FreeBSD/Linux Kernel Cross Reference
sys/net/bpf_filter.c
1 /*
2 * Copyright (c) 1990, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * This code is derived from the Stanford/CMU enet packet filter,
6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8 * Berkeley Laboratory.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * This product includes software developed by the University of
21 * California, Berkeley and its contributors.
22 * 4. Neither the name of the University nor the names of its contributors
23 * may be used to endorse or promote products derived from this software
24 * without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 * @(#)bpf_filter.c 8.1 (Berkeley) 6/10/93
39 *
40 * $FreeBSD$
41 */
42
43 #include <sys/param.h>
44
45 #ifdef sun
46 #include <netinet/in.h>
47 #endif
48
49 #if defined(sparc) || defined(mips) || defined(ibm032) || defined(__alpha__)
50 #define BPF_ALIGN
51 #endif
52
53 #ifndef BPF_ALIGN
54 #define EXTRACT_SHORT(p) ((u_int16_t)ntohs(*(u_int16_t *)p))
55 #define EXTRACT_LONG(p) (ntohl(*(u_int32_t *)p))
56 #else
57 #define EXTRACT_SHORT(p)\
58 ((u_int16_t)\
59 ((u_int16_t)*((u_char *)p+0)<<8|\
60 (u_int16_t)*((u_char *)p+1)<<0))
61 #define EXTRACT_LONG(p)\
62 ((u_int32_t)*((u_char *)p+0)<<24|\
63 (u_int32_t)*((u_char *)p+1)<<16|\
64 (u_int32_t)*((u_char *)p+2)<<8|\
65 (u_int32_t)*((u_char *)p+3)<<0)
66 #endif
67
68 #ifdef KERNEL
69 #include <sys/mbuf.h>
70 #endif
71 #include <net/bpf.h>
72 #ifdef KERNEL
73 #define MINDEX(m, k) \
74 { \
75 register int len = m->m_len; \
76 \
77 while (k >= len) { \
78 k -= len; \
79 m = m->m_next; \
80 if (m == 0) \
81 return 0; \
82 len = m->m_len; \
83 } \
84 }
85
86 static u_int16_t m_xhalf __P((struct mbuf *m, bpf_u_int32 k, int *err));
87 static u_int32_t m_xword __P((struct mbuf *m, bpf_u_int32 k, int *err));
88
89 static u_int32_t
90 m_xword(m, k, err)
91 register struct mbuf *m;
92 register bpf_u_int32 k;
93 register int *err;
94 {
95 register size_t len;
96 register u_char *cp, *np;
97 register struct mbuf *m0;
98
99 len = m->m_len;
100 while (k >= len) {
101 k -= len;
102 m = m->m_next;
103 if (m == 0)
104 goto bad;
105 len = m->m_len;
106 }
107 cp = mtod(m, u_char *) + k;
108 if (len - k >= 4) {
109 *err = 0;
110 return EXTRACT_LONG(cp);
111 }
112 m0 = m->m_next;
113 if (m0 == 0 || m0->m_len + len - k < 4)
114 goto bad;
115 *err = 0;
116 np = mtod(m0, u_char *);
117 switch (len - k) {
118
119 case 1:
120 return
121 ((u_int32_t)cp[0] << 24) |
122 ((u_int32_t)np[0] << 16) |
123 ((u_int32_t)np[1] << 8) |
124 (u_int32_t)np[2];
125
126 case 2:
127 return
128 ((u_int32_t)cp[0] << 24) |
129 ((u_int32_t)cp[1] << 16) |
130 ((u_int32_t)np[0] << 8) |
131 (u_int32_t)np[1];
132
133 default:
