1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2019 Isilon Systems, LLC.
5 * Copyright (c) 2005-2014 Sandvine Incorporated. All rights reserved.
6 * Copyright (c) 2000 Darrell Anderson
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31#include <sys/cdefs.h>
32__FBSDID("$FreeBSD$");
33
34#include "opt_inet.h"
35
36#include <sys/param.h>
37#include <sys/systm.h>
38#include <sys/errno.h>
39#include <sys/socket.h>
40#include <sys/sysctl.h>
41
42#include <net/ethernet.h>
43#include <net/if.h>
44#include <net/if_arp.h>
45#include <net/if_dl.h>
46#include <net/if_types.h>
47#include <net/if_var.h>
48
49#include <netinet/in.h>
50#include <netinet/in_systm.h>
51#include <netinet/in_var.h>
52#include <netinet/ip.h>
53#include <netinet/ip_var.h>
54#include <netinet/ip_options.h>
55#include <netinet/udp.h>
56#include <netinet/udp_var.h>
57
58#include <machine/in_cksum.h>
59#include <machine/pcb.h>
60
61#include <net/debugnet.h>
62#define	DEBUGNET_INTERNAL
63#include <net/debugnet_int.h>
64
65int debugnet_arp_nretries = 3;
66SYSCTL_INT(_net_debugnet, OID_AUTO, arp_nretries, CTLFLAG_RWTUN,
67    &debugnet_arp_nretries, 0,
68    "Number of ARP attempts before giving up");
69
70/*
71 * Handler for IP packets: checks their sanity and then processes any debugnet
72 * ACK packets it finds.
73 *
74 * It needs to partially replicate the behaviour of ip_input() and udp_input().
75 *
76 * Parameters:
77 *	pcb	a pointer to the live debugnet PCB
78 *	mb	a pointer to an mbuf * containing the packet received
79 *		Updates *mb if m_pullup et al change the pointer
80 *		Assumes the calling function will take care of freeing the mbuf
81 */
82void
83debugnet_handle_ip(struct debugnet_pcb *pcb, struct mbuf **mb)
84{
85	struct ip *ip;
86	struct mbuf *m;
87	unsigned short hlen;
88
89	/* IP processing. */
90	m = *mb;
91	if (m->m_pkthdr.len < sizeof(struct ip)) {
92		DNETDEBUG("dropping packet too small for IP header\n");
93		return;
94	}
95	if (m->m_len < sizeof(struct ip)) {
96		m = m_pullup(m, sizeof(struct ip));
97		*mb = m;
98		if (m == NULL) {
99			DNETDEBUG("m_pullup failed\n");
100			return;
101		}
102	}
103	ip = mtod(m, struct ip *);
104
105	/* IP version. */
106	if (ip->ip_v != IPVERSION) {
107		DNETDEBUG("bad IP version %d\n", ip->ip_v);
108		return;
109	}
110
111	/* Header length. */
112	hlen = ip->ip_hl << 2;
113	if (hlen < sizeof(struct ip)) {
114		DNETDEBUG("bad IP header length (%hu)\n", hlen);
115		return;
116	}
117	if (hlen > m->m_len) {
118		m = m_pullup(m, hlen);
119		*mb = m;
120		if (m == NULL) {
121			DNETDEBUG("m_pullup failed\n");
122			return;
123		}
124		ip = mtod(m, struct ip *);
125	}
126	/* Ignore packets with IP options. */
127	if (hlen > sizeof(struct ip)) {
128		DNETDEBUG("drop packet with IP options\n");
129		return;
130	}
131
132#ifdef INVARIANTS
133	if ((IN_LOOPBACK(ntohl(ip->ip_dst.s_addr)) ||
134	    IN_LOOPBACK(ntohl(ip->ip_src.s_addr))) &&
135	    (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {
136		DNETDEBUG("Bad IP header (RFC1122)\n");
137		return;
138	}
139#endif
140
141	/* Checksum. */
142	if ((m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) != 0) {
143		if ((m->m_pkthdr.csum_flags & CSUM_IP_VALID) == 0) {
144			DNETDEBUG("bad IP checksum\n");
145			return;
146		}
147	} else {
148		/* XXX */ ;
149	}
150
151	/* Convert fields to host byte order. */
152	ip->ip_len = ntohs(ip->ip_len);
153	if (ip->ip_len < hlen) {
154		DNETDEBUG("IP packet smaller (%hu) than header (%hu)\n",
155		    ip->ip_len, hlen);
156		return;
157	}
158	if (m->m_pkthdr.len < ip->ip_len) {
159		DNETDEBUG("IP packet bigger (%hu) than ethernet packet (%d)\n",
160		    ip->ip_len, m->m_pkthdr.len);
161		return;
162	}
163	if (m->m_pkthdr.len > ip->ip_len) {
164		/* Truncate the packet to the IP length. */
165		if (m->m_len == m->m_pkthdr.len) {
166			m->m_len = ip->ip_len;
167			m->m_pkthdr.len = ip->ip_len;
168		} else
169			m_adj(m, ip->ip_len - m->m_pkthdr.len);
170	}
171
172	ip->ip_off = ntohs(ip->ip_off);
173
174	/* Check that the source is the server's IP. */
175	if (ip->ip_src.s_addr != pcb->dp_server) {
176		DNETDEBUG("drop packet not from server (from 0x%x)\n",
177		    ip->ip_src.s_addr);
178		return;
179	}
180
181	/* Check if the destination IP is ours. */
182	if (ip->ip_dst.s_addr != pcb->dp_client) {
183		DNETDEBUGV("drop packet not to our IP\n");
184		return;
185	}
186
187	if (ip->ip_p != IPPROTO_UDP) {
188		DNETDEBUG("drop non-UDP packet\n");
189		return;
190	}
191
192	/* Do not deal with fragments. */
193	if ((ip->ip_off & (IP_MF | IP_OFFMASK)) != 0) {
194		DNETDEBUG("drop fragmented packet\n");
195		return;
196	}
197
198	if ((m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) != 0) {
199		if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID) == 0) {
200			DNETDEBUG("bad UDP checksum\n");
201			return;
202		}
203	} else {
204		/* XXX */ ;
205	}
206
207	/* UDP custom is to have packet length not include IP header. */
208	ip->ip_len -= hlen;
209
210	/* Checked above before decoding IP header. */
211	MPASS(m->m_pkthdr.len >= sizeof(struct ipovly));
212
213	/* Put the UDP header at start of chain. */
214	m_adj(m, sizeof(struct ipovly));
215	debugnet_handle_udp(pcb, mb);
216}
217
218/*
219 * Builds and sends a single ARP request to locate the L2 address for a given
220 * INET address.
221 *
222 * Return value:
223 *	0 on success
224 *	errno on error
225 */
226static int
227debugnet_send_arp(struct debugnet_pcb *pcb, in_addr_t dst)
228{
229	struct ether_addr bcast;
230	struct arphdr *ah;
231	struct ifnet *ifp;
232	struct mbuf *m;
233	int pktlen;
234
235	ifp = pcb->dp_ifp;
236
237	/* Fill-up a broadcast address. */
238	memset(&bcast, 0xFF, ETHER_ADDR_LEN);
239	m = m_gethdr(M_NOWAIT, MT_DATA);
240	if (m == NULL) {
241		printf("%s: Out of mbufs\n", __func__);
242		return (ENOBUFS);
243	}
244	pktlen = arphdr_len2(ETHER_ADDR_LEN, sizeof(struct in_addr));
245	m->m_len = pktlen;
246	m->m_pkthdr.len = pktlen;
247	MH_ALIGN(m, pktlen);
248	ah = mtod(m, struct arphdr *);
249	ah->ar_hrd = htons(ARPHRD_ETHER);
250	ah->ar_pro = htons(ETHERTYPE_IP);
251	ah->ar_hln = ETHER_ADDR_LEN;
252	ah->ar_pln = sizeof(struct in_addr);
253	ah->ar_op = htons(ARPOP_REQUEST);
254	memcpy(ar_sha(ah), IF_LLADDR(ifp), ETHER_ADDR_LEN);
255	((struct in_addr *)ar_spa(ah))->s_addr = pcb->dp_client;
256	bzero(ar_tha(ah), ETHER_ADDR_LEN);
257	((struct in_addr *)ar_tpa(ah))->s_addr = dst;
258	return (debugnet_ether_output(m, ifp, bcast, ETHERTYPE_ARP));
259}
260
261/*
262 * Handler for ARP packets: checks their sanity and then
263 * 1. If the ARP is a request for our IP, respond with our MAC address
264 * 2. If the ARP is a response from our server, record its MAC address
265 *
266 * It needs to replicate partially the behaviour of arpintr() and
267 * in_arpinput().
