xref: /netbsd-src/sys/net/bpf.c (revision bf1e9b32e27832f0c493206710fb8b58a980838a)
1 /*	$NetBSD: bpf.c,v 1.109 2005/06/22 10:36:16 peter Exp $	*/
2 
3 /*
4  * Copyright (c) 1990, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from the Stanford/CMU enet packet filter,
8  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
9  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
10  * Berkeley Laboratory.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)bpf.c	8.4 (Berkeley) 1/9/95
37  * static char rcsid[] =
38  * "Header: bpf.c,v 1.67 96/09/26 22:00:52 leres Exp ";
39  */
40 
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.109 2005/06/22 10:36:16 peter Exp $");
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/mbuf.h>
47 #include <sys/buf.h>
48 #include <sys/time.h>
49 #include <sys/proc.h>
50 #include <sys/user.h>
51 #include <sys/ioctl.h>
52 #include <sys/conf.h>
53 #include <sys/vnode.h>
54 #include <sys/queue.h>
55 
56 #include <sys/file.h>
57 #include <sys/filedesc.h>
58 #include <sys/tty.h>
59 #include <sys/uio.h>
60 
61 #include <sys/protosw.h>
62 #include <sys/socket.h>
63 #include <sys/errno.h>
64 #include <sys/kernel.h>
65 #include <sys/poll.h>
66 #include <sys/sysctl.h>
67 
68 #include <net/if.h>
69 #include <net/slip.h>
70 
71 #include <net/bpf.h>
72 #include <net/bpfdesc.h>
73 
74 #include <net/if_arc.h>
75 #include <net/if_ether.h>
76 
77 #include <netinet/in.h>
78 #include <netinet/if_inarp.h>
79 
80 #if defined(_KERNEL_OPT)
81 #include "opt_bpf.h"
82 #include "sl.h"
83 #include "strip.h"
84 #endif
85 
86 #ifndef BPF_BUFSIZE
87 /*
88  * 4096 is too small for FDDI frames. 8192 is too small for gigabit Ethernet
89  * jumbos (circa 9k), ATM, or Intel gig/10gig ethernet jumbos (16k).
90  */
91 # define BPF_BUFSIZE 32768
92 #endif
93 
94 #define PRINET  26			/* interruptible */
95 
96 /*
97  * The default read buffer size, and limit for BIOCSBLEN, is sysctl'able.
98  * XXX the default values should be computed dynamically based
99  * on available memory size and available mbuf clusters.
100  */
101 int bpf_bufsize = BPF_BUFSIZE;
102 int bpf_maxbufsize = BPF_DFLTBUFSIZE;	/* XXX set dynamically, see above */
103 
104 /*
105  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
106  *  bpf_dtab holds the descriptors, indexed by minor device #
107  */
108 struct bpf_if	*bpf_iflist;
109 LIST_HEAD(, bpf_d) bpf_list;
110 
111 static int	bpf_allocbufs(struct bpf_d *);
112 static void	bpf_deliver(struct bpf_if *,
113 		            void *(*cpfn)(void *, const void *, size_t),
114 			    void *, u_int, u_int, struct ifnet *);
115 static void	bpf_freed(struct bpf_d *);
116 static void	bpf_ifname(struct ifnet *, struct ifreq *);
117 static void	*bpf_mcpy(void *, const void *, size_t);
118 static int	bpf_movein(struct uio *, int, int,
119 			        struct mbuf **, struct sockaddr *);
120 static void	bpf_attachd(struct bpf_d *, struct bpf_if *);
121 static void	bpf_detachd(struct bpf_d *);
122 static int	bpf_setif(struct bpf_d *, struct ifreq *);
123 static void	bpf_timed_out(void *);
124 static __inline void
125 		bpf_wakeup(struct bpf_d *);
126 static void	catchpacket(struct bpf_d *, u_char *, u_int, u_int,
127 				 void *(*)(void *, const void *, size_t));
128 static void	reset_d(struct bpf_d *);
129 static int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
130 static int	bpf_setdlt(struct bpf_d *, u_int);
131 
132 static int	bpf_read(struct file *, off_t *, struct uio *, struct ucred *,
133     int);
134 static int	bpf_write(struct file *, off_t *, struct uio *, struct ucred *,
135     int);
136 static int	bpf_ioctl(struct file *, u_long, void *, struct proc *);
137 static int	bpf_poll(struct file *, int, struct proc *);
138 static int	bpf_close(struct file *, struct proc *);
139 static int	bpf_kqfilter(struct file *, struct knote *);
140 
141 static const struct fileops bpf_fileops = {
142 	bpf_read,
143 	bpf_write,
144 	bpf_ioctl,
145 	fnullop_fcntl,
146 	bpf_poll,
147 	fbadop_stat,
148 	bpf_close,
149 	bpf_kqfilter,
150 };
151 
152 dev_type_open(bpfopen);
153 
154 const struct cdevsw bpf_cdevsw = {
155 	bpfopen, noclose, noread, nowrite, noioctl,
156 	nostop, notty, nopoll, nommap, nokqfilter,
157 };
158 
159 static int
160 bpf_movein(uio, linktype, mtu, mp, sockp)
161 	struct uio *uio;
162 	int linktype;
163 	int mtu;
164 	struct mbuf **mp;
165 	struct sockaddr *sockp;
166 {
167 	struct mbuf *m;
168 	int error;
169 	int len;
170 	int hlen;
171 	int align;
172 
173 	/*
174 	 * Build a sockaddr based on the data link layer type.
175 	 * We do this at this level because the ethernet header
176 	 * is copied directly into the data field of the sockaddr.
177 	 * In the case of SLIP, there is no header and the packet
178 	 * is forwarded as is.
179 	 * Also, we are careful to leave room at the front of the mbuf
180 	 * for the link level header.
181 	 */
182 	switch (linktype) {
183 
184 	case DLT_SLIP:
185 		sockp->sa_family = AF_INET;
186 		hlen = 0;
187 		align = 0;
188 		break;
189 
190 	case DLT_PPP:
191 		sockp->sa_family = AF_UNSPEC;
192 		hlen = 0;
193 		align = 0;
194 		break;
195 
196 	case DLT_EN10MB:
197 		sockp->sa_family = AF_UNSPEC;
198 		/* XXX Would MAXLINKHDR be better? */
199  		/* 6(dst)+6(src)+2(type) */
200 		hlen = sizeof(struct ether_header);
201 		align = 2;
202 		break;
203 
204 	case DLT_ARCNET:
205 		sockp->sa_family = AF_UNSPEC;
206 		hlen = ARC_HDRLEN;
207 		align = 5;
208 		break;
209 
210 	case DLT_FDDI:
211 		sockp->sa_family = AF_LINK;
212 		/* XXX 4(FORMAC)+6(dst)+6(src) */
213 		hlen = 16;
214 		align = 0;
215 		break;
216 
217 	case DLT_ECONET:
218 		sockp->sa_family = AF_UNSPEC;
219 		hlen = 6;
220 		align = 2;
221 		break;
222 
223 	case DLT_NULL:
224 		sockp->sa_family = AF_UNSPEC;
225 		hlen = 0;
226 		align = 0;
227 		break;
228 
229 	default:
230 		return (EIO);
231 	}
232 
233 	len = uio->uio_resid;
234 	/*
235 	 * If there aren't enough bytes for a link level header or the
236 	 * packet length exceeds the interface mtu, return an error.
