xref: /freebsd/sbin/dhclient/bpf.c (revision d3d381b2b194b4d24853e92eecef55f262688d1a)
1 /*	$OpenBSD: bpf.c,v 1.13 2004/05/05 14:28:58 deraadt Exp $	*/
2 
3 /* BPF socket interface code, originally contributed by Archie Cobbs. */
4 
5 /*-
6  * SPDX-License-Identifier: BSD-3-Clause
7  *
8  * Copyright (c) 1995, 1996, 1998, 1999
9  * The Internet Software Consortium.    All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  *
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of The Internet Software Consortium nor the names
21  *    of its contributors may be used to endorse or promote products derived
22  *    from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
25  * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
26  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
27  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
28  * DISCLAIMED.  IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
29  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
30  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
31  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
32  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
33  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
34  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
35  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  * This software has been written for the Internet Software Consortium
39  * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
40  * Enterprises.  To learn more about the Internet Software Consortium,
41  * see ``http://www.vix.com/isc''.  To learn more about Vixie
42  * Enterprises, see ``http://www.vix.com''.
43  */
44 
45 #include <sys/cdefs.h>
46 __FBSDID("$FreeBSD$");
47 
48 #include "dhcpd.h"
49 #include "privsep.h"
50 #include <sys/capsicum.h>
51 #include <sys/ioctl.h>
52 #include <sys/uio.h>
53 
54 #include <net/bpf.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/ip.h>
57 #include <netinet/udp.h>
58 #include <netinet/if_ether.h>
59 
60 #define BPF_FORMAT "/dev/bpf%d"
61 
62 /*
63  * Called by get_interface_list for each interface that's discovered.
64  * Opens a packet filter for each interface and adds it to the select
65  * mask.
66  */
67 int
68 if_register_bpf(struct interface_info *info, int flags)
69 {
70 	char filename[50];
71 	int sock, b;
72 
73 	/* Open a BPF device */
74 	for (b = 0;; b++) {
75 		snprintf(filename, sizeof(filename), BPF_FORMAT, b);
76 		sock = open(filename, flags);
77 		if (sock < 0) {
78 			if (errno == EBUSY)
79 				continue;
80 			else
81 				error("Can't find free bpf: %m");
82 		} else
83 			break;
84 	}
85 
86 	/* Set the BPF device to point at this interface. */
87 	if (ioctl(sock, BIOCSETIF, info->ifp) < 0)
88 		error("Can't attach interface %s to bpf device %s: %m",
89 		    info->name, filename);
90 
91 	return (sock);
92 }
93 
94 /*
95  * Packet write filter program:
96  * 'ip and udp and src port bootps and dst port (bootps or bootpc)'
97  */
98 static struct bpf_insn dhcp_bpf_wfilter[] = {
99 	BPF_STMT(BPF_LD + BPF_B + BPF_IND, 14),
100 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (IPVERSION << 4) + 5, 0, 12),
101 
102 	/* Make sure this is an IP packet... */
103 	BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12),
104 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 10),
105 
106 	/* Make sure it's a UDP packet... */
107 	BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23),
108 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 8),
109 
110 	/* Make sure this isn't a fragment... */
111 	BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20),
112 	BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 6, 0),	/* patched */
113 
114 	/* Get the IP header length... */
115 	BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14),
116 
117 	/* Make sure it's from the right port... */
118 	BPF_STMT(BPF_LD + BPF_H + BPF_IND, 14),
119 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 68, 0, 3),
120 
121 	/* Make sure it is to the right ports ... */
122 	BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16),
123 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1),
124 
125 	/* If we passed all the tests, ask for the whole packet. */
126 	BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
127 
128 	/* Otherwise, drop it. */
129 	BPF_STMT(BPF_RET+BPF_K, 0),
130 };
131 
132 static int dhcp_bpf_wfilter_len = nitems(dhcp_bpf_wfilter);
133 
134 void
135 if_register_send(struct interface_info *info)
136 {
137 	cap_rights_t rights;
138 	struct bpf_version v;
139 	struct bpf_program p;
140 	int sock, on = 1;
141 
142 	/* Open a BPF device and hang it on this interface... */
143 	info->wfdesc = if_register_bpf(info, O_WRONLY);
144 
145 	/* Make sure the BPF version is in range... */
146 	if (ioctl(info->wfdesc, BIOCVERSION, &v) < 0)
147 		error("Can't get BPF version: %m");
148 
149 	if (v.bv_major != BPF_MAJOR_VERSION ||
150 	    v.bv_minor < BPF_MINOR_VERSION)
151 		error("Kernel BPF version out of range - recompile dhcpd!");
152 
153 	/* Set up the bpf write filter program structure. */
154 	p.bf_len = dhcp_bpf_wfilter_len;
155 	p.bf_insns = dhcp_bpf_wfilter;
156 
157 	if (dhcp_bpf_wfilter[7].k == 0x1fff)
158 		dhcp_bpf_wfilter[7].k = htons(IP_MF|IP_OFFMASK);
159 
160 	if (ioctl(info->wfdesc, BIOCSETWF, &p) < 0)
161 		error("Can't install write filter program: %m");
162 
163 	if (ioctl(info->wfdesc, BIOCLOCK, NULL) < 0)
164 		error("Cannot lock bpf");
165 
166 	cap_rights_init(&rights, CAP_WRITE);
167 	if (cap_rights_limit(info->wfdesc, &rights) < 0 && errno != ENOSYS)
168 		error("Can't limit bpf descriptor: %m");
169 
170 	/*
171 	 * Use raw socket for unicast send.
172 	 */
173 	if ((sock = socket(AF_INET, SOCK_RAW, IPPROTO_UDP)) == -1)
174 		error("socket(SOCK_RAW): %m");
175 	if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &on,
176 	    sizeof(on)) == -1)
177 		error("setsockopt(IP_HDRINCL): %m");
178 	info->ufdesc = sock;
179 }
180 
181 /*
182  * Packet filter program...
183  *
184  * XXX: Changes to the filter program may require changes to the
185  * constant offsets used in if_register_send to patch the BPF program!
186  */
187 static struct bpf_insn dhcp_bpf_filter[] = {
188 	/* Make sure this is an IP packet... */
189 	BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12),
190 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 8),
191 
192 	/* Make sure it's a UDP packet... */
193 	BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23),
194 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6),
195 
196 	/* Make sure this isn't a fragment... */
197 	BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20),
198 	BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0),
199 
200 	/* Get the IP header length... */
201 	BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14),
202 
203 	/* Make sure it's to the right port... */
204 	BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16),
205 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1),		/* patch */
206 
207 	/* If we passed all the tests, ask for the whole packet. */
208 	BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
209 
210 	/* Otherwise, drop it. */
211 	BPF_STMT(BPF_RET+BPF_K, 0),
212 };
213 
214 static int dhcp_bpf_filter_len = nitems(dhcp_bpf_filter);
215 
216 void
217 if_register_receive(struct interface_info *info)
218 {
219 	static const unsigned long cmds[2] = { SIOCGIFFLAGS, SIOCGIFMEDIA };
220 	cap_rights_t rights;
221 	struct bpf_version v;
222 	struct bpf_program p;
223 	int flag = 1, sz;
224 
225 	/* Open a BPF device and hang it on this interface... */
226 	info->rfdesc = if_register_bpf(info, O_RDONLY);
227 
228 	/* Make sure the BPF version is in range... */
229 	if (ioctl(info->rfdesc, BIOCVERSION, &v) < 0)
230 		error("Can't get BPF version: %m");
231 
232 	if (v.bv_major != BPF_MAJOR_VERSION ||
233 	    v.bv_minor < BPF_MINOR_VERSION)
234 		error("Kernel BPF version out of range - recompile dhcpd!");
235 
236 	/*
237 	 * Set immediate mode so that reads return as soon as a packet
238 	 * comes in, rather than waiting for the input buffer to fill
239 	 * with packets.
240 	 */
241 	if (ioctl(info->rfdesc, BIOCIMMEDIATE, &flag) < 0)
242 		error("Can't set immediate mode on bpf device: %m");
243 
244 	/* Get the required BPF buffer length from the kernel. */
245 	if (ioctl(info->rfdesc, BIOCGBLEN, &sz) < 0)
246 		error("Can't get bpf buffer length: %m");
247 	info->rbuf_max = sz;
248 	info->rbuf = malloc(info->rbuf_max);
249 	if (!info->rbuf)
250 		error("Can't allocate %lu bytes for bpf input buffer.",
251 		    (unsigned long)info->rbuf_max);
252 	info->rbuf_offset = 0;
253 	info->rbuf_len = 0;
254 
255 	/* Set up the bpf filter program structure. */
256 	p.bf_len = dhcp_bpf_filter_len;
257 	p.bf_insns = dhcp_bpf_filter;
258 
259 	/* Patch the server port into the BPF program...
260 	 *
261 	 * XXX: changes to filter program may require changes to the
262 	 * insn number(s) used below!
263 	 */
264 	dhcp_bpf_filter[8].k = LOCAL_PORT;
265 
266 	if (ioctl(info->rfdesc, BIOCSETF, &p) < 0)
267 		error("Can't install packet filter program: %m");
268 
269 	if (ioctl(info->rfdesc, BIOCLOCK, NULL) < 0)
270 		error("Cannot lock bpf");
271 
272 	cap_rights_init(&rights, CAP_IOCTL, CAP_EVENT, CAP_READ);
273 	if (cap_rights_limit(info->rfdesc, &rights) < 0 && errno != ENOSYS)
274 		error("Can't limit bpf descriptor: %m");
275 	if (cap_ioctls_limit(info->rfdesc, cmds, 2) < 0 && errno != ENOSYS)
276 		error("Can't limit ioctls for bpf descriptor: %m");
277 }
278 
279 void
280 send_packet_unpriv(int privfd, struct dhcp_packet *raw, size_t len,
281     struct in_addr from, struct in_addr to)
282 {
283 	struct imsg_hdr hdr;
284 	struct buf *buf;
285 	int errs;
286 
287 	hdr.code = IMSG_SEND_PACKET;
288 	hdr.len = sizeof(hdr) +
289 	    sizeof(size_t) + len +
290 	    sizeof(from) + sizeof(to);
291 
292 	if ((buf = buf_open(hdr.len)) == NULL)
293 		error("buf_open: %m");
294 
295 	errs = 0;
296 	errs += buf_add(buf, &hdr, sizeof(hdr));
297 	errs += buf_add(buf, &len, sizeof(len));
298 	errs += buf_add(buf, raw, len);
299 	errs += buf_add(buf, &from, sizeof(from));
300 	errs += buf_add(buf, &to, sizeof(to));
301 	if (errs)
302 		error("buf_add: %m");
303 
304 	if (buf_close(privfd, buf) == -1)
305 		error("buf_close: %m");
306 }
307 
308 void
309 send_packet_priv(struct interface_info *interface, struct imsg_hdr *hdr, int fd)
310 {
311 	unsigned char buf[256];
312 	struct iovec iov[2];
313 	struct msghdr msg;
314 	struct dhcp_packet raw;
315 	size_t len;
316 	struct in_addr from, to;
317 	int result, bufp = 0;
318 
319 	if (hdr->len < sizeof(*hdr) + sizeof(size_t))
320 		error("corrupted message received");
321 	buf_read(fd, &len, sizeof(len));
322 	if (hdr->len != sizeof(*hdr) + sizeof(size_t) + len +
323 	    sizeof(from) + sizeof(to)) {
324 		error("corrupted message received");
325 	}
326 	if (len > sizeof(raw))
327 		error("corrupted message received");
328 	buf_read(fd, &raw, len);
329 	buf_read(fd, &from, sizeof(from));
330 	buf_read(fd, &to, sizeof(to));
331 
332 	/* Assemble the headers... */
333 	if (to.s_addr == INADDR_BROADCAST)
334 		assemble_hw_header(interface, buf, &bufp);
335 	assemble_udp_ip_header(buf, &bufp, from.s_addr, to.s_addr,
336 	    htons(REMOTE_PORT), (unsigned char *)&raw, len);
337 
338 	iov[0].iov_base = buf;
339 	iov[0].iov_len = bufp;
340 	iov[1].iov_base = &raw;
341 	iov[1].iov_len = len;
342 
343 	/* Fire it off */
344 	if (to.s_addr == INADDR_BROADCAST)
345 		result = writev(interface->wfdesc, iov, 2);
346 	else {
347 		struct sockaddr_in sato;
348 
349 		sato.sin_addr = to;
350 		sato.sin_port = htons(REMOTE_PORT);
351 		sato.sin_family = AF_INET;
352 		sato.sin_len = sizeof(sato);
353 
354 		memset(&msg, 0, sizeof(msg));
355 		msg.msg_name = (struct sockaddr *)&sato;
356 		msg.msg_namelen = sizeof(sato);
357 		msg.msg_iov = iov;
358 		msg.msg_iovlen = 2;
359 		result = sendmsg(interface->ufdesc, &msg, 0);
360 	}
361 
362 	if (result < 0)
363 		warning("send_packet: %m");
364 }
365 
366 ssize_t
367 receive_packet(struct interface_info *interface, unsigned char *buf,
368     size_t len, struct sockaddr_in *from, struct hardware *hfrom)
369 {
370 	int length = 0, offset = 0;
371 	struct bpf_hdr hdr;
372 
373 	/*
374 	 * All this complexity is because BPF doesn't guarantee that
375 	 * only one packet will be returned at a time.  We're getting
376 	 * what we deserve, though - this is a terrible abuse of the BPF
377 	 * interface.  Sigh.
378 	 */
379 
380 	/* Process packets until we get one we can return or until we've
381 	 * done a read and gotten nothing we can return...
382 	 */
383 	do {
384 		/* If the buffer is empty, fill it. */
385 		if (interface->rbuf_offset >= interface->rbuf_len) {
386 			length = read(interface->rfdesc, interface->rbuf,
387 			    interface->rbuf_max);
388 			if (length <= 0)
389 				return (length);
390 			interface->rbuf_offset = 0;
391 			interface->rbuf_len = length;
392 		}
393 
394 		/*
395 		 * If there isn't room for a whole bpf header, something
396 		 * went wrong, but we'll ignore it and hope it goes
397 		 * away... XXX
398 		 */
399 		if (interface->rbuf_len - interface->rbuf_offset <
400 		    sizeof(hdr)) {
401 			interface->rbuf_offset = interface->rbuf_len;
402 			continue;
403 		}
404 
405 		/* Copy out a bpf header... */
406 		memcpy(&hdr, &interface->rbuf[interface->rbuf_offset],
407 		    sizeof(hdr));
408 
409 		/*
410 		 * If the bpf header plus data doesn't fit in what's
411 		 * left of the buffer, stick head in sand yet again...
412 		 */
413 		if (interface->rbuf_offset + hdr.bh_hdrlen + hdr.bh_caplen >
414 		    interface->rbuf_len) {
415 			interface->rbuf_offset = interface->rbuf_len;
416 			continue;
417 		}
418 
419 		/* Skip over the BPF header... */
420 		interface->rbuf_offset += hdr.bh_hdrlen;
421 
422 		/*
423 		 * If the captured data wasn't the whole packet, or if
424 		 * the packet won't fit in the input buffer, all we can
425 		 * do is drop it.
426 		 */
427 		if (hdr.bh_caplen != hdr.bh_datalen) {
428 			interface->rbuf_offset =
429 			    BPF_WORDALIGN(interface->rbuf_offset +
430 			    hdr.bh_caplen);
431 			continue;
432 		}
433 
434 		/* Decode the physical header... */
435 		offset = decode_hw_header(interface->rbuf,
436 		    interface->rbuf_offset, hfrom);
437 
438 		/*
439 		 * If a physical layer checksum failed (dunno of any
440 		 * physical layer that supports this, but WTH), skip
441 		 * this packet.
442 		 */
443 		if (offset < 0) {
444 			interface->rbuf_offset =
445 			    BPF_WORDALIGN(interface->rbuf_offset +
446 			    hdr.bh_caplen);
447 			continue;
448 		}
449 		interface->rbuf_offset += offset;
450 		hdr.bh_caplen -= offset;
451 
452 		/* Decode the IP and UDP headers... */
453 		offset = decode_udp_ip_header(interface->rbuf,
454 		    interface->rbuf_offset, from, NULL, hdr.bh_caplen);
455 
456 		/* If the IP or UDP checksum was bad, skip the packet... */
457 		if (offset < 0) {
458 			interface->rbuf_offset =
459 			    BPF_WORDALIGN(interface->rbuf_offset +
460 			    hdr.bh_caplen);
461 			continue;
462 		}
463 		interface->rbuf_offset += offset;
464 		hdr.bh_caplen -= offset;
465 
466 		/*
467 		 * If there's not enough room to stash the packet data,
468 		 * we have to skip it (this shouldn't happen in real
469 		 * life, though).
470 		 */
471 		if (hdr.bh_caplen > len) {
472 			interface->rbuf_offset =
473 			    BPF_WORDALIGN(interface->rbuf_offset +
474 			    hdr.bh_caplen);
475 			continue;
476 		}
477 
478 		/* Copy out the data in the packet... */
479 		memcpy(buf, interface->rbuf + interface->rbuf_offset,
480 		    hdr.bh_caplen);
481 		interface->rbuf_offset =
482 		    BPF_WORDALIGN(interface->rbuf_offset +
483 		    hdr.bh_caplen);
484 		return (hdr.bh_caplen);
485 	} while (!length);
486 	return (0);
487 }
488