icmp echo disable (or dont answer pings)

[Joel Sherrill]

Comments please.  This does seem like a reasonable application feature.

--joel

Steven Johnson wrote:

>Hi,
>
>I've posted this before, but it seems to have been missed, because it
>was in a message with other info.
>
>We need to be able to prevent all ping's being echoed in my application,
>it's an end user security requirement.
>
>I've added a feature to the network stack to allow this to be toggled by
>the application (using a sysctl).  Patch is attached for comments.
>
>This patch is against 4.6.99.3
>
>Steven J
>  
>
>------------------------------------------------------------------------
>
>diff -Naur rtems-4.6.99.3-static-mbuf/cpukit/libnetworking/netinet/icmp_var.h rtems-4.6.99.3-icmpecho-alldisable/cpukit/libnetworking/netinet/icmp_var.h
>--- rtems-4.6.99.3-static-mbuf/cpukit/libnetworking/netinet/icmp_var.h	2006-04-27 10:48:53.000000000 +1100
>+++ rtems-4.6.99.3-icmpecho-alldisable/cpukit/libnetworking/netinet/icmp_var.h	2006-04-27 10:58:57.000000000 +1100
>@@ -54,6 +54,7 @@
> 	u_long	icps_badlen;		/* calculated bound mismatch */
> 	u_long	icps_reflect;		/* number of responses */
> 	u_long	icps_inhist[ICMP_MAXTYPE + 1];
>+        u_long  icps_allecho;           /* all echo requests dropped */
> 	u_long	icps_bmcastecho; 	/* b/mcast echo requests dropped */
> 	u_long	icps_bmcasttstamp; 	/* b/mcast tstamp requests dropped */
> };
>diff -Naur rtems-4.6.99.3-static-mbuf/cpukit/libnetworking/netinet/ip_icmp.c rtems-4.6.99.3-icmpecho-alldisable/cpukit/libnetworking/netinet/ip_icmp.c
>--- rtems-4.6.99.3-static-mbuf/cpukit/libnetworking/netinet/ip_icmp.c	2006-04-27 10:48:53.000000000 +1100
>+++ rtems-4.6.99.3-icmpecho-alldisable/cpukit/libnetworking/netinet/ip_icmp.c	2006-04-27 11:05:31.000000000 +1100
>@@ -88,6 +88,10 @@
> SYSCTL_INT(_net_inet_icmp, OID_AUTO, bmcastecho, CTLFLAG_RW, &icmpbmcastecho,
> 	   0, "");
> 
>+static int  icmpallecho = 1;
>+SYSCTL_INT(_net_inet_icmp, OID_AUTO, allecho, CTLFLAG_RW, &icmpallecho,
>+	   0, "");
>+
> /* #define ICMPPRINTFS 1 */
> #ifdef ICMPPRINTFS
> int	icmpprintfs = 0;
>@@ -399,9 +403,10 @@
> 		break;
> 
> 	case ICMP_ECHO:
>-		if (!icmpbmcastecho
>-		    && (m->m_flags & (M_MCAST | M_BCAST)) != 0
>-		    && IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
>+		if (!icmpallecho 
>+		    || (!icmpbmcastecho
>+			&& (m->m_flags & (M_MCAST | M_BCAST)) != 0
>+			&& IN_MULTICAST(ntohl(ip->ip_dst.s_addr)))) {
> 			icmpstat.icps_bmcastecho++;
> 			break;
> 		}
>diff -Naur rtems-4.6.99.3-static-mbuf/cpukit/libnetworking/rtems/rtems_showicmpstat.c rtems-4.6.99.3-icmpecho-alldisable/cpukit/libnetworking/rtems/rtems_showicmpstat.c
>--- rtems-4.6.99.3-static-mbuf/cpukit/libnetworking/rtems/rtems_showicmpstat.c	2006-04-27 10:48:53.000000000 +1100
>+++ rtems-4.6.99.3-icmpecho-alldisable/cpukit/libnetworking/rtems/rtems_showicmpstat.c	2006-04-27 11:07:06.000000000 +1100
>@@ -52,6 +52,7 @@
> 	showicmpstat ("bad checksum", icmpstat.icps_checksum);
> 	showicmpstat ("calculated bound mismatch", icmpstat.icps_badlen);
> 	showicmpstat ("number of responses", icmpstat.icps_reflect);
>+        showicmpstat ("all echo requests dropped", icmpstat.icps_allecho);
> 	showicmpstat ("b/mcast echo requests dropped", icmpstat.icps_bmcastecho);
> 	showicmpstat ("b/mcast tstamp requests dropped", icmpstat.icps_bmcasttstamp);
> 	for (i = 0 ; i <= ICMP_MAXTYPE ; i++) {
>
>  
>