bpf.c revision 1.2
1/* $OpenBSD: bpf.c,v 1.2 2021/03/02 19:20:13 florian Exp $ */ 2 3/* BPF socket interface code, originally contributed by Archie Cobbs. */ 4 5/* 6 * Copyright (c) 1995, 1996, 1998, 1999 7 * The Internet Software Consortium. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. Neither the name of The Internet Software Consortium nor the names 19 * of its contributors may be used to endorse or promote products derived 20 * from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND 23 * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, 24 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 25 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 26 * DISCLAIMED. IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR 27 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 29 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF 30 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 31 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 32 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 33 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * This software has been written for the Internet Software Consortium 37 * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie 38 * Enterprises. To learn more about the Internet Software Consortium, 39 * see ``http://www.vix.com/isc''. To learn more about Vixie 40 * Enterprises, see ``http://www.vix.com''. 41 */ 42 43#include <sys/types.h> 44#include <sys/ioctl.h> 45 46#include <net/bpf.h> 47#include <net/if.h> 48#include <net/ethertypes.h> 49#include <netinet/in.h> 50#include <netinet/ip.h> 51 52#include <fcntl.h> 53#include <string.h> 54#include <unistd.h> 55 56#include "bpf.h" 57#include "log.h" 58 59#define CLIENT_PORT 68 60 61/* 62 * Packet filter program. 63 */ 64struct bpf_insn dhcp_bpf_filter[] = { 65 /* Make sure this is an IP packet. */ 66 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12), 67 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 8), 68 69 /* Make sure it's a UDP packet. */ 70 BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23), 71 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6), 72 73 /* Make sure this isn't a fragment. */ 74 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20), 75 BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0), 76 77 /* Get the IP header length. */ 78 BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14), 79 80 /* Make sure it's to the right port. */ 81 BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16), 82 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, CLIENT_PORT, 0, 1), 83 84 /* If we passed all the tests, ask for the whole packet. */ 85 BPF_STMT(BPF_RET+BPF_K, (unsigned int)-1), 86 87 /* Otherwise, drop it. */ 88 BPF_STMT(BPF_RET+BPF_K, 0), 89}; 90 91/* 92 * Packet write filter program: 93 * 'ip and udp and src port bootpc and dst port bootps' 94 */ 95struct bpf_insn dhcp_bpf_wfilter[] = { 96 BPF_STMT(BPF_LD + BPF_B + BPF_IND, 14), 97 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (IPVERSION << 4) + 5, 0, 12), 98 99 /* Make sure this is an IP packet. */ 100 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12), 101 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 10), 102 103 /* Make sure it's a UDP packet. */ 104 BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23), 105 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 8), 106 107 /* Make sure this isn't a fragment. */ 108 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20), 109 BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 6, 0), /* patched */ 110 111 /* Get the IP header length. */ 112 BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14), 113 114 /* Make sure it's from the right port. */ 115 BPF_STMT(BPF_LD + BPF_H + BPF_IND, 14), 116 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 68, 0, 3), 117 118 /* Make sure it is to the right ports. */ 119 BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16), 120 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1), 121 122 /* If we passed all the tests, ask for the whole packet. */ 123 BPF_STMT(BPF_RET+BPF_K, (unsigned int)-1), 124 125 /* Otherwise, drop it. */ 126 BPF_STMT(BPF_RET+BPF_K, 0), 127}; 128 129int 130get_bpf_sock(const char *name) 131{ 132 struct bpf_program p; 133 struct ifreq ifr; 134 u_int sz; 135 int flag = 1, fildrop = BPF_FILDROP_CAPTURE; 136 int bpffd; 137 138 if ((bpffd = open("/dev/bpf", O_RDWR | O_CLOEXEC | O_NONBLOCK)) == -1) 139 fatal("open(/dev/bpf)"); 140 141 sz = BPFLEN; 142 /* Set the BPF buffer length. */ 143 if (ioctl(bpffd, BIOCSBLEN, &sz) == -1) 144 fatal("BIOCSBLEN"); 145 if (sz != BPFLEN) 146 fatal("BIOCSBLEN, expected %u, got %u", BPFLEN, sz); 147 148 /* 149 * Set immediate mode so that reads return as soon as a packet 150 * comes in, rather than waiting for the input buffer to fill 151 * with packets. 152 */ 153 if (ioctl(bpffd, BIOCIMMEDIATE, &flag) == -1) 154 fatal("BIOCIMMEDIATE"); 155 156 if (ioctl(bpffd, BIOCSFILDROP, &fildrop) == -1) 157 fatal("BIOCSFILDROP"); 158 159 /* Set up the bpf filter program structure. */ 160 p.bf_len = sizeof(dhcp_bpf_filter) / sizeof(struct bpf_insn); 161 p.bf_insns = dhcp_bpf_filter; 162 163 if (ioctl(bpffd, BIOCSETF, &p) == -1) 164 fatal("BIOCSETF"); 165 166 /* Set up the bpf write filter program structure. */ 167 p.bf_len = sizeof(dhcp_bpf_wfilter) / sizeof(struct bpf_insn); 168 p.bf_insns = dhcp_bpf_wfilter; 169 170 if (dhcp_bpf_wfilter[7].k == 0x1fff) 171 dhcp_bpf_wfilter[7].k = htons(IP_MF|IP_OFFMASK); 172 173 if (ioctl(bpffd, BIOCSETWF, &p) == -1) 174 fatal("BIOCSETWF"); 175 176 strlcpy(ifr.ifr_name, name, IFNAMSIZ); 177 if (ioctl(bpffd, BIOCSETIF, &ifr) == -1) { 178 log_warn("BIOCSETIF"); /* interface might have disappeared */ 179 close(bpffd); 180 return -1; 181 } 182 183 if (ioctl(bpffd, BIOCLOCK, NULL) == -1) 184 fatal("BIOCLOCK"); 185 186 return bpffd; 187} 188