Add "ipx", which checks for the LLC SAP for IPX as well as, on Ethernet,

for "Novell 802.3" frames, which are 802.3 frames (i.e., the type/length
field is a length field, i.e. it's <= ETHERMTU) with 0xFFFF as the first
2 bytes.  We don't yet check for ETHERTYPE_IPX as well.

When checking for OSI packets on Linux cooked captures, check for 802.2
frames by testing the packet type for LINUX_SLL_P_802_2 rather than by
checking whether the type field is <= ETHERMTU (it's always a type field
in DLT_LINUX_SLL captures).

diff --git a/gencode.c b/gencode.c
index 465cba1fbcaed4f47debf589a1f02265a4ea8061..dde00486abc0ddc4cbefdbc0a9ad81804396387d 100644 (file)
--- a/gencode.c
+++ b/gencode.c
@@ -21,7 +21,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.142 2001-01-14 05:30:07 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.143 2001-01-14 07:57:47 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -69,6 +69,7 @@ struct rtentry;
 #define LLC_SNAP_LSAP  0xaa
 #define LLC_ISO_LSAP   0xfe
 #define LLC_STP_LSAP   0x42
+#define LLC_IPX_LSAP   0xe0
 
 #define ETHERMTU       1500
 
@@ -720,7 +721,7 @@ gen_linktype(proto)
                        /*
                         * OSI protocols always use 802.2 encapsulation.
                         * XXX - should we check both the DSAP and the
-                        * LSAP, like this, or should we check just the
+                        * SSAP, like this, or should we check just the
                         * DSAP?
                         */
                        b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
@@ -730,6 +731,40 @@ gen_linktype(proto)
                        gen_and(b0, b1);
                        return b1;
 
+               case LLC_IPX_LSAP:
+                       /*
+                        * Check both for the IPX LSAP as the DSAP and
+                        * for Netware 802.3, where the type/length
+                        * field is a length field (i.e., <= ETHERMTU)
+                        * and the first two bytes after the LLC header
+                        * are 0xFFFF.
+                        *
+                        * XXX - check for the IPX Ethertype, 0x8137,
+                        * as well?
+                        *
+                        * This generates code to check both for the
+                        * IPX LSAP and for Netware 802.3.
+                        */
+                       b0 = gen_cmp(off_linktype + 2, BPF_B,
+                           (bpf_int32)LLC_IPX_LSAP);
+                       b1 = gen_cmp(off_linktype + 2, BPF_H,
+                           (bpf_int32)0xFFFF);
+                       gen_or(b0, b1);
+
+                       /*
+                        * Now we generate code to check for 802.3
+                        * frames in general.
+                        */
+                       b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+                       gen_not(b0);
+
+                       /*
+                        * Now check for 802.3 frames and, if that passes,
+                        * check for either of the flavors of IPX.
+                        */
+                       gen_and(b0, b1);
+                       return b1;
+
                case ETHERTYPE_ATALK:
                case ETHERTYPE_AARP:
                        /*
@@ -832,6 +867,10 @@ gen_linktype(proto)
                        break;
 
                default:
+                       /*
+                        * XXX - we don't have to check for IPX 802.3
+                        * here, but should we check for the IPX Ethertype?
+                        */
                        if (proto <= ETHERMTU) {
                                /*
                                 * This is an LLC SAP value, so check
@@ -878,13 +917,33 @@ gen_linktype(proto)
                         * LSAP, like this, or should we check just the
                         * DSAP?
                         */
-                       b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
-                       gen_not(b0);
+                       b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
                        b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
                                     ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
                        gen_and(b0, b1);
                        return b1;
 
+               case LLC_IPX_LSAP:
+                       /*
+                        * Check both for 802.2 frames with the IPX LSAP as
+                        * the DSAP and for Netware 802.3 frames.
+                        *
+                        * This generates code to check for 802.2 frames
+                        * with the IPX LSAP.
+                        */
+                       b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+                       b1 = gen_cmp(off_linktype + 2, BPF_B,
+                           (bpf_int32)LLC_IPX_LSAP);
+                       gen_and(b0, b1);
+
+                       /*
+                        * Now check for 802.3 frames and OR that with
+                        * the previous test.
+                        */
+                       b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
+                       gen_or(b0, b1);
+                       return b1;
+
                case ETHERTYPE_ATALK:
                case ETHERTYPE_AARP:
                        /*
@@ -1562,6 +1621,9 @@ gen_host(addr, mask, proto, dir)
        case Q_STP:
                bpf_error("'stp' modifier applied to host");
 
+       case Q_IPX:
+               bpf_error("IPX host filtering not implemented");
+
        default:
                abort();
        }
@@ -1657,6 +1719,9 @@ gen_host6(addr, mask, proto, dir)
        case Q_STP:
                bpf_error("'stp' modifier applied to host");
 
+       case Q_IPX:
+               bpf_error("IPX host filtering not implemented");
+
        default:
                abort();
        }
@@ -1863,6 +1928,10 @@ gen_proto_abbrev(proto)
                b1 = gen_linktype(LLC_STP_LSAP);
                break;
 
+       case Q_IPX:
+               b1 = gen_linktype(LLC_IPX_LSAP);
+               break;
+
        default:
                abort();
        }
@@ -2522,6 +2591,9 @@ gen_proto(v, proto, dir)
        case Q_STP:
                bpf_error("'stp proto' is bogus");
 
+       case Q_IPX:
+               bpf_error("'ipx proto' is bogus");
+
        default:
                abort();
                /* NOTREACHED */

diff --git a/gencode.h b/gencode.h
index 0b516d308416183a932cc1dbbc234f6319c21d2b..c451426040d8f43405a42920f41fdfa61d155a09 100644 (file)
--- a/gencode.h
+++ b/gencode.h
@@ -18,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.48 2001-01-14 04:34:51 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.49 2001-01-14 07:57:48 guy Exp $ (LBL)
  */
 
 /* Address qualifiers. */
@@ -67,6 +67,8 @@
 
 #define Q_STP          26
 
+#define Q_IPX          27
+
 /* Directional qualifiers. */
 
 #define Q_SRC          1

diff --git a/grammar.y b/grammar.y
index 1aea40fd7a3bb6289dfc5f064ceb4dd22b4d3f2a..3e9025205e165a7dfe5004371256766d92eb1b0b 100644 (file)
--- a/grammar.y
+++ b/grammar.y
@@ -22,7 +22,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.65 2001-01-14 04:34:52 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.66 2001-01-14 07:57:48 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -119,6 +119,7 @@ pcap_parse()
 %token VLAN
 %token  ISO ESIS ISIS CLNP
 %token  STP
+%token  IPX
 
 %type  <s> ID
 %type  <e> EID
@@ -265,6 +266,7 @@ pname:        LINK                  { $$ = Q_LINK; }
        | ISIS                  { $$ = Q_ISIS; }
        | CLNP                  { $$ = Q_CLNP; }
        | STP                   { $$ = Q_STP; }
+       | IPX                   { $$ = Q_IPX; }
        ;
 other:   pqual TK_BROADCAST    { $$ = gen_broadcast($1); }
        | pqual TK_MULTICAST    { $$ = gen_multicast($1); }

diff --git a/scanner.l b/scanner.l
index 36619b64a62792110eb0b5ef725134f365c972ed..4ef4803b51a2c8bf199150149316ed521c82f808 100644 (file)
--- a/scanner.l
+++ b/scanner.l
@@ -22,7 +22,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.71 2001-01-14 04:34:52 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.72 2001-01-14 07:57:49 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -199,6 +199,8 @@ clnp                return CLNP;
 
 stp            return STP;
 
+ipx            return IPX;
+
 host           return HOST;
 net            return NET;
 mask           return MASK;