X-Git-Url: https://git.distorted.org.uk/~mdw/secnet/blobdiff_plain/55bc97e626e0f31e04b190528b25c6e026942610..f928f0694ff6b90d5fc429cfe910eaba9fdd3fd0:/netlink.c diff --git a/netlink.c b/netlink.c index 6384c02..97e1af9 100644 --- a/netlink.c +++ b/netlink.c @@ -120,7 +120,7 @@ their use. #define ICMP_CODE_TTL_EXCEEDED 0 /* Generic IP checksum routine */ -static inline uint16_t ip_csum(uint8_t *iph,int32_t count) +static inline uint16_t ip_csum(const uint8_t *iph,int32_t count) { register uint32_t sum=0; @@ -144,7 +144,7 @@ static inline uint16_t ip_csum(uint8_t *iph,int32_t count) * By Jorge Cwik , adapted for linux by * Arnt Gulbrandsen. */ -static inline uint16_t ip_fast_csum(uint8_t *iph, int32_t ihl) { +static inline uint16_t ip_fast_csum(const uint8_t *iph, int32_t ihl) { uint32_t sum; __asm__ __volatile__( @@ -192,7 +192,11 @@ struct iphdr { uint8_t tos; uint16_t tot_len; uint16_t id; - uint16_t frag_off; + uint16_t frag; +#define IPHDR_FRAG_OFF ((uint16_t)0x1fff) +#define IPHDR_FRAG_MORE ((uint16_t)0x2000) +#define IPHDR_FRAG_DONT ((uint16_t)0x4000) +/* reserved 0x8000 */ uint8_t ttl; uint8_t protocol; uint16_t check; @@ -206,7 +210,7 @@ struct icmphdr { uint8_t type; uint8_t code; uint16_t check; - union { + union icmpinfofield { uint32_t unused; struct { uint8_t pointer; @@ -220,6 +224,8 @@ struct icmphdr { } echo; } d; }; + +static const union icmpinfofield icmp_noinfo; static void netlink_packet_deliver(struct netlink *st, struct netlink_client *client, @@ -246,7 +252,7 @@ static struct icmphdr *netlink_icmp_tmpl(struct netlink *st, h->iph.tos=0; h->iph.tot_len=htons(len+(h->iph.ihl*4)+8); h->iph.id=0; - h->iph.frag_off=0; + h->iph.frag=0; h->iph.ttl=255; /* XXX should be configurable */ h->iph.protocol=1; h->iph.saddr=htonl(st->secnet_address); @@ -298,14 +304,22 @@ static bool_t netlink_icmp_may_reply(struct buffer_if *buf) icmph=(struct icmphdr *)buf->start; if (iph->protocol==1) { switch(icmph->type) { - case 3: /* Destination unreachable */ - case 11: /* Time Exceeded */ - case 12: /* Parameter Problem */ + /* Based on http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-types + * as retrieved Thu, 20 Mar 2014 00:16:44 +0000. + * Deprecated, reserved, unassigned and experimental + * options are treated as not safe to reply to. + */ + case 0: /* Echo Reply */ + case 8: /* Echo */ + case 13: /* Timestamp */ + case 14: /* Timestamp Reply */ + return True; + default: return False; } } /* How do we spot broadcast destination addresses? */ - if (ntohs(iph->frag_off)&0x1fff) return False; /* Non-initial fragment */ + if (ntohs(iph->frag)&IPHDR_FRAG_OFF) return False; source=ntohl(iph->saddr); if (source==0) return False; if ((source&0xff000000)==0x7f000000) return False; @@ -353,8 +367,8 @@ static uint16_t netlink_icmp_reply_len(struct buffer_if *buf) /* client indicates where the packet we're constructing a response to comes from. NULL indicates the host. */ static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf, - struct netlink_client *client, - uint8_t type, uint8_t code) + uint8_t type, uint8_t code, + union icmpinfofield info) { struct icmphdr *h; uint16_t len; @@ -363,7 +377,7 @@ static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf, struct iphdr *iph=(struct iphdr *)buf->start; len=netlink_icmp_reply_len(buf); h=netlink_icmp_tmpl(st,ntohl(iph->saddr),len); - h->type=type; h->code=code; + h->type=type; h->code=code; h->d=info; memcpy(buf_append(&st->icmp,len),buf->start,len); netlink_icmp_csum(h); netlink_packet_deliver(st,NULL,&st->icmp); @@ -431,6 +445,16 @@ static void netlink_client_deliver(struct netlink *st, client->outcount++; } +/* Deliver a packet to the host; used after we have decided that that + * is what to do with it. */ +static void netlink_host_deliver(struct netlink *st, + uint32_t source, uint32_t dest, + struct buffer_if *buf) +{ + st->deliver_to_host(st->dst,buf); + st->outcount++; +} + /* Deliver a packet. "client" is the _origin_ of the packet, not its destination, and is NULL for packets from the host and packets generated internally in secnet. */ @@ -510,8 +534,7 @@ static void netlink_packet_deliver(struct netlink *st, /* The packet's not going down a tunnel. It might (ought to) be for the host. */ if (ipset_contains_addr(st->networks,dest)) { - st->deliver_to_host(st->dst,buf); - st->outcount++; + netlink_host_deliver(st,source,dest,buf); BUF_ASSERT_FREE(buf); } else { string_t s,d; @@ -520,8 +543,8 @@ static void netlink_packet_deliver(struct netlink *st, Message(M_DEBUG,"%s: don't know where to deliver packet " "(s=%s, d=%s)\n", st->name, s, d); free(s); free(d); - netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE, - ICMP_CODE_NET_UNREACHABLE); + netlink_icmp_simple(st,buf,ICMP_TYPE_UNREACHABLE, + ICMP_CODE_NET_UNREACHABLE, icmp_noinfo); BUF_FREE(buf); } } else { @@ -537,8 +560,8 @@ static void netlink_packet_deliver(struct netlink *st, st->name,s,d); free(s); free(d); - netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE, - ICMP_CODE_NET_PROHIBITED); + netlink_icmp_simple(st,buf,ICMP_TYPE_UNREACHABLE, + ICMP_CODE_NET_PROHIBITED, icmp_noinfo); BUF_FREE(buf); } else { if (best_quality>0) { @@ -548,8 +571,10 @@ static void netlink_packet_deliver(struct netlink *st, BUF_ASSERT_FREE(buf); } else { /* Generate ICMP destination unreachable */ - netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE, - ICMP_CODE_NET_UNREACHABLE); /* client==NULL */ + netlink_icmp_simple(st,buf, + ICMP_TYPE_UNREACHABLE, + ICMP_CODE_NET_UNREACHABLE, + icmp_noinfo); BUF_FREE(buf); } } @@ -569,8 +594,8 @@ static void netlink_packet_forward(struct netlink *st, /* Packet has already been checked */ if (iph->ttl<=1) { /* Generate ICMP time exceeded */ - netlink_icmp_simple(st,buf,client,ICMP_TYPE_TIME_EXCEEDED, - ICMP_CODE_TTL_EXCEEDED); + netlink_icmp_simple(st,buf,ICMP_TYPE_TIME_EXCEEDED, + ICMP_CODE_TTL_EXCEEDED,icmp_noinfo); BUF_FREE(buf); return; } @@ -599,7 +624,7 @@ static void netlink_packet_local(struct netlink *st, } h=(struct icmphdr *)buf->start; - if ((ntohs(h->iph.frag_off)&0xbfff)!=0) { + if ((ntohs(h->iph.frag)&(IPHDR_FRAG_OFF|IPHDR_FRAG_MORE))!=0) { Message(M_WARNING,"%s: fragmented packet addressed to secnet; " "ignoring it\n",st->name); BUF_FREE(buf); @@ -624,8 +649,8 @@ static void netlink_packet_local(struct netlink *st, Message(M_WARNING,"%s: unknown incoming ICMP\n",st->name); } else { /* Send ICMP protocol unreachable */ - netlink_icmp_simple(st,buf,client,ICMP_TYPE_UNREACHABLE, - ICMP_CODE_PROTOCOL_UNREACHABLE); + netlink_icmp_simple(st,buf,ICMP_TYPE_UNREACHABLE, + ICMP_CODE_PROTOCOL_UNREACHABLE,icmp_noinfo); BUF_FREE(buf); return; } @@ -697,7 +722,7 @@ static void netlink_incoming(struct netlink *st, struct netlink_client *client, address validity and generate ICMP, etc. */ if (st->ptp) { if (client) { - st->deliver_to_host(st->dst,buf); + netlink_host_deliver(st,source,dest,buf); } else { netlink_client_deliver(st,st->clients,source,dest,buf); } @@ -765,7 +790,7 @@ static void netlink_dump_routes(struct netlink *st, bool_t requested) if (requested) c=M_WARNING; if (st->ptp) { net=ipaddr_to_string(st->secnet_address); - Message(c,"%s: point-to-point (remote end is %s); routes:\n", + Message(c,"%s: point-to-point (remote end is %s); routes: ", st->name, net); free(net); netlink_output_subnets(st,c,st->clients->subnets);