xref: /openbmc/linux/net/ipv4/icmp.c (revision e868d61272caa648214046a096e5a6bfc068dc8c)
1 /*
2  *	NET3:	Implementation of the ICMP protocol layer.
3  *
4  *		Alan Cox, <alan@redhat.com>
5  *
6  *	Version: $Id: icmp.c,v 1.85 2002/02/01 22:01:03 davem Exp $
7  *
8  *	This program is free software; you can redistribute it and/or
9  *	modify it under the terms of the GNU General Public License
10  *	as published by the Free Software Foundation; either version
11  *	2 of the License, or (at your option) any later version.
12  *
13  *	Some of the function names and the icmp unreach table for this
14  *	module were derived from [icmp.c 1.0.11 06/02/93] by
15  *	Ross Biro, Fred N. van Kempen, Mark Evans, Alan Cox, Gerhard Koerting.
16  *	Other than that this module is a complete rewrite.
17  *
18  *	Fixes:
19  *	Clemens Fruhwirth	:	introduce global icmp rate limiting
20  *					with icmp type masking ability instead
21  *					of broken per type icmp timeouts.
22  *		Mike Shaver	:	RFC1122 checks.
23  *		Alan Cox	:	Multicast ping reply as self.
24  *		Alan Cox	:	Fix atomicity lockup in ip_build_xmit
25  *					call.
26  *		Alan Cox	:	Added 216,128 byte paths to the MTU
27  *					code.
28  *		Martin Mares	:	RFC1812 checks.
29  *		Martin Mares	:	Can be configured to follow redirects
30  *					if acting as a router _without_ a
31  *					routing protocol (RFC 1812).
32  *		Martin Mares	:	Echo requests may be configured to
33  *					be ignored (RFC 1812).
34  *		Martin Mares	:	Limitation of ICMP error message
35  *					transmit rate (RFC 1812).
36  *		Martin Mares	:	TOS and Precedence set correctly
37  *					(RFC 1812).
38  *		Martin Mares	:	Now copying as much data from the
39  *					original packet as we can without
40  *					exceeding 576 bytes (RFC 1812).
41  *	Willy Konynenberg	:	Transparent proxying support.
42  *		Keith Owens	:	RFC1191 correction for 4.2BSD based
43  *					path MTU bug.
44  *		Thomas Quinot	:	ICMP Dest Unreach codes up to 15 are
45  *					valid (RFC 1812).
46  *		Andi Kleen	:	Check all packet lengths properly
47  *					and moved all kfree_skb() up to
48  *					icmp_rcv.
49  *		Andi Kleen	:	Move the rate limit bookkeeping
50  *					into the dest entry and use a token
51  *					bucket filter (thanks to ANK). Make
52  *					the rates sysctl configurable.
53  *		Yu Tianli	:	Fixed two ugly bugs in icmp_send
54  *					- IP option length was accounted wrongly
55  *					- ICMP header length was not accounted
56  *					  at all.
57  *              Tristan Greaves :       Added sysctl option to ignore bogus
58  *              			broadcast responses from broken routers.
59  *
60  * To Fix:
61  *
62  *	- Should use skb_pull() instead of all the manual checking.
63  *	  This would also greatly simply some upper layer error handlers. --AK
64  *
65  */
66 
67 #include <linux/module.h>
68 #include <linux/types.h>
69 #include <linux/jiffies.h>
70 #include <linux/kernel.h>
71 #include <linux/fcntl.h>
72 #include <linux/socket.h>
73 #include <linux/in.h>
74 #include <linux/inet.h>
75 #include <linux/inetdevice.h>
76 #include <linux/netdevice.h>
77 #include <linux/string.h>
78 #include <linux/netfilter_ipv4.h>
79 #include <net/snmp.h>
80 #include <net/ip.h>
81 #include <net/route.h>
82 #include <net/protocol.h>
83 #include <net/icmp.h>
84 #include <net/tcp.h>
85 #include <net/udp.h>
86 #include <net/raw.h>
87 #include <linux/skbuff.h>
88 #include <net/sock.h>
89 #include <linux/errno.h>
90 #include <linux/timer.h>
91 #include <linux/init.h>
92 #include <asm/system.h>
93 #include <asm/uaccess.h>
94 #include <net/checksum.h>
95 
96 /*
97  *	Build xmit assembly blocks
98  */
99 
100 struct icmp_bxm {
101 	struct sk_buff *skb;
102 	int offset;
103 	int data_len;
104 
105 	struct {
106 		struct icmphdr icmph;
107 		__be32	       times[3];
108 	} data;
109 	int head_len;
110 	struct ip_options replyopts;
111 	unsigned char  optbuf[40];
112 };
113 
114 /*
115  *	Statistics
116  */
117 DEFINE_SNMP_STAT(struct icmp_mib, icmp_statistics) __read_mostly;
118 
119 /* An array of errno for error messages from dest unreach. */
120 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
121 
122 struct icmp_err icmp_err_convert[] = {
123 	{
124 		.errno = ENETUNREACH,	/* ICMP_NET_UNREACH */
125 		.fatal = 0,
126 	},
127 	{
128 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNREACH */
129 		.fatal = 0,
130 	},
131 	{
132 		.errno = ENOPROTOOPT	/* ICMP_PROT_UNREACH */,
133 		.fatal = 1,
134 	},
135 	{
136 		.errno = ECONNREFUSED,	/* ICMP_PORT_UNREACH */
137 		.fatal = 1,
138 	},
139 	{
140 		.errno = EMSGSIZE,	/* ICMP_FRAG_NEEDED */
141 		.fatal = 0,
142 	},
143 	{
144 		.errno = EOPNOTSUPP,	/* ICMP_SR_FAILED */
145 		.fatal = 0,
146 	},
147 	{
148 		.errno = ENETUNREACH,	/* ICMP_NET_UNKNOWN */
149 		.fatal = 1,
150 	},
151 	{
152 		.errno = EHOSTDOWN,	/* ICMP_HOST_UNKNOWN */
153 		.fatal = 1,
154 	},
155 	{
156 		.errno = ENONET,	/* ICMP_HOST_ISOLATED */
157 		.fatal = 1,
158 	},
159 	{
160 		.errno = ENETUNREACH,	/* ICMP_NET_ANO	*/
161 		.fatal = 1,
162 	},
163 	{
164 		.errno = EHOSTUNREACH,	/* ICMP_HOST_ANO */
165 		.fatal = 1,
166 	},
167 	{
168 		.errno = ENETUNREACH,	/* ICMP_NET_UNR_TOS */
169 		.fatal = 0,
170 	},
171 	{
172 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNR_TOS */
173 		.fatal = 0,
174 	},
175 	{
176 		.errno = EHOSTUNREACH,	/* ICMP_PKT_FILTERED */
177 		.fatal = 1,
178 	},
179 	{
180 		.errno = EHOSTUNREACH,	/* ICMP_PREC_VIOLATION */
181 		.fatal = 1,
182 	},
183 	{
184 		.errno = EHOSTUNREACH,	/* ICMP_PREC_CUTOFF */
185 		.fatal = 1,
186 	},
187 };
188 
189 /* Control parameters for ECHO replies. */
190 int sysctl_icmp_echo_ignore_all __read_mostly;
191 int sysctl_icmp_echo_ignore_broadcasts __read_mostly = 1;
192 
193 /* Control parameter - ignore bogus broadcast responses? */
194 int sysctl_icmp_ignore_bogus_error_responses __read_mostly = 1;
195 
196 /*
197  * 	Configurable global rate limit.
198  *
199  *	ratelimit defines tokens/packet consumed for dst->rate_token bucket
200  *	ratemask defines which icmp types are ratelimited by setting
201  * 	it's bit position.
202  *
203  *	default:
204  *	dest unreachable (3), source quench (4),
205  *	time exceeded (11), parameter problem (12)
206  */
207 
208 int sysctl_icmp_ratelimit __read_mostly = 1 * HZ;
209 int sysctl_icmp_ratemask __read_mostly = 0x1818;
210 int sysctl_icmp_errors_use_inbound_ifaddr __read_mostly;
211 
212 /*
213  *	ICMP control array. This specifies what to do with each ICMP.
214  */
215 
216 struct icmp_control {
217 	int output_entry;	/* Field for increment on output */
218 	int input_entry;	/* Field for increment on input */
219 	void (*handler)(struct sk_buff *skb);
220 	short   error;		/* This ICMP is classed as an error message */
221 };
222 
223 static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
224 
225 /*
226  *	The ICMP socket(s). This is the most convenient way to flow control
227  *	our ICMP output as well as maintain a clean interface throughout
228  *	all layers. All Socketless IP sends will soon be gone.
229  *
230  *	On SMP we have one ICMP socket per-cpu.
231  */
232 static DEFINE_PER_CPU(struct socket *, __icmp_socket) = NULL;
233 #define icmp_socket	__get_cpu_var(__icmp_socket)
234 
235 static __inline__ int icmp_xmit_lock(void)
236 {
237 	local_bh_disable();
238 
239 	if (unlikely(!spin_trylock(&icmp_socket->sk->sk_lock.slock))) {
240 		/* This can happen if the output path signals a
241 		 * dst_link_failure() for an outgoing ICMP packet.
242 		 */
243 		local_bh_enable();
244 		return 1;
245 	}
246 	return 0;
247 }
248 
249 static void icmp_xmit_unlock(void)
250 {
251 	spin_unlock_bh(&icmp_socket->sk->sk_lock.slock);
252 }
253 
254 /*
255  *	Send an ICMP frame.
256  */
257 
258 /*
259  *	Check transmit rate limitation for given message.
260  *	The rate information is held in the destination cache now.
261  *	This function is generic and could be used for other purposes
262  *	too. It uses a Token bucket filter as suggested by Alexey Kuznetsov.
263  *
264  *	Note that the same dst_entry fields are modified by functions in
265  *	route.c too, but these work for packet destinations while xrlim_allow
266  *	works for icmp destinations. This means the rate limiting information
267  *	for one "ip object" is shared - and these ICMPs are twice limited:
268  *	by source and by destination.
269  *
270  *	RFC 1812: 4.3.2.8 SHOULD be able to limit error message rate
271  *			  SHOULD allow setting of rate limits
272  *
273  * 	Shared between ICMPv4 and ICMPv6.
274  */
275 #define XRLIM_BURST_FACTOR 6
276 int xrlim_allow(struct dst_entry *dst, int timeout)
277 {
278 	unsigned long now;
279 	int rc = 0;
280 
281 	now = jiffies;
282 	dst->rate_tokens += now - dst->rate_last;
283 	dst->rate_last = now;
284 	if (dst->rate_tokens > XRLIM_BURST_FACTOR * timeout)
285 		dst->rate_tokens = XRLIM_BURST_FACTOR * timeout;
286 	if (dst->rate_tokens >= timeout) {
287 		dst->rate_tokens -= timeout;
288 		rc = 1;
289 	}
290 	return rc;
291 }
292 
293 static inline int icmpv4_xrlim_allow(struct rtable *rt, int type, int code)
294 {
295 	struct dst_entry *dst = &rt->u.dst;
296 	int rc = 1;
297 
298 	if (type > NR_ICMP_TYPES)
299 		goto out;
300 
301 	/* Don't limit PMTU discovery. */
302 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
303 		goto out;
304 
305 	/* No rate limit on loopback */
306 	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
307 		goto out;
308 
309 	/* Limit if icmp type is enabled in ratemask. */
310 	if ((1 << type) & sysctl_icmp_ratemask)
311 		rc = xrlim_allow(dst, sysctl_icmp_ratelimit);
312 out:
313 	return rc;
314 }
315 
316 /*
317  *	Maintain the counters used in the SNMP statistics for outgoing ICMP
318  */
319 static void icmp_out_count(int type)
320 {
321 	if (type <= NR_ICMP_TYPES) {
322 		ICMP_INC_STATS(icmp_pointers[type].output_entry);
323 		ICMP_INC_STATS(ICMP_MIB_OUTMSGS);
324 	}
325 }
326 
327 /*
328  *	Checksum each fragment, and on the first include the headers and final
329  *	checksum.
330  */
331 static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
332 			  struct sk_buff *skb)
333 {
334 	struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
335 	__wsum csum;
336 
337 	csum = skb_copy_and_csum_bits(icmp_param->skb,
338 				      icmp_param->offset + offset,
339 				      to, len, 0);
340 
341 	skb->csum = csum_block_add(skb->csum, csum, odd);
342 	if (icmp_pointers[icmp_param->data.icmph.type].error)
343 		nf_ct_attach(skb, icmp_param->skb);
344 	return 0;
345 }
346 
347 static void icmp_push_reply(struct icmp_bxm *icmp_param,
348 			    struct ipcm_cookie *ipc, struct rtable *rt)
349 {
350 	struct sk_buff *skb;
351 
352 	if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
353 			   icmp_param->data_len+icmp_param->head_len,
354 			   icmp_param->head_len,
355 			   ipc, rt, MSG_DONTWAIT) < 0)
356 		ip_flush_pending_frames(icmp_socket->sk);
357 	else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
358 		struct icmphdr *icmph = icmp_hdr(skb);
359 		__wsum csum = 0;
360 		struct sk_buff *skb1;
361 
362 		skb_queue_walk(&icmp_socket->sk->sk_write_queue, skb1) {
363 			csum = csum_add(csum, skb1->csum);
364 		}
365 		csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
366 						 (char *)icmph,
367 						 icmp_param->head_len, csum);
368 		icmph->checksum = csum_fold(csum);
369 		skb->ip_summed = CHECKSUM_NONE;
370 		ip_push_pending_frames(icmp_socket->sk);
371 	}
372 }
373 
374 /*
375  *	Driving logic for building and sending ICMP messages.
376  */
377 
378 static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
379 {
380 	struct sock *sk = icmp_socket->sk;
381 	struct inet_sock *inet = inet_sk(sk);
382 	struct ipcm_cookie ipc;
383 	struct rtable *rt = (struct rtable *)skb->dst;
384 	__be32 daddr;
385 
386 	if (ip_options_echo(&icmp_param->replyopts, skb))
387 		return;
388 
389 	if (icmp_xmit_lock())
390 		return;
391 
392 	icmp_param->data.icmph.checksum = 0;
393 	icmp_out_count(icmp_param->data.icmph.type);
394 
395 	inet->tos = ip_hdr(skb)->tos;
396 	daddr = ipc.addr = rt->rt_src;
397 	ipc.opt = NULL;
398 	if (icmp_param->replyopts.optlen) {
399 		ipc.opt = &icmp_param->replyopts;
400 		if (ipc.opt->srr)
401 			daddr = icmp_param->replyopts.faddr;
402 	}
403 	{
404 		struct flowi fl = { .nl_u = { .ip4_u =
405 					      { .daddr = daddr,
406 						.saddr = rt->rt_spec_dst,
407 						.tos = RT_TOS(ip_hdr(skb)->tos) } },
408 				    .proto = IPPROTO_ICMP };
409 		security_skb_classify_flow(skb, &fl);
410 		if (ip_route_output_key(&rt, &fl))
411 			goto out_unlock;
412 	}
413 	if (icmpv4_xrlim_allow(rt, icmp_param->data.icmph.type,
414 			       icmp_param->data.icmph.code))
415 		icmp_push_reply(icmp_param, &ipc, rt);
416 	ip_rt_put(rt);
417 out_unlock:
418 	icmp_xmit_unlock();
419 }
420 
421 
422 /*
423  *	Send an ICMP message in response to a situation
424  *
425  *	RFC 1122: 3.2.2	MUST send at least the IP header and 8 bytes of header.
426  *		  MAY send more (we do).
427  *			MUST NOT change this header information.
428  *			MUST NOT reply to a multicast/broadcast IP address.
429  *			MUST NOT reply to a multicast/broadcast MAC address.
430  *			MUST reply to only the first fragment.
431  */
432 
433 void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
434 {
435 	struct iphdr *iph;
436 	int room;
437 	struct icmp_bxm icmp_param;
438 	struct rtable *rt = (struct rtable *)skb_in->dst;
439 	struct ipcm_cookie ipc;
440 	__be32 saddr;
441 	u8  tos;
442 
443 	if (!rt)
444 		goto out;
445 
446 	/*
447 	 *	Find the original header. It is expected to be valid, of course.
448 	 *	Check this, icmp_send is called from the most obscure devices
449 	 *	sometimes.
450 	 */
451 	iph = ip_hdr(skb_in);
452 
453 	if ((u8 *)iph < skb_in->head ||
454 	    (skb_in->network_header + sizeof(*iph)) > skb_in->tail)
455 		goto out;
456 
457 	/*
458 	 *	No replies to physical multicast/broadcast
459 	 */
460 	if (skb_in->pkt_type != PACKET_HOST)
461 		goto out;
462 
463 	/*
464 	 *	Now check at the protocol level
465 	 */
466 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
467 		goto out;
468 
469 	/*
470 	 *	Only reply to fragment 0. We byte re-order the constant
471 	 *	mask for efficiency.
472 	 */
473 	if (iph->frag_off & htons(IP_OFFSET))
474 		goto out;
475 
476 	/*
477 	 *	If we send an ICMP error to an ICMP error a mess would result..
478 	 */
479 	if (icmp_pointers[type].error) {
480 		/*
481 		 *	We are an error, check if we are replying to an
482 		 *	ICMP error
483 		 */
484 		if (iph->protocol == IPPROTO_ICMP) {
485 			u8 _inner_type, *itp;
486 
487 			itp = skb_header_pointer(skb_in,
488 						 skb_network_header(skb_in) +
489 						 (iph->ihl << 2) +
490 						 offsetof(struct icmphdr,
491 							  type) -
492 						 skb_in->data,
493 						 sizeof(_inner_type),
494 						 &_inner_type);
495 			if (itp == NULL)
496 				goto out;
497 
498 			/*
499 			 *	Assume any unknown ICMP type is an error. This
500 			 *	isn't specified by the RFC, but think about it..
501 			 */
502 			if (*itp > NR_ICMP_TYPES ||
503 			    icmp_pointers[*itp].error)
504 				goto out;
505 		}
506 	}
507 
508 	if (icmp_xmit_lock())
509 		return;
510 
511 	/*
512 	 *	Construct source address and options.
513 	 */
514 
515 	saddr = iph->daddr;
516 	if (!(rt->rt_flags & RTCF_LOCAL)) {
517 		if (sysctl_icmp_errors_use_inbound_ifaddr)
518 			saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
519 		else
520 			saddr = 0;
521 	}
522 
523 	tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
524 					   IPTOS_PREC_INTERNETCONTROL) :
525 					  iph->tos;
526 
527 	if (ip_options_echo(&icmp_param.replyopts, skb_in))
528 		goto out_unlock;
529 
530 
531 	/*
532 	 *	Prepare data for ICMP header.
533 	 */
534 
535 	icmp_param.data.icmph.type	 = type;
536 	icmp_param.data.icmph.code	 = code;
537 	icmp_param.data.icmph.un.gateway = info;
538 	icmp_param.data.icmph.checksum	 = 0;
539 	icmp_param.skb	  = skb_in;
540 	icmp_param.offset = skb_network_offset(skb_in);
541 	icmp_out_count(icmp_param.data.icmph.type);
542 	inet_sk(icmp_socket->sk)->tos = tos;
543 	ipc.addr = iph->saddr;
544 	ipc.opt = &icmp_param.replyopts;
545 
546 	{
547 		struct flowi fl = {
548 			.nl_u = {
549 				.ip4_u = {
550 					.daddr = icmp_param.replyopts.srr ?
551 						icmp_param.replyopts.faddr :
552 						iph->saddr,
553 					.saddr = saddr,
554 					.tos = RT_TOS(tos)
555 				}
556 			},
557 			.proto = IPPROTO_ICMP,
558 			.uli_u = {
559 				.icmpt = {
560 					.type = type,
561 					.code = code
562 				}
563 			}
564 		};
565 		security_skb_classify_flow(skb_in, &fl);
566 		if (ip_route_output_key(&rt, &fl))
567 			goto out_unlock;
568 	}
569 
570 	if (!icmpv4_xrlim_allow(rt, type, code))
571 		goto ende;
572 
573 	/* RFC says return as much as we can without exceeding 576 bytes. */
574 
575 	room = dst_mtu(&rt->u.dst);
576 	if (room > 576)
577 		room = 576;
578 	room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
579 	room -= sizeof(struct icmphdr);
580 
581 	icmp_param.data_len = skb_in->len - icmp_param.offset;
582 	if (icmp_param.data_len > room)
583 		icmp_param.data_len = room;
584 	icmp_param.head_len = sizeof(struct icmphdr);
585 
586 	icmp_push_reply(&icmp_param, &ipc, rt);
587 ende:
588 	ip_rt_put(rt);
589 out_unlock:
590 	icmp_xmit_unlock();
591 out:;
592 }
593 
594 
595 /*
596  *	Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, and ICMP_QUENCH.
597  */
598 
599 static void icmp_unreach(struct sk_buff *skb)
600 {
601 	struct iphdr *iph;
602 	struct icmphdr *icmph;
603 	int hash, protocol;
604 	struct net_protocol *ipprot;
605 	struct sock *raw_sk;
606 	u32 info = 0;
607 
608 	/*
609 	 *	Incomplete header ?
610 	 * 	Only checks for the IP header, there should be an
611 	 *	additional check for longer headers in upper levels.
612 	 */
613 
614 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
615 		goto out_err;
616 
617 	icmph = icmp_hdr(skb);
618 	iph   = (struct iphdr *)skb->data;
619 
620 	if (iph->ihl < 5) /* Mangled header, drop. */
621 		goto out_err;
622 
623 	if (icmph->type == ICMP_DEST_UNREACH) {
624 		switch (icmph->code & 15) {
625 		case ICMP_NET_UNREACH:
626 		case ICMP_HOST_UNREACH:
627 		case ICMP_PROT_UNREACH:
628 		case ICMP_PORT_UNREACH:
629 			break;
630 		case ICMP_FRAG_NEEDED:
631 			if (ipv4_config.no_pmtu_disc) {
632 				LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: "
633 							 "fragmentation needed "
634 							 "and DF set.\n",
635 					       NIPQUAD(iph->daddr));
636 			} else {
637 				info = ip_rt_frag_needed(iph,
638 						     ntohs(icmph->un.frag.mtu));
639 				if (!info)
640 					goto out;
641 			}
642 			break;
643 		case ICMP_SR_FAILED:
644 			LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: Source "
645 						 "Route Failed.\n",
646 				       NIPQUAD(iph->daddr));
647 			break;
648 		default:
649 			break;
650 		}
651 		if (icmph->code > NR_ICMP_UNREACH)
652 			goto out;
653 	} else if (icmph->type == ICMP_PARAMETERPROB)
654 		info = ntohl(icmph->un.gateway) >> 24;
655 
656 	/*
657 	 *	Throw it at our lower layers
658 	 *
659 	 *	RFC 1122: 3.2.2 MUST extract the protocol ID from the passed
660 	 *		  header.
661 	 *	RFC 1122: 3.2.2.1 MUST pass ICMP unreach messages to the
662 	 *		  transport layer.
663 	 *	RFC 1122: 3.2.2.2 MUST pass ICMP time expired messages to
664 	 *		  transport layer.
665 	 */
666 
667 	/*
668 	 *	Check the other end isnt violating RFC 1122. Some routers send
669 	 *	bogus responses to broadcast frames. If you see this message
670 	 *	first check your netmask matches at both ends, if it does then
671 	 *	get the other vendor to fix their kit.
672 	 */
673 
674 	if (!sysctl_icmp_ignore_bogus_error_responses &&
675 	    inet_addr_type(iph->daddr) == RTN_BROADCAST) {
676 		if (net_ratelimit())
677 			printk(KERN_WARNING "%u.%u.%u.%u sent an invalid ICMP "
678 					    "type %u, code %u "
679 					    "error to a broadcast: %u.%u.%u.%u on %s\n",
680 			       NIPQUAD(ip_hdr(skb)->saddr),
681 			       icmph->type, icmph->code,
682 			       NIPQUAD(iph->daddr),
683 			       skb->dev->name);
684 		goto out;
685 	}
686 
687 	/* Checkin full IP header plus 8 bytes of protocol to
688 	 * avoid additional coding at protocol handlers.
689 	 */
690 	if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
691 		goto out;
692 
693 	iph = (struct iphdr *)skb->data;
694 	protocol = iph->protocol;
695 
696 	/*
697 	 *	Deliver ICMP message to raw sockets. Pretty useless feature?
698 	 */
699 
700 	/* Note: See raw.c and net/raw.h, RAWV4_HTABLE_SIZE==MAX_INET_PROTOS */
701 	hash = protocol & (MAX_INET_PROTOS - 1);
702 	read_lock(&raw_v4_lock);
703 	if ((raw_sk = sk_head(&raw_v4_htable[hash])) != NULL) {
704 		while ((raw_sk = __raw_v4_lookup(raw_sk, protocol, iph->daddr,
705 						 iph->saddr,
706 						 skb->dev->ifindex)) != NULL) {
707 			raw_err(raw_sk, skb, info);
708 			raw_sk = sk_next(raw_sk);
709 			iph = (struct iphdr *)skb->data;
710 		}
711 	}
712 	read_unlock(&raw_v4_lock);
713 
714 	rcu_read_lock();
715 	ipprot = rcu_dereference(inet_protos[hash]);
716 	if (ipprot && ipprot->err_handler)
717 		ipprot->err_handler(skb, info);
718 	rcu_read_unlock();
719 
720 out:
721 	return;
722 out_err:
723 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
724 	goto out;
725 }
726 
727 
728 /*
729  *	Handle ICMP_REDIRECT.
