    opt == IPOPT_SECURITY) {
712 					bcopy(cp,
713 					      mtod(opts, caddr_t) + opts->m_len,
714 					      len);
715 					opts->m_len += len;
716 				}
717 			}
718 			/* Terminate & pad, if necessary */
719 			cnt = opts->m_len % 4;
720 			if (cnt) {
721 				for (; cnt < 4; cnt++) {
722 					*(mtod(opts, caddr_t) + opts->m_len) =
723 					    IPOPT_EOL;
724 					opts->m_len++;
725 				}
726 			}
727 #ifdef ICMPPRINTFS
728 			if (icmpprintfs)
729 				printf("%d\n", opts->m_len);
730 #endif
731 		}
732 		/*
733 		 * Now strip out original options by copying rest of first
734 		 * mbuf's data back, and adjust the IP length.
735 		 */
736 		ip->ip_len -= optlen;
737 		ip->ip_vhl = IP_VHL_BORING;
738 		m->m_len -= optlen;
739 		if (m->m_flags & M_PKTHDR)
740 			m->m_pkthdr.len -= optlen;
741 		optlen += sizeof(struct ip);
742 		bcopy((caddr_t)ip + optlen, ip + 1,
743 		      m->m_len - sizeof(struct ip));
744 	}
745 	m->m_pkthdr.pf_flags &= PF_MBUF_GENERATED;
746 	m->m_flags &= ~(M_BCAST|M_MCAST);
747 	icmp_send(m, opts, ro);
748 done:
749 	if (opts)
750 		m_free(opts);
751 	if (ro && ro->ro_rt)
752 		RTFREE(ro->ro_rt);
753 }
754 
755 /*
756  * Send an icmp packet back to the ip level,
757  * after supplying a checksum.
758  */
759 static void
760 icmp_send(m, opts, rt)
761 	struct mbuf *m;
762 	struct mbuf *opts;
763 	struct route *rt;
764 {
765 	struct ip *ip = mtod(m, struct ip *);
766 	int hlen;
767 	struct icmp *icp;
768 
769 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
770 	m->m_data += hlen;
771 	m->m_len -= hlen;
772 	icp = mtod(m, struct icmp *);
773 	icp->icmp_cksum = 0;
774 	icp->icmp_cksum = in_cksum(m, ip->ip_len - hlen);
775 	m->m_data -= hlen;
776 	m->m_len += hlen;
777 	m->m_pkthdr.rcvif = (struct ifnet *)0;
778 #ifdef ICMPPRINTFS
779 	if (icmpprintfs) {
780 		char buf[sizeof "aaa.bbb.ccc.ddd"];
781 
782 		strcpy(buf, inet_ntoa(ip->ip_dst));
783 		printf("icmp_send dst %s src %s\n", buf, inet_ntoa(ip->ip_src));
784 	}
785 #endif
786 	ip_output(m, opts, rt, 0, NULL, NULL);
787 }
788 
789 n_time
790 iptime()
791 {
792 	struct timeval atv;
793 	u_long t;
794 
795 	getmicrotime(&atv);
796 	t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
797 	return (htonl(t));
798 }
799 
800 #if 1
801 /*
802  * Return the next larger or smaller MTU plateau (table from RFC 1191)
803  * given current value MTU.  If DIR is less than zero, a larger plateau
804  * is returned; otherwise, a smaller value is returned.
805  */
806 static int
807 ip_next_mtu(mtu, dir)
808 	int mtu;
809 	int dir;
810 {
811 	static int mtutab[] = {
812 		65535, 32000, 17914, 8166, 4352, 2002, 1492, 1006, 508, 296,
813 		68, 0
814 	};
815 	int i;
816 
817 	for (i = 0; i < (sizeof mtutab) / (sizeof mtutab[0]); i++) {
818 		if (mtu >= mtutab[i])
819 			break;
820 	}
821 
822 	if (dir < 0) {
823 		if (i == 0) {
824 			return 0;
825 		} else {
826 			return mtutab[i - 1];
827 		}
828 	} else {
829 		if (mtutab[i] == 0) {
830 			return 0;
831 		} else if(mtu > mtutab[i]) {
832 			return mtutab[i];
833 		} else {
834 			return mtutab[i + 1];
835 		}
836 	}
837 }
838 #endif
839 
840 #ifdef ICMP_BANDLIM
841 /*
842  * badport_bandlim() - check for ICMP bandwidth limit
843  *
844  *	Return 0 if it is ok to send an ICMP error response, -1 if we have
845  *	hit our bandwidth limit and it is not ok.
846  *
847  *	If icmplim is <= 0, the feature is disabled and 0 is returned.
848  *
849  *	For now we separate the TCP and UDP subsystems w/ different 'which'
850  *	values.  We may eventually remove this separation (and simplify the
851  *	code further).
852  *
853  *	Note that the printing of the error message is delayed so we can
854  *	properly print the icmp error rate that the system was trying to do
855  *	(i.e. 22000/100 pps, etc...).  This can cause long delays in printing
856  *	the 'final' error, but it doesn't make sense to solve the printing
857  *	delay with more complex code.
858  */
859 int
860 badport_bandlim(int which)
861 {
862 	static int lticks[BANDLIM_MAX + 1];
863 	static int lpackets[BANDLIM_MAX + 1];
864 	int dticks;
865 	const char *bandlimittype[] = {
866 		"Limiting icmp unreach response",
867 		"Limiting icmp ping response",
868 		"Limiting icmp tstamp response",
869 		"Limiting closed port RST response",
870 		"Limiting open port RST response"
871 		};
872 
873 	/*
874 	 * Return ok status if feature disabled or argument out of
875 	 * ranage.
876 	 */
877 
878 	if (icmplim <= 0 || which > BANDLIM_MAX || which < 0)
879 		return(0);
880 	dticks = ticks - lticks[which];
881 
882 	/*
883 	 * reset stats when cumulative dt exceeds one second.
884 	 */
885 
886 	if ((unsigned int)dticks > hz) {
887 		if (lpackets[which] > icmplim && icmplim_output) {
888 			printf("%s from %d to %d packets per second\n",
889 				bandlimittype[which],
890 				lpackets[which],
891 				icmplim
892 			);
893 		}
894 		lticks[which] = ticks;
895 		lpackets[which] = 0;
896 	}
897 
898 	/*
899 	 * bump packet count
900 	 */
901 
902 	if (++lpackets[which] > icmplim) {
903 		return(-1);
904 	}
905 	return(0);
906 }
907 #endif
908