sys/netinet/ip_icmp.c

   1 /*      $NetBSD: ip_icmp.c,v 1.120 2008/06/18 09:06:28 yamt Exp $       */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 /*-
  33  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
  34  * All rights reserved.
  35  *
  36  * This code is derived from software contributed to The NetBSD Foundation
  37  * by Public Access Networks Corporation ("Panix").  It was developed under
  38  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
  39  *
  40  * This code is derived from software contributed to The NetBSD Foundation
  41  * by Jason R. Thorpe of Zembu Labs, Inc.
  42  *
  43  * Redistribution and use in source and binary forms, with or without
  44  * modification, are permitted provided that the following conditions
  45  * are met:
  46  * 1. Redistributions of source code must retain the above copyright
  47  *    notice, this list of conditions and the following disclaimer.
  48  * 2. Redistributions in binary form must reproduce the above copyright
  49  *    notice, this list of conditions and the following disclaimer in the
  50  *    documentation and/or other materials provided with the distribution.
  51  *
  52  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  53  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  54  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  55  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  56  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  57  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  58  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  59  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  60  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  61  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  62  * POSSIBILITY OF SUCH DAMAGE.
  63  */
  64
  65 /*
  66  * Copyright (c) 1982, 1986, 1988, 1993
  67  *      The Regents of the University of California.  All rights reserved.
  68  *
  69  * Redistribution and use in source and binary forms, with or without
  70  * modification, are permitted provided that the following conditions
  71  * are met:
  72  * 1. Redistributions of source code must retain the above copyright
  73  *    notice, this list of conditions and the following disclaimer.
  74  * 2. Redistributions in binary form must reproduce the above copyright
  75  *    notice, this list of conditions and the following disclaimer in the
  76  *    documentation and/or other materials provided with the distribution.
  77  * 3. Neither the name of the University nor the names of its contributors
  78  *    may be used to endorse or promote products derived from this software
  79  *    without specific prior written permission.
  80  *
  81  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  82  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  83  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  84  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  85  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  86  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  87  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  88  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  89  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  90  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  91  * SUCH DAMAGE.
  92  *
  93  *      @(#)ip_icmp.c   8.2 (Berkeley) 1/4/94
  94  */
  95
  96 #include <sys/cdefs.h>
  97 __KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.120 2008/06/18 09:06:28 yamt Exp $");
  98
  99 #include "opt_ipsec.h"
 100
 101 #include <sys/param.h>
 102 #include <sys/systm.h>
 103 #include <sys/malloc.h>
 104 #include <sys/mbuf.h>
 105 #include <sys/protosw.h>
 106 #include <sys/socket.h>
 107 #include <sys/time.h>
 108 #include <sys/kernel.h>
 109 #include <sys/syslog.h>
 110 #include <sys/sysctl.h>
 111
 112 #include <net/if.h>
 113 #include <net/route.h>
 114
 115 #include <netinet/in.h>
 116 #include <netinet/in_systm.h>
 117 #include <netinet/in_var.h>
 118 #include <netinet/ip.h>
 119 #include <netinet/ip_icmp.h>
 120 #include <netinet/ip_var.h>
 121 #include <netinet/in_pcb.h>
 122 #include <netinet/in_proto.h>
 123 #include <netinet/icmp_var.h>
 124 #include <netinet/icmp_private.h>
 125
 126 #ifdef IPSEC
 127 #include <netinet6/ipsec.h>
 128 #include <netkey/key.h>
 129 #endif
 130
 131 #ifdef FAST_IPSEC
 132 #include <netipsec/ipsec.h>
 133 #include <netipsec/key.h>
 134 #endif  /* FAST_IPSEC*/
 135
 136 #include <machine/stdarg.h>
 137
 138 /*
 139  * ICMP routines: error generation, receive packet processing, and
 140  * routines to turnaround packets back to the originator, and
 141  * host table maintenance routines.
 142  */
 143
 144 int     icmpmaskrepl = 0;
 145 #ifdef ICMPPRINTFS
 146 int     icmpprintfs = 0;
 147 #endif
 148 int     icmpreturndatabytes = 8;
 149
 150 percpu_t *icmpstat_percpu;
 151
 152 /*
 153  * List of callbacks to notify when Path MTU changes are made.
 154  */
 155 struct icmp_mtudisc_callback {
 156         LIST_ENTRY(icmp_mtudisc_callback) mc_list;
 157         void (*mc_func)(struct in_addr);
 158 };
 159
 160 LIST_HEAD(, icmp_mtudisc_callback) icmp_mtudisc_callbacks =
 161     LIST_HEAD_INITIALIZER(&icmp_mtudisc_callbacks);
 162
 163 #if 0
 164 static u_int    ip_next_mtu(u_int, int);
 165 #else
 166 /*static*/ u_int        ip_next_mtu(u_int, int);
 167 #endif
 168
 169 extern int icmperrppslim;
 170 static int icmperrpps_count = 0;
 171 static struct timeval icmperrppslim_last;
 172 static int icmp_rediraccept = 1;
 173 static int icmp_redirtimeout = 600;
 174 static struct rttimer_queue *icmp_redirect_timeout_q = NULL;
 175
 176 static void icmp_mtudisc_timeout(struct rtentry *, struct rttimer *);
 177 static void icmp_redirect_timeout(struct rtentry *, struct rttimer *);
 178
 179 static int icmp_ratelimit(const struct in_addr *, const int, const int);
 180
 181 static void sysctl_netinet_icmp_setup(struct sysctllog **);
 182
 183 void
 184 icmp_init(void)
 185 {
 186
 187         sysctl_netinet_icmp_setup(NULL);
 188
 189         /*
 190          * This is only useful if the user initializes redirtimeout to
 191          * something other than zero.
 192          */
 193         if (icmp_redirtimeout != 0) {
 194                 icmp_redirect_timeout_q =
 195                         rt_timer_queue_create(icmp_redirtimeout);
 196         }
 197
 198         icmpstat_percpu = percpu_alloc(sizeof(uint64_t) * ICMP_NSTATS);
 199 }
 200
 201 /*
 202  * Register a Path MTU Discovery callback.
