beceem: remove ARP spoofing (7441698f) · Commits · e / devices / android_kernel_teracube_emerald

drivers/staging/bcm/Arp.c

deleted100644 → 0

+0 −94

Original line number	Diff line number	Diff line

		/*
		* File Name: Arp.c
		* Abstract: This file contains the routines for handling ARP PACKETS
		*/
		#include "headers.h"
		#define ARP_PKT_SIZE 60

		/* =========================================================================
		* Function - reply_to_arp_request()
		*
		* Description - When this host tries to broadcast ARP request packet through
		* the virtual interface (veth0), reply directly to upper layer.
		* This function allocates a new skb for ARP reply packet,
		* fills in the fields of the packet and then sends it to
		* upper layer.
		*
		* Parameters - skb: Pointer to sk_buff structure of the ARP request pkt.
		*
		* Returns - None
		* =========================================================================*/

		VOID
		reply_to_arp_request(struct sk_buff *skb)
		{
		PMINI_ADAPTER Adapter;
		struct ArpHeader *pArpHdr = NULL;
		struct ethhdr *pethhdr = NULL;
		UCHAR uiIPHdr[4];
		/* Check for valid skb */
		if(skb == NULL)
		{
		BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0, "Invalid skb: Cannot reply to ARP request\n");
		return;
		}


		Adapter = GET_BCM_ADAPTER(skb->dev);
		/* Print the ARP Request Packet */
		BCM_DEBUG_PRINT(Adapter,DBG_TYPE_TX, ARP_RESP, DBG_LVL_ALL, "ARP Packet Dump :");
		BCM_DEBUG_PRINT_BUFFER(Adapter,DBG_TYPE_TX, ARP_RESP, DBG_LVL_ALL, (PUCHAR)(skb->data), skb->len);

		/*
		* Extract the Ethernet Header and Arp Payload including Header
		*/
		pethhdr = (struct ethhdr *)skb->data;
		pArpHdr = (struct ArpHeader *)(skb->data+ETH_HLEN);

		if(Adapter->bETHCSEnabled)
		{
		if(memcmp(pethhdr->h_source, Adapter->dev->dev_addr, ETH_ALEN))
		{
		dev_kfree_skb(skb);
		return;
		}
		}

		// Set the Ethernet Header First.
		memcpy(pethhdr->h_dest, pethhdr->h_source, ETH_ALEN);
		if(!memcmp(pethhdr->h_source, Adapter->dev->dev_addr, ETH_ALEN))
		{
		pethhdr->h_source[5]++;
		}

		/* Set the reply to ARP Reply */
		pArpHdr->arp.ar_op = ntohs(ARPOP_REPLY);

		/* Set the HW Address properly */
		memcpy(pArpHdr->ar_sha, pethhdr->h_source, ETH_ALEN);
		memcpy(pArpHdr->ar_tha, pethhdr->h_dest, ETH_ALEN);

		// Swapping the IP Adddress
		memcpy(uiIPHdr,pArpHdr->ar_sip,4);
		memcpy(pArpHdr->ar_sip,pArpHdr->ar_tip,4);
		memcpy(pArpHdr->ar_tip,uiIPHdr,4);

		/* Print the ARP Reply Packet */

		BCM_DEBUG_PRINT(Adapter,DBG_TYPE_TX, ARP_RESP, DBG_LVL_ALL, "ARP REPLY PACKET: ");

		/* Send the Packet to upper layer */
		BCM_DEBUG_PRINT_BUFFER(Adapter,DBG_TYPE_TX, ARP_RESP, DBG_LVL_ALL, (PUCHAR)(skb->data), skb->len);

		skb->protocol = eth_type_trans(skb,skb->dev);
		skb->pkt_type = PACKET_HOST;

		// skb->mac.raw=skb->data+LEADER_SIZE;
		skb_set_mac_header (skb, LEADER_SIZE);
		netif_rx(skb);
		BCM_DEBUG_PRINT(Adapter,DBG_TYPE_TX, ARP_RESP, DBG_LVL_ALL, "<=============\n");
		return;
		}

drivers/staging/bcm/Bcmnet.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -124,6 +124,9 @@ int register_networkdev(PMINI_ADAPTER Adapter)
		net->ethtool_ops = &bcm_ethtool_ops;
		net->mtu = MTU_SIZE; /* 1400 Bytes */
		net->tx_queue_len = TX_QLEN;
		net->flags \|= IFF_NOARP;
		net->flags &= ~(IFF_BROADCAST\|IFF_MULTICAST);

		netif_carrier_off(net);

		SET_NETDEV_DEVTYPE(net, &wimax_type);

drivers/staging/bcm/Makefile

+1 −1

Original line number	Diff line number	Diff line
		@@ -6,7 +6,7 @@ obj-$(CONFIG_BCM_WIMAX) += bcm_wimax.o

		bcm_wimax-y := InterfaceDld.o InterfaceIdleMode.o InterfaceInit.o InterfaceRx.o \
		InterfaceIsr.o InterfaceMisc.o InterfaceTx.o \
		Arp.o CmHost.o IPv6Protocol.o Qos.o Transmit.o\
		CmHost.o IPv6Protocol.o Qos.o Transmit.o\
		Bcmnet.o DDRInit.o HandleControlPacket.o\
		LeakyBucket.o Misc.o sort.o Bcmchar.o hostmibs.o PHSModule.o\
		led_control.o nvm.o vendorspecificextn.o

drivers/staging/bcm/Transmit.c

+3 −12

Original line number	Diff line number	Diff line
		@@ -6,7 +6,7 @@
		digraph transmit1 {
		node[shape=box]
		edge[weight=5;color=red]
		bcm_transmit->reply_to_arp_request[label="ARP"]

		bcm_transmit->GetPacketQueueIndex[label="IP Packet"]
		GetPacketQueueIndex->IpVersion4[label="IPV4"]
		GetPacketQueueIndex->IpVersion6[label="IPV6"]
		@@ -63,18 +63,9 @@ netdev_tx_t bcm_transmit(struct sk_buff skb, struct net_device dev)

		qindex = GetPacketQueueIndex(Adapter, skb);

		if (INVALID_QUEUE_INDEX==qindex) {
		if (ntohs(eth_hdr(skb)->h_proto) != ETH_ARP_FRAME)
		if (INVALID_QUEUE_INDEX==qindex)
		goto drop;

		/*
		Reply directly to ARP request packet
		ARP Spoofing only if NO ETH CS rule matches for it
		*/
		reply_to_arp_request(skb);
		return NETDEV_TX_OK;
		}

		if (Adapter->PackInfo[qindex].uiCurrentPacketsOnHost >= SF_MAX_ALLOWED_PACKETS_TO_BACKUP)
		return NETDEV_TX_BUSY;