1 /* 2 * WPA Supplicant - Layer2 packet handling with Linux packet sockets 3 * Copyright (c) 2003-2015, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <sys/ioctl.h> 11 #include <netpacket/packet.h> 12 #include <net/if.h> 13 #include <linux/filter.h> 14 15 #include "common.h" 16 #include "eloop.h" 17 #include "crypto/sha1.h" 18 #include "crypto/crypto.h" 19 #include "l2_packet.h" 20 21 22 struct l2_packet_data { 23 int fd; /* packet socket for EAPOL frames */ 24 char ifname[IFNAMSIZ + 1]; 25 int ifindex; 26 u8 own_addr[ETH_ALEN]; 27 void (*rx_callback)(void *ctx, const u8 *src_addr, 28 const u8 *buf, size_t len); 29 void *rx_callback_ctx; 30 int l2_hdr; /* whether to include layer 2 (Ethernet) header data 31 * buffers */ 32 33 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 34 /* For working around Linux packet socket behavior and regression. */ 35 int fd_br_rx; 36 int last_from_br, last_from_br_prev; 37 u8 last_hash[SHA1_MAC_LEN]; 38 u8 last_hash_prev[SHA1_MAC_LEN]; 39 unsigned int num_rx_br; 40 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 41 }; 42 43 /* Generated by 'sudo tcpdump -s 3000 -dd greater 278 and ip and udp and 44 * src port bootps and dst port bootpc' 45 */ 46 static struct sock_filter dhcp_sock_filter_insns[] = { 47 { 0x80, 0, 0, 0x00000000 }, 48 { 0x35, 0, 12, 0x00000116 }, 49 { 0x28, 0, 0, 0x0000000c }, 50 { 0x15, 0, 10, 0x00000800 }, 51 { 0x30, 0, 0, 0x00000017 }, 52 { 0x15, 0, 8, 0x00000011 }, 53 { 0x28, 0, 0, 0x00000014 }, 54 { 0x45, 6, 0, 0x00001fff }, 55 { 0xb1, 0, 0, 0x0000000e }, 56 { 0x48, 0, 0, 0x0000000e }, 57 { 0x15, 0, 3, 0x00000043 }, 58 { 0x48, 0, 0, 0x00000010 }, 59 { 0x15, 0, 1, 0x00000044 }, 60 { 0x6, 0, 0, 0x00000bb8 }, 61 { 0x6, 0, 0, 0x00000000 }, 62 }; 63 64 static const struct sock_fprog dhcp_sock_filter = { 65 .len = ARRAY_SIZE(dhcp_sock_filter_insns), 66 .filter = dhcp_sock_filter_insns, 67 }; 68 69 70 /* Generated by 'sudo tcpdump -dd -s 1500 multicast and ip6[6]=58' */ 71 static struct sock_filter ndisc_sock_filter_insns[] = { 72 { 0x30, 0, 0, 0x00000000 }, 73 { 0x45, 0, 5, 0x00000001 }, 74 { 0x28, 0, 0, 0x0000000c }, 75 { 0x15, 0, 3, 0x000086dd }, 76 { 0x30, 0, 0, 0x00000014 }, 77 { 0x15, 0, 1, 0x0000003a }, 78 { 0x6, 0, 0, 0x000005dc }, 79 { 0x6, 0, 0, 0x00000000 }, 80 }; 81 82 static const struct sock_fprog ndisc_sock_filter = { 83 .len = ARRAY_SIZE(ndisc_sock_filter_insns), 84 .filter = ndisc_sock_filter_insns, 85 }; 86 87 88 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr) 89 { 90 os_memcpy(addr, l2->own_addr, ETH_ALEN); 91 return 0; 92 } 93 94 95 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto, 96 const u8 *buf, size_t len) 97 { 98 int ret; 99 100 if (TEST_FAIL()) 101 return -1; 102 if (l2 == NULL) 103 return -1; 104 if (l2->l2_hdr) { 105 ret = send(l2->fd, buf, len, 0); 106 if (ret < 0) 107 wpa_printf(MSG_ERROR, "l2_packet_send - send: %s", 108 strerror(errno)); 109 } else { 110 struct sockaddr_ll ll; 111 os_memset(&ll, 0, sizeof(ll)); 112 ll.sll_family = AF_PACKET; 113 ll.sll_ifindex = l2->ifindex; 114 ll.sll_protocol = htons(proto); 115 ll.sll_halen = ETH_ALEN; 116 os_memcpy(ll.sll_addr, dst_addr, ETH_ALEN); 117 ret = sendto(l2->fd, buf, len, 0, (struct sockaddr *) &ll, 118 sizeof(ll)); 119 if (ret < 0) { 120 wpa_printf(MSG_ERROR, "l2_packet_send - sendto: %s", 121 strerror(errno)); 122 } 123 } 124 return ret; 125 } 126 127 128 static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx) 129 { 130 struct l2_packet_data *l2 = eloop_ctx; 131 u8 buf[2300]; 132 int res; 133 struct sockaddr_ll ll; 134 socklen_t fromlen; 135 136 os_memset(&ll, 0, sizeof(ll)); 137 fromlen = sizeof(ll); 138 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll, 139 &fromlen); 140 if (res < 0) { 141 wpa_printf(MSG_DEBUG, "l2_packet_receive - recvfrom: %s", 142 strerror(errno)); 143 return; 144 } 145 146 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d", 147 __func__, MAC2STR(ll.sll_addr), (int) res); 148 149 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 150 if (l2->fd_br_rx >= 0) { 151 u8 hash[SHA1_MAC_LEN]; 152 const u8 *addr[1]; 153 size_t len[1]; 154 155 /* 156 * Close the workaround socket if the kernel version seems to be 157 * able to deliver packets through the packet socket before 158 * authorization has been completed (in dormant state). 159 */ 160 if (l2->num_rx_br <= 1) { 161 wpa_printf(MSG_DEBUG, 162 "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket", 163 l2->ifname); 164 eloop_unregister_read_sock(l2->fd_br_rx); 165 close(l2->fd_br_rx); 166 l2->fd_br_rx = -1; 167 } 168 169 addr[0] = buf; 170 len[0] = res; 171 sha1_vector(1, addr, len, hash); 172 if (l2->last_from_br && 173 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) { 174 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", 175 __func__); 176 return; 177 } 178 if (l2->last_from_br_prev && 179 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) { 180 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", 181 __func__); 182 return; 183 } 184 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN); 185 l2->last_from_br_prev = l2->last_from_br; 186 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN); 187 } 188 189 l2->last_from_br = 0; 190 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 191 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res); 192 } 193 194 195 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 196 static void l2_packet_receive_br(int sock, void *eloop_ctx, void *sock_ctx) 197 { 198 struct l2_packet_data *l2 = eloop_ctx; 199 u8 buf[2300]; 200 int res; 201 struct sockaddr_ll ll; 202 socklen_t fromlen; 203 u8 hash[SHA1_MAC_LEN]; 204 const u8 *addr[1]; 205 size_t len[1]; 206 207 l2->num_rx_br++; 208 os_memset(&ll, 0, sizeof(ll)); 209 fromlen = sizeof(ll); 210 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll, 211 &fromlen); 212 if (res < 0) { 213 wpa_printf(MSG_DEBUG, "l2_packet_receive_br - recvfrom: %s", 214 strerror(errno)); 215 return; 216 } 217 218 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d", 219 __func__, MAC2STR(ll.sll_addr), (int) res); 220 221 if (os_memcmp(ll.sll_addr, l2->own_addr, ETH_ALEN) == 0) { 222 wpa_printf(MSG_DEBUG, "%s: Drop RX of own frame", __func__); 223 return; 224 } 225 226 addr[0] = buf; 227 len[0] = res; 228 sha1_vector(1, addr, len, hash); 229 if (!l2->last_from_br && 230 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) { 231 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", __func__); 232 return; 233 } 234 if (!l2->last_from_br_prev && 235 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) { 236 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", __func__); 237 return; 238 } 239 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN); 240 l2->last_from_br_prev = l2->last_from_br; 241 l2->last_from_br = 1; 242 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN); 243 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res); 244 } 245 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 246 247 248 struct l2_packet_data * l2_packet_init( 249 const char *ifname, const u8 *own_addr, unsigned short protocol, 250 void (*rx_callback)(void *ctx, const u8 *src_addr, 251 const u8 *buf, size_t len), 252 void *rx_callback_ctx, int l2_hdr) 253 { 254 struct l2_packet_data *l2; 255 struct ifreq ifr; 256 struct sockaddr_ll ll; 257 258 l2 = os_zalloc(sizeof(struct l2_packet_data)); 259 if (l2 == NULL) 260 return NULL; 261 os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname)); 262 l2->rx_callback = rx_callback; 263 l2->rx_callback_ctx = rx_callback_ctx; 264 l2->l2_hdr = l2_hdr; 265 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 266 l2->fd_br_rx = -1; 267 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 268 269 l2->fd = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM, 270 htons(protocol)); 271 if (l2->fd < 0) { 272 wpa_printf(MSG_ERROR, "%s: socket(PF_PACKET): %s", 273 __func__, strerror(errno)); 274 os_free(l2); 275 return NULL; 276 } 277 os_memset(&ifr, 0, sizeof(ifr)); 278 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name)); 279 if (ioctl(l2->fd, SIOCGIFINDEX, &ifr) < 0) { 280 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFINDEX]: %s", 281 __func__, strerror(errno)); 282 close(l2->fd); 283 os_free(l2); 284 return NULL; 285 } 286 l2->ifindex = ifr.ifr_ifindex; 287 288 os_memset(&ll, 0, sizeof(ll)); 289 ll.sll_family = PF_PACKET; 290 ll.sll_ifindex = ifr.ifr_ifindex; 291 ll.sll_protocol = htons(protocol); 292 if (bind(l2->fd, (struct sockaddr *) &ll, sizeof(ll)) < 0) { 293 wpa_printf(MSG_ERROR, "%s: bind[PF_PACKET]: %s", 294 __func__, strerror(errno)); 295 close(l2->fd); 296 os_free(l2); 297 return NULL; 298 } 299 300 if (ioctl(l2->fd, SIOCGIFHWADDR, &ifr) < 0) { 301 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFHWADDR]: %s", 302 __func__, strerror(errno)); 303 close(l2->fd); 304 os_free(l2); 305 return NULL; 306 } 307 os_memcpy(l2->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN); 308 309 eloop_register_read_sock(l2->fd, l2_packet_receive, l2, NULL); 310 311 return l2; 312 } 313 314 315 struct l2_packet_data * l2_packet_init_bridge( 316 const char *br_ifname, const char *ifname, const u8 *own_addr, 317 unsigned short protocol, 318 void (*rx_callback)(void *ctx, const u8 *src_addr, 319 const u8 *buf, size_t len), 320 void *rx_callback_ctx, int l2_hdr) 321 { 322 struct l2_packet_data *l2; 323 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 324 struct sock_filter ethertype_sock_filter_insns[] = { 325 /* Load ethertype */ 326 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 2 * ETH_ALEN), 327 /* Jump over next statement if ethertype does not match */ 328 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, protocol, 0, 1), 329 /* Ethertype match - return all */ 330 BPF_STMT(BPF_RET | BPF_K, ~0), 331 /* No match - drop */ 332 BPF_STMT(BPF_RET | BPF_K, 0) 333 }; 334 const struct sock_fprog ethertype_sock_filter = { 335 .len = ARRAY_SIZE(ethertype_sock_filter_insns), 336 .filter = ethertype_sock_filter_insns, 337 }; 338 struct sockaddr_ll ll; 339 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 340 341 l2 = l2_packet_init(br_ifname, own_addr, protocol, rx_callback, 342 rx_callback_ctx, l2_hdr); 343 if (!l2) 344 return NULL; 345 346 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 347 /* 348 * The Linux packet socket behavior has changed over the years and there 349 * is an inconvenient regression in it that breaks RX for a specific 350 * protocol from interfaces in a bridge when that interface is not in 351 * fully operation state (i.e., when in station mode and not completed 352 * authorization). To work around this, register ETH_P_ALL version of 353 * the packet socket bound to the real netdev and use socket filter to 354 * match the ethertype value. This version is less efficient, but 355 * required for functionality with many kernel version. If the main 356 * packet socket is found to be working, this less efficient version 357 * gets closed automatically. 358 */ 359 360 l2->fd_br_rx = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM, 361 htons(ETH_P_ALL)); 362 if (l2->fd_br_rx < 0) { 363 wpa_printf(MSG_DEBUG, "%s: socket(PF_PACKET-fd_br_rx): %s", 364 __func__, strerror(errno)); 365 /* try to continue without the workaround RX socket */ 366 return l2; 367 } 368 369 os_memset(&ll, 0, sizeof(ll)); 370 ll.sll_family = PF_PACKET; 371 ll.sll_ifindex = if_nametoindex(ifname); 372 ll.sll_protocol = htons(ETH_P_ALL); 373 if (bind(l2->fd_br_rx, (struct sockaddr *) &ll, sizeof(ll)) < 0) { 374 wpa_printf(MSG_DEBUG, "%s: bind[PF_PACKET-fd_br_rx]: %s", 375 __func__, strerror(errno)); 376 /* try to continue without the workaround RX socket */ 377 close(l2->fd_br_rx); 378 l2->fd_br_rx = -1; 379 return l2; 380 } 381 382 if (setsockopt(l2->fd_br_rx, SOL_SOCKET, SO_ATTACH_FILTER, 383 ðertype_sock_filter, sizeof(struct sock_fprog))) { 384 wpa_printf(MSG_DEBUG, 385 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s", 386 strerror(errno)); 387 /* try to continue without the workaround RX socket */ 388 close(l2->fd_br_rx); 389 l2->fd_br_rx = -1; 390 return l2; 391 } 392 393 eloop_register_read_sock(l2->fd_br_rx, l2_packet_receive_br, l2, NULL); 394 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 395 396 return l2; 397 } 398 399 400 void l2_packet_deinit(struct l2_packet_data *l2) 401 { 402 if (l2 == NULL) 403 return; 404 405 if (l2->fd >= 0) { 406 eloop_unregister_read_sock(l2->fd); 407 close(l2->fd); 408 } 409 410 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 411 if (l2->fd_br_rx >= 0) { 412 eloop_unregister_read_sock(l2->fd_br_rx); 413 close(l2->fd_br_rx); 414 } 415 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 416 417 os_free(l2); 418 } 419 420 421 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len) 422 { 423 int s; 424 struct ifreq ifr; 425 struct sockaddr_in *saddr; 426 size_t res; 427 428 s = socket(PF_INET, SOCK_DGRAM, 0); 429 if (s < 0) { 430 wpa_printf(MSG_ERROR, "%s: socket: %s", 431 __func__, strerror(errno)); 432 return -1; 433 } 434 os_memset(&ifr, 0, sizeof(ifr)); 435 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name)); 436 if (ioctl(s, SIOCGIFADDR, &ifr) < 0) { 437 if (errno != EADDRNOTAVAIL) 438 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFADDR]: %s", 439 __func__, strerror(errno)); 440 close(s); 441 return -1; 442 } 443 close(s); 444 saddr = aliasing_hide_typecast(&ifr.ifr_addr, struct sockaddr_in); 445 if (saddr->sin_family != AF_INET) 446 return -1; 447 res = os_strlcpy(buf, inet_ntoa(saddr->sin_addr), len); 448 if (res >= len) 449 return -1; 450 return 0; 451 } 452 453 454 void l2_packet_notify_auth_start(struct l2_packet_data *l2) 455 { 456 } 457 458 459 int l2_packet_set_packet_filter(struct l2_packet_data *l2, 460 enum l2_packet_filter_type type) 461 { 462 const struct sock_fprog *sock_filter; 463 464 if (TEST_FAIL()) 465 return -1; 466 467 switch (type) { 468 case L2_PACKET_FILTER_DHCP: 469 sock_filter = &dhcp_sock_filter; 470 break; 471 case L2_PACKET_FILTER_NDISC: 472 sock_filter = &ndisc_sock_filter; 473 break; 474 default: 475 return -1; 476 } 477 478 if (setsockopt(l2->fd, SOL_SOCKET, SO_ATTACH_FILTER, 479 sock_filter, sizeof(struct sock_fprog))) { 480 wpa_printf(MSG_ERROR, 481 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s", 482 strerror(errno)); 483 return -1; 484 } 485 486 return 0; 487 } 488
