xref: /openbmc/linux/net/ipv4/icmp.c (revision 64c70b1c)
1 /*
2  *	NET3:	Implementation of the ICMP protocol layer.
3  *
4  *		Alan Cox, <alan@redhat.com>
5  *
6  *	Version: $Id: icmp.c,v 1.85 2002/02/01 22:01:03 davem Exp $
7  *
8  *	This program is free software; you can redistribute it and/or
9  *	modify it under the terms of the GNU General Public License
10  *	as published by the Free Software Foundation; either version
11  *	2 of the License, or (at your option) any later version.
12  *
13  *	Some of the function names and the icmp unreach table for this
14  *	module were derived from [icmp.c 1.0.11 06/02/93] by
15  *	Ross Biro, Fred N. van Kempen, Mark Evans, Alan Cox, Gerhard Koerting.
16  *	Other than that this module is a complete rewrite.
17  *
18  *	Fixes:
19  *	Clemens Fruhwirth	:	introduce global icmp rate limiting
20  *					with icmp type masking ability instead
21  *					of broken per type icmp timeouts.
22  *		Mike Shaver	:	RFC1122 checks.
23  *		Alan Cox	:	Multicast ping reply as self.
24  *		Alan Cox	:	Fix atomicity lockup in ip_build_xmit
25  *					call.
26  *		Alan Cox	:	Added 216,128 byte paths to the MTU
27  *					code.
28  *		Martin Mares	:	RFC1812 checks.
29  *		Martin Mares	:	Can be configured to follow redirects
30  *					if acting as a router _without_ a
31  *					routing protocol (RFC 1812).
32  *		Martin Mares	:	Echo requests may be configured to
33  *					be ignored (RFC 1812).
34  *		Martin Mares	:	Limitation of ICMP error message
35  *					transmit rate (RFC 1812).
36  *		Martin Mares	:	TOS and Precedence set correctly
37  *					(RFC 1812).
38  *		Martin Mares	:	Now copying as much data from the
39  *					original packet as we can without
40  *					exceeding 576 bytes (RFC 1812).
41  *	Willy Konynenberg	:	Transparent proxying support.
42  *		Keith Owens	:	RFC1191 correction for 4.2BSD based
43  *					path MTU bug.
44  *		Thomas Quinot	:	ICMP Dest Unreach codes up to 15 are
45  *					valid (RFC 1812).
46  *		Andi Kleen	:	Check all packet lengths properly
47  *					and moved all kfree_skb() up to
48  *					icmp_rcv.
49  *		Andi Kleen	:	Move the rate limit bookkeeping
50  *					into the dest entry and use a token
51  *					bucket filter (thanks to ANK). Make
52  *					the rates sysctl configurable.
53  *		Yu Tianli	:	Fixed two ugly bugs in icmp_send
54  *					- IP option length was accounted wrongly
55  *					- ICMP header length was not accounted
56  *					  at all.
57  *              Tristan Greaves :       Added sysctl option to ignore bogus
58  *              			broadcast responses from broken routers.
59  *
60  * To Fix:
61  *
62  *	- Should use skb_pull() instead of all the manual checking.
63  *	  This would also greatly simply some upper layer error handlers. --AK
64  *
65  */
66 
67 #include <linux/module.h>
68 #include <linux/types.h>
69 #include <linux/jiffies.h>
70 #include <linux/kernel.h>
71 #include <linux/fcntl.h>
72 #include <linux/socket.h>
73 #include <linux/in.h>
74 #include <linux/inet.h>
75 #include <linux/inetdevice.h>
76 #include <linux/netdevice.h>
77 #include <linux/string.h>
78 #include <linux/netfilter_ipv4.h>
79 #include <net/snmp.h>
80 #include <net/ip.h>
81 #include <net/route.h>
82 #include <net/protocol.h>
83 #include <net/icmp.h>
84 #include <net/tcp.h>
85 #include <net/udp.h>
86 #include <net/raw.h>
87 #include <linux/skbuff.h>
88 #include <net/sock.h>
89 #include <linux/errno.h>
90 #include <linux/timer.h>
91 #include <linux/init.h>
92 #include <asm/system.h>
93 #include <asm/uaccess.h>
94 #include <net/checksum.h>
95 
96 /*
97  *	Build xmit assembly blocks
98  */
99 
100 struct icmp_bxm {
101 	struct sk_buff *skb;
102 	int offset;
103 	int data_len;
104 
105 	struct {
106 		struct icmphdr icmph;
107 		__be32	       times[3];
108 	} data;
109 	int head_len;
110 	struct ip_options replyopts;
111 	unsigned char  optbuf[40];
112 };
113 
114 /*
115  *	Statistics
116  */
117 DEFINE_SNMP_STAT(struct icmp_mib, icmp_statistics) __read_mostly;
118 
119 /* An array of errno for error messages from dest unreach. */
120 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
121 
122 struct icmp_err icmp_err_convert[] = {
123 	{
124 		.errno = ENETUNREACH,	/* ICMP_NET_UNREACH */
125 		.fatal = 0,
126 	},
127 	{
128 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNREACH */
129 		.fatal = 0,
130 	},
131 	{
132 		.errno = ENOPROTOOPT	/* ICMP_PROT_UNREACH */,
133 		.fatal = 1,
134 	},
135 	{
136 		.errno = ECONNREFUSED,	/* ICMP_PORT_UNREACH */
137 		.fatal = 1,
138 	},
139 	{
140 		.errno = EMSGSIZE,	/* ICMP_FRAG_NEEDED */
141 		.fatal = 0,
142 	},
143 	{
144 		.errno = EOPNOTSUPP,	/* ICMP_SR_FAILED */
145 		.fatal = 0,
146 	},
147 	{
148 		.errno = ENETUNREACH,	/* ICMP_NET_UNKNOWN */
149 		.fatal = 1,
150 	},
151 	{
152 		.errno = EHOSTDOWN,	/* ICMP_HOST_UNKNOWN */
153 		.fatal = 1,
154 	},
155 	{
156 		.errno = ENONET,	/* ICMP_HOST_ISOLATED */
157 		.fatal = 1,
158 	},
159 	{
160 		.errno = ENETUNREACH,	/* ICMP_NET_ANO	*/
161 		.fatal = 1,
162 	},
163 	{
164 		.errno = EHOSTUNREACH,	/* ICMP_HOST_ANO */
165 		.fatal = 1,
166 	},
167 	{
168 		.errno = ENETUNREACH,	/* ICMP_NET_UNR_TOS */
169 		.fatal = 0,
170 	},
171 	{
172 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNR_TOS */
173 		.fatal = 0,
174 	},
175 	{
176 		.errno = EHOSTUNREACH,	/* ICMP_PKT_FILTERED */
177 		.fatal = 1,
178 	},
179 	{
180 		.errno = EHOSTUNREACH,	/* ICMP_PREC_VIOLATION */
181 		.fatal = 1,
182 	},
183 	{
184 		.errno = EHOSTUNREACH,	/* ICMP_PREC_CUTOFF */
185 		.fatal = 1,
186 	},
187 };
188 
189 /* Control parameters for ECHO replies. */
190 int sysctl_icmp_echo_ignore_all __read_mostly;
191 int sysctl_icmp_echo_ignore_broadcasts __read_mostly = 1;
192 
193 /* Control parameter - ignore bogus broadcast responses? */
194 int sysctl_icmp_ignore_bogus_error_responses __read_mostly = 1;
195 
196 /*
197  * 	Configurable global rate limit.
198  *
199  *	ratelimit defines tokens/packet consumed for dst->rate_token bucket
200  *	ratemask defines which icmp types are ratelimited by setting
201  * 	it's bit position.
202  *
203  *	default:
204  *	dest unreachable (3), source quench (4),
205  *	time exceeded (11), parameter problem (12)
206  */
207 
208 int sysctl_icmp_ratelimit __read_mostly = 1 * HZ;
209 int sysctl_icmp_ratemask __read_mostly = 0x1818;
210 int sysctl_icmp_errors_use_inbound_ifaddr __read_mostly;
211 
212 /*
213  *	ICMP control array. This specifies what to do with each ICMP.
214  */
215 
216 struct icmp_control {
217 	int output_entry;	/* Field for increment on output */
218 	int input_entry;	/* Field for increment on input */
219 	void (*handler)(struct sk_buff *skb);
220 	short   error;		/* This ICMP is classed as an error message */
221 };
222 
223 static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
224 
225 /*
226  *	The ICMP socket(s). This is the most convenient way to flow control
227  *	our ICMP output as well as maintain a clean interface throughout
228  *	all layers. All Socketless IP sends will soon be gone.
229  *
230  *	On SMP we have one ICMP socket per-cpu.
231  */
232 static DEFINE_PER_CPU(struct socket *, __icmp_socket) = NULL;
233 #define icmp_socket	__get_cpu_var(__icmp_socket)
234 
235 static __inline__ int icmp_xmit_lock(void)
236 {
237 	local_bh_disable();
238 
239 	if (unlikely(!spin_trylock(&icmp_socket->sk->sk_lock.slock))) {
240 		/* This can happen if the output path signals a
241 		 * dst_link_failure() for an outgoing ICMP packet.
242 		 */
243 		local_bh_enable();
244 		return 1;
245 	}
246 	return 0;
247 }
248 
249 static void icmp_xmit_unlock(void)
250 {
251 	spin_unlock_bh(&icmp_socket->sk->sk_lock.slock);
252 }
253 
254 /*
255  *	Send an ICMP frame.
256  */
257 
258 /*
259  *	Check transmit rate limitation for given message.
260  *	The rate information is held in the destination cache now.
261  *	This function is generic and could be used for other purposes
262  *	too. It uses a Token bucket filter as suggested by Alexey Kuznetsov.
263  *
264  *	Note that the same dst_entry fields are modified by functions in
265  *	route.c too, but these work for packet destinations while xrlim_allow
266  *	works for icmp destinations. This means the rate limiting information
267  *	for one "ip object" is shared - and these ICMPs are twice limited:
268  *	by source and by destination.
269  *
270  *	RFC 1812: 4.3.2.8 SHOULD be able to limit error message rate
271  *			  SHOULD allow setting of rate limits
272  *
273  * 	Shared between ICMPv4 and ICMPv6.
