1 /*#define CHASE_CHAIN*/ 2 /* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 */ 22 #ifndef lint 23 static const char rcsid[] = 24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.160 2001/11/30 07:25:48 guy Exp $ (LBL)"; 25 #endif 26 27 #ifdef HAVE_CONFIG_H 28 #include "config.h" 29 #endif 30 31 #include <sys/types.h> 32 #include <sys/socket.h> 33 #include <sys/time.h> 34 #ifdef __NetBSD__ 35 #include <sys/param.h> 36 #endif 37 38 struct mbuf; 39 struct rtentry; 40 #include <net/if.h> 41 42 #include <netinet/in.h> 43 44 #include <stdlib.h> 45 #include <string.h> 46 #include <memory.h> 47 #include <setjmp.h> 48 #include <stdarg.h> 49 50 #include "pcap-int.h" 51 52 #include "ethertype.h" 53 #include "nlpid.h" 54 #include "llc.h" 55 #include "gencode.h" 56 #include "ppp.h" 57 #include "sll.h" 58 #include "arcnet.h" 59 #include <pcap-namedb.h> 60 #ifdef INET6 61 #include <netdb.h> 62 #include <sys/socket.h> 63 #endif /*INET6*/ 64 65 #define ETHERMTU 1500 66 67 #ifndef IPPROTO_SCTP 68 #define IPPROTO_SCTP 132 69 #endif 70 71 #ifdef HAVE_OS_PROTO_H 72 #include "os-proto.h" 73 #endif 74 75 #define JMP(c) ((c)|BPF_JMP|BPF_K) 76 77 /* Locals */ 78 static jmp_buf top_ctx; 79 static pcap_t *bpf_pcap; 80 81 /* Hack for updating VLAN offsets. */ 82 static u_int orig_linktype = -1, orig_nl = -1; 83 84 /* XXX */ 85 #ifdef PCAP_FDDIPAD 86 int pcap_fddipad = PCAP_FDDIPAD; 87 #else 88 int pcap_fddipad; 89 #endif 90 91 /* VARARGS */ 92 void 93 bpf_error(const char *fmt, ...) 94 95 { 96 va_list ap; 97 98 va_start(ap, fmt); 99 if (bpf_pcap != NULL) 100 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE, 101 fmt, ap); 102 va_end(ap); 103 longjmp(top_ctx, 1); 104 /* NOTREACHED */ 105 } 106 107 static void init_linktype(int); 108 109 static int alloc_reg(void); 110 static void free_reg(int); 111 112 static struct block *root; 113 114 /* 115 * We divy out chunks of memory rather than call malloc each time so 116 * we don't have to worry about leaking memory. It's probably 117 * not a big deal if all this memory was wasted but it this ever 118 * goes into a library that would probably not be a good idea. 119 */ 120 #define NCHUNKS 16 121 #define CHUNK0SIZE 1024 122 struct chunk { 123 u_int n_left; 124 void *m; 125 }; 126 127 static struct chunk chunks[NCHUNKS]; 128 static int cur_chunk; 129 130 static void *newchunk(u_int); 131 static void freechunks(void); 132 static inline struct block *new_block(int); 133 static inline struct slist *new_stmt(int); 134 static struct block *gen_retblk(int); 135 static inline void syntax(void); 136 137 static void backpatch(struct block *, struct block *); 138 static void merge(struct block *, struct block *); 139 static struct block *gen_cmp(u_int, u_int, bpf_int32); 140 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32); 141 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32); 142 static struct block *gen_bcmp(u_int, u_int, const u_char *); 143 static struct block *gen_uncond(int); 144 static inline struct block *gen_true(void); 145 static inline struct block *gen_false(void); 146 static struct block *gen_linktype(int); 147 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); 148 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 149 #ifdef INET6 150 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 151 #endif 152 static struct block *gen_ahostop(const u_char *, int); 153 static struct block *gen_ehostop(const u_char *, int); 154 static struct block *gen_fhostop(const u_char *, int); 155 static struct block *gen_thostop(const u_char *, int); 156 static struct block *gen_dnhostop(bpf_u_int32, int, u_int); 157 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 158 #ifdef INET6 159 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 160 #endif 161 #ifndef INET6 162 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); 163 #endif 164 static struct block *gen_ipfrag(void); 165 static struct block *gen_portatom(int, bpf_int32); 166 #ifdef INET6 167 static struct block *gen_portatom6(int, bpf_int32); 168 #endif 169 struct block *gen_portop(int, int, int); 170 static struct block *gen_port(int, int, int); 171 #ifdef INET6 172 struct block *gen_portop6(int, int, int); 173 static struct block *gen_port6(int, int, int); 174 #endif 175 static int lookup_proto(const char *, int); 176 static struct block *gen_protochain(int, int, int); 177 static struct block *gen_proto(int, int, int); 178 static struct slist *xfer_to_x(struct arth *); 179 static struct slist *xfer_to_a(struct arth *); 180 static struct block *gen_len(int, int); 181 182 static void * 183 newchunk(n) 184 u_int n; 185 { 186 struct chunk *cp; 187 int k, size; 188 189 #ifndef __NetBSD__ 190 /* XXX Round up to nearest long. */ 191 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 192 #else 193 /* XXX Round up to structure boundary. */ 194 n = ALIGN(n); 195 #endif 196 197 cp = &chunks[cur_chunk]; 198 if (n > cp->n_left) { 199 ++cp, k = ++cur_chunk; 200 if (k >= NCHUNKS) 201 bpf_error("out of memory"); 202 size = CHUNK0SIZE << k; 203 cp->m = (void *)malloc(size); 204 memset((char *)cp->m, 0, size); 205 cp->n_left = size; 206 if (n > size) 207 bpf_error("out of memory"); 208 } 209 cp->n_left -= n; 210 return (void *)((char *)cp->m + cp->n_left); 211 } 212 213 static void 214 freechunks() 215 { 216 int i; 217 218 cur_chunk = 0; 219 for (i = 0; i < NCHUNKS; ++i) 220 if (chunks[i].m != NULL) { 221 free(chunks[i].m); 222 chunks[i].m = NULL; 223 } 224 } 225 226 /* 227 * A strdup whose allocations are freed after code generation is over. 228 */ 229 char * 230 sdup(s) 231 register const char *s; 232 { 233 int n = strlen(s) + 1; 234 char *cp = newchunk(n); 235 236 strlcpy(cp, s, n); 237 return (cp); 238 } 239 240 static inline struct block * 241 new_block(code) 242 int code; 243 { 244 struct block *p; 245 246 p = (struct block *)newchunk(sizeof(*p)); 247 p->s.code = code; 248 p->head = p; 249 250 return p; 251 } 252 253 static inline struct slist * 254 new_stmt(code) 255 int code; 256 { 257 struct slist *p; 258 259 p = (struct slist *)newchunk(sizeof(*p)); 260 p->s.code = code; 261 262 return p; 263 } 264 265 static struct block * 266 gen_retblk(v) 267 int v; 268 { 269 struct block *b = new_block(BPF_RET|BPF_K); 270 271 b->s.k = v; 272 return b; 273 } 274 275 static inline void 276 syntax() 277 { 278 bpf_error("syntax error in filter expression"); 279 } 280 281 static bpf_u_int32 netmask; 282 static int snaplen; 283 int no_optimize; 284 285 int 286 pcap_compile(pcap_t *p, struct bpf_program *program, 287 char *buf, int optimize, bpf_u_int32 mask) 288 { 289 extern int n_errors; 290 int len; 291 292 no_optimize = 0; 293 n_errors = 0; 294 root = NULL; 295 bpf_pcap = p; 296 if (setjmp(top_ctx)) { 297 lex_cleanup(); 298 freechunks(); 299 return (-1); 300 } 301 302 netmask = mask; 303 304 snaplen = pcap_snapshot(p); 305 if (snaplen == 0) { 306 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 307 "snaplen of 0 rejects all packets"); 308 return -1; 309 } 310 311 lex_init(buf ? buf : ""); 312 init_linktype(pcap_datalink(p)); 313 (void)pcap_parse(); 314 315 if (n_errors) 316 syntax(); 317 318 if (root == NULL) 319 root = gen_retblk(snaplen); 320 321 if (optimize && !no_optimize) { 322 bpf_optimize(&root); 323 if (root == NULL || 324 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0)) 325 bpf_error("expression rejects all packets"); 326 } 327 program->bf_insns = icode_to_fcode(root, &len); 328 program->bf_len = len; 329 330 lex_cleanup(); 331 freechunks(); 332 return (0); 333 } 334 335 /* 336 * entry point for using the compiler with no pcap open 337 * pass in all the stuff that is needed explicitly instead. 338 */ 339 int 340 pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 341 struct bpf_program *program, 342 char *buf, int optimize, bpf_u_int32 mask) 343 { 344 pcap_t *p; 345 int ret; 346 347 p = pcap_open_dead(linktype_arg, snaplen_arg); 348 if (p == NULL) 349 return (-1); 350 ret = pcap_compile(p, program, buf, optimize, mask); 351 pcap_close(p); 352 return (ret); 353 } 354 355 /* 356 * Clean up a "struct bpf_program" by freeing all the memory allocated 357 * in it. 358 */ 359 void 360 pcap_freecode(struct bpf_program *program) 361 { 362 program->bf_len = 0; 363 if (program->bf_insns != NULL) { 364 free((char *)program->bf_insns); 365 program->bf_insns = NULL; 366 } 367 } 368 369 /* 370 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 371 * which of the jt and jf fields has been resolved and which is a pointer 372 * back to another unresolved block (or nil). At least one of the fields 373 * in each block is already resolved. 374 */ 375 static void 376 backpatch(list, target) 377 struct block *list, *target; 378 { 379 struct block *next; 380 381 while (list) { 382 if (!list->sense) { 383 next = JT(list); 384 JT(list) = target; 385 } else { 386 next = JF(list); 387 JF(list) = target; 388 } 389 list = next; 390 } 391 } 392 393 /* 394 * Merge the lists in b0 and b1, using the 'sense' field to indicate 395 * which of jt and jf is the link. 396 */ 397 static void 398 merge(b0, b1) 399 struct block *b0, *b1; 400 { 401 register struct block **p = &b0; 402 403 /* Find end of list. */ 404 while (*p) 405 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 406 407 /* Concatenate the lists. */ 408 *p = b1; 409 } 410 411 void 412 finish_parse(p) 413 struct block *p; 414 { 415 backpatch(p, gen_retblk(snaplen)); 416 p->sense = !p->sense; 417 backpatch(p, gen_retblk(0)); 418 root = p->head; 419 } 420 421 void 422 gen_and(b0, b1) 423 struct block *b0, *b1; 424 { 425 backpatch(b0, b1->head); 426 b0->sense = !b0->sense; 427 b1->sense = !b1->sense; 428 merge(b1, b0); 429 b1->sense = !b1->sense; 430 b1->head = b0->head; 431 } 432 433 void 434 gen_or(b0, b1) 435 struct block *b0, *b1; 436 { 437 b0->sense = !b0->sense; 438 backpatch(b0, b1->head); 439 b0->sense = !b0->sense; 440 merge(b1, b0); 441 b1->head = b0->head; 442 } 443 444 void 445 gen_not(b) 446 struct block *b; 447 { 448 b->sense = !b->sense; 449 } 450 451 static struct block * 452 gen_cmp(offset, size, v) 453 u_int offset, size; 454 bpf_int32 v; 455 { 456 struct slist *s; 457 struct block *b; 458 459 s = new_stmt(BPF_LD|BPF_ABS|size); 460 s->s.k = offset; 461 462 b = new_block(JMP(BPF_JEQ)); 463 b->stmts = s; 464 b->s.k = v; 465 466 return b; 467 } 468 469 static struct block * 470 gen_cmp_gt(offset, size, v) 471 u_int offset, size; 472 bpf_int32 v; 473 { 474 struct slist *s; 475 struct block *b; 476 477 s = new_stmt(BPF_LD|BPF_ABS|size); 478 s->s.k = offset; 479 480 b = new_block(JMP(BPF_JGT)); 481 b->stmts = s; 482 b->s.k = v; 483 484 return b; 485 } 486 487 static struct block * 488 gen_mcmp(offset, size, v, mask) 489 u_int offset, size; 490 bpf_int32 v; 491 bpf_u_int32 mask; 492 { 493 struct block *b = gen_cmp(offset, size, v); 494 struct slist *s; 495 496 if (mask != 0xffffffff) { 497 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 498 s->s.k = mask; 499 b->stmts->next = s; 500 } 501 return b; 502 } 503 504 static struct block * 505 gen_bcmp(offset, size, v) 506 register u_int offset, size; 507 register const u_char *v; 508 { 509 register struct block *b, *tmp; 510 511 b = NULL; 512 while (size >= 4) { 513 register const u_char *p = &v[size - 4]; 514 bpf_int32 w = ((bpf_int32)p[0] << 24) | 515 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 516 517 tmp = gen_cmp(offset + size - 4, BPF_W, w); 518 if (b != NULL) 519 gen_and(b, tmp); 520 b = tmp; 521 size -= 4; 522 } 523 while (size >= 2) { 524 register const u_char *p = &v[size - 2]; 525 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 526 527 tmp = gen_cmp(offset + size - 2, BPF_H, w); 528 if (b != NULL) 529 gen_and(b, tmp); 530 b = tmp; 531 size -= 2; 532 } 533 if (size > 0) { 534 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]); 535 if (b != NULL) 536 gen_and(b, tmp); 537 b = tmp; 538 } 539 return b; 540 } 541 542 /* 543 * Various code constructs need to know the layout of the data link 544 * layer. These variables give the necessary offsets. off_linktype 545 * is set to -1 for no encapsulation, in which case, IP is assumed. 546 */ 547 static u_int off_linktype; 548 static u_int off_nl; 549 static int linktype; 550 551 static void 552 init_linktype(type) 553 int type; 554 { 555 linktype = type; 556 557 orig_linktype = -1; 558 orig_nl = -1; 559 560 switch (type) { 561 562 case DLT_ARCNET: 563 off_linktype = 2; 564 off_nl = 6; /* XXX in reality, variable! */ 565 return; 566 567 case DLT_IEEE802_11: 568 off_linktype = 30; /* XXX variable */ 569 off_nl = 32; 570 return; 571 572 case DLT_EN10MB: 573 off_linktype = 12; 574 off_nl = 14; 575 return; 576 577 case DLT_SLIP: 578 /* 579 * SLIP doesn't have a link level type. The 16 byte 580 * header is hacked into our SLIP driver. 581 */ 582 off_linktype = -1; 583 off_nl = 16; 584 return; 585 586 case DLT_SLIP_BSDOS: 587 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 588 off_linktype = -1; 589 /* XXX end */ 590 off_nl = 24; 591 return; 592 593 case DLT_NULL: 594 case DLT_LOOP: 595 off_linktype = 0; 596 off_nl = 4; 597 return; 598 599 case DLT_PPP: 600 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 601 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */ 602 off_linktype = 2; 603 off_nl = 4; 604 return; 605 606 case DLT_PPP_ETHER: 607 /* 608 * This does no include the Ethernet header, and 609 * only covers session state. 610 */ 611 off_linktype = 6; 612 off_nl = 8; 613 return; 614 615 case DLT_PPP_BSDOS: 616 off_linktype = 5; 617 off_nl = 24; 618 return; 619 620 case DLT_FDDI: 621 /* 622 * FDDI doesn't really have a link-level type field. 623 * We set "off_linktype" to the offset of the LLC header. 624 * 625 * To check for Ethernet types, we assume that SSAP = SNAP 626 * is being used and pick out the encapsulated Ethernet type. 627 * XXX - should we generate code to check for SNAP? 628 */ 629 off_linktype = 13; 630 #ifdef PCAP_FDDIPAD 631 off_linktype += pcap_fddipad; 632 #endif 633 off_nl = 21; 634 #ifdef PCAP_FDDIPAD 635 off_nl += pcap_fddipad; 636 #endif 637 return; 638 639 case DLT_IEEE802: 640 /* 641 * Token Ring doesn't really have a link-level type field. 642 * We set "off_linktype" to the offset of the LLC header. 643 * 644 * To check for Ethernet types, we assume that SSAP = SNAP 645 * is being used and pick out the encapsulated Ethernet type. 646 * XXX - should we generate code to check for SNAP? 647 * 648 * XXX - the header is actually variable-length. 649 * Some various Linux patched versions gave 38 650 * as "off_linktype" and 40 as "off_nl"; however, 651 * if a token ring packet has *no* routing 652 * information, i.e. is not source-routed, the correct 653 * values are 20 and 22, as they are in the vanilla code. 654 * 655 * A packet is source-routed iff the uppermost bit 656 * of the first byte of the source address, at an 657 * offset of 8, has the uppermost bit set. If the 658 * packet is source-routed, the total number of bytes 659 * of routing information is 2 plus bits 0x1F00 of 660 * the 16-bit value at an offset of 14 (shifted right 661 * 8 - figure out which byte that is). 662 */ 663 off_linktype = 14; 664 off_nl = 22; 665 return; 666 667 #ifdef notdef 668 case DLT_IEEE802_11: 669 /* 670 * 802.11 doesn't really have a link-level type field. 671 * We set "off_linktype" to the offset of the LLC header. 672 * 673 * To check for Ethernet types, we assume that SSAP = SNAP 674 * is being used and pick out the encapsulated Ethernet type. 675 * XXX - should we generate code to check for SNAP? 676 * 677 * XXX - the header is actually variable-length. We 678 * assume a 24-byte link-layer header, as appears in 679 * data frames in networks with no bridges. 680 */ 681 off_linktype = 24; 682 off_nl = 30; 683 return; 684 #endif 685 686 case DLT_PRISM_HEADER: 687 /* 688 * Same as 802.11, but with an additional header before 689 * the 802.11 header, containing a bunch of additional 690 * information including radio-level information. 691 * 692 * The header is 144 bytes long. 693 * 694 * XXX - same variable-length header problem; at least 695 * the Prism header is fixed-length. 696 */ 697 off_linktype = 144+24; 698 off_nl = 144+30; 699 return; 700 701 case DLT_ATM_RFC1483: 702 /* 703 * assume routed, non-ISO PDUs 704 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 705 */ 706 off_linktype = 6; 707 off_nl = 8; 708 return; 709 710 case DLT_RAW: 711 off_linktype = -1; 712 off_nl = 0; 713 return; 714 715 case DLT_ATM_CLIP: /* Linux ATM defines this */ 716 off_linktype = 6; 717 off_nl = 8; 718 return; 719 720 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 721 off_linktype = 14; 722 off_nl = 16; 723 return; 724 725 case DLT_LTALK: 726 /* 727 * LocalTalk does have a 1-byte type field in the LLAP header, 728 * but really it just indicates whether there is a "short" or 729 * "long" DDP packet following. 730 */ 731 off_linktype = -1; 732 off_nl = 0; 733 return; 734 } 735 bpf_error("unknown data link type %d", linktype); 736 /* NOTREACHED */ 737 } 738 739 static struct block * 740 gen_uncond(rsense) 741 int rsense; 742 { 743 struct block *b; 744 struct slist *s; 745 746 s = new_stmt(BPF_LD|BPF_IMM); 747 s->s.k = !rsense; 748 b = new_block(JMP(BPF_JEQ)); 749 b->stmts = s; 750 751 return b; 752 } 753 754 static inline struct block * 755 gen_true() 756 { 757 return gen_uncond(1); 758 } 759 760 static inline struct block * 761 gen_false() 762 { 763 return gen_uncond(0); 764 } 765 766 /* 767 * Byte-swap a 32-bit number. 768 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 769 * big-endian platforms.) 770 */ 771 #define SWAPLONG(y) \ 772 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 773 774 static struct block * 775 gen_linktype(proto) 776 register int proto; 777 { 778 struct block *b0, *b1; 779 780 switch (linktype) { 781 782 case DLT_EN10MB: 783 switch (proto) { 784 785 case LLCSAP_ISONS: 786 /* 787 * OSI protocols always use 802.2 encapsulation. 788 * XXX - should we check both the DSAP and the 789 * SSAP, like this, or should we check just the 790 * DSAP? 791 */ 792 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 793 gen_not(b0); 794 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 795 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 796 gen_and(b0, b1); 797 return b1; 798 799 case LLCSAP_NETBEUI: 800 /* 801 * NetBEUI always uses 802.2 encapsulation. 802 * XXX - should we check both the DSAP and the 803 * SSAP, like this, or should we check just the 804 * DSAP? 805 */ 806 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 807 gen_not(b0); 808 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 809 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 810 gen_and(b0, b1); 811 return b1; 812 813 case LLCSAP_IPX: 814 /* 815 * Check for; 816 * 817 * Ethernet_II frames, which are Ethernet 818 * frames with a frame type of ETHERTYPE_IPX; 819 * 820 * Ethernet_802.3 frames, which are 802.3 821 * frames (i.e., the type/length field is 822 * a length field, <= ETHERMTU, rather than 823 * a type field) with the first two bytes 824 * after the Ethernet/802.3 header being 825 * 0xFFFF; 826 * 827 * Ethernet_802.2 frames, which are 802.3 828 * frames with an 802.2 LLC header and 829 * with the IPX LSAP as the DSAP in the LLC 830 * header; 831 * 832 * Ethernet_SNAP frames, which are 802.3 833 * frames with an LLC header and a SNAP 834 * header and with an OUI of 0x000000 835 * (encapsulated Ethernet) and a protocol 836 * ID of ETHERTYPE_IPX in the SNAP header. 837 * 838 * XXX - should we generate the same code both 839 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 840 */ 841 842 /* 843 * This generates code to check both for the 844 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 845 */ 846 b0 = gen_cmp(off_linktype + 2, BPF_B, 847 (bpf_int32)LLCSAP_IPX); 848 b1 = gen_cmp(off_linktype + 2, BPF_H, 849 (bpf_int32)0xFFFF); 850 gen_or(b0, b1); 851 852 /* 853 * Now we add code to check for SNAP frames with 854 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 855 */ 856 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14); 857 gen_or(b0, b1); 858 859 /* 860 * Now we generate code to check for 802.3 861 * frames in general. 862 */ 863 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 864 gen_not(b0); 865 866 /* 867 * Now add the check for 802.3 frames before the 868 * check for Ethernet_802.2 and Ethernet_802.3, 869 * as those checks should only be done on 802.3 870 * frames, not on Ethernet frames. 871 */ 872 gen_and(b0, b1); 873 874 /* 875 * Now add the check for Ethernet_II frames, and 876 * do that before checking for the other frame 877 * types. 878 */ 879 b0 = gen_cmp(off_linktype, BPF_H, 880 (bpf_int32)ETHERTYPE_IPX); 881 gen_or(b0, b1); 882 return b1; 883 884 case ETHERTYPE_ATALK: 885 case ETHERTYPE_AARP: 886 /* 887 * EtherTalk (AppleTalk protocols on Ethernet link 888 * layer) may use 802.2 encapsulation. 889 */ 890 891 /* 892 * Check for 802.2 encapsulation (EtherTalk phase 2?); 893 * we check for an Ethernet type field less than 894 * 1500, which means it's an 802.3 length field. 895 */ 896 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 897 gen_not(b0); 898 899 /* 900 * 802.2-encapsulated ETHERTYPE_ATALK packets are 901 * SNAP packets with an organization code of 902 * 0x080007 (Apple, for Appletalk) and a protocol 903 * type of ETHERTYPE_ATALK (Appletalk). 904 * 905 * 802.2-encapsulated ETHERTYPE_AARP packets are 906 * SNAP packets with an organization code of 907 * 0x000000 (encapsulated Ethernet) and a protocol 908 * type of ETHERTYPE_AARP (Appletalk ARP). 909 */ 910 if (proto == ETHERTYPE_ATALK) 911 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14); 912 else /* proto == ETHERTYPE_AARP */ 913 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14); 914 gen_and(b0, b1); 915 916 /* 917 * Check for Ethernet encapsulation (Ethertalk 918 * phase 1?); we just check for the Ethernet 919 * protocol type. 920 */ 921 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 922 923 gen_or(b0, b1); 924 return b1; 925 926 default: 927 if (proto <= ETHERMTU) { 928 /* 929 * This is an LLC SAP value, so the frames 930 * that match would be 802.2 frames. 931 * Check that the frame is an 802.2 frame 932 * (i.e., that the length/type field is 933 * a length field, <= ETHERMTU) and 934 * then check the DSAP. 935 */ 936 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 937 gen_not(b0); 938 b1 = gen_cmp(off_linktype + 2, BPF_B, 939 (bpf_int32)proto); 940 gen_and(b0, b1); 941 return b1; 942 } else { 943 /* 944 * This is an Ethernet type, so compare 945 * the length/type field with it (if 946 * the frame is an 802.2 frame, the length 947 * field will be <= ETHERMTU, and, as 948 * "proto" is > ETHERMTU, this test 949 * will fail and the frame won't match, 950 * which is what we want). 951 */ 952 return gen_cmp(off_linktype, BPF_H, 953 (bpf_int32)proto); 954 } 955 } 956 break; 957 958 case DLT_IEEE802_11: 959 case DLT_PRISM_HEADER: 960 case DLT_FDDI: 961 case DLT_IEEE802: 962 case DLT_ATM_RFC1483: 963 case DLT_ATM_CLIP: 964 /* 965 * XXX - handle token-ring variable-length header. 966 */ 967 switch (proto) { 968 969 case LLCSAP_ISONS: 970 return gen_cmp(off_linktype, BPF_H, (long) 971 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 972 973 case LLCSAP_NETBEUI: 974 return gen_cmp(off_linktype, BPF_H, (long) 975 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 976 977 case LLCSAP_IPX: 978 /* 979 * XXX - are there ever SNAP frames for IPX on 980 * non-Ethernet 802.x networks? 981 */ 982 return gen_cmp(off_linktype, BPF_B, 983 (bpf_int32)LLCSAP_IPX); 984 985 case ETHERTYPE_ATALK: 986 /* 987 * 802.2-encapsulated ETHERTYPE_ATALK packets are 988 * SNAP packets with an organization code of 989 * 0x080007 (Apple, for Appletalk) and a protocol 990 * type of ETHERTYPE_ATALK (Appletalk). 991 * 992 * XXX - check for an organization code of 993 * encapsulated Ethernet as well? 994 */ 995 return gen_snap(0x080007, ETHERTYPE_ATALK, 996 off_linktype); 997 break; 998 999 default: 1000 /* 1001 * XXX - we don't have to check for IPX 802.3 1002 * here, but should we check for the IPX Ethertype? 1003 */ 1004 if (proto <= ETHERMTU) { 1005 /* 1006 * This is an LLC SAP value, so check 1007 * the DSAP. 1008 */ 1009 return gen_cmp(off_linktype, BPF_B, 1010 (bpf_int32)proto); 1011 } else { 1012 /* 1013 * This is an Ethernet type; we assume 1014 * that it's unlikely that it'll 1015 * appear in the right place at random, 1016 * and therefore check only the 1017 * location that would hold the Ethernet 1018 * type in a SNAP frame with an organization 1019 * code of 0x000000 (encapsulated Ethernet). 1020 * 1021 * XXX - if we were to check for the SNAP DSAP 1022 * and LSAP, as per XXX, and were also to check 1023 * for an organization code of 0x000000 1024 * (encapsulated Ethernet), we'd do 1025 * 1026 * return gen_snap(0x000000, proto, 1027 * off_linktype); 1028 * 1029 * here; for now, we don't, as per the above. 1030 * I don't know whether it's worth the 1031 * extra CPU time to do the right check 1032 * or not. 1033 */ 1034 return gen_cmp(off_linktype+6, BPF_H, 1035 (bpf_int32)proto); 1036 } 1037 } 1038 break; 1039 1040 case DLT_LINUX_SLL: 1041 switch (proto) { 1042 1043 case LLCSAP_ISONS: 1044 /* 1045 * OSI protocols always use 802.2 encapsulation. 1046 * XXX - should we check both the DSAP and the 1047 * LSAP, like this, or should we check just the 1048 * DSAP? 1049 */ 1050 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1051 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1052 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 1053 gen_and(b0, b1); 1054 return b1; 1055 1056 case LLCSAP_NETBEUI: 1057 /* 1058 * NetBEUI always uses 802.2 encapsulation. 1059 * XXX - should we check both the DSAP and the 1060 * LSAP, like this, or should we check just the 1061 * DSAP? 1062 */ 1063 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1064 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1065 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 1066 gen_and(b0, b1); 1067 return b1; 1068 1069 case LLCSAP_IPX: 1070 /* 1071 * Ethernet_II frames, which are Ethernet 1072 * frames with a frame type of ETHERTYPE_IPX; 1073 * 1074 * Ethernet_802.3 frames, which have a frame 1075 * type of LINUX_SLL_P_802_3; 1076 * 1077 * Ethernet_802.2 frames, which are 802.3 1078 * frames with an 802.2 LLC header (i.e, have 1079 * a frame type of LINUX_SLL_P_802_2) and 1080 * with the IPX LSAP as the DSAP in the LLC 1081 * header; 1082 * 1083 * Ethernet_SNAP frames, which are 802.3 1084 * frames with an LLC header and a SNAP 1085 * header and with an OUI of 0x000000 1086 * (encapsulated Ethernet) and a protocol 1087 * ID of ETHERTYPE_IPX in the SNAP header. 1088 * 1089 * First, do the checks on LINUX_SLL_P_802_2 1090 * frames; generate the check for either 1091 * Ethernet_802.2 or Ethernet_SNAP frames, and 1092 * then put a check for LINUX_SLL_P_802_2 frames 1093 * before it. 1094 */ 1095 b0 = gen_cmp(off_linktype + 2, BPF_B, 1096 (bpf_int32)LLCSAP_IPX); 1097 b1 = gen_snap(0x000000, ETHERTYPE_IPX, 1098 off_linktype + 2); 1099 gen_or(b0, b1); 1100 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1101 gen_and(b0, b1); 1102 1103 /* 1104 * Now check for 802.3 frames and OR that with 1105 * the previous test. 1106 */ 1107 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3); 1108 gen_or(b0, b1); 1109 1110 /* 1111 * Now add the check for Ethernet_II frames, and 1112 * do that before checking for the other frame 1113 * types. 1114 */ 1115 b0 = gen_cmp(off_linktype, BPF_H, 1116 (bpf_int32)ETHERTYPE_IPX); 1117 gen_or(b0, b1); 1118 return b1; 1119 1120 case ETHERTYPE_ATALK: 1121 case ETHERTYPE_AARP: 1122 /* 1123 * EtherTalk (AppleTalk protocols on Ethernet link 1124 * layer) may use 802.2 encapsulation. 1125 */ 1126 1127 /* 1128 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1129 * we check for the 802.2 protocol type in the 1130 * "Ethernet type" field. 1131 */ 1132 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1133 1134 /* 1135 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1136 * SNAP packets with an organization code of 1137 * 0x080007 (Apple, for Appletalk) and a protocol 1138 * type of ETHERTYPE_ATALK (Appletalk). 1139 * 1140 * 802.2-encapsulated ETHERTYPE_AARP packets are 1141 * SNAP packets with an organization code of 1142 * 0x000000 (encapsulated Ethernet) and a protocol 1143 * type of ETHERTYPE_AARP (Appletalk ARP). 1144 */ 1145 if (proto == ETHERTYPE_ATALK) 1146 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 1147 off_linktype + 2); 1148 else /* proto == ETHERTYPE_AARP */ 1149 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 1150 off_linktype + 2); 1151 gen_and(b0, b1); 1152 1153 /* 1154 * Check for Ethernet encapsulation (Ethertalk 1155 * phase 1?); we just check for the Ethernet 1156 * protocol type. 1157 */ 1158 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1159 1160 gen_or(b0, b1); 1161 return b1; 1162 1163 default: 1164 if (proto <= ETHERMTU) { 1165 /* 1166 * This is an LLC SAP value, so the frames 1167 * that match would be 802.2 frames. 1168 * Check for the 802.2 protocol type 1169 * in the "Ethernet type" field, and 1170 * then check the DSAP. 1171 */ 1172 b0 = gen_cmp(off_linktype, BPF_H, 1173 LINUX_SLL_P_802_2); 1174 b1 = gen_cmp(off_linktype + 2, BPF_B, 1175 (bpf_int32)proto); 1176 gen_and(b0, b1); 1177 return b1; 1178 } else { 1179 /* 1180 * This is an Ethernet type, so compare 1181 * the length/type field with it (if 1182 * the frame is an 802.2 frame, the length 1183 * field will be <= ETHERMTU, and, as 1184 * "proto" is > ETHERMTU, this test 1185 * will fail and the frame won't match, 1186 * which is what we want). 1187 */ 1188 return gen_cmp(off_linktype, BPF_H, 1189 (bpf_int32)proto); 1190 } 1191 } 1192 break; 1193 1194 case DLT_SLIP: 1195 case DLT_SLIP_BSDOS: 1196 case DLT_RAW: 1197 /* 1198 * These types don't provide any type field; packets 1199 * are always IP. 1200 * 1201 * XXX - for IPv4, check for a version number of 4, and, 1202 * for IPv6, check for a version number of 6? 1203 */ 1204 switch (proto) { 1205 1206 case ETHERTYPE_IP: 1207 #ifdef INET6 1208 case ETHERTYPE_IPV6: 1209 #endif 1210 return gen_true(); /* always true */ 1211 1212 default: 1213 return gen_false(); /* always false */ 1214 } 1215 break; 1216 1217 case DLT_PPP: 1218 case DLT_PPP_SERIAL: 1219 case DLT_PPP_ETHER: 1220 /* 1221 * We use Ethernet protocol types inside libpcap; 1222 * map them to the corresponding PPP protocol types. 1223 */ 1224 switch (proto) { 1225 1226 case ETHERTYPE_IP: 1227 proto = PPP_IP; /* XXX was 0x21 */ 1228 break; 1229 1230 #ifdef INET6 1231 case ETHERTYPE_IPV6: 1232 proto = PPP_IPV6; 1233 break; 1234 #endif 1235 1236 case ETHERTYPE_DN: 1237 proto = PPP_DECNET; 1238 break; 1239 1240 case ETHERTYPE_ATALK: 1241 proto = PPP_APPLE; 1242 break; 1243 1244 case ETHERTYPE_NS: 1245 proto = PPP_NS; 1246 break; 1247 1248 case LLCSAP_ISONS: 1249 proto = PPP_OSI; 1250 break; 1251 1252 case LLCSAP_8021D: 1253 /* 1254 * I'm assuming the "Bridging PDU"s that go 1255 * over PPP are Spanning Tree Protocol 1256 * Bridging PDUs. 1257 */ 1258 proto = PPP_BRPDU; 1259 break; 1260 1261 case LLCSAP_IPX: 1262 proto = PPP_IPX; 1263 break; 1264 } 1265 break; 1266 1267 case DLT_PPP_BSDOS: 1268 /* 1269 * We use Ethernet protocol types inside libpcap; 1270 * map them to the corresponding PPP protocol types. 1271 */ 1272 switch (proto) { 1273 1274 case ETHERTYPE_IP: 1275 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP); 1276 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC); 1277 gen_or(b0, b1); 1278 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC); 1279 gen_or(b1, b0); 1280 return b0; 1281 1282 #ifdef INET6 1283 case ETHERTYPE_IPV6: 1284 proto = PPP_IPV6; 1285 /* more to go? */ 1286 break; 1287 #endif 1288 1289 case ETHERTYPE_DN: 1290 proto = PPP_DECNET; 1291 break; 1292 1293 case ETHERTYPE_ATALK: 1294 proto = PPP_APPLE; 1295 break; 1296 1297 case ETHERTYPE_NS: 1298 proto = PPP_NS; 1299 break; 1300 1301 case LLCSAP_ISONS: 1302 proto = PPP_OSI; 1303 break; 1304 1305 case LLCSAP_8021D: 1306 /* 1307 * I'm assuming the "Bridging PDU"s that go 1308 * over PPP are Spanning Tree Protocol 1309 * Bridging PDUs. 1310 */ 1311 proto = PPP_BRPDU; 1312 break; 1313 1314 case LLCSAP_IPX: 1315 proto = PPP_IPX; 1316 break; 1317 } 1318 break; 1319 1320 case DLT_NULL: 1321 case DLT_LOOP: 1322 /* 1323 * For DLT_NULL, the link-layer header is a 32-bit 1324 * word containing an AF_ value in *host* byte order. 1325 * 1326 * In addition, if we're reading a saved capture file, 1327 * the host byte order in the capture may not be the 1328 * same as the host byte order on this machine. 1329 * 1330 * For DLT_LOOP, the link-layer header is a 32-bit 1331 * word containing an AF_ value in *network* byte order. 1332 * 1333 * XXX - AF_ values may, unfortunately, be platform- 1334 * dependent; for example, FreeBSD's AF_INET6 is 24 1335 * whilst NetBSD's and OpenBSD's is 26. 1336 * 1337 * This means that, when reading a capture file, just 1338 * checking for our AF_INET6 value won't work if the 1339 * capture file came from another OS. 1340 */ 1341 switch (proto) { 1342 1343 case ETHERTYPE_IP: 1344 proto = AF_INET; 1345 break; 1346 1347 #ifdef INET6 1348 case ETHERTYPE_IPV6: 1349 proto = AF_INET6; 1350 break; 1351 #endif 1352 1353 default: 1354 /* 1355 * Not a type on which we support filtering. 1356 * XXX - support those that have AF_ values 1357 * #defined on this platform, at least? 1358 */ 1359 return gen_false(); 1360 } 1361 1362 if (linktype == DLT_NULL) { 1363 /* 1364 * The AF_ value is in host byte order, but 1365 * the BPF interpreter will convert it to 1366 * network byte order. 1367 * 1368 * If this is a save file, and it's from a 1369 * machine with the opposite byte order to 1370 * ours, we byte-swap the AF_ value. 1371 * 1372 * Then we run it through "htonl()", and 1373 * generate code to compare against the result. 1374 */ 1375 if (bpf_pcap->sf.rfile != NULL && 1376 bpf_pcap->sf.swapped) 1377 proto = SWAPLONG(proto); 1378 proto = htonl(proto); 1379 } 1380 return (gen_cmp(0, BPF_W, (bpf_int32)proto)); 1381 1382 case DLT_ARCNET: 1383 /* 1384 * XXX should we check for first fragment if the protocol 1385 * uses PHDS? 1386 */ 1387 switch(proto) { 1388 default: 1389 return gen_false(); 1390 #ifdef INET6 1391 case ETHERTYPE_IPV6: 1392 return(gen_cmp(2, BPF_B, 1393 (bpf_int32)htonl(ARCTYPE_INET6))); 1394 #endif /* INET6 */ 1395 case ETHERTYPE_IP: 1396 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP)); 1397 b1 = gen_cmp(2, BPF_B, 1398 (bpf_int32)htonl(ARCTYPE_IP_OLD)); 1399 gen_or(b0, b1); 1400 return(b1); 1401 case ETHERTYPE_ARP: 1402 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP)); 1403 b1 = gen_cmp(2, BPF_B, 1404 (bpf_int32)htonl(ARCTYPE_ARP_OLD)); 1405 gen_or(b0, b1); 1406 return(b1); 1407 case ETHERTYPE_REVARP: 1408 return(gen_cmp(2, BPF_B, 1409 (bpf_int32)htonl(ARCTYPE_REVARP))); 1410 case ETHERTYPE_ATALK: 1411 return(gen_cmp(2, BPF_B, 1412 (bpf_int32)htonl(ARCTYPE_ATALK))); 1413 } 1414 break; 1415 1416 case DLT_LTALK: 1417 switch (proto) { 1418 case ETHERTYPE_ATALK: 1419 return gen_true(); 1420 default: 1421 return gen_false(); 1422 } 1423 break; 1424 } 1425 1426 /* 1427 * All the types that have no encapsulation should either be 1428 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if 1429 * all packets are IP packets, or should be handled in some 1430 * special case, if none of them are (if some are and some 1431 * aren't, the lack of encapsulation is a problem, as we'd 1432 * have to find some other way of determining the packet type). 1433 * 1434 * Therefore, if "off_linktype" is -1, there's an error. 1435 */ 1436 if (off_linktype == -1) 1437 abort(); 1438 1439 /* 1440 * Any type not handled above should always have an Ethernet 1441 * type at an offset of "off_linktype". (PPP is partially 1442 * handled above - the protocol type is mapped from the 1443 * Ethernet and LLC types we use internally to the corresponding 1444 * PPP type - but the PPP type is always specified by a value 1445 * at "off_linktype", so we don't have to do the code generation 1446 * above.) 1447 */ 1448 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1449 } 1450 1451 /* 1452 * Check for an LLC SNAP packet with a given organization code and 1453 * protocol type; we check the entire contents of the 802.2 LLC and 1454 * snap headers, checking for DSAP and SSAP of SNAP and a control 1455 * field of 0x03 in the LLC header, and for the specified organization 1456 * code and protocol type in the SNAP header. 1457 */ 1458 static struct block * 1459 gen_snap(orgcode, ptype, offset) 1460 bpf_u_int32 orgcode; 1461 bpf_u_int32 ptype; 1462 u_int offset; 1463 { 1464 u_char snapblock[8]; 1465 1466 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 1467 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ 1468 snapblock[2] = 0x03; /* control = UI */ 1469 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 1470 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 1471 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 1472 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 1473 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ 1474 return gen_bcmp(offset, 8, snapblock); 1475 } 1476 1477 static struct block * 1478 gen_hostop(addr, mask, dir, proto, src_off, dst_off) 1479 bpf_u_int32 addr; 1480 bpf_u_int32 mask; 1481 int dir, proto; 1482 u_int src_off, dst_off; 1483 { 1484 struct block *b0, *b1; 1485 u_int offset; 1486 1487 switch (dir) { 1488 1489 case Q_SRC: 1490 offset = src_off; 1491 break; 1492 1493 case Q_DST: 1494 offset = dst_off; 1495 break; 1496 1497 case Q_AND: 1498 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 1499 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 1500 gen_and(b0, b1); 1501 return b1; 1502 1503 case Q_OR: 1504 case Q_DEFAULT: 1505 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 1506 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 1507 gen_or(b0, b1); 1508 return b1; 1509 1510 default: 1511 abort(); 1512 } 1513 b0 = gen_linktype(proto); 1514 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask); 1515 gen_and(b0, b1); 1516 return b1; 1517 } 1518 1519 #ifdef INET6 1520 static struct block * 1521 gen_hostop6(addr, mask, dir, proto, src_off, dst_off) 1522 struct in6_addr *addr; 1523 struct in6_addr *mask; 1524 int dir, proto; 1525 u_int src_off, dst_off; 1526 { 1527 struct block *b0, *b1; 1528 u_int offset; 1529 u_int32_t *a, *m; 1530 1531 switch (dir) { 1532 1533 case Q_SRC: 1534 offset = src_off; 1535 break; 1536 1537 case Q_DST: 1538 offset = dst_off; 1539 break; 1540 1541 case Q_AND: 1542 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1543 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1544 gen_and(b0, b1); 1545 return b1; 1546 1547 case Q_OR: 1548 case Q_DEFAULT: 1549 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1550 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1551 gen_or(b0, b1); 1552 return b1; 1553 1554 default: 1555 abort(); 1556 } 1557 /* this order is important */ 1558 a = (u_int32_t *)addr; 1559 m = (u_int32_t *)mask; 1560 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 1561 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 1562 gen_and(b0, b1); 1563 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 1564 gen_and(b0, b1); 1565 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 1566 gen_and(b0, b1); 1567 b0 = gen_linktype(proto); 1568 gen_and(b0, b1); 1569 return b1; 1570 } 1571 #endif /*INET6*/ 1572 1573 static struct block * 1574 gen_ehostop(eaddr, dir) 1575 register const u_char *eaddr; 1576 register int dir; 1577 { 1578 register struct block *b0, *b1; 1579 1580 switch (dir) { 1581 case Q_SRC: 1582 return gen_bcmp(6, 6, eaddr); 1583 1584 case Q_DST: 1585 return gen_bcmp(0, 6, eaddr); 1586 1587 case Q_AND: 1588 b0 = gen_ehostop(eaddr, Q_SRC); 1589 b1 = gen_ehostop(eaddr, Q_DST); 1590 gen_and(b0, b1); 1591 return b1; 1592 1593 case Q_DEFAULT: 1594 case Q_OR: 1595 b0 = gen_ehostop(eaddr, Q_SRC); 1596 b1 = gen_ehostop(eaddr, Q_DST); 1597 gen_or(b0, b1); 1598 return b1; 1599 } 1600 abort(); 1601 /* NOTREACHED */ 1602 } 1603 1604 /* 1605 * Like gen_ehostop, but for DLT_FDDI 1606 */ 1607 static struct block * 1608 gen_fhostop(eaddr, dir) 1609 register const u_char *eaddr; 1610 register int dir; 1611 { 1612 struct block *b0, *b1; 1613 1614 switch (dir) { 1615 case Q_SRC: 1616 #ifdef PCAP_FDDIPAD 1617 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr); 1618 #else 1619 return gen_bcmp(6 + 1, 6, eaddr); 1620 #endif 1621 1622 case Q_DST: 1623 #ifdef PCAP_FDDIPAD 1624 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr); 1625 #else 1626 return gen_bcmp(0 + 1, 6, eaddr); 1627 #endif 1628 1629 case Q_AND: 1630 b0 = gen_fhostop(eaddr, Q_SRC); 1631 b1 = gen_fhostop(eaddr, Q_DST); 1632 gen_and(b0, b1); 1633 return b1; 1634 1635 case Q_DEFAULT: 1636 case Q_OR: 1637 b0 = gen_fhostop(eaddr, Q_SRC); 1638 b1 = gen_fhostop(eaddr, Q_DST); 1639 gen_or(b0, b1); 1640 return b1; 1641 } 1642 abort(); 1643 /* NOTREACHED */ 1644 } 1645 1646 /* 1647 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 1648 */ 1649 static struct block * 1650 gen_thostop(eaddr, dir) 1651 register const u_char *eaddr; 1652 register int dir; 1653 { 1654 register struct block *b0, *b1; 1655 1656 switch (dir) { 1657 case Q_SRC: 1658 return gen_bcmp(8, 6, eaddr); 1659 1660 case Q_DST: 1661 return gen_bcmp(2, 6, eaddr); 1662 1663 case Q_AND: 1664 b0 = gen_thostop(eaddr, Q_SRC); 1665 b1 = gen_thostop(eaddr, Q_DST); 1666 gen_and(b0, b1); 1667 return b1; 1668 1669 case Q_DEFAULT: 1670 case Q_OR: 1671 b0 = gen_thostop(eaddr, Q_SRC); 1672 b1 = gen_thostop(eaddr, Q_DST); 1673 gen_or(b0, b1); 1674 return b1; 1675 } 1676 abort(); 1677 /* NOTREACHED */ 1678 } 1679 1680 /* 1681 * This is quite tricky because there may be pad bytes in front of the 1682 * DECNET header, and then there are two possible data packet formats that 1683 * carry both src and dst addresses, plus 5 packet types in a format that 1684 * carries only the src node, plus 2 types that use a different format and 1685 * also carry just the src node. 1686 * 1687 * Yuck. 1688 * 1689 * Instead of doing those all right, we just look for data packets with 1690 * 0 or 1 bytes of padding. If you want to look at other packets, that 1691 * will require a lot more hacking. 1692 * 1693 * To add support for filtering on DECNET "areas" (network numbers) 1694 * one would want to add a "mask" argument to this routine. That would 1695 * make the filter even more inefficient, although one could be clever 1696 * and not generate masking instructions if the mask is 0xFFFF. 1697 */ 1698 static struct block * 1699 gen_dnhostop(addr, dir, base_off) 1700 bpf_u_int32 addr; 1701 int dir; 1702 u_int base_off; 1703 { 1704 struct block *b0, *b1, *b2, *tmp; 1705 u_int offset_lh; /* offset if long header is received */ 1706 u_int offset_sh; /* offset if short header is received */ 1707 1708 switch (dir) { 1709 1710 case Q_DST: 1711 offset_sh = 1; /* follows flags */ 1712 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 1713 break; 1714 1715 case Q_SRC: 1716 offset_sh = 3; /* follows flags, dstnode */ 1717 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 1718 break; 1719 1720 case Q_AND: 1721 /* Inefficient because we do our Calvinball dance twice */ 1722 b0 = gen_dnhostop(addr, Q_SRC, base_off); 1723 b1 = gen_dnhostop(addr, Q_DST, base_off); 1724 gen_and(b0, b1); 1725 return b1; 1726 1727 case Q_OR: 1728 case Q_DEFAULT: 1729 /* Inefficient because we do our Calvinball dance twice */ 1730 b0 = gen_dnhostop(addr, Q_SRC, base_off); 1731 b1 = gen_dnhostop(addr, Q_DST, base_off); 1732 gen_or(b0, b1); 1733 return b1; 1734 1735 case Q_ISO: 1736 bpf_error("ISO host filtering not implemented"); 1737 1738 default: 1739 abort(); 1740 } 1741 b0 = gen_linktype(ETHERTYPE_DN); 1742 /* Check for pad = 1, long header case */ 1743 tmp = gen_mcmp(base_off + 2, BPF_H, 1744 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); 1745 b1 = gen_cmp(base_off + 2 + 1 + offset_lh, 1746 BPF_H, (bpf_int32)ntohs(addr)); 1747 gen_and(tmp, b1); 1748 /* Check for pad = 0, long header case */ 1749 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 1750 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); 1751 gen_and(tmp, b2); 1752 gen_or(b2, b1); 1753 /* Check for pad = 1, short header case */ 1754 tmp = gen_mcmp(base_off + 2, BPF_H, 1755 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); 1756 b2 = gen_cmp(base_off + 2 + 1 + offset_sh, 1757 BPF_H, (bpf_int32)ntohs(addr)); 1758 gen_and(tmp, b2); 1759 gen_or(b2, b1); 1760 /* Check for pad = 0, short header case */ 1761 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 1762 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); 1763 gen_and(tmp, b2); 1764 gen_or(b2, b1); 1765 1766 /* Combine with test for linktype */ 1767 gen_and(b0, b1); 1768 return b1; 1769 } 1770 1771 static struct block * 1772 gen_host(addr, mask, proto, dir) 1773 bpf_u_int32 addr; 1774 bpf_u_int32 mask; 1775 int proto; 1776 int dir; 1777 { 1778 struct block *b0, *b1; 1779 1780 switch (proto) { 1781 1782 case Q_DEFAULT: 1783 b0 = gen_host(addr, mask, Q_IP, dir); 1784 if (off_linktype != -1) { 1785 b1 = gen_host(addr, mask, Q_ARP, dir); 1786 gen_or(b0, b1); 1787 b0 = gen_host(addr, mask, Q_RARP, dir); 1788 gen_or(b1, b0); 1789 } 1790 return b0; 1791 1792 case Q_IP: 1793 return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 1794 off_nl + 12, off_nl + 16); 1795 1796 case Q_RARP: 1797 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 1798 off_nl + 14, off_nl + 24); 1799 1800 case Q_ARP: 1801 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 1802 off_nl + 14, off_nl + 24); 1803 1804 case Q_TCP: 1805 bpf_error("'tcp' modifier applied to host"); 1806 1807 case Q_SCTP: 1808 bpf_error("'sctp' modifier applied to host"); 1809 1810 case Q_UDP: 1811 bpf_error("'udp' modifier applied to host"); 1812 1813 case Q_ICMP: 1814 bpf_error("'icmp' modifier applied to host"); 1815 1816 case Q_IGMP: 1817 bpf_error("'igmp' modifier applied to host"); 1818 1819 case Q_IGRP: 1820 bpf_error("'igrp' modifier applied to host"); 1821 1822 case Q_PIM: 1823 bpf_error("'pim' modifier applied to host"); 1824 1825 case Q_VRRP: 1826 bpf_error("'vrrp' modifier applied to host"); 1827 1828 case Q_ATALK: 1829 bpf_error("ATALK host filtering not implemented"); 1830 1831 case Q_AARP: 1832 bpf_error("AARP host filtering not implemented"); 1833 1834 case Q_DECNET: 1835 return gen_dnhostop(addr, dir, off_nl); 1836 1837 case Q_SCA: 1838 bpf_error("SCA host filtering not implemented"); 1839 1840 case Q_LAT: 1841 bpf_error("LAT host filtering not implemented"); 1842 1843 case Q_MOPDL: 1844 bpf_error("MOPDL host filtering not implemented"); 1845 1846 case Q_MOPRC: 1847 bpf_error("MOPRC host filtering not implemented"); 1848 1849 #ifdef INET6 1850 case Q_IPV6: 1851 bpf_error("'ip6' modifier applied to ip host"); 1852 1853 case Q_ICMPV6: 1854 bpf_error("'icmp6' modifier applied to host"); 1855 #endif /* INET6 */ 1856 1857 case Q_AH: 1858 bpf_error("'ah' modifier applied to host"); 1859 1860 case Q_ESP: 1861 bpf_error("'esp' modifier applied to host"); 1862 1863 case Q_ISO: 1864 bpf_error("ISO host filtering not implemented"); 1865 1866 case Q_ESIS: 1867 bpf_error("'esis' modifier applied to host"); 1868 1869 case Q_ISIS: 1870 bpf_error("'isis' modifier applied to host"); 1871 1872 case Q_CLNP: 1873 bpf_error("'clnp' modifier applied to host"); 1874 1875 case Q_STP: 1876 bpf_error("'stp' modifier applied to host"); 1877 1878 case Q_IPX: 1879 bpf_error("IPX host filtering not implemented"); 1880 1881 case Q_NETBEUI: 1882 bpf_error("'netbeui' modifier applied to host"); 1883 1884 default: 1885 abort(); 1886 } 1887 /* NOTREACHED */ 1888 } 1889 1890 #ifdef INET6 1891 static struct block * 1892 gen_host6(addr, mask, proto, dir) 1893 struct in6_addr *addr; 1894 struct in6_addr *mask; 1895 int proto; 1896 int dir; 1897 { 1898 switch (proto) { 1899 1900 case Q_DEFAULT: 1901 return gen_host6(addr, mask, Q_IPV6, dir); 1902 1903 case Q_IP: 1904 bpf_error("'ip' modifier applied to ip6 host"); 1905 1906 case Q_RARP: 1907 bpf_error("'rarp' modifier applied to ip6 host"); 1908 1909 case Q_ARP: 1910 bpf_error("'arp' modifier applied to ip6 host"); 1911 1912 case Q_SCTP: 1913 bpf_error("'sctp' modifier applied to host"); 1914 1915 case Q_TCP: 1916 bpf_error("'tcp' modifier applied to host"); 1917 1918 case Q_UDP: 1919 bpf_error("'udp' modifier applied to host"); 1920 1921 case Q_ICMP: 1922 bpf_error("'icmp' modifier applied to host"); 1923 1924 case Q_IGMP: 1925 bpf_error("'igmp' modifier applied to host"); 1926 1927 case Q_IGRP: 1928 bpf_error("'igrp' modifier applied to host"); 1929 1930 case Q_PIM: 1931 bpf_error("'pim' modifier applied to host"); 1932 1933 case Q_VRRP: 1934 bpf_error("'vrrp' modifier applied to host"); 1935 1936 case Q_ATALK: 1937 bpf_error("ATALK host filtering not implemented"); 1938 1939 case Q_AARP: 1940 bpf_error("AARP host filtering not implemented"); 1941 1942 case Q_DECNET: 1943 bpf_error("'decnet' modifier applied to ip6 host"); 1944 1945 case Q_SCA: 1946 bpf_error("SCA host filtering not implemented"); 1947 1948 case Q_LAT: 1949 bpf_error("LAT host filtering not implemented"); 1950 1951 case Q_MOPDL: 1952 bpf_error("MOPDL host filtering not implemented"); 1953 1954 case Q_MOPRC: 1955 bpf_error("MOPRC host filtering not implemented"); 1956 1957 case Q_IPV6: 1958 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 1959 off_nl + 8, off_nl + 24); 1960 1961 case Q_ICMPV6: 1962 bpf_error("'icmp6' modifier applied to host"); 1963 1964 case Q_AH: 1965 bpf_error("'ah' modifier applied to host"); 1966 1967 case Q_ESP: 1968 bpf_error("'esp' modifier applied to host"); 1969 1970 case Q_ISO: 1971 bpf_error("ISO host filtering not implemented"); 1972 1973 case Q_ESIS: 1974 bpf_error("'esis' modifier applied to host"); 1975 1976 case Q_ISIS: 1977 bpf_error("'isis' modifier applied to host"); 1978 1979 case Q_CLNP: 1980 bpf_error("'clnp' modifier applied to host"); 1981 1982 case Q_STP: 1983 bpf_error("'stp' modifier applied to host"); 1984 1985 case Q_IPX: 1986 bpf_error("IPX host filtering not implemented"); 1987 1988 case Q_NETBEUI: 1989 bpf_error("'netbeui' modifier applied to host"); 1990 1991 default: 1992 abort(); 1993 } 1994 /* NOTREACHED */ 1995 } 1996 #endif /*INET6*/ 1997 1998 #ifndef INET6 1999 static struct block * 2000 gen_gateway(eaddr, alist, proto, dir) 2001 const u_char *eaddr; 2002 bpf_u_int32 **alist; 2003 int proto; 2004 int dir; 2005 { 2006 struct block *b0, *b1, *tmp; 2007 2008 if (dir != 0) 2009 bpf_error("direction applied to 'gateway'"); 2010 2011 switch (proto) { 2012 case Q_DEFAULT: 2013 case Q_IP: 2014 case Q_ARP: 2015 case Q_RARP: 2016 if (linktype == DLT_EN10MB) 2017 b0 = gen_ehostop(eaddr, Q_OR); 2018 else if (linktype == DLT_FDDI) 2019 b0 = gen_fhostop(eaddr, Q_OR); 2020 else if (linktype == DLT_IEEE802) 2021 b0 = gen_thostop(eaddr, Q_OR); 2022 else 2023 bpf_error( 2024 "'gateway' supported only on ethernet, FDDI or token ring"); 2025 2026 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR); 2027 while (*alist) { 2028 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR); 2029 gen_or(b1, tmp); 2030 b1 = tmp; 2031 } 2032 gen_not(b1); 2033 gen_and(b0, b1); 2034 return b1; 2035 } 2036 bpf_error("illegal modifier of 'gateway'"); 2037 /* NOTREACHED */ 2038 } 2039 #endif 2040 2041 struct block * 2042 gen_proto_abbrev(proto) 2043 int proto; 2044 { 2045 #ifdef INET6 2046 struct block *b0; 2047 #endif 2048 struct block *b1; 2049 2050 switch (proto) { 2051 2052 case Q_SCTP: 2053 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT); 2054 #ifdef INET6 2055 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT); 2056 gen_or(b0, b1); 2057 #endif 2058 break; 2059 2060 case Q_TCP: 2061 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT); 2062 #ifdef INET6 2063 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 2064 gen_or(b0, b1); 2065 #endif 2066 break; 2067 2068 case Q_UDP: 2069 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT); 2070 #ifdef INET6 2071 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT); 2072 gen_or(b0, b1); 2073 #endif 2074 break; 2075 2076 case Q_ICMP: 2077 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT); 2078 break; 2079 2080 #ifndef IPPROTO_IGMP 2081 #define IPPROTO_IGMP 2 2082 #endif 2083 2084 case Q_IGMP: 2085 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT); 2086 break; 2087 2088 #ifndef IPPROTO_IGRP 2089 #define IPPROTO_IGRP 9 2090 #endif 2091 case Q_IGRP: 2092 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT); 2093 break; 2094 2095 #ifndef IPPROTO_PIM 2096 #define IPPROTO_PIM 103 2097 #endif 2098 2099 case Q_PIM: 2100 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT); 2101 #ifdef INET6 2102 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 2103 gen_or(b0, b1); 2104 #endif 2105 break; 2106 2107 #ifndef IPPROTO_VRRP 2108 #define IPPROTO_VRRP 112 2109 #endif 2110 2111 case Q_VRRP: 2112 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT); 2113 break; 2114 2115 case Q_IP: 2116 b1 = gen_linktype(ETHERTYPE_IP); 2117 break; 2118 2119 case Q_ARP: 2120 b1 = gen_linktype(ETHERTYPE_ARP); 2121 break; 2122 2123 case Q_RARP: 2124 b1 = gen_linktype(ETHERTYPE_REVARP); 2125 break; 2126 2127 case Q_LINK: 2128 bpf_error("link layer applied in wrong context"); 2129 2130 case Q_ATALK: 2131 b1 = gen_linktype(ETHERTYPE_ATALK); 2132 break; 2133 2134 case Q_AARP: 2135 b1 = gen_linktype(ETHERTYPE_AARP); 2136 break; 2137 2138 case Q_DECNET: 2139 b1 = gen_linktype(ETHERTYPE_DN); 2140 break; 2141 2142 case Q_SCA: 2143 b1 = gen_linktype(ETHERTYPE_SCA); 2144 break; 2145 2146 case Q_LAT: 2147 b1 = gen_linktype(ETHERTYPE_LAT); 2148 break; 2149 2150 case Q_MOPDL: 2151 b1 = gen_linktype(ETHERTYPE_MOPDL); 2152 break; 2153 2154 case Q_MOPRC: 2155 b1 = gen_linktype(ETHERTYPE_MOPRC); 2156 break; 2157 2158 #ifdef INET6 2159 case Q_IPV6: 2160 b1 = gen_linktype(ETHERTYPE_IPV6); 2161 break; 2162 2163 #ifndef IPPROTO_ICMPV6 2164 #define IPPROTO_ICMPV6 58 2165 #endif 2166 case Q_ICMPV6: 2167 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 2168 break; 2169 #endif /* INET6 */ 2170 2171 #ifndef IPPROTO_AH 2172 #define IPPROTO_AH 51 2173 #endif 2174 case Q_AH: 2175 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT); 2176 #ifdef INET6 2177 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT); 2178 gen_or(b0, b1); 2179 #endif 2180 break; 2181 2182 #ifndef IPPROTO_ESP 2183 #define IPPROTO_ESP 50 2184 #endif 2185 case Q_ESP: 2186 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT); 2187 #ifdef INET6 2188 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 2189 gen_or(b0, b1); 2190 #endif 2191 break; 2192 2193 case Q_ISO: 2194 b1 = gen_linktype(LLCSAP_ISONS); 2195 break; 2196 2197 case Q_ESIS: 2198 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT); 2199 break; 2200 2201 case Q_ISIS: 2202 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 2203 break; 2204 2205 case Q_CLNP: 2206 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT); 2207 break; 2208 2209 case Q_STP: 2210 b1 = gen_linktype(LLCSAP_8021D); 2211 break; 2212 2213 case Q_IPX: 2214 b1 = gen_linktype(LLCSAP_IPX); 2215 break; 2216 2217 case Q_NETBEUI: 2218 b1 = gen_linktype(LLCSAP_NETBEUI); 2219 break; 2220 2221 default: 2222 abort(); 2223 } 2224 return b1; 2225 } 2226 2227 static struct block * 2228 gen_ipfrag() 2229 { 2230 struct slist *s; 2231 struct block *b; 2232 2233 /* not ip frag */ 2234 s = new_stmt(BPF_LD|BPF_H|BPF_ABS); 2235 s->s.k = off_nl + 6; 2236 b = new_block(JMP(BPF_JSET)); 2237 b->s.k = 0x1fff; 2238 b->stmts = s; 2239 gen_not(b); 2240 2241 return b; 2242 } 2243 2244 static struct block * 2245 gen_portatom(off, v) 2246 int off; 2247 bpf_int32 v; 2248 { 2249 struct slist *s; 2250 struct block *b; 2251 2252 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 2253 s->s.k = off_nl; 2254 2255 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H); 2256 s->next->s.k = off_nl + off; 2257 2258 b = new_block(JMP(BPF_JEQ)); 2259 b->stmts = s; 2260 b->s.k = v; 2261 2262 return b; 2263 } 2264 2265 #ifdef INET6 2266 static struct block * 2267 gen_portatom6(off, v) 2268 int off; 2269 bpf_int32 v; 2270 { 2271 return gen_cmp(off_nl + 40 + off, BPF_H, v); 2272 } 2273 #endif/*INET6*/ 2274 2275 struct block * 2276 gen_portop(port, proto, dir) 2277 int port, proto, dir; 2278 { 2279 struct block *b0, *b1, *tmp; 2280 2281 /* ip proto 'proto' */ 2282 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto); 2283 b0 = gen_ipfrag(); 2284 gen_and(tmp, b0); 2285 2286 switch (dir) { 2287 case Q_SRC: 2288 b1 = gen_portatom(0, (bpf_int32)port); 2289 break; 2290 2291 case Q_DST: 2292 b1 = gen_portatom(2, (bpf_int32)port); 2293 break; 2294 2295 case Q_OR: 2296 case Q_DEFAULT: 2297 tmp = gen_portatom(0, (bpf_int32)port); 2298 b1 = gen_portatom(2, (bpf_int32)port); 2299 gen_or(tmp, b1); 2300 break; 2301 2302 case Q_AND: 2303 tmp = gen_portatom(0, (bpf_int32)port); 2304 b1 = gen_portatom(2, (bpf_int32)port); 2305 gen_and(tmp, b1); 2306 break; 2307 2308 default: 2309 abort(); 2310 } 2311 gen_and(b0, b1); 2312 2313 return b1; 2314 } 2315 2316 static struct block * 2317 gen_port(port, ip_proto, dir) 2318 int port; 2319 int ip_proto; 2320 int dir; 2321 { 2322 struct block *b0, *b1, *tmp; 2323 2324 /* ether proto ip */ 2325 b0 = gen_linktype(ETHERTYPE_IP); 2326 2327 switch (ip_proto) { 2328 case IPPROTO_UDP: 2329 case IPPROTO_TCP: 2330 case IPPROTO_SCTP: 2331 b1 = gen_portop(port, ip_proto, dir); 2332 break; 2333 2334 case PROTO_UNDEF: 2335 tmp = gen_portop(port, IPPROTO_TCP, dir); 2336 b1 = gen_portop(port, IPPROTO_UDP, dir); 2337 gen_or(tmp, b1); 2338 tmp = gen_portop(port, IPPROTO_SCTP, dir); 2339 gen_or(tmp, b1); 2340 break; 2341 2342 default: 2343 abort(); 2344 } 2345 gen_and(b0, b1); 2346 return b1; 2347 } 2348 2349 #ifdef INET6 2350 struct block * 2351 gen_portop6(port, proto, dir) 2352 int port, proto, dir; 2353 { 2354 struct block *b0, *b1, *tmp; 2355 2356 /* ip proto 'proto' */ 2357 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto); 2358 2359 switch (dir) { 2360 case Q_SRC: 2361 b1 = gen_portatom6(0, (bpf_int32)port); 2362 break; 2363 2364 case Q_DST: 2365 b1 = gen_portatom6(2, (bpf_int32)port); 2366 break; 2367 2368 case Q_OR: 2369 case Q_DEFAULT: 2370 tmp = gen_portatom6(0, (bpf_int32)port); 2371 b1 = gen_portatom6(2, (bpf_int32)port); 2372 gen_or(tmp, b1); 2373 break; 2374 2375 case Q_AND: 2376 tmp = gen_portatom6(0, (bpf_int32)port); 2377 b1 = gen_portatom6(2, (bpf_int32)port); 2378 gen_and(tmp, b1); 2379 break; 2380 2381 default: 2382 abort(); 2383 } 2384 gen_and(b0, b1); 2385 2386 return b1; 2387 } 2388 2389 static struct block * 2390 gen_port6(port, ip_proto, dir) 2391 int port; 2392 int ip_proto; 2393 int dir; 2394 { 2395 struct block *b0, *b1, *tmp; 2396 2397 /* ether proto ip */ 2398 b0 = gen_linktype(ETHERTYPE_IPV6); 2399 2400 switch (ip_proto) { 2401 case IPPROTO_UDP: 2402 case IPPROTO_TCP: 2403 case IPPROTO_SCTP: 2404 b1 = gen_portop6(port, ip_proto, dir); 2405 break; 2406 2407 case PROTO_UNDEF: 2408 tmp = gen_portop6(port, IPPROTO_TCP, dir); 2409 b1 = gen_portop6(port, IPPROTO_UDP, dir); 2410 gen_or(tmp, b1); 2411 tmp = gen_portop6(port, IPPROTO_SCTP, dir); 2412 gen_or(tmp, b1); 2413 break; 2414 2415 default: 2416 abort(); 2417 } 2418 gen_and(b0, b1); 2419 return b1; 2420 } 2421 #endif /* INET6 */ 2422 2423 static int 2424 lookup_proto(name, proto) 2425 register const char *name; 2426 register int proto; 2427 { 2428 register int v; 2429 2430 switch (proto) { 2431 2432 case Q_DEFAULT: 2433 case Q_IP: 2434 case Q_IPV6: 2435 v = pcap_nametoproto(name); 2436 if (v == PROTO_UNDEF) 2437 bpf_error("unknown ip proto '%s'", name); 2438 break; 2439 2440 case Q_LINK: 2441 /* XXX should look up h/w protocol type based on linktype */ 2442 v = pcap_nametoeproto(name); 2443 if (v == PROTO_UNDEF) 2444 bpf_error("unknown ether proto '%s'", name); 2445 break; 2446 2447 case Q_ISO: 2448 if (strcmp(name, "esis") == 0) 2449 v = ISO9542_ESIS; 2450 else if (strcmp(name, "isis") == 0) 2451 v = ISO10589_ISIS; 2452 else if (strcmp(name, "clnp") == 0) 2453 v = ISO8473_CLNP; 2454 else 2455 bpf_error("unknown osi proto '%s'", name); 2456 break; 2457 2458 default: 2459 v = PROTO_UNDEF; 2460 break; 2461 } 2462 return v; 2463 } 2464 2465 #if 0 2466 struct stmt * 2467 gen_joinsp(s, n) 2468 struct stmt **s; 2469 int n; 2470 { 2471 return NULL; 2472 } 2473 #endif 2474 2475 static struct block * 2476 gen_protochain(v, proto, dir) 2477 int v; 2478 int proto; 2479 int dir; 2480 { 2481 #ifdef NO_PROTOCHAIN 2482 return gen_proto(v, proto, dir); 2483 #else 2484 struct block *b0, *b; 2485 struct slist *s[100]; 2486 int fix2, fix3, fix4, fix5; 2487 int ahcheck, again, end; 2488 int i, max; 2489 int reg2 = alloc_reg(); 2490 2491 memset(s, 0, sizeof(s)); 2492 fix2 = fix3 = fix4 = fix5 = 0; 2493 2494 switch (proto) { 2495 case Q_IP: 2496 case Q_IPV6: 2497 break; 2498 case Q_DEFAULT: 2499 b0 = gen_protochain(v, Q_IP, dir); 2500 b = gen_protochain(v, Q_IPV6, dir); 2501 gen_or(b0, b); 2502 return b; 2503 default: 2504 bpf_error("bad protocol applied for 'protochain'"); 2505 /*NOTREACHED*/ 2506 } 2507 2508 no_optimize = 1; /*this code is not compatible with optimzer yet */ 2509 2510 /* 2511 * s[0] is a dummy entry to protect other BPF insn from damaged 2512 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 2513 * hard to find interdependency made by jump table fixup. 2514 */ 2515 i = 0; 2516 s[i] = new_stmt(0); /*dummy*/ 2517 i++; 2518 2519 switch (proto) { 2520 case Q_IP: 2521 b0 = gen_linktype(ETHERTYPE_IP); 2522 2523 /* A = ip->ip_p */ 2524 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 2525 s[i]->s.k = off_nl + 9; 2526 i++; 2527 /* X = ip->ip_hl << 2 */ 2528 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 2529 s[i]->s.k = off_nl; 2530 i++; 2531 break; 2532 #ifdef INET6 2533 case Q_IPV6: 2534 b0 = gen_linktype(ETHERTYPE_IPV6); 2535 2536 /* A = ip6->ip_nxt */ 2537 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 2538 s[i]->s.k = off_nl + 6; 2539 i++; 2540 /* X = sizeof(struct ip6_hdr) */ 2541 s[i] = new_stmt(BPF_LDX|BPF_IMM); 2542 s[i]->s.k = 40; 2543 i++; 2544 break; 2545 #endif 2546 default: 2547 bpf_error("unsupported proto to gen_protochain"); 2548 /*NOTREACHED*/ 2549 } 2550 2551 /* again: if (A == v) goto end; else fall through; */ 2552 again = i; 2553 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2554 s[i]->s.k = v; 2555 s[i]->s.jt = NULL; /*later*/ 2556 s[i]->s.jf = NULL; /*update in next stmt*/ 2557 fix5 = i; 2558 i++; 2559 2560 #ifndef IPPROTO_NONE 2561 #define IPPROTO_NONE 59 2562 #endif 2563 /* if (A == IPPROTO_NONE) goto end */ 2564 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2565 s[i]->s.jt = NULL; /*later*/ 2566 s[i]->s.jf = NULL; /*update in next stmt*/ 2567 s[i]->s.k = IPPROTO_NONE; 2568 s[fix5]->s.jf = s[i]; 2569 fix2 = i; 2570 i++; 2571 2572 #ifdef INET6 2573 if (proto == Q_IPV6) { 2574 int v6start, v6end, v6advance, j; 2575 2576 v6start = i; 2577 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 2578 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2579 s[i]->s.jt = NULL; /*later*/ 2580 s[i]->s.jf = NULL; /*update in next stmt*/ 2581 s[i]->s.k = IPPROTO_HOPOPTS; 2582 s[fix2]->s.jf = s[i]; 2583 i++; 2584 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 2585 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2586 s[i]->s.jt = NULL; /*later*/ 2587 s[i]->s.jf = NULL; /*update in next stmt*/ 2588 s[i]->s.k = IPPROTO_DSTOPTS; 2589 i++; 2590 /* if (A == IPPROTO_ROUTING) goto v6advance */ 2591 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2592 s[i]->s.jt = NULL; /*later*/ 2593 s[i]->s.jf = NULL; /*update in next stmt*/ 2594 s[i]->s.k = IPPROTO_ROUTING; 2595 i++; 2596 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 2597 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2598 s[i]->s.jt = NULL; /*later*/ 2599 s[i]->s.jf = NULL; /*later*/ 2600 s[i]->s.k = IPPROTO_FRAGMENT; 2601 fix3 = i; 2602 v6end = i; 2603 i++; 2604 2605 /* v6advance: */ 2606 v6advance = i; 2607 2608 /* 2609 * in short, 2610 * A = P[X]; 2611 * X = X + (P[X + 1] + 1) * 8; 2612 */ 2613 /* A = X */ 2614 s[i] = new_stmt(BPF_MISC|BPF_TXA); 2615 i++; 2616 /* A = P[X + packet head] */ 2617 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2618 s[i]->s.k = off_nl; 2619 i++; 2620 /* MEM[reg2] = A */ 2621 s[i] = new_stmt(BPF_ST); 2622 s[i]->s.k = reg2; 2623 i++; 2624 /* A = X */ 2625 s[i] = new_stmt(BPF_MISC|BPF_TXA); 2626 i++; 2627 /* A += 1 */ 2628 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2629 s[i]->s.k = 1; 2630 i++; 2631 /* X = A */ 2632 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2633 i++; 2634 /* A = P[X + packet head]; */ 2635 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2636 s[i]->s.k = off_nl; 2637 i++; 2638 /* A += 1 */ 2639 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2640 s[i]->s.k = 1; 2641 i++; 2642 /* A *= 8 */ 2643 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 2644 s[i]->s.k = 8; 2645 i++; 2646 /* X = A; */ 2647 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2648 i++; 2649 /* A = MEM[reg2] */ 2650 s[i] = new_stmt(BPF_LD|BPF_MEM); 2651 s[i]->s.k = reg2; 2652 i++; 2653 2654 /* goto again; (must use BPF_JA for backward jump) */ 2655 s[i] = new_stmt(BPF_JMP|BPF_JA); 2656 s[i]->s.k = again - i - 1; 2657 s[i - 1]->s.jf = s[i]; 2658 i++; 2659 2660 /* fixup */ 2661 for (j = v6start; j <= v6end; j++) 2662 s[j]->s.jt = s[v6advance]; 2663 } else 2664 #endif 2665 { 2666 /* nop */ 2667 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2668 s[i]->s.k = 0; 2669 s[fix2]->s.jf = s[i]; 2670 i++; 2671 } 2672 2673 /* ahcheck: */ 2674 ahcheck = i; 2675 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 2676 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2677 s[i]->s.jt = NULL; /*later*/ 2678 s[i]->s.jf = NULL; /*later*/ 2679 s[i]->s.k = IPPROTO_AH; 2680 if (fix3) 2681 s[fix3]->s.jf = s[ahcheck]; 2682 fix4 = i; 2683 i++; 2684 2685 /* 2686 * in short, 2687 * A = P[X]; 2688 * X = X + (P[X + 1] + 2) * 4; 2689 */ 2690 /* A = X */ 2691 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 2692 i++; 2693 /* A = P[X + packet head]; */ 2694 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2695 s[i]->s.k = off_nl; 2696 i++; 2697 /* MEM[reg2] = A */ 2698 s[i] = new_stmt(BPF_ST); 2699 s[i]->s.k = reg2; 2700 i++; 2701 /* A = X */ 2702 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 2703 i++; 2704 /* A += 1 */ 2705 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2706 s[i]->s.k = 1; 2707 i++; 2708 /* X = A */ 2709 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2710 i++; 2711 /* A = P[X + packet head] */ 2712 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2713 s[i]->s.k = off_nl; 2714 i++; 2715 /* A += 2 */ 2716 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2717 s[i]->s.k = 2; 2718 i++; 2719 /* A *= 4 */ 2720 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 2721 s[i]->s.k = 4; 2722 i++; 2723 /* X = A; */ 2724 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2725 i++; 2726 /* A = MEM[reg2] */ 2727 s[i] = new_stmt(BPF_LD|BPF_MEM); 2728 s[i]->s.k = reg2; 2729 i++; 2730 2731 /* goto again; (must use BPF_JA for backward jump) */ 2732 s[i] = new_stmt(BPF_JMP|BPF_JA); 2733 s[i]->s.k = again - i - 1; 2734 i++; 2735 2736 /* end: nop */ 2737 end = i; 2738 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2739 s[i]->s.k = 0; 2740 s[fix2]->s.jt = s[end]; 2741 s[fix4]->s.jf = s[end]; 2742 s[fix5]->s.jt = s[end]; 2743 i++; 2744 2745 /* 2746 * make slist chain 2747 */ 2748 max = i; 2749 for (i = 0; i < max - 1; i++) 2750 s[i]->next = s[i + 1]; 2751 s[max - 1]->next = NULL; 2752 2753 /* 2754 * emit final check 2755 */ 2756 b = new_block(JMP(BPF_JEQ)); 2757 b->stmts = s[1]; /*remember, s[0] is dummy*/ 2758 b->s.k = v; 2759 2760 free_reg(reg2); 2761 2762 gen_and(b0, b); 2763 return b; 2764 #endif 2765 } 2766 2767 static struct block * 2768 gen_proto(v, proto, dir) 2769 int v; 2770 int proto; 2771 int dir; 2772 { 2773 struct block *b0, *b1; 2774 2775 if (dir != Q_DEFAULT) 2776 bpf_error("direction applied to 'proto'"); 2777 2778 switch (proto) { 2779 case Q_DEFAULT: 2780 #ifdef INET6 2781 b0 = gen_proto(v, Q_IP, dir); 2782 b1 = gen_proto(v, Q_IPV6, dir); 2783 gen_or(b0, b1); 2784 return b1; 2785 #else 2786 /*FALLTHROUGH*/ 2787 #endif 2788 case Q_IP: 2789 b0 = gen_linktype(ETHERTYPE_IP); 2790 #ifndef CHASE_CHAIN 2791 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v); 2792 #else 2793 b1 = gen_protochain(v, Q_IP); 2794 #endif 2795 gen_and(b0, b1); 2796 return b1; 2797 2798 case Q_ISO: 2799 b0 = gen_linktype(LLCSAP_ISONS); 2800 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v); 2801 gen_and(b0, b1); 2802 return b1; 2803 2804 case Q_ARP: 2805 bpf_error("arp does not encapsulate another protocol"); 2806 /* NOTREACHED */ 2807 2808 case Q_RARP: 2809 bpf_error("rarp does not encapsulate another protocol"); 2810 /* NOTREACHED */ 2811 2812 case Q_ATALK: 2813 bpf_error("atalk encapsulation is not specifiable"); 2814 /* NOTREACHED */ 2815 2816 case Q_DECNET: 2817 bpf_error("decnet encapsulation is not specifiable"); 2818 /* NOTREACHED */ 2819 2820 case Q_SCA: 2821 bpf_error("sca does not encapsulate another protocol"); 2822 /* NOTREACHED */ 2823 2824 case Q_LAT: 2825 bpf_error("lat does not encapsulate another protocol"); 2826 /* NOTREACHED */ 2827 2828 case Q_MOPRC: 2829 bpf_error("moprc does not encapsulate another protocol"); 2830 /* NOTREACHED */ 2831 2832 case Q_MOPDL: 2833 bpf_error("mopdl does not encapsulate another protocol"); 2834 /* NOTREACHED */ 2835 2836 case Q_LINK: 2837 return gen_linktype(v); 2838 2839 case Q_UDP: 2840 bpf_error("'udp proto' is bogus"); 2841 /* NOTREACHED */ 2842 2843 case Q_TCP: 2844 bpf_error("'tcp proto' is bogus"); 2845 /* NOTREACHED */ 2846 2847 case Q_SCTP: 2848 bpf_error("'sctp proto' is bogus"); 2849 /* NOTREACHED */ 2850 2851 case Q_ICMP: 2852 bpf_error("'icmp proto' is bogus"); 2853 /* NOTREACHED */ 2854 2855 case Q_IGMP: 2856 bpf_error("'igmp proto' is bogus"); 2857 /* NOTREACHED */ 2858 2859 case Q_IGRP: 2860 bpf_error("'igrp proto' is bogus"); 2861 /* NOTREACHED */ 2862 2863 case Q_PIM: 2864 bpf_error("'pim proto' is bogus"); 2865 /* NOTREACHED */ 2866 2867 case Q_VRRP: 2868 bpf_error("'vrrp proto' is bogus"); 2869 /* NOTREACHED */ 2870 2871 #ifdef INET6 2872 case Q_IPV6: 2873 b0 = gen_linktype(ETHERTYPE_IPV6); 2874 #ifndef CHASE_CHAIN 2875 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v); 2876 #else 2877 b1 = gen_protochain(v, Q_IPV6); 2878 #endif 2879 gen_and(b0, b1); 2880 return b1; 2881 2882 case Q_ICMPV6: 2883 bpf_error("'icmp6 proto' is bogus"); 2884 #endif /* INET6 */ 2885 2886 case Q_AH: 2887 bpf_error("'ah proto' is bogus"); 2888 2889 case Q_ESP: 2890 bpf_error("'ah proto' is bogus"); 2891 2892 case Q_STP: 2893 bpf_error("'stp proto' is bogus"); 2894 2895 case Q_IPX: 2896 bpf_error("'ipx proto' is bogus"); 2897 2898 case Q_NETBEUI: 2899 bpf_error("'netbeui proto' is bogus"); 2900 2901 default: 2902 abort(); 2903 /* NOTREACHED */ 2904 } 2905 /* NOTREACHED */ 2906 } 2907 2908 struct block * 2909 gen_scode(name, q) 2910 register const char *name; 2911 struct qual q; 2912 { 2913 int proto = q.proto; 2914 int dir = q.dir; 2915 int tproto; 2916 u_char *eaddr; 2917 bpf_u_int32 mask, addr; 2918 #ifndef INET6 2919 bpf_u_int32 **alist; 2920 #else 2921 int tproto6; 2922 struct sockaddr_in *sin; 2923 struct sockaddr_in6 *sin6; 2924 struct addrinfo *res, *res0; 2925 struct in6_addr mask128; 2926 #endif /*INET6*/ 2927 struct block *b, *tmp; 2928 int port, real_proto; 2929 2930 switch (q.addr) { 2931 2932 case Q_NET: 2933 addr = pcap_nametonetaddr(name); 2934 if (addr == 0) 2935 bpf_error("unknown network '%s'", name); 2936 /* Left justify network addr and calculate its network mask */ 2937 mask = 0xffffffff; 2938 while (addr && (addr & 0xff000000) == 0) { 2939 addr <<= 8; 2940 mask <<= 8; 2941 } 2942 return gen_host(addr, mask, proto, dir); 2943 2944 case Q_DEFAULT: 2945 case Q_HOST: 2946 if (proto == Q_LINK) { 2947 switch (linktype) { 2948 2949 case DLT_EN10MB: 2950 eaddr = pcap_ether_hostton(name); 2951 if (eaddr == NULL) 2952 bpf_error( 2953 "unknown ether host '%s'", name); 2954 b = gen_ehostop(eaddr, dir); 2955 free(eaddr); 2956 return b; 2957 2958 case DLT_FDDI: 2959 eaddr = pcap_ether_hostton(name); 2960 if (eaddr == NULL) 2961 bpf_error( 2962 "unknown FDDI host '%s'", name); 2963 b = gen_fhostop(eaddr, dir); 2964 free(eaddr); 2965 return b; 2966 2967 case DLT_IEEE802: 2968 eaddr = pcap_ether_hostton(name); 2969 if (eaddr == NULL) 2970 bpf_error( 2971 "unknown token ring host '%s'", name); 2972 b = gen_thostop(eaddr, dir); 2973 free(eaddr); 2974 return b; 2975 2976 default: 2977 bpf_error( 2978 "only ethernet/FDDI/token ring supports link-level host name"); 2979 break; 2980 } 2981 } else if (proto == Q_DECNET) { 2982 unsigned short dn_addr = __pcap_nametodnaddr(name); 2983 /* 2984 * I don't think DECNET hosts can be multihomed, so 2985 * there is no need to build up a list of addresses 2986 */ 2987 return (gen_host(dn_addr, 0, proto, dir)); 2988 } else { 2989 #ifndef INET6 2990 alist = pcap_nametoaddr(name); 2991 if (alist == NULL || *alist == NULL) 2992 bpf_error("unknown host '%s'", name); 2993 tproto = proto; 2994 if (off_linktype == -1 && tproto == Q_DEFAULT) 2995 tproto = Q_IP; 2996 b = gen_host(**alist++, 0xffffffff, tproto, dir); 2997 while (*alist) { 2998 tmp = gen_host(**alist++, 0xffffffff, 2999 tproto, dir); 3000 gen_or(b, tmp); 3001 b = tmp; 3002 } 3003 return b; 3004 #else 3005 memset(&mask128, 0xff, sizeof(mask128)); 3006 res0 = res = pcap_nametoaddrinfo(name); 3007 if (res == NULL) 3008 bpf_error("unknown host '%s'", name); 3009 b = tmp = NULL; 3010 tproto = tproto6 = proto; 3011 if (off_linktype == -1 && tproto == Q_DEFAULT) { 3012 tproto = Q_IP; 3013 tproto6 = Q_IPV6; 3014 } 3015 for (res = res0; res; res = res->ai_next) { 3016 switch (res->ai_family) { 3017 case AF_INET: 3018 if (tproto == Q_IPV6) 3019 continue; 3020 3021 sin = (struct sockaddr_in *) 3022 res->ai_addr; 3023 tmp = gen_host(ntohl(sin->sin_addr.s_addr), 3024 0xffffffff, tproto, dir); 3025 break; 3026 case AF_INET6: 3027 if (tproto6 == Q_IP) 3028 continue; 3029 3030 sin6 = (struct sockaddr_in6 *) 3031 res->ai_addr; 3032 tmp = gen_host6(&sin6->sin6_addr, 3033 &mask128, tproto6, dir); 3034 break; 3035 default: 3036 continue; 3037 } 3038 if (b) 3039 gen_or(b, tmp); 3040 b = tmp; 3041 } 3042 freeaddrinfo(res0); 3043 if (b == NULL) { 3044 bpf_error("unknown host '%s'%s", name, 3045 (proto == Q_DEFAULT) 3046 ? "" 3047 : " for specified address family"); 3048 } 3049 return b; 3050 #endif /*INET6*/ 3051 } 3052 3053 case Q_PORT: 3054 if (proto != Q_DEFAULT && 3055 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 3056 bpf_error("illegal qualifier of 'port'"); 3057 if (pcap_nametoport(name, &port, &real_proto) == 0) 3058 bpf_error("unknown port '%s'", name); 3059 if (proto == Q_UDP) { 3060 if (real_proto == IPPROTO_TCP) 3061 bpf_error("port '%s' is tcp", name); 3062 else if (real_proto == IPPROTO_SCTP) 3063 bpf_error("port '%s' is sctp", name); 3064 else 3065 /* override PROTO_UNDEF */ 3066 real_proto = IPPROTO_UDP; 3067 } 3068 if (proto == Q_TCP) { 3069 if (real_proto == IPPROTO_UDP) 3070 bpf_error("port '%s' is udp", name); 3071 3072 else if (real_proto == IPPROTO_SCTP) 3073 bpf_error("port '%s' is sctp", name); 3074 else 3075 /* override PROTO_UNDEF */ 3076 real_proto = IPPROTO_TCP; 3077 } 3078 if (proto == Q_SCTP) { 3079 if (real_proto == IPPROTO_UDP) 3080 bpf_error("port '%s' is udp", name); 3081 3082 else if (real_proto == IPPROTO_TCP) 3083 bpf_error("port '%s' is tcp", name); 3084 else 3085 /* override PROTO_UNDEF */ 3086 real_proto = IPPROTO_SCTP; 3087 } 3088 #ifndef INET6 3089 return gen_port(port, real_proto, dir); 3090 #else 3091 { 3092 struct block *b; 3093 b = gen_port(port, real_proto, dir); 3094 gen_or(gen_port6(port, real_proto, dir), b); 3095 return b; 3096 } 3097 #endif /* INET6 */ 3098 3099 case Q_GATEWAY: 3100 #ifndef INET6 3101 eaddr = pcap_ether_hostton(name); 3102 if (eaddr == NULL) 3103 bpf_error("unknown ether host: %s", name); 3104 3105 alist = pcap_nametoaddr(name); 3106 if (alist == NULL || *alist == NULL) 3107 bpf_error("unknown host '%s'", name); 3108 b = gen_gateway(eaddr, alist, proto, dir); 3109 free(eaddr); 3110 return b; 3111 #else 3112 bpf_error("'gateway' not supported in this configuration"); 3113 #endif /*INET6*/ 3114 3115 case Q_PROTO: 3116 real_proto = lookup_proto(name, proto); 3117 if (real_proto >= 0) 3118 return gen_proto(real_proto, proto, dir); 3119 else 3120 bpf_error("unknown protocol: %s", name); 3121 3122 case Q_PROTOCHAIN: 3123 real_proto = lookup_proto(name, proto); 3124 if (real_proto >= 0) 3125 return gen_protochain(real_proto, proto, dir); 3126 else 3127 bpf_error("unknown protocol: %s", name); 3128 3129 3130 case Q_UNDEF: 3131 syntax(); 3132 /* NOTREACHED */ 3133 } 3134 abort(); 3135 /* NOTREACHED */ 3136 } 3137 3138 struct block * 3139 gen_mcode(s1, s2, masklen, q) 3140 register const char *s1, *s2; 3141 register int masklen; 3142 struct qual q; 3143 { 3144 register int nlen, mlen; 3145 bpf_u_int32 n, m; 3146 3147 nlen = __pcap_atoin(s1, &n); 3148 /* Promote short ipaddr */ 3149 n <<= 32 - nlen; 3150 3151 if (s2 != NULL) { 3152 mlen = __pcap_atoin(s2, &m); 3153 /* Promote short ipaddr */ 3154 m <<= 32 - mlen; 3155 if ((n & ~m) != 0) 3156 bpf_error("non-network bits set in \"%s mask %s\"", 3157 s1, s2); 3158 } else { 3159 /* Convert mask len to mask */ 3160 if (masklen > 32) 3161 bpf_error("mask length must be <= 32"); 3162 m = 0xffffffff << (32 - masklen); 3163 if ((n & ~m) != 0) 3164 bpf_error("non-network bits set in \"%s/%d\"", 3165 s1, masklen); 3166 } 3167 3168 switch (q.addr) { 3169 3170 case Q_NET: 3171 return gen_host(n, m, q.proto, q.dir); 3172 3173 default: 3174 bpf_error("Mask syntax for networks only"); 3175 /* NOTREACHED */ 3176 } 3177 } 3178 3179 struct block * 3180 gen_ncode(s, v, q) 3181 register const char *s; 3182 bpf_u_int32 v; 3183 struct qual q; 3184 { 3185 bpf_u_int32 mask; 3186 int proto = q.proto; 3187 int dir = q.dir; 3188 register int vlen; 3189 3190 if (s == NULL) 3191 vlen = 32; 3192 else if (q.proto == Q_DECNET) 3193 vlen = __pcap_atodn(s, &v); 3194 else 3195 vlen = __pcap_atoin(s, &v); 3196 3197 switch (q.addr) { 3198 3199 case Q_DEFAULT: 3200 case Q_HOST: 3201 case Q_NET: 3202 if (proto == Q_DECNET) 3203 return gen_host(v, 0, proto, dir); 3204 else if (proto == Q_LINK) { 3205 bpf_error("illegal link layer address"); 3206 } else { 3207 mask = 0xffffffff; 3208 if (s == NULL && q.addr == Q_NET) { 3209 /* Promote short net number */ 3210 while (v && (v & 0xff000000) == 0) { 3211 v <<= 8; 3212 mask <<= 8; 3213 } 3214 } else { 3215 /* Promote short ipaddr */ 3216 v <<= 32 - vlen; 3217 mask <<= 32 - vlen; 3218 } 3219 return gen_host(v, mask, proto, dir); 3220 } 3221 3222 case Q_PORT: 3223 if (proto == Q_UDP) 3224 proto = IPPROTO_UDP; 3225 else if (proto == Q_TCP) 3226 proto = IPPROTO_TCP; 3227 else if (proto == Q_SCTP) 3228 proto = IPPROTO_SCTP; 3229 else if (proto == Q_DEFAULT) 3230 proto = PROTO_UNDEF; 3231 else 3232 bpf_error("illegal qualifier of 'port'"); 3233 3234 #ifndef INET6 3235 return gen_port((int)v, proto, dir); 3236 #else 3237 { 3238 struct block *b; 3239 b = gen_port((int)v, proto, dir); 3240 gen_or(gen_port6((int)v, proto, dir), b); 3241 return b; 3242 } 3243 #endif /* INET6 */ 3244 3245 case Q_GATEWAY: 3246 bpf_error("'gateway' requires a name"); 3247 /* NOTREACHED */ 3248 3249 case Q_PROTO: 3250 return gen_proto((int)v, proto, dir); 3251 3252 case Q_PROTOCHAIN: 3253 return gen_protochain((int)v, proto, dir); 3254 3255 case Q_UNDEF: 3256 syntax(); 3257 /* NOTREACHED */ 3258 3259 default: 3260 abort(); 3261 /* NOTREACHED */ 3262 } 3263 /* NOTREACHED */ 3264 } 3265 3266 #ifdef INET6 3267 struct block * 3268 gen_mcode6(s1, s2, masklen, q) 3269 register const char *s1, *s2; 3270 register int masklen; 3271 struct qual q; 3272 { 3273 struct addrinfo *res; 3274 struct in6_addr *addr; 3275 struct in6_addr mask; 3276 struct block *b; 3277 u_int32_t *a, *m; 3278 3279 if (s2) 3280 bpf_error("no mask %s supported", s2); 3281 3282 res = pcap_nametoaddrinfo(s1); 3283 if (!res) 3284 bpf_error("invalid ip6 address %s", s1); 3285 if (res->ai_next) 3286 bpf_error("%s resolved to multiple address", s1); 3287 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 3288 3289 if (sizeof(mask) * 8 < masklen) 3290 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8)); 3291 memset(&mask, 0, sizeof(mask)); 3292 memset(&mask, 0xff, masklen / 8); 3293 if (masklen % 8) { 3294 mask.s6_addr[masklen / 8] = 3295 (0xff << (8 - masklen % 8)) & 0xff; 3296 } 3297 3298 a = (u_int32_t *)addr; 3299 m = (u_int32_t *)&mask; 3300 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 3301 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 3302 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen); 3303 } 3304 3305 switch (q.addr) { 3306 3307 case Q_DEFAULT: 3308 case Q_HOST: 3309 if (masklen != 128) 3310 bpf_error("Mask syntax for networks only"); 3311 /* FALLTHROUGH */ 3312 3313 case Q_NET: 3314 b = gen_host6(addr, &mask, q.proto, q.dir); 3315 freeaddrinfo(res); 3316 return b; 3317 3318 default: 3319 bpf_error("invalid qualifier against IPv6 address"); 3320 /* NOTREACHED */ 3321 } 3322 } 3323 #endif /*INET6*/ 3324 3325 struct block * 3326 gen_ecode(eaddr, q) 3327 register const u_char *eaddr; 3328 struct qual q; 3329 { 3330 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 3331 if (linktype == DLT_EN10MB) 3332 return gen_ehostop(eaddr, (int)q.dir); 3333 if (linktype == DLT_FDDI) 3334 return gen_fhostop(eaddr, (int)q.dir); 3335 if (linktype == DLT_IEEE802) 3336 return gen_thostop(eaddr, (int)q.dir); 3337 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring"); 3338 } 3339 bpf_error("ethernet address used in non-ether expression"); 3340 /* NOTREACHED */ 3341 } 3342 3343 void 3344 sappend(s0, s1) 3345 struct slist *s0, *s1; 3346 { 3347 /* 3348 * This is definitely not the best way to do this, but the 3349 * lists will rarely get long. 3350 */ 3351 while (s0->next) 3352 s0 = s0->next; 3353 s0->next = s1; 3354 } 3355 3356 static struct slist * 3357 xfer_to_x(a) 3358 struct arth *a; 3359 { 3360 struct slist *s; 3361 3362 s = new_stmt(BPF_LDX|BPF_MEM); 3363 s->s.k = a->regno; 3364 return s; 3365 } 3366 3367 static struct slist * 3368 xfer_to_a(a) 3369 struct arth *a; 3370 { 3371 struct slist *s; 3372 3373 s = new_stmt(BPF_LD|BPF_MEM); 3374 s->s.k = a->regno; 3375 return s; 3376 } 3377 3378 struct arth * 3379 gen_load(proto, index, size) 3380 int proto; 3381 struct arth *index; 3382 int size; 3383 { 3384 struct slist *s, *tmp; 3385 struct block *b; 3386 int regno = alloc_reg(); 3387 3388 free_reg(index->regno); 3389 switch (size) { 3390 3391 default: 3392 bpf_error("data size must be 1, 2, or 4"); 3393 3394 case 1: 3395 size = BPF_B; 3396 break; 3397 3398 case 2: 3399 size = BPF_H; 3400 break; 3401 3402 case 4: 3403 size = BPF_W; 3404 break; 3405 } 3406 switch (proto) { 3407 default: 3408 bpf_error("unsupported index operation"); 3409 3410 case Q_LINK: 3411 s = xfer_to_x(index); 3412 tmp = new_stmt(BPF_LD|BPF_IND|size); 3413 sappend(s, tmp); 3414 sappend(index->s, s); 3415 break; 3416 3417 case Q_IP: 3418 case Q_ARP: 3419 case Q_RARP: 3420 case Q_ATALK: 3421 case Q_DECNET: 3422 case Q_SCA: 3423 case Q_LAT: 3424 case Q_MOPRC: 3425 case Q_MOPDL: 3426 #ifdef INET6 3427 case Q_IPV6: 3428 #endif 3429 /* XXX Note that we assume a fixed link header here. */ 3430 s = xfer_to_x(index); 3431 tmp = new_stmt(BPF_LD|BPF_IND|size); 3432 tmp->s.k = off_nl; 3433 sappend(s, tmp); 3434 sappend(index->s, s); 3435 3436 b = gen_proto_abbrev(proto); 3437 if (index->b) 3438 gen_and(index->b, b); 3439 index->b = b; 3440 break; 3441 3442 case Q_SCTP: 3443 case Q_TCP: 3444 case Q_UDP: 3445 case Q_ICMP: 3446 case Q_IGMP: 3447 case Q_IGRP: 3448 case Q_PIM: 3449 case Q_VRRP: 3450 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 3451 s->s.k = off_nl; 3452 sappend(s, xfer_to_a(index)); 3453 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 3454 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 3455 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 3456 tmp->s.k = off_nl; 3457 sappend(index->s, s); 3458 3459 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); 3460 if (index->b) 3461 gen_and(index->b, b); 3462 #ifdef INET6 3463 gen_and(gen_proto_abbrev(Q_IP), b); 3464 #endif 3465 index->b = b; 3466 break; 3467 #ifdef INET6 3468 case Q_ICMPV6: 3469 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]"); 3470 /*NOTREACHED*/ 3471 #endif 3472 } 3473 index->regno = regno; 3474 s = new_stmt(BPF_ST); 3475 s->s.k = regno; 3476 sappend(index->s, s); 3477 3478 return index; 3479 } 3480 3481 struct block * 3482 gen_relation(code, a0, a1, reversed) 3483 int code; 3484 struct arth *a0, *a1; 3485 int reversed; 3486 { 3487 struct slist *s0, *s1, *s2; 3488 struct block *b, *tmp; 3489 3490 s0 = xfer_to_x(a1); 3491 s1 = xfer_to_a(a0); 3492 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X); 3493 b = new_block(JMP(code)); 3494 if (code == BPF_JGT || code == BPF_JGE) { 3495 reversed = !reversed; 3496 b->s.k = 0x80000000; 3497 } 3498 if (reversed) 3499 gen_not(b); 3500 3501 sappend(s1, s2); 3502 sappend(s0, s1); 3503 sappend(a1->s, s0); 3504 sappend(a0->s, a1->s); 3505 3506 b->stmts = a0->s; 3507 3508 free_reg(a0->regno); 3509 free_reg(a1->regno); 3510 3511 /* 'and' together protocol checks */ 3512 if (a0->b) { 3513 if (a1->b) { 3514 gen_and(a0->b, tmp = a1->b); 3515 } 3516 else 3517 tmp = a0->b; 3518 } else 3519 tmp = a1->b; 3520 3521 if (tmp) 3522 gen_and(tmp, b); 3523 3524 return b; 3525 } 3526 3527 struct arth * 3528 gen_loadlen() 3529 { 3530 int regno = alloc_reg(); 3531 struct arth *a = (struct arth *)newchunk(sizeof(*a)); 3532 struct slist *s; 3533 3534 s = new_stmt(BPF_LD|BPF_LEN); 3535 s->next = new_stmt(BPF_ST); 3536 s->next->s.k = regno; 3537 a->s = s; 3538 a->regno = regno; 3539 3540 return a; 3541 } 3542 3543 struct arth * 3544 gen_loadi(val) 3545 int val; 3546 { 3547 struct arth *a; 3548 struct slist *s; 3549 int reg; 3550 3551 a = (struct arth *)newchunk(sizeof(*a)); 3552 3553 reg = alloc_reg(); 3554 3555 s = new_stmt(BPF_LD|BPF_IMM); 3556 s->s.k = val; 3557 s->next = new_stmt(BPF_ST); 3558 s->next->s.k = reg; 3559 a->s = s; 3560 a->regno = reg; 3561 3562 return a; 3563 } 3564 3565 struct arth * 3566 gen_neg(a) 3567 struct arth *a; 3568 { 3569 struct slist *s; 3570 3571 s = xfer_to_a(a); 3572 sappend(a->s, s); 3573 s = new_stmt(BPF_ALU|BPF_NEG); 3574 s->s.k = 0; 3575 sappend(a->s, s); 3576 s = new_stmt(BPF_ST); 3577 s->s.k = a->regno; 3578 sappend(a->s, s); 3579 3580 return a; 3581 } 3582 3583 struct arth * 3584 gen_arth(code, a0, a1) 3585 int code; 3586 struct arth *a0, *a1; 3587 { 3588 struct slist *s0, *s1, *s2; 3589 3590 s0 = xfer_to_x(a1); 3591 s1 = xfer_to_a(a0); 3592 s2 = new_stmt(BPF_ALU|BPF_X|code); 3593 3594 sappend(s1, s2); 3595 sappend(s0, s1); 3596 sappend(a1->s, s0); 3597 sappend(a0->s, a1->s); 3598 3599 free_reg(a1->regno); 3600 3601 s0 = new_stmt(BPF_ST); 3602 a0->regno = s0->s.k = alloc_reg(); 3603 sappend(a0->s, s0); 3604 3605 return a0; 3606 } 3607 3608 /* 3609 * Here we handle simple allocation of the scratch registers. 3610 * If too many registers are alloc'd, the allocator punts. 3611 */ 3612 static int regused[BPF_MEMWORDS]; 3613 static int curreg; 3614 3615 /* 3616 * Return the next free register. 3617 */ 3618 static int 3619 alloc_reg() 3620 { 3621 int n = BPF_MEMWORDS; 3622 3623 while (--n >= 0) { 3624 if (regused[curreg]) 3625 curreg = (curreg + 1) % BPF_MEMWORDS; 3626 else { 3627 regused[curreg] = 1; 3628 return curreg; 3629 } 3630 } 3631 bpf_error("too many registers needed to evaluate expression"); 3632 /* NOTREACHED */ 3633 } 3634 3635 /* 3636 * Return a register to the table so it can 3637 * be used later. 3638 */ 3639 static void 3640 free_reg(n) 3641 int n; 3642 { 3643 regused[n] = 0; 3644 } 3645 3646 static struct block * 3647 gen_len(jmp, n) 3648 int jmp, n; 3649 { 3650 struct slist *s; 3651 struct block *b; 3652 3653 s = new_stmt(BPF_LD|BPF_LEN); 3654 b = new_block(JMP(jmp)); 3655 b->stmts = s; 3656 b->s.k = n; 3657 3658 return b; 3659 } 3660 3661 struct block * 3662 gen_greater(n) 3663 int n; 3664 { 3665 return gen_len(BPF_JGE, n); 3666 } 3667 3668 /* 3669 * Actually, this is less than or equal. 3670 */ 3671 struct block * 3672 gen_less(n) 3673 int n; 3674 { 3675 struct block *b; 3676 3677 b = gen_len(BPF_JGT, n); 3678 gen_not(b); 3679 3680 return b; 3681 } 3682 3683 struct block * 3684 gen_byteop(op, idx, val) 3685 int op, idx, val; 3686 { 3687 struct block *b; 3688 struct slist *s; 3689 3690 switch (op) { 3691 default: 3692 abort(); 3693 3694 case '=': 3695 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3696 3697 case '<': 3698 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3699 b->s.code = JMP(BPF_JGE); 3700 gen_not(b); 3701 return b; 3702 3703 case '>': 3704 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3705 b->s.code = JMP(BPF_JGT); 3706 return b; 3707 3708 case '|': 3709 s = new_stmt(BPF_ALU|BPF_OR|BPF_K); 3710 break; 3711 3712 case '&': 3713 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 3714 break; 3715 } 3716 s->s.k = val; 3717 b = new_block(JMP(BPF_JEQ)); 3718 b->stmts = s; 3719 gen_not(b); 3720 3721 return b; 3722 } 3723 3724 static u_char abroadcast[] = { 0x0 }; 3725 3726 struct block * 3727 gen_broadcast(proto) 3728 int proto; 3729 { 3730 bpf_u_int32 hostmask; 3731 struct block *b0, *b1, *b2; 3732 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 3733 3734 switch (proto) { 3735 3736 case Q_DEFAULT: 3737 case Q_LINK: 3738 if (linktype == DLT_ARCNET) 3739 return gen_ahostop(abroadcast, Q_DST); 3740 if (linktype == DLT_EN10MB) 3741 return gen_ehostop(ebroadcast, Q_DST); 3742 if (linktype == DLT_FDDI) 3743 return gen_fhostop(ebroadcast, Q_DST); 3744 if (linktype == DLT_IEEE802) 3745 return gen_thostop(ebroadcast, Q_DST); 3746 bpf_error("not a broadcast link"); 3747 break; 3748 3749 case Q_IP: 3750 b0 = gen_linktype(ETHERTYPE_IP); 3751 hostmask = ~netmask; 3752 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask); 3753 b2 = gen_mcmp(off_nl + 16, BPF_W, 3754 (bpf_int32)(~0 & hostmask), hostmask); 3755 gen_or(b1, b2); 3756 gen_and(b0, b2); 3757 return b2; 3758 } 3759 bpf_error("only ether/ip broadcast filters supported"); 3760 } 3761 3762 struct block * 3763 gen_multicast(proto) 3764 int proto; 3765 { 3766 register struct block *b0, *b1; 3767 register struct slist *s; 3768 3769 switch (proto) { 3770 3771 case Q_DEFAULT: 3772 case Q_LINK: 3773 if (linktype == DLT_ARCNET) 3774 /* all ARCnet multicasts use the same address */ 3775 return gen_ahostop(abroadcast, Q_DST); 3776 3777 if (linktype == DLT_EN10MB) { 3778 /* ether[0] & 1 != 0 */ 3779 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3780 s->s.k = 0; 3781 b0 = new_block(JMP(BPF_JSET)); 3782 b0->s.k = 1; 3783 b0->stmts = s; 3784 return b0; 3785 } 3786 3787 if (linktype == DLT_FDDI) { 3788 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */ 3789 /* fddi[1] & 1 != 0 */ 3790 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3791 s->s.k = 1; 3792 b0 = new_block(JMP(BPF_JSET)); 3793 b0->s.k = 1; 3794 b0->stmts = s; 3795 return b0; 3796 } 3797 3798 /* TODO - check how token ring handles multicast */ 3799 /* if (linktype == DLT_IEEE802) ... */ 3800 3801 /* Link not known to support multicasts */ 3802 break; 3803 3804 case Q_IP: 3805 b0 = gen_linktype(ETHERTYPE_IP); 3806 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224); 3807 b1->s.code = JMP(BPF_JGE); 3808 gen_and(b0, b1); 3809 return b1; 3810 3811 #ifdef INET6 3812 case Q_IPV6: 3813 b0 = gen_linktype(ETHERTYPE_IPV6); 3814 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255); 3815 gen_and(b0, b1); 3816 return b1; 3817 #endif /* INET6 */ 3818 } 3819 bpf_error("only IP multicast filters supported on ethernet/FDDI"); 3820 } 3821 3822 /* 3823 * generate command for inbound/outbound. It's here so we can 3824 * make it link-type specific. 'dir' = 0 implies "inbound", 3825 * = 1 implies "outbound". 3826 */ 3827 struct block * 3828 gen_inbound(dir) 3829 int dir; 3830 { 3831 register struct block *b0; 3832 3833 /* 3834 * Only some data link types support inbound/outbound qualifiers. 3835 */ 3836 switch (linktype) { 3837 case DLT_SLIP: 3838 case DLT_PPP: 3839 b0 = gen_relation(BPF_JEQ, 3840 gen_load(Q_LINK, gen_loadi(0), 1), 3841 gen_loadi(0), 3842 dir); 3843 break; 3844 3845 default: 3846 bpf_error("inbound/outbound not supported on linktype %d\n", 3847 linktype); 3848 b0 = NULL; 3849 /* NOTREACHED */ 3850 } 3851 return (b0); 3852 } 3853 3854 struct block * 3855 gen_acode(eaddr, q) 3856 register const u_char *eaddr; 3857 struct qual q; 3858 { 3859 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 3860 if (linktype == DLT_ARCNET) 3861 return gen_ahostop(eaddr, (int)q.dir); 3862 } 3863 bpf_error("ARCnet address used in non-arc expression"); 3864 /* NOTREACHED */ 3865 } 3866 3867 static struct block * 3868 gen_ahostop(eaddr, dir) 3869 register const u_char *eaddr; 3870 register int dir; 3871 { 3872 register struct block *b0, *b1; 3873 3874 switch (dir) { 3875 /* src comes first, different from Ethernet */ 3876 case Q_SRC: 3877 return gen_bcmp(0, 1, eaddr); 3878 3879 case Q_DST: 3880 return gen_bcmp(1, 1, eaddr); 3881 3882 case Q_AND: 3883 b0 = gen_ahostop(eaddr, Q_SRC); 3884 b1 = gen_ahostop(eaddr, Q_DST); 3885 gen_and(b0, b1); 3886 return b1; 3887 3888 case Q_DEFAULT: 3889 case Q_OR: 3890 b0 = gen_ahostop(eaddr, Q_SRC); 3891 b1 = gen_ahostop(eaddr, Q_DST); 3892 gen_or(b0, b1); 3893 return b1; 3894 } 3895 abort(); 3896 /* NOTREACHED */ 3897 } 3898 3899 /* 3900 * support IEEE 802.1Q VLAN trunk over ethernet 3901 */ 3902 struct block * 3903 gen_vlan(vlan_num) 3904 int vlan_num; 3905 { 3906 struct block *b0; 3907 3908 /* 3909 * Change the offsets to point to the type and data fields within 3910 * the VLAN packet. This is somewhat of a kludge. 3911 */ 3912 if (orig_nl == (u_int)-1) { 3913 orig_linktype = off_linktype; /* save original values */ 3914 orig_nl = off_nl; 3915 3916 switch (linktype) { 3917 3918 case DLT_EN10MB: 3919 off_linktype = 16; 3920 off_nl = 18; 3921 break; 3922 3923 default: 3924 bpf_error("no VLAN support for data link type %d", 3925 linktype); 3926 /*NOTREACHED*/ 3927 } 3928 } 3929 3930 /* check for VLAN */ 3931 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q); 3932 3933 /* If a specific VLAN is requested, check VLAN id */ 3934 if (vlan_num >= 0) { 3935 struct block *b1; 3936 3937 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num); 3938 gen_and(b0, b1); 3939 b0 = b1; 3940 } 3941 3942 return (b0); 3943 } 3944