1 /* $NetBSD: npf_sendpkt.c,v 1.12 2012/07/15 00:23:00 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF module for packet construction routines. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.12 2012/07/15 00:23:00 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <netinet/in_systm.h> 43 #include <netinet/in.h> 44 #include <netinet/ip.h> 45 #include <netinet/ip_icmp.h> 46 #include <netinet/ip_var.h> 47 #include <netinet/tcp.h> 48 #include <netinet/ip6.h> 49 #include <netinet/icmp6.h> 50 #include <netinet6/ip6_var.h> 51 #include <sys/mbuf.h> 52 53 #include "npf_impl.h" 54 55 #define DEFAULT_IP_TTL (ip_defttl) 56 57 #ifndef INET6 58 #define in6_cksum(...) 0 59 #define ip6_output(...) 0 60 #define icmp6_error(m, ...) m_freem(m) 61 #endif 62 63 /* 64 * npf_return_tcp: return a TCP reset (RST) packet. 65 */ 66 static int 67 npf_return_tcp(npf_cache_t *npc) 68 { 69 struct mbuf *m; 70 struct ip *ip = NULL; 71 struct ip6_hdr *ip6 = NULL; 72 struct tcphdr *oth, *th; 73 tcp_seq seq, ack; 74 int tcpdlen, len; 75 uint32_t win; 76 77 /* Fetch relevant data. */ 78 KASSERT(npf_iscached(npc, NPC_IP46)); 79 KASSERT(npf_iscached(npc, NPC_LAYER4)); 80 tcpdlen = npf_tcpsaw(npc, &seq, &ack, &win); 81 oth = &npc->npc_l4.tcp; 82 83 if (oth->th_flags & TH_RST) { 84 return 0; 85 } 86 87 /* Create and setup a network buffer. */ 88 if (npf_iscached(npc, NPC_IP4)) { 89 len = sizeof(struct ip) + sizeof(struct tcphdr); 90 } else if (npf_iscached(npc, NPC_IP6)) { 91 len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr); 92 } else { 93 return EINVAL; 94 } 95 96 m = m_gethdr(M_DONTWAIT, MT_HEADER); 97 if (m == NULL) { 98 return ENOMEM; 99 } 100 m->m_data += max_linkhdr; 101 m->m_len = len; 102 m->m_pkthdr.len = len; 103 104 if (npf_iscached(npc, NPC_IP4)) { 105 struct ip *oip = &npc->npc_ip.v4; 106 107 ip = mtod(m, struct ip *); 108 memset(ip, 0, len); 109 110 /* 111 * First, partially fill IPv4 header for TCP checksum. 112 * Note: IP length contains TCP header length. 113 */ 114 ip->ip_p = IPPROTO_TCP; 115 ip->ip_src.s_addr = oip->ip_dst.s_addr; 116 ip->ip_dst.s_addr = oip->ip_src.s_addr; 117 ip->ip_len = htons(sizeof(struct tcphdr)); 118 119 th = (struct tcphdr *)(ip + 1); 120 } else { 121 struct ip6_hdr *oip = &npc->npc_ip.v6; 122 123 KASSERT(npf_iscached(npc, NPC_IP6)); 124 ip6 = mtod(m, struct ip6_hdr *); 125 memset(ip6, 0, len); 126 127 ip6->ip6_nxt = IPPROTO_TCP; 128 ip6->ip6_hlim = IPV6_DEFHLIM; 129 memcpy(&ip6->ip6_src, &oip->ip6_dst, sizeof(struct in6_addr)); 130 memcpy(&ip6->ip6_dst, &oip->ip6_src, sizeof(struct in6_addr)); 131 ip6->ip6_plen = htons(len); 132 ip6->ip6_vfc = IPV6_VERSION; 133 134 th = (struct tcphdr *)(ip6 + 1); 135 } 136 137 /* 138 * Construct TCP header and compute the checksum. 139 */ 140 th->th_sport = oth->th_dport; 141 th->th_dport = oth->th_sport; 142 th->th_seq = htonl(ack); 143 if (oth->th_flags & TH_SYN) { 144 tcpdlen++; 145 } 146 th->th_ack = htonl(seq + tcpdlen); 147 th->th_off = sizeof(struct tcphdr) >> 2; 148 th->th_flags = TH_ACK | TH_RST; 149 150 if (npf_iscached(npc, NPC_IP4)) { 151 th->th_sum = in_cksum(m, len); 152 153 /* 154 * Second, fill the rest of IPv4 header and correct IP length. 155 */ 156 ip->ip_v = IPVERSION; 157 ip->ip_hl = sizeof(struct ip) >> 2; 158 ip->ip_tos = IPTOS_LOWDELAY; 159 ip->ip_len = htons(len); 160 ip->ip_ttl = DEFAULT_IP_TTL; 161 } else { 162 KASSERT(npf_iscached(npc, NPC_IP6)); 163 th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr), 164 sizeof(struct tcphdr)); 165 } 166 167 /* Pass to IP layer. */ 168 if (npf_iscached(npc, NPC_IP4)) { 169 return ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL); 170 } 171 return ip6_output(m, NULL, NULL, IPV6_FORWARDING, NULL, NULL, NULL); 172 } 173 174 /* 175 * npf_return_icmp: return an ICMP error. 176 */ 177 static int 178 npf_return_icmp(npf_cache_t *npc, nbuf_t *nbuf) 179 { 180 struct mbuf *m = nbuf; 181 182 if (npf_iscached(npc, NPC_IP4)) { 183 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_ADMIN_PROHIBIT, 0, 0); 184 return 0; 185 } else if (npf_iscached(npc, NPC_IP6)) { 186 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN, 0); 187 return 0; 188 } 189 return EINVAL; 190 } 191 192 /* 193 * npf_return_block: return TCP reset or ICMP host unreachable packet. 194 * 195 * => Returns true if the buffer was consumed (freed) and false otherwise. 196 */ 197 bool 198 npf_return_block(npf_cache_t *npc, nbuf_t *nbuf, const int retfl) 199 { 200 void *n_ptr = nbuf_dataptr(nbuf); 201 202 if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) { 203 return false; 204 } 205 switch (npf_cache_ipproto(npc)) { 206 case IPPROTO_TCP: 207 if (retfl & NPF_RULE_RETRST) { 208 if (!npf_fetch_tcp(npc, nbuf, n_ptr)) { 209 return false; 210 } 211 (void)npf_return_tcp(npc); 212 } 213 break; 214 case IPPROTO_UDP: 215 if (retfl & NPF_RULE_RETICMP) 216 if (npf_return_icmp(npc, nbuf) == 0) 217 return true; 218 break; 219 } 220 return false; 221 } 222