1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
66
67#include <linux/module.h>
68#include <linux/types.h>
69#include <linux/jiffies.h>
70#include <linux/kernel.h>
71#include <linux/fcntl.h>
72#include <linux/socket.h>
73#include <linux/in.h>
74#include <linux/inet.h>
75#include <linux/inetdevice.h>
76#include <linux/netdevice.h>
77#include <linux/string.h>
78#include <linux/netfilter_ipv4.h>
79#include <linux/slab.h>
80#include <net/snmp.h>
81#include <net/ip.h>
82#include <net/route.h>
83#include <net/protocol.h>
84#include <net/icmp.h>
85#include <net/tcp.h>
86#include <net/udp.h>
87#include <net/raw.h>
88#include <net/ping.h>
89#include <linux/skbuff.h>
90#include <net/sock.h>
91#include <linux/errno.h>
92#include <linux/timer.h>
93#include <linux/init.h>
94#include <asm/uaccess.h>
95#include <net/checksum.h>
96#include <net/xfrm.h>
97#include <net/inet_common.h>
98#include <net/ip_fib.h>
99#include <net/l3mdev.h>
100
101
102
103
104
105struct icmp_bxm {
106 struct sk_buff *skb;
107 int offset;
108 int data_len;
109
110 struct {
111 struct icmphdr icmph;
112 __be32 times[3];
113 } data;
114 int head_len;
115 struct ip_options_data replyopts;
116};
117
118
119
120
121const struct icmp_err icmp_err_convert[] = {
122 {
123 .errno = ENETUNREACH,
124 .fatal = 0,
125 },
126 {
127 .errno = EHOSTUNREACH,
128 .fatal = 0,
129 },
130 {
131 .errno = ENOPROTOOPT ,
132 .fatal = 1,
133 },
134 {
135 .errno = ECONNREFUSED,
136 .fatal = 1,
137 },
138 {
139 .errno = EMSGSIZE,
140 .fatal = 0,
141 },
142 {
143 .errno = EOPNOTSUPP,
144 .fatal = 0,
145 },
146 {
147 .errno = ENETUNREACH,
148 .fatal = 1,
149 },
150 {
151 .errno = EHOSTDOWN,
152 .fatal = 1,
153 },
154 {
155 .errno = ENONET,
156 .fatal = 1,
157 },
158 {
159 .errno = ENETUNREACH,
160 .fatal = 1,
161 },
162 {
163 .errno = EHOSTUNREACH,
164 .fatal = 1,
165 },
166 {
167 .errno = ENETUNREACH,
168 .fatal = 0,
169 },
170 {
171 .errno = EHOSTUNREACH,
172 .fatal = 0,
173 },
174 {
175 .errno = EHOSTUNREACH,
176 .fatal = 1,
177 },
178 {
179 .errno = EHOSTUNREACH,
180 .fatal = 1,
181 },
182 {
183 .errno = EHOSTUNREACH,
184 .fatal = 1,
185 },
186};
187EXPORT_SYMBOL(icmp_err_convert);
188
189
190
191
192
193struct icmp_control {
194 bool (*handler)(struct sk_buff *skb);
195 short error;
196};
197
198static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
199
200
201
202
203
204
205
206
207static struct sock *icmp_sk(struct net *net)
208{
209 return *this_cpu_ptr(net->ipv4.icmp_sk);
210}
211
212static inline struct sock *icmp_xmit_lock(struct net *net)
213{
214 struct sock *sk;
215
216 local_bh_disable();
217
218 sk = icmp_sk(net);
219
220 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
221
222
223
224 local_bh_enable();
225 return NULL;
226 }
227 return sk;
228}
229
230static inline void icmp_xmit_unlock(struct sock *sk)
231{
232 spin_unlock_bh(&sk->sk_lock.slock);
233}
234
235int sysctl_icmp_msgs_per_sec __read_mostly = 1000;
236int sysctl_icmp_msgs_burst __read_mostly = 50;
237
238static struct {
239 spinlock_t lock;
240 u32 credit;
241 u32 stamp;
242} icmp_global = {
243 .lock = __SPIN_LOCK_UNLOCKED(icmp_global.lock),
244};
245
246
247
248
249
250
251
252
253bool icmp_global_allow(void)
254{
255 u32 credit, delta, incr = 0, now = (u32)jiffies;
256 bool rc = false;
257
258
259
260
261 if (!icmp_global.credit) {
262 delta = min_t(u32, now - icmp_global.stamp, HZ);
263 if (delta < HZ / 50)
264 return false;
265 }
266
267 spin_lock(&icmp_global.lock);
268 delta = min_t(u32, now - icmp_global.stamp, HZ);
269 if (delta >= HZ / 50) {
270 incr = sysctl_icmp_msgs_per_sec * delta / HZ ;
271 if (incr)
272 icmp_global.stamp = now;
273 }
274 credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
275 if (credit) {
276 credit--;
277 rc = true;
278 }
279 icmp_global.credit = credit;
280 spin_unlock(&icmp_global.lock);
281 return rc;
282}
283EXPORT_SYMBOL(icmp_global_allow);
284
285
286
287
288
289static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
290 struct flowi4 *fl4, int type, int code)
291{
292 struct dst_entry *dst = &rt->dst;
293 bool rc = true;
294
295 if (type > NR_ICMP_TYPES)
296 goto out;
297
298
299 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
300 goto out;
301
302
303 if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
304 goto out;
305
306
307 if (!((1 << type) & net->ipv4.sysctl_icmp_ratemask))
308 goto out;
309
310 rc = false;
311 if (icmp_global_allow()) {
312 int vif = l3mdev_master_ifindex(dst->dev);
313 struct inet_peer *peer;
314
315 peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1);
316 rc = inet_peer_xrlim_allow(peer,
317 net->ipv4.sysctl_icmp_ratelimit);
318 if (peer)
319 inet_putpeer(peer);
320 }
321out:
322 return rc;
323}
324
325
326
327
328void icmp_out_count(struct net *net, unsigned char type)
329{
330 ICMPMSGOUT_INC_STATS(net, type);
331 ICMP_INC_STATS(net, ICMP_MIB_OUTMSGS);
332}
333
334
335
336
337
338static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
339 struct sk_buff *skb)
340{
341 struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
342 __wsum csum;
343
344 csum = skb_copy_and_csum_bits(icmp_param->skb,
345 icmp_param->offset + offset,
346 to, len, 0);
347
348 skb->csum = csum_block_add(skb->csum, csum, odd);
349 if (icmp_pointers[icmp_param->data.icmph.type].error)
350 nf_ct_attach(skb, icmp_param->skb);
351 return 0;
352}
353
354static void icmp_push_reply(struct icmp_bxm *icmp_param,
355 struct flowi4 *fl4,
356 struct ipcm_cookie *ipc, struct rtable **rt)
357{
358 struct sock *sk;
359 struct sk_buff *skb;
360
361 sk = icmp_sk(dev_net((*rt)->dst.dev));
362 if (ip_append_data(sk, fl4, icmp_glue_bits, icmp_param,
363 icmp_param->data_len+icmp_param->head_len,
364 icmp_param->head_len,
365 ipc, rt, MSG_DONTWAIT) < 0) {
366 __ICMP_INC_STATS(sock_net(sk), ICMP_MIB_OUTERRORS);
367 ip_flush_pending_frames(sk);
368 } else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
369 struct icmphdr *icmph = icmp_hdr(skb);
370 __wsum csum = 0;
371 struct sk_buff *skb1;
372
373 skb_queue_walk(&sk->sk_write_queue, skb1) {
374 csum = csum_add(csum, skb1->csum);
375 }
376 csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
377 (char *)icmph,
378 icmp_param->head_len, csum);
379 icmph->checksum = csum_fold(csum);
380 skb->ip_summed = CHECKSUM_NONE;
381 ip_push_pending_frames(sk, fl4);
382 }
383}
384
385
386
387
388
389static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
390{
391 struct ipcm_cookie ipc;
392 struct rtable *rt = skb_rtable(skb);
393 struct net *net = dev_net(rt->dst.dev);
394 struct flowi4 fl4;
395 struct sock *sk;
396 struct inet_sock *inet;
397 __be32 daddr, saddr;
398 u32 mark = IP4_REPLY_MARK(net, skb->mark);
399
400 if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
401 return;
402
403 sk = icmp_xmit_lock(net);
404 if (!sk)
405 return;
406 inet = inet_sk(sk);
407
408 icmp_param->data.icmph.checksum = 0;
409
410 inet->tos = ip_hdr(skb)->tos;