134 return
135 ((u_int32_t)cp[0] << 24) |
136 ((u_int32_t)cp[1] << 16) |
137 ((u_int32_t)cp[2] << 8) |
138 (u_int32_t)np[0];
139 }
140 bad:
141 *err = 1;
142 return 0;
143 }
144
145 static u_int16_t
146 m_xhalf(m, k, err)
147 register struct mbuf *m;
148 register bpf_u_int32 k;
149 register int *err;
150 {
151 register size_t len;
152 register u_char *cp;
153 register struct mbuf *m0;
154
155 len = m->m_len;
156 while (k >= len) {
157 k -= len;
158 m = m->m_next;
159 if (m == 0)
160 goto bad;
161 len = m->m_len;
162 }
163 cp = mtod(m, u_char *) + k;
164 if (len - k >= 2) {
165 *err = 0;
166 return EXTRACT_SHORT(cp);
167 }
168 m0 = m->m_next;
169 if (m0 == 0)
170 goto bad;
171 *err = 0;
172 return (cp[0] << 8) | mtod(m0, u_char *)[0];
173 bad:
174 *err = 1;
175 return 0;
176 }
177 #endif
178
179 /*
180 * Execute the filter program starting at pc on the packet p
181 * wirelen is the length of the original packet
182 * buflen is the amount of data present
183 */
184 u_int
185 bpf_filter(pc, p, wirelen, buflen)
186 register const struct bpf_insn *pc;
187 register u_char *p;
188 u_int wirelen;
189 register u_int buflen;
190 {
191 register u_int32_t A = 0, X = 0;
192 register bpf_u_int32 k;
193 int32_t mem[BPF_MEMWORDS];
194
195 if (pc == 0)
196 /*
197 * No filter means accept all.
198 */
199 return (u_int)-1;
200
201 --pc;
202 while (1) {
203 ++pc;
204 switch (pc->code) {
205
206 default:
207 #ifdef KERNEL
208 return 0;
209 #else
210 abort();
211 #endif
212 case BPF_RET|BPF_K:
213 return (u_int)pc->k;
214
215 case BPF_RET|BPF_A:
216 return (u_int)A;
217
218 case BPF_LD|BPF_W|BPF_ABS:
219 k = pc->k;
220 if (k > buflen || sizeof(int32_t) > buflen - k) {
221 #ifdef KERNEL
222 int merr;
223
224 if (buflen != 0)
225 return 0;
226 A = m_xword((struct mbuf *)p, k, &merr);
227 if (merr != 0)
228 return 0;
229 continue;
230 #else
231 return 0;
232 #endif
233 }
234 #ifdef BPF_ALIGN
235 if (((intptr_t)(p + k) & 3) != 0)
236 A = EXTRACT_LONG(&p[k]);
237 else
238 #endif
239 A = ntohl(*(int32_t *)(p + k));
240 continue;
241
242 case BPF_LD|BPF_H|BPF_ABS:
243 k = pc->k;
244 if (k > buflen || sizeof(int16_t) > buflen - k) {
245 #ifdef KERNEL
246 int merr;
247
248 if (buflen != 0)
249 return 0;
250 A = m_xhalf((struct mbuf *)p, k, &merr);
251 continue;
252 #else
253 return 0;
254 #endif
255 }
256 A = EXTRACT_SHORT(&p[k]);
257 continue;
258
259 case BPF_LD|BPF_B|BPF_ABS:
260 k = pc->k;
261 if (k >= buflen) {
262 #ifdef KERNEL
263 register struct mbuf *m;
264
265 if (buflen != 0)
266 return 0;
267 m = (struct mbuf *)p;
268 MINDEX(m, k);
269 A = mtod(m, u_char *)[k];
270 continue;
271 #else
272 return 0;
273 #endif
274 }
275 A = p[k];
276 continue;
277
278 case BPF_LD|BPF_W|BPF_LEN:
