1/*
2 * dhcpcd - ARP handler
3 * Copyright (c) 2006-2019 Roy Marples <roy@marples.name>
4 * All rights reserved
5
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/socket.h>
29#include <sys/types.h>
30
31#include <arpa/inet.h>
32
33#include <net/if.h>
34#include <netinet/in.h>
35#include <netinet/if_ether.h>
36
37#include <errno.h>
38#include <stdlib.h>
39#include <string.h>
40#include <unistd.h>
41
42#define ELOOP_QUEUE 5
43#include "config.h"
44#include "arp.h"
45#include "bpf.h"
46#include "ipv4.h"
47#include "common.h"
48#include "dhcpcd.h"
49#include "eloop.h"
50#include "if.h"
51#include "if-options.h"
52#include "ipv4ll.h"
53#include "logerr.h"
54
55#if defined(ARP)
56#define ARP_LEN \
57 (sizeof(struct arphdr) + (2 * sizeof(uint32_t)) + (2 * HWADDR_LEN))
58
59/* ARP debugging can be quite noisy. Enable this for more noise! */
60//#define ARP_DEBUG
61
62/* Assert the correct structure size for on wire */
63__CTASSERT(sizeof(struct arphdr) == 8);
64
65ssize_t
66arp_request(const struct interface *ifp, in_addr_t sip, in_addr_t tip)
67{
68 uint8_t arp_buffer[ARP_LEN];
69 struct arphdr ar;
70 size_t len;
71 uint8_t *p;
72 const struct iarp_state *state;
73
74 ar.ar_hrd = htons(ifp->family);
75 ar.ar_pro = htons(ETHERTYPE_IP);
76 ar.ar_hln = ifp->hwlen;
77 ar.ar_pln = sizeof(sip);
78 ar.ar_op = htons(ARPOP_REQUEST);
79
80 p = arp_buffer;
81 len = 0;
82
83#define CHECK(fun, b, l) \
84 do { \
85 if (len + (l) > sizeof(arp_buffer)) \
86 goto eexit; \
87 fun(p, (b), (l)); \
88 p += (l); \
89 len += (l); \
90 } while (/* CONSTCOND */ 0)
91#define APPEND(b, l) CHECK(memcpy, b, l)
92#define ZERO(l) CHECK(memset, 0, l)
93
94 APPEND(&ar, sizeof(ar));
95 APPEND(ifp->hwaddr, ifp->hwlen);
96 APPEND(&sip, sizeof(sip));
97 ZERO(ifp->hwlen);
98 APPEND(&tip, sizeof(tip));
99
100 state = ARP_CSTATE(ifp);
101 return bpf_send(ifp, state->bpf_fd, ETHERTYPE_ARP, arp_buffer, len);
102
103eexit:
104 errno = ENOBUFS;
105 return -1;
106}
107
108static void
109arp_packet(struct interface *ifp, uint8_t *data, size_t len)
110{
111 const struct interface *ifn;
112 struct arphdr ar;
113 struct arp_msg arm;
114 const struct iarp_state *state;
115 struct arp_state *astate, *astaten;
116 uint8_t *hw_s, *hw_t;
117
118 /* We must have a full ARP header */
119 if (len < sizeof(ar))
120 return;
121 memcpy(&ar, data, sizeof(ar));
122
123 /* These checks are enforced in the BPF filter. */
124#if 0
125 /* Families must match */
126 if (ar.ar_hrd != htons(ifp->family))
127 return;
128 /* Protocol must be IP. */
129 if (ar.ar_pro != htons(ETHERTYPE_IP))
130 continue;
131 /* lladdr length matches */
132 if (ar.ar_hln != ifp->hwlen)
133 continue;
134 /* Protocol length must match in_addr_t */
135 if (ar.ar_pln != sizeof(arm.sip.s_addr))
136 return;
137 /* Only these types are recognised */
138 if (ar.ar_op != htons(ARPOP_REPLY) &&
139 ar.ar_op != htons(ARPOP_REQUEST))
140 continue;
141#endif
142
143 /* Get pointers to the hardware addresses */
144 hw_s = data + sizeof(ar);
145 hw_t = hw_s + ar.ar_hln + ar.ar_pln;
146 /* Ensure we got all the data */
147 if ((size_t)((hw_t + ar.ar_hln + ar.ar_pln) - data) > len)
148 return;
149 /* Ignore messages from ourself */
150 TAILQ_FOREACH(ifn, ifp->ctx->ifaces, next) {
151 if (ar.ar_hln == ifn->hwlen &&
152 memcmp(hw_s, ifn->hwaddr, ifn->hwlen) == 0)
153 break;
154 }
155 if (ifn) {
156#ifdef ARP_DEBUG
157 logdebugx("%s: ignoring ARP from self", ifp->name);
158#endif
159 return;
160 }
161 /* Copy out the HW and IP addresses */
162 memcpy(&arm.sha, hw_s, ar.ar_hln);
163 memcpy(&arm.sip.s_addr, hw_s + ar.ar_hln, ar.ar_pln);
164 memcpy(&arm.tha, hw_t, ar.ar_hln);
165 memcpy(&arm.tip.s_addr, hw_t + ar.ar_hln, ar.ar_pln);
166
167 /* Run the conflicts */
168 state = ARP_CSTATE(ifp);
169 TAILQ_FOREACH_SAFE(astate, &state->arp_states, next, astaten) {
170 if (arm.sip.s_addr != astate->addr.s_addr &&
171 arm.tip.s_addr != astate->addr.s_addr)
172 continue;
173 if (astate->conflicted_cb)
174 astate->conflicted_cb(astate, &arm);
175 }
176}
177
178static void
179arp_close(struct interface *ifp)
180{
181 struct iarp_state *state;
182
183 if ((state = ARP_STATE(ifp)) == NULL || state->bpf_fd == -1)
184 return;
185
186 eloop_event_delete(ifp->ctx->eloop, state->bpf_fd);
187 bpf_close(ifp, state->bpf_fd);
188 state->bpf_fd = -1;
189 state->bpf_flags |= BPF_EOF;
190}
191
192static void
193arp_tryfree(struct interface *ifp)
194{
195 struct iarp_state *state = ARP_STATE(ifp);
196
197 /* If there are no more ARP states, close the socket. */
198 if (TAILQ_FIRST(&state->arp_states) == NULL) {
199 arp_close(ifp);
200 if (state->bpf_flags & BPF_READING)
201 state->bpf_flags |= BPF_EOF;
202 else {
203 free(state);
204 ifp->if_data[IF_DATA_ARP] = NULL;
205 }
206 } else {
207 if (bpf_arp(ifp, state->bpf_fd) == -1)
208 logerr(__func__);
209 }
210}
211
212static void
213arp_read(void *arg)
214{
215 struct interface *ifp = arg;
216 struct iarp_state *state;
217 uint8_t buf[ARP_LEN];
218 ssize_t bytes;
219
220 /* Some RAW mechanisms are generic file descriptors, not sockets.
221 * This means we have no kernel call to just get one packet,
222 * so we have to process the entire buffer. */
223 state = ARP_STATE(ifp);
224 state->bpf_flags &= ~BPF_EOF;
225 state->bpf_flags |= BPF_READING;
226 while (!(state->bpf_flags & BPF_EOF)) {
227 bytes = bpf_read(ifp, state->bpf_fd, buf, sizeof(buf),
228 &state->bpf_flags);
229 if (bytes == -1) {
230 logerr("%s: %s", __func__, ifp->name);
231 arp_close(ifp);
232 break;
233 }
234 arp_packet(ifp, buf, (size_t)bytes);
235 /* Check we still have a state after processing. */
236 if ((state = ARP_STATE(ifp)) == NULL)
237 break;
238 }
239 if (state != NULL) {
240 state->bpf_flags &= ~BPF_READING;
241 /* Try and free the state if nothing left to do. */
242 arp_tryfree(ifp);
243 }
244}
245
246int
247arp_open(struct interface *ifp)
248{
249 struct iarp_state *state;
250
251 state = ARP_STATE(ifp);
252 if (state->bpf_fd == -1) {
253 state->bpf_fd = bpf_open(ifp, bpf_arp);
254 if (state->bpf_fd == -1) {
255 logerr("%s: %s", __func__, ifp->name);
256 return -1;
257 }
258 eloop_event_add(ifp->ctx->eloop, state->bpf_fd, arp_read, ifp);
259 }
260 return state->bpf_fd;
261}
262
263static void
264arp_probed(void *arg)
265{
266 struct arp_state *astate = arg;
267
268 astate->probed_cb(astate);
269}
270
271static void
272arp_probe1(void *arg)
273{
274 struct arp_state *astate = arg;
275 struct interface *ifp = astate->iface;
276 struct timespec tv;
277
278 if (++astate->probes < PROBE_NUM) {
279 tv.tv_sec = PROBE_MIN;
280 tv.tv_nsec = (suseconds_t)arc4random_uniform(
281 (PROBE_MAX - PROBE_MIN) * NSEC_PER_SEC);
282 timespecnorm(&tv);
283 eloop_timeout_add_tv(ifp->ctx->eloop, &tv, arp_probe1, astate);
284 } else {
285 tv.tv_sec = ANNOUNCE_WAIT;
286 tv.tv_nsec = 0;
287 eloop_timeout_add_tv(ifp->ctx->eloop, &tv, arp_probed, astate);
288 }
289 logdebugx("%s: ARP probing %s (%d of %d), next in %0.1f seconds",
290 ifp->name, inet_ntoa(astate->addr),
291 astate->probes ? astate->probes : PROBE_NUM, PROBE_NUM,
292 timespec_to_double(&tv));
293 if (arp_request(ifp, 0, astate->addr.s_addr) == -1)
294 logerr(__func__);
295}
296
297void
298arp_probe(struct arp_state *astate)
299{
300
301 if (arp_open(astate->iface) == -1) {
302 logerr(__func__);
303 return;
304 } else {
305 const struct iarp_state *state = ARP_CSTATE(astate->iface);
306
307 if (bpf_arp(astate->iface, state->bpf_fd) == -1)
308 logerr(__func__);
309 }
310 astate->probes = 0;
311 logdebugx("%s: probing for %s",
312 astate->iface->name, inet_ntoa(astate->addr));
313 arp_probe1(astate);
314}
315#endif /* ARP */
316
317static void
318arp_announced(void *arg)
319{
320 struct arp_state *astate = arg;
321
322 if (astate->announced_cb) {
323 astate->announced_cb(astate);
324 return;
325 }
326
327 /* Keep the ARP state open to handle ongoing ACD. */
328}
329
330static void
331arp_announce1(void *arg)
332{
333 struct arp_state *astate = arg;
334 struct interface *ifp = astate->iface;
335
336 if (++astate->claims < ANNOUNCE_NUM)
337 logdebugx("%s: ARP announcing %s (%d of %d), "
338 "next in %d.0 seconds",
339 ifp->name, inet_ntoa(astate->addr),
340 astate->claims, ANNOUNCE_NUM, ANNOUNCE_WAIT);
341 else
342 logdebugx("%s: ARP announcing %s (%d of %d)",
343 ifp->name, inet_ntoa(astate->addr),
344 astate->claims, ANNOUNCE_NUM);
345 if (arp_request(ifp, astate->addr.s_addr, astate->addr.s_addr) == -1)
346 logerr(__func__);
347 eloop_timeout_add_sec(ifp->ctx->eloop, ANNOUNCE_WAIT,
348 astate->claims < ANNOUNCE_NUM ? arp_announce1 : arp_announced,
349 astate);
350}
351
352/*
353 * XXX FIXME
354 * Kernels supporting RFC5227 will announce the address when it's
355 * added.
356 * dhcpcd should not announce when this happens, nor need to open
357 * a BPF socket for it.
358 * Also, an address might be added to a non preferred inteface when
359 * the same address exists on a preferred one so we need to instruct
360 * the kernel not to announce the address somehow.
361 */
362
363void
364arp_announce(struct arp_state *astate)
365{
366 struct iarp_state *state;
367 struct interface *ifp;
368 struct arp_state *a2;
369 int r;
370
371 if (arp_open(astate->iface) == -1) {
372 logerr(__func__);
373 return;
374 }
375
376 /* Cancel any other ARP announcements for this address. */
377 TAILQ_FOREACH(ifp, astate->iface->ctx->ifaces, next) {
378 state = ARP_STATE(ifp);
379 if (state == NULL)
380 continue;
381 TAILQ_FOREACH(a2, &state->arp_states, next) {
382 if (astate == a2 ||
383 a2->addr.s_addr != astate->addr.s_addr)
384 continue;
385 r = eloop_timeout_delete(a2->iface->ctx->eloop,
386 a2->claims < ANNOUNCE_NUM
387 ? arp_announce1 : arp_announced,
388 a2);
389 if (r == -1)
390 logerr(__func__);
391 else if (r != 0)
392 logdebugx("%s: ARP announcement "
393 "of %s cancelled",
394 a2->iface->name,
395 inet_ntoa(a2->addr));
396 }
397 }
398
399 astate->claims = 0;
400 arp_announce1(astate);
401}
402
403void
404arp_announceaddr(struct dhcpcd_ctx *ctx, const struct in_addr *ia)
405{
406 struct interface *ifp;
407 struct ipv4_addr *iaf;
408 struct arp_state *astate;
409
410 TAILQ_FOREACH(ifp, ctx->ifaces, next) {
411 iaf = ipv4_iffindaddr(ifp, ia, NULL);
412#ifdef IN_IFF_NOTUSEABLE
413 if (iaf && !(iaf->addr_flags & IN_IFF_NOTUSEABLE))
414#else
415 if (iaf)
416#endif
417 break;
418 }
419 if (ifp == NULL)
420 return;
421
422 astate = arp_find(ifp, ia);
423 if (astate != NULL)
424 arp_announce(astate);
425}
426
427void
428arp_ifannounceaddr(struct interface *ifp, const struct in_addr *ia)
429{
430 struct arp_state *astate;
431
432 astate = arp_new(ifp, ia);
433 if (astate != NULL)
434 arp_announce(astate);
435}
436
437void
438arp_report_conflicted(const struct arp_state *astate,
439 const struct arp_msg *amsg)
440{
441
442 if (amsg != NULL) {
443 char buf[HWADDR_LEN * 3];
444
445 logerrx("%s: hardware address %s claims %s",
446 astate->iface->name,
447 hwaddr_ntoa(amsg->sha, astate->iface->hwlen,
448 buf, sizeof(buf)),
449 inet_ntoa(astate->failed));
450 } else
451 logerrx("%s: DAD detected %s",
452 astate->iface->name, inet_ntoa(astate->failed));
453}
454
455struct arp_state *
456arp_find(struct interface *ifp, const struct in_addr *addr)
457{
458 struct iarp_state *state;
459 struct arp_state *astate;
460
461 if ((state = ARP_STATE(ifp)) == NULL)
462 goto out;
463 TAILQ_FOREACH(astate, &state->arp_states, next) {
464 if (astate->addr.s_addr == addr->s_addr && astate->iface == ifp)
465 return astate;
466 }
467out:
468 errno = ESRCH;
469 return NULL;
470}
471
472struct arp_state *
473arp_new(struct interface *ifp, const struct in_addr *addr)
474{
475 struct iarp_state *state;
476 struct arp_state *astate;
477
478 if ((state = ARP_STATE(ifp)) == NULL) {
479 ifp->if_data[IF_DATA_ARP] = malloc(sizeof(*state));
480 state = ARP_STATE(ifp);
481 if (state == NULL) {
482 logerr(__func__);
483 return NULL;
484 }
485 state->bpf_fd = -1;
486 state->bpf_flags = 0;
487 TAILQ_INIT(&state->arp_states);
488 } else {
489 if (addr && (astate = arp_find(ifp, addr)))
490 return astate;
491 }
492
493 if ((astate = calloc(1, sizeof(*astate))) == NULL) {
494 logerr(__func__);
495 return NULL;
496 }
497 astate->iface = ifp;
498 if (addr)
499 astate->addr = *addr;
500 state = ARP_STATE(ifp);
501 TAILQ_INSERT_TAIL(&state->arp_states, astate, next);
502
503 if (bpf_arp(ifp, state->bpf_fd) == -1)
504 logerr(__func__); /* try and continue */
505
506 return astate;
507}
508
509void
510arp_cancel(struct arp_state *astate)
511{
512
513 eloop_timeout_delete(astate->iface->ctx->eloop, NULL, astate);
514}
515
516void
517arp_free(struct arp_state *astate)
518{
519 struct interface *ifp;
520 struct iarp_state *state;
521
522 if (astate == NULL)
523 return;
524
525 ifp = astate->iface;
526 eloop_timeout_delete(ifp->ctx->eloop, NULL, astate);
527 state = ARP_STATE(ifp);
528 TAILQ_REMOVE(&state->arp_states, astate, next);
529 if (astate->free_cb)
530 astate->free_cb(astate);
531 free(astate);
532 arp_tryfree(ifp);
533}
534
535static void
536arp_free_but1(struct interface *ifp, struct arp_state *astate)
537{
538 struct iarp_state *state;
539
540 if ((state = ARP_STATE(ifp)) != NULL) {
541 struct arp_state *p, *n;
542
543 TAILQ_FOREACH_SAFE(p, &state->arp_states, next, n) {
544 if (p != astate)
545 arp_free(p);
546 }
547 }
548}
549
550void
551arp_free_but(struct arp_state *astate)
552{
553
554 arp_free_but1(astate->iface, astate);
555}
556
557void
558arp_drop(struct interface *ifp)
559{
560
561 arp_free_but1(ifp, NULL);
562 arp_close(ifp);
563}
564
565void
566arp_handleifa(int cmd, struct ipv4_addr *addr)
567{
568 struct iarp_state *state;
569 struct arp_state *astate, *asn;
570
571 state = ARP_STATE(addr->iface);
572 if (state == NULL)
573 return;
574
575 TAILQ_FOREACH_SAFE(astate, &state->arp_states, next, asn) {
576 if (astate->addr.s_addr != addr->addr.s_addr)
577 continue;
578 if (cmd == RTM_DELADDR)
579 arp_free(astate);
580#ifdef IN_IFF_DUPLICATED
581 if (cmd != RTM_NEWADDR)
582 continue;
583 if (addr->addr_flags & IN_IFF_DUPLICATED) {
584 if (astate->conflicted_cb)
585 astate->conflicted_cb(astate, NULL);
586 } else if (!(addr->addr_flags & IN_IFF_NOTUSEABLE)) {
587 if (astate->probed_cb)
588 astate->probed_cb(astate);
589 }
590#endif
591 }
592}
593