1 /*
2 * WPA Supplicant - Layer2 packet handling with Linux packet sockets
3 * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #include <sys/ioctl.h>
11 #include <netpacket/packet.h>
12 #include <net/if.h>
13 #include <linux/filter.h>
14
15 #include "common.h"
16 #include "eloop.h"
17 #include "crypto/sha1.h"
18 #include "crypto/crypto.h"
19 #include "l2_packet.h"
20
21
22 struct l2_packet_data {
23 int fd; /* packet socket for EAPOL frames */
24 char ifname[IFNAMSIZ + 1];
25 int ifindex;
26 u8 own_addr[ETH_ALEN];
27 void (*rx_callback)(void *ctx, const u8 *src_addr,
28 const u8 *buf, size_t len);
29 void *rx_callback_ctx;
30 int l2_hdr; /* whether to include layer 2 (Ethernet) header data
31 * buffers */
32
33 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
34 /* For working around Linux packet socket behavior and regression. */
35 int fd_br_rx;
36 int last_from_br, last_from_br_prev;
37 u8 last_hash[SHA1_MAC_LEN];
38 u8 last_hash_prev[SHA1_MAC_LEN];
39 unsigned int num_rx_br;
40 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
41 };
42
43 /* Generated by 'sudo tcpdump -s 3000 -dd greater 278 and ip and udp and
44 * src port bootps and dst port bootpc'
45 */
46 static struct sock_filter dhcp_sock_filter_insns[] = {
47 { 0x80, 0, 0, 0x00000000 },
48 { 0x35, 0, 12, 0x00000116 },
49 { 0x28, 0, 0, 0x0000000c },
50 { 0x15, 0, 10, 0x00000800 },
51 { 0x30, 0, 0, 0x00000017 },
52 { 0x15, 0, 8, 0x00000011 },
53 { 0x28, 0, 0, 0x00000014 },
54 { 0x45, 6, 0, 0x00001fff },
55 { 0xb1, 0, 0, 0x0000000e },
56 { 0x48, 0, 0, 0x0000000e },
57 { 0x15, 0, 3, 0x00000043 },
58 { 0x48, 0, 0, 0x00000010 },
59 { 0x15, 0, 1, 0x00000044 },
60 { 0x6, 0, 0, 0x00000bb8 },
61 { 0x6, 0, 0, 0x00000000 },
62 };
63
64 static const struct sock_fprog dhcp_sock_filter = {
65 .len = ARRAY_SIZE(dhcp_sock_filter_insns),
66 .filter = dhcp_sock_filter_insns,
67 };
68
69
70 /* Generated by 'sudo tcpdump -dd -s 1500 multicast and ip6[6]=58' */
71 static struct sock_filter ndisc_sock_filter_insns[] = {
72 { 0x30, 0, 0, 0x00000000 },
73 { 0x45, 0, 5, 0x00000001 },
74 { 0x28, 0, 0, 0x0000000c },
75 { 0x15, 0, 3, 0x000086dd },
76 { 0x30, 0, 0, 0x00000014 },
77 { 0x15, 0, 1, 0x0000003a },
78 { 0x6, 0, 0, 0x000005dc },
79 { 0x6, 0, 0, 0x00000000 },
80 };
81
82 static const struct sock_fprog ndisc_sock_filter = {
83 .len = ARRAY_SIZE(ndisc_sock_filter_insns),
84 .filter = ndisc_sock_filter_insns,
85 };
86
87
l2_packet_get_own_addr(struct l2_packet_data * l2,u8 * addr)88 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
89 {
90 os_memcpy(addr, l2->own_addr, ETH_ALEN);
91 return 0;
92 }
93
94
l2_packet_send(struct l2_packet_data * l2,const u8 * dst_addr,u16 proto,const u8 * buf,size_t len)95 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
96 const u8 *buf, size_t len)
97 {
98 int ret;
99
100 if (TEST_FAIL())
101 return -1;
102 if (l2 == NULL)
103 return -1;
104 if (l2->l2_hdr) {
105 ret = send(l2->fd, buf, len, 0);
106 if (ret < 0)
107 wpa_printf(MSG_ERROR, "l2_packet_send - send: %s",
108 strerror(errno));
109 } else {
110 struct sockaddr_ll ll;
111 os_memset(&ll, 0, sizeof(ll));
112 ll.sll_family = AF_PACKET;
113 ll.sll_ifindex = l2->ifindex;
114 ll.sll_protocol = htons(proto);
115 ll.sll_halen = ETH_ALEN;
116 os_memcpy(ll.sll_addr, dst_addr, ETH_ALEN);
117 ret = sendto(l2->fd, buf, len, 0, (struct sockaddr *) &ll,
118 sizeof(ll));
119 if (ret < 0) {
120 wpa_printf(MSG_ERROR, "l2_packet_send - sendto: %s",
121 strerror(errno));
122 }
123 }
124 return ret;
125 }
126
127
l2_packet_receive(int sock,void * eloop_ctx,void * sock_ctx)128 static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
129 {
130 struct l2_packet_data *l2 = eloop_ctx;
131 u8 buf[2300];
132 int res;
133 struct sockaddr_ll ll;
134 socklen_t fromlen;
135
136 os_memset(&ll, 0, sizeof(ll));
