]> The Tcpdump Group git mirrors - libpcap/blob - gencode.c
projects / libpcap / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
backport the changes over the weekend from HEAD to 0_9
[libpcap] / gencode.c
1 /*#define CHASE_CHAIN*/
2 /*
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22 #ifndef lint
23 static const char rcsid[] _U_ =
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.2 2005-04-10 18:04:50 hannes Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #ifdef WIN32
32 #include <pcap-stdinc.h>
33 #else /* WIN32 */
34 #include <sys/types.h>
35 #include <sys/socket.h>
36 #endif /* WIN32 */
37
38 /*
39 * XXX - why was this included even on UNIX?
40 */
41 #ifdef __MINGW32__
42 #include "IP6_misc.h"
43 #endif
44
45 #ifndef WIN32
46
47 #ifdef __NetBSD__
48 #include <sys/param.h>
49 #endif
50
51 #include <netinet/in.h>
52
53 #endif /* WIN32 */
54
55 #include <stdlib.h>
56 #include <string.h>
57 #include <memory.h>
58 #include <setjmp.h>
59 #include <stdarg.h>
60
61 #ifdef MSDOS
62 #include "pcap-dos.h"
63 #endif
64
65 #include "pcap-int.h"
66
67 #include "ethertype.h"
68 #include "nlpid.h"
69 #include "llc.h"
70 #include "gencode.h"
71 #include "atmuni31.h"
72 #include "sunatmpos.h"
73 #include "ppp.h"
74 #include "sll.h"
75 #include "arcnet.h"
76 #include "pf.h"
77 #ifndef offsetof
78 #define offsetof(s, e) ((size_t)&((s *)0)->e)
79 #endif
80 #ifdef INET6
81 #ifndef WIN32
82 #include <netdb.h> /* for "struct addrinfo" */
83 #endif /* WIN32 */
84 #endif /*INET6*/
85 #include <pcap-namedb.h>
86
87 #define ETHERMTU 1500
88
89 #ifndef IPPROTO_SCTP
90 #define IPPROTO_SCTP 132
91 #endif
92
93 #ifdef HAVE_OS_PROTO_H
94 #include "os-proto.h"
95 #endif
96
97 #define JMP(c) ((c)|BPF_JMP|BPF_K)
98
99 /* Locals */
100 static jmp_buf top_ctx;
101 static pcap_t *bpf_pcap;
102
103 /* Hack for updating VLAN, MPLS offsets. */
104 static u_int orig_linktype = -1U, orig_nl = -1U, orig_nl_nosnap = -1U;
105
106 /* XXX */
107 #ifdef PCAP_FDDIPAD
108 static int pcap_fddipad;
109 #endif
110
111 /* VARARGS */
112 void
113 bpf_error(const char *fmt, ...)
114
115 {
116 va_list ap;
117
118 va_start(ap, fmt);
119 if (bpf_pcap != NULL)
120 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE,
121 fmt, ap);
122 va_end(ap);
123 longjmp(top_ctx, 1);
124 /* NOTREACHED */
125 }
126
127 static void init_linktype(pcap_t *);
128
129 static int alloc_reg(void);
130 static void free_reg(int);
131
132 static struct block *root;
133
134 /*
135 * We divy out chunks of memory rather than call malloc each time so
136 * we don't have to worry about leaking memory. It's probably
137 * not a big deal if all this memory was wasted but if this ever
138 * goes into a library that would probably not be a good idea.
139 *
140 * XXX - this *is* in a library....
141 */
142 #define NCHUNKS 16
143 #define CHUNK0SIZE 1024
144 struct chunk {
145 u_int n_left;
146 void *m;
147 };
148
149 static struct chunk chunks[NCHUNKS];
150 static int cur_chunk;
151
152 static void *newchunk(u_int);
153 static void freechunks(void);
154 static inline struct block *new_block(int);
155 static inline struct slist *new_stmt(int);
156 static struct block *gen_retblk(int);
157 static inline void syntax(void);
158
159 static void backpatch(struct block *, struct block *);
160 static void merge(struct block *, struct block *);
161 static struct block *gen_cmp(u_int, u_int, bpf_int32);
162 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
163 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
164 static struct block *gen_bcmp(u_int, u_int, const u_char *);
165 static struct block *gen_ncmp(bpf_u_int32, bpf_u_int32, bpf_u_int32,
166 bpf_u_int32, bpf_u_int32, int);
167 static struct block *gen_uncond(int);
168 static inline struct block *gen_true(void);
169 static inline struct block *gen_false(void);
170 static struct block *gen_ether_linktype(int);
171 static struct block *gen_linux_sll_linktype(int);
172 static struct block *gen_linktype(int);
173 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
174 static struct block *gen_llc_linktype(int);
175 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
176 #ifdef INET6
177 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
178 #endif
179 static struct block *gen_ahostop(const u_char *, int);
180 static struct block *gen_ehostop(const u_char *, int);
181 static struct block *gen_fhostop(const u_char *, int);
182 static struct block *gen_thostop(const u_char *, int);
183 static struct block *gen_wlanhostop(const u_char *, int);
184 static struct block *gen_ipfchostop(const u_char *, int);
185 static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
186 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
187 #ifdef INET6
188 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
189 #endif
190 #ifndef INET6
191 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
192 #endif
193 static struct block *gen_ipfrag(void);
194 static struct block *gen_portatom(int, bpf_int32);
195 #ifdef INET6
196 static struct block *gen_portatom6(int, bpf_int32);
197 #endif
198 struct block *gen_portop(int, int, int);
199 static struct block *gen_port(int, int, int);
200 #ifdef INET6
201 struct block *gen_portop6(int, int, int);
202 static struct block *gen_port6(int, int, int);
203 #endif
204 static int lookup_proto(const char *, int);
205 static struct block *gen_protochain(int, int, int);
206 static struct block *gen_proto(int, int, int);
207 static struct slist *xfer_to_x(struct arth *);
208 static struct slist *xfer_to_a(struct arth *);
209 static struct block *gen_mac_multicast(int);
210 static struct block *gen_len(int, int);
211
212 static struct block *gen_msg_abbrev(int type);
213
214 static void *
215 newchunk(n)
216 u_int n;
217 {
218 struct chunk *cp;
219 int k;
220 size_t size;
221
222 #ifndef __NetBSD__
223 /* XXX Round up to nearest long. */
224 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1);
225 #else
226 /* XXX Round up to structure boundary. */
227 n = ALIGN(n);
228 #endif
229
230 cp = &chunks[cur_chunk];
231 if (n > cp->n_left) {
232 ++cp, k = ++cur_chunk;
233 if (k >= NCHUNKS)
234 bpf_error("out of memory");
235 size = CHUNK0SIZE << k;
236 cp->m = (void *)malloc(size);
237 if (cp->m == NULL)
238 bpf_error("out of memory");
239 memset((char *)cp->m, 0, size);
240 cp->n_left = size;
241 if (n > size)
242 bpf_error("out of memory");
243 }
244 cp->n_left -= n;
245 return (void *)((char *)cp->m + cp->n_left);
246 }
247
248 static void
249 freechunks()
250 {
251 int i;
252
253 cur_chunk = 0;
254 for (i = 0; i < NCHUNKS; ++i)
255 if (chunks[i].m != NULL) {
256 free(chunks[i].m);
257 chunks[i].m = NULL;
258 }
259 }
260
261 /*
262 * A strdup whose allocations are freed after code generation is over.
263 */
264 char *
265 sdup(s)
266 register const char *s;
267 {
268 int n = strlen(s) + 1;
269 char *cp = newchunk(n);
270
271 strlcpy(cp, s, n);
272 return (cp);
273 }
274
275 static inline struct block *
276 new_block(code)
277 int code;
278 {
279 struct block *p;
280
281 p = (struct block *)newchunk(sizeof(*p));
282 p->s.code = code;
283 p->head = p;
284
285 return p;
286 }
287
288 static inline struct slist *
289 new_stmt(code)
290 int code;
291 {
292 struct slist *p;
293
294 p = (struct slist *)newchunk(sizeof(*p));
295 p->s.code = code;
296
297 return p;
298 }
299
300 static struct block *
301 gen_retblk(v)
302 int v;
303 {
304 struct block *b = new_block(BPF_RET|BPF_K);
305
306 b->s.k = v;
307 return b;
308 }
309
310 static inline void
311 syntax()
312 {
313 bpf_error("syntax error in filter expression");
314 }
315
316 static bpf_u_int32 netmask;
317 static int snaplen;
318 int no_optimize;
319
320 int
321 pcap_compile(pcap_t *p, struct bpf_program *program,
322 char *buf, int optimize, bpf_u_int32 mask)
323 {
324 extern int n_errors;
325 int len;
326
327 no_optimize = 0;
328 n_errors = 0;
329 root = NULL;
330 bpf_pcap = p;
331 if (setjmp(top_ctx)) {
332 lex_cleanup();
333 freechunks();
334 return (-1);
335 }
336
337 netmask = mask;
338
339 snaplen = pcap_snapshot(p);
340 if (snaplen == 0) {
341 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
342 "snaplen of 0 rejects all packets");
343 return -1;
344 }
345
346 lex_init(buf ? buf : "");
347 init_linktype(p);
348 (void)pcap_parse();
349
350 if (n_errors)
351 syntax();
352
353 if (root == NULL)
354 root = gen_retblk(snaplen);
355
356 if (optimize && !no_optimize) {
357 bpf_optimize(&root);
358 if (root == NULL ||
359 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
360 bpf_error("expression rejects all packets");
361 }
362 program->bf_insns = icode_to_fcode(root, &len);
363 program->bf_len = len;
364
365 lex_cleanup();
366 freechunks();
367 return (0);
368 }
369
370 /*
371 * entry point for using the compiler with no pcap open
372 * pass in all the stuff that is needed explicitly instead.
373 */
374 int
375 pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
376 struct bpf_program *program,
377 char *buf, int optimize, bpf_u_int32 mask)
378 {
379 pcap_t *p;
380 int ret;
381
382 p = pcap_open_dead(linktype_arg, snaplen_arg);
383 if (p == NULL)
384 return (-1);
385 ret = pcap_compile(p, program, buf, optimize, mask);
386 pcap_close(p);
387 return (ret);
388 }
389
390 /*
391 * Clean up a "struct bpf_program" by freeing all the memory allocated
392 * in it.
393 */
394 void
395 pcap_freecode(struct bpf_program *program)
396 {
397 program->bf_len = 0;
398 if (program->bf_insns != NULL) {
399 free((char *)program->bf_insns);
400 program->bf_insns = NULL;
401 }
402 }
403
404 /*
405 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
406 * which of the jt and jf fields has been resolved and which is a pointer
407 * back to another unresolved block (or nil). At least one of the fields
408 * in each block is already resolved.
409 */
410 static void
411 backpatch(list, target)
412 struct block *list, *target;
413 {
414 struct block *next;
415
416 while (list) {
417 if (!list->sense) {
418 next = JT(list);
419 JT(list) = target;
420 } else {
421 next = JF(list);
422 JF(list) = target;
423 }
424 list = next;
425 }
426 }
427
428 /*
429 * Merge the lists in b0 and b1, using the 'sense' field to indicate
430 * which of jt and jf is the link.
431 */
432 static void
433 merge(b0, b1)
434 struct block *b0, *b1;
435 {
436 register struct block **p = &b0;
437
438 /* Find end of list. */
439 while (*p)
440 p = !((*p)->sense) ? &JT(*p) : &JF(*p);
441
442 /* Concatenate the lists. */
443 *p = b1;
444 }
445
446 void
447 finish_parse(p)
448 struct block *p;
449 {
450 backpatch(p, gen_retblk(snaplen));
451 p->sense = !p->sense;
452 backpatch(p, gen_retblk(0));
453 root = p->head;
454 }
455
456 void
457 gen_and(b0, b1)
458 struct block *b0, *b1;
459 {
460 backpatch(b0, b1->head);
461 b0->sense = !b0->sense;
462 b1->sense = !b1->sense;
463 merge(b1, b0);
464 b1->sense = !b1->sense;
465 b1->head = b0->head;
466 }
467
468 void
469 gen_or(b0, b1)
470 struct block *b0, *b1;
471 {
472 b0->sense = !b0->sense;
473 backpatch(b0, b1->head);
474 b0->sense = !b0->sense;
475 merge(b1, b0);
476 b1->head = b0->head;
477 }
478
479 void
480 gen_not(b)
481 struct block *b;
482 {
483 b->sense = !b->sense;
484 }
485
486 static struct block *
487 gen_cmp(offset, size, v)
488 u_int offset, size;
489 bpf_int32 v;
490 {
491 struct slist *s;
492 struct block *b;
493
494 s = new_stmt(BPF_LD|BPF_ABS|size);
495 s->s.k = offset;
496
497 b = new_block(JMP(BPF_JEQ));
498 b->stmts = s;
499 b->s.k = v;
500
501 return b;
502 }
503
504 static struct block *
505 gen_cmp_gt(offset, size, v)
506 u_int offset, size;
507 bpf_int32 v;
508 {
509 struct slist *s;
510 struct block *b;
511
512 s = new_stmt(BPF_LD|BPF_ABS|size);
513 s->s.k = offset;
514
515 b = new_block(JMP(BPF_JGT));
516 b->stmts = s;
517 b->s.k = v;
518
519 return b;
520 }
521
522 static struct block *
523 gen_mcmp(offset, size, v, mask)
524 u_int offset, size;
525 bpf_int32 v;
526 bpf_u_int32 mask;
527 {
528 struct block *b = gen_cmp(offset, size, v);
529 struct slist *s;
530
531 if (mask != 0xffffffff) {
532 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
533 s->s.k = mask;
534 b->stmts->next = s;
535 }
536 return b;
537 }
538
539 static struct block *
540 gen_bcmp(offset, size, v)
541 register u_int offset, size;
542 register const u_char *v;
543 {
544 register struct block *b, *tmp;
545
546 b = NULL;
547 while (size >= 4) {
548 register const u_char *p = &v[size - 4];
549 bpf_int32 w = ((bpf_int32)p[0] << 24) |
550 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
551
552 tmp = gen_cmp(offset + size - 4, BPF_W, w);
553 if (b != NULL)
554 gen_and(b, tmp);
555 b = tmp;
556 size -= 4;
557 }
558 while (size >= 2) {
559 register const u_char *p = &v[size - 2];
560 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
561
562 tmp = gen_cmp(offset + size - 2, BPF_H, w);
563 if (b != NULL)
564 gen_and(b, tmp);
565 b = tmp;
566 size -= 2;
567 }
568 if (size > 0) {
569 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
570 if (b != NULL)
571 gen_and(b, tmp);
572 b = tmp;
573 }
574 return b;
575 }
576
577 static struct block *
578 gen_ncmp(datasize, offset, mask, jtype, jvalue, reverse)
579 bpf_u_int32 datasize, offset, mask, jtype, jvalue;
580 int reverse;
581 {
582 struct slist *s;
583 struct block *b;
584
585 s = new_stmt(BPF_LD|datasize|BPF_ABS);
586 s->s.k = offset;
587
588 if (mask != 0xffffffff) {
589 s->next = new_stmt(BPF_ALU|BPF_AND|BPF_K);
590 s->next->s.k = mask;
591 }
592
593 b = new_block(JMP(jtype));
594 b->stmts = s;
595 b->s.k = jvalue;
596 if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE))
597 gen_not(b);
598 return b;
599 }
600
601 /*
602 * Various code constructs need to know the layout of the data link
603 * layer. These variables give the necessary offsets.
604 */
605
606 /*
607 * This is the offset of the beginning of the MAC-layer header.
608 * It's usually 0, except for ATM LANE.
609 */
610 static u_int off_mac;
611
612 /*
613 * "off_linktype" is the offset to information in the link-layer header
614 * giving the packet type.
615 *
616 * For Ethernet, it's the offset of the Ethernet type field.
617 *
618 * For link-layer types that always use 802.2 headers, it's the
619 * offset of the LLC header.
620 *
621 * For PPP, it's the offset of the PPP type field.
622 *
623 * For Cisco HDLC, it's the offset of the CHDLC type field.
624 *
625 * For BSD loopback, it's the offset of the AF_ value.
626 *
627 * For Linux cooked sockets, it's the offset of the type field.
628 *
629 * It's set to -1 for no encapsulation, in which case, IP is assumed.
630 */
631 static u_int off_linktype;
632
633 /*
634 * TRUE if the link layer includes an ATM pseudo-header.
635 */
636 static int is_atm = 0;
637
638 /*
639 * TRUE if "lane" appeared in the filter; it causes us to generate
640 * code that assumes LANE rather than LLC-encapsulated traffic in SunATM.
641 */
642 static int is_lane = 0;
643
644 /*
645 * These are offsets for the ATM pseudo-header.
646 */
647 static u_int off_vpi;
648 static u_int off_vci;
649 static u_int off_proto;
650
651 /*
652 * This is the offset of the first byte after the ATM pseudo_header,
653 * or -1 if there is no ATM pseudo-header.
654 */
655 static u_int off_payload;
656
657 /*
658 * These are offsets to the beginning of the network-layer header.
659 *
660 * If the link layer never uses 802.2 LLC:
661 *
662 * "off_nl" and "off_nl_nosnap" are the same.
663 *
664 * If the link layer always uses 802.2 LLC:
665 *
666 * "off_nl" is the offset if there's a SNAP header following
667 * the 802.2 header;
668 *
669 * "off_nl_nosnap" is the offset if there's no SNAP header.
670 *
671 * If the link layer is Ethernet:
672 *
673 * "off_nl" is the offset if the packet is an Ethernet II packet
674 * (we assume no 802.3+802.2+SNAP);
675 *
676 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet
677 * with an 802.2 header following it.
678 */
679 static u_int off_nl;
680 static u_int off_nl_nosnap;
681
682 static int linktype;
683
684 static void
685 init_linktype(p)
686 pcap_t *p;
687 {
688 linktype = pcap_datalink(p);
689 #ifdef PCAP_FDDIPAD
690 pcap_fddipad = p->fddipad;
691 #endif
692
693 /*
694 * Assume it's not raw ATM with a pseudo-header, for now.
695 */
696 off_mac = 0;
697 is_atm = 0;
698 is_lane = 0;
699 off_vpi = -1;
700 off_vci = -1;
701 off_proto = -1;
702 off_payload = -1;
703
704 orig_linktype = -1;
705 orig_nl = -1;
706 orig_nl_nosnap = -1;
707
708 switch (linktype) {
709
710 case DLT_ARCNET:
711 off_linktype = 2;
712 off_nl = 6; /* XXX in reality, variable! */
713 off_nl_nosnap = 6; /* no 802.2 LLC */
714 return;
715
716 case DLT_ARCNET_LINUX:
717 off_linktype = 4;
718 off_nl = 8; /* XXX in reality, variable! */
719 off_nl_nosnap = 8; /* no 802.2 LLC */
720 return;
721
722 case DLT_EN10MB:
723 off_linktype = 12;
724 off_nl = 14; /* Ethernet II */
725 off_nl_nosnap = 17; /* 802.3+802.2 */
726 return;
727
728 case DLT_SLIP:
729 /*
730 * SLIP doesn't have a link level type. The 16 byte
731 * header is hacked into our SLIP driver.
732 */
733 off_linktype = -1;
734 off_nl = 16;
735 off_nl_nosnap = 16; /* no 802.2 LLC */
736 return;
737
738 case DLT_SLIP_BSDOS:
739 /* XXX this may be the same as the DLT_PPP_BSDOS case */
740 off_linktype = -1;
741 /* XXX end */
742 off_nl = 24;
743 off_nl_nosnap = 24; /* no 802.2 LLC */
744 return;
745
746 case DLT_NULL:
747 case DLT_LOOP:
748 off_linktype = 0;
749 off_nl = 4;
750 off_nl_nosnap = 4; /* no 802.2 LLC */
751 return;
752
753 case DLT_ENC:
754 off_linktype = 0;
755 off_nl = 12;
756 off_nl_nosnap = 12; /* no 802.2 LLC */
757 return;
758
759 case DLT_PPP:
760 case DLT_PPP_PPPD:
761 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */
762 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */
763 off_linktype = 2;
764 off_nl = 4;
765 off_nl_nosnap = 4; /* no 802.2 LLC */
766 return;
767
768 case DLT_PPP_ETHER:
769 /*
770 * This does no include the Ethernet header, and
771 * only covers session state.
772 */
773 off_linktype = 6;
774 off_nl = 8;
775 off_nl_nosnap = 8; /* no 802.2 LLC */
776 return;
777
778 case DLT_PPP_BSDOS:
779 off_linktype = 5;
780 off_nl = 24;
781 off_nl_nosnap = 24; /* no 802.2 LLC */
782 return;
783
784 case DLT_FDDI:
785 /*
786 * FDDI doesn't really have a link-level type field.
787 * We set "off_linktype" to the offset of the LLC header.
788 *
789 * To check for Ethernet types, we assume that SSAP = SNAP
790 * is being used and pick out the encapsulated Ethernet type.
791 * XXX - should we generate code to check for SNAP?
792 */
793 off_linktype = 13;
794 #ifdef PCAP_FDDIPAD
795 off_linktype += pcap_fddipad;
796 #endif
797 off_nl = 21; /* FDDI+802.2+SNAP */
798 off_nl_nosnap = 16; /* FDDI+802.2 */
799 #ifdef PCAP_FDDIPAD
800 off_nl += pcap_fddipad;
801 off_nl_nosnap += pcap_fddipad;
802 #endif
803 return;
804
805 case DLT_IEEE802:
806 /*
807 * Token Ring doesn't really have a link-level type field.
808 * We set "off_linktype" to the offset of the LLC header.
809 *
810 * To check for Ethernet types, we assume that SSAP = SNAP
811 * is being used and pick out the encapsulated Ethernet type.
812 * XXX - should we generate code to check for SNAP?
813 *
814 * XXX - the header is actually variable-length.
815 * Some various Linux patched versions gave 38
816 * as "off_linktype" and 40 as "off_nl"; however,
817 * if a token ring packet has *no* routing
818 * information, i.e. is not source-routed, the correct
819 * values are 20 and 22, as they are in the vanilla code.
820 *
821 * A packet is source-routed iff the uppermost bit
822 * of the first byte of the source address, at an
823 * offset of 8, has the uppermost bit set. If the
824 * packet is source-routed, the total number of bytes
825 * of routing information is 2 plus bits 0x1F00 of
826 * the 16-bit value at an offset of 14 (shifted right
827 * 8 - figure out which byte that is).
828 */
829 off_linktype = 14;
830 off_nl = 22; /* Token Ring+802.2+SNAP */
831 off_nl_nosnap = 17; /* Token Ring+802.2 */
832 return;
833
834 case DLT_IEEE802_11:
835 /*
836 * 802.11 doesn't really have a link-level type field.
837 * We set "off_linktype" to the offset of the LLC header.
838 *
839 * To check for Ethernet types, we assume that SSAP = SNAP
840 * is being used and pick out the encapsulated Ethernet type.
841 * XXX - should we generate code to check for SNAP?
842 *
843 * XXX - the header is actually variable-length. We
844 * assume a 24-byte link-layer header, as appears in
845 * data frames in networks with no bridges. If the
846 * fromds and tods 802.11 header bits are both set,
847 * it's actually supposed to be 30 bytes.
848 */
849 off_linktype = 24;
850 off_nl = 32; /* 802.11+802.2+SNAP */
851 off_nl_nosnap = 27; /* 802.11+802.2 */
852 return;
853
854 case DLT_PRISM_HEADER:
855 /*
856 * Same as 802.11, but with an additional header before
857 * the 802.11 header, containing a bunch of additional
858 * information including radio-level information.
859 *
860 * The header is 144 bytes long.
861 *
862 * XXX - same variable-length header problem; at least
863 * the Prism header is fixed-length.
864 */
865 off_linktype = 144+24;
866 off_nl = 144+32; /* Prism+802.11+802.2+SNAP */
867 off_nl_nosnap = 144+27; /* Prism+802.11+802.2 */
868 return;
869
870 case DLT_IEEE802_11_RADIO_AVS:
871 /*
872 * Same as 802.11, but with an additional header before
873 * the 802.11 header, containing a bunch of additional
874 * information including radio-level information.
875 *
876 * The header is 64 bytes long, at least in its
877 * current incarnation.
878 *
879 * XXX - same variable-length header problem, only
880 * more so; this header is also variable-length,
881 * with the length being the 32-bit big-endian
882 * number at an offset of 4 from the beginning
883 * of the radio header.
884 */
885 off_linktype = 64+24;
886 off_nl = 64+32; /* Radio+802.11+802.2+SNAP */
887 off_nl_nosnap = 64+27; /* Radio+802.11+802.2 */
888 return;
889
890 case DLT_IEEE802_11_RADIO:
891 /*
892 * Same as 802.11, but with an additional header before
893 * the 802.11 header, containing a bunch of additional
894 * information including radio-level information.
895 *
896 * XXX - same variable-length header problem, only
897 * even *more* so; this header is also variable-length,
898 * with the length being the 16-bit number at an offset
899 * of 2 from the beginning of the radio header, and it's
900 * device-dependent (different devices might supply
901 * different amounts of information), so we can't even
902 * assume a fixed length for the current version of the
903 * header.
904 *
905 * Therefore, currently, only raw "link[N:M]" filtering is
906 * supported.
907 */
908 off_linktype = -1;
909 off_nl = -1;
910 off_nl_nosnap = -1;
911 return;
912
913 case DLT_ATM_RFC1483:
914 case DLT_ATM_CLIP: /* Linux ATM defines this */
915 /*
916 * assume routed, non-ISO PDUs
917 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
918 */
919 off_linktype = 0;
920 off_nl = 8; /* 802.2+SNAP */
921 off_nl_nosnap = 3; /* 802.2 */
922 return;
923
924 case DLT_SUNATM:
925 /*
926 * Full Frontal ATM; you get AALn PDUs with an ATM
927 * pseudo-header.
928 */
929 is_atm = 1;
930 off_vpi = SUNATM_VPI_POS;
931 off_vci = SUNATM_VCI_POS;
932 off_proto = PROTO_POS;
933 off_mac = -1; /* LLC-encapsulated, so no MAC-layer header */
934 off_payload = SUNATM_PKT_BEGIN_POS;
935 off_linktype = off_payload;
936 off_nl = off_payload+8; /* 802.2+SNAP */
937 off_nl_nosnap = off_payload+3; /* 802.2 */
938 return;
939
940 case DLT_RAW:
941 off_linktype = -1;
942 off_nl = 0;
943 off_nl_nosnap = 0; /* no 802.2 LLC */
944 return;
945
946 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */
947 off_linktype = 14;
948 off_nl = 16;
949 off_nl_nosnap = 16; /* no 802.2 LLC */
950 return;
951
952 case DLT_LTALK:
953 /*
954 * LocalTalk does have a 1-byte type field in the LLAP header,
955 * but really it just indicates whether there is a "short" or
956 * "long" DDP packet following.
957 */
958 off_linktype = -1;
959 off_nl = 0;
960 off_nl_nosnap = 0; /* no 802.2 LLC */
961 return;
962
963 case DLT_IP_OVER_FC:
964 /*
965 * RFC 2625 IP-over-Fibre-Channel doesn't really have a
966 * link-level type field. We set "off_linktype" to the
967 * offset of the LLC header.
968 *
969 * To check for Ethernet types, we assume that SSAP = SNAP
970 * is being used and pick out the encapsulated Ethernet type.
971 * XXX - should we generate code to check for SNAP? RFC
972 * 2625 says SNAP should be used.
973 */
974 off_linktype = 16;
975 off_nl = 24; /* IPFC+802.2+SNAP */
976 off_nl_nosnap = 19; /* IPFC+802.2 */
977 return;
978
979 case DLT_FRELAY:
980 /*
981 * XXX - we should set this to handle SNAP-encapsulated
982 * frames (NLPID of 0x80).
983 */
984 off_linktype = -1;
985 off_nl = 0;
986 off_nl_nosnap = 0; /* no 802.2 LLC */
987 return;
988
989 case DLT_APPLE_IP_OVER_IEEE1394:
990 off_linktype = 16;
991 off_nl = 18;
992 off_nl_nosnap = 18; /* no 802.2 LLC */
993 return;
994
995 case DLT_LINUX_IRDA:
996 /*
997 * Currently, only raw "link[N:M]" filtering is supported.
998 */
999 off_linktype = -1;
1000 off_nl = -1;
1001 off_nl_nosnap = -1;
1002 return;
1003
1004 case DLT_DOCSIS:
1005 /*
1006 * Currently, only raw "link[N:M]" filtering is supported.
1007 */
1008 off_linktype = -1;
1009 off_nl = -1;
1010 off_nl_nosnap = -1;
1011 return;
1012
1013 case DLT_SYMANTEC_FIREWALL:
1014 off_linktype = 6;
1015 off_nl = 44; /* Ethernet II */
1016 off_nl_nosnap = 44; /* XXX - what does it do with 802.3 packets? */
1017 return;
1018
1019 case DLT_PFLOG:
1020 off_linktype = 0;
1021 /* XXX read this from pf.h? */
1022 off_nl = PFLOG_HDRLEN;
1023 off_nl_nosnap = PFLOG_HDRLEN; /* no 802.2 LLC */
1024 return;
1025
1026 case DLT_JUNIPER_MLFR:
1027 case DLT_JUNIPER_MLPPP:
1028 off_linktype = 4;
1029 off_nl = 4;
1030 off_nl_nosnap = -1; /* no 802.2 LLC */
1031 return;
1032
1033 case DLT_JUNIPER_ATM1:
1034 off_linktype = 4; /* in reality variable between 4-8 */
1035 off_nl = 4;
1036 off_nl_nosnap = 14;
1037 return;
1038
1039 case DLT_JUNIPER_ATM2:
1040 off_linktype = 8; /* in reality variable between 8-12 */
1041 off_nl = 8;
1042 off_nl_nosnap = 18;
1043 return;
1044
1045 #ifdef DLT_PFSYNC
1046 case DLT_PFSYNC:
1047 off_linktype = -1;
1048 off_nl = 4;
1049 off_nl_nosnap = 4;
1050 return;
1051 #endif
1052
1053 case DLT_LINUX_LAPD:
1054 /*
1055 * Currently, only raw "link[N:M]" filtering is supported.
1056 */
1057 off_linktype = -1;
1058 off_nl = -1;
1059 off_nl_nosnap = -1;
1060 return;
1061 }
1062 bpf_error("unknown data link type %d", linktype);
1063 /* NOTREACHED */
1064 }
1065
1066 static struct block *
1067 gen_uncond(rsense)
1068 int rsense;
1069 {
1070 struct block *b;
1071 struct slist *s;
1072
1073 s = new_stmt(BPF_LD|BPF_IMM);
1074 s->s.k = !rsense;
1075 b = new_block(JMP(BPF_JEQ));
1076 b->stmts = s;
1077
1078 return b;
1079 }
1080
1081 static inline struct block *
1082 gen_true()
1083 {
1084 return gen_uncond(1);
1085 }
1086
1087 static inline struct block *
1088 gen_false()
1089 {
1090 return gen_uncond(0);
1091 }
1092
1093 /*
1094 * Byte-swap a 32-bit number.
1095 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
1096 * big-endian platforms.)
1097 */
1098 #define SWAPLONG(y) \
1099 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
1100
1101 /*
1102 * Generate code to match a particular packet type.
1103 *
1104 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1105 * value, if <= ETHERMTU. We use that to determine whether to
1106 * match the type/length field or to check the type/length field for
1107 * a value <= ETHERMTU to see whether it's a type field and then do
1108 * the appropriate test.
1109 */
1110 static struct block *
1111 gen_ether_linktype(proto)
1112 register int proto;
1113 {
1114 struct block *b0, *b1;
1115
1116 switch (proto) {
1117
1118 case LLCSAP_ISONS:
1119 case LLCSAP_IP:
1120 case LLCSAP_NETBEUI:
1121 /*
1122 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1123 * so we check the DSAP and SSAP.
1124 *
1125 * LLCSAP_IP checks for IP-over-802.2, rather
1126 * than IP-over-Ethernet or IP-over-SNAP.
1127 *
1128 * XXX - should we check both the DSAP and the
1129 * SSAP, like this, or should we check just the
1130 * DSAP, as we do for other types <= ETHERMTU
1131 * (i.e., other SAP values)?
1132 */
1133 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
1134 gen_not(b0);
1135 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
1136 ((proto << 8) | proto));
1137 gen_and(b0, b1);
1138 return b1;
1139
1140 case LLCSAP_IPX:
1141 /*
1142 * Check for;
1143 *
1144 * Ethernet_II frames, which are Ethernet
1145 * frames with a frame type of ETHERTYPE_IPX;
1146 *
1147 * Ethernet_802.3 frames, which are 802.3
1148 * frames (i.e., the type/length field is
1149 * a length field, <= ETHERMTU, rather than
1150 * a type field) with the first two bytes
1151 * after the Ethernet/802.3 header being
1152 * 0xFFFF;
1153 *
1154 * Ethernet_802.2 frames, which are 802.3
1155 * frames with an 802.2 LLC header and
1156 * with the IPX LSAP as the DSAP in the LLC
1157 * header;
1158 *
1159 * Ethernet_SNAP frames, which are 802.3
1160 * frames with an LLC header and a SNAP
1161 * header and with an OUI of 0x000000
1162 * (encapsulated Ethernet) and a protocol
1163 * ID of ETHERTYPE_IPX in the SNAP header.
1164 *
1165 * XXX - should we generate the same code both
1166 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
1167 */
1168
1169 /*
1170 * This generates code to check both for the
1171 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
1172 */
1173 b0 = gen_cmp(off_linktype + 2, BPF_B, (bpf_int32)LLCSAP_IPX);
1174 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)0xFFFF);
1175 gen_or(b0, b1);
1176
1177 /*
1178 * Now we add code to check for SNAP frames with
1179 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
1180 */
1181 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
1182 gen_or(b0, b1);
1183
1184 /*
1185 * Now we generate code to check for 802.3
1186 * frames in general.
1187 */
1188 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
1189 gen_not(b0);
1190
1191 /*
1192 * Now add the check for 802.3 frames before the
1193 * check for Ethernet_802.2 and Ethernet_802.3,
1194 * as those checks should only be done on 802.3
1195 * frames, not on Ethernet frames.
1196 */
1197 gen_and(b0, b1);
1198
1199 /*
1200 * Now add the check for Ethernet_II frames, and
1201 * do that before checking for the other frame
1202 * types.
1203 */
1204 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)ETHERTYPE_IPX);
1205 gen_or(b0, b1);
1206 return b1;
1207
1208 case ETHERTYPE_ATALK:
1209 case ETHERTYPE_AARP:
1210 /*
1211 * EtherTalk (AppleTalk protocols on Ethernet link
1212 * layer) may use 802.2 encapsulation.
1213 */
1214
1215 /*
1216 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1217 * we check for an Ethernet type field less than
1218 * 1500, which means it's an 802.3 length field.
1219 */
1220 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
1221 gen_not(b0);
1222
1223 /*
1224 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1225 * SNAP packets with an organization code of
1226 * 0x080007 (Apple, for Appletalk) and a protocol
1227 * type of ETHERTYPE_ATALK (Appletalk).
1228 *
1229 * 802.2-encapsulated ETHERTYPE_AARP packets are
1230 * SNAP packets with an organization code of
1231 * 0x000000 (encapsulated Ethernet) and a protocol
1232 * type of ETHERTYPE_AARP (Appletalk ARP).
1233 */
1234 if (proto == ETHERTYPE_ATALK)
1235 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
1236 else /* proto == ETHERTYPE_AARP */
1237 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
1238 gen_and(b0, b1);
1239
1240 /*
1241 * Check for Ethernet encapsulation (Ethertalk
1242 * phase 1?); we just check for the Ethernet
1243 * protocol type.
1244 */
1245 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1246
1247 gen_or(b0, b1);
1248 return b1;
1249
1250 default:
1251 if (proto <= ETHERMTU) {
1252 /*
1253 * This is an LLC SAP value, so the frames
1254 * that match would be 802.2 frames.
1255 * Check that the frame is an 802.2 frame
1256 * (i.e., that the length/type field is
1257 * a length field, <= ETHERMTU) and
1258 * then check the DSAP.
1259 */
1260 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
1261 gen_not(b0);
1262 b1 = gen_cmp(off_linktype + 2, BPF_B, (bpf_int32)proto);
1263 gen_and(b0, b1);
1264 return b1;
1265 } else {
1266 /*
1267 * This is an Ethernet type, so compare
1268 * the length/type field with it (if
1269 * the frame is an 802.2 frame, the length
1270 * field will be <= ETHERMTU, and, as
1271 * "proto" is > ETHERMTU, this test
1272 * will fail and the frame won't match,
1273 * which is what we want).
1274 */
1275 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1276 }
1277 }
1278 }
1279
1280 /*
1281 * Generate code to match a particular packet type.
1282 *
1283 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1284 * value, if <= ETHERMTU. We use that to determine whether to
1285 * match the type field or to check the type field for the special
1286 * LINUX_SLL_P_802_2 value and then do the appropriate test.
1287 */
1288 static struct block *
1289 gen_linux_sll_linktype(proto)
1290 register int proto;
1291 {
1292 struct block *b0, *b1;
1293
1294 switch (proto) {
1295
1296 case LLCSAP_ISONS:
1297 case LLCSAP_IP:
1298 case LLCSAP_NETBEUI:
1299 /*
1300 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1301 * so we check the DSAP and SSAP.
1302 *
1303 * LLCSAP_IP checks for IP-over-802.2, rather
1304 * than IP-over-Ethernet or IP-over-SNAP.
1305 *
1306 * XXX - should we check both the DSAP and the
1307 * SSAP, like this, or should we check just the
1308 * DSAP, as we do for other types <= ETHERMTU
1309 * (i.e., other SAP values)?
1310 */
1311 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1312 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
1313 ((proto << 8) | proto));
1314 gen_and(b0, b1);
1315 return b1;
1316
1317 case LLCSAP_IPX:
1318 /*
1319 * Ethernet_II frames, which are Ethernet
1320 * frames with a frame type of ETHERTYPE_IPX;
1321 *
1322 * Ethernet_802.3 frames, which have a frame
1323 * type of LINUX_SLL_P_802_3;
1324 *
1325 * Ethernet_802.2 frames, which are 802.3
1326 * frames with an 802.2 LLC header (i.e, have
1327 * a frame type of LINUX_SLL_P_802_2) and
1328 * with the IPX LSAP as the DSAP in the LLC
1329 * header;
1330 *
1331 * Ethernet_SNAP frames, which are 802.3
1332 * frames with an LLC header and a SNAP
1333 * header and with an OUI of 0x000000
1334 * (encapsulated Ethernet) and a protocol
1335 * ID of ETHERTYPE_IPX in the SNAP header.
1336 *
1337 * First, do the checks on LINUX_SLL_P_802_2
1338 * frames; generate the check for either
1339 * Ethernet_802.2 or Ethernet_SNAP frames, and
1340 * then put a check for LINUX_SLL_P_802_2 frames
1341 * before it.
1342 */
1343 b0 = gen_cmp(off_linktype + 2, BPF_B,
1344 (bpf_int32)LLCSAP_IPX);
1345 b1 = gen_snap(0x000000, ETHERTYPE_IPX,
1346 off_linktype + 2);
1347 gen_or(b0, b1);
1348 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1349 gen_and(b0, b1);
1350
1351 /*
1352 * Now check for 802.3 frames and OR that with
1353 * the previous test.
1354 */
1355 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
1356 gen_or(b0, b1);
1357
1358 /*
1359 * Now add the check for Ethernet_II frames, and
1360 * do that before checking for the other frame
1361 * types.
1362 */
1363 b0 = gen_cmp(off_linktype, BPF_H,
1364 (bpf_int32)ETHERTYPE_IPX);
1365 gen_or(b0, b1);
1366 return b1;
1367
1368 case ETHERTYPE_ATALK:
1369 case ETHERTYPE_AARP:
1370 /*
1371 * EtherTalk (AppleTalk protocols on Ethernet link
1372 * layer) may use 802.2 encapsulation.
1373 */
1374
1375 /*
1376 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1377 * we check for the 802.2 protocol type in the
1378 * "Ethernet type" field.
1379 */
1380 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1381
1382 /*
1383 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1384 * SNAP packets with an organization code of
1385 * 0x080007 (Apple, for Appletalk) and a protocol
1386 * type of ETHERTYPE_ATALK (Appletalk).
1387 *
1388 * 802.2-encapsulated ETHERTYPE_AARP packets are
1389 * SNAP packets with an organization code of
1390 * 0x000000 (encapsulated Ethernet) and a protocol
1391 * type of ETHERTYPE_AARP (Appletalk ARP).
1392 */
1393 if (proto == ETHERTYPE_ATALK)
1394 b1 = gen_snap(0x080007, ETHERTYPE_ATALK,
1395 off_linktype + 2);
1396 else /* proto == ETHERTYPE_AARP */
1397 b1 = gen_snap(0x000000, ETHERTYPE_AARP,
1398 off_linktype + 2);
1399 gen_and(b0, b1);
1400
1401 /*
1402 * Check for Ethernet encapsulation (Ethertalk
1403 * phase 1?); we just check for the Ethernet
1404 * protocol type.
1405 */
1406 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1407
1408 gen_or(b0, b1);
1409 return b1;
1410
1411 default:
1412 if (proto <= ETHERMTU) {
1413 /*
1414 * This is an LLC SAP value, so the frames
1415 * that match would be 802.2 frames.
1416 * Check for the 802.2 protocol type
1417 * in the "Ethernet type" field, and
1418 * then check the DSAP.
1419 */
1420 b0 = gen_cmp(off_linktype, BPF_H,
1421 LINUX_SLL_P_802_2);
1422 b1 = gen_cmp(off_linktype + 2, BPF_B,
1423 (bpf_int32)proto);
1424 gen_and(b0, b1);
1425 return b1;
1426 } else {
1427 /*
1428 * This is an Ethernet type, so compare
1429 * the length/type field with it (if
1430 * the frame is an 802.2 frame, the length
1431 * field will be <= ETHERMTU, and, as
1432 * "proto" is > ETHERMTU, this test
1433 * will fail and the frame won't match,
1434 * which is what we want).
1435 */
1436 return gen_cmp(off_linktype, BPF_H,
1437 (bpf_int32)proto);
1438 }
1439 }
1440 }
1441
1442 /*
1443 * Generate code to match a particular packet type by matching the
1444 * link-layer type field or fields in the 802.2 LLC header.
1445 *
1446 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1447 * value, if <= ETHERMTU.
1448 */
1449 static struct block *
1450 gen_linktype(proto)
1451 register int proto;
1452 {
1453 struct block *b0, *b1, *b2;
1454
1455 switch (linktype) {
1456
1457 case DLT_EN10MB:
1458 return gen_ether_linktype(proto);
1459 /*NOTREACHED*/
1460 break;
1461
1462 case DLT_C_HDLC:
1463 switch (proto) {
1464
1465 case LLCSAP_ISONS:
1466 proto = (proto << 8 | LLCSAP_ISONS);
1467 /* fall through */
1468
1469 default:
1470 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1471 /*NOTREACHED*/
1472 break;
1473 }
1474 break;
1475
1476 case DLT_IEEE802_11:
1477 case DLT_PRISM_HEADER:
1478 case DLT_IEEE802_11_RADIO:
1479 case DLT_FDDI:
1480 case DLT_IEEE802:
1481 case DLT_ATM_RFC1483:
1482 case DLT_ATM_CLIP:
1483 case DLT_IP_OVER_FC:
1484 return gen_llc_linktype(proto);
1485 /*NOTREACHED*/
1486 break;
1487
1488 case DLT_SUNATM:
1489 /*
1490 * If "is_lane" is set, check for a LANE-encapsulated
1491 * version of this protocol, otherwise check for an
1492 * LLC-encapsulated version of this protocol.
1493 *
1494 * We assume LANE means Ethernet, not Token Ring.
1495 */
1496 if (is_lane) {
1497 /*
1498 * Check that the packet doesn't begin with an
1499 * LE Control marker. (We've already generated
1500 * a test for LANE.)
1501 */
1502 b0 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
1503 gen_not(b0);
1504
1505 /*
1506 * Now generate an Ethernet test.
1507 */
1508 b1 = gen_ether_linktype(proto);
1509 gen_and(b0, b1);
1510 return b1;
1511 } else {
1512 /*
1513 * Check for LLC encapsulation and then check the
1514 * protocol.
1515 */
1516 b0 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0);
1517 b1 = gen_llc_linktype(proto);
1518 gen_and(b0, b1);
1519 return b1;
1520 }
1521 /*NOTREACHED*/
1522 break;
1523
1524 case DLT_LINUX_SLL:
1525 return gen_linux_sll_linktype(proto);
1526 /*NOTREACHED*/
1527 break;
1528
1529 case DLT_SLIP:
1530 case DLT_SLIP_BSDOS:
1531 case DLT_RAW:
1532 /*
1533 * These types don't provide any type field; packets
1534 * are always IP.
1535 *
1536 * XXX - for IPv4, check for a version number of 4, and,
1537 * for IPv6, check for a version number of 6?
1538 */
1539 switch (proto) {
1540
1541 case ETHERTYPE_IP:
1542 #ifdef INET6
1543 case ETHERTYPE_IPV6:
1544 #endif
1545 return gen_true(); /* always true */
1546
1547 default:
1548 return gen_false(); /* always false */
1549 }
1550 /*NOTREACHED*/
1551 break;
1552
1553 case DLT_PPP:
1554 case DLT_PPP_PPPD:
1555 case DLT_PPP_SERIAL:
1556 case DLT_PPP_ETHER:
1557 /*
1558 * We use Ethernet protocol types inside libpcap;
1559 * map them to the corresponding PPP protocol types.
1560 */
1561 switch (proto) {
1562
1563 case ETHERTYPE_IP:
1564 proto = PPP_IP;
1565 break;
1566
1567 #ifdef INET6
1568 case ETHERTYPE_IPV6:
1569 proto = PPP_IPV6;
1570 break;
1571 #endif
1572
1573 case ETHERTYPE_DN:
1574 proto = PPP_DECNET;
1575 break;
1576
1577 case ETHERTYPE_ATALK:
1578 proto = PPP_APPLE;
1579 break;
1580
1581 case ETHERTYPE_NS:
1582 proto = PPP_NS;
1583 break;
1584
1585 case LLCSAP_ISONS:
1586 proto = PPP_OSI;
1587 break;
1588
1589 case LLCSAP_8021D:
1590 /*
1591 * I'm assuming the "Bridging PDU"s that go
1592 * over PPP are Spanning Tree Protocol
1593 * Bridging PDUs.
1594 */
1595 proto = PPP_BRPDU;
1596 break;
1597
1598 case LLCSAP_IPX:
1599 proto = PPP_IPX;
1600 break;
1601 }
1602 break;
1603
1604 case DLT_PPP_BSDOS:
1605 /*
1606 * We use Ethernet protocol types inside libpcap;
1607 * map them to the corresponding PPP protocol types.
1608 */
1609 switch (proto) {
1610
1611 case ETHERTYPE_IP:
1612 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
1613 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
1614 gen_or(b0, b1);
1615 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
1616 gen_or(b1, b0);
1617 return b0;
1618
1619 #ifdef INET6
1620 case ETHERTYPE_IPV6:
1621 proto = PPP_IPV6;
1622 /* more to go? */
1623 break;
1624 #endif
1625
1626 case ETHERTYPE_DN:
1627 proto = PPP_DECNET;
1628 break;
1629
1630 case ETHERTYPE_ATALK:
1631 proto = PPP_APPLE;
1632 break;
1633
1634 case ETHERTYPE_NS:
1635 proto = PPP_NS;
1636 break;
1637
1638 case LLCSAP_ISONS:
1639 proto = PPP_OSI;
1640 break;
1641
1642 case LLCSAP_8021D:
1643 /*
1644 * I'm assuming the "Bridging PDU"s that go
1645 * over PPP are Spanning Tree Protocol
1646 * Bridging PDUs.
1647 */
1648 proto = PPP_BRPDU;
1649 break;
1650
1651 case LLCSAP_IPX:
1652 proto = PPP_IPX;
1653 break;
1654 }
1655 break;
1656
1657 case DLT_NULL:
1658 case DLT_LOOP:
1659 case DLT_ENC:
1660 /*
1661 * For DLT_NULL, the link-layer header is a 32-bit
1662 * word containing an AF_ value in *host* byte order,
1663 * and for DLT_ENC, the link-layer header begins
1664 * with a 32-bit work containing an AF_ value in
1665 * host byte order.
1666 *
1667 * In addition, if we're reading a saved capture file,
1668 * the host byte order in the capture may not be the
1669 * same as the host byte order on this machine.
1670 *
1671 * For DLT_LOOP, the link-layer header is a 32-bit
1672 * word containing an AF_ value in *network* byte order.
1673 *
1674 * XXX - AF_ values may, unfortunately, be platform-
1675 * dependent; for example, FreeBSD's AF_INET6 is 24
1676 * whilst NetBSD's and OpenBSD's is 26.
1677 *
1678 * This means that, when reading a capture file, just
1679 * checking for our AF_INET6 value won't work if the
1680 * capture file came from another OS.
1681 */
1682 switch (proto) {
1683
1684 case ETHERTYPE_IP:
1685 proto = AF_INET;
1686 break;
1687
1688 #ifdef INET6
1689 case ETHERTYPE_IPV6:
1690 proto = AF_INET6;
1691 break;
1692 #endif
1693
1694 default:
1695 /*
1696 * Not a type on which we support filtering.
1697 * XXX - support those that have AF_ values
1698 * #defined on this platform, at least?
1699 */
1700 return gen_false();
1701 }
1702
1703 if (linktype == DLT_NULL || linktype == DLT_ENC) {
1704 /*
1705 * The AF_ value is in host byte order, but
1706 * the BPF interpreter will convert it to
1707 * network byte order.
1708 *
1709 * If this is a save file, and it's from a
1710 * machine with the opposite byte order to
1711 * ours, we byte-swap the AF_ value.
1712 *
1713 * Then we run it through "htonl()", and
1714 * generate code to compare against the result.
1715 */
1716 if (bpf_pcap->sf.rfile != NULL &&
1717 bpf_pcap->sf.swapped)
1718 proto = SWAPLONG(proto);
1719 proto = htonl(proto);
1720 }
1721 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
1722
1723 case DLT_PFLOG:
1724 /*
1725 * af field is host byte order in contrast to the rest of
1726 * the packet.
1727 */
1728 if (proto == ETHERTYPE_IP)
1729 return (gen_cmp(offsetof(struct pfloghdr, af), BPF_B,
1730 (bpf_int32)AF_INET));
1731 #ifdef INET6
1732 else if (proto == ETHERTYPE_IPV6)
1733 return (gen_cmp(offsetof(struct pfloghdr, af), BPF_B,
1734 (bpf_int32)AF_INET6));
1735 #endif /* INET6 */
1736 else
1737 return gen_false();
1738 /*NOTREACHED*/
1739 break;
1740
1741 case DLT_ARCNET:
1742 case DLT_ARCNET_LINUX:
1743 /*
1744 * XXX should we check for first fragment if the protocol
1745 * uses PHDS?
1746 */
1747 switch (proto) {
1748
1749 default:
1750 return gen_false();
1751
1752 #ifdef INET6
1753 case ETHERTYPE_IPV6:
1754 return (gen_cmp(off_linktype, BPF_B,
1755 (bpf_int32)ARCTYPE_INET6));
1756 #endif /* INET6 */
1757
1758 case ETHERTYPE_IP:
1759 b0 = gen_cmp(off_linktype, BPF_B,
1760 (bpf_int32)ARCTYPE_IP);
1761 b1 = gen_cmp(off_linktype, BPF_B,
1762 (bpf_int32)ARCTYPE_IP_OLD);
1763 gen_or(b0, b1);
1764 return (b1);
1765
1766 case ETHERTYPE_ARP:
1767 b0 = gen_cmp(off_linktype, BPF_B,
1768 (bpf_int32)ARCTYPE_ARP);
1769 b1 = gen_cmp(off_linktype, BPF_B,
1770 (bpf_int32)ARCTYPE_ARP_OLD);
1771 gen_or(b0, b1);
1772 return (b1);
1773
1774 case ETHERTYPE_REVARP:
1775 return (gen_cmp(off_linktype, BPF_B,
1776 (bpf_int32)ARCTYPE_REVARP));
1777
1778 case ETHERTYPE_ATALK:
1779 return (gen_cmp(off_linktype, BPF_B,
1780 (bpf_int32)ARCTYPE_ATALK));
1781 }
1782 /*NOTREACHED*/
1783 break;
1784
1785 case DLT_LTALK:
1786 switch (proto) {
1787 case ETHERTYPE_ATALK:
1788 return gen_true();
1789 default:
1790 return gen_false();
1791 }
1792 /*NOTREACHED*/
1793 break;
1794
1795 case DLT_FRELAY:
1796 /*
1797 * XXX - assumes a 2-byte Frame Relay header with
1798 * DLCI and flags. What if the address is longer?
1799 */
1800 switch (proto) {
1801
1802 case ETHERTYPE_IP:
1803 /*
1804 * Check for the special NLPID for IP.
1805 */
1806 return gen_cmp(2, BPF_H, (0x03<<8) | 0xcc);
1807
1808 #ifdef INET6
1809 case ETHERTYPE_IPV6:
1810 /*
1811 * Check for the special NLPID for IPv6.
1812 */
1813 return gen_cmp(2, BPF_H, (0x03<<8) | 0x8e);
1814 #endif
1815
1816 case LLCSAP_ISONS:
1817 /*
1818 * Check for several OSI protocols.
1819 *
1820 * Frame Relay packets typically have an OSI
1821 * NLPID at the beginning; we check for each
1822 * of them.
1823 *
1824 * What we check for is the NLPID and a frame
1825 * control field of UI, i.e. 0x03 followed
1826 * by the NLPID.
1827 */
1828 b0 = gen_cmp(2, BPF_H, (0x03<<8) | ISO8473_CLNP);
1829 b1 = gen_cmp(2, BPF_H, (0x03<<8) | ISO9542_ESIS);
1830 b2 = gen_cmp(2, BPF_H, (0x03<<8) | ISO10589_ISIS);
1831 gen_or(b1, b2);
1832 gen_or(b0, b2);
1833 return b2;
1834
1835 default:
1836 return gen_false();
1837 }
1838 /*NOTREACHED*/
1839 break;
1840
1841 case DLT_JUNIPER_MLFR:
1842 case DLT_JUNIPER_MLPPP:
1843 case DLT_JUNIPER_ATM1:
1844 case DLT_JUNIPER_ATM2:
1845 /* just lets verify the magic number for now -
1846 * on ATM we may have up to 6 different encapsulations on the wire
1847 * and need a lot of heuristics to figure out that the payload
1848 * might be;
1849 *
1850 * FIXME encapsulation specific BPF_ filters
1851 */
1852 return gen_mcmp(0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */
1853
1854 case DLT_LINUX_IRDA:
1855 bpf_error("IrDA link-layer type filtering not implemented");
1856
1857 case DLT_DOCSIS:
1858 bpf_error("DOCSIS link-layer type filtering not implemented");
1859
1860 case DLT_LINUX_LAPD:
1861 bpf_error("LAPD link-layer type filtering not implemented");
1862 }
1863
1864 /*
1865 * All the types that have no encapsulation should either be
1866 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
1867 * all packets are IP packets, or should be handled in some
1868 * special case, if none of them are (if some are and some
1869 * aren't, the lack of encapsulation is a problem, as we'd
1870 * have to find some other way of determining the packet type).
1871 *
1872 * Therefore, if "off_linktype" is -1, there's an error.
1873 */
1874 if (off_linktype == (u_int)-1)
1875 abort();
1876
1877 /*
1878 * Any type not handled above should always have an Ethernet
1879 * type at an offset of "off_linktype". (PPP is partially
1880 * handled above - the protocol type is mapped from the
1881 * Ethernet and LLC types we use internally to the corresponding
1882 * PPP type - but the PPP type is always specified by a value
1883 * at "off_linktype", so we don't have to do the code generation
1884 * above.)
1885 */
1886 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1887 }
1888
1889 /*
1890 * Check for an LLC SNAP packet with a given organization code and
1891 * protocol type; we check the entire contents of the 802.2 LLC and
1892 * snap headers, checking for DSAP and SSAP of SNAP and a control
1893 * field of 0x03 in the LLC header, and for the specified organization
1894 * code and protocol type in the SNAP header.
1895 */
1896 static struct block *
1897 gen_snap(orgcode, ptype, offset)
1898 bpf_u_int32 orgcode;
1899 bpf_u_int32 ptype;
1900 u_int offset;
1901 {
1902 u_char snapblock[8];
1903
1904 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */
1905 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
1906 snapblock[2] = 0x03; /* control = UI */
1907 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
1908 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */
1909 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */
1910 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */
1911 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */
1912 return gen_bcmp(offset, 8, snapblock);
1913 }
1914
1915 /*
1916 * Generate code to match a particular packet type, for link-layer types
1917 * using 802.2 LLC headers.
1918 *
1919 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used
1920 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues.
1921 *
1922 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1923 * value, if <= ETHERMTU. We use that to determine whether to
1924 * match the DSAP or both DSAP and LSAP or to check the OUI and
1925 * protocol ID in a SNAP header.
1926 */
1927 static struct block *
1928 gen_llc_linktype(proto)
1929 int proto;
1930 {
1931 /*
1932 * XXX - handle token-ring variable-length header.
1933 */
1934 switch (proto) {
1935
1936 case LLCSAP_IP:
1937 case LLCSAP_ISONS:
1938 case LLCSAP_NETBEUI:
1939 /*
1940 * XXX - should we check both the DSAP and the
1941 * SSAP, like this, or should we check just the
1942 * DSAP, as we do for other types <= ETHERMTU
1943 * (i.e., other SAP values)?
1944 */
1945 return gen_cmp(off_linktype, BPF_H, (long)
1946 ((proto << 8) | proto));
1947
1948 case LLCSAP_IPX:
1949 /*
1950 * XXX - are there ever SNAP frames for IPX on
1951 * non-Ethernet 802.x networks?
1952 */
1953 return gen_cmp(off_linktype, BPF_B, (bpf_int32)LLCSAP_IPX);
1954
1955 case ETHERTYPE_ATALK:
1956 /*
1957 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1958 * SNAP packets with an organization code of
1959 * 0x080007 (Apple, for Appletalk) and a protocol
1960 * type of ETHERTYPE_ATALK (Appletalk).
1961 *
1962 * XXX - check for an organization code of
1963 * encapsulated Ethernet as well?
1964 */
1965 return gen_snap(0x080007, ETHERTYPE_ATALK, off_linktype);
1966
1967 default:
1968 /*
1969 * XXX - we don't have to check for IPX 802.3
1970 * here, but should we check for the IPX Ethertype?
1971 */
1972 if (proto <= ETHERMTU) {
1973 /*
1974 * This is an LLC SAP value, so check
1975 * the DSAP.
1976 */
1977 return gen_cmp(off_linktype, BPF_B, (bpf_int32)proto);
1978 } else {
1979 /*
1980 * This is an Ethernet type; we assume that it's
1981 * unlikely that it'll appear in the right place
1982 * at random, and therefore check only the
1983 * location that would hold the Ethernet type
1984 * in a SNAP frame with an organization code of
1985 * 0x000000 (encapsulated Ethernet).
1986 *
1987 * XXX - if we were to check for the SNAP DSAP and
1988 * LSAP, as per XXX, and were also to check for an
1989 * organization code of 0x000000 (encapsulated
1990 * Ethernet), we'd do
1991 *
1992 * return gen_snap(0x000000, proto,
1993 * off_linktype);
1994 *
1995 * here; for now, we don't, as per the above.
1996 * I don't know whether it's worth the extra CPU
1997 * time to do the right check or not.
1998 */
1999 return gen_cmp(off_linktype+6, BPF_H, (bpf_int32)proto);
2000 }
2001 }
2002 }
2003
2004 static struct block *
2005 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
2006 bpf_u_int32 addr;
2007 bpf_u_int32 mask;
2008 int dir, proto;
2009 u_int src_off, dst_off;
2010 {
2011 struct block *b0, *b1;
2012 u_int offset;
2013
2014 switch (dir) {
2015
2016 case Q_SRC:
2017 offset = src_off;
2018 break;
2019
2020 case Q_DST:
2021 offset = dst_off;
2022 break;
2023
2024 case Q_AND:
2025 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
2026 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
2027 gen_and(b0, b1);
2028 return b1;
2029
2030 case Q_OR:
2031 case Q_DEFAULT:
2032 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
2033 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
2034 gen_or(b0, b1);
2035 return b1;
2036
2037 default:
2038 abort();
2039 }
2040 b0 = gen_linktype(proto);
2041 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
2042 gen_and(b0, b1);
2043 return b1;
2044 }
2045
2046 #ifdef INET6
2047 static struct block *
2048 gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
2049 struct in6_addr *addr;
2050 struct in6_addr *mask;
2051 int dir, proto;
2052 u_int src_off, dst_off;
2053 {
2054 struct block *b0, *b1;
2055 u_int offset;
2056 u_int32_t *a, *m;
2057
2058 switch (dir) {
2059
2060 case Q_SRC:
2061 offset = src_off;
2062 break;
2063
2064 case Q_DST:
2065 offset = dst_off;
2066 break;
2067
2068 case Q_AND:
2069 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
2070 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
2071 gen_and(b0, b1);
2072 return b1;
2073
2074 case Q_OR:
2075 case Q_DEFAULT:
2076 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
2077 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
2078 gen_or(b0, b1);
2079 return b1;
2080
2081 default:
2082 abort();
2083 }
2084 /* this order is important */
2085 a = (u_int32_t *)addr;
2086 m = (u_int32_t *)mask;
2087 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
2088 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
2089 gen_and(b0, b1);
2090 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
2091 gen_and(b0, b1);
2092 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
2093 gen_and(b0, b1);
2094 b0 = gen_linktype(proto);
2095 gen_and(b0, b1);
2096 return b1;
2097 }
2098 #endif /*INET6*/
2099
2100 static struct block *
2101 gen_ehostop(eaddr, dir)
2102 register const u_char *eaddr;
2103 register int dir;
2104 {
2105 register struct block *b0, *b1;
2106
2107 switch (dir) {
2108 case Q_SRC:
2109 return gen_bcmp(off_mac + 6, 6, eaddr);
2110
2111 case Q_DST:
2112 return gen_bcmp(off_mac + 0, 6, eaddr);
2113
2114 case Q_AND:
2115 b0 = gen_ehostop(eaddr, Q_SRC);
2116 b1 = gen_ehostop(eaddr, Q_DST);
2117 gen_and(b0, b1);
2118 return b1;
2119
2120 case Q_DEFAULT:
2121 case Q_OR:
2122 b0 = gen_ehostop(eaddr, Q_SRC);
2123 b1 = gen_ehostop(eaddr, Q_DST);
2124 gen_or(b0, b1);
2125 return b1;
2126 }
2127 abort();
2128 /* NOTREACHED */
2129 }
2130
2131 /*
2132 * Like gen_ehostop, but for DLT_FDDI
2133 */
2134 static struct block *
2135 gen_fhostop(eaddr, dir)
2136 register const u_char *eaddr;
2137 register int dir;
2138 {
2139 struct block *b0, *b1;
2140
2141 switch (dir) {
2142 case Q_SRC:
2143 #ifdef PCAP_FDDIPAD
2144 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
2145 #else
2146 return gen_bcmp(6 + 1, 6, eaddr);
2147 #endif
2148
2149 case Q_DST:
2150 #ifdef PCAP_FDDIPAD
2151 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
2152 #else
2153 return gen_bcmp(0 + 1, 6, eaddr);
2154 #endif
2155
2156 case Q_AND:
2157 b0 = gen_fhostop(eaddr, Q_SRC);
2158 b1 = gen_fhostop(eaddr, Q_DST);
2159 gen_and(b0, b1);
2160 return b1;
2161
2162 case Q_DEFAULT:
2163 case Q_OR:
2164 b0 = gen_fhostop(eaddr, Q_SRC);
2165 b1 = gen_fhostop(eaddr, Q_DST);
2166 gen_or(b0, b1);
2167 return b1;
2168 }
2169 abort();
2170 /* NOTREACHED */
2171 }
2172
2173 /*
2174 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
2175 */
2176 static struct block *
2177 gen_thostop(eaddr, dir)
2178 register const u_char *eaddr;
2179 register int dir;
2180 {
2181 register struct block *b0, *b1;
2182
2183 switch (dir) {
2184 case Q_SRC:
2185 return gen_bcmp(8, 6, eaddr);
2186
2187 case Q_DST:
2188 return gen_bcmp(2, 6, eaddr);
2189
2190 case Q_AND:
2191 b0 = gen_thostop(eaddr, Q_SRC);
2192 b1 = gen_thostop(eaddr, Q_DST);
2193 gen_and(b0, b1);
2194 return b1;
2195
2196 case Q_DEFAULT:
2197 case Q_OR:
2198 b0 = gen_thostop(eaddr, Q_SRC);
2199 b1 = gen_thostop(eaddr, Q_DST);
2200 gen_or(b0, b1);
2201 return b1;
2202 }
2203 abort();
2204 /* NOTREACHED */
2205 }
2206
2207 /*
2208 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN)
2209 */
2210 static struct block *
2211 gen_wlanhostop(eaddr, dir)
2212 register const u_char *eaddr;
2213 register int dir;
2214 {
2215 register struct block *b0, *b1, *b2;
2216 register struct slist *s;
2217
2218 switch (dir) {
2219 case Q_SRC:
2220 /*
2221 * Oh, yuk.
2222 *
2223 * For control frames, there is no SA.
2224 *
2225 * For management frames, SA is at an
2226 * offset of 10 from the beginning of
2227 * the packet.
2228 *
2229 * For data frames, SA is at an offset
2230 * of 10 from the beginning of the packet
2231 * if From DS is clear, at an offset of
2232 * 16 from the beginning of the packet
2233 * if From DS is set and To DS is clear,
2234 * and an offset of 24 from the beginning
2235 * of the packet if From DS is set and To DS
2236 * is set.
2237 */
2238
2239 /*
2240 * Generate the tests to be done for data frames
2241 * with From DS set.
2242 *
2243 * First, check for To DS set, i.e. check "link[1] & 0x01".
2244 */
2245 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2246 s->s.k = 1;
2247 b1 = new_block(JMP(BPF_JSET));
2248 b1->s.k = 0x01; /* To DS */
2249 b1->stmts = s;
2250
2251 /*
2252 * If To DS is set, the SA is at 24.
2253 */
2254 b0 = gen_bcmp(24, 6, eaddr);
2255 gen_and(b1, b0);
2256
2257 /*
2258 * Now, check for To DS not set, i.e. check
2259 * "!(link[1] & 0x01)".
2260 */
2261 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2262 s->s.k = 1;
2263 b2 = new_block(JMP(BPF_JSET));
2264 b2->s.k = 0x01; /* To DS */
2265 b2->stmts = s;
2266 gen_not(b2);
2267
2268 /*
2269 * If To DS is not set, the SA is at 16.
2270 */
2271 b1 = gen_bcmp(16, 6, eaddr);
2272 gen_and(b2, b1);
2273
2274 /*
2275 * Now OR together the last two checks. That gives
2276 * the complete set of checks for data frames with
2277 * From DS set.
2278 */
2279 gen_or(b1, b0);
2280
2281 /*
2282 * Now check for From DS being set, and AND that with
2283 * the ORed-together checks.
2284 */
2285 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2286 s->s.k = 1;
2287 b1 = new_block(JMP(BPF_JSET));
2288 b1->s.k = 0x02; /* From DS */
2289 b1->stmts = s;
2290 gen_and(b1, b0);
2291
2292 /*
2293 * Now check for data frames with From DS not set.
2294 */
2295 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2296 s->s.k = 1;
2297 b2 = new_block(JMP(BPF_JSET));
2298 b2->s.k = 0x02; /* From DS */
2299 b2->stmts = s;
2300 gen_not(b2);
2301
2302 /*
2303 * If From DS isn't set, the SA is at 10.
2304 */
2305 b1 = gen_bcmp(10, 6, eaddr);
2306 gen_and(b2, b1);
2307
2308 /*
2309 * Now OR together the checks for data frames with
2310 * From DS not set and for data frames with From DS
2311 * set; that gives the checks done for data frames.
2312 */
2313 gen_or(b1, b0);
2314
2315 /*
2316 * Now check for a data frame.
2317 * I.e, check "link[0] & 0x08".
2318 */
2319 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2320 s->s.k = 0;
2321 b1 = new_block(JMP(BPF_JSET));
2322 b1->s.k = 0x08;
2323 b1->stmts = s;
2324
2325 /*
2326 * AND that with the checks done for data frames.
2327 */
2328 gen_and(b1, b0);
2329
2330 /*
2331 * If the high-order bit of the type value is 0, this
2332 * is a management frame.
2333 * I.e, check "!(link[0] & 0x08)".
2334 */
2335 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2336 s->s.k = 0;
2337 b2 = new_block(JMP(BPF_JSET));
2338 b2->s.k = 0x08;
2339 b2->stmts = s;
2340 gen_not(b2);
2341
2342 /*
2343 * For management frames, the SA is at 10.
2344 */
2345 b1 = gen_bcmp(10, 6, eaddr);
2346 gen_and(b2, b1);
2347
2348 /*
2349 * OR that with the checks done for data frames.
2350 * That gives the checks done for management and
2351 * data frames.
2352 */
2353 gen_or(b1, b0);
2354
2355 /*
2356 * If the low-order bit of the type value is 1,
2357 * this is either a control frame or a frame
2358 * with a reserved type, and thus not a
2359 * frame with an SA.
2360 *
2361 * I.e., check "!(link[0] & 0x04)".
2362 */
2363 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2364 s->s.k = 0;
2365 b1 = new_block(JMP(BPF_JSET));
2366 b1->s.k = 0x04;
2367 b1->stmts = s;
2368 gen_not(b1);
2369
2370 /*
2371 * AND that with the checks for data and management
2372 * frames.
2373 */
2374 gen_and(b1, b0);
2375 return b0;
2376
2377 case Q_DST:
2378 /*
2379 * Oh, yuk.
2380 *
2381 * For control frames, there is no DA.
2382 *
2383 * For management frames, DA is at an
2384 * offset of 4 from the beginning of
2385 * the packet.
2386 *
2387 * For data frames, DA is at an offset
2388 * of 4 from the beginning of the packet
2389 * if To DS is clear and at an offset of
2390 * 16 from the beginning of the packet
2391 * if To DS is set.
2392 */
2393
2394 /*
2395 * Generate the tests to be done for data frames.
2396 *
2397 * First, check for To DS set, i.e. "link[1] & 0x01".
2398 */
2399 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2400 s->s.k = 1;
2401 b1 = new_block(JMP(BPF_JSET));
2402 b1->s.k = 0x01; /* To DS */
2403 b1->stmts = s;
2404
2405 /*
2406 * If To DS is set, the DA is at 16.
2407 */
2408 b0 = gen_bcmp(16, 6, eaddr);
2409 gen_and(b1, b0);
2410
2411 /*
2412 * Now, check for To DS not set, i.e. check
2413 * "!(link[1] & 0x01)".
2414 */
2415 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2416 s->s.k = 1;
2417 b2 = new_block(JMP(BPF_JSET));
2418 b2->s.k = 0x01; /* To DS */
2419 b2->stmts = s;
2420 gen_not(b2);
2421
2422 /*
2423 * If To DS is not set, the DA is at 4.
2424 */
2425 b1 = gen_bcmp(4, 6, eaddr);
2426 gen_and(b2, b1);
2427
2428 /*
2429 * Now OR together the last two checks. That gives
2430 * the complete set of checks for data frames.
2431 */
2432 gen_or(b1, b0);
2433
2434 /*
2435 * Now check for a data frame.
2436 * I.e, check "link[0] & 0x08".
2437 */
2438 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2439 s->s.k = 0;
2440 b1 = new_block(JMP(BPF_JSET));
2441 b1->s.k = 0x08;
2442 b1->stmts = s;
2443
2444 /*
2445 * AND that with the checks done for data frames.
2446 */
2447 gen_and(b1, b0);
2448
2449 /*
2450 * If the high-order bit of the type value is 0, this
2451 * is a management frame.
2452 * I.e, check "!(link[0] & 0x08)".
2453 */
2454 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2455 s->s.k = 0;
2456 b2 = new_block(JMP(BPF_JSET));
2457 b2->s.k = 0x08;
2458 b2->stmts = s;
2459 gen_not(b2);
2460
2461 /*
2462 * For management frames, the DA is at 4.
2463 */
2464 b1 = gen_bcmp(4, 6, eaddr);
2465 gen_and(b2, b1);
2466
2467 /*
2468 * OR that with the checks done for data frames.
2469 * That gives the checks done for management and
2470 * data frames.
2471 */
2472 gen_or(b1, b0);
2473
2474 /*
2475 * If the low-order bit of the type value is 1,
2476 * this is either a control frame or a frame
2477 * with a reserved type, and thus not a
2478 * frame with an SA.
2479 *
2480 * I.e., check "!(link[0] & 0x04)".
2481 */
2482 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2483 s->s.k = 0;
2484 b1 = new_block(JMP(BPF_JSET));
2485 b1->s.k = 0x04;
2486 b1->stmts = s;
2487 gen_not(b1);
2488
2489 /*
2490 * AND that with the checks for data and management
2491 * frames.
2492 */
2493 gen_and(b1, b0);
2494 return b0;
2495
2496 case Q_AND:
2497 b0 = gen_wlanhostop(eaddr, Q_SRC);
2498 b1 = gen_wlanhostop(eaddr, Q_DST);
2499 gen_and(b0, b1);
2500 return b1;
2501
2502 case Q_DEFAULT:
2503 case Q_OR:
2504 b0 = gen_wlanhostop(eaddr, Q_SRC);
2505 b1 = gen_wlanhostop(eaddr, Q_DST);
2506 gen_or(b0, b1);
2507 return b1;
2508 }
2509 abort();
2510 /* NOTREACHED */
2511 }
2512
2513 /*
2514 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel.
2515 * (We assume that the addresses are IEEE 48-bit MAC addresses,
2516 * as the RFC states.)
2517 */
2518 static struct block *
2519 gen_ipfchostop(eaddr, dir)
2520 register const u_char *eaddr;
2521 register int dir;
2522 {
2523 register struct block *b0, *b1;
2524
2525 switch (dir) {
2526 case Q_SRC:
2527 return gen_bcmp(10, 6, eaddr);
2528
2529 case Q_DST:
2530 return gen_bcmp(2, 6, eaddr);
2531
2532 case Q_AND:
2533 b0 = gen_ipfchostop(eaddr, Q_SRC);
2534 b1 = gen_ipfchostop(eaddr, Q_DST);
2535 gen_and(b0, b1);
2536 return b1;
2537
2538 case Q_DEFAULT:
2539 case Q_OR:
2540 b0 = gen_ipfchostop(eaddr, Q_SRC);
2541 b1 = gen_ipfchostop(eaddr, Q_DST);
2542 gen_or(b0, b1);
2543 return b1;
2544 }
2545 abort();
2546 /* NOTREACHED */
2547 }
2548
2549 /*
2550 * This is quite tricky because there may be pad bytes in front of the
2551 * DECNET header, and then there are two possible data packet formats that
2552 * carry both src and dst addresses, plus 5 packet types in a format that
2553 * carries only the src node, plus 2 types that use a different format and
2554 * also carry just the src node.
2555 *
2556 * Yuck.
2557 *
2558 * Instead of doing those all right, we just look for data packets with
2559 * 0 or 1 bytes of padding. If you want to look at other packets, that
2560 * will require a lot more hacking.
2561 *
2562 * To add support for filtering on DECNET "areas" (network numbers)
2563 * one would want to add a "mask" argument to this routine. That would
2564 * make the filter even more inefficient, although one could be clever
2565 * and not generate masking instructions if the mask is 0xFFFF.
2566 */
2567 static struct block *
2568 gen_dnhostop(addr, dir, base_off)
2569 bpf_u_int32 addr;
2570 int dir;
2571 u_int base_off;
2572 {
2573 struct block *b0, *b1, *b2, *tmp;
2574 u_int offset_lh; /* offset if long header is received */
2575 u_int offset_sh; /* offset if short header is received */
2576
2577 switch (dir) {
2578
2579 case Q_DST:
2580 offset_sh = 1; /* follows flags */
2581 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */
2582 break;
2583
2584 case Q_SRC:
2585 offset_sh = 3; /* follows flags, dstnode */
2586 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
2587 break;
2588
2589 case Q_AND:
2590 /* Inefficient because we do our Calvinball dance twice */
2591 b0 = gen_dnhostop(addr, Q_SRC, base_off);
2592 b1 = gen_dnhostop(addr, Q_DST, base_off);
2593 gen_and(b0, b1);
2594 return b1;
2595
2596 case Q_OR:
2597 case Q_DEFAULT:
2598 /* Inefficient because we do our Calvinball dance twice */
2599 b0 = gen_dnhostop(addr, Q_SRC, base_off);
2600 b1 = gen_dnhostop(addr, Q_DST, base_off);
2601 gen_or(b0, b1);
2602 return b1;
2603
2604 case Q_ISO:
2605 bpf_error("ISO host filtering not implemented");
2606
2607 default:
2608 abort();
2609 }
2610 b0 = gen_linktype(ETHERTYPE_DN);
2611 /* Check for pad = 1, long header case */
2612 tmp = gen_mcmp(base_off + 2, BPF_H,
2613 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
2614 b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
2615 BPF_H, (bpf_int32)ntohs(addr));
2616 gen_and(tmp, b1);
2617 /* Check for pad = 0, long header case */
2618 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
2619 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
2620 gen_and(tmp, b2);
2621 gen_or(b2, b1);
2622 /* Check for pad = 1, short header case */
2623 tmp = gen_mcmp(base_off + 2, BPF_H,
2624 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
2625 b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
2626 BPF_H, (bpf_int32)ntohs(addr));
2627 gen_and(tmp, b2);
2628 gen_or(b2, b1);
2629 /* Check for pad = 0, short header case */
2630 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
2631 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
2632 gen_and(tmp, b2);
2633 gen_or(b2, b1);
2634
2635 /* Combine with test for linktype */
2636 gen_and(b0, b1);
2637 return b1;
2638 }
2639
2640 static struct block *
2641 gen_host(addr, mask, proto, dir)
2642 bpf_u_int32 addr;
2643 bpf_u_int32 mask;
2644 int proto;
2645 int dir;
2646 {
2647 struct block *b0, *b1;
2648
2649 switch (proto) {
2650
2651 case Q_DEFAULT:
2652 b0 = gen_host(addr, mask, Q_IP, dir);
2653 if (off_linktype != (u_int)-1) {
2654 b1 = gen_host(addr, mask, Q_ARP, dir);
2655 gen_or(b0, b1);
2656 b0 = gen_host(addr, mask, Q_RARP, dir);
2657 gen_or(b1, b0);
2658 }
2659 return b0;
2660
2661 case Q_IP:
2662 return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
2663 off_nl + 12, off_nl + 16);
2664
2665 case Q_RARP:
2666 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
2667 off_nl + 14, off_nl + 24);
2668
2669 case Q_ARP:
2670 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
2671 off_nl + 14, off_nl + 24);
2672
2673 case Q_TCP:
2674 bpf_error("'tcp' modifier applied to host");
2675
2676 case Q_SCTP:
2677 bpf_error("'sctp' modifier applied to host");
2678
2679 case Q_UDP:
2680 bpf_error("'udp' modifier applied to host");
2681
2682 case Q_ICMP:
2683 bpf_error("'icmp' modifier applied to host");
2684
2685 case Q_IGMP:
2686 bpf_error("'igmp' modifier applied to host");
2687
2688 case Q_IGRP:
2689 bpf_error("'igrp' modifier applied to host");
2690
2691 case Q_PIM:
2692 bpf_error("'pim' modifier applied to host");
2693
2694 case Q_VRRP:
2695 bpf_error("'vrrp' modifier applied to host");
2696
2697 case Q_ATALK:
2698 bpf_error("ATALK host filtering not implemented");
2699
2700 case Q_AARP:
2701 bpf_error("AARP host filtering not implemented");
2702
2703 case Q_DECNET:
2704 return gen_dnhostop(addr, dir, off_nl);
2705
2706 case Q_SCA:
2707 bpf_error("SCA host filtering not implemented");
2708
2709 case Q_LAT:
2710 bpf_error("LAT host filtering not implemented");
2711
2712 case Q_MOPDL:
2713 bpf_error("MOPDL host filtering not implemented");
2714
2715 case Q_MOPRC:
2716 bpf_error("MOPRC host filtering not implemented");
2717
2718 #ifdef INET6
2719 case Q_IPV6:
2720 bpf_error("'ip6' modifier applied to ip host");
2721
2722 case Q_ICMPV6:
2723 bpf_error("'icmp6' modifier applied to host");
2724 #endif /* INET6 */
2725
2726 case Q_AH:
2727 bpf_error("'ah' modifier applied to host");
2728
2729 case Q_ESP:
2730 bpf_error("'esp' modifier applied to host");
2731
2732 case Q_ISO:
2733 bpf_error("ISO host filtering not implemented");
2734
2735 case Q_ESIS:
2736 bpf_error("'esis' modifier applied to host");
2737
2738 case Q_ISIS:
2739 bpf_error("'isis' modifier applied to host");
2740
2741 case Q_CLNP:
2742 bpf_error("'clnp' modifier applied to host");
2743
2744 case Q_STP:
2745 bpf_error("'stp' modifier applied to host");
2746
2747 case Q_IPX:
2748 bpf_error("IPX host filtering not implemented");
2749
2750 case Q_NETBEUI:
2751 bpf_error("'netbeui' modifier applied to host");
2752
2753 default:
2754 abort();
2755 }
2756 /* NOTREACHED */
2757 }
2758
2759 #ifdef INET6
2760 static struct block *
2761 gen_host6(addr, mask, proto, dir)
2762 struct in6_addr *addr;
2763 struct in6_addr *mask;
2764 int proto;
2765 int dir;
2766 {
2767 switch (proto) {
2768
2769 case Q_DEFAULT:
2770 return gen_host6(addr, mask, Q_IPV6, dir);
2771
2772 case Q_IP:
2773 bpf_error("'ip' modifier applied to ip6 host");
2774
2775 case Q_RARP:
2776 bpf_error("'rarp' modifier applied to ip6 host");
2777
2778 case Q_ARP:
2779 bpf_error("'arp' modifier applied to ip6 host");
2780
2781 case Q_SCTP:
2782 bpf_error("'sctp' modifier applied to host");
2783
2784 case Q_TCP:
2785 bpf_error("'tcp' modifier applied to host");
2786
2787 case Q_UDP:
2788 bpf_error("'udp' modifier applied to host");
2789
2790 case Q_ICMP:
2791 bpf_error("'icmp' modifier applied to host");
2792
2793 case Q_IGMP:
2794 bpf_error("'igmp' modifier applied to host");
2795
2796 case Q_IGRP:
2797 bpf_error("'igrp' modifier applied to host");
2798
2799 case Q_PIM:
2800 bpf_error("'pim' modifier applied to host");
2801
2802 case Q_VRRP:
2803 bpf_error("'vrrp' modifier applied to host");
2804
2805 case Q_ATALK:
2806 bpf_error("ATALK host filtering not implemented");
2807
2808 case Q_AARP:
2809 bpf_error("AARP host filtering not implemented");
2810
2811 case Q_DECNET:
2812 bpf_error("'decnet' modifier applied to ip6 host");
2813
2814 case Q_SCA:
2815 bpf_error("SCA host filtering not implemented");
2816
2817 case Q_LAT:
2818 bpf_error("LAT host filtering not implemented");
2819
2820 case Q_MOPDL:
2821 bpf_error("MOPDL host filtering not implemented");
2822
2823 case Q_MOPRC:
2824 bpf_error("MOPRC host filtering not implemented");
2825
2826 case Q_IPV6:
2827 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
2828 off_nl + 8, off_nl + 24);
2829
2830 case Q_ICMPV6:
2831 bpf_error("'icmp6' modifier applied to host");
2832
2833 case Q_AH:
2834 bpf_error("'ah' modifier applied to host");
2835
2836 case Q_ESP:
2837 bpf_error("'esp' modifier applied to host");
2838
2839 case Q_ISO:
2840 bpf_error("ISO host filtering not implemented");
2841
2842 case Q_ESIS:
2843 bpf_error("'esis' modifier applied to host");
2844
2845 case Q_ISIS:
2846 bpf_error("'isis' modifier applied to host");
2847
2848 case Q_CLNP:
2849 bpf_error("'clnp' modifier applied to host");
2850
2851 case Q_STP:
2852 bpf_error("'stp' modifier applied to host");
2853
2854 case Q_IPX:
2855 bpf_error("IPX host filtering not implemented");
2856
2857 case Q_NETBEUI:
2858 bpf_error("'netbeui' modifier applied to host");
2859
2860 default:
2861 abort();
2862 }
2863 /* NOTREACHED */
2864 }
2865 #endif /*INET6*/
2866
2867 #ifndef INET6
2868 static struct block *
2869 gen_gateway(eaddr, alist, proto, dir)
2870 const u_char *eaddr;
2871 bpf_u_int32 **alist;
2872 int proto;
2873 int dir;
2874 {
2875 struct block *b0, *b1, *tmp;
2876
2877 if (dir != 0)
2878 bpf_error("direction applied to 'gateway'");
2879
2880 switch (proto) {
2881 case Q_DEFAULT:
2882 case Q_IP:
2883 case Q_ARP:
2884 case Q_RARP:
2885 if (linktype == DLT_EN10MB)
2886 b0 = gen_ehostop(eaddr, Q_OR);
2887 else if (linktype == DLT_FDDI)
2888 b0 = gen_fhostop(eaddr, Q_OR);
2889 else if (linktype == DLT_IEEE802)
2890 b0 = gen_thostop(eaddr, Q_OR);
2891 else if (linktype == DLT_IEEE802_11)
2892 b0 = gen_wlanhostop(eaddr, Q_OR);
2893 else if (linktype == DLT_SUNATM && is_lane) {
2894 /*
2895 * Check that the packet doesn't begin with an
2896 * LE Control marker. (We've already generated
2897 * a test for LANE.)
2898 */
2899 b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
2900 gen_not(b1);
2901
2902 /*
2903 * Now check the MAC address.
2904 */
2905 b0 = gen_ehostop(eaddr, Q_OR);
2906 gen_and(b1, b0);
2907 } else if (linktype == DLT_IP_OVER_FC)
2908 b0 = gen_ipfchostop(eaddr, Q_OR);
2909 else
2910 bpf_error(
2911 "'gateway' supported only on ethernet/FDDI/token ring/802.11/Fibre Channel");
2912
2913 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
2914 while (*alist) {
2915 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR);
2916 gen_or(b1, tmp);
2917 b1 = tmp;
2918 }
2919 gen_not(b1);
2920 gen_and(b0, b1);
2921 return b1;
2922 }
2923 bpf_error("illegal modifier of 'gateway'");
2924 /* NOTREACHED */
2925 }
2926 #endif
2927
2928 struct block *
2929 gen_proto_abbrev(proto)
2930 int proto;
2931 {
2932 struct block *b0;
2933 struct block *b1;
2934
2935 switch (proto) {
2936
2937 case Q_SCTP:
2938 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT);
2939 #ifdef INET6
2940 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT);
2941 gen_or(b0, b1);
2942 #endif
2943 break;
2944
2945 case Q_TCP:
2946 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
2947 #ifdef INET6
2948 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
2949 gen_or(b0, b1);
2950 #endif
2951 break;
2952
2953 case Q_UDP:
2954 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT);
2955 #ifdef INET6
2956 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
2957 gen_or(b0, b1);
2958 #endif
2959 break;
2960
2961 case Q_ICMP:
2962 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT);
2963 break;
2964
2965 #ifndef IPPROTO_IGMP
2966 #define IPPROTO_IGMP 2
2967 #endif
2968
2969 case Q_IGMP:
2970 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT);
2971 break;
2972
2973 #ifndef IPPROTO_IGRP
2974 #define IPPROTO_IGRP 9
2975 #endif
2976 case Q_IGRP:
2977 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT);
2978 break;
2979
2980 #ifndef IPPROTO_PIM
2981 #define IPPROTO_PIM 103
2982 #endif
2983
2984 case Q_PIM:
2985 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT);
2986 #ifdef INET6
2987 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
2988 gen_or(b0, b1);
2989 #endif
2990 break;
2991
2992 #ifndef IPPROTO_VRRP
2993 #define IPPROTO_VRRP 112
2994 #endif
2995
2996 case Q_VRRP:
2997 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT);
2998 break;
2999
3000 case Q_IP:
3001 b1 = gen_linktype(ETHERTYPE_IP);
3002 break;
3003
3004 case Q_ARP:
3005 b1 = gen_linktype(ETHERTYPE_ARP);
3006 break;
3007
3008 case Q_RARP:
3009 b1 = gen_linktype(ETHERTYPE_REVARP);
3010 break;
3011
3012 case Q_LINK:
3013 bpf_error("link layer applied in wrong context");
3014
3015 case Q_ATALK:
3016 b1 = gen_linktype(ETHERTYPE_ATALK);
3017 break;
3018
3019 case Q_AARP:
3020 b1 = gen_linktype(ETHERTYPE_AARP);
3021 break;
3022
3023 case Q_DECNET:
3024 b1 = gen_linktype(ETHERTYPE_DN);
3025 break;
3026
3027 case Q_SCA:
3028 b1 = gen_linktype(ETHERTYPE_SCA);
3029 break;
3030
3031 case Q_LAT:
3032 b1 = gen_linktype(ETHERTYPE_LAT);
3033 break;
3034
3035 case Q_MOPDL:
3036 b1 = gen_linktype(ETHERTYPE_MOPDL);
3037 break;
3038
3039 case Q_MOPRC:
3040 b1 = gen_linktype(ETHERTYPE_MOPRC);
3041 break;
3042
3043 #ifdef INET6
3044 case Q_IPV6:
3045 b1 = gen_linktype(ETHERTYPE_IPV6);
3046 break;
3047
3048 #ifndef IPPROTO_ICMPV6
3049 #define IPPROTO_ICMPV6 58
3050 #endif
3051 case Q_ICMPV6:
3052 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
3053 break;
3054 #endif /* INET6 */
3055
3056 #ifndef IPPROTO_AH
3057 #define IPPROTO_AH 51
3058 #endif
3059 case Q_AH:
3060 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT);
3061 #ifdef INET6
3062 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT);
3063 gen_or(b0, b1);
3064 #endif
3065 break;
3066
3067 #ifndef IPPROTO_ESP
3068 #define IPPROTO_ESP 50
3069 #endif
3070 case Q_ESP:
3071 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT);
3072 #ifdef INET6
3073 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
3074 gen_or(b0, b1);
3075 #endif
3076 break;
3077
3078 case Q_ISO:
3079 b1 = gen_linktype(LLCSAP_ISONS);
3080 break;
3081
3082 case Q_ESIS:
3083 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT);
3084 break;
3085
3086 case Q_ISIS:
3087 b0 = gen_linktype(LLCSAP_ISONS);
3088 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
3089 gen_and(b0, b1);
3090 break;
3091
3092 case Q_ISIS_L1: /* all IS-IS Level1 PDU-Types */
3093 b0 = gen_proto(ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT);
3094 b1 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */
3095 gen_or(b0, b1);
3096 b0 = gen_proto(ISIS_L1_LSP, Q_ISIS, Q_DEFAULT);
3097 gen_or(b0, b1);
3098 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT);
3099 gen_or(b0, b1);
3100 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT);
3101 gen_or(b0, b1);
3102 break;
3103
3104 case Q_ISIS_L2: /* all IS-IS Level2 PDU-Types */
3105 b0 = gen_proto(ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT);
3106 b1 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */
3107 gen_or(b0, b1);
3108 b0 = gen_proto(ISIS_L2_LSP, Q_ISIS, Q_DEFAULT);
3109 gen_or(b0, b1);
3110 b0 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT);
3111 gen_or(b0, b1);
3112 b0 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT);
3113 gen_or(b0, b1);
3114 break;
3115
3116 case Q_ISIS_IIH: /* all IS-IS Hello PDU-Types */
3117 b0 = gen_proto(ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT);
3118 b1 = gen_proto(ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT);
3119 gen_or(b0, b1);
3120 b0 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT);
3121 gen_or(b0, b1);
3122 break;
3123
3124 case Q_ISIS_LSP:
3125 b0 = gen_proto(ISIS_L1_LSP, Q_ISIS, Q_DEFAULT);
3126 b1 = gen_proto(ISIS_L2_LSP, Q_ISIS, Q_DEFAULT);
3127 gen_or(b0, b1);
3128 break;
3129
3130 case Q_ISIS_SNP:
3131 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT);
3132 b1 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT);
3133 gen_or(b0, b1);
3134 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT);
3135 gen_or(b0, b1);
3136 b0 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT);
3137 gen_or(b0, b1);
3138 break;
3139
3140 case Q_ISIS_CSNP:
3141 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT);
3142 b1 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT);
3143 gen_or(b0, b1);
3144 break;
3145
3146 case Q_ISIS_PSNP:
3147 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT);
3148 b1 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT);
3149 gen_or(b0, b1);
3150 break;
3151
3152 case Q_CLNP:
3153 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT);
3154 break;
3155
3156 case Q_STP:
3157 b1 = gen_linktype(LLCSAP_8021D);
3158 break;
3159
3160 case Q_IPX:
3161 b1 = gen_linktype(LLCSAP_IPX);
3162 break;
3163
3164 case Q_NETBEUI:
3165 b1 = gen_linktype(LLCSAP_NETBEUI);
3166 break;
3167
3168 default:
3169 abort();
3170 }
3171 return b1;
3172 }
3173
3174 static struct block *
3175 gen_ipfrag()
3176 {
3177 struct slist *s;
3178 struct block *b;
3179
3180 /* not ip frag */
3181 s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
3182 s->s.k = off_nl + 6;
3183 b = new_block(JMP(BPF_JSET));
3184 b->s.k = 0x1fff;
3185 b->stmts = s;
3186 gen_not(b);
3187
3188 return b;
3189 }
3190
3191 static struct block *
3192 gen_portatom(off, v)
3193 int off;
3194 bpf_int32 v;
3195 {
3196 struct slist *s;
3197 struct block *b;
3198
3199 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
3200 s->s.k = off_nl;
3201
3202 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
3203 s->next->s.k = off_nl + off;
3204
3205 b = new_block(JMP(BPF_JEQ));
3206 b->stmts = s;
3207 b->s.k = v;
3208
3209 return b;
3210 }
3211
3212 #ifdef INET6
3213 static struct block *
3214 gen_portatom6(off, v)
3215 int off;
3216 bpf_int32 v;
3217 {
3218 return gen_cmp(off_nl + 40 + off, BPF_H, v);
3219 }
3220 #endif/*INET6*/
3221
3222 struct block *
3223 gen_portop(port, proto, dir)
3224 int port, proto, dir;
3225 {
3226 struct block *b0, *b1, *tmp;
3227
3228 /* ip proto 'proto' */
3229 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
3230 b0 = gen_ipfrag();
3231 gen_and(tmp, b0);
3232
3233 switch (dir) {
3234 case Q_SRC:
3235 b1 = gen_portatom(0, (bpf_int32)port);
3236 break;
3237
3238 case Q_DST:
3239 b1 = gen_portatom(2, (bpf_int32)port);
3240 break;
3241
3242 case Q_OR:
3243 case Q_DEFAULT:
3244 tmp = gen_portatom(0, (bpf_int32)port);
3245 b1 = gen_portatom(2, (bpf_int32)port);
3246 gen_or(tmp, b1);
3247 break;
3248
3249 case Q_AND:
3250 tmp = gen_portatom(0, (bpf_int32)port);
3251 b1 = gen_portatom(2, (bpf_int32)port);
3252 gen_and(tmp, b1);
3253 break;
3254
3255 default:
3256 abort();
3257 }
3258 gen_and(b0, b1);
3259
3260 return b1;
3261 }
3262
3263 static struct block *
3264 gen_port(port, ip_proto, dir)
3265 int port;
3266 int ip_proto;
3267 int dir;
3268 {
3269 struct block *b0, *b1, *tmp;
3270
3271 /*
3272 * ether proto ip
3273 *
3274 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
3275 * not LLC encapsulation with LLCSAP_IP.
3276 *
3277 * For IEEE 802 networks - which includes 802.5 token ring
3278 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
3279 * says that SNAP encapsulation is used, not LLC encapsulation
3280 * with LLCSAP_IP.
3281 *
3282 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
3283 * RFC 2225 say that SNAP encapsulation is used, not LLC
3284 * encapsulation with LLCSAP_IP.
3285 *
3286 * So we always check for ETHERTYPE_IP.
3287 */
3288 b0 = gen_linktype(ETHERTYPE_IP);
3289
3290 switch (ip_proto) {
3291 case IPPROTO_UDP:
3292 case IPPROTO_TCP:
3293 case IPPROTO_SCTP:
3294 b1 = gen_portop(port, ip_proto, dir);
3295 break;
3296
3297 case PROTO_UNDEF:
3298 tmp = gen_portop(port, IPPROTO_TCP, dir);
3299 b1 = gen_portop(port, IPPROTO_UDP, dir);
3300 gen_or(tmp, b1);
3301 tmp = gen_portop(port, IPPROTO_SCTP, dir);
3302 gen_or(tmp, b1);
3303 break;
3304
3305 default:
3306 abort();
3307 }
3308 gen_and(b0, b1);
3309 return b1;
3310 }
3311
3312 #ifdef INET6
3313 struct block *
3314 gen_portop6(port, proto, dir)
3315 int port, proto, dir;
3316 {
3317 struct block *b0, *b1, *tmp;
3318
3319 /* ip proto 'proto' */
3320 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
3321
3322 switch (dir) {
3323 case Q_SRC:
3324 b1 = gen_portatom6(0, (bpf_int32)port);
3325 break;
3326
3327 case Q_DST:
3328 b1 = gen_portatom6(2, (bpf_int32)port);
3329 break;
3330
3331 case Q_OR:
3332 case Q_DEFAULT:
3333 tmp = gen_portatom6(0, (bpf_int32)port);
3334 b1 = gen_portatom6(2, (bpf_int32)port);
3335 gen_or(tmp, b1);
3336 break;
3337
3338 case Q_AND:
3339 tmp = gen_portatom6(0, (bpf_int32)port);
3340 b1 = gen_portatom6(2, (bpf_int32)port);
3341 gen_and(tmp, b1);
3342 break;
3343
3344 default:
3345 abort();
3346 }
3347 gen_and(b0, b1);
3348
3349 return b1;
3350 }
3351
3352 static struct block *
3353 gen_port6(port, ip_proto, dir)
3354 int port;
3355 int ip_proto;
3356 int dir;
3357 {
3358 struct block *b0, *b1, *tmp;
3359
3360 /* ether proto ip */
3361 b0 = gen_linktype(ETHERTYPE_IPV6);
3362
3363 switch (ip_proto) {
3364 case IPPROTO_UDP:
3365 case IPPROTO_TCP:
3366 case IPPROTO_SCTP:
3367 b1 = gen_portop6(port, ip_proto, dir);
3368 break;
3369
3370 case PROTO_UNDEF:
3371 tmp = gen_portop6(port, IPPROTO_TCP, dir);
3372 b1 = gen_portop6(port, IPPROTO_UDP, dir);
3373 gen_or(tmp, b1);
3374 tmp = gen_portop6(port, IPPROTO_SCTP, dir);
3375 gen_or(tmp, b1);
3376 break;
3377
3378 default:
3379 abort();
3380 }
3381 gen_and(b0, b1);
3382 return b1;
3383 }
3384 #endif /* INET6 */
3385
3386 static int
3387 lookup_proto(name, proto)
3388 register const char *name;
3389 register int proto;
3390 {
3391 register int v;
3392
3393 switch (proto) {
3394
3395 case Q_DEFAULT:
3396 case Q_IP:
3397 case Q_IPV6:
3398 v = pcap_nametoproto(name);
3399 if (v == PROTO_UNDEF)
3400 bpf_error("unknown ip proto '%s'", name);
3401 break;
3402
3403 case Q_LINK:
3404 /* XXX should look up h/w protocol type based on linktype */
3405 v = pcap_nametoeproto(name);
3406 if (v == PROTO_UNDEF) {
3407 v = pcap_nametollc(name);
3408 if (v == PROTO_UNDEF)
3409 bpf_error("unknown ether proto '%s'", name);
3410 }
3411 break;
3412
3413 case Q_ISO:
3414 if (strcmp(name, "esis") == 0)
3415 v = ISO9542_ESIS;
3416 else if (strcmp(name, "isis") == 0)
3417 v = ISO10589_ISIS;
3418 else if (strcmp(name, "clnp") == 0)
3419 v = ISO8473_CLNP;
3420 else
3421 bpf_error("unknown osi proto '%s'", name);
3422 break;
3423
3424 default:
3425 v = PROTO_UNDEF;
3426 break;
3427 }
3428 return v;
3429 }
3430
3431 #if 0
3432 struct stmt *
3433 gen_joinsp(s, n)
3434 struct stmt **s;
3435 int n;
3436 {
3437 return NULL;
3438 }
3439 #endif
3440
3441 static struct block *
3442 gen_protochain(v, proto, dir)
3443 int v;
3444 int proto;
3445 int dir;
3446 {
3447 #ifdef NO_PROTOCHAIN
3448 return gen_proto(v, proto, dir);
3449 #else
3450 struct block *b0, *b;
3451 struct slist *s[100];
3452 int fix2, fix3, fix4, fix5;
3453 int ahcheck, again, end;
3454 int i, max;
3455 int reg2 = alloc_reg();
3456
3457 memset(s, 0, sizeof(s));
3458 fix2 = fix3 = fix4 = fix5 = 0;
3459
3460 switch (proto) {
3461 case Q_IP:
3462 case Q_IPV6:
3463 break;
3464 case Q_DEFAULT:
3465 b0 = gen_protochain(v, Q_IP, dir);
3466 b = gen_protochain(v, Q_IPV6, dir);
3467 gen_or(b0, b);
3468 return b;
3469 default:
3470 bpf_error("bad protocol applied for 'protochain'");
3471 /*NOTREACHED*/
3472 }
3473
3474 no_optimize = 1; /*this code is not compatible with optimzer yet */
3475
3476 /*
3477 * s[0] is a dummy entry to protect other BPF insn from damaged
3478 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
3479 * hard to find interdependency made by jump table fixup.
3480 */
3481 i = 0;
3482 s[i] = new_stmt(0); /*dummy*/
3483 i++;
3484
3485 switch (proto) {
3486 case Q_IP:
3487 b0 = gen_linktype(ETHERTYPE_IP);
3488
3489 /* A = ip->ip_p */
3490 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
3491 s[i]->s.k = off_nl + 9;
3492 i++;
3493 /* X = ip->ip_hl << 2 */
3494 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
3495 s[i]->s.k = off_nl;
3496 i++;
3497 break;
3498 #ifdef INET6
3499 case Q_IPV6:
3500 b0 = gen_linktype(ETHERTYPE_IPV6);
3501
3502 /* A = ip6->ip_nxt */
3503 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
3504 s[i]->s.k = off_nl + 6;
3505 i++;
3506 /* X = sizeof(struct ip6_hdr) */
3507 s[i] = new_stmt(BPF_LDX|BPF_IMM);
3508 s[i]->s.k = 40;
3509 i++;
3510 break;
3511 #endif
3512 default:
3513 bpf_error("unsupported proto to gen_protochain");
3514 /*NOTREACHED*/
3515 }
3516
3517 /* again: if (A == v) goto end; else fall through; */
3518 again = i;
3519 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3520 s[i]->s.k = v;
3521 s[i]->s.jt = NULL; /*later*/
3522 s[i]->s.jf = NULL; /*update in next stmt*/
3523 fix5 = i;
3524 i++;
3525
3526 #ifndef IPPROTO_NONE
3527 #define IPPROTO_NONE 59
3528 #endif
3529 /* if (A == IPPROTO_NONE) goto end */
3530 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3531 s[i]->s.jt = NULL; /*later*/
3532 s[i]->s.jf = NULL; /*update in next stmt*/
3533 s[i]->s.k = IPPROTO_NONE;
3534 s[fix5]->s.jf = s[i];
3535 fix2 = i;
3536 i++;
3537
3538 #ifdef INET6
3539 if (proto == Q_IPV6) {
3540 int v6start, v6end, v6advance, j;
3541
3542 v6start = i;
3543 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
3544 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3545 s[i]->s.jt = NULL; /*later*/
3546 s[i]->s.jf = NULL; /*update in next stmt*/
3547 s[i]->s.k = IPPROTO_HOPOPTS;
3548 s[fix2]->s.jf = s[i];
3549 i++;
3550 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
3551 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3552 s[i]->s.jt = NULL; /*later*/
3553 s[i]->s.jf = NULL; /*update in next stmt*/
3554 s[i]->s.k = IPPROTO_DSTOPTS;
3555 i++;
3556 /* if (A == IPPROTO_ROUTING) goto v6advance */
3557 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3558 s[i]->s.jt = NULL; /*later*/
3559 s[i]->s.jf = NULL; /*update in next stmt*/
3560 s[i]->s.k = IPPROTO_ROUTING;
3561 i++;
3562 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
3563 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3564 s[i]->s.jt = NULL; /*later*/
3565 s[i]->s.jf = NULL; /*later*/
3566 s[i]->s.k = IPPROTO_FRAGMENT;
3567 fix3 = i;
3568 v6end = i;
3569 i++;
3570
3571 /* v6advance: */
3572 v6advance = i;
3573
3574 /*
3575 * in short,
3576 * A = P[X];
3577 * X = X + (P[X + 1] + 1) * 8;
3578 */
3579 /* A = X */
3580 s[i] = new_stmt(BPF_MISC|BPF_TXA);
3581 i++;
3582 /* A = P[X + packet head] */
3583 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
3584 s[i]->s.k = off_nl;
3585 i++;
3586 /* MEM[reg2] = A */
3587 s[i] = new_stmt(BPF_ST);
3588 s[i]->s.k = reg2;
3589 i++;
3590 /* A = X */
3591 s[i] = new_stmt(BPF_MISC|BPF_TXA);
3592 i++;
3593 /* A += 1 */
3594 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
3595 s[i]->s.k = 1;
3596 i++;
3597 /* X = A */
3598 s[i] = new_stmt(BPF_MISC|BPF_TAX);
3599 i++;
3600 /* A = P[X + packet head]; */
3601 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
3602 s[i]->s.k = off_nl;
3603 i++;
3604 /* A += 1 */
3605 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
3606 s[i]->s.k = 1;
3607 i++;
3608 /* A *= 8 */
3609 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
3610 s[i]->s.k = 8;
3611 i++;
3612 /* X = A; */
3613 s[i] = new_stmt(BPF_MISC|BPF_TAX);
3614 i++;
3615 /* A = MEM[reg2] */
3616 s[i] = new_stmt(BPF_LD|BPF_MEM);
3617 s[i]->s.k = reg2;
3618 i++;
3619
3620 /* goto again; (must use BPF_JA for backward jump) */
3621 s[i] = new_stmt(BPF_JMP|BPF_JA);
3622 s[i]->s.k = again - i - 1;
3623 s[i - 1]->s.jf = s[i];
3624 i++;
3625
3626 /* fixup */
3627 for (j = v6start; j <= v6end; j++)
3628 s[j]->s.jt = s[v6advance];
3629 } else
3630 #endif
3631 {
3632 /* nop */
3633 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
3634 s[i]->s.k = 0;
3635 s[fix2]->s.jf = s[i];
3636 i++;
3637 }
3638
3639 /* ahcheck: */
3640 ahcheck = i;
3641 /* if (A == IPPROTO_AH) then fall through; else goto end; */
3642 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
3643 s[i]->s.jt = NULL; /*later*/
3644 s[i]->s.jf = NULL; /*later*/
3645 s[i]->s.k = IPPROTO_AH;
3646 if (fix3)
3647 s[fix3]->s.jf = s[ahcheck];
3648 fix4 = i;
3649 i++;
3650
3651 /*
3652 * in short,
3653 * A = P[X];
3654 * X = X + (P[X + 1] + 2) * 4;
3655 */
3656 /* A = X */
3657 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
3658 i++;
3659 /* A = P[X + packet head]; */
3660 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
3661 s[i]->s.k = off_nl;
3662 i++;
3663 /* MEM[reg2] = A */
3664 s[i] = new_stmt(BPF_ST);
3665 s[i]->s.k = reg2;
3666 i++;
3667 /* A = X */
3668 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
3669 i++;
3670 /* A += 1 */
3671 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
3672 s[i]->s.k = 1;
3673 i++;
3674 /* X = A */
3675 s[i] = new_stmt(BPF_MISC|BPF_TAX);
3676 i++;
3677 /* A = P[X + packet head] */
3678 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
3679 s[i]->s.k = off_nl;
3680 i++;
3681 /* A += 2 */
3682 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
3683 s[i]->s.k = 2;
3684 i++;
3685 /* A *= 4 */
3686 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
3687 s[i]->s.k = 4;
3688 i++;
3689 /* X = A; */
3690 s[i] = new_stmt(BPF_MISC|BPF_TAX);
3691 i++;
3692 /* A = MEM[reg2] */
3693 s[i] = new_stmt(BPF_LD|BPF_MEM);
3694 s[i]->s.k = reg2;
3695 i++;
3696
3697 /* goto again; (must use BPF_JA for backward jump) */
3698 s[i] = new_stmt(BPF_JMP|BPF_JA);
3699 s[i]->s.k = again - i - 1;
3700 i++;
3701
3702 /* end: nop */
3703 end = i;
3704 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
3705 s[i]->s.k = 0;
3706 s[fix2]->s.jt = s[end];
3707 s[fix4]->s.jf = s[end];
3708 s[fix5]->s.jt = s[end];
3709 i++;
3710
3711 /*
3712 * make slist chain
3713 */
3714 max = i;
3715 for (i = 0; i < max - 1; i++)
3716 s[i]->next = s[i + 1];
3717 s[max - 1]->next = NULL;
3718
3719 /*
3720 * emit final check
3721 */
3722 b = new_block(JMP(BPF_JEQ));
3723 b->stmts = s[1]; /*remember, s[0] is dummy*/
3724 b->s.k = v;
3725
3726 free_reg(reg2);
3727
3728 gen_and(b0, b);
3729 return b;
3730 #endif
3731 }
3732
3733 static struct block *
3734 gen_proto(v, proto, dir)
3735 int v;
3736 int proto;
3737 int dir;
3738 {
3739 struct block *b0, *b1;
3740
3741 if (dir != Q_DEFAULT)
3742 bpf_error("direction applied to 'proto'");
3743
3744 switch (proto) {
3745 case Q_DEFAULT:
3746 #ifdef INET6
3747 b0 = gen_proto(v, Q_IP, dir);
3748 b1 = gen_proto(v, Q_IPV6, dir);
3749 gen_or(b0, b1);
3750 return b1;
3751 #else
3752 /*FALLTHROUGH*/
3753 #endif
3754 case Q_IP:
3755 /*
3756 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
3757 * not LLC encapsulation with LLCSAP_IP.
3758 *
3759 * For IEEE 802 networks - which includes 802.5 token ring
3760 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
3761 * says that SNAP encapsulation is used, not LLC encapsulation
3762 * with LLCSAP_IP.
3763 *
3764 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
3765 * RFC 2225 say that SNAP encapsulation is used, not LLC
3766 * encapsulation with LLCSAP_IP.
3767 *
3768 * So we always check for ETHERTYPE_IP.
3769 */
3770 b0 = gen_linktype(ETHERTYPE_IP);
3771 #ifndef CHASE_CHAIN
3772 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
3773 #else
3774 b1 = gen_protochain(v, Q_IP);
3775 #endif
3776 gen_and(b0, b1);
3777 return b1;
3778
3779 case Q_ISO:
3780 switch (linktype) {
3781
3782 case DLT_FRELAY:
3783 /*
3784 * Frame Relay packets typically have an OSI
3785 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)"
3786 * generates code to check for all the OSI
3787 * NLPIDs, so calling it and then adding a check
3788 * for the particular NLPID for which we're
3789 * looking is bogus, as we can just check for
3790 * the NLPID.
3791 *
3792 * What we check for is the NLPID and a frame
3793 * control field value of UI, i.e. 0x03 followed
3794 * by the NLPID.
3795 *
3796 * XXX - assumes a 2-byte Frame Relay header with
3797 * DLCI and flags. What if the address is longer?
3798 *
3799 * XXX - what about SNAP-encapsulated frames?
3800 */
3801 return gen_cmp(2, BPF_H, (0x03<<8) | v);
3802 /*NOTREACHED*/
3803 break;
3804
3805 case DLT_C_HDLC:
3806 /*
3807 * Cisco uses an Ethertype lookalike - for OSI,
3808 * it's 0xfefe.
3809 */
3810 b0 = gen_linktype(LLCSAP_ISONS<<8 | LLCSAP_ISONS);
3811 /* OSI in C-HDLC is stuffed with a fudge byte */
3812 b1 = gen_cmp(off_nl_nosnap+1, BPF_B, (long)v);
3813 gen_and(b0, b1);
3814 return b1;
3815
3816 default:
3817 b0 = gen_linktype(LLCSAP_ISONS);
3818 b1 = gen_cmp(off_nl_nosnap, BPF_B, (long)v);
3819 gen_and(b0, b1);
3820 return b1;
3821 }
3822
3823 case Q_ISIS:
3824 b0 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
3825 /*
3826 * 4 is the offset of the PDU type relative to the IS-IS
3827 * header.
3828 */
3829 b1 = gen_cmp(off_nl_nosnap+4, BPF_B, (long)v);
3830 gen_and(b0, b1);
3831 return b1;
3832
3833 case Q_ARP:
3834 bpf_error("arp does not encapsulate another protocol");
3835 /* NOTREACHED */
3836
3837 case Q_RARP:
3838 bpf_error("rarp does not encapsulate another protocol");
3839 /* NOTREACHED */
3840
3841 case Q_ATALK:
3842 bpf_error("atalk encapsulation is not specifiable");
3843 /* NOTREACHED */
3844
3845 case Q_DECNET:
3846 bpf_error("decnet encapsulation is not specifiable");
3847 /* NOTREACHED */
3848
3849 case Q_SCA:
3850 bpf_error("sca does not encapsulate another protocol");
3851 /* NOTREACHED */
3852
3853 case Q_LAT:
3854 bpf_error("lat does not encapsulate another protocol");
3855 /* NOTREACHED */
3856
3857 case Q_MOPRC:
3858 bpf_error("moprc does not encapsulate another protocol");
3859 /* NOTREACHED */
3860
3861 case Q_MOPDL:
3862 bpf_error("mopdl does not encapsulate another protocol");
3863 /* NOTREACHED */
3864
3865 case Q_LINK:
3866 return gen_linktype(v);
3867
3868 case Q_UDP:
3869 bpf_error("'udp proto' is bogus");
3870 /* NOTREACHED */
3871
3872 case Q_TCP:
3873 bpf_error("'tcp proto' is bogus");
3874 /* NOTREACHED */
3875
3876 case Q_SCTP:
3877 bpf_error("'sctp proto' is bogus");
3878 /* NOTREACHED */
3879
3880 case Q_ICMP:
3881 bpf_error("'icmp proto' is bogus");
3882 /* NOTREACHED */
3883
3884 case Q_IGMP:
3885 bpf_error("'igmp proto' is bogus");
3886 /* NOTREACHED */
3887
3888 case Q_IGRP:
3889 bpf_error("'igrp proto' is bogus");
3890 /* NOTREACHED */
3891
3892 case Q_PIM:
3893 bpf_error("'pim proto' is bogus");
3894 /* NOTREACHED */
3895
3896 case Q_VRRP:
3897 bpf_error("'vrrp proto' is bogus");
3898 /* NOTREACHED */
3899
3900 #ifdef INET6
3901 case Q_IPV6:
3902 b0 = gen_linktype(ETHERTYPE_IPV6);
3903 #ifndef CHASE_CHAIN
3904 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
3905 #else
3906 b1 = gen_protochain(v, Q_IPV6);
3907 #endif
3908 gen_and(b0, b1);
3909 return b1;
3910
3911 case Q_ICMPV6:
3912 bpf_error("'icmp6 proto' is bogus");
3913 #endif /* INET6 */
3914
3915 case Q_AH:
3916 bpf_error("'ah proto' is bogus");
3917
3918 case Q_ESP:
3919 bpf_error("'ah proto' is bogus");
3920
3921 case Q_STP:
3922 bpf_error("'stp proto' is bogus");
3923
3924 case Q_IPX:
3925 bpf_error("'ipx proto' is bogus");
3926
3927 case Q_NETBEUI:
3928 bpf_error("'netbeui proto' is bogus");
3929
3930 default:
3931 abort();
3932 /* NOTREACHED */
3933 }
3934 /* NOTREACHED */
3935 }
3936
3937 struct block *
3938 gen_scode(name, q)
3939 register const char *name;
3940 struct qual q;
3941 {
3942 int proto = q.proto;
3943 int dir = q.dir;
3944 int tproto;
3945 u_char *eaddr;
3946 bpf_u_int32 mask, addr;
3947 #ifndef INET6
3948 bpf_u_int32 **alist;
3949 #else
3950 int tproto6;
3951 struct sockaddr_in *sin;
3952 struct sockaddr_in6 *sin6;
3953 struct addrinfo *res, *res0;
3954 struct in6_addr mask128;
3955 #endif /*INET6*/
3956 struct block *b, *tmp;
3957 int port, real_proto;
3958
3959 switch (q.addr) {
3960
3961 case Q_NET:
3962 addr = pcap_nametonetaddr(name);
3963 if (addr == 0)
3964 bpf_error("unknown network '%s'", name);
3965 /* Left justify network addr and calculate its network mask */
3966 mask = 0xffffffff;
3967 while (addr && (addr & 0xff000000) == 0) {
3968 addr <<= 8;
3969 mask <<= 8;
3970 }
3971 return gen_host(addr, mask, proto, dir);
3972
3973 case Q_DEFAULT:
3974 case Q_HOST:
3975 if (proto == Q_LINK) {
3976 switch (linktype) {
3977
3978 case DLT_EN10MB:
3979 eaddr = pcap_ether_hostton(name);
3980 if (eaddr == NULL)
3981 bpf_error(
3982 "unknown ether host '%s'", name);
3983 b = gen_ehostop(eaddr, dir);
3984 free(eaddr);
3985 return b;
3986
3987 case DLT_FDDI:
3988 eaddr = pcap_ether_hostton(name);
3989 if (eaddr == NULL)
3990 bpf_error(
3991 "unknown FDDI host '%s'", name);
3992 b = gen_fhostop(eaddr, dir);
3993 free(eaddr);
3994 return b;
3995
3996 case DLT_IEEE802:
3997 eaddr = pcap_ether_hostton(name);
3998 if (eaddr == NULL)
3999 bpf_error(
4000 "unknown token ring host '%s'", name);
4001 b = gen_thostop(eaddr, dir);
4002 free(eaddr);
4003 return b;
4004
4005 case DLT_IEEE802_11:
4006 eaddr = pcap_ether_hostton(name);
4007 if (eaddr == NULL)
4008 bpf_error(
4009 "unknown 802.11 host '%s'", name);
4010 b = gen_wlanhostop(eaddr, dir);
4011 free(eaddr);
4012 return b;
4013
4014 case DLT_IP_OVER_FC:
4015 eaddr = pcap_ether_hostton(name);
4016 if (eaddr == NULL)
4017 bpf_error(
4018 "unknown Fibre Channel host '%s'", name);
4019 b = gen_ipfchostop(eaddr, dir);
4020 free(eaddr);
4021 return b;
4022
4023 case DLT_SUNATM:
4024 if (!is_lane)
4025 break;
4026
4027 /*
4028 * Check that the packet doesn't begin
4029 * with an LE Control marker. (We've
4030 * already generated a test for LANE.)
4031 */
4032 tmp = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H,
4033 0xFF00);
4034 gen_not(tmp);
4035
4036 eaddr = pcap_ether_hostton(name);
4037 if (eaddr == NULL)
4038 bpf_error(
4039 "unknown ether host '%s'", name);
4040 b = gen_ehostop(eaddr, dir);
4041 gen_and(tmp, b);
4042 free(eaddr);
4043 return b;
4044 }
4045
4046 bpf_error("only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name");
4047 } else if (proto == Q_DECNET) {
4048 unsigned short dn_addr = __pcap_nametodnaddr(name);
4049 /*
4050 * I don't think DECNET hosts can be multihomed, so
4051 * there is no need to build up a list of addresses
4052 */
4053 return (gen_host(dn_addr, 0, proto, dir));
4054 } else {
4055 #ifndef INET6
4056 alist = pcap_nametoaddr(name);
4057 if (alist == NULL || *alist == NULL)
4058 bpf_error("unknown host '%s'", name);
4059 tproto = proto;
4060 if (off_linktype == (u_int)-1 && tproto == Q_DEFAULT)
4061 tproto = Q_IP;
4062 b = gen_host(**alist++, 0xffffffff, tproto, dir);
4063 while (*alist) {
4064 tmp = gen_host(**alist++, 0xffffffff,
4065 tproto, dir);
4066 gen_or(b, tmp);
4067 b = tmp;
4068 }
4069 return b;
4070 #else
4071 memset(&mask128, 0xff, sizeof(mask128));
4072 res0 = res = pcap_nametoaddrinfo(name);
4073 if (res == NULL)
4074 bpf_error("unknown host '%s'", name);
4075 b = tmp = NULL;
4076 tproto = tproto6 = proto;
4077 if (off_linktype == -1 && tproto == Q_DEFAULT) {
4078 tproto = Q_IP;
4079 tproto6 = Q_IPV6;
4080 }
4081 for (res = res0; res; res = res->ai_next) {
4082 switch (res->ai_family) {
4083 case AF_INET:
4084 if (tproto == Q_IPV6)
4085 continue;
4086
4087 sin = (struct sockaddr_in *)
4088 res->ai_addr;
4089 tmp = gen_host(ntohl(sin->sin_addr.s_addr),
4090 0xffffffff, tproto, dir);
4091 break;
4092 case AF_INET6:
4093 if (tproto6 == Q_IP)
4094 continue;
4095
4096 sin6 = (struct sockaddr_in6 *)
4097 res->ai_addr;
4098 tmp = gen_host6(&sin6->sin6_addr,
4099 &mask128, tproto6, dir);
4100 break;
4101 default:
4102 continue;
4103 }
4104 if (b)
4105 gen_or(b, tmp);
4106 b = tmp;
4107 }
4108 freeaddrinfo(res0);
4109 if (b == NULL) {
4110 bpf_error("unknown host '%s'%s", name,
4111 (proto == Q_DEFAULT)
4112 ? ""
4113 : " for specified address family");
4114 }
4115 return b;
4116 #endif /*INET6*/
4117 }
4118
4119 case Q_PORT:
4120 if (proto != Q_DEFAULT &&
4121 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
4122 bpf_error("illegal qualifier of 'port'");
4123 if (pcap_nametoport(name, &port, &real_proto) == 0)
4124 bpf_error("unknown port '%s'", name);
4125 if (proto == Q_UDP) {
4126 if (real_proto == IPPROTO_TCP)
4127 bpf_error("port '%s' is tcp", name);
4128 else if (real_proto == IPPROTO_SCTP)
4129 bpf_error("port '%s' is sctp", name);
4130 else
4131 /* override PROTO_UNDEF */
4132 real_proto = IPPROTO_UDP;
4133 }
4134 if (proto == Q_TCP) {
4135 if (real_proto == IPPROTO_UDP)
4136 bpf_error("port '%s' is udp", name);
4137
4138 else if (real_proto == IPPROTO_SCTP)
4139 bpf_error("port '%s' is sctp", name);
4140 else
4141 /* override PROTO_UNDEF */
4142 real_proto = IPPROTO_TCP;
4143 }
4144 if (proto == Q_SCTP) {
4145 if (real_proto == IPPROTO_UDP)
4146 bpf_error("port '%s' is udp", name);
4147
4148 else if (real_proto == IPPROTO_TCP)
4149 bpf_error("port '%s' is tcp", name);
4150 else
4151 /* override PROTO_UNDEF */
4152 real_proto = IPPROTO_SCTP;
4153 }
4154 #ifndef INET6
4155 return gen_port(port, real_proto, dir);
4156 #else
4157 {
4158 struct block *b;
4159 b = gen_port(port, real_proto, dir);
4160 gen_or(gen_port6(port, real_proto, dir), b);
4161 return b;
4162 }
4163 #endif /* INET6 */
4164
4165 case Q_GATEWAY:
4166 #ifndef INET6
4167 eaddr = pcap_ether_hostton(name);
4168 if (eaddr == NULL)
4169 bpf_error("unknown ether host: %s", name);
4170
4171 alist = pcap_nametoaddr(name);
4172 if (alist == NULL || *alist == NULL)
4173 bpf_error("unknown host '%s'", name);
4174 b = gen_gateway(eaddr, alist, proto, dir);
4175 free(eaddr);
4176 return b;
4177 #else
4178 bpf_error("'gateway' not supported in this configuration");
4179 #endif /*INET6*/
4180
4181 case Q_PROTO:
4182 real_proto = lookup_proto(name, proto);
4183 if (real_proto >= 0)
4184 return gen_proto(real_proto, proto, dir);
4185 else
4186 bpf_error("unknown protocol: %s", name);
4187
4188 case Q_PROTOCHAIN:
4189 real_proto = lookup_proto(name, proto);
4190 if (real_proto >= 0)
4191 return gen_protochain(real_proto, proto, dir);
4192 else
4193 bpf_error("unknown protocol: %s", name);
4194
4195
4196 case Q_UNDEF:
4197 syntax();
4198 /* NOTREACHED */
4199 }
4200 abort();
4201 /* NOTREACHED */
4202 }
4203
4204 struct block *
4205 gen_mcode(s1, s2, masklen, q)
4206 register const char *s1, *s2;
4207 register int masklen;
4208 struct qual q;
4209 {
4210 register int nlen, mlen;
4211 bpf_u_int32 n, m;
4212
4213 nlen = __pcap_atoin(s1, &n);
4214 /* Promote short ipaddr */
4215 n <<= 32 - nlen;
4216
4217 if (s2 != NULL) {
4218 mlen = __pcap_atoin(s2, &m);
4219 /* Promote short ipaddr */
4220 m <<= 32 - mlen;
4221 if ((n & ~m) != 0)
4222 bpf_error("non-network bits set in \"%s mask %s\"",
4223 s1, s2);
4224 } else {
4225 /* Convert mask len to mask */
4226 if (masklen > 32)
4227 bpf_error("mask length must be <= 32");
4228 m = 0xffffffff << (32 - masklen);
4229 if ((n & ~m) != 0)
4230 bpf_error("non-network bits set in \"%s/%d\"",
4231 s1, masklen);
4232 }
4233
4234 switch (q.addr) {
4235
4236 case Q_NET:
4237 return gen_host(n, m, q.proto, q.dir);
4238
4239 default:
4240 bpf_error("Mask syntax for networks only");
4241 /* NOTREACHED */
4242 }
4243 /* NOTREACHED */
4244 }
4245
4246 struct block *
4247 gen_ncode(s, v, q)
4248 register const char *s;
4249 bpf_u_int32 v;
4250 struct qual q;
4251 {
4252 bpf_u_int32 mask;
4253 int proto = q.proto;
4254 int dir = q.dir;
4255 register int vlen;
4256
4257 if (s == NULL)
4258 vlen = 32;
4259 else if (q.proto == Q_DECNET)
4260 vlen = __pcap_atodn(s, &v);
4261 else
4262 vlen = __pcap_atoin(s, &v);
4263
4264 switch (q.addr) {
4265
4266 case Q_DEFAULT:
4267 case Q_HOST:
4268 case Q_NET:
4269 if (proto == Q_DECNET)
4270 return gen_host(v, 0, proto, dir);
4271 else if (proto == Q_LINK) {
4272 bpf_error("illegal link layer address");
4273 } else {
4274 mask = 0xffffffff;
4275 if (s == NULL && q.addr == Q_NET) {
4276 /* Promote short net number */
4277 while (v && (v & 0xff000000) == 0) {
4278 v <<= 8;
4279 mask <<= 8;
4280 }
4281 } else {
4282 /* Promote short ipaddr */
4283 v <<= 32 - vlen;
4284 mask <<= 32 - vlen;
4285 }
4286 return gen_host(v, mask, proto, dir);
4287 }
4288
4289 case Q_PORT:
4290 if (proto == Q_UDP)
4291 proto = IPPROTO_UDP;
4292 else if (proto == Q_TCP)
4293 proto = IPPROTO_TCP;
4294 else if (proto == Q_SCTP)
4295 proto = IPPROTO_SCTP;
4296 else if (proto == Q_DEFAULT)
4297 proto = PROTO_UNDEF;
4298 else
4299 bpf_error("illegal qualifier of 'port'");
4300
4301 #ifndef INET6
4302 return gen_port((int)v, proto, dir);
4303 #else
4304 {
4305 struct block *b;
4306 b = gen_port((int)v, proto, dir);
4307 gen_or(gen_port6((int)v, proto, dir), b);
4308 return b;
4309 }
4310 #endif /* INET6 */
4311
4312 case Q_GATEWAY:
4313 bpf_error("'gateway' requires a name");
4314 /* NOTREACHED */
4315
4316 case Q_PROTO:
4317 return gen_proto((int)v, proto, dir);
4318
4319 case Q_PROTOCHAIN:
4320 return gen_protochain((int)v, proto, dir);
4321
4322 case Q_UNDEF:
4323 syntax();
4324 /* NOTREACHED */
4325
4326 default:
4327 abort();
4328 /* NOTREACHED */
4329 }
4330 /* NOTREACHED */
4331 }
4332
4333 #ifdef INET6
4334 struct block *
4335 gen_mcode6(s1, s2, masklen, q)
4336 register const char *s1, *s2;
4337 register int masklen;
4338 struct qual q;
4339 {
4340 struct addrinfo *res;
4341 struct in6_addr *addr;
4342 struct in6_addr mask;
4343 struct block *b;
4344 u_int32_t *a, *m;
4345
4346 if (s2)
4347 bpf_error("no mask %s supported", s2);
4348
4349 res = pcap_nametoaddrinfo(s1);
4350 if (!res)
4351 bpf_error("invalid ip6 address %s", s1);
4352 if (res->ai_next)
4353 bpf_error("%s resolved to multiple address", s1);
4354 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
4355
4356 if (sizeof(mask) * 8 < masklen)
4357 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
4358 memset(&mask, 0, sizeof(mask));
4359 memset(&mask, 0xff, masklen / 8);
4360 if (masklen % 8) {
4361 mask.s6_addr[masklen / 8] =
4362 (0xff << (8 - masklen % 8)) & 0xff;
4363 }
4364
4365 a = (u_int32_t *)addr;
4366 m = (u_int32_t *)&mask;
4367 if ((a[0] & ~m[0]) || (a[1] & ~m[1])
4368 || (a[2] & ~m[2]) || (a[3] & ~m[3])) {
4369 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen);
4370 }
4371
4372 switch (q.addr) {
4373
4374 case Q_DEFAULT:
4375 case Q_HOST:
4376 if (masklen != 128)
4377 bpf_error("Mask syntax for networks only");
4378 /* FALLTHROUGH */
4379
4380 case Q_NET:
4381 b = gen_host6(addr, &mask, q.proto, q.dir);
4382 freeaddrinfo(res);
4383 return b;
4384
4385 default:
4386 bpf_error("invalid qualifier against IPv6 address");
4387 /* NOTREACHED */
4388 }
4389 }
4390 #endif /*INET6*/
4391
4392 struct block *
4393 gen_ecode(eaddr, q)
4394 register const u_char *eaddr;
4395 struct qual q;
4396 {
4397 struct block *b, *tmp;
4398
4399 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
4400 if (linktype == DLT_EN10MB)
4401 return gen_ehostop(eaddr, (int)q.dir);
4402 if (linktype == DLT_FDDI)
4403 return gen_fhostop(eaddr, (int)q.dir);
4404 if (linktype == DLT_IEEE802)
4405 return gen_thostop(eaddr, (int)q.dir);
4406 if (linktype == DLT_IEEE802_11)
4407 return gen_wlanhostop(eaddr, (int)q.dir);
4408 if (linktype == DLT_SUNATM && is_lane) {
4409 /*
4410 * Check that the packet doesn't begin with an
4411 * LE Control marker. (We've already generated
4412 * a test for LANE.)
4413 */
4414 tmp = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
4415 gen_not(tmp);
4416
4417 /*
4418 * Now check the MAC address.
4419 */
4420 b = gen_ehostop(eaddr, (int)q.dir);
4421 gen_and(tmp, b);
4422 return b;
4423 }
4424 if (linktype == DLT_IP_OVER_FC)
4425 return gen_ipfchostop(eaddr, (int)q.dir);
4426 bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4427 }
4428 bpf_error("ethernet address used in non-ether expression");
4429 /* NOTREACHED */
4430 }
4431
4432 void
4433 sappend(s0, s1)
4434 struct slist *s0, *s1;
4435 {
4436 /*
4437 * This is definitely not the best way to do this, but the
4438 * lists will rarely get long.
4439 */
4440 while (s0->next)
4441 s0 = s0->next;
4442 s0->next = s1;
4443 }
4444
4445 static struct slist *
4446 xfer_to_x(a)
4447 struct arth *a;
4448 {
4449 struct slist *s;
4450
4451 s = new_stmt(BPF_LDX|BPF_MEM);
4452 s->s.k = a->regno;
4453 return s;
4454 }
4455
4456 static struct slist *
4457 xfer_to_a(a)
4458 struct arth *a;
4459 {
4460 struct slist *s;
4461
4462 s = new_stmt(BPF_LD|BPF_MEM);
4463 s->s.k = a->regno;
4464 return s;
4465 }
4466
4467 struct arth *
4468 gen_load(proto, index, size)
4469 int proto;
4470 struct arth *index;
4471 int size;
4472 {
4473 struct slist *s, *tmp;
4474 struct block *b;
4475 int regno = alloc_reg();
4476
4477 free_reg(index->regno);
4478 switch (size) {
4479
4480 default:
4481 bpf_error("data size must be 1, 2, or 4");
4482
4483 case 1:
4484 size = BPF_B;
4485 break;
4486
4487 case 2:
4488 size = BPF_H;
4489 break;
4490
4491 case 4:
4492 size = BPF_W;
4493 break;
4494 }
4495 switch (proto) {
4496 default:
4497 bpf_error("unsupported index operation");
4498
4499 case Q_LINK:
4500 /*
4501 * XXX - what about ATM LANE? Should the index be
4502 * relative to the beginning of the AAL5 frame, so
4503 * that 0 refers to the beginning of the LE Control
4504 * field, or relative to the beginning of the LAN
4505 * frame, so that 0 refers, for Ethernet LANE, to
4506 * the beginning of the destination address?
4507 */
4508 s = xfer_to_x(index);
4509 tmp = new_stmt(BPF_LD|BPF_IND|size);
4510 sappend(s, tmp);
4511 sappend(index->s, s);
4512 break;
4513
4514 case Q_IP:
4515 case Q_ARP:
4516 case Q_RARP:
4517 case Q_ATALK:
4518 case Q_DECNET:
4519 case Q_SCA:
4520 case Q_LAT:
4521 case Q_MOPRC:
4522 case Q_MOPDL:
4523 #ifdef INET6
4524 case Q_IPV6:
4525 #endif
4526 /* XXX Note that we assume a fixed link header here. */
4527 s = xfer_to_x(index);
4528 tmp = new_stmt(BPF_LD|BPF_IND|size);
4529 tmp->s.k = off_nl;
4530 sappend(s, tmp);
4531 sappend(index->s, s);
4532
4533 b = gen_proto_abbrev(proto);
4534 if (index->b)
4535 gen_and(index->b, b);
4536 index->b = b;
4537 break;
4538
4539 case Q_SCTP:
4540 case Q_TCP:
4541 case Q_UDP:
4542 case Q_ICMP:
4543 case Q_IGMP:
4544 case Q_IGRP:
4545 case Q_PIM:
4546 case Q_VRRP:
4547 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
4548 s->s.k = off_nl;
4549 sappend(s, xfer_to_a(index));
4550 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
4551 sappend(s, new_stmt(BPF_MISC|BPF_TAX));
4552 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
4553 tmp->s.k = off_nl;
4554 sappend(index->s, s);
4555
4556 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
4557 if (index->b)
4558 gen_and(index->b, b);
4559 #ifdef INET6
4560 gen_and(gen_proto_abbrev(Q_IP), b);
4561 #endif
4562 index->b = b;
4563 break;
4564 #ifdef INET6
4565 case Q_ICMPV6:
4566 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
4567 /*NOTREACHED*/
4568 #endif
4569 }
4570 index->regno = regno;
4571 s = new_stmt(BPF_ST);
4572 s->s.k = regno;
4573 sappend(index->s, s);
4574
4575 return index;
4576 }
4577
4578 struct block *
4579 gen_relation(code, a0, a1, reversed)
4580 int code;
4581 struct arth *a0, *a1;
4582 int reversed;
4583 {
4584 struct slist *s0, *s1, *s2;
4585 struct block *b, *tmp;
4586
4587 s0 = xfer_to_x(a1);
4588 s1 = xfer_to_a(a0);
4589 if (code == BPF_JEQ) {
4590 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X);
4591 b = new_block(JMP(code));
4592 sappend(s1, s2);
4593 }
4594 else
4595 b = new_block(BPF_JMP|code|BPF_X);
4596 if (reversed)
4597 gen_not(b);
4598
4599 sappend(s0, s1);
4600 sappend(a1->s, s0);
4601 sappend(a0->s, a1->s);
4602
4603 b->stmts = a0->s;
4604
4605 free_reg(a0->regno);
4606 free_reg(a1->regno);
4607
4608 /* 'and' together protocol checks */
4609 if (a0->b) {
4610 if (a1->b) {
4611 gen_and(a0->b, tmp = a1->b);
4612 }
4613 else
4614 tmp = a0->b;
4615 } else
4616 tmp = a1->b;
4617
4618 if (tmp)
4619 gen_and(tmp, b);
4620
4621 return b;
4622 }
4623
4624 struct arth *
4625 gen_loadlen()
4626 {
4627 int regno = alloc_reg();
4628 struct arth *a = (struct arth *)newchunk(sizeof(*a));
4629 struct slist *s;
4630
4631 s = new_stmt(BPF_LD|BPF_LEN);
4632 s->next = new_stmt(BPF_ST);
4633 s->next->s.k = regno;
4634 a->s = s;
4635 a->regno = regno;
4636
4637 return a;
4638 }
4639
4640 struct arth *
4641 gen_loadi(val)
4642 int val;
4643 {
4644 struct arth *a;
4645 struct slist *s;
4646 int reg;
4647
4648 a = (struct arth *)newchunk(sizeof(*a));
4649
4650 reg = alloc_reg();
4651
4652 s = new_stmt(BPF_LD|BPF_IMM);
4653 s->s.k = val;
4654 s->next = new_stmt(BPF_ST);
4655 s->next->s.k = reg;
4656 a->s = s;
4657 a->regno = reg;
4658
4659 return a;
4660 }
4661
4662 struct arth *
4663 gen_neg(a)
4664 struct arth *a;
4665 {
4666 struct slist *s;
4667
4668 s = xfer_to_a(a);
4669 sappend(a->s, s);
4670 s = new_stmt(BPF_ALU|BPF_NEG);
4671 s->s.k = 0;
4672 sappend(a->s, s);
4673 s = new_stmt(BPF_ST);
4674 s->s.k = a->regno;
4675 sappend(a->s, s);
4676
4677 return a;
4678 }
4679
4680 struct arth *
4681 gen_arth(code, a0, a1)
4682 int code;
4683 struct arth *a0, *a1;
4684 {
4685 struct slist *s0, *s1, *s2;
4686
4687 s0 = xfer_to_x(a1);
4688 s1 = xfer_to_a(a0);
4689 s2 = new_stmt(BPF_ALU|BPF_X|code);
4690
4691 sappend(s1, s2);
4692 sappend(s0, s1);
4693 sappend(a1->s, s0);
4694 sappend(a0->s, a1->s);
4695
4696 free_reg(a0->regno);
4697 free_reg(a1->regno);
4698
4699 s0 = new_stmt(BPF_ST);
4700 a0->regno = s0->s.k = alloc_reg();
4701 sappend(a0->s, s0);
4702
4703 return a0;
4704 }
4705
4706 /*
4707 * Here we handle simple allocation of the scratch registers.
4708 * If too many registers are alloc'd, the allocator punts.
4709 */
4710 static int regused[BPF_MEMWORDS];
4711 static int curreg;
4712
4713 /*
4714 * Return the next free register.
4715 */
4716 static int
4717 alloc_reg()
4718 {
4719 int n = BPF_MEMWORDS;
4720
4721 while (--n >= 0) {
4722 if (regused[curreg])
4723 curreg = (curreg + 1) % BPF_MEMWORDS;
4724 else {
4725 regused[curreg] = 1;
4726 return curreg;
4727 }
4728 }
4729 bpf_error("too many registers needed to evaluate expression");
4730 /* NOTREACHED */
4731 }
4732
4733 /*
4734 * Return a register to the table so it can
4735 * be used later.
4736 */
4737 static void
4738 free_reg(n)
4739 int n;
4740 {
4741 regused[n] = 0;
4742 }
4743
4744 static struct block *
4745 gen_len(jmp, n)
4746 int jmp, n;
4747 {
4748 struct slist *s;
4749 struct block *b;
4750
4751 s = new_stmt(BPF_LD|BPF_LEN);
4752 b = new_block(JMP(jmp));
4753 b->stmts = s;
4754 b->s.k = n;
4755
4756 return b;
4757 }
4758
4759 struct block *
4760 gen_greater(n)
4761 int n;
4762 {
4763 return gen_len(BPF_JGE, n);
4764 }
4765
4766 /*
4767 * Actually, this is less than or equal.
4768 */
4769 struct block *
4770 gen_less(n)
4771 int n;
4772 {
4773 struct block *b;
4774
4775 b = gen_len(BPF_JGT, n);
4776 gen_not(b);
4777
4778 return b;
4779 }
4780
4781 struct block *
4782 gen_byteop(op, idx, val)
4783 int op, idx, val;
4784 {
4785 struct block *b;
4786 struct slist *s;
4787
4788 switch (op) {
4789 default:
4790 abort();
4791
4792 case '=':
4793 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
4794
4795 case '<':
4796 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
4797 b->s.code = JMP(BPF_JGE);
4798 gen_not(b);
4799 return b;
4800
4801 case '>':
4802 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
4803 b->s.code = JMP(BPF_JGT);
4804 return b;
4805
4806 case '|':
4807 s = new_stmt(BPF_ALU|BPF_OR|BPF_K);
4808 break;
4809
4810 case '&':
4811 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
4812 break;
4813 }
4814 s->s.k = val;
4815 b = new_block(JMP(BPF_JEQ));
4816 b->stmts = s;
4817 gen_not(b);
4818
4819 return b;
4820 }
4821
4822 static u_char abroadcast[] = { 0x0 };
4823
4824 struct block *
4825 gen_broadcast(proto)
4826 int proto;
4827 {
4828 bpf_u_int32 hostmask;
4829 struct block *b0, *b1, *b2;
4830 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
4831
4832 switch (proto) {
4833
4834 case Q_DEFAULT:
4835 case Q_LINK:
4836 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX)
4837 return gen_ahostop(abroadcast, Q_DST);
4838 if (linktype == DLT_EN10MB)
4839 return gen_ehostop(ebroadcast, Q_DST);
4840 if (linktype == DLT_FDDI)
4841 return gen_fhostop(ebroadcast, Q_DST);
4842 if (linktype == DLT_IEEE802)
4843 return gen_thostop(ebroadcast, Q_DST);
4844 if (linktype == DLT_IEEE802_11)
4845 return gen_wlanhostop(ebroadcast, Q_DST);
4846 if (linktype == DLT_IP_OVER_FC)
4847 return gen_ipfchostop(ebroadcast, Q_DST);
4848 if (linktype == DLT_SUNATM && is_lane) {
4849 /*
4850 * Check that the packet doesn't begin with an
4851 * LE Control marker. (We've already generated
4852 * a test for LANE.)
4853 */
4854 b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
4855 gen_not(b1);
4856
4857 /*
4858 * Now check the MAC address.
4859 */
4860 b0 = gen_ehostop(ebroadcast, Q_DST);
4861 gen_and(b1, b0);
4862 return b0;
4863 }
4864 bpf_error("not a broadcast link");
4865 break;
4866
4867 case Q_IP:
4868 b0 = gen_linktype(ETHERTYPE_IP);
4869 hostmask = ~netmask;
4870 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
4871 b2 = gen_mcmp(off_nl + 16, BPF_W,
4872 (bpf_int32)(~0 & hostmask), hostmask);
4873 gen_or(b1, b2);
4874 gen_and(b0, b2);
4875 return b2;
4876 }
4877 bpf_error("only link-layer/IP broadcast filters supported");
4878 /* NOTREACHED */
4879 }
4880
4881 /*
4882 * Generate code to test the low-order bit of a MAC address (that's
4883 * the bottom bit of the *first* byte).
4884 */
4885 static struct block *
4886 gen_mac_multicast(offset)
4887 int offset;
4888 {
4889 register struct block *b0;
4890 register struct slist *s;
4891
4892 /* link[offset] & 1 != 0 */
4893 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
4894 s->s.k = offset;
4895 b0 = new_block(JMP(BPF_JSET));
4896 b0->s.k = 1;
4897 b0->stmts = s;
4898 return b0;
4899 }
4900
4901 struct block *
4902 gen_multicast(proto)
4903 int proto;
4904 {
4905 register struct block *b0, *b1, *b2;
4906 register struct slist *s;
4907
4908 switch (proto) {
4909
4910 case Q_DEFAULT:
4911 case Q_LINK:
4912 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX)
4913 /* all ARCnet multicasts use the same address */
4914 return gen_ahostop(abroadcast, Q_DST);
4915
4916 if (linktype == DLT_EN10MB) {
4917 /* ether[0] & 1 != 0 */
4918 return gen_mac_multicast(0);
4919 }
4920
4921 if (linktype == DLT_FDDI) {
4922 /*
4923 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
4924 *
4925 * XXX - was that referring to bit-order issues?
4926 */
4927 /* fddi[1] & 1 != 0 */
4928 return gen_mac_multicast(1);
4929 }
4930
4931 if (linktype == DLT_IEEE802) {
4932 /* tr[2] & 1 != 0 */
4933 return gen_mac_multicast(2);
4934 }
4935
4936 if (linktype == DLT_IEEE802_11) {
4937 /*
4938 * Oh, yuk.
4939 *
4940 * For control frames, there is no DA.
4941 *
4942 * For management frames, DA is at an
4943 * offset of 4 from the beginning of
4944 * the packet.
4945 *
4946 * For data frames, DA is at an offset
4947 * of 4 from the beginning of the packet
4948 * if To DS is clear and at an offset of
4949 * 16 from the beginning of the packet
4950 * if To DS is set.
4951 */
4952
4953 /*
4954 * Generate the tests to be done for data frames.
4955 *
4956 * First, check for To DS set, i.e. "link[1] & 0x01".
4957 */
4958 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
4959 s->s.k = 1;
4960 b1 = new_block(JMP(BPF_JSET));
4961 b1->s.k = 0x01; /* To DS */
4962 b1->stmts = s;
4963
4964 /*
4965 * If To DS is set, the DA is at 16.
4966 */
4967 b0 = gen_mac_multicast(16);
4968 gen_and(b1, b0);
4969
4970 /*
4971 * Now, check for To DS not set, i.e. check
4972 * "!(link[1] & 0x01)".
4973 */
4974 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
4975 s->s.k = 1;
4976 b2 = new_block(JMP(BPF_JSET));
4977 b2->s.k = 0x01; /* To DS */
4978 b2->stmts = s;
4979 gen_not(b2);
4980
4981 /*
4982 * If To DS is not set, the DA is at 4.
4983 */
4984 b1 = gen_mac_multicast(4);
4985 gen_and(b2, b1);
4986
4987 /*
4988 * Now OR together the last two checks. That gives
4989 * the complete set of checks for data frames.
4990 */
4991 gen_or(b1, b0);
4992
4993 /*
4994 * Now check for a data frame.
4995 * I.e, check "link[0] & 0x08".
4996 */
4997 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
4998 s->s.k = 0;
4999 b1 = new_block(JMP(BPF_JSET));
5000 b1->s.k = 0x08;
5001 b1->stmts = s;
5002
5003 /*
5004 * AND that with the checks done for data frames.
5005 */
5006 gen_and(b1, b0);
5007
5008 /*
5009 * If the high-order bit of the type value is 0, this
5010 * is a management frame.
5011 * I.e, check "!(link[0] & 0x08)".
5012 */
5013 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
5014 s->s.k = 0;
5015 b2 = new_block(JMP(BPF_JSET));
5016 b2->s.k = 0x08;
5017 b2->stmts = s;
5018 gen_not(b2);
5019
5020 /*
5021 * For management frames, the DA is at 4.
5022 */
5023 b1 = gen_mac_multicast(4);
5024 gen_and(b2, b1);
5025
5026 /*
5027 * OR that with the checks done for data frames.
5028 * That gives the checks done for management and
5029 * data frames.
5030 */
5031 gen_or(b1, b0);
5032
5033 /*
5034 * If the low-order bit of the type value is 1,
5035 * this is either a control frame or a frame
5036 * with a reserved type, and thus not a
5037 * frame with an SA.
5038 *
5039 * I.e., check "!(link[0] & 0x04)".
5040 */
5041 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
5042 s->s.k = 0;
5043 b1 = new_block(JMP(BPF_JSET));
5044 b1->s.k = 0x04;
5045 b1->stmts = s;
5046 gen_not(b1);
5047
5048 /*
5049 * AND that with the checks for data and management
5050 * frames.
5051 */
5052 gen_and(b1, b0);
5053 return b0;
5054 }
5055
5056 if (linktype == DLT_IP_OVER_FC) {
5057 b0 = gen_mac_multicast(2);
5058 return b0;
5059 }
5060
5061 if (linktype == DLT_SUNATM && is_lane) {
5062 /*
5063 * Check that the packet doesn't begin with an
5064 * LE Control marker. (We've already generated
5065 * a test for LANE.)
5066 */
5067 b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
5068 gen_not(b1);
5069
5070 /* ether[off_mac] & 1 != 0 */
5071 b0 = gen_mac_multicast(off_mac);
5072 gen_and(b1, b0);
5073 return b0;
5074 }
5075
5076 /* Link not known to support multicasts */
5077 break;
5078
5079 case Q_IP:
5080 b0 = gen_linktype(ETHERTYPE_IP);
5081 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
5082 b1->s.code = JMP(BPF_JGE);
5083 gen_and(b0, b1);
5084 return b1;
5085
5086 #ifdef INET6
5087 case Q_IPV6:
5088 b0 = gen_linktype(ETHERTYPE_IPV6);
5089 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
5090 gen_and(b0, b1);
5091 return b1;
5092 #endif /* INET6 */
5093 }
5094 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel");
5095 /* NOTREACHED */
5096 }
5097
5098 /*
5099 * generate command for inbound/outbound. It's here so we can
5100 * make it link-type specific. 'dir' = 0 implies "inbound",
5101 * = 1 implies "outbound".
5102 */
5103 struct block *
5104 gen_inbound(dir)
5105 int dir;
5106 {
5107 register struct block *b0;
5108
5109 /*
5110 * Only some data link types support inbound/outbound qualifiers.
5111 */
5112 switch (linktype) {
5113 case DLT_SLIP:
5114 b0 = gen_relation(BPF_JEQ,
5115 gen_load(Q_LINK, gen_loadi(0), 1),
5116 gen_loadi(0),
5117 dir);
5118 break;
5119
5120 case DLT_LINUX_SLL:
5121 if (dir) {
5122 /*
5123 * Match packets sent by this machine.
5124 */
5125 b0 = gen_cmp(0, BPF_H, LINUX_SLL_OUTGOING);
5126 } else {
5127 /*
5128 * Match packets sent to this machine.
5129 * (No broadcast or multicast packets, or
5130 * packets sent to some other machine and
5131 * received promiscuously.)
5132 *
5133 * XXX - packets sent to other machines probably
5134 * shouldn't be matched, but what about broadcast
5135 * or multicast packets we received?
5136 */
5137 b0 = gen_cmp(0, BPF_H, LINUX_SLL_HOST);
5138 }
5139 break;
5140
5141 case DLT_PFLOG:
5142 b0 = gen_cmp(offsetof(struct pfloghdr, dir), BPF_B,
5143 (bpf_int32)((dir == 0) ? PF_IN : PF_OUT));
5144 break;
5145
5146 case DLT_PPP_PPPD:
5147 if (dir) {
5148 /* match outgoing packets */
5149 b0 = gen_cmp(0, BPF_B, PPP_PPPD_OUT);
5150 } else {
5151 /* match incoming packets */
5152 b0 = gen_cmp(0, BPF_B, PPP_PPPD_IN);
5153 }
5154 break;
5155
5156 case DLT_JUNIPER_MLFR:
5157 case DLT_JUNIPER_MLPPP:
5158 case DLT_JUNIPER_ATM1:
5159 case DLT_JUNIPER_ATM2:
5160 /* juniper flags (including direction) are stored
5161 * the byte after the 3-byte magic number */
5162 if (dir) {
5163 /* match outgoing packets */
5164 b0 = gen_mcmp(3, BPF_B, 0, 0x01);
5165 } else {
5166 /* match incoming packets */
5167 b0 = gen_mcmp(3, BPF_B, 1, 0x01);
5168 }
5169 break;
5170
5171 default:
5172 bpf_error("inbound/outbound not supported on linktype %d",
5173 linktype);
5174 b0 = NULL;
5175 /* NOTREACHED */
5176 }
5177 return (b0);
5178 }
5179
5180 /* PF firewall log matched interface */
5181 struct block *
5182 gen_pf_ifname(const char *ifname)
5183 {
5184 struct block *b0;
5185 u_int len, off;
5186
5187 if (linktype == DLT_PFLOG) {
5188 len = sizeof(((struct pfloghdr *)0)->ifname);
5189 off = offsetof(struct pfloghdr, ifname);
5190 } else {
5191 bpf_error("ifname not supported on linktype 0x%x", linktype);
5192 /* NOTREACHED */
5193 }
5194 if (strlen(ifname) >= len) {
5195 bpf_error("ifname interface names can only be %d characters",
5196 len-1);
5197 /* NOTREACHED */
5198 }
5199 b0 = gen_bcmp(off, strlen(ifname), (const u_char *)ifname);
5200 return (b0);
5201 }
5202
5203 /* PF firewall log matched interface */
5204 struct block *
5205 gen_pf_ruleset(char *ruleset)
5206 {
5207 struct block *b0;
5208
5209 if (linktype != DLT_PFLOG) {
5210 bpf_error("ruleset not supported on linktype 0x%x", linktype);
5211 /* NOTREACHED */
5212 }
5213 if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) {
5214 bpf_error("ruleset names can only be %ld characters",
5215 (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1));
5216 /* NOTREACHED */
5217 }
5218 b0 = gen_bcmp(offsetof(struct pfloghdr, ruleset),
5219 strlen(ruleset), (const u_char *)ruleset);
5220 return (b0);
5221 }
5222
5223 /* PF firewall log rule number */
5224 struct block *
5225 gen_pf_rnr(int rnr)
5226 {
5227 struct block *b0;
5228
5229 if (linktype == DLT_PFLOG) {
5230 b0 = gen_cmp(offsetof(struct pfloghdr, rulenr), BPF_W,
5231 (bpf_int32)rnr);
5232 } else {
5233 bpf_error("rnr not supported on linktype 0x%x", linktype);
5234 /* NOTREACHED */
5235 }
5236
5237 return (b0);
5238 }
5239
5240 /* PF firewall log sub-rule number */
5241 struct block *
5242 gen_pf_srnr(int srnr)
5243 {
5244 struct block *b0;
5245
5246 if (linktype != DLT_PFLOG) {
5247 bpf_error("srnr not supported on linktype 0x%x", linktype);
5248 /* NOTREACHED */
5249 }
5250
5251 b0 = gen_cmp(offsetof(struct pfloghdr, subrulenr), BPF_W,
5252 (bpf_int32)srnr);
5253 return (b0);
5254 }
5255
5256 /* PF firewall log reason code */
5257 struct block *
5258 gen_pf_reason(int reason)
5259 {
5260 struct block *b0;
5261
5262 if (linktype == DLT_PFLOG) {
5263 b0 = gen_cmp(offsetof(struct pfloghdr, reason), BPF_B,
5264 (bpf_int32)reason);
5265 } else {
5266 bpf_error("reason not supported on linktype 0x%x", linktype);
5267 /* NOTREACHED */
5268 }
5269
5270 return (b0);
5271 }
5272
5273 /* PF firewall log action */
5274 struct block *
5275 gen_pf_action(int action)
5276 {
5277 struct block *b0;
5278
5279 if (linktype == DLT_PFLOG) {
5280 b0 = gen_cmp(offsetof(struct pfloghdr, action), BPF_B,
5281 (bpf_int32)action);
5282 } else {
5283 bpf_error("action not supported on linktype 0x%x", linktype);
5284 /* NOTREACHED */
5285 }
5286
5287 return (b0);
5288 }
5289
5290 struct block *
5291 gen_acode(eaddr, q)
5292 register const u_char *eaddr;
5293 struct qual q;
5294 {
5295 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
5296 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX)
5297 return gen_ahostop(eaddr, (int)q.dir);
5298 }
5299 bpf_error("ARCnet address used in non-arc expression");
5300 /* NOTREACHED */
5301 }
5302
5303 static struct block *
5304 gen_ahostop(eaddr, dir)
5305 register const u_char *eaddr;
5306 register int dir;
5307 {
5308 register struct block *b0, *b1;
5309
5310 switch (dir) {
5311 /* src comes first, different from Ethernet */
5312 case Q_SRC:
5313 return gen_bcmp(0, 1, eaddr);
5314
5315 case Q_DST:
5316 return gen_bcmp(1, 1, eaddr);
5317
5318 case Q_AND:
5319 b0 = gen_ahostop(eaddr, Q_SRC);
5320 b1 = gen_ahostop(eaddr, Q_DST);
5321 gen_and(b0, b1);
5322 return b1;
5323
5324 case Q_DEFAULT:
5325 case Q_OR:
5326 b0 = gen_ahostop(eaddr, Q_SRC);
5327 b1 = gen_ahostop(eaddr, Q_DST);
5328 gen_or(b0, b1);
5329 return b1;
5330 }
5331 abort();
5332 /* NOTREACHED */
5333 }
5334
5335 /*
5336 * support IEEE 802.1Q VLAN trunk over ethernet
5337 */
5338 struct block *
5339 gen_vlan(vlan_num)
5340 int vlan_num;
5341 {
5342 struct block *b0;
5343
5344 /*
5345 * Change the offsets to point to the type and data fields within
5346 * the VLAN packet. Just increment the offsets, so that we
5347 * can support a hierarchy, e.g. "vlan 300 && vlan 200" to
5348 * capture VLAN 200 encapsulated within VLAN 100.
5349 *
5350 * XXX - this is a bit of a kludge. If we were to split the
5351 * compiler into a parser that parses an expression and
5352 * generates an expression tree, and a code generator that
5353 * takes an expression tree (which could come from our
5354 * parser or from some other parser) and generates BPF code,
5355 * we could perhaps make the offsets parameters of routines
5356 * and, in the handler for an "AND" node, pass to subnodes
5357 * other than the VLAN node the adjusted offsets.
5358 *
5359 * This would mean that "vlan" would, instead of changing the
5360 * behavior of *all* tests after it, change only the behavior
5361 * of tests ANDed with it. That would change the documented
5362 * semantics of "vlan", which might break some expressions.
5363 * However, it would mean that "(vlan and ip) or ip" would check
5364 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
5365 * checking only for VLAN-encapsulated IP, so that could still
5366 * be considered worth doing; it wouldn't break expressions
5367 * that are of the form "vlan and ..." or "vlan N and ...",
5368 * which I suspect are the most common expressions involving
5369 * "vlan". "vlan or ..." doesn't necessarily do what the user
5370 * would really want, now, as all the "or ..." tests would
5371 * be done assuming a VLAN, even though the "or" could be viewed
5372 * as meaning "or, if this isn't a VLAN packet...".
5373 */
5374 orig_linktype = off_linktype; /* save original values */
5375 orig_nl = off_nl;
5376 orig_nl_nosnap = off_nl_nosnap;
5377
5378 switch (linktype) {
5379
5380 case DLT_EN10MB:
5381 off_linktype += 4;
5382 off_nl_nosnap += 4;
5383 off_nl += 4;
5384 break;
5385
5386 default:
5387 bpf_error("no VLAN support for data link type %d",
5388 linktype);
5389 /*NOTREACHED*/
5390 }
5391
5392 /* check for VLAN */
5393 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
5394
5395 /* If a specific VLAN is requested, check VLAN id */
5396 if (vlan_num >= 0) {
5397 struct block *b1;
5398
5399 b1 = gen_mcmp(orig_nl, BPF_H, (bpf_int32)vlan_num, 0x0fff);
5400 gen_and(b0, b1);
5401 b0 = b1;
5402 }
5403
5404 return (b0);
5405 }
5406
5407 /*
5408 * support for MPLS
5409 */
5410 struct block *
5411 gen_mpls(label_num)
5412 int label_num;
5413 {
5414 struct block *b0;
5415
5416 /*
5417 * Change the offsets to point to the type and data fields within
5418 * the MPLS packet. Just increment the offsets, so that we
5419 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to
5420 * capture packets with an outer label of 100000 and an inner
5421 * label of 1024.
5422 *
5423 * XXX - this is a bit of a kludge. See comments in gen_vlan().
5424 */
5425 orig_linktype = off_linktype; /* save original values */
5426 orig_nl = off_nl;
5427 orig_nl_nosnap = off_nl_nosnap;
5428
5429 switch (linktype) {
5430
5431 case DLT_C_HDLC: /* fall through */
5432 case DLT_EN10MB:
5433 off_linktype += 4;
5434 off_nl_nosnap += 4;
5435 off_nl += 4;
5436
5437 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_MPLS);
5438 break;
5439
5440 case DLT_PPP:
5441 off_linktype += 4;
5442 off_nl_nosnap += 4;
5443 off_nl += 4;
5444
5445 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)PPP_MPLS_UCAST);
5446 break;
5447
5448 /* FIXME add other DLT_s ...
5449 * for Frame-Relay/and ATM this may get messy due to SNAP headers
5450 * leave it for now */
5451
5452 default:
5453 bpf_error("no MPLS support for data link type %d",
5454 linktype);
5455 b0 = NULL;
5456 /*NOTREACHED*/
5457 break;
5458 }
5459
5460 /* If a specific MPLS label is requested, check it */
5461 if (label_num >= 0) {
5462 struct block *b1;
5463
5464 label_num = label_num << 12; /* label is shifted 12 bits on the wire */
5465 b1 = gen_mcmp(orig_nl, BPF_W, (bpf_int32)label_num, 0xfffff000); /* only compare the first 20 bits */
5466 gen_and(b0, b1);
5467 b0 = b1;
5468 }
5469
5470 return (b0);
5471 }
5472
5473 struct block *
5474 gen_atmfield_code(atmfield, jvalue, jtype, reverse)
5475 int atmfield;
5476 bpf_u_int32 jvalue;
5477 bpf_u_int32 jtype;
5478 int reverse;
5479 {
5480 struct block *b0;
5481
5482 switch (atmfield) {
5483
5484 case A_VPI:
5485 if (!is_atm)
5486 bpf_error("'vpi' supported only on raw ATM");
5487 if (off_vpi == (u_int)-1)
5488 abort();
5489 b0 = gen_ncmp(BPF_B, off_vpi, 0xffffffff, (u_int)jtype,
5490 (u_int)jvalue, reverse);
5491 break;
5492
5493 case A_VCI:
5494 if (!is_atm)
5495 bpf_error("'vci' supported only on raw ATM");
5496 if (off_vci == (u_int)-1)
5497 abort();
5498 b0 = gen_ncmp(BPF_H, off_vci, 0xffffffff, (u_int)jtype,
5499 (u_int)jvalue, reverse);
5500 break;
5501
5502 case A_PROTOTYPE:
5503 if (off_proto == (u_int)-1)
5504 abort(); /* XXX - this isn't on FreeBSD */
5505 b0 = gen_ncmp(BPF_B, off_proto, 0x0f, (u_int)jtype,
5506 (u_int)jvalue, reverse);
5507 break;
5508
5509 case A_MSGTYPE:
5510 if (off_payload == (u_int)-1)
5511 abort();
5512 b0 = gen_ncmp(BPF_B, off_payload + MSG_TYPE_POS, 0xffffffff,
5513 (u_int)jtype, (u_int)jvalue, reverse);
5514 break;
5515
5516 case A_CALLREFTYPE:
5517 if (!is_atm)
5518 bpf_error("'callref' supported only on raw ATM");
5519 if (off_proto == (u_int)-1)
5520 abort();
5521 b0 = gen_ncmp(BPF_B, off_proto, 0xffffffff, (u_int)jtype,
5522 (u_int)jvalue, reverse);
5523 break;
5524
5525 default:
5526 abort();
5527 }
5528 return b0;
5529 }
5530
5531 struct block *
5532 gen_atmtype_abbrev(type)
5533 int type;
5534 {
5535 struct block *b0, *b1;
5536
5537 switch (type) {
5538
5539 case A_METAC:
5540 /* Get all packets in Meta signalling Circuit */
5541 if (!is_atm)
5542 bpf_error("'metac' supported only on raw ATM");
5543 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5544 b1 = gen_atmfield_code(A_VCI, 1, BPF_JEQ, 0);
5545 gen_and(b0, b1);
5546 break;
5547
5548 case A_BCC:
5549 /* Get all packets in Broadcast Circuit*/
5550 if (!is_atm)
5551 bpf_error("'bcc' supported only on raw ATM");
5552 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5553 b1 = gen_atmfield_code(A_VCI, 2, BPF_JEQ, 0);
5554 gen_and(b0, b1);
5555 break;
5556
5557 case A_OAMF4SC:
5558 /* Get all cells in Segment OAM F4 circuit*/
5559 if (!is_atm)
5560 bpf_error("'oam4sc' supported only on raw ATM");
5561 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5562 b1 = gen_atmfield_code(A_VCI, 3, BPF_JEQ, 0);
5563 gen_and(b0, b1);
5564 break;
5565
5566 case A_OAMF4EC:
5567 /* Get all cells in End-to-End OAM F4 Circuit*/
5568 if (!is_atm)
5569 bpf_error("'oam4ec' supported only on raw ATM");
5570 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5571 b1 = gen_atmfield_code(A_VCI, 4, BPF_JEQ, 0);
5572 gen_and(b0, b1);
5573 break;
5574
5575 case A_SC:
5576 /* Get all packets in connection Signalling Circuit */
5577 if (!is_atm)
5578 bpf_error("'sc' supported only on raw ATM");
5579 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5580 b1 = gen_atmfield_code(A_VCI, 5, BPF_JEQ, 0);
5581 gen_and(b0, b1);
5582 break;
5583
5584 case A_ILMIC:
5585 /* Get all packets in ILMI Circuit */
5586 if (!is_atm)
5587 bpf_error("'ilmic' supported only on raw ATM");
5588 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5589 b1 = gen_atmfield_code(A_VCI, 16, BPF_JEQ, 0);
5590 gen_and(b0, b1);
5591 break;
5592
5593 case A_LANE:
5594 /* Get all LANE packets */
5595 if (!is_atm)
5596 bpf_error("'lane' supported only on raw ATM");
5597 b1 = gen_atmfield_code(A_PROTOTYPE, PT_LANE, BPF_JEQ, 0);
5598
5599 /*
5600 * Arrange that all subsequent tests assume LANE
5601 * rather than LLC-encapsulated packets, and set
5602 * the offsets appropriately for LANE-encapsulated
5603 * Ethernet.
5604 *
5605 * "off_mac" is the offset of the Ethernet header,
5606 * which is 2 bytes past the ATM pseudo-header
5607 * (skipping the pseudo-header and 2-byte LE Client
5608 * field). The other offsets are Ethernet offsets
5609 * relative to "off_mac".
5610 */
5611 is_lane = 1;
5612 off_mac = off_payload + 2; /* MAC header */
5613 off_linktype = off_mac + 12;
5614 off_nl = off_mac + 14; /* Ethernet II */
5615 off_nl_nosnap = off_mac + 17; /* 802.3+802.2 */
5616 break;
5617
5618 case A_LLC:
5619 /* Get all LLC-encapsulated packets */
5620 if (!is_atm)
5621 bpf_error("'llc' supported only on raw ATM");
5622 b1 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0);
5623 is_lane = 0;
5624 break;
5625
5626 default:
5627 abort();
5628 }
5629 return b1;
5630 }
5631
5632
5633 static struct block *
5634 gen_msg_abbrev(type)
5635 int type;
5636 {
5637 struct block *b1;
5638
5639 /*
5640 * Q.2931 signalling protocol messages for handling virtual circuits
5641 * establishment and teardown
5642 */
5643 switch (type) {
5644
5645 case A_SETUP:
5646 b1 = gen_atmfield_code(A_MSGTYPE, SETUP, BPF_JEQ, 0);
5647 break;
5648
5649 case A_CALLPROCEED:
5650 b1 = gen_atmfield_code(A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0);
5651 break;
5652
5653 case A_CONNECT:
5654 b1 = gen_atmfield_code(A_MSGTYPE, CONNECT, BPF_JEQ, 0);
5655 break;
5656
5657 case A_CONNECTACK:
5658 b1 = gen_atmfield_code(A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0);
5659 break;
5660
5661 case A_RELEASE:
5662 b1 = gen_atmfield_code(A_MSGTYPE, RELEASE, BPF_JEQ, 0);
5663 break;
5664
5665 case A_RELEASE_DONE:
5666 b1 = gen_atmfield_code(A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0);
5667 break;
5668
5669 default:
5670 abort();
5671 }
5672 return b1;
5673 }
5674
5675 struct block *
5676 gen_atmmulti_abbrev(type)
5677 int type;
5678 {
5679 struct block *b0, *b1;
5680
5681 switch (type) {
5682
5683 case A_OAM:
5684 if (!is_atm)
5685 bpf_error("'oam' supported only on raw ATM");
5686 b1 = gen_atmmulti_abbrev(A_OAMF4);
5687 break;
5688
5689 case A_OAMF4:
5690 if (!is_atm)
5691 bpf_error("'oamf4' supported only on raw ATM");
5692 /* OAM F4 type */
5693 b0 = gen_atmfield_code(A_VCI, 3, BPF_JEQ, 0);
5694 b1 = gen_atmfield_code(A_VCI, 4, BPF_JEQ, 0);
5695 gen_or(b0, b1);
5696 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0);
5697 gen_and(b0, b1);
5698 break;
5699
5700 case A_CONNECTMSG:
5701 /*
5702 * Get Q.2931 signalling messages for switched
5703 * virtual connection
5704 */
5705 if (!is_atm)
5706 bpf_error("'connectmsg' supported only on raw ATM");
5707 b0 = gen_msg_abbrev(A_SETUP);
5708 b1 = gen_msg_abbrev(A_CALLPROCEED);
5709 gen_or(b0, b1);
5710 b0 = gen_msg_abbrev(A_CONNECT);
5711 gen_or(b0, b1);
5712 b0 = gen_msg_abbrev(A_CONNECTACK);
5713 gen_or(b0, b1);
5714 b0 = gen_msg_abbrev(A_RELEASE);
5715 gen_or(b0, b1);
5716 b0 = gen_msg_abbrev(A_RELEASE_DONE);
5717 gen_or(b0, b1);
5718 b0 = gen_atmtype_abbrev(A_SC);
5719 gen_and(b0, b1);
5720 break;
5721
5722 case A_METACONNECT:
5723 if (!is_atm)
5724 bpf_error("'metaconnect' supported only on raw ATM");
5725 b0 = gen_msg_abbrev(A_SETUP);
5726 b1 = gen_msg_abbrev(A_CALLPROCEED);
5727 gen_or(b0, b1);
5728 b0 = gen_msg_abbrev(A_CONNECT);
5729 gen_or(b0, b1);
5730 b0 = gen_msg_abbrev(A_RELEASE);
5731 gen_or(b0, b1);
5732 b0 = gen_msg_abbrev(A_RELEASE_DONE);
5733 gen_or(b0, b1);
5734 b0 = gen_atmtype_abbrev(A_METAC);
5735 gen_and(b0, b1);
5736 break;
5737
5738 default:
5739 abort();
5740 }
5741 return b1;
5742 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism