![[BACK]](/icons/back.gif){kind=icon}
Return to bpf_filter.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net|
Return to bpf_filter.c CVS log | Up to [local] / sys / net |
1.1 ! nbrk 1: /* $OpenBSD: bpf_filter.c,v 1.19 2007/08/06 08:28:09 tom Exp $ */
! 2: /* $NetBSD: bpf_filter.c,v 1.12 1996/02/13 22:00:00 christos Exp $ */
! 3:
! 4: /*
! 5: * Copyright (c) 1990, 1991, 1992, 1993
! 6: * The Regents of the University of California. All rights reserved.
! 7: *
! 8: * This code is derived from the Stanford/CMU enet packet filter,
! 9: * (net/enet.c) distributed as part of 4.3BSD, and code contributed
! 10: * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
! 11: * Berkeley Laboratory.
! 12: *
! 13: * Redistribution and use in source and binary forms, with or without
! 14: * modification, are permitted provided that the following conditions
! 15: * are met:
! 16: * 1. Redistributions of source code must retain the above copyright
! 17: * notice, this list of conditions and the following disclaimer.
! 18: * 2. Redistributions in binary form must reproduce the above copyright
! 19: * notice, this list of conditions and the following disclaimer in the
! 20: * documentation and/or other materials provided with the distribution.
! 21: * 3. Neither the name of the University nor the names of its contributors
! 22: * may be used to endorse or promote products derived from this software
! 23: * without specific prior written permission.
! 24: *
! 25: * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
! 26: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
! 27: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
! 28: * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
! 29: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
! 30: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
! 31: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
! 32: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
! 33: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
! 34: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
! 35: * SUCH DAMAGE.
! 36: *
! 37: * @(#)bpf_filter.c 8.1 (Berkeley) 6/10/93
! 38: */
! 39:
! 40: #include <sys/param.h>
! 41: #include <sys/types.h>
! 42: #include <sys/time.h>
! 43: #ifndef _KERNEL
! 44: #include <stdlib.h>
! 45: #include "pcap.h"
! 46: #endif
! 47:
! 48: #include <sys/endian.h>
! 49: #ifdef __STRICT_ALIGNMENT
! 50: #define BPF_ALIGN
! 51: #endif
! 52:
! 53: #ifndef BPF_ALIGN
! 54: #define EXTRACT_SHORT(p) ((u_int16_t)ntohs(*(u_int16_t *)p))
! 55: #define EXTRACT_LONG(p) (ntohl(*(u_int32_t *)p))
! 56: #else
! 57: #define EXTRACT_SHORT(p)\
! 58: ((u_int16_t)\
! 59: ((u_int16_t)*((u_char *)p+0)<<8|\
! 60: (u_int16_t)*((u_char *)p+1)<<0))
! 61: #define EXTRACT_LONG(p)\
! 62: ((u_int32_t)*((u_char *)p+0)<<24|\
! 63: (u_int32_t)*((u_char *)p+1)<<16|\
! 64: (u_int32_t)*((u_char *)p+2)<<8|\
! 65: (u_int32_t)*((u_char *)p+3)<<0)
! 66: #endif
! 67:
! 68: #ifdef _KERNEL
! 69: #include <sys/mbuf.h>
! 70: #define MINDEX(len, m, k) \
! 71: { \
! 72: len = m->m_len; \
! 73: while (k >= len) { \
! 74: k -= len; \
! 75: m = m->m_next; \
! 76: if (m == 0) \
! 77: return 0; \
! 78: len = m->m_len; \
! 79: } \
! 80: }
! 81:
! 82: extern int bpf_maxbufsize;
! 83:
! 84: int bpf_m_xword(struct mbuf *, u_int32_t, int *);
! 85: int bpf_m_xhalf(struct mbuf *, u_int32_t, int *);
! 86:
! 87: int
! 88: bpf_m_xword(m, k, err)
! 89: struct mbuf *m;
! 90: u_int32_t k;
! 91: int *err;
! 92: {
! 93: int len;
! 94: u_char *cp, *np;
! 95: struct mbuf *m0;
! 96:
! 97: *err = 1;
! 98: MINDEX(len, m, k);
! 99: cp = mtod(m, u_char *) + k;
! 100: if (len >= k + 4) {
! 101: *err = 0;
! 102: return EXTRACT_LONG(cp);
! 103: }
! 104: m0 = m->m_next;
! 105: if (m0 == 0 || m0->m_len + len - k < 4)
! 106: return 0;
! 107: *err = 0;
! 108: np = mtod(m0, u_char *);
! 109: switch (len - k) {
! 110:
! 111: case 1:
! 112: return (cp[0] << 24) | (np[0] << 16) | (np[1] << 8) | np[2];
! 113:
! 114: case 2:
! 115: return (cp[0] << 24) | (cp[1] << 16) | (np[0] << 8) | np[1];
! 116:
! 117: default:
! 118: return (cp[0] << 24) | (cp[1] << 16) | (cp[2] << 8) | np[0];
! 119: }
! 120: }
! 121:
! 122: int
! 123: bpf_m_xhalf(m, k, err)
! 124: struct mbuf *m;
! 125: u_int32_t k;
! 126: int *err;
! 127: {
! 128: int len;
! 129: u_char *cp;
! 130: struct mbuf *m0;
! 131:
! 132: *err = 1;
! 133: MINDEX(len, m, k);
! 134: cp = mtod(m, u_char *) + k;
! 135: if (len >= k + 2) {
! 136: *err = 0;
! 137: return EXTRACT_SHORT(cp);
! 138: }
! 139: m0 = m->m_next;
! 140: if (m0 == 0)
! 141: return 0;
! 142: *err = 0;
! 143: return (cp[0] << 8) | mtod(m0, u_char *)[0];
! 144: }
! 145: #endif
! 146:
! 147: #include <net/bpf.h>
! 148:
! 149: /*
! 150: * Execute the filter program starting at pc on the packet p
! 151: * wirelen is the length of the original packet
! 152: * buflen is the amount of data present
! 153: */
! 154: u_int
! 155: bpf_filter(pc, p, wirelen, buflen)
! 156: struct bpf_insn *pc;
! 157: u_char *p;
! 158: u_int wirelen;
! 159: u_int buflen;
! 160: {
! 161: u_int32_t A = 0, X = 0;
! 162: u_int32_t k;
! 163: int32_t mem[BPF_MEMWORDS];
! 164:
! 165: if (pc == 0)
! 166: /*
! 167: * No filter means accept all.
! 168: */
! 169: return (u_int)-1;
! 170: --pc;
! 171: while (1) {
! 172: ++pc;
! 173: switch (pc->code) {
! 174:
! 175: default:
! 176: #ifdef _KERNEL
! 177: return 0;
! 178: #else
! 179: abort();
! 180: #endif
! 181: case BPF_RET|BPF_K:
! 182: return (u_int)pc->k;
! 183:
! 184: case BPF_RET|BPF_A:
! 185: return (u_int)A;
! 186:
! 187: case BPF_LD|BPF_W|BPF_ABS:
! 188: k = pc->k;
! 189: if (k + sizeof(int32_t) > buflen) {
! 190: #ifdef _KERNEL
! 191: int merr;
! 192:
! 193: if (buflen != 0)
! 194: return 0;
! 195: A = bpf_m_xword((struct mbuf *)p, k, &merr);
! 196: if (merr != 0)
! 197: return 0;
! 198: continue;
! 199: #else
! 200: return 0;
! 201: #endif
! 202: }
! 203: A = EXTRACT_LONG(&p[k]);
! 204: continue;
! 205:
! 206: case BPF_LD|BPF_H|BPF_ABS:
! 207: k = pc->k;
! 208: if (k + sizeof(int16_t) > buflen) {
! 209: #ifdef _KERNEL
! 210: int merr;
! 211:
! 212: if (buflen != 0)
! 213: return 0;
! 214: A = bpf_m_xhalf((struct mbuf *)p, k, &merr);
! 215: if (merr != 0)
! 216: return 0;
! 217: continue;
! 218: #else
! 219: return 0;
! 220: #endif
! 221: }
! 222: A = EXTRACT_SHORT(&p[k]);
! 223: continue;
! 224:
! 225: case BPF_LD|BPF_B|BPF_ABS:
! 226: k = pc->k;
! 227: if (k >= buflen) {
! 228: #ifdef _KERNEL
! 229: struct mbuf *m;
! 230: int len;
! 231:
! 232: if (buflen != 0)
! 233: return 0;
! 234: m = (struct mbuf *)p;
! 235: MINDEX(len, m, k);
! 236: A = mtod(m, u_char *)[k];
! 237: continue;
! 238: #else
! 239: return 0;
! 240: #endif
! 241: }
! 242: A = p[k];
! 243: continue;
! 244:
! 245: case BPF_LD|BPF_W|BPF_LEN:
! 246: A = wirelen;
! 247: continue;
! 248:
! 249: case BPF_LDX|BPF_W|BPF_LEN:
! 250: X = wirelen;
! 251: continue;
! 252:
! 253: case BPF_LD|BPF_W|BPF_IND:
! 254: k = X + pc->k;
! 255: if (k + sizeof(int32_t) > buflen) {
! 256: #ifdef _KERNEL
! 257: int merr;
! 258:
! 259: if (buflen != 0)
! 260: return 0;
! 261: A = bpf_m_xword((struct mbuf *)p, k, &merr);
! 262: if (merr != 0)
! 263: return 0;
! 264: continue;
! 265: #else
! 266: return 0;
! 267: #endif
! 268: }
! 269: A = EXTRACT_LONG(&p[k]);
! 270: continue;
! 271:
! 272: case BPF_LD|BPF_H|BPF_IND:
! 273: k = X + pc->k;
! 274: if (k + sizeof(int16_t) > buflen) {
! 275: #ifdef _KERNEL
! 276: int merr;
! 277:
! 278: if (buflen != 0)
! 279: return 0;
! 280: A = bpf_m_xhalf((struct mbuf *)p, k, &merr);
! 281: if (merr != 0)
! 282: return 0;
! 283: continue;
! 284: #else
! 285: return 0;
! 286: #endif
! 287: }
! 288: A = EXTRACT_SHORT(&p[k]);
! 289: continue;
! 290:
! 291: case BPF_LD|BPF_B|BPF_IND:
! 292: k = X + pc->k;
! 293: if (k >= buflen) {
! 294: #ifdef _KERNEL
! 295: struct mbuf *m;
! 296: int len;
! 297:
! 298: if (buflen != 0)
! 299: return 0;
! 300: m = (struct mbuf *)p;
! 301: MINDEX(len, m, k);
! 302: A = mtod(m, u_char *)[k];
! 303: continue;
! 304: #else
! 305: return 0;
! 306: #endif
! 307: }
! 308: A = p[k];
! 309: continue;
! 310:
! 311: case BPF_LDX|BPF_MSH|BPF_B:
! 312: k = pc->k;
! 313: if (k >= buflen) {
! 314: #ifdef _KERNEL
! 315: struct mbuf *m;
! 316: int len;
! 317:
! 318: if (buflen != 0)
! 319: return 0;
! 320: m = (struct mbuf *)p;
! 321: MINDEX(len, m, k);
! 322: X = (mtod(m, u_char *)[k] & 0xf) << 2;
! 323: continue;
! 324: #else
! 325: return 0;
! 326: #endif
! 327: }
! 328: X = (p[pc->k] & 0xf) << 2;
! 329: continue;
! 330:
! 331: case BPF_LD|BPF_IMM:
! 332: A = pc->k;
! 333: continue;
! 334:
! 335: case BPF_LDX|BPF_IMM:
! 336: X = pc->k;
! 337: continue;
! 338:
! 339: case BPF_LD|BPF_MEM:
! 340: A = mem[pc->k];
! 341: continue;
! 342:
! 343: case BPF_LDX|BPF_MEM:
! 344: X = mem[pc->k];
! 345: continue;
! 346:
! 347: case BPF_ST:
! 348: mem[pc->k] = A;
! 349: continue;
! 350:
! 351: case BPF_STX:
! 352: mem[pc->k] = X;
! 353: continue;
! 354:
! 355: case BPF_JMP|BPF_JA:
! 356: pc += pc->k;
! 357: continue;
! 358:
! 359: case BPF_JMP|BPF_JGT|BPF_K:
! 360: pc += (A > pc->k) ? pc->jt : pc->jf;
! 361: continue;
! 362:
! 363: case BPF_JMP|BPF_JGE|BPF_K:
! 364: pc += (A >= pc->k) ? pc->jt : pc->jf;
! 365: continue;
! 366:
! 367: case BPF_JMP|BPF_JEQ|BPF_K:
! 368: pc += (A == pc->k) ? pc->jt : pc->jf;
! 369: continue;
! 370:
! 371: case BPF_JMP|BPF_JSET|BPF_K:
! 372: pc += (A & pc->k) ? pc->jt : pc->jf;
! 373: continue;
! 374:
! 375: case BPF_JMP|BPF_JGT|BPF_X:
! 376: pc += (A > X) ? pc->jt : pc->jf;
! 377: continue;
! 378:
! 379: case BPF_JMP|BPF_JGE|BPF_X:
! 380: pc += (A >= X) ? pc->jt : pc->jf;
! 381: continue;
! 382:
! 383: case BPF_JMP|BPF_JEQ|BPF_X:
! 384: pc += (A == X) ? pc->jt : pc->jf;
! 385: continue;
! 386:
! 387: case BPF_JMP|BPF_JSET|BPF_X:
! 388: pc += (A & X) ? pc->jt : pc->jf;
! 389: continue;
! 390:
! 391: case BPF_ALU|BPF_ADD|BPF_X:
! 392: A += X;
! 393: continue;
! 394:
! 395: case BPF_ALU|BPF_SUB|BPF_X:
! 396: A -= X;
! 397: continue;
! 398:
! 399: case BPF_ALU|BPF_MUL|BPF_X:
! 400: A *= X;
! 401: continue;
! 402:
! 403: case BPF_ALU|BPF_DIV|BPF_X:
! 404: if (X == 0)
! 405: return 0;
! 406: A /= X;
! 407: continue;
! 408:
! 409: case BPF_ALU|BPF_AND|BPF_X:
! 410: A &= X;
! 411: continue;
! 412:
! 413: case BPF_ALU|BPF_OR|BPF_X:
! 414: A |= X;
! 415: continue;
! 416:
! 417: case BPF_ALU|BPF_LSH|BPF_X:
! 418: A <<= X;
! 419: continue;
! 420:
! 421: case BPF_ALU|BPF_RSH|BPF_X:
! 422: A >>= X;
! 423: continue;
! 424:
! 425: case BPF_ALU|BPF_ADD|BPF_K:
! 426: A += pc->k;
! 427: continue;
! 428:
! 429: case BPF_ALU|BPF_SUB|BPF_K:
! 430: A -= pc->k;
! 431: continue;
! 432:
! 433: case BPF_ALU|BPF_MUL|BPF_K:
! 434: A *= pc->k;
! 435: continue;
! 436:
! 437: case BPF_ALU|BPF_DIV|BPF_K:
! 438: A /= pc->k;
! 439: continue;
! 440:
! 441: case BPF_ALU|BPF_AND|BPF_K:
! 442: A &= pc->k;
! 443: continue;
! 444:
! 445: case BPF_ALU|BPF_OR|BPF_K:
! 446: A |= pc->k;
! 447: continue;
! 448:
! 449: case BPF_ALU|BPF_LSH|BPF_K:
! 450: A <<= pc->k;
! 451: continue;
! 452:
! 453: case BPF_ALU|BPF_RSH|BPF_K:
! 454: A >>= pc->k;
! 455: continue;
! 456:
! 457: case BPF_ALU|BPF_NEG:
! 458: A = -A;
! 459: continue;
! 460:
! 461: case BPF_MISC|BPF_TAX:
! 462: X = A;
! 463: continue;
! 464:
! 465: case BPF_MISC|BPF_TXA:
! 466: A = X;
! 467: continue;
! 468: }
! 469: }
! 470: }
! 471:
! 472: #ifdef _KERNEL
! 473: /*
! 474: * Return true if the 'fcode' is a valid filter program.
! 475: * The constraints are that each jump be forward and to a valid
! 476: * code. The code must terminate with either an accept or reject.
! 477: * 'valid' is an array for use by the routine (it must be at least
! 478: * 'len' bytes long).
! 479: *
! 480: * The kernel needs to be able to verify an application's filter code.
! 481: * Otherwise, a bogus program could easily crash the system.
! 482: */
! 483: int
! 484: bpf_validate(f, len)
! 485: struct bpf_insn *f;
! 486: int len;
! 487: {
! 488: u_int i, from;
! 489: struct bpf_insn *p;
! 490:
! 491: if (len < 1 || len > BPF_MAXINSNS)
! 492: return 0;
! 493:
! 494: for (i = 0; i < len; ++i) {
! 495: p = &f[i];
! 496: switch (BPF_CLASS(p->code)) {
! 497: /*
! 498: * Check that memory operations use valid addresses.
! 499: */
! 500: case BPF_LD:
! 501: case BPF_LDX:
! 502: switch (BPF_MODE(p->code)) {
! 503: case BPF_IMM:
! 504: break;
! 505: case BPF_ABS:
! 506: case BPF_IND:
! 507: case BPF_MSH:
! 508: /*
! 509: * More strict check with actual packet length
! 510: * is done runtime.
! 511: */
! 512: if (p->k >= bpf_maxbufsize)
! 513: return 0;
! 514: break;
! 515: case BPF_MEM:
! 516: if (p->k >= BPF_MEMWORDS)
! 517: return 0;
! 518: break;
! 519: case BPF_LEN:
! 520: break;
! 521: default:
! 522: return 0;
! 523: }
! 524: break;
! 525: case BPF_ST:
! 526: case BPF_STX:
! 527: if (p->k >= BPF_MEMWORDS)
! 528: return 0;
! 529: break;
! 530: case BPF_ALU:
! 531: switch (BPF_OP(p->code)) {
! 532: case BPF_ADD:
! 533: case BPF_SUB:
! 534: case BPF_OR:
! 535: case BPF_AND:
! 536: case BPF_LSH:
! 537: case BPF_RSH:
! 538: case BPF_NEG:
! 539: break;
! 540: case BPF_DIV:
! 541: /*
! 542: * Check for constant division by 0.
! 543: */
! 544: if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
! 545: return 0;
! 546: break;
! 547: default:
! 548: return 0;
! 549: }
! 550: break;
! 551: case BPF_JMP:
! 552: /*
! 553: * Check that jumps are forward, and within
! 554: * the code block.
! 555: */
! 556: from = i + 1;
! 557: switch (BPF_OP(p->code)) {
! 558: case BPF_JA:
! 559: if (from + p->k < from || from + p->k >= len)
! 560: return 0;
! 561: break;
! 562: case BPF_JEQ:
! 563: case BPF_JGT:
! 564: case BPF_JGE:
! 565: case BPF_JSET:
! 566: if (from + p->jt >= len || from + p->jf >= len)
! 567: return 0;
! 568: break;
! 569: default:
! 570: return 0;
! 571: }
! 572: break;
! 573: case BPF_RET:
! 574: break;
! 575: case BPF_MISC:
! 576: break;
! 577: default:
! 578: return 0;
! 579: }
! 580:
! 581: }
! 582: return BPF_CLASS(f[len - 1].code) == BPF_RET;
! 583: }
! 584: #endif