ping.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * INET		An implementation of the TCP/IP protocol suite for the LINUX
   4 *		operating system.  INET is implemented using the  BSD Socket
   5 *		interface as the means of communication with the user level.
   6 *
   7 *		"Ping" sockets
   8 *
   9 * Based on ipv4/udp.c code.
  10 *
  11 * Authors:	Vasiliy Kulikov / Openwall (for Linux 2.6),
  12 *		Pavel Kankovsky (for Linux 2.4.32)
  13 *
  14 * Pavel gave all rights to bugs to Vasiliy,
  15 * none of the bugs are Pavel's now.
  16 */
  17
  18#include <linux/uaccess.h>
  19#include <linux/types.h>
  20#include <linux/fcntl.h>
  21#include <linux/socket.h>
  22#include <linux/sockios.h>
  23#include <linux/in.h>
  24#include <linux/errno.h>
  25#include <linux/timer.h>
  26#include <linux/mm.h>
  27#include <linux/inet.h>
  28#include <linux/netdevice.h>
  29#include <net/snmp.h>
  30#include <net/ip.h>
  31#include <net/icmp.h>
  32#include <net/protocol.h>
  33#include <linux/skbuff.h>
  34#include <linux/proc_fs.h>
  35#include <linux/export.h>
  36#include <linux/bpf-cgroup.h>
  37#include <net/sock.h>
  38#include <net/ping.h>
  39#include <net/udp.h>
  40#include <net/route.h>
  41#include <net/inet_common.h>
  42#include <net/checksum.h>
  43
  44#if IS_ENABLED(CONFIG_IPV6)
  45#include <linux/in6.h>
  46#include <linux/icmpv6.h>
  47#include <net/addrconf.h>
  48#include <net/ipv6.h>
  49#include <net/transp_v6.h>
  50#endif
  51
  52struct ping_table {
  53	struct hlist_head	hash[PING_HTABLE_SIZE];
  54	spinlock_t		lock;
  55};
  56
  57static struct ping_table ping_table;
  58struct pingv6_ops pingv6_ops;
  59EXPORT_IPV6_MOD_GPL(pingv6_ops);
  60
  61static inline u32 ping_hashfn(const struct net *net, u32 num, u32 mask)
  62{
  63	u32 res = (num + net_hash_mix(net)) & mask;
  64
  65	pr_debug("hash(%u) = %u\n", num, res);
  66	return res;
  67}
  68
  69static inline struct hlist_head *ping_hashslot(struct ping_table *table,
  70					       struct net *net, unsigned int num)
  71{
  72	return &table->hash[ping_hashfn(net, num, PING_HTABLE_MASK)];
  73}
  74
  75int ping_get_port(struct sock *sk, unsigned short ident)
  76{
  77	struct net *net = sock_net(sk);
  78	struct inet_sock *isk, *isk2;
  79	struct hlist_head *hlist;
  80	struct sock *sk2 = NULL;
  81
  82	isk = inet_sk(sk);
  83	spin_lock(&ping_table.lock);
  84	if (ident == 0) {
  85		u16 result = net->ipv4.ping_port_rover + 1;
  86		u32 i;
  87
  88		for (i = 0; i < (1L << 16); i++, result++) {
  89			if (!result)
  90				continue; /* avoid zero */
  91			hlist = ping_hashslot(&ping_table, net, result);
  92			sk_for_each(sk2, hlist) {
  93				if (!net_eq(sock_net(sk2), net))
  94					continue;
  95				isk2 = inet_sk(sk2);
  96
  97				if (isk2->inet_num == result)
  98					goto next_port;
  99			}
 100
 101			/* found */
 102			net->ipv4.ping_port_rover = ident = result;
 103			break;
 104next_port:
 105			;
 106		}
 107		if (i >= (1L << 16))
 108			goto fail;
 109	} else {
 110		hlist = ping_hashslot(&ping_table, net, ident);
 111		sk_for_each(sk2, hlist) {
 112			if (!net_eq(sock_net(sk2), net))
 113				continue;
 114			isk2 = inet_sk(sk2);
 115
 116			/* BUG? Why is this reuse and not reuseaddr? ping.c
 117			 * doesn't turn off SO_REUSEADDR, and it doesn't expect
 118			 * that other ping processes can steal its packets.
 119			 */
 120			if ((isk2->inet_num == ident) &&
 121			    (sk2 != sk) &&
 122			    (!sk2->sk_reuse || !sk->sk_reuse))
 123				goto fail;
 124		}
 125	}
 126
 127	pr_debug("found port/ident = %d\n", ident);
 128	isk->inet_num = ident;
 129	if (sk_unhashed(sk)) {
 130		pr_debug("was not hashed\n");
 131		sk_add_node_rcu(sk, hlist);
 132		sock_set_flag(sk, SOCK_RCU_FREE);
 133		sock_prot_inuse_add(net, sk->sk_prot, 1);
 134	}
 135	spin_unlock(&ping_table.lock);
 136	return 0;
 137
 138fail:
 139	spin_unlock(&ping_table.lock);
 140	return -EADDRINUSE;
 141}
 142EXPORT_IPV6_MOD_GPL(ping_get_port);
 143
 144void ping_unhash(struct sock *sk)
 145{
 146	struct inet_sock *isk = inet_sk(sk);
 147
 148	pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
 149	spin_lock(&ping_table.lock);
 150	if (sk_del_node_init_rcu(sk)) {
 151		WRITE_ONCE(isk->inet_num, 0);
 152		isk->inet_sport = 0;
 153		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 154	}
 155	spin_unlock(&ping_table.lock);
 156}
 157EXPORT_IPV6_MOD_GPL(ping_unhash);
 158
 159/* Called under rcu_read_lock() */
 160static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
 161{
 162	struct hlist_head *hslot = ping_hashslot(&ping_table, net, ident);
 163	struct sock *sk = NULL;
 164	struct inet_sock *isk;
 165	int dif, sdif;
 166
 167	if (skb->protocol == htons(ETH_P_IP)) {
 168		dif = inet_iif(skb);
 169		sdif = inet_sdif(skb);
 170		pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n",
 171			 (int)ident, &ip_hdr(skb)->daddr, dif);
 172#if IS_ENABLED(CONFIG_IPV6)
 173	} else if (skb->protocol == htons(ETH_P_IPV6)) {
 174		dif = inet6_iif(skb);
 175		sdif = inet6_sdif(skb);
 176		pr_debug("try to find: num = %d, daddr = %pI6c, dif = %d\n",
 177			 (int)ident, &ipv6_hdr(skb)->daddr, dif);
 178#endif
 179	} else {
 180		return NULL;
 181	}
 182
 183	sk_for_each_rcu(sk, hslot) {
 184		int bound_dev_if;
 185
 186		if (!net_eq(sock_net(sk), net))
 187			continue;
 188		isk = inet_sk(sk);
 189
 190		pr_debug("iterate\n");
 191		if (READ_ONCE(isk->inet_num) != ident)
 192			continue;
 193
 194		bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
 195		if (skb->protocol == htons(ETH_P_IP) &&
 196		    sk->sk_family == AF_INET) {
 197			__be32 rcv_saddr = READ_ONCE(isk->inet_rcv_saddr);
 198
 199			pr_debug("found: %p: num=%d, daddr=%pI4, dif=%d\n", sk,
 200				 ident, &rcv_saddr,
 201				 bound_dev_if);
 202
 203			if (rcv_saddr && rcv_saddr != ip_hdr(skb)->daddr)
 204				continue;
 205#if IS_ENABLED(CONFIG_IPV6)
 206		} else if (skb->protocol == htons(ETH_P_IPV6) &&
 207			   sk->sk_family == AF_INET6) {
 208
 209			pr_debug("found: %p: num=%d, daddr=%pI6c, dif=%d\n", sk,
 210				 ident,
 211				 &sk->sk_v6_rcv_saddr,
 212				 bound_dev_if);
 213
 214			if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr) &&
 215			    !ipv6_addr_equal(&sk->sk_v6_rcv_saddr,
 216					     &ipv6_hdr(skb)->daddr))
 217				continue;
 218#endif
 219		} else {
 220			continue;
 221		}
 222
 223		if (bound_dev_if && bound_dev_if != dif &&
 224		    bound_dev_if != sdif)
 225			continue;
 226
 227		goto exit;
 228	}
 229
 230	sk = NULL;
 231exit:
 232
 233	return sk;
 234}
 235
 236static void inet_get_ping_group_range_net(struct net *net, kgid_t *low,
 237					  kgid_t *high)
 238{
 239	kgid_t *data = net->ipv4.ping_group_range.range;
 240	unsigned int seq;
 241
 242	do {
 243		seq = read_seqbegin(&net->ipv4.ping_group_range.lock);
 244
 245		*low = data[0];
 246		*high = data[1];
 247	} while (read_seqretry(&net->ipv4.ping_group_range.lock, seq));
 248}
 249
 250
 251int ping_init_sock(struct sock *sk)
 252{
 253	struct net *net = sock_net(sk);
 254	kgid_t group = current_egid();
 255	struct group_info *group_info;
 256	int i;
 257	kgid_t low, high;
 258	int ret = 0;
 259
 260	if (sk->sk_family == AF_INET6)
 261		sk->sk_ipv6only = 1;
 262
 263	inet_get_ping_group_range_net(net, &low, &high);
 264	if (gid_lte(low, group) && gid_lte(group, high))
 265		return 0;
 266
 267	group_info = get_current_groups();
 268	for (i = 0; i < group_info->ngroups; i++) {
 269		kgid_t gid = group_info->gid[i];
 270
 271		if (gid_lte(low, gid) && gid_lte(gid, high))
 272			goto out_release_group;
 273	}
 274
 275	ret = -EACCES;
 276
 277out_release_group:
 278	put_group_info(group_info);
 279	return ret;
 280}
 281EXPORT_IPV6_MOD_GPL(ping_init_sock);
 282
 283void ping_close(struct sock *sk, long timeout)
 284{
 285	pr_debug("ping_close(sk=%p,sk->num=%u)\n",
 286		 inet_sk(sk), inet_sk(sk)->inet_num);
 287	pr_debug("isk->refcnt = %d\n", refcount_read(&sk->sk_refcnt));
 288
 289	sk_common_release(sk);
 290}
 291EXPORT_IPV6_MOD_GPL(ping_close);
 292
 293static int ping_pre_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
 294			    int addr_len)
 295{
 296	/* This check is replicated from __ip4_datagram_connect() and
 297	 * intended to prevent BPF program called below from accessing bytes
 298	 * that are out of the bound specified by user in addr_len.
 299	 */
 300	if (addr_len < sizeof(struct sockaddr_in))
 301		return -EINVAL;
 302
 303	return BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr, &addr_len);
 304}
 305
 306/* Checks the bind address and possibly modifies sk->sk_bound_dev_if. */
 307static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
 308				struct sockaddr_unsized *uaddr, int addr_len)
 309{
 310	struct net *net = sock_net(sk);
 311	if (sk->sk_family == AF_INET) {
 312		struct sockaddr_in *addr = (struct sockaddr_in *) uaddr;
 313		u32 tb_id = RT_TABLE_LOCAL;
 314		int chk_addr_ret;
 315
 316		if (addr_len < sizeof(*addr))
 317			return -EINVAL;
 318
 319		if (addr->sin_family != AF_INET &&
 320		    !(addr->sin_family == AF_UNSPEC &&
 321		      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
 322			return -EAFNOSUPPORT;
 323
 324		pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
 325			 sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
 326
 327		if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
 328			return 0;
 329
 330		tb_id = l3mdev_fib_table_by_index(net, sk->sk_bound_dev_if) ? : tb_id;
 331		chk_addr_ret = inet_addr_type_table(net, addr->sin_addr.s_addr, tb_id);
 332
 333		if (chk_addr_ret == RTN_MULTICAST ||
 334		    chk_addr_ret == RTN_BROADCAST ||
 335		    (chk_addr_ret != RTN_LOCAL &&
 336		     !inet_can_nonlocal_bind(net, isk)))
 337			return -EADDRNOTAVAIL;
 338
 339#if IS_ENABLED(CONFIG_IPV6)
 340	} else if (sk->sk_family == AF_INET6) {
 341		struct sockaddr_in6 *addr = (struct sockaddr_in6 *) uaddr;
 342		int addr_type, scoped, has_addr;
 343		struct net_device *dev = NULL;
 344
 345		if (addr_len < sizeof(*addr))
 346			return -EINVAL;
 347
 348		if (addr->sin6_family != AF_INET6)
 349			return -EAFNOSUPPORT;
 350
 351		pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
 352			 sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
 353
 354		addr_type = ipv6_addr_type(&addr->sin6_addr);
 355		scoped = __ipv6_addr_needs_scope_id(addr_type);
 356		if ((addr_type != IPV6_ADDR_ANY &&
 357		     !(addr_type & IPV6_ADDR_UNICAST)) ||
 358		    (scoped && !addr->sin6_scope_id))
 359			return -EINVAL;
 360
 361		rcu_read_lock();
 362		if (addr->sin6_scope_id) {
 363			dev = dev_get_by_index_rcu(net, addr->sin6_scope_id);
 364			if (!dev) {
 365				rcu_read_unlock();
 366				return -ENODEV;
 367			}
 368		}
 369
 370		if (!dev && sk->sk_bound_dev_if) {
 371			dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
 372			if (!dev) {
 373				rcu_read_unlock();
 374				return -ENODEV;
 375			}
 376		}
 377		has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev,
 378						    scoped);
 379		rcu_read_unlock();
 380
 381		if (!(ipv6_can_nonlocal_bind(net, isk) || has_addr ||
 382		      addr_type == IPV6_ADDR_ANY))
 383			return -EADDRNOTAVAIL;
 384
 385		if (scoped)
 386			sk->sk_bound_dev_if = addr->sin6_scope_id;
 387#endif
 388	} else {
 389		return -EAFNOSUPPORT;
 390	}
 391	return 0;
 392}
 393
 394static void ping_set_saddr(struct sock *sk, struct sockaddr_unsized *saddr)
 395{
 396	if (saddr->sa_family == AF_INET) {
 397		struct inet_sock *isk = inet_sk(sk);
 398		struct sockaddr_in *addr = (struct sockaddr_in *) saddr;
 399
 400		isk->inet_saddr = addr->sin_addr.s_addr;
 401		WRITE_ONCE(isk->inet_rcv_saddr, addr->sin_addr.s_addr);
 402#if IS_ENABLED(CONFIG_IPV6)
 403	} else if (saddr->sa_family == AF_INET6) {
 404		struct sockaddr_in6 *addr = (struct sockaddr_in6 *) saddr;
 405		struct ipv6_pinfo *np = inet6_sk(sk);
 406		sk->sk_v6_rcv_saddr = np->saddr = addr->sin6_addr;
 407#endif
 408	}
 409}
 410
 411/*
 412 * We need our own bind because there are no privileged id's == local ports.
 413 * Moreover, we don't allow binding to multi- and broadcast addresses.
 414 */
 415
 416int ping_bind(struct sock *sk, struct sockaddr_unsized *uaddr, int addr_len)
 417{
 418	struct inet_sock *isk = inet_sk(sk);
 419	unsigned short snum;
 420	int err;
 421	int dif = sk->sk_bound_dev_if;
 422
 423	err = ping_check_bind_addr(sk, isk, uaddr, addr_len);
 424	if (err)
 425		return err;
 426
 427	lock_sock(sk);
 428
 429	err = -EINVAL;
 430	if (isk->inet_num != 0)
 431		goto out;
 432
 433	err = -EADDRINUSE;
 434	snum = ntohs(((struct sockaddr_in *)uaddr)->sin_port);
 435	if (ping_get_port(sk, snum) != 0) {
 436		/* Restore possibly modified sk->sk_bound_dev_if by ping_check_bind_addr(). */
 437		sk->sk_bound_dev_if = dif;
 438		goto out;
 439	}
 440	ping_set_saddr(sk, uaddr);
 441
 442	pr_debug("after bind(): num = %hu, dif = %d\n",
 443		 isk->inet_num,
 444		 sk->sk_bound_dev_if);
 445
 446	err = 0;
 447	if (sk->sk_family == AF_INET && isk->inet_rcv_saddr)
 448		sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
 449#if IS_ENABLED(CONFIG_IPV6)
 450	if (sk->sk_family == AF_INET6 && !ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 451		sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
 452#endif
 453
 454	if (snum)
 455		sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
 456	isk->inet_sport = htons(isk->inet_num);
 457	isk->inet_daddr = 0;
 458	isk->inet_dport = 0;
 459
 460#if IS_ENABLED(CONFIG_IPV6)
 461	if (sk->sk_family == AF_INET6)
 462		memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
 463#endif
 464
 465	sk_dst_reset(sk);
 466out:
 467	release_sock(sk);
 468	pr_debug("ping_v4_bind -> %d\n", err);
 469	return err;
 470}
 471EXPORT_IPV6_MOD_GPL(ping_bind);
 472
 473/*
 474 * Is this a supported type of ICMP message?
