emo/ndhc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use BPF to filter input on raw sockets.

Browse Source
This commit is contained in:
Nicholas J. Kain 2010-11-13 11:18:07 -05:00
parent 71a3603934
commit 9f7fe1de8b
1 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
ndhc/socket.c
View File

@ -33,8 +33,10 @@
#include <features.h> #include <features.h>
#include <netpacket/packet.h> #include <netpacket/packet.h>
#include <net/ethernet.h> #include <net/ethernet.h>
#include <linux/filter.h>
#include "log.h" #include "log.h"
#include "strl.h" #include "strl.h"
#include "dhcpd.h" /* For SERVER_PORT and CLIENT_PORT */
int read_interface(char *interface, int *ifindex, uint32_t *addr, int read_interface(char *interface, int *ifindex, uint32_t *addr,
unsigned char *arp) unsigned char *arp)
@ -130,6 +132,48 @@ int raw_socket(int ifindex)
int fd; int fd;
struct sockaddr_ll sock; struct sockaddr_ll sock;
/*
* Comment:
*
* I've selected not to see LL header, so BPF doesn't see it, too.
* The filter may also pass non-IP and non-ARP packets, but we do
* a more complete check when receiving the message in userspace.
*
* and filter shamelessly stolen from:
*
* http://www.flamewarmaster.de/software/dhcpclient/
*
* There are a few other interesting ideas on that page (look under
* "Motivation"). Use of netlink events is most interesting. Think
* of various network servers listening for events and reconfiguring.
* That would obsolete sending HUP signals and/or make use of restarts.
*
* Copyright: 2006, 2007 Stefan Rompf <sux@loplof.de>.
* License: GPL v2.
*/
#define SERVER_AND_CLIENT_PORTS ((67 << 16) + 68)
static const struct sock_filter filter_instr[] = {
/* check for udp */
BPF_STMT(BPF_LD|BPF_B|BPF_ABS, 9),
BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, IPPROTO_UDP, 2, 0), /* L5, L1, is UDP? */
/* ugly check for arp on ethernet-like and IPv4 */
BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2), /* L1: */
BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x08000604, 3, 4), /* L3, L4 */
/* skip IP header */
BPF_STMT(BPF_LDX|BPF_B|BPF_MSH, 0), /* L5: */
/* check udp source and destination ports */
BPF_STMT(BPF_LD|BPF_W|BPF_IND, 0),
BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SERVER_AND_CLIENT_PORTS, 0, 1),/* L3, L4 */
/* returns */
BPF_STMT(BPF_RET|BPF_K, 0x0fffffff ), /* L3: pass */
BPF_STMT(BPF_RET|BPF_K, 0), /* L4: reject */
};
static const struct sock_fprog filter_prog = {
.len = sizeof(filter_instr) / sizeof(filter_instr[0]),
/* casting const away: */
.filter = (struct sock_filter *) filter_instr,
};
memset(&sock, 0, sizeof sock); memset(&sock, 0, sizeof sock);
log_line("Opening raw socket on ifindex %d", ifindex); log_line("Opening raw socket on ifindex %d", ifindex);
if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) { if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) {
@ -137,6 +181,14 @@ int raw_socket(int ifindex)
goto out; goto out;
} }
if (SERVER_PORT == 67 && CLIENT_PORT == 68) {
/* Use only if standard ports are in use */
/* Ignoring error (kernel may lack support for this) */
if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter_prog,
sizeof filter_prog) >= 0)
log_line("Attached filter to raw socket fd %d", fd);
}
sock.sll_family = AF_PACKET; sock.sll_family = AF_PACKET;
sock.sll_protocol = htons(ETH_P_IP); sock.sll_protocol = htons(ETH_P_IP);
sock.sll_ifindex = ifindex; sock.sll_ifindex = ifindex;