1 /*- 2 * Copyright (c) 1990, 1991, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from the Stanford/CMU enet packet filter, 6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 8 * Berkeley Laboratory. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 4. Neither the name of the University nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * @(#)bpf.c 8.4 (Berkeley) 1/9/95 35 * 36 * $FreeBSD$ 37 */ 38 39 #include "opt_bpf.h" 40 #include "opt_mac.h" 41 #include "opt_netgraph.h" 42 43 #include <sys/types.h> 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/conf.h> 47 #include <sys/fcntl.h> 48 #include <sys/malloc.h> 49 #include <sys/mbuf.h> 50 #include <sys/time.h> 51 #include <sys/priv.h> 52 #include <sys/proc.h> 53 #include <sys/signalvar.h> 54 #include <sys/filio.h> 55 #include <sys/sockio.h> 56 #include <sys/ttycom.h> 57 #include <sys/uio.h> 58 59 #include <sys/event.h> 60 #include <sys/file.h> 61 #include <sys/poll.h> 62 #include <sys/proc.h> 63 64 #include <sys/socket.h> 65 66 #include <net/if.h> 67 #include <net/bpf.h> 68 #ifdef BPF_JITTER 69 #include <net/bpf_jitter.h> 70 #endif 71 #include <net/bpfdesc.h> 72 73 #include <netinet/in.h> 74 #include <netinet/if_ether.h> 75 #include <sys/kernel.h> 76 #include <sys/sysctl.h> 77 78 #include <net80211/ieee80211_freebsd.h> 79 80 #include <security/mac/mac_framework.h> 81 82 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data"); 83 84 #if defined(DEV_BPF) || defined(NETGRAPH_BPF) 85 86 #define PRINET 26 /* interruptible */ 87 88 #define M_SKIP_BPF M_SKIP_FIREWALL 89 90 /* 91 * bpf_iflist is a list of BPF interface structures, each corresponding to a 92 * specific DLT. The same network interface might have several BPF interface 93 * structures registered by different layers in the stack (i.e., 802.11 94 * frames, ethernet frames, etc). 95 */ 96 static LIST_HEAD(, bpf_if) bpf_iflist; 97 static struct mtx bpf_mtx; /* bpf global lock */ 98 static int bpf_bpfd_cnt; 99 100 static void bpf_allocbufs(struct bpf_d *); 101 static void bpf_attachd(struct bpf_d *, struct bpf_if *); 102 static void bpf_detachd(struct bpf_d *); 103 static void bpf_freed(struct bpf_d *); 104 static void bpf_mcopy(const void *, void *, size_t); 105 static int bpf_movein(struct uio *, int, int, struct mbuf **, 106 struct sockaddr *, int *, struct bpf_insn *); 107 static int bpf_setif(struct bpf_d *, struct ifreq *); 108 static void bpf_timed_out(void *); 109 static __inline void 110 bpf_wakeup(struct bpf_d *); 111 static void catchpacket(struct bpf_d *, u_char *, u_int, 112 u_int, void (*)(const void *, void *, size_t), 113 struct timeval *); 114 static void reset_d(struct bpf_d *); 115 static int bpf_setf(struct bpf_d *, struct bpf_program *, u_long cmd); 116 static int bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *); 117 static int bpf_setdlt(struct bpf_d *, u_int); 118 static void filt_bpfdetach(struct knote *); 119 static int filt_bpfread(struct knote *, long); 120 static void bpf_drvinit(void *); 121 static void bpf_clone(void *, struct ucred *, char *, int, struct cdev **); 122 static int bpf_stats_sysctl(SYSCTL_HANDLER_ARGS); 123 124 SYSCTL_NODE(_net, OID_AUTO, bpf, CTLFLAG_RW, 0, "bpf sysctl"); 125 static int bpf_bufsize = 4096; 126 SYSCTL_INT(_net_bpf, OID_AUTO, bufsize, CTLFLAG_RW, 127 &bpf_bufsize, 0, "Default bpf buffer size"); 128 static int bpf_maxbufsize = BPF_MAXBUFSIZE; 129 SYSCTL_INT(_net_bpf, OID_AUTO, maxbufsize, CTLFLAG_RW, 130 &bpf_maxbufsize, 0, "Maximum bpf buffer size"); 131 static int bpf_maxinsns = BPF_MAXINSNS; 132 SYSCTL_INT(_net_bpf, OID_AUTO, maxinsns, CTLFLAG_RW, 133 &bpf_maxinsns, 0, "Maximum bpf program instructions"); 134 SYSCTL_NODE(_net_bpf, OID_AUTO, stats, CTLFLAG_RW, 135 bpf_stats_sysctl, "bpf statistics portal"); 136 137 static d_open_t bpfopen; 138 static d_close_t bpfclose; 139 static d_read_t bpfread; 140 static d_write_t bpfwrite; 141 static d_ioctl_t bpfioctl; 142 static d_poll_t bpfpoll; 143 static d_kqfilter_t bpfkqfilter; 144 145 static struct cdevsw bpf_cdevsw = { 146 .d_version = D_VERSION, 147 .d_flags = D_NEEDGIANT, 148 .d_open = bpfopen, 149 .d_close = bpfclose, 150 .d_read = bpfread, 151 .d_write = bpfwrite, 152 .d_ioctl = bpfioctl, 153 .d_poll = bpfpoll, 154 .d_name = "bpf", 155 .d_kqfilter = bpfkqfilter, 156 }; 157 158 static struct filterops bpfread_filtops = 159 { 1, NULL, filt_bpfdetach, filt_bpfread }; 160 161 static int 162 bpf_movein(struct uio *uio, int linktype, int mtu, struct mbuf **mp, 163 struct sockaddr *sockp, int *hdrlen, struct bpf_insn *wfilter) 164 { 165 const struct ieee80211_bpf_params *p; 166 struct mbuf *m; 167 int error; 168 int len; 169 int hlen; 170 int slen; 171 172 /* 173 * Build a sockaddr based on the data link layer type. 174 * We do this at this level because the ethernet header 175 * is copied directly into the data field of the sockaddr. 176 * In the case of SLIP, there is no header and the packet 177 * is forwarded as is. 178 * Also, we are careful to leave room at the front of the mbuf 179 * for the link level header. 180 */ 181 switch (linktype) { 182 183 case DLT_SLIP: 184 sockp->sa_family = AF_INET; 185 hlen = 0; 186 break; 187 188 case DLT_EN10MB: 189 sockp->sa_family = AF_UNSPEC; 190 /* XXX Would MAXLINKHDR be better? */ 191 hlen = ETHER_HDR_LEN; 192 break; 193 194 case DLT_FDDI: 195 sockp->sa_family = AF_IMPLINK; 196 hlen = 0; 197 break; 198 199 case DLT_RAW: 200 sockp->sa_family = AF_UNSPEC; 201 hlen = 0; 202 break; 203 204 case DLT_NULL: 205 /* 206 * null interface types require a 4 byte pseudo header which 207 * corresponds to the address family of the packet. 208 */ 209 sockp->sa_family = AF_UNSPEC; 210 hlen = 4; 211 break; 212 213 case DLT_ATM_RFC1483: 214 /* 215 * en atm driver requires 4-byte atm pseudo header. 216 * though it isn't standard, vpi:vci needs to be 217 * specified anyway. 218 */ 219 sockp->sa_family = AF_UNSPEC; 220 hlen = 12; /* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */ 221 break; 222 223 case DLT_PPP: 224 sockp->sa_family = AF_UNSPEC; 225 hlen = 4; /* This should match PPP_HDRLEN */ 226 break; 227 228 case DLT_IEEE802_11: /* IEEE 802.11 wireless */ 229 sockp->sa_family = AF_IEEE80211; 230 hlen = 0; 231 break; 232 233 case DLT_IEEE802_11_RADIO: /* IEEE 802.11 wireless w/ phy params */ 234 sockp->sa_family = AF_IEEE80211; 235 sockp->sa_len = 12; /* XXX != 0 */ 236 hlen = sizeof(struct ieee80211_bpf_params); 237 break; 238 239 default: 240 return (EIO); 241 } 242 243 len = uio->uio_resid; 244 245 if (len - hlen > mtu) 246 return (EMSGSIZE); 247 248 if ((unsigned)len > MCLBYTES) 249 return (EIO); 250 251 if (len > MHLEN) { 252 m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR); 253 } else { 254 MGETHDR(m, M_TRYWAIT, MT_DATA); 255 } 256 if (m == NULL) 257 return (ENOBUFS); 258 m->m_pkthdr.len = m->m_len = len; 259 m->m_pkthdr.rcvif = NULL; 260 *mp = m; 261 262 if (m->m_len < hlen) { 263 error = EPERM; 264 goto bad; 265 } 266 267 error = uiomove(mtod(m, u_char *), len, uio); 268 if (error) 269 goto bad; 270 271 slen = bpf_filter(wfilter, mtod(m, u_char *), len, len); 272 if (slen == 0) { 273 error = EPERM; 274 goto bad; 275 } 276 277 /* 278 * Make room for link header, and copy it to sockaddr 279 */ 280 if (hlen != 0) { 281 if (sockp->sa_family == AF_IEEE80211) { 282 /* 283 * Collect true length from the parameter header 284 * NB: sockp is known to be zero'd so if we do a 285 * short copy unspecified parameters will be 286 * zero. 287 * NB: packet may not be aligned after stripping 288 * bpf params 289 * XXX check ibp_vers 290 */ 291 p = mtod(m, const struct ieee80211_bpf_params *); 292 hlen = p->ibp_len; 293 if (hlen > sizeof(sockp->sa_data)) { 294 error = EINVAL; 295 goto bad; 296 } 297 } 298 bcopy(m->m_data, sockp->sa_data, hlen); 299 } 300 *hdrlen = hlen; 301 302 return (0); 303 bad: 304 m_freem(m); 305 return (error); 306 } 307 308 /* 309 * Attach file to the bpf interface, i.e. make d listen on bp. 310 */ 311 static void 312 bpf_attachd(struct bpf_d *d, struct bpf_if *bp) 313 { 314 /* 315 * Point d at bp, and add d to the interface's list of listeners. 316 * Finally, point the driver's bpf cookie at the interface so 317 * it will divert packets to bpf. 318 */ 319 BPFIF_LOCK(bp); 320 d->bd_bif = bp; 321 LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next); 322 323 bpf_bpfd_cnt++; 324 BPFIF_UNLOCK(bp); 325 } 326 327 /* 328 * Detach a file from its interface. 329 */ 330 static void 331 bpf_detachd(struct bpf_d *d) 332 { 333 int error; 334 struct bpf_if *bp; 335 struct ifnet *ifp; 336 337 bp = d->bd_bif; 338 BPFIF_LOCK(bp); 339 BPFD_LOCK(d); 340 ifp = d->bd_bif->bif_ifp; 341 342 /* 343 * Remove d from the interface's descriptor list. 344 */ 345 LIST_REMOVE(d, bd_next); 346 347 bpf_bpfd_cnt--; 348 d->bd_bif = NULL; 349 BPFD_UNLOCK(d); 350 BPFIF_UNLOCK(bp); 351 352 /* 353 * Check if this descriptor had requested promiscuous mode. 354 * If so, turn it off. 355 */ 356 if (d->bd_promisc) { 357 d->bd_promisc = 0; 358 error = ifpromisc(ifp, 0); 359 if (error != 0 && error != ENXIO) { 360 /* 361 * ENXIO can happen if a pccard is unplugged 362 * Something is really wrong if we were able to put 363 * the driver into promiscuous mode, but can't 364 * take it out. 365 */ 366 if_printf(bp->bif_ifp, 367 "bpf_detach: ifpromisc failed (%d)\n", error); 368 } 369 } 370 } 371 372 /* 373 * Open ethernet device. Returns ENXIO for illegal minor device number, 374 * EBUSY if file is open by another process. 375 */ 376 /* ARGSUSED */ 377 static int 378 bpfopen(struct cdev *dev, int flags, int fmt, struct thread *td) 379 { 380 struct bpf_d *d; 381 382 mtx_lock(&bpf_mtx); 383 d = dev->si_drv1; 384 /* 385 * Each minor can be opened by only one process. If the requested 386 * minor is in use, return EBUSY. 387 */ 388 if (d != NULL) { 389 mtx_unlock(&bpf_mtx); 390 return (EBUSY); 391 } 392 dev->si_drv1 = (struct bpf_d *)~0; /* mark device in use */ 393 mtx_unlock(&bpf_mtx); 394 395 if ((dev->si_flags & SI_NAMED) == 0) 396 make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600, 397 "bpf%d", dev2unit(dev)); 398 MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK | M_ZERO); 399 dev->si_drv1 = d; 400 d->bd_bufsize = bpf_bufsize; 401 d->bd_sig = SIGIO; 402 d->bd_direction = BPF_D_INOUT; 403 d->bd_pid = td->td_proc->p_pid; 404 #ifdef MAC 405 mac_init_bpfdesc(d); 406 mac_create_bpfdesc(td->td_ucred, d); 407 #endif 408 mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF); 409 callout_init(&d->bd_callout, NET_CALLOUT_MPSAFE); 410 knlist_init(&d->bd_sel.si_note, &d->bd_mtx, NULL, NULL, NULL); 411 412 return (0); 413 } 414 415 /* 416 * Close the descriptor by detaching it from its interface, 417 * deallocating its buffers, and marking it free. 418 */ 419 /* ARGSUSED */ 420 static int 421 bpfclose(struct cdev *dev, int flags, int fmt, struct thread *td) 422 { 423 struct bpf_d *d = dev->si_drv1; 424 425 BPFD_LOCK(d); 426 if (d->bd_state == BPF_WAITING) 427 callout_stop(&d->bd_callout); 428 d->bd_state = BPF_IDLE; 429 BPFD_UNLOCK(d); 430 funsetown(&d->bd_sigio); 431 mtx_lock(&bpf_mtx); 432 if (d->bd_bif) 433 bpf_detachd(d); 434 mtx_unlock(&bpf_mtx); 435 selwakeuppri(&d->bd_sel, PRINET); 436 #ifdef MAC 437 mac_destroy_bpfdesc(d); 438 #endif /* MAC */ 439 knlist_destroy(&d->bd_sel.si_note); 440 bpf_freed(d); 441 dev->si_drv1 = NULL; 442 free(d, M_BPF); 443 444 return (0); 445 } 446 447 448 /* 449 * Rotate the packet buffers in descriptor d. Move the store buffer 450 * into the hold slot, and the free buffer into the store slot. 451 * Zero the length of the new store buffer. 452 */ 453 #define ROTATE_BUFFERS(d) \ 454 (d)->bd_hbuf = (d)->bd_sbuf; \ 455 (d)->bd_hlen = (d)->bd_slen; \ 456 (d)->bd_sbuf = (d)->bd_fbuf; \ 457 (d)->bd_slen = 0; \ 458 (d)->bd_fbuf = NULL; 459 /* 460 * bpfread - read next chunk of packets from buffers 461 */ 462 static int 463 bpfread(struct cdev *dev, struct uio *uio, int ioflag) 464 { 465 struct bpf_d *d = dev->si_drv1; 466 int timed_out; 467 int error; 468 469 /* 470 * Restrict application to use a buffer the same size as 471 * as kernel buffers. 472 */ 473 if (uio->uio_resid != d->bd_bufsize) 474 return (EINVAL); 475 476 BPFD_LOCK(d); 477 if (d->bd_state == BPF_WAITING) 478 callout_stop(&d->bd_callout); 479 timed_out = (d->bd_state == BPF_TIMED_OUT); 480 d->bd_state = BPF_IDLE; 481 /* 482 * If the hold buffer is empty, then do a timed sleep, which 483 * ends when the timeout expires or when enough packets 484 * have arrived to fill the store buffer. 485 */ 486 while (d->bd_hbuf == NULL) { 487 if ((d->bd_immediate || timed_out) && d->bd_slen != 0) { 488 /* 489 * A packet(s) either arrived since the previous 490 * read or arrived while we were asleep. 491 * Rotate the buffers and return what's here. 492 */ 493 ROTATE_BUFFERS(d); 494 break; 495 } 496 497 /* 498 * No data is available, check to see if the bpf device 499 * is still pointed at a real interface. If not, return 500 * ENXIO so that the userland process knows to rebind 501 * it before using it again. 502 */ 503 if (d->bd_bif == NULL) { 504 BPFD_UNLOCK(d); 505 return (ENXIO); 506 } 507 508 if (ioflag & O_NONBLOCK) { 509 BPFD_UNLOCK(d); 510 return (EWOULDBLOCK); 511 } 512 error = msleep(d, &d->bd_mtx, PRINET|PCATCH, 513 "bpf", d->bd_rtout); 514 if (error == EINTR || error == ERESTART) { 515 BPFD_UNLOCK(d); 516 return (error); 517 } 518 if (error == EWOULDBLOCK) { 519 /* 520 * On a timeout, return what's in the buffer, 521 * which may be nothing. If there is something 522 * in the store buffer, we can rotate the buffers. 523 */ 524 if (d->bd_hbuf) 525 /* 526 * We filled up the buffer in between 527 * getting the timeout and arriving 528 * here, so we don't need to rotate. 529 */ 530 break; 531 532 if (d->bd_slen == 0) { 533 BPFD_UNLOCK(d); 534 return (0); 535 } 536 ROTATE_BUFFERS(d); 537 break; 538 } 539 } 540 /* 541 * At this point, we know we have something in the hold slot. 542 */ 543 BPFD_UNLOCK(d); 544 545 /* 546 * Move data from hold buffer into user space. 547 * We know the entire buffer is transferred since 548 * we checked above that the read buffer is bpf_bufsize bytes. 549 */ 550 error = uiomove(d->bd_hbuf, d->bd_hlen, uio); 551 552 BPFD_LOCK(d); 553 d->bd_fbuf = d->bd_hbuf; 554 d->bd_hbuf = NULL; 555 d->bd_hlen = 0; 556 BPFD_UNLOCK(d); 557 558 return (error); 559 } 560 561 562 /* 563 * If there are processes sleeping on this descriptor, wake them up. 564 */ 565 static __inline void 566 bpf_wakeup(struct bpf_d *d) 567 { 568 569 BPFD_LOCK_ASSERT(d); 570 if (d->bd_state == BPF_WAITING) { 571 callout_stop(&d->bd_callout); 572 d->bd_state = BPF_IDLE; 573 } 574 wakeup(d); 575 if (d->bd_async && d->bd_sig && d->bd_sigio) 576 pgsigio(&d->bd_sigio, d->bd_sig, 0); 577 578 selwakeuppri(&d->bd_sel, PRINET); 579 KNOTE_LOCKED(&d->bd_sel.si_note, 0); 580 } 581 582 static void 583 bpf_timed_out(void *arg) 584 { 585 struct bpf_d *d = (struct bpf_d *)arg; 586 587 BPFD_LOCK(d); 588 if (d->bd_state == BPF_WAITING) { 589 d->bd_state = BPF_TIMED_OUT; 590 if (d->bd_slen != 0) 591 bpf_wakeup(d); 592 } 593 BPFD_UNLOCK(d); 594 } 595 596 static int 597 bpfwrite(struct cdev *dev, struct uio *uio, int ioflag) 598 { 599 struct bpf_d *d = dev->si_drv1; 600 struct ifnet *ifp; 601 struct mbuf *m, *mc; 602 struct sockaddr dst; 603 int error, hlen; 604 605 if (d->bd_bif == NULL) 606 return (ENXIO); 607 608 ifp = d->bd_bif->bif_ifp; 609 610 if ((ifp->if_flags & IFF_UP) == 0) 611 return (ENETDOWN); 612 613 if (uio->uio_resid == 0) 614 return (0); 615 616 bzero(&dst, sizeof(dst)); 617 error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp->if_mtu, 618 &m, &dst, &hlen, d->bd_wfilter); 619 if (error) 620 return (error); 621 622 if (d->bd_hdrcmplt) 623 dst.sa_family = pseudo_AF_HDRCMPLT; 624 625 if (d->bd_feedback) { 626 mc = m_dup(m, M_DONTWAIT); 627 if (mc != NULL) 628 mc->m_pkthdr.rcvif = ifp; 629 /* XXX Do not return the same packet twice. */ 630 if (d->bd_direction == BPF_D_INOUT) 631 m->m_flags |= M_SKIP_BPF; 632 } else 633 mc = NULL; 634 635 m->m_pkthdr.len -= hlen; 636 m->m_len -= hlen; 637 m->m_data += hlen; /* XXX */ 638 639 #ifdef MAC 640 BPFD_LOCK(d); 641 mac_create_mbuf_from_bpfdesc(d, m); 642 if (mc != NULL) 643 mac_create_mbuf_from_bpfdesc(d, mc); 644 BPFD_UNLOCK(d); 645 #endif 646 647 NET_LOCK_GIANT(); 648 error = (*ifp->if_output)(ifp, m, &dst, NULL); 649 NET_UNLOCK_GIANT(); 650 651 if (mc != NULL) { 652 if (error == 0) { 653 NET_LOCK_GIANT(); 654 (*ifp->if_input)(ifp, mc); 655 NET_UNLOCK_GIANT(); 656 } else 657 m_freem(mc); 658 } 659 660 return (error); 661 } 662 663 /* 664 * Reset a descriptor by flushing its packet buffer and clearing the 665 * receive and drop counts. 666 */ 667 static void 668 reset_d(struct bpf_d *d) 669 { 670 671 mtx_assert(&d->bd_mtx, MA_OWNED); 672 if (d->bd_hbuf) { 673 /* Free the hold buffer. */ 674 d->bd_fbuf = d->bd_hbuf; 675 d->bd_hbuf = NULL; 676 } 677 d->bd_slen = 0; 678 d->bd_hlen = 0; 679 d->bd_rcount = 0; 680 d->bd_dcount = 0; 681 d->bd_fcount = 0; 682 } 683 684 /* 685 * FIONREAD Check for read packet available. 686 * SIOCGIFADDR Get interface address - convenient hook to driver. 687 * BIOCGBLEN Get buffer len [for read()]. 688 * BIOCSETF Set ethernet read filter. 689 * BIOCSETWF Set ethernet write filter. 690 * BIOCFLUSH Flush read packet buffer. 691 * BIOCPROMISC Put interface into promiscuous mode. 692 * BIOCGDLT Get link layer type. 693 * BIOCGETIF Get interface name. 694 * BIOCSETIF Set interface. 695 * BIOCSRTIMEOUT Set read timeout. 696 * BIOCGRTIMEOUT Get read timeout. 697 * BIOCGSTATS Get packet stats. 698 * BIOCIMMEDIATE Set immediate mode. 699 * BIOCVERSION Get filter language version. 700 * BIOCGHDRCMPLT Get "header already complete" flag 701 * BIOCSHDRCMPLT Set "header already complete" flag 702 * BIOCGDIRECTION Get packet direction flag 703 * BIOCSDIRECTION Set packet direction flag 704 * BIOCLOCK Set "locked" flag 705 * BIOCFEEDBACK Set packet feedback mode. 706 */ 707 /* ARGSUSED */ 708 static int 709 bpfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, 710 struct thread *td) 711 { 712 struct bpf_d *d = dev->si_drv1; 713 int error = 0; 714 715 /* 716 * Refresh PID associated with this descriptor. 717 */ 718 BPFD_LOCK(d); 719 d->bd_pid = td->td_proc->p_pid; 720 if (d->bd_state == BPF_WAITING) 721 callout_stop(&d->bd_callout); 722 d->bd_state = BPF_IDLE; 723 BPFD_UNLOCK(d); 724 725 if (d->bd_locked == 1) { 726 switch (cmd) { 727 case BIOCGBLEN: 728 case BIOCFLUSH: 729 case BIOCGDLT: 730 case BIOCGDLTLIST: 731 case BIOCGETIF: 732 case BIOCGRTIMEOUT: 733 case BIOCGSTATS: 734 case BIOCVERSION: 735 case BIOCGRSIG: 736 case BIOCGHDRCMPLT: 737 case BIOCFEEDBACK: 738 case FIONREAD: 739 case BIOCLOCK: 740 case BIOCSRTIMEOUT: 741 case BIOCIMMEDIATE: 742 case TIOCGPGRP: 743 break; 744 default: 745 return (EPERM); 746 } 747 } 748 switch (cmd) { 749 750 default: 751 error = EINVAL; 752 break; 753 754 /* 755 * Check for read packet available. 756 */ 757 case FIONREAD: 758 { 759 int n; 760 761 BPFD_LOCK(d); 762 n = d->bd_slen; 763 if (d->bd_hbuf) 764 n += d->bd_hlen; 765 BPFD_UNLOCK(d); 766 767 *(int *)addr = n; 768 break; 769 } 770 771 case SIOCGIFADDR: 772 { 773 struct ifnet *ifp; 774 775 if (d->bd_bif == NULL) 776 error = EINVAL; 777 else { 778 ifp = d->bd_bif->bif_ifp; 779 error = (*ifp->if_ioctl)(ifp, cmd, addr); 780 } 781 break; 782 } 783 784 /* 785 * Get buffer len [for read()]. 786 */ 787 case BIOCGBLEN: 788 *(u_int *)addr = d->bd_bufsize; 789 break; 790 791 /* 792 * Set buffer length. 793 */ 794 case BIOCSBLEN: 795 if (d->bd_bif != NULL) 796 error = EINVAL; 797 else { 798 u_int size = *(u_int *)addr; 799 800 if (size > bpf_maxbufsize) 801 *(u_int *)addr = size = bpf_maxbufsize; 802 else if (size < BPF_MINBUFSIZE) 803 *(u_int *)addr = size = BPF_MINBUFSIZE; 804 d->bd_bufsize = size; 805 } 806 break; 807 808 /* 809 * Set link layer read filter. 810 */ 811 case BIOCSETF: 812 case BIOCSETWF: 813 error = bpf_setf(d, (struct bpf_program *)addr, cmd); 814 break; 815 816 /* 817 * Flush read packet buffer. 818 */ 819 case BIOCFLUSH: 820 BPFD_LOCK(d); 821 reset_d(d); 822 BPFD_UNLOCK(d); 823 break; 824 825 /* 826 * Put interface into promiscuous mode. 827 */ 828 case BIOCPROMISC: 829 if (d->bd_bif == NULL) { 830 /* 831 * No interface attached yet. 832 */ 833 error = EINVAL; 834 break; 835 } 836 if (d->bd_promisc == 0) { 837 mtx_lock(&Giant); 838 error = ifpromisc(d->bd_bif->bif_ifp, 1); 839 mtx_unlock(&Giant); 840 if (error == 0) 841 d->bd_promisc = 1; 842 } 843 break; 844 845 /* 846 * Get current data link type. 847 */ 848 case BIOCGDLT: 849 if (d->bd_bif == NULL) 850 error = EINVAL; 851 else 852 *(u_int *)addr = d->bd_bif->bif_dlt; 853 break; 854 855 /* 856 * Get a list of supported data link types. 857 */ 858 case BIOCGDLTLIST: 859 if (d->bd_bif == NULL) 860 error = EINVAL; 861 else 862 error = bpf_getdltlist(d, (struct bpf_dltlist *)addr); 863 break; 864 865 /* 866 * Set data link type. 867 */ 868 case BIOCSDLT: 869 if (d->bd_bif == NULL) 870 error = EINVAL; 871 else 872 error = bpf_setdlt(d, *(u_int *)addr); 873 break; 874 875 /* 876 * Get interface name. 877 */ 878 case BIOCGETIF: 879 if (d->bd_bif == NULL) 880 error = EINVAL; 881 else { 882 struct ifnet *const ifp = d->bd_bif->bif_ifp; 883 struct ifreq *const ifr = (struct ifreq *)addr; 884 885 strlcpy(ifr->ifr_name, ifp->if_xname, 886 sizeof(ifr->ifr_name)); 887 } 888 break; 889 890 /* 891 * Set interface. 892 */ 893 case BIOCSETIF: 894 error = bpf_setif(d, (struct ifreq *)addr); 895 break; 896 897 /* 898 * Set read timeout. 899 */ 900 case BIOCSRTIMEOUT: 901 { 902 struct timeval *tv = (struct timeval *)addr; 903 904 /* 905 * Subtract 1 tick from tvtohz() since this isn't 906 * a one-shot timer. 907 */ 908 if ((error = itimerfix(tv)) == 0) 909 d->bd_rtout = tvtohz(tv) - 1; 910 break; 911 } 912 913 /* 914 * Get read timeout. 915 */ 916 case BIOCGRTIMEOUT: 917 { 918 struct timeval *tv = (struct timeval *)addr; 919 920 tv->tv_sec = d->bd_rtout / hz; 921 tv->tv_usec = (d->bd_rtout % hz) * tick; 922 break; 923 } 924 925 /* 926 * Get packet stats. 927 */ 928 case BIOCGSTATS: 929 { 930 struct bpf_stat *bs = (struct bpf_stat *)addr; 931 932 bs->bs_recv = d->bd_rcount; 933 bs->bs_drop = d->bd_dcount; 934 break; 935 } 936 937 /* 938 * Set immediate mode. 939 */ 940 case BIOCIMMEDIATE: 941 d->bd_immediate = *(u_int *)addr; 942 break; 943 944 case BIOCVERSION: 945 { 946 struct bpf_version *bv = (struct bpf_version *)addr; 947 948 bv->bv_major = BPF_MAJOR_VERSION; 949 bv->bv_minor = BPF_MINOR_VERSION; 950 break; 951 } 952 953 /* 954 * Get "header already complete" flag 955 */ 956 case BIOCGHDRCMPLT: 957 *(u_int *)addr = d->bd_hdrcmplt; 958 break; 959 960 /* 961 * Set "header already complete" flag 962 */ 963 case BIOCSHDRCMPLT: 964 d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0; 965 break; 966 967 /* 968 * Get packet direction flag 969 */ 970 case BIOCGDIRECTION: 971 *(u_int *)addr = d->bd_direction; 972 break; 973 974 /* 975 * Set packet direction flag 976 */ 977 case BIOCSDIRECTION: 978 { 979 u_int direction; 980 981 direction = *(u_int *)addr; 982 switch (direction) { 983 case BPF_D_IN: 984 case BPF_D_INOUT: 985 case BPF_D_OUT: 986 d->bd_direction = direction; 987 break; 988 default: 989 error = EINVAL; 990 } 991 } 992 break; 993 994 case BIOCFEEDBACK: 995 d->bd_feedback = *(u_int *)addr; 996 break; 997 998 case BIOCLOCK: 999 d->bd_locked = 1; 1000 break; 1001 1002 case FIONBIO: /* Non-blocking I/O */ 1003 break; 1004 1005 case FIOASYNC: /* Send signal on receive packets */ 1006 d->bd_async = *(int *)addr; 1007 break; 1008 1009 case FIOSETOWN: 1010 error = fsetown(*(int *)addr, &d->bd_sigio); 1011 break; 1012 1013 case FIOGETOWN: 1014 *(int *)addr = fgetown(&d->bd_sigio); 1015 break; 1016 1017 /* This is deprecated, FIOSETOWN should be used instead. */ 1018 case TIOCSPGRP: 1019 error = fsetown(-(*(int *)addr), &d->bd_sigio); 1020 break; 1021 1022 /* This is deprecated, FIOGETOWN should be used instead. */ 1023 case TIOCGPGRP: 1024 *(int *)addr = -fgetown(&d->bd_sigio); 1025 break; 1026 1027 case BIOCSRSIG: /* Set receive signal */ 1028 { 1029 u_int sig; 1030 1031 sig = *(u_int *)addr; 1032 1033 if (sig >= NSIG) 1034 error = EINVAL; 1035 else 1036 d->bd_sig = sig; 1037 break; 1038 } 1039 case BIOCGRSIG: 1040 *(u_int *)addr = d->bd_sig; 1041 break; 1042 } 1043 return (error); 1044 } 1045 1046 /* 1047 * Set d's packet filter program to fp. If this file already has a filter, 1048 * free it and replace it. Returns EINVAL for bogus requests. 1049 */ 1050 static int 1051 bpf_setf(struct bpf_d *d, struct bpf_program *fp, u_long cmd) 1052 { 1053 struct bpf_insn *fcode, *old; 1054 u_int wfilter, flen, size; 1055 #ifdef BPF_JITTER 1056 bpf_jit_filter *ofunc; 1057 #endif 1058 1059 if (cmd == BIOCSETWF) { 1060 old = d->bd_wfilter; 1061 wfilter = 1; 1062 #ifdef BPF_JITTER 1063 ofunc = NULL; 1064 #endif 1065 } else { 1066 wfilter = 0; 1067 old = d->bd_rfilter; 1068 #ifdef BPF_JITTER 1069 ofunc = d->bd_bfilter; 1070 #endif 1071 } 1072 if (fp->bf_insns == NULL) { 1073 if (fp->bf_len != 0) 1074 return (EINVAL); 1075 BPFD_LOCK(d); 1076 if (wfilter) 1077 d->bd_wfilter = NULL; 1078 else { 1079 d->bd_rfilter = NULL; 1080 #ifdef BPF_JITTER 1081 d->bd_bfilter = NULL; 1082 #endif 1083 } 1084 reset_d(d); 1085 BPFD_UNLOCK(d); 1086 if (old != NULL) 1087 free((caddr_t)old, M_BPF); 1088 #ifdef BPF_JITTER 1089 if (ofunc != NULL) 1090 bpf_destroy_jit_filter(ofunc); 1091 #endif 1092 return (0); 1093 } 1094 flen = fp->bf_len; 1095 if (flen > bpf_maxinsns) 1096 return (EINVAL); 1097 1098 size = flen * sizeof(*fp->bf_insns); 1099 fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK); 1100 if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 && 1101 bpf_validate(fcode, (int)flen)) { 1102 BPFD_LOCK(d); 1103 if (wfilter) 1104 d->bd_wfilter = fcode; 1105 else { 1106 d->bd_rfilter = fcode; 1107 #ifdef BPF_JITTER 1108 d->bd_bfilter = bpf_jitter(fcode, flen); 1109 #endif 1110 } 1111 reset_d(d); 1112 BPFD_UNLOCK(d); 1113 if (old != NULL) 1114 free((caddr_t)old, M_BPF); 1115 #ifdef BPF_JITTER 1116 if (ofunc != NULL) 1117 bpf_destroy_jit_filter(ofunc); 1118 #endif 1119 1120 return (0); 1121 } 1122 free((caddr_t)fcode, M_BPF); 1123 return (EINVAL); 1124 } 1125 1126 /* 1127 * Detach a file from its current interface (if attached at all) and attach 1128 * to the interface indicated by the name stored in ifr. 1129 * Return an errno or 0. 1130 */ 1131 static int 1132 bpf_setif(struct bpf_d *d, struct ifreq *ifr) 1133 { 1134 struct bpf_if *bp; 1135 struct ifnet *theywant; 1136 1137 theywant = ifunit(ifr->ifr_name); 1138 if (theywant == NULL || theywant->if_bpf == NULL) 1139 return (ENXIO); 1140 1141 bp = theywant->if_bpf; 1142 /* 1143 * Allocate the packet buffers if we need to. 1144 * If we're already attached to requested interface, 1145 * just flush the buffer. 1146 */ 1147 if (d->bd_sbuf == NULL) 1148 bpf_allocbufs(d); 1149 if (bp != d->bd_bif) { 1150 if (d->bd_bif) 1151 /* 1152 * Detach if attached to something else. 1153 */ 1154 bpf_detachd(d); 1155 1156 bpf_attachd(d, bp); 1157 } 1158 BPFD_LOCK(d); 1159 reset_d(d); 1160 BPFD_UNLOCK(d); 1161 return (0); 1162 } 1163 1164 /* 1165 * Support for select() and poll() system calls 1166 * 1167 * Return true iff the specific operation will not block indefinitely. 1168 * Otherwise, return false but make a note that a selwakeup() must be done. 1169 */ 1170 static int 1171 bpfpoll(struct cdev *dev, int events, struct thread *td) 1172 { 1173 struct bpf_d *d; 1174 int revents; 1175 1176 d = dev->si_drv1; 1177 if (d->bd_bif == NULL) 1178 return (ENXIO); 1179 1180 /* 1181 * Refresh PID associated with this descriptor. 1182 */ 1183 revents = events & (POLLOUT | POLLWRNORM); 1184 BPFD_LOCK(d); 1185 d->bd_pid = td->td_proc->p_pid; 1186 if (events & (POLLIN | POLLRDNORM)) { 1187 if (bpf_ready(d)) 1188 revents |= events & (POLLIN | POLLRDNORM); 1189 else { 1190 selrecord(td, &d->bd_sel); 1191 /* Start the read timeout if necessary. */ 1192 if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) { 1193 callout_reset(&d->bd_callout, d->bd_rtout, 1194 bpf_timed_out, d); 1195 d->bd_state = BPF_WAITING; 1196 } 1197 } 1198 } 1199 BPFD_UNLOCK(d); 1200 return (revents); 1201 } 1202 1203 /* 1204 * Support for kevent() system call. Register EVFILT_READ filters and 1205 * reject all others. 1206 */ 1207 int 1208 bpfkqfilter(struct cdev *dev, struct knote *kn) 1209 { 1210 struct bpf_d *d = (struct bpf_d *)dev->si_drv1; 1211 1212 if (kn->kn_filter != EVFILT_READ) 1213 return (1); 1214 1215 /* 1216 * Refresh PID associated with this descriptor. 1217 */ 1218 BPFD_LOCK(d); 1219 d->bd_pid = curthread->td_proc->p_pid; 1220 kn->kn_fop = &bpfread_filtops; 1221 kn->kn_hook = d; 1222 knlist_add(&d->bd_sel.si_note, kn, 1); 1223 BPFD_UNLOCK(d); 1224 1225 return (0); 1226 } 1227 1228 static void 1229 filt_bpfdetach(struct knote *kn) 1230 { 1231 struct bpf_d *d = (struct bpf_d *)kn->kn_hook; 1232 1233 knlist_remove(&d->bd_sel.si_note, kn, 0); 1234 } 1235 1236 static int 1237 filt_bpfread(struct knote *kn, long hint) 1238 { 1239 struct bpf_d *d = (struct bpf_d *)kn->kn_hook; 1240 int ready; 1241 1242 BPFD_LOCK_ASSERT(d); 1243 ready = bpf_ready(d); 1244 if (ready) { 1245 kn->kn_data = d->bd_slen; 1246 if (d->bd_hbuf) 1247 kn->kn_data += d->bd_hlen; 1248 } 1249 else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) { 1250 callout_reset(&d->bd_callout, d->bd_rtout, 1251 bpf_timed_out, d); 1252 d->bd_state = BPF_WAITING; 1253 } 1254 1255 return (ready); 1256 } 1257 1258 /* 1259 * Incoming linkage from device drivers. Process the packet pkt, of length 1260 * pktlen, which is stored in a contiguous buffer. The packet is parsed 1261 * by each process' filter, and if accepted, stashed into the corresponding 1262 * buffer. 1263 */ 1264 void 1265 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen) 1266 { 1267 struct bpf_d *d; 1268 u_int slen; 1269 int gottime; 1270 struct timeval tv; 1271 1272 gottime = 0; 1273 BPFIF_LOCK(bp); 1274 LIST_FOREACH(d, &bp->bif_dlist, bd_next) { 1275 BPFD_LOCK(d); 1276 ++d->bd_rcount; 1277 #ifdef BPF_JITTER 1278 if (bpf_jitter_enable != 0 && d->bd_bfilter != NULL) 1279 slen = (*(d->bd_bfilter->func))(pkt, pktlen, pktlen); 1280 else 1281 #endif 1282 slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen); 1283 if (slen != 0) { 1284 d->bd_fcount++; 1285 if (!gottime) { 1286 microtime(&tv); 1287 gottime = 1; 1288 } 1289 #ifdef MAC 1290 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0) 1291 #endif 1292 catchpacket(d, pkt, pktlen, slen, bcopy, &tv); 1293 } 1294 BPFD_UNLOCK(d); 1295 } 1296 BPFIF_UNLOCK(bp); 1297 } 1298 1299 /* 1300 * Copy data from an mbuf chain into a buffer. This code is derived 1301 * from m_copydata in sys/uipc_mbuf.c. 1302 */ 1303 static void 1304 bpf_mcopy(const void *src_arg, void *dst_arg, size_t len) 1305 { 1306 const struct mbuf *m; 1307 u_int count; 1308 u_char *dst; 1309 1310 m = src_arg; 1311 dst = dst_arg; 1312 while (len > 0) { 1313 if (m == NULL) 1314 panic("bpf_mcopy"); 1315 count = min(m->m_len, len); 1316 bcopy(mtod(m, void *), dst, count); 1317 m = m->m_next; 1318 dst += count; 1319 len -= count; 1320 } 1321 } 1322 1323 #define BPF_CHECK_DIRECTION(d, m) \ 1324 if (((d)->bd_direction == BPF_D_IN && (m)->m_pkthdr.rcvif == NULL) || \ 1325 ((d)->bd_direction == BPF_D_OUT && (m)->m_pkthdr.rcvif != NULL)) 1326 1327 /* 1328 * Incoming linkage from device drivers, when packet is in an mbuf chain. 1329 */ 1330 void 1331 bpf_mtap(struct bpf_if *bp, struct mbuf *m) 1332 { 1333 struct bpf_d *d; 1334 u_int pktlen, slen; 1335 int gottime; 1336 struct timeval tv; 1337 1338 if (m->m_flags & M_SKIP_BPF) { 1339 m->m_flags &= ~M_SKIP_BPF; 1340 return; 1341 } 1342 1343 gottime = 0; 1344 1345 pktlen = m_length(m, NULL); 1346 1347 BPFIF_LOCK(bp); 1348 LIST_FOREACH(d, &bp->bif_dlist, bd_next) { 1349 BPF_CHECK_DIRECTION(d, m) 1350 continue; 1351 BPFD_LOCK(d); 1352 ++d->bd_rcount; 1353 #ifdef BPF_JITTER 1354 /* XXX We cannot handle multiple mbufs. */ 1355 if (bpf_jitter_enable != 0 && d->bd_bfilter != NULL && 1356 m->m_next == NULL) 1357 slen = (*(d->bd_bfilter->func))(mtod(m, u_char *), 1358 pktlen, pktlen); 1359 else 1360 #endif 1361 slen = bpf_filter(d->bd_rfilter, (u_char *)m, pktlen, 0); 1362 if (slen != 0) { 1363 d->bd_fcount++; 1364 if (!gottime) { 1365 microtime(&tv); 1366 gottime = 1; 1367 } 1368 #ifdef MAC 1369 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0) 1370 #endif 1371 catchpacket(d, (u_char *)m, pktlen, slen, 1372 bpf_mcopy, &tv); 1373 } 1374 BPFD_UNLOCK(d); 1375 } 1376 BPFIF_UNLOCK(bp); 1377 } 1378 1379 /* 1380 * Incoming linkage from device drivers, when packet is in 1381 * an mbuf chain and to be prepended by a contiguous header. 1382 */ 1383 void 1384 bpf_mtap2(struct bpf_if *bp, void *data, u_int dlen, struct mbuf *m) 1385 { 1386 struct mbuf mb; 1387 struct bpf_d *d; 1388 u_int pktlen, slen; 1389 int gottime; 1390 struct timeval tv; 1391 1392 if (m->m_flags & M_SKIP_BPF) { 1393 m->m_flags &= ~M_SKIP_BPF; 1394 return; 1395 } 1396 1397 gottime = 0; 1398 1399 pktlen = m_length(m, NULL); 1400 /* 1401 * Craft on-stack mbuf suitable for passing to bpf_filter. 1402 * Note that we cut corners here; we only setup what's 1403 * absolutely needed--this mbuf should never go anywhere else. 1404 */ 1405 mb.m_next = m; 1406 mb.m_data = data; 1407 mb.m_len = dlen; 1408 pktlen += dlen; 1409 1410 BPFIF_LOCK(bp); 1411 LIST_FOREACH(d, &bp->bif_dlist, bd_next) { 1412 BPF_CHECK_DIRECTION(d, m) 1413 continue; 1414 BPFD_LOCK(d); 1415 ++d->bd_rcount; 1416 slen = bpf_filter(d->bd_rfilter, (u_char *)&mb, pktlen, 0); 1417 if (slen != 0) { 1418 d->bd_fcount++; 1419 if (!gottime) { 1420 microtime(&tv); 1421 gottime = 1; 1422 } 1423 #ifdef MAC 1424 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0) 1425 #endif 1426 catchpacket(d, (u_char *)&mb, pktlen, slen, 1427 bpf_mcopy, &tv); 1428 } 1429 BPFD_UNLOCK(d); 1430 } 1431 BPFIF_UNLOCK(bp); 1432 } 1433 1434 #undef BPF_CHECK_DIRECTION 1435 1436 /* 1437 * Move the packet data from interface memory (pkt) into the 1438 * store buffer. "cpfn" is the routine called to do the actual data 1439 * transfer. bcopy is passed in to copy contiguous chunks, while 1440 * bpf_mcopy is passed in to copy mbuf chains. In the latter case, 1441 * pkt is really an mbuf. 1442 */ 1443 static void 1444 catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen, 1445 void (*cpfn)(const void *, void *, size_t), struct timeval *tv) 1446 { 1447 struct bpf_hdr *hp; 1448 int totlen, curlen; 1449 int hdrlen = d->bd_bif->bif_hdrlen; 1450 int do_wakeup = 0; 1451 1452 BPFD_LOCK_ASSERT(d); 1453 /* 1454 * Figure out how many bytes to move. If the packet is 1455 * greater or equal to the snapshot length, transfer that 1456 * much. Otherwise, transfer the whole packet (unless 1457 * we hit the buffer size limit). 1458 */ 1459 totlen = hdrlen + min(snaplen, pktlen); 1460 if (totlen > d->bd_bufsize) 1461 totlen = d->bd_bufsize; 1462 1463 /* 1464 * Round up the end of the previous packet to the next longword. 1465 */ 1466 curlen = BPF_WORDALIGN(d->bd_slen); 1467 if (curlen + totlen > d->bd_bufsize) { 1468 /* 1469 * This packet will overflow the storage buffer. 1470 * Rotate the buffers if we can, then wakeup any 1471 * pending reads. 1472 */ 1473 if (d->bd_fbuf == NULL) { 1474 /* 1475 * We haven't completed the previous read yet, 1476 * so drop the packet. 1477 */ 1478 ++d->bd_dcount; 1479 return; 1480 } 1481 ROTATE_BUFFERS(d); 1482 do_wakeup = 1; 1483 curlen = 0; 1484 } 1485 else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT) 1486 /* 1487 * Immediate mode is set, or the read timeout has 1488 * already expired during a select call. A packet 1489 * arrived, so the reader should be woken up. 1490 */ 1491 do_wakeup = 1; 1492 1493 /* 1494 * Append the bpf header. 1495 */ 1496 hp = (struct bpf_hdr *)(d->bd_sbuf + curlen); 1497 hp->bh_tstamp = *tv; 1498 hp->bh_datalen = pktlen; 1499 hp->bh_hdrlen = hdrlen; 1500 /* 1501 * Copy the packet data into the store buffer and update its length. 1502 */ 1503 (*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen)); 1504 d->bd_slen = curlen + totlen; 1505 1506 if (do_wakeup) 1507 bpf_wakeup(d); 1508 } 1509 1510 /* 1511 * Initialize all nonzero fields of a descriptor. 1512 */ 1513 static void 1514 bpf_allocbufs(struct bpf_d *d) 1515 { 1516 1517 KASSERT(d->bd_fbuf == NULL, ("bpf_allocbufs: bd_fbuf != NULL")); 1518 KASSERT(d->bd_sbuf == NULL, ("bpf_allocbufs: bd_sbuf != NULL")); 1519 KASSERT(d->bd_hbuf == NULL, ("bpf_allocbufs: bd_hbuf != NULL")); 1520 1521 d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK); 1522 d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK); 1523 d->bd_slen = 0; 1524 d->bd_hlen = 0; 1525 } 1526 1527 /* 1528 * Free buffers currently in use by a descriptor. 1529 * Called on close. 1530 */ 1531 static void 1532 bpf_freed(struct bpf_d *d) 1533 { 1534 /* 1535 * We don't need to lock out interrupts since this descriptor has 1536 * been detached from its interface and it yet hasn't been marked 1537 * free. 1538 */ 1539 if (d->bd_sbuf != NULL) { 1540 free(d->bd_sbuf, M_BPF); 1541 if (d->bd_hbuf != NULL) 1542 free(d->bd_hbuf, M_BPF); 1543 if (d->bd_fbuf != NULL) 1544 free(d->bd_fbuf, M_BPF); 1545 } 1546 if (d->bd_rfilter) { 1547 free((caddr_t)d->bd_rfilter, M_BPF); 1548 #ifdef BPF_JITTER 1549 bpf_destroy_jit_filter(d->bd_bfilter); 1550 #endif 1551 } 1552 if (d->bd_wfilter) 1553 free((caddr_t)d->bd_wfilter, M_BPF); 1554 mtx_destroy(&d->bd_mtx); 1555 } 1556 1557 /* 1558 * Attach an interface to bpf. dlt is the link layer type; hdrlen is the 1559 * fixed size of the link header (variable length headers not yet supported). 1560 */ 1561 void 1562 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen) 1563 { 1564 1565 bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf); 1566 } 1567 1568 /* 1569 * Attach an interface to bpf. ifp is a pointer to the structure 1570 * defining the interface to be attached, dlt is the link layer type, 1571 * and hdrlen is the fixed size of the link header (variable length 1572 * headers are not yet supporrted). 1573 */ 1574 void 1575 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp) 1576 { 1577 struct bpf_if *bp; 1578 1579 bp = malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO); 1580 if (bp == NULL) 1581 panic("bpfattach"); 1582 1583 LIST_INIT(&bp->bif_dlist); 1584 bp->bif_ifp = ifp; 1585 bp->bif_dlt = dlt; 1586 mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF); 1587 KASSERT(*driverp == NULL, ("bpfattach2: driverp already initialized")); 1588 *driverp = bp; 1589 1590 mtx_lock(&bpf_mtx); 1591 LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next); 1592 mtx_unlock(&bpf_mtx); 1593 1594 /* 1595 * Compute the length of the bpf header. This is not necessarily 1596 * equal to SIZEOF_BPF_HDR because we want to insert spacing such 1597 * that the network layer header begins on a longword boundary (for 1598 * performance reasons and to alleviate alignment restrictions). 1599 */ 1600 bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen; 1601 1602 if (bootverbose) 1603 if_printf(ifp, "bpf attached\n"); 1604 } 1605 1606 /* 1607 * Detach bpf from an interface. This involves detaching each descriptor 1608 * associated with the interface, and leaving bd_bif NULL. Notify each 1609 * descriptor as it's detached so that any sleepers wake up and get 1610 * ENXIO. 1611 */ 1612 void 1613 bpfdetach(struct ifnet *ifp) 1614 { 1615 struct bpf_if *bp; 1616 struct bpf_d *d; 1617 1618 /* Locate BPF interface information */ 1619 mtx_lock(&bpf_mtx); 1620 LIST_FOREACH(bp, &bpf_iflist, bif_next) { 1621 if (ifp == bp->bif_ifp) 1622 break; 1623 } 1624 1625 /* Interface wasn't attached */ 1626 if ((bp == NULL) || (bp->bif_ifp == NULL)) { 1627 mtx_unlock(&bpf_mtx); 1628 printf("bpfdetach: %s was not attached\n", ifp->if_xname); 1629 return; 1630 } 1631 1632 LIST_REMOVE(bp, bif_next); 1633 mtx_unlock(&bpf_mtx); 1634 1635 while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) { 1636 bpf_detachd(d); 1637 BPFD_LOCK(d); 1638 bpf_wakeup(d); 1639 BPFD_UNLOCK(d); 1640 } 1641 1642 mtx_destroy(&bp->bif_mtx); 1643 free(bp, M_BPF); 1644 } 1645 1646 /* 1647 * Get a list of available data link type of the interface. 1648 */ 1649 static int 1650 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl) 1651 { 1652 int n, error; 1653 struct ifnet *ifp; 1654 struct bpf_if *bp; 1655 1656 ifp = d->bd_bif->bif_ifp; 1657 n = 0; 1658 error = 0; 1659 mtx_lock(&bpf_mtx); 1660 LIST_FOREACH(bp, &bpf_iflist, bif_next) { 1661 if (bp->bif_ifp != ifp) 1662 continue; 1663 if (bfl->bfl_list != NULL) { 1664 if (n >= bfl->bfl_len) { 1665 mtx_unlock(&bpf_mtx); 1666 return (ENOMEM); 1667 } 1668 error = copyout(&bp->bif_dlt, 1669 bfl->bfl_list + n, sizeof(u_int)); 1670 } 1671 n++; 1672 } 1673 mtx_unlock(&bpf_mtx); 1674 bfl->bfl_len = n; 1675 return (error); 1676 } 1677 1678 /* 1679 * Set the data link type of a BPF instance. 1680 */ 1681 static int 1682 bpf_setdlt(struct bpf_d *d, u_int dlt) 1683 { 1684 int error, opromisc; 1685 struct ifnet *ifp; 1686 struct bpf_if *bp; 1687 1688 if (d->bd_bif->bif_dlt == dlt) 1689 return (0); 1690 ifp = d->bd_bif->bif_ifp; 1691 mtx_lock(&bpf_mtx); 1692 LIST_FOREACH(bp, &bpf_iflist, bif_next) { 1693 if (bp->bif_ifp == ifp && bp->bif_dlt == dlt) 1694 break; 1695 } 1696 mtx_unlock(&bpf_mtx); 1697 if (bp != NULL) { 1698 opromisc = d->bd_promisc; 1699 bpf_detachd(d); 1700 bpf_attachd(d, bp); 1701 BPFD_LOCK(d); 1702 reset_d(d); 1703 BPFD_UNLOCK(d); 1704 if (opromisc) { 1705 error = ifpromisc(bp->bif_ifp, 1); 1706 if (error) 1707 if_printf(bp->bif_ifp, 1708 "bpf_setdlt: ifpromisc failed (%d)\n", 1709 error); 1710 else 1711 d->bd_promisc = 1; 1712 } 1713 } 1714 return (bp == NULL ? EINVAL : 0); 1715 } 1716 1717 static void 1718 bpf_clone(void *arg, struct ucred *cred, char *name, int namelen, 1719 struct cdev **dev) 1720 { 1721 int u; 1722 1723 if (*dev != NULL) 1724 return; 1725 if (dev_stdclone(name, NULL, "bpf", &u) != 1) 1726 return; 1727 *dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600, 1728 "bpf%d", u); 1729 dev_ref(*dev); 1730 (*dev)->si_flags |= SI_CHEAPCLONE; 1731 return; 1732 } 1733 1734 static void 1735 bpf_drvinit(void *unused) 1736 { 1737 1738 mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF); 1739 LIST_INIT(&bpf_iflist); 1740 EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000); 1741 } 1742 1743 static void 1744 bpfstats_fill_xbpf(struct xbpf_d *d, struct bpf_d *bd) 1745 { 1746 1747 bzero(d, sizeof(*d)); 1748 BPFD_LOCK_ASSERT(bd); 1749 d->bd_immediate = bd->bd_immediate; 1750 d->bd_promisc = bd->bd_promisc; 1751 d->bd_hdrcmplt = bd->bd_hdrcmplt; 1752 d->bd_direction = bd->bd_direction; 1753 d->bd_feedback = bd->bd_feedback; 1754 d->bd_async = bd->bd_async; 1755 d->bd_rcount = bd->bd_rcount; 1756 d->bd_dcount = bd->bd_dcount; 1757 d->bd_fcount = bd->bd_fcount; 1758 d->bd_sig = bd->bd_sig; 1759 d->bd_slen = bd->bd_slen; 1760 d->bd_hlen = bd->bd_hlen; 1761 d->bd_bufsize = bd->bd_bufsize; 1762 d->bd_pid = bd->bd_pid; 1763 strlcpy(d->bd_ifname, 1764 bd->bd_bif->bif_ifp->if_xname, IFNAMSIZ); 1765 d->bd_locked = bd->bd_locked; 1766 } 1767 1768 static int 1769 bpf_stats_sysctl(SYSCTL_HANDLER_ARGS) 1770 { 1771 struct xbpf_d *xbdbuf, *xbd; 1772 int index, error; 1773 struct bpf_if *bp; 1774 struct bpf_d *bd; 1775 1776 /* 1777 * XXX This is not technically correct. It is possible for non 1778 * privileged users to open bpf devices. It would make sense 1779 * if the users who opened the devices were able to retrieve 1780 * the statistics for them, too. 1781 */ 1782 error = priv_check(req->td, PRIV_NET_BPF); 1783 if (error) 1784 return (error); 1785 if (req->oldptr == NULL) 1786 return (SYSCTL_OUT(req, 0, bpf_bpfd_cnt * sizeof(*xbd))); 1787 if (bpf_bpfd_cnt == 0) 1788 return (SYSCTL_OUT(req, 0, 0)); 1789 xbdbuf = malloc(req->oldlen, M_BPF, M_WAITOK); 1790 mtx_lock(&bpf_mtx); 1791 if (req->oldlen < (bpf_bpfd_cnt * sizeof(*xbd))) { 1792 mtx_unlock(&bpf_mtx); 1793 free(xbdbuf, M_BPF); 1794 return (ENOMEM); 1795 } 1796 index = 0; 1797 LIST_FOREACH(bp, &bpf_iflist, bif_next) { 1798 BPFIF_LOCK(bp); 1799 LIST_FOREACH(bd, &bp->bif_dlist, bd_next) { 1800 xbd = &xbdbuf[index++]; 1801 BPFD_LOCK(bd); 1802 bpfstats_fill_xbpf(xbd, bd); 1803 BPFD_UNLOCK(bd); 1804 } 1805 BPFIF_UNLOCK(bp); 1806 } 1807 mtx_unlock(&bpf_mtx); 1808 error = SYSCTL_OUT(req, xbdbuf, index * sizeof(*xbd)); 1809 free(xbdbuf, M_BPF); 1810 return (error); 1811 } 1812 1813 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL) 1814 1815 #else /* !DEV_BPF && !NETGRAPH_BPF */ 1816 /* 1817 * NOP stubs to allow bpf-using drivers to load and function. 1818 * 1819 * A 'better' implementation would allow the core bpf functionality 1820 * to be loaded at runtime. 1821 */ 1822 static struct bpf_if bp_null; 1823 1824 void 1825 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen) 1826 { 1827 } 1828 1829 void 1830 bpf_mtap(struct bpf_if *bp, struct mbuf *m) 1831 { 1832 } 1833 1834 void 1835 bpf_mtap2(struct bpf_if *bp, void *d, u_int l, struct mbuf *m) 1836 { 1837 } 1838 1839 void 1840 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen) 1841 { 1842 1843 bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf); 1844 } 1845 1846 void 1847 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp) 1848 { 1849 1850 *driverp = &bp_null; 1851 } 1852 1853 void 1854 bpfdetach(struct ifnet *ifp) 1855 { 1856 } 1857 1858 u_int 1859 bpf_filter(const struct bpf_insn *pc, u_char *p, u_int wirelen, u_int buflen) 1860 { 1861 return -1; /* "no filter" behaviour */ 1862 } 1863 1864 int 1865 bpf_validate(const struct bpf_insn *f, int len) 1866 { 1867 return 0; /* false */ 1868 } 1869 1870 #endif /* !DEV_BPF && !NETGRAPH_BPF */ 1871