1 /* $NetBSD: npf_sendpkt.c,v 1.19 2018/04/10 04:29:57 mrg Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF module for packet construction routines. 34 */ 35 36 #ifdef _KERNEL 37 #include <sys/cdefs.h> 38 __KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.19 2018/04/10 04:29:57 mrg Exp $"); 39 40 #include <sys/param.h> 41 #include <sys/types.h> 42 43 #include <netinet/in_systm.h> 44 #include <netinet/in.h> 45 #include <netinet/ip.h> 46 #include <netinet/ip_icmp.h> 47 #include <netinet/ip_var.h> 48 #include <netinet/tcp.h> 49 #include <netinet/ip6.h> 50 #include <netinet/icmp6.h> 51 #include <netinet6/ip6_var.h> 52 #include <netinet6/scope6_var.h> 53 #include <sys/mbuf.h> 54 #endif 55 56 #include "npf_impl.h" 57 58 #define DEFAULT_IP_TTL (ip_defttl) 59 60 #if defined(_NPF_STANDALONE) 61 #define m_gethdr(t, f) npf->mbufops->alloc(0, 0) 62 #define m_freem(m) npc->npc_ctx->mbufops->free(m) 63 #define mtod(m,t) ((t)((npf)->mbufops->getdata(m))) 64 #endif 65 66 #if !defined(INET6) || defined(_NPF_STANDALONE) 67 #define in6_cksum(...) 0 68 #define ip6_output(...) 0 69 #define icmp6_error(m, ...) m_freem(m) 70 #endif 71 72 /* 73 * npf_return_tcp: return a TCP reset (RST) packet. 74 */ 75 static int 76 npf_return_tcp(npf_cache_t *npc) 77 { 78 npf_t *npf = npc->npc_ctx; 79 struct mbuf *m; 80 struct ip *ip = NULL; 81 struct ip6_hdr *ip6 = NULL; 82 struct tcphdr *oth, *th; 83 tcp_seq seq, ack; 84 int tcpdlen, len; 85 uint32_t win; 86 87 /* Fetch relevant data. */ 88 KASSERT(npf_iscached(npc, NPC_IP46)); 89 KASSERT(npf_iscached(npc, NPC_LAYER4)); 90 tcpdlen = npf_tcpsaw(npc, &seq, &ack, &win); 91 oth = npc->npc_l4.tcp; 92 93 if (oth->th_flags & TH_RST) { 94 return 0; 95 } 96 97 /* Create and setup a network buffer. */ 98 if (npf_iscached(npc, NPC_IP4)) { 99 len = sizeof(struct ip) + sizeof(struct tcphdr); 100 } else if (npf_iscached(npc, NPC_IP6)) { 101 len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr); 102 } else { 103 return EINVAL; 104 } 105 106 m = m_gethdr(M_DONTWAIT, MT_HEADER); 107 if (m == NULL) { 108 return ENOMEM; 109 } 110 #if !defined(_NPF_STANDALONE) 111 m->m_data += max_linkhdr; 112 m->m_len = len; 113 m->m_pkthdr.len = len; 114 (void)npf; 115 #endif 116 if (npf_iscached(npc, NPC_IP4)) { 117 struct ip *oip = npc->npc_ip.v4; 118 119 ip = mtod(m, struct ip *); 120 memset(ip, 0, len); 121 122 /* 123 * First, partially fill IPv4 header for TCP checksum. 124 * Note: IP length contains TCP header length. 125 */ 126 ip->ip_p = IPPROTO_TCP; 127 ip->ip_src.s_addr = oip->ip_dst.s_addr; 128 ip->ip_dst.s_addr = oip->ip_src.s_addr; 129 ip->ip_len = htons(sizeof(struct tcphdr)); 130 131 th = (struct tcphdr *)(ip + 1); 132 } else { 133 struct ip6_hdr *oip = npc->npc_ip.v6; 134 135 KASSERT(npf_iscached(npc, NPC_IP6)); 136 ip6 = mtod(m, struct ip6_hdr *); 137 memset(ip6, 0, len); 138 139 ip6->ip6_nxt = IPPROTO_TCP; 140 ip6->ip6_hlim = IPV6_DEFHLIM; 141 memcpy(&ip6->ip6_src, &oip->ip6_dst, sizeof(struct in6_addr)); 142 memcpy(&ip6->ip6_dst, &oip->ip6_src, sizeof(struct in6_addr)); 143 ip6->ip6_plen = htons(len); 144 ip6->ip6_vfc = IPV6_VERSION; 145 146 th = (struct tcphdr *)(ip6 + 1); 147 } 148 149 /* 150 * Construct TCP header and compute the checksum. 