path: root/bpf-interface.scm

;;;
;;; Interface to the /dev/bpf[N] devices (ioctls, opening/closing etc)
;;;
;;; Copyright (c) 2013 by Peter Bex, see file COPYING.BSD
;;;
;;; TODO: Think about FreeBSD/OpenBSD extensions like LOCK, DIRFILT.
;;;       OS X seems to support only the smallest common denominator.
(module bpf-interface
  (bpf-open bpf-close bpf? bpf-buffer-length bpf-flush!
            bpf-interface bpf-interface-set! bpf-stats
            bpf-datalink-type bpf-datalink-type-set! bpf-list-datalink-types
            bpf-filter-set!)

(import chicken scheme foreign)

(use posix lolevel srfi-1 srfi-4 bitstring)

(foreign-declare "#include <errno.h>")
(foreign-declare "#include <string.h>")

(foreign-declare "#include <sys/types.h>")
(foreign-declare "#include <sys/time.h>")
(foreign-declare "#include <sys/ioctl.h>")
(foreign-declare "#include <net/bpf.h>")
;; For BIOCGETIF/BIOCSETIF
(foreign-declare "#include <net/if.h>")

(define error-string (foreign-lambda c-string "strerror" int))

;; From the IOCTL egg, with some tweaks for brevity and convenience
(define ioctl0
  (foreign-lambda* int (((c-pointer int) err) (int fd) (unsigned-long req))
    "int res = ioctl(fd, req);"
    "*err = errno;"
    "return(res);"))

(define ioctl1
  (foreign-lambda* int (((c-pointer int) err) (int fd)
                        (unsigned-long req) (c-pointer val1))
    "int res = ioctl(fd, req, val1);"
    "*err = errno;"
    "return(res);"))

(define-syntax ioctl
  (ir-macro-transformer
   (lambda (e i c)
     (let ((fd `(bpf-fd ,(cadr e)))     ; Always a bpf object
           (request `(foreign-value ,(->string (strip-syntax (caddr e))) int))
           (arg (and (pair? (cdddr e)) `(location ,(cadddr e)))))
       `(let-location ((err int))
          (let ((res ,(if arg
                          `(ioctl1 (location err) ,fd ,request ,arg)
                          `(ioctl0 (location err) ,fd ,request))))
            (if (= res -1)
                (error (error-string err))
                res)))))))

;;;;;;;;;;;

(define-record bpf fd)

(define-record-printer (bpf obj out)
  (if (bpf-fd obj)
      (fprintf out "#<bpf on interface: ~S>" (bpf-interface obj))
      (display "#<bpf (closed)>" out)))

;; Promiscuous mode is not guaranteed to be off even if the flag is #f
(define (bpf-open interface #!key buffer-length promiscuous)
  (let lp ((i -1)
           (prev-fn #f)
           (prev-error #f))
    ;; Try /dev/bpf first, before enumerating all of the /dev/bpfN options.
    ;; If all fail, show the error of the last file we tried, as soon as we
    ;; can't find any existing bpf files anymore.
    ;; This can be improved if Chicken allowed us to distinguish between
    ;; "nonexistent file"-type errors and other errors.
    (let ((fn (string-append "/dev/bpf" (if (fx= i -1) "" (number->string i)))))
      (if (and prev-error (not (file-exists? fn)))
          (let* ((om (get-condition-property prev-error 'exn 'message))
                 (msg (string-append
                       "Unable to open bpf device " prev-fn ": " om)))
            (signal (make-composite-condition
                     (make-property-condition
                      'exn 'location 'bpf-open 'message msg)
                     (make-property-condition 'bpf)
                     (make-property-condition 'i/o)
                     (make-property-condition 'file))))
          (let* ((mode (bitwise-ior open/read open/write open/nonblock))
                 (fd (condition-case (file-open fn mode)
                       (e (exn i/o file) (lp (fx+ i 1) fn e))))
                 (bpf (make-bpf fd)))
            (set-finalizer! bpf bpf-close)
            ;; Length _must_ be set before interface is assigned
            (when buffer-length
              (bpf-buffer-length-set! bpf buffer-length))
            (bpf-interface-set! bpf interface)
            ;; Rather pointless to expose this as a "setter" procedure(?)
            (when promiscuous
              (ioctl bpf BIOCPROMISC))
            bpf)))))

(define (bpf-close bpf)
  (and-let* ((fd (bpf-fd bpf)))
    (file-close fd)
    (bpf-fd-set! bpf #f))
  (void))

(define (bpf-flush! bpf)
  (ioctl bpf BIOCFLUSH))

;; Returns the *actual* size that was set, the requested size is too big
;; Remember, this can only be done *before* setting the interface.
;; Oddly enough, the interface can be switched afterwards, so there's
;; no way to set a new interface *and* buffer-length...
(define (bpf-buffer-length-set! bpf requested-length)
  (let-location ((new-length int requested-length))
    (ioctl bpf BIOCSBLEN new-length)
    new-length))

(define interface-name-maximum-length (foreign-value "IF_NAMESIZE" int))

(define (bpf-interface-set! bpf interface)
  (let ((ifreq (make-blob (foreign-value "sizeof(struct ifreq)" int)))
        (len (string-length interface)))
    (when (>= len interface-name-maximum-length)
      (error (string-append "Interface name exceeds maximum length of "
                            (number->string interface-name-maximum-length))
             interface))
    ((foreign-lambda* void ((scheme-pointer i) (scheme-pointer s) (int len))
       "char *ifname = ((struct ifreq *)i)->ifr_name;"
       "strncpy(ifname, s, len);"
       "ifname[len] = '\\0';") ifreq interface len)
    (ioctl bpf BIOCSETIF ifreq)
    (void)))

(define (bpf-interface bpf)
  (let ((ifreq (make-blob (foreign-value "sizeof(struct ifreq)" int))))
    (ioctl bpf BIOCGETIF ifreq)
    ((foreign-lambda* c-string ((scheme-pointer i))
       "C_return(((struct ifreq *)i)->ifr_name);") ifreq)))

(define (bpf-buffer-length bpf)
  (let-location ((length unsigned-int))
    (ioctl bpf BIOCGBLEN length)
    length))

;; These are a bit problematic: there is a shitload of known types.
;; Maybe we should automatically convert to a symbol, but that
;; requires coding all of the types in here.  OTOH, that's
;; more-or-less what C is doing with its #defines.
(define (bpf-datalink-type bpf)
  (let-location ((type unsigned-int))
    (ioctl bpf BIOCGDLT type)
    type))

(define (bpf-datalink-type-set! bpf type)
  (let-location ((type unsigned-int type))
    (ioctl bpf BIOCSDLT type)
    (void)))

(define (bpf-list-datalink-types bpf)
  ;; First, get the number of types (required slot length)
  (let ((in (make-blob (foreign-value "sizeof(struct bpf_dltlist)" int))))
    ((foreign-lambda* void (((c-pointer "struct bpf_dltlist") p))
       "p->bfl_list = NULL;") (location in))
    (ioctl bpf BIOCGDLTLIST in)
    (let* ((length ((foreign-lambda* unsigned-int
                        (((c-pointer "struct bpf_dltlist") p))
                      "C_return(p->bfl_len);") (location in)))
           ;; Now, get that many types
           (types (make-blob (* (foreign-value "sizeof(u_int)" int) length))))
      ((foreign-lambda* void (((c-pointer "struct bpf_dltlist") p)
                              ((c-pointer "u_int") list))
         "p->bfl_list = list;") (location in) (location types))
      (ioctl bpf BIOCGDLTLIST in)
      (list-tabulate
       length
       (lambda (i)
         ((foreign-lambda* unsigned-int (((c-pointer "u_int") p) (int i))
            "C_return(p[i]);") (location types) i))))))

(define (bpf-stats bpf)
  (let ((st (make-blob (foreign-value "sizeof(struct bpf_stat)" int))))
    (ioctl bpf BIOCGSTATS st)
    (let ((result '()))
      (let-syntax ((add-stat!
                    (syntax-rules ()
                      ((_ ?scheme-name ?c-name)
                       (set! result
                         (alist-cons '?scheme-name
                                     ((foreign-lambda* unsigned-integer64
                                          (((c-pointer "struct bpf_stat") st))
                                        "C_return((uint64_t)st->" ?c-name ");")
                                      (location st))
                                     result))))))
        (add-stat! received "bs_recv")
        (add-stat! dropped "bs_drop")
        (cond-expand (netbsd (add-stat! captured "bs_capt")))
        result))))

;; Maybe success should be cached inside the bpf object?
(define (check-version! bpf)
  (let ((expected-major (foreign-value "BPF_MAJOR_VERSION" int))
        (expected-minor (foreign-value "BPF_MINOR_VERSION" int))
        (v (make-blob (foreign-value "sizeof(struct bpf_version)" int))))
    (ioctl bpf BIOCVERSION v)
    (let-location ((major int) (minor int))
      ((foreign-lambda* void (((c-pointer "struct bpf_version") v)
                              ((c-pointer int) major) ((c-pointer int) minor))
         "*major = v->bv_major;"
         "*minor = v->bv_minor;")
       (location v) (location major) (location minor))
      ;; "Version numbers are compatible if the major numbers match and
      ;; the application minor is less than or equal to the kernel minor."
      (unless (and (= major expected-major)
                   (<= expected-minor minor))
        (error "BPF filter language version mismatch!"
               (cons major minor)
               (cons expected-major expected-minor))))))

(define (bpf-filter-set! bpf filter)
  (check-version! bpf)
  (let ((prog (make-blob (foreign-value "sizeof(struct bpf_program)" int)))
        (insns (cond ((bitstring? filter) (bitstring->blob filter))
                     ((or (blob? filter) (string? filter)) filter)
                     ((u8vector? filter) (u8vector->blob/shared filter))
                     (else (error "Unsupported filter data type" filter)))))
    ((foreign-lambda* void (((c-pointer "struct bpf_program") p)
                            (scheme-pointer i) (unsigned-int len))
       "p->bf_len = len;"
       "p->bf_insns = i;") (location prog) insns (fx/ (##sys#size insns) 8))
    (ioctl bpf BIOCSETF prog)
    (void)))

)