]> The Tcpdump Group git mirrors - libpcap/blob - gencode.c
projects / libpcap / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Zero out IPv6 mask before using it. This fixes expressions like
[libpcap] / gencode.c
1 /*#define CHASE_CHAIN*/
2 /*
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.159 2001-11-12 21:59:44 fenner Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <sys/types.h>
32 #include <sys/socket.h>
33 #include <sys/time.h>
34 #ifdef __NetBSD__
35 #include <sys/param.h>
36 #endif
37
38 struct mbuf;
39 struct rtentry;
40 #include <net/if.h>
41
42 #include <netinet/in.h>
43
44 #include <stdlib.h>
45 #include <string.h>
46 #include <memory.h>
47 #include <setjmp.h>
48 #include <stdarg.h>
49
50 #include "pcap-int.h"
51
52 #include "ethertype.h"
53 #include "nlpid.h"
54 #include "llc.h"
55 #include "gencode.h"
56 #include "ppp.h"
57 #include "sll.h"
58 #include "arcnet.h"
59 #include <pcap-namedb.h>
60 #ifdef INET6
61 #include <netdb.h>
62 #include <sys/socket.h>
63 #endif /*INET6*/
64
65 #define ETHERMTU 1500
66
67 #ifndef IPPROTO_SCTP
68 #define IPPROTO_SCTP 132
69 #endif
70
71 #ifdef HAVE_OS_PROTO_H
72 #include "os-proto.h"
73 #endif
74
75 #define JMP(c) ((c)|BPF_JMP|BPF_K)
76
77 /* Locals */
78 static jmp_buf top_ctx;
79 static pcap_t *bpf_pcap;
80
81 /* Hack for updating VLAN offsets. */
82 static u_int orig_linktype = -1, orig_nl = -1;
83
84 /* XXX */
85 #ifdef PCAP_FDDIPAD
86 int pcap_fddipad = PCAP_FDDIPAD;
87 #else
88 int pcap_fddipad;
89 #endif
90
91 /* VARARGS */
92 void
93 bpf_error(const char *fmt, ...)
94
95 {
96 va_list ap;
97
98 va_start(ap, fmt);
99 if (bpf_pcap != NULL)
100 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE,
101 fmt, ap);
102 va_end(ap);
103 longjmp(top_ctx, 1);
104 /* NOTREACHED */
105 }
106
107 static void init_linktype(int);
108
109 static int alloc_reg(void);
110 static void free_reg(int);
111
112 static struct block *root;
113
114 /*
115 * We divy out chunks of memory rather than call malloc each time so
116 * we don't have to worry about leaking memory. It's probably
117 * not a big deal if all this memory was wasted but it this ever
118 * goes into a library that would probably not be a good idea.
119 */
120 #define NCHUNKS 16
121 #define CHUNK0SIZE 1024
122 struct chunk {
123 u_int n_left;
124 void *m;
125 };
126
127 static struct chunk chunks[NCHUNKS];
128 static int cur_chunk;
129
130 static void *newchunk(u_int);
131 static void freechunks(void);
132 static inline struct block *new_block(int);
133 static inline struct slist *new_stmt(int);
134 static struct block *gen_retblk(int);
135 static inline void syntax(void);
136
137 static void backpatch(struct block *, struct block *);
138 static void merge(struct block *, struct block *);
139 static struct block *gen_cmp(u_int, u_int, bpf_int32);
140 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
141 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
142 static struct block *gen_bcmp(u_int, u_int, const u_char *);
143 static struct block *gen_uncond(int);
144 static inline struct block *gen_true(void);
145 static inline struct block *gen_false(void);
146 static struct block *gen_linktype(int);
147 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
148 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
149 #ifdef INET6
150 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
151 #endif
152 static struct block *gen_ahostop(const u_char *, int);
153 static struct block *gen_ehostop(const u_char *, int);
154 static struct block *gen_fhostop(const u_char *, int);
155 static struct block *gen_thostop(const u_char *, int);
156 static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
157 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
158 #ifdef INET6
159 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
160 #endif
161 #ifndef INET6
162 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
163 #endif
164 static struct block *gen_ipfrag(void);
165 static struct block *gen_portatom(int, bpf_int32);
166 #ifdef INET6
167 static struct block *gen_portatom6(int, bpf_int32);
168 #endif
169 struct block *gen_portop(int, int, int);
170 static struct block *gen_port(int, int, int);
171 #ifdef INET6
172 struct block *gen_portop6(int, int, int);
173 static struct block *gen_port6(int, int, int);
174 #endif
175 static int lookup_proto(const char *, int);
176 static struct block *gen_protochain(int, int, int);
177 static struct block *gen_proto(int, int, int);
178 static struct slist *xfer_to_x(struct arth *);
179 static struct slist *xfer_to_a(struct arth *);
180 static struct block *gen_len(int, int);
181
182 static void *
183 newchunk(n)
184 u_int n;
185 {
186 struct chunk *cp;
187 int k, size;
188
189 #ifndef __NetBSD__
190 /* XXX Round up to nearest long. */
191 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1);
192 #else
193 /* XXX Round up to structure boundary. */
194 n = ALIGN(n);
195 #endif
196
197 cp = &chunks[cur_chunk];
198 if (n > cp->n_left) {
199 ++cp, k = ++cur_chunk;
200 if (k >= NCHUNKS)
201 bpf_error("out of memory");
202 size = CHUNK0SIZE << k;
203 cp->m = (void *)malloc(size);
204 memset((char *)cp->m, 0, size);
205 cp->n_left = size;
206 if (n > size)
207 bpf_error("out of memory");
208 }
209 cp->n_left -= n;
210 return (void *)((char *)cp->m + cp->n_left);
211 }
212
213 static void
214 freechunks()
215 {
216 int i;
217
218 cur_chunk = 0;
219 for (i = 0; i < NCHUNKS; ++i)
220 if (chunks[i].m != NULL) {
221 free(chunks[i].m);
222 chunks[i].m = NULL;
223 }
224 }
225
226 /*
227 * A strdup whose allocations are freed after code generation is over.
228 */
229 char *
230 sdup(s)
231 register const char *s;
232 {
233 int n = strlen(s) + 1;
234 char *cp = newchunk(n);
235
236 strlcpy(cp, s, n);
237 return (cp);
238 }
239
240 static inline struct block *
241 new_block(code)
242 int code;
243 {
244 struct block *p;
245
246 p = (struct block *)newchunk(sizeof(*p));
247 p->s.code = code;
248 p->head = p;
249
250 return p;
251 }
252
253 static inline struct slist *
254 new_stmt(code)
255 int code;
256 {
257 struct slist *p;
258
259 p = (struct slist *)newchunk(sizeof(*p));
260 p->s.code = code;
261
262 return p;
263 }
264
265 static struct block *
266 gen_retblk(v)
267 int v;
268 {
269 struct block *b = new_block(BPF_RET|BPF_K);
270
271 b->s.k = v;
272 return b;
273 }
274
275 static inline void
276 syntax()
277 {
278 bpf_error("syntax error in filter expression");
279 }
280
281 static bpf_u_int32 netmask;
282 static int snaplen;
283 int no_optimize;
284
285 int
286 pcap_compile(pcap_t *p, struct bpf_program *program,
287 char *buf, int optimize, bpf_u_int32 mask)
288 {
289 extern int n_errors;
290 int len;
291
292 no_optimize = 0;
293 n_errors = 0;
294 root = NULL;
295 bpf_pcap = p;
296 if (setjmp(top_ctx)) {
297 lex_cleanup();
298 freechunks();
299 return (-1);
300 }
301
302 netmask = mask;
303
304 snaplen = pcap_snapshot(p);
305 if (snaplen == 0) {
306 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
307 "snaplen of 0 rejects all packets");
308 return -1;
309 }
310
311 lex_init(buf ? buf : "");
312 init_linktype(pcap_datalink(p));
313 (void)pcap_parse();
314
315 if (n_errors)
316 syntax();
317
318 if (root == NULL)
319 root = gen_retblk(snaplen);
320
321 if (optimize && !no_optimize) {
322 bpf_optimize(&root);
323 if (root == NULL ||
324 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
325 bpf_error("expression rejects all packets");
326 }
327 program->bf_insns = icode_to_fcode(root, &len);
328 program->bf_len = len;
329
330 lex_cleanup();
331 freechunks();
332 return (0);
333 }
334
335 /*
336 * entry point for using the compiler with no pcap open
337 * pass in all the stuff that is needed explicitly instead.
338 */
339 int
340 pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
341 struct bpf_program *program,
342 char *buf, int optimize, bpf_u_int32 mask)
343 {
344 pcap_t *p;
345 int ret;
346
347 p = pcap_open_dead(linktype_arg, snaplen_arg);
348 if (p == NULL)
349 return (-1);
350 ret = pcap_compile(p, program, buf, optimize, mask);
351 pcap_close(p);
352 return (ret);
353 }
354
355 /*
356 * Clean up a "struct bpf_program" by freeing all the memory allocated
357 * in it.
358 */
359 void
360 pcap_freecode(struct bpf_program *program)
361 {
362 program->bf_len = 0;
363 if (program->bf_insns != NULL) {
364 free((char *)program->bf_insns);
365 program->bf_insns = NULL;
366 }
367 }
368
369 /*
370 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
371 * which of the jt and jf fields has been resolved and which is a pointer
372 * back to another unresolved block (or nil). At least one of the fields
373 * in each block is already resolved.
374 */
375 static void
376 backpatch(list, target)
377 struct block *list, *target;
378 {
379 struct block *next;
380
381 while (list) {
382 if (!list->sense) {
383 next = JT(list);
384 JT(list) = target;
385 } else {
386 next = JF(list);
387 JF(list) = target;
388 }
389 list = next;
390 }
391 }
392
393 /*
394 * Merge the lists in b0 and b1, using the 'sense' field to indicate
395 * which of jt and jf is the link.
396 */
397 static void
398 merge(b0, b1)
399 struct block *b0, *b1;
400 {
401 register struct block **p = &b0;
402
403 /* Find end of list. */
404 while (*p)
405 p = !((*p)->sense) ? &JT(*p) : &JF(*p);
406
407 /* Concatenate the lists. */
408 *p = b1;
409 }
410
411 void
412 finish_parse(p)
413 struct block *p;
414 {
415 backpatch(p, gen_retblk(snaplen));
416 p->sense = !p->sense;
417 backpatch(p, gen_retblk(0));
418 root = p->head;
419 }
420
421 void
422 gen_and(b0, b1)
423 struct block *b0, *b1;
424 {
425 backpatch(b0, b1->head);
426 b0->sense = !b0->sense;
427 b1->sense = !b1->sense;
428 merge(b1, b0);
429 b1->sense = !b1->sense;
430 b1->head = b0->head;
431 }
432
433 void
434 gen_or(b0, b1)
435 struct block *b0, *b1;
436 {
437 b0->sense = !b0->sense;
438 backpatch(b0, b1->head);
439 b0->sense = !b0->sense;
440 merge(b1, b0);
441 b1->head = b0->head;
442 }
443
444 void
445 gen_not(b)
446 struct block *b;
447 {
448 b->sense = !b->sense;
449 }
450
451 static struct block *
452 gen_cmp(offset, size, v)
453 u_int offset, size;
454 bpf_int32 v;
455 {
456 struct slist *s;
457 struct block *b;
458
459 s = new_stmt(BPF_LD|BPF_ABS|size);
460 s->s.k = offset;
461
462 b = new_block(JMP(BPF_JEQ));
463 b->stmts = s;
464 b->s.k = v;
465
466 return b;
467 }
468
469 static struct block *
470 gen_cmp_gt(offset, size, v)
471 u_int offset, size;
472 bpf_int32 v;
473 {
474 struct slist *s;
475 struct block *b;
476
477 s = new_stmt(BPF_LD|BPF_ABS|size);
478 s->s.k = offset;
479
480 b = new_block(JMP(BPF_JGT));
481 b->stmts = s;
482 b->s.k = v;
483
484 return b;
485 }
486
487 static struct block *
488 gen_mcmp(offset, size, v, mask)
489 u_int offset, size;
490 bpf_int32 v;
491 bpf_u_int32 mask;
492 {
493 struct block *b = gen_cmp(offset, size, v);
494 struct slist *s;
495
496 if (mask != 0xffffffff) {
497 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
498 s->s.k = mask;
499 b->stmts->next = s;
500 }
501 return b;
502 }
503
504 static struct block *
505 gen_bcmp(offset, size, v)
506 register u_int offset, size;
507 register const u_char *v;
508 {
509 register struct block *b, *tmp;
510
511 b = NULL;
512 while (size >= 4) {
513 register const u_char *p = &v[size - 4];
514 bpf_int32 w = ((bpf_int32)p[0] << 24) |
515 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
516
517 tmp = gen_cmp(offset + size - 4, BPF_W, w);
518 if (b != NULL)
519 gen_and(b, tmp);
520 b = tmp;
521 size -= 4;
522 }
523 while (size >= 2) {
524 register const u_char *p = &v[size - 2];
525 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
526
527 tmp = gen_cmp(offset + size - 2, BPF_H, w);
528 if (b != NULL)
529 gen_and(b, tmp);
530 b = tmp;
531 size -= 2;
532 }
533 if (size > 0) {
534 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
535 if (b != NULL)
536 gen_and(b, tmp);
537 b = tmp;
538 }
539 return b;
540 }
541
542 /*
543 * Various code constructs need to know the layout of the data link
544 * layer. These variables give the necessary offsets. off_linktype
545 * is set to -1 for no encapsulation, in which case, IP is assumed.
546 */
547 static u_int off_linktype;
548 static u_int off_nl;
549 static int linktype;
550
551 static void
552 init_linktype(type)
553 int type;
554 {
555 linktype = type;
556
557 orig_linktype = -1;
558 orig_nl = -1;
559
560 switch (type) {
561
562 case DLT_ARCNET:
563 off_linktype = 2;
564 off_nl = 6; /* XXX in reality, variable! */
565 return;
566
567 case DLT_EN10MB:
568 off_linktype = 12;
569 off_nl = 14;
570 return;
571
572 case DLT_SLIP:
573 /*
574 * SLIP doesn't have a link level type. The 16 byte
575 * header is hacked into our SLIP driver.
576 */
577 off_linktype = -1;
578 off_nl = 16;
579 return;
580
581 case DLT_SLIP_BSDOS:
582 /* XXX this may be the same as the DLT_PPP_BSDOS case */
583 off_linktype = -1;
584 /* XXX end */
585 off_nl = 24;
586 return;
587
588 case DLT_NULL:
589 case DLT_LOOP:
590 off_linktype = 0;
591 off_nl = 4;
592 return;
593
594 case DLT_PPP:
595 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */
596 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */
597 off_linktype = 2;
598 off_nl = 4;
599 return;
600
601 case DLT_PPP_ETHER:
602 /*
603 * This does no include the Ethernet header, and
604 * only covers session state.
605 */
606 off_linktype = 6;
607 off_nl = 8;
608 return;
609
610 case DLT_PPP_BSDOS:
611 off_linktype = 5;
612 off_nl = 24;
613 return;
614
615 case DLT_FDDI:
616 /*
617 * FDDI doesn't really have a link-level type field.
618 * We set "off_linktype" to the offset of the LLC header.
619 *
620 * To check for Ethernet types, we assume that SSAP = SNAP
621 * is being used and pick out the encapsulated Ethernet type.
622 * XXX - should we generate code to check for SNAP?
623 */
624 off_linktype = 13;
625 #ifdef PCAP_FDDIPAD
626 off_linktype += pcap_fddipad;
627 #endif
628 off_nl = 21;
629 #ifdef PCAP_FDDIPAD
630 off_nl += pcap_fddipad;
631 #endif
632 return;
633
634 case DLT_IEEE802:
635 /*
636 * Token Ring doesn't really have a link-level type field.
637 * We set "off_linktype" to the offset of the LLC header.
638 *
639 * To check for Ethernet types, we assume that SSAP = SNAP
640 * is being used and pick out the encapsulated Ethernet type.
641 * XXX - should we generate code to check for SNAP?
642 *
643 * XXX - the header is actually variable-length.
644 * Some various Linux patched versions gave 38
645 * as "off_linktype" and 40 as "off_nl"; however,
646 * if a token ring packet has *no* routing
647 * information, i.e. is not source-routed, the correct
648 * values are 20 and 22, as they are in the vanilla code.
649 *
650 * A packet is source-routed iff the uppermost bit
651 * of the first byte of the source address, at an
652 * offset of 8, has the uppermost bit set. If the
653 * packet is source-routed, the total number of bytes
654 * of routing information is 2 plus bits 0x1F00 of
655 * the 16-bit value at an offset of 14 (shifted right
656 * 8 - figure out which byte that is).
657 */
658 off_linktype = 14;
659 off_nl = 22;
660 return;
661
662 case DLT_IEEE802_11:
663 /*
664 * 802.11 doesn't really have a link-level type field.
665 * We set "off_linktype" to the offset of the LLC header.
666 *
667 * To check for Ethernet types, we assume that SSAP = SNAP
668 * is being used and pick out the encapsulated Ethernet type.
669 * XXX - should we generate code to check for SNAP?
670 *
671 * XXX - the header is actually variable-length. We
672 * assume a 24-byte link-layer header, as appears in
673 * data frames in networks with no bridges.
674 */
675 off_linktype = 24;
676 off_nl = 30;
677 return;
678
679 case DLT_ATM_RFC1483:
680 /*
681 * assume routed, non-ISO PDUs
682 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
683 */
684 off_linktype = 6;
685 off_nl = 8;
686 return;
687
688 case DLT_RAW:
689 off_linktype = -1;
690 off_nl = 0;
691 return;
692
693 case DLT_ATM_CLIP: /* Linux ATM defines this */
694 off_linktype = 6;
695 off_nl = 8;
696 return;
697
698 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */
699 off_linktype = 14;
700 off_nl = 16;
701 return;
702
703 case DLT_LTALK:
704 /*
705 * LocalTalk does have a 1-byte type field in the LLAP header,
706 * but really it just indicates whether there is a "short" or
707 * "long" DDP packet following.
708 */
709 off_linktype = -1;
710 off_nl = 0;
711 return;
712 }
713 bpf_error("unknown data link type %d", linktype);
714 /* NOTREACHED */
715 }
716
717 static struct block *
718 gen_uncond(rsense)
719 int rsense;
720 {
721 struct block *b;
722 struct slist *s;
723
724 s = new_stmt(BPF_LD|BPF_IMM);
725 s->s.k = !rsense;
726 b = new_block(JMP(BPF_JEQ));
727 b->stmts = s;
728
729 return b;
730 }
731
732 static inline struct block *
733 gen_true()
734 {
735 return gen_uncond(1);
736 }
737
738 static inline struct block *
739 gen_false()
740 {
741 return gen_uncond(0);
742 }
743
744 /*
745 * Byte-swap a 32-bit number.
746 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
747 * big-endian platforms.)
748 */
749 #define SWAPLONG(y) \
750 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
751
752 static struct block *
753 gen_linktype(proto)
754 register int proto;
755 {
756 struct block *b0, *b1;
757
758 switch (linktype) {
759
760 case DLT_EN10MB:
761 switch (proto) {
762
763 case LLCSAP_ISONS:
764 /*
765 * OSI protocols always use 802.2 encapsulation.
766 * XXX - should we check both the DSAP and the
767 * SSAP, like this, or should we check just the
768 * DSAP?
769 */
770 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
771 gen_not(b0);
772 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
773 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
774 gen_and(b0, b1);
775 return b1;
776
777 case LLCSAP_NETBEUI:
778 /*
779 * NetBEUI always uses 802.2 encapsulation.
780 * XXX - should we check both the DSAP and the
781 * SSAP, like this, or should we check just the
782 * DSAP?
783 */
784 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
785 gen_not(b0);
786 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
787 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
788 gen_and(b0, b1);
789 return b1;
790
791 case LLCSAP_IPX:
792 /*
793 * Check for;
794 *
795 * Ethernet_II frames, which are Ethernet
796 * frames with a frame type of ETHERTYPE_IPX;
797 *
798 * Ethernet_802.3 frames, which are 802.3
799 * frames (i.e., the type/length field is
800 * a length field, <= ETHERMTU, rather than
801 * a type field) with the first two bytes
802 * after the Ethernet/802.3 header being
803 * 0xFFFF;
804 *
805 * Ethernet_802.2 frames, which are 802.3
806 * frames with an 802.2 LLC header and
807 * with the IPX LSAP as the DSAP in the LLC
808 * header;
809 *
810 * Ethernet_SNAP frames, which are 802.3
811 * frames with an LLC header and a SNAP
812 * header and with an OUI of 0x000000
813 * (encapsulated Ethernet) and a protocol
814 * ID of ETHERTYPE_IPX in the SNAP header.
815 *
816 * XXX - should we generate the same code both
817 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
818 */
819
820 /*
821 * This generates code to check both for the
822 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
823 */
824 b0 = gen_cmp(off_linktype + 2, BPF_B,
825 (bpf_int32)LLCSAP_IPX);
826 b1 = gen_cmp(off_linktype + 2, BPF_H,
827 (bpf_int32)0xFFFF);
828 gen_or(b0, b1);
829
830 /*
831 * Now we add code to check for SNAP frames with
832 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
833 */
834 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
835 gen_or(b0, b1);
836
837 /*
838 * Now we generate code to check for 802.3
839 * frames in general.
840 */
841 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
842 gen_not(b0);
843
844 /*
845 * Now add the check for 802.3 frames before the
846 * check for Ethernet_802.2 and Ethernet_802.3,
847 * as those checks should only be done on 802.3
848 * frames, not on Ethernet frames.
849 */
850 gen_and(b0, b1);
851
852 /*
853 * Now add the check for Ethernet_II frames, and
854 * do that before checking for the other frame
855 * types.
856 */
857 b0 = gen_cmp(off_linktype, BPF_H,
858 (bpf_int32)ETHERTYPE_IPX);
859 gen_or(b0, b1);
860 return b1;
861
862 case ETHERTYPE_ATALK:
863 case ETHERTYPE_AARP:
864 /*
865 * EtherTalk (AppleTalk protocols on Ethernet link
866 * layer) may use 802.2 encapsulation.
867 */
868
869 /*
870 * Check for 802.2 encapsulation (EtherTalk phase 2?);
871 * we check for an Ethernet type field less than
872 * 1500, which means it's an 802.3 length field.
873 */
874 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
875 gen_not(b0);
876
877 /*
878 * 802.2-encapsulated ETHERTYPE_ATALK packets are
879 * SNAP packets with an organization code of
880 * 0x080007 (Apple, for Appletalk) and a protocol
881 * type of ETHERTYPE_ATALK (Appletalk).
882 *
883 * 802.2-encapsulated ETHERTYPE_AARP packets are
884 * SNAP packets with an organization code of
885 * 0x000000 (encapsulated Ethernet) and a protocol
886 * type of ETHERTYPE_AARP (Appletalk ARP).
887 */
888 if (proto == ETHERTYPE_ATALK)
889 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
890 else /* proto == ETHERTYPE_AARP */
891 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
892 gen_and(b0, b1);
893
894 /*
895 * Check for Ethernet encapsulation (Ethertalk
896 * phase 1?); we just check for the Ethernet
897 * protocol type.
898 */
899 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
900
901 gen_or(b0, b1);
902 return b1;
903
904 default:
905 if (proto <= ETHERMTU) {
906 /*
907 * This is an LLC SAP value, so the frames
908 * that match would be 802.2 frames.
909 * Check that the frame is an 802.2 frame
910 * (i.e., that the length/type field is
911 * a length field, <= ETHERMTU) and
912 * then check the DSAP.
913 */
914 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
915 gen_not(b0);
916 b1 = gen_cmp(off_linktype + 2, BPF_B,
917 (bpf_int32)proto);
918 gen_and(b0, b1);
919 return b1;
920 } else {
921 /*
922 * This is an Ethernet type, so compare
923 * the length/type field with it (if
924 * the frame is an 802.2 frame, the length
925 * field will be <= ETHERMTU, and, as
926 * "proto" is > ETHERMTU, this test
927 * will fail and the frame won't match,
928 * which is what we want).
929 */
930 return gen_cmp(off_linktype, BPF_H,
931 (bpf_int32)proto);
932 }
933 }
934 break;
935
936 case DLT_IEEE802_11:
937 case DLT_FDDI:
938 case DLT_IEEE802:
939 case DLT_ATM_RFC1483:
940 case DLT_ATM_CLIP:
941 /*
942 * XXX - handle token-ring variable-length header.
943 */
944 switch (proto) {
945
946 case LLCSAP_ISONS:
947 return gen_cmp(off_linktype, BPF_H, (long)
948 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
949
950 case LLCSAP_NETBEUI:
951 return gen_cmp(off_linktype, BPF_H, (long)
952 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
953
954 case LLCSAP_IPX:
955 /*
956 * XXX - are there ever SNAP frames for IPX on
957 * non-Ethernet 802.x networks?
958 */
959 return gen_cmp(off_linktype, BPF_B,
960 (bpf_int32)LLCSAP_IPX);
961
962 case ETHERTYPE_ATALK:
963 /*
964 * 802.2-encapsulated ETHERTYPE_ATALK packets are
965 * SNAP packets with an organization code of
966 * 0x080007 (Apple, for Appletalk) and a protocol
967 * type of ETHERTYPE_ATALK (Appletalk).
968 *
969 * XXX - check for an organization code of
970 * encapsulated Ethernet as well?
971 */
972 return gen_snap(0x080007, ETHERTYPE_ATALK,
973 off_linktype);
974 break;
975
976 default:
977 /*
978 * XXX - we don't have to check for IPX 802.3
979 * here, but should we check for the IPX Ethertype?
980 */
981 if (proto <= ETHERMTU) {
982 /*
983 * This is an LLC SAP value, so check
984 * the DSAP.
985 */
986 return gen_cmp(off_linktype, BPF_B,
987 (bpf_int32)proto);
988 } else {
989 /*
990 * This is an Ethernet type; we assume
991 * that it's unlikely that it'll
992 * appear in the right place at random,
993 * and therefore check only the
994 * location that would hold the Ethernet
995 * type in a SNAP frame with an organization
996 * code of 0x000000 (encapsulated Ethernet).
997 *
998 * XXX - if we were to check for the SNAP DSAP
999 * and LSAP, as per XXX, and were also to check
1000 * for an organization code of 0x000000
1001 * (encapsulated Ethernet), we'd do
1002 *
1003 * return gen_snap(0x000000, proto,
1004 * off_linktype);
1005 *
1006 * here; for now, we don't, as per the above.
1007 * I don't know whether it's worth the
1008 * extra CPU time to do the right check
1009 * or not.
1010 */
1011 return gen_cmp(off_linktype+6, BPF_H,
1012 (bpf_int32)proto);
1013 }
1014 }
1015 break;
1016
1017 case DLT_LINUX_SLL:
1018 switch (proto) {
1019
1020 case LLCSAP_ISONS:
1021 /*
1022 * OSI protocols always use 802.2 encapsulation.
1023 * XXX - should we check both the DSAP and the
1024 * LSAP, like this, or should we check just the
1025 * DSAP?
1026 */
1027 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1028 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
1029 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
1030 gen_and(b0, b1);
1031 return b1;
1032
1033 case LLCSAP_NETBEUI:
1034 /*
1035 * NetBEUI always uses 802.2 encapsulation.
1036 * XXX - should we check both the DSAP and the
1037 * LSAP, like this, or should we check just the
1038 * DSAP?
1039 */
1040 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1041 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
1042 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
1043 gen_and(b0, b1);
1044 return b1;
1045
1046 case LLCSAP_IPX:
1047 /*
1048 * Ethernet_II frames, which are Ethernet
1049 * frames with a frame type of ETHERTYPE_IPX;
1050 *
1051 * Ethernet_802.3 frames, which have a frame
1052 * type of LINUX_SLL_P_802_3;
1053 *
1054 * Ethernet_802.2 frames, which are 802.3
1055 * frames with an 802.2 LLC header (i.e, have
1056 * a frame type of LINUX_SLL_P_802_2) and
1057 * with the IPX LSAP as the DSAP in the LLC
1058 * header;
1059 *
1060 * Ethernet_SNAP frames, which are 802.3
1061 * frames with an LLC header and a SNAP
1062 * header and with an OUI of 0x000000
1063 * (encapsulated Ethernet) and a protocol
1064 * ID of ETHERTYPE_IPX in the SNAP header.
1065 *
1066 * First, do the checks on LINUX_SLL_P_802_2
1067 * frames; generate the check for either
1068 * Ethernet_802.2 or Ethernet_SNAP frames, and
1069 * then put a check for LINUX_SLL_P_802_2 frames
1070 * before it.
1071 */
1072 b0 = gen_cmp(off_linktype + 2, BPF_B,
1073 (bpf_int32)LLCSAP_IPX);
1074 b1 = gen_snap(0x000000, ETHERTYPE_IPX,
1075 off_linktype + 2);
1076 gen_or(b0, b1);
1077 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1078 gen_and(b0, b1);
1079
1080 /*
1081 * Now check for 802.3 frames and OR that with
1082 * the previous test.
1083 */
1084 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
1085 gen_or(b0, b1);
1086
1087 /*
1088 * Now add the check for Ethernet_II frames, and
1089 * do that before checking for the other frame
1090 * types.
1091 */
1092 b0 = gen_cmp(off_linktype, BPF_H,
1093 (bpf_int32)ETHERTYPE_IPX);
1094 gen_or(b0, b1);
1095 return b1;
1096
1097 case ETHERTYPE_ATALK:
1098 case ETHERTYPE_AARP:
1099 /*
1100 * EtherTalk (AppleTalk protocols on Ethernet link
1101 * layer) may use 802.2 encapsulation.
1102 */
1103
1104 /*
1105 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1106 * we check for the 802.2 protocol type in the
1107 * "Ethernet type" field.
1108 */
1109 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1110
1111 /*
1112 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1113 * SNAP packets with an organization code of
1114 * 0x080007 (Apple, for Appletalk) and a protocol
1115 * type of ETHERTYPE_ATALK (Appletalk).
1116 *
1117 * 802.2-encapsulated ETHERTYPE_AARP packets are
1118 * SNAP packets with an organization code of
1119 * 0x000000 (encapsulated Ethernet) and a protocol
1120 * type of ETHERTYPE_AARP (Appletalk ARP).
1121 */
1122 if (proto == ETHERTYPE_ATALK)
1123 b1 = gen_snap(0x080007, ETHERTYPE_ATALK,
1124 off_linktype + 2);
1125 else /* proto == ETHERTYPE_AARP */
1126 b1 = gen_snap(0x000000, ETHERTYPE_AARP,
1127 off_linktype + 2);
1128 gen_and(b0, b1);
1129
1130 /*
1131 * Check for Ethernet encapsulation (Ethertalk
1132 * phase 1?); we just check for the Ethernet
1133 * protocol type.
1134 */
1135 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1136
1137 gen_or(b0, b1);
1138 return b1;
1139
1140 default:
1141 if (proto <= ETHERMTU) {
1142 /*
1143 * This is an LLC SAP value, so the frames
1144 * that match would be 802.2 frames.
1145 * Check for the 802.2 protocol type
1146 * in the "Ethernet type" field, and
1147 * then check the DSAP.
1148 */
1149 b0 = gen_cmp(off_linktype, BPF_H,
1150 LINUX_SLL_P_802_2);
1151 b1 = gen_cmp(off_linktype + 2, BPF_B,
1152 (bpf_int32)proto);
1153 gen_and(b0, b1);
1154 return b1;
1155 } else {
1156 /*
1157 * This is an Ethernet type, so compare
1158 * the length/type field with it (if
1159 * the frame is an 802.2 frame, the length
1160 * field will be <= ETHERMTU, and, as
1161 * "proto" is > ETHERMTU, this test
1162 * will fail and the frame won't match,
1163 * which is what we want).
1164 */
1165 return gen_cmp(off_linktype, BPF_H,
1166 (bpf_int32)proto);
1167 }
1168 }
1169 break;
1170
1171 case DLT_SLIP:
1172 case DLT_SLIP_BSDOS:
1173 case DLT_RAW:
1174 /*
1175 * These types don't provide any type field; packets
1176 * are always IP.
1177 *
1178 * XXX - for IPv4, check for a version number of 4, and,
1179 * for IPv6, check for a version number of 6?
1180 */
1181 switch (proto) {
1182
1183 case ETHERTYPE_IP:
1184 #ifdef INET6
1185 case ETHERTYPE_IPV6:
1186 #endif
1187 return gen_true(); /* always true */
1188
1189 default:
1190 return gen_false(); /* always false */
1191 }
1192 break;
1193
1194 case DLT_PPP:
1195 case DLT_PPP_SERIAL:
1196 case DLT_PPP_ETHER:
1197 /*
1198 * We use Ethernet protocol types inside libpcap;
1199 * map them to the corresponding PPP protocol types.
1200 */
1201 switch (proto) {
1202
1203 case ETHERTYPE_IP:
1204 proto = PPP_IP; /* XXX was 0x21 */
1205 break;
1206
1207 #ifdef INET6
1208 case ETHERTYPE_IPV6:
1209 proto = PPP_IPV6;
1210 break;
1211 #endif
1212
1213 case ETHERTYPE_DN:
1214 proto = PPP_DECNET;
1215 break;
1216
1217 case ETHERTYPE_ATALK:
1218 proto = PPP_APPLE;
1219 break;
1220
1221 case ETHERTYPE_NS:
1222 proto = PPP_NS;
1223 break;
1224
1225 case LLCSAP_ISONS:
1226 proto = PPP_OSI;
1227 break;
1228
1229 case LLCSAP_8021D:
1230 /*
1231 * I'm assuming the "Bridging PDU"s that go
1232 * over PPP are Spanning Tree Protocol
1233 * Bridging PDUs.
1234 */
1235 proto = PPP_BRPDU;
1236 break;
1237
1238 case LLCSAP_IPX:
1239 proto = PPP_IPX;
1240 break;
1241 }
1242 break;
1243
1244 case DLT_PPP_BSDOS:
1245 /*
1246 * We use Ethernet protocol types inside libpcap;
1247 * map them to the corresponding PPP protocol types.
1248 */
1249 switch (proto) {
1250
1251 case ETHERTYPE_IP:
1252 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
1253 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
1254 gen_or(b0, b1);
1255 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
1256 gen_or(b1, b0);
1257 return b0;
1258
1259 #ifdef INET6
1260 case ETHERTYPE_IPV6:
1261 proto = PPP_IPV6;
1262 /* more to go? */
1263 break;
1264 #endif
1265
1266 case ETHERTYPE_DN:
1267 proto = PPP_DECNET;
1268 break;
1269
1270 case ETHERTYPE_ATALK:
1271 proto = PPP_APPLE;
1272 break;
1273
1274 case ETHERTYPE_NS:
1275 proto = PPP_NS;
1276 break;
1277
1278 case LLCSAP_ISONS:
1279 proto = PPP_OSI;
1280 break;
1281
1282 case LLCSAP_8021D:
1283 /*
1284 * I'm assuming the "Bridging PDU"s that go
1285 * over PPP are Spanning Tree Protocol
1286 * Bridging PDUs.
1287 */
1288 proto = PPP_BRPDU;
1289 break;
1290
1291 case LLCSAP_IPX:
1292 proto = PPP_IPX;
1293 break;
1294 }
1295 break;
1296
1297 case DLT_NULL:
1298 case DLT_LOOP:
1299 /*
1300 * For DLT_NULL, the link-layer header is a 32-bit
1301 * word containing an AF_ value in *host* byte order.
1302 *
1303 * In addition, if we're reading a saved capture file,
1304 * the host byte order in the capture may not be the
1305 * same as the host byte order on this machine.
1306 *
1307 * For DLT_LOOP, the link-layer header is a 32-bit
1308 * word containing an AF_ value in *network* byte order.
1309 *
1310 * XXX - AF_ values may, unfortunately, be platform-
1311 * dependent; for example, FreeBSD's AF_INET6 is 24
1312 * whilst NetBSD's and OpenBSD's is 26.
1313 *
1314 * This means that, when reading a capture file, just
1315 * checking for our AF_INET6 value won't work if the
1316 * capture file came from another OS.
1317 */
1318 switch (proto) {
1319
1320 case ETHERTYPE_IP:
1321 proto = AF_INET;
1322 break;
1323
1324 #ifdef INET6
1325 case ETHERTYPE_IPV6:
1326 proto = AF_INET6;
1327 break;
1328 #endif
1329
1330 default:
1331 /*
1332 * Not a type on which we support filtering.
1333 * XXX - support those that have AF_ values
1334 * #defined on this platform, at least?
1335 */
1336 return gen_false();
1337 }
1338
1339 if (linktype == DLT_NULL) {
1340 /*
1341 * The AF_ value is in host byte order, but
1342 * the BPF interpreter will convert it to
1343 * network byte order.
1344 *
1345 * If this is a save file, and it's from a
1346 * machine with the opposite byte order to
1347 * ours, we byte-swap the AF_ value.
1348 *
1349 * Then we run it through "htonl()", and
1350 * generate code to compare against the result.
1351 */
1352 if (bpf_pcap->sf.rfile != NULL &&
1353 bpf_pcap->sf.swapped)
1354 proto = SWAPLONG(proto);
1355 proto = htonl(proto);
1356 }
1357 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
1358
1359 case DLT_ARCNET:
1360 /*
1361 * XXX should we check for first fragment if the protocol
1362 * uses PHDS?
1363 */
1364 switch(proto) {
1365 default:
1366 return gen_false();
1367 #ifdef INET6
1368 case ETHERTYPE_IPV6:
1369 return(gen_cmp(2, BPF_B,
1370 (bpf_int32)htonl(ARCTYPE_INET6)));
1371 #endif /* INET6 */
1372 case ETHERTYPE_IP:
1373 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP));
1374 b1 = gen_cmp(2, BPF_B,
1375 (bpf_int32)htonl(ARCTYPE_IP_OLD));
1376 gen_or(b0, b1);
1377 return(b1);
1378 case ETHERTYPE_ARP:
1379 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP));
1380 b1 = gen_cmp(2, BPF_B,
1381 (bpf_int32)htonl(ARCTYPE_ARP_OLD));
1382 gen_or(b0, b1);
1383 return(b1);
1384 case ETHERTYPE_REVARP:
1385 return(gen_cmp(2, BPF_B,
1386 (bpf_int32)htonl(ARCTYPE_REVARP)));
1387 case ETHERTYPE_ATALK:
1388 return(gen_cmp(2, BPF_B,
1389 (bpf_int32)htonl(ARCTYPE_ATALK)));
1390 }
1391 break;
1392
1393 case DLT_LTALK:
1394 switch (proto) {
1395 case ETHERTYPE_ATALK:
1396 return gen_true();
1397 default:
1398 return gen_false();
1399 }
1400 break;
1401 }
1402
1403 /*
1404 * All the types that have no encapsulation should either be
1405 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
1406 * all packets are IP packets, or should be handled in some
1407 * special case, if none of them are (if some are and some
1408 * aren't, the lack of encapsulation is a problem, as we'd
1409 * have to find some other way of determining the packet type).
1410 *
1411 * Therefore, if "off_linktype" is -1, there's an error.
1412 */
1413 if (off_linktype == -1)
1414 abort();
1415
1416 /*
1417 * Any type not handled above should always have an Ethernet
1418 * type at an offset of "off_linktype". (PPP is partially
1419 * handled above - the protocol type is mapped from the
1420 * Ethernet and LLC types we use internally to the corresponding
1421 * PPP type - but the PPP type is always specified by a value
1422 * at "off_linktype", so we don't have to do the code generation
1423 * above.)
1424 */
1425 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1426 }
1427
1428 /*
1429 * Check for an LLC SNAP packet with a given organization code and
1430 * protocol type; we check the entire contents of the 802.2 LLC and
1431 * snap headers, checking for DSAP and SSAP of SNAP and a control
1432 * field of 0x03 in the LLC header, and for the specified organization
1433 * code and protocol type in the SNAP header.