279 A = wirelen;
280 continue;
281
282 case BPF_LDX|BPF_W|BPF_LEN:
283 X = wirelen;
284 continue;
285
286 case BPF_LD|BPF_W|BPF_IND:
287 k = X + pc->k;
288 if (pc->k > buflen || X > buflen - pc->k || sizeof(int32_t) > buflen - k) {
289 #ifdef KERNEL
290 int merr;
291
292 if (buflen != 0)
293 return 0;
294 A = m_xword((struct mbuf *)p, k, &merr);
295 if (merr != 0)
296 return 0;
297 continue;
298 #else
299 return 0;
300 #endif
301 }
302 #ifdef BPF_ALIGN
303 if (((intptr_t)(p + k) & 3) != 0)
304 A = EXTRACT_LONG(&p[k]);
305 else
306 #endif
307 A = ntohl(*(int32_t *)(p + k));
308 continue;
309
310 case BPF_LD|BPF_H|BPF_IND:
311 k = X + pc->k;
312 if (X > buflen || pc->k > buflen - X || sizeof(int16_t) > buflen - k) {
313 #ifdef KERNEL
314 int merr;
315
316 if (buflen != 0)
317 return 0;
318 A = m_xhalf((struct mbuf *)p, k, &merr);
319 if (merr != 0)
320 return 0;
321 continue;
322 #else
323 return 0;
324 #endif
325 }
326 A = EXTRACT_SHORT(&p[k]);
327 continue;
328
329 case BPF_LD|BPF_B|BPF_IND:
330 k = X + pc->k;
331 if (pc->k >= buflen || X >= buflen - pc->k) {
332 #ifdef KERNEL
333 register struct mbuf *m;
334
335 if (buflen != 0)
336 return 0;
337 m = (struct mbuf *)p;
338 MINDEX(m, k);
339 A = mtod(m, char *)[k];
340 continue;
341 #else
342 return 0;
343 #endif
344 }
345 A = p[k];
346 continue;
347
348 case BPF_LDX|BPF_MSH|BPF_B:
349 k = pc->k;
350 if (k >= buflen) {
351 #ifdef KERNEL
352 register struct mbuf *m;
353
354 if (buflen != 0)
355 return 0;
356 m = (struct mbuf *)p;
357 MINDEX(m, k);
358 X = (mtod(m, char *)[k] & 0xf) << 2;
359 continue;
360 #else
361 return 0;
362 #endif
363 }
364 X = (p[pc->k] & 0xf) << 2;
365 continue;
366
367 case BPF_LD|BPF_IMM:
368 A = pc->k;
369 continue;
370
371 case BPF_LDX|BPF_IMM:
372 X = pc->k;
373 continue;
374
375 case BPF_LD|BPF_MEM:
376 A = mem[pc->k];
377 continue;
378
379 case BPF_LDX|BPF_MEM:
380 X = mem[pc->k];
381 continue;
382
383 case BPF_ST:
384 mem[pc->k] = A;
385 continue;
386
387 case BPF_STX:
388 mem[pc->k] = X;
389 continue;
390
391 case BPF_JMP|BPF_JA:
392 pc += pc->k;
393 continue;
394
395 case BPF_JMP|BPF_JGT|BPF_K:
396 pc += (A > pc->k) ? pc->jt : pc->jf;
397 continue;
398
399 case BPF_JMP|BPF_JGE|BPF_K:
400 pc += (A >= pc->k) ? pc->jt : pc->jf;
401 continue;
402
403 case BPF_JMP|BPF_JEQ|BPF_K:
404 pc += (A == pc->k) ? pc->jt : pc->jf;
405 continue;
406
407 case BPF_JMP|BPF_JSET|BPF_K:
408 pc += (A & pc->k) ? pc->jt : pc->jf;
409 continue;
410
411 case BPF_JMP|BPF_JGT|BPF_X:
412 pc += (A > X) ? pc->jt : pc->jf;
413 continue;
414
415 case BPF_JMP|BPF_JGE|BPF_X:
416 pc += (A >= X) ? pc->jt : pc->jf;
417 continue;
418
419 case BPF_JMP|BPF_JEQ|BPF_X:
420 pc += (A == X) ? pc->jt : pc->jf;
421 continue;
422
