1 /* $OpenBSD: bpf.c,v 1.2 2021/03/02 19:20:13 florian Exp $ */
2
3 /* BPF socket interface code, originally contributed by Archie Cobbs. */
4
5 /*
6 * Copyright (c) 1995, 1996, 1998, 1999
7 * The Internet Software Consortium. All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of The Internet Software Consortium nor the names
19 * of its contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
23 * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
24 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
26 * DISCLAIMED. IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
27 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
29 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
30 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
31 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
32 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
33 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 *
36 * This software has been written for the Internet Software Consortium
37 * by Ted Lemon <mellon@fugue.com> in cooperation with Vixie
38 * Enterprises. To learn more about the Internet Software Consortium,
39 * see ``http://www.vix.com/isc''. To learn more about Vixie
40 * Enterprises, see ``http://www.vix.com''.
41 */
42
43 #include <sys/types.h>
44 #include <sys/ioctl.h>
45
46 #include <net/bpf.h>
47 #include <net/if.h>
48 #include <net/ethertypes.h>
49 #include <netinet/in.h>
50 #include <netinet/ip.h>
51
52 #include <fcntl.h>
53 #include <string.h>
54 #include <unistd.h>
55
56 #include "bpf.h"
57 #include "log.h"
58
59 #define CLIENT_PORT 68
60
61 /*
62 * Packet filter program.
63 */
64 struct bpf_insn dhcp_bpf_filter[] = {
65 /* Make sure this is an IP packet. */
66 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12),
67 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 8),
68
69 /* Make sure it's a UDP packet. */
70 BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23),
71 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 6),
72
73 /* Make sure this isn't a fragment. */
74 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20),
75 BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0),
76
77 /* Get the IP header length. */
78 BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14),
79
80 /* Make sure it's to the right port. */
81 BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16),
82 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, CLIENT_PORT, 0, 1),
83
84 /* If we passed all the tests, ask for the whole packet. */
85 BPF_STMT(BPF_RET+BPF_K, (unsigned int)-1),
86
87 /* Otherwise, drop it. */
88 BPF_STMT(BPF_RET+BPF_K, 0),
89 };
90
91 /*
92 * Packet write filter program:
93 * 'ip and udp and src port bootpc and dst port bootps'
94 */
95 struct bpf_insn dhcp_bpf_wfilter[] = {
96 BPF_STMT(BPF_LD + BPF_B + BPF_IND, 14),
97 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (IPVERSION << 4) + 5, 0, 12),
98
99 /* Make sure this is an IP packet. */
100 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 12),
101 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 10),
102
103 /* Make sure it's a UDP packet. */
104 BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 23),
105 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 8),
106
107 /* Make sure this isn't a fragment. */
108 BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20),
109 BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 6, 0), /* patched */
110
111 /* Get the IP header length. */
112 BPF_STMT(BPF_LDX + BPF_B + BPF_MSH, 14),
113
114 /* Make sure it's from the right port. */
115 BPF_STMT(BPF_LD + BPF_H + BPF_IND, 14),
116 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 68, 0, 3),
117
118 /* Make sure it is to the right ports. */
119 BPF_STMT(BPF_LD + BPF_H + BPF_IND, 16),
120 BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 67, 0, 1),
121
122 /* If we passed all the tests, ask for the whole packet. */
123 BPF_STMT(BPF_RET+BPF_K, (unsigned int)-1),
124
125 /* Otherwise, drop it. */
126 BPF_STMT(BPF_RET+BPF_K, 0),
127 };
128
129 int
get_bpf_sock(const char * name)130 get_bpf_sock(const char *name)
131 {
132 struct bpf_program p;
133 struct ifreq ifr;
134 u_int sz;
135 int flag = 1, fildrop = BPF_FILDROP_CAPTURE;
136 int bpffd;
137
138 if ((bpffd = open("/dev/bpf", O_RDWR | O_CLOEXEC | O_NONBLOCK)) == -1)
139 fatal("open(/dev/bpf)");
140
141 sz = BPFLEN;
142 /* Set the BPF buffer length. */
143 if (ioctl(bpffd, BIOCSBLEN, &sz) == -1)
144 fatal("BIOCSBLEN");
145 if (sz != BPFLEN)
146 fatal("BIOCSBLEN, expected %u, got %u", BPFLEN, sz);
147
148 /*
149 * Set immediate mode so that reads return as soon as a packet
150 * comes in, rather than waiting for the input buffer to fill
151 * with packets.
152 */
153 if (ioctl(bpffd, BIOCIMMEDIATE, &flag) == -1)
154 fatal("BIOCIMMEDIATE");
155
156 if (ioctl(bpffd, BIOCSFILDROP, &fildrop) == -1)
157 fatal("BIOCSFILDROP");
158
159 /* Set up the bpf filter program structure. */
160 p.bf_len = sizeof(dhcp_bpf_filter) / sizeof(struct bpf_insn);
161 p.bf_insns = dhcp_bpf_filter;
162
163 if (ioctl(bpffd, BIOCSETF, &p) == -1)
164 fatal("BIOCSETF");
165
166 /* Set up the bpf write filter program structure. */
167 p.bf_len = sizeof(dhcp_bpf_wfilter) / sizeof(struct bpf_insn);
168 p.bf_insns = dhcp_bpf_wfilter;
169
170 if (dhcp_bpf_wfilter[7].k == 0x1fff)
171 dhcp_bpf_wfilter[7].k = htons(IP_MF|IP_OFFMASK);
172
173 if (ioctl(bpffd, BIOCSETWF, &p) == -1)
174 fatal("BIOCSETWF");
175
176 strlcpy(ifr.ifr_name, name, IFNAMSIZ);
177 if (ioctl(bpffd, BIOCSETIF, &ifr) == -1) {
178 log_warn("BIOCSETIF"); /* interface might have disappeared */
179 close(bpffd);
180 return -1;
181 }
182
183 if (ioctl(bpffd, BIOCLOCK, NULL) == -1)
184 fatal("BIOCLOCK");
185
186 return bpffd;
187 }
188