2 * Copyright (c) 2015 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 * ip/icmp4.c: ipv4 icmp
18 * Copyright (c) 2008 Eliot Dresselhaus
20 * Permission is hereby granted, free of charge, to any person obtaining
21 * a copy of this software and associated documentation files (the
22 * "Software"), to deal in the Software without restriction, including
23 * without limitation the rights to use, copy, modify, merge, publish,
24 * distribute, sublicense, and/or sell copies of the Software, and to
25 * permit persons to whom the Software is furnished to do so, subject to
26 * the following conditions:
28 * The above copyright notice and this permission notice shall be
29 * included in all copies or substantial portions of the Software.
31 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
32 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
33 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
34 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
35 * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
36 * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
37 * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
40 #include <vlib/vlib.h>
41 #include <vnet/ip/ip.h>
42 #include <vnet/pg/pg.h>
43 #include <vnet/ip/ip_sas.h>
44 #include <vnet/util/throttle.h>
46 static char *icmp_error_strings[] = {
52 /** ICMP throttling */
53 static throttle_t icmp_throttle;
56 format_ip4_icmp_type_and_code (u8 * s, va_list * args)
58 icmp4_type_t type = va_arg (*args, int);
59 u8 code = va_arg (*args, int);
62 #define _(n,f) case n: t = #f; break;
75 return format (s, "unknown 0x%x", type);
77 s = format (s, "%s", t);
80 switch ((type << 8) | code)
82 #define _(a,n,f) case (ICMP4_##a << 8) | (n): t = #f; break;
90 s = format (s, " %s", t);
96 format_ip4_icmp_header (u8 * s, va_list * args)
98 icmp46_header_t *icmp = va_arg (*args, icmp46_header_t *);
99 u32 max_header_bytes = va_arg (*args, u32);
102 if (max_header_bytes < sizeof (icmp[0]))
103 return format (s, "ICMP header truncated");
105 s = format (s, "ICMP %U checksum 0x%x",
106 format_ip4_icmp_type_and_code, icmp->type, icmp->code,
107 clib_net_to_host_u16 (icmp->checksum));
109 if ((ICMP4_echo_request == icmp->type || ICMP4_echo_reply == icmp->type)
110 && sizeof (icmp[0]) + sizeof (u16) < max_header_bytes)
112 s = format (s, " id %u", clib_net_to_host_u16 (*(u16 *) (icmp + 1)));
119 format_icmp_input_trace (u8 * s, va_list * va)
121 CLIB_UNUSED (vlib_main_t * vm) = va_arg (*va, vlib_main_t *);
122 CLIB_UNUSED (vlib_node_t * node) = va_arg (*va, vlib_node_t *);
123 icmp_input_trace_t *t = va_arg (*va, icmp_input_trace_t *);
126 format_ip4_header, t->packet_data, sizeof (t->packet_data));
133 ICMP_INPUT_NEXT_ERROR,
139 uword *type_and_code_by_name;
143 /* Vector dispatch table indexed by [icmp type]. */
144 u8 ip4_input_next_index_by_type[256];
147 icmp4_main_t icmp4_main;
150 ip4_icmp_input (vlib_main_t * vm,
151 vlib_node_runtime_t * node, vlib_frame_t * frame)
153 icmp4_main_t *im = &icmp4_main;
154 uword n_packets = frame->n_vectors;
156 u32 n_left_from, n_left_to_next, next;
158 from = vlib_frame_vector_args (frame);
159 n_left_from = n_packets;
160 next = node->cached_next_index;
162 if (node->flags & VLIB_NODE_FLAG_TRACE)
163 vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
165 sizeof (icmp_input_trace_t));
167 while (n_left_from > 0)
169 vlib_get_next_frame (vm, node, next, to_next, n_left_to_next);
171 while (n_left_from > 0 && n_left_to_next > 0)
175 icmp46_header_t *icmp0;
179 if (PREDICT_TRUE (n_left_from > 2))
181 vlib_prefetch_buffer_with_index (vm, from[2], LOAD);
182 p0 = vlib_get_buffer (vm, from[1]);
183 ip0 = vlib_buffer_get_current (p0);
184 clib_prefetch_load (ip0);
187 bi0 = to_next[0] = from[0];
194 p0 = vlib_get_buffer (vm, bi0);
195 ip0 = vlib_buffer_get_current (p0);
196 icmp0 = ip4_next_header (ip0);
198 next0 = im->ip4_input_next_index_by_type[type0];
200 p0->error = node->errors[ICMP4_ERROR_UNKNOWN_TYPE];
202 /* Verify speculative enqueue, maybe switch current next frame */
203 vlib_validate_buffer_enqueue_x1 (vm, node, next, to_next,
204 n_left_to_next, bi0, next0);
207 vlib_put_next_frame (vm, node, next, n_left_to_next);
210 return frame->n_vectors;
214 VLIB_REGISTER_NODE (ip4_icmp_input_node) = {
215 .function = ip4_icmp_input,
216 .name = "ip4-icmp-input",
218 .vector_size = sizeof (u32),
220 .format_trace = format_icmp_input_trace,
222 .n_errors = ARRAY_LEN (icmp_error_strings),
223 .error_strings = icmp_error_strings,
227 [ICMP_INPUT_NEXT_ERROR] = "ip4-punt",
234 IP4_ICMP_ERROR_NEXT_DROP,
235 IP4_ICMP_ERROR_NEXT_LOOKUP,
236 IP4_ICMP_ERROR_N_NEXT,
237 } ip4_icmp_error_next_t;
240 icmp4_icmp_type_to_error (u8 type)
244 case ICMP4_destination_unreachable:
245 return ICMP4_ERROR_DEST_UNREACH_SENT;
246 case ICMP4_time_exceeded:
247 return ICMP4_ERROR_TTL_EXPIRE_SENT;
248 case ICMP4_parameter_problem:
249 return ICMP4_ERROR_PARAM_PROBLEM_SENT;
251 return ICMP4_ERROR_DROP;
256 ip4_icmp_error (vlib_main_t * vm,
257 vlib_node_runtime_t * node, vlib_frame_t * frame)
260 uword n_left_from, n_left_to_next;
261 ip4_icmp_error_next_t next_index;
262 u32 thread_index = vm->thread_index;
264 from = vlib_frame_vector_args (frame);
265 n_left_from = frame->n_vectors;
266 next_index = node->cached_next_index;
268 u64 seed = throttle_seed (&icmp_throttle, thread_index, vlib_time_now (vm));
270 if (node->flags & VLIB_NODE_FLAG_TRACE)
271 vlib_trace_frame_buffers_only (vm, node, from, frame->n_vectors,
273 sizeof (icmp_input_trace_t));
275 while (n_left_from > 0)
277 vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
279 while (n_left_from > 0 && n_left_to_next > 0)
282 * Duplicate first buffer and free the original chain. Keep
283 * as much of the original packet as possible, within the
284 * minimum MTU. We chat "a little" here by keeping whatever
285 * is available in the first buffer.
