1 /*#define CHASE_CHAIN*/ 2 /* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 */ 22 #ifndef lint 23 static const char rcsid[] _U_ = 24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.193.2.8 2004/03/29 20:53:47 guy Exp $ (LBL)"; 25 #endif 26 27 #ifdef HAVE_CONFIG_H 28 #include "config.h" 29 #endif 30 31 #ifdef WIN32 32 #include <pcap-stdinc.h> 33 #else /* WIN32 */ 34 #include <sys/types.h> 35 #include <sys/socket.h> 36 #include <sys/time.h> 37 #endif /* WIN32 */ 38 39 /* 40 * XXX - why was this included even on UNIX? 41 */ 42 #ifdef __MINGW32__ 43 #include "IP6_misc.h" 44 #endif 45 46 #ifndef WIN32 47 48 #ifdef __NetBSD__ 49 #include <sys/param.h> 50 #endif 51 52 #include <netinet/in.h> 53 54 #endif /* WIN32 */ 55 56 #include <stdlib.h> 57 #include <string.h> 58 #include <memory.h> 59 #include <setjmp.h> 60 #include <stdarg.h> 61 62 #include "pcap-int.h" 63 64 #include "ethertype.h" 65 #include "nlpid.h" 66 #include "llc.h" 67 #include "gencode.h" 68 #include "atmuni31.h" 69 #include "sunatmpos.h" 70 #include "ppp.h" 71 #include "sll.h" 72 #include "arcnet.h" 73 #include "pf.h" 74 #ifndef offsetof 75 #define offsetof(s, e) ((size_t)&((s *)0)->e) 76 #endif 77 #ifdef INET6 78 #ifndef WIN32 79 #include <netdb.h> /* for "struct addrinfo" */ 80 #endif /* WIN32 */ 81 #endif /*INET6*/ 82 #include <pcap-namedb.h> 83 84 #define ETHERMTU 1500 85 86 #ifndef IPPROTO_SCTP 87 #define IPPROTO_SCTP 132 88 #endif 89 90 #ifdef HAVE_OS_PROTO_H 91 #include "os-proto.h" 92 #endif 93 94 #define JMP(c) ((c)|BPF_JMP|BPF_K) 95 96 /* Locals */ 97 static jmp_buf top_ctx; 98 static pcap_t *bpf_pcap; 99 100 /* Hack for updating VLAN offsets. */ 101 static u_int orig_linktype = -1, orig_nl = -1, orig_nl_nosnap = -1; 102 103 /* XXX */ 104 #ifdef PCAP_FDDIPAD 105 int pcap_fddipad = PCAP_FDDIPAD; 106 #else 107 int pcap_fddipad; 108 #endif 109 110 /* VARARGS */ 111 void 112 bpf_error(const char *fmt, ...) 113 114 { 115 va_list ap; 116 117 va_start(ap, fmt); 118 if (bpf_pcap != NULL) 119 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE, 120 fmt, ap); 121 va_end(ap); 122 longjmp(top_ctx, 1); 123 /* NOTREACHED */ 124 } 125 126 static void init_linktype(int); 127 128 static int alloc_reg(void); 129 static void free_reg(int); 130 131 static struct block *root; 132 133 /* 134 * We divy out chunks of memory rather than call malloc each time so 135 * we don't have to worry about leaking memory. It's probably 136 * not a big deal if all this memory was wasted but it this ever 137 * goes into a library that would probably not be a good idea. 138 */ 139 #define NCHUNKS 16 140 #define CHUNK0SIZE 1024 141 struct chunk { 142 u_int n_left; 143 void *m; 144 }; 145 146 static struct chunk chunks[NCHUNKS]; 147 static int cur_chunk; 148 149 static void *newchunk(u_int); 150 static void freechunks(void); 151 static inline struct block *new_block(int); 152 static inline struct slist *new_stmt(int); 153 static struct block *gen_retblk(int); 154 static inline void syntax(void); 155 156 static void backpatch(struct block *, struct block *); 157 static void merge(struct block *, struct block *); 158 static struct block *gen_cmp(u_int, u_int, bpf_int32); 159 static struct block *gen_cmp_gt(u_int, u_int, bpf_int32); 160 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32); 161 static struct block *gen_bcmp(u_int, u_int, const u_char *); 162 static struct block *gen_ncmp(bpf_u_int32, bpf_u_int32, bpf_u_int32, 163 bpf_u_int32, bpf_u_int32, int); 164 static struct block *gen_uncond(int); 165 static inline struct block *gen_true(void); 166 static inline struct block *gen_false(void); 167 static struct block *gen_ether_linktype(int); 168 static struct block *gen_linktype(int); 169 static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); 170 static struct block *gen_llc(int); 171 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 172 #ifdef INET6 173 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 174 #endif 175 static struct block *gen_ahostop(const u_char *, int); 176 static struct block *gen_ehostop(const u_char *, int); 177 static struct block *gen_fhostop(const u_char *, int); 178 static struct block *gen_thostop(const u_char *, int); 179 static struct block *gen_wlanhostop(const u_char *, int); 180 static struct block *gen_ipfchostop(const u_char *, int); 181 static struct block *gen_dnhostop(bpf_u_int32, int, u_int); 182 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 183 #ifdef INET6 184 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 185 #endif 186 #ifndef INET6 187 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); 188 #endif 189 static struct block *gen_ipfrag(void); 190 static struct block *gen_portatom(int, bpf_int32); 191 #ifdef INET6 192 static struct block *gen_portatom6(int, bpf_int32); 193 #endif 194 struct block *gen_portop(int, int, int); 195 static struct block *gen_port(int, int, int); 196 #ifdef INET6 197 struct block *gen_portop6(int, int, int); 198 static struct block *gen_port6(int, int, int); 199 #endif 200 static int lookup_proto(const char *, int); 201 static struct block *gen_protochain(int, int, int); 202 static struct block *gen_proto(int, int, int); 203 static struct slist *xfer_to_x(struct arth *); 204 static struct slist *xfer_to_a(struct arth *); 205 static struct block *gen_mac_multicast(int); 206 static struct block *gen_len(int, int); 207 208 static struct block *gen_msg_abbrev(int type); 209 210 static void * 211 newchunk(n) 212 u_int n; 213 { 214 struct chunk *cp; 215 int k; 216 size_t size; 217 218 #ifndef __NetBSD__ 219 /* XXX Round up to nearest long. */ 220 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 221 #else 222 /* XXX Round up to structure boundary. */ 223 n = ALIGN(n); 224 #endif 225 226 cp = &chunks[cur_chunk]; 227 if (n > cp->n_left) { 228 ++cp, k = ++cur_chunk; 229 if (k >= NCHUNKS) 230 bpf_error("out of memory"); 231 size = CHUNK0SIZE << k; 232 cp->m = (void *)malloc(size); 233 if (cp->m == NULL) 234 bpf_error("out of memory"); 235 memset((char *)cp->m, 0, size); 236 cp->n_left = size; 237 if (n > size) 238 bpf_error("out of memory"); 239 } 240 cp->n_left -= n; 241 return (void *)((char *)cp->m + cp->n_left); 242 } 243 244 static void 245 freechunks() 246 { 247 int i; 248 249 cur_chunk = 0; 250 for (i = 0; i < NCHUNKS; ++i) 251 if (chunks[i].m != NULL) { 252 free(chunks[i].m); 253 chunks[i].m = NULL; 254 } 255 } 256 257 /* 258 * A strdup whose allocations are freed after code generation is over. 259 */ 260 char * 261 sdup(s) 262 register const char *s; 263 { 264 int n = strlen(s) + 1; 265 char *cp = newchunk(n); 266 267 strlcpy(cp, s, n); 268 return (cp); 269 } 270 271 static inline struct block * 272 new_block(code) 273 int code; 274 { 275 struct block *p; 276 277 p = (struct block *)newchunk(sizeof(*p)); 278 p->s.code = code; 279 p->head = p; 280 281 return p; 282 } 283 284 static inline struct slist * 285 new_stmt(code) 286 int code; 287 { 288 struct slist *p; 289 290 p = (struct slist *)newchunk(sizeof(*p)); 291 p->s.code = code; 292 293 return p; 294 } 295 296 static struct block * 297 gen_retblk(v) 298 int v; 299 { 300 struct block *b = new_block(BPF_RET|BPF_K); 301 302 b->s.k = v; 303 return b; 304 } 305 306 static inline void 307 syntax() 308 { 309 bpf_error("syntax error in filter expression"); 310 } 311 312 static bpf_u_int32 netmask; 313 static int snaplen; 314 int no_optimize; 315 316 int 317 pcap_compile(pcap_t *p, struct bpf_program *program, 318 char *buf, int optimize, bpf_u_int32 mask) 319 { 320 extern int n_errors; 321 int len; 322 323 no_optimize = 0; 324 n_errors = 0; 325 root = NULL; 326 bpf_pcap = p; 327 if (setjmp(top_ctx)) { 328 lex_cleanup(); 329 freechunks(); 330 return (-1); 331 } 332 333 netmask = mask; 334 335 snaplen = pcap_snapshot(p); 336 if (snaplen == 0) { 337 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 338 "snaplen of 0 rejects all packets"); 339 return -1; 340 } 341 342 lex_init(buf ? buf : ""); 343 init_linktype(pcap_datalink(p)); 344 (void)pcap_parse(); 345 346 if (n_errors) 347 syntax(); 348 349 if (root == NULL) 350 root = gen_retblk(snaplen); 351 352 if (optimize && !no_optimize) { 353 bpf_optimize(&root); 354 if (root == NULL || 355 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0)) 356 bpf_error("expression rejects all packets"); 357 } 358 program->bf_insns = icode_to_fcode(root, &len); 359 program->bf_len = len; 360 361 lex_cleanup(); 362 freechunks(); 363 return (0); 364 } 365 366 /* 367 * entry point for using the compiler with no pcap open 368 * pass in all the stuff that is needed explicitly instead. 369 */ 370 int 371 pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 372 struct bpf_program *program, 373 char *buf, int optimize, bpf_u_int32 mask) 374 { 375 pcap_t *p; 376 int ret; 377 378 p = pcap_open_dead(linktype_arg, snaplen_arg); 379 if (p == NULL) 380 return (-1); 381 ret = pcap_compile(p, program, buf, optimize, mask); 382 pcap_close(p); 383 return (ret); 384 } 385 386 /* 387 * Clean up a "struct bpf_program" by freeing all the memory allocated 388 * in it. 389 */ 390 void 391 pcap_freecode(struct bpf_program *program) 392 { 393 program->bf_len = 0; 394 if (program->bf_insns != NULL) { 395 free((char *)program->bf_insns); 396 program->bf_insns = NULL; 397 } 398 } 399 400 /* 401 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 402 * which of the jt and jf fields has been resolved and which is a pointer 403 * back to another unresolved block (or nil). At least one of the fields 404 * in each block is already resolved. 405 */ 406 static void 407 backpatch(list, target) 408 struct block *list, *target; 409 { 410 struct block *next; 411 412 while (list) { 413 if (!list->sense) { 414 next = JT(list); 415 JT(list) = target; 416 } else { 417 next = JF(list); 418 JF(list) = target; 419 } 420 list = next; 421 } 422 } 423 424 /* 425 * Merge the lists in b0 and b1, using the 'sense' field to indicate 426 * which of jt and jf is the link. 427 */ 428 static void 429 merge(b0, b1) 430 struct block *b0, *b1; 431 { 432 register struct block **p = &b0; 433 434 /* Find end of list. */ 435 while (*p) 436 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 437 438 /* Concatenate the lists. */ 439 *p = b1; 440 } 441 442 void 443 finish_parse(p) 444 struct block *p; 445 { 446 backpatch(p, gen_retblk(snaplen)); 447 p->sense = !p->sense; 448 backpatch(p, gen_retblk(0)); 449 root = p->head; 450 } 451 452 void 453 gen_and(b0, b1) 454 struct block *b0, *b1; 455 { 456 backpatch(b0, b1->head); 457 b0->sense = !b0->sense; 458 b1->sense = !b1->sense; 459 merge(b1, b0); 460 b1->sense = !b1->sense; 461 b1->head = b0->head; 462 } 463 464 void 465 gen_or(b0, b1) 466 struct block *b0, *b1; 467 { 468 b0->sense = !b0->sense; 469 backpatch(b0, b1->head); 470 b0->sense = !b0->sense; 471 merge(b1, b0); 472 b1->head = b0->head; 473 } 474 475 void 476 gen_not(b) 477 struct block *b; 478 { 479 b->sense = !b->sense; 480 } 481 482 static struct block * 483 gen_cmp(offset, size, v) 484 u_int offset, size; 485 bpf_int32 v; 486 { 487 struct slist *s; 488 struct block *b; 489 490 s = new_stmt(BPF_LD|BPF_ABS|size); 491 s->s.k = offset; 492 493 b = new_block(JMP(BPF_JEQ)); 494 b->stmts = s; 495 b->s.k = v; 496 497 return b; 498 } 499 500 static struct block * 501 gen_cmp_gt(offset, size, v) 502 u_int offset, size; 503 bpf_int32 v; 504 { 505 struct slist *s; 506 struct block *b; 507 508 s = new_stmt(BPF_LD|BPF_ABS|size); 509 s->s.k = offset; 510 511 b = new_block(JMP(BPF_JGT)); 512 b->stmts = s; 513 b->s.k = v; 514 515 return b; 516 } 517 518 static struct block * 519 gen_mcmp(offset, size, v, mask) 520 u_int offset, size; 521 bpf_int32 v; 522 bpf_u_int32 mask; 523 { 524 struct block *b = gen_cmp(offset, size, v); 525 struct slist *s; 526 527 if (mask != 0xffffffff) { 528 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 529 s->s.k = mask; 530 b->stmts->next = s; 531 } 532 return b; 533 } 534 535 static struct block * 536 gen_bcmp(offset, size, v) 537 register u_int offset, size; 538 register const u_char *v; 539 { 540 register struct block *b, *tmp; 541 542 b = NULL; 543 while (size >= 4) { 544 register const u_char *p = &v[size - 4]; 545 bpf_int32 w = ((bpf_int32)p[0] << 24) | 546 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 547 548 tmp = gen_cmp(offset + size - 4, BPF_W, w); 549 if (b != NULL) 550 gen_and(b, tmp); 551 b = tmp; 552 size -= 4; 553 } 554 while (size >= 2) { 555 register const u_char *p = &v[size - 2]; 556 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 557 558 tmp = gen_cmp(offset + size - 2, BPF_H, w); 559 if (b != NULL) 560 gen_and(b, tmp); 561 b = tmp; 562 size -= 2; 563 } 564 if (size > 0) { 565 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]); 566 if (b != NULL) 567 gen_and(b, tmp); 568 b = tmp; 569 } 570 return b; 571 } 572 573 static struct block * 574 gen_ncmp(datasize, offset, mask, jtype, jvalue, reverse) 575 bpf_u_int32 datasize, offset, mask, jtype, jvalue; 576 int reverse; 577 { 578 struct slist *s; 579 struct block *b; 580 581 s = new_stmt(BPF_LD|datasize|BPF_ABS); 582 s->s.k = offset; 583 584 if (mask != 0xffffffff) { 585 s->next = new_stmt(BPF_ALU|BPF_AND|BPF_K); 586 s->next->s.k = mask; 587 } 588 589 b = new_block(JMP(jtype)); 590 b->stmts = s; 591 b->s.k = jvalue; 592 if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE)) 593 gen_not(b); 594 return b; 595 } 596 597 /* 598 * Various code constructs need to know the layout of the data link 599 * layer. These variables give the necessary offsets. 600 */ 601 602 /* 603 * This is the offset of the beginning of the MAC-layer header. 604 * It's usually 0, except for ATM LANE. 605 */ 606 static u_int off_mac; 607 608 /* 609 * "off_linktype" is the offset to information in the link-layer header 610 * giving the packet type. 611 * 612 * For Ethernet, it's the offset of the Ethernet type field. 613 * 614 * For link-layer types that always use 802.2 headers, it's the 615 * offset of the LLC header. 616 * 617 * For PPP, it's the offset of the PPP type field. 618 * 619 * For Cisco HDLC, it's the offset of the CHDLC type field. 620 * 621 * For BSD loopback, it's the offset of the AF_ value. 622 * 623 * For Linux cooked sockets, it's the offset of the type field. 624 * 625 * It's set to -1 for no encapsulation, in which case, IP is assumed. 626 */ 627 static u_int off_linktype; 628 629 /* 630 * TRUE if the link layer includes an ATM pseudo-header. 631 */ 632 static int is_atm = 0; 633 634 /* 635 * TRUE if "lane" appeared in the filter; it causes us to generate 636 * code that assumes LANE rather than LLC-encapsulated traffic in SunATM. 637 */ 638 static int is_lane = 0; 639 640 /* 641 * These are offsets for the ATM pseudo-header. 642 */ 643 static u_int off_vpi; 644 static u_int off_vci; 645 static u_int off_proto; 646 647 /* 648 * This is the offset of the first byte after the ATM pseudo_header, 649 * or -1 if there is no ATM pseudo-header. 650 */ 651 static u_int off_payload; 652 653 /* 654 * These are offsets to the beginning of the network-layer header. 655 * 656 * If the link layer never uses 802.2 LLC: 657 * 658 * "off_nl" and "off_nl_nosnap" are the same. 659 * 660 * If the link layer always uses 802.2 LLC: 661 * 662 * "off_nl" is the offset if there's a SNAP header following 663 * the 802.2 header; 664 * 665 * "off_nl_nosnap" is the offset if there's no SNAP header. 666 * 667 * If the link layer is Ethernet: 668 * 669 * "off_nl" is the offset if the packet is an Ethernet II packet 670 * (we assume no 802.3+802.2+SNAP); 671 * 672 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet 673 * with an 802.2 header following it. 674 */ 675 static u_int off_nl; 676 static u_int off_nl_nosnap; 677 678 static int linktype; 679 680 static void 681 init_linktype(type) 682 int type; 683 { 684 linktype = type; 685 686 /* 687 * Assume it's not raw ATM with a pseudo-header, for now. 688 */ 689 off_mac = 0; 690 is_atm = 0; 691 is_lane = 0; 692 off_vpi = -1; 693 off_vci = -1; 694 off_proto = -1; 695 off_payload = -1; 696 697 orig_linktype = -1; 698 orig_nl = -1; 699 orig_nl_nosnap = -1; 700 701 switch (type) { 702 703 case DLT_ARCNET: 704 off_linktype = 2; 705 off_nl = 6; /* XXX in reality, variable! */ 706 off_nl_nosnap = 6; /* no 802.2 LLC */ 707 return; 708 709 case DLT_ARCNET_LINUX: 710 off_linktype = 4; 711 off_nl = 8; /* XXX in reality, variable! */ 712 off_nl_nosnap = 8; /* no 802.2 LLC */ 713 return; 714 715 case DLT_EN10MB: 716 off_linktype = 12; 717 off_nl = 14; /* Ethernet II */ 718 off_nl_nosnap = 17; /* 802.3+802.2 */ 719 return; 720 721 case DLT_SLIP: 722 /* 723 * SLIP doesn't have a link level type. The 16 byte 724 * header is hacked into our SLIP driver. 725 */ 726 off_linktype = -1; 727 off_nl = 16; 728 off_nl_nosnap = 16; /* no 802.2 LLC */ 729 return; 730 731 case DLT_SLIP_BSDOS: 732 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 733 off_linktype = -1; 734 /* XXX end */ 735 off_nl = 24; 736 off_nl_nosnap = 24; /* no 802.2 LLC */ 737 return; 738 739 case DLT_NULL: 740 case DLT_LOOP: 741 off_linktype = 0; 742 off_nl = 4; 743 off_nl_nosnap = 4; /* no 802.2 LLC */ 744 return; 745 746 case DLT_ENC: 747 off_linktype = 0; 748 off_nl = 12; 749 off_nl_nosnap = 12; /* no 802.2 LLC */ 750 return; 751 752 case DLT_PPP: 753 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 754 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */ 755 off_linktype = 2; 756 off_nl = 4; 757 off_nl_nosnap = 4; /* no 802.2 LLC */ 758 return; 759 760 case DLT_PPP_ETHER: 761 /* 762 * This does no include the Ethernet header, and 763 * only covers session state. 764 */ 765 off_linktype = 6; 766 off_nl = 8; 767 off_nl_nosnap = 8; /* no 802.2 LLC */ 768 return; 769 770 case DLT_PPP_BSDOS: 771 off_linktype = 5; 772 off_nl = 24; 773 off_nl_nosnap = 24; /* no 802.2 LLC */ 774 return; 775 776 case DLT_FDDI: 777 /* 778 * FDDI doesn't really have a link-level type field. 779 * We set "off_linktype" to the offset of the LLC header. 780 * 781 * To check for Ethernet types, we assume that SSAP = SNAP 782 * is being used and pick out the encapsulated Ethernet type. 783 * XXX - should we generate code to check for SNAP? 784 */ 785 off_linktype = 13; 786 #ifdef PCAP_FDDIPAD 787 off_linktype += pcap_fddipad; 788 #endif 789 off_nl = 21; /* FDDI+802.2+SNAP */ 790 off_nl_nosnap = 16; /* FDDI+802.2 */ 791 #ifdef PCAP_FDDIPAD 792 off_nl += pcap_fddipad; 793 off_nl_nosnap += pcap_fddipad; 794 #endif 795 return; 796 797 case DLT_IEEE802: 798 /* 799 * Token Ring doesn't really have a link-level type field. 800 * We set "off_linktype" to the offset of the LLC header. 801 * 802 * To check for Ethernet types, we assume that SSAP = SNAP 803 * is being used and pick out the encapsulated Ethernet type. 804 * XXX - should we generate code to check for SNAP? 805 * 806 * XXX - the header is actually variable-length. 807 * Some various Linux patched versions gave 38 808 * as "off_linktype" and 40 as "off_nl"; however, 809 * if a token ring packet has *no* routing 810 * information, i.e. is not source-routed, the correct 811 * values are 20 and 22, as they are in the vanilla code. 812 * 813 * A packet is source-routed iff the uppermost bit 814 * of the first byte of the source address, at an 815 * offset of 8, has the uppermost bit set. If the 816 * packet is source-routed, the total number of bytes 817 * of routing information is 2 plus bits 0x1F00 of 818 * the 16-bit value at an offset of 14 (shifted right 819 * 8 - figure out which byte that is). 820 */ 821 off_linktype = 14; 822 off_nl = 22; /* Token Ring+802.2+SNAP */ 823 off_nl_nosnap = 17; /* Token Ring+802.2 */ 824 return; 825 826 case DLT_IEEE802_11: 827 /* 828 * 802.11 doesn't really have a link-level type field. 829 * We set "off_linktype" to the offset of the LLC header. 830 * 831 * To check for Ethernet types, we assume that SSAP = SNAP 832 * is being used and pick out the encapsulated Ethernet type. 833 * XXX - should we generate code to check for SNAP? 834 * 835 * XXX - the header is actually variable-length. We 836 * assume a 24-byte link-layer header, as appears in 837 * data frames in networks with no bridges. If the 838 * fromds and tods 802.11 header bits are both set, 839 * it's actually supposed to be 30 bytes. 840 */ 841 off_linktype = 24; 842 off_nl = 32; /* 802.11+802.2+SNAP */ 843 off_nl_nosnap = 27; /* 802.11+802.2 */ 844 return; 845 846 case DLT_PRISM_HEADER: 847 /* 848 * Same as 802.11, but with an additional header before 849 * the 802.11 header, containing a bunch of additional 850 * information including radio-level information. 851 * 852 * The header is 144 bytes long. 853 * 854 * XXX - same variable-length header problem; at least 855 * the Prism header is fixed-length. 856 */ 857 off_linktype = 144+24; 858 off_nl = 144+32; /* Prism+802.11+802.2+SNAP */ 859 off_nl_nosnap = 144+27; /* Prism+802.11+802.2 */ 860 return; 861 862 case DLT_IEEE802_11_RADIO_AVS: 863 /* 864 * Same as 802.11, but with an additional header before 865 * the 802.11 header, containing a bunch of additional 866 * information including radio-level information. 867 * 868 * The header is 64 bytes long, at least in its 869 * current incarnation. 870 * 871 * XXX - same variable-length header problem, only 872 * more so; this header is also variable-length, 873 * with the length being the 32-bit big-endian 874 * number at an offset of 4 from the beginning 875 * of the radio header. 876 */ 877 off_linktype = 64+24; 878 off_nl = 64+32; /* Radio+802.11+802.2+SNAP */ 879 off_nl_nosnap = 64+27; /* Radio+802.11+802.2 */ 880 return; 881 882 case DLT_IEEE802_11_RADIO: 883 /* 884 * Same as 802.11, but with an additional header before 885 * the 802.11 header, containing a bunch of additional 886 * information including radio-level information. 887 * 888 * XXX - same variable-length header problem, only 889 * even *more* so; this header is also variable-length, 890 * with the length being the 16-bit number at an offset 891 * of 2 from the beginning of the radio header, and it's 892 * device-dependent (different devices might supply 893 * different amounts of information), so we can't even 894 * assume a fixed length for the current version of the 895 * header. 896 * 897 * Therefore, currently, only raw "link[N:M]" filtering is 898 * supported. 899 */ 900 off_linktype = -1; 901 off_nl = -1; 902 off_nl_nosnap = -1; 903 return; 904 905 case DLT_ATM_RFC1483: 906 case DLT_ATM_CLIP: /* Linux ATM defines this */ 907 /* 908 * assume routed, non-ISO PDUs 909 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 910 */ 911 off_linktype = 0; 912 off_nl = 8; /* 802.2+SNAP */ 913 off_nl_nosnap = 3; /* 802.2 */ 914 return; 915 916 case DLT_SUNATM: 917 /* 918 * Full Frontal ATM; you get AALn PDUs with an ATM 919 * pseudo-header. 920 */ 921 is_atm = 1; 922 off_vpi = SUNATM_VPI_POS; 923 off_vci = SUNATM_VCI_POS; 924 off_proto = PROTO_POS; 925 off_mac = -1; /* LLC-encapsulated, so no MAC-layer header */ 926 off_payload = SUNATM_PKT_BEGIN_POS; 927 off_linktype = off_payload; 928 off_nl = off_payload+8; /* 802.2+SNAP */ 929 off_nl_nosnap = off_payload+3; /* 802.2 */ 930 return; 931 932 case DLT_RAW: 933 off_linktype = -1; 934 off_nl = 0; 935 off_nl_nosnap = 0; /* no 802.2 LLC */ 936 return; 937 938 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 939 off_linktype = 14; 940 off_nl = 16; 941 off_nl_nosnap = 16; /* no 802.2 LLC */ 942 return; 943 944 case DLT_LTALK: 945 /* 946 * LocalTalk does have a 1-byte type field in the LLAP header, 947 * but really it just indicates whether there is a "short" or 948 * "long" DDP packet following. 949 */ 950 off_linktype = -1; 951 off_nl = 0; 952 off_nl_nosnap = 0; /* no 802.2 LLC */ 953 return; 954 955 case DLT_IP_OVER_FC: 956 /* 957 * RFC 2625 IP-over-Fibre-Channel doesn't really have a 958 * link-level type field. We set "off_linktype" to the 959 * offset of the LLC header. 960 * 961 * To check for Ethernet types, we assume that SSAP = SNAP 962 * is being used and pick out the encapsulated Ethernet type. 963 * XXX - should we generate code to check for SNAP? RFC 964 * 2625 says SNAP should be used. 965 */ 966 off_linktype = 16; 967 off_nl = 24; /* IPFC+802.2+SNAP */ 968 off_nl_nosnap = 19; /* IPFC+802.2 */ 969 return; 970 971 case DLT_FRELAY: 972 /* 973 * XXX - we should set this to handle SNAP-encapsulated 974 * frames (NLPID of 0x80). 975 */ 976 off_linktype = -1; 977 off_nl = 0; 978 off_nl_nosnap = 0; /* no 802.2 LLC */ 979 return; 980 981 case DLT_APPLE_IP_OVER_IEEE1394: 982 off_linktype = 16; 983 off_nl = 18; 984 off_nl_nosnap = 0; /* no 802.2 LLC */ 985 return; 986 987 case DLT_LINUX_IRDA: 988 /* 989 * Currently, only raw "link[N:M]" filtering is supported. 990 */ 991 off_linktype = -1; 992 off_nl = -1; 993 off_nl_nosnap = -1; 994 return; 995 996 case DLT_PFLOG: 997 off_linktype = 0; 998 /* XXX read from header? */ 999 off_nl = PFLOG_HDRLEN; 1000 off_nl_nosnap = PFLOG_HDRLEN; 1001 return; 1002 1003 #ifdef DLT_PFSYNC 1004 case DLT_PFSYNC: 1005 off_linktype = -1; 1006 off_nl = 4; 1007 off_nl_nosnap = 4; 1008 return; 1009 #endif 1010 } 1011 bpf_error("unknown data link type %d", linktype); 1012 /* NOTREACHED */ 1013 } 1014 1015 static struct block * 1016 gen_uncond(rsense) 1017 int rsense; 1018 { 1019 struct block *b; 1020 struct slist *s; 1021 1022 s = new_stmt(BPF_LD|BPF_IMM); 1023 s->s.k = !rsense; 1024 b = new_block(JMP(BPF_JEQ)); 1025 b->stmts = s; 1026 1027 return b; 1028 } 1029 1030 static inline struct block * 1031 gen_true() 1032 { 1033 return gen_uncond(1); 1034 } 1035 1036 static inline struct block * 1037 gen_false() 1038 { 1039 return gen_uncond(0); 1040 } 1041 1042 /* 1043 * Byte-swap a 32-bit number. 1044 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 1045 * big-endian platforms.) 1046 */ 1047 #define SWAPLONG(y) \ 1048 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 1049 1050 static struct block * 1051 gen_ether_linktype(proto) 1052 register int proto; 1053 { 1054 struct block *b0, *b1; 1055 1056 switch (proto) { 1057 1058 case LLCSAP_ISONS: 1059 /* 1060 * OSI protocols always use 802.2 encapsulation. 1061 * XXX - should we check both the DSAP and the 1062 * SSAP, like this, or should we check just the 1063 * DSAP? 1064 */ 1065 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 1066 gen_not(b0); 1067 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1068 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 1069 gen_and(b0, b1); 1070 return b1; 1071 1072 case LLCSAP_IP: 1073 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 1074 gen_not(b0); 1075 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1076 ((LLCSAP_IP << 8) | LLCSAP_IP)); 1077 gen_and(b0, b1); 1078 return b1; 1079 1080 case LLCSAP_NETBEUI: 1081 /* 1082 * NetBEUI always uses 802.2 encapsulation. 1083 * XXX - should we check both the DSAP and the 1084 * SSAP, like this, or should we check just the 1085 * DSAP? 1086 */ 1087 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 1088 gen_not(b0); 1089 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1090 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 1091 gen_and(b0, b1); 1092 return b1; 1093 1094 case LLCSAP_IPX: 1095 /* 1096 * Check for; 1097 * 1098 * Ethernet_II frames, which are Ethernet 1099 * frames with a frame type of ETHERTYPE_IPX; 1100 * 1101 * Ethernet_802.3 frames, which are 802.3 1102 * frames (i.e., the type/length field is 1103 * a length field, <= ETHERMTU, rather than 1104 * a type field) with the first two bytes 1105 * after the Ethernet/802.3 header being 1106 * 0xFFFF; 1107 * 1108 * Ethernet_802.2 frames, which are 802.3 1109 * frames with an 802.2 LLC header and 1110 * with the IPX LSAP as the DSAP in the LLC 1111 * header; 1112 * 1113 * Ethernet_SNAP frames, which are 802.3 1114 * frames with an LLC header and a SNAP 1115 * header and with an OUI of 0x000000 1116 * (encapsulated Ethernet) and a protocol 1117 * ID of ETHERTYPE_IPX in the SNAP header. 1118 * 1119 * XXX - should we generate the same code both 1120 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 1121 */ 1122 1123 /* 1124 * This generates code to check both for the 1125 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 1126 */ 1127 b0 = gen_cmp(off_linktype + 2, BPF_B, (bpf_int32)LLCSAP_IPX); 1128 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)0xFFFF); 1129 gen_or(b0, b1); 1130 1131 /* 1132 * Now we add code to check for SNAP frames with 1133 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 1134 */ 1135 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14); 1136 gen_or(b0, b1); 1137 1138 /* 1139 * Now we generate code to check for 802.3 1140 * frames in general. 1141 */ 1142 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 1143 gen_not(b0); 1144 1145 /* 1146 * Now add the check for 802.3 frames before the 1147 * check for Ethernet_802.2 and Ethernet_802.3, 1148 * as those checks should only be done on 802.3 1149 * frames, not on Ethernet frames. 1150 */ 1151 gen_and(b0, b1); 1152 1153 /* 1154 * Now add the check for Ethernet_II frames, and 1155 * do that before checking for the other frame 1156 * types. 1157 */ 1158 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)ETHERTYPE_IPX); 1159 gen_or(b0, b1); 1160 return b1; 1161 1162 case ETHERTYPE_ATALK: 1163 case ETHERTYPE_AARP: 1164 /* 1165 * EtherTalk (AppleTalk protocols on Ethernet link 1166 * layer) may use 802.2 encapsulation. 1167 */ 1168 1169 /* 1170 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1171 * we check for an Ethernet type field less than 1172 * 1500, which means it's an 802.3 length field. 1173 */ 1174 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 1175 gen_not(b0); 1176 1177 /* 1178 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1179 * SNAP packets with an organization code of 1180 * 0x080007 (Apple, for Appletalk) and a protocol 1181 * type of ETHERTYPE_ATALK (Appletalk). 1182 * 1183 * 802.2-encapsulated ETHERTYPE_AARP packets are 1184 * SNAP packets with an organization code of 1185 * 0x000000 (encapsulated Ethernet) and a protocol 1186 * type of ETHERTYPE_AARP (Appletalk ARP). 1187 */ 1188 if (proto == ETHERTYPE_ATALK) 1189 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14); 1190 else /* proto == ETHERTYPE_AARP */ 1191 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14); 1192 gen_and(b0, b1); 1193 1194 /* 1195 * Check for Ethernet encapsulation (Ethertalk 1196 * phase 1?); we just check for the Ethernet 1197 * protocol type. 1198 */ 1199 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1200 1201 gen_or(b0, b1); 1202 return b1; 1203 1204 default: 1205 if (proto <= ETHERMTU) { 1206 /* 1207 * This is an LLC SAP value, so the frames 1208 * that match would be 802.2 frames. 1209 * Check that the frame is an 802.2 frame 1210 * (i.e., that the length/type field is 1211 * a length field, <= ETHERMTU) and 1212 * then check the DSAP. 1213 */ 1214 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 1215 gen_not(b0); 1216 b1 = gen_cmp(off_linktype + 2, BPF_B, (bpf_int32)proto); 1217 gen_and(b0, b1); 1218 return b1; 1219 } else { 1220 /* 1221 * This is an Ethernet type, so compare 1222 * the length/type field with it (if 1223 * the frame is an 802.2 frame, the length 1224 * field will be <= ETHERMTU, and, as 1225 * "proto" is > ETHERMTU, this test 1226 * will fail and the frame won't match, 1227 * which is what we want). 1228 */ 1229 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1230 } 1231 } 1232 } 1233 1234 static struct block * 1235 gen_linktype(proto) 1236 register int proto; 1237 { 1238 struct block *b0, *b1, *b2; 1239 1240 switch (linktype) { 1241 1242 case DLT_EN10MB: 1243 return gen_ether_linktype(proto); 1244 break; 1245 1246 case DLT_C_HDLC: 1247 switch (proto) { 1248 1249 case LLCSAP_ISONS: 1250 proto = (proto << 8 | LLCSAP_ISONS); 1251 /* fall through */ 1252 1253 default: 1254 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1255 break; 1256 } 1257 break; 1258 1259 case DLT_IEEE802_11: 1260 case DLT_PRISM_HEADER: 1261 case DLT_IEEE802_11_RADIO: 1262 case DLT_FDDI: 1263 case DLT_IEEE802: 1264 case DLT_ATM_RFC1483: 1265 case DLT_ATM_CLIP: 1266 case DLT_IP_OVER_FC: 1267 return gen_llc(proto); 1268 break; 1269 1270 case DLT_SUNATM: 1271 /* 1272 * If "is_lane" is set, check for a LANE-encapsulated 1273 * version of this protocol, otherwise check for an 1274 * LLC-encapsulated version of this protocol. 1275 * 1276 * We assume LANE means Ethernet, not Token Ring. 1277 */ 1278 if (is_lane) { 1279 /* 1280 * Check that the packet doesn't begin with an 1281 * LE Control marker. (We've already generated 1282 * a test for LANE.) 1283 */ 1284 b0 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 1285 gen_not(b0); 1286 1287 /* 1288 * Now generate an Ethernet test. 1289 */ 1290 b1 = gen_ether_linktype(proto); 1291 gen_and(b0, b1); 1292 return b1; 1293 } else { 1294 /* 1295 * Check for LLC encapsulation and then check the 1296 * protocol. 1297 */ 1298 b0 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 1299 b1 = gen_llc(proto); 1300 gen_and(b0, b1); 1301 return b1; 1302 } 1303 1304 case DLT_LINUX_SLL: 1305 switch (proto) { 1306 1307 case LLCSAP_IP: 1308 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1309 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1310 ((LLCSAP_IP << 8) | LLCSAP_IP)); 1311 gen_and(b0, b1); 1312 return b1; 1313 1314 case LLCSAP_ISONS: 1315 /* 1316 * OSI protocols always use 802.2 encapsulation. 1317 * XXX - should we check both the DSAP and the 1318 * LSAP, like this, or should we check just the 1319 * DSAP? 1320 */ 1321 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1322 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1323 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 1324 gen_and(b0, b1); 1325 return b1; 1326 1327 case LLCSAP_NETBEUI: 1328 /* 1329 * NetBEUI always uses 802.2 encapsulation. 1330 * XXX - should we check both the DSAP and the 1331 * LSAP, like this, or should we check just the 1332 * DSAP? 1333 */ 1334 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1335 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1336 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 1337 gen_and(b0, b1); 1338 return b1; 1339 1340 case LLCSAP_IPX: 1341 /* 1342 * Ethernet_II frames, which are Ethernet 1343 * frames with a frame type of ETHERTYPE_IPX; 1344 * 1345 * Ethernet_802.3 frames, which have a frame 1346 * type of LINUX_SLL_P_802_3; 1347 * 1348 * Ethernet_802.2 frames, which are 802.3 1349 * frames with an 802.2 LLC header (i.e, have 1350 * a frame type of LINUX_SLL_P_802_2) and 1351 * with the IPX LSAP as the DSAP in the LLC 1352 * header; 1353 * 1354 * Ethernet_SNAP frames, which are 802.3 1355 * frames with an LLC header and a SNAP 1356 * header and with an OUI of 0x000000 1357 * (encapsulated Ethernet) and a protocol 1358 * ID of ETHERTYPE_IPX in the SNAP header. 1359 * 1360 * First, do the checks on LINUX_SLL_P_802_2 1361 * frames; generate the check for either 1362 * Ethernet_802.2 or Ethernet_SNAP frames, and 1363 * then put a check for LINUX_SLL_P_802_2 frames 1364 * before it. 1365 */ 1366 b0 = gen_cmp(off_linktype + 2, BPF_B, 1367 (bpf_int32)LLCSAP_IPX); 1368 b1 = gen_snap(0x000000, ETHERTYPE_IPX, 1369 off_linktype + 2); 1370 gen_or(b0, b1); 1371 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1372 gen_and(b0, b1); 1373 1374 /* 1375 * Now check for 802.3 frames and OR that with 1376 * the previous test. 1377 */ 1378 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3); 1379 gen_or(b0, b1); 1380 1381 /* 1382 * Now add the check for Ethernet_II frames, and 1383 * do that before checking for the other frame 1384 * types. 1385 */ 1386 b0 = gen_cmp(off_linktype, BPF_H, 1387 (bpf_int32)ETHERTYPE_IPX); 1388 gen_or(b0, b1); 1389 return b1; 1390 1391 case ETHERTYPE_ATALK: 1392 case ETHERTYPE_AARP: 1393 /* 1394 * EtherTalk (AppleTalk protocols on Ethernet link 1395 * layer) may use 802.2 encapsulation. 1396 */ 1397 1398 /* 1399 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1400 * we check for the 802.2 protocol type in the 1401 * "Ethernet type" field. 1402 */ 1403 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1404 1405 /* 1406 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1407 * SNAP packets with an organization code of 1408 * 0x080007 (Apple, for Appletalk) and a protocol 1409 * type of ETHERTYPE_ATALK (Appletalk). 1410 * 1411 * 802.2-encapsulated ETHERTYPE_AARP packets are 1412 * SNAP packets with an organization code of 1413 * 0x000000 (encapsulated Ethernet) and a protocol 1414 * type of ETHERTYPE_AARP (Appletalk ARP). 1415 */ 1416 if (proto == ETHERTYPE_ATALK) 1417 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 1418 off_linktype + 2); 1419 else /* proto == ETHERTYPE_AARP */ 1420 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 1421 off_linktype + 2); 1422 gen_and(b0, b1); 1423 1424 /* 1425 * Check for Ethernet encapsulation (Ethertalk 1426 * phase 1?); we just check for the Ethernet 1427 * protocol type. 1428 */ 1429 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1430 1431 gen_or(b0, b1); 1432 return b1; 1433 1434 default: 1435 if (proto <= ETHERMTU) { 1436 /* 1437 * This is an LLC SAP value, so the frames 1438 * that match would be 802.2 frames. 1439 * Check for the 802.2 protocol type 1440 * in the "Ethernet type" field, and 1441 * then check the DSAP. 1442 */ 1443 b0 = gen_cmp(off_linktype, BPF_H, 1444 LINUX_SLL_P_802_2); 1445 b1 = gen_cmp(off_linktype + 2, BPF_B, 1446 (bpf_int32)proto); 1447 gen_and(b0, b1); 1448 return b1; 1449 } else { 1450 /* 1451 * This is an Ethernet type, so compare 1452 * the length/type field with it (if 1453 * the frame is an 802.2 frame, the length 1454 * field will be <= ETHERMTU, and, as 1455 * "proto" is > ETHERMTU, this test 1456 * will fail and the frame won't match, 1457 * which is what we want). 1458 */ 1459 return gen_cmp(off_linktype, BPF_H, 1460 (bpf_int32)proto); 1461 } 1462 } 1463 break; 1464 1465 case DLT_SLIP: 1466 case DLT_SLIP_BSDOS: 1467 case DLT_RAW: 1468 /* 1469 * These types don't provide any type field; packets 1470 * are always IP. 1471 * 1472 * XXX - for IPv4, check for a version number of 4, and, 1473 * for IPv6, check for a version number of 6? 1474 */ 1475 switch (proto) { 1476 1477 case ETHERTYPE_IP: 1478 #ifdef INET6 1479 case ETHERTYPE_IPV6: 1480 #endif 1481 return gen_true(); /* always true */ 1482 1483 default: 1484 return gen_false(); /* always false */ 1485 } 1486 break; 1487 1488 case DLT_PPP: 1489 case DLT_PPP_SERIAL: 1490 case DLT_PPP_ETHER: 1491 /* 1492 * We use Ethernet protocol types inside libpcap; 1493 * map them to the corresponding PPP protocol types. 1494 */ 1495 switch (proto) { 1496 1497 case ETHERTYPE_IP: 1498 proto = PPP_IP; 1499 break; 1500 1501 #ifdef INET6 1502 case ETHERTYPE_IPV6: 1503 proto = PPP_IPV6; 1504 break; 1505 #endif 1506 1507 case ETHERTYPE_DN: 1508 proto = PPP_DECNET; 1509 break; 1510 1511 case ETHERTYPE_ATALK: 1512 proto = PPP_APPLE; 1513 break; 1514 1515 case ETHERTYPE_NS: 1516 proto = PPP_NS; 1517 break; 1518 1519 case LLCSAP_ISONS: 1520 proto = PPP_OSI; 1521 break; 1522 1523 case LLCSAP_8021D: 1524 /* 1525 * I'm assuming the "Bridging PDU"s that go 1526 * over PPP are Spanning Tree Protocol 1527 * Bridging PDUs. 1528 */ 1529 proto = PPP_BRPDU; 1530 break; 1531 1532 case LLCSAP_IPX: 1533 proto = PPP_IPX; 1534 break; 1535 } 1536 break; 1537 1538 case DLT_PPP_BSDOS: 1539 /* 1540 * We use Ethernet protocol types inside libpcap; 1541 * map them to the corresponding PPP protocol types. 1542 */ 1543 switch (proto) { 1544 1545 case ETHERTYPE_IP: 1546 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP); 1547 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC); 1548 gen_or(b0, b1); 1549 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC); 1550 gen_or(b1, b0); 1551 return b0; 1552 1553 #ifdef INET6 1554 case ETHERTYPE_IPV6: 1555 proto = PPP_IPV6; 1556 /* more to go? */ 1557 break; 1558 #endif 1559 1560 case ETHERTYPE_DN: 1561 proto = PPP_DECNET; 1562 break; 1563 1564 case ETHERTYPE_ATALK: 1565 proto = PPP_APPLE; 1566 break; 1567 1568 case ETHERTYPE_NS: 1569 proto = PPP_NS; 1570 break; 1571 1572 case LLCSAP_ISONS: 1573 proto = PPP_OSI; 1574 break; 1575 1576 case LLCSAP_8021D: 1577 /* 1578 * I'm assuming the "Bridging PDU"s that go 1579 * over PPP are Spanning Tree Protocol 1580 * Bridging PDUs. 1581 */ 1582 proto = PPP_BRPDU; 1583 break; 1584 1585 case LLCSAP_IPX: 1586 proto = PPP_IPX; 1587 break; 1588 } 1589 break; 1590 1591 case DLT_NULL: 1592 case DLT_LOOP: 1593 case DLT_ENC: 1594 /* 1595 * For DLT_NULL, the link-layer header is a 32-bit 1596 * word containing an AF_ value in *host* byte order, 1597 * and for DLT_ENC, the link-layer header begins 1598 * with a 32-bit work containing an AF_ value in 1599 * host byte order. 1600 * 1601 * In addition, if we're reading a saved capture file, 1602 * the host byte order in the capture may not be the 1603 * same as the host byte order on this machine. 1604 * 1605 * For DLT_LOOP, the link-layer header is a 32-bit 1606 * word containing an AF_ value in *network* byte order. 1607 * 1608 * XXX - AF_ values may, unfortunately, be platform- 1609 * dependent; for example, FreeBSD's AF_INET6 is 24 1610 * whilst NetBSD's and OpenBSD's is 26. 1611 * 1612 * This means that, when reading a capture file, just 1613 * checking for our AF_INET6 value won't work if the 1614 * capture file came from another OS. 1615 */ 1616 switch (proto) { 1617 1618 case ETHERTYPE_IP: 1619 proto = AF_INET; 1620 break; 1621 1622 #ifdef INET6 1623 case ETHERTYPE_IPV6: 1624 proto = AF_INET6; 1625 break; 1626 #endif 1627 1628 default: 1629 /* 1630 * Not a type on which we support filtering. 1631 * XXX - support those that have AF_ values 1632 * #defined on this platform, at least? 1633 */ 1634 return gen_false(); 1635 } 1636 1637 if (linktype == DLT_NULL || linktype == DLT_ENC) { 1638 /* 1639 * The AF_ value is in host byte order, but 1640 * the BPF interpreter will convert it to 1641 * network byte order. 1642 * 1643 * If this is a save file, and it's from a 1644 * machine with the opposite byte order to 1645 * ours, we byte-swap the AF_ value. 1646 * 1647 * Then we run it through "htonl()", and 1648 * generate code to compare against the result. 1649 */ 1650 if (bpf_pcap->sf.rfile != NULL && 1651 bpf_pcap->sf.swapped) 1652 proto = SWAPLONG(proto); 1653 proto = htonl(proto); 1654 } 1655 return (gen_cmp(0, BPF_W, (bpf_int32)proto)); 1656 1657 case DLT_PFLOG: 1658 /* 1659 * af field is host byte order in contrast to the rest of 1660 * the packet. 1661 */ 1662 if (proto == ETHERTYPE_IP) 1663 return (gen_cmp(offsetof(struct pfloghdr, af), BPF_B, 1664 (bpf_int32)AF_INET)); 1665 #ifdef INET6 1666 else if (proto == ETHERTYPE_IPV6) 1667 return (gen_cmp(offsetof(struct pfloghdr, af), BPF_B, 1668 (bpf_int32)AF_INET6)); 1669 #endif /* INET6 */ 1670 else 1671 return gen_false(); 1672 break; 1673 1674 case DLT_ARCNET: 1675 case DLT_ARCNET_LINUX: 1676 /* 1677 * XXX should we check for first fragment if the protocol 1678 * uses PHDS? 1679 */ 1680 switch (proto) { 1681 1682 default: 1683 return gen_false(); 1684 1685 #ifdef INET6 1686 case ETHERTYPE_IPV6: 1687 return (gen_cmp(off_linktype, BPF_B, 1688 (bpf_int32)ARCTYPE_INET6)); 1689 #endif /* INET6 */ 1690 1691 case ETHERTYPE_IP: 1692 b0 = gen_cmp(off_linktype, BPF_B, 1693 (bpf_int32)ARCTYPE_IP); 1694 b1 = gen_cmp(off_linktype, BPF_B, 1695 (bpf_int32)ARCTYPE_IP_OLD); 1696 gen_or(b0, b1); 1697 return (b1); 1698 1699 case ETHERTYPE_ARP: 1700 b0 = gen_cmp(off_linktype, BPF_B, 1701 (bpf_int32)ARCTYPE_ARP); 1702 b1 = gen_cmp(off_linktype, BPF_B, 1703 (bpf_int32)ARCTYPE_ARP_OLD); 1704 gen_or(b0, b1); 1705 return (b1); 1706 1707 case ETHERTYPE_REVARP: 1708 return (gen_cmp(off_linktype, BPF_B, 1709 (bpf_int32)ARCTYPE_REVARP)); 1710 1711 case ETHERTYPE_ATALK: 1712 return (gen_cmp(off_linktype, BPF_B, 1713 (bpf_int32)ARCTYPE_ATALK)); 1714 } 1715 break; 1716 1717 case DLT_LTALK: 1718 switch (proto) { 1719 case ETHERTYPE_ATALK: 1720 return gen_true(); 1721 default: 1722 return gen_false(); 1723 } 1724 break; 1725 1726 case DLT_FRELAY: 1727 /* 1728 * XXX - assumes a 2-byte Frame Relay header with 1729 * DLCI and flags. What if the address is longer? 1730 */ 1731 switch (proto) { 1732 1733 case ETHERTYPE_IP: 1734 /* 1735 * Check for the special NLPID for IP. 1736 */ 1737 return gen_cmp(2, BPF_H, (0x03<<8) | 0xcc); 1738 1739 #ifdef INET6 1740 case ETHERTYPE_IPV6: 1741 /* 1742 * Check for the special NLPID for IPv6. 1743 */ 1744 return gen_cmp(2, BPF_H, (0x03<<8) | 0x8e); 1745 #endif 1746 1747 case LLCSAP_ISONS: 1748 /* 1749 * Check for several OSI protocols. 1750 * 1751 * Frame Relay packets typically have an OSI 1752 * NLPID at the beginning; we check for each 1753 * of them. 1754 * 1755 * What we check for is the NLPID and a frame 1756 * control field of UI, i.e. 0x03 followed 1757 * by the NLPID. 1758 */ 1759 b0 = gen_cmp(2, BPF_H, (0x03<<8) | ISO8473_CLNP); 1760 b1 = gen_cmp(2, BPF_H, (0x03<<8) | ISO9542_ESIS); 1761 b2 = gen_cmp(2, BPF_H, (0x03<<8) | ISO10589_ISIS); 1762 gen_or(b1, b2); 1763 gen_or(b0, b2); 1764 return b2; 1765 1766 default: 1767 return gen_false(); 1768 } 1769 break; 1770 1771 case DLT_LINUX_IRDA: 1772 bpf_error("IrDA link-layer type filtering not implemented"); 1773 } 1774 1775 /* 1776 * All the types that have no encapsulation should either be 1777 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if 1778 * all packets are IP packets, or should be handled in some 1779 * special case, if none of them are (if some are and some 1780 * aren't, the lack of encapsulation is a problem, as we'd 1781 * have to find some other way of determining the packet type). 1782 * 1783 * Therefore, if "off_linktype" is -1, there's an error. 1784 */ 1785 if (off_linktype == (u_int)-1) 1786 abort(); 1787 1788 /* 1789 * Any type not handled above should always have an Ethernet 1790 * type at an offset of "off_linktype". (PPP is partially 1791 * handled above - the protocol type is mapped from the 1792 * Ethernet and LLC types we use internally to the corresponding 1793 * PPP type - but the PPP type is always specified by a value 1794 * at "off_linktype", so we don't have to do the code generation 1795 * above.) 1796 */ 1797 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1798 } 1799 1800 /* 1801 * Check for an LLC SNAP packet with a given organization code and 1802 * protocol type; we check the entire contents of the 802.2 LLC and 1803 * snap headers, checking for DSAP and SSAP of SNAP and a control 1804 * field of 0x03 in the LLC header, and for the specified organization 1805 * code and protocol type in the SNAP header. 1806 */ 1807 static struct block * 1808 gen_snap(orgcode, ptype, offset) 1809 bpf_u_int32 orgcode; 1810 bpf_u_int32 ptype; 1811 u_int offset; 1812 { 1813 u_char snapblock[8]; 1814 1815 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 1816 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ 1817 snapblock[2] = 0x03; /* control = UI */ 1818 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 1819 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 1820 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 1821 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 1822 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ 1823 return gen_bcmp(offset, 8, snapblock); 1824 } 1825 1826 /* 1827 * Check for a given protocol value assuming an 802.2 LLC header. 1828 */ 1829 static struct block * 1830 gen_llc(proto) 1831 int proto; 1832 { 1833 /* 1834 * XXX - handle token-ring variable-length header. 1835 */ 1836 switch (proto) { 1837 1838 case LLCSAP_IP: 1839 return gen_cmp(off_linktype, BPF_H, (long) 1840 ((LLCSAP_IP << 8) | LLCSAP_IP)); 1841 1842 case LLCSAP_ISONS: 1843 return gen_cmp(off_linktype, BPF_H, (long) 1844 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 1845 1846 case LLCSAP_NETBEUI: 1847 return gen_cmp(off_linktype, BPF_H, (long) 1848 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 1849 1850 case LLCSAP_IPX: 1851 /* 1852 * XXX - are there ever SNAP frames for IPX on 1853 * non-Ethernet 802.x networks? 1854 */ 1855 return gen_cmp(off_linktype, BPF_B, (bpf_int32)LLCSAP_IPX); 1856 1857 case ETHERTYPE_ATALK: 1858 /* 1859 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1860 * SNAP packets with an organization code of 1861 * 0x080007 (Apple, for Appletalk) and a protocol 1862 * type of ETHERTYPE_ATALK (Appletalk). 1863 * 1864 * XXX - check for an organization code of 1865 * encapsulated Ethernet as well? 1866 */ 1867 return gen_snap(0x080007, ETHERTYPE_ATALK, off_linktype); 1868 1869 default: 1870 /* 1871 * XXX - we don't have to check for IPX 802.3 1872 * here, but should we check for the IPX Ethertype? 1873 */ 1874 if (proto <= ETHERMTU) { 1875 /* 1876 * This is an LLC SAP value, so check 1877 * the DSAP. 1878 */ 1879 return gen_cmp(off_linktype, BPF_B, (bpf_int32)proto); 1880 } else { 1881 /* 1882 * This is an Ethernet type; we assume that it's 1883 * unlikely that it'll appear in the right place 1884 * at random, and therefore check only the 1885 * location that would hold the Ethernet type 1886 * in a SNAP frame with an organization code of 1887 * 0x000000 (encapsulated Ethernet). 1888 * 1889 * XXX - if we were to check for the SNAP DSAP and 1890 * LSAP, as per XXX, and were also to check for an 1891 * organization code of 0x000000 (encapsulated 1892 * Ethernet), we'd do 1893 * 1894 * return gen_snap(0x000000, proto, 1895 * off_linktype); 1896 * 1897 * here; for now, we don't, as per the above. 1898 * I don't know whether it's worth the extra CPU 1899 * time to do the right check or not. 1900 */ 1901 return gen_cmp(off_linktype+6, BPF_H, (bpf_int32)proto); 1902 } 1903 } 1904 } 1905 1906 static struct block * 1907 gen_hostop(addr, mask, dir, proto, src_off, dst_off) 1908 bpf_u_int32 addr; 1909 bpf_u_int32 mask; 1910 int dir, proto; 1911 u_int src_off, dst_off; 1912 { 1913 struct block *b0, *b1; 1914 u_int offset; 1915 1916 switch (dir) { 1917 1918 case Q_SRC: 1919 offset = src_off; 1920 break; 1921 1922 case Q_DST: 1923 offset = dst_off; 1924 break; 1925 1926 case Q_AND: 1927 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 1928 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 1929 gen_and(b0, b1); 1930 return b1; 1931 1932 case Q_OR: 1933 case Q_DEFAULT: 1934 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 1935 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 1936 gen_or(b0, b1); 1937 return b1; 1938 1939 default: 1940 abort(); 1941 } 1942 b0 = gen_linktype(proto); 1943 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask); 1944 gen_and(b0, b1); 1945 return b1; 1946 } 1947 1948 #ifdef INET6 1949 static struct block * 1950 gen_hostop6(addr, mask, dir, proto, src_off, dst_off) 1951 struct in6_addr *addr; 1952 struct in6_addr *mask; 1953 int dir, proto; 1954 u_int src_off, dst_off; 1955 { 1956 struct block *b0, *b1; 1957 u_int offset; 1958 u_int32_t *a, *m; 1959 1960 switch (dir) { 1961 1962 case Q_SRC: 1963 offset = src_off; 1964 break; 1965 1966 case Q_DST: 1967 offset = dst_off; 1968 break; 1969 1970 case Q_AND: 1971 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1972 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1973 gen_and(b0, b1); 1974 return b1; 1975 1976 case Q_OR: 1977 case Q_DEFAULT: 1978 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1979 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1980 gen_or(b0, b1); 1981 return b1; 1982 1983 default: 1984 abort(); 1985 } 1986 /* this order is important */ 1987 a = (u_int32_t *)addr; 1988 m = (u_int32_t *)mask; 1989 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 1990 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 1991 gen_and(b0, b1); 1992 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 1993 gen_and(b0, b1); 1994 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 1995 gen_and(b0, b1); 1996 b0 = gen_linktype(proto); 1997 gen_and(b0, b1); 1998 return b1; 1999 } 2000 #endif /*INET6*/ 2001 2002 static struct block * 2003 gen_ehostop(eaddr, dir) 2004 register const u_char *eaddr; 2005 register int dir; 2006 { 2007 register struct block *b0, *b1; 2008 2009 switch (dir) { 2010 case Q_SRC: 2011 return gen_bcmp(off_mac + 6, 6, eaddr); 2012 2013 case Q_DST: 2014 return gen_bcmp(off_mac + 0, 6, eaddr); 2015 2016 case Q_AND: 2017 b0 = gen_ehostop(eaddr, Q_SRC); 2018 b1 = gen_ehostop(eaddr, Q_DST); 2019 gen_and(b0, b1); 2020 return b1; 2021 2022 case Q_DEFAULT: 2023 case Q_OR: 2024 b0 = gen_ehostop(eaddr, Q_SRC); 2025 b1 = gen_ehostop(eaddr, Q_DST); 2026 gen_or(b0, b1); 2027 return b1; 2028 } 2029 abort(); 2030 /* NOTREACHED */ 2031 } 2032 2033 /* 2034 * Like gen_ehostop, but for DLT_FDDI 2035 */ 2036 static struct block * 2037 gen_fhostop(eaddr, dir) 2038 register const u_char *eaddr; 2039 register int dir; 2040 { 2041 struct block *b0, *b1; 2042 2043 switch (dir) { 2044 case Q_SRC: 2045 #ifdef PCAP_FDDIPAD 2046 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr); 2047 #else 2048 return gen_bcmp(6 + 1, 6, eaddr); 2049 #endif 2050 2051 case Q_DST: 2052 #ifdef PCAP_FDDIPAD 2053 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr); 2054 #else 2055 return gen_bcmp(0 + 1, 6, eaddr); 2056 #endif 2057 2058 case Q_AND: 2059 b0 = gen_fhostop(eaddr, Q_SRC); 2060 b1 = gen_fhostop(eaddr, Q_DST); 2061 gen_and(b0, b1); 2062 return b1; 2063 2064 case Q_DEFAULT: 2065 case Q_OR: 2066 b0 = gen_fhostop(eaddr, Q_SRC); 2067 b1 = gen_fhostop(eaddr, Q_DST); 2068 gen_or(b0, b1); 2069 return b1; 2070 } 2071 abort(); 2072 /* NOTREACHED */ 2073 } 2074 2075 /* 2076 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 2077 */ 2078 static struct block * 2079 gen_thostop(eaddr, dir) 2080 register const u_char *eaddr; 2081 register int dir; 2082 { 2083 register struct block *b0, *b1; 2084 2085 switch (dir) { 2086 case Q_SRC: 2087 return gen_bcmp(8, 6, eaddr); 2088 2089 case Q_DST: 2090 return gen_bcmp(2, 6, eaddr); 2091 2092 case Q_AND: 2093 b0 = gen_thostop(eaddr, Q_SRC); 2094 b1 = gen_thostop(eaddr, Q_DST); 2095 gen_and(b0, b1); 2096 return b1; 2097 2098 case Q_DEFAULT: 2099 case Q_OR: 2100 b0 = gen_thostop(eaddr, Q_SRC); 2101 b1 = gen_thostop(eaddr, Q_DST); 2102 gen_or(b0, b1); 2103 return b1; 2104 } 2105 abort(); 2106 /* NOTREACHED */ 2107 } 2108 2109 /* 2110 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) 2111 */ 2112 static struct block * 2113 gen_wlanhostop(eaddr, dir) 2114 register const u_char *eaddr; 2115 register int dir; 2116 { 2117 register struct block *b0, *b1, *b2; 2118 register struct slist *s; 2119 2120 switch (dir) { 2121 case Q_SRC: 2122 /* 2123 * Oh, yuk. 2124 * 2125 * For control frames, there is no SA. 2126 * 2127 * For management frames, SA is at an 2128 * offset of 10 from the beginning of 2129 * the packet. 2130 * 2131 * For data frames, SA is at an offset 2132 * of 10 from the beginning of the packet 2133 * if From DS is clear, at an offset of 2134 * 16 from the beginning of the packet 2135 * if From DS is set and To DS is clear, 2136 * and an offset of 24 from the beginning 2137 * of the packet if From DS is set and To DS 2138 * is set. 2139 */ 2140 2141 /* 2142 * Generate the tests to be done for data frames 2143 * with From DS set. 2144 * 2145 * First, check for To DS set, i.e. check "link[1] & 0x01". 2146 */ 2147 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2148 s->s.k = 1; 2149 b1 = new_block(JMP(BPF_JSET)); 2150 b1->s.k = 0x01; /* To DS */ 2151 b1->stmts = s; 2152 2153 /* 2154 * If To DS is set, the SA is at 24. 2155 */ 2156 b0 = gen_bcmp(24, 6, eaddr); 2157 gen_and(b1, b0); 2158 2159 /* 2160 * Now, check for To DS not set, i.e. check 2161 * "!(link[1] & 0x01)". 2162 */ 2163 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2164 s->s.k = 1; 2165 b2 = new_block(JMP(BPF_JSET)); 2166 b2->s.k = 0x01; /* To DS */ 2167 b2->stmts = s; 2168 gen_not(b2); 2169 2170 /* 2171 * If To DS is not set, the SA is at 16. 2172 */ 2173 b1 = gen_bcmp(16, 6, eaddr); 2174 gen_and(b2, b1); 2175 2176 /* 2177 * Now OR together the last two checks. That gives 2178 * the complete set of checks for data frames with 2179 * From DS set. 2180 */ 2181 gen_or(b1, b0); 2182 2183 /* 2184 * Now check for From DS being set, and AND that with 2185 * the ORed-together checks. 2186 */ 2187 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2188 s->s.k = 1; 2189 b1 = new_block(JMP(BPF_JSET)); 2190 b1->s.k = 0x02; /* From DS */ 2191 b1->stmts = s; 2192 gen_and(b1, b0); 2193 2194 /* 2195 * Now check for data frames with From DS not set. 2196 */ 2197 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2198 s->s.k = 1; 2199 b2 = new_block(JMP(BPF_JSET)); 2200 b2->s.k = 0x02; /* From DS */ 2201 b2->stmts = s; 2202 gen_not(b2); 2203 2204 /* 2205 * If From DS isn't set, the SA is at 10. 2206 */ 2207 b1 = gen_bcmp(10, 6, eaddr); 2208 gen_and(b2, b1); 2209 2210 /* 2211 * Now OR together the checks for data frames with 2212 * From DS not set and for data frames with From DS 2213 * set; that gives the checks done for data frames. 2214 */ 2215 gen_or(b1, b0); 2216 2217 /* 2218 * Now check for a data frame. 2219 * I.e, check "link[0] & 0x08". 2220 */ 2221 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2222 s->s.k = 0; 2223 b1 = new_block(JMP(BPF_JSET)); 2224 b1->s.k = 0x08; 2225 b1->stmts = s; 2226 2227 /* 2228 * AND that with the checks done for data frames. 2229 */ 2230 gen_and(b1, b0); 2231 2232 /* 2233 * If the high-order bit of the type value is 0, this 2234 * is a management frame. 2235 * I.e, check "!(link[0] & 0x08)". 2236 */ 2237 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2238 s->s.k = 0; 2239 b2 = new_block(JMP(BPF_JSET)); 2240 b2->s.k = 0x08; 2241 b2->stmts = s; 2242 gen_not(b2); 2243 2244 /* 2245 * For management frames, the SA is at 10. 2246 */ 2247 b1 = gen_bcmp(10, 6, eaddr); 2248 gen_and(b2, b1); 2249 2250 /* 2251 * OR that with the checks done for data frames. 2252 * That gives the checks done for management and 2253 * data frames. 2254 */ 2255 gen_or(b1, b0); 2256 2257 /* 2258 * If the low-order bit of the type value is 1, 2259 * this is either a control frame or a frame 2260 * with a reserved type, and thus not a 2261 * frame with an SA. 2262 * 2263 * I.e., check "!(link[0] & 0x04)". 2264 */ 2265 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2266 s->s.k = 0; 2267 b1 = new_block(JMP(BPF_JSET)); 2268 b1->s.k = 0x04; 2269 b1->stmts = s; 2270 gen_not(b1); 2271 2272 /* 2273 * AND that with the checks for data and management 2274 * frames. 2275 */ 2276 gen_and(b1, b0); 2277 return b0; 2278 2279 case Q_DST: 2280 /* 2281 * Oh, yuk. 2282 * 2283 * For control frames, there is no DA. 2284 * 2285 * For management frames, DA is at an 2286 * offset of 4 from the beginning of 2287 * the packet. 2288 * 2289 * For data frames, DA is at an offset 2290 * of 4 from the beginning of the packet 2291 * if To DS is clear and at an offset of 2292 * 16 from the beginning of the packet 2293 * if To DS is set. 2294 */ 2295 2296 /* 2297 * Generate the tests to be done for data frames. 2298 * 2299 * First, check for To DS set, i.e. "link[1] & 0x01". 2300 */ 2301 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2302 s->s.k = 1; 2303 b1 = new_block(JMP(BPF_JSET)); 2304 b1->s.k = 0x01; /* To DS */ 2305 b1->stmts = s; 2306 2307 /* 2308 * If To DS is set, the DA is at 16. 2309 */ 2310 b0 = gen_bcmp(16, 6, eaddr); 2311 gen_and(b1, b0); 2312 2313 /* 2314 * Now, check for To DS not set, i.e. check 2315 * "!(link[1] & 0x01)". 2316 */ 2317 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2318 s->s.k = 1; 2319 b2 = new_block(JMP(BPF_JSET)); 2320 b2->s.k = 0x01; /* To DS */ 2321 b2->stmts = s; 2322 gen_not(b2); 2323 2324 /* 2325 * If To DS is not set, the DA is at 4. 2326 */ 2327 b1 = gen_bcmp(4, 6, eaddr); 2328 gen_and(b2, b1); 2329 2330 /* 2331 * Now OR together the last two checks. That gives 2332 * the complete set of checks for data frames. 2333 */ 2334 gen_or(b1, b0); 2335 2336 /* 2337 * Now check for a data frame. 2338 * I.e, check "link[0] & 0x08". 2339 */ 2340 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2341 s->s.k = 0; 2342 b1 = new_block(JMP(BPF_JSET)); 2343 b1->s.k = 0x08; 2344 b1->stmts = s; 2345 2346 /* 2347 * AND that with the checks done for data frames. 2348 */ 2349 gen_and(b1, b0); 2350 2351 /* 2352 * If the high-order bit of the type value is 0, this 2353 * is a management frame. 2354 * I.e, check "!(link[0] & 0x08)". 2355 */ 2356 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2357 s->s.k = 0; 2358 b2 = new_block(JMP(BPF_JSET)); 2359 b2->s.k = 0x08; 2360 b2->stmts = s; 2361 gen_not(b2); 2362 2363 /* 2364 * For management frames, the DA is at 4. 2365 */ 2366 b1 = gen_bcmp(4, 6, eaddr); 2367 gen_and(b2, b1); 2368 2369 /* 2370 * OR that with the checks done for data frames. 2371 * That gives the checks done for management and 2372 * data frames. 2373 */ 2374 gen_or(b1, b0); 2375 2376 /* 2377 * If the low-order bit of the type value is 1, 2378 * this is either a control frame or a frame 2379 * with a reserved type, and thus not a 2380 * frame with an SA. 2381 * 2382 * I.e., check "!(link[0] & 0x04)". 2383 */ 2384 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 2385 s->s.k = 0; 2386 b1 = new_block(JMP(BPF_JSET)); 2387 b1->s.k = 0x04; 2388 b1->stmts = s; 2389 gen_not(b1); 2390 2391 /* 2392 * AND that with the checks for data and management 2393 * frames. 2394 */ 2395 gen_and(b1, b0); 2396 return b0; 2397 2398 case Q_AND: 2399 b0 = gen_wlanhostop(eaddr, Q_SRC); 2400 b1 = gen_wlanhostop(eaddr, Q_DST); 2401 gen_and(b0, b1); 2402 return b1; 2403 2404 case Q_DEFAULT: 2405 case Q_OR: 2406 b0 = gen_wlanhostop(eaddr, Q_SRC); 2407 b1 = gen_wlanhostop(eaddr, Q_DST); 2408 gen_or(b0, b1); 2409 return b1; 2410 } 2411 abort(); 2412 /* NOTREACHED */ 2413 } 2414 2415 /* 2416 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel. 2417 * (We assume that the addresses are IEEE 48-bit MAC addresses, 2418 * as the RFC states.) 2419 */ 2420 static struct block * 2421 gen_ipfchostop(eaddr, dir) 2422 register const u_char *eaddr; 2423 register int dir; 2424 { 2425 register struct block *b0, *b1; 2426 2427 switch (dir) { 2428 case Q_SRC: 2429 return gen_bcmp(10, 6, eaddr); 2430 2431 case Q_DST: 2432 return gen_bcmp(2, 6, eaddr); 2433 2434 case Q_AND: 2435 b0 = gen_ipfchostop(eaddr, Q_SRC); 2436 b1 = gen_ipfchostop(eaddr, Q_DST); 2437 gen_and(b0, b1); 2438 return b1; 2439 2440 case Q_DEFAULT: 2441 case Q_OR: 2442 b0 = gen_ipfchostop(eaddr, Q_SRC); 2443 b1 = gen_ipfchostop(eaddr, Q_DST); 2444 gen_or(b0, b1); 2445 return b1; 2446 } 2447 abort(); 2448 /* NOTREACHED */ 2449 } 2450 2451 /* 2452 * This is quite tricky because there may be pad bytes in front of the 2453 * DECNET header, and then there are two possible data packet formats that 2454 * carry both src and dst addresses, plus 5 packet types in a format that 2455 * carries only the src node, plus 2 types that use a different format and 2456 * also carry just the src node. 2457 * 2458 * Yuck. 2459 * 2460 * Instead of doing those all right, we just look for data packets with 2461 * 0 or 1 bytes of padding. If you want to look at other packets, that 2462 * will require a lot more hacking. 2463 * 2464 * To add support for filtering on DECNET "areas" (network numbers) 2465 * one would want to add a "mask" argument to this routine. That would 2466 * make the filter even more inefficient, although one could be clever 2467 * and not generate masking instructions if the mask is 0xFFFF. 2468 */ 2469 static struct block * 2470 gen_dnhostop(addr, dir, base_off) 2471 bpf_u_int32 addr; 2472 int dir; 2473 u_int base_off; 2474 { 2475 struct block *b0, *b1, *b2, *tmp; 2476 u_int offset_lh; /* offset if long header is received */ 2477 u_int offset_sh; /* offset if short header is received */ 2478 2479 switch (dir) { 2480 2481 case Q_DST: 2482 offset_sh = 1; /* follows flags */ 2483 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 2484 break; 2485 2486 case Q_SRC: 2487 offset_sh = 3; /* follows flags, dstnode */ 2488 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 2489 break; 2490 2491 case Q_AND: 2492 /* Inefficient because we do our Calvinball dance twice */ 2493 b0 = gen_dnhostop(addr, Q_SRC, base_off); 2494 b1 = gen_dnhostop(addr, Q_DST, base_off); 2495 gen_and(b0, b1); 2496 return b1; 2497 2498 case Q_OR: 2499 case Q_DEFAULT: 2500 /* Inefficient because we do our Calvinball dance twice */ 2501 b0 = gen_dnhostop(addr, Q_SRC, base_off); 2502 b1 = gen_dnhostop(addr, Q_DST, base_off); 2503 gen_or(b0, b1); 2504 return b1; 2505 2506 case Q_ISO: 2507 bpf_error("ISO host filtering not implemented"); 2508 2509 default: 2510 abort(); 2511 } 2512 b0 = gen_linktype(ETHERTYPE_DN); 2513 /* Check for pad = 1, long header case */ 2514 tmp = gen_mcmp(base_off + 2, BPF_H, 2515 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); 2516 b1 = gen_cmp(base_off + 2 + 1 + offset_lh, 2517 BPF_H, (bpf_int32)ntohs(addr)); 2518 gen_and(tmp, b1); 2519 /* Check for pad = 0, long header case */ 2520 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 2521 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); 2522 gen_and(tmp, b2); 2523 gen_or(b2, b1); 2524 /* Check for pad = 1, short header case */ 2525 tmp = gen_mcmp(base_off + 2, BPF_H, 2526 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); 2527 b2 = gen_cmp(base_off + 2 + 1 + offset_sh, 2528 BPF_H, (bpf_int32)ntohs(addr)); 2529 gen_and(tmp, b2); 2530 gen_or(b2, b1); 2531 /* Check for pad = 0, short header case */ 2532 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 2533 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); 2534 gen_and(tmp, b2); 2535 gen_or(b2, b1); 2536 2537 /* Combine with test for linktype */ 2538 gen_and(b0, b1); 2539 return b1; 2540 } 2541 2542 static struct block * 2543 gen_host(addr, mask, proto, dir) 2544 bpf_u_int32 addr; 2545 bpf_u_int32 mask; 2546 int proto; 2547 int dir; 2548 { 2549 struct block *b0, *b1; 2550 2551 switch (proto) { 2552 2553 case Q_DEFAULT: 2554 b0 = gen_host(addr, mask, Q_IP, dir); 2555 if (off_linktype != (u_int)-1) { 2556 b1 = gen_host(addr, mask, Q_ARP, dir); 2557 gen_or(b0, b1); 2558 b0 = gen_host(addr, mask, Q_RARP, dir); 2559 gen_or(b1, b0); 2560 } 2561 return b0; 2562 2563 case Q_IP: 2564 return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 2565 off_nl + 12, off_nl + 16); 2566 2567 case Q_RARP: 2568 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 2569 off_nl + 14, off_nl + 24); 2570 2571 case Q_ARP: 2572 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 2573 off_nl + 14, off_nl + 24); 2574 2575 case Q_TCP: 2576 bpf_error("'tcp' modifier applied to host"); 2577 2578 case Q_SCTP: 2579 bpf_error("'sctp' modifier applied to host"); 2580 2581 case Q_UDP: 2582 bpf_error("'udp' modifier applied to host"); 2583 2584 case Q_ICMP: 2585 bpf_error("'icmp' modifier applied to host"); 2586 2587 case Q_IGMP: 2588 bpf_error("'igmp' modifier applied to host"); 2589 2590 case Q_IGRP: 2591 bpf_error("'igrp' modifier applied to host"); 2592 2593 case Q_PIM: 2594 bpf_error("'pim' modifier applied to host"); 2595 2596 case Q_VRRP: 2597 bpf_error("'vrrp' modifier applied to host"); 2598 2599 case Q_ATALK: 2600 bpf_error("ATALK host filtering not implemented"); 2601 2602 case Q_AARP: 2603 bpf_error("AARP host filtering not implemented"); 2604 2605 case Q_DECNET: 2606 return gen_dnhostop(addr, dir, off_nl); 2607 2608 case Q_SCA: 2609 bpf_error("SCA host filtering not implemented"); 2610 2611 case Q_LAT: 2612 bpf_error("LAT host filtering not implemented"); 2613 2614 case Q_MOPDL: 2615 bpf_error("MOPDL host filtering not implemented"); 2616 2617 case Q_MOPRC: 2618 bpf_error("MOPRC host filtering not implemented"); 2619 2620 #ifdef INET6 2621 case Q_IPV6: 2622 bpf_error("'ip6' modifier applied to ip host"); 2623 2624 case Q_ICMPV6: 2625 bpf_error("'icmp6' modifier applied to host"); 2626 #endif /* INET6 */ 2627 2628 case Q_AH: 2629 bpf_error("'ah' modifier applied to host"); 2630 2631 case Q_ESP: 2632 bpf_error("'esp' modifier applied to host"); 2633 2634 case Q_ISO: 2635 bpf_error("ISO host filtering not implemented"); 2636 2637 case Q_ESIS: 2638 bpf_error("'esis' modifier applied to host"); 2639 2640 case Q_ISIS: 2641 bpf_error("'isis' modifier applied to host"); 2642 2643 case Q_CLNP: 2644 bpf_error("'clnp' modifier applied to host"); 2645 2646 case Q_STP: 2647 bpf_error("'stp' modifier applied to host"); 2648 2649 case Q_IPX: 2650 bpf_error("IPX host filtering not implemented"); 2651 2652 case Q_NETBEUI: 2653 bpf_error("'netbeui' modifier applied to host"); 2654 2655 default: 2656 abort(); 2657 } 2658 /* NOTREACHED */ 2659 } 2660 2661 #ifdef INET6 2662 static struct block * 2663 gen_host6(addr, mask, proto, dir) 2664 struct in6_addr *addr; 2665 struct in6_addr *mask; 2666 int proto; 2667 int dir; 2668 { 2669 switch (proto) { 2670 2671 case Q_DEFAULT: 2672 return gen_host6(addr, mask, Q_IPV6, dir); 2673 2674 case Q_IP: 2675 bpf_error("'ip' modifier applied to ip6 host"); 2676 2677 case Q_RARP: 2678 bpf_error("'rarp' modifier applied to ip6 host"); 2679 2680 case Q_ARP: 2681 bpf_error("'arp' modifier applied to ip6 host"); 2682 2683 case Q_SCTP: 2684 bpf_error("'sctp' modifier applied to host"); 2685 2686 case Q_TCP: 2687 bpf_error("'tcp' modifier applied to host"); 2688 2689 case Q_UDP: 2690 bpf_error("'udp' modifier applied to host"); 2691 2692 case Q_ICMP: 2693 bpf_error("'icmp' modifier applied to host"); 2694 2695 case Q_IGMP: 2696 bpf_error("'igmp' modifier applied to host"); 2697 2698 case Q_IGRP: 2699 bpf_error("'igrp' modifier applied to host"); 2700 2701 case Q_PIM: 2702 bpf_error("'pim' modifier applied to host"); 2703 2704 case Q_VRRP: 2705 bpf_error("'vrrp' modifier applied to host"); 2706 2707 case Q_ATALK: 2708 bpf_error("ATALK host filtering not implemented"); 2709 2710 case Q_AARP: 2711 bpf_error("AARP host filtering not implemented"); 2712 2713 case Q_DECNET: 2714 bpf_error("'decnet' modifier applied to ip6 host"); 2715 2716 case Q_SCA: 2717 bpf_error("SCA host filtering not implemented"); 2718 2719 case Q_LAT: 2720 bpf_error("LAT host filtering not implemented"); 2721 2722 case Q_MOPDL: 2723 bpf_error("MOPDL host filtering not implemented"); 2724 2725 case Q_MOPRC: 2726 bpf_error("MOPRC host filtering not implemented"); 2727 2728 case Q_IPV6: 2729 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 2730 off_nl + 8, off_nl + 24); 2731 2732 case Q_ICMPV6: 2733 bpf_error("'icmp6' modifier applied to host"); 2734 2735 case Q_AH: 2736 bpf_error("'ah' modifier applied to host"); 2737 2738 case Q_ESP: 2739 bpf_error("'esp' modifier applied to host"); 2740 2741 case Q_ISO: 2742 bpf_error("ISO host filtering not implemented"); 2743 2744 case Q_ESIS: 2745 bpf_error("'esis' modifier applied to host"); 2746 2747 case Q_ISIS: 2748 bpf_error("'isis' modifier applied to host"); 2749 2750 case Q_CLNP: 2751 bpf_error("'clnp' modifier applied to host"); 2752 2753 case Q_STP: 2754 bpf_error("'stp' modifier applied to host"); 2755 2756 case Q_IPX: 2757 bpf_error("IPX host filtering not implemented"); 2758 2759 case Q_NETBEUI: 2760 bpf_error("'netbeui' modifier applied to host"); 2761 2762 default: 2763 abort(); 2764 } 2765 /* NOTREACHED */ 2766 } 2767 #endif /*INET6*/ 2768 2769 #ifndef INET6 2770 static struct block * 2771 gen_gateway(eaddr, alist, proto, dir) 2772 const u_char *eaddr; 2773 bpf_u_int32 **alist; 2774 int proto; 2775 int dir; 2776 { 2777 struct block *b0, *b1, *tmp; 2778 2779 if (dir != 0) 2780 bpf_error("direction applied to 'gateway'"); 2781 2782 switch (proto) { 2783 case Q_DEFAULT: 2784 case Q_IP: 2785 case Q_ARP: 2786 case Q_RARP: 2787 if (linktype == DLT_EN10MB) 2788 b0 = gen_ehostop(eaddr, Q_OR); 2789 else if (linktype == DLT_FDDI) 2790 b0 = gen_fhostop(eaddr, Q_OR); 2791 else if (linktype == DLT_IEEE802) 2792 b0 = gen_thostop(eaddr, Q_OR); 2793 else if (linktype == DLT_IEEE802_11) 2794 b0 = gen_wlanhostop(eaddr, Q_OR); 2795 else if (linktype == DLT_SUNATM && is_lane) { 2796 /* 2797 * Check that the packet doesn't begin with an 2798 * LE Control marker. (We've already generated 2799 * a test for LANE.) 2800 */ 2801 b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 2802 gen_not(b1); 2803 2804 /* 2805 * Now check the MAC address. 2806 */ 2807 b0 = gen_ehostop(eaddr, Q_OR); 2808 gen_and(b1, b0); 2809 } else if (linktype == DLT_IP_OVER_FC) 2810 b0 = gen_ipfchostop(eaddr, Q_OR); 2811 else 2812 bpf_error( 2813 "'gateway' supported only on ethernet/FDDI/token ring/802.11/Fibre Channel"); 2814 2815 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR); 2816 while (*alist) { 2817 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR); 2818 gen_or(b1, tmp); 2819 b1 = tmp; 2820 } 2821 gen_not(b1); 2822 gen_and(b0, b1); 2823 return b1; 2824 } 2825 bpf_error("illegal modifier of 'gateway'"); 2826 /* NOTREACHED */ 2827 } 2828 #endif 2829 2830 struct block * 2831 gen_proto_abbrev(proto) 2832 int proto; 2833 { 2834 struct block *b0; 2835 struct block *b1; 2836 2837 switch (proto) { 2838 2839 case Q_SCTP: 2840 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT); 2841 #ifdef INET6 2842 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT); 2843 gen_or(b0, b1); 2844 #endif 2845 break; 2846 2847 case Q_TCP: 2848 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT); 2849 #ifdef INET6 2850 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 2851 gen_or(b0, b1); 2852 #endif 2853 break; 2854 2855 case Q_UDP: 2856 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT); 2857 #ifdef INET6 2858 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT); 2859 gen_or(b0, b1); 2860 #endif 2861 break; 2862 2863 case Q_ICMP: 2864 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT); 2865 break; 2866 2867 #ifndef IPPROTO_IGMP 2868 #define IPPROTO_IGMP 2 2869 #endif 2870 2871 case Q_IGMP: 2872 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT); 2873 break; 2874 2875 #ifndef IPPROTO_IGRP 2876 #define IPPROTO_IGRP 9 2877 #endif 2878 case Q_IGRP: 2879 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT); 2880 break; 2881 2882 #ifndef IPPROTO_PIM 2883 #define IPPROTO_PIM 103 2884 #endif 2885 2886 case Q_PIM: 2887 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT); 2888 #ifdef INET6 2889 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 2890 gen_or(b0, b1); 2891 #endif 2892 break; 2893 2894 #ifndef IPPROTO_VRRP 2895 #define IPPROTO_VRRP 112 2896 #endif 2897 2898 case Q_VRRP: 2899 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT); 2900 break; 2901 2902 case Q_IP: 2903 b1 = gen_linktype(ETHERTYPE_IP); 2904 break; 2905 2906 case Q_ARP: 2907 b1 = gen_linktype(ETHERTYPE_ARP); 2908 break; 2909 2910 case Q_RARP: 2911 b1 = gen_linktype(ETHERTYPE_REVARP); 2912 break; 2913 2914 case Q_LINK: 2915 bpf_error("link layer applied in wrong context"); 2916 2917 case Q_ATALK: 2918 b1 = gen_linktype(ETHERTYPE_ATALK); 2919 break; 2920 2921 case Q_AARP: 2922 b1 = gen_linktype(ETHERTYPE_AARP); 2923 break; 2924 2925 case Q_DECNET: 2926 b1 = gen_linktype(ETHERTYPE_DN); 2927 break; 2928 2929 case Q_SCA: 2930 b1 = gen_linktype(ETHERTYPE_SCA); 2931 break; 2932 2933 case Q_LAT: 2934 b1 = gen_linktype(ETHERTYPE_LAT); 2935 break; 2936 2937 case Q_MOPDL: 2938 b1 = gen_linktype(ETHERTYPE_MOPDL); 2939 break; 2940 2941 case Q_MOPRC: 2942 b1 = gen_linktype(ETHERTYPE_MOPRC); 2943 break; 2944 2945 #ifdef INET6 2946 case Q_IPV6: 2947 b1 = gen_linktype(ETHERTYPE_IPV6); 2948 break; 2949 2950 #ifndef IPPROTO_ICMPV6 2951 #define IPPROTO_ICMPV6 58 2952 #endif 2953 case Q_ICMPV6: 2954 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 2955 break; 2956 #endif /* INET6 */ 2957 2958 #ifndef IPPROTO_AH 2959 #define IPPROTO_AH 51 2960 #endif 2961 case Q_AH: 2962 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT); 2963 #ifdef INET6 2964 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT); 2965 gen_or(b0, b1); 2966 #endif 2967 break; 2968 2969 #ifndef IPPROTO_ESP 2970 #define IPPROTO_ESP 50 2971 #endif 2972 case Q_ESP: 2973 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT); 2974 #ifdef INET6 2975 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 2976 gen_or(b0, b1); 2977 #endif 2978 break; 2979 2980 case Q_ISO: 2981 b1 = gen_linktype(LLCSAP_ISONS); 2982 break; 2983 2984 case Q_ESIS: 2985 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT); 2986 break; 2987 2988 case Q_ISIS: 2989 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 2990 break; 2991 2992 case Q_ISIS_L1: /* all IS-IS Level1 PDU-Types */ 2993 b0 = gen_proto(ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 2994 b1 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 2995 gen_or(b0, b1); 2996 b0 = gen_proto(ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 2997 gen_or(b0, b1); 2998 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 2999 gen_or(b0, b1); 3000 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 3001 gen_or(b0, b1); 3002 break; 3003 3004 case Q_ISIS_L2: /* all IS-IS Level2 PDU-Types */ 3005 b0 = gen_proto(ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 3006 b1 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 3007 gen_or(b0, b1); 3008 b0 = gen_proto(ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 3009 gen_or(b0, b1); 3010 b0 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 3011 gen_or(b0, b1); 3012 b0 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 3013 gen_or(b0, b1); 3014 break; 3015 3016 case Q_ISIS_IIH: /* all IS-IS Hello PDU-Types */ 3017 b0 = gen_proto(ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 3018 b1 = gen_proto(ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 3019 gen_or(b0, b1); 3020 b0 = gen_proto(ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); 3021 gen_or(b0, b1); 3022 break; 3023 3024 case Q_ISIS_LSP: 3025 b0 = gen_proto(ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 3026 b1 = gen_proto(ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 3027 gen_or(b0, b1); 3028 break; 3029 3030 case Q_ISIS_SNP: 3031 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 3032 b1 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 3033 gen_or(b0, b1); 3034 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 3035 gen_or(b0, b1); 3036 b0 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 3037 gen_or(b0, b1); 3038 break; 3039 3040 case Q_ISIS_CSNP: 3041 b0 = gen_proto(ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 3042 b1 = gen_proto(ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 3043 gen_or(b0, b1); 3044 break; 3045 3046 case Q_ISIS_PSNP: 3047 b0 = gen_proto(ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 3048 b1 = gen_proto(ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 3049 gen_or(b0, b1); 3050 break; 3051 3052 case Q_CLNP: 3053 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT); 3054 break; 3055 3056 case Q_STP: 3057 b1 = gen_linktype(LLCSAP_8021D); 3058 break; 3059 3060 case Q_IPX: 3061 b1 = gen_linktype(LLCSAP_IPX); 3062 break; 3063 3064 case Q_NETBEUI: 3065 b1 = gen_linktype(LLCSAP_NETBEUI); 3066 break; 3067 3068 default: 3069 abort(); 3070 } 3071 return b1; 3072 } 3073 3074 static struct block * 3075 gen_ipfrag() 3076 { 3077 struct slist *s; 3078 struct block *b; 3079 3080 /* not ip frag */ 3081 s = new_stmt(BPF_LD|BPF_H|BPF_ABS); 3082 s->s.k = off_nl + 6; 3083 b = new_block(JMP(BPF_JSET)); 3084 b->s.k = 0x1fff; 3085 b->stmts = s; 3086 gen_not(b); 3087 3088 return b; 3089 } 3090 3091 static struct block * 3092 gen_portatom(off, v) 3093 int off; 3094 bpf_int32 v; 3095 { 3096 struct slist *s; 3097 struct block *b; 3098 3099 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 3100 s->s.k = off_nl; 3101 3102 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H); 3103 s->next->s.k = off_nl + off; 3104 3105 b = new_block(JMP(BPF_JEQ)); 3106 b->stmts = s; 3107 b->s.k = v; 3108 3109 return b; 3110 } 3111 3112 #ifdef INET6 3113 static struct block * 3114 gen_portatom6(off, v) 3115 int off; 3116 bpf_int32 v; 3117 { 3118 return gen_cmp(off_nl + 40 + off, BPF_H, v); 3119 } 3120 #endif/*INET6*/ 3121 3122 struct block * 3123 gen_portop(port, proto, dir) 3124 int port, proto, dir; 3125 { 3126 struct block *b0, *b1, *tmp; 3127 3128 /* ip proto 'proto' */ 3129 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto); 3130 b0 = gen_ipfrag(); 3131 gen_and(tmp, b0); 3132 3133 switch (dir) { 3134 case Q_SRC: 3135 b1 = gen_portatom(0, (bpf_int32)port); 3136 break; 3137 3138 case Q_DST: 3139 b1 = gen_portatom(2, (bpf_int32)port); 3140 break; 3141 3142 case Q_OR: 3143 case Q_DEFAULT: 3144 tmp = gen_portatom(0, (bpf_int32)port); 3145 b1 = gen_portatom(2, (bpf_int32)port); 3146 gen_or(tmp, b1); 3147 break; 3148 3149 case Q_AND: 3150 tmp = gen_portatom(0, (bpf_int32)port); 3151 b1 = gen_portatom(2, (bpf_int32)port); 3152 gen_and(tmp, b1); 3153 break; 3154 3155 default: 3156 abort(); 3157 } 3158 gen_and(b0, b1); 3159 3160 return b1; 3161 } 3162 3163 static struct block * 3164 gen_port(port, ip_proto, dir) 3165 int port; 3166 int ip_proto; 3167 int dir; 3168 { 3169 struct block *b0, *b1, *tmp; 3170 3171 /* 3172 * ether proto ip 3173 * 3174 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 3175 * not LLC encapsulation with LLCSAP_IP. 3176 * 3177 * For IEEE 802 networks - which includes 802.5 token ring 3178 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 3179 * says that SNAP encapsulation is used, not LLC encapsulation 3180 * with LLCSAP_IP. 3181 * 3182 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 3183 * RFC 2225 say that SNAP encapsulation is used, not LLC 3184 * encapsulation with LLCSAP_IP. 3185 * 3186 * So we always check for ETHERTYPE_IP. 3187 */ 3188 b0 = gen_linktype(ETHERTYPE_IP); 3189 3190 switch (ip_proto) { 3191 case IPPROTO_UDP: 3192 case IPPROTO_TCP: 3193 case IPPROTO_SCTP: 3194 b1 = gen_portop(port, ip_proto, dir); 3195 break; 3196 3197 case PROTO_UNDEF: 3198 tmp = gen_portop(port, IPPROTO_TCP, dir); 3199 b1 = gen_portop(port, IPPROTO_UDP, dir); 3200 gen_or(tmp, b1); 3201 tmp = gen_portop(port, IPPROTO_SCTP, dir); 3202 gen_or(tmp, b1); 3203 break; 3204 3205 default: 3206 abort(); 3207 } 3208 gen_and(b0, b1); 3209 return b1; 3210 } 3211 3212 #ifdef INET6 3213 struct block * 3214 gen_portop6(port, proto, dir) 3215 int port, proto, dir; 3216 { 3217 struct block *b0, *b1, *tmp; 3218 3219 /* ip proto 'proto' */ 3220 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto); 3221 3222 switch (dir) { 3223 case Q_SRC: 3224 b1 = gen_portatom6(0, (bpf_int32)port); 3225 break; 3226 3227 case Q_DST: 3228 b1 = gen_portatom6(2, (bpf_int32)port); 3229 break; 3230 3231 case Q_OR: 3232 case Q_DEFAULT: 3233 tmp = gen_portatom6(0, (bpf_int32)port); 3234 b1 = gen_portatom6(2, (bpf_int32)port); 3235 gen_or(tmp, b1); 3236 break; 3237 3238 case Q_AND: 3239 tmp = gen_portatom6(0, (bpf_int32)port); 3240 b1 = gen_portatom6(2, (bpf_int32)port); 3241 gen_and(tmp, b1); 3242 break; 3243 3244 default: 3245 abort(); 3246 } 3247 gen_and(b0, b1); 3248 3249 return b1; 3250 } 3251 3252 static struct block * 3253 gen_port6(port, ip_proto, dir) 3254 int port; 3255 int ip_proto; 3256 int dir; 3257 { 3258 struct block *b0, *b1, *tmp; 3259 3260 /* ether proto ip */ 3261 b0 = gen_linktype(ETHERTYPE_IPV6); 3262 3263 switch (ip_proto) { 3264 case IPPROTO_UDP: 3265 case IPPROTO_TCP: 3266 case IPPROTO_SCTP: 3267 b1 = gen_portop6(port, ip_proto, dir); 3268 break; 3269 3270 case PROTO_UNDEF: 3271 tmp = gen_portop6(port, IPPROTO_TCP, dir); 3272 b1 = gen_portop6(port, IPPROTO_UDP, dir); 3273 gen_or(tmp, b1); 3274 tmp = gen_portop6(port, IPPROTO_SCTP, dir); 3275 gen_or(tmp, b1); 3276 break; 3277 3278 default: 3279 abort(); 3280 } 3281 gen_and(b0, b1); 3282 return b1; 3283 } 3284 #endif /* INET6 */ 3285 3286 static int 3287 lookup_proto(name, proto) 3288 register const char *name; 3289 register int proto; 3290 { 3291 register int v; 3292 3293 switch (proto) { 3294 3295 case Q_DEFAULT: 3296 case Q_IP: 3297 case Q_IPV6: 3298 v = pcap_nametoproto(name); 3299 if (v == PROTO_UNDEF) 3300 bpf_error("unknown ip proto '%s'", name); 3301 break; 3302 3303 case Q_LINK: 3304 /* XXX should look up h/w protocol type based on linktype */ 3305 v = pcap_nametoeproto(name); 3306 if (v == PROTO_UNDEF) 3307 bpf_error("unknown ether proto '%s'", name); 3308 break; 3309 3310 case Q_ISO: 3311 if (strcmp(name, "esis") == 0) 3312 v = ISO9542_ESIS; 3313 else if (strcmp(name, "isis") == 0) 3314 v = ISO10589_ISIS; 3315 else if (strcmp(name, "clnp") == 0) 3316 v = ISO8473_CLNP; 3317 else 3318 bpf_error("unknown osi proto '%s'", name); 3319 break; 3320 3321 default: 3322 v = PROTO_UNDEF; 3323 break; 3324 } 3325 return v; 3326 } 3327 3328 #if 0 3329 struct stmt * 3330 gen_joinsp(s, n) 3331 struct stmt **s; 3332 int n; 3333 { 3334 return NULL; 3335 } 3336 #endif 3337 3338 static struct block * 3339 gen_protochain(v, proto, dir) 3340 int v; 3341 int proto; 3342 int dir; 3343 { 3344 #ifdef NO_PROTOCHAIN 3345 return gen_proto(v, proto, dir); 3346 #else 3347 struct block *b0, *b; 3348 struct slist *s[100]; 3349 int fix2, fix3, fix4, fix5; 3350 int ahcheck, again, end; 3351 int i, max; 3352 int reg2 = alloc_reg(); 3353 3354 memset(s, 0, sizeof(s)); 3355 fix2 = fix3 = fix4 = fix5 = 0; 3356 3357 switch (proto) { 3358 case Q_IP: 3359 case Q_IPV6: 3360 break; 3361 case Q_DEFAULT: 3362 b0 = gen_protochain(v, Q_IP, dir); 3363 b = gen_protochain(v, Q_IPV6, dir); 3364 gen_or(b0, b); 3365 return b; 3366 default: 3367 bpf_error("bad protocol applied for 'protochain'"); 3368 /*NOTREACHED*/ 3369 } 3370 3371 no_optimize = 1; /*this code is not compatible with optimzer yet */ 3372 3373 /* 3374 * s[0] is a dummy entry to protect other BPF insn from damaged 3375 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 3376 * hard to find interdependency made by jump table fixup. 3377 */ 3378 i = 0; 3379 s[i] = new_stmt(0); /*dummy*/ 3380 i++; 3381 3382 switch (proto) { 3383 case Q_IP: 3384 b0 = gen_linktype(ETHERTYPE_IP); 3385 3386 /* A = ip->ip_p */ 3387 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 3388 s[i]->s.k = off_nl + 9; 3389 i++; 3390 /* X = ip->ip_hl << 2 */ 3391 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 3392 s[i]->s.k = off_nl; 3393 i++; 3394 break; 3395 #ifdef INET6 3396 case Q_IPV6: 3397 b0 = gen_linktype(ETHERTYPE_IPV6); 3398 3399 /* A = ip6->ip_nxt */ 3400 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 3401 s[i]->s.k = off_nl + 6; 3402 i++; 3403 /* X = sizeof(struct ip6_hdr) */ 3404 s[i] = new_stmt(BPF_LDX|BPF_IMM); 3405 s[i]->s.k = 40; 3406 i++; 3407 break; 3408 #endif 3409 default: 3410 bpf_error("unsupported proto to gen_protochain"); 3411 /*NOTREACHED*/ 3412 } 3413 3414 /* again: if (A == v) goto end; else fall through; */ 3415 again = i; 3416 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3417 s[i]->s.k = v; 3418 s[i]->s.jt = NULL; /*later*/ 3419 s[i]->s.jf = NULL; /*update in next stmt*/ 3420 fix5 = i; 3421 i++; 3422 3423 #ifndef IPPROTO_NONE 3424 #define IPPROTO_NONE 59 3425 #endif 3426 /* if (A == IPPROTO_NONE) goto end */ 3427 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3428 s[i]->s.jt = NULL; /*later*/ 3429 s[i]->s.jf = NULL; /*update in next stmt*/ 3430 s[i]->s.k = IPPROTO_NONE; 3431 s[fix5]->s.jf = s[i]; 3432 fix2 = i; 3433 i++; 3434 3435 #ifdef INET6 3436 if (proto == Q_IPV6) { 3437 int v6start, v6end, v6advance, j; 3438 3439 v6start = i; 3440 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 3441 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3442 s[i]->s.jt = NULL; /*later*/ 3443 s[i]->s.jf = NULL; /*update in next stmt*/ 3444 s[i]->s.k = IPPROTO_HOPOPTS; 3445 s[fix2]->s.jf = s[i]; 3446 i++; 3447 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 3448 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3449 s[i]->s.jt = NULL; /*later*/ 3450 s[i]->s.jf = NULL; /*update in next stmt*/ 3451 s[i]->s.k = IPPROTO_DSTOPTS; 3452 i++; 3453 /* if (A == IPPROTO_ROUTING) goto v6advance */ 3454 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3455 s[i]->s.jt = NULL; /*later*/ 3456 s[i]->s.jf = NULL; /*update in next stmt*/ 3457 s[i]->s.k = IPPROTO_ROUTING; 3458 i++; 3459 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 3460 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3461 s[i]->s.jt = NULL; /*later*/ 3462 s[i]->s.jf = NULL; /*later*/ 3463 s[i]->s.k = IPPROTO_FRAGMENT; 3464 fix3 = i; 3465 v6end = i; 3466 i++; 3467 3468 /* v6advance: */ 3469 v6advance = i; 3470 3471 /* 3472 * in short, 3473 * A = P[X]; 3474 * X = X + (P[X + 1] + 1) * 8; 3475 */ 3476 /* A = X */ 3477 s[i] = new_stmt(BPF_MISC|BPF_TXA); 3478 i++; 3479 /* A = P[X + packet head] */ 3480 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 3481 s[i]->s.k = off_nl; 3482 i++; 3483 /* MEM[reg2] = A */ 3484 s[i] = new_stmt(BPF_ST); 3485 s[i]->s.k = reg2; 3486 i++; 3487 /* A = X */ 3488 s[i] = new_stmt(BPF_MISC|BPF_TXA); 3489 i++; 3490 /* A += 1 */ 3491 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 3492 s[i]->s.k = 1; 3493 i++; 3494 /* X = A */ 3495 s[i] = new_stmt(BPF_MISC|BPF_TAX); 3496 i++; 3497 /* A = P[X + packet head]; */ 3498 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 3499 s[i]->s.k = off_nl; 3500 i++; 3501 /* A += 1 */ 3502 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 3503 s[i]->s.k = 1; 3504 i++; 3505 /* A *= 8 */ 3506 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 3507 s[i]->s.k = 8; 3508 i++; 3509 /* X = A; */ 3510 s[i] = new_stmt(BPF_MISC|BPF_TAX); 3511 i++; 3512 /* A = MEM[reg2] */ 3513 s[i] = new_stmt(BPF_LD|BPF_MEM); 3514 s[i]->s.k = reg2; 3515 i++; 3516 3517 /* goto again; (must use BPF_JA for backward jump) */ 3518 s[i] = new_stmt(BPF_JMP|BPF_JA); 3519 s[i]->s.k = again - i - 1; 3520 s[i - 1]->s.jf = s[i]; 3521 i++; 3522 3523 /* fixup */ 3524 for (j = v6start; j <= v6end; j++) 3525 s[j]->s.jt = s[v6advance]; 3526 } else 3527 #endif 3528 { 3529 /* nop */ 3530 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 3531 s[i]->s.k = 0; 3532 s[fix2]->s.jf = s[i]; 3533 i++; 3534 } 3535 3536 /* ahcheck: */ 3537 ahcheck = i; 3538 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 3539 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 3540 s[i]->s.jt = NULL; /*later*/ 3541 s[i]->s.jf = NULL; /*later*/ 3542 s[i]->s.k = IPPROTO_AH; 3543 if (fix3) 3544 s[fix3]->s.jf = s[ahcheck]; 3545 fix4 = i; 3546 i++; 3547 3548 /* 3549 * in short, 3550 * A = P[X]; 3551 * X = X + (P[X + 1] + 2) * 4; 3552 */ 3553 /* A = X */ 3554 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 3555 i++; 3556 /* A = P[X + packet head]; */ 3557 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 3558 s[i]->s.k = off_nl; 3559 i++; 3560 /* MEM[reg2] = A */ 3561 s[i] = new_stmt(BPF_ST); 3562 s[i]->s.k = reg2; 3563 i++; 3564 /* A = X */ 3565 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 3566 i++; 3567 /* A += 1 */ 3568 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 3569 s[i]->s.k = 1; 3570 i++; 3571 /* X = A */ 3572 s[i] = new_stmt(BPF_MISC|BPF_TAX); 3573 i++; 3574 /* A = P[X + packet head] */ 3575 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 3576 s[i]->s.k = off_nl; 3577 i++; 3578 /* A += 2 */ 3579 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 3580 s[i]->s.k = 2; 3581 i++; 3582 /* A *= 4 */ 3583 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 3584 s[i]->s.k = 4; 3585 i++; 3586 /* X = A; */ 3587 s[i] = new_stmt(BPF_MISC|BPF_TAX); 3588 i++; 3589 /* A = MEM[reg2] */ 3590 s[i] = new_stmt(BPF_LD|BPF_MEM); 3591 s[i]->s.k = reg2; 3592 i++; 3593 3594 /* goto again; (must use BPF_JA for backward jump) */ 3595 s[i] = new_stmt(BPF_JMP|BPF_JA); 3596 s[i]->s.k = again - i - 1; 3597 i++; 3598 3599 /* end: nop */ 3600 end = i; 3601 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 3602 s[i]->s.k = 0; 3603 s[fix2]->s.jt = s[end]; 3604 s[fix4]->s.jf = s[end]; 3605 s[fix5]->s.jt = s[end]; 3606 i++; 3607 3608 /* 3609 * make slist chain 3610 */ 3611 max = i; 3612 for (i = 0; i < max - 1; i++) 3613 s[i]->next = s[i + 1]; 3614 s[max - 1]->next = NULL; 3615 3616 /* 3617 * emit final check 3618 */ 3619 b = new_block(JMP(BPF_JEQ)); 3620 b->stmts = s[1]; /*remember, s[0] is dummy*/ 3621 b->s.k = v; 3622 3623 free_reg(reg2); 3624 3625 gen_and(b0, b); 3626 return b; 3627 #endif 3628 } 3629 3630 static struct block * 3631 gen_proto(v, proto, dir) 3632 int v; 3633 int proto; 3634 int dir; 3635 { 3636 struct block *b0, *b1; 3637 3638 if (dir != Q_DEFAULT) 3639 bpf_error("direction applied to 'proto'"); 3640 3641 switch (proto) { 3642 case Q_DEFAULT: 3643 #ifdef INET6 3644 b0 = gen_proto(v, Q_IP, dir); 3645 b1 = gen_proto(v, Q_IPV6, dir); 3646 gen_or(b0, b1); 3647 return b1; 3648 #else 3649 /*FALLTHROUGH*/ 3650 #endif 3651 case Q_IP: 3652 /* 3653 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 3654 * not LLC encapsulation with LLCSAP_IP. 3655 * 3656 * For IEEE 802 networks - which includes 802.5 token ring 3657 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 3658 * says that SNAP encapsulation is used, not LLC encapsulation 3659 * with LLCSAP_IP. 3660 * 3661 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 3662 * RFC 2225 say that SNAP encapsulation is used, not LLC 3663 * encapsulation with LLCSAP_IP. 3664 * 3665 * So we always check for ETHERTYPE_IP. 3666 */ 3667 b0 = gen_linktype(ETHERTYPE_IP); 3668 #ifndef CHASE_CHAIN 3669 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v); 3670 #else 3671 b1 = gen_protochain(v, Q_IP); 3672 #endif 3673 gen_and(b0, b1); 3674 return b1; 3675 3676 case Q_ISO: 3677 switch (linktype) { 3678 3679 case DLT_FRELAY: 3680 /* 3681 * Frame Relay packets typically have an OSI 3682 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)" 3683 * generates code to check for all the OSI 3684 * NLPIDs, so calling it and then adding a check 3685 * for the particular NLPID for which we're 3686 * looking is bogus, as we can just check for 3687 * the NLPID. 3688 * 3689 * What we check for is the NLPID and a frame 3690 * control field value of UI, i.e. 0x03 followed 3691 * by the NLPID. 3692 * 3693 * XXX - assumes a 2-byte Frame Relay header with 3694 * DLCI and flags. What if the address is longer? 3695 * 3696 * XXX - what about SNAP-encapsulated frames? 3697 */ 3698 return gen_cmp(2, BPF_H, (0x03<<8) | v); 3699 break; 3700 3701 case DLT_C_HDLC: 3702 /* 3703 * Cisco uses an Ethertype lookalike - for OSI, 3704 * it's 0xfefe. 3705 */ 3706 b0 = gen_linktype(LLCSAP_ISONS<<8 | LLCSAP_ISONS); 3707 /* OSI in C-HDLC is stuffed with a fudge byte */ 3708 b1 = gen_cmp(off_nl_nosnap+1, BPF_B, (long)v); 3709 gen_and(b0, b1); 3710 return b1; 3711 3712 default: 3713 b0 = gen_linktype(LLCSAP_ISONS); 3714 b1 = gen_cmp(off_nl_nosnap, BPF_B, (long)v); 3715 gen_and(b0, b1); 3716 return b1; 3717 } 3718 3719 case Q_ISIS: 3720 b0 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 3721 /* 3722 * 4 is the offset of the PDU type relative to the IS-IS 3723 * header. 3724 */ 3725 b1 = gen_cmp(off_nl_nosnap+4, BPF_B, (long)v); 3726 gen_and(b0, b1); 3727 return b1; 3728 3729 case Q_ARP: 3730 bpf_error("arp does not encapsulate another protocol"); 3731 /* NOTREACHED */ 3732 3733 case Q_RARP: 3734 bpf_error("rarp does not encapsulate another protocol"); 3735 /* NOTREACHED */ 3736 3737 case Q_ATALK: 3738 bpf_error("atalk encapsulation is not specifiable"); 3739 /* NOTREACHED */ 3740 3741 case Q_DECNET: 3742 bpf_error("decnet encapsulation is not specifiable"); 3743 /* NOTREACHED */ 3744 3745 case Q_SCA: 3746 bpf_error("sca does not encapsulate another protocol"); 3747 /* NOTREACHED */ 3748 3749 case Q_LAT: 3750 bpf_error("lat does not encapsulate another protocol"); 3751 /* NOTREACHED */ 3752 3753 case Q_MOPRC: 3754 bpf_error("moprc does not encapsulate another protocol"); 3755 /* NOTREACHED */ 3756 3757 case Q_MOPDL: 3758 bpf_error("mopdl does not encapsulate another protocol"); 3759 /* NOTREACHED */ 3760 3761 case Q_LINK: 3762 return gen_linktype(v); 3763 3764 case Q_UDP: 3765 bpf_error("'udp proto' is bogus"); 3766 /* NOTREACHED */ 3767 3768 case Q_TCP: 3769 bpf_error("'tcp proto' is bogus"); 3770 /* NOTREACHED */ 3771 3772 case Q_SCTP: 3773 bpf_error("'sctp proto' is bogus"); 3774 /* NOTREACHED */ 3775 3776 case Q_ICMP: 3777 bpf_error("'icmp proto' is bogus"); 3778 /* NOTREACHED */ 3779 3780 case Q_IGMP: 3781 bpf_error("'igmp proto' is bogus"); 3782 /* NOTREACHED */ 3783 3784 case Q_IGRP: 3785 bpf_error("'igrp proto' is bogus"); 3786 /* NOTREACHED */ 3787 3788 case Q_PIM: 3789 bpf_error("'pim proto' is bogus"); 3790 /* NOTREACHED */ 3791 3792 case Q_VRRP: 3793 bpf_error("'vrrp proto' is bogus"); 3794 /* NOTREACHED */ 3795 3796 #ifdef INET6 3797 case Q_IPV6: 3798 b0 = gen_linktype(ETHERTYPE_IPV6); 3799 #ifndef CHASE_CHAIN 3800 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v); 3801 #else 3802 b1 = gen_protochain(v, Q_IPV6); 3803 #endif 3804 gen_and(b0, b1); 3805 return b1; 3806 3807 case Q_ICMPV6: 3808 bpf_error("'icmp6 proto' is bogus"); 3809 #endif /* INET6 */ 3810 3811 case Q_AH: 3812 bpf_error("'ah proto' is bogus"); 3813 3814 case Q_ESP: 3815 bpf_error("'ah proto' is bogus"); 3816 3817 case Q_STP: 3818 bpf_error("'stp proto' is bogus"); 3819 3820 case Q_IPX: 3821 bpf_error("'ipx proto' is bogus"); 3822 3823 case Q_NETBEUI: 3824 bpf_error("'netbeui proto' is bogus"); 3825 3826 default: 3827 abort(); 3828 /* NOTREACHED */ 3829 } 3830 /* NOTREACHED */ 3831 } 3832 3833 struct block * 3834 gen_scode(name, q) 3835 register const char *name; 3836 struct qual q; 3837 { 3838 int proto = q.proto; 3839 int dir = q.dir; 3840 int tproto; 3841 u_char *eaddr; 3842 bpf_u_int32 mask, addr; 3843 #ifndef INET6 3844 bpf_u_int32 **alist; 3845 #else 3846 int tproto6; 3847 struct sockaddr_in *sin; 3848 struct sockaddr_in6 *sin6; 3849 struct addrinfo *res, *res0; 3850 struct in6_addr mask128; 3851 #endif /*INET6*/ 3852 struct block *b, *tmp; 3853 int port, real_proto; 3854 3855 switch (q.addr) { 3856 3857 case Q_NET: 3858 addr = pcap_nametonetaddr(name); 3859 if (addr == 0) 3860 bpf_error("unknown network '%s'", name); 3861 /* Left justify network addr and calculate its network mask */ 3862 mask = 0xffffffff; 3863 while (addr && (addr & 0xff000000) == 0) { 3864 addr <<= 8; 3865 mask <<= 8; 3866 } 3867 return gen_host(addr, mask, proto, dir); 3868 3869 case Q_DEFAULT: 3870 case Q_HOST: 3871 if (proto == Q_LINK) { 3872 switch (linktype) { 3873 3874 case DLT_EN10MB: 3875 eaddr = pcap_ether_hostton(name); 3876 if (eaddr == NULL) 3877 bpf_error( 3878 "unknown ether host '%s'", name); 3879 b = gen_ehostop(eaddr, dir); 3880 free(eaddr); 3881 return b; 3882 3883 case DLT_FDDI: 3884 eaddr = pcap_ether_hostton(name); 3885 if (eaddr == NULL) 3886 bpf_error( 3887 "unknown FDDI host '%s'", name); 3888 b = gen_fhostop(eaddr, dir); 3889 free(eaddr); 3890 return b; 3891 3892 case DLT_IEEE802: 3893 eaddr = pcap_ether_hostton(name); 3894 if (eaddr == NULL) 3895 bpf_error( 3896 "unknown token ring host '%s'", name); 3897 b = gen_thostop(eaddr, dir); 3898 free(eaddr); 3899 return b; 3900 3901 case DLT_IEEE802_11: 3902 eaddr = pcap_ether_hostton(name); 3903 if (eaddr == NULL) 3904 bpf_error( 3905 "unknown 802.11 host '%s'", name); 3906 b = gen_wlanhostop(eaddr, dir); 3907 free(eaddr); 3908 return b; 3909 3910 case DLT_IP_OVER_FC: 3911 eaddr = pcap_ether_hostton(name); 3912 if (eaddr == NULL) 3913 bpf_error( 3914 "unknown Fibre Channel host '%s'", name); 3915 b = gen_ipfchostop(eaddr, dir); 3916 free(eaddr); 3917 return b; 3918 3919 case DLT_SUNATM: 3920 if (!is_lane) 3921 break; 3922 3923 /* 3924 * Check that the packet doesn't begin 3925 * with an LE Control marker. (We've 3926 * already generated a test for LANE.) 3927 */ 3928 tmp = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 3929 0xFF00); 3930 gen_not(tmp); 3931 3932 eaddr = pcap_ether_hostton(name); 3933 if (eaddr == NULL) 3934 bpf_error( 3935 "unknown ether host '%s'", name); 3936 b = gen_ehostop(eaddr, dir); 3937 gen_and(tmp, b); 3938 free(eaddr); 3939 return b; 3940 } 3941 3942 bpf_error("only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name"); 3943 } else if (proto == Q_DECNET) { 3944 unsigned short dn_addr = __pcap_nametodnaddr(name); 3945 /* 3946 * I don't think DECNET hosts can be multihomed, so 3947 * there is no need to build up a list of addresses 3948 */ 3949 return (gen_host(dn_addr, 0, proto, dir)); 3950 } else { 3951 #ifndef INET6 3952 alist = pcap_nametoaddr(name); 3953 if (alist == NULL || *alist == NULL) 3954 bpf_error("unknown host '%s'", name); 3955 tproto = proto; 3956 if (off_linktype == (u_int)-1 && tproto == Q_DEFAULT) 3957 tproto = Q_IP; 3958 b = gen_host(**alist++, 0xffffffff, tproto, dir); 3959 while (*alist) { 3960 tmp = gen_host(**alist++, 0xffffffff, 3961 tproto, dir); 3962 gen_or(b, tmp); 3963 b = tmp; 3964 } 3965 return b; 3966 #else 3967 memset(&mask128, 0xff, sizeof(mask128)); 3968 res0 = res = pcap_nametoaddrinfo(name); 3969 if (res == NULL) 3970 bpf_error("unknown host '%s'", name); 3971 b = tmp = NULL; 3972 tproto = tproto6 = proto; 3973 if (off_linktype == -1 && tproto == Q_DEFAULT) { 3974 tproto = Q_IP; 3975 tproto6 = Q_IPV6; 3976 } 3977 for (res = res0; res; res = res->ai_next) { 3978 switch (res->ai_family) { 3979 case AF_INET: 3980 if (tproto == Q_IPV6) 3981 continue; 3982 3983 sin = (struct sockaddr_in *) 3984 res->ai_addr; 3985 tmp = gen_host(ntohl(sin->sin_addr.s_addr), 3986 0xffffffff, tproto, dir); 3987 break; 3988 case AF_INET6: 3989 if (tproto6 == Q_IP) 3990 continue; 3991 3992 sin6 = (struct sockaddr_in6 *) 3993 res->ai_addr; 3994 tmp = gen_host6(&sin6->sin6_addr, 3995 &mask128, tproto6, dir); 3996 break; 3997 default: 3998 continue; 3999 } 4000 if (b) 4001 gen_or(b, tmp); 4002 b = tmp; 4003 } 4004 freeaddrinfo(res0); 4005 if (b == NULL) { 4006 bpf_error("unknown host '%s'%s", name, 4007 (proto == Q_DEFAULT) 4008 ? "" 4009 : " for specified address family"); 4010 } 4011 return b; 4012 #endif /*INET6*/ 4013 } 4014 4015 case Q_PORT: 4016 if (proto != Q_DEFAULT && 4017 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 4018 bpf_error("illegal qualifier of 'port'"); 4019 if (pcap_nametoport(name, &port, &real_proto) == 0) 4020 bpf_error("unknown port '%s'", name); 4021 if (proto == Q_UDP) { 4022 if (real_proto == IPPROTO_TCP) 4023 bpf_error("port '%s' is tcp", name); 4024 else if (real_proto == IPPROTO_SCTP) 4025 bpf_error("port '%s' is sctp", name); 4026 else 4027 /* override PROTO_UNDEF */ 4028 real_proto = IPPROTO_UDP; 4029 } 4030 if (proto == Q_TCP) { 4031 if (real_proto == IPPROTO_UDP) 4032 bpf_error("port '%s' is udp", name); 4033 4034 else if (real_proto == IPPROTO_SCTP) 4035 bpf_error("port '%s' is sctp", name); 4036 else 4037 /* override PROTO_UNDEF */ 4038 real_proto = IPPROTO_TCP; 4039 } 4040 if (proto == Q_SCTP) { 4041 if (real_proto == IPPROTO_UDP) 4042 bpf_error("port '%s' is udp", name); 4043 4044 else if (real_proto == IPPROTO_TCP) 4045 bpf_error("port '%s' is tcp", name); 4046 else 4047 /* override PROTO_UNDEF */ 4048 real_proto = IPPROTO_SCTP; 4049 } 4050 #ifndef INET6 4051 return gen_port(port, real_proto, dir); 4052 #else 4053 { 4054 struct block *b; 4055 b = gen_port(port, real_proto, dir); 4056 gen_or(gen_port6(port, real_proto, dir), b); 4057 return b; 4058 } 4059 #endif /* INET6 */ 4060 4061 case Q_GATEWAY: 4062 #ifndef INET6 4063 eaddr = pcap_ether_hostton(name); 4064 if (eaddr == NULL) 4065 bpf_error("unknown ether host: %s", name); 4066 4067 alist = pcap_nametoaddr(name); 4068 if (alist == NULL || *alist == NULL) 4069 bpf_error("unknown host '%s'", name); 4070 b = gen_gateway(eaddr, alist, proto, dir); 4071 free(eaddr); 4072 return b; 4073 #else 4074 bpf_error("'gateway' not supported in this configuration"); 4075 #endif /*INET6*/ 4076 4077 case Q_PROTO: 4078 real_proto = lookup_proto(name, proto); 4079 if (real_proto >= 0) 4080 return gen_proto(real_proto, proto, dir); 4081 else 4082 bpf_error("unknown protocol: %s", name); 4083 4084 case Q_PROTOCHAIN: 4085 real_proto = lookup_proto(name, proto); 4086 if (real_proto >= 0) 4087 return gen_protochain(real_proto, proto, dir); 4088 else 4089 bpf_error("unknown protocol: %s", name); 4090 4091 4092 case Q_UNDEF: 4093 syntax(); 4094 /* NOTREACHED */ 4095 } 4096 abort(); 4097 /* NOTREACHED */ 4098 } 4099 4100 struct block * 4101 gen_mcode(s1, s2, masklen, q) 4102 register const char *s1, *s2; 4103 register int masklen; 4104 struct qual q; 4105 { 4106 register int nlen, mlen; 4107 bpf_u_int32 n, m; 4108 4109 nlen = __pcap_atoin(s1, &n); 4110 /* Promote short ipaddr */ 4111 n <<= 32 - nlen; 4112 4113 if (s2 != NULL) { 4114 mlen = __pcap_atoin(s2, &m); 4115 /* Promote short ipaddr */ 4116 m <<= 32 - mlen; 4117 if ((n & ~m) != 0) 4118 bpf_error("non-network bits set in \"%s mask %s\"", 4119 s1, s2); 4120 } else { 4121 /* Convert mask len to mask */ 4122 if (masklen > 32) 4123 bpf_error("mask length must be <= 32"); 4124 m = 0xffffffff << (32 - masklen); 4125 if ((n & ~m) != 0) 4126 bpf_error("non-network bits set in \"%s/%d\"", 4127 s1, masklen); 4128 } 4129 4130 switch (q.addr) { 4131 4132 case Q_NET: 4133 return gen_host(n, m, q.proto, q.dir); 4134 4135 default: 4136 bpf_error("Mask syntax for networks only"); 4137 /* NOTREACHED */ 4138 } 4139 } 4140 4141 struct block * 4142 gen_ncode(s, v, q) 4143 register const char *s; 4144 bpf_u_int32 v; 4145 struct qual q; 4146 { 4147 bpf_u_int32 mask; 4148 int proto = q.proto; 4149 int dir = q.dir; 4150 register int vlen; 4151 4152 if (s == NULL) 4153 vlen = 32; 4154 else if (q.proto == Q_DECNET) 4155 vlen = __pcap_atodn(s, &v); 4156 else 4157 vlen = __pcap_atoin(s, &v); 4158 4159 switch (q.addr) { 4160 4161 case Q_DEFAULT: 4162 case Q_HOST: 4163 case Q_NET: 4164 if (proto == Q_DECNET) 4165 return gen_host(v, 0, proto, dir); 4166 else if (proto == Q_LINK) { 4167 bpf_error("illegal link layer address"); 4168 } else { 4169 mask = 0xffffffff; 4170 if (s == NULL && q.addr == Q_NET) { 4171 /* Promote short net number */ 4172 while (v && (v & 0xff000000) == 0) { 4173 v <<= 8; 4174 mask <<= 8; 4175 } 4176 } else { 4177 /* Promote short ipaddr */ 4178 v <<= 32 - vlen; 4179 mask <<= 32 - vlen; 4180 } 4181 return gen_host(v, mask, proto, dir); 4182 } 4183 4184 case Q_PORT: 4185 if (proto == Q_UDP) 4186 proto = IPPROTO_UDP; 4187 else if (proto == Q_TCP) 4188 proto = IPPROTO_TCP; 4189 else if (proto == Q_SCTP) 4190 proto = IPPROTO_SCTP; 4191 else if (proto == Q_DEFAULT) 4192 proto = PROTO_UNDEF; 4193 else 4194 bpf_error("illegal qualifier of 'port'"); 4195 4196 #ifndef INET6 4197 return gen_port((int)v, proto, dir); 4198 #else 4199 { 4200 struct block *b; 4201 b = gen_port((int)v, proto, dir); 4202 gen_or(gen_port6((int)v, proto, dir), b); 4203 return b; 4204 } 4205 #endif /* INET6 */ 4206 4207 case Q_GATEWAY: 4208 bpf_error("'gateway' requires a name"); 4209 /* NOTREACHED */ 4210 4211 case Q_PROTO: 4212 return gen_proto((int)v, proto, dir); 4213 4214 case Q_PROTOCHAIN: 4215 return gen_protochain((int)v, proto, dir); 4216 4217 case Q_UNDEF: 4218 syntax(); 4219 /* NOTREACHED */ 4220 4221 default: 4222 abort(); 4223 /* NOTREACHED */ 4224 } 4225 /* NOTREACHED */ 4226 } 4227 4228 #ifdef INET6 4229 struct block * 4230 gen_mcode6(s1, s2, masklen, q) 4231 register const char *s1, *s2; 4232 register int masklen; 4233 struct qual q; 4234 { 4235 struct addrinfo *res; 4236 struct in6_addr *addr; 4237 struct in6_addr mask; 4238 struct block *b; 4239 u_int32_t *a, *m; 4240 4241 if (s2) 4242 bpf_error("no mask %s supported", s2); 4243 4244 res = pcap_nametoaddrinfo(s1); 4245 if (!res) 4246 bpf_error("invalid ip6 address %s", s1); 4247 if (res->ai_next) 4248 bpf_error("%s resolved to multiple address", s1); 4249 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 4250 4251 if (sizeof(mask) * 8 < masklen) 4252 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8)); 4253 memset(&mask, 0, sizeof(mask)); 4254 memset(&mask, 0xff, masklen / 8); 4255 if (masklen % 8) { 4256 mask.s6_addr[masklen / 8] = 4257 (0xff << (8 - masklen % 8)) & 0xff; 4258 } 4259 4260 a = (u_int32_t *)addr; 4261 m = (u_int32_t *)&mask; 4262 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 4263 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 4264 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen); 4265 } 4266 4267 switch (q.addr) { 4268 4269 case Q_DEFAULT: 4270 case Q_HOST: 4271 if (masklen != 128) 4272 bpf_error("Mask syntax for networks only"); 4273 /* FALLTHROUGH */ 4274 4275 case Q_NET: 4276 b = gen_host6(addr, &mask, q.proto, q.dir); 4277 freeaddrinfo(res); 4278 return b; 4279 4280 default: 4281 bpf_error("invalid qualifier against IPv6 address"); 4282 /* NOTREACHED */ 4283 } 4284 } 4285 #endif /*INET6*/ 4286 4287 struct block * 4288 gen_ecode(eaddr, q) 4289 register const u_char *eaddr; 4290 struct qual q; 4291 { 4292 struct block *b, *tmp; 4293 4294 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 4295 if (linktype == DLT_EN10MB) 4296 return gen_ehostop(eaddr, (int)q.dir); 4297 if (linktype == DLT_FDDI) 4298 return gen_fhostop(eaddr, (int)q.dir); 4299 if (linktype == DLT_IEEE802) 4300 return gen_thostop(eaddr, (int)q.dir); 4301 if (linktype == DLT_IEEE802_11) 4302 return gen_wlanhostop(eaddr, (int)q.dir); 4303 if (linktype == DLT_SUNATM && is_lane) { 4304 /* 4305 * Check that the packet doesn't begin with an 4306 * LE Control marker. (We've already generated 4307 * a test for LANE.) 4308 */ 4309 tmp = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 4310 gen_not(tmp); 4311 4312 /* 4313 * Now check the MAC address. 4314 */ 4315 b = gen_ehostop(eaddr, (int)q.dir); 4316 gen_and(tmp, b); 4317 return b; 4318 } 4319 if (linktype == DLT_IP_OVER_FC) 4320 return gen_ipfchostop(eaddr, (int)q.dir); 4321 bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 4322 } 4323 bpf_error("ethernet address used in non-ether expression"); 4324 /* NOTREACHED */ 4325 } 4326 4327 void 4328 sappend(s0, s1) 4329 struct slist *s0, *s1; 4330 { 4331 /* 4332 * This is definitely not the best way to do this, but the 4333 * lists will rarely get long. 4334 */ 4335 while (s0->next) 4336 s0 = s0->next; 4337 s0->next = s1; 4338 } 4339 4340 static struct slist * 4341 xfer_to_x(a) 4342 struct arth *a; 4343 { 4344 struct slist *s; 4345 4346 s = new_stmt(BPF_LDX|BPF_MEM); 4347 s->s.k = a->regno; 4348 return s; 4349 } 4350 4351 static struct slist * 4352 xfer_to_a(a) 4353 struct arth *a; 4354 { 4355 struct slist *s; 4356 4357 s = new_stmt(BPF_LD|BPF_MEM); 4358 s->s.k = a->regno; 4359 return s; 4360 } 4361 4362 struct arth * 4363 gen_load(proto, index, size) 4364 int proto; 4365 struct arth *index; 4366 int size; 4367 { 4368 struct slist *s, *tmp; 4369 struct block *b; 4370 int regno = alloc_reg(); 4371 4372 free_reg(index->regno); 4373 switch (size) { 4374 4375 default: 4376 bpf_error("data size must be 1, 2, or 4"); 4377 4378 case 1: 4379 size = BPF_B; 4380 break; 4381 4382 case 2: 4383 size = BPF_H; 4384 break; 4385 4386 case 4: 4387 size = BPF_W; 4388 break; 4389 } 4390 switch (proto) { 4391 default: 4392 bpf_error("unsupported index operation"); 4393 4394 case Q_LINK: 4395 /* 4396 * XXX - what about ATM LANE? Should the index be 4397 * relative to the beginning of the AAL5 frame, so 4398 * that 0 refers to the beginning of the LE Control 4399 * field, or relative to the beginning of the LAN 4400 * frame, so that 0 refers, for Ethernet LANE, to 4401 * the beginning of the destination address? 4402 */ 4403 s = xfer_to_x(index); 4404 tmp = new_stmt(BPF_LD|BPF_IND|size); 4405 sappend(s, tmp); 4406 sappend(index->s, s); 4407 break; 4408 4409 case Q_IP: 4410 case Q_ARP: 4411 case Q_RARP: 4412 case Q_ATALK: 4413 case Q_DECNET: 4414 case Q_SCA: 4415 case Q_LAT: 4416 case Q_MOPRC: 4417 case Q_MOPDL: 4418 #ifdef INET6 4419 case Q_IPV6: 4420 #endif 4421 /* XXX Note that we assume a fixed link header here. */ 4422 s = xfer_to_x(index); 4423 tmp = new_stmt(BPF_LD|BPF_IND|size); 4424 tmp->s.k = off_nl; 4425 sappend(s, tmp); 4426 sappend(index->s, s); 4427 4428 b = gen_proto_abbrev(proto); 4429 if (index->b) 4430 gen_and(index->b, b); 4431 index->b = b; 4432 break; 4433 4434 case Q_SCTP: 4435 case Q_TCP: 4436 case Q_UDP: 4437 case Q_ICMP: 4438 case Q_IGMP: 4439 case Q_IGRP: 4440 case Q_PIM: 4441 case Q_VRRP: 4442 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 4443 s->s.k = off_nl; 4444 sappend(s, xfer_to_a(index)); 4445 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 4446 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 4447 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 4448 tmp->s.k = off_nl; 4449 sappend(index->s, s); 4450 4451 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); 4452 if (index->b) 4453 gen_and(index->b, b); 4454 #ifdef INET6 4455 gen_and(gen_proto_abbrev(Q_IP), b); 4456 #endif 4457 index->b = b; 4458 break; 4459 #ifdef INET6 4460 case Q_ICMPV6: 4461 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]"); 4462 /*NOTREACHED*/ 4463 #endif 4464 } 4465 index->regno = regno; 4466 s = new_stmt(BPF_ST); 4467 s->s.k = regno; 4468 sappend(index->s, s); 4469 4470 return index; 4471 } 4472 4473 struct block * 4474 gen_relation(code, a0, a1, reversed) 4475 int code; 4476 struct arth *a0, *a1; 4477 int reversed; 4478 { 4479 struct slist *s0, *s1, *s2; 4480 struct block *b, *tmp; 4481 4482 s0 = xfer_to_x(a1); 4483 s1 = xfer_to_a(a0); 4484 if (code == BPF_JEQ) { 4485 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X); 4486 b = new_block(JMP(code)); 4487 sappend(s1, s2); 4488 } 4489 else 4490 b = new_block(BPF_JMP|code|BPF_X); 4491 if (reversed) 4492 gen_not(b); 4493 4494 sappend(s0, s1); 4495 sappend(a1->s, s0); 4496 sappend(a0->s, a1->s); 4497 4498 b->stmts = a0->s; 4499 4500 free_reg(a0->regno); 4501 free_reg(a1->regno); 4502 4503 /* 'and' together protocol checks */ 4504 if (a0->b) { 4505 if (a1->b) { 4506 gen_and(a0->b, tmp = a1->b); 4507 } 4508 else 4509 tmp = a0->b; 4510 } else 4511 tmp = a1->b; 4512 4513 if (tmp) 4514 gen_and(tmp, b); 4515 4516 return b; 4517 } 4518 4519 struct arth * 4520 gen_loadlen() 4521 { 4522 int regno = alloc_reg(); 4523 struct arth *a = (struct arth *)newchunk(sizeof(*a)); 4524 struct slist *s; 4525 4526 s = new_stmt(BPF_LD|BPF_LEN); 4527 s->next = new_stmt(BPF_ST); 4528 s->next->s.k = regno; 4529 a->s = s; 4530 a->regno = regno; 4531 4532 return a; 4533 } 4534 4535 struct arth * 4536 gen_loadi(val) 4537 int val; 4538 { 4539 struct arth *a; 4540 struct slist *s; 4541 int reg; 4542 4543 a = (struct arth *)newchunk(sizeof(*a)); 4544 4545 reg = alloc_reg(); 4546 4547 s = new_stmt(BPF_LD|BPF_IMM); 4548 s->s.k = val; 4549 s->next = new_stmt(BPF_ST); 4550 s->next->s.k = reg; 4551 a->s = s; 4552 a->regno = reg; 4553 4554 return a; 4555 } 4556 4557 struct arth * 4558 gen_neg(a) 4559 struct arth *a; 4560 { 4561 struct slist *s; 4562 4563 s = xfer_to_a(a); 4564 sappend(a->s, s); 4565 s = new_stmt(BPF_ALU|BPF_NEG); 4566 s->s.k = 0; 4567 sappend(a->s, s); 4568 s = new_stmt(BPF_ST); 4569 s->s.k = a->regno; 4570 sappend(a->s, s); 4571 4572 return a; 4573 } 4574 4575 struct arth * 4576 gen_arth(code, a0, a1) 4577 int code; 4578 struct arth *a0, *a1; 4579 { 4580 struct slist *s0, *s1, *s2; 4581 4582 s0 = xfer_to_x(a1); 4583 s1 = xfer_to_a(a0); 4584 s2 = new_stmt(BPF_ALU|BPF_X|code); 4585 4586 sappend(s1, s2); 4587 sappend(s0, s1); 4588 sappend(a1->s, s0); 4589 sappend(a0->s, a1->s); 4590 4591 free_reg(a0->regno); 4592 free_reg(a1->regno); 4593 4594 s0 = new_stmt(BPF_ST); 4595 a0->regno = s0->s.k = alloc_reg(); 4596 sappend(a0->s, s0); 4597 4598 return a0; 4599 } 4600 4601 /* 4602 * Here we handle simple allocation of the scratch registers. 4603 * If too many registers are alloc'd, the allocator punts. 4604 */ 4605 static int regused[BPF_MEMWORDS]; 4606 static int curreg; 4607 4608 /* 4609 * Return the next free register. 4610 */ 4611 static int 4612 alloc_reg() 4613 { 4614 int n = BPF_MEMWORDS; 4615 4616 while (--n >= 0) { 4617 if (regused[curreg]) 4618 curreg = (curreg + 1) % BPF_MEMWORDS; 4619 else { 4620 regused[curreg] = 1; 4621 return curreg; 4622 } 4623 } 4624 bpf_error("too many registers needed to evaluate expression"); 4625 /* NOTREACHED */ 4626 } 4627 4628 /* 4629 * Return a register to the table so it can 4630 * be used later. 4631 */ 4632 static void 4633 free_reg(n) 4634 int n; 4635 { 4636 regused[n] = 0; 4637 } 4638 4639 static struct block * 4640 gen_len(jmp, n) 4641 int jmp, n; 4642 { 4643 struct slist *s; 4644 struct block *b; 4645 4646 s = new_stmt(BPF_LD|BPF_LEN); 4647 b = new_block(JMP(jmp)); 4648 b->stmts = s; 4649 b->s.k = n; 4650 4651 return b; 4652 } 4653 4654 struct block * 4655 gen_greater(n) 4656 int n; 4657 { 4658 return gen_len(BPF_JGE, n); 4659 } 4660 4661 /* 4662 * Actually, this is less than or equal. 4663 */ 4664 struct block * 4665 gen_less(n) 4666 int n; 4667 { 4668 struct block *b; 4669 4670 b = gen_len(BPF_JGT, n); 4671 gen_not(b); 4672 4673 return b; 4674 } 4675 4676 struct block * 4677 gen_byteop(op, idx, val) 4678 int op, idx, val; 4679 { 4680 struct block *b; 4681 struct slist *s; 4682 4683 switch (op) { 4684 default: 4685 abort(); 4686 4687 case '=': 4688 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 4689 4690 case '<': 4691 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 4692 b->s.code = JMP(BPF_JGE); 4693 gen_not(b); 4694 return b; 4695 4696 case '>': 4697 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 4698 b->s.code = JMP(BPF_JGT); 4699 return b; 4700 4701 case '|': 4702 s = new_stmt(BPF_ALU|BPF_OR|BPF_K); 4703 break; 4704 4705 case '&': 4706 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 4707 break; 4708 } 4709 s->s.k = val; 4710 b = new_block(JMP(BPF_JEQ)); 4711 b->stmts = s; 4712 gen_not(b); 4713 4714 return b; 4715 } 4716 4717 static u_char abroadcast[] = { 0x0 }; 4718 4719 struct block * 4720 gen_broadcast(proto) 4721 int proto; 4722 { 4723 bpf_u_int32 hostmask; 4724 struct block *b0, *b1, *b2; 4725 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 4726 4727 switch (proto) { 4728 4729 case Q_DEFAULT: 4730 case Q_LINK: 4731 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 4732 return gen_ahostop(abroadcast, Q_DST); 4733 if (linktype == DLT_EN10MB) 4734 return gen_ehostop(ebroadcast, Q_DST); 4735 if (linktype == DLT_FDDI) 4736 return gen_fhostop(ebroadcast, Q_DST); 4737 if (linktype == DLT_IEEE802) 4738 return gen_thostop(ebroadcast, Q_DST); 4739 if (linktype == DLT_IEEE802_11) 4740 return gen_wlanhostop(ebroadcast, Q_DST); 4741 if (linktype == DLT_IP_OVER_FC) 4742 return gen_ipfchostop(ebroadcast, Q_DST); 4743 if (linktype == DLT_SUNATM && is_lane) { 4744 /* 4745 * Check that the packet doesn't begin with an 4746 * LE Control marker. (We've already generated 4747 * a test for LANE.) 4748 */ 4749 b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 4750 gen_not(b1); 4751 4752 /* 4753 * Now check the MAC address. 4754 */ 4755 b0 = gen_ehostop(ebroadcast, Q_DST); 4756 gen_and(b1, b0); 4757 return b0; 4758 } 4759 bpf_error("not a broadcast link"); 4760 break; 4761 4762 case Q_IP: 4763 b0 = gen_linktype(ETHERTYPE_IP); 4764 hostmask = ~netmask; 4765 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask); 4766 b2 = gen_mcmp(off_nl + 16, BPF_W, 4767 (bpf_int32)(~0 & hostmask), hostmask); 4768 gen_or(b1, b2); 4769 gen_and(b0, b2); 4770 return b2; 4771 } 4772 bpf_error("only link-layer/IP broadcast filters supported"); 4773 } 4774 4775 /* 4776 * Generate code to test the low-order bit of a MAC address (that's 4777 * the bottom bit of the *first* byte). 4778 */ 4779 static struct block * 4780 gen_mac_multicast(offset) 4781 int offset; 4782 { 4783 register struct block *b0; 4784 register struct slist *s; 4785 4786 /* link[offset] & 1 != 0 */ 4787 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 4788 s->s.k = offset; 4789 b0 = new_block(JMP(BPF_JSET)); 4790 b0->s.k = 1; 4791 b0->stmts = s; 4792 return b0; 4793 } 4794 4795 struct block * 4796 gen_multicast(proto) 4797 int proto; 4798 { 4799 register struct block *b0, *b1, *b2; 4800 register struct slist *s; 4801 4802 switch (proto) { 4803 4804 case Q_DEFAULT: 4805 case Q_LINK: 4806 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 4807 /* all ARCnet multicasts use the same address */ 4808 return gen_ahostop(abroadcast, Q_DST); 4809 4810 if (linktype == DLT_EN10MB) { 4811 /* ether[0] & 1 != 0 */ 4812 return gen_mac_multicast(0); 4813 } 4814 4815 if (linktype == DLT_FDDI) { 4816 /* 4817 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX 4818 * 4819 * XXX - was that referring to bit-order issues? 4820 */ 4821 /* fddi[1] & 1 != 0 */ 4822 return gen_mac_multicast(1); 4823 } 4824 4825 if (linktype == DLT_IEEE802) { 4826 /* tr[2] & 1 != 0 */ 4827 return gen_mac_multicast(2); 4828 } 4829 4830 if (linktype == DLT_IEEE802_11) { 4831 /* 4832 * Oh, yuk. 4833 * 4834 * For control frames, there is no DA. 4835 * 4836 * For management frames, DA is at an 4837 * offset of 4 from the beginning of 4838 * the packet. 4839 * 4840 * For data frames, DA is at an offset 4841 * of 4 from the beginning of the packet 4842 * if To DS is clear and at an offset of 4843 * 16 from the beginning of the packet 4844 * if To DS is set. 4845 */ 4846 4847 /* 4848 * Generate the tests to be done for data frames. 4849 * 4850 * First, check for To DS set, i.e. "link[1] & 0x01". 4851 */ 4852 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 4853 s->s.k = 1; 4854 b1 = new_block(JMP(BPF_JSET)); 4855 b1->s.k = 0x01; /* To DS */ 4856 b1->stmts = s; 4857 4858 /* 4859 * If To DS is set, the DA is at 16. 4860 */ 4861 b0 = gen_mac_multicast(16); 4862 gen_and(b1, b0); 4863 4864 /* 4865 * Now, check for To DS not set, i.e. check 4866 * "!(link[1] & 0x01)". 4867 */ 4868 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 4869 s->s.k = 1; 4870 b2 = new_block(JMP(BPF_JSET)); 4871 b2->s.k = 0x01; /* To DS */ 4872 b2->stmts = s; 4873 gen_not(b2); 4874 4875 /* 4876 * If To DS is not set, the DA is at 4. 4877 */ 4878 b1 = gen_mac_multicast(4); 4879 gen_and(b2, b1); 4880 4881 /* 4882 * Now OR together the last two checks. That gives 4883 * the complete set of checks for data frames. 4884 */ 4885 gen_or(b1, b0); 4886 4887 /* 4888 * Now check for a data frame. 4889 * I.e, check "link[0] & 0x08". 4890 */ 4891 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 4892 s->s.k = 0; 4893 b1 = new_block(JMP(BPF_JSET)); 4894 b1->s.k = 0x08; 4895 b1->stmts = s; 4896 4897 /* 4898 * AND that with the checks done for data frames. 4899 */ 4900 gen_and(b1, b0); 4901 4902 /* 4903 * If the high-order bit of the type value is 0, this 4904 * is a management frame. 4905 * I.e, check "!(link[0] & 0x08)". 4906 */ 4907 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 4908 s->s.k = 0; 4909 b2 = new_block(JMP(BPF_JSET)); 4910 b2->s.k = 0x08; 4911 b2->stmts = s; 4912 gen_not(b2); 4913 4914 /* 4915 * For management frames, the DA is at 4. 4916 */ 4917 b1 = gen_mac_multicast(4); 4918 gen_and(b2, b1); 4919 4920 /* 4921 * OR that with the checks done for data frames. 4922 * That gives the checks done for management and 4923 * data frames. 4924 */ 4925 gen_or(b1, b0); 4926 4927 /* 4928 * If the low-order bit of the type value is 1, 4929 * this is either a control frame or a frame 4930 * with a reserved type, and thus not a 4931 * frame with an SA. 4932 * 4933 * I.e., check "!(link[0] & 0x04)". 4934 */ 4935 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 4936 s->s.k = 0; 4937 b1 = new_block(JMP(BPF_JSET)); 4938 b1->s.k = 0x04; 4939 b1->stmts = s; 4940 gen_not(b1); 4941 4942 /* 4943 * AND that with the checks for data and management 4944 * frames. 4945 */ 4946 gen_and(b1, b0); 4947 return b0; 4948 } 4949 4950 if (linktype == DLT_IP_OVER_FC) { 4951 b0 = gen_mac_multicast(2); 4952 return b0; 4953 } 4954 4955 if (linktype == DLT_SUNATM && is_lane) { 4956 /* 4957 * Check that the packet doesn't begin with an 4958 * LE Control marker. (We've already generated 4959 * a test for LANE.) 4960 */ 4961 b1 = gen_cmp(SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 4962 gen_not(b1); 4963 4964 /* ether[off_mac] & 1 != 0 */ 4965 b0 = gen_mac_multicast(off_mac); 4966 gen_and(b1, b0); 4967 return b0; 4968 } 4969 4970 /* Link not known to support multicasts */ 4971 break; 4972 4973 case Q_IP: 4974 b0 = gen_linktype(ETHERTYPE_IP); 4975 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224); 4976 b1->s.code = JMP(BPF_JGE); 4977 gen_and(b0, b1); 4978 return b1; 4979 4980 #ifdef INET6 4981 case Q_IPV6: 4982 b0 = gen_linktype(ETHERTYPE_IPV6); 4983 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255); 4984 gen_and(b0, b1); 4985 return b1; 4986 #endif /* INET6 */ 4987 } 4988 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel"); 4989 } 4990 4991 /* 4992 * generate command for inbound/outbound. It's here so we can 4993 * make it link-type specific. 'dir' = 0 implies "inbound", 4994 * = 1 implies "outbound". 4995 */ 4996 struct block * 4997 gen_inbound(dir) 4998 int dir; 4999 { 5000 register struct block *b0; 5001 5002 /* 5003 * Only some data link types support inbound/outbound qualifiers. 5004 */ 5005 switch (linktype) { 5006 case DLT_SLIP: 5007 b0 = gen_relation(BPF_JEQ, 5008 gen_load(Q_LINK, gen_loadi(0), 1), 5009 gen_loadi(0), 5010 dir); 5011 break; 5012 5013 case DLT_LINUX_SLL: 5014 if (dir) { 5015 /* 5016 * Match packets sent by this machine. 5017 */ 5018 b0 = gen_cmp(0, BPF_H, LINUX_SLL_OUTGOING); 5019 } else { 5020 /* 5021 * Match packets sent to this machine. 5022 * (No broadcast or multicast packets, or 5023 * packets sent to some other machine and 5024 * received promiscuously.) 5025 * 5026 * XXX - packets sent to other machines probably 5027 * shouldn't be matched, but what about broadcast 5028 * or multicast packets we received? 5029 */ 5030 b0 = gen_cmp(0, BPF_H, LINUX_SLL_HOST); 5031 } 5032 break; 5033 5034 case DLT_PFLOG: 5035 b0 = gen_cmp(offsetof(struct pfloghdr, dir), BPF_B, 5036 (bpf_int32)((dir == 0) ? PF_IN : PF_OUT)); 5037 break; 5038 5039 default: 5040 bpf_error("inbound/outbound not supported on linktype %d", 5041 linktype); 5042 b0 = NULL; 5043 /* NOTREACHED */ 5044 } 5045 return (b0); 5046 } 5047 5048 /* PF firewall log matched interface */ 5049 struct block * 5050 gen_pf_ifname(const char *ifname) 5051 { 5052 struct block *b0; 5053 u_int len, off; 5054 5055 if (linktype == DLT_PFLOG) { 5056 len = sizeof(((struct pfloghdr *)0)->ifname); 5057 off = offsetof(struct pfloghdr, ifname); 5058 } else { 5059 bpf_error("ifname not supported on linktype 0x%x", linktype); 5060 /* NOTREACHED */ 5061 } 5062 if (strlen(ifname) >= len) { 5063 bpf_error("ifname interface names can only be %d characters", 5064 len-1); 5065 /* NOTREACHED */ 5066 } 5067 b0 = gen_bcmp(off, strlen(ifname), ifname); 5068 return (b0); 5069 } 5070 5071 /* PF firewall log matched interface */ 5072 struct block * 5073 gen_pf_ruleset(char *ruleset) 5074 { 5075 struct block *b0; 5076 5077 if (linktype != DLT_PFLOG) { 5078 bpf_error("ruleset not supported on linktype 0x%x", linktype); 5079 /* NOTREACHED */ 5080 } 5081 if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) { 5082 bpf_error("ruleset names can only be %ld characters", 5083 (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1)); 5084 /* NOTREACHED */ 5085 } 5086 b0 = gen_bcmp(offsetof(struct pfloghdr, ruleset), 5087 strlen(ruleset), ruleset); 5088 return (b0); 5089 } 5090 5091 /* PF firewall log rule number */ 5092 struct block * 5093 gen_pf_rnr(int rnr) 5094 { 5095 struct block *b0; 5096 5097 if (linktype == DLT_PFLOG) { 5098 b0 = gen_cmp(offsetof(struct pfloghdr, rulenr), BPF_W, 5099 (bpf_int32)rnr); 5100 } else { 5101 bpf_error("rnr not supported on linktype 0x%x", linktype); 5102 /* NOTREACHED */ 5103 } 5104 5105 return (b0); 5106 } 5107 5108 /* PF firewall log sub-rule number */ 5109 struct block * 5110 gen_pf_srnr(int srnr) 5111 { 5112 struct block *b0; 5113 5114 if (linktype != DLT_PFLOG) { 5115 bpf_error("srnr not supported on linktype 0x%x", linktype); 5116 /* NOTREACHED */ 5117 } 5118 5119 b0 = gen_cmp(offsetof(struct pfloghdr, subrulenr), BPF_W, 5120 (bpf_int32)srnr); 5121 return (b0); 5122 } 5123 5124 /* PF firewall log reason code */ 5125 struct block * 5126 gen_pf_reason(int reason) 5127 { 5128 struct block *b0; 5129 5130 if (linktype == DLT_PFLOG) { 5131 b0 = gen_cmp(offsetof(struct pfloghdr, reason), BPF_B, 5132 (bpf_int32)reason); 5133 } else { 5134 bpf_error("reason not supported on linktype 0x%x", linktype); 5135 /* NOTREACHED */ 5136 } 5137 5138 return (b0); 5139 } 5140 5141 /* PF firewall log action */ 5142 struct block * 5143 gen_pf_action(int action) 5144 { 5145 struct block *b0; 5146 5147 if (linktype == DLT_PFLOG) { 5148 b0 = gen_cmp(offsetof(struct pfloghdr, action), BPF_B, 5149 (bpf_int32)action); 5150 } else { 5151 bpf_error("action not supported on linktype 0x%x", linktype); 5152 /* NOTREACHED */ 5153 } 5154 5155 return (b0); 5156 } 5157 5158 struct block * 5159 gen_acode(eaddr, q) 5160 register const u_char *eaddr; 5161 struct qual q; 5162 { 5163 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 5164 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 5165 return gen_ahostop(eaddr, (int)q.dir); 5166 } 5167 bpf_error("ARCnet address used in non-arc expression"); 5168 /* NOTREACHED */ 5169 } 5170 5171 static struct block * 5172 gen_ahostop(eaddr, dir) 5173 register const u_char *eaddr; 5174 register int dir; 5175 { 5176 register struct block *b0, *b1; 5177 5178 switch (dir) { 5179 /* src comes first, different from Ethernet */ 5180 case Q_SRC: 5181 return gen_bcmp(0, 1, eaddr); 5182 5183 case Q_DST: 5184 return gen_bcmp(1, 1, eaddr); 5185 5186 case Q_AND: 5187 b0 = gen_ahostop(eaddr, Q_SRC); 5188 b1 = gen_ahostop(eaddr, Q_DST); 5189 gen_and(b0, b1); 5190 return b1; 5191 5192 case Q_DEFAULT: 5193 case Q_OR: 5194 b0 = gen_ahostop(eaddr, Q_SRC); 5195 b1 = gen_ahostop(eaddr, Q_DST); 5196 gen_or(b0, b1); 5197 return b1; 5198 } 5199 abort(); 5200 /* NOTREACHED */ 5201 } 5202 5203 /* 5204 * support IEEE 802.1Q VLAN trunk over ethernet 5205 */ 5206 struct block * 5207 gen_vlan(vlan_num) 5208 int vlan_num; 5209 { 5210 struct block *b0; 5211 5212 /* 5213 * Change the offsets to point to the type and data fields within 5214 * the VLAN packet. This is somewhat of a kludge. 5215 */ 5216 if (orig_nl == (u_int)-1) { 5217 orig_linktype = off_linktype; /* save original values */ 5218 orig_nl = off_nl; 5219 orig_nl_nosnap = off_nl_nosnap; 5220 5221 switch (linktype) { 5222 5223 case DLT_EN10MB: 5224 off_linktype = 16; 5225 off_nl_nosnap = 18; 5226 off_nl = 18; 5227 break; 5228 5229 default: 5230 bpf_error("no VLAN support for data link type %d", 5231 linktype); 5232 /*NOTREACHED*/ 5233 } 5234 } 5235 5236 /* check for VLAN */ 5237 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q); 5238 5239 /* If a specific VLAN is requested, check VLAN id */ 5240 if (vlan_num >= 0) { 5241 struct block *b1; 5242 5243 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num); 5244 gen_and(b0, b1); 5245 b0 = b1; 5246 } 5247 5248 return (b0); 5249 } 5250 5251 struct block * 5252 gen_atmfield_code(atmfield, jvalue, jtype, reverse) 5253 int atmfield; 5254 bpf_u_int32 jvalue; 5255 bpf_u_int32 jtype; 5256 int reverse; 5257 { 5258 struct block *b0; 5259 5260 switch (atmfield) { 5261 5262 case A_VPI: 5263 if (!is_atm) 5264 bpf_error("'vpi' supported only on raw ATM"); 5265 if (off_vpi == (u_int)-1) 5266 abort(); 5267 b0 = gen_ncmp(BPF_B, off_vpi, 0xffffffff, (u_int)jtype, 5268 (u_int)jvalue, reverse); 5269 break; 5270 5271 case A_VCI: 5272 if (!is_atm) 5273 bpf_error("'vci' supported only on raw ATM"); 5274 if (off_vci == (u_int)-1) 5275 abort(); 5276 b0 = gen_ncmp(BPF_H, off_vci, 0xffffffff, (u_int)jtype, 5277 (u_int)jvalue, reverse); 5278 break; 5279 5280 case A_PROTOTYPE: 5281 if (off_proto == (u_int)-1) 5282 abort(); /* XXX - this isn't on FreeBSD */ 5283 b0 = gen_ncmp(BPF_B, off_proto, 0x0f, (u_int)jtype, 5284 (u_int)jvalue, reverse); 5285 break; 5286 5287 case A_MSGTYPE: 5288 if (off_payload == (u_int)-1) 5289 abort(); 5290 b0 = gen_ncmp(BPF_B, off_payload + MSG_TYPE_POS, 0xffffffff, 5291 (u_int)jtype, (u_int)jvalue, reverse); 5292 break; 5293 5294 case A_CALLREFTYPE: 5295 if (!is_atm) 5296 bpf_error("'callref' supported only on raw ATM"); 5297 if (off_proto == (u_int)-1) 5298 abort(); 5299 b0 = gen_ncmp(BPF_B, off_proto, 0xffffffff, (u_int)jtype, 5300 (u_int)jvalue, reverse); 5301 break; 5302 5303 default: 5304 abort(); 5305 } 5306 return b0; 5307 } 5308 5309 struct block * 5310 gen_atmtype_abbrev(type) 5311 int type; 5312 { 5313 struct block *b0, *b1; 5314 5315 switch (type) { 5316 5317 case A_METAC: 5318 /* Get all packets in Meta signalling Circuit */ 5319 if (!is_atm) 5320 bpf_error("'metac' supported only on raw ATM"); 5321 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5322 b1 = gen_atmfield_code(A_VCI, 1, BPF_JEQ, 0); 5323 gen_and(b0, b1); 5324 break; 5325 5326 case A_BCC: 5327 /* Get all packets in Broadcast Circuit*/ 5328 if (!is_atm) 5329 bpf_error("'bcc' supported only on raw ATM"); 5330 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5331 b1 = gen_atmfield_code(A_VCI, 2, BPF_JEQ, 0); 5332 gen_and(b0, b1); 5333 break; 5334 5335 case A_OAMF4SC: 5336 /* Get all cells in Segment OAM F4 circuit*/ 5337 if (!is_atm) 5338 bpf_error("'oam4sc' supported only on raw ATM"); 5339 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5340 b1 = gen_atmfield_code(A_VCI, 3, BPF_JEQ, 0); 5341 gen_and(b0, b1); 5342 break; 5343 5344 case A_OAMF4EC: 5345 /* Get all cells in End-to-End OAM F4 Circuit*/ 5346 if (!is_atm) 5347 bpf_error("'oam4ec' supported only on raw ATM"); 5348 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5349 b1 = gen_atmfield_code(A_VCI, 4, BPF_JEQ, 0); 5350 gen_and(b0, b1); 5351 break; 5352 5353 case A_SC: 5354 /* Get all packets in connection Signalling Circuit */ 5355 if (!is_atm) 5356 bpf_error("'sc' supported only on raw ATM"); 5357 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5358 b1 = gen_atmfield_code(A_VCI, 5, BPF_JEQ, 0); 5359 gen_and(b0, b1); 5360 break; 5361 5362 case A_ILMIC: 5363 /* Get all packets in ILMI Circuit */ 5364 if (!is_atm) 5365 bpf_error("'ilmic' supported only on raw ATM"); 5366 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5367 b1 = gen_atmfield_code(A_VCI, 16, BPF_JEQ, 0); 5368 gen_and(b0, b1); 5369 break; 5370 5371 case A_LANE: 5372 /* Get all LANE packets */ 5373 if (!is_atm) 5374 bpf_error("'lane' supported only on raw ATM"); 5375 b1 = gen_atmfield_code(A_PROTOTYPE, PT_LANE, BPF_JEQ, 0); 5376 5377 /* 5378 * Arrange that all subsequent tests assume LANE 5379 * rather than LLC-encapsulated packets, and set 5380 * the offsets appropriately for LANE-encapsulated 5381 * Ethernet. 5382 * 5383 * "off_mac" is the offset of the Ethernet header, 5384 * which is 2 bytes past the ATM pseudo-header 5385 * (skipping the pseudo-header and 2-byte LE Client 5386 * field). The other offsets are Ethernet offsets 5387 * relative to "off_mac". 5388 */ 5389 is_lane = 1; 5390 off_mac = off_payload + 2; /* MAC header */ 5391 off_linktype = off_mac + 12; 5392 off_nl = off_mac + 14; /* Ethernet II */ 5393 off_nl_nosnap = off_mac + 17; /* 802.3+802.2 */ 5394 break; 5395 5396 case A_LLC: 5397 /* Get all LLC-encapsulated packets */ 5398 if (!is_atm) 5399 bpf_error("'llc' supported only on raw ATM"); 5400 b1 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 5401 is_lane = 0; 5402 break; 5403 5404 default: 5405 abort(); 5406 } 5407 return b1; 5408 } 5409 5410 5411 static struct block * 5412 gen_msg_abbrev(type) 5413 int type; 5414 { 5415 struct block *b1; 5416 5417 /* 5418 * Q.2931 signalling protocol messages for handling virtual circuits 5419 * establishment and teardown 5420 */ 5421 switch (type) { 5422 5423 case A_SETUP: 5424 b1 = gen_atmfield_code(A_MSGTYPE, SETUP, BPF_JEQ, 0); 5425 break; 5426 5427 case A_CALLPROCEED: 5428 b1 = gen_atmfield_code(A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0); 5429 break; 5430 5431 case A_CONNECT: 5432 b1 = gen_atmfield_code(A_MSGTYPE, CONNECT, BPF_JEQ, 0); 5433 break; 5434 5435 case A_CONNECTACK: 5436 b1 = gen_atmfield_code(A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0); 5437 break; 5438 5439 case A_RELEASE: 5440 b1 = gen_atmfield_code(A_MSGTYPE, RELEASE, BPF_JEQ, 0); 5441 break; 5442 5443 case A_RELEASE_DONE: 5444 b1 = gen_atmfield_code(A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0); 5445 break; 5446 5447 default: 5448 abort(); 5449 } 5450 return b1; 5451 } 5452 5453 struct block * 5454 gen_atmmulti_abbrev(type) 5455 int type; 5456 { 5457 struct block *b0, *b1; 5458 5459 switch (type) { 5460 5461 case A_OAM: 5462 if (!is_atm) 5463 bpf_error("'oam' supported only on raw ATM"); 5464 b1 = gen_atmmulti_abbrev(A_OAMF4); 5465 break; 5466 5467 case A_OAMF4: 5468 if (!is_atm) 5469 bpf_error("'oamf4' supported only on raw ATM"); 5470 /* OAM F4 type */ 5471 b0 = gen_atmfield_code(A_VCI, 3, BPF_JEQ, 0); 5472 b1 = gen_atmfield_code(A_VCI, 4, BPF_JEQ, 0); 5473 gen_or(b0, b1); 5474 b0 = gen_atmfield_code(A_VPI, 0, BPF_JEQ, 0); 5475 gen_and(b0, b1); 5476 break; 5477 5478 case A_CONNECTMSG: 5479 /* 5480 * Get Q.2931 signalling messages for switched 5481 * virtual connection 5482 */ 5483 if (!is_atm) 5484 bpf_error("'connectmsg' supported only on raw ATM"); 5485 b0 = gen_msg_abbrev(A_SETUP); 5486 b1 = gen_msg_abbrev(A_CALLPROCEED); 5487 gen_or(b0, b1); 5488 b0 = gen_msg_abbrev(A_CONNECT); 5489 gen_or(b0, b1); 5490 b0 = gen_msg_abbrev(A_CONNECTACK); 5491 gen_or(b0, b1); 5492 b0 = gen_msg_abbrev(A_RELEASE); 5493 gen_or(b0, b1); 5494 b0 = gen_msg_abbrev(A_RELEASE_DONE); 5495 gen_or(b0, b1); 5496 b0 = gen_atmtype_abbrev(A_SC); 5497 gen_and(b0, b1); 5498 break; 5499 5500 case A_METACONNECT: 5501 if (!is_atm) 5502 bpf_error("'metaconnect' supported only on raw ATM"); 5503 b0 = gen_msg_abbrev(A_SETUP); 5504 b1 = gen_msg_abbrev(A_CALLPROCEED); 5505 gen_or(b0, b1); 5506 b0 = gen_msg_abbrev(A_CONNECT); 5507 gen_or(b0, b1); 5508 b0 = gen_msg_abbrev(A_RELEASE); 5509 gen_or(b0, b1); 5510 b0 = gen_msg_abbrev(A_RELEASE_DONE); 5511 gen_or(b0, b1); 5512 b0 = gen_atmtype_abbrev(A_METAC); 5513 gen_and(b0, b1); 5514 break; 5515 5516 default: 5517 abort(); 5518 } 5519 return b1; 5520 } 5521