2 * Copyright (c) 1990, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
5 * This code is derived from the Stanford/CMU enet packet filter,
6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 4. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * @(#)bpf.c 8.4 (Berkeley) 1/9/95
41 #include "opt_netgraph.h"
43 #include <sys/types.h>
44 #include <sys/param.h>
45 #include <sys/systm.h>
47 #include <sys/fcntl.h>
48 #include <sys/malloc.h>
53 #include <sys/signalvar.h>
54 #include <sys/filio.h>
55 #include <sys/sockio.h>
56 #include <sys/ttycom.h>
59 #include <sys/event.h>
64 #include <sys/socket.h>
69 #include <net/bpf_jitter.h>
71 #include <net/bpfdesc.h>
73 #include <netinet/in.h>
74 #include <netinet/if_ether.h>
75 #include <sys/kernel.h>
76 #include <sys/sysctl.h>
78 #include <net80211/ieee80211_freebsd.h>
80 #include <security/mac/mac_framework.h>
82 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
84 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)
86 #define PRINET 26 /* interruptible */
89 * bpf_iflist is a list of BPF interface structures, each corresponding to a
90 * specific DLT. The same network interface might have several BPF interface
91 * structures registered by different layers in the stack (i.e., 802.11
92 * frames, ethernet frames, etc).
94 static LIST_HEAD(, bpf_if) bpf_iflist;
95 static struct mtx bpf_mtx; /* bpf global lock */
96 static int bpf_bpfd_cnt;
98 static void bpf_allocbufs(struct bpf_d *);
99 static void bpf_attachd(struct bpf_d *, struct bpf_if *);
100 static void bpf_detachd(struct bpf_d *);
101 static void bpf_freed(struct bpf_d *);
102 static void bpf_mcopy(const void *, void *, size_t);
103 static int bpf_movein(struct uio *, int, struct ifnet *, struct mbuf **,
104 struct sockaddr *, int *, struct bpf_insn *);
105 static int bpf_setif(struct bpf_d *, struct ifreq *);
106 static void bpf_timed_out(void *);
108 bpf_wakeup(struct bpf_d *);
109 static void catchpacket(struct bpf_d *, u_char *, u_int,
110 u_int, void (*)(const void *, void *, size_t),
112 static void reset_d(struct bpf_d *);
113 static int bpf_setf(struct bpf_d *, struct bpf_program *, u_long cmd);
114 static int bpf_getdltlist(struct bpf_d *, struct bpf_dltlist *);
115 static int bpf_setdlt(struct bpf_d *, u_int);
116 static void filt_bpfdetach(struct knote *);
117 static int filt_bpfread(struct knote *, long);
118 static void bpf_drvinit(void *);
119 static void bpf_clone(void *, struct ucred *, char *, int, struct cdev **);
120 static int bpf_stats_sysctl(SYSCTL_HANDLER_ARGS);
122 SYSCTL_NODE(_net, OID_AUTO, bpf, CTLFLAG_RW, 0, "bpf sysctl");
123 static int bpf_bufsize = 4096;
124 SYSCTL_INT(_net_bpf, OID_AUTO, bufsize, CTLFLAG_RW,
125 &bpf_bufsize, 0, "Default bpf buffer size");
126 static int bpf_maxbufsize = BPF_MAXBUFSIZE;
127 SYSCTL_INT(_net_bpf, OID_AUTO, maxbufsize, CTLFLAG_RW,
128 &bpf_maxbufsize, 0, "Maximum bpf buffer size");
129 static int bpf_maxinsns = BPF_MAXINSNS;
130 SYSCTL_INT(_net_bpf, OID_AUTO, maxinsns, CTLFLAG_RW,
131 &bpf_maxinsns, 0, "Maximum bpf program instructions");
132 SYSCTL_NODE(_net_bpf, OID_AUTO, stats, CTLFLAG_MPSAFE | CTLFLAG_RW,
133 bpf_stats_sysctl, "bpf statistics portal");
135 static d_open_t bpfopen;
136 static d_close_t bpfclose;
137 static d_read_t bpfread;
138 static d_write_t bpfwrite;
139 static d_ioctl_t bpfioctl;
140 static d_poll_t bpfpoll;
141 static d_kqfilter_t bpfkqfilter;
143 static struct cdevsw bpf_cdevsw = {
144 .d_version = D_VERSION,
145 .d_flags = D_TRACKCLOSE,
153 .d_kqfilter = bpfkqfilter,
156 static struct filterops bpfread_filtops =
157 { 1, NULL, filt_bpfdetach, filt_bpfread };
160 bpf_movein(struct uio *uio, int linktype, struct ifnet *ifp, struct mbuf **mp,
161 struct sockaddr *sockp, int *hdrlen, struct bpf_insn *wfilter)
163 const struct ieee80211_bpf_params *p;
164 struct ether_header *eh;
172 * Build a sockaddr based on the data link layer type.
173 * We do this at this level because the ethernet header
174 * is copied directly into the data field of the sockaddr.
175 * In the case of SLIP, there is no header and the packet
176 * is forwarded as is.
177 * Also, we are careful to leave room at the front of the mbuf
178 * for the link level header.