237 	 */
238 	if (len < hlen || len - hlen > mtu)
239 		return (EMSGSIZE);
240 
241 	/*
242 	 * XXX Avoid complicated buffer chaining ---
243 	 * bail if it won't fit in a single mbuf.
244 	 * (Take into account possible alignment bytes)
245 	 */
246 	if ((unsigned)len > MCLBYTES - align)
247 		return (EIO);
248 
249 	m = m_gethdr(M_WAIT, MT_DATA);
250 	m->m_pkthdr.rcvif = 0;
251 	m->m_pkthdr.len = len - hlen;
252 	if (len > MHLEN - align) {
253 		m_clget(m, M_WAIT);
254 		if ((m->m_flags & M_EXT) == 0) {
255 			error = ENOBUFS;
256 			goto bad;
257 		}
258 	}
259 
260 	/* Insure the data is properly aligned */
261 	if (align > 0) {
262 		m->m_data += align;
263 		m->m_len -= align;
264 	}
265 
266 	error = uiomove(mtod(m, void *), len, uio);
267 	if (error)
268 		goto bad;
269 	if (hlen != 0) {
270 		memcpy(sockp->sa_data, mtod(m, void *), hlen);
271 		m->m_data += hlen; /* XXX */
272 		len -= hlen;
273 	}
274 	m->m_len = len;
275 	*mp = m;
276 	return (0);
277 
278 bad:
279 	m_freem(m);
280 	return (error);
281 }
282 
283 /*
284  * Attach file to the bpf interface, i.e. make d listen on bp.
285  * Must be called at splnet.
286  */
287 static void
288 bpf_attachd(d, bp)
289 	struct bpf_d *d;
290 	struct bpf_if *bp;
291 {
292 	/*
293 	 * Point d at bp, and add d to the interface's list of listeners.
294 	 * Finally, point the driver's bpf cookie at the interface so
295 	 * it will divert packets to bpf.
296 	 */
297 	d->bd_bif = bp;
298 	d->bd_next = bp->bif_dlist;
299 	bp->bif_dlist = d;
300 
301 	*bp->bif_driverp = bp;
302 }
303 
304 /*
305  * Detach a file from its interface.
306  */
307 static void
308 bpf_detachd(d)
309 	struct bpf_d *d;
310 {
311 	struct bpf_d **p;
312 	struct bpf_if *bp;
313 
314 	bp = d->bd_bif;
315 	/*
316 	 * Check if this descriptor had requested promiscuous mode.
317 	 * If so, turn it off.
318 	 */
319 	if (d->bd_promisc) {
320 		int error;
321 
322 		d->bd_promisc = 0;
323 		/*
324 		 * Take device out of promiscuous mode.  Since we were
325 		 * able to enter promiscuous mode, we should be able
326 		 * to turn it off.  But we can get an error if
327 		 * the interface was configured down, so only panic
328 		 * if we don't get an unexpected error.
329 		 */
330   		error = ifpromisc(bp->bif_ifp, 0);
331 		if (error && error != EINVAL)
332 			panic("bpf: ifpromisc failed");
333 	}
334 	/* Remove d from the interface's descriptor list. */
335 	p = &bp->bif_dlist;
336 	while (*p != d) {
337 		p = &(*p)->bd_next;
338 		if (*p == 0)
339 			panic("bpf_detachd: descriptor not in list");
340 	}
341 	*p = (*p)->bd_next;
342 	if (bp->bif_dlist == 0)
343 		/*
344 		 * Let the driver know that there are no more listeners.
345 		 */
346 		*d->bd_bif->bif_driverp = 0;
347 	d->bd_bif = 0;
348 }
349 
350 
351 /*
352  * Mark a descriptor free by making it point to itself.
353  * This is probably cheaper than marking with a constant since
354  * the address should be in a register anyway.
355  */
356 
357 /*
358  * bpfilterattach() is called at boot time.
359  */
360 /* ARGSUSED */
361 void
362 bpfilterattach(n)
363 	int n;
364 {
365 	LIST_INIT(&bpf_list);
366 }
367 
368 /*
369  * Open ethernet device. Clones.
370  */
371 /* ARGSUSED */
372 int
373 bpfopen(dev, flag, mode, p)
374 	dev_t dev;
375 	int flag;
376 	int mode;
377 	struct proc *p;
378 {
379 	struct bpf_d *d;
380 	struct file *fp;
381 	int error, fd;
382 
383 	/* falloc() will use the descriptor for us. */
384 	if ((error = falloc(p, &fp, &fd)) != 0)
385 		return error;
386 
387 	d = malloc(sizeof(*d), M_DEVBUF, M_WAITOK);
388 	(void)memset(d, 0, sizeof(*d));
389 	d->bd_bufsize = bpf_bufsize;
390 	d->bd_seesent = 1;
391 	callout_init(&d->bd_callout);
392 
393 	LIST_INSERT_HEAD(&bpf_list, d, bd_list);
394 
395 	return fdclone(p, fp, fd, flag, &bpf_fileops, d);
396 }
397 
398 /*
399  * Close the descriptor by detaching it from its interface,
400  * deallocating its buffers, and marking it free.
401  */
402 /* ARGSUSED */
403 static int
404 bpf_close(struct file *fp, struct proc *p)
405 {
406 	struct bpf_d *d = fp->f_data;
407 	int s;
408 
409 	s = splnet();
410 	if (d->bd_state == BPF_WAITING)
411 		callout_stop(&d->bd_callout);
412 	d->bd_state = BPF_IDLE;
413 	if (d->bd_bif)
414 		bpf_detachd(d);
415 	splx(s);
416 	bpf_freed(d);
417 	LIST_REMOVE(d, bd_list);
418 	free(d, M_DEVBUF);
419 	fp->f_data = NULL;
420 
421 	return (0);
422 }
423 
424 /*
425  * Rotate the packet buffers in descriptor d.  Move the store buffer
426  * into the hold slot, and the free buffer into the store slot.
427  * Zero the length of the new store buffer.
428  */
429 #define ROTATE_BUFFERS(d) \
430 	(d)->bd_hbuf = (d)->bd_sbuf; \
431 	(d)->bd_hlen = (d)->bd_slen; \
432 	(d)->bd_sbuf = (d)->bd_fbuf; \
433 	(d)->bd_slen = 0; \
434 	(d)->bd_fbuf = 0;
435 /*
436  *  bpfread - read next chunk of packets from buffers
437  */
438 static int
439 bpf_read(struct file *fp, off_t *offp, struct uio *uio,
440     struct ucred *cred, int flags)
441 {
442 	struct bpf_d *d = fp->f_data;
443 	int timed_out;
444 	int error;
445 	int s;
446 
447 	/*
448 	 * Restrict application to use a buffer the same size as
449 	 * as kernel buffers.
450 	 */
451 	if (uio->uio_resid != d->bd_bufsize)
452 		return (EINVAL);
453 
454 	s = splnet();
455 	if (d->bd_state == BPF_WAITING)
456 		callout_stop(&d->bd_callout);
457 	timed_out = (d->bd_state == BPF_TIMED_OUT);
458 	d->bd_state = BPF_IDLE;
459 	/*
460 	 * If the hold buffer is empty, then do a timed sleep, which
461 	 * ends when the timeout expires or when enough packets
462 	 * have arrived to fill the store buffer.
463 	 */
464 	while (d->bd_hbuf == 0) {
465 		if (fp->f_flag & FNONBLOCK) {
466 			if (d->bd_slen == 0) {
467 				splx(s);
468 				return (EWOULDBLOCK);
469 			}
470 			ROTATE_BUFFERS(d);
471 			break;
472 		}
473 
474 		if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
475 			/*
476 			 * A packet(s) either arrived since the previous
477 			 * read or arrived while we were asleep.
478 			 * Rotate the buffers and return what's here.
479 			 */
480 			ROTATE_BUFFERS(d);
481 			break;
482 		}
483 		error = tsleep(d, PRINET|PCATCH, "bpf",
484 				d->bd_rtout);
485 		if (error == EINTR || error == ERESTART) {
486 			splx(s);
487 			return (error);
488 		}
489 		if (error == EWOULDBLOCK) {
490 			/*
491 			 * On a timeout, return what's in the buffer,
492 			 * which may be nothing.  If there is something
493 			 * in the store buffer, we can rotate the buffers.
494 			 */
495 			if (d->bd_hbuf)
496 				/*
497 				 * We filled up the buffer in between
498 				 * getting the timeout and arriving
499 				 * here, so we don't need to rotate.
500 				 */
501 				break;
502 
503 			if (d->bd_slen == 0) {
504 				splx(s);
505 				return (0);
506 			}
507 			ROTATE_BUFFERS(d);
508 			break;
509 		}
510 		if (error != 0)
511 			goto done;
512 	}
513 	/*
514 	 * At this point, we know we have something in the hold slot.
515 	 */
516 	splx(s);
517 
518 	/*
519 	 * Move data from hold buffer into user space.
520 	 * We know the entire buffer is transferred since
521 	 * we checked above that the read buffer is bpf_bufsize bytes.
522 	 */
523 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
524 
525 	s = splnet();
526 	d->bd_fbuf = d->bd_hbuf;
527 	d->bd_hbuf = 0;
528 	d->bd_hlen = 0;
529 done:
530 	splx(s);
531 	return (error);
532 }
533 
534 
535 /*
536  * If there are processes sleeping on this descriptor, wake them up.
537  */
538 static __inline void
539 bpf_wakeup(d)
540 	struct bpf_d *d;
541 {
542 	wakeup(d);
543 	if (d->bd_async)
544 		fownsignal(d->bd_pgid, SIGIO, 0, 0, NULL);
545 
546 	selnotify(&d->bd_sel, 0);
547 	/* XXX */
548 	d->bd_sel.sel_pid = 0;
549 }
550 
551 
552 static void
553 bpf_timed_out(arg)
554 	void *arg;
555 {
556 	struct bpf_d *d = arg;
557 	int s;
558 
559 	s = splnet();
560 	if (d->bd_state == BPF_WAITING) {
561 		d->bd_state = BPF_TIMED_OUT;
562 		if (d->bd_slen != 0)
563 			bpf_wakeup(d);
564 	}
565 	splx(s);
566 }
567 
568 
569 static int
570 bpf_write(struct file *fp, off_t *offp, struct uio *uio,
571     struct ucred *cred, int flags)
572 {
573 	struct bpf_d *d = fp->f_data;
574 	struct ifnet *ifp;
575 	struct mbuf *m;
576 	int error, s;
577 	static struct sockaddr_storage dst;
578 
579 	if (d->bd_bif == 0)
580 		return (ENXIO);
581 
582 	ifp = d->bd_bif->bif_ifp;
583 
584 	if (uio->uio_resid == 0)
585 		return (0);
586 
587 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp->if_mtu, &m,
588 		(struct sockaddr *) &dst);
589 	if (error)
590 		return (error);
591 
592 	if (m->m_pkthdr.len > ifp->if_mtu) {
593 		m_freem(m);
594 		return (EMSGSIZE);
595 	}
596 
597 	if (d->bd_hdrcmplt)
598 		dst.ss_family = pseudo_AF_HDRCMPLT;
599 
600 	s = splsoftnet();
601 	error = (*ifp->if_output)(ifp, m, (struct sockaddr *) &dst, NULL);
602 	splx(s);
603 	/*
604 	 * The driver frees the mbuf.
605 	 */
606 	return (error);
607 }
608 
609 /*
610  * Reset a descriptor by flushing its packet buffer and clearing the
611  * receive and drop counts.  Should be called at splnet.
612  */
613 static void
614 reset_d(d)
615 	struct bpf_d *d;
616 {
617 	if (d->bd_hbuf) {
618 		/* Free the hold buffer. */
619 		d->bd_fbuf = d->bd_hbuf;
620 		d->bd_hbuf = 0;
621 	}
622 	d->bd_slen = 0;
623 	d->bd_hlen = 0;
624 	d->bd_rcount = 0;
625 	d->bd_dcount = 0;
626 	d->bd_ccount = 0;
627 }
628 
629 #ifdef BPF_KERN_FILTER
630 extern struct bpf_insn *bpf_tcp_filter;
631 extern struct bpf_insn *bpf_udp_filter;
632 #endif
633 
634 /*
635  *  FIONREAD		Check for read packet available.
636  *  BIOCGBLEN		Get buffer len [for read()].
637  *  BIOCSETF		Set ethernet read filter.
638  *  BIOCFLUSH		Flush read packet buffer.
639  *  BIOCPROMISC		Put interface into promiscuous mode.
640  *  BIOCGDLT		Get link layer type.
641  *  BIOCGETIF		Get interface name.
642  *  BIOCSETIF		Set interface.
643  *  BIOCSRTIMEOUT	Set read timeout.
644  *  BIOCGRTIMEOUT	Get read timeout.
645  *  BIOCGSTATS		Get packet stats.
646  *  BIOCIMMEDIATE	Set immediate mode.
647  *  BIOCVERSION		Get filter language version.
648  *  BIOGHDRCMPLT	Get "header already complete" flag.
649  *  BIOSHDRCMPLT	Set "header already complete" flag.
650  */
651 /* ARGSUSED */
652 static int
653 bpf_ioctl(struct file *fp, u_long cmd, void *addr, struct proc *p)
654 {
655 	struct bpf_d *d = fp->f_data;
656 	int s, error = 0;
657 #ifdef BPF_KERN_FILTER
658 	struct bpf_insn **p;
659 #endif
660 
661 	s = splnet();
662 	if (d->bd_state == BPF_WAITING)
663 		callout_stop(&d->bd_callout);
664 	d->bd_state = BPF_IDLE;
665 	splx(s);
666 
667 	switch (cmd) {
668 
669 	default:
670 		error = EINVAL;
671 		break;
672 
673 	/*
674 	 * Check for read packet available.
