X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=secnet.git;a=blobdiff_plain;f=netlink.c;h=e197e80f8c69508f5f617d9af86b1bfa07957098;hp=b6650eb36f55ccd58910cb6e7203feae5e44fe93;hb=f1af5809ba842b5ca0799a8e085e92967976ac34;hpb=d3fe100dfc120244d316e083ce87b1eb130fe4fd;ds=sidebyside diff --git a/netlink.c b/netlink.c index b6650eb..e197e80 100644 --- a/netlink.c +++ b/netlink.c @@ -1,24 +1,132 @@ /* User-kernel network link */ -/* Each netlink device is actually a router, with its own IP address. - We do things like decreasing the TTL and recalculating the header - checksum, generating ICMP, responding to pings, etc. */ +/* See RFCs 791, 792, 1123 and 1812 */ -/* This is where we have the anti-spoofing paranoia - before sending a - packet to the kernel we check that the tunnel it came over could - reasonably have produced it. */ +/* The netlink device is actually a router. Tunnels are unnumbered + point-to-point lines (RFC1812 section 2.2.7); the router has a + single address (the 'router-id'). */ +/* This is where we currently have the anti-spoofing paranoia - before + sending a packet to the kernel we check that the tunnel it came + over could reasonably have produced it. */ + + +/* Points to note from RFC1812 (which may require changes in this + file): + +3.3.4 Maximum Transmission Unit - MTU + + The MTU of each logical interface MUST be configurable within the + range of legal MTUs for the interface. + + Many Link Layer protocols define a maximum frame size that may be + sent. In such cases, a router MUST NOT allow an MTU to be set which + would allow sending of frames larger than those allowed by the Link + Layer protocol. However, a router SHOULD be willing to receive a + packet as large as the maximum frame size even if that is larger than + the MTU. + +4.2.1 A router SHOULD count datagrams discarded. + +4.2.2.1 Source route options - we probably should implement processing +of source routes, even though mostly the security policy will prevent +their use. + +5.3.13.4 Source Route Options + + A router MUST implement support for source route options in forwarded + packets. A router MAY implement a configuration option that, when + enabled, causes all source-routed packets to be discarded. However, + such an option MUST NOT be enabled by default. + +5.3.13.5 Record Route Option + + Routers MUST support the Record Route option in forwarded packets. + + A router MAY provide a configuration option that, if enabled, will + cause the router to ignore (i.e., pass through unchanged) Record + Route options in forwarded packets. If provided, such an option MUST + default to enabling the record-route. This option should not affect + the processing of Record Route options in datagrams received by the + router itself (in particular, Record Route options in ICMP echo + requests will still be processed according to Section [4.3.3.6]). + +5.3.13.6 Timestamp Option + + Routers MUST support the timestamp option in forwarded packets. A + timestamp value MUST follow the rules given [INTRO:2]. + + If the flags field = 3 (timestamp and prespecified address), the + router MUST add its timestamp if the next prespecified address + matches any of the router's IP addresses. It is not necessary that + the prespecified address be either the address of the interface on + which the packet arrived or the address of the interface over which + it will be sent. + + +4.2.2.7 Fragmentation: RFC 791 Section 3.2 + + Fragmentation, as described in [INTERNET:1], MUST be supported by a + router. + +4.2.2.8 Reassembly: RFC 791 Section 3.2 + + As specified in the corresponding section of [INTRO:2], a router MUST + support reassembly of datagrams that it delivers to itself. + +4.2.2.9 Time to Live: RFC 791 Section 3.2 + + Note in particular that a router MUST NOT check the TTL of a packet + except when forwarding it. + + A router MUST NOT discard a datagram just because it was received + with TTL equal to zero or one; if it is to the router and otherwise + valid, the router MUST attempt to receive it. + + On messages the router originates, the IP layer MUST provide a means + for the transport layer to set the TTL field of every datagram that + is sent. When a fixed TTL value is used, it MUST be configurable. + + +8.1 The Simple Network Management Protocol - SNMP +8.1.1 SNMP Protocol Elements + + Routers MUST be manageable by SNMP [MGT:3]. The SNMP MUST operate + using UDP/IP as its transport and network protocols. + + +*/ + +#include +#include +#include #include "secnet.h" #include "util.h" #include "ipaddr.h" #include "netlink.h" #include "process.h" -#define OPT_SOFTROUTE 1 -#define OPT_ALLOWROUTE 2 +#ifdef NETLINK_DEBUG +#define MDEBUG(...) Message(M_DEBUG, __VA_ARGS__) +#else /* !NETLINK_DEBUG */ +#define MDEBUG(...) ((void)0) +#endif /* !NETLINK_DEBUG */ + +#define ICMP_TYPE_ECHO_REPLY 0 + +#define ICMP_TYPE_UNREACHABLE 3 +#define ICMP_CODE_NET_UNREACHABLE 0 +#define ICMP_CODE_PROTOCOL_UNREACHABLE 2 +#define ICMP_CODE_FRAGMENTATION_REQUIRED 4 +#define ICMP_CODE_NET_PROHIBITED 13 + +#define ICMP_TYPE_ECHO_REQUEST 8 + +#define ICMP_TYPE_TIME_EXCEEDED 11 +#define ICMP_CODE_TTL_EXCEEDED 0 /* Generic IP checksum routine */ -static inline uint16_t ip_csum(uint8_t *iph,uint32_t count) +static inline uint16_t ip_csum(const uint8_t *iph,int32_t count) { register uint32_t sum=0; @@ -42,38 +150,39 @@ static inline uint16_t ip_csum(uint8_t *iph,uint32_t count) * By Jorge Cwik , adapted for linux by * Arnt Gulbrandsen. */ -static inline uint16_t ip_fast_csum(uint8_t *iph, uint32_t ihl) { +static inline uint16_t ip_fast_csum(const uint8_t *iph, int32_t ihl) { uint32_t sum; - __asm__ __volatile__(" - movl (%1), %0 - subl $4, %2 - jbe 2f - addl 4(%1), %0 - adcl 8(%1), %0 - adcl 12(%1), %0 -1: adcl 16(%1), %0 - lea 4(%1), %1 - decl %2 - jne 1b - adcl $0, %0 - movl %0, %2 - shrl $16, %0 - addw %w2, %w0 - adcl $0, %0 - notl %0 -2: - " + __asm__ __volatile__( + "movl (%1), %0 ;\n" + "subl $4, %2 ;\n" + "jbe 2f ;\n" + "addl 4(%1), %0 ;\n" + "adcl 8(%1), %0 ;\n" + "adcl 12(%1), %0 ;\n" +"1: adcl 16(%1), %0 ;\n" + "lea 4(%1), %1 ;\n" + "decl %2 ;\n" + "jne 1b ;\n" + "adcl $0, %0 ;\n" + "movl %0, %2 ;\n" + "shrl $16, %0 ;\n" + "addw %w2, %w0 ;\n" + "adcl $0, %0 ;\n" + "notl %0 ;\n" +"2: ;\n" /* Since the input registers which are loaded with iph and ipl are modified, we must also specify them as outputs, or gcc will assume they contain their original values. */ : "=r" (sum), "=r" (iph), "=r" (ihl) - : "1" (iph), "2" (ihl)); + : "1" (iph), "2" (ihl) + : "memory"); return sum; } #else -static inline uint16_t ip_fast_csum(uint8_t *iph, uint32_t ihl) +static inline uint16_t ip_fast_csum(const uint8_t *iph, int32_t ihl) { + assert(ihl < INT_MAX/4); return ip_csum(iph,ihl*4); } #endif @@ -89,7 +198,11 @@ struct iphdr { uint8_t tos; uint16_t tot_len; uint16_t id; - uint16_t frag_off; + uint16_t frag; +#define IPHDR_FRAG_OFF ((uint16_t)0x1fff) +#define IPHDR_FRAG_MORE ((uint16_t)0x2000) +#define IPHDR_FRAG_DONT ((uint16_t)0x4000) +/* reserved 0x8000 */ uint8_t ttl; uint8_t protocol; uint16_t check; @@ -103,7 +216,7 @@ struct icmphdr { uint8_t type; uint8_t code; uint16_t check; - union { + union icmpinfofield { uint32_t unused; struct { uint8_t pointer; @@ -115,20 +228,48 @@ struct icmphdr { uint16_t id; uint16_t seq; } echo; + struct { + uint16_t unused; + uint16_t mtu; + } fragneeded; } d; }; + +static const union icmpinfofield icmp_noinfo; +static void netlink_client_deliver(struct netlink *st, + struct netlink_client *client, + uint32_t source, uint32_t dest, + struct buffer_if *buf); +static void netlink_host_deliver(struct netlink *st, + struct netlink_client *sender, + uint32_t source, uint32_t dest, + struct buffer_if *buf); + +static const char *sender_name(struct netlink_client *sender /* or NULL */) +{ + return sender?sender->name:"(local)"; +} + static void netlink_packet_deliver(struct netlink *st, struct netlink_client *client, struct buffer_if *buf); +/* XXX RFC1812 4.3.2.5: + All other ICMP error messages (Destination Unreachable, + Redirect, Time Exceeded, and Parameter Problem) SHOULD have their + precedence value set to 6 (INTERNETWORK CONTROL) or 7 (NETWORK + CONTROL). The IP Precedence value for these error messages MAY be + settable. + */ static struct icmphdr *netlink_icmp_tmpl(struct netlink *st, - uint32_t dest,uint16_t len) + uint32_t source, uint32_t dest, + uint16_t len) { struct icmphdr *h; BUF_ALLOC(&st->icmp,"netlink_icmp_tmpl"); - buffer_init(&st->icmp,st->max_start_pad); + buffer_init(&st->icmp,calculate_max_start_pad()); h=buf_append(&st->icmp,sizeof(*h)); h->iph.version=4; @@ -136,10 +277,10 @@ static struct icmphdr *netlink_icmp_tmpl(struct netlink *st, h->iph.tos=0; h->iph.tot_len=htons(len+(h->iph.ihl*4)+8); h->iph.id=0; - h->iph.frag_off=0; - h->iph.ttl=255; + h->iph.frag=0; + h->iph.ttl=255; /* XXX should be configurable */ h->iph.protocol=1; - h->iph.saddr=htonl(st->secnet_address); + h->iph.saddr=htonl(source); h->iph.daddr=htonl(dest); h->iph.check=0; h->iph.check=ip_fast_csum((uint8_t *)&h->iph,h->iph.ihl); @@ -152,7 +293,7 @@ static struct icmphdr *netlink_icmp_tmpl(struct netlink *st, /* Fill in the ICMP checksum field correctly */ static void netlink_icmp_csum(struct icmphdr *h) { - uint32_t len; + int32_t len; len=ntohs(h->iph.tot_len)-(4*h->iph.ihl); h->check=0; @@ -183,18 +324,27 @@ static bool_t netlink_icmp_may_reply(struct buffer_if *buf) struct icmphdr *icmph; uint32_t source; + if (buf->size < (int)sizeof(struct icmphdr)) return False; iph=(struct iphdr *)buf->start; icmph=(struct icmphdr *)buf->start; if (iph->protocol==1) { switch(icmph->type) { - case 3: /* Destination unreachable */ - case 11: /* Time Exceeded */ - case 12: /* Parameter Problem */ + /* Based on http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-types + * as retrieved Thu, 20 Mar 2014 00:16:44 +0000. + * Deprecated, reserved, unassigned and experimental + * options are treated as not safe to reply to. + */ + case 0: /* Echo Reply */ + case 8: /* Echo */ + case 13: /* Timestamp */ + case 14: /* Timestamp Reply */ + return True; + default: return False; } } /* How do we spot broadcast destination addresses? */ - if (ntohs(iph->frag_off)&0x1fff) return False; /* Non-initial fragment */ + if (ntohs(iph->frag)&IPHDR_FRAG_OFF) return False; source=ntohl(iph->saddr); if (source==0) return False; if ((source&0xff000000)==0x7f000000) return False; @@ -206,8 +356,29 @@ static bool_t netlink_icmp_may_reply(struct buffer_if *buf) /* How much of the original IP packet do we include in its ICMP response? The header plus up to 64 bits. */ + +/* XXX TODO RFC1812: +4.3.2.3 Original Message Header + + Historically, every ICMP error message has included the Internet + header and at least the first 8 data bytes of the datagram that + triggered the error. This is no longer adequate, due to the use of + IP-in-IP tunneling and other technologies. Therefore, the ICMP + datagram SHOULD contain as much of the original datagram as possible + without the length of the ICMP datagram exceeding 576 bytes. The + returned IP header (and user data) MUST be identical to that which + was received, except that the router is not required to undo any + modifications to the IP header that are normally performed in + forwarding that were performed before the error was detected (e.g., + decrementing the TTL, or updating options). Note that the + requirements of Section [4.3.3.5] supersede this requirement in some + cases (i.e., for a Parameter Problem message, if the problem is in a + modified field, the router must undo the modification). See Section + [4.3.3.5]). + */ static uint16_t netlink_icmp_reply_len(struct buffer_if *buf) { + if (buf->size < (int)sizeof(struct iphdr)) return 0; struct iphdr *iph=(struct iphdr *)buf->start; uint16_t hlen,plen; @@ -220,21 +391,55 @@ static uint16_t netlink_icmp_reply_len(struct buffer_if *buf) /* client indicates where the packet we're constructing a response to comes from. NULL indicates the host. */ -static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf, - struct netlink_client *client, - uint8_t type, uint8_t code) +static void netlink_icmp_simple(struct netlink *st, + struct netlink_client *origsender, + struct buffer_if *buf, + uint8_t type, uint8_t code, + union icmpinfofield info) { - struct iphdr *iph=(struct iphdr *)buf->start; struct icmphdr *h; uint16_t len; if (netlink_icmp_may_reply(buf)) { + struct iphdr *iph=(struct iphdr *)buf->start; + + uint32_t icmpdest = ntohl(iph->saddr); + uint32_t icmpsource; + const char *icmpsourcedebugprefix; + if (!st->ptp) { + icmpsource=st->secnet_address; + icmpsourcedebugprefix=""; + } else if (origsender) { + /* was from peer, send reply as if from host */ + icmpsource=st->local_address; + icmpsourcedebugprefix="L!"; + } else { + /* was from host, send reply as if from peer */ + icmpsource=st->secnet_address; /* actually, peer address */ + icmpsourcedebugprefix="P!"; + } + MDEBUG("%s: generating ICMP re %s[%s]->[%s]:" + " from %s%s type=%u code=%u\n", + st->name, sender_name(origsender), + ipaddr_to_string(ntohl(iph->saddr)), + ipaddr_to_string(ntohl(iph->daddr)), + icmpsourcedebugprefix, + ipaddr_to_string(icmpsource), + type, code); + len=netlink_icmp_reply_len(buf); - h=netlink_icmp_tmpl(st,ntohl(iph->saddr),len); - h->type=type; h->code=code; - memcpy(buf_append(&st->icmp,len),buf->start,len); + h=netlink_icmp_tmpl(st,icmpsource,icmpdest,len); + h->type=type; h->code=code; h->d=info; + BUF_ADD_BYTES(append,&st->icmp,buf->start,len); netlink_icmp_csum(h); - netlink_packet_deliver(st,NULL,&st->icmp); + + if (!st->ptp) { + netlink_packet_deliver(st,NULL,&st->icmp); + } else if (origsender) { + netlink_client_deliver(st,origsender,icmpsource,icmpdest,&st->icmp); + } else { + netlink_host_deliver(st,NULL,icmpsource,icmpdest,&st->icmp); + } BUF_ASSERT_FREE(&st->icmp); } } @@ -242,6 +447,7 @@ static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf, /* * RFC1122: 3.1.2.2 MUST silently discard any IP frame that fails the * checksum. + * RFC1812: 4.2.2.5 MUST discard messages containing invalid checksums. * * Is the datagram acceptable? * @@ -250,28 +456,220 @@ static void netlink_icmp_simple(struct netlink *st, struct buffer_if *buf, * 3. Checksums correctly. * 4. Doesn't have a bogus length */ -static bool_t netlink_check(struct netlink *st, struct buffer_if *buf) +static bool_t netlink_check(struct netlink *st, struct buffer_if *buf, + char *errmsgbuf, int errmsgbuflen) { +#define BAD(...) do{ \ + snprintf(errmsgbuf,errmsgbuflen,__VA_ARGS__); \ + return False; \ + }while(0) + + if (buf->size < (int)sizeof(struct iphdr)) BAD("len %"PRIu32"",buf->size); struct iphdr *iph=(struct iphdr *)buf->start; - uint32_t len; + int32_t len; - if (iph->ihl < 5 || iph->version != 4) return False; - if (buf->size < iph->ihl*4) return False; - if (ip_fast_csum((uint8_t *)iph, iph->ihl)!=0) return False; + if (iph->ihl < 5) BAD("ihl %u",iph->ihl); + if (iph->version != 4) BAD("version %u",iph->version); + if (buf->size < iph->ihl*4) BAD("size %"PRId32"<%u*4",buf->size,iph->ihl); + if (ip_fast_csum((uint8_t *)iph, iph->ihl)!=0) BAD("csum"); len=ntohs(iph->tot_len); /* There should be no padding */ - if (buf->size!=len || len<(iph->ihl<<2)) return False; + if (buf->size!=len) BAD("len %"PRId32"!=%"PRId32,buf->size,len); + if (len<(iph->ihl<<2)) BAD("len %"PRId32"<(%u<<2)",len,iph->ihl); /* XXX check that there's no source route specified */ return True; + +#undef BAD +} + +static const char *fragment_filter_header(uint8_t *base, long *hlp) +{ + const int fixedhl = sizeof(struct iphdr); + long hl = *hlp; + const uint8_t *ipend = base + hl; + uint8_t *op = base + fixedhl; + const uint8_t *ip = op; + + while (ip < ipend) { + uint8_t opt = ip[0]; + int remain = ipend - ip; + if (opt == 0x00) /* End of Options List */ break; + if (opt == 0x01) /* No Operation */ continue; + if (remain < 2) return "IPv4 options truncated at length"; + int optlen = ip[1]; + if (remain < optlen) return "IPv4 options truncated in option"; + if (opt & 0x80) /* copy */ { + memmove(op, ip, optlen); + op += optlen; + } + ip += optlen; + } + while ((hl = (op - base)) & 0x3) + *op++ = 0x00 /* End of Option List */; + ((struct iphdr*)base)->ihl = hl >> 2; + *hlp = hl; + + return 0; } -/* Deliver a packet. "client" is the _origin_ of the packet, not its - destination, and is NULL for packets from the host and packets +/* Fragment or send ICMP Fragmentation Needed */ +static void netlink_maybe_fragment(struct netlink *st, + struct netlink_client *sender, + netlink_deliver_fn *deliver, + void *deliver_dst, + const char *delivery_name, + int32_t mtu, + uint32_t source, uint32_t dest, + struct buffer_if *buf) +{ + struct iphdr *iph=(struct iphdr*)buf->start; + long hl = iph->ihl*4; + const char *ssource = ipaddr_to_string(source); + + if (buf->size <= mtu) { + deliver(deliver_dst, buf); + return; + } + + MDEBUG("%s: fragmenting %s->%s org.size=%"PRId32"\n", + st->name, ssource, delivery_name, buf->size); + +#define BADFRAG(m, ...) \ + Message(M_WARNING, \ + "%s: fragmenting packet from source %s" \ + " for transmission via %s: " m "\n", \ + st->name, ssource, delivery_name, \ + ## __VA_ARGS__); + + unsigned orig_frag = ntohs(iph->frag); + + if (orig_frag&IPHDR_FRAG_DONT) { + union icmpinfofield info = + { .fragneeded = { .unused = 0, .mtu = htons(mtu) } }; + netlink_icmp_simple(st,sender,buf, + ICMP_TYPE_UNREACHABLE, + ICMP_CODE_FRAGMENTATION_REQUIRED, + info); + BUF_FREE(buf); + return; + } + if (mtu < hl + 8) { + BADFRAG("mtu %"PRId32" too small", mtu); + BUF_FREE(buf); + return; + } + + /* we (ab)use the icmp buffer to stash the original packet */ + struct buffer_if *orig = &st->icmp; + BUF_ALLOC(orig,"netlink_client_deliver fragment orig"); + buffer_copy(orig,buf); + BUF_FREE(buf); + + const uint8_t *startindata = orig->start + hl; + const uint8_t *indata = startindata; + const uint8_t *endindata = orig->start + orig->size; + _Bool filtered = 0; + + for (;;) { + /* compute our fragment offset */ + long dataoffset = indata - startindata + + (orig_frag & IPHDR_FRAG_OFF)*8; + assert(!(dataoffset & 7)); + if (dataoffset > IPHDR_FRAG_OFF*8) { + BADFRAG("ultimate fragment offset out of range"); + break; + } + + BUF_ALLOC(buf,"netlink_client_deliver fragment frag"); + buffer_init(buf,calculate_max_start_pad()); + + /* copy header (possibly filtered); will adjust in a bit */ + struct iphdr *fragh = buf_append(buf, hl); + memcpy(fragh, orig->start, hl); + + /* decide how much payload to copy and copy it */ + long avail = mtu - hl; + long remain = endindata - indata; + long use = avail < remain ? (avail & ~(long)7) : remain; + BUF_ADD_BYTES(append, buf, indata, use); + indata += use; + + _Bool last_frag = indata >= endindata; + + /* adjust the header */ + fragh->tot_len = htons(buf->size); + fragh->frag = + htons((orig_frag & ~IPHDR_FRAG_OFF) | + (last_frag ? 0 : IPHDR_FRAG_MORE) | + (dataoffset >> 3)); + fragh->check = 0; + fragh->check = ip_fast_csum((const void*)fragh, fragh->ihl); + + /* actually send it */ + deliver(deliver_dst, buf); + if (last_frag) + break; + + /* after copying the header for the first frag, + * we filter the header for the remaining frags */ + if (!filtered++) { + const char *bad = fragment_filter_header(orig->start, &hl); + if (bad) { BADFRAG("%s", bad); break; } + } + } + + BUF_FREE(orig); + +#undef BADFRAG +} + +/* Deliver a packet _to_ client; used after we have decided + * what to do with it (and just to check that the client has + * actually registered a delivery function with us). */ +static void netlink_client_deliver(struct netlink *st, + struct netlink_client *client, + uint32_t source, uint32_t dest, + struct buffer_if *buf) +{ + if (!client->deliver) { + string_t s,d; + s=ipaddr_to_string(source); + d=ipaddr_to_string(dest); + Message(M_ERR,"%s: dropping %s->%s, client not registered\n", + st->name,s,d); + BUF_FREE(buf); + return; + } + netlink_maybe_fragment(st,NULL, client->deliver,client->dst,client->name, + client->mtu, source,dest,buf); + client->outcount++; +} + +/* Deliver a packet to the host; used after we have decided that that + * is what to do with it. */ +static void netlink_host_deliver(struct netlink *st, + struct netlink_client *sender, + uint32_t source, uint32_t dest, + struct buffer_if *buf) +{ + netlink_maybe_fragment(st,sender, st->deliver_to_host,st->dst,"(host)", + st->mtu, source,dest,buf); + st->outcount++; +} + +/* Deliver a packet. "sender"==NULL for packets from the host and packets generated internally in secnet. */ static void netlink_packet_deliver(struct netlink *st, - struct netlink_client *client, + struct netlink_client *sender, struct buffer_if *buf) { + if (buf->size < (int)sizeof(struct iphdr)) { + Message(M_ERR,"%s: trying to deliver a too-short packet" + " from %s!\n",st->name, sender_name(sender)); + BUF_FREE(buf); + return; + } + struct iphdr *iph=(struct iphdr *)buf->start; uint32_t dest=ntohl(iph->daddr); uint32_t source=ntohl(iph->saddr); @@ -284,14 +682,14 @@ static void netlink_packet_deliver(struct netlink *st, BUF_ASSERT_USED(buf); if (dest==st->secnet_address) { - Message(M_ERR,"%s: trying to deliver a packet to myself!\n"); + Message(M_ERR,"%s: trying to deliver a packet to myself!\n",st->name); BUF_FREE(buf); return; } - /* Packets from the host (client==NULL) may always be routed. Packets + /* Packets from the host (sender==NULL) may always be routed. Packets from clients with the allow_route option will also be routed. */ - if (!client || (client && (client->options & OPT_ALLOWROUTE))) + if (!sender || (sender && (sender->options & OPT_ALLOWROUTE))) allow_route=True; /* If !allow_route, we check the routing table anyway, and if @@ -337,17 +735,16 @@ static void netlink_packet_deliver(struct netlink *st, /* The packet's not going down a tunnel. It might (ought to) be for the host. */ if (ipset_contains_addr(st->networks,dest)) { - st->deliver_to_host(st->dst,buf); - st->outcount++; + netlink_host_deliver(st,sender,source,dest,buf); BUF_ASSERT_FREE(buf); } else { string_t s,d; s=ipaddr_to_string(source); d=ipaddr_to_string(dest); - Message(M_ERR,"%s: don't know where to deliver packet " + Message(M_DEBUG,"%s: don't know where to deliver packet " "(s=%s, d=%s)\n", st->name, s, d); - free(s); free(d); - netlink_icmp_simple(st,buf,client,3,0); + netlink_icmp_simple(st,sender,buf,ICMP_TYPE_UNREACHABLE, + ICMP_CODE_NET_UNREACHABLE, icmp_noinfo); BUF_FREE(buf); } } else { @@ -361,30 +758,33 @@ static void netlink_packet_deliver(struct netlink *st, with destination network administratively prohibited */ Message(M_NOTICE,"%s: denied forwarding for packet (s=%s, d=%s)\n", st->name,s,d); - free(s); free(d); - netlink_icmp_simple(st,buf,client,3,9); + netlink_icmp_simple(st,sender,buf,ICMP_TYPE_UNREACHABLE, + ICMP_CODE_NET_PROHIBITED, icmp_noinfo); BUF_FREE(buf); - } - if (best_quality>0) { - /* XXX Fragment if required */ - st->routes[best_match]->deliver( - st->routes[best_match]->dst, buf); - st->routes[best_match]->outcount++; - BUF_ASSERT_FREE(buf); } else { - /* Generate ICMP destination unreachable */ - netlink_icmp_simple(st,buf,client,3,0); /* client==NULL */ - BUF_FREE(buf); + if (best_quality>0) { + netlink_client_deliver(st,st->routes[best_match], + source,dest,buf); + BUF_ASSERT_FREE(buf); + } else { + /* Generate ICMP destination unreachable */ + netlink_icmp_simple(st,sender,buf, + ICMP_TYPE_UNREACHABLE, + ICMP_CODE_NET_UNREACHABLE, + icmp_noinfo); + BUF_FREE(buf); + } } } BUF_ASSERT_FREE(buf); } static void netlink_packet_forward(struct netlink *st, - struct netlink_client *client, + struct netlink_client *sender, struct buffer_if *buf) { + if (buf->size < (int)sizeof(struct iphdr)) return; struct iphdr *iph=(struct iphdr *)buf->start; BUF_ASSERT_USED(buf); @@ -392,7 +792,8 @@ static void netlink_packet_forward(struct netlink *st, /* Packet has already been checked */ if (iph->ttl<=1) { /* Generate ICMP time exceeded */ - netlink_icmp_simple(st,buf,client,11,0); + netlink_icmp_simple(st,sender,buf,ICMP_TYPE_TIME_EXCEEDED, + ICMP_CODE_TTL_EXCEEDED,icmp_noinfo); BUF_FREE(buf); return; } @@ -400,37 +801,46 @@ static void netlink_packet_forward(struct netlink *st, iph->check=0; iph->check=ip_fast_csum((uint8_t *)iph,iph->ihl); - netlink_packet_deliver(st,client,buf); + netlink_packet_deliver(st,sender,buf); BUF_ASSERT_FREE(buf); } /* Deal with packets addressed explicitly to us */ static void netlink_packet_local(struct netlink *st, - struct netlink_client *client, + struct netlink_client *sender, struct buffer_if *buf) { struct icmphdr *h; st->localcount++; + if (buf->size < (int)sizeof(struct icmphdr)) { + Message(M_WARNING,"%s: short packet addressed to secnet; " + "ignoring it\n",st->name); + BUF_FREE(buf); + return; + } h=(struct icmphdr *)buf->start; - if ((ntohs(h->iph.frag_off)&0xbfff)!=0) { - Message(M_WARNING,"%s: fragmented packet addressed to secnet; " - "ignoring it\n",st->name); + unsigned fraginfo = ntohs(h->iph.frag); + if ((fraginfo&(IPHDR_FRAG_OFF|IPHDR_FRAG_MORE))!=0) { + if (!(fraginfo & IPHDR_FRAG_OFF)) + /* report only for first fragment */ + Message(M_WARNING,"%s: fragmented packet addressed to secnet; " + "ignoring it\n",st->name); BUF_FREE(buf); return; } if (h->iph.protocol==1) { /* It's ICMP */ - if (h->type==8 && h->code==0) { + if (h->type==ICMP_TYPE_ECHO_REQUEST && h->code==0) { /* ICMP echo-request. Special case: we re-use the buffer to construct the reply. */ - h->type=0; + h->type=ICMP_TYPE_ECHO_REPLY; h->iph.daddr=h->iph.saddr; h->iph.saddr=htonl(st->secnet_address); - h->iph.ttl=255; /* Be nice and bump it up again... */ + h->iph.ttl=255; h->iph.check=0; h->iph.check=ip_fast_csum((uint8_t *)h,h->iph.ihl); netlink_icmp_csum(h); @@ -440,7 +850,8 @@ static void netlink_packet_local(struct netlink *st, Message(M_WARNING,"%s: unknown incoming ICMP\n",st->name); } else { /* Send ICMP protocol unreachable */ - netlink_icmp_simple(st,buf,client,3,2); + netlink_icmp_simple(st,sender,buf,ICMP_TYPE_UNREACHABLE, + ICMP_CODE_PROTOCOL_UNREACHABLE,icmp_noinfo); BUF_FREE(buf); return; } @@ -450,19 +861,24 @@ static void netlink_packet_local(struct netlink *st, /* If cid==NULL packet is from host, otherwise cid specifies which tunnel it came from. */ -static void netlink_incoming(struct netlink *st, struct netlink_client *client, +static void netlink_incoming(struct netlink *st, struct netlink_client *sender, struct buffer_if *buf) { uint32_t source,dest; struct iphdr *iph; + char errmsgbuf[50]; + const char *sourcedesc=sender?sender->name:"host"; BUF_ASSERT_USED(buf); - if (!netlink_check(st,buf)) { - Message(M_WARNING,"%s: bad IP packet from %s\n", - st->name,client?client->name:"host"); + + if (!netlink_check(st,buf,errmsgbuf,sizeof(errmsgbuf))) { + Message(M_WARNING,"%s: bad IP packet from %s: %s\n", + st->name,sourcedesc, + errmsgbuf); BUF_FREE(buf); return; } + assert(buf->size >= (int)sizeof(struct iphdr)); iph=(struct iphdr *)buf->start; source=ntohl(iph->saddr); @@ -471,16 +887,15 @@ static void netlink_incoming(struct netlink *st, struct netlink_client *client, /* Check source. If we don't like the source, there's no point generating ICMP because we won't know how to get it to the source of the packet. */ - if (client) { + if (sender) { /* Check that the packet source is appropriate for the tunnel it came down */ - if (!ipset_contains_addr(client->networks,source)) { + if (!ipset_contains_addr(sender->networks,source)) { string_t s,d; s=ipaddr_to_string(source); d=ipaddr_to_string(dest); Message(M_WARNING,"%s: packet from tunnel %s with bad " - "source address (s=%s,d=%s)\n",st->name,client->name,s,d); - free(s); free(d); + "source address (s=%s,d=%s)\n",st->name,sender->name,s,d); BUF_FREE(buf); return; } @@ -494,7 +909,6 @@ static void netlink_incoming(struct netlink *st, struct netlink_client *client, d=ipaddr_to_string(dest); Message(M_WARNING,"%s: outgoing packet with bad source address " "(s=%s,d=%s)\n",st->name,s,d); - free(s); free(d); BUF_FREE(buf); return; } @@ -506,10 +920,10 @@ static void netlink_incoming(struct netlink *st, struct netlink_client *client, where it came from. It's up to external software to check address validity and generate ICMP, etc. */ if (st->ptp) { - if (client) { - st->deliver_to_host(st->dst,buf); + if (sender) { + netlink_host_deliver(st,sender,source,dest,buf); } else { - st->clients->deliver(st->clients->dst,buf); + netlink_client_deliver(st,st->clients,source,dest,buf); } BUF_ASSERT_FREE(buf); return; @@ -518,11 +932,11 @@ static void netlink_incoming(struct netlink *st, struct netlink_client *client, /* st->secnet_address needs checking before matching destination addresses */ if (dest==st->secnet_address) { - netlink_packet_local(st,client,buf); + netlink_packet_local(st,sender,buf); BUF_ASSERT_FREE(buf); return; } - netlink_packet_forward(st,client,buf); + netlink_packet_forward(st,sender,buf); BUF_ASSERT_FREE(buf); } @@ -556,13 +970,12 @@ static void netlink_set_quality(void *sst, uint32_t quality) static void netlink_output_subnets(struct netlink *st, uint32_t loglevel, struct subnet_list *snets) { - uint32_t i; + int32_t i; string_t net; for (i=0; ientries; i++) { net=subnet_to_string(snets->list[i]); Message(loglevel,"%s ",net); - free(net); } } @@ -575,31 +988,31 @@ static void netlink_dump_routes(struct netlink *st, bool_t requested) if (requested) c=M_WARNING; if (st->ptp) { net=ipaddr_to_string(st->secnet_address); - Message(c,"%s: point-to-point (remote end is %s); routes:\n", + Message(c,"%s: point-to-point (remote end is %s); routes: ", st->name, net); - free(net); netlink_output_subnets(st,c,st->clients->subnets); Message(c,"\n"); } else { Message(c,"%s: routing table:\n",st->name); for (i=0; in_clients; i++) { netlink_output_subnets(st,c,st->routes[i]->subnets); - Message(c,"-> tunnel %s (%s,%s routes,%s,quality %d,use %d)\n", + Message(c,"-> tunnel %s (%s,mtu %d,%s routes,%s," + "quality %d,use %d,pri %lu)\n", st->routes[i]->name, + st->routes[i]->up?"up":"down", + st->routes[i]->mtu, st->routes[i]->options&OPT_SOFTROUTE?"soft":"hard", st->routes[i]->options&OPT_ALLOWROUTE?"free":"restricted", - st->routes[i]->up?"up":"down", st->routes[i]->link_quality, - st->routes[i]->outcount); + st->routes[i]->outcount, + (unsigned long)st->routes[i]->priority); } net=ipaddr_to_string(st->secnet_address); Message(c,"%s/32 -> netlink \"%s\" (use %d)\n", net,st->name,st->localcount); - free(net); for (i=0; isubnets->entries; i++) { net=subnet_to_string(st->subnets->list[i]); Message(c,"%s ",net); - free(net); } if (i>0) Message(c,"-> host (use %d)\n",st->outcount); @@ -621,17 +1034,19 @@ static void netlink_phase_hook(void *sst, uint32_t new_phase) { struct netlink *st=sst; struct netlink_client *c; - uint32_t i; + int32_t i; /* All the networks serviced by the various tunnels should now * have been registered. We build a routing table by sorting the * clients by priority. */ - st->routes=safe_malloc(st->n_clients*sizeof(*st->routes), - "netlink_phase_hook"); + st->routes=safe_malloc_ary(sizeof(*st->routes),st->n_clients, + "netlink_phase_hook"); /* Fill the table */ i=0; - for (c=st->clients; c; c=c->next) + for (c=st->clients; c; c=c->next) { + assert(iroutes[i++]=c; + } /* Sort the table in descending order of priority */ qsort(st->routes,st->n_clients,sizeof(*st->routes), netlink_compare_client_priority); @@ -646,28 +1061,7 @@ static void netlink_signal_handler(void *sst, int signum) netlink_dump_routes(st,True); } -static void netlink_inst_output_config(void *sst, struct buffer_if *buf) -{ -/* struct netlink_client *c=sst; */ -/* struct netlink *st=c->nst; */ - - /* For now we don't output anything */ - BUF_ASSERT_USED(buf); -} - -static bool_t netlink_inst_check_config(void *sst, struct buffer_if *buf) -{ -/* struct netlink_client *c=sst; */ -/* struct netlink *st=c->nst; */ - - BUF_ASSERT_USED(buf); - /* We need to eat all of the configuration information from the buffer - for backward compatibility. */ - buf->size=0; - return True; -} - -static void netlink_inst_set_mtu(void *sst, uint32_t new_mtu) +static void netlink_inst_set_mtu(void *sst, int32_t new_mtu) { struct netlink_client *c=sst; @@ -675,16 +1069,16 @@ static void netlink_inst_set_mtu(void *sst, uint32_t new_mtu) } static void netlink_inst_reg(void *sst, netlink_deliver_fn *deliver, - void *dst, uint32_t max_start_pad, - uint32_t max_end_pad) + void *dst, uint32_t *localmtu_r) { struct netlink_client *c=sst; struct netlink *st=c->nst; - if (max_start_pad > st->max_start_pad) st->max_start_pad=max_start_pad; - if (max_end_pad > st->max_end_pad) st->max_end_pad=max_end_pad; c->deliver=deliver; c->dst=dst; + + if (localmtu_r) + *localmtu_r=st->mtu; } static struct flagstr netlink_option_table[]={ @@ -703,7 +1097,8 @@ static closure_t *netlink_inst_create(struct netlink *st, struct netlink_client *c; string_t name; struct ipset *networks; - uint32_t options,priority,mtu; + uint32_t options,priority; + int32_t mtu; list_t *l; name=dict_read_string(dict, "name", True, st->name, loc); @@ -752,8 +1147,6 @@ static closure_t *netlink_inst_create(struct netlink *st, c->ops.reg=netlink_inst_reg; c->ops.deliver=netlink_inst_incoming; c->ops.set_quality=netlink_set_quality; - c->ops.output_config=netlink_inst_output_config; - c->ops.check_config=netlink_inst_check_config; c->ops.set_mtu=netlink_inst_set_mtu; c->nst=st; @@ -763,7 +1156,7 @@ static closure_t *netlink_inst_create(struct netlink *st, c->deliver=NULL; c->dst=NULL; c->name=name; - c->link_quality=LINK_QUALITY_DOWN; + c->link_quality=LINK_QUALITY_UNUSED; c->mtu=mtu?mtu:st->mtu; c->options=options; c->outcount=0; @@ -771,6 +1164,7 @@ static closure_t *netlink_inst_create(struct netlink *st, c->kup=False; c->next=st->clients; st->clients=c; + assert(st->n_clients < INT_MAX); st->n_clients++; return &c->cl; @@ -798,7 +1192,7 @@ static list_t *netlink_inst_apply(closure_t *self, struct cloc loc, netlink_deliver_fn *netlink_init(struct netlink *st, void *dst, struct cloc loc, - dict_t *dict, string_t description, + dict_t *dict, cstring_t description, netlink_route_fn *set_routes, netlink_deliver_fn *to_host) { @@ -810,8 +1204,6 @@ netlink_deliver_fn *netlink_init(struct netlink *st, st->cl.type=CL_PURE; st->cl.apply=netlink_inst_apply; st->cl.interface=st; - st->max_start_pad=0; - st->max_end_pad=0; st->clients=NULL; st->routes=NULL; st->n_clients=0; @@ -824,9 +1216,10 @@ netlink_deliver_fn *netlink_init(struct netlink *st, if (l) st->networks=string_list_to_ipset(l,loc,st->name,"networks"); else { - Message(M_WARNING,"%s: no local networks (parameter \"networks\") " - "defined\n",st->name); - st->networks=ipset_new(); + struct ipset *empty; + empty=ipset_new(); + st->networks=ipset_complement(empty); + ipset_free(empty); } l=dict_lookup(dict,"remote-networks"); if (l) { @@ -838,6 +1231,8 @@ netlink_deliver_fn *netlink_init(struct netlink *st, st->remote_networks=ipset_complement(empty); ipset_free(empty); } + st->local_address=string_item_to_ipaddr( + dict_find_item(dict,"local-address", True, "netlink", loc),"netlink"); sa=dict_find_item(dict,"secnet-address",False,"netlink",loc); ptpa=dict_find_item(dict,"ptp-address",False,"netlink",loc); @@ -861,7 +1256,7 @@ netlink_deliver_fn *netlink_init(struct netlink *st, though, and will make the route dump look complicated... */ st->subnets=ipset_to_subnet_list(st->networks); st->mtu=dict_read_number(dict, "mtu", False, "netlink", loc, DEFAULT_MTU); - buffer_new(&st->icmp,ICMP_BUFSIZE); + buffer_new(&st->icmp,MAX(ICMP_BUFSIZE,st->mtu)); st->outcount=0; st->localcount=0; @@ -926,7 +1321,6 @@ static list_t *null_apply(closure_t *self, struct cloc loc, dict_t *context, return new_closure(&st->nl.cl); } -init_module netlink_module; void netlink_module(dict_t *dict) { add_closure(dict,"null-netlink",null_apply);