 203  */
 204 void
 205 icmp_mtudisc_callback_register(void (*func)(struct in_addr))
 206 {
 207         struct icmp_mtudisc_callback *mc;
 208
 209         for (mc = LIST_FIRST(&icmp_mtudisc_callbacks); mc != NULL;
 210              mc = LIST_NEXT(mc, mc_list)) {
 211                 if (mc->mc_func == func)
 212                         return;
 213         }
 214
 215         mc = malloc(sizeof(*mc), M_PCB, M_NOWAIT);
 216         if (mc == NULL)
 217                 panic("icmp_mtudisc_callback_register");
 218
 219         mc->mc_func = func;
 220         LIST_INSERT_HEAD(&icmp_mtudisc_callbacks, mc, mc_list);
 221 }
 222
 223 /*
 224  * Generate an error packet of type error
 225  * in response to bad packet ip.
 226  */
 227 void
 228 icmp_error(struct mbuf *n, int type, int code, n_long dest,
 229     int destmtu)
 230 {
 231         struct ip *oip = mtod(n, struct ip *), *nip;
 232         unsigned oiplen = oip->ip_hl << 2;
 233         struct icmp *icp;
 234         struct mbuf *m;
 235         struct m_tag *mtag;
 236         unsigned icmplen, mblen;
 237
 238 #ifdef ICMPPRINTFS
 239         if (icmpprintfs)
 240                 printf("icmp_error(%p, type:%d, code:%d)\n", oip, type, code);
 241 #endif
 242         if (type != ICMP_REDIRECT)
 243                 ICMP_STATINC(ICMP_STAT_ERROR);
 244         /*
 245          * Don't send error if the original packet was encrypted.
 246          * Don't send error if not the first fragment of message.
 247          * Don't error if the old packet protocol was ICMP
 248          * error message, only known informational types.
 249          */
 250         if (n->m_flags & M_DECRYPTED)
 251                 goto freeit;
 252         if (oip->ip_off &~ htons(IP_MF|IP_DF))
 253                 goto freeit;
 254         if (oip->ip_p == IPPROTO_ICMP && type != ICMP_REDIRECT &&
 255           n->m_len >= oiplen + ICMP_MINLEN &&
 256           !ICMP_INFOTYPE(((struct icmp *)((char *)oip + oiplen))->icmp_type)) {
 257                 ICMP_STATINC(ICMP_STAT_OLDICMP);
 258                 goto freeit;
 259         }
 260         /* Don't send error in response to a multicast or broadcast packet */
 261         if (n->m_flags & (M_BCAST|M_MCAST))
 262                 goto freeit;
 263
 264         /*
 265          * First, do a rate limitation check.
 266          */
 267         if (icmp_ratelimit(&oip->ip_src, type, code)) {
 268                 /* XXX stat */
 269                 goto freeit;
 270         }
 271
 272         /*
 273          * Now, formulate icmp message
 274          */
 275         icmplen = oiplen + min(icmpreturndatabytes,
 276             ntohs(oip->ip_len) - oiplen);
 277         /*
 278          * Defend against mbuf chains shorter than oip->ip_len - oiplen:
 279          */
 280         mblen = 0;
 281         for (m = n; m && (mblen < icmplen); m = m->m_next)
 282                 mblen += m->m_len;
 283         icmplen = min(mblen, icmplen);
 284
 285         /*
 286          * As we are not required to return everything we have,
 287          * we return whatever we can return at ease.
 288          *
 289          * Note that ICMP datagrams longer than 576 octets are out of spec
 290          * according to RFC1812; the limit on icmpreturndatabytes below in
 291          * icmp_sysctl will keep things below that limit.
 292          */
 293
 294         KASSERT(ICMP_MINLEN <= MCLBYTES);
 295
 296         if (icmplen + ICMP_MINLEN > MCLBYTES)
 297                 icmplen = MCLBYTES - ICMP_MINLEN;
 298
 299         m = m_gethdr(M_DONTWAIT, MT_HEADER);
 300         if (m && (icmplen + ICMP_MINLEN > MHLEN)) {
 301                 MCLGET(m, M_DONTWAIT);
 302                 if ((m->m_flags & M_EXT) == 0) {
 303                         m_freem(m);
 304                         m = NULL;
 305                 }
 306         }
 307         if (m == NULL)
 308                 goto freeit;
 309         MCLAIM(m, n->m_owner);
 310         m->m_len = icmplen + ICMP_MINLEN;
 311         if ((m->m_flags & M_EXT) == 0)
 312                 MH_ALIGN(m, m->m_len);
 313         icp = mtod(m, struct icmp *);
 314         if ((u_int)type > ICMP_MAXTYPE)
 315                 panic("icmp_error");
 316         ICMP_STATINC(ICMP_STAT_OUTHIST + type);
 317         icp->icmp_type = type;
 318         if (type == ICMP_REDIRECT)
 319                 icp->icmp_gwaddr.s_addr = dest;
 320         else {
 321                 icp->icmp_void = 0;
 322                 /*
 323                  * The following assignments assume an overlay with the
 324                  * zeroed icmp_void field.
 325                  */
 326                 if (type == ICMP_PARAMPROB) {
 327                         icp->icmp_pptr = code;
 328                         code = 0;
 329                 } else if (type == ICMP_UNREACH &&
 330                     code == ICMP_UNREACH_NEEDFRAG && destmtu)
 331                         icp->icmp_nextmtu = htons(destmtu);
 332         }
 333
 334         icp->icmp_code = code;
 335         m_copydata(n, 0, icmplen, (void *)&icp->icmp_ip);
 336
 337         /*
 338          * Now, copy old ip header (without options)
 339          * in front of icmp message.
 340          */
 341         if (m->m_data - sizeof(struct ip) < m->m_pktdat)
 342                 panic("icmp len");
 343         m->m_data -= sizeof(struct ip);
 344         m->m_len += sizeof(struct ip);
 345         m->m_pkthdr.len = m->m_len;
 346         m->m_pkthdr.rcvif = n->m_pkthdr.rcvif;
 347         nip = mtod(m, struct ip *);
 348         /* ip_v set in ip_output */
 349         nip->ip_hl = sizeof(struct ip) >> 2;
 350         nip->ip_tos = 0;
 351         nip->ip_len = htons(m->m_len);
 352         /* ip_id set in ip_output */
 353         nip->ip_off = htons(0);
 354         /* ip_ttl set in icmp_reflect */
 355         nip->ip_p = IPPROTO_ICMP;
 356         nip->ip_src = oip->ip_src;
 357         nip->ip_dst = oip->ip_dst;
 358         /* move PF m_tag to new packet, if it exists */
 359         mtag = m_tag_find(n, PACKET_TAG_PF, NULL);
 360         if (mtag != NULL) {
 361                 m_tag_unlink(n, mtag);
 362                 m_tag_prepend(m, mtag);
 363         }
 364         icmp_reflect(m);
 365
 366 freeit:
 367         m_freem(n);
 368 }
 369
 370 struct sockaddr_in icmpsrc = {
 371         .sin_len = sizeof (struct sockaddr_in),
 372         .sin_family = AF_INET,
 373 };
 374 static struct sockaddr_in icmpdst = {
 375         .sin_len = sizeof (struct sockaddr_in),
 376         .sin_family = AF_INET,
 377 };
 378 static struct sockaddr_in icmpgw = {
 379         .sin_len = sizeof (struct sockaddr_in),
 380         .sin_family = AF_INET,
 381 };
 382 struct sockaddr_in icmpmask = {
 383         .sin_len = 8,
 384         .sin_family = 0,
 385 };
 386
 387 /*
 388  * Process a received ICMP message.
 389  */
 390 void
 391 icmp_input(struct mbuf *m, ...)
 392 {
 393         int proto;
 394         struct icmp *icp;
 395         struct ip *ip = mtod(m, struct ip *);
 396         int icmplen;
 397         int i;
 398         struct in_ifaddr *ia;
 399         void *(*ctlfunc)(int, const struct sockaddr *, void *);
 400         int code;
 401         int hlen;
 402         va_list ap;
 403         struct rtentry *rt;
 404
 405         va_start(ap, m);
 406         hlen = va_arg(ap, int);
 407         proto = va_arg(ap, int);
 408         va_end(ap);
 409
 410         /*
 411          * Locate icmp structure in mbuf, and check
 412          * that not corrupted and of at least minimum length.
 413          */
 414         icmplen = ntohs(ip->ip_len) - hlen;
 415 #ifdef ICMPPRINTFS
 416         if (icmpprintfs) {
 417                 printf("icmp_input from `%s' to ", inet_ntoa(ip->ip_src));
 418                 printf("`%s', len %d\n", inet_ntoa(ip->ip_dst), icmplen);
 419         }
 420 #endif
 421         if (icmplen < ICMP_MINLEN) {
 422                 ICMP_STATINC(ICMP_STAT_TOOSHORT);
 423                 goto freeit;
 424         }
 425         i = hlen + min(icmplen, ICMP_ADVLENMIN);
 426         if ((m->m_len < i || M_READONLY(m)) && (m = m_pullup(m, i)) == 0) {
 427                 ICMP_STATINC(ICMP_STAT_TOOSHORT);
 428                 return;
 429         }
 430         ip = mtod(m, struct ip *);
 431         m->m_len -= hlen;
 432         m->m_data += hlen;
 433         icp = mtod(m, struct icmp *);
 434         /* Don't need to assert alignment, here. */
 435         if (in_cksum(m, icmplen)) {
 436                 ICMP_STATINC(ICMP_STAT_CHECKSUM);
 437                 goto freeit;
 438         }
 439         m->m_len += hlen;
 440         m->m_data -= hlen;
 441
 442 #ifdef ICMPPRINTFS
 443         /*
 444          * Message type specific processing.
 445          */
 446         if (icmpprintfs)
 447                 printf("icmp_input(type:%d, code:%d)\n", icp->icmp_type,
 448                     icp->icmp_code);
 449 #endif
 450         if (icp->icmp_type > ICMP_MAXTYPE)
 451                 goto raw;
 452         ICMP_STATINC(ICMP_STAT_INHIST + icp->icmp_type);
 453         code = icp->icmp_code;
 454         switch (icp->icmp_type) {
 455
 456         case ICMP_UNREACH:
 457                 switch (code) {
 458                         case ICMP_UNREACH_NET:
 459                                 code = PRC_UNREACH_NET;
 460                                 break;
 461
 462                         case ICMP_UNREACH_HOST:
 463                                 code = PRC_UNREACH_HOST;
 464                                 break;
 465
 466                         case ICMP_UNREACH_PROTOCOL:
 467                                 code = PRC_UNREACH_PROTOCOL;
 468                                 break;
 469
 470                         case ICMP_UNREACH_PORT:
 471                                 code = PRC_UNREACH_PORT;
 472                                 break;
 473
 474                         case ICMP_UNREACH_SRCFAIL:
 475                                 code = PRC_UNREACH_SRCFAIL;
 476                                 break;
 477
 478                         case ICMP_UNREACH_NEEDFRAG:
 479                                 code = PRC_MSGSIZE;
 480                                 break;
 481
 482                         case ICMP_UNREACH_NET_UNKNOWN:
 483                         case ICMP_UNREACH_NET_PROHIB:
 484                         case ICMP_UNREACH_TOSNET:
 485                                 code = PRC_UNREACH_NET;
 486                                 break;
 487
 488                         case ICMP_UNREACH_HOST_UNKNOWN:
 489                         case ICMP_UNREACH_ISOLATED:
 490                         case ICMP_UNREACH_HOST_PROHIB:
 491                         case ICMP_UNREACH_TOSHOST:
 492                                 code = PRC_UNREACH_HOST;
 493                                 break;
 494
 495                         default:
 496                                 goto badcode;
 497                 }
 498                 goto deliver;
 499
 500         case ICMP_TIMXCEED:
 501                 if (code > 1)
 502                         goto badcode;
 503                 code += PRC_TIMXCEED_INTRANS;
 504                 goto deliver;
 505
 506         case ICMP_PARAMPROB:
 507                 if (code > 1)
 508                         goto badcode;
 509                 code = PRC_PARAMPROB;
 510                 goto deliver;
 511
 512         case ICMP_SOURCEQUENCH:
 513                 if (code)
 514                         goto badcode;
 515                 code = PRC_QUENCH;
 516                 goto deliver;
 517
 518         deliver:
 519                 /*
 520                  * Problem with datagram; advise higher level routines.
 521                  */
 522                 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
 523                     icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
 524                         ICMP_STATINC(ICMP_STAT_BADLEN);
 525                         goto freeit;
 526                 }
 527                 if (IN_MULTICAST(icp->icmp_ip.ip_dst.s_addr))
 528                         goto badcode;
 529 #ifdef ICMPPRINTFS
 530                 if (icmpprintfs)
 531                         printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
 532 #endif
 533                 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
 534                 ctlfunc = inetsw[ip_protox[icp->icmp_ip.ip_p]].pr_ctlinput;
 535                 if (ctlfunc)
 536                         (void) (*ctlfunc)(code, sintosa(&icmpsrc),
 537                             &icp->icmp_ip);
 538                 break;
 539
 540         badcode:
 541                 ICMP_STATINC(ICMP_STAT_BADCODE);
 542                 break;
 543
 544         case ICMP_ECHO:
 545                 icp->icmp_type = ICMP_ECHOREPLY;
 546                 goto reflect;
 547
 548         case ICMP_TSTAMP:
 549                 if (icmplen < ICMP_TSLEN) {
 550                         ICMP_STATINC(ICMP_STAT_BADLEN);
 551                         break;
 552                 }
 553                 icp->icmp_type = ICMP_TSTAMPREPLY;
 554                 icp->icmp_rtime = iptime();
 555                 icp->icmp_ttime = icp->icmp_rtime;      /* bogus, do later! */
 556                 goto reflect;
 557
 558         case ICMP_MASKREQ:
 559                 if (icmpmaskrepl == 0)
 560                         break;
 561                 /*
 562                  * We are not able to respond with all ones broadcast
 563                  * unless we receive it over a point-to-point interface.
 564                  */
 565                 if (icmplen < ICMP_MASKLEN) {
 566                         ICMP_STATINC(ICMP_STAT_BADLEN);
 567                         break;
 568                 }
 569                 if (ip->ip_dst.s_addr == INADDR_BROADCAST ||
 570                     in_nullhost(ip->ip_dst))
 571                         icmpdst.sin_addr = ip->ip_src;
 572                 else
 573                         icmpdst.sin_addr = ip->ip_dst;
 574                 ia = ifatoia(ifaof_ifpforaddr(sintosa(&icmpdst),
 575                     m->m_pkthdr.rcvif));
 576                 if (ia == 0)
 577                         break;
 578                 icp->icmp_type = ICMP_MASKREPLY;
 579                 icp->icmp_mask = ia->ia_sockmask.sin_addr.s_addr;
 580                 if (in_nullhost(ip->ip_src)) {
 581                         if (ia->ia_ifp->if_flags & IFF_BROADCAST)
 582                                 ip->ip_src = ia->ia_broadaddr.sin_addr;
 583                         else if (ia->ia_ifp->if_flags & IFF_POINTOPOINT)
 584                                 ip->ip_src = ia->ia_dstaddr.sin_addr;
 585                 }
 586 reflect:
 587                 {
 588                         uint64_t *icps = percpu_getref(icmpstat_percpu);
 589                         icps[ICMP_STAT_REFLECT]++;
 590                         icps[ICMP_STAT_OUTHIST + icp->icmp_type]++;
 591                         percpu_putref(icmpstat_percpu);
 592                 }
 593                 icmp_reflect(m);
 594                 return;
 595
 596         case ICMP_REDIRECT:
 597                 if (code > 3)
 598                         goto badcode;
 599                 if (icmp_rediraccept == 0)
 600                         goto freeit;
 601                 if (icmplen < ICMP_ADVLENMIN || icmplen < ICMP_ADVLEN(icp) ||
 602                     icp->icmp_ip.ip_hl < (sizeof(struct ip) >> 2)) {
 603                         ICMP_STATINC(ICMP_STAT_BADLEN);
 604                         break;
 605                 }
 606                 /*
 607                  * Short circuit routing redirects to force
 608                  * immediate change in the kernel's routing
 609                  * tables.  The message is also handed to anyone
 610                  * listening on a raw socket (e.g. the routing
 611                  * daemon for use in updating its tables).
 612                  */
 613                 icmpgw.sin_addr = ip->ip_src;
 614                 icmpdst.sin_addr = icp->icmp_gwaddr;
 615 #ifdef  ICMPPRINTFS
 616                 if (icmpprintfs) {
 617                         printf("redirect dst `%s' to `%s'\n",
 618                             inet_ntoa(icp->icmp_ip.ip_dst),
 619                             inet_ntoa(icp->icmp_gwaddr));
 620                 }
 621 #endif
 622                 icmpsrc.sin_addr = icp->icmp_ip.ip_dst;
 623                 rt = NULL;
 624                 rtredirect(sintosa(&icmpsrc), sintosa(&icmpdst),
 625                     NULL, RTF_GATEWAY | RTF_HOST, sintosa(&icmpgw), &rt);
 626                 if (rt != NULL && icmp_redirtimeout != 0) {
 627                         i = rt_timer_add(rt, icmp_redirect_timeout,
 628                                          icmp_redirect_timeout_q);
 629                         if (i)
 630                                 log(LOG_ERR, "ICMP:  redirect failed to "
 631                                     "register timeout for route to %x, "
 632                                     "code %d\n",
 633                                     icp->icmp_ip.ip_dst.s_addr, i);
 634                 }
 635                 if (rt != NULL)
 636                         rtfree(rt);
 637
 638                 pfctlinput(PRC_REDIRECT_HOST, sintosa(&icmpsrc));
 639 #if defined(IPSEC) || defined(FAST_IPSEC)
 640                 key_sa_routechange((struct sockaddr *)&icmpsrc);
 641 #endif
 642                 break;
 643
 644         /*
 645          * No kernel processing for the following;
 646          * just fall through to send to raw listener.
 647          */
 648         case ICMP_ECHOREPLY:
 649         case ICMP_ROUTERADVERT:
 650         case ICMP_ROUTERSOLICIT:
 651         case ICMP_TSTAMPREPLY:
 652         case ICMP_IREQREPLY:
 653         case ICMP_MASKREPLY:
 654         default:
 655                 break;
 656         }
 657
 658 raw:
 659         rip_input(m, hlen, proto);
 660         return;
 661
 662 freeit:
 663         m_freem(m);
 664         return;
 665 }
 666
 667 /*
 668  * Reflect the ip packet back to the source
 669  */
 670 void
 671 icmp_reflect(struct mbuf *m)
 672 {
 673         struct ip *ip = mtod(m, struct ip *);
 674         struct in_ifaddr *ia;
 675         struct ifaddr *ifa;
 676         struct sockaddr_in *sin = 0;
 677         struct in_addr t;
 678         struct mbuf *opts = 0;
 679         int optlen = (ip->ip_hl << 2) - sizeof(struct ip);
 680
 681         if (!in_canforward(ip->ip_src) &&
 682             ((ip->ip_src.s_addr & IN_CLASSA_NET) !=
 683              htonl(IN_LOOPBACKNET << IN_CLASSA_NSHIFT))) {
 684                 m_freem(m);     /* Bad return address */
 685                 goto done;      /* ip_output() will check for broadcast */
 686         }
 687         t = ip->ip_dst;
 688         ip->ip_dst = ip->ip_src;
 689         /*
 690          * If the incoming packet was addressed directly to us, use
 691          * dst as the src for the reply.  Otherwise (broadcast or
 692          * anonymous), use an address which corresponds to the
 693          * incoming interface, with a preference for the address which
 694          * corresponds to the route to the destination of the ICMP.
 695          */
 696
 697         /* Look for packet addressed to us */
 698         INADDR_TO_IA(t, ia);
 699
 700         /* look for packet sent to broadcast address */
 701         if (ia == NULL && m->m_pkthdr.rcvif &&
 702             (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST)) {
 703                 IFADDR_FOREACH(ifa, m->m_pkthdr.rcvif) {
 704                         if (ifa->ifa_addr->sa_family != AF_INET)
 705                                 continue;
 706                         if (in_hosteq(t,ifatoia(ifa)->ia_broadaddr.sin_addr)) {
 707                                 ia = ifatoia(ifa);
 708                                 break;
 709                         }
 710                 }
 711         }
 712
 713         if (ia)
 714                 sin = &ia->ia_addr;
 715
 716         icmpdst.sin_addr = t;
 717
 718         /*
 719          * if the packet is addressed somewhere else, compute the
 720          * source address for packets routed back to the source, and
 721          * use that, if it's an address on the interface which
 722          * received the packet
 723          */
 724         if (sin == NULL && m->m_pkthdr.rcvif) {
 725                 struct sockaddr_in sin_dst;
 726                 struct route icmproute;
 727                 int errornum;
 728
 729                 sockaddr_in_init(&sin_dst, &ip->ip_dst, 0);
 730                 memset(&icmproute, 0, sizeof(icmproute));
 731                 errornum = 0;
 732                 sin = in_selectsrc(&sin_dst, &icmproute, 0, NULL, &errornum);
 733                 /* errornum is never used */
 734                 rtcache_free(&icmproute);
 735                 /* check to make sure sin is a source address on rcvif */
 736                 if (sin) {
 737                         t = sin->sin_addr;
 738                         sin = NULL;
 739                         INADDR_TO_IA(t, ia);
 740                         while (ia) {
 741                                 if (ia->ia_ifp == m->m_pkthdr.rcvif) {
 742                                         sin = &ia->ia_addr;
 743                                         break;
 744                                 }
 745                                 NEXT_IA_WITH_SAME_ADDR(ia);
 746                         }
 747                 }
 748         }
 749
 750         /*
 751          * if it was not addressed to us, but the route doesn't go out
 752          * the source interface, pick an address on the source
 753          * interface.  This can happen when routing is asymmetric, or
 754          * when the incoming packet was encapsulated
 755          */
 756         if (sin == NULL && m->m_pkthdr.rcvif) {
 757                 IFADDR_FOREACH(ifa, m->m_pkthdr.rcvif) {
 758                         if (ifa->ifa_addr->sa_family != AF_INET)
 759                                 continue;
 760                         sin = &(ifatoia(ifa)->ia_addr);
 761                         break;
 762                 }
 763         }
 764
 765         /*
 766          * The following happens if the packet was not addressed to us,
 767          * and was received on an interface with no IP address:
 768          * We find the first AF_INET address on the first non-loopback
 769          * interface.
 770          */
 771         if (sin == NULL)
 772                 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_list) {
 773                         if (ia->ia_ifp->if_flags & IFF_LOOPBACK)
 774                                 continue;
 775                         sin = &ia->ia_addr;
 776                         break;
 777                 }
 778
 779         /*
 780          * If we still didn't find an address, punt.  We could have an
 781          * interface up (and receiving packets) with no address.
 782          */
 783         if (sin == NULL) {
 784                 m_freem(m);
 785                 goto done;
 786         }
 787
 788         ip->ip_src = sin->sin_addr;
 789         ip->ip_ttl = MAXTTL;
 790
 791         if (optlen > 0) {
 792                 u_char *cp;
 793                 int opt, cnt;
 794                 u_int len;
 795
 796                 /*
 797                  * Retrieve any source routing from the incoming packet;
 798                  * add on any record-route or timestamp options.
 799                  */
 800                 cp = (u_char *) (ip + 1);
 801                 if ((opts = ip_srcroute()) == 0 &&
 802                     (opts = m_gethdr(M_DONTWAIT, MT_HEADER))) {
 803                         MCLAIM(opts, m->m_owner);
 804                         opts->m_len = sizeof(struct in_addr);
 805                         *mtod(opts, struct in_addr *) = zeroin_addr;
 806                 }
 807                 if (opts) {
 808 #ifdef ICMPPRINTFS
 809                     if (icmpprintfs)
 810                             printf("icmp_reflect optlen %d rt %d => ",
 811                                 optlen, opts->m_len);
 812 #endif
 813                     for (cnt = optlen; cnt > 0; cnt -= len, cp += len) {
 814                             opt = cp[IPOPT_OPTVAL];
 815                             if (opt == IPOPT_EOL)
 816                                     break;
 817                             if (opt == IPOPT_NOP)
 818                                     len = 1;
 819                             else {
 820                                     if (cnt < IPOPT_OLEN + sizeof(*cp))
 821                                             break;
 822                                     len = cp[IPOPT_OLEN];
 823                                     if (len < IPOPT_OLEN + sizeof(*cp) ||
 824                                         len > cnt)
 825                                             break;
 826                             }
 827                             /*
 828                              * Should check for overflow, but it "can't happen"
 829                              */
 830                             if (opt == IPOPT_RR || opt == IPOPT_TS ||
 831                                 opt == IPOPT_SECURITY) {
 832                                     memmove(mtod(opts, char *) + opts->m_len,
 833                                         cp, len);
 834                                     opts->m_len += len;
 835                             }
 836                     }
 837                     /* Terminate & pad, if necessary */
 838                     if ((cnt = opts->m_len % 4) != 0) {
 839                             for (; cnt < 4; cnt++) {
 840                                     *(mtod(opts, char *) + opts->m_len) =
 841                                         IPOPT_EOL;
 842                                     opts->m_len++;
 843                             }
 844                     }
 845 #ifdef ICMPPRINTFS
 846                     if (icmpprintfs)
 847                             printf("%d\n", opts->m_len);
 848 #endif
 849                 }
 850                 /*
 851                  * Now strip out original options by copying rest of first
 852                  * mbuf's data back, and adjust the IP length.
 853                  */
 854                 ip->ip_len = htons(ntohs(ip->ip_len) - optlen);
 855                 ip->ip_hl = sizeof(struct ip) >> 2;
 856                 m->m_len -= optlen;
 857                 if (m->m_flags & M_PKTHDR)
 858                         m->m_pkthdr.len -= optlen;
 859                 optlen += sizeof(struct ip);
 860                 memmove(ip + 1, (char *)ip + optlen,
 861                     (unsigned)(m->m_len - sizeof(struct ip)));
 862         }
 863         m_tag_delete_nonpersistent(m);
 864         m->m_flags &= ~(M_BCAST|M_MCAST);
 865
 866         /*
 867          * Clear any in-bound checksum flags for this packet.
 868          */
 869         if (m->m_flags & M_PKTHDR)
 870                 m->m_pkthdr.csum_flags = 0;
 871
 872         icmp_send(m, opts);
 873 done:
 874         if (opts)
 875                 (void)m_free(opts);
 876 }
 877
 878 /*
 879  * Send an icmp packet back to the ip level,
 880  * after supplying a checksum.
 881  */
 882 void
 883 icmp_send(struct mbuf *m, struct mbuf *opts)
 884 {
 885         struct ip *ip = mtod(m, struct ip *);
 886         int hlen;
 887         struct icmp *icp;
 888
 889         hlen = ip->ip_hl << 2;
 890         m->m_data += hlen;
 891         m->m_len -= hlen;
 892         icp = mtod(m, struct icmp *);
 893         icp->icmp_cksum = 0;
 894         icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
 895         m->m_data -= hlen;
 896         m->m_len += hlen;
 897 #ifdef ICMPPRINTFS
 898         if (icmpprintfs) {
 899                 printf("icmp_send to destination `%s' from `%s'\n",
 900                     inet_ntoa(ip->ip_dst), inet_ntoa(ip->ip_src));
 901         }
 902 #endif
 903         (void)ip_output(m, opts, NULL, 0, NULL, NULL);
 904 }
 905
 906 n_time
 907 iptime(void)
 908 {
 909         struct timeval atv;
 910         u_long t;
 911
 912         microtime(&atv);
 913         t = (atv.tv_sec % (24*60*60)) * 1000 + atv.tv_usec / 1000;
 914         return (htonl(t));
 915 }
 916
 917 /*
 918  * sysctl helper routine for net.inet.icmp.returndatabytes.  ensures
 919  * that the new value is in the correct range.
 920  */
 921 static int
 922 sysctl_net_inet_icmp_returndatabytes(SYSCTLFN_ARGS)
 923 {
 924         int error, t;
 925         struct sysctlnode node;
 926
 927         node = *rnode;
 928         node.sysctl_data = &t;
 929         t = icmpreturndatabytes;
 930         error = sysctl_lookup(SYSCTLFN_CALL(&node));
 931         if (error || newp == NULL)
 932                 return (error);
 933
 934         if (t < 8 || t > 512)
 935                 return (EINVAL);
 936         icmpreturndatabytes = t;
 937
 938         return (0);
 939 }
 940
 941 /*
 942  * sysctl helper routine for net.inet.icmp.redirtimeout.  ensures that
 943  * the given value is not less than zero and then resets the timeout
 944  * queue.
 945  */
 946 static int
 947 sysctl_net_inet_icmp_redirtimeout(SYSCTLFN_ARGS)
 948 {
 949         int error, tmp;
 950         struct sysctlnode node;
 951
 952         node = *rnode;
 953         node.sysctl_data = &tmp;
 954         tmp = icmp_redirtimeout;
 955         error = sysctl_lookup(SYSCTLFN_CALL(&node));
 956         if (error || newp == NULL)
 957                 return (error);
 958         if (tmp < 0)
 959                 return (EINVAL);
 960         icmp_redirtimeout = tmp;
 961
 962         /*
 963          * was it a *defined* side-effect that anyone even *reading*
 964          * this value causes these things to happen?
 965          */
 966         if (icmp_redirect_timeout_q != NULL) {
 967                 if (icmp_redirtimeout == 0) {
 968                         rt_timer_queue_destroy(icmp_redirect_timeout_q,
 969                             true);
 970                         icmp_redirect_timeout_q = NULL;
 971                 } else {
 972                         rt_timer_queue_change(icmp_redirect_timeout_q,
 973                             icmp_redirtimeout);
 974                 }
 975         } else if (icmp_redirtimeout > 0) {
 976                 icmp_redirect_timeout_q =
 977                     rt_timer_queue_create(icmp_redirtimeout);
 978         }
 979
 980         return (0);
 981 }
 982
 983 static int
 984 sysctl_net_inet_icmp_stats(SYSCTLFN_ARGS)
 985 {
 986
 987         return (NETSTAT_SYSCTL(icmpstat_percpu, ICMP_NSTATS));
 988 }
 989
 990 static void
 991 sysctl_netinet_icmp_setup(struct sysctllog **clog)
 992 {
 993
 994         sysctl_createv(clog, 0, NULL, NULL,
 995                        CTLFLAG_PERMANENT,
 996                        CTLTYPE_NODE, "net", NULL,
 997                        NULL, 0, NULL, 0,
 998                        CTL_NET, CTL_EOL);
 999         sysctl_createv(clog, 0, NULL, NULL,
1000                        CTLFLAG_PERMANENT,
1001                        CTLTYPE_NODE, "inet", NULL,
1002                        NULL, 0, NULL, 0,
1003                        CTL_NET, PF_INET, CTL_EOL);
1004         sysctl_createv(clog, 0, NULL, NULL,
1005                        CTLFLAG_PERMANENT,
1006                        CTLTYPE_NODE, "icmp",
1007                        SYSCTL_DESCR("ICMPv4 related settings"),
1008                        NULL, 0, NULL, 0,
1009                        CTL_NET, PF_INET, IPPROTO_ICMP, CTL_EOL);
1010
1011         sysctl_createv(clog, 0, NULL, NULL,
1012                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1013                        CTLTYPE_INT, "maskrepl",
1014                        SYSCTL_DESCR("Respond to ICMP_MASKREQ messages"),
1015                        NULL, 0, &icmpmaskrepl, 0,
1016                        CTL_NET, PF_INET, IPPROTO_ICMP,
1017                        ICMPCTL_MASKREPL, CTL_EOL);
1018         sysctl_createv(clog, 0, NULL, NULL,
1019                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1020                        CTLTYPE_INT, "returndatabytes",
1021                        SYSCTL_DESCR("Number of bytes to return in an ICMP "
1022                                     "error message"),
1023                        sysctl_net_inet_icmp_returndatabytes, 0,
1024                        &icmpreturndatabytes, 0,
1025                        CTL_NET, PF_INET, IPPROTO_ICMP,
1026                        ICMPCTL_RETURNDATABYTES, CTL_EOL);
1027         sysctl_createv(clog, 0, NULL, NULL,
1028                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1029                        CTLTYPE_INT, "errppslimit",
1030                        SYSCTL_DESCR("Maximum number of outgoing ICMP error "
1031                                     "messages per second"),
1032                        NULL, 0, &icmperrppslim, 0,
1033                        CTL_NET, PF_INET, IPPROTO_ICMP,
1034                        ICMPCTL_ERRPPSLIMIT, CTL_EOL);
1035         sysctl_createv(clog, 0, NULL, NULL,
1036                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1037                        CTLTYPE_INT, "rediraccept",
1038                        SYSCTL_DESCR("Accept ICMP_REDIRECT messages"),
1039                        NULL, 0, &icmp_rediraccept, 0,
1040                        CTL_NET, PF_INET, IPPROTO_ICMP,
1041                        ICMPCTL_REDIRACCEPT, CTL_EOL);
1042         sysctl_createv(clog, 0, NULL, NULL,
1043                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1044                        CTLTYPE_INT, "redirtimeout",
1045                        SYSCTL_DESCR("Lifetime of ICMP_REDIRECT generated "
1046                                     "routes"),
1047                        sysctl_net_inet_icmp_redirtimeout, 0,
1048                        &icmp_redirtimeout, 0,
1049                        CTL_NET, PF_INET, IPPROTO_ICMP,
1050                        ICMPCTL_REDIRTIMEOUT, CTL_EOL);
1051         sysctl_createv(clog, 0, NULL, NULL,
1052                        CTLFLAG_PERMANENT,
1053                        CTLTYPE_STRUCT, "stats",
1054                        SYSCTL_DESCR("ICMP statistics"),
1055                        sysctl_net_inet_icmp_stats, 0, NULL, 0,
1056                        CTL_NET, PF_INET, IPPROTO_ICMP, ICMPCTL_STATS,
1057                        CTL_EOL);
1058 }
1059
1060 void
1061 icmp_statinc(u_int stat)
1062 {
1063
1064         KASSERT(stat < ICMP_NSTATS);
1065         ICMP_STATINC(stat);
1066 }
1067
1068 /* Table of common MTUs: */
1069
1070 static const u_int mtu_table[] = {
1071         65535, 65280, 32000, 17914, 9180, 8166,
1072         4352, 2002, 1492, 1006, 508, 296, 68, 0
1073 };
1074
1075 void
1076 icmp_mtudisc(struct icmp *icp, struct in_addr faddr)
1077 {
1078         struct icmp_mtudisc_callback *mc;
1079         struct sockaddr *dst = sintosa(&icmpsrc);
1080         struct rtentry *rt;
1081         u_long mtu = ntohs(icp->icmp_nextmtu);  /* Why a long?  IPv6 */
1082         int    error;
1083
1084         rt = rtalloc1(dst, 1);
1085         if (rt == 0)
1086                 return;
1087
1088         /* If we didn't get a host route, allocate one */
1089
1090         if ((rt->rt_flags & RTF_HOST) == 0) {
1091                 struct rtentry *nrt;
1092
1093                 error = rtrequest((int) RTM_ADD, dst,
1094                     (struct sockaddr *) rt->rt_gateway,
1095                     (struct sockaddr *) 0,
1096                     RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt);
1097                 if (error) {
1098                         rtfree(rt);
1099                         return;
1100                 }
1101                 nrt->rt_rmx = rt->rt_rmx;
1102                 rtfree(rt);
1103                 rt = nrt;
1104         }
1105         error = rt_timer_add(rt, icmp_mtudisc_timeout, ip_mtudisc_timeout_q);
1106         if (error) {
1107                 rtfree(rt);
1108                 return;
1109         }
1110
1111         if (mtu == 0) {
1112                 int i = 0;
1113
1114                 mtu = ntohs(icp->icmp_ip.ip_len);
1115                 /* Some 4.2BSD-based routers incorrectly adjust the ip_len */
1116                 if (mtu > rt->rt_rmx.rmx_mtu && rt->rt_rmx.rmx_mtu != 0)
1117                         mtu -= (icp->icmp_ip.ip_hl << 2);
1118
1119                 /* If we still can't guess a value, try the route */
1120
1121                 if (mtu == 0) {
1122                         mtu = rt->rt_rmx.rmx_mtu;
1123
1124                         /* If no route mtu, default to the interface mtu */
1125
1126                         if (mtu == 0)
1127                                 mtu = rt->rt_ifp->if_mtu;
1128                 }
1129
1130                 for (i = 0; i < sizeof(mtu_table) / sizeof(mtu_table[0]); i++)
1131                         if (mtu > mtu_table[i]) {
1132                                 mtu = mtu_table[i];
1133                                 break;
1134                         }
1135         }
1136
1137         /*
1138          * XXX:   RTV_MTU is overloaded, since the admin can set it
1139          *        to turn off PMTU for a route, and the kernel can
1140          *        set it to indicate a serious problem with PMTU
1141          *        on a route.  We should be using a separate flag
1142          *        for the kernel to indicate this.
1143          */
1144
1145         if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) {
1146                 if (mtu < 296 || mtu > rt->rt_ifp->if_mtu)
1147                         rt->rt_rmx.rmx_locks |= RTV_MTU;
1148                 else if (rt->rt_rmx.rmx_mtu > mtu ||
1149                          rt->rt_rmx.rmx_mtu == 0) {
1150                         ICMP_STATINC(ICMP_STAT_PMTUCHG);
1151                         rt->rt_rmx.rmx_mtu = mtu;
1152                 }
1153         }
1154
1155         if (rt)
1156                 rtfree(rt);
1157
1158         /*
1159          * Notify protocols that the MTU for this destination
1160          * has changed.
1161          */
1162         for (mc = LIST_FIRST(&icmp_mtudisc_callbacks); mc != NULL;
1163              mc = LIST_NEXT(mc, mc_list))
1164                 (*mc->mc_func)(faddr);
1165 }
1166
1167 /*
1168  * Return the next larger or smaller MTU plateau (table from RFC 1191)
1169  * given current value MTU.  If DIR is less than zero, a larger plateau
1170  * is returned; otherwise, a smaller value is returned.
1171  */
1172 u_int
1173 ip_next_mtu(u_int mtu, int dir) /* XXX */
1174 {
1175         int i;
1176
1177         for (i = 0; i < (sizeof mtu_table) / (sizeof mtu_table[0]); i++) {
1178                 if (mtu >= mtu_table[i])
1179                         break;
1180         }
1181
1182         if (dir < 0) {
1183                 if (i == 0) {
1184                         return 0;
1185                 } else {
1186                         return mtu_table[i - 1];
1187                 }
1188         } else {
1189                 if (mtu_table[i] == 0) {
1190                         return 0;
1191                 } else if (mtu > mtu_table[i]) {
1192                         return mtu_table[i];
1193                 } else {
1194                         return mtu_table[i + 1];
1195                 }
1196         }
1197 }
1198
1199 static void
1200 icmp_mtudisc_timeout(struct rtentry *rt, struct rttimer *r)
1201 {
1202         if (rt == NULL)
1203                 panic("icmp_mtudisc_timeout:  bad route to timeout");
1204         if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
1205             (RTF_DYNAMIC | RTF_HOST)) {
1206                 rtrequest((int) RTM_DELETE, rt_getkey(rt),
1207                     rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
1208         } else {
1209                 if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) {
1210                         rt->rt_rmx.rmx_mtu = 0;
1211                 }
1212         }
1213 }
1214
1215 static void
1216 icmp_redirect_timeout(struct rtentry *rt, struct rttimer *r)
1217 {
1218         if (rt == NULL)
1219                 panic("icmp_redirect_timeout:  bad route to timeout");
1220         if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
1221             (RTF_DYNAMIC | RTF_HOST)) {
1222                 rtrequest((int) RTM_DELETE, rt_getkey(rt),
1223                     rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
1224         }
1225 }
1226
1227 /*
1228  * Perform rate limit check.
1229  * Returns 0 if it is okay to send the icmp packet.
1230  * Returns 1 if the router SHOULD NOT send this icmp packet due to rate
1231  * limitation.
1232  *
1233  * XXX per-destination/type check necessary?
1234  */
1235 static int
1236 icmp_ratelimit(const struct in_addr *dst, const int type,
1237     const int code)
1238 {
1239
1240         /* PPS limit */
1241         if (!ppsratecheck(&icmperrppslim_last, &icmperrpps_count,
1242             icmperrppslim)) {
1243                 /* The packet is subject to rate limit */
1244                 return 1;
1245         }
1246
1247         /* okay to send */
1248         return 0;
1249 }