xref: /netbsd-src/sys/net/bpf.c (revision 3b01aba77a7a698587faaae455bbfe740923c1f5)
1 /*	$NetBSD: bpf.c,v 1.61 2001/04/13 23:30:11 thorpej Exp $	*/
2 
3 /*
4  * Copyright (c) 1990, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from the Stanford/CMU enet packet filter,
8  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
9  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
10  * Berkeley Laboratory.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by the University of
23  *	California, Berkeley and its contributors.
24  * 4. Neither the name of the University nor the names of its contributors
25  *    may be used to endorse or promote products derived from this software
26  *    without specific prior written permission.
27  *
28  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38  * SUCH DAMAGE.
39  *
40  *	@(#)bpf.c	8.4 (Berkeley) 1/9/95
41  * static char rcsid[] =
42  * "Header: bpf.c,v 1.67 96/09/26 22:00:52 leres Exp ";
43  */
44 
45 #include "bpfilter.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/mbuf.h>
50 #include <sys/buf.h>
51 #include <sys/time.h>
52 #include <sys/proc.h>
53 #include <sys/user.h>
54 #include <sys/ioctl.h>
55 #include <sys/map.h>
56 #include <sys/conf.h>
57 #include <sys/vnode.h>
58 
59 #include <sys/file.h>
60 #include <sys/tty.h>
61 #include <sys/uio.h>
62 
63 #include <sys/protosw.h>
64 #include <sys/socket.h>
65 #include <sys/errno.h>
66 #include <sys/kernel.h>
67 #include <sys/poll.h>
68 
69 #include <net/if.h>
70 
71 #include <net/bpf.h>
72 #include <net/bpfdesc.h>
73 
74 #include <net/if_arc.h>
75 #include <net/if_ether.h>
76 
77 #include <netinet/in.h>
78 #include <netinet/if_inarp.h>
79 
80 #ifndef BPF_BUFSIZE
81 # define BPF_BUFSIZE 8192		/* 4096 too small for FDDI frames */
82 #endif
83 
84 #define PRINET  26			/* interruptible */
85 
86 /*
87  * The default read buffer size is patchable.
88  */
89 int bpf_bufsize = BPF_BUFSIZE;
90 
91 /*
92  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
93  *  bpf_dtab holds the descriptors, indexed by minor device #
94  */
95 struct bpf_if	*bpf_iflist;
96 struct bpf_d	bpf_dtab[NBPFILTER];
97 
98 static int	bpf_allocbufs __P((struct bpf_d *));
99 static void	bpf_freed __P((struct bpf_d *));
100 static void	bpf_ifname __P((struct ifnet *, struct ifreq *));
101 static void	*bpf_mcpy __P((void *, const void *, size_t));
102 static int	bpf_movein __P((struct uio *, int, int,
103 			        struct mbuf **, struct sockaddr *));
104 static void	bpf_attachd __P((struct bpf_d *, struct bpf_if *));
105 static void	bpf_detachd __P((struct bpf_d *));
106 static int	bpf_setif __P((struct bpf_d *, struct ifreq *));
107 int		bpfpoll __P((dev_t, int, struct proc *));
108 static __inline void
109 		bpf_wakeup __P((struct bpf_d *));
110 static void	catchpacket __P((struct bpf_d *, u_char *, u_int, u_int,
111 				 void *(*)(void *, const void *, size_t)));
112 static void	reset_d __P((struct bpf_d *));
113 
114 static int
115 bpf_movein(uio, linktype, mtu, mp, sockp)
116 	struct uio *uio;
117 	int linktype;
118 	int mtu;
119 	struct mbuf **mp;
120 	struct sockaddr *sockp;
121 {
122 	struct mbuf *m;
123 	int error;
124 	int len;
125 	int hlen;
126 	int align;
127 
128 	/*
129 	 * Build a sockaddr based on the data link layer type.
130 	 * We do this at this level because the ethernet header
131 	 * is copied directly into the data field of the sockaddr.
132 	 * In the case of SLIP, there is no header and the packet
133 	 * is forwarded as is.
134 	 * Also, we are careful to leave room at the front of the mbuf
135 	 * for the link level header.
136 	 */
137 	switch (linktype) {
138 
139 	case DLT_SLIP:
140 		sockp->sa_family = AF_INET;
141 		hlen = 0;
142 		align = 0;
143 		break;
144 
145 	case DLT_PPP:
146 		sockp->sa_family = AF_UNSPEC;
147 		hlen = 0;
148 		align = 0;
149 		break;
150 
151 	case DLT_EN10MB:
152 		sockp->sa_family = AF_UNSPEC;
153 		/* XXX Would MAXLINKHDR be better? */
154  		/* 6(dst)+6(src)+2(type) */
155 		hlen = sizeof(struct ether_header);
156 		align = 2;
157 		break;
158 
159 	case DLT_ARCNET:
160 		sockp->sa_family = AF_UNSPEC;
161 		hlen = ARC_HDRLEN;
162 		align = 5;
163 		break;
164 
165 	case DLT_FDDI:
166 		sockp->sa_family = AF_LINK;
167 		/* XXX 4(FORMAC)+6(dst)+6(src) */
168 		hlen = 16;
169 		align = 0;
170 		break;
171 
172 	case DLT_NULL:
173 		sockp->sa_family = AF_UNSPEC;
174 		hlen = 0;
175 		align = 0;
176 		break;
177 
178 	default:
179 		return (EIO);
180 	}
181 
182 	len = uio->uio_resid;
183 	/*
184 	 * If there aren't enough bytes for a link level header or the
185 	 * packet length exceeds the interface mtu, return an error.
186 	 */
187 	if (len < hlen || len - hlen > mtu)
188 		return (EMSGSIZE);
189 
190 	/*
191 	 * XXX Avoid complicated buffer chaining ---
192 	 * bail if it won't fit in a single mbuf.
193 	 * (Take into account possible alignment bytes)
194 	 */
195 	if ((unsigned)len > MCLBYTES - align)
196 		return (EIO);
197 
198 	MGETHDR(m, M_WAIT, MT_DATA);
199 	if (m == 0)
200 		return (ENOBUFS);
201 	m->m_pkthdr.rcvif = 0;
202 	m->m_pkthdr.len = len - hlen;
203 	if (len > MHLEN - align) {
204 		MCLGET(m, M_WAIT);
205 		if ((m->m_flags & M_EXT) == 0) {
206 			error = ENOBUFS;
207 			goto bad;
208 		}
209 	}
210 
211 	/* Insure the data is properly aligned */
212 	if (align > 0) {
213 		m->m_data += align;
214 		m->m_len -= align;
215 	}
216 
217 	error = uiomove(mtod(m, caddr_t), len, uio);
218 	if (error)
219 		goto bad;
220 	if (hlen != 0) {
221 		memcpy(sockp->sa_data, mtod(m, caddr_t), hlen);
222 		m->m_data += hlen; /* XXX */
223 		len -= hlen;
224 	}
225 	m->m_len = len;
226 	*mp = m;
227 	return (0);
228 
229 bad:
230 	m_freem(m);
231 	return (error);
232 }
233 
234 /*
235  * Attach file to the bpf interface, i.e. make d listen on bp.
236  * Must be called at splnet.
237  */
238 static void
239 bpf_attachd(d, bp)
240 	struct bpf_d *d;
241 	struct bpf_if *bp;
242 {
243 	/*
244 	 * Point d at bp, and add d to the interface's list of listeners.
245 	 * Finally, point the driver's bpf cookie at the interface so
246 	 * it will divert packets to bpf.
247 	 */
248 	d->bd_bif = bp;
249 	d->bd_next = bp->bif_dlist;
250 	bp->bif_dlist = d;
251 
252 	*bp->bif_driverp = bp;
253 }
254 
255 /*
256  * Detach a file from its interface.
257  */
258 static void
259 bpf_detachd(d)
260 	struct bpf_d *d;
261 {
262 	struct bpf_d **p;
263 	struct bpf_if *bp;
264 
265 	bp = d->bd_bif;
266 	/*
267 	 * Check if this descriptor had requested promiscuous mode.
268 	 * If so, turn it off.
269 	 */
270 	if (d->bd_promisc) {
271 		int error;
272 
273 		d->bd_promisc = 0;
274 		/*
275 		 * Take device out of promiscuous mode.  Since we were
276 		 * able to enter promiscuous mode, we should be able
277 		 * to turn it off.  But we can get an error if
278 		 * the interface was configured down, so only panic
279 		 * if we don't get an unexpected error.
280 		 */
281   		error = ifpromisc(bp->bif_ifp, 0);
282 		if (error && error != EINVAL)
283 			panic("bpf: ifpromisc failed");
284 	}
285 	/* Remove d from the interface's descriptor list. */
286 	p = &bp->bif_dlist;
287 	while (*p != d) {
288 		p = &(*p)->bd_next;
289 		if (*p == 0)
290 			panic("bpf_detachd: descriptor not in list");
291 	}
292 	*p = (*p)->bd_next;
293 	if (bp->bif_dlist == 0)
294 		/*
295 		 * Let the driver know that there are no more listeners.
296 		 */
297 		*d->bd_bif->bif_driverp = 0;
298 	d->bd_bif = 0;
299 }
300 
301 
302 /*
303  * Mark a descriptor free by making it point to itself.
304  * This is probably cheaper than marking with a constant since
305  * the address should be in a register anyway.
306  */
307 #define D_ISFREE(d) ((d) == (d)->bd_next)
308 #define D_MARKFREE(d) ((d)->bd_next = (d))
309 #define D_MARKUSED(d) ((d)->bd_next = 0)
310 
311 /*
312  * bpfilterattach() is called at boot time.
313  */
314 /* ARGSUSED */
315 void
316 bpfilterattach(n)
317 	int n;
318 {
319 	int i;
320 	/*
321 	 * Mark all the descriptors free.
322 	 */
323 	for (i = 0; i < NBPFILTER; ++i)
324 		D_MARKFREE(&bpf_dtab[i]);
325 
326 }
327 
328 /*
329  * Open ethernet device.  Returns ENXIO for illegal minor device number,
330  * EBUSY if file is open by another process.
331  */
332 /* ARGSUSED */
333 int
334 bpfopen(dev, flag, mode, p)
335 	dev_t dev;
336 	int flag;
337 	int mode;
338 	struct proc *p;
339 {
340 	struct bpf_d *d;
341 
342 	if (minor(dev) >= NBPFILTER)
343 		return (ENXIO);
344 	/*
345 	 * Each minor can be opened by only one process.  If the requested
346 	 * minor is in use, return EBUSY.
