FreeBSD/Linux Kernel Cross Reference
sys/net/bpf.c
1 /*-
2 * Copyright (c) 1990, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * This code is derived from the Stanford/CMU enet packet filter,
6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8 * Berkeley Laboratory.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 4. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * @(#)bpf.c 8.4 (Berkeley) 1/9/95
35 *
36 * $FreeBSD$
37 */
38
39 #include "opt_bpf.h"
40 #include "opt_mac.h"
41 #include "opt_netgraph.h"
42
43 #include <sys/types.h>
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/conf.h>
47 #include <sys/fcntl.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 #include <sys/time.h>
51 #include <sys/priv.h>
52 #include <sys/proc.h>
53 #include <sys/signalvar.h>
54 #include <sys/filio.h>
55 #include <sys/sockio.h>
56 #include <sys/ttycom.h>
57 #include <sys/uio.h>
58
59 #include <sys/event.h>
60 #include <sys/file.h>
61 #include <sys/poll.h>
62 #include <sys/proc.h>
63
64 #include <sys/socket.h>
65
66 #include <net/if.h>
67 #include <net/bpf.h>
68 #ifdef BPF_JITTER
69 #include <net/bpf_jitter.h>
70 #endif
71 #include <net/bpfdesc.h>
72
73 #include <netinet/in.h>
74 #include <netinet/if_ether.h>
75 #include <sys/kernel.h>
76 #include <sys/sysctl.h>
77
78 #include <net80211/ieee80211_freebsd.h>
79
80 #include <security/mac/mac_framework.h>
81
82 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
83
84 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)
85
86 #define PRINET 26 /* interruptible */
87
88 /*
89 * bpf_iflist is a list of BPF interface structures, each corresponding to a
90 * specific DLT. The same network interface might have several BPF interface
91 * structures registered by different layers in the stack (i.e., 802.11
92 * frames, ethernet frames, etc).
93 */
94 static LIST_HEAD(, bpf_if) bpf_iflist;
95 static struct mtx bpf_mtx; /* bpf global lock */
96 static int bpf_bpfd_cnt;
97
98 static void bpf_allocbufs(struct bpf_d *);
99 static void bpf_attachd(struct bpf_d *, struct bpf_if *);
100 static void bpf_detachd(struct bpf_d *);
101 static void bpf_freed(struct bpf_d *);
102 static void bpf_mcopy(const void *, void *, size_t);
103 static int bpf_movein(struct uio *, int, struct ifnet *, struct mbuf **,
104 struct sockaddr *, int *, struct bpf_insn *);
105 static int bpf_setif(struct bpf_d *, struct ifreq *);
106 static void bpf_timed_out(void *);
107 static __inline void
108 bpf_wakeup(struct bpf_d *);
109 static void catchpacket(struct bpf_d *, u_char *, u_int,
110 u_int, void (*)(const void *, void *, size_t),
111 struct timeval *);
112 static void reset_d(struct bpf_d *);
113 static int bpf_setf(struct bpf_d *, struct bpf_program *, u_long cmd);
114 static int bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
115 static int bpf_setdlt(struct bpf_d *, u_int);
116 static void filt_bpfdetach(struct knote *);
117 static int filt_bpfread(struct knote *, long);
118 static void bpf_drvinit(void *);
119 static void bpf_clone(void *, struct ucred *, char *, int, struct cdev **);
120 static int bpf_stats_sysctl(SYSCTL_HANDLER_ARGS);
121
122 SYSCTL_NODE(_net, OID_AUTO, bpf, CTLFLAG_RW, 0, "bpf sysctl");
123 static int bpf_bufsize = 4096;
124 SYSCTL_INT(_net_bpf, OID_AUTO, bufsize, CTLFLAG_RW,
125 &bpf_bufsize, 0, "Default bpf buffer size");
126 static int bpf_maxbufsize = BPF_MAXBUFSIZE;
127 SYSCTL_INT(_net_bpf, OID_AUTO, maxbufsize, CTLFLAG_RW,
128 &bpf_maxbufsize, 0, "Maximum bpf buffer size");
129 static int bpf_maxinsns = BPF_MAXINSNS;
130 SYSCTL_INT(_net_bpf, OID_AUTO, maxinsns, CTLFLAG_RW,
131 &bpf_maxinsns, 0, "Maximum bpf program instructions");
132 SYSCTL_NODE(_net_bpf, OID_AUTO, stats, CTLFLAG_RW,
133 bpf_stats_sysctl, "bpf statistics portal");
134
135 static d_open_t bpfopen;
136 static d_close_t bpfclose;
137 static d_read_t bpfread;
138 static d_write_t bpfwrite;
139 static d_ioctl_t bpfioctl;
140 static d_poll_t bpfpoll;
141 static d_kqfilter_t bpfkqfilter;
142
143 static struct cdevsw bpf_cdevsw = {
144 .d_version = D_VERSION,
145 .d_flags = D_TRACKCLOSE,
146 .d_open = bpfopen,
147 .d_close = bpfclose,
148 .d_read = bpfread,
149 .d_write = bpfwrite,
150 .d_ioctl = bpfioctl,
151 .d_poll = bpfpoll,
152 .d_name = "bpf",
153 .d_kqfilter = bpfkqfilter,
154 };
155
156 static struct filterops bpfread_filtops =
157 { 1, NULL, filt_bpfdetach, filt_bpfread };
158
159 static int
160 bpf_movein(struct uio *uio, int linktype, struct ifnet *ifp, struct mbuf **mp,
161 struct sockaddr *sockp, int *hdrlen, struct bpf_insn *wfilter)
162 {
163 const struct ieee80211_bpf_params *p;
164 struct ether_header *eh;
165 struct mbuf *m;
166 int error;
167 int len;
168 int hlen;
169 int slen;
170
171 /*
172 * Build a sockaddr based on the data link layer type.
173 * We do this at this level because the ethernet header
174 * is copied directly into the data field of the sockaddr.
175 * In the case of SLIP, there is no header and the packet
176 * is forwarded as is.
177 * Also, we are careful to leave room at the front of the mbuf
178 * for the link level header.
179 */
180 switch (linktype) {
181
182 case DLT_SLIP:
183 sockp->sa_family = AF_INET;
184 hlen = 0;
185 break;
186
187 case DLT_EN10MB:
188 sockp->sa_family = AF_UNSPEC;
189 /* XXX Would MAXLINKHDR be better? */
190 hlen = ETHER_HDR_LEN;
191 break;
192
193 case DLT_FDDI:
194 sockp->sa_family = AF_IMPLINK;
195 hlen = 0;
196 break;
197
198 case DLT_RAW:
199 sockp->sa_family = AF_UNSPEC;
200 hlen = 0;
201 break;
202
203 case DLT_NULL:
204 /*
205 * null interface types require a 4 byte pseudo header which
206 * corresponds to the address family of the packet.
207 */
208 sockp->sa_family = AF_UNSPEC;
209 hlen = 4;
210 break;
211
212 case DLT_ATM_RFC1483:
213 /*
214 * en atm driver requires 4-byte atm pseudo header.
215 * though it isn't standard, vpi:vci needs to be
216 * specified anyway.
