1 /*
2 * WPA Supplicant - Layer2 packet handling with Linux packet sockets
3 * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #include <sys/ioctl.h>
11 #include <netpacket/packet.h>
12 #include <net/if.h>
13 #include <linux/filter.h>
14
15 #include "common.h"
16 #include "eloop.h"
17 #include "crypto/sha1.h"
18 #include "crypto/crypto.h"
19 #include "l2_packet.h"
20 #ifdef CONFIG_DRIVER_HDF
21 #include "securec.h"
22 #endif
23
24 struct l2_packet_data {
25 int fd; /* packet socket for EAPOL frames */
26 char ifname[IFNAMSIZ + 1];
27 int ifindex;
28 u8 own_addr[ETH_ALEN];
29 void (*rx_callback)(void *ctx, const u8 *src_addr,
30 const u8 *buf, size_t len);
31 void *rx_callback_ctx;
32 int l2_hdr; /* whether to include layer 2 (Ethernet) header data
33 * buffers */
34
35 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
36 /* For working around Linux packet socket behavior and regression. */
37 int fd_br_rx;
38 int last_from_br, last_from_br_prev;
39 u8 last_hash[SHA1_MAC_LEN];
40 u8 last_hash_prev[SHA1_MAC_LEN];
41 unsigned int num_rx_br;
42 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
43 };
44
45 /* Generated by 'sudo tcpdump -s 3000 -dd greater 278 and ip and udp and
46 * src port bootps and dst port bootpc'
47 */
48 static struct sock_filter dhcp_sock_filter_insns[] = {
49 { 0x80, 0, 0, 0x00000000 },
50 { 0x35, 0, 12, 0x00000116 },
51 { 0x28, 0, 0, 0x0000000c },
52 { 0x15, 0, 10, 0x00000800 },
53 { 0x30, 0, 0, 0x00000017 },
54 { 0x15, 0, 8, 0x00000011 },
55 { 0x28, 0, 0, 0x00000014 },
56 { 0x45, 6, 0, 0x00001fff },
57 { 0xb1, 0, 0, 0x0000000e },
58 { 0x48, 0, 0, 0x0000000e },
59 { 0x15, 0, 3, 0x00000043 },
60 { 0x48, 0, 0, 0x00000010 },
61 { 0x15, 0, 1, 0x00000044 },
62 { 0x6, 0, 0, 0x00000bb8 },
63 { 0x6, 0, 0, 0x00000000 },
64 };
65
66 static const struct sock_fprog dhcp_sock_filter = {
67 .len = ARRAY_SIZE(dhcp_sock_filter_insns),
68 .filter = dhcp_sock_filter_insns,
69 };
70
71
72 /* Generated by 'sudo tcpdump -dd -s 1500 multicast and ip6[6]=58' */
73 static struct sock_filter ndisc_sock_filter_insns[] = {
74 { 0x30, 0, 0, 0x00000000 },
75 { 0x45, 0, 5, 0x00000001 },
76 { 0x28, 0, 0, 0x0000000c },
77 { 0x15, 0, 3, 0x000086dd },
78 { 0x30, 0, 0, 0x00000014 },
79 { 0x15, 0, 1, 0x0000003a },
80 { 0x6, 0, 0, 0x000005dc },
81 { 0x6, 0, 0, 0x00000000 },
82 };
83
84 static const struct sock_fprog ndisc_sock_filter = {
85 .len = ARRAY_SIZE(ndisc_sock_filter_insns),
86 .filter = ndisc_sock_filter_insns,
87 };
88
89 /* drop packet if skb->pkt_type is PACKET_OTHERHOST (0x03). Generated by:
90 * $ bpfc - <<EOF
91 * > ldb #type
92 * > jeq #0x03, drop
93 * > pass: ret #-1
94 * > drop: ret #0
95 * > EOF
96 */
97 static struct sock_filter pkt_type_filter_insns[] = {
98 { 0x30, 0, 0, 0xfffff004 },
99 { 0x15, 1, 0, 0x00000003 },
100 { 0x6, 0, 0, 0xffffffff },
101 { 0x6, 0, 0, 0x00000000 },
102 };
103
104 static const struct sock_fprog pkt_type_sock_filter = {
105 .len = ARRAY_SIZE(pkt_type_filter_insns),
106 .filter = pkt_type_filter_insns,
107 };
108
109
l2_packet_get_own_addr(struct l2_packet_data * l2,u8 * addr)110 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
111 {
112 os_memcpy(addr, l2->own_addr, ETH_ALEN);
113 return 0;
114 }
115
116
l2_packet_send(struct l2_packet_data * l2,const u8 * dst_addr,u16 proto,const u8 * buf,size_t len)117 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
118 const u8 *buf, size_t len)
119 {
120 int ret;
121
122 if (TEST_FAIL())
123 return -1;
124 if (l2 == NULL)
125 return -1;
126 #ifdef CONFIG_DRIVER_HDF
127 // lwip not implete send so forcing to use "sendto".
128 l2->l2_hdr = 0;
129 #endif
130 if (l2->l2_hdr) {
131 ret = send(l2->fd, buf, len, 0);
132 if (ret < 0)
133 wpa_printf(MSG_ERROR, "l2_packet_send - send: %s",
134 strerror(errno));
135 } else {
136 struct sockaddr_ll ll;
137 os_memset(&ll, 0, sizeof(ll));
138 ll.sll_family = AF_PACKET;
139 ll.sll_ifindex = l2->ifindex;
140 ll.sll_protocol = htons(proto);
141 ll.sll_halen = ETH_ALEN;
142 os_memcpy(ll.sll_addr, dst_addr, ETH_ALEN);
143 ret = sendto(l2->fd, buf, len, 0, (struct sockaddr *) &ll,
144 sizeof(ll));
145 if (ret < 0) {
146 wpa_printf(MSG_ERROR, "l2_packet_send - sendto: %s",
147 strerror(errno));
148 }
149 }
150 return ret;
151 }
152
153
l2_packet_receive(int sock,void * eloop_ctx,void * sock_ctx)154 void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
155 {
156 struct l2_packet_data *l2 = eloop_ctx;
157 u8 buf[2300];
158 int res;
159 struct sockaddr_ll ll;
160 socklen_t fromlen;
161
162 os_memset(&ll, 0, sizeof(ll));
163 fromlen = sizeof(ll);
164 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
165 &fromlen);
166 if (res < 0) {
167 wpa_printf(MSG_DEBUG, "l2_packet_receive - recvfrom: %s",
168 strerror(errno));
169 return;
170 }
171 #ifdef CONFIG_DRIVER_HDF
172 // lwip not implete ll.sll_addr when raw protocol, so coping source addr to sll_addr
173 if (memcpy_s(ll.sll_addr, ETH_ALEN, buf + ETH_ALEN, ETH_ALEN) != EOK) {
174 return;
175 }
176 #endif
177 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
178 __func__, MAC2STR(ll.sll_addr), (int) res);
179
180 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
181 if (l2->fd_br_rx >= 0) {
182 u8 hash[SHA1_MAC_LEN];
183 const u8 *addr[1];
184 size_t len[1];
185
186 /*
187 * Close the workaround socket if the kernel version seems to be
188 * able to deliver packets through the packet socket before
189 * authorization has been completed (in dormant state).
190 */
191 if (l2->num_rx_br <= 1) {
192 wpa_printf(MSG_DEBUG,
193 "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket",
194 l2->ifname);
195 eloop_unregister_read_sock(l2->fd_br_rx);
196 close(l2->fd_br_rx);
197 l2->fd_br_rx = -1;
198 }
199
200 addr[0] = buf;
201 len[0] = res;
202 sha1_vector(1, addr, len, hash);
203 if (l2->last_from_br &&
204 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
205 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX",
206 __func__);
207 return;
208 }
209 if (l2->last_from_br_prev &&
210 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) {
211 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)",
212 __func__);
213 return;
214 }
215 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN);
216 l2->last_from_br_prev = l2->last_from_br;
217 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
218 }
219
220 l2->last_from_br = 0;
221 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
222 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
223 }
224
225
226 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
l2_packet_receive_br(int sock,void * eloop_ctx,void * sock_ctx)227 static void l2_packet_receive_br(int sock, void *eloop_ctx, void *sock_ctx)
228 {
229 struct l2_packet_data *l2 = eloop_ctx;
230 u8 buf[2300];
231 int res;
232 struct sockaddr_ll ll;
233 socklen_t fromlen;
234 u8 hash[SHA1_MAC_LEN];
235 const u8 *addr[1];
236 size_t len[1];
237
238 l2->num_rx_br++;
239 os_memset(&ll, 0, sizeof(ll));
240 fromlen = sizeof(ll);
241 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
242 &fromlen);
243 if (res < 0) {
244 wpa_printf(MSG_DEBUG, "l2_packet_receive_br - recvfrom: %s",
245 strerror(errno));
246 return;
247 }
248
249 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
250 __func__, MAC2STR(ll.sll_addr), (int) res);
251
252 if (os_memcmp(ll.sll_addr, l2->own_addr, ETH_ALEN) == 0) {
253 wpa_printf(MSG_DEBUG, "%s: Drop RX of own frame", __func__);
254 return;
255 }
256
257 addr[0] = buf;
258 len[0] = res;
259 sha1_vector(1, addr, len, hash);
260 if (!l2->last_from_br &&
261 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
262 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", __func__);
263 return;
264 }
265 if (!l2->last_from_br_prev &&
266 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) {
267 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", __func__);
268 return;
269 }
270 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN);
271 l2->last_from_br_prev = l2->last_from_br;
272 l2->last_from_br = 1;
273 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
274 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
275 }
276 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
277
278
l2_packet_init(const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)279 struct l2_packet_data * l2_packet_init(
280 const char *ifname, const u8 *own_addr, unsigned short protocol,
281 void (*rx_callback)(void *ctx, const u8 *src_addr,
282 const u8 *buf, size_t len),
283 void *rx_callback_ctx, int l2_hdr)
284 {
285 struct l2_packet_data *l2;
286 struct ifreq ifr;
287 struct sockaddr_ll ll;
288
289 l2 = os_zalloc(sizeof(struct l2_packet_data));
290 if (l2 == NULL)
291 return NULL;
292 os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
293 l2->rx_callback = rx_callback;
294 l2->rx_callback_ctx = rx_callback_ctx;
295 l2->l2_hdr = l2_hdr;
296 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
297 l2->fd_br_rx = -1;
298 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
299
300 l2->fd = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
301 htons(protocol));
302 if (l2->fd < 0) {
303 wpa_printf(MSG_ERROR, "%s: socket(PF_PACKET): %s",
304 __func__, strerror(errno));
305 os_free(l2);
306 return NULL;
307 }
308 os_memset(&ifr, 0, sizeof(ifr));
309 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
310 if (ioctl(l2->fd, SIOCGIFINDEX, &ifr) < 0) {
311 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFINDEX]: %s",
312 __func__, strerror(errno));
313 close(l2->fd);
314 os_free(l2);
315 return NULL;
316 }
317 l2->ifindex = ifr.ifr_ifindex;
318
319 os_memset(&ll, 0, sizeof(ll));
320 ll.sll_family = PF_PACKET;
321 ll.sll_ifindex = ifr.ifr_ifindex;
322 ll.sll_protocol = htons(protocol);
323 if (bind(l2->fd, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
324 wpa_printf(MSG_ERROR, "%s: bind[PF_PACKET]: %s",
325 __func__, strerror(errno));
326 close(l2->fd);
327 os_free(l2);
328 return NULL;
329 }
330
331 if (ioctl(l2->fd, SIOCGIFHWADDR, &ifr) < 0) {
332 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFHWADDR]: %s",
333 __func__, strerror(errno));
334 close(l2->fd);
335 os_free(l2);
336 return NULL;
337 }
338 os_memcpy(l2->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
339
340 eloop_register_read_sock(l2->fd, l2_packet_receive, l2, NULL);
341
342 return l2;
343 }
344
345
l2_packet_init_bridge(const char * br_ifname,const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)346 struct l2_packet_data * l2_packet_init_bridge(
347 const char *br_ifname, const char *ifname, const u8 *own_addr,
348 unsigned short protocol,
349 void (*rx_callback)(void *ctx, const u8 *src_addr,
350 const u8 *buf, size_t len),
351 void *rx_callback_ctx, int l2_hdr)
352 {
353 struct l2_packet_data *l2;
354 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
355 struct sock_filter ethertype_sock_filter_insns[] = {
356 /* Load ethertype */
357 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 2 * ETH_ALEN),
358 /* Jump over next statement if ethertype does not match */
359 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, protocol, 0, 1),
360 /* Ethertype match - return all */
361 BPF_STMT(BPF_RET | BPF_K, ~0),
362 /* No match - drop */
363 BPF_STMT(BPF_RET | BPF_K, 0)
364 };
365 const struct sock_fprog ethertype_sock_filter = {
366 .len = ARRAY_SIZE(ethertype_sock_filter_insns),
367 .filter = ethertype_sock_filter_insns,
368 };
369 struct sockaddr_ll ll;
370 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
371
372 l2 = l2_packet_init(br_ifname, own_addr, protocol, rx_callback,
373 rx_callback_ctx, l2_hdr);
374 if (!l2)
375 return NULL;
376
377 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
378 /*
379 * The Linux packet socket behavior has changed over the years and there
380 * is an inconvenient regression in it that breaks RX for a specific
381 * protocol from interfaces in a bridge when that interface is not in
382 * fully operation state (i.e., when in station mode and not completed
383 * authorization). To work around this, register ETH_P_ALL version of
384 * the packet socket bound to the real netdev and use socket filter to
385 * match the ethertype value. This version is less efficient, but
386 * required for functionality with many kernel version. If the main
387 * packet socket is found to be working, this less efficient version
388 * gets closed automatically.
389 */
390
391 l2->fd_br_rx = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
392 htons(ETH_P_ALL));
393 if (l2->fd_br_rx < 0) {
394 wpa_printf(MSG_DEBUG, "%s: socket(PF_PACKET-fd_br_rx): %s",
395 __func__, strerror(errno));
396 /* try to continue without the workaround RX socket */
397 return l2;
398 }
399
400 os_memset(&ll, 0, sizeof(ll));
401 ll.sll_family = PF_PACKET;
402 ll.sll_ifindex = if_nametoindex(ifname);
403 ll.sll_protocol = htons(ETH_P_ALL);
404 if (bind(l2->fd_br_rx, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
405 wpa_printf(MSG_DEBUG, "%s: bind[PF_PACKET-fd_br_rx]: %s",
406 __func__, strerror(errno));
407 /* try to continue without the workaround RX socket */
408 close(l2->fd_br_rx);
409 l2->fd_br_rx = -1;
410 return l2;
411 }
412
413 if (setsockopt(l2->fd_br_rx, SOL_SOCKET, SO_ATTACH_FILTER,
414 ðertype_sock_filter, sizeof(struct sock_fprog))) {
415 wpa_printf(MSG_DEBUG,
416 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
417 strerror(errno));
418 /* try to continue without the workaround RX socket */
419 close(l2->fd_br_rx);
420 l2->fd_br_rx = -1;
421 return l2;
422 }
423
424 eloop_register_read_sock(l2->fd_br_rx, l2_packet_receive_br, l2, NULL);
425 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
426
427 return l2;
428 }
429
430
l2_packet_deinit(struct l2_packet_data * l2)431 void l2_packet_deinit(struct l2_packet_data *l2)
432 {
433 if (l2 == NULL)
434 return;
435
436 if (l2->fd >= 0) {
437 eloop_unregister_read_sock(l2->fd);
438 close(l2->fd);
439 }
440
441 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
442 if (l2->fd_br_rx >= 0) {
443 eloop_unregister_read_sock(l2->fd_br_rx);
444 close(l2->fd_br_rx);
445 }
446 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
447
448 os_free(l2);
449 }
450
451
l2_packet_get_ip_addr(struct l2_packet_data * l2,char * buf,size_t len)452 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
453 {
454 int s;
455 struct ifreq ifr;
456 struct sockaddr_in *saddr;
457 size_t res;
458
459 s = socket(PF_INET, SOCK_DGRAM, 0);
460 if (s < 0) {
461 wpa_printf(MSG_ERROR, "%s: socket: %s",
462 __func__, strerror(errno));
463 return -1;
464 }
465 os_memset(&ifr, 0, sizeof(ifr));
466 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
467 if (ioctl(s, SIOCGIFADDR, &ifr) < 0) {
468 if (errno != EADDRNOTAVAIL)
469 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFADDR]: %s",
470 __func__, strerror(errno));
471 close(s);
472 return -1;
473 }
474 close(s);
475 saddr = aliasing_hide_typecast(&ifr.ifr_addr, struct sockaddr_in);
476 if (saddr->sin_family != AF_INET)
477 return -1;
478 res = os_strlcpy(buf, inet_ntoa(saddr->sin_addr), len);
479 if (res >= len)
480 return -1;
481 return 0;
482 }
483
484
l2_packet_notify_auth_start(struct l2_packet_data * l2)485 void l2_packet_notify_auth_start(struct l2_packet_data *l2)
486 {
487 }
488
489
l2_packet_set_packet_filter(struct l2_packet_data * l2,enum l2_packet_filter_type type)490 int l2_packet_set_packet_filter(struct l2_packet_data *l2,
491 enum l2_packet_filter_type type)
492 {
493 const struct sock_fprog *sock_filter;
494
495 if (TEST_FAIL())
496 return -1;
497
498 switch (type) {
499 case L2_PACKET_FILTER_DHCP:
500 sock_filter = &dhcp_sock_filter;
501 break;
502 case L2_PACKET_FILTER_NDISC:
503 sock_filter = &ndisc_sock_filter;
504 break;
505 case L2_PACKET_FILTER_PKTTYPE:
506 sock_filter = &pkt_type_sock_filter;
507 break;
508 default:
509 return -1;
510 }
511
512 if (setsockopt(l2->fd, SOL_SOCKET, SO_ATTACH_FILTER,
513 sock_filter, sizeof(struct sock_fprog))) {
514 wpa_printf(MSG_ERROR,
515 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
516 strerror(errno));
517 return -1;
518 }
519
520 return 0;
521 }
522