1 /* 2 * dhcpcd - ARP handler 3 * SPDX-License-Identifier: BSD-2-Clause 4 * Copyright (c) 2006-2025 Roy Marples <roy (at) marples.name> 5 * All rights reserved 6 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/types.h> 30 #include <sys/socket.h> 31 32 #include <net/if.h> 33 #include <netinet/in.h> 34 #include <netinet/if_ether.h> 35 36 #include <arpa/inet.h> 37 #include <errno.h> 38 #include <stdio.h> 39 #include <stdlib.h> 40 #include <string.h> 41 #include <unistd.h> 42 43 #define ELOOP_QUEUE ELOOP_ARP 44 #include "config.h" // IWYU pragma: keep 45 #include "arp.h" 46 #include "bpf.h" 47 #include "common.h" 48 #include "dhcpcd.h" 49 #include "eloop.h" 50 #include "if-options.h" 51 #include "if.h" 52 #include "ipv4.h" 53 #include "logerr.h" 54 #include "privsep.h" 55 56 #if defined(ARP) 57 #define ARP_LEN \ 58 (FRAMEHDRLEN_MAX + sizeof(struct arphdr) + (2 * sizeof(uint32_t)) + \ 59 (2 * HWADDR_LEN)) 60 61 /* ARP debugging can be quite noisy. Enable this for more noise! */ 62 // #define ARP_DEBUG 63 64 /* Assert the correct structure size for on wire */ 65 __CTASSERT(sizeof(struct arphdr) == 8); 66 67 static ssize_t 68 arp_request(const struct arp_state *astate, const struct in_addr *sip) 69 { 70 const struct interface *ifp = astate->iface; 71 const struct in_addr *tip = &astate->addr; 72 uint8_t arp_buffer[ARP_LEN]; 73 struct arphdr ar; 74 size_t len; 75 uint8_t *p; 76 77 ar.ar_hrd = htons(ifp->hwtype); 78 ar.ar_pro = htons(ETHERTYPE_IP); 79 ar.ar_hln = ifp->hwlen; 80 ar.ar_pln = sizeof(tip->s_addr); 81 ar.ar_op = htons(ARPOP_REQUEST); 82 83 p = arp_buffer; 84 len = 0; 85 86 #define CHECK(fun, b, l) \ 87 do { \ 88 if (len + (l) > sizeof(arp_buffer)) \ 89 goto eexit; \ 90 fun(p, (b), (l)); \ 91 p += (l); \ 92 len += (l); \ 93 } while (/* CONSTCOND */ 0) 94 #define APPEND(b, l) CHECK(memcpy, b, l) 95 #define ZERO(l) CHECK(memset, 0, l) 96 97 APPEND(&ar, sizeof(ar)); 98 APPEND(ifp->hwaddr, ifp->hwlen); 99 if (sip != NULL) 100 APPEND(&sip->s_addr, sizeof(sip->s_addr)); 101 else 102 ZERO(sizeof(tip->s_addr)); 103 ZERO(ifp->hwlen); 104 APPEND(&tip->s_addr, sizeof(tip->s_addr)); 105 106 #ifdef PRIVSEP 107 if (ifp->ctx->options & DHCPCD_PRIVSEP) 108 return ps_bpf_sendarp(ifp, tip, arp_buffer, len); 109 #endif 110 /* Note that well formed ethernet will add extra padding 111 * to ensure that the packet is at least 60 bytes (64 including FCS). */ 112 return bpf_send(astate->bpf, ETHERTYPE_ARP, arp_buffer, len); 113 114 eexit: 115 errno = ENOBUFS; 116 return -1; 117 } 118 119 static void 120 arp_report_conflicted(const struct arp_state *astate, 121 const struct arp_msg *amsg) 122 { 123 char abuf[HWADDR_LEN * 3]; 124 char fbuf[HWADDR_LEN * 3]; 125 126 if (amsg == NULL) { 127 logerrx("%s: DAD detected %s", astate->iface->name, 128 inet_ntoa(astate->addr)); 129 return; 130 } 131 132 hwaddr_ntoa(amsg->sha, astate->iface->hwlen, abuf, sizeof(abuf)); 133 if (bpf_frame_header_len(astate->iface) == 0) { 134 logwarnx("%s: %s claims %s", astate->iface->name, abuf, 135 inet_ntoa(astate->addr)); 136 return; 137 } 138 139 logwarnx("%s: %s(%s) claims %s", astate->iface->name, abuf, 140 hwaddr_ntoa(amsg->fsha, astate->iface->hwlen, fbuf, sizeof(fbuf)), 141 inet_ntoa(astate->addr)); 142 } 143 144 static void 145 arp_found(struct arp_state *astate, const struct arp_msg *amsg) 146 { 147 struct interface *ifp; 148 struct ipv4_addr *ia; 149 #ifndef KERNEL_RFC5227 150 struct timespec now; 151 #endif 152 153 arp_report_conflicted(astate, amsg); 154 ifp = astate->iface; 155 156 /* If we haven't added the address we're doing a probe. */ 157 ia = ipv4_iffindaddr(ifp, &astate->addr, NULL); 158 if (ia == NULL) { 159 if (astate->found_cb != NULL) 160 astate->found_cb(astate, amsg); 161 return; 162 } 163 164 #ifndef KERNEL_RFC5227 165 /* RFC 3927 Section 2.5 says a defence should 166 * broadcast an ARP announcement. 167 * Because the kernel will also unicast a reply to the 168 * hardware address which requested the IP address 169 * the other IPv4LL client will receieve two ARP 170 * messages. 171 * If another conflict happens within DEFEND_INTERVAL 172 * then we must drop our address and negotiate a new one. 173 * If DHCPCD_ARP_PERSISTDEFENCE is set, that enables 174 * RFC5227 section 2.4.c behaviour. Upon conflict 175 * detection, the host records the time that the 176 * conflicting ARP packet was received, and then 177 * broadcasts one single ARP Announcement. The host then 178 * continues to use the address normally. All further 179 * conflict notifications within the DEFEND_INTERVAL are 180 * ignored. */ 181 clock_gettime(CLOCK_MONOTONIC, &now); 182 if (timespecisset(&astate->defend) && 183 eloop_timespec_diff(&now, &astate->defend, NULL) < 184 DEFEND_INTERVAL) { 185 logwarnx("%s: %d second defence failed for %s", ifp->name, 186 DEFEND_INTERVAL, inet_ntoa(astate->addr)); 187 if (ifp->options->options & DHCPCD_ARP_PERSISTDEFENCE) 188 return; 189 } else if (arp_request(astate, &astate->addr) == -1) 190 logerr(__func__); 191 else { 192 logdebugx("%s: defended address %s", ifp->name, 193 inet_ntoa(astate->addr)); 194 astate->defend = now; 195 return; 196 } 197 #endif 198 199 if (astate->defend_failed_cb != NULL) 200 astate->defend_failed_cb(astate); 201 } 202 203 static bool 204 arp_validate(const struct interface *ifp, struct arphdr *arp) 205 { 206 /* Address type must match */ 207 if (arp->ar_hrd != htons(ifp->hwtype)) 208 return false; 209 210 /* Protocol must be IP. */ 211 if (arp->ar_pro != htons(ETHERTYPE_IP)) 212 return false; 213 214 /* lladdr length matches */ 215 if (arp->ar_hln != ifp->hwlen) 216 return false; 217 218 /* Protocol length must match in_addr_t */ 219 if (arp->ar_pln != sizeof(in_addr_t)) 220 return false; 221 222 /* Only these types are recognised */ 223 if (arp->ar_op != htons(ARPOP_REPLY) && 224 arp->ar_op != htons(ARPOP_REQUEST)) 225 return false; 226 227 return true; 228 } 229 230 void 231 arp_packet(struct interface *ifp, uint8_t *data, size_t len, 232 unsigned int bpf_flags) 233 { 234 size_t fl = bpf_frame_header_len(ifp), falen; 235 struct arphdr ar; 236 struct arp_msg arm; 237 const struct iarp_state *state; 238 struct arp_state *astate, *astaten; 239 uint8_t *hw_s, *hw_t; 240 #ifndef KERNEL_RFC5227 241 bool is_probe; 242 #endif /* KERNEL_RFC5227 */ 243 244 /* Copy the frame header source and destination out */ 245 memset(&arm, 0, sizeof(arm)); 246 if (fl != 0) { 247 if (len < fl) 248 return; 249 hw_s = bpf_frame_header_src(ifp, data, &falen); 250 if (hw_s != NULL && falen <= sizeof(arm.fsha)) 251 memcpy(arm.fsha, hw_s, falen); 252 hw_t = bpf_frame_header_dst(ifp, data, &falen); 253 if (hw_t != NULL && falen <= sizeof(arm.ftha)) 254 memcpy(arm.ftha, hw_t, falen); 255 256 /* Skip past the frame header */ 257 data += fl; 258 len -= fl; 259 } 260 261 /* We must have a full ARP header */ 262 if (len < sizeof(ar)) 263 return; 264 memcpy(&ar, data, sizeof(ar)); 265 266 if (!arp_validate(ifp, &ar)) { 267 #ifdef BPF_DEBUG 268 logerrx("%s: ARP BPF validation failure", ifp->name); 269 #endif 270 return; 271 } 272 273 /* Get pointers to the hardware addresses */ 274 hw_s = data + sizeof(ar); 275 hw_t = hw_s + ar.ar_hln + ar.ar_pln; 276 /* Ensure we got all the data */ 277 if ((size_t)((hw_t + ar.ar_hln + ar.ar_pln) - data) > len) 278 return; 279 /* Ignore messages from ourself */ 280 if (ar.ar_hln == ifp->hwlen && 281 memcmp(hw_s, ifp->hwaddr, ifp->hwlen) == 0) { 282 #ifdef ARP_DEBUG 283 logdebugx("%s: ignoring ARP from self", ifp->name); 284 #endif 285 return; 286 } 287 /* Copy out the HW and IP addresses */ 288 memcpy(&arm.sha, hw_s, ar.ar_hln); 289 memcpy(&arm.sip.s_addr, hw_s + ar.ar_hln, ar.ar_pln); 290 memcpy(&arm.tha, hw_t, ar.ar_hln); 291 memcpy(&arm.tip.s_addr, hw_t + ar.ar_hln, ar.ar_pln); 292 293 #ifndef KERNEL_RFC5227 294 /* During ARP probe the 'sender hardware address' MUST contain the 295 * hardware address of the interface sending the packet. RFC5227, 1.1 */ 296 is_probe = ar.ar_op == htons(ARPOP_REQUEST) && 297 IN_IS_ADDR_UNSPECIFIED(&arm.sip) && bpf_flags & BPF_BCAST; 298 if (is_probe && falen > 0 && 299 (falen != ar.ar_hln || memcmp(&arm.sha, &arm.fsha, ar.ar_hln))) { 300 char abuf[HWADDR_LEN * 3]; 301 char fbuf[HWADDR_LEN * 3]; 302 hwaddr_ntoa(&arm.sha, ar.ar_hln, abuf, sizeof(abuf)); 303 hwaddr_ntoa(&arm.fsha, falen, fbuf, sizeof(fbuf)); 304 logwarnx( 305 "%s: invalid ARP probe, sender hw address mismatch (%s, %s)", 306 ifp->name, abuf, fbuf); 307 return; 308 } 309 #endif /* KERNEL_RFC5227 */ 310 311 /* Match the ARP probe to our states. 312 * Ignore Unicast Poll, RFC1122. */ 313 state = ARP_CSTATE(ifp); 314 if (state == NULL) 315 return; 316 TAILQ_FOREACH_SAFE(astate, &state->arp_states, next, astaten) { 317 if (IN_ARE_ADDR_EQUAL(&arm.sip, &astate->addr) || 318 (IN_IS_ADDR_UNSPECIFIED(&arm.sip) && 319 IN_ARE_ADDR_EQUAL(&arm.tip, &astate->addr) && 320 bpf_flags & BPF_BCAST)) 321 arp_found(astate, &arm); 322 } 323 } 324 325 static void 326 arp_read(void *arg, unsigned short events) 327 { 328 struct arp_state *astate = arg; 329 struct bpf *bpf = astate->bpf; 330 struct interface *ifp = astate->iface; 331 uint8_t buf[ARP_LEN]; 332 ssize_t bytes; 333 struct in_addr addr = astate->addr; 334 335 if (events != ELE_READ) 336 logerrx("%s: unexpected event 0x%04x", __func__, events); 337 338 /* Some RAW mechanisms are generic file descriptors, not sockets. 339 * This means we have no kernel call to just get one packet, 340 * so we have to process the entire buffer. */ 341 bpf->bpf_flags &= ~BPF_EOF; 342 while (!(bpf->bpf_flags & BPF_EOF)) { 343 bytes = bpf_read(bpf, buf, sizeof(buf)); 344 if (bytes == -1) { 345 logerr("%s: %s", __func__, ifp->name); 346 arp_free(astate); 347 return; 348 } 349 arp_packet(ifp, buf, (size_t)bytes, bpf->bpf_flags); 350 /* Check we still have a state after processing. */ 351 if ((astate = arp_find(ifp, &addr)) == NULL) 352 break; 353 if ((bpf = astate->bpf) == NULL) 354 break; 355 } 356 } 357 358 static void 359 arp_probed(void *arg) 360 { 361 struct arp_state *astate = arg; 362 363 timespecclear(&astate->defend); 364 astate->not_found_cb(astate); 365 } 366 367 static void 368 arp_probe1(void *arg) 369 { 370 struct arp_state *astate = arg; 371 struct interface *ifp = astate->iface; 372 unsigned int delay; 373 374 if (++astate->probes < PROBE_NUM) { 375 delay = (PROBE_MIN * MSEC_PER_SEC) + 376 (arc4random_uniform( 377 (PROBE_MAX - PROBE_MIN) * MSEC_PER_SEC)); 378 eloop_timeout_add_msec(ifp->ctx->eloop, delay, arp_probe1, 379 astate); 380 } else { 381 delay = ANNOUNCE_WAIT * MSEC_PER_SEC; 382 eloop_timeout_add_msec(ifp->ctx->eloop, delay, arp_probed, 383 astate); 384 } 385 logdebugx("%s: ARP probing %s (%d of %d), next in %0.1f seconds", 386 ifp->name, inet_ntoa(astate->addr), 387 astate->probes ? astate->probes : PROBE_NUM, PROBE_NUM, 388 (float)delay / MSEC_PER_SEC); 389 if (arp_request(astate, NULL) == -1) 390 logerr(__func__); 391 } 392 393 void 394 arp_probe(struct arp_state *astate) 395 { 396 astate->probes = 0; 397 logdebugx("%s: probing for %s", astate->iface->name, 398 inet_ntoa(astate->addr)); 399 arp_probe1(astate); 400 } 401 #endif /* ARP */ 402 403 struct arp_state * 404 arp_find(struct interface *ifp, const struct in_addr *addr) 405 { 406 struct iarp_state *state; 407 struct arp_state *astate; 408 409 if ((state = ARP_STATE(ifp)) == NULL) 410 goto out; 411 TAILQ_FOREACH(astate, &state->arp_states, next) { 412 if (astate->addr.s_addr == addr->s_addr && astate->iface == ifp) 413 return astate; 414 } 415 out: 416 errno = ESRCH; 417 return NULL; 418 } 419 420 #ifndef KERNEL_RFC5227 421 static void 422 arp_announced(void *arg) 423 { 424 struct arp_state *astate = arg; 425 426 if (astate->announced_cb) { 427 astate->announced_cb(astate); 428 return; 429 } 430 431 /* Keep the ARP state open to handle ongoing ACD. */ 432 } 433 434 static void 435 arp_announce1(void *arg) 436 { 437 struct arp_state *astate = arg; 438 struct interface *ifp = astate->iface; 439 struct ipv4_addr *ia; 440 441 if (++astate->claims < ANNOUNCE_NUM) 442 logdebugx("%s: ARP announcing %s (%d of %d), " 443 "next in %d.0 seconds", 444 ifp->name, inet_ntoa(astate->addr), astate->claims, 445 ANNOUNCE_NUM, ANNOUNCE_WAIT); 446 else 447 logdebugx("%s: ARP announcing %s (%d of %d)", ifp->name, 448 inet_ntoa(astate->addr), astate->claims, ANNOUNCE_NUM); 449 450 /* The kernel will send a Gratuitous ARP for newly added addresses. 451 * So we can avoid sending the same. 452 * Linux is special and doesn't send one. */ 453 ia = ipv4_iffindaddr(ifp, &astate->addr, NULL); 454 #ifndef __linux__ 455 if (astate->claims == 1 && ia != NULL && ia->flags & IPV4_AF_NEW) 456 goto skip_request; 457 #endif 458 459 if (arp_request(astate, &astate->addr) == -1) 460 logerr(__func__); 461 462 #ifndef __linux__ 463 skip_request: 464 #endif 465 /* No longer a new address. */ 466 if (ia != NULL) 467 ia->flags |= ~IPV4_AF_NEW; 468 469 eloop_timeout_add_sec(ifp->ctx->eloop, ANNOUNCE_WAIT, 470 astate->claims < ANNOUNCE_NUM ? arp_announce1 : arp_announced, 471 astate); 472 } 473 474 static void 475 arp_announce(struct arp_state *astate) 476 { 477 struct iarp_state *state; 478 struct interface *ifp; 479 struct arp_state *a2, *an; 480 int r; 481 482 /* Cancel any other ARP announcements for this address. */ 483 TAILQ_FOREACH(ifp, astate->iface->ctx->ifaces, next) { 484 state = ARP_STATE(ifp); 485 if (state == NULL) 486 continue; 487 TAILQ_FOREACH_SAFE(a2, &state->arp_states, next, an) { 488 if (astate == a2 || 489 a2->addr.s_addr != astate->addr.s_addr) 490 continue; 491 r = eloop_timeout_delete(a2->iface->ctx->eloop, 492 a2->claims < ANNOUNCE_NUM ? arp_announce1 : 493 arp_announced, 494 a2); 495 if (r == -1) 496 logerr(__func__); 497 else if (r != 0) { 498 logdebugx("%s: ARP announcement " 499 "of %s cancelled", 500 a2->iface->name, inet_ntoa(a2->addr)); 501 arp_announced(a2); 502 } 503 } 504 } 505 506 astate->claims = 0; 507 arp_announce1(astate); 508 } 509 510 struct arp_state * 511 arp_ifannounceaddr(struct interface *ifp, const struct in_addr *ia) 512 { 513 struct arp_state *astate; 514 515 if (ifp->flags & IFF_NOARP || !(ifp->options->options & DHCPCD_ARP)) 516 return NULL; 517 518 astate = arp_find(ifp, ia); 519 if (astate == NULL) { 520 astate = arp_new(ifp, ia); 521 if (astate == NULL) 522 return NULL; 523 astate->announced_cb = arp_free; 524 } 525 arp_announce(astate); 526 return astate; 527 } 528 #endif 529 530 struct arp_state * 531 arp_new(struct interface *ifp, const struct in_addr *addr) 532 { 533 struct iarp_state *state; 534 struct arp_state *astate; 535 536 if ((state = ARP_STATE(ifp)) == NULL) { 537 ifp->if_data[IF_DATA_ARP] = malloc(sizeof(*state)); 538 state = ARP_STATE(ifp); 539 if (state == NULL) { 540 logerr(__func__); 541 return NULL; 542 } 543 TAILQ_INIT(&state->arp_states); 544 } else { 545 if ((astate = arp_find(ifp, addr)) != NULL) 546 return astate; 547 } 548 549 if ((astate = calloc(1, sizeof(*astate))) == NULL) { 550 logerr(__func__); 551 return NULL; 552 } 553 astate->iface = ifp; 554 astate->addr = *addr; 555 556 #ifdef PRIVSEP 557 if (IN_PRIVSEP(ifp->ctx)) { 558 if (ps_bpf_openarp(ifp, addr) == -1) { 559 logerr(__func__); 560 free(astate); 561 return NULL; 562 } 563 } else 564 #endif 565 { 566 astate->bpf = bpf_open(ifp, bpf_filter_arp, addr); 567 if (astate->bpf == NULL) { 568 logerr(__func__); 569 free(astate); 570 return NULL; 571 } 572 if (eloop_event_add(ifp->ctx->eloop, astate->bpf->bpf_fd, 573 ELE_READ, arp_read, astate) == -1) 574 logerr("%s: eloop_event_add", __func__); 575 } 576 577 state = ARP_STATE(ifp); 578 TAILQ_INSERT_TAIL(&state->arp_states, astate, next); 579 return astate; 580 } 581 582 void 583 arp_free(struct arp_state *astate) 584 { 585 struct interface *ifp; 586 struct dhcpcd_ctx *ctx; 587 struct iarp_state *state; 588 589 if (astate == NULL) 590 return; 591 592 ifp = astate->iface; 593 ctx = ifp->ctx; 594 eloop_timeout_delete(ctx->eloop, NULL, astate); 595 596 state = ARP_STATE(ifp); 597 TAILQ_REMOVE(&state->arp_states, astate, next); 598 if (astate->free_cb) 599 astate->free_cb(astate); 600 601 #ifdef PRIVSEP 602 if (IN_PRIVSEP(ctx) && ps_bpf_closearp(ifp, &astate->addr) == -1) 603 logerr(__func__); 604 #endif 605 if (astate->bpf != NULL) { 606 eloop_event_delete(ctx->eloop, astate->bpf->bpf_fd); 607 bpf_close(astate->bpf); 608 } 609 610 free(astate); 611 612 if (TAILQ_FIRST(&state->arp_states) == NULL) { 613 free(state); 614 ifp->if_data[IF_DATA_ARP] = NULL; 615 } 616 } 617 618 void 619 arp_freeaddr(struct interface *ifp, const struct in_addr *ia) 620 { 621 struct arp_state *astate; 622 623 astate = arp_find(ifp, ia); 624 arp_free(astate); 625 } 626 627 void 628 arp_drop(struct interface *ifp) 629 { 630 struct iarp_state *state; 631 struct arp_state *astate; 632 633 while ((state = ARP_STATE(ifp)) != NULL && 634 (astate = TAILQ_FIRST(&state->arp_states)) != NULL) 635 arp_free(astate); 636 } 637
Indexes created Wed Sep 02 00:25:50 UTC 2026