217 */
218 sockp->sa_family = AF_UNSPEC;
219 hlen = 12; /* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
220 break;
221
222 case DLT_PPP:
223 sockp->sa_family = AF_UNSPEC;
224 hlen = 4; /* This should match PPP_HDRLEN */
225 break;
226
227 case DLT_IEEE802_11: /* IEEE 802.11 wireless */
228 sockp->sa_family = AF_IEEE80211;
229 hlen = 0;
230 break;
231
232 case DLT_IEEE802_11_RADIO: /* IEEE 802.11 wireless w/ phy params */
233 sockp->sa_family = AF_IEEE80211;
234 sockp->sa_len = 12; /* XXX != 0 */
235 hlen = sizeof(struct ieee80211_bpf_params);
236 break;
237
238 default:
239 return (EIO);
240 }
241
242 len = uio->uio_resid;
243
244 if (len - hlen > ifp->if_mtu)
245 return (EMSGSIZE);
246
247 if ((unsigned)len > MJUM16BYTES)
248 return (EIO);
249
250 if (len <= MHLEN)
251 MGETHDR(m, M_TRYWAIT, MT_DATA);
252 else if (len <= MCLBYTES)
253 m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR);
254 else
255 m = m_getjcl(M_TRYWAIT, MT_DATA, M_PKTHDR,
256 #if (MJUMPAGESIZE > MCLBYTES)
257 len <= MJUMPAGESIZE ? MJUMPAGESIZE :
258 #endif
259 (len <= MJUM9BYTES ? MJUM9BYTES : MJUM16BYTES));
260 if (m == NULL)
261 return (ENOBUFS);
262 m->m_pkthdr.len = m->m_len = len;
263 m->m_pkthdr.rcvif = NULL;
264 *mp = m;
265
266 if (m->m_len < hlen) {
267 error = EPERM;
268 goto bad;
269 }
270
271 error = uiomove(mtod(m, u_char *), len, uio);
272 if (error)
273 goto bad;
274
275 slen = bpf_filter(wfilter, mtod(m, u_char *), len, len);
276 if (slen == 0) {
277 error = EPERM;
278 goto bad;
279 }
280
281 /* Check for multicast destination */
282 switch (linktype) {
283 case DLT_EN10MB:
284 eh = mtod(m, struct ether_header *);
285 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
286 if (bcmp(ifp->if_broadcastaddr, eh->ether_dhost,
287 ETHER_ADDR_LEN) == 0)
288 m->m_flags |= M_BCAST;
289 else
290 m->m_flags |= M_MCAST;
291 }
292 break;
293 }
294
295 /*
296 * Make room for link header, and copy it to sockaddr
297 */
298 if (hlen != 0) {
299 if (sockp->sa_family == AF_IEEE80211) {
300 /*
301 * Collect true length from the parameter header
302 * NB: sockp is known to be zero'd so if we do a
303 * short copy unspecified parameters will be
304 * zero.
305 * NB: packet may not be aligned after stripping
306 * bpf params
307 * XXX check ibp_vers
308 */
309 p = mtod(m, const struct ieee80211_bpf_params *);
310 hlen = p->ibp_len;
311 if (hlen > sizeof(sockp->sa_data)) {
312 error = EINVAL;
313 goto bad;
314 }
315 }
316 bcopy(m->m_data, sockp->sa_data, hlen);
317 }
318 *hdrlen = hlen;
319
320 return (0);
321 bad:
322 m_freem(m);
323 return (error);
324 }
325
326 /*
327 * Attach file to the bpf interface, i.e. make d listen on bp.
328 */
329 static void
330 bpf_attachd(struct bpf_d *d, struct bpf_if *bp)
331 {
332 /*
333 * Point d at bp, and add d to the interface's list of listeners.
334 * Finally, point the driver's bpf cookie at the interface so
335 * it will divert packets to bpf.
336 */
337 BPFIF_LOCK(bp);
338 d->bd_bif = bp;
339 LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
340
341 bpf_bpfd_cnt++;
342 BPFIF_UNLOCK(bp);
343 }
344
345 /*
346 * Detach a file from its interface.
347 */
348 static void
349 bpf_detachd(struct bpf_d *d)
350 {
351 int error;
352 struct bpf_if *bp;
353 struct ifnet *ifp;
354
355 bp = d->bd_bif;
356 BPFIF_LOCK(bp);
357 BPFD_LOCK(d);
358 ifp = d->bd_bif->bif_ifp;
359
360 /*
361 * Remove d from the interface's descriptor list.
362 */
363 LIST_REMOVE(d, bd_next);
364
365 bpf_bpfd_cnt--;
366 d->bd_bif = NULL;
367 BPFD_UNLOCK(d);
368 BPFIF_UNLOCK(bp);
369
370 /*
371 * Check if this descriptor had requested promiscuous mode.
372 * If so, turn it off.
373 */
374 if (d->bd_promisc) {
375 d->bd_promisc = 0;
376 error = ifpromisc(ifp, 0);
377 if (error != 0 && error != ENXIO) {
378 /*
379 * ENXIO can happen if a pccard is unplugged
380 * Something is really wrong if we were able to put
381 * the driver into promiscuous mode, but can't
382 * take it out.
383 */
384 if_printf(bp->bif_ifp,
385 "bpf_detach: ifpromisc failed (%d)\n", error);
386 }
387 }
388 }
389
390 /*
391 * Open ethernet device. Returns ENXIO for illegal minor device number,
392 * EBUSY if file is open by another process.
393 */
394 /* ARGSUSED */
395 static int
396 bpfopen(struct cdev *dev, int flags, int fmt, struct thread *td)
397 {
398 struct bpf_d *d;
399
400 mtx_lock(&bpf_mtx);
401 d = dev->si_drv1;
402 /*
403 * Each minor can be opened by only one process. If the requested
404 * minor is in use, return EBUSY.
405 */
406 if (d != NULL) {
407 mtx_unlock(&bpf_mtx);
408 return (EBUSY);
409 }
410 dev->si_drv1 = (struct bpf_d *)~0; /* mark device in use */
411 mtx_unlock(&bpf_mtx);
412
413 if ((dev->si_flags & SI_NAMED) == 0)
414 make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600,
415 "bpf%d", dev2unit(dev));
416 MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK | M_ZERO);
417 dev->si_drv1 = d;
418 d->bd_bufsize = bpf_bufsize;
419 d->bd_sig = SIGIO;
420 d->bd_direction = BPF_D_INOUT;
421 d->bd_pid = td->td_proc->p_pid;
422 #ifdef MAC
423 mac_init_bpfdesc(d);
424 mac_create_bpfdesc(td->td_ucred, d);
425 #endif
426 mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
427 callout_init(&d->bd_callout, CALLOUT_MPSAFE);
428 knlist_init(&d->bd_sel.si_note, &d->bd_mtx, NULL, NULL, NULL);
429
430 return (0);
431 }
432
433 /*
434 * Close the descriptor by detaching it from its interface,
435 * deallocating its buffers, and marking it free.
436 */
437 /* ARGSUSED */
438 static int
439 bpfclose(struct cdev *dev, int flags, int fmt, struct thread *td)
440 {
441 struct bpf_d *d = dev->si_drv1;
442
443 BPFD_LOCK(d);
444 if (d->bd_state == BPF_WAITING)
445 callout_stop(&d->bd_callout);
446 d->bd_state = BPF_IDLE;
447 BPFD_UNLOCK(d);
448 funsetown(&d->bd_sigio);
449 mtx_lock(&bpf_mtx);
450 if (d->bd_bif)
451 bpf_detachd(d);
452 mtx_unlock(&bpf_mtx);
453 selwakeuppri(&d->bd_sel, PRINET);
454 #ifdef MAC
455 mac_destroy_bpfdesc(d);
456 #endif /* MAC */
457 knlist_destroy(&d->bd_sel.si_note);
458 bpf_freed(d);
459 dev->si_drv1 = NULL;
460 free(d, M_BPF);
461
462 return (0);
463 }
464
465
466 /*
467 * Rotate the packet buffers in descriptor d. Move the store buffer
468 * into the hold slot, and the free buffer into the store slot.
469 * Zero the length of the new store buffer.
470 */
471 #define ROTATE_BUFFERS(d) \
472 (d)->bd_hbuf = (d)->bd_sbuf; \
473 (d)->bd_hlen = (d)->bd_slen; \
474 (d)->bd_sbuf = (d)->bd_fbuf; \
475 (d)->bd_slen = 0; \
476 (d)->bd_fbuf = NULL;
477 /*
478 * bpfread - read next chunk of packets from buffers
479 */
480 static int
481 bpfread(struct cdev *dev, struct uio *uio, int ioflag)
482 {
483 struct bpf_d *d = dev->si_drv1;
484 int timed_out;
485 int error;
486
487 /*
488 * Restrict application to use a buffer the same size as
489 * as kernel buffers.
490 */
491 if (uio->uio_resid != d->bd_bufsize)
492 return (EINVAL);
493
494 BPFD_LOCK(d);
495 d->bd_pid = curthread->td_proc->p_pid;
496 if (d->bd_state == BPF_WAITING)
497 callout_stop(&d->bd_callout);
498 timed_out = (d->bd_state == BPF_TIMED_OUT);
499 d->bd_state = BPF_IDLE;
500 /*
501 * If the hold buffer is empty, then do a timed sleep, which
502 * ends when the timeout expires or when enough packets
503 * have arrived to fill the store buffer.
504 */
505 while (d->bd_hbuf == NULL) {
506 if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
507 /*
508 * A packet(s) either arrived since the previous
509 * read or arrived while we were asleep.
510 * Rotate the buffers and return what's here.
511 */
512 ROTATE_BUFFERS(d);
513 break;
514 }
515
516 /*
517 * No data is available, check to see if the bpf device
518 * is still pointed at a real interface. If not, return
519 * ENXIO so that the userland process knows to rebind
520 * it before using it again.
521 */
522 if (d->bd_bif == NULL) {
523 BPFD_UNLOCK(d);
524 return (ENXIO);
525 }
526
527 if (ioflag & O_NONBLOCK) {
528 BPFD_UNLOCK(d);
529 return (EWOULDBLOCK);
530 }
531 error = msleep(d, &d->bd_mtx, PRINET|PCATCH,
532 "bpf", d->bd_rtout);
533 if (error == EINTR || error == ERESTART) {
534 BPFD_UNLOCK(d);
535 return (error);
536 }
537 if (error == EWOULDBLOCK) {
538 /*
539 * On a timeout, return what's in the buffer,
540 * which may be nothing. If there is something
541 * in the store buffer, we can rotate the buffers.
542 */
543 if (d->bd_hbuf)
544 /*
545 * We filled up the buffer in between
546 * getting the timeout and arriving
547 * here, so we don't need to rotate.
548 */
549 break;
550
551 if (d->bd_slen == 0) {
552 BPFD_UNLOCK(d);
553 return (0);
554 }
555 ROTATE_BUFFERS(d);
556 break;
557 }
558 }
559 /*
560 * At this point, we know we have something in the hold slot.
561 */
562 BPFD_UNLOCK(d);
563
564 /*
565 * Move data from hold buffer into user space.
566 * We know the entire buffer is transferred since
567 * we checked above that the read buffer is bpf_bufsize bytes.
568 *
569 * XXXRW: More synchronization needed here: what if a second thread
570 * issues a read on the same fd at the same time? Don't want this
571 * getting invalidated.
572 */
573 error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
574
575 BPFD_LOCK(d);
576 d->bd_fbuf = d->bd_hbuf;
577 d->bd_hbuf = NULL;
578 d->bd_hlen = 0;
579 BPFD_UNLOCK(d);
580
581 return (error);
582 }
583
584 /*
585 * If there are processes sleeping on this descriptor, wake them up.
586 */
587 static __inline void
588 bpf_wakeup(struct bpf_d *d)
589 {
590
591 BPFD_LOCK_ASSERT(d);
592 if (d->bd_state == BPF_WAITING) {
593 callout_stop(&d->bd_callout);
594 d->bd_state = BPF_IDLE;
595 }
596 wakeup(d);
597 if (d->bd_async && d->bd_sig && d->bd_sigio)
598 pgsigio(&d->bd_sigio, d->bd_sig, 0);
599
600 selwakeuppri(&d->bd_sel, PRINET);
601 KNOTE_LOCKED(&d->bd_sel.si_note, 0);
602 }
603
604 static void
605 bpf_timed_out(void *arg)
606 {
607 struct bpf_d *d = (struct bpf_d *)arg;
608
609 BPFD_LOCK(d);
610 if (d->bd_state == BPF_WAITING) {
611 d->bd_state = BPF_TIMED_OUT;
612 if (d->bd_slen != 0)
613 bpf_wakeup(d);
614 }
615 BPFD_UNLOCK(d);
616 }
617
618 static int
619 bpfwrite(struct cdev *dev, struct uio *uio, int ioflag)
620 {
621 struct bpf_d *d = dev->si_drv1;
622 struct ifnet *ifp;
623 struct mbuf *m, *mc;
624 struct sockaddr dst;
625 int error, hlen;
626
627 d->bd_pid = curthread->td_proc->p_pid;
628 if (d->bd_bif == NULL)
629 return (ENXIO);
630
631 ifp = d->bd_bif->bif_ifp;
632
633 if ((ifp->if_flags & IFF_UP) == 0)
634 return (ENETDOWN);
635
636 if (uio->uio_resid == 0)
637 return (0);
638
639 bzero(&dst, sizeof(dst));
640 m = NULL;
641 hlen = 0;
642 error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp,
643 &m, &dst, &hlen, d->bd_wfilter);
644 if (error)
645 return (error);
646
647 if (d->bd_hdrcmplt)
648 dst.sa_family = pseudo_AF_HDRCMPLT;
649
650 if (d->bd_feedback) {
651 mc = m_dup(m, M_DONTWAIT);
652 if (mc != NULL)
653 mc->m_pkthdr.rcvif = ifp;
654 /* Set M_PROMISC for outgoing packets to be discarded. */
655 if (d->bd_direction == BPF_D_INOUT)
656 m->m_flags |= M_PROMISC;
657 } else
658 mc = NULL;
659
660 m->m_pkthdr.len -= hlen;
661 m->m_len -= hlen;
662 m->m_data += hlen; /* XXX */
663
664 #ifdef MAC
665 BPFD_LOCK(d);
666 mac_create_mbuf_from_bpfdesc(d, m);
667 if (mc != NULL)
668 mac_create_mbuf_from_bpfdesc(d, mc);
669 BPFD_UNLOCK(d);
670 #endif
671
672 error = (*ifp->if_output)(ifp, m, &dst, NULL);
673
674 if (mc != NULL) {
675 if (error == 0)
676 (*ifp->if_input)(ifp, mc);
677 else
678 m_freem(mc);
679 }
680
681 return (error);
682 }
683
684 /*
685 * Reset a descriptor by flushing its packet buffer and clearing the
686 * receive and drop counts.
687 */
688 static void
689 reset_d(struct bpf_d *d)
690 {
691
692 mtx_assert(&d->bd_mtx, MA_OWNED);
693 if (d->bd_hbuf) {
694 /* Free the hold buffer. */
695 d->bd_fbuf = d->bd_hbuf;
696 d->bd_hbuf = NULL;
697 }
698 d->bd_slen = 0;
699 d->bd_hlen = 0;
700 d->bd_rcount = 0;
701 d->bd_dcount = 0;
702 d->bd_fcount = 0;
703 }
704
705 /*
706 * FIONREAD Check for read packet available.
