xref: /openbmc/linux/net/ipv4/icmp.c (revision d5cb9783536a41df9f9cba5b0a1d78047ed787f7)
1 /*
2  *	NET3:	Implementation of the ICMP protocol layer.
3  *
4  *		Alan Cox, <alan@redhat.com>
5  *
6  *	Version: $Id: icmp.c,v 1.85 2002/02/01 22:01:03 davem Exp $
7  *
8  *	This program is free software; you can redistribute it and/or
9  *	modify it under the terms of the GNU General Public License
10  *	as published by the Free Software Foundation; either version
11  *	2 of the License, or (at your option) any later version.
12  *
13  *	Some of the function names and the icmp unreach table for this
14  *	module were derived from [icmp.c 1.0.11 06/02/93] by
15  *	Ross Biro, Fred N. van Kempen, Mark Evans, Alan Cox, Gerhard Koerting.
16  *	Other than that this module is a complete rewrite.
17  *
18  *	Fixes:
19  *	Clemens Fruhwirth	:	introduce global icmp rate limiting
20  *					with icmp type masking ability instead
21  *					of broken per type icmp timeouts.
22  *		Mike Shaver	:	RFC1122 checks.
23  *		Alan Cox	:	Multicast ping reply as self.
24  *		Alan Cox	:	Fix atomicity lockup in ip_build_xmit
25  *					call.
26  *		Alan Cox	:	Added 216,128 byte paths to the MTU
27  *					code.
28  *		Martin Mares	:	RFC1812 checks.
29  *		Martin Mares	:	Can be configured to follow redirects
30  *					if acting as a router _without_ a
31  *					routing protocol (RFC 1812).
32  *		Martin Mares	:	Echo requests may be configured to
33  *					be ignored (RFC 1812).
34  *		Martin Mares	:	Limitation of ICMP error message
35  *					transmit rate (RFC 1812).
36  *		Martin Mares	:	TOS and Precedence set correctly
37  *					(RFC 1812).
38  *		Martin Mares	:	Now copying as much data from the
39  *					original packet as we can without
40  *					exceeding 576 bytes (RFC 1812).
41  *	Willy Konynenberg	:	Transparent proxying support.
42  *		Keith Owens	:	RFC1191 correction for 4.2BSD based
43  *					path MTU bug.
44  *		Thomas Quinot	:	ICMP Dest Unreach codes up to 15 are
45  *					valid (RFC 1812).
46  *		Andi Kleen	:	Check all packet lengths properly
47  *					and moved all kfree_skb() up to
48  *					icmp_rcv.
49  *		Andi Kleen	:	Move the rate limit bookkeeping
50  *					into the dest entry and use a token
51  *					bucket filter (thanks to ANK). Make
52  *					the rates sysctl configurable.
53  *		Yu Tianli	:	Fixed two ugly bugs in icmp_send
54  *					- IP option length was accounted wrongly
55  *					- ICMP header length was not accounted
56  *					  at all.
57  *              Tristan Greaves :       Added sysctl option to ignore bogus
58  *              			broadcast responses from broken routers.
59  *
60  * To Fix:
61  *
62  *	- Should use skb_pull() instead of all the manual checking.
63  *	  This would also greatly simply some upper layer error handlers. --AK
64  *
65  */
66 
67 #include <linux/config.h>
68 #include <linux/module.h>
69 #include <linux/types.h>
70 #include <linux/jiffies.h>
71 #include <linux/kernel.h>
72 #include <linux/fcntl.h>
73 #include <linux/socket.h>
74 #include <linux/in.h>
75 #include <linux/inet.h>
76 #include <linux/netdevice.h>
77 #include <linux/string.h>
78 #include <linux/netfilter_ipv4.h>
79 #include <net/snmp.h>
80 #include <net/ip.h>
81 #include <net/route.h>
82 #include <net/protocol.h>
83 #include <net/icmp.h>
84 #include <net/tcp.h>
85 #include <net/udp.h>
86 #include <net/raw.h>
87 #include <linux/skbuff.h>
88 #include <net/sock.h>
89 #include <linux/errno.h>
90 #include <linux/timer.h>
91 #include <linux/init.h>
92 #include <asm/system.h>
93 #include <asm/uaccess.h>
94 #include <net/checksum.h>
95 
96 /*
97  *	Build xmit assembly blocks
98  */
99 
100 struct icmp_bxm {
101 	struct sk_buff *skb;
102 	int offset;
103 	int data_len;
104 
105 	struct {
106 		struct icmphdr icmph;
107 		__u32	       times[3];
108 	} data;
109 	int head_len;
110 	struct ip_options replyopts;
111 	unsigned char  optbuf[40];
112 };
113 
114 /*
115  *	Statistics
116  */
117 DEFINE_SNMP_STAT(struct icmp_mib, icmp_statistics) __read_mostly;
118 
119 /* An array of errno for error messages from dest unreach. */
120 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
121 
122 struct icmp_err icmp_err_convert[] = {
123 	{
124 		.errno = ENETUNREACH,	/* ICMP_NET_UNREACH */
125 		.fatal = 0,
126 	},
127 	{
128 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNREACH */
129 		.fatal = 0,
130 	},
131 	{
132 		.errno = ENOPROTOOPT	/* ICMP_PROT_UNREACH */,
133 		.fatal = 1,
134 	},
135 	{
136 		.errno = ECONNREFUSED,	/* ICMP_PORT_UNREACH */
137 		.fatal = 1,
138 	},
139 	{
140 		.errno = EMSGSIZE,	/* ICMP_FRAG_NEEDED */
141 		.fatal = 0,
142 	},
143 	{
144 		.errno = EOPNOTSUPP,	/* ICMP_SR_FAILED */
145 		.fatal = 0,
146 	},
147 	{
148 		.errno = ENETUNREACH,	/* ICMP_NET_UNKNOWN */
149 		.fatal = 1,
150 	},
151 	{
152 		.errno = EHOSTDOWN,	/* ICMP_HOST_UNKNOWN */
153 		.fatal = 1,
154 	},
155 	{
156 		.errno = ENONET,	/* ICMP_HOST_ISOLATED */
157 		.fatal = 1,
158 	},
159 	{
160 		.errno = ENETUNREACH,	/* ICMP_NET_ANO	*/
161 		.fatal = 1,
162 	},
163 	{
164 		.errno = EHOSTUNREACH,	/* ICMP_HOST_ANO */
165 		.fatal = 1,
166 	},
167 	{
168 		.errno = ENETUNREACH,	/* ICMP_NET_UNR_TOS */
169 		.fatal = 0,
170 	},
171 	{
172 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNR_TOS */
173 		.fatal = 0,
174 	},
175 	{
176 		.errno = EHOSTUNREACH,	/* ICMP_PKT_FILTERED */
177 		.fatal = 1,
178 	},
179 	{
180 		.errno = EHOSTUNREACH,	/* ICMP_PREC_VIOLATION */
181 		.fatal = 1,
182 	},
183 	{
184 		.errno = EHOSTUNREACH,	/* ICMP_PREC_CUTOFF */
185 		.fatal = 1,
186 	},
187 };
188 
189 /* Control parameters for ECHO replies. */
190 int sysctl_icmp_echo_ignore_all;
191 int sysctl_icmp_echo_ignore_broadcasts = 1;
192 
193 /* Control parameter - ignore bogus broadcast responses? */
194 int sysctl_icmp_ignore_bogus_error_responses;
195 
196 /*
197  * 	Configurable global rate limit.
198  *
199  *	ratelimit defines tokens/packet consumed for dst->rate_token bucket
200  *	ratemask defines which icmp types are ratelimited by setting
201  * 	it's bit position.
202  *
203  *	default:
204  *	dest unreachable (3), source quench (4),
205  *	time exceeded (11), parameter problem (12)
206  */
207 
208 int sysctl_icmp_ratelimit = 1 * HZ;
209 int sysctl_icmp_ratemask = 0x1818;
210 int sysctl_icmp_errors_use_inbound_ifaddr;
211 
212 /*
213  *	ICMP control array. This specifies what to do with each ICMP.
214  */
215 
216 struct icmp_control {
217 	int output_entry;	/* Field for increment on output */
218 	int input_entry;	/* Field for increment on input */
219 	void (*handler)(struct sk_buff *skb);
220 	short   error;		/* This ICMP is classed as an error message */
221 };
222 
223 static struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
224 
225 /*
226  *	The ICMP socket(s). This is the most convenient way to flow control
227  *	our ICMP output as well as maintain a clean interface throughout
228  *	all layers. All Socketless IP sends will soon be gone.
229  *
230  *	On SMP we have one ICMP socket per-cpu.
231  */
232 static DEFINE_PER_CPU(struct socket *, __icmp_socket) = NULL;
233 #define icmp_socket	__get_cpu_var(__icmp_socket)
234 
235 static __inline__ int icmp_xmit_lock(void)
236 {
237 	local_bh_disable();
238 
239 	if (unlikely(!spin_trylock(&icmp_socket->sk->sk_lock.slock))) {
240 		/* This can happen if the output path signals a
241 		 * dst_link_failure() for an outgoing ICMP packet.
242 		 */
243 		local_bh_enable();
244 		return 1;
245 	}
246 	return 0;
247 }
248 
249 static void icmp_xmit_unlock(void)
250 {
251 	spin_unlock_bh(&icmp_socket->sk->sk_lock.slock);
252 }
253 
254 /*
255  *	Send an ICMP frame.
256  */
257 
258 /*
259  *	Check transmit rate limitation for given message.
260  *	The rate information is held in the destination cache now.
261  *	This function is generic and could be used for other purposes
262  *	too. It uses a Token bucket filter as suggested by Alexey Kuznetsov.
263  *
264  *	Note that the same dst_entry fields are modified by functions in
265  *	route.c too, but these work for packet destinations while xrlim_allow
266  *	works for icmp destinations. This means the rate limiting information
267  *	for one "ip object" is shared - and these ICMPs are twice limited:
268  *	by source and by destination.
269  *
270  *	RFC 1812: 4.3.2.8 SHOULD be able to limit error message rate
271  *			  SHOULD allow setting of rate limits
272  *
273  * 	Shared between ICMPv4 and ICMPv6.
274  */
275 #define XRLIM_BURST_FACTOR 6
276 int xrlim_allow(struct dst_entry *dst, int timeout)
277 {
278 	unsigned long now;
279 	int rc = 0;
280 
281 	now = jiffies;
282 	dst->rate_tokens += now - dst->rate_last;
283 	dst->rate_last = now;
284 	if (dst->rate_tokens > XRLIM_BURST_FACTOR * timeout)
285 		dst->rate_tokens = XRLIM_BURST_FACTOR * timeout;
286 	if (dst->rate_tokens >= timeout) {
287 		dst->rate_tokens -= timeout;
288 		rc = 1;
289 	}
290 	return rc;
291 }
292 
293 static inline int icmpv4_xrlim_allow(struct rtable *rt, int type, int code)
294 {
295 	struct dst_entry *dst = &rt->u.dst;
296 	int rc = 1;
297 
298 	if (type > NR_ICMP_TYPES)
299 		goto out;
300 
301 	/* Don't limit PMTU discovery. */
302 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
303 		goto out;
304 
305 	/* No rate limit on loopback */
306 	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
307  		goto out;
308 
309 	/* Limit if icmp type is enabled in ratemask. */
310 	if ((1 << type) & sysctl_icmp_ratemask)
311 		rc = xrlim_allow(dst, sysctl_icmp_ratelimit);
312 out:
313 	return rc;
314 }
315 
316 /*
317  *	Maintain the counters used in the SNMP statistics for outgoing ICMP
318  */
319 static void icmp_out_count(int type)
320 {
321 	if (type <= NR_ICMP_TYPES) {
322 		ICMP_INC_STATS(icmp_pointers[type].output_entry);
323 		ICMP_INC_STATS(ICMP_MIB_OUTMSGS);
324 	}
325 }
326 
327 /*
328  *	Checksum each fragment, and on the first include the headers and final
329  *	checksum.
330  */
331 static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
332 			  struct sk_buff *skb)
333 {
334 	struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
335 	unsigned int csum;
336 
337 	csum = skb_copy_and_csum_bits(icmp_param->skb,
338 				      icmp_param->offset + offset,
339 				      to, len, 0);
340 
341 	skb->csum = csum_block_add(skb->csum, csum, odd);
342 	if (icmp_pointers[icmp_param->data.icmph.type].error)
343 		nf_ct_attach(skb, icmp_param->skb);
344 	return 0;
345 }
346 
347 static void icmp_push_reply(struct icmp_bxm *icmp_param,
348 			    struct ipcm_cookie *ipc, struct rtable *rt)
349 {
350 	struct sk_buff *skb;
351 
352 	if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
353 		           icmp_param->data_len+icmp_param->head_len,
354 		           icmp_param->head_len,
355 		           ipc, rt, MSG_DONTWAIT) < 0)
356 		ip_flush_pending_frames(icmp_socket->sk);
357 	else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
358 		struct icmphdr *icmph = skb->h.icmph;
359 		unsigned int csum = 0;
360 		struct sk_buff *skb1;
361 
362 		skb_queue_walk(&icmp_socket->sk->sk_write_queue, skb1) {
363 			csum = csum_add(csum, skb1->csum);
364 		}
365 		csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
366 						 (char *)icmph,
367 						 icmp_param->head_len, csum);
368 		icmph->checksum = csum_fold(csum);
369 		skb->ip_summed = CHECKSUM_NONE;
370 		ip_push_pending_frames(icmp_socket->sk);
371 	}
372 }
373 
374 /*
375  *	Driving logic for building and sending ICMP messages.
376  */
377 
378 static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
379 {
380 	struct sock *sk = icmp_socket->sk;
381 	struct inet_sock *inet = inet_sk(sk);
382 	struct ipcm_cookie ipc;
383 	struct rtable *rt = (struct rtable *)skb->dst;
384 	u32 daddr;
385 
386 	if (ip_options_echo(&icmp_param->replyopts, skb))
387 		goto out;
388 
389 	if (icmp_xmit_lock())
390 		return;
391 
392 	icmp_param->data.icmph.checksum = 0;
393 	icmp_out_count(icmp_param->data.icmph.type);
394 
395 	inet->tos = skb->nh.iph->tos;
396 	daddr = ipc.addr = rt->rt_src;
397 	ipc.opt = NULL;
398 	if (icmp_param->replyopts.optlen) {
399 		ipc.opt = &icmp_param->replyopts;
400 		if (ipc.opt->srr)
401 			daddr = icmp_param->replyopts.faddr;
402 	}
403 	{
404 		struct flowi fl = { .nl_u = { .ip4_u =
405 					      { .daddr = daddr,
406 						.saddr = rt->rt_spec_dst,
407 						.tos = RT_TOS(skb->nh.iph->tos) } },
408 				    .proto = IPPROTO_ICMP };
409 		if (ip_route_output_key(&rt, &fl))
410 			goto out_unlock;
411 	}
412 	if (icmpv4_xrlim_allow(rt, icmp_param->data.icmph.type,
413 			       icmp_param->data.icmph.code))
414 		icmp_push_reply(icmp_param, &ipc, rt);
415 	ip_rt_put(rt);
416 out_unlock:
417 	icmp_xmit_unlock();
418 out:;
419 }
420 
421 
422 /*
423  *	Send an ICMP message in response to a situation
424  *
425  *	RFC 1122: 3.2.2	MUST send at least the IP header and 8 bytes of header.
426  *		  MAY send more (we do).
427  *			MUST NOT change this header information.
428  *			MUST NOT reply to a multicast/broadcast IP address.
429  *			MUST NOT reply to a multicast/broadcast MAC address.
430  *			MUST reply to only the first fragment.
431  */
432 
433 void icmp_send(struct sk_buff *skb_in, int type, int code, u32 info)
434 {
435 	struct iphdr *iph;
436 	int room;
437 	struct icmp_bxm icmp_param;
438 	struct rtable *rt = (struct rtable *)skb_in->dst;
439 	struct ipcm_cookie ipc;
440 	u32 saddr;
441 	u8  tos;
442 
443 	if (!rt)
444 		goto out;
445 
446 	/*
447 	 *	Find the original header. It is expected to be valid, of course.
448 	 *	Check this, icmp_send is called from the most obscure devices
449 	 *	sometimes.
450 	 */
451 	iph = skb_in->nh.iph;
452 
453 	if ((u8 *)iph < skb_in->head || (u8 *)(iph + 1) > skb_in->tail)
454 		goto out;
455 
456 	/*
457 	 *	No replies to physical multicast/broadcast
458 	 */
459 	if (skb_in->pkt_type != PACKET_HOST)
460 		goto out;
461 
462 	/*
463 	 *	Now check at the protocol level
464 	 */
465 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
466 		goto out;
467 
468 	/*
469 	 *	Only reply to fragment 0. We byte re-order the constant
470 	 *	mask for efficiency.
471 	 */
472 	if (iph->frag_off & htons(IP_OFFSET))
473 		goto out;
474 
475 	/*
476 	 *	If we send an ICMP error to an ICMP error a mess would result..
477 	 */
478 	if (icmp_pointers[type].error) {
479 		/*
480 		 *	We are an error, check if we are replying to an
481 		 *	ICMP error
482 		 */
483 		if (iph->protocol == IPPROTO_ICMP) {
484 			u8 _inner_type, *itp;
485 
486 			itp = skb_header_pointer(skb_in,
487 						 skb_in->nh.raw +
488 						 (iph->ihl << 2) +
489 						 offsetof(struct icmphdr,
490 							  type) -
491 						 skb_in->data,
492 						 sizeof(_inner_type),
493 						 &_inner_type);
494 			if (itp == NULL)
495 				goto out;
496 
497 			/*
498 			 *	Assume any unknown ICMP type is an error. This
499 			 *	isn't specified by the RFC, but think about it..
500 			 */
501 			if (*itp > NR_ICMP_TYPES ||
502 			    icmp_pointers[*itp].error)
503 				goto out;
504 		}
505 	}
506 
507 	if (icmp_xmit_lock())
508 		return;
509 
510 	/*
511 	 *	Construct source address and options.
512 	 */
513 
514 	saddr = iph->daddr;
515 	if (!(rt->rt_flags & RTCF_LOCAL)) {
516 		if (sysctl_icmp_errors_use_inbound_ifaddr)
517 			saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
518 		else
519 			saddr = 0;
520 	}
521 
522 	tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
523 					   IPTOS_PREC_INTERNETCONTROL) :
524 					  iph->tos;
525 
526 	if (ip_options_echo(&icmp_param.replyopts, skb_in))
527 		goto ende;
528 
529 
530 	/*
531 	 *	Prepare data for ICMP header.
532 	 */
533 
534 	icmp_param.data.icmph.type	 = type;
535 	icmp_param.data.icmph.code	 = code;
536 	icmp_param.data.icmph.un.gateway = info;
537 	icmp_param.data.icmph.checksum	 = 0;
538 	icmp_param.skb	  = skb_in;
539 	icmp_param.offset = skb_in->nh.raw - skb_in->data;
540 	icmp_out_count(icmp_param.data.icmph.type);
541 	inet_sk(icmp_socket->sk)->tos = tos;
542 	ipc.addr = iph->saddr;
543 	ipc.opt = &icmp_param.replyopts;
544 
545 	{
546 		struct flowi fl = {
547 			.nl_u = {
548 				.ip4_u = {
549 					.daddr = icmp_param.replyopts.srr ?
550 						icmp_param.replyopts.faddr :
551 						iph->saddr,
552 					.saddr = saddr,
553 					.tos = RT_TOS(tos)
554 				}
555 			},
556 			.proto = IPPROTO_ICMP,
557 			.uli_u = {
558 				.icmpt = {
559 					.type = type,
560 					.code = code
561 				}
562 			}
563 		};
564 		if (ip_route_output_key(&rt, &fl))
565 			goto out_unlock;
566 	}
567 
568 	if (!icmpv4_xrlim_allow(rt, type, code))
569 		goto ende;
570 
571 	/* RFC says return as much as we can without exceeding 576 bytes. */
572 
573 	room = dst_mtu(&rt->u.dst);
574 	if (room > 576)
575 		room = 576;
576 	room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
577 	room -= sizeof(struct icmphdr);
578 
579 	icmp_param.data_len = skb_in->len - icmp_param.offset;
580 	if (icmp_param.data_len > room)
581 		icmp_param.data_len = room;
582 	icmp_param.head_len = sizeof(struct icmphdr);
583 
584 	icmp_push_reply(&icmp_param, &ipc, rt);
585 ende:
586 	ip_rt_put(rt);
587 out_unlock:
588 	icmp_xmit_unlock();
589 out:;
590 }
591 
592 
593 /*
594  *	Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, and ICMP_QUENCH.
595  */
596 
597 static void icmp_unreach(struct sk_buff *skb)
598 {
599 	struct iphdr *iph;
600 	struct icmphdr *icmph;
601 	int hash, protocol;
602 	struct net_protocol *ipprot;
603 	struct sock *raw_sk;
604 	u32 info = 0;
605 
606 	/*
607 	 *	Incomplete header ?
608 	 * 	Only checks for the IP header, there should be an
609 	 *	additional check for longer headers in upper levels.
610 	 */
611 
612 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
613 		goto out_err;
614 
615 	icmph = skb->h.icmph;
616 	iph   = (struct iphdr *)skb->data;
617 
618 	if (iph->ihl < 5) /* Mangled header, drop. */
619 		goto out_err;
620 
621 	if (icmph->type == ICMP_DEST_UNREACH) {
622 		switch (icmph->code & 15) {
623 		case ICMP_NET_UNREACH:
624 		case ICMP_HOST_UNREACH:
625 		case ICMP_PROT_UNREACH:
626 		case ICMP_PORT_UNREACH:
627 			break;
628 		case ICMP_FRAG_NEEDED:
629 			if (ipv4_config.no_pmtu_disc) {
630 				LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: "
631 							 "fragmentation needed "
632 							 "and DF set.\n",
633 					       NIPQUAD(iph->daddr));
634 			} else {
635 				info = ip_rt_frag_needed(iph,
636 						     ntohs(icmph->un.frag.mtu));
637 				if (!info)
638 					goto out;
639 			}
640 			break;
641 		case ICMP_SR_FAILED:
642 			LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: Source "
643 						 "Route Failed.\n",
644 				       NIPQUAD(iph->daddr));
645 			break;
646 		default:
647 			break;
648 		}
649 		if (icmph->code > NR_ICMP_UNREACH)
650 			goto out;
651 	} else if (icmph->type == ICMP_PARAMETERPROB)
652 		info = ntohl(icmph->un.gateway) >> 24;
653 
654 	/*
655 	 *	Throw it at our lower layers
656 	 *
657 	 *	RFC 1122: 3.2.2 MUST extract the protocol ID from the passed
658 	 *		  header.
659 	 *	RFC 1122: 3.2.2.1 MUST pass ICMP unreach messages to the
660 	 *		  transport layer.
661 	 *	RFC 1122: 3.2.2.2 MUST pass ICMP time expired messages to
662 	 *		  transport layer.
663 	 */
664 
665 	/*
666 	 *	Check the other end isnt violating RFC 1122. Some routers send
667 	 *	bogus responses to broadcast frames. If you see this message
668 	 *	first check your netmask matches at both ends, if it does then
669 	 *	get the other vendor to fix their kit.
670 	 */
671 
672 	if (!sysctl_icmp_ignore_bogus_error_responses &&
673 	    inet_addr_type(iph->daddr) == RTN_BROADCAST) {
674 		if (net_ratelimit())
675 			printk(KERN_WARNING "%u.%u.%u.%u sent an invalid ICMP "
676 					    "type %u, code %u "
677 					    "error to a broadcast: %u.%u.%u.%u on %s\n",
678 			       NIPQUAD(skb->nh.iph->saddr),
679 			       icmph->type, icmph->code,
680 			       NIPQUAD(iph->daddr),
681 			       skb->dev->name);
682 		goto out;
683 	}
684 
685 	/* Checkin full IP header plus 8 bytes of protocol to
686 	 * avoid additional coding at protocol handlers.
687 	 */
688 	if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
689 		goto out;
690 
691 	iph = (struct iphdr *)skb->data;
692 	protocol = iph->protocol;
693 
694 	/*
695 	 *	Deliver ICMP message to raw sockets. Pretty useless feature?
696 	 */
697 
698 	/* Note: See raw.c and net/raw.h, RAWV4_HTABLE_SIZE==MAX_INET_PROTOS */
699 	hash = protocol & (MAX_INET_PROTOS - 1);
700 	read_lock(&raw_v4_lock);
701 	if ((raw_sk = sk_head(&raw_v4_htable[hash])) != NULL) {
702 		while ((raw_sk = __raw_v4_lookup(raw_sk, protocol, iph->daddr,
703 						 iph->saddr,
704 						 skb->dev->ifindex)) != NULL) {
705 			raw_err(raw_sk, skb, info);
706 			raw_sk = sk_next(raw_sk);
707 			iph = (struct iphdr *)skb->data;
708 		}
709 	}
710 	read_unlock(&raw_v4_lock);
711 
712 	rcu_read_lock();
713 	ipprot = rcu_dereference(inet_protos[hash]);
714 	if (ipprot && ipprot->err_handler)
715 		ipprot->err_handler(skb, info);
716 	rcu_read_unlock();
717 
718 out:
719 	return;
720 out_err:
721 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
722 	goto out;
723 }
724 
725 
726 /*
727  *	Handle ICMP_REDIRECT.
728  */
729 
730 static void icmp_redirect(struct sk_buff *skb)
731 {
732 	struct iphdr *iph;
733 	unsigned long ip;
734 
735 	if (skb->len < sizeof(struct iphdr))
736 		goto out_err;
737 
738 	/*
739 	 *	Get the copied header of the packet that caused the redirect
740 	 */
741 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
742 		goto out;
743 
744 	iph = (struct iphdr *)skb->data;
745 	ip = iph->daddr;
746 
747 	switch (skb->h.icmph->code & 7) {
748 	case ICMP_REDIR_NET:
749 	case ICMP_REDIR_NETTOS:
750 		/*
751 		 * As per RFC recommendations now handle it as a host redirect.
752 		 */
753 	case ICMP_REDIR_HOST:
754 	case ICMP_REDIR_HOSTTOS:
755 		ip_rt_redirect(skb->nh.iph->saddr, ip, skb->h.icmph->un.gateway,
756 			       iph->saddr, iph->tos, skb->dev);
757 		break;
758   	}
759 out:
760 	return;
761 out_err:
762 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
763 	goto out;
764 }
765 
766 /*
767  *	Handle ICMP_ECHO ("ping") requests.
768  *
769  *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
770  *		  requests.
771  *	RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
772  *		  included in the reply.
773  *	RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
774  *		  echo requests, MUST have default=NOT.
775  *	See also WRT handling of options once they are done and working.
776  */
777 
778 static void icmp_echo(struct sk_buff *skb)
779 {
780 	if (!sysctl_icmp_echo_ignore_all) {
781 		struct icmp_bxm icmp_param;
782 
783 		icmp_param.data.icmph	   = *skb->h.icmph;
784 		icmp_param.data.icmph.type = ICMP_ECHOREPLY;
785 		icmp_param.skb		   = skb;
786 		icmp_param.offset	   = 0;
787 		icmp_param.data_len	   = skb->len;
788 		icmp_param.head_len	   = sizeof(struct icmphdr);
789 		icmp_reply(&icmp_param, skb);
790 	}
791 }
792 
793 /*
794  *	Handle ICMP Timestamp requests.
795  *	RFC 1122: 3.2.2.8 MAY implement ICMP timestamp requests.
796  *		  SHOULD be in the kernel for minimum random latency.
797  *		  MUST be accurate to a few minutes.
798  *		  MUST be updated at least at 15Hz.
799  */
800 static void icmp_timestamp(struct sk_buff *skb)
801 {
802 	struct timeval tv;
803 	struct icmp_bxm icmp_param;
804 	/*
805 	 *	Too short.
806 	 */
807 	if (skb->len < 4)
808 		goto out_err;
809 
810 	/*
811 	 *	Fill in the current time as ms since midnight UT:
812 	 */
813 	do_gettimeofday(&tv);
814 	icmp_param.data.times[1] = htonl((tv.tv_sec % 86400) * 1000 +
815 					 tv.tv_usec / 1000);
816 	icmp_param.data.times[2] = icmp_param.data.times[1];
817 	if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
818 		BUG();
819 	icmp_param.data.icmph	   = *skb->h.icmph;
820 	icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
821 	icmp_param.data.icmph.code = 0;
822 	icmp_param.skb		   = skb;
823 	icmp_param.offset	   = 0;
824 	icmp_param.data_len	   = 0;
825 	icmp_param.head_len	   = sizeof(struct icmphdr) + 12;
826 	icmp_reply(&icmp_param, skb);
827 out:
828 	return;
829 out_err:
830 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
831 	goto out;
832 }
833 
834 
835 /*
836  *	Handle ICMP_ADDRESS_MASK requests.  (RFC950)
837  *
838  * RFC1122 (3.2.2.9).  A host MUST only send replies to
839  * ADDRESS_MASK requests if it's been configured as an address mask
840  * agent.  Receiving a request doesn't constitute implicit permission to
841  * act as one. Of course, implementing this correctly requires (SHOULD)
842  * a way to turn the functionality on and off.  Another one for sysctl(),
843  * I guess. -- MS
844  *
845  * RFC1812 (4.3.3.9).	A router MUST implement it.
846  *			A router SHOULD have switch turning it on/off.
847  *		      	This switch MUST be ON by default.
848  *
849  * Gratuitous replies, zero-source replies are not implemented,
850  * that complies with RFC. DO NOT implement them!!! All the idea
851  * of broadcast addrmask replies as specified in RFC950 is broken.
852  * The problem is that it is not uncommon to have several prefixes
853  * on one physical interface. Moreover, addrmask agent can even be
854  * not aware of existing another prefixes.
855  * If source is zero, addrmask agent cannot choose correct prefix.
856  * Gratuitous mask announcements suffer from the same problem.
857  * RFC1812 explains it, but still allows to use ADDRMASK,
858  * that is pretty silly. --ANK
859  *
860  * All these rules are so bizarre, that I removed kernel addrmask
861  * support at all. It is wrong, it is obsolete, nobody uses it in
862  * any case. --ANK
863  *
864  * Furthermore you can do it with a usermode address agent program
865  * anyway...
866  */
867 
868 static void icmp_address(struct sk_buff *skb)
869 {
870 #if 0
871 	if (net_ratelimit())
872 		printk(KERN_DEBUG "a guy asks for address mask. Who is it?\n");
873 #endif
874 }
875 
876 /*
877  * RFC1812 (4.3.3.9).	A router SHOULD listen all replies, and complain
878  *			loudly if an inconsistency is found.
879  */
880 
881 static void icmp_address_reply(struct sk_buff *skb)
882 {
883 	struct rtable *rt = (struct rtable *)skb->dst;
884 	struct net_device *dev = skb->dev;
885 	struct in_device *in_dev;
886 	struct in_ifaddr *ifa;
887 
888 	if (skb->len < 4 || !(rt->rt_flags&RTCF_DIRECTSRC))
889 		goto out;
890 
891 	in_dev = in_dev_get(dev);
892 	if (!in_dev)
893 		goto out;
894 	rcu_read_lock();
895 	if (in_dev->ifa_list &&
896 	    IN_DEV_LOG_MARTIANS(in_dev) &&
897 	    IN_DEV_FORWARD(in_dev)) {
898 		u32 _mask, *mp;
899 
900 		mp = skb_header_pointer(skb, 0, sizeof(_mask), &_mask);
901 		if (mp == NULL)
902 			BUG();
903 		for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
904 			if (*mp == ifa->ifa_mask &&
905 			    inet_ifa_match(rt->rt_src, ifa))
906 				break;
907 		}
908 		if (!ifa && net_ratelimit()) {
909 			printk(KERN_INFO "Wrong address mask %u.%u.%u.%u from "
910 					 "%s/%u.%u.%u.%u\n",
911 			       NIPQUAD(*mp), dev->name, NIPQUAD(rt->rt_src));
912 		}
913 	}
914 	rcu_read_unlock();
915 	in_dev_put(in_dev);
916 out:;
917 }
918 
919 static void icmp_discard(struct sk_buff *skb)
920 {
921 }
922 
923 /*
924  *	Deal with incoming ICMP packets.
925  */
926 int icmp_rcv(struct sk_buff *skb)
927 {
928 	struct icmphdr *icmph;
929 	struct rtable *rt = (struct rtable *)skb->dst;
930 
931 	ICMP_INC_STATS_BH(ICMP_MIB_INMSGS);
932 
933 	switch (skb->ip_summed) {
934 	case CHECKSUM_HW:
935 		if (!(u16)csum_fold(skb->csum))
936 			break;
937 		LIMIT_NETDEBUG(KERN_DEBUG "icmp v4 hw csum failure\n");
938 	case CHECKSUM_NONE:
939 		if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0)))
940 			goto error;
941 	default:;
942 	}
943 
944 	if (!pskb_pull(skb, sizeof(struct icmphdr)))
945 		goto error;
946 
947 	icmph = skb->h.icmph;
948 
949 	/*
950 	 *	18 is the highest 'known' ICMP type. Anything else is a mystery
951 	 *
952 	 *	RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
953 	 *		  discarded.
954 	 */
955 	if (icmph->type > NR_ICMP_TYPES)
956 		goto error;
957 
958 
959 	/*
960 	 *	Parse the ICMP message
961 	 */
962 
963  	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
964 		/*
965 		 *	RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
966 		 *	  silently ignored (we let user decide with a sysctl).
967 		 *	RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
968 		 *	  discarded if to broadcast/multicast.
969 		 */
970 		if ((icmph->type == ICMP_ECHO ||
971 		     icmph->type == ICMP_TIMESTAMP) &&
972 		    sysctl_icmp_echo_ignore_broadcasts) {
973 			goto error;
974 		}
975 		if (icmph->type != ICMP_ECHO &&
976 		    icmph->type != ICMP_TIMESTAMP &&
977 		    icmph->type != ICMP_ADDRESS &&
978 		    icmph->type != ICMP_ADDRESSREPLY) {
979 			goto error;
980   		}
981 	}
982 
983 	ICMP_INC_STATS_BH(icmp_pointers[icmph->type].input_entry);
984 	icmp_pointers[icmph->type].handler(skb);
985 
986 drop:
987 	kfree_skb(skb);
988 	return 0;
989 error:
990 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
991 	goto drop;
992 }
993 
994 /*
995  *	This table is the definition of how we handle ICMP.
996  */
997 static struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
998 	[ICMP_ECHOREPLY] = {
999 		.output_entry = ICMP_MIB_OUTECHOREPS,
1000 		.input_entry = ICMP_MIB_INECHOREPS,
1001 		.handler = icmp_discard,
1002 	},
1003 	[1] = {
1004 		.output_entry = ICMP_MIB_DUMMY,
1005 		.input_entry = ICMP_MIB_INERRORS,
1006 		.handler = icmp_discard,
1007 		.error = 1,
1008 	},
1009 	[2] = {
1010 		.output_entry = ICMP_MIB_DUMMY,
1011 		.input_entry = ICMP_MIB_INERRORS,
1012 		.handler = icmp_discard,
1013 		.error = 1,
1014 	},
1015 	[ICMP_DEST_UNREACH] = {
1016 		.output_entry = ICMP_MIB_OUTDESTUNREACHS,
1017 		.input_entry = ICMP_MIB_INDESTUNREACHS,
1018 		.handler = icmp_unreach,
1019 		.error = 1,
1020 	},
1021 	[ICMP_SOURCE_QUENCH] = {
1022 		.output_entry = ICMP_MIB_OUTSRCQUENCHS,
1023 		.input_entry = ICMP_MIB_INSRCQUENCHS,
1024 		.handler = icmp_unreach,
1025 		.error = 1,
1026 	},
1027 	[ICMP_REDIRECT] = {
1028 		.output_entry = ICMP_MIB_OUTREDIRECTS,
1029 		.input_entry = ICMP_MIB_INREDIRECTS,
1030 		.handler = icmp_redirect,
1031 		.error = 1,
1032 	},
1033 	[6] = {
1034 		.output_entry = ICMP_MIB_DUMMY,
1035 		.input_entry = ICMP_MIB_INERRORS,
1036 		.handler = icmp_discard,
1037 		.error = 1,
1038 	},
1039 	[7] = {
1040 		.output_entry = ICMP_MIB_DUMMY,
1041 		.input_entry = ICMP_MIB_INERRORS,
1042 		.handler = icmp_discard,
1043 		.error = 1,
1044 	},
1045 	[ICMP_ECHO] = {
1046 		.output_entry = ICMP_MIB_OUTECHOS,
1047 		.input_entry = ICMP_MIB_INECHOS,
1048 		.handler = icmp_echo,
1049 	},
1050 	[9] = {
1051 		.output_entry = ICMP_MIB_DUMMY,
1052 		.input_entry = ICMP_MIB_INERRORS,
1053 		.handler = icmp_discard,
1054 		.error = 1,
1055 	},
1056 	[10] = {
1057 		.output_entry = ICMP_MIB_DUMMY,
1058 		.input_entry = ICMP_MIB_INERRORS,
1059 		.handler = icmp_discard,
1060 		.error = 1,
1061 	},
1062 	[ICMP_TIME_EXCEEDED] = {
1063 		.output_entry = ICMP_MIB_OUTTIMEEXCDS,
1064 		.input_entry = ICMP_MIB_INTIMEEXCDS,
1065 		.handler = icmp_unreach,
1066 		.error = 1,
1067 	},
1068 	[ICMP_PARAMETERPROB] = {
1069 		.output_entry = ICMP_MIB_OUTPARMPROBS,
1070 		.input_entry = ICMP_MIB_INPARMPROBS,
1071 		.handler = icmp_unreach,
1072 		.error = 1,
1073 	},
1074 	[ICMP_TIMESTAMP] = {
1075 		.output_entry = ICMP_MIB_OUTTIMESTAMPS,
1076 		.input_entry = ICMP_MIB_INTIMESTAMPS,
1077 		.handler = icmp_timestamp,
1078 	},
1079 	[ICMP_TIMESTAMPREPLY] = {
1080 		.output_entry = ICMP_MIB_OUTTIMESTAMPREPS,
1081 		.input_entry = ICMP_MIB_INTIMESTAMPREPS,
1082 		.handler = icmp_discard,
1083 	},
1084 	[ICMP_INFO_REQUEST] = {
1085 		.output_entry = ICMP_MIB_DUMMY,
1086 		.input_entry = ICMP_MIB_DUMMY,
1087 		.handler = icmp_discard,
1088 	},
1089  	[ICMP_INFO_REPLY] = {
1090 		.output_entry = ICMP_MIB_DUMMY,
1091 		.input_entry = ICMP_MIB_DUMMY,
1092 		.handler = icmp_discard,
1093 	},
1094 	[ICMP_ADDRESS] = {
1095 		.output_entry = ICMP_MIB_OUTADDRMASKS,
1096 		.input_entry = ICMP_MIB_INADDRMASKS,
1097 		.handler = icmp_address,
1098 	},
1099 	[ICMP_ADDRESSREPLY] = {
1100 		.output_entry = ICMP_MIB_OUTADDRMASKREPS,
1101 		.input_entry = ICMP_MIB_INADDRMASKREPS,
1102 		.handler = icmp_address_reply,
1103 	},
1104 };
1105 
1106 void __init icmp_init(struct net_proto_family *ops)
1107 {
1108 	struct inet_sock *inet;
1109 	int i;
1110 
1111 	for_each_cpu(i) {
1112 		int err;
1113 
1114 		err = sock_create_kern(PF_INET, SOCK_RAW, IPPROTO_ICMP,
1115 				       &per_cpu(__icmp_socket, i));
1116 
1117 		if (err < 0)
1118 			panic("Failed to create the ICMP control socket.\n");
1119 
1120 		per_cpu(__icmp_socket, i)->sk->sk_allocation = GFP_ATOMIC;
1121 
1122 		/* Enough space for 2 64K ICMP packets, including
1123 		 * sk_buff struct overhead.
1124 		 */
1125 		per_cpu(__icmp_socket, i)->sk->sk_sndbuf =
1126 			(2 * ((64 * 1024) + sizeof(struct sk_buff)));
1127 
1128 		inet = inet_sk(per_cpu(__icmp_socket, i)->sk);
1129 		inet->uc_ttl = -1;
1130 		inet->pmtudisc = IP_PMTUDISC_DONT;
1131 
1132 		/* Unhash it so that IP input processing does not even
1133 		 * see it, we do not wish this socket to see incoming
1134 		 * packets.
1135 		 */
1136 		per_cpu(__icmp_socket, i)->sk->sk_prot->unhash(per_cpu(__icmp_socket, i)->sk);
1137 	}
1138 }
1139 
1140 EXPORT_SYMBOL(icmp_err_convert);
1141 EXPORT_SYMBOL(icmp_send);
1142 EXPORT_SYMBOL(icmp_statistics);
1143 EXPORT_SYMBOL(xrlim_allow);
1144