151 */ 152 th->th_sport = oth->th_dport; 153 th->th_dport = oth->th_sport; 154 th->th_seq = htonl(ack); 155 if (oth->th_flags & TH_SYN) { 156 tcpdlen++; 157 } 158 th->th_ack = htonl(seq + tcpdlen); 159 th->th_off = sizeof(struct tcphdr) >> 2; 160 th->th_flags = TH_ACK | TH_RST; 161 162 if (npf_iscached(npc, NPC_IP4)) { 163 th->th_sum = in_cksum(m, len); 164 165 /* 166 * Second, fill the rest of IPv4 header and correct IP length. 167 */ 168 ip->ip_v = IPVERSION; 169 ip->ip_hl = sizeof(struct ip) >> 2; 170 ip->ip_tos = IPTOS_LOWDELAY; 171 ip->ip_len = htons(len); 172 ip->ip_ttl = DEFAULT_IP_TTL; 173 } else { 174 KASSERT(npf_iscached(npc, NPC_IP6)); 175 th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr), 176 sizeof(struct tcphdr)); 177 } 178 179 #if defined(INET6) 180 /* Handle IPv6 scopes */ 181 if (npf_iscached(npc, NPC_IP6)) { 182 const struct ifnet *rcvif = npc->npc_nbuf->nb_ifp; 183 184 if (in6_clearscope(&ip6->ip6_src) || 185 in6_clearscope(&ip6->ip6_dst)) { 186 goto bad; 187 } 188 if (in6_setscope(&ip6->ip6_src, rcvif, NULL) || 189 in6_setscope(&ip6->ip6_dst, rcvif, NULL)) { 190 goto bad; 191 } 192 } 193 #endif 194 195 /* Pass to IP layer. */ 196 if (npf_iscached(npc, NPC_IP4)) { 197 return ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL); 198 } 199 #if defined(INET6) 200 return ip6_output(m, NULL, NULL, IPV6_FORWARDING, NULL, NULL, NULL); 201 202 bad: 203 #endif 204 m_freem(m); 205 return EINVAL; 206 } 207 208 /* 209 * npf_return_icmp: return an ICMP error. 210 */ 211 static int 212 npf_return_icmp(const npf_cache_t *npc) 213 { 214 struct mbuf *m = nbuf_head_mbuf(npc->npc_nbuf); 215 216 if (npf_iscached(npc, NPC_IP4)) { 217 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_ADMIN_PROHIBIT, 0, 0); 218 return 0; 219 #if defined(INET6) 220 } else if (npf_iscached(npc, NPC_IP6)) { 221 /* Handle IPv6 scopes */ 222 const struct ifnet *rcvif = npc->npc_nbuf->nb_ifp; 223 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 224 if (in6_clearscope(&ip6->ip6_src) || 225 in6_clearscope(&ip6->ip6_dst)) { 226 return EINVAL; 227 } 228 if (in6_setscope(&ip6->ip6_src, rcvif, NULL) || 229 in6_setscope(&ip6->ip6_dst, rcvif, NULL)) { 230 return EINVAL; 231 } 232 233 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN, 0); 234 return 0; 235 #endif 236 } 237 return EINVAL; 238 } 239 240 /* 241 * npf_return_block: return TCP reset or ICMP host unreachable packet. 242 * 243 * => Returns true if the buffer was consumed (freed) and false otherwise. 244 */ 245 bool 246 npf_return_block(npf_cache_t *npc, const int retfl) 247 { 248 if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) { 249 return false; 250 } 251 switch (npc->npc_proto) { 252 case IPPROTO_TCP: 253 if (retfl & NPF_RULE_RETRST) { 254 (void)npf_return_tcp(npc); 255 } 256 break; 257 case IPPROTO_UDP: 258 if (retfl & NPF_RULE_RETICMP) 259 if (npf_return_icmp(npc) == 0) 260 return true; 261 break; 262 } 263 return false; 264 } 265