1 /*	$OpenBSD: check_icmp.c,v 1.49 2026/03/02 19:28:01 rsadowski Exp $	*/
2 
3 /*
4  * Copyright (c) 2006 Pierre-Yves Ritschard <pyr@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/sysctl.h>
23 #include <sys/time.h>
24 
25 #include <netinet/in.h>
26 #include <netinet/ip.h>
27 #include <netinet/ip_icmp.h>
28 #include <netinet/icmp6.h>
29 #include <arpa/inet.h>
30 
31 #include <event.h>
32 #include <errno.h>
33 #include <unistd.h>
34 #include <string.h>
35 #include <stdlib.h>
36 
37 #include "relayd.h"
38 #include "log.h"
39 
40 void	icmp_setup(struct relayd *, struct ctl_icmp_event *, int);
41 void	check_icmp_add(struct ctl_icmp_event *, int, struct timeval *,
42 	    void (*)(int, short, void *));
43 int	icmp_checks_done(struct ctl_icmp_event *);
44 void	icmp_checks_timeout(struct ctl_icmp_event *, enum host_error);
45 void	send_icmp(int, short, void *);
46 void	recv_icmp(int, short, void *);
47 int	in_cksum(u_short *, int);
48 
49 void
50 icmp_setup(struct relayd *env, struct ctl_icmp_event *cie, int af)
51 {
52 	int proto = IPPROTO_ICMP, val;
53 
54 	if (af == AF_INET6)
55 		proto = IPPROTO_ICMPV6;
56 	if ((cie->s = socket(af, SOCK_RAW | SOCK_NONBLOCK, proto)) == -1)
57 		fatal("%s: socket", __func__);
58 	val = ICMP_RCVBUF_SIZE;
59 	if (setsockopt(cie->s, SOL_SOCKET, SO_RCVBUF, &val, sizeof(val)) == -1)
60 		fatal("%s: setsockopt", __func__);
61 	cie->env = env;
62 	cie->af = af;
63 }
64 
65 void
66 icmp_init(struct relayd *env)
67 {
68 	icmp_setup(env, &env->sc_icmp_send, AF_INET);
69 	icmp_setup(env, &env->sc_icmp_recv, AF_INET);
70 	icmp_setup(env, &env->sc_icmp6_send, AF_INET6);
71 	icmp_setup(env, &env->sc_icmp6_recv, AF_INET6);
72 	env->sc_id = getpid() & 0xffff;
73 }
74 
75 void
76 schedule_icmp(struct relayd *env, struct host *host)
77 {
78 	host->last_up = host->up;
79 	host->flags &= ~(F_CHECK_SENT|F_CHECK_DONE);
80 
81 	if (((struct sockaddr *)&host->conf.ss)->sa_family == AF_INET)
82 		env->sc_has_icmp = 1;
83 	else
84 		env->sc_has_icmp6 = 1;
85 }
86 
87 void
88 check_icmp_add(struct ctl_icmp_event *cie, int flags, struct timeval *start,
89     void (*fn)(int, short, void *))
90 {
91 	struct timeval	 tv;
92 
93 	if (start != NULL)
94 		bcopy(start, &cie->tv_start, sizeof(cie->tv_start));
95 	bcopy(&cie->env->sc_conf.timeout, &tv, sizeof(tv));
96 	getmonotime(&cie->tv_start);
97 	event_del(&cie->ev);
98 	event_set(&cie->ev, cie->s, EV_TIMEOUT|flags, fn, cie);
99 	event_add(&cie->ev, &tv);
100 }
101 
102 void
103 check_icmp(struct relayd *env, struct timeval *tv)
104 {
105 	if (env->sc_has_icmp) {
106 		check_icmp_add(&env->sc_icmp_recv, EV_READ, tv, recv_icmp);
107 		check_icmp_add(&env->sc_icmp_send, EV_WRITE, tv, send_icmp);
108 	}
109 	if (env->sc_has_icmp6) {
110 		check_icmp_add(&env->sc_icmp6_recv, EV_READ, tv, recv_icmp);
111 		check_icmp_add(&env->sc_icmp6_send, EV_WRITE, tv, send_icmp);
112 	}
113 }
114 
115 int
116 icmp_checks_done(struct ctl_icmp_event *cie)
117 {
118 	struct table	*table;
119 	struct host	*host;
120 
121 	TAILQ_FOREACH(table, cie->env->sc_tables, entry) {
122 		if (table->conf.flags & F_DISABLE ||
123 		    table->conf.check != CHECK_ICMP)
124 			continue;
125 		TAILQ_FOREACH(host, &table->hosts, entry) {
126 			if (((struct sockaddr *)&host->conf.ss)->sa_family !=
127 			    cie->af)
128 				continue;
129 			if (!(host->flags & F_CHECK_DONE))
130 				return (0);
131 		}
132 	}
133 	return (1);
134 }
135 
136 void
137 icmp_checks_timeout(struct ctl_icmp_event *cie, enum host_error he)
138 {
139 	struct table	*table;
140 	struct host	*host;
141 
142 	TAILQ_FOREACH(table, cie->env->sc_tables, entry) {
143 		if (table->conf.flags & F_DISABLE ||
144 		    table->conf.check != CHECK_ICMP)
145 			continue;
146 		TAILQ_FOREACH(host, &table->hosts, entry) {
147 			if (((struct sockaddr *)&host->conf.ss)->sa_family !=
148 			    cie->af)
149 				continue;
150 			if (!(host->flags & (F_CHECK_DONE|F_DISABLE))) {
151 				host->up = HOST_DOWN;
152 				hce_notify_done(host, he);
153 			}
154 		}
155 	}
156 }
157 
158 void
159 send_icmp(int s, short event, void *arg)
160 {
161 	struct ctl_icmp_event	*cie = arg;
162 	struct table		*table;
163 	struct host		*host;
164 	struct sockaddr		*to;
165 	struct icmp		*icp;
166 	struct icmp6_hdr	*icp6;
167 	ssize_t			 r;
168 	u_char			 packet[ICMP_BUF_SIZE];
169 	socklen_t		 slen, len;
170 	int			 i = 0, ttl;
171 	u_int32_t		 id;
172 
173 	if (event == EV_TIMEOUT) {
174 		icmp_checks_timeout(cie, HCE_ICMP_WRITE_TIMEOUT);
175 		return;
176 	}
177 
178 	bzero(&packet, sizeof(packet));
179 	icp = (struct icmp *)packet;
180 	icp6 = (struct icmp6_hdr *)packet;
181 	if (cie->af == AF_INET) {
182 		icp->icmp_type = ICMP_ECHO;
183 		icp->icmp_code = 0;
184 		icp->icmp_id = htons(cie->env->sc_id);
185 		icp->icmp_cksum = 0;
186 		slen = sizeof(struct sockaddr_in);
187 	} else {
188 		icp6->icmp6_type = ICMP6_ECHO_REQUEST;
189 		icp6->icmp6_code = 0;
190 		icp6->icmp6_cksum = 0;
191 		icp6->icmp6_id = htons(cie->env->sc_id);
192 		slen = sizeof(struct sockaddr_in6);
193 	}
194 
195 	TAILQ_FOREACH(table, cie->env->sc_tables, entry) {
196 		if (table->conf.check != CHECK_ICMP ||
197 		    table->conf.flags & F_DISABLE)
198 			continue;
199 		TAILQ_FOREACH(host, &table->hosts, entry) {
200 			if (host->flags & (F_DISABLE | F_CHECK_SENT) ||
201 			    host->conf.parentid)
202 				continue;
203 			if (((struct sockaddr *)&host->conf.ss)->sa_family !=
204 			    cie->af)
205 				continue;
206 			i++;
207 			to = (struct sockaddr *)&host->conf.ss;
208 			id = htonl(host->conf.id);
209 
210 			if (cie->af == AF_INET) {
211 				icp->icmp_seq = htons(i);
212 				icp->icmp_cksum = 0;
213 				icp->icmp_mask = id;
214 				icp->icmp_cksum = in_cksum((u_short *)icp,
215 				    sizeof(packet));
216 			} else {
217 				icp6->icmp6_seq = htons(i);
218 				icp6->icmp6_cksum = 0;
219 				memcpy(packet + sizeof(*icp6), &id, sizeof(id));
220 				icp6->icmp6_cksum = in_cksum((u_short *)icp6,
221 				    sizeof(packet));
222 			}
223 
224 			ttl = host->conf.ttl;
225 			switch(cie->af) {
226 			case AF_INET:
227 				if (ttl > 0) {
228 					if (setsockopt(s, IPPROTO_IP, IP_TTL,
229 					    &ttl, sizeof(ttl)) == -1)
230 						log_warn("%s: setsockopt",
231 						    __func__);
232 				} else {
233 					/* Revert to default TTL */
234 					len = sizeof(ttl);
235 					if (getsockopt(s, IPPROTO_IP,
236 					    IP_IPDEFTTL, &ttl, &len) == 0) {
237 						if (setsockopt(s, IPPROTO_IP,
238 						    IP_TTL, &ttl, len) == -1)
239 							log_warn(
240 							    "%s: setsockopt",
241 							    __func__);
242 					} else
243 						log_warn("%s: getsockopt",
244 						    __func__);
245 				}
246 				break;
247 			case AF_INET6:
248 				if (ttl > 0) {
249 					if (setsockopt(s, IPPROTO_IPV6,
250 					    IPV6_UNICAST_HOPS, &ttl,
251 					    sizeof(ttl)) == -1)
252 						log_warn("%s: setsockopt",
253 						    __func__);
254 				} else {
255 					/* Revert to default hop limit */
256 					ttl = -1;
257 					if (setsockopt(s, IPPROTO_IPV6,
258 					    IPV6_UNICAST_HOPS, &ttl,
259 					    sizeof(ttl)) == -1)
260 						log_warn("%s: setsockopt",
261 						    __func__);
262 				}
263 				break;
264 			}
265 
266 			r = sendto(s, packet, sizeof(packet), 0, to, slen);
267 			if (r == -1) {
268 				if (errno == EAGAIN || errno == EINTR)
269 					goto retry;
270 				host->flags |= F_CHECK_SENT|F_CHECK_DONE;
271 				host->up = HOST_DOWN;
272 			} else if (r != sizeof(packet))
273 				goto retry;
274 			host->flags |= F_CHECK_SENT;
275 		}
276 	}
277 
278 	return;
279 
280  retry:
281 	event_again(&cie->ev, s, EV_TIMEOUT|EV_WRITE, send_icmp,
282 	    &cie->tv_start, &cie->env->sc_conf.timeout, cie);
283 }
284 
285 void
286 recv_icmp(int s, short event, void *arg)
287 {
288 	struct ctl_icmp_event	*cie = arg;
289 	u_char			 packet[ICMP_BUF_SIZE];
290 	socklen_t		 slen;
291 	struct sockaddr_storage	 ss;
292 	struct icmp		*icp;
293 	struct icmp6_hdr	*icp6;
294 	u_int16_t		 icpid;
295 	struct host		*host;
296 	ssize_t			 r;
297 	u_int32_t		 id;
298 
299 	if (event == EV_TIMEOUT) {
300 		icmp_checks_timeout(cie, HCE_ICMP_READ_TIMEOUT);
301 		return;
302 	}
303 
304 	bzero(&packet, sizeof(packet));
305 	bzero(&ss, sizeof(ss));
306 	slen = sizeof(ss);
307 
308 	r = recvfrom(s, packet, sizeof(packet), 0,
309 	    (struct sockaddr *)&ss, &slen);
310 	if (r == -1 || r != ICMP_BUF_SIZE) {
311 		if (r == -1 && errno != EAGAIN && errno != EINTR)
312 			log_debug("%s: receive error", __func__);
313 		goto retry;
314 	}
315 
316 	if (cie->af == AF_INET) {
317 		icp = (struct icmp *)(packet + sizeof(struct ip));
318 		icpid = ntohs(icp->icmp_id);
319 		id = icp->icmp_mask;
320 	} else {
321 		icp6 = (struct icmp6_hdr *)packet;
322 		icpid = ntohs(icp6->icmp6_id);
323 		memcpy(&id, packet + sizeof(*icp6), sizeof(id));
324 	}
325 	if (icpid != cie->env->sc_id)
326 		goto retry;
327 	id = ntohl(id);
328 	host = host_find(cie->env, id);
329 	if (host == NULL) {
330 		log_warn("%s: ping for unknown host received", __func__);
331 		goto retry;
332 	}
333 	if (bcmp(&ss, &host->conf.ss, slen)) {
334 		log_warnx("%s: forged icmp packet?", __func__);
335 		goto retry;
336 	}
337 
338 	host->up = HOST_UP;
339 	host->flags |= F_CHECK_DONE;
340 	hce_notify_done(host, HCE_ICMP_OK);
341 
342 	if (icmp_checks_done(cie))
343 		return;
344 
345  retry:
346 	event_again(&cie->ev, s, EV_TIMEOUT|EV_READ, recv_icmp,
347 	    &cie->tv_start, &cie->env->sc_conf.timeout, cie);
348 }
349 
350 /* in_cksum from ping.c --
351  *	Checksum routine for Internet Protocol family headers (C Version)
352  *
353  * Copyright (c) 1989, 1993
354  *	The Regents of the University of California.  All rights reserved.
355  *
356  * This code is derived from software contributed to Berkeley by
357  * Mike Muuss.
358  *
359  * Redistribution and use in source and binary forms, with or without
360  * modification, are permitted provided that the following conditions
361  * are met:
362  * 1. Redistributions of source code must retain the above copyright
363  *    notice, this list of conditions and the following disclaimer.
364  * 2. Redistributions in binary form must reproduce the above copyright
365  *    notice, this list of conditions and the following disclaimer in the
366  *    documentation and/or other materials provided with the distribution.
367  * 3. Neither the name of the University nor the names of its contributors
368  *    may be used to endorse or promote products derived from this software
369  *    without specific prior written permission.
370  *
371  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
372  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
373  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
374  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
375  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
376  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
377  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
378  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
379  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
380  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
381  * SUCH DAMAGE.
382  */
383 int
384 in_cksum(u_short *addr, int len)
385 {
386 	int nleft = len;
387 	u_short *w = addr;
388 	int sum = 0;
389 	u_short answer = 0;
390 
391 	/*
392 	 * Our algorithm is simple, using a 32 bit accumulator (sum), we add
393 	 * sequential 16 bit words to it, and at the end, fold back all the
394 	 * carry bits from the top 16 bits into the lower 16 bits.
395 	 */
396 	while (nleft > 1)  {
397 		sum += *w++;
398 		nleft -= 2;
399 	}
400 
401 	/* mop up an odd byte, if necessary */
402 	if (nleft == 1) {
403 		*(u_char *)(&answer) = *(u_char *)w ;
404 		sum += answer;
405 	}
406 
407 	/* add back carry outs from top 16 bits to low 16 bits */
408 	sum = (sum >> 16) + (sum & 0xffff);	/* add hi 16 to low 16 */
409 	sum += (sum >> 16);			/* add carry */
410 	answer = ~sum;				/* truncate to 16 bits */
411 
412 	return (answer);
413 }