411 sk->sk_mark = mark;
412 daddr = ipc.addr = ip_hdr(skb)->saddr;
413 saddr = fib_compute_spec_dst(skb);
414 ipc.opt = NULL;
415 ipc.tx_flags = 0;
416 ipc.ttl = 0;
417 ipc.tos = -1;
418
419 if (icmp_param->replyopts.opt.opt.optlen) {
420 ipc.opt = &icmp_param->replyopts.opt;
421 if (ipc.opt->opt.srr)
422 daddr = icmp_param->replyopts.opt.opt.faddr;
423 }
424 memset(&fl4, 0, sizeof(fl4));
425 fl4.daddr = daddr;
426 fl4.saddr = saddr;
427 fl4.flowi4_mark = mark;
428 fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
429 fl4.flowi4_proto = IPPROTO_ICMP;
430 fl4.flowi4_oif = l3mdev_master_ifindex(skb->dev);
431 security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
432 rt = ip_route_output_key(net, &fl4);
433 if (IS_ERR(rt))
434 goto out_unlock;
435 if (icmpv4_xrlim_allow(net, rt, &fl4, icmp_param->data.icmph.type,
436 icmp_param->data.icmph.code))
437 icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
438 ip_rt_put(rt);
439out_unlock:
440 icmp_xmit_unlock(sk);
441}
442
443#ifdef CONFIG_IP_ROUTE_MULTIPATH
444
445
446static int icmp_multipath_hash_skb(const struct sk_buff *skb)
447{
448 const struct iphdr *iph = ip_hdr(skb);
449
450 return fib_multipath_hash(iph->daddr, iph->saddr);
451}
452
453#else
454
455#define icmp_multipath_hash_skb(skb) (-1)
456
457#endif
458
459static struct rtable *icmp_route_lookup(struct net *net,
460 struct flowi4 *fl4,
461 struct sk_buff *skb_in,
462 const struct iphdr *iph,
463 __be32 saddr, u8 tos, u32 mark,
464 int type, int code,
465 struct icmp_bxm *param)
466{
467 struct rtable *rt, *rt2;
468 struct flowi4 fl4_dec;
469 int err;
470
471 memset(fl4, 0, sizeof(*fl4));
472 fl4->daddr = (param->replyopts.opt.opt.srr ?
473 param->replyopts.opt.opt.faddr : iph->saddr);
474 fl4->saddr = saddr;
475 fl4->flowi4_mark = mark;
476 fl4->flowi4_tos = RT_TOS(tos);
477 fl4->flowi4_proto = IPPROTO_ICMP;
478 fl4->fl4_icmp_type = type;
479 fl4->fl4_icmp_code = code;
480 fl4->flowi4_oif = l3mdev_master_ifindex(skb_in->dev);
481
482 security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
483 rt = __ip_route_output_key_hash(net, fl4,
484 icmp_multipath_hash_skb(skb_in));
485 if (IS_ERR(rt))
486 return rt;
487
488
489 rt2 = rt;
490
491 rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
492 flowi4_to_flowi(fl4), NULL, 0);
493 if (!IS_ERR(rt)) {
494 if (rt != rt2)
495 return rt;
496 } else if (PTR_ERR(rt) == -EPERM) {
497 rt = NULL;
498 } else
499 return rt;
500
501 err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
502 if (err)
503 goto relookup_failed;
504
505 if (inet_addr_type_dev_table(net, skb_in->dev,
506 fl4_dec.saddr) == RTN_LOCAL) {
507 rt2 = __ip_route_output_key(net, &fl4_dec);
508 if (IS_ERR(rt2))
509 err = PTR_ERR(rt2);
510 } else {
511 struct flowi4 fl4_2 = {};
512 unsigned long orefdst;
513
514 fl4_2.daddr = fl4_dec.saddr;
515 rt2 = ip_route_output_key(net, &fl4_2);
516 if (IS_ERR(rt2)) {
517 err = PTR_ERR(rt2);
518 goto relookup_failed;
519 }
520
521 orefdst = skb_in->_skb_refdst;
522 skb_dst_set(skb_in, NULL);
523 err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
524 RT_TOS(tos), rt2->dst.dev);
525
526 dst_release(&rt2->dst);
527 rt2 = skb_rtable(skb_in);
528 skb_in->_skb_refdst = orefdst;
529 }
530
531 if (err)
532 goto relookup_failed;
533
534 rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
535 flowi4_to_flowi(&fl4_dec), NULL,
536 XFRM_LOOKUP_ICMP);
537 if (!IS_ERR(rt2)) {
538 dst_release(&rt->dst);
539 memcpy(fl4, &fl4_dec, sizeof(*fl4));
540 rt = rt2;
541 } else if (PTR_ERR(rt2) == -EPERM) {
542 if (rt)
543 dst_release(&rt->dst);
544 return rt2;
545 } else {
546 err = PTR_ERR(rt2);
547 goto relookup_failed;
548 }
549 return rt;
550
551relookup_failed:
552 if (rt)
553 return rt;
554 return ERR_PTR(err);
555}
556
557
558
559
560
561
562
563
564
565
566
567
568void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
569{
570 struct iphdr *iph;
571 int room;
572 struct icmp_bxm *icmp_param;
573 struct rtable *rt = skb_rtable(skb_in);
574 struct ipcm_cookie ipc;
575 struct flowi4 fl4;
576 __be32 saddr;
577 u8 tos;
578 u32 mark;
579 struct net *net;
580 struct sock *sk;
581
582 if (!rt)
583 goto out;
584 net = dev_net(rt->dst.dev);
585
586
587
588
589
590
591 iph = ip_hdr(skb_in);
592
593 if ((u8 *)iph < skb_in->head ||
594 (skb_network_header(skb_in) + sizeof(*iph)) >
595 skb_tail_pointer(skb_in))
596 goto out;
597
598
599
600
601 if (skb_in->pkt_type != PACKET_HOST)
602 goto out;
603
604
605
606
607 if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
608 goto out;
609
610
611
612
613
614 if (iph->frag_off & htons(IP_OFFSET))
615 goto out;
616
617
618
619
620 if (icmp_pointers[type].error) {
621
622
623
624
625 if (iph->protocol == IPPROTO_ICMP) {
626 u8 _inner_type, *itp;
627
628 itp = skb_header_pointer(skb_in,
629 skb_network_header(skb_in) +
630 (iph->ihl << 2) +
631 offsetof(struct icmphdr,
632 type) -
633 skb_in->data,
634 sizeof(_inner_type),
635 &_inner_type);
636 if (!itp)
637 goto out;
638
639
640
641
642
643 if (*itp > NR_ICMP_TYPES ||
644 icmp_pointers[*itp].error)
645 goto out;
646 }
647 }
648
649 icmp_param = kmalloc(sizeof(*icmp_param), GFP_ATOMIC);
650 if (!icmp_param)
651 return;
652
653 sk = icmp_xmit_lock(net);
654 if (!sk)
655 goto out_free;
656
657
658
659
660
661 saddr = iph->daddr;
662 if (!(rt->rt_flags & RTCF_LOCAL)) {
663 struct net_device *dev = NULL;
664
665 rcu_read_lock();
666 if (rt_is_input_route(rt) &&
667 net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
668 dev = dev_get_by_index_rcu(net, inet_iif(skb_in));
669
670 if (dev)
671 saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
672 else
673 saddr = 0;
674 rcu_read_unlock();
675 }
676
677 tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
678 IPTOS_PREC_INTERNETCONTROL) :
679 iph->tos;
680 mark = IP4_REPLY_MARK(net, skb_in->mark);
681
682 if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb_in))
683 goto out_unlock;
684
685
686
687
688
689
690 icmp_param->data.icmph.type = type;
691 icmp_param->data.icmph.code = code;
692 icmp_param->data.icmph.un.gateway = info;
693 icmp_param->data.icmph.checksum = 0;
694 icmp_param->skb = skb_in;
695 icmp_param->offset = skb_network_offset(skb_in);
696 inet_sk(sk)->tos = tos;
697 sk->sk_mark = mark;
698 ipc.addr = iph->saddr;
699 ipc.opt = &icmp_param->replyopts.opt;
700 ipc.tx_flags = 0;
701 ipc.ttl = 0;
702 ipc.tos = -1;
703
704 rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos, mark,
705 type, code, icmp_param);
706 if (IS_ERR(rt))
707 goto out_unlock;
708
709 if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code))
710 goto ende;
711
712
713
714 room = dst_mtu(&rt->dst);
715 if (room > 576)
716 room = 576;
717 room -= sizeof(struct iphdr) + icmp_param->replyopts.opt.opt.optlen;
718 room -= sizeof(struct icmphdr);
719
720 icmp_param->data_len = skb_in->len - icmp_param->offset;
721 if (icmp_param->data_len > room)
722 icmp_param->data_len = room;
723 icmp_param->head_len = sizeof(struct icmphdr);
724
725 icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
726ende:
727 ip_rt_put(rt);
728out_unlock:
729 icmp_xmit_unlock(sk);
730out_free:
731 kfree(icmp_param);
732out:;
733}
734EXPORT_SYMBOL(icmp_send);
735
736
737static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
738{
739 const struct iphdr *iph = (const struct iphdr *) skb->data;
740 const struct net_protocol *ipprot;
741 int protocol = iph->protocol;
742
743
744
745
746 if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) {
747 __ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
748 return;
749 }
750
751 raw_icmp_error(skb, protocol, info);
752
753 ipprot = rcu_dereference(inet_protos[protocol]);
754 if (ipprot && ipprot->err_handler)
755 ipprot->err_handler(skb, info);
756}
757
758static bool icmp_tag_validation(int proto)
759{
760 bool ok;
761
762 rcu_read_lock();
763 ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
764 rcu_read_unlock();
765 return ok;
766}
767
768
769
770
771
772
773static bool icmp_unreach(struct sk_buff *skb)
774{
775 const struct iphdr *iph;
776 struct icmphdr *icmph;
777 struct net *net;
778 u32 info = 0;
779
780 net = dev_net(skb_dst(skb)->dev);
781
782
783
784
785
786
787
788 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
789 goto out_err;
790
791 icmph = icmp_hdr(skb);
792 iph = (const struct iphdr *)skb->data;
793
794 if (iph->ihl < 5)
795 goto out_err;
796
797 if (icmph->type == ICMP_DEST_UNREACH) {
798 switch (icmph->code & 15) {
799 case ICMP_NET_UNREACH:
800 case ICMP_HOST_UNREACH:
801 case ICMP_PROT_UNREACH:
802 case ICMP_PORT_UNREACH:
803 break;
804 case ICMP_FRAG_NEEDED:
805
806
807
808
809 switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
810 default:
811 net_dbg_ratelimited("%pI4: fragmentation needed and DF set\n",
812 &iph->daddr);
813 break;
814 case 2:
815 goto out;
816 case 3:
817 if (!icmp_tag_validation(iph->protocol))
818 goto out;
819
820 case 0:
821 info = ntohs(icmph->un.frag.mtu);
822 }
823 break;
824 case ICMP_SR_FAILED:
825 net_dbg_ratelimited("%pI4: Source Route Failed\n",
826 &iph->daddr);
827 break;
828 default:
829 break;
830 }
831 if (icmph->code > NR_ICMP_UNREACH)
832 goto out;
833 } else if (icmph->type == ICMP_PARAMETERPROB)
834 info = ntohl(icmph->un.gateway) >> 24;
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854 if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses &&
855 inet_addr_type_dev_table(net, skb->dev, iph->daddr) == RTN_BROADCAST) {
856 net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n",
857 &ip_hdr(skb)->saddr,
858 icmph->type, icmph->code,
859 &iph->daddr, skb->dev->name);
860 goto out;
861 }
862
863 icmp_socket_deliver(skb, info);
864
865out:
866 return true;
867out_err:
868 __ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
869 return false;
870}
871
872
873
874
875
876
877static bool icmp_redirect(struct sk_buff *skb)
878{
879 if (skb->len < sizeof(struct iphdr)) {
880 __ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
881 return false;
882 }
883
884 if (!pskb_may_pull(skb, sizeof(struct iphdr))) {
885
886 return false;
887 }
888
889 icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway);
890 return true;
891}
892
893
894
895
896
897
898
899
900
901
902
903
904
905static bool icmp_echo(struct sk_buff *skb)
906{
907 struct net *net;
908
909 net = dev_net(skb_dst(skb)->dev);
910 if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
911 struct icmp_bxm icmp_param;
912
913 icmp_param.data.icmph = *icmp_hdr(skb);
914 icmp_param.data.icmph.type = ICMP_ECHOREPLY;
915 icmp_param.skb = skb;
916 icmp_param.offset = 0;
917 icmp_param.data_len = skb->len;
918 icmp_param.head_len = sizeof(struct icmphdr);
919 icmp_reply(&icmp_param, skb);
920 }
921
922 return true;
923}
924
925
926
927
928
929
930
931
932static bool icmp_timestamp(struct sk_buff *skb)
933{
934 struct icmp_bxm icmp_param;
935
936
937
938 if (skb->len < 4)
939 goto out_err;
940
941
942
943
944 icmp_param.data.times[1] = inet_current_timestamp();
945 icmp_param.data.times[2] = icmp_param.data.times[1];
946 if (skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4))
947 BUG();
948 icmp_param.data.icmph = *icmp_hdr(skb);
949 icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
950 icmp_param.data.icmph.code = 0;
951 icmp_param.skb = skb;
952 icmp_param.offset = 0;
953 icmp_param.data_len = 0;
954 icmp_param.head_len = sizeof(struct icmphdr) + 12;
955 icmp_reply(&icmp_param, skb);
956 return true;
957
958out_err:
959 __ICMP_INC_STATS(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
960 return false;
961}
962
963static bool icmp_discard(struct sk_buff *skb)
964{
965
966 return true;
967}
968
969
970
971
972int icmp_rcv(struct sk_buff *skb)
973{
974 struct icmphdr *icmph;
975 struct rtable *rt = skb_rtable(skb);
976 struct net *net = dev_net(rt->dst.dev);
977 bool success;
978
979 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
980 struct sec_path *sp = skb_sec_path(skb);
981 int nh;
982
983 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
984 XFRM_STATE_ICMP))
985 goto drop;
986
987 if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
988 goto drop;
989
990 nh = skb_network_offset(skb);
991 skb_set_network_header(skb, sizeof(*icmph));
992
993 if (!xfrm4_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
994 goto drop;
995
996 skb_set_network_header(skb, nh);
997 }
998
999 __ICMP_INC_STATS(net, ICMP_MIB_INMSGS);
1000
1001 if (skb_checksum_simple_validate(skb))
1002 goto csum_error;
1003
1004 if (!pskb_pull(skb, sizeof(*icmph)))
1005 goto error;
1006
1007 icmph = icmp_hdr(skb);
1008
1009 ICMPMSGIN_INC_STATS(net, icmph->type);
1010
1011
1012
1013
1014
1015
1016 if (icmph->type > NR_ICMP_TYPES)
1017 goto error;
1018
1019
1020
1021
1022
1023
1024 if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
1025
1026
1027
1028
1029
1030
1031 if ((icmph->type == ICMP_ECHO ||
1032 icmph->type == ICMP_TIMESTAMP) &&
1033 net->ipv4.sysctl_icmp_echo_ignore_broadcasts) {
1034 goto error;
1035 }
1036 if (icmph->type != ICMP_ECHO &&
1037 icmph->type != ICMP_TIMESTAMP &&
1038 icmph->type != ICMP_ADDRESS &&
1039 icmph->type != ICMP_ADDRESSREPLY) {
1040 goto error;
1041 }
1042 }
1043
1044 success = icmp_pointers[icmph->type].handler(skb);
1045
1046 if (success) {
1047 consume_skb(skb);
1048 return 0;
1049 }
1050
1051drop:
1052 kfree_skb(skb);
1053 return 0;
1054csum_error:
1055 __ICMP_INC_STATS(net, ICMP_MIB_CSUMERRORS);
1056error:
1057 __ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
1058 goto drop;
1059}
1060
1061void icmp_err(struct sk_buff *skb, u32 info)
1062{
1063 struct iphdr *iph = (struct iphdr *)skb->data;
1064 int offset = iph->ihl<<2;
1065 struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset);
1066 int type = icmp_hdr(skb)->type;
1067 int code = icmp_hdr(skb)->code;
1068 struct net *net = dev_net(skb->dev);
1069
1070
1071
1072
1073
1074 if (icmph->type != ICMP_ECHOREPLY) {
1075 ping_err(skb, offset, info);
1076 return;
1077 }
1078
1079 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
1080 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ICMP, 0);
1081 else if (type == ICMP_REDIRECT)
1082 ipv4_redirect(skb, net, 0, 0, IPPROTO_ICMP, 0);
1083}
1084
1085
1086
1087
1088static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
1089 [ICMP_ECHOREPLY] = {
1090 .handler = ping_rcv,
1091 },
1092 [1] = {
1093 .handler = icmp_discard,
1094 .error = 1,
1095 },
1096 [2] = {
1097 .handler = icmp_discard,
1098 .error = 1,
1099 },
1100 [ICMP_DEST_UNREACH] = {
1101 .handler = icmp_unreach,
1102 .error = 1,
1103 },
1104 [ICMP_SOURCE_QUENCH] = {
1105 .handler = icmp_unreach,
1106 .error = 1,
1107 },
1108 [ICMP_REDIRECT] = {
1109 .handler = icmp_redirect,
1110 .error = 1,
1111 },
1112 [6] = {
1113 .handler = icmp_discard,
1114 .error = 1,
1115 },
1116 [7] = {
1117 .handler = icmp_discard,
1118 .error = 1,
1119 },
1120 [ICMP_ECHO] = {
1121 .handler = icmp_echo,
1122 },
1123 [9] = {
1124 .handler = icmp_discard,
1125 .error = 1,
1126 },
1127 [10] = {
1128 .handler = icmp_discard,
1129 .error = 1,
1130 },
1131 [ICMP_TIME_EXCEEDED] = {
1132 .handler = icmp_unreach,
1133 .error = 1,
1134 },
1135 [ICMP_PARAMETERPROB] = {
1136 .handler = icmp_unreach,
1137 .error = 1,
1138 },
1139 [ICMP_TIMESTAMP] = {
1140 .handler = icmp_timestamp,
1141 },
1142 [ICMP_TIMESTAMPREPLY] = {
1143 .handler = icmp_discard,
1144 },
1145 [ICMP_INFO_REQUEST] = {
1146 .handler = icmp_discard,
1147 },
1148 [ICMP_INFO_REPLY] = {
1149 .handler = icmp_discard,
1150 },
1151 [ICMP_ADDRESS] = {
1152 .handler = icmp_discard,
1153 },
1154 [ICMP_ADDRESSREPLY] = {
1155 .handler = icmp_discard,
1156 },
1157};
1158
1159static void __net_exit icmp_sk_exit(struct net *net)
1160{
1161 int i;
1162
1163 for_each_possible_cpu(i)
1164 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.icmp_sk, i));
1165 free_percpu(net->ipv4.icmp_sk);
1166 net->ipv4.icmp_sk = NULL;
1167}
1168
1169static int __net_init icmp_sk_init(struct net *net)
1170{
1171 int i, err;
1172
1173 net->ipv4.icmp_sk = alloc_percpu(struct sock *);
1174 if (!net->ipv4.icmp_sk)
1175 return -ENOMEM;
1176
1177 for_each_possible_cpu(i) {
1178 struct sock *sk;
1179
1180 err = inet_ctl_sock_create(&sk, PF_INET,
1181 SOCK_RAW, IPPROTO_ICMP, net);
1182 if (err < 0)
1183 goto fail;
1184
1185 *per_cpu_ptr(net->ipv4.icmp_sk, i) = sk;
1186
1187
1188
1189
1190 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
1191
1192
1193
1194
1195 sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1196 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
1197 }
1198
1199
1200 net->ipv4.sysctl_icmp_echo_ignore_all = 0;
1201 net->ipv4.sysctl_icmp_echo_ignore_broadcasts = 1;
1202
1203
1204 net->ipv4.sysctl_icmp_ignore_bogus_error_responses = 1;
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218 net->ipv4.sysctl_icmp_ratelimit = 1 * HZ;
1219 net->ipv4.sysctl_icmp_ratemask = 0x1818;
1220 net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;
1221
1222 return 0;
1223
1224fail:
1225 for_each_possible_cpu(i)
1226 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.icmp_sk, i));
1227 free_percpu(net->ipv4.icmp_sk);
1228 return err;
1229}
1230
1231static struct pernet_operations __net_initdata icmp_sk_ops = {
1232 .init = icmp_sk_init,
1233 .exit = icmp_sk_exit,
1234};
1235
1236int __init icmp_init(void)
1237{
1238 return register_pernet_subsys(&icmp_sk_ops);
1239}
1240