137 fromlen = sizeof(ll);
138 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
139 &fromlen);
140 if (res < 0) {
141 wpa_printf(MSG_DEBUG, "l2_packet_receive - recvfrom: %s",
142 strerror(errno));
143 return;
144 }
145
146 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
147 __func__, MAC2STR(ll.sll_addr), (int) res);
148
149 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
150 if (l2->fd_br_rx >= 0) {
151 u8 hash[SHA1_MAC_LEN];
152 const u8 *addr[1];
153 size_t len[1];
154
155 /*
156 * Close the workaround socket if the kernel version seems to be
157 * able to deliver packets through the packet socket before
158 * authorization has been completed (in dormant state).
159 */
160 if (l2->num_rx_br <= 1) {
161 wpa_printf(MSG_DEBUG,
162 "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket",
163 l2->ifname);
164 eloop_unregister_read_sock(l2->fd_br_rx);
165 close(l2->fd_br_rx);
166 l2->fd_br_rx = -1;
167 }
168
169 addr[0] = buf;
170 len[0] = res;
171 sha1_vector(1, addr, len, hash);
172 if (l2->last_from_br &&
173 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
174 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX",
175 __func__);
176 return;
177 }
178 if (l2->last_from_br_prev &&
179 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) {
180 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)",
181 __func__);
182 return;
183 }
184 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN);
185 l2->last_from_br_prev = l2->last_from_br;
186 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
187 }
188
189 l2->last_from_br = 0;
190 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
191 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
192 }
193
194
195 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
l2_packet_receive_br(int sock,void * eloop_ctx,void * sock_ctx)196 static void l2_packet_receive_br(int sock, void *eloop_ctx, void *sock_ctx)
197 {
198 struct l2_packet_data *l2 = eloop_ctx;
199 u8 buf[2300];
200 int res;
201 struct sockaddr_ll ll;
202 socklen_t fromlen;
203 u8 hash[SHA1_MAC_LEN];
204 const u8 *addr[1];
205 size_t len[1];
206
207 l2->num_rx_br++;
208 os_memset(&ll, 0, sizeof(ll));
209 fromlen = sizeof(ll);
210 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll,
211 &fromlen);
212 if (res < 0) {
213 wpa_printf(MSG_DEBUG, "l2_packet_receive_br - recvfrom: %s",
214 strerror(errno));
215 return;
216 }
217
218 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d",
219 __func__, MAC2STR(ll.sll_addr), (int) res);
220
221 if (os_memcmp(ll.sll_addr, l2->own_addr, ETH_ALEN) == 0) {
222 wpa_printf(MSG_DEBUG, "%s: Drop RX of own frame", __func__);
223 return;
224 }
225
226 addr[0] = buf;
227 len[0] = res;
228 sha1_vector(1, addr, len, hash);
229 if (!l2->last_from_br &&
230 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) {
231 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", __func__);
232 return;
233 }
234 if (!l2->last_from_br_prev &&
235 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) {
236 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", __func__);
237 return;
238 }
239 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN);
240 l2->last_from_br_prev = l2->last_from_br;
241 l2->last_from_br = 1;
242 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN);
243 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
244 }
245 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
246
247
l2_packet_init(const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)248 struct l2_packet_data * l2_packet_init(
249 const char *ifname, const u8 *own_addr, unsigned short protocol,
250 void (*rx_callback)(void *ctx, const u8 *src_addr,
251 const u8 *buf, size_t len),
252 void *rx_callback_ctx, int l2_hdr)
253 {
254 struct l2_packet_data *l2;
255 struct ifreq ifr;
256 struct sockaddr_ll ll;
257
258 l2 = os_zalloc(sizeof(struct l2_packet_data));
259 if (l2 == NULL)
260 return NULL;
261 os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
262 l2->rx_callback = rx_callback;
263 l2->rx_callback_ctx = rx_callback_ctx;
264 l2->l2_hdr = l2_hdr;
265 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
266 l2->fd_br_rx = -1;
267 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
268
269 l2->fd = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
270 htons(protocol));
271 if (l2->fd < 0) {
272 wpa_printf(MSG_ERROR, "%s: socket(PF_PACKET): %s",
273 __func__, strerror(errno));
274 os_free(l2);
275 return NULL;
276 }
277 os_memset(&ifr, 0, sizeof(ifr));
278 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
279 if (ioctl(l2->fd, SIOCGIFINDEX, &ifr) < 0) {
280 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFINDEX]: %s",
281 __func__, strerror(errno));
282 close(l2->fd);
283 os_free(l2);
284 return NULL;
285 }
286 l2->ifindex = ifr.ifr_ifindex;
287
288 os_memset(&ll, 0, sizeof(ll));
289 ll.sll_family = PF_PACKET;
290 ll.sll_ifindex = ifr.ifr_ifindex;
291 ll.sll_protocol = htons(protocol);
292 if (bind(l2->fd, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
293 wpa_printf(MSG_ERROR, "%s: bind[PF_PACKET]: %s",
294 __func__, strerror(errno));
295 close(l2->fd);
296 os_free(l2);
297 return NULL;
298 }
299
300 if (ioctl(l2->fd, SIOCGIFHWADDR, &ifr) < 0) {
301 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFHWADDR]: %s",
302 __func__, strerror(errno));
303 close(l2->fd);
304 os_free(l2);
305 return NULL;
306 }
307 os_memcpy(l2->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
308
309 eloop_register_read_sock(l2->fd, l2_packet_receive, l2, NULL);
310
311 return l2;
312 }
313
314
l2_packet_init_bridge(const char * br_ifname,const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)315 struct l2_packet_data * l2_packet_init_bridge(
316 const char *br_ifname, const char *ifname, const u8 *own_addr,
317 unsigned short protocol,
318 void (*rx_callback)(void *ctx, const u8 *src_addr,
319 const u8 *buf, size_t len),
320 void *rx_callback_ctx, int l2_hdr)
321 {
322 struct l2_packet_data *l2;
323 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
324 struct sock_filter ethertype_sock_filter_insns[] = {
325 /* Load ethertype */
326 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 2 * ETH_ALEN),
327 /* Jump over next statement if ethertype does not match */
328 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, protocol, 0, 1),
329 /* Ethertype match - return all */
330 BPF_STMT(BPF_RET | BPF_K, ~0),
331 /* No match - drop */
332 BPF_STMT(BPF_RET | BPF_K, 0)
333 };
334 const struct sock_fprog ethertype_sock_filter = {
335 .len = ARRAY_SIZE(ethertype_sock_filter_insns),
336 .filter = ethertype_sock_filter_insns,
337 };
338 struct sockaddr_ll ll;
339 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
340
341 l2 = l2_packet_init(br_ifname, own_addr, protocol, rx_callback,
342 rx_callback_ctx, l2_hdr);
343 if (!l2)
344 return NULL;
345
346 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
347 /*
348 * The Linux packet socket behavior has changed over the years and there
349 * is an inconvenient regression in it that breaks RX for a specific
350 * protocol from interfaces in a bridge when that interface is not in
351 * fully operation state (i.e., when in station mode and not completed
352 * authorization). To work around this, register ETH_P_ALL version of
353 * the packet socket bound to the real netdev and use socket filter to
354 * match the ethertype value. This version is less efficient, but
355 * required for functionality with many kernel version. If the main
356 * packet socket is found to be working, this less efficient version
357 * gets closed automatically.
358 */
359
360 l2->fd_br_rx = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM,
361 htons(ETH_P_ALL));
362 if (l2->fd_br_rx < 0) {
363 wpa_printf(MSG_DEBUG, "%s: socket(PF_PACKET-fd_br_rx): %s",
364 __func__, strerror(errno));
365 /* try to continue without the workaround RX socket */
366 return l2;
367 }
368
369 os_memset(&ll, 0, sizeof(ll));
370 ll.sll_family = PF_PACKET;
371 ll.sll_ifindex = if_nametoindex(ifname);
372 ll.sll_protocol = htons(ETH_P_ALL);
373 if (bind(l2->fd_br_rx, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
374 wpa_printf(MSG_DEBUG, "%s: bind[PF_PACKET-fd_br_rx]: %s",
375 __func__, strerror(errno));
376 /* try to continue without the workaround RX socket */
377 close(l2->fd_br_rx);
378 l2->fd_br_rx = -1;
379 return l2;
380 }
381
382 if (setsockopt(l2->fd_br_rx, SOL_SOCKET, SO_ATTACH_FILTER,
383 ðertype_sock_filter, sizeof(struct sock_fprog))) {
384 wpa_printf(MSG_DEBUG,
385 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
386 strerror(errno));
387 /* try to continue without the workaround RX socket */
388 close(l2->fd_br_rx);
389 l2->fd_br_rx = -1;
390 return l2;
391 }
392
393 eloop_register_read_sock(l2->fd_br_rx, l2_packet_receive_br, l2, NULL);
394 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
395
396 return l2;
397 }
398
399
l2_packet_deinit(struct l2_packet_data * l2)400 void l2_packet_deinit(struct l2_packet_data *l2)
401 {
402 if (l2 == NULL)
403 return;
404
405 if (l2->fd >= 0) {
406 eloop_unregister_read_sock(l2->fd);
407 close(l2->fd);
408 }
409
410 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR
411 if (l2->fd_br_rx >= 0) {
412 eloop_unregister_read_sock(l2->fd_br_rx);
413 close(l2->fd_br_rx);
414 }
415 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */
416
417 os_free(l2);
418 }
419
420
l2_packet_get_ip_addr(struct l2_packet_data * l2,char * buf,size_t len)421 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
422 {
423 int s;
424 struct ifreq ifr;
425 struct sockaddr_in *saddr;
426 size_t res;
427
428 s = socket(PF_INET, SOCK_DGRAM, 0);
429 if (s < 0) {
430 wpa_printf(MSG_ERROR, "%s: socket: %s",
431 __func__, strerror(errno));
432 return -1;
433 }
434 os_memset(&ifr, 0, sizeof(ifr));
435 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name));
436 if (ioctl(s, SIOCGIFADDR, &ifr) < 0) {
437 if (errno != EADDRNOTAVAIL)
438 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFADDR]: %s",
439 __func__, strerror(errno));
440 close(s);
441 return -1;
442 }
443 close(s);
444 saddr = aliasing_hide_typecast(&ifr.ifr_addr, struct sockaddr_in);
445 if (saddr->sin_family != AF_INET)
446 return -1;
447 res = os_strlcpy(buf, inet_ntoa(saddr->sin_addr), len);
448 if (res >= len)
449 return -1;
450 return 0;
451 }
452
453
l2_packet_notify_auth_start(struct l2_packet_data * l2)454 void l2_packet_notify_auth_start(struct l2_packet_data *l2)
455 {
456 }
457
458
l2_packet_set_packet_filter(struct l2_packet_data * l2,enum l2_packet_filter_type type)459 int l2_packet_set_packet_filter(struct l2_packet_data *l2,
460 enum l2_packet_filter_type type)
461 {
462 const struct sock_fprog *sock_filter;
463
464 if (TEST_FAIL())
465 return -1;
466
467 switch (type) {
468 case L2_PACKET_FILTER_DHCP:
469 sock_filter = &dhcp_sock_filter;
470 break;
471 case L2_PACKET_FILTER_NDISC:
472 sock_filter = &ndisc_sock_filter;
473 break;
474 default:
475 return -1;
476 }
477
478 if (setsockopt(l2->fd, SOL_SOCKET, SO_ATTACH_FILTER,
479 sock_filter, sizeof(struct sock_fprog))) {
480 wpa_printf(MSG_ERROR,
481 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s",
482 strerror(errno));
483 return -1;
484 }
485
486 return 0;
487 }
488