1/* $OpenBSD: pf.c,v 1.19 2023/03/08 04:43:13 guenther Exp $ */ 2 3/* 4 * Copyright (c) 1993-95 Mats O Jansson. All rights reserved. 5 * Copyright (c) 1990 The Regents of the University of California. 6 * All rights reserved. 7 * 8 * This code is partly derived from rarpd. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31#include <sys/types.h> 32#include <sys/time.h> 33#include <sys/ioctl.h> 34#include <sys/socket.h> 35#include <sys/uio.h> 36#include <net/if.h> 37 38#include <net/bpf.h> 39 40#include <netinet/in.h> 41#include <netinet/if_ether.h> 42 43#include <netdb.h> 44#include <ctype.h> 45#include <string.h> 46#include <err.h> 47#include <errno.h> 48#include <fcntl.h> 49#include <stdio.h> 50#include <syslog.h> 51#include <unistd.h> 52 53#include "common/mopdef.h" 54 55/* 56 * Variables 57 */ 58 59extern int promisc; 60 61/* 62 * Return information to device.c how to open device. 63 * In this case the driver can handle both Ethernet type II and 64 * IEEE 802.3 frames (SNAP) in a single pfOpen. 65 */ 66int 67pfTrans(char *interface) 68{ 69 return (TRANS_ETHER + TRANS_8023 + TRANS_AND); 70} 71 72/* 73 * Open and initialize packet filter. 74 */ 75int 76pfInit(char *interface, int mode, u_short protocol, int typ) 77{ 78 int fd; 79 struct ifreq ifr; 80 u_int dlt; 81 int immediate; 82 83 static struct bpf_insn insns[] = { 84 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 12), 85 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x4711, 4, 0), 86 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 20), 87 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x4711, 0, 3), 88 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 14), 89 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xaaaa, 0, 1), 90 BPF_STMT(BPF_RET | BPF_K, 1520), 91 BPF_STMT(BPF_RET | BPF_K, 0), 92 }; 93 static struct bpf_program filter = { 94 sizeof insns / sizeof(insns[0]), 95 insns 96 }; 97 98 if ((fd = open("/dev/bpf", mode)) == -1) { 99 syslog(LOG_ERR,"pfInit: open bpf %m"); 100 return (-1); 101 } 102 103 /* Set immediate mode so packets are processed as they arrive. */ 104 immediate = 1; 105 if (ioctl(fd, BIOCIMMEDIATE, &immediate) < 0) { 106 syslog(LOG_ERR,"pfInit: BIOCIMMEDIATE: %m"); 107 return (-1); 108 } 109 strncpy(ifr.ifr_name, interface, sizeof ifr.ifr_name); 110 if (ioctl(fd, BIOCSETIF, &ifr) < 0) { 111 syslog(LOG_ERR,"pfInit: BIOCSETIF: %m"); 112 return (-1); 113 } 114 /* Check that the data link layer is an Ethernet; this code won't work 115 * with anything else. */ 116 if (ioctl(fd, BIOCGDLT, &dlt) < 0) { 117 syslog(LOG_ERR,"pfInit: BIOCGDLT: %m"); 118 return (-1); 119 } 120 if (dlt != DLT_EN10MB) { 121 syslog(LOG_ERR,"pfInit: %s is not ethernet", interface); 122 return (-1); 123 } 124 if (promisc) 125 /* Set promiscuous mode. */ 126 if (ioctl(fd, BIOCPROMISC, 0) < 0) { 127 syslog(LOG_ERR,"pfInit: BIOCPROMISC: %m"); 128 return (-1); 129 } 130 131 /* Set filter program. */ 132 insns[1].k = protocol; 133 insns[3].k = protocol; 134 135 if (ioctl(fd, BIOCSETF, &filter) < 0) { 136 syslog(LOG_ERR,"pfInit: BIOCSETF: %m"); 137 return (-1); 138 } 139 140 /* XXX set the same write filter (for protocol only) */ 141 if (ioctl(fd, BIOCSETWF, &filter) < 0) { 142 syslog(LOG_ERR,"pfInit: BIOCSETWF: %m"); 143 return (-1); 144 } 145 146 /* Lock the interface to prevent further changes */ 147 if (ioctl(fd, BIOCLOCK) < 0) { 148 syslog(LOG_ERR,"pfInit: BIOCLOCK: %m"); 149 return (-1); 150 } 151 152 return (fd); 153} 154 155/* 156 * Add a Multicast address to the interface 157 */ 158int 159pfAddMulti(int s, char *interface, char *addr) 160{ 161 struct ifreq ifr; 162 int fd; 163 164 strncpy(ifr.ifr_name, interface, sizeof(ifr.ifr_name) - 1); 165 ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = 0; 166 167 ifr.ifr_addr.sa_family = AF_UNSPEC; 168 bcopy(addr, ifr.ifr_addr.sa_data, 6); 169 170 /* 171 * open a socket, temporarily, to use for SIOC* ioctls 172 */ 173 if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) { 174 syslog(LOG_ERR, "pfAddMulti: socket: %m"); 175 return (-1); 176 } 177 if (ioctl(fd, SIOCADDMULTI, &ifr) < 0) { 178 syslog(LOG_ERR, "pfAddMulti: SIOCADDMULTI: %m"); 179 close(fd); 180 return (-1); 181 } 182 close(fd); 183 184 return (0); 185} 186 187/* 188 * Delete a Multicast address from the interface 189 */ 190int 191pfDelMulti(int s, char *interface, char *addr) 192{ 193 struct ifreq ifr; 194 int fd; 195 196 strncpy(ifr.ifr_name, interface, sizeof (ifr.ifr_name) - 1); 197 ifr.ifr_name[sizeof(ifr.ifr_name)-1] = 0; 198 199 ifr.ifr_addr.sa_family = AF_UNSPEC; 200 bcopy(addr, ifr.ifr_addr.sa_data, 6); 201 202 /* 203 * open a socket, temporarily, to use for SIOC* ioctls 204 * 205 */ 206 if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) { 207 syslog(LOG_ERR, "pfDelMulti: socket: %m"); 208 return (-1); 209 } 210 if (ioctl(fd, SIOCDELMULTI, &ifr) < 0) { 211 syslog(LOG_ERR, "pfAddMulti: SIOCDELMULTI: %m"); 212 close(fd); 213 return (-1); 214 } 215 close(fd); 216 217 return (0); 218} 219 220/* 221 * read a packet 222 */ 223int 224pfRead(int fd, u_char *buf, int len) 225{ 226 return (read(fd, buf, len)); 227} 228 229/* 230 * write a packet 231 */ 232int 233pfWrite(int fd, u_char *buf, int len, int trans) 234{ 235 struct iovec iov[2]; 236 237 /* XXX */ 238 switch (trans) { 239 case TRANS_8023: 240 iov[0].iov_base = buf; 241 iov[0].iov_len = 22; 242 iov[1].iov_base = buf + 22; 243 iov[1].iov_len = len - 22; 244 break; 245 default: 246 iov[0].iov_base = buf; 247 iov[0].iov_len = 14; 248 iov[1].iov_base = buf + 14; 249 iov[1].iov_len = len - 14; 250 break; 251 } 252 253 if (writev(fd, iov, 2) == len) 254 return (len); 255 256 return (-1); 257} 258 259