• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * WPA Supplicant - Layer2 packet handling with Linux packet sockets
3  * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 #include <sys/ioctl.h>
11 #include <netpacket/packet.h>
12 #include <net/if.h>
13 #include <linux/filter.h>
14 
15 #include "common.h"
16 #include "eloop.h"
17 #include "crypto/sha1.h"
18 #include "crypto/crypto.h"
19 #include "l2_packet.h"
20 
21 
22 struct l2_packet_data {
23 	int fd; /* packet socket for EAPOL frames */
24 	char ifname[IFNAMSIZ + 1];
25 	int ifindex;
26 	u8 own_addr[ETH_ALEN];
27 	void (*rx_callback)(void *ctx, const u8 *src_addr,
28 			    const u8 *buf, size_t len);
29 	void *rx_callback_ctx;
30 	int l2_hdr; /* whether to include layer 2 (Ethernet) header data
31 		     * buffers */
32 
33 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
34 	/* For working around Linux packet socket behavior and regression. */
35 	int fd_br_rx;
36 	int last_from_br, last_from_br_prev;
37 	u8 last_hash[SHA1_MAC_LEN];
38 	u8 last_hash_prev[SHA1_MAC_LEN];
39 	unsigned int num_rx_br;
40 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
41 };
42 
43 /* Generated by 'sudo tcpdump -s 3000 -dd greater 278 and ip and udp and
44  * src port bootps and dst port bootpc'
45  */
46 static struct sock_filter dhcp_sock_filter_insns[] = {
47 	{ 0x80, 0, 0, 0x00000000 },
48 	{ 0x35, 0, 12, 0x00000116 },
49 	{ 0x28, 0, 0, 0x0000000c },
50 	{ 0x15, 0, 10, 0x00000800 },
51 	{ 0x30, 0, 0, 0x00000017 },
52 	{ 0x15, 0, 8, 0x00000011 },
53 	{ 0x28, 0, 0, 0x00000014 },
54 	{ 0x45, 6, 0, 0x00001fff },
55 	{ 0xb1, 0, 0, 0x0000000e },
56 	{ 0x48, 0, 0, 0x0000000e },
57 	{ 0x15, 0, 3, 0x00000043 },
58 	{ 0x48, 0, 0, 0x00000010 },
59 	{ 0x15, 0, 1, 0x00000044 },
60 	{ 0x6, 0, 0, 0x00000bb8 },
61 	{ 0x6, 0, 0, 0x00000000 },
62 };
63 
64 static const struct sock_fprog dhcp_sock_filter = {
65 	.len = ARRAY_SIZE(dhcp_sock_filter_insns),
66 	.filter = dhcp_sock_filter_insns,
67 };
68 
69 
70 /* Generated by 'sudo tcpdump -dd -s 1500 multicast and ip6[6]=58' */
71 static struct sock_filter ndisc_sock_filter_insns[] = {
72 	{ 0x30, 0, 0, 0x00000000 },
73 	{ 0x45, 0, 5, 0x00000001 },
74 	{ 0x28, 0, 0, 0x0000000c },
75 	{ 0x15, 0, 3, 0x000086dd },
76 	{ 0x30, 0, 0, 0x00000014 },
77 	{ 0x15, 0, 1, 0x0000003a },
78 	{ 0x6, 0, 0, 0x000005dc },
79 	{ 0x6, 0, 0, 0x00000000 },
80 };
81 
82 static const struct sock_fprog ndisc_sock_filter = {
83 	.len = ARRAY_SIZE(ndisc_sock_filter_insns),
84 	.filter = ndisc_sock_filter_insns,
85 };
86 
87 /* drop packet if skb->pkt_type is PACKET_OTHERHOST (0x03). Generated by:
88  * $ bpfc - <<EOF
89  * > ldb #type
90  * > jeq #0x03, drop
91  * > pass: ret #-1
92  * > drop: ret #0
93  * > EOF
94  */
95 static struct sock_filter pkt_type_filter_insns[] = {
96 	{ 0x30, 0, 0, 0xfffff004 },
97 	{ 0x15, 1, 0, 0x00000003 },
98 	{ 0x6, 0, 0, 0xffffffff },
99 	{ 0x6, 0, 0, 0x00000000 },
100 };
101 
102 static const struct sock_fprog pkt_type_sock_filter = {
103 	.len = ARRAY_SIZE(pkt_type_filter_insns),
104 	.filter = pkt_type_filter_insns,
105 };
106 
107 
l2_packet_get_own_addr(struct l2_packet_data * l2,u8 * addr)108 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
109 {
110 	os_memcpy(addr, l2->own_addr, ETH_ALEN);
111 	return 0;
112 }
113 
114 
l2_packet_send(struct l2_packet_data * l2,const u8 * dst_addr,u16 proto,const u8 * buf,size_t len)115 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
116 		   const u8 *buf, size_t len)
117 {
118 	int ret;
119 
120 	if (TEST_FAIL())
121 		return -1;
122 	if (l2 == NULL)
123 		return -1;
124 	if (l2->l2_hdr) {
125 		ret = send(l2->fd, buf, len, 0);
126 		if (ret < 0)
127 			wpa_printf(MSG_ERROR, "l2_packet_send - send: %s",
128 				   strerror(errno));
129 	} else {
130 		struct sockaddr_ll ll;
131 		os_memset(&ll, 0, sizeof(ll));
132 		ll.sll_family = AF_PACKET;
133 		ll.sll_ifindex = l2->ifindex;
134 		ll.sll_protocol = htons(proto);
135 		ll.sll_halen = ETH_ALEN;
136 		os_memcpy(ll.sll_addr, dst_addr, ETH_ALEN);
137 		ret = sendto(l2->fd, buf, len, 0, (struct sockaddr *) &ll,
138 			     sizeof(ll));
139 		if (ret < 0) {
140 			wpa_printf(MSG_ERROR, "l2_packet_send - sendto: %s",
141 				   strerror(errno));
142 		}
143 	}
144 	return ret;
145 }
146 
147 
l2_packet_receive(int sock,void * eloop_ctx,void * sock_ctx)148 static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
149 {
150 	struct l2_packet_data *l2 = eloop_ctx;
151 	u8 buf[2300];
152 	int res;
153 	struct sockaddr_ll ll;
154 	socklen_t fromlen;
155 
156 	os_memset(&ll, 0, sizeof(ll));
157 	fromlen = sizeof(ll);
158 	res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
159 		       &fromlen);
160 	if (res < 0) {
161 		wpa_printf(MSG_DEBUG, "l2_packet_receive - recvfrom: %s",
162 			   strerror(errno));
163 		return;
164 	}
165 
166 	wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
167 		   __func__, MAC2STR(ll.sll_addr), (int) res);
168 
169 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
170 	if (l2->fd_br_rx >= 0) {
171 		u8 hash[SHA1_MAC_LEN];
172 		const u8 *addr[1];
173 		size_t len[1];
174 
175 		/*
176 		 * Close the workaround socket if the kernel version seems to be
177 		 * able to deliver packets through the packet socket before
178 		 * authorization has been completed (in dormant state).
179 		 */
180 		if (l2->num_rx_br <= 1) {
181 			wpa_printf(MSG_DEBUG,
182 				   "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket",
183 				   l2->ifname);
184 			eloop_unregister_read_sock(l2->fd_br_rx);
185 			close(l2->fd_br_rx);
186 			l2->fd_br_rx = -1;
187 		}
188 
189 		addr[0] = buf;
190 		len[0] = res;
191 		sha1_vector(1, addr, len, hash);
192 		if (l2->last_from_br &&
193 		    os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
194 			wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX",
195 				   __func__);
196 			return;
197 		}
198 		if (l2->last_from_br_prev &&
199 		    os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) {
200 			wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)",
201 				   __func__);
202 			return;
203 		}
204 		os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN);
205 		l2->last_from_br_prev = l2->last_from_br;
206 		os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
207 	}
208 
209 	l2->last_from_br = 0;
210 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
211 	l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
212 }
213 
214 
215 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
l2_packet_receive_br(int sock,void * eloop_ctx,void * sock_ctx)216 static void l2_packet_receive_br(int sock, void *eloop_ctx, void *sock_ctx)
217 {
218 	struct l2_packet_data *l2 = eloop_ctx;
219 	u8 buf[2300];
220 	int res;
221 	struct sockaddr_ll ll;
222 	socklen_t fromlen;
223 	u8 hash[SHA1_MAC_LEN];
224 	const u8 *addr[1];
225 	size_t len[1];
226 
227 	l2->num_rx_br++;
228 	os_memset(&ll, 0, sizeof(ll));
229 	fromlen = sizeof(ll);
230 	res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
231 		       &fromlen);
232 	if (res < 0) {
233 		wpa_printf(MSG_DEBUG, "l2_packet_receive_br - recvfrom: %s",
234 			   strerror(errno));
235 		return;
236 	}
237 
238 	wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
239 		   __func__, MAC2STR(ll.sll_addr), (int) res);
240 
241 	if (os_memcmp(ll.sll_addr, l2->own_addr, ETH_ALEN) == 0) {
242 		wpa_printf(MSG_DEBUG, "%s: Drop RX of own frame", __func__);
243 		return;
244 	}
245 
246 	addr[0] = buf;
247 	len[0] = res;
248 	sha1_vector(1, addr, len, hash);
249 	if (!l2->last_from_br &&
250 	    os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
251 		wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", __func__);
252 		return;
253 	}
254 	if (!l2->last_from_br_prev &&
255 	    os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) {
256 		wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", __func__);
257 		return;
258 	}
259 	os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN);
260 	l2->last_from_br_prev = l2->last_from_br;
261 	l2->last_from_br = 1;
262 	os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
263 	l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
264 }
265 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
266 
267 
l2_packet_init(const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)268 struct l2_packet_data * l2_packet_init(
269 	const char *ifname, const u8 *own_addr, unsigned short protocol,
270 	void (*rx_callback)(void *ctx, const u8 *src_addr,
271 			    const u8 *buf, size_t len),
272 	void *rx_callback_ctx, int l2_hdr)
273 {
274 	struct l2_packet_data *l2;
275 	struct ifreq ifr;
276 	struct sockaddr_ll ll;
277 
278 	l2 = os_zalloc(sizeof(struct l2_packet_data));
279 	if (l2 == NULL)
280 		return NULL;
281 	os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
282 	l2->rx_callback = rx_callback;
283 	l2->rx_callback_ctx = rx_callback_ctx;
284 	l2->l2_hdr = l2_hdr;
285 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
286 	l2->fd_br_rx = -1;
287 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
288 
289 	l2->fd = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
290 			htons(protocol));
291 	if (l2->fd < 0) {
292 		wpa_printf(MSG_ERROR, "%s: socket(PF_PACKET): %s",
293 			   __func__, strerror(errno));
294 		os_free(l2);
295 		return NULL;
296 	}
297 	os_memset(&ifr, 0, sizeof(ifr));
298 	os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
299 	if (ioctl(l2->fd, SIOCGIFINDEX, &ifr) < 0) {
300 		wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFINDEX]: %s",
301 			   __func__, strerror(errno));
302 		close(l2->fd);
303 		os_free(l2);
304 		return NULL;
305 	}
306 	l2->ifindex = ifr.ifr_ifindex;
307 
308 	os_memset(&ll, 0, sizeof(ll));
309 	ll.sll_family = PF_PACKET;
310 	ll.sll_ifindex = ifr.ifr_ifindex;
311 	ll.sll_protocol = htons(protocol);
312 	if (bind(l2->fd, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
313 		wpa_printf(MSG_ERROR, "%s: bind[PF_PACKET]: %s",
314 			   __func__, strerror(errno));
315 		close(l2->fd);
316 		os_free(l2);
317 		return NULL;
318 	}
319 
320 	if (ioctl(l2->fd, SIOCGIFHWADDR, &ifr) < 0) {
321 		wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFHWADDR]: %s",
322 			   __func__, strerror(errno));
323 		close(l2->fd);
324 		os_free(l2);
325 		return NULL;
326 	}
327 	os_memcpy(l2->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
328 
329 	eloop_register_read_sock(l2->fd, l2_packet_receive, l2, NULL);
330 
331 	return l2;
332 }
333 
334 
l2_packet_init_bridge(const char * br_ifname,const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)335 struct l2_packet_data * l2_packet_init_bridge(
336 	const char *br_ifname, const char *ifname, const u8 *own_addr,
337 	unsigned short protocol,
338 	void (*rx_callback)(void *ctx, const u8 *src_addr,
339 			    const u8 *buf, size_t len),
340 	void *rx_callback_ctx, int l2_hdr)
341 {
342 	struct l2_packet_data *l2;
343 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
344 	struct sock_filter ethertype_sock_filter_insns[] = {
345 		/* Load ethertype */
346 		BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 2 * ETH_ALEN),
347 		/* Jump over next statement if ethertype does not match */
348 		BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, protocol, 0, 1),
349 		/* Ethertype match - return all */
350 		BPF_STMT(BPF_RET | BPF_K, ~0),
351 		/* No match - drop */
352 		BPF_STMT(BPF_RET | BPF_K, 0)
353 	};
354 	const struct sock_fprog ethertype_sock_filter = {
355 		.len = ARRAY_SIZE(ethertype_sock_filter_insns),
356 		.filter = ethertype_sock_filter_insns,
357 	};
358 	struct sockaddr_ll ll;
359 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
360 
361 	l2 = l2_packet_init(br_ifname, own_addr, protocol, rx_callback,
362 			    rx_callback_ctx, l2_hdr);
363 	if (!l2)
364 		return NULL;
365 
366 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
367 	/*
368 	 * The Linux packet socket behavior has changed over the years and there
369 	 * is an inconvenient regression in it that breaks RX for a specific
370 	 * protocol from interfaces in a bridge when that interface is not in
371 	 * fully operation state (i.e., when in station mode and not completed
372 	 * authorization). To work around this, register ETH_P_ALL version of
373 	 * the packet socket bound to the real netdev and use socket filter to
374 	 * match the ethertype value. This version is less efficient, but
375 	 * required for functionality with many kernel version. If the main
376 	 * packet socket is found to be working, this less efficient version
377 	 * gets closed automatically.
378 	 */
379 
380 	l2->fd_br_rx = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
381 			      htons(ETH_P_ALL));
382 	if (l2->fd_br_rx < 0) {
383 		wpa_printf(MSG_DEBUG, "%s: socket(PF_PACKET-fd_br_rx): %s",
384 			   __func__, strerror(errno));
385 		/* try to continue without the workaround RX socket */
386 		return l2;
387 	}
388 
389 	os_memset(&ll, 0, sizeof(ll));
390 	ll.sll_family = PF_PACKET;
391 	ll.sll_ifindex = if_nametoindex(ifname);
392 	ll.sll_protocol = htons(ETH_P_ALL);
393 	if (bind(l2->fd_br_rx, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
394 		wpa_printf(MSG_DEBUG, "%s: bind[PF_PACKET-fd_br_rx]: %s",
395 			   __func__, strerror(errno));
396 		/* try to continue without the workaround RX socket */
397 		close(l2->fd_br_rx);
398 		l2->fd_br_rx = -1;
399 		return l2;
400 	}
401 
402 	if (setsockopt(l2->fd_br_rx, SOL_SOCKET, SO_ATTACH_FILTER,
403 		       &ethertype_sock_filter, sizeof(struct sock_fprog))) {
404 		wpa_printf(MSG_DEBUG,
405 			   "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
406 			   strerror(errno));
407 		/* try to continue without the workaround RX socket */
408 		close(l2->fd_br_rx);
409 		l2->fd_br_rx = -1;
410 		return l2;
411 	}
412 
413 	eloop_register_read_sock(l2->fd_br_rx, l2_packet_receive_br, l2, NULL);
414 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
415 
416 	return l2;
417 }
418 
419 
l2_packet_deinit(struct l2_packet_data * l2)420 void l2_packet_deinit(struct l2_packet_data *l2)
421 {
422 	if (l2 == NULL)
423 		return;
424 
425 	if (l2->fd >= 0) {
426 		eloop_unregister_read_sock(l2->fd);
427 		close(l2->fd);
428 	}
429 
430 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
431 	if (l2->fd_br_rx >= 0) {
432 		eloop_unregister_read_sock(l2->fd_br_rx);
433 		close(l2->fd_br_rx);
434 	}
435 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
436 
437 	os_free(l2);
438 }
439 
440 
l2_packet_get_ip_addr(struct l2_packet_data * l2,char * buf,size_t len)441 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
442 {
443 	int s;
444 	struct ifreq ifr;
445 	struct sockaddr_in *saddr;
446 	size_t res;
447 
448 	s = socket(PF_INET, SOCK_DGRAM, 0);
449 	if (s < 0) {
450 		wpa_printf(MSG_ERROR, "%s: socket: %s",
451 			   __func__, strerror(errno));
452 		return -1;
453 	}
454 	os_memset(&ifr, 0, sizeof(ifr));
455 	os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
456 	if (ioctl(s, SIOCGIFADDR, &ifr) < 0) {
457 		if (errno != EADDRNOTAVAIL)
458 			wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFADDR]: %s",
459 				   __func__, strerror(errno));
460 		close(s);
461 		return -1;
462 	}
463 	close(s);
464 	saddr = aliasing_hide_typecast(&ifr.ifr_addr, struct sockaddr_in);
465 	if (saddr->sin_family != AF_INET)
466 		return -1;
467 	res = os_strlcpy(buf, inet_ntoa(saddr->sin_addr), len);
468 	if (res >= len)
469 		return -1;
470 	return 0;
471 }
472 
473 
l2_packet_notify_auth_start(struct l2_packet_data * l2)474 void l2_packet_notify_auth_start(struct l2_packet_data *l2)
475 {
476 }
477 
478 
l2_packet_set_packet_filter(struct l2_packet_data * l2,enum l2_packet_filter_type type)479 int l2_packet_set_packet_filter(struct l2_packet_data *l2,
480 				enum l2_packet_filter_type type)
481 {
482 	const struct sock_fprog *sock_filter;
483 
484 	if (TEST_FAIL())
485 		return -1;
486 
487 	switch (type) {
488 	case L2_PACKET_FILTER_DHCP:
489 		sock_filter = &dhcp_sock_filter;
490 		break;
491 	case L2_PACKET_FILTER_NDISC:
492 		sock_filter = &ndisc_sock_filter;
493 		break;
494 	case L2_PACKET_FILTER_PKTTYPE:
495 		sock_filter = &pkt_type_sock_filter;
496 		break;
497 	default:
498 		return -1;
499 	}
500 
501 	if (setsockopt(l2->fd, SOL_SOCKET, SO_ATTACH_FILTER,
502 		       sock_filter, sizeof(struct sock_fprog))) {
503 		wpa_printf(MSG_ERROR,
504 			   "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
505 			   strerror(errno));
506 		return -1;
507 	}
508 
509 	return 0;
510 }
511