X-Git-Url: https://git.tcpdump.org/libpcap/blobdiff_plain/82547471f79c2cf4a9943a222d006edc4add2d76..af30d75a3ece28ef91c77bc1fc3ef658cb8aa69b:/gencode.c

diff --git a/gencode.c b/gencode.c
index 12706b65..ea844903 100644
--- a/gencode.c
+++ b/gencode.c
@@ -21,7 +21,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.126 2000-10-28 00:01:26 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.129 2000-10-28 09:30:21 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -50,6 +50,7 @@ struct rtentry;
 #include "pcap-int.h"
 
 #include "ethertype.h"
+#include "nlpid.h"
 #include "gencode.h"
 #include "ppp.h"
 #include <pcap-namedb.h>
@@ -58,6 +59,10 @@ struct rtentry;
 #include <sys/socket.h>
 #endif /*INET6*/
 
+#define LLC_ISO_LSAP	0xfe
+
+#define ETHERMTU	1500
+
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
 #endif
@@ -124,12 +129,14 @@ static inline void syntax(void);
 static void backpatch(struct block *, struct block *);
 static void merge(struct block *, struct block *);
 static struct block *gen_cmp(u_int, u_int, bpf_int32);
+static struct block *gen_cmp_gt(u_int, u_int, bpf_int32);
 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
 static struct block *gen_bcmp(u_int, u_int, const u_char *);
 static struct block *gen_uncond(int);
 static inline struct block *gen_true(void);
 static inline struct block *gen_false(void);
 static struct block *gen_linktype(int);
+static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
 #ifdef INET6
 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
@@ -486,6 +493,24 @@ gen_cmp(offset, size, v)
 	return b;
 }
 
+static struct block *
+gen_cmp_gt(offset, size, v)
+	u_int offset, size;
+	bpf_int32 v;
+{
+	struct slist *s;
+	struct block *b;
+
+	s = new_stmt(BPF_LD|BPF_ABS|size);
+	s->s.k = offset;
+
+	b = new_block(JMP(BPF_JGT));
+	b->stmts = s;
+	b->s.k = v;
+
+	return b;
+}
+
 static struct block *
 gen_mcmp(offset, size, v, mask)
 	u_int offset, size;
@@ -703,20 +728,108 @@ gen_linktype(proto)
 
 	switch (linktype) {
 
+	case DLT_EN10MB:
+		/*
+		 * XXX - handle other LLC-encapsulated protocols here
+		 * (IPX, OSI)?
+		 */
+		switch (proto) {
+
+		case LLC_ISO_LSAP:
+			/*
+			 * OSI protocols always use 802.2 encapsulation.
+			 */
+			b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+			gen_not(b0);
+			b1 = gen_cmp(off_linktype + 2, BPF_H, (long)
+				     ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
+			gen_and(b0, b1);
+			return b1;
+
+		case ETHERTYPE_ATALK:
+		case ETHERTYPE_AARP:
+			/*
+			 * EtherTalk (AppleTalk protocols on Ethernet link
+			 * layer) may use 802.2 encapsulation.
+			 */
+
+			/*
+			 * Check for 802.2 encapsulation (EtherTalk phase 2?);
+			 * we check for an Ethernet type field less than
+			 * 1500, which means it's an 802.3 length field.
+			 */
+			b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+			gen_not(b0);
+
+			/*
+			 * 802.2-encapsulated ETHERTYPE_ATALK packets are
+			 * SNAP packets with an organization code of
+			 * 0x080007 (Apple, for Appletalk) and a protocol
+			 * type of ETHERTYPE_ATALK (Appletalk).
+			 *
+			 * 802.2-encapsulated ETHERTYPE_AARP packets are
+			 * SNAP packets with an organization code of
+			 * 0x000000 (encapsulated Ethernet) and a protocol
+			 * type of ETHERTYPE_AARP (Appletalk ARP).
+			 */
+			if (proto == ETHERTYPE_ATALK)
+				b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
+			else	/* proto == ETHERTYPE_AARP */
+				b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
+			gen_and(b0, b1);
+
+			/*
+			 * Check for Ethernet encapsulation (Ethertalk
+			 * phase 1?); we just check for the Ethernet
+			 * protocol type.
+			 */
+			b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+
+			gen_or(b0, b1);
+			return b1;
+		}
+		break;
+
 	case DLT_SLIP:
 		return gen_false();
 
 	case DLT_PPP:
 	case DLT_PPP_SERIAL:
-		if (proto == ETHERTYPE_IP)
+		/*
+		 * We use Ethernet protocol types inside libpcap;
+		 * map them to the corresponding PPP protocol types.
+		 */
+		switch (proto) {
+
+		case ETHERTYPE_IP:
 			proto = PPP_IP;			/* XXX was 0x21 */
+			break;
+
 #ifdef INET6
-		else if (proto == ETHERTYPE_IPV6)
+		case ETHERTYPE_IPV6:
 			proto = PPP_IPV6;
+			break;
 #endif
+
+		case ETHERTYPE_DN:
+			proto = PPP_DECNET;
+			break;
+
+		case ETHERTYPE_ATALK:
+			proto = PPP_APPLE;
+			break;
+
+		case ETHERTYPE_NS:
+			proto = PPP_NS;
+			break;
+		}
 		break;
 
 	case DLT_PPP_BSDOS:
+		/*
+		 * We use Ethernet protocol types inside libpcap;
+		 * map them to the corresponding PPP protocol types.
+		 */
 		switch (proto) {
 
 		case ETHERTYPE_IP:
@@ -762,6 +875,32 @@ gen_linktype(proto)
 	return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
 }
 
+/*
+ * Check for an LLC SNAP packet with a given organization code and
+ * protocol type; we check the entire contents of the 802.2 LLC and
+ * snap headers, checking for a DSAP of 0xAA, an SSAP of 0xAA, and
+ * a control field of 0x03 in the LLC header, and for the specified
+ * organization code and protocol type in the SNAP header.
+ */
+static struct block *
+gen_snap(orgcode, ptype, offset)
+	bpf_u_int32 orgcode;
+	bpf_u_int32 ptype;
+	u_int offset;
+{
+	u_char snapblock[8];
+
+	snapblock[0] = 0xAA;	/* DSAP = SNAP */
+	snapblock[1] = 0xAA;	/* SSAP = SNAP */
+	snapblock[2] = 0x03;	/* control = UI */
+	snapblock[3] = (orgcode >> 16);	/* upper 8 bits of organization code */
+	snapblock[4] = (orgcode >> 8);	/* middle 8 bits of organization code */
+	snapblock[5] = (orgcode >> 0);	/* lower 8 bits of organization code */
+	snapblock[6] = (ptype >> 8);	/* upper 8 bits of protocol type */
+	snapblock[7] = (ptype >> 0);	/* lower 8 bits of protocol type */
+	return gen_bcmp(offset, 8, snapblock);
+}
+
 static struct block *
 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
 	bpf_u_int32 addr;
@@ -1020,6 +1159,9 @@ gen_dnhostop(addr, dir, base_off)
 		gen_or(b0, b1);
 		return b1;
 
+	case Q_ISO:
+	        bpf_error("ISO host filtering not implemented");
+		
 	default:
 		abort();
 	}
@@ -1107,6 +1249,9 @@ gen_host(addr, mask, proto, dir)
 	case Q_ATALK:
 		bpf_error("ATALK host filtering not implemented");
 
+	case Q_AARP:
+		bpf_error("AARP host filtering not implemented");
+
 	case Q_DECNET:
 		return gen_dnhostop(addr, dir, off_nl);
 
@@ -1185,6 +1330,9 @@ gen_host6(addr, mask, proto, dir)
 	case Q_ATALK:
 		bpf_error("ATALK host filtering not implemented");
 
+	case Q_AARP:
+		bpf_error("AARP host filtering not implemented");
+
 	case Q_DECNET:
 		bpf_error("'decnet' modifier applied to ip6 host");
 
@@ -1340,6 +1488,10 @@ gen_proto_abbrev(proto)
 		b1 =  gen_linktype(ETHERTYPE_ATALK);
 		break;
 
+	case Q_AARP:
+		b1 =  gen_linktype(ETHERTYPE_AARP);
+		break;
+
 	case Q_DECNET:
 		b1 =  gen_linktype(ETHERTYPE_DN);
 		break;
@@ -1395,6 +1547,18 @@ gen_proto_abbrev(proto)
 #endif
 		break;
 
+	case Q_ISO:
+	        b1 = gen_linktype(LLC_ISO_LSAP);
+		break;
+
+	case Q_ESIS:
+	        b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT);
+		break;
+
+	case Q_ISIS:
+	        b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT);
+		break;
+
 	default:
 		abort();
 	}
@@ -1966,6 +2130,12 @@ gen_proto(v, proto, dir)
 		gen_and(b0, b1);
 		return b1;
 
+	case Q_ISO:
+		b0 = gen_linktype(LLC_ISO_LSAP);
+		b1 = gen_cmp(off_nl + 3, BPF_B, (long)v);
+		gen_and(b0, b1);
+		return b1;
+
 	case Q_ARP:
 		bpf_error("arp does not encapsulate another protocol");
 		/* NOTREACHED */
@@ -2781,6 +2951,9 @@ gen_greater(n)
 	return gen_len(BPF_JGE, n);
 }
 
+/*
+ * Actually, this is less than or equal.
+ */
 struct block *
 gen_less(n)
 	int n;