xref: /netbsd-src/sys/net/bpf_filter.c (revision 811e6386f8c5e4a3521c7003da29ec8673e344fa)
1 /*-
2  * Copyright (c) 1990-1991 The Regents of the University of California.
3  * All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *      @(#)bpf_filter.c	7.2 (Berkeley) 5/14/91
39  *
40  * static char rcsid[] =
41  * "@(#) $Header: /cvsroot/src/sys/net/bpf_filter.c,v 1.2 1993/03/25 00:27:53 cgd Exp $ (LBL)";
42  */
43 #if !(defined(lint) || defined(KERNEL))
44 static char rcsid[] =
45 	"@(#) $Header: /cvsroot/src/sys/net/bpf_filter.c,v 1.2 1993/03/25 00:27:53 cgd Exp $ (LBL)";
46 #endif
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/time.h>
51 #include <net/bpf.h>
52 
53 #ifdef sun
54 #include <netinet/in.h>
55 #endif
56 
57 #if defined(sparc) || defined(mips) || defined(ibm032)
58 #define BPF_ALIGN
59 #endif
60 
61 #ifndef BPF_ALIGN
62 #define EXTRACT_SHORT(p)	((u_short)ntohs(*(u_short *)p))
63 #define EXTRACT_LONG(p)		(ntohl(*(u_long *)p))
64 #else
65 #define EXTRACT_SHORT(p)\
66 	((u_short)\
67 		((u_short)*((u_char *)p+0)<<8|\
68 		 (u_short)*((u_char *)p+1)<<0))
69 #define EXTRACT_LONG(p)\
70 		((u_long)*((u_char *)p+0)<<24|\
71 		 (u_long)*((u_char *)p+1)<<16|\
72 		 (u_long)*((u_char *)p+2)<<8|\
73 		 (u_long)*((u_char *)p+3)<<0)
74 #endif
75 
76 #ifdef KERNEL
77 #include <sys/mbuf.h>
78 #define MINDEX(m, k) \
79 { \
80 	register int len = m->m_len; \
81  \
82 	while (k >= len) { \
83 		k -= len; \
84 		m = m->m_next; \
85 		if (m == 0) \
86 			return 0; \
87 		len = m->m_len; \
88 	} \
89 }
90 
91 static int
92 m_xword(m, k, err)
93 	register struct mbuf *m;
94 	register int k, *err;
95 {
96 	register int len;
97 	register u_char *cp, *np;
98 	register struct mbuf *m0;
99 
100 	len = m->m_len;
101 	while (k >= len) {
102 		k -= len;
103 		m = m->m_next;
104 		if (m == 0)
105 			goto bad;
106 		len = m->m_len;
107 	}
108 	cp = mtod(m, u_char *) + k;
109 	if (len - k >= 4) {
110 		*err = 0;
111 		return EXTRACT_LONG(cp);
112 	}
113 	m0 = m->m_next;
114 	if (m0 == 0 || m0->m_len + len - k < 4)
115 		goto bad;
116 	*err = 0;
117 	np = mtod(m0, u_char *);
118 	switch (len - k) {
119 
120 	case 1:
121 		return (cp[k] << 24) | (np[0] << 16) | (np[1] << 8) | np[2];
122 
123 	case 2:
124 		return (cp[k] << 24) | (cp[k + 1] << 16) | (np[0] << 8) |
125 			np[1];
126 
127 	default:
128 		return (cp[k] << 24) | (cp[k + 1] << 16) | (cp[k + 2] << 8) |
129 			np[0];
130 	}
131     bad:
132 	*err = 1;
133 	return 0;
134 }
135 
136 static int
137 m_xhalf(m, k, err)
138 	register struct mbuf *m;
139 	register int k, *err;
140 {
141 	register int len;
142 	register u_char *cp;
143 	register struct mbuf *m0;
144 
145 	len = m->m_len;
146 	while (k >= len) {
147 		k -= len;
148 		m = m->m_next;
149 		if (m == 0)
150 			goto bad;
151 		len = m->m_len;
152 	}
153 	cp = mtod(m, u_char *) + k;
154 	if (len - k >= 2) {
155 		*err = 0;
156 		return EXTRACT_SHORT(cp);
157 	}
158 	m0 = m->m_next;
159 	if (m0 == 0)
160 		goto bad;
161 	*err = 0;
162 	return (cp[k] << 8) | mtod(m0, u_char *)[0];
163  bad:
164 	*err = 1;
165 	return 0;
166 }
167 #endif
168 
169 /*
170  * Execute the filter program starting at pc on the packet p
171  * wirelen is the length of the original packet
172  * buflen is the amount of data present
173  */
174 u_int
175 bpf_filter(pc, p, wirelen, buflen)
176 	register struct bpf_insn *pc;
177 	register u_char *p;
178 	u_int wirelen;
179 	register u_int buflen;
180 {
181 	register u_long A, X;
182 	register int k;
183 	long mem[BPF_MEMWORDS];
184 
185 	if (pc == 0)
186 		/*
187 		 * No filter means accept all.
188 		 */
189 		return (u_int)-1;
190 #ifdef lint
191 	A = 0;
192 	X = 0;
193 #endif
194 	--pc;
195 	while (1) {
196 		++pc;
197 		switch (pc->code) {
198 
199 		default:
200 #ifdef KERNEL
201 			return 0;
202 #else
203 			abort();
204 #endif
205 		case BPF_RET|BPF_K:
206 			return (u_int)pc->k;
207 
208 		case BPF_RET|BPF_A:
209 			return (u_int)A;
210 
211 		case BPF_LD|BPF_W|BPF_ABS:
212 			k = pc->k;
213 			if (k + sizeof(long) > buflen) {
214 #ifdef KERNEL
215 				int merr;
216 
217 				if (buflen != 0)
218 					return 0;
219 				A = m_xword((struct mbuf *)p, k, &merr);
220 				if (merr != 0)
221 					return 0;
222 				continue;
223 #else
224 				return 0;
225 #endif
226 			}
227 #ifdef BPF_ALIGN
228 			if (((int)(p + k) & 3) != 0)
229 				A = EXTRACT_LONG(&p[k]);
230 			else
231 #endif
232 				A = ntohl(*(long *)(p + k));
233 			continue;
234 
235 		case BPF_LD|BPF_H|BPF_ABS:
236 			k = pc->k;
237 			if (k + sizeof(short) > buflen) {
238 #ifdef KERNEL
239 				int merr;
240 
241 				if (buflen != 0)
242 					return 0;
243 				A = m_xhalf((struct mbuf *)p, k, &merr);
244 				continue;
245 #else
246 				return 0;
247 #endif
248 			}
249 			A = EXTRACT_SHORT(&p[k]);
250 			continue;
251 
252 		case BPF_LD|BPF_B|BPF_ABS:
253 			k = pc->k;
254 			if (k >= buflen) {
255 #ifdef KERNEL
256 				register struct mbuf *m;
257 
258 				if (buflen != 0)
259 					return 0;
260 				m = (struct mbuf *)p;
261 				MINDEX(m, k);
262 				A = mtod(m, u_char *)[k];
263 				continue;
264 #else
265 				return 0;
266 #endif
267 			}
268 			A = p[k];
269 			continue;
270 
271 		case BPF_LD|BPF_W|BPF_LEN:
272 			A = wirelen;
273 			continue;
274 
275 		case BPF_LDX|BPF_W|BPF_LEN:
276 			X = wirelen;
277 			continue;
278 
279 		case BPF_LD|BPF_W|BPF_IND:
280 			k = X + pc->k;
281 			if (k + sizeof(long) > buflen) {
282 #ifdef KERNEL
283 				int merr;
284 
285 				if (buflen != 0)
286 					return 0;
287 				A = m_xword((struct mbuf *)p, k, &merr);
288 				if (merr != 0)
289 					return 0;
290 				continue;
291 #else
292 				return 0;
293 #endif
294 			}
295 #ifdef BPF_ALIGN
296 			if (((int)(p + k) & 3) != 0)
297 				A = EXTRACT_LONG(&p[k]);
298 			else
299 #endif
300 				A = ntohl(*(long *)(p + k));
301 			continue;
302 
303 		case BPF_LD|BPF_H|BPF_IND:
304 			k = X + pc->k;
305 			if (k + sizeof(short) > buflen) {
306 #ifdef KERNEL
307 				int merr;
308 
309 				if (buflen != 0)
310 					return 0;
311 				A = m_xhalf((struct mbuf *)p, k, &merr);
312 				if (merr != 0)
313 					return 0;
314 				continue;
315 #else
316 				return 0;
317 #endif
318 			}
319 			A = EXTRACT_SHORT(&p[k]);
320 			continue;
321 
322 		case BPF_LD|BPF_B|BPF_IND:
323 			k = X + pc->k;
324 			if (k >= buflen) {
325 #ifdef KERNEL
326 				register struct mbuf *m;
327 
328 				if (buflen != 0)
329 					return 0;
330 				m = (struct mbuf *)p;
331 				MINDEX(m, k);
332 				A = mtod(m, char *)[k];
333 				continue;
334 #else
335 				return 0;
336 #endif
337 			}
338 			A = p[k];
339 			continue;
340 
341 		case BPF_LDX|BPF_MSH|BPF_B:
342 			k = pc->k;
343 			if (k >= buflen) {
344 #ifdef KERNEL
345 				register struct mbuf *m;
346 
347 				if (buflen != 0)
348 					return 0;
349 				m = (struct mbuf *)p;
350 				MINDEX(m, k);
351 				X = (mtod(m, char *)[k] & 0xf) << 2;
352 				continue;
353 #else
354 				return 0;
355 #endif
356 			}
357 			X = (p[pc->k] & 0xf) << 2;
358 			continue;
359 
360 		case BPF_LD|BPF_IMM:
361 			A = pc->k;
362 			continue;
363 
364 		case BPF_LDX|BPF_IMM:
365 			X = pc->k;
366 			continue;
367 
368 		case BPF_LD|BPF_MEM:
369 			A = mem[pc->k];
370 			continue;
371 
372 		case BPF_LDX|BPF_MEM:
373 			X = mem[pc->k];
374 			continue;
375 
376 		case BPF_ST:
377 			mem[pc->k] = A;
378 			continue;
379 
380 		case BPF_STX:
381 			mem[pc->k] = X;
382 			continue;
383 
384 		case BPF_JMP|BPF_JA:
385 			pc += pc->k;
386 			continue;
387 
388 		case BPF_JMP|BPF_JGT|BPF_K:
389 			pc += (A > pc->k) ? pc->jt : pc->jf;
390 			continue;
391 
392 		case BPF_JMP|BPF_JGE|BPF_K:
393 			pc += (A >= pc->k) ? pc->jt : pc->jf;
394 			continue;
395 
396 		case BPF_JMP|BPF_JEQ|BPF_K:
397 			pc += (A == pc->k) ? pc->jt : pc->jf;
398 			continue;
399 
400 		case BPF_JMP|BPF_JSET|BPF_K:
401 			pc += (A & pc->k) ? pc->jt : pc->jf;
402 			continue;
403 
404 		case BPF_JMP|BPF_JGT|BPF_X:
405 			pc += (A > X) ? pc->jt : pc->jf;
406 			continue;
407 
408 		case BPF_JMP|BPF_JGE|BPF_X:
409 			pc += (A >= X) ? pc->jt : pc->jf;
410 			continue;
411 
412 		case BPF_JMP|BPF_JEQ|BPF_X:
413 			pc += (A == X) ? pc->jt : pc->jf;
414 			continue;
415 
416 		case BPF_JMP|BPF_JSET|BPF_X:
417 			pc += (A & X) ? pc->jt : pc->jf;
418 			continue;
419 
420 		case BPF_ALU|BPF_ADD|BPF_X:
421 			A += X;
422 			continue;
423 
424 		case BPF_ALU|BPF_SUB|BPF_X:
425 			A -= X;
426 			continue;
427 
428 		case BPF_ALU|BPF_MUL|BPF_X:
429 			A *= X;
430 			continue;
431 
432 		case BPF_ALU|BPF_DIV|BPF_X:
433 			if (X == 0)
434 				return 0;
435 			A /= X;
436 			continue;
437 
438 		case BPF_ALU|BPF_AND|BPF_X:
439 			A &= X;
440 			continue;
441 
442 		case BPF_ALU|BPF_OR|BPF_X:
443 			A |= X;
444 			continue;
445 
446 		case BPF_ALU|BPF_LSH|BPF_X:
447 			A <<= X;
448 			continue;
449 
450 		case BPF_ALU|BPF_RSH|BPF_X:
451 			A >>= X;
452 			continue;
453 
454 		case BPF_ALU|BPF_ADD|BPF_K:
455 			A += pc->k;
456 			continue;
457 
458 		case BPF_ALU|BPF_SUB|BPF_K:
459 			A -= pc->k;
460 			continue;
461 
462 		case BPF_ALU|BPF_MUL|BPF_K:
463 			A *= pc->k;
464 			continue;
465 
466 		case BPF_ALU|BPF_DIV|BPF_K:
467 			A /= pc->k;
468 			continue;
469 
470 		case BPF_ALU|BPF_AND|BPF_K:
471 			A &= pc->k;
472 			continue;
473 
474 		case BPF_ALU|BPF_OR|BPF_K:
475 			A |= pc->k;
476 			continue;
477 
478 		case BPF_ALU|BPF_LSH|BPF_K:
479 			A <<= pc->k;
480 			continue;
481 
482 		case BPF_ALU|BPF_RSH|BPF_K:
483 			A >>= pc->k;
484 			continue;
485 
486 		case BPF_ALU|BPF_NEG:
487 			A = -A;
488 			continue;
489 
490 		case BPF_MISC|BPF_TAX:
491 			X = A;
492 			continue;
493 
494 		case BPF_MISC|BPF_TXA:
495 			A = X;
496 			continue;
497 		}
498 	}
499 }
500 
501 #ifdef KERNEL
502 /*
503  * Return true if the 'fcode' is a valid filter program.
504  * The constraints are that each jump be forward and to a valid
505  * code.  The code must terminate with either an accept or reject.
506  * 'valid' is an array for use by the routine (it must be at least
507  * 'len' bytes long).
508  *
509  * The kernel needs to be able to verify an application's filter code.
510  * Otherwise, a bogus program could easily crash the system.
511  */
512 int
513 bpf_validate(f, len)
514 	struct bpf_insn *f;
515 	int len;
516 {
517 	register int i;
518 	register struct bpf_insn *p;
519 
520 	for (i = 0; i < len; ++i) {
521 		/*
522 		 * Check that that jumps are forward, and within
523 		 * the code block.
524 		 */
525 		p = &f[i];
526 		if (BPF_CLASS(p->code) == BPF_JMP) {
527 			register int from = i + 1;
528 
529 			if (BPF_OP(p->code) == BPF_JA) {
530 				if (from + p->k >= len)
531 					return 0;
532 			}
533 			else if (from + p->jt >= len || from + p->jf >= len)
534 				return 0;
535 		}
536 		/*
537 		 * Check that memory operations use valid addresses.
538 		 */
539 		if ((BPF_CLASS(p->code) == BPF_ST ||
540 		     (BPF_CLASS(p->code) == BPF_LD &&
541 		      (p->code & 0xe0) == BPF_MEM)) &&
542 		    (p->k >= BPF_MEMWORDS || p->k < 0))
543 			return 0;
544 		/*
545 		 * Check for constant division by 0.
546 		 */
547 		if (p->code == (BPF_ALU|BPF_DIV|BPF_K) && p->k == 0)
548 			return 0;
549 	}
550 	return BPF_CLASS(f[len - 1].code) == BPF_RET;
551 }
552 #endif
553