183 sockp->sa_family = AF_INET;
188 sockp->sa_family = AF_UNSPEC;
189 /* XXX Would MAXLINKHDR be better? */
190 hlen = ETHER_HDR_LEN;
194 sockp->sa_family = AF_IMPLINK;
199 sockp->sa_family = AF_UNSPEC;
205 * null interface types require a 4 byte pseudo header which
206 * corresponds to the address family of the packet.
208 sockp->sa_family = AF_UNSPEC;
212 case DLT_ATM_RFC1483:
214 * en atm driver requires 4-byte atm pseudo header.
215 * though it isn't standard, vpi:vci needs to be
218 sockp->sa_family = AF_UNSPEC;
219 hlen = 12; /* XXX 4(ATM_PH) + 3(LLC) + 5(SNAP) */
223 sockp->sa_family = AF_UNSPEC;
224 hlen = 4; /* This should match PPP_HDRLEN */
227 case DLT_IEEE802_11: /* IEEE 802.11 wireless */
228 sockp->sa_family = AF_IEEE80211;
232 case DLT_IEEE802_11_RADIO: /* IEEE 802.11 wireless w/ phy params */
233 sockp->sa_family = AF_IEEE80211;
234 sockp->sa_len = 12; /* XXX != 0 */
235 hlen = sizeof(struct ieee80211_bpf_params);
242 len = uio->uio_resid;
244 if (len - hlen > ifp->if_mtu)
247 if ((unsigned)len > MJUM16BYTES)
251 MGETHDR(m, M_TRYWAIT, MT_DATA);
252 else if (len <= MCLBYTES)
253 m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR);
255 m = m_getjcl(M_TRYWAIT, MT_DATA, M_PKTHDR,
256 #if (MJUMPAGESIZE > MCLBYTES)
257 len <= MJUMPAGESIZE ? MJUMPAGESIZE :
259 (len <= MJUM9BYTES ? MJUM9BYTES : MJUM16BYTES));
262 m->m_pkthdr.len = m->m_len = len;
263 m->m_pkthdr.rcvif = NULL;
266 if (m->m_len < hlen) {
271 error = uiomove(mtod(m, u_char *), len, uio);
275 slen = bpf_filter(wfilter, mtod(m, u_char *), len, len);
281 /* Check for multicast destination */
284 eh = mtod(m, struct ether_header *);
285 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
286 if (bcmp(ifp->if_broadcastaddr, eh->ether_dhost,
287 ETHER_ADDR_LEN) == 0)
288 m->m_flags |= M_BCAST;
290 m->m_flags |= M_MCAST;
296 * Make room for link header, and copy it to sockaddr
299 if (sockp->sa_family == AF_IEEE80211) {
301 * Collect true length from the parameter header
302 * NB: sockp is known to be zero'd so if we do a
303 * short copy unspecified parameters will be
305 * NB: packet may not be aligned after stripping
309 p = mtod(m, const struct ieee80211_bpf_params *);
311 if (hlen > sizeof(sockp->sa_data)) {
316 bcopy(m->m_data, sockp->sa_data, hlen);
327 * Attach file to the bpf interface, i.e. make d listen on bp.
330 bpf_attachd(struct bpf_d *d, struct bpf_if *bp)
333 * Point d at bp, and add d to the interface's list of listeners.
334 * Finally, point the driver's bpf cookie at the interface so
335 * it will divert packets to bpf.
339 LIST_INSERT_HEAD(&bp->bif_dlist, d, bd_next);
346 * Detach a file from its interface.
349 bpf_detachd(struct bpf_d *d)
358 ifp = d->bd_bif->bif_ifp;
361 * Remove d from the interface's descriptor list.
363 LIST_REMOVE(d, bd_next);
371 * Check if this descriptor had requested promiscuous mode.
372 * If so, turn it off.
376 error = ifpromisc(ifp, 0);
377 if (error != 0 && error != ENXIO) {
379 * ENXIO can happen if a pccard is unplugged
380 * Something is really wrong if we were able to put
381 * the driver into promiscuous mode, but can't
384 if_printf(bp->bif_ifp,
385 "bpf_detach: ifpromisc failed (%d)\n", error);
391 * Open ethernet device. Returns ENXIO for illegal minor device number,
392 * EBUSY if file is open by another process.
396 bpfopen(struct cdev *dev, int flags, int fmt, struct thread *td)
403 * Each minor can be opened by only one process. If the requested
404 * minor is in use, return EBUSY.
407 mtx_unlock(&bpf_mtx);
410 dev->si_drv1 = (struct bpf_d *)~0; /* mark device in use */
411 mtx_unlock(&bpf_mtx);
413 if ((dev->si_flags & SI_NAMED) == 0)
414 make_dev(&bpf_cdevsw, minor(dev), UID_ROOT, GID_WHEEL, 0600,
415 "bpf%d", dev2unit(dev));
416 MALLOC(d, struct bpf_d *, sizeof(*d), M_BPF, M_WAITOK | M_ZERO);
418 d->bd_bufsize = bpf_bufsize;
420 d->bd_direction = BPF_D_INOUT;
421 d->bd_pid = td->td_proc->p_pid;
424 mac_create_bpfdesc(td->td_ucred, d);
426 mtx_init(&d->bd_mtx, devtoname(dev), "bpf cdev lock", MTX_DEF);
427 callout_init(&d->bd_callout, CALLOUT_MPSAFE);
428 knlist_init(&d->bd_sel.si_note, &d->bd_mtx, NULL, NULL, NULL);
434 * Close the descriptor by detaching it from its interface,
435 * deallocating its buffers, and marking it free.
439 bpfclose(struct cdev *dev, int flags, int fmt, struct thread *td)
441 struct bpf_d *d = dev->si_drv1;
444 if (d->bd_state == BPF_WAITING)
445 callout_stop(&d->bd_callout);
446 d->bd_state = BPF_IDLE;
448 funsetown(&d->bd_sigio);
452 mtx_unlock(&bpf_mtx);
453 selwakeuppri(&d->bd_sel, PRINET);
455 mac_destroy_bpfdesc(d);
457 knlist_destroy(&d->bd_sel.si_note);
467 * Rotate the packet buffers in descriptor d. Move the store buffer
468 * into the hold slot, and the free buffer into the store slot.
469 * Zero the length of the new store buffer.
471 #define ROTATE_BUFFERS(d) \
472 (d)->bd_hbuf = (d)->bd_sbuf; \
473 (d)->bd_hlen = (d)->bd_slen; \
474 (d)->bd_sbuf = (d)->bd_fbuf; \
478 * bpfread - read next chunk of packets from buffers
481 bpfread(struct cdev *dev, struct uio *uio, int ioflag)
483 struct bpf_d *d = dev->si_drv1;
488 * Restrict application to use a buffer the same size as
491 if (uio->uio_resid != d->bd_bufsize)
495 d->bd_pid = curthread->td_proc->p_pid;
496 if (d->bd_state == BPF_WAITING)
497 callout_stop(&d->bd_callout);
498 timed_out = (d->bd_state == BPF_TIMED_OUT);
499 d->bd_state = BPF_IDLE;
501 * If the hold buffer is empty, then do a timed sleep, which
502 * ends when the timeout expires or when enough packets
503 * have arrived to fill the store buffer.
505 while (d->bd_hbuf == NULL) {
506 if ((d->bd_immediate || timed_out) && d->bd_slen != 0) {
508 * A packet(s) either arrived since the previous
509 * read or arrived while we were asleep.
510 * Rotate the buffers and return what's here.
517 * No data is available, check to see if the bpf device
518 * is still pointed at a real interface. If not, return
519 * ENXIO so that the userland process knows to rebind
520 * it before using it again.
522 if (d->bd_bif == NULL) {
527 if (ioflag & O_NONBLOCK) {
529 return (EWOULDBLOCK);
531 error = msleep(d, &d->bd_mtx, PRINET|PCATCH,
533 if (error == EINTR || error == ERESTART) {
537 if (error == EWOULDBLOCK) {
539 * On a timeout, return what's in the buffer,
540 * which may be nothing. If there is something
541 * in the store buffer, we can rotate the buffers.
545 * We filled up the buffer in between
546 * getting the timeout and arriving
547 * here, so we don't need to rotate.
551 if (d->bd_slen == 0) {
560 * At this point, we know we have something in the hold slot.
565 * Move data from hold buffer into user space.
566 * We know the entire buffer is transferred since
567 * we checked above that the read buffer is bpf_bufsize bytes.
569 * XXXRW: More synchronization needed here: what if a second thread
570 * issues a read on the same fd at the same time? Don't want this
571 * getting invalidated.
573 error = uiomove(d->bd_hbuf, d->bd_hlen, uio);
576 d->bd_fbuf = d->bd_hbuf;
585 * If there are processes sleeping on this descriptor, wake them up.
588 bpf_wakeup(struct bpf_d *d)
592 if (d->bd_state == BPF_WAITING) {
593 callout_stop(&d->bd_callout);
594 d->bd_state = BPF_IDLE;
597 if (d->bd_async && d->bd_sig && d->bd_sigio)
598 pgsigio(&d->bd_sigio, d->bd_sig, 0);
600 selwakeuppri(&d->bd_sel, PRINET);
601 KNOTE_LOCKED(&d->bd_sel.si_note, 0);
605 bpf_timed_out(void *arg)
607 struct bpf_d *d = (struct bpf_d *)arg;
610 if (d->bd_state == BPF_WAITING) {
611 d->bd_state = BPF_TIMED_OUT;
619 bpfwrite(struct cdev *dev, struct uio *uio, int ioflag)
621 struct bpf_d *d = dev->si_drv1;
627 d->bd_pid = curthread->td_proc->p_pid;
628 if (d->bd_bif == NULL)
631 ifp = d->bd_bif->bif_ifp;
633 if ((ifp->if_flags & IFF_UP) == 0)
636 if (uio->uio_resid == 0)
639 bzero(&dst, sizeof(dst));
642 error = bpf_movein(uio, (int)d->bd_bif->bif_dlt, ifp,
643 &m, &dst, &hlen, d->bd_wfilter);
648 dst.sa_family = pseudo_AF_HDRCMPLT;
650 if (d->bd_feedback) {
651 mc = m_dup(m, M_DONTWAIT);
653 mc->m_pkthdr.rcvif = ifp;
654 /* Set M_PROMISC for outgoing packets to be discarded. */
655 if (d->bd_direction == BPF_D_INOUT)
656 m->m_flags |= M_PROMISC;
660 m->m_pkthdr.len -= hlen;
662 m->m_data += hlen; /* XXX */
666 mac_create_mbuf_from_bpfdesc(d, m);
668 mac_create_mbuf_from_bpfdesc(d, mc);
672 error = (*ifp->if_output)(ifp, m, &dst, NULL);
676 (*ifp->if_input)(ifp, mc);
685 * Reset a descriptor by flushing its packet buffer and clearing the
686 * receive and drop counts.
689 reset_d(struct bpf_d *d)
692 mtx_assert(&d->bd_mtx, MA_OWNED);
694 /* Free the hold buffer. */
695 d->bd_fbuf = d->bd_hbuf;
706 * FIONREAD Check for read packet available.
707 * SIOCGIFADDR Get interface address - convenient hook to driver.
708 * BIOCGBLEN Get buffer len [for read()].
709 * BIOCSETF Set read filter.
710 * BIOCSETFNR Set read filter without resetting descriptor.
711 * BIOCSETWF Set write filter.
712 * BIOCFLUSH Flush read packet buffer.
713 * BIOCPROMISC Put interface into promiscuous mode.
714 * BIOCGDLT Get link layer type.
715 * BIOCGETIF Get interface name.
716 * BIOCSETIF Set interface.
717 * BIOCSRTIMEOUT Set read timeout.
718 * BIOCGRTIMEOUT Get read timeout.
719 * BIOCGSTATS Get packet stats.
720 * BIOCIMMEDIATE Set immediate mode.
721 * BIOCVERSION Get filter language version.
722 * BIOCGHDRCMPLT Get "header already complete" flag
723 * BIOCSHDRCMPLT Set "header already complete" flag
724 * BIOCGDIRECTION Get packet direction flag
725 * BIOCSDIRECTION Set packet direction flag
726 * BIOCLOCK Set "locked" flag
727 * BIOCFEEDBACK Set packet feedback mode.
731 bpfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags,
734 struct bpf_d *d = dev->si_drv1;
738 * Refresh PID associated with this descriptor.
741 d->bd_pid = td->td_proc->p_pid;
742 if (d->bd_state == BPF_WAITING)
743 callout_stop(&d->bd_callout);
744 d->bd_state = BPF_IDLE;
747 if (d->bd_locked == 1) {
777 * Check for read packet available.
797 if (d->bd_bif == NULL)
800 ifp = d->bd_bif->bif_ifp;
801 error = (*ifp->if_ioctl)(ifp, cmd, addr);
807 * Get buffer len [for read()].
810 *(u_int *)addr = d->bd_bufsize;
817 if (d->bd_bif != NULL)
820 u_int size = *(u_int *)addr;
822 if (size > bpf_maxbufsize)
823 *(u_int *)addr = size = bpf_maxbufsize;
824 else if (size < BPF_MINBUFSIZE)
825 *(u_int *)addr = size = BPF_MINBUFSIZE;
826 d->bd_bufsize = size;
831 * Set link layer read filter.
836 error = bpf_setf(d, (struct bpf_program *)addr, cmd);
840 * Flush read packet buffer.
849 * Put interface into promiscuous mode.
852 if (d->bd_bif == NULL) {
854 * No interface attached yet.
859 if (d->bd_promisc == 0) {
860 error = ifpromisc(d->bd_bif->bif_ifp, 1);
867 * Get current data link type.
870 if (d->bd_bif == NULL)
873 *(u_int *)addr = d->bd_bif->bif_dlt;
877 * Get a list of supported data link types.
880 if (d->bd_bif == NULL)
883 error = bpf_getdltlist(d, (struct bpf_dltlist *)addr);
887 * Set data link type.
890 if (d->bd_bif == NULL)
893 error = bpf_setdlt(d, *(u_int *)addr);
897 * Get interface name.
900 if (d->bd_bif == NULL)
903 struct ifnet *const ifp = d->bd_bif->bif_ifp;
904 struct ifreq *const ifr = (struct ifreq *)addr;
906 strlcpy(ifr->ifr_name, ifp->if_xname,
907 sizeof(ifr->ifr_name));
915 error = bpf_setif(d, (struct ifreq *)addr);
923 struct timeval *tv = (struct timeval *)addr;
926 * Subtract 1 tick from tvtohz() since this isn't
929 if ((error = itimerfix(tv)) == 0)
930 d->bd_rtout = tvtohz(tv) - 1;
939 struct timeval *tv = (struct timeval *)addr;
941 tv->tv_sec = d->bd_rtout / hz;
942 tv->tv_usec = (d->bd_rtout % hz) * tick;
951 struct bpf_stat *bs = (struct bpf_stat *)addr;
953 bs->bs_recv = d->bd_rcount;
954 bs->bs_drop = d->bd_dcount;
959 * Set immediate mode.
962 d->bd_immediate = *(u_int *)addr;
967 struct bpf_version *bv = (struct bpf_version *)addr;
969 bv->bv_major = BPF_MAJOR_VERSION;
970 bv->bv_minor = BPF_MINOR_VERSION;
975 * Get "header already complete" flag
978 *(u_int *)addr = d->bd_hdrcmplt;
982 * Set "header already complete" flag
985 d->bd_hdrcmplt = *(u_int *)addr ? 1 : 0;
989 * Get packet direction flag
992 *(u_int *)addr = d->bd_direction;
996 * Set packet direction flag
1002 direction = *(u_int *)addr;
1003 switch (direction) {
1007 d->bd_direction = direction;
1016 d->bd_feedback = *(u_int *)addr;
1023 case FIONBIO: /* Non-blocking I/O */
1026 case FIOASYNC: /* Send signal on receive packets */
1027 d->bd_async = *(int *)addr;
1031 error = fsetown(*(int *)addr, &d->bd_sigio);
1035 *(int *)addr = fgetown(&d->bd_sigio);
1038 /* This is deprecated, FIOSETOWN should be used instead. */
1040 error = fsetown(-(*(int *)addr), &d->bd_sigio);
1043 /* This is deprecated, FIOGETOWN should be used instead. */
1045 *(int *)addr = -fgetown(&d->bd_sigio);
1048 case BIOCSRSIG: /* Set receive signal */
1052 sig = *(u_int *)addr;
1061 *(u_int *)addr = d->bd_sig;
1068 * Set d's packet filter program to fp. If this file already has a filter,
1069 * free it and replace it. Returns EINVAL for bogus requests.
1072 bpf_setf(struct bpf_d *d, struct bpf_program *fp, u_long cmd)
1074 struct bpf_insn *fcode, *old;
1075 u_int wfilter, flen, size;
1077 bpf_jit_filter *ofunc;
1080 if (cmd == BIOCSETWF) {
1081 old = d->bd_wfilter;
1088 old = d->bd_rfilter;
1090 ofunc = d->bd_bfilter;
1093 if (fp->bf_insns == NULL) {
1094 if (fp->bf_len != 0)
1098 d->bd_wfilter = NULL;
1100 d->bd_rfilter = NULL;
1102 d->bd_bfilter = NULL;
1104 if (cmd == BIOCSETF)
1109 free((caddr_t)old, M_BPF);
1112 bpf_destroy_jit_filter(ofunc);
1117 if (flen > bpf_maxinsns)
1120 size = flen * sizeof(*fp->bf_insns);
1121 fcode = (struct bpf_insn *)malloc(size, M_BPF, M_WAITOK);
1122 if (copyin((caddr_t)fp->bf_insns, (caddr_t)fcode, size) == 0 &&
1123 bpf_validate(fcode, (int)flen)) {
1126 d->bd_wfilter = fcode;
1128 d->bd_rfilter = fcode;
1130 d->bd_bfilter = bpf_jitter(fcode, flen);
1132 if (cmd == BIOCSETF)
1137 free((caddr_t)old, M_BPF);
1140 bpf_destroy_jit_filter(ofunc);
1145 free((caddr_t)fcode, M_BPF);
1150 * Detach a file from its current interface (if attached at all) and attach
1151 * to the interface indicated by the name stored in ifr.
1152 * Return an errno or 0.
1155 bpf_setif(struct bpf_d *d, struct ifreq *ifr)
1158 struct ifnet *theywant;
1160 theywant = ifunit(ifr->ifr_name);
1161 if (theywant == NULL || theywant->if_bpf == NULL)
1164 bp = theywant->if_bpf;
1166 * Allocate the packet buffers if we need to.
1167 * If we're already attached to requested interface,
1168 * just flush the buffer.
1170 if (d->bd_sbuf == NULL)
1172 if (bp != d->bd_bif) {
1175 * Detach if attached to something else.
1188 * Support for select() and poll() system calls
1190 * Return true iff the specific operation will not block indefinitely.
1191 * Otherwise, return false but make a note that a selwakeup() must be done.
1194 bpfpoll(struct cdev *dev, int events, struct thread *td)
1200 if (d->bd_bif == NULL)
1204 * Refresh PID associated with this descriptor.
1206 revents = events & (POLLOUT | POLLWRNORM);
1208 d->bd_pid = td->td_proc->p_pid;
1209 if (events & (POLLIN | POLLRDNORM)) {
1211 revents |= events & (POLLIN | POLLRDNORM);
1213 selrecord(td, &d->bd_sel);
1214 /* Start the read timeout if necessary. */
1215 if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1216 callout_reset(&d->bd_callout, d->bd_rtout,
1218 d->bd_state = BPF_WAITING;
1227 * Support for kevent() system call. Register EVFILT_READ filters and
1228 * reject all others.
1231 bpfkqfilter(struct cdev *dev, struct knote *kn)
1233 struct bpf_d *d = (struct bpf_d *)dev->si_drv1;
1235 if (kn->kn_filter != EVFILT_READ)
1239 * Refresh PID associated with this descriptor.
1242 d->bd_pid = curthread->td_proc->p_pid;
1243 kn->kn_fop = &bpfread_filtops;
1245 knlist_add(&d->bd_sel.si_note, kn, 1);
1252 filt_bpfdetach(struct knote *kn)
1254 struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1256 knlist_remove(&d->bd_sel.si_note, kn, 0);
1260 filt_bpfread(struct knote *kn, long hint)
1262 struct bpf_d *d = (struct bpf_d *)kn->kn_hook;
1265 BPFD_LOCK_ASSERT(d);
1266 ready = bpf_ready(d);
1268 kn->kn_data = d->bd_slen;
1270 kn->kn_data += d->bd_hlen;
1272 else if (d->bd_rtout > 0 && d->bd_state == BPF_IDLE) {
1273 callout_reset(&d->bd_callout, d->bd_rtout,
1275 d->bd_state = BPF_WAITING;
1282 * Incoming linkage from device drivers. Process the packet pkt, of length
1283 * pktlen, which is stored in a contiguous buffer. The packet is parsed
1284 * by each process' filter, and if accepted, stashed into the corresponding
1288 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
1297 LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1301 if (bpf_jitter_enable != 0 && d->bd_bfilter != NULL)
1302 slen = (*(d->bd_bfilter->func))(pkt, pktlen, pktlen);
1305 slen = bpf_filter(d->bd_rfilter, pkt, pktlen, pktlen);
1313 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1315 catchpacket(d, pkt, pktlen, slen, bcopy, &tv);
1323 * Copy data from an mbuf chain into a buffer. This code is derived
1324 * from m_copydata in sys/uipc_mbuf.c.
1327 bpf_mcopy(const void *src_arg, void *dst_arg, size_t len)
1329 const struct mbuf *m;
1338 count = min(m->m_len, len);
1339 bcopy(mtod(m, void *), dst, count);
1346 #define BPF_CHECK_DIRECTION(d, r, i) \
1347 (((d)->bd_direction == BPF_D_IN && (r) != (i)) || \
1348 ((d)->bd_direction == BPF_D_OUT && (r) == (i)))
1351 * Incoming linkage from device drivers, when packet is in an mbuf chain.
1354 bpf_mtap(struct bpf_if *bp, struct mbuf *m)
1361 /* Skip outgoing duplicate packets. */
1362 if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
1363 m->m_flags &= ~M_PROMISC;
1369 pktlen = m_length(m, NULL);
1372 LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1373 if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
1378 /* XXX We cannot handle multiple mbufs. */
1379 if (bpf_jitter_enable != 0 && d->bd_bfilter != NULL &&
1381 slen = (*(d->bd_bfilter->func))(mtod(m, u_char *),
1385 slen = bpf_filter(d->bd_rfilter, (u_char *)m, pktlen, 0);
1393 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1395 catchpacket(d, (u_char *)m, pktlen, slen,
1404 * Incoming linkage from device drivers, when packet is in
1405 * an mbuf chain and to be prepended by a contiguous header.
1408 bpf_mtap2(struct bpf_if *bp, void *data, u_int dlen, struct mbuf *m)
1416 /* Skip outgoing duplicate packets. */
1417 if ((m->m_flags & M_PROMISC) != 0 && m->m_pkthdr.rcvif == NULL) {
1418 m->m_flags &= ~M_PROMISC;
1424 pktlen = m_length(m, NULL);
1426 * Craft on-stack mbuf suitable for passing to bpf_filter.
1427 * Note that we cut corners here; we only setup what's
1428 * absolutely needed--this mbuf should never go anywhere else.
1436 LIST_FOREACH(d, &bp->bif_dlist, bd_next) {
1437 if (BPF_CHECK_DIRECTION(d, m->m_pkthdr.rcvif, bp->bif_ifp))
1441 slen = bpf_filter(d->bd_rfilter, (u_char *)&mb, pktlen, 0);
1449 if (mac_check_bpfdesc_receive(d, bp->bif_ifp) == 0)
1451 catchpacket(d, (u_char *)&mb, pktlen, slen,
1459 #undef BPF_CHECK_DIRECTION
1462 * Move the packet data from interface memory (pkt) into the
1463 * store buffer. "cpfn" is the routine called to do the actual data
1464 * transfer. bcopy is passed in to copy contiguous chunks, while
1465 * bpf_mcopy is passed in to copy mbuf chains. In the latter case,
1466 * pkt is really an mbuf.
1469 catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
1470 void (*cpfn)(const void *, void *, size_t), struct timeval *tv)
1474 int hdrlen = d->bd_bif->bif_hdrlen;
1477 BPFD_LOCK_ASSERT(d);
1479 * Figure out how many bytes to move. If the packet is
1480 * greater or equal to the snapshot length, transfer that
1481 * much. Otherwise, transfer the whole packet (unless
1482 * we hit the buffer size limit).
1484 totlen = hdrlen + min(snaplen, pktlen);
1485 if (totlen > d->bd_bufsize)
1486 totlen = d->bd_bufsize;
1489 * Round up the end of the previous packet to the next longword.
1491 curlen = BPF_WORDALIGN(d->bd_slen);
1492 if (curlen + totlen > d->bd_bufsize) {
1494 * This packet will overflow the storage buffer.
1495 * Rotate the buffers if we can, then wakeup any
1498 if (d->bd_fbuf == NULL) {
1500 * We haven't completed the previous read yet,
1501 * so drop the packet.
1510 else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
1512 * Immediate mode is set, or the read timeout has
1513 * already expired during a select call. A packet
1514 * arrived, so the reader should be woken up.
1519 * Append the bpf header.
1521 hp = (struct bpf_hdr *)(d->bd_sbuf + curlen);
1522 hp->bh_tstamp = *tv;
1523 hp->bh_datalen = pktlen;
1524 hp->bh_hdrlen = hdrlen;
1526 * Copy the packet data into the store buffer and update its length.
1528 (*cpfn)(pkt, (u_char *)hp + hdrlen, (hp->bh_caplen = totlen - hdrlen));
1529 d->bd_slen = curlen + totlen;
1536 * Initialize all nonzero fields of a descriptor.
1539 bpf_allocbufs(struct bpf_d *d)
1542 KASSERT(d->bd_fbuf == NULL, ("bpf_allocbufs: bd_fbuf != NULL"));
1543 KASSERT(d->bd_sbuf == NULL, ("bpf_allocbufs: bd_sbuf != NULL"));
1544 KASSERT(d->bd_hbuf == NULL, ("bpf_allocbufs: bd_hbuf != NULL"));
1546 d->bd_fbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1547 d->bd_sbuf = (caddr_t)malloc(d->bd_bufsize, M_BPF, M_WAITOK);
1553 * Free buffers currently in use by a descriptor.
1557 bpf_freed(struct bpf_d *d)
1560 * We don't need to lock out interrupts since this descriptor has
1561 * been detached from its interface and it yet hasn't been marked
1564 if (d->bd_sbuf != NULL) {
1565 free(d->bd_sbuf, M_BPF);
1566 if (d->bd_hbuf != NULL)
1567 free(d->bd_hbuf, M_BPF);
1568 if (d->bd_fbuf != NULL)
1569 free(d->bd_fbuf, M_BPF);
1571 if (d->bd_rfilter) {
1572 free((caddr_t)d->bd_rfilter, M_BPF);
1574 bpf_destroy_jit_filter(d->bd_bfilter);
1578 free((caddr_t)d->bd_wfilter, M_BPF);
1579 mtx_destroy(&d->bd_mtx);
1583 * Attach an interface to bpf. dlt is the link layer type; hdrlen is the
1584 * fixed size of the link header (variable length headers not yet supported).
1587 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
1590 bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1594 * Attach an interface to bpf. ifp is a pointer to the structure
1595 * defining the interface to be attached, dlt is the link layer type,
1596 * and hdrlen is the fixed size of the link header (variable length
1597 * headers are not yet supporrted).
1600 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
1604 bp = malloc(sizeof(*bp), M_BPF, M_NOWAIT | M_ZERO);
1608 LIST_INIT(&bp->bif_dlist);
1611 mtx_init(&bp->bif_mtx, "bpf interface lock", NULL, MTX_DEF);
1612 KASSERT(*driverp == NULL, ("bpfattach2: driverp already initialized"));
1616 LIST_INSERT_HEAD(&bpf_iflist, bp, bif_next);
1617 mtx_unlock(&bpf_mtx);
1620 * Compute the length of the bpf header. This is not necessarily
1621 * equal to SIZEOF_BPF_HDR because we want to insert spacing such
1622 * that the network layer header begins on a longword boundary (for
1623 * performance reasons and to alleviate alignment restrictions).
1625 bp->bif_hdrlen = BPF_WORDALIGN(hdrlen + SIZEOF_BPF_HDR) - hdrlen;
1628 if_printf(ifp, "bpf attached\n");
1632 * Detach bpf from an interface. This involves detaching each descriptor
1633 * associated with the interface, and leaving bd_bif NULL. Notify each
1634 * descriptor as it's detached so that any sleepers wake up and get
1638 bpfdetach(struct ifnet *ifp)
1643 /* Locate BPF interface information */
1645 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1646 if (ifp == bp->bif_ifp)
1650 /* Interface wasn't attached */
1651 if ((bp == NULL) || (bp->bif_ifp == NULL)) {
1652 mtx_unlock(&bpf_mtx);
1653 printf("bpfdetach: %s was not attached\n", ifp->if_xname);
1657 LIST_REMOVE(bp, bif_next);
1658 mtx_unlock(&bpf_mtx);
1660 while ((d = LIST_FIRST(&bp->bif_dlist)) != NULL) {
1667 mtx_destroy(&bp->bif_mtx);
1672 * Get a list of available data link type of the interface.
1675 bpf_getdltlist(struct bpf_d *d, struct bpf_dltlist *bfl)
1681 ifp = d->bd_bif->bif_ifp;
1685 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1686 if (bp->bif_ifp != ifp)
1688 if (bfl->bfl_list != NULL) {
1689 if (n >= bfl->bfl_len) {
1690 mtx_unlock(&bpf_mtx);
1693 error = copyout(&bp->bif_dlt,
1694 bfl->bfl_list + n, sizeof(u_int));
1698 mtx_unlock(&bpf_mtx);
1704 * Set the data link type of a BPF instance.
1707 bpf_setdlt(struct bpf_d *d, u_int dlt)
1709 int error, opromisc;
1713 if (d->bd_bif->bif_dlt == dlt)
1715 ifp = d->bd_bif->bif_ifp;
1717 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1718 if (bp->bif_ifp == ifp && bp->bif_dlt == dlt)
1721 mtx_unlock(&bpf_mtx);
1723 opromisc = d->bd_promisc;
1730 error = ifpromisc(bp->bif_ifp, 1);
1732 if_printf(bp->bif_ifp,
1733 "bpf_setdlt: ifpromisc failed (%d)\n",
1739 return (bp == NULL ? EINVAL : 0);
1743 bpf_clone(void *arg, struct ucred *cred, char *name, int namelen,
1750 if (dev_stdclone(name, NULL, "bpf", &u) != 1)
1752 *dev = make_dev(&bpf_cdevsw, unit2minor(u), UID_ROOT, GID_WHEEL, 0600,
1755 (*dev)->si_flags |= SI_CHEAPCLONE;
1760 bpf_drvinit(void *unused)
1763 mtx_init(&bpf_mtx, "bpf global lock", NULL, MTX_DEF);
1764 LIST_INIT(&bpf_iflist);
1765 EVENTHANDLER_REGISTER(dev_clone, bpf_clone, 0, 1000);
1769 bpfstats_fill_xbpf(struct xbpf_d *d, struct bpf_d *bd)
1772 bzero(d, sizeof(*d));
1773 BPFD_LOCK_ASSERT(bd);
1774 d->bd_immediate = bd->bd_immediate;
1775 d->bd_promisc = bd->bd_promisc;
1776 d->bd_hdrcmplt = bd->bd_hdrcmplt;
1777 d->bd_direction = bd->bd_direction;
1778 d->bd_feedback = bd->bd_feedback;
1779 d->bd_async = bd->bd_async;
1780 d->bd_rcount = bd->bd_rcount;
1781 d->bd_dcount = bd->bd_dcount;
1782 d->bd_fcount = bd->bd_fcount;
1783 d->bd_sig = bd->bd_sig;
1784 d->bd_slen = bd->bd_slen;
1785 d->bd_hlen = bd->bd_hlen;
1786 d->bd_bufsize = bd->bd_bufsize;
1787 d->bd_pid = bd->bd_pid;
1788 strlcpy(d->bd_ifname,
1789 bd->bd_bif->bif_ifp->if_xname, IFNAMSIZ);
1790 d->bd_locked = bd->bd_locked;
1794 bpf_stats_sysctl(SYSCTL_HANDLER_ARGS)
1796 struct xbpf_d *xbdbuf, *xbd;
1802 * XXX This is not technically correct. It is possible for non
1803 * privileged users to open bpf devices. It would make sense
1804 * if the users who opened the devices were able to retrieve
1805 * the statistics for them, too.
1807 error = priv_check(req->td, PRIV_NET_BPF);
1810 if (req->oldptr == NULL)
1811 return (SYSCTL_OUT(req, 0, bpf_bpfd_cnt * sizeof(*xbd)));
1812 if (bpf_bpfd_cnt == 0)
1813 return (SYSCTL_OUT(req, 0, 0));
1814 xbdbuf = malloc(req->oldlen, M_BPF, M_WAITOK);
1816 if (req->oldlen < (bpf_bpfd_cnt * sizeof(*xbd))) {
1817 mtx_unlock(&bpf_mtx);
1818 free(xbdbuf, M_BPF);
1822 LIST_FOREACH(bp, &bpf_iflist, bif_next) {
1824 LIST_FOREACH(bd, &bp->bif_dlist, bd_next) {
1825 xbd = &xbdbuf[index++];
1827 bpfstats_fill_xbpf(xbd, bd);
1832 mtx_unlock(&bpf_mtx);
1833 error = SYSCTL_OUT(req, xbdbuf, index * sizeof(*xbd));
1834 free(xbdbuf, M_BPF);
1838 SYSINIT(bpfdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE,bpf_drvinit,NULL);
1840 #else /* !DEV_BPF && !NETGRAPH_BPF */
1842 * NOP stubs to allow bpf-using drivers to load and function.
1844 * A 'better' implementation would allow the core bpf functionality
1845 * to be loaded at runtime.
1847 static struct bpf_if bp_null;
1850 bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
1855 bpf_mtap(struct bpf_if *bp, struct mbuf *m)
1860 bpf_mtap2(struct bpf_if *bp, void *d, u_int l, struct mbuf *m)
1865 bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
1868 bpfattach2(ifp, dlt, hdrlen, &ifp->if_bpf);
1872 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
1875 *driverp = &bp_null;
1879 bpfdetach(struct ifnet *ifp)
1884 bpf_filter(const struct bpf_insn *pc, u_char *p, u_int wirelen, u_int buflen)
1886 return -1; /* "no filter" behaviour */
1890 bpf_validate(const struct bpf_insn *f, int len)
1892 return 0; /* false */
1895 #endif /* !DEV_BPF && !NETGRAPH_BPF */