]> The Tcpdump Group git mirrors - libpcap/blob - gencode.c
projects / libpcap / blob


2a49825d235bbff07af2cf779b79b48008ea0413
[libpcap] / gencode.c
1 /*#define CHASE_CHAIN*/
2 /*
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.168 2002-07-11 07:56:44 guy Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <sys/types.h>
32 #include <sys/socket.h>
33 #include <sys/time.h>
34 #ifdef __NetBSD__
35 #include <sys/param.h>
36 #endif
37
38 struct mbuf; /* Squelch compiler warnings on some platforms for */
39 struct rtentry; /* declarations in <net/if.h> */
40 #include <net/if.h>
41
42 #include <netinet/in.h>
43
44 #include <stdlib.h>
45 #include <string.h>
46 #include <memory.h>
47 #include <setjmp.h>
48 #include <stdarg.h>
49
50 #include "pcap-int.h"
51
52 #include "ethertype.h"
53 #include "nlpid.h"
54 #include "llc.h"
55 #include "gencode.h"
56 #include "ppp.h"
57 #include "sll.h"
58 #include "arcnet.h"
59 #ifdef INET6
60 #include <netdb.h> /* for "struct addrinfo" */
61 #endif /*INET6*/
62 #include <pcap-namedb.h>
63
64 #define ETHERMTU 1500
65
66 #ifndef IPPROTO_SCTP
67 #define IPPROTO_SCTP 132
68 #endif
69
70 #ifdef HAVE_OS_PROTO_H
71 #include "os-proto.h"
72 #endif
73
74 #define JMP(c) ((c)|BPF_JMP|BPF_K)
75
76 /* Locals */
77 static jmp_buf top_ctx;
78 static pcap_t *bpf_pcap;
79
80 /* Hack for updating VLAN offsets. */
81 static u_int orig_linktype = -1, orig_nl = -1, orig_nl_nosnap = -1;
82
83 /* XXX */
84 #ifdef PCAP_FDDIPAD
85 int pcap_fddipad = PCAP_FDDIPAD;
86 #else
87 int pcap_fddipad;
88 #endif
89
90 /* VARARGS */
91 void
92 bpf_error(const char *fmt, ...)
93
94 {
95 va_list ap;
96
97 va_start(ap, fmt);
98 if (bpf_pcap != NULL)
99 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE,
100 fmt, ap);
101 va_end(ap);
102 longjmp(top_ctx, 1);
103 /* NOTREACHED */
104 }
105
106 static void init_linktype(int);
107
108 static int alloc_reg(void);
109 static void free_reg(int);
110
111 static struct block *root;
112
113 /*
114 * We divy out chunks of memory rather than call malloc each time so
115 * we don't have to worry about leaking memory. It's probably
116 * not a big deal if all this memory was wasted but it this ever
117 * goes into a library that would probably not be a good idea.
118 */
119 #define NCHUNKS 16
120 #define CHUNK0SIZE 1024
121 struct chunk {
122 u_int n_left;
123 void *m;
124 };
125
126 static struct chunk chunks[NCHUNKS];
127 static int cur_chunk;
128
129 static void *newchunk(u_int);
130 static void freechunks(void);
131 static inline struct block *new_block(int);
132 static inline struct slist *new_stmt(int);
133 static struct block *gen_retblk(int);
134 static inline void syntax(void);
135
136 static void backpatch(struct block *, struct block *);
137 static void merge(struct block *, struct block *);
138 static struct block *gen_cmp(u_int, u_int, bpf_int32);
139 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
140 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
141 static struct block *gen_bcmp(u_int, u_int, const u_char *);
142 static struct block *gen_uncond(int);
143 static inline struct block *gen_true(void);
144 static inline struct block *gen_false(void);
145 static struct block *gen_linktype(int);
146 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
147 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
148 #ifdef INET6
149 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
150 #endif
151 static struct block *gen_ahostop(const u_char *, int);
152 static struct block *gen_ehostop(const u_char *, int);
153 static struct block *gen_fhostop(const u_char *, int);
154 static struct block *gen_thostop(const u_char *, int);
155 static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
156 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
157 #ifdef INET6
158 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
159 #endif
160 #ifndef INET6
161 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
162 #endif
163 static struct block *gen_ipfrag(void);
164 static struct block *gen_portatom(int, bpf_int32);
165 #ifdef INET6
166 static struct block *gen_portatom6(int, bpf_int32);
167 #endif
168 struct block *gen_portop(int, int, int);
169 static struct block *gen_port(int, int, int);
170 #ifdef INET6
171 struct block *gen_portop6(int, int, int);
172 static struct block *gen_port6(int, int, int);
173 #endif
174 static int lookup_proto(const char *, int);
175 static struct block *gen_protochain(int, int, int);
176 static struct block *gen_proto(int, int, int);
177 static struct slist *xfer_to_x(struct arth *);
178 static struct slist *xfer_to_a(struct arth *);
179 static struct block *gen_len(int, int);
180
181 static void *
182 newchunk(n)
183 u_int n;
184 {
185 struct chunk *cp;
186 int k, size;
187
188 #ifndef __NetBSD__
189 /* XXX Round up to nearest long. */
190 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1);
191 #else
192 /* XXX Round up to structure boundary. */
193 n = ALIGN(n);
194 #endif
195
196 cp = &chunks[cur_chunk];
197 if (n > cp->n_left) {
198 ++cp, k = ++cur_chunk;
199 if (k >= NCHUNKS)
200 bpf_error("out of memory");
201 size = CHUNK0SIZE << k;
202 cp->m = (void *)malloc(size);
203 memset((char *)cp->m, 0, size);
204 cp->n_left = size;
205 if (n > size)
206 bpf_error("out of memory");
207 }
208 cp->n_left -= n;
209 return (void *)((char *)cp->m + cp->n_left);
210 }
211
212 static void
213 freechunks()
214 {
215 int i;
216
217 cur_chunk = 0;
218 for (i = 0; i < NCHUNKS; ++i)
219 if (chunks[i].m != NULL) {
220 free(chunks[i].m);
221 chunks[i].m = NULL;
222 }
223 }
224
225 /*
226 * A strdup whose allocations are freed after code generation is over.
227 */
228 char *
229 sdup(s)
230 register const char *s;
231 {
232 int n = strlen(s) + 1;
233 char *cp = newchunk(n);
234
235 strlcpy(cp, s, n);
236 return (cp);
237 }
238
239 static inline struct block *
240 new_block(code)
241 int code;
242 {
243 struct block *p;
244
245 p = (struct block *)newchunk(sizeof(*p));
246 p->s.code = code;
247 p->head = p;
248
249 return p;
250 }
251
252 static inline struct slist *
253 new_stmt(code)
254 int code;
255 {
256 struct slist *p;
257
258 p = (struct slist *)newchunk(sizeof(*p));
259 p->s.code = code;
260
261 return p;
262 }
263
264 static struct block *
265 gen_retblk(v)
266 int v;
267 {
268 struct block *b = new_block(BPF_RET|BPF_K);
269
270 b->s.k = v;
271 return b;
272 }
273
274 static inline void
275 syntax()
276 {
277 bpf_error("syntax error in filter expression");
278 }
279
280 static bpf_u_int32 netmask;
281 static int snaplen;
282 int no_optimize;
283
284 int
285 pcap_compile(pcap_t *p, struct bpf_program *program,
286 char *buf, int optimize, bpf_u_int32 mask)
287 {
288 extern int n_errors;
289 int len;
290
291 no_optimize = 0;
292 n_errors = 0;
293 root = NULL;
294 bpf_pcap = p;
295 if (setjmp(top_ctx)) {
296 lex_cleanup();
297 freechunks();
298 return (-1);
299 }
300
301 netmask = mask;
302
303 snaplen = pcap_snapshot(p);
304 if (snaplen == 0) {
305 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
306 "snaplen of 0 rejects all packets");
307 return -1;
308 }
309
310 lex_init(buf ? buf : "");
311 init_linktype(pcap_datalink(p));
312 (void)pcap_parse();
313
314 if (n_errors)
315 syntax();
316
317 if (root == NULL)
318 root = gen_retblk(snaplen);
319
320 if (optimize && !no_optimize) {
321 bpf_optimize(&root);
322 if (root == NULL ||
323 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
324 bpf_error("expression rejects all packets");
325 }
326 program->bf_insns = icode_to_fcode(root, &len);
327 program->bf_len = len;
328
329 lex_cleanup();
330 freechunks();
331 return (0);
332 }
333
334 /*
335 * entry point for using the compiler with no pcap open
336 * pass in all the stuff that is needed explicitly instead.
337 */
338 int
339 pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
340 struct bpf_program *program,
341 char *buf, int optimize, bpf_u_int32 mask)
342 {
343 pcap_t *p;
344 int ret;
345
346 p = pcap_open_dead(linktype_arg, snaplen_arg);
347 if (p == NULL)
348 return (-1);
349 ret = pcap_compile(p, program, buf, optimize, mask);
350 pcap_close(p);
351 return (ret);
352 }
353
354 /*
355 * Clean up a "struct bpf_program" by freeing all the memory allocated
356 * in it.
357 */
358 void
359 pcap_freecode(struct bpf_program *program)
360 {
361 program->bf_len = 0;
362 if (program->bf_insns != NULL) {
363 free((char *)program->bf_insns);
364 program->bf_insns = NULL;
365 }
366 }
367
368 /*
369 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
370 * which of the jt and jf fields has been resolved and which is a pointer
371 * back to another unresolved block (or nil). At least one of the fields
372 * in each block is already resolved.
373 */
374 static void
375 backpatch(list, target)
376 struct block *list, *target;
377 {
378 struct block *next;
379
380 while (list) {
381 if (!list->sense) {
382 next = JT(list);
383 JT(list) = target;
384 } else {
385 next = JF(list);
386 JF(list) = target;
387 }
388 list = next;
389 }
390 }
391
392 /*
393 * Merge the lists in b0 and b1, using the 'sense' field to indicate
394 * which of jt and jf is the link.
395 */
396 static void
397 merge(b0, b1)
398 struct block *b0, *b1;
399 {
400 register struct block **p = &b0;
401
402 /* Find end of list. */
403 while (*p)
404 p = !((*p)->sense) ? &JT(*p) : &JF(*p);
405
406 /* Concatenate the lists. */
407 *p = b1;
408 }
409
410 void
411 finish_parse(p)
412 struct block *p;
413 {
414 backpatch(p, gen_retblk(snaplen));
415 p->sense = !p->sense;
416 backpatch(p, gen_retblk(0));
417 root = p->head;
418 }
419
420 void
421 gen_and(b0, b1)
422 struct block *b0, *b1;
423 {
424 backpatch(b0, b1->head);
425 b0->sense = !b0->sense;
426 b1->sense = !b1->sense;
427 merge(b1, b0);
428 b1->sense = !b1->sense;
429 b1->head = b0->head;
430 }
431
432 void
433 gen_or(b0, b1)
434 struct block *b0, *b1;
435 {
436 b0->sense = !b0->sense;
437 backpatch(b0, b1->head);
438 b0->sense = !b0->sense;
439 merge(b1, b0);
440 b1->head = b0->head;
441 }
442
443 void
444 gen_not(b)
445 struct block *b;
446 {
447 b->sense = !b->sense;
448 }
449
450 static struct block *
451 gen_cmp(offset, size, v)
452 u_int offset, size;
453 bpf_int32 v;
454 {
455 struct slist *s;
456 struct block *b;
457
458 s = new_stmt(BPF_LD|BPF_ABS|size);
459 s->s.k = offset;
460
461 b = new_block(JMP(BPF_JEQ));
462 b->stmts = s;
463 b->s.k = v;
464
465 return b;
466 }
467
468 static struct block *
469 gen_cmp_gt(offset, size, v)
470 u_int offset, size;
471 bpf_int32 v;
472 {
473 struct slist *s;
474 struct block *b;
475
476 s = new_stmt(BPF_LD|BPF_ABS|size);
477 s->s.k = offset;
478
479 b = new_block(JMP(BPF_JGT));
480 b->stmts = s;
481 b->s.k = v;
482
483 return b;
484 }
485
486 static struct block *
487 gen_mcmp(offset, size, v, mask)
488 u_int offset, size;
489 bpf_int32 v;
490 bpf_u_int32 mask;
491 {
492 struct block *b = gen_cmp(offset, size, v);
493 struct slist *s;
494
495 if (mask != 0xffffffff) {
496 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
497 s->s.k = mask;
498 b->stmts->next = s;
499 }
500 return b;
501 }
502
503 static struct block *
504 gen_bcmp(offset, size, v)
505 register u_int offset, size;
506 register const u_char *v;
507 {
508 register struct block *b, *tmp;
509
510 b = NULL;
511 while (size >= 4) {
512 register const u_char *p = &v[size - 4];
513 bpf_int32 w = ((bpf_int32)p[0] << 24) |
514 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
515
516 tmp = gen_cmp(offset + size - 4, BPF_W, w);
517 if (b != NULL)
518 gen_and(b, tmp);
519 b = tmp;
520 size -= 4;
521 }
522 while (size >= 2) {
523 register const u_char *p = &v[size - 2];
524 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
525
526 tmp = gen_cmp(offset + size - 2, BPF_H, w);
527 if (b != NULL)
528 gen_and(b, tmp);
529 b = tmp;
530 size -= 2;
531 }
532 if (size > 0) {
533 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
534 if (b != NULL)
535 gen_and(b, tmp);
536 b = tmp;
537 }
538 return b;
539 }
540
541 /*
542 * Various code constructs need to know the layout of the data link
543 * layer. These variables give the necessary offsets.
544 */
545
546 /*
547 * "off_linktype" is the offset to information in the link-layer header
548 * giving the packet type.
549 *
550 * For Ethernet, it's the offset of the Ethernet type field.
551 *
552 * For link-layer types that always use 802.2 headers, it's the
553 * offset of the LLC header.
554 *
555 * For PPP, it's the offset of the PPP type field.
556 *
557 * For Cisco HDLC, it's the offset of the CHDLC type field.
558 *
559 * For BSD loopback, it's the offset of the AF_ value.
560 *
561 * For Linux cooked sockets, it's the offset of the type field.
562 *
563 * It's set to -1 for no encapsulation, in which case, IP is assumed.
564 */
565 static u_int off_linktype;
566
567 /*
568 * These are offsets to the beginning of the network-layer header.
569 *
570 * If the link layer never uses 802.2 LLC:
571 *
572 * "off_nl" and "off_nl_nosnap" are the same.
573 *
574 * If the link layer always uses 802.2 LLC:
575 *
576 * "off_nl" is the offset if there's a SNAP header following
577 * the 802.2 header;
578 *
579 * "off_nl_nosnap" is the offset if there's no SNAP header.
580 *
581 * If the link layer is Ethernet:
582 *
583 * "off_nl" is the offset if the packet is an Ethernet II packet
584 * (we assume no 802.3+802.2+SNAP);
585 *
586 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet
587 * with an 802.2 header following it.
