xref: /openbsd-src/sys/net/bpf.c (revision 43003dfe3ad45d1698bed8a37f2b0f5b14f20d4f)
1 /*	$OpenBSD: bpf.c,v 1.73 2009/09/21 16:33:42 canacar Exp $	*/
2 /*	$NetBSD: bpf.c,v 1.33 1997/02/21 23:59:35 thorpej Exp $	*/
3 
4 /*
5  * Copyright (c) 1990, 1991, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * This code is derived from the Stanford/CMU enet packet filter,
9  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
10  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
11  * Berkeley Laboratory.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  *
37  *	@(#)bpf.c	8.2 (Berkeley) 3/28/94
38  */
39 
40 #include "bpfilter.h"
41 
42 #include <sys/param.h>
43 #include <sys/mbuf.h>
44 #include <sys/proc.h>
45 #include <sys/signalvar.h>
46 #include <sys/ioctl.h>
47 #include <sys/conf.h>
48 #include <sys/vnode.h>
49 #include <sys/file.h>
50 #include <sys/socket.h>
51 #include <sys/poll.h>
52 #include <sys/kernel.h>
53 #include <sys/sysctl.h>
54 
55 #include <net/if.h>
56 #include <net/bpf.h>
57 #include <net/bpfdesc.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/if_ether.h>
61 
62 #include "vlan.h"
63 #if NVLAN > 0
64 #include <net/if_vlan_var.h>
65 #endif
66 
67 #define BPF_BUFSIZE 32768
68 
69 #define PRINET  26			/* interruptible */
70 
71 /* from kern/kern_clock.c; incremented each clock tick. */
72 extern int ticks;
73 
74 /*
75  * The default read buffer size is patchable.
76  */
77 int bpf_bufsize = BPF_BUFSIZE;
78 int bpf_maxbufsize = BPF_MAXBUFSIZE;
79 
80 /*
81  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
82  *  bpf_d_list is the list of descriptors
83  */
84 struct bpf_if	*bpf_iflist;
85 LIST_HEAD(, bpf_d) bpf_d_list;
86 
87 int	bpf_allocbufs(struct bpf_d *);
88 void	bpf_freed(struct bpf_d *);
89 void	bpf_ifname(struct ifnet *, struct ifreq *);
90 void	bpf_mcopy(const void *, void *, size_t);
91 int	bpf_movein(struct uio *, u_int, struct mbuf **,
92 	    struct sockaddr *, struct bpf_insn *);
93 void	bpf_attachd(struct bpf_d *, struct bpf_if *);
94 void	bpf_detachd(struct bpf_d *);
95 int	bpf_setif(struct bpf_d *, struct ifreq *);
96 int	bpfpoll(dev_t, int, struct proc *);
97 int	bpfkqfilter(dev_t, struct knote *);
98 void	bpf_wakeup(struct bpf_d *);
99 void	bpf_catchpacket(struct bpf_d *, u_char *, size_t, size_t,
100 	    void (*)(const void *, void *, size_t));
101 void	bpf_reset_d(struct bpf_d *);
102 int	bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
103 int	bpf_setdlt(struct bpf_d *, u_int);
104 
105 void	filt_bpfrdetach(struct knote *);
106 int	filt_bpfread(struct knote *, long);
107 
108 struct bpf_d *bpfilter_lookup(int);
109 struct bpf_d *bpfilter_create(int);
110 void bpfilter_destroy(struct bpf_d *);
111 
112 int
113 bpf_movein(struct uio *uio, u_int linktype, struct mbuf **mp,
114     struct sockaddr *sockp, struct bpf_insn *filter)
115 {
116 	struct mbuf *m;
117 	struct m_tag *mtag;
118 	int error;
119 	u_int hlen;
120 	u_int len;
121 	u_int slen;
122 
123 	/*
124 	 * Build a sockaddr based on the data link layer type.
125 	 * We do this at this level because the ethernet header
126 	 * is copied directly into the data field of the sockaddr.
127 	 * In the case of SLIP, there is no header and the packet
128 	 * is forwarded as is.
129 	 * Also, we are careful to leave room at the front of the mbuf
130 	 * for the link level header.
131 	 */
132 	switch (linktype) {
133 
134 	case DLT_SLIP:
135 		sockp->sa_family = AF_INET;
136 		hlen = 0;
137 		break;
138 
139 	case DLT_PPP:
140 		sockp->sa_family = AF_UNSPEC;
141 		hlen = 0;
142 		break;
143 
144 	case DLT_EN10MB:
145 		sockp->sa_family = AF_UNSPEC;
146 		/* XXX Would MAXLINKHDR be better? */
147 		hlen = ETHER_HDR_LEN;
148 		break;
149 
150 	case DLT_FDDI:
151 		sockp->sa_family = AF_UNSPEC;
152 		/* XXX 4(FORMAC)+6(dst)+6(src)+3(LLC)+5(SNAP) */
153 		hlen = 24;
154 		break;
155 
156 	case DLT_IEEE802_11:
157 	case DLT_IEEE802_11_RADIO:
158 		sockp->sa_family = AF_UNSPEC;
159 		hlen = 0;
160 		break;
161 
162 	case DLT_RAW:
163 	case DLT_NULL:
164 		sockp->sa_family = AF_UNSPEC;
165 		hlen = 0;
166 		break;
167 
168 	case DLT_ATM_RFC1483:
169 		/*
170 		 * en atm driver requires 4-byte atm pseudo header.
171 		 * though it isn't standard, vpi:vci needs to be
172 		 * specified anyway.
173 		 */
174 		sockp->sa_family = AF_UNSPEC;
175 		hlen = 12; 	/* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
176 		break;
177 
178 	default:
179 		return (EIO);
180 	}
181 
182 	len = uio->uio_resid;
183 	if (len > MCLBYTES)
184 		return (EIO);
185 
186 	MGETHDR(m, M_WAIT, MT_DATA);
187 	m->m_pkthdr.rcvif = 0;
188 	m->m_pkthdr.len = len - hlen;
189 
190 	if (len > MHLEN) {
191 		MCLGET(m, M_WAIT);
192 		if ((m->m_flags & M_EXT) == 0) {
193 			error = ENOBUFS;
194 			goto bad;
195 		}
196 	}
197 	m->m_len = len;
198 	*mp = m;
199 
200 	error = uiomove(mtod(m, caddr_t), len, uio);
201 	if (error)
202 		goto bad;
203 
204 	slen = bpf_filter(filter, mtod(m, u_char *), len, len);
205 	if (slen < len) {
206 		error = EPERM;
207 		goto bad;
208 	}
209 
210 	if (m->m_len < hlen) {
211 		error = EPERM;
212 		goto bad;
213 	}
214 	/*
215 	 * Make room for link header, and copy it to sockaddr
216 	 */
217 	if (hlen != 0) {
218 		bcopy(m->m_data, sockp->sa_data, hlen);
219 		m->m_len -= hlen;
220 		m->m_data += hlen; /* XXX */
221 	}
222 
223 	/*
224 	 * Prepend the data link type as a mbuf tag
225 	 */
226 	mtag = m_tag_get(PACKET_TAG_DLT, sizeof(u_int), M_NOWAIT);
227 	if (mtag == NULL)
228 		return (ENOMEM);
229 	*(u_int *)(mtag + 1) = linktype;
230 	m_tag_prepend(m, mtag);
231 
232 	return (0);
233  bad:
234 	m_freem(m);
235 	return (error);
236 }
237 
238 /*
239  * Attach file to the bpf interface, i.e. make d listen on bp.
240  * Must be called at splnet.
241  */
242 void
243 bpf_attachd(struct bpf_d *d, struct bpf_if *bp)
244 {
245 	/*
246 	 * Point d at bp, and add d to the interface's list of listeners.
247 	 * Finally, point the driver's bpf cookie at the interface so
248 	 * it will divert packets to bpf.
249 	 */
250 	d->bd_bif = bp;
251 	d->bd_next = bp->bif_dlist;
252 	bp->bif_dlist = d;
253 
254 	*bp->bif_driverp = bp;
255 }
256 
257 /*
258  * Detach a file from its interface.
259  */
260 void
261 bpf_detachd(struct bpf_d *d)
262 {
263 	struct bpf_d **p;
264 	struct bpf_if *bp;
265 
266 	bp = d->bd_bif;
267 	/*
268 	 * Check if this descriptor had requested promiscuous mode.
269 	 * If so, turn it off.
270 	 */
271 	if (d->bd_promisc) {
272 		int error;
273 
274 		d->bd_promisc = 0;
275 		error = ifpromisc(bp->bif_ifp, 0);
276 		if (error && !(error == EINVAL || error == ENODEV))
277 			/*
278 			 * Something is really wrong if we were able to put
279 			 * the driver into promiscuous mode, but can't
280 			 * take it out.
281 			 */
282 			panic("bpf: ifpromisc failed");
283 	}
284 	/* Remove d from the interface's descriptor list. */
285 	p = &bp->bif_dlist;
286 	while (*p != d) {
287 		p = &(*p)->bd_next;
288 		if (*p == 0)
289 			panic("bpf_detachd: descriptor not in list");
290 	}
291 	*p = (*p)->bd_next;
292 	if (bp->bif_dlist == 0)
293 		/*
294 		 * Let the driver know that there are no more listeners.
295 		 */
296 		*d->bd_bif->bif_driverp = 0;
297 	d->bd_bif = 0;
298 }
299 
300 /*
301  * Reference count access to descriptor buffers
302  */
303 #define D_GET(d) ((d)->bd_ref++)
304 #define D_PUT(d) bpf_freed(d)
305 
306 /*
307  * bpfilterattach() is called at boot time in new systems.  We do
308  * nothing here since old systems will not call this.
309  */
310 /* ARGSUSED */
311 void
312 bpfilterattach(int n)
313 {
314 	LIST_INIT(&bpf_d_list);
315 }
316 
317 /*
318  * Open ethernet device.  Returns ENXIO for illegal minor device number,
319  * EBUSY if file is open by another process.
320  */
321 /* ARGSUSED */
322 int
323 bpfopen(dev_t dev, int flag, int mode, struct proc *p)
324 {
325 	struct bpf_d *d;
326 
327 	/* create on demand */
328 	if ((d = bpfilter_create(minor(dev))) == NULL)
329 		return (EBUSY);
330 
331 	/* Mark "free" and do most initialization. */
332 	d->bd_bufsize = bpf_bufsize;
333 	d->bd_sig = SIGIO;
334 
335 	D_GET(d);
336 
337 	return (0);
338 }
339 
340 /*
341  * Close the descriptor by detaching it from its interface,
342  * deallocating its buffers, and marking it free.
343  */
344 /* ARGSUSED */
345 int
346 bpfclose(dev_t dev, int flag, int mode, struct proc *p)
347 {
348 	struct bpf_d *d;
349 	int s;
350 
351 	d = bpfilter_lookup(minor(dev));
352 	s = splnet();
353 	if (d->bd_bif)
354 		bpf_detachd(d);
355 	bpf_wakeup(d);
356 	D_PUT(d);
357 	splx(s);
358 
359 	return (0);
360 }
361 
362 /*
363  * Rotate the packet buffers in descriptor d.  Move the store buffer
364  * into the hold slot, and the free buffer into the store slot.
365  * Zero the length of the new store buffer.
366  */
367 #define ROTATE_BUFFERS(d) \
368 	(d)->bd_hbuf = (d)->bd_sbuf; \
369 	(d)->bd_hlen = (d)->bd_slen; \
370 	(d)->bd_sbuf = (d)->bd_fbuf; \
371 	(d)->bd_slen = 0; \
372 	(d)->bd_fbuf = 0;
373 /*
374  *  bpfread - read next chunk of packets from buffers
375  */
376 int
377 bpfread(dev_t dev, struct uio *uio, int ioflag)
378 {
379 	struct bpf_d *d;
380 	int error;
381 	int s;
382 
383 	d = bpfilter_lookup(minor(dev));
384 	if (d->bd_bif == 0)
385 		return (ENXIO);
386 
387 	/*
388 	 * Restrict application to use a buffer the same size as
389 	 * as kernel buffers.
390 	 */
391 	if (uio->uio_resid != d->bd_bufsize)
392 		return (EINVAL);
393 
394 	s = splnet();
395 
396 	D_GET(d);
397 
398 	/*
399 	 * bd_rdStart is tagged when we start the read, iff there's a timeout.
400 	 * we can then figure out when we're done reading.
401 	 */
402 	if (d->bd_rtout != -1 && d->bd_rdStart == 0)
403 		d->bd_rdStart = ticks;
404 	else
405 		d->bd_rdStart = 0;
406 
407 	/*
408 	 * If the hold buffer is empty, then do a timed sleep, which
409 	 * ends when the timeout expires or when enough packets
410 	 * have arrived to fill the store buffer.
411 	 */
412 	while (d->bd_hbuf == 0) {
413 		if (d->bd_bif == NULL) {
414 			/* interface is gone */
415 			if (d->bd_slen == 0) {
416 				D_PUT(d);
417 				splx(s);
418 				return (EIO);
419 			}
420 			ROTATE_BUFFERS(d);
421 			break;
422 		}
423 		if (d->bd_immediate && d->bd_slen != 0) {
424 			/*
425 			 * A packet(s) either arrived since the previous
426 			 * read or arrived while we were asleep.
427 			 * Rotate the buffers and return what's here.
428 			 */
429 			ROTATE_BUFFERS(d);
430 			break;
431 		}
432 		if ((d->bd_rtout != -1) ||
433 		    (d->bd_rdStart + d->bd_rtout) < ticks) {
434 			error = tsleep((caddr_t)d, PRINET|PCATCH, "bpf",
435 			    d->bd_rtout);
436 		} else {
437 			if (d->bd_rtout == -1) {
438 				/* User requested non-blocking I/O */
439 				error = EWOULDBLOCK;
440 			} else
441 				error = 0;
442 		}
443 		if (error == EINTR || error == ERESTART) {
444 			D_PUT(d);
445 			splx(s);
446 			return (error);
447 		}
448 		if (error == EWOULDBLOCK) {
449 			/*
450 			 * On a timeout, return what's in the buffer,
451 			 * which may be nothing.  If there is something
452 			 * in the store buffer, we can rotate the buffers.
453 			 */
454 			if (d->bd_hbuf)
455 				/*
456 				 * We filled up the buffer in between
457 				 * getting the timeout and arriving
458 				 * here, so we don't need to rotate.
459 				 */
460 				break;
461 
462 			if (d->bd_slen == 0) {
463 				D_PUT(d);
464 				splx(s);
465 				return (0);
466 			}
467 			ROTATE_BUFFERS(d);
468 			break;
469 		}
470 	}
471 	/*
472 	 * At this point, we know we have something in the hold slot.
473 	 */
474 	splx(s);
475 
476 	/*
477 	 * Move data from hold buffer into user space.
478 	 * We know the entire buffer is transferred since
479 	 * we checked above that the read buffer is bpf_bufsize bytes.
480 	 */
481 	error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
482 
483 	s = splnet();
484 	d->bd_fbuf = d->bd_hbuf;
485 	d->bd_hbuf = 0;
486 	d->bd_hlen = 0;
487 
488 	D_PUT(d);
489 	splx(s);
490 
491 	return (error);
492 }
493 
494 
495 /*
496  * If there are processes sleeping on this descriptor, wake them up.
497  */
498 void
499 bpf_wakeup(struct bpf_d *d)
500 {
501 	wakeup((caddr_t)d);
502 	if (d->bd_async && d->bd_sig)
503 		csignal(d->bd_pgid, d->bd_sig,
504 		    d->bd_siguid, d->bd_sigeuid);
505 
506 	selwakeup(&d->bd_sel);
507 	/* XXX */
508 	d->bd_sel.si_selpid = 0;
509 	KNOTE(&d->bd_sel.si_note, 0);
510 }
511 
512 int
513 bpfwrite(dev_t dev, struct uio *uio, int ioflag)
514 {
515 	struct bpf_d *d;
516 	struct ifnet *ifp;
517 	struct mbuf *m;
518 	int error, s;
519 	struct sockaddr_storage dst;
520 
521 	d = bpfilter_lookup(minor(dev));
522 	if (d->bd_bif == 0)
523 		return (ENXIO);
524 
525 	ifp = d->bd_bif->bif_ifp;
526 
527 	if ((ifp->if_flags & IFF_UP) == 0)
528 		return (ENETDOWN);
529 
530 	if (uio->uio_resid == 0)
531 		return (0);
532 
533 	error = bpf_movein(uio, d->bd_bif->bif_dlt, &m,
534 	    (struct sockaddr *)&dst, d->bd_wfilter);
535 	if (error)
536 		return (error);
537 
538 	if (m->m_pkthdr.len > ifp->if_mtu) {
539 		m_freem(m);
540 		return (EMSGSIZE);
541 	}
542 
543 	if (d->bd_hdrcmplt)
544 		dst.ss_family = pseudo_AF_HDRCMPLT;
545 
546 	s = splsoftnet();
547 	error = (*ifp->if_output)(ifp, m, (struct sockaddr *)&dst,
548 	    (struct rtentry *)0);
549 	splx(s);
550 	/*
551 	 * The driver frees the mbuf.
552 	 */
553 	return (error);
554 }
555 
556 /*
557  * Reset a descriptor by flushing its packet buffer and clearing the
558  * receive and drop counts.  Should be called at splnet.
559  */
560 void
561 bpf_reset_d(struct bpf_d *d)
562 {
563 	if (d->bd_hbuf) {
564 		/* Free the hold buffer. */
565 		d->bd_fbuf = d->bd_hbuf;
566 		d->bd_hbuf = 0;
567 	}
568 	d->bd_slen = 0;
569 	d->bd_hlen = 0;
570 	d->bd_rcount = 0;
571 	d->bd_dcount = 0;
572 }
573 
574 /*
575  *  FIONREAD		Check for read packet available.
576  *  BIOCGBLEN		Get buffer len [for read()].
577  *  BIOCSETF		Set ethernet read filter.
578  *  BIOCFLUSH		Flush read packet buffer.
579  *  BIOCPROMISC		Put interface into promiscuous mode.
580  *  BIOCGDLTLIST	Get supported link layer types.
581  *  BIOCGDLT		Get link layer type.
582  *  BIOCSDLT		Set link layer type.
583  *  BIOCGETIF		Get interface name.
584  *  BIOCSETIF		Set interface.
585  *  BIOCSRTIMEOUT	Set read timeout.
586  *  BIOCGRTIMEOUT	Get read timeout.
587  *  BIOCGSTATS		Get packet stats.
588  *  BIOCIMMEDIATE	Set immediate mode.
589  *  BIOCVERSION		Get filter language version.
590  *  BIOCGHDRCMPLT	Get "header already complete" flag
591  *  BIOCSHDRCMPLT	Set "header already complete" flag
592  */
593 /* ARGSUSED */
594 int
595 bpfioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct proc *p)
596 {
597 	struct bpf_d *d;
598 	int s, error = 0;
599 
600 	d = bpfilter_lookup(minor(dev));
601 	if (d->bd_locked && suser(p, 0) != 0) {
602 		/* list of allowed ioctls when locked and not root */
603 		switch (cmd) {
604 		case BIOCGBLEN:
605 		case BIOCFLUSH:
606 		case BIOCGDLT:
607 		case BIOCGDLTLIST:
608 		case BIOCGETIF:
609 		case BIOCGRTIMEOUT:
610 		case BIOCGSTATS:
611 		case BIOCVERSION:
612 		case BIOCGRSIG:
613 		case BIOCGHDRCMPLT:
614 		case FIONREAD:
615 		case BIOCLOCK:
616 		case BIOCSRTIMEOUT:
617 		case BIOCIMMEDIATE:
618 		case TIOCGPGRP:
619 		case BIOCGDIRFILT:
620 			break;
621 		default:
622 			return (EPERM);
623 		}
624 	}
625 
626 	switch (cmd) {
627 
628 	default:
629 		error = EINVAL;
630 		break;
631 
632 	/*
633 	 * Check for read packet available.
634 	 */
635 	case FIONREAD:
636 		{
637 			int n;
638 
639 			s = splnet();
640 			n = d->bd_slen;
641 			if (d->bd_hbuf)
642 				n += d->bd_hlen;
643 			splx(s);
644 
645 			*(int *)addr = n;
646 			break;
647 		}
648 
649 	/*
650 	 * Get buffer len [for read()].
651 	 */
652 	case BIOCGBLEN:
653 		*(u_int *)addr = d->bd_bufsize;
654 		break;
655 
656 	/*
657 	 * Set buffer length.
658 	 */
659 	case BIOCSBLEN:
660 		if (d->bd_bif != 0)
661 			error = EINVAL;
662 		else {
663 			u_int size = *(u_int *)addr;
664 
665 			if (size > bpf_maxbufsize)
666 				*(u_int *)addr = size = bpf_maxbufsize;
667 			else if (size < BPF_MINBUFSIZE)
668 				*(u_int *)addr = size = BPF_MINBUFSIZE;
669 			d->bd_bufsize = size;
670 		}
671 		break;
672 
673 	/*
674 	 * Set link layer read filter.
675 	 */
676 	case BIOCSETF:
677 		error = bpf_setf(d, (struct bpf_program *)addr, 0);
678 		break;
679 
680 	/*
681 	 * Set link layer write filter.
682 	 */
683 	case BIOCSETWF:
684 		error = bpf_setf(d, (struct bpf_program *)addr, 1);
685 		break;
686 
687 	/*
688 	 * Flush read packet buffer.
689 	 */
690 	case BIOCFLUSH:
691 		s = splnet();
692 		bpf_reset_d(d);
693 		splx(s);
694 		break;
695 
696 	/*
697 	 * Put interface into promiscuous mode.
698 	 */
699 	case BIOCPROMISC:
700 		if (d->bd_bif == 0) {
701 			/*
702 			 * No interface attached yet.
703 			 */
704 			error = EINVAL;
705 			break;
706 		}
707 		s = splnet();
708 		if (d->bd_promisc == 0) {
709 			error = ifpromisc(d->bd_bif->bif_ifp, 1);
710 			if (error == 0)
711 				d->bd_promisc = 1;
712 		}
713 		splx(s);
714 		break;
715 
716 	/*
717 	 * Get a list of supported device parameters.
718 	 */
719 	case BIOCGDLTLIST:
720 		if (d->bd_bif == NULL)
721 			error = EINVAL;
722 		else
723 			error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
724 		break;
725 
726 	/*
727 	 * Get device parameters.
728 	 */
729 	case BIOCGDLT:
730 		if (d->bd_bif == 0)
731 			error = EINVAL;
732 		else
733 			*(u_int *)addr = d->bd_bif->bif_dlt;
734 		break;
735 
736 	/*
737 	 * Set device parameters.
738 	 */
739 	case BIOCSDLT:
740 		if (d->bd_bif == NULL)
741 			error = EINVAL;
742 		else
743 			error = bpf_setdlt(d, *(u_int *)addr);
744 		break;
745 
746 	/*
747 	 * Set interface name.
748 	 */
749 	case BIOCGETIF:
750 		if (d->bd_bif == 0)
751 			error = EINVAL;
752 		else
753 			bpf_ifname(d->bd_bif->bif_ifp, (struct ifreq *)addr);
754 		break;
755 
756 	/*
757 	 * Set interface.
758 	 */
759 	case BIOCSETIF:
760 		error = bpf_setif(d, (struct ifreq *)addr);
761 		break;
762 
763 	/*
764 	 * Set read timeout.
765 	 */
766 	case BIOCSRTIMEOUT:
767 		{
768 			struct timeval *tv = (struct timeval *)addr;
769 
770 			/* Compute number of ticks. */
771 			d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
772 			if (d->bd_rtout == 0 && tv->tv_usec != 0)
773 				d->bd_rtout = 1;
774 			break;
775 		}
776 
777 	/*
778 	 * Get read timeout.
779 	 */
780 	case BIOCGRTIMEOUT:
781 		{
782 			struct timeval *tv = (struct timeval *)addr;
783 
784 			tv->tv_sec = d->bd_rtout / hz;
785 			tv->tv_usec = (d->bd_rtout % hz) * tick;
786 			break;
787 		}
788 
789 	/*
790 	 * Get packet stats.
791 	 */
792 	case BIOCGSTATS:
793 		{
794 			struct bpf_stat *bs = (struct bpf_stat *)addr;
795 
796 			bs->bs_recv = d->bd_rcount;
797 			bs->bs_drop = d->bd_dcount;
798 			break;
799 		}
800 
801 	/*
802 	 * Set immediate mode.
803 	 */
804 	case BIOCIMMEDIATE:
805 		d->bd_immediate = *(u_int *)addr;
806 		break;
807 
808 	case BIOCVERSION:
809 		{
810 			struct bpf_version *bv = (struct bpf_version *)addr;
811 
812 			bv->bv_major = BPF_MAJOR_VERSION;
813 			bv->bv_minor = BPF_MINOR_VERSION;
814 			break;
815 		}
816 
817 	case BIOCGHDRCMPLT:	/* get "header already complete" flag */
818 		*(u_int *)addr = d->bd_hdrcmplt;
819 		break;
820 
821 	case BIOCSHDRCMPLT:	/* set "header already complete" flag */
822 		d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
823 		break;
824 
825 	case BIOCLOCK:		/* set "locked" flag (no reset) */
826 		d->bd_locked = 1;
827 		break;
828 
829 	case BIOCGFILDROP:	/* get "filter-drop" flag */
830 		*(u_int *)addr = d->bd_fildrop;
831 		break;
832 
833 	case BIOCSFILDROP:	/* set "filter-drop" flag */
834 		d->bd_fildrop = *(u_int *)addr ? 1 : 0;
835 		break;
836 
837 	case BIOCGDIRFILT:	/* get direction filter */
838 		*(u_int *)addr = d->bd_dirfilt;
839 		break;
840 
841 	case BIOCSDIRFILT:	/* set direction filter */
842 		d->bd_dirfilt = (*(u_int *)addr) &
843 		    (BPF_DIRECTION_IN|BPF_DIRECTION_OUT);
844 		break;
845 
846 	case FIONBIO:		/* Non-blocking I/O */
847 		if (*(int *)addr)
848 			d->bd_rtout = -1;
849 		else
850 			d->bd_rtout = 0;
851 		break;
852 
853 	case FIOASYNC:		/* Send signal on receive packets */
854 		d->bd_async = *(int *)addr;
855 		break;
856 
857 	/*
858 	 * N.B.  ioctl (FIOSETOWN) and fcntl (F_SETOWN) both end up doing
859 	 * the equivalent of a TIOCSPGRP and hence end up here.  *However*
860 	 * TIOCSPGRP's arg is a process group if it's positive and a process
861 	 * id if it's negative.  This is exactly the opposite of what the
862 	 * other two functions want!  Therefore there is code in ioctl and
863 	 * fcntl to negate the arg before calling here.
864 	 */
865 	case TIOCSPGRP:		/* Process or group to send signals to */
866 		d->bd_pgid = *(int *)addr;
867 		d->bd_siguid = p->p_cred->p_ruid;
868 		d->bd_sigeuid = p->p_ucred->cr_uid;
869 		break;
870 
871 	case TIOCGPGRP:
872 		*(int *)addr = d->bd_pgid;
873 		break;
874 
875 	case BIOCSRSIG:		/* Set receive signal */
876 		{
877 			u_int sig;
878 
879 			sig = *(u_int *)addr;
880 
881 			if (sig >= NSIG)
882 				error = EINVAL;
883 			else
884 				d->bd_sig = sig;
885 			break;
886 		}
887 	case BIOCGRSIG:
888 		*(u_int *)addr = d->bd_sig;
889 		break;
890 	}
891 	return (error);
892 }
893 
894 /*
895  * Set d's packet filter program to fp.  If this file already has a filter,
896  * free it and replace it.  Returns EINVAL for bogus requests.
897  */
898 int
899 bpf_setf(struct bpf_d *d, struct bpf_program *fp, int wf)
900 {
901 	struct bpf_insn *fcode, *old;
902 	u_int flen, size;
903 	int s;
904 
905 	old = wf ? d->bd_wfilter : d->bd_rfilter;
906 	if (fp->bf_insns == 0) {
907 		if (fp->bf_len != 0)
908 			return (EINVAL);
909 		s = splnet();
910 		if (wf)
911 			d->bd_wfilter = 0;
912 		else
913 			d->bd_rfilter = 0;
914 		bpf_reset_d(d);
915 		splx(s);
916 		if (old != 0)
917 			free((caddr_t)old, M_DEVBUF);
918 		return (0);
919 	}
920 	flen = fp->bf_len;
921 	if (flen > BPF_MAXINSNS)
922 		return (EINVAL);
923 
924 	size = flen * sizeof(*fp->bf_insns);
925 	fcode = (struct bpf_insn *)malloc(size, M_DEVBUF, M_WAITOK);
926 	if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
927 	    bpf_validate(fcode, (int)flen)) {
928 		s = splnet();
929 		if (wf)
930 			d->bd_wfilter = fcode;
931 		else
932 			d->bd_rfilter = fcode;
933 		bpf_reset_d(d);
934 		splx(s);
935 		if (old != 0)
936 			free((caddr_t)old, M_DEVBUF);
937 
938 		return (0);
939 	}
940 	free((caddr_t)fcode, M_DEVBUF);
941 	return (EINVAL);
942 }
943 
944 /*
945  * Detach a file from its current interface (if attached at all) and attach
946  * to the interface indicated by the name stored in ifr.
947  * Return an errno or 0.
948  */
949 int
950 bpf_setif(struct bpf_d *d, struct ifreq *ifr)
951 {
952 	struct bpf_if *bp, *candidate = NULL;
953 	int s, error;
954 
955 	/*
956 	 * Look through attached interfaces for the named one.
957 	 */
958 	for (bp = bpf_iflist; bp != 0; bp = bp->bif_next) {
959 		struct ifnet *ifp = bp->bif_ifp;
960 
961 		if (ifp == 0 ||
962 		    strcmp(ifp->if_xname, ifr->ifr_name) != 0)
963 			continue;
964 
965 		/*
966 		 * We found the requested interface.
967 		 */
968 		if (candidate == NULL || candidate->bif_dlt > bp->bif_dlt)
969 			candidate = bp;
970 	}
971 
972 	if (candidate != NULL) {
973 		/*
974 		 * Allocate the packet buffers if we need to.
975 		 * If we're already attached to requested interface,
976 		 * just flush the buffer.
977 		 */
978 		if (d->bd_sbuf == 0) {
979 			error = bpf_allocbufs(d);
980 			if (error != 0)
981 				return (error);
982 		}
983 		s = splnet();
984 		if (candidate != d->bd_bif) {
985 			if (d->bd_bif)
986 				/*
987 				 * Detach if attached to something else.
988 				 */
989 				bpf_detachd(d);
990 
991 			bpf_attachd(d, candidate);
992 		}
993 		bpf_reset_d(d);
994 		splx(s);
995 		return (0);
996 	}
997 	/* Not found. */
998 	return (ENXIO);
999 }
1000 
1001 /*
1002  * Copy the interface name to the ifreq.
1003  */
1004 void
1005 bpf_ifname(struct ifnet *ifp, struct ifreq *ifr)
1006 {
1007 	bcopy(ifp->if_xname, ifr->ifr_name, IFNAMSIZ);
1008 }
1009 
1010 /*
1011  * Support for poll() system call
1012  */
1013 int
1014 bpfpoll(dev_t dev, int events, struct proc *p)
1015 {
1016 	struct bpf_d *d;
1017 	int s, revents;
1018 
1019 	revents = events & (POLLIN | POLLRDNORM);
1020 	if (revents == 0)
1021 		return (0);		/* only support reading */
1022 
1023 	/*
1024 	 * An imitation of the FIONREAD ioctl code.
1025 	 */
1026 	d = bpfilter_lookup(minor(dev));
1027 	/*
1028 	 * XXX The USB stack manages it to trigger some race condition
1029 	 * which causes bpfilter_lookup to return NULL when a USB device
1030 	 * gets detached while it is up and has an open bpf handler (e.g.
1031 	 * dhclient).  We still should recheck if we can fix the root
1032 	 * cause of this issue.
1033 	 */
1034 	if (d == NULL)
1035 		return (POLLERR);
1036 	s = splnet();
1037 	if (d->bd_hlen == 0 && (!d->bd_immediate || d->bd_slen == 0)) {
1038 		revents = 0;		/* no data waiting */
1039 		/*
1040 		 * if there's a timeout, mark the time we started waiting.
1041 		 */
1042 		if (d->bd_rtout != -1 && d->bd_rdStart == 0)
1043 			d->bd_rdStart = ticks;
1044 		selrecord(p, &d->bd_sel);
1045 	}
1046 	splx(s);
1047 	return (revents);
1048 }
1049 
1050 struct filterops bpfread_filtops =
1051 	{ 1, NULL, filt_bpfrdetach, filt_bpfread };
1052 
1053 int
1054 bpfkqfilter(dev_t dev, struct knote *kn)
1055 {
1056 	struct bpf_d *d;
1057 	struct klist *klist;
1058 	int s;
1059 
1060 	d = bpfilter_lookup(minor(dev));
1061 	switch (kn->kn_filter) {
1062 	case EVFILT_READ:
1063 		klist = &d->bd_sel.si_note;
1064 		kn->kn_fop = &bpfread_filtops;
1065 		break;
1066 	default:
1067 		return (1);
1068 	}
1069 
1070 	kn->kn_hook = (caddr_t)((u_long)dev);
1071 
1072 	s = splnet();
1073 	D_GET(d);
1074 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1075 	splx(s);
1076 
1077 	return (0);
1078 }
1079 
1080 void
1081 filt_bpfrdetach(struct knote *kn)
1082 {
1083 	dev_t dev = (dev_t)((u_long)kn->kn_hook);
1084 	struct bpf_d *d;
1085 	int s;
1086 
1087 	d = bpfilter_lookup(minor(dev));
1088 	s = splnet();
1089 	SLIST_REMOVE(&d->bd_sel.si_note, kn, knote, kn_selnext);
1090 	D_PUT(d);
1091 	splx(s);
1092 }
1093 
1094 int
1095 filt_bpfread(struct knote *kn, long hint)
1096 {
1097 	dev_t dev = (dev_t)((u_long)kn->kn_hook);
1098 	struct bpf_d *d;
1099 
1100 	d = bpfilter_lookup(minor(dev));
1101 	kn->kn_data = d->bd_hlen;
1102 	if (d->bd_immediate)
1103 		kn->kn_data += d->bd_slen;
1104 	return (kn->kn_data > 0);
1105 }
1106 
1107 /*
1108  * Incoming linkage from device drivers.  Process the packet pkt, of length
1109  * pktlen, which is stored in a contiguous buffer.  The packet is parsed
1110  * by each process' filter, and if accepted, stashed into the corresponding
1111  * buffer.
1112  */
1113 int
1114 bpf_tap(caddr_t arg, u_char *pkt, u_int pktlen, u_int direction)
1115 {
1116 	struct bpf_if *bp;
1117 	struct bpf_d *d;
1118 	size_t slen;
1119 	int drop = 0;
1120 
1121 	/*
1122 	 * Note that the ipl does not have to be raised at this point.
1123 	 * The only problem that could arise here is that if two different
1124 	 * interfaces shared any data.  This is not the case.
1125 	 */
1126 	bp = (struct bpf_if *)arg;
1127 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1128 		++d->bd_rcount;
1129 		if ((direction & d->bd_dirfilt) != 0)
1130 			slen = 0;
1131 		else
1132 			slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen);
1133 		if (slen != 0) {
1134 			bpf_catchpacket(d, pkt, pktlen, slen, bcopy);
1135 			if (d->bd_fildrop)
1136 				drop++;
1137 		}
1138 	}
1139 
1140 	return (drop);
1141 }
1142 
1143 /*
1144  * Copy data from an mbuf chain into a buffer.  This code is derived
1145  * from m_copydata in sys/uipc_mbuf.c.
1146  */
1147 void
1148 bpf_mcopy(const void *src_arg, void *dst_arg, size_t len)
1149 {
1150 	const struct mbuf *m;
1151 	u_int count;
1152 	u_char *dst;
1153 
1154 	m = src_arg;
1155 	dst = dst_arg;
1156 	while (len > 0) {
1157 		if (m == 0)
1158 			panic("bpf_mcopy");
1159 		count = min(m->m_len, len);
1160 		bcopy(mtod(m, caddr_t), (caddr_t)dst, count);
1161 		m = m->m_next;
1162 		dst += count;
1163 		len -= count;
1164 	}
1165 }
1166 
1167 /*
1168  * Incoming linkage from device drivers, when packet is in an mbuf chain.
1169  */
1170 void
1171 bpf_mtap(caddr_t arg, struct mbuf *m, u_int direction)
1172 {
1173 	struct bpf_if *bp = (struct bpf_if *)arg;
1174 	struct bpf_d *d;
1175 	size_t pktlen, slen;
1176 	struct mbuf *m0;
1177 
1178 	if (m == NULL)
1179 		return;
1180 
1181 	pktlen = 0;
1182 	for (m0 = m; m0 != 0; m0 = m0->m_next)
1183 		pktlen += m0->m_len;
1184 
1185 	for (d = bp->bif_dlist; d != 0; d = d->bd_next) {
1186 		++d->bd_rcount;
1187 		if ((direction & d->bd_dirfilt) != 0)
1188 			slen = 0;
1189 		else
1190 			slen = bpf_filter(d->bd_rfilter, (u_char *)m,
1191 			    pktlen, 0);
1192 
1193 		if (slen == 0)
1194 		    continue;
1195 
1196 		bpf_catchpacket(d, (u_char *)m, pktlen, slen, bpf_mcopy);
1197 		if (d->bd_fildrop)
1198 			m->m_flags |= M_FILDROP;
1199 	}
1200 }
1201 
1202 /*
1203  * Incoming linkage from device drivers, where we have a mbuf chain
1204  * but need to prepend some arbitrary header from a linear buffer.
1205  *
1206  * Con up a minimal dummy header to pacify bpf.  Allocate (only) a
1207  * struct m_hdr on the stack.  This is safe as bpf only reads from the
1208  * fields in this header that we initialize, and will not try to free
1209  * it or keep a pointer to it.
1210  */
1211 void
1212 bpf_mtap_hdr(caddr_t arg, caddr_t data, u_int dlen, struct mbuf *m,
1213     u_int direction)
1214 {
1215 	struct m_hdr mh;
1216 
1217 	mh.mh_flags = 0;
1218 	mh.mh_next = m;
1219 	mh.mh_len = dlen;
1220 	mh.mh_data = data;
1221 
1222 	bpf_mtap(arg, (struct mbuf *) &mh, direction);
1223 	m->m_flags |= mh.mh_flags & M_FILDROP;
1224 }
1225 
1226 /*
1227  * Incoming linkage from device drivers, where we have a mbuf chain
1228  * but need to prepend the address family.
1229  *
1230  * Con up a minimal dummy header to pacify bpf.  We allocate (only) a
1231  * struct m_hdr on the stack.  This is safe as bpf only reads from the
1232  * fields in this header that we initialize, and will not try to free
1233  * it or keep a pointer to it.
1234  */
1235 void
1236 bpf_mtap_af(caddr_t arg, u_int32_t af, struct mbuf *m, u_int direction)
1237 {
1238 	struct m_hdr mh;
1239 
1240 	mh.mh_flags = 0;
1241 	mh.mh_next = m;
1242 	mh.mh_len = 4;
1243 	mh.mh_data = (caddr_t)&af;
1244 
1245 	bpf_mtap(arg, (struct mbuf *) &mh, direction);
1246 	m->m_flags |= mh.mh_flags & M_FILDROP;
1247 }
1248 
1249 /*
1250  * Incoming linkage from device drivers, where we have a mbuf chain
1251  * but need to prepend a VLAN encapsulation header.
1252  *
1253  * Con up a minimal dummy header to pacify bpf.  Allocate (only) a
1254  * struct m_hdr on the stack.  This is safe as bpf only reads from the
1255  * fields in this header that we initialize, and will not try to free
1256  * it or keep a pointer to it.
1257  */
1258 void
1259 bpf_mtap_ether(caddr_t arg, struct mbuf *m, u_int direction)
1260 {
1261 #if NVLAN > 0
1262 	struct m_hdr mh;
1263 	struct ether_vlan_header evh;
1264 
1265 	if ((m->m_flags & M_VLANTAG) == 0)
1266 #endif
1267 	{
1268 		bpf_mtap(arg, m, direction);
1269 		return;
1270 	}
1271 
1272 #if NVLAN > 0
1273 	bcopy(mtod(m, char *), &evh, ETHER_HDR_LEN);
1274 	evh.evl_proto = evh.evl_encap_proto;
1275 	evh.evl_encap_proto = htons(ETHERTYPE_VLAN);
1276 	evh.evl_tag = htons(m->m_pkthdr.ether_vtag);
1277 	m->m_len -= ETHER_HDR_LEN;
1278 	m->m_data += ETHER_HDR_LEN;
1279 
1280 	mh.mh_flags = 0;
1281 	mh.mh_next = m;
1282 	mh.mh_len = sizeof(evh);
1283 	mh.mh_data = (caddr_t)&evh;
1284 
1285 	bpf_mtap(arg, (struct mbuf *) &mh, direction);
1286 	m->m_flags |= mh.mh_flags & M_FILDROP;
1287 
1288 	m->m_len += ETHER_HDR_LEN;
1289 	m->m_data -= ETHER_HDR_LEN;
1290 #endif
1291 }
1292 
1293 /*
1294  * Move the packet data from interface memory (pkt) into the
1295  * store buffer.  Return 1 if it's time to wakeup a listener (buffer full),
1296  * otherwise 0.  "copy" is the routine called to do the actual data
1297  * transfer.  bcopy is passed in to copy contiguous chunks, while
1298  * bpf_mcopy is passed in to copy mbuf chains.  In the latter case,
1299  * pkt is really an mbuf.
1300  */
1301 void
1302 bpf_catchpacket(struct bpf_d *d, u_char *pkt, size_t pktlen, size_t snaplen,
1303     void (*cpfn)(const void *, void *, size_t))
1304 {
1305 	struct bpf_hdr *hp;
1306 	int totlen, curlen;
1307 	int hdrlen = d->bd_bif->bif_hdrlen;
1308 	struct timeval tv;
1309 
1310 	/*
1311 	 * Figure out how many bytes to move.  If the packet is
1312 	 * greater or equal to the snapshot length, transfer that
1313 	 * much.  Otherwise, transfer the whole packet (unless
1314 	 * we hit the buffer size limit).
1315 	 */
1316 	totlen = hdrlen + min(snaplen, pktlen);
1317 	if (totlen > d->bd_bufsize)
1318 		totlen = d->bd_bufsize;
1319 
1320 	/*
1321 	 * Round up the end of the previous packet to the next longword.
1322 	 */
1323 	curlen = BPF_WORDALIGN(d->bd_slen);
1324 	if (curlen + totlen > d->bd_bufsize) {
1325 		/*
1326 		 * This packet will overflow the storage buffer.
1327 		 * Rotate the buffers if we can, then wakeup any
1328 		 * pending reads.
1329 		 */
1330 		if (d->bd_fbuf == 0) {
1331 			/*
1332 			 * We haven't completed the previous read yet,
1333 			 * so drop the packet.
1334 			 */
1335 			++d->bd_dcount;
1336 			return;
1337 		}
1338 		ROTATE_BUFFERS(d);
1339 		bpf_wakeup(d);
1340 		curlen = 0;
1341 	}
1342 
1343 	/*
1344 	 * Append the bpf header.
1345 	 */
1346 	hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1347 	microtime(&tv);
1348 	hp->bh_tstamp.tv_sec = tv.tv_sec;
1349 	hp->bh_tstamp.tv_usec = tv.tv_usec;
1350 	hp->bh_datalen = pktlen;
1351 	hp->bh_hdrlen = hdrlen;
1352 	/*
1353 	 * Copy the packet data into the store buffer and update its length.
1354 	 */
1355 	(*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1356 	d->bd_slen = curlen + totlen;
1357 
1358 	if (d->bd_immediate) {
1359 		/*
1360 		 * Immediate mode is set.  A packet arrived so any
1361 		 * reads should be woken up.
1362 		 */
1363 		bpf_wakeup(d);
1364 	}
1365 
1366 	if (d->bd_rdStart && (d->bd_rtout + d->bd_rdStart < ticks)) {
1367 		/*
1368 		 * we could be selecting on the bpf, and we
1369 		 * may have timeouts set.  We got here by getting
1370 		 * a packet, so wake up the reader.
1371 		 */
1372 		if (d->bd_fbuf) {
1373 			d->bd_rdStart = 0;
1374 			ROTATE_BUFFERS(d);
1375 			bpf_wakeup(d);
1376 		}
1377 	}
1378 }
1379 
1380 /*
1381  * Initialize all nonzero fields of a descriptor.
1382  */
1383 int
1384 bpf_allocbufs(struct bpf_d *d)
1385 {
1386 	d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_DEVBUF, M_NOWAIT);
1387 	if (d->bd_fbuf == NULL)
1388 		return (ENOBUFS);
1389 	d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_DEVBUF, M_NOWAIT);
1390 	if (d->bd_sbuf == NULL) {
1391 		free(d->bd_fbuf, M_DEVBUF);
1392 		return (ENOBUFS);
1393 	}
1394 	d->bd_slen = 0;
1395 	d->bd_hlen = 0;
1396 	return (0);
1397 }
1398 
1399 /*
1400  * Free buffers currently in use by a descriptor
1401  * when the reference count drops to zero.
1402  */
1403 void
1404 bpf_freed(struct bpf_d *d)
1405 {
1406 	if (--d->bd_ref > 0)
1407 		return;
1408 
1409 	if (d->bd_sbuf != 0) {
1410 		free(d->bd_sbuf, M_DEVBUF);
1411 		if (d->bd_hbuf != 0)
1412 			free(d->bd_hbuf, M_DEVBUF);
1413 		if (d->bd_fbuf != 0)
1414 			free(d->bd_fbuf, M_DEVBUF);
1415 	}
1416 	if (d->bd_rfilter)
1417 		free((caddr_t)d->bd_rfilter, M_DEVBUF);
1418 	if (d->bd_wfilter)
1419 		free((caddr_t)d->bd_wfilter, M_DEVBUF);
1420 
1421 	bpfilter_destroy(d);
1422 }
1423 
1424 /*
1425  * Attach an interface to bpf.  driverp is a pointer to a (struct bpf_if *)
1426  * in the driver's softc; dlt is the link layer type; hdrlen is the fixed
1427  * size of the link header (variable length headers not yet supported).
1428  */
1429 void
1430 bpfattach(caddr_t *driverp, struct ifnet *ifp, u_int dlt, u_int hdrlen)
1431 {
1432 	struct bpf_if *bp;
1433 	bp = (struct bpf_if *)malloc(sizeof(*bp), M_DEVBUF, M_DONTWAIT);
1434 
1435 	if (bp == 0)
1436 		panic("bpfattach");
1437 
1438 	bp->bif_dlist = 0;
1439 	bp->bif_driverp = (struct bpf_if **)driverp;
1440 	bp->bif_ifp = ifp;
1441 	bp->bif_dlt = dlt;
1442 
1443 	bp->bif_next = bpf_iflist;
1444 	bpf_iflist = bp;
1445 
1446 	*bp->bif_driverp = NULL;
1447 
1448 	/*
1449 	 * Compute the length of the bpf header.  This is not necessarily
1450 	 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1451 	 * that the network layer header begins on a longword boundary (for
1452 	 * performance reasons and to alleviate alignment restrictions).
1453 	 */
1454 	bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1455 }
1456 
1457 /* Detach an interface from its attached bpf device.  */
1458 void
1459 bpfdetach(struct ifnet *ifp)
1460 {
1461 	struct bpf_if *bp, *nbp, **pbp = &bpf_iflist;
1462 	struct bpf_d *bd;
1463 	int maj;
1464 
1465 	for (bp = bpf_iflist; bp; bp = nbp) {
1466 		nbp= bp->bif_next;
1467 		if (bp->bif_ifp == ifp) {
1468 			*pbp = nbp;
1469 
1470 			/* Locate the major number. */
1471 			for (maj = 0; maj < nchrdev; maj++)
1472 				if (cdevsw[maj].d_open == bpfopen)
1473 					break;
1474 
1475 			for (bd = bp->bif_dlist; bd; bd = bp->bif_dlist) {
1476 				struct bpf_d *d;
1477 
1478 				/*
1479 				 * Locate the minor number and nuke the vnode
1480 				 * for any open instance.
1481 				 */
1482 				LIST_FOREACH(d, &bpf_d_list, bd_list)
1483 					if (d == bd) {
1484 						vdevgone(maj, d->bd_unit,
1485 						    d->bd_unit, VCHR);
1486 						break;
1487 					}
1488 			}
1489 
1490 			free(bp, M_DEVBUF);
1491 		} else
1492 			pbp = &bp->bif_next;
1493 	}
1494 	ifp->if_bpf = NULL;
1495 }
1496 
1497 int
1498 bpf_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
1499     size_t newlen)
1500 {
1501 	int newval;
1502 	int error;
1503 
1504 	if (namelen != 1)
1505 		return (ENOTDIR);
1506 
1507 	switch (name[0]) {
1508 	case NET_BPF_BUFSIZE:
1509 		newval = bpf_bufsize;
1510 		error = sysctl_int(oldp, oldlenp, newp, newlen, &newval);
1511 		if (error)
1512 			return (error);
1513 		if (newval < BPF_MINBUFSIZE || newval > bpf_maxbufsize)
1514 			return (EINVAL);
1515 		bpf_bufsize = newval;
1516 		break;
1517 	case NET_BPF_MAXBUFSIZE:
1518 		newval = bpf_maxbufsize;
1519 		error = sysctl_int(oldp, oldlenp, newp, newlen, &newval);
1520 		if (error)
1521 			return (error);
1522 		if (newval < BPF_MINBUFSIZE)
1523 			return (EINVAL);
1524 		bpf_maxbufsize = newval;
1525 		break;
1526 	default:
1527 		return (EOPNOTSUPP);
1528 	}
1529 	return (0);
1530 }
1531 
1532 struct bpf_d *
1533 bpfilter_lookup(int unit)
1534 {
1535 	struct bpf_d *bd;
1536 
1537 	LIST_FOREACH(bd, &bpf_d_list, bd_list)
1538 		if (bd->bd_unit == unit)
1539 			return (bd);
1540 	return (NULL);
1541 }
1542 
1543 struct bpf_d *
1544 bpfilter_create(int unit)
1545 {
1546 	struct bpf_d *bd;
1547 
1548 	if ((bd = bpfilter_lookup(unit)) != NULL)
1549 		return (NULL);
1550 	if ((bd = malloc(sizeof(*bd), M_DEVBUF, M_NOWAIT|M_ZERO)) != NULL) {
1551 		bd->bd_unit = unit;
1552 		LIST_INSERT_HEAD(&bpf_d_list, bd, bd_list);
1553 	}
1554 	return (bd);
1555 }
1556 
1557 void
1558 bpfilter_destroy(struct bpf_d *bd)
1559 {
1560 	LIST_REMOVE(bd, bd_list);
1561 	free(bd, M_DEVBUF);
1562 }
1563 
1564 /*
1565  * Get a list of available data link type of the interface.
1566  */
1567 int
1568 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl)
1569 {
1570 	int n, error;
1571 	struct ifnet *ifp;
1572 	struct bpf_if *bp;
1573 
1574 	ifp = d->bd_bif->bif_ifp;
1575 	n = 0;
1576 	error = 0;
1577 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1578 		if (bp->bif_ifp != ifp)
1579 			continue;
1580 		if (bfl->bfl_list != NULL) {
1581 			if (n >= bfl->bfl_len)
1582 				return (ENOMEM);
1583 			error = copyout(&bp->bif_dlt,
1584 			    bfl->bfl_list + n, sizeof(u_int));
1585 			if (error)
1586 				break;
1587 		}
1588 		n++;
1589 	}
1590 
1591 	bfl->bfl_len = n;
1592 	return (error);
1593 }
1594 
1595 /*
1596  * Set the data link type of a BPF instance.
1597  */
1598 int
1599 bpf_setdlt(struct bpf_d *d, u_int dlt)
1600 {
1601 	int s;
1602 	struct ifnet *ifp;
1603 	struct bpf_if *bp;
1604 
1605 	if (d->bd_bif->bif_dlt == dlt)
1606 		return (0);
1607 	ifp = d->bd_bif->bif_ifp;
1608 	for (bp = bpf_iflist; bp != NULL; bp = bp->bif_next) {
1609 		if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1610 			break;
1611 	}
1612 	if (bp == NULL)
1613 		return (EINVAL);
1614 	s = splnet();
1615 	bpf_detachd(d);
1616 	bpf_attachd(d, bp);
1617 	bpf_reset_d(d);
1618 	splx(s);
1619 	return (0);
1620 }
1621