347 	 */
348 	d = &bpf_dtab[minor(dev)];
349 	if (!D_ISFREE(d))
350 		return (EBUSY);
351 
352 	/* Mark "free" and do most initialization. */
353 	memset((char *)d, 0, sizeof(*d));
354 	d->bd_bufsize = bpf_bufsize;
355 
356 	return (0);
357 }
358 
359 /*
360  * Close the descriptor by detaching it from its interface,
361  * deallocating its buffers, and marking it free.
362  */
363 /* ARGSUSED */
364 int
365 bpfclose(dev, flag, mode, p)
366 	dev_t dev;
367 	int flag;
368 	int mode;
369 	struct proc *p;
370 {
371 	struct bpf_d *d = &bpf_dtab[minor(dev)];
372 	int s;
373 
374 	s = splnet();
375 	if (d->bd_bif)
376 		bpf_detachd(d);
377 	splx(s);
378 	bpf_freed(d);
379 
380 	return (0);
381 }
382 
383 /*
384  * Rotate the packet buffers in descriptor d.  Move the store buffer
385  * into the hold slot, and the free buffer into the store slot.
386  * Zero the length of the new store buffer.
387  */
388 #define ROTATE_BUFFERS(d) \
389 	(d)->bd_hbuf = (d)->bd_sbuf; \
390 	(d)->bd_hlen = (d)->bd_slen; \
391 	(d)->bd_sbuf = (d)->bd_fbuf; \
392 	(d)->bd_slen = 0; \
393 	(d)->bd_fbuf = 0;
394 /*
395  *  bpfread - read next chunk of packets from buffers
396  */
397 int
398 bpfread(dev, uio, ioflag)
399 	dev_t dev;
400 	struct uio *uio;
401 	int ioflag;
402 {
403 	struct bpf_d *d = &bpf_dtab[minor(dev)];
404 	int error;
405 	int s;
406 
407 	/*
408 	 * Restrict application to use a buffer the same size as
409 	 * as kernel buffers.
410 	 */
411 	if (uio->uio_resid != d->bd_bufsize)
412 		return (EINVAL);
413 
414 	s = splnet();
415 	/*
416 	 * If the hold buffer is empty, then do a timed sleep, which
417 	 * ends when the timeout expires or when enough packets
418 	 * have arrived to fill the store buffer.
419 	 */
420 	while (d->bd_hbuf == 0) {
421 		if (d->bd_immediate) {
422 			if (d->bd_slen == 0) {
423 				splx(s);
424 				return (EWOULDBLOCK);
425 			}
426 			/*
427 			 * A packet(s) either arrived since the previous
428 			 * read or arrived while we were asleep.
429 			 * Rotate the buffers and return what's here.
430 			 */
431 			ROTATE_BUFFERS(d);
432 			break;
433 		}
434 		if (d->bd_rtout != -1)
435 			error = tsleep((caddr_t)d, PRINET|PCATCH, "bpf",
436 					  d->bd_rtout);
437 		else {
438 			if (d->bd_rtout == -1) {
439 				/* User requested non-blocking I/O */
440 				error = EWOULDBLOCK;
441 			} else
442 				error = 0;
443 		}
444 		if (error == EINTR || error == ERESTART) {
445 			splx(s);
446 			return (error);
447 		}
448 		if (error == EWOULDBLOCK) {
449 			/*
450 			 * On a timeout, return what's in the buffer,
451 			 * which may be nothing.  If there is something
452 			 * in the store buffer, we can rotate the buffers.
453 			 */
454 			if (d->bd_hbuf)
455 				/*
456 				 * We filled up the buffer in between
457 				 * getting the timeout and arriving
458 				 * here, so we don't need to rotate.
459 				 */
460 				break;
461 
462 			if (d->bd_slen == 0) {
463 				splx(s);
464 				return (0);
465 			}
466 			ROTATE_BUFFERS(d);
467 			break;
468 		}
469 		if (error != 0)
470 			goto done;
471 	}
472 	/*
473 	 * At this point, we know we have something in the hold slot.
474 	 */
475 	splx(s);
476 
477 	/*
478 	 * Move data from hold buffer into user space.
479 	 * We know the entire buffer is transferred since
480 	 * we checked above that the read buffer is bpf_bufsize bytes.
481 	 */
482 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
483 
484 	s = splnet();
485 	d->bd_fbuf = d->bd_hbuf;
486 	d->bd_hbuf = 0;
487 	d->bd_hlen = 0;
488 done:
489 	splx(s);
490 	return (error);
491 }
492 
493 
494 /*
495  * If there are processes sleeping on this descriptor, wake them up.