 475 */
 476
 477static inline int ping_supported(int family, int type, int code)
 478{
 479	return (family == AF_INET && type == ICMP_ECHO && code == 0) ||
 480	       (family == AF_INET && type == ICMP_EXT_ECHO && code == 0) ||
 481	       (family == AF_INET6 && type == ICMPV6_ECHO_REQUEST && code == 0) ||
 482	       (family == AF_INET6 && type == ICMPV6_EXT_ECHO_REQUEST && code == 0);
 483}
 484
 485/*
 486 * This routine is called by the ICMP module when it gets some
 487 * sort of error condition.
 488 */
 489
 490void ping_err(struct sk_buff *skb, int offset, u32 info)
 491{
 492	int family;
 493	struct icmphdr *icmph;
 494	struct inet_sock *inet_sock;
 495	int type;
 496	int code;
 497	struct net *net = dev_net(skb->dev);
 498	struct sock *sk;
 499	int harderr;
 500	int err;
 501
 502	if (skb->protocol == htons(ETH_P_IP)) {
 503		family = AF_INET;
 504		type = icmp_hdr(skb)->type;
 505		code = icmp_hdr(skb)->code;
 506		icmph = (struct icmphdr *)(skb->data + offset);
 507	} else if (skb->protocol == htons(ETH_P_IPV6)) {
 508		family = AF_INET6;
 509		type = icmp6_hdr(skb)->icmp6_type;
 510		code = icmp6_hdr(skb)->icmp6_code;
 511		icmph = (struct icmphdr *) (skb->data + offset);
 512	} else {
 513		BUG();
 514	}
 515
 516	/* We assume the packet has already been checked by icmp_unreach */
 517
 518	if (!ping_supported(family, icmph->type, icmph->code))
 519		return;
 520
 521	pr_debug("ping_err(proto=0x%x,type=%d,code=%d,id=%04x,seq=%04x)\n",
 522		 skb->protocol, type, code, ntohs(icmph->un.echo.id),
 523		 ntohs(icmph->un.echo.sequence));
 524
 525	sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
 526	if (!sk) {
 527		pr_debug("no socket, dropping\n");
 528		return;	/* No socket for error */
 529	}
 530	pr_debug("err on socket %p\n", sk);
 531
 532	err = 0;
 533	harderr = 0;
 534	inet_sock = inet_sk(sk);
 535
 536	if (skb->protocol == htons(ETH_P_IP)) {
 537		switch (type) {
 538		default:
 539		case ICMP_TIME_EXCEEDED:
 540			err = EHOSTUNREACH;
 541			break;
 542		case ICMP_SOURCE_QUENCH:
 543			/* This is not a real error but ping wants to see it.
 544			 * Report it with some fake errno.
 545			 */
 546			err = EREMOTEIO;
 547			break;
 548		case ICMP_PARAMETERPROB:
 549			err = EPROTO;
 550			harderr = 1;
 551			break;
 552		case ICMP_DEST_UNREACH:
 553			if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
 554				ipv4_sk_update_pmtu(skb, sk, info);
 555				if (READ_ONCE(inet_sock->pmtudisc) != IP_PMTUDISC_DONT) {
 556					err = EMSGSIZE;
 557					harderr = 1;
 558					break;
 559				}
 560				goto out;
 561			}
 562			err = EHOSTUNREACH;
 563			if (code <= NR_ICMP_UNREACH) {
 564				harderr = icmp_err_convert[code].fatal;
 565				err = icmp_err_convert[code].errno;
 566			}
 567			break;
 568		case ICMP_REDIRECT:
 569			/* See ICMP_SOURCE_QUENCH */
 570			ipv4_sk_redirect(skb, sk);
 571			err = EREMOTEIO;
 572			break;
 573		}
 574#if IS_ENABLED(CONFIG_IPV6)
 575	} else if (skb->protocol == htons(ETH_P_IPV6)) {
 576		harderr = pingv6_ops.icmpv6_err_convert(type, code, &err);
 577#endif
 578	}
 579
 580	/*
 581	 *      RFC1122: OK.  Passes ICMP errors back to application, as per
 582	 *	4.1.3.3.
 583	 */
 584	if ((family == AF_INET && !inet_test_bit(RECVERR, sk)) ||
 585	    (family == AF_INET6 && !inet6_test_bit(RECVERR6, sk))) {
 586		if (!harderr || sk->sk_state != TCP_ESTABLISHED)
 587			goto out;
 588	} else {
 589		if (family == AF_INET) {
 590			ip_icmp_error(sk, skb, err, 0 /* no remote port */,
 591				      info, (u8 *)icmph);
 592#if IS_ENABLED(CONFIG_IPV6)
 593		} else if (family == AF_INET6) {
 594			pingv6_ops.ipv6_icmp_error(sk, skb, err, 0,
 595						   info, (u8 *)icmph);
 596#endif
 597		}
 598	}
 599	sk->sk_err = err;
 600	sk_error_report(sk);
 601out:
 602	return;
 603}
 604EXPORT_IPV6_MOD_GPL(ping_err);
 605
 606/*
 607 *	Copy and checksum an ICMP Echo packet from user space into a buffer
 608 *	starting from the payload.
 609 */
 610
 611int ping_getfrag(void *from, char *to,
 612		 int offset, int fraglen, int odd, struct sk_buff *skb)
 613{
 614	struct pingfakehdr *pfh = from;
 615
 616	if (!csum_and_copy_from_iter_full(to, fraglen, &pfh->wcheck,
 617					  &pfh->msg->msg_iter))
 618		return -EFAULT;
 619
 620#if IS_ENABLED(CONFIG_IPV6)
 621	/* For IPv6, checksum each skb as we go along, as expected by
 622	 * icmpv6_push_pending_frames. For IPv4, accumulate the checksum in
 623	 * wcheck, it will be finalized in ping_v4_push_pending_frames.
 624	 */
 625	if (pfh->family == AF_INET6) {
 626		skb->csum = csum_block_add(skb->csum, pfh->wcheck, odd);
 627		skb->ip_summed = CHECKSUM_NONE;
 628		pfh->wcheck = 0;
 629	}
 630#endif
 631
 632	return 0;
 633}
 634EXPORT_IPV6_MOD_GPL(ping_getfrag);
 635
 636static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
 637				       struct flowi4 *fl4)
 638{
 639	struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
 640
 641	if (!skb)
 642		return 0;
 643	pfh->wcheck = csum_partial((char *)&pfh->icmph,
 644		sizeof(struct icmphdr), pfh->wcheck);
 645	pfh->icmph.checksum = csum_fold(pfh->wcheck);
 646	memcpy(icmp_hdr(skb), &pfh->icmph, sizeof(struct icmphdr));
 647	skb->ip_summed = CHECKSUM_NONE;
 648	return ip_push_pending_frames(sk, fl4);
 649}
 650
 651int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 652			void *user_icmph, size_t icmph_len)
 653{
 654	u8 type, code;
 655
 656	if (len > 0xFFFF)
 657		return -EMSGSIZE;
 658
 659	/* Must have at least a full ICMP header. */
 660	if (len < icmph_len)
 661		return -EINVAL;
 662
 663	/*
 664	 *	Check the flags.
 665	 */
 666
 667	/* Mirror BSD error message compatibility */
 668	if (msg->msg_flags & MSG_OOB)
 669		return -EOPNOTSUPP;
 670
 671	/*
 672	 *	Fetch the ICMP header provided by the userland.
 673	 *	iovec is modified! The ICMP header is consumed.
 674	 */
 675	if (memcpy_from_msg(user_icmph, msg, icmph_len))
 676		return -EFAULT;
 677
 678	if (family == AF_INET) {
 679		type = ((struct icmphdr *) user_icmph)->type;
 680		code = ((struct icmphdr *) user_icmph)->code;
 681#if IS_ENABLED(CONFIG_IPV6)
 682	} else if (family == AF_INET6) {
 683		type = ((struct icmp6hdr *) user_icmph)->icmp6_type;
 684		code = ((struct icmp6hdr *) user_icmph)->icmp6_code;
 685#endif
 686	} else {
 687		BUG();
 688	}
 689
 690	if (!ping_supported(family, type, code))
 691		return -EINVAL;
 692
 693	return 0;
 694}
 695EXPORT_IPV6_MOD_GPL(ping_common_sendmsg);
 696
 697static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 698{
 699	struct net *net = sock_net(sk);
 700	struct flowi4 fl4;
 701	struct inet_sock *inet = inet_sk(sk);
 702	struct ipcm_cookie ipc;
 703	struct icmphdr user_icmph;
 704	struct pingfakehdr pfh;
 705	struct rtable *rt = NULL;
 706	struct ip_options_data opt_copy;
 707	int free = 0;
 708	__be32 saddr, daddr, faddr;
 709	u8 scope;
 710	int err;
 711
 712	pr_debug("ping_v4_sendmsg(sk=%p,sk->num=%u)\n", inet, inet->inet_num);
 713
 714	err = ping_common_sendmsg(AF_INET, msg, len, &user_icmph,
 715				  sizeof(user_icmph));
 716	if (err)
 717		return err;
 718
 719	/*
 720	 *	Get and verify the address.
 721	 */
 722
 723	if (msg->msg_name) {
 724		DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
 725		if (msg->msg_namelen < sizeof(*usin))
 726			return -EINVAL;
 727		if (usin->sin_family != AF_INET)
 728			return -EAFNOSUPPORT;
 729		daddr = usin->sin_addr.s_addr;
 730		/* no remote port */
 731	} else {
 732		if (sk->sk_state != TCP_ESTABLISHED)
 733			return -EDESTADDRREQ;
 734		daddr = inet->inet_daddr;
 735		/* no remote port */
 736	}
 737
 738	ipcm_init_sk(&ipc, inet);
 739
 740	if (msg->msg_controllen) {
 741		err = ip_cmsg_send(sk, msg, &ipc, false);
 742		if (unlikely(err)) {
 743			kfree(ipc.opt);
 744			return err;
 745		}
 746		if (ipc.opt)
 747			free = 1;
 748	}
 749	if (!ipc.opt) {
 750		struct ip_options_rcu *inet_opt;
 751
 752		rcu_read_lock();
 753		inet_opt = rcu_dereference(inet->inet_opt);
 754		if (inet_opt) {
 755			memcpy(&opt_copy, inet_opt,
 756			       sizeof(*inet_opt) + inet_opt->opt.optlen);
 757			ipc.opt = &opt_copy.opt;
 758		}
 759		rcu_read_unlock();
 760	}
 761
 762	saddr = ipc.addr;
 763	ipc.addr = faddr = daddr;
 764
 765	if (ipc.opt && ipc.opt->opt.srr) {
 766		if (!daddr) {
 767			err = -EINVAL;
 768			goto out_free;
 769		}
 770		faddr = ipc.opt->opt.faddr;
 771	}
 772	scope = ip_sendmsg_scope(inet, &ipc, msg);
 773
 774	if (ipv4_is_multicast(daddr)) {
 775		if (!ipc.oif || netif_index_is_l3_master(sock_net(sk), ipc.oif))
 776			ipc.oif = READ_ONCE(inet->mc_index);
 777		if (!saddr)
 778			saddr = READ_ONCE(inet->mc_addr);
 779	} else if (!ipc.oif)
 780		ipc.oif = READ_ONCE(inet->uc_index);
 781
 782	flowi4_init_output(&fl4, ipc.oif, ipc.sockc.mark,
 783			   ipc.tos & INET_DSCP_MASK, scope,
 784			   sk->sk_protocol, inet_sk_flowi_flags(sk), faddr,
 785			   saddr, 0, 0, sk_uid(sk));
 786
 787	fl4.fl4_icmp_type = user_icmph.type;
 788	fl4.fl4_icmp_code = user_icmph.code;
 789
 790	security_sk_classify_flow(sk, flowi4_to_flowi_common(&fl4));
 791	rt = ip_route_output_flow(net, &fl4, sk);
 792	if (IS_ERR(rt)) {
 793		err = PTR_ERR(rt);
 794		rt = NULL;
 795		if (err == -ENETUNREACH)
 796			IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
 797		goto out;
 798	}
 799
 800	err = -EACCES;
 801	if ((rt->rt_flags & RTCF_BROADCAST) &&
 802	    !sock_flag(sk, SOCK_BROADCAST))
 803		goto out;
 804
 805	if (msg->msg_flags & MSG_CONFIRM)
 806		goto do_confirm;
 807back_from_confirm:
 808
 809	if (!ipc.addr)
 810		ipc.addr = fl4.daddr;
 811
 812	lock_sock(sk);
 813
 814	pfh.icmph.type = user_icmph.type; /* already checked */
 815	pfh.icmph.code = user_icmph.code; /* ditto */
 816	pfh.icmph.checksum = 0;
 817	pfh.icmph.un.echo.id = inet->inet_sport;
 818	pfh.icmph.un.echo.sequence = user_icmph.un.echo.sequence;
 819	pfh.msg = msg;
 820	pfh.wcheck = 0;
 821	pfh.family = AF_INET;
 822
 823	err = ip_append_data(sk, &fl4, ping_getfrag, &pfh, len,
 824			     sizeof(struct icmphdr), &ipc, &rt,
 825			     msg->msg_flags);
 826	if (err)
 827		ip_flush_pending_frames(sk);
 828	else
 829		err = ping_v4_push_pending_frames(sk, &pfh, &fl4);
 830	release_sock(sk);
 831
 832out:
 833	ip_rt_put(rt);
 834out_free:
 835	if (free)
 836		kfree(ipc.opt);
 837	if (!err)
 838		return len;
 839	return err;
 840
 841do_confirm:
 842	if (msg->msg_flags & MSG_PROBE)
 843		dst_confirm_neigh(&rt->dst, &fl4.daddr);
 844	if (!(msg->msg_flags & MSG_PROBE) || len)
 845		goto back_from_confirm;
 846	err = 0;
 847	goto out;
 848}
 849
 850int ping_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags,
 851		 int *addr_len)
 852{
 853	struct inet_sock *isk = inet_sk(sk);
 854	int family = sk->sk_family;
 855	struct sk_buff *skb;
 856	int copied, err;
 857
 858	pr_debug("ping_recvmsg(sk=%p,sk->num=%u)\n", isk,
 859		 READ_ONCE(isk->inet_num));
 860
 861	err = -EOPNOTSUPP;
 862	if (flags & MSG_OOB)
 863		goto out;
 864
 865	if (flags & MSG_ERRQUEUE)
 866		return inet_recv_error(sk, msg, len, addr_len);
 867
 868	skb = skb_recv_datagram(sk, flags, &err);
 869	if (!skb)
 870		goto out;
 871
 872	copied = skb->len;
 873	if (copied > len) {
 874		msg->msg_flags |= MSG_TRUNC;
 875		copied = len;
 876	}
 877
 878	/* Don't bother checking the checksum */
 879	err = skb_copy_datagram_msg(skb, 0, msg, copied);
 880	if (err)
 881		goto done;
 882
 883	sock_recv_timestamp(msg, sk, skb);
 884
 885	/* Copy the address and add cmsg data. */
 886	if (family == AF_INET) {
 887		DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
 888
 889		if (sin) {
 890			sin->sin_family = AF_INET;
 891			sin->sin_port = 0 /* skb->h.uh->source */;
 892			sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
 893			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
 894			*addr_len = sizeof(*sin);
 895		}
 896
 897		if (inet_cmsg_flags(isk))
 898			ip_cmsg_recv(msg, skb);
 899
 900#if IS_ENABLED(CONFIG_IPV6)
 901	} else if (family == AF_INET6) {
 902		struct ipv6hdr *ip6 = ipv6_hdr(skb);
 903		DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
 904
 905		if (sin6) {
 906			sin6->sin6_family = AF_INET6;
 907			sin6->sin6_port = 0;
 908			sin6->sin6_addr = ip6->saddr;
 909			sin6->sin6_flowinfo = 0;
 910			if (inet6_test_bit(SNDFLOW, sk))
 911				sin6->sin6_flowinfo = ip6_flowinfo(ip6);
 912			sin6->sin6_scope_id =
 913				ipv6_iface_scope_id(&sin6->sin6_addr,
 914						    inet6_iif(skb));
 915			*addr_len = sizeof(*sin6);
 916		}
 917
 918		if (inet6_sk(sk)->rxopt.all)
 919			pingv6_ops.ip6_datagram_recv_common_ctl(sk, msg, skb);
 920		if (skb->protocol == htons(ETH_P_IPV6) &&
 921		    inet6_sk(sk)->rxopt.all)
 922			pingv6_ops.ip6_datagram_recv_specific_ctl(sk, msg, skb);
 923		else if (skb->protocol == htons(ETH_P_IP) &&
 924			 inet_cmsg_flags(isk))
 925			ip_cmsg_recv(msg, skb);
 926#endif
 927	} else {
 928		BUG();
 929	}
 930
 931	err = copied;
 932
 933done:
 934	skb_free_datagram(sk, skb);
 935out:
 936	pr_debug("ping_recvmsg -> %d\n", err);
 937	return err;
 938}
 939EXPORT_IPV6_MOD_GPL(ping_recvmsg);
 940
 941static enum skb_drop_reason __ping_queue_rcv_skb(struct sock *sk,
 942						 struct sk_buff *skb)
 943{
 944	enum skb_drop_reason reason;
 945
 946	pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
 947		 inet_sk(sk), inet_sk(sk)->inet_num, skb);
 948	if (sock_queue_rcv_skb_reason(sk, skb, &reason) < 0) {
 949		sk_skb_reason_drop(sk, skb, reason);
 950		pr_debug("ping_queue_rcv_skb -> failed\n");
 951		return reason;
 952	}
 953	return SKB_NOT_DROPPED_YET;
 954}
 955
 956int ping_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 957{
 958	return __ping_queue_rcv_skb(sk, skb) ? -1 : 0;
 959}
 960EXPORT_IPV6_MOD_GPL(ping_queue_rcv_skb);
 961
 962
 963/*
 964 *	All we need to do is get the socket.
 965 */
 966
 967enum skb_drop_reason ping_rcv(struct sk_buff *skb)
 968{
 969	struct net *net = dev_net(skb->dev);
 970	struct icmphdr *icmph = icmp_hdr(skb);
 971	struct sock *sk;
 972
 973	/* We assume the packet has already been checked by icmp_rcv */
 974
 975	pr_debug("ping_rcv(skb=%p,id=%04x,seq=%04x)\n",
 976		 skb, ntohs(icmph->un.echo.id), ntohs(icmph->un.echo.sequence));
 977
 978	/* Push ICMP header back */
 979	skb_push(skb, skb->data - (u8 *)icmph);
 980
 981	sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
 982	if (sk)
 983		return __ping_queue_rcv_skb(sk, skb);
 984
 985	kfree_skb_reason(skb, SKB_DROP_REASON_NO_SOCKET);
 986	return SKB_DROP_REASON_NO_SOCKET;
 987}
 988EXPORT_IPV6_MOD_GPL(ping_rcv);
 989
 990struct proto ping_prot = {
 991	.name =		"PING",
 992	.owner =	THIS_MODULE,
 993	.init =		ping_init_sock,
 994	.close =	ping_close,
 995	.pre_connect =	ping_pre_connect,
 996	.connect =	ip4_datagram_connect,
 997	.disconnect =	__udp_disconnect,
 998	.setsockopt =	ip_setsockopt,
 999	.getsockopt =	ip_getsockopt,
1000	.sendmsg =	ping_v4_sendmsg,
1001	.recvmsg =	ping_recvmsg,
1002	.bind =		ping_bind,
1003	.backlog_rcv =	ping_queue_rcv_skb,
1004	.release_cb =	ip4_datagram_release_cb,
1005	.unhash =	ping_unhash,
1006	.get_port =	ping_get_port,
1007	.put_port =	ping_unhash,
1008	.obj_size =	sizeof(struct inet_sock),
1009};
1010EXPORT_IPV6_MOD(ping_prot);
1011
1012#ifdef CONFIG_PROC_FS
1013
1014static struct sock *ping_get_first(struct seq_file *seq, int start)
1015{
1016	struct sock *sk;
1017	struct ping_iter_state *state = seq->private;
1018	struct net *net = seq_file_net(seq);
1019
1020	for (state->bucket = start; state->bucket < PING_HTABLE_SIZE;
1021	     ++state->bucket) {
1022		struct hlist_head *hslot;
1023
1024		hslot = &ping_table.hash[state->bucket];
1025
1026		if (hlist_empty(hslot))
1027			continue;
1028
1029		sk_for_each(sk, hslot) {
1030			if (net_eq(sock_net(sk), net) &&
1031			    sk->sk_family == state->family)
1032				goto found;
1033		}
1034	}
1035	sk = NULL;
1036found:
1037	return sk;
1038}
1039
1040static struct sock *ping_get_next(struct seq_file *seq, struct sock *sk)
1041{
1042	struct ping_iter_state *state = seq->private;
1043	struct net *net = seq_file_net(seq);
1044
1045	do {
1046		sk = sk_next(sk);
1047	} while (sk && (!net_eq(sock_net(sk), net)));
1048
1049	if (!sk)
1050		return ping_get_first(seq, state->bucket + 1);
1051	return sk;
1052}
1053
1054static struct sock *ping_get_idx(struct seq_file *seq, loff_t pos)
1055{
1056	struct sock *sk = ping_get_first(seq, 0);
1057
1058	if (sk)
1059		while (pos && (sk = ping_get_next(seq, sk)) != NULL)
1060			--pos;
1061	return pos ? NULL : sk;
1062}
1063
1064void *ping_seq_start(struct seq_file *seq, loff_t *pos, sa_family_t family)
1065	__acquires(ping_table.lock)
1066{
1067	struct ping_iter_state *state = seq->private;
1068	state->bucket = 0;
1069	state->family = family;
1070
1071	spin_lock(&ping_table.lock);
1072
1073	return *pos ? ping_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
1074}
1075EXPORT_IPV6_MOD_GPL(ping_seq_start);
1076
1077static void *ping_v4_seq_start(struct seq_file *seq, loff_t *pos)
1078{
1079	return ping_seq_start(seq, pos, AF_INET);
1080}
1081
1082void *ping_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1083{
1084	struct sock *sk;
1085
1086	if (v == SEQ_START_TOKEN)
1087		sk = ping_get_idx(seq, 0);
1088	else
1089		sk = ping_get_next(seq, v);
1090
1091	++*pos;
1092	return sk;
1093}
1094EXPORT_IPV6_MOD_GPL(ping_seq_next);
1095
1096void ping_seq_stop(struct seq_file *seq, void *v)
1097	__releases(ping_table.lock)
1098{
1099	spin_unlock(&ping_table.lock);
1100}
1101EXPORT_IPV6_MOD_GPL(ping_seq_stop);
1102
1103static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
1104		int bucket)
1105{
1106	struct inet_sock *inet = inet_sk(sp);
1107	__be32 dest = inet->inet_daddr;
1108	__be32 src = inet->inet_rcv_saddr;
1109	__u16 destp = ntohs(inet->inet_dport);
1110	__u16 srcp = ntohs(inet->inet_sport);
1111
1112	seq_printf(f, "%5d: %08X:%04X %08X:%04X"
1113		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %u",
1114		bucket, src, srcp, dest, destp, sp->sk_state,
1115		sk_wmem_alloc_get(sp),
1116		sk_rmem_alloc_get(sp),
1117		0, 0L, 0,
1118		from_kuid_munged(seq_user_ns(f), sk_uid(sp)),
1119		0, sock_i_ino(sp),
1120		refcount_read(&sp->sk_refcnt), sp,
1121		sk_drops_read(sp));
1122}
1123
1124static int ping_v4_seq_show(struct seq_file *seq, void *v)
1125{
1126	seq_setwidth(seq, 127);
1127	if (v == SEQ_START_TOKEN)
1128		seq_puts(seq, "  sl  local_address rem_address   st tx_queue "
1129			   "rx_queue tr tm->when retrnsmt   uid  timeout "
1130			   "inode ref pointer drops");
1131	else {
1132		struct ping_iter_state *state = seq->private;
1133
1134		ping_v4_format_sock(v, seq, state->bucket);
1135	}
1136	seq_pad(seq, '\n');
1137	return 0;
1138}
1139
1140static const struct seq_operations ping_v4_seq_ops = {
1141	.start		= ping_v4_seq_start,
1142	.show		= ping_v4_seq_show,
1143	.next		= ping_seq_next,
1144	.stop		= ping_seq_stop,
1145};
1146
1147static int __net_init ping_v4_proc_init_net(struct net *net)
1148{
1149	if (!proc_create_net("icmp", 0444, net->proc_net, &ping_v4_seq_ops,
1150			sizeof(struct ping_iter_state)))
1151		return -ENOMEM;
1152
1153	net->ipv4.ping_port_rover = get_random_u16();
1154	return 0;
1155}
1156
1157static void __net_exit ping_v4_proc_exit_net(struct net *net)
1158{
1159	remove_proc_entry("icmp", net->proc_net);
1160}
1161
1162static struct pernet_operations ping_v4_net_ops = {
1163	.init = ping_v4_proc_init_net,
1164	.exit = ping_v4_proc_exit_net,
1165};
1166
1167int __init ping_proc_init(void)
1168{
1169	return register_pernet_subsys(&ping_v4_net_ops);
1170}
1171
1172void ping_proc_exit(void)
1173{
1174	unregister_pernet_subsys(&ping_v4_net_ops);
1175}
1176
1177#endif
1178
1179void __init ping_init(void)
1180{
1181	int i;
1182
1183	for (i = 0; i < PING_HTABLE_SIZE; i++)
1184		INIT_HLIST_HEAD(&ping_table.hash[i]);
1185	spin_lock_init(&ping_table.lock);
1186}