274  */
275 #define XRLIM_BURST_FACTOR 6
276 int xrlim_allow(struct dst_entry *dst, int timeout)
277 {
278 	unsigned long now;
279 	int rc = 0;
280 
281 	now = jiffies;
282 	dst->rate_tokens += now - dst->rate_last;
283 	dst->rate_last = now;
284 	if (dst->rate_tokens > XRLIM_BURST_FACTOR * timeout)
285 		dst->rate_tokens = XRLIM_BURST_FACTOR * timeout;
286 	if (dst->rate_tokens >= timeout) {
287 		dst->rate_tokens -= timeout;
288 		rc = 1;
289 	}
290 	return rc;
291 }
292 
293 static inline int icmpv4_xrlim_allow(struct rtable *rt, int type, int code)
294 {
295 	struct dst_entry *dst = &rt->u.dst;
296 	int rc = 1;
297 
298 	if (type > NR_ICMP_TYPES)
299 		goto out;
300 
301 	/* Don't limit PMTU discovery. */
302 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
303 		goto out;
304 
305 	/* No rate limit on loopback */
306 	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
307 		goto out;
308 
309 	/* Limit if icmp type is enabled in ratemask. */
310 	if ((1 << type) & sysctl_icmp_ratemask)
311 		rc = xrlim_allow(dst, sysctl_icmp_ratelimit);
312 out:
313 	return rc;
314 }
315 
316 /*
317  *	Maintain the counters used in the SNMP statistics for outgoing ICMP
318  */
319 static void icmp_out_count(int type)
320 {
321 	if (type <= NR_ICMP_TYPES) {
322 		ICMP_INC_STATS(icmp_pointers[type].output_entry);
323 		ICMP_INC_STATS(ICMP_MIB_OUTMSGS);
324 	}
325 }
326 
327 /*
328  *	Checksum each fragment, and on the first include the headers and final
329  *	checksum.
330  */
331 static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
332 			  struct sk_buff *skb)
333 {
334 	struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
335 	__wsum csum;
336 
337 	csum = skb_copy_and_csum_bits(icmp_param->skb,
338 				      icmp_param->offset + offset,
339 				      to, len, 0);
340 
341 	skb->csum = csum_block_add(skb->csum, csum, odd);
342 	if (icmp_pointers[icmp_param->data.icmph.type].error)
343 		nf_ct_attach(skb, icmp_param->skb);
344 	return 0;
345 }
346 
347 static void icmp_push_reply(struct icmp_bxm *icmp_param,
348 			    struct ipcm_cookie *ipc, struct rtable *rt)
349 {
350 	struct sk_buff *skb;
351 
352 	if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
353 			   icmp_param->data_len+icmp_param->head_len,
354 			   icmp_param->head_len,
355 			   ipc, rt, MSG_DONTWAIT) < 0)
356 		ip_flush_pending_frames(icmp_socket->sk);
357 	else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
358 		struct icmphdr *icmph = icmp_hdr(skb);
359 		__wsum csum = 0;
360 		struct sk_buff *skb1;
361 
362 		skb_queue_walk(&icmp_socket->sk->sk_write_queue, skb1) {
363 			csum = csum_add(csum, skb1->csum);
364 		}
365 		csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
366 						 (char *)icmph,
367 						 icmp_param->head_len, csum);
368 		icmph->checksum = csum_fold(csum);
369 		skb->ip_summed = CHECKSUM_NONE;
370 		ip_push_pending_frames(icmp_socket->sk);
371 	}
372 }
373 
374 /*
375  *	Driving logic for building and sending ICMP messages.
376  */
377 
378 static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
379 {
380 	struct sock *sk = icmp_socket->sk;
381 	struct inet_sock *inet = inet_sk(sk);
382 	struct ipcm_cookie ipc;
383 	struct rtable *rt = (struct rtable *)skb->dst;
384 	__be32 daddr;
385 
386 	if (ip_options_echo(&icmp_param->replyopts, skb))
387 		return;
388 
389 	if (icmp_xmit_lock())
390 		return;
391 
392 	icmp_param->data.icmph.checksum = 0;
393 	icmp_out_count(icmp_param->data.icmph.type);
394 
395 	inet->tos = ip_hdr(skb)->tos;
396 	daddr = ipc.addr = rt->rt_src;
397 	ipc.opt = NULL;
398 	if (icmp_param->replyopts.optlen) {
399 		ipc.opt = &icmp_param->replyopts;
400 		if (ipc.opt->srr)
401 			daddr = icmp_param->replyopts.faddr;
402 	}
403 	{
404 		struct flowi fl = { .nl_u = { .ip4_u =
405 					      { .daddr = daddr,
406 						.saddr = rt->rt_spec_dst,
407 						.tos = RT_TOS(ip_hdr(skb)->tos) } },
408 				    .proto = IPPROTO_ICMP };
409 		security_skb_classify_flow(skb, &fl);
410 		if (ip_route_output_key(&rt, &fl))
411 			goto out_unlock;
412 	}
413 	if (icmpv4_xrlim_allow(rt, icmp_param->data.icmph.type,
414 			       icmp_param->data.icmph.code))
415 		icmp_push_reply(icmp_param, &ipc, rt);
416 	ip_rt_put(rt);
417 out_unlock:
418 	icmp_xmit_unlock();
419 }
420 
421 
422 /*
423  *	Send an ICMP message in response to a situation
424  *
425  *	RFC 1122: 3.2.2	MUST send at least the IP header and 8 bytes of header.
426  *		  MAY send more (we do).
427  *			MUST NOT change this header information.
428  *			MUST NOT reply to a multicast/broadcast IP address.
429  *			MUST NOT reply to a multicast/broadcast MAC address.
430  *			MUST reply to only the first fragment.
431  */
432 
433 void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
434 {
435 	struct iphdr *iph;
436 	int room;
437 	struct icmp_bxm icmp_param;
438 	struct rtable *rt = (struct rtable *)skb_in->dst;
439 	struct ipcm_cookie ipc;
440 	__be32 saddr;
441 	u8  tos;
442 
443 	if (!rt)
444 		goto out;
445 
446 	/*
447 	 *	Find the original header. It is expected to be valid, of course.
448 	 *	Check this, icmp_send is called from the most obscure devices
449 	 *	sometimes.
450 	 */
451 	iph = ip_hdr(skb_in);
452 
453 	if ((u8 *)iph < skb_in->head ||
454 	    (skb_in->network_header + sizeof(*iph)) > skb_in->tail)
455 		goto out;
456 
457 	/*
458 	 *	No replies to physical multicast/broadcast
459 	 */
460 	if (skb_in->pkt_type != PACKET_HOST)
461 		goto out;
462 
463 	/*
464 	 *	Now check at the protocol level
465 	 */
466 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
467 		goto out;
468 
469 	/*
470 	 *	Only reply to fragment 0. We byte re-order the constant
471 	 *	mask for efficiency.
472 	 */
473 	if (iph->frag_off & htons(IP_OFFSET))
474 		goto out;
475 
476 	/*
477 	 *	If we send an ICMP error to an ICMP error a mess would result..
478 	 */
479 	if (icmp_pointers[type].error) {
480 		/*
481 		 *	We are an error, check if we are replying to an
482 		 *	ICMP error
483 		 */
484 		if (iph->protocol == IPPROTO_ICMP) {
485 			u8 _inner_type, *itp;
486 
487 			itp = skb_header_pointer(skb_in,
488 						 skb_network_header(skb_in) +
489 						 (iph->ihl << 2) +
490 						 offsetof(struct icmphdr,
491 							  type) -
492 						 skb_in->data,
493 						 sizeof(_inner_type),
494 						 &_inner_type);
495 			if (itp == NULL)
496 				goto out;
497 
498 			/*
499 			 *	Assume any unknown ICMP type is an error. This
500 			 *	isn't specified by the RFC, but think about it..
501 			 */
502 			if (*itp > NR_ICMP_TYPES ||
503 			    icmp_pointers[*itp].error)
504 				goto out;
505 		}
506 	}
507 
508 	if (icmp_xmit_lock())
509 		return;
510 
511 	/*
512 	 *	Construct source address and options.
513 	 */
514 
515 	saddr = iph->daddr;
516 	if (!(rt->rt_flags & RTCF_LOCAL)) {
517 		struct net_device *dev = NULL;
518 
519 		if (rt->fl.iif && sysctl_icmp_errors_use_inbound_ifaddr)
520 			dev = dev_get_by_index(rt->fl.iif);
521 
522 		if (dev) {
523 			saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
524 			dev_put(dev);
525 		} else
526 			saddr = 0;
527 	}
528 
529 	tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
530 					   IPTOS_PREC_INTERNETCONTROL) :
531 					  iph->tos;
532 
533 	if (ip_options_echo(&icmp_param.replyopts, skb_in))
534 		goto out_unlock;
535 
536 
537 	/*
538 	 *	Prepare data for ICMP header.
539 	 */
540 
541 	icmp_param.data.icmph.type	 = type;
542 	icmp_param.data.icmph.code	 = code;
543 	icmp_param.data.icmph.un.gateway = info;
544 	icmp_param.data.icmph.checksum	 = 0;
545 	icmp_param.skb	  = skb_in;
546 	icmp_param.offset = skb_network_offset(skb_in);
547 	icmp_out_count(icmp_param.data.icmph.type);
548 	inet_sk(icmp_socket->sk)->tos = tos;
549 	ipc.addr = iph->saddr;
550 	ipc.opt = &icmp_param.replyopts;
551 
552 	{
553 		struct flowi fl = {
554 			.nl_u = {
555 				.ip4_u = {
556 					.daddr = icmp_param.replyopts.srr ?
557 						icmp_param.replyopts.faddr :
558 						iph->saddr,
559 					.saddr = saddr,
560 					.tos = RT_TOS(tos)
561 				}
562 			},
563 			.proto = IPPROTO_ICMP,
564 			.uli_u = {
565 				.icmpt = {
566 					.type = type,
567 					.code = code
568 				}
569 			}
570 		};
571 		security_skb_classify_flow(skb_in, &fl);
572 		if (ip_route_output_key(&rt, &fl))
573 			goto out_unlock;
574 	}
575 
576 	if (!icmpv4_xrlim_allow(rt, type, code))
577 		goto ende;
578 
579 	/* RFC says return as much as we can without exceeding 576 bytes. */
580 
581 	room = dst_mtu(&rt->u.dst);
582 	if (room > 576)
583 		room = 576;
584 	room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
585 	room -= sizeof(struct icmphdr);
586 
587 	icmp_param.data_len = skb_in->len - icmp_param.offset;
588 	if (icmp_param.data_len > room)
589 		icmp_param.data_len = room;
590 	icmp_param.head_len = sizeof(struct icmphdr);
591 
592 	icmp_push_reply(&icmp_param, &ipc, rt);
593 ende:
594 	ip_rt_put(rt);
595 out_unlock:
596 	icmp_xmit_unlock();
597 out:;
598 }
599 
600 
601 /*
602  *	Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, and ICMP_QUENCH.
603  */
604 
605 static void icmp_unreach(struct sk_buff *skb)
606 {
607 	struct iphdr *iph;
608 	struct icmphdr *icmph;
609 	int hash, protocol;
610 	struct net_protocol *ipprot;
611 	struct sock *raw_sk;
612 	u32 info = 0;
613 
614 	/*
615 	 *	Incomplete header ?
616 	 * 	Only checks for the IP header, there should be an
617 	 *	additional check for longer headers in upper levels.
618 	 */
619 
620 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
621 		goto out_err;
622 
623 	icmph = icmp_hdr(skb);
624 	iph   = (struct iphdr *)skb->data;
625 
626 	if (iph->ihl < 5) /* Mangled header, drop. */
627 		goto out_err;
628 
629 	if (icmph->type == ICMP_DEST_UNREACH) {
630 		switch (icmph->code & 15) {
631 		case ICMP_NET_UNREACH:
632 		case ICMP_HOST_UNREACH:
633 		case ICMP_PROT_UNREACH:
634 		case ICMP_PORT_UNREACH:
635 			break;
636 		case ICMP_FRAG_NEEDED:
637 			if (ipv4_config.no_pmtu_disc) {
638 				LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: "
639 							 "fragmentation needed "
640 							 "and DF set.\n",
641 					       NIPQUAD(iph->daddr));
642 			} else {
643 				info = ip_rt_frag_needed(iph,
644 						     ntohs(icmph->un.frag.mtu));
645 				if (!info)
646 					goto out;
647 			}
648 			break;
649 		case ICMP_SR_FAILED:
650 			LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: Source "
651 						 "Route Failed.\n",
652 				       NIPQUAD(iph->daddr));
653 			break;
654 		default:
655 			break;
656 		}
657 		if (icmph->code > NR_ICMP_UNREACH)
658 			goto out;
659 	} else if (icmph->type == ICMP_PARAMETERPROB)
660 		info = ntohl(icmph->un.gateway) >> 24;
661 
662 	/*
663 	 *	Throw it at our lower layers
664 	 *
665 	 *	RFC 1122: 3.2.2 MUST extract the protocol ID from the passed
666 	 *		  header.
667 	 *	RFC 1122: 3.2.2.1 MUST pass ICMP unreach messages to the
668 	 *		  transport layer.
669 	 *	RFC 1122: 3.2.2.2 MUST pass ICMP time expired messages to
670 	 *		  transport layer.
671 	 */
672 
673 	/*
674 	 *	Check the other end isnt violating RFC 1122. Some routers send
675 	 *	bogus responses to broadcast frames. If you see this message
676 	 *	first check your netmask matches at both ends, if it does then
677 	 *	get the other vendor to fix their kit.
678 	 */
679 
680 	if (!sysctl_icmp_ignore_bogus_error_responses &&
681 	    inet_addr_type(iph->daddr) == RTN_BROADCAST) {
682 		if (net_ratelimit())
683 			printk(KERN_WARNING "%u.%u.%u.%u sent an invalid ICMP "
684 					    "type %u, code %u "
685 					    "error to a broadcast: %u.%u.%u.%u on %s\n",
686 			       NIPQUAD(ip_hdr(skb)->saddr),
687 			       icmph->type, icmph->code,
688 			       NIPQUAD(iph->daddr),
689 			       skb->dev->name);
690 		goto out;
691 	}
692 
693 	/* Checkin full IP header plus 8 bytes of protocol to
694 	 * avoid additional coding at protocol handlers.
695 	 */
696 	if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
697 		goto out;
698 
699 	iph = (struct iphdr *)skb->data;
700 	protocol = iph->protocol;
701 
702 	/*
703 	 *	Deliver ICMP message to raw sockets. Pretty useless feature?
704 	 */
705 
706 	/* Note: See raw.c and net/raw.h, RAWV4_HTABLE_SIZE==MAX_INET_PROTOS */
707 	hash = protocol & (MAX_INET_PROTOS - 1);
708 	read_lock(&raw_v4_lock);
709 	if ((raw_sk = sk_head(&raw_v4_htable[hash])) != NULL) {
710 		while ((raw_sk = __raw_v4_lookup(raw_sk, protocol, iph->daddr,
711 						 iph->saddr,
712 						 skb->dev->ifindex)) != NULL) {
713 			raw_err(raw_sk, skb, info);
714 			raw_sk = sk_next(raw_sk);
715 			iph = (struct iphdr *)skb->data;
716 		}
717 	}
718 	read_unlock(&raw_v4_lock);
719 
720 	rcu_read_lock();
721 	ipprot = rcu_dereference(inet_protos[hash]);
722 	if (ipprot && ipprot->err_handler)
723 		ipprot->err_handler(skb, info);
724 	rcu_read_unlock();
725 
726 out:
727 	return;
728 out_err:
729 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
730 	goto out;
731 }
732 
733 
734 /*
735  *	Handle ICMP_REDIRECT.
736  */
737 
738 static void icmp_redirect(struct sk_buff *skb)
739 {
740 	struct iphdr *iph;
741 
742 	if (skb->len < sizeof(struct iphdr))
743 		goto out_err;
744 
745 	/*
746 	 *	Get the copied header of the packet that caused the redirect
747 	 */
748 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
749 		goto out;
750 
751 	iph = (struct iphdr *)skb->data;
752 
753 	switch (icmp_hdr(skb)->code & 7) {
754 	case ICMP_REDIR_NET:
755 	case ICMP_REDIR_NETTOS:
756 		/*
757 		 * As per RFC recommendations now handle it as a host redirect.
758 		 */
759 	case ICMP_REDIR_HOST:
760 	case ICMP_REDIR_HOSTTOS:
761 		ip_rt_redirect(ip_hdr(skb)->saddr, iph->daddr,
762 			       icmp_hdr(skb)->un.gateway,
763 			       iph->saddr, skb->dev);
764 		break;
765 	}
766 out:
767 	return;
768 out_err:
769 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
770 	goto out;
771 }
772 
773 /*
774  *	Handle ICMP_ECHO ("ping") requests.
775  *
776  *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
777  *		  requests.
778  *	RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
779  *		  included in the reply.
780  *	RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
781  *		  echo requests, MUST have default=NOT.
782  *	See also WRT handling of options once they are done and working.
783  */
784 
785 static void icmp_echo(struct sk_buff *skb)
786 {
787 	if (!sysctl_icmp_echo_ignore_all) {
788 		struct icmp_bxm icmp_param;
789 
790 		icmp_param.data.icmph	   = *icmp_hdr(skb);
791 		icmp_param.data.icmph.type = ICMP_ECHOREPLY;
792 		icmp_param.skb		   = skb;
793 		icmp_param.offset	   = 0;
794 		icmp_param.data_len	   = skb->len;
795 		icmp_param.head_len	   = sizeof(struct icmphdr);
796 		icmp_reply(&icmp_param, skb);
797 	}
798 }
799 
800 /*
801  *	Handle ICMP Timestamp requests.
802  *	RFC 1122: 3.2.2.8 MAY implement ICMP timestamp requests.
803  *		  SHOULD be in the kernel for minimum random latency.
804  *		  MUST be accurate to a few minutes.
805  *		  MUST be updated at least at 15Hz.
806  */
807 static void icmp_timestamp(struct sk_buff *skb)
808 {
809 	struct timeval tv;
810 	struct icmp_bxm icmp_param;
811 	/*
812 	 *	Too short.
813 	 */
814 	if (skb->len < 4)
815 		goto out_err;
816 
817 	/*
818 	 *	Fill in the current time as ms since midnight UT:
819 	 */
820 	do_gettimeofday(&tv);
821 	icmp_param.data.times[1] = htonl((tv.tv_sec % 86400) * 1000 +
822 					 tv.tv_usec / 1000);
823 	icmp_param.data.times[2] = icmp_param.data.times[1];
824 	if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
825 		BUG();
826 	icmp_param.data.icmph	   = *icmp_hdr(skb);
827 	icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
828 	icmp_param.data.icmph.code = 0;
829 	icmp_param.skb		   = skb;
830 	icmp_param.offset	   = 0;
831 	icmp_param.data_len	   = 0;
832 	icmp_param.head_len	   = sizeof(struct icmphdr) + 12;
833 	icmp_reply(&icmp_param, skb);
834 out:
835 	return;
836 out_err:
837 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
838 	goto out;
839 }
840 
841 
842 /*
843  *	Handle ICMP_ADDRESS_MASK requests.  (RFC950)
844  *
845  * RFC1122 (3.2.2.9).  A host MUST only send replies to
846  * ADDRESS_MASK requests if it's been configured as an address mask
847  * agent.  Receiving a request doesn't constitute implicit permission to
848  * act as one. Of course, implementing this correctly requires (SHOULD)
849  * a way to turn the functionality on and off.  Another one for sysctl(),
850  * I guess. -- MS
851  *
852  * RFC1812 (4.3.3.9).	A router MUST implement it.
853  *			A router SHOULD have switch turning it on/off.
854  *		      	This switch MUST be ON by default.
855  *
856  * Gratuitous replies, zero-source replies are not implemented,
857  * that complies with RFC. DO NOT implement them!!! All the idea
858  * of broadcast addrmask replies as specified in RFC950 is broken.
859  * The problem is that it is not uncommon to have several prefixes
860  * on one physical interface. Moreover, addrmask agent can even be
861  * not aware of existing another prefixes.
862  * If source is zero, addrmask agent cannot choose correct prefix.
863  * Gratuitous mask announcements suffer from the same problem.
864  * RFC1812 explains it, but still allows to use ADDRMASK,
865  * that is pretty silly. --ANK
866  *
867  * All these rules are so bizarre, that I removed kernel addrmask
868  * support at all. It is wrong, it is obsolete, nobody uses it in
869  * any case. --ANK
870  *
871  * Furthermore you can do it with a usermode address agent program
872  * anyway...
873  */
874 
875 static void icmp_address(struct sk_buff *skb)
876 {
877 #if 0
878 	if (net_ratelimit())
879 		printk(KERN_DEBUG "a guy asks for address mask. Who is it?\n");
880 #endif
881 }
882 
883 /*
884  * RFC1812 (4.3.3.9).	A router SHOULD listen all replies, and complain
885  *			loudly if an inconsistency is found.
