1 /*#define CHASE_CHAIN*/ 2 /* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 */ 22 #ifndef lint 23 static const char rcsid[] _U_ = 24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.34 2005/09/05 09:08:04 guy Exp $ (LBL)"; 25 #endif 26 27 #ifdef HAVE_CONFIG_H 28 #include "config.h" 29 #endif 30 31 #ifdef WIN32 32 #include <pcap-stdinc.h> 33 #else /* WIN32 */ 34 #include <sys/types.h> 35 #include <sys/socket.h> 36 #endif /* WIN32 */ 37 38 /* 39 * XXX - why was this included even on UNIX? 40 */ 41 #ifdef __MINGW32__ 42 #include "IP6_misc.h" 43 #endif 44 45 #ifndef WIN32 46 47 #ifdef __NetBSD__ 48 #include <sys/param.h> 49 #endif 50 51 #include <netinet/in.h> 52 53 #endif /* WIN32 */ 54 55 #include <stdlib.h> 56 #include <string.h> 57 #include <memory.h> 58 #include <setjmp.h> 59 #include <stdarg.h> 60 61 #ifdef MSDOS 62 #include "pcap-dos.h" 63 #endif 64 65 #include "pcap-int.h" 66 67 #include "ethertype.h" 68 #include "nlpid.h" 69 #include "llc.h" 70 #include "gencode.h" 71 #include "atmuni31.h" 72 #include "sunatmpos.h" 73 #include "ppp.h" 74 #include "sll.h" 75 #include "arcnet.h" 76 #include "pf.h" 77 #ifndef offsetof 78 #define offsetof(s, e) ((size_t)&((s *)0)->e) 79 #endif 80 #ifdef INET6 81 #ifndef WIN32 82 #include <netdb.h> /* for "struct addrinfo" */ 83 #endif /* WIN32 */ 84 #endif /*INET6*/ 85 #include <pcap-namedb.h> 86 87 #define ETHERMTU 1500 88 89 #ifndef IPPROTO_SCTP 90 #define IPPROTO_SCTP 132 91 #endif 92 93 #ifdef HAVE_OS_PROTO_H 94 #include "os-proto.h" 95 #endif 96 97 #define JMP(c) ((c)|BPF_JMP|BPF_K) 98 99 /* Locals */ 100 static jmp_buf top_ctx; 101 static pcap_t *bpf_pcap; 102 103 /* Hack for updating VLAN, MPLS, and PPPoE offsets. */ 104 static u_int orig_linktype = -1U, orig_nl = -1U, label_stack_depth = -1U; 105 106 /* XXX */ 107 #ifdef PCAP_FDDIPAD 108 static int pcap_fddipad; 109 #endif 110 111 /* VARARGS */ 112 void 113 bpf_error(const char *fmt, ...) 114 { 115 va_list ap; 116 117 va_start(ap, fmt); 118 if (bpf_pcap != NULL) 119 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE, 120 fmt, ap); 121 va_end(ap); 122 longjmp(top_ctx, 1); 123 /* NOTREACHED */ 124 } 125 126 static void init_linktype(pcap_t *); 127 128 static int alloc_reg(void); 129 static void free_reg(int); 130 131 static struct block *root; 132 133 /* 134 * Value passed to gen_load_a() to indicate what the offset argument 135 * is relative to. 136 */ 137 enum e_offrel { 138 OR_PACKET, /* relative to the beginning of the packet */ 139 OR_LINK, /* relative to the link-layer header */ 140 OR_NET, /* relative to the network-layer header */ 141 OR_NET_NOSNAP, /* relative to the network-layer header, with no SNAP header at the link layer */ 142 OR_TRAN_IPV4, /* relative to the transport-layer header, with IPv4 network layer */ 143 OR_TRAN_IPV6 /* relative to the transport-layer header, with IPv6 network layer */ 144 }; 145 146 /* 147 * We divy out chunks of memory rather than call malloc each time so 148 * we don't have to worry about leaking memory. It's probably 149 * not a big deal if all this memory was wasted but if this ever 150 * goes into a library that would probably not be a good idea. 151 * 152 * XXX - this *is* in a library.... 153 */ 154 #define NCHUNKS 16 155 #define CHUNK0SIZE 1024 156 struct chunk { 157 u_int n_left; 158 void *m; 159 }; 160 161 static struct chunk chunks[NCHUNKS]; 162 static int cur_chunk; 163 164 static void *newchunk(u_int); 165 static void freechunks(void); 166 static inline struct block *new_block(int); 167 static inline struct slist *new_stmt(int); 168 static struct block *gen_retblk(int); 169 static inline void syntax(void); 170 171 static void backpatch(struct block *, struct block *); 172 static void merge(struct block *, struct block *); 173 static struct block *gen_cmp(enum e_offrel, u_int, u_int, bpf_int32); 174 static struct block *gen_cmp_gt(enum e_offrel, u_int, u_int, bpf_int32); 175 static struct block *gen_cmp_ge(enum e_offrel, u_int, u_int, bpf_int32); 176 static struct block *gen_cmp_lt(enum e_offrel, u_int, u_int, bpf_int32); 177 static struct block *gen_cmp_le(enum e_offrel, u_int, u_int, bpf_int32); 178 static struct block *gen_mcmp(enum e_offrel, u_int, u_int, bpf_int32, 179 bpf_u_int32); 180 static struct block *gen_bcmp(enum e_offrel, u_int, u_int, const u_char *); 181 static struct block *gen_ncmp(enum e_offrel, bpf_u_int32, bpf_u_int32, 182 bpf_u_int32, bpf_u_int32, int, bpf_int32); 183 static struct slist *gen_load_llrel(u_int, u_int); 184 static struct slist *gen_load_a(enum e_offrel, u_int, u_int); 185 static struct slist *gen_loadx_iphdrlen(void); 186 static struct block *gen_uncond(int); 187 static inline struct block *gen_true(void); 188 static inline struct block *gen_false(void); 189 static struct block *gen_ether_linktype(int); 190 static struct block *gen_linux_sll_linktype(int); 191 static void insert_radiotap_load_llprefixlen(struct block *); 192 static void insert_load_llprefixlen(struct block *); 193 static struct slist *gen_llprefixlen(void); 194 static struct block *gen_linktype(int); 195 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); 196 static struct block *gen_llc_linktype(int); 197 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 198 #ifdef INET6 199 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 200 #endif 201 static struct block *gen_ahostop(const u_char *, int); 202 static struct block *gen_ehostop(const u_char *, int); 203 static struct block *gen_fhostop(const u_char *, int); 204 static struct block *gen_thostop(const u_char *, int); 205 static struct block *gen_wlanhostop(const u_char *, int); 206 static struct block *gen_ipfchostop(const u_char *, int); 207 static struct block *gen_dnhostop(bpf_u_int32, int); 208 static struct block *gen_mpls_linktype(int); 209 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 210 #ifdef INET6 211 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 212 #endif 213 #ifndef INET6 214 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); 215 #endif 216 static struct block *gen_ipfrag(void); 217 static struct block *gen_portatom(int, bpf_int32); 218 static struct block *gen_portrangeatom(int, bpf_int32, bpf_int32); 219 #ifdef INET6 220 static struct block *gen_portatom6(int, bpf_int32); 221 static struct block *gen_portrangeatom6(int, bpf_int32, bpf_int32); 222 #endif 223 struct block *gen_portop(int, int, int); 224 static struct block *gen_port(int, int, int); 225 struct block *gen_portrangeop(int, int, int, int); 226 static struct block *gen_portrange(int, int, int, int); 227 #ifdef INET6 228 struct block *gen_portop6(int, int, int); 229 static struct block *gen_port6(int, int, int); 230 struct block *gen_portrangeop6(int, int, int, int); 231 static struct block *gen_portrange6(int, int, int, int); 232 #endif 233 static int lookup_proto(const char *, int); 234 static struct block *gen_protochain(int, int, int); 235 static struct block *gen_proto(int, int, int); 236 static struct slist *xfer_to_x(struct arth *); 237 static struct slist *xfer_to_a(struct arth *); 238 static struct block *gen_mac_multicast(int); 239 static struct block *gen_len(int, int); 240 241 static struct block *gen_msg_abbrev(int type); 242 243 static void * 244 newchunk(n) 245 u_int n; 246 { 247 struct chunk *cp; 248 int k; 249 size_t size; 250 251 #ifndef __NetBSD__ 252 /* XXX Round up to nearest long. */ 253 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 254 #else 255 /* XXX Round up to structure boundary. */ 256 n = ALIGN(n); 257 #endif 258 259 cp = &chunks[cur_chunk]; 260 if (n > cp->n_left) { 261 ++cp, k = ++cur_chunk; 262 if (k >= NCHUNKS) 263 bpf_error("out of memory"); 264 size = CHUNK0SIZE << k; 265 cp->m = (void *)malloc(size); 266 if (cp->m == NULL) 267 bpf_error("out of memory"); 268 memset((char *)cp->m, 0, size); 269 cp->n_left = size; 270 if (n > size) 271 bpf_error("out of memory"); 272 } 273 cp->n_left -= n; 274 return (void *)((char *)cp->m + cp->n_left); 275 } 276 277 static void 278 freechunks() 279 { 280 int i; 281 282 cur_chunk = 0; 283 for (i = 0; i < NCHUNKS; ++i) 284 if (chunks[i].m != NULL) { 285 free(chunks[i].m); 286 chunks[i].m = NULL; 287 } 288 } 289 290 /* 291 * A strdup whose allocations are freed after code generation is over. 292 */ 293 char * 294 sdup(s) 295 register const char *s; 296 { 297 int n = strlen(s) + 1; 298 char *cp = newchunk(n); 299 300 strlcpy(cp, s, n); 301 return (cp); 302 } 303 304 static inline struct block * 305 new_block(code) 306 int code; 307 { 308 struct block *p; 309 310 p = (struct block *)newchunk(sizeof(*p)); 311 p->s.code = code; 312 p->head = p; 313 314 return p; 315 } 316 317 static inline struct slist * 318 new_stmt(code) 319 int code; 320 { 321 struct slist *p; 322 323 p = (struct slist *)newchunk(sizeof(*p)); 324 p->s.code = code; 325 326 return p; 327 } 328 329 static struct block * 330 gen_retblk(v) 331 int v; 332 { 333 struct block *b = new_block(BPF_RET|BPF_K); 334 335 b->s.k = v; 336 return b; 337 } 338 339 static inline void 340 syntax() 341 { 342 bpf_error("syntax error in filter expression"); 343 } 344 345 static bpf_u_int32 netmask; 346 static int snaplen; 347 int no_optimize; 348 349 int 350 pcap_compile(pcap_t *p, struct bpf_program *program, 351 char *buf, int optimize, bpf_u_int32 mask) 352 { 353 extern int n_errors; 354 int len; 355 356 no_optimize = 0; 357 n_errors = 0; 358 root = NULL; 359 bpf_pcap = p; 360 if (setjmp(top_ctx)) { 361 lex_cleanup(); 362 freechunks(); 363 return (-1); 364 } 365 366 netmask = mask; 367 368 snaplen = pcap_snapshot(p); 369 if (snaplen == 0) { 370 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 371 "snaplen of 0 rejects all packets"); 372 return -1; 373 } 374 375 lex_init(buf ? buf : ""); 376 init_linktype(p); 377 (void)pcap_parse(); 378 379 if (n_errors) 380 syntax(); 381 382 if (root == NULL) 383 root = gen_retblk(snaplen); 384 385 if (optimize && !no_optimize) { 386 bpf_optimize(&root); 387 if (root == NULL || 388 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0)) 389 bpf_error("expression rejects all packets"); 390 } 391 program->bf_insns = icode_to_fcode(root, &len); 392 program->bf_len = len; 393 394 lex_cleanup(); 395 freechunks(); 396 return (0); 397 } 398 399 /* 400 * entry point for using the compiler with no pcap open 401 * pass in all the stuff that is needed explicitly instead. 402 */ 403 int 404 pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 405 struct bpf_program *program, 406 char *buf, int optimize, bpf_u_int32 mask) 407 { 408 pcap_t *p; 409 int ret; 410 411 p = pcap_open_dead(linktype_arg, snaplen_arg); 412 if (p == NULL) 413 return (-1); 414 ret = pcap_compile(p, program, buf, optimize, mask); 415 pcap_close(p); 416 return (ret); 417 } 418 419 /* 420 * Clean up a "struct bpf_program" by freeing all the memory allocated 421 * in it. 422 */ 423 void 424 pcap_freecode(struct bpf_program *program) 425 { 426 program->bf_len = 0; 427 if (program->bf_insns != NULL) { 428 free((char *)program->bf_insns); 429 program->bf_insns = NULL; 430 } 431 } 432 433 /* 434 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 435 * which of the jt and jf fields has been resolved and which is a pointer 436 * back to another unresolved block (or nil). At least one of the fields 437 * in each block is already resolved. 438 */ 439 static void 440 backpatch(list, target) 441 struct block *list, *target; 442 { 443 struct block *next; 444 445 while (list) { 446 if (!list->sense) { 447 next = JT(list); 448 JT(list) = target; 449 } else { 450 next = JF(list); 451 JF(list) = target; 452 } 453 list = next; 454 } 455 } 456 457 /* 458 * Merge the lists in b0 and b1, using the 'sense' field to indicate 459 * which of jt and jf is the link. 460 */ 461 static void 462 merge(b0, b1) 463 struct block *b0, *b1; 464 { 465 register struct block **p = &b0; 466 467 /* Find end of list. */ 468 while (*p) 469 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 470 471 /* Concatenate the lists. */ 472 *p = b1; 473 } 474 475 void 476 finish_parse(p) 477 struct block *p; 478 { 479 backpatch(p, gen_retblk(snaplen)); 480 p->sense = !p->sense; 481 backpatch(p, gen_retblk(0)); 482 root = p->head; 483 484 /* 485 * Insert before the statements of the first (root) block any 486 * statements needed to load the lengths of any variable-length 487 * headers into registers. 488 * 489 * XXX - a fancier strategy would be to insert those before the 490 * statements of all blocks that use those lengths and that 491 * have no predecessors that use them, so that we only compute 492 * the lengths if we need them. There might be even better 493 * approaches than that. However, as we're currently only 494 * handling variable-length radiotap headers, and as all 495 * filtering expressions other than raw link[M:N] tests 496 * require the length of that header, doing more for that 497 * header length isn't really worth the effort. 498 */ 499 insert_load_llprefixlen(root); 500 } 501 502 void 503 gen_and(b0, b1) 504 struct block *b0, *b1; 505 { 506 backpatch(b0, b1->head); 507 b0->sense = !b0->sense; 508 b1->sense = !b1->sense; 509 merge(b1, b0); 510 b1->sense = !b1->sense; 511 b1->head = b0->head; 512 } 513 514 void 515 gen_or(b0, b1) 516 struct block *b0, *b1; 517 { 518 b0->sense = !b0->sense; 519 backpatch(b0, b1->head); 520 b0->sense = !b0->sense; 521 merge(b1, b0); 522 b1->head = b0->head; 523 } 524 525 void 526 gen_not(b) 527 struct block *b; 528 { 529 b->sense = !b->sense; 530 } 531 532 static struct block * 533 gen_cmp(offrel, offset, size, v) 534 enum e_offrel offrel; 535 u_int offset, size; 536 bpf_int32 v; 537 { 538 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v); 539 } 540 541 static struct block * 542 gen_cmp_gt(offrel, offset, size, v) 543 enum e_offrel offrel; 544 u_int offset, size; 545 bpf_int32 v; 546 { 547 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGT, 0, v); 548 } 549 550 static struct block * 551 gen_cmp_ge(offrel, offset, size, v) 552 enum e_offrel offrel; 553 u_int offset, size; 554 bpf_int32 v; 555 { 556 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGE, 0, v); 557 } 558 559 static struct block * 560 gen_cmp_lt(offrel, offset, size, v) 561 enum e_offrel offrel; 562 u_int offset, size; 563 bpf_int32 v; 564 { 565 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGE, 1, v); 566 } 567 568 static struct block * 569 gen_cmp_le(offrel, offset, size, v) 570 enum e_offrel offrel; 571 u_int offset, size; 572 bpf_int32 v; 573 { 574 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGT, 1, v); 575 } 576 577 static struct block * 578 gen_mcmp(offrel, offset, size, v, mask) 579 enum e_offrel offrel; 580 u_int offset, size; 581 bpf_int32 v; 582 bpf_u_int32 mask; 583 { 584 return gen_ncmp(offrel, offset, size, mask, BPF_JEQ, 0, v); 585 } 586 587 static struct block * 588 gen_bcmp(offrel, offset, size, v) 589 enum e_offrel offrel; 590 register u_int offset, size; 591 register const u_char *v; 592 { 593 register struct block *b, *tmp; 594 595 b = NULL; 596 while (size >= 4) { 597 register const u_char *p = &v[size - 4]; 598 bpf_int32 w = ((bpf_int32)p[0] << 24) | 599 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 600 601 tmp = gen_cmp(offrel, offset + size - 4, BPF_W, w); 602 if (b != NULL) 603 gen_and(b, tmp); 604 b = tmp; 605 size -= 4; 606 } 607 while (size >= 2) { 608 register const u_char *p = &v[size - 2]; 609 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 610 611 tmp = gen_cmp(offrel, offset + size - 2, BPF_H, w); 612 if (b != NULL) 613 gen_and(b, tmp); 614 b = tmp; 615 size -= 2; 616 } 617 if (size > 0) { 618 tmp = gen_cmp(offrel, offset, BPF_B, (bpf_int32)v[0]); 619 if (b != NULL) 620 gen_and(b, tmp); 621 b = tmp; 622 } 623 return b; 624 } 625 626 /* 627 * AND the field of size "size" at offset "offset" relative to the header 628 * specified by "offrel" with "mask", and compare it with the value "v" 629 * with the test specified by "jtype"; if "reverse" is true, the test 630 * should test the opposite of "jtype". 631 */ 632 static struct block * 633 gen_ncmp(offrel, offset, size, mask, jtype, reverse, v) 634 enum e_offrel offrel; 635 bpf_int32 v; 636 bpf_u_int32 offset, size, mask, jtype; 637 int reverse; 638 { 639 struct slist *s, *s2; 640 struct block *b; 641 642 s = gen_load_a(offrel, offset, size); 643 644 if (mask != 0xffffffff) { 645 s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K); 646 s2->s.k = mask; 647 sappend(s, s2); 648 } 649 650 b = new_block(JMP(jtype)); 651 b->stmts = s; 652 b->s.k = v; 653 if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE)) 654 gen_not(b); 655 return b; 656 } 657 658 /* 659 * Various code constructs need to know the layout of the data link 660 * layer. These variables give the necessary offsets from the beginning 661 * of the packet data. 662 * 663 * If the link layer has variable_length headers, the offsets are offsets 664 * from the end of the link-link-layer header, and "reg_ll_size" is 665 * the register number for a register containing the length of the 666 * link-layer header. Otherwise, "reg_ll_size" is -1. 667 */ 668 static int reg_ll_size; 669 670 /* 671 * This is the offset of the beginning of the link-layer header. 672 * It's usually 0, except for 802.11 with a fixed-length radio header. 673 */ 674 static u_int off_ll; 675 676 /* 677 * This is the offset of the beginning of the MAC-layer header. 678 * It's usually 0, except for ATM LANE. 679 */ 680 static u_int off_mac; 681 682 /* 683 * "off_linktype" is the offset to information in the link-layer header 684 * giving the packet type. 685 * 686 * For Ethernet, it's the offset of the Ethernet type field. 687 * 688 * For link-layer types that always use 802.2 headers, it's the 689 * offset of the LLC header. 690 * 691 * For PPP, it's the offset of the PPP type field. 692 * 693 * For Cisco HDLC, it's the offset of the CHDLC type field. 694 * 695 * For BSD loopback, it's the offset of the AF_ value. 696 * 697 * For Linux cooked sockets, it's the offset of the type field. 698 * 699 * It's set to -1 for no encapsulation, in which case, IP is assumed. 700 */ 701 static u_int off_linktype; 702 703 /* 704 * TRUE if the link layer includes an ATM pseudo-header. 705 */ 706 static int is_atm = 0; 707 708 /* 709 * TRUE if "lane" appeared in the filter; it causes us to generate 710 * code that assumes LANE rather than LLC-encapsulated traffic in SunATM. 711 */ 712 static int is_lane = 0; 713 714 /* 715 * These are offsets for the ATM pseudo-header. 716 */ 717 static u_int off_vpi; 718 static u_int off_vci; 719 static u_int off_proto; 720 721 /* 722 * These are offsets for the MTP3 fields. 723 */ 724 static u_int off_sio; 725 static u_int off_opc; 726 static u_int off_dpc; 727 static u_int off_sls; 728 729 /* 730 * This is the offset of the first byte after the ATM pseudo_header, 731 * or -1 if there is no ATM pseudo-header. 732 */ 733 static u_int off_payload; 734 735 /* 736 * These are offsets to the beginning of the network-layer header. 737 * 738 * If the link layer never uses 802.2 LLC: 739 * 740 * "off_nl" and "off_nl_nosnap" are the same. 741 * 742 * If the link layer always uses 802.2 LLC: 743 * 744 * "off_nl" is the offset if there's a SNAP header following 745 * the 802.2 header; 746 * 747 * "off_nl_nosnap" is the offset if there's no SNAP header. 748 * 749 * If the link layer is Ethernet: 750 * 751 * "off_nl" is the offset if the packet is an Ethernet II packet 752 * (we assume no 802.3+802.2+SNAP); 753 * 754 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet 755 * with an 802.2 header following it. 756 */ 757 static u_int off_nl; 758 static u_int off_nl_nosnap; 759 760 static int linktype; 761 762 static void 763 init_linktype(p) 764 pcap_t *p; 765 { 766 linktype = pcap_datalink(p); 767 #ifdef PCAP_FDDIPAD 768 pcap_fddipad = p->fddipad; 769 #endif 770 771 /* 772 * Assume it's not raw ATM with a pseudo-header, for now. 773 */ 774 off_mac = 0; 775 is_atm = 0; 776 is_lane = 0; 777 off_vpi = -1; 778 off_vci = -1; 779 off_proto = -1; 780 off_payload = -1; 781 782 /* 783 * And assume we're not doing SS7. 784 */ 785 off_sio = -1; 786 off_opc = -1; 787 off_dpc = -1; 788 off_sls = -1; 789 790 /* 791 * Also assume it's not 802.11 with a fixed-length radio header. 792 */ 793 off_ll = 0; 794 795 orig_linktype = -1; 796 orig_nl = -1; 797 label_stack_depth = 0; 798 799 reg_ll_size = -1; 800 801 switch (linktype) { 802 803 case DLT_ARCNET: 804 off_linktype = 2; 805 off_nl = 6; /* XXX in reality, variable! */ 806 off_nl_nosnap = 6; /* no 802.2 LLC */ 807 return; 808 809 case DLT_ARCNET_LINUX: 810 off_linktype = 4; 811 off_nl = 8; /* XXX in reality, variable! */ 812 off_nl_nosnap = 8; /* no 802.2 LLC */ 813 return; 814 815 case DLT_EN10MB: 816 off_linktype = 12; 817 off_nl = 14; /* Ethernet II */ 818 off_nl_nosnap = 17; /* 802.3+802.2 */ 819 return; 820 821 case DLT_SLIP: 822 /* 823 * SLIP doesn't have a link level type. The 16 byte 824 * header is hacked into our SLIP driver. 825 */ 826 off_linktype = -1; 827 off_nl = 16; 828 off_nl_nosnap = 16; /* no 802.2 LLC */ 829 return; 830 831 case DLT_SLIP_BSDOS: 832 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 833 off_linktype = -1; 834 /* XXX end */ 835 off_nl = 24; 836 off_nl_nosnap = 24; /* no 802.2 LLC */ 837 return; 838 839 case DLT_NULL: 840 case DLT_LOOP: 841 off_linktype = 0; 842 off_nl = 4; 843 off_nl_nosnap = 4; /* no 802.2 LLC */ 844 return; 845 846 case DLT_ENC: 847 off_linktype = 0; 848 off_nl = 12; 849 off_nl_nosnap = 12; /* no 802.2 LLC */ 850 return; 851 852 case DLT_PPP: 853 case DLT_PPP_PPPD: 854 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 855 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */ 856 off_linktype = 2; 857 off_nl = 4; 858 off_nl_nosnap = 4; /* no 802.2 LLC */ 859 return; 860 861 case DLT_PPP_ETHER: 862 /* 863 * This does no include the Ethernet header, and 864 * only covers session state. 865 */ 866 off_linktype = 6; 867 off_nl = 8; 868 off_nl_nosnap = 8; /* no 802.2 LLC */ 869 return; 870 871 case DLT_PPP_BSDOS: 872 off_linktype = 5; 873 off_nl = 24; 874 off_nl_nosnap = 24; /* no 802.2 LLC */ 875 return; 876 877 case DLT_FDDI: 878 /* 879 * FDDI doesn't really have a link-level type field. 880 * We set "off_linktype" to the offset of the LLC header. 881 * 882 * To check for Ethernet types, we assume that SSAP = SNAP 883 * is being used and pick out the encapsulated Ethernet type. 884 * XXX - should we generate code to check for SNAP? 885 */ 886 off_linktype = 13; 887 #ifdef PCAP_FDDIPAD 888 off_linktype += pcap_fddipad; 889 #endif 890 off_nl = 21; /* FDDI+802.2+SNAP */ 891 off_nl_nosnap = 16; /* FDDI+802.2 */ 892 #ifdef PCAP_FDDIPAD 893 off_nl += pcap_fddipad; 894 off_nl_nosnap += pcap_fddipad; 895 #endif 896 return; 897 898 case DLT_IEEE802: 899 /* 900 * Token Ring doesn't really have a link-level type field. 901 * We set "off_linktype" to the offset of the LLC header. 902 * 903 * To check for Ethernet types, we assume that SSAP = SNAP 904 * is being used and pick out the encapsulated Ethernet type. 905 * XXX - should we generate code to check for SNAP? 906 * 907 * XXX - the header is actually variable-length. 908 * Some various Linux patched versions gave 38 909 * as "off_linktype" and 40 as "off_nl"; however, 910 * if a token ring packet has *no* routing 911 * information, i.e. is not source-routed, the correct 912 * values are 20 and 22, as they are in the vanilla code. 913 * 914 * A packet is source-routed iff the uppermost bit 915 * of the first byte of the source address, at an 916 * offset of 8, has the uppermost bit set. If the 917 * packet is source-routed, the total number of bytes 918 * of routing information is 2 plus bits 0x1F00 of 919 * the 16-bit value at an offset of 14 (shifted right 920 * 8 - figure out which byte that is). 921 */ 922 off_linktype = 14; 923 off_nl = 22; /* Token Ring+802.2+SNAP */ 924 off_nl_nosnap = 17; /* Token Ring+802.2 */ 925 return; 926 927 case DLT_IEEE802_11: 928 /* 929 * 802.11 doesn't really have a link-level type field. 930 * We set "off_linktype" to the offset of the LLC header. 931 * 932 * To check for Ethernet types, we assume that SSAP = SNAP 933 * is being used and pick out the encapsulated Ethernet type. 934 * XXX - should we generate code to check for SNAP? 935 * 936 * XXX - the header is actually variable-length. We 937 * assume a 24-byte link-layer header, as appears in 938 * data frames in networks with no bridges. If the 939 * fromds and tods 802.11 header bits are both set, 940 * it's actually supposed to be 30 bytes. 941 */ 942 off_linktype = 24; 943 off_nl = 32; /* 802.11+802.2+SNAP */ 944 off_nl_nosnap = 27; /* 802.11+802.2 */ 945 return; 946 947 case DLT_PRISM_HEADER: 948 /* 949 * Same as 802.11, but with an additional header before 950 * the 802.11 header, containing a bunch of additional 951 * information including radio-level information. 952 * 953 * The header is 144 bytes long. 954 * 955 * XXX - same variable-length header problem; at least 956 * the Prism header is fixed-length. 957 */ 958 off_ll = 144; 959 off_linktype = 144+24; 960 off_nl = 144+32; /* Prism+802.11+802.2+SNAP */ 961 off_nl_nosnap = 144+27; /* Prism+802.11+802.2 */ 962 return; 963 964 case DLT_IEEE802_11_RADIO_AVS: 965 /* 966 * Same as 802.11, but with an additional header before 967 * the 802.11 header, containing a bunch of additional 968 * information including radio-level information. 969 * 970 * The header is 64 bytes long, at least in its 971 * current incarnation. 972 * 973 * XXX - same variable-length header problem, only 974 * more so; this header is also variable-length, 975 * with the length being the 32-bit big-endian 976 * number at an offset of 4 from the beginning 977 * of the radio header. 978 */ 979 off_ll = 64; 980 off_linktype = 64+24; 981 off_nl = 64+32; /* Radio+802.11+802.2+SNAP */ 982 off_nl_nosnap = 64+27; /* Radio+802.11+802.2 */ 983 return; 984 985 case DLT_IEEE802_11_RADIO: 986 /* 987 * Same as 802.11, but with an additional header before 988 * the 802.11 header, containing a bunch of additional 989 * information including radio-level information. 990 * 991 * The radiotap header is variable length, and we 992 * generate code to compute its length and store it 993 * in a register. These offsets are relative to the 994 * beginning of the 802.11 header. 995 */ 996 off_linktype = 24; 997 off_nl = 32; /* 802.11+802.2+SNAP */ 998 off_nl_nosnap = 27; /* 802.11+802.2 */ 999 return; 1000 1001 case DLT_ATM_RFC1483: 1002 case DLT_ATM_CLIP: /* Linux ATM defines this */ 1003 /* 1004 * assume routed, non-ISO PDUs 1005 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 1006 * 1007 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS, 1008 * or PPP with the PPP NLPID (e.g., PPPoA)? The 1009 * latter would presumably be treated the way PPPoE 1010 * should be, so you can do "pppoe and udp port 2049" 1011 * or "pppoa and tcp port 80" and have it check for 1012 * PPPo{A,E} and a PPP protocol of IP and.... 1013 */ 1014 off_linktype = 0; 1015 off_nl = 8; /* 802.2+SNAP */ 1016 off_nl_nosnap = 3; /* 802.2 */ 1017 return; 1018 1019 case DLT_SUNATM: 1020 /* 1021 * Full Frontal ATM; you get AALn PDUs with an ATM 1022 * pseudo-header. 1023 */ 1024 is_atm = 1; 1025 off_vpi = SUNATM_VPI_POS; 1026 off_vci = SUNATM_VCI_POS; 1027 off_proto = PROTO_POS; 1028 off_mac = -1; /* LLC-encapsulated, so no MAC-layer header */ 1029 off_payload = SUNATM_PKT_BEGIN_POS; 1030 off_linktype = off_payload; 1031 off_nl = off_payload+8; /* 802.2+SNAP */ 1032 off_nl_nosnap = off_payload+3; /* 802.2 */ 1033 return; 1034 1035 case DLT_RAW: 1036 off_linktype = -1; 1037 off_nl = 0; 1038 off_nl_nosnap = 0; /* no 802.2 LLC */ 1039 return; 1040 1041 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 1042 off_linktype = 14; 1043 off_nl = 16; 1044 off_nl_nosnap = 16; /* no 802.2 LLC */ 1045 return; 1046 1047 case DLT_LTALK: 1048 /* 1049 * LocalTalk does have a 1-byte type field in the LLAP header, 1050 * but really it just indicates whether there is a "short" or 1051 * "long" DDP packet following. 1052 */ 1053 off_linktype = -1; 1054 off_nl = 0; 1055 off_nl_nosnap = 0; /* no 802.2 LLC */ 1056 return; 1057 1058 case DLT_IP_OVER_FC: 1059 /* 1060 * RFC 2625 IP-over-Fibre-Channel doesn't really have a 1061 * link-level type field. We set "off_linktype" to the 1062 * offset of the LLC header. 1063 * 1064 * To check for Ethernet types, we assume that SSAP = SNAP 1065 * is being used and pick out the encapsulated Ethernet type. 1066 * XXX - should we generate code to check for SNAP? RFC 1067 * 2625 says SNAP should be used. 1068 */ 1069 off_linktype = 16; 1070 off_nl = 24; /* IPFC+802.2+SNAP */ 1071 off_nl_nosnap = 19; /* IPFC+802.2 */ 1072 return; 1073 1074 case DLT_FRELAY: 1075 /* 1076 * XXX - we should set this to handle SNAP-encapsulated 1077 * frames (NLPID of 0x80). 1078 */ 1079 off_linktype = -1; 1080 off_nl = 0; 1081 off_nl_nosnap = 0; /* no 802.2 LLC */ 1082 return; 1083 1084 case DLT_APPLE_IP_OVER_IEEE1394: 1085 off_linktype = 16; 1086 off_nl = 18; 1087 off_nl_nosnap = 18; /* no 802.2 LLC */ 1088 return; 1089 1090 case DLT_LINUX_IRDA: 1091 /* 1092 * Currently, only raw "link[N:M]" filtering is supported. 1093 */ 1094 off_linktype = -1; 1095 off_nl = -1; 1096 off_nl_nosnap = -1; 1097 return; 1098 1099 case DLT_DOCSIS: 1100 /* 1101 * Currently, only raw "link[N:M]" filtering is supported. 1102 */ 1103 off_linktype = -1; 1104 off_nl = -1; 1105 off_nl_nosnap = -1; 1106 return; 1107 1108 case DLT_SYMANTEC_FIREWALL: 1109 off_linktype = 6; 1110 off_nl = 44; /* Ethernet II */ 1111 off_nl_nosnap = 44; /* XXX - what does it do with 802.3 packets? */ 1112 return; 1113 1114 case DLT_PFLOG: 1115 off_linktype = 0; 1116 /* XXX read this from pf.h? */ 1117 off_nl = PFLOG_HDRLEN; 1118 off_nl_nosnap = PFLOG_HDRLEN; /* no 802.2 LLC */ 1119 return; 1120 1121 case DLT_JUNIPER_MFR: 1122 case DLT_JUNIPER_MLFR: 1123 case DLT_JUNIPER_MLPPP: 1124 case DLT_JUNIPER_PPP: 1125 case DLT_JUNIPER_CHDLC: 1126 case DLT_JUNIPER_FRELAY: 1127 off_linktype = 4; 1128 off_nl = 4; 1129 off_nl_nosnap = -1; /* no 802.2 LLC */ 1130 return; 1131 1132 case DLT_JUNIPER_ATM1: 1133 off_linktype = 4; /* in reality variable between 4-8 */ 1134 off_nl = 4; 1135 off_nl_nosnap = 14; 1136 return; 1137 1138 case DLT_JUNIPER_ATM2: 1139 off_linktype = 8; /* in reality variable between 8-12 */ 1140 off_nl = 8; 1141 off_nl_nosnap = 18; 1142 return; 1143 1144 /* frames captured on a Juniper PPPoE service PIC 1145 * contain raw ethernet frames */ 1146 case DLT_JUNIPER_PPPOE: 1147 case DLT_JUNIPER_ETHER: 1148 off_linktype = 16; 1149 off_nl = 18; /* Ethernet II */ 1150 off_nl_nosnap = 21; /* 802.3+802.2 */ 1151 return; 1152 1153 case DLT_JUNIPER_PPPOE_ATM: 1154 off_linktype = 4; 1155 off_nl = 6; 1156 off_nl_nosnap = -1; /* no 802.2 LLC */ 1157 return; 1158 1159 case DLT_JUNIPER_GGSN: 1160 off_linktype = 6; 1161 off_nl = 12; 1162 off_nl_nosnap = -1; /* no 802.2 LLC */ 1163 return; 1164 1165 case DLT_JUNIPER_ES: 1166 off_linktype = 6; 1167 off_nl = -1; /* not really a network layer but raw IP adresses */ 1168 off_nl_nosnap = -1; /* no 802.2 LLC */ 1169 return; 1170 1171 case DLT_JUNIPER_MONITOR: 1172 off_linktype = 12; 1173 off_nl = 12; /* raw IP/IP6 header */ 1174 off_nl_nosnap = -1; /* no 802.2 LLC */ 1175 return; 1176 1177 case DLT_JUNIPER_SERVICES: 1178 off_linktype = 12; 1179 off_nl = -1; /* L3 proto location dep. on cookie type */ 1180 off_nl_nosnap = -1; /* no 802.2 LLC */ 1181 return; 1182 1183 case DLT_MTP2: 1184 off_sio = 3; 1185 off_opc = 4; 1186 off_dpc = 4; 1187 off_sls = 7; 1188 off_linktype = -1; 1189 off_nl = -1; 1190 off_nl_nosnap = -1; 1191 return; 1192 1193 #ifdef DLT_PFSYNC 1194 case DLT_PFSYNC: 1195 off_linktype = -1; 1196 off_nl = 4; 1197 off_nl_nosnap = 4; 1198 return; 1199 #endif 1200 1201 case DLT_LINUX_LAPD: 1202 /* 1203 * Currently, only raw "link[N:M]" filtering is supported. 1204 */ 1205 off_linktype = -1; 1206 off_nl = -1; 1207 off_nl_nosnap = -1; 1208 return; 1209 } 1210 bpf_error("unknown data link type %d", linktype); 1211 /* NOTREACHED */ 1212 } 1213 1214 /* 1215 * Load a value relative to the beginning of the link-layer header. 1216 * The link-layer header doesn't necessarily begin at the beginning 1217 * of the packet data; there might be a variable-length prefix containing 1218 * radio information. 1219 */ 1220 static struct slist * 1221 gen_load_llrel(offset, size) 1222 u_int offset, size; 1223 { 1224 struct slist *s, *s2; 1225 1226 s = gen_llprefixlen(); 1227 1228 /* 1229 * If "s" is non-null, it has code to arrange that the X register 1230 * contains the length of the prefix preceding the link-layer 1231 * header. 1232 */ 1233 if (s != NULL) { 1234 s2 = new_stmt(BPF_LD|BPF_IND|size); 1235 s2->s.k = offset; 1236 sappend(s, s2); 1237 } else { 1238 s = new_stmt(BPF_LD|BPF_ABS|size); 1239 s->s.k = offset; 1240 } 1241 return s; 1242 } 1243 1244 /* 1245 * Load a value relative to the beginning of the specified header. 1246 */ 1247 static struct slist * 1248 gen_load_a(offrel, offset, size) 1249 enum e_offrel offrel; 1250 u_int offset, size; 1251 { 1252 struct slist *s, *s2; 1253 1254 switch (offrel) { 1255 1256 case OR_PACKET: 1257 s = gen_load_llrel(offset, size); 1258 break; 1259 1260 case OR_LINK: 1261 s = gen_load_llrel(off_ll + offset, size); 1262 break; 1263 1264 case OR_NET: 1265 s = gen_load_llrel(off_nl + offset, size); 1266 break; 1267 1268 case OR_NET_NOSNAP: 1269 s = gen_load_llrel(off_nl_nosnap + offset, size); 1270 break; 1271 1272 case OR_TRAN_IPV4: 1273 /* 1274 * Load the X register with the length of the IPv4 header, 1275 * in bytes. 1276 */ 1277 s = gen_loadx_iphdrlen(); 1278 1279 /* 1280 * Load the item at {length of the link-layer header} + 1281 * {length of the IPv4 header} + {specified offset}. 1282 */ 1283 s2 = new_stmt(BPF_LD|BPF_IND|size); 1284 s2->s.k = off_nl + offset; 1285 sappend(s, s2); 1286 break; 1287 1288 case OR_TRAN_IPV6: 1289 s = gen_load_llrel(off_nl + 40 + offset, size); 1290 break; 1291 1292 default: 1293 abort(); 1294 return NULL; 1295 } 1296 return s; 1297 } 1298 1299 /* 1300 * Generate code to load into the X register the sum of the length of 1301 * the IPv4 header and any variable-length header preceding the link-layer 1302 * header. 1303 */ 1304 static struct slist * 1305 gen_loadx_iphdrlen() 1306 { 1307 struct slist *s, *s2; 1308 1309 s = gen_llprefixlen(); 1310 if (s != NULL) { 1311 /* 1312 * There's a variable-length prefix preceding the 1313 * link-layer header. "s" points to a list of statements 1314 * that put the length of that prefix into the X register. 1315 * The 4*([k]&0xf) addressing mode can't be used, as we 1316 * don't have a constant offset, so we have to load the 1317 * value in question into the A register and add to it 1318 * the value from the X register. 1319 */ 1320 s2 = new_stmt(BPF_LD|BPF_IND|BPF_B); 1321 s2->s.k = off_nl; 1322 sappend(s, s2); 1323 s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K); 1324 s2->s.k = 0xf; 1325 sappend(s, s2); 1326 s2 = new_stmt(BPF_ALU|BPF_LSH|BPF_K); 1327 s2->s.k = 2; 1328 sappend(s, s2); 1329 1330 /* 1331 * The A register now contains the length of the 1332 * IP header. We need to add to it the length 1333 * of the prefix preceding the link-layer 1334 * header, which is still in the X register, and 1335 * move the result into the X register. 1336 */ 1337 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 1338 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 1339 } else { 1340 /* 1341 * There is no variable-length header preceding the 1342 * link-layer header; if there's a fixed-length 1343 * header preceding it, its length is included in 1344 * the off_ variables, so it doesn't need to be added. 1345 */ 1346 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 1347 s->s.k = off_nl; 1348 } 1349 return s; 1350 } 1351 1352 static struct block * 1353 gen_uncond(rsense) 1354 int rsense; 1355 { 1356 struct block *b; 1357 struct slist *s; 1358 1359 s = new_stmt(BPF_LD|BPF_IMM); 1360 s->s.k = !rsense; 1361 b = new_block(JMP(BPF_JEQ)); 1362 b->stmts = s; 1363 1364 return b; 1365 } 1366 1367 static inline struct block * 1368 gen_true() 1369 { 1370 return gen_uncond(1); 1371 } 1372 1373 static inline struct block * 1374 gen_false() 1375 { 1376 return gen_uncond(0); 1377 } 1378 1379 /* 1380 * Byte-swap a 32-bit number. 1381 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 1382 * big-endian platforms.) 1383 */ 1384 #define SWAPLONG(y) \ 1385 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 1386 1387 /* 1388 * Generate code to match a particular packet type. 1389 * 1390 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1391 * value, if <= ETHERMTU. We use that to determine whether to 1392 * match the type/length field or to check the type/length field for 1393 * a value <= ETHERMTU to see whether it's a type field and then do 1394 * the appropriate test. 1395 */ 1396 static struct block * 1397 gen_ether_linktype(proto) 1398 register int proto; 1399 { 1400 struct block *b0, *b1; 1401 1402 switch (proto) { 1403 1404 case LLCSAP_ISONS: 1405 case LLCSAP_IP: 1406 case LLCSAP_NETBEUI: 1407 /* 1408 * OSI protocols and NetBEUI always use 802.2 encapsulation, 1409 * so we check the DSAP and SSAP. 1410 * 1411 * LLCSAP_IP checks for IP-over-802.2, rather 1412 * than IP-over-Ethernet or IP-over-SNAP. 1413 * 1414 * XXX - should we check both the DSAP and the 1415 * SSAP, like this, or should we check just the 1416 * DSAP, as we do for other types <= ETHERMTU 1417 * (i.e., other SAP values)? 1418 */ 1419 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); 1420 gen_not(b0); 1421 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32) 1422 ((proto << 8) | proto)); 1423 gen_and(b0, b1); 1424 return b1; 1425 1426 case LLCSAP_IPX: 1427 /* 1428 * Check for; 1429 * 1430 * Ethernet_II frames, which are Ethernet 1431 * frames with a frame type of ETHERTYPE_IPX; 1432 * 1433 * Ethernet_802.3 frames, which are 802.3 1434 * frames (i.e., the type/length field is 1435 * a length field, <= ETHERMTU, rather than 1436 * a type field) with the first two bytes 1437 * after the Ethernet/802.3 header being 1438 * 0xFFFF; 1439 * 1440 * Ethernet_802.2 frames, which are 802.3 1441 * frames with an 802.2 LLC header and 1442 * with the IPX LSAP as the DSAP in the LLC 1443 * header; 1444 * 1445 * Ethernet_SNAP frames, which are 802.3 1446 * frames with an LLC header and a SNAP 1447 * header and with an OUI of 0x000000 1448 * (encapsulated Ethernet) and a protocol 1449 * ID of ETHERTYPE_IPX in the SNAP header. 1450 * 1451 * XXX - should we generate the same code both 1452 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 1453 */ 1454 1455 /* 1456 * This generates code to check both for the 1457 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 1458 */ 1459 b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, 1460 (bpf_int32)LLCSAP_IPX); 1461 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, 1462 (bpf_int32)0xFFFF); 1463 gen_or(b0, b1); 1464 1465 /* 1466 * Now we add code to check for SNAP frames with 1467 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 1468 */ 1469 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14); 1470 gen_or(b0, b1); 1471 1472 /* 1473 * Now we generate code to check for 802.3 1474 * frames in general. 1475 */ 1476 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); 1477 gen_not(b0); 1478 1479 /* 1480 * Now add the check for 802.3 frames before the 1481 * check for Ethernet_802.2 and Ethernet_802.3, 1482 * as those checks should only be done on 802.3 1483 * frames, not on Ethernet frames. 1484 */ 1485 gen_and(b0, b1); 1486 1487 /* 1488 * Now add the check for Ethernet_II frames, and 1489 * do that before checking for the other frame 1490 * types. 1491 */ 1492 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, 1493 (bpf_int32)ETHERTYPE_IPX); 1494 gen_or(b0, b1); 1495 return b1; 1496 1497 case ETHERTYPE_ATALK: 1498 case ETHERTYPE_AARP: 1499 /* 1500 * EtherTalk (AppleTalk protocols on Ethernet link 1501 * layer) may use 802.2 encapsulation. 1502 */ 1503 1504 /* 1505 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1506 * we check for an Ethernet type field less than 1507 * 1500, which means it's an 802.3 length field. 1508 */ 1509 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); 1510 gen_not(b0); 1511 1512 /* 1513 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1514 * SNAP packets with an organization code of 1515 * 0x080007 (Apple, for Appletalk) and a protocol 1516 * type of ETHERTYPE_ATALK (Appletalk). 1517 * 1518 * 802.2-encapsulated ETHERTYPE_AARP packets are 1519 * SNAP packets with an organization code of 1520 * 0x000000 (encapsulated Ethernet) and a protocol 1521 * type of ETHERTYPE_AARP (Appletalk ARP). 1522 */ 1523 if (proto == ETHERTYPE_ATALK) 1524 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14); 1525 else /* proto == ETHERTYPE_AARP */ 1526 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14); 1527 gen_and(b0, b1); 1528 1529 /* 1530 * Check for Ethernet encapsulation (Ethertalk 1531 * phase 1?); we just check for the Ethernet 1532 * protocol type. 1533 */ 1534 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto); 1535 1536 gen_or(b0, b1); 1537 return b1; 1538 1539 default: 1540 if (proto <= ETHERMTU) { 1541 /* 1542 * This is an LLC SAP value, so the frames 1543 * that match would be 802.2 frames. 1544 * Check that the frame is an 802.2 frame 1545 * (i.e., that the length/type field is 1546 * a length field, <= ETHERMTU) and 1547 * then check the DSAP. 1548 */ 1549 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); 1550 gen_not(b0); 1551 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, 1552 (bpf_int32)proto); 1553 gen_and(b0, b1); 1554 return b1; 1555 } else { 1556 /* 1557 * This is an Ethernet type, so compare 1558 * the length/type field with it (if 1559 * the frame is an 802.2 frame, the length 1560 * field will be <= ETHERMTU, and, as 1561 * "proto" is > ETHERMTU, this test 1562 * will fail and the frame won't match, 1563 * which is what we want). 1564 */ 1565 return gen_cmp(OR_LINK, off_linktype, BPF_H, 1566 (bpf_int32)proto); 1567 } 1568 } 1569 } 1570 1571 /* 1572 * Generate code to match a particular packet type. 1573 * 1574 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1575 * value, if <= ETHERMTU. We use that to determine whether to 1576 * match the type field or to check the type field for the special 1577 * LINUX_SLL_P_802_2 value and then do the appropriate test. 1578 */ 1579 static struct block * 1580 gen_linux_sll_linktype(proto) 1581 register int proto; 1582 { 1583 struct block *b0, *b1; 1584 1585 switch (proto) { 1586 1587 case LLCSAP_ISONS: 1588 case LLCSAP_IP: 1589 case LLCSAP_NETBEUI: 1590 /* 1591 * OSI protocols and NetBEUI always use 802.2 encapsulation, 1592 * so we check the DSAP and SSAP. 1593 * 1594 * LLCSAP_IP checks for IP-over-802.2, rather 1595 * than IP-over-Ethernet or IP-over-SNAP. 1596 * 1597 * XXX - should we check both the DSAP and the 1598 * SSAP, like this, or should we check just the 1599 * DSAP, as we do for other types <= ETHERMTU 1600 * (i.e., other SAP values)? 1601 */ 1602 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2); 1603 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32) 1604 ((proto << 8) | proto)); 1605 gen_and(b0, b1); 1606 return b1; 1607 1608 case LLCSAP_IPX: 1609 /* 1610 * Ethernet_II frames, which are Ethernet 1611 * frames with a frame type of ETHERTYPE_IPX; 1612 * 1613 * Ethernet_802.3 frames, which have a frame 1614 * type of LINUX_SLL_P_802_3; 1615 * 1616 * Ethernet_802.2 frames, which are 802.3 1617 * frames with an 802.2 LLC header (i.e, have 1618 * a frame type of LINUX_SLL_P_802_2) and 1619 * with the IPX LSAP as the DSAP in the LLC 1620 * header; 1621 * 1622 * Ethernet_SNAP frames, which are 802.3 1623 * frames with an LLC header and a SNAP 1624 * header and with an OUI of 0x000000 1625 * (encapsulated Ethernet) and a protocol 1626 * ID of ETHERTYPE_IPX in the SNAP header. 1627 * 1628 * First, do the checks on LINUX_SLL_P_802_2 1629 * frames; generate the check for either 1630 * Ethernet_802.2 or Ethernet_SNAP frames, and 1631 * then put a check for LINUX_SLL_P_802_2 frames 1632 * before it. 1633 */ 1634 b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, 1635 (bpf_int32)LLCSAP_IPX); 1636 b1 = gen_snap(0x000000, ETHERTYPE_IPX, 1637 off_linktype + 2); 1638 gen_or(b0, b1); 1639 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2); 1640 gen_and(b0, b1); 1641 1642 /* 1643 * Now check for 802.3 frames and OR that with 1644 * the previous test. 1645 */ 1646 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_3); 1647 gen_or(b0, b1); 1648 1649 /* 1650 * Now add the check for Ethernet_II frames, and 1651 * do that before checking for the other frame 1652 * types. 1653 */ 1654 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, 1655 (bpf_int32)ETHERTYPE_IPX); 1656 gen_or(b0, b1); 1657 return b1; 1658 1659 case ETHERTYPE_ATALK: 1660 case ETHERTYPE_AARP: 1661 /* 1662 * EtherTalk (AppleTalk protocols on Ethernet link 1663 * layer) may use 802.2 encapsulation. 1664 */ 1665 1666 /* 1667 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1668 * we check for the 802.2 protocol type in the 1669 * "Ethernet type" field. 1670 */ 1671 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2); 1672 1673 /* 1674 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1675 * SNAP packets with an organization code of 1676 * 0x080007 (Apple, for Appletalk) and a protocol 1677 * type of ETHERTYPE_ATALK (Appletalk). 1678 * 1679 * 802.2-encapsulated ETHERTYPE_AARP packets are 1680 * SNAP packets with an organization code of 1681 * 0x000000 (encapsulated Ethernet) and a protocol 1682 * type of ETHERTYPE_AARP (Appletalk ARP). 1683 */ 1684 if (proto == ETHERTYPE_ATALK) 1685 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 1686 off_linktype + 2); 1687 else /* proto == ETHERTYPE_AARP */ 1688 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 1689 off_linktype + 2); 1690 gen_and(b0, b1); 1691 1692 /* 1693 * Check for Ethernet encapsulation (Ethertalk 1694 * phase 1?); we just check for the Ethernet 1695 * protocol type. 1696 */ 1697 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto); 1698 1699 gen_or(b0, b1); 1700 return b1; 1701 1702 default: 1703 if (proto <= ETHERMTU) { 1704 /* 1705 * This is an LLC SAP value, so the frames 1706 * that match would be 802.2 frames. 1707 * Check for the 802.2 protocol type 1708 * in the "Ethernet type" field, and 1709 * then check the DSAP. 1710 */ 1711 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, 1712 LINUX_SLL_P_802_2); 1713 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, 1714 (bpf_int32)proto); 1715 gen_and(b0, b1); 1716 return b1; 1717 } else { 1718 /* 1719 * This is an Ethernet type, so compare 1720 * the length/type field with it (if 1721 * the frame is an 802.2 frame, the length 1722 * field will be <= ETHERMTU, and, as 1723 * "proto" is > ETHERMTU, this test 1724 * will fail and the frame won't match, 1725 * which is what we want). 1726 */ 1727 return gen_cmp(OR_LINK, off_linktype, BPF_H, 1728 (bpf_int32)proto); 1729 } 1730 } 1731 } 1732 1733 static void 1734 insert_radiotap_load_llprefixlen(b) 1735 struct block *b; 1736 { 1737 struct slist *s1, *s2; 1738 1739 /* 1740 * Prepend to the statements in this block code to load the 1741 * length of the radiotap header into the register assigned 1742 * to hold that length, if one has been assigned. 1743 */ 1744 if (reg_ll_size != -1) { 1745 /* 1746 * The 2 bytes at offsets of 2 and 3 from the beginning 1747 * of the radiotap header are the length of the radiotap 1748 * header; unfortunately, it's little-endian, so we have 1749 * to load it a byte at a time and construct the value. 1750 */ 1751 1752 /* 1753 * Load the high-order byte, at an offset of 3, shift it 1754 * left a byte, and put the result in the X register. 1755 */ 1756 s1 = new_stmt(BPF_LD|BPF_B|BPF_ABS); 1757 s1->s.k = 3; 1758 s2 = new_stmt(BPF_ALU|BPF_LSH|BPF_K); 1759 sappend(s1, s2); 1760 s2->s.k = 8; 1761 s2 = new_stmt(BPF_MISC|BPF_TAX); 1762 sappend(s1, s2); 1763 1764 /* 1765 * Load the next byte, at an offset of 2, and OR the 1766 * value from the X register into it. 1767 */ 1768 s2 = new_stmt(BPF_LD|BPF_B|BPF_ABS); 1769 sappend(s1, s2); 1770 s2->s.k = 2; 1771 s2 = new_stmt(BPF_ALU|BPF_OR|BPF_X); 1772 sappend(s1, s2); 1773 1774 /* 1775 * Now allocate a register to hold that value and store 1776 * it. 1777 */ 1778 s2 = new_stmt(BPF_ST); 1779 s2->s.k = reg_ll_size; 1780 sappend(s1, s2); 1781 1782 /* 1783 * Now move it into the X register. 1784 */ 1785 s2 = new_stmt(BPF_MISC|BPF_TAX); 1786 sappend(s1, s2); 1787 1788 /* 1789 * Now append all the existing statements in this 1790 * block to these statements. 1791 */ 1792 sappend(s1, b->stmts); 1793 b->stmts = s1; 1794 } 1795 } 1796 1797 1798 static void 1799 insert_load_llprefixlen(b) 1800 struct block *b; 1801 { 1802 switch (linktype) { 1803 1804 case DLT_IEEE802_11_RADIO: 1805 insert_radiotap_load_llprefixlen(b); 1806 } 1807 } 1808 1809 1810 static struct slist * 1811 gen_radiotap_llprefixlen(void) 1812 { 1813 struct slist *s; 1814 1815 if (reg_ll_size == -1) { 1816 /* 1817 * We haven't yet assigned a register for the length 1818 * of the radiotap header; allocate one. 1819 */ 1820 reg_ll_size = alloc_reg(); 1821 } 1822 1823 /* 1824 * Load the register containing the radiotap length 1825 * into the X register. 1826 */ 1827 s = new_stmt(BPF_LDX|BPF_MEM); 1828 s->s.k = reg_ll_size; 1829 return s; 1830 } 1831 1832 /* 1833 * Generate code to compute the link-layer header length, if necessary, 1834 * putting it into the X register, and to return either a pointer to a 1835 * "struct slist" for the list of statements in that code, or NULL if 1836 * no code is necessary. 1837 */ 1838 static struct slist * 1839 gen_llprefixlen(void) 1840 { 1841 switch (linktype) { 1842 1843 case DLT_IEEE802_11_RADIO: 1844 return gen_radiotap_llprefixlen(); 1845 1846 default: 1847 return NULL; 1848 } 1849 } 1850 1851 /* 1852 * Generate code to match a particular packet type by matching the 1853 * link-layer type field or fields in the 802.2 LLC header. 1854 * 1855 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1856 * value, if <= ETHERMTU. 1857 */ 1858 static struct block * 1859 gen_linktype(proto) 1860 register int proto; 1861 { 1862 struct block *b0, *b1, *b2; 1863 1864 /* are we checking MPLS-encapsulated packets? */ 1865 if (label_stack_depth > 0) { 1866 switch (proto) { 1867 case ETHERTYPE_IP: 1868 case PPP_IP: 1869 /* FIXME add other L3 proto IDs */ 1870 return gen_mpls_linktype(Q_IP); 1871 1872 case ETHERTYPE_IPV6: 1873 case PPP_IPV6: 1874 /* FIXME add other L3 proto IDs */ 1875 return gen_mpls_linktype(Q_IPV6); 1876 1877 default: 1878 bpf_error("unsupported protocol over mpls"); 1879 /* NOTREACHED */ 1880 } 1881 } 1882 1883 switch (linktype) { 1884 1885 case DLT_EN10MB: 1886 return gen_ether_linktype(proto); 1887 /*NOTREACHED*/ 1888 break; 1889 1890 case DLT_C_HDLC: 1891 switch (proto) { 1892 1893 case LLCSAP_ISONS: 1894 proto = (proto << 8 | LLCSAP_ISONS); 1895 /* fall through */ 1896 1897 default: 1898 return gen_cmp(OR_LINK, off_linktype, BPF_H, 1899 (bpf_int32)proto); 1900 /*NOTREACHED*/ 1901 break; 1902 } 1903 break; 1904 1905 case DLT_FDDI: 1906 case DLT_IEEE802: 1907 case DLT_IEEE802_11: 1908 case DLT_IEEE802_11_RADIO_AVS: 1909 case DLT_IEEE802_11_RADIO: 1910 case DLT_PRISM_HEADER: 1911 case DLT_ATM_RFC1483: 1912 case DLT_ATM_CLIP: 1913 case DLT_IP_OVER_FC: 1914 return gen_llc_linktype(proto); 1915 /*NOTREACHED*/ 1916 break; 1917 1918 case DLT_SUNATM: 1919 /* 1920 * If "is_lane" is set, check for a LANE-encapsulated 1921 * version of this protocol, otherwise check for an 1922 * LLC-encapsulated version of this protocol. 1923 * 1924 * We assume LANE means Ethernet, not Token Ring. 1925 */ 1926 if (is_lane) { 1927 /* 1928 * Check that the packet doesn't begin with an 1929 * LE Control marker. (We've already generated 1930 * a test for LANE.) 1931 */ 1932 b0 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 1933 0xFF00); 1934 gen_not(b0); 1935 1936 /* 1937 * Now generate an Ethernet test. 1938 */ 1939 b1 = gen_ether_linktype(proto); 1940 gen_and(b0, b1); 1941 return b1; 1942 } else { 1943 /* 1944 * Check for LLC encapsulation and then check the 1945 * protocol. 1946 */ 1947 b0 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 1948 b1 = gen_llc_linktype(proto); 1949 gen_and(b0, b1); 1950 return b1; 1951 } 1952 /*NOTREACHED*/ 1953 break; 1954 1955 case DLT_LINUX_SLL: 1956 return gen_linux_sll_linktype(proto); 1957 /*NOTREACHED*/ 1958 break; 1959 1960 case DLT_SLIP: 1961 case DLT_SLIP_BSDOS: 1962 case DLT_RAW: 1963 /* 1964 * These types don't provide any type field; packets 1965 * are always IP. 1966 * 1967 * XXX - for IPv4, check for a version number of 4, and, 1968 * for IPv6, check for a version number of 6? 1969 */ 1970 switch (proto) { 1971 1972 case ETHERTYPE_IP: 1973 #ifdef INET6 1974 case ETHERTYPE_IPV6: 1975 #endif 1976 return gen_true(); /* always true */ 1977 1978 default: 1979 return gen_false(); /* always false */ 1980 } 1981 /*NOTREACHED*/ 1982 break; 1983 1984 case DLT_PPP: 1985 case DLT_PPP_PPPD: 1986 case DLT_PPP_SERIAL: 1987 case DLT_PPP_ETHER: 1988 /* 1989 * We use Ethernet protocol types inside libpcap; 1990 * map them to the corresponding PPP protocol types. 1991 */ 1992 switch (proto) { 1993 1994 case ETHERTYPE_IP: 1995 proto = PPP_IP; 1996 break; 1997 1998 #ifdef INET6 1999 case ETHERTYPE_IPV6: 2000 proto = PPP_IPV6; 2001 break; 2002 #endif 2003 2004 case ETHERTYPE_DN: 2005 proto = PPP_DECNET; 2006 break; 2007 2008 case ETHERTYPE_ATALK: 2009 proto = PPP_APPLE; 2010 break; 2011 2012 case ETHERTYPE_NS: 2013 proto = PPP_NS; 2014 break; 2015 2016 case LLCSAP_ISONS: 2017 proto = PPP_OSI; 2018 break; 2019 2020 case LLCSAP_8021D: 2021 /* 2022 * I'm assuming the "Bridging PDU"s that go 2023 * over PPP are Spanning Tree Protocol 2024 * Bridging PDUs. 2025 */ 2026 proto = PPP_BRPDU; 2027 break; 2028 2029 case LLCSAP_IPX: 2030 proto = PPP_IPX; 2031 break; 2032 } 2033 break; 2034 2035 case DLT_PPP_BSDOS: 2036 /* 2037 * We use Ethernet protocol types inside libpcap; 2038 * map them to the corresponding PPP protocol types. 2039 */ 2040 switch (proto) { 2041 2042 case ETHERTYPE_IP: 2043 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_IP); 2044 b1 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJC); 2045 gen_or(b0, b1); 2046 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJNC); 2047 gen_or(b1, b0); 2048 return b0; 2049 2050 #ifdef INET6 2051 case ETHERTYPE_IPV6: 2052 proto = PPP_IPV6; 2053 /* more to go? */ 2054 break; 2055 #endif 2056 2057 case ETHERTYPE_DN: 2058 proto = PPP_DECNET; 2059 break; 2060 2061 case ETHERTYPE_ATALK: 2062 proto = PPP_APPLE; 2063 break; 2064 2065 case ETHERTYPE_NS: 2066 proto = PPP_NS; 2067 break; 2068 2069 case LLCSAP_ISONS: 2070 proto = PPP_OSI; 2071 break; 2072 2073 case LLCSAP_8021D: 2074 /* 2075 * I'm assuming the "Bridging PDU"s that go 2076 * over PPP are Spanning Tree Protocol 2077 * Bridging PDUs. 2078 */ 2079 proto = PPP_BRPDU; 2080 break; 2081 2082 case LLCSAP_IPX: 2083 proto = PPP_IPX; 2084 break; 2085 } 2086 break; 2087 2088 case DLT_NULL: 2089 case DLT_LOOP: 2090 case DLT_ENC: 2091 /* 2092 * For DLT_NULL, the link-layer header is a 32-bit 2093 * word containing an AF_ value in *host* byte order, 2094 * and for DLT_ENC, the link-layer header begins 2095 * with a 32-bit work containing an AF_ value in 2096 * host byte order. 2097 * 2098 * In addition, if we're reading a saved capture file, 2099 * the host byte order in the capture may not be the 2100 * same as the host byte order on this machine. 2101 * 2102 * For DLT_LOOP, the link-layer header is a 32-bit 2103 * word containing an AF_ value in *network* byte order. 2104 * 2105 * XXX - AF_ values may, unfortunately, be platform- 2106 * dependent; for example, FreeBSD's AF_INET6 is 24 2107 * whilst NetBSD's and OpenBSD's is 26. 2108 * 2109 * This means that, when reading a capture file, just 2110 * checking for our AF_INET6 value won't work if the 2111 * capture file came from another OS. 2112 */ 2113 switch (proto) { 2114 2115 case ETHERTYPE_IP: 2116 proto = AF_INET; 2117 break; 2118 2119 #ifdef INET6 2120 case ETHERTYPE_IPV6: 2121 proto = AF_INET6; 2122 break; 2123 #endif 2124 2125 default: 2126 /* 2127 * Not a type on which we support filtering. 2128 * XXX - support those that have AF_ values 2129 * #defined on this platform, at least? 2130 */ 2131 return gen_false(); 2132 } 2133 2134 if (linktype == DLT_NULL || linktype == DLT_ENC) { 2135 /* 2136 * The AF_ value is in host byte order, but 2137 * the BPF interpreter will convert it to 2138 * network byte order. 2139 * 2140 * If this is a save file, and it's from a 2141 * machine with the opposite byte order to 2142 * ours, we byte-swap the AF_ value. 2143 * 2144 * Then we run it through "htonl()", and 2145 * generate code to compare against the result. 2146 */ 2147 if (bpf_pcap->sf.rfile != NULL && 2148 bpf_pcap->sf.swapped) 2149 proto = SWAPLONG(proto); 2150 proto = htonl(proto); 2151 } 2152 return (gen_cmp(OR_LINK, 0, BPF_W, (bpf_int32)proto)); 2153 2154 case DLT_PFLOG: 2155 /* 2156 * af field is host byte order in contrast to the rest of 2157 * the packet. 2158 */ 2159 if (proto == ETHERTYPE_IP) 2160 return (gen_cmp(OR_LINK, offsetof(struct pfloghdr, af), 2161 BPF_B, (bpf_int32)AF_INET)); 2162 #ifdef INET6 2163 else if (proto == ETHERTYPE_IPV6) 2164 return (gen_cmp(OR_LINK, offsetof(struct pfloghdr, af), 2165 BPF_B, (bpf_int32)AF_INET6)); 2166 #endif /* INET6 */ 2167 else 2168 return gen_false(); 2169 /*NOTREACHED*/ 2170 break; 2171 2172 case DLT_ARCNET: 2173 case DLT_ARCNET_LINUX: 2174 /* 2175 * XXX should we check for first fragment if the protocol 2176 * uses PHDS? 2177 */ 2178 switch (proto) { 2179 2180 default: 2181 return gen_false(); 2182 2183 #ifdef INET6 2184 case ETHERTYPE_IPV6: 2185 return (gen_cmp(OR_LINK, off_linktype, BPF_B, 2186 (bpf_int32)ARCTYPE_INET6)); 2187 #endif /* INET6 */ 2188 2189 case ETHERTYPE_IP: 2190 b0 = gen_cmp(OR_LINK, off_linktype, BPF_B, 2191 (bpf_int32)ARCTYPE_IP); 2192 b1 = gen_cmp(OR_LINK, off_linktype, BPF_B, 2193 (bpf_int32)ARCTYPE_IP_OLD); 2194 gen_or(b0, b1); 2195 return (b1); 2196 2197 case ETHERTYPE_ARP: 2198 b0 = gen_cmp(OR_LINK, off_linktype, BPF_B, 2199 (bpf_int32)ARCTYPE_ARP); 2200 b1 = gen_cmp(OR_LINK, off_linktype, BPF_B, 2201 (bpf_int32)ARCTYPE_ARP_OLD); 2202 gen_or(b0, b1); 2203 return (b1); 2204 2205 case ETHERTYPE_REVARP: 2206 return (gen_cmp(OR_LINK, off_linktype, BPF_B, 2207 (bpf_int32)ARCTYPE_REVARP)); 2208 2209 case ETHERTYPE_ATALK: 2210 return (gen_cmp(OR_LINK, off_linktype, BPF_B, 2211 (bpf_int32)ARCTYPE_ATALK)); 2212 } 2213 /*NOTREACHED*/ 2214 break; 2215 2216 case DLT_LTALK: 2217 switch (proto) { 2218 case ETHERTYPE_ATALK: 2219 return gen_true(); 2220 default: 2221 return gen_false(); 2222 } 2223 /*NOTREACHED*/ 2224 break; 2225 2226 case DLT_FRELAY: 2227 /* 2228 * XXX - assumes a 2-byte Frame Relay header with 2229 * DLCI and flags. What if the address is longer? 2230 */ 2231 switch (proto) { 2232 2233 case ETHERTYPE_IP: 2234 /* 2235 * Check for the special NLPID for IP. 2236 */ 2237 return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | 0xcc); 2238 2239 #ifdef INET6 2240 case ETHERTYPE_IPV6: 2241 /* 2242 * Check for the special NLPID for IPv6. 2243 */ 2244 return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | 0x8e); 2245 #endif 2246 2247 case LLCSAP_ISONS: 2248 /* 2249 * Check for several OSI protocols. 2250 * 2251 * Frame Relay packets typically have an OSI 2252 * NLPID at the beginning; we check for each 2253 * of them. 2254 * 2255 * What we check for is the NLPID and a frame 2256 * control field of UI, i.e. 0x03 followed 2257 * by the NLPID. 2258 */ 2259 b0 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO8473_CLNP); 2260 b1 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO9542_ESIS); 2261 b2 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO10589_ISIS); 2262 gen_or(b1, b2); 2263 gen_or(b0, b2); 2264 return b2; 2265 2266 default: 2267 return gen_false(); 2268 } 2269 /*NOTREACHED*/ 2270 break; 2271 2272 case DLT_JUNIPER_MFR: 2273 case DLT_JUNIPER_MLFR: 2274 case DLT_JUNIPER_MLPPP: 2275 case DLT_JUNIPER_ATM1: 2276 case DLT_JUNIPER_ATM2: 2277 case DLT_JUNIPER_PPPOE: 2278 case DLT_JUNIPER_PPPOE_ATM: 2279 case DLT_JUNIPER_GGSN: 2280 case DLT_JUNIPER_ES: 2281 case DLT_JUNIPER_MONITOR: 2282 case DLT_JUNIPER_SERVICES: 2283 case DLT_JUNIPER_ETHER: 2284 case DLT_JUNIPER_PPP: 2285 case DLT_JUNIPER_FRELAY: 2286 case DLT_JUNIPER_CHDLC: 2287 /* just lets verify the magic number for now - 2288 * on ATM we may have up to 6 different encapsulations on the wire 2289 * and need a lot of heuristics to figure out that the payload 2290 * might be; 2291 * 2292 * FIXME encapsulation specific BPF_ filters 2293 */ 2294 return gen_mcmp(OR_LINK, 0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */ 2295 2296 case DLT_LINUX_IRDA: 2297 bpf_error("IrDA link-layer type filtering not implemented"); 2298 2299 case DLT_DOCSIS: 2300 bpf_error("DOCSIS link-layer type filtering not implemented"); 2301 2302 case DLT_LINUX_LAPD: 2303 bpf_error("LAPD link-layer type filtering not implemented"); 2304 } 2305 2306 /* 2307 * All the types that have no encapsulation should either be 2308 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if 2309 * all packets are IP packets, or should be handled in some 2310 * special case, if none of them are (if some are and some 2311 * aren't, the lack of encapsulation is a problem, as we'd 2312 * have to find some other way of determining the packet type). 2313 * 2314 * Therefore, if "off_linktype" is -1, there's an error. 2315 */ 2316 if (off_linktype == (u_int)-1) 2317 abort(); 2318 2319 /* 2320 * Any type not handled above should always have an Ethernet 2321 * type at an offset of "off_linktype". (PPP is partially 2322 * handled above - the protocol type is mapped from the 2323 * Ethernet and LLC types we use internally to the corresponding 2324 * PPP type - but the PPP type is always specified by a value 2325 * at "off_linktype", so we don't have to do the code generation 2326 * above.) 2327 */ 2328 return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto); 2329 } 2330 2331 /* 2332 * Check for an LLC SNAP packet with a given organization code and 2333 * protocol type; we check the entire contents of the 802.2 LLC and 2334 * snap headers, checking for DSAP and SSAP of SNAP and a control 2335 * field of 0x03 in the LLC header, and for the specified organization 2336 * code and protocol type in the SNAP header. 2337 */ 2338 static struct block * 2339 gen_snap(orgcode, ptype, offset) 2340 bpf_u_int32 orgcode; 2341 bpf_u_int32 ptype; 2342 u_int offset; 2343 { 2344 u_char snapblock[8]; 2345 2346 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 2347 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ 2348 snapblock[2] = 0x03; /* control = UI */ 2349 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 2350 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 2351 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 2352 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 2353 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ 2354 return gen_bcmp(OR_LINK, offset, 8, snapblock); 2355 } 2356 2357 /* 2358 * Generate code to match a particular packet type, for link-layer types 2359 * using 802.2 LLC headers. 2360 * 2361 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used 2362 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues. 2363 * 2364 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 2365 * value, if <= ETHERMTU. We use that to determine whether to 2366 * match the DSAP or both DSAP and LSAP or to check the OUI and 2367 * protocol ID in a SNAP header. 2368 */ 2369 static struct block * 2370 gen_llc_linktype(proto) 2371 int proto; 2372 { 2373 /* 2374 * XXX - handle token-ring variable-length header. 2375 */ 2376 switch (proto) { 2377 2378 case LLCSAP_IP: 2379 case LLCSAP_ISONS: 2380 case LLCSAP_NETBEUI: 2381 /* 2382 * XXX - should we check both the DSAP and the 2383 * SSAP, like this, or should we check just the 2384 * DSAP, as we do for other types <= ETHERMTU 2385 * (i.e., other SAP values)? 2386 */ 2387 return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_u_int32) 2388 ((proto << 8) | proto)); 2389 2390 case LLCSAP_IPX: 2391 /* 2392 * XXX - are there ever SNAP frames for IPX on 2393 * non-Ethernet 802.x networks? 2394 */ 2395 return gen_cmp(OR_LINK, off_linktype, BPF_B, 2396 (bpf_int32)LLCSAP_IPX); 2397 2398 case ETHERTYPE_ATALK: 2399 /* 2400 * 802.2-encapsulated ETHERTYPE_ATALK packets are 2401 * SNAP packets with an organization code of 2402 * 0x080007 (Apple, for Appletalk) and a protocol 2403 * type of ETHERTYPE_ATALK (Appletalk). 2404 * 2405 * XXX - check for an organization code of 2406 * encapsulated Ethernet as well? 2407 */ 2408 return gen_snap(0x080007, ETHERTYPE_ATALK, off_linktype); 2409 2410 default: 2411 /* 2412 * XXX - we don't have to check for IPX 802.3 2413 * here, but should we check for the IPX Ethertype? 2414 */ 2415 if (proto <= ETHERMTU) { 2416 /* 2417 * This is an LLC SAP value, so check 2418 * the DSAP. 2419 */ 2420 return gen_cmp(OR_LINK, off_linktype, BPF_B, 2421 (bpf_int32)proto); 2422 } else { 2423 /* 2424 * This is an Ethernet type; we assume that it's 2425 * unlikely that it'll appear in the right place 2426 * at random, and therefore check only the 2427 * location that would hold the Ethernet type 2428 * in a SNAP frame with an organization code of 2429 * 0x000000 (encapsulated Ethernet). 2430 * 2431 * XXX - if we were to check for the SNAP DSAP and 2432 * LSAP, as per XXX, and were also to check for an 2433 * organization code of 0x000000 (encapsulated 2434 * Ethernet), we'd do 2435 * 2436 * return gen_snap(0x000000, proto, 2437 * off_linktype); 2438 * 2439 * here; for now, we don't, as per the above. 2440 * I don't know whether it's worth the extra CPU 2441 * time to do the right check or not. 2442 */ 2443 return gen_cmp(OR_LINK, off_linktype+6, BPF_H, 2444 (bpf_int32)proto); 2445 } 2446 } 2447 } 2448 2449 static struct block * 2450 gen_hostop(addr, mask, dir, proto, src_off, dst_off) 2451 bpf_u_int32 addr; 2452 bpf_u_int32 mask; 2453 int dir, proto; 2454 u_int src_off, dst_off; 2455 { 2456 struct block *b0, *b1; 2457 u_int offset; 2458 2459 switch (dir) { 2460 2461 case Q_SRC: 2462 offset = src_off; 2463 break; 2464 2465 case Q_DST: 2466 offset = dst_off; 2467 break; 2468 2469 case Q_AND: 2470 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 2471 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 2472 gen_and(b0, b1); 2473 return b1; 2474 2475 case Q_OR: 2476 case Q_DEFAULT: 2477 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 2478 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 2479 gen_or(b0, b1); 2480 return b1; 2481 2482 default: 2483 abort(); 2484 } 2485 b0 = gen_linktype(proto); 2486 b1 = gen_mcmp(OR_NET, offset, BPF_W, (bpf_int32)addr, mask); 2487 gen_and(b0, b1); 2488 return b1; 2489 } 2490 2491 #ifdef INET6 2492 static struct block * 2493 gen_hostop6(addr, mask, dir, proto, src_off, dst_off) 2494 struct in6_addr *addr; 2495 struct in6_addr *mask; 2496 int dir, proto; 2497 u_int src_off, dst_off; 2498 { 2499 struct block *b0, *b1; 2500 u_int offset; 2501 u_int32_t *a, *m; 2502 2503 switch (dir) { 2504 2505 case Q_SRC: 2506 offset = src_off; 2507 break; 2508 2509 case Q_DST: 2510 offset = dst_off; 2511 break; 2512 2513 case Q_AND: 2514 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 2515 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 2516 gen_and(b0, b1); 2517 return b1; 2518 2519 case Q_OR: 2520 case Q_DEFAULT: 2521 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 2522 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 2523 gen_or(b0, b1); 2524 return b1; 2525 2526 default: 2527 abort(); 2528 } 2529 /* this order is important */ 2530 a = (u_int32_t *)addr; 2531 m = (u_int32_t *)mask; 2532 b1 = gen_mcmp(OR_NET, offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 2533 b0 = gen_mcmp(OR_NET, offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 2534 gen_and(b0, b1); 2535 b0 = gen_mcmp(OR_NET, offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 2536 gen_and(b0, b1); 2537 b0 = gen_mcmp(OR_NET, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 2538 gen_and(b0, b1); 2539 b0 = gen_linktype(proto); 2540 gen_and(b0, b1); 2541 return b1; 2542 } 2543 #endif /*INET6*/ 2544 2545 static struct block * 2546 gen_ehostop(eaddr, dir) 2547 register const u_char *eaddr; 2548 register int dir; 2549 { 2550 register struct block *b0, *b1; 2551 2552 switch (dir) { 2553 case Q_SRC: 2554 return gen_bcmp(OR_LINK, off_mac + 6, 6, eaddr); 2555 2556 case Q_DST: 2557 return gen_bcmp(OR_LINK, off_mac + 0, 6, eaddr); 2558 2559 case Q_AND: 2560 b0 = gen_ehostop(eaddr, Q_SRC); 2561 b1 = gen_ehostop(eaddr, Q_DST); 2562 gen_and(b0, b1); 2563 return b1; 2564 2565 case Q_DEFAULT: 2566 case Q_OR: 2567 b0 = gen_ehostop(eaddr, Q_SRC); 2568 b1 = gen_ehostop(eaddr, Q_DST); 2569 gen_or(b0, b1); 2570 return b1; 2571 } 2572 abort(); 2573 /* NOTREACHED */ 2574 } 2575 2576 /* 2577 * Like gen_ehostop, but for DLT_FDDI 2578 */ 2579 static struct block * 2580 gen_fhostop(eaddr, dir) 2581 register const u_char *eaddr; 2582 register int dir; 2583 { 2584 struct block *b0, *b1; 2585 2586 switch (dir) { 2587 case Q_SRC: 2588 #ifdef PCAP_FDDIPAD 2589 return gen_bcmp(OR_LINK, 6 + 1 + pcap_fddipad, 6, eaddr); 2590 #else 2591 return gen_bcmp(OR_LINK, 6 + 1, 6, eaddr); 2592 #endif 2593 2594 case Q_DST: 2595 #ifdef PCAP_FDDIPAD 2596 return gen_bcmp(OR_LINK, 0 + 1 + pcap_fddipad, 6, eaddr); 2597 #else 2598 return gen_bcmp(OR_LINK, 0 + 1, 6, eaddr); 2599 #endif 2600 2601 case Q_AND: 2602 b0 = gen_fhostop(eaddr, Q_SRC); 2603 b1 = gen_fhostop(eaddr, Q_DST); 2604 gen_and(b0, b1); 2605 return b1; 2606 2607 case Q_DEFAULT: 2608 case Q_OR: 2609 b0 = gen_fhostop(eaddr, Q_SRC); 2610 b1 = gen_fhostop(eaddr, Q_DST); 2611 gen_or(b0, b1); 2612 return b1; 2613 } 2614 abort(); 2615 /* NOTREACHED */ 2616 } 2617 2618 /* 2619 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 2620 */ 2621 static struct block * 2622 gen_thostop(eaddr, dir) 2623 register const u_char *eaddr; 2624 register int dir; 2625 { 2626 register struct block *b0, *b1; 2627 2628 switch (dir) { 2629 case Q_SRC: 2630 return gen_bcmp(OR_LINK, 8, 6, eaddr); 2631 2632 case Q_DST: 2633 return gen_bcmp(OR_LINK, 2, 6, eaddr); 2634 2635 case Q_AND: 2636 b0 = gen_thostop(eaddr, Q_SRC); 2637 b1 = gen_thostop(eaddr, Q_DST); 2638 gen_and(b0, b1); 2639 return b1; 2640 2641 case Q_DEFAULT: 2642 case Q_OR: 2643 b0 = gen_thostop(eaddr, Q_SRC); 2644 b1 = gen_thostop(eaddr, Q_DST); 2645 gen_or(b0, b1); 2646 return b1; 2647 } 2648 abort(); 2649 /* NOTREACHED */ 2650 } 2651 2652 /* 2653 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) 2654 */ 2655 static struct block * 2656 gen_wlanhostop(eaddr, dir) 2657 register const u_char *eaddr; 2658 register int dir; 2659 { 2660 register struct block *b0, *b1, *b2; 2661 register struct slist *s; 2662 2663 switch (dir) { 2664 case Q_SRC: 2665 /* 2666 * Oh, yuk. 2667 * 2668 * For control frames, there is no SA. 2669 * 2670 * For management frames, SA is at an 2671 * offset of 10 from the beginning of 2672 * the packet. 2673 * 2674 * For data frames, SA is at an offset 2675 * of 10 from the beginning of the packet 2676 * if From DS is clear, at an offset of 2677 * 16 from the beginning of the packet 2678 * if From DS is set and To DS is clear, 2679 * and an offset of 24 from the beginning 2680 * of the packet if From DS is set and To DS 2681 * is set. 2682 */ 2683 2684 /* 2685 * Generate the tests to be done for data frames 2686 * with From DS set. 2687 * 2688 * First, check for To DS set, i.e. check "link[1] & 0x01". 2689 */ 2690 s = gen_load_a(OR_LINK, 1, BPF_B); 2691 b1 = new_block(JMP(BPF_JSET)); 2692 b1->s.k = 0x01; /* To DS */ 2693 b1->stmts = s; 2694 2695 /* 2696 * If To DS is set, the SA is at 24. 2697 */ 2698 b0 = gen_bcmp(OR_LINK, 24, 6, eaddr); 2699 gen_and(b1, b0); 2700 2701 /* 2702 * Now, check for To DS not set, i.e. check 2703 * "!(link[1] & 0x01)". 2704 */ 2705 s = gen_load_a(OR_LINK, 1, BPF_B); 2706 b2 = new_block(JMP(BPF_JSET)); 2707 b2->s.k = 0x01; /* To DS */ 2708 b2->stmts = s; 2709 gen_not(b2); 2710 2711 /* 2712 * If To DS is not set, the SA is at 16. 2713 */ 2714 b1 = gen_bcmp(OR_LINK, 16, 6, eaddr); 2715 gen_and(b2, b1); 2716 2717 /* 2718 * Now OR together the last two checks. That gives 2719 * the complete set of checks for data frames with 2720 * From DS set. 2721 */ 2722 gen_or(b1, b0); 2723 2724 /* 2725 * Now check for From DS being set, and AND that with 2726 * the ORed-together checks. 2727 */ 2728 s = gen_load_a(OR_LINK, 1, BPF_B); 2729 b1 = new_block(JMP(BPF_JSET)); 2730 b1->s.k = 0x02; /* From DS */ 2731 b1->stmts = s; 2732 gen_and(b1, b0); 2733 2734 /* 2735 * Now check for data frames with From DS not set. 2736 */ 2737 s = gen_load_a(OR_LINK, 1, BPF_B); 2738 b2 = new_block(JMP(BPF_JSET)); 2739 b2->s.k = 0x02; /* From DS */ 2740 b2->stmts = s; 2741 gen_not(b2); 2742 2743 /* 2744 * If From DS isn't set, the SA is at 10. 2745 */ 2746 b1 = gen_bcmp(OR_LINK, 10, 6, eaddr); 2747 gen_and(b2, b1); 2748 2749 /* 2750 * Now OR together the checks for data frames with 2751 * From DS not set and for data frames with From DS 2752 * set; that gives the checks done for data frames. 2753 */ 2754 gen_or(b1, b0); 2755 2756 /* 2757 * Now check for a data frame. 2758 * I.e, check "link[0] & 0x08". 2759 */ 2760 gen_load_a(OR_LINK, 0, BPF_B); 2761 b1 = new_block(JMP(BPF_JSET)); 2762 b1->s.k = 0x08; 2763 b1->stmts = s; 2764 2765 /* 2766 * AND that with the checks done for data frames. 2767 */ 2768 gen_and(b1, b0); 2769 2770 /* 2771 * If the high-order bit of the type value is 0, this 2772 * is a management frame. 2773 * I.e, check "!(link[0] & 0x08)". 2774 */ 2775 s = gen_load_a(OR_LINK, 0, BPF_B); 2776 b2 = new_block(JMP(BPF_JSET)); 2777 b2->s.k = 0x08; 2778 b2->stmts = s; 2779 gen_not(b2); 2780 2781 /* 2782 * For management frames, the SA is at 10. 2783 */ 2784 b1 = gen_bcmp(OR_LINK, 10, 6, eaddr); 2785 gen_and(b2, b1); 2786 2787 /* 2788 * OR that with the checks done for data frames. 2789 * That gives the checks done for management and 2790 * data frames. 2791 */ 2792 gen_or(b1, b0); 2793 2794 /* 2795 * If the low-order bit of the type value is 1, 2796 * this is either a control frame or a frame 2797 * with a reserved type, and thus not a 2798 * frame with an SA. 2799 * 2800 * I.e., check "!(link[0] & 0x04)". 2801 */ 2802 s = gen_load_a(OR_LINK, 0, BPF_B); 2803 b1 = new_block(JMP(BPF_JSET)); 2804 b1->s.k = 0x04; 2805 b1->stmts = s; 2806 gen_not(b1); 2807 2808 /* 2809 * AND that with the checks for data and management 2810 * frames. 2811 */ 2812 gen_and(b1, b0); 2813 return b0; 2814 2815 case Q_DST: 2816 /* 2817 * Oh, yuk. 2818 * 2819 * For control frames, there is no DA. 2820 * 2821 * For management frames, DA is at an 2822 * offset of 4 from the beginning of 2823 * the packet. 2824 * 2825 * For data frames, DA is at an offset 2826 * of 4 from the beginning of the packet 2827 * if To DS is clear and at an offset of 2828 * 16 from the beginning of the packet 2829 * if To DS is set. 2830 */ 2831 2832 /* 2833 * Generate the tests to be done for data frames. 2834 * 2835 * First, check for To DS set, i.e. "link[1] & 0x01". 2836 */ 2837 s = gen_load_a(OR_LINK, 1, BPF_B); 2838 b1 = new_block(JMP(BPF_JSET)); 2839 b1->s.k = 0x01; /* To DS */ 2840 b1->stmts = s; 2841 2842 /* 2843 * If To DS is set, the DA is at 16. 2844 */ 2845 b0 = gen_bcmp(OR_LINK, 16, 6, eaddr); 2846 gen_and(b1, b0); 2847 2848 /* 2849 * Now, check for To DS not set, i.e. check 2850 * "!(link[1] & 0x01)". 2851 */ 2852 s = gen_load_a(OR_LINK, 1, BPF_B); 2853 b2 = new_block(JMP(BPF_JSET)); 2854 b2->s.k = 0x01; /* To DS */ 2855 b2->stmts = s; 2856 gen_not(b2); 2857 2858 /* 2859 * If To DS is not set, the DA is at 4. 2860 */ 2861 b1 = gen_bcmp(OR_LINK, 4, 6, eaddr); 2862 gen_and(b2, b1); 2863 2864 /* 2865 * Now OR together the last two checks. That gives 2866 * the complete set of checks for data frames. 2867 */ 2868 gen_or(b1, b0); 2869 2870 /* 2871 * Now check for a data frame. 2872 * I.e, check "link[0] & 0x08". 2873 */ 2874 s = gen_load_a(OR_LINK, 0, BPF_B); 2875 b1 = new_block(JMP(BPF_JSET)); 2876 b1->s.k = 0x08; 2877 b1->stmts = s; 2878 2879 /* 2880 * AND that with the checks done for data frames. 2881 */ 2882 gen_and(b1, b0); 2883 2884 /* 2885 * If the high-order bit of the type value is 0, this 2886 * is a management frame. 2887 * I.e, check "!(link[0] & 0x08)". 2888 */ 2889 s = gen_load_a(OR_LINK, 0, BPF_B); 2890 b2 = new_block(JMP(BPF_JSET)); 2891 b2->s.k = 0x08; 2892 b2->stmts = s; 2893 gen_not(b2); 2894 2895 /* 2896 * For management frames, the DA is at 4. 2897 */ 2898 b1 = gen_bcmp(OR_LINK, 4, 6, eaddr); 2899 gen_and(b2, b1); 2900 2901 /* 2902 * OR that with the checks done for data frames. 2903 * That gives the checks done for management and 2904 * data frames. 2905 */ 2906 gen_or(b1, b0); 2907 2908 /* 2909 * If the low-order bit of the type value is 1, 2910 * this is either a control frame or a frame 2911 * with a reserved type, and thus not a 2912 * frame with an SA. 2913 * 2914 * I.e., check "!(link[0] & 0x04)". 2915 */ 2916 s = gen_load_a(OR_LINK, 0, BPF_B); 2917 b1 = new_block(JMP(BPF_JSET)); 2918 b1->s.k = 0x04; 2919 b1->stmts = s; 2920 gen_not(b1); 2921 2922 /* 2923 * AND that with the checks for data and management 2924 * frames. 2925 */ 2926 gen_and(b1, b0); 2927 return b0; 2928 2929 case Q_AND: 2930 b0 = gen_wlanhostop(eaddr, Q_SRC); 2931 b1 = gen_wlanhostop(eaddr, Q_DST); 2932 gen_and(b0, b1); 2933 return b1; 2934 2935 case Q_DEFAULT: 2936 case Q_OR: 2937 b0 = gen_wlanhostop(eaddr, Q_SRC); 2938 b1 = gen_wlanhostop(eaddr, Q_DST); 2939 gen_or(b0, b1); 2940 return b1; 2941 } 2942 abort(); 2943 /* NOTREACHED */ 2944 } 2945 2946 /* 2947 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel. 2948 * (We assume that the addresses are IEEE 48-bit MAC addresses, 2949 * as the RFC states.) 2950 */ 2951 static struct block * 2952 gen_ipfchostop(eaddr, dir) 2953 register const u_char *eaddr; 2954 register int dir; 2955 { 2956 register struct block *b0, *b1; 2957 2958 switch (dir) { 2959 case Q_SRC: 2960 return gen_bcmp(OR_LINK, 10, 6, eaddr); 2961 2962 case Q_DST: 2963 return gen_bcmp(OR_LINK, 2, 6, eaddr); 2964 2965 case Q_AND: 2966 b0 = gen_ipfchostop(eaddr, Q_SRC); 2967 b1 = gen_ipfchostop(eaddr, Q_DST); 2968 gen_and(b0, b1); 2969 return b1; 2970 2971 case Q_DEFAULT: 2972 case Q_OR: 2973 b0 = gen_ipfchostop(eaddr, Q_SRC); 2974 b1 = gen_ipfchostop(eaddr, Q_DST); 2975 gen_or(b0, b1); 2976 return b1; 2977 } 2978 abort(); 2979 /* NOTREACHED */ 2980 } 2981 2982 /* 2983 * This is quite tricky because there may be pad bytes in front of the 2984 * DECNET header, and then there are two possible data packet formats that 2985 * carry both src and dst addresses, plus 5 packet types in a format that 2986 * carries only the src node, plus 2 types that use a different format and 2987 * also carry just the src node. 2988 * 2989 * Yuck. 2990 * 2991 * Instead of doing those all right, we just look for data packets with 2992 * 0 or 1 bytes of padding. If you want to look at other packets, that 2993 * will require a lot more hacking. 2994 * 2995 * To add support for filtering on DECNET "areas" (network numbers) 2996 * one would want to add a "mask" argument to this routine. That would 2997 * make the filter even more inefficient, although one could be clever 2998 * and not generate masking instructions if the mask is 0xFFFF. 2999 */ 3000 static struct block * 3001 gen_dnhostop(addr, dir) 3002 bpf_u_int32 addr; 3003 int dir; 3004 { 3005 struct block *b0, *b1, *b2, *tmp; 3006 u_int offset_lh; /* offset if long header is received */ 3007 u_int offset_sh; /* offset if short header is received */ 3008 3009 switch (dir) { 3010 3011 case Q_DST: 3012 offset_sh = 1; /* follows flags */ 3013 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 3014 break; 3015 3016 case Q_SRC: 3017 offset_sh = 3; /* follows flags, dstnode */ 3018 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 3019 break; 3020 3021 case Q_AND: 3022 /* Inefficient because we do our Calvinball dance twice */ 3023 b0 = gen_dnhostop(addr, Q_SRC); 3024 b1 = gen_dnhostop(addr, Q_DST); 3025 gen_and(b0, b1); 3026 return b1; 3027 3028 case Q_OR: 3029 case Q_DEFAULT: 3030 /* Inefficient because we do our Calvinball dance twice */ 3031 b0 = gen_dnhostop(addr, Q_SRC); 3032 b1 = gen_dnhostop(addr, Q_DST); 3033 gen_or(b0, b1); 3034 return b1; 3035 3036 case Q_ISO: 3037 bpf_error("ISO host filtering not implemented"); 3038 3039 default: 3040 abort(); 3041 } 3042 b0 = gen_linktype(ETHERTYPE_DN); 3043 /* Check for pad = 1, long header case */ 3044 tmp = gen_mcmp(OR_NET, 2, BPF_H, 3045 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); 3046 b1 = gen_cmp(OR_NET, 2 + 1 + offset_lh, 3047 BPF_H, (bpf_int32)ntohs(addr)); 3048 gen_and(tmp, b1); 3049 /* Check for pad = 0, long header case */ 3050 tmp = gen_mcmp(OR_NET, 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 3051 b2 = gen_cmp(OR_NET, 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); 3052 gen_and(tmp, b2); 3053 gen_or(b2, b1); 3054 /* Check for pad = 1, short header case */ 3055 tmp = gen_mcmp(OR_NET, 2, BPF_H, 3056 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); 3057 b2 = gen_cmp(OR_NET, 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); 3058 gen_and(tmp, b2); 3059 gen_or(b2, b1); 3060 /* Check for pad = 0, short header case */ 3061 tmp = gen_mcmp(OR_NET, 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 3062 b2 = gen_cmp(OR_NET, 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); 3063 gen_and(tmp, b2); 3064 gen_or(b2, b1); 3065 3066 /* Combine with test for linktype */ 3067 gen_and(b0, b1); 3068 return b1; 3069 } 3070 3071 /* 3072 * Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets; 3073 * test the bottom-of-stack bit, and then check the version number 3074 * field in the IP header. 3075 */ 3076 static struct block * 3077 gen_mpls_linktype(proto) 3078 int proto; 3079 { 3080 struct block *b0, *b1; 3081 3082 switch (proto) { 3083 3084 case Q_IP: 3085 /* match the bottom-of-stack bit */ 3086 b0 = gen_mcmp(OR_NET, -2, BPF_B, 0x01, 0x01); 3087 /* match the IPv4 version number */ 3088 b1 = gen_mcmp(OR_NET, 0, BPF_B, 0x40, 0xf0); 3089 gen_and(b0, b1); 3090 return b1; 3091 3092 case Q_IPV6: 3093 /* match the bottom-of-stack bit */ 3094 b0 = gen_mcmp(OR_NET, -2, BPF_B, 0x01, 0x01); 3095 /* match the IPv4 version number */ 3096 b1 = gen_mcmp(OR_NET, 0, BPF_B, 0x60, 0xf0); 3097 gen_and(b0, b1); 3098 return b1; 3099 3100 default: 3101 abort(); 3102 } 3103 } 3104 3105 static struct block * 3106 gen_host(addr, mask, proto, dir) 3107 bpf_u_int32 addr; 3108 bpf_u_int32 mask; 3109 int proto; 3110 int dir; 3111 { 3112 struct block *b0, *b1; 3113 3114 switch (proto) { 3115 3116 case Q_DEFAULT: 3117 b0 = gen_host(addr, mask, Q_IP, dir); 3118 /* 3119 * Only check for non-IPv4 addresses if we're not 3120 * checking MPLS-encapsulated packets. 3121 */ 3122 if (label_stack_depth == 0) { 3123 b1 = gen_host(addr, mask, Q_ARP, dir); 3124 gen_or(b0, b1); 3125 b0 = gen_host(addr, mask, Q_RARP, dir); 3126 gen_or(b1, b0); 3127 } 3128 return b0; 3129 3130 case Q_IP: 3131 return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 12, 16); 3132 3133 case Q_RARP: 3134 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 14, 24); 3135 3136 case Q_ARP: 3137 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 14, 24); 3138 3139 case Q_TCP: 3140 bpf_error("'tcp' modifier applied to host"); 3141 3142 case Q_SCTP: 3143 bpf_error("'sctp' modifier applied to host"); 3144 3145 case Q_UDP: 3146 bpf_error("'udp' modifier applied to host"); 3147 3148 case Q_ICMP: 3149 bpf_error("'icmp' modifier applied to host"); 3150 3151 case Q_IGMP: 3152 bpf_error("'igmp' modifier applied to host"); 3153 3154 case Q_IGRP: 3155 bpf_error("'igrp' modifier applied to host"); 3156 3157 case Q_PIM: 3158 bpf_error("'pim' modifier applied to host"); 3159 3160 case Q_VRRP: 3161 bpf_error("'vrrp' modifier applied to host"); 3162 3163 case Q_ATALK: 3164 bpf_error("ATALK host filtering not implemented"); 3165 3166 case Q_AARP: 3167 bpf_error("AARP host filtering not implemented"); 3168 3169 case Q_DECNET: 3170 return gen_dnhostop(addr, dir); 3171 3172 case Q_SCA: 3173 bpf_error("SCA host filtering not implemented"); 3174 3175 case Q_LAT: 3176 bpf_error("LAT host filtering not implemented"); 3177 3178 case Q_MOPDL: 3179 bpf_error("MOPDL host filtering not implemented"); 3180 3181 case Q_MOPRC: 3182 bpf_error("MOPRC host filtering not implemented"); 3183 3184 #ifdef INET6 3185 case Q_IPV6: 3186 bpf_error("'ip6' modifier applied to ip host"); 3187 3188 case Q_ICMPV6: 3189 bpf_error("'icmp6' modifier applied to host"); 3190 #endif /* INET6 */ 3191 3192 case Q_AH: 3193 bpf_error("'ah' modifier applied to host"); 3194 3195 case Q_ESP: 3196 bpf_error("'esp' modifier applied to host"); 3197 3198 case Q_ISO: 3199 bpf_error("ISO host filtering not implemented"); 3200 3201 case Q_ESIS: 3202 bpf_error("'esis' modifier applied to host"); 3203 3204 case Q_ISIS: 3205 bpf_error("'isis' modifier applied to host"); 3206 3207 case Q_CLNP: 3208 bpf_error("'clnp' modifier applied to host"); 3209 3210 case Q_STP: 3211 bpf_error("'stp' modifier applied to host"); 3212 3213 case Q_IPX: 3214 bpf_error("IPX host filtering not implemented"); 3215 3216 case Q_NETBEUI: 3217 bpf_error("'netbeui' modifier applied to host"); 3218 3219 case Q_RADIO: 3220 bpf_error("'radio' modifier applied to host"); 3221 3222 default: 3223 abort(); 3224 } 3225 /* NOTREACHED */ 3226 } 3227 3228 #ifdef INET6 3229 static struct block * 3230 gen_host6(addr, mask, proto, dir) 3231 struct in6_addr *addr; 3232 struct in6_addr *mask; 3233 int proto; 3234 int dir; 3235 { 3236 switch (proto) { 3237 3238 case Q_DEFAULT: 3239 return gen_host6(addr, mask, Q_IPV6, dir); 3240 3241 case Q_IP: 3242 bpf_error("'ip' modifier applied to ip6 host"); 3243 3244 case Q_RARP: 3245 bpf_error("'rarp' modifier applied to ip6 host"); 3246 3247 case Q_ARP: 3248 bpf_error("'arp' modifier applied to ip6 host"); 3249 3250 case Q_SCTP: 3251 bpf_error("'sctp' modifier applied to host"); 3252 3253 case Q_TCP: 3254 bpf_error("'tcp' modifier applied to host"); 3255 3256 case Q_UDP: 3257 bpf_error("'udp' modifier applied to host"); 3258 3259 case Q_ICMP: 3260 bpf_error("'icmp' modifier applied to host"); 3261 3262 case Q_IGMP: 3263 bpf_error("'igmp' modifier applied to host"); 3264 3265 case Q_IGRP: 3266 bpf_error("'igrp' modifier applied to host"); 3267 3268 case Q_PIM: 3269 bpf_error("'pim' modifier applied to host"); 3270 3271 case Q_VRRP: 3272 bpf_error("'vrrp' modifier applied to host"); 3273 3274 case Q_ATALK: 3275 bpf_error("ATALK host filtering not implemented"); 3276 3277 case Q_AARP: 3278 bpf_error("AARP host filtering not implemented"); 3279 3280 case Q_DECNET: 3281 bpf_error("'decnet' modifier applied to ip6 host"); 3282 3283 case Q_SCA: 3284 bpf_error("SCA host filtering not implemented"); 3285 3286 case Q_LAT: 3287 bpf_error("LAT host filtering not implemented"); 3288 3289 case Q_MOPDL: 3290 bpf_error("MOPDL host filtering not implemented"); 3291 3292 case Q_MOPRC: 3293 bpf_error("MOPRC host filtering not implemented"); 3294 3295 case Q_IPV6: 3296 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 8, 24); 3297 3298 case Q_ICMPV6: 3299 bpf_error("'icmp6' modifier applied to host"); 3300 3301 case Q_AH: 3302 bpf_error("'ah' modifier applied to host"); 3303 3304 case Q_ESP: 3305 bpf_error("'esp' modifier applied to host"); 3306 3307 case Q_ISO: 3308 bpf_error("ISO host filtering not implemented"); 3309 3310 case Q_ESIS: 3311 bpf_error("'esis' modifier applied to host"); 3312 3313 case Q_ISIS: 3314 bpf_error("'isis' modifier applied to host"); 3315 3316 case Q_CLNP: 3317 bpf_error("'clnp' modifier applied to host"); 3318 3319 case Q_STP: 3320 bpf_error("'stp' modifier applied to host"); 3321 3322 case Q_IPX: 3323 bpf_error("IPX host filtering not implemented"); 3324 3325 case Q_NETBEUI: 3326 bpf_error("'netbeui' modifier applied to host"); 3327 3328 case Q_RADIO: 3329 bpf_error("'radio' modifier applied to host"); 3330 3331 default: 3332 abort(); 3333 } 3334 /* NOTREACHED */ 3335 } 3336 #endif /*INET6*/ 3337 3338 #ifndef INET6 3339 static struct block * 3340 gen_gateway(eaddr, alist, proto, dir) 3341 const u_char *eaddr; 3342 bpf_u_int32 **alist; 3343 int proto; 3344 int dir; 3345 { 3346 struct block *b0, *b1, *tmp; 3347 3348 if (dir != 0) 3349 bpf_error("direction applied to 'gateway'"); 3350 3351 switch (proto) { 3352 case Q_DEFAULT: 3353 case Q_IP: 3354 case Q_ARP: 3355 case Q_RARP: 3356 if (linktype == DLT_EN10MB) 3357 b0 = gen_ehostop(eaddr, Q_OR); 3358 else if (linktype == DLT_FDDI) 3359 b0 = gen_fhostop(eaddr, Q_OR); 3360 else if (linktype == DLT_IEEE802) 3361 b0 = gen_thostop(eaddr, Q_OR); 3362 else if (linktype == DLT_IEEE802_11 || 3363 linktype == DLT_IEEE802_11_RADIO_AVS || 3364 linktype == DLT_IEEE802_11_RADIO || 3365 linktype == DLT_PRISM_HEADER) 3366 b0 = gen_wlanhostop(eaddr, Q_OR); 3367 else if (linktype == DLT_SUNATM && is_lane) { 3368 /* 3369 * Check that the packet doesn't begin with an 3370 * LE Control marker. (We've already generated 3371 * a test for LANE.) 3372 */ 3373 b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 3374 0xFF00); 3375 gen_not(b1); 3376 3377 /* 3378 * Now check the MAC address. 3379 */ 3380 b0 = gen_ehostop(eaddr, Q_OR); 3381 gen_and(b1, b0); 3382 } else if (linktype == DLT_IP_OVER_FC) 3383 b0 = gen_ipfchostop(eaddr, Q_OR); 3384 else 3385 bpf_error( 3386 "'gateway' supported only on ethernet/FDDI/token ring/802.11/Fibre Channel"); 3387 3388 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR); 3389 while (*alist) { 3390 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR); 3391 gen_or(b1, tmp); 3392 b1 = tmp; 3393 } 3394 gen_not(b1); 3395 gen_and(b0, b1); 3396 return b1; 3397 } 3398 bpf_error("illegal modifier of 'gateway'"); 3399 /* NOTREACHED */ 3400 } 3401 #endif 3402 3403 struct block * 3404 gen_proto_abbrev(proto) 3405 int proto; 3406 { 3407 struct block *b0; 3408 struct block *b1; 3409 3410 switch (proto) { 3411 3412 case Q_SCTP: 3413 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT); 3414 #ifdef INET6 3415 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT); 3416 gen_or(b0, b1); 3417 #endif 3418 break; 3419 3420 case Q_TCP: 3421 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT); 3422 #ifdef INET6 3423 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 3424 gen_or(b0, b1); 3425 #endif 3426 break; 3427 3428 case Q_UDP: 3429 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT); 3430 #ifdef INET6 3431 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT); 3432 gen_or(b0, b1); 3433 #endif 3434 break; 3435 3436 case Q_ICMP: 3437 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT); 3438 break; 3439 3440 #ifndef IPPROTO_IGMP 3441 #define IPPROTO_IGMP 2 3442 #endif 3443 3444 case Q_IGMP: 3445 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT); 3446 break; 3447 3448 #ifndef IPPROTO_IGRP 3449 #define IPPROTO_IGRP 9 3450 #endif 3451 case Q_IGRP: 3452 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT); 3453 break; 3454 3455 #ifndef IPPROTO_PIM 3456 #define IPPROTO_PIM 103 3457 #endif 3458 3459 case Q_PIM: 3460 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT); 3461 #ifdef INET6 3462 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 3463 gen_or(b0, b1); 3464 #endif 3465 break; 3466 3467 #ifndef IPPROTO_VRRP 3468 #define IPPROTO_VRRP 112 3469 #endif 3470 3471 case Q_VRRP: 3472 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT); 3473 break; 3474 3475 case Q_IP: 3476 b1 = gen_linktype(ETHERTYPE_IP); 3477 break; 3478 3479 case Q_ARP: 3480 b1 = gen_linktype(ETHERTYPE_ARP); 3481 break; 3482 3483 case Q_RARP: 3484 b1 = gen_linktype(ETHERTYPE_REVARP); 3485 break; 3486 3487 case Q_LINK: 3488 bpf_error("link layer applied in wrong context"); 3489 3490 case Q_ATALK: 3491 b1 = gen_linktype(ETHERTYPE_ATALK); 3492 break; 3493 3494 case Q_AARP: 3495 b1 = gen_linktype(ETHERTYPE_AARP); 3496 break; 3497 3498 case Q_DECNET: 3499 b1 = gen_linktype(ETHERTYPE_DN); 3500 break; 3501 3502 case Q_SCA: 3503 b1 = gen_linktype(ETHERTYPE_SCA); 3504 break; 3505 3506 case Q_LAT: 3507 b1 = gen_linktype(ETHERTYPE_LAT); 3508 break; 3509 3510 case Q_MOPDL: 3511 b1 = gen_linktype(ETHERTYPE_MOPDL); 3512 break; 3513 3514 case Q_MOPRC: 3515 b1 = gen_linktype(ETHERTYPE_MOPRC); 3516 break; 3517 3518 #ifdef INET6 3519 case Q_IPV6: 3520 b1 = gen_linktype(ETHERTYPE_IPV6); 3521 break; 3522 3523 #ifndef IPPROTO_ICMPV6 3524 #define IPPROTO_ICMPV6 58 3525 #endif 3526 case Q_ICMPV6: 3527 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 3528 break; 3529 #endif /* INET6 */ 3530 3531 #ifndef IPPROTO_AH 3532 #define IPPROTO_AH 51 3533 #endif 3534 case Q_AH: 3535 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT); 3536 #ifdef INET6 3537 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT); 3538 gen_or(b0, b1); 3539 #endif 3540 break; 3541 3542 #ifndef IPPROTO_ESP 3543 #define IPPROTO_ESP 50 3544 #endif 3545 case Q_ESP: 3546 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT); 3547 #ifdef INET6 3548 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 3549 gen_or(b0, b1); 3550 #endif 3551 break; 3552 3553 case Q_ISO: 3554 b1 = gen_linktype(LLCSAP_ISONS); 3555 break; 3556 3557 case Q_ESIS: 3558 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT); 3559 break; 3560 3561 case Q_ISIS: 3562 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 3563 break; 3564 3565 case Q_ISIS_L1: /* all IS-IS Level1 PDU-Types */ 3566 b0 = gen_proto(ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 3567 b1 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 3568 gen_or(b0, b1); 3569 b0 = gen_proto(ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 3570 gen_or(b0, b1); 3571 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 3572 gen_or(b0, b1); 3573 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 3574 gen_or(b0, b1); 3575 break; 3576 3577 case Q_ISIS_L2: /* all IS-IS Level2 PDU-Types */ 3578 b0 = gen_proto(ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 3579 b1 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 3580 gen_or(b0, b1); 3581 b0 = gen_proto(ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 3582 gen_or(b0, b1); 3583 b0 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 3584 gen_or(b0, b1); 3585 b0 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 3586 gen_or(b0, b1); 3587 break; 3588 3589 case Q_ISIS_IIH: /* all IS-IS Hello PDU-Types */ 3590 b0 = gen_proto(ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 3591 b1 = gen_proto(ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 3592 gen_or(b0, b1); 3593 b0 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); 3594 gen_or(b0, b1); 3595 break; 3596 3597 case Q_ISIS_LSP: 3598 b0 = gen_proto(ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 3599 b1 = gen_proto(ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 3600 gen_or(b0, b1); 3601 break; 3602 3603 case Q_ISIS_SNP: 3604 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 3605 b1 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 3606 gen_or(b0, b1); 3607 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 3608 gen_or(b0, b1); 3609 b0 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 3610 gen_or(b0, b1); 3611 break; 3612 3613 case Q_ISIS_CSNP: 3614 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 3615 b1 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 3616 gen_or(b0, b1); 3617 break; 3618 3619 case Q_ISIS_PSNP: 3620 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 3621 b1 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 3622 gen_or(b0, b1); 3623 break; 3624 3625 case Q_CLNP: 3626 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT); 3627 break; 3628 3629 case Q_STP: 3630 b1 = gen_linktype(LLCSAP_8021D); 3631 break; 3632 3633 case Q_IPX: 3634 b1 = gen_linktype(LLCSAP_IPX); 3635 break; 3636 3637 case Q_NETBEUI: 3638 b1 = gen_linktype(LLCSAP_NETBEUI); 3639 break; 3640 3641 case Q_RADIO: 3642 bpf_error("'radio' is not a valid protocol type"); 3643 3644 default: 3645 abort(); 3646 } 3647 return b1; 3648 } 3649 3650 static struct block * 3651 gen_ipfrag() 3652 { 3653 struct slist *s; 3654 struct block *b; 3655 3656 /* not ip frag */ 3657 s = gen_load_a(OR_NET, 6, BPF_H); 3658 b = new_block(JMP(BPF_JSET)); 3659 b->s.k = 0x1fff; 3660 b->stmts = s; 3661 gen_not(b); 3662 3663 return b; 3664 } 3665 3666 /* 3667 * Generate a comparison to a port value in the transport-layer header 3668 * at the specified offset from the beginning of that header. 3669 * 3670 * XXX - this handles a variable-length prefix preceding the link-layer 3671 * header, such as the radiotap or AVS radio prefix, but doesn't handle 3672 * variable-length link-layer headers (such as Token Ring or 802.11 3673 * headers). 3674 */ 3675 static struct block * 3676 gen_portatom(off, v) 3677 int off; 3678 bpf_int32 v; 3679 { 3680 return gen_cmp(OR_TRAN_IPV4, off, BPF_H, v); 3681 } 3682 3683 #ifdef INET6 3684 static struct block * 3685 gen_portatom6(off, v) 3686 int off; 3687 bpf_int32 v; 3688 { 3689 return gen_cmp(OR_TRAN_IPV6, off, BPF_H, v); 3690 } 3691 #endif/*INET6*/ 3692 3693 struct block * 3694 gen_portop(port, proto, dir) 3695 int port, proto, dir; 3696 { 3697 struct block *b0, *b1, *tmp; 3698 3699 /* ip proto 'proto' */ 3700 tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto); 3701 b0 = gen_ipfrag(); 3702 gen_and(tmp, b0); 3703 3704 switch (dir) { 3705 case Q_SRC: 3706 b1 = gen_portatom(0, (bpf_int32)port); 3707 break; 3708 3709 case Q_DST: 3710 b1 = gen_portatom(2, (bpf_int32)port); 3711 break; 3712 3713 case Q_OR: 3714 case Q_DEFAULT: 3715 tmp = gen_portatom(0, (bpf_int32)port); 3716 b1 = gen_portatom(2, (bpf_int32)port); 3717 gen_or(tmp, b1); 3718 break; 3719 3720 case Q_AND: 3721 tmp = gen_portatom(0, (bpf_int32)port); 3722 b1 = gen_portatom(2, (bpf_int32)port); 3723 gen_and(tmp, b1); 3724 break; 3725 3726 default: 3727 abort(); 3728 } 3729 gen_and(b0, b1); 3730 3731 return b1; 3732 } 3733 3734 static struct block * 3735 gen_port(port, ip_proto, dir) 3736 int port; 3737 int ip_proto; 3738 int dir; 3739 { 3740 struct block *b0, *b1, *tmp; 3741 3742 /* 3743 * ether proto ip 3744 * 3745 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 3746 * not LLC encapsulation with LLCSAP_IP. 3747 * 3748 * For IEEE 802 networks - which includes 802.5 token ring 3749 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 3750 * says that SNAP encapsulation is used, not LLC encapsulation 3751 * with LLCSAP_IP. 3752 * 3753 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 3754 * RFC 2225 say that SNAP encapsulation is used, not LLC 3755 * encapsulation with LLCSAP_IP. 3756 * 3757 * So we always check for ETHERTYPE_IP. 3758 */ 3759 b0 = gen_linktype(ETHERTYPE_IP); 3760 3761 switch (ip_proto) { 3762 case IPPROTO_UDP: 3763 case IPPROTO_TCP: 3764 case IPPROTO_SCTP: 3765 b1 = gen_portop(port, ip_proto, dir); 3766 break; 3767 3768 case PROTO_UNDEF: 3769 tmp = gen_portop(port, IPPROTO_TCP, dir); 3770 b1 = gen_portop(port, IPPROTO_UDP, dir); 3771 gen_or(tmp, b1); 3772 tmp = gen_portop(port, IPPROTO_SCTP, dir); 3773 gen_or(tmp, b1); 3774 break; 3775 3776 default: 3777 abort(); 3778 } 3779 gen_and(b0, b1); 3780 return b1; 3781 } 3782 3783 #ifdef INET6 3784 struct block * 3785 gen_portop6(port, proto, dir) 3786 int port, proto, dir; 3787 { 3788 struct block *b0, *b1, *tmp; 3789 3790 /* ip6 proto 'proto' */ 3791 b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto); 3792 3793 switch (dir) { 3794 case Q_SRC: 3795 b1 = gen_portatom6(0, (bpf_int32)port); 3796 break; 3797 3798 case Q_DST: 3799 b1 = gen_portatom6(2, (bpf_int32)port); 3800 break; 3801 3802 case Q_OR: 3803 case Q_DEFAULT: 3804 tmp = gen_portatom6(0, (bpf_int32)port); 3805 b1 = gen_portatom6(2, (bpf_int32)port); 3806 gen_or(tmp, b1); 3807 break; 3808 3809 case Q_AND: 3810 tmp = gen_portatom6(0, (bpf_int32)port); 3811 b1 = gen_portatom6(2, (bpf_int32)port); 3812 gen_and(tmp, b1); 3813 break; 3814 3815 default: 3816 abort(); 3817 } 3818 gen_and(b0, b1); 3819 3820 return b1; 3821 } 3822 3823 static struct block * 3824 gen_port6(port, ip_proto, dir) 3825 int port; 3826 int ip_proto; 3827 int dir; 3828 { 3829 struct block *b0, *b1, *tmp; 3830 3831 /* link proto ip6 */ 3832 b0 = gen_linktype(ETHERTYPE_IPV6); 3833 3834 switch (ip_proto) { 3835 case IPPROTO_UDP: 3836 case IPPROTO_TCP: 3837 case IPPROTO_SCTP: 3838 b1 = gen_portop6(port, ip_proto, dir); 3839 break; 3840 3841 case PROTO_UNDEF: 3842 tmp = gen_portop6(port, IPPROTO_TCP, dir); 3843 b1 = gen_portop6(port, IPPROTO_UDP, dir); 3844 gen_or(tmp, b1); 3845 tmp = gen_portop6(port, IPPROTO_SCTP, dir); 3846 gen_or(tmp, b1); 3847 break; 3848 3849 default: 3850 abort(); 3851 } 3852 gen_and(b0, b1); 3853 return b1; 3854 } 3855 #endif /* INET6 */ 3856 3857 /* gen_portrange code */ 3858 static struct block * 3859 gen_portrangeatom(off, v1, v2) 3860 int off; 3861 bpf_int32 v1, v2; 3862 { 3863 struct block *b1, *b2; 3864 3865 if (v1 > v2) { 3866 /* 3867 * Reverse the order of the ports, so v1 is the lower one. 3868 */ 3869 bpf_int32 vtemp; 3870 3871 vtemp = v1; 3872 v1 = v2; 3873 v2 = vtemp; 3874 } 3875 3876 b1 = gen_cmp_ge(OR_TRAN_IPV4, off, BPF_H, v1); 3877 b2 = gen_cmp_le(OR_TRAN_IPV4, off, BPF_H, v2); 3878 3879 gen_and(b1, b2); 3880 3881 return b2; 3882 } 3883 3884 struct block * 3885 gen_portrangeop(port1, port2, proto, dir) 3886 int port1, port2; 3887 int proto; 3888 int dir; 3889 { 3890 struct block *b0, *b1, *tmp; 3891 3892 /* ip proto 'proto' */ 3893 tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto); 3894 b0 = gen_ipfrag(); 3895 gen_and(tmp, b0); 3896 3897 switch (dir) { 3898 case Q_SRC: 3899 b1 = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2); 3900 break; 3901 3902 case Q_DST: 3903 b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2); 3904 break; 3905 3906 case Q_OR: 3907 case Q_DEFAULT: 3908 tmp = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2); 3909 b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2); 3910 gen_or(tmp, b1); 3911 break; 3912 3913 case Q_AND: 3914 tmp = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2); 3915 b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2); 3916 gen_and(tmp, b1); 3917 break; 3918 3919 default: 3920 abort(); 3921 } 3922 gen_and(b0, b1); 3923 3924 return b1; 3925 } 3926 3927 static struct block * 3928 gen_portrange(port1, port2, ip_proto, dir) 3929 int port1, port2; 3930 int ip_proto; 3931 int dir; 3932 { 3933 struct block *b0, *b1, *tmp; 3934 3935 /* link proto ip */ 3936 b0 = gen_linktype(ETHERTYPE_IP); 3937 3938 switch (ip_proto) { 3939 case IPPROTO_UDP: 3940 case IPPROTO_TCP: 3941 case IPPROTO_SCTP: 3942 b1 = gen_portrangeop(port1, port2, ip_proto, dir); 3943 break; 3944 3945 case PROTO_UNDEF: 3946 tmp = gen_portrangeop(port1, port2, IPPROTO_TCP, dir); 3947 b1 = gen_portrangeop(port1, port2, IPPROTO_UDP, dir); 3948 gen_or(tmp, b1); 3949 tmp = gen_portrangeop(port1, port2, IPPROTO_SCTP, dir); 3950 gen_or(tmp, b1); 3951 break; 3952 3953 default: 3954 abort(); 3955 } 3956 gen_and(b0, b1); 3957 return b1; 3958 } 3959 3960 #ifdef INET6 3961 static struct block * 3962 gen_portrangeatom6(off, v1, v2) 3963 int off; 3964 bpf_int32 v1, v2; 3965 { 3966 struct block *b1, *b2; 3967 3968 if (v1 > v2) { 3969 /* 3970 * Reverse the order of the ports, so v1 is the lower one. 3971 */ 3972 bpf_int32 vtemp; 3973 3974 vtemp = v1; 3975 v1 = v2; 3976 v2 = vtemp; 3977 } 3978 3979 b1 = gen_cmp_ge(OR_TRAN_IPV6, off, BPF_H, v1); 3980 b2 = gen_cmp_le(OR_TRAN_IPV6, off, BPF_H, v2); 3981 3982 gen_and(b1, b2); 3983 3984 return b2; 3985 } 3986 3987 struct block * 3988 gen_portrangeop6(port1, port2, proto, dir) 3989 int port1, port2; 3990 int proto; 3991 int dir; 3992 { 3993 struct block *b0, *b1, *tmp; 3994 3995 /* ip6 proto 'proto' */ 3996 b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto); 3997 3998 switch (dir) { 3999 case Q_SRC: 4000 b1 = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2); 4001 break; 4002 4003 case Q_DST: 4004 b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2); 4005 break; 4006 4007 case Q_OR: 4008 case Q_DEFAULT: 4009 tmp = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2); 4010 b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2); 4011 gen_or(tmp, b1); 4012 break; 4013 4014 case Q_AND: 4015 tmp = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2); 4016 b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2); 4017 gen_and(tmp, b1); 4018 break; 4019 4020 default: 4021 abort(); 4022 } 4023 gen_and(b0, b1); 4024 4025 return b1; 4026 } 4027 4028 static struct block * 4029 gen_portrange6(port1, port2, ip_proto, dir) 4030 int port1, port2; 4031 int ip_proto; 4032 int dir; 4033 { 4034 struct block *b0, *b1, *tmp; 4035 4036 /* link proto ip6 */ 4037 b0 = gen_linktype(ETHERTYPE_IPV6); 4038 4039 switch (ip_proto) { 4040 case IPPROTO_UDP: 4041 case IPPROTO_TCP: 4042 case IPPROTO_SCTP: 4043 b1 = gen_portrangeop6(port1, port2, ip_proto, dir); 4044 break; 4045 4046 case PROTO_UNDEF: 4047 tmp = gen_portrangeop6(port1, port2, IPPROTO_TCP, dir); 4048 b1 = gen_portrangeop6(port1, port2, IPPROTO_UDP, dir); 4049 gen_or(tmp, b1); 4050 tmp = gen_portrangeop6(port1, port2, IPPROTO_SCTP, dir); 4051 gen_or(tmp, b1); 4052 break; 4053 4054 default: 4055 abort(); 4056 } 4057 gen_and(b0, b1); 4058 return b1; 4059 } 4060 #endif /* INET6 */ 4061 4062 static int 4063 lookup_proto(name, proto) 4064 register const char *name; 4065 register int proto; 4066 { 4067 register int v; 4068 4069 switch (proto) { 4070 4071 case Q_DEFAULT: 4072 case Q_IP: 4073 case Q_IPV6: 4074 v = pcap_nametoproto(name); 4075 if (v == PROTO_UNDEF) 4076 bpf_error("unknown ip proto '%s'", name); 4077 break; 4078 4079 case Q_LINK: 4080 /* XXX should look up h/w protocol type based on linktype */ 4081 v = pcap_nametoeproto(name); 4082 if (v == PROTO_UNDEF) { 4083 v = pcap_nametollc(name); 4084 if (v == PROTO_UNDEF) 4085 bpf_error("unknown ether proto '%s'", name); 4086 } 4087 break; 4088 4089 case Q_ISO: 4090 if (strcmp(name, "esis") == 0) 4091 v = ISO9542_ESIS; 4092 else if (strcmp(name, "isis") == 0) 4093 v = ISO10589_ISIS; 4094 else if (strcmp(name, "clnp") == 0) 4095 v = ISO8473_CLNP; 4096 else 4097 bpf_error("unknown osi proto '%s'", name); 4098 break; 4099 4100 default: 4101 v = PROTO_UNDEF; 4102 break; 4103 } 4104 return v; 4105 } 4106 4107 #if 0 4108 struct stmt * 4109 gen_joinsp(s, n) 4110 struct stmt **s; 4111 int n; 4112 { 4113 return NULL; 4114 } 4115 #endif 4116 4117 static struct block * 4118 gen_protochain(v, proto, dir) 4119 int v; 4120 int proto; 4121 int dir; 4122 { 4123 #ifdef NO_PROTOCHAIN 4124 return gen_proto(v, proto, dir); 4125 #else 4126 struct block *b0, *b; 4127 struct slist *s[100]; 4128 int fix2, fix3, fix4, fix5; 4129 int ahcheck, again, end; 4130 int i, max; 4131 int reg2 = alloc_reg(); 4132 4133 memset(s, 0, sizeof(s)); 4134 fix2 = fix3 = fix4 = fix5 = 0; 4135 4136 switch (proto) { 4137 case Q_IP: 4138 case Q_IPV6: 4139 break; 4140 case Q_DEFAULT: 4141 b0 = gen_protochain(v, Q_IP, dir); 4142 b = gen_protochain(v, Q_IPV6, dir); 4143 gen_or(b0, b); 4144 return b; 4145 default: 4146 bpf_error("bad protocol applied for 'protochain'"); 4147 /*NOTREACHED*/ 4148 } 4149 4150 /* 4151 * We don't handle variable-length radiotap here headers yet. 4152 * We might want to add BPF instructions to do the protochain 4153 * work, to simplify that and, on platforms that have a BPF 4154 * interpreter with the new instructions, let the filtering 4155 * be done in the kernel. (We already require a modified BPF 4156 * engine to do the protochain stuff, to support backward 4157 * branches, and backward branch support is unlikely to appear 4158 * in kernel BPF engines.) 4159 */ 4160 if (linktype == DLT_IEEE802_11_RADIO) 4161 bpf_error("'protochain' not supported with radiotap headers"); 4162 4163 no_optimize = 1; /*this code is not compatible with optimzer yet */ 4164 4165 /* 4166 * s[0] is a dummy entry to protect other BPF insn from damage 4167 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 4168 * hard to find interdependency made by jump table fixup. 4169 */ 4170 i = 0; 4171 s[i] = new_stmt(0); /*dummy*/ 4172 i++; 4173 4174 switch (proto) { 4175 case Q_IP: 4176 b0 = gen_linktype(ETHERTYPE_IP); 4177 4178 /* A = ip->ip_p */ 4179 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 4180 s[i]->s.k = off_nl + 9; 4181 i++; 4182 /* X = ip->ip_hl << 2 */ 4183 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 4184 s[i]->s.k = off_nl; 4185 i++; 4186 break; 4187 #ifdef INET6 4188 case Q_IPV6: 4189 b0 = gen_linktype(ETHERTYPE_IPV6); 4190 4191 /* A = ip6->ip_nxt */ 4192 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 4193 s[i]->s.k = off_nl + 6; 4194 i++; 4195 /* X = sizeof(struct ip6_hdr) */ 4196 s[i] = new_stmt(BPF_LDX|BPF_IMM); 4197 s[i]->s.k = 40; 4198 i++; 4199 break; 4200 #endif 4201 default: 4202 bpf_error("unsupported proto to gen_protochain"); 4203 /*NOTREACHED*/ 4204 } 4205 4206 /* again: if (A == v) goto end; else fall through; */ 4207 again = i; 4208 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4209 s[i]->s.k = v; 4210 s[i]->s.jt = NULL; /*later*/ 4211 s[i]->s.jf = NULL; /*update in next stmt*/ 4212 fix5 = i; 4213 i++; 4214 4215 #ifndef IPPROTO_NONE 4216 #define IPPROTO_NONE 59 4217 #endif 4218 /* if (A == IPPROTO_NONE) goto end */ 4219 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4220 s[i]->s.jt = NULL; /*later*/ 4221 s[i]->s.jf = NULL; /*update in next stmt*/ 4222 s[i]->s.k = IPPROTO_NONE; 4223 s[fix5]->s.jf = s[i]; 4224 fix2 = i; 4225 i++; 4226 4227 #ifdef INET6 4228 if (proto == Q_IPV6) { 4229 int v6start, v6end, v6advance, j; 4230 4231 v6start = i; 4232 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 4233 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4234 s[i]->s.jt = NULL; /*later*/ 4235 s[i]->s.jf = NULL; /*update in next stmt*/ 4236 s[i]->s.k = IPPROTO_HOPOPTS; 4237 s[fix2]->s.jf = s[i]; 4238 i++; 4239 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 4240 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4241 s[i]->s.jt = NULL; /*later*/ 4242 s[i]->s.jf = NULL; /*update in next stmt*/ 4243 s[i]->s.k = IPPROTO_DSTOPTS; 4244 i++; 4245 /* if (A == IPPROTO_ROUTING) goto v6advance */ 4246 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4247 s[i]->s.jt = NULL; /*later*/ 4248 s[i]->s.jf = NULL; /*update in next stmt*/ 4249 s[i]->s.k = IPPROTO_ROUTING; 4250 i++; 4251 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 4252 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4253 s[i]->s.jt = NULL; /*later*/ 4254 s[i]->s.jf = NULL; /*later*/ 4255 s[i]->s.k = IPPROTO_FRAGMENT; 4256 fix3 = i; 4257 v6end = i; 4258 i++; 4259 4260 /* v6advance: */ 4261 v6advance = i; 4262 4263 /* 4264 * in short, 4265 * A = P[X]; 4266 * X = X + (P[X + 1] + 1) * 8; 4267 */ 4268 /* A = X */ 4269 s[i] = new_stmt(BPF_MISC|BPF_TXA); 4270 i++; 4271 /* A = P[X + packet head] */ 4272 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 4273 s[i]->s.k = off_nl; 4274 i++; 4275 /* MEM[reg2] = A */ 4276 s[i] = new_stmt(BPF_ST); 4277 s[i]->s.k = reg2; 4278 i++; 4279 /* A = X */ 4280 s[i] = new_stmt(BPF_MISC|BPF_TXA); 4281 i++; 4282 /* A += 1 */ 4283 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 4284 s[i]->s.k = 1; 4285 i++; 4286 /* X = A */ 4287 s[i] = new_stmt(BPF_MISC|BPF_TAX); 4288 i++; 4289 /* A = P[X + packet head]; */ 4290 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 4291 s[i]->s.k = off_nl; 4292 i++; 4293 /* A += 1 */ 4294 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 4295 s[i]->s.k = 1; 4296 i++; 4297 /* A *= 8 */ 4298 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 4299 s[i]->s.k = 8; 4300 i++; 4301 /* X = A; */ 4302 s[i] = new_stmt(BPF_MISC|BPF_TAX); 4303 i++; 4304 /* A = MEM[reg2] */ 4305 s[i] = new_stmt(BPF_LD|BPF_MEM); 4306 s[i]->s.k = reg2; 4307 i++; 4308 4309 /* goto again; (must use BPF_JA for backward jump) */ 4310 s[i] = new_stmt(BPF_JMP|BPF_JA); 4311 s[i]->s.k = again - i - 1; 4312 s[i - 1]->s.jf = s[i]; 4313 i++; 4314 4315 /* fixup */ 4316 for (j = v6start; j <= v6end; j++) 4317 s[j]->s.jt = s[v6advance]; 4318 } else 4319 #endif 4320 { 4321 /* nop */ 4322 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 4323 s[i]->s.k = 0; 4324 s[fix2]->s.jf = s[i]; 4325 i++; 4326 } 4327 4328 /* ahcheck: */ 4329 ahcheck = i; 4330 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 4331 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 4332 s[i]->s.jt = NULL; /*later*/ 4333 s[i]->s.jf = NULL; /*later*/ 4334 s[i]->s.k = IPPROTO_AH; 4335 if (fix3) 4336 s[fix3]->s.jf = s[ahcheck]; 4337 fix4 = i; 4338 i++; 4339 4340 /* 4341 * in short, 4342 * A = P[X]; 4343 * X = X + (P[X + 1] + 2) * 4; 4344 */ 4345 /* A = X */ 4346 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 4347 i++; 4348 /* A = P[X + packet head]; */ 4349 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 4350 s[i]->s.k = off_nl; 4351 i++; 4352 /* MEM[reg2] = A */ 4353 s[i] = new_stmt(BPF_ST); 4354 s[i]->s.k = reg2; 4355 i++; 4356 /* A = X */ 4357 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 4358 i++; 4359 /* A += 1 */ 4360 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 4361 s[i]->s.k = 1; 4362 i++; 4363 /* X = A */ 4364 s[i] = new_stmt(BPF_MISC|BPF_TAX); 4365 i++; 4366 /* A = P[X + packet head] */ 4367 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 4368 s[i]->s.k = off_nl; 4369 i++; 4370 /* A += 2 */ 4371 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 4372 s[i]->s.k = 2; 4373 i++; 4374 /* A *= 4 */ 4375 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 4376 s[i]->s.k = 4; 4377 i++; 4378 /* X = A; */ 4379 s[i] = new_stmt(BPF_MISC|BPF_TAX); 4380 i++; 4381 /* A = MEM[reg2] */ 4382 s[i] = new_stmt(BPF_LD|BPF_MEM); 4383 s[i]->s.k = reg2; 4384 i++; 4385 4386 /* goto again; (must use BPF_JA for backward jump) */ 4387 s[i] = new_stmt(BPF_JMP|BPF_JA); 4388 s[i]->s.k = again - i - 1; 4389 i++; 4390 4391 /* end: nop */ 4392 end = i; 4393 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 4394 s[i]->s.k = 0; 4395 s[fix2]->s.jt = s[end]; 4396 s[fix4]->s.jf = s[end]; 4397 s[fix5]->s.jt = s[end]; 4398 i++; 4399 4400 /* 4401 * make slist chain 4402 */ 4403 max = i; 4404 for (i = 0; i < max - 1; i++) 4405 s[i]->next = s[i + 1]; 4406 s[max - 1]->next = NULL; 4407 4408 /* 4409 * emit final check 4410 */ 4411 b = new_block(JMP(BPF_JEQ)); 4412 b->stmts = s[1]; /*remember, s[0] is dummy*/ 4413 b->s.k = v; 4414 4415 free_reg(reg2); 4416 4417 gen_and(b0, b); 4418 return b; 4419 #endif 4420 } 4421 4422 /* 4423 * Generate code that checks whether the packet is a packet for protocol 4424 * <proto> and whether the type field in that protocol's header has 4425 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an 4426 * IP packet and checks the protocol number in the IP header against <v>. 4427 * 4428 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks 4429 * against Q_IP and Q_IPV6. 4430 */ 4431 static struct block * 4432 gen_proto(v, proto, dir) 4433 int v; 4434 int proto; 4435 int dir; 4436 { 4437 struct block *b0, *b1; 4438 4439 if (dir != Q_DEFAULT) 4440 bpf_error("direction applied to 'proto'"); 4441 4442 switch (proto) { 4443 case Q_DEFAULT: 4444 #ifdef INET6 4445 b0 = gen_proto(v, Q_IP, dir); 4446 b1 = gen_proto(v, Q_IPV6, dir); 4447 gen_or(b0, b1); 4448 return b1; 4449 #else 4450 /*FALLTHROUGH*/ 4451 #endif 4452 case Q_IP: 4453 /* 4454 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 4455 * not LLC encapsulation with LLCSAP_IP. 4456 * 4457 * For IEEE 802 networks - which includes 802.5 token ring 4458 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 4459 * says that SNAP encapsulation is used, not LLC encapsulation 4460 * with LLCSAP_IP. 4461 * 4462 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 4463 * RFC 2225 say that SNAP encapsulation is used, not LLC 4464 * encapsulation with LLCSAP_IP. 4465 * 4466 * So we always check for ETHERTYPE_IP. 4467 */ 4468 4469 b0 = gen_linktype(ETHERTYPE_IP); 4470 #ifndef CHASE_CHAIN 4471 b1 = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)v); 4472 #else 4473 b1 = gen_protochain(v, Q_IP); 4474 #endif 4475 gen_and(b0, b1); 4476 return b1; 4477 4478 case Q_ISO: 4479 switch (linktype) { 4480 4481 case DLT_FRELAY: 4482 /* 4483 * Frame Relay packets typically have an OSI 4484 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)" 4485 * generates code to check for all the OSI 4486 * NLPIDs, so calling it and then adding a check 4487 * for the particular NLPID for which we're 4488 * looking is bogus, as we can just check for 4489 * the NLPID. 4490 * 4491 * What we check for is the NLPID and a frame 4492 * control field value of UI, i.e. 0x03 followed 4493 * by the NLPID. 4494 * 4495 * XXX - assumes a 2-byte Frame Relay header with 4496 * DLCI and flags. What if the address is longer? 4497 * 4498 * XXX - what about SNAP-encapsulated frames? 4499 */ 4500 return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | v); 4501 /*NOTREACHED*/ 4502 break; 4503 4504 case DLT_C_HDLC: 4505 /* 4506 * Cisco uses an Ethertype lookalike - for OSI, 4507 * it's 0xfefe. 4508 */ 4509 b0 = gen_linktype(LLCSAP_ISONS<<8 | LLCSAP_ISONS); 4510 /* OSI in C-HDLC is stuffed with a fudge byte */ 4511 b1 = gen_cmp(OR_NET_NOSNAP, 1, BPF_B, (long)v); 4512 gen_and(b0, b1); 4513 return b1; 4514 4515 default: 4516 b0 = gen_linktype(LLCSAP_ISONS); 4517 b1 = gen_cmp(OR_NET_NOSNAP, 0, BPF_B, (long)v); 4518 gen_and(b0, b1); 4519 return b1; 4520 } 4521 4522 case Q_ISIS: 4523 b0 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 4524 /* 4525 * 4 is the offset of the PDU type relative to the IS-IS 4526 * header. 4527 */ 4528 b1 = gen_cmp(OR_NET_NOSNAP, 4, BPF_B, (long)v); 4529 gen_and(b0, b1); 4530 return b1; 4531 4532 case Q_ARP: 4533 bpf_error("arp does not encapsulate another protocol"); 4534 /* NOTREACHED */ 4535 4536 case Q_RARP: 4537 bpf_error("rarp does not encapsulate another protocol"); 4538 /* NOTREACHED */ 4539 4540 case Q_ATALK: 4541 bpf_error("atalk encapsulation is not specifiable"); 4542 /* NOTREACHED */ 4543 4544 case Q_DECNET: 4545 bpf_error("decnet encapsulation is not specifiable"); 4546 /* NOTREACHED */ 4547 4548 case Q_SCA: 4549 bpf_error("sca does not encapsulate another protocol"); 4550 /* NOTREACHED */ 4551 4552 case Q_LAT: 4553 bpf_error("lat does not encapsulate another protocol"); 4554 /* NOTREACHED */ 4555 4556 case Q_MOPRC: 4557 bpf_error("moprc does not encapsulate another protocol"); 4558 /* NOTREACHED */ 4559 4560 case Q_MOPDL: 4561 bpf_error("mopdl does not encapsulate another protocol"); 4562 /* NOTREACHED */ 4563 4564 case Q_LINK: 4565 return gen_linktype(v); 4566 4567 case Q_UDP: 4568 bpf_error("'udp proto' is bogus"); 4569 /* NOTREACHED */ 4570 4571 case Q_TCP: 4572 bpf_error("'tcp proto' is bogus"); 4573 /* NOTREACHED */ 4574 4575 case Q_SCTP: 4576 bpf_error("'sctp proto' is bogus"); 4577 /* NOTREACHED */ 4578 4579 case Q_ICMP: 4580 bpf_error("'icmp proto' is bogus"); 4581 /* NOTREACHED */ 4582 4583 case Q_IGMP: 4584 bpf_error("'igmp proto' is bogus"); 4585 /* NOTREACHED */ 4586 4587 case Q_IGRP: 4588 bpf_error("'igrp proto' is bogus"); 4589 /* NOTREACHED */ 4590 4591 case Q_PIM: 4592 bpf_error("'pim proto' is bogus"); 4593 /* NOTREACHED */ 4594 4595 case Q_VRRP: 4596 bpf_error("'vrrp proto' is bogus"); 4597 /* NOTREACHED */ 4598 4599 #ifdef INET6 4600 case Q_IPV6: 4601 b0 = gen_linktype(ETHERTYPE_IPV6); 4602 #ifndef CHASE_CHAIN 4603 b1 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)v); 4604 #else 4605 b1 = gen_protochain(v, Q_IPV6); 4606 #endif 4607 gen_and(b0, b1); 4608 return b1; 4609 4610 case Q_ICMPV6: 4611 bpf_error("'icmp6 proto' is bogus"); 4612 #endif /* INET6 */ 4613 4614 case Q_AH: 4615 bpf_error("'ah proto' is bogus"); 4616 4617 case Q_ESP: 4618 bpf_error("'ah proto' is bogus"); 4619 4620 case Q_STP: 4621 bpf_error("'stp proto' is bogus"); 4622 4623 case Q_IPX: 4624 bpf_error("'ipx proto' is bogus"); 4625 4626 case Q_NETBEUI: 4627 bpf_error("'netbeui proto' is bogus"); 4628 4629 case Q_RADIO: 4630 bpf_error("'radio proto' is bogus"); 4631 4632 default: 4633 abort(); 4634 /* NOTREACHED */ 4635 } 4636 /* NOTREACHED */ 4637 } 4638 4639 struct block * 4640 gen_scode(name, q) 4641 register const char *name; 4642 struct qual q; 4643 { 4644 int proto = q.proto; 4645 int dir = q.dir; 4646 int tproto; 4647 u_char *eaddr; 4648 bpf_u_int32 mask, addr; 4649 #ifndef INET6 4650 bpf_u_int32 **alist; 4651 #else 4652 int tproto6; 4653 struct sockaddr_in *sin; 4654 struct sockaddr_in6 *sin6; 4655 struct addrinfo *res, *res0; 4656 struct in6_addr mask128; 4657 #endif /*INET6*/ 4658 struct block *b, *tmp; 4659 int port, real_proto; 4660 int port1, port2; 4661 4662 switch (q.addr) { 4663 4664 case Q_NET: 4665 addr = pcap_nametonetaddr(name); 4666 if (addr == 0) 4667 bpf_error("unknown network '%s'", name); 4668 /* Left justify network addr and calculate its network mask */ 4669 mask = 0xffffffff; 4670 while (addr && (addr & 0xff000000) == 0) { 4671 addr <<= 8; 4672 mask <<= 8; 4673 } 4674 return gen_host(addr, mask, proto, dir); 4675 4676 case Q_DEFAULT: 4677 case Q_HOST: 4678 if (proto == Q_LINK) { 4679 switch (linktype) { 4680 4681 case DLT_EN10MB: 4682 eaddr = pcap_ether_hostton(name); 4683 if (eaddr == NULL) 4684 bpf_error( 4685 "unknown ether host '%s'", name); 4686 b = gen_ehostop(eaddr, dir); 4687 free(eaddr); 4688 return b; 4689 4690 case DLT_FDDI: 4691 eaddr = pcap_ether_hostton(name); 4692 if (eaddr == NULL) 4693 bpf_error( 4694 "unknown FDDI host '%s'", name); 4695 b = gen_fhostop(eaddr, dir); 4696 free(eaddr); 4697 return b; 4698 4699 case DLT_IEEE802: 4700 eaddr = pcap_ether_hostton(name); 4701 if (eaddr == NULL) 4702 bpf_error( 4703 "unknown token ring host '%s'", name); 4704 b = gen_thostop(eaddr, dir); 4705 free(eaddr); 4706 return b; 4707 4708 case DLT_IEEE802_11: 4709 case DLT_IEEE802_11_RADIO_AVS: 4710 case DLT_IEEE802_11_RADIO: 4711 case DLT_PRISM_HEADER: 4712 eaddr = pcap_ether_hostton(name); 4713 if (eaddr == NULL) 4714 bpf_error( 4715 "unknown 802.11 host '%s'", name); 4716 b = gen_wlanhostop(eaddr, dir); 4717 free(eaddr); 4718 return b; 4719 4720 case DLT_IP_OVER_FC: 4721 eaddr = pcap_ether_hostton(name); 4722 if (eaddr == NULL) 4723 bpf_error( 4724 "unknown Fibre Channel host '%s'", name); 4725 b = gen_ipfchostop(eaddr, dir); 4726 free(eaddr); 4727 return b; 4728 4729 case DLT_SUNATM: 4730 if (!is_lane) 4731 break; 4732 4733 /* 4734 * Check that the packet doesn't begin 4735 * with an LE Control marker. (We've 4736 * already generated a test for LANE.) 4737 */ 4738 tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, 4739 BPF_H, 0xFF00); 4740 gen_not(tmp); 4741 4742 eaddr = pcap_ether_hostton(name); 4743 if (eaddr == NULL) 4744 bpf_error( 4745 "unknown ether host '%s'", name); 4746 b = gen_ehostop(eaddr, dir); 4747 gen_and(tmp, b); 4748 free(eaddr); 4749 return b; 4750 } 4751 4752 bpf_error("only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name"); 4753 } else if (proto == Q_DECNET) { 4754 unsigned short dn_addr = __pcap_nametodnaddr(name); 4755 /* 4756 * I don't think DECNET hosts can be multihomed, so 4757 * there is no need to build up a list of addresses 4758 */ 4759 return (gen_host(dn_addr, 0, proto, dir)); 4760 } else { 4761 #ifndef INET6 4762 alist = pcap_nametoaddr(name); 4763 if (alist == NULL || *alist == NULL) 4764 bpf_error("unknown host '%s'", name); 4765 tproto = proto; 4766 if (off_linktype == (u_int)-1 && tproto == Q_DEFAULT) 4767 tproto = Q_IP; 4768 b = gen_host(**alist++, 0xffffffff, tproto, dir); 4769 while (*alist) { 4770 tmp = gen_host(**alist++, 0xffffffff, 4771 tproto, dir); 4772 gen_or(b, tmp); 4773 b = tmp; 4774 } 4775 return b; 4776 #else 4777 memset(&mask128, 0xff, sizeof(mask128)); 4778 res0 = res = pcap_nametoaddrinfo(name); 4779 if (res == NULL) 4780 bpf_error("unknown host '%s'", name); 4781 b = tmp = NULL; 4782 tproto = tproto6 = proto; 4783 if (off_linktype == -1 && tproto == Q_DEFAULT) { 4784 tproto = Q_IP; 4785 tproto6 = Q_IPV6; 4786 } 4787 for (res = res0; res; res = res->ai_next) { 4788 switch (res->ai_family) { 4789 case AF_INET: 4790 if (tproto == Q_IPV6) 4791 continue; 4792 4793 sin = (struct sockaddr_in *) 4794 res->ai_addr; 4795 tmp = gen_host(ntohl(sin->sin_addr.s_addr), 4796 0xffffffff, tproto, dir); 4797 break; 4798 case AF_INET6: 4799 if (tproto6 == Q_IP) 4800 continue; 4801 4802 sin6 = (struct sockaddr_in6 *) 4803 res->ai_addr; 4804 tmp = gen_host6(&sin6->sin6_addr, 4805 &mask128, tproto6, dir); 4806 break; 4807 default: 4808 continue; 4809 } 4810 if (b) 4811 gen_or(b, tmp); 4812 b = tmp; 4813 } 4814 freeaddrinfo(res0); 4815 if (b == NULL) { 4816 bpf_error("unknown host '%s'%s", name, 4817 (proto == Q_DEFAULT) 4818 ? "" 4819 : " for specified address family"); 4820 } 4821 return b; 4822 #endif /*INET6*/ 4823 } 4824 4825 case Q_PORT: 4826 if (proto != Q_DEFAULT && 4827 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 4828 bpf_error("illegal qualifier of 'port'"); 4829 if (pcap_nametoport(name, &port, &real_proto) == 0) 4830 bpf_error("unknown port '%s'", name); 4831 if (proto == Q_UDP) { 4832 if (real_proto == IPPROTO_TCP) 4833 bpf_error("port '%s' is tcp", name); 4834 else if (real_proto == IPPROTO_SCTP) 4835 bpf_error("port '%s' is sctp", name); 4836 else 4837 /* override PROTO_UNDEF */ 4838 real_proto = IPPROTO_UDP; 4839 } 4840 if (proto == Q_TCP) { 4841 if (real_proto == IPPROTO_UDP) 4842 bpf_error("port '%s' is udp", name); 4843 4844 else if (real_proto == IPPROTO_SCTP) 4845 bpf_error("port '%s' is sctp", name); 4846 else 4847 /* override PROTO_UNDEF */ 4848 real_proto = IPPROTO_TCP; 4849 } 4850 if (proto == Q_SCTP) { 4851 if (real_proto == IPPROTO_UDP) 4852 bpf_error("port '%s' is udp", name); 4853 4854 else if (real_proto == IPPROTO_TCP) 4855 bpf_error("port '%s' is tcp", name); 4856 else 4857 /* override PROTO_UNDEF */ 4858 real_proto = IPPROTO_SCTP; 4859 } 4860 #ifndef INET6 4861 return gen_port(port, real_proto, dir); 4862 #else 4863 { 4864 struct block *b; 4865 b = gen_port(port, real_proto, dir); 4866 gen_or(gen_port6(port, real_proto, dir), b); 4867 return b; 4868 } 4869 #endif /* INET6 */ 4870 4871 case Q_PORTRANGE: 4872 if (proto != Q_DEFAULT && 4873 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 4874 bpf_error("illegal qualifier of 'portrange'"); 4875 if (pcap_nametoportrange(name, &port1, &port2, &real_proto) == 0) 4876 bpf_error("unknown port in range '%s'", name); 4877 if (proto == Q_UDP) { 4878 if (real_proto == IPPROTO_TCP) 4879 bpf_error("port in range '%s' is tcp", name); 4880 else if (real_proto == IPPROTO_SCTP) 4881 bpf_error("port in range '%s' is sctp", name); 4882 else 4883 /* override PROTO_UNDEF */ 4884 real_proto = IPPROTO_UDP; 4885 } 4886 if (proto == Q_TCP) { 4887 if (real_proto == IPPROTO_UDP) 4888 bpf_error("port in range '%s' is udp", name); 4889 else if (real_proto == IPPROTO_SCTP) 4890 bpf_error("port in range '%s' is sctp", name); 4891 else 4892 /* override PROTO_UNDEF */ 4893 real_proto = IPPROTO_TCP; 4894 } 4895 if (proto == Q_SCTP) { 4896 if (real_proto == IPPROTO_UDP) 4897 bpf_error("port in range '%s' is udp", name); 4898 else if (real_proto == IPPROTO_TCP) 4899 bpf_error("port in range '%s' is tcp", name); 4900 else 4901 /* override PROTO_UNDEF */ 4902 real_proto = IPPROTO_SCTP; 4903 } 4904 #ifndef INET6 4905 return gen_portrange(port1, port2, real_proto, dir); 4906 #else 4907 { 4908 struct block *b; 4909 b = gen_portrange(port1, port2, real_proto, dir); 4910 gen_or(gen_portrange6(port1, port2, real_proto, dir), b); 4911 return b; 4912 } 4913 #endif /* INET6 */ 4914 4915 case Q_GATEWAY: 4916 #ifndef INET6 4917 eaddr = pcap_ether_hostton(name); 4918 if (eaddr == NULL) 4919 bpf_error("unknown ether host: %s", name); 4920 4921 alist = pcap_nametoaddr(name); 4922 if (alist == NULL || *alist == NULL) 4923 bpf_error("unknown host '%s'", name); 4924 b = gen_gateway(eaddr, alist, proto, dir); 4925 free(eaddr); 4926 return b; 4927 #else 4928 bpf_error("'gateway' not supported in this configuration"); 4929 #endif /*INET6*/ 4930 4931 case Q_PROTO: 4932 real_proto = lookup_proto(name, proto); 4933 if (real_proto >= 0) 4934 return gen_proto(real_proto, proto, dir); 4935 else 4936 bpf_error("unknown protocol: %s", name); 4937 4938 case Q_PROTOCHAIN: 4939 real_proto = lookup_proto(name, proto); 4940 if (real_proto >= 0) 4941 return gen_protochain(real_proto, proto, dir); 4942 else 4943 bpf_error("unknown protocol: %s", name); 4944 4945 4946 case Q_UNDEF: 4947 syntax(); 4948 /* NOTREACHED */ 4949 } 4950 abort(); 4951 /* NOTREACHED */ 4952 } 4953 4954 struct block * 4955 gen_mcode(s1, s2, masklen, q) 4956 register const char *s1, *s2; 4957 register int masklen; 4958 struct qual q; 4959 { 4960 register int nlen, mlen; 4961 bpf_u_int32 n, m; 4962 4963 nlen = __pcap_atoin(s1, &n); 4964 /* Promote short ipaddr */ 4965 n <<= 32 - nlen; 4966 4967 if (s2 != NULL) { 4968 mlen = __pcap_atoin(s2, &m); 4969 /* Promote short ipaddr */ 4970 m <<= 32 - mlen; 4971 if ((n & ~m) != 0) 4972 bpf_error("non-network bits set in \"%s mask %s\"", 4973 s1, s2); 4974 } else { 4975 /* Convert mask len to mask */ 4976 if (masklen > 32) 4977 bpf_error("mask length must be <= 32"); 4978 m = 0xffffffff << (32 - masklen); 4979 if ((n & ~m) != 0) 4980 bpf_error("non-network bits set in \"%s/%d\"", 4981 s1, masklen); 4982 } 4983 4984 switch (q.addr) { 4985 4986 case Q_NET: 4987 return gen_host(n, m, q.proto, q.dir); 4988 4989 default: 4990 bpf_error("Mask syntax for networks only"); 4991 /* NOTREACHED */ 4992 } 4993 /* NOTREACHED */ 4994 } 4995 4996 struct block * 4997 gen_ncode(s, v, q) 4998 register const char *s; 4999 bpf_u_int32 v; 5000 struct qual q; 5001 { 5002 bpf_u_int32 mask; 5003 int proto = q.proto; 5004 int dir = q.dir; 5005 register int vlen; 5006 5007 if (s == NULL) 5008 vlen = 32; 5009 else if (q.proto == Q_DECNET) 5010 vlen = __pcap_atodn(s, &v); 5011 else 5012 vlen = __pcap_atoin(s, &v); 5013 5014 switch (q.addr) { 5015 5016 case Q_DEFAULT: 5017 case Q_HOST: 5018 case Q_NET: 5019 if (proto == Q_DECNET) 5020 return gen_host(v, 0, proto, dir); 5021 else if (proto == Q_LINK) { 5022 bpf_error("illegal link layer address"); 5023 } else { 5024 mask = 0xffffffff; 5025 if (s == NULL && q.addr == Q_NET) { 5026 /* Promote short net number */ 5027 while (v && (v & 0xff000000) == 0) { 5028 v <<= 8; 5029 mask <<= 8; 5030 } 5031 } else { 5032 /* Promote short ipaddr */ 5033 v <<= 32 - vlen; 5034 mask <<= 32 - vlen; 5035 } 5036 return gen_host(v, mask, proto, dir); 5037 } 5038 5039 case Q_PORT: 5040 if (proto == Q_UDP) 5041 proto = IPPROTO_UDP; 5042 else if (proto == Q_TCP) 5043 proto = IPPROTO_TCP; 5044 else if (proto == Q_SCTP) 5045 proto = IPPROTO_SCTP; 5046 else if (proto == Q_DEFAULT) 5047 proto = PROTO_UNDEF; 5048 else 5049 bpf_error("illegal qualifier of 'port'"); 5050 5051 #ifndef INET6 5052 return gen_port((int)v, proto, dir); 5053 #else 5054 { 5055 struct block *b; 5056 b = gen_port((int)v, proto, dir); 5057 gen_or(gen_port6((int)v, proto, dir), b); 5058 return b; 5059 } 5060 #endif /* INET6 */ 5061 5062 case Q_PORTRANGE: 5063 if (proto == Q_UDP) 5064 proto = IPPROTO_UDP; 5065 else if (proto == Q_TCP) 5066 proto = IPPROTO_TCP; 5067 else if (proto == Q_SCTP) 5068 proto = IPPROTO_SCTP; 5069 else if (proto == Q_DEFAULT) 5070 proto = PROTO_UNDEF; 5071 else 5072 bpf_error("illegal qualifier of 'portrange'"); 5073 5074 #ifndef INET6 5075 return gen_portrange((int)v, (int)v, proto, dir); 5076 #else 5077 { 5078 struct block *b; 5079 b = gen_portrange((int)v, (int)v, proto, dir); 5080 gen_or(gen_portrange6((int)v, (int)v, proto, dir), b); 5081 return b; 5082 } 5083 #endif /* INET6 */ 5084 5085 case Q_GATEWAY: 5086 bpf_error("'gateway' requires a name"); 5087 /* NOTREACHED */ 5088 5089 case Q_PROTO: 5090 return gen_proto((int)v, proto, dir); 5091 5092 case Q_PROTOCHAIN: 5093 return gen_protochain((int)v, proto, dir); 5094 5095 case Q_UNDEF: 5096 syntax(); 5097 /* NOTREACHED */ 5098 5099 default: 5100 abort(); 5101 /* NOTREACHED */ 5102 } 5103 /* NOTREACHED */ 5104 } 5105 5106 #ifdef INET6 5107 struct block * 5108 gen_mcode6(s1, s2, masklen, q) 5109 register const char *s1, *s2; 5110 register int masklen; 5111 struct qual q; 5112 { 5113 struct addrinfo *res; 5114 struct in6_addr *addr; 5115 struct in6_addr mask; 5116 struct block *b; 5117 u_int32_t *a, *m; 5118 5119 if (s2) 5120 bpf_error("no mask %s supported", s2); 5121 5122 res = pcap_nametoaddrinfo(s1); 5123 if (!res) 5124 bpf_error("invalid ip6 address %s", s1); 5125 if (res->ai_next) 5126 bpf_error("%s resolved to multiple address", s1); 5127 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 5128 5129 if (sizeof(mask) * 8 < masklen) 5130 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8)); 5131 memset(&mask, 0, sizeof(mask)); 5132 memset(&mask, 0xff, masklen / 8); 5133 if (masklen % 8) { 5134 mask.s6_addr[masklen / 8] = 5135 (0xff << (8 - masklen % 8)) & 0xff; 5136 } 5137 5138 a = (u_int32_t *)addr; 5139 m = (u_int32_t *)&mask; 5140 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 5141 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 5142 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen); 5143 } 5144 5145 switch (q.addr) { 5146 5147 case Q_DEFAULT: 5148 case Q_HOST: 5149 if (masklen != 128) 5150 bpf_error("Mask syntax for networks only"); 5151 /* FALLTHROUGH */ 5152 5153 case Q_NET: 5154 b = gen_host6(addr, &mask, q.proto, q.dir); 5155 freeaddrinfo(res); 5156 return b; 5157 5158 default: 5159 bpf_error("invalid qualifier against IPv6 address"); 5160 /* NOTREACHED */ 5161 } 5162 } 5163 #endif /*INET6*/ 5164 5165 struct block * 5166 gen_ecode(eaddr, q) 5167 register const u_char *eaddr; 5168 struct qual q; 5169 { 5170 struct block *b, *tmp; 5171 5172 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 5173 if (linktype == DLT_EN10MB) 5174 return gen_ehostop(eaddr, (int)q.dir); 5175 if (linktype == DLT_FDDI) 5176 return gen_fhostop(eaddr, (int)q.dir); 5177 if (linktype == DLT_IEEE802) 5178 return gen_thostop(eaddr, (int)q.dir); 5179 if (linktype == DLT_IEEE802_11 || 5180 linktype == DLT_IEEE802_11_RADIO_AVS || 5181 linktype == DLT_IEEE802_11_RADIO || 5182 linktype == DLT_PRISM_HEADER) 5183 return gen_wlanhostop(eaddr, (int)q.dir); 5184 if (linktype == DLT_SUNATM && is_lane) { 5185 /* 5186 * Check that the packet doesn't begin with an 5187 * LE Control marker. (We've already generated 5188 * a test for LANE.) 5189 */ 5190 tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 5191 0xFF00); 5192 gen_not(tmp); 5193 5194 /* 5195 * Now check the MAC address. 5196 */ 5197 b = gen_ehostop(eaddr, (int)q.dir); 5198 gen_and(tmp, b); 5199 return b; 5200 } 5201 if (linktype == DLT_IP_OVER_FC) 5202 return gen_ipfchostop(eaddr, (int)q.dir); 5203 bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 5204 } 5205 bpf_error("ethernet address used in non-ether expression"); 5206 /* NOTREACHED */ 5207 } 5208 5209 void 5210 sappend(s0, s1) 5211 struct slist *s0, *s1; 5212 { 5213 /* 5214 * This is definitely not the best way to do this, but the 5215 * lists will rarely get long. 5216 */ 5217 while (s0->next) 5218 s0 = s0->next; 5219 s0->next = s1; 5220 } 5221 5222 static struct slist * 5223 xfer_to_x(a) 5224 struct arth *a; 5225 { 5226 struct slist *s; 5227 5228 s = new_stmt(BPF_LDX|BPF_MEM); 5229 s->s.k = a->regno; 5230 return s; 5231 } 5232 5233 static struct slist * 5234 xfer_to_a(a) 5235 struct arth *a; 5236 { 5237 struct slist *s; 5238 5239 s = new_stmt(BPF_LD|BPF_MEM); 5240 s->s.k = a->regno; 5241 return s; 5242 } 5243 5244 /* 5245 * Modify "index" to use the value stored into its register as an 5246 * offset relative to the beginning of the header for the protocol 5247 * "proto", and allocate a register and put an item "size" bytes long 5248 * (1, 2, or 4) at that offset into that register, making it the register 5249 * for "index". 5250 */ 5251 struct arth * 5252 gen_load(proto, index, size) 5253 int proto; 5254 struct arth *index; 5255 int size; 5256 { 5257 struct slist *s, *tmp; 5258 struct block *b; 5259 int regno = alloc_reg(); 5260 5261 free_reg(index->regno); 5262 switch (size) { 5263 5264 default: 5265 bpf_error("data size must be 1, 2, or 4"); 5266 5267 case 1: 5268 size = BPF_B; 5269 break; 5270 5271 case 2: 5272 size = BPF_H; 5273 break; 5274 5275 case 4: 5276 size = BPF_W; 5277 break; 5278 } 5279 switch (proto) { 5280 default: 5281 bpf_error("unsupported index operation"); 5282 5283 case Q_RADIO: 5284 /* 5285 * The offset is relative to the beginning of the packet 5286 * data, if we have a radio header. (If we don't, this 5287 * is an error.) 5288 */ 5289 if (linktype != DLT_IEEE802_11_RADIO_AVS && 5290 linktype != DLT_IEEE802_11_RADIO && 5291 linktype != DLT_PRISM_HEADER) 5292 bpf_error("radio information not present in capture"); 5293 5294 /* 5295 * Load into the X register the offset computed into the 5296 * register specifed by "index". 5297 */ 5298 s = xfer_to_x(index); 5299 5300 /* 5301 * Load the item at that offset. 5302 */ 5303 tmp = new_stmt(BPF_LD|BPF_IND|size); 5304 sappend(s, tmp); 5305 sappend(index->s, s); 5306 break; 5307 5308 case Q_LINK: 5309 /* 5310 * The offset is relative to the beginning of 5311 * the link-layer header. 5312 * 5313 * XXX - what about ATM LANE? Should the index be 5314 * relative to the beginning of the AAL5 frame, so 5315 * that 0 refers to the beginning of the LE Control 5316 * field, or relative to the beginning of the LAN 5317 * frame, so that 0 refers, for Ethernet LANE, to 5318 * the beginning of the destination address? 5319 */ 5320 s = gen_llprefixlen(); 5321 5322 /* 5323 * If "s" is non-null, it has code to arrange that the 5324 * X register contains the length of the prefix preceding 5325 * the link-layer header. Add to it the offset computed 5326 * into the register specified by "index", and move that 5327 * into the X register. Otherwise, just load into the X 5328 * register the offset computed into the register specifed 5329 * by "index". 5330 */ 5331 if (s != NULL) { 5332 sappend(s, xfer_to_a(index)); 5333 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 5334 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 5335 } else 5336 s = xfer_to_x(index); 5337 5338 /* 5339 * Load the item at the sum of the offset we've put in the 5340 * X register and the offset of the start of the link 5341 * layer header (which is 0 if the radio header is 5342 * variable-length; that header length is what we put 5343 * into the X register and then added to the index). 5344 */ 5345 tmp = new_stmt(BPF_LD|BPF_IND|size); 5346 tmp->s.k = off_ll; 5347 sappend(s, tmp); 5348 sappend(index->s, s); 5349 break; 5350 5351 case Q_IP: 5352 case Q_ARP: 5353 case Q_RARP: 5354 case Q_ATALK: 5355 case Q_DECNET: 5356 case Q_SCA: 5357 case Q_LAT: 5358 case Q_MOPRC: 5359 case Q_MOPDL: 5360 #ifdef INET6 5361 case Q_IPV6: 5362 #endif 5363 /* 5364 * The offset is relative to the beginning of 5365 * the network-layer header. 5366 * XXX - are there any cases where we want 5367 * off_nl_nosnap? 5368 */ 5369 s = gen_llprefixlen(); 5370 5371 /* 5372 * If "s" is non-null, it has code to arrange that the 5373 * X register contains the length of the prefix preceding 5374 * the link-layer header. Add to it the offset computed 5375 * into the register specified by "index", and move that 5376 * into the X register. Otherwise, just load into the X 5377 * register the offset computed into the register specifed 5378 * by "index". 5379 */ 5380 if (s != NULL) { 5381 sappend(s, xfer_to_a(index)); 5382 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 5383 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 5384 } else 5385 s = xfer_to_x(index); 5386 5387 /* 5388 * Load the item at the sum of the offset we've put in the 5389 * X register and the offset of the start of the network 5390 * layer header. 5391 */ 5392 tmp = new_stmt(BPF_LD|BPF_IND|size); 5393 tmp->s.k = off_nl; 5394 sappend(s, tmp); 5395 sappend(index->s, s); 5396 5397 /* 5398 * Do the computation only if the packet contains 5399 * the protocol in question. 5400 */ 5401 b = gen_proto_abbrev(proto); 5402 if (index->b) 5403 gen_and(index->b, b); 5404 index->b = b; 5405 break; 5406 5407 case Q_SCTP: 5408 case Q_TCP: 5409 case Q_UDP: 5410 case Q_ICMP: 5411 case Q_IGMP: 5412 case Q_IGRP: 5413 case Q_PIM: 5414 case Q_VRRP: 5415 /* 5416 * The offset is relative to the beginning of 5417 * the transport-layer header. 5418 * XXX - are there any cases where we want 5419 * off_nl_nosnap? 5420 * XXX - we should, if we're built with 5421 * IPv6 support, generate code to load either 5422 * IPv4, IPv6, or both, as appropriate. 5423 */ 5424 s = gen_loadx_iphdrlen(); 5425 5426 /* 5427 * The X register now contains the sum of the offset 5428 * of the beginning of the link-layer header and 5429 * the length of the network-layer header. Load 5430 * into the A register the offset relative to 5431 * the beginning of the transport layer header, 5432 * add the X register to that, move that to the 5433 * X register, and load with an offset from the 5434 * X register equal to the offset of the network 5435 * layer header relative to the beginning of 5436 * the link-layer header. 5437 */ 5438 sappend(s, xfer_to_a(index)); 5439 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 5440 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 5441 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 5442 tmp->s.k = off_nl; 5443 sappend(index->s, s); 5444 5445 /* 5446 * Do the computation only if the packet contains 5447 * the protocol in question - which is true only 5448 * if this is an IP datagram and is the first or 5449 * only fragment of that datagram. 5450 */ 5451 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); 5452 if (index->b) 5453 gen_and(index->b, b); 5454 #ifdef INET6 5455 gen_and(gen_proto_abbrev(Q_IP), b); 5456 #endif 5457 index->b = b; 5458 break; 5459 #ifdef INET6 5460 case Q_ICMPV6: 5461 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]"); 5462 /*NOTREACHED*/ 5463 #endif 5464 } 5465 index->regno = regno; 5466 s = new_stmt(BPF_ST); 5467 s->s.k = regno; 5468 sappend(index->s, s); 5469 5470 return index; 5471 } 5472 5473 struct block * 5474 gen_relation(code, a0, a1, reversed) 5475 int code; 5476 struct arth *a0, *a1; 5477 int reversed; 5478 { 5479 struct slist *s0, *s1, *s2; 5480 struct block *b, *tmp; 5481 5482 s0 = xfer_to_x(a1); 5483 s1 = xfer_to_a(a0); 5484 if (code == BPF_JEQ) { 5485 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X); 5486 b = new_block(JMP(code)); 5487 sappend(s1, s2); 5488 } 5489 else 5490 b = new_block(BPF_JMP|code|BPF_X); 5491 if (reversed) 5492 gen_not(b); 5493 5494 sappend(s0, s1); 5495 sappend(a1->s, s0); 5496 sappend(a0->s, a1->s); 5497 5498 b->stmts = a0->s; 5499 5500 free_reg(a0->regno); 5501 free_reg(a1->regno); 5502 5503 /* 'and' together protocol checks */ 5504 if (a0->b) { 5505 if (a1->b) { 5506 gen_and(a0->b, tmp = a1->b); 5507 } 5508 else 5509 tmp = a0->b; 5510 } else 5511 tmp = a1->b; 5512 5513 if (tmp) 5514 gen_and(tmp, b); 5515 5516 return b; 5517 } 5518 5519 struct arth * 5520 gen_loadlen() 5521 { 5522 int regno = alloc_reg(); 5523 struct arth *a = (struct arth *)newchunk(sizeof(*a)); 5524 struct slist *s; 5525 5526 s = new_stmt(BPF_LD|BPF_LEN); 5527 s->next = new_stmt(BPF_ST); 5528 s->next->s.k = regno; 5529 a->s = s; 5530 a->regno = regno; 5531 5532 return a; 5533 } 5534 5535 struct arth * 5536 gen_loadi(val) 5537 int val; 5538 { 5539 struct arth *a; 5540 struct slist *s; 5541 int reg; 5542 5543 a = (struct arth *)newchunk(sizeof(*a)); 5544 5545 reg = alloc_reg(); 5546 5547 s = new_stmt(BPF_LD|BPF_IMM); 5548 s->s.k = val; 5549 s->next = new_stmt(BPF_ST); 5550 s->next->s.k = reg; 5551 a->s = s; 5552 a->regno = reg; 5553 5554 return a; 5555 } 5556 5557 struct arth * 5558 gen_neg(a) 5559 struct arth *a; 5560 { 5561 struct slist *s; 5562 5563 s = xfer_to_a(a); 5564 sappend(a->s, s); 5565 s = new_stmt(BPF_ALU|BPF_NEG); 5566 s->s.k = 0; 5567 sappend(a->s, s); 5568 s = new_stmt(BPF_ST); 5569 s->s.k = a->regno; 5570 sappend(a->s, s); 5571 5572 return a; 5573 } 5574 5575 struct arth * 5576 gen_arth(code, a0, a1) 5577 int code; 5578 struct arth *a0, *a1; 5579 { 5580 struct slist *s0, *s1, *s2; 5581 5582 s0 = xfer_to_x(a1); 5583 s1 = xfer_to_a(a0); 5584 s2 = new_stmt(BPF_ALU|BPF_X|code); 5585 5586 sappend(s1, s2); 5587 sappend(s0, s1); 5588 sappend(a1->s, s0); 5589 sappend(a0->s, a1->s); 5590 5591 free_reg(a0->regno); 5592 free_reg(a1->regno); 5593 5594 s0 = new_stmt(BPF_ST); 5595 a0->regno = s0->s.k = alloc_reg(); 5596 sappend(a0->s, s0); 5597 5598 return a0; 5599 } 5600 5601 /* 5602 * Here we handle simple allocation of the scratch registers. 5603 * If too many registers are alloc'd, the allocator punts. 5604 */ 5605 static int regused[BPF_MEMWORDS]; 5606 static int curreg; 5607 5608 /* 5609 * Return the next free register. 5610 */ 5611 static int 5612 alloc_reg() 5613 { 5614 int n = BPF_MEMWORDS; 5615 5616 while (--n >= 0) { 5617 if (regused[curreg]) 5618 curreg = (curreg + 1) % BPF_MEMWORDS; 5619 else { 5620 regused[curreg] = 1; 5621 return curreg; 5622 } 5623 } 5624 bpf_error("too many registers needed to evaluate expression"); 5625 /* NOTREACHED */ 5626 } 5627 5628 /* 5629 * Return a register to the table so it can 5630 * be used later. 5631 */ 5632 static void 5633 free_reg(n) 5634 int n; 5635 { 5636 regused[n] = 0; 5637 } 5638 5639 static struct block * 5640 gen_len(jmp, n) 5641 int jmp, n; 5642 { 5643 struct slist *s; 5644 struct block *b; 5645 5646 s = new_stmt(BPF_LD|BPF_LEN); 5647 b = new_block(JMP(jmp)); 5648 b->stmts = s; 5649 b->s.k = n; 5650 5651 return b; 5652 } 5653 5654 struct block * 5655 gen_greater(n) 5656 int n; 5657 { 5658 return gen_len(BPF_JGE, n); 5659 } 5660 5661 /* 5662 * Actually, this is less than or equal. 5663 */ 5664 struct block * 5665 gen_less(n) 5666 int n; 5667 { 5668 struct block *b; 5669 5670 b = gen_len(BPF_JGT, n); 5671 gen_not(b); 5672 5673 return b; 5674 } 5675 5676 /* 5677 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to 5678 * the beginning of the link-layer header. 5679 * XXX - that means you can't test values in the radiotap header, but 5680 * as that header is difficult if not impossible to parse generally 5681 * without a loop, that might not be a severe problem. A new keyword 5682 * "radio" could be added for that, although what you'd really want 5683 * would be a way of testing particular radio header values, which 5684 * would generate code appropriate to the radio header in question. 5685 */ 5686 struct block * 5687 gen_byteop(op, idx, val) 5688 int op, idx, val; 5689 { 5690 struct block *b; 5691 struct slist *s; 5692 5693 switch (op) { 5694 default: 5695 abort(); 5696 5697 case '=': 5698 return gen_cmp(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val); 5699 5700 case '<': 5701 b = gen_cmp_lt(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val); 5702 return b; 5703 5704 case '>': 5705 b = gen_cmp_gt(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val); 5706 return b; 5707 5708 case '|': 5709 s = new_stmt(BPF_ALU|BPF_OR|BPF_K); 5710 break; 5711 5712 case '&': 5713 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 5714 break; 5715 } 5716 s->s.k = val; 5717 b = new_block(JMP(BPF_JEQ)); 5718 b->stmts = s; 5719 gen_not(b); 5720 5721 return b; 5722 } 5723 5724 static u_char abroadcast[] = { 0x0 }; 5725 5726 struct block * 5727 gen_broadcast(proto) 5728 int proto; 5729 { 5730 bpf_u_int32 hostmask; 5731 struct block *b0, *b1, *b2; 5732 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 5733 5734 switch (proto) { 5735 5736 case Q_DEFAULT: 5737 case Q_LINK: 5738 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 5739 return gen_ahostop(abroadcast, Q_DST); 5740 if (linktype == DLT_EN10MB) 5741 return gen_ehostop(ebroadcast, Q_DST); 5742 if (linktype == DLT_FDDI) 5743 return gen_fhostop(ebroadcast, Q_DST); 5744 if (linktype == DLT_IEEE802) 5745 return gen_thostop(ebroadcast, Q_DST); 5746 if (linktype == DLT_IEEE802_11 || 5747 linktype == DLT_IEEE802_11_RADIO_AVS || 5748 linktype == DLT_IEEE802_11_RADIO || 5749 linktype == DLT_PRISM_HEADER) 5750 return gen_wlanhostop(ebroadcast, Q_DST); 5751 if (linktype == DLT_IP_OVER_FC) 5752 return gen_ipfchostop(ebroadcast, Q_DST); 5753 if (linktype == DLT_SUNATM && is_lane) { 5754 /* 5755 * Check that the packet doesn't begin with an 5756 * LE Control marker. (We've already generated 5757 * a test for LANE.) 5758 */ 5759 b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 5760 0xFF00); 5761 gen_not(b1); 5762 5763 /* 5764 * Now check the MAC address. 5765 */ 5766 b0 = gen_ehostop(ebroadcast, Q_DST); 5767 gen_and(b1, b0); 5768 return b0; 5769 } 5770 bpf_error("not a broadcast link"); 5771 break; 5772 5773 case Q_IP: 5774 b0 = gen_linktype(ETHERTYPE_IP); 5775 hostmask = ~netmask; 5776 b1 = gen_mcmp(OR_NET, 16, BPF_W, (bpf_int32)0, hostmask); 5777 b2 = gen_mcmp(OR_NET, 16, BPF_W, 5778 (bpf_int32)(~0 & hostmask), hostmask); 5779 gen_or(b1, b2); 5780 gen_and(b0, b2); 5781 return b2; 5782 } 5783 bpf_error("only link-layer/IP broadcast filters supported"); 5784 /* NOTREACHED */ 5785 } 5786 5787 /* 5788 * Generate code to test the low-order bit of a MAC address (that's 5789 * the bottom bit of the *first* byte). 5790 */ 5791 static struct block * 5792 gen_mac_multicast(offset) 5793 int offset; 5794 { 5795 register struct block *b0; 5796 register struct slist *s; 5797 5798 /* link[offset] & 1 != 0 */ 5799 s = gen_load_a(OR_LINK, offset, BPF_B); 5800 b0 = new_block(JMP(BPF_JSET)); 5801 b0->s.k = 1; 5802 b0->stmts = s; 5803 return b0; 5804 } 5805 5806 struct block * 5807 gen_multicast(proto) 5808 int proto; 5809 { 5810 register struct block *b0, *b1, *b2; 5811 register struct slist *s; 5812 5813 switch (proto) { 5814 5815 case Q_DEFAULT: 5816 case Q_LINK: 5817 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 5818 /* all ARCnet multicasts use the same address */ 5819 return gen_ahostop(abroadcast, Q_DST); 5820 5821 if (linktype == DLT_EN10MB) { 5822 /* ether[0] & 1 != 0 */ 5823 return gen_mac_multicast(0); 5824 } 5825 5826 if (linktype == DLT_FDDI) { 5827 /* 5828 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX 5829 * 5830 * XXX - was that referring to bit-order issues? 5831 */ 5832 /* fddi[1] & 1 != 0 */ 5833 return gen_mac_multicast(1); 5834 } 5835 5836 if (linktype == DLT_IEEE802) { 5837 /* tr[2] & 1 != 0 */ 5838 return gen_mac_multicast(2); 5839 } 5840 5841 if (linktype == DLT_IEEE802_11 || 5842 linktype == DLT_IEEE802_11_RADIO_AVS || 5843 linktype == DLT_IEEE802_11_RADIO || 5844 linktype == DLT_PRISM_HEADER) { 5845 /* 5846 * Oh, yuk. 5847 * 5848 * For control frames, there is no DA. 5849 * 5850 * For management frames, DA is at an 5851 * offset of 4 from the beginning of 5852 * the packet. 5853 * 5854 * For data frames, DA is at an offset 5855 * of 4 from the beginning of the packet 5856 * if To DS is clear and at an offset of 5857 * 16 from the beginning of the packet 5858 * if To DS is set. 5859 */ 5860 5861 /* 5862 * Generate the tests to be done for data frames. 5863 * 5864 * First, check for To DS set, i.e. "link[1] & 0x01". 5865 */ 5866 s = gen_load_a(OR_LINK, 1, BPF_B); 5867 b1 = new_block(JMP(BPF_JSET)); 5868 b1->s.k = 0x01; /* To DS */ 5869 b1->stmts = s; 5870 5871 /* 5872 * If To DS is set, the DA is at 16. 5873 */ 5874 b0 = gen_mac_multicast(16); 5875 gen_and(b1, b0); 5876 5877 /* 5878 * Now, check for To DS not set, i.e. check 5879 * "!(link[1] & 0x01)". 5880 */ 5881 s = gen_load_a(OR_LINK, 1, BPF_B); 5882 b2 = new_block(JMP(BPF_JSET)); 5883 b2->s.k = 0x01; /* To DS */ 5884 b2->stmts = s; 5885 gen_not(b2); 5886 5887 /* 5888 * If To DS is not set, the DA is at 4. 5889 */ 5890 b1 = gen_mac_multicast(4); 5891 gen_and(b2, b1); 5892 5893 /* 5894 * Now OR together the last two checks. That gives 5895 * the complete set of checks for data frames. 5896 */ 5897 gen_or(b1, b0); 5898 5899 /* 5900 * Now check for a data frame. 5901 * I.e, check "link[0] & 0x08". 5902 */ 5903 s = gen_load_a(OR_LINK, 0, BPF_B); 5904 b1 = new_block(JMP(BPF_JSET)); 5905 b1->s.k = 0x08; 5906 b1->stmts = s; 5907 5908 /* 5909 * AND that with the checks done for data frames. 5910 */ 5911 gen_and(b1, b0); 5912 5913 /* 5914 * If the high-order bit of the type value is 0, this 5915 * is a management frame. 5916 * I.e, check "!(link[0] & 0x08)". 5917 */ 5918 s = gen_load_a(OR_LINK, 0, BPF_B); 5919 b2 = new_block(JMP(BPF_JSET)); 5920 b2->s.k = 0x08; 5921 b2->stmts = s; 5922 gen_not(b2); 5923 5924 /* 5925 * For management frames, the DA is at 4. 5926 */ 5927 b1 = gen_mac_multicast(4); 5928 gen_and(b2, b1); 5929 5930 /* 5931 * OR that with the checks done for data frames. 5932 * That gives the checks done for management and 5933 * data frames. 5934 */ 5935 gen_or(b1, b0); 5936 5937 /* 5938 * If the low-order bit of the type value is 1, 5939 * this is either a control frame or a frame 5940 * with a reserved type, and thus not a 5941 * frame with an SA. 5942 * 5943 * I.e., check "!(link[0] & 0x04)". 5944 */ 5945 s = gen_load_a(OR_LINK, 0, BPF_B); 5946 b1 = new_block(JMP(BPF_JSET)); 5947 b1->s.k = 0x04; 5948 b1->stmts = s; 5949 gen_not(b1); 5950 5951 /* 5952 * AND that with the checks for data and management 5953 * frames. 5954 */ 5955 gen_and(b1, b0); 5956 return b0; 5957 } 5958 5959 if (linktype == DLT_IP_OVER_FC) { 5960 b0 = gen_mac_multicast(2); 5961 return b0; 5962 } 5963 5964 if (linktype == DLT_SUNATM && is_lane) { 5965 /* 5966 * Check that the packet doesn't begin with an 5967 * LE Control marker. (We've already generated 5968 * a test for LANE.) 5969 */ 5970 b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 5971 0xFF00); 5972 gen_not(b1); 5973 5974 /* ether[off_mac] & 1 != 0 */ 5975 b0 = gen_mac_multicast(off_mac); 5976 gen_and(b1, b0); 5977 return b0; 5978 } 5979 5980 /* Link not known to support multicasts */ 5981 break; 5982 5983 case Q_IP: 5984 b0 = gen_linktype(ETHERTYPE_IP); 5985 b1 = gen_cmp_ge(OR_NET, 16, BPF_B, (bpf_int32)224); 5986 gen_and(b0, b1); 5987 return b1; 5988 5989 #ifdef INET6 5990 case Q_IPV6: 5991 b0 = gen_linktype(ETHERTYPE_IPV6); 5992 b1 = gen_cmp(OR_NET, 24, BPF_B, (bpf_int32)255); 5993 gen_and(b0, b1); 5994 return b1; 5995 #endif /* INET6 */ 5996 } 5997 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel"); 5998 /* NOTREACHED */ 5999 } 6000 6001 /* 6002 * generate command for inbound/outbound. It's here so we can 6003 * make it link-type specific. 'dir' = 0 implies "inbound", 6004 * = 1 implies "outbound". 6005 */ 6006 struct block * 6007 gen_inbound(dir) 6008 int dir; 6009 { 6010 register struct block *b0; 6011 6012 /* 6013 * Only some data link types support inbound/outbound qualifiers. 6014 */ 6015 switch (linktype) { 6016 case DLT_SLIP: 6017 b0 = gen_relation(BPF_JEQ, 6018 gen_load(Q_LINK, gen_loadi(0), 1), 6019 gen_loadi(0), 6020 dir); 6021 break; 6022 6023 case DLT_LINUX_SLL: 6024 if (dir) { 6025 /* 6026 * Match packets sent by this machine. 6027 */ 6028 b0 = gen_cmp(OR_LINK, 0, BPF_H, LINUX_SLL_OUTGOING); 6029 } else { 6030 /* 6031 * Match packets sent to this machine. 6032 * (No broadcast or multicast packets, or 6033 * packets sent to some other machine and 6034 * received promiscuously.) 6035 * 6036 * XXX - packets sent to other machines probably 6037 * shouldn't be matched, but what about broadcast 6038 * or multicast packets we received? 6039 */ 6040 b0 = gen_cmp(OR_LINK, 0, BPF_H, LINUX_SLL_HOST); 6041 } 6042 break; 6043 6044 case DLT_PFLOG: 6045 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, dir), BPF_B, 6046 (bpf_int32)((dir == 0) ? PF_IN : PF_OUT)); 6047 break; 6048 6049 case DLT_PPP_PPPD: 6050 if (dir) { 6051 /* match outgoing packets */ 6052 b0 = gen_cmp(OR_LINK, 0, BPF_B, PPP_PPPD_OUT); 6053 } else { 6054 /* match incoming packets */ 6055 b0 = gen_cmp(OR_LINK, 0, BPF_B, PPP_PPPD_IN); 6056 } 6057 break; 6058 6059 case DLT_JUNIPER_MFR: 6060 case DLT_JUNIPER_MLFR: 6061 case DLT_JUNIPER_MLPPP: 6062 case DLT_JUNIPER_ATM1: 6063 case DLT_JUNIPER_ATM2: 6064 case DLT_JUNIPER_PPPOE: 6065 case DLT_JUNIPER_PPPOE_ATM: 6066 case DLT_JUNIPER_GGSN: 6067 case DLT_JUNIPER_ES: 6068 case DLT_JUNIPER_MONITOR: 6069 case DLT_JUNIPER_SERVICES: 6070 case DLT_JUNIPER_ETHER: 6071 case DLT_JUNIPER_PPP: 6072 case DLT_JUNIPER_FRELAY: 6073 case DLT_JUNIPER_CHDLC: 6074 /* juniper flags (including direction) are stored 6075 * the byte after the 3-byte magic number */ 6076 if (dir) { 6077 /* match outgoing packets */ 6078 b0 = gen_mcmp(OR_LINK, 3, BPF_B, 0, 0x01); 6079 } else { 6080 /* match incoming packets */ 6081 b0 = gen_mcmp(OR_LINK, 3, BPF_B, 1, 0x01); 6082 } 6083 break; 6084 6085 default: 6086 bpf_error("inbound/outbound not supported on linktype %d", 6087 linktype); 6088 b0 = NULL; 6089 /* NOTREACHED */ 6090 } 6091 return (b0); 6092 } 6093 6094 /* PF firewall log matched interface */ 6095 struct block * 6096 gen_pf_ifname(const char *ifname) 6097 { 6098 struct block *b0; 6099 u_int len, off; 6100 6101 if (linktype == DLT_PFLOG) { 6102 len = sizeof(((struct pfloghdr *)0)->ifname); 6103 off = offsetof(struct pfloghdr, ifname); 6104 } else { 6105 bpf_error("ifname not supported on linktype 0x%x", linktype); 6106 /* NOTREACHED */ 6107 } 6108 if (strlen(ifname) >= len) { 6109 bpf_error("ifname interface names can only be %d characters", 6110 len-1); 6111 /* NOTREACHED */ 6112 } 6113 b0 = gen_bcmp(OR_LINK, off, strlen(ifname), (const u_char *)ifname); 6114 return (b0); 6115 } 6116 6117 /* PF firewall log ruleset name */ 6118 struct block * 6119 gen_pf_ruleset(char *ruleset) 6120 { 6121 struct block *b0; 6122 6123 if (linktype != DLT_PFLOG) { 6124 bpf_error("ruleset not supported on linktype 0x%x", linktype); 6125 /* NOTREACHED */ 6126 } 6127 if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) { 6128 bpf_error("ruleset names can only be %ld characters", 6129 (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1)); 6130 /* NOTREACHED */ 6131 } 6132 b0 = gen_bcmp(OR_LINK, offsetof(struct pfloghdr, ruleset), 6133 strlen(ruleset), (const u_char *)ruleset); 6134 return (b0); 6135 } 6136 6137 /* PF firewall log rule number */ 6138 struct block * 6139 gen_pf_rnr(int rnr) 6140 { 6141 struct block *b0; 6142 6143 if (linktype == DLT_PFLOG) { 6144 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, rulenr), BPF_W, 6145 (bpf_int32)rnr); 6146 } else { 6147 bpf_error("rnr not supported on linktype 0x%x", linktype); 6148 /* NOTREACHED */ 6149 } 6150 6151 return (b0); 6152 } 6153 6154 /* PF firewall log sub-rule number */ 6155 struct block * 6156 gen_pf_srnr(int srnr) 6157 { 6158 struct block *b0; 6159 6160 if (linktype != DLT_PFLOG) { 6161 bpf_error("srnr not supported on linktype 0x%x", linktype); 6162 /* NOTREACHED */ 6163 } 6164 6165 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, subrulenr), BPF_W, 6166 (bpf_int32)srnr); 6167 return (b0); 6168 } 6169 6170 /* PF firewall log reason code */ 6171 struct block * 6172 gen_pf_reason(int reason) 6173 { 6174 struct block *b0; 6175 6176 if (linktype == DLT_PFLOG) { 6177 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, reason), BPF_B, 6178 (bpf_int32)reason); 6179 } else { 6180 bpf_error("reason not supported on linktype 0x%x", linktype); 6181 /* NOTREACHED */ 6182 } 6183 6184 return (b0); 6185 } 6186 6187 /* PF firewall log action */ 6188 struct block * 6189 gen_pf_action(int action) 6190 { 6191 struct block *b0; 6192 6193 if (linktype == DLT_PFLOG) { 6194 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, action), BPF_B, 6195 (bpf_int32)action); 6196 } else { 6197 bpf_error("action not supported on linktype 0x%x", linktype); 6198 /* NOTREACHED */ 6199 } 6200 6201 return (b0); 6202 } 6203 6204 struct block * 6205 gen_acode(eaddr, q) 6206 register const u_char *eaddr; 6207 struct qual q; 6208 { 6209 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 6210 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 6211 return gen_ahostop(eaddr, (int)q.dir); 6212 } 6213 bpf_error("ARCnet address used in non-arc expression"); 6214 /* NOTREACHED */ 6215 } 6216 6217 static struct block * 6218 gen_ahostop(eaddr, dir) 6219 register const u_char *eaddr; 6220 register int dir; 6221 { 6222 register struct block *b0, *b1; 6223 6224 switch (dir) { 6225 /* src comes first, different from Ethernet */ 6226 case Q_SRC: 6227 return gen_bcmp(OR_LINK, 0, 1, eaddr); 6228 6229 case Q_DST: 6230 return gen_bcmp(OR_LINK, 1, 1, eaddr); 6231 6232 case Q_AND: 6233 b0 = gen_ahostop(eaddr, Q_SRC); 6234 b1 = gen_ahostop(eaddr, Q_DST); 6235 gen_and(b0, b1); 6236 return b1; 6237 6238 case Q_DEFAULT: 6239 case Q_OR: 6240 b0 = gen_ahostop(eaddr, Q_SRC); 6241 b1 = gen_ahostop(eaddr, Q_DST); 6242 gen_or(b0, b1); 6243 return b1; 6244 } 6245 abort(); 6246 /* NOTREACHED */ 6247 } 6248 6249 /* 6250 * support IEEE 802.1Q VLAN trunk over ethernet 6251 */ 6252 struct block * 6253 gen_vlan(vlan_num) 6254 int vlan_num; 6255 { 6256 struct block *b0, *b1; 6257 6258 /* can't check for VLAN-encapsulated packets inside MPLS */ 6259 if (label_stack_depth > 0) 6260 bpf_error("no VLAN match after MPLS"); 6261 6262 /* 6263 * Change the offsets to point to the type and data fields within 6264 * the VLAN packet. Just increment the offsets, so that we 6265 * can support a hierarchy, e.g. "vlan 300 && vlan 200" to 6266 * capture VLAN 200 encapsulated within VLAN 100. 6267 * 6268 * XXX - this is a bit of a kludge. If we were to split the 6269 * compiler into a parser that parses an expression and 6270 * generates an expression tree, and a code generator that 6271 * takes an expression tree (which could come from our 6272 * parser or from some other parser) and generates BPF code, 6273 * we could perhaps make the offsets parameters of routines 6274 * and, in the handler for an "AND" node, pass to subnodes 6275 * other than the VLAN node the adjusted offsets. 6276 * 6277 * This would mean that "vlan" would, instead of changing the 6278 * behavior of *all* tests after it, change only the behavior 6279 * of tests ANDed with it. That would change the documented 6280 * semantics of "vlan", which might break some expressions. 6281 * However, it would mean that "(vlan and ip) or ip" would check 6282 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than 6283 * checking only for VLAN-encapsulated IP, so that could still 6284 * be considered worth doing; it wouldn't break expressions 6285 * that are of the form "vlan and ..." or "vlan N and ...", 6286 * which I suspect are the most common expressions involving 6287 * "vlan". "vlan or ..." doesn't necessarily do what the user 6288 * would really want, now, as all the "or ..." tests would 6289 * be done assuming a VLAN, even though the "or" could be viewed 6290 * as meaning "or, if this isn't a VLAN packet...". 6291 */ 6292 orig_linktype = off_linktype; /* save original values */ 6293 orig_nl = off_nl; 6294 6295 switch (linktype) { 6296 6297 case DLT_EN10MB: 6298 off_linktype += 4; 6299 off_nl_nosnap += 4; 6300 off_nl += 4; 6301 break; 6302 6303 default: 6304 bpf_error("no VLAN support for data link type %d", 6305 linktype); 6306 /*NOTREACHED*/ 6307 } 6308 6309 /* check for VLAN */ 6310 b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q); 6311 6312 /* If a specific VLAN is requested, check VLAN id */ 6313 if (vlan_num >= 0) { 6314 b1 = gen_mcmp(OR_LINK, orig_nl, BPF_H, (bpf_int32)vlan_num, 6315 0x0fff); 6316 gen_and(b0, b1); 6317 b0 = b1; 6318 } 6319 6320 return (b0); 6321 } 6322 6323 /* 6324 * support for MPLS 6325 */ 6326 struct block * 6327 gen_mpls(label_num) 6328 int label_num; 6329 { 6330 struct block *b0,*b1; 6331 6332 /* 6333 * Change the offsets to point to the type and data fields within 6334 * the MPLS packet. Just increment the offsets, so that we 6335 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to 6336 * capture packets with an outer label of 100000 and an inner 6337 * label of 1024. 6338 * 6339 * XXX - this is a bit of a kludge. See comments in gen_vlan(). 6340 */ 6341 orig_nl = off_nl; 6342 6343 if (label_stack_depth > 0) { 6344 /* just match the bottom-of-stack bit clear */ 6345 b0 = gen_mcmp(OR_LINK, orig_nl-2, BPF_B, 0, 0x01); 6346 } else { 6347 /* 6348 * Indicate that we're checking MPLS-encapsulated headers, 6349 * to make sure higher level code generators don't try to 6350 * match against IP-related protocols such as Q_ARP, Q_RARP 6351 * etc. 6352 */ 6353 switch (linktype) { 6354 6355 case DLT_C_HDLC: /* fall through */ 6356 case DLT_EN10MB: 6357 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, 6358 (bpf_int32)ETHERTYPE_MPLS); 6359 break; 6360 6361 case DLT_PPP: 6362 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, 6363 (bpf_int32)PPP_MPLS_UCAST); 6364 break; 6365 6366 /* FIXME add other DLT_s ... 6367 * for Frame-Relay/and ATM this may get messy due to SNAP headers 6368 * leave it for now */ 6369 6370 default: 6371 bpf_error("no MPLS support for data link type %d", 6372 linktype); 6373 b0 = NULL; 6374 /*NOTREACHED*/ 6375 break; 6376 } 6377 } 6378 6379 /* If a specific MPLS label is requested, check it */ 6380 if (label_num >= 0) { 6381 label_num = label_num << 12; /* label is shifted 12 bits on the wire */ 6382 b1 = gen_mcmp(OR_LINK, orig_nl, BPF_W, (bpf_int32)label_num, 6383 0xfffff000); /* only compare the first 20 bits */ 6384 gen_and(b0, b1); 6385 b0 = b1; 6386 } 6387 6388 off_nl_nosnap += 4; 6389 off_nl += 4; 6390 label_stack_depth++; 6391 return (b0); 6392 } 6393 6394 /* 6395 * Support PPPOE discovery and session. 6396 */ 6397 struct block * 6398 gen_pppoed() 6399 { 6400 /* check for PPPoE discovery */ 6401 return gen_linktype((bpf_int32)ETHERTYPE_PPPOED); 6402 } 6403 6404 struct block * 6405 gen_pppoes() 6406 { 6407 struct block *b0; 6408 6409 /* 6410 * Test against the PPPoE session link-layer type. 6411 */ 6412 b0 = gen_linktype((bpf_int32)ETHERTYPE_PPPOES); 6413 6414 /* 6415 * Change the offsets to point to the type and data fields within 6416 * the PPP packet. 6417 * 6418 * XXX - this is a bit of a kludge. If we were to split the 6419 * compiler into a parser that parses an expression and 6420 * generates an expression tree, and a code generator that 6421 * takes an expression tree (which could come from our 6422 * parser or from some other parser) and generates BPF code, 6423 * we could perhaps make the offsets parameters of routines 6424 * and, in the handler for an "AND" node, pass to subnodes 6425 * other than the PPPoE node the adjusted offsets. 6426 * 6427 * This would mean that "pppoes" would, instead of changing the 6428 * behavior of *all* tests after it, change only the behavior 6429 * of tests ANDed with it. That would change the documented 6430 * semantics of "pppoes", which might break some expressions. 6431 * However, it would mean that "(pppoes and ip) or ip" would check 6432 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than 6433 * checking only for VLAN-encapsulated IP, so that could still 6434 * be considered worth doing; it wouldn't break expressions 6435 * that are of the form "pppoes and ..." which I suspect are the 6436 * most common expressions involving "pppoes". "pppoes or ..." 6437 * doesn't necessarily do what the user would really want, now, 6438 * as all the "or ..." tests would be done assuming PPPoE, even 6439 * though the "or" could be viewed as meaning "or, if this isn't 6440 * a PPPoE packet...". 6441 */ 6442 orig_linktype = off_linktype; /* save original values */ 6443 orig_nl = off_nl; 6444 6445 /* 6446 * The "network-layer" protocol is PPPoE, which has a 6-byte 6447 * PPPoE header, followed by PPP payload, so we set the 6448 * offsets to the network layer offset plus 6 bytes for 6449 * the PPPoE header plus the values appropriate for PPP when 6450 * encapsulated in Ethernet (which means there's no HDLC 6451 * encapsulation). 6452 */ 6453 off_linktype = orig_nl + 6; 6454 off_nl = orig_nl + 6 + 2; 6455 off_nl_nosnap = orig_nl + 6 + 2; 6456 6457 /* 6458 * Set the link-layer type to PPP, as all subsequent tests will 6459 * be on the encapsulated PPP header. 6460 */ 6461 linktype = DLT_PPP; 6462 6463 return b0; 6464 } 6465 6466 struct block * 6467 gen_atmfield_code(atmfield, jvalue, jtype, reverse) 6468 int atmfield; 6469 bpf_int32 jvalue; 6470 bpf_u_int32 jtype; 6471 int reverse; 6472 { 6473 struct block *b0; 6474 6475 switch (atmfield) { 6476 6477 case A_VPI: 6478 if (!is_atm) 6479 bpf_error("'vpi' supported only on raw ATM"); 6480 if (off_vpi == (u_int)-1) 6481 abort(); 6482 b0 = gen_ncmp(OR_LINK, off_vpi, BPF_B, 0xffffffff, jtype, 6483 reverse, jvalue); 6484 break; 6485 6486 case A_VCI: 6487 if (!is_atm) 6488 bpf_error("'vci' supported only on raw ATM"); 6489 if (off_vci == (u_int)-1) 6490 abort(); 6491 b0 = gen_ncmp(OR_LINK, off_vci, BPF_H, 0xffffffff, jtype, 6492 reverse, jvalue); 6493 break; 6494 6495 case A_PROTOTYPE: 6496 if (off_proto == (u_int)-1) 6497 abort(); /* XXX - this isn't on FreeBSD */ 6498 b0 = gen_ncmp(OR_LINK, off_proto, BPF_B, 0x0f, jtype, 6499 reverse, jvalue); 6500 break; 6501 6502 case A_MSGTYPE: 6503 if (off_payload == (u_int)-1) 6504 abort(); 6505 b0 = gen_ncmp(OR_LINK, off_payload + MSG_TYPE_POS, BPF_B, 6506 0xffffffff, jtype, reverse, jvalue); 6507 break; 6508 6509 case A_CALLREFTYPE: 6510 if (!is_atm) 6511 bpf_error("'callref' supported only on raw ATM"); 6512 if (off_proto == (u_int)-1) 6513 abort(); 6514 b0 = gen_ncmp(OR_LINK, off_proto, BPF_B, 0xffffffff, 6515 jtype, reverse, jvalue); 6516 break; 6517 6518 default: 6519 abort(); 6520 } 6521 return b0; 6522 } 6523 6524 struct block * 6525 gen_atmtype_abbrev(type) 6526 int type; 6527 { 6528 struct block *b0, *b1; 6529 6530 switch (type) { 6531 6532 case A_METAC: 6533 /* Get all packets in Meta signalling Circuit */ 6534 if (!is_atm) 6535 bpf_error("'metac' supported only on raw ATM"); 6536 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6537 b1 = gen_atmfield_code(A_VCI, 1, BPF_JEQ, 0); 6538 gen_and(b0, b1); 6539 break; 6540 6541 case A_BCC: 6542 /* Get all packets in Broadcast Circuit*/ 6543 if (!is_atm) 6544 bpf_error("'bcc' supported only on raw ATM"); 6545 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6546 b1 = gen_atmfield_code(A_VCI, 2, BPF_JEQ, 0); 6547 gen_and(b0, b1); 6548 break; 6549 6550 case A_OAMF4SC: 6551 /* Get all cells in Segment OAM F4 circuit*/ 6552 if (!is_atm) 6553 bpf_error("'oam4sc' supported only on raw ATM"); 6554 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6555 b1 = gen_atmfield_code(A_VCI, 3, BPF_JEQ, 0); 6556 gen_and(b0, b1); 6557 break; 6558 6559 case A_OAMF4EC: 6560 /* Get all cells in End-to-End OAM F4 Circuit*/ 6561 if (!is_atm) 6562 bpf_error("'oam4ec' supported only on raw ATM"); 6563 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6564 b1 = gen_atmfield_code(A_VCI, 4, BPF_JEQ, 0); 6565 gen_and(b0, b1); 6566 break; 6567 6568 case A_SC: 6569 /* Get all packets in connection Signalling Circuit */ 6570 if (!is_atm) 6571 bpf_error("'sc' supported only on raw ATM"); 6572 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6573 b1 = gen_atmfield_code(A_VCI, 5, BPF_JEQ, 0); 6574 gen_and(b0, b1); 6575 break; 6576 6577 case A_ILMIC: 6578 /* Get all packets in ILMI Circuit */ 6579 if (!is_atm) 6580 bpf_error("'ilmic' supported only on raw ATM"); 6581 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6582 b1 = gen_atmfield_code(A_VCI, 16, BPF_JEQ, 0); 6583 gen_and(b0, b1); 6584 break; 6585 6586 case A_LANE: 6587 /* Get all LANE packets */ 6588 if (!is_atm) 6589 bpf_error("'lane' supported only on raw ATM"); 6590 b1 = gen_atmfield_code(A_PROTOTYPE, PT_LANE, BPF_JEQ, 0); 6591 6592 /* 6593 * Arrange that all subsequent tests assume LANE 6594 * rather than LLC-encapsulated packets, and set 6595 * the offsets appropriately for LANE-encapsulated 6596 * Ethernet. 6597 * 6598 * "off_mac" is the offset of the Ethernet header, 6599 * which is 2 bytes past the ATM pseudo-header 6600 * (skipping the pseudo-header and 2-byte LE Client 6601 * field). The other offsets are Ethernet offsets 6602 * relative to "off_mac". 6603 */ 6604 is_lane = 1; 6605 off_mac = off_payload + 2; /* MAC header */ 6606 off_linktype = off_mac + 12; 6607 off_nl = off_mac + 14; /* Ethernet II */ 6608 off_nl_nosnap = off_mac + 17; /* 802.3+802.2 */ 6609 break; 6610 6611 case A_LLC: 6612 /* Get all LLC-encapsulated packets */ 6613 if (!is_atm) 6614 bpf_error("'llc' supported only on raw ATM"); 6615 b1 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 6616 is_lane = 0; 6617 break; 6618 6619 default: 6620 abort(); 6621 } 6622 return b1; 6623 } 6624 6625 struct block * 6626 gen_mtp3field_code(mtp3field, jvalue, jtype, reverse) 6627 int mtp3field; 6628 bpf_u_int32 jvalue; 6629 bpf_u_int32 jtype; 6630 int reverse; 6631 { 6632 struct block *b0; 6633 bpf_u_int32 val1 , val2 , val3; 6634 6635 switch (mtp3field) { 6636 6637 case M_SIO: 6638 if (off_sio == (u_int)-1) 6639 bpf_error("'sio' supported only on SS7"); 6640 /* sio coded on 1 byte so max value 255 */ 6641 if(jvalue > 255) 6642 bpf_error("sio value %u too big; max value = 255", 6643 jvalue); 6644 b0 = gen_ncmp(OR_PACKET, off_sio, BPF_B, 0xffffffff, 6645 (u_int)jtype, reverse, (u_int)jvalue); 6646 break; 6647 6648 case M_OPC: 6649 if (off_opc == (u_int)-1) 6650 bpf_error("'opc' supported only on SS7"); 6651 /* opc coded on 14 bits so max value 16383 */ 6652 if (jvalue > 16383) 6653 bpf_error("opc value %u too big; max value = 16383", 6654 jvalue); 6655 /* the following instructions are made to convert jvalue 6656 * to the form used to write opc in an ss7 message*/ 6657 val1 = jvalue & 0x00003c00; 6658 val1 = val1 >>10; 6659 val2 = jvalue & 0x000003fc; 6660 val2 = val2 <<6; 6661 val3 = jvalue & 0x00000003; 6662 val3 = val3 <<22; 6663 jvalue = val1 + val2 + val3; 6664 b0 = gen_ncmp(OR_PACKET, off_opc, BPF_W, 0x00c0ff0f, 6665 (u_int)jtype, reverse, (u_int)jvalue); 6666 break; 6667 6668 case M_DPC: 6669 if (off_dpc == (u_int)-1) 6670 bpf_error("'dpc' supported only on SS7"); 6671 /* dpc coded on 14 bits so max value 16383 */ 6672 if (jvalue > 16383) 6673 bpf_error("dpc value %u too big; max value = 16383", 6674 jvalue); 6675 /* the following instructions are made to convert jvalue 6676 * to the forme used to write dpc in an ss7 message*/ 6677 val1 = jvalue & 0x000000ff; 6678 val1 = val1 << 24; 6679 val2 = jvalue & 0x00003f00; 6680 val2 = val2 << 8; 6681 jvalue = val1 + val2; 6682 b0 = gen_ncmp(OR_PACKET, off_dpc, BPF_W, 0xff3f0000, 6683 (u_int)jtype, reverse, (u_int)jvalue); 6684 break; 6685 6686 case M_SLS: 6687 if (off_sls == (u_int)-1) 6688 bpf_error("'sls' supported only on SS7"); 6689 /* sls coded on 4 bits so max value 15 */ 6690 if (jvalue > 15) 6691 bpf_error("sls value %u too big; max value = 15", 6692 jvalue); 6693 /* the following instruction is made to convert jvalue 6694 * to the forme used to write sls in an ss7 message*/ 6695 jvalue = jvalue << 4; 6696 b0 = gen_ncmp(OR_PACKET, off_sls, BPF_B, 0xf0, 6697 (u_int)jtype,reverse, (u_int)jvalue); 6698 break; 6699 6700 default: 6701 abort(); 6702 } 6703 return b0; 6704 } 6705 6706 static struct block * 6707 gen_msg_abbrev(type) 6708 int type; 6709 { 6710 struct block *b1; 6711 6712 /* 6713 * Q.2931 signalling protocol messages for handling virtual circuits 6714 * establishment and teardown 6715 */ 6716 switch (type) { 6717 6718 case A_SETUP: 6719 b1 = gen_atmfield_code(A_MSGTYPE, SETUP, BPF_JEQ, 0); 6720 break; 6721 6722 case A_CALLPROCEED: 6723 b1 = gen_atmfield_code(A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0); 6724 break; 6725 6726 case A_CONNECT: 6727 b1 = gen_atmfield_code(A_MSGTYPE, CONNECT, BPF_JEQ, 0); 6728 break; 6729 6730 case A_CONNECTACK: 6731 b1 = gen_atmfield_code(A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0); 6732 break; 6733 6734 case A_RELEASE: 6735 b1 = gen_atmfield_code(A_MSGTYPE, RELEASE, BPF_JEQ, 0); 6736 break; 6737 6738 case A_RELEASE_DONE: 6739 b1 = gen_atmfield_code(A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0); 6740 break; 6741 6742 default: 6743 abort(); 6744 } 6745 return b1; 6746 } 6747 6748 struct block * 6749 gen_atmmulti_abbrev(type) 6750 int type; 6751 { 6752 struct block *b0, *b1; 6753 6754 switch (type) { 6755 6756 case A_OAM: 6757 if (!is_atm) 6758 bpf_error("'oam' supported only on raw ATM"); 6759 b1 = gen_atmmulti_abbrev(A_OAMF4); 6760 break; 6761 6762 case A_OAMF4: 6763 if (!is_atm) 6764 bpf_error("'oamf4' supported only on raw ATM"); 6765 /* OAM F4 type */ 6766 b0 = gen_atmfield_code(A_VCI, 3, BPF_JEQ, 0); 6767 b1 = gen_atmfield_code(A_VCI, 4, BPF_JEQ, 0); 6768 gen_or(b0, b1); 6769 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 6770 gen_and(b0, b1); 6771 break; 6772 6773 case A_CONNECTMSG: 6774 /* 6775 * Get Q.2931 signalling messages for switched 6776 * virtual connection 6777 */ 6778 if (!is_atm) 6779 bpf_error("'connectmsg' supported only on raw ATM"); 6780 b0 = gen_msg_abbrev(A_SETUP); 6781 b1 = gen_msg_abbrev(A_CALLPROCEED); 6782 gen_or(b0, b1); 6783 b0 = gen_msg_abbrev(A_CONNECT); 6784 gen_or(b0, b1); 6785 b0 = gen_msg_abbrev(A_CONNECTACK); 6786 gen_or(b0, b1); 6787 b0 = gen_msg_abbrev(A_RELEASE); 6788 gen_or(b0, b1); 6789 b0 = gen_msg_abbrev(A_RELEASE_DONE); 6790 gen_or(b0, b1); 6791 b0 = gen_atmtype_abbrev(A_SC); 6792 gen_and(b0, b1); 6793 break; 6794 6795 case A_METACONNECT: 6796 if (!is_atm) 6797 bpf_error("'metaconnect' supported only on raw ATM"); 6798 b0 = gen_msg_abbrev(A_SETUP); 6799 b1 = gen_msg_abbrev(A_CALLPROCEED); 6800 gen_or(b0, b1); 6801 b0 = gen_msg_abbrev(A_CONNECT); 6802 gen_or(b0, b1); 6803 b0 = gen_msg_abbrev(A_RELEASE); 6804 gen_or(b0, b1); 6805 b0 = gen_msg_abbrev(A_RELEASE_DONE); 6806 gen_or(b0, b1); 6807 b0 = gen_atmtype_abbrev(A_METAC); 6808 gen_and(b0, b1); 6809 break; 6810 6811 default: 6812 abort(); 6813 } 6814 return b1; 6815 } 6816