588 */
589 static u_int off_nl;
590 static u_int off_nl_nosnap;
591
592 static int linktype;
593
594 static void
595 init_linktype(type)
596 int type;
597 {
598 linktype = type;
599
600 orig_linktype = -1;
601 orig_nl = -1;
602 orig_nl_nosnap = -1;
603
604 switch (type) {
605
606 case DLT_ARCNET:
607 off_linktype = 2;
608 off_nl = 6; /* XXX in reality, variable! */
609 off_nl_nosnap = 6; /* no 802.2 LLC */
610 return;
611
612 case DLT_EN10MB:
613 off_linktype = 12;
614 off_nl = 14; /* Ethernet II */
615 off_nl_nosnap = 17; /* 802.3+802.2 */
616 return;
617
618 case DLT_SLIP:
619 /*
620 * SLIP doesn't have a link level type. The 16 byte
621 * header is hacked into our SLIP driver.
622 */
623 off_linktype = -1;
624 off_nl = 16;
625 off_nl_nosnap = 16; /* no 802.2 LLC */
626 return;
627
628 case DLT_SLIP_BSDOS:
629 /* XXX this may be the same as the DLT_PPP_BSDOS case */
630 off_linktype = -1;
631 /* XXX end */
632 off_nl = 24;
633 off_nl_nosnap = 24; /* no 802.2 LLC */
634 return;
635
636 case DLT_NULL:
637 case DLT_LOOP:
638 off_linktype = 0;
639 off_nl = 4;
640 off_nl_nosnap = 4; /* no 802.2 LLC */
641 return;
642
643 case DLT_PPP:
644 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */
645 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */
646 off_linktype = 2;
647 off_nl = 4;
648 off_nl_nosnap = 4; /* no 802.2 LLC */
649 return;
650
651 case DLT_PPP_ETHER:
652 /*
653 * This does no include the Ethernet header, and
654 * only covers session state.
655 */
656 off_linktype = 6;
657 off_nl = 8;
658 off_nl_nosnap = 8; /* no 802.2 LLC */
659 return;
660
661 case DLT_PPP_BSDOS:
662 off_linktype = 5;
663 off_nl = 24;
664 off_nl_nosnap = 24; /* no 802.2 LLC */
665 return;
666
667 case DLT_FDDI:
668 /*
669 * FDDI doesn't really have a link-level type field.
670 * We set "off_linktype" to the offset of the LLC header.
671 *
672 * To check for Ethernet types, we assume that SSAP = SNAP
673 * is being used and pick out the encapsulated Ethernet type.
674 * XXX - should we generate code to check for SNAP?
675 */
676 off_linktype = 13;
677 #ifdef PCAP_FDDIPAD
678 off_linktype += pcap_fddipad;
679 #endif
680 off_nl = 21; /* FDDI+802.2+SNAP */
681 off_nl_nosnap = 16; /* FDDI+802.2 */
682 #ifdef PCAP_FDDIPAD
683 off_nl += pcap_fddipad;
684 off_nl_nosnap += pcap_fddipad;
685 #endif
686 return;
687
688 case DLT_IEEE802:
689 /*
690 * Token Ring doesn't really have a link-level type field.
691 * We set "off_linktype" to the offset of the LLC header.
692 *
693 * To check for Ethernet types, we assume that SSAP = SNAP
694 * is being used and pick out the encapsulated Ethernet type.
695 * XXX - should we generate code to check for SNAP?
696 *
697 * XXX - the header is actually variable-length.
698 * Some various Linux patched versions gave 38
699 * as "off_linktype" and 40 as "off_nl"; however,
700 * if a token ring packet has *no* routing
701 * information, i.e. is not source-routed, the correct
702 * values are 20 and 22, as they are in the vanilla code.
703 *
704 * A packet is source-routed iff the uppermost bit
705 * of the first byte of the source address, at an
706 * offset of 8, has the uppermost bit set. If the
707 * packet is source-routed, the total number of bytes
708 * of routing information is 2 plus bits 0x1F00 of
709 * the 16-bit value at an offset of 14 (shifted right
710 * 8 - figure out which byte that is).
711 */
712 off_linktype = 14;
713 off_nl = 22; /* Token Ring+802.2+SNAP */
714 off_nl_nosnap = 17; /* Token Ring+802.2 */
715 return;
716
717 case DLT_IEEE802_11:
718 /*
719 * 802.11 doesn't really have a link-level type field.
720 * We set "off_linktype" to the offset of the LLC header.
721 *
722 * To check for Ethernet types, we assume that SSAP = SNAP
723 * is being used and pick out the encapsulated Ethernet type.
724 * XXX - should we generate code to check for SNAP?
725 *
726 * XXX - the header is actually variable-length. We
727 * assume a 24-byte link-layer header, as appears in
728 * data frames in networks with no bridges.
729 */
730 off_linktype = 24;
731 off_nl = 32; /* 802.11+802.2+SNAP */
732 off_nl_nosnap = 27; /* 802.22+802.2 */
733 return;
734
735 case DLT_PRISM_HEADER:
736 /*
737 * Same as 802.11, but with an additional header before
738 * the 802.11 header, containing a bunch of additional
739 * information including radio-level information.
740 *
741 * The header is 144 bytes long.
742 *
743 * XXX - same variable-length header problem; at least
744 * the Prism header is fixed-length.
745 */
746 off_linktype = 144+24;
747 off_nl = 144+32; /* Prism+802.11+802.2+SNAP */
748 off_nl_nosnap = 144+27; /* Prism+802.11+802.2 */
749 return;
750
751 case DLT_ATM_RFC1483:
752 case DLT_ATM_CLIP: /* Linux ATM defines this */
753 /*
754 * assume routed, non-ISO PDUs
755 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
756 */
757 off_linktype = 0;
758 off_nl = 8; /* 802.2+SNAP */
759 off_nl_nosnap = 3; /* 802.2 */
760 return;
761
762 case DLT_RAW:
763 off_linktype = -1;
764 off_nl = 0;
765 off_nl_nosnap = 0; /* no 802.2 LLC */
766 return;
767
768 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */
769 off_linktype = 14;
770 off_nl = 16;
771 off_nl_nosnap = 16; /* no 802.2 LLC */
772 return;
773
774 case DLT_LTALK:
775 /*
776 * LocalTalk does have a 1-byte type field in the LLAP header,
777 * but really it just indicates whether there is a "short" or
778 * "long" DDP packet following.
779 */
780 off_linktype = -1;
781 off_nl = 0;
782 off_nl_nosnap = 0; /* no 802.2 LLC */
783 return;
784
785 case DLT_FRELAY:
786 /*
787 * XXX - we should set this to handle SNAP-encapsulated
788 * frames (NLPID of 0x80).
789 */
790 off_linktype = -1;
791 off_nl = 0;
792 off_nl_nosnap = 0; /* no 802.2 LLC */
793 return;
794 }
795 bpf_error("unknown data link type %d", linktype);
796 /* NOTREACHED */
797 }
798
799 static struct block *
800 gen_uncond(rsense)
801 int rsense;
802 {
803 struct block *b;
804 struct slist *s;
805
806 s = new_stmt(BPF_LD|BPF_IMM);
807 s->s.k = !rsense;
808 b = new_block(JMP(BPF_JEQ));
809 b->stmts = s;
810
811 return b;
812 }
813
814 static inline struct block *
815 gen_true()
816 {
817 return gen_uncond(1);
818 }
819
820 static inline struct block *
821 gen_false()
822 {
823 return gen_uncond(0);
824 }
825
826 /*
827 * Byte-swap a 32-bit number.
828 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
829 * big-endian platforms.)
830 */
831 #define SWAPLONG(y) \
832 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
833
834 static struct block *
835 gen_linktype(proto)
836 register int proto;
837 {
838 struct block *b0, *b1, *b2;
839
840 switch (linktype) {
841
842 case DLT_EN10MB:
843 switch (proto) {
844
845 case LLCSAP_ISONS:
846 /*
847 * OSI protocols always use 802.2 encapsulation.
848 * XXX - should we check both the DSAP and the
849 * SSAP, like this, or should we check just the
850 * DSAP?
851 */
852 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
853 gen_not(b0);
854 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
855 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
856 gen_and(b0, b1);
857 return b1;
858
859 case LLCSAP_NETBEUI:
860 /*
861 * NetBEUI always uses 802.2 encapsulation.
862 * XXX - should we check both the DSAP and the
863 * SSAP, like this, or should we check just the
864 * DSAP?
865 */
866 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
867 gen_not(b0);
868 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
869 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
870 gen_and(b0, b1);
871 return b1;
872
873 case LLCSAP_IPX:
874 /*
875 * Check for;
876 *
877 * Ethernet_II frames, which are Ethernet
878 * frames with a frame type of ETHERTYPE_IPX;
879 *
880 * Ethernet_802.3 frames, which are 802.3
881 * frames (i.e., the type/length field is
882 * a length field, <= ETHERMTU, rather than
883 * a type field) with the first two bytes
884 * after the Ethernet/802.3 header being
885 * 0xFFFF;
886 *
887 * Ethernet_802.2 frames, which are 802.3
888 * frames with an 802.2 LLC header and
889 * with the IPX LSAP as the DSAP in the LLC
890 * header;
891 *
892 * Ethernet_SNAP frames, which are 802.3
893 * frames with an LLC header and a SNAP
894 * header and with an OUI of 0x000000
895 * (encapsulated Ethernet) and a protocol
896 * ID of ETHERTYPE_IPX in the SNAP header.
897 *
898 * XXX - should we generate the same code both
899 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
900 */
901
902 /*
903 * This generates code to check both for the
904 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
905 */
906 b0 = gen_cmp(off_linktype + 2, BPF_B,
907 (bpf_int32)LLCSAP_IPX);
908 b1 = gen_cmp(off_linktype + 2, BPF_H,
909 (bpf_int32)0xFFFF);
910 gen_or(b0, b1);
911
912 /*
913 * Now we add code to check for SNAP frames with
914 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
915 */
916 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
917 gen_or(b0, b1);
918
919 /*
920 * Now we generate code to check for 802.3
921 * frames in general.
922 */
923 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
924 gen_not(b0);
925
926 /*
927 * Now add the check for 802.3 frames before the
928 * check for Ethernet_802.2 and Ethernet_802.3,
929 * as those checks should only be done on 802.3
930 * frames, not on Ethernet frames.
931 */
932 gen_and(b0, b1);
933
934 /*
935 * Now add the check for Ethernet_II frames, and
936 * do that before checking for the other frame
937 * types.
938 */
939 b0 = gen_cmp(off_linktype, BPF_H,
940 (bpf_int32)ETHERTYPE_IPX);
941 gen_or(b0, b1);
942 return b1;
943
944 case ETHERTYPE_ATALK:
945 case ETHERTYPE_AARP:
946 /*
947 * EtherTalk (AppleTalk protocols on Ethernet link
948 * layer) may use 802.2 encapsulation.
949 */
950
951 /*
952 * Check for 802.2 encapsulation (EtherTalk phase 2?);
953 * we check for an Ethernet type field less than
954 * 1500, which means it's an 802.3 length field.
955 */
956 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
957 gen_not(b0);
958
959 /*
960 * 802.2-encapsulated ETHERTYPE_ATALK packets are
961 * SNAP packets with an organization code of
962 * 0x080007 (Apple, for Appletalk) and a protocol
963 * type of ETHERTYPE_ATALK (Appletalk).
964 *
965 * 802.2-encapsulated ETHERTYPE_AARP packets are
966 * SNAP packets with an organization code of
967 * 0x000000 (encapsulated Ethernet) and a protocol
968 * type of ETHERTYPE_AARP (Appletalk ARP).
969 */
970 if (proto == ETHERTYPE_ATALK)
971 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
972 else /* proto == ETHERTYPE_AARP */
973 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
974 gen_and(b0, b1);
975
976 /*
977 * Check for Ethernet encapsulation (Ethertalk
978 * phase 1?); we just check for the Ethernet
979 * protocol type.
980 */
981 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
982
983 gen_or(b0, b1);
984 return b1;
985
986 default:
987 if (proto <= ETHERMTU) {
988 /*
989 * This is an LLC SAP value, so the frames
990 * that match would be 802.2 frames.
991 * Check that the frame is an 802.2 frame
992 * (i.e., that the length/type field is
993 * a length field, <= ETHERMTU) and
994 * then check the DSAP.
995 */
996 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
997 gen_not(b0);
998 b1 = gen_cmp(off_linktype + 2, BPF_B,
999 (bpf_int32)proto);
1000 gen_and(b0, b1);
1001 return b1;
1002 } else {
1003 /*
1004 * This is an Ethernet type, so compare
1005 * the length/type field with it (if
1006 * the frame is an 802.2 frame, the length
1007 * field will be <= ETHERMTU, and, as
1008 * "proto" is > ETHERMTU, this test
1009 * will fail and the frame won't match,
1010 * which is what we want).
1011 */
1012 return gen_cmp(off_linktype, BPF_H,
1013 (bpf_int32)proto);
1014 }
1015 }
1016 break;
1017
1018 case DLT_IEEE802_11:
1019 case DLT_PRISM_HEADER:
1020 case DLT_FDDI:
1021 case DLT_IEEE802:
1022 case DLT_ATM_RFC1483:
1023 case DLT_ATM_CLIP:
1024 /*
1025 * XXX - handle token-ring variable-length header.
1026 */
1027 switch (proto) {
1028
1029 case LLCSAP_ISONS:
1030 return gen_cmp(off_linktype, BPF_H, (long)
1031 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
1032
1033 case LLCSAP_NETBEUI:
1034 return gen_cmp(off_linktype, BPF_H, (long)
1035 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
1036
1037 case LLCSAP_IPX:
1038 /*
1039 * XXX - are there ever SNAP frames for IPX on
1040 * non-Ethernet 802.x networks?
1041 */
1042 return gen_cmp(off_linktype, BPF_B,
1043 (bpf_int32)LLCSAP_IPX);
1044
1045 case ETHERTYPE_ATALK:
1046 /*
1047 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1048 * SNAP packets with an organization code of
1049 * 0x080007 (Apple, for Appletalk) and a protocol
1050 * type of ETHERTYPE_ATALK (Appletalk).
1051 *
1052 * XXX - check for an organization code of
1053 * encapsulated Ethernet as well?
1054 */
1055 return gen_snap(0x080007, ETHERTYPE_ATALK,
1056 off_linktype);
1057 break;
1058
1059 default:
1060 /*
1061 * XXX - we don't have to check for IPX 802.3
1062 * here, but should we check for the IPX Ethertype?
1063 */
1064 if (proto <= ETHERMTU) {
1065 /*
1066 * This is an LLC SAP value, so check
1067 * the DSAP.
1068 */
1069 return gen_cmp(off_linktype, BPF_B,
1070 (bpf_int32)proto);
1071 } else {
1072 /*
1073 * This is an Ethernet type; we assume
1074 * that it's unlikely that it'll
1075 * appear in the right place at random,
1076 * and therefore check only the
1077 * location that would hold the Ethernet
1078 * type in a SNAP frame with an organization
1079 * code of 0x000000 (encapsulated Ethernet).
1080 *
1081 * XXX - if we were to check for the SNAP DSAP
1082 * and LSAP, as per XXX, and were also to check
1083 * for an organization code of 0x000000
1084 * (encapsulated Ethernet), we'd do
1085 *
1086 * return gen_snap(0x000000, proto,
1087 * off_linktype);
1088 *
1089 * here; for now, we don't, as per the above.
1090 * I don't know whether it's worth the
1091 * extra CPU time to do the right check
1092 * or not.
1093 */
1094 return gen_cmp(off_linktype+6, BPF_H,
1095 (bpf_int32)proto);
1096 }
1097 }
1098 break;
1099
1100 case DLT_LINUX_SLL:
1101 switch (proto) {
1102
1103 case LLCSAP_ISONS:
1104 /*
1105 * OSI protocols always use 802.2 encapsulation.
1106 * XXX - should we check both the DSAP and the
1107 * LSAP, like this, or should we check just the
1108 * DSAP?
1109 */
1110 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1111 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
1112 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
1113 gen_and(b0, b1);
1114 return b1;
1115
1116 case LLCSAP_NETBEUI:
1117 /*
1118 * NetBEUI always uses 802.2 encapsulation.
1119 * XXX - should we check both the DSAP and the
1120 * LSAP, like this, or should we check just the
1121 * DSAP?
1122 */
1123 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1124 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
1125 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
1126 gen_and(b0, b1);
1127 return b1;
1128
1129 case LLCSAP_IPX:
1130 /*
1131 * Ethernet_II frames, which are Ethernet
1132 * frames with a frame type of ETHERTYPE_IPX;
1133 *
1134 * Ethernet_802.3 frames, which have a frame
1135 * type of LINUX_SLL_P_802_3;
1136 *
1137 * Ethernet_802.2 frames, which are 802.3
1138 * frames with an 802.2 LLC header (i.e, have
1139 * a frame type of LINUX_SLL_P_802_2) and
1140 * with the IPX LSAP as the DSAP in the LLC
1141 * header;
1142 *
1143 * Ethernet_SNAP frames, which are 802.3
1144 * frames with an LLC header and a SNAP
1145 * header and with an OUI of 0x000000
1146 * (encapsulated Ethernet) and a protocol
1147 * ID of ETHERTYPE_IPX in the SNAP header.
1148 *
1149 * First, do the checks on LINUX_SLL_P_802_2
1150 * frames; generate the check for either
1151 * Ethernet_802.2 or Ethernet_SNAP frames, and
1152 * then put a check for LINUX_SLL_P_802_2 frames
1153 * before it.
1154 */
1155 b0 = gen_cmp(off_linktype + 2, BPF_B,
1156 (bpf_int32)LLCSAP_IPX);
1157 b1 = gen_snap(0x000000, ETHERTYPE_IPX,
1158 off_linktype + 2);
1159 gen_or(b0, b1);
1160 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1161 gen_and(b0, b1);
1162
1163 /*
1164 * Now check for 802.3 frames and OR that with
1165 * the previous test.
1166 */
1167 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
1168 gen_or(b0, b1);
1169
1170 /*
1171 * Now add the check for Ethernet_II frames, and
1172 * do that before checking for the other frame
1173 * types.
1174 */
1175 b0 = gen_cmp(off_linktype, BPF_H,
1176 (bpf_int32)ETHERTYPE_IPX);
1177 gen_or(b0, b1);
1178 return b1;
1179
1180 case ETHERTYPE_ATALK:
1181 case ETHERTYPE_AARP:
1182 /*
1183 * EtherTalk (AppleTalk protocols on Ethernet link
1184 * layer) may use 802.2 encapsulation.
1185 */
1186
1187 /*
1188 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1189 * we check for the 802.2 protocol type in the
1190 * "Ethernet type" field.
1191 */
1192 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1193
1194 /*
1195 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1196 * SNAP packets with an organization code of
1197 * 0x080007 (Apple, for Appletalk) and a protocol
1198 * type of ETHERTYPE_ATALK (Appletalk).
1199 *
1200 * 802.2-encapsulated ETHERTYPE_AARP packets are
1201 * SNAP packets with an organization code of
1202 * 0x000000 (encapsulated Ethernet) and a protocol
1203 * type of ETHERTYPE_AARP (Appletalk ARP).
1204 */
1205 if (proto == ETHERTYPE_ATALK)
1206 b1 = gen_snap(0x080007, ETHERTYPE_ATALK,
1207 off_linktype + 2);
1208 else /* proto == ETHERTYPE_AARP */
1209 b1 = gen_snap(0x000000, ETHERTYPE_AARP,
1210 off_linktype + 2);
1211 gen_and(b0, b1);
1212
1213 /*
1214 * Check for Ethernet encapsulation (Ethertalk
1215 * phase 1?); we just check for the Ethernet
1216 * protocol type.
1217 */
1218 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1219
1220 gen_or(b0, b1);
1221 return b1;
1222
1223 default:
1224 if (proto <= ETHERMTU) {
1225 /*
1226 * This is an LLC SAP value, so the frames
1227 * that match would be 802.2 frames.
1228 * Check for the 802.2 protocol type
1229 * in the "Ethernet type" field, and
1230 * then check the DSAP.
1231 */
1232 b0 = gen_cmp(off_linktype, BPF_H,
1233 LINUX_SLL_P_802_2);
1234 b1 = gen_cmp(off_linktype + 2, BPF_B,
1235 (bpf_int32)proto);
1236 gen_and(b0, b1);
1237 return b1;
1238 } else {
1239 /*
1240 * This is an Ethernet type, so compare
1241 * the length/type field with it (if
1242 * the frame is an 802.2 frame, the length
1243 * field will be <= ETHERMTU, and, as
1244 * "proto" is > ETHERMTU, this test
1245 * will fail and the frame won't match,
1246 * which is what we want).
1247 */
1248 return gen_cmp(off_linktype, BPF_H,
1249 (bpf_int32)proto);
1250 }
1251 }
1252 break;
1253
1254 case DLT_SLIP:
1255 case DLT_SLIP_BSDOS:
1256 case DLT_RAW:
1257 /*
1258 * These types don't provide any type field; packets
1259 * are always IP.
1260 *
1261 * XXX - for IPv4, check for a version number of 4, and,
1262 * for IPv6, check for a version number of 6?
1263 */
1264 switch (proto) {
1265
1266 case ETHERTYPE_IP:
1267 #ifdef INET6
1268 case ETHERTYPE_IPV6:
1269 #endif
1270 return gen_true(); /* always true */
1271
1272 default:
1273 return gen_false(); /* always false */
1274 }
1275 break;
1276
1277 case DLT_PPP:
1278 case DLT_PPP_SERIAL:
1279 case DLT_PPP_ETHER:
1280 /*
1281 * We use Ethernet protocol types inside libpcap;
1282 * map them to the corresponding PPP protocol types.
1283 */
1284 switch (proto) {
1285
1286 case ETHERTYPE_IP:
1287 proto = PPP_IP; /* XXX was 0x21 */
1288 break;
1289
1290 #ifdef INET6
1291 case ETHERTYPE_IPV6:
1292 proto = PPP_IPV6;
1293 break;
1294 #endif
1295
1296 case ETHERTYPE_DN:
1297 proto = PPP_DECNET;
1298 break;
1299
1300 case ETHERTYPE_ATALK:
1301 proto = PPP_APPLE;
1302 break;
1303
1304 case ETHERTYPE_NS:
1305 proto = PPP_NS;
1306 break;
1307
1308 case LLCSAP_ISONS:
1309 proto = PPP_OSI;
1310 break;
1311
1312 case LLCSAP_8021D:
1313 /*
1314 * I'm assuming the "Bridging PDU"s that go
1315 * over PPP are Spanning Tree Protocol
1316 * Bridging PDUs.
1317 */
1318 proto = PPP_BRPDU;
1319 break;
1320
1321 case LLCSAP_IPX:
1322 proto = PPP_IPX;
1323 break;
1324 }
1325 break;
1326
1327 case DLT_PPP_BSDOS:
1328 /*
1329 * We use Ethernet protocol types inside libpcap;
1330 * map them to the corresponding PPP protocol types.
1331 */
1332 switch (proto) {
1333
1334 case ETHERTYPE_IP:
1335 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
1336 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
1337 gen_or(b0, b1);
1338 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
1339 gen_or(b1, b0);
1340 return b0;
1341
1342 #ifdef INET6
1343 case ETHERTYPE_IPV6:
1344 proto = PPP_IPV6;
1345 /* more to go? */
1346 break;
1347 #endif
1348
1349 case ETHERTYPE_DN:
1350 proto = PPP_DECNET;
1351 break;
1352
1353 case ETHERTYPE_ATALK:
1354 proto = PPP_APPLE;
1355 break;
1356
1357 case ETHERTYPE_NS:
1358 proto = PPP_NS;
1359 break;
1360
1361 case LLCSAP_ISONS:
1362 proto = PPP_OSI;
1363 break;
1364
1365 case LLCSAP_8021D:
1366 /*
1367 * I'm assuming the "Bridging PDU"s that go
1368 * over PPP are Spanning Tree Protocol
1369 * Bridging PDUs.
1370 */
1371 proto = PPP_BRPDU;
1372 break;
1373
1374 case LLCSAP_IPX:
1375 proto = PPP_IPX;
1376 break;
1377 }
1378 break;
1379
1380 case DLT_NULL:
1381 case DLT_LOOP:
1382 /*
1383 * For DLT_NULL, the link-layer header is a 32-bit
1384 * word containing an AF_ value in *host* byte order.
1385 *
1386 * In addition, if we're reading a saved capture file,
1387 * the host byte order in the capture may not be the
1388 * same as the host byte order on this machine.
1389 *
1390 * For DLT_LOOP, the link-layer header is a 32-bit
1391 * word containing an AF_ value in *network* byte order.
1392 *
1393 * XXX - AF_ values may, unfortunately, be platform-
1394 * dependent; for example, FreeBSD's AF_INET6 is 24
1395 * whilst NetBSD's and OpenBSD's is 26.
1396 *
1397 * This means that, when reading a capture file, just
1398 * checking for our AF_INET6 value won't work if the
1399 * capture file came from another OS.
1400 */
1401 switch (proto) {
1402
1403 case ETHERTYPE_IP:
1404 proto = AF_INET;
1405 break;
1406
1407 #ifdef INET6
1408 case ETHERTYPE_IPV6:
1409 proto = AF_INET6;
1410 break;
1411 #endif
1412
1413 default:
1414 /*
1415 * Not a type on which we support filtering.
1416 * XXX - support those that have AF_ values
1417 * #defined on this platform, at least?
1418 */
1419 return gen_false();
1420 }
1421
1422 if (linktype == DLT_NULL) {
1423 /*
1424 * The AF_ value is in host byte order, but
1425 * the BPF interpreter will convert it to
1426 * network byte order.
1427 *
1428 * If this is a save file, and it's from a
1429 * machine with the opposite byte order to
1430 * ours, we byte-swap the AF_ value.
1431 *
1432 * Then we run it through "htonl()", and
1433 * generate code to compare against the result.
1434 */
1435 if (bpf_pcap->sf.rfile != NULL &&
1436 bpf_pcap->sf.swapped)
1437 proto = SWAPLONG(proto);
1438 proto = htonl(proto);
1439 }
1440 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
1441
1442 case DLT_ARCNET:
1443 /*
1444 * XXX should we check for first fragment if the protocol
1445 * uses PHDS?
1446 */
1447 switch(proto) {
1448 default:
1449 return gen_false();
1450 #ifdef INET6
1451 case ETHERTYPE_IPV6:
1452 return(gen_cmp(2, BPF_B,
1453 (bpf_int32)htonl(ARCTYPE_INET6)));
1454 #endif /* INET6 */
1455 case ETHERTYPE_IP:
1456 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP));
1457 b1 = gen_cmp(2, BPF_B,
1458 (bpf_int32)htonl(ARCTYPE_IP_OLD));
1459 gen_or(b0, b1);
1460 return(b1);
1461 case ETHERTYPE_ARP:
1462 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP));
1463 b1 = gen_cmp(2, BPF_B,
1464 (bpf_int32)htonl(ARCTYPE_ARP_OLD));
1465 gen_or(b0, b1);
1466 return(b1);
1467 case ETHERTYPE_REVARP:
1468 return(gen_cmp(2, BPF_B,
1469 (bpf_int32)htonl(ARCTYPE_REVARP)));
1470 case ETHERTYPE_ATALK:
1471 return(gen_cmp(2, BPF_B,
1472 (bpf_int32)htonl(ARCTYPE_ATALK)));
1473 }
1474 break;
1475
1476 case DLT_LTALK:
1477 switch (proto) {
1478 case ETHERTYPE_ATALK:
1479 return gen_true();
1480 default:
1481 return gen_false();
1482 }
1483 break;
1484
1485 case DLT_FRELAY:
1486 /*
1487 * XXX - assumes a 2-byte Frame Relay header with
1488 * DLCI and flags. What if the address is longer?
1489 */
1490 switch (proto) {
1491
1492 case ETHERTYPE_IP:
1493 /*
1494 * Check for the special NLPID for IP.
1495 */
1496 return gen_cmp(2, BPF_H, (0x03<<8) | 0xcc);
1497
1498 #ifdef INET6
1499 case ETHERTYPE_IPV6:
1500 /*
1501 * Check for the special NLPID for IPv6.
1502 */
1503 return gen_cmp(2, BPF_H, (0x03<<8) | 0x8e);
1504 #endif
1505
1506 case LLCSAP_ISONS:
1507 /*
1508 * Check for several OSI protocols.
1509 *
1510 * Frame Relay packets typically have an OSI
1511 * NLPID at the beginning; we check for each
1512 * of them.
1513 *
1514 * What we check for is the NLPID and a frame
1515 * control field of UI, i.e. 0x03 followed
1516 * by the NLPID.
1517 */
1518 b0 = gen_cmp(2, BPF_H, (0x03<<8) | ISO8473_CLNP);
1519 b1 = gen_cmp(2, BPF_H, (0x03<<8) | ISO9542_ESIS);
1520 b2 = gen_cmp(2, BPF_H, (0x03<<8) | ISO10589_ISIS);
1521 gen_or(b1, b2);
1522 gen_or(b0, b2);
1523 return b2;
1524
1525 default:
1526 return gen_false();
1527 }
1528 break;
1529 }
1530
1531 /*
1532 * All the types that have no encapsulation should either be
1533 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
1534 * all packets are IP packets, or should be handled in some
1535 * special case, if none of them are (if some are and some
1536 * aren't, the lack of encapsulation is a problem, as we'd
1537 * have to find some other way of determining the packet type).
1538 *
1539 * Therefore, if "off_linktype" is -1, there's an error.
1540 */
1541 if (off_linktype == -1)
1542 abort();
1543
1544 /*
1545 * Any type not handled above should always have an Ethernet
1546 * type at an offset of "off_linktype". (PPP is partially
1547 * handled above - the protocol type is mapped from the
1548 * Ethernet and LLC types we use internally to the corresponding
1549 * PPP type - but the PPP type is always specified by a value
1550 * at "off_linktype", so we don't have to do the code generation
1551 * above.)
1552 */
1553 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1554 }
1555
1556 /*
1557 * Check for an LLC SNAP packet with a given organization code and
1558 * protocol type; we check the entire contents of the 802.2 LLC and
1559 * snap headers, checking for DSAP and SSAP of SNAP and a control
1560 * field of 0x03 in the LLC header, and for the specified organization
1561 * code and protocol type in the SNAP header.
1562 */
1563 static struct block *
1564 gen_snap(orgcode, ptype, offset)
1565 bpf_u_int32 orgcode;
1566 bpf_u_int32 ptype;
1567 u_int offset;
1568 {
1569 u_char snapblock[8];
1570
1571 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */
1572 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
1573 snapblock[2] = 0x03; /* control = UI */
1574 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
1575 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */
1576 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */
1577 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */
1578 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */
1579 return gen_bcmp(offset, 8, snapblock);
1580 }
1581
1582 static struct block *
1583 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
1584 bpf_u_int32 addr;
1585 bpf_u_int32 mask;
1586 int dir, proto;
1587 u_int src_off, dst_off;
1588 {
1589 struct block *b0, *b1;
1590 u_int offset;
1591
1592 switch (dir) {
1593
1594 case Q_SRC:
1595 offset = src_off;
1596 break;
1597
1598 case Q_DST:
1599 offset = dst_off;
1600 break;
1601
1602 case Q_AND:
1603 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1604 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1605 gen_and(b0, b1);
1606 return b1;
1607
1608 case Q_OR:
1609 case Q_DEFAULT:
1610 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1611 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1612 gen_or(b0, b1);
1613 return b1;
1614
1615 default:
1616 abort();
1617 }
1618 b0 = gen_linktype(proto);
1619 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
1620 gen_and(b0, b1);
1621 return b1;
1622 }
1623
1624 #ifdef INET6
1625 static struct block *
1626 gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
1627 struct in6_addr *addr;
1628 struct in6_addr *mask;
1629 int dir, proto;
1630 u_int src_off, dst_off;
1631 {
1632 struct block *b0, *b1;
1633 u_int offset;
1634 u_int32_t *a, *m;
1635
1636 switch (dir) {
1637
1638 case Q_SRC:
1639 offset = src_off;
1640 break;
1641
1642 case Q_DST:
1643 offset = dst_off;
1644 break;
1645
1646 case Q_AND:
1647 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1648 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1649 gen_and(b0, b1);
1650 return b1;
1651
1652 case Q_OR:
1653 case Q_DEFAULT:
1654 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1655 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1656 gen_or(b0, b1);
1657 return b1;
1658
1659 default:
1660 abort();
1661 }
1662 /* this order is important */
1663 a = (u_int32_t *)addr;
1664 m = (u_int32_t *)mask;
1665 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
1666 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
1667 gen_and(b0, b1);
1668 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
1669 gen_and(b0, b1);
1670 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
1671 gen_and(b0, b1);
1672 b0 = gen_linktype(proto);
1673 gen_and(b0, b1);
1674 return b1;
1675 }
1676 #endif /*INET6*/
1677
1678 static struct block *
1679 gen_ehostop(eaddr, dir)
1680 register const u_char *eaddr;
1681 register int dir;
1682 {
1683 register struct block *b0, *b1;
1684
1685 switch (dir) {
1686 case Q_SRC:
1687 return gen_bcmp(6, 6, eaddr);
1688
1689 case Q_DST:
1690 return gen_bcmp(0, 6, eaddr);
1691
1692 case Q_AND:
1693 b0 = gen_ehostop(eaddr, Q_SRC);
1694 b1 = gen_ehostop(eaddr, Q_DST);
1695 gen_and(b0, b1);
1696 return b1;
1697
1698 case Q_DEFAULT:
1699 case Q_OR:
1700 b0 = gen_ehostop(eaddr, Q_SRC);
1701 b1 = gen_ehostop(eaddr, Q_DST);
1702 gen_or(b0, b1);
1703 return b1;
1704 }
1705 abort();
1706 /* NOTREACHED */
1707 }
1708
1709 /*
1710 * Like gen_ehostop, but for DLT_FDDI
1711 */
1712 static struct block *
1713 gen_fhostop(eaddr, dir)
1714 register const u_char *eaddr;
1715 register int dir;
1716 {
1717 struct block *b0, *b1;
1718
1719 switch (dir) {
1720 case Q_SRC:
1721 #ifdef PCAP_FDDIPAD
1722 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
1723 #else
1724 return gen_bcmp(6 + 1, 6, eaddr);
1725 #endif
1726
1727 case Q_DST:
1728 #ifdef PCAP_FDDIPAD
1729 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
1730 #else
1731 return gen_bcmp(0 + 1, 6, eaddr);
1732 #endif
1733
1734 case Q_AND:
1735 b0 = gen_fhostop(eaddr, Q_SRC);
1736 b1 = gen_fhostop(eaddr, Q_DST);
1737 gen_and(b0, b1);
1738 return b1;
1739
1740 case Q_DEFAULT:
1741 case Q_OR:
1742 b0 = gen_fhostop(eaddr, Q_SRC);
1743 b1 = gen_fhostop(eaddr, Q_DST);
1744 gen_or(b0, b1);
1745 return b1;
1746 }
1747 abort();
1748 /* NOTREACHED */
1749 }
1750
1751 /*
1752 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
1753 */
1754 static struct block *
1755 gen_thostop(eaddr, dir)
1756 register const u_char *eaddr;
1757 register int dir;
1758 {
1759 register struct block *b0, *b1;
1760
1761 switch (dir) {
1762 case Q_SRC:
1763 return gen_bcmp(8, 6, eaddr);
1764
1765 case Q_DST:
1766 return gen_bcmp(2, 6, eaddr);
1767
1768 case Q_AND:
1769 b0 = gen_thostop(eaddr, Q_SRC);
1770 b1 = gen_thostop(eaddr, Q_DST);
1771 gen_and(b0, b1);
1772 return b1;
1773
1774 case Q_DEFAULT:
1775 case Q_OR:
1776 b0 = gen_thostop(eaddr, Q_SRC);
1777 b1 = gen_thostop(eaddr, Q_DST);
1778 gen_or(b0, b1);
1779 return b1;
1780 }
1781 abort();
1782 /* NOTREACHED */
1783 }
1784
1785 /*
1786 * This is quite tricky because there may be pad bytes in front of the
1787 * DECNET header, and then there are two possible data packet formats that
1788 * carry both src and dst addresses, plus 5 packet types in a format that
1789 * carries only the src node, plus 2 types that use a different format and
1790 * also carry just the src node.
1791 *
1792 * Yuck.
1793 *
1794 * Instead of doing those all right, we just look for data packets with
1795 * 0 or 1 bytes of padding. If you want to look at other packets, that
1796 * will require a lot more hacking.
1797 *
1798 * To add support for filtering on DECNET "areas" (network numbers)
1799 * one would want to add a "mask" argument to this routine. That would
1800 * make the filter even more inefficient, although one could be clever
1801 * and not generate masking instructions if the mask is 0xFFFF.
1802 */
1803 static struct block *
1804 gen_dnhostop(addr, dir, base_off)
1805 bpf_u_int32 addr;
1806 int dir;
1807 u_int base_off;
1808 {
1809 struct block *b0, *b1, *b2, *tmp;
1810 u_int offset_lh; /* offset if long header is received */
1811 u_int offset_sh; /* offset if short header is received */
1812
1813 switch (dir) {
1814
1815 case Q_DST:
1816 offset_sh = 1; /* follows flags */
1817 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */
1818 break;
1819
1820 case Q_SRC:
1821 offset_sh = 3; /* follows flags, dstnode */
1822 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
1823 break;
1824
1825 case Q_AND:
1826 /* Inefficient because we do our Calvinball dance twice */
1827 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1828 b1 = gen_dnhostop(addr, Q_DST, base_off);
1829 gen_and(b0, b1);
1830 return b1;
1831
1832 case Q_OR:
1833 case Q_DEFAULT:
1834 /* Inefficient because we do our Calvinball dance twice */
1835 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1836 b1 = gen_dnhostop(addr, Q_DST, base_off);
1837 gen_or(b0, b1);
1838 return b1;
1839
1840 case Q_ISO:
1841 bpf_error("ISO host filtering not implemented");
1842
1843 default:
1844 abort();
1845 }
1846 b0 = gen_linktype(ETHERTYPE_DN);
1847 /* Check for pad = 1, long header case */
1848 tmp = gen_mcmp(base_off + 2, BPF_H,
1849 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
1850 b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
1851 BPF_H, (bpf_int32)ntohs(addr));
1852 gen_and(tmp, b1);
1853 /* Check for pad = 0, long header case */
1854 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
1855 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
1856 gen_and(tmp, b2);
1857 gen_or(b2, b1);
1858 /* Check for pad = 1, short header case */
1859 tmp = gen_mcmp(base_off + 2, BPF_H,
1860 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
1861 b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
1862 BPF_H, (bpf_int32)ntohs(addr));
1863 gen_and(tmp, b2);
1864 gen_or(b2, b1);
1865 /* Check for pad = 0, short header case */
1866 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
1867 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
1868 gen_and(tmp, b2);
1869 gen_or(b2, b1);
1870
1871 /* Combine with test for linktype */
1872 gen_and(b0, b1);
1873 return b1;
1874 }
1875
1876 static struct block *
1877 gen_host(addr, mask, proto, dir)
1878 bpf_u_int32 addr;
1879 bpf_u_int32 mask;
1880 int proto;
1881 int dir;
1882 {
1883 struct block *b0, *b1;
1884
1885 switch (proto) {
1886
1887 case Q_DEFAULT:
1888 b0 = gen_host(addr, mask, Q_IP, dir);
1889 if (off_linktype != -1) {
1890 b1 = gen_host(addr, mask, Q_ARP, dir);
1891 gen_or(b0, b1);
1892 b0 = gen_host(addr, mask, Q_RARP, dir);
1893 gen_or(b1, b0);
1894 }
1895 return b0;
1896
1897 case Q_IP:
1898 return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
1899 off_nl + 12, off_nl + 16);
1900
1901 case Q_RARP:
1902 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
1903 off_nl + 14, off_nl + 24);
1904
1905 case Q_ARP:
1906 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
1907 off_nl + 14, off_nl + 24);
1908
1909 case Q_TCP:
1910 bpf_error("'tcp' modifier applied to host");
1911
1912 case Q_SCTP:
1913 bpf_error("'sctp' modifier applied to host");
1914
1915 case Q_UDP:
1916 bpf_error("'udp' modifier applied to host");
1917
1918 case Q_ICMP:
1919 bpf_error("'icmp' modifier applied to host");
1920
1921 case Q_IGMP:
1922 bpf_error("'igmp' modifier applied to host");
1923
1924 case Q_IGRP:
1925 bpf_error("'igrp' modifier applied to host");
1926
1927 case Q_PIM:
1928 bpf_error("'pim' modifier applied to host");
1929
1930 case Q_VRRP:
1931 bpf_error("'vrrp' modifier applied to host");
1932
1933 case Q_ATALK:
1934 bpf_error("ATALK host filtering not implemented");
1935
1936 case Q_AARP:
1937 bpf_error("AARP host filtering not implemented");
1938
1939 case Q_DECNET:
1940 return gen_dnhostop(addr, dir, off_nl);
1941
1942 case Q_SCA:
1943 bpf_error("SCA host filtering not implemented");
1944
1945 case Q_LAT:
1946 bpf_error("LAT host filtering not implemented");
1947
1948 case Q_MOPDL:
1949 bpf_error("MOPDL host filtering not implemented");
1950
1951 case Q_MOPRC:
1952 bpf_error("MOPRC host filtering not implemented");
1953
1954 #ifdef INET6
1955 case Q_IPV6:
1956 bpf_error("'ip6' modifier applied to ip host");
1957
1958 case Q_ICMPV6:
1959 bpf_error("'icmp6' modifier applied to host");
1960 #endif /* INET6 */
1961
1962 case Q_AH:
1963 bpf_error("'ah' modifier applied to host");
1964
1965 case Q_ESP:
1966 bpf_error("'esp' modifier applied to host");
1967
1968 case Q_ISO:
1969 bpf_error("ISO host filtering not implemented");
1970
1971 case Q_ESIS:
1972 bpf_error("'esis' modifier applied to host");
1973
1974 case Q_ISIS:
1975 bpf_error("'isis' modifier applied to host");
1976
1977 case Q_CLNP:
1978 bpf_error("'clnp' modifier applied to host");
1979
1980 case Q_STP:
1981 bpf_error("'stp' modifier applied to host");
1982
1983 case Q_IPX:
1984 bpf_error("IPX host filtering not implemented");
1985
1986 case Q_NETBEUI:
1987 bpf_error("'netbeui' modifier applied to host");
1988
1989 default:
1990 abort();
1991 }
1992 /* NOTREACHED */
1993 }
1994
1995 #ifdef INET6
1996 static struct block *
1997 gen_host6(addr, mask, proto, dir)
1998 struct in6_addr *addr;
1999 struct in6_addr *mask;
2000 int proto;
2001 int dir;
2002 {
2003 switch (proto) {
2004
2005 case Q_DEFAULT:
2006 return gen_host6(addr, mask, Q_IPV6, dir);
2007
2008 case Q_IP:
2009 bpf_error("'ip' modifier applied to ip6 host");
2010
2011 case Q_RARP:
2012 bpf_error("'rarp' modifier applied to ip6 host");
2013
2014 case Q_ARP:
2015 bpf_error("'arp' modifier applied to ip6 host");
2016
2017 case Q_SCTP:
2018 bpf_error("'sctp' modifier applied to host");
2019
2020 case Q_TCP:
2021 bpf_error("'tcp' modifier applied to host");
2022
2023 case Q_UDP:
2024 bpf_error("'udp' modifier applied to host");
2025
2026 case Q_ICMP:
2027 bpf_error("'icmp' modifier applied to host");
2028
2029 case Q_IGMP:
2030 bpf_error("'igmp' modifier applied to host");
2031
2032 case Q_IGRP:
2033 bpf_error("'igrp' modifier applied to host");
2034
2035 case Q_PIM:
2036 bpf_error("'pim' modifier applied to host");
2037
2038 case Q_VRRP:
2039 bpf_error("'vrrp' modifier applied to host");
2040
2041 case Q_ATALK:
2042 bpf_error("ATALK host filtering not implemented");
2043
2044 case Q_AARP:
2045 bpf_error("AARP host filtering not implemented");
2046
2047 case Q_DECNET:
2048 bpf_error("'decnet' modifier applied to ip6 host");
2049
2050 case Q_SCA:
2051 bpf_error("SCA host filtering not implemented");
2052
2053 case Q_LAT:
2054 bpf_error("LAT host filtering not implemented");
2055
2056 case Q_MOPDL:
2057 bpf_error("MOPDL host filtering not implemented");
2058
2059 case Q_MOPRC:
2060 bpf_error("MOPRC host filtering not implemented");
2061
2062 case Q_IPV6:
2063 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
2064 off_nl + 8, off_nl + 24);
2065
2066 case Q_ICMPV6:
2067 bpf_error("'icmp6' modifier applied to host");
2068
2069 case Q_AH:
2070 bpf_error("'ah' modifier applied to host");
2071
2072 case Q_ESP:
2073 bpf_error("'esp' modifier applied to host");
2074
2075 case Q_ISO:
2076 bpf_error("ISO host filtering not implemented");
2077
2078 case Q_ESIS:
2079 bpf_error("'esis' modifier applied to host");
2080
2081 case Q_ISIS:
2082 bpf_error("'isis' modifier applied to host");
2083
2084 case Q_CLNP:
2085 bpf_error("'clnp' modifier applied to host");
2086
2087 case Q_STP:
2088 bpf_error("'stp' modifier applied to host");
2089
2090 case Q_IPX:
2091 bpf_error("IPX host filtering not implemented");
2092
2093 case Q_NETBEUI:
2094 bpf_error("'netbeui' modifier applied to host");
2095
2096 default:
2097 abort();
2098 }
2099 /* NOTREACHED */
2100 }
2101 #endif /*INET6*/
2102
2103 #ifndef INET6
2104 static struct block *
2105 gen_gateway(eaddr, alist, proto, dir)
2106 const u_char *eaddr;
2107 bpf_u_int32 **alist;
2108 int proto;
2109 int dir;
2110 {
2111 struct block *b0, *b1, *tmp;
2112
2113 if (dir != 0)
2114 bpf_error("direction applied to 'gateway'");
2115
2116 switch (proto) {
2117 case Q_DEFAULT:
2118 case Q_IP:
2119 case Q_ARP:
2120 case Q_RARP:
2121 if (linktype == DLT_EN10MB)
2122 b0 = gen_ehostop(eaddr, Q_OR);
2123 else if (linktype == DLT_FDDI)
2124 b0 = gen_fhostop(eaddr, Q_OR);
2125 else if (linktype == DLT_IEEE802)
2126 b0 = gen_thostop(eaddr, Q_OR);
2127 else
2128 bpf_error(
2129 "'gateway' supported only on ethernet, FDDI or token ring");
2130
2131 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
2132 while (*alist) {
2133 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR);
2134 gen_or(b1, tmp);
2135 b1 = tmp;
2136 }
2137 gen_not(b1);
2138 gen_and(b0, b1);
2139 return b1;
2140 }
2141 bpf_error("illegal modifier of 'gateway'");
2142 /* NOTREACHED */
2143 }
2144 #endif
2145
2146 struct block *
2147 gen_proto_abbrev(proto)
2148 int proto;
2149 {
2150 #ifdef INET6
2151 struct block *b0;
2152 #endif
2153 struct block *b1;
2154
2155 switch (proto) {
2156
2157 case Q_SCTP:
2158 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT);
2159 #ifdef INET6
2160 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT);
2161 gen_or(b0, b1);
2162 #endif
2163 break;
2164
2165 case Q_TCP:
2166 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
2167 #ifdef INET6
2168 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
2169 gen_or(b0, b1);
2170 #endif
2171 break;
2172
2173 case Q_UDP:
2174 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT);
2175 #ifdef INET6
2176 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
2177 gen_or(b0, b1);
2178 #endif
2179 break;
2180
2181 case Q_ICMP:
2182 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT);
2183 break;
2184
2185 #ifndef IPPROTO_IGMP
2186 #define IPPROTO_IGMP 2
2187 #endif
2188
2189 case Q_IGMP:
2190 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT);
2191 break;
2192
2193 #ifndef IPPROTO_IGRP
2194 #define IPPROTO_IGRP 9
2195 #endif
2196 case Q_IGRP:
2197 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT);
2198 break;
2199
2200 #ifndef IPPROTO_PIM
2201 #define IPPROTO_PIM 103
2202 #endif
2203
2204 case Q_PIM:
2205 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT);
2206 #ifdef INET6
2207 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
2208 gen_or(b0, b1);
2209 #endif
2210 break;
2211
2212 #ifndef IPPROTO_VRRP
2213 #define IPPROTO_VRRP 112
2214 #endif
2215
2216 case Q_VRRP:
2217 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT);
2218 break;
2219
2220 case Q_IP:
2221 b1 = gen_linktype(ETHERTYPE_IP);
2222 break;
2223
2224 case Q_ARP:
2225 b1 = gen_linktype(ETHERTYPE_ARP);
2226 break;
2227
2228 case Q_RARP:
2229 b1 = gen_linktype(ETHERTYPE_REVARP);
2230 break;
2231
2232 case Q_LINK:
2233 bpf_error("link layer applied in wrong context");
2234
2235 case Q_ATALK:
2236 b1 = gen_linktype(ETHERTYPE_ATALK);
2237 break;
2238
2239 case Q_AARP:
2240 b1 = gen_linktype(ETHERTYPE_AARP);
2241 break;
2242
2243 case Q_DECNET:
2244 b1 = gen_linktype(ETHERTYPE_DN);
2245 break;
2246
2247 case Q_SCA:
2248 b1 = gen_linktype(ETHERTYPE_SCA);
2249 break;
2250
2251 case Q_LAT:
2252 b1 = gen_linktype(ETHERTYPE_LAT);
2253 break;
2254
2255 case Q_MOPDL:
2256 b1 = gen_linktype(ETHERTYPE_MOPDL);
2257 break;
2258
2259 case Q_MOPRC:
2260 b1 = gen_linktype(ETHERTYPE_MOPRC);
2261 break;
2262
2263 #ifdef INET6
2264 case Q_IPV6:
2265 b1 = gen_linktype(ETHERTYPE_IPV6);
2266 break;
2267
2268 #ifndef IPPROTO_ICMPV6
2269 #define IPPROTO_ICMPV6 58
2270 #endif
2271 case Q_ICMPV6:
2272 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
2273 break;
2274 #endif /* INET6 */
2275
2276 #ifndef IPPROTO_AH
2277 #define IPPROTO_AH 51
2278 #endif
2279 case Q_AH:
2280 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT);
2281 #ifdef INET6
2282 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT);
2283 gen_or(b0, b1);
2284 #endif
2285 break;
2286
2287 #ifndef IPPROTO_ESP
2288 #define IPPROTO_ESP 50
2289 #endif
2290 case Q_ESP:
2291 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT);
2292 #ifdef INET6
2293 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
2294 gen_or(b0, b1);
2295 #endif
2296 break;
2297
2298 case Q_ISO:
2299 b1 = gen_linktype(LLCSAP_ISONS);
2300 break;
2301
2302 case Q_ESIS:
2303 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT);
2304 break;
2305
2306 case Q_ISIS:
2307 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
2308 break;
2309
2310 case Q_CLNP:
2311 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT);
2312 break;
2313
2314 case Q_STP:
2315 b1 = gen_linktype(LLCSAP_8021D);
2316 break;
2317
2318 case Q_IPX:
2319 b1 = gen_linktype(LLCSAP_IPX);
2320 break;
2321
2322 case Q_NETBEUI:
2323 b1 = gen_linktype(LLCSAP_NETBEUI);
2324 break;
2325
2326 default:
2327 abort();
2328 }
2329 return b1;
2330 }
2331
2332 static struct block *
2333 gen_ipfrag()
2334 {
2335 struct slist *s;
2336 struct block *b;
2337
2338 /* not ip frag */
2339 s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
2340 s->s.k = off_nl + 6;
2341 b = new_block(JMP(BPF_JSET));
2342 b->s.k = 0x1fff;
2343 b->stmts = s;
2344 gen_not(b);
2345
2346 return b;
2347 }
2348
2349 static struct block *
2350 gen_portatom(off, v)
2351 int off;
2352 bpf_int32 v;
2353 {
2354 struct slist *s;
2355 struct block *b;
2356
2357 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2358 s->s.k = off_nl;
2359
2360 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
2361 s->next->s.k = off_nl + off;
2362
2363 b = new_block(JMP(BPF_JEQ));
2364 b->stmts = s;
2365 b->s.k = v;
2366
2367 return b;
2368 }
2369
2370 #ifdef INET6
2371 static struct block *
2372 gen_portatom6(off, v)
2373 int off;
2374 bpf_int32 v;
2375 {
2376 return gen_cmp(off_nl + 40 + off, BPF_H, v);
2377 }
2378 #endif/*INET6*/
2379
2380 struct block *
2381 gen_portop(port, proto, dir)
2382 int port, proto, dir;
2383 {
2384 struct block *b0, *b1, *tmp;
2385
2386 /* ip proto 'proto' */
2387 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
2388 b0 = gen_ipfrag();
2389 gen_and(tmp, b0);
2390
2391 switch (dir) {
2392 case Q_SRC:
2393 b1 = gen_portatom(0, (bpf_int32)port);
2394 break;
2395
2396 case Q_DST:
2397 b1 = gen_portatom(2, (bpf_int32)port);
2398 break;
2399
2400 case Q_OR:
2401 case Q_DEFAULT:
2402 tmp = gen_portatom(0, (bpf_int32)port);
2403 b1 = gen_portatom(2, (bpf_int32)port);
2404 gen_or(tmp, b1);
2405 break;
2406
2407 case Q_AND:
2408 tmp = gen_portatom(0, (bpf_int32)port);
2409 b1 = gen_portatom(2, (bpf_int32)port);
2410 gen_and(tmp, b1);
2411 break;
2412
2413 default:
2414 abort();
2415 }
2416 gen_and(b0, b1);
2417
2418 return b1;
2419 }
2420
2421 static struct block *
2422 gen_port(port, ip_proto, dir)
2423 int port;
2424 int ip_proto;
2425 int dir;
2426 {
2427 struct block *b0, *b1, *tmp;
2428
2429 /* ether proto ip */
2430 b0 = gen_linktype(ETHERTYPE_IP);
2431
2432 switch (ip_proto) {
2433 case IPPROTO_UDP:
2434 case IPPROTO_TCP:
2435 case IPPROTO_SCTP:
2436 b1 = gen_portop(port, ip_proto, dir);
2437 break;
2438
2439 case PROTO_UNDEF:
2440 tmp = gen_portop(port, IPPROTO_TCP, dir);
2441 b1 = gen_portop(port, IPPROTO_UDP, dir);
2442 gen_or(tmp, b1);
2443 tmp = gen_portop(port, IPPROTO_SCTP, dir);
2444 gen_or(tmp, b1);
2445 break;
2446
2447 default:
2448 abort();
2449 }
2450 gen_and(b0, b1);
2451 return b1;
2452 }
2453
2454 #ifdef INET6
2455 struct block *
2456 gen_portop6(port, proto, dir)
2457 int port, proto, dir;
2458 {
2459 struct block *b0, *b1, *tmp;
2460
2461 /* ip proto 'proto' */
2462 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
2463
2464 switch (dir) {
2465 case Q_SRC:
2466 b1 = gen_portatom6(0, (bpf_int32)port);
2467 break;
2468
2469 case Q_DST:
2470 b1 = gen_portatom6(2, (bpf_int32)port);
2471 break;
2472
2473 case Q_OR:
2474 case Q_DEFAULT:
2475 tmp = gen_portatom6(0, (bpf_int32)port);
2476 b1 = gen_portatom6(2, (bpf_int32)port);
2477 gen_or(tmp, b1);
2478 break;
2479
2480 case Q_AND:
2481 tmp = gen_portatom6(0, (bpf_int32)port);
2482 b1 = gen_portatom6(2, (bpf_int32)port);
2483 gen_and(tmp, b1);
2484 break;
2485
2486 default:
2487 abort();
2488 }
2489 gen_and(b0, b1);
2490
2491 return b1;
2492 }
2493
2494 static struct block *
2495 gen_port6(port, ip_proto, dir)
2496 int port;
2497 int ip_proto;
2498 int dir;
2499 {
2500 struct block *b0, *b1, *tmp;
2501
2502 /* ether proto ip */
2503 b0 = gen_linktype(ETHERTYPE_IPV6);
2504
2505 switch (ip_proto) {
2506 case IPPROTO_UDP:
2507 case IPPROTO_TCP:
2508 case IPPROTO_SCTP:
2509 b1 = gen_portop6(port, ip_proto, dir);
2510 break;
2511
2512 case PROTO_UNDEF:
2513 tmp = gen_portop6(port, IPPROTO_TCP, dir);
2514 b1 = gen_portop6(port, IPPROTO_UDP, dir);
2515 gen_or(tmp, b1);
2516 tmp = gen_portop6(port, IPPROTO_SCTP, dir);
2517 gen_or(tmp, b1);
2518 break;
2519
2520 default:
2521 abort();
2522 }
2523 gen_and(b0, b1);
2524 return b1;
2525 }
2526 #endif /* INET6 */
2527
2528 static int
2529 lookup_proto(name, proto)
2530 register const char *name;
2531 register int proto;
2532 {
2533 register int v;
2534
2535 switch (proto) {
2536
2537 case Q_DEFAULT:
2538 case Q_IP:
2539 case Q_IPV6:
2540 v = pcap_nametoproto(name);
2541 if (v == PROTO_UNDEF)
2542 bpf_error("unknown ip proto '%s'", name);
2543 break;
2544
2545 case Q_LINK:
2546 /* XXX should look up h/w protocol type based on linktype */
2547 v = pcap_nametoeproto(name);
2548 if (v == PROTO_UNDEF)
2549 bpf_error("unknown ether proto '%s'", name);
2550 break;
2551
2552 case Q_ISO:
2553 if (strcmp(name, "esis") == 0)
2554 v = ISO9542_ESIS;
2555 else if (strcmp(name, "isis") == 0)
2556 v = ISO10589_ISIS;
2557 else if (strcmp(name, "clnp") == 0)
2558 v = ISO8473_CLNP;
2559 else
2560 bpf_error("unknown osi proto '%s'", name);
2561 break;
2562
2563 default:
2564 v = PROTO_UNDEF;
2565 break;
2566 }
2567 return v;
2568 }
2569
2570 #if 0
2571 struct stmt *
2572 gen_joinsp(s, n)
2573 struct stmt **s;
2574 int n;
2575 {
2576 return NULL;
2577 }
2578 #endif
2579
2580 static struct block *
2581 gen_protochain(v, proto, dir)
2582 int v;
2583 int proto;
2584 int dir;
2585 {
2586 #ifdef NO_PROTOCHAIN
2587 return gen_proto(v, proto, dir);
2588 #else
2589 struct block *b0, *b;
2590 struct slist *s[100];
2591 int fix2, fix3, fix4, fix5;
2592 int ahcheck, again, end;
2593 int i, max;
2594 int reg2 = alloc_reg();
2595
2596 memset(s, 0, sizeof(s));
2597 fix2 = fix3 = fix4 = fix5 = 0;
2598
2599 switch (proto) {
2600 case Q_IP:
2601 case Q_IPV6:
2602 break;
2603 case Q_DEFAULT:
2604 b0 = gen_protochain(v, Q_IP, dir);
2605 b = gen_protochain(v, Q_IPV6, dir);
2606 gen_or(b0, b);
2607 return b;
2608 default:
2609 bpf_error("bad protocol applied for 'protochain'");
2610 /*NOTREACHED*/
2611 }
2612
2613 no_optimize = 1; /*this code is not compatible with optimzer yet */
2614
2615 /*
2616 * s[0] is a dummy entry to protect other BPF insn from damaged
2617 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
2618 * hard to find interdependency made by jump table fixup.
2619 */
2620 i = 0;
2621 s[i] = new_stmt(0); /*dummy*/
2622 i++;
2623
2624 switch (proto) {
2625 case Q_IP:
2626 b0 = gen_linktype(ETHERTYPE_IP);
2627
2628 /* A = ip->ip_p */
2629 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2630 s[i]->s.k = off_nl + 9;
2631 i++;
2632 /* X = ip->ip_hl << 2 */
2633 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2634 s[i]->s.k = off_nl;
2635 i++;
2636 break;
2637 #ifdef INET6
2638 case Q_IPV6:
2639 b0 = gen_linktype(ETHERTYPE_IPV6);
2640
2641 /* A = ip6->ip_nxt */
2642 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2643 s[i]->s.k = off_nl + 6;
2644 i++;
2645 /* X = sizeof(struct ip6_hdr) */
2646 s[i] = new_stmt(BPF_LDX|BPF_IMM);
2647 s[i]->s.k = 40;
2648 i++;
2649 break;
2650 #endif
2651 default:
2652 bpf_error("unsupported proto to gen_protochain");
2653 /*NOTREACHED*/
2654 }
2655
2656 /* again: if (A == v) goto end; else fall through; */
2657 again = i;
2658 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2659 s[i]->s.k = v;
2660 s[i]->s.jt = NULL; /*later*/
2661 s[i]->s.jf = NULL; /*update in next stmt*/
2662 fix5 = i;
2663 i++;
2664
2665 #ifndef IPPROTO_NONE
2666 #define IPPROTO_NONE 59
2667 #endif
2668 /* if (A == IPPROTO_NONE) goto end */
2669 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2670 s[i]->s.jt = NULL; /*later*/
2671 s[i]->s.jf = NULL; /*update in next stmt*/
2672 s[i]->s.k = IPPROTO_NONE;
2673 s[fix5]->s.jf = s[i];
2674 fix2 = i;
2675 i++;
2676
2677 #ifdef INET6
2678 if (proto == Q_IPV6) {
2679 int v6start, v6end, v6advance, j;
2680
2681 v6start = i;
2682 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
2683 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2684 s[i]->s.jt = NULL; /*later*/
2685 s[i]->s.jf = NULL; /*update in next stmt*/
2686 s[i]->s.k = IPPROTO_HOPOPTS;
2687 s[fix2]->s.jf = s[i];
2688 i++;
2689 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
2690 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2691 s[i]->s.jt = NULL; /*later*/
2692 s[i]->s.jf = NULL; /*update in next stmt*/
2693 s[i]->s.k = IPPROTO_DSTOPTS;
2694 i++;
2695 /* if (A == IPPROTO_ROUTING) goto v6advance */
2696 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2697 s[i]->s.jt = NULL; /*later*/
2698 s[i]->s.jf = NULL; /*update in next stmt*/
2699 s[i]->s.k = IPPROTO_ROUTING;
2700 i++;
2701 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
2702 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2703 s[i]->s.jt = NULL; /*later*/
2704 s[i]->s.jf = NULL; /*later*/
2705 s[i]->s.k = IPPROTO_FRAGMENT;
2706 fix3 = i;
2707 v6end = i;
2708 i++;
2709
2710 /* v6advance: */
2711 v6advance = i;
2712
2713 /*
2714 * in short,
2715 * A = P[X];
2716 * X = X + (P[X + 1] + 1) * 8;
2717 */
2718 /* A = X */
2719 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2720 i++;
2721 /* A = P[X + packet head] */
2722 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2723 s[i]->s.k = off_nl;
2724 i++;
2725 /* MEM[reg2] = A */
2726 s[i] = new_stmt(BPF_ST);
2727 s[i]->s.k = reg2;
2728 i++;
2729 /* A = X */
2730 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2731 i++;
2732 /* A += 1 */
2733 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2734 s[i]->s.k = 1;
2735 i++;
2736 /* X = A */
2737 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2738 i++;
2739 /* A = P[X + packet head]; */
2740 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2741 s[i]->s.k = off_nl;
2742 i++;
2743 /* A += 1 */
2744 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2745 s[i]->s.k = 1;
2746 i++;
2747 /* A *= 8 */
2748 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2749 s[i]->s.k = 8;
2750 i++;
2751 /* X = A; */
2752 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2753 i++;
2754 /* A = MEM[reg2] */
2755 s[i] = new_stmt(BPF_LD|BPF_MEM);
2756 s[i]->s.k = reg2;
2757 i++;
2758
2759 /* goto again; (must use BPF_JA for backward jump) */
2760 s[i] = new_stmt(BPF_JMP|BPF_JA);
2761 s[i]->s.k = again - i - 1;
2762 s[i - 1]->s.jf = s[i];
2763 i++;
2764
2765 /* fixup */
2766 for (j = v6start; j <= v6end; j++)
2767 s[j]->s.jt = s[v6advance];
2768 } else
2769 #endif
2770 {
2771 /* nop */
2772 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2773 s[i]->s.k = 0;
2774 s[fix2]->s.jf = s[i];
2775 i++;
2776 }
2777
2778 /* ahcheck: */
2779 ahcheck = i;
2780 /* if (A == IPPROTO_AH) then fall through; else goto end; */
2781 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2782 s[i]->s.jt = NULL; /*later*/
2783 s[i]->s.jf = NULL; /*later*/
2784 s[i]->s.k = IPPROTO_AH;
2785 if (fix3)
2786 s[fix3]->s.jf = s[ahcheck];
2787 fix4 = i;
2788 i++;
2789
2790 /*
2791 * in short,
2792 * A = P[X];
2793 * X = X + (P[X + 1] + 2) * 4;
2794 */
2795 /* A = X */
2796 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2797 i++;
2798 /* A = P[X + packet head]; */
2799 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2800 s[i]->s.k = off_nl;
2801 i++;
2802 /* MEM[reg2] = A */
2803 s[i] = new_stmt(BPF_ST);
2804 s[i]->s.k = reg2;
2805 i++;
2806 /* A = X */
2807 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2808 i++;
2809 /* A += 1 */
2810 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2811 s[i]->s.k = 1;
2812 i++;
2813 /* X = A */
2814 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2815 i++;
2816 /* A = P[X + packet head] */
2817 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2818 s[i]->s.k = off_nl;
2819 i++;
2820 /* A += 2 */
2821 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2822 s[i]->s.k = 2;
2823 i++;
2824 /* A *= 4 */
2825 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2826 s[i]->s.k = 4;
2827 i++;
2828 /* X = A; */
2829 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2830 i++;
2831 /* A = MEM[reg2] */
2832 s[i] = new_stmt(BPF_LD|BPF_MEM);
2833 s[i]->s.k = reg2;
2834 i++;
2835
2836 /* goto again; (must use BPF_JA for backward jump) */
2837 s[i] = new_stmt(BPF_JMP|BPF_JA);
2838 s[i]->s.k = again - i - 1;
2839 i++;
2840
2841 /* end: nop */
2842 end = i;
2843 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2844 s[i]->s.k = 0;
2845 s[fix2]->s.jt = s[end];
2846 s[fix4]->s.jf = s[end];
2847 s[fix5]->s.jt = s[end];
2848 i++;
2849
2850 /*
2851 * make slist chain
2852 */
2853 max = i;
2854 for (i = 0; i < max - 1; i++)
2855 s[i]->next = s[i + 1];
2856 s[max - 1]->next = NULL;
2857
2858 /*
2859 * emit final check
2860 */
2861 b = new_block(JMP(BPF_JEQ));
2862 b->stmts = s[1]; /*remember, s[0] is dummy*/
2863 b->s.k = v;
2864
2865 free_reg(reg2);
2866
2867 gen_and(b0, b);
2868 return b;
2869 #endif
2870 }
2871
2872 static struct block *
2873 gen_proto(v, proto, dir)
2874 int v;
2875 int proto;
2876 int dir;
2877 {
2878 struct block *b0, *b1;
2879
2880 if (dir != Q_DEFAULT)
2881 bpf_error("direction applied to 'proto'");
2882
2883 switch (proto) {
2884 case Q_DEFAULT:
2885 #ifdef INET6
2886 b0 = gen_proto(v, Q_IP, dir);
2887 b1 = gen_proto(v, Q_IPV6, dir);
2888 gen_or(b0, b1);
2889 return b1;
2890 #else
2891 /*FALLTHROUGH*/
2892 #endif
2893 case Q_IP:
2894 b0 = gen_linktype(ETHERTYPE_IP);
2895 #ifndef CHASE_CHAIN
2896 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
2897 #else
2898 b1 = gen_protochain(v, Q_IP);
2899 #endif
2900 gen_and(b0, b1);
2901 return b1;
2902
2903 case Q_ISO:
2904 switch (linktype) {
2905
2906 case DLT_FRELAY:
2907 /*
2908 * Frame Relay packets typically have an OSI
2909 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)"
2910 * generates code to check for all the OSI
2911 * NLPIDs, so calling it and then adding a check
2912 * for the particular NLPID for which we're
2913 * looking is bogus, as we can just check for
2914 * the NLPID.
2915 *
2916 * What we check for is the NLPID and a frame
2917 * control field value of UI, i.e. 0x03 followed
2918 * by the NLPID.
2919 *
2920 * XXX - assumes a 2-byte Frame Relay header with
2921 * DLCI and flags. What if the address is longer?
2922 *
2923 * XXX - what about SNAP-encapsulated frames?
2924 */
2925 return gen_cmp(2, BPF_H, (0x03<<8) | v);
2926 break;
2927
2928 default:
2929 b0 = gen_linktype(LLCSAP_ISONS);
2930 b1 = gen_cmp(off_nl_nosnap, BPF_B, (long)v);
2931 gen_and(b0, b1);
2932 return b1;
2933 }
2934
2935 case Q_ARP:
2936 bpf_error("arp does not encapsulate another protocol");
2937 /* NOTREACHED */
2938
2939 case Q_RARP:
2940 bpf_error("rarp does not encapsulate another protocol");
2941 /* NOTREACHED */
2942
2943 case Q_ATALK:
2944 bpf_error("atalk encapsulation is not specifiable");
2945 /* NOTREACHED */
2946
2947 case Q_DECNET:
2948 bpf_error("decnet encapsulation is not specifiable");
2949 /* NOTREACHED */
2950
2951 case Q_SCA:
2952 bpf_error("sca does not encapsulate another protocol");
2953 /* NOTREACHED */
2954
2955 case Q_LAT:
2956 bpf_error("lat does not encapsulate another protocol");
2957 /* NOTREACHED */
2958
2959 case Q_MOPRC:
2960 bpf_error("moprc does not encapsulate another protocol");
2961 /* NOTREACHED */
2962
2963 case Q_MOPDL:
2964 bpf_error("mopdl does not encapsulate another protocol");
2965 /* NOTREACHED */
2966
2967 case Q_LINK:
2968 return gen_linktype(v);
2969
2970 case Q_UDP:
2971 bpf_error("'udp proto' is bogus");
2972 /* NOTREACHED */
2973
2974 case Q_TCP:
2975 bpf_error("'tcp proto' is bogus");
2976 /* NOTREACHED */
2977
2978 case Q_SCTP:
2979 bpf_error("'sctp proto' is bogus");
2980 /* NOTREACHED */
2981
2982 case Q_ICMP:
2983 bpf_error("'icmp proto' is bogus");
2984 /* NOTREACHED */
2985
2986 case Q_IGMP:
2987 bpf_error("'igmp proto' is bogus");
2988 /* NOTREACHED */
2989
2990 case Q_IGRP:
2991 bpf_error("'igrp proto' is bogus");
2992 /* NOTREACHED */
2993
2994 case Q_PIM:
2995 bpf_error("'pim proto' is bogus");
2996 /* NOTREACHED */
2997
2998 case Q_VRRP:
2999 bpf_error("'vrrp proto' is bogus");
3000 /* NOTREACHED */
3001
3002 #ifdef INET6
3003 case Q_IPV6:
3004 b0 = gen_linktype(ETHERTYPE_IPV6);
3005 #ifndef CHASE_CHAIN
3006 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
3007 #else
3008 b1 = gen_protochain(v, Q_IPV6);
3009 #endif
3010 gen_and(b0, b1);
3011 return b1;
3012
3013 case Q_ICMPV6:
3014 bpf_error("'icmp6 proto' is bogus");
3015 #endif /* INET6 */
3016
3017 case Q_AH:
3018 bpf_error("'ah proto' is bogus");
3019
3020 case Q_ESP:
3021 bpf_error("'ah proto' is bogus");
3022
3023 case Q_STP:
3024 bpf_error("'stp proto' is bogus");
3025
3026 case Q_IPX:
3027 bpf_error("'ipx proto' is bogus");
3028
3029 case Q_NETBEUI:
3030 bpf_error("'netbeui proto' is bogus");
3031
3032 default:
3033 abort();
3034 /* NOTREACHED */
3035 }
3036 /* NOTREACHED */
3037 }
3038
3039 struct block *
3040 gen_scode(name, q)
3041 register const char *name;
3042 struct qual q;
3043 {
3044 int proto = q.proto;
3045 int dir = q.dir;
3046 int tproto;
3047 u_char *eaddr;
3048 bpf_u_int32 mask, addr;
3049 #ifndef INET6
3050 bpf_u_int32 **alist;
3051 #else
3052 int tproto6;
3053 struct sockaddr_in *sin;
3054 struct sockaddr_in6 *sin6;
3055 struct addrinfo *res, *res0;
3056 struct in6_addr mask128;
3057 #endif /*INET6*/
3058 struct block *b, *tmp;
3059 int port, real_proto;
3060
3061 switch (q.addr) {
3062
3063 case Q_NET:
3064 addr = pcap_nametonetaddr(name);
3065 if (addr == 0)
3066 bpf_error("unknown network '%s'", name);
3067 /* Left justify network addr and calculate its network mask */
3068 mask = 0xffffffff;
3069 while (addr && (addr & 0xff000000) == 0) {
3070 addr <<= 8;
3071 mask <<= 8;
3072 }
3073 return gen_host(addr, mask, proto, dir);
3074
3075 case Q_DEFAULT:
3076 case Q_HOST:
3077 if (proto == Q_LINK) {
3078 switch (linktype) {
3079
3080 case DLT_EN10MB:
3081 eaddr = pcap_ether_hostton(name);
3082 if (eaddr == NULL)
3083 bpf_error(
3084 "unknown ether host '%s'", name);
3085 b = gen_ehostop(eaddr, dir);
3086 free(eaddr);
3087 return b;
3088
3089 case DLT_FDDI:
3090 eaddr = pcap_ether_hostton(name);
3091 if (eaddr == NULL)
3092 bpf_error(
3093 "unknown FDDI host '%s'", name);
3094 b = gen_fhostop(eaddr, dir);
3095 free(eaddr);
3096 return b;
3097
3098 case DLT_IEEE802:
3099 eaddr = pcap_ether_hostton(name);
3100 if (eaddr == NULL)
3101 bpf_error(
3102 "unknown token ring host '%s'", name);
3103 b = gen_thostop(eaddr, dir);
3104 free(eaddr);
3105 return b;
3106
3107 default:
3108 bpf_error(
3109 "only ethernet/FDDI/token ring supports link-level host name");
3110 break;
3111 }
3112 } else if (proto == Q_DECNET) {
3113 unsigned short dn_addr = __pcap_nametodnaddr(name);
3114 /*
3115 * I don't think DECNET hosts can be multihomed, so
3116 * there is no need to build up a list of addresses
3117 */
3118 return (gen_host(dn_addr, 0, proto, dir));
3119 } else {
3120 #ifndef INET6
3121 alist = pcap_nametoaddr(name);
3122 if (alist == NULL || *alist == NULL)
3123 bpf_error("unknown host '%s'", name);
3124 tproto = proto;
3125 if (off_linktype == -1 && tproto == Q_DEFAULT)
3126 tproto = Q_IP;
3127 b = gen_host(**alist++, 0xffffffff, tproto, dir);
3128 while (*alist) {
3129 tmp = gen_host(**alist++, 0xffffffff,
3130 tproto, dir);
3131 gen_or(b, tmp);
3132 b = tmp;
3133 }
3134 return b;
3135 #else
3136 memset(&mask128, 0xff, sizeof(mask128));
3137 res0 = res = pcap_nametoaddrinfo(name);
3138 if (res == NULL)
3139 bpf_error("unknown host '%s'", name);
3140 b = tmp = NULL;
3141 tproto = tproto6 = proto;
3142 if (off_linktype == -1 && tproto == Q_DEFAULT) {
3143 tproto = Q_IP;
3144 tproto6 = Q_IPV6;
3145 }
3146 for (res = res0; res; res = res->ai_next) {
3147 switch (res->ai_family) {
3148 case AF_INET:
3149 if (tproto == Q_IPV6)
3150 continue;
3151
3152 sin = (struct sockaddr_in *)
3153 res->ai_addr;
3154 tmp = gen_host(ntohl(sin->sin_addr.s_addr),
3155 0xffffffff, tproto, dir);
3156 break;
3157 case AF_INET6:
3158 if (tproto6 == Q_IP)
3159 continue;
3160
3161 sin6 = (struct sockaddr_in6 *)
3162 res->ai_addr;
3163 tmp = gen_host6(&sin6->sin6_addr,
3164 &mask128, tproto6, dir);
3165 break;
3166 default:
3167 continue;
3168 }
3169 if (b)
3170 gen_or(b, tmp);
3171 b = tmp;
3172 }
3173 freeaddrinfo(res0);
3174 if (b == NULL) {
3175 bpf_error("unknown host '%s'%s", name,
3176 (proto == Q_DEFAULT)
3177 ? ""
3178 : " for specified address family");
3179 }
3180 return b;
3181 #endif /*INET6*/
3182 }
3183
3184 case Q_PORT:
3185 if (proto != Q_DEFAULT &&
3186 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
3187 bpf_error("illegal qualifier of 'port'");
3188 if (pcap_nametoport(name, &port, &real_proto) == 0)
3189 bpf_error("unknown port '%s'", name);
3190 if (proto == Q_UDP) {
3191 if (real_proto == IPPROTO_TCP)
3192 bpf_error("port '%s' is tcp", name);
3193 else if (real_proto == IPPROTO_SCTP)
3194 bpf_error("port '%s' is sctp", name);
3195 else
3196 /* override PROTO_UNDEF */
3197 real_proto = IPPROTO_UDP;
3198 }
3199 if (proto == Q_TCP) {
3200 if (real_proto == IPPROTO_UDP)
3201 bpf_error("port '%s' is udp", name);
3202
3203 else if (real_proto == IPPROTO_SCTP)
3204 bpf_error("port '%s' is sctp", name);
3205 else
3206 /* override PROTO_UNDEF */
3207 real_proto = IPPROTO_TCP;
3208 }
3209 if (proto == Q_SCTP) {
3210 if (real_proto == IPPROTO_UDP)
3211 bpf_error("port '%s' is udp", name);
3212
3213 else if (real_proto == IPPROTO_TCP)
3214 bpf_error("port '%s' is tcp", name);
3215 else
3216 /* override PROTO_UNDEF */
3217 real_proto = IPPROTO_SCTP;
3218 }
3219 #ifndef INET6
3220 return gen_port(port, real_proto, dir);
3221 #else
3222 {
3223 struct block *b;
3224 b = gen_port(port, real_proto, dir);
3225 gen_or(gen_port6(port, real_proto, dir), b);
3226 return b;
3227 }
3228 #endif /* INET6 */
3229
3230 case Q_GATEWAY:
3231 #ifndef INET6
3232 eaddr = pcap_ether_hostton(name);
3233 if (eaddr == NULL)
3234 bpf_error("unknown ether host: %s", name);
3235
3236 alist = pcap_nametoaddr(name);
3237 if (alist == NULL || *alist == NULL)
3238 bpf_error("unknown host '%s'", name);
3239 b = gen_gateway(eaddr, alist, proto, dir);
3240 free(eaddr);
3241 return b;
3242 #else
3243 bpf_error("'gateway' not supported in this configuration");
3244 #endif /*INET6*/
3245
3246 case Q_PROTO:
3247 real_proto = lookup_proto(name, proto);
3248 if (real_proto >= 0)
3249 return gen_proto(real_proto, proto, dir);
3250 else
3251 bpf_error("unknown protocol: %s", name);
3252
3253 case Q_PROTOCHAIN:
3254 real_proto = lookup_proto(name, proto);
3255 if (real_proto >= 0)
3256 return gen_protochain(real_proto, proto, dir);
3257 else
3258 bpf_error("unknown protocol: %s", name);
3259
3260
3261 case Q_UNDEF:
3262 syntax();
3263 /* NOTREACHED */
3264 }
3265 abort();
3266 /* NOTREACHED */
3267 }
3268
3269 struct block *
3270 gen_mcode(s1, s2, masklen, q)
3271 register const char *s1, *s2;
3272 register int masklen;
3273 struct qual q;
3274 {
3275 register int nlen, mlen;
3276 bpf_u_int32 n, m;
3277
3278 nlen = __pcap_atoin(s1, &n);
3279 /* Promote short ipaddr */
3280 n <<= 32 - nlen;
3281
3282 if (s2 != NULL) {
3283 mlen = __pcap_atoin(s2, &m);
3284 /* Promote short ipaddr */
3285 m <<= 32 - mlen;
3286 if ((n & ~m) != 0)
3287 bpf_error("non-network bits set in \"%s mask %s\"",
3288 s1, s2);
3289 } else {
3290 /* Convert mask len to mask */
3291 if (masklen > 32)
3292 bpf_error("mask length must be <= 32");
3293 m = 0xffffffff << (32 - masklen);
3294 if ((n & ~m) != 0)
3295 bpf_error("non-network bits set in \"%s/%d\"",
3296 s1, masklen);
3297 }
3298
3299 switch (q.addr) {
3300
3301 case Q_NET:
3302 return gen_host(n, m, q.proto, q.dir);
3303
3304 default:
3305 bpf_error("Mask syntax for networks only");
3306 /* NOTREACHED */
3307 }
3308 }
3309
3310 struct block *
3311 gen_ncode(s, v, q)
3312 register const char *s;
3313 bpf_u_int32 v;
3314 struct qual q;
3315 {
3316 bpf_u_int32 mask;
3317 int proto = q.proto;
3318 int dir = q.dir;
3319 register int vlen;
3320
3321 if (s == NULL)
3322 vlen = 32;
3323 else if (q.proto == Q_DECNET)
3324 vlen = __pcap_atodn(s, &v);
3325 else
3326 vlen = __pcap_atoin(s, &v);
3327
3328 switch (q.addr) {
3329
3330 case Q_DEFAULT:
3331 case Q_HOST:
3332 case Q_NET:
3333 if (proto == Q_DECNET)
3334 return gen_host(v, 0, proto, dir);
3335 else if (proto == Q_LINK) {
3336 bpf_error("illegal link layer address");
3337 } else {
3338 mask = 0xffffffff;
3339 if (s == NULL && q.addr == Q_NET) {
3340 /* Promote short net number */
3341 while (v && (v & 0xff000000) == 0) {
3342 v <<= 8;
3343 mask <<= 8;
3344 }
3345 } else {
3346 /* Promote short ipaddr */
3347 v <<= 32 - vlen;
3348 mask <<= 32 - vlen;
3349 }
3350 return gen_host(v, mask, proto, dir);
3351 }
3352
3353 case Q_PORT:
3354 if (proto == Q_UDP)
3355 proto = IPPROTO_UDP;
3356 else if (proto == Q_TCP)
3357 proto = IPPROTO_TCP;
3358 else if (proto == Q_SCTP)
3359 proto = IPPROTO_SCTP;
3360 else if (proto == Q_DEFAULT)
3361 proto = PROTO_UNDEF;
3362 else
3363 bpf_error("illegal qualifier of 'port'");
3364
3365 #ifndef INET6
3366 return gen_port((int)v, proto, dir);
3367 #else
3368 {
3369 struct block *b;
3370 b = gen_port((int)v, proto, dir);
3371 gen_or(gen_port6((int)v, proto, dir), b);
3372 return b;
3373 }
3374 #endif /* INET6 */
3375
3376 case Q_GATEWAY:
3377 bpf_error("'gateway' requires a name");
3378 /* NOTREACHED */
3379
3380 case Q_PROTO:
3381 return gen_proto((int)v, proto, dir);
3382
3383 case Q_PROTOCHAIN:
3384 return gen_protochain((int)v, proto, dir);
3385
3386 case Q_UNDEF:
3387 syntax();
3388 /* NOTREACHED */
3389
3390 default:
3391 abort();
3392 /* NOTREACHED */
3393 }
3394 /* NOTREACHED */
3395 }
3396
3397 #ifdef INET6
3398 struct block *
3399 gen_mcode6(s1, s2, masklen, q)
3400 register const char *s1, *s2;
3401 register int masklen;
3402 struct qual q;
3403 {
3404 struct addrinfo *res;
3405 struct in6_addr *addr;
3406 struct in6_addr mask;
3407 struct block *b;
3408 u_int32_t *a, *m;
3409
3410 if (s2)
3411 bpf_error("no mask %s supported", s2);
3412
3413 res = pcap_nametoaddrinfo(s1);
3414 if (!res)
3415 bpf_error("invalid ip6 address %s", s1);
3416 if (res->ai_next)
3417 bpf_error("%s resolved to multiple address", s1);
3418 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
3419
3420 if (sizeof(mask) * 8 < masklen)
3421 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
3422 memset(&mask, 0, sizeof(mask));
3423 memset(&mask, 0xff, masklen / 8);
3424 if (masklen % 8) {
3425 mask.s6_addr[masklen / 8] =
3426 (0xff << (8 - masklen % 8)) & 0xff;
3427 }
3428
3429 a = (u_int32_t *)addr;
3430 m = (u_int32_t *)&mask;
3431 if ((a[0] & ~m[0]) || (a[1] & ~m[1])
3432 || (a[2] & ~m[2]) || (a[3] & ~m[3])) {
3433 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen);
3434 }
3435
3436 switch (q.addr) {
3437
3438 case Q_DEFAULT:
3439 case Q_HOST:
3440 if (masklen != 128)
3441 bpf_error("Mask syntax for networks only");
3442 /* FALLTHROUGH */
3443
3444 case Q_NET:
3445 b = gen_host6(addr, &mask, q.proto, q.dir);
3446 freeaddrinfo(res);
3447 return b;
3448
3449 default:
3450 bpf_error("invalid qualifier against IPv6 address");
3451 /* NOTREACHED */
3452 }
3453 }
3454 #endif /*INET6*/
3455
3456 struct block *
3457 gen_ecode(eaddr, q)
3458 register const u_char *eaddr;
3459 struct qual q;
3460 {
3461 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
3462 if (linktype == DLT_EN10MB)
3463 return gen_ehostop(eaddr, (int)q.dir);
3464 if (linktype == DLT_FDDI)
3465 return gen_fhostop(eaddr, (int)q.dir);
3466 if (linktype == DLT_IEEE802)
3467 return gen_thostop(eaddr, (int)q.dir);
3468 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring");
3469 }
3470 bpf_error("ethernet address used in non-ether expression");
3471 /* NOTREACHED */
3472 }
3473
3474 void
3475 sappend(s0, s1)
3476 struct slist *s0, *s1;
3477 {
3478 /*
3479 * This is definitely not the best way to do this, but the
3480 * lists will rarely get long.
3481 */
3482 while (s0->next)
3483 s0 = s0->next;
3484 s0->next = s1;
3485 }
3486
3487 static struct slist *
3488 xfer_to_x(a)
3489 struct arth *a;
3490 {
3491 struct slist *s;
3492
3493 s = new_stmt(BPF_LDX|BPF_MEM);
3494 s->s.k = a->regno;
3495 return s;
3496 }
3497
3498 static struct slist *
3499 xfer_to_a(a)
3500 struct arth *a;
3501 {
3502 struct slist *s;
3503
3504 s = new_stmt(BPF_LD|BPF_MEM);
3505 s->s.k = a->regno;
3506 return s;
3507 }
3508
3509 struct arth *
3510 gen_load(proto, index, size)
3511 int proto;
3512 struct arth *index;
3513 int size;
3514 {
3515 struct slist *s, *tmp;
3516 struct block *b;
3517 int regno = alloc_reg();
3518
3519 free_reg(index->regno);
3520 switch (size) {
3521
3522 default:
3523 bpf_error("data size must be 1, 2, or 4");
3524
3525 case 1:
3526 size = BPF_B;
3527 break;
3528
3529 case 2:
3530 size = BPF_H;
3531 break;
3532
3533 case 4:
3534 size = BPF_W;
3535 break;
3536 }
3537 switch (proto) {
3538 default:
3539 bpf_error("unsupported index operation");
3540
3541 case Q_LINK:
3542 s = xfer_to_x(index);
3543 tmp = new_stmt(BPF_LD|BPF_IND|size);
3544 sappend(s, tmp);
3545 sappend(index->s, s);
3546 break;
3547
3548 case Q_IP:
3549 case Q_ARP:
3550 case Q_RARP:
3551 case Q_ATALK:
3552 case Q_DECNET:
3553 case Q_SCA:
3554 case Q_LAT:
3555 case Q_MOPRC:
3556 case Q_MOPDL:
3557 #ifdef INET6
3558 case Q_IPV6:
3559 #endif
3560 /* XXX Note that we assume a fixed link header here. */
3561 s = xfer_to_x(index);
3562 tmp = new_stmt(BPF_LD|BPF_IND|size);
3563 tmp->s.k = off_nl;
3564 sappend(s, tmp);
3565 sappend(index->s, s);
3566
3567 b = gen_proto_abbrev(proto);
3568 if (index->b)
3569 gen_and(index->b, b);
3570 index->b = b;
3571 break;
3572
3573 case Q_SCTP:
3574 case Q_TCP:
3575 case Q_UDP:
3576 case Q_ICMP:
3577 case Q_IGMP:
3578 case Q_IGRP:
3579 case Q_PIM:
3580 case Q_VRRP:
3581 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
3582 s->s.k = off_nl;
3583 sappend(s, xfer_to_a(index));
3584 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
3585 sappend(s, new_stmt(BPF_MISC|BPF_TAX));
3586 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
3587 tmp->s.k = off_nl;
3588 sappend(index->s, s);
3589
3590 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
3591 if (index->b)
3592 gen_and(index->b, b);
3593 #ifdef INET6
3594 gen_and(gen_proto_abbrev(Q_IP), b);
3595 #endif
3596 index->b = b;
3597 break;
3598 #ifdef INET6
3599 case Q_ICMPV6:
3600 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
3601 /*NOTREACHED*/
3602 #endif
3603 }
3604 index->regno = regno;
3605 s = new_stmt(BPF_ST);
3606 s->s.k = regno;
3607 sappend(index->s, s);
3608
3609 return index;
3610 }
3611
3612 struct block *
3613 gen_relation(code, a0, a1, reversed)
3614 int code;
3615 struct arth *a0, *a1;
3616 int reversed;
3617 {
3618 struct slist *s0, *s1, *s2;
3619 struct block *b, *tmp;
3620
3621 s0 = xfer_to_x(a1);
3622 s1 = xfer_to_a(a0);
3623 if (code == BPF_JEQ) {
3624 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X);
3625 b = new_block(JMP(code));
3626 sappend(s1, s2);
3627 }
3628 else
3629 b = new_block(BPF_JMP|code|BPF_X);
3630 if (reversed)
3631 gen_not(b);
3632
3633 sappend(s0, s1);
3634 sappend(a1->s, s0);
3635 sappend(a0->s, a1->s);
3636
3637 b->stmts = a0->s;
3638
3639 free_reg(a0->regno);
3640 free_reg(a1->regno);
3641
3642 /* 'and' together protocol checks */
3643 if (a0->b) {
3644 if (a1->b) {
3645 gen_and(a0->b, tmp = a1->b);
3646 }
3647 else
3648 tmp = a0->b;
3649 } else
3650 tmp = a1->b;
3651
3652 if (tmp)
3653 gen_and(tmp, b);
3654
3655 return b;
3656 }
3657
3658 struct arth *
3659 gen_loadlen()
3660 {
3661 int regno = alloc_reg();
3662 struct arth *a = (struct arth *)newchunk(sizeof(*a));
3663 struct slist *s;
3664
3665 s = new_stmt(BPF_LD|BPF_LEN);
3666 s->next = new_stmt(BPF_ST);
3667 s->next->s.k = regno;
3668 a->s = s;
3669 a->regno = regno;
3670
3671 return a;
3672 }
3673
3674 struct arth *
3675 gen_loadi(val)
3676 int val;
3677 {
3678 struct arth *a;
3679 struct slist *s;
3680 int reg;
3681
3682 a = (struct arth *)newchunk(sizeof(*a));
3683
3684 reg = alloc_reg();
3685
3686 s = new_stmt(BPF_LD|BPF_IMM);
3687 s->s.k = val;
3688 s->next = new_stmt(BPF_ST);
3689 s->next->s.k = reg;
3690 a->s = s;
3691 a->regno = reg;
3692
3693 return a;
3694 }
3695
3696 struct arth *
3697 gen_neg(a)
3698 struct arth *a;
3699 {
3700 struct slist *s;
3701
3702 s = xfer_to_a(a);
3703 sappend(a->s, s);
3704 s = new_stmt(BPF_ALU|BPF_NEG);
3705 s->s.k = 0;
3706 sappend(a->s, s);
3707 s = new_stmt(BPF_ST);
3708 s->s.k = a->regno;
3709 sappend(a->s, s);
3710
3711 return a;
3712 }
3713
3714 struct arth *
3715 gen_arth(code, a0, a1)
3716 int code;
3717 struct arth *a0, *a1;
3718 {
3719 struct slist *s0, *s1, *s2;
3720
3721 s0 = xfer_to_x(a1);
3722 s1 = xfer_to_a(a0);
3723 s2 = new_stmt(BPF_ALU|BPF_X|code);
3724
3725 sappend(s1, s2);
3726 sappend(s0, s1);
3727 sappend(a1->s, s0);
3728 sappend(a0->s, a1->s);
3729
3730 free_reg(a0->regno);
3731 free_reg(a1->regno);
3732
3733 s0 = new_stmt(BPF_ST);
3734 a0->regno = s0->s.k = alloc_reg();
3735 sappend(a0->s, s0);
3736
3737 return a0;
3738 }
3739
3740 /*
3741 * Here we handle simple allocation of the scratch registers.
3742 * If too many registers are alloc'd, the allocator punts.
3743 */
3744 static int regused[BPF_MEMWORDS];
3745 static int curreg;
3746
3747 /*
3748 * Return the next free register.
3749 */
3750 static int
3751 alloc_reg()
3752 {
3753 int n = BPF_MEMWORDS;
3754
3755 while (--n >= 0) {
3756 if (regused[curreg])
3757 curreg = (curreg + 1) % BPF_MEMWORDS;
3758 else {
3759 regused[curreg] = 1;
3760 return curreg;
3761 }
3762 }
3763 bpf_error("too many registers needed to evaluate expression");
3764 /* NOTREACHED */
3765 }
3766
3767 /*
3768 * Return a register to the table so it can
3769 * be used later.
3770 */
3771 static void
3772 free_reg(n)
3773 int n;
3774 {
3775 regused[n] = 0;
3776 }
3777
3778 static struct block *
3779 gen_len(jmp, n)
3780 int jmp, n;
3781 {
3782 struct slist *s;
3783 struct block *b;
3784
3785 s = new_stmt(BPF_LD|BPF_LEN);
3786 b = new_block(JMP(jmp));
3787 b->stmts = s;
3788 b->s.k = n;
3789
3790 return b;
3791 }
3792
3793 struct block *
3794 gen_greater(n)
3795 int n;
3796 {
3797 return gen_len(BPF_JGE, n);
3798 }
3799
3800 /*
3801 * Actually, this is less than or equal.
3802 */
3803 struct block *
3804 gen_less(n)
3805 int n;
3806 {
3807 struct block *b;
3808
3809 b = gen_len(BPF_JGT, n);
3810 gen_not(b);
3811
3812 return b;
3813 }
3814
3815 struct block *
3816 gen_byteop(op, idx, val)
3817 int op, idx, val;
3818 {
3819 struct block *b;
3820 struct slist *s;
3821
3822 switch (op) {
3823 default:
3824 abort();
3825
3826 case '=':
3827 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3828
3829 case '<':
3830 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3831 b->s.code = JMP(BPF_JGE);
3832 gen_not(b);
3833 return b;
3834
3835 case '>':
3836 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3837 b->s.code = JMP(BPF_JGT);
3838 return b;
3839
3840 case '|':
3841 s = new_stmt(BPF_ALU|BPF_OR|BPF_K);
3842 break;
3843
3844 case '&':
3845 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
3846 break;
3847 }
3848 s->s.k = val;
3849 b = new_block(JMP(BPF_JEQ));
3850 b->stmts = s;
3851 gen_not(b);
3852
3853 return b;
3854 }
3855
3856 static u_char abroadcast[] = { 0x0 };
3857
3858 struct block *
3859 gen_broadcast(proto)
3860 int proto;
3861 {
3862 bpf_u_int32 hostmask;
3863 struct block *b0, *b1, *b2;
3864 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3865
3866 switch (proto) {
3867
3868 case Q_DEFAULT:
3869 case Q_LINK:
3870 if (linktype == DLT_ARCNET)
3871 return gen_ahostop(abroadcast, Q_DST);
3872 if (linktype == DLT_EN10MB)
3873 return gen_ehostop(ebroadcast, Q_DST);
3874 if (linktype == DLT_FDDI)
3875 return gen_fhostop(ebroadcast, Q_DST);
3876 if (linktype == DLT_IEEE802)
3877 return gen_thostop(ebroadcast, Q_DST);
3878 bpf_error("not a broadcast link");
3879 break;
3880
3881 case Q_IP:
3882 b0 = gen_linktype(ETHERTYPE_IP);
3883 hostmask = ~netmask;
3884 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
3885 b2 = gen_mcmp(off_nl + 16, BPF_W,
3886 (bpf_int32)(~0 & hostmask), hostmask);
3887 gen_or(b1, b2);
3888 gen_and(b0, b2);
3889 return b2;
3890 }
3891 bpf_error("only ether/ip broadcast filters supported");
3892 }
3893
3894 struct block *
3895 gen_multicast(proto)
3896 int proto;
3897 {
3898 register struct block *b0, *b1;
3899 register struct slist *s;
3900
3901 switch (proto) {
3902
3903 case Q_DEFAULT:
3904 case Q_LINK:
3905 if (linktype == DLT_ARCNET)
3906 /* all ARCnet multicasts use the same address */
3907 return gen_ahostop(abroadcast, Q_DST);
3908
3909 if (linktype == DLT_EN10MB) {
3910 /* ether[0] & 1 != 0 */
3911 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3912 s->s.k = 0;
3913 b0 = new_block(JMP(BPF_JSET));
3914 b0->s.k = 1;
3915 b0->stmts = s;
3916 return b0;
3917 }
3918
3919 if (linktype == DLT_FDDI) {
3920 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */
3921 /* fddi[1] & 1 != 0 */
3922 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3923 s->s.k = 1;
3924 b0 = new_block(JMP(BPF_JSET));
3925 b0->s.k = 1;
3926 b0->stmts = s;
3927 return b0;
3928 }
3929
3930 /* TODO - check how token ring handles multicast */
3931 /* if (linktype == DLT_IEEE802) ... */
3932
3933 /* Link not known to support multicasts */
3934 break;
3935
3936 case Q_IP:
3937 b0 = gen_linktype(ETHERTYPE_IP);
3938 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
3939 b1->s.code = JMP(BPF_JGE);
3940 gen_and(b0, b1);
3941 return b1;
3942
3943 #ifdef INET6
3944 case Q_IPV6:
3945 b0 = gen_linktype(ETHERTYPE_IPV6);
3946 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
3947 gen_and(b0, b1);
3948 return b1;
3949 #endif /* INET6 */
3950 }
3951 bpf_error("only IP multicast filters supported on ethernet/FDDI");
3952 }
3953
3954 /*
3955 * generate command for inbound/outbound. It's here so we can
3956 * make it link-type specific. 'dir' = 0 implies "inbound",
3957 * = 1 implies "outbound".
3958 */
3959 struct block *
3960 gen_inbound(dir)
3961 int dir;
3962 {
3963 register struct block *b0;
3964
3965 /*
3966 * Only some data link types support inbound/outbound qualifiers.
3967 */
3968 switch (linktype) {
3969 case DLT_SLIP:
3970 case DLT_PPP:
3971 b0 = gen_relation(BPF_JEQ,
3972 gen_load(Q_LINK, gen_loadi(0), 1),
3973 gen_loadi(0),
3974 dir);
3975 break;
3976
3977 default:
3978 bpf_error("inbound/outbound not supported on linktype %d\n",
3979 linktype);
3980 b0 = NULL;
3981 /* NOTREACHED */
3982 }
3983 return (b0);
3984 }
3985
3986 struct block *
3987 gen_acode(eaddr, q)
3988 register const u_char *eaddr;
3989 struct qual q;
3990 {
3991 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
3992 if (linktype == DLT_ARCNET)
3993 return gen_ahostop(eaddr, (int)q.dir);
3994 }
3995 bpf_error("ARCnet address used in non-arc expression");
3996 /* NOTREACHED */
3997 }
3998
3999 static struct block *
4000 gen_ahostop(eaddr, dir)
4001 register const u_char *eaddr;
4002 register int dir;
4003 {
4004 register struct block *b0, *b1;
4005
4006 switch (dir) {
4007 /* src comes first, different from Ethernet */
4008 case Q_SRC:
4009 return gen_bcmp(0, 1, eaddr);
4010
4011 case Q_DST:
4012 return gen_bcmp(1, 1, eaddr);
4013
4014 case Q_AND:
4015 b0 = gen_ahostop(eaddr, Q_SRC);
4016 b1 = gen_ahostop(eaddr, Q_DST);
4017 gen_and(b0, b1);
4018 return b1;
4019
4020 case Q_DEFAULT:
4021 case Q_OR:
4022 b0 = gen_ahostop(eaddr, Q_SRC);
4023 b1 = gen_ahostop(eaddr, Q_DST);
4024 gen_or(b0, b1);
4025 return b1;
4026 }
4027 abort();
4028 /* NOTREACHED */
4029 }
4030
4031 /*
4032 * support IEEE 802.1Q VLAN trunk over ethernet
4033 */
4034 struct block *
4035 gen_vlan(vlan_num)
4036 int vlan_num;
4037 {
4038 struct block *b0;
4039
4040 /*
4041 * Change the offsets to point to the type and data fields within
4042 * the VLAN packet. This is somewhat of a kludge.
4043 */
4044 if (orig_nl == (u_int)-1) {
4045 orig_linktype = off_linktype; /* save original values */
4046 orig_nl = off_nl;
4047 orig_nl_nosnap = off_nl_nosnap;
4048
4049 switch (linktype) {
4050
4051 case DLT_EN10MB:
4052 off_linktype = 16;
4053 off_nl_nosnap = 18;
4054 off_nl = 18;
4055 break;
4056
4057 default:
4058 bpf_error("no VLAN support for data link type %d",
4059 linktype);
4060 /*NOTREACHED*/
4061 }
4062 }
4063
4064 /* check for VLAN */
4065 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
4066
4067 /* If a specific VLAN is requested, check VLAN id */
4068 if (vlan_num >= 0) {
4069 struct block *b1;
4070
4071 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num);
4072 gen_and(b0, b1);
4073 b0 = b1;
4074 }
4075
4076 return (b0);
4077 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism