BPF: Address review comments

Author: rsmarples

src/bpf-bsd.c

@@ -40,7 +40,7 @@
 #include "bpf.h"
 #include "logerr.h"
 
-const char *bpf_name = "Berkley Packet Filter";
+const char *bpf_name = "Berkeley Packet Filter";
 
 struct bpf *
 bpf_open(const struct interface *ifp,
@@ -138,7 +138,8 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 {
 	ssize_t bytes;
 	struct bpf_hdr packet;
-	const char *payload;
+	size_t hdr_max;
+	const uint8_t *payload;
 
 	bpf->bpf_flags &= ~BPF_EOF;
 	for (;;) {
@@ -159,11 +160,22 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 			bpf->bpf_pos = 0;
 		}
 		bytes = -1;
-		payload = (const char *)bpf->bpf_buffer + bpf->bpf_pos;
+		if (bpf->bpf_pos + sizeof(packet) > bpf->bpf_len) {
+			errno = EINVAL;
+			goto err;
+		}
+		payload = (const uint8_t *)bpf->bpf_buffer + bpf->bpf_pos;
 		memcpy(&packet, payload, sizeof(packet));
-		if (bpf->bpf_pos + packet.bh_caplen + packet.bh_hdrlen >
-		    bpf->bpf_len)
-			goto next; /* Packet beyond buffer, drop. */
+		hdr_max = SIZE_MAX - packet.bh_caplen;
+		if (packet.bh_hdrlen > hdr_max) {
+			errno = EOVERFLOW;
+			goto err;
+		}
+		if (packet.bh_hdrlen + packet.bh_caplen >
+		    bpf->bpf_len - bpf->bpf_pos) {
+			errno = EBADMSG;
+			goto err;
+		}
 		payload += packet.bh_hdrlen;
 		if (packet.bh_caplen > len)
 			bytes = (ssize_t)len;
@@ -174,7 +186,6 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 		else
 			bpf->bpf_flags &= ~BPF_BCAST;
 		memcpy(data, payload, (size_t)bytes);
-	next:
 		bpf->bpf_pos += BPF_WORDALIGN(
 		    packet.bh_hdrlen + packet.bh_caplen);
 		if (bpf->bpf_pos >= bpf->bpf_len) {
@@ -186,6 +197,11 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 	}
 
 	/* NOTREACHED */
+
+err:
+	bpf->bpf_len = bpf->bpf_pos = 0;
+	bpf->bpf_flags |= BPF_EOF;
+	return -1;
 }
 
 int

src/bpf-linux.c

@@ -64,6 +64,7 @@ bpf_open(const struct interface *ifp,
 		return NULL;
 	bpf->bpf_ifp = ifp;
 	bpf->bpf_flags = BPF_EOF;
+	bpf->bpf_fd = -1;
 
 	/* Allocate a suitably large buffer for a single packet. */
 	bpf->bpf_size = ETH_FRAME_LEN;

src/bpf-pcap.c

@@ -47,7 +47,7 @@
 
 #define ETH_MTU 1500
 
-const char *bpf_name = "Berkley Packet Filter (libpcap)";
+const char *bpf_name = "Berkeley Packet Filter (libpcap)";
 
 struct bpf *
 bpf_open(const struct interface *ifp,
@@ -124,6 +124,8 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 
 	err = pcap_next_ex(bpf->bpf_handle, &pkt_header, &pkt_data);
 
+	if (err == 0)
+		return 0;
 	if (err < 0)
 		return -1;
 
@@ -133,6 +135,11 @@ bpf_read(struct bpf *bpf, void *data, size_t len)
 		cap_len = len;
 	memcpy(data, pkt_data, cap_len);
 
+	if (bpf_frame_bcast(bpf->bpf_ifp, pkt_data) == 0)
+		bpf->bpf_flags |= BPF_BCAST;
+	else
+		bpf->bpf_flags &= ~BPF_BCAST;
+
 	return (ssize_t)cap_len;
 }
 

src/bpf.c

@@ -363,9 +363,9 @@ bpf_arp_rw(const struct bpf *bpf, const struct in_addr *ia, bool recv)
 	bp++;
 
 	len = (unsigned int)(bp - buf);
-	if (recv) return bpf_setfilter(bpf, buf, len);
+	if (recv)
+		return bpf_setfilter(bpf, buf, len);
 	return bpf_setwfilter(bpf, buf, len);
-		return -1;
 }
 
 int
@@ -441,7 +441,7 @@ static const struct bpf_insn bpf_bootp_write[] = {
 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (BOOTPC << 16) + BOOTPS, 1, 0),
 	BPF_STMT(BPF_RET + BPF_K, 0),
 };
-#define BPF_BOOTP_WRITE_LEN __arraycount(bpf_bootp_write)
+#define BPF_BOOTP_WRITE_LEN  __arraycount(bpf_bootp_write)
 
 #define BPF_BOOTP_CHADDR_LEN ((BOOTP_CHADDR_LEN / 4) * 3)
 #define BPF_BOOTP_XID_LEN    4 /* BOUND check is 4 instructions */
@@ -503,7 +503,7 @@ int
 bpf_filter_bootp(const struct bpf *bpf, __unused const struct in_addr *ia)
 {
 	if (bpf_bootp_rw(bpf, true) == -1)
-	       return -1;
+		return -1;
 	if (bpf_bootp_rw(bpf, false) == -1 && errno != ENOSYS)
 		return -1;
 	if (bpf_lock(bpf) == -1 && errno != ENOSYS)