]> The Tcpdump Group git mirrors - libpcap/blob - gencode.c
projects / libpcap / blob


a033a783a90a861604b834bd1ed2002559953172
[libpcap] / gencode.c
1 /*#define CHASE_CHAIN*/
2 /*
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.149 2001-02-21 09:33:04 guy Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <sys/types.h>
32 #include <sys/socket.h>
33 #include <sys/time.h>
34 #ifdef __NetBSD__
35 #include <sys/param.h>
36 #endif
37
38 struct mbuf;
39 struct rtentry;
40 #include <net/if.h>
41
42 #include <netinet/in.h>
43
44 #include <stdlib.h>
45 #include <string.h>
46 #include <memory.h>
47 #include <setjmp.h>
48 #include <stdarg.h>
49
50 #include "pcap-int.h"
51
52 #include "ethertype.h"
53 #include "nlpid.h"
54 #include "llc.h"
55 #include "gencode.h"
56 #include "ppp.h"
57 #include "sll.h"
58 #include <pcap-namedb.h>
59 #ifdef INET6
60 #include <netdb.h>
61 #include <sys/socket.h>
62 #endif /*INET6*/
63
64 #define ETHERMTU 1500
65
66 #ifdef HAVE_OS_PROTO_H
67 #include "os-proto.h"
68 #endif
69
70 #define JMP(c) ((c)|BPF_JMP|BPF_K)
71
72 /* Locals */
73 static jmp_buf top_ctx;
74 static pcap_t *bpf_pcap;
75
76 /* XXX */
77 #ifdef PCAP_FDDIPAD
78 int pcap_fddipad = PCAP_FDDIPAD;
79 #else
80 int pcap_fddipad;
81 #endif
82
83 /* VARARGS */
84 void
85 bpf_error(const char *fmt, ...)
86
87 {
88 va_list ap;
89
90 va_start(ap, fmt);
91 if (bpf_pcap != NULL)
92 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE,
93 fmt, ap);
94 va_end(ap);
95 longjmp(top_ctx, 1);
96 /* NOTREACHED */
97 }
98
99 static void init_linktype(int);
100
101 static int alloc_reg(void);
102 static void free_reg(int);
103
104 static struct block *root;
105
106 /*
107 * We divy out chunks of memory rather than call malloc each time so
108 * we don't have to worry about leaking memory. It's probably
109 * not a big deal if all this memory was wasted but it this ever
110 * goes into a library that would probably not be a good idea.
111 */
112 #define NCHUNKS 16
113 #define CHUNK0SIZE 1024
114 struct chunk {
115 u_int n_left;
116 void *m;
117 };
118
119 static struct chunk chunks[NCHUNKS];
120 static int cur_chunk;
121
122 static void *newchunk(u_int);
123 static void freechunks(void);
124 static inline struct block *new_block(int);
125 static inline struct slist *new_stmt(int);
126 static struct block *gen_retblk(int);
127 static inline void syntax(void);
128
129 static void backpatch(struct block *, struct block *);
130 static void merge(struct block *, struct block *);
131 static struct block *gen_cmp(u_int, u_int, bpf_int32);
132 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
133 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
134 static struct block *gen_bcmp(u_int, u_int, const u_char *);
135 static struct block *gen_uncond(int);
136 static inline struct block *gen_true(void);
137 static inline struct block *gen_false(void);
138 static struct block *gen_linktype(int);
139 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
140 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
141 #ifdef INET6
142 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
143 #endif
144 static struct block *gen_ehostop(const u_char *, int);
145 static struct block *gen_fhostop(const u_char *, int);
146 static struct block *gen_thostop(const u_char *, int);
147 static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
148 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
149 #ifdef INET6
150 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
151 #endif
152 #ifndef INET6
153 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
154 #endif
155 static struct block *gen_ipfrag(void);
156 static struct block *gen_portatom(int, bpf_int32);
157 #ifdef INET6
158 static struct block *gen_portatom6(int, bpf_int32);
159 #endif
160 struct block *gen_portop(int, int, int);
161 static struct block *gen_port(int, int, int);
162 #ifdef INET6
163 struct block *gen_portop6(int, int, int);
164 static struct block *gen_port6(int, int, int);
165 #endif
166 static int lookup_proto(const char *, int);
167 static struct block *gen_protochain(int, int, int);
168 static struct block *gen_proto(int, int, int);
169 static struct slist *xfer_to_x(struct arth *);
170 static struct slist *xfer_to_a(struct arth *);
171 static struct block *gen_len(int, int);
172
173 static void *
174 newchunk(n)
175 u_int n;
176 {
177 struct chunk *cp;
178 int k, size;
179
180 #ifndef __NetBSD__
181 /* XXX Round up to nearest long. */
182 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1);
183 #else
184 /* XXX Round up to structure boundary. */
185 n = ALIGN(n);
186 #endif
187
188 cp = &chunks[cur_chunk];
189 if (n > cp->n_left) {
190 ++cp, k = ++cur_chunk;
191 if (k >= NCHUNKS)
192 bpf_error("out of memory");
193 size = CHUNK0SIZE << k;
194 cp->m = (void *)malloc(size);
195 memset((char *)cp->m, 0, size);
196 cp->n_left = size;
197 if (n > size)
198 bpf_error("out of memory");
199 }
200 cp->n_left -= n;
201 return (void *)((char *)cp->m + cp->n_left);
202 }
203
204 static void
205 freechunks()
206 {
207 int i;
208
209 cur_chunk = 0;
210 for (i = 0; i < NCHUNKS; ++i)
211 if (chunks[i].m != NULL) {
212 free(chunks[i].m);
213 chunks[i].m = NULL;
214 }
215 }
216
217 /*
218 * A strdup whose allocations are freed after code generation is over.
219 */
220 char *
221 sdup(s)
222 register const char *s;
223 {
224 int n = strlen(s) + 1;
225 char *cp = newchunk(n);
226
227 strlcpy(cp, s, n);
228 return (cp);
229 }
230
231 static inline struct block *
232 new_block(code)
233 int code;
234 {
235 struct block *p;
236
237 p = (struct block *)newchunk(sizeof(*p));
238 p->s.code = code;
239 p->head = p;
240
241 return p;
242 }
243
244 static inline struct slist *
245 new_stmt(code)
246 int code;
247 {
248 struct slist *p;
249
250 p = (struct slist *)newchunk(sizeof(*p));
251 p->s.code = code;
252
253 return p;
254 }
255
256 static struct block *
257 gen_retblk(v)
258 int v;
259 {
260 struct block *b = new_block(BPF_RET|BPF_K);
261
262 b->s.k = v;
263 return b;
264 }
265
266 static inline void
267 syntax()
268 {
269 bpf_error("syntax error in filter expression");
270 }
271
272 static bpf_u_int32 netmask;
273 static int snaplen;
274 int no_optimize;
275
276 int
277 pcap_compile(pcap_t *p, struct bpf_program *program,
278 char *buf, int optimize, bpf_u_int32 mask)
279 {
280 extern int n_errors;
281 int len;
282
283 no_optimize = 0;
284 n_errors = 0;
285 root = NULL;
286 bpf_pcap = p;
287 if (setjmp(top_ctx)) {
288 lex_cleanup();
289 freechunks();
290 return (-1);
291 }
292
293 netmask = mask;
294
295 snaplen = pcap_snapshot(p);
296 if (snaplen == 0) {
297 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
298 "snaplen of 0 rejects all packets");
299 return -1;
300 }
301
302 lex_init(buf ? buf : "");
303 init_linktype(pcap_datalink(p));
304 (void)pcap_parse();
305
306 if (n_errors)
307 syntax();
308
309 if (root == NULL)
310 root = gen_retblk(snaplen);
311
312 if (optimize && !no_optimize) {
313 bpf_optimize(&root);
314 if (root == NULL ||
315 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
316 bpf_error("expression rejects all packets");
317 }
318 program->bf_insns = icode_to_fcode(root, &len);
319 program->bf_len = len;
320
321 lex_cleanup();
322 freechunks();
323 return (0);
324 }
325
326 /*
327 * entry point for using the compiler with no pcap open
328 * pass in all the stuff that is needed explicitly instead.
329 */
330 int
331 pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
332 struct bpf_program *program,
333 char *buf, int optimize, bpf_u_int32 mask)
334 {
335 pcap_t *p;
336 int ret;
337
338 p = pcap_open_dead(linktype_arg, snaplen_arg);
339 if (p == NULL)
340 return (-1);
341 ret = pcap_compile(p, program, buf, optimize, mask);
342 pcap_close(p);
343 return (ret);
344 }
345
346 /*
347 * Clean up a "struct bpf_program" by freeing all the memory allocated
348 * in it.
349 */
350 void
351 pcap_freecode(struct bpf_program *program)
352 {
353 program->bf_len = 0;
354 if (program->bf_insns != NULL) {
355 free((char *)program->bf_insns);
356 program->bf_insns = NULL;
357 }
358 }
359
360 /*
361 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
362 * which of the jt and jf fields has been resolved and which is a pointer
363 * back to another unresolved block (or nil). At least one of the fields
364 * in each block is already resolved.
365 */
366 static void
367 backpatch(list, target)
368 struct block *list, *target;
369 {
370 struct block *next;
371
372 while (list) {
373 if (!list->sense) {
374 next = JT(list);
375 JT(list) = target;
376 } else {
377 next = JF(list);
378 JF(list) = target;
379 }
380 list = next;
381 }
382 }
383
384 /*
385 * Merge the lists in b0 and b1, using the 'sense' field to indicate
386 * which of jt and jf is the link.
387 */
388 static void
389 merge(b0, b1)
390 struct block *b0, *b1;
391 {
392 register struct block **p = &b0;
393
394 /* Find end of list. */
395 while (*p)
396 p = !((*p)->sense) ? &JT(*p) : &JF(*p);
397
398 /* Concatenate the lists. */
399 *p = b1;
400 }
401
402 void
403 finish_parse(p)
404 struct block *p;
405 {
406 backpatch(p, gen_retblk(snaplen));
407 p->sense = !p->sense;
408 backpatch(p, gen_retblk(0));
409 root = p->head;
410 }
411
412 void
413 gen_and(b0, b1)
414 struct block *b0, *b1;
415 {
416 backpatch(b0, b1->head);
417 b0->sense = !b0->sense;
418 b1->sense = !b1->sense;
419 merge(b1, b0);
420 b1->sense = !b1->sense;
421 b1->head = b0->head;
422 }
423
424 void
425 gen_or(b0, b1)
426 struct block *b0, *b1;
427 {
428 b0->sense = !b0->sense;
429 backpatch(b0, b1->head);
430 b0->sense = !b0->sense;
431 merge(b1, b0);
432 b1->head = b0->head;
433 }
434
435 void
436 gen_not(b)
437 struct block *b;
438 {
439 b->sense = !b->sense;
440 }
441
442 static struct block *
443 gen_cmp(offset, size, v)
444 u_int offset, size;
445 bpf_int32 v;
446 {
447 struct slist *s;
448 struct block *b;
449
450 s = new_stmt(BPF_LD|BPF_ABS|size);
451 s->s.k = offset;
452
453 b = new_block(JMP(BPF_JEQ));
454 b->stmts = s;
455 b->s.k = v;
456
457 return b;
458 }
459
460 static struct block *
461 gen_cmp_gt(offset, size, v)
462 u_int offset, size;
463 bpf_int32 v;
464 {
465 struct slist *s;
466 struct block *b;
467
468 s = new_stmt(BPF_LD|BPF_ABS|size);
469 s->s.k = offset;
470
471 b = new_block(JMP(BPF_JGT));
472 b->stmts = s;
473 b->s.k = v;
474
475 return b;
476 }
477
478 static struct block *
479 gen_mcmp(offset, size, v, mask)
480 u_int offset, size;
481 bpf_int32 v;
482 bpf_u_int32 mask;
483 {
484 struct block *b = gen_cmp(offset, size, v);
485 struct slist *s;
486
487 if (mask != 0xffffffff) {
488 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
489 s->s.k = mask;
490 b->stmts->next = s;
491 }
492 return b;
493 }
494
495 static struct block *
496 gen_bcmp(offset, size, v)
497 register u_int offset, size;
498 register const u_char *v;
499 {
500 register struct block *b, *tmp;
501
502 b = NULL;
503 while (size >= 4) {
504 register const u_char *p = &v[size - 4];
505 bpf_int32 w = ((bpf_int32)p[0] << 24) |
506 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
507
508 tmp = gen_cmp(offset + size - 4, BPF_W, w);
509 if (b != NULL)
510 gen_and(b, tmp);
511 b = tmp;
512 size -= 4;
513 }
514 while (size >= 2) {
515 register const u_char *p = &v[size - 2];
516 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
517
518 tmp = gen_cmp(offset + size - 2, BPF_H, w);
519 if (b != NULL)
520 gen_and(b, tmp);
521 b = tmp;
522 size -= 2;
523 }
524 if (size > 0) {
525 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
526 if (b != NULL)
527 gen_and(b, tmp);
528 b = tmp;
529 }
530 return b;
531 }
532
533 /*
534 * Various code constructs need to know the layout of the data link
535 * layer. These variables give the necessary offsets. off_linktype
536 * is set to -1 for no encapsulation, in which case, IP is assumed.
537 */
538 static u_int off_linktype;
539 static u_int off_nl;
540 static int linktype;
541
542 static void
543 init_linktype(type)
544 int type;
545 {
546 linktype = type;
547
548 switch (type) {
549
550 case DLT_EN10MB:
551 off_linktype = 12;
552 off_nl = 14;
553 return;
554
555 case DLT_SLIP:
556 /*
557 * SLIP doesn't have a link level type. The 16 byte
558 * header is hacked into our SLIP driver.
559 */
560 off_linktype = -1;
561 off_nl = 16;
562 return;
563
564 case DLT_SLIP_BSDOS:
565 /* XXX this may be the same as the DLT_PPP_BSDOS case */
566 off_linktype = -1;
567 /* XXX end */
568 off_nl = 24;
569 return;
570
571 case DLT_NULL:
572 case DLT_LOOP:
573 off_linktype = 0;
574 off_nl = 4;
575 return;
576
577 case DLT_PPP:
578 case DLT_C_HDLC:
579 case DLT_PPP_SERIAL:
580 off_linktype = 2;
581 off_nl = 4;
582 return;
583
584 case DLT_PPP_BSDOS:
585 off_linktype = 5;
586 off_nl = 24;
587 return;
588
589 case DLT_FDDI:
590 /*
591 * FDDI doesn't really have a link-level type field.
592 * We set "off_linktype" to the offset of the LLC header.
593 *
594 * To check for Ethernet types, we assume that SSAP = SNAP
595 * is being used and pick out the encapsulated Ethernet type.
596 * XXX - should we generate code to check for SNAP?
597 */
598 off_linktype = 13;
599 #ifdef PCAP_FDDIPAD
600 off_linktype += pcap_fddipad;
601 #endif
602 off_nl = 21;
603 #ifdef PCAP_FDDIPAD
604 off_nl += pcap_fddipad;
605 #endif
606 return;
607
608 case DLT_IEEE802:
609 /*
610 * Token Ring doesn't really have a link-level type field.
611 * We set "off_linktype" to the offset of the LLC header.
612 *
613 * To check for Ethernet types, we assume that SSAP = SNAP
614 * is being used and pick out the encapsulated Ethernet type.
615 * XXX - should we generate code to check for SNAP?
616 *
617 * XXX - the header is actually variable-length.
618 * Some various Linux patched versions gave 38
619 * as "off_linktype" and 40 as "off_nl"; however,
620 * if a token ring packet has *no* routing
621 * information, i.e. is not source-routed, the correct
622 * values are 20 and 22, as they are in the vanilla code.
623 *
624 * A packet is source-routed iff the uppermost bit
625 * of the first byte of the source address, at an
626 * offset of 8, has the uppermost bit set. If the
627 * packet is source-routed, the total number of bytes
628 * of routing information is 2 plus bits 0x1F00 of
629 * the 16-bit value at an offset of 14 (shifted right
630 * 8 - figure out which byte that is).
631 */
632 off_linktype = 14;
633 off_nl = 22;
634 return;
635
636 case DLT_ATM_RFC1483:
637 /*
638 * assume routed, non-ISO PDUs
639 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
640 */
641 off_linktype = 6;
642 off_nl = 8;
643 return;
644
645 case DLT_RAW:
646 off_linktype = -1;
647 off_nl = 0;
648 return;
649
650 case DLT_ATM_CLIP: /* Linux ATM defines this */
651 off_linktype = 6;
652 off_nl = 8;
653 return;
654
655 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */
656 off_linktype = 14;
657 off_nl = 16;
658 return;
659 }
660 bpf_error("unknown data link type %d", linktype);
661 /* NOTREACHED */
662 }
663
664 static struct block *
665 gen_uncond(rsense)
666 int rsense;
667 {
668 struct block *b;
669 struct slist *s;
670
671 s = new_stmt(BPF_LD|BPF_IMM);
672 s->s.k = !rsense;
673 b = new_block(JMP(BPF_JEQ));
674 b->stmts = s;
675
676 return b;
677 }
678
679 static inline struct block *
680 gen_true()
681 {
682 return gen_uncond(1);
683 }
684
685 static inline struct block *
686 gen_false()
687 {
688 return gen_uncond(0);
689 }
690
691 /*
692 * Byte-swap a 32-bit number.
693 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
694 * big-endian platforms.)
695 */
696 #define SWAPLONG(y) \
697 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
698
699 static struct block *
700 gen_linktype(proto)
701 register int proto;
702 {
703 struct block *b0, *b1;
704
705 switch (linktype) {
706
707 case DLT_EN10MB:
708 switch (proto) {
709
710 case LLCSAP_ISONS:
711 /*
712 * OSI protocols always use 802.2 encapsulation.
713 * XXX - should we check both the DSAP and the
714 * SSAP, like this, or should we check just the
715 * DSAP?
716 */
717 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
718 gen_not(b0);
719 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
720 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
721 gen_and(b0, b1);
722 return b1;
723
724 case LLCSAP_NETBEUI:
725 /*
726 * NetBEUI always uses 802.2 encapsulation.
727 * XXX - should we check both the DSAP and the
728 * SSAP, like this, or should we check just the
729 * DSAP?
730 */
731 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
732 gen_not(b0);
733 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
734 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
735 gen_and(b0, b1);
736 return b1;
737
738 case LLCSAP_IPX:
739 /*
740 * Check for;
741 *
742 * Ethernet_II frames, which are Ethernet
743 * frames with a frame type of ETHERTYPE_IPX;
744 *
745 * Ethernet_802.3 frames, which are 802.3
746 * frames (i.e., the type/length field is
747 * a length field, <= ETHERMTU, rather than
748 * a type field) with the first two bytes
749 * after the Ethernet/802.3 header being
750 * 0xFFFF;
751 *
752 * Ethernet_802.2 frames, which are 802.3
753 * frames with an 802.2 LLC header and
754 * with the IPX LSAP as the DSAP in the LLC
755 * header;
756 *
757 * Ethernet_SNAP frames, which are 802.3
758 * frames with an LLC header and a SNAP
759 * header and with an OUI of 0x000000
760 * (encapsulated Ethernet) and a protocol
761 * ID of ETHERTYPE_IPX in the SNAP header.
762 *
763 * XXX - should we generate the same code both
764 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
765 */
766
767 /*
768 * This generates code to check both for the
769 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
770 */
771 b0 = gen_cmp(off_linktype + 2, BPF_B,
772 (bpf_int32)LLCSAP_IPX);
773 b1 = gen_cmp(off_linktype + 2, BPF_H,
774 (bpf_int32)0xFFFF);
775 gen_or(b0, b1);
776
777 /*
778 * Now we add code to check for SNAP frames with
779 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
780 */
781 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
782 gen_or(b0, b1);
783
784 /*
785 * Now we generate code to check for 802.3
786 * frames in general.
787 */
788 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
789 gen_not(b0);
790
791 /*
792 * Now add the check for 802.3 frames before the
793 * check for Ethernet_802.2 and Ethernet_802.3,
794 * as those checks should only be done on 802.3
795 * frames, not on Ethernet frames.
796 */
797 gen_and(b0, b1);
798
799 /*
800 * Now add the check for Ethernet_II frames, and
801 * do that before checking for the other frame
802 * types.
803 */
804 b0 = gen_cmp(off_linktype, BPF_H,
805 (bpf_int32)ETHERTYPE_IPX);
806 gen_or(b0, b1);
807 return b1;
808
809 case ETHERTYPE_ATALK:
810 case ETHERTYPE_AARP:
811 /*
812 * EtherTalk (AppleTalk protocols on Ethernet link
813 * layer) may use 802.2 encapsulation.
814 */
815
816 /*
817 * Check for 802.2 encapsulation (EtherTalk phase 2?);
818 * we check for an Ethernet type field less than
819 * 1500, which means it's an 802.3 length field.
820 */
821 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
822 gen_not(b0);
823
824 /*
825 * 802.2-encapsulated ETHERTYPE_ATALK packets are
826 * SNAP packets with an organization code of
827 * 0x080007 (Apple, for Appletalk) and a protocol
828 * type of ETHERTYPE_ATALK (Appletalk).
829 *
830 * 802.2-encapsulated ETHERTYPE_AARP packets are
831 * SNAP packets with an organization code of
832 * 0x000000 (encapsulated Ethernet) and a protocol
833 * type of ETHERTYPE_AARP (Appletalk ARP).
834 */
835 if (proto == ETHERTYPE_ATALK)
836 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
837 else /* proto == ETHERTYPE_AARP */
838 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
839 gen_and(b0, b1);
840
841 /*
842 * Check for Ethernet encapsulation (Ethertalk
843 * phase 1?); we just check for the Ethernet
844 * protocol type.
845 */
846 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
847
848 gen_or(b0, b1);
849 return b1;
850
851 default:
852 if (proto <= ETHERMTU) {
853 /*
854 * This is an LLC SAP value, so the frames
855 * that match would be 802.2 frames.
856 * Check that the frame is an 802.2 frame
857 * (i.e., that the length/type field is
858 * a length field, <= ETHERMTU) and
859 * then check the DSAP.
860 */
861 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
862 gen_not(b0);
863 b1 = gen_cmp(off_linktype + 2, BPF_B,
864 (bpf_int32)proto);
865 gen_and(b0, b1);
866 return b1;
867 } else {
868 /*
869 * This is an Ethernet type, so compare
870 * the length/type field with it (if
871 * the frame is an 802.2 frame, the length
872 * field will be <= ETHERMTU, and, as
873 * "proto" is > ETHERMTU, this test
874 * will fail and the frame won't match,
875 * which is what we want).
876 */
877 return gen_cmp(off_linktype, BPF_H,
878 (bpf_int32)proto);
879 }
880 }
881 break;
882
883 case DLT_FDDI:
884 case DLT_IEEE802:
885 case DLT_ATM_RFC1483:
886 case DLT_ATM_CLIP:
887 /*
888 * XXX - handle token-ring variable-length header.
889 */
890 switch (proto) {
891
892 case LLCSAP_ISONS:
893 return gen_cmp(off_linktype, BPF_H, (long)
894 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
895
896 case LLCSAP_NETBEUI:
897 return gen_cmp(off_linktype, BPF_H, (long)
898 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
899
900 case LLCSAP_IPX:
901 /*
902 * XXX - are there ever SNAP frames for IPX on
903 * non-Ethernet 802.x networks?
904 */
905 return gen_cmp(off_linktype, BPF_B,
906 (bpf_int32)LLCSAP_IPX);
907
908 case ETHERTYPE_ATALK:
909 /*
910 * 802.2-encapsulated ETHERTYPE_ATALK packets are
911 * SNAP packets with an organization code of
912 * 0x080007 (Apple, for Appletalk) and a protocol
913 * type of ETHERTYPE_ATALK (Appletalk).
914 *
915 * XXX - check for an organization code of
916 * encapsulated Ethernet as well?
917 */
918 return gen_snap(0x080007, ETHERTYPE_ATALK,
919 off_linktype);
920 break;
921
922 default:
923 /*
924 * XXX - we don't have to check for IPX 802.3
925 * here, but should we check for the IPX Ethertype?
926 */
927 if (proto <= ETHERMTU) {
928 /*
929 * This is an LLC SAP value, so check
930 * the DSAP.
931 */
932 return gen_cmp(off_linktype, BPF_B,
933 (bpf_int32)proto);
934 } else {
935 /*
936 * This is an Ethernet type; we assume
937 * that it's unlikely that it'll
938 * appear in the right place at random,
939 * and therefore check only the
940 * location that would hold the Ethernet
941 * type in a SNAP frame with an organization
942 * code of 0x000000 (encapsulated Ethernet).
943 *
944 * XXX - if we were to check for the SNAP DSAP
945 * and LSAP, as per XXX, and were also to check
946 * for an organization code of 0x000000
947 * (encapsulated Ethernet), we'd do
948 *
949 * return gen_snap(0x000000, proto,
950 * off_linktype);
951 *
952 * here; for now, we don't, as per the above.
953 * I don't know whether it's worth the
954 * extra CPU time to do the right check
955 * or not.
956 */
957 return gen_cmp(off_linktype+6, BPF_H,
958 (bpf_int32)proto);
959 }
960 }
961 break;
962
963 case DLT_LINUX_SLL:
964 switch (proto) {
965
966 case LLCSAP_ISONS:
967 /*
968 * OSI protocols always use 802.2 encapsulation.
969 * XXX - should we check both the DSAP and the
970 * LSAP, like this, or should we check just the
971 * DSAP?
972 */
973 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
974 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
975 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
976 gen_and(b0, b1);
977 return b1;
978
979 case LLCSAP_NETBEUI:
980 /*
981 * NetBEUI always uses 802.2 encapsulation.
982 * XXX - should we check both the DSAP and the
983 * LSAP, like this, or should we check just the
984 * DSAP?
985 */
986 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
987 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
988 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
989 gen_and(b0, b1);
990 return b1;
991
992 case LLCSAP_IPX:
993 /*
994 * Ethernet_II frames, which are Ethernet
995 * frames with a frame type of ETHERTYPE_IPX;
996 *
997 * Ethernet_802.3 frames, which have a frame
998 * type of LINUX_SLL_P_802_3;
999 *
1000 * Ethernet_802.2 frames, which are 802.3
1001 * frames with an 802.2 LLC header (i.e, have
1002 * a frame type of LINUX_SLL_P_802_2) and
1003 * with the IPX LSAP as the DSAP in the LLC
1004 * header;
1005 *
1006 * Ethernet_SNAP frames, which are 802.3
1007 * frames with an LLC header and a SNAP
1008 * header and with an OUI of 0x000000
1009 * (encapsulated Ethernet) and a protocol
1010 * ID of ETHERTYPE_IPX in the SNAP header.
1011 *
1012 * First, do the checks on LINUX_SLL_P_802_2
1013 * frames; generate the check for either
1014 * Ethernet_802.2 or Ethernet_SNAP frames, and
1015 * then put a check for LINUX_SLL_P_802_2 frames
1016 * before it.
1017 */
1018 b0 = gen_cmp(off_linktype + 2, BPF_B,
1019 (bpf_int32)LLCSAP_IPX);
1020 b1 = gen_snap(0x000000, ETHERTYPE_IPX,
1021 off_linktype + 2);
1022 gen_or(b0, b1);
1023 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1024 gen_and(b0, b1);
1025
1026 /*
1027 * Now check for 802.3 frames and OR that with
1028 * the previous test.
1029 */
1030 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
1031 gen_or(b0, b1);
1032
1033 /*
1034 * Now add the check for Ethernet_II frames, and
1035 * do that before checking for the other frame
1036 * types.
1037 */
1038 b0 = gen_cmp(off_linktype, BPF_H,
1039 (bpf_int32)ETHERTYPE_IPX);
1040 gen_or(b0, b1);
1041 return b1;
1042
1043 case ETHERTYPE_ATALK:
1044 case ETHERTYPE_AARP:
1045 /*
1046 * EtherTalk (AppleTalk protocols on Ethernet link
1047 * layer) may use 802.2 encapsulation.
1048 */
1049
1050 /*
1051 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1052 * we check for the 802.2 protocol type in the
1053 * "Ethernet type" field.
1054 */
1055 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1056
1057 /*
1058 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1059 * SNAP packets with an organization code of
1060 * 0x080007 (Apple, for Appletalk) and a protocol
1061 * type of ETHERTYPE_ATALK (Appletalk).
1062 *
1063 * 802.2-encapsulated ETHERTYPE_AARP packets are
1064 * SNAP packets with an organization code of
1065 * 0x000000 (encapsulated Ethernet) and a protocol
1066 * type of ETHERTYPE_AARP (Appletalk ARP).
1067 */
1068 if (proto == ETHERTYPE_ATALK)
1069 b1 = gen_snap(0x080007, ETHERTYPE_ATALK,
1070 off_linktype + 2);
1071 else /* proto == ETHERTYPE_AARP */
1072 b1 = gen_snap(0x000000, ETHERTYPE_AARP,
1073 off_linktype + 2);
1074 gen_and(b0, b1);
1075
1076 /*
1077 * Check for Ethernet encapsulation (Ethertalk
1078 * phase 1?); we just check for the Ethernet
1079 * protocol type.
1080 */
1081 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1082
1083 gen_or(b0, b1);
1084 return b1;
1085
1086 default:
1087 if (proto <= ETHERMTU) {
1088 /*
1089 * This is an LLC SAP value, so the frames
1090 * that match would be 802.2 frames.
1091 * Check for the 802.2 protocol type
1092 * in the "Ethernet type" field, and
1093 * then check the DSAP.
1094 */
1095 b0 = gen_cmp(off_linktype, BPF_H,
1096 LINUX_SLL_P_802_2);
1097 b1 = gen_cmp(off_linktype + 2, BPF_B,
1098 (bpf_int32)proto);
1099 gen_and(b0, b1);
1100 return b1;
1101 } else {
1102 /*
1103 * This is an Ethernet type, so compare
1104 * the length/type field with it (if
1105 * the frame is an 802.2 frame, the length
1106 * field will be <= ETHERMTU, and, as
1107 * "proto" is > ETHERMTU, this test
1108 * will fail and the frame won't match,
1109 * which is what we want).
1110 */
1111 return gen_cmp(off_linktype, BPF_H,
1112 (bpf_int32)proto);
1113 }
1114 }
1115 break;
1116
1117 case DLT_SLIP:
1118 case DLT_SLIP_BSDOS:
1119 case DLT_RAW:
1120 /*
1121 * These types don't provide any type field; packets
1122 * are always IP.
1123 *
1124 * XXX - for IPv4, check for a version number of 4, and,
1125 * for IPv6, check for a version number of 6?
1126 */
1127 switch (proto) {
1128
1129 case ETHERTYPE_IP:
1130 #ifdef INET6
1131 case ETHERTYPE_IPV6:
1132 #endif
1133 return gen_true(); /* always true */
1134
1135 default:
1136 return gen_false(); /* always false */
1137 }
1138 break;
1139
1140 case DLT_PPP:
1141 case DLT_PPP_SERIAL:
1142 /*
1143 * We use Ethernet protocol types inside libpcap;
1144 * map them to the corresponding PPP protocol types.
1145 */
1146 switch (proto) {
1147
1148 case ETHERTYPE_IP:
1149 proto = PPP_IP; /* XXX was 0x21 */
1150 break;
1151
1152 #ifdef INET6
1153 case ETHERTYPE_IPV6:
1154 proto = PPP_IPV6;
1155 break;
1156 #endif
1157
1158 case ETHERTYPE_DN:
1159 proto = PPP_DECNET;
1160 break;
1161
1162 case ETHERTYPE_ATALK:
1163 proto = PPP_APPLE;
1164 break;
1165
1166 case ETHERTYPE_NS:
1167 proto = PPP_NS;
1168 break;
1169
1170 case LLCSAP_ISONS:
1171 proto = PPP_OSI;
1172 break;
1173
1174 case LLCSAP_8021D:
1175 /*
1176 * I'm assuming the "Bridging PDU"s that go
1177 * over PPP are Spanning Tree Protocol
1178 * Bridging PDUs.
1179 */
1180 proto = PPP_BRPDU;
1181 break;
1182
1183 case LLCSAP_IPX:
1184 proto = PPP_IPX;
1185 break;
1186 }
1187 break;
1188
1189 case DLT_PPP_BSDOS:
1190 /*
1191 * We use Ethernet protocol types inside libpcap;
1192 * map them to the corresponding PPP protocol types.
1193 */
1194 switch (proto) {
1195
1196 case ETHERTYPE_IP:
1197 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
1198 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
1199 gen_or(b0, b1);
1200 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
1201 gen_or(b1, b0);
1202 return b0;
1203
1204 #ifdef INET6
1205 case ETHERTYPE_IPV6:
1206 proto = PPP_IPV6;
1207 /* more to go? */
1208 break;
1209 #endif
1210
1211 case ETHERTYPE_DN:
1212 proto = PPP_DECNET;
1213 break;
1214
1215 case ETHERTYPE_ATALK:
1216 proto = PPP_APPLE;
1217 break;
1218
1219 case ETHERTYPE_NS:
1220 proto = PPP_NS;
1221 break;
1222
1223 case LLCSAP_ISONS:
1224 proto = PPP_OSI;
1225 break;
1226
1227 case LLCSAP_8021D:
1228 /*
1229 * I'm assuming the "Bridging PDU"s that go
1230 * over PPP are Spanning Tree Protocol
1231 * Bridging PDUs.
1232 */
1233 proto = PPP_BRPDU;
1234 break;
1235
1236 case LLCSAP_IPX:
1237 proto = PPP_IPX;
1238 break;
1239 }
1240 break;
1241
1242 case DLT_NULL:
1243 case DLT_LOOP:
1244 /*
1245 * For DLT_NULL, the link-layer header is a 32-bit
1246 * word containing an AF_ value in *host* byte order.
1247 *
1248 * In addition, if we're reading a saved capture file,
1249 * the host byte order in the capture may not be the
1250 * same as the host byte order on this machine.
1251 *
1252 * For DLT_LOOP, the link-layer header is a 32-bit
1253 * word containing an AF_ value in *network* byte order.
1254 *
1255 * XXX - AF_ values may, unfortunately, be platform-
1256 * dependent; for example, FreeBSD's AF_INET6 is 24
1257 * whilst NetBSD's and OpenBSD's is 26.
1258 *
1259 * This means that, when reading a capture file, just
1260 * checking for our AF_INET6 value won't work if the
1261 * capture file came from another OS.
1262 */
1263 switch (proto) {
1264
1265 case ETHERTYPE_IP:
1266 proto = AF_INET;
1267 break;
1268
1269 #ifdef INET6
1270 case ETHERTYPE_IPV6:
1271 proto = AF_INET6;
1272 break;
1273 #endif
1274
1275 default:
1276 /*
1277 * Not a type on which we support filtering.
1278 * XXX - support those that have AF_ values
1279 * #defined on this platform, at least?
1280 */
1281 return gen_false();
1282 }
1283
1284 if (linktype == DLT_NULL) {
1285 /*
1286 * The AF_ value is in host byte order, but
1287 * the BPF interpreter will convert it to
1288 * network byte order.
1289 *
1290 * If this is a save file, and it's from a
1291 * machine with the opposite byte order to
1292 * ours, we byte-swap the AF_ value.
1293 *
1294 * Then we run it through "htonl()", and
1295 * generate code to compare against the result.
1296 */
1297 if (bpf_pcap->sf.rfile != NULL &&
1298 bpf_pcap->sf.swapped)
1299 proto = SWAPLONG(proto);
1300 proto = htonl(proto);
1301 }
1302 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
1303 }
1304
1305 /*
1306 * All the types that have no encapsulation should either be
1307 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
1308 * all packets are IP packets, or should be handled in some
1309 * special case, if none of them are (if some are and some
1310 * aren't, the lack of encapsulation is a problem, as we'd
1311 * have to find some other way of determining the packet type).
1312 *
1313 * Therefore, if "off_linktype" is -1, there's an error.
1314 */
1315 if (off_linktype == -1)
1316 abort();
1317
1318 /*
1319 * Any type not handled above should always have an Ethernet
1320 * type at an offset of "off_linktype". (PPP is partially
1321 * handled above - the protocol type is mapped from the
1322 * Ethernet and LLC types we use internally to the corresponding
1323 * PPP type - but the PPP type is always specified by a value
1324 * at "off_linktype", so we don't have to do the code generation
1325 * above.)
1326 */
1327 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1328 }
1329
1330 /*
1331 * Check for an LLC SNAP packet with a given organization code and
1332 * protocol type; we check the entire contents of the 802.2 LLC and
1333 * snap headers, checking for DSAP and SSAP of SNAP and a control
1334 * field of 0x03 in the LLC header, and for the specified organization
1335 * code and protocol type in the SNAP header.
1336 */
1337 static struct block *
1338 gen_snap(orgcode, ptype, offset)
1339 bpf_u_int32 orgcode;
1340 bpf_u_int32 ptype;
1341 u_int offset;
1342 {
1343 u_char snapblock[8];
1344
1345 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */
1346 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
1347 snapblock[2] = 0x03; /* control = UI */
1348 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
1349 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */
1350 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */
1351 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */
1352 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */
1353 return gen_bcmp(offset, 8, snapblock);
1354 }
1355
1356 static struct block *
1357 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
1358 bpf_u_int32 addr;
1359 bpf_u_int32 mask;
1360 int dir, proto;
1361 u_int src_off, dst_off;
1362 {
1363 struct block *b0, *b1;
1364 u_int offset;
1365
1366 switch (dir) {
1367
1368 case Q_SRC:
1369 offset = src_off;
1370 break;
1371
1372 case Q_DST:
1373 offset = dst_off;
1374 break;
1375
1376 case Q_AND:
1377 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1378 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1379 gen_and(b0, b1);
1380 return b1;
1381
1382 case Q_OR:
1383 case Q_DEFAULT:
1384 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1385 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1386 gen_or(b0, b1);
1387 return b1;
1388
1389 default:
1390 abort();
1391 }
1392 b0 = gen_linktype(proto);
1393 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
1394 gen_and(b0, b1);
1395 return b1;
1396 }
1397
1398 #ifdef INET6
1399 static struct block *
1400 gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
1401 struct in6_addr *addr;
1402 struct in6_addr *mask;
1403 int dir, proto;
1404 u_int src_off, dst_off;
1405 {
1406 struct block *b0, *b1;
1407 u_int offset;
1408 u_int32_t *a, *m;
1409
1410 switch (dir) {
1411
1412 case Q_SRC:
1413 offset = src_off;
1414 break;
1415
1416 case Q_DST:
1417 offset = dst_off;
1418 break;
1419
1420 case Q_AND:
1421 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1422 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1423 gen_and(b0, b1);
1424 return b1;
1425
1426 case Q_OR:
1427 case Q_DEFAULT:
1428 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1429 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1430 gen_or(b0, b1);
1431 return b1;
1432
1433 default:
1434 abort();
1435 }
1436 /* this order is important */
1437 a = (u_int32_t *)addr;
1438 m = (u_int32_t *)mask;
1439 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
1440 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
1441 gen_and(b0, b1);
1442 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
1443 gen_and(b0, b1);
1444 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
1445 gen_and(b0, b1);
1446 b0 = gen_linktype(proto);
1447 gen_and(b0, b1);
1448 return b1;
1449 }
1450 #endif /*INET6*/
1451
1452 static struct block *
1453 gen_ehostop(eaddr, dir)
1454 register const u_char *eaddr;
1455 register int dir;
1456 {
1457 register struct block *b0, *b1;
1458
1459 switch (dir) {
1460 case Q_SRC:
1461 return gen_bcmp(6, 6, eaddr);
1462
1463 case Q_DST:
1464 return gen_bcmp(0, 6, eaddr);
1465
1466 case Q_AND:
1467 b0 = gen_ehostop(eaddr, Q_SRC);
1468 b1 = gen_ehostop(eaddr, Q_DST);
1469 gen_and(b0, b1);
1470 return b1;
1471
1472 case Q_DEFAULT:
1473 case Q_OR:
1474 b0 = gen_ehostop(eaddr, Q_SRC);
1475 b1 = gen_ehostop(eaddr, Q_DST);
1476 gen_or(b0, b1);
1477 return b1;
1478 }
1479 abort();
1480 /* NOTREACHED */
1481 }
1482
1483 /*
1484 * Like gen_ehostop, but for DLT_FDDI
1485 */
1486 static struct block *
1487 gen_fhostop(eaddr, dir)
1488 register const u_char *eaddr;
1489 register int dir;
1490 {
1491 struct block *b0, *b1;
1492
1493 switch (dir) {
1494 case Q_SRC:
1495 #ifdef PCAP_FDDIPAD
1496 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
1497 #else
1498 return gen_bcmp(6 + 1, 6, eaddr);
1499 #endif
1500
1501 case Q_DST:
1502 #ifdef PCAP_FDDIPAD
1503 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
1504 #else
1505 return gen_bcmp(0 + 1, 6, eaddr);
1506 #endif
1507
1508 case Q_AND:
1509 b0 = gen_fhostop(eaddr, Q_SRC);
1510 b1 = gen_fhostop(eaddr, Q_DST);
1511 gen_and(b0, b1);
1512 return b1;
1513
1514 case Q_DEFAULT:
1515 case Q_OR:
1516 b0 = gen_fhostop(eaddr, Q_SRC);
1517 b1 = gen_fhostop(eaddr, Q_DST);
1518 gen_or(b0, b1);
1519 return b1;
1520 }
1521 abort();
1522 /* NOTREACHED */
1523 }
1524
1525 /*
1526 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
1527 */
1528 static struct block *
1529 gen_thostop(eaddr, dir)
1530 register const u_char *eaddr;
1531 register int dir;
1532 {
1533 register struct block *b0, *b1;
1534
1535 switch (dir) {
1536 case Q_SRC:
1537 return gen_bcmp(8, 6, eaddr);
1538
1539 case Q_DST:
1540 return gen_bcmp(2, 6, eaddr);
1541
1542 case Q_AND:
1543 b0 = gen_thostop(eaddr, Q_SRC);
1544 b1 = gen_thostop(eaddr, Q_DST);
1545 gen_and(b0, b1);
1546 return b1;
1547
1548 case Q_DEFAULT:
1549 case Q_OR:
1550 b0 = gen_thostop(eaddr, Q_SRC);
1551 b1 = gen_thostop(eaddr, Q_DST);
1552 gen_or(b0, b1);
1553 return b1;
1554 }
1555 abort();
1556 /* NOTREACHED */
1557 }
1558
1559 /*
1560 * This is quite tricky because there may be pad bytes in front of the
1561 * DECNET header, and then there are two possible data packet formats that
1562 * carry both src and dst addresses, plus 5 packet types in a format that
1563 * carries only the src node, plus 2 types that use a different format and
1564 * also carry just the src node.
1565 *
1566 * Yuck.
1567 *
1568 * Instead of doing those all right, we just look for data packets with
1569 * 0 or 1 bytes of padding. If you want to look at other packets, that
1570 * will require a lot more hacking.
1571 *
1572 * To add support for filtering on DECNET "areas" (network numbers)
1573 * one would want to add a "mask" argument to this routine. That would
1574 * make the filter even more inefficient, although one could be clever
1575 * and not generate masking instructions if the mask is 0xFFFF.
1576 */
1577 static struct block *
1578 gen_dnhostop(addr, dir, base_off)
1579 bpf_u_int32 addr;
1580 int dir;
1581 u_int base_off;
1582 {
1583 struct block *b0, *b1, *b2, *tmp;
1584 u_int offset_lh; /* offset if long header is received */
1585 u_int offset_sh; /* offset if short header is received */
1586
1587 switch (dir) {
1588
1589 case Q_DST:
1590 offset_sh = 1; /* follows flags */
1591 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */
1592 break;
1593
1594 case Q_SRC:
1595 offset_sh = 3; /* follows flags, dstnode */
1596 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
1597 break;
1598
1599 case Q_AND:
1600 /* Inefficient because we do our Calvinball dance twice */
1601 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1602 b1 = gen_dnhostop(addr, Q_DST, base_off);
1603 gen_and(b0, b1);
1604 return b1;
1605
1606 case Q_OR:
1607 case Q_DEFAULT:
1608 /* Inefficient because we do our Calvinball dance twice */
1609 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1610 b1 = gen_dnhostop(addr, Q_DST, base_off);
1611 gen_or(b0, b1);
1612 return b1;
1613
1614 case Q_ISO:
1615 bpf_error("ISO host filtering not implemented");
1616
1617 default:
1618 abort();
1619 }
1620 b0 = gen_linktype(ETHERTYPE_DN);
1621 /* Check for pad = 1, long header case */
1622 tmp = gen_mcmp(base_off + 2, BPF_H,
1623 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
1624 b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
1625 BPF_H, (bpf_int32)ntohs(addr));
1626 gen_and(tmp, b1);
1627 /* Check for pad = 0, long header case */
1628 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
1629 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
1630 gen_and(tmp, b2);
1631 gen_or(b2, b1);
1632 /* Check for pad = 1, short header case */
1633 tmp = gen_mcmp(base_off + 2, BPF_H,
1634 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
1635 b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
1636 BPF_H, (bpf_int32)ntohs(addr));
1637 gen_and(tmp, b2);
1638 gen_or(b2, b1);
1639 /* Check for pad = 0, short header case */
1640 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
1641 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
1642 gen_and(tmp, b2);
1643 gen_or(b2, b1);
1644
1645 /* Combine with test for linktype */
1646 gen_and(b0, b1);
1647 return b1;
1648 }
1649
1650 static struct block *
1651 gen_host(addr, mask, proto, dir)
1652 bpf_u_int32 addr;
1653 bpf_u_int32 mask;
1654 int proto;
1655 int dir;
1656 {
1657 struct block *b0, *b1;
1658
1659 switch (proto) {
1660
1661 case Q_DEFAULT:
1662 b0 = gen_host(addr, mask, Q_IP, dir);
1663 if (off_linktype != -1) {
1664 b1 = gen_host(addr, mask, Q_ARP, dir);
1665 gen_or(b0, b1);
1666 b0 = gen_host(addr, mask, Q_RARP, dir);
1667 gen_or(b1, b0);
1668 }
1669 return b0;
1670
1671 case Q_IP:
1672 return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
1673 off_nl + 12, off_nl + 16);
1674
1675 case Q_RARP:
1676 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
1677 off_nl + 14, off_nl + 24);
1678
1679 case Q_ARP:
1680 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
1681 off_nl + 14, off_nl + 24);
1682
1683 case Q_TCP:
1684 bpf_error("'tcp' modifier applied to host");
1685
1686 case Q_UDP:
1687 bpf_error("'udp' modifier applied to host");
1688
1689 case Q_ICMP:
1690 bpf_error("'icmp' modifier applied to host");
1691
1692 case Q_IGMP:
1693 bpf_error("'igmp' modifier applied to host");
1694
1695 case Q_IGRP:
1696 bpf_error("'igrp' modifier applied to host");
1697
1698 case Q_PIM:
1699 bpf_error("'pim' modifier applied to host");
1700
1701 case Q_VRRP:
1702 bpf_error("'vrrp' modifier applied to host");
1703
1704 case Q_ATALK:
1705 bpf_error("ATALK host filtering not implemented");
1706
1707 case Q_AARP:
1708 bpf_error("AARP host filtering not implemented");
1709
1710 case Q_DECNET:
1711 return gen_dnhostop(addr, dir, off_nl);
1712
1713 case Q_SCA:
1714 bpf_error("SCA host filtering not implemented");
1715
1716 case Q_LAT:
1717 bpf_error("LAT host filtering not implemented");
1718
1719 case Q_MOPDL:
1720 bpf_error("MOPDL host filtering not implemented");
1721
1722 case Q_MOPRC:
1723 bpf_error("MOPRC host filtering not implemented");
1724
1725 #ifdef INET6
1726 case Q_IPV6:
1727 bpf_error("'ip6' modifier applied to ip host");
1728
1729 case Q_ICMPV6:
1730 bpf_error("'icmp6' modifier applied to host");
1731 #endif /* INET6 */
1732
1733 case Q_AH:
1734 bpf_error("'ah' modifier applied to host");
1735
1736 case Q_ESP:
1737 bpf_error("'esp' modifier applied to host");
1738
1739 case Q_ISO:
1740 bpf_error("ISO host filtering not implemented");
1741
1742 case Q_ESIS:
1743 bpf_error("'esis' modifier applied to host");
1744
1745 case Q_ISIS:
1746 bpf_error("'isis' modifier applied to host");
1747
1748 case Q_CLNP:
1749 bpf_error("'clnp' modifier applied to host");
1750
1751 case Q_STP:
1752 bpf_error("'stp' modifier applied to host");
1753
1754 case Q_IPX:
1755 bpf_error("IPX host filtering not implemented");
1756
1757 case Q_NETBEUI:
1758 bpf_error("'netbeui' modifier applied to host");
1759
1760 default:
1761 abort();
1762 }
1763 /* NOTREACHED */
1764 }
1765
1766 #ifdef INET6
1767 static struct block *
1768 gen_host6(addr, mask, proto, dir)
1769 struct in6_addr *addr;
1770 struct in6_addr *mask;
1771 int proto;
1772 int dir;
1773 {
1774 switch (proto) {
1775
1776 case Q_DEFAULT:
1777 return gen_host6(addr, mask, Q_IPV6, dir);
1778
1779 case Q_IP:
1780 bpf_error("'ip' modifier applied to ip6 host");
1781
1782 case Q_RARP:
1783 bpf_error("'rarp' modifier applied to ip6 host");
1784
1785 case Q_ARP:
1786 bpf_error("'arp' modifier applied to ip6 host");
1787
1788 case Q_TCP:
1789 bpf_error("'tcp' modifier applied to host");
1790
1791 case Q_UDP:
1792 bpf_error("'udp' modifier applied to host");
1793
1794 case Q_ICMP:
1795 bpf_error("'icmp' modifier applied to host");
1796
1797 case Q_IGMP:
1798 bpf_error("'igmp' modifier applied to host");
1799
1800 case Q_IGRP:
1801 bpf_error("'igrp' modifier applied to host");
1802
1803 case Q_PIM:
1804 bpf_error("'pim' modifier applied to host");
1805
1806 case Q_VRRP:
1807 bpf_error("'vrrp' modifier applied to host");
1808
1809 case Q_ATALK:
1810 bpf_error("ATALK host filtering not implemented");
1811
1812 case Q_AARP:
1813 bpf_error("AARP host filtering not implemented");
1814
1815 case Q_DECNET:
1816 bpf_error("'decnet' modifier applied to ip6 host");
1817
1818 case Q_SCA:
1819 bpf_error("SCA host filtering not implemented");
1820
1821 case Q_LAT:
1822 bpf_error("LAT host filtering not implemented");
1823
1824 case Q_MOPDL:
1825 bpf_error("MOPDL host filtering not implemented");
1826
1827 case Q_MOPRC:
1828 bpf_error("MOPRC host filtering not implemented");
1829
1830 case Q_IPV6:
1831 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
1832 off_nl + 8, off_nl + 24);
1833
1834 case Q_ICMPV6:
1835 bpf_error("'icmp6' modifier applied to host");
1836
1837 case Q_AH:
1838 bpf_error("'ah' modifier applied to host");
1839
1840 case Q_ESP:
1841 bpf_error("'esp' modifier applied to host");
1842
1843 case Q_ISO:
1844 bpf_error("ISO host filtering not implemented");
1845
1846 case Q_ESIS:
1847 bpf_error("'esis' modifier applied to host");
1848
1849 case Q_ISIS:
1850 bpf_error("'isis' modifier applied to host");
1851
1852 case Q_CLNP:
1853 bpf_error("'clnp' modifier applied to host");
1854
1855 case Q_STP:
1856 bpf_error("'stp' modifier applied to host");
1857
1858 case Q_IPX:
1859 bpf_error("IPX host filtering not implemented");
1860
1861 case Q_NETBEUI:
1862 bpf_error("'netbeui' modifier applied to host");
1863
1864 default:
1865 abort();
1866 }
1867 /* NOTREACHED */
1868 }
1869 #endif /*INET6*/
1870
1871 #ifndef INET6
1872 static struct block *
1873 gen_gateway(eaddr, alist, proto, dir)
1874 const u_char *eaddr;
1875 bpf_u_int32 **alist;
1876 int proto;
1877 int dir;
1878 {
1879 struct block *b0, *b1, *tmp;
1880
1881 if (dir != 0)
1882 bpf_error("direction applied to 'gateway'");
1883
1884 switch (proto) {
1885 case Q_DEFAULT:
1886 case Q_IP:
1887 case Q_ARP:
1888 case Q_RARP:
1889 if (linktype == DLT_EN10MB)
1890 b0 = gen_ehostop(eaddr, Q_OR);
1891 else if (linktype == DLT_FDDI)
1892 b0 = gen_fhostop(eaddr, Q_OR);
1893 else if (linktype == DLT_IEEE802)
1894 b0 = gen_thostop(eaddr, Q_OR);
1895 else
1896 bpf_error(
1897 "'gateway' supported only on ethernet, FDDI or token ring");
1898
1899 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
1900 while (*alist) {
1901 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR);
1902 gen_or(b1, tmp);
1903 b1 = tmp;
1904 }
1905 gen_not(b1);
1906 gen_and(b0, b1);
1907 return b1;
1908 }
1909 bpf_error("illegal modifier of 'gateway'");
1910 /* NOTREACHED */
1911 }
1912 #endif
1913
1914 struct block *
1915 gen_proto_abbrev(proto)
1916 int proto;
1917 {
1918 #ifdef INET6
1919 struct block *b0;
1920 #endif
1921 struct block *b1;
1922
1923 switch (proto) {
1924
1925 case Q_TCP:
1926 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
1927 #ifdef INET6
1928 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
1929 gen_or(b0, b1);
1930 #endif
1931 break;
1932
1933 case Q_UDP:
1934 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT);
1935 #ifdef INET6
1936 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
1937 gen_or(b0, b1);
1938 #endif
1939 break;
1940
1941 case Q_ICMP:
1942 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT);
1943 break;
1944
1945 #ifndef IPPROTO_IGMP
1946 #define IPPROTO_IGMP 2
1947 #endif
1948
1949 case Q_IGMP:
1950 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT);
1951 break;
1952
1953 #ifndef IPPROTO_IGRP
1954 #define IPPROTO_IGRP 9
1955 #endif
1956 case Q_IGRP:
1957 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT);
1958 break;
1959
1960 #ifndef IPPROTO_PIM
1961 #define IPPROTO_PIM 103
1962 #endif
1963
1964 case Q_PIM:
1965 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT);
1966 #ifdef INET6
1967 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
1968 gen_or(b0, b1);
1969 #endif
1970 break;
1971
1972 #ifndef IPPROTO_VRRP
1973 #define IPPROTO_VRRP 112
1974 #endif
1975
1976 case Q_VRRP:
1977 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT);
1978 break;
1979
1980 case Q_IP:
1981 b1 = gen_linktype(ETHERTYPE_IP);
1982 break;
1983
1984 case Q_ARP:
1985 b1 = gen_linktype(ETHERTYPE_ARP);
1986 break;
1987
1988 case Q_RARP:
1989 b1 = gen_linktype(ETHERTYPE_REVARP);
1990 break;
1991
1992 case Q_LINK:
1993 bpf_error("link layer applied in wrong context");
1994
1995 case Q_ATALK:
1996 b1 = gen_linktype(ETHERTYPE_ATALK);
1997 break;
1998
1999 case Q_AARP:
2000 b1 = gen_linktype(ETHERTYPE_AARP);
2001 break;
2002
2003 case Q_DECNET:
2004 b1 = gen_linktype(ETHERTYPE_DN);
2005 break;
2006
2007 case Q_SCA:
2008 b1 = gen_linktype(ETHERTYPE_SCA);
2009 break;
2010
2011 case Q_LAT:
2012 b1 = gen_linktype(ETHERTYPE_LAT);
2013 break;
2014
2015 case Q_MOPDL:
2016 b1 = gen_linktype(ETHERTYPE_MOPDL);
2017 break;
2018
2019 case Q_MOPRC:
2020 b1 = gen_linktype(ETHERTYPE_MOPRC);
2021 break;
2022
2023 #ifdef INET6
2024 case Q_IPV6:
2025 b1 = gen_linktype(ETHERTYPE_IPV6);
2026 break;
2027
2028 #ifndef IPPROTO_ICMPV6
2029 #define IPPROTO_ICMPV6 58
2030 #endif
2031 case Q_ICMPV6:
2032 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
2033 break;
2034 #endif /* INET6 */
2035
2036 #ifndef IPPROTO_AH
2037 #define IPPROTO_AH 51
2038 #endif
2039 case Q_AH:
2040 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT);
2041 #ifdef INET6
2042 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT);
2043 gen_or(b0, b1);
2044 #endif
2045 break;
2046
2047 #ifndef IPPROTO_ESP
2048 #define IPPROTO_ESP 50
2049 #endif
2050 case Q_ESP:
2051 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT);
2052 #ifdef INET6
2053 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
2054 gen_or(b0, b1);
2055 #endif
2056 break;
2057
2058 case Q_ISO:
2059 b1 = gen_linktype(LLCSAP_ISONS);
2060 break;
2061
2062 case Q_ESIS:
2063 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT);
2064 break;
2065
2066 case Q_ISIS:
2067 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
2068 break;
2069
2070 case Q_CLNP:
2071 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT);
2072 break;
2073
2074 case Q_STP:
2075 b1 = gen_linktype(LLCSAP_8021D);
2076 break;
2077
2078 case Q_IPX:
2079 b1 = gen_linktype(LLCSAP_IPX);
2080 break;
2081
2082 case Q_NETBEUI:
2083 b1 = gen_linktype(LLCSAP_NETBEUI);
2084 break;
2085
2086 default:
2087 abort();
2088 }
2089 return b1;
2090 }
2091
2092 static struct block *
2093 gen_ipfrag()
2094 {
2095 struct slist *s;
2096 struct block *b;
2097
2098 /* not ip frag */
2099 s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
2100 s->s.k = off_nl + 6;
2101 b = new_block(JMP(BPF_JSET));
2102 b->s.k = 0x1fff;
2103 b->stmts = s;
2104 gen_not(b);
2105
2106 return b;
2107 }
2108
2109 static struct block *
2110 gen_portatom(off, v)
2111 int off;
2112 bpf_int32 v;
2113 {
2114 struct slist *s;
2115 struct block *b;
2116
2117 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2118 s->s.k = off_nl;
2119
2120 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
2121 s->next->s.k = off_nl + off;
2122
2123 b = new_block(JMP(BPF_JEQ));
2124 b->stmts = s;
2125 b->s.k = v;
2126
2127 return b;
2128 }
2129
2130 #ifdef INET6
2131 static struct block *
2132 gen_portatom6(off, v)
2133 int off;
2134 bpf_int32 v;
2135 {
2136 return gen_cmp(off_nl + 40 + off, BPF_H, v);
2137 }
2138 #endif/*INET6*/
2139
2140 struct block *
2141 gen_portop(port, proto, dir)
2142 int port, proto, dir;
2143 {
2144 struct block *b0, *b1, *tmp;
2145
2146 /* ip proto 'proto' */
2147 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
2148 b0 = gen_ipfrag();
2149 gen_and(tmp, b0);
2150
2151 switch (dir) {
2152 case Q_SRC:
2153 b1 = gen_portatom(0, (bpf_int32)port);
2154 break;
2155
2156 case Q_DST:
2157 b1 = gen_portatom(2, (bpf_int32)port);
2158 break;
2159
2160 case Q_OR:
2161 case Q_DEFAULT:
2162 tmp = gen_portatom(0, (bpf_int32)port);
2163 b1 = gen_portatom(2, (bpf_int32)port);
2164 gen_or(tmp, b1);
2165 break;
2166
2167 case Q_AND:
2168 tmp = gen_portatom(0, (bpf_int32)port);
2169 b1 = gen_portatom(2, (bpf_int32)port);
2170 gen_and(tmp, b1);
2171 break;
2172
2173 default:
2174 abort();
2175 }
2176 gen_and(b0, b1);
2177
2178 return b1;
2179 }
2180
2181 static struct block *
2182 gen_port(port, ip_proto, dir)
2183 int port;
2184 int ip_proto;
2185 int dir;
2186 {
2187 struct block *b0, *b1, *tmp;
2188
2189 /* ether proto ip */
2190 b0 = gen_linktype(ETHERTYPE_IP);
2191
2192 switch (ip_proto) {
2193 case IPPROTO_UDP:
2194 case IPPROTO_TCP:
2195 b1 = gen_portop(port, ip_proto, dir);
2196 break;
2197
2198 case PROTO_UNDEF:
2199 tmp = gen_portop(port, IPPROTO_TCP, dir);
2200 b1 = gen_portop(port, IPPROTO_UDP, dir);
2201 gen_or(tmp, b1);
2202 break;
2203
2204 default:
2205 abort();
2206 }
2207 gen_and(b0, b1);
2208 return b1;
2209 }
2210
2211 #ifdef INET6
2212 struct block *
2213 gen_portop6(port, proto, dir)
2214 int port, proto, dir;
2215 {
2216 struct block *b0, *b1, *tmp;
2217
2218 /* ip proto 'proto' */
2219 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
2220
2221 switch (dir) {
2222 case Q_SRC:
2223 b1 = gen_portatom6(0, (bpf_int32)port);
2224 break;
2225
2226 case Q_DST:
2227 b1 = gen_portatom6(2, (bpf_int32)port);
2228 break;
2229
2230 case Q_OR:
2231 case Q_DEFAULT:
2232 tmp = gen_portatom6(0, (bpf_int32)port);
2233 b1 = gen_portatom6(2, (bpf_int32)port);
2234 gen_or(tmp, b1);
2235 break;
2236
2237 case Q_AND:
2238 tmp = gen_portatom6(0, (bpf_int32)port);
2239 b1 = gen_portatom6(2, (bpf_int32)port);
2240 gen_and(tmp, b1);
2241 break;
2242
2243 default:
2244 abort();
2245 }
2246 gen_and(b0, b1);
2247
2248 return b1;
2249 }
2250
2251 static struct block *
2252 gen_port6(port, ip_proto, dir)
2253 int port;
2254 int ip_proto;
2255 int dir;
2256 {
2257 struct block *b0, *b1, *tmp;
2258
2259 /* ether proto ip */
2260 b0 = gen_linktype(ETHERTYPE_IPV6);
2261
2262 switch (ip_proto) {
2263 case IPPROTO_UDP:
2264 case IPPROTO_TCP:
2265 b1 = gen_portop6(port, ip_proto, dir);
2266 break;
2267
2268 case PROTO_UNDEF:
2269 tmp = gen_portop6(port, IPPROTO_TCP, dir);
2270 b1 = gen_portop6(port, IPPROTO_UDP, dir);
2271 gen_or(tmp, b1);
2272 break;
2273
2274 default:
2275 abort();
2276 }
2277 gen_and(b0, b1);
2278 return b1;
2279 }
2280 #endif /* INET6 */
2281
2282 static int
2283 lookup_proto(name, proto)
2284 register const char *name;
2285 register int proto;
2286 {
2287 register int v;
2288
2289 switch (proto) {
2290
2291 case Q_DEFAULT:
2292 case Q_IP:
2293 v = pcap_nametoproto(name);
2294 if (v == PROTO_UNDEF)
2295 bpf_error("unknown ip proto '%s'", name);
2296 break;
2297
2298 case Q_LINK:
2299 /* XXX should look up h/w protocol type based on linktype */
2300 v = pcap_nametoeproto(name);
2301 if (v == PROTO_UNDEF)
2302 bpf_error("unknown ether proto '%s'", name);
2303 break;
2304
2305 case Q_ISO:
2306 if (strcmp(name, "esis") == 0)
2307 v = ISO9542_ESIS;
2308 else if (strcmp(name, "isis") == 0)
2309 v = ISO10589_ISIS;
2310 else if (strcmp(name, "clnp") == 0)
2311 v = ISO8473_CLNP;
2312 else
2313 bpf_error("unknown osi proto '%s'", name);
2314 break;
2315
2316 default:
2317 v = PROTO_UNDEF;
2318 break;
2319 }
2320 return v;
2321 }
2322
2323 #if 0
2324 struct stmt *
2325 gen_joinsp(s, n)
2326 struct stmt **s;
2327 int n;
2328 {
2329 return NULL;
2330 }
2331 #endif
2332
2333 static struct block *
2334 gen_protochain(v, proto, dir)
2335 int v;
2336 int proto;
2337 int dir;
2338 {
2339 #ifdef NO_PROTOCHAIN
2340 return gen_proto(v, proto, dir);
2341 #else
2342 struct block *b0, *b;
2343 struct slist *s[100];
2344 int fix2, fix3, fix4, fix5;
2345 int ahcheck, again, end;
2346 int i, max;
2347 int reg2 = alloc_reg();
2348
2349 memset(s, 0, sizeof(s));
2350 fix2 = fix3 = fix4 = fix5 = 0;
2351
2352 switch (proto) {
2353 case Q_IP:
2354 case Q_IPV6:
2355 break;
2356 case Q_DEFAULT:
2357 b0 = gen_protochain(v, Q_IP, dir);
2358 b = gen_protochain(v, Q_IPV6, dir);
2359 gen_or(b0, b);
2360 return b;
2361 default:
2362 bpf_error("bad protocol applied for 'protochain'");
2363 /*NOTREACHED*/
2364 }
2365
2366 no_optimize = 1; /*this code is not compatible with optimzer yet */
2367
2368 /*
2369 * s[0] is a dummy entry to protect other BPF insn from damaged
2370 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
2371 * hard to find interdependency made by jump table fixup.
2372 */
2373 i = 0;
2374 s[i] = new_stmt(0); /*dummy*/
2375 i++;
2376
2377 switch (proto) {
2378 case Q_IP:
2379 b0 = gen_linktype(ETHERTYPE_IP);
2380
2381 /* A = ip->ip_p */
2382 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2383 s[i]->s.k = off_nl + 9;
2384 i++;
2385 /* X = ip->ip_hl << 2 */
2386 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2387 s[i]->s.k = off_nl;
2388 i++;
2389 break;
2390 #ifdef INET6
2391 case Q_IPV6:
2392 b0 = gen_linktype(ETHERTYPE_IPV6);
2393
2394 /* A = ip6->ip_nxt */
2395 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2396 s[i]->s.k = off_nl + 6;
2397 i++;
2398 /* X = sizeof(struct ip6_hdr) */
2399 s[i] = new_stmt(BPF_LDX|BPF_IMM);
2400 s[i]->s.k = 40;
2401 i++;
2402 break;
2403 #endif
2404 default:
2405 bpf_error("unsupported proto to gen_protochain");
2406 /*NOTREACHED*/
2407 }
2408
2409 /* again: if (A == v) goto end; else fall through; */
2410 again = i;
2411 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2412 s[i]->s.k = v;
2413 s[i]->s.jt = NULL; /*later*/
2414 s[i]->s.jf = NULL; /*update in next stmt*/
2415 fix5 = i;
2416 i++;
2417
2418 #ifndef IPPROTO_NONE
2419 #define IPPROTO_NONE 59
2420 #endif
2421 /* if (A == IPPROTO_NONE) goto end */
2422 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2423 s[i]->s.jt = NULL; /*later*/
2424 s[i]->s.jf = NULL; /*update in next stmt*/
2425 s[i]->s.k = IPPROTO_NONE;
2426 s[fix5]->s.jf = s[i];
2427 fix2 = i;
2428 i++;
2429
2430 #ifdef INET6
2431 if (proto == Q_IPV6) {
2432 int v6start, v6end, v6advance, j;
2433
2434 v6start = i;
2435 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
2436 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2437 s[i]->s.jt = NULL; /*later*/
2438 s[i]->s.jf = NULL; /*update in next stmt*/
2439 s[i]->s.k = IPPROTO_HOPOPTS;
2440 s[fix2]->s.jf = s[i];
2441 i++;
2442 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
2443 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2444 s[i]->s.jt = NULL; /*later*/
2445 s[i]->s.jf = NULL; /*update in next stmt*/
2446 s[i]->s.k = IPPROTO_DSTOPTS;
2447 i++;
2448 /* if (A == IPPROTO_ROUTING) goto v6advance */
2449 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2450 s[i]->s.jt = NULL; /*later*/
2451 s[i]->s.jf = NULL; /*update in next stmt*/
2452 s[i]->s.k = IPPROTO_ROUTING;
2453 i++;
2454 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
2455 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2456 s[i]->s.jt = NULL; /*later*/
2457 s[i]->s.jf = NULL; /*later*/
2458 s[i]->s.k = IPPROTO_FRAGMENT;
2459 fix3 = i;
2460 v6end = i;
2461 i++;
2462
2463 /* v6advance: */
2464 v6advance = i;
2465
2466 /*
2467 * in short,
2468 * A = P[X];
2469 * X = X + (P[X + 1] + 1) * 8;
2470 */
2471 /* A = X */
2472 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2473 i++;
2474 /* A = P[X + packet head] */
2475 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2476 s[i]->s.k = off_nl;
2477 i++;
2478 /* MEM[reg2] = A */
2479 s[i] = new_stmt(BPF_ST);
2480 s[i]->s.k = reg2;
2481 i++;
2482 /* A = X */
2483 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2484 i++;
2485 /* A += 1 */
2486 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2487 s[i]->s.k = 1;
2488 i++;
2489 /* X = A */
2490 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2491 i++;
2492 /* A = P[X + packet head]; */
2493 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2494 s[i]->s.k = off_nl;
2495 i++;
2496 /* A += 1 */
2497 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2498 s[i]->s.k = 1;
2499 i++;
2500 /* A *= 8 */
2501 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2502 s[i]->s.k = 8;
2503 i++;
2504 /* X = A; */
2505 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2506 i++;
2507 /* A = MEM[reg2] */
2508 s[i] = new_stmt(BPF_LD|BPF_MEM);
2509 s[i]->s.k = reg2;
2510 i++;
2511
2512 /* goto again; (must use BPF_JA for backward jump) */
2513 s[i] = new_stmt(BPF_JMP|BPF_JA);
2514 s[i]->s.k = again - i - 1;
2515 s[i - 1]->s.jf = s[i];
2516 i++;
2517
2518 /* fixup */
2519 for (j = v6start; j <= v6end; j++)
2520 s[j]->s.jt = s[v6advance];
2521 } else
2522 #endif
2523 {
2524 /* nop */
2525 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2526 s[i]->s.k = 0;
2527 s[fix2]->s.jf = s[i];
2528 i++;
2529 }
2530
2531 /* ahcheck: */
2532 ahcheck = i;
2533 /* if (A == IPPROTO_AH) then fall through; else goto end; */
2534 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2535 s[i]->s.jt = NULL; /*later*/
2536 s[i]->s.jf = NULL; /*later*/
2537 s[i]->s.k = IPPROTO_AH;
2538 if (fix3)
2539 s[fix3]->s.jf = s[ahcheck];
2540 fix4 = i;
2541 i++;
2542
2543 /*
2544 * in short,
2545 * A = P[X];
2546 * X = X + (P[X + 1] + 2) * 4;
2547 */
2548 /* A = X */
2549 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2550 i++;
2551 /* A = P[X + packet head]; */
2552 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2553 s[i]->s.k = off_nl;
2554 i++;
2555 /* MEM[reg2] = A */
2556 s[i] = new_stmt(BPF_ST);
2557 s[i]->s.k = reg2;
2558 i++;
2559 /* A = X */
2560 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2561 i++;
2562 /* A += 1 */
2563 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2564 s[i]->s.k = 1;
2565 i++;
2566 /* X = A */
2567 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2568 i++;
2569 /* A = P[X + packet head] */
2570 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2571 s[i]->s.k = off_nl;
2572 i++;
2573 /* A += 2 */
2574 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2575 s[i]->s.k = 2;
2576 i++;
2577 /* A *= 4 */
2578 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2579 s[i]->s.k = 4;
2580 i++;
2581 /* X = A; */
2582 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2583 i++;
2584 /* A = MEM[reg2] */
2585 s[i] = new_stmt(BPF_LD|BPF_MEM);
2586 s[i]->s.k = reg2;
2587 i++;
2588
2589 /* goto again; (must use BPF_JA for backward jump) */
2590 s[i] = new_stmt(BPF_JMP|BPF_JA);
2591 s[i]->s.k = again - i - 1;
2592 i++;
2593
2594 /* end: nop */
2595 end = i;
2596 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2597 s[i]->s.k = 0;
2598 s[fix2]->s.jt = s[end];
2599 s[fix4]->s.jf = s[end];
2600 s[fix5]->s.jt = s[end];
2601 i++;
2602
2603 /*
2604 * make slist chain
2605 */
2606 max = i;
2607 for (i = 0; i < max - 1; i++)
2608 s[i]->next = s[i + 1];
2609 s[max - 1]->next = NULL;
2610
2611 /*
2612 * emit final check
2613 */
2614 b = new_block(JMP(BPF_JEQ));
2615 b->stmts = s[1]; /*remember, s[0] is dummy*/
2616 b->s.k = v;
2617
2618 free_reg(reg2);
2619
2620 gen_and(b0, b);
2621 return b;
2622 #endif
2623 }
2624
2625 static struct block *
2626 gen_proto(v, proto, dir)
2627 int v;
2628 int proto;
2629 int dir;
2630 {
2631 struct block *b0, *b1;
2632
2633 if (dir != Q_DEFAULT)
2634 bpf_error("direction applied to 'proto'");
2635
2636 switch (proto) {
2637 case Q_DEFAULT:
2638 #ifdef INET6
2639 b0 = gen_proto(v, Q_IP, dir);
2640 b1 = gen_proto(v, Q_IPV6, dir);
2641 gen_or(b0, b1);
2642 return b1;
2643 #else
2644 /*FALLTHROUGH*/
2645 #endif
2646 case Q_IP:
2647 b0 = gen_linktype(ETHERTYPE_IP);
2648 #ifndef CHASE_CHAIN
2649 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
2650 #else
2651 b1 = gen_protochain(v, Q_IP);
2652 #endif
2653 gen_and(b0, b1);
2654 return b1;
2655
2656 case Q_ISO:
2657 b0 = gen_linktype(LLCSAP_ISONS);
2658 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v);
2659 gen_and(b0, b1);
2660 return b1;
2661
2662 case Q_ARP:
2663 bpf_error("arp does not encapsulate another protocol");
2664 /* NOTREACHED */
2665
2666 case Q_RARP:
2667 bpf_error("rarp does not encapsulate another protocol");
2668 /* NOTREACHED */
2669
2670 case Q_ATALK:
2671 bpf_error("atalk encapsulation is not specifiable");
2672 /* NOTREACHED */
2673
2674 case Q_DECNET:
2675 bpf_error("decnet encapsulation is not specifiable");
2676 /* NOTREACHED */
2677
2678 case Q_SCA:
2679 bpf_error("sca does not encapsulate another protocol");
2680 /* NOTREACHED */
2681
2682 case Q_LAT:
2683 bpf_error("lat does not encapsulate another protocol");
2684 /* NOTREACHED */
2685
2686 case Q_MOPRC:
2687 bpf_error("moprc does not encapsulate another protocol");
2688 /* NOTREACHED */
2689
2690 case Q_MOPDL:
2691 bpf_error("mopdl does not encapsulate another protocol");
2692 /* NOTREACHED */
2693
2694 case Q_LINK:
2695 return gen_linktype(v);
2696
2697 case Q_UDP:
2698 bpf_error("'udp proto' is bogus");
2699 /* NOTREACHED */
2700
2701 case Q_TCP:
2702 bpf_error("'tcp proto' is bogus");
2703 /* NOTREACHED */
2704
2705 case Q_ICMP:
2706 bpf_error("'icmp proto' is bogus");
2707 /* NOTREACHED */
2708
2709 case Q_IGMP:
2710 bpf_error("'igmp proto' is bogus");
2711 /* NOTREACHED */
2712
2713 case Q_IGRP:
2714 bpf_error("'igrp proto' is bogus");
2715 /* NOTREACHED */
2716
2717 case Q_PIM:
2718 bpf_error("'pim proto' is bogus");
2719 /* NOTREACHED */
2720
2721 case Q_VRRP:
2722 bpf_error("'vrrp proto' is bogus");
2723 /* NOTREACHED */
2724
2725 #ifdef INET6
2726 case Q_IPV6:
2727 b0 = gen_linktype(ETHERTYPE_IPV6);
2728 #ifndef CHASE_CHAIN
2729 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
2730 #else
2731 b1 = gen_protochain(v, Q_IPV6);
2732 #endif
2733 gen_and(b0, b1);
2734 return b1;
2735
2736 case Q_ICMPV6:
2737 bpf_error("'icmp6 proto' is bogus");
2738 #endif /* INET6 */
2739
2740 case Q_AH:
2741 bpf_error("'ah proto' is bogus");
2742
2743 case Q_ESP:
2744 bpf_error("'ah proto' is bogus");
2745
2746 case Q_STP:
2747 bpf_error("'stp proto' is bogus");
2748
2749 case Q_IPX:
2750 bpf_error("'ipx proto' is bogus");
2751
2752 case Q_NETBEUI:
2753 bpf_error("'netbeui proto' is bogus");
2754
2755 default:
2756 abort();
2757 /* NOTREACHED */
2758 }
2759 /* NOTREACHED */
2760 }
2761
2762 struct block *
2763 gen_scode(name, q)
2764 register const char *name;
2765 struct qual q;
2766 {
2767 int proto = q.proto;
2768 int dir = q.dir;
2769 int tproto;
2770 u_char *eaddr;
2771 bpf_u_int32 mask, addr;
2772 #ifndef INET6
2773 bpf_u_int32 **alist;
2774 #else
2775 int tproto6;
2776 struct sockaddr_in *sin;
2777 struct sockaddr_in6 *sin6;
2778 struct addrinfo *res, *res0;
2779 struct in6_addr mask128;
2780 #endif /*INET6*/
2781 struct block *b, *tmp;
2782 int port, real_proto;
2783
2784 switch (q.addr) {
2785
2786 case Q_NET:
2787 addr = pcap_nametonetaddr(name);
2788 if (addr == 0)
2789 bpf_error("unknown network '%s'", name);
2790 /* Left justify network addr and calculate its network mask */
2791 mask = 0xffffffff;
2792 while (addr && (addr & 0xff000000) == 0) {
2793 addr <<= 8;
2794 mask <<= 8;
2795 }
2796 return gen_host(addr, mask, proto, dir);
2797
2798 case Q_DEFAULT:
2799 case Q_HOST:
2800 if (proto == Q_LINK) {
2801 switch (linktype) {
2802
2803 case DLT_EN10MB:
2804 eaddr = pcap_ether_hostton(name);
2805 if (eaddr == NULL)
2806 bpf_error(
2807 "unknown ether host '%s'", name);
2808 return gen_ehostop(eaddr, dir);
2809
2810 case DLT_FDDI:
2811 eaddr = pcap_ether_hostton(name);
2812 if (eaddr == NULL)
2813 bpf_error(
2814 "unknown FDDI host '%s'", name);
2815 return gen_fhostop(eaddr, dir);
2816
2817 case DLT_IEEE802:
2818 eaddr = pcap_ether_hostton(name);
2819 if (eaddr == NULL)
2820 bpf_error(
2821 "unknown token ring host '%s'", name);
2822 return gen_thostop(eaddr, dir);
2823
2824 default:
2825 bpf_error(
2826 "only ethernet/FDDI/token ring supports link-level host name");
2827 break;
2828 }
2829 } else if (proto == Q_DECNET) {
2830 unsigned short dn_addr = __pcap_nametodnaddr(name);
2831 /*
2832 * I don't think DECNET hosts can be multihomed, so
2833 * there is no need to build up a list of addresses
2834 */
2835 return (gen_host(dn_addr, 0, proto, dir));
2836 } else {
2837 #ifndef INET6
2838 alist = pcap_nametoaddr(name);
2839 if (alist == NULL || *alist == NULL)
2840 bpf_error("unknown host '%s'", name);
2841 tproto = proto;
2842 if (off_linktype == -1 && tproto == Q_DEFAULT)
2843 tproto = Q_IP;
2844 b = gen_host(**alist++, 0xffffffff, tproto, dir);
2845 while (*alist) {
2846 tmp = gen_host(**alist++, 0xffffffff,
2847 tproto, dir);
2848 gen_or(b, tmp);
2849 b = tmp;
2850 }
2851 return b;
2852 #else
2853 memset(&mask128, 0xff, sizeof(mask128));
2854 res0 = res = pcap_nametoaddrinfo(name);
2855 if (res == NULL)
2856 bpf_error("unknown host '%s'", name);
2857 b = tmp = NULL;
2858 tproto = tproto6 = proto;
2859 if (off_linktype == -1 && tproto == Q_DEFAULT) {
2860 tproto = Q_IP;
2861 tproto6 = Q_IPV6;
2862 }
2863 for (res = res0; res; res = res->ai_next) {
2864 switch (res->ai_family) {
2865 case AF_INET:
2866 if (tproto == Q_IPV6)
2867 continue;
2868
2869 sin = (struct sockaddr_in *)
2870 res->ai_addr;
2871 tmp = gen_host(ntohl(sin->sin_addr.s_addr),
2872 0xffffffff, tproto, dir);
2873 break;
2874 case AF_INET6:
2875 if (tproto6 == Q_IP)
2876 continue;
2877
2878 sin6 = (struct sockaddr_in6 *)
2879 res->ai_addr;
2880 tmp = gen_host6(&sin6->sin6_addr,
2881 &mask128, tproto6, dir);
2882 break;
2883 default:
2884 continue;
2885 }
2886 if (b)
2887 gen_or(b, tmp);
2888 b = tmp;
2889 }
2890 freeaddrinfo(res0);
2891 if (b == NULL) {
2892 bpf_error("unknown host '%s'%s", name,
2893 (proto == Q_DEFAULT)
2894 ? ""
2895 : " for specified address family");
2896 }
2897 return b;
2898 #endif /*INET6*/
2899 }
2900
2901 case Q_PORT:
2902 if (proto != Q_DEFAULT && proto != Q_UDP && proto != Q_TCP)
2903 bpf_error("illegal qualifier of 'port'");
2904 if (pcap_nametoport(name, &port, &real_proto) == 0)
2905 bpf_error("unknown port '%s'", name);
2906 if (proto == Q_UDP) {
2907 if (real_proto == IPPROTO_TCP)
2908 bpf_error("port '%s' is tcp", name);
2909 else
2910 /* override PROTO_UNDEF */
2911 real_proto = IPPROTO_UDP;
2912 }
2913 if (proto == Q_TCP) {
2914 if (real_proto == IPPROTO_UDP)
2915 bpf_error("port '%s' is udp", name);
2916 else
2917 /* override PROTO_UNDEF */
2918 real_proto = IPPROTO_TCP;
2919 }
2920 #ifndef INET6
2921 return gen_port(port, real_proto, dir);
2922 #else
2923 {
2924 struct block *b;
2925 b = gen_port(port, real_proto, dir);
2926 gen_or(gen_port6(port, real_proto, dir), b);
2927 return b;
2928 }
2929 #endif /* INET6 */
2930
2931 case Q_GATEWAY:
2932 #ifndef INET6
2933 eaddr = pcap_ether_hostton(name);
2934 if (eaddr == NULL)
2935 bpf_error("unknown ether host: %s", name);
2936
2937 alist = pcap_nametoaddr(name);
2938 if (alist == NULL || *alist == NULL)
2939 bpf_error("unknown host '%s'", name);
2940 return gen_gateway(eaddr, alist, proto, dir);
2941 #else
2942 bpf_error("'gateway' not supported in this configuration");
2943 #endif /*INET6*/
2944
2945 case Q_PROTO:
2946 real_proto = lookup_proto(name, proto);
2947 if (real_proto >= 0)
2948 return gen_proto(real_proto, proto, dir);
2949 else
2950 bpf_error("unknown protocol: %s", name);
2951
2952 case Q_PROTOCHAIN:
2953 real_proto = lookup_proto(name, proto);
2954 if (real_proto >= 0)
2955 return gen_protochain(real_proto, proto, dir);
2956 else
2957 bpf_error("unknown protocol: %s", name);
2958
2959
2960 case Q_UNDEF:
2961 syntax();
2962 /* NOTREACHED */
2963 }
2964 abort();
2965 /* NOTREACHED */
2966 }
2967
2968 struct block *
2969 gen_mcode(s1, s2, masklen, q)
2970 register const char *s1, *s2;
2971 register int masklen;
2972 struct qual q;
2973 {
2974 register int nlen, mlen;
2975 bpf_u_int32 n, m;
2976
2977 nlen = __pcap_atoin(s1, &n);
2978 /* Promote short ipaddr */
2979 n <<= 32 - nlen;
2980
2981 if (s2 != NULL) {
2982 mlen = __pcap_atoin(s2, &m);
2983 /* Promote short ipaddr */
2984 m <<= 32 - mlen;
2985 if ((n & ~m) != 0)
2986 bpf_error("non-network bits set in \"%s mask %s\"",
2987 s1, s2);
2988 } else {
2989 /* Convert mask len to mask */
2990 if (masklen > 32)
2991 bpf_error("mask length must be <= 32");
2992 m = 0xffffffff << (32 - masklen);
2993 if ((n & ~m) != 0)
2994 bpf_error("non-network bits set in \"%s/%d\"",
2995 s1, masklen);
2996 }
2997
2998 switch (q.addr) {
2999
3000 case Q_NET:
3001 return gen_host(n, m, q.proto, q.dir);
3002
3003 default:
3004 bpf_error("Mask syntax for networks only");
3005 /* NOTREACHED */
3006 }
3007 }
3008
3009 struct block *
3010 gen_ncode(s, v, q)
3011 register const char *s;
3012 bpf_u_int32 v;
3013 struct qual q;
3014 {
3015 bpf_u_int32 mask;
3016 int proto = q.proto;
3017 int dir = q.dir;
3018 register int vlen;
3019
3020 if (s == NULL)
3021 vlen = 32;
3022 else if (q.proto == Q_DECNET)
3023 vlen = __pcap_atodn(s, &v);
3024 else
3025 vlen = __pcap_atoin(s, &v);
3026
3027 switch (q.addr) {
3028
3029 case Q_DEFAULT:
3030 case Q_HOST:
3031 case Q_NET:
3032 if (proto == Q_DECNET)
3033 return gen_host(v, 0, proto, dir);
3034 else if (proto == Q_LINK) {
3035 bpf_error("illegal link layer address");
3036 } else {
3037 mask = 0xffffffff;
3038 if (s == NULL && q.addr == Q_NET) {
3039 /* Promote short net number */
3040 while (v && (v & 0xff000000) == 0) {
3041 v <<= 8;
3042 mask <<= 8;
3043 }
3044 } else {
3045 /* Promote short ipaddr */
3046 v <<= 32 - vlen;
3047 mask <<= 32 - vlen;
3048 }
3049 return gen_host(v, mask, proto, dir);
3050 }
3051
3052 case Q_PORT:
3053 if (proto == Q_UDP)
3054 proto = IPPROTO_UDP;
3055 else if (proto == Q_TCP)
3056 proto = IPPROTO_TCP;
3057 else if (proto == Q_DEFAULT)
3058 proto = PROTO_UNDEF;
3059 else
3060 bpf_error("illegal qualifier of 'port'");
3061
3062 #ifndef INET6
3063 return gen_port((int)v, proto, dir);
3064 #else
3065 {
3066 struct block *b;
3067 b = gen_port((int)v, proto, dir);
3068 gen_or(gen_port6((int)v, proto, dir), b);
3069 return b;
3070 }
3071 #endif /* INET6 */
3072
3073 case Q_GATEWAY:
3074 bpf_error("'gateway' requires a name");
3075 /* NOTREACHED */
3076
3077 case Q_PROTO:
3078 return gen_proto((int)v, proto, dir);
3079
3080 case Q_PROTOCHAIN:
3081 return gen_protochain((int)v, proto, dir);
3082
3083 case Q_UNDEF:
3084 syntax();
3085 /* NOTREACHED */
3086
3087 default:
3088 abort();
3089 /* NOTREACHED */
3090 }
3091 /* NOTREACHED */
3092 }
3093
3094 #ifdef INET6
3095 struct block *
3096 gen_mcode6(s1, s2, masklen, q)
3097 register const char *s1, *s2;
3098 register int masklen;
3099 struct qual q;
3100 {
3101 struct addrinfo *res;
3102 struct in6_addr *addr;
3103 struct in6_addr mask;
3104 struct block *b;
3105 u_int32_t *a, *m;
3106
3107 if (s2)
3108 bpf_error("no mask %s supported", s2);
3109
3110 res = pcap_nametoaddrinfo(s1);
3111 if (!res)
3112 bpf_error("invalid ip6 address %s", s1);
3113 if (res->ai_next)
3114 bpf_error("%s resolved to multiple address", s1);
3115 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
3116
3117 if (sizeof(mask) * 8 < masklen)
3118 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
3119 memset(&mask, 0xff, masklen / 8);
3120 if (masklen % 8) {
3121 mask.s6_addr[masklen / 8] =
3122 (0xff << (8 - masklen % 8)) & 0xff;
3123 }
3124
3125 a = (u_int32_t *)addr;
3126 m = (u_int32_t *)&mask;
3127 if ((a[0] & ~m[0]) || (a[1] & ~m[1])
3128 || (a[2] & ~m[2]) || (a[3] & ~m[3])) {
3129 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen);
3130 }
3131
3132 switch (q.addr) {
3133
3134 case Q_DEFAULT:
3135 case Q_HOST:
3136 if (masklen != 128)
3137 bpf_error("Mask syntax for networks only");
3138 /* FALLTHROUGH */
3139
3140 case Q_NET:
3141 b = gen_host6(addr, &mask, q.proto, q.dir);
3142 freeaddrinfo(res);
3143 return b;
3144
3145 default:
3146 bpf_error("invalid qualifier against IPv6 address");
3147 /* NOTREACHED */
3148 }
3149 }
3150 #endif /*INET6*/
3151
3152 struct block *
3153 gen_ecode(eaddr, q)
3154 register const u_char *eaddr;
3155 struct qual q;
3156 {
3157 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
3158 if (linktype == DLT_EN10MB)
3159 return gen_ehostop(eaddr, (int)q.dir);
3160 if (linktype == DLT_FDDI)
3161 return gen_fhostop(eaddr, (int)q.dir);
3162 if (linktype == DLT_IEEE802)
3163 return gen_thostop(eaddr, (int)q.dir);
3164 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring");
3165 }
3166 bpf_error("ethernet address used in non-ether expression");
3167 /* NOTREACHED */
3168 }
3169
3170 void
3171 sappend(s0, s1)
3172 struct slist *s0, *s1;
3173 {
3174 /*
3175 * This is definitely not the best way to do this, but the
3176 * lists will rarely get long.
3177 */
3178 while (s0->next)
3179 s0 = s0->next;
3180 s0->next = s1;
3181 }
3182
3183 static struct slist *
3184 xfer_to_x(a)
3185 struct arth *a;
3186 {
3187 struct slist *s;
3188
3189 s = new_stmt(BPF_LDX|BPF_MEM);
3190 s->s.k = a->regno;
3191 return s;
3192 }
3193
3194 static struct slist *
3195 xfer_to_a(a)
3196 struct arth *a;
3197 {
3198 struct slist *s;
3199
3200 s = new_stmt(BPF_LD|BPF_MEM);
3201 s->s.k = a->regno;
3202 return s;
3203 }
3204
3205 struct arth *
3206 gen_load(proto, index, size)
3207 int proto;
3208 struct arth *index;
3209 int size;
3210 {
3211 struct slist *s, *tmp;
3212 struct block *b;
3213 int regno = alloc_reg();
3214
3215 free_reg(index->regno);
3216 switch (size) {
3217
3218 default:
3219 bpf_error("data size must be 1, 2, or 4");
3220
3221 case 1:
3222 size = BPF_B;
3223 break;
3224
3225 case 2:
3226 size = BPF_H;
3227 break;
3228
3229 case 4:
3230 size = BPF_W;
3231 break;
3232 }
3233 switch (proto) {
3234 default:
3235 bpf_error("unsupported index operation");
3236
3237 case Q_LINK:
3238 s = xfer_to_x(index);
3239 tmp = new_stmt(BPF_LD|BPF_IND|size);
3240 sappend(s, tmp);
3241 sappend(index->s, s);
3242 break;
3243
3244 case Q_IP:
3245 case Q_ARP:
3246 case Q_RARP:
3247 case Q_ATALK:
3248 case Q_DECNET:
3249 case Q_SCA:
3250 case Q_LAT:
3251 case Q_MOPRC:
3252 case Q_MOPDL:
3253 #ifdef INET6
3254 case Q_IPV6:
3255 #endif
3256 /* XXX Note that we assume a fixed link header here. */
3257 s = xfer_to_x(index);
3258 tmp = new_stmt(BPF_LD|BPF_IND|size);
3259 tmp->s.k = off_nl;
3260 sappend(s, tmp);
3261 sappend(index->s, s);
3262
3263 b = gen_proto_abbrev(proto);
3264 if (index->b)
3265 gen_and(index->b, b);
3266 index->b = b;
3267 break;
3268
3269 case Q_TCP:
3270 case Q_UDP:
3271 case Q_ICMP:
3272 case Q_IGMP:
3273 case Q_IGRP:
3274 case Q_PIM:
3275 case Q_VRRP:
3276 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
3277 s->s.k = off_nl;
3278 sappend(s, xfer_to_a(index));
3279 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
3280 sappend(s, new_stmt(BPF_MISC|BPF_TAX));
3281 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
3282 tmp->s.k = off_nl;
3283 sappend(index->s, s);
3284
3285 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
3286 if (index->b)
3287 gen_and(index->b, b);
3288 #ifdef INET6
3289 gen_and(gen_proto_abbrev(Q_IP), b);
3290 #endif
3291 index->b = b;
3292 break;
3293 #ifdef INET6
3294 case Q_ICMPV6:
3295 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
3296 /*NOTREACHED*/
3297 #endif
3298 }
3299 index->regno = regno;
3300 s = new_stmt(BPF_ST);
3301 s->s.k = regno;
3302 sappend(index->s, s);
3303
3304 return index;
3305 }
3306
3307 struct block *
3308 gen_relation(code, a0, a1, reversed)
3309 int code;
3310 struct arth *a0, *a1;
3311 int reversed;
3312 {
3313 struct slist *s0, *s1, *s2;
3314 struct block *b, *tmp;
3315
3316 s0 = xfer_to_x(a1);
3317 s1 = xfer_to_a(a0);
3318 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X);
3319 b = new_block(JMP(code));
3320 if (code == BPF_JGT || code == BPF_JGE) {
3321 reversed = !reversed;
3322 b->s.k = 0x80000000;
3323 }
3324 if (reversed)
3325 gen_not(b);
3326
3327 sappend(s1, s2);
3328 sappend(s0, s1);
3329 sappend(a1->s, s0);
3330 sappend(a0->s, a1->s);
3331
3332 b->stmts = a0->s;
3333
3334 free_reg(a0->regno);
3335 free_reg(a1->regno);
3336
3337 /* 'and' together protocol checks */
3338 if (a0->b) {
3339 if (a1->b) {
3340 gen_and(a0->b, tmp = a1->b);
3341 }
3342 else
3343 tmp = a0->b;
3344 } else
3345 tmp = a1->b;
3346
3347 if (tmp)
3348 gen_and(tmp, b);
3349
3350 return b;
3351 }
3352
3353 struct arth *
3354 gen_loadlen()
3355 {
3356 int regno = alloc_reg();
3357 struct arth *a = (struct arth *)newchunk(sizeof(*a));
3358 struct slist *s;
3359
3360 s = new_stmt(BPF_LD|BPF_LEN);
3361 s->next = new_stmt(BPF_ST);
3362 s->next->s.k = regno;
3363 a->s = s;
3364 a->regno = regno;
3365
3366 return a;
3367 }
3368
3369 struct arth *
3370 gen_loadi(val)
3371 int val;
3372 {
3373 struct arth *a;
3374 struct slist *s;
3375 int reg;
3376
3377 a = (struct arth *)newchunk(sizeof(*a));
3378
3379 reg = alloc_reg();
3380
3381 s = new_stmt(BPF_LD|BPF_IMM);
3382 s->s.k = val;
3383 s->next = new_stmt(BPF_ST);
3384 s->next->s.k = reg;
3385 a->s = s;
3386 a->regno = reg;
3387
3388 return a;
3389 }
3390
3391 struct arth *
3392 gen_neg(a)
3393 struct arth *a;
3394 {
3395 struct slist *s;
3396
3397 s = xfer_to_a(a);
3398 sappend(a->s, s);
3399 s = new_stmt(BPF_ALU|BPF_NEG);
3400 s->s.k = 0;
3401 sappend(a->s, s);
3402 s = new_stmt(BPF_ST);
3403 s->s.k = a->regno;
3404 sappend(a->s, s);
3405
3406 return a;
3407 }
3408
3409 struct arth *
3410 gen_arth(code, a0, a1)
3411 int code;
3412 struct arth *a0, *a1;
3413 {
3414 struct slist *s0, *s1, *s2;
3415
3416 s0 = xfer_to_x(a1);
3417 s1 = xfer_to_a(a0);
3418 s2 = new_stmt(BPF_ALU|BPF_X|code);
3419
3420 sappend(s1, s2);
3421 sappend(s0, s1);
3422 sappend(a1->s, s0);
3423 sappend(a0->s, a1->s);
3424
3425 free_reg(a1->regno);
3426
3427 s0 = new_stmt(BPF_ST);
3428 a0->regno = s0->s.k = alloc_reg();
3429 sappend(a0->s, s0);
3430
3431 return a0;
3432 }
3433
3434 /*
3435 * Here we handle simple allocation of the scratch registers.
3436 * If too many registers are alloc'd, the allocator punts.
3437 */
3438 static int regused[BPF_MEMWORDS];
3439 static int curreg;
3440
3441 /*
3442 * Return the next free register.
3443 */
3444 static int
3445 alloc_reg()
3446 {
3447 int n = BPF_MEMWORDS;
3448
3449 while (--n >= 0) {
3450 if (regused[curreg])
3451 curreg = (curreg + 1) % BPF_MEMWORDS;
3452 else {
3453 regused[curreg] = 1;
3454 return curreg;
3455 }
3456 }
3457 bpf_error("too many registers needed to evaluate expression");
3458 /* NOTREACHED */
3459 }
3460
3461 /*
3462 * Return a register to the table so it can
3463 * be used later.
3464 */
3465 static void
3466 free_reg(n)
3467 int n;
3468 {
3469 regused[n] = 0;
3470 }
3471
3472 static struct block *
3473 gen_len(jmp, n)
3474 int jmp, n;
3475 {
3476 struct slist *s;
3477 struct block *b;
3478
3479 s = new_stmt(BPF_LD|BPF_LEN);
3480 b = new_block(JMP(jmp));
3481 b->stmts = s;
3482 b->s.k = n;
3483
3484 return b;
3485 }
3486
3487 struct block *
3488 gen_greater(n)
3489 int n;
3490 {
3491 return gen_len(BPF_JGE, n);
3492 }
3493
3494 /*
3495 * Actually, this is less than or equal.
3496 */
3497 struct block *
3498 gen_less(n)
3499 int n;
3500 {
3501 struct block *b;
3502
3503 b = gen_len(BPF_JGT, n);
3504 gen_not(b);
3505
3506 return b;
3507 }
3508
3509 struct block *
3510 gen_byteop(op, idx, val)
3511 int op, idx, val;
3512 {
3513 struct block *b;
3514 struct slist *s;
3515
3516 switch (op) {
3517 default:
3518 abort();
3519
3520 case '=':
3521 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3522
3523 case '<':
3524 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3525 b->s.code = JMP(BPF_JGE);
3526 gen_not(b);
3527 return b;
3528
3529 case '>':
3530 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3531 b->s.code = JMP(BPF_JGT);
3532 return b;
3533
3534 case '|':
3535 s = new_stmt(BPF_ALU|BPF_OR|BPF_K);
3536 break;
3537
3538 case '&':
3539 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
3540 break;
3541 }
3542 s->s.k = val;
3543 b = new_block(JMP(BPF_JEQ));
3544 b->stmts = s;
3545 gen_not(b);
3546
3547 return b;
3548 }
3549
3550 struct block *
3551 gen_broadcast(proto)
3552 int proto;
3553 {
3554 bpf_u_int32 hostmask;
3555 struct block *b0, *b1, *b2;
3556 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3557
3558 switch (proto) {
3559
3560 case Q_DEFAULT:
3561 case Q_LINK:
3562 if (linktype == DLT_EN10MB)
3563 return gen_ehostop(ebroadcast, Q_DST);
3564 if (linktype == DLT_FDDI)
3565 return gen_fhostop(ebroadcast, Q_DST);
3566 if (linktype == DLT_IEEE802)
3567 return gen_thostop(ebroadcast, Q_DST);
3568 bpf_error("not a broadcast link");
3569 break;
3570
3571 case Q_IP:
3572 b0 = gen_linktype(ETHERTYPE_IP);
3573 hostmask = ~netmask;
3574 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
3575 b2 = gen_mcmp(off_nl + 16, BPF_W,
3576 (bpf_int32)(~0 & hostmask), hostmask);
3577 gen_or(b1, b2);
3578 gen_and(b0, b2);
3579 return b2;
3580 }
3581 bpf_error("only ether/ip broadcast filters supported");
3582 }
3583
3584 struct block *
3585 gen_multicast(proto)
3586 int proto;
3587 {
3588 register struct block *b0, *b1;
3589 register struct slist *s;
3590
3591 switch (proto) {
3592
3593 case Q_DEFAULT:
3594 case Q_LINK:
3595 if (linktype == DLT_EN10MB) {
3596 /* ether[0] & 1 != 0 */
3597 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3598 s->s.k = 0;
3599 b0 = new_block(JMP(BPF_JSET));
3600 b0->s.k = 1;
3601 b0->stmts = s;
3602 return b0;
3603 }
3604
3605 if (linktype == DLT_FDDI) {
3606 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */
3607 /* fddi[1] & 1 != 0 */
3608 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3609 s->s.k = 1;
3610 b0 = new_block(JMP(BPF_JSET));
3611 b0->s.k = 1;
3612 b0->stmts = s;
3613 return b0;
3614 }
3615
3616 /* TODO - check how token ring handles multicast */
3617 /* if (linktype == DLT_IEEE802) ... */
3618
3619 /* Link not known to support multicasts */
3620 break;
3621
3622 case Q_IP:
3623 b0 = gen_linktype(ETHERTYPE_IP);
3624 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
3625 b1->s.code = JMP(BPF_JGE);
3626 gen_and(b0, b1);
3627 return b1;
3628
3629 #ifdef INET6
3630 case Q_IPV6:
3631 b0 = gen_linktype(ETHERTYPE_IPV6);
3632 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
3633 gen_and(b0, b1);
3634 return b1;
3635 #endif /* INET6 */
3636 }
3637 bpf_error("only IP multicast filters supported on ethernet/FDDI");
3638 }
3639
3640 /*
3641 * generate command for inbound/outbound. It's here so we can
3642 * make it link-type specific. 'dir' = 0 implies "inbound",
3643 * = 1 implies "outbound".
3644 */
3645 struct block *
3646 gen_inbound(dir)
3647 int dir;
3648 {
3649 register struct block *b0;
3650
3651 /*
3652 * Only some data link types support inbound/outbound qualifiers.
3653 */
3654 switch (linktype) {
3655 case DLT_SLIP:
3656 case DLT_PPP:
3657 b0 = gen_relation(BPF_JEQ,
3658 gen_load(Q_LINK, gen_loadi(0), 1),
3659 gen_loadi(0),
3660 dir);
3661 break;
3662
3663 default:
3664 bpf_error("inbound/outbound not supported on linktype %d\n",
3665 linktype);
3666 b0 = NULL;
3667 /* NOTREACHED */
3668 }
3669 return (b0);
3670 }
3671
3672 /*
3673 * support IEEE 802.1Q VLAN trunk over ethernet
3674 */
3675 struct block *
3676 gen_vlan(vlan_num)
3677 int vlan_num;
3678 {
3679 static u_int orig_linktype = -1, orig_nl = -1;
3680 struct block *b0;
3681
3682 /*
3683 * Change the offsets to point to the type and data fields within
3684 * the VLAN packet. This is somewhat of a kludge.
3685 */
3686 if (orig_nl == (u_int)-1) {
3687 orig_linktype = off_linktype; /* save original values */
3688 orig_nl = off_nl;
3689
3690 switch (linktype) {
3691
3692 case DLT_EN10MB:
3693 off_linktype = 16;
3694 off_nl = 18;
3695 break;
3696
3697 default:
3698 bpf_error("no VLAN support for data link type %d",
3699 linktype);
3700 /*NOTREACHED*/
3701 }
3702 }
3703
3704 /* check for VLAN */
3705 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
3706
3707 /* If a specific VLAN is requested, check VLAN id */
3708 if (vlan_num >= 0) {
3709 struct block *b1;
3710
3711 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num);
3712 gen_and(b0, b1);
3713 b0 = b1;
3714 }
3715
3716 return (b0);
3717 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism