1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65#include <linux/module.h>
66#include <linux/types.h>
67#include <linux/jiffies.h>
68#include <linux/kernel.h>
69#include <linux/fcntl.h>
70#include <linux/socket.h>
71#include <linux/in.h>
72#include <linux/inet.h>
73#include <linux/inetdevice.h>
74#include <linux/netdevice.h>
75#include <linux/string.h>
76#include <linux/netfilter_ipv4.h>
77#include <linux/slab.h>
78#include <net/snmp.h>
79#include <net/ip.h>
80#include <net/route.h>
81#include <net/protocol.h>
82#include <net/icmp.h>
83#include <net/tcp.h>
84#include <net/udp.h>
85#include <net/raw.h>
86#include <net/ping.h>
87#include <linux/skbuff.h>
88#include <net/sock.h>
89#include <linux/errno.h>
90#include <linux/timer.h>
91#include <linux/init.h>
92#include <asm/system.h>
93#include <asm/uaccess.h>
94#include <net/checksum.h>
95#include <net/xfrm.h>
96#include <net/inet_common.h>
97
98
99
100
101
102struct icmp_bxm {
103 struct sk_buff *skb;
104 int offset;
105 int data_len;
106
107 struct {
108 struct icmphdr icmph;
109 __be32 times[3];
110 } data;
111 int head_len;
112 struct ip_options_data replyopts;
113};
114
115
116
117
118const struct icmp_err icmp_err_convert[] = {
119 {
120 .errno = ENETUNREACH,
121 .fatal = 0,
122 },
123 {
124 .errno = EHOSTUNREACH,
125 .fatal = 0,
126 },
127 {
128 .errno = ENOPROTOOPT ,
129 .fatal = 1,
130 },
131 {
132 .errno = ECONNREFUSED,
133 .fatal = 1,
134 },
135 {
136 .errno = EMSGSIZE,
137 .fatal = 0,
138 },
139 {
140 .errno = EOPNOTSUPP,
141 .fatal = 0,
142 },
143 {
144 .errno = ENETUNREACH,
145 .fatal = 1,
146 },
147 {
148 .errno = EHOSTDOWN,
149 .fatal = 1,
150 },
151 {
152 .errno = ENONET,
153 .fatal = 1,
154 },
155 {
156 .errno = ENETUNREACH,
157 .fatal = 1,
158 },
159 {
160 .errno = EHOSTUNREACH,
161 .fatal = 1,
162 },
163 {
164 .errno = ENETUNREACH,
165 .fatal = 0,
166 },
167 {
168 .errno = EHOSTUNREACH,
169 .fatal = 0,
170 },
171 {
172 .errno = EHOSTUNREACH,
173 .fatal = 1,
174 },
175 {
176 .errno = EHOSTUNREACH,
177 .fatal = 1,
178 },
179 {
180 .errno = EHOSTUNREACH,
181 .fatal = 1,
182 },
183};
184EXPORT_SYMBOL(icmp_err_convert);
185
186
187
188
189
190struct icmp_control {
191 void (*handler)(struct sk_buff *skb);
192 short error;
193};
194
195static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
196
197
198
199
200
201
202
203
204static struct sock *icmp_sk(struct net *net)
205{
206 return net->ipv4.icmp_sk[smp_processor_id()];
207}
208
209static inline struct sock *icmp_xmit_lock(struct net *net)
210{
211 struct sock *sk;
212
213 local_bh_disable();
214
215 sk = icmp_sk(net);
216
217 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
218
219
220
221 local_bh_enable();
222 return NULL;
223 }
224 return sk;
225}
226
227static inline void icmp_xmit_unlock(struct sock *sk)
228{
229 spin_unlock_bh(&sk->sk_lock.slock);
230}
231
232
233
234
235
236static inline bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
237 struct flowi4 *fl4, int type, int code)
238{
239 struct dst_entry *dst = &rt->dst;
240 bool rc = true;
241
242 if (type > NR_ICMP_TYPES)
243 goto out;
244
245
246 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
247 goto out;
248
249
250 if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
251 goto out;
252
253
254 if ((1 << type) & net->ipv4.sysctl_icmp_ratemask) {
255 if (!rt->peer)
256 rt_bind_peer(rt, fl4->daddr, 1);
257 rc = inet_peer_xrlim_allow(rt->peer,
258 net->ipv4.sysctl_icmp_ratelimit);
259 }
260out:
261 return rc;
262}
263
264
265
266
267void icmp_out_count(struct net *net, unsigned char type)
268{
269 ICMPMSGOUT_INC_STATS(net, type);
270 ICMP_INC_STATS(net, ICMP_MIB_OUTMSGS);
271}
272
273
274
275
276
277static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
278 struct sk_buff *skb)
279{
280 struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
281 __wsum csum;
282
283 csum = skb_copy_and_csum_bits(icmp_param->skb,
284 icmp_param->offset + offset,
285 to, len, 0);
286
287 skb->csum = csum_block_add(skb->csum, csum, odd);
288 if (icmp_pointers[icmp_param->data.icmph.type].error)
289 nf_ct_attach(skb, icmp_param->skb);
290 return 0;
291}
292
293static void icmp_push_reply(struct icmp_bxm *icmp_param,
294 struct flowi4 *fl4,
295 struct ipcm_cookie *ipc, struct rtable **rt)
296{
297 struct sock *sk;
298 struct sk_buff *skb;
299
300 sk = icmp_sk(dev_net((*rt)->dst.dev));
301 if (ip_append_data(sk, fl4, icmp_glue_bits, icmp_param,
302 icmp_param->data_len+icmp_param->head_len,
303 icmp_param->head_len,
304 ipc, rt, MSG_DONTWAIT) < 0) {
305 ICMP_INC_STATS_BH(sock_net(sk), ICMP_MIB_OUTERRORS);
306 ip_flush_pending_frames(sk);
307 } else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
308 struct icmphdr *icmph = icmp_hdr(skb);
309 __wsum csum = 0;
310 struct sk_buff *skb1;
311
312 skb_queue_walk(&sk->sk_write_queue, skb1) {
313 csum = csum_add(csum, skb1->csum);
314 }
315 csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
316 (char *)icmph,
317 icmp_param->head_len, csum);
318 icmph->checksum = csum_fold(csum);
319 skb->ip_summed = CHECKSUM_NONE;
320 ip_push_pending_frames(sk, fl4);
321 }
322}
323
324
325
326
327
328static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
329{
330 struct ipcm_cookie ipc;
331 struct rtable *rt = skb_rtable(skb);
332 struct net *net = dev_net(rt->dst.dev);
333 struct flowi4 fl4;
334 struct sock *sk;
335 struct inet_sock *inet;
336 __be32 daddr;
337
338 if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
339 return;
340
341 sk = icmp_xmit_lock(net);
342 if (sk == NULL)
343 return;
344 inet = inet_sk(sk);
345
346 icmp_param->data.icmph.checksum = 0;
347
348 inet->tos = ip_hdr(skb)->tos;
349 daddr = ipc.addr = ip_hdr(skb)->saddr;
350 ipc.opt = NULL;
351 ipc.tx_flags = 0;
352 if (icmp_param->replyopts.opt.opt.optlen) {
353 ipc.opt = &icmp_param->replyopts.opt;
354 if (ipc.opt->opt.srr)
355 daddr = icmp_param->replyopts.opt.opt.faddr;
356 }
357 memset(&fl4, 0, sizeof(fl4));
358 fl4.daddr = daddr;
359 fl4.saddr = rt->rt_spec_dst;
360 fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
361 fl4.flowi4_proto = IPPROTO_ICMP;
362 security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
363 rt = ip_route_output_key(net, &fl4);
364 if (IS_ERR(rt))
365 goto out_unlock;
366 if (icmpv4_xrlim_allow(net, rt, &fl4, icmp_param->data.icmph.type,
367 icmp_param->data.icmph.code))
368 icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
369 ip_rt_put(rt);
370out_unlock:
371 icmp_xmit_unlock(sk);
372}
373
374static struct rtable *icmp_route_lookup(struct net *net,
375 struct flowi4 *fl4,
376 struct sk_buff *skb_in,
377 const struct iphdr *iph,
378 __be32 saddr, u8 tos,
379 int type, int code,
380 struct icmp_bxm *param)
381{
382 struct rtable *rt, *rt2;
383 int err;
384
385 memset(fl4, 0, sizeof(*fl4));
386 fl4->daddr = (param->replyopts.opt.opt.srr ?
387 param->replyopts.opt.opt.faddr : iph->saddr);
388 fl4->saddr = saddr;
389 fl4->flowi4_tos = RT_TOS(tos);
390 fl4->flowi4_proto = IPPROTO_ICMP;
391 fl4->fl4_icmp_type = type;
392 fl4->fl4_icmp_code = code;
393 security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
394 rt = __ip_route_output_key(net, fl4);
395 if (IS_ERR(rt))
396 return rt;
397
398
399 rt2 = rt;
400
401 rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
402 flowi4_to_flowi(fl4), NULL, 0);
403 if (!IS_ERR(rt)) {
404 if (rt != rt2)
405 return rt;
406 } else if (PTR_ERR(rt) == -EPERM) {
407 rt = NULL;
408 } else
409 return rt;
410
411 err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(fl4), AF_INET);
412 if (err)
413 goto relookup_failed;
414
415 if (inet_addr_type(net, fl4->saddr) == RTN_LOCAL) {
416 rt2 = __ip_route_output_key(net, fl4);
417 if (IS_ERR(rt2))
418 err = PTR_ERR(rt2);
419 } else {
420 struct flowi4 fl4_2 = {};
421 unsigned long orefdst;
422
423 fl4_2.daddr = fl4->saddr;
424 rt2 = ip_route_output_key(net, &fl4_2);
425 if (IS_ERR(rt2)) {
426 err = PTR_ERR(rt2);
427 goto relookup_failed;
428 }
429
430 orefdst = skb_in->_skb_refdst;
431 err = ip_route_input(skb_in, fl4->daddr, fl4->saddr,
432 RT_TOS(tos), rt2->dst.dev);
433
434 dst_release(&rt2->dst);
435 rt2 = skb_rtable(skb_in);
436 skb_in->_skb_refdst = orefdst;
437 }
438
439 if (err)
440 goto relookup_failed;
441
442 rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
443 flowi4_to_flowi(fl4), NULL,
444 XFRM_LOOKUP_ICMP);
445 if (!IS_ERR(rt2)) {
446 dst_release(&rt->dst);
447 rt = rt2;
448 } else if (PTR_ERR(rt2) == -EPERM) {
449 if (rt)
450 dst_release(&rt->dst);
451 return rt2;
452 } else {
453 err = PTR_ERR(rt2);
454 goto relookup_failed;
455 }
456 return rt;
457
458relookup_failed:
459 if (rt)
460 return rt;
461 return ERR_PTR(err);
462}
463
464
465
466
467
468
469
470
471
472
473
474
475void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
476{
477 struct iphdr *iph;
478 int room;
479 struct icmp_bxm icmp_param;
480 struct rtable *rt = skb_rtable(skb_in);
481 struct ipcm_cookie ipc;
482 struct flowi4 fl4;
483 __be32 saddr;
484 u8 tos;
485 struct net *net;
486 struct sock *sk;
487
488 if (!rt)
489 goto out;
490 net = dev_net(rt->dst.dev);
491
492
493
494
495
496
497 iph = ip_hdr(skb_in);
498
499 if ((u8 *)iph < skb_in->head ||
500 (skb_in->network_header + sizeof(*iph)) > skb_in->tail)
501 goto out;
502
503
504
505
506 if (skb_in->pkt_type != PACKET_HOST)
507 goto out;
508
509
510
511
512 if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
513 goto out;
514
515
516
517
518
519 if (iph->frag_off & htons(IP_OFFSET))
520 goto out;
521
522
523
524
525 if (icmp_pointers[type].error) {
526
527
528
529
530 if (iph->protocol == IPPROTO_ICMP) {
531 u8 _inner_type, *itp;
532
533 itp = skb_header_pointer(skb_in,
534 skb_network_header(skb_in) +
535 (iph->ihl << 2) +
536 offsetof(struct icmphdr,
537 type) -
538 skb_in->data,
539 sizeof(_inner_type),
540 &_inner_type);
541 if (itp == NULL)
542 goto out;
543
544
545
546
547
548 if (*itp > NR_ICMP_TYPES ||
549 icmp_pointers[*itp].error)
550 goto out;
551 }
552 }
553
554 sk = icmp_xmit_lock(net);