496  */
497 static __inline void
498 bpf_wakeup(d)
499 	struct bpf_d *d;
500 {
501 	struct proc *p;
502 
503 	wakeup((caddr_t)d);
504 	if (d->bd_async) {
505 		if (d->bd_pgid > 0)
506 			gsignal (d->bd_pgid, SIGIO);
507 		else if (d->bd_pgid && (p = pfind (-d->bd_pgid)) != NULL)
508 			psignal (p, SIGIO);
509 	}
510 
511 	selwakeup(&d->bd_sel);
512 	/* XXX */
513 	d->bd_sel.si_pid = 0;
514 }
515 
516 int
517 bpfwrite(dev, uio, ioflag)
518 	dev_t dev;
519 	struct uio *uio;
520 	int ioflag;
521 {
522 	struct bpf_d *d = &bpf_dtab[minor(dev)];
523 	struct ifnet *ifp;
524 	struct mbuf *m;
525 	int error, s;
526 	static struct sockaddr_storage dst;
527 
528 	if (d->bd_bif == 0)
529 		return (ENXIO);
530 
531 	ifp = d->bd_bif->bif_ifp;
532 
533 	if (uio->uio_resid == 0)
534 		return (0);
535 
536 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp->if_mtu, &m,
537 		(struct sockaddr *) &dst);
538 	if (error)
539 		return (error);
540 
541 	if (m->m_pkthdr.len > ifp->if_mtu)
542 		return (EMSGSIZE);
543 
544 	if (d->bd_hdrcmplt)
545 		dst.ss_family = pseudo_AF_HDRCMPLT;
546 
547 	s = splsoftnet();
548 	error = (*ifp->if_output)(ifp, m, (struct sockaddr *) &dst, NULL);
549 	splx(s);
550 	/*
551 	 * The driver frees the mbuf.
552 	 */
553 	return (error);
554 }
555 
556 /*
557  * Reset a descriptor by flushing its packet buffer and clearing the
558  * receive and drop counts.  Should be called at splnet.
559  */
560 static void
561 reset_d(d)
562 	struct bpf_d *d;
563 {
564 	if (d->bd_hbuf) {
565 		/* Free the hold buffer. */
566 		d->bd_fbuf = d->bd_hbuf;
567 		d->bd_hbuf = 0;
568 	}
569 	d->bd_slen = 0;
570 	d->bd_hlen = 0;
571 	d->bd_rcount = 0;
572 	d->bd_dcount = 0;
573 }
574 
575 #ifdef BPF_KERN_FILTER
576 extern struct bpf_insn *bpf_tcp_filter;
577 extern struct bpf_insn *bpf_udp_filter;
578 #endif
579 
580 /*
581  *  FIONREAD		Check for read packet available.
582  *  BIOCGBLEN		Get buffer len [for read()].
583  *  BIOCSETF		Set ethernet read filter.
584  *  BIOCFLUSH		Flush read packet buffer.
585  *  BIOCPROMISC		Put interface into promiscuous mode.
586  *  BIOCGDLT		Get link layer type.
587  *  BIOCGETIF		Get interface name.
588  *  BIOCSETIF		Set interface.
589  *  BIOCSRTIMEOUT	Set read timeout.
590  *  BIOCGRTIMEOUT	Get read timeout.
591  *  BIOCGSTATS		Get packet stats.
592  *  BIOCIMMEDIATE	Set immediate mode.
593  *  BIOCVERSION		Get filter language version.
594  *  BIOGHDRCMPLT	Get "header already complete" flag.
595  *  BIOSHDRCMPLT	Set "header already complete" flag.
596  */
597 /* ARGSUSED */
598 int
599 bpfioctl(dev, cmd, addr, flag, p)
600 	dev_t dev;
601 	u_long cmd;
602 	caddr_t addr;
603 	int flag;
604 	struct proc *p;
605 {
606 	struct bpf_d *d = &bpf_dtab[minor(dev)];
607 	int s, error = 0;
608 #ifdef BPF_KERN_FILTER
609 	struct bpf_insn **p;
610 #endif
611 
612 	switch (cmd) {
613 
614 	default:
615 		error = EINVAL;
616 		break;
617 
618 	/*
619 	 * Check for read packet available.
620 	 */
621 	case FIONREAD:
622 		{
623 			int n;
624 
625 			s = splnet();
626 			n = d->bd_slen;
627 			if (d->bd_hbuf)
628 				n += d->bd_hlen;
629 			splx(s);
630 
631 			*(int *)addr = n;
632 			break;
633 		}
634 
635 	/*
636 	 * Get buffer len [for read()].
637 	 */
638 	case BIOCGBLEN:
639 		*(u_int *)addr = d->bd_bufsize;
640 		break;
641 
642 	/*
643 	 * Set buffer length.
644 	 */
645 	case BIOCSBLEN:
646 		if (d->bd_bif != 0)
647 			error = EINVAL;
648 		else {
649 			u_int size = *(u_int *)addr;
650 
651 			if (size > BPF_MAXBUFSIZE)
652 				*(u_int *)addr = size = BPF_MAXBUFSIZE;
653 			else if (size < BPF_MINBUFSIZE)
654 				*(u_int *)addr = size = BPF_MINBUFSIZE;
655 			d->bd_bufsize = size;
656 		}
657 		break;
658 
659 	/*
660 	 * Set link layer read filter.
661 	 */
662 	case BIOCSETF:
663 		error = bpf_setf(d, (struct bpf_program *)addr);
664 		break;
665 
666 #ifdef BPF_KERN_FILTER
667 	/*
668 	 * Set TCP or UDP reject filter.