675 	 */
676 	case FIONREAD:
677 		{
678 			int n;
679 
680 			s = splnet();
681 			n = d->bd_slen;
682 			if (d->bd_hbuf)
683 				n += d->bd_hlen;
684 			splx(s);
685 
686 			*(int *)addr = n;
687 			break;
688 		}
689 
690 	/*
691 	 * Get buffer len [for read()].
692 	 */
693 	case BIOCGBLEN:
694 		*(u_int *)addr = d->bd_bufsize;
695 		break;
696 
697 	/*
698 	 * Set buffer length.
699 	 */
700 	case BIOCSBLEN:
701 		if (d->bd_bif != 0)
702 			error = EINVAL;
703 		else {
704 			u_int size = *(u_int *)addr;
705 
706 			if (size > bpf_maxbufsize)
707 				*(u_int *)addr = size = bpf_maxbufsize;
708 			else if (size < BPF_MINBUFSIZE)
709 				*(u_int *)addr = size = BPF_MINBUFSIZE;
710 			d->bd_bufsize = size;
711 		}
712 		break;
713 
714 	/*
715 	 * Set link layer read filter.
716 	 */
717 	case BIOCSETF:
718 		error = bpf_setf(d, addr);
719 		break;
720 
721 #ifdef BPF_KERN_FILTER
722 	/*
723 	 * Set TCP or UDP reject filter.
724 	 */
725 	case BIOCSTCPF:
726 	case BIOCSUDPF:
727 		if (!suser()) {
728 			error = EPERM;
729 			break;
730 		}
731 
732 		/* Validate and store filter */
733 		error = bpf_setf(d, addr);
734 
735 		/* Free possible old filter */
736 		if (cmd == BIOCSTCPF)
737 			p = &bpf_tcp_filter;
738 		else
739 			p = &bpf_udp_filter;
740 		if (*p != NULL)
741 			free(*p, M_DEVBUF);
742 
743 		/* Steal new filter (noop if error) */
744 		s = splnet();
745 		*p = d->bd_filter;
746 		d->bd_filter = NULL;
747 		splx(s);
748 		break;
749 #endif
750 
751 	/*
752 	 * Flush read packet buffer.
753 	 */
754 	case BIOCFLUSH:
755 		s = splnet();
756 		reset_d(d);
757 		splx(s);
758 		break;
759 
760 	/*
761 	 * Put interface into promiscuous mode.
762 	 */
763 	case BIOCPROMISC:
764 		if (d->bd_bif == 0) {
765 			/*
766 			 * No interface attached yet.
767 			 */
768 			error = EINVAL;
769 			break;
770 		}
771 		s = splnet();
772 		if (d->bd_promisc == 0) {
773 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
774 			if (error == 0)
775 				d->bd_promisc = 1;
776 		}
777 		splx(s);
778 		break;
779 
780 	/*
781 	 * Get device parameters.
782 	 */
783 	case BIOCGDLT:
784 		if (d->bd_bif == 0)
785 			error = EINVAL;
786 		else
787 			*(u_int *)addr = d->bd_bif->bif_dlt;
788 		break;
789 
790 	/*
791 	 * Get a list of supported device parameters.
792 	 */
793 	case BIOCGDLTLIST:
794 		if (d->bd_bif == 0)
795 			error = EINVAL;
796 		else
797 			error = bpf_getdltlist(d, addr);
798 		break;
799 
800 	/*
801 	 * Set device parameters.
802 	 */
803 	case BIOCSDLT:
804 		if (d->bd_bif == 0)
805 			error = EINVAL;
806 		else
807 			error = bpf_setdlt(d, *(u_int *)addr);
808 		break;
809 
810 	/*
811 	 * Set interface name.
812 	 */
813 	case BIOCGETIF:
814 		if (d->bd_bif == 0)
815 			error = EINVAL;
816 		else
817 			bpf_ifname(d->bd_bif->bif_ifp, addr);
818 		break;
819 
820 	/*
821 	 * Set interface.
822 	 */
823 	case BIOCSETIF:
824 		error = bpf_setif(d, addr);
825 		break;
826 
827 	/*
828 	 * Set read timeout.
829 	 */
830 	case BIOCSRTIMEOUT:
831 		{
832 			struct timeval *tv = addr;
833 
834 			/* Compute number of ticks. */
835 			d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
836 			if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
837 				d->bd_rtout = 1;
838 			break;
839 		}
840 
841 	/*
842 	 * Get read timeout.
843 	 */
844 	case BIOCGRTIMEOUT:
845 		{
846 			struct timeval *tv = addr;
847 
848 			tv->tv_sec = d->bd_rtout / hz;
849 			tv->tv_usec = (d->bd_rtout % hz) * tick;
850 			break;
851 		}
852 
853 	/*
854 	 * Get packet stats.
855 	 */
856 	case BIOCGSTATS:
857 		{
858 			struct bpf_stat *bs = addr;
859 
860 			bs->bs_recv = d->bd_rcount;
861 			bs->bs_drop = d->bd_dcount;
862 			bs->bs_capt = d->bd_ccount;
863 			break;
864 		}
865 
866 	case BIOCGSTATSOLD:
867 		{
868 			struct bpf_stat_old *bs = addr;
869 
870 			bs->bs_recv = d->bd_rcount;
871 			bs->bs_drop = d->bd_dcount;
872 			break;
873 		}
874 
875 	/*
876 	 * Set immediate mode.
877 	 */
878 	case BIOCIMMEDIATE:
879 		d->bd_immediate = *(u_int *)addr;
880 		break;
881 
882 	case BIOCVERSION:
883 		{
884 			struct bpf_version *bv = addr;
885 
886 			bv->bv_major = BPF_MAJOR_VERSION;
887 			bv->bv_minor = BPF_MINOR_VERSION;
888 			break;
889 		}
890 
891 	case BIOCGHDRCMPLT:	/* get "header already complete" flag */
892 		*(u_int *)addr = d->bd_hdrcmplt;
893 		break;
894 
895 	case BIOCSHDRCMPLT:	/* set "header already complete" flag */
896 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
897 		break;
898 
899 	/*
900 	 * Get "see sent packets" flag
901 	 */
902 	case BIOCGSEESENT:
903 		*(u_int *)addr = d->bd_seesent;
904 		break;
905 
906 	/*
907 	 * Set "see sent" packets flag
908 	 */
909 	case BIOCSSEESENT:
910 		d->bd_seesent = *(u_int *)addr;
911 		break;
912 
913 	case FIONBIO:		/* Non-blocking I/O */
914 		/*
915 		 * No need to do anything special as we use IO_NDELAY in
916 		 * bpfread() as an indication of whether or not to block
917 		 * the read.
918 		 */
919 		break;
920 
921 	case FIOASYNC:		/* Send signal on receive packets */
922 		d->bd_async = *(int *)addr;
923 		break;
924 
925 	case TIOCSPGRP:		/* Process or group to send signals to */
926 	case FIOSETOWN:
927 		error = fsetown(p, &d->bd_pgid, cmd, addr);
928 		break;
929 
930 	case TIOCGPGRP:
931 	case FIOGETOWN:
932 		error = fgetown(p, d->bd_pgid, cmd, addr);
933 		break;
934 	}
935 	return (error);
936 }
937 
938 /*
939  * Set d's packet filter program to fp.  If this file already has a filter,
940  * free it and replace it.  Returns EINVAL for bogus requests.
941  */
942 int
943 bpf_setf(struct bpf_d *d, struct bpf_program *fp)
944 {
945 	struct bpf_insn *fcode, *old;
946 	u_int flen, size;
947 	int s;
948 
949 	old = d->bd_filter;
950 	if (fp->bf_insns == 0) {
951 		if (fp->bf_len != 0)
952 			return (EINVAL);
953 		s = splnet();
954 		d->bd_filter = 0;
955 		reset_d(d);
956 		splx(s);
957 		if (old != 0)
958 			free(old, M_DEVBUF);
959 		return (0);
960 	}
961 	flen = fp->bf_len;
962 	if (flen > BPF_MAXINSNS)
963 		return (EINVAL);
964 
965 	size = flen * sizeof(*fp->bf_insns);
966 	fcode = malloc(size, M_DEVBUF, M_WAITOK);
967 	if (copyin(fp->bf_insns, fcode, size) == 0 &&
968 	    bpf_validate(fcode, (int)flen)) {
969 		s = splnet();
970 		d->bd_filter = fcode;
971 		reset_d(d);
972 		splx(s);
973 		if (old != 0)
974 			free(old, M_DEVBUF);
975 
976 		return (0);
977 	}
978 	free(fcode, M_DEVBUF);
979 	return (EINVAL);
980 }
981 
982 /*
983  * Detach a file from its current interface (if attached at all) and attach
984  * to the interface indicated by the name stored in ifr.
985  * Return an errno or 0.
986  */
987 static int
988 bpf_setif(struct bpf_d *d, struct ifreq *ifr)
989 {
990 	struct bpf_if *bp;
991 	char *cp;
992 	int unit_seen, i, s, error;
993 
994 	/*
995 	 * Make sure the provided name has a unit number, and default
996 	 * it to '0' if not specified.
997 	 * XXX This is ugly ... do this differently?
998 	 */
999 	unit_seen = 0;
1000 	cp = ifr->ifr_name;
1001 	cp[sizeof(ifr->ifr_name) - 1] = '\0';	/* sanity */
1002 	while (*cp++)
1003 		if (*cp >= '0' && *cp <= '9')
1004 			unit_seen = 1;
1005 	if (!unit_seen) {
1006 		/* Make sure to leave room for the '\0'. */
1007 		for (i = 0; i < (IFNAMSIZ - 1); ++i) {
1008 			if ((ifr->ifr_name[i] >= 'a' &&
1009 			     ifr->ifr_name[i] <= 'z') ||
1010 			    (ifr->ifr_name[i] >= 'A' &&
1011 			     ifr->ifr_name[i] <= 'Z'))
1012 				continue;
1013 			ifr->ifr_name[i] = '0';
1014 		}
1015 	}
1016 
1017 	/*
1018 	 * Look through attached interfaces for the named one.
1019 	 */
1020 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
1021 		struct ifnet *ifp = bp->bif_ifp;
1022 
1023 		if (ifp == 0 ||
1024 		    strcmp(ifp->if_xname, ifr->ifr_name) != 0)
1025 			continue;
1026 		/* skip additional entry */
1027 		if (bp->bif_driverp != (struct bpf_if **)&ifp->if_bpf)
1028 			continue;
1029 		/*
1030 		 * We found the requested interface.
1031 		 * Allocate the packet buffers if we need to.
1032 		 * If we're already attached to requested interface,
1033 		 * just flush the buffer.
1034 		 */
1035 		if (d->bd_sbuf == 0) {
1036 			error = bpf_allocbufs(d);
1037 			if (error != 0)
1038 				return (error);
1039 		}
1040 		s = splnet();
1041 		if (bp != d->bd_bif) {
1042 			if (d->bd_bif)
1043 				/*
1044 				 * Detach if attached to something else.
1045 				 */
1046 				bpf_detachd(d);
1047 
1048 			bpf_attachd(d, bp);
1049 		}
1050 		reset_d(d);
1051 		splx(s);
1052 		return (0);
1053 	}
1054 	/* Not found. */
1055 	return (ENXIO);
1056 }
1057 
1058 /*
1059  * Copy the interface name to the ifreq.
1060  */
1061 static void
1062 bpf_ifname(struct ifnet *ifp, struct ifreq *ifr)
1063 {
1064 	memcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
1065 }
1066 
1067 /*
1068  * Support for poll() system call
1069  *
1070  * Return true iff the specific operation will not block indefinitely - with
1071  * the assumption that it is safe to positively acknowledge a request for the
1072  * ability to write to the BPF device.
1073  * Otherwise, return false but make a note that a selwakeup() must be done.
1074  */
1075 static int
1076 bpf_poll(struct file *fp, int events, struct proc *p)
1077 {
1078 	struct bpf_d *d = fp->f_data;
1079 	int s = splnet();
1080 	int revents;
1081 
1082 	revents = events & (POLLOUT | POLLWRNORM);
1083 	if (events & (POLLIN | POLLRDNORM)) {
1084 		/*
1085 		 * An imitation of the FIONREAD ioctl code.
1086 		 */
1087 		if ((d->bd_hlen != 0) ||
1088 		    (d->bd_immediate && d->bd_slen != 0)) {
1089 			revents |= events & (POLLIN | POLLRDNORM);
1090 		} else if (d->bd_state == BPF_TIMED_OUT) {
1091 			if (d->bd_slen != 0)
1092 				revents |= events & (POLLIN | POLLRDNORM);
1093 			else
1094 				revents |= events & POLLIN;
1095 		} else {
1096 			selrecord(p, &d->bd_sel);
1097 			/* Start the read timeout if necessary */
1098 			if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1099 				callout_reset(&d->bd_callout, d->bd_rtout,
1100 					      bpf_timed_out, d);
1101 				d->bd_state = BPF_WAITING;
1102 			}
1103 		}
1104 	}
1105 
1106 	splx(s);
1107 	return (revents);
1108 }
1109 
1110 static void
1111 filt_bpfrdetach(struct knote *kn)
1112 {
1113 	struct bpf_d *d = kn->kn_hook;
1114 	int s;
1115 
1116 	s = splnet();
1117 	SLIST_REMOVE(&d->bd_sel.sel_klist, kn, knote, kn_selnext);
1118 	splx(s);
1119 }
1120 
1121 static int
1122 filt_bpfread(struct knote *kn, long hint)
1123 {
1124 	struct bpf_d *d = kn->kn_hook;
1125 
1126 	kn->kn_data = d->bd_hlen;
1127 	if (d->bd_immediate)
1128 		kn->kn_data += d->bd_slen;
1129 	return (kn->kn_data > 0);
1130 }
1131 
1132 static const struct filterops bpfread_filtops =
1133 	{ 1, NULL, filt_bpfrdetach, filt_bpfread };
1134 
1135 static int
1136 bpf_kqfilter(struct file *fp, struct knote *kn)
1137 {
1138 	struct bpf_d *d = fp->f_data;
1139 	struct klist *klist;
1140 	int s;
1141 
1142 	switch (kn->kn_filter) {
1143 	case EVFILT_READ:
1144 		klist = &d->bd_sel.sel_klist;
1145 		kn->kn_fop = &bpfread_filtops;
1146 		break;
1147 
1148 	default:
1149 		return (1);
1150 	}
1151 
1152 	kn->kn_hook = d;
1153 
1154 	s = splnet();
1155 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1156 	splx(s);
1157 
1158 	return (0);
1159 }
1160 
1161 /*
1162  * Incoming linkage from device drivers.  Process the packet pkt, of length
1163  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1164  * by each process' filter, and if accepted, stashed into the corresponding
1165  * buffer.
1166  */
1167 void
1168 bpf_tap(void *arg, u_char *pkt, u_int pktlen)
1169 {
1170 	struct bpf_if *bp;
1171 	struct bpf_d *d;
1172 	u_int slen;
1173 	/*
1174 	 * Note that the ipl does not have to be raised at this point.
1175 	 * The only problem that could arise here is that if two different
1176 	 * interfaces shared any data.  This is not the case.
1177 	 */
1178 	bp = arg;
1179 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1180 		++d->bd_rcount;
1181 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
1182 		if (slen != 0)
1183 			catchpacket(d, pkt, pktlen, slen, memcpy);
1184 	}
1185 }
1186 
1187 /*
1188  * Copy data from an mbuf chain into a buffer.  This code is derived
1189  * from m_copydata in sys/uipc_mbuf.c.
1190  */
1191 static void *
1192 bpf_mcpy(void *dst_arg, const void *src_arg, size_t len)
1193 {
1194 	const struct mbuf *m;
1195 	u_int count;
1196 	u_char *dst;
1197 
1198 	m = src_arg;
1199 	dst = dst_arg;
1200 	while (len > 0) {
1201 		if (m == 0)
1202 			panic("bpf_mcpy");
1203 		count = min(m->m_len, len);
1204 		memcpy(dst, mtod(m, void *), count);
1205 		m = m->m_next;
1206 		dst += count;
1207 		len -= count;
1208 	}
1209 	return (dst_arg);
1210 }
1211 
1212 /*
1213  * Dispatch a packet to all the listeners on interface bp.
1214  *
1215  * marg    pointer to the packet, either a data buffer or an mbuf chain
1216  * buflen  buffer length, if marg is a data buffer
1217  * cpfn    a function that can copy marg into the listener's buffer
1218  * pktlen  length of the packet
1219  * rcvif   either NULL or the interface the packet came in on.
1220  */
1221 static __inline void
1222 bpf_deliver(struct bpf_if *bp, void *(*cpfn)(void *, const void *, size_t),
1223     void *marg, u_int pktlen, u_int buflen, struct ifnet *rcvif)
1224 {
1225 	u_int slen;
1226 	struct bpf_d *d;
1227 
1228 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1229 		if (!d->bd_seesent && (rcvif == NULL))
1230 			continue;
1231 		++d->bd_rcount;
1232 		slen = bpf_filter(d->bd_filter, marg, pktlen, buflen);
1233 		if (slen != 0)
1234 			catchpacket(d, marg, pktlen, slen, cpfn);
1235 	}
1236 }
1237 
1238 /*
1239  * Incoming linkage from device drivers, when the head of the packet is in
1240  * a buffer, and the tail is in an mbuf chain.
1241  */
1242 void
1243 bpf_mtap2(void *arg, void *data, u_int dlen, struct mbuf *m)
1244 {
1245 	struct bpf_if *bp = arg;
1246 	u_int pktlen;
1247 	struct mbuf mb;
1248 
1249 	pktlen = m_length(m) + dlen;
1250 
1251 	/*
1252 	 * Craft on-stack mbuf suitable for passing to bpf_filter.
1253 	 * Note that we cut corners here; we only setup what's
1254 	 * absolutely needed--this mbuf should never go anywhere else.
1255 	 */
1256 	(void)memset(&mb, 0, sizeof(mb));
1257 	mb.m_next = m;
1258 	mb.m_data = data;
1259 	mb.m_len = dlen;
1260 
1261 	bpf_deliver(bp, bpf_mcpy, &mb, pktlen, 0, m->m_pkthdr.rcvif);
1262 }
1263 
1264 /*
1265  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1266  */
1267 void
1268 bpf_mtap(void *arg, struct mbuf *m)
1269 {
1270 	void *(*cpfn)(void *, const void *, size_t);
1271 	struct bpf_if *bp = arg;
1272 	u_int pktlen, buflen;
1273 	void *marg;
1274 
1275 	pktlen = m_length(m);
1276 
1277 	if (pktlen == m->m_len) {
1278 		cpfn = memcpy;
1279 		marg = mtod(m, void *);
1280 		buflen = pktlen;
1281 	} else {
1282 		cpfn = bpf_mcpy;
1283 		marg = m;
1284 		buflen = 0;
1285 	}
1286 
1287 	bpf_deliver(bp, cpfn, marg, pktlen, buflen, m->m_pkthdr.rcvif);
1288 }
1289 
1290 /*
1291  * We need to prepend the address family as
1292  * a four byte field.  Cons up a dummy header
1293  * to pacify bpf.  This is safe because bpf
1294  * will only read from the mbuf (i.e., it won't
1295  * try to free it or keep a pointer a to it).
1296  */
1297 void
1298 bpf_mtap_af(void *arg, u_int32_t af, struct mbuf *m)
1299 {
1300 	struct mbuf m0;
1301 
1302 	m0.m_flags = 0;
1303 	m0.m_next = m;
1304 	m0.m_len = 4;
1305 	m0.m_data = (char *)&af;
1306 
1307 	bpf_mtap(arg, &m0);
1308 }
1309 
1310 void
1311 bpf_mtap_et(void *arg, u_int16_t et, struct mbuf *m)
1312 {
1313 	struct mbuf m0;
1314 
1315 	m0.m_flags = 0;
1316 	m0.m_next = m;
1317 	m0.m_len = 14;
1318 	m0.m_data = m0.m_dat;
1319 
1320 	((u_int32_t *)m0.m_data)[0] = 0;
1321 	((u_int32_t *)m0.m_data)[1] = 0;
1322 	((u_int32_t *)m0.m_data)[2] = 0;
1323 	((u_int16_t *)m0.m_data)[6] = et;
1324 
1325 	bpf_mtap(arg, &m0);
1326 }
1327 
1328 #if NSL > 0 || NSTRIP > 0
1329 /*
1330  * Put the SLIP pseudo-"link header" in place.
1331  * Note this M_PREPEND() should never fail,
1332  * swince we know we always have enough space
1333  * in the input buffer.
1334  */
1335 void
1336 bpf_mtap_sl_in(void *arg, u_char *chdr, struct mbuf **m)
1337 {
1338 	int s;
1339 	u_char *hp;
1340 
1341 	M_PREPEND(*m, SLIP_HDRLEN, M_DONTWAIT);
1342 	if (*m == NULL)
1343 		return;
1344 
1345 	hp = mtod(*m, u_char *);
1346 	hp[SLX_DIR] = SLIPDIR_IN;
1347 	(void)memcpy(&hp[SLX_CHDR], chdr, CHDR_LEN);
1348 
1349 	s = splnet();
1350 	bpf_mtap(arg, *m);
1351 	splx(s);
1352 
1353 	m_adj(*m, SLIP_HDRLEN);
1354 }
1355 
1356 /*
1357  * Put the SLIP pseudo-"link header" in
1358  * place.  The compressed header is now
1359  * at the beginning of the mbuf.
1360  */
1361 void
1362 bpf_mtap_sl_out(void *arg, u_char *chdr, struct mbuf *m)
1363 {
1364 	struct mbuf m0;
1365 	u_char *hp;
1366 	int s;
1367 
1368 	m0.m_flags = 0;
1369 	m0.m_next = m;
1370 	m0.m_data = m0.m_dat;
1371 	m0.m_len = SLIP_HDRLEN;
1372 
1373 	hp = mtod(&m0, u_char *);
1374 
1375 	hp[SLX_DIR] = SLIPDIR_OUT;
1376 	(void)memcpy(&hp[SLX_CHDR], chdr, CHDR_LEN);
1377 
1378 	s = splnet();
1379 	bpf_mtap(arg, &m0);
1380 	splx(s);
1381 	m_freem(m);
1382 }
1383 #endif
1384 
1385 /*
1386  * Move the packet data from interface memory (pkt) into the
1387  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1388  * otherwise 0.  "copy" is the routine called to do the actual data
1389  * transfer.  memcpy is passed in to copy contiguous chunks, while
1390  * bpf_mcpy is passed in to copy mbuf chains.  In the latter case,
1391  * pkt is really an mbuf.
1392  */
1393 static void
1394 catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
1395     void *(*cpfn)(void *, const void *, size_t))
1396 {
1397 	struct bpf_hdr *hp;
1398 	int totlen, curlen;
1399 	int hdrlen = d->bd_bif->bif_hdrlen;
1400 
1401 	++d->bd_ccount;
1402 	/*
1403 	 * Figure out how many bytes to move.  If the packet is
1404 	 * greater or equal to the snapshot length, transfer that
1405 	 * much.  Otherwise, transfer the whole packet (unless
1406 	 * we hit the buffer size limit).
1407 	 */
1408 	totlen = hdrlen + min(snaplen, pktlen);
1409 	if (totlen > d->bd_bufsize)
1410 		totlen = d->bd_bufsize;
1411 
1412 	/*
1413 	 * Round up the end of the previous packet to the next longword.
1414 	 */
1415 	curlen = BPF_WORDALIGN(d->bd_slen);
1416 	if (curlen + totlen > d->bd_bufsize) {
1417 		/*
1418 		 * This packet will overflow the storage buffer.
1419 		 * Rotate the buffers if we can, then wakeup any
1420 		 * pending reads.
1421 		 */
1422 		if (d->bd_fbuf == 0) {
1423 			/*
1424 			 * We haven't completed the previous read yet,
1425 			 * so drop the packet.
1426 			 */
1427 			++d->bd_dcount;
1428 			return;
1429 		}
1430 		ROTATE_BUFFERS(d);
1431 		bpf_wakeup(d);
1432 		curlen = 0;
1433 	}
1434 
1435 	/*
1436 	 * Append the bpf header.
1437 	 */
1438 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1439 	microtime(&hp->bh_tstamp);
1440 	hp->bh_datalen = pktlen;
1441 	hp->bh_hdrlen = hdrlen;
1442 	/*
1443 	 * Copy the packet data into the store buffer and update its length.
1444 	 */
1445 	(*cpfn)((u_char *)hp + hdrlen, pkt, (hp->bh_caplen = totlen - hdrlen));
1446 	d->bd_slen = curlen + totlen;
1447 
1448 	/*
1449 	 * Call bpf_wakeup after bd_slen has been updated so that kevent(2)
1450 	 * will cause filt_bpfread() to be called with it adjusted.
1451 	 */
1452 	if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1453 		/*
1454 		 * Immediate mode is set, or the read timeout has
1455 		 * already expired during a select call.  A packet
1456 		 * arrived, so the reader should be woken up.
1457 		 */
1458 		bpf_wakeup(d);
1459 }
1460 
1461 /*
1462  * Initialize all nonzero fields of a descriptor.
1463  */
1464 static int
1465 bpf_allocbufs(struct bpf_d *d)
1466 {
1467 
1468 	d->bd_fbuf = malloc(d->bd_bufsize, M_DEVBUF, M_NOWAIT);
1469 	if (!d->bd_fbuf)
1470 		return (ENOBUFS);
1471 	d->bd_sbuf = malloc(d->bd_bufsize, M_DEVBUF, M_NOWAIT);
1472 	if (!d->bd_sbuf) {
1473 		free(d->bd_fbuf, M_DEVBUF);
1474 		return (ENOBUFS);
1475 	}
1476 	d->bd_slen = 0;
1477 	d->bd_hlen = 0;
1478 	return (0);
1479 }
1480 
1481 /*
1482  * Free buffers currently in use by a descriptor.
1483  * Called on close.
1484  */
1485 static void
1486 bpf_freed(struct bpf_d *d)
1487 {
1488 	/*
1489 	 * We don't need to lock out interrupts since this descriptor has
1490 	 * been detached from its interface and it yet hasn't been marked
1491 	 * free.
1492 	 */
1493 	if (d->bd_sbuf != 0) {
1494 		free(d->bd_sbuf, M_DEVBUF);
1495 		if (d->bd_hbuf != 0)
1496 			free(d->bd_hbuf, M_DEVBUF);
1497 		if (d->bd_fbuf != 0)
1498 			free(d->bd_fbuf, M_DEVBUF);
1499 	}
1500 	if (d->bd_filter)
1501 		free(d->bd_filter, M_DEVBUF);
1502 }
1503 
1504 /*
1505  * Attach an interface to bpf.  dlt is the link layer type; hdrlen is the
1506  * fixed size of the link header (variable length headers not yet supported).
1507  */
1508 void
1509 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
1510 {
1511 
1512 	bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1513 }
1514 
1515 /*
1516  * Attach additional dlt for a interface to bpf.  dlt is the link layer type;
1517  * hdrlen is the fixed size of the link header for the specified dlt
1518  * (variable length headers not yet supported).
1519  */
1520 void
1521 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, void *driverp)
1522 {
1523 	struct bpf_if *bp;
1524 	bp = malloc(sizeof(*bp), M_DEVBUF, M_DONTWAIT);
1525 	if (bp == 0)
1526 		panic("bpfattach");
1527 
1528 	bp->bif_dlist = 0;
1529 	bp->bif_driverp = driverp;
1530 	bp->bif_ifp = ifp;
1531 	bp->bif_dlt = dlt;
1532 
1533 	bp->bif_next = bpf_iflist;
1534 	bpf_iflist = bp;
1535 
1536 	*bp->bif_driverp = 0;
1537 
1538 	/*
1539 	 * Compute the length of the bpf header.  This is not necessarily
1540 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1541 	 * that the network layer header begins on a longword boundary (for
1542 	 * performance reasons and to alleviate alignment restrictions).
1543 	 */
1544 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1545 
1546 #if 0
1547 	printf("bpf: %s attached\n", ifp->if_xname);
1548 #endif
1549 }
1550 
1551 /*
1552  * Remove an interface from bpf.
1553  */
1554 void
1555 bpfdetach(struct ifnet *ifp)
1556 {
1557 	struct bpf_if *bp, **pbp;
1558 	struct bpf_d *d;
1559 	int s;
1560 
1561 	/* Nuke the vnodes for any open instances */
1562 	for (d = LIST_FIRST(&bpf_list); d != NULL; d = LIST_NEXT(d, bd_list)) {
1563 		if (d->bd_bif != NULL && d->bd_bif->bif_ifp == ifp) {
1564 			/*
1565 			 * Detach the descriptor from an interface now.
1566 			 * It will be free'ed later by close routine.
1567 			 */
1568 			s = splnet();
1569 			d->bd_promisc = 0;	/* we can't touch device. */
1570 			bpf_detachd(d);
1571 			splx(s);
1572 		}
1573 	}
1574 
1575   again:
1576 	for (bp = bpf_iflist, pbp = &bpf_iflist;
1577 	     bp != NULL; pbp = &bp->bif_next, bp = bp->bif_next) {
1578 		if (bp->bif_ifp == ifp) {
1579 			*pbp = bp->bif_next;
1580 			free(bp, M_DEVBUF);
1581 			goto again;
1582 		}
1583 	}
1584 }
1585 
1586 /*
1587  * Change the data link type of a interface.
1588  */
1589 void
1590 bpf_change_type(struct ifnet *ifp, u_int dlt, u_int hdrlen)
1591 {
1592 	struct bpf_if *bp;
1593 
1594 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1595 		if (bp->bif_driverp == (struct bpf_if **)&ifp->if_bpf)
1596 			break;
1597 	}
1598 	if (bp == NULL)
1599 		panic("bpf_change_type");
1600 
1601 	bp->bif_dlt = dlt;
1602 
1603 	/*
1604 	 * Compute the length of the bpf header.  This is not necessarily
1605 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1606 	 * that the network layer header begins on a longword boundary (for
1607 	 * performance reasons and to alleviate alignment restrictions).
1608 	 */
1609 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1610 }
1611 
1612 /*
1613  * Get a list of available data link type of the interface.
1614  */
1615 static int
1616 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl)
1617 {
1618 	int n, error;
1619 	struct ifnet *ifp;
1620 	struct bpf_if *bp;
1621 
1622 	ifp = d->bd_bif->bif_ifp;
1623 	n = 0;
1624 	error = 0;
1625 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1626 		if (bp->bif_ifp != ifp)
1627 			continue;
1628 		if (bfl->bfl_list != NULL) {
1629 			if (n >= bfl->bfl_len)
1630 				return ENOMEM;
1631 			error = copyout(&bp->bif_dlt,
1632 			    bfl->bfl_list + n, sizeof(u_int));
1633 		}
1634 		n++;
1635 	}
1636 	bfl->bfl_len = n;
1637 	return error;
1638 }
1639 
1640 /*
1641  * Set the data link type of a BPF instance.
1642  */
1643 static int
1644 bpf_setdlt(struct bpf_d *d, u_int dlt)
1645 {
1646 	int s, error, opromisc;
1647 	struct ifnet *ifp;
1648 	struct bpf_if *bp;
1649 
1650 	if (d->bd_bif->bif_dlt == dlt)
1651 		return 0;
1652 	ifp = d->bd_bif->bif_ifp;
1653 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1654 		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1655 			break;
1656 	}
1657 	if (bp == NULL)
1658 		return EINVAL;
1659 	s = splnet();
1660 	opromisc = d->bd_promisc;
1661 	bpf_detachd(d);
1662 	bpf_attachd(d, bp);
1663 	reset_d(d);
1664 	if (opromisc) {
1665 		error = ifpromisc(bp->bif_ifp, 1);
1666 		if (error)
1667 			printf("%s: bpf_setdlt: ifpromisc failed (%d)\n",
1668 			    bp->bif_ifp->if_xname, error);
1669 		else
1670 			d->bd_promisc = 1;
1671 	}
1672 	splx(s);
1673 	return 0;
1674 }
1675 
1676 static int
1677 sysctl_net_bpf_maxbufsize(SYSCTLFN_ARGS)
1678 {
1679 	int newsize, error;
1680 	struct sysctlnode node;
1681 
1682 	node = *rnode;
1683 	node.sysctl_data = &newsize;
1684 	newsize = bpf_maxbufsize;
1685 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1686 	if (error || newp == NULL)
1687 		return (error);
1688 
1689 	if (newsize < BPF_MINBUFSIZE || newsize > BPF_MAXBUFSIZE)
1690 		return (EINVAL);
1691 
1692 	bpf_maxbufsize = newsize;
1693 
1694 	return (0);
1695 }
1696 
1697 SYSCTL_SETUP(sysctl_net_bfp_setup, "sysctl net.bpf subtree setup")
1698 {
1699 	const struct sysctlnode *node;
1700 
1701 	sysctl_createv(clog, 0, NULL, NULL,
1702 		       CTLFLAG_PERMANENT,
1703 		       CTLTYPE_NODE, "net", NULL,
1704 		       NULL, 0, NULL, 0,
1705 		       CTL_NET, CTL_EOL);
1706 
1707 	node = NULL;
1708 	sysctl_createv(clog, 0, NULL, &node,
1709 		       CTLFLAG_PERMANENT,
1710 		       CTLTYPE_NODE, "bpf",
1711 		       SYSCTL_DESCR("BPF options"),
1712 		       NULL, 0, NULL, 0,
1713 		       CTL_NET, CTL_CREATE, CTL_EOL);
1714 	if (node != NULL)
1715 		sysctl_createv(clog, 0, NULL, NULL,
1716 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1717 			CTLTYPE_INT, "maxbufsize",
1718 			SYSCTL_DESCR("Maximum size for data capture buffer"),
1719 			sysctl_net_bpf_maxbufsize, 0, &bpf_maxbufsize, 0,
1720 			CTL_NET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1721 }
1722