1 /*
2  * WPA Supplicant - Layer2 packet handling with WinPcap RX thread
3  * Copyright (c) 2003-2006, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  *
8  * This l2_packet implementation is explicitly for WinPcap and Windows events.
9  * l2_packet_pcap.c has support for WinPcap, but it requires polling to receive
10  * frames which means relatively long latency for EAPOL RX processing. The
11  * implementation here uses a separate thread to allow WinPcap to be receiving
12  * all the time to reduce latency for EAPOL receiving from about 100 ms to 3 ms
13  * when comparing l2_packet_pcap.c to l2_packet_winpcap.c. Extra sleep of 50 ms
14  * is added in to receive thread whenever no EAPOL frames has been received for
15  * a while. Whenever an EAPOL handshake is expected, this sleep is removed.
16  *
17  * The RX thread receives a frame and signals main thread through Windows event
18  * about the availability of a new frame. Processing the received frame is
19  * synchronized with pair of Windows events so that no extra buffer or queuing
20  * mechanism is needed. This implementation requires Windows specific event
21  * loop implementation, i.e., eloop_win.c.
22  *
23  * WinPcap has pcap_getevent() that could, in theory at least, be used to
24  * implement this kind of waiting with a simpler single-thread design. However,
25  * that event handle is not really signaled immediately when receiving each
26  * frame, so it does not really work for this kind of use.
27  */
28 
29 #include "includes.h"
30 #include <pcap.h>
31 
32 #include "common.h"
33 #include "eloop.h"
34 #include "l2_packet.h"
35 
36 
37 static const u8 pae_group_addr[ETH_ALEN] =
38 { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03 };
39 
40 /*
41  * Number of pcap_dispatch() iterations to do without extra wait after each
42  * received EAPOL packet or authentication notification. This is used to reduce
43  * latency for EAPOL receive.
44  */
45 static const size_t no_wait_count = 750;
46 
47 struct l2_packet_data {
48 	pcap_t *pcap;
49 	unsigned int num_fast_poll;
50 	char ifname[100];
51 	u8 own_addr[ETH_ALEN];
52 	void (*rx_callback)(void *ctx, const u8 *src_addr,
53 			    const u8 *buf, size_t len);
54 	void *rx_callback_ctx;
55 	int l2_hdr; /* whether to include layer 2 (Ethernet) header in calls to
56 		     * rx_callback and l2_packet_send() */
57 	int running;
58 	HANDLE rx_avail, rx_done, rx_thread, rx_thread_done, rx_notify;
59 	u8 *rx_buf, *rx_src;
60 	size_t rx_len;
61 	size_t rx_no_wait;
62 };
63 
64 
65 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
66 {
67 	os_memcpy(addr, l2->own_addr, ETH_ALEN);
68 	return 0;
69 }
70 
71 
72 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
73 		   const u8 *buf, size_t len)
74 {
75 	int ret;
76 	struct l2_ethhdr *eth;
77 
78 	if (l2 == NULL)
79 		return -1;
80 
81 	if (l2->l2_hdr) {
82 		ret = pcap_sendpacket(l2->pcap, buf, len);
83 	} else {
84 		size_t mlen = sizeof(*eth) + len;
85 		eth = os_malloc(mlen);
86 		if (eth == NULL)
87 			return -1;
88 
89 		os_memcpy(eth->h_dest, dst_addr, ETH_ALEN);
90 		os_memcpy(eth->h_source, l2->own_addr, ETH_ALEN);
91 		eth->h_proto = htons(proto);
92 		os_memcpy(eth + 1, buf, len);
93 		ret = pcap_sendpacket(l2->pcap, (u8 *) eth, mlen);
94 		os_free(eth);
95 	}
96 
97 	return ret;
98 }
99 
100 
101 /* pcap_dispatch() callback for the RX thread */
102 static void l2_packet_receive_cb(u_char *user, const struct pcap_pkthdr *hdr,
103 				 const u_char *pkt_data)
104 {
105 	struct l2_packet_data *l2 = (struct l2_packet_data *) user;
106 	struct l2_ethhdr *ethhdr;
107 
108 	if (pkt_data == NULL || hdr->caplen < sizeof(*ethhdr))
109 		return;
110 
111 	ethhdr = (struct l2_ethhdr *) pkt_data;
112 	if (l2->l2_hdr) {
113 		l2->rx_buf = (u8 *) ethhdr;
114 		l2->rx_len = hdr->caplen;
115 	} else {
116 		l2->rx_buf = (u8 *) (ethhdr + 1);
117 		l2->rx_len = hdr->caplen - sizeof(*ethhdr);
118 	}
119 	l2->rx_src = ethhdr->h_source;
120 	SetEvent(l2->rx_avail);
121 	WaitForSingleObject(l2->rx_done, INFINITE);
122 	ResetEvent(l2->rx_done);
123 	l2->rx_no_wait = no_wait_count;
124 }
125 
126 
127 /* main RX loop that is running in a separate thread */
128 static DWORD WINAPI l2_packet_receive_thread(LPVOID arg)
129 {
130 	struct l2_packet_data *l2 = arg;
131 
132 	while (l2->running) {
133 		pcap_dispatch(l2->pcap, 1, l2_packet_receive_cb,
134 			      (u_char *) l2);
135 		if (l2->rx_no_wait > 0)
136 			l2->rx_no_wait--;
137 		if (WaitForSingleObject(l2->rx_notify,
138 					l2->rx_no_wait ? 0 : 50) ==
139 		    WAIT_OBJECT_0) {
140 			l2->rx_no_wait = no_wait_count;
141 			ResetEvent(l2->rx_notify);
142 		}
143 	}
144 	SetEvent(l2->rx_thread_done);
145 	ExitThread(0);
146 	return 0;
147 }
148 
149 
150 /* main thread RX event handler */
151 static void l2_packet_rx_event(void *eloop_data, void *user_data)
152 {
153 	struct l2_packet_data *l2 = eloop_data;
154 	l2->rx_callback(l2->rx_callback_ctx, l2->rx_src, l2->rx_buf,
155 			l2->rx_len);
156 	ResetEvent(l2->rx_avail);
157 	SetEvent(l2->rx_done);
158 }
159 
160 
161 static int l2_packet_init_libpcap(struct l2_packet_data *l2,
162 				  unsigned short protocol)
163 {
164 	bpf_u_int32 pcap_maskp, pcap_netp;
165 	char pcap_filter[200], pcap_err[PCAP_ERRBUF_SIZE];
166 	struct bpf_program pcap_fp;
167 
168 	pcap_lookupnet(l2->ifname, &pcap_netp, &pcap_maskp, pcap_err);
169 	l2->pcap = pcap_open_live(l2->ifname, 2500, 0, 1, pcap_err);
170 	if (l2->pcap == NULL) {
171 		fprintf(stderr, "pcap_open_live: %s\n", pcap_err);
172 		fprintf(stderr, "ifname='%s'\n", l2->ifname);
173 		return -1;
174 	}
175 	os_snprintf(pcap_filter, sizeof(pcap_filter),
176 		    "not ether src " MACSTR " and "
177 		    "( ether dst " MACSTR " or ether dst " MACSTR " ) and "
178 		    "ether proto 0x%x",
179 		    MAC2STR(l2->own_addr), /* do not receive own packets */
180 		    MAC2STR(l2->own_addr), MAC2STR(pae_group_addr),
181 		    protocol);
182 	if (pcap_compile(l2->pcap, &pcap_fp, pcap_filter, 1, pcap_netp) < 0) {
183 		fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(l2->pcap));
184 		return -1;
185 	}
186 
187 	if (pcap_setfilter(l2->pcap, &pcap_fp) < 0) {
188 		fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(l2->pcap));
189 		return -1;
190 	}
191 
192 	pcap_freecode(&pcap_fp);
193 
194 	return 0;
195 }
196 
197 
198 struct l2_packet_data * l2_packet_init(
199 	const char *ifname, const u8 *own_addr, unsigned short protocol,
200 	void (*rx_callback)(void *ctx, const u8 *src_addr,
201 			    const u8 *buf, size_t len),
202 	void *rx_callback_ctx, int l2_hdr)
203 {
204 	struct l2_packet_data *l2;
205 	DWORD thread_id;
206 
207 	l2 = os_zalloc(sizeof(struct l2_packet_data));
208 	if (l2 == NULL)
209 		return NULL;
210 	if (os_strncmp(ifname, "\\Device\\NPF_", 12) == 0)
211 		os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
212 	else
213 		os_snprintf(l2->ifname, sizeof(l2->ifname), "\\Device\\NPF_%s",
214 			    ifname);
215 	l2->rx_callback = rx_callback;
216 	l2->rx_callback_ctx = rx_callback_ctx;
217 	l2->l2_hdr = l2_hdr;
218 
219 	if (own_addr)
220 		os_memcpy(l2->own_addr, own_addr, ETH_ALEN);
221 
222 	if (l2_packet_init_libpcap(l2, protocol)) {
223 		os_free(l2);
224 		return NULL;
225 	}
226 
227 	l2->rx_avail = CreateEvent(NULL, TRUE, FALSE, NULL);
228 	l2->rx_done = CreateEvent(NULL, TRUE, FALSE, NULL);
229 	l2->rx_notify = CreateEvent(NULL, TRUE, FALSE, NULL);
230 	if (l2->rx_avail == NULL || l2->rx_done == NULL ||
231 	    l2->rx_notify == NULL) {
232 		CloseHandle(l2->rx_avail);
233 		CloseHandle(l2->rx_done);
234 		CloseHandle(l2->rx_notify);
235 		pcap_close(l2->pcap);
236 		os_free(l2);
237 		return NULL;
238 	}
239 
240 	eloop_register_event(l2->rx_avail, sizeof(l2->rx_avail),
241 			     l2_packet_rx_event, l2, NULL);
242 
243 	l2->running = 1;
244 	l2->rx_thread = CreateThread(NULL, 0, l2_packet_receive_thread, l2, 0,
245 				     &thread_id);
246 
247 	return l2;
248 }
249 
250 
251 struct l2_packet_data * l2_packet_init_bridge(
252 	const char *br_ifname, const char *ifname, const u8 *own_addr,
253 	unsigned short protocol,
254 	void (*rx_callback)(void *ctx, const u8 *src_addr,
255 			    const u8 *buf, size_t len),
256 	void *rx_callback_ctx, int l2_hdr)
257 {
258 	return l2_packet_init(br_ifname, own_addr, protocol, rx_callback,
259 			      rx_callback_ctx, l2_hdr);
260 }
261 
262 
263 static void l2_packet_deinit_timeout(void *eloop_ctx, void *timeout_ctx)
264 {
265 	struct l2_packet_data *l2 = eloop_ctx;
266 
267 	if (l2->rx_thread_done &&
268 	    WaitForSingleObject(l2->rx_thread_done, 2000) != WAIT_OBJECT_0) {
269 		wpa_printf(MSG_DEBUG, "l2_packet_winpcap: RX thread did not "
270 			   "exit - kill it\n");
271 		TerminateThread(l2->rx_thread, 0);
272 	}
273 	CloseHandle(l2->rx_thread_done);
274 	CloseHandle(l2->rx_thread);
275 	if (l2->pcap)
276 		pcap_close(l2->pcap);
277 	eloop_unregister_event(l2->rx_avail, sizeof(l2->rx_avail));
278 	CloseHandle(l2->rx_avail);
279 	CloseHandle(l2->rx_done);
280 	CloseHandle(l2->rx_notify);
281 	os_free(l2);
282 }
283 
284 
285 void l2_packet_deinit(struct l2_packet_data *l2)
286 {
287 	if (l2 == NULL)
288 		return;
289 
290 	l2->rx_thread_done = CreateEvent(NULL, TRUE, FALSE, NULL);
291 
292 	l2->running = 0;
293 	pcap_breakloop(l2->pcap);
294 
295 	/*
296 	 * RX thread may be waiting in l2_packet_receive_cb() for l2->rx_done
297 	 * event and this event is set in l2_packet_rx_event(). However,
298 	 * l2_packet_deinit() may end up being called from l2->rx_callback(),
299 	 * so we need to return from here and complete deinitialization in
300 	 * a registered timeout to avoid having to forcefully kill the RX
301 	 * thread.
302 	 */
303 	eloop_register_timeout(0, 0, l2_packet_deinit_timeout, l2, NULL);
304 }
305 
306 
307 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
308 {
309 	pcap_if_t *devs, *dev;
310 	struct pcap_addr *addr;
311 	struct sockaddr_in *saddr;
312 	int found = 0;
313 	char err[PCAP_ERRBUF_SIZE + 1];
314 
315 	if (pcap_findalldevs(&devs, err) < 0) {
316 		wpa_printf(MSG_DEBUG, "pcap_findalldevs: %s\n", err);
317 		return -1;
318 	}
319 
320 	for (dev = devs; dev && !found; dev = dev->next) {
321 		if (os_strcmp(dev->name, l2->ifname) != 0)
322 			continue;
323 
324 		addr = dev->addresses;
325 		while (addr) {
326 			saddr = (struct sockaddr_in *) addr->addr;
327 			if (saddr && saddr->sin_family == AF_INET) {
328 				os_strlcpy(buf, inet_ntoa(saddr->sin_addr),
329 					   len);
330 				found = 1;
331 				break;
332 			}
333 			addr = addr->next;
334 		}
335 	}
336 
337 	pcap_freealldevs(devs);
338 
339 	return found ? 0 : -1;
340 }
341 
342 
343 void l2_packet_notify_auth_start(struct l2_packet_data *l2)
344 {
345 	if (l2)
346 		SetEvent(l2->rx_notify);
347 }
348