886  */
887 
888 static void icmp_address_reply(struct sk_buff *skb)
889 {
890 	struct rtable *rt = (struct rtable *)skb->dst;
891 	struct net_device *dev = skb->dev;
892 	struct in_device *in_dev;
893 	struct in_ifaddr *ifa;
894 
895 	if (skb->len < 4 || !(rt->rt_flags&RTCF_DIRECTSRC))
896 		goto out;
897 
898 	in_dev = in_dev_get(dev);
899 	if (!in_dev)
900 		goto out;
901 	rcu_read_lock();
902 	if (in_dev->ifa_list &&
903 	    IN_DEV_LOG_MARTIANS(in_dev) &&
904 	    IN_DEV_FORWARD(in_dev)) {
905 		__be32 _mask, *mp;
906 
907 		mp = skb_header_pointer(skb, 0, sizeof(_mask), &_mask);
908 		BUG_ON(mp == NULL);
909 		for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
910 			if (*mp == ifa->ifa_mask &&
911 			    inet_ifa_match(rt->rt_src, ifa))
912 				break;
913 		}
914 		if (!ifa && net_ratelimit()) {
915 			printk(KERN_INFO "Wrong address mask %u.%u.%u.%u from "
916 					 "%s/%u.%u.%u.%u\n",
917 			       NIPQUAD(*mp), dev->name, NIPQUAD(rt->rt_src));
918 		}
919 	}
920 	rcu_read_unlock();
921 	in_dev_put(in_dev);
922 out:;
923 }
924 
925 static void icmp_discard(struct sk_buff *skb)
926 {
927 }
928 
929 /*
930  *	Deal with incoming ICMP packets.
931  */
932 int icmp_rcv(struct sk_buff *skb)
933 {
934 	struct icmphdr *icmph;
935 	struct rtable *rt = (struct rtable *)skb->dst;
936 
937 	ICMP_INC_STATS_BH(ICMP_MIB_INMSGS);
938 
939 	switch (skb->ip_summed) {
940 	case CHECKSUM_COMPLETE:
941 		if (!csum_fold(skb->csum))
942 			break;
943 		/* fall through */
944 	case CHECKSUM_NONE:
945 		skb->csum = 0;
946 		if (__skb_checksum_complete(skb))
947 			goto error;
948 	}
949 
950 	if (!pskb_pull(skb, sizeof(struct icmphdr)))
951 		goto error;
952 
953 	icmph = icmp_hdr(skb);
954 
955 	/*
956 	 *	18 is the highest 'known' ICMP type. Anything else is a mystery
957 	 *
958 	 *	RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
959 	 *		  discarded.
960 	 */
961 	if (icmph->type > NR_ICMP_TYPES)
962 		goto error;
963 
964 
965 	/*
966 	 *	Parse the ICMP message
967 	 */
968 
969 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
970 		/*
971 		 *	RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
972 		 *	  silently ignored (we let user decide with a sysctl).
973 		 *	RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
974 		 *	  discarded if to broadcast/multicast.
975 		 */
976 		if ((icmph->type == ICMP_ECHO ||
977 		     icmph->type == ICMP_TIMESTAMP) &&
978 		    sysctl_icmp_echo_ignore_broadcasts) {
979 			goto error;
980 		}
981 		if (icmph->type != ICMP_ECHO &&
982 		    icmph->type != ICMP_TIMESTAMP &&
983 		    icmph->type != ICMP_ADDRESS &&
984 		    icmph->type != ICMP_ADDRESSREPLY) {
985 			goto error;
986 		}
987 	}
988 
989 	ICMP_INC_STATS_BH(icmp_pointers[icmph->type].input_entry);
990 	icmp_pointers[icmph->type].handler(skb);
991 
992 drop:
993 	kfree_skb(skb);
994 	return 0;
995 error:
996 	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
997 	goto drop;
998 }
999 
1000 /*
1001  *	This table is the definition of how we handle ICMP.
1002  */
1003 static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
1004 	[ICMP_ECHOREPLY] = {
1005 		.output_entry = ICMP_MIB_OUTECHOREPS,
1006 		.input_entry = ICMP_MIB_INECHOREPS,
1007 		.handler = icmp_discard,
1008 	},
1009 	[1] = {
1010 		.output_entry = ICMP_MIB_DUMMY,
1011 		.input_entry = ICMP_MIB_INERRORS,
1012 		.handler = icmp_discard,
1013 		.error = 1,
1014 	},
1015 	[2] = {
1016 		.output_entry = ICMP_MIB_DUMMY,
1017 		.input_entry = ICMP_MIB_INERRORS,
1018 		.handler = icmp_discard,
1019 		.error = 1,
1020 	},
1021 	[ICMP_DEST_UNREACH] = {
1022 		.output_entry = ICMP_MIB_OUTDESTUNREACHS,
1023 		.input_entry = ICMP_MIB_INDESTUNREACHS,
1024 		.handler = icmp_unreach,
1025 		.error = 1,
1026 	},
1027 	[ICMP_SOURCE_QUENCH] = {
1028 		.output_entry = ICMP_MIB_OUTSRCQUENCHS,
1029 		.input_entry = ICMP_MIB_INSRCQUENCHS,
1030 		.handler = icmp_unreach,
1031 		.error = 1,
1032 	},
1033 	[ICMP_REDIRECT] = {
1034 		.output_entry = ICMP_MIB_OUTREDIRECTS,
1035 		.input_entry = ICMP_MIB_INREDIRECTS,
1036 		.handler = icmp_redirect,
1037 		.error = 1,
1038 	},
1039 	[6] = {
1040 		.output_entry = ICMP_MIB_DUMMY,
1041 		.input_entry = ICMP_MIB_INERRORS,
1042 		.handler = icmp_discard,
1043 		.error = 1,
1044 	},
1045 	[7] = {
1046 		.output_entry = ICMP_MIB_DUMMY,
1047 		.input_entry = ICMP_MIB_INERRORS,
1048 		.handler = icmp_discard,
1049 		.error = 1,
1050 	},
1051 	[ICMP_ECHO] = {
1052 		.output_entry = ICMP_MIB_OUTECHOS,
1053 		.input_entry = ICMP_MIB_INECHOS,
1054 		.handler = icmp_echo,
1055 	},
1056 	[9] = {
1057 		.output_entry = ICMP_MIB_DUMMY,
1058 		.input_entry = ICMP_MIB_INERRORS,
1059 		.handler = icmp_discard,
1060 		.error = 1,
1061 	},
1062 	[10] = {
1063 		.output_entry = ICMP_MIB_DUMMY,
1064 		.input_entry = ICMP_MIB_INERRORS,
1065 		.handler = icmp_discard,
1066 		.error = 1,
1067 	},
1068 	[ICMP_TIME_EXCEEDED] = {
1069 		.output_entry = ICMP_MIB_OUTTIMEEXCDS,
1070 		.input_entry = ICMP_MIB_INTIMEEXCDS,
1071 		.handler = icmp_unreach,
1072 		.error = 1,
1073 	},
1074 	[ICMP_PARAMETERPROB] = {
1075 		.output_entry = ICMP_MIB_OUTPARMPROBS,
1076 		.input_entry = ICMP_MIB_INPARMPROBS,
1077 		.handler = icmp_unreach,
1078 		.error = 1,
1079 	},
1080 	[ICMP_TIMESTAMP] = {
1081 		.output_entry = ICMP_MIB_OUTTIMESTAMPS,
1082 		.input_entry = ICMP_MIB_INTIMESTAMPS,
1083 		.handler = icmp_timestamp,
1084 	},
1085 	[ICMP_TIMESTAMPREPLY] = {
1086 		.output_entry = ICMP_MIB_OUTTIMESTAMPREPS,
1087 		.input_entry = ICMP_MIB_INTIMESTAMPREPS,
1088 		.handler = icmp_discard,
1089 	},
1090 	[ICMP_INFO_REQUEST] = {
1091 		.output_entry = ICMP_MIB_DUMMY,
1092 		.input_entry = ICMP_MIB_DUMMY,
1093 		.handler = icmp_discard,
1094 	},
1095 	[ICMP_INFO_REPLY] = {
1096 		.output_entry = ICMP_MIB_DUMMY,
1097 		.input_entry = ICMP_MIB_DUMMY,
1098 		.handler = icmp_discard,
1099 	},
1100 	[ICMP_ADDRESS] = {
1101 		.output_entry = ICMP_MIB_OUTADDRMASKS,
1102 		.input_entry = ICMP_MIB_INADDRMASKS,
1103 		.handler = icmp_address,
1104 	},
1105 	[ICMP_ADDRESSREPLY] = {
1106 		.output_entry = ICMP_MIB_OUTADDRMASKREPS,
1107 		.input_entry = ICMP_MIB_INADDRMASKREPS,
1108 		.handler = icmp_address_reply,
1109 	},
1110 };
1111 
1112 void __init icmp_init(struct net_proto_family *ops)
1113 {
1114 	struct inet_sock *inet;
1115 	int i;
1116 
1117 	for_each_possible_cpu(i) {
1118 		int err;
1119 
1120 		err = sock_create_kern(PF_INET, SOCK_RAW, IPPROTO_ICMP,
1121 				       &per_cpu(__icmp_socket, i));
1122 
1123 		if (err < 0)
1124 			panic("Failed to create the ICMP control socket.\n");
1125 
1126 		per_cpu(__icmp_socket, i)->sk->sk_allocation = GFP_ATOMIC;
1127 
1128 		/* Enough space for 2 64K ICMP packets, including
1129 		 * sk_buff struct overhead.
1130 		 */
1131 		per_cpu(__icmp_socket, i)->sk->sk_sndbuf =
1132 			(2 * ((64 * 1024) + sizeof(struct sk_buff)));
1133 
1134 		inet = inet_sk(per_cpu(__icmp_socket, i)->sk);
1135 		inet->uc_ttl = -1;
1136 		inet->pmtudisc = IP_PMTUDISC_DONT;
1137 
1138 		/* Unhash it so that IP input processing does not even
1139 		 * see it, we do not wish this socket to see incoming
1140 		 * packets.
1141 		 */
1142 		per_cpu(__icmp_socket, i)->sk->sk_prot->unhash(per_cpu(__icmp_socket, i)->sk);
1143 	}
1144 }
1145 
1146 EXPORT_SYMBOL(icmp_err_convert);
1147 EXPORT_SYMBOL(icmp_send);
1148 EXPORT_SYMBOL(icmp_statistics);
1149 EXPORT_SYMBOL(xrlim_allow);
1150