xref: /netbsd-src/sys/netmpls/mpls_ttl.c (revision d909946ca08dceb44d7d0f22ec9488679695d976)
1 /*	$NetBSD: mpls_ttl.c,v 1.8 2016/06/10 13:31:44 ozaki-r Exp $ */
2 
3 /*
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*-
33  * Copyright (c) 2010 The NetBSD Foundation, Inc.
34  * All rights reserved.
35  *
36  * This code is derived from software contributed to The NetBSD Foundation
37  * by Public Access Networks Corporation ("Panix").  It was developed under
38  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
39  *
40  * This code is derived from software contributed to The NetBSD Foundation
41  * by Jason R. Thorpe of Zembu Labs, Inc.
42  *
43  * This code is derived from software contributed to The NetBSD Foundation
44  * by Mihai Chelaru <kefren@NetBSD.org>
45  *
46  * Redistribution and use in source and binary forms, with or without
47  * modification, are permitted provided that the following conditions
48  * are met:
49  * 1. Redistributions of source code must retain the above copyright
50  *    notice, this list of conditions and the following disclaimer.
51  * 2. Redistributions in binary form must reproduce the above copyright
52  *    notice, this list of conditions and the following disclaimer in the
53  *    documentation and/or other materials provided with the distribution.
54  *
55  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
56  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
57  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
58  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
59  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
60  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
61  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
62  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
63  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
64  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
65  * POSSIBILITY OF SUCH DAMAGE.
66  */
67 
68 /*
69  * Copyright (c) 1982, 1986, 1988, 1993
70  *      The Regents of the University of California.  All rights reserved.
71  *
72  * Redistribution and use in source and binary forms, with or without
73  * modification, are permitted provided that the following conditions
74  * are met:
75  * 1. Redistributions of source code must retain the above copyright
76  *    notice, this list of conditions and the following disclaimer.
77  * 2. Redistributions in binary form must reproduce the above copyright
78  *    notice, this list of conditions and the following disclaimer in the
79  *    documentation and/or other materials provided with the distribution.
80  * 3. Neither the name of the University nor the names of its contributors
81  *    may be used to endorse or promote products derived from this software
82  *    without specific prior written permission.
83  *
84  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
85  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
86  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
87  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
88  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
89  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
90  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
91  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
92  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
93  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
94  * SUCH DAMAGE.
95  *
96  *      @(#)ip_icmp.c   8.2 (Berkeley) 1/4/94
97  */
98 
99 #include <sys/cdefs.h>
100 __KERNEL_RCSID(0, "$NetBSD: mpls_ttl.c,v 1.8 2016/06/10 13:31:44 ozaki-r Exp $");
101 
102 #ifdef _KERNEL_OPT
103 #include "opt_inet.h"
104 #include "opt_mpls.h"
105 #endif
106 
107 #include <sys/param.h>
108 #include <sys/malloc.h>
109 #include <sys/mbuf.h>
110 #include <sys/errno.h>
111 #include <sys/socket.h>
112 #include <sys/systm.h>
113 
114 #include <net/if.h>
115 #include <net/if_dl.h>
116 
117 #include <netinet/in.h>
118 #include <netinet/in_systm.h>
119 #include <netinet/ip.h>
120 #include <netinet/ip_icmp.h>
121 #include <netinet/icmp_private.h>
122 #include <netinet/icmp_var.h>
123 
124 #include <netmpls/mpls.h>
125 #include <netmpls/mpls_var.h>
126 
127 #ifdef INET
128 
129 /* in netinet/ip_icmp.c */
130 extern int icmpreturndatabytes;
131 
132 /* ICMP Extensions */
133 
134 #define ICMP_EXT_VERSION 2
135 #define	MPLS_RETURN_DATA 128
136 #define	ICMP_EXT_OFFSET	128
137 
138 struct icmp_ext_cmn_hdr {
139 #if BYTE_ORDER == BIG_ENDIAN
140         unsigned char   version:4;
141         unsigned char   reserved1:4;
142 #else
143         unsigned char   reserved1:4;
144         unsigned char   version:4;
145 #endif
146 	unsigned char   reserved2;
147 	unsigned short  checksum;
148 };
149 
150 struct icmp_ext_obj_hdr {
151 	u_short length;
152 	u_char  class_num;
153 #define MPLS_STACK_ENTRY_CLASS 1
154 	u_char  c_type;
155 #define MPLS_STACK_ENTRY_C_TYPE 1
156 };
157 
158 struct mpls_extension {
159 	struct icmp_ext_cmn_hdr cmn_hdr;
160 	struct icmp_ext_obj_hdr obj_hdr;
161 	union mpls_shim ms;
162 } __packed;
163 
164 static void mpls_icmp_error(struct mbuf *, int, int, n_long, int,
165 	union mpls_shim *);
166 static bool ip4_check(struct mbuf *);
167 
168 /*
169  * References: RFC 4884 and RFC 4950
170  * This should be in sync with icmp_error() in sys/netinet/ip_icmp.c
171  * XXX: is called only for ICMP_TIMXCEED_INTRANS but code is too general
172  */
173 
174 static void
175 mpls_icmp_error(struct mbuf *n, int type, int code, n_long dest,
176     int destmtu, union mpls_shim *shim)
177 {
178 	struct ip *oip = mtod(n, struct ip *), *nip;
179 	unsigned oiplen = oip->ip_hl << 2;
180 	struct icmp *icp;
181 	struct mbuf *m;
182 	unsigned icmplen, mblen, packetlen;
183 	struct mpls_extension mpls_icmp_ext;
184 
185 	memset(&mpls_icmp_ext, 0, sizeof(mpls_icmp_ext));
186 	mpls_icmp_ext.cmn_hdr.version = ICMP_EXT_VERSION;
187 	mpls_icmp_ext.cmn_hdr.checksum = 0;
188 
189 	mpls_icmp_ext.obj_hdr.length = htons(sizeof(union mpls_shim) +
190 					sizeof(struct icmp_ext_obj_hdr));
191 	mpls_icmp_ext.obj_hdr.class_num = MPLS_STACK_ENTRY_CLASS;
192 	mpls_icmp_ext.obj_hdr.c_type = MPLS_STACK_ENTRY_C_TYPE;
193 
194 	mpls_icmp_ext.ms.s_addr = shim->s_addr;
195 
196 #ifdef ICMPPRINTFS
197 	if (icmpprintfs)
198 		printf("mpls_icmp_error(%p, type:%d, code:%d)\n", oip, type,
199 			code);
200 #endif
201 	if (type != ICMP_REDIRECT)
202 		ICMP_STATINC(ICMP_STAT_ERROR);
203 	/*
204 	 * Don't send error if the original packet was encrypted.
205 	 * Don't send error if not the first fragment of message.
206 	 * Don't error if the old packet protocol was ICMP
207 	 * error message, only known informational types.
208 	 */
209 	if (n->m_flags & M_DECRYPTED)
210 		goto freeit;
211 	if (oip->ip_off &~ htons(IP_MF|IP_DF))
212 		goto freeit;
213 	if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
214 	    n->m_len >= oiplen + ICMP_MINLEN &&
215 	    !ICMP_INFOTYPE(((struct icmp *)((char *)oip + oiplen))->icmp_type))
216 	{
217 		ICMP_STATINC(ICMP_STAT_OLDICMP);
218 		goto freeit;
219 	}
220 	/* Don't send error in response to a multicast or broadcast packet */
221 	if (n->m_flags & (M_BCAST|M_MCAST))
222 		goto freeit;
223 
224 	/*
225 	 * First, do a rate limitation check.
226 	 */
227 	if (icmp_ratelimit(&oip->ip_src, type, code))
228 		/* XXX stats */
229 		goto freeit;
230 
231 	/*
232 	 * Now, formulate icmp message
233 	 */
234 	icmplen = min(ICMP_EXT_OFFSET, ntohs(oip->ip_len));
235 	/*
236 	 * Defend against mbuf chains shorter than oip->ip_len - oiplen:
237 	 */
238 	mblen = 0;
239 	for (m = n; m && (mblen < icmplen); m = m->m_next)
240 		mblen += m->m_len;
241 	icmplen = min(mblen, icmplen);
242 
243 	packetlen = sizeof(struct ip) + offsetof(struct icmp, icmp_ip) +
244 	    ICMP_EXT_OFFSET + sizeof(mpls_icmp_ext);
245 
246 	/*
247 	 * As we are not required to return everything we have,
248 	 * we return whatever we can return at ease.
249 	 *
250 	 * Note that ICMP datagrams longer than 576 octets are out of spec
251 	 * according to RFC1812; the limit on icmpreturndatabytes below in
252 	 * icmp_sysctl will keep things below that limit.
253 	 */
254 
255 	KASSERT (packetlen <= MCLBYTES);
256 
257 	m = m_gethdr(M_DONTWAIT, MT_HEADER);
258 	if (m && (packetlen > MHLEN)) {
259 		MCLGET(m, M_DONTWAIT);
260 		if ((m->m_flags & M_EXT) == 0) {
261 			m_freem(m);
262 			m = NULL;
263 		}
264 	}
265 	if (m == NULL)
266 		goto freeit;
267 	MCLAIM(m, n->m_owner);
268 	m->m_len = packetlen;
269 	if ((m->m_flags & M_EXT) == 0)
270 		MH_ALIGN(m, m->m_len);
271 	m->m_data += sizeof(struct ip);
272 	m->m_len -= sizeof(struct ip);
273 
274 	icp = mtod(m, struct icmp *);
275 	if ((u_int)type > ICMP_MAXTYPE)
276 		panic("icmp error (mpls_ttl)");
277 	ICMP_STATINC(ICMP_STAT_OUTHIST + type);
278 	icp->icmp_type = type;
279 	if (type == ICMP_REDIRECT)
280 		icp->icmp_gwaddr.s_addr = dest;
281 	else {
282 		icp->icmp_void = 0;
283 		/*
284 		 * The following assignments assume an overlay with the
285 		 * zeroed icmp_void field.