423 case BPF_JMP|BPF_JSET|BPF_X:
424 pc += (A & X) ? pc->jt : pc->jf;
425 continue;
426
427 case BPF_ALU|BPF_ADD|BPF_X:
428 A += X;
429 continue;
430
431 case BPF_ALU|BPF_SUB|BPF_X:
432 A -= X;
433 continue;
434
435 case BPF_ALU|BPF_MUL|BPF_X:
436 A *= X;
437 continue;
438
439 case BPF_ALU|BPF_DIV|BPF_X:
440 if (X == 0)
441 return 0;
442 A /= X;
443 continue;
444
445 case BPF_ALU|BPF_AND|BPF_X:
446 A &= X;
447 continue;
448
449 case BPF_ALU|BPF_OR|BPF_X:
450 A |= X;
451 continue;
452
453 case BPF_ALU|BPF_LSH|BPF_X:
454 A <<= X;
455 continue;
456
457 case BPF_ALU|BPF_RSH|BPF_X:
458 A >>= X;
459 continue;
460
461 case BPF_ALU|BPF_ADD|BPF_K:
462 A += pc->k;
463 continue;
464
465 case BPF_ALU|BPF_SUB|BPF_K:
466 A -= pc->k;
467 continue;
468
469 case BPF_ALU|BPF_MUL|BPF_K:
470 A *= pc->k;
471 continue;
472
473 case BPF_ALU|BPF_DIV|BPF_K:
474 A /= pc->k;
475 continue;
476
477 case BPF_ALU|BPF_AND|BPF_K:
478 A &= pc->k;
479 continue;
480
481 case BPF_ALU|BPF_OR|BPF_K:
482 A |= pc->k;
483 continue;
484
485 case BPF_ALU|BPF_LSH|BPF_K:
486 A <<= pc->k;
487 continue;
488
489 case BPF_ALU|BPF_RSH|BPF_K:
490 A >>= pc->k;
491 continue;
492
493 case BPF_ALU|BPF_NEG:
494 A = -A;
495 continue;
496
497 case BPF_MISC|BPF_TAX:
498 X = A;
499 continue;
500
501 case BPF_MISC|BPF_TXA:
502 A = X;
503 continue;
504 }
505 }
506 }
507
508 #ifdef KERNEL
509 /*
510 * Return true if the 'fcode' is a valid filter program.
511 * The constraints are that each jump be forward and to a valid
512 * code. The code must terminate with either an accept or reject.
513 *
514 * The kernel needs to be able to verify an application's filter code.
515 * Otherwise, a bogus program could easily crash the system.
516 */
517 int
518 bpf_validate(f, len)
519 const struct bpf_insn *f;
520 int len;
521 {
522 register int i;
523 register const struct bpf_insn *p;
524
525 for (i = 0; i < len; ++i) {
526 /*
527 * Check that that jumps are forward, and within
528 * the code block.
529 */
530 p = &f[i];
531 if (BPF_CLASS(p->code) == BPF_JMP) {
532 register int from = i + 1;
533
534 if (BPF_OP(p->code) == BPF_JA) {
535 if (from >= len || p->k >= len - from)
536 return 0;
537 }
538 else if (from >= len || p->jt >= len - from || p->jf >= len - from)
539 return 0;
540 }
541 /*
542 * Check that memory operations use valid addresses.
543 */
544 if ((BPF_CLASS(p->code) == BPF_ST ||
545 (BPF_CLASS(p->code) == BPF_LD &&
546 (p->code & 0xe0) == BPF_MEM)) &&
547 p->k >= BPF_MEMWORDS)
548 return 0;
549 /*
550 * Check for constant division by 0.
551 */
552 if (p->code == (BPF_ALU|BPF_DIV|BPF_K) && p->k == 0)
553 return 0;
554 }
555 return BPF_CLASS(f[len - 1].code) == BPF_RET;
556 }
557 #endif
Cache object: 61cbc6f71a69ff3da41ee09b72623e77
|