268 *
269 * Parameters:
270 *	pcb	a pointer to the live debugnet PCB
271 *	mb	a pointer to an mbuf * containing the packet received
272 *		Updates *mb if m_pullup et al change the pointer
273 *		Assumes the calling function will take care of freeing the mbuf
274 */
275void
276debugnet_handle_arp(struct debugnet_pcb *pcb, struct mbuf **mb)
277{
278	char buf[INET_ADDRSTRLEN];
279	struct in_addr isaddr, itaddr;
280	struct ether_addr dst;
281	struct mbuf *m;
282	struct arphdr *ah;
283	struct ifnet *ifp;
284	uint8_t *enaddr;
285	int req_len, op;
286
287	m = *mb;
288	ifp = m->m_pkthdr.rcvif;
289	if (m->m_len < sizeof(struct arphdr)) {
290		m = m_pullup(m, sizeof(struct arphdr));
291		*mb = m;
292		if (m == NULL) {
293			DNETDEBUG("runt packet: m_pullup failed\n");
294			return;
295		}
296	}
297
298	ah = mtod(m, struct arphdr *);
299	if (ntohs(ah->ar_hrd) != ARPHRD_ETHER) {
300		DNETDEBUG("unknown hardware address 0x%2D)\n",
301		    (unsigned char *)&ah->ar_hrd, "");
302		return;
303	}
304	if (ntohs(ah->ar_pro) != ETHERTYPE_IP) {
305		DNETDEBUG("drop ARP for unknown protocol %d\n",
306		    ntohs(ah->ar_pro));
307		return;
308	}
309	req_len = arphdr_len2(ifp->if_addrlen, sizeof(struct in_addr));
310	if (m->m_len < req_len) {
311		m = m_pullup(m, req_len);
312		*mb = m;
313		if (m == NULL) {
314			DNETDEBUG("runt packet: m_pullup failed\n");
315			return;
316		}
317	}
318	ah = mtod(m, struct arphdr *);
319
320	op = ntohs(ah->ar_op);
321	memcpy(&isaddr, ar_spa(ah), sizeof(isaddr));
322	memcpy(&itaddr, ar_tpa(ah), sizeof(itaddr));
323	enaddr = (uint8_t *)IF_LLADDR(ifp);
324
325	if (memcmp(ar_sha(ah), enaddr, ifp->if_addrlen) == 0) {
326		DNETDEBUG("ignoring ARP from myself\n");
327		return;
328	}
329
330	if (isaddr.s_addr == pcb->dp_client) {
331		printf("%s: %*D is using my IP address %s!\n", __func__,
332		    ifp->if_addrlen, (u_char *)ar_sha(ah), ":",
333		    inet_ntoa_r(isaddr, buf));
334		return;
335	}
336
337	if (memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen) == 0) {
338		DNETDEBUG("ignoring ARP from broadcast address\n");
339		return;
340	}
341
342	if (op == ARPOP_REPLY) {
343		if (isaddr.s_addr != pcb->dp_gateway &&
344		    isaddr.s_addr != pcb->dp_server) {
345			inet_ntoa_r(isaddr, buf);
346			DNETDEBUG("ignoring ARP reply from %s (not configured"
347			    " server or gateway)\n", buf);
348			return;
349		}
350		memcpy(pcb->dp_gw_mac.octet, ar_sha(ah),
351		    min(ah->ar_hln, ETHER_ADDR_LEN));
352
353		DNETDEBUG("got server MAC address %6D\n",
354		    pcb->dp_gw_mac.octet, ":");
355
356		MPASS(pcb->dp_state == DN_STATE_INIT);
357		pcb->dp_state = DN_STATE_HAVE_GW_MAC;
358		return;
359	}
360
361	if (op != ARPOP_REQUEST) {
362		DNETDEBUG("ignoring ARP non-request/reply\n");
363		return;
364	}
365
366	if (itaddr.s_addr != pcb->dp_client) {
367		DNETDEBUG("ignoring ARP not to our IP\n");
368		return;
369	}
370
371	memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln);
372	memcpy(ar_sha(ah), enaddr, ah->ar_hln);
373	memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
374	memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
375	ah->ar_op = htons(ARPOP_REPLY);
376	ah->ar_pro = htons(ETHERTYPE_IP);
377	m->m_flags &= ~(M_BCAST|M_MCAST);
378	m->m_len = arphdr_len(ah);
379	m->m_pkthdr.len = m->m_len;
380
381	memcpy(dst.octet, ar_tha(ah), ETHER_ADDR_LEN);
382	debugnet_ether_output(m, ifp, dst, ETHERTYPE_ARP);
383	*mb = NULL;
384}
385
386/*
387 * Sends ARP requests to locate the server and waits for a response.
388 * We first try to ARP the server itself, and fall back to the provided
389 * gateway if the server appears to be off-link.
390 *
391 * Return value:
392 *	0 on success
393 *	errno on error
394 */
395int
396debugnet_arp_gw(struct debugnet_pcb *pcb)
397{
398	in_addr_t dst;
399	int error, polls, retries;
400
401	dst = pcb->dp_server;
402restart:
403	for (retries = 0; retries < debugnet_arp_nretries; retries++) {
404		error = debugnet_send_arp(pcb, dst);
405		if (error != 0)
406			return (error);
407		for (polls = 0; polls < debugnet_npolls &&
408		    pcb->dp_state < DN_STATE_HAVE_GW_MAC; polls++) {
409			debugnet_network_poll(pcb);
410			DELAY(500);
411		}
412		if (pcb->dp_state >= DN_STATE_HAVE_GW_MAC)
413			break;
414		printf("(ARP retry)");
415	}
416	if (pcb->dp_state >= DN_STATE_HAVE_GW_MAC)
417		return (0);
418	if (dst == pcb->dp_server) {
419		printf("\nFailed to ARP server");
420		if (pcb->dp_gateway != INADDR_ANY) {
421			printf(", trying to reach gateway...\n");
422			dst = pcb->dp_gateway;
423			goto restart;
424		} else
425			printf(".\n");
426	} else
427		printf("\nFailed to ARP gateway.\n");
428
429	return (ETIMEDOUT);
430}
431
432/*
433 * Unreliable IPv4 transmission of an mbuf chain to the debugnet server
434 * Note: can't handle fragmentation; fails if the packet is larger than
435 *	 ifp->if_mtu after adding the UDP/IP headers
436 *
437 * Parameters:
438 *	pcb	The debugnet context block
439 *	m	mbuf chain
440 *
441 * Returns:
442 *	int	see errno.h, 0 for success
443 */
444int
445debugnet_ip_output(struct debugnet_pcb *pcb, struct mbuf *m)
446{
447	struct udphdr *udp;
448	struct ifnet *ifp;
449	struct ip *ip;
450
451	MPASS(pcb->dp_state >= DN_STATE_HAVE_GW_MAC);
452
453	ifp = pcb->dp_ifp;
454
455	M_PREPEND(m, sizeof(*ip), M_NOWAIT);
456	if (m == NULL) {
457		printf("%s: out of mbufs\n", __func__);
458		return (ENOBUFS);
459	}
460
461	if (m->m_pkthdr.len > ifp->if_mtu) {
462		printf("%s: Packet is too big: %d > MTU %u\n", __func__,
463		    m->m_pkthdr.len, ifp->if_mtu);
464		m_freem(m);
465		return (ENOBUFS);
466	}
467
468	ip = mtod(m, void *);
469	udp = (void *)(ip + 1);
470
471	memset(ip, 0, offsetof(struct ip, ip_p));
472	ip->ip_p = IPPROTO_UDP;
473	ip->ip_sum = udp->uh_ulen;
474	ip->ip_src = (struct in_addr) { pcb->dp_client };
475	ip->ip_dst = (struct in_addr) { pcb->dp_server };
476
477	/* Compute UDP-IPv4 checksum. */
478	udp->uh_sum = in_cksum(m, m->m_pkthdr.len);
479	if (udp->uh_sum == 0)
480		udp->uh_sum = 0xffff;
481
482	ip->ip_v = IPVERSION;
483	ip->ip_hl = sizeof(*ip) >> 2;
484	ip->ip_tos = 0;
485	ip->ip_len = htons(m->m_pkthdr.len);
486	ip->ip_id = 0;
487	ip->ip_off = htons(IP_DF);
488	ip->ip_ttl = 255;
489	ip->ip_sum = 0;
490	ip->ip_sum = in_cksum(m, sizeof(struct ip));
491
492	return (debugnet_ether_output(m, ifp, pcb->dp_gw_mac, ETHERTYPE_IP));
493}
494