1/*-
2 * Copyright (c) 2018 The FreeBSD Foundation
3 *
4 * This software was developed by Mark Johnston under sponsorship from
5 * the FreeBSD Foundation.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions are
9 * met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in
14 *    the documentation and/or other materials provided with the
15 *    distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD$");
32
33#include <sys/param.h>
34#include <sys/ioctl.h>
35#include <sys/socket.h>
36#include <sys/sysctl.h>
37
38#include <net/bpf.h>
39#include <net/if.h>
40#include <netinet/in.h>
41#include <netinet/ip.h>
42#include <netinet/ip_var.h>
43
44#include <err.h>
45#include <errno.h>
46#include <fcntl.h>
47#include <ifaddrs.h>
48#include <stdint.h>
49#include <stdlib.h>
50#include <time.h>
51#include <unistd.h>
52
53#include <atf-c.h>
54
55struct lopacket {
56	u_int		family;
57	struct ip	hdr;
58	char		payload[];
59};
60
61static void
62update_cksum(struct ip *ip)
63{
64	size_t i;
65	uint32_t cksum;
66	uint16_t *cksump;
67
68	ip->ip_sum = 0;
69	cksump = (uint16_t *)ip;
70	for (cksum = 0, i = 0; i < sizeof(*ip) / sizeof(*cksump); cksump++, i++)
71		cksum += ntohs(*cksump);
72	cksum = (cksum >> 16) + (cksum & 0xffff);
73	cksum = ~(cksum + (cksum >> 16));
74	ip->ip_sum = htons((uint16_t)cksum);
75}
76
77static struct lopacket *
78alloc_lopacket(in_addr_t dstaddr, size_t payloadlen)
79{
80	struct ip *ip;
81	struct lopacket *packet;
82	size_t pktlen;
83
84	pktlen = sizeof(*packet) + payloadlen;
85	packet = malloc(pktlen);
86	ATF_REQUIRE(packet != NULL);
87
88	memset(packet, 0, pktlen);
89	packet->family = AF_INET;
90
91	ip = &packet->hdr;
92	ip->ip_hl = sizeof(struct ip) >> 2;
93	ip->ip_v = 4;
94	ip->ip_tos = 0;
95	ip->ip_len = htons(sizeof(*ip) + payloadlen);
96	ip->ip_id = 0;
97	ip->ip_off = 0;
98	ip->ip_ttl = 1;
99	ip->ip_p = IPPROTO_IP;
100	ip->ip_sum = 0;
101	ip->ip_src.s_addr = dstaddr;
102	ip->ip_dst.s_addr = dstaddr;
103	update_cksum(ip);
104
105	return (packet);
106}
107
108static void
109free_lopacket(struct lopacket *packet)
110{
111
112	free(packet);
113}
114
115static void
116write_lopacket(int bpffd, struct lopacket *packet)
117{
118	struct timespec ts;
119	ssize_t n;
120	size_t len;
121
122	len = sizeof(packet->family) + ntohs(packet->hdr.ip_len);
123	n = write(bpffd, packet, len);
124	ATF_REQUIRE_MSG(n >= 0, "packet write failed: %s", strerror(errno));
125	ATF_REQUIRE_MSG((size_t)n == len, "wrote %zd bytes instead of %zu",
126	    n, len);
127
128	/*
129	 * Loopback packets are dispatched asynchronously, give netisr some
130	 * time.
