xref: /netbsd-src/sys/net/bpf.c (revision cda4f8f6ee55684e8d311b86c99ea59191e6b74f)
1 /*-
2  * Copyright (c) 1990-1991 The Regents of the University of California.
3  * All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	from: @(#)bpf.c	7.5 (Berkeley) 7/15/91
39  *	$Id: bpf.c,v 1.5 1993/05/18 18:19:50 cgd Exp $
40  */
41 
42 #include "bpfilter.h"
43 
44 #if NBPFILTER > 0
45 
46 #ifndef __386BSD__
47 #define __386BSD__
48 #endif
49 
50 #include <sys/param.h>
51 #include <sys/systm.h>
52 #include <sys/mbuf.h>
53 #include <sys/buf.h>
54 #include <sys/dir.h>
55 #include <sys/time.h>
56 #include <sys/proc.h>
57 #include <sys/user.h>
58 #include <sys/ioctl.h>
59 #include <sys/select.h>
60 
61 #include <sys/file.h>
62 #if defined(sparc) && BSD < 199103
63 #include <sys/stream.h>
64 #endif
65 #include <sys/tty.h>
66 #include <sys/uio.h>
67 
68 #include <sys/protosw.h>
69 #include <sys/socket.h>
70 #include <net/if.h>
71 
72 #include <net/bpf.h>
73 #include <net/bpfdesc.h>
74 
75 #include <sys/errno.h>
76 
77 #include <netinet/in.h>
78 #include <netinet/if_ether.h>
79 #include <sys/kernel.h>
80 
81 /*
82  * Older BSDs don't have kernel malloc.
83  */
84 #if BSD < 199103
85 extern bcopy();
86 static caddr_t bpf_alloc();
87 #include <net/bpf_compat.h>
88 #define BPF_BUFSIZE (MCLBYTES-8)
89 #define UIOMOVE(cp, len, code, uio) uiomove(cp, len, code, uio)
90 #else
91 #define BPF_BUFSIZE 4096
92 #define UIOMOVE(cp, len, code, uio) uiomove(cp, len, uio)
93 #endif
94 
95 #define PRINET  26			/* interruptible */
96 
97 /*
98  * The default read buffer size is patchable.
99  */
100 int bpf_bufsize = BPF_BUFSIZE;
101 
102 /*
103  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
104  *  bpf_dtab holds the descriptors, indexed by minor device #
105  */
106 struct bpf_if	*bpf_iflist;
107 struct bpf_d	bpf_dtab[NBPFILTER];
108 
109 static void	bpf_ifname();
110 static void	catchpacket();
111 static void	bpf_freed();
112 static int	bpf_setif();
113 static int	bpf_initd();
114 static int	bpf_allocbufs();
115 
116 static int
117 bpf_movein(uio, linktype, mp, sockp)
118 	register struct uio *uio;
119 	int linktype;
120 	register struct mbuf **mp;
121 	register struct sockaddr *sockp;
122 {
123 	struct mbuf *m;
124 	int error;
125 	int len;
126 	int hlen;
127 
128 	/*
129 	 * Build a sockaddr based on the data link layer type.
130 	 * We do this at this level because the ethernet header
131 	 * is copied directly into the data field of the sockaddr.
132 	 * In the case of SLIP, there is no header and the packet
133 	 * is forwarded as is.
134 	 * Also, we are careful to leave room at the front of the mbuf
135 	 * for the link level header.
136 	 */
137 	switch (linktype) {
138 
139 	case DLT_SLIP:
140 		sockp->sa_family = AF_INET;
141 		hlen = 0;
142 		break;
143 
144 	case DLT_EN10MB:
145 		sockp->sa_family = AF_UNSPEC;
146 		/* XXX Would MAXLINKHDR be better? */
147 		hlen = sizeof(struct ether_header);
148 		break;
149 
150 	case DLT_FDDI:
151 		sockp->sa_family = AF_UNSPEC;
152 		/* XXX 4(FORMAC)+6(dst)+6(src)+3(LLC)+5(SNAP) */
153 		hlen = 24;
154 		break;
155 
156 	case DLT_NULL:
157 		sockp->sa_family = AF_UNSPEC;
158 		hlen = 0;
159 		break;
160 
161 	default:
162 		return (EIO);
163 	}
164 
165 	len = uio->uio_resid;
166 	if ((unsigned)len > MCLBYTES)
167 		return (EIO);
168 
169 	MGET(m, M_WAIT, MT_DATA);
170 	if (m == 0)
171 		return (ENOBUFS);
172 	if (len > MLEN) {
173 #if BSD >= 199103
174 		MCLGET(m, M_WAIT);
175 		if ((m->m_flags & M_EXT) == 0) {
176 #else
177 		MCLGET(m);
178 		if (m->m_len != MCLBYTES) {
179 #endif
180 			error = ENOBUFS;
181 			goto bad;
182 		}
183 	}
184 	m->m_len = len;
185 	*mp = m;
186 	/*
187 	 * Make room for link header.