1434 */
1435 static struct block *
1436 gen_snap(orgcode, ptype, offset)
1437 bpf_u_int32 orgcode;
1438 bpf_u_int32 ptype;
1439 u_int offset;
1440 {
1441 u_char snapblock[8];
1442
1443 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */
1444 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
1445 snapblock[2] = 0x03; /* control = UI */
1446 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
1447 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */
1448 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */
1449 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */
1450 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */
1451 return gen_bcmp(offset, 8, snapblock);
1452 }
1453
1454 static struct block *
1455 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
1456 bpf_u_int32 addr;
1457 bpf_u_int32 mask;
1458 int dir, proto;
1459 u_int src_off, dst_off;
1460 {
1461 struct block *b0, *b1;
1462 u_int offset;
1463
1464 switch (dir) {
1465
1466 case Q_SRC:
1467 offset = src_off;
1468 break;
1469
1470 case Q_DST:
1471 offset = dst_off;
1472 break;
1473
1474 case Q_AND:
1475 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1476 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1477 gen_and(b0, b1);
1478 return b1;
1479
1480 case Q_OR:
1481 case Q_DEFAULT:
1482 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1483 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1484 gen_or(b0, b1);
1485 return b1;
1486
1487 default:
1488 abort();
1489 }
1490 b0 = gen_linktype(proto);
1491 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
1492 gen_and(b0, b1);
1493 return b1;
1494 }
1495
1496 #ifdef INET6
1497 static struct block *
1498 gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
1499 struct in6_addr *addr;
1500 struct in6_addr *mask;
1501 int dir, proto;
1502 u_int src_off, dst_off;
1503 {
1504 struct block *b0, *b1;
1505 u_int offset;
1506 u_int32_t *a, *m;
1507
1508 switch (dir) {
1509
1510 case Q_SRC:
1511 offset = src_off;
1512 break;
1513
1514 case Q_DST:
1515 offset = dst_off;
1516 break;
1517
1518 case Q_AND:
1519 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1520 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1521 gen_and(b0, b1);
1522 return b1;
1523
1524 case Q_OR:
1525 case Q_DEFAULT:
1526 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1527 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1528 gen_or(b0, b1);
1529 return b1;
1530
1531 default:
1532 abort();
1533 }
1534 /* this order is important */
1535 a = (u_int32_t *)addr;
1536 m = (u_int32_t *)mask;
1537 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
1538 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
1539 gen_and(b0, b1);
1540 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
1541 gen_and(b0, b1);
1542 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
1543 gen_and(b0, b1);
1544 b0 = gen_linktype(proto);
1545 gen_and(b0, b1);
1546 return b1;
1547 }
1548 #endif /*INET6*/
1549
1550 static struct block *
1551 gen_ehostop(eaddr, dir)
1552 register const u_char *eaddr;
1553 register int dir;
1554 {
1555 register struct block *b0, *b1;
1556
1557 switch (dir) {
1558 case Q_SRC:
1559 return gen_bcmp(6, 6, eaddr);
1560
1561 case Q_DST:
1562 return gen_bcmp(0, 6, eaddr);
1563
1564 case Q_AND:
1565 b0 = gen_ehostop(eaddr, Q_SRC);
1566 b1 = gen_ehostop(eaddr, Q_DST);
1567 gen_and(b0, b1);
1568 return b1;
1569
1570 case Q_DEFAULT:
1571 case Q_OR:
1572 b0 = gen_ehostop(eaddr, Q_SRC);
1573 b1 = gen_ehostop(eaddr, Q_DST);
1574 gen_or(b0, b1);
1575 return b1;
1576 }
1577 abort();
1578 /* NOTREACHED */
1579 }
1580
1581 /*
1582 * Like gen_ehostop, but for DLT_FDDI
1583 */
1584 static struct block *
1585 gen_fhostop(eaddr, dir)
1586 register const u_char *eaddr;
1587 register int dir;
1588 {
1589 struct block *b0, *b1;
1590
1591 switch (dir) {
1592 case Q_SRC:
1593 #ifdef PCAP_FDDIPAD
1594 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
1595 #else
1596 return gen_bcmp(6 + 1, 6, eaddr);
1597 #endif
1598
1599 case Q_DST:
1600 #ifdef PCAP_FDDIPAD
1601 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
1602 #else
1603 return gen_bcmp(0 + 1, 6, eaddr);
1604 #endif
1605
1606 case Q_AND:
1607 b0 = gen_fhostop(eaddr, Q_SRC);
1608 b1 = gen_fhostop(eaddr, Q_DST);
1609 gen_and(b0, b1);
1610 return b1;
1611
1612 case Q_DEFAULT:
1613 case Q_OR:
1614 b0 = gen_fhostop(eaddr, Q_SRC);
1615 b1 = gen_fhostop(eaddr, Q_DST);
1616 gen_or(b0, b1);
1617 return b1;
1618 }
1619 abort();
1620 /* NOTREACHED */
1621 }
1622
1623 /*
1624 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
1625 */
1626 static struct block *
1627 gen_thostop(eaddr, dir)
1628 register const u_char *eaddr;
1629 register int dir;
1630 {
1631 register struct block *b0, *b1;
1632
1633 switch (dir) {
1634 case Q_SRC:
1635 return gen_bcmp(8, 6, eaddr);
1636
1637 case Q_DST:
1638 return gen_bcmp(2, 6, eaddr);
1639
1640 case Q_AND:
1641 b0 = gen_thostop(eaddr, Q_SRC);
1642 b1 = gen_thostop(eaddr, Q_DST);
1643 gen_and(b0, b1);
1644 return b1;
1645
1646 case Q_DEFAULT:
1647 case Q_OR:
1648 b0 = gen_thostop(eaddr, Q_SRC);
1649 b1 = gen_thostop(eaddr, Q_DST);
1650 gen_or(b0, b1);
1651 return b1;
1652 }
1653 abort();
1654 /* NOTREACHED */
1655 }
1656
1657 /*
1658 * This is quite tricky because there may be pad bytes in front of the
1659 * DECNET header, and then there are two possible data packet formats that
1660 * carry both src and dst addresses, plus 5 packet types in a format that
1661 * carries only the src node, plus 2 types that use a different format and
1662 * also carry just the src node.
1663 *
1664 * Yuck.
1665 *
1666 * Instead of doing those all right, we just look for data packets with
1667 * 0 or 1 bytes of padding. If you want to look at other packets, that
1668 * will require a lot more hacking.
1669 *
1670 * To add support for filtering on DECNET "areas" (network numbers)
1671 * one would want to add a "mask" argument to this routine. That would
1672 * make the filter even more inefficient, although one could be clever
1673 * and not generate masking instructions if the mask is 0xFFFF.
1674 */
1675 static struct block *
1676 gen_dnhostop(addr, dir, base_off)
1677 bpf_u_int32 addr;
1678 int dir;
1679 u_int base_off;
1680 {
1681 struct block *b0, *b1, *b2, *tmp;
1682 u_int offset_lh; /* offset if long header is received */
1683 u_int offset_sh; /* offset if short header is received */
1684
1685 switch (dir) {
1686
1687 case Q_DST:
1688 offset_sh = 1; /* follows flags */
1689 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */
1690 break;
1691
1692 case Q_SRC:
1693 offset_sh = 3; /* follows flags, dstnode */
1694 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
1695 break;
1696
1697 case Q_AND:
1698 /* Inefficient because we do our Calvinball dance twice */
1699 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1700 b1 = gen_dnhostop(addr, Q_DST, base_off);
1701 gen_and(b0, b1);
1702 return b1;
1703
1704 case Q_OR:
1705 case Q_DEFAULT:
1706 /* Inefficient because we do our Calvinball dance twice */
1707 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1708 b1 = gen_dnhostop(addr, Q_DST, base_off);
1709 gen_or(b0, b1);
1710 return b1;
1711
1712 case Q_ISO:
1713 bpf_error("ISO host filtering not implemented");
1714
1715 default:
1716 abort();
1717 }
1718 b0 = gen_linktype(ETHERTYPE_DN);
1719 /* Check for pad = 1, long header case */
1720 tmp = gen_mcmp(base_off + 2, BPF_H,
1721 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
1722 b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
1723 BPF_H, (bpf_int32)ntohs(addr));
1724 gen_and(tmp, b1);
1725 /* Check for pad = 0, long header case */
1726 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
1727 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
1728 gen_and(tmp, b2);
1729 gen_or(b2, b1);
1730 /* Check for pad = 1, short header case */
1731 tmp = gen_mcmp(base_off + 2, BPF_H,
1732 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
1733 b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
1734 BPF_H, (bpf_int32)ntohs(addr));
1735 gen_and(tmp, b2);
1736 gen_or(b2, b1);
1737 /* Check for pad = 0, short header case */
1738 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
1739 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
1740 gen_and(tmp, b2);
1741 gen_or(b2, b1);
1742
1743 /* Combine with test for linktype */
1744 gen_and(b0, b1);
1745 return b1;
1746 }
1747
1748 static struct block *
1749 gen_host(addr, mask, proto, dir)
1750 bpf_u_int32 addr;
1751 bpf_u_int32 mask;
1752 int proto;
1753 int dir;
1754 {
1755 struct block *b0, *b1;
1756
1757 switch (proto) {
1758
1759 case Q_DEFAULT:
1760 b0 = gen_host(addr, mask, Q_IP, dir);
1761 if (off_linktype != -1) {
1762 b1 = gen_host(addr, mask, Q_ARP, dir);
1763 gen_or(b0, b1);
1764 b0 = gen_host(addr, mask, Q_RARP, dir);
1765 gen_or(b1, b0);
1766 }
1767 return b0;
1768
1769 case Q_IP:
1770 return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
1771 off_nl + 12, off_nl + 16);
1772
1773 case Q_RARP:
1774 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
1775 off_nl + 14, off_nl + 24);
1776
1777 case Q_ARP:
1778 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
1779 off_nl + 14, off_nl + 24);
1780
1781 case Q_TCP:
1782 bpf_error("'tcp' modifier applied to host");
1783
1784 case Q_SCTP:
1785 bpf_error("'sctp' modifier applied to host");
1786
1787 case Q_UDP:
1788 bpf_error("'udp' modifier applied to host");
1789
1790 case Q_ICMP:
1791 bpf_error("'icmp' modifier applied to host");
1792
1793 case Q_IGMP:
1794 bpf_error("'igmp' modifier applied to host");
1795
1796 case Q_IGRP:
1797 bpf_error("'igrp' modifier applied to host");
1798
1799 case Q_PIM:
1800 bpf_error("'pim' modifier applied to host");
1801
1802 case Q_VRRP:
1803 bpf_error("'vrrp' modifier applied to host");
1804
1805 case Q_ATALK:
1806 bpf_error("ATALK host filtering not implemented");
1807
1808 case Q_AARP:
1809 bpf_error("AARP host filtering not implemented");
1810
1811 case Q_DECNET:
1812 return gen_dnhostop(addr, dir, off_nl);
1813
1814 case Q_SCA:
1815 bpf_error("SCA host filtering not implemented");
1816
1817 case Q_LAT:
1818 bpf_error("LAT host filtering not implemented");
1819
1820 case Q_MOPDL:
1821 bpf_error("MOPDL host filtering not implemented");
1822
1823 case Q_MOPRC:
1824 bpf_error("MOPRC host filtering not implemented");
1825
1826 #ifdef INET6
1827 case Q_IPV6:
1828 bpf_error("'ip6' modifier applied to ip host");
1829
1830 case Q_ICMPV6:
1831 bpf_error("'icmp6' modifier applied to host");
1832 #endif /* INET6 */
1833
1834 case Q_AH:
1835 bpf_error("'ah' modifier applied to host");
1836
1837 case Q_ESP:
1838 bpf_error("'esp' modifier applied to host");
1839
1840 case Q_ISO:
1841 bpf_error("ISO host filtering not implemented");
1842
1843 case Q_ESIS:
1844 bpf_error("'esis' modifier applied to host");
1845
1846 case Q_ISIS:
1847 bpf_error("'isis' modifier applied to host");
1848
1849 case Q_CLNP:
1850 bpf_error("'clnp' modifier applied to host");
1851
1852 case Q_STP:
1853 bpf_error("'stp' modifier applied to host");
1854
1855 case Q_IPX:
1856 bpf_error("IPX host filtering not implemented");
1857
1858 case Q_NETBEUI:
1859 bpf_error("'netbeui' modifier applied to host");
1860
1861 default:
1862 abort();
1863 }
1864 /* NOTREACHED */
1865 }
1866
1867 #ifdef INET6
1868 static struct block *
1869 gen_host6(addr, mask, proto, dir)
1870 struct in6_addr *addr;
1871 struct in6_addr *mask;
1872 int proto;
1873 int dir;
1874 {
1875 switch (proto) {
1876
1877 case Q_DEFAULT:
1878 return gen_host6(addr, mask, Q_IPV6, dir);
1879
1880 case Q_IP:
1881 bpf_error("'ip' modifier applied to ip6 host");
1882
1883 case Q_RARP:
1884 bpf_error("'rarp' modifier applied to ip6 host");
1885
1886 case Q_ARP:
1887 bpf_error("'arp' modifier applied to ip6 host");
1888
1889 case Q_SCTP:
1890 bpf_error("'sctp' modifier applied to host");
1891
1892 case Q_TCP:
1893 bpf_error("'tcp' modifier applied to host");
1894
1895 case Q_UDP:
1896 bpf_error("'udp' modifier applied to host");
1897
1898 case Q_ICMP:
1899 bpf_error("'icmp' modifier applied to host");
1900
1901 case Q_IGMP:
1902 bpf_error("'igmp' modifier applied to host");
1903
1904 case Q_IGRP:
1905 bpf_error("'igrp' modifier applied to host");
1906
1907 case Q_PIM:
1908 bpf_error("'pim' modifier applied to host");
1909
1910 case Q_VRRP:
1911 bpf_error("'vrrp' modifier applied to host");
1912
1913 case Q_ATALK:
1914 bpf_error("ATALK host filtering not implemented");
1915
1916 case Q_AARP:
1917 bpf_error("AARP host filtering not implemented");
