xref: /csrg-svn/sys/net/bpf_filter.c (revision 51428)
1 /*-
2  * Copyright (c) 1990-1991 The Regents of the University of California.
3  * All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	@(#)bpf.c	7.5 (Berkeley) 7/15/91
39  *
40  * static char rcsid[] =
41  * "$Header: bpf_filter.c,v 1.16 91/10/27 21:22:35 mccanne Exp $";
42  */
43 #if !(defined(lint) || defined(KERNEL))
44 static char rcsid[] =
45     "@(#) $Header: bpf_filter.c,v 1.16 91/10/27 21:22:35 mccanne Exp $ (LBL)";
46 #endif
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/time.h>
51 #include <net/bpf.h>
52 
53 #ifdef sun
54 #include <netinet/in.h>
55 #endif
56 
57 #if defined(sparc) || defined(mips) || defined(ibm032)
58 #define ALIGN
59 #endif
60 
61 #ifndef ALIGN
62 #define EXTRACT_SHORT(p)	(ntohs(*(u_short *)p))
63 #define EXTRACT_LONG(p)		(ntohl(*(u_long *)p))
64 #else
65 #define EXTRACT_SHORT(p)\
66 	((u_short)\
67 		(*((u_char *)(p)+0)<<8|\
68 		 *((u_char *)(p)+1)<<0))
69 #define EXTRACT_LONG(p)\
70 		(*((u_char *)(p)+0)<<24|\
71 		 *((u_char *)(p)+1)<<16|\
72 		 *((u_char *)(p)+2)<<8|\
73 		 *((u_char *)(p)+3)<<0)
74 #endif
75 
76 #ifdef KERNEL
77 #include <sys/mbuf.h>
78 #define MINDEX(m, k) \
79 { \
80 	register int len = m->m_len; \
81  \
82 	while (k >= len) { \
83 		k -= len; \
84 		m = m->m_next; \
85 		if (m == 0) \
86 			return 0; \
87 		len = m->m_len; \
88 	} \
89 }
90 
91 static int
92 m_xword(m, k, err)
93 	register struct mbuf *m;
94 	register int k, *err;
95 {
96 	register int len;
97 	register u_char *cp, *np;
98 	register struct mbuf *m0;
99 
100 	len = m->m_len;
101 	while (k >= len) {
102 		k -= len;
103 		m = m->m_next;
104 		if (m == 0)
105 			goto bad;
106 		len = m->m_len;
107 	}
108 	cp = mtod(m, u_char *) + k;
109 	if (len - k >= 4) {
110 		*err = 0;
111 		return EXTRACT_LONG(cp);
112 	}
113 	m0 = m->m_next;
114 	if (m0 == 0 || m0->m_len + len - k < 4)
115 		goto bad;
116 	*err = 0;
117 	np = mtod(m0, u_char *);
118 	switch (len - k) {
119 
120 	case 1:
121 		return (cp[k] << 24) | (np[0] << 16) | (np[1] << 8) | np[2];
122 
123 	case 2:
124 		return (cp[k] << 24) | (cp[k + 1] << 16) | (np[0] << 8) |
125 			np[1];
126 
127 	default:
128 		return (cp[k] << 24) | (cp[k + 1] << 16) | (cp[k + 2] << 8) |
129 			np[0];
130 	}
131     bad:
132 	*err = 1;
133 	return 0;
134 }
135 
136 static int
137 m_xhalf(m, k, err)
138 	register struct mbuf *m;
139 	register int k, *err;
140 {
141 	register int len;
142 	register u_char *cp;
143 	register struct mbuf *m0;
144 
145 	len = m->m_len;
146 	while (k >= len) {
147 		k -= len;
148 		m = m->m_next;
149 		if (m == 0)
150 			goto bad;
151 		len = m->m_len;
152 	}
153 	cp = mtod(m, u_char *) + k;
154 	if (len - k >= 2) {
155 		*err = 0;
156 		return EXTRACT_SHORT(cp);
157 	}
158 	m0 = m->m_next;
159 	if (m0 == 0)
160 		goto bad;
161 	*err = 0;
162 	return (cp[k] << 8) | mtod(m0, u_char *)[0];
163  bad:
164 	*err = 1;
165 	return 0;
166 }
167 
168 
169 #endif
170 
171 /*
172  * Execute the filter program starting at pc on the packet p
173  * wirelen is the length of the original packet
174  * buflen is the amount of data present
175  */
176 u_int
177 bpf_filter(pc, p, wirelen, buflen)
178 	register struct bpf_insn *pc;
179 	register u_char *p;
180 	u_int wirelen;
181 	register u_int buflen;
182 {
183 	register long A, X;
184 	register int k;
185 	long mem[BPF_MEMWORDS];
186 
187 	if (pc == 0)
188 		/*
189 		 * No filter means accept all.