188 	 */
189 	if (hlen != 0) {
190 		m->m_len -= hlen;
191 #if BSD >= 199103
192 		m->m_data += hlen; /* XXX */
193 #else
194 		m->m_off += hlen;
195 #endif
196 		error = UIOMOVE((caddr_t)sockp->sa_data, hlen, UIO_WRITE, uio);
197 		if (error)
198 			goto bad;
199 	}
200 	error = UIOMOVE(mtod(m, caddr_t), len - hlen, UIO_WRITE, uio);
201 	if (!error)
202 		return (0);
203  bad:
204 	m_freem(m);
205 	return (error);
206 }
207 
208 /*
209  * Attach file to the bpf interface, i.e. make d listen on bp.
210  * Must be called at splimp.
211  */
212 static void
213 bpf_attachd(d, bp)
214 	struct bpf_d *d;
215 	struct bpf_if *bp;
216 {
217 	/*
218 	 * Point d at bp, and add d to the interface's list of listeners.
219 	 * Finally, point the driver's bpf cookie at the interface so
220 	 * it will divert packets to bpf.
221 	 */
222 	d->bd_bif = bp;
223 	d->bd_next = bp->bif_dlist;
224 	bp->bif_dlist = d;
225 
226 	*bp->bif_driverp = bp;
227 }
228 
229 /*
230  * Detach a file from its interface.
231  */
232 static void
233 bpf_detachd(d)
234 	struct bpf_d *d;
235 {
236 	struct bpf_d **p;
237 	struct bpf_if *bp;
238 
239 	bp = d->bd_bif;
240 	/*
241 	 * Check if this descriptor had requested promiscuous mode.
242 	 * If so, turn it off.
243 	 */
244 	if (d->bd_promisc) {
245 		d->bd_promisc = 0;
246 		if (ifpromisc(bp->bif_ifp, 0))
247 			/*
248 			 * Something is really wrong if we were able to put
249 			 * the driver into promiscuous mode, but can't
250 			 * take it out.
251 			 */
252 			panic("bpf: ifpromisc failed");
253 	}
254 	/* Remove d from the interface's descriptor list. */
255 	p = &bp->bif_dlist;
256 	while (*p != d) {
257 		p = &(*p)->bd_next;
258 		if (*p == 0)
259 			panic("bpf_detachd: descriptor not in list");
260 	}
261 	*p = (*p)->bd_next;
262 	if (bp->bif_dlist == 0)
263 		/*
264 		 * Let the driver know that there are no more listeners.
265 		 */
266 		*d->bd_bif->bif_driverp = 0;
267 	d->bd_bif = 0;
268 }
269 
270 
271 /*
272  * Mark a descriptor free by making it point to itself.
273  * This is probably cheaper than marking with a constant since
274  * the address should be in a register anyway.
275  */
276 #define D_ISFREE(d) ((d) == (d)->bd_next)
277 #define D_MARKFREE(d) ((d)->bd_next = (d))
278 #define D_MARKUSED(d) ((d)->bd_next = 0)
279 
280 /*
281  * Open ethernet device.  Returns ENXIO for illegal minor device number,
282  * EBUSY if file is open by another process.
283  */
284 /* ARGSUSED */
285 int
286 bpfopen(dev, flag)
287 	dev_t dev;
288 	int flag;
289 {
290 	register struct bpf_d *d;
291 
292 	if (minor(dev) >= NBPFILTER)
293 		return (ENXIO);
294 	/*
295 	 * Each minor can be opened by only one process.  If the requested
296 	 * minor is in use, return EBUSY.
297 	 */
298 	d = &bpf_dtab[minor(dev)];
299 	if (!D_ISFREE(d))
300 		return (EBUSY);
301 
302 	/* Mark "free" and do most initialization. */
303 	bzero((char *)d, sizeof(*d));
304 	d->bd_bufsize = bpf_bufsize;
305 
306 	return (0);
307 }
308 
309 /*
310  * Close the descriptor by detaching it from its interface,
311  * deallocating its buffers, and marking it free.
312  */
313 /* ARGSUSED */
314 int
315 bpfclose(dev, flag)
316 	dev_t dev;
317 	int flag;
318 {
319 	register struct bpf_d *d = &bpf_dtab[minor(dev)];
320 	register int s;
321 
322 	s = splimp();
323 	if (d->bd_bif)
324 		bpf_detachd(d);
325 	splx(s);
326 	bpf_freed(d);
327 
328 	return (0);
329 }
330 
331 /*
332  * Support for SunOS, which does not have tsleep.
333  */
334 #if BSD < 199103
335 static
336 bpf_timeout(arg)
337 	caddr_t arg;
338 {
339 	struct bpf_d *d = (struct bpf_d *)arg;
340 	d->bd_timedout = 1;
341 	wakeup(arg);
342 }
343 
344 #define BPF_SLEEP(chan, pri, s, t) bpf_sleep((struct bpf_d *)chan)
345 
346 int
347 bpf_sleep(d)
348 	register struct bpf_d *d;
349 {
350 	register int rto = d->bd_rtout;
351 	register int st;
352 
353 	if (rto != 0) {
354 		d->bd_timedout = 0;
355 		timeout(bpf_timeout, (caddr_t)d, rto);
356 	}
357 	st = sleep((caddr_t)d, PRINET|PCATCH);
358 	if (rto != 0) {
359 		if (d->bd_timedout == 0)
360 			untimeout(bpf_timeout, (caddr_t)d);
361 		else if (st == 0)
362 			return EWOULDBLOCK;
363 	}
364 	return (st != 0) ? EINTR : 0;
365 }
366 #else
367 #define BPF_SLEEP tsleep
368 #endif
369 
370 /*
371  * Rotate the packet buffers in descriptor d.  Move the store buffer
372  * into the hold slot, and the free buffer into the store slot.
373  * Zero the length of the new store buffer.
374  */
375 #define ROTATE_BUFFERS(d) \
376 	(d)->bd_hbuf = (d)->bd_sbuf; \
377 	(d)->bd_hlen = (d)->bd_slen; \
378 	(d)->bd_sbuf = (d)->bd_fbuf; \
379 	(d)->bd_slen = 0; \
380 	(d)->bd_fbuf = 0;
381 /*
382  *  bpfread - read next chunk of packets from buffers
383  */
384 int
385 bpfread(dev, uio)
386 	dev_t dev;
387 	register struct uio *uio;
388 {
389 	register struct bpf_d *d = &bpf_dtab[minor(dev)];
390 	int error;
391 	int s;
392 
393 	/*
394 	 * Restrict application to use a buffer the same size as
395 	 * as kernel buffers.
396 	 */
397 	if (uio->uio_resid != d->bd_bufsize)
398 		return (EINVAL);
399 
400 	s = splimp();
401 	/*
402 	 * If the hold buffer is empty, then do a timed sleep, which
403 	 * ends when the timeout expires or when enough packets
404 	 * have arrived to fill the store buffer.
405 	 */
406 	while (d->bd_hbuf == 0) {
407 		if (d->bd_immediate && d->bd_slen != 0) {
408 			/*
409 			 * A packet(s) either arrived since the previous
410 			 * read or arrived while we were asleep.
411 			 * Rotate the buffers and return what's here.
412 			 */
413 			ROTATE_BUFFERS(d);
414 			break;
415 		}
416 		error = BPF_SLEEP((caddr_t)d, PRINET|PCATCH, "bpf",
417 				  d->bd_rtout);
418 		if (error == EINTR || error == ERESTART) {
419 			splx(s);
420 			return (error);
421 		}
422 		if (error == EWOULDBLOCK) {
423 			/*
424 			 * On a timeout, return what's in the buffer,
425 			 * which may be nothing.  If there is something
426 			 * in the store buffer, we can rotate the buffers.
427 			 */
428 			if (d->bd_hbuf)
429 				/*
430 				 * We filled up the buffer in between
431 				 * getting the timeout and arriving
432 				 * here, so we don't need to rotate.
433 				 */
434 				break;
435 
436 			if (d->bd_slen == 0) {
437 				splx(s);
438 				return (0);
439 			}
440 			ROTATE_BUFFERS(d);
441 			break;
442 		}
443 	}
444 	/*
445 	 * At this point, we know we have something in the hold slot.
446 	 */
447 	splx(s);
448 
449 	/*
450 	 * Move data from hold buffer into user space.
451 	 * We know the entire buffer is transferred since
452 	 * we checked above that the read buffer is bpf_bufsize bytes.
453 	 */
454 	error = UIOMOVE(d->bd_hbuf, d->bd_hlen, UIO_READ, uio);
455 
456 	s = splimp();
457 	d->bd_fbuf = d->bd_hbuf;
458 	d->bd_hbuf = 0;
459 	d->bd_hlen = 0;
460 	splx(s);
461 
462 	return (error);
463 }
464 
465 
466 /*
467  * If there are processes sleeping on this descriptor, wake them up.
468  */
469 static inline void
470 bpf_wakeup(d)
471 	register struct bpf_d *d;
472 {
473 	wakeup((caddr_t)d);
474 #if (BSD > 199103) || defined(__386BSD__)
475 	selwakeup(&d->bd_sel);
476 	/* XXX */
477 	d->bd_sel.si_pid = 0;
478 #else
479 	if (d->bd_selproc) {
480 		selwakeup(d->bd_selproc, (int)d->bd_selcoll);
481 		d->bd_selcoll = 0;
482 		d->bd_selproc = 0;
483 	}
484 #endif
485 }
486 
487 int
488 bpfwrite(dev, uio)
489 	dev_t dev;
490 	struct uio *uio;
491 {
492 	register struct bpf_d *d = &bpf_dtab[minor(dev)];
493 	struct ifnet *ifp;
494 	struct mbuf *m;
495 	int error, s;
496 	static struct sockaddr dst;
497 
498 	if (d->bd_bif == 0)
499 		return (ENXIO);
500 
501 	ifp = d->bd_bif->bif_ifp;
502 
503 	if (uio->uio_resid == 0)
504 		return (0);
505 	if (uio->uio_resid > ifp->if_mtu)
506 		return (EMSGSIZE);
507 
508 	error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, &m, &dst);
509 	if (error)
510 		return (error);
511 
512 	s = splnet();
513 #if BSD >= 199103
514 	error = (*ifp->if_output)(ifp, m, &dst, (struct rtentry *)0);
515 #else
516 	error = (*ifp->if_output)(ifp, m, &dst);
517 #endif
518 	splx(s);
519 	/*
520 	 * The driver frees the mbuf.
521 	 */
522 	return (error);
523 }
524 
525 /*
526  * Reset a descriptor by flushing its packet buffer and clearing the
527  * receive and drop counts.  Should be called at splimp.
528  */
529 static void
530 reset_d(d)
531 	struct bpf_d *d;
532 {
533 	if (d->bd_hbuf) {
534 		/* Free the hold buffer. */
535 		d->bd_fbuf = d->bd_hbuf;
536 		d->bd_hbuf = 0;
537 	}
538 	d->bd_slen = 0;
539 	d->bd_hlen = 0;
540 	d->bd_rcount = 0;
541 	d->bd_dcount = 0;
542 }
543 
544 /*
545  *  FIONREAD		Check for read packet available.
546  *  SIOCGIFADDR		Get interface address - convenient hook to driver.
547  *  BIOCGBLEN		Get buffer len [for read()].
548  *  BIOCSETF		Set ethernet read filter.
549  *  BIOCFLUSH		Flush read packet buffer.
550  *  BIOCPROMISC		Put interface into promiscuous mode.
551  *  BIOCGDLT		Get link layer type.
552  *  BIOCGETIF		Get interface name.
553  *  BIOCSETIF		Set interface.
554  *  BIOCSRTIMEOUT	Set read timeout.
555  *  BIOCGRTIMEOUT	Get read timeout.
556  *  BIOCGSTATS		Get packet stats.
557  *  BIOCIMMEDIATE	Set immediate mode.
558  *  BIOCVERSION		Get filter language version.
559  */
560 /* ARGSUSED */
561 int
562 bpfioctl(dev, cmd, addr, flag)
563 	dev_t dev;
564 	int cmd;
565 	caddr_t addr;
566 	int flag;
567 {
568 	register struct bpf_d *d = &bpf_dtab[minor(dev)];
569 	int s, error = 0;
570 
571 	switch (cmd) {
572 
573 	default:
574 		error = EINVAL;
575 		break;
576 
577 	/*
578 	 * Check for read packet available.
579 	 */
580 	case FIONREAD:
581 		{
582 			int n;
583 
584 			s = splimp();
585 			n = d->bd_slen;
586 			if (d->bd_hbuf)
587 				n += d->bd_hlen;
588 			splx(s);
589 
590 			*(int *)addr = n;
591 			break;
592 		}
593 
594 	case SIOCGIFADDR:
595 		{
596 			struct ifnet *ifp;
597 
598 			if (d->bd_bif == 0)
599 				error = EINVAL;
600 			else {
601 				ifp = d->bd_bif->bif_ifp;
602 				error = (*ifp->if_ioctl)(ifp, cmd, addr);
603 			}
604 			break;
605 		}
606 
607 	/*
608 	 * Get buffer len [for read()].
609 	 */
610 	case BIOCGBLEN:
611 		*(u_int *)addr = d->bd_bufsize;
612 		break;
613 
614 	/*
615 	 * Set buffer length.
616 	 */
617 	case BIOCSBLEN:
618 #if BSD < 199103
619 		error = EINVAL;
620 #else
621 		if (d->bd_bif != 0)
622 			error = EINVAL;
623 		else {
624 			register u_int size = *(u_int *)addr;
625 
626 			if (size > BPF_MAXBUFSIZE)
627 				*(u_int *)addr = size = BPF_MAXBUFSIZE;
628 			else if (size < BPF_MINBUFSIZE)
629 				*(u_int *)addr = size = BPF_MINBUFSIZE;
630 			d->bd_bufsize = size;
631 		}
632 #endif
633 		break;
634 
635 	/*
636 	 * Set link layer read filter.
637 	 */
638 	case BIOCSETF:
639 		error = bpf_setf(d, (struct bpf_program *)addr);
640 		break;
641 
642 	/*
643 	 * Flush read packet buffer.
644 	 */
645 	case BIOCFLUSH:
646 		s = splimp();
647 		reset_d(d);
648 		splx(s);
649 		break;
650 
651 	/*
652 	 * Put interface into promiscuous mode.
653 	 */
654 	case BIOCPROMISC:
655 		if (d->bd_bif == 0) {
656 			/*
657 			 * No interface attached yet.
658 			 */
659 			error = EINVAL;
660 			break;
661 		}
662 		s = splimp();
663 		if (d->bd_promisc == 0) {
664 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
665 			if (error == 0)
666 				d->bd_promisc = 1;
667 		}
668 		splx(s);
669 		break;
670 
671 	/*
672 	 * Get device parameters.
673 	 */
674 	case BIOCGDLT:
675 		if (d->bd_bif == 0)
676 			error = EINVAL;
677 		else
678 			*(u_int *)addr = d->bd_bif->bif_dlt;
679 		break;
680 
681 	/*
682 	 * Set interface name.
683 	 */
684 	case BIOCGETIF:
685 		if (d->bd_bif == 0)
686 			error = EINVAL;
687 		else
688 			bpf_ifname(d->bd_bif->bif_ifp, (struct ifreq *)addr);
689 		break;
690 
691 	/*
692 	 * Set interface.
693 	 */
694 	case BIOCSETIF:
695 		error = bpf_setif(d, (struct ifreq *)addr);
696 		break;
697 
698 	/*
699 	 * Set read timeout.
700 	 */
701 	case BIOCSRTIMEOUT:
702 		{
703 			struct timeval *tv = (struct timeval *)addr;
704 			u_long msec;
705 
706 			/* Compute number of milliseconds. */
707 			msec = tv->tv_sec * 1000 + tv->tv_usec / 1000;
708 			/* Scale milliseconds to ticks.  Assume hard
709 			   clock has millisecond or greater resolution
710 			   (i.e. tick >= 1000).  For 10ms hardclock,
711 			   tick/1000 = 10, so rtout<-msec/10. */
712 			d->bd_rtout = msec / (tick / 1000);
713 			break;
714 		}
715 
716 	/*
717 	 * Get read timeout.
718 	 */
719 	case BIOCGRTIMEOUT:
720 		{
721 			struct timeval *tv = (struct timeval *)addr;
722 			u_long msec = d->bd_rtout;
723 
724 			msec *= tick / 1000;
725 			tv->tv_sec = msec / 1000;
726 			tv->tv_usec = msec % 1000;
727 			break;
728 		}
729 
730 	/*
731 	 * Get packet stats.
732 	 */
733 	case BIOCGSTATS:
734 		{
735 			struct bpf_stat *bs = (struct bpf_stat *)addr;
736 
737 			bs->bs_recv = d->bd_rcount;
738 			bs->bs_drop = d->bd_dcount;
739 			break;
740 		}
741 
742 	/*
743 	 * Set immediate mode.
744 	 */
745 	case BIOCIMMEDIATE:
746 		d->bd_immediate = *(u_int *)addr;
747 		break;
748 
749 	case BIOCVERSION:
750 		{
751 			struct bpf_version *bv = (struct bpf_version *)addr;
752 
753 			bv->bv_major = BPF_MAJOR_VERSION;
754 			bv->bv_minor = BPF_MINOR_VERSION;
755 			break;
756 		}
757 	}
758 	return (error);
759 }
760 
761 /*
762  * Set d's packet filter program to fp.  If this file already has a filter,
763  * free it and replace it.  Returns EINVAL for bogus requests.
764  */
765 int
766 bpf_setf(d, fp)
767 	struct bpf_d *d;
768 	struct bpf_program *fp;
769 {
770 	struct bpf_insn *fcode, *old;
771 	u_int flen, size;
772 	int s;
773 
774 	old = d->bd_filter;
775 	if (fp->bf_insns == 0) {
776 		if (fp->bf_len != 0)
777 			return (EINVAL);
778 		s = splimp();
779 		d->bd_filter = 0;
780 		reset_d(d);
781 		splx(s);
782 		if (old != 0)
783 			free((caddr_t)old, M_DEVBUF);
784 		return (0);
785 	}
786 	flen = fp->bf_len;
787 	if (flen > BPF_MAXINSNS)
788 		return (EINVAL);
789 
790 	size = flen * sizeof(*fp->bf_insns);
791 	fcode = (struct bpf_insn *)malloc(size, M_DEVBUF, M_WAITOK);
792 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
793 	    bpf_validate(fcode, (int)flen)) {
794 		s = splimp();
795 		d->bd_filter = fcode;
796 		reset_d(d);
797 		splx(s);
798 		if (old != 0)
799 			free((caddr_t)old, M_DEVBUF);
800 
801 		return (0);
802 	}
803 	free((caddr_t)fcode, M_DEVBUF);
804 	return (EINVAL);
805 }
806 
807 /*
808  * Detach a file from its current interface (if attached at all) and attach
809  * to the interface indicated by the name stored in ifr.
810  * Return an errno or 0.
811  */
812 static int
813 bpf_setif(d, ifr)
814 	struct bpf_d *d;
815 	struct ifreq *ifr;
816 {
817 	struct bpf_if *bp;
818 	char *cp;
819 	int unit, s, error;
820 
821 	/*
822 	 * Separate string into name part and unit number.  Put a null
823 	 * byte at the end of the name part, and compute the number.
824 	 * If the a unit number is unspecified, the default is 0,
825 	 * as initialized above.  XXX This should be common code.
826 	 */
827 	unit = 0;
828 	cp = ifr->ifr_name;
829 	cp[sizeof(ifr->ifr_name) - 1] = '\0';
830 	while (*cp++) {
831 		if (*cp >= '0' && *cp <= '9') {
832 			unit = *cp - '0';
833 			*cp++ = '\0';
834 			while (*cp)
835 				unit = 10 * unit + *cp++ - '0';
836 			break;
837 		}
838 	}
839 	/*
840 	 * Look through attached interfaces for the named one.
841 	 */
842 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
843 		struct ifnet *ifp = bp->bif_ifp;
844 
845 		if (ifp == 0 || unit != ifp->if_unit
846 		    || strcmp(ifp->if_name, ifr->ifr_name) != 0)
847 			continue;
848 		/*
849 		 * We found the requested interface.
850 		 * If it's not up, return an error.
851 		 * Allocate the packet buffers if we need to.
852 		 * If we're already attached to requested interface,
853 		 * just flush the buffer.
854 		 */
855 		if ((ifp->if_flags & IFF_UP) == 0)
856 			return (ENETDOWN);
857 
858 		if (d->bd_sbuf == 0) {
859 			error = bpf_allocbufs(d);
860 			if (error != 0)
861 				return (error);
862 		}
863 		s = splimp();
864 		if (bp != d->bd_bif) {
865 			if (d->bd_bif)
866 				/*
867 				 * Detach if attached to something else.
868 				 */
869 				bpf_detachd(d);
870 
871 			bpf_attachd(d, bp);
872 		}
873 		reset_d(d);
874 		splx(s);
875 		return (0);
876 	}
877 	/* Not found. */
878 	return (ENXIO);
879 }
880 
881 /*
882  * Convert an interface name plus unit number of an ifp to a single
883  * name which is returned in the ifr.
884  */
885 static void
886 bpf_ifname(ifp, ifr)
887 	struct ifnet *ifp;
888 	struct ifreq *ifr;
889 {
890 	char *s = ifp->if_name;
891 	char *d = ifr->ifr_name;
892 
893 	while (*d++ = *s++)
894 		continue;
895 	/* XXX Assume that unit number is less than 10. */
896 	*d++ = ifp->if_unit + '0';
897 	*d = '\0';
898 }
899 
900 /*
901  * The new select interface passes down the proc pointer; the old select
902  * stubs had to grab it out of the user struct.  This glue allows either case.
903  */
904 #if BSD >= 199103
905 #define bpf_select bpfselect
906 #else
907 int
908 bpfselect(dev, rw)
909 	register dev_t dev;
910 	int rw;
911 {
912 	return (bpf_select(dev, rw, u.u_procp));
913 }
914 #endif
915 
916 /*
917  * Support for select() system call
918  * Inspired by the code in tty.c for the same purpose.
919  *
920  * Return true iff the specific operation will not block indefinitely.
921  * Otherwise, return false but make a note that a selwakeup() must be done.
922  */
923 int
924 bpf_select(dev, rw, p)
925 	register dev_t dev;
926 	int rw;
927 	struct proc *p;
928 {
929 	register struct bpf_d *d;
930 	register int s;
931 
932 	if (rw != FREAD)
933 		return (0);
934 	/*
935 	 * An imitation of the FIONREAD ioctl code.
936 	 */
937 	d = &bpf_dtab[minor(dev)];
938 
939 	s = splimp();
940 	if (d->bd_hlen != 0 || (d->bd_immediate && d->bd_slen != 0)) {
941 		/*
942 		 * There is data waiting.
943 		 */
944 		splx(s);
945 		return (1);
946 	}
947 #if defined(__386BSD__)
948 	selrecord(p, &d->bd_sel);
949 #else
950 	/*
951 	 * No data ready.  If there's already a select() waiting on this
952 	 * minor device then this is a collision.  This shouldn't happen
953 	 * because minors really should not be shared, but if a process
954 	 * forks while one of these is open, it is possible that both
955 	 * processes could select on the same descriptor.
956 	 */
957 	if (d->bd_selproc && d->bd_selproc->p_wchan == (caddr_t)&selwait)
958 		d->bd_selcoll = 1;
959 	else
960 		d->bd_selproc = p;
961 #endif
962 	splx(s);
963 	return (0);
964 }
965 
966 /*
967  * Incoming linkage from device drivers.  Process the packet pkt, of length
968  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
969  * by each process' filter, and if accepted, stashed into the corresponding
970  * buffer.
971  */
972 void
973 bpf_tap(arg, pkt, pktlen)
974 	caddr_t arg;
975 	register u_char *pkt;
976 	register u_int pktlen;
977 {
978 	struct bpf_if *bp;
979 	register struct bpf_d *d;
980 	register u_int slen;
981 	/*
982 	 * Note that the ipl does not have to be raised at this point.
983 	 * The only problem that could arise here is that if two different
984 	 * interfaces shared any data.  This is not the case.
985 	 */
986 	bp = (struct bpf_if *)arg;
987 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
988 		++d->bd_rcount;
989 		slen = bpf_filter(d->bd_filter, pkt, pktlen, pktlen);
990 		if (slen != 0)
991 			catchpacket(d, pkt, pktlen, slen, bcopy);
992 	}
993 }
994 
995 /*
996  * Copy data from an mbuf chain into a buffer.  This code is derived
997  * from m_copydata in sys/uipc_mbuf.c.
998  */
999 static void
1000 bpf_mcopy(src, dst, len)
1001 	u_char *src;
1002 	u_char *dst;
1003 	register int len;
1004 {
1005 	register struct mbuf *m = (struct mbuf *)src;
1006 	register unsigned count;
1007 
1008 	while (len > 0) {
1009 		if (m == 0)
1010 			panic("bpf_mcopy");
1011 		count = MIN(m->m_len, len);
1012 		bcopy(mtod(m, caddr_t), (caddr_t)dst, count);
1013 		m = m->m_next;
1014 		dst += count;
1015 		len -= count;
1016 	}
1017 }
1018 
1019 /*
1020  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1021  */
1022 void
1023 bpf_mtap(arg, m)
1024 	caddr_t arg;
1025 	struct mbuf *m;
1026 {
1027 	struct bpf_if *bp = (struct bpf_if *)arg;
1028 	struct bpf_d *d;
1029 	u_int pktlen, slen;
1030 	struct mbuf *m0;
1031 
1032 	pktlen = 0;
1033 	for (m0 = m; m0 != 0; m0 = m0->m_next)
1034 		pktlen += m0->m_len;
1035 
1036 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1037 		++d->bd_rcount;
1038 		slen = bpf_filter(d->bd_filter, (u_char *)m, pktlen, 0);
1039 		if (slen != 0)
1040 			catchpacket(d, (u_char *)m, pktlen, slen, bpf_mcopy);
1041 	}
1042 }
1043 
1044 /*
1045  * Move the packet data from interface memory (pkt) into the
1046  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1047  * otherwise 0.  "copy" is the routine called to do the actual data
1048  * transfer.  bcopy is passed in to copy contiguous chunks, while
1049  * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1050  * pkt is really an mbuf.
1051  */
1052 static void
1053 catchpacket(d, pkt, pktlen, snaplen, cpfn)
1054 	register struct bpf_d *d;
1055 	register u_char *pkt;
1056 	register u_int pktlen, snaplen;
1057 	register void (*cpfn)();
1058 {
1059 	register struct bpf_hdr *hp;
1060 	register int totlen, curlen;
1061 	register int hdrlen = d->bd_bif->bif_hdrlen;
1062 	/*
1063 	 * Figure out how many bytes to move.  If the packet is
1064 	 * greater or equal to the snapshot length, transfer that
1065 	 * much.  Otherwise, transfer the whole packet (unless
1066 	 * we hit the buffer size limit).
1067 	 */
1068 	totlen = hdrlen + MIN(snaplen, pktlen);
1069 	if (totlen > d->bd_bufsize)
1070 		totlen = d->bd_bufsize;
1071 
1072 	/*
1073 	 * Round up the end of the previous packet to the next longword.
1074 	 */
1075 	curlen = BPF_WORDALIGN(d->bd_slen);
1076 	if (curlen + totlen > d->bd_bufsize) {
1077 		/*
1078 		 * This packet will overflow the storage buffer.
1079 		 * Rotate the buffers if we can, then wakeup any
1080 		 * pending reads.
1081 		 */
1082 		if (d->bd_fbuf == 0) {
1083 			/*
1084 			 * We haven't completed the previous read yet,
1085 			 * so drop the packet.
1086 			 */
1087 			++d->bd_dcount;
1088 			return;
1089 		}
1090 		ROTATE_BUFFERS(d);
1091 		bpf_wakeup(d);
1092 		curlen = 0;
1093 	}
1094 	else if (d->bd_immediate)
1095 		/*
1096 		 * Immediate mode is set.  A packet arrived so any
1097 		 * reads should be woken up.
1098 		 */
1099 		bpf_wakeup(d);
1100 
1101 	/*
1102 	 * Append the bpf header.
1103 	 */
1104 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1105 #if BSD >= 199103
1106 	microtime(&hp->bh_tstamp);
1107 #elif defined(sun)
1108 	uniqtime(&hp->bh_tstamp);
1109 #else
1110 	hp->bh_tstamp = time;
1111 #endif
1112 	hp->bh_datalen = pktlen;
1113 	hp->bh_hdrlen = hdrlen;
1114 	/*
1115 	 * Copy the packet data into the store buffer and update its length.
1116 	 */
1117 	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1118 	d->bd_slen = curlen + totlen;
1119 }
1120 
1121 /*
1122  * Initialize all nonzero fields of a descriptor.
1123  */
1124 static int
1125 bpf_allocbufs(d)
1126 	register struct bpf_d *d;
1127 {
1128 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_DEVBUF, M_WAITOK);
1129 	if (d->bd_fbuf == 0)
1130 		return (ENOBUFS);
1131 
1132 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_DEVBUF, M_WAITOK);
1133 	if (d->bd_sbuf == 0) {
1134 		free(d->bd_fbuf, M_DEVBUF);
1135 		return (ENOBUFS);
1136 	}
1137 	d->bd_slen = 0;
1138 	d->bd_hlen = 0;
1139 	return (0);
1140 }
1141 
1142 /*
1143  * Free buffers currently in use by a descriptor.
1144  * Called on close.
1145  */
1146 static void
1147 bpf_freed(d)
1148 	register struct bpf_d *d;
1149 {
1150 	/*
1151 	 * We don't need to lock out interrupts since this descriptor has
1152 	 * been detached from its interface and it yet hasn't been marked
1153 	 * free.
1154 	 */
1155 	if (d->bd_sbuf != 0) {
1156 		free(d->bd_sbuf, M_DEVBUF);
1157 		if (d->bd_hbuf != 0)
1158 			free(d->bd_hbuf, M_DEVBUF);
1159 		if (d->bd_fbuf != 0)
1160 			free(d->bd_fbuf, M_DEVBUF);
1161 	}
1162 	if (d->bd_filter)
1163 		free((caddr_t)d->bd_filter, M_DEVBUF);
1164 
1165 	D_MARKFREE(d);
1166 }
1167 
1168 /*
1169  * Attach an interface to bpf.  driverp is a pointer to a (struct bpf_if *)
1170  * in the driver's softc; dlt is the link layer type; hdrlen is the fixed
1171  * size of the link header (variable length headers not yet supported).
1172  */
1173 void
1174 bpfattach(driverp, ifp, dlt, hdrlen)
1175 	caddr_t *driverp;
1176 	struct ifnet *ifp;
1177 	u_int dlt, hdrlen;
1178 {
1179 	struct bpf_if *bp;
1180 	int i;
1181 #if BSD < 199103
1182 	static struct bpf_if bpf_ifs[NBPFILTER];
1183 	static int bpfifno;
1184 
1185 	bp = (bpfifno < NBPFILTER) ? &bpf_ifs[bpfifno++] : 0;
1186 #else
1187 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_DEVBUF, M_DONTWAIT);
1188 #endif
1189 	if (bp == 0)
1190 		panic("bpfattach");
1191 
1192 	bp->bif_dlist = 0;
1193 	bp->bif_driverp = (struct bpf_if **)driverp;
1194 	bp->bif_ifp = ifp;
1195 	bp->bif_dlt = dlt;
1196 
1197 	bp->bif_next = bpf_iflist;
1198 	bpf_iflist = bp;
1199 
1200 	*bp->bif_driverp = 0;
1201 
1202 	/*
1203 	 * Compute the length of the bpf header.  This is not necessarily
1204 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1205 	 * that the network layer header begins on a longword boundary (for
1206 	 * performance reasons and to alleviate alignment restrictions).
1207 	 */
1208 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1209 
1210 	/*
1211 	 * Mark all the descriptors free if this hasn't been done.
1212 	 */
1213 	if (!D_ISFREE(&bpf_dtab[0]))
1214 		for (i = 0; i < NBPFILTER; ++i)
1215 			D_MARKFREE(&bpf_dtab[i]);
1216 
1217 	printf("bpf: %s%d attached\n", ifp->if_name, ifp->if_unit);
1218 }
1219 
1220 #if BSD >= 199103
1221 /* XXX This routine belongs in net/if.c. */
1222 /*
1223  * Set/clear promiscuous mode on interface ifp based on the truth value
1224  * of pswitch.  The calls are reference counted so that only the first
1225  * "on" request actually has an effect, as does the final "off" request.
1226  * Results are undefined if the "off" and "on" requests are not matched.
1227  */
1228 int
1229 ifpromisc(ifp, pswitch)
1230 	struct ifnet *ifp;
1231 	int pswitch;
1232 {
1233 	struct ifreq ifr;
1234 	/*
1235 	 * If the device is not configured up, we cannot put it in
1236 	 * promiscuous mode.
1237 	 */
1238 	if ((ifp->if_flags & IFF_UP) == 0)
1239 		return (ENETDOWN);
1240 
1241 	if (pswitch) {
1242 		if (ifp->if_pcount++ != 0)
1243 			return (0);
1244 		ifp->if_flags |= IFF_PROMISC;
1245 	} else {
1246 		if (--ifp->if_pcount > 0)
1247 			return (0);
1248 		ifp->if_flags &= ~IFF_PROMISC;
1249 	}
1250 	ifr.ifr_flags = ifp->if_flags;
1251 	return ((*ifp->if_ioctl)(ifp, SIOCSIFFLAGS, (caddr_t)&ifr));
1252 }
1253 #endif
1254 
1255 #if BSD < 199103
1256 /*
1257  * Allocate some memory for bpf.  This is temporary SunOS support, and
1258  * is admittedly a hack.
1259  * If resources unavaiable, return 0.
1260  */
1261 static caddr_t
1262 bpf_alloc(size, canwait)
1263 	register int size;
1264 	register int canwait;
1265 {
1266 	register struct mbuf *m;
1267 
1268 	if ((unsigned)size > (MCLBYTES-8))
1269 		return 0;
1270 
1271 	MGET(m, canwait, MT_DATA);
1272 	if (m == 0)
1273 		return 0;
1274 	if ((unsigned)size > (MLEN-8)) {
1275 		MCLGET(m);
1276 		if (m->m_len != MCLBYTES) {
1277 			m_freem(m);
1278 			return 0;
1279 		}
1280 	}
1281 	*mtod(m, struct mbuf **) = m;
1282 	return mtod(m, caddr_t) + 8;
1283 }
1284 #endif
1285 #endif
1286