555 if (sk == NULL)
556 return;
557
558
559
560
561
562 saddr = iph->daddr;
563 if (!(rt->rt_flags & RTCF_LOCAL)) {
564 struct net_device *dev = NULL;
565
566 rcu_read_lock();
567 if (rt_is_input_route(rt) &&
568 net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
569 dev = dev_get_by_index_rcu(net, rt->rt_iif);
570
571 if (dev)
572 saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
573 else
574 saddr = 0;
575 rcu_read_unlock();
576 }
577
578 tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
579 IPTOS_PREC_INTERNETCONTROL) :
580 iph->tos;
581
582 if (ip_options_echo(&icmp_param.replyopts.opt.opt, skb_in))
583 goto out_unlock;
584
585
586
587
588
589
590 icmp_param.data.icmph.type = type;
591 icmp_param.data.icmph.code = code;
592 icmp_param.data.icmph.un.gateway = info;
593 icmp_param.data.icmph.checksum = 0;
594 icmp_param.skb = skb_in;
595 icmp_param.offset = skb_network_offset(skb_in);
596 inet_sk(sk)->tos = tos;
597 ipc.addr = iph->saddr;
598 ipc.opt = &icmp_param.replyopts.opt;
599 ipc.tx_flags = 0;
600
601 rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos,
602 type, code, &icmp_param);
603 if (IS_ERR(rt))
604 goto out_unlock;
605
606 if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code))
607 goto ende;
608
609
610
611 room = dst_mtu(&rt->dst);
612 if (room > 576)
613 room = 576;
614 room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
615 room -= sizeof(struct icmphdr);
616
617 icmp_param.data_len = skb_in->len - icmp_param.offset;
618 if (icmp_param.data_len > room)
619 icmp_param.data_len = room;
620 icmp_param.head_len = sizeof(struct icmphdr);
621
622 icmp_push_reply(&icmp_param, &fl4, &ipc, &rt);
623ende:
624 ip_rt_put(rt);
625out_unlock:
626 icmp_xmit_unlock(sk);
627out:;
628}
629EXPORT_SYMBOL(icmp_send);
630
631
632
633
634
635
636static void icmp_unreach(struct sk_buff *skb)
637{
638 const struct iphdr *iph;
639 struct icmphdr *icmph;
640 int hash, protocol;
641 const struct net_protocol *ipprot;
642 u32 info = 0;
643 struct net *net;
644
645 net = dev_net(skb_dst(skb)->dev);
646
647
648
649
650
651
652
653 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
654 goto out_err;
655
656 icmph = icmp_hdr(skb);
657 iph = (const struct iphdr *)skb->data;
658
659 if (iph->ihl < 5)
660 goto out_err;
661
662 if (icmph->type == ICMP_DEST_UNREACH) {
663 switch (icmph->code & 15) {
664 case ICMP_NET_UNREACH:
665 case ICMP_HOST_UNREACH:
666 case ICMP_PROT_UNREACH:
667 case ICMP_PORT_UNREACH:
668 break;
669 case ICMP_FRAG_NEEDED:
670 if (ipv4_config.no_pmtu_disc) {
671 LIMIT_NETDEBUG(KERN_INFO "ICMP: %pI4: fragmentation needed and DF set.\n",
672 &iph->daddr);
673 } else {
674 info = ip_rt_frag_needed(net, iph,
675 ntohs(icmph->un.frag.mtu),
676 skb->dev);
677 if (!info)
678 goto out;
679 }
680 break;
681 case ICMP_SR_FAILED:
682 LIMIT_NETDEBUG(KERN_INFO "ICMP: %pI4: Source Route Failed.\n",
683 &iph->daddr);
684 break;
685 default:
686 break;
687 }
688 if (icmph->code > NR_ICMP_UNREACH)
689 goto out;
690 } else if (icmph->type == ICMP_PARAMETERPROB)
691 info = ntohl(icmph->un.gateway) >> 24;
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711 if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses &&
712 inet_addr_type(net, iph->daddr) == RTN_BROADCAST) {
713 if (net_ratelimit())
714 printk(KERN_WARNING "%pI4 sent an invalid ICMP "
715 "type %u, code %u "
716 "error to a broadcast: %pI4 on %s\n",
717 &ip_hdr(skb)->saddr,
718 icmph->type, icmph->code,
719 &iph->daddr,
720 skb->dev->name);
721 goto out;
722 }
723
724
725
726
727 if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
728 goto out;
729
730 iph = (const struct iphdr *)skb->data;
731 protocol = iph->protocol;
732
733
734
735
736 raw_icmp_error(skb, protocol, info);
737
738 hash = protocol & (MAX_INET_PROTOS - 1);
739 rcu_read_lock();
740 ipprot = rcu_dereference(inet_protos[hash]);
741 if (ipprot && ipprot->err_handler)
742 ipprot->err_handler(skb, info);
743 rcu_read_unlock();
744
745out:
746 return;
747out_err:
748 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
749 goto out;
750}
751
752
753
754
755
756
757static void icmp_redirect(struct sk_buff *skb)
758{
759 const struct iphdr *iph;
760
761 if (skb->len < sizeof(struct iphdr))
762 goto out_err;
763
764
765
766
767 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
768 goto out;
769
770 iph = (const struct iphdr *)skb->data;
771
772 switch (icmp_hdr(skb)->code & 7) {
773 case ICMP_REDIR_NET:
774 case ICMP_REDIR_NETTOS:
775
776
777
778 case ICMP_REDIR_HOST:
779 case ICMP_REDIR_HOSTTOS:
780 ip_rt_redirect(ip_hdr(skb)->saddr, iph->daddr,
781 icmp_hdr(skb)->un.gateway,
782 iph->saddr, skb->dev);
783 break;
784 }
785
786
787
788 if (iph->protocol == IPPROTO_ICMP &&
789 iph->ihl >= 5 &&
790 pskb_may_pull(skb, (iph->ihl<<2)+8)) {
791 ping_err(skb, icmp_hdr(skb)->un.gateway);
792 }
793
794out:
795 return;
796out_err:
797 ICMP_INC_STATS_BH(dev_net(skb->dev), ICMP_MIB_INERRORS);
798 goto out;
799}
800
801
802
803
804
805
806
807
808
809
810
811
812
813static void icmp_echo(struct sk_buff *skb)
814{
815 struct net *net;
816
817 net = dev_net(skb_dst(skb)->dev);
818 if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
819 struct icmp_bxm icmp_param;
820
821 icmp_param.data.icmph = *icmp_hdr(skb);
822 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
823 icmp_param.skb = skb;
824 icmp_param.offset = 0;
825 icmp_param.data_len = skb->len;
826 icmp_param.head_len = sizeof(struct icmphdr);
827 icmp_reply(&icmp_param, skb);
828 }
829}
830
831
832
833
834
835
836
837
838static void icmp_timestamp(struct sk_buff *skb)
839{
840 struct timespec tv;
841 struct icmp_bxm icmp_param;
842
843
844
845 if (skb->len < 4)
846 goto out_err;
847
848
849
850
851 getnstimeofday(&tv);
852 icmp_param.data.times[1] = htonl((tv.tv_sec % 86400) * MSEC_PER_SEC +
853 tv.tv_nsec / NSEC_PER_MSEC);
854 icmp_param.data.times[2] = icmp_param.data.times[1];
855 if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
856 BUG();
857 icmp_param.data.icmph = *icmp_hdr(skb);
858 icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
859 icmp_param.data.icmph.code = 0;
860 icmp_param.skb = skb;
861 icmp_param.offset = 0;
862 icmp_param.data_len = 0;
863 icmp_param.head_len = sizeof(struct icmphdr) + 12;
864 icmp_reply(&icmp_param, skb);
865out:
866 return;
867out_err:
868 ICMP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
869 goto out;
870}
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906static void icmp_address(struct sk_buff *skb)
907{
908#if 0
909 if (net_ratelimit())
910 printk(KERN_DEBUG "a guy asks for address mask. Who is it?\n");
911#endif
912}
913
914
915
916
917
918
919
920static void icmp_address_reply(struct sk_buff *skb)
921{
922 struct rtable *rt = skb_rtable(skb);
923 struct net_device *dev = skb->dev;
924 struct in_device *in_dev;
925 struct in_ifaddr *ifa;
926
927 if (skb->len < 4 || !(rt->rt_flags&RTCF_DIRECTSRC))
928 return;
929
930 in_dev = __in_dev_get_rcu(dev);
931 if (!in_dev)
932 return;
933
934 if (in_dev->ifa_list &&
935 IN_DEV_LOG_MARTIANS(in_dev) &&
936 IN_DEV_FORWARD(in_dev)) {
937 __be32 _mask, *mp;
938
939 mp = skb_header_pointer(skb, 0, sizeof(_mask), &_mask);
940 BUG_ON(mp == NULL);
941 for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
942 if (*mp == ifa->ifa_mask &&
943 inet_ifa_match(ip_hdr(skb)->saddr, ifa))
944 break;
945 }
946 if (!ifa && net_ratelimit()) {
947 printk(KERN_INFO "Wrong address mask %pI4 from %s/%pI4\n",
948 mp, dev->name, &ip_hdr(skb)->saddr);
949 }
950 }
951}
952
953static void icmp_discard(struct sk_buff *skb)
954{
955}
956
957
958
959
960int icmp_rcv(struct sk_buff *skb)
961{
962 struct icmphdr *icmph;
963 struct rtable *rt = skb_rtable(skb);
964 struct net *net = dev_net(rt->dst.dev);
965
966 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
967 struct sec_path *sp = skb_sec_path(skb);
968 int nh;
969
970 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
971 XFRM_STATE_ICMP))
972 goto drop;
973
974 if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
975 goto drop;
976
977 nh = skb_network_offset(skb);
978 skb_set_network_header(skb, sizeof(*icmph));
979
980 if (!xfrm4_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
981 goto drop;
982
983 skb_set_network_header(skb, nh);
984 }
985
986 ICMP_INC_STATS_BH(net, ICMP_MIB_INMSGS);
987
988 switch (skb->ip_summed) {
989 case CHECKSUM_COMPLETE:
990 if (!csum_fold(skb->csum))
991 break;
992
993 case CHECKSUM_NONE:
994 skb->csum = 0;
995 if (__skb_checksum_complete(skb))
996 goto error;
997 }
998
999 if (!pskb_pull(skb, sizeof(*icmph)))
1000 goto error;
1001
1002 icmph = icmp_hdr(skb);
1003
1004 ICMPMSGIN_INC_STATS_BH(net, icmph->type);
1005
1006
1007
1008
1009
1010
1011 if (icmph->type > NR_ICMP_TYPES)
1012 goto error;
1013
1014
1015
1016
1017
1018
1019 if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
1020
1021
1022
1023
1024
1025
1026 if ((icmph->type == ICMP_ECHO ||
1027 icmph->type == ICMP_TIMESTAMP) &&
1028 net->ipv4.sysctl_icmp_echo_ignore_broadcasts) {
1029 goto error;
1030 }
1031 if (icmph->type != ICMP_ECHO &&
1032 icmph->type != ICMP_TIMESTAMP &&
1033 icmph->type != ICMP_ADDRESS &&
1034 icmph->type != ICMP_ADDRESSREPLY) {
1035 goto error;
1036 }
1037 }
1038
1039 icmp_pointers[icmph->type].handler(skb);
1040
1041drop:
1042 kfree_skb(skb);
1043 return 0;
1044error:
1045 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
1046 goto drop;
1047}
1048
1049
1050
1051
1052static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
1053 [ICMP_ECHOREPLY] = {
1054 .handler = ping_rcv,
1055 },
1056 [1] = {
1057 .handler = icmp_discard,
1058 .error = 1,
1059 },
1060 [2] = {
1061 .handler = icmp_discard,
1062 .error = 1,
1063 },
1064 [ICMP_DEST_UNREACH] = {
1065 .handler = icmp_unreach,
1066 .error = 1,
1067 },
1068 [ICMP_SOURCE_QUENCH] = {
1069 .handler = icmp_unreach,
1070 .error = 1,
1071 },
1072 [ICMP_REDIRECT] = {
1073 .handler = icmp_redirect,
1074 .error = 1,
1075 },
1076 [6] = {
1077 .handler = icmp_discard,
1078 .error = 1,
1079 },
1080 [7] = {
1081 .handler = icmp_discard,
1082 .error = 1,
1083 },
1084 [ICMP_ECHO] = {
1085 .handler = icmp_echo,
1086 },
1087 [9] = {
1088 .handler = icmp_discard,
1089 .error = 1,
1090 },
1091 [10] = {
1092 .handler = icmp_discard,
1093 .error = 1,
1094 },
1095 [ICMP_TIME_EXCEEDED] = {
1096 .handler = icmp_unreach,
1097 .error = 1,
1098 },
1099 [ICMP_PARAMETERPROB] = {
1100 .handler = icmp_unreach,
1101 .error = 1,
1102 },
1103 [ICMP_TIMESTAMP] = {
1104 .handler = icmp_timestamp,
1105 },
1106 [ICMP_TIMESTAMPREPLY] = {
1107 .handler = icmp_discard,
1108 },
1109 [ICMP_INFO_REQUEST] = {
1110 .handler = icmp_discard,
1111 },
1112 [ICMP_INFO_REPLY] = {
1113 .handler = icmp_discard,
1114 },
1115 [ICMP_ADDRESS] = {
1116 .handler = icmp_address,
1117 },
1118 [ICMP_ADDRESSREPLY] = {
1119 .handler = icmp_address_reply,
1120 },
1121};
1122
1123static void __net_exit icmp_sk_exit(struct net *net)
1124{
1125 int i;
1126
1127 for_each_possible_cpu(i)
1128 inet_ctl_sock_destroy(net->ipv4.icmp_sk[i]);
1129 kfree(net->ipv4.icmp_sk);
1130 net->ipv4.icmp_sk = NULL;
1131}
1132
1133static int __net_init icmp_sk_init(struct net *net)
1134{
1135 int i, err;
1136
1137 net->ipv4.icmp_sk =
1138 kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
1139 if (net->ipv4.icmp_sk == NULL)
1140 return -ENOMEM;
1141
1142 for_each_possible_cpu(i) {
1143 struct sock *sk;
1144
1145 err = inet_ctl_sock_create(&sk, PF_INET,
1146 SOCK_RAW, IPPROTO_ICMP, net);
1147 if (err < 0)
1148 goto fail;
1149
1150 net->ipv4.icmp_sk[i] = sk;
1151
1152
1153
1154
1155 sk->sk_sndbuf =
1156 (2 * ((64 * 1024) + sizeof(struct sk_buff)));
1157
1158
1159
1160
1161 sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1162 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
1163 }
1164
1165
1166 net->ipv4.sysctl_icmp_echo_ignore_all = 0;
1167 net->ipv4.sysctl_icmp_echo_ignore_broadcasts = 1;
1168
1169
1170 net->ipv4.sysctl_icmp_ignore_bogus_error_responses = 1;
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184 net->ipv4.sysctl_icmp_ratelimit = 1 * HZ;
1185 net->ipv4.sysctl_icmp_ratemask = 0x1818;
1186 net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;
1187
1188 return 0;
1189
1190fail:
1191 for_each_possible_cpu(i)
1192 inet_ctl_sock_destroy(net->ipv4.icmp_sk[i]);
1193 kfree(net->ipv4.icmp_sk);
1194 return err;
1195}
1196
1197static struct pernet_operations __net_initdata icmp_sk_ops = {
1198 .init = icmp_sk_init,
1199 .exit = icmp_sk_exit,
1200};
1201
1202int __init icmp_init(void)
1203{
1204 return register_pernet_subsys(&icmp_sk_ops);
1205}
1206