190 		 */
191 		return (u_int)-1;
192 #ifdef lint
193 	A = 0;
194 	X = 0;
195 #endif
196 	--pc;
197 	while (1) {
198 		++pc;
199 		switch (pc->code) {
200 
201 		default:
202 #ifdef KERNEL
203 			return 0;
204 #else
205 			abort();
206 #endif
207 		case BPF_RET|BPF_K:
208 			return (u_int)pc->k;
209 
210 		case BPF_RET|BPF_A:
211 			return (u_int)A;
212 
213 		case BPF_LD|BPF_W|BPF_ABS:
214 			k = pc->k;
215 			if (k + sizeof(long) > buflen) {
216 #ifdef KERNEL
217 				int merr;
218 
219 				if (buflen != 0)
220 					return 0;
221 				A = m_xword((struct mbuf *)p, k, &merr);
222 				if (merr != 0)
223 					return 0;
224 				continue;
225 #else
226 				return 0;
227 #endif
228 			}
229 #ifdef ALIGN
230 			if (((int)(p + k) & 3) != 0)
231 				A = EXTRACT_LONG(&p[k]);
232 			else
233 #endif
234 				A = *(long *)(p + k);
235 			continue;
236 
237 		case BPF_LD|BPF_H|BPF_ABS:
238 			k = pc->k;
239 			if (k + sizeof(short) > buflen) {
240 #ifdef KERNEL
241 				int merr;
242 
243 				if (buflen != 0)
244 					return 0;
245 				A = m_xhalf((struct mbuf *)p, k, &merr);
246 				continue;
247 #else
248 				return 0;
249 #endif
250 			}
251 			A = EXTRACT_SHORT(&p[k]);
252 			continue;
253 
254 		case BPF_LD|BPF_B|BPF_ABS:
255 			k = pc->k;
256 			if (k >= buflen) {
257 #ifdef KERNEL
258 				register struct mbuf *m;
259 
260 				if (buflen != 0)
261 					return 0;
262 				m = (struct mbuf *)p;
263 				MINDEX(m, k);
264 				A = mtod(m, u_char *)[k];
265 				continue;
266 #else
267 				return 0;
268 #endif
269 			}
270 			A = p[k];
271 			continue;
272 
273 		case BPF_LD|BPF_W|BPF_LEN:
274 			A = wirelen;
275 			continue;
276 
277 		case BPF_LDX|BPF_W|BPF_LEN:
278 			X = wirelen;
279 			continue;
280 
281 		case BPF_LD|BPF_W|BPF_IND:
282 			k = X + pc->k;
283 			if (k + sizeof(long) > buflen) {
284 #ifdef KERNEL
285 				int merr;
286 
287 				if (buflen != 0)
288 					return 0;
289 				A = m_xword((struct mbuf *)p, k, &merr);
290 				if (merr != 0)
291 					return 0;
292 				continue;
293 #else
294 				return 0;
295 #endif
296 			}
297 #ifdef ALIGN
298 			if (((int)(p + k) & 3) != 0)
299 				A = EXTRACT_LONG(&p[k]);
300 			else
301 #endif
302 				A = *(long *)(p + k);
303 			continue;
304 
305 		case BPF_LD|BPF_H|BPF_IND:
306 			k = X + pc->k;
307 			if (k + sizeof(short) > buflen) {
308 #ifdef KERNEL
309 				int merr;
310 
311 				if (buflen != 0)
312 					return 0;
313 				A = m_xhalf((struct mbuf *)p, k, &merr);
314 				if (merr != 0)
315 					return 0;
316 				continue;
317 #else
318 				return 0;