289 u32 org_pi0 = from[0];
290 u32 next0 = IP4_ICMP_ERROR_NEXT_LOOKUP;
291 u8 error0 = ICMP4_ERROR_NONE;
292 vlib_buffer_t *p0, *org_p0;
293 ip4_header_t *ip0, *out_ip0;
294 icmp46_header_t *icmp0;
298 org_p0 = vlib_get_buffer (vm, org_pi0);
299 ip0 = vlib_buffer_get_current (org_p0);
301 /* Rate limit based on the src,dst addresses in the original packet
304 (u64) ip0->dst_address.as_u32 << 32 | ip0->src_address.as_u32;
306 if (throttle_check (&icmp_throttle, thread_index, r0, seed))
308 vlib_error_count (vm, node->node_index, ICMP4_ERROR_DROP, 1);
314 p0 = vlib_buffer_copy_no_chain (vm, org_p0, &pi0);
315 if (!p0 || pi0 == ~0) /* Out of buffers */
318 /* Speculatively enqueue p0 to the current next frame */
325 sw_if_index0 = vnet_buffer (p0)->sw_if_index[VLIB_RX];
327 vlib_buffer_copy_trace_flag (vm, p0, pi0);
329 /* Add IP header and ICMPv4 header including a 4 byte data field */
330 vlib_buffer_advance (p0,
331 -sizeof (ip4_header_t) -
332 sizeof (icmp46_header_t) - 4);
335 p0->current_length > 576 ? 576 : p0->current_length;
336 out_ip0 = vlib_buffer_get_current (p0);
337 icmp0 = (icmp46_header_t *) & out_ip0[1];
339 /* Fill ip header fields */
340 out_ip0->ip_version_and_header_length = 0x45;
342 out_ip0->length = clib_host_to_net_u16 (p0->current_length);
343 out_ip0->fragment_id = 0;
344 out_ip0->flags_and_fragment_offset = 0;
346 out_ip0->protocol = IP_PROTOCOL_ICMP;
347 out_ip0->dst_address = ip0->src_address;
348 /* Prefer a source address from "offending interface" */
349 if (!ip4_sas_by_sw_if_index (sw_if_index0, &out_ip0->dst_address,
350 &out_ip0->src_address))
351 { /* interface has no IP6 address - should not happen */
352 next0 = IP4_ICMP_ERROR_NEXT_DROP;
353 error0 = ICMP4_ERROR_DROP;
356 out_ip0->checksum = ip4_header_checksum (out_ip0);
358 /* Fill icmp header fields */
359 icmp0->type = vnet_buffer (p0)->ip.icmp.type;
360 icmp0->code = vnet_buffer (p0)->ip.icmp.code;
361 *((u32 *) (icmp0 + 1)) =
362 clib_host_to_net_u32 (vnet_buffer (p0)->ip.icmp.data);
365 ip_incremental_checksum (0, icmp0,
367 sizeof (ip4_header_t));
368 icmp0->checksum = ~ip_csum_fold (sum);
370 /* Update error status */
371 if (error0 == ICMP4_ERROR_NONE)
372 error0 = icmp4_icmp_type_to_error (icmp0->type);
374 vlib_error_count (vm, node->node_index, error0, 1);
376 /* Verify speculative enqueue, maybe switch current next frame */
377 vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
378 to_next, n_left_to_next,
381 vlib_put_next_frame (vm, node, next_index, n_left_to_next);
385 * push the original buffers to error-drop, so that
386 * they can get the error counters handled, then freed
388 vlib_buffer_enqueue_to_single_next (vm, node,
389 vlib_frame_vector_args (frame),
390 IP4_ICMP_ERROR_NEXT_DROP,
393 return frame->n_vectors;
397 VLIB_REGISTER_NODE (ip4_icmp_error_node) = {
398 .function = ip4_icmp_error,
399 .name = "ip4-icmp-error",
400 .vector_size = sizeof (u32),
402 .n_errors = ARRAY_LEN (icmp_error_strings),
403 .error_strings = icmp_error_strings,
405 .n_next_nodes = IP4_ICMP_ERROR_N_NEXT,
407 [IP4_ICMP_ERROR_NEXT_DROP] = "ip4-drop",
408 [IP4_ICMP_ERROR_NEXT_LOOKUP] = "ip4-lookup",
411 .format_trace = format_icmp_input_trace,
417 unformat_icmp_type_and_code (unformat_input_t * input, va_list * args)
419 icmp46_header_t *h = va_arg (*args, icmp46_header_t *);
420 icmp4_main_t *cm = &icmp4_main;
423 if (unformat_user (input, unformat_vlib_number_by_name,
424 cm->type_and_code_by_name, &i))
426 h->type = (i >> 8) & 0xff;
427 h->code = (i >> 0) & 0xff;
429 else if (unformat_user (input, unformat_vlib_number_by_name,
430 cm->type_by_name, &i))
442 icmp4_pg_edit_function (pg_main_t * pg,
444 pg_edit_group_t * g, u32 * packets, u32 n_packets)
446 vlib_main_t *vm = vlib_get_main ();
447 u32 ip_offset, icmp_offset;
449 icmp_offset = g->start_byte_offset;
450 ip_offset = (g - 1)->start_byte_offset;
452 while (n_packets >= 1)
456 icmp46_header_t *icmp0;
459 p0 = vlib_get_buffer (vm, packets[0]);
463 ASSERT (p0->current_data == 0);
464 ip0 = (void *) (p0->data + ip_offset);
465 icmp0 = (void *) (p0->data + icmp_offset);
467 /* if IP length has been specified, then calculate the length based on buffer */
468 if (ip0->length == 0)
469 len0 = vlib_buffer_length_in_chain (vm, p0) - icmp_offset;
471 len0 = clib_net_to_host_u16 (ip0->length) - icmp_offset;
474 ~ip_csum_fold (ip_incremental_checksum (0, icmp0, len0));
480 pg_edit_t type, code;
482 } pg_icmp46_header_t;
485 pg_icmp_header_init (pg_icmp46_header_t * p)
487 /* Initialize fields that are not bit fields in the IP header. */
488 #define _(f) pg_edit_init (&p->f, icmp46_header_t, f);
496 unformat_pg_icmp_header (unformat_input_t * input, va_list * args)
498 pg_stream_t *s = va_arg (*args, pg_stream_t *);
499 pg_icmp46_header_t *p;
502 p = pg_create_edit_group (s, sizeof (p[0]), sizeof (icmp46_header_t),
504 pg_icmp_header_init (p);
506 p->checksum.type = PG_EDIT_UNSPECIFIED;
511 if (!unformat (input, "ICMP %U", unformat_icmp_type_and_code, &tmp))
514 pg_edit_set_fixed (&p->type, tmp.type);
515 pg_edit_set_fixed (&p->code, tmp.code);
521 if (unformat (input, "checksum %U",
522 unformat_pg_edit, unformat_pg_number, &p->checksum))
525 /* Can't parse input: try next protocol level. */
530 if (!unformat_user (input, unformat_pg_payload, s))
533 if (p->checksum.type == PG_EDIT_UNSPECIFIED)
535 pg_edit_group_t *g = pg_stream_get_group (s, group_index);
536 g->edit_function = icmp4_pg_edit_function;
537 g->edit_function_opaque = 0;
543 /* Free up any edits we may have added. */
544 pg_free_edit_group (s);
549 ip4_icmp_register_type (vlib_main_t * vm, icmp4_type_t type, u32 node_index)
551 icmp4_main_t *im = &icmp4_main;
554 ASSERT ((int) type < ARRAY_LEN (im->ip4_input_next_index_by_type));
555 old_next_index = im->ip4_input_next_index_by_type[type];
557 im->ip4_input_next_index_by_type[type]
558 = vlib_node_add_next (vm, ip4_icmp_input_node.index, node_index);
560 if (old_next_index &&
561 (old_next_index != im->ip4_input_next_index_by_type[type]))
562 clib_warning ("WARNING: changed next_by_type[%d]", (int) type);
565 static clib_error_t *
566 icmp4_init (vlib_main_t * vm)
568 ip_main_t *im = &ip_main;
569 ip_protocol_info_t *pi;
570 icmp4_main_t *cm = &icmp4_main;
573 error = vlib_call_init_function (vm, ip_main_init);
578 pi = ip_get_protocol_info (im, IP_PROTOCOL_ICMP);
579 pi->format_header = format_ip4_icmp_header;
580 pi->unformat_pg_edit = unformat_pg_icmp_header;
582 cm->type_by_name = hash_create_string (0, sizeof (uword));
583 #define _(n,t) hash_set_mem (cm->type_by_name, #t, (n));
587 cm->type_and_code_by_name = hash_create_string (0, sizeof (uword));
588 #define _(a,n,t) hash_set_mem (cm->type_by_name, #t, (n) | (ICMP4_##a << 8));
592 clib_memset (cm->ip4_input_next_index_by_type,
593 ICMP_INPUT_NEXT_ERROR,
594 sizeof (cm->ip4_input_next_index_by_type));
596 vlib_thread_main_t *tm = &vlib_thread_main;
597 u32 n_vlib_mains = tm->n_vlib_mains;
599 throttle_init (&icmp_throttle, n_vlib_mains, 1e-3);
604 VLIB_INIT_FUNCTION (icmp4_init);
607 * fd.io coding-style-patch-verification: ON
610 * eval: (c-set-style "gnu")