1/*
2 * WPA Supplicant - Layer2 packet handling with WinPcap RX thread
3 * Copyright (c) 2003-2006, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 *
8 * This l2_packet implementation is explicitly for WinPcap and Windows events.
9 * l2_packet_pcap.c has support for WinPcap, but it requires polling to receive
10 * frames which means relatively long latency for EAPOL RX processing. The
11 * implementation here uses a separate thread to allow WinPcap to be receiving
12 * all the time to reduce latency for EAPOL receiving from about 100 ms to 3 ms
13 * when comparing l2_packet_pcap.c to l2_packet_winpcap.c. Extra sleep of 50 ms
14 * is added in to receive thread whenever no EAPOL frames has been received for
15 * a while. Whenever an EAPOL handshake is expected, this sleep is removed.
16 *
17 * The RX thread receives a frame and signals main thread through Windows event
18 * about the availability of a new frame. Processing the received frame is
19 * synchronized with pair of Windows events so that no extra buffer or queuing
20 * mechanism is needed. This implementation requires Windows specific event
21 * loop implementation, i.e., eloop_win.c.
22 *
23 * WinPcap has pcap_getevent() that could, in theory at least, be used to
24 * implement this kind of waiting with a simpler single-thread design. However,
25 * that event handle is not really signaled immediately when receiving each
26 * frame, so it does not really work for this kind of use.
27 */
28
29#include "includes.h"
30#include <pcap.h>
31
32#include "common.h"
33#include "eloop.h"
34#include "l2_packet.h"
35
36
37static const u8 pae_group_addr[ETH_ALEN] =
38{ 0x01, 0x80, 0xc2, 0x00, 0x00, 0x03 };
39
40/*
41 * Number of pcap_dispatch() iterations to do without extra wait after each
42 * received EAPOL packet or authentication notification. This is used to reduce
43 * latency for EAPOL receive.
44 */
45static const size_t no_wait_count = 750;
46
47struct l2_packet_data {
48	pcap_t *pcap;
49	unsigned int num_fast_poll;
50	char ifname[100];
51	u8 own_addr[ETH_ALEN];
52	void (*rx_callback)(void *ctx, const u8 *src_addr,
53			    const u8 *buf, size_t len);
54	void *rx_callback_ctx;
55	int l2_hdr; /* whether to include layer 2 (Ethernet) header in calls to
56		     * rx_callback and l2_packet_send() */
57	int running;
58	HANDLE rx_avail, rx_done, rx_thread, rx_thread_done, rx_notify;
59	u8 *rx_buf, *rx_src;
60	size_t rx_len;
61	size_t rx_no_wait;
62};
63
64
65int l2_packet_get_own_addr(struct l2_packet_data *l2, u8 *addr)
66{
67	os_memcpy(addr, l2->own_addr, ETH_ALEN);
68	return 0;
69}
70
71
72int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
73		   const u8 *buf, size_t len)
74{
75	int ret;
76	struct l2_ethhdr *eth;
77
78	if (l2 == NULL)
79		return -1;
80
81	if (l2->l2_hdr) {
82		ret = pcap_sendpacket(l2->pcap, buf, len);
83	} else {
84		size_t mlen = sizeof(*eth) + len;
85		eth = os_malloc(mlen);
86		if (eth == NULL)
87			return -1;
88
89		os_memcpy(eth->h_dest, dst_addr, ETH_ALEN);
90		os_memcpy(eth->h_source, l2->own_addr, ETH_ALEN);
91		eth->h_proto = htons(proto);
92		os_memcpy(eth + 1, buf, len);
93		ret = pcap_sendpacket(l2->pcap, (u8 *) eth, mlen);
94		os_free(eth);
95	}
96
97	return ret;
98}
99
100
101/* pcap_dispatch() callback for the RX thread */
102static void l2_packet_receive_cb(u_char *user, const struct pcap_pkthdr *hdr,