669 	 */
670 	case BIOCSTCPF:
671 	case BIOCSUDPF:
672 		if (!suser()) {
673 			error = EPERM;
674 			break;
675 		}
676 
677 		/* Validate and store filter */
678 		error = bpf_setf(d, (struct bpf_program *)addr);
679 
680 		/* Free possible old filter */
681 		if (cmd == BIOCSTCPF)
682 			p = &bpf_tcp_filter;
683 		else
684 			p = &bpf_udp_filter;
685 		if (*p != NULL)
686 			free((caddr_t)*p, M_DEVBUF);
687 
688 		/* Steal new filter (noop if error) */
689 		s = splnet();
690 		*p = d->bd_filter;
691 		d->bd_filter = NULL;
692 		splx(s);
693 		break;
694 #endif
695 
696 	/*
697 	 * Flush read packet buffer.
698 	 */
699 	case BIOCFLUSH:
700 		s = splnet();
701 		reset_d(d);
702 		splx(s);
703 		break;
704 
705 	/*
706 	 * Put interface into promiscuous mode.
707 	 */
708 	case BIOCPROMISC:
709 		if (d->bd_bif == 0) {
710 			/*
711 			 * No interface attached yet.
712 			 */
713 			error = EINVAL;
714 			break;
715 		}
716 		s = splnet();
717 		if (d->bd_promisc == 0) {
718 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
719 			if (error == 0)
720 				d->bd_promisc = 1;
721 		}
722 		splx(s);
723 		break;
724 
725 	/*
726 	 * Get device parameters.
727 	 */
728 	case BIOCGDLT:
729 		if (d->bd_bif == 0)
730 			error = EINVAL;
731 		else
732 			*(u_int *)addr = d->bd_bif->bif_dlt;
733 		break;
734 
735 	/*
736 	 * Set interface name.
737 	 */
738 	case BIOCGETIF:
739 		if (d->bd_bif == 0)
740 			error = EINVAL;
741 		else
742 			bpf_ifname(d->bd_bif->bif_ifp, (struct ifreq *)addr);
743 		break;
744 
745 	/*
746 	 * Set interface.
747 	 */
748 	case BIOCSETIF:
749 		error = bpf_setif(d, (struct ifreq *)addr);
750 		break;
751 
752 	/*
753 	 * Set read timeout.
754 	 */
755 	case BIOCSRTIMEOUT:
756 		{
757 			struct timeval *tv = (struct timeval *)addr;
758 
759 			/* Compute number of ticks. */
760 			d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
761 			if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
762 				d->bd_rtout = 1;
763 			break;
764 		}
765 
766 	/*
767 	 * Get read timeout.
768 	 */
769 	case BIOCGRTIMEOUT:
770 		{
771 			struct timeval *tv = (struct timeval *)addr;
772 
773 			tv->tv_sec = d->bd_rtout / hz;
774 			tv->tv_usec = (d->bd_rtout % hz) * tick;
775 			break;
776 		}
777 
778 	/*
779 	 * Get packet stats.
780 	 */
781 	case BIOCGSTATS:
782 		{
783 			struct bpf_stat *bs = (struct bpf_stat *)addr;
784 
785 			bs->bs_recv = d->bd_rcount;
786 			bs->bs_drop = d->bd_dcount;
787 			break;
788 		}
789 
790 	/*
791 	 * Set immediate mode.
792 	 */
793 	case BIOCIMMEDIATE:
794 		d->bd_immediate = *(u_int *)addr;
795 		break;
796 
797 	case BIOCVERSION:
798 		{
799 			struct bpf_version *bv = (struct bpf_version *)addr;
800 
801 			bv->bv_major = BPF_MAJOR_VERSION;
802 			bv->bv_minor = BPF_MINOR_VERSION;
803 			break;
804 		}
805 
806 	case BIOCGHDRCMPLT:	/* get "header already complete" flag */
807 		*(u_int *)addr = d->bd_hdrcmplt;
808 		break;
809 
810 	case BIOCSHDRCMPLT:	/* set "header already complete" flag */
811 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
812 		break;
813 
814 	case FIONBIO:		/* Non-blocking I/O */
815 		if (*(int *)addr)
816 			d->bd_rtout = -1;
817 		else
818 			d->bd_rtout = 0;
819 		break;
820 
821 	case FIOASYNC:		/* Send signal on receive packets */
822 		d->bd_async = *(int *)addr;
823 		break;
824 
825 	/*
826 	 * N.B.  ioctl (FIOSETOWN) and fcntl (F_SETOWN) both end up doing
827 	 * the equivalent of a TIOCSPGRP and hence end up here.  *However*
828 	 * TIOCSPGRP's arg is a process group if it's positive and a process
829 	 * id if it's negative.  This is exactly the opposite of what the
830 	 * other two functions want!  Therefore there is code in ioctl and
831 	 * fcntl to negate the arg before calling here.
832 	 */
833 	case TIOCSPGRP:		/* Process or group to send signals to */
834 		d->bd_pgid = *(int *)addr;
835 		break;
836 
837 	case TIOCGPGRP:
838 		*(int *)addr = d->bd_pgid;
839 		break;
840 	}
841 	return (error);
842 }
843 
844 /*
845  * Set d's packet filter program to fp.  If this file already has a filter,
846  * free it and replace it.  Returns EINVAL for bogus requests.
847  */
848 int
849 bpf_setf(d, fp)
850 	struct bpf_d *d;
851 	struct bpf_program *fp;
852 {
853 	struct bpf_insn *fcode, *old;
854 	u_int flen, size;
855 	int s;
856 
857 	old = d->bd_filter;
858 	if (fp->bf_insns == 0) {
859 		if (fp->bf_len != 0)
860 			return (EINVAL);
861 		s = splnet();
862 		d->bd_filter = 0;
863 		reset_d(d);
864 		splx(s);
865 		if (old != 0)
866 			free((caddr_t)old, M_DEVBUF);
867 		return (0);
868 	}
869 	flen = fp->bf_len;
870 	if (flen > BPF_MAXINSNS)
871 		return (EINVAL);
872 
873 	size = flen * sizeof(*fp->bf_insns);
874 	fcode = (struct bpf_insn *)malloc(size, M_DEVBUF, M_WAITOK);
875 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
876 	    bpf_validate(fcode, (int)flen)) {
877 		s = splnet();
878 		d->bd_filter = fcode;
879 		reset_d(d);
880 		splx(s);
881 		if (old != 0)
882 			free((caddr_t)old, M_DEVBUF);
883 
884 		return (0);
885 	}
886 	free((caddr_t)fcode, M_DEVBUF);
887 	return (EINVAL);
888 }
889 
890 /*
891  * Detach a file from its current interface (if attached at all) and attach
892  * to the interface indicated by the name stored in ifr.
893  * Return an errno or 0.
894  */
895 static int
896 bpf_setif(d, ifr)
897 	struct bpf_d *d;
898 	struct ifreq *ifr;
899 {
900 	struct bpf_if *bp;
901 	char *cp;
902 	int unit_seen, i, s, error;
903 
904 	/*
905 	 * Make sure the provided name has a unit number, and default
906 	 * it to '0' if not specified.
907 	 * XXX This is ugly ... do this differently?
908 	 */
909 	unit_seen = 0;
910 	cp = ifr->ifr_name;
911 	cp[sizeof(ifr->ifr_name) - 1] = '\0';	/* sanity */
912 	while (*cp++)
913 		if (*cp >= '0' && *cp <= '9')
914 			unit_seen = 1;
915 	if (!unit_seen) {
916 		/* Make sure to leave room for the '\0'. */
917 		for (i = 0; i < (IFNAMSIZ - 1); ++i) {
918 			if ((ifr->ifr_name[i] >= 'a' &&
919 			     ifr->ifr_name[i] <= 'z') ||
920 			    (ifr->ifr_name[i] >= 'A' &&
921 			     ifr->ifr_name[i] <= 'Z'))
922 				continue;
923 			ifr->ifr_name[i] = '0';
924 		}
925 	}
926 
927 	/*
928 	 * Look through attached interfaces for the named one.
929 	 */
930 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
931 		struct ifnet *ifp = bp->bif_ifp;
932 
933 		if (ifp == 0 ||
934 		    strcmp(ifp->if_xname, ifr->ifr_name) != 0)
935 			continue;
936 		/*
937 		 * We found the requested interface.
938 		 * If it's not up, return an error.
939 		 * Allocate the packet buffers if we need to.
940 		 * If we're already attached to requested interface,
941 		 * just flush the buffer.
942 		 */
943 		if ((ifp->if_flags & IFF_UP) == 0)
944 			return (ENETDOWN);
945 
946 		if (d->bd_sbuf == 0) {
947 			error = bpf_allocbufs(d);
948 			if (error != 0)
949 				return (error);
950 		}
951 		s = splnet();
952 		if (bp != d->bd_bif) {
953 			if (d->bd_bif)
954 				/*
955 				 * Detach if attached to something else.
956 				 */
957 				bpf_detachd(d);
958 
959 			bpf_attachd(d, bp);
960 		}
961 		reset_d(d);
962 		splx(s);
963 		return (0);
964 	}
965 	/* Not found. */
966 	return (ENXIO);
967 }
968 
969 /*
970  * Copy the interface name to the ifreq.
971  */
972 static void
973 bpf_ifname(ifp, ifr)
974 	struct ifnet *ifp;
975 	struct ifreq *ifr;
976 {
977 
978 	memcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
979 }
980 
981 /*
982  * Support for poll() system call
983  *
984  * Return true iff the specific operation will not block indefinitely.
985  * Otherwise, return false but make a note that a selwakeup() must be done.
986  */
987 int
988 bpfpoll(dev, events, p)
989 	dev_t dev;
990 	int events;
991 	struct proc *p;
992 {
993 	struct bpf_d *d = &bpf_dtab[minor(dev)];
994 	int revents = 0;
995 	int s = splnet();
996 
997 	/*
998 	 * An imitation of the FIONREAD ioctl code.
999 	 */
1000 	if (events & (POLLIN | POLLRDNORM)) {
1001 		if (d->bd_hlen != 0 || (d->bd_immediate && d->bd_slen != 0))
1002 			revents |= events & (POLLIN | POLLRDNORM);
1003 		else
1004 			selrecord(p, &d->bd_sel);
1005 	}
1006 
1007 	splx(s);
1008 	return (revents);
1009 }
1010 
1011 /*
1012  * Incoming linkage from device drivers.  Process the packet pkt, of length
1013  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1014  * by each process' filter, and if accepted, stashed into the corresponding
1015  * buffer.
1016  */
1017 void
1018 bpf_tap(arg, pkt, pktlen)
1019 	caddr_t arg;
1020 	u_char *pkt;
1021 	u_int pktlen;
1022 {
1023 	struct bpf_if *bp;
1024 	struct bpf_d *d;
1025 	u_int slen;
1026 	/*
1027 	 * Note that the ipl does not have to be raised at this point.
1028 	 * The only problem that could arise here is that if two different
1029 	 * interfaces shared any data.  This is not the case.
1030 	 */
1031 	bp = (struct bpf_if *)arg;
1032 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1033 		++d->bd_rcount;
1034 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1035 		if (slen != 0)
1036 			catchpacket(d, pkt, pktlen, slen, memcpy);
1037 	}
1038 }
1039 
1040 /*
1041  * Copy data from an mbuf chain into a buffer.  This code is derived
1042  * from m_copydata in sys/uipc_mbuf.c.
1043  */
1044 static void *
1045 bpf_mcpy(dst_arg, src_arg, len)
1046 	void *dst_arg;
1047 	const void *src_arg;
1048 	size_t len;
1049 {
1050 	const struct mbuf *m;
1051 	u_int count;
1052 	u_char *dst;
1053 
1054 	m = src_arg;
1055 	dst = dst_arg;
1056 	while (len > 0) {
1057 		if (m == 0)
1058 			panic("bpf_mcpy");
1059 		count = min(m->m_len, len);
1060 		memcpy((caddr_t)dst, mtod(m, caddr_t), count);
1061 		m = m->m_next;
1062 		dst += count;
1063 		len -= count;
1064 	}
1065 	return(dst_arg);
1066 }
1067 
1068 /*
1069  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1070  */
1071 void
1072 bpf_mtap(arg, m)
1073 	caddr_t arg;
1074 	struct mbuf *m;
1075 {
1076 	struct bpf_if *bp = (struct bpf_if *)arg;
1077 	struct bpf_d *d;
1078 	u_int pktlen, slen;
1079 	struct mbuf *m0;
1080 
1081 	pktlen = 0;
1082 	for (m0 = m; m0 != 0; m0 = m0->m_next)
1083 		pktlen += m0->m_len;
1084 
1085 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1086 		++d->bd_rcount;
1087 		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1088 		if (slen != 0)
1089 			catchpacket(d, (u_char *)m, pktlen, slen, bpf_mcpy);
1090 	}
1091 }
1092 
1093 /*
1094  * Move the packet data from interface memory (pkt) into the
1095  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1096  * otherwise 0.  "copy" is the routine called to do the actual data
1097  * transfer.  memcpy is passed in to copy contiguous chunks, while
1098  * bpf_mcpy is passed in to copy mbuf chains.  In the latter case,
1099  * pkt is really an mbuf.
1100  */
1101 static void
1102 catchpacket(d, pkt, pktlen, snaplen, cpfn)
1103 	struct bpf_d *d;
1104 	u_char *pkt;
1105 	u_int pktlen, snaplen;
1106 	void *(*cpfn) __P((void *, const void *, size_t));
1107 {
1108 	struct bpf_hdr *hp;
1109 	int totlen, curlen;
1110 	int hdrlen = d->bd_bif->bif_hdrlen;
1111 	/*
1112 	 * Figure out how many bytes to move.  If the packet is
1113 	 * greater or equal to the snapshot length, transfer that
1114 	 * much.  Otherwise, transfer the whole packet (unless
1115 	 * we hit the buffer size limit).
1116 	 */
1117 	totlen = hdrlen + min(snaplen, pktlen);
1118 	if (totlen > d->bd_bufsize)
1119 		totlen = d->bd_bufsize;
1120 
1121 	/*
1122 	 * Round up the end of the previous packet to the next longword.
1123 	 */
1124 	curlen = BPF_WORDALIGN(d->bd_slen);
1125 	if (curlen + totlen > d->bd_bufsize) {
1126 		/*
1127 		 * This packet will overflow the storage buffer.
1128 		 * Rotate the buffers if we can, then wakeup any
1129 		 * pending reads.
1130 		 */
1131 		if (d->bd_fbuf == 0) {
1132 			/*
1133 			 * We haven't completed the previous read yet,
1134 			 * so drop the packet.
1135 			 */
1136 			++d->bd_dcount;
1137 			return;
1138 		}
1139 		ROTATE_BUFFERS(d);
1140 		bpf_wakeup(d);
1141 		curlen = 0;
1142 	}
1143 	else if (d->bd_immediate)
1144 		/*
1145 		 * Immediate mode is set.  A packet arrived so any
1146 		 * reads should be woken up.
1147 		 */
1148 		bpf_wakeup(d);
1149 
1150 	/*
1151 	 * Append the bpf header.
1152 	 */
1153 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1154 	microtime(&hp->bh_tstamp);
1155 	hp->bh_datalen = pktlen;
1156 	hp->bh_hdrlen = hdrlen;
1157 	/*
1158 	 * Copy the packet data into the store buffer and update its length.
1159 	 */
1160 	(*cpfn)((u_char *)hp + hdrlen, pkt, (hp->bh_caplen = totlen - hdrlen));
1161 	d->bd_slen = curlen + totlen;
1162 }
1163 
1164 /*
1165  * Initialize all nonzero fields of a descriptor.
1166  */
1167 static int
1168 bpf_allocbufs(d)
1169 	struct bpf_d *d;
1170 {
1171 
1172 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_DEVBUF, M_WAITOK);
1173 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_DEVBUF, M_WAITOK);
1174 	d->bd_slen = 0;
1175 	d->bd_hlen = 0;
1176 	return (0);
1177 }
1178 
1179 /*
1180  * Free buffers currently in use by a descriptor.
1181  * Called on close.
1182  */
1183 static void
1184 bpf_freed(d)
1185 	struct bpf_d *d;
1186 {
1187 	/*
1188 	 * We don't need to lock out interrupts since this descriptor has
1189 	 * been detached from its interface and it yet hasn't been marked
1190 	 * free.
1191 	 */
1192 	if (d->bd_sbuf != 0) {
1193 		free(d->bd_sbuf, M_DEVBUF);
1194 		if (d->bd_hbuf != 0)
1195 			free(d->bd_hbuf, M_DEVBUF);
1196 		if (d->bd_fbuf != 0)
1197 			free(d->bd_fbuf, M_DEVBUF);
1198 	}
1199 	if (d->bd_filter)
1200 		free((caddr_t)d->bd_filter, M_DEVBUF);
1201 
1202 	D_MARKFREE(d);
1203 }
1204 
1205 /*
1206  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
1207  * fixed size of the link header (variable length headers not yet supported).
1208  */
1209 void
1210 bpfattach(ifp, dlt, hdrlen)
1211 	struct ifnet *ifp;
1212 	u_int dlt, hdrlen;
1213 {
1214 	struct bpf_if *bp;
1215 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_DEVBUF, M_DONTWAIT);
1216 	if (bp == 0)
1217 		panic("bpfattach");
1218 
1219 	bp->bif_dlist = 0;
1220 	bp->bif_driverp = (struct bpf_if **)&ifp->if_bpf;
1221 	bp->bif_ifp = ifp;
1222 	bp->bif_dlt = dlt;
1223 
1224 	bp->bif_next = bpf_iflist;
1225 	bpf_iflist = bp;
1226 
1227 	*bp->bif_driverp = 0;
1228 
1229 	/*
1230 	 * Compute the length of the bpf header.  This is not necessarily
1231 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1232 	 * that the network layer header begins on a longword boundary (for
1233 	 * performance reasons and to alleviate alignment restrictions).
1234 	 */
1235 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1236 
1237 #if 0
1238 	printf("bpf: %s attached\n", ifp->if_xname);
1239 #endif
1240 }
1241 
1242 /*
1243  * Remove an interface from bpf.
1244  */
1245 void
1246 bpfdetach(ifp)
1247 	struct ifnet *ifp;
1248 {
1249 	struct bpf_if *bp, **pbp;
1250 	struct bpf_d *d;
1251 	int i, s, cmaj;
1252 
1253 	/* locate the major number */
1254 	for (cmaj = 0; cmaj <= nchrdev; cmaj++)
1255 		if (cdevsw[cmaj].d_open == bpfopen)
1256 			break;
1257 
1258 	/* Nuke the vnodes for any open instances */
1259 	for (i = 0; i < NBPFILTER; ++i) {
1260 		d = &bpf_dtab[i];
1261 		if (!D_ISFREE(d) && d->bd_bif != NULL &&
1262 		    d->bd_bif->bif_ifp == ifp) {
1263 			/*
1264 			 * Detach the descriptor from an interface now.
1265 			 * It will be free'ed later by close routine.
1266 			 */
1267 			s = splnet();
1268 			d->bd_promisc = 0;	/* we can't touch device. */
1269 			bpf_detachd(d);
1270 			splx(s);
1271 			vdevgone(cmaj, i, i, VCHR);
1272 		}
1273 	}
1274 
1275 	for (bp = bpf_iflist, pbp = &bpf_iflist;
1276 	     bp != NULL; pbp = &bp->bif_next, bp = bp->bif_next) {
1277 		if (bp->bif_ifp == ifp) {
1278 			*pbp = bp->bif_next;
1279 			free(bp, M_DEVBUF);
1280 			break;
1281 		}
1282 	}
1283 }
1284 
1285 /*
1286  * Change the data link type of a BPF instance.
1287  */
1288 void
1289 bpf_change_type(ifp, dlt, hdrlen)
1290 	struct ifnet *ifp;
1291 	u_int dlt, hdrlen;
1292 {
1293 	struct bpf_if *bp;
1294 
1295 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1296 		if (bp->bif_driverp == (struct bpf_if **)&ifp->if_bpf)
1297 			break;
1298 	}
1299 	if (bp == NULL)
1300 		panic("bpf_change_type");
1301 
1302 	bp->bif_dlt = dlt;
1303 
1304 	/*
1305 	 * Compute the length of the bpf header.  This is not necessarily
1306 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1307 	 * that the network layer header begins on a longword boundary (for
1308 	 * performance reasons and to alleviate alignment restrictions).
1309 	 */
1310 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1311 }
1312