1 /* $OpenBSD: pf.c,v 1.18 2018/04/26 12:42:51 guenther Exp $ */ 2 3 /* 4 * Copyright (c) 1993-95 Mats O Jansson. All rights reserved. 5 * Copyright (c) 1990 The Regents of the University of California. 6 * All rights reserved. 7 * 8 * This code is partly derived from rarpd. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <sys/types.h> 32 #include <sys/time.h> 33 #include <sys/ioctl.h> 34 #include <sys/socket.h> 35 #include <sys/uio.h> 36 #include <net/if.h> 37 38 #include <net/bpf.h> 39 40 #include <netinet/in.h> 41 #include <netinet/if_ether.h> 42 43 #include <netdb.h> 44 #include <ctype.h> 45 #include <string.h> 46 #include <err.h> 47 #include <errno.h> 48 #include <fcntl.h> 49 #include <stdio.h> 50 #include <syslog.h> 51 #include <unistd.h> 52 53 #include "common/mopdef.h" 54 55 /* 56 * Variables 57 */ 58 59 extern int promisc; 60 61 /* 62 * Return information to device.c how to open device. 63 * In this case the driver can handle both Ethernet type II and 64 * IEEE 802.3 frames (SNAP) in a single pfOpen. 65 */ 66 /* ARGSUSED */ 67 int 68 pfTrans(char *interface) 69 { 70 return (TRANS_ETHER + TRANS_8023 + TRANS_AND); 71 } 72 73 /* 74 * Open and initialize packet filter. 75 */ 76 /* ARGSUSED */ 77 int 78 pfInit(char *interface, int mode, u_short protocol, int typ) 79 { 80 int fd; 81 struct ifreq ifr; 82 u_int dlt; 83 int immediate; 84 85 static struct bpf_insn insns[] = { 86 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 12), 87 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x4711, 4, 0), 88 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 20), 89 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x4711, 0, 3), 90 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 14), 91 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xaaaa, 0, 1), 92 BPF_STMT(BPF_RET | BPF_K, 1520), 93 BPF_STMT(BPF_RET | BPF_K, 0), 94 }; 95 static struct bpf_program filter = { 96 sizeof insns / sizeof(insns[0]), 97 insns 98 }; 99 100 if ((fd = open("/dev/bpf", mode)) == -1) { 101 syslog(LOG_ERR,"pfInit: open bpf %m"); 102 return (-1); 103 } 104 105 /* Set immediate mode so packets are processed as they arrive. */ 106 immediate = 1; 107 if (ioctl(fd, BIOCIMMEDIATE, &immediate) < 0) { 108 syslog(LOG_ERR,"pfInit: BIOCIMMEDIATE: %m"); 109 return (-1); 110 } 111 strncpy(ifr.ifr_name, interface, sizeof ifr.ifr_name); 112 if (ioctl(fd, BIOCSETIF, &ifr) < 0) { 113 syslog(LOG_ERR,"pfInit: BIOCSETIF: %m"); 114 return (-1); 115 } 116 /* Check that the data link layer is an Ethernet; this code won't work 117 * with anything else. */ 118 if (ioctl(fd, BIOCGDLT, &dlt) < 0) { 119 syslog(LOG_ERR,"pfInit: BIOCGDLT: %m"); 120 return (-1); 121 } 122 if (dlt != DLT_EN10MB) { 123 syslog(LOG_ERR,"pfInit: %s is not ethernet", interface); 124 return (-1); 125 } 126 if (promisc) 127 /* Set promiscuous mode. */ 128 if (ioctl(fd, BIOCPROMISC, 0) < 0) { 129 syslog(LOG_ERR,"pfInit: BIOCPROMISC: %m"); 130 return (-1); 131 } 132 133 /* Set filter program. */ 134 insns[1].k = protocol; 135 insns[3].k = protocol; 136 137 if (ioctl(fd, BIOCSETF, &filter) < 0) { 138 syslog(LOG_ERR,"pfInit: BIOCSETF: %m"); 139 return (-1); 140 } 141 142 /* XXX set the same write filter (for protocol only) */ 143 if (ioctl(fd, BIOCSETWF, &filter) < 0) { 144 syslog(LOG_ERR,"pfInit: BIOCSETWF: %m"); 145 return (-1); 146 } 147 148 /* Lock the interface to prevent further changes */ 149 if (ioctl(fd, BIOCLOCK) < 0) { 150 syslog(LOG_ERR,"pfInit: BIOCLOCK: %m"); 151 return (-1); 152 } 153 154 return (fd); 155 } 156 157 /* 158 * Add a Multicast address to the interface 159 */ 160 /* ARGSUSED */ 161 int 162 pfAddMulti(int s, char *interface, char *addr) 163 { 164 struct ifreq ifr; 165 int fd; 166 167 strncpy(ifr.ifr_name, interface, sizeof(ifr.ifr_name) - 1); 168 ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = 0; 169 170 ifr.ifr_addr.sa_family = AF_UNSPEC; 171 bcopy(addr, ifr.ifr_addr.sa_data, 6); 172 173 /* 174 * open a socket, temporarily, to use for SIOC* ioctls 175 */ 176 if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) { 177 syslog(LOG_ERR, "pfAddMulti: socket: %m"); 178 return (-1); 179 } 180 if (ioctl(fd, SIOCADDMULTI, &ifr) < 0) { 181 syslog(LOG_ERR, "pfAddMulti: SIOCADDMULTI: %m"); 182 close(fd); 183 return (-1); 184 } 185 close(fd); 186 187 return (0); 188 } 189 190 /* 191 * Delete a Multicast address from the interface 192 */ 193 /* ARGSUSED */ 194 int 195 pfDelMulti(int s, char *interface, char *addr) 196 { 197 struct ifreq ifr; 198 int fd; 199 200 strncpy(ifr.ifr_name, interface, sizeof (ifr.ifr_name) - 1); 201 ifr.ifr_name[sizeof(ifr.ifr_name)-1] = 0; 202 203 ifr.ifr_addr.sa_family = AF_UNSPEC; 204 bcopy(addr, ifr.ifr_addr.sa_data, 6); 205 206 /* 207 * open a socket, temporarily, to use for SIOC* ioctls 208 * 209 */ 210 if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) { 211 syslog(LOG_ERR, "pfDelMulti: socket: %m"); 212 return (-1); 213 } 214 if (ioctl(fd, SIOCDELMULTI, &ifr) < 0) { 215 syslog(LOG_ERR, "pfAddMulti: SIOCDELMULTI: %m"); 216 close(fd); 217 return (-1); 218 } 219 close(fd); 220 221 return (0); 222 } 223 224 /* 225 * read a packet 226 */ 227 int 228 pfRead(int fd, u_char *buf, int len) 229 { 230 return (read(fd, buf, len)); 231 } 232 233 /* 234 * write a packet 235 */ 236 int 237 pfWrite(int fd, u_char *buf, int len, int trans) 238 { 239 struct iovec iov[2]; 240 241 /* XXX */ 242 switch (trans) { 243 case TRANS_8023: 244 iov[0].iov_base = buf; 245 iov[0].iov_len = 22; 246 iov[1].iov_base = buf + 22; 247 iov[1].iov_len = len - 22; 248 break; 249 default: 250 iov[0].iov_base = buf; 251 iov[0].iov_len = 14; 252 iov[1].iov_base = buf + 14; 253 iov[1].iov_len = len - 14; 254 break; 255 } 256 257 if (writev(fd, iov, 2) == len) 258 return (len); 259 260 return (-1); 261 } 262 263