103				 const u_char *pkt_data)
104{
105	struct l2_packet_data *l2 = (struct l2_packet_data *) user;
106	struct l2_ethhdr *ethhdr;
107
108	if (pkt_data == NULL || hdr->caplen < sizeof(*ethhdr))
109		return;
110
111	ethhdr = (struct l2_ethhdr *) pkt_data;
112	if (l2->l2_hdr) {
113		l2->rx_buf = (u8 *) ethhdr;
114		l2->rx_len = hdr->caplen;
115	} else {
116		l2->rx_buf = (u8 *) (ethhdr + 1);
117		l2->rx_len = hdr->caplen - sizeof(*ethhdr);
118	}
119	l2->rx_src = ethhdr->h_source;
120	SetEvent(l2->rx_avail);
121	WaitForSingleObject(l2->rx_done, INFINITE);
122	ResetEvent(l2->rx_done);
123	l2->rx_no_wait = no_wait_count;
124}
125
126
127/* main RX loop that is running in a separate thread */
128static DWORD WINAPI l2_packet_receive_thread(LPVOID arg)
129{
130	struct l2_packet_data *l2 = arg;
131
132	while (l2->running) {
133		pcap_dispatch(l2->pcap, 1, l2_packet_receive_cb,
134			      (u_char *) l2);
135		if (l2->rx_no_wait > 0)
136			l2->rx_no_wait--;
137		if (WaitForSingleObject(l2->rx_notify,
138					l2->rx_no_wait ? 0 : 50) ==
139		    WAIT_OBJECT_0) {
140			l2->rx_no_wait = no_wait_count;
141			ResetEvent(l2->rx_notify);
142		}
143	}
144	SetEvent(l2->rx_thread_done);
145	ExitThread(0);
146	return 0;
147}
148
149
150/* main thread RX event handler */
151static void l2_packet_rx_event(void *eloop_data, void *user_data)
152{
153	struct l2_packet_data *l2 = eloop_data;
154	l2->rx_callback(l2->rx_callback_ctx, l2->rx_src, l2->rx_buf,
155			l2->rx_len);
156	ResetEvent(l2->rx_avail);
157	SetEvent(l2->rx_done);
158}
159
160
161static int l2_packet_init_libpcap(struct l2_packet_data *l2,
162				  unsigned short protocol)
163{
164	bpf_u_int32 pcap_maskp, pcap_netp;
165	char pcap_filter[200], pcap_err[PCAP_ERRBUF_SIZE];
166	struct bpf_program pcap_fp;
167
168	pcap_lookupnet(l2->ifname, &pcap_netp, &pcap_maskp, pcap_err);
169	l2->pcap = pcap_open_live(l2->ifname, 2500, 0, 1, pcap_err);
170	if (l2->pcap == NULL) {
171		fprintf(stderr, "pcap_open_live: %s\n", pcap_err);
172		fprintf(stderr, "ifname='%s'\n", l2->ifname);
173		return -1;
174	}
175	os_snprintf(pcap_filter, sizeof(pcap_filter),
176		    "not ether src " MACSTR " and "
177		    "( ether dst " MACSTR " or ether dst " MACSTR " ) and "
178		    "ether proto 0x%x",
179		    MAC2STR(l2->own_addr), /* do not receive own packets */
180		    MAC2STR(l2->own_addr), MAC2STR(pae_group_addr),
181		    protocol);
182	if (pcap_compile(l2->pcap, &pcap_fp, pcap_filter, 1, pcap_netp) < 0) {
183		fprintf(stderr, "pcap_compile: %s\n", pcap_geterr(l2->pcap));
184		return -1;
185	}
186
187	if (pcap_setfilter(l2->pcap, &pcap_fp) < 0) {
188		fprintf(stderr, "pcap_setfilter: %s\n", pcap_geterr(l2->pcap));
189		return -1;
190	}
191
192	pcap_freecode(&pcap_fp);
193
194	return 0;
195}
196
197
198struct l2_packet_data * l2_packet_init(
199	const char *ifname, const u8 *own_addr, unsigned short protocol,
200	void (*rx_callback)(void *ctx, const u8 *src_addr,
201			    const u8 *buf, size_t len),
202	void *rx_callback_ctx, int l2_hdr)
203{
204	struct l2_packet_data *l2;
205	DWORD thread_id;
206
207	l2 = os_zalloc(sizeof(struct l2_packet_data));
208	if (l2 == NULL)
209		return NULL;
210	if (os_strncmp(ifname, "\\Device\\NPF_", 12) == 0)
211		os_strlcpy(l2->ifname, ifname, sizeof(l2->ifname));
212	else
213		os_snprintf(l2->ifname, sizeof(l2->ifname), "\\Device\\NPF_%s",
214			    ifname);
215	l2->rx_callback = rx_callback;
216	l2->rx_callback_ctx = rx_callback_ctx;
217	l2->l2_hdr = l2_hdr;
218
219	if (own_addr)
220		os_memcpy(l2->own_addr, own_addr, ETH_ALEN);
221
222	if (l2_packet_init_libpcap(l2, protocol)) {
223		os_free(l2);
224		return NULL;
225	}
226
227	l2->rx_avail = CreateEvent(NULL, TRUE, FALSE, NULL);
228	l2->rx_done = CreateEvent(NULL, TRUE, FALSE, NULL);
229	l2->rx_notify = CreateEvent(NULL, TRUE, FALSE, NULL);
230	if (l2->rx_avail == NULL || l2->rx_done == NULL ||
231	    l2->rx_notify == NULL) {
232		CloseHandle(l2->rx_avail);
233		CloseHandle(l2->rx_done);
234		CloseHandle(l2->rx_notify);
235		pcap_close(l2->pcap);
236		os_free(l2);
237		return NULL;
238	}
239
240	eloop_register_event(l2->rx_avail, sizeof(l2->rx_avail),
241			     l2_packet_rx_event, l2, NULL);
242
243	l2->running = 1;
244	l2->rx_thread = CreateThread(NULL, 0, l2_packet_receive_thread, l2, 0,
245				     &thread_id);
246
247	return l2;
248}
249
250
251static void l2_packet_deinit_timeout(void *eloop_ctx, void *timeout_ctx)
252{
253	struct l2_packet_data *l2 = eloop_ctx;
254
255	if (l2->rx_thread_done &&
256	    WaitForSingleObject(l2->rx_thread_done, 2000) != WAIT_OBJECT_0) {
257		wpa_printf(MSG_DEBUG, "l2_packet_winpcap: RX thread did not "
258			   "exit - kill it\n");
259		TerminateThread(l2->rx_thread, 0);
260	}
261	CloseHandle(l2->rx_thread_done);
262	CloseHandle(l2->rx_thread);
263	if (l2->pcap)
264		pcap_close(l2->pcap);
265	eloop_unregister_event(l2->rx_avail, sizeof(l2->rx_avail));
266	CloseHandle(l2->rx_avail);
267	CloseHandle(l2->rx_done);
268	CloseHandle(l2->rx_notify);
269	os_free(l2);
270}
271
272
273void l2_packet_deinit(struct l2_packet_data *l2)
274{
275	if (l2 == NULL)
276		return;
277
278	l2->rx_thread_done = CreateEvent(NULL, TRUE, FALSE, NULL);
279
280	l2->running = 0;
281	pcap_breakloop(l2->pcap);
282
283	/*
284	 * RX thread may be waiting in l2_packet_receive_cb() for l2->rx_done
285	 * event and this event is set in l2_packet_rx_event(). However,
286	 * l2_packet_deinit() may end up being called from l2->rx_callback(),
287	 * so we need to return from here and complete deinitialization in
288	 * a registered timeout to avoid having to forcefully kill the RX
289	 * thread.
290	 */
291	eloop_register_timeout(0, 0, l2_packet_deinit_timeout, l2, NULL);
292}
293
294
295int l2_packet_get_ip_addr(struct l2_packet_data *l2, char *buf, size_t len)
296{
297	pcap_if_t *devs, *dev;
298	struct pcap_addr *addr;
299	struct sockaddr_in *saddr;
300	int found = 0;
301	char err[PCAP_ERRBUF_SIZE + 1];
302
303	if (pcap_findalldevs(&devs, err) < 0) {
304		wpa_printf(MSG_DEBUG, "pcap_findalldevs: %s\n", err);
305		return -1;
306	}
307
308	for (dev = devs; dev && !found; dev = dev->next) {
309		if (os_strcmp(dev->name, l2->ifname) != 0)
310			continue;
311
312		addr = dev->addresses;
313		while (addr) {
314			saddr = (struct sockaddr_in *) addr->addr;
315			if (saddr && saddr->sin_family == AF_INET) {
316				os_strlcpy(buf, inet_ntoa(saddr->sin_addr),
317					   len);
318				found = 1;
319				break;
320			}
321			addr = addr->next;
322		}
323	}
324
325	pcap_freealldevs(devs);
326
327	return found ? 0 : -1;
328}
329
330
331void l2_packet_notify_auth_start(struct l2_packet_data *l2)
332{
333	if (l2)
334		SetEvent(l2->rx_notify);
335}
336