286 		 */
287 		if (type == ICMP_PARAMPROB) {
288 			icp->icmp_pptr = code;
289 			code = 0;
290 		} else if (type == ICMP_UNREACH &&
291 		    code == ICMP_UNREACH_NEEDFRAG && destmtu)
292 			icp->icmp_nextmtu = htons(destmtu);
293 	}
294 
295 	icp->icmp_code = code;
296 
297 	memset(&icp->icmp_ip, 0, ICMP_EXT_OFFSET);
298 	m_copydata(n, 0, icmplen, (char *)&icp->icmp_ip);
299 
300 	/* Append the extension structure */
301 	memcpy(((char*)&icp->icmp_ip) + ICMP_EXT_OFFSET,
302 	    &mpls_icmp_ext, sizeof(mpls_icmp_ext));
303 
304 	/*
305 	 * Now, copy old ip header (without options)
306 	 * in front of icmp message.
307 	*/
308 	if ((m->m_flags & M_EXT) == 0 &&
309 	    m->m_data - sizeof(struct ip) < m->m_pktdat)
310 		panic("icmp len");
311 	m->m_data -= sizeof(struct ip);
312 	m->m_len += sizeof(struct ip);
313 	m->m_pkthdr.len = m->m_len;
314 	m_copy_rcvif(m, n);
315 	nip = mtod(m, struct ip *);
316 	/* ip_v set in ip_output */
317 	nip->ip_hl = sizeof(struct ip) >> 2;
318 	nip->ip_tos = 0;
319 	nip->ip_len = htons(m->m_len);
320 	/* ip_id set in ip_output */
321 	nip->ip_off = htons(0);
322 	/* ip_ttl set in icmp_reflect */
323 	nip->ip_p = IPPROTO_ICMP;
324 	nip->ip_src = oip->ip_src;
325 	nip->ip_dst = oip->ip_dst;
326 	icmp_reflect(m);
327 
328 freeit:
329 	m_freem(n);
330 
331 }
332 
333 static bool
334 ip4_check(struct mbuf *m)
335 {
336 	struct ip *iph;
337 	int hlen, len;
338 
339 	if (m->m_len < sizeof(struct ip) &&
340 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
341 		return false;
342 
343 	iph = mtod(m, struct ip *);
344 
345 	if (iph->ip_v != IPVERSION)
346 		goto freeit;
347 	hlen = iph->ip_hl << 2;
348 	if (hlen < sizeof(struct ip))
349 		goto freeit;
350 	if (hlen > m->m_len) {
351 		if ((m = m_pullup(m, hlen)) == NULL)
352 			return false;
353 		iph = mtod(m, struct ip *);
354 	}
355 	if (IN_MULTICAST(iph->ip_src.s_addr) ||
356 	    (ntohl(iph->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
357 	    (ntohl(iph->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
358 	    in_cksum(m, hlen) != 0)
359 		goto freeit;
360 
361 	len = ntohs(iph->ip_len);
362 	if (len < hlen || m->m_pkthdr.len < len)
363 		goto freeit;
364 
365 	return true;
366 freeit:
367 	m_freem(m);
368 	return false;
369 
370 }
371 
372 #endif	/* INET */
373 
374 struct mbuf *
375 mpls_ttl_dec(struct mbuf *m)
376 {
377 	union mpls_shim *mshim;
378 #ifdef INET
379 	union mpls_shim top_shim, bossh;
380 #endif
381 
382 	if (__predict_false(m->m_len < sizeof(union mpls_shim) &&
383 	    (m = m_pullup(m, sizeof(union mpls_shim))) == NULL))
384 		return NULL;
385 	mshim = mtod(m, union mpls_shim *);
386 	mshim->s_addr = ntohl(mshim->s_addr);
387 	mshim->shim.ttl--;
388 
389 	if (mshim->shim.ttl == 0) {
390 		if (!mpls_icmp_respond) {
391 			m_freem(m);
392 			return NULL;
393 		}
394 
395 #ifdef INET
396 		/*
397 		 * shim ttl exceeded
398 		 * send back ICMP type 11 code 0
399 		 */
400 		bossh.s_addr = mshim->s_addr;
401 		top_shim.s_addr = htonl(mshim->s_addr);
402 		m_adj(m, sizeof(union mpls_shim));
403 
404 		/* Goto BOS */
405 		while(bossh.shim.bos == 0) {
406 			if (m->m_len < sizeof(union mpls_shim) &&
407 			    (m = m_pullup(m, sizeof(union mpls_shim))) == NULL) {
408 				m_freem(m);
409 				return NULL;
410 			}
411 			bossh.s_addr = ntohl(mtod(m, union mpls_shim *)->s_addr);
412 			m_adj(m, sizeof(union mpls_shim));
413 		}
414 
415 		if (ip4_check(m) == true)
416 			mpls_icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS,
417 			    0, 0, &top_shim);
418 #else
419 		m_freem(m);
420 #endif
421 		return NULL;
422 	}
423 
424 	mshim->s_addr = htonl(mshim->s_addr);
425 
426 	return m;
427 }
428