707 * SIOCGIFADDR Get interface address - convenient hook to driver.
708 * BIOCGBLEN Get buffer len [for read()].
709 * BIOCSETF Set read filter.
710 * BIOCSETFNR Set read filter without resetting descriptor.
711 * BIOCSETWF Set write filter.
712 * BIOCFLUSH Flush read packet buffer.
713 * BIOCPROMISC Put interface into promiscuous mode.
714 * BIOCGDLT Get link layer type.
715 * BIOCGETIF Get interface name.
716 * BIOCSETIF Set interface.
717 * BIOCSRTIMEOUT Set read timeout.
718 * BIOCGRTIMEOUT Get read timeout.
719 * BIOCGSTATS Get packet stats.
720 * BIOCIMMEDIATE Set immediate mode.
721 * BIOCVERSION Get filter language version.
722 * BIOCGHDRCMPLT Get "header already complete" flag
723 * BIOCSHDRCMPLT Set "header already complete" flag
724 * BIOCGDIRECTION Get packet direction flag
725 * BIOCSDIRECTION Set packet direction flag
726 * BIOCLOCK Set "locked" flag
727 * BIOCFEEDBACK Set packet feedback mode.
728 */
729 /* ARGSUSED */
730 static int
731 bpfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags,
732 struct thread *td)
733 {
734 struct bpf_d *d = dev->si_drv1;
735 int error = 0;
736
737 /*
738 * Refresh PID associated with this descriptor.
739 */
740 BPFD_LOCK(d);
741 d->bd_pid = td->td_proc->p_pid;
742 if (d->bd_state == BPF_WAITING)
743 callout_stop(&d->bd_callout);
744 d->bd_state = BPF_IDLE;
745 BPFD_UNLOCK(d);
746
747 if (d->bd_locked == 1) {
748 switch (cmd) {
749 case BIOCGBLEN:
750 case BIOCFLUSH:
751 case BIOCGDLT:
752 case BIOCGDLTLIST:
753 case BIOCGETIF:
754 case BIOCGRTIMEOUT:
755 case BIOCGSTATS:
756 case BIOCVERSION:
757 case BIOCGRSIG:
758 case BIOCGHDRCMPLT:
759 case BIOCFEEDBACK:
760 case FIONREAD:
761 case BIOCLOCK:
762 case BIOCSRTIMEOUT:
763 case BIOCIMMEDIATE:
764 case TIOCGPGRP:
765 break;
766 default:
767 return (EPERM);
768 }
769 }
770 switch (cmd) {
771
772 default:
773 error = EINVAL;
774 break;
775
776 /*
777 * Check for read packet available.
778 */
779 case FIONREAD:
780 {
781 int n;
782
783 BPFD_LOCK(d);
784 n = d->bd_slen;
785 if (d->bd_hbuf)
786 n += d->bd_hlen;
787 BPFD_UNLOCK(d);
788
789 *(int *)addr = n;
790 break;
791 }
792
793 case SIOCGIFADDR:
794 {
795 struct ifnet *ifp;
796
797 if (d->bd_bif == NULL)
798 error = EINVAL;
799 else {
800 ifp = d->bd_bif->bif_ifp;
801 error = (*ifp->if_ioctl)(ifp, cmd, addr);
802 }
803 break;
804 }
805
806 /*
807 * Get buffer len [for read()].
808 */
809 case BIOCGBLEN:
810 *(u_int *)addr = d->bd_bufsize;
811 break;
812
813 /*
814 * Set buffer length.
815 */
816 case BIOCSBLEN:
817 if (d->bd_bif != NULL)
818 error = EINVAL;
819 else {
820 u_int size = *(u_int *)addr;
821
822 if (size > bpf_maxbufsize)
823 *(u_int *)addr = size = bpf_maxbufsize;
824 else if (size < BPF_MINBUFSIZE)
825 *(u_int *)addr = size = BPF_MINBUFSIZE;
826 d->bd_bufsize = size;
827 }
828 break;
829
830 /*
831 * Set link layer read filter.
832 */
833 case BIOCSETF:
834 case BIOCSETFNR:
835 case BIOCSETWF:
836 error = bpf_setf(d, (struct bpf_program *)addr, cmd);
837 break;
838
839 /*
840 * Flush read packet buffer.
841 */
842 case BIOCFLUSH:
843 BPFD_LOCK(d);
844 reset_d(d);
845 BPFD_UNLOCK(d);
846 break;
847
848 /*
849 * Put interface into promiscuous mode.
850 */
851 case BIOCPROMISC:
852 if (d->bd_bif == NULL) {
853 /*
854 * No interface attached yet.
855 */
856 error = EINVAL;
857 break;
858 }
859 if (d->bd_promisc == 0) {
860 error = ifpromisc(d->bd_bif->bif_ifp, 1);
861 if (error == 0)
862 d->bd_promisc = 1;
863 }
864 break;
865
866 /*
867 * Get current data link type.
868 */
869 case BIOCGDLT:
870 if (d->bd_bif == NULL)
871 error = EINVAL;
872 else
873 *(u_int *)addr = d->bd_bif->bif_dlt;
874 break;
875
876 /*
877 * Get a list of supported data link types.
878 */
879 case BIOCGDLTLIST:
880 if (d->bd_bif == NULL)
881 error = EINVAL;
882 else
883 error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
884 break;
885
886 /*
887 * Set data link type.
888 */
889 case BIOCSDLT:
890 if (d->bd_bif == NULL)
891 error = EINVAL;
892 else
893 error = bpf_setdlt(d, *(u_int *)addr);
894 break;
895
896 /*
897 * Get interface name.
898 */
899 case BIOCGETIF:
900 if (d->bd_bif == NULL)
901 error = EINVAL;
902 else {
903 struct ifnet *const ifp = d->bd_bif->bif_ifp;
904 struct ifreq *const ifr = (struct ifreq *)addr;
905
906 strlcpy(ifr->ifr_name, ifp->if_xname,
907 sizeof(ifr->ifr_name));
908 }
909 break;
910
911 /*
912 * Set interface.
913 */
914 case BIOCSETIF:
915 error = bpf_setif(d, (struct ifreq *)addr);
916 break;
917
918 /*
919 * Set read timeout.
920 */
921 case BIOCSRTIMEOUT:
922 {
923 struct timeval *tv = (struct timeval *)addr;
924
925 /*
926 * Subtract 1 tick from tvtohz() since this isn't
927 * a one-shot timer.
928 */
929 if ((error = itimerfix(tv)) == 0)
930 d->bd_rtout = tvtohz(tv) - 1;
931 break;
932 }
933
934 /*
935 * Get read timeout.
936 */
937 case BIOCGRTIMEOUT:
938 {
939 struct timeval *tv = (struct timeval *)addr;
940
941 tv->tv_sec = d->bd_rtout / hz;
942 tv->tv_usec = (d->bd_rtout % hz) * tick;
943 break;
944 }
945
946 /*
947 * Get packet stats.
948 */
949 case BIOCGSTATS:
950 {
951 struct bpf_stat *bs = (struct bpf_stat *)addr;
952
953 bs->bs_recv = d->bd_rcount;
954 bs->bs_drop = d->bd_dcount;
955 break;
956 }
957
958 /*
959 * Set immediate mode.
960 */
961 case BIOCIMMEDIATE:
962 d->bd_immediate = *(u_int *)addr;
963 break;
964
965 case BIOCVERSION:
966 {
967 struct bpf_version *bv = (struct bpf_version *)addr;
968
969 bv->bv_major = BPF_MAJOR_VERSION;
970 bv->bv_minor = BPF_MINOR_VERSION;
971 break;
972 }
973
974 /*
975 * Get "header already complete" flag
976 */
977 case BIOCGHDRCMPLT:
978 *(u_int *)addr = d->bd_hdrcmplt;
979 break;
980
981 /*
982 * Set "header already complete" flag
983 */
984 case BIOCSHDRCMPLT:
985 d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
986 break;
987
988 /*
989 * Get packet direction flag
990 */
991 case BIOCGDIRECTION:
992 *(u_int *)addr = d->bd_direction;
993 break;
994
995 /*
996 * Set packet direction flag
997 */
998 case BIOCSDIRECTION:
999 {
1000 u_int direction;
1001
1002 direction = *(u_int *)addr;
1003 switch (direction) {
1004 case BPF_D_IN:
1005 case BPF_D_INOUT:
1006 case BPF_D_OUT:
1007 d->bd_direction = direction;
1008 break;
1009 default:
1010 error = EINVAL;
1011 }
1012 }
1013 break;
1014
1015 case BIOCFEEDBACK:
1016 d->bd_feedback = *(u_int *)addr;
1017 break;
1018
1019 case BIOCLOCK:
1020 d->bd_locked = 1;
1021 break;
1022
1023 case FIONBIO: /* Non-blocking I/O */
1024 break;
1025
1026 case FIOASYNC: /* Send signal on receive packets */
1027 d->bd_async = *(int *)addr;
1028 break;
1029
1030 case FIOSETOWN:
1031 error = fsetown(*(int *)addr, &d->bd_sigio);
1032 break;
1033
1034 case FIOGETOWN:
1035 *(int *)addr = fgetown(&d->bd_sigio);
1036 break;
1037
1038 /* This is deprecated, FIOSETOWN should be used instead. */
1039 case TIOCSPGRP:
1040 error = fsetown(-(*(int *)addr), &d->bd_sigio);
1041 break;
1042
1043 /* This is deprecated, FIOGETOWN should be used instead. */
1044 case TIOCGPGRP:
1045 *(int *)addr = -fgetown(&d->bd_sigio);
1046 break;
1047
1048 case BIOCSRSIG: /* Set receive signal */
1049 {
1050 u_int sig;
1051
1052 sig = *(u_int *)addr;
1053
1054 if (sig >= NSIG)
1055 error = EINVAL;
1056 else
1057 d->bd_sig = sig;
1058 break;
1059 }
1060 case BIOCGRSIG:
1061 *(u_int *)addr = d->bd_sig;
1062 break;
1063 }
1064 return (error);
1065 }
1066
1067 /*
1068 * Set d's packet filter program to fp. If this file already has a filter,
1069 * free it and replace it. Returns EINVAL for bogus requests.
1070 */
1071 static int
1072 bpf_setf(struct bpf_d *d, struct bpf_program *fp, u_long cmd)
1073 {
1074 struct bpf_insn *fcode, *old;
1075 u_int wfilter, flen, size;
1076 #ifdef BPF_JITTER
1077 bpf_jit_filter *ofunc;
1078 #endif
1079
1080 if (cmd == BIOCSETWF) {
1081 old = d->bd_wfilter;
1082 wfilter = 1;
1083 #ifdef BPF_JITTER
1084 ofunc = NULL;
1085 #endif
1086 } else {
1087 wfilter = 0;
1088 old = d->bd_rfilter;
1089 #ifdef BPF_JITTER
1090 ofunc = d->bd_bfilter;
1091 #endif
1092 }
1093 if (fp->bf_insns == NULL) {
1094 if (fp->bf_len != 0)
1095 return (EINVAL);
1096 BPFD_LOCK(d);
1097 if (wfilter)
1098 d->bd_wfilter = NULL;
1099 else {
1100 d->bd_rfilter = NULL;
1101 #ifdef BPF_JITTER
1102 d->bd_bfilter = NULL;
1103 #endif
1104 if (cmd == BIOCSETF)
1105 reset_d(d);
1106 }
1107 BPFD_UNLOCK(d);
1108 if (old != NULL)
1109 free((caddr_t)old, M_BPF);
1110 #ifdef BPF_JITTER
1111 if (ofunc != NULL)
1112 bpf_destroy_jit_filter(ofunc);
1113 #endif
1114 return (0);
1115 }
1116 flen = fp->bf_len;
1117 if (flen > bpf_maxinsns)
1118 return (EINVAL);
1119
1120 size = flen * sizeof(*fp->bf_insns);
1121 fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
1122 if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
1123 bpf_validate(fcode, (int)flen)) {
1124 BPFD_LOCK(d);
1125 if (wfilter)
1126 d->bd_wfilter = fcode;
1127 else {
1128 d->bd_rfilter = fcode;
1129 #ifdef BPF_JITTER
1130 d->bd_bfilter = bpf_jitter(fcode, flen);
1131 #endif
1132 if (cmd == BIOCSETF)
1133 reset_d(d);
1134 }
1135 BPFD_UNLOCK(d);
1136 if (old != NULL)
1137 free((caddr_t)old, M_BPF);
1138 #ifdef BPF_JITTER
1139 if (ofunc != NULL)
1140 bpf_destroy_jit_filter(ofunc);
1141 #endif
1142
1143 return (0);
1144 }
1145 free((caddr_t)fcode, M_BPF);
1146 return (EINVAL);
1147 }
1148
1149 /*
1150 * Detach a file from its current interface (if attached at all) and attach
1151 * to the interface indicated by the name stored in ifr.
1152 * Return an errno or 0.
1153 */
1154 static int
1155 bpf_setif(struct bpf_d *d, struct ifreq *ifr)
1156 {
1157 struct bpf_if *bp;
1158 struct ifnet *theywant;
1159
1160 theywant = ifunit(ifr->ifr_name);
1161 if (theywant == NULL || theywant->if_bpf == NULL)
1162 return (ENXIO);
1163
1164 bp = theywant->if_bpf;
1165 /*
1166 * Allocate the packet buffers if we need to.
1167 * If we're already attached to requested interface,
1168 * just flush the buffer.
1169 */
1170 if (d->bd_sbuf == NULL)
1171 bpf_allocbufs(d);
1172 if (bp != d->bd_bif) {
1173 if (d->bd_bif)
1174 /*
1175 * Detach if attached to something else.
1176 */
1177 bpf_detachd(d);
1178
1179 bpf_attachd(d, bp);
1180 }
1181 BPFD_LOCK(d);
1182 reset_d(d);
1183 BPFD_UNLOCK(d);
1184 return (0);
1185 }
1186
1187 /*
1188 * Support for select() and poll() system calls
1189 *
1190 * Return true iff the specific operation will not block indefinitely.
1191 * Otherwise, return false but make a note that a selwakeup() must be done.
1192 */
1193 static int
1194 bpfpoll(struct cdev *dev, int events, struct thread *td)
1195 {
1196 struct bpf_d *d;
1197 int revents;
1198
1199 d = dev->si_drv1;
1200 if (d->bd_bif == NULL)
1201 return (ENXIO);
1202
1203 /*
1204 * Refresh PID associated with this descriptor.
1205 */
1206 revents = events & (POLLOUT | POLLWRNORM);
1207 BPFD_LOCK(d);
1208 d->bd_pid = td->td_proc->p_pid;
1209 if (events & (POLLIN | POLLRDNORM)) {
1210 if (bpf_ready(d))
1211 revents |= events & (POLLIN | POLLRDNORM);
1212 else {
1213 selrecord(td, &d->bd_sel);
1214 /* Start the read timeout if necessary. */
1215 if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1216 callout_reset(&d->bd_callout, d->bd_rtout,
1217 bpf_timed_out, d);
1218 d->bd_state = BPF_WAITING;
1219 }
1220 }
1221 }
1222 BPFD_UNLOCK(d);
1223 return (revents);
1224 }
1225
1226 /*
1227 * Support for kevent() system call. Register EVFILT_READ filters and
1228 * reject all others.
1229 */
1230 int
1231 bpfkqfilter(struct cdev *dev, struct knote *kn)
1232 {
1233 struct bpf_d *d = (struct bpf_d *)dev->si_drv1;
1234
1235 if (kn->kn_filter != EVFILT_READ)
1236 return (1);
1237
1238 /*
1239 * Refresh PID associated with this descriptor.
1240 */
1241 BPFD_LOCK(d);
1242 d->bd_pid = curthread->td_proc->p_pid;
1243 kn->kn_fop = &bpfread_filtops;
1244 kn->kn_hook = d;
1245 knlist_add(&d->bd_sel.si_note, kn, 1);
1246 BPFD_UNLOCK(d);
1247
1248 return (0);
1249 }
1250
1251 static void
1252 filt_bpfdetach(struct knote *kn)
1253 {
1254 struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1255
1256 knlist_remove(&d->bd_sel.si_note, kn, 0);
1257 }
1258
1259 static int
1260 filt_bpfread(struct knote *kn, long hint)
1261 {
1262 struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1263 int ready;
1264
1265 BPFD_LOCK_ASSERT(d);
1266 ready = bpf_ready(d);
1267 if (ready) {
1268 kn->kn_data = d->bd_slen;
1269 if (d->bd_hbuf)
1270 kn->kn_data += d->bd_hlen;
1271 }
1272 else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1273 callout_reset(&d->bd_callout, d->bd_rtout,
1274 bpf_timed_out, d);
1275 d->bd_state = BPF_WAITING;
1276 }
1277
1278 return (ready);
1279 }
1280
1281 /*
1282 * Incoming linkage from device drivers. Process the packet pkt, of length
1283 * pktlen, which is stored in a contiguous buffer. The packet is parsed
1284 * by each process' filter, and if accepted, stashed into the corresponding
1285 * buffer.
1286 */
1287 void
1288 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
1289 {
1290 struct bpf_d *d;
1291 u_int slen;
1292 int gottime;
1293 struct timeval tv;
1294
1295 gottime = 0;
1296 BPFIF_LOCK(bp);
1297 LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1298 BPFD_LOCK(d);
1299 ++d->bd_rcount;
1300 #ifdef BPF_JITTER
1301 if (bpf_jitter_enable != 0 && d->bd_bfilter != NULL)
1302 slen = (*(d->bd_bfilter->func))(pkt, pktlen, pktlen);
1303 else
1304 #endif
1305 slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen);
1306 if (slen != 0) {
1307 d->bd_fcount++;
1308 if (!gottime) {
1309 microtime(&tv);
1310 gottime = 1;
1311 }
1312 #ifdef MAC
1313 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1314 #endif
1315 catchpacket(d, pkt, pktlen, slen, bcopy, &tv);
1316 }
1317 BPFD_UNLOCK(d);
1318 }
1319 BPFIF_UNLOCK(bp);
1320 }
1321
1322 /*
1323 * Copy data from an mbuf chain into a buffer. This code is derived
1324 * from m_copydata in sys/uipc_mbuf.c.
1325 */
1326 static void
1327 bpf_mcopy(const void *src_arg, void *dst_arg, size_t len)
1328 {
1329 const struct mbuf *m;
1330 u_int count;
1331 u_char *dst;
1332
1333 m = src_arg;
1334 dst = dst_arg;
1335 while (len > 0) {
1336 if (m == NULL)
1337 panic("bpf_mcopy");
1338 count = min(m->m_len, len);
1339 bcopy(mtod(m, void *), dst, count);
1340 m = m->m_next;
1341 dst += count;
1342 len -= count;
1343 }
1344 }
1345
1346 #define BPF_CHECK_DIRECTION(d, r, i) \
1347 (((d)->bd_direction == BPF_D_IN && (r) != (i)) || \
1348 ((d)->bd_direction == BPF_D_OUT && (r) == (i)))
1349
1350 /*
1351 * Incoming linkage from device drivers, when packet is in an mbuf chain.
1352 */
1353 void
1354 bpf_mtap(struct bpf_if *bp, struct mbuf *m)
1355 {
1356 struct bpf_d *d;
1357 u_int pktlen, slen;
1358 int gottime;
1359 struct timeval tv;
1360
1361 /* Skip outgoing duplicate packets. */
1362 if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
1363 m->m_flags &= ~M_PROMISC;
1364 return;
1365 }
1366
1367 gottime = 0;
1368
1369 pktlen = m_length(m, NULL);
1370
1371 BPFIF_LOCK(bp);
1372 LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1373 if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
1374 continue;
1375 BPFD_LOCK(d);
1376 ++d->bd_rcount;
1377 #ifdef BPF_JITTER
1378 /* XXX We cannot handle multiple mbufs. */
1379 if (bpf_jitter_enable != 0 && d->bd_bfilter != NULL &&
1380 m->m_next == NULL)
1381 slen = (*(d->bd_bfilter->func))(mtod(m, u_char *),
1382 pktlen, pktlen);
1383 else
1384 #endif
1385 slen = bpf_filter(d->bd_rfilter, (u_char *)m, pktlen, 0);
1386 if (slen != 0) {
1387 d->bd_fcount++;
1388 if (!gottime) {
1389 microtime(&tv);
1390 gottime = 1;
1391 }
1392 #ifdef MAC
1393 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1394 #endif
1395 catchpacket(d, (u_char *)m, pktlen, slen,
1396 bpf_mcopy, &tv);
1397 }
1398 BPFD_UNLOCK(d);
1399 }
1400 BPFIF_UNLOCK(bp);
1401 }
1402
1403 /*
1404 * Incoming linkage from device drivers, when packet is in
1405 * an mbuf chain and to be prepended by a contiguous header.
1406 */
1407 void
1408 bpf_mtap2(struct bpf_if *bp, void *data, u_int dlen, struct mbuf *m)
1409 {
1410 struct mbuf mb;
1411 struct bpf_d *d;
1412 u_int pktlen, slen;
1413 int gottime;
1414 struct timeval tv;
1415
1416 /* Skip outgoing duplicate packets. */
1417 if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
1418 m->m_flags &= ~M_PROMISC;
1419 return;
1420 }
1421
1422 gottime = 0;
1423
1424 pktlen = m_length(m, NULL);
1425 /*
1426 * Craft on-stack mbuf suitable for passing to bpf_filter.
1427 * Note that we cut corners here; we only setup what's
1428 * absolutely needed--this mbuf should never go anywhere else.
1429 */
1430 mb.m_next = m;
1431 mb.m_data = data;
1432 mb.m_len = dlen;
1433 pktlen += dlen;
1434
1435 BPFIF_LOCK(bp);
1436 LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1437 if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
1438 continue;
1439 BPFD_LOCK(d);
1440 ++d->bd_rcount;
1441 slen = bpf_filter(d->bd_rfilter, (u_char *)&mb, pktlen, 0);
1442 if (slen != 0) {
1443 d->bd_fcount++;
1444 if (!gottime) {
1445 microtime(&tv);
1446 gottime = 1;
1447 }
1448 #ifdef MAC
1449 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1450 #endif
1451 catchpacket(d, (u_char *)&mb, pktlen, slen,
1452 bpf_mcopy, &tv);
1453 }
1454 BPFD_UNLOCK(d);
1455 }
1456 BPFIF_UNLOCK(bp);
1457 }
1458
1459 #undef BPF_CHECK_DIRECTION
1460
1461 /*
1462 * Move the packet data from interface memory (pkt) into the
1463 * store buffer. "cpfn" is the routine called to do the actual data
1464 * transfer. bcopy is passed in to copy contiguous chunks, while
1465 * bpf_mcopy is passed in to copy mbuf chains. In the latter case,
1466 * pkt is really an mbuf.
1467 */
1468 static void
1469 catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
1470 void (*cpfn)(const void *, void *, size_t), struct timeval *tv)
1471 {
1472 struct bpf_hdr *hp;
1473 int totlen, curlen;
1474 int hdrlen = d->bd_bif->bif_hdrlen;
1475 int do_wakeup = 0;
1476
1477 BPFD_LOCK_ASSERT(d);
1478 /*
1479 * Figure out how many bytes to move. If the packet is
1480 * greater or equal to the snapshot length, transfer that
1481 * much. Otherwise, transfer the whole packet (unless
1482 * we hit the buffer size limit).
1483 */
1484 totlen = hdrlen + min(snaplen, pktlen);
1485 if (totlen > d->bd_bufsize)
1486 totlen = d->bd_bufsize;
1487
1488 /*
1489 * Round up the end of the previous packet to the next longword.
1490 */
1491 curlen = BPF_WORDALIGN(d->bd_slen);
1492 if (curlen + totlen > d->bd_bufsize) {
1493 /*
1494 * This packet will overflow the storage buffer.
1495 * Rotate the buffers if we can, then wakeup any
1496 * pending reads.
1497 */
1498 if (d->bd_fbuf == NULL) {
1499 /*
1500 * We haven't completed the previous read yet,
1501 * so drop the packet.
1502 */
1503 ++d->bd_dcount;
1504 return;
1505 }
1506 ROTATE_BUFFERS(d);
1507 do_wakeup = 1;
1508 curlen = 0;
1509 }
1510 else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1511 /*
1512 * Immediate mode is set, or the read timeout has
1513 * already expired during a select call. A packet
1514 * arrived, so the reader should be woken up.
1515 */
1516 do_wakeup = 1;
1517
1518 /*
1519 * Append the bpf header.
1520 */
1521 hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1522 hp->bh_tstamp = *tv;
1523 hp->bh_datalen = pktlen;
1524 hp->bh_hdrlen = hdrlen;
1525 /*
1526 * Copy the packet data into the store buffer and update its length.
1527 */
1528 (*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1529 d->bd_slen = curlen + totlen;
1530
1531 if (do_wakeup)
1532 bpf_wakeup(d);
1533 }
1534
1535 /*
1536 * Initialize all nonzero fields of a descriptor.
1537 */
1538 static void
1539 bpf_allocbufs(struct bpf_d *d)
1540 {
1541
1542 KASSERT(d->bd_fbuf == NULL, ("bpf_allocbufs: bd_fbuf != NULL"));
1543 KASSERT(d->bd_sbuf == NULL, ("bpf_allocbufs: bd_sbuf != NULL"));
1544 KASSERT(d->bd_hbuf == NULL, ("bpf_allocbufs: bd_hbuf != NULL"));
1545
1546 d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1547 d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1548 d->bd_slen = 0;
1549 d->bd_hlen = 0;
1550 }
1551
1552 /*
1553 * Free buffers currently in use by a descriptor.
1554 * Called on close.
1555 */
1556 static void
1557 bpf_freed(struct bpf_d *d)
1558 {
1559 /*
1560 * We don't need to lock out interrupts since this descriptor has
1561 * been detached from its interface and it yet hasn't been marked
1562 * free.
1563 */
1564 if (d->bd_sbuf != NULL) {
1565 free(d->bd_sbuf, M_BPF);
1566 if (d->bd_hbuf != NULL)
1567 free(d->bd_hbuf, M_BPF);
1568 if (d->bd_fbuf != NULL)
1569 free(d->bd_fbuf, M_BPF);
1570 }
1571 if (d->bd_rfilter) {
1572 free((caddr_t)d->bd_rfilter, M_BPF);
1573 #ifdef BPF_JITTER
1574 bpf_destroy_jit_filter(d->bd_bfilter);
1575 #endif
1576 }
1577 if (d->bd_wfilter)
1578 free((caddr_t)d->bd_wfilter, M_BPF);
1579 mtx_destroy(&d->bd_mtx);
1580 }
1581
1582 /*
1583 * Attach an interface to bpf. dlt is the link layer type; hdrlen is the
1584 * fixed size of the link header (variable length headers not yet supported).
1585 */
1586 void
1587 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
1588 {
1589
1590 bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1591 }
1592
1593 /*
1594 * Attach an interface to bpf. ifp is a pointer to the structure
1595 * defining the interface to be attached, dlt is the link layer type,
1596 * and hdrlen is the fixed size of the link header (variable length
1597 * headers are not yet supporrted).
1598 */
1599 void
1600 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
1601 {
1602 struct bpf_if *bp;
1603
1604 bp = malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
1605 if (bp == NULL)
1606 panic("bpfattach");
1607
1608 LIST_INIT(&bp->bif_dlist);
1609 bp->bif_ifp = ifp;
1610 bp->bif_dlt = dlt;
1611 mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
1612 KASSERT(*driverp == NULL, ("bpfattach2: driverp already initialized"));
1613 *driverp = bp;
1614
1615 mtx_lock(&bpf_mtx);
1616 LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next);
1617 mtx_unlock(&bpf_mtx);
1618
1619 /*
1620 * Compute the length of the bpf header. This is not necessarily
1621 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1622 * that the network layer header begins on a longword boundary (for
1623 * performance reasons and to alleviate alignment restrictions).
1624 */
1625 bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1626
1627 if (bootverbose)
1628 if_printf(ifp, "bpf attached\n");
1629 }
1630
1631 /*
1632 * Detach bpf from an interface. This involves detaching each descriptor
1633 * associated with the interface, and leaving bd_bif NULL. Notify each
1634 * descriptor as it's detached so that any sleepers wake up and get
1635 * ENXIO.
1636 */
1637 void
1638 bpfdetach(struct ifnet *ifp)
1639 {
1640 struct bpf_if *bp;
1641 struct bpf_d *d;
1642
1643 /* Locate BPF interface information */
1644 mtx_lock(&bpf_mtx);
1645 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1646 if (ifp == bp->bif_ifp)
1647 break;
1648 }
1649
1650 /* Interface wasn't attached */
1651 if ((bp == NULL) || (bp->bif_ifp == NULL)) {
1652 mtx_unlock(&bpf_mtx);
1653 printf("bpfdetach: %s was not attached\n", ifp->if_xname);
1654 return;
1655 }
1656
1657 LIST_REMOVE(bp, bif_next);
1658 mtx_unlock(&bpf_mtx);
1659
1660 while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) {
1661 bpf_detachd(d);
1662 BPFD_LOCK(d);
1663 bpf_wakeup(d);
1664 BPFD_UNLOCK(d);
1665 }
1666
1667 mtx_destroy(&bp->bif_mtx);
1668 free(bp, M_BPF);
1669 }
1670
1671 /*
1672 * Get a list of available data link type of the interface.
1673 */
1674 static int
1675 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl)
1676 {
1677 int n, error;
1678 struct ifnet *ifp;
1679 struct bpf_if *bp;
1680
1681 ifp = d->bd_bif->bif_ifp;
1682 n = 0;
1683 error = 0;
1684 mtx_lock(&bpf_mtx);
1685 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1686 if (bp->bif_ifp != ifp)
1687 continue;
1688 if (bfl->bfl_list != NULL) {
1689 if (n >= bfl->bfl_len) {
1690 mtx_unlock(&bpf_mtx);
1691 return (ENOMEM);
1692 }
1693 error = copyout(&bp->bif_dlt,
1694 bfl->bfl_list + n, sizeof(u_int));
1695 }
1696 n++;
1697 }
1698 mtx_unlock(&bpf_mtx);
1699 bfl->bfl_len = n;
1700 return (error);
1701 }
1702
1703 /*
1704 * Set the data link type of a BPF instance.
1705 */
1706 static int
1707 bpf_setdlt(struct bpf_d *d, u_int dlt)
1708 {
1709 int error, opromisc;
1710 struct ifnet *ifp;
1711 struct bpf_if *bp;
1712
1713 if (d->bd_bif->bif_dlt == dlt)
1714 return (0);
1715 ifp = d->bd_bif->bif_ifp;
1716 mtx_lock(&bpf_mtx);
1717 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1718 if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1719 break;
1720 }
1721 mtx_unlock(&bpf_mtx);
1722 if (bp != NULL) {
1723 opromisc = d->bd_promisc;
1724 bpf_detachd(d);
1725 bpf_attachd(d, bp);
1726 BPFD_LOCK(d);
1727 reset_d(d);
1728 BPFD_UNLOCK(d);
1729 if (opromisc) {
1730 error = ifpromisc(bp->bif_ifp, 1);
1731 if (error)
1732 if_printf(bp->bif_ifp,
1733 "bpf_setdlt: ifpromisc failed (%d)\n",
1734 error);
1735 else
1736 d->bd_promisc = 1;
1737 }
1738 }
1739 return (bp == NULL ? EINVAL : 0);
1740 }
1741
1742 static void
1743 bpf_clone(void *arg, struct ucred *cred, char *name, int namelen,
1744 struct cdev **dev)
1745 {
1746 int u;
1747
1748 if (*dev != NULL)
1749 return;
1750 if (dev_stdclone(name, NULL, "bpf", &u) != 1)
1751 return;
1752 *dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
1753 "bpf%d", u);
1754 dev_ref(*dev);
1755 (*dev)->si_flags |= SI_CHEAPCLONE;
1756 return;
1757 }
1758
1759 static void
1760 bpf_drvinit(void *unused)
1761 {
1762
1763 mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
1764 LIST_INIT(&bpf_iflist);
1765 EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000);
1766 }
1767
1768 static void
1769 bpfstats_fill_xbpf(struct xbpf_d *d, struct bpf_d *bd)
1770 {
1771
1772 bzero(d, sizeof(*d));
1773 BPFD_LOCK_ASSERT(bd);
1774 d->bd_immediate = bd->bd_immediate;
1775 d->bd_promisc = bd->bd_promisc;
1776 d->bd_hdrcmplt = bd->bd_hdrcmplt;
1777 d->bd_direction = bd->bd_direction;
1778 d->bd_feedback = bd->bd_feedback;
1779 d->bd_async = bd->bd_async;
1780 d->bd_rcount = bd->bd_rcount;
1781 d->bd_dcount = bd->bd_dcount;
1782 d->bd_fcount = bd->bd_fcount;
1783 d->bd_sig = bd->bd_sig;
1784 d->bd_slen = bd->bd_slen;
1785 d->bd_hlen = bd->bd_hlen;
1786 d->bd_bufsize = bd->bd_bufsize;
1787 d->bd_pid = bd->bd_pid;
1788 strlcpy(d->bd_ifname,
1789 bd->bd_bif->bif_ifp->if_xname, IFNAMSIZ);
1790 d->bd_locked = bd->bd_locked;
1791 }
1792
1793 static int
1794 bpf_stats_sysctl(SYSCTL_HANDLER_ARGS)
1795 {
1796 struct xbpf_d *xbdbuf, *xbd;
1797 int index, error;
1798 struct bpf_if *bp;
1799 struct bpf_d *bd;
1800
1801 /*
1802 * XXX This is not technically correct. It is possible for non
1803 * privileged users to open bpf devices. It would make sense
1804 * if the users who opened the devices were able to retrieve
1805 * the statistics for them, too.
1806 */
1807 error = priv_check(req->td, PRIV_NET_BPF);
1808 if (error)
1809 return (error);
1810 if (req->oldptr == NULL)
1811 return (SYSCTL_OUT(req, 0, bpf_bpfd_cnt * sizeof(*xbd)));
1812 if (bpf_bpfd_cnt == 0)
1813 return (SYSCTL_OUT(req, 0, 0));
1814 xbdbuf = malloc(req->oldlen, M_BPF, M_WAITOK);
1815 mtx_lock(&bpf_mtx);
1816 if (req->oldlen < (bpf_bpfd_cnt * sizeof(*xbd))) {
1817 mtx_unlock(&bpf_mtx);
1818 free(xbdbuf, M_BPF);
1819 return (ENOMEM);
1820 }
1821 index = 0;
1822 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1823 BPFIF_LOCK(bp);
1824 LIST_FOREACH(bd, &bp->bif_dlist, bd_next) {
1825 xbd = &xbdbuf[index++];
1826 BPFD_LOCK(bd);
1827 bpfstats_fill_xbpf(xbd, bd);
1828 BPFD_UNLOCK(bd);
1829 }
1830 BPFIF_UNLOCK(bp);
1831 }
1832 mtx_unlock(&bpf_mtx);
1833 error = SYSCTL_OUT(req, xbdbuf, index * sizeof(*xbd));
1834 free(xbdbuf, M_BPF);
1835 return (error);
1836 }
1837
1838 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL);
1839
1840 #else /* !DEV_BPF && !NETGRAPH_BPF */
1841 /*
1842 * NOP stubs to allow bpf-using drivers to load and function.
1843 *
1844 * A 'better' implementation would allow the core bpf functionality
1845 * to be loaded at runtime.
1846 */
1847 static struct bpf_if bp_null;
1848
1849 void
1850 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
1851 {
1852 }
1853
1854 void
1855 bpf_mtap(struct bpf_if *bp, struct mbuf *m)
1856 {
1857 }
1858
1859 void
1860 bpf_mtap2(struct bpf_if *bp, void *d, u_int l, struct mbuf *m)
1861 {
1862 }
1863
1864 void
1865 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
1866 {
1867
1868 bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1869 }
1870
1871 void
1872 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
1873 {
1874
1875 *driverp = &bp_null;
1876 }
1877
1878 void
1879 bpfdetach(struct ifnet *ifp)
1880 {
1881 }
1882
1883 u_int
1884 bpf_filter(const struct bpf_insn *pc, u_char *p, u_int wirelen, u_int buflen)
1885 {
1886 return -1; /* "no filter" behaviour */
1887 }
1888
1889 int
1890 bpf_validate(const struct bpf_insn *f, int len)
1891 {
1892 return 0; /* false */
1893 }
1894
1895 #endif /* !DEV_BPF && !NETGRAPH_BPF */
Cache object: 993ec9522f6e5dede2a57679078e4e7a
|