1918
1919 case Q_DECNET:
1920 bpf_error("'decnet' modifier applied to ip6 host");
1921
1922 case Q_SCA:
1923 bpf_error("SCA host filtering not implemented");
1924
1925 case Q_LAT:
1926 bpf_error("LAT host filtering not implemented");
1927
1928 case Q_MOPDL:
1929 bpf_error("MOPDL host filtering not implemented");
1930
1931 case Q_MOPRC:
1932 bpf_error("MOPRC host filtering not implemented");
1933
1934 case Q_IPV6:
1935 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
1936 off_nl + 8, off_nl + 24);
1937
1938 case Q_ICMPV6:
1939 bpf_error("'icmp6' modifier applied to host");
1940
1941 case Q_AH:
1942 bpf_error("'ah' modifier applied to host");
1943
1944 case Q_ESP:
1945 bpf_error("'esp' modifier applied to host");
1946
1947 case Q_ISO:
1948 bpf_error("ISO host filtering not implemented");
1949
1950 case Q_ESIS:
1951 bpf_error("'esis' modifier applied to host");
1952
1953 case Q_ISIS:
1954 bpf_error("'isis' modifier applied to host");
1955
1956 case Q_CLNP:
1957 bpf_error("'clnp' modifier applied to host");
1958
1959 case Q_STP:
1960 bpf_error("'stp' modifier applied to host");
1961
1962 case Q_IPX:
1963 bpf_error("IPX host filtering not implemented");
1964
1965 case Q_NETBEUI:
1966 bpf_error("'netbeui' modifier applied to host");
1967
1968 default:
1969 abort();
1970 }
1971 /* NOTREACHED */
1972 }
1973 #endif /*INET6*/
1974
1975 #ifndef INET6
1976 static struct block *
1977 gen_gateway(eaddr, alist, proto, dir)
1978 const u_char *eaddr;
1979 bpf_u_int32 **alist;
1980 int proto;
1981 int dir;
1982 {
1983 struct block *b0, *b1, *tmp;
1984
1985 if (dir != 0)
1986 bpf_error("direction applied to 'gateway'");
1987
1988 switch (proto) {
1989 case Q_DEFAULT:
1990 case Q_IP:
1991 case Q_ARP:
1992 case Q_RARP:
1993 if (linktype == DLT_EN10MB)
1994 b0 = gen_ehostop(eaddr, Q_OR);
1995 else if (linktype == DLT_FDDI)
1996 b0 = gen_fhostop(eaddr, Q_OR);
1997 else if (linktype == DLT_IEEE802)
1998 b0 = gen_thostop(eaddr, Q_OR);
1999 else
2000 bpf_error(
2001 "'gateway' supported only on ethernet, FDDI or token ring");
2002
2003 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
2004 while (*alist) {
2005 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR);
2006 gen_or(b1, tmp);
2007 b1 = tmp;
2008 }
2009 gen_not(b1);
2010 gen_and(b0, b1);
2011 return b1;
2012 }
2013 bpf_error("illegal modifier of 'gateway'");
2014 /* NOTREACHED */
2015 }
2016 #endif
2017
2018 struct block *
2019 gen_proto_abbrev(proto)
2020 int proto;
2021 {
2022 #ifdef INET6
2023 struct block *b0;
2024 #endif
2025 struct block *b1;
2026
2027 switch (proto) {
2028
2029 case Q_SCTP:
2030 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT);
2031 #ifdef INET6
2032 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT);
2033 gen_or(b0, b1);
2034 #endif
2035 break;
2036
2037 case Q_TCP:
2038 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
2039 #ifdef INET6
2040 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
2041 gen_or(b0, b1);
2042 #endif
2043 break;
2044
2045 case Q_UDP:
2046 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT);
2047 #ifdef INET6
2048 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
2049 gen_or(b0, b1);
2050 #endif
2051 break;
2052
2053 case Q_ICMP:
2054 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT);
2055 break;
2056
2057 #ifndef IPPROTO_IGMP
2058 #define IPPROTO_IGMP 2
2059 #endif
2060
2061 case Q_IGMP:
2062 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT);
2063 break;
2064
2065 #ifndef IPPROTO_IGRP
2066 #define IPPROTO_IGRP 9
2067 #endif
2068 case Q_IGRP:
2069 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT);
2070 break;
2071
2072 #ifndef IPPROTO_PIM
2073 #define IPPROTO_PIM 103
2074 #endif
2075
2076 case Q_PIM:
2077 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT);
2078 #ifdef INET6
2079 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
2080 gen_or(b0, b1);
2081 #endif
2082 break;
2083
2084 #ifndef IPPROTO_VRRP
2085 #define IPPROTO_VRRP 112
2086 #endif
2087
2088 case Q_VRRP:
2089 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT);
2090 break;
2091
2092 case Q_IP:
2093 b1 = gen_linktype(ETHERTYPE_IP);
2094 break;
2095
2096 case Q_ARP:
2097 b1 = gen_linktype(ETHERTYPE_ARP);
2098 break;
2099
2100 case Q_RARP:
2101 b1 = gen_linktype(ETHERTYPE_REVARP);
2102 break;
2103
2104 case Q_LINK:
2105 bpf_error("link layer applied in wrong context");
2106
2107 case Q_ATALK:
2108 b1 = gen_linktype(ETHERTYPE_ATALK);
2109 break;
2110
2111 case Q_AARP:
2112 b1 = gen_linktype(ETHERTYPE_AARP);
2113 break;
2114
2115 case Q_DECNET:
2116 b1 = gen_linktype(ETHERTYPE_DN);
2117 break;
2118
2119 case Q_SCA:
2120 b1 = gen_linktype(ETHERTYPE_SCA);
2121 break;
2122
2123 case Q_LAT:
2124 b1 = gen_linktype(ETHERTYPE_LAT);
2125 break;
2126
2127 case Q_MOPDL:
2128 b1 = gen_linktype(ETHERTYPE_MOPDL);
2129 break;
2130
2131 case Q_MOPRC:
2132 b1 = gen_linktype(ETHERTYPE_MOPRC);
2133 break;
2134
2135 #ifdef INET6
2136 case Q_IPV6:
2137 b1 = gen_linktype(ETHERTYPE_IPV6);
2138 break;
2139
2140 #ifndef IPPROTO_ICMPV6
2141 #define IPPROTO_ICMPV6 58
2142 #endif
2143 case Q_ICMPV6:
2144 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
2145 break;
2146 #endif /* INET6 */
2147
2148 #ifndef IPPROTO_AH
2149 #define IPPROTO_AH 51
2150 #endif
2151 case Q_AH:
2152 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT);
2153 #ifdef INET6
2154 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT);
2155 gen_or(b0, b1);
2156 #endif
2157 break;
2158
2159 #ifndef IPPROTO_ESP
2160 #define IPPROTO_ESP 50
2161 #endif
2162 case Q_ESP:
2163 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT);
2164 #ifdef INET6
2165 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
2166 gen_or(b0, b1);
2167 #endif
2168 break;
2169
2170 case Q_ISO:
2171 b1 = gen_linktype(LLCSAP_ISONS);
2172 break;
2173
2174 case Q_ESIS:
2175 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT);
2176 break;
2177
2178 case Q_ISIS:
2179 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
2180 break;
2181
2182 case Q_CLNP:
2183 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT);
2184 break;
2185
2186 case Q_STP:
2187 b1 = gen_linktype(LLCSAP_8021D);
2188 break;
2189
2190 case Q_IPX:
2191 b1 = gen_linktype(LLCSAP_IPX);
2192 break;
2193
2194 case Q_NETBEUI:
2195 b1 = gen_linktype(LLCSAP_NETBEUI);
2196 break;
2197
2198 default:
2199 abort();
2200 }
2201 return b1;
2202 }
2203
2204 static struct block *
2205 gen_ipfrag()
2206 {
2207 struct slist *s;
2208 struct block *b;
2209
2210 /* not ip frag */
2211 s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
2212 s->s.k = off_nl + 6;
2213 b = new_block(JMP(BPF_JSET));
2214 b->s.k = 0x1fff;
2215 b->stmts = s;
2216 gen_not(b);
2217
2218 return b;
2219 }
2220
2221 static struct block *
2222 gen_portatom(off, v)
2223 int off;
2224 bpf_int32 v;
2225 {
2226 struct slist *s;
2227 struct block *b;
2228
2229 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2230 s->s.k = off_nl;
2231
2232 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
2233 s->next->s.k = off_nl + off;
2234
2235 b = new_block(JMP(BPF_JEQ));
2236 b->stmts = s;
2237 b->s.k = v;
2238
2239 return b;
2240 }
2241
2242 #ifdef INET6
2243 static struct block *
2244 gen_portatom6(off, v)
2245 int off;
2246 bpf_int32 v;
2247 {
2248 return gen_cmp(off_nl + 40 + off, BPF_H, v);
2249 }
2250 #endif/*INET6*/
2251
2252 struct block *
2253 gen_portop(port, proto, dir)
2254 int port, proto, dir;
2255 {
2256 struct block *b0, *b1, *tmp;
2257
2258 /* ip proto 'proto' */
2259 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
2260 b0 = gen_ipfrag();
2261 gen_and(tmp, b0);
2262
2263 switch (dir) {
2264 case Q_SRC:
2265 b1 = gen_portatom(0, (bpf_int32)port);
2266 break;
2267
2268 case Q_DST:
2269 b1 = gen_portatom(2, (bpf_int32)port);
2270 break;
2271
2272 case Q_OR:
2273 case Q_DEFAULT:
2274 tmp = gen_portatom(0, (bpf_int32)port);
2275 b1 = gen_portatom(2, (bpf_int32)port);
2276 gen_or(tmp, b1);
2277 break;
2278
2279 case Q_AND:
2280 tmp = gen_portatom(0, (bpf_int32)port);
2281 b1 = gen_portatom(2, (bpf_int32)port);
2282 gen_and(tmp, b1);
2283 break;
2284
2285 default:
2286 abort();
2287 }
2288 gen_and(b0, b1);
2289
2290 return b1;
2291 }
2292
2293 static struct block *
2294 gen_port(port, ip_proto, dir)
2295 int port;
2296 int ip_proto;
2297 int dir;
2298 {
2299 struct block *b0, *b1, *tmp;
2300
2301 /* ether proto ip */
2302 b0 = gen_linktype(ETHERTYPE_IP);
2303
2304 switch (ip_proto) {
2305 case IPPROTO_UDP:
2306 case IPPROTO_TCP:
2307 case IPPROTO_SCTP:
2308 b1 = gen_portop(port, ip_proto, dir);
2309 break;
2310
2311 case PROTO_UNDEF:
2312 tmp = gen_portop(port, IPPROTO_TCP, dir);
2313 b1 = gen_portop(port, IPPROTO_UDP, dir);
2314 gen_or(tmp, b1);
2315 tmp = gen_portop(port, IPPROTO_SCTP, dir);
2316 gen_or(tmp, b1);
2317 break;
2318
2319 default:
2320 abort();
2321 }
2322 gen_and(b0, b1);
2323 return b1;
2324 }
2325
2326 #ifdef INET6
2327 struct block *
2328 gen_portop6(port, proto, dir)
2329 int port, proto, dir;
2330 {
2331 struct block *b0, *b1, *tmp;
2332
2333 /* ip proto 'proto' */
2334 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
2335
2336 switch (dir) {
2337 case Q_SRC:
2338 b1 = gen_portatom6(0, (bpf_int32)port);
2339 break;
2340
2341 case Q_DST:
2342 b1 = gen_portatom6(2, (bpf_int32)port);
2343 break;
2344
2345 case Q_OR:
2346 case Q_DEFAULT:
2347 tmp = gen_portatom6(0, (bpf_int32)port);
2348 b1 = gen_portatom6(2, (bpf_int32)port);
2349 gen_or(tmp, b1);
2350 break;
2351
2352 case Q_AND:
2353 tmp = gen_portatom6(0, (bpf_int32)port);
2354 b1 = gen_portatom6(2, (bpf_int32)port);
2355 gen_and(tmp, b1);
2356 break;
2357
2358 default:
2359 abort();
2360 }
2361 gen_and(b0, b1);
2362
2363 return b1;
2364 }
2365
2366 static struct block *
2367 gen_port6(port, ip_proto, dir)
2368 int port;
2369 int ip_proto;
2370 int dir;
2371 {
2372 struct block *b0, *b1, *tmp;
2373
2374 /* ether proto ip */
2375 b0 = gen_linktype(ETHERTYPE_IPV6);
2376
2377 switch (ip_proto) {
2378 case IPPROTO_UDP:
2379 case IPPROTO_TCP:
2380 case IPPROTO_SCTP:
2381 b1 = gen_portop6(port, ip_proto, dir);
2382 break;
2383
2384 case PROTO_UNDEF:
2385 tmp = gen_portop6(port, IPPROTO_TCP, dir);
2386 b1 = gen_portop6(port, IPPROTO_UDP, dir);
2387 gen_or(tmp, b1);
2388 tmp = gen_portop6(port, IPPROTO_SCTP, dir);
2389 gen_or(tmp, b1);
2390 break;
2391
2392 default:
2393 abort();
2394 }
2395 gen_and(b0, b1);
2396 return b1;
2397 }
2398 #endif /* INET6 */
2399
2400 static int
2401 lookup_proto(name, proto)
2402 register const char *name;
2403 register int proto;
2404 {
2405 register int v;
2406
2407 switch (proto) {
2408
2409 case Q_DEFAULT:
2410 case Q_IP:
2411 case Q_IPV6:
2412 v = pcap_nametoproto(name);
2413 if (v == PROTO_UNDEF)
2414 bpf_error("unknown ip proto '%s'", name);
2415 break;
2416
2417 case Q_LINK:
2418 /* XXX should look up h/w protocol type based on linktype */
2419 v = pcap_nametoeproto(name);
2420 if (v == PROTO_UNDEF)
2421 bpf_error("unknown ether proto '%s'", name);
2422 break;
2423
2424 case Q_ISO:
2425 if (strcmp(name, "esis") == 0)
2426 v = ISO9542_ESIS;
2427 else if (strcmp(name, "isis") == 0)
2428 v = ISO10589_ISIS;
2429 else if (strcmp(name, "clnp") == 0)
2430 v = ISO8473_CLNP;
2431 else
2432 bpf_error("unknown osi proto '%s'", name);
2433 break;
2434
2435 default:
2436 v = PROTO_UNDEF;
2437 break;
2438 }
2439 return v;
2440 }
2441
2442 #if 0
2443 struct stmt *
2444 gen_joinsp(s, n)
2445 struct stmt **s;
2446 int n;
2447 {
2448 return NULL;
2449 }
2450 #endif
2451
2452 static struct block *
2453 gen_protochain(v, proto, dir)
2454 int v;
2455 int proto;
2456 int dir;
2457 {
2458 #ifdef NO_PROTOCHAIN
2459 return gen_proto(v, proto, dir);
2460 #else
2461 struct block *b0, *b;
2462 struct slist *s[100];
2463 int fix2, fix3, fix4, fix5;
2464 int ahcheck, again, end;
2465 int i, max;
2466 int reg2 = alloc_reg();
2467
2468 memset(s, 0, sizeof(s));
2469 fix2 = fix3 = fix4 = fix5 = 0;
2470
2471 switch (proto) {
2472 case Q_IP:
2473 case Q_IPV6:
2474 break;
2475 case Q_DEFAULT:
2476 b0 = gen_protochain(v, Q_IP, dir);
2477 b = gen_protochain(v, Q_IPV6, dir);
2478 gen_or(b0, b);
2479 return b;
2480 default:
2481 bpf_error("bad protocol applied for 'protochain'");
2482 /*NOTREACHED*/
2483 }
2484
2485 no_optimize = 1; /*this code is not compatible with optimzer yet */
2486
2487 /*
2488 * s[0] is a dummy entry to protect other BPF insn from damaged
2489 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
2490 * hard to find interdependency made by jump table fixup.
2491 */
2492 i = 0;
2493 s[i] = new_stmt(0); /*dummy*/
2494 i++;
2495
2496 switch (proto) {
2497 case Q_IP:
2498 b0 = gen_linktype(ETHERTYPE_IP);
2499
2500 /* A = ip->ip_p */
2501 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2502 s[i]->s.k = off_nl + 9;
2503 i++;
2504 /* X = ip->ip_hl << 2 */
2505 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2506 s[i]->s.k = off_nl;
2507 i++;
2508 break;
2509 #ifdef INET6
2510 case Q_IPV6:
2511 b0 = gen_linktype(ETHERTYPE_IPV6);
2512
2513 /* A = ip6->ip_nxt */
2514 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2515 s[i]->s.k = off_nl + 6;
2516 i++;
2517 /* X = sizeof(struct ip6_hdr) */
2518 s[i] = new_stmt(BPF_LDX|BPF_IMM);
2519 s[i]->s.k = 40;
2520 i++;
2521 break;
2522 #endif
2523 default:
2524 bpf_error("unsupported proto to gen_protochain");
2525 /*NOTREACHED*/
2526 }
2527
2528 /* again: if (A == v) goto end; else fall through; */
2529 again = i;
2530 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2531 s[i]->s.k = v;
2532 s[i]->s.jt = NULL; /*later*/
2533 s[i]->s.jf = NULL; /*update in next stmt*/
2534 fix5 = i;
2535 i++;
2536
2537 #ifndef IPPROTO_NONE
2538 #define IPPROTO_NONE 59
2539 #endif
2540 /* if (A == IPPROTO_NONE) goto end */
2541 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2542 s[i]->s.jt = NULL; /*later*/
2543 s[i]->s.jf = NULL; /*update in next stmt*/
2544 s[i]->s.k = IPPROTO_NONE;
2545 s[fix5]->s.jf = s[i];
2546 fix2 = i;
2547 i++;
2548
2549 #ifdef INET6
2550 if (proto == Q_IPV6) {
2551 int v6start, v6end, v6advance, j;
2552
2553 v6start = i;
2554 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
2555 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2556 s[i]->s.jt = NULL; /*later*/
2557 s[i]->s.jf = NULL; /*update in next stmt*/
2558 s[i]->s.k = IPPROTO_HOPOPTS;
2559 s[fix2]->s.jf = s[i];
2560 i++;
2561 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
2562 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2563 s[i]->s.jt = NULL; /*later*/
2564 s[i]->s.jf = NULL; /*update in next stmt*/
2565 s[i]->s.k = IPPROTO_DSTOPTS;
2566 i++;
2567 /* if (A == IPPROTO_ROUTING) goto v6advance */
2568 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2569 s[i]->s.jt = NULL; /*later*/
2570 s[i]->s.jf = NULL; /*update in next stmt*/
2571 s[i]->s.k = IPPROTO_ROUTING;
2572 i++;
2573 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
2574 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2575 s[i]->s.jt = NULL; /*later*/
2576 s[i]->s.jf = NULL; /*later*/
2577 s[i]->s.k = IPPROTO_FRAGMENT;
2578 fix3 = i;
2579 v6end = i;
2580 i++;
2581
2582 /* v6advance: */
2583 v6advance = i;
2584
2585 /*
2586 * in short,
2587 * A = P[X];
2588 * X = X + (P[X + 1] + 1) * 8;
2589 */
2590 /* A = X */
2591 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2592 i++;
2593 /* A = P[X + packet head] */
2594 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2595 s[i]->s.k = off_nl;
2596 i++;
2597 /* MEM[reg2] = A */
2598 s[i] = new_stmt(BPF_ST);
2599 s[i]->s.k = reg2;
2600 i++;
2601 /* A = X */
2602 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2603 i++;
2604 /* A += 1 */
2605 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2606 s[i]->s.k = 1;
2607 i++;
2608 /* X = A */
2609 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2610 i++;
2611 /* A = P[X + packet head]; */
2612 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2613 s[i]->s.k = off_nl;
2614 i++;
2615 /* A += 1 */
2616 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2617 s[i]->s.k = 1;
2618 i++;
2619 /* A *= 8 */
2620 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2621 s[i]->s.k = 8;
2622 i++;
2623 /* X = A; */
2624 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2625 i++;
2626 /* A = MEM[reg2] */
2627 s[i] = new_stmt(BPF_LD|BPF_MEM);
2628 s[i]->s.k = reg2;
2629 i++;
2630
2631 /* goto again; (must use BPF_JA for backward jump) */
2632 s[i] = new_stmt(BPF_JMP|BPF_JA);
2633 s[i]->s.k = again - i - 1;
2634 s[i - 1]->s.jf = s[i];
2635 i++;
2636
2637 /* fixup */
2638 for (j = v6start; j <= v6end; j++)
2639 s[j]->s.jt = s[v6advance];
2640 } else
2641 #endif
2642 {
2643 /* nop */
2644 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2645 s[i]->s.k = 0;
2646 s[fix2]->s.jf = s[i];
2647 i++;
2648 }
2649
2650 /* ahcheck: */
2651 ahcheck = i;
2652 /* if (A == IPPROTO_AH) then fall through; else goto end; */
2653 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2654 s[i]->s.jt = NULL; /*later*/
2655 s[i]->s.jf = NULL; /*later*/
2656 s[i]->s.k = IPPROTO_AH;
2657 if (fix3)
2658 s[fix3]->s.jf = s[ahcheck];
2659 fix4 = i;
2660 i++;
2661
2662 /*
2663 * in short,
2664 * A = P[X];
2665 * X = X + (P[X + 1] + 2) * 4;
2666 */
2667 /* A = X */
2668 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2669 i++;
2670 /* A = P[X + packet head]; */
2671 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2672 s[i]->s.k = off_nl;
2673 i++;
2674 /* MEM[reg2] = A */
2675 s[i] = new_stmt(BPF_ST);
2676 s[i]->s.k = reg2;
2677 i++;
2678 /* A = X */
2679 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2680 i++;
2681 /* A += 1 */
2682 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2683 s[i]->s.k = 1;
2684 i++;
2685 /* X = A */
2686 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2687 i++;
2688 /* A = P[X + packet head] */
2689 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2690 s[i]->s.k = off_nl;
2691 i++;
2692 /* A += 2 */
2693 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2694 s[i]->s.k = 2;
2695 i++;
2696 /* A *= 4 */
2697 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2698 s[i]->s.k = 4;
2699 i++;
2700 /* X = A; */
2701 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2702 i++;
2703 /* A = MEM[reg2] */
2704 s[i] = new_stmt(BPF_LD|BPF_MEM);
2705 s[i]->s.k = reg2;
2706 i++;
2707
2708 /* goto again; (must use BPF_JA for backward jump) */
2709 s[i] = new_stmt(BPF_JMP|BPF_JA);
2710 s[i]->s.k = again - i - 1;
2711 i++;
2712
2713 /* end: nop */
2714 end = i;
2715 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2716 s[i]->s.k = 0;
2717 s[fix2]->s.jt = s[end];
2718 s[fix4]->s.jf = s[end];
2719 s[fix5]->s.jt = s[end];
2720 i++;
2721
2722 /*
2723 * make slist chain
2724 */
2725 max = i;
2726 for (i = 0; i < max - 1; i++)
2727 s[i]->next = s[i + 1];
2728 s[max - 1]->next = NULL;
2729
2730 /*
2731 * emit final check
2732 */
2733 b = new_block(JMP(BPF_JEQ));
2734 b->stmts = s[1]; /*remember, s[0] is dummy*/
2735 b->s.k = v;
2736
2737 free_reg(reg2);
2738
2739 gen_and(b0, b);
2740 return b;
2741 #endif
2742 }
2743
2744 static struct block *
2745 gen_proto(v, proto, dir)
2746 int v;
2747 int proto;
2748 int dir;
2749 {
2750 struct block *b0, *b1;
2751
2752 if (dir != Q_DEFAULT)
2753 bpf_error("direction applied to 'proto'");
2754
2755 switch (proto) {
2756 case Q_DEFAULT:
2757 #ifdef INET6
2758 b0 = gen_proto(v, Q_IP, dir);
2759 b1 = gen_proto(v, Q_IPV6, dir);
2760 gen_or(b0, b1);
2761 return b1;
2762 #else
2763 /*FALLTHROUGH*/
2764 #endif
2765 case Q_IP:
2766 b0 = gen_linktype(ETHERTYPE_IP);
2767 #ifndef CHASE_CHAIN
2768 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
2769 #else
2770 b1 = gen_protochain(v, Q_IP);
2771 #endif
2772 gen_and(b0, b1);
2773 return b1;
2774
2775 case Q_ISO:
2776 b0 = gen_linktype(LLCSAP_ISONS);
2777 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v);
2778 gen_and(b0, b1);
2779 return b1;
2780
2781 case Q_ARP:
2782 bpf_error("arp does not encapsulate another protocol");
2783 /* NOTREACHED */
2784
2785 case Q_RARP:
2786 bpf_error("rarp does not encapsulate another protocol");
2787 /* NOTREACHED */
2788
2789 case Q_ATALK:
2790 bpf_error("atalk encapsulation is not specifiable");
2791 /* NOTREACHED */
2792
2793 case Q_DECNET:
2794 bpf_error("decnet encapsulation is not specifiable");
2795 /* NOTREACHED */
2796
2797 case Q_SCA:
2798 bpf_error("sca does not encapsulate another protocol");
2799 /* NOTREACHED */
2800
2801 case Q_LAT:
2802 bpf_error("lat does not encapsulate another protocol");
2803 /* NOTREACHED */
2804
2805 case Q_MOPRC:
2806 bpf_error("moprc does not encapsulate another protocol");
2807 /* NOTREACHED */
2808
2809 case Q_MOPDL:
2810 bpf_error("mopdl does not encapsulate another protocol");
2811 /* NOTREACHED */
2812
2813 case Q_LINK:
2814 return gen_linktype(v);
2815
2816 case Q_UDP:
2817 bpf_error("'udp proto' is bogus");
2818 /* NOTREACHED */
2819
2820 case Q_TCP:
2821 bpf_error("'tcp proto' is bogus");
2822 /* NOTREACHED */
2823
2824 case Q_SCTP:
2825 bpf_error("'sctp proto' is bogus");
2826 /* NOTREACHED */
2827
2828 case Q_ICMP:
2829 bpf_error("'icmp proto' is bogus");
2830 /* NOTREACHED */
2831
2832 case Q_IGMP:
2833 bpf_error("'igmp proto' is bogus");
2834 /* NOTREACHED */
2835
2836 case Q_IGRP:
2837 bpf_error("'igrp proto' is bogus");
2838 /* NOTREACHED */
2839
2840 case Q_PIM:
2841 bpf_error("'pim proto' is bogus");
2842 /* NOTREACHED */
2843
2844 case Q_VRRP:
2845 bpf_error("'vrrp proto' is bogus");
2846 /* NOTREACHED */
2847
2848 #ifdef INET6
2849 case Q_IPV6:
2850 b0 = gen_linktype(ETHERTYPE_IPV6);
2851 #ifndef CHASE_CHAIN
2852 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
2853 #else
2854 b1 = gen_protochain(v, Q_IPV6);
2855 #endif
2856 gen_and(b0, b1);
2857 return b1;
2858
2859 case Q_ICMPV6:
2860 bpf_error("'icmp6 proto' is bogus");
2861 #endif /* INET6 */
2862
2863 case Q_AH:
2864 bpf_error("'ah proto' is bogus");
2865
2866 case Q_ESP:
2867 bpf_error("'ah proto' is bogus");
2868
2869 case Q_STP:
2870 bpf_error("'stp proto' is bogus");
2871
2872 case Q_IPX:
2873 bpf_error("'ipx proto' is bogus");
2874
2875 case Q_NETBEUI:
2876 bpf_error("'netbeui proto' is bogus");
2877
2878 default:
2879 abort();
2880 /* NOTREACHED */
2881 }
2882 /* NOTREACHED */
2883 }
2884
2885 struct block *
2886 gen_scode(name, q)
2887 register const char *name;
2888 struct qual q;
2889 {
2890 int proto = q.proto;
2891 int dir = q.dir;
2892 int tproto;
2893 u_char *eaddr;
2894 bpf_u_int32 mask, addr;
2895 #ifndef INET6
2896 bpf_u_int32 **alist;
2897 #else
2898 int tproto6;
2899 struct sockaddr_in *sin;
2900 struct sockaddr_in6 *sin6;
2901 struct addrinfo *res, *res0;
2902 struct in6_addr mask128;
2903 #endif /*INET6*/
2904 struct block *b, *tmp;
2905 int port, real_proto;
2906
2907 switch (q.addr) {
2908
2909 case Q_NET:
2910 addr = pcap_nametonetaddr(name);
2911 if (addr == 0)
2912 bpf_error("unknown network '%s'", name);
2913 /* Left justify network addr and calculate its network mask */
2914 mask = 0xffffffff;
2915 while (addr && (addr & 0xff000000) == 0) {
2916 addr <<= 8;
2917 mask <<= 8;
2918 }
2919 return gen_host(addr, mask, proto, dir);
2920
2921 case Q_DEFAULT:
2922 case Q_HOST:
2923 if (proto == Q_LINK) {
2924 switch (linktype) {
2925
2926 case DLT_EN10MB:
2927 eaddr = pcap_ether_hostton(name);
2928 if (eaddr == NULL)
2929 bpf_error(
2930 "unknown ether host '%s'", name);
2931 b = gen_ehostop(eaddr, dir);
2932 free(eaddr);
2933 return b;
2934
2935 case DLT_FDDI:
2936 eaddr = pcap_ether_hostton(name);
2937 if (eaddr == NULL)
2938 bpf_error(
2939 "unknown FDDI host '%s'", name);
2940 b = gen_fhostop(eaddr, dir);
2941 free(eaddr);
2942 return b;
2943
2944 case DLT_IEEE802:
2945 eaddr = pcap_ether_hostton(name);
2946 if (eaddr == NULL)
2947 bpf_error(
2948 "unknown token ring host '%s'", name);
2949 b = gen_thostop(eaddr, dir);
2950 free(eaddr);
2951 return b;
2952
2953 default:
2954 bpf_error(
2955 "only ethernet/FDDI/token ring supports link-level host name");
2956 break;
2957 }
2958 } else if (proto == Q_DECNET) {
2959 unsigned short dn_addr = __pcap_nametodnaddr(name);
2960 /*
2961 * I don't think DECNET hosts can be multihomed, so
2962 * there is no need to build up a list of addresses
2963 */
2964 return (gen_host(dn_addr, 0, proto, dir));
2965 } else {
2966 #ifndef INET6
2967 alist = pcap_nametoaddr(name);
2968 if (alist == NULL || *alist == NULL)
2969 bpf_error("unknown host '%s'", name);
2970 tproto = proto;
2971 if (off_linktype == -1 && tproto == Q_DEFAULT)
2972 tproto = Q_IP;
2973 b = gen_host(**alist++, 0xffffffff, tproto, dir);
2974 while (*alist) {
2975 tmp = gen_host(**alist++, 0xffffffff,
2976 tproto, dir);
2977 gen_or(b, tmp);
2978 b = tmp;
2979 }
2980 return b;
2981 #else
2982 memset(&mask128, 0xff, sizeof(mask128));
2983 res0 = res = pcap_nametoaddrinfo(name);
2984 if (res == NULL)
2985 bpf_error("unknown host '%s'", name);
2986 b = tmp = NULL;
2987 tproto = tproto6 = proto;
2988 if (off_linktype == -1 && tproto == Q_DEFAULT) {
2989 tproto = Q_IP;
2990 tproto6 = Q_IPV6;
2991 }
2992 for (res = res0; res; res = res->ai_next) {
2993 switch (res->ai_family) {
2994 case AF_INET:
2995 if (tproto == Q_IPV6)
2996 continue;
2997
2998 sin = (struct sockaddr_in *)
2999 res->ai_addr;
3000 tmp = gen_host(ntohl(sin->sin_addr.s_addr),
3001 0xffffffff, tproto, dir);
3002 break;
3003 case AF_INET6:
3004 if (tproto6 == Q_IP)
3005 continue;
3006
3007 sin6 = (struct sockaddr_in6 *)
3008 res->ai_addr;
3009 tmp = gen_host6(&sin6->sin6_addr,
3010 &mask128, tproto6, dir);
3011 break;
3012 default:
3013 continue;
3014 }
3015 if (b)
3016 gen_or(b, tmp);
3017 b = tmp;
3018 }
3019 freeaddrinfo(res0);
3020 if (b == NULL) {
3021 bpf_error("unknown host '%s'%s", name,
3022 (proto == Q_DEFAULT)
3023 ? ""
3024 : " for specified address family");
3025 }
3026 return b;
3027 #endif /*INET6*/
3028 }
3029
3030 case Q_PORT:
3031 if (proto != Q_DEFAULT &&
3032 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
3033 bpf_error("illegal qualifier of 'port'");
3034 if (pcap_nametoport(name, &port, &real_proto) == 0)
3035 bpf_error("unknown port '%s'", name);
3036 if (proto == Q_UDP) {
3037 if (real_proto == IPPROTO_TCP)
3038 bpf_error("port '%s' is tcp", name);
3039 else if (real_proto == IPPROTO_SCTP)
3040 bpf_error("port '%s' is sctp", name);
3041 else
3042 /* override PROTO_UNDEF */
3043 real_proto = IPPROTO_UDP;
3044 }
3045 if (proto == Q_TCP) {
3046 if (real_proto == IPPROTO_UDP)
3047 bpf_error("port '%s' is udp", name);
3048
3049 else if (real_proto == IPPROTO_SCTP)
3050 bpf_error("port '%s' is sctp", name);
3051 else
3052 /* override PROTO_UNDEF */
3053 real_proto = IPPROTO_TCP;
3054 }
3055 if (proto == Q_SCTP) {
3056 if (real_proto == IPPROTO_UDP)
3057 bpf_error("port '%s' is udp", name);
3058
3059 else if (real_proto == IPPROTO_TCP)
3060 bpf_error("port '%s' is tcp", name);
3061 else
3062 /* override PROTO_UNDEF */
3063 real_proto = IPPROTO_SCTP;
3064 }
3065 #ifndef INET6
3066 return gen_port(port, real_proto, dir);
3067 #else
3068 {
3069 struct block *b;
3070 b = gen_port(port, real_proto, dir);
3071 gen_or(gen_port6(port, real_proto, dir), b);
3072 return b;
3073 }
3074 #endif /* INET6 */
3075
3076 case Q_GATEWAY:
3077 #ifndef INET6
3078 eaddr = pcap_ether_hostton(name);
3079 if (eaddr == NULL)
3080 bpf_error("unknown ether host: %s", name);
3081
3082 alist = pcap_nametoaddr(name);
3083 if (alist == NULL || *alist == NULL)
3084 bpf_error("unknown host '%s'", name);
3085 b = gen_gateway(eaddr, alist, proto, dir);
3086 free(eaddr);
3087 return b;
3088 #else
3089 bpf_error("'gateway' not supported in this configuration");
3090 #endif /*INET6*/
3091
3092 case Q_PROTO:
3093 real_proto = lookup_proto(name, proto);
3094 if (real_proto >= 0)
3095 return gen_proto(real_proto, proto, dir);
3096 else
3097 bpf_error("unknown protocol: %s", name);
3098
3099 case Q_PROTOCHAIN:
3100 real_proto = lookup_proto(name, proto);
3101 if (real_proto >= 0)
3102 return gen_protochain(real_proto, proto, dir);
3103 else
3104 bpf_error("unknown protocol: %s", name);
3105
3106
3107 case Q_UNDEF:
3108 syntax();
3109 /* NOTREACHED */
3110 }
3111 abort();
3112 /* NOTREACHED */
3113 }
3114
3115 struct block *
3116 gen_mcode(s1, s2, masklen, q)
3117 register const char *s1, *s2;
3118 register int masklen;
3119 struct qual q;
3120 {
3121 register int nlen, mlen;
3122 bpf_u_int32 n, m;
3123
3124 nlen = __pcap_atoin(s1, &n);
3125 /* Promote short ipaddr */
3126 n <<= 32 - nlen;
3127
3128 if (s2 != NULL) {
3129 mlen = __pcap_atoin(s2, &m);
3130 /* Promote short ipaddr */
3131 m <<= 32 - mlen;
3132 if ((n & ~m) != 0)
3133 bpf_error("non-network bits set in \"%s mask %s\"",
3134 s1, s2);
3135 } else {
3136 /* Convert mask len to mask */
3137 if (masklen > 32)
3138 bpf_error("mask length must be <= 32");
3139 m = 0xffffffff << (32 - masklen);
3140 if ((n & ~m) != 0)
3141 bpf_error("non-network bits set in \"%s/%d\"",
3142 s1, masklen);
3143 }
3144
3145 switch (q.addr) {
3146
3147 case Q_NET:
3148 return gen_host(n, m, q.proto, q.dir);
3149
3150 default:
3151 bpf_error("Mask syntax for networks only");
3152 /* NOTREACHED */
3153 }
3154 }
3155
3156 struct block *
3157 gen_ncode(s, v, q)
3158 register const char *s;
3159 bpf_u_int32 v;
3160 struct qual q;
3161 {
3162 bpf_u_int32 mask;
3163 int proto = q.proto;
3164 int dir = q.dir;
3165 register int vlen;
3166
3167 if (s == NULL)
3168 vlen = 32;
3169 else if (q.proto == Q_DECNET)
3170 vlen = __pcap_atodn(s, &v);
3171 else
3172 vlen = __pcap_atoin(s, &v);
3173
3174 switch (q.addr) {
3175
3176 case Q_DEFAULT:
3177 case Q_HOST:
3178 case Q_NET:
3179 if (proto == Q_DECNET)
3180 return gen_host(v, 0, proto, dir);
3181 else if (proto == Q_LINK) {
3182 bpf_error("illegal link layer address");
3183 } else {
3184 mask = 0xffffffff;
3185 if (s == NULL && q.addr == Q_NET) {
3186 /* Promote short net number */
3187 while (v && (v & 0xff000000) == 0) {
3188 v <<= 8;
3189 mask <<= 8;
3190 }
3191 } else {
3192 /* Promote short ipaddr */
3193 v <<= 32 - vlen;
3194 mask <<= 32 - vlen;
3195 }
3196 return gen_host(v, mask, proto, dir);
3197 }
3198
3199 case Q_PORT:
3200 if (proto == Q_UDP)
3201 proto = IPPROTO_UDP;
3202 else if (proto == Q_TCP)
3203 proto = IPPROTO_TCP;
3204 else if (proto == Q_SCTP)
3205 proto = IPPROTO_SCTP;
3206 else if (proto == Q_DEFAULT)
3207 proto = PROTO_UNDEF;
3208 else
3209 bpf_error("illegal qualifier of 'port'");
3210
3211 #ifndef INET6
3212 return gen_port((int)v, proto, dir);
3213 #else
3214 {
3215 struct block *b;
3216 b = gen_port((int)v, proto, dir);
3217 gen_or(gen_port6((int)v, proto, dir), b);
3218 return b;
3219 }
3220 #endif /* INET6 */
3221
3222 case Q_GATEWAY:
3223 bpf_error("'gateway' requires a name");
3224 /* NOTREACHED */
3225
3226 case Q_PROTO:
3227 return gen_proto((int)v, proto, dir);
3228
3229 case Q_PROTOCHAIN:
3230 return gen_protochain((int)v, proto, dir);
3231
3232 case Q_UNDEF:
3233 syntax();
3234 /* NOTREACHED */
3235
3236 default:
3237 abort();
3238 /* NOTREACHED */
3239 }
3240 /* NOTREACHED */
3241 }
3242
3243 #ifdef INET6
3244 struct block *
3245 gen_mcode6(s1, s2, masklen, q)
3246 register const char *s1, *s2;
3247 register int masklen;
3248 struct qual q;
3249 {
3250 struct addrinfo *res;
3251 struct in6_addr *addr;
3252 struct in6_addr mask;
3253 struct block *b;
3254 u_int32_t *a, *m;
3255
3256 if (s2)
3257 bpf_error("no mask %s supported", s2);
3258
3259 res = pcap_nametoaddrinfo(s1);
3260 if (!res)
3261 bpf_error("invalid ip6 address %s", s1);
3262 if (res->ai_next)
3263 bpf_error("%s resolved to multiple address", s1);
3264 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
3265
3266 if (sizeof(mask) * 8 < masklen)
3267 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
3268 memset(&mask, 0, sizeof(mask));
3269 memset(&mask, 0xff, masklen / 8);
3270 if (masklen % 8) {
3271 mask.s6_addr[masklen / 8] =
3272 (0xff << (8 - masklen % 8)) & 0xff;
3273 }
3274
3275 a = (u_int32_t *)addr;
3276 m = (u_int32_t *)&mask;
3277 if ((a[0] & ~m[0]) || (a[1] & ~m[1])
3278 || (a[2] & ~m[2]) || (a[3] & ~m[3])) {
3279 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen);
3280 }
3281
3282 switch (q.addr) {
3283
3284 case Q_DEFAULT:
3285 case Q_HOST:
3286 if (masklen != 128)
3287 bpf_error("Mask syntax for networks only");
3288 /* FALLTHROUGH */
3289
3290 case Q_NET:
3291 b = gen_host6(addr, &mask, q.proto, q.dir);
3292 freeaddrinfo(res);
3293 return b;
3294
3295 default:
3296 bpf_error("invalid qualifier against IPv6 address");
3297 /* NOTREACHED */
3298 }
3299 }
3300 #endif /*INET6*/
3301
3302 struct block *
3303 gen_ecode(eaddr, q)
3304 register const u_char *eaddr;
3305 struct qual q;
3306 {
3307 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
3308 if (linktype == DLT_EN10MB)
3309 return gen_ehostop(eaddr, (int)q.dir);
3310 if (linktype == DLT_FDDI)
3311 return gen_fhostop(eaddr, (int)q.dir);
3312 if (linktype == DLT_IEEE802)
3313 return gen_thostop(eaddr, (int)q.dir);
3314 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring");
3315 }
3316 bpf_error("ethernet address used in non-ether expression");
3317 /* NOTREACHED */
3318 }
3319
3320 void
3321 sappend(s0, s1)
3322 struct slist *s0, *s1;
3323 {
3324 /*
3325 * This is definitely not the best way to do this, but the
3326 * lists will rarely get long.
3327 */
3328 while (s0->next)
3329 s0 = s0->next;
3330 s0->next = s1;
3331 }
3332
3333 static struct slist *
3334 xfer_to_x(a)
3335 struct arth *a;
3336 {
3337 struct slist *s;
3338
3339 s = new_stmt(BPF_LDX|BPF_MEM);
3340 s->s.k = a->regno;
3341 return s;
3342 }
3343
3344 static struct slist *
3345 xfer_to_a(a)
3346 struct arth *a;
3347 {
3348 struct slist *s;
3349
3350 s = new_stmt(BPF_LD|BPF_MEM);
3351 s->s.k = a->regno;
3352 return s;
3353 }
3354
3355 struct arth *
3356 gen_load(proto, index, size)
3357 int proto;
3358 struct arth *index;
3359 int size;
3360 {
3361 struct slist *s, *tmp;
3362 struct block *b;
3363 int regno = alloc_reg();
3364
3365 free_reg(index->regno);
3366 switch (size) {
3367
3368 default:
3369 bpf_error("data size must be 1, 2, or 4");
3370
3371 case 1:
3372 size = BPF_B;
3373 break;
3374
3375 case 2:
3376 size = BPF_H;
3377 break;
3378
3379 case 4:
3380 size = BPF_W;
3381 break;
3382 }
3383 switch (proto) {
3384 default:
3385 bpf_error("unsupported index operation");
3386
3387 case Q_LINK:
3388 s = xfer_to_x(index);
3389 tmp = new_stmt(BPF_LD|BPF_IND|size);
3390 sappend(s, tmp);
3391 sappend(index->s, s);
3392 break;
3393
3394 case Q_IP:
3395 case Q_ARP:
3396 case Q_RARP:
3397 case Q_ATALK:
3398 case Q_DECNET:
3399 case Q_SCA:
3400 case Q_LAT:
3401 case Q_MOPRC:
3402 case Q_MOPDL:
3403 #ifdef INET6
3404 case Q_IPV6:
3405 #endif
3406 /* XXX Note that we assume a fixed link header here. */
3407 s = xfer_to_x(index);
3408 tmp = new_stmt(BPF_LD|BPF_IND|size);
3409 tmp->s.k = off_nl;
3410 sappend(s, tmp);
3411 sappend(index->s, s);
3412
3413 b = gen_proto_abbrev(proto);
3414 if (index->b)
3415 gen_and(index->b, b);
3416 index->b = b;
3417 break;
3418
3419 case Q_SCTP:
3420 case Q_TCP:
3421 case Q_UDP:
3422 case Q_ICMP:
3423 case Q_IGMP:
3424 case Q_IGRP:
3425 case Q_PIM:
3426 case Q_VRRP:
3427 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
3428 s->s.k = off_nl;
3429 sappend(s, xfer_to_a(index));
3430 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
3431 sappend(s, new_stmt(BPF_MISC|BPF_TAX));
3432 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
3433 tmp->s.k = off_nl;
3434 sappend(index->s, s);
3435
3436 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
3437 if (index->b)
3438 gen_and(index->b, b);
3439 #ifdef INET6
3440 gen_and(gen_proto_abbrev(Q_IP), b);
3441 #endif
3442 index->b = b;
3443 break;
3444 #ifdef INET6
3445 case Q_ICMPV6:
3446 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
3447 /*NOTREACHED*/
3448 #endif
3449 }
3450 index->regno = regno;
3451 s = new_stmt(BPF_ST);
3452 s->s.k = regno;
3453 sappend(index->s, s);
3454
3455 return index;
3456 }
3457
3458 struct block *
3459 gen_relation(code, a0, a1, reversed)
3460 int code;
3461 struct arth *a0, *a1;
3462 int reversed;
3463 {
3464 struct slist *s0, *s1, *s2;
3465 struct block *b, *tmp;
3466
3467 s0 = xfer_to_x(a1);
3468 s1 = xfer_to_a(a0);
3469 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X);
3470 b = new_block(JMP(code));
3471 if (code == BPF_JGT || code == BPF_JGE) {
3472 reversed = !reversed;
3473 b->s.k = 0x80000000;
3474 }
3475 if (reversed)
3476 gen_not(b);
3477
3478 sappend(s1, s2);
3479 sappend(s0, s1);
3480 sappend(a1->s, s0);
3481 sappend(a0->s, a1->s);
3482
3483 b->stmts = a0->s;
3484
3485 free_reg(a0->regno);
3486 free_reg(a1->regno);
3487
3488 /* 'and' together protocol checks */
3489 if (a0->b) {
3490 if (a1->b) {
3491 gen_and(a0->b, tmp = a1->b);
3492 }
3493 else
3494 tmp = a0->b;
3495 } else
3496 tmp = a1->b;
3497
3498 if (tmp)
3499 gen_and(tmp, b);
3500
3501 return b;
3502 }
3503
3504 struct arth *
3505 gen_loadlen()
3506 {
3507 int regno = alloc_reg();
3508 struct arth *a = (struct arth *)newchunk(sizeof(*a));
3509 struct slist *s;
3510
3511 s = new_stmt(BPF_LD|BPF_LEN);
3512 s->next = new_stmt(BPF_ST);
3513 s->next->s.k = regno;
3514 a->s = s;
3515 a->regno = regno;
3516
3517 return a;
3518 }
3519
3520 struct arth *
3521 gen_loadi(val)
3522 int val;
3523 {
3524 struct arth *a;
3525 struct slist *s;
3526 int reg;
3527
3528 a = (struct arth *)newchunk(sizeof(*a));
3529
3530 reg = alloc_reg();
3531
3532 s = new_stmt(BPF_LD|BPF_IMM);
3533 s->s.k = val;
3534 s->next = new_stmt(BPF_ST);
3535 s->next->s.k = reg;
3536 a->s = s;
3537 a->regno = reg;
3538
3539 return a;
3540 }
3541
3542 struct arth *
3543 gen_neg(a)
3544 struct arth *a;
3545 {
3546 struct slist *s;
3547
3548 s = xfer_to_a(a);
3549 sappend(a->s, s);
3550 s = new_stmt(BPF_ALU|BPF_NEG);
3551 s->s.k = 0;
3552 sappend(a->s, s);
3553 s = new_stmt(BPF_ST);
3554 s->s.k = a->regno;
3555 sappend(a->s, s);
3556
3557 return a;
3558 }
3559
3560 struct arth *
3561 gen_arth(code, a0, a1)
3562 int code;
3563 struct arth *a0, *a1;
3564 {
3565 struct slist *s0, *s1, *s2;
3566
3567 s0 = xfer_to_x(a1);
3568 s1 = xfer_to_a(a0);
3569 s2 = new_stmt(BPF_ALU|BPF_X|code);
3570
3571 sappend(s1, s2);
3572 sappend(s0, s1);
3573 sappend(a1->s, s0);
3574 sappend(a0->s, a1->s);
3575
3576 free_reg(a1->regno);
3577
3578 s0 = new_stmt(BPF_ST);
3579 a0->regno = s0->s.k = alloc_reg();
3580 sappend(a0->s, s0);
3581
3582 return a0;
3583 }
3584
3585 /*
3586 * Here we handle simple allocation of the scratch registers.
3587 * If too many registers are alloc'd, the allocator punts.
3588 */
3589 static int regused[BPF_MEMWORDS];
3590 static int curreg;
3591
3592 /*
3593 * Return the next free register.
3594 */
3595 static int
3596 alloc_reg()
3597 {
3598 int n = BPF_MEMWORDS;
3599
3600 while (--n >= 0) {
3601 if (regused[curreg])
3602 curreg = (curreg + 1) % BPF_MEMWORDS;
3603 else {
3604 regused[curreg] = 1;
3605 return curreg;
3606 }
3607 }
3608 bpf_error("too many registers needed to evaluate expression");
3609 /* NOTREACHED */
3610 }
3611
3612 /*
3613 * Return a register to the table so it can
3614 * be used later.
3615 */
3616 static void
3617 free_reg(n)
3618 int n;
3619 {
3620 regused[n] = 0;
3621 }
3622
3623 static struct block *
3624 gen_len(jmp, n)
3625 int jmp, n;
3626 {
3627 struct slist *s;
3628 struct block *b;
3629
3630 s = new_stmt(BPF_LD|BPF_LEN);
3631 b = new_block(JMP(jmp));
3632 b->stmts = s;
3633 b->s.k = n;
3634
3635 return b;
3636 }
3637
3638 struct block *
3639 gen_greater(n)
3640 int n;
3641 {
3642 return gen_len(BPF_JGE, n);
3643 }
3644
3645 /*
3646 * Actually, this is less than or equal.
3647 */
3648 struct block *
3649 gen_less(n)
3650 int n;
3651 {
3652 struct block *b;
3653
3654 b = gen_len(BPF_JGT, n);
3655 gen_not(b);
3656
3657 return b;
3658 }
3659
3660 struct block *
3661 gen_byteop(op, idx, val)
3662 int op, idx, val;
3663 {
3664 struct block *b;
3665 struct slist *s;
3666
3667 switch (op) {
3668 default:
3669 abort();
3670
3671 case '=':
3672 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3673
3674 case '<':
3675 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3676 b->s.code = JMP(BPF_JGE);
3677 gen_not(b);
3678 return b;
3679
3680 case '>':
3681 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3682 b->s.code = JMP(BPF_JGT);
3683 return b;
3684
3685 case '|':
3686 s = new_stmt(BPF_ALU|BPF_OR|BPF_K);
3687 break;
3688
3689 case '&':
3690 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
3691 break;
3692 }
3693 s->s.k = val;
3694 b = new_block(JMP(BPF_JEQ));
3695 b->stmts = s;
3696 gen_not(b);
3697
3698 return b;
3699 }
3700
3701 static u_char abroadcast[] = { 0x0 };
3702
3703 struct block *
3704 gen_broadcast(proto)
3705 int proto;
3706 {
3707 bpf_u_int32 hostmask;
3708 struct block *b0, *b1, *b2;
3709 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3710
3711 switch (proto) {
3712
3713 case Q_DEFAULT:
3714 case Q_LINK:
3715 if (linktype == DLT_ARCNET)
3716 return gen_ahostop(abroadcast, Q_DST);
3717 if (linktype == DLT_EN10MB)
3718 return gen_ehostop(ebroadcast, Q_DST);
3719 if (linktype == DLT_FDDI)
3720 return gen_fhostop(ebroadcast, Q_DST);
3721 if (linktype == DLT_IEEE802)
3722 return gen_thostop(ebroadcast, Q_DST);
3723 bpf_error("not a broadcast link");
3724 break;
3725
3726 case Q_IP:
3727 b0 = gen_linktype(ETHERTYPE_IP);
3728 hostmask = ~netmask;
3729 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
3730 b2 = gen_mcmp(off_nl + 16, BPF_W,
3731 (bpf_int32)(~0 & hostmask), hostmask);
3732 gen_or(b1, b2);
3733 gen_and(b0, b2);
3734 return b2;
3735 }
3736 bpf_error("only ether/ip broadcast filters supported");
3737 }
3738
3739 struct block *
3740 gen_multicast(proto)
3741 int proto;
3742 {
3743 register struct block *b0, *b1;
3744 register struct slist *s;
3745
3746 switch (proto) {
3747
3748 case Q_DEFAULT:
3749 case Q_LINK:
3750 if (linktype == DLT_ARCNET)
3751 /* all ARCnet multicasts use the same address */
3752 return gen_ahostop(abroadcast, Q_DST);
3753
3754 if (linktype == DLT_EN10MB) {
3755 /* ether[0] & 1 != 0 */
3756 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3757 s->s.k = 0;
3758 b0 = new_block(JMP(BPF_JSET));
3759 b0->s.k = 1;
3760 b0->stmts = s;
3761 return b0;
3762 }
3763
3764 if (linktype == DLT_FDDI) {
3765 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */
3766 /* fddi[1] & 1 != 0 */
3767 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3768 s->s.k = 1;
3769 b0 = new_block(JMP(BPF_JSET));
3770 b0->s.k = 1;
3771 b0->stmts = s;
3772 return b0;
3773 }
3774
3775 /* TODO - check how token ring handles multicast */
3776 /* if (linktype == DLT_IEEE802) ... */
3777
3778 /* Link not known to support multicasts */
3779 break;
3780
3781 case Q_IP:
3782 b0 = gen_linktype(ETHERTYPE_IP);
3783 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
3784 b1->s.code = JMP(BPF_JGE);
3785 gen_and(b0, b1);
3786 return b1;
3787
3788 #ifdef INET6
3789 case Q_IPV6:
3790 b0 = gen_linktype(ETHERTYPE_IPV6);
3791 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
3792 gen_and(b0, b1);
3793 return b1;
3794 #endif /* INET6 */
3795 }
3796 bpf_error("only IP multicast filters supported on ethernet/FDDI");
3797 }
3798
3799 /*
3800 * generate command for inbound/outbound. It's here so we can
3801 * make it link-type specific. 'dir' = 0 implies "inbound",
3802 * = 1 implies "outbound".
3803 */
3804 struct block *
3805 gen_inbound(dir)
3806 int dir;
3807 {
3808 register struct block *b0;
3809
3810 /*
3811 * Only some data link types support inbound/outbound qualifiers.
3812 */
3813 switch (linktype) {
3814 case DLT_SLIP:
3815 case DLT_PPP:
3816 b0 = gen_relation(BPF_JEQ,
3817 gen_load(Q_LINK, gen_loadi(0), 1),
3818 gen_loadi(0),
3819 dir);
3820 break;
3821
3822 default:
3823 bpf_error("inbound/outbound not supported on linktype %d\n",
3824 linktype);
3825 b0 = NULL;
3826 /* NOTREACHED */
3827 }
3828 return (b0);
3829 }
3830
3831 struct block *
3832 gen_acode(eaddr, q)
3833 register const u_char *eaddr;
3834 struct qual q;
3835 {
3836 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
3837 if (linktype == DLT_ARCNET)
3838 return gen_ahostop(eaddr, (int)q.dir);
3839 }
3840 bpf_error("ARCnet address used in non-arc expression");
3841 /* NOTREACHED */
3842 }
3843
3844 static struct block *
3845 gen_ahostop(eaddr, dir)
3846 register const u_char *eaddr;
3847 register int dir;
3848 {
3849 register struct block *b0, *b1;
3850
3851 switch (dir) {
3852 /* src comes first, different from Ethernet */
3853 case Q_SRC:
3854 return gen_bcmp(0, 1, eaddr);
3855
3856 case Q_DST:
3857 return gen_bcmp(1, 1, eaddr);
3858
3859 case Q_AND:
3860 b0 = gen_ahostop(eaddr, Q_SRC);
3861 b1 = gen_ahostop(eaddr, Q_DST);
3862 gen_and(b0, b1);
3863 return b1;
3864
3865 case Q_DEFAULT:
3866 case Q_OR:
3867 b0 = gen_ahostop(eaddr, Q_SRC);
3868 b1 = gen_ahostop(eaddr, Q_DST);
3869 gen_or(b0, b1);
3870 return b1;
3871 }
3872 abort();
3873 /* NOTREACHED */
3874 }
3875
3876 /*
3877 * support IEEE 802.1Q VLAN trunk over ethernet
3878 */
3879 struct block *
3880 gen_vlan(vlan_num)
3881 int vlan_num;
3882 {
3883 struct block *b0;
3884
3885 /*
3886 * Change the offsets to point to the type and data fields within
3887 * the VLAN packet. This is somewhat of a kludge.
3888 */
3889 if (orig_nl == (u_int)-1) {
3890 orig_linktype = off_linktype; /* save original values */
3891 orig_nl = off_nl;
3892
3893 switch (linktype) {
3894
3895 case DLT_EN10MB:
3896 off_linktype = 16;
3897 off_nl = 18;
3898 break;
3899
3900 default:
3901 bpf_error("no VLAN support for data link type %d",
3902 linktype);
3903 /*NOTREACHED*/
3904 }
3905 }
3906
3907 /* check for VLAN */
3908 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
3909
3910 /* If a specific VLAN is requested, check VLAN id */
3911 if (vlan_num >= 0) {
3912 struct block *b1;
3913
3914 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num);
3915 gen_and(b0, b1);
3916 b0 = b1;
3917 }
3918
3919 return (b0);
3920 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism