1/*#define CHASE_CHAIN*/ 2/* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 *
| 1/*#define CHASE_CHAIN*/ 2/* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 *
|
22 * $FreeBSD: head/contrib/libpcap/gencode.c 75110 2001-04-03 04:32:48Z fenner $
| 22 * $FreeBSD: head/contrib/libpcap/gencode.c 98533 2002-06-21 01:38:14Z fenner $
|
23 */ 24#ifndef lint 25static const char rcsid[] =
| 23 */ 24#ifndef lint 25static const char rcsid[] =
|
26 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.140.2.1 2001/01/14 06:48:35 guy Exp $ (LBL)";
| 26 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.160 2001/11/30 07:25:48 guy Exp $ (LBL)";
|
27#endif 28 29#ifdef HAVE_CONFIG_H 30#include "config.h" 31#endif 32 33#include <sys/types.h> 34#include <sys/socket.h> 35#include <sys/time.h> 36#ifdef __NetBSD__ 37#include <sys/param.h> 38#endif 39 40struct mbuf; 41struct rtentry; 42#include <net/if.h> 43 44#include <netinet/in.h> 45 46#include <stdlib.h> 47#include <string.h> 48#include <memory.h> 49#include <setjmp.h> 50#include <stdarg.h> 51 52#include "pcap-int.h" 53 54#include "ethertype.h" 55#include "nlpid.h"
| 27#endif 28 29#ifdef HAVE_CONFIG_H 30#include "config.h" 31#endif 32 33#include <sys/types.h> 34#include <sys/socket.h> 35#include <sys/time.h> 36#ifdef __NetBSD__ 37#include <sys/param.h> 38#endif 39 40struct mbuf; 41struct rtentry; 42#include <net/if.h> 43 44#include <netinet/in.h> 45 46#include <stdlib.h> 47#include <string.h> 48#include <memory.h> 49#include <setjmp.h> 50#include <stdarg.h> 51 52#include "pcap-int.h" 53 54#include "ethertype.h" 55#include "nlpid.h"
|
| 56#include "llc.h"
|
56#include "gencode.h" 57#include "ppp.h" 58#include "sll.h"
| 57#include "gencode.h" 58#include "ppp.h" 59#include "sll.h"
|
| 60#include "arcnet.h"
|
59#include <pcap-namedb.h> 60#ifdef INET6 61#include <netdb.h> 62#include <sys/socket.h> 63#endif /*INET6*/ 64
| 61#include <pcap-namedb.h> 62#ifdef INET6 63#include <netdb.h> 64#include <sys/socket.h> 65#endif /*INET6*/ 66
|
65#define LLC_SNAP_LSAP 0xaa 66#define LLC_ISO_LSAP 0xfe 67
| |
68#undef ETHERMTU 69#define ETHERMTU 1500 70
| 67#undef ETHERMTU 68#define ETHERMTU 1500 69
|
| 70#ifndef IPPROTO_SCTP 71#define IPPROTO_SCTP 132 72#endif 73
|
71#ifdef HAVE_OS_PROTO_H 72#include "os-proto.h" 73#endif 74 75#define JMP(c) ((c)|BPF_JMP|BPF_K) 76 77/* Locals */ 78static jmp_buf top_ctx; 79static pcap_t *bpf_pcap; 80
| 74#ifdef HAVE_OS_PROTO_H 75#include "os-proto.h" 76#endif 77 78#define JMP(c) ((c)|BPF_JMP|BPF_K) 79 80/* Locals */ 81static jmp_buf top_ctx; 82static pcap_t *bpf_pcap; 83
|
| 84/* Hack for updating VLAN offsets. */ 85static u_int orig_linktype = -1, orig_nl = -1; 86
|
81/* XXX */ 82#ifdef PCAP_FDDIPAD 83int pcap_fddipad = PCAP_FDDIPAD; 84#else 85int pcap_fddipad; 86#endif 87 88/* VARARGS */ 89void 90bpf_error(const char *fmt, ...) 91 92{ 93 va_list ap; 94 95 va_start(ap, fmt); 96 if (bpf_pcap != NULL) 97 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE, 98 fmt, ap); 99 va_end(ap); 100 longjmp(top_ctx, 1); 101 /* NOTREACHED */ 102} 103 104static void init_linktype(int); 105 106static int alloc_reg(void); 107static void free_reg(int); 108 109static struct block *root; 110 111/* 112 * We divy out chunks of memory rather than call malloc each time so 113 * we don't have to worry about leaking memory. It's probably 114 * not a big deal if all this memory was wasted but it this ever 115 * goes into a library that would probably not be a good idea. 116 */ 117#define NCHUNKS 16 118#define CHUNK0SIZE 1024 119struct chunk { 120 u_int n_left; 121 void *m; 122}; 123 124static struct chunk chunks[NCHUNKS]; 125static int cur_chunk; 126 127static void *newchunk(u_int); 128static void freechunks(void); 129static inline struct block *new_block(int); 130static inline struct slist *new_stmt(int); 131static struct block *gen_retblk(int); 132static inline void syntax(void); 133 134static void backpatch(struct block *, struct block *); 135static void merge(struct block *, struct block *); 136static struct block *gen_cmp(u_int, u_int, bpf_int32); 137static struct block *gen_cmp_gt(u_int, u_int, bpf_int32); 138static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32); 139static struct block *gen_bcmp(u_int, u_int, const u_char *); 140static struct block *gen_uncond(int); 141static inline struct block *gen_true(void); 142static inline struct block *gen_false(void); 143static struct block *gen_linktype(int); 144static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); 145static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 146#ifdef INET6 147static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 148#endif
| 87/* XXX */ 88#ifdef PCAP_FDDIPAD 89int pcap_fddipad = PCAP_FDDIPAD; 90#else 91int pcap_fddipad; 92#endif 93 94/* VARARGS */ 95void 96bpf_error(const char *fmt, ...) 97 98{ 99 va_list ap; 100 101 va_start(ap, fmt); 102 if (bpf_pcap != NULL) 103 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE, 104 fmt, ap); 105 va_end(ap); 106 longjmp(top_ctx, 1); 107 /* NOTREACHED */ 108} 109 110static void init_linktype(int); 111 112static int alloc_reg(void); 113static void free_reg(int); 114 115static struct block *root; 116 117/* 118 * We divy out chunks of memory rather than call malloc each time so 119 * we don't have to worry about leaking memory. It's probably 120 * not a big deal if all this memory was wasted but it this ever 121 * goes into a library that would probably not be a good idea. 122 */ 123#define NCHUNKS 16 124#define CHUNK0SIZE 1024 125struct chunk { 126 u_int n_left; 127 void *m; 128}; 129 130static struct chunk chunks[NCHUNKS]; 131static int cur_chunk; 132 133static void *newchunk(u_int); 134static void freechunks(void); 135static inline struct block *new_block(int); 136static inline struct slist *new_stmt(int); 137static struct block *gen_retblk(int); 138static inline void syntax(void); 139 140static void backpatch(struct block *, struct block *); 141static void merge(struct block *, struct block *); 142static struct block *gen_cmp(u_int, u_int, bpf_int32); 143static struct block *gen_cmp_gt(u_int, u_int, bpf_int32); 144static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32); 145static struct block *gen_bcmp(u_int, u_int, const u_char *); 146static struct block *gen_uncond(int); 147static inline struct block *gen_true(void); 148static inline struct block *gen_false(void); 149static struct block *gen_linktype(int); 150static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); 151static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 152#ifdef INET6 153static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 154#endif
|
| 155static struct block *gen_ahostop(const u_char *, int);
|
149static struct block *gen_ehostop(const u_char *, int); 150static struct block *gen_fhostop(const u_char *, int); 151static struct block *gen_thostop(const u_char *, int); 152static struct block *gen_dnhostop(bpf_u_int32, int, u_int); 153static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 154#ifdef INET6 155static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 156#endif 157#ifndef INET6 158static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); 159#endif 160static struct block *gen_ipfrag(void); 161static struct block *gen_portatom(int, bpf_int32); 162#ifdef INET6 163static struct block *gen_portatom6(int, bpf_int32); 164#endif 165struct block *gen_portop(int, int, int); 166static struct block *gen_port(int, int, int); 167#ifdef INET6 168struct block *gen_portop6(int, int, int); 169static struct block *gen_port6(int, int, int); 170#endif 171static int lookup_proto(const char *, int); 172static struct block *gen_protochain(int, int, int); 173static struct block *gen_proto(int, int, int); 174static struct slist *xfer_to_x(struct arth *); 175static struct slist *xfer_to_a(struct arth *); 176static struct block *gen_len(int, int); 177 178static void * 179newchunk(n) 180 u_int n; 181{ 182 struct chunk *cp; 183 int k, size; 184 185#ifndef __NetBSD__ 186 /* XXX Round up to nearest long. */ 187 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 188#else 189 /* XXX Round up to structure boundary. */ 190 n = ALIGN(n); 191#endif 192 193 cp = &chunks[cur_chunk]; 194 if (n > cp->n_left) { 195 ++cp, k = ++cur_chunk; 196 if (k >= NCHUNKS) 197 bpf_error("out of memory"); 198 size = CHUNK0SIZE << k; 199 cp->m = (void *)malloc(size); 200 memset((char *)cp->m, 0, size); 201 cp->n_left = size; 202 if (n > size) 203 bpf_error("out of memory"); 204 } 205 cp->n_left -= n; 206 return (void *)((char *)cp->m + cp->n_left); 207} 208 209static void 210freechunks() 211{ 212 int i; 213 214 cur_chunk = 0; 215 for (i = 0; i < NCHUNKS; ++i) 216 if (chunks[i].m != NULL) { 217 free(chunks[i].m); 218 chunks[i].m = NULL; 219 } 220} 221 222/* 223 * A strdup whose allocations are freed after code generation is over. 224 */ 225char * 226sdup(s) 227 register const char *s; 228{ 229 int n = strlen(s) + 1; 230 char *cp = newchunk(n); 231 232 strlcpy(cp, s, n); 233 return (cp); 234} 235 236static inline struct block * 237new_block(code) 238 int code; 239{ 240 struct block *p; 241 242 p = (struct block *)newchunk(sizeof(*p)); 243 p->s.code = code; 244 p->head = p; 245 246 return p; 247} 248 249static inline struct slist * 250new_stmt(code) 251 int code; 252{ 253 struct slist *p; 254 255 p = (struct slist *)newchunk(sizeof(*p)); 256 p->s.code = code; 257 258 return p; 259} 260 261static struct block * 262gen_retblk(v) 263 int v; 264{ 265 struct block *b = new_block(BPF_RET|BPF_K); 266 267 b->s.k = v; 268 return b; 269} 270 271static inline void 272syntax() 273{ 274 bpf_error("syntax error in filter expression"); 275} 276 277static bpf_u_int32 netmask; 278static int snaplen; 279int no_optimize; 280 281int 282pcap_compile(pcap_t *p, struct bpf_program *program, 283 char *buf, int optimize, bpf_u_int32 mask) 284{ 285 extern int n_errors; 286 int len; 287 288 no_optimize = 0; 289 n_errors = 0; 290 root = NULL; 291 bpf_pcap = p; 292 if (setjmp(top_ctx)) { 293 lex_cleanup(); 294 freechunks(); 295 return (-1); 296 } 297 298 netmask = mask; 299 300 snaplen = pcap_snapshot(p); 301 if (snaplen == 0) { 302 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 303 "snaplen of 0 rejects all packets"); 304 return -1; 305 } 306 307 lex_init(buf ? buf : ""); 308 init_linktype(pcap_datalink(p)); 309 (void)pcap_parse(); 310 311 if (n_errors) 312 syntax(); 313 314 if (root == NULL) 315 root = gen_retblk(snaplen); 316 317 if (optimize && !no_optimize) { 318 bpf_optimize(&root); 319 if (root == NULL || 320 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0)) 321 bpf_error("expression rejects all packets"); 322 } 323 program->bf_insns = icode_to_fcode(root, &len); 324 program->bf_len = len; 325 326 lex_cleanup(); 327 freechunks(); 328 return (0); 329} 330 331/* 332 * entry point for using the compiler with no pcap open 333 * pass in all the stuff that is needed explicitly instead. 334 */ 335int 336pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 337 struct bpf_program *program, 338 char *buf, int optimize, bpf_u_int32 mask) 339{ 340 pcap_t *p; 341 int ret; 342 343 p = pcap_open_dead(linktype_arg, snaplen_arg); 344 if (p == NULL) 345 return (-1); 346 ret = pcap_compile(p, program, buf, optimize, mask); 347 pcap_close(p); 348 return (ret); 349} 350 351/* 352 * Clean up a "struct bpf_program" by freeing all the memory allocated 353 * in it. 354 */ 355void 356pcap_freecode(struct bpf_program *program) 357{ 358 program->bf_len = 0; 359 if (program->bf_insns != NULL) { 360 free((char *)program->bf_insns); 361 program->bf_insns = NULL; 362 } 363} 364 365/* 366 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 367 * which of the jt and jf fields has been resolved and which is a pointer 368 * back to another unresolved block (or nil). At least one of the fields 369 * in each block is already resolved. 370 */ 371static void 372backpatch(list, target) 373 struct block *list, *target; 374{ 375 struct block *next; 376 377 while (list) { 378 if (!list->sense) { 379 next = JT(list); 380 JT(list) = target; 381 } else { 382 next = JF(list); 383 JF(list) = target; 384 } 385 list = next; 386 } 387} 388 389/* 390 * Merge the lists in b0 and b1, using the 'sense' field to indicate 391 * which of jt and jf is the link. 392 */ 393static void 394merge(b0, b1) 395 struct block *b0, *b1; 396{ 397 register struct block **p = &b0; 398 399 /* Find end of list. */ 400 while (*p) 401 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 402 403 /* Concatenate the lists. */ 404 *p = b1; 405} 406 407void 408finish_parse(p) 409 struct block *p; 410{ 411 backpatch(p, gen_retblk(snaplen)); 412 p->sense = !p->sense; 413 backpatch(p, gen_retblk(0)); 414 root = p->head; 415} 416 417void 418gen_and(b0, b1) 419 struct block *b0, *b1; 420{ 421 backpatch(b0, b1->head); 422 b0->sense = !b0->sense; 423 b1->sense = !b1->sense; 424 merge(b1, b0); 425 b1->sense = !b1->sense; 426 b1->head = b0->head; 427} 428 429void 430gen_or(b0, b1) 431 struct block *b0, *b1; 432{ 433 b0->sense = !b0->sense; 434 backpatch(b0, b1->head); 435 b0->sense = !b0->sense; 436 merge(b1, b0); 437 b1->head = b0->head; 438} 439 440void 441gen_not(b) 442 struct block *b; 443{ 444 b->sense = !b->sense; 445} 446 447static struct block * 448gen_cmp(offset, size, v) 449 u_int offset, size; 450 bpf_int32 v; 451{ 452 struct slist *s; 453 struct block *b; 454 455 s = new_stmt(BPF_LD|BPF_ABS|size); 456 s->s.k = offset; 457 458 b = new_block(JMP(BPF_JEQ)); 459 b->stmts = s; 460 b->s.k = v; 461 462 return b; 463} 464 465static struct block * 466gen_cmp_gt(offset, size, v) 467 u_int offset, size; 468 bpf_int32 v; 469{ 470 struct slist *s; 471 struct block *b; 472 473 s = new_stmt(BPF_LD|BPF_ABS|size); 474 s->s.k = offset; 475 476 b = new_block(JMP(BPF_JGT)); 477 b->stmts = s; 478 b->s.k = v; 479 480 return b; 481} 482 483static struct block * 484gen_mcmp(offset, size, v, mask) 485 u_int offset, size; 486 bpf_int32 v; 487 bpf_u_int32 mask; 488{ 489 struct block *b = gen_cmp(offset, size, v); 490 struct slist *s; 491 492 if (mask != 0xffffffff) { 493 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 494 s->s.k = mask; 495 b->stmts->next = s; 496 } 497 return b; 498} 499 500static struct block * 501gen_bcmp(offset, size, v) 502 register u_int offset, size; 503 register const u_char *v; 504{ 505 register struct block *b, *tmp; 506 507 b = NULL; 508 while (size >= 4) { 509 register const u_char *p = &v[size - 4]; 510 bpf_int32 w = ((bpf_int32)p[0] << 24) | 511 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 512 513 tmp = gen_cmp(offset + size - 4, BPF_W, w); 514 if (b != NULL) 515 gen_and(b, tmp); 516 b = tmp; 517 size -= 4; 518 } 519 while (size >= 2) { 520 register const u_char *p = &v[size - 2]; 521 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 522 523 tmp = gen_cmp(offset + size - 2, BPF_H, w); 524 if (b != NULL) 525 gen_and(b, tmp); 526 b = tmp; 527 size -= 2; 528 } 529 if (size > 0) { 530 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]); 531 if (b != NULL) 532 gen_and(b, tmp); 533 b = tmp; 534 } 535 return b; 536} 537 538/* 539 * Various code constructs need to know the layout of the data link 540 * layer. These variables give the necessary offsets. off_linktype 541 * is set to -1 for no encapsulation, in which case, IP is assumed. 542 */ 543static u_int off_linktype; 544static u_int off_nl; 545static int linktype; 546 547static void 548init_linktype(type) 549 int type; 550{ 551 linktype = type; 552
| 156static struct block *gen_ehostop(const u_char *, int); 157static struct block *gen_fhostop(const u_char *, int); 158static struct block *gen_thostop(const u_char *, int); 159static struct block *gen_dnhostop(bpf_u_int32, int, u_int); 160static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 161#ifdef INET6 162static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 163#endif 164#ifndef INET6 165static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); 166#endif 167static struct block *gen_ipfrag(void); 168static struct block *gen_portatom(int, bpf_int32); 169#ifdef INET6 170static struct block *gen_portatom6(int, bpf_int32); 171#endif 172struct block *gen_portop(int, int, int); 173static struct block *gen_port(int, int, int); 174#ifdef INET6 175struct block *gen_portop6(int, int, int); 176static struct block *gen_port6(int, int, int); 177#endif 178static int lookup_proto(const char *, int); 179static struct block *gen_protochain(int, int, int); 180static struct block *gen_proto(int, int, int); 181static struct slist *xfer_to_x(struct arth *); 182static struct slist *xfer_to_a(struct arth *); 183static struct block *gen_len(int, int); 184 185static void * 186newchunk(n) 187 u_int n; 188{ 189 struct chunk *cp; 190 int k, size; 191 192#ifndef __NetBSD__ 193 /* XXX Round up to nearest long. */ 194 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 195#else 196 /* XXX Round up to structure boundary. */ 197 n = ALIGN(n); 198#endif 199 200 cp = &chunks[cur_chunk]; 201 if (n > cp->n_left) { 202 ++cp, k = ++cur_chunk; 203 if (k >= NCHUNKS) 204 bpf_error("out of memory"); 205 size = CHUNK0SIZE << k; 206 cp->m = (void *)malloc(size); 207 memset((char *)cp->m, 0, size); 208 cp->n_left = size; 209 if (n > size) 210 bpf_error("out of memory"); 211 } 212 cp->n_left -= n; 213 return (void *)((char *)cp->m + cp->n_left); 214} 215 216static void 217freechunks() 218{ 219 int i; 220 221 cur_chunk = 0; 222 for (i = 0; i < NCHUNKS; ++i) 223 if (chunks[i].m != NULL) { 224 free(chunks[i].m); 225 chunks[i].m = NULL; 226 } 227} 228 229/* 230 * A strdup whose allocations are freed after code generation is over. 231 */ 232char * 233sdup(s) 234 register const char *s; 235{ 236 int n = strlen(s) + 1; 237 char *cp = newchunk(n); 238 239 strlcpy(cp, s, n); 240 return (cp); 241} 242 243static inline struct block * 244new_block(code) 245 int code; 246{ 247 struct block *p; 248 249 p = (struct block *)newchunk(sizeof(*p)); 250 p->s.code = code; 251 p->head = p; 252 253 return p; 254} 255 256static inline struct slist * 257new_stmt(code) 258 int code; 259{ 260 struct slist *p; 261 262 p = (struct slist *)newchunk(sizeof(*p)); 263 p->s.code = code; 264 265 return p; 266} 267 268static struct block * 269gen_retblk(v) 270 int v; 271{ 272 struct block *b = new_block(BPF_RET|BPF_K); 273 274 b->s.k = v; 275 return b; 276} 277 278static inline void 279syntax() 280{ 281 bpf_error("syntax error in filter expression"); 282} 283 284static bpf_u_int32 netmask; 285static int snaplen; 286int no_optimize; 287 288int 289pcap_compile(pcap_t *p, struct bpf_program *program, 290 char *buf, int optimize, bpf_u_int32 mask) 291{ 292 extern int n_errors; 293 int len; 294 295 no_optimize = 0; 296 n_errors = 0; 297 root = NULL; 298 bpf_pcap = p; 299 if (setjmp(top_ctx)) { 300 lex_cleanup(); 301 freechunks(); 302 return (-1); 303 } 304 305 netmask = mask; 306 307 snaplen = pcap_snapshot(p); 308 if (snaplen == 0) { 309 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 310 "snaplen of 0 rejects all packets"); 311 return -1; 312 } 313 314 lex_init(buf ? buf : ""); 315 init_linktype(pcap_datalink(p)); 316 (void)pcap_parse(); 317 318 if (n_errors) 319 syntax(); 320 321 if (root == NULL) 322 root = gen_retblk(snaplen); 323 324 if (optimize && !no_optimize) { 325 bpf_optimize(&root); 326 if (root == NULL || 327 (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0)) 328 bpf_error("expression rejects all packets"); 329 } 330 program->bf_insns = icode_to_fcode(root, &len); 331 program->bf_len = len; 332 333 lex_cleanup(); 334 freechunks(); 335 return (0); 336} 337 338/* 339 * entry point for using the compiler with no pcap open 340 * pass in all the stuff that is needed explicitly instead. 341 */ 342int 343pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 344 struct bpf_program *program, 345 char *buf, int optimize, bpf_u_int32 mask) 346{ 347 pcap_t *p; 348 int ret; 349 350 p = pcap_open_dead(linktype_arg, snaplen_arg); 351 if (p == NULL) 352 return (-1); 353 ret = pcap_compile(p, program, buf, optimize, mask); 354 pcap_close(p); 355 return (ret); 356} 357 358/* 359 * Clean up a "struct bpf_program" by freeing all the memory allocated 360 * in it. 361 */ 362void 363pcap_freecode(struct bpf_program *program) 364{ 365 program->bf_len = 0; 366 if (program->bf_insns != NULL) { 367 free((char *)program->bf_insns); 368 program->bf_insns = NULL; 369 } 370} 371 372/* 373 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 374 * which of the jt and jf fields has been resolved and which is a pointer 375 * back to another unresolved block (or nil). At least one of the fields 376 * in each block is already resolved. 377 */ 378static void 379backpatch(list, target) 380 struct block *list, *target; 381{ 382 struct block *next; 383 384 while (list) { 385 if (!list->sense) { 386 next = JT(list); 387 JT(list) = target; 388 } else { 389 next = JF(list); 390 JF(list) = target; 391 } 392 list = next; 393 } 394} 395 396/* 397 * Merge the lists in b0 and b1, using the 'sense' field to indicate 398 * which of jt and jf is the link. 399 */ 400static void 401merge(b0, b1) 402 struct block *b0, *b1; 403{ 404 register struct block **p = &b0; 405 406 /* Find end of list. */ 407 while (*p) 408 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 409 410 /* Concatenate the lists. */ 411 *p = b1; 412} 413 414void 415finish_parse(p) 416 struct block *p; 417{ 418 backpatch(p, gen_retblk(snaplen)); 419 p->sense = !p->sense; 420 backpatch(p, gen_retblk(0)); 421 root = p->head; 422} 423 424void 425gen_and(b0, b1) 426 struct block *b0, *b1; 427{ 428 backpatch(b0, b1->head); 429 b0->sense = !b0->sense; 430 b1->sense = !b1->sense; 431 merge(b1, b0); 432 b1->sense = !b1->sense; 433 b1->head = b0->head; 434} 435 436void 437gen_or(b0, b1) 438 struct block *b0, *b1; 439{ 440 b0->sense = !b0->sense; 441 backpatch(b0, b1->head); 442 b0->sense = !b0->sense; 443 merge(b1, b0); 444 b1->head = b0->head; 445} 446 447void 448gen_not(b) 449 struct block *b; 450{ 451 b->sense = !b->sense; 452} 453 454static struct block * 455gen_cmp(offset, size, v) 456 u_int offset, size; 457 bpf_int32 v; 458{ 459 struct slist *s; 460 struct block *b; 461 462 s = new_stmt(BPF_LD|BPF_ABS|size); 463 s->s.k = offset; 464 465 b = new_block(JMP(BPF_JEQ)); 466 b->stmts = s; 467 b->s.k = v; 468 469 return b; 470} 471 472static struct block * 473gen_cmp_gt(offset, size, v) 474 u_int offset, size; 475 bpf_int32 v; 476{ 477 struct slist *s; 478 struct block *b; 479 480 s = new_stmt(BPF_LD|BPF_ABS|size); 481 s->s.k = offset; 482 483 b = new_block(JMP(BPF_JGT)); 484 b->stmts = s; 485 b->s.k = v; 486 487 return b; 488} 489 490static struct block * 491gen_mcmp(offset, size, v, mask) 492 u_int offset, size; 493 bpf_int32 v; 494 bpf_u_int32 mask; 495{ 496 struct block *b = gen_cmp(offset, size, v); 497 struct slist *s; 498 499 if (mask != 0xffffffff) { 500 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 501 s->s.k = mask; 502 b->stmts->next = s; 503 } 504 return b; 505} 506 507static struct block * 508gen_bcmp(offset, size, v) 509 register u_int offset, size; 510 register const u_char *v; 511{ 512 register struct block *b, *tmp; 513 514 b = NULL; 515 while (size >= 4) { 516 register const u_char *p = &v[size - 4]; 517 bpf_int32 w = ((bpf_int32)p[0] << 24) | 518 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 519 520 tmp = gen_cmp(offset + size - 4, BPF_W, w); 521 if (b != NULL) 522 gen_and(b, tmp); 523 b = tmp; 524 size -= 4; 525 } 526 while (size >= 2) { 527 register const u_char *p = &v[size - 2]; 528 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 529 530 tmp = gen_cmp(offset + size - 2, BPF_H, w); 531 if (b != NULL) 532 gen_and(b, tmp); 533 b = tmp; 534 size -= 2; 535 } 536 if (size > 0) { 537 tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]); 538 if (b != NULL) 539 gen_and(b, tmp); 540 b = tmp; 541 } 542 return b; 543} 544 545/* 546 * Various code constructs need to know the layout of the data link 547 * layer. These variables give the necessary offsets. off_linktype 548 * is set to -1 for no encapsulation, in which case, IP is assumed. 549 */ 550static u_int off_linktype; 551static u_int off_nl; 552static int linktype; 553 554static void 555init_linktype(type) 556 int type; 557{ 558 linktype = type; 559
|
| 560 orig_linktype = -1; 561 orig_nl = -1; 562
|
553 switch (type) { 554
| 563 switch (type) { 564
|
| 565 case DLT_ARCNET: 566 off_linktype = 2; 567 off_nl = 6; /* XXX in reality, variable! */ 568 return; 569
|
555 case DLT_EN10MB: 556 off_linktype = 12; 557 off_nl = 14; 558 return; 559 560 case DLT_SLIP: 561 /* 562 * SLIP doesn't have a link level type. The 16 byte 563 * header is hacked into our SLIP driver. 564 */ 565 off_linktype = -1; 566 off_nl = 16; 567 return; 568 569 case DLT_SLIP_BSDOS: 570 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 571 off_linktype = -1; 572 /* XXX end */ 573 off_nl = 24; 574 return; 575 576 case DLT_NULL: 577 case DLT_LOOP: 578 off_linktype = 0; 579 off_nl = 4; 580 return; 581 582 case DLT_PPP:
| 570 case DLT_EN10MB: 571 off_linktype = 12; 572 off_nl = 14; 573 return; 574 575 case DLT_SLIP: 576 /* 577 * SLIP doesn't have a link level type. The 16 byte 578 * header is hacked into our SLIP driver. 579 */ 580 off_linktype = -1; 581 off_nl = 16; 582 return; 583 584 case DLT_SLIP_BSDOS: 585 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 586 off_linktype = -1; 587 /* XXX end */ 588 off_nl = 24; 589 return; 590 591 case DLT_NULL: 592 case DLT_LOOP: 593 off_linktype = 0; 594 off_nl = 4; 595 return; 596 597 case DLT_PPP:
|
583 case DLT_C_HDLC: 584 case DLT_PPP_SERIAL:
| 598 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 599 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */
|
585 off_linktype = 2; 586 off_nl = 4; 587 return; 588
| 600 off_linktype = 2; 601 off_nl = 4; 602 return; 603
|
| 604 case DLT_PPP_ETHER: 605 /* 606 * This does no include the Ethernet header, and 607 * only covers session state. 608 */ 609 off_linktype = 6; 610 off_nl = 8; 611 return; 612
|
589 case DLT_PPP_BSDOS: 590 off_linktype = 5; 591 off_nl = 24; 592 return; 593 594 case DLT_FDDI: 595 /* 596 * FDDI doesn't really have a link-level type field.
| 613 case DLT_PPP_BSDOS: 614 off_linktype = 5; 615 off_nl = 24; 616 return; 617 618 case DLT_FDDI: 619 /* 620 * FDDI doesn't really have a link-level type field.
|
597 * We assume that SSAP = SNAP is being used and pick 598 * out the encapsulated Ethernet type.
| 621 * We set "off_linktype" to the offset of the LLC header.
|
599 *
| 622 *
|
| 623 * To check for Ethernet types, we assume that SSAP = SNAP 624 * is being used and pick out the encapsulated Ethernet type.
|
600 * XXX - should we generate code to check for SNAP? 601 */
| 625 * XXX - should we generate code to check for SNAP? 626 */
|
602 off_linktype = 19;
| 627 off_linktype = 13;
|
603#ifdef PCAP_FDDIPAD 604 off_linktype += pcap_fddipad; 605#endif 606 off_nl = 21; 607#ifdef PCAP_FDDIPAD 608 off_nl += pcap_fddipad; 609#endif 610 return; 611 612 case DLT_IEEE802: 613 /* 614 * Token Ring doesn't really have a link-level type field.
| 628#ifdef PCAP_FDDIPAD 629 off_linktype += pcap_fddipad; 630#endif 631 off_nl = 21; 632#ifdef PCAP_FDDIPAD 633 off_nl += pcap_fddipad; 634#endif 635 return; 636 637 case DLT_IEEE802: 638 /* 639 * Token Ring doesn't really have a link-level type field.
|
615 * We assume that SSAP = SNAP is being used and pick 616 * out the encapsulated Ethernet type.
| 640 * We set "off_linktype" to the offset of the LLC header.
|
617 *
| 641 *
|
| 642 * To check for Ethernet types, we assume that SSAP = SNAP 643 * is being used and pick out the encapsulated Ethernet type.
|
618 * XXX - should we generate code to check for SNAP? 619 * 620 * XXX - the header is actually variable-length. 621 * Some various Linux patched versions gave 38 622 * as "off_linktype" and 40 as "off_nl"; however, 623 * if a token ring packet has *no* routing 624 * information, i.e. is not source-routed, the correct 625 * values are 20 and 22, as they are in the vanilla code. 626 * 627 * A packet is source-routed iff the uppermost bit 628 * of the first byte of the source address, at an 629 * offset of 8, has the uppermost bit set. If the 630 * packet is source-routed, the total number of bytes 631 * of routing information is 2 plus bits 0x1F00 of 632 * the 16-bit value at an offset of 14 (shifted right 633 * 8 - figure out which byte that is). 634 */
| 644 * XXX - should we generate code to check for SNAP? 645 * 646 * XXX - the header is actually variable-length. 647 * Some various Linux patched versions gave 38 648 * as "off_linktype" and 40 as "off_nl"; however, 649 * if a token ring packet has *no* routing 650 * information, i.e. is not source-routed, the correct 651 * values are 20 and 22, as they are in the vanilla code. 652 * 653 * A packet is source-routed iff the uppermost bit 654 * of the first byte of the source address, at an 655 * offset of 8, has the uppermost bit set. If the 656 * packet is source-routed, the total number of bytes 657 * of routing information is 2 plus bits 0x1F00 of 658 * the 16-bit value at an offset of 14 (shifted right 659 * 8 - figure out which byte that is). 660 */
|
635 off_linktype = 20;
| 661 off_linktype = 14;
|
636 off_nl = 22; 637 return; 638
| 662 off_nl = 22; 663 return; 664
|
| 665 case DLT_IEEE802_11: 666 /* 667 * 802.11 doesn't really have a link-level type field. 668 * We set "off_linktype" to the offset of the LLC header. 669 * 670 * To check for Ethernet types, we assume that SSAP = SNAP 671 * is being used and pick out the encapsulated Ethernet type. 672 * XXX - should we generate code to check for SNAP? 673 * 674 * XXX - the header is actually variable-length. We 675 * assume a 24-byte link-layer header, as appears in 676 * data frames in networks with no bridges. 677 */ 678 off_linktype = 24; 679 off_nl = 30; 680 return; 681 682 case DLT_PRISM_HEADER: 683 /* 684 * Same as 802.11, but with an additional header before 685 * the 802.11 header, containing a bunch of additional 686 * information including radio-level information. 687 * 688 * The header is 144 bytes long. 689 * 690 * XXX - same variable-length header problem; at least 691 * the Prism header is fixed-length. 692 */ 693 off_linktype = 144+24; 694 off_nl = 144+30; 695 return; 696
|
639 case DLT_ATM_RFC1483: 640 /* 641 * assume routed, non-ISO PDUs 642 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 643 */ 644 off_linktype = 6; 645 off_nl = 8; 646 return; 647 648 case DLT_RAW: 649 off_linktype = -1; 650 off_nl = 0; 651 return; 652 653 case DLT_ATM_CLIP: /* Linux ATM defines this */ 654 off_linktype = 6; 655 off_nl = 8; 656 return; 657 658 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 659 off_linktype = 14; 660 off_nl = 16; 661 return;
| 697 case DLT_ATM_RFC1483: 698 /* 699 * assume routed, non-ISO PDUs 700 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 701 */ 702 off_linktype = 6; 703 off_nl = 8; 704 return; 705 706 case DLT_RAW: 707 off_linktype = -1; 708 off_nl = 0; 709 return; 710 711 case DLT_ATM_CLIP: /* Linux ATM defines this */ 712 off_linktype = 6; 713 off_nl = 8; 714 return; 715 716 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 717 off_linktype = 14; 718 off_nl = 16; 719 return;
|
| 720 721 case DLT_LTALK: 722 /* 723 * LocalTalk does have a 1-byte type field in the LLAP header, 724 * but really it just indicates whether there is a "short" or 725 * "long" DDP packet following. 726 */ 727 off_linktype = -1; 728 off_nl = 0; 729 return;
|
662 } 663 bpf_error("unknown data link type %d", linktype); 664 /* NOTREACHED */ 665} 666 667static struct block * 668gen_uncond(rsense) 669 int rsense; 670{ 671 struct block *b; 672 struct slist *s; 673 674 s = new_stmt(BPF_LD|BPF_IMM); 675 s->s.k = !rsense; 676 b = new_block(JMP(BPF_JEQ)); 677 b->stmts = s; 678 679 return b; 680} 681 682static inline struct block * 683gen_true() 684{ 685 return gen_uncond(1); 686} 687 688static inline struct block * 689gen_false() 690{ 691 return gen_uncond(0); 692} 693 694/* 695 * Byte-swap a 32-bit number. 696 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 697 * big-endian platforms.) 698 */ 699#define SWAPLONG(y) \ 700((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 701 702static struct block * 703gen_linktype(proto) 704 register int proto; 705{ 706 struct block *b0, *b1; 707
| 730 } 731 bpf_error("unknown data link type %d", linktype); 732 /* NOTREACHED */ 733} 734 735static struct block * 736gen_uncond(rsense) 737 int rsense; 738{ 739 struct block *b; 740 struct slist *s; 741 742 s = new_stmt(BPF_LD|BPF_IMM); 743 s->s.k = !rsense; 744 b = new_block(JMP(BPF_JEQ)); 745 b->stmts = s; 746 747 return b; 748} 749 750static inline struct block * 751gen_true() 752{ 753 return gen_uncond(1); 754} 755 756static inline struct block * 757gen_false() 758{ 759 return gen_uncond(0); 760} 761 762/* 763 * Byte-swap a 32-bit number. 764 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 765 * big-endian platforms.) 766 */ 767#define SWAPLONG(y) \ 768((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 769 770static struct block * 771gen_linktype(proto) 772 register int proto; 773{ 774 struct block *b0, *b1; 775
|
708 /* If we're not using encapsulation, we're done */ 709 if (off_linktype == -1) 710 return gen_true(); 711
| |
712 switch (linktype) { 713 714 case DLT_EN10MB:
| 776 switch (linktype) { 777 778 case DLT_EN10MB:
|
715 /* 716 * XXX - handle other LLC-encapsulated protocols here 717 * (IPX, OSI)? 718 */
| |
719 switch (proto) { 720
| 779 switch (proto) { 780
|
721 case LLC_ISO_LSAP:
| 781 case LLCSAP_ISONS:
|
722 /* 723 * OSI protocols always use 802.2 encapsulation.
| 782 /* 783 * OSI protocols always use 802.2 encapsulation.
|
| 784 * XXX - should we check both the DSAP and the 785 * SSAP, like this, or should we check just the 786 * DSAP?
|
724 */ 725 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 726 gen_not(b0); 727 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
| 787 */ 788 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 789 gen_not(b0); 790 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
|
728 ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
| 791 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
|
729 gen_and(b0, b1); 730 return b1; 731
| 792 gen_and(b0, b1); 793 return b1; 794
|
| 795 case LLCSAP_NETBEUI: 796 /* 797 * NetBEUI always uses 802.2 encapsulation. 798 * XXX - should we check both the DSAP and the 799 * SSAP, like this, or should we check just the 800 * DSAP? 801 */ 802 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 803 gen_not(b0); 804 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 805 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 806 gen_and(b0, b1); 807 return b1; 808 809 case LLCSAP_IPX: 810 /* 811 * Check for; 812 * 813 * Ethernet_II frames, which are Ethernet 814 * frames with a frame type of ETHERTYPE_IPX; 815 * 816 * Ethernet_802.3 frames, which are 802.3 817 * frames (i.e., the type/length field is 818 * a length field, <= ETHERMTU, rather than 819 * a type field) with the first two bytes 820 * after the Ethernet/802.3 header being 821 * 0xFFFF; 822 * 823 * Ethernet_802.2 frames, which are 802.3 824 * frames with an 802.2 LLC header and 825 * with the IPX LSAP as the DSAP in the LLC 826 * header; 827 * 828 * Ethernet_SNAP frames, which are 802.3 829 * frames with an LLC header and a SNAP 830 * header and with an OUI of 0x000000 831 * (encapsulated Ethernet) and a protocol 832 * ID of ETHERTYPE_IPX in the SNAP header. 833 * 834 * XXX - should we generate the same code both 835 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 836 */ 837 838 /* 839 * This generates code to check both for the 840 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 841 */ 842 b0 = gen_cmp(off_linktype + 2, BPF_B, 843 (bpf_int32)LLCSAP_IPX); 844 b1 = gen_cmp(off_linktype + 2, BPF_H, 845 (bpf_int32)0xFFFF); 846 gen_or(b0, b1); 847 848 /* 849 * Now we add code to check for SNAP frames with 850 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 851 */ 852 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14); 853 gen_or(b0, b1); 854 855 /* 856 * Now we generate code to check for 802.3 857 * frames in general. 858 */ 859 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 860 gen_not(b0); 861 862 /* 863 * Now add the check for 802.3 frames before the 864 * check for Ethernet_802.2 and Ethernet_802.3, 865 * as those checks should only be done on 802.3 866 * frames, not on Ethernet frames. 867 */ 868 gen_and(b0, b1); 869 870 /* 871 * Now add the check for Ethernet_II frames, and 872 * do that before checking for the other frame 873 * types. 874 */ 875 b0 = gen_cmp(off_linktype, BPF_H, 876 (bpf_int32)ETHERTYPE_IPX); 877 gen_or(b0, b1); 878 return b1; 879
|
732 case ETHERTYPE_ATALK: 733 case ETHERTYPE_AARP: 734 /* 735 * EtherTalk (AppleTalk protocols on Ethernet link 736 * layer) may use 802.2 encapsulation. 737 */ 738 739 /* 740 * Check for 802.2 encapsulation (EtherTalk phase 2?); 741 * we check for an Ethernet type field less than 742 * 1500, which means it's an 802.3 length field. 743 */ 744 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 745 gen_not(b0); 746 747 /* 748 * 802.2-encapsulated ETHERTYPE_ATALK packets are 749 * SNAP packets with an organization code of 750 * 0x080007 (Apple, for Appletalk) and a protocol 751 * type of ETHERTYPE_ATALK (Appletalk). 752 * 753 * 802.2-encapsulated ETHERTYPE_AARP packets are 754 * SNAP packets with an organization code of 755 * 0x000000 (encapsulated Ethernet) and a protocol 756 * type of ETHERTYPE_AARP (Appletalk ARP). 757 */ 758 if (proto == ETHERTYPE_ATALK) 759 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14); 760 else /* proto == ETHERTYPE_AARP */ 761 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14); 762 gen_and(b0, b1); 763 764 /* 765 * Check for Ethernet encapsulation (Ethertalk 766 * phase 1?); we just check for the Ethernet 767 * protocol type. 768 */ 769 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 770 771 gen_or(b0, b1); 772 return b1;
| 880 case ETHERTYPE_ATALK: 881 case ETHERTYPE_AARP: 882 /* 883 * EtherTalk (AppleTalk protocols on Ethernet link 884 * layer) may use 802.2 encapsulation. 885 */ 886 887 /* 888 * Check for 802.2 encapsulation (EtherTalk phase 2?); 889 * we check for an Ethernet type field less than 890 * 1500, which means it's an 802.3 length field. 891 */ 892 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 893 gen_not(b0); 894 895 /* 896 * 802.2-encapsulated ETHERTYPE_ATALK packets are 897 * SNAP packets with an organization code of 898 * 0x080007 (Apple, for Appletalk) and a protocol 899 * type of ETHERTYPE_ATALK (Appletalk). 900 * 901 * 802.2-encapsulated ETHERTYPE_AARP packets are 902 * SNAP packets with an organization code of 903 * 0x000000 (encapsulated Ethernet) and a protocol 904 * type of ETHERTYPE_AARP (Appletalk ARP). 905 */ 906 if (proto == ETHERTYPE_ATALK) 907 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14); 908 else /* proto == ETHERTYPE_AARP */ 909 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14); 910 gen_and(b0, b1); 911 912 /* 913 * Check for Ethernet encapsulation (Ethertalk 914 * phase 1?); we just check for the Ethernet 915 * protocol type. 916 */ 917 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 918 919 gen_or(b0, b1); 920 return b1;
|
| 921 922 default: 923 if (proto <= ETHERMTU) { 924 /* 925 * This is an LLC SAP value, so the frames 926 * that match would be 802.2 frames. 927 * Check that the frame is an 802.2 frame 928 * (i.e., that the length/type field is 929 * a length field, <= ETHERMTU) and 930 * then check the DSAP. 931 */ 932 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 933 gen_not(b0); 934 b1 = gen_cmp(off_linktype + 2, BPF_B, 935 (bpf_int32)proto); 936 gen_and(b0, b1); 937 return b1; 938 } else { 939 /* 940 * This is an Ethernet type, so compare 941 * the length/type field with it (if 942 * the frame is an 802.2 frame, the length 943 * field will be <= ETHERMTU, and, as 944 * "proto" is > ETHERMTU, this test 945 * will fail and the frame won't match, 946 * which is what we want). 947 */ 948 return gen_cmp(off_linktype, BPF_H, 949 (bpf_int32)proto); 950 }
|
773 } 774 break; 775
| 951 } 952 break; 953
|
| 954 case DLT_IEEE802_11: 955 case DLT_PRISM_HEADER: 956 case DLT_FDDI: 957 case DLT_IEEE802: 958 case DLT_ATM_RFC1483: 959 case DLT_ATM_CLIP: 960 /* 961 * XXX - handle token-ring variable-length header. 962 */ 963 switch (proto) { 964 965 case LLCSAP_ISONS: 966 return gen_cmp(off_linktype, BPF_H, (long) 967 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 968 969 case LLCSAP_NETBEUI: 970 return gen_cmp(off_linktype, BPF_H, (long) 971 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 972 973 case LLCSAP_IPX: 974 /* 975 * XXX - are there ever SNAP frames for IPX on 976 * non-Ethernet 802.x networks? 977 */ 978 return gen_cmp(off_linktype, BPF_B, 979 (bpf_int32)LLCSAP_IPX); 980 981 case ETHERTYPE_ATALK: 982 /* 983 * 802.2-encapsulated ETHERTYPE_ATALK packets are 984 * SNAP packets with an organization code of 985 * 0x080007 (Apple, for Appletalk) and a protocol 986 * type of ETHERTYPE_ATALK (Appletalk). 987 * 988 * XXX - check for an organization code of 989 * encapsulated Ethernet as well? 990 */ 991 return gen_snap(0x080007, ETHERTYPE_ATALK, 992 off_linktype); 993 break; 994 995 default: 996 /* 997 * XXX - we don't have to check for IPX 802.3 998 * here, but should we check for the IPX Ethertype? 999 */ 1000 if (proto <= ETHERMTU) { 1001 /* 1002 * This is an LLC SAP value, so check 1003 * the DSAP. 1004 */ 1005 return gen_cmp(off_linktype, BPF_B, 1006 (bpf_int32)proto); 1007 } else { 1008 /* 1009 * This is an Ethernet type; we assume 1010 * that it's unlikely that it'll 1011 * appear in the right place at random, 1012 * and therefore check only the 1013 * location that would hold the Ethernet 1014 * type in a SNAP frame with an organization 1015 * code of 0x000000 (encapsulated Ethernet). 1016 * 1017 * XXX - if we were to check for the SNAP DSAP 1018 * and LSAP, as per XXX, and were also to check 1019 * for an organization code of 0x000000 1020 * (encapsulated Ethernet), we'd do 1021 * 1022 * return gen_snap(0x000000, proto, 1023 * off_linktype); 1024 * 1025 * here; for now, we don't, as per the above. 1026 * I don't know whether it's worth the 1027 * extra CPU time to do the right check 1028 * or not. 1029 */ 1030 return gen_cmp(off_linktype+6, BPF_H, 1031 (bpf_int32)proto); 1032 } 1033 } 1034 break; 1035 1036 case DLT_LINUX_SLL: 1037 switch (proto) { 1038 1039 case LLCSAP_ISONS: 1040 /* 1041 * OSI protocols always use 802.2 encapsulation. 1042 * XXX - should we check both the DSAP and the 1043 * LSAP, like this, or should we check just the 1044 * DSAP? 1045 */ 1046 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1047 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1048 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 1049 gen_and(b0, b1); 1050 return b1; 1051 1052 case LLCSAP_NETBEUI: 1053 /* 1054 * NetBEUI always uses 802.2 encapsulation. 1055 * XXX - should we check both the DSAP and the 1056 * LSAP, like this, or should we check just the 1057 * DSAP? 1058 */ 1059 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1060 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1061 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 1062 gen_and(b0, b1); 1063 return b1; 1064 1065 case LLCSAP_IPX: 1066 /* 1067 * Ethernet_II frames, which are Ethernet 1068 * frames with a frame type of ETHERTYPE_IPX; 1069 * 1070 * Ethernet_802.3 frames, which have a frame 1071 * type of LINUX_SLL_P_802_3; 1072 * 1073 * Ethernet_802.2 frames, which are 802.3 1074 * frames with an 802.2 LLC header (i.e, have 1075 * a frame type of LINUX_SLL_P_802_2) and 1076 * with the IPX LSAP as the DSAP in the LLC 1077 * header; 1078 * 1079 * Ethernet_SNAP frames, which are 802.3 1080 * frames with an LLC header and a SNAP 1081 * header and with an OUI of 0x000000 1082 * (encapsulated Ethernet) and a protocol 1083 * ID of ETHERTYPE_IPX in the SNAP header. 1084 * 1085 * First, do the checks on LINUX_SLL_P_802_2 1086 * frames; generate the check for either 1087 * Ethernet_802.2 or Ethernet_SNAP frames, and 1088 * then put a check for LINUX_SLL_P_802_2 frames 1089 * before it. 1090 */ 1091 b0 = gen_cmp(off_linktype + 2, BPF_B, 1092 (bpf_int32)LLCSAP_IPX); 1093 b1 = gen_snap(0x000000, ETHERTYPE_IPX, 1094 off_linktype + 2); 1095 gen_or(b0, b1); 1096 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1097 gen_and(b0, b1); 1098 1099 /* 1100 * Now check for 802.3 frames and OR that with 1101 * the previous test. 1102 */ 1103 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3); 1104 gen_or(b0, b1); 1105 1106 /* 1107 * Now add the check for Ethernet_II frames, and 1108 * do that before checking for the other frame 1109 * types. 1110 */ 1111 b0 = gen_cmp(off_linktype, BPF_H, 1112 (bpf_int32)ETHERTYPE_IPX); 1113 gen_or(b0, b1); 1114 return b1; 1115 1116 case ETHERTYPE_ATALK: 1117 case ETHERTYPE_AARP: 1118 /* 1119 * EtherTalk (AppleTalk protocols on Ethernet link 1120 * layer) may use 802.2 encapsulation. 1121 */ 1122 1123 /* 1124 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1125 * we check for the 802.2 protocol type in the 1126 * "Ethernet type" field. 1127 */ 1128 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1129 1130 /* 1131 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1132 * SNAP packets with an organization code of 1133 * 0x080007 (Apple, for Appletalk) and a protocol 1134 * type of ETHERTYPE_ATALK (Appletalk). 1135 * 1136 * 802.2-encapsulated ETHERTYPE_AARP packets are 1137 * SNAP packets with an organization code of 1138 * 0x000000 (encapsulated Ethernet) and a protocol 1139 * type of ETHERTYPE_AARP (Appletalk ARP). 1140 */ 1141 if (proto == ETHERTYPE_ATALK) 1142 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 1143 off_linktype + 2); 1144 else /* proto == ETHERTYPE_AARP */ 1145 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 1146 off_linktype + 2); 1147 gen_and(b0, b1); 1148 1149 /* 1150 * Check for Ethernet encapsulation (Ethertalk 1151 * phase 1?); we just check for the Ethernet 1152 * protocol type. 1153 */ 1154 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1155 1156 gen_or(b0, b1); 1157 return b1; 1158 1159 default: 1160 if (proto <= ETHERMTU) { 1161 /* 1162 * This is an LLC SAP value, so the frames 1163 * that match would be 802.2 frames. 1164 * Check for the 802.2 protocol type 1165 * in the "Ethernet type" field, and 1166 * then check the DSAP. 1167 */ 1168 b0 = gen_cmp(off_linktype, BPF_H, 1169 LINUX_SLL_P_802_2); 1170 b1 = gen_cmp(off_linktype + 2, BPF_B, 1171 (bpf_int32)proto); 1172 gen_and(b0, b1); 1173 return b1; 1174 } else { 1175 /* 1176 * This is an Ethernet type, so compare 1177 * the length/type field with it (if 1178 * the frame is an 802.2 frame, the length 1179 * field will be <= ETHERMTU, and, as 1180 * "proto" is > ETHERMTU, this test 1181 * will fail and the frame won't match, 1182 * which is what we want). 1183 */ 1184 return gen_cmp(off_linktype, BPF_H, 1185 (bpf_int32)proto); 1186 } 1187 } 1188 break; 1189
|
776 case DLT_SLIP:
| 1190 case DLT_SLIP:
|
777 return gen_false();
| 1191 case DLT_SLIP_BSDOS: 1192 case DLT_RAW: 1193 /* 1194 * These types don't provide any type field; packets 1195 * are always IP. 1196 * 1197 * XXX - for IPv4, check for a version number of 4, and, 1198 * for IPv6, check for a version number of 6? 1199 */ 1200 switch (proto) {
|
778
| 1201
|
| 1202 case ETHERTYPE_IP: 1203#ifdef INET6 1204 case ETHERTYPE_IPV6: 1205#endif 1206 return gen_true(); /* always true */ 1207 1208 default: 1209 return gen_false(); /* always false */ 1210 } 1211 break; 1212
|
779 case DLT_PPP: 780 case DLT_PPP_SERIAL:
| 1213 case DLT_PPP: 1214 case DLT_PPP_SERIAL:
|
| 1215 case DLT_PPP_ETHER:
|
781 /* 782 * We use Ethernet protocol types inside libpcap; 783 * map them to the corresponding PPP protocol types. 784 */ 785 switch (proto) { 786 787 case ETHERTYPE_IP: 788 proto = PPP_IP; /* XXX was 0x21 */ 789 break; 790 791#ifdef INET6 792 case ETHERTYPE_IPV6: 793 proto = PPP_IPV6; 794 break; 795#endif 796 797 case ETHERTYPE_DN: 798 proto = PPP_DECNET; 799 break; 800 801 case ETHERTYPE_ATALK: 802 proto = PPP_APPLE; 803 break; 804 805 case ETHERTYPE_NS: 806 proto = PPP_NS; 807 break; 808
| 1216 /* 1217 * We use Ethernet protocol types inside libpcap; 1218 * map them to the corresponding PPP protocol types. 1219 */ 1220 switch (proto) { 1221 1222 case ETHERTYPE_IP: 1223 proto = PPP_IP; /* XXX was 0x21 */ 1224 break; 1225 1226#ifdef INET6 1227 case ETHERTYPE_IPV6: 1228 proto = PPP_IPV6; 1229 break; 1230#endif 1231 1232 case ETHERTYPE_DN: 1233 proto = PPP_DECNET; 1234 break; 1235 1236 case ETHERTYPE_ATALK: 1237 proto = PPP_APPLE; 1238 break; 1239 1240 case ETHERTYPE_NS: 1241 proto = PPP_NS; 1242 break; 1243
|
809 case LLC_ISO_LSAP:
| 1244 case LLCSAP_ISONS:
|
810 proto = PPP_OSI; 811 break;
| 1245 proto = PPP_OSI; 1246 break;
|
| 1247 1248 case LLCSAP_8021D: 1249 /* 1250 * I'm assuming the "Bridging PDU"s that go 1251 * over PPP are Spanning Tree Protocol 1252 * Bridging PDUs. 1253 */ 1254 proto = PPP_BRPDU; 1255 break; 1256 1257 case LLCSAP_IPX: 1258 proto = PPP_IPX; 1259 break;
|
812 } 813 break; 814 815 case DLT_PPP_BSDOS: 816 /* 817 * We use Ethernet protocol types inside libpcap; 818 * map them to the corresponding PPP protocol types. 819 */ 820 switch (proto) { 821 822 case ETHERTYPE_IP: 823 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP); 824 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC); 825 gen_or(b0, b1); 826 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC); 827 gen_or(b1, b0); 828 return b0; 829 830#ifdef INET6 831 case ETHERTYPE_IPV6: 832 proto = PPP_IPV6; 833 /* more to go? */ 834 break; 835#endif 836 837 case ETHERTYPE_DN: 838 proto = PPP_DECNET; 839 break; 840 841 case ETHERTYPE_ATALK: 842 proto = PPP_APPLE; 843 break; 844 845 case ETHERTYPE_NS: 846 proto = PPP_NS; 847 break; 848
| 1260 } 1261 break; 1262 1263 case DLT_PPP_BSDOS: 1264 /* 1265 * We use Ethernet protocol types inside libpcap; 1266 * map them to the corresponding PPP protocol types. 1267 */ 1268 switch (proto) { 1269 1270 case ETHERTYPE_IP: 1271 b0 = gen_cmp(off_linktype, BPF_H, PPP_IP); 1272 b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC); 1273 gen_or(b0, b1); 1274 b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC); 1275 gen_or(b1, b0); 1276 return b0; 1277 1278#ifdef INET6 1279 case ETHERTYPE_IPV6: 1280 proto = PPP_IPV6; 1281 /* more to go? */ 1282 break; 1283#endif 1284 1285 case ETHERTYPE_DN: 1286 proto = PPP_DECNET; 1287 break; 1288 1289 case ETHERTYPE_ATALK: 1290 proto = PPP_APPLE; 1291 break; 1292 1293 case ETHERTYPE_NS: 1294 proto = PPP_NS; 1295 break; 1296
|
849 case LLC_ISO_LSAP:
| 1297 case LLCSAP_ISONS:
|
850 proto = PPP_OSI; 851 break;
| 1298 proto = PPP_OSI; 1299 break;
|
| 1300 1301 case LLCSAP_8021D: 1302 /* 1303 * I'm assuming the "Bridging PDU"s that go 1304 * over PPP are Spanning Tree Protocol 1305 * Bridging PDUs. 1306 */ 1307 proto = PPP_BRPDU; 1308 break; 1309 1310 case LLCSAP_IPX: 1311 proto = PPP_IPX; 1312 break;
|
852 } 853 break; 854 855 case DLT_NULL: 856 case DLT_LOOP: 857 /* 858 * For DLT_NULL, the link-layer header is a 32-bit 859 * word containing an AF_ value in *host* byte order. 860 * 861 * In addition, if we're reading a saved capture file, 862 * the host byte order in the capture may not be the 863 * same as the host byte order on this machine. 864 * 865 * For DLT_LOOP, the link-layer header is a 32-bit 866 * word containing an AF_ value in *network* byte order. 867 * 868 * XXX - AF_ values may, unfortunately, be platform- 869 * dependent; for example, FreeBSD's AF_INET6 is 24 870 * whilst NetBSD's and OpenBSD's is 26. 871 * 872 * This means that, when reading a capture file, just 873 * checking for our AF_INET6 value won't work if the 874 * capture file came from another OS. 875 */ 876 switch (proto) { 877 878 case ETHERTYPE_IP: 879 proto = AF_INET; 880 break; 881 882#ifdef INET6 883 case ETHERTYPE_IPV6: 884 proto = AF_INET6; 885 break; 886#endif 887 888 default: 889 /* 890 * Not a type on which we support filtering. 891 * XXX - support those that have AF_ values 892 * #defined on this platform, at least? 893 */ 894 return gen_false(); 895 } 896 897 if (linktype == DLT_NULL) { 898 /* 899 * The AF_ value is in host byte order, but 900 * the BPF interpreter will convert it to 901 * network byte order. 902 * 903 * If this is a save file, and it's from a 904 * machine with the opposite byte order to 905 * ours, we byte-swap the AF_ value. 906 * 907 * Then we run it through "htonl()", and 908 * generate code to compare against the result. 909 */ 910 if (bpf_pcap->sf.rfile != NULL && 911 bpf_pcap->sf.swapped) 912 proto = SWAPLONG(proto); 913 proto = htonl(proto); 914 } 915 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
| 1313 } 1314 break; 1315 1316 case DLT_NULL: 1317 case DLT_LOOP: 1318 /* 1319 * For DLT_NULL, the link-layer header is a 32-bit 1320 * word containing an AF_ value in *host* byte order. 1321 * 1322 * In addition, if we're reading a saved capture file, 1323 * the host byte order in the capture may not be the 1324 * same as the host byte order on this machine. 1325 * 1326 * For DLT_LOOP, the link-layer header is a 32-bit 1327 * word containing an AF_ value in *network* byte order. 1328 * 1329 * XXX - AF_ values may, unfortunately, be platform- 1330 * dependent; for example, FreeBSD's AF_INET6 is 24 1331 * whilst NetBSD's and OpenBSD's is 26. 1332 * 1333 * This means that, when reading a capture file, just 1334 * checking for our AF_INET6 value won't work if the 1335 * capture file came from another OS. 1336 */ 1337 switch (proto) { 1338 1339 case ETHERTYPE_IP: 1340 proto = AF_INET; 1341 break; 1342 1343#ifdef INET6 1344 case ETHERTYPE_IPV6: 1345 proto = AF_INET6; 1346 break; 1347#endif 1348 1349 default: 1350 /* 1351 * Not a type on which we support filtering. 1352 * XXX - support those that have AF_ values 1353 * #defined on this platform, at least? 1354 */ 1355 return gen_false(); 1356 } 1357 1358 if (linktype == DLT_NULL) { 1359 /* 1360 * The AF_ value is in host byte order, but 1361 * the BPF interpreter will convert it to 1362 * network byte order. 1363 * 1364 * If this is a save file, and it's from a 1365 * machine with the opposite byte order to 1366 * ours, we byte-swap the AF_ value. 1367 * 1368 * Then we run it through "htonl()", and 1369 * generate code to compare against the result. 1370 */ 1371 if (bpf_pcap->sf.rfile != NULL && 1372 bpf_pcap->sf.swapped) 1373 proto = SWAPLONG(proto); 1374 proto = htonl(proto); 1375 } 1376 return (gen_cmp(0, BPF_W, (bpf_int32)proto));
|
| 1377 1378 case DLT_ARCNET: 1379 /* 1380 * XXX should we check for first fragment if the protocol 1381 * uses PHDS? 1382 */ 1383 switch(proto) { 1384 default: 1385 return gen_false(); 1386#ifdef INET6 1387 case ETHERTYPE_IPV6: 1388 return(gen_cmp(2, BPF_B, 1389 (bpf_int32)htonl(ARCTYPE_INET6))); 1390#endif /* INET6 */ 1391 case ETHERTYPE_IP: 1392 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP)); 1393 b1 = gen_cmp(2, BPF_B, 1394 (bpf_int32)htonl(ARCTYPE_IP_OLD)); 1395 gen_or(b0, b1); 1396 return(b1); 1397 case ETHERTYPE_ARP: 1398 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP)); 1399 b1 = gen_cmp(2, BPF_B, 1400 (bpf_int32)htonl(ARCTYPE_ARP_OLD)); 1401 gen_or(b0, b1); 1402 return(b1); 1403 case ETHERTYPE_REVARP: 1404 return(gen_cmp(2, BPF_B, 1405 (bpf_int32)htonl(ARCTYPE_REVARP))); 1406 case ETHERTYPE_ATALK: 1407 return(gen_cmp(2, BPF_B, 1408 (bpf_int32)htonl(ARCTYPE_ATALK))); 1409 } 1410 break; 1411 1412 case DLT_LTALK: 1413 switch (proto) { 1414 case ETHERTYPE_ATALK: 1415 return gen_true(); 1416 default: 1417 return gen_false(); 1418 } 1419 break;
|
916 }
| 1420 }
|
| 1421 1422 /* 1423 * All the types that have no encapsulation should either be 1424 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if 1425 * all packets are IP packets, or should be handled in some 1426 * special case, if none of them are (if some are and some 1427 * aren't, the lack of encapsulation is a problem, as we'd 1428 * have to find some other way of determining the packet type). 1429 * 1430 * Therefore, if "off_linktype" is -1, there's an error. 1431 */ 1432 if (off_linktype == -1) 1433 abort(); 1434 1435 /* 1436 * Any type not handled above should always have an Ethernet 1437 * type at an offset of "off_linktype". (PPP is partially 1438 * handled above - the protocol type is mapped from the 1439 * Ethernet and LLC types we use internally to the corresponding 1440 * PPP type - but the PPP type is always specified by a value 1441 * at "off_linktype", so we don't have to do the code generation 1442 * above.) 1443 */
|
917 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 918} 919 920/* 921 * Check for an LLC SNAP packet with a given organization code and 922 * protocol type; we check the entire contents of the 802.2 LLC and 923 * snap headers, checking for DSAP and SSAP of SNAP and a control 924 * field of 0x03 in the LLC header, and for the specified organization 925 * code and protocol type in the SNAP header. 926 */ 927static struct block * 928gen_snap(orgcode, ptype, offset) 929 bpf_u_int32 orgcode; 930 bpf_u_int32 ptype; 931 u_int offset; 932{ 933 u_char snapblock[8]; 934
| 1444 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1445} 1446 1447/* 1448 * Check for an LLC SNAP packet with a given organization code and 1449 * protocol type; we check the entire contents of the 802.2 LLC and 1450 * snap headers, checking for DSAP and SSAP of SNAP and a control 1451 * field of 0x03 in the LLC header, and for the specified organization 1452 * code and protocol type in the SNAP header. 1453 */ 1454static struct block * 1455gen_snap(orgcode, ptype, offset) 1456 bpf_u_int32 orgcode; 1457 bpf_u_int32 ptype; 1458 u_int offset; 1459{ 1460 u_char snapblock[8]; 1461
|
935 snapblock[0] = LLC_SNAP_LSAP; /* DSAP = SNAP */ 936 snapblock[1] = LLC_SNAP_LSAP; /* SSAP = SNAP */
| 1462 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 1463 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
|
937 snapblock[2] = 0x03; /* control = UI */ 938 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 939 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 940 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 941 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 942 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ 943 return gen_bcmp(offset, 8, snapblock); 944} 945 946static struct block * 947gen_hostop(addr, mask, dir, proto, src_off, dst_off) 948 bpf_u_int32 addr; 949 bpf_u_int32 mask; 950 int dir, proto; 951 u_int src_off, dst_off; 952{ 953 struct block *b0, *b1; 954 u_int offset; 955 956 switch (dir) { 957 958 case Q_SRC: 959 offset = src_off; 960 break; 961 962 case Q_DST: 963 offset = dst_off; 964 break; 965 966 case Q_AND: 967 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 968 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 969 gen_and(b0, b1); 970 return b1; 971 972 case Q_OR: 973 case Q_DEFAULT: 974 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 975 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 976 gen_or(b0, b1); 977 return b1; 978 979 default: 980 abort(); 981 } 982 b0 = gen_linktype(proto); 983 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask); 984 gen_and(b0, b1); 985 return b1; 986} 987 988#ifdef INET6 989static struct block * 990gen_hostop6(addr, mask, dir, proto, src_off, dst_off) 991 struct in6_addr *addr; 992 struct in6_addr *mask; 993 int dir, proto; 994 u_int src_off, dst_off; 995{ 996 struct block *b0, *b1; 997 u_int offset; 998 u_int32_t *a, *m; 999 1000 switch (dir) { 1001 1002 case Q_SRC: 1003 offset = src_off; 1004 break; 1005 1006 case Q_DST: 1007 offset = dst_off; 1008 break; 1009 1010 case Q_AND: 1011 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1012 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1013 gen_and(b0, b1); 1014 return b1; 1015 1016 case Q_OR: 1017 case Q_DEFAULT: 1018 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1019 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1020 gen_or(b0, b1); 1021 return b1; 1022 1023 default: 1024 abort(); 1025 } 1026 /* this order is important */ 1027 a = (u_int32_t *)addr; 1028 m = (u_int32_t *)mask; 1029 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 1030 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 1031 gen_and(b0, b1); 1032 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 1033 gen_and(b0, b1); 1034 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 1035 gen_and(b0, b1); 1036 b0 = gen_linktype(proto); 1037 gen_and(b0, b1); 1038 return b1; 1039} 1040#endif /*INET6*/ 1041 1042static struct block * 1043gen_ehostop(eaddr, dir) 1044 register const u_char *eaddr; 1045 register int dir; 1046{ 1047 register struct block *b0, *b1; 1048 1049 switch (dir) { 1050 case Q_SRC: 1051 return gen_bcmp(6, 6, eaddr); 1052 1053 case Q_DST: 1054 return gen_bcmp(0, 6, eaddr); 1055 1056 case Q_AND: 1057 b0 = gen_ehostop(eaddr, Q_SRC); 1058 b1 = gen_ehostop(eaddr, Q_DST); 1059 gen_and(b0, b1); 1060 return b1; 1061 1062 case Q_DEFAULT: 1063 case Q_OR: 1064 b0 = gen_ehostop(eaddr, Q_SRC); 1065 b1 = gen_ehostop(eaddr, Q_DST); 1066 gen_or(b0, b1); 1067 return b1; 1068 } 1069 abort(); 1070 /* NOTREACHED */ 1071} 1072 1073/* 1074 * Like gen_ehostop, but for DLT_FDDI 1075 */ 1076static struct block * 1077gen_fhostop(eaddr, dir) 1078 register const u_char *eaddr; 1079 register int dir; 1080{ 1081 struct block *b0, *b1; 1082 1083 switch (dir) { 1084 case Q_SRC: 1085#ifdef PCAP_FDDIPAD 1086 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr); 1087#else 1088 return gen_bcmp(6 + 1, 6, eaddr); 1089#endif 1090 1091 case Q_DST: 1092#ifdef PCAP_FDDIPAD 1093 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr); 1094#else 1095 return gen_bcmp(0 + 1, 6, eaddr); 1096#endif 1097 1098 case Q_AND: 1099 b0 = gen_fhostop(eaddr, Q_SRC); 1100 b1 = gen_fhostop(eaddr, Q_DST); 1101 gen_and(b0, b1); 1102 return b1; 1103 1104 case Q_DEFAULT: 1105 case Q_OR: 1106 b0 = gen_fhostop(eaddr, Q_SRC); 1107 b1 = gen_fhostop(eaddr, Q_DST); 1108 gen_or(b0, b1); 1109 return b1; 1110 } 1111 abort(); 1112 /* NOTREACHED */ 1113} 1114 1115/* 1116 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 1117 */ 1118static struct block * 1119gen_thostop(eaddr, dir) 1120 register const u_char *eaddr; 1121 register int dir; 1122{ 1123 register struct block *b0, *b1; 1124 1125 switch (dir) { 1126 case Q_SRC: 1127 return gen_bcmp(8, 6, eaddr); 1128 1129 case Q_DST: 1130 return gen_bcmp(2, 6, eaddr); 1131 1132 case Q_AND: 1133 b0 = gen_thostop(eaddr, Q_SRC); 1134 b1 = gen_thostop(eaddr, Q_DST); 1135 gen_and(b0, b1); 1136 return b1; 1137 1138 case Q_DEFAULT: 1139 case Q_OR: 1140 b0 = gen_thostop(eaddr, Q_SRC); 1141 b1 = gen_thostop(eaddr, Q_DST); 1142 gen_or(b0, b1); 1143 return b1; 1144 } 1145 abort(); 1146 /* NOTREACHED */ 1147} 1148 1149/* 1150 * This is quite tricky because there may be pad bytes in front of the 1151 * DECNET header, and then there are two possible data packet formats that 1152 * carry both src and dst addresses, plus 5 packet types in a format that 1153 * carries only the src node, plus 2 types that use a different format and 1154 * also carry just the src node. 1155 * 1156 * Yuck. 1157 * 1158 * Instead of doing those all right, we just look for data packets with 1159 * 0 or 1 bytes of padding. If you want to look at other packets, that 1160 * will require a lot more hacking. 1161 * 1162 * To add support for filtering on DECNET "areas" (network numbers) 1163 * one would want to add a "mask" argument to this routine. That would 1164 * make the filter even more inefficient, although one could be clever 1165 * and not generate masking instructions if the mask is 0xFFFF. 1166 */ 1167static struct block * 1168gen_dnhostop(addr, dir, base_off) 1169 bpf_u_int32 addr; 1170 int dir; 1171 u_int base_off; 1172{ 1173 struct block *b0, *b1, *b2, *tmp; 1174 u_int offset_lh; /* offset if long header is received */ 1175 u_int offset_sh; /* offset if short header is received */ 1176 1177 switch (dir) { 1178 1179 case Q_DST: 1180 offset_sh = 1; /* follows flags */ 1181 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 1182 break; 1183 1184 case Q_SRC: 1185 offset_sh = 3; /* follows flags, dstnode */ 1186 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 1187 break; 1188 1189 case Q_AND: 1190 /* Inefficient because we do our Calvinball dance twice */ 1191 b0 = gen_dnhostop(addr, Q_SRC, base_off); 1192 b1 = gen_dnhostop(addr, Q_DST, base_off); 1193 gen_and(b0, b1); 1194 return b1; 1195 1196 case Q_OR: 1197 case Q_DEFAULT: 1198 /* Inefficient because we do our Calvinball dance twice */ 1199 b0 = gen_dnhostop(addr, Q_SRC, base_off); 1200 b1 = gen_dnhostop(addr, Q_DST, base_off); 1201 gen_or(b0, b1); 1202 return b1; 1203 1204 case Q_ISO: 1205 bpf_error("ISO host filtering not implemented"); 1206 1207 default: 1208 abort(); 1209 } 1210 b0 = gen_linktype(ETHERTYPE_DN); 1211 /* Check for pad = 1, long header case */ 1212 tmp = gen_mcmp(base_off + 2, BPF_H, 1213 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); 1214 b1 = gen_cmp(base_off + 2 + 1 + offset_lh, 1215 BPF_H, (bpf_int32)ntohs(addr)); 1216 gen_and(tmp, b1); 1217 /* Check for pad = 0, long header case */ 1218 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 1219 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); 1220 gen_and(tmp, b2); 1221 gen_or(b2, b1); 1222 /* Check for pad = 1, short header case */ 1223 tmp = gen_mcmp(base_off + 2, BPF_H, 1224 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); 1225 b2 = gen_cmp(base_off + 2 + 1 + offset_sh, 1226 BPF_H, (bpf_int32)ntohs(addr)); 1227 gen_and(tmp, b2); 1228 gen_or(b2, b1); 1229 /* Check for pad = 0, short header case */ 1230 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 1231 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); 1232 gen_and(tmp, b2); 1233 gen_or(b2, b1); 1234 1235 /* Combine with test for linktype */ 1236 gen_and(b0, b1); 1237 return b1; 1238} 1239 1240static struct block * 1241gen_host(addr, mask, proto, dir) 1242 bpf_u_int32 addr; 1243 bpf_u_int32 mask; 1244 int proto; 1245 int dir; 1246{ 1247 struct block *b0, *b1; 1248 1249 switch (proto) { 1250 1251 case Q_DEFAULT: 1252 b0 = gen_host(addr, mask, Q_IP, dir); 1253 if (off_linktype != -1) { 1254 b1 = gen_host(addr, mask, Q_ARP, dir); 1255 gen_or(b0, b1); 1256 b0 = gen_host(addr, mask, Q_RARP, dir); 1257 gen_or(b1, b0); 1258 } 1259 return b0; 1260 1261 case Q_IP: 1262 return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 1263 off_nl + 12, off_nl + 16); 1264 1265 case Q_RARP: 1266 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 1267 off_nl + 14, off_nl + 24); 1268 1269 case Q_ARP: 1270 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 1271 off_nl + 14, off_nl + 24); 1272 1273 case Q_TCP: 1274 bpf_error("'tcp' modifier applied to host"); 1275
| 1464 snapblock[2] = 0x03; /* control = UI */ 1465 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 1466 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 1467 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 1468 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 1469 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ 1470 return gen_bcmp(offset, 8, snapblock); 1471} 1472 1473static struct block * 1474gen_hostop(addr, mask, dir, proto, src_off, dst_off) 1475 bpf_u_int32 addr; 1476 bpf_u_int32 mask; 1477 int dir, proto; 1478 u_int src_off, dst_off; 1479{ 1480 struct block *b0, *b1; 1481 u_int offset; 1482 1483 switch (dir) { 1484 1485 case Q_SRC: 1486 offset = src_off; 1487 break; 1488 1489 case Q_DST: 1490 offset = dst_off; 1491 break; 1492 1493 case Q_AND: 1494 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 1495 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 1496 gen_and(b0, b1); 1497 return b1; 1498 1499 case Q_OR: 1500 case Q_DEFAULT: 1501 b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); 1502 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 1503 gen_or(b0, b1); 1504 return b1; 1505 1506 default: 1507 abort(); 1508 } 1509 b0 = gen_linktype(proto); 1510 b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask); 1511 gen_and(b0, b1); 1512 return b1; 1513} 1514 1515#ifdef INET6 1516static struct block * 1517gen_hostop6(addr, mask, dir, proto, src_off, dst_off) 1518 struct in6_addr *addr; 1519 struct in6_addr *mask; 1520 int dir, proto; 1521 u_int src_off, dst_off; 1522{ 1523 struct block *b0, *b1; 1524 u_int offset; 1525 u_int32_t *a, *m; 1526 1527 switch (dir) { 1528 1529 case Q_SRC: 1530 offset = src_off; 1531 break; 1532 1533 case Q_DST: 1534 offset = dst_off; 1535 break; 1536 1537 case Q_AND: 1538 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1539 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1540 gen_and(b0, b1); 1541 return b1; 1542 1543 case Q_OR: 1544 case Q_DEFAULT: 1545 b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off); 1546 b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off); 1547 gen_or(b0, b1); 1548 return b1; 1549 1550 default: 1551 abort(); 1552 } 1553 /* this order is important */ 1554 a = (u_int32_t *)addr; 1555 m = (u_int32_t *)mask; 1556 b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 1557 b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 1558 gen_and(b0, b1); 1559 b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 1560 gen_and(b0, b1); 1561 b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 1562 gen_and(b0, b1); 1563 b0 = gen_linktype(proto); 1564 gen_and(b0, b1); 1565 return b1; 1566} 1567#endif /*INET6*/ 1568 1569static struct block * 1570gen_ehostop(eaddr, dir) 1571 register const u_char *eaddr; 1572 register int dir; 1573{ 1574 register struct block *b0, *b1; 1575 1576 switch (dir) { 1577 case Q_SRC: 1578 return gen_bcmp(6, 6, eaddr); 1579 1580 case Q_DST: 1581 return gen_bcmp(0, 6, eaddr); 1582 1583 case Q_AND: 1584 b0 = gen_ehostop(eaddr, Q_SRC); 1585 b1 = gen_ehostop(eaddr, Q_DST); 1586 gen_and(b0, b1); 1587 return b1; 1588 1589 case Q_DEFAULT: 1590 case Q_OR: 1591 b0 = gen_ehostop(eaddr, Q_SRC); 1592 b1 = gen_ehostop(eaddr, Q_DST); 1593 gen_or(b0, b1); 1594 return b1; 1595 } 1596 abort(); 1597 /* NOTREACHED */ 1598} 1599 1600/* 1601 * Like gen_ehostop, but for DLT_FDDI 1602 */ 1603static struct block * 1604gen_fhostop(eaddr, dir) 1605 register const u_char *eaddr; 1606 register int dir; 1607{ 1608 struct block *b0, *b1; 1609 1610 switch (dir) { 1611 case Q_SRC: 1612#ifdef PCAP_FDDIPAD 1613 return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr); 1614#else 1615 return gen_bcmp(6 + 1, 6, eaddr); 1616#endif 1617 1618 case Q_DST: 1619#ifdef PCAP_FDDIPAD 1620 return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr); 1621#else 1622 return gen_bcmp(0 + 1, 6, eaddr); 1623#endif 1624 1625 case Q_AND: 1626 b0 = gen_fhostop(eaddr, Q_SRC); 1627 b1 = gen_fhostop(eaddr, Q_DST); 1628 gen_and(b0, b1); 1629 return b1; 1630 1631 case Q_DEFAULT: 1632 case Q_OR: 1633 b0 = gen_fhostop(eaddr, Q_SRC); 1634 b1 = gen_fhostop(eaddr, Q_DST); 1635 gen_or(b0, b1); 1636 return b1; 1637 } 1638 abort(); 1639 /* NOTREACHED */ 1640} 1641 1642/* 1643 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 1644 */ 1645static struct block * 1646gen_thostop(eaddr, dir) 1647 register const u_char *eaddr; 1648 register int dir; 1649{ 1650 register struct block *b0, *b1; 1651 1652 switch (dir) { 1653 case Q_SRC: 1654 return gen_bcmp(8, 6, eaddr); 1655 1656 case Q_DST: 1657 return gen_bcmp(2, 6, eaddr); 1658 1659 case Q_AND: 1660 b0 = gen_thostop(eaddr, Q_SRC); 1661 b1 = gen_thostop(eaddr, Q_DST); 1662 gen_and(b0, b1); 1663 return b1; 1664 1665 case Q_DEFAULT: 1666 case Q_OR: 1667 b0 = gen_thostop(eaddr, Q_SRC); 1668 b1 = gen_thostop(eaddr, Q_DST); 1669 gen_or(b0, b1); 1670 return b1; 1671 } 1672 abort(); 1673 /* NOTREACHED */ 1674} 1675 1676/* 1677 * This is quite tricky because there may be pad bytes in front of the 1678 * DECNET header, and then there are two possible data packet formats that 1679 * carry both src and dst addresses, plus 5 packet types in a format that 1680 * carries only the src node, plus 2 types that use a different format and 1681 * also carry just the src node. 1682 * 1683 * Yuck. 1684 * 1685 * Instead of doing those all right, we just look for data packets with 1686 * 0 or 1 bytes of padding. If you want to look at other packets, that 1687 * will require a lot more hacking. 1688 * 1689 * To add support for filtering on DECNET "areas" (network numbers) 1690 * one would want to add a "mask" argument to this routine. That would 1691 * make the filter even more inefficient, although one could be clever 1692 * and not generate masking instructions if the mask is 0xFFFF. 1693 */ 1694static struct block * 1695gen_dnhostop(addr, dir, base_off) 1696 bpf_u_int32 addr; 1697 int dir; 1698 u_int base_off; 1699{ 1700 struct block *b0, *b1, *b2, *tmp; 1701 u_int offset_lh; /* offset if long header is received */ 1702 u_int offset_sh; /* offset if short header is received */ 1703 1704 switch (dir) { 1705 1706 case Q_DST: 1707 offset_sh = 1; /* follows flags */ 1708 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 1709 break; 1710 1711 case Q_SRC: 1712 offset_sh = 3; /* follows flags, dstnode */ 1713 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 1714 break; 1715 1716 case Q_AND: 1717 /* Inefficient because we do our Calvinball dance twice */ 1718 b0 = gen_dnhostop(addr, Q_SRC, base_off); 1719 b1 = gen_dnhostop(addr, Q_DST, base_off); 1720 gen_and(b0, b1); 1721 return b1; 1722 1723 case Q_OR: 1724 case Q_DEFAULT: 1725 /* Inefficient because we do our Calvinball dance twice */ 1726 b0 = gen_dnhostop(addr, Q_SRC, base_off); 1727 b1 = gen_dnhostop(addr, Q_DST, base_off); 1728 gen_or(b0, b1); 1729 return b1; 1730 1731 case Q_ISO: 1732 bpf_error("ISO host filtering not implemented"); 1733 1734 default: 1735 abort(); 1736 } 1737 b0 = gen_linktype(ETHERTYPE_DN); 1738 /* Check for pad = 1, long header case */ 1739 tmp = gen_mcmp(base_off + 2, BPF_H, 1740 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); 1741 b1 = gen_cmp(base_off + 2 + 1 + offset_lh, 1742 BPF_H, (bpf_int32)ntohs(addr)); 1743 gen_and(tmp, b1); 1744 /* Check for pad = 0, long header case */ 1745 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 1746 b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); 1747 gen_and(tmp, b2); 1748 gen_or(b2, b1); 1749 /* Check for pad = 1, short header case */ 1750 tmp = gen_mcmp(base_off + 2, BPF_H, 1751 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); 1752 b2 = gen_cmp(base_off + 2 + 1 + offset_sh, 1753 BPF_H, (bpf_int32)ntohs(addr)); 1754 gen_and(tmp, b2); 1755 gen_or(b2, b1); 1756 /* Check for pad = 0, short header case */ 1757 tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 1758 b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); 1759 gen_and(tmp, b2); 1760 gen_or(b2, b1); 1761 1762 /* Combine with test for linktype */ 1763 gen_and(b0, b1); 1764 return b1; 1765} 1766 1767static struct block * 1768gen_host(addr, mask, proto, dir) 1769 bpf_u_int32 addr; 1770 bpf_u_int32 mask; 1771 int proto; 1772 int dir; 1773{ 1774 struct block *b0, *b1; 1775 1776 switch (proto) { 1777 1778 case Q_DEFAULT: 1779 b0 = gen_host(addr, mask, Q_IP, dir); 1780 if (off_linktype != -1) { 1781 b1 = gen_host(addr, mask, Q_ARP, dir); 1782 gen_or(b0, b1); 1783 b0 = gen_host(addr, mask, Q_RARP, dir); 1784 gen_or(b1, b0); 1785 } 1786 return b0; 1787 1788 case Q_IP: 1789 return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 1790 off_nl + 12, off_nl + 16); 1791 1792 case Q_RARP: 1793 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 1794 off_nl + 14, off_nl + 24); 1795 1796 case Q_ARP: 1797 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 1798 off_nl + 14, off_nl + 24); 1799 1800 case Q_TCP: 1801 bpf_error("'tcp' modifier applied to host"); 1802
|
| 1803 case Q_SCTP: 1804 bpf_error("'sctp' modifier applied to host"); 1805
|
1276 case Q_UDP: 1277 bpf_error("'udp' modifier applied to host"); 1278 1279 case Q_ICMP: 1280 bpf_error("'icmp' modifier applied to host"); 1281 1282 case Q_IGMP: 1283 bpf_error("'igmp' modifier applied to host"); 1284 1285 case Q_IGRP: 1286 bpf_error("'igrp' modifier applied to host"); 1287 1288 case Q_PIM: 1289 bpf_error("'pim' modifier applied to host"); 1290
| 1806 case Q_UDP: 1807 bpf_error("'udp' modifier applied to host"); 1808 1809 case Q_ICMP: 1810 bpf_error("'icmp' modifier applied to host"); 1811 1812 case Q_IGMP: 1813 bpf_error("'igmp' modifier applied to host"); 1814 1815 case Q_IGRP: 1816 bpf_error("'igrp' modifier applied to host"); 1817 1818 case Q_PIM: 1819 bpf_error("'pim' modifier applied to host"); 1820
|
| 1821 case Q_VRRP: 1822 bpf_error("'vrrp' modifier applied to host"); 1823
|
1291 case Q_ATALK: 1292 bpf_error("ATALK host filtering not implemented"); 1293 1294 case Q_AARP: 1295 bpf_error("AARP host filtering not implemented"); 1296 1297 case Q_DECNET: 1298 return gen_dnhostop(addr, dir, off_nl); 1299 1300 case Q_SCA: 1301 bpf_error("SCA host filtering not implemented"); 1302 1303 case Q_LAT: 1304 bpf_error("LAT host filtering not implemented"); 1305 1306 case Q_MOPDL: 1307 bpf_error("MOPDL host filtering not implemented"); 1308 1309 case Q_MOPRC: 1310 bpf_error("MOPRC host filtering not implemented"); 1311 1312#ifdef INET6 1313 case Q_IPV6: 1314 bpf_error("'ip6' modifier applied to ip host"); 1315 1316 case Q_ICMPV6: 1317 bpf_error("'icmp6' modifier applied to host"); 1318#endif /* INET6 */ 1319 1320 case Q_AH: 1321 bpf_error("'ah' modifier applied to host"); 1322 1323 case Q_ESP: 1324 bpf_error("'esp' modifier applied to host"); 1325 1326 case Q_ISO: 1327 bpf_error("ISO host filtering not implemented"); 1328 1329 case Q_ESIS: 1330 bpf_error("'esis' modifier applied to host"); 1331 1332 case Q_ISIS: 1333 bpf_error("'isis' modifier applied to host"); 1334 1335 case Q_CLNP: 1336 bpf_error("'clnp' modifier applied to host"); 1337
| 1824 case Q_ATALK: 1825 bpf_error("ATALK host filtering not implemented"); 1826 1827 case Q_AARP: 1828 bpf_error("AARP host filtering not implemented"); 1829 1830 case Q_DECNET: 1831 return gen_dnhostop(addr, dir, off_nl); 1832 1833 case Q_SCA: 1834 bpf_error("SCA host filtering not implemented"); 1835 1836 case Q_LAT: 1837 bpf_error("LAT host filtering not implemented"); 1838 1839 case Q_MOPDL: 1840 bpf_error("MOPDL host filtering not implemented"); 1841 1842 case Q_MOPRC: 1843 bpf_error("MOPRC host filtering not implemented"); 1844 1845#ifdef INET6 1846 case Q_IPV6: 1847 bpf_error("'ip6' modifier applied to ip host"); 1848 1849 case Q_ICMPV6: 1850 bpf_error("'icmp6' modifier applied to host"); 1851#endif /* INET6 */ 1852 1853 case Q_AH: 1854 bpf_error("'ah' modifier applied to host"); 1855 1856 case Q_ESP: 1857 bpf_error("'esp' modifier applied to host"); 1858 1859 case Q_ISO: 1860 bpf_error("ISO host filtering not implemented"); 1861 1862 case Q_ESIS: 1863 bpf_error("'esis' modifier applied to host"); 1864 1865 case Q_ISIS: 1866 bpf_error("'isis' modifier applied to host"); 1867 1868 case Q_CLNP: 1869 bpf_error("'clnp' modifier applied to host"); 1870
|
| 1871 case Q_STP: 1872 bpf_error("'stp' modifier applied to host"); 1873 1874 case Q_IPX: 1875 bpf_error("IPX host filtering not implemented"); 1876 1877 case Q_NETBEUI: 1878 bpf_error("'netbeui' modifier applied to host"); 1879
|
1338 default: 1339 abort(); 1340 } 1341 /* NOTREACHED */ 1342} 1343 1344#ifdef INET6 1345static struct block * 1346gen_host6(addr, mask, proto, dir) 1347 struct in6_addr *addr; 1348 struct in6_addr *mask; 1349 int proto; 1350 int dir; 1351{ 1352 switch (proto) { 1353 1354 case Q_DEFAULT: 1355 return gen_host6(addr, mask, Q_IPV6, dir); 1356 1357 case Q_IP: 1358 bpf_error("'ip' modifier applied to ip6 host"); 1359 1360 case Q_RARP: 1361 bpf_error("'rarp' modifier applied to ip6 host"); 1362 1363 case Q_ARP: 1364 bpf_error("'arp' modifier applied to ip6 host"); 1365
| 1880 default: 1881 abort(); 1882 } 1883 /* NOTREACHED */ 1884} 1885 1886#ifdef INET6 1887static struct block * 1888gen_host6(addr, mask, proto, dir) 1889 struct in6_addr *addr; 1890 struct in6_addr *mask; 1891 int proto; 1892 int dir; 1893{ 1894 switch (proto) { 1895 1896 case Q_DEFAULT: 1897 return gen_host6(addr, mask, Q_IPV6, dir); 1898 1899 case Q_IP: 1900 bpf_error("'ip' modifier applied to ip6 host"); 1901 1902 case Q_RARP: 1903 bpf_error("'rarp' modifier applied to ip6 host"); 1904 1905 case Q_ARP: 1906 bpf_error("'arp' modifier applied to ip6 host"); 1907
|
| 1908 case Q_SCTP: 1909 bpf_error("'sctp' modifier applied to host"); 1910
|
1366 case Q_TCP: 1367 bpf_error("'tcp' modifier applied to host"); 1368 1369 case Q_UDP: 1370 bpf_error("'udp' modifier applied to host"); 1371 1372 case Q_ICMP: 1373 bpf_error("'icmp' modifier applied to host"); 1374 1375 case Q_IGMP: 1376 bpf_error("'igmp' modifier applied to host"); 1377 1378 case Q_IGRP: 1379 bpf_error("'igrp' modifier applied to host"); 1380 1381 case Q_PIM: 1382 bpf_error("'pim' modifier applied to host"); 1383
| 1911 case Q_TCP: 1912 bpf_error("'tcp' modifier applied to host"); 1913 1914 case Q_UDP: 1915 bpf_error("'udp' modifier applied to host"); 1916 1917 case Q_ICMP: 1918 bpf_error("'icmp' modifier applied to host"); 1919 1920 case Q_IGMP: 1921 bpf_error("'igmp' modifier applied to host"); 1922 1923 case Q_IGRP: 1924 bpf_error("'igrp' modifier applied to host"); 1925 1926 case Q_PIM: 1927 bpf_error("'pim' modifier applied to host"); 1928
|
| 1929 case Q_VRRP: 1930 bpf_error("'vrrp' modifier applied to host"); 1931
|
1384 case Q_ATALK: 1385 bpf_error("ATALK host filtering not implemented"); 1386 1387 case Q_AARP: 1388 bpf_error("AARP host filtering not implemented"); 1389 1390 case Q_DECNET: 1391 bpf_error("'decnet' modifier applied to ip6 host"); 1392 1393 case Q_SCA: 1394 bpf_error("SCA host filtering not implemented"); 1395 1396 case Q_LAT: 1397 bpf_error("LAT host filtering not implemented"); 1398 1399 case Q_MOPDL: 1400 bpf_error("MOPDL host filtering not implemented"); 1401 1402 case Q_MOPRC: 1403 bpf_error("MOPRC host filtering not implemented"); 1404 1405 case Q_IPV6: 1406 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 1407 off_nl + 8, off_nl + 24); 1408 1409 case Q_ICMPV6: 1410 bpf_error("'icmp6' modifier applied to host"); 1411 1412 case Q_AH: 1413 bpf_error("'ah' modifier applied to host"); 1414 1415 case Q_ESP: 1416 bpf_error("'esp' modifier applied to host"); 1417 1418 case Q_ISO: 1419 bpf_error("ISO host filtering not implemented"); 1420 1421 case Q_ESIS: 1422 bpf_error("'esis' modifier applied to host"); 1423 1424 case Q_ISIS: 1425 bpf_error("'isis' modifier applied to host"); 1426 1427 case Q_CLNP: 1428 bpf_error("'clnp' modifier applied to host"); 1429
| 1932 case Q_ATALK: 1933 bpf_error("ATALK host filtering not implemented"); 1934 1935 case Q_AARP: 1936 bpf_error("AARP host filtering not implemented"); 1937 1938 case Q_DECNET: 1939 bpf_error("'decnet' modifier applied to ip6 host"); 1940 1941 case Q_SCA: 1942 bpf_error("SCA host filtering not implemented"); 1943 1944 case Q_LAT: 1945 bpf_error("LAT host filtering not implemented"); 1946 1947 case Q_MOPDL: 1948 bpf_error("MOPDL host filtering not implemented"); 1949 1950 case Q_MOPRC: 1951 bpf_error("MOPRC host filtering not implemented"); 1952 1953 case Q_IPV6: 1954 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 1955 off_nl + 8, off_nl + 24); 1956 1957 case Q_ICMPV6: 1958 bpf_error("'icmp6' modifier applied to host"); 1959 1960 case Q_AH: 1961 bpf_error("'ah' modifier applied to host"); 1962 1963 case Q_ESP: 1964 bpf_error("'esp' modifier applied to host"); 1965 1966 case Q_ISO: 1967 bpf_error("ISO host filtering not implemented"); 1968 1969 case Q_ESIS: 1970 bpf_error("'esis' modifier applied to host"); 1971 1972 case Q_ISIS: 1973 bpf_error("'isis' modifier applied to host"); 1974 1975 case Q_CLNP: 1976 bpf_error("'clnp' modifier applied to host"); 1977
|
| 1978 case Q_STP: 1979 bpf_error("'stp' modifier applied to host"); 1980 1981 case Q_IPX: 1982 bpf_error("IPX host filtering not implemented"); 1983 1984 case Q_NETBEUI: 1985 bpf_error("'netbeui' modifier applied to host"); 1986
|
1430 default: 1431 abort(); 1432 } 1433 /* NOTREACHED */ 1434} 1435#endif /*INET6*/ 1436 1437#ifndef INET6 1438static struct block * 1439gen_gateway(eaddr, alist, proto, dir) 1440 const u_char *eaddr; 1441 bpf_u_int32 **alist; 1442 int proto; 1443 int dir; 1444{ 1445 struct block *b0, *b1, *tmp; 1446 1447 if (dir != 0) 1448 bpf_error("direction applied to 'gateway'"); 1449 1450 switch (proto) { 1451 case Q_DEFAULT: 1452 case Q_IP: 1453 case Q_ARP: 1454 case Q_RARP: 1455 if (linktype == DLT_EN10MB) 1456 b0 = gen_ehostop(eaddr, Q_OR); 1457 else if (linktype == DLT_FDDI) 1458 b0 = gen_fhostop(eaddr, Q_OR); 1459 else if (linktype == DLT_IEEE802) 1460 b0 = gen_thostop(eaddr, Q_OR); 1461 else 1462 bpf_error( 1463 "'gateway' supported only on ethernet, FDDI or token ring"); 1464 1465 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR); 1466 while (*alist) { 1467 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR); 1468 gen_or(b1, tmp); 1469 b1 = tmp; 1470 } 1471 gen_not(b1); 1472 gen_and(b0, b1); 1473 return b1; 1474 } 1475 bpf_error("illegal modifier of 'gateway'"); 1476 /* NOTREACHED */ 1477} 1478#endif 1479 1480struct block * 1481gen_proto_abbrev(proto) 1482 int proto; 1483{ 1484#ifdef INET6 1485 struct block *b0; 1486#endif 1487 struct block *b1; 1488 1489 switch (proto) { 1490
| 1987 default: 1988 abort(); 1989 } 1990 /* NOTREACHED */ 1991} 1992#endif /*INET6*/ 1993 1994#ifndef INET6 1995static struct block * 1996gen_gateway(eaddr, alist, proto, dir) 1997 const u_char *eaddr; 1998 bpf_u_int32 **alist; 1999 int proto; 2000 int dir; 2001{ 2002 struct block *b0, *b1, *tmp; 2003 2004 if (dir != 0) 2005 bpf_error("direction applied to 'gateway'"); 2006 2007 switch (proto) { 2008 case Q_DEFAULT: 2009 case Q_IP: 2010 case Q_ARP: 2011 case Q_RARP: 2012 if (linktype == DLT_EN10MB) 2013 b0 = gen_ehostop(eaddr, Q_OR); 2014 else if (linktype == DLT_FDDI) 2015 b0 = gen_fhostop(eaddr, Q_OR); 2016 else if (linktype == DLT_IEEE802) 2017 b0 = gen_thostop(eaddr, Q_OR); 2018 else 2019 bpf_error( 2020 "'gateway' supported only on ethernet, FDDI or token ring"); 2021 2022 b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR); 2023 while (*alist) { 2024 tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR); 2025 gen_or(b1, tmp); 2026 b1 = tmp; 2027 } 2028 gen_not(b1); 2029 gen_and(b0, b1); 2030 return b1; 2031 } 2032 bpf_error("illegal modifier of 'gateway'"); 2033 /* NOTREACHED */ 2034} 2035#endif 2036 2037struct block * 2038gen_proto_abbrev(proto) 2039 int proto; 2040{ 2041#ifdef INET6 2042 struct block *b0; 2043#endif 2044 struct block *b1; 2045 2046 switch (proto) { 2047
|
| 2048 case Q_SCTP: 2049 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT); 2050#ifdef INET6 2051 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT); 2052 gen_or(b0, b1); 2053#endif 2054 break; 2055
|
1491 case Q_TCP: 1492 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT); 1493#ifdef INET6 1494 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 1495 gen_or(b0, b1); 1496#endif 1497 break; 1498 1499 case Q_UDP: 1500 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT); 1501#ifdef INET6 1502 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT); 1503 gen_or(b0, b1); 1504#endif 1505 break; 1506 1507 case Q_ICMP: 1508 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT); 1509 break; 1510 1511#ifndef IPPROTO_IGMP 1512#define IPPROTO_IGMP 2 1513#endif 1514 1515 case Q_IGMP: 1516 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT); 1517 break; 1518 1519#ifndef IPPROTO_IGRP 1520#define IPPROTO_IGRP 9 1521#endif 1522 case Q_IGRP: 1523 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT); 1524 break; 1525 1526#ifndef IPPROTO_PIM 1527#define IPPROTO_PIM 103 1528#endif 1529 1530 case Q_PIM: 1531 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT); 1532#ifdef INET6 1533 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 1534 gen_or(b0, b1); 1535#endif 1536 break; 1537
| 2056 case Q_TCP: 2057 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT); 2058#ifdef INET6 2059 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 2060 gen_or(b0, b1); 2061#endif 2062 break; 2063 2064 case Q_UDP: 2065 b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT); 2066#ifdef INET6 2067 b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT); 2068 gen_or(b0, b1); 2069#endif 2070 break; 2071 2072 case Q_ICMP: 2073 b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT); 2074 break; 2075 2076#ifndef IPPROTO_IGMP 2077#define IPPROTO_IGMP 2 2078#endif 2079 2080 case Q_IGMP: 2081 b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT); 2082 break; 2083 2084#ifndef IPPROTO_IGRP 2085#define IPPROTO_IGRP 9 2086#endif 2087 case Q_IGRP: 2088 b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT); 2089 break; 2090 2091#ifndef IPPROTO_PIM 2092#define IPPROTO_PIM 103 2093#endif 2094 2095 case Q_PIM: 2096 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT); 2097#ifdef INET6 2098 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 2099 gen_or(b0, b1); 2100#endif 2101 break; 2102
|
| 2103#ifndef IPPROTO_VRRP 2104#define IPPROTO_VRRP 112 2105#endif 2106 2107 case Q_VRRP: 2108 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT); 2109 break; 2110
|
1538 case Q_IP: 1539 b1 = gen_linktype(ETHERTYPE_IP); 1540 break; 1541 1542 case Q_ARP: 1543 b1 = gen_linktype(ETHERTYPE_ARP); 1544 break; 1545 1546 case Q_RARP: 1547 b1 = gen_linktype(ETHERTYPE_REVARP); 1548 break; 1549 1550 case Q_LINK: 1551 bpf_error("link layer applied in wrong context"); 1552 1553 case Q_ATALK: 1554 b1 = gen_linktype(ETHERTYPE_ATALK); 1555 break; 1556 1557 case Q_AARP: 1558 b1 = gen_linktype(ETHERTYPE_AARP); 1559 break; 1560 1561 case Q_DECNET: 1562 b1 = gen_linktype(ETHERTYPE_DN); 1563 break; 1564 1565 case Q_SCA: 1566 b1 = gen_linktype(ETHERTYPE_SCA); 1567 break; 1568 1569 case Q_LAT: 1570 b1 = gen_linktype(ETHERTYPE_LAT); 1571 break; 1572 1573 case Q_MOPDL: 1574 b1 = gen_linktype(ETHERTYPE_MOPDL); 1575 break; 1576 1577 case Q_MOPRC: 1578 b1 = gen_linktype(ETHERTYPE_MOPRC); 1579 break; 1580 1581#ifdef INET6 1582 case Q_IPV6: 1583 b1 = gen_linktype(ETHERTYPE_IPV6); 1584 break; 1585 1586#ifndef IPPROTO_ICMPV6 1587#define IPPROTO_ICMPV6 58 1588#endif 1589 case Q_ICMPV6: 1590 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 1591 break; 1592#endif /* INET6 */ 1593 1594#ifndef IPPROTO_AH 1595#define IPPROTO_AH 51 1596#endif 1597 case Q_AH: 1598 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT); 1599#ifdef INET6 1600 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT); 1601 gen_or(b0, b1); 1602#endif 1603 break; 1604 1605#ifndef IPPROTO_ESP 1606#define IPPROTO_ESP 50 1607#endif 1608 case Q_ESP: 1609 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT); 1610#ifdef INET6 1611 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 1612 gen_or(b0, b1); 1613#endif 1614 break; 1615 1616 case Q_ISO:
| 2111 case Q_IP: 2112 b1 = gen_linktype(ETHERTYPE_IP); 2113 break; 2114 2115 case Q_ARP: 2116 b1 = gen_linktype(ETHERTYPE_ARP); 2117 break; 2118 2119 case Q_RARP: 2120 b1 = gen_linktype(ETHERTYPE_REVARP); 2121 break; 2122 2123 case Q_LINK: 2124 bpf_error("link layer applied in wrong context"); 2125 2126 case Q_ATALK: 2127 b1 = gen_linktype(ETHERTYPE_ATALK); 2128 break; 2129 2130 case Q_AARP: 2131 b1 = gen_linktype(ETHERTYPE_AARP); 2132 break; 2133 2134 case Q_DECNET: 2135 b1 = gen_linktype(ETHERTYPE_DN); 2136 break; 2137 2138 case Q_SCA: 2139 b1 = gen_linktype(ETHERTYPE_SCA); 2140 break; 2141 2142 case Q_LAT: 2143 b1 = gen_linktype(ETHERTYPE_LAT); 2144 break; 2145 2146 case Q_MOPDL: 2147 b1 = gen_linktype(ETHERTYPE_MOPDL); 2148 break; 2149 2150 case Q_MOPRC: 2151 b1 = gen_linktype(ETHERTYPE_MOPRC); 2152 break; 2153 2154#ifdef INET6 2155 case Q_IPV6: 2156 b1 = gen_linktype(ETHERTYPE_IPV6); 2157 break; 2158 2159#ifndef IPPROTO_ICMPV6 2160#define IPPROTO_ICMPV6 58 2161#endif 2162 case Q_ICMPV6: 2163 b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 2164 break; 2165#endif /* INET6 */ 2166 2167#ifndef IPPROTO_AH 2168#define IPPROTO_AH 51 2169#endif 2170 case Q_AH: 2171 b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT); 2172#ifdef INET6 2173 b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT); 2174 gen_or(b0, b1); 2175#endif 2176 break; 2177 2178#ifndef IPPROTO_ESP 2179#define IPPROTO_ESP 50 2180#endif 2181 case Q_ESP: 2182 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT); 2183#ifdef INET6 2184 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 2185 gen_or(b0, b1); 2186#endif 2187 break; 2188 2189 case Q_ISO:
|
1617 b1 = gen_linktype(LLC_ISO_LSAP);
| 2190 b1 = gen_linktype(LLCSAP_ISONS);
|
1618 break; 1619 1620 case Q_ESIS: 1621 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT); 1622 break; 1623 1624 case Q_ISIS: 1625 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 1626 break; 1627 1628 case Q_CLNP: 1629 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT); 1630 break; 1631
| 2191 break; 2192 2193 case Q_ESIS: 2194 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT); 2195 break; 2196 2197 case Q_ISIS: 2198 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 2199 break; 2200 2201 case Q_CLNP: 2202 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT); 2203 break; 2204
|
| 2205 case Q_STP: 2206 b1 = gen_linktype(LLCSAP_8021D); 2207 break; 2208 2209 case Q_IPX: 2210 b1 = gen_linktype(LLCSAP_IPX); 2211 break; 2212 2213 case Q_NETBEUI: 2214 b1 = gen_linktype(LLCSAP_NETBEUI); 2215 break; 2216
|
1632 default: 1633 abort(); 1634 } 1635 return b1; 1636} 1637 1638static struct block * 1639gen_ipfrag() 1640{ 1641 struct slist *s; 1642 struct block *b; 1643 1644 /* not ip frag */ 1645 s = new_stmt(BPF_LD|BPF_H|BPF_ABS); 1646 s->s.k = off_nl + 6; 1647 b = new_block(JMP(BPF_JSET)); 1648 b->s.k = 0x1fff; 1649 b->stmts = s; 1650 gen_not(b); 1651 1652 return b; 1653} 1654 1655static struct block * 1656gen_portatom(off, v) 1657 int off; 1658 bpf_int32 v; 1659{ 1660 struct slist *s; 1661 struct block *b; 1662 1663 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 1664 s->s.k = off_nl; 1665 1666 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H); 1667 s->next->s.k = off_nl + off; 1668 1669 b = new_block(JMP(BPF_JEQ)); 1670 b->stmts = s; 1671 b->s.k = v; 1672 1673 return b; 1674} 1675 1676#ifdef INET6 1677static struct block * 1678gen_portatom6(off, v) 1679 int off; 1680 bpf_int32 v; 1681{ 1682 return gen_cmp(off_nl + 40 + off, BPF_H, v); 1683} 1684#endif/*INET6*/ 1685 1686struct block * 1687gen_portop(port, proto, dir) 1688 int port, proto, dir; 1689{ 1690 struct block *b0, *b1, *tmp; 1691 1692 /* ip proto 'proto' */ 1693 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto); 1694 b0 = gen_ipfrag(); 1695 gen_and(tmp, b0); 1696 1697 switch (dir) { 1698 case Q_SRC: 1699 b1 = gen_portatom(0, (bpf_int32)port); 1700 break; 1701 1702 case Q_DST: 1703 b1 = gen_portatom(2, (bpf_int32)port); 1704 break; 1705 1706 case Q_OR: 1707 case Q_DEFAULT: 1708 tmp = gen_portatom(0, (bpf_int32)port); 1709 b1 = gen_portatom(2, (bpf_int32)port); 1710 gen_or(tmp, b1); 1711 break; 1712 1713 case Q_AND: 1714 tmp = gen_portatom(0, (bpf_int32)port); 1715 b1 = gen_portatom(2, (bpf_int32)port); 1716 gen_and(tmp, b1); 1717 break; 1718 1719 default: 1720 abort(); 1721 } 1722 gen_and(b0, b1); 1723 1724 return b1; 1725} 1726 1727static struct block * 1728gen_port(port, ip_proto, dir) 1729 int port; 1730 int ip_proto; 1731 int dir; 1732{ 1733 struct block *b0, *b1, *tmp; 1734 1735 /* ether proto ip */ 1736 b0 = gen_linktype(ETHERTYPE_IP); 1737 1738 switch (ip_proto) { 1739 case IPPROTO_UDP: 1740 case IPPROTO_TCP:
| 2217 default: 2218 abort(); 2219 } 2220 return b1; 2221} 2222 2223static struct block * 2224gen_ipfrag() 2225{ 2226 struct slist *s; 2227 struct block *b; 2228 2229 /* not ip frag */ 2230 s = new_stmt(BPF_LD|BPF_H|BPF_ABS); 2231 s->s.k = off_nl + 6; 2232 b = new_block(JMP(BPF_JSET)); 2233 b->s.k = 0x1fff; 2234 b->stmts = s; 2235 gen_not(b); 2236 2237 return b; 2238} 2239 2240static struct block * 2241gen_portatom(off, v) 2242 int off; 2243 bpf_int32 v; 2244{ 2245 struct slist *s; 2246 struct block *b; 2247 2248 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 2249 s->s.k = off_nl; 2250 2251 s->next = new_stmt(BPF_LD|BPF_IND|BPF_H); 2252 s->next->s.k = off_nl + off; 2253 2254 b = new_block(JMP(BPF_JEQ)); 2255 b->stmts = s; 2256 b->s.k = v; 2257 2258 return b; 2259} 2260 2261#ifdef INET6 2262static struct block * 2263gen_portatom6(off, v) 2264 int off; 2265 bpf_int32 v; 2266{ 2267 return gen_cmp(off_nl + 40 + off, BPF_H, v); 2268} 2269#endif/*INET6*/ 2270 2271struct block * 2272gen_portop(port, proto, dir) 2273 int port, proto, dir; 2274{ 2275 struct block *b0, *b1, *tmp; 2276 2277 /* ip proto 'proto' */ 2278 tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto); 2279 b0 = gen_ipfrag(); 2280 gen_and(tmp, b0); 2281 2282 switch (dir) { 2283 case Q_SRC: 2284 b1 = gen_portatom(0, (bpf_int32)port); 2285 break; 2286 2287 case Q_DST: 2288 b1 = gen_portatom(2, (bpf_int32)port); 2289 break; 2290 2291 case Q_OR: 2292 case Q_DEFAULT: 2293 tmp = gen_portatom(0, (bpf_int32)port); 2294 b1 = gen_portatom(2, (bpf_int32)port); 2295 gen_or(tmp, b1); 2296 break; 2297 2298 case Q_AND: 2299 tmp = gen_portatom(0, (bpf_int32)port); 2300 b1 = gen_portatom(2, (bpf_int32)port); 2301 gen_and(tmp, b1); 2302 break; 2303 2304 default: 2305 abort(); 2306 } 2307 gen_and(b0, b1); 2308 2309 return b1; 2310} 2311 2312static struct block * 2313gen_port(port, ip_proto, dir) 2314 int port; 2315 int ip_proto; 2316 int dir; 2317{ 2318 struct block *b0, *b1, *tmp; 2319 2320 /* ether proto ip */ 2321 b0 = gen_linktype(ETHERTYPE_IP); 2322 2323 switch (ip_proto) { 2324 case IPPROTO_UDP: 2325 case IPPROTO_TCP:
|
| 2326 case IPPROTO_SCTP:
|
1741 b1 = gen_portop(port, ip_proto, dir); 1742 break; 1743 1744 case PROTO_UNDEF: 1745 tmp = gen_portop(port, IPPROTO_TCP, dir); 1746 b1 = gen_portop(port, IPPROTO_UDP, dir); 1747 gen_or(tmp, b1);
| 2327 b1 = gen_portop(port, ip_proto, dir); 2328 break; 2329 2330 case PROTO_UNDEF: 2331 tmp = gen_portop(port, IPPROTO_TCP, dir); 2332 b1 = gen_portop(port, IPPROTO_UDP, dir); 2333 gen_or(tmp, b1);
|
| 2334 tmp = gen_portop(port, IPPROTO_SCTP, dir); 2335 gen_or(tmp, b1);
|
1748 break; 1749 1750 default: 1751 abort(); 1752 } 1753 gen_and(b0, b1); 1754 return b1; 1755} 1756 1757#ifdef INET6 1758struct block * 1759gen_portop6(port, proto, dir) 1760 int port, proto, dir; 1761{ 1762 struct block *b0, *b1, *tmp; 1763 1764 /* ip proto 'proto' */ 1765 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto); 1766 1767 switch (dir) { 1768 case Q_SRC: 1769 b1 = gen_portatom6(0, (bpf_int32)port); 1770 break; 1771 1772 case Q_DST: 1773 b1 = gen_portatom6(2, (bpf_int32)port); 1774 break; 1775 1776 case Q_OR: 1777 case Q_DEFAULT: 1778 tmp = gen_portatom6(0, (bpf_int32)port); 1779 b1 = gen_portatom6(2, (bpf_int32)port); 1780 gen_or(tmp, b1); 1781 break; 1782 1783 case Q_AND: 1784 tmp = gen_portatom6(0, (bpf_int32)port); 1785 b1 = gen_portatom6(2, (bpf_int32)port); 1786 gen_and(tmp, b1); 1787 break; 1788 1789 default: 1790 abort(); 1791 } 1792 gen_and(b0, b1); 1793 1794 return b1; 1795} 1796 1797static struct block * 1798gen_port6(port, ip_proto, dir) 1799 int port; 1800 int ip_proto; 1801 int dir; 1802{ 1803 struct block *b0, *b1, *tmp; 1804 1805 /* ether proto ip */ 1806 b0 = gen_linktype(ETHERTYPE_IPV6); 1807 1808 switch (ip_proto) { 1809 case IPPROTO_UDP: 1810 case IPPROTO_TCP:
| 2336 break; 2337 2338 default: 2339 abort(); 2340 } 2341 gen_and(b0, b1); 2342 return b1; 2343} 2344 2345#ifdef INET6 2346struct block * 2347gen_portop6(port, proto, dir) 2348 int port, proto, dir; 2349{ 2350 struct block *b0, *b1, *tmp; 2351 2352 /* ip proto 'proto' */ 2353 b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto); 2354 2355 switch (dir) { 2356 case Q_SRC: 2357 b1 = gen_portatom6(0, (bpf_int32)port); 2358 break; 2359 2360 case Q_DST: 2361 b1 = gen_portatom6(2, (bpf_int32)port); 2362 break; 2363 2364 case Q_OR: 2365 case Q_DEFAULT: 2366 tmp = gen_portatom6(0, (bpf_int32)port); 2367 b1 = gen_portatom6(2, (bpf_int32)port); 2368 gen_or(tmp, b1); 2369 break; 2370 2371 case Q_AND: 2372 tmp = gen_portatom6(0, (bpf_int32)port); 2373 b1 = gen_portatom6(2, (bpf_int32)port); 2374 gen_and(tmp, b1); 2375 break; 2376 2377 default: 2378 abort(); 2379 } 2380 gen_and(b0, b1); 2381 2382 return b1; 2383} 2384 2385static struct block * 2386gen_port6(port, ip_proto, dir) 2387 int port; 2388 int ip_proto; 2389 int dir; 2390{ 2391 struct block *b0, *b1, *tmp; 2392 2393 /* ether proto ip */ 2394 b0 = gen_linktype(ETHERTYPE_IPV6); 2395 2396 switch (ip_proto) { 2397 case IPPROTO_UDP: 2398 case IPPROTO_TCP:
|
| 2399 case IPPROTO_SCTP:
|
1811 b1 = gen_portop6(port, ip_proto, dir); 1812 break; 1813 1814 case PROTO_UNDEF: 1815 tmp = gen_portop6(port, IPPROTO_TCP, dir); 1816 b1 = gen_portop6(port, IPPROTO_UDP, dir); 1817 gen_or(tmp, b1);
| 2400 b1 = gen_portop6(port, ip_proto, dir); 2401 break; 2402 2403 case PROTO_UNDEF: 2404 tmp = gen_portop6(port, IPPROTO_TCP, dir); 2405 b1 = gen_portop6(port, IPPROTO_UDP, dir); 2406 gen_or(tmp, b1);
|
| 2407 tmp = gen_portop6(port, IPPROTO_SCTP, dir); 2408 gen_or(tmp, b1);
|
1818 break; 1819 1820 default: 1821 abort(); 1822 } 1823 gen_and(b0, b1); 1824 return b1; 1825} 1826#endif /* INET6 */ 1827 1828static int 1829lookup_proto(name, proto) 1830 register const char *name; 1831 register int proto; 1832{ 1833 register int v; 1834 1835 switch (proto) { 1836 1837 case Q_DEFAULT: 1838 case Q_IP:
| 2409 break; 2410 2411 default: 2412 abort(); 2413 } 2414 gen_and(b0, b1); 2415 return b1; 2416} 2417#endif /* INET6 */ 2418 2419static int 2420lookup_proto(name, proto) 2421 register const char *name; 2422 register int proto; 2423{ 2424 register int v; 2425 2426 switch (proto) { 2427 2428 case Q_DEFAULT: 2429 case Q_IP:
|
| 2430 case Q_IPV6:
|
1839 v = pcap_nametoproto(name); 1840 if (v == PROTO_UNDEF) 1841 bpf_error("unknown ip proto '%s'", name); 1842 break; 1843 1844 case Q_LINK: 1845 /* XXX should look up h/w protocol type based on linktype */ 1846 v = pcap_nametoeproto(name); 1847 if (v == PROTO_UNDEF) 1848 bpf_error("unknown ether proto '%s'", name); 1849 break; 1850 1851 case Q_ISO: 1852 if (strcmp(name, "esis") == 0) 1853 v = ISO9542_ESIS; 1854 else if (strcmp(name, "isis") == 0) 1855 v = ISO10589_ISIS; 1856 else if (strcmp(name, "clnp") == 0) 1857 v = ISO8473_CLNP; 1858 else 1859 bpf_error("unknown osi proto '%s'", name); 1860 break; 1861 1862 default: 1863 v = PROTO_UNDEF; 1864 break; 1865 } 1866 return v; 1867} 1868 1869#if 0 1870struct stmt * 1871gen_joinsp(s, n) 1872 struct stmt **s; 1873 int n; 1874{ 1875 return NULL; 1876} 1877#endif 1878 1879static struct block * 1880gen_protochain(v, proto, dir) 1881 int v; 1882 int proto; 1883 int dir; 1884{ 1885#ifdef NO_PROTOCHAIN 1886 return gen_proto(v, proto, dir); 1887#else 1888 struct block *b0, *b; 1889 struct slist *s[100]; 1890 int fix2, fix3, fix4, fix5; 1891 int ahcheck, again, end; 1892 int i, max; 1893 int reg2 = alloc_reg(); 1894 1895 memset(s, 0, sizeof(s)); 1896 fix2 = fix3 = fix4 = fix5 = 0; 1897 1898 switch (proto) { 1899 case Q_IP: 1900 case Q_IPV6: 1901 break; 1902 case Q_DEFAULT: 1903 b0 = gen_protochain(v, Q_IP, dir); 1904 b = gen_protochain(v, Q_IPV6, dir); 1905 gen_or(b0, b); 1906 return b; 1907 default: 1908 bpf_error("bad protocol applied for 'protochain'"); 1909 /*NOTREACHED*/ 1910 } 1911 1912 no_optimize = 1; /*this code is not compatible with optimzer yet */ 1913 1914 /* 1915 * s[0] is a dummy entry to protect other BPF insn from damaged 1916 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 1917 * hard to find interdependency made by jump table fixup. 1918 */ 1919 i = 0; 1920 s[i] = new_stmt(0); /*dummy*/ 1921 i++; 1922 1923 switch (proto) { 1924 case Q_IP: 1925 b0 = gen_linktype(ETHERTYPE_IP); 1926 1927 /* A = ip->ip_p */ 1928 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 1929 s[i]->s.k = off_nl + 9; 1930 i++; 1931 /* X = ip->ip_hl << 2 */ 1932 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 1933 s[i]->s.k = off_nl; 1934 i++; 1935 break; 1936#ifdef INET6 1937 case Q_IPV6: 1938 b0 = gen_linktype(ETHERTYPE_IPV6); 1939 1940 /* A = ip6->ip_nxt */ 1941 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 1942 s[i]->s.k = off_nl + 6; 1943 i++; 1944 /* X = sizeof(struct ip6_hdr) */ 1945 s[i] = new_stmt(BPF_LDX|BPF_IMM); 1946 s[i]->s.k = 40; 1947 i++; 1948 break; 1949#endif 1950 default: 1951 bpf_error("unsupported proto to gen_protochain"); 1952 /*NOTREACHED*/ 1953 } 1954 1955 /* again: if (A == v) goto end; else fall through; */ 1956 again = i; 1957 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 1958 s[i]->s.k = v; 1959 s[i]->s.jt = NULL; /*later*/ 1960 s[i]->s.jf = NULL; /*update in next stmt*/ 1961 fix5 = i; 1962 i++; 1963 1964#ifndef IPPROTO_NONE 1965#define IPPROTO_NONE 59 1966#endif 1967 /* if (A == IPPROTO_NONE) goto end */ 1968 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 1969 s[i]->s.jt = NULL; /*later*/ 1970 s[i]->s.jf = NULL; /*update in next stmt*/ 1971 s[i]->s.k = IPPROTO_NONE; 1972 s[fix5]->s.jf = s[i]; 1973 fix2 = i; 1974 i++; 1975 1976#ifdef INET6 1977 if (proto == Q_IPV6) { 1978 int v6start, v6end, v6advance, j; 1979 1980 v6start = i; 1981 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 1982 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 1983 s[i]->s.jt = NULL; /*later*/ 1984 s[i]->s.jf = NULL; /*update in next stmt*/ 1985 s[i]->s.k = IPPROTO_HOPOPTS; 1986 s[fix2]->s.jf = s[i]; 1987 i++; 1988 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 1989 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 1990 s[i]->s.jt = NULL; /*later*/ 1991 s[i]->s.jf = NULL; /*update in next stmt*/ 1992 s[i]->s.k = IPPROTO_DSTOPTS; 1993 i++; 1994 /* if (A == IPPROTO_ROUTING) goto v6advance */ 1995 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 1996 s[i]->s.jt = NULL; /*later*/ 1997 s[i]->s.jf = NULL; /*update in next stmt*/ 1998 s[i]->s.k = IPPROTO_ROUTING; 1999 i++; 2000 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 2001 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2002 s[i]->s.jt = NULL; /*later*/ 2003 s[i]->s.jf = NULL; /*later*/ 2004 s[i]->s.k = IPPROTO_FRAGMENT; 2005 fix3 = i; 2006 v6end = i; 2007 i++; 2008 2009 /* v6advance: */ 2010 v6advance = i; 2011 2012 /* 2013 * in short, 2014 * A = P[X]; 2015 * X = X + (P[X + 1] + 1) * 8; 2016 */ 2017 /* A = X */ 2018 s[i] = new_stmt(BPF_MISC|BPF_TXA); 2019 i++; 2020 /* A = P[X + packet head] */ 2021 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2022 s[i]->s.k = off_nl; 2023 i++; 2024 /* MEM[reg2] = A */ 2025 s[i] = new_stmt(BPF_ST); 2026 s[i]->s.k = reg2; 2027 i++; 2028 /* A = X */ 2029 s[i] = new_stmt(BPF_MISC|BPF_TXA); 2030 i++; 2031 /* A += 1 */ 2032 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2033 s[i]->s.k = 1; 2034 i++; 2035 /* X = A */ 2036 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2037 i++; 2038 /* A = P[X + packet head]; */ 2039 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2040 s[i]->s.k = off_nl; 2041 i++; 2042 /* A += 1 */ 2043 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2044 s[i]->s.k = 1; 2045 i++; 2046 /* A *= 8 */ 2047 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 2048 s[i]->s.k = 8; 2049 i++; 2050 /* X = A; */ 2051 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2052 i++; 2053 /* A = MEM[reg2] */ 2054 s[i] = new_stmt(BPF_LD|BPF_MEM); 2055 s[i]->s.k = reg2; 2056 i++; 2057 2058 /* goto again; (must use BPF_JA for backward jump) */ 2059 s[i] = new_stmt(BPF_JMP|BPF_JA); 2060 s[i]->s.k = again - i - 1; 2061 s[i - 1]->s.jf = s[i]; 2062 i++; 2063 2064 /* fixup */ 2065 for (j = v6start; j <= v6end; j++) 2066 s[j]->s.jt = s[v6advance]; 2067 } else 2068#endif 2069 { 2070 /* nop */ 2071 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2072 s[i]->s.k = 0; 2073 s[fix2]->s.jf = s[i]; 2074 i++; 2075 } 2076 2077 /* ahcheck: */ 2078 ahcheck = i; 2079 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 2080 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2081 s[i]->s.jt = NULL; /*later*/ 2082 s[i]->s.jf = NULL; /*later*/ 2083 s[i]->s.k = IPPROTO_AH; 2084 if (fix3) 2085 s[fix3]->s.jf = s[ahcheck]; 2086 fix4 = i; 2087 i++; 2088 2089 /* 2090 * in short, 2091 * A = P[X]; 2092 * X = X + (P[X + 1] + 2) * 4; 2093 */ 2094 /* A = X */ 2095 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 2096 i++; 2097 /* A = P[X + packet head]; */ 2098 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2099 s[i]->s.k = off_nl; 2100 i++; 2101 /* MEM[reg2] = A */ 2102 s[i] = new_stmt(BPF_ST); 2103 s[i]->s.k = reg2; 2104 i++; 2105 /* A = X */ 2106 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 2107 i++; 2108 /* A += 1 */ 2109 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2110 s[i]->s.k = 1; 2111 i++; 2112 /* X = A */ 2113 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2114 i++; 2115 /* A = P[X + packet head] */ 2116 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2117 s[i]->s.k = off_nl; 2118 i++; 2119 /* A += 2 */ 2120 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2121 s[i]->s.k = 2; 2122 i++; 2123 /* A *= 4 */ 2124 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 2125 s[i]->s.k = 4; 2126 i++; 2127 /* X = A; */ 2128 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2129 i++; 2130 /* A = MEM[reg2] */ 2131 s[i] = new_stmt(BPF_LD|BPF_MEM); 2132 s[i]->s.k = reg2; 2133 i++; 2134 2135 /* goto again; (must use BPF_JA for backward jump) */ 2136 s[i] = new_stmt(BPF_JMP|BPF_JA); 2137 s[i]->s.k = again - i - 1; 2138 i++; 2139 2140 /* end: nop */ 2141 end = i; 2142 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2143 s[i]->s.k = 0; 2144 s[fix2]->s.jt = s[end]; 2145 s[fix4]->s.jf = s[end]; 2146 s[fix5]->s.jt = s[end]; 2147 i++; 2148 2149 /* 2150 * make slist chain 2151 */ 2152 max = i; 2153 for (i = 0; i < max - 1; i++) 2154 s[i]->next = s[i + 1]; 2155 s[max - 1]->next = NULL; 2156 2157 /* 2158 * emit final check 2159 */ 2160 b = new_block(JMP(BPF_JEQ)); 2161 b->stmts = s[1]; /*remember, s[0] is dummy*/ 2162 b->s.k = v; 2163 2164 free_reg(reg2); 2165 2166 gen_and(b0, b); 2167 return b; 2168#endif 2169} 2170 2171static struct block * 2172gen_proto(v, proto, dir) 2173 int v; 2174 int proto; 2175 int dir; 2176{ 2177 struct block *b0, *b1; 2178 2179 if (dir != Q_DEFAULT) 2180 bpf_error("direction applied to 'proto'"); 2181 2182 switch (proto) { 2183 case Q_DEFAULT: 2184#ifdef INET6 2185 b0 = gen_proto(v, Q_IP, dir); 2186 b1 = gen_proto(v, Q_IPV6, dir); 2187 gen_or(b0, b1); 2188 return b1; 2189#else 2190 /*FALLTHROUGH*/ 2191#endif 2192 case Q_IP: 2193 b0 = gen_linktype(ETHERTYPE_IP); 2194#ifndef CHASE_CHAIN 2195 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v); 2196#else 2197 b1 = gen_protochain(v, Q_IP); 2198#endif 2199 gen_and(b0, b1); 2200 return b1; 2201 2202 case Q_ISO:
| 2431 v = pcap_nametoproto(name); 2432 if (v == PROTO_UNDEF) 2433 bpf_error("unknown ip proto '%s'", name); 2434 break; 2435 2436 case Q_LINK: 2437 /* XXX should look up h/w protocol type based on linktype */ 2438 v = pcap_nametoeproto(name); 2439 if (v == PROTO_UNDEF) 2440 bpf_error("unknown ether proto '%s'", name); 2441 break; 2442 2443 case Q_ISO: 2444 if (strcmp(name, "esis") == 0) 2445 v = ISO9542_ESIS; 2446 else if (strcmp(name, "isis") == 0) 2447 v = ISO10589_ISIS; 2448 else if (strcmp(name, "clnp") == 0) 2449 v = ISO8473_CLNP; 2450 else 2451 bpf_error("unknown osi proto '%s'", name); 2452 break; 2453 2454 default: 2455 v = PROTO_UNDEF; 2456 break; 2457 } 2458 return v; 2459} 2460 2461#if 0 2462struct stmt * 2463gen_joinsp(s, n) 2464 struct stmt **s; 2465 int n; 2466{ 2467 return NULL; 2468} 2469#endif 2470 2471static struct block * 2472gen_protochain(v, proto, dir) 2473 int v; 2474 int proto; 2475 int dir; 2476{ 2477#ifdef NO_PROTOCHAIN 2478 return gen_proto(v, proto, dir); 2479#else 2480 struct block *b0, *b; 2481 struct slist *s[100]; 2482 int fix2, fix3, fix4, fix5; 2483 int ahcheck, again, end; 2484 int i, max; 2485 int reg2 = alloc_reg(); 2486 2487 memset(s, 0, sizeof(s)); 2488 fix2 = fix3 = fix4 = fix5 = 0; 2489 2490 switch (proto) { 2491 case Q_IP: 2492 case Q_IPV6: 2493 break; 2494 case Q_DEFAULT: 2495 b0 = gen_protochain(v, Q_IP, dir); 2496 b = gen_protochain(v, Q_IPV6, dir); 2497 gen_or(b0, b); 2498 return b; 2499 default: 2500 bpf_error("bad protocol applied for 'protochain'"); 2501 /*NOTREACHED*/ 2502 } 2503 2504 no_optimize = 1; /*this code is not compatible with optimzer yet */ 2505 2506 /* 2507 * s[0] is a dummy entry to protect other BPF insn from damaged 2508 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 2509 * hard to find interdependency made by jump table fixup. 2510 */ 2511 i = 0; 2512 s[i] = new_stmt(0); /*dummy*/ 2513 i++; 2514 2515 switch (proto) { 2516 case Q_IP: 2517 b0 = gen_linktype(ETHERTYPE_IP); 2518 2519 /* A = ip->ip_p */ 2520 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 2521 s[i]->s.k = off_nl + 9; 2522 i++; 2523 /* X = ip->ip_hl << 2 */ 2524 s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 2525 s[i]->s.k = off_nl; 2526 i++; 2527 break; 2528#ifdef INET6 2529 case Q_IPV6: 2530 b0 = gen_linktype(ETHERTYPE_IPV6); 2531 2532 /* A = ip6->ip_nxt */ 2533 s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B); 2534 s[i]->s.k = off_nl + 6; 2535 i++; 2536 /* X = sizeof(struct ip6_hdr) */ 2537 s[i] = new_stmt(BPF_LDX|BPF_IMM); 2538 s[i]->s.k = 40; 2539 i++; 2540 break; 2541#endif 2542 default: 2543 bpf_error("unsupported proto to gen_protochain"); 2544 /*NOTREACHED*/ 2545 } 2546 2547 /* again: if (A == v) goto end; else fall through; */ 2548 again = i; 2549 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2550 s[i]->s.k = v; 2551 s[i]->s.jt = NULL; /*later*/ 2552 s[i]->s.jf = NULL; /*update in next stmt*/ 2553 fix5 = i; 2554 i++; 2555 2556#ifndef IPPROTO_NONE 2557#define IPPROTO_NONE 59 2558#endif 2559 /* if (A == IPPROTO_NONE) goto end */ 2560 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2561 s[i]->s.jt = NULL; /*later*/ 2562 s[i]->s.jf = NULL; /*update in next stmt*/ 2563 s[i]->s.k = IPPROTO_NONE; 2564 s[fix5]->s.jf = s[i]; 2565 fix2 = i; 2566 i++; 2567 2568#ifdef INET6 2569 if (proto == Q_IPV6) { 2570 int v6start, v6end, v6advance, j; 2571 2572 v6start = i; 2573 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 2574 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2575 s[i]->s.jt = NULL; /*later*/ 2576 s[i]->s.jf = NULL; /*update in next stmt*/ 2577 s[i]->s.k = IPPROTO_HOPOPTS; 2578 s[fix2]->s.jf = s[i]; 2579 i++; 2580 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 2581 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2582 s[i]->s.jt = NULL; /*later*/ 2583 s[i]->s.jf = NULL; /*update in next stmt*/ 2584 s[i]->s.k = IPPROTO_DSTOPTS; 2585 i++; 2586 /* if (A == IPPROTO_ROUTING) goto v6advance */ 2587 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2588 s[i]->s.jt = NULL; /*later*/ 2589 s[i]->s.jf = NULL; /*update in next stmt*/ 2590 s[i]->s.k = IPPROTO_ROUTING; 2591 i++; 2592 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 2593 s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2594 s[i]->s.jt = NULL; /*later*/ 2595 s[i]->s.jf = NULL; /*later*/ 2596 s[i]->s.k = IPPROTO_FRAGMENT; 2597 fix3 = i; 2598 v6end = i; 2599 i++; 2600 2601 /* v6advance: */ 2602 v6advance = i; 2603 2604 /* 2605 * in short, 2606 * A = P[X]; 2607 * X = X + (P[X + 1] + 1) * 8; 2608 */ 2609 /* A = X */ 2610 s[i] = new_stmt(BPF_MISC|BPF_TXA); 2611 i++; 2612 /* A = P[X + packet head] */ 2613 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2614 s[i]->s.k = off_nl; 2615 i++; 2616 /* MEM[reg2] = A */ 2617 s[i] = new_stmt(BPF_ST); 2618 s[i]->s.k = reg2; 2619 i++; 2620 /* A = X */ 2621 s[i] = new_stmt(BPF_MISC|BPF_TXA); 2622 i++; 2623 /* A += 1 */ 2624 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2625 s[i]->s.k = 1; 2626 i++; 2627 /* X = A */ 2628 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2629 i++; 2630 /* A = P[X + packet head]; */ 2631 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2632 s[i]->s.k = off_nl; 2633 i++; 2634 /* A += 1 */ 2635 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2636 s[i]->s.k = 1; 2637 i++; 2638 /* A *= 8 */ 2639 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 2640 s[i]->s.k = 8; 2641 i++; 2642 /* X = A; */ 2643 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2644 i++; 2645 /* A = MEM[reg2] */ 2646 s[i] = new_stmt(BPF_LD|BPF_MEM); 2647 s[i]->s.k = reg2; 2648 i++; 2649 2650 /* goto again; (must use BPF_JA for backward jump) */ 2651 s[i] = new_stmt(BPF_JMP|BPF_JA); 2652 s[i]->s.k = again - i - 1; 2653 s[i - 1]->s.jf = s[i]; 2654 i++; 2655 2656 /* fixup */ 2657 for (j = v6start; j <= v6end; j++) 2658 s[j]->s.jt = s[v6advance]; 2659 } else 2660#endif 2661 { 2662 /* nop */ 2663 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2664 s[i]->s.k = 0; 2665 s[fix2]->s.jf = s[i]; 2666 i++; 2667 } 2668 2669 /* ahcheck: */ 2670 ahcheck = i; 2671 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 2672 s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K); 2673 s[i]->s.jt = NULL; /*later*/ 2674 s[i]->s.jf = NULL; /*later*/ 2675 s[i]->s.k = IPPROTO_AH; 2676 if (fix3) 2677 s[fix3]->s.jf = s[ahcheck]; 2678 fix4 = i; 2679 i++; 2680 2681 /* 2682 * in short, 2683 * A = P[X]; 2684 * X = X + (P[X + 1] + 2) * 4; 2685 */ 2686 /* A = X */ 2687 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 2688 i++; 2689 /* A = P[X + packet head]; */ 2690 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2691 s[i]->s.k = off_nl; 2692 i++; 2693 /* MEM[reg2] = A */ 2694 s[i] = new_stmt(BPF_ST); 2695 s[i]->s.k = reg2; 2696 i++; 2697 /* A = X */ 2698 s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA); 2699 i++; 2700 /* A += 1 */ 2701 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2702 s[i]->s.k = 1; 2703 i++; 2704 /* X = A */ 2705 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2706 i++; 2707 /* A = P[X + packet head] */ 2708 s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B); 2709 s[i]->s.k = off_nl; 2710 i++; 2711 /* A += 2 */ 2712 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2713 s[i]->s.k = 2; 2714 i++; 2715 /* A *= 4 */ 2716 s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K); 2717 s[i]->s.k = 4; 2718 i++; 2719 /* X = A; */ 2720 s[i] = new_stmt(BPF_MISC|BPF_TAX); 2721 i++; 2722 /* A = MEM[reg2] */ 2723 s[i] = new_stmt(BPF_LD|BPF_MEM); 2724 s[i]->s.k = reg2; 2725 i++; 2726 2727 /* goto again; (must use BPF_JA for backward jump) */ 2728 s[i] = new_stmt(BPF_JMP|BPF_JA); 2729 s[i]->s.k = again - i - 1; 2730 i++; 2731 2732 /* end: nop */ 2733 end = i; 2734 s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K); 2735 s[i]->s.k = 0; 2736 s[fix2]->s.jt = s[end]; 2737 s[fix4]->s.jf = s[end]; 2738 s[fix5]->s.jt = s[end]; 2739 i++; 2740 2741 /* 2742 * make slist chain 2743 */ 2744 max = i; 2745 for (i = 0; i < max - 1; i++) 2746 s[i]->next = s[i + 1]; 2747 s[max - 1]->next = NULL; 2748 2749 /* 2750 * emit final check 2751 */ 2752 b = new_block(JMP(BPF_JEQ)); 2753 b->stmts = s[1]; /*remember, s[0] is dummy*/ 2754 b->s.k = v; 2755 2756 free_reg(reg2); 2757 2758 gen_and(b0, b); 2759 return b; 2760#endif 2761} 2762 2763static struct block * 2764gen_proto(v, proto, dir) 2765 int v; 2766 int proto; 2767 int dir; 2768{ 2769 struct block *b0, *b1; 2770 2771 if (dir != Q_DEFAULT) 2772 bpf_error("direction applied to 'proto'"); 2773 2774 switch (proto) { 2775 case Q_DEFAULT: 2776#ifdef INET6 2777 b0 = gen_proto(v, Q_IP, dir); 2778 b1 = gen_proto(v, Q_IPV6, dir); 2779 gen_or(b0, b1); 2780 return b1; 2781#else 2782 /*FALLTHROUGH*/ 2783#endif 2784 case Q_IP: 2785 b0 = gen_linktype(ETHERTYPE_IP); 2786#ifndef CHASE_CHAIN 2787 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v); 2788#else 2789 b1 = gen_protochain(v, Q_IP); 2790#endif 2791 gen_and(b0, b1); 2792 return b1; 2793 2794 case Q_ISO:
|
2203 b0 = gen_linktype(LLC_ISO_LSAP);
| 2795 b0 = gen_linktype(LLCSAP_ISONS);
|
2204 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v); 2205 gen_and(b0, b1); 2206 return b1; 2207 2208 case Q_ARP: 2209 bpf_error("arp does not encapsulate another protocol"); 2210 /* NOTREACHED */ 2211 2212 case Q_RARP: 2213 bpf_error("rarp does not encapsulate another protocol"); 2214 /* NOTREACHED */ 2215 2216 case Q_ATALK: 2217 bpf_error("atalk encapsulation is not specifiable"); 2218 /* NOTREACHED */ 2219 2220 case Q_DECNET: 2221 bpf_error("decnet encapsulation is not specifiable"); 2222 /* NOTREACHED */ 2223 2224 case Q_SCA: 2225 bpf_error("sca does not encapsulate another protocol"); 2226 /* NOTREACHED */ 2227 2228 case Q_LAT: 2229 bpf_error("lat does not encapsulate another protocol"); 2230 /* NOTREACHED */ 2231 2232 case Q_MOPRC: 2233 bpf_error("moprc does not encapsulate another protocol"); 2234 /* NOTREACHED */ 2235 2236 case Q_MOPDL: 2237 bpf_error("mopdl does not encapsulate another protocol"); 2238 /* NOTREACHED */ 2239 2240 case Q_LINK: 2241 return gen_linktype(v); 2242 2243 case Q_UDP: 2244 bpf_error("'udp proto' is bogus"); 2245 /* NOTREACHED */ 2246 2247 case Q_TCP: 2248 bpf_error("'tcp proto' is bogus"); 2249 /* NOTREACHED */ 2250
| 2796 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v); 2797 gen_and(b0, b1); 2798 return b1; 2799 2800 case Q_ARP: 2801 bpf_error("arp does not encapsulate another protocol"); 2802 /* NOTREACHED */ 2803 2804 case Q_RARP: 2805 bpf_error("rarp does not encapsulate another protocol"); 2806 /* NOTREACHED */ 2807 2808 case Q_ATALK: 2809 bpf_error("atalk encapsulation is not specifiable"); 2810 /* NOTREACHED */ 2811 2812 case Q_DECNET: 2813 bpf_error("decnet encapsulation is not specifiable"); 2814 /* NOTREACHED */ 2815 2816 case Q_SCA: 2817 bpf_error("sca does not encapsulate another protocol"); 2818 /* NOTREACHED */ 2819 2820 case Q_LAT: 2821 bpf_error("lat does not encapsulate another protocol"); 2822 /* NOTREACHED */ 2823 2824 case Q_MOPRC: 2825 bpf_error("moprc does not encapsulate another protocol"); 2826 /* NOTREACHED */ 2827 2828 case Q_MOPDL: 2829 bpf_error("mopdl does not encapsulate another protocol"); 2830 /* NOTREACHED */ 2831 2832 case Q_LINK: 2833 return gen_linktype(v); 2834 2835 case Q_UDP: 2836 bpf_error("'udp proto' is bogus"); 2837 /* NOTREACHED */ 2838 2839 case Q_TCP: 2840 bpf_error("'tcp proto' is bogus"); 2841 /* NOTREACHED */ 2842
|
| 2843 case Q_SCTP: 2844 bpf_error("'sctp proto' is bogus"); 2845 /* NOTREACHED */ 2846
|
2251 case Q_ICMP: 2252 bpf_error("'icmp proto' is bogus"); 2253 /* NOTREACHED */ 2254 2255 case Q_IGMP: 2256 bpf_error("'igmp proto' is bogus"); 2257 /* NOTREACHED */ 2258 2259 case Q_IGRP: 2260 bpf_error("'igrp proto' is bogus"); 2261 /* NOTREACHED */ 2262 2263 case Q_PIM: 2264 bpf_error("'pim proto' is bogus"); 2265 /* NOTREACHED */ 2266
| 2847 case Q_ICMP: 2848 bpf_error("'icmp proto' is bogus"); 2849 /* NOTREACHED */ 2850 2851 case Q_IGMP: 2852 bpf_error("'igmp proto' is bogus"); 2853 /* NOTREACHED */ 2854 2855 case Q_IGRP: 2856 bpf_error("'igrp proto' is bogus"); 2857 /* NOTREACHED */ 2858 2859 case Q_PIM: 2860 bpf_error("'pim proto' is bogus"); 2861 /* NOTREACHED */ 2862
|
| 2863 case Q_VRRP: 2864 bpf_error("'vrrp proto' is bogus"); 2865 /* NOTREACHED */ 2866
|
2267#ifdef INET6 2268 case Q_IPV6: 2269 b0 = gen_linktype(ETHERTYPE_IPV6); 2270#ifndef CHASE_CHAIN 2271 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v); 2272#else 2273 b1 = gen_protochain(v, Q_IPV6); 2274#endif 2275 gen_and(b0, b1); 2276 return b1; 2277 2278 case Q_ICMPV6: 2279 bpf_error("'icmp6 proto' is bogus"); 2280#endif /* INET6 */ 2281 2282 case Q_AH: 2283 bpf_error("'ah proto' is bogus"); 2284 2285 case Q_ESP: 2286 bpf_error("'ah proto' is bogus"); 2287
| 2867#ifdef INET6 2868 case Q_IPV6: 2869 b0 = gen_linktype(ETHERTYPE_IPV6); 2870#ifndef CHASE_CHAIN 2871 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v); 2872#else 2873 b1 = gen_protochain(v, Q_IPV6); 2874#endif 2875 gen_and(b0, b1); 2876 return b1; 2877 2878 case Q_ICMPV6: 2879 bpf_error("'icmp6 proto' is bogus"); 2880#endif /* INET6 */ 2881 2882 case Q_AH: 2883 bpf_error("'ah proto' is bogus"); 2884 2885 case Q_ESP: 2886 bpf_error("'ah proto' is bogus"); 2887
|
| 2888 case Q_STP: 2889 bpf_error("'stp proto' is bogus"); 2890 2891 case Q_IPX: 2892 bpf_error("'ipx proto' is bogus"); 2893 2894 case Q_NETBEUI: 2895 bpf_error("'netbeui proto' is bogus"); 2896
|
2288 default: 2289 abort(); 2290 /* NOTREACHED */ 2291 } 2292 /* NOTREACHED */ 2293} 2294 2295struct block * 2296gen_scode(name, q) 2297 register const char *name; 2298 struct qual q; 2299{ 2300 int proto = q.proto; 2301 int dir = q.dir; 2302 int tproto; 2303 u_char *eaddr; 2304 bpf_u_int32 mask, addr; 2305#ifndef INET6 2306 bpf_u_int32 **alist; 2307#else 2308 int tproto6; 2309 struct sockaddr_in *sin; 2310 struct sockaddr_in6 *sin6; 2311 struct addrinfo *res, *res0; 2312 struct in6_addr mask128; 2313#endif /*INET6*/ 2314 struct block *b, *tmp; 2315 int port, real_proto; 2316 2317 switch (q.addr) { 2318 2319 case Q_NET: 2320 addr = pcap_nametonetaddr(name); 2321 if (addr == 0) 2322 bpf_error("unknown network '%s'", name); 2323 /* Left justify network addr and calculate its network mask */ 2324 mask = 0xffffffff; 2325 while (addr && (addr & 0xff000000) == 0) { 2326 addr <<= 8; 2327 mask <<= 8; 2328 } 2329 return gen_host(addr, mask, proto, dir); 2330 2331 case Q_DEFAULT: 2332 case Q_HOST: 2333 if (proto == Q_LINK) { 2334 switch (linktype) { 2335 2336 case DLT_EN10MB: 2337 eaddr = pcap_ether_hostton(name); 2338 if (eaddr == NULL) 2339 bpf_error( 2340 "unknown ether host '%s'", name);
| 2897 default: 2898 abort(); 2899 /* NOTREACHED */ 2900 } 2901 /* NOTREACHED */ 2902} 2903 2904struct block * 2905gen_scode(name, q) 2906 register const char *name; 2907 struct qual q; 2908{ 2909 int proto = q.proto; 2910 int dir = q.dir; 2911 int tproto; 2912 u_char *eaddr; 2913 bpf_u_int32 mask, addr; 2914#ifndef INET6 2915 bpf_u_int32 **alist; 2916#else 2917 int tproto6; 2918 struct sockaddr_in *sin; 2919 struct sockaddr_in6 *sin6; 2920 struct addrinfo *res, *res0; 2921 struct in6_addr mask128; 2922#endif /*INET6*/ 2923 struct block *b, *tmp; 2924 int port, real_proto; 2925 2926 switch (q.addr) { 2927 2928 case Q_NET: 2929 addr = pcap_nametonetaddr(name); 2930 if (addr == 0) 2931 bpf_error("unknown network '%s'", name); 2932 /* Left justify network addr and calculate its network mask */ 2933 mask = 0xffffffff; 2934 while (addr && (addr & 0xff000000) == 0) { 2935 addr <<= 8; 2936 mask <<= 8; 2937 } 2938 return gen_host(addr, mask, proto, dir); 2939 2940 case Q_DEFAULT: 2941 case Q_HOST: 2942 if (proto == Q_LINK) { 2943 switch (linktype) { 2944 2945 case DLT_EN10MB: 2946 eaddr = pcap_ether_hostton(name); 2947 if (eaddr == NULL) 2948 bpf_error( 2949 "unknown ether host '%s'", name);
|
2341 return gen_ehostop(eaddr, dir);
| 2950 b = gen_ehostop(eaddr, dir); 2951 free(eaddr); 2952 return b;
|
2342 2343 case DLT_FDDI: 2344 eaddr = pcap_ether_hostton(name); 2345 if (eaddr == NULL) 2346 bpf_error( 2347 "unknown FDDI host '%s'", name);
| 2953 2954 case DLT_FDDI: 2955 eaddr = pcap_ether_hostton(name); 2956 if (eaddr == NULL) 2957 bpf_error( 2958 "unknown FDDI host '%s'", name);
|
2348 return gen_fhostop(eaddr, dir);
| 2959 b = gen_fhostop(eaddr, dir); 2960 free(eaddr); 2961 return b;
|
2349 2350 case DLT_IEEE802: 2351 eaddr = pcap_ether_hostton(name); 2352 if (eaddr == NULL) 2353 bpf_error( 2354 "unknown token ring host '%s'", name);
| 2962 2963 case DLT_IEEE802: 2964 eaddr = pcap_ether_hostton(name); 2965 if (eaddr == NULL) 2966 bpf_error( 2967 "unknown token ring host '%s'", name);
|
2355 return gen_thostop(eaddr, dir);
| 2968 b = gen_thostop(eaddr, dir); 2969 free(eaddr); 2970 return b;
|
2356 2357 default: 2358 bpf_error( 2359 "only ethernet/FDDI/token ring supports link-level host name"); 2360 break; 2361 } 2362 } else if (proto == Q_DECNET) { 2363 unsigned short dn_addr = __pcap_nametodnaddr(name); 2364 /* 2365 * I don't think DECNET hosts can be multihomed, so 2366 * there is no need to build up a list of addresses 2367 */ 2368 return (gen_host(dn_addr, 0, proto, dir)); 2369 } else { 2370#ifndef INET6 2371 alist = pcap_nametoaddr(name); 2372 if (alist == NULL || *alist == NULL) 2373 bpf_error("unknown host '%s'", name); 2374 tproto = proto; 2375 if (off_linktype == -1 && tproto == Q_DEFAULT) 2376 tproto = Q_IP; 2377 b = gen_host(**alist++, 0xffffffff, tproto, dir); 2378 while (*alist) { 2379 tmp = gen_host(**alist++, 0xffffffff, 2380 tproto, dir); 2381 gen_or(b, tmp); 2382 b = tmp; 2383 } 2384 return b; 2385#else 2386 memset(&mask128, 0xff, sizeof(mask128)); 2387 res0 = res = pcap_nametoaddrinfo(name); 2388 if (res == NULL) 2389 bpf_error("unknown host '%s'", name); 2390 b = tmp = NULL; 2391 tproto = tproto6 = proto; 2392 if (off_linktype == -1 && tproto == Q_DEFAULT) { 2393 tproto = Q_IP; 2394 tproto6 = Q_IPV6; 2395 } 2396 for (res = res0; res; res = res->ai_next) { 2397 switch (res->ai_family) { 2398 case AF_INET: 2399 if (tproto == Q_IPV6) 2400 continue; 2401 2402 sin = (struct sockaddr_in *) 2403 res->ai_addr; 2404 tmp = gen_host(ntohl(sin->sin_addr.s_addr), 2405 0xffffffff, tproto, dir); 2406 break; 2407 case AF_INET6: 2408 if (tproto6 == Q_IP) 2409 continue; 2410 2411 sin6 = (struct sockaddr_in6 *) 2412 res->ai_addr; 2413 tmp = gen_host6(&sin6->sin6_addr, 2414 &mask128, tproto6, dir); 2415 break;
| 2971 2972 default: 2973 bpf_error( 2974 "only ethernet/FDDI/token ring supports link-level host name"); 2975 break; 2976 } 2977 } else if (proto == Q_DECNET) { 2978 unsigned short dn_addr = __pcap_nametodnaddr(name); 2979 /* 2980 * I don't think DECNET hosts can be multihomed, so 2981 * there is no need to build up a list of addresses 2982 */ 2983 return (gen_host(dn_addr, 0, proto, dir)); 2984 } else { 2985#ifndef INET6 2986 alist = pcap_nametoaddr(name); 2987 if (alist == NULL || *alist == NULL) 2988 bpf_error("unknown host '%s'", name); 2989 tproto = proto; 2990 if (off_linktype == -1 && tproto == Q_DEFAULT) 2991 tproto = Q_IP; 2992 b = gen_host(**alist++, 0xffffffff, tproto, dir); 2993 while (*alist) { 2994 tmp = gen_host(**alist++, 0xffffffff, 2995 tproto, dir); 2996 gen_or(b, tmp); 2997 b = tmp; 2998 } 2999 return b; 3000#else 3001 memset(&mask128, 0xff, sizeof(mask128)); 3002 res0 = res = pcap_nametoaddrinfo(name); 3003 if (res == NULL) 3004 bpf_error("unknown host '%s'", name); 3005 b = tmp = NULL; 3006 tproto = tproto6 = proto; 3007 if (off_linktype == -1 && tproto == Q_DEFAULT) { 3008 tproto = Q_IP; 3009 tproto6 = Q_IPV6; 3010 } 3011 for (res = res0; res; res = res->ai_next) { 3012 switch (res->ai_family) { 3013 case AF_INET: 3014 if (tproto == Q_IPV6) 3015 continue; 3016 3017 sin = (struct sockaddr_in *) 3018 res->ai_addr; 3019 tmp = gen_host(ntohl(sin->sin_addr.s_addr), 3020 0xffffffff, tproto, dir); 3021 break; 3022 case AF_INET6: 3023 if (tproto6 == Q_IP) 3024 continue; 3025 3026 sin6 = (struct sockaddr_in6 *) 3027 res->ai_addr; 3028 tmp = gen_host6(&sin6->sin6_addr, 3029 &mask128, tproto6, dir); 3030 break;
|
| 3031 default: 3032 continue;
|
2416 } 2417 if (b) 2418 gen_or(b, tmp); 2419 b = tmp; 2420 } 2421 freeaddrinfo(res0); 2422 if (b == NULL) { 2423 bpf_error("unknown host '%s'%s", name, 2424 (proto == Q_DEFAULT) 2425 ? "" 2426 : " for specified address family"); 2427 } 2428 return b; 2429#endif /*INET6*/ 2430 } 2431 2432 case Q_PORT:
| 3033 } 3034 if (b) 3035 gen_or(b, tmp); 3036 b = tmp; 3037 } 3038 freeaddrinfo(res0); 3039 if (b == NULL) { 3040 bpf_error("unknown host '%s'%s", name, 3041 (proto == Q_DEFAULT) 3042 ? "" 3043 : " for specified address family"); 3044 } 3045 return b; 3046#endif /*INET6*/ 3047 } 3048 3049 case Q_PORT:
|
2433 if (proto != Q_DEFAULT && proto != Q_UDP && proto != Q_TCP)
| 3050 if (proto != Q_DEFAULT && 3051 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
|
2434 bpf_error("illegal qualifier of 'port'"); 2435 if (pcap_nametoport(name, &port, &real_proto) == 0) 2436 bpf_error("unknown port '%s'", name); 2437 if (proto == Q_UDP) { 2438 if (real_proto == IPPROTO_TCP) 2439 bpf_error("port '%s' is tcp", name);
| 3052 bpf_error("illegal qualifier of 'port'"); 3053 if (pcap_nametoport(name, &port, &real_proto) == 0) 3054 bpf_error("unknown port '%s'", name); 3055 if (proto == Q_UDP) { 3056 if (real_proto == IPPROTO_TCP) 3057 bpf_error("port '%s' is tcp", name);
|
| 3058 else if (real_proto == IPPROTO_SCTP) 3059 bpf_error("port '%s' is sctp", name);
|
2440 else 2441 /* override PROTO_UNDEF */ 2442 real_proto = IPPROTO_UDP; 2443 } 2444 if (proto == Q_TCP) { 2445 if (real_proto == IPPROTO_UDP) 2446 bpf_error("port '%s' is udp", name);
| 3060 else 3061 /* override PROTO_UNDEF */ 3062 real_proto = IPPROTO_UDP; 3063 } 3064 if (proto == Q_TCP) { 3065 if (real_proto == IPPROTO_UDP) 3066 bpf_error("port '%s' is udp", name);
|
| 3067 3068 else if (real_proto == IPPROTO_SCTP) 3069 bpf_error("port '%s' is sctp", name);
|
2447 else 2448 /* override PROTO_UNDEF */ 2449 real_proto = IPPROTO_TCP; 2450 }
| 3070 else 3071 /* override PROTO_UNDEF */ 3072 real_proto = IPPROTO_TCP; 3073 }
|
| 3074 if (proto == Q_SCTP) { 3075 if (real_proto == IPPROTO_UDP) 3076 bpf_error("port '%s' is udp", name); 3077 3078 else if (real_proto == IPPROTO_TCP) 3079 bpf_error("port '%s' is tcp", name); 3080 else 3081 /* override PROTO_UNDEF */ 3082 real_proto = IPPROTO_SCTP; 3083 }
|
2451#ifndef INET6 2452 return gen_port(port, real_proto, dir); 2453#else 2454 { 2455 struct block *b; 2456 b = gen_port(port, real_proto, dir); 2457 gen_or(gen_port6(port, real_proto, dir), b); 2458 return b; 2459 } 2460#endif /* INET6 */ 2461 2462 case Q_GATEWAY: 2463#ifndef INET6 2464 eaddr = pcap_ether_hostton(name); 2465 if (eaddr == NULL) 2466 bpf_error("unknown ether host: %s", name); 2467 2468 alist = pcap_nametoaddr(name); 2469 if (alist == NULL || *alist == NULL) 2470 bpf_error("unknown host '%s'", name);
| 3084#ifndef INET6 3085 return gen_port(port, real_proto, dir); 3086#else 3087 { 3088 struct block *b; 3089 b = gen_port(port, real_proto, dir); 3090 gen_or(gen_port6(port, real_proto, dir), b); 3091 return b; 3092 } 3093#endif /* INET6 */ 3094 3095 case Q_GATEWAY: 3096#ifndef INET6 3097 eaddr = pcap_ether_hostton(name); 3098 if (eaddr == NULL) 3099 bpf_error("unknown ether host: %s", name); 3100 3101 alist = pcap_nametoaddr(name); 3102 if (alist == NULL || *alist == NULL) 3103 bpf_error("unknown host '%s'", name);
|
2471 return gen_gateway(eaddr, alist, proto, dir);
| 3104 b = gen_gateway(eaddr, alist, proto, dir); 3105 free(eaddr); 3106 return b;
|
2472#else 2473 bpf_error("'gateway' not supported in this configuration"); 2474#endif /*INET6*/ 2475 2476 case Q_PROTO: 2477 real_proto = lookup_proto(name, proto); 2478 if (real_proto >= 0) 2479 return gen_proto(real_proto, proto, dir); 2480 else 2481 bpf_error("unknown protocol: %s", name); 2482 2483 case Q_PROTOCHAIN: 2484 real_proto = lookup_proto(name, proto); 2485 if (real_proto >= 0) 2486 return gen_protochain(real_proto, proto, dir); 2487 else 2488 bpf_error("unknown protocol: %s", name); 2489 2490 2491 case Q_UNDEF: 2492 syntax(); 2493 /* NOTREACHED */ 2494 } 2495 abort(); 2496 /* NOTREACHED */ 2497} 2498 2499struct block * 2500gen_mcode(s1, s2, masklen, q) 2501 register const char *s1, *s2; 2502 register int masklen; 2503 struct qual q; 2504{ 2505 register int nlen, mlen; 2506 bpf_u_int32 n, m; 2507 2508 nlen = __pcap_atoin(s1, &n); 2509 /* Promote short ipaddr */ 2510 n <<= 32 - nlen; 2511 2512 if (s2 != NULL) { 2513 mlen = __pcap_atoin(s2, &m); 2514 /* Promote short ipaddr */ 2515 m <<= 32 - mlen; 2516 if ((n & ~m) != 0) 2517 bpf_error("non-network bits set in \"%s mask %s\"", 2518 s1, s2); 2519 } else { 2520 /* Convert mask len to mask */ 2521 if (masklen > 32) 2522 bpf_error("mask length must be <= 32"); 2523 m = 0xffffffff << (32 - masklen); 2524 if ((n & ~m) != 0) 2525 bpf_error("non-network bits set in \"%s/%d\"", 2526 s1, masklen); 2527 } 2528 2529 switch (q.addr) { 2530 2531 case Q_NET: 2532 return gen_host(n, m, q.proto, q.dir); 2533 2534 default: 2535 bpf_error("Mask syntax for networks only"); 2536 /* NOTREACHED */ 2537 } 2538} 2539 2540struct block * 2541gen_ncode(s, v, q) 2542 register const char *s; 2543 bpf_u_int32 v; 2544 struct qual q; 2545{ 2546 bpf_u_int32 mask; 2547 int proto = q.proto; 2548 int dir = q.dir; 2549 register int vlen; 2550 2551 if (s == NULL) 2552 vlen = 32; 2553 else if (q.proto == Q_DECNET) 2554 vlen = __pcap_atodn(s, &v); 2555 else 2556 vlen = __pcap_atoin(s, &v); 2557 2558 switch (q.addr) { 2559 2560 case Q_DEFAULT: 2561 case Q_HOST: 2562 case Q_NET: 2563 if (proto == Q_DECNET) 2564 return gen_host(v, 0, proto, dir); 2565 else if (proto == Q_LINK) { 2566 bpf_error("illegal link layer address"); 2567 } else { 2568 mask = 0xffffffff; 2569 if (s == NULL && q.addr == Q_NET) { 2570 /* Promote short net number */ 2571 while (v && (v & 0xff000000) == 0) { 2572 v <<= 8; 2573 mask <<= 8; 2574 } 2575 } else { 2576 /* Promote short ipaddr */ 2577 v <<= 32 - vlen; 2578 mask <<= 32 - vlen; 2579 } 2580 return gen_host(v, mask, proto, dir); 2581 } 2582 2583 case Q_PORT: 2584 if (proto == Q_UDP) 2585 proto = IPPROTO_UDP; 2586 else if (proto == Q_TCP) 2587 proto = IPPROTO_TCP;
| 3107#else 3108 bpf_error("'gateway' not supported in this configuration"); 3109#endif /*INET6*/ 3110 3111 case Q_PROTO: 3112 real_proto = lookup_proto(name, proto); 3113 if (real_proto >= 0) 3114 return gen_proto(real_proto, proto, dir); 3115 else 3116 bpf_error("unknown protocol: %s", name); 3117 3118 case Q_PROTOCHAIN: 3119 real_proto = lookup_proto(name, proto); 3120 if (real_proto >= 0) 3121 return gen_protochain(real_proto, proto, dir); 3122 else 3123 bpf_error("unknown protocol: %s", name); 3124 3125 3126 case Q_UNDEF: 3127 syntax(); 3128 /* NOTREACHED */ 3129 } 3130 abort(); 3131 /* NOTREACHED */ 3132} 3133 3134struct block * 3135