Line data Source code
1 : /*
2 : * WPA Supplicant - Layer2 packet handling with Linux packet sockets
3 : * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
4 : *
5 : * This software may be distributed under the terms of the BSD license.
6 : * See README for more details.
7 : */
8 :
9 : #include "includes.h"
10 : #include <sys/ioctl.h>
11 : #include <netpacket/packet.h>
12 : #include <net/if.h>
13 : #include <linux/filter.h>
14 :
15 : #include "common.h"
16 : #include "eloop.h"
17 : #include "crypto/sha1.h"
18 : #include "crypto/crypto.h"
19 : #include "l2_packet.h"
20 :
21 :
22 : struct l2_packet_data {
23 : int fd; /* packet socket for EAPOL frames */
24 : char ifname[IFNAMSIZ + 1];
25 : int ifindex;
26 : u8 own_addr[ETH_ALEN];
27 : void (*rx_callback)(void *ctx, const u8 *src_addr,
28 : const u8 *buf, size_t len);
29 : void *rx_callback_ctx;
30 : int l2_hdr; /* whether to include layer 2 (Ethernet) header data
31 : * buffers */
32 :
33 : /* For working around Linux packet socket behavior and regression. */
34 : int fd_br_rx;
35 : int last_from_br;
36 : u8 last_hash[SHA1_MAC_LEN];
37 : unsigned int num_rx, num_rx_br;
38 : };
39 :
40 : /* Generated by 'sudo tcpdump -s 3000 -dd greater 278 and ip and udp and
41 : * src port bootps and dst port bootpc'
42 : */
43 : static struct sock_filter dhcp_sock_filter_insns[] = {
44 : { 0x80, 0, 0, 0x00000000 },
45 : { 0x35, 0, 12, 0x00000116 },
46 : { 0x28, 0, 0, 0x0000000c },
47 : { 0x15, 0, 10, 0x00000800 },
48 : { 0x30, 0, 0, 0x00000017 },
49 : { 0x15, 0, 8, 0x00000011 },
50 : { 0x28, 0, 0, 0x00000014 },
51 : { 0x45, 6, 0, 0x00001fff },
52 : { 0xb1, 0, 0, 0x0000000e },
53 : { 0x48, 0, 0, 0x0000000e },
54 : { 0x15, 0, 3, 0x00000043 },
55 : { 0x48, 0, 0, 0x00000010 },
56 : { 0x15, 0, 1, 0x00000044 },
57 : { 0x6, 0, 0, 0x00000bb8 },
58 : { 0x6, 0, 0, 0x00000000 },
59 : };
60 :
61 : static const struct sock_fprog dhcp_sock_filter = {
62 : .len = ARRAY_SIZE(dhcp_sock_filter_insns),
63 : .filter = dhcp_sock_filter_insns,
64 : };
65 :
66 :
67 : /* Generated by 'sudo tcpdump -dd -s 1500 multicast and ip6[6]=58' */
68 : static struct sock_filter ndisc_sock_filter_insns[] = {
69 : { 0x30, 0, 0, 0x00000000 },
70 : { 0x45, 0, 5, 0x00000001 },
71 : { 0x28, 0, 0, 0x0000000c },
72 : { 0x15, 0, 3, 0x000086dd },
73 : { 0x30, 0, 0, 0x00000014 },
74 : { 0x15, 0, 1, 0x0000003a },
75 : { 0x6, 0, 0, 0x000005dc },
76 : { 0x6, 0, 0, 0x00000000 },
77 : };
78 :
79 : static const struct sock_fprog ndisc_sock_filter = {
80 : .len = ARRAY_SIZE(ndisc_sock_filter_insns),
81 : .filter = ndisc_sock_filter_insns,
82 : };
83 :
84 :
85 600 : int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
86 : {
87 600 : os_memcpy(addr, l2->own_addr, ETH_ALEN);
88 600 : return 0;
89 : }
90 :
91 :
92 13446 : int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
93 : const u8 *buf, size_t len)
94 : {
95 : int ret;
96 13446 : if (l2 == NULL)
97 0 : return -1;
98 13446 : if (l2->l2_hdr) {
99 3701 : ret = send(l2->fd, buf, len, 0);
100 3701 : if (ret < 0)
101 0 : wpa_printf(MSG_ERROR, "l2_packet_send - send: %s",
102 0 : strerror(errno));
103 : } else {
104 : struct sockaddr_ll ll;
105 9745 : os_memset(&ll, 0, sizeof(ll));
106 9745 : ll.sll_family = AF_PACKET;
107 9745 : ll.sll_ifindex = l2->ifindex;
108 9745 : ll.sll_protocol = htons(proto);
109 9745 : ll.sll_halen = ETH_ALEN;
110 9745 : os_memcpy(ll.sll_addr, dst_addr, ETH_ALEN);
111 9745 : ret = sendto(l2->fd, buf, len, 0, (struct sockaddr *) &ll,
112 : sizeof(ll));
113 9745 : if (ret < 0) {
114 0 : wpa_printf(MSG_ERROR, "l2_packet_send - sendto: %s",
115 0 : strerror(errno));
116 : }
117 : }
118 13446 : return ret;
119 : }
120 :
121 :
122 16662 : static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
123 : {
124 16662 : struct l2_packet_data *l2 = eloop_ctx;
125 : u8 buf[2300];
126 : int res;
127 : struct sockaddr_ll ll;
128 : socklen_t fromlen;
129 :
130 16662 : l2->num_rx++;
131 16662 : os_memset(&ll, 0, sizeof(ll));
132 16662 : fromlen = sizeof(ll);
133 16662 : res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
134 : &fromlen);
135 16662 : if (res < 0) {
136 193 : wpa_printf(MSG_DEBUG, "l2_packet_receive - recvfrom: %s",
137 193 : strerror(errno));
138 193 : return;
139 : }
140 :
141 98814 : wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
142 98814 : __func__, MAC2STR(ll.sll_addr), (int) res);
143 :
144 16469 : if (l2->fd_br_rx >= 0) {
145 : u8 hash[SHA1_MAC_LEN];
146 : const u8 *addr[1];
147 : size_t len[1];
148 :
149 : /*
150 : * Close the workaround socket if the kernel version seems to be
151 : * able to deliver packets through the packet socket before
152 : * authorization has been completed (in dormant state).
153 : */
154 12 : if (l2->num_rx_br <= 1) {
155 0 : wpa_printf(MSG_DEBUG,
156 : "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket",
157 0 : l2->ifname);
158 0 : eloop_unregister_read_sock(l2->fd_br_rx);
159 0 : close(l2->fd_br_rx);
160 0 : l2->fd_br_rx = -1;
161 : }
162 :
163 12 : addr[0] = buf;
164 12 : len[0] = res;
165 12 : sha1_vector(1, addr, len, hash);
166 22 : if (l2->last_from_br &&
167 10 : os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
168 0 : wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX",
169 : __func__);
170 0 : return;
171 : }
172 12 : os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
173 : }
174 :
175 16469 : l2->last_from_br = 0;
176 16469 : l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
177 : }
178 :
179 :
180 43 : static void l2_packet_receive_br(int sock, void *eloop_ctx, void *sock_ctx)
181 : {
182 43 : struct l2_packet_data *l2 = eloop_ctx;
183 : u8 buf[2300];
184 : int res;
185 : struct sockaddr_ll ll;
186 : socklen_t fromlen;
187 : u8 hash[SHA1_MAC_LEN];
188 : const u8 *addr[1];
189 : size_t len[1];
190 :
191 43 : l2->num_rx_br++;
192 43 : os_memset(&ll, 0, sizeof(ll));
193 43 : fromlen = sizeof(ll);
194 43 : res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
195 : &fromlen);
196 43 : if (res < 0) {
197 0 : wpa_printf(MSG_DEBUG, "l2_packet_receive_br - recvfrom: %s",
198 0 : strerror(errno));
199 0 : return;
200 : }
201 :
202 258 : wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
203 258 : __func__, MAC2STR(ll.sll_addr), (int) res);
204 :
205 43 : addr[0] = buf;
206 43 : len[0] = res;
207 43 : sha1_vector(1, addr, len, hash);
208 67 : if (!l2->last_from_br &&
209 24 : os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
210 12 : wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", __func__);
211 12 : return;
212 : }
213 31 : l2->last_from_br = 1;
214 31 : os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
215 31 : l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
216 : }
217 :
218 :
219 3101 : struct l2_packet_data * l2_packet_init(
220 : const char *ifname, const u8 *own_addr, unsigned short protocol,
221 : void (*rx_callback)(void *ctx, const u8 *src_addr,
222 : const u8 *buf, size_t len),
223 : void *rx_callback_ctx, int l2_hdr)
224 : {
225 : struct l2_packet_data *l2;
226 : struct ifreq ifr;
227 : struct sockaddr_ll ll;
228 :
229 3101 : l2 = os_zalloc(sizeof(struct l2_packet_data));
230 3101 : if (l2 == NULL)
231 4 : return NULL;
232 3097 : os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
233 3097 : l2->rx_callback = rx_callback;
234 3097 : l2->rx_callback_ctx = rx_callback_ctx;
235 3097 : l2->l2_hdr = l2_hdr;
236 3097 : l2->fd_br_rx = -1;
237 :
238 3097 : l2->fd = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
239 3097 : htons(protocol));
240 3097 : if (l2->fd < 0) {
241 0 : wpa_printf(MSG_ERROR, "%s: socket(PF_PACKET): %s",
242 0 : __func__, strerror(errno));
243 0 : os_free(l2);
244 0 : return NULL;
245 : }
246 3097 : os_memset(&ifr, 0, sizeof(ifr));
247 3097 : os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
248 3097 : if (ioctl(l2->fd, SIOCGIFINDEX, &ifr) < 0) {
249 1 : wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFINDEX]: %s",
250 1 : __func__, strerror(errno));
251 1 : close(l2->fd);
252 1 : os_free(l2);
253 1 : return NULL;
254 : }
255 3096 : l2->ifindex = ifr.ifr_ifindex;
256 :
257 3096 : os_memset(&ll, 0, sizeof(ll));
258 3096 : ll.sll_family = PF_PACKET;
259 3096 : ll.sll_ifindex = ifr.ifr_ifindex;
260 3096 : ll.sll_protocol = htons(protocol);
261 3096 : if (bind(l2->fd, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
262 0 : wpa_printf(MSG_ERROR, "%s: bind[PF_PACKET]: %s",
263 0 : __func__, strerror(errno));
264 0 : close(l2->fd);
265 0 : os_free(l2);
266 0 : return NULL;
267 : }
268 :
269 3096 : if (ioctl(l2->fd, SIOCGIFHWADDR, &ifr) < 0) {
270 0 : wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFHWADDR]: %s",
271 0 : __func__, strerror(errno));
272 0 : close(l2->fd);
273 0 : os_free(l2);
274 0 : return NULL;
275 : }
276 3096 : os_memcpy(l2->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
277 :
278 3096 : eloop_register_read_sock(l2->fd, l2_packet_receive, l2, NULL);
279 :
280 3096 : return l2;
281 : }
282 :
283 :
284 4 : struct l2_packet_data * l2_packet_init_bridge(
285 : const char *br_ifname, const char *ifname, const u8 *own_addr,
286 : unsigned short protocol,
287 : void (*rx_callback)(void *ctx, const u8 *src_addr,
288 : const u8 *buf, size_t len),
289 : void *rx_callback_ctx, int l2_hdr)
290 : {
291 : struct l2_packet_data *l2;
292 4 : struct sock_filter ethertype_sock_filter_insns[] = {
293 : /* Load ethertype */
294 : BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 2 * ETH_ALEN),
295 : /* Jump over next statement if ethertype does not match */
296 : BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, protocol, 0, 1),
297 : /* Ethertype match - return all */
298 : BPF_STMT(BPF_RET | BPF_K, ~0),
299 : /* No match - drop */
300 : BPF_STMT(BPF_RET | BPF_K, 0)
301 : };
302 4 : const struct sock_fprog ethertype_sock_filter = {
303 : .len = ARRAY_SIZE(ethertype_sock_filter_insns),
304 : .filter = ethertype_sock_filter_insns,
305 : };
306 : struct sockaddr_ll ll;
307 :
308 4 : l2 = l2_packet_init(br_ifname, own_addr, protocol, rx_callback,
309 : rx_callback_ctx, l2_hdr);
310 4 : if (!l2)
311 1 : return NULL;
312 :
313 : /*
314 : * The Linux packet socket behavior has changed over the years and there
315 : * is an inconvenient regression in it that breaks RX for a specific
316 : * protocol from interfaces in a bridge when that interface is not in
317 : * fully operation state (i.e., when in station mode and not completed
318 : * authorization). To work around this, register ETH_P_ALL version of
319 : * the packet socket bound to the real netdev and use socket filter to
320 : * match the ethertype value. This version is less efficient, but
321 : * required for functionality with many kernel version. If the main
322 : * packet socket is found to be working, this less efficient version
323 : * gets closed automatically.
324 : */
325 :
326 3 : l2->fd_br_rx = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
327 3 : htons(ETH_P_ALL));
328 3 : if (l2->fd_br_rx < 0) {
329 0 : wpa_printf(MSG_DEBUG, "%s: socket(PF_PACKET-fd_br_rx): %s",
330 0 : __func__, strerror(errno));
331 : /* try to continue without the workaround RX socket */
332 0 : return l2;
333 : }
334 :
335 3 : os_memset(&ll, 0, sizeof(ll));
336 3 : ll.sll_family = PF_PACKET;
337 3 : ll.sll_ifindex = if_nametoindex(ifname);
338 3 : ll.sll_protocol = htons(ETH_P_ALL);
339 3 : if (bind(l2->fd_br_rx, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
340 0 : wpa_printf(MSG_DEBUG, "%s: bind[PF_PACKET-fd_br_rx]: %s",
341 0 : __func__, strerror(errno));
342 : /* try to continue without the workaround RX socket */
343 0 : close(l2->fd_br_rx);
344 0 : l2->fd_br_rx = -1;
345 0 : return l2;
346 : }
347 :
348 3 : if (setsockopt(l2->fd_br_rx, SOL_SOCKET, SO_ATTACH_FILTER,
349 : ðertype_sock_filter, sizeof(struct sock_fprog))) {
350 0 : wpa_printf(MSG_DEBUG,
351 : "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
352 0 : strerror(errno));
353 : /* try to continue without the workaround RX socket */
354 0 : close(l2->fd_br_rx);
355 0 : l2->fd_br_rx = -1;
356 0 : return l2;
357 : }
358 :
359 3 : eloop_register_read_sock(l2->fd_br_rx, l2_packet_receive_br, l2, NULL);
360 :
361 3 : return l2;
362 : }
363 :
364 :
365 11441 : void l2_packet_deinit(struct l2_packet_data *l2)
366 : {
367 11441 : if (l2 == NULL)
368 19786 : return;
369 :
370 3096 : if (l2->fd >= 0) {
371 3096 : eloop_unregister_read_sock(l2->fd);
372 3096 : close(l2->fd);
373 : }
374 :
375 3096 : if (l2->fd_br_rx >= 0) {
376 3 : eloop_unregister_read_sock(l2->fd_br_rx);
377 3 : close(l2->fd_br_rx);
378 : }
379 :
380 3096 : os_free(l2);
381 : }
382 :
383 :
384 3257 : int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
385 : {
386 : int s;
387 : struct ifreq ifr;
388 : struct sockaddr_in *saddr;
389 : size_t res;
390 :
391 3257 : s = socket(PF_INET, SOCK_DGRAM, 0);
392 3257 : if (s < 0) {
393 0 : wpa_printf(MSG_ERROR, "%s: socket: %s",
394 0 : __func__, strerror(errno));
395 0 : return -1;
396 : }
397 3257 : os_memset(&ifr, 0, sizeof(ifr));
398 3257 : os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
399 3257 : if (ioctl(s, SIOCGIFADDR, &ifr) < 0) {
400 3256 : if (errno != EADDRNOTAVAIL)
401 0 : wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFADDR]: %s",
402 0 : __func__, strerror(errno));
403 3256 : close(s);
404 3256 : return -1;
405 : }
406 1 : close(s);
407 1 : saddr = aliasing_hide_typecast(&ifr.ifr_addr, struct sockaddr_in);
408 1 : if (saddr->sin_family != AF_INET)
409 0 : return -1;
410 1 : res = os_strlcpy(buf, inet_ntoa(saddr->sin_addr), len);
411 1 : if (res >= len)
412 0 : return -1;
413 1 : return 0;
414 : }
415 :
416 :
417 3326 : void l2_packet_notify_auth_start(struct l2_packet_data *l2)
418 : {
419 3326 : }
420 :
421 :
422 10 : int l2_packet_set_packet_filter(struct l2_packet_data *l2,
423 : enum l2_packet_filter_type type)
424 : {
425 : const struct sock_fprog *sock_filter;
426 :
427 10 : switch (type) {
428 : case L2_PACKET_FILTER_DHCP:
429 5 : sock_filter = &dhcp_sock_filter;
430 5 : break;
431 : case L2_PACKET_FILTER_NDISC:
432 5 : sock_filter = &ndisc_sock_filter;
433 5 : break;
434 : default:
435 0 : return -1;
436 : }
437 :
438 10 : if (setsockopt(l2->fd, SOL_SOCKET, SO_ATTACH_FILTER,
439 : sock_filter, sizeof(struct sock_fprog))) {
440 0 : wpa_printf(MSG_ERROR,
441 : "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
442 0 : strerror(errno));
443 0 : return -1;
444 : }
445 :
446 10 : return 0;
447 : }
|