131	 */
132	ts.tv_sec = 0;
133	ts.tv_nsec = 5000000; /* 5ms */
134	(void)nanosleep(&ts, NULL);
135}
136
137static int
138open_lobpf(in_addr_t *addrp)
139{
140	struct ifreq ifr;
141	struct ifaddrs *ifa, *ifap;
142	int error, fd;
143
144	fd = open("/dev/bpf0", O_RDWR);
145	if (fd < 0 && errno == ENOENT)
146		atf_tc_skip("no BPF device available");
147	ATF_REQUIRE_MSG(fd >= 0, "open(/dev/bpf0): %s", strerror(errno));
148
149	error = getifaddrs(&ifap);
150	ATF_REQUIRE(error == 0);
151	for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next)
152		if ((ifa->ifa_flags & IFF_LOOPBACK) != 0 &&
153		    ifa->ifa_addr->sa_family == AF_INET)
154			break;
155	if (ifa == NULL)
156		atf_tc_skip("no loopback address found");
157
158	memset(&ifr, 0, sizeof(ifr));
159	strlcpy(ifr.ifr_name, ifa->ifa_name, IFNAMSIZ);
160	error = ioctl(fd, BIOCSETIF, &ifr);
161	ATF_REQUIRE_MSG(error == 0, "ioctl(BIOCSETIF): %s", strerror(errno));
162
163	*addrp = ((struct sockaddr_in *)(void *)ifa->ifa_addr)->sin_addr.s_addr;
164
165	freeifaddrs(ifap);
166
167	return (fd);
168}
169
170static void
171get_ipstat(struct ipstat *stat)
172{
173	size_t len;
174	int error;
175
176	memset(stat, 0, sizeof(*stat));
177	len = sizeof(*stat);
178	error = sysctlbyname("net.inet.ip.stats", stat, &len, NULL, 0);
179	ATF_REQUIRE_MSG(error == 0, "sysctl(net.inet.ip.stats) failed: %s",
180	    strerror(errno));
181	ATF_REQUIRE(len == sizeof(*stat));
182}
183
184#define	CHECK_IP_COUNTER(oldp, newp, counter)				\
185	ATF_REQUIRE_MSG((oldp)->ips_ ## counter < (newp)->ips_ ## counter, \
186	    "ips_" #counter " wasn't incremented (%ju vs. %ju)",	\
187	    (uintmax_t)old.ips_ ## counter, (uintmax_t)new.ips_## counter);
188
189/*
190 * Make sure a fragment with MF set doesn't come after the last fragment of a
191 * packet.  Make sure that multiple fragments with MF clear have the same offset
192 * and length.
193 */
194ATF_TC(ip_reass__multiple_last_fragments);
195ATF_TC_HEAD(ip_reass__multiple_last_fragments, tc)
196{
197	atf_tc_set_md_var(tc, "require.user", "root");
198}
199ATF_TC_BODY(ip_reass__multiple_last_fragments, tc)
200{
201	struct ipstat old, new;
202	struct ip *ip;
203	struct lopacket *packet1, *packet2, *packet3, *packet4;
204	in_addr_t addr;
205	int error, fd;
206	uint16_t ipid;
207
208	fd = open_lobpf(&addr);
209	ipid = arc4random_uniform(UINT16_MAX + 1);
210
211	packet1 = alloc_lopacket(addr, 16);
212	ip = &packet1->hdr;
213	ip->ip_id = ipid;
214	ip->ip_off = htons(0x10);
215	update_cksum(ip);
216
217	packet2 = alloc_lopacket(addr, 16);
218	ip = &packet2->hdr;
219	ip->ip_id = ipid;
220	ip->ip_off = htons(0x20);
221	update_cksum(ip);
222
223	packet3 = alloc_lopacket(addr, 16);
224	ip = &packet3->hdr;
225	ip->ip_id = ipid;
226	ip->ip_off = htons(0x8);
227	update_cksum(ip);
228
229	packet4 = alloc_lopacket(addr, 32);
230	ip = &packet4->hdr;
231	ip->ip_id = ipid;
232	ip->ip_off = htons(0x10);
233	update_cksum(ip);
234
235	write_lopacket(fd, packet1);
236
237	/* packet2 comes after packet1. */
238	get_ipstat(&old);
239	write_lopacket(fd, packet2);
240	get_ipstat(&new);
241	CHECK_IP_COUNTER(&old, &new, fragdropped);
242
243	/* packet2 comes after packet1 and has MF set. */
244	packet2->hdr.ip_off = htons(IP_MF | 0x20);
245	update_cksum(&packet2->hdr);
246	get_ipstat(&old);
247	write_lopacket(fd, packet2);
248	get_ipstat(&new);
249	CHECK_IP_COUNTER(&old, &new, fragdropped);
250
251	/* packet3 comes before packet1 but overlaps. */
252	get_ipstat(&old);
253	write_lopacket(fd, packet3);
254	get_ipstat(&new);
255	CHECK_IP_COUNTER(&old, &new, fragdropped);
256
257	/* packet4 has the same offset as packet1 but is longer. */
258	get_ipstat(&old);
259	write_lopacket(fd, packet4);
260	get_ipstat(&new);
261	CHECK_IP_COUNTER(&old, &new, fragdropped);
262
263	error = close(fd);
264	ATF_REQUIRE(error == 0);
265	free_lopacket(packet1);
266	free_lopacket(packet2);
267	free_lopacket(packet3);
268	free_lopacket(packet4);
269}
270
271/*
272 * Make sure that we reject zero-length fragments.
273 */
274ATF_TC(ip_reass__zero_length_fragment);
275ATF_TC_HEAD(ip_reass__zero_length_fragment, tc)
276{
277	atf_tc_set_md_var(tc, "require.user", "root");
278}
279ATF_TC_BODY(ip_reass__zero_length_fragment, tc)
280{
281	struct ipstat old, new;
282	struct ip *ip;
283	struct lopacket *packet1, *packet2;
284	in_addr_t addr;
285	int error, fd;
286	uint16_t ipid;
287
288	fd = open_lobpf(&addr);
289	ipid = arc4random_uniform(UINT16_MAX + 1);
290
291	/*
292	 * Create two packets, one with MF set, one without.
293	 */
294	packet1 = alloc_lopacket(addr, 0);
295	ip = &packet1->hdr;
296	ip->ip_id = ipid;
297	ip->ip_off = htons(IP_MF | 0x10);
298	update_cksum(ip);
299
300	packet2 = alloc_lopacket(addr, 0);
301	ip = &packet2->hdr;
302	ip->ip_id = ~ipid;
303	ip->ip_off = htons(0x10);
304	update_cksum(ip);
305
306	get_ipstat(&old);
307	write_lopacket(fd, packet1);
308	get_ipstat(&new);
309	CHECK_IP_COUNTER(&old, &new, toosmall);
310	CHECK_IP_COUNTER(&old, &new, fragdropped);
311
312	get_ipstat(&old);
313	write_lopacket(fd, packet2);
314	get_ipstat(&new);
315	CHECK_IP_COUNTER(&old, &new, toosmall);
316	CHECK_IP_COUNTER(&old, &new, fragdropped);
317
318	error = close(fd);
319	ATF_REQUIRE(error == 0);
320	free_lopacket(packet1);
321	free_lopacket(packet2);
322}
323
324ATF_TC(ip_reass__large_fragment);
325ATF_TC_HEAD(ip_reass__large_fragment, tc)
326{
327	atf_tc_set_md_var(tc, "require.user", "root");
328}
329ATF_TC_BODY(ip_reass__large_fragment, tc)
330{
331	struct ipstat old, new;
332	struct ip *ip;
333	struct lopacket *packet1, *packet2;
334	in_addr_t addr;
335	int error, fd;
336	uint16_t ipid;
337
338	fd = open_lobpf(&addr);
339	ipid = arc4random_uniform(UINT16_MAX + 1);
340
341	/*
342	 * Create two packets, one with MF set, one without.
343	 *
344	 * 16 + (0x1fff << 3) > IP_MAXPACKET, so these should fail the check.
345	 */
346	packet1 = alloc_lopacket(addr, 16);
347	ip = &packet1->hdr;
348	ip->ip_id = ipid;
349	ip->ip_off = htons(IP_MF | 0x1fff);
350	update_cksum(ip);
351
352	packet2 = alloc_lopacket(addr, 16);
353	ip = &packet2->hdr;
354	ip->ip_id = ipid;
355	ip->ip_off = htons(0x1fff);
356	update_cksum(ip);
357
358	get_ipstat(&old);
359	write_lopacket(fd, packet1);
360	get_ipstat(&new);
361	CHECK_IP_COUNTER(&old, &new, toolong);
362	CHECK_IP_COUNTER(&old, &new, fragdropped);
363
364	get_ipstat(&old);
365	write_lopacket(fd, packet2);
366	get_ipstat(&new);
367	CHECK_IP_COUNTER(&old, &new, toolong);
368	CHECK_IP_COUNTER(&old, &new, fragdropped);
369
370	error = close(fd);
371	ATF_REQUIRE(error == 0);
372	free_lopacket(packet1);
373	free_lopacket(packet2);
374}
375
376ATF_TP_ADD_TCS(tp)
377{
378	ATF_TP_ADD_TC(tp, ip_reass__multiple_last_fragments);
379	ATF_TP_ADD_TC(tp, ip_reass__zero_length_fragment);
380	ATF_TP_ADD_TC(tp, ip_reass__large_fragment);
381
382	return (atf_no_error());
383}
384