• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	NET3:	Implementation of the ICMP protocol layer.
4  *
5  *		Alan Cox, <alan@lxorguk.ukuu.org.uk>
6  *
7  *	Some of the function names and the icmp unreach table for this
8  *	module were derived from [icmp.c 1.0.11 06/02/93] by
9  *	Ross Biro, Fred N. van Kempen, Mark Evans, Alan Cox, Gerhard Koerting.
10  *	Other than that this module is a complete rewrite.
11  *
12  *	Fixes:
13  *	Clemens Fruhwirth	:	introduce global icmp rate limiting
14  *					with icmp type masking ability instead
15  *					of broken per type icmp timeouts.
16  *		Mike Shaver	:	RFC1122 checks.
17  *		Alan Cox	:	Multicast ping reply as self.
18  *		Alan Cox	:	Fix atomicity lockup in ip_build_xmit
19  *					call.
20  *		Alan Cox	:	Added 216,128 byte paths to the MTU
21  *					code.
22  *		Martin Mares	:	RFC1812 checks.
23  *		Martin Mares	:	Can be configured to follow redirects
24  *					if acting as a router _without_ a
25  *					routing protocol (RFC 1812).
26  *		Martin Mares	:	Echo requests may be configured to
27  *					be ignored (RFC 1812).
28  *		Martin Mares	:	Limitation of ICMP error message
29  *					transmit rate (RFC 1812).
30  *		Martin Mares	:	TOS and Precedence set correctly
31  *					(RFC 1812).
32  *		Martin Mares	:	Now copying as much data from the
33  *					original packet as we can without
34  *					exceeding 576 bytes (RFC 1812).
35  *	Willy Konynenberg	:	Transparent proxying support.
36  *		Keith Owens	:	RFC1191 correction for 4.2BSD based
37  *					path MTU bug.
38  *		Thomas Quinot	:	ICMP Dest Unreach codes up to 15 are
39  *					valid (RFC 1812).
40  *		Andi Kleen	:	Check all packet lengths properly
41  *					and moved all kfree_skb() up to
42  *					icmp_rcv.
43  *		Andi Kleen	:	Move the rate limit bookkeeping
44  *					into the dest entry and use a token
45  *					bucket filter (thanks to ANK). Make
46  *					the rates sysctl configurable.
47  *		Yu Tianli	:	Fixed two ugly bugs in icmp_send
48  *					- IP option length was accounted wrongly
49  *					- ICMP header length was not accounted
50  *					  at all.
51  *              Tristan Greaves :       Added sysctl option to ignore bogus
52  *              			broadcast responses from broken routers.
53  *
54  * To Fix:
55  *
56  *	- Should use skb_pull() instead of all the manual checking.
57  *	  This would also greatly simply some upper layer error handlers. --AK
58  */
59 
60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
61 
62 #include <linux/module.h>
63 #include <linux/types.h>
64 #include <linux/jiffies.h>
65 #include <linux/kernel.h>
66 #include <linux/fcntl.h>
67 #include <linux/socket.h>
68 #include <linux/in.h>
69 #include <linux/inet.h>
70 #include <linux/inetdevice.h>
71 #include <linux/netdevice.h>
72 #include <linux/string.h>
73 #include <linux/netfilter_ipv4.h>
74 #include <linux/slab.h>
75 #include <net/snmp.h>
76 #include <net/ip.h>
77 #include <net/route.h>
78 #include <net/protocol.h>
79 #include <net/icmp.h>
80 #include <net/tcp.h>
81 #include <net/udp.h>
82 #include <net/raw.h>
83 #include <net/ping.h>
84 #include <linux/skbuff.h>
85 #include <net/sock.h>
86 #include <linux/errno.h>
87 #include <linux/timer.h>
88 #include <linux/init.h>
89 #include <linux/uaccess.h>
90 #include <net/checksum.h>
91 #include <net/xfrm.h>
92 #include <net/inet_common.h>
93 #include <net/ip_fib.h>
94 #include <net/l3mdev.h>
95 
96 /*
97  *	Build xmit assembly blocks
98  */
99 
100 struct icmp_bxm {
101 	struct sk_buff *skb;
102 	int offset;
103 	int data_len;
104 
105 	struct {
106 		struct icmphdr icmph;
107 		__be32	       times[3];
108 	} data;
109 	int head_len;
110 	struct ip_options_data replyopts;
111 };
112 
113 /* An array of errno for error messages from dest unreach. */
114 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
115 
116 const struct icmp_err icmp_err_convert[] = {
117 	{
118 		.errno = ENETUNREACH,	/* ICMP_NET_UNREACH */
119 		.fatal = 0,
120 	},
121 	{
122 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNREACH */
123 		.fatal = 0,
124 	},
125 	{
126 		.errno = ENOPROTOOPT	/* ICMP_PROT_UNREACH */,
127 		.fatal = 1,
128 	},
129 	{
130 		.errno = ECONNREFUSED,	/* ICMP_PORT_UNREACH */
131 		.fatal = 1,
132 	},
133 	{
134 		.errno = EMSGSIZE,	/* ICMP_FRAG_NEEDED */
135 		.fatal = 0,
136 	},
137 	{
138 		.errno = EOPNOTSUPP,	/* ICMP_SR_FAILED */
139 		.fatal = 0,
140 	},
141 	{
142 		.errno = ENETUNREACH,	/* ICMP_NET_UNKNOWN */
143 		.fatal = 1,
144 	},
145 	{
146 		.errno = EHOSTDOWN,	/* ICMP_HOST_UNKNOWN */
147 		.fatal = 1,
148 	},
149 	{
150 		.errno = ENONET,	/* ICMP_HOST_ISOLATED */
151 		.fatal = 1,
152 	},
153 	{
154 		.errno = ENETUNREACH,	/* ICMP_NET_ANO	*/
155 		.fatal = 1,
156 	},
157 	{
158 		.errno = EHOSTUNREACH,	/* ICMP_HOST_ANO */
159 		.fatal = 1,
160 	},
161 	{
162 		.errno = ENETUNREACH,	/* ICMP_NET_UNR_TOS */
163 		.fatal = 0,
164 	},
165 	{
166 		.errno = EHOSTUNREACH,	/* ICMP_HOST_UNR_TOS */
167 		.fatal = 0,
168 	},
169 	{
170 		.errno = EHOSTUNREACH,	/* ICMP_PKT_FILTERED */
171 		.fatal = 1,
172 	},
173 	{
174 		.errno = EHOSTUNREACH,	/* ICMP_PREC_VIOLATION */
175 		.fatal = 1,
176 	},
177 	{
178 		.errno = EHOSTUNREACH,	/* ICMP_PREC_CUTOFF */
179 		.fatal = 1,
180 	},
181 };
182 EXPORT_SYMBOL(icmp_err_convert);
183 
184 /*
185  *	ICMP control array. This specifies what to do with each ICMP.
186  */
187 
188 struct icmp_control {
189 	bool (*handler)(struct sk_buff *skb);
190 	short   error;		/* This ICMP is classed as an error message */
191 };
192 
193 static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
194 
195 /*
196  *	The ICMP socket(s). This is the most convenient way to flow control
197  *	our ICMP output as well as maintain a clean interface throughout
198  *	all layers. All Socketless IP sends will soon be gone.
199  *
200  *	On SMP we have one ICMP socket per-cpu.
201  */
icmp_sk(struct net * net)202 static struct sock *icmp_sk(struct net *net)
203 {
204 	return this_cpu_read(*net->ipv4.icmp_sk);
205 }
206 
207 /* Called with BH disabled */
icmp_xmit_lock(struct net * net)208 static inline struct sock *icmp_xmit_lock(struct net *net)
209 {
210 	struct sock *sk;
211 
212 	sk = icmp_sk(net);
213 
214 	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
215 		/* This can happen if the output path signals a
216 		 * dst_link_failure() for an outgoing ICMP packet.
217 		 */
218 		return NULL;
219 	}
220 	return sk;
221 }
222 
icmp_xmit_unlock(struct sock * sk)223 static inline void icmp_xmit_unlock(struct sock *sk)
224 {
225 	spin_unlock(&sk->sk_lock.slock);
226 }
227 
228 int sysctl_icmp_msgs_per_sec __read_mostly = 1000;
229 int sysctl_icmp_msgs_burst __read_mostly = 50;
230 
231 static struct {
232 	spinlock_t	lock;
233 	u32		credit;
234 	u32		stamp;
235 } icmp_global = {
236 	.lock		= __SPIN_LOCK_UNLOCKED(icmp_global.lock),
237 };
238 
239 /**
240  * icmp_global_allow - Are we allowed to send one more ICMP message ?
241  *
242  * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
243  * Returns false if we reached the limit and can not send another packet.
244  * Note: called with BH disabled
245  */
icmp_global_allow(void)246 bool icmp_global_allow(void)
247 {
248 	u32 credit, delta, incr = 0, now = (u32)jiffies;
249 	bool rc = false;
250 
251 	/* Check if token bucket is empty and cannot be refilled
252 	 * without taking the spinlock. The READ_ONCE() are paired
253 	 * with the following WRITE_ONCE() in this same function.
254 	 */
255 	if (!READ_ONCE(icmp_global.credit)) {
256 		delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ);
257 		if (delta < HZ / 50)
258 			return false;
259 	}
260 
261 	spin_lock(&icmp_global.lock);
262 	delta = min_t(u32, now - icmp_global.stamp, HZ);
263 	if (delta >= HZ / 50) {
264 		incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ;
265 		if (incr)
266 			WRITE_ONCE(icmp_global.stamp, now);
267 	}
268 	credit = min_t(u32, icmp_global.credit + incr,
269 		       READ_ONCE(sysctl_icmp_msgs_burst));
270 	if (credit) {
271 		/* We want to use a credit of one in average, but need to randomize
272 		 * it for security reasons.
273 		 */
274 		credit = max_t(int, credit - prandom_u32_max(3), 0);
275 		rc = true;
276 	}
277 	WRITE_ONCE(icmp_global.credit, credit);
278 	spin_unlock(&icmp_global.lock);
279 	return rc;
280 }
281 EXPORT_SYMBOL(icmp_global_allow);
282 
icmpv4_mask_allow(struct net * net,int type,int code)283 static bool icmpv4_mask_allow(struct net *net, int type, int code)
284 {
285 	if (type > NR_ICMP_TYPES)
286 		return true;
287 
288 	/* Don't limit PMTU discovery. */
289 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
290 		return true;
291 
292 	/* Limit if icmp type is enabled in ratemask. */
293 	if (!((1 << type) & READ_ONCE(net->ipv4.sysctl_icmp_ratemask)))
294 		return true;
295 
296 	return false;
297 }
298 
icmpv4_global_allow(struct net * net,int type,int code)299 static bool icmpv4_global_allow(struct net *net, int type, int code)
300 {
301 	if (icmpv4_mask_allow(net, type, code))
302 		return true;
303 
304 	if (icmp_global_allow())
305 		return true;
306 
307 	return false;
308 }
309 
310 /*
311  *	Send an ICMP frame.
312  */
313 
icmpv4_xrlim_allow(struct net * net,struct rtable * rt,struct flowi4 * fl4,int type,int code)314 static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
315 			       struct flowi4 *fl4, int type, int code)
316 {
317 	struct dst_entry *dst = &rt->dst;
318 	struct inet_peer *peer;
319 	bool rc = true;
320 	int vif;
321 
322 	if (icmpv4_mask_allow(net, type, code))
323 		goto out;
324 
325 	/* No rate limit on loopback */
326 	if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
327 		goto out;
328 
329 	vif = l3mdev_master_ifindex(dst->dev);
330 	peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1);
331 	rc = inet_peer_xrlim_allow(peer,
332 				   READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
333 	if (peer)
334 		inet_putpeer(peer);
335 out:
336 	return rc;
337 }
338 
339 /*
340  *	Maintain the counters used in the SNMP statistics for outgoing ICMP
341  */
icmp_out_count(struct net * net,unsigned char type)342 void icmp_out_count(struct net *net, unsigned char type)
343 {
344 	ICMPMSGOUT_INC_STATS(net, type);
345 	ICMP_INC_STATS(net, ICMP_MIB_OUTMSGS);
346 }
347 
348 /*
349  *	Checksum each fragment, and on the first include the headers and final
350  *	checksum.
351  */
icmp_glue_bits(void * from,char * to,int offset,int len,int odd,struct sk_buff * skb)352 static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
353 			  struct sk_buff *skb)
354 {
355 	struct icmp_bxm *icmp_param = (struct icmp_bxm *)from;
356 	__wsum csum;
357 
358 	csum = skb_copy_and_csum_bits(icmp_param->skb,
359 				      icmp_param->offset + offset,
360 				      to, len);
361 
362 	skb->csum = csum_block_add(skb->csum, csum, odd);
363 	if (icmp_pointers[icmp_param->data.icmph.type].error)
364 		nf_ct_attach(skb, icmp_param->skb);
365 	return 0;
366 }
367 
icmp_push_reply(struct icmp_bxm * icmp_param,struct flowi4 * fl4,struct ipcm_cookie * ipc,struct rtable ** rt)368 static void icmp_push_reply(struct icmp_bxm *icmp_param,
369 			    struct flowi4 *fl4,
370 			    struct ipcm_cookie *ipc, struct rtable **rt)
371 {
372 	struct sock *sk;
373 	struct sk_buff *skb;
374 
375 	sk = icmp_sk(dev_net((*rt)->dst.dev));
376 	if (ip_append_data(sk, fl4, icmp_glue_bits, icmp_param,
377 			   icmp_param->data_len+icmp_param->head_len,
378 			   icmp_param->head_len,
379 			   ipc, rt, MSG_DONTWAIT) < 0) {
380 		__ICMP_INC_STATS(sock_net(sk), ICMP_MIB_OUTERRORS);
381 		ip_flush_pending_frames(sk);
382 	} else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
383 		struct icmphdr *icmph = icmp_hdr(skb);
384 		__wsum csum;
385 		struct sk_buff *skb1;
386 
387 		csum = csum_partial_copy_nocheck((void *)&icmp_param->data,
388 						 (char *)icmph,
389 						 icmp_param->head_len);
390 		skb_queue_walk(&sk->sk_write_queue, skb1) {
391 			csum = csum_add(csum, skb1->csum);
392 		}
393 		icmph->checksum = csum_fold(csum);
394 		skb->ip_summed = CHECKSUM_NONE;
395 		ip_push_pending_frames(sk, fl4);
396 	}
397 }
398 
399 /*
400  *	Driving logic for building and sending ICMP messages.
401  */
402 
icmp_reply(struct icmp_bxm * icmp_param,struct sk_buff * skb)403 static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
404 {
405 	struct ipcm_cookie ipc;
406 	struct rtable *rt = skb_rtable(skb);
407 	struct net *net = dev_net(rt->dst.dev);
408 	struct flowi4 fl4;
409 	struct sock *sk;
410 	struct inet_sock *inet;
411 	__be32 daddr, saddr;
412 	u32 mark = IP4_REPLY_MARK(net, skb->mark);
413 	int type = icmp_param->data.icmph.type;
414 	int code = icmp_param->data.icmph.code;
415 
416 	if (ip_options_echo(net, &icmp_param->replyopts.opt.opt, skb))
417 		return;
418 
419 	/* Needed by both icmp_global_allow and icmp_xmit_lock */
420 	local_bh_disable();
421 
422 	/* global icmp_msgs_per_sec */
423 	if (!icmpv4_global_allow(net, type, code))
424 		goto out_bh_enable;
425 
426 	sk = icmp_xmit_lock(net);
427 	if (!sk)
428 		goto out_bh_enable;
429 	inet = inet_sk(sk);
430 
431 	icmp_param->data.icmph.checksum = 0;
432 
433 	ipcm_init(&ipc);
434 	inet->tos = ip_hdr(skb)->tos;
435 	ipc.sockc.mark = mark;
436 	daddr = ipc.addr = ip_hdr(skb)->saddr;
437 	saddr = fib_compute_spec_dst(skb);
438 
439 	if (icmp_param->replyopts.opt.opt.optlen) {
440 		ipc.opt = &icmp_param->replyopts.opt;
441 		if (ipc.opt->opt.srr)
442 			daddr = icmp_param->replyopts.opt.opt.faddr;
443 	}
444 	memset(&fl4, 0, sizeof(fl4));
445 	fl4.daddr = daddr;
446 	fl4.saddr = saddr;
447 	fl4.flowi4_mark = mark;
448 	fl4.flowi4_uid = sock_net_uid(net, NULL);
449 	fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
450 	fl4.flowi4_proto = IPPROTO_ICMP;
451 	fl4.flowi4_oif = l3mdev_master_ifindex(skb->dev);
452 	security_skb_classify_flow(skb, flowi4_to_flowi_common(&fl4));
453 	rt = ip_route_output_key(net, &fl4);
454 	if (IS_ERR(rt))
455 		goto out_unlock;
456 	if (icmpv4_xrlim_allow(net, rt, &fl4, type, code))
457 		icmp_push_reply(icmp_param, &fl4, &ipc, &rt);
458 	ip_rt_put(rt);
459 out_unlock:
460 	icmp_xmit_unlock(sk);
461 out_bh_enable:
462 	local_bh_enable();
463 }
464 
465 /*
466  * The device used for looking up which routing table to use for sending an ICMP
467  * error is preferably the source whenever it is set, which should ensure the
468  * icmp error can be sent to the source host, else lookup using the routing
469  * table of the destination device, else use the main routing table (index 0).
470  */
icmp_get_route_lookup_dev(struct sk_buff * skb)471 static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
472 {
473 	struct net_device *route_lookup_dev = NULL;
474 
475 	if (skb->dev)
476 		route_lookup_dev = skb->dev;
477 	else if (skb_dst(skb))
478 		route_lookup_dev = skb_dst(skb)->dev;
479 	return route_lookup_dev;
480 }
481 
icmp_route_lookup(struct net * net,struct flowi4 * fl4,struct sk_buff * skb_in,const struct iphdr * iph,__be32 saddr,u8 tos,u32 mark,int type,int code,struct icmp_bxm * param)482 static struct rtable *icmp_route_lookup(struct net *net,
483 					struct flowi4 *fl4,
484 					struct sk_buff *skb_in,
485 					const struct iphdr *iph,
486 					__be32 saddr, u8 tos, u32 mark,
487 					int type, int code,
488 					struct icmp_bxm *param)
489 {
490 	struct net_device *route_lookup_dev;
491 	struct rtable *rt, *rt2;
492 	struct flowi4 fl4_dec;
493 	int err;
494 
495 	memset(fl4, 0, sizeof(*fl4));
496 	fl4->daddr = (param->replyopts.opt.opt.srr ?
497 		      param->replyopts.opt.opt.faddr : iph->saddr);
498 	fl4->saddr = saddr;
499 	fl4->flowi4_mark = mark;
500 	fl4->flowi4_uid = sock_net_uid(net, NULL);
501 	fl4->flowi4_tos = RT_TOS(tos);
502 	fl4->flowi4_proto = IPPROTO_ICMP;
503 	fl4->fl4_icmp_type = type;
504 	fl4->fl4_icmp_code = code;
505 	route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
506 	fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
507 
508 	security_skb_classify_flow(skb_in, flowi4_to_flowi_common(fl4));
509 	rt = ip_route_output_key_hash(net, fl4, skb_in);
510 	if (IS_ERR(rt))
511 		return rt;
512 
513 	/* No need to clone since we're just using its address. */
514 	rt2 = rt;
515 
516 	rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
517 					   flowi4_to_flowi(fl4), NULL, 0);
518 	if (!IS_ERR(rt)) {
519 		if (rt != rt2)
520 			return rt;
521 	} else if (PTR_ERR(rt) == -EPERM) {
522 		rt = NULL;
523 	} else
524 		return rt;
525 
526 	err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec), AF_INET);
527 	if (err)
528 		goto relookup_failed;
529 
530 	if (inet_addr_type_dev_table(net, route_lookup_dev,
531 				     fl4_dec.saddr) == RTN_LOCAL) {
532 		rt2 = __ip_route_output_key(net, &fl4_dec);
533 		if (IS_ERR(rt2))
534 			err = PTR_ERR(rt2);
535 	} else {
536 		struct flowi4 fl4_2 = {};
537 		unsigned long orefdst;
538 
539 		fl4_2.daddr = fl4_dec.saddr;
540 		rt2 = ip_route_output_key(net, &fl4_2);
541 		if (IS_ERR(rt2)) {
542 			err = PTR_ERR(rt2);
543 			goto relookup_failed;
544 		}
545 		/* Ugh! */
546 		orefdst = skb_in->_skb_refdst; /* save old refdst */
547 		skb_dst_set(skb_in, NULL);
548 		err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
549 				     RT_TOS(tos), rt2->dst.dev);
550 
551 		dst_release(&rt2->dst);
552 		rt2 = skb_rtable(skb_in);
553 		skb_in->_skb_refdst = orefdst; /* restore old refdst */
554 	}
555 
556 	if (err)
557 		goto relookup_failed;
558 
559 	rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
560 					    flowi4_to_flowi(&fl4_dec), NULL,
561 					    XFRM_LOOKUP_ICMP);
562 	if (!IS_ERR(rt2)) {
563 		dst_release(&rt->dst);
564 		memcpy(fl4, &fl4_dec, sizeof(*fl4));
565 		rt = rt2;
566 	} else if (PTR_ERR(rt2) == -EPERM) {
567 		if (rt)
568 			dst_release(&rt->dst);
569 		return rt2;
570 	} else {
571 		err = PTR_ERR(rt2);
572 		goto relookup_failed;
573 	}
574 	return rt;
575 
576 relookup_failed:
577 	if (rt)
578 		return rt;
579 	return ERR_PTR(err);
580 }
581 
582 /*
583  *	Send an ICMP message in response to a situation
584  *
585  *	RFC 1122: 3.2.2	MUST send at least the IP header and 8 bytes of header.
586  *		  MAY send more (we do).
587  *			MUST NOT change this header information.
588  *			MUST NOT reply to a multicast/broadcast IP address.
589  *			MUST NOT reply to a multicast/broadcast MAC address.
590  *			MUST reply to only the first fragment.
591  */
592 
__icmp_send(struct sk_buff * skb_in,int type,int code,__be32 info,const struct ip_options * opt)593 void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
594 		 const struct ip_options *opt)
595 {
596 	struct iphdr *iph;
597 	int room;
598 	struct icmp_bxm icmp_param;
599 	struct rtable *rt = skb_rtable(skb_in);
600 	struct ipcm_cookie ipc;
601 	struct flowi4 fl4;
602 	__be32 saddr;
603 	u8  tos;
604 	u32 mark;
605 	struct net *net;
606 	struct sock *sk;
607 
608 	if (!rt)
609 		goto out;
610 
611 	if (rt->dst.dev)
612 		net = dev_net(rt->dst.dev);
613 	else if (skb_in->dev)
614 		net = dev_net(skb_in->dev);
615 	else
616 		goto out;
617 
618 	/*
619 	 *	Find the original header. It is expected to be valid, of course.
620 	 *	Check this, icmp_send is called from the most obscure devices
621 	 *	sometimes.
622 	 */
623 	iph = ip_hdr(skb_in);
624 
625 	if ((u8 *)iph < skb_in->head ||
626 	    (skb_network_header(skb_in) + sizeof(*iph)) >
627 	    skb_tail_pointer(skb_in))
628 		goto out;
629 
630 	/*
631 	 *	No replies to physical multicast/broadcast
632 	 */
633 	if (skb_in->pkt_type != PACKET_HOST)
634 		goto out;
635 
636 	/*
637 	 *	Now check at the protocol level
638 	 */
639 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
640 		goto out;
641 
642 	/*
643 	 *	Only reply to fragment 0. We byte re-order the constant
644 	 *	mask for efficiency.
645 	 */
646 	if (iph->frag_off & htons(IP_OFFSET))
647 		goto out;
648 
649 	/*
650 	 *	If we send an ICMP error to an ICMP error a mess would result..
651 	 */
652 	if (icmp_pointers[type].error) {
653 		/*
654 		 *	We are an error, check if we are replying to an
655 		 *	ICMP error
656 		 */
657 		if (iph->protocol == IPPROTO_ICMP) {
658 			u8 _inner_type, *itp;
659 
660 			itp = skb_header_pointer(skb_in,
661 						 skb_network_header(skb_in) +
662 						 (iph->ihl << 2) +
663 						 offsetof(struct icmphdr,
664 							  type) -
665 						 skb_in->data,
666 						 sizeof(_inner_type),
667 						 &_inner_type);
668 			if (!itp)
669 				goto out;
670 
671 			/*
672 			 *	Assume any unknown ICMP type is an error. This
673 			 *	isn't specified by the RFC, but think about it..
674 			 */
675 			if (*itp > NR_ICMP_TYPES ||
676 			    icmp_pointers[*itp].error)
677 				goto out;
678 		}
679 	}
680 
681 	/* Needed by both icmp_global_allow and icmp_xmit_lock */
682 	local_bh_disable();
683 
684 	/* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
685 	 * incoming dev is loopback.  If outgoing dev change to not be
686 	 * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
687 	 */
688 	if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
689 	      !icmpv4_global_allow(net, type, code))
690 		goto out_bh_enable;
691 
692 	sk = icmp_xmit_lock(net);
693 	if (!sk)
694 		goto out_bh_enable;
695 
696 	/*
697 	 *	Construct source address and options.
698 	 */
699 
700 	saddr = iph->daddr;
701 	if (!(rt->rt_flags & RTCF_LOCAL)) {
702 		struct net_device *dev = NULL;
703 
704 		rcu_read_lock();
705 		if (rt_is_input_route(rt) &&
706 		    net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
707 			dev = dev_get_by_index_rcu(net, inet_iif(skb_in));
708 
709 		if (dev)
710 			saddr = inet_select_addr(dev, iph->saddr,
711 						 RT_SCOPE_LINK);
712 		else
713 			saddr = 0;
714 		rcu_read_unlock();
715 	}
716 
717 	tos = icmp_pointers[type].error ? (RT_TOS(iph->tos) |
718 					   IPTOS_PREC_INTERNETCONTROL) :
719 					   iph->tos;
720 	mark = IP4_REPLY_MARK(net, skb_in->mark);
721 
722 	if (__ip_options_echo(net, &icmp_param.replyopts.opt.opt, skb_in, opt))
723 		goto out_unlock;
724 
725 
726 	/*
727 	 *	Prepare data for ICMP header.
728 	 */
729 
730 	icmp_param.data.icmph.type	 = type;
731 	icmp_param.data.icmph.code	 = code;
732 	icmp_param.data.icmph.un.gateway = info;
733 	icmp_param.data.icmph.checksum	 = 0;
734 	icmp_param.skb	  = skb_in;
735 	icmp_param.offset = skb_network_offset(skb_in);
736 	inet_sk(sk)->tos = tos;
737 	ipcm_init(&ipc);
738 	ipc.addr = iph->saddr;
739 	ipc.opt = &icmp_param.replyopts.opt;
740 	ipc.sockc.mark = mark;
741 
742 	rt = icmp_route_lookup(net, &fl4, skb_in, iph, saddr, tos, mark,
743 			       type, code, &icmp_param);
744 	if (IS_ERR(rt))
745 		goto out_unlock;
746 
747 	/* peer icmp_ratelimit */
748 	if (!icmpv4_xrlim_allow(net, rt, &fl4, type, code))
749 		goto ende;
750 
751 	/* RFC says return as much as we can without exceeding 576 bytes. */
752 
753 	room = dst_mtu(&rt->dst);
754 	if (room > 576)
755 		room = 576;
756 	room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
757 	room -= sizeof(struct icmphdr);
758 	/* Guard against tiny mtu. We need to include at least one
759 	 * IP network header for this message to make any sense.
760 	 */
761 	if (room <= (int)sizeof(struct iphdr))
762 		goto ende;
763 
764 	icmp_param.data_len = skb_in->len - icmp_param.offset;
765 	if (icmp_param.data_len > room)
766 		icmp_param.data_len = room;
767 	icmp_param.head_len = sizeof(struct icmphdr);
768 
769 	/* if we don't have a source address at this point, fall back to the
770 	 * dummy address instead of sending out a packet with a source address
771 	 * of 0.0.0.0
772 	 */
773 	if (!fl4.saddr)
774 		fl4.saddr = htonl(INADDR_DUMMY);
775 
776 	icmp_push_reply(&icmp_param, &fl4, &ipc, &rt);
777 ende:
778 	ip_rt_put(rt);
779 out_unlock:
780 	icmp_xmit_unlock(sk);
781 out_bh_enable:
782 	local_bh_enable();
783 out:;
784 }
785 EXPORT_SYMBOL(__icmp_send);
786 
787 #if IS_ENABLED(CONFIG_NF_NAT)
788 #include <net/netfilter/nf_conntrack.h>
icmp_ndo_send(struct sk_buff * skb_in,int type,int code,__be32 info)789 void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
790 {
791 	struct sk_buff *cloned_skb = NULL;
792 	struct ip_options opts = { 0 };
793 	enum ip_conntrack_info ctinfo;
794 	struct nf_conn *ct;
795 	__be32 orig_ip;
796 
797 	ct = nf_ct_get(skb_in, &ctinfo);
798 	if (!ct || !(ct->status & IPS_SRC_NAT)) {
799 		__icmp_send(skb_in, type, code, info, &opts);
800 		return;
801 	}
802 
803 	if (skb_shared(skb_in))
804 		skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
805 
806 	if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
807 	    (skb_network_header(skb_in) + sizeof(struct iphdr)) >
808 	    skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
809 	    skb_network_offset(skb_in) + sizeof(struct iphdr))))
810 		goto out;
811 
812 	orig_ip = ip_hdr(skb_in)->saddr;
813 	ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
814 	__icmp_send(skb_in, type, code, info, &opts);
815 	ip_hdr(skb_in)->saddr = orig_ip;
816 out:
817 	consume_skb(cloned_skb);
818 }
819 EXPORT_SYMBOL(icmp_ndo_send);
820 #endif
821 
icmp_socket_deliver(struct sk_buff * skb,u32 info)822 static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
823 {
824 	const struct iphdr *iph = (const struct iphdr *)skb->data;
825 	const struct net_protocol *ipprot;
826 	int protocol = iph->protocol;
827 
828 	/* Checkin full IP header plus 8 bytes of protocol to
829 	 * avoid additional coding at protocol handlers.
830 	 */
831 	if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) {
832 		__ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
833 		return;
834 	}
835 
836 	raw_icmp_error(skb, protocol, info);
837 
838 	ipprot = rcu_dereference(inet_protos[protocol]);
839 	if (ipprot && ipprot->err_handler)
840 		ipprot->err_handler(skb, info);
841 }
842 
icmp_tag_validation(int proto)843 static bool icmp_tag_validation(int proto)
844 {
845 	bool ok;
846 
847 	rcu_read_lock();
848 	ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
849 	rcu_read_unlock();
850 	return ok;
851 }
852 
853 /*
854  *	Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEEDED, ICMP_QUENCH, and
855  *	ICMP_PARAMETERPROB.
856  */
857 
icmp_unreach(struct sk_buff * skb)858 static bool icmp_unreach(struct sk_buff *skb)
859 {
860 	const struct iphdr *iph;
861 	struct icmphdr *icmph;
862 	struct net *net;
863 	u32 info = 0;
864 
865 	net = dev_net(skb_dst(skb)->dev);
866 
867 	/*
868 	 *	Incomplete header ?
869 	 * 	Only checks for the IP header, there should be an
870 	 *	additional check for longer headers in upper levels.
871 	 */
872 
873 	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
874 		goto out_err;
875 
876 	icmph = icmp_hdr(skb);
877 	iph   = (const struct iphdr *)skb->data;
878 
879 	if (iph->ihl < 5) /* Mangled header, drop. */
880 		goto out_err;
881 
882 	switch (icmph->type) {
883 	case ICMP_DEST_UNREACH:
884 		switch (icmph->code & 15) {
885 		case ICMP_NET_UNREACH:
886 		case ICMP_HOST_UNREACH:
887 		case ICMP_PROT_UNREACH:
888 		case ICMP_PORT_UNREACH:
889 			break;
890 		case ICMP_FRAG_NEEDED:
891 			/* for documentation of the ip_no_pmtu_disc
892 			 * values please see
893 			 * Documentation/networking/ip-sysctl.rst
894 			 */
895 			switch (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc)) {
896 			default:
897 				net_dbg_ratelimited("%pI4: fragmentation needed and DF set\n",
898 						    &iph->daddr);
899 				break;
900 			case 2:
901 				goto out;
902 			case 3:
903 				if (!icmp_tag_validation(iph->protocol))
904 					goto out;
905 				fallthrough;
906 			case 0:
907 				info = ntohs(icmph->un.frag.mtu);
908 			}
909 			break;
910 		case ICMP_SR_FAILED:
911 			net_dbg_ratelimited("%pI4: Source Route Failed\n",
912 					    &iph->daddr);
913 			break;
914 		default:
915 			break;
916 		}
917 		if (icmph->code > NR_ICMP_UNREACH)
918 			goto out;
919 		break;
920 	case ICMP_PARAMETERPROB:
921 		info = ntohl(icmph->un.gateway) >> 24;
922 		break;
923 	case ICMP_TIME_EXCEEDED:
924 		__ICMP_INC_STATS(net, ICMP_MIB_INTIMEEXCDS);
925 		if (icmph->code == ICMP_EXC_FRAGTIME)
926 			goto out;
927 		break;
928 	}
929 
930 	/*
931 	 *	Throw it at our lower layers
932 	 *
933 	 *	RFC 1122: 3.2.2 MUST extract the protocol ID from the passed
934 	 *		  header.
935 	 *	RFC 1122: 3.2.2.1 MUST pass ICMP unreach messages to the
936 	 *		  transport layer.
937 	 *	RFC 1122: 3.2.2.2 MUST pass ICMP time expired messages to
938 	 *		  transport layer.
939 	 */
940 
941 	/*
942 	 *	Check the other end isn't violating RFC 1122. Some routers send
943 	 *	bogus responses to broadcast frames. If you see this message
944 	 *	first check your netmask matches at both ends, if it does then
945 	 *	get the other vendor to fix their kit.
946 	 */
947 
948 	if (!net->ipv4.sysctl_icmp_ignore_bogus_error_responses &&
949 	    inet_addr_type_dev_table(net, skb->dev, iph->daddr) == RTN_BROADCAST) {
950 		net_warn_ratelimited("%pI4 sent an invalid ICMP type %u, code %u error to a broadcast: %pI4 on %s\n",
951 				     &ip_hdr(skb)->saddr,
952 				     icmph->type, icmph->code,
953 				     &iph->daddr, skb->dev->name);
954 		goto out;
955 	}
956 
957 	icmp_socket_deliver(skb, info);
958 
959 out:
960 	return true;
961 out_err:
962 	__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
963 	return false;
964 }
965 
966 
967 /*
968  *	Handle ICMP_REDIRECT.
969  */
970 
icmp_redirect(struct sk_buff * skb)971 static bool icmp_redirect(struct sk_buff *skb)
972 {
973 	if (skb->len < sizeof(struct iphdr)) {
974 		__ICMP_INC_STATS(dev_net(skb->dev), ICMP_MIB_INERRORS);
975 		return false;
976 	}
977 
978 	if (!pskb_may_pull(skb, sizeof(struct iphdr))) {
979 		/* there aught to be a stat */
980 		return false;
981 	}
982 
983 	icmp_socket_deliver(skb, ntohl(icmp_hdr(skb)->un.gateway));
984 	return true;
985 }
986 
987 /*
988  *	Handle ICMP_ECHO ("ping") requests.
989  *
990  *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
991  *		  requests.
992  *	RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
993  *		  included in the reply.
994  *	RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
995  *		  echo requests, MUST have default=NOT.
996  *	See also WRT handling of options once they are done and working.
997  */
998 
icmp_echo(struct sk_buff * skb)999 static bool icmp_echo(struct sk_buff *skb)
1000 {
1001 	struct net *net;
1002 
1003 	net = dev_net(skb_dst(skb)->dev);
1004 	if (!net->ipv4.sysctl_icmp_echo_ignore_all) {
1005 		struct icmp_bxm icmp_param;
1006 
1007 		icmp_param.data.icmph	   = *icmp_hdr(skb);
1008 		icmp_param.data.icmph.type = ICMP_ECHOREPLY;
1009 		icmp_param.skb		   = skb;
1010 		icmp_param.offset	   = 0;
1011 		icmp_param.data_len	   = skb->len;
1012 		icmp_param.head_len	   = sizeof(struct icmphdr);
1013 		icmp_reply(&icmp_param, skb);
1014 	}
1015 	/* should there be an ICMP stat for ignored echos? */
1016 	return true;
1017 }
1018 
1019 /*
1020  *	Handle ICMP Timestamp requests.
1021  *	RFC 1122: 3.2.2.8 MAY implement ICMP timestamp requests.
1022  *		  SHOULD be in the kernel for minimum random latency.
1023  *		  MUST be accurate to a few minutes.
1024  *		  MUST be updated at least at 15Hz.
1025  */
icmp_timestamp(struct sk_buff * skb)1026 static bool icmp_timestamp(struct sk_buff *skb)
1027 {
1028 	struct icmp_bxm icmp_param;
1029 	/*
1030 	 *	Too short.
1031 	 */
1032 	if (skb->len < 4)
1033 		goto out_err;
1034 
1035 	/*
1036 	 *	Fill in the current time as ms since midnight UT:
1037 	 */
1038 	icmp_param.data.times[1] = inet_current_timestamp();
1039 	icmp_param.data.times[2] = icmp_param.data.times[1];
1040 
1041 	BUG_ON(skb_copy_bits(skb, 0, &icmp_param.data.times[0], 4));
1042 
1043 	icmp_param.data.icmph	   = *icmp_hdr(skb);
1044 	icmp_param.data.icmph.type = ICMP_TIMESTAMPREPLY;
1045 	icmp_param.data.icmph.code = 0;
1046 	icmp_param.skb		   = skb;
1047 	icmp_param.offset	   = 0;
1048 	icmp_param.data_len	   = 0;
1049 	icmp_param.head_len	   = sizeof(struct icmphdr) + 12;
1050 	icmp_reply(&icmp_param, skb);
1051 	return true;
1052 
1053 out_err:
1054 	__ICMP_INC_STATS(dev_net(skb_dst(skb)->dev), ICMP_MIB_INERRORS);
1055 	return false;
1056 }
1057 
icmp_discard(struct sk_buff * skb)1058 static bool icmp_discard(struct sk_buff *skb)
1059 {
1060 	/* pretend it was a success */
1061 	return true;
1062 }
1063 
1064 /*
1065  *	Deal with incoming ICMP packets.
1066  */
icmp_rcv(struct sk_buff * skb)1067 int icmp_rcv(struct sk_buff *skb)
1068 {
1069 	struct icmphdr *icmph;
1070 	struct rtable *rt = skb_rtable(skb);
1071 	struct net *net = dev_net(rt->dst.dev);
1072 	bool success;
1073 
1074 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1075 		struct sec_path *sp = skb_sec_path(skb);
1076 		int nh;
1077 
1078 		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
1079 				 XFRM_STATE_ICMP))
1080 			goto drop;
1081 
1082 		if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
1083 			goto drop;
1084 
1085 		nh = skb_network_offset(skb);
1086 		skb_set_network_header(skb, sizeof(*icmph));
1087 
1088 		if (!xfrm4_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
1089 			goto drop;
1090 
1091 		skb_set_network_header(skb, nh);
1092 	}
1093 
1094 	__ICMP_INC_STATS(net, ICMP_MIB_INMSGS);
1095 
1096 	if (skb_checksum_simple_validate(skb))
1097 		goto csum_error;
1098 
1099 	if (!pskb_pull(skb, sizeof(*icmph)))
1100 		goto error;
1101 
1102 	icmph = icmp_hdr(skb);
1103 
1104 	ICMPMSGIN_INC_STATS(net, icmph->type);
1105 	/*
1106 	 *	18 is the highest 'known' ICMP type. Anything else is a mystery
1107 	 *
1108 	 *	RFC 1122: 3.2.2  Unknown ICMP messages types MUST be silently
1109 	 *		  discarded.
1110 	 */
1111 	if (icmph->type > NR_ICMP_TYPES)
1112 		goto error;
1113 
1114 
1115 	/*
1116 	 *	Parse the ICMP message
1117 	 */
1118 
1119 	if (rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
1120 		/*
1121 		 *	RFC 1122: 3.2.2.6 An ICMP_ECHO to broadcast MAY be
1122 		 *	  silently ignored (we let user decide with a sysctl).
1123 		 *	RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
1124 		 *	  discarded if to broadcast/multicast.
1125 		 */
1126 		if ((icmph->type == ICMP_ECHO ||
1127 		     icmph->type == ICMP_TIMESTAMP) &&
1128 		    net->ipv4.sysctl_icmp_echo_ignore_broadcasts) {
1129 			goto error;
1130 		}
1131 		if (icmph->type != ICMP_ECHO &&
1132 		    icmph->type != ICMP_TIMESTAMP &&
1133 		    icmph->type != ICMP_ADDRESS &&
1134 		    icmph->type != ICMP_ADDRESSREPLY) {
1135 			goto error;
1136 		}
1137 	}
1138 
1139 	success = icmp_pointers[icmph->type].handler(skb);
1140 
1141 	if (success)  {
1142 		consume_skb(skb);
1143 		return NET_RX_SUCCESS;
1144 	}
1145 
1146 drop:
1147 	kfree_skb(skb);
1148 	return NET_RX_DROP;
1149 csum_error:
1150 	__ICMP_INC_STATS(net, ICMP_MIB_CSUMERRORS);
1151 error:
1152 	__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
1153 	goto drop;
1154 }
1155 
ip_icmp_error_rfc4884_validate(const struct sk_buff * skb,int off)1156 static bool ip_icmp_error_rfc4884_validate(const struct sk_buff *skb, int off)
1157 {
1158 	struct icmp_extobj_hdr *objh, _objh;
1159 	struct icmp_ext_hdr *exth, _exth;
1160 	u16 olen;
1161 
1162 	exth = skb_header_pointer(skb, off, sizeof(_exth), &_exth);
1163 	if (!exth)
1164 		return false;
1165 	if (exth->version != 2)
1166 		return true;
1167 
1168 	if (exth->checksum &&
1169 	    csum_fold(skb_checksum(skb, off, skb->len - off, 0)))
1170 		return false;
1171 
1172 	off += sizeof(_exth);
1173 	while (off < skb->len) {
1174 		objh = skb_header_pointer(skb, off, sizeof(_objh), &_objh);
1175 		if (!objh)
1176 			return false;
1177 
1178 		olen = ntohs(objh->length);
1179 		if (olen < sizeof(_objh))
1180 			return false;
1181 
1182 		off += olen;
1183 		if (off > skb->len)
1184 			return false;
1185 	}
1186 
1187 	return true;
1188 }
1189 
ip_icmp_error_rfc4884(const struct sk_buff * skb,struct sock_ee_data_rfc4884 * out,int thlen,int off)1190 void ip_icmp_error_rfc4884(const struct sk_buff *skb,
1191 			   struct sock_ee_data_rfc4884 *out,
1192 			   int thlen, int off)
1193 {
1194 	int hlen;
1195 
1196 	/* original datagram headers: end of icmph to payload (skb->data) */
1197 	hlen = -skb_transport_offset(skb) - thlen;
1198 
1199 	/* per rfc 4884: minimal datagram length of 128 bytes */
1200 	if (off < 128 || off < hlen)
1201 		return;
1202 
1203 	/* kernel has stripped headers: return payload offset in bytes */
1204 	off -= hlen;
1205 	if (off + sizeof(struct icmp_ext_hdr) > skb->len)
1206 		return;
1207 
1208 	out->len = off;
1209 
1210 	if (!ip_icmp_error_rfc4884_validate(skb, off))
1211 		out->flags |= SO_EE_RFC4884_FLAG_INVALID;
1212 }
1213 EXPORT_SYMBOL_GPL(ip_icmp_error_rfc4884);
1214 
icmp_err(struct sk_buff * skb,u32 info)1215 int icmp_err(struct sk_buff *skb, u32 info)
1216 {
1217 	struct iphdr *iph = (struct iphdr *)skb->data;
1218 	int offset = iph->ihl<<2;
1219 	struct icmphdr *icmph = (struct icmphdr *)(skb->data + offset);
1220 	int type = icmp_hdr(skb)->type;
1221 	int code = icmp_hdr(skb)->code;
1222 	struct net *net = dev_net(skb->dev);
1223 
1224 	/*
1225 	 * Use ping_err to handle all icmp errors except those
1226 	 * triggered by ICMP_ECHOREPLY which sent from kernel.
1227 	 */
1228 	if (icmph->type != ICMP_ECHOREPLY) {
1229 		ping_err(skb, offset, info);
1230 		return 0;
1231 	}
1232 
1233 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
1234 		ipv4_update_pmtu(skb, net, info, 0, IPPROTO_ICMP);
1235 	else if (type == ICMP_REDIRECT)
1236 		ipv4_redirect(skb, net, 0, IPPROTO_ICMP);
1237 
1238 	return 0;
1239 }
1240 
1241 /*
1242  *	This table is the definition of how we handle ICMP.
1243  */
1244 static const struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
1245 	[ICMP_ECHOREPLY] = {
1246 		.handler = ping_rcv,
1247 	},
1248 	[1] = {
1249 		.handler = icmp_discard,
1250 		.error = 1,
1251 	},
1252 	[2] = {
1253 		.handler = icmp_discard,
1254 		.error = 1,
1255 	},
1256 	[ICMP_DEST_UNREACH] = {
1257 		.handler = icmp_unreach,
1258 		.error = 1,
1259 	},
1260 	[ICMP_SOURCE_QUENCH] = {
1261 		.handler = icmp_unreach,
1262 		.error = 1,
1263 	},
1264 	[ICMP_REDIRECT] = {
1265 		.handler = icmp_redirect,
1266 		.error = 1,
1267 	},
1268 	[6] = {
1269 		.handler = icmp_discard,
1270 		.error = 1,
1271 	},
1272 	[7] = {
1273 		.handler = icmp_discard,
1274 		.error = 1,
1275 	},
1276 	[ICMP_ECHO] = {
1277 		.handler = icmp_echo,
1278 	},
1279 	[9] = {
1280 		.handler = icmp_discard,
1281 		.error = 1,
1282 	},
1283 	[10] = {
1284 		.handler = icmp_discard,
1285 		.error = 1,
1286 	},
1287 	[ICMP_TIME_EXCEEDED] = {
1288 		.handler = icmp_unreach,
1289 		.error = 1,
1290 	},
1291 	[ICMP_PARAMETERPROB] = {
1292 		.handler = icmp_unreach,
1293 		.error = 1,
1294 	},
1295 	[ICMP_TIMESTAMP] = {
1296 		.handler = icmp_timestamp,
1297 	},
1298 	[ICMP_TIMESTAMPREPLY] = {
1299 		.handler = icmp_discard,
1300 	},
1301 	[ICMP_INFO_REQUEST] = {
1302 		.handler = icmp_discard,
1303 	},
1304 	[ICMP_INFO_REPLY] = {
1305 		.handler = icmp_discard,
1306 	},
1307 	[ICMP_ADDRESS] = {
1308 		.handler = icmp_discard,
1309 	},
1310 	[ICMP_ADDRESSREPLY] = {
1311 		.handler = icmp_discard,
1312 	},
1313 };
1314 
icmp_sk_exit(struct net * net)1315 static void __net_exit icmp_sk_exit(struct net *net)
1316 {
1317 	int i;
1318 
1319 	for_each_possible_cpu(i)
1320 		inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.icmp_sk, i));
1321 	free_percpu(net->ipv4.icmp_sk);
1322 	net->ipv4.icmp_sk = NULL;
1323 }
1324 
icmp_sk_init(struct net * net)1325 static int __net_init icmp_sk_init(struct net *net)
1326 {
1327 	int i, err;
1328 
1329 	net->ipv4.icmp_sk = alloc_percpu(struct sock *);
1330 	if (!net->ipv4.icmp_sk)
1331 		return -ENOMEM;
1332 
1333 	for_each_possible_cpu(i) {
1334 		struct sock *sk;
1335 
1336 		err = inet_ctl_sock_create(&sk, PF_INET,
1337 					   SOCK_RAW, IPPROTO_ICMP, net);
1338 		if (err < 0)
1339 			goto fail;
1340 
1341 		*per_cpu_ptr(net->ipv4.icmp_sk, i) = sk;
1342 
1343 		/* Enough space for 2 64K ICMP packets, including
1344 		 * sk_buff/skb_shared_info struct overhead.
1345 		 */
1346 		sk->sk_sndbuf =	2 * SKB_TRUESIZE(64 * 1024);
1347 
1348 		/*
1349 		 * Speedup sock_wfree()
1350 		 */
1351 		sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1352 		inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
1353 	}
1354 
1355 	/* Control parameters for ECHO replies. */
1356 	net->ipv4.sysctl_icmp_echo_ignore_all = 0;
1357 	net->ipv4.sysctl_icmp_echo_ignore_broadcasts = 1;
1358 
1359 	/* Control parameter - ignore bogus broadcast responses? */
1360 	net->ipv4.sysctl_icmp_ignore_bogus_error_responses = 1;
1361 
1362 	/*
1363 	 * 	Configurable global rate limit.
1364 	 *
1365 	 *	ratelimit defines tokens/packet consumed for dst->rate_token
1366 	 *	bucket ratemask defines which icmp types are ratelimited by
1367 	 *	setting	it's bit position.
1368 	 *
1369 	 *	default:
1370 	 *	dest unreachable (3), source quench (4),
1371 	 *	time exceeded (11), parameter problem (12)
1372 	 */
1373 
1374 	net->ipv4.sysctl_icmp_ratelimit = 1 * HZ;
1375 	net->ipv4.sysctl_icmp_ratemask = 0x1818;
1376 	net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;
1377 
1378 	return 0;
1379 
1380 fail:
1381 	icmp_sk_exit(net);
1382 	return err;
1383 }
1384 
1385 static struct pernet_operations __net_initdata icmp_sk_ops = {
1386        .init = icmp_sk_init,
1387        .exit = icmp_sk_exit,
1388 };
1389 
icmp_init(void)1390 int __init icmp_init(void)
1391 {
1392 	return register_pernet_subsys(&icmp_sk_ops);
1393 }
1394