1 /* 2 * WPA Supplicant - Layer2 packet handling with Linux packet sockets 3 * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <sys/ioctl.h> 11 #include <netpacket/packet.h> 12 #include <net/if.h> 13 #include <linux/filter.h> 14 15 #include "common.h" 16 #include "eloop.h" 17 #include "crypto/sha1.h" 18 #include "crypto/crypto.h" 19 #include "l2_packet.h" 20 21 22 struct l2_packet_data { 23 int fd; /* packet socket for EAPOL frames */ 24 char ifname[IFNAMSIZ + 1]; 25 int ifindex; 26 u8 own_addr[ETH_ALEN]; 27 void (*rx_callback)(void *ctx, const u8 *src_addr, 28 const u8 *buf, size_t len); 29 void *rx_callback_ctx; 30 int l2_hdr; /* whether to include layer 2 (Ethernet) header data 31 * buffers */ 32 33 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 34 /* For working around Linux packet socket behavior and regression. */ 35 int fd_br_rx; 36 int last_from_br, last_from_br_prev; 37 u8 last_hash[SHA1_MAC_LEN]; 38 u8 last_hash_prev[SHA1_MAC_LEN]; 39 unsigned int num_rx_br; 40 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 41 }; 42 43 /* Generated by 'sudo tcpdump -s 3000 -dd greater 278 and ip and udp and 44 * src port bootps and dst port bootpc' 45 */ 46 static struct sock_filter dhcp_sock_filter_insns[] = { 47 { 0x80, 0, 0, 0x00000000 }, 48 { 0x35, 0, 12, 0x00000116 }, 49 { 0x28, 0, 0, 0x0000000c }, 50 { 0x15, 0, 10, 0x00000800 }, 51 { 0x30, 0, 0, 0x00000017 }, 52 { 0x15, 0, 8, 0x00000011 }, 53 { 0x28, 0, 0, 0x00000014 }, 54 { 0x45, 6, 0, 0x00001fff }, 55 { 0xb1, 0, 0, 0x0000000e }, 56 { 0x48, 0, 0, 0x0000000e }, 57 { 0x15, 0, 3, 0x00000043 }, 58 { 0x48, 0, 0, 0x00000010 }, 59 { 0x15, 0, 1, 0x00000044 }, 60 { 0x6, 0, 0, 0x00000bb8 }, 61 { 0x6, 0, 0, 0x00000000 }, 62 }; 63 64 static const struct sock_fprog dhcp_sock_filter = { 65 .len = ARRAY_SIZE(dhcp_sock_filter_insns), 66 .filter = dhcp_sock_filter_insns, 67 }; 68 69 70 /* Generated by 'sudo tcpdump -dd -s 1500 multicast and ip6[6]=58' */ 71 static struct sock_filter ndisc_sock_filter_insns[] = { 72 { 0x30, 0, 0, 0x00000000 }, 73 { 0x45, 0, 5, 0x00000001 }, 74 { 0x28, 0, 0, 0x0000000c }, 75 { 0x15, 0, 3, 0x000086dd }, 76 { 0x30, 0, 0, 0x00000014 }, 77 { 0x15, 0, 1, 0x0000003a }, 78 { 0x6, 0, 0, 0x000005dc }, 79 { 0x6, 0, 0, 0x00000000 }, 80 }; 81 82 static const struct sock_fprog ndisc_sock_filter = { 83 .len = ARRAY_SIZE(ndisc_sock_filter_insns), 84 .filter = ndisc_sock_filter_insns, 85 }; 86 87 /* drop packet if skb->pkt_type is PACKET_OTHERHOST (0x03). Generated by: 88 * $ bpfc - <<EOF 89 * > ldb #type 90 * > jeq #0x03, drop 91 * > pass: ret #-1 92 * > drop: ret #0 93 * > EOF 94 */ 95 static struct sock_filter pkt_type_filter_insns[] = { 96 { 0x30, 0, 0, 0xfffff004 }, 97 { 0x15, 1, 0, 0x00000003 }, 98 { 0x6, 0, 0, 0xffffffff }, 99 { 0x6, 0, 0, 0x00000000 }, 100 }; 101 102 static const struct sock_fprog pkt_type_sock_filter = { 103 .len = ARRAY_SIZE(pkt_type_filter_insns), 104 .filter = pkt_type_filter_insns, 105 }; 106 107 l2_packet_get_own_addr(struct l2_packet_data * l2,u8 * addr)108 int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr) 109 { 110 os_memcpy(addr, l2->own_addr, ETH_ALEN); 111 return 0; 112 } 113 114 l2_packet_send(struct l2_packet_data * l2,const u8 * dst_addr,u16 proto,const u8 * buf,size_t len)115 int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto, 116 const u8 *buf, size_t len) 117 { 118 int ret; 119 120 if (TEST_FAIL()) 121 return -1; 122 if (l2 == NULL) 123 return -1; 124 if (l2->l2_hdr) { 125 ret = send(l2->fd, buf, len, 0); 126 if (ret < 0) 127 wpa_printf(MSG_ERROR, "l2_packet_send - send: %s", 128 strerror(errno)); 129 } else { 130 struct sockaddr_ll ll; 131 os_memset(&ll, 0, sizeof(ll)); 132 ll.sll_family = AF_PACKET; 133 ll.sll_ifindex = l2->ifindex; 134 ll.sll_protocol = htons(proto); 135 ll.sll_halen = ETH_ALEN; 136 os_memcpy(ll.sll_addr, dst_addr, ETH_ALEN); 137 ret = sendto(l2->fd, buf, len, 0, (struct sockaddr *) &ll, 138 sizeof(ll)); 139 if (ret < 0) { 140 wpa_printf(MSG_ERROR, "l2_packet_send - sendto: %s", 141 strerror(errno)); 142 } 143 } 144 return ret; 145 } 146 147 l2_packet_receive(int sock,void * eloop_ctx,void * sock_ctx)148 static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx) 149 { 150 struct l2_packet_data *l2 = eloop_ctx; 151 u8 buf[2300]; 152 int res; 153 struct sockaddr_ll ll; 154 socklen_t fromlen; 155 156 os_memset(&ll, 0, sizeof(ll)); 157 fromlen = sizeof(ll); 158 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll, 159 &fromlen); 160 if (res < 0) { 161 wpa_printf(MSG_DEBUG, "l2_packet_receive - recvfrom: %s", 162 strerror(errno)); 163 return; 164 } 165 166 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d", 167 __func__, MAC2STR(ll.sll_addr), (int) res); 168 169 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 170 if (l2->fd_br_rx >= 0) { 171 u8 hash[SHA1_MAC_LEN]; 172 const u8 *addr[1]; 173 size_t len[1]; 174 const struct l2_ethhdr *eth = (const struct l2_ethhdr *) buf; 175 176 /* 177 * Close the workaround socket if the kernel version seems to be 178 * able to deliver packets through the packet socket before 179 * authorization has been completed (in dormant state). 180 */ 181 if (l2->num_rx_br <= 1 && 182 (ether_addr_equal(eth->h_dest, l2->own_addr) || 183 is_multicast_ether_addr(eth->h_dest))) { 184 wpa_printf(MSG_DEBUG, 185 "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket", 186 l2->ifname); 187 eloop_unregister_read_sock(l2->fd_br_rx); 188 close(l2->fd_br_rx); 189 l2->fd_br_rx = -1; 190 } 191 192 addr[0] = buf; 193 len[0] = res; 194 sha1_vector(1, addr, len, hash); 195 if (l2->last_from_br && 196 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) { 197 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", 198 __func__); 199 return; 200 } 201 if (l2->last_from_br_prev && 202 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) { 203 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", 204 __func__); 205 return; 206 } 207 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN); 208 l2->last_from_br_prev = l2->last_from_br; 209 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN); 210 } 211 212 l2->last_from_br = 0; 213 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 214 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res); 215 } 216 217 218 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR l2_packet_receive_br(int sock,void * eloop_ctx,void * sock_ctx)219 static