icmp.c 37 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NET3: Implementation of the ICMP protocol layer.
  4. *
  5. * Alan Cox, <[email protected]>
  6. *
  7. * Some of the function names and the icmp unreach table for this
  8. * module were derived from [icmp.c 1.0.11 06/02/93] by
  9. * Ross Biro, Fred N. van Kempen, Mark Evans, Alan Cox, Gerhard Koerting.
  10. * Other than that this module is a complete rewrite.
  11. *
  12. * Fixes:
  13. * Clemens Fruhwirth : introduce global icmp rate limiting
  14. * with icmp type masking ability instead
  15. * of broken per type icmp timeouts.
  16. * Mike Shaver : RFC1122 checks.
  17. * Alan Cox : Multicast ping reply as self.
  18. * Alan Cox : Fix atomicity lockup in ip_build_xmit
  19. * call.
  20. * Alan Cox : Added 216,128 byte paths to the MTU
  21. * code.
  22. * Martin Mares : RFC1812 checks.
  23. * Martin Mares : Can be configured to follow redirects
  24. * if acting as a router _without_ a
  25. * routing protocol (RFC 1812).
  26. * Martin Mares : Echo requests may be configured to
  27. * be ignored (RFC 1812).
  28. * Martin Mares : Limitation of ICMP error message
  29. * transmit rate (RFC 1812).
  30. * Martin Mares : TOS and Precedence set correctly
  31. * (RFC 1812).
  32. * Martin Mares : Now copying as much data from the
  33. * original packet as we can without
  34. * exceeding 576 bytes (RFC 1812).
  35. * Willy Konynenberg : Transparent proxying support.
  36. * Keith Owens : RFC1191 correction for 4.2BSD based
  37. * path MTU bug.
  38. * Thomas Quinot : ICMP Dest Unreach codes up to 15 are
  39. * valid (RFC 1812).
  40. * Andi Kleen : Check all packet lengths properly
  41. * and moved all kfree_skb() up to
  42. * icmp_rcv.
  43. * Andi Kleen : Move the rate limit bookkeeping
  44. * into the dest entry and use a token
  45. * bucket filter (thanks to ANK). Make
  46. * the rates sysctl configurable.
  47. * Yu Tianli : Fixed two ugly bugs in icmp_send
  48. * - IP option length was accounted wrongly
  49. * - ICMP header length was not accounted
  50. * at all.
  51. * Tristan Greaves : Added sysctl option to ignore bogus
  52. * broadcast responses from broken routers.
  53. *
  54. * To Fix:
  55. *
  56. * - Should use skb_pull() instead of all the manual checking.
  57. * This would also greatly simply some upper layer error handlers. --AK
  58. */
  59. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  60. #include <linux/module.h>
  61. #include <linux/types.h>
  62. #include <linux/jiffies.h>
  63. #include <linux/kernel.h>
  64. #include <linux/fcntl.h>
  65. #include <linux/socket.h>
  66. #include <linux/in.h>
  67. #include <linux/inet.h>
  68. #include <linux/inetdevice.h>
  69. #include <linux/netdevice.h>
  70. #include <linux/string.h>
  71. #include <linux/netfilter_ipv4.h>
  72. #include <linux/slab.h>
  73. #include <net/snmp.h>
  74. #include <net/ip.h>
  75. #include <net/route.h>
  76. #include <net/protocol.h>
  77. #include <net/icmp.h>
  78. #include <net/tcp.h>
  79. #include <net/udp.h>
  80. #include <net/raw.h>
  81. #include <net/ping.h>
  82. #include <linux/skbuff.h>
  83. #include <net/sock.h>
  84. #include <linux/errno.h>
  85. #include <linux/timer.h>
  86. #include <linux/init.h>
  87. #include <linux/uaccess.h>
  88. #include <net/checksum.h>
  89. #include <net/xfrm.h>
  90. #include <net/inet_common.h>
  91. #include <net/ip_fib.h>
  92. #include <net/l3mdev.h>
  93. /*
  94. * Build xmit assembly blocks
  95. */
  96. struct icmp_bxm {
  97. struct sk_buff *skb;
  98. int offset;
  99. int data_len;
  100. struct {
  101. struct icmphdr icmph;
  102. __be32 times[3];
  103. } data;
  104. int head_len;
  105. struct ip_options_data replyopts;
  106. };
  107. /* An array of errno for error messages from dest unreach. */
  108. /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
  109. const struct icmp_err icmp_err_convert[] = {
  110. {
  111. .errno = ENETUNREACH, /* ICMP_NET_UNREACH */
  112. .fatal = 0,
  113. },
  114. {
  115. .errno = EHOSTUNREACH, /* ICMP_HOST_UNREACH */
  116. .fatal = 0,
  117. },
  118. {
  119. .errno = ENOPROTOOPT /* ICMP_PROT_UNREACH */,
  120. .fatal = 1,
  121. },
  122. {
  123. .errno = ECONNREFUSED, /* ICMP_PORT_UNREACH */
  124. .fatal = 1,
  125. },
  126. {
  127. .errno = EMSGSIZE, /* ICMP_FRAG_NEEDED */
  128. .fatal = 0,
  129. },
  130. {
  131. .errno = EOPNOTSUPP, /* ICMP_SR_FAILED */
  132. .fatal = 0,
  133. },
  134. {
  135. .errno = ENETUNREACH, /* ICMP_NET_UNKNOWN */
  136. .fatal = 1,
  137. },
  138. {
  139. .errno = EHOSTDOWN, /* ICMP_HOST_UNKNOWN */
  140. .fatal = 1,
  141. },
  142. {
  143. .errno = ENONET, /* ICMP_HOST_ISOLATED */
  144. .fatal = 1,
  145. },
  146. {
  147. .errno = ENETUNREACH, /* ICMP_NET_ANO */
  148. .fatal = 1,
  149. },
  150. {
  151. .errno = EHOSTUNREACH, /* ICMP_HOST_ANO */
  152. .fatal = 1,
  153. },
  154. {
  155. .errno = ENETUNREACH, /* ICMP_NET_UNR_TOS */
  156. .fatal = 0,
  157. },
  158. {
  159. .errno = EHOSTUNREACH, /* ICMP_HOST_UNR_TOS */
  160. .fatal = 0,
  161. },
  162. {
  163. .errno = EHOSTUNREACH, /* ICMP_PKT_FILTERED */
  164. .fatal = 1,
  165. },
  166. {
  167. .errno = EHOSTUNREACH, /* ICMP_PREC_VIOLATION */
  168. .fatal = 1,
  169. },
  170. {
  171. .errno = EHOSTUNREACH, /* ICMP_PREC_CUTOFF */
  172. .fatal = 1,
  173. },
  174. };
  175. EXPORT_SYMBOL(icmp_err_convert);
  176. /*
  177. * ICMP control array. This specifies what to do with each ICMP.
  178. */
  179. struct icmp_control {
  180. enum skb_drop_reason (*handler)(struct sk_buff *skb);
  181. short error; /* This ICMP is classed as an error message */
  182. };
  183. static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
  184. static DEFINE_PER_CPU(struct sock *, ipv4_icmp_sk);
  185. /* Called with BH disabled */
  186. static inline struct sock *icmp_xmit_lock(struct net *net)
  187. {
  188. struct sock *sk;
  189. sk = this_cpu_read(ipv4_icmp_sk);
  190. if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
  191. /* This can happen if the output path signals a
  192. * dst_link_failure() for an outgoing ICMP packet.
  193. */
  194. return NULL;
  195. }
  196. sock_net_set(sk, net);
  197. return sk;
  198. }
  199. static inline void icmp_xmit_unlock(struct sock *sk)
  200. {
  201. sock_net_set(sk, &init_net);
  202. spin_unlock(&sk->sk_lock.slock);
  203. }
  204. int sysctl_icmp_msgs_per_sec __read_mostly = 1000;
  205. int sysctl_icmp_msgs_burst __read_mostly = 50;
  206. static struct {
  207. spinlock_t lock;
  208. u32 credit;
  209. u32 stamp;
  210. } icmp_global = {
  211. .lock = __SPIN_LOCK_UNLOCKED(icmp_global.lock),
  212. };
  213. /**
  214. * icmp_global_allow - Are we allowed to send one more ICMP message ?
  215. *
  216. * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
  217. * Returns false if we reached the limit and can not send another packet.
  218. * Note: called with BH disabled
  219. */
  220. bool icmp_global_allow(void)
  221. {
  222. u32 credit, delta, incr = 0, now = (u32)jiffies;
  223. bool rc = false;
  224. /* Check if token bucket is empty and cannot be refilled
  225. * without taking the spinlock. The READ_ONCE() are paired
  226. * with the following WRITE_ONCE() in this same function.
  227. */
  228. if (!READ_ONCE(icmp_global.credit)) {
  229. delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ);
  230. if (delta < HZ / 50)
  231. return false;
  232. }
  233. spin_lock(&icmp_global.lock);
  234. delta = min_t(u32, now - icmp_global.stamp, HZ);
  235. if (delta >= HZ / 50) {
  236. incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ;
  237. if (incr)
  238. WRITE_ONCE(icmp_global.stamp, now);
  239. }
  240. credit = min_t(u32, icmp_global.credit + incr,
  241. READ_ONCE(sysctl_icmp_msgs_burst));
  242. if (credit) {
  243. /* We want to use a credit of one in average, but need to randomize
  244. * it for security reasons.
  245. */
  246. credit = max_t(int, credit - prandom_u32_max(3), 0);
  247. rc = true;
  248. }
  249. WRITE_ONCE(icmp_global.credit, credit);
  250. spin_unlock(&icmp_global.lock);
  251. return rc;
  252. }
  253. EXPORT_SYMBOL(icmp_global_allow);
  254. static bool icmpv4_mask_allow(struct net *net, int type, int code)
  255. {
  256. if (type > NR_ICMP_TYPES)
  257. return true;
  258. /* Don't limit PMTU discovery. */
  259. if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
  260. return true;
  261. /* Limit if icmp type is enabled in ratemask. */
  262. if (!((1 << type) & READ_ONCE(net->ipv4.sysctl_icmp_ratemask)))
  263. return true;
  264. return false;
  265. }
  266. static bool icmpv4_global_allow(struct net *net, int type, int code)
  267. {
  268. if (icmpv4_mask_allow(net, type, code))
  269. return true;
  270. if (icmp_global_allow())
  271. return true;
  272. return false;
  273. }
  274. /*
  275. * Send an ICMP frame.
  276. */
  277. static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
  278. struct flowi4 *fl4, int type, int code)
  279. {
  280. struct dst_entry *dst = &rt->dst;
  281. struct inet_peer *peer;
  282. bool rc = true;
  283. int vif;
  284. if (icmpv4_mask_allow(net, type, code))
  285. goto out;
  286. /* No rate limit on loopback */
  287. if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
  288. goto out;
  289. vif = l3mdev_master_ifindex(dst->dev);
  290. peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1);
  291. rc = inet_peer_xrlim_allow(peer,
  292. READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
  293. if (peer)
  294. inet_putpeer(peer);
  295. out:
  296. return rc;
  297. }
  298. /*
  299. * Maintain the counters used in the SNMP statistics for outgoing ICMP
  300. */
  301. void icmp_out_count(struct net *net, unsigned char type)
  302. {
  303. ICMPMSGOUT_INC_STATS(net, type);
  304. ICMP_INC_STATS(net, ICMP_MIB_OUTMSGS);
  305. }
  306. /*
  307. * Checksum each fragment, and on the first include the headers and final
  308. * checksum.
  309. */
  310. static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
  311. struct sk_buff *skb)
  312. {
  313. struct icmp_bxm *icmp_param = from;
  314. __wsum csum;
  315. csum = skb_copy_and_csum_bits(icmp_param->skb,
  316. icmp_param->offset + offset,
  317. to, len);
  318. skb->csum = csum_block_add(skb->csum, csum, odd);
  319. if (icmp_pointers[icmp_param->data.icmph.type].error)
  320. nf_ct_attach(skb, icmp_param->skb);
  321. return 0;
  322. }
  323. static void icmp_push_reply(struct sock *sk,
  324. struct icmp_bxm *icmp_param,
  325. struct flowi4 *fl4,
  326. struct ipcm_cookie *ipc, struct rtable **rt)
  327. {
  328. struct sk_buff *skb;
  329. if (ip_append_data(sk, fl4, icmp_glue_bits, icmp_param,
  330. icmp_param->data_len+icmp_param->head_len,
  331. icmp_param->head_len,
  332. ipc, rt, MSG_DONTWAIT) < 0) {
  333. __ICMP_INC_STATS(sock_net(sk), ICMP_MIB_OUTERRORS);
  334. ip_flush_pending_frames(sk);
  335. } else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
  336. struct icmphdr *icmph = icmp_hdr(skb);
  337. __wsum csum;
  338. struct sk_buff *skb1;
  339. csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
  340. (char *)icmph,
  341. icmp_param->head_len);
  342. skb_queue_walk(&sk->sk_write_queue, skb1) {
  343. csum = csum_add(csum, skb1->csum);
  344. }
  345. icmph->checksum = csum_fold(csum);
  346. skb->ip_summed = CHECKSUM_NONE;
  347. ip_push_pending_frames(sk, fl4);
  348. }
  349. }
  350. /*
  351. * Driving logic for building and sending ICMP messages.
  352. */
  353. static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
  354. {
  355. struct ipcm_cookie ipc;
  356. struct rtable *rt = skb_rtable(skb);
  357. struct net *net = dev_net(rt->dst.dev);
  358. struct flowi4 fl4;
  359. struct sock *sk;
  360. struct inet_sock *inet;
  361. __be32 daddr, saddr;
  362. u32 mark = IP4_REPLY_MARK(net, skb->mark);
  363. int type = icmp_param->data.icmph.type;
  364. int code = icmp_param->data.icmph.code;
  365. if (ip_options_echo(net, &icmp_param->replyopts.opt.opt, skb))
  366. return;
  367. /* Needed by both icmp_global_allow and icmp_xmit_lock */
  368. local_bh_disable();
  369. /* global icmp_msgs_per_sec */
  370. if (!icmpv4_global_allow(net, type, code))
  371. goto out_bh_enable;
  372. sk = icmp_xmit_lock(net);
  373. if (!sk)
  374. goto out_bh_enable;
  375. inet = inet_sk(sk);
  376. icmp_param->data.icmph.checksum = 0;
  377. ipcm_init(&ipc);
  378. inet->tos = ip_hdr(skb)->tos;
  379. ipc.sockc.mark = mark;
  380. daddr = ipc.addr = ip_hdr(skb)->saddr;
  381. saddr = fib_compute_spec_dst(skb);
  382. if (icmp_param->replyopts.opt.opt.optlen) {
  383. ipc.opt = &icmp_param->replyopts.opt;
  384. if (ipc.opt->opt.srr)
  385. daddr = icmp_param->replyopts.opt.opt.faddr;
  386. }
  387. memset(&fl4, 0, sizeof(fl4));
  388. fl4.daddr = daddr;
  389. fl4.saddr = saddr;
  390. fl4.flowi4_mark = mark;
  391. fl4.flowi4_uid = sock_net_uid(net, NULL);
  392. fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
  393. fl4.flowi4_proto = IPPROTO_ICMP;
  394. fl4.flowi4_oif = l3mdev_master_ifindex(skb->dev);
  395. security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
  396. rt = ip_route_output_key(net, &fl4);
  397. if (IS_ERR(rt))
  398. goto out_unlock;
  399. if (icmpv4_xrlim_allow(net, rt, &fl4, type, code))
  400. icmp_push_reply(sk, icmp_param, &fl4, &ipc, &rt);
  401. ip_rt_put(rt);
  402. out_unlock:
  403. icmp_xmit_unlock(sk);
  404. out_bh_enable:
  405. local_bh_enable();
  406. }
  407. /*
  408. * The device used for looking up which routing table to use for sending an ICMP
  409. * error is preferably the source whenever it is set, which should ensure the
  410. * icmp error can be sent to the source host, else lookup using the routing
  411. * table of the destination device, else use the main routing table (index 0).
  412. */
  413. static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
  414. {
  415. struct net_device *route_lookup_dev = NULL;
  416. if (skb->dev)
  417. route_lookup_dev = skb->dev;
  418. else if (skb_dst(skb))
  419. route_lookup_dev = skb_dst(skb)->dev;
  420. return route_lookup_dev;
  421. }
  422. static struct rtable *icmp_route_lookup(struct net *net,
  423. struct flowi4 *fl4,
  424. struct sk_buff *skb_in,
  425. const struct iphdr *iph,
  426. __be32 saddr, u8 tos, u32 mark,
  427. int type, int code,
  428. struct icmp_bxm *param)
  429. {
  430. struct net_device *route_lookup_dev;
  431. struct rtable *rt, *rt2;
  432. struct flowi4 fl4_dec;
  433. int err;
  434. memset(fl4, 0, sizeof(*fl4));
  435. fl4->daddr = (param->replyopts.opt.opt.srr ?
  436. param->replyopts.opt.opt.faddr : iph->saddr);
  437. fl4->saddr = saddr;
  438. fl4->flowi4_mark = mark;
  439. fl4->flowi4_uid = sock_net_uid(net, NULL);
  440. fl4->flowi4_tos = RT_TOS(tos);
  441. fl4->flowi4_proto = IPPROTO_ICMP;
  442. fl4->fl4_icmp_type = type;
  443. fl4->fl4_icmp_code = code;
  444. route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
  445. fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
  446. security_skb_classify_flow(skb_in, flowi4_to_flowi_common(fl4));
  447. rt = ip_route_output_key_hash(net, fl4, skb_in);
  448. if (IS_ERR(rt))
  449. return rt;
  450. /* No need to clone since we're just using its address. */
  451. rt2 = rt;
  452. rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
  453. flowi4_to_flowi(fl4), NULL, 0);
  454. if (!IS_ERR(rt)) {
  455. if (rt != rt2)
  456. return rt;
  457. } else if (PTR_ERR(rt) == -EPERM) {
  458. rt = NULL;
  459. } else
  460. return rt;
  461. err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
  462. if (err)
  463. goto relookup_failed;
  464. if (inet_addr_type_dev_table(net, route_lookup_dev,
  465. fl4_dec.saddr) == RTN_LOCAL) {
  466. rt2 = __ip_route_output_key(net, &fl4_dec);
  467. if (IS_ERR(rt2))
  468. err = PTR_ERR(rt2);
  469. } else {
  470. struct flowi4 fl4_2 = {};
  471. unsigned long orefdst;
  472. fl4_2.daddr = fl4_dec.saddr;
  473. rt2 = ip_route_output_key(net, &fl4_2);
  474. if (IS_ERR(rt2)) {
  475. err = PTR_ERR(rt2);
  476. goto relookup_failed;
  477. }
  478. /* Ugh! */
  479. orefdst = skb_in->_skb_refdst; /* save old refdst */
  480. skb_dst_set(skb_in, NULL);
  481. err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
  482. RT_TOS(tos), rt2->dst.dev);
  483. dst_release(&rt2->dst);
  484. rt2 = skb_rtable(skb_in);
  485. skb_in->_skb_refdst = orefdst; /* restore old refdst */
  486. }
  487. if (err)
  488. goto relookup_failed;
  489. rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
  490. flowi4_to_flowi(&fl4_dec), NULL,
  491. XFRM_LOOKUP_ICMP);
  492. if (!IS_ERR(rt2)) {
  493. dst_release(&rt->dst);
  494. memcpy(fl4, &fl4_dec, sizeof(*fl4));
  495. rt = rt2;
  496. } else if (PTR_ERR(rt2) == -EPERM) {
  497. if (rt)
  498. dst_release(&rt->dst);
  499. return rt2;
  500. } else {
  501. err = PTR_ERR(rt2);
  502. goto relookup_failed;
  503. }
  504. return rt;
  505. relookup_failed:
  506. if (rt)
  507. return rt;
  508. return ERR_PTR(err);
  509. }
  510. /*
  511. * Send an ICMP message in response to a situation
  512. *
  513. * RFC 1122: 3.2.2 MUST send at least the IP header and 8 bytes of header.
  514. * MAY send more (we do).
  515. * MUST NOT change this header information.
  516. * MUST NOT reply to a multicast/broadcast IP address.
  517. * MUST NOT reply to a multicast/broadcast MAC address.
  518. * MUST reply to only the first fragment.
  519. */
  520. void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
  521. const struct ip_options *opt)
  522. {
  523. struct iphdr *iph;
  524. int room;
  525. struct icmp_bxm icmp_param;
  526. struct rtable *rt = skb_rtable(skb_in);
  527. struct ipcm_cookie ipc;
  528. struct flowi4 fl4;
  529. __be32 saddr;
  530. u8 tos;
  531. u32 mark;
  532. struct net *net;
  533. struct sock *sk;
  534. if (!rt)
  535. goto out;
  536. if (rt->dst.dev)
  537. net = dev_net(rt->dst.dev);
  538. else if (skb_in->dev)
  539. net = dev_net(skb_in->dev);
  540. else
  541. goto out;
  542. /*
  543. * Find the original header. It is expected to be valid, of course.
  544. * Check this, icmp_send is called from the most obscure devices
  545. * sometimes.
  546. */
  547. iph = ip_hdr(skb_in);
  548. if ((u8 *)iph < skb_in->head ||
  549. (skb_network_header(skb_in) + sizeof(*iph)) >
  550. skb_tail_pointer(skb_in))
  551. goto out;
  552. /*
  553. * No replies to physical multicast/broadcast
  554. */
  555. if (skb_in->pkt_type != PACKET_HOST)
  556. goto out;
  557. /*
  558. * Now check at the protocol level
  559. */
  560. if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
  561. goto out;
  562. /*
  563. * Only reply to fragment 0. We byte re-order the constant
  564. * mask for efficiency.
  565. */
  566. if (iph->frag_off & htons(IP_OFFSET))
  567. goto out;
  568. /*
  569. * If we send an ICMP error to an ICMP error a mess would result..
  570. */
  571. if (icmp_pointers[type].error) {
  572. /*
  573. * We are an error, check if we are replying to an
  574. * ICMP error
  575. */
  576. if (iph->protocol == IPPROTO_ICMP) {
  577. u8 _inner_type, *itp;
  578. itp = skb_header_pointer(skb_in,
  579. skb_network_header(skb_in) +
  580. (iph->ihl << 2) +
  581. offsetof(struct icmphdr,
  582. type) -
  583. skb_in->data,
  584. sizeof(_inner_type),
  585. &_inner_type);
  586. if (!itp)
  587. goto out;
  588. /*
  589. * Assume any unknown ICMP type is an error. This
  590. * isn't specified by the RFC, but think about it..
  591. */
  592. if (*itp > NR_ICMP_TYPES ||
  593. icmp_pointers[*itp].error)
  594. goto out;
  595. }
  596. }
  597. /* Needed by both icmp_global_allow and icmp_xmit_lock */
  598. local_bh_disable();
  599. /* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
  600. * incoming dev is loopback. If outgoing dev change to not be
  601. * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
  602. */
  603. if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
  604. !icmpv4_global_allow(net, type, code))
  605. goto out_bh_enable;
  606. sk = icmp_xmit_lock(net);
  607. if (!sk)
  608. goto out_bh_enable;
  609. /*
  610. * Construct source address and options.
  611. */
  612. saddr = iph->daddr;
  613. if (!(rt->rt_flags & RTCF_LOCAL)) {
  614. struct net_device *dev = NULL;
  615. rcu_read_lock();
  616. if (rt_is_input_route(rt) &&
  617. READ_ONCE(net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr))
  618. dev = dev_get_by_index_rcu(net, inet_iif(skb_in));
  619. if (dev)
  620. saddr = inet_select_addr(dev, iph->saddr,
  621. RT_SCOPE_LINK);
  622. else
  623. saddr = 0;
  624. rcu_read_unlock();
  625. }
  626. tos = icmp_pointers[type].error ? (RT_TOS(iph->tos) |
  627. IPTOS_PREC_INTERNETCONTROL) :
  628. iph->tos;
  629. mark = IP4_REPLY_MARK(net, skb_in->mark);
  630. if (__ip_options_echo(net, &icmp_param.replyopts.opt.opt, skb_in, opt))
  631. goto out_unlock;
  632. /*
  633. * Prepare data for ICMP header.
  634. */
  635. icmp_param.data.icmph.type = type;
  636. icmp_param.data.icmph.code = code;
  637. icmp_param.data.icmph.un.gateway = info;
  638. icmp_param.data.icmph.checksum = 0;
  639. icmp_param.skb = skb_in;
  640. icmp_param.offset = skb_network_offset(skb_in);
  641. inet_sk(sk)->tos = tos;
  642. ipcm_init(&ipc);
  643. ipc.addr = iph->saddr;
  644. ipc.opt = &icmp_param.replyopts.opt;
  645. ipc.sockc.mark = mark;
  646. rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos, mark,
  647. type, code, &icmp_param);
  648. if (IS_ERR(rt))
  649. goto out_unlock;
  650. /* peer icmp_ratelimit */
  651. if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code))
  652. goto ende;
  653. /* RFC says return as much as we can without exceeding 576 bytes. */
  654. room = dst_mtu(&rt->dst);
  655. if (room > 576)
  656. room = 576;
  657. room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
  658. room -= sizeof(struct icmphdr);
  659. /* Guard against tiny mtu. We need to include at least one
  660. * IP network header for this message to make any sense.
  661. */
  662. if (room <= (int)sizeof(struct iphdr))
  663. goto ende;
  664. icmp_param.data_len = skb_in->len - icmp_param.offset;
  665. if (icmp_param.data_len > room)
  666. icmp_param.data_len = room;
  667. icmp_param.head_len = sizeof(struct icmphdr);
  668. /* if we don't have a source address at this point, fall back to the
  669. * dummy address instead of sending out a packet with a source address
  670. * of 0.0.0.0
  671. */
  672. if (!fl4.saddr)
  673. fl4.saddr = htonl(INADDR_DUMMY);
  674. icmp_push_reply(sk, &icmp_param, &fl4, &ipc, &rt);
  675. ende:
  676. ip_rt_put(rt);
  677. out_unlock:
  678. icmp_xmit_unlock(sk);
  679. out_bh_enable:
  680. local_bh_enable();
  681. out:;
  682. }
  683. EXPORT_SYMBOL(__icmp_send);
  684. #if IS_ENABLED(CONFIG_NF_NAT)
  685. #include <net/netfilter/nf_conntrack.h>
  686. void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
  687. {
  688. struct sk_buff *cloned_skb = NULL;
  689. struct ip_options opts = { 0 };
  690. enum ip_conntrack_info ctinfo;
  691. struct nf_conn *ct;
  692. __be32 orig_ip;
  693. ct = nf_ct_get(skb_in, &ctinfo);
  694. if (!ct || !(ct->status & IPS_SRC_NAT)) {
  695. __icmp_send(skb_in, type, code, info, &opts);
  696. return;
  697. }
  698. if (skb_shared(skb_in))
  699. skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
  700. if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
  701. (skb_network_header(skb_in) + sizeof(struct iphdr)) >
  702. skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
  703. skb_network_offset(skb_in) + sizeof(struct iphdr))))
  704. goto out;
  705. orig_ip = ip_hdr(skb_in)->saddr;
  706. ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
  707. __icmp_send(skb_in, type, code, info, &opts);
  708. ip_hdr(skb_in)->saddr = orig_ip;
  709. out:
  710. consume_skb(cloned_skb);
  711. }
  712. EXPORT_SYMBOL(icmp_ndo_send);
  713. #endif
  714. static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
  715. {
  716. const struct iphdr *iph = (const struct iphdr *)skb->data;
  717. const struct net_protocol *ipprot;
  718. int protocol = iph->protocol;
  719. /* Checkin full IP header plus 8 bytes of protocol to
  720. * avoid additional coding at protocol handlers.
  721. */
  722. if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) {
  723. __ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
  724. return;
  725. }
  726. raw_icmp_error(skb, protocol, info);
  727. ipprot = rcu_dereference(inet_protos[protocol]);
  728. if (ipprot && ipprot->err_handler)
  729. ipprot->err_handler(skb, info);
  730. }
  731. static bool icmp_tag_validation(int proto)
  732. {
  733. bool ok;
  734. rcu_read_lock();
  735. ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
  736. rcu_read_unlock();
  737. return ok;
  738. }
  739. /*
  740. * Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEEDED, ICMP_QUENCH, and
  741. * ICMP_PARAMETERPROB.
  742. */
  743. static enum skb_drop_reason icmp_unreach(struct sk_buff *skb)
  744. {
  745. enum skb_drop_reason reason = SKB_NOT_DROPPED_YET;
  746. const struct iphdr *iph;
  747. struct icmphdr *icmph;
  748. struct net *net;
  749. u32 info = 0;
  750. net = dev_net(skb_dst(skb)->dev);
  751. /*
  752. * Incomplete header ?
  753. * Only checks for the IP header, there should be an
  754. * additional check for longer headers in upper levels.
  755. */
  756. if (!pskb_may_pull(skb, sizeof(struct iphdr)))
  757. goto out_err;
  758. icmph = icmp_hdr(skb);
  759. iph = (const struct iphdr *)skb->data;
  760. if (iph->ihl < 5) { /* Mangled header, drop. */
  761. reason = SKB_DROP_REASON_IP_INHDR;
  762. goto out_err;
  763. }
  764. switch (icmph->type) {
  765. case ICMP_DEST_UNREACH:
  766. switch (icmph->code & 15) {
  767. case ICMP_NET_UNREACH:
  768. case ICMP_HOST_UNREACH:
  769. case ICMP_PROT_UNREACH:
  770. case ICMP_PORT_UNREACH:
  771. break;
  772. case ICMP_FRAG_NEEDED:
  773. /* for documentation of the ip_no_pmtu_disc
  774. * values please see
  775. * Documentation/networking/ip-sysctl.rst
  776. */
  777. switch (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) {
  778. default:
  779. net_dbg_ratelimited("%pI4: fragmentation needed and DF set\n",
  780. &iph->daddr);
  781. break;
  782. case 2:
  783. goto out;
  784. case 3:
  785. if (!icmp_tag_validation(iph->protocol))
  786. goto out;
  787. fallthrough;
  788. case 0:
  789. info = ntohs(icmph->un.frag.mtu);
  790. }
  791. break;
  792. case ICMP_SR_FAILED:
  793. net_dbg_ratelimited("%pI4: Source Route Failed\n",
  794. &iph->daddr);
  795. break;
  796. default:
  797. break;
  798. }
  799. if (icmph->code > NR_ICMP_UNREACH)
  800. goto out;
  801. break;
  802. case ICMP_PARAMETERPROB:
  803. info = ntohl(icmph->un.gateway) >> 24;
  804. break;
  805. case ICMP_TIME_EXCEEDED:
  806. __ICMP_INC_STATS(net, ICMP_MIB_INTIMEEXCDS);
  807. if (icmph->code == ICMP_EXC_FRAGTIME)
  808. goto out;
  809. break;
  810. }
  811. /*
  812. * Throw it at our lower layers
  813. *
  814. * RFC 1122: 3.2.2 MUST extract the protocol ID from the passed
  815. * header.
  816. * RFC 1122: 3.2.2.1 MUST pass ICMP unreach messages to the
  817. * transport layer.
  818. * RFC 1122: 3.2.2.2 MUST pass ICMP time expired messages to
  819. * transport layer.
  820. */
  821. /*
  822. * Check the other end isn't violating RFC 1122. Some routers send
  823. * bogus responses to broadcast frames. If you see this message
  824. * first check your netmask matches at both ends, if it does then
  825. * get the other vendor to fix their kit.
  826. */
  827. if (!READ_ONCE(net->ipv4.sysctl_icmp_ignore_bogus_error_responses) &&
  828. inet_addr_type_dev_table(net, skb->dev, iph->daddr) == RTN_BROADCAST) {
  829. net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n",
  830. &ip_hdr(skb)->saddr,
  831. icmph->type, icmph->code,
  832. &iph->daddr, skb->dev->name);
  833. goto out;
  834. }
  835. icmp_socket_deliver(skb, info);
  836. out:
  837. return reason;
  838. out_err:
  839. __ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
  840. return reason ?: SKB_DROP_REASON_NOT_SPECIFIED;
  841. }
  842. /*
  843. * Handle ICMP_REDIRECT.
  844. */
  845. static enum skb_drop_reason icmp_redirect(struct sk_buff *skb)
  846. {
  847. if (skb->len < sizeof(struct iphdr)) {
  848. __ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
  849. return SKB_DROP_REASON_PKT_TOO_SMALL;
  850. }
  851. if (!pskb_may_pull(skb, sizeof(struct iphdr))) {
  852. /* there aught to be a stat */
  853. return SKB_DROP_REASON_NOMEM;
  854. }
  855. icmp_socket_deliver(skb, ntohl(icmp_hdr(skb)->un.gateway));
  856. return SKB_NOT_DROPPED_YET;
  857. }
  858. /*
  859. * Handle ICMP_ECHO ("ping") and ICMP_EXT_ECHO ("PROBE") requests.
  860. *
  861. * RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
  862. * requests.
  863. * RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
  864. * included in the reply.
  865. * RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
  866. * echo requests, MUST have default=NOT.
  867. * RFC 8335: 8 MUST have a config option to enable/disable ICMP
  868. * Extended Echo Functionality, MUST be disabled by default
  869. * See also WRT handling of options once they are done and working.
  870. */
  871. static enum skb_drop_reason icmp_echo(struct sk_buff *skb)
  872. {
  873. struct icmp_bxm icmp_param;
  874. struct net *net;
  875. net = dev_net(skb_dst(skb)->dev);
  876. /* should there be an ICMP stat for ignored echos? */
  877. if (READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_all))
  878. return SKB_NOT_DROPPED_YET;
  879. icmp_param.data.icmph = *icmp_hdr(skb);
  880. icmp_param.skb = skb;
  881. icmp_param.offset = 0;
  882. icmp_param.data_len = skb->len;
  883. icmp_param.head_len = sizeof(struct icmphdr);
  884. if (icmp_param.data.icmph.type == ICMP_ECHO)
  885. icmp_param.data.icmph.type = ICMP_ECHOREPLY;
  886. else if (!icmp_build_probe(skb, &icmp_param.data.icmph))
  887. return SKB_NOT_DROPPED_YET;
  888. icmp_reply(&icmp_param, skb);
  889. return SKB_NOT_DROPPED_YET;
  890. }
  891. /* Helper for icmp_echo and icmpv6_echo_reply.
  892. * Searches for net_device that matches PROBE interface identifier
  893. * and builds PROBE reply message in icmphdr.
  894. *
  895. * Returns false if PROBE responses are disabled via sysctl
  896. */
  897. bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
  898. {
  899. struct icmp_ext_hdr *ext_hdr, _ext_hdr;
  900. struct icmp_ext_echo_iio *iio, _iio;
  901. struct net *net = dev_net(skb->dev);
  902. struct net_device *dev;
  903. char buff[IFNAMSIZ];
  904. u16 ident_len;
  905. u8 status;
  906. if (!READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe))
  907. return false;
  908. /* We currently only support probing interfaces on the proxy node
  909. * Check to ensure L-bit is set
  910. */
  911. if (!(ntohs(icmphdr->un.echo.sequence) & 1))
  912. return false;
  913. /* Clear status bits in reply message */
  914. icmphdr->un.echo.sequence &= htons(0xFF00);
  915. if (icmphdr->type == ICMP_EXT_ECHO)
  916. icmphdr->type = ICMP_EXT_ECHOREPLY;
  917. else
  918. icmphdr->type = ICMPV6_EXT_ECHO_REPLY;
  919. ext_hdr = skb_header_pointer(skb, 0, sizeof(_ext_hdr), &_ext_hdr);
  920. /* Size of iio is class_type dependent.
  921. * Only check header here and assign length based on ctype in the switch statement
  922. */
  923. iio = skb_header_pointer(skb, sizeof(_ext_hdr), sizeof(iio->extobj_hdr), &_iio);
  924. if (!ext_hdr || !iio)
  925. goto send_mal_query;
  926. if (ntohs(iio->extobj_hdr.length) <= sizeof(iio->extobj_hdr) ||
  927. ntohs(iio->extobj_hdr.length) > sizeof(_iio))
  928. goto send_mal_query;
  929. ident_len = ntohs(iio->extobj_hdr.length) - sizeof(iio->extobj_hdr);
  930. iio = skb_header_pointer(skb, sizeof(_ext_hdr),
  931. sizeof(iio->extobj_hdr) + ident_len, &_iio);
  932. if (!iio)
  933. goto send_mal_query;
  934. status = 0;
  935. dev = NULL;
  936. switch (iio->extobj_hdr.class_type) {
  937. case ICMP_EXT_ECHO_CTYPE_NAME:
  938. if (ident_len >= IFNAMSIZ)
  939. goto send_mal_query;
  940. memset(buff, 0, sizeof(buff));
  941. memcpy(buff, &iio->ident.name, ident_len);
  942. dev = dev_get_by_name(net, buff);
  943. break;
  944. case ICMP_EXT_ECHO_CTYPE_INDEX:
  945. if (ident_len != sizeof(iio->ident.ifindex))
  946. goto send_mal_query;
  947. dev = dev_get_by_index(net, ntohl(iio->ident.ifindex));
  948. break;
  949. case ICMP_EXT_ECHO_CTYPE_ADDR:
  950. if (ident_len < sizeof(iio->ident.addr.ctype3_hdr) ||
  951. ident_len != sizeof(iio->ident.addr.ctype3_hdr) +
  952. iio->ident.addr.ctype3_hdr.addrlen)
  953. goto send_mal_query;
  954. switch (ntohs(iio->ident.addr.ctype3_hdr.afi)) {
  955. case ICMP_AFI_IP:
  956. if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in_addr))
  957. goto send_mal_query;
  958. dev = ip_dev_find(net, iio->ident.addr.ip_addr.ipv4_addr);
  959. break;
  960. #if IS_ENABLED(CONFIG_IPV6)
  961. case ICMP_AFI_IP6:
  962. if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
  963. goto send_mal_query;
  964. dev = ipv6_stub->ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
  965. dev_hold(dev);
  966. break;
  967. #endif
  968. default:
  969. goto send_mal_query;
  970. }
  971. break;
  972. default:
  973. goto send_mal_query;
  974. }
  975. if (!dev) {
  976. icmphdr->code = ICMP_EXT_CODE_NO_IF;
  977. return true;
  978. }
  979. /* Fill bits in reply message */
  980. if (dev->flags & IFF_UP)
  981. status |= ICMP_EXT_ECHOREPLY_ACTIVE;
  982. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)
  983. status |= ICMP_EXT_ECHOREPLY_IPV4;
  984. if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))
  985. status |= ICMP_EXT_ECHOREPLY_IPV6;
  986. dev_put(dev);
  987. icmphdr->un.echo.sequence |= htons(status);
  988. return true;
  989. send_mal_query:
  990. icmphdr->code = ICMP_EXT_CODE_MAL_QUERY;
  991. return true;
  992. }
  993. EXPORT_SYMBOL_GPL(icmp_build_probe);
  994. /*
  995. * Handle ICMP Timestamp requests.
  996. * RFC 1122: 3.2.2.8 MAY implement ICMP timestamp requests.
  997. * SHOULD be in the kernel for minimum random latency.
  998. * MUST be accurate to a few minutes.
  999. * MUST be updated at least at 15Hz.
  1000. */
  1001. static enum skb_drop_reason icmp_timestamp(struct sk_buff *skb)
  1002. {
  1003. struct icmp_bxm icmp_param;
  1004. /*
  1005. * Too short.
  1006. */
  1007. if (skb->len < 4)
  1008. goto out_err;
  1009. /*
  1010. * Fill in the current time as ms since midnight UT:
  1011. */
  1012. icmp_param.data.times[1] = inet_current_timestamp();
  1013. icmp_param.data.times[2] = icmp_param.data.times[1];
  1014. BUG_ON(skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4));
  1015. icmp_param.data.icmph = *icmp_hdr(skb);
  1016. icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
  1017. icmp_param.data.icmph.code = 0;
  1018. icmp_param.skb = skb;
  1019. icmp_param.offset = 0;
  1020. icmp_param.data_len = 0;
  1021. icmp_param.head_len = sizeof(struct icmphdr) + 12;
  1022. icmp_reply(&icmp_param, skb);
  1023. return SKB_NOT_DROPPED_YET;
  1024. out_err:
  1025. __ICMP_INC_STATS(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
  1026. return SKB_DROP_REASON_PKT_TOO_SMALL;
  1027. }
  1028. static enum skb_drop_reason icmp_discard(struct sk_buff *skb)
  1029. {
  1030. /* pretend it was a success */
  1031. return SKB_NOT_DROPPED_YET;
  1032. }
  1033. /*
  1034. * Deal with incoming ICMP packets.
  1035. */
  1036. int icmp_rcv(struct sk_buff *skb)
  1037. {
  1038. enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
  1039. struct rtable *rt = skb_rtable(skb);
  1040. struct net *net = dev_net(rt->dst.dev);
  1041. struct icmphdr *icmph;
  1042. if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
  1043. struct sec_path *sp = skb_sec_path(skb);
  1044. int nh;
  1045. if (!(sp && sp->xvec[sp->len - 1]->props.flags &
  1046. XFRM_STATE_ICMP)) {
  1047. reason = SKB_DROP_REASON_XFRM_POLICY;
  1048. goto drop;
  1049. }
  1050. if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
  1051. goto drop;
  1052. nh = skb_network_offset(skb);
  1053. skb_set_network_header(skb, sizeof(*icmph));
  1054. if (!xfrm4_policy_check_reverse(NULL, XFRM_POLICY_IN,
  1055. skb)) {
  1056. reason = SKB_DROP_REASON_XFRM_POLICY;
  1057. goto drop;
  1058. }
  1059. skb_set_network_header(skb, nh);
  1060. }
  1061. __ICMP_INC_STATS(net, ICMP_MIB_INMSGS);
  1062. if (skb_checksum_simple_validate(skb))
  1063. goto csum_error;
  1064. if (!pskb_pull(skb, sizeof(*icmph)))
  1065. goto error;
  1066. icmph = icmp_hdr(skb);
  1067. ICMPMSGIN_INC_STATS(net, icmph->type);
  1068. /* Check for ICMP Extended Echo (PROBE) messages */
  1069. if (icmph->type == ICMP_EXT_ECHO) {
  1070. /* We can't use icmp_pointers[].handler() because it is an array of
  1071. * size NR_ICMP_TYPES + 1 (19 elements) and PROBE has code 42.
  1072. */
  1073. reason = icmp_echo(skb);
  1074. goto reason_check;
  1075. }
  1076. if (icmph->type == ICMP_EXT_ECHOREPLY) {
  1077. reason = ping_rcv(skb);
  1078. goto reason_check;
  1079. }
  1080. /*
  1081. * 18 is the highest 'known' ICMP type. Anything else is a mystery
  1082. *
  1083. * RFC 1122: 3.2.2 Unknown ICMP messages types MUST be silently
  1084. * discarded.
  1085. */
  1086. if (icmph->type > NR_ICMP_TYPES) {
  1087. reason = SKB_DROP_REASON_UNHANDLED_PROTO;
  1088. goto error;
  1089. }
  1090. /*
  1091. * Parse the ICMP message
  1092. */
  1093. if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
  1094. /*
  1095. * RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
  1096. * silently ignored (we let user decide with a sysctl).
  1097. * RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
  1098. * discarded if to broadcast/multicast.
  1099. */
  1100. if ((icmph->type == ICMP_ECHO ||
  1101. icmph->type == ICMP_TIMESTAMP) &&
  1102. READ_ONCE(net->ipv4.sysctl_icmp_echo_ignore_broadcasts)) {
  1103. reason = SKB_DROP_REASON_INVALID_PROTO;
  1104. goto error;
  1105. }
  1106. if (icmph->type != ICMP_ECHO &&
  1107. icmph->type != ICMP_TIMESTAMP &&
  1108. icmph->type != ICMP_ADDRESS &&
  1109. icmph->type != ICMP_ADDRESSREPLY) {
  1110. reason = SKB_DROP_REASON_INVALID_PROTO;
  1111. goto error;
  1112. }
  1113. }
  1114. reason = icmp_pointers[icmph->type].handler(skb);
  1115. reason_check:
  1116. if (!reason) {
  1117. consume_skb(skb);
  1118. return NET_RX_SUCCESS;
  1119. }
  1120. drop:
  1121. kfree_skb_reason(skb, reason);
  1122. return NET_RX_DROP;
  1123. csum_error:
  1124. reason = SKB_DROP_REASON_ICMP_CSUM;
  1125. __ICMP_INC_STATS(net, ICMP_MIB_CSUMERRORS);
  1126. error:
  1127. __ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
  1128. goto drop;
  1129. }
  1130. static bool ip_icmp_error_rfc4884_validate(const struct sk_buff *skb, int off)
  1131. {
  1132. struct icmp_extobj_hdr *objh, _objh;
  1133. struct icmp_ext_hdr *exth, _exth;
  1134. u16 olen;
  1135. exth = skb_header_pointer(skb, off, sizeof(_exth), &_exth);
  1136. if (!exth)
  1137. return false;
  1138. if (exth->version != 2)
  1139. return true;
  1140. if (exth->checksum &&
  1141. csum_fold(skb_checksum(skb, off, skb->len - off, 0)))
  1142. return false;
  1143. off += sizeof(_exth);
  1144. while (off < skb->len) {
  1145. objh = skb_header_pointer(skb, off, sizeof(_objh), &_objh);
  1146. if (!objh)
  1147. return false;
  1148. olen = ntohs(objh->length);
  1149. if (olen < sizeof(_objh))
  1150. return false;
  1151. off += olen;
  1152. if (off > skb->len)
  1153. return false;
  1154. }
  1155. return true;
  1156. }
  1157. void ip_icmp_error_rfc4884(const struct sk_buff *skb,
  1158. struct sock_ee_data_rfc4884 *out,
  1159. int thlen, int off)
  1160. {
  1161. int hlen;
  1162. /* original datagram headers: end of icmph to payload (skb->data) */
  1163. hlen = -skb_transport_offset(skb) - thlen;
  1164. /* per rfc 4884: minimal datagram length of 128 bytes */
  1165. if (off < 128 || off < hlen)
  1166. return;
  1167. /* kernel has stripped headers: return payload offset in bytes */
  1168. off -= hlen;
  1169. if (off + sizeof(struct icmp_ext_hdr) > skb->len)
  1170. return;
  1171. out->len = off;
  1172. if (!ip_icmp_error_rfc4884_validate(skb, off))
  1173. out->flags |= SO_EE_RFC4884_FLAG_INVALID;
  1174. }
  1175. EXPORT_SYMBOL_GPL(ip_icmp_error_rfc4884);
  1176. int icmp_err(struct sk_buff *skb, u32 info)
  1177. {
  1178. struct iphdr *iph = (struct iphdr *)skb->data;
  1179. int offset = iph->ihl<<2;
  1180. struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset);
  1181. int type = icmp_hdr(skb)->type;
  1182. int code = icmp_hdr(skb)->code;
  1183. struct net *net = dev_net(skb->dev);
  1184. /*
  1185. * Use ping_err to handle all icmp errors except those
  1186. * triggered by ICMP_ECHOREPLY which sent from kernel.
  1187. */
  1188. if (icmph->type != ICMP_ECHOREPLY) {
  1189. ping_err(skb, offset, info);
  1190. return 0;
  1191. }
  1192. if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
  1193. ipv4_update_pmtu(skb, net, info, 0, IPPROTO_ICMP);
  1194. else if (type == ICMP_REDIRECT)
  1195. ipv4_redirect(skb, net, 0, IPPROTO_ICMP);
  1196. return 0;
  1197. }
  1198. /*
  1199. * This table is the definition of how we handle ICMP.
  1200. */
  1201. static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
  1202. [ICMP_ECHOREPLY] = {
  1203. .handler = ping_rcv,
  1204. },
  1205. [1] = {
  1206. .handler = icmp_discard,
  1207. .error = 1,
  1208. },
  1209. [2] = {
  1210. .handler = icmp_discard,
  1211. .error = 1,
  1212. },
  1213. [ICMP_DEST_UNREACH] = {
  1214. .handler = icmp_unreach,
  1215. .error = 1,
  1216. },
  1217. [ICMP_SOURCE_QUENCH] = {
  1218. .handler = icmp_unreach,
  1219. .error = 1,
  1220. },
  1221. [ICMP_REDIRECT] = {
  1222. .handler = icmp_redirect,
  1223. .error = 1,
  1224. },
  1225. [6] = {
  1226. .handler = icmp_discard,
  1227. .error = 1,
  1228. },
  1229. [7] = {
  1230. .handler = icmp_discard,
  1231. .error = 1,
  1232. },
  1233. [ICMP_ECHO] = {
  1234. .handler = icmp_echo,
  1235. },
  1236. [9] = {
  1237. .handler = icmp_discard,
  1238. .error = 1,
  1239. },
  1240. [10] = {
  1241. .handler = icmp_discard,
  1242. .error = 1,
  1243. },
  1244. [ICMP_TIME_EXCEEDED] = {
  1245. .handler = icmp_unreach,
  1246. .error = 1,
  1247. },
  1248. [ICMP_PARAMETERPROB] = {
  1249. .handler = icmp_unreach,
  1250. .error = 1,
  1251. },
  1252. [ICMP_TIMESTAMP] = {
  1253. .handler = icmp_timestamp,
  1254. },
  1255. [ICMP_TIMESTAMPREPLY] = {
  1256. .handler = icmp_discard,
  1257. },
  1258. [ICMP_INFO_REQUEST] = {
  1259. .handler = icmp_discard,
  1260. },
  1261. [ICMP_INFO_REPLY] = {
  1262. .handler = icmp_discard,
  1263. },
  1264. [ICMP_ADDRESS] = {
  1265. .handler = icmp_discard,
  1266. },
  1267. [ICMP_ADDRESSREPLY] = {
  1268. .handler = icmp_discard,
  1269. },
  1270. };
  1271. static int __net_init icmp_sk_init(struct net *net)
  1272. {
  1273. /* Control parameters for ECHO replies. */
  1274. net->ipv4.sysctl_icmp_echo_ignore_all = 0;
  1275. net->ipv4.sysctl_icmp_echo_enable_probe = 0;
  1276. net->ipv4.sysctl_icmp_echo_ignore_broadcasts = 1;
  1277. /* Control parameter - ignore bogus broadcast responses? */
  1278. net->ipv4.sysctl_icmp_ignore_bogus_error_responses = 1;
  1279. /*
  1280. * Configurable global rate limit.
  1281. *
  1282. * ratelimit defines tokens/packet consumed for dst->rate_token
  1283. * bucket ratemask defines which icmp types are ratelimited by
  1284. * setting it's bit position.
  1285. *
  1286. * default:
  1287. * dest unreachable (3), source quench (4),
  1288. * time exceeded (11), parameter problem (12)
  1289. */
  1290. net->ipv4.sysctl_icmp_ratelimit = 1 * HZ;
  1291. net->ipv4.sysctl_icmp_ratemask = 0x1818;
  1292. net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;
  1293. return 0;
  1294. }
  1295. static struct pernet_operations __net_initdata icmp_sk_ops = {
  1296. .init = icmp_sk_init,
  1297. };
  1298. int __init icmp_init(void)
  1299. {
  1300. int err, i;
  1301. for_each_possible_cpu(i) {
  1302. struct sock *sk;
  1303. err = inet_ctl_sock_create(&sk, PF_INET,
  1304. SOCK_RAW, IPPROTO_ICMP, &init_net);
  1305. if (err < 0)
  1306. return err;
  1307. per_cpu(ipv4_icmp_sk, i) = sk;
  1308. /* Enough space for 2 64K ICMP packets, including
  1309. * sk_buff/skb_shared_info struct overhead.
  1310. */
  1311. sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
  1312. /*
  1313. * Speedup sock_wfree()
  1314. */
  1315. sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
  1316. inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
  1317. }
  1318. return register_pernet_subsys(&icmp_sk_ops);
  1319. }