1 /*
2  * WPA Supplicant - Layer2 packet handling with WinPcap RX thread
3  * Copyright (c) 2003-2006, Jouni Malinen <j@w1.fi>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  * Alternatively, this software may be distributed under the terms of BSD
10  * license.
11  *
12  * See README and COPYING for more details.
13  *
14  * This l2_packet implementation is explicitly for WinPcap and Windows events.
15  * l2_packet_pcap.c has support for WinPcap, but it requires polling to receive
16  * frames which means relatively long latency for EAPOL RX processing. The
17  * implementation here uses a separate thread to allow WinPcap to be receiving
18  * all the time to reduce latency for EAPOL receiving from about 100 ms to 3 ms
19  * when comparing l2_packet_pcap.c to l2_packet_winpcap.c. Extra sleep of 50 ms
20  * is added in to receive thread whenever no EAPOL frames has been received for
21  * a while. Whenever an EAPOL handshake is expected, this sleep is removed.
22  *
23  * The RX thread receives a frame and signals main thread through Windows event
24  * about the availability of a new frame. Processing the received frame is
25  * synchronized with pair of Windows events so that no extra buffer or queuing
26  * mechanism is needed. This implementation requires Windows specific event
27  * loop implementation, i.e., eloop_win.c.
28  *
29  * WinPcap has pcap_getevent() that could, in theory at least, be used to
30  * implement this kind of waiting with a simpler single-thread design. However,
31  * that event handle is not really signaled immediately when receiving each
32  * frame, so it does not really work for this kind of use.
33  */
34 
35 #include "includes.h"
36 #include <pcap.h>
37 
38 #include "common.h"
39 #include "eloop.h"
40 #include "l2_packet.h"
41 
42 
43 static const u8 pae_group_addr[ETH_ALEN] =
44 { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03 };
45 
46 /*
47  * Number of pcap_dispatch() iterations to do without extra wait after each
48  * received EAPOL packet or authentication notification. This is used to reduce
49  * latency for EAPOL receive.
50  */
51 static const size_t no_wait_count = 750;
52 
53 struct l2_packet_data {
54 	pcap_t *pcap;
55 	unsigned int num_fast_poll;
56 	char ifname[100];
57 	u8 own_addr[ETH_ALEN];
58 	void (*rx_callback)(void *ctx, const u8 *src_addr,
59 			    const u8 *buf, size_t len);
60 	void *rx_callback_ctx;
61 	int l2_hdr; /* whether to include layer 2 (Ethernet) header in calls to
62 		     * rx_callback and l2_packet_send() */
63 	int running;
64 	HANDLE rx_avail, rx_done, rx_thread, rx_thread_done, rx_notify;
65 	u8 *rx_buf, *rx_src;
66 	size_t rx_len;
67 	size_t rx_no_wait;
68 };
69 
70 
71 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
72 {
73 	os_memcpy(addr, l2->own_addr, ETH_ALEN);
74 	return 0;
75 }
76 
77 
78 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
79 		   const u8 *buf, size_t len)
80 {
81 	int ret;
82 	struct l2_ethhdr *eth;
83 
84 	if (l2 == NULL)
85 		return -1;
86 
87 	if (l2->l2_hdr) {
88 		ret = pcap_sendpacket(l2->pcap, buf, len);
89 	} else {
90 		size_t mlen = sizeof(*eth) + len;
91 		eth = os_malloc(mlen);
92 		if (eth == NULL)
93 			return -1;
94 
95 		os_memcpy(eth->h_dest, dst_addr, ETH_ALEN);
96 		os_memcpy(eth->h_source, l2->own_addr, ETH_ALEN);
97 		eth->h_proto = htons(proto);
98 		os_memcpy(eth + 1, buf, len);
99 		ret = pcap_sendpacket(l2->pcap, (u8 *) eth, mlen);
100 		os_free(eth);
101 	}
102 
103 	return ret;
104 }
105 
106 
107 /* pcap_dispatch() callback for the RX thread */
108 static void l2_packet_receive_cb(u_char *user, const struct pcap_pkthdr *hdr,
109 				 const u_char *pkt_data)
110 {
111 	struct l2_packet_data *l2 = (struct l2_packet_data *) user;
112 	struct l2_ethhdr *ethhdr;
113 
114 	if (pkt_data == NULL || hdr->caplen < sizeof(*ethhdr))
115 		return;
116 
117 	ethhdr = (struct l2_ethhdr *) pkt_data;
118 	if (l2->l2_hdr) {
119 		l2->rx_buf = (u8 *) ethhdr;
120 		l2->rx_len = hdr->caplen;
121 	} else {
122 		l2->rx_buf = (u8 *) (ethhdr + 1);
123 		l2->rx_len = hdr->caplen - sizeof(*ethhdr);
124 	}
125 	l2->rx_src = ethhdr->h_source;
126 	SetEvent(l2->rx_avail);
127 	WaitForSingleObject(l2->rx_done, INFINITE);
128 	ResetEvent(l2->rx_done);
129 	l2->rx_no_wait = no_wait_count;
130 }
131 
132 
133 /* main RX loop that is running in a separate thread */
134 static DWORD WINAPI l2_packet_receive_thread(LPVOID arg)
135 {
136 	struct l2_packet_data *l2 = arg;
137 
138 	while (l2->running) {
139 		pcap_dispatch(l2->pcap, 1, l2_packet_receive_cb,
140 			      (u_char *) l2);
141 		if (l2->rx_no_wait > 0)
142 			l2->rx_no_wait--;
143 		if (WaitForSingleObject(l2->rx_notify,
144 					l2->rx_no_wait ? 0 : 50) ==
145 		    WAIT_OBJECT_0) {
146 			l2->rx_no_wait = no_wait_count;
147 			ResetEvent(l2->rx_notify);
148 		}
149 	}
150 	SetEvent(l2->rx_thread_done);
151 	ExitThread(0);
152 	return 0;
153 }
154 
155 
156 /* main thread RX event handler */
157 static void l2_packet_rx_event(void *eloop_data, void *user_data)
158 {
159 	struct l2_packet_data *l2 = eloop_data;
160 	l2->rx_callback(l2->rx_callback_ctx, l2->rx_src, l2->rx_buf,
161 			l2->rx_len);
162 	ResetEvent(l2->rx_avail);
163 	SetEvent(l2->rx_done);
164 }
165 
166 
167 static int l2_packet_init_libpcap(struct l2_packet_data *l2,
168 				  unsigned short protocol)
169 {
170 	bpf_u_int32 pcap_maskp, pcap_netp;
171 	char pcap_filter[200], pcap_err[PCAP_ERRBUF_SIZE];
172 	struct bpf_program pcap_fp;
173 
174 	pcap_lookupnet(l2->ifname, &pcap_netp, &pcap_maskp, pcap_err);
175 	l2->pcap = pcap_open_live(l2->ifname, 2500, 0, 1, pcap_err);
176 	if (l2->pcap == NULL) {
177 		fprintf(stderr, "pcap_open_live: %s\n", pcap_err);
178 		fprintf(stderr, "ifname='%s'\n", l2->ifname);
179 		return -1;
180 	}
181 	os_snprintf(pcap_filter, sizeof(pcap_filter),
182 		    "not ether src " MACSTR " and "
183 		    "( ether dst " MACSTR " or ether dst " MACSTR " ) and "
184 		    "ether proto 0x%x",
185 		    MAC2STR(l2->own_addr), /* do not receive own packets */
186 		    MAC2STR(l2->own_addr), MAC2STR(pae_group_addr),
187 		    protocol);
188 	if (pcap_compile(l2->pcap, &pcap_fp, pcap_filter, 1, pcap_netp) < 0) {
189 		fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(l2->pcap));
190 		return -1;
191 	}
192 
193 	if (pcap_setfilter(l2->pcap, &pcap_fp) < 0) {
194 		fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(l2->pcap));
195 		return -1;
196 	}
197 
198 	pcap_freecode(&pcap_fp);
199 
200 	return 0;
201 }
202 
203 
204 struct l2_packet_data * l2_packet_init(
205 	const char *ifname, const u8 *own_addr, unsigned short protocol,
206 	void (*rx_callback)(void *ctx, const u8 *src_addr,
207 			    const u8 *buf, size_t len),
208 	void *rx_callback_ctx, int l2_hdr)
209 {
210 	struct l2_packet_data *l2;
211 	DWORD thread_id;
212 
213 	l2 = os_zalloc(sizeof(struct l2_packet_data));
214 	if (l2 == NULL)
215 		return NULL;
216 	if (os_strncmp(ifname, "\\Device\\NPF_", 12) == 0)
217 		os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
218 	else
219 		os_snprintf(l2->ifname, sizeof(l2->ifname), "\\Device\\NPF_%s",
220 			    ifname);
221 	l2->rx_callback = rx_callback;
222 	l2->rx_callback_ctx = rx_callback_ctx;
223 	l2->l2_hdr = l2_hdr;
224 
225 	if (own_addr)
226 		os_memcpy(l2->own_addr, own_addr, ETH_ALEN);
227 
228 	if (l2_packet_init_libpcap(l2, protocol)) {
229 		os_free(l2);
230 		return NULL;
231 	}
232 
233 	l2->rx_avail = CreateEvent(NULL, TRUE, FALSE, NULL);
234 	l2->rx_done = CreateEvent(NULL, TRUE, FALSE, NULL);
235 	l2->rx_notify = CreateEvent(NULL, TRUE, FALSE, NULL);
236 	if (l2->rx_avail == NULL || l2->rx_done == NULL ||
237 	    l2->rx_notify == NULL) {
238 		CloseHandle(l2->rx_avail);
239 		CloseHandle(l2->rx_done);
240 		CloseHandle(l2->rx_notify);
241 		pcap_close(l2->pcap);
242 		os_free(l2);
243 		return NULL;
244 	}
245 
246 	eloop_register_event(l2->rx_avail, sizeof(l2->rx_avail),
247 			     l2_packet_rx_event, l2, NULL);
248 
249 	l2->running = 1;
250 	l2->rx_thread = CreateThread(NULL, 0, l2_packet_receive_thread, l2, 0,
251 				     &thread_id);
252 
253 	return l2;
254 }
255 
256 
257 static void l2_packet_deinit_timeout(void *eloop_ctx, void *timeout_ctx)
258 {
259 	struct l2_packet_data *l2 = eloop_ctx;
260 
261 	if (l2->rx_thread_done &&
262 	    WaitForSingleObject(l2->rx_thread_done, 2000) != WAIT_OBJECT_0) {
263 		wpa_printf(MSG_DEBUG, "l2_packet_winpcap: RX thread did not "
264 			   "exit - kill it\n");
265 		TerminateThread(l2->rx_thread, 0);
266 	}
267 	CloseHandle(l2->rx_thread_done);
268 	CloseHandle(l2->rx_thread);
269 	if (l2->pcap)
270 		pcap_close(l2->pcap);
271 	eloop_unregister_event(l2->rx_avail, sizeof(l2->rx_avail));
272 	CloseHandle(l2->rx_avail);
273 	CloseHandle(l2->rx_done);
274 	CloseHandle(l2->rx_notify);
275 	os_free(l2);
276 }
277 
278 
279 void l2_packet_deinit(struct l2_packet_data *l2)
280 {
281 	if (l2 == NULL)
282 		return;
283 
284 	l2->rx_thread_done = CreateEvent(NULL, TRUE, FALSE, NULL);
285 
286 	l2->running = 0;
287 	pcap_breakloop(l2->pcap);
288 
289 	/*
290 	 * RX thread may be waiting in l2_packet_receive_cb() for l2->rx_done
291 	 * event and this event is set in l2_packet_rx_event(). However,
292 	 * l2_packet_deinit() may end up being called from l2->rx_callback(),
293 	 * so we need to return from here and complete deinitialization in
294 	 * a registered timeout to avoid having to forcefully kill the RX
295 	 * thread.
296 	 */
297 	eloop_register_timeout(0, 0, l2_packet_deinit_timeout, l2, NULL);
298 }
299 
300 
301 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
302 {
303 	pcap_if_t *devs, *dev;
304 	struct pcap_addr *addr;
305 	struct sockaddr_in *saddr;
306 	int found = 0;
307 	char err[PCAP_ERRBUF_SIZE + 1];
308 
309 	if (pcap_findalldevs(&devs, err) < 0) {
310 		wpa_printf(MSG_DEBUG, "pcap_findalldevs: %s\n", err);
311 		return -1;
312 	}
313 
314 	for (dev = devs; dev && !found; dev = dev->next) {
315 		if (os_strcmp(dev->name, l2->ifname) != 0)
316 			continue;
317 
318 		addr = dev->addresses;
319 		while (addr) {
320 			saddr = (struct sockaddr_in *) addr->addr;
321 			if (saddr && saddr->sin_family == AF_INET) {
322 				os_strlcpy(buf, inet_ntoa(saddr->sin_addr),
323 					   len);
324 				found = 1;
325 				break;
326 			}
327 			addr = addr->next;
328 		}
329 	}
330 
331 	pcap_freealldevs(devs);
332 
333 	return found ? 0 : -1;
334 }
335 
336 
337 void l2_packet_notify_auth_start(struct l2_packet_data *l2)
338 {
339 	if (l2)
340 		SetEvent(l2->rx_notify);
341 }
342