void l2_packet_receive_br(int sock, void *eloop_ctx, void *sock_ctx) 220 { 221 struct l2_packet_data *l2 = eloop_ctx; 222 u8 buf[2300]; 223 int res; 224 struct sockaddr_ll ll; 225 socklen_t fromlen; 226 u8 hash[SHA1_MAC_LEN]; 227 const u8 *addr[1]; 228 size_t len[1]; 229 230 l2->num_rx_br++; 231 os_memset(&ll, 0, sizeof(ll)); 232 fromlen = sizeof(ll); 233 res = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *) &ll, 234 &fromlen); 235 if (res < 0) { 236 wpa_printf(MSG_DEBUG, "l2_packet_receive_br - recvfrom: %s", 237 strerror(errno)); 238 return; 239 } 240 241 wpa_printf(MSG_DEBUG, "%s: src=" MACSTR " len=%d", 242 __func__, MAC2STR(ll.sll_addr), (int) res); 243 244 if (ether_addr_equal(ll.sll_addr, l2->own_addr)) { 245 wpa_printf(MSG_DEBUG, "%s: Drop RX of own frame", __func__); 246 return; 247 } 248 249 addr[0] = buf; 250 len[0] = res; 251 sha1_vector(1, addr, len, hash); 252 if (!l2->last_from_br && 253 os_memcmp(hash, l2->last_hash, SHA1_MAC_LEN) == 0) { 254 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX", __func__); 255 return; 256 } 257 if (!l2->last_from_br_prev && 258 os_memcmp(hash, l2->last_hash_prev, SHA1_MAC_LEN) == 0) { 259 wpa_printf(MSG_DEBUG, "%s: Drop duplicate RX(prev)", __func__); 260 return; 261 } 262 os_memcpy(l2->last_hash_prev, l2->last_hash, SHA1_MAC_LEN); 263 l2->last_from_br_prev = l2->last_from_br; 264 l2->last_from_br = 1; 265 os_memcpy(l2->last_hash, hash, SHA1_MAC_LEN); 266 l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res); 267 } 268 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 269 270 l2_packet_init(const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)271 struct l2_packet_data * l2_packet_init( 272 const char *ifname, const u8 *own_addr, unsigned short protocol, 273 void (*rx_callback)(void *ctx, const u8 *src_addr, 274 const u8 *buf, size_t len), 275 void *rx_callback_ctx, int l2_hdr) 276 { 277 struct l2_packet_data *l2; 278 struct ifreq ifr; 279 struct sockaddr_ll ll; 280 281 l2 = os_zalloc(sizeof(struct l2_packet_data)); 282 if (l2 == NULL) 283 return NULL; 284 os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname)); 285 l2->rx_callback = rx_callback; 286 l2->rx_callback_ctx = rx_callback_ctx; 287 l2->l2_hdr = l2_hdr; 288 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 289 l2->fd_br_rx = -1; 290 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 291 292 l2->fd = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM, 293 htons(protocol)); 294 if (l2->fd < 0) { 295 wpa_printf(MSG_ERROR, "%s: socket(PF_PACKET): %s", 296 __func__, strerror(errno)); 297 os_free(l2); 298 return NULL; 299 } 300 os_memset(&ifr, 0, sizeof(ifr)); 301 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name)); 302 if (ioctl(l2->fd, SIOCGIFINDEX, &ifr) < 0) { 303 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFINDEX]: %s", 304 __func__, strerror(errno)); 305 close(l2->fd); 306 os_free(l2); 307 return NULL; 308 } 309 l2->ifindex = ifr.ifr_ifindex; 310 311 os_memset(&ll, 0, sizeof(ll)); 312 ll.sll_family = PF_PACKET; 313 ll.sll_ifindex = ifr.ifr_ifindex; 314 ll.sll_protocol = htons(protocol); 315 if (rx_callback && 316 bind(l2->fd, (struct sockaddr *) &ll, sizeof(ll)) < 0) { 317 wpa_printf(MSG_ERROR, "%s: bind[PF_PACKET]: %s", 318 __func__, strerror(errno)); 319 close(l2->fd); 320 os_free(l2); 321 return NULL; 322 } 323 324 if (ioctl(l2->fd, SIOCGIFHWADDR, &ifr) < 0) { 325 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFHWADDR]: %s", 326 __func__, strerror(errno)); 327 close(l2->fd); 328 os_free(l2); 329 return NULL; 330 } 331 os_memcpy(l2->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN); 332 333 if (rx_callback) 334 eloop_register_read_sock(l2->fd, l2_packet_receive, l2, NULL); 335 336 return l2; 337 } 338 339 l2_packet_init_bridge(const char * br_ifname,const char * ifname,const u8 * own_addr,unsigned short protocol,void (* rx_callback)(void * ctx,const u8 * src_addr,const u8 * buf,size_t len),void * rx_callback_ctx,int l2_hdr)340 struct l2_packet_data * l2_packet_init_bridge( 341 const char *br_ifname, const char *ifname, const u8 *own_addr, 342 unsigned short protocol, 343 void (*rx_callback)(void *ctx, const u8 *src_addr, 344 const u8 *buf, size_t len), 345 void *rx_callback_ctx, int l2_hdr) 346 { 347 struct l2_packet_data *l2; 348 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 349 struct sock_filter ethertype_sock_filter_insns[] = { 350 /* Load ethertype */ 351 BPF_STMT(BPF_LD | BPF_H | BPF_ABS, 2 * ETH_ALEN), 352 /* Jump over next statement if ethertype does not match */ 353 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, protocol, 0, 1), 354 /* Ethertype match - return all */ 355 BPF_STMT(BPF_RET | BPF_K, ~0), 356 /* No match - drop */ 357 BPF_STMT(BPF_RET | BPF_K, 0) 358 }; 359 const struct sock_fprog ethertype_sock_filter = { 360 .len = ARRAY_SIZE(ethertype_sock_filter_insns), 361 .filter = ethertype_sock_filter_insns, 362 }; 363 struct sockaddr_ll ll; 364 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 365 366 l2 = l2_packet_init(br_ifname, own_addr, protocol, rx_callback, 367 rx_callback_ctx, l2_hdr); 368 if (!l2) 369 return NULL; 370 371 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 372 /* 373 * The Linux packet socket behavior has changed over the years and there 374 * is an inconvenient regression in it that breaks RX for a specific 375 * protocol from interfaces in a bridge when that interface is not in 376 * fully operation state (i.e., when in station mode and not completed 377 * authorization). To work around this, register ETH_P_ALL version of 378 * the packet socket bound to the real netdev and use socket filter to 379 * match the ethertype value. This version is less efficient, but 380 * required for functionality with many kernel version. If the main 381 * packet socket is found to be working, this less efficient version 382 * gets closed automatically. 383 */ 384 385 l2->fd_br_rx = socket(PF_PACKET, l2_hdr ? SOCK_RAW : SOCK_DGRAM, 386 htons(ETH_P_ALL)); 387 if (l2->fd_br_rx < 0) { 388 wpa_printf(MSG_DEBUG, "%s: socket(PF_PACKET-fd_br_rx): %s", 389 __func__, strerror(errno)); 390 /* try to continue without the workaround RX socket */ 391 return l2; 392 } 393 394 os_memset(&ll, 0, sizeof(ll)); 395 ll.sll_family = PF_PACKET; 396 ll.sll_ifindex = if_nametoindex(ifname); 397 ll.sll_protocol = htons(ETH_P_ALL); 398 if (bind(l2->fd_br_rx, (struct sockaddr *) &ll, sizeof(ll)) < 0) { 399 wpa_printf(MSG_DEBUG, "%s: bind[PF_PACKET-fd_br_rx]: %s", 400 __func__, strerror(errno)); 401 /* try to continue without the workaround RX socket */ 402 close(l2->fd_br_rx); 403 l2->fd_br_rx = -1; 404 return l2; 405 } 406 407 if (setsockopt(l2->fd_br_rx, SOL_SOCKET, SO_ATTACH_FILTER, 408 ðertype_sock_filter, sizeof(struct sock_fprog))) { 409 wpa_printf(MSG_DEBUG, 410 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s", 411 strerror(errno)); 412 /* try to continue without the workaround RX socket */ 413 close(l2->fd_br_rx); 414 l2->fd_br_rx = -1; 415 return l2; 416 } 417 418 eloop_register_read_sock(l2->fd_br_rx, l2_packet_receive_br, l2, NULL); 419 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 420 421 return l2; 422 } 423 424 l2_packet_deinit(struct l2_packet_data * l2)425 void l2_packet_deinit(struct l2_packet_data *l2) 426 { 427 if (l2 == NULL) 428 return; 429 430 if (l2->fd >= 0) { 431 eloop_unregister_read_sock(l2->fd); 432 close(l2->fd); 433 } 434 435 #ifndef CONFIG_NO_LINUX_PACKET_SOCKET_WAR 436 if (l2->fd_br_rx >= 0) { 437 eloop_unregister_read_sock(l2->fd_br_rx); 438 close(l2->fd_br_rx); 439 } 440 #endif /* CONFIG_NO_LINUX_PACKET_SOCKET_WAR */ 441 442 os_free(l2); 443 } 444 445 l2_packet_get_ip_addr(struct l2_packet_data * l2,char * buf,size_t len)446 int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len) 447 { 448 int s; 449 struct ifreq ifr; 450 struct sockaddr_in *saddr; 451 size_t res; 452 453 s = socket(PF_INET, SOCK_DGRAM, 0); 454 if (s < 0) { 455 wpa_printf(MSG_ERROR, "%s: socket: %s", 456 __func__, strerror(errno)); 457 return -1; 458 } 459 os_memset(&ifr, 0, sizeof(ifr)); 460 os_strlcpy(ifr.ifr_name, l2->ifname, sizeof(ifr.ifr_name)); 461 if (ioctl(s, SIOCGIFADDR, &ifr) < 0) { 462 if (errno != EADDRNOTAVAIL) 463 wpa_printf(MSG_ERROR, "%s: ioctl[SIOCGIFADDR]: %s", 464 __func__, strerror(errno)); 465 close(s); 466 return -1; 467 } 468 close(s); 469 saddr = aliasing_hide_typecast(&ifr.ifr_addr, struct sockaddr_in); 470 if (saddr->sin_family != AF_INET) 471 return -1; 472 res = os_strlcpy(buf, inet_ntoa(saddr->sin_addr), len); 473 if (res >= len) 474 return -1; 475 return 0; 476 } 477 478 l2_packet_notify_auth_start(struct l2_packet_data * l2)479 void l2_packet_notify_auth_start(struct l2_packet_data *l2) 480 { 481 } 482 483 l2_packet_set_packet_filter(struct l2_packet_data * l2,enum l2_packet_filter_type type)484 int l2_packet_set_packet_filter(struct l2_packet_data *l2, 485 enum l2_packet_filter_type type) 486 { 487 const struct sock_fprog *sock_filter; 488 489 if (TEST_FAIL()) 490 return -1; 491 492 switch (type) { 493 case L2_PACKET_FILTER_DHCP: 494 sock_filter = &dhcp_sock_filter; 495 break; 496 case L2_PACKET_FILTER_NDISC: 497 sock_filter = &ndisc_sock_filter; 498 break; 499 case L2_PACKET_FILTER_PKTTYPE: 500 sock_filter = &pkt_type_sock_filter; 501 break; 502 default: 503 return -1; 504 } 505 506 if (setsockopt(l2->fd, SOL_SOCKET, SO_ATTACH_FILTER, 507 sock_filter, sizeof(struct sock_fprog))) { 508 wpa_printf(MSG_ERROR, 509 "l2_packet_linux: setsockopt(SO_ATTACH_FILTER) failed: %s", 510 strerror(errno)); 511 return -1; 512 } 513 514 return 0; 515 } 516