bpf.c revision 149399
1119418Sobrien/* $OpenBSD: bpf.c,v 1.13 2004/05/05 14:28:58 deraadt Exp $ */ 251694Sroger 351694Sroger/* BPF socket interface code, originally contributed by Archie Cobbs. */ 451694Sroger 551694Sroger/* 651694Sroger * Copyright (c) 1995, 1996, 1998, 1999 751694Sroger * The Internet Software Consortium. All rights reserved. 851694Sroger * 951694Sroger * Redistribution and use in source and binary forms, with or without 1051694Sroger * modification, are permitted provided that the following conditions 1151694Sroger * are met: 1251694Sroger * 1351694Sroger * 1. Redistributions of source code must retain the above copyright 1451694Sroger * notice, this list of conditions and the following disclaimer. 1551694Sroger * 2. Redistributions in binary form must reproduce the above copyright 1651694Sroger * notice, this list of conditions and the following disclaimer in the 1751694Sroger * documentation and/or other materials provided with the distribution. 1851694Sroger * 3. Neither the name of The Internet Software Consortium nor the names 1951694Sroger * of its contributors may be used to endorse or promote products derived 2051694Sroger * from this software without specific prior written permission. 2151694Sroger * 2251694Sroger * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND 2351694Sroger * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, 2451694Sroger * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 2551694Sroger * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 2651694Sroger * DISCLAIMED. IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR 2751694Sroger * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 2851694Sroger * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 2951694Sroger * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF 3051694Sroger * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 3151694Sroger * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 3251694Sroger * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 3351694Sroger * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34119418Sobrien * SUCH DAMAGE. 35119418Sobrien * 36119418Sobrien * This software has been written for the Internet Software Consortium 37119418Sobrien * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie 38119418Sobrien * Enterprises. To learn more about the Internet Software Consortium, 39119418Sobrien * see ``http://www.vix.com/isc''. To learn more about Vixie 40119418Sobrien * Enterprises, see ``http://www.vix.com''. 41119418Sobrien */ 42119418Sobrien 43119418Sobrien#include <sys/cdefs.h> 44119418Sobrien__FBSDID("$FreeBSD: head/sbin/dhclient/bpf.c 149399 2005-08-23 23:59:55Z brooks $"); 45119418Sobrien 46119418Sobrien#include "dhcpd.h" 47119418Sobrien#include <sys/ioctl.h> 48119418Sobrien#include <sys/uio.h> 49119418Sobrien 50119418Sobrien#include <net/bpf.h> 51118819Salex#include <netinet/in_systm.h> 52118819Salex#include <netinet/ip.h> 5351694Sroger#include <netinet/udp.h> 5451694Sroger#include <netinet/if_ether.h> 5551694Sroger 5651694Sroger#define BPF_FORMAT "/dev/bpf%d" 5759014Sroger 5867306Sroger/* 5967306Sroger * Called by get_interface_list for each interface that's discovered. 6067306Sroger * Opens a packet filter for each interface and adds it to the select 61119277Simp * mask. 62119277Simp */ 63139917Simpint 64139917Simpif_register_bpf(struct interface_info *info) 65139917Simp{ 66119277Simp char filename[50]; 6767306Sroger int sock, b; 6867306Sroger 6959014Sroger /* Open a BPF device */ 7059014Sroger for (b = 0; 1; b++) { 7159014Sroger snprintf(filename, sizeof(filename), BPF_FORMAT, b); 7259014Sroger sock = open(filename, O_RDWR, 0); 7359014Sroger if (sock < 0) { 7462112Sroger if (errno == EBUSY) 7562112Sroger continue; 7662112Sroger else 7762112Sroger error("Can't find free bpf: %m"); 7862112Sroger } else 7962112Sroger break; 8062112Sroger } 8159014Sroger 82123291Sobrien /* Set the BPF device to point at this interface. */ 83123291Sobrien if (ioctl(sock, BIOCSETIF, info->ifp) < 0) 8451694Sroger error("Can't attach interface %s to bpf device %s: %m", 8551694Sroger info->name, filename); 8651694Sroger 8751694Sroger return (sock); 8851694Sroger} 8962112Sroger 9051694Srogervoid 9151694Srogerif_register_send(struct interface_info *info) 92110237Sorion{ 9351694Sroger /* 94110237Sorion * If we're using the bpf API for sending and receiving, we 95110237Sorion * don't need to register this interface twice. 96110237Sorion */ 9751694Sroger info->wfdesc = info->rfdesc; 9851694Sroger} 9951694Sroger 10051694Sroger/* 10151694Sroger * Packet filter program... 10251694Sroger * 10351694Sroger * XXX: Changes to the filter program may require changes to the 10451694Sroger * constant offsets used in if_register_send to patch the BPF program! 10551694Sroger */ 10651694Srogerstruct bpf_insn dhcp_bpf_filter[] = { 10751694Sroger /* Make sure this is an IP packet... */ 10851694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12), 10951694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 8), 11052593Sroger 11151694Sroger /* Make sure it's a UDP packet... */ 11252593Sroger BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23), 11352593Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6), 11452593Sroger 11552593Sroger /* Make sure this isn't a fragment... */ 11651694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20), 11751694Sroger BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0), 11851694Sroger 11951694Sroger /* Get the IP header length... */ 12051694Sroger BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14), 12151694Sroger 12251694Sroger /* Make sure it's to the right port... */ 12351694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16), 12451694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1), /* patch */ 12551694Sroger 12651694Sroger /* If we passed all the tests, ask for the whole packet. */ 12751694Sroger BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 12851694Sroger 12951694Sroger /* Otherwise, drop it. */ 13051694Sroger BPF_STMT(BPF_RET+BPF_K, 0), 13151694Sroger}; 13251694Sroger 13351694Srogerint dhcp_bpf_filter_len = sizeof(dhcp_bpf_filter) / sizeof(struct bpf_insn); 13451694Sroger 13551694Sroger/* 13651694Sroger * Packet write filter program: 13751694Sroger * 'ip and udp and src port bootps and dst port (bootps or bootpc)' 13851694Sroger */ 13951694Srogerstruct bpf_insn dhcp_bpf_wfilter[] = { 14051694Sroger BPF_STMT(BPF_LD + BPF_B + BPF_IND, 14), 14151694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (IPVERSION << 4) + 5, 0, 12), 14251694Sroger 14351694Sroger /* Make sure this is an IP packet... */ 14451694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12), 14551694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 10), 14651694Sroger 14751694Sroger /* Make sure it's a UDP packet... */ 14851694Sroger BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23), 14951694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 8), 15051694Sroger 15151694Sroger /* Make sure this isn't a fragment... */ 15251694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20), 15351694Sroger BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 6, 0), /* patched */ 15451694Sroger 15551694Sroger /* Get the IP header length... */ 15651694Sroger BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14), 15751694Sroger 15851694Sroger /* Make sure it's from the right port... */ 15951694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_IND, 14), 16051694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 68, 0, 3), 16151694Sroger 16251694Sroger /* Make sure it is to the right ports ... */ 16351694Sroger BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16), 16451694Sroger BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1), 16551694Sroger 16662112Sroger /* If we passed all the tests, ask for the whole packet. */ 16762112Sroger BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 16851694Sroger 16951694Sroger /* Otherwise, drop it. */ 17051694Sroger BPF_STMT(BPF_RET+BPF_K, 0), 17151694Sroger}; 17251694Sroger 17351694Srogerint dhcp_bpf_wfilter_len = sizeof(dhcp_bpf_wfilter) / sizeof(struct bpf_insn); 17451694Sroger 17551694Srogervoid 176110237Sorionif_register_receive(struct interface_info *info) 177110237Sorion{ 17851694Sroger struct bpf_version v; 17951694Sroger struct bpf_program p; 18051694Sroger int flag = 1, sz; 18151694Sroger 18251694Sroger /* Open a BPF device and hang it on this interface... */ 18351694Sroger info->rfdesc = if_register_bpf(info); 18451694Sroger 18551694Sroger /* Make sure the BPF version is in range... */ 18651694Sroger if (ioctl(info->rfdesc, BIOCVERSION, &v) < 0) 18751694Sroger error("Can't get BPF version: %m"); 18851694Sroger 18951694Sroger if (v.bv_major != BPF_MAJOR_VERSION || 19051694Sroger v.bv_minor < BPF_MINOR_VERSION) 19151694Sroger error("Kernel BPF version out of range - recompile dhcpd!"); 19251694Sroger 19351694Sroger /* 19451694Sroger * Set immediate mode so that reads return as soon as a packet 19551694Sroger * comes in, rather than waiting for the input buffer to fill 19651694Sroger * with packets. 19751694Sroger */ 19851694Sroger if (ioctl(info->rfdesc, BIOCIMMEDIATE, &flag) < 0) 19951694Sroger error("Can't set immediate mode on bpf device: %m"); 20051694Sroger 20151694Sroger /* Get the required BPF buffer length from the kernel. */ 20251694Sroger if (ioctl(info->rfdesc, BIOCGBLEN, &sz) < 0) 20351694Sroger error("Can't get bpf buffer length: %m"); 20451694Sroger info->rbuf_max = sz; 20551694Sroger info->rbuf = malloc(info->rbuf_max); 20651694Sroger if (!info->rbuf) 20768071Sroger error("Can't allocate %lu bytes for bpf input buffer.", 20859014Sroger (unsigned long)info->rbuf_max); 20951694Sroger info->rbuf_offset = 0; 21059014Sroger info->rbuf_len = 0; 21162112Sroger 21268071Sroger /* Set up the bpf filter program structure. */ 21351694Sroger p.bf_len = dhcp_bpf_filter_len; 21459014Sroger p.bf_insns = dhcp_bpf_filter; 21551694Sroger 21651694Sroger /* Patch the server port into the BPF program... 21768071Sroger * 21868071Sroger * XXX: changes to filter program may require changes to the 21968071Sroger * insn number(s) used below! 22068071Sroger */ 22168071Sroger dhcp_bpf_filter[8].k = LOCAL_PORT; 22268071Sroger 22368071Sroger if (ioctl(info->rfdesc, BIOCSETF, &p) < 0) 22468071Sroger error("Can't install packet filter program: %m"); 22568071Sroger 22668071Sroger /* Set up the bpf write filter program structure. */ 22768071Sroger p.bf_len = dhcp_bpf_wfilter_len; 22868071Sroger p.bf_insns = dhcp_bpf_wfilter; 22968071Sroger 23068071Sroger if (dhcp_bpf_wfilter[7].k == 0x1fff) 23168071Sroger dhcp_bpf_wfilter[7].k = htons(IP_MF|IP_OFFMASK); 23268071Sroger 23368071Sroger if (ioctl(info->rfdesc, BIOCSETWF, &p) < 0) 23468071Sroger error("Can't install write filter program: %m"); 23568071Sroger 23668071Sroger if (ioctl(info->rfdesc, BIOCLOCK, NULL) < 0) 23768071Sroger error("Cannot lock bpf"); 23868071Sroger} 23968071Sroger 24068071Srogerssize_t 24168071Srogersend_packet(struct interface_info *interface, struct dhcp_packet *raw, 24268071Sroger size_t len, struct in_addr from, struct sockaddr_in *to, 24368071Sroger struct hardware *hto) 24468071Sroger{ 24568071Sroger unsigned char buf[256]; 24668071Sroger struct iovec iov[2]; 24768071Sroger int result, bufp = 0; 24868071Sroger 24968071Sroger /* Assemble the headers... */ 25068071Sroger assemble_hw_header(interface, buf, &bufp, hto); 25168071Sroger assemble_udp_ip_header(buf, &bufp, from.s_addr, 25268071Sroger to->sin_addr.s_addr, to->sin_port, (unsigned char *)raw, len); 25368071Sroger 25468071Sroger /* Fire it off */ 25568071Sroger iov[0].iov_base = (char *)buf; 25651694Sroger iov[0].iov_len = bufp; 25751694Sroger iov[1].iov_base = (char *)raw; 25851694Sroger iov[1].iov_len = len; 25951694Sroger 26051694Sroger result = writev(interface->wfdesc, iov, 2); 26151694Sroger if (result < 0) 26251694Sroger warning("send_packet: %m"); 26351694Sroger return (result); 26451694Sroger} 26551694Sroger 26651694Srogerssize_t 26751694Srogerreceive_packet(struct interface_info *interface, unsigned char *buf, 26851694Sroger size_t len, struct sockaddr_in *from, struct hardware *hfrom) 26951694Sroger{ 27051694Sroger int length = 0, offset = 0; 27151694Sroger struct bpf_hdr hdr; 27251694Sroger 27351694Sroger /* 27451694Sroger * All this complexity is because BPF doesn't guarantee that 27551694Sroger * only one packet will be returned at a time. We're getting 27651694Sroger * what we deserve, though - this is a terrible abuse of the BPF 27751694Sroger * interface. Sigh. 27851694Sroger */ 27951694Sroger 28051694Sroger /* Process packets until we get one we can return or until we've 28151694Sroger * done a read and gotten nothing we can return... 28251694Sroger */ 28351694Sroger do { 28451694Sroger /* If the buffer is empty, fill it. */ 28551694Sroger if (interface->rbuf_offset == interface->rbuf_len) { 28651694Sroger length = read(interface->rfdesc, interface->rbuf, 28751694Sroger interface->rbuf_max); 28851694Sroger if (length <= 0) 28951694Sroger return (length); 29051694Sroger interface->rbuf_offset = 0; 29151694Sroger interface->rbuf_len = length; 29251694Sroger } 29351694Sroger 29451694Sroger /* 29551694Sroger * If there isn't room for a whole bpf header, something 29651694Sroger * went wrong, but we'll ignore it and hope it goes 29751694Sroger * away... XXX 29851694Sroger */ 29951694Sroger if (interface->rbuf_len - interface->rbuf_offset < 30051694Sroger sizeof(hdr)) { 30151694Sroger interface->rbuf_offset = interface->rbuf_len; 30251694Sroger continue; 30351694Sroger } 30451694Sroger 30551694Sroger /* Copy out a bpf header... */ 30651694Sroger memcpy(&hdr, &interface->rbuf[interface->rbuf_offset], 30751694Sroger sizeof(hdr)); 30851694Sroger 30951694Sroger /* 31051694Sroger * If the bpf header plus data doesn't fit in what's 31151694Sroger * left of the buffer, stick head in sand yet again... 31251694Sroger */ 31351694Sroger if (interface->rbuf_offset + hdr.bh_hdrlen + hdr.bh_caplen > 31451694Sroger interface->rbuf_len) { 31551694Sroger interface->rbuf_offset = interface->rbuf_len; 31651694Sroger continue; 31751694Sroger } 31851694Sroger 31951694Sroger /* Skip over the BPF header... */ 320110237Sorion interface->rbuf_offset += hdr.bh_hdrlen; 32151694Sroger 32251694Sroger /* 323110237Sorion * If the captured data wasn't the whole packet, or if 324110237Sorion * the packet won't fit in the input buffer, all we can 325110237Sorion * do is drop it. 32651694Sroger */ 327110237Sorion if (hdr.bh_caplen != hdr.bh_datalen) { 328110237Sorion interface->rbuf_offset = 32951694Sroger BPF_WORDALIGN(interface->rbuf_offset + 330110237Sorion hdr.bh_caplen); 331110237Sorion continue; 332110237Sorion } 333110237Sorion 334110237Sorion /* Decode the physical header... */ 335110237Sorion offset = decode_hw_header(interface->rbuf, 33651694Sroger interface->rbuf_offset, hfrom); 33751694Sroger 338110237Sorion /* 33951694Sroger * If a physical layer checksum failed (dunno of any 34051694Sroger * physical layer that supports this, but WTH), skip 34151694Sroger * this packet. 34251694Sroger */ 34351694Sroger if (offset < 0) { 34451694Sroger interface->rbuf_offset = 345110237Sorion BPF_WORDALIGN(interface->rbuf_offset + 34651694Sroger hdr.bh_caplen); 34751694Sroger continue; 348110237Sorion } 34951694Sroger interface->rbuf_offset += offset; 35051694Sroger hdr.bh_caplen -= offset; 35151694Sroger 352110237Sorion /* Decode the IP and UDP headers... */ 353110237Sorion offset = decode_udp_ip_header(interface->rbuf, 354110237Sorion interface->rbuf_offset, from, NULL, hdr.bh_caplen); 35551694Sroger 356110237Sorion /* If the IP or UDP checksum was bad, skip the packet... */ 357110237Sorion if (offset < 0) { 35851694Sroger interface->rbuf_offset = 359110237Sorion BPF_WORDALIGN(interface->rbuf_offset + 36051694Sroger hdr.bh_caplen); 361110237Sorion continue; 36251694Sroger } 36351694Sroger interface->rbuf_offset += offset; 36451694Sroger hdr.bh_caplen -= offset; 365110237Sorion 36651694Sroger /* 367110237Sorion * If there's not enough room to stash the packet data, 36851694Sroger * we have to skip it (this shouldn't happen in real 36951694Sroger * life, though). 37051694Sroger */ 37151694Sroger if (hdr.bh_caplen > len) { 37251694Sroger interface->rbuf_offset = 373110237Sorion BPF_WORDALIGN(interface->rbuf_offset + 374110237Sorion hdr.bh_caplen); 375110237Sorion continue; 376110237Sorion } 37751694Sroger 378110237Sorion /* Copy out the data in the packet... */ 379110237Sorion memcpy(buf, interface->rbuf + interface->rbuf_offset, 380110237Sorion hdr.bh_caplen); 38151694Sroger interface->rbuf_offset = 38251694Sroger BPF_WORDALIGN(interface->rbuf_offset + 383110237Sorion hdr.bh_caplen); 384110237Sorion return (hdr.bh_caplen); 38551694Sroger } while (!length); 386110237Sorion return (0); 38751694Sroger} 38851694Sroger