319 #endif
320 			}
321 			A = EXTRACT_SHORT(&p[k]);
322 			continue;
323 
324 		case BPF_LD|BPF_B|BPF_IND:
325 			k = X + pc->k;
326 			if (k >= buflen) {
327 #ifdef KERNEL
328 				register struct mbuf *m;
329 
330 				if (buflen != 0)
331 					return 0;
332 				m = (struct mbuf *)p;
333 				MINDEX(m, k);
334 				A = mtod(m, char *)[k];
335 				continue;
336 #else
337 				return 0;
338 #endif
339 			}
340 			A = p[k];
341 			continue;
342 
343 		case BPF_LDX|BPF_MSH|BPF_B:
344 			k = pc->k;
345 			if (k >= buflen) {
346 #ifdef KERNEL
347 				register struct mbuf *m;
348 
349 				if (buflen != 0)
350 					return 0;
351 				m = (struct mbuf *)p;
352 				MINDEX(m, k);
353 				X = (mtod(m, char *)[k] & 0xf) << 2;
354 				continue;
355 #else
356 				return 0;
357 #endif
358 			}
359 			X = (p[pc->k] & 0xf) << 2;
360 			continue;
361 
362 		case BPF_LD|BPF_IMM:
363 			A = pc->k;
364 			continue;
365 
366 		case BPF_LDX|BPF_IMM:
367 			X = pc->k;
368 			continue;
369 
370 		case BPF_LD|BPF_MEM:
371 			A = mem[pc->k];
372 			continue;
373 
374 		case BPF_LDX|BPF_MEM:
375 			X = mem[pc->k];
376 			continue;
377 
378 		case BPF_ST:
379 			mem[pc->k] = A;
380 			continue;
381 
382 		case BPF_STX:
383 			mem[pc->k] = X;
384 			continue;
385 
386 		case BPF_JMP|BPF_JA:
387 			pc += pc->k;
388 			continue;
389 
390 		case BPF_JMP|BPF_JGT|BPF_K:
391 			pc += (A > pc->k) ? pc->jt : pc->jf;
392 			continue;
393 
394 		case BPF_JMP|BPF_JGE|BPF_K:
395 			pc += (A >= pc->k) ? pc->jt : pc->jf;
396 			continue;
397 
398 		case BPF_JMP|BPF_JEQ|BPF_K:
399 			pc += (A == pc->k) ? pc->jt : pc->jf;
400 			continue;
401 
402 		case BPF_JMP|BPF_JSET|BPF_K:
403 			pc += (A & pc->k) ? pc->jt : pc->jf;
404 			continue;
405 
406 		case BPF_JMP|BPF_JGT|BPF_X:
407 			pc += (A > X) ? pc->jt : pc->jf;
408 			continue;
409 
410 		case BPF_JMP|BPF_JGE|BPF_X:
411 			pc += (A >= X) ? pc->jt : pc->jf;
412 			continue;
413 
414 		case BPF_JMP|BPF_JEQ|BPF_X:
415 			pc += (A == X) ? pc->jt : pc->jf;
416 			continue;
417 
418 		case BPF_JMP|BPF_JSET|BPF_X:
419 			pc += (A & X) ? pc->jt : pc->jf;
420 			continue;
421 
422 		case BPF_ALU|BPF_ADD|BPF_X:
423 			A += X;
424 			continue;
425 
426 		case BPF_ALU|BPF_SUB|BPF_X:
427 			A -= X;
428 			continue;
429 
430 		case BPF_ALU|BPF_MUL|BPF_X:
431 			A *= X;
432 			continue;
433 
434 		case BPF_ALU|BPF_DIV|BPF_X:
435 			if (X == 0)
436 				return 0;
437 			A /= X;
438 			continue;
439 
440 		case BPF_ALU|BPF_AND|BPF_X:
441 			A &= X;
442 			continue;
443 
444 		case BPF_ALU|BPF_OR|BPF_X:
445 			A |= X;
446 			continue;
447 
448 		case BPF_ALU|BPF_LSH|BPF_X:
449 			A <<= X;
450 			continue;
451 
452 		case BPF_ALU|BPF_RSH|BPF_X:
453 			A >>= X;
454 			continue;
455 
456 		case BPF_ALU|BPF_ADD|BPF_K:
457 			A += pc->k;
458 			continue;
459 
460 		case BPF_ALU|BPF_SUB|BPF_K:
461 			A -= pc->k;
462 			continue;
463 
464 		case BPF_ALU|BPF_MUL|BPF_K:
465 			A *= pc->k;
466 			continue;
467 
468 		case BPF_ALU|BPF_DIV|BPF_K:
469 			A /= pc->k;
470 			continue;
471 
472 		case BPF_ALU|BPF_AND|BPF_K:
473 			A &= pc->k;
474 			continue;
475 
476 		case BPF_ALU|BPF_OR|BPF_K:
477 			A |= pc->k;
478 			continue;
479 
480 		case BPF_ALU|BPF_LSH|BPF_K:
481 			A <<= pc->k;
482 			continue;
483 
484 		case BPF_ALU|BPF_RSH|BPF_K:
485 			A >>= pc->k;
486 			continue;
487 
488 		case BPF_ALU|BPF_NEG:
489 			A = -A;
490 			continue;
491 
492 		case BPF_MISC|BPF_TAX:
493 			X = A;
494 			continue;
495 
496 		case BPF_MISC|BPF_TXA:
497 			A = X;
498 			continue;
499 		}
500 	}
501 }
502 
503 #ifdef KERNEL
504 /*
505  * Return true if the 'fcode' is a valid filter program.
506  * The constraints are that each jump be forward and to a valid
507  * code.  The code must terminate with either an accept or reject.
508  * 'valid' is an array for use by the routine (it must be at least
509  * 'len' bytes long).
510  *
511  * The kernel needs to be able to verify an application's filter code.
512  * Otherwise, a bogus program could easily crash the system.
513  */
514 int
515 bpf_validate(f, len)
516 	struct bpf_insn *f;
517 	int len;
518 {
519 	register int i;
520 	register struct bpf_insn *p;
521 
522 	for (i = 0; i < len; ++i) {
523 		/*
524 		 * Check that that jumps are forward, and within
525 		 * the code block.
526 		 */
527 		p = &f[i];
528 		if (BPF_CLASS(p->code) == BPF_JMP) {
529 			register int from = i + 1;
530 
531 			if (BPF_OP(p->code) == BPF_JA) {
532 				if (from + p->k >= len)
533 					return 0;
534 			}
535 			else if (from + p->jt >= len || from + p->jf >= len)
536 				return 0;
537 		}
538 		/*
539 		 * Check that memory operations use valid addresses.
540 		 */
541 		if ((BPF_CLASS(p->code) == BPF_ST ||
542 		     (BPF_CLASS(p->code) == BPF_LD &&
543 		      (p->code & 0xe0) == BPF_MEM)) &&
544 		    (p->k >= BPF_MEMWORDS || p->k < 0))
545 			return 0;
546 		/*
547 		 * Check for constant division by 0.
548 		 */
549 		if (p->code == (BPF_ALU|BPF_DIV|BPF_K) && p->k == 0)
550 			return 0;
551 	}
552 	return BPF_CLASS(f[len - 1].code) == BPF_RET;
553 }
554 #endif
555