ip_icmp.c@ 91623

Last change on this file since 91623 was 85082, checked in by vboxsync, 4 years ago
icmp_input: don't keep a mbuf reference after we pass it to a function that consumes it.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 23.5 KB

Line
1	/* $Id: ip_icmp.c 85082 2020-07-07 14:04:23Z vboxsync $ */
2	/** @file
3	* NAT - IP/ICMP handling.
4	*/
5
6	/*
7	* Copyright (C) 2006-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*
19	* This code is based on:
20	*
21	* Copyright (c) 1982, 1986, 1988, 1993
22	* The Regents of the University of California. All rights reserved.
23	*
24	* Redistribution and use in source and binary forms, with or without
25	* modification, are permitted provided that the following conditions
26	* are met:
27	* 1. Redistributions of source code must retain the above copyright
28	* notice, this list of conditions and the following disclaimer.
29	* 2. Redistributions in binary form must reproduce the above copyright
30	* notice, this list of conditions and the following disclaimer in the
31	* documentation and/or other materials provided with the distribution.
32	* 3. All advertising materials mentioning features or use of this software
33	* must display the following acknowledgement:
34	* This product includes software developed by the University of
35	* California, Berkeley and its contributors.
36	* 4. Neither the name of the University nor the names of its contributors
37	* may be used to endorse or promote products derived from this software
38	* without specific prior written permission.
39	*
40	* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
41	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43	* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
44	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50	* SUCH DAMAGE.
51	*
52	* @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
53	* ip_icmp.c,v 1.7 1995/05/30 08:09:42 rgrimes Exp
54	*/
55
56	#include "slirp.h"
57	#include "ip_icmp.h"
58
59	#ifdef VBOX_RAWSOCK_DEBUG_HELPER
60	int getrawsock(int type);
61	#endif
62
63
64	/* The message sent when emulating PING */
65	/* Be nice and tell them it's just a psuedo-ping packet */
66	#if 0 /* unused */
67	static const char icmp_ping_msg[] = "This is a psuedo-PING packet used by Slirp to emulate ICMP ECHO-REQUEST packets.\n";
68	#endif
69
70	/* list of actions for icmp_error() on RX of an icmp message */
71	static const int icmp_flush[19] =
72	{
73	/* ECHO REPLY (0) */ 0,
74	1,
75	1,
76	/* DEST UNREACH (3) */ 1,
77	/* SOURCE QUENCH (4)*/ 1,
78	/* REDIRECT (5) */ 1,
79	1,
80	1,
81	/* ECHO (8) */ 0,
82	/* ROUTERADVERT (9) */ 1,
83	/* ROUTERSOLICIT (10) */ 1,
84	/* TIME EXCEEDED (11) */ 1,
85	/* PARAMETER PROBLEM (12) */ 1,
86	/* TIMESTAMP (13) */ 0,
87	/* TIMESTAMP REPLY (14) */ 0,
88	/* INFO (15) */ 0,
89	/* INFO REPLY (16) */ 0,
90	/* ADDR MASK (17) */ 0,
91	/* ADDR MASK REPLY (18) */ 0
92	};
93
94
95	int
96	icmp_init(PNATState pData, int iIcmpCacheLimit)
97	{
98	pData->icmp_socket.so_type = IPPROTO_ICMP;
99	pData->icmp_socket.so_state = SS_ISFCONNECTED;
100
101	#ifndef RT_OS_WINDOWS
102	TAILQ_INIT(&pData->icmp_msg_head);
103
104	if (iIcmpCacheLimit < 0)
105	{
106	LogRel(("NAT: iIcmpCacheLimit is invalid %d, will be alter to default value 100\n", iIcmpCacheLimit));
107	iIcmpCacheLimit = 100;
108	}
109	pData->iIcmpCacheLimit = iIcmpCacheLimit;
110	# ifndef RT_OS_DARWIN
111	pData->icmp_socket.s = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP);
112	# else /* !RT_OS_DARWIN */
113	pData->icmp_socket.s = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
114	# endif /* RT_OS_DARWIN */
115	if (pData->icmp_socket.s == -1)
116	{
117	int rc = RTErrConvertFromErrno(errno);
118	# if defined(RT_OS_DARWIN) \|\| !defined(VBOX_RAWSOCK_DEBUG_HELPER)
119	LogRel(("NAT: ICMP/ping not available (could not open ICMP socket, error %Rrc)\n", rc));
120	return 1;
121	# else
122	/* try to get it from privileged helper */
123	LogRel(("NAT: ICMP/ping raw socket error %Rrc, asking helper...\n", rc));
124	pData->icmp_socket.s = getrawsock(AF_INET);
125	if (pData->icmp_socket.s == -1)
126	{
127	LogRel(("NAT: ICMP/ping not available\n"));
128	return 1;
129	}
130	# endif /* !RT_OS_DARWIN && VBOX_RAWSOCK_DEBUG_HELPER */
131	}
132	fd_nonblock(pData->icmp_socket.s);
133	NSOCK_INC();
134
135	#else /* RT_OS_WINDOWS */
136	RT_NOREF(iIcmpCacheLimit);
137
138	if (icmpwin_init(pData) != 0)
139	return 1;
140	#endif /* RT_OS_WINDOWS */
141
142	return 0;
143	}
144
145	/**
146	* Cleans ICMP cache.
147	*/
148	void
149	icmp_finit(PNATState pData)
150	{
151	#ifdef RT_OS_WINDOWS
152	icmpwin_finit(pData);
153	#else
154	while (!TAILQ_EMPTY(&pData->icmp_msg_head))
155	{
156	struct icmp_msg *icm = TAILQ_FIRST(&pData->icmp_msg_head);
157	icmp_msg_delete(pData, icm);
158	}
159	closesocket(pData->icmp_socket.s);
160	#endif
161	}
162
163
164	#if !defined(RT_OS_WINDOWS)
165	static struct icmp_msg *
166	icmp_msg_alloc(PNATState pData)
167	{
168	struct icmp_msg *icm;
169
170	#ifdef DEBUG
171	{
172	int iTally = 0;
173	TAILQ_FOREACH(icm, &pData->icmp_msg_head, im_queue)
174	++iTally;
175	Assert(pData->cIcmpCacheSize == iTally);
176	}
177	#endif
178
179	if (pData->cIcmpCacheSize >= pData->iIcmpCacheLimit)
180	{
181	int cTargetCacheSize = pData->iIcmpCacheLimit/2;
182
183	while (pData->cIcmpCacheSize > cTargetCacheSize)
184	{
185	icm = TAILQ_FIRST(&pData->icmp_msg_head);
186	icmp_msg_delete(pData, icm);
187	}
188	}
189
190	icm = RTMemAlloc(sizeof(struct icmp_msg));
191	if (RT_UNLIKELY(icm == NULL))
192	return NULL;
193
194	TAILQ_INSERT_TAIL(&pData->icmp_msg_head, icm, im_queue);
195	pData->cIcmpCacheSize++;
196
197	return icm;
198	}
199
200
201	static void
202	icmp_attach(PNATState pData, struct mbuf *m)
203	{
204	struct icmp_msg *icm;
205
206	#ifdef DEBUG
207	{
208	/* only used for ping */
209	struct ip ip = mtod(m, struct ip );
