]> The Tcpdump Group git mirrors - libpcap/blob - gencode.c
projects / libpcap / blob


c824b61ea25303b4ad2b54df5164582c88078f58
[libpcap] / gencode.c
1 /*#define CHASE_CHAIN*/
2 /*
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.148 2001-02-12 09:33:21 itojun Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <sys/types.h>
32 #include <sys/socket.h>
33 #include <sys/time.h>
34 #ifdef __NetBSD__
35 #include <sys/param.h>
36 #endif
37
38 struct mbuf;
39 struct rtentry;
40 #include <net/if.h>
41
42 #include <netinet/in.h>
43
44 #include <stdlib.h>
45 #include <string.h>
46 #include <memory.h>
47 #include <setjmp.h>
48 #include <stdarg.h>
49
50 #include "pcap-int.h"
51
52 #include "ethertype.h"
53 #include "nlpid.h"
54 #include "llc.h"
55 #include "gencode.h"
56 #include "ppp.h"
57 #include "sll.h"
58 #include <pcap-namedb.h>
59 #ifdef INET6
60 #include <netdb.h>
61 #include <sys/socket.h>
62 #endif /*INET6*/
63
64 #define ETHERMTU 1500
65
66 #ifdef HAVE_OS_PROTO_H
67 #include "os-proto.h"
68 #endif
69
70 #define JMP(c) ((c)|BPF_JMP|BPF_K)
71
72 /* Locals */
73 static jmp_buf top_ctx;
74 static pcap_t *bpf_pcap;
75
76 /* XXX */
77 #ifdef PCAP_FDDIPAD
78 int pcap_fddipad = PCAP_FDDIPAD;
79 #else
80 int pcap_fddipad;
81 #endif
82
83 /* VARARGS */
84 void
85 bpf_error(const char *fmt, ...)
86
87 {
88 va_list ap;
89
90 va_start(ap, fmt);
91 if (bpf_pcap != NULL)
92 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE,
93 fmt, ap);
94 va_end(ap);
95 longjmp(top_ctx, 1);
96 /* NOTREACHED */
97 }
98
99 static void init_linktype(int);
100
101 static int alloc_reg(void);
102 static void free_reg(int);
103
104 static struct block *root;
105
106 /*
107 * We divy out chunks of memory rather than call malloc each time so
108 * we don't have to worry about leaking memory. It's probably
109 * not a big deal if all this memory was wasted but it this ever
110 * goes into a library that would probably not be a good idea.
111 */
112 #define NCHUNKS 16
113 #define CHUNK0SIZE 1024
114 struct chunk {
115 u_int n_left;
116 void *m;
117 };
118
119 static struct chunk chunks[NCHUNKS];
120 static int cur_chunk;
121
122 static void *newchunk(u_int);
123 static void freechunks(void);
124 static inline struct block *new_block(int);
125 static inline struct slist *new_stmt(int);
126 static struct block *gen_retblk(int);
127 static inline void syntax(void);
128
129 static void backpatch(struct block *, struct block *);
130 static void merge(struct block *, struct block *);
131 static struct block *gen_cmp(u_int, u_int, bpf_int32);
132 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
133 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
134 static struct block *gen_bcmp(u_int, u_int, const u_char *);
135 static struct block *gen_uncond(int);
136 static inline struct block *gen_true(void);
137 static inline struct block *gen_false(void);
138 static struct block *gen_linktype(int);
139 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
140 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
141 #ifdef INET6
142 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
143 #endif
144 static struct block *gen_ehostop(const u_char *, int);
145 static struct block *gen_fhostop(const u_char *, int);
146 static struct block *gen_thostop(const u_char *, int);
147 static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
148 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
149 #ifdef INET6
150 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
151 #endif
152 #ifndef INET6
153 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
154 #endif
155 static struct block *gen_ipfrag(void);
156 static struct block *gen_portatom(int, bpf_int32);
157 #ifdef INET6
158 static struct block *gen_portatom6(int, bpf_int32);
159 #endif
160 struct block *gen_portop(int, int, int);
161 static struct block *gen_port(int, int, int);
162 #ifdef INET6
163 struct block *gen_portop6(int, int, int);
164 static struct block *gen_port6(int, int, int);
165 #endif
166 static int lookup_proto(const char *, int);
167 static struct block *gen_protochain(int, int, int);
168 static struct block *gen_proto(int, int, int);
169 static struct slist *xfer_to_x(struct arth *);
170 static struct slist *xfer_to_a(struct arth *);
171 static struct block *gen_len(int, int);
172
173 static void *
174 newchunk(n)
175 u_int n;
176 {
177 struct chunk *cp;
178 int k, size;
179
180 #ifndef __NetBSD__
181 /* XXX Round up to nearest long. */
182 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1);
183 #else
184 /* XXX Round up to structure boundary. */
185 n = ALIGN(n);
186 #endif
187
188 cp = &chunks[cur_chunk];
189 if (n > cp->n_left) {
190 ++cp, k = ++cur_chunk;
191 if (k >= NCHUNKS)
192 bpf_error("out of memory");
193 size = CHUNK0SIZE << k;
194 cp->m = (void *)malloc(size);
195 memset((char *)cp->m, 0, size);
196 cp->n_left = size;
197 if (n > size)
198 bpf_error("out of memory");
199 }
200 cp->n_left -= n;
201 return (void *)((char *)cp->m + cp->n_left);
202 }
203
204 static void
205 freechunks()
206 {
207 int i;
208
209 cur_chunk = 0;
210 for (i = 0; i < NCHUNKS; ++i)
211 if (chunks[i].m != NULL) {
212 free(chunks[i].m);
213 chunks[i].m = NULL;
214 }
215 }
216
217 /*
218 * A strdup whose allocations are freed after code generation is over.
219 */
220 char *
221 sdup(s)
222 register const char *s;
223 {
224 int n = strlen(s) + 1;
225 char *cp = newchunk(n);
226
227 strlcpy(cp, s, n);
228 return (cp);
229 }
230
231 static inline struct block *
232 new_block(code)
233 int code;
234 {
235 struct block *p;
236
237 p = (struct block *)newchunk(sizeof(*p));
238 p->s.code = code;
239 p->head = p;
240
241 return p;
242 }
243
244 static inline struct slist *
245 new_stmt(code)
246 int code;
247 {
248 struct slist *p;
249
250 p = (struct slist *)newchunk(sizeof(*p));
251 p->s.code = code;
252
253 return p;
254 }
255
256 static struct block *
257 gen_retblk(v)
258 int v;
259 {
260 struct block *b = new_block(BPF_RET|BPF_K);
261
262 b->s.k = v;
263 return b;
264 }
265
266 static inline void
267 syntax()
268 {
269 bpf_error("syntax error in filter expression");
270 }
271
272 static bpf_u_int32 netmask;
273 static int snaplen;
274 int no_optimize;
275
276 int
277 pcap_compile(pcap_t *p, struct bpf_program *program,
278 char *buf, int optimize, bpf_u_int32 mask)
279 {
280 extern int n_errors;
281 int len;
282
283 no_optimize = 0;
284 n_errors = 0;
285 root = NULL;
286 bpf_pcap = p;
287 if (setjmp(top_ctx)) {
288 lex_cleanup();
289 freechunks();
290 return (-1);
291 }
292
293 netmask = mask;
294
295 snaplen = pcap_snapshot(p);
296 if (snaplen == 0) {
297 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
298 "snaplen of 0 rejects all packets");
299 return -1;
300 }
301
302 lex_init(buf ? buf : "");
303 init_linktype(pcap_datalink(p));
304 (void)pcap_parse();
305
306 if (n_errors)
307 syntax();
308
309 if (root == NULL)
310 root = gen_retblk(snaplen);
311
312 if (optimize && !no_optimize) {
313 bpf_optimize(&root);
314 if (root == NULL ||
315 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
316 bpf_error("expression rejects all packets");
317 }
318 program->bf_insns = icode_to_fcode(root, &len);
319 program->bf_len = len;
320
321 lex_cleanup();
322 freechunks();
323 return (0);
324 }
325
326 /*
327 * entry point for using the compiler with no pcap open
328 * pass in all the stuff that is needed explicitly instead.
329 */
330 int
331 pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
332 struct bpf_program *program,
333 char *buf, int optimize, bpf_u_int32 mask)
334 {
335 pcap_t *p;
336 int ret;
337
338 p = pcap_open_dead(linktype_arg, snaplen_arg);
339 if (p == NULL)
340 return (-1);
341 ret = pcap_compile(p, program, buf, optimize, mask);
342 pcap_close(p);
343 return (ret);
344 }
345
346 /*
347 * Clean up a "struct bpf_program" by freeing all the memory allocated
348 * in it.
349 */
350 void
351 pcap_freecode(struct bpf_program *program)
352 {
353 program->bf_len = 0;
354 if (program->bf_insns != NULL) {
355 free((char *)program->bf_insns);
356 program->bf_insns = NULL;
357 }
358 }
359
360 /*
361 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
362 * which of the jt and jf fields has been resolved and which is a pointer
363 * back to another unresolved block (or nil). At least one of the fields
364 * in each block is already resolved.
365 */
366 static void
367 backpatch(list, target)
368 struct block *list, *target;
369 {
370 struct block *next;
371
372 while (list) {
373 if (!list->sense) {
374 next = JT(list);
375 JT(list) = target;
376 } else {
377 next = JF(list);
378 JF(list) = target;
379 }
380 list = next;
381 }
382 }
383
384 /*
385 * Merge the lists in b0 and b1, using the 'sense' field to indicate
386 * which of jt and jf is the link.
387 */
388 static void
389 merge(b0, b1)
390 struct block *b0, *b1;
391 {
392 register struct block **p = &b0;
393
394 /* Find end of list. */
395 while (*p)
396 p = !((*p)->sense) ? &JT(*p) : &JF(*p);
397
398 /* Concatenate the lists. */
399 *p = b1;
400 }
401
402 void
403 finish_parse(p)
404 struct block *p;
405 {
406 backpatch(p, gen_retblk(snaplen));
407 p->sense = !p->sense;
408 backpatch(p, gen_retblk(0));
409 root = p->head;
410 }
411
412 void
413 gen_and(b0, b1)
414 struct block *b0, *b1;
415 {
416 backpatch(b0, b1->head);
417 b0->sense = !b0->sense;
418 b1->sense = !b1->sense;
419 merge(b1, b0);
420 b1->sense = !b1->sense;
421 b1->head = b0->head;
422 }
423
424 void
425 gen_or(b0, b1)
426 struct block *b0, *b1;
427 {
428 b0->sense = !b0->sense;
429 backpatch(b0, b1->head);
430 b0->sense = !b0->sense;
431 merge(b1, b0);
432 b1->head = b0->head;
433 }
434
435 void
436 gen_not(b)
437 struct block *b;
438 {
439 b->sense = !b->sense;
440 }
441
442 static struct block *
443 gen_cmp(offset, size, v)
444 u_int offset, size;
445 bpf_int32 v;
446 {
447 struct slist *s;
448 struct block *b;
449
450 s = new_stmt(BPF_LD|BPF_ABS|size);
451 s->s.k = offset;
452
453 b = new_block(JMP(BPF_JEQ));
454 b->stmts = s;
455 b->s.k = v;
456
457 return b;
458 }
459
460 static struct block *
461 gen_cmp_gt(offset, size, v)
462 u_int offset, size;
463 bpf_int32 v;
464 {
465 struct slist *s;
466 struct block *b;
467
468 s = new_stmt(BPF_LD|BPF_ABS|size);
469 s->s.k = offset;
470
471 b = new_block(JMP(BPF_JGT));
472 b->stmts = s;
473 b->s.k = v;
474
475 return b;
476 }
477
478 static struct block *
479 gen_mcmp(offset, size, v, mask)
480 u_int offset, size;
481 bpf_int32 v;
482 bpf_u_int32 mask;
483 {
484 struct block *b = gen_cmp(offset, size, v);
485 struct slist *s;
486
487 if (mask != 0xffffffff) {
488 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
489 s->s.k = mask;
490 b->stmts->next = s;
491 }
492 return b;
493 }
494
495 static struct block *
496 gen_bcmp(offset, size, v)
497 register u_int offset, size;
498 register const u_char *v;
499 {
500 register struct block *b, *tmp;
501
502 b = NULL;
503 while (size >= 4) {
504 register const u_char *p = &v[size - 4];
505 bpf_int32 w = ((bpf_int32)p[0] << 24) |
506 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
507
508 tmp = gen_cmp(offset + size - 4, BPF_W, w);
509 if (b != NULL)
510 gen_and(b, tmp);
511 b = tmp;
512 size -= 4;
513 }
514 while (size >= 2) {
515 register const u_char *p = &v[size - 2];
516 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
517
518 tmp = gen_cmp(offset + size - 2, BPF_H, w);
519 if (b != NULL)
520 gen_and(b, tmp);
521 b = tmp;
522 size -= 2;
523 }
524 if (size > 0) {
525 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
526 if (b != NULL)
527 gen_and(b, tmp);
528 b = tmp;
529 }
530 return b;
531 }
532
533 /*
534 * Various code constructs need to know the layout of the data link
535 * layer. These variables give the necessary offsets. off_linktype
536 * is set to -1 for no encapsulation, in which case, IP is assumed.
537 */
538 static u_int off_linktype;
539 static u_int off_nl;
540 static int linktype;
541
542 static void
543 init_linktype(type)
544 int type;
545 {
546 linktype = type;
547
548 switch (type) {
549
550 case DLT_EN10MB:
551 off_linktype = 12;
552 off_nl = 14;
553 return;
554
555 case DLT_SLIP:
556 /*
557 * SLIP doesn't have a link level type. The 16 byte
558 * header is hacked into our SLIP driver.
559 */
560 off_linktype = -1;
561 off_nl = 16;
562 return;
563
564 case DLT_SLIP_BSDOS:
565 /* XXX this may be the same as the DLT_PPP_BSDOS case */
566 off_linktype = -1;
567 /* XXX end */
568 off_nl = 24;
569 return;
570
571 case DLT_NULL:
572 case DLT_LOOP:
573 off_linktype = 0;
574 off_nl = 4;
575 return;
576
577 case DLT_PPP:
578 case DLT_C_HDLC:
579 case DLT_PPP_SERIAL:
580 off_linktype = 2;
581 off_nl = 4;
582 return;
583
584 case DLT_PPP_BSDOS:
585 off_linktype = 5;
586 off_nl = 24;
587 return;
588
589 case DLT_FDDI:
590 /*
591 * FDDI doesn't really have a link-level type field.
592 * We set "off_linktype" to the offset of the LLC header.
593 *
594 * To check for Ethernet types, we assume that SSAP = SNAP
595 * is being used and pick out the encapsulated Ethernet type.
596 * XXX - should we generate code to check for SNAP?
597 */
598 off_linktype = 13;
599 #ifdef PCAP_FDDIPAD
600 off_linktype += pcap_fddipad;
601 #endif
602 off_nl = 21;
603 #ifdef PCAP_FDDIPAD
604 off_nl += pcap_fddipad;
605 #endif
606 return;
607
608 case DLT_IEEE802:
609 /*
610 * Token Ring doesn't really have a link-level type field.
611 * We set "off_linktype" to the offset of the LLC header.
612 *
613 * To check for Ethernet types, we assume that SSAP = SNAP
614 * is being used and pick out the encapsulated Ethernet type.
615 * XXX - should we generate code to check for SNAP?
616 *
617 * XXX - the header is actually variable-length.
618 * Some various Linux patched versions gave 38
619 * as "off_linktype" and 40 as "off_nl"; however,
620 * if a token ring packet has *no* routing
621 * information, i.e. is not source-routed, the correct
622 * values are 20 and 22, as they are in the vanilla code.
623 *
624 * A packet is source-routed iff the uppermost bit
625 * of the first byte of the source address, at an
626 * offset of 8, has the uppermost bit set. If the
627 * packet is source-routed, the total number of bytes
628 * of routing information is 2 plus bits 0x1F00 of
629 * the 16-bit value at an offset of 14 (shifted right
630 * 8 - figure out which byte that is).
631 */
632 off_linktype = 14;
633 off_nl = 22;
634 return;
635
636 case DLT_ATM_RFC1483:
637 /*
638 * assume routed, non-ISO PDUs
639 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
640 */
641 off_linktype = 6;
642 off_nl = 8;
643 return;
644
645 case DLT_RAW:
646 off_linktype = -1;
647 off_nl = 0;
648 return;
649
650 case DLT_ATM_CLIP: /* Linux ATM defines this */
651 off_linktype = 6;
652 off_nl = 8;
653 return;
654
655 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */
656 off_linktype = 14;
657 off_nl = 16;
658 return;
659 }
660 bpf_error("unknown data link type %d", linktype);
661 /* NOTREACHED */
662 }
663
664 static struct block *
665 gen_uncond(rsense)
666 int rsense;
667 {
668 struct block *b;
669 struct slist *s;
670
671 s = new_stmt(BPF_LD|BPF_IMM);
672 s->s.k = !rsense;
673 b = new_block(JMP(BPF_JEQ));
674 b->stmts = s;
675
676 return b;
677 }
678
679 static inline struct block *
680 gen_true()
681 {
682 return gen_uncond(1);
683 }
684
685 static inline struct block *
686 gen_false()
687 {
688 return gen_uncond(0);
689 }
690
691 /*
692 * Byte-swap a 32-bit number.
693 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
694 * big-endian platforms.)
695 */
696 #define SWAPLONG(y) \
697 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
698
699 static struct block *
700 gen_linktype(proto)
701 register int proto;
702 {
703 struct block *b0, *b1;
704
705 switch (linktype) {
706
707 case DLT_EN10MB:
708 switch (proto) {
709
710 case LLCSAP_ISONS:
711 /*
712 * OSI protocols always use 802.2 encapsulation.
713 * XXX - should we check both the DSAP and the
714 * SSAP, like this, or should we check just the
715 * DSAP?
716 */
717 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
718 gen_not(b0);
719 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
720 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
721 gen_and(b0, b1);
722 return b1;
723
724 case LLCSAP_NETBEUI:
725 /*
726 * NetBEUI always uses 802.2 encapsulation.
727 * XXX - should we check both the DSAP and the
728 * SSAP, like this, or should we check just the
729 * DSAP?
730 */
731 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
732 gen_not(b0);
733 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
734 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
735 gen_and(b0, b1);
736 return b1;
737
738 case LLCSAP_IPX:
739 /*
740 * Check for;
741 *
742 * Ethernet_II frames, which are Ethernet
743 * frames with a frame type of ETHERTYPE_IPX;
744 *
745 * Ethernet_802.3 frames, which are 802.3
746 * frames (i.e., the type/length field is
747 * a length field, <= ETHERMTU, rather than
748 * a type field) with the first two bytes
749 * after the Ethernet/802.3 header being
750 * 0xFFFF;
751 *
752 * Ethernet_802.2 frames, which are 802.3
753 * frames with an 802.2 LLC header and
754 * with the IPX LSAP as the DSAP in the LLC
755 * header;
756 *
757 * Ethernet_SNAP frames, which are 802.3
758 * frames with an LLC header and a SNAP
759 * header and with an OUI of 0x000000
760 * (encapsulated Ethernet) and a protocol
761 * ID of ETHERTYPE_IPX in the SNAP header.
762 *
763 * XXX - should we generate the same code both
764 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
765 */
766
767 /*
768 * This generates code to check both for the
769 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
770 */
771 b0 = gen_cmp(off_linktype + 2, BPF_B,
772 (bpf_int32)LLCSAP_IPX);
773 b1 = gen_cmp(off_linktype + 2, BPF_H,
774 (bpf_int32)0xFFFF);
775 gen_or(b0, b1);
776
777 /*
778 * Now we add code to check for SNAP frames with
779 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
780 */
781 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
782 gen_or(b0, b1);
783
784 /*
785 * Now we generate code to check for 802.3
786 * frames in general.
787 */
788 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
789 gen_not(b0);
790
791 /*
792 * Now add the check for 802.3 frames before the
793 * check for Ethernet_802.2 and Ethernet_802.3,
794 * as those checks should only be done on 802.3
795 * frames, not on Ethernet frames.
796 */
797 gen_and(b0, b1);
798
799 /*
800 * Now add the check for Ethernet_II frames, and
801 * do that before checking for the other frame
802 * types.
803 */
804 b0 = gen_cmp(off_linktype, BPF_H,
805 (bpf_int32)ETHERTYPE_IPX);
806 gen_or(b0, b1);
807 return b1;
808
809 case ETHERTYPE_ATALK:
810 case ETHERTYPE_AARP:
811 /*
812 * EtherTalk (AppleTalk protocols on Ethernet link
813 * layer) may use 802.2 encapsulation.
814 */
815
816 /*
817 * Check for 802.2 encapsulation (EtherTalk phase 2?);
818 * we check for an Ethernet type field less than
819 * 1500, which means it's an 802.3 length field.
820 */
821 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
822 gen_not(b0);
823
824 /*
825 * 802.2-encapsulated ETHERTYPE_ATALK packets are
826 * SNAP packets with an organization code of
827 * 0x080007 (Apple, for Appletalk) and a protocol
828 * type of ETHERTYPE_ATALK (Appletalk).
829 *
830 * 802.2-encapsulated ETHERTYPE_AARP packets are
831 * SNAP packets with an organization code of
832 * 0x000000 (encapsulated Ethernet) and a protocol
833 * type of ETHERTYPE_AARP (Appletalk ARP).
834 */
835 if (proto == ETHERTYPE_ATALK)
836 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
837 else /* proto == ETHERTYPE_AARP */
838 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
839 gen_and(b0, b1);
840
841 /*
842 * Check for Ethernet encapsulation (Ethertalk
843 * phase 1?); we just check for the Ethernet
844 * protocol type.
845 */
846 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
847
848 gen_or(b0, b1);
849 return b1;
850
851 default:
852 if (proto <= ETHERMTU) {
853 /*
854 * This is an LLC SAP value, so the frames
855 * that match would be 802.2 frames.
856 * Check that the frame is an 802.2 frame
857 * (i.e., that the length/type field is
858 * a length field, <= ETHERMTU) and
859 * then check the DSAP.
860 */
861 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
862 gen_not(b0);
863 b1 = gen_cmp(off_linktype + 2, BPF_B,
864 (bpf_int32)proto);
865 gen_and(b0, b1);
866 return b1;
867 } else {
868 /*
869 * This is an Ethernet type, so compare
870 * the length/type field with it (if
871 * the frame is an 802.2 frame, the length
872 * field will be <= ETHERMTU, and, as
873 * "proto" is > ETHERMTU, this test
874 * will fail and the frame won't match,
875 * which is what we want).
876 */
877 return gen_cmp(off_linktype, BPF_H,
878 (bpf_int32)proto);
879 }
880 }
881 break;
882
883 case DLT_FDDI:
884 case DLT_IEEE802:
885 case DLT_ATM_RFC1483:
886 case DLT_ATM_CLIP:
887 /*
888 * XXX - handle token-ring variable-length header.
889 */
890 switch (proto) {
891
892 case LLCSAP_ISONS:
893 return gen_cmp(off_linktype, BPF_H, (long)
894 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
895
896 case LLCSAP_NETBEUI:
897 return gen_cmp(off_linktype, BPF_H, (long)
898 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
899
900 case LLCSAP_IPX:
901 /*
902 * XXX - are there ever SNAP frames for IPX on
903 * non-Ethernet 802.x networks?
904 */
905 return gen_cmp(off_linktype, BPF_B,
906 (bpf_int32)LLCSAP_IPX);
907
908 case ETHERTYPE_ATALK:
909 /*
910 * 802.2-encapsulated ETHERTYPE_ATALK packets are
911 * SNAP packets with an organization code of
912 * 0x080007 (Apple, for Appletalk) and a protocol
913 * type of ETHERTYPE_ATALK (Appletalk).
914 *
915 * XXX - check for an organization code of
916 * encapsulated Ethernet as well?
917 */
918 return gen_snap(0x080007, ETHERTYPE_ATALK,
919 off_linktype);
920 break;
921
922 default:
923 /*
924 * XXX - we don't have to check for IPX 802.3
925 * here, but should we check for the IPX Ethertype?
926 */
927 if (proto <= ETHERMTU) {
928 /*
929 * This is an LLC SAP value, so check
930 * the DSAP.
931 */
932 return gen_cmp(off_linktype, BPF_B,
933 (bpf_int32)proto);
934 } else {
935 /*
936 * This is an Ethernet type; we assume
937 * that it's unlikely that it'll
938 * appear in the right place at random,
939 * and therefore check only the
940 * location that would hold the Ethernet
941 * type in a SNAP frame with an organization
942 * code of 0x000000 (encapsulated Ethernet).
943 *
944 * XXX - if we were to check for the SNAP DSAP
945 * and LSAP, as per XXX, and were also to check
946 * for an organization code of 0x000000
947 * (encapsulated Ethernet), we'd do
948 *
949 * return gen_snap(0x000000, proto,
950 * off_linktype);
951 *
952 * here; for now, we don't, as per the above.
953 * I don't know whether it's worth the
954 * extra CPU time to do the right check
955 * or not.
956 */
957 return gen_cmp(off_linktype+6, BPF_H,
958 (bpf_int32)proto);
959 }
960 }
961 break;
962
963 case DLT_LINUX_SLL:
964 switch (proto) {
965
966 case LLCSAP_ISONS:
967 /*
968 * OSI protocols always use 802.2 encapsulation.
969 * XXX - should we check both the DSAP and the
970 * LSAP, like this, or should we check just the
971 * DSAP?
972 */
973 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
974 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
975 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
976 gen_and(b0, b1);
977 return b1;
978
979 case LLCSAP_NETBEUI:
980 /*
981 * NetBEUI always uses 802.2 encapsulation.
982 * XXX - should we check both the DSAP and the
983 * LSAP, like this, or should we check just the
984 * DSAP?
985 */
986 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
987 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
988 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI));
989 gen_and(b0, b1);
990 return b1;
991
992 case LLCSAP_IPX:
993 /*
994 * Ethernet_II frames, which are Ethernet
995 * frames with a frame type of ETHERTYPE_IPX;
996 *
997 * Ethernet_802.3 frames, which have a frame
998 * type of LINUX_SLL_P_802_3;
999 *
1000 * Ethernet_802.2 frames, which are 802.3
1001 * frames with an 802.2 LLC header (i.e, have
1002 * a frame type of LINUX_SLL_P_802_2) and
1003 * with the IPX LSAP as the DSAP in the LLC
1004 * header;
1005 *
1006 * Ethernet_SNAP frames, which are 802.3
1007 * frames with an LLC header and a SNAP
1008 * header and with an OUI of 0x000000
1009 * (encapsulated Ethernet) and a protocol
1010 * ID of ETHERTYPE_IPX in the SNAP header.
1011 *
1012 * First, do the checks on LINUX_SLL_P_802_2
1013 * frames; generate the check for either
1014 * Ethernet_802.2 or Ethernet_SNAP frames, and
1015 * then put a check for LINUX_SLL_P_802_2 frames
1016 * before it.
1017 */
1018 b0 = gen_cmp(off_linktype + 2, BPF_B,
1019 (bpf_int32)LLCSAP_IPX);
1020 b1 = gen_snap(0x000000, ETHERTYPE_IPX,
1021 off_linktype + 2);
1022 gen_or(b0, b1);
1023 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1024 gen_and(b0, b1);
1025
1026 /*
1027 * Now check for 802.3 frames and OR that with
1028 * the previous test.
1029 */
1030 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
1031 gen_or(b0, b1);
1032
1033 /*
1034 * Now add the check for Ethernet_II frames, and
1035 * do that before checking for the other frame
1036 * types.
1037 */
1038 b0 = gen_cmp(off_linktype, BPF_H,
1039 (bpf_int32)ETHERTYPE_IPX);
1040 gen_or(b0, b1);
1041 return b1;
1042
1043 case ETHERTYPE_ATALK:
1044 case ETHERTYPE_AARP:
1045 /*
1046 * EtherTalk (AppleTalk protocols on Ethernet link
1047 * layer) may use 802.2 encapsulation.
1048 */
1049
1050 /*
1051 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1052 * we check for the 802.2 protocol type in the
1053 * "Ethernet type" field.
1054 */
1055 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
1056
1057 /*
1058 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1059 * SNAP packets with an organization code of
1060 * 0x080007 (Apple, for Appletalk) and a protocol
1061 * type of ETHERTYPE_ATALK (Appletalk).
1062 *
1063 * 802.2-encapsulated ETHERTYPE_AARP packets are
1064 * SNAP packets with an organization code of
1065 * 0x000000 (encapsulated Ethernet) and a protocol
1066 * type of ETHERTYPE_AARP (Appletalk ARP).
1067 */
1068 if (proto == ETHERTYPE_ATALK)
1069 b1 = gen_snap(0x080007, ETHERTYPE_ATALK,
1070 off_linktype + 2);
1071 else /* proto == ETHERTYPE_AARP */
1072 b1 = gen_snap(0x000000, ETHERTYPE_AARP,
1073 off_linktype + 2);
1074 gen_and(b0, b1);
1075
1076 /*
1077 * Check for Ethernet encapsulation (Ethertalk
1078 * phase 1?); we just check for the Ethernet
1079 * protocol type.
1080 */
1081 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1082
1083 gen_or(b0, b1);
1084 return b1;
1085
1086 default:
1087 if (proto <= ETHERMTU) {
1088 /*
1089 * This is an LLC SAP value, so the frames
1090 * that match would be 802.2 frames.
1091 * Check for the 802.2 protocol type
1092 * in the "Ethernet type" field, and
1093 * then check the DSAP.
1094 */
1095 b0 = gen_cmp(off_linktype, BPF_H,
1096 LINUX_SLL_P_802_2);
1097 b1 = gen_cmp(off_linktype + 2, BPF_B,
1098 (bpf_int32)proto);
1099 gen_and(b0, b1);
1100 return b1;
1101 } else {
1102 /*
1103 * This is an Ethernet type, so compare
1104 * the length/type field with it (if
1105 * the frame is an 802.2 frame, the length
1106 * field will be <= ETHERMTU, and, as
1107 * "proto" is > ETHERMTU, this test
1108 * will fail and the frame won't match,
1109 * which is what we want).
1110 */
1111 return gen_cmp(off_linktype, BPF_H,
1112 (bpf_int32)proto);
1113 }
1114 }
1115 break;
1116
1117 case DLT_SLIP:
1118 case DLT_SLIP_BSDOS:
1119 case DLT_RAW:
1120 /*
1121 * These types don't provide any type field; packets
1122 * are always IP.
1123 *
1124 * XXX - for IPv4, check for a version number of 4, and,
1125 * for IPv6, check for a version number of 6?
1126 */
1127 switch (proto) {
1128
1129 case ETHERTYPE_IP:
1130 #ifdef INET6
1131 case ETHERTYPE_IPV6:
1132 #endif
1133 return gen_true(); /* always true */
1134
1135 default:
1136 return gen_false(); /* always false */
1137 }
1138 break;
1139
1140 case DLT_PPP:
1141 case DLT_PPP_SERIAL:
1142 /*
1143 * We use Ethernet protocol types inside libpcap;
1144 * map them to the corresponding PPP protocol types.
1145 */
1146 switch (proto) {
1147
1148 case ETHERTYPE_IP:
1149 proto = PPP_IP; /* XXX was 0x21 */
1150 break;
1151
1152 #ifdef INET6
1153 case ETHERTYPE_IPV6:
1154 proto = PPP_IPV6;
1155 break;
1156 #endif
1157
1158 case ETHERTYPE_DN:
1159 proto = PPP_DECNET;
1160 break;
1161
1162 case ETHERTYPE_ATALK:
1163 proto = PPP_APPLE;
1164 break;
1165
1166 case ETHERTYPE_NS:
1167 proto = PPP_NS;
1168 break;
1169
1170 case LLCSAP_ISONS:
1171 proto = PPP_OSI;
1172 break;
1173
1174 case LLCSAP_8021D:
1175 /*
1176 * I'm assuming the "Bridging PDU"s that go
1177 * over PPP are Spanning Tree Protocol
1178 * Bridging PDUs.
1179 */
1180 proto = PPP_BRPDU;
1181 break;
1182
1183 case LLCSAP_IPX:
1184 proto = PPP_IPX;
1185 break;
1186 }
1187 break;
1188
1189 case DLT_PPP_BSDOS:
1190 /*
1191 * We use Ethernet protocol types inside libpcap;
1192 * map them to the corresponding PPP protocol types.
1193 */
1194 switch (proto) {
1195
1196 case ETHERTYPE_IP:
1197 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
1198 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
1199 gen_or(b0, b1);
1200 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
1201 gen_or(b1, b0);
1202 return b0;
1203
1204 #ifdef INET6
1205 case ETHERTYPE_IPV6:
1206 proto = PPP_IPV6;
1207 /* more to go? */
1208 break;
1209 #endif
1210
1211 case ETHERTYPE_DN:
1212 proto = PPP_DECNET;
1213 break;
1214
1215 case ETHERTYPE_ATALK:
1216 proto = PPP_APPLE;
1217 break;
1218
1219 case ETHERTYPE_NS:
1220 proto = PPP_NS;
1221 break;
1222
1223 case LLCSAP_ISONS:
1224 proto = PPP_OSI;
1225 break;
1226
1227 case LLCSAP_8021D:
1228 /*
1229 * I'm assuming the "Bridging PDU"s that go
1230 * over PPP are Spanning Tree Protocol
1231 * Bridging PDUs.
1232 */
1233 proto = PPP_BRPDU;
1234 break;
1235
1236 case LLCSAP_IPX:
1237 proto = PPP_IPX;
1238 break;
1239 }
1240 break;
1241
1242 case DLT_NULL:
1243 case DLT_LOOP:
1244 /*
1245 * For DLT_NULL, the link-layer header is a 32-bit
1246 * word containing an AF_ value in *host* byte order.
1247 *
1248 * In addition, if we're reading a saved capture file,
1249 * the host byte order in the capture may not be the
1250 * same as the host byte order on this machine.
1251 *
1252 * For DLT_LOOP, the link-layer header is a 32-bit
1253 * word containing an AF_ value in *network* byte order.
1254 *
1255 * XXX - AF_ values may, unfortunately, be platform-
1256 * dependent; for example, FreeBSD's AF_INET6 is 24
1257 * whilst NetBSD's and OpenBSD's is 26.
1258 *
1259 * This means that, when reading a capture file, just
1260 * checking for our AF_INET6 value won't work if the
1261 * capture file came from another OS.
1262 */
1263 switch (proto) {
1264
1265 case ETHERTYPE_IP:
1266 proto = AF_INET;
1267 break;
1268
1269 #ifdef INET6
1270 case ETHERTYPE_IPV6:
1271 proto = AF_INET6;
1272 break;
1273 #endif
1274
1275 default:
1276 /*
1277 * Not a type on which we support filtering.
1278 * XXX - support those that have AF_ values
1279 * #defined on this platform, at least?
1280 */
1281 return gen_false();
1282 }
1283
1284 if (linktype == DLT_NULL) {
1285 /*
1286 * The AF_ value is in host byte order, but
1287 * the BPF interpreter will convert it to
1288 * network byte order.
1289 *
1290 * If this is a save file, and it's from a
1291 * machine with the opposite byte order to
1292 * ours, we byte-swap the AF_ value.
1293 *
1294 * Then we run it through "htonl()", and
1295 * generate code to compare against the result.
1296 */
1297 if (bpf_pcap->sf.rfile != NULL &&
1298 bpf_pcap->sf.swapped)
1299 proto = SWAPLONG(proto);
1300 proto = htonl(proto);
1301 }
1302 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
1303 }
1304
1305 /*
1306 * All the types that have no encapsulation should either be
1307 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
1308 * all packets are IP packets, or should be handled in some
1309 * special case, if none of them are (if some are and some
1310 * aren't, the lack of encapsulation is a problem, as we'd
1311 * have to find some other way of determining the packet type).
1312 *
1313 * Therefore, if "off_linktype" is -1, there's an error.
1314 */
1315 if (off_linktype == -1)
1316 abort();
1317
1318 /*
1319 * Any type not handled above should always have an Ethernet
1320 * type at an offset of "off_linktype". (PPP is partially
1321 * handled above - the protocol type is mapped from the
1322 * Ethernet and LLC types we use internally to the corresponding
1323 * PPP type - but the PPP type is always specified by a value
1324 * at "off_linktype", so we don't have to do the code generation
1325 * above.)
1326 */
1327 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
1328 }
1329
1330 /*
1331 * Check for an LLC SNAP packet with a given organization code and
1332 * protocol type; we check the entire contents of the 802.2 LLC and
1333 * snap headers, checking for DSAP and SSAP of SNAP and a control
1334 * field of 0x03 in the LLC header, and for the specified organization
1335 * code and protocol type in the SNAP header.
1336 */
1337 static struct block *
1338 gen_snap(orgcode, ptype, offset)
1339 bpf_u_int32 orgcode;
1340 bpf_u_int32 ptype;
1341 u_int offset;
1342 {
1343 u_char snapblock[8];
1344
1345 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */
1346 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
1347 snapblock[2] = 0x03; /* control = UI */
1348 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
1349 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */
1350 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */
1351 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */
1352 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */
1353 return gen_bcmp(offset, 8, snapblock);
1354 }
1355
1356 static struct block *
1357 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
1358 bpf_u_int32 addr;
1359 bpf_u_int32 mask;
1360 int dir, proto;
1361 u_int src_off, dst_off;
1362 {
1363 struct block *b0, *b1;
1364 u_int offset;
1365
1366 switch (dir) {
1367
1368 case Q_SRC:
1369 offset = src_off;
1370 break;
1371
1372 case Q_DST:
1373 offset = dst_off;
1374 break;
1375
1376 case Q_AND:
1377 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1378 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1379 gen_and(b0, b1);
1380 return b1;
1381
1382 case Q_OR:
1383 case Q_DEFAULT:
1384 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
1385 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
1386 gen_or(b0, b1);
1387 return b1;
1388
1389 default:
1390 abort();
1391 }
1392 b0 = gen_linktype(proto);
1393 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
1394 gen_and(b0, b1);
1395 return b1;
1396 }
1397
1398 #ifdef INET6
1399 static struct block *
1400 gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
1401 struct in6_addr *addr;
1402 struct in6_addr *mask;
1403 int dir, proto;
1404 u_int src_off, dst_off;
1405 {
1406 struct block *b0, *b1;
1407 u_int offset;
1408 u_int32_t *a, *m;
1409
1410 switch (dir) {
1411
1412 case Q_SRC:
1413 offset = src_off;
1414 break;
1415
1416 case Q_DST:
1417 offset = dst_off;
1418 break;
1419
1420 case Q_AND:
1421 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1422 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1423 gen_and(b0, b1);
1424 return b1;
1425
1426 case Q_OR:
1427 case Q_DEFAULT:
1428 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
1429 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
1430 gen_or(b0, b1);
1431 return b1;
1432
1433 default:
1434 abort();
1435 }
1436 /* this order is important */
1437 a = (u_int32_t *)addr;
1438 m = (u_int32_t *)mask;
1439 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
1440 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
1441 gen_and(b0, b1);
1442 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
1443 gen_and(b0, b1);
1444 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
1445 gen_and(b0, b1);
1446 b0 = gen_linktype(proto);
1447 gen_and(b0, b1);
1448 return b1;
1449 }
1450 #endif /*INET6*/
1451
1452 static struct block *
1453 gen_ehostop(eaddr, dir)
1454 register const u_char *eaddr;
1455 register int dir;
1456 {
1457 register struct block *b0, *b1;
1458
1459 switch (dir) {
1460 case Q_SRC:
1461 return gen_bcmp(6, 6, eaddr);
1462
1463 case Q_DST:
1464 return gen_bcmp(0, 6, eaddr);
1465
1466 case Q_AND:
1467 b0 = gen_ehostop(eaddr, Q_SRC);
1468 b1 = gen_ehostop(eaddr, Q_DST);
1469 gen_and(b0, b1);
1470 return b1;
1471
1472 case Q_DEFAULT:
1473 case Q_OR:
1474 b0 = gen_ehostop(eaddr, Q_SRC);
1475 b1 = gen_ehostop(eaddr, Q_DST);
1476 gen_or(b0, b1);
1477 return b1;
1478 }
1479 abort();
1480 /* NOTREACHED */
1481 }
1482
1483 /*
1484 * Like gen_ehostop, but for DLT_FDDI
1485 */
1486 static struct block *
1487 gen_fhostop(eaddr, dir)
1488 register const u_char *eaddr;
1489 register int dir;
1490 {
1491 struct block *b0, *b1;
1492
1493 switch (dir) {
1494 case Q_SRC:
1495 #ifdef PCAP_FDDIPAD
1496 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
1497 #else
1498 return gen_bcmp(6 + 1, 6, eaddr);
1499 #endif
1500
1501 case Q_DST:
1502 #ifdef PCAP_FDDIPAD
1503 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
1504 #else
1505 return gen_bcmp(0 + 1, 6, eaddr);
1506 #endif
1507
1508 case Q_AND:
1509 b0 = gen_fhostop(eaddr, Q_SRC);
1510 b1 = gen_fhostop(eaddr, Q_DST);
1511 gen_and(b0, b1);
1512 return b1;
1513
1514 case Q_DEFAULT:
1515 case Q_OR:
1516 b0 = gen_fhostop(eaddr, Q_SRC);
1517 b1 = gen_fhostop(eaddr, Q_DST);
1518 gen_or(b0, b1);
1519 return b1;
1520 }
1521 abort();
1522 /* NOTREACHED */
1523 }
1524
1525 /*
1526 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
1527 */
1528 static struct block *
1529 gen_thostop(eaddr, dir)
1530 register const u_char *eaddr;
1531 register int dir;
1532 {
1533 register struct block *b0, *b1;
1534
1535 switch (dir) {
1536 case Q_SRC:
1537 return gen_bcmp(8, 6, eaddr);
1538
1539 case Q_DST:
1540 return gen_bcmp(2, 6, eaddr);
1541
1542 case Q_AND:
1543 b0 = gen_thostop(eaddr, Q_SRC);
1544 b1 = gen_thostop(eaddr, Q_DST);
1545 gen_and(b0, b1);
1546 return b1;
1547
1548 case Q_DEFAULT:
1549 case Q_OR:
1550 b0 = gen_thostop(eaddr, Q_SRC);
1551 b1 = gen_thostop(eaddr, Q_DST);
1552 gen_or(b0, b1);
1553 return b1;
1554 }
1555 abort();
1556 /* NOTREACHED */
1557 }
1558
1559 /*
1560 * This is quite tricky because there may be pad bytes in front of the
1561 * DECNET header, and then there are two possible data packet formats that
1562 * carry both src and dst addresses, plus 5 packet types in a format that
1563 * carries only the src node, plus 2 types that use a different format and
1564 * also carry just the src node.
1565 *
1566 * Yuck.
1567 *
1568 * Instead of doing those all right, we just look for data packets with
1569 * 0 or 1 bytes of padding. If you want to look at other packets, that
1570 * will require a lot more hacking.
1571 *
1572 * To add support for filtering on DECNET "areas" (network numbers)
1573 * one would want to add a "mask" argument to this routine. That would
1574 * make the filter even more inefficient, although one could be clever
1575 * and not generate masking instructions if the mask is 0xFFFF.
1576 */
1577 static struct block *
1578 gen_dnhostop(addr, dir, base_off)
1579 bpf_u_int32 addr;
1580 int dir;
1581 u_int base_off;
1582 {
1583 struct block *b0, *b1, *b2, *tmp;
1584 u_int offset_lh; /* offset if long header is received */
1585 u_int offset_sh; /* offset if short header is received */
1586
1587 switch (dir) {
1588
1589 case Q_DST:
1590 offset_sh = 1; /* follows flags */
1591 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */
1592 break;
1593
1594 case Q_SRC:
1595 offset_sh = 3; /* follows flags, dstnode */
1596 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
1597 break;
1598
1599 case Q_AND:
1600 /* Inefficient because we do our Calvinball dance twice */
1601 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1602 b1 = gen_dnhostop(addr, Q_DST, base_off);
1603 gen_and(b0, b1);
1604 return b1;
1605
1606 case Q_OR:
1607 case Q_DEFAULT:
1608 /* Inefficient because we do our Calvinball dance twice */
1609 b0 = gen_dnhostop(addr, Q_SRC, base_off);
1610 b1 = gen_dnhostop(addr, Q_DST, base_off);
1611 gen_or(b0, b1);
1612 return b1;
1613
1614 case Q_ISO:
1615 bpf_error("ISO host filtering not implemented");
1616
1617 default:
1618 abort();
1619 }
1620 b0 = gen_linktype(ETHERTYPE_DN);
1621 /* Check for pad = 1, long header case */
1622 tmp = gen_mcmp(base_off + 2, BPF_H,
1623 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
1624 b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
1625 BPF_H, (bpf_int32)ntohs(addr));
1626 gen_and(tmp, b1);
1627 /* Check for pad = 0, long header case */
1628 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
1629 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
1630 gen_and(tmp, b2);
1631 gen_or(b2, b1);
1632 /* Check for pad = 1, short header case */
1633 tmp = gen_mcmp(base_off + 2, BPF_H,
1634 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
1635 b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
1636 BPF_H, (bpf_int32)ntohs(addr));
1637 gen_and(tmp, b2);
1638 gen_or(b2, b1);
1639 /* Check for pad = 0, short header case */
1640 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
1641 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
1642 gen_and(tmp, b2);
1643 gen_or(b2, b1);
1644
1645 /* Combine with test for linktype */
1646 gen_and(b0, b1);
1647 return b1;
1648 }
1649
1650 static struct block *
1651 gen_host(addr, mask, proto, dir)
1652 bpf_u_int32 addr;
1653 bpf_u_int32 mask;
1654 int proto;
1655 int dir;
1656 {
1657 struct block *b0, *b1;
1658
1659 switch (proto) {
1660
1661 case Q_DEFAULT:
1662 b0 = gen_host(addr, mask, Q_IP, dir);
1663 if (off_linktype != -1) {
1664 b1 = gen_host(addr, mask, Q_ARP, dir);
1665 gen_or(b0, b1);
1666 b0 = gen_host(addr, mask, Q_RARP, dir);
1667 gen_or(b1, b0);
1668 }
1669 return b0;
1670
1671 case Q_IP:
1672 return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
1673 off_nl + 12, off_nl + 16);
1674
1675 case Q_RARP:
1676 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
1677 off_nl + 14, off_nl + 24);
1678
1679 case Q_ARP:
1680 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
1681 off_nl + 14, off_nl + 24);
1682
1683 case Q_TCP:
1684 bpf_error("'tcp' modifier applied to host");
1685
1686 case Q_UDP:
1687 bpf_error("'udp' modifier applied to host");
1688
1689 case Q_ICMP:
1690 bpf_error("'icmp' modifier applied to host");
1691
1692 case Q_IGMP:
1693 bpf_error("'igmp' modifier applied to host");
1694
1695 case Q_IGRP:
1696 bpf_error("'igrp' modifier applied to host");
1697
1698 case Q_PIM:
1699 bpf_error("'pim' modifier applied to host");
1700
1701 case Q_ATALK:
1702 bpf_error("ATALK host filtering not implemented");
1703
1704 case Q_AARP:
1705 bpf_error("AARP host filtering not implemented");
1706
1707 case Q_DECNET:
1708 return gen_dnhostop(addr, dir, off_nl);
1709
1710 case Q_SCA:
1711 bpf_error("SCA host filtering not implemented");
1712
1713 case Q_LAT:
1714 bpf_error("LAT host filtering not implemented");
1715
1716 case Q_MOPDL:
1717 bpf_error("MOPDL host filtering not implemented");
1718
1719 case Q_MOPRC:
1720 bpf_error("MOPRC host filtering not implemented");
1721
1722 #ifdef INET6
1723 case Q_IPV6:
1724 bpf_error("'ip6' modifier applied to ip host");
1725
1726 case Q_ICMPV6:
1727 bpf_error("'icmp6' modifier applied to host");
1728 #endif /* INET6 */
1729
1730 case Q_AH:
1731 bpf_error("'ah' modifier applied to host");
1732
1733 case Q_ESP:
1734 bpf_error("'esp' modifier applied to host");
1735
1736 case Q_ISO:
1737 bpf_error("ISO host filtering not implemented");
1738
1739 case Q_ESIS:
1740 bpf_error("'esis' modifier applied to host");
1741
1742 case Q_ISIS:
1743 bpf_error("'isis' modifier applied to host");
1744
1745 case Q_CLNP:
1746 bpf_error("'clnp' modifier applied to host");
1747
1748 case Q_STP:
1749 bpf_error("'stp' modifier applied to host");
1750
1751 case Q_IPX:
1752 bpf_error("IPX host filtering not implemented");
1753
1754 case Q_NETBEUI:
1755 bpf_error("'netbeui' modifier applied to host");
1756
1757 default:
1758 abort();
1759 }
1760 /* NOTREACHED */
1761 }
1762
1763 #ifdef INET6
1764 static struct block *
1765 gen_host6(addr, mask, proto, dir)
1766 struct in6_addr *addr;
1767 struct in6_addr *mask;
1768 int proto;
1769 int dir;
1770 {
1771 switch (proto) {
1772
1773 case Q_DEFAULT:
1774 return gen_host6(addr, mask, Q_IPV6, dir);
1775
1776 case Q_IP:
1777 bpf_error("'ip' modifier applied to ip6 host");
1778
1779 case Q_RARP:
1780 bpf_error("'rarp' modifier applied to ip6 host");
1781
1782 case Q_ARP:
1783 bpf_error("'arp' modifier applied to ip6 host");
1784
1785 case Q_TCP:
1786 bpf_error("'tcp' modifier applied to host");
1787
1788 case Q_UDP:
1789 bpf_error("'udp' modifier applied to host");
1790
1791 case Q_ICMP:
1792 bpf_error("'icmp' modifier applied to host");
1793
1794 case Q_IGMP:
1795 bpf_error("'igmp' modifier applied to host");
1796
1797 case Q_IGRP:
1798 bpf_error("'igrp' modifier applied to host");
1799
1800 case Q_PIM:
1801 bpf_error("'pim' modifier applied to host");
1802
1803 case Q_ATALK:
1804 bpf_error("ATALK host filtering not implemented");
1805
1806 case Q_AARP:
1807 bpf_error("AARP host filtering not implemented");
1808
1809 case Q_DECNET:
1810 bpf_error("'decnet' modifier applied to ip6 host");
1811
1812 case Q_SCA:
1813 bpf_error("SCA host filtering not implemented");
1814
1815 case Q_LAT:
1816 bpf_error("LAT host filtering not implemented");
1817
1818 case Q_MOPDL:
1819 bpf_error("MOPDL host filtering not implemented");
1820
1821 case Q_MOPRC:
1822 bpf_error("MOPRC host filtering not implemented");
1823
1824 case Q_IPV6:
1825 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
1826 off_nl + 8, off_nl + 24);
1827
1828 case Q_ICMPV6:
1829 bpf_error("'icmp6' modifier applied to host");
1830
1831 case Q_AH:
1832 bpf_error("'ah' modifier applied to host");
1833
1834 case Q_ESP:
1835 bpf_error("'esp' modifier applied to host");
1836
1837 case Q_ISO:
1838 bpf_error("ISO host filtering not implemented");
1839
1840 case Q_ESIS:
1841 bpf_error("'esis' modifier applied to host");
1842
1843 case Q_ISIS:
1844 bpf_error("'isis' modifier applied to host");
1845
1846 case Q_CLNP:
1847 bpf_error("'clnp' modifier applied to host");
1848
1849 case Q_STP:
1850 bpf_error("'stp' modifier applied to host");
1851
1852 case Q_IPX:
1853 bpf_error("IPX host filtering not implemented");
1854
1855 case Q_NETBEUI:
1856 bpf_error("'netbeui' modifier applied to host");
1857
1858 default:
1859 abort();
1860 }
1861 /* NOTREACHED */
1862 }
1863 #endif /*INET6*/
1864
1865 #ifndef INET6
1866 static struct block *
1867 gen_gateway(eaddr, alist, proto, dir)
1868 const u_char *eaddr;
1869 bpf_u_int32 **alist;
1870 int proto;
1871 int dir;
1872 {
1873 struct block *b0, *b1, *tmp;
1874
1875 if (dir != 0)
1876 bpf_error("direction applied to 'gateway'");
1877
1878 switch (proto) {
1879 case Q_DEFAULT:
1880 case Q_IP:
1881 case Q_ARP:
1882 case Q_RARP:
1883 if (linktype == DLT_EN10MB)
1884 b0 = gen_ehostop(eaddr, Q_OR);
1885 else if (linktype == DLT_FDDI)
1886 b0 = gen_fhostop(eaddr, Q_OR);
1887 else if (linktype == DLT_IEEE802)
1888 b0 = gen_thostop(eaddr, Q_OR);
1889 else
1890 bpf_error(
1891 "'gateway' supported only on ethernet, FDDI or token ring");
1892
1893 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
1894 while (*alist) {
1895 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR);
1896 gen_or(b1, tmp);
1897 b1 = tmp;
1898 }
1899 gen_not(b1);
1900 gen_and(b0, b1);
1901 return b1;
1902 }
1903 bpf_error("illegal modifier of 'gateway'");
1904 /* NOTREACHED */
1905 }
1906 #endif
1907
1908 struct block *
1909 gen_proto_abbrev(proto)
1910 int proto;
1911 {
1912 #ifdef INET6
1913 struct block *b0;
1914 #endif
1915 struct block *b1;
1916
1917 switch (proto) {
1918
1919 case Q_TCP:
1920 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
1921 #ifdef INET6
1922 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
1923 gen_or(b0, b1);
1924 #endif
1925 break;
1926
1927 case Q_UDP:
1928 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT);
1929 #ifdef INET6
1930 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
1931 gen_or(b0, b1);
1932 #endif
1933 break;
1934
1935 case Q_ICMP:
1936 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT);
1937 break;
1938
1939 #ifndef IPPROTO_IGMP
1940 #define IPPROTO_IGMP 2
1941 #endif
1942
1943 case Q_IGMP:
1944 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT);
1945 break;
1946
1947 #ifndef IPPROTO_IGRP
1948 #define IPPROTO_IGRP 9
1949 #endif
1950 case Q_IGRP:
1951 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT);
1952 break;
1953
1954 #ifndef IPPROTO_PIM
1955 #define IPPROTO_PIM 103
1956 #endif
1957
1958 case Q_PIM:
1959 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT);
1960 #ifdef INET6
1961 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
1962 gen_or(b0, b1);
1963 #endif
1964 break;
1965
1966 case Q_IP:
1967 b1 = gen_linktype(ETHERTYPE_IP);
1968 break;
1969
1970 case Q_ARP:
1971 b1 = gen_linktype(ETHERTYPE_ARP);
1972 break;
1973
1974 case Q_RARP:
1975 b1 = gen_linktype(ETHERTYPE_REVARP);
1976 break;
1977
1978 case Q_LINK:
1979 bpf_error("link layer applied in wrong context");
1980
1981 case Q_ATALK:
1982 b1 = gen_linktype(ETHERTYPE_ATALK);
1983 break;
1984
1985 case Q_AARP:
1986 b1 = gen_linktype(ETHERTYPE_AARP);
1987 break;
1988
1989 case Q_DECNET:
1990 b1 = gen_linktype(ETHERTYPE_DN);
1991 break;
1992
1993 case Q_SCA:
1994 b1 = gen_linktype(ETHERTYPE_SCA);
1995 break;
1996
1997 case Q_LAT:
1998 b1 = gen_linktype(ETHERTYPE_LAT);
1999 break;
2000
2001 case Q_MOPDL:
2002 b1 = gen_linktype(ETHERTYPE_MOPDL);
2003 break;
2004
2005 case Q_MOPRC:
2006 b1 = gen_linktype(ETHERTYPE_MOPRC);
2007 break;
2008
2009 #ifdef INET6
2010 case Q_IPV6:
2011 b1 = gen_linktype(ETHERTYPE_IPV6);
2012 break;
2013
2014 #ifndef IPPROTO_ICMPV6
2015 #define IPPROTO_ICMPV6 58
2016 #endif
2017 case Q_ICMPV6:
2018 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
2019 break;
2020 #endif /* INET6 */
2021
2022 #ifndef IPPROTO_AH
2023 #define IPPROTO_AH 51
2024 #endif
2025 case Q_AH:
2026 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT);
2027 #ifdef INET6
2028 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT);
2029 gen_or(b0, b1);
2030 #endif
2031 break;
2032
2033 #ifndef IPPROTO_ESP
2034 #define IPPROTO_ESP 50
2035 #endif
2036 case Q_ESP:
2037 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT);
2038 #ifdef INET6
2039 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
2040 gen_or(b0, b1);
2041 #endif
2042 break;
2043
2044 case Q_ISO:
2045 b1 = gen_linktype(LLCSAP_ISONS);
2046 break;
2047
2048 case Q_ESIS:
2049 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT);
2050 break;
2051
2052 case Q_ISIS:
2053 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
2054 break;
2055
2056 case Q_CLNP:
2057 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT);
2058 break;
2059
2060 case Q_STP:
2061 b1 = gen_linktype(LLCSAP_8021D);
2062 break;
2063
2064 case Q_IPX:
2065 b1 = gen_linktype(LLCSAP_IPX);
2066 break;
2067
2068 case Q_NETBEUI:
2069 b1 = gen_linktype(LLCSAP_NETBEUI);
2070 break;
2071
2072 default:
2073 abort();
2074 }
2075 return b1;
2076 }
2077
2078 static struct block *
2079 gen_ipfrag()
2080 {
2081 struct slist *s;
2082 struct block *b;
2083
2084 /* not ip frag */
2085 s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
2086 s->s.k = off_nl + 6;
2087 b = new_block(JMP(BPF_JSET));
2088 b->s.k = 0x1fff;
2089 b->stmts = s;
2090 gen_not(b);
2091
2092 return b;
2093 }
2094
2095 static struct block *
2096 gen_portatom(off, v)
2097 int off;
2098 bpf_int32 v;
2099 {
2100 struct slist *s;
2101 struct block *b;
2102
2103 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2104 s->s.k = off_nl;
2105
2106 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
2107 s->next->s.k = off_nl + off;
2108
2109 b = new_block(JMP(BPF_JEQ));
2110 b->stmts = s;
2111 b->s.k = v;
2112
2113 return b;
2114 }
2115
2116 #ifdef INET6
2117 static struct block *
2118 gen_portatom6(off, v)
2119 int off;
2120 bpf_int32 v;
2121 {
2122 return gen_cmp(off_nl + 40 + off, BPF_H, v);
2123 }
2124 #endif/*INET6*/
2125
2126 struct block *
2127 gen_portop(port, proto, dir)
2128 int port, proto, dir;
2129 {
2130 struct block *b0, *b1, *tmp;
2131
2132 /* ip proto 'proto' */
2133 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
2134 b0 = gen_ipfrag();
2135 gen_and(tmp, b0);
2136
2137 switch (dir) {
2138 case Q_SRC:
2139 b1 = gen_portatom(0, (bpf_int32)port);
2140 break;
2141
2142 case Q_DST:
2143 b1 = gen_portatom(2, (bpf_int32)port);
2144 break;
2145
2146 case Q_OR:
2147 case Q_DEFAULT:
2148 tmp = gen_portatom(0, (bpf_int32)port);
2149 b1 = gen_portatom(2, (bpf_int32)port);
2150 gen_or(tmp, b1);
2151 break;
2152
2153 case Q_AND:
2154 tmp = gen_portatom(0, (bpf_int32)port);
2155 b1 = gen_portatom(2, (bpf_int32)port);
2156 gen_and(tmp, b1);
2157 break;
2158
2159 default:
2160 abort();
2161 }
2162 gen_and(b0, b1);
2163
2164 return b1;
2165 }
2166
2167 static struct block *
2168 gen_port(port, ip_proto, dir)
2169 int port;
2170 int ip_proto;
2171 int dir;
2172 {
2173 struct block *b0, *b1, *tmp;
2174
2175 /* ether proto ip */
2176 b0 = gen_linktype(ETHERTYPE_IP);
2177
2178 switch (ip_proto) {
2179 case IPPROTO_UDP:
2180 case IPPROTO_TCP:
2181 b1 = gen_portop(port, ip_proto, dir);
2182 break;
2183
2184 case PROTO_UNDEF:
2185 tmp = gen_portop(port, IPPROTO_TCP, dir);
2186 b1 = gen_portop(port, IPPROTO_UDP, dir);
2187 gen_or(tmp, b1);
2188 break;
2189
2190 default:
2191 abort();
2192 }
2193 gen_and(b0, b1);
2194 return b1;
2195 }
2196
2197 #ifdef INET6
2198 struct block *
2199 gen_portop6(port, proto, dir)
2200 int port, proto, dir;
2201 {
2202 struct block *b0, *b1, *tmp;
2203
2204 /* ip proto 'proto' */
2205 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
2206
2207 switch (dir) {
2208 case Q_SRC:
2209 b1 = gen_portatom6(0, (bpf_int32)port);
2210 break;
2211
2212 case Q_DST:
2213 b1 = gen_portatom6(2, (bpf_int32)port);
2214 break;
2215
2216 case Q_OR:
2217 case Q_DEFAULT:
2218 tmp = gen_portatom6(0, (bpf_int32)port);
2219 b1 = gen_portatom6(2, (bpf_int32)port);
2220 gen_or(tmp, b1);
2221 break;
2222
2223 case Q_AND:
2224 tmp = gen_portatom6(0, (bpf_int32)port);
2225 b1 = gen_portatom6(2, (bpf_int32)port);
2226 gen_and(tmp, b1);
2227 break;
2228
2229 default:
2230 abort();
2231 }
2232 gen_and(b0, b1);
2233
2234 return b1;
2235 }
2236
2237 static struct block *
2238 gen_port6(port, ip_proto, dir)
2239 int port;
2240 int ip_proto;
2241 int dir;
2242 {
2243 struct block *b0, *b1, *tmp;
2244
2245 /* ether proto ip */
2246 b0 = gen_linktype(ETHERTYPE_IPV6);
2247
2248 switch (ip_proto) {
2249 case IPPROTO_UDP:
2250 case IPPROTO_TCP:
2251 b1 = gen_portop6(port, ip_proto, dir);
2252 break;
2253
2254 case PROTO_UNDEF:
2255 tmp = gen_portop6(port, IPPROTO_TCP, dir);
2256 b1 = gen_portop6(port, IPPROTO_UDP, dir);
2257 gen_or(tmp, b1);
2258 break;
2259
2260 default:
2261 abort();
2262 }
2263 gen_and(b0, b1);
2264 return b1;
2265 }
2266 #endif /* INET6 */
2267
2268 static int
2269 lookup_proto(name, proto)
2270 register const char *name;
2271 register int proto;
2272 {
2273 register int v;
2274
2275 switch (proto) {
2276
2277 case Q_DEFAULT:
2278 case Q_IP:
2279 v = pcap_nametoproto(name);
2280 if (v == PROTO_UNDEF)
2281 bpf_error("unknown ip proto '%s'", name);
2282 break;
2283
2284 case Q_LINK:
2285 /* XXX should look up h/w protocol type based on linktype */
2286 v = pcap_nametoeproto(name);
2287 if (v == PROTO_UNDEF)
2288 bpf_error("unknown ether proto '%s'", name);
2289 break;
2290
2291 case Q_ISO:
2292 if (strcmp(name, "esis") == 0)
2293 v = ISO9542_ESIS;
2294 else if (strcmp(name, "isis") == 0)
2295 v = ISO10589_ISIS;
2296 else if (strcmp(name, "clnp") == 0)
2297 v = ISO8473_CLNP;
2298 else
2299 bpf_error("unknown osi proto '%s'", name);
2300 break;
2301
2302 default:
2303 v = PROTO_UNDEF;
2304 break;
2305 }
2306 return v;
2307 }
2308
2309 #if 0
2310 struct stmt *
2311 gen_joinsp(s, n)
2312 struct stmt **s;
2313 int n;
2314 {
2315 return NULL;
2316 }
2317 #endif
2318
2319 static struct block *
2320 gen_protochain(v, proto, dir)
2321 int v;
2322 int proto;
2323 int dir;
2324 {
2325 #ifdef NO_PROTOCHAIN
2326 return gen_proto(v, proto, dir);
2327 #else
2328 struct block *b0, *b;
2329 struct slist *s[100];
2330 int fix2, fix3, fix4, fix5;
2331 int ahcheck, again, end;
2332 int i, max;
2333 int reg2 = alloc_reg();
2334
2335 memset(s, 0, sizeof(s));
2336 fix2 = fix3 = fix4 = fix5 = 0;
2337
2338 switch (proto) {
2339 case Q_IP:
2340 case Q_IPV6:
2341 break;
2342 case Q_DEFAULT:
2343 b0 = gen_protochain(v, Q_IP, dir);
2344 b = gen_protochain(v, Q_IPV6, dir);
2345 gen_or(b0, b);
2346 return b;
2347 default:
2348 bpf_error("bad protocol applied for 'protochain'");
2349 /*NOTREACHED*/
2350 }
2351
2352 no_optimize = 1; /*this code is not compatible with optimzer yet */
2353
2354 /*
2355 * s[0] is a dummy entry to protect other BPF insn from damaged
2356 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
2357 * hard to find interdependency made by jump table fixup.
2358 */
2359 i = 0;
2360 s[i] = new_stmt(0); /*dummy*/
2361 i++;
2362
2363 switch (proto) {
2364 case Q_IP:
2365 b0 = gen_linktype(ETHERTYPE_IP);
2366
2367 /* A = ip->ip_p */
2368 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2369 s[i]->s.k = off_nl + 9;
2370 i++;
2371 /* X = ip->ip_hl << 2 */
2372 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2373 s[i]->s.k = off_nl;
2374 i++;
2375 break;
2376 #ifdef INET6
2377 case Q_IPV6:
2378 b0 = gen_linktype(ETHERTYPE_IPV6);
2379
2380 /* A = ip6->ip_nxt */
2381 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
2382 s[i]->s.k = off_nl + 6;
2383 i++;
2384 /* X = sizeof(struct ip6_hdr) */
2385 s[i] = new_stmt(BPF_LDX|BPF_IMM);
2386 s[i]->s.k = 40;
2387 i++;
2388 break;
2389 #endif
2390 default:
2391 bpf_error("unsupported proto to gen_protochain");
2392 /*NOTREACHED*/
2393 }
2394
2395 /* again: if (A == v) goto end; else fall through; */
2396 again = i;
2397 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2398 s[i]->s.k = v;
2399 s[i]->s.jt = NULL; /*later*/
2400 s[i]->s.jf = NULL; /*update in next stmt*/
2401 fix5 = i;
2402 i++;
2403
2404 #ifndef IPPROTO_NONE
2405 #define IPPROTO_NONE 59
2406 #endif
2407 /* if (A == IPPROTO_NONE) goto end */
2408 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2409 s[i]->s.jt = NULL; /*later*/
2410 s[i]->s.jf = NULL; /*update in next stmt*/
2411 s[i]->s.k = IPPROTO_NONE;
2412 s[fix5]->s.jf = s[i];
2413 fix2 = i;
2414 i++;
2415
2416 #ifdef INET6
2417 if (proto == Q_IPV6) {
2418 int v6start, v6end, v6advance, j;
2419
2420 v6start = i;
2421 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
2422 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2423 s[i]->s.jt = NULL; /*later*/
2424 s[i]->s.jf = NULL; /*update in next stmt*/
2425 s[i]->s.k = IPPROTO_HOPOPTS;
2426 s[fix2]->s.jf = s[i];
2427 i++;
2428 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
2429 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2430 s[i]->s.jt = NULL; /*later*/
2431 s[i]->s.jf = NULL; /*update in next stmt*/
2432 s[i]->s.k = IPPROTO_DSTOPTS;
2433 i++;
2434 /* if (A == IPPROTO_ROUTING) goto v6advance */
2435 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2436 s[i]->s.jt = NULL; /*later*/
2437 s[i]->s.jf = NULL; /*update in next stmt*/
2438 s[i]->s.k = IPPROTO_ROUTING;
2439 i++;
2440 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
2441 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2442 s[i]->s.jt = NULL; /*later*/
2443 s[i]->s.jf = NULL; /*later*/
2444 s[i]->s.k = IPPROTO_FRAGMENT;
2445 fix3 = i;
2446 v6end = i;
2447 i++;
2448
2449 /* v6advance: */
2450 v6advance = i;
2451
2452 /*
2453 * in short,
2454 * A = P[X];
2455 * X = X + (P[X + 1] + 1) * 8;
2456 */
2457 /* A = X */
2458 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2459 i++;
2460 /* A = P[X + packet head] */
2461 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2462 s[i]->s.k = off_nl;
2463 i++;
2464 /* MEM[reg2] = A */
2465 s[i] = new_stmt(BPF_ST);
2466 s[i]->s.k = reg2;
2467 i++;
2468 /* A = X */
2469 s[i] = new_stmt(BPF_MISC|BPF_TXA);
2470 i++;
2471 /* A += 1 */
2472 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2473 s[i]->s.k = 1;
2474 i++;
2475 /* X = A */
2476 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2477 i++;
2478 /* A = P[X + packet head]; */
2479 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2480 s[i]->s.k = off_nl;
2481 i++;
2482 /* A += 1 */
2483 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2484 s[i]->s.k = 1;
2485 i++;
2486 /* A *= 8 */
2487 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2488 s[i]->s.k = 8;
2489 i++;
2490 /* X = A; */
2491 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2492 i++;
2493 /* A = MEM[reg2] */
2494 s[i] = new_stmt(BPF_LD|BPF_MEM);
2495 s[i]->s.k = reg2;
2496 i++;
2497
2498 /* goto again; (must use BPF_JA for backward jump) */
2499 s[i] = new_stmt(BPF_JMP|BPF_JA);
2500 s[i]->s.k = again - i - 1;
2501 s[i - 1]->s.jf = s[i];
2502 i++;
2503
2504 /* fixup */
2505 for (j = v6start; j <= v6end; j++)
2506 s[j]->s.jt = s[v6advance];
2507 } else
2508 #endif
2509 {
2510 /* nop */
2511 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2512 s[i]->s.k = 0;
2513 s[fix2]->s.jf = s[i];
2514 i++;
2515 }
2516
2517 /* ahcheck: */
2518 ahcheck = i;
2519 /* if (A == IPPROTO_AH) then fall through; else goto end; */
2520 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
2521 s[i]->s.jt = NULL; /*later*/
2522 s[i]->s.jf = NULL; /*later*/
2523 s[i]->s.k = IPPROTO_AH;
2524 if (fix3)
2525 s[fix3]->s.jf = s[ahcheck];
2526 fix4 = i;
2527 i++;
2528
2529 /*
2530 * in short,
2531 * A = P[X];
2532 * X = X + (P[X + 1] + 2) * 4;
2533 */
2534 /* A = X */
2535 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2536 i++;
2537 /* A = P[X + packet head]; */
2538 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2539 s[i]->s.k = off_nl;
2540 i++;
2541 /* MEM[reg2] = A */
2542 s[i] = new_stmt(BPF_ST);
2543 s[i]->s.k = reg2;
2544 i++;
2545 /* A = X */
2546 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
2547 i++;
2548 /* A += 1 */
2549 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2550 s[i]->s.k = 1;
2551 i++;
2552 /* X = A */
2553 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2554 i++;
2555 /* A = P[X + packet head] */
2556 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
2557 s[i]->s.k = off_nl;
2558 i++;
2559 /* A += 2 */
2560 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2561 s[i]->s.k = 2;
2562 i++;
2563 /* A *= 4 */
2564 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
2565 s[i]->s.k = 4;
2566 i++;
2567 /* X = A; */
2568 s[i] = new_stmt(BPF_MISC|BPF_TAX);
2569 i++;
2570 /* A = MEM[reg2] */
2571 s[i] = new_stmt(BPF_LD|BPF_MEM);
2572 s[i]->s.k = reg2;
2573 i++;
2574
2575 /* goto again; (must use BPF_JA for backward jump) */
2576 s[i] = new_stmt(BPF_JMP|BPF_JA);
2577 s[i]->s.k = again - i - 1;
2578 i++;
2579
2580 /* end: nop */
2581 end = i;
2582 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
2583 s[i]->s.k = 0;
2584 s[fix2]->s.jt = s[end];
2585 s[fix4]->s.jf = s[end];
2586 s[fix5]->s.jt = s[end];
2587 i++;
2588
2589 /*
2590 * make slist chain
2591 */
2592 max = i;
2593 for (i = 0; i < max - 1; i++)
2594 s[i]->next = s[i + 1];
2595 s[max - 1]->next = NULL;
2596
2597 /*
2598 * emit final check
2599 */
2600 b = new_block(JMP(BPF_JEQ));
2601 b->stmts = s[1]; /*remember, s[0] is dummy*/
2602 b->s.k = v;
2603
2604 free_reg(reg2);
2605
2606 gen_and(b0, b);
2607 return b;
2608 #endif
2609 }
2610
2611 static struct block *
2612 gen_proto(v, proto, dir)
2613 int v;
2614 int proto;
2615 int dir;
2616 {
2617 struct block *b0, *b1;
2618
2619 if (dir != Q_DEFAULT)
2620 bpf_error("direction applied to 'proto'");
2621
2622 switch (proto) {
2623 case Q_DEFAULT:
2624 #ifdef INET6
2625 b0 = gen_proto(v, Q_IP, dir);
2626 b1 = gen_proto(v, Q_IPV6, dir);
2627 gen_or(b0, b1);
2628 return b1;
2629 #else
2630 /*FALLTHROUGH*/
2631 #endif
2632 case Q_IP:
2633 b0 = gen_linktype(ETHERTYPE_IP);
2634 #ifndef CHASE_CHAIN
2635 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
2636 #else
2637 b1 = gen_protochain(v, Q_IP);
2638 #endif
2639 gen_and(b0, b1);
2640 return b1;
2641
2642 case Q_ISO:
2643 b0 = gen_linktype(LLCSAP_ISONS);
2644 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v);
2645 gen_and(b0, b1);
2646 return b1;
2647
2648 case Q_ARP:
2649 bpf_error("arp does not encapsulate another protocol");
2650 /* NOTREACHED */
2651
2652 case Q_RARP:
2653 bpf_error("rarp does not encapsulate another protocol");
2654 /* NOTREACHED */
2655
2656 case Q_ATALK:
2657 bpf_error("atalk encapsulation is not specifiable");
2658 /* NOTREACHED */
2659
2660 case Q_DECNET:
2661 bpf_error("decnet encapsulation is not specifiable");
2662 /* NOTREACHED */
2663
2664 case Q_SCA:
2665 bpf_error("sca does not encapsulate another protocol");
2666 /* NOTREACHED */
2667
2668 case Q_LAT:
2669 bpf_error("lat does not encapsulate another protocol");
2670 /* NOTREACHED */
2671
2672 case Q_MOPRC:
2673 bpf_error("moprc does not encapsulate another protocol");
2674 /* NOTREACHED */
2675
2676 case Q_MOPDL:
2677 bpf_error("mopdl does not encapsulate another protocol");
2678 /* NOTREACHED */
2679
2680 case Q_LINK:
2681 return gen_linktype(v);
2682
2683 case Q_UDP:
2684 bpf_error("'udp proto' is bogus");
2685 /* NOTREACHED */
2686
2687 case Q_TCP:
2688 bpf_error("'tcp proto' is bogus");
2689 /* NOTREACHED */
2690
2691 case Q_ICMP:
2692 bpf_error("'icmp proto' is bogus");
2693 /* NOTREACHED */
2694
2695 case Q_IGMP:
2696 bpf_error("'igmp proto' is bogus");
2697 /* NOTREACHED */
2698
2699 case Q_IGRP:
2700 bpf_error("'igrp proto' is bogus");
2701 /* NOTREACHED */
2702
2703 case Q_PIM:
2704 bpf_error("'pim proto' is bogus");
2705 /* NOTREACHED */
2706
2707 #ifdef INET6
2708 case Q_IPV6:
2709 b0 = gen_linktype(ETHERTYPE_IPV6);
2710 #ifndef CHASE_CHAIN
2711 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
2712 #else
2713 b1 = gen_protochain(v, Q_IPV6);
2714 #endif
2715 gen_and(b0, b1);
2716 return b1;
2717
2718 case Q_ICMPV6:
2719 bpf_error("'icmp6 proto' is bogus");
2720 #endif /* INET6 */
2721
2722 case Q_AH:
2723 bpf_error("'ah proto' is bogus");
2724
2725 case Q_ESP:
2726 bpf_error("'ah proto' is bogus");
2727
2728 case Q_STP:
2729 bpf_error("'stp proto' is bogus");
2730
2731 case Q_IPX:
2732 bpf_error("'ipx proto' is bogus");
2733
2734 case Q_NETBEUI:
2735 bpf_error("'netbeui proto' is bogus");
2736
2737 default:
2738 abort();
2739 /* NOTREACHED */
2740 }
2741 /* NOTREACHED */
2742 }
2743
2744 struct block *
2745 gen_scode(name, q)
2746 register const char *name;
2747 struct qual q;
2748 {
2749 int proto = q.proto;
2750 int dir = q.dir;
2751 int tproto;
2752 u_char *eaddr;
2753 bpf_u_int32 mask, addr;
2754 #ifndef INET6
2755 bpf_u_int32 **alist;
2756 #else
2757 int tproto6;
2758 struct sockaddr_in *sin;
2759 struct sockaddr_in6 *sin6;
2760 struct addrinfo *res, *res0;
2761 struct in6_addr mask128;
2762 #endif /*INET6*/
2763 struct block *b, *tmp;
2764 int port, real_proto;
2765
2766 switch (q.addr) {
2767
2768 case Q_NET:
2769 addr = pcap_nametonetaddr(name);
2770 if (addr == 0)
2771 bpf_error("unknown network '%s'", name);
2772 /* Left justify network addr and calculate its network mask */
2773 mask = 0xffffffff;
2774 while (addr && (addr & 0xff000000) == 0) {
2775 addr <<= 8;
2776 mask <<= 8;
2777 }
2778 return gen_host(addr, mask, proto, dir);
2779
2780 case Q_DEFAULT:
2781 case Q_HOST:
2782 if (proto == Q_LINK) {
2783 switch (linktype) {
2784
2785 case DLT_EN10MB:
2786 eaddr = pcap_ether_hostton(name);
2787 if (eaddr == NULL)
2788 bpf_error(
2789 "unknown ether host '%s'", name);
2790 return gen_ehostop(eaddr, dir);
2791
2792 case DLT_FDDI:
2793 eaddr = pcap_ether_hostton(name);
2794 if (eaddr == NULL)
2795 bpf_error(
2796 "unknown FDDI host '%s'", name);
2797 return gen_fhostop(eaddr, dir);
2798
2799 case DLT_IEEE802:
2800 eaddr = pcap_ether_hostton(name);
2801 if (eaddr == NULL)
2802 bpf_error(
2803 "unknown token ring host '%s'", name);
2804 return gen_thostop(eaddr, dir);
2805
2806 default:
2807 bpf_error(
2808 "only ethernet/FDDI/token ring supports link-level host name");
2809 break;
2810 }
2811 } else if (proto == Q_DECNET) {
2812 unsigned short dn_addr = __pcap_nametodnaddr(name);
2813 /*
2814 * I don't think DECNET hosts can be multihomed, so
2815 * there is no need to build up a list of addresses
2816 */
2817 return (gen_host(dn_addr, 0, proto, dir));
2818 } else {
2819 #ifndef INET6
2820 alist = pcap_nametoaddr(name);
2821 if (alist == NULL || *alist == NULL)
2822 bpf_error("unknown host '%s'", name);
2823 tproto = proto;
2824 if (off_linktype == -1 && tproto == Q_DEFAULT)
2825 tproto = Q_IP;
2826 b = gen_host(**alist++, 0xffffffff, tproto, dir);
2827 while (*alist) {
2828 tmp = gen_host(**alist++, 0xffffffff,
2829 tproto, dir);
2830 gen_or(b, tmp);
2831 b = tmp;
2832 }
2833 return b;
2834 #else
2835 memset(&mask128, 0xff, sizeof(mask128));
2836 res0 = res = pcap_nametoaddrinfo(name);
2837 if (res == NULL)
2838 bpf_error("unknown host '%s'", name);
2839 b = tmp = NULL;
2840 tproto = tproto6 = proto;
2841 if (off_linktype == -1 && tproto == Q_DEFAULT) {
2842 tproto = Q_IP;
2843 tproto6 = Q_IPV6;
2844 }
2845 for (res = res0; res; res = res->ai_next) {
2846 switch (res->ai_family) {
2847 case AF_INET:
2848 if (tproto == Q_IPV6)
2849 continue;
2850
2851 sin = (struct sockaddr_in *)
2852 res->ai_addr;
2853 tmp = gen_host(ntohl(sin->sin_addr.s_addr),
2854 0xffffffff, tproto, dir);
2855 break;
2856 case AF_INET6:
2857 if (tproto6 == Q_IP)
2858 continue;
2859
2860 sin6 = (struct sockaddr_in6 *)
2861 res->ai_addr;
2862 tmp = gen_host6(&sin6->sin6_addr,
2863 &mask128, tproto6, dir);
2864 break;
2865 default:
2866 continue;
2867 }
2868 if (b)
2869 gen_or(b, tmp);
2870 b = tmp;
2871 }
2872 freeaddrinfo(res0);
2873 if (b == NULL) {
2874 bpf_error("unknown host '%s'%s", name,
2875 (proto == Q_DEFAULT)
2876 ? ""
2877 : " for specified address family");
2878 }
2879 return b;
2880 #endif /*INET6*/
2881 }
2882
2883 case Q_PORT:
2884 if (proto != Q_DEFAULT && proto != Q_UDP && proto != Q_TCP)
2885 bpf_error("illegal qualifier of 'port'");
2886 if (pcap_nametoport(name, &port, &real_proto) == 0)
2887 bpf_error("unknown port '%s'", name);
2888 if (proto == Q_UDP) {
2889 if (real_proto == IPPROTO_TCP)
2890 bpf_error("port '%s' is tcp", name);
2891 else
2892 /* override PROTO_UNDEF */
2893 real_proto = IPPROTO_UDP;
2894 }
2895 if (proto == Q_TCP) {
2896 if (real_proto == IPPROTO_UDP)
2897 bpf_error("port '%s' is udp", name);
2898 else
2899 /* override PROTO_UNDEF */
2900 real_proto = IPPROTO_TCP;
2901 }
2902 #ifndef INET6
2903 return gen_port(port, real_proto, dir);
2904 #else
2905 {
2906 struct block *b;
2907 b = gen_port(port, real_proto, dir);
2908 gen_or(gen_port6(port, real_proto, dir), b);
2909 return b;
2910 }
2911 #endif /* INET6 */
2912
2913 case Q_GATEWAY:
2914 #ifndef INET6
2915 eaddr = pcap_ether_hostton(name);
2916 if (eaddr == NULL)
2917 bpf_error("unknown ether host: %s", name);
2918
2919 alist = pcap_nametoaddr(name);
2920 if (alist == NULL || *alist == NULL)
2921 bpf_error("unknown host '%s'", name);
2922 return gen_gateway(eaddr, alist, proto, dir);
2923 #else
2924 bpf_error("'gateway' not supported in this configuration");
2925 #endif /*INET6*/
2926
2927 case Q_PROTO:
2928 real_proto = lookup_proto(name, proto);
2929 if (real_proto >= 0)
2930 return gen_proto(real_proto, proto, dir);
2931 else
2932 bpf_error("unknown protocol: %s", name);
2933
2934 case Q_PROTOCHAIN:
2935 real_proto = lookup_proto(name, proto);
2936 if (real_proto >= 0)
2937 return gen_protochain(real_proto, proto, dir);
2938 else
2939 bpf_error("unknown protocol: %s", name);
2940
2941
2942 case Q_UNDEF:
2943 syntax();
2944 /* NOTREACHED */
2945 }
2946 abort();
2947 /* NOTREACHED */
2948 }
2949
2950 struct block *
2951 gen_mcode(s1, s2, masklen, q)
2952 register const char *s1, *s2;
2953 register int masklen;
2954 struct qual q;
2955 {
2956 register int nlen, mlen;
2957 bpf_u_int32 n, m;
2958
2959 nlen = __pcap_atoin(s1, &n);
2960 /* Promote short ipaddr */
2961 n <<= 32 - nlen;
2962
2963 if (s2 != NULL) {
2964 mlen = __pcap_atoin(s2, &m);
2965 /* Promote short ipaddr */
2966 m <<= 32 - mlen;
2967 if ((n & ~m) != 0)
2968 bpf_error("non-network bits set in \"%s mask %s\"",
2969 s1, s2);
2970 } else {
2971 /* Convert mask len to mask */
2972 if (masklen > 32)
2973 bpf_error("mask length must be <= 32");
2974 m = 0xffffffff << (32 - masklen);
2975 if ((n & ~m) != 0)
2976 bpf_error("non-network bits set in \"%s/%d\"",
2977 s1, masklen);
2978 }
2979
2980 switch (q.addr) {
2981
2982 case Q_NET:
2983 return gen_host(n, m, q.proto, q.dir);
2984
2985 default:
2986 bpf_error("Mask syntax for networks only");
2987 /* NOTREACHED */
2988 }
2989 }
2990
2991 struct block *
2992 gen_ncode(s, v, q)
2993 register const char *s;
2994 bpf_u_int32 v;
2995 struct qual q;
2996 {
2997 bpf_u_int32 mask;
2998 int proto = q.proto;
2999 int dir = q.dir;
3000 register int vlen;
3001
3002 if (s == NULL)
3003 vlen = 32;
3004 else if (q.proto == Q_DECNET)
3005 vlen = __pcap_atodn(s, &v);
3006 else
3007 vlen = __pcap_atoin(s, &v);
3008
3009 switch (q.addr) {
3010
3011 case Q_DEFAULT:
3012 case Q_HOST:
3013 case Q_NET:
3014 if (proto == Q_DECNET)
3015 return gen_host(v, 0, proto, dir);
3016 else if (proto == Q_LINK) {
3017 bpf_error("illegal link layer address");
3018 } else {
3019 mask = 0xffffffff;
3020 if (s == NULL && q.addr == Q_NET) {
3021 /* Promote short net number */
3022 while (v && (v & 0xff000000) == 0) {
3023 v <<= 8;
3024 mask <<= 8;
3025 }
3026 } else {
3027 /* Promote short ipaddr */
3028 v <<= 32 - vlen;
3029 mask <<= 32 - vlen;
3030 }
3031 return gen_host(v, mask, proto, dir);
3032 }
3033
3034 case Q_PORT:
3035 if (proto == Q_UDP)
3036 proto = IPPROTO_UDP;
3037 else if (proto == Q_TCP)
3038 proto = IPPROTO_TCP;
3039 else if (proto == Q_DEFAULT)
3040 proto = PROTO_UNDEF;
3041 else
3042 bpf_error("illegal qualifier of 'port'");
3043
3044 #ifndef INET6
3045 return gen_port((int)v, proto, dir);
3046 #else
3047 {
3048 struct block *b;
3049 b = gen_port((int)v, proto, dir);
3050 gen_or(gen_port6((int)v, proto, dir), b);
3051 return b;
3052 }
3053 #endif /* INET6 */
3054
3055 case Q_GATEWAY:
3056 bpf_error("'gateway' requires a name");
3057 /* NOTREACHED */
3058
3059 case Q_PROTO:
3060 return gen_proto((int)v, proto, dir);
3061
3062 case Q_PROTOCHAIN:
3063 return gen_protochain((int)v, proto, dir);
3064
3065 case Q_UNDEF:
3066 syntax();
3067 /* NOTREACHED */
3068
3069 default:
3070 abort();
3071 /* NOTREACHED */
3072 }
3073 /* NOTREACHED */
3074 }
3075
3076 #ifdef INET6
3077 struct block *
3078 gen_mcode6(s1, s2, masklen, q)
3079 register const char *s1, *s2;
3080 register int masklen;
3081 struct qual q;
3082 {
3083 struct addrinfo *res;
3084 struct in6_addr *addr;
3085 struct in6_addr mask;
3086 struct block *b;
3087 u_int32_t *a, *m;
3088
3089 if (s2)
3090 bpf_error("no mask %s supported", s2);
3091
3092 res = pcap_nametoaddrinfo(s1);
3093 if (!res)
3094 bpf_error("invalid ip6 address %s", s1);
3095 if (res->ai_next)
3096 bpf_error("%s resolved to multiple address", s1);
3097 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
3098
3099 if (sizeof(mask) * 8 < masklen)
3100 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
3101 memset(&mask, 0xff, masklen / 8);
3102 if (masklen % 8) {
3103 mask.s6_addr[masklen / 8] =
3104 (0xff << (8 - masklen % 8)) & 0xff;
3105 }
3106
3107 a = (u_int32_t *)addr;
3108 m = (u_int32_t *)&mask;
3109 if ((a[0] & ~m[0]) || (a[1] & ~m[1])
3110 || (a[2] & ~m[2]) || (a[3] & ~m[3])) {
3111 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen);
3112 }
3113
3114 switch (q.addr) {
3115
3116 case Q_DEFAULT:
3117 case Q_HOST:
3118 if (masklen != 128)
3119 bpf_error("Mask syntax for networks only");
3120 /* FALLTHROUGH */
3121
3122 case Q_NET:
3123 b = gen_host6(addr, &mask, q.proto, q.dir);
3124 freeaddrinfo(res);
3125 return b;
3126
3127 default:
3128 bpf_error("invalid qualifier against IPv6 address");
3129 /* NOTREACHED */
3130 }
3131 }
3132 #endif /*INET6*/
3133
3134 struct block *
3135 gen_ecode(eaddr, q)
3136 register const u_char *eaddr;
3137 struct qual q;
3138 {
3139 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
3140 if (linktype == DLT_EN10MB)
3141 return gen_ehostop(eaddr, (int)q.dir);
3142 if (linktype == DLT_FDDI)
3143 return gen_fhostop(eaddr, (int)q.dir);
3144 if (linktype == DLT_IEEE802)
3145 return gen_thostop(eaddr, (int)q.dir);
3146 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring");
3147 }
3148 bpf_error("ethernet address used in non-ether expression");
3149 /* NOTREACHED */
3150 }
3151
3152 void
3153 sappend(s0, s1)
3154 struct slist *s0, *s1;
3155 {
3156 /*
3157 * This is definitely not the best way to do this, but the
3158 * lists will rarely get long.
3159 */
3160 while (s0->next)
3161 s0 = s0->next;
3162 s0->next = s1;
3163 }
3164
3165 static struct slist *
3166 xfer_to_x(a)
3167 struct arth *a;
3168 {
3169 struct slist *s;
3170
3171 s = new_stmt(BPF_LDX|BPF_MEM);
3172 s->s.k = a->regno;
3173 return s;
3174 }
3175
3176 static struct slist *
3177 xfer_to_a(a)
3178 struct arth *a;
3179 {
3180 struct slist *s;
3181
3182 s = new_stmt(BPF_LD|BPF_MEM);
3183 s->s.k = a->regno;
3184 return s;
3185 }
3186
3187 struct arth *
3188 gen_load(proto, index, size)
3189 int proto;
3190 struct arth *index;
3191 int size;
3192 {
3193 struct slist *s, *tmp;
3194 struct block *b;
3195 int regno = alloc_reg();
3196
3197 free_reg(index->regno);
3198 switch (size) {
3199
3200 default:
3201 bpf_error("data size must be 1, 2, or 4");
3202
3203 case 1:
3204 size = BPF_B;
3205 break;
3206
3207 case 2:
3208 size = BPF_H;
3209 break;
3210
3211 case 4:
3212 size = BPF_W;
3213 break;
3214 }
3215 switch (proto) {
3216 default:
3217 bpf_error("unsupported index operation");
3218
3219 case Q_LINK:
3220 s = xfer_to_x(index);
3221 tmp = new_stmt(BPF_LD|BPF_IND|size);
3222 sappend(s, tmp);
3223 sappend(index->s, s);
3224 break;
3225
3226 case Q_IP:
3227 case Q_ARP:
3228 case Q_RARP:
3229 case Q_ATALK:
3230 case Q_DECNET:
3231 case Q_SCA:
3232 case Q_LAT:
3233 case Q_MOPRC:
3234 case Q_MOPDL:
3235 #ifdef INET6
3236 case Q_IPV6:
3237 #endif
3238 /* XXX Note that we assume a fixed link header here. */
3239 s = xfer_to_x(index);
3240 tmp = new_stmt(BPF_LD|BPF_IND|size);
3241 tmp->s.k = off_nl;
3242 sappend(s, tmp);
3243 sappend(index->s, s);
3244
3245 b = gen_proto_abbrev(proto);
3246 if (index->b)
3247 gen_and(index->b, b);
3248 index->b = b;
3249 break;
3250
3251 case Q_TCP:
3252 case Q_UDP:
3253 case Q_ICMP:
3254 case Q_IGMP:
3255 case Q_IGRP:
3256 case Q_PIM:
3257 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
3258 s->s.k = off_nl;
3259 sappend(s, xfer_to_a(index));
3260 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
3261 sappend(s, new_stmt(BPF_MISC|BPF_TAX));
3262 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
3263 tmp->s.k = off_nl;
3264 sappend(index->s, s);
3265
3266 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
3267 if (index->b)
3268 gen_and(index->b, b);
3269 #ifdef INET6
3270 gen_and(gen_proto_abbrev(Q_IP), b);
3271 #endif
3272 index->b = b;
3273 break;
3274 #ifdef INET6
3275 case Q_ICMPV6:
3276 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
3277 /*NOTREACHED*/
3278 #endif
3279 }
3280 index->regno = regno;
3281 s = new_stmt(BPF_ST);
3282 s->s.k = regno;
3283 sappend(index->s, s);
3284
3285 return index;
3286 }
3287
3288 struct block *
3289 gen_relation(code, a0, a1, reversed)
3290 int code;
3291 struct arth *a0, *a1;
3292 int reversed;
3293 {
3294 struct slist *s0, *s1, *s2;
3295 struct block *b, *tmp;
3296
3297 s0 = xfer_to_x(a1);
3298 s1 = xfer_to_a(a0);
3299 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X);
3300 b = new_block(JMP(code));
3301 if (code == BPF_JGT || code == BPF_JGE) {
3302 reversed = !reversed;
3303 b->s.k = 0x80000000;
3304 }
3305 if (reversed)
3306 gen_not(b);
3307
3308 sappend(s1, s2);
3309 sappend(s0, s1);
3310 sappend(a1->s, s0);
3311 sappend(a0->s, a1->s);
3312
3313 b->stmts = a0->s;
3314
3315 free_reg(a0->regno);
3316 free_reg(a1->regno);
3317
3318 /* 'and' together protocol checks */
3319 if (a0->b) {
3320 if (a1->b) {
3321 gen_and(a0->b, tmp = a1->b);
3322 }
3323 else
3324 tmp = a0->b;
3325 } else
3326 tmp = a1->b;
3327
3328 if (tmp)
3329 gen_and(tmp, b);
3330
3331 return b;
3332 }
3333
3334 struct arth *
3335 gen_loadlen()
3336 {
3337 int regno = alloc_reg();
3338 struct arth *a = (struct arth *)newchunk(sizeof(*a));
3339 struct slist *s;
3340
3341 s = new_stmt(BPF_LD|BPF_LEN);
3342 s->next = new_stmt(BPF_ST);
3343 s->next->s.k = regno;
3344 a->s = s;
3345 a->regno = regno;
3346
3347 return a;
3348 }
3349
3350 struct arth *
3351 gen_loadi(val)
3352 int val;
3353 {
3354 struct arth *a;
3355 struct slist *s;
3356 int reg;
3357
3358 a = (struct arth *)newchunk(sizeof(*a));
3359
3360 reg = alloc_reg();
3361
3362 s = new_stmt(BPF_LD|BPF_IMM);
3363 s->s.k = val;
3364 s->next = new_stmt(BPF_ST);
3365 s->next->s.k = reg;
3366 a->s = s;
3367 a->regno = reg;
3368
3369 return a;
3370 }
3371
3372 struct arth *
3373 gen_neg(a)
3374 struct arth *a;
3375 {
3376 struct slist *s;
3377
3378 s = xfer_to_a(a);
3379 sappend(a->s, s);
3380 s = new_stmt(BPF_ALU|BPF_NEG);
3381 s->s.k = 0;
3382 sappend(a->s, s);
3383 s = new_stmt(BPF_ST);
3384 s->s.k = a->regno;
3385 sappend(a->s, s);
3386
3387 return a;
3388 }
3389
3390 struct arth *
3391 gen_arth(code, a0, a1)
3392 int code;
3393 struct arth *a0, *a1;
3394 {
3395 struct slist *s0, *s1, *s2;
3396
3397 s0 = xfer_to_x(a1);
3398 s1 = xfer_to_a(a0);
3399 s2 = new_stmt(BPF_ALU|BPF_X|code);
3400
3401 sappend(s1, s2);
3402 sappend(s0, s1);
3403 sappend(a1->s, s0);
3404 sappend(a0->s, a1->s);
3405
3406 free_reg(a1->regno);
3407
3408 s0 = new_stmt(BPF_ST);
3409 a0->regno = s0->s.k = alloc_reg();
3410 sappend(a0->s, s0);
3411
3412 return a0;
3413 }
3414
3415 /*
3416 * Here we handle simple allocation of the scratch registers.
3417 * If too many registers are alloc'd, the allocator punts.
3418 */
3419 static int regused[BPF_MEMWORDS];
3420 static int curreg;
3421
3422 /*
3423 * Return the next free register.
3424 */
3425 static int
3426 alloc_reg()
3427 {
3428 int n = BPF_MEMWORDS;
3429
3430 while (--n >= 0) {
3431 if (regused[curreg])
3432 curreg = (curreg + 1) % BPF_MEMWORDS;
3433 else {
3434 regused[curreg] = 1;
3435 return curreg;
3436 }
3437 }
3438 bpf_error("too many registers needed to evaluate expression");
3439 /* NOTREACHED */
3440 }
3441
3442 /*
3443 * Return a register to the table so it can
3444 * be used later.
3445 */
3446 static void
3447 free_reg(n)
3448 int n;
3449 {
3450 regused[n] = 0;
3451 }
3452
3453 static struct block *
3454 gen_len(jmp, n)
3455 int jmp, n;
3456 {
3457 struct slist *s;
3458 struct block *b;
3459
3460 s = new_stmt(BPF_LD|BPF_LEN);
3461 b = new_block(JMP(jmp));
3462 b->stmts = s;
3463 b->s.k = n;
3464
3465 return b;
3466 }
3467
3468 struct block *
3469 gen_greater(n)
3470 int n;
3471 {
3472 return gen_len(BPF_JGE, n);
3473 }
3474
3475 /*
3476 * Actually, this is less than or equal.
3477 */
3478 struct block *
3479 gen_less(n)
3480 int n;
3481 {
3482 struct block *b;
3483
3484 b = gen_len(BPF_JGT, n);
3485 gen_not(b);
3486
3487 return b;
3488 }
3489
3490 struct block *
3491 gen_byteop(op, idx, val)
3492 int op, idx, val;
3493 {
3494 struct block *b;
3495 struct slist *s;
3496
3497 switch (op) {
3498 default:
3499 abort();
3500
3501 case '=':
3502 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3503
3504 case '<':
3505 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3506 b->s.code = JMP(BPF_JGE);
3507 gen_not(b);
3508 return b;
3509
3510 case '>':
3511 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
3512 b->s.code = JMP(BPF_JGT);
3513 return b;
3514
3515 case '|':
3516 s = new_stmt(BPF_ALU|BPF_OR|BPF_K);
3517 break;
3518
3519 case '&':
3520 s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
3521 break;
3522 }
3523 s->s.k = val;
3524 b = new_block(JMP(BPF_JEQ));
3525 b->stmts = s;
3526 gen_not(b);
3527
3528 return b;
3529 }
3530
3531 struct block *
3532 gen_broadcast(proto)
3533 int proto;
3534 {
3535 bpf_u_int32 hostmask;
3536 struct block *b0, *b1, *b2;
3537 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
3538
3539 switch (proto) {
3540
3541 case Q_DEFAULT:
3542 case Q_LINK:
3543 if (linktype == DLT_EN10MB)
3544 return gen_ehostop(ebroadcast, Q_DST);
3545 if (linktype == DLT_FDDI)
3546 return gen_fhostop(ebroadcast, Q_DST);
3547 if (linktype == DLT_IEEE802)
3548 return gen_thostop(ebroadcast, Q_DST);
3549 bpf_error("not a broadcast link");
3550 break;
3551
3552 case Q_IP:
3553 b0 = gen_linktype(ETHERTYPE_IP);
3554 hostmask = ~netmask;
3555 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
3556 b2 = gen_mcmp(off_nl + 16, BPF_W,
3557 (bpf_int32)(~0 & hostmask), hostmask);
3558 gen_or(b1, b2);
3559 gen_and(b0, b2);
3560 return b2;
3561 }
3562 bpf_error("only ether/ip broadcast filters supported");
3563 }
3564
3565 struct block *
3566 gen_multicast(proto)
3567 int proto;
3568 {
3569 register struct block *b0, *b1;
3570 register struct slist *s;
3571
3572 switch (proto) {
3573
3574 case Q_DEFAULT:
3575 case Q_LINK:
3576 if (linktype == DLT_EN10MB) {
3577 /* ether[0] & 1 != 0 */
3578 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3579 s->s.k = 0;
3580 b0 = new_block(JMP(BPF_JSET));
3581 b0->s.k = 1;
3582 b0->stmts = s;
3583 return b0;
3584 }
3585
3586 if (linktype == DLT_FDDI) {
3587 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */
3588 /* fddi[1] & 1 != 0 */
3589 s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
3590 s->s.k = 1;
3591 b0 = new_block(JMP(BPF_JSET));
3592 b0->s.k = 1;
3593 b0->stmts = s;
3594 return b0;
3595 }
3596
3597 /* TODO - check how token ring handles multicast */
3598 /* if (linktype == DLT_IEEE802) ... */
3599
3600 /* Link not known to support multicasts */
3601 break;
3602
3603 case Q_IP:
3604 b0 = gen_linktype(ETHERTYPE_IP);
3605 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
3606 b1->s.code = JMP(BPF_JGE);
3607 gen_and(b0, b1);
3608 return b1;
3609
3610 #ifdef INET6
3611 case Q_IPV6:
3612 b0 = gen_linktype(ETHERTYPE_IPV6);
3613 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
3614 gen_and(b0, b1);
3615 return b1;
3616 #endif /* INET6 */
3617 }
3618 bpf_error("only IP multicast filters supported on ethernet/FDDI");
3619 }
3620
3621 /*
3622 * generate command for inbound/outbound. It's here so we can
3623 * make it link-type specific. 'dir' = 0 implies "inbound",
3624 * = 1 implies "outbound".
3625 */
3626 struct block *
3627 gen_inbound(dir)
3628 int dir;
3629 {
3630 register struct block *b0;
3631
3632 /*
3633 * Only some data link types support inbound/outbound qualifiers.
3634 */
3635 switch (linktype) {
3636 case DLT_SLIP:
3637 case DLT_PPP:
3638 b0 = gen_relation(BPF_JEQ,
3639 gen_load(Q_LINK, gen_loadi(0), 1),
3640 gen_loadi(0),
3641 dir);
3642 break;
3643
3644 default:
3645 bpf_error("inbound/outbound not supported on linktype %d\n",
3646 linktype);
3647 b0 = NULL;
3648 /* NOTREACHED */
3649 }
3650 return (b0);
3651 }
3652
3653 /*
3654 * support IEEE 802.1Q VLAN trunk over ethernet
3655 */
3656 struct block *
3657 gen_vlan(vlan_num)
3658 int vlan_num;
3659 {
3660 static u_int orig_linktype = -1, orig_nl = -1;
3661 struct block *b0;
3662
3663 /*
3664 * Change the offsets to point to the type and data fields within
3665 * the VLAN packet. This is somewhat of a kludge.
3666 */
3667 if (orig_nl == (u_int)-1) {
3668 orig_linktype = off_linktype; /* save original values */
3669 orig_nl = off_nl;
3670
3671 switch (linktype) {
3672
3673 case DLT_EN10MB:
3674 off_linktype = 16;
3675 off_nl = 18;
3676 break;
3677
3678 default:
3679 bpf_error("no VLAN support for data link type %d",
3680 linktype);
3681 /*NOTREACHED*/
3682 }
3683 }
3684
3685 /* check for VLAN */
3686 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
3687
3688 /* If a specific VLAN is requested, check VLAN id */
3689 if (vlan_num >= 0) {
3690 struct block *b1;
3691
3692 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num);
3693 gen_and(b0, b1);
3694 b0 = b1;
3695 }
3696
3697 return (b0);
3698 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism