* Copyright (c) 1982, 1986, 1989 Regents of the University of California.
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by the University of
* California, Berkeley and its contributors.
* 4. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* from: @(#)ip_icmp.c 7.15 (Berkeley) 4/20/91
* $Id: ip_icmp.c,v 1.5 1993/11/25 01:35:07 wollman Exp $
#include "../net/route.h"
* ICMP routines: error generation, receive packet processing, and
* routines to turnaround packets back to the originator, and
* host table maintenance routines.
#define satosin(sa) ((struct sockaddr_in *)(sa))
static void icmp_reflect(struct mbuf
*);
static void icmp_send(struct mbuf
*, struct mbuf
*);
* Generate an error packet of type error
* in response to bad packet ip.
icmp_error(n
, type
, code
, dest
, mtu
)
int mtu
; /* mtu for ICMP_UNREACH_SRCFRAG */
register struct ip
*oip
= mtod(n
, struct ip
*), *nip
;
register unsigned oiplen
= oip
->ip_hl
<< 2;
register struct icmp
*icp
;
register struct mbuf
*m
= 0;
printf("icmp_error(%x, %d, %d)\n", oip
, type
, code
);
if (type
!= ICMP_REDIRECT
)
* Quoth RFC 1122 (Requirements for Internet Hosts):
* An ICMP error message MUST NOT be sent as the result of
* - an ICMP error message, or
* - a datagram destined to an IP broadcast or IP multicast
* - a datagram sent as a link-layer broadcast, or
* - a non-initial fragment, or
* - a datagram whose source address does not define a single
* host -- e.g., a zero address, a loopback address, a
* broadcast address, a multicast address, or a Class E
* NOTE: THESE RESTRICTIONS TAKE PRECEDENCE OVER ANY REQUIREMENT
* ELSEWHERE IN THIS DOCUMENT FOR SENDING ICMP ERROR MESSAGES.
oaddr
= ntohl(oip
->ip_src
.s_addr
);
* Don't send error messages to multicast or broadcast addresses.
|| oaddr
== INADDR_BROADCAST
|| n
->m_flags
& (M_BCAST
| M_MCAST
)) {
icmpstat
.icps_oldmcast
++;
* Don't send error messages to zero addresses or class E's.
if (IN_EXPERIMENTAL(oaddr
)
|| ! in_lnaof(oip
->ip_src
)
|| ! in_netof(oip
->ip_src
)) {
icmpstat
.icps_oldbadaddr
++;
* Don't send error messages to loopback addresses.
* As a special (unauthorized) exception, we check to see
* if the packet came from the loopback interface. If it
* did, then we should allow the errors through, because
* the upper layers rely on them.
if(in_netof(oip
->ip_src
) == IN_LOOPBACKNET
&& !(m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
)) {
icmpstat
.icps_oldbadaddr
++;
* Don't send error if not the first fragment of message.
* Don't error if the old packet protocol was ICMP
* error message, only known informational types.
if (oip
->ip_off
&~ (IP_MF
|IP_DF
))
if (oip
->ip_p
== IPPROTO_ICMP
&& type
!= ICMP_REDIRECT
&&
n
->m_len
>= oiplen
+ ICMP_MINLEN
&&
!ICMP_INFOTYPE(((struct icmp
*)((caddr_t
)oip
+ oiplen
))->icmp_type
)) {
* First, formulate icmp message
m
= m_gethdr(M_DONTWAIT
, MT_HEADER
);
icmplen
= oiplen
+ min(8, oip
->ip_len
);
m
->m_len
= icmplen
+ ICMP_MINLEN
;
icp
= mtod(m
, struct icmp
*);
if ((u_int
)type
> ICMP_MAXTYPE
)
icmpstat
.icps_outhist
[type
]++;
if (type
== ICMP_REDIRECT
)
else if (type
== ICMP_UNREACH
&& code
== ICMP_UNREACH_NEEDFRAG
) {
icp
->icmp_mtu
= htons(mtu
);
if (type
== ICMP_PARAMPROB
) {
bcopy((caddr_t
)oip
, (caddr_t
)&icp
->icmp_ip
, icmplen
);
nip
->ip_len
= htons((u_short
)(nip
->ip_len
+ oiplen
));
* Now, copy old ip header (without options)
* in front of icmp message.
if (m
->m_data
- sizeof(struct ip
) < m
->m_pktdat
)
m
->m_data
-= sizeof(struct ip
);
m
->m_len
+= sizeof(struct ip
);
m
->m_pkthdr
.len
= m
->m_len
;
m
->m_pkthdr
.rcvif
= n
->m_pkthdr
.rcvif
;
nip
= mtod(m
, struct ip
*);
bcopy((caddr_t
)oip
, (caddr_t
)nip
, oiplen
);
nip
->ip_hl
= sizeof(struct ip
) >> 2;
nip
->ip_p
= IPPROTO_ICMP
;
static struct sockproto icmproto
= { AF_INET
, IPPROTO_ICMP
};
static struct sockaddr_in icmpsrc
= { sizeof (struct sockaddr_in
), AF_INET
};
static struct sockaddr_in icmpdst
= { sizeof (struct sockaddr_in
), AF_INET
};
static struct sockaddr_in icmpgw
= { sizeof (struct sockaddr_in
), AF_INET
};
* Process a received ICMP message.
register struct icmp
*icp
;
register struct ip
*ip
= mtod(m
, struct ip
*);
int icmplen
= ip
->ip_len
;
* Locate icmp structure in mbuf, and check
* that not corrupted and of at least minimum length.
printf("icmp_input from %x, len %d\n", ip
->ip_src
, icmplen
);
if (icmplen
< ICMP_MINLEN
) {
icmpstat
.icps_tooshort
++;
i
= hlen
+ MIN(icmplen
, ICMP_ADVLENMIN
);
if (m
->m_len
< i
&& (m
= m_pullup(m
, i
)) == 0) {
icmpstat
.icps_tooshort
++;
ip
= mtod(m
, struct ip
*);
icp
= mtod(m
, struct icmp
*);
if (in_cksum(m
, icmplen
)) {
icmpstat
.icps_checksum
++;
* Message type specific processing.
printf("icmp_input, type %d code %d\n", icp
->icmp_type
,
if (icp
->icmp_type
> ICMP_MAXTYPE
)
icmpstat
.icps_inhist
[icp
->icmp_type
]++;
switch (icp
->icmp_type
) {
if (code
> ICMP_UNREACH_MAXCODE
)
if (code
== ICMP_UNREACH_NEEDFRAG
) {
* Need to adjust the routing tables immediately;
* when ULP's get the PRC_MSGSIZE, it is their
* responsibility to notice it and update their
* internal ideas of MTU-derived protocol parameters.
in_mtureduce(icp
->icmp_ip
.ip_dst
,
if (code
> ICMP_TIMXCEED_MAXCODE
)
code
+= PRC_TIMXCEED_INTRANS
;
if (code
> ICMP_PARAMPROB_MAXCODE
)
* Problem with datagram; advise higher level routines.
if (icmplen
< ICMP_ADVLENMIN
|| icmplen
< ICMP_ADVLEN(icp
) ||
icp
->icmp_ip
.ip_hl
< (sizeof(struct ip
) >> 2)) {
NTOHS(icp
->icmp_ip
.ip_len
);
printf("deliver to protocol %d\n", icp
->icmp_ip
.ip_p
);
icmpsrc
.sin_addr
= icp
->icmp_ip
.ip_dst
;
if (ctlfunc
= inetsw
[ip_protox
[icp
->icmp_ip
.ip_p
]].pr_ctlinput
)
(*ctlfunc
)(code
, (struct sockaddr
*)&icmpsrc
,
* Always respond to pings from valid addresses.
* Don't respond to broadcast pings unless ipbroadcastecho
* is set. Don't respond to multicast pings unless
* ipbraodcastecho is set AND we support multicasting
* to begin with. (Per RFC 1122, we may choose either.)
u_long srcaddr
= ntohl(icp
->icmp_ip
.ip_src
.s_addr
);
if(IN_MULTICAST(srcaddr
) && !ipbroadcastecho
)
#else /* not MULTICAST */
if(IN_MULTICAST(srcaddr
))
#endif /* not MULTICAST */
if((srcaddr
== INADDR_BROADCAST
icp
->icmp_type
= ICMP_ECHOREPLY
;
if (icmplen
< ICMP_TSLEN
) {
icp
->icmp_type
= ICMP_TSTAMPREPLY
;
icp
->icmp_rtime
= iptime();
icp
->icmp_ttime
= icp
->icmp_rtime
; /* bogus, do later! */
* Per RFC 1122, only respond to ICMP mask requests
* if the administrator has SPECIFICALLY CONFIGURED
* this host as an address mask agent.
if (icmplen
< ICMP_MASKLEN
||
(ia
= ifptoia(m
->m_pkthdr
.rcvif
)) == 0)
icp
->icmp_type
= ICMP_MASKREPLY
;
icp
->icmp_mask
= ia
->ia_sockmask
.sin_addr
.s_addr
;
if (ip
->ip_src
.s_addr
== 0) {
if (ia
->ia_ifp
->if_flags
& IFF_BROADCAST
)
ip
->ip_src
= satosin(&ia
->ia_broadaddr
)->sin_addr
;
else if (ia
->ia_ifp
->if_flags
& IFF_POINTOPOINT
)
ip
->ip_src
= satosin(&ia
->ia_dstaddr
)->sin_addr
;
ip
->ip_len
+= hlen
; /* since ip_input deducts this */
icmpstat
.icps_outhist
[icp
->icmp_type
]++;
if (icmplen
< ICMP_ADVLENMIN
|| icmplen
< ICMP_ADVLEN(icp
)) {
* Short circuit routing redirects to force
* immediate change in the kernel's routing
* tables. The message is also handed to anyone
* listening on a raw socket (e.g. the routing
* daemon for use in updating its tables).
icmpgw
.sin_addr
= ip
->ip_src
;
icmpdst
.sin_addr
= icp
->icmp_gwaddr
;
printf("redirect dst %x to %x\n", icp
->icmp_ip
.ip_dst
,
* Per RFC 1122, throw away redirects that
* suggested places we can't get to, or
* an interface other than the one the packet
* It also says that we SHOULD throw away
* redirects that come from someone other
* than the current first-hop gateway for the
* These are both implemented as general policy
if (code
== ICMP_REDIRECT_NET
|| code
== ICMP_REDIRECT_TOSNET
) {
in_makeaddr(in_netof(icp
->icmp_ip
.ip_dst
), INADDR_ANY
);
in_sockmaskof(icp
->icmp_ip
.ip_dst
, &icmpmask
);
rtredirect((struct sockaddr
*)&icmpsrc
,
(struct sockaddr
*)&icmpdst
,
(struct sockaddr
*)&icmpmask
, RTF_GATEWAY
,
(struct sockaddr
*)&icmpgw
, (struct rtentry
**)0);
icmpsrc
.sin_addr
= icp
->icmp_ip
.ip_dst
;
pfctlinput(PRC_REDIRECT_NET
,
(struct sockaddr
*)&icmpsrc
);
icmpsrc
.sin_addr
= icp
->icmp_ip
.ip_dst
;
rtredirect((struct sockaddr
*)&icmpsrc
,
(struct sockaddr
*)&icmpdst
,
(struct sockaddr
*)0, RTF_GATEWAY
| RTF_HOST
,
(struct sockaddr
*)&icmpgw
, (struct rtentry
**)0);
pfctlinput(PRC_REDIRECT_HOST
,
(struct sockaddr
*)&icmpsrc
);
* No kernel processing for the following;
* just fall through to send to raw listener.
icmpsrc
.sin_addr
= ip
->ip_src
;
icmpdst
.sin_addr
= ip
->ip_dst
;
(void) raw_input(m
, &icmproto
, (struct sockaddr
*)&icmpsrc
,
(struct sockaddr
*)&icmpdst
);
* Reflect the ip packet back to the source
register struct ip
*ip
= mtod(m
, struct ip
*);
register struct in_ifaddr
*ia
;
struct mbuf
*opts
= 0, *ip_srcroute();
int optlen
= (ip
->ip_hl
<< 2) - sizeof(struct ip
);
* If the incoming packet was addressed directly to us,
* use dst as the src for the reply. Otherwise (broadcast
* or anonymous), use the address which corresponds
* to the incoming interface.
for (ia
= in_ifaddr
; ia
; ia
= ia
->ia_next
) {
if (t
.s_addr
== IA_SIN(ia
)->sin_addr
.s_addr
)
if ((ia
->ia_ifp
->if_flags
& IFF_BROADCAST
) &&
t
.s_addr
== satosin(&ia
->ia_broadaddr
)->sin_addr
.s_addr
)
if (ia
== (struct in_ifaddr
*)0)
ia
= ifptoia(m
->m_pkthdr
.rcvif
);
if (ia
== (struct in_ifaddr
*)0)
t
= IA_SIN(ia
)->sin_addr
;
* Retrieve any source routing from the incoming packet;
* add on any record-route or timestamp options.
cp
= (u_char
*) (ip
+ 1);
if ((opts
= ip_srcroute()) == 0 &&
(opts
= m_gethdr(M_DONTWAIT
, MT_HEADER
))) {
opts
->m_len
= sizeof(struct in_addr
);
mtod(opts
, struct in_addr
*)->s_addr
= 0;
printf("icmp_reflect optlen %d rt %d => ",
for (cnt
= optlen
; cnt
> 0; cnt
-= len
, cp
+= len
) {
if (len
<= 0 || len
> cnt
)
* should check for overflow, but it "can't happen"
if (opt
== IPOPT_RR
|| opt
== IPOPT_TS
) {
mtod(opts
, caddr_t
) + opts
->m_len
, len
);
if (opts
->m_len
% 4 != 0) {
*(mtod(opts
, caddr_t
) + opts
->m_len
) = IPOPT_EOL
;
printf("%d\n", opts
->m_len
);
* Now strip out original options by copying rest of first
* mbuf's data back, and adjust the IP length.
ip
->ip_hl
= sizeof(struct ip
) >> 2;
if (m
->m_flags
& M_PKTHDR
)
m
->m_pkthdr
.len
-= optlen
;
optlen
+= sizeof(struct ip
);
bcopy((caddr_t
)ip
+ optlen
, (caddr_t
)(ip
+ 1),
(unsigned)(m
->m_len
- sizeof(struct ip
)));
register struct in_ifaddr
*ia
;
for (ia
= in_ifaddr
; ia
; ia
= ia
->ia_next
)
return ((struct in_ifaddr
*)0);
* Send an icmp packet back to the ip level,
* after supplying a checksum.
register struct ip
*ip
= mtod(m
, struct ip
*);
register struct icmp
*icp
;
icp
= mtod(m
, struct icmp
*);
icp
->icmp_cksum
= in_cksum(m
, ip
->ip_len
- hlen
);
printf("icmp_send dst %x src %x\n", ip
->ip_dst
, ip
->ip_src
);
(void) ip_output(m
, opts
, (struct route
*)0, 0);
t
= (atv
.tv_sec
% (24*60*60)) * 1000 + atv
.tv_usec
/ 1000;