730  */
731 
732 static void icmp_redirect(struct sk_buff *skb)
733 {
734 	struct iphdr *iph;
735 
736 	if (skb->len < sizeof(struct iphdr))
737 		goto out_err;
738 
739 	/*
740 	 *	Get the copied header of the packet that caused the redirect
741 	 */
742 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
743 		goto out;
744 
745 	iph = (struct iphdr *)skb->data;
746 
747 	switch (icmp_hdr(skb)->code & 7) {
748 	case ICMP_REDIR_NET:
749 	case ICMP_REDIR_NETTOS:
750 		/*
751 		 * As per RFC recommendations now handle it as a host redirect.
752 		 */
753 	case ICMP_REDIR_HOST:
754 	case ICMP_REDIR_HOSTTOS:
755 		ip_rt_redirect(ip_hdr(skb)->saddr, iph->daddr,
756 			       icmp_hdr(skb)->un.gateway,
757 			       iph->saddr, skb->dev);
758 		break;
759 	}
760 out:
761 	return;
762 out_err:
763 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
764 	goto out;
765 }
766 
767 /*
768  *	Handle ICMP_ECHO ("ping") requests.
769  *
770  *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
771  *		  requests.
772  *	RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
773  *		  included in the reply.
774  *	RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
775  *		  echo requests, MUST have default=NOT.
776  *	See also WRT handling of options once they are done and working.
777  */
778 
779 static void icmp_echo(struct sk_buff *skb)
780 {
781 	if (!sysctl_icmp_echo_ignore_all) {
782 		struct icmp_bxm icmp_param;
783 
784 		icmp_param.data.icmph	   = *icmp_hdr(skb);
785 		icmp_param.data.icmph.type = ICMP_ECHOREPLY;
786 		icmp_param.skb		   = skb;
787 		icmp_param.offset	   = 0;
788 		icmp_param.data_len	   = skb->len;
789 		icmp_param.head_len	   = sizeof(struct icmphdr);
790 		icmp_reply(&icmp_param, skb);
791 	}
792 }
793 
794 /*
795  *	Handle ICMP Timestamp requests.
796  *	RFC 1122: 3.2.2.8 MAY implement ICMP timestamp requests.
797  *		  SHOULD be in the kernel for minimum random latency.
798  *		  MUST be accurate to a few minutes.
799  *		  MUST be updated at least at 15Hz.
800  */
801 static void icmp_timestamp(struct sk_buff *skb)
802 {
803 	struct timeval tv;
804 	struct icmp_bxm icmp_param;
805 	/*
806 	 *	Too short.
807 	 */
808 	if (skb->len < 4)
809 		goto out_err;
810 
811 	/*
812 	 *	Fill in the current time as ms since midnight UT:
813 	 */
814 	do_gettimeofday(&tv);
815 	icmp_param.data.times[1] = htonl((tv.tv_sec % 86400) * 1000 +
816 					 tv.tv_usec / 1000);
817 	icmp_param.data.times[2] = icmp_param.data.times[1];
818 	if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
819 		BUG();
820 	icmp_param.data.icmph	   = *icmp_hdr(skb);
821 	icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
822 	icmp_param.data.icmph.code = 0;
823 	icmp_param.skb		   = skb;
824 	icmp_param.offset	   = 0;
825 	icmp_param.data_len	   = 0;
826 	icmp_param.head_len	   = sizeof(struct icmphdr) + 12;
827 	icmp_reply(&icmp_param, skb);
828 out:
829 	return;
830 out_err:
831 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
832 	goto out;
833 }
834 
835 
836 /*
837  *	Handle ICMP_ADDRESS_MASK requests.  (RFC950)
838  *
839  * RFC1122 (3.2.2.9).  A host MUST only send replies to
840  * ADDRESS_MASK requests if it's been configured as an address mask
841  * agent.  Receiving a request doesn't constitute implicit permission to
842  * act as one. Of course, implementing this correctly requires (SHOULD)
843  * a way to turn the functionality on and off.  Another one for sysctl(),
844  * I guess. -- MS
845  *
846  * RFC1812 (4.3.3.9).	A router MUST implement it.
847  *			A router SHOULD have switch turning it on/off.
848  *		      	This switch MUST be ON by default.
849  *
850  * Gratuitous replies, zero-source replies are not implemented,
851  * that complies with RFC. DO NOT implement them!!! All the idea
852  * of broadcast addrmask replies as specified in RFC950 is broken.
853  * The problem is that it is not uncommon to have several prefixes
854  * on one physical interface. Moreover, addrmask agent can even be
855  * not aware of existing another prefixes.
856  * If source is zero, addrmask agent cannot choose correct prefix.
857  * Gratuitous mask announcements suffer from the same problem.
858  * RFC1812 explains it, but still allows to use ADDRMASK,
859  * that is pretty silly. --ANK
860  *
861  * All these rules are so bizarre, that I removed kernel addrmask
862  * support at all. It is wrong, it is obsolete, nobody uses it in
863  * any case. --ANK
864  *
865  * Furthermore you can do it with a usermode address agent program
866  * anyway...
867  */
868 
869 static void icmp_address(struct sk_buff *skb)
870 {
871 #if 0
872 	if (net_ratelimit())
873 		printk(KERN_DEBUG "a guy asks for address mask. Who is it?\n");
874 #endif
875 }
876 
877 /*
878  * RFC1812 (4.3.3.9).	A router SHOULD listen all replies, and complain
879  *			loudly if an inconsistency is found.
880  */
881 
882 static void icmp_address_reply(struct sk_buff *skb)
883 {
884 	struct rtable *rt = (struct rtable *)skb->dst;
885 	struct net_device *dev = skb->dev;
886 	struct in_device *in_dev;
887 	struct in_ifaddr *ifa;
888 
889 	if (skb->len < 4 || !(rt->rt_flags&RTCF_DIRECTSRC))
890 		goto out;
891 
892 	in_dev = in_dev_get(dev);
893 	if (!in_dev)
894 		goto out;
895 	rcu_read_lock();
896 	if (in_dev->ifa_list &&
897 	    IN_DEV_LOG_MARTIANS(in_dev) &&
898 	    IN_DEV_FORWARD(in_dev)) {
899 		__be32 _mask, *mp;
900 
901 		mp = skb_header_pointer(skb, 0, sizeof(_mask), &_mask);
902 		BUG_ON(mp == NULL);
903 		for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
904 			if (*mp == ifa->ifa_mask &&
905 			    inet_ifa_match(rt->rt_src, ifa))
906 				break;
907 		}
908 		if (!ifa && net_ratelimit()) {
909 			printk(KERN_INFO "Wrong address mask %u.%u.%u.%u from "
910 					 "%s/%u.%u.%u.%u\n",
911 			       NIPQUAD(*mp), dev->name, NIPQUAD(rt->rt_src));
912 		}
913 	}
914 	rcu_read_unlock();
915 	in_dev_put(in_dev);
916 out:;
917 }
918 
919 static void icmp_discard(struct sk_buff *skb)
920 {
921 }
922 
923 /*
924  *	Deal with incoming ICMP packets.
925  */
926 int icmp_rcv(struct sk_buff *skb)
927 {
928 	struct icmphdr *icmph;
929 	struct rtable *rt = (struct rtable *)skb->dst;
930 
931 	ICMP_INC_STATS_BH(ICMP_MIB_INMSGS);
932 
933 	switch (skb->ip_summed) {
934 	case CHECKSUM_COMPLETE:
935 		if (!csum_fold(skb->csum))
936 			break;
937 		/* fall through */
938 	case CHECKSUM_NONE:
939 		skb->csum = 0;
940 		if (__skb_checksum_complete(skb))
941 			goto error;
942 	}
943 
944 	if (!pskb_pull(skb, sizeof(struct icmphdr)))
945 		goto error;
946 
947 	icmph = icmp_hdr(skb);
948 
949 	/*
950 	 *	18 is the highest 'known' ICMP type. Anything else is a mystery
951 	 *
952 	 *	RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
953 	 *		  discarded.
954 	 */
955 	if (icmph->type > NR_ICMP_TYPES)
956 		goto error;
957 
958 
959 	/*
960 	 *	Parse the ICMP message
961 	 */
962 
963 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
964 		/*
965 		 *	RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
966 		 *	  silently ignored (we let user decide with a sysctl).
967 		 *	RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
968 		 *	  discarded if to broadcast/multicast.
969 		 */
970 		if ((icmph->type == ICMP_ECHO ||
971 		     icmph->type == ICMP_TIMESTAMP) &&
972 		    sysctl_icmp_echo_ignore_broadcasts) {
973 			goto error;
974 		}
975 		if (icmph->type != ICMP_ECHO &&
976 		    icmph->type != ICMP_TIMESTAMP &&
977 		    icmph->type != ICMP_ADDRESS &&
978 		    icmph->type != ICMP_ADDRESSREPLY) {
979 			goto error;
980 		}
981 	}
982 
983 	ICMP_INC_STATS_BH(icmp_pointers[icmph->type].input_entry);
984 	icmp_pointers[icmph->type].handler(skb);
985 
986 drop:
987 	kfree_skb(skb);
988 	return 0;
989 error:
990 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
991 	goto drop;
992 }
993 
994 /*
995  *	This table is the definition of how we handle ICMP.
996  */
997 static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
998 	[ICMP_ECHOREPLY] = {
999 		.output_entry = ICMP_MIB_OUTECHOREPS,
1000 		.input_entry = ICMP_MIB_INECHOREPS,
1001 		.handler = icmp_discard,
1002 	},
1003 	[1] = {
1004 		.output_entry = ICMP_MIB_DUMMY,
1005 		.input_entry = ICMP_MIB_INERRORS,
1006 		.handler = icmp_discard,
1007 		.error = 1,
1008 	},
1009 	[2] = {
1010 		.output_entry = ICMP_MIB_DUMMY,
1011 		.input_entry = ICMP_MIB_INERRORS,
1012 		.handler = icmp_discard,
1013 		.error = 1,
1014 	},
1015 	[ICMP_DEST_UNREACH] = {
1016 		.output_entry = ICMP_MIB_OUTDESTUNREACHS,
1017 		.input_entry = ICMP_MIB_INDESTUNREACHS,
1018 		.handler = icmp_unreach,
1019 		.error = 1,
1020 	},
1021 	[ICMP_SOURCE_QUENCH] = {
1022 		.output_entry = ICMP_MIB_OUTSRCQUENCHS,
1023 		.input_entry = ICMP_MIB_INSRCQUENCHS,
1024 		.handler = icmp_unreach,
1025 		.error = 1,
1026 	},
1027 	[ICMP_REDIRECT] = {
1028 		.output_entry = ICMP_MIB_OUTREDIRECTS,
1029 		.input_entry = ICMP_MIB_INREDIRECTS,
1030 		.handler = icmp_redirect,
1031 		.error = 1,
1032 	},
1033 	[6] = {
1034 		.output_entry = ICMP_MIB_DUMMY,
1035 		.input_entry = ICMP_MIB_INERRORS,
1036 		.handler = icmp_discard,
1037 		.error = 1,
1038 	},
1039 	[7] = {
1040 		.output_entry = ICMP_MIB_DUMMY,
1041 		.input_entry = ICMP_MIB_INERRORS,
1042 		.handler = icmp_discard,
1043 		.error = 1,
1044 	},
1045 	[ICMP_ECHO] = {
1046 		.output_entry = ICMP_MIB_OUTECHOS,
1047 		.input_entry = ICMP_MIB_INECHOS,
1048 		.handler = icmp_echo,
1049 	},
1050 	[9] = {
1051 		.output_entry = ICMP_MIB_DUMMY,
1052 		.input_entry = ICMP_MIB_INERRORS,
1053 		.handler = icmp_discard,
1054 		.error = 1,
1055 	},
1056 	[10] = {
1057 		.output_entry = ICMP_MIB_DUMMY,
1058 		.input_entry = ICMP_MIB_INERRORS,
1059 		.handler = icmp_discard,
1060 		.error = 1,
1061 	},
1062 	[ICMP_TIME_EXCEEDED] = {
1063 		.output_entry = ICMP_MIB_OUTTIMEEXCDS,
1064 		.input_entry = ICMP_MIB_INTIMEEXCDS,
1065 		.handler = icmp_unreach,
1066 		.error = 1,
1067 	},
1068 	[ICMP_PARAMETERPROB] = {
1069 		.output_entry = ICMP_MIB_OUTPARMPROBS,
1070 		.input_entry = ICMP_MIB_INPARMPROBS,
1071 		.handler = icmp_unreach,
1072 		.error = 1,
1073 	},
1074 	[ICMP_TIMESTAMP] = {
1075 		.output_entry = ICMP_MIB_OUTTIMESTAMPS,
1076 		.input_entry = ICMP_MIB_INTIMESTAMPS,
1077 		.handler = icmp_timestamp,
1078 	},
1079 	[ICMP_TIMESTAMPREPLY] = {
1080 		.output_entry = ICMP_MIB_OUTTIMESTAMPREPS,
1081 		.input_entry = ICMP_MIB_INTIMESTAMPREPS,
1082 		.handler = icmp_discard,
1083 	},
1084 	[ICMP_INFO_REQUEST] = {
1085 		.output_entry = ICMP_MIB_DUMMY,
1086 		.input_entry = ICMP_MIB_DUMMY,
1087 		.handler = icmp_discard,
1088 	},
1089 	[ICMP_INFO_REPLY] = {
1090 		.output_entry = ICMP_MIB_DUMMY,
1091 		.input_entry = ICMP_MIB_DUMMY,
1092 		.handler = icmp_discard,
1093 	},
1094 	[ICMP_ADDRESS] = {
1095 		.output_entry = ICMP_MIB_OUTADDRMASKS,
1096 		.input_entry = ICMP_MIB_INADDRMASKS,
1097 		.handler = icmp_address,
1098 	},
1099 	[ICMP_ADDRESSREPLY] = {
1100 		.output_entry = ICMP_MIB_OUTADDRMASKREPS,
1101 		.input_entry = ICMP_MIB_INADDRMASKREPS,
1102 		.handler = icmp_address_reply,
1103 	},
1104 };
1105 
1106 void __init icmp_init(struct net_proto_family *ops)
1107 {
1108 	struct inet_sock *inet;
1109 	int i;
1110 
1111 	for_each_possible_cpu(i) {
1112 		int err;
1113 
1114 		err = sock_create_kern(PF_INET, SOCK_RAW, IPPROTO_ICMP,
1115 				       &per_cpu(__icmp_socket, i));
1116 
1117 		if (err < 0)
1118 			panic("Failed to create the ICMP control socket.\n");
1119 
1120 		per_cpu(__icmp_socket, i)->sk->sk_allocation = GFP_ATOMIC;
1121 
1122 		/* Enough space for 2 64K ICMP packets, including
1123 		 * sk_buff struct overhead.
1124 		 */
1125 		per_cpu(__icmp_socket, i)->sk->sk_sndbuf =
1126 			(2 * ((64 * 1024) + sizeof(struct sk_buff)));
1127 
1128 		inet = inet_sk(per_cpu(__icmp_socket, i)->sk);
1129 		inet->uc_ttl = -1;
1130 		inet->pmtudisc = IP_PMTUDISC_DONT;
1131 
1132 		/* Unhash it so that IP input processing does not even
1133 		 * see it, we do not wish this socket to see incoming
1134 		 * packets.
1135 		 */
1136 		per_cpu(__icmp_socket, i)->sk->sk_prot->unhash(per_cpu(__icmp_socket, i)->sk);
1137 	}
1138 }
1139 
1140 EXPORT_SYMBOL(icmp_err_convert);
1141 EXPORT_SYMBOL(icmp_send);
1142 EXPORT_SYMBOL(icmp_statistics);
1143 EXPORT_SYMBOL(xrlim_allow);
1144