210	Assert(ip->ip_p == IPPROTO_ICMP);
211	}
212	#endif
213
214	icm = icmp_msg_alloc(pData);
215	if (RT_UNLIKELY(icm == NULL))
216	return;
217
218	icm->im_so = &pData->icmp_socket;
219	icm->im_m = m;
220	}
221
222
223	void
224	icmp_msg_delete(PNATState pData, struct icmp_msg *icm)
225	{
226	if (RT_UNLIKELY(icm == NULL))
227	return;
228
229	#ifdef DEBUG
230	{
231	struct icmp_msg *existing;
232	int iTally = 0;
233
234	TAILQ_FOREACH(existing, &pData->icmp_msg_head, im_queue)
235	++iTally;
236	Assert(pData->cIcmpCacheSize == iTally);
237
238	Assert(pData->cIcmpCacheSize > 0);
239	TAILQ_FOREACH(existing, &pData->icmp_msg_head, im_queue)
240	{
241	if (existing == icm)
242	break;
243	}
244	Assert(existing != NULL);
245	}
246	#endif
247
248	TAILQ_REMOVE(&pData->icmp_msg_head, icm, im_queue);
249	pData->cIcmpCacheSize--;
250
251	icm->im_so->so_m = NULL;
252	if (icm->im_m != NULL)
253	m_freem(pData, icm->im_m);
254
255	RTMemFree(icm);
256	}
257
258
259	/*
260	* ip here is ip header + 64bytes readed from ICMP packet
261	*/
262	struct icmp_msg *
263	icmp_find_original_mbuf(PNATState pData, struct ip *ip)
264	{
265	struct mbuf *m0;
266	struct ip *ip0;
267	struct icmp icp, icp0;
268	struct icmp_msg *icm = NULL;
269	int found = 0;
270	struct udphdr *udp;
271	struct tcphdr *tcp;
272	struct socket *head_socket = NULL;
273	struct socket *last_socket = NULL;
274	struct socket *so = NULL;
275	struct in_addr faddr;
276	u_short lport, fport;
277
278	faddr.s_addr = ~0;
279
280	lport = ~0;
281	fport = ~0;
282
283
284	LogFlowFunc(("ENTER: ip->ip_p:%d\n", ip->ip_p));
285	switch (ip->ip_p)
286	{
287	case IPPROTO_ICMP:
288	icp = (struct icmp )((char )ip + (ip->ip_hl << 2));
289	TAILQ_FOREACH(icm, &pData->icmp_msg_head, im_queue)
290	{
291	m0 = icm->im_m;
292	ip0 = mtod(m0, struct ip *);
293	if (ip0->ip_p != IPPROTO_ICMP)
294	{
295	/* try next item */
296	continue;
297	}
298	icp0 = (struct icmp )((char )ip0 + (ip0->ip_hl << 2));
299	/*
300	* IP could pointer to ICMP_REPLY datagram (1)
301	* or pointer IP header in ICMP payload in case of
302	* ICMP_TIMXCEED or ICMP_UNREACH (2)
303	*
304	* if (1) and then ICMP (type should be ICMP_ECHOREPLY) and we need check that
305	* IP.IP_SRC == IP0.IP_DST received datagramm comes from destination.
306	*
307	* if (2) then check that payload ICMP has got type ICMP_ECHO and
308	* IP.IP_DST == IP0.IP_DST destination of returned datagram is the same as
309	* one was sent.
310	*/
311	if ( ( (icp->icmp_type != ICMP_ECHO && ip->ip_src.s_addr == ip0->ip_dst.s_addr)
312	\|\| (icp->icmp_type == ICMP_ECHO && ip->ip_dst.s_addr == ip0->ip_dst.s_addr))
313	&& icp->icmp_id == icp0->icmp_id
314	&& icp->icmp_seq == icp0->icmp_seq)
315	{
316	found = 1;
317	Log(("Have found %R[natsock]\n", icm->im_so));
318	break;
319	}
320	Log(("Have found nothing\n"));
321	}
322	break;
323
324	/*
325	* for TCP and UDP logic little bit reverted, we try to find the HOST socket
326	* from which the IP package has been sent.
327	*/
328	case IPPROTO_UDP:
329	head_socket = &udb;
330	udp = (struct udphdr )((char )ip + (ip->ip_hl << 2));
331	faddr.s_addr = ip->ip_dst.s_addr;
332	fport = udp->uh_dport;
333	lport = udp->uh_sport;
334	last_socket = udp_last_so;
335	RT_FALL_THRU();
336
337	case IPPROTO_TCP:
338	if (head_socket == NULL)
339	{
340	tcp = (struct tcphdr )((char )ip + (ip->ip_hl << 2));
341	head_socket = &tcb; /* head_socket could be initialized with udb*/
342	faddr.s_addr = ip->ip_dst.s_addr;
343	fport = tcp->th_dport;
344	lport = tcp->th_sport;
345	last_socket = tcp_last_so;
346	}
347	/* check last socket first */
348	if ( last_socket->so_faddr.s_addr == faddr.s_addr
349	&& last_socket->so_fport == fport
350	&& last_socket->so_hlport == lport)
351	{
352	found = 1;
353	so = last_socket;
354	break;
355	}
356	for (so = head_socket->so_prev; so != head_socket; so = so->so_prev)
357	{
358	/* Should be replaced by hash here */
359	Log(("trying:%R[natsock] against %RTnaipv4:%d lport=%d hlport=%d\n",
360	so, faddr.s_addr, ntohs(fport), ntohs(lport), ntohs(so->so_hlport)));
361	if ( so->so_faddr.s_addr == faddr.s_addr
362	&& so->so_fport == fport
363	&& so->so_hlport == lport)
364	{
365	found = 1;
366	break;
367	}
368	}
369	break;
370
371	default:
372	Log(("NAT:ICMP: unsupported protocol(%d)\n", ip->ip_p));
373	}
374
375	#ifdef DEBUG
376	if (found)
377	Assert((icm != NULL) ^ (so != NULL));
378	#endif
379
380	if (found && icm == NULL)
381	{
382	/*
383	* XXX: Implies this is not a pong, found socket. This is, of
384	* course, wasteful since the caller will delete icmp_msg
385	* immediately after processing, so there's not much reason to
386	* clutter up the queue with it.
387	*/
388	AssertReturn(so != NULL, NULL);
389
390	/*
391	* XXX: FIXME: If the very first send(2) fails, the socket is
392	* still in SS_NOFDREF and so we will not report this too.
393	*/
394	if (so->so_state == SS_NOFDREF)
395	{
396	/* socket is shutting down we've already sent ICMP on it. */
397	Log(("NAT:ICMP: disconnected %R[natsock]\n", so));
398	LogFlowFunc(("LEAVE: icm:NULL\n"));
399	return NULL;
400	}
401
402	if (so->so_m == NULL)
403	{
404	Log(("NAT:ICMP: no saved mbuf for %R[natsock]\n", so));
405	LogFlowFunc(("LEAVE: icm:NULL\n"));
406	return NULL;
407	}
408
409	icm = icmp_msg_alloc(pData);
410	if (RT_UNLIKELY(icm == NULL))
411	{
412	LogFlowFunc(("LEAVE: icm:NULL\n"));
413	return NULL;
414	}
415
416	Log(("NAT:ICMP: for %R[natsock]\n", so));
417	icm->im_so = so;
418	icm->im_m = so->so_m;
419	}
420	LogFlowFunc(("LEAVE: icm:%p\n", icm));
421	return icm;
422	}
423	#endif /* !RT_OS_WINDOWS */
424
425
426	/*
427	* Process a received ICMP message.
428	*/
429	void
430	icmp_input(PNATState pData, struct mbuf *m, int hlen)
431	{
432	register struct ip ip = mtod(m, struct ip );
433	int icmplen = ip->ip_len;
434	uint8_t icmp_type;
435	void *icp_buf = NULL;
436	uint32_t dst;
437
438	/* int code; */
439
440	LogFlowFunc(("ENTER: m = %p, m_len = %d\n", m, m ? m->m_len : 0));
441
442	icmpstat.icps_received++;
443
444	/*
445	* Locate icmp structure in mbuf, and check
446	* that its not corrupted and of at least minimum length.
447	*/
448	if (icmplen < ICMP_MINLEN)
449	{
450	/* min 8 bytes payload */
451	icmpstat.icps_tooshort++;
452	goto end_error_free_m;
453	}
454
455	m->m_len -= hlen;
456	m->m_data += hlen;
457
458	if (cksum(m, icmplen))
459	{
460	icmpstat.icps_checksum++;
461	goto end_error_free_m;
462	}
463
464	/* are we guaranteed to have ICMP header in first mbuf? be safe. */
465	m_copydata(m, 0, sizeof(icmp_type), (caddr_t)&icmp_type);
466
467	m->m_len += hlen;
468	m->m_data -= hlen;
469
470	/* icmpstat.icps_inhist[icp->icmp_type]++; */
471	/* code = icp->icmp_code; */
472
473	LogFlow(("icmp_type = %d\n", icmp_type));
474	switch (icmp_type)
475	{
476	case ICMP_ECHO:
477	ip->ip_len += hlen; /* since ip_input subtracts this */
478	dst = ip->ip_dst.s_addr;
479	if ( CTL_CHECK(dst, CTL_ALIAS)
480	\|\| CTL_CHECK(dst, CTL_DNS)
481	\|\| CTL_CHECK(dst, CTL_TFTP))
482	{
483	uint8_t echo_reply = ICMP_ECHOREPLY;
484	m_copyback(pData, m, hlen + RT_OFFSETOF(struct icmp, icmp_type),
485	sizeof(echo_reply), (caddr_t)&echo_reply);
486	ip->ip_dst.s_addr = ip->ip_src.s_addr;
487	ip->ip_src.s_addr = dst;
488	icmp_reflect(pData, m);
489	m = NULL; /* m was consumed and freed */
490	goto done;
491	}
492
493	#ifdef RT_OS_WINDOWS
494	{
495	icmpwin_ping(pData, m, hlen);
496	break; /* free mbuf */
497	}
498	#else
499	{
500	struct icmp *icp;
501	struct sockaddr_in addr;
502
503	/* XXX: FIXME: this is bogus, see CTL_CHECKs above */
504	addr.sin_family = AF_INET;
505	if ((ip->ip_dst.s_addr & RT_H2N_U32(pData->netmask)) == pData->special_addr.s_addr)
506	{
507	/* It's an alias */
508	switch (RT_N2H_U32(ip->ip_dst.s_addr) & ~pData->netmask)
509	{
510	case CTL_DNS:
511	case CTL_ALIAS:
512	default:
513	addr.sin_addr = loopback_addr;
514	break;
515	}
516	}
517	else
518	addr.sin_addr.s_addr = ip->ip_dst.s_addr;
519
520	if (m->m_next)
521	{
522	icp_buf = RTMemAlloc(icmplen);
523	if (!icp_buf)
524	{
525	Log(("NAT: not enought memory to allocate the buffer\n"));
526	goto end_error_free_m;
527	}
528	m_copydata(m, hlen, icmplen, icp_buf);
529	icp = (struct icmp *)icp_buf;
530	}
531	else
532	icp = (struct icmp )(mtod(m, char ) + hlen);
533
534	if (pData->icmp_socket.s != -1)
535	{
536	static bool fIcmpSocketErrorReported;
537	int ttl;
538	int status;
539	ssize_t rc;
540
541	ttl = ip->ip_ttl;
542	Log(("NAT/ICMP: try to set TTL(%d)\n", ttl));
543	status = setsockopt(pData->icmp_socket.s, IPPROTO_IP, IP_TTL,
544	(void *)&ttl, sizeof(ttl));
545	if (status < 0)
546	Log(("NAT: Error (%s) occurred while setting TTL attribute of IP packet\n",
547	strerror(errno)));
548	rc = sendto(pData->icmp_socket.s, icp, icmplen, 0,
549	(struct sockaddr *)&addr, sizeof(addr));
550	if (rc >= 0)
551	{
552	icmp_attach(pData, m);
553	m = NULL; /* m was stashed away for safekeeping */
554	goto done;
555	}
556
557
558	if (!fIcmpSocketErrorReported)
559	{
560	LogRel(("NAT: icmp_input udp sendto tx errno = %d (%s)\n",
561	errno, strerror(errno)));
562	fIcmpSocketErrorReported = true;
563	}
564	icmp_error(pData, m, ICMP_UNREACH, ICMP_UNREACH_NET, 0, strerror(errno));
565	m = NULL; /* m was consumed and freed */
566	goto done;
567	}
568	}
569	#endif /* !RT_OS_WINDOWS */
570	break;
571	case ICMP_UNREACH:
572	case ICMP_TIMXCEED:
573	/* @todo(vvl): both up cases comes from guest,
574	* indeed right solution would be find the socket
575	* corresponding to ICMP data and close it.
576	*/
577	case ICMP_PARAMPROB:
578	case ICMP_SOURCEQUENCH:
579	case ICMP_TSTAMP:
580	case ICMP_MASKREQ:
581	case ICMP_REDIRECT:
582	icmpstat.icps_notsupp++;
583	break;
584
585	default:
586	icmpstat.icps_badtype++;
587	} /* switch */
588
589	end_error_free_m:
590	if (m != NULL)
591	m_freem(pData, m);
592
593	done:
594	if (icp_buf)
595	RTMemFree(icp_buf);
596	}
597
598
599	/**
600	* Send an ICMP message in response to a situation
601	*
602	* RFC 1122: 3.2.2 MUST send at least the IP header and 8 bytes of header. MAY send more (we do).
603	* MUST NOT change this header information.
604	* MUST NOT reply to a multicast/broadcast IP address.
605	* MUST NOT reply to a multicast/broadcast MAC address.
606	* MUST reply to only the first fragment.
607	*
608	* Send ICMP_UNREACH back to the source regarding msrc.
609	* It is reported as the bad ip packet. The header should
610	* be fully correct and in host byte order.
611	* ICMP fragmentation is illegal.
612	*
613	* @note: implementation note: MSIZE is 256 bytes (minimal buffer).
614	* We always truncate original payload to 8 bytes required by the RFC,
615	* so the largest possible datagram is 14 (ethernet) + 20 (ip) +
616	* 8 (icmp) + 60 (max original ip with options) + 8 (original payload)
617	* = 110 bytes which fits into sinlge mbuf.
618	*
619	* @note This function will free msrc!
620	*/
621
622	void icmp_error(PNATState pData, struct mbuf msrc, u_char type, u_char code, int minsize, const char message)
623	{
624	unsigned ohlen, olen;
625	struct mbuf *m;
626	struct ip oip, ip;
627	struct icmp *icp;
628	void *payload;
629	RT_NOREF(minsize);
630
631	LogFlow(("icmp_error: msrc = %p, msrc_len = %d\n",
632	(void *)msrc, msrc ? msrc->m_len : 0));
633
634	if (RT_UNLIKELY(msrc == NULL))
635	goto end_error;
636
637	M_ASSERTPKTHDR(msrc);
638
639	if ( type != ICMP_UNREACH
640	&& type != ICMP_TIMXCEED
641	&& type != ICMP_SOURCEQUENCH)
642	goto end_error;
643
644	oip = mtod(msrc, struct ip *);
645	LogFunc(("msrc: %RTnaipv4 -> %RTnaipv4\n", oip->ip_src, oip->ip_dst));
646
647	if (oip->ip_src.s_addr == INADDR_ANY)
648	goto end_error;
649
650	if (oip->ip_off & IP_OFFMASK)
651	goto end_error; /* Only reply to fragment 0 */
652
653	ohlen = oip->ip_hl * 4;
654	AssertStmt(ohlen >= sizeof(struct ip), goto end_error);
655
656	olen = oip->ip_len;
657	AssertStmt(olen >= ohlen, goto end_error);
658
659	if (oip->ip_p == IPPROTO_ICMP)
660	{
661	struct icmp oicp = (struct icmp )((char *)oip + ohlen);
662	/*
663	* Assume any unknown ICMP type is an error. This isn't
664	* specified by the RFC, but think about it..
665	*/
666	if (oicp->icmp_type > ICMP_MAXTYPE \|\| icmp_flush[oicp->icmp_type])
667	goto end_error;
668	}
669
670	/* undo byte order conversions done in ip_input() */
671	HTONS(oip->ip_len);
672	HTONS(oip->ip_id);
673	HTONS(oip->ip_off);
674
675	m = m_gethdr(pData, M_NOWAIT, MT_HEADER);
676	if (RT_UNLIKELY(m == NULL))
677	goto end_error;
678
679	m->m_flags \|= M_SKIP_FIREWALL;
680	m->m_data += if_maxlinkhdr;
681
682	ip = mtod(m, struct ip *);
683	m->m_pkthdr.header = (void *)ip;
684
685	/* fill in ip (ip_output0() does the boilerplate for us) */
686	ip->ip_tos = ((oip->ip_tos & 0x1E) \| 0xC0); /* high priority for errors */
687	/* ip->ip_len will be set later */
688	ip->ip_off = 0;
689	ip->ip_ttl = MAXTTL;
690	ip->ip_p = IPPROTO_ICMP;
691	ip->ip_src = alias_addr;
692	ip->ip_dst = oip->ip_src;
693
694	/* fill in icmp */
695	icp = (struct icmp )((char )ip + sizeof(*ip));
696	icp->icmp_type = type;
697	icp->icmp_code = code;
698	icp->icmp_id = 0;
699	icp->icmp_seq = 0;
700
701	/* fill in icmp payload: original ip header plus 8 bytes of its payload */
702	if (olen > ohlen + 8)
703	olen = ohlen + 8;
704	payload = (void )((char )icp + ICMP_MINLEN);
705	memcpy(payload, oip, olen);
706
707	/*
708	* Original code appended this message after the payload. This
709	* might have been a good idea for real slirp, as it provided a
710	* communication channel with the remote host. But 90s are over.
711	*/
712	NOREF(message);
713
714	/* hide ip header for icmp checksum calculation */
715	m->m_data += sizeof(struct ip);
716	m->m_len = ICMP_MINLEN + /* truncated */ olen;
717
718	icp->icmp_cksum = 0;
719	icp->icmp_cksum = cksum(m, m->m_len);
720
721	/* reveal ip header */
722	m->m_data -= sizeof(struct ip);
723	m->m_len += sizeof(struct ip);
724	ip->ip_len = m->m_len;
725
726	(void) ip_output0(pData, (struct socket *)NULL, m, 1);
727
728	icmpstat.icps_reflect++;
729
730	/* clear source datagramm in positive branch */
731	m_freem(pData, msrc);
732	LogFlowFuncLeave();
733	return;
734
735	end_error:
736
737	/*
738	* clear source datagramm in case if some of requirement haven't been met.
739	*/
740	if (msrc)
741	m_freem(pData, msrc);
742
743	{
744	static bool fIcmpErrorReported;
745	if (!fIcmpErrorReported)
746	{
747	LogRel(("NAT: Error occurred while sending ICMP error message\n"));
748	fIcmpErrorReported = true;
749	}
750	}
751	LogFlowFuncLeave();
752	}
753
754	/*
755	* Reflect the ip packet back to the source
756	* Note: m isn't duplicated by this method and more delivered to ip_output then.
757	*/
758	void
759	icmp_reflect(PNATState pData, struct mbuf *m)
760	{
761	register struct ip ip = mtod(m, struct ip );
762	int hlen = ip->ip_hl << 2;
763	register struct icmp *icp;
764	LogFlowFunc(("ENTER: m:%p\n", m));
765
766	/*
767	* Send an icmp packet back to the ip level,
768	* after supplying a checksum.
769	*/
770	m->m_data += hlen;
771	m->m_len -= hlen;
772	icp = mtod(m, struct icmp *);
773
774	icp->icmp_cksum = 0;
775	icp->icmp_cksum = cksum(m, ip->ip_len - hlen);
776
777	m->m_data -= hlen;
778	m->m_len += hlen;
779
780	(void) ip_output(pData, (struct socket *)NULL, m);
781
782	icmpstat.icps_reflect++;
783	LogFlowFuncLeave();
784	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Network/slirp/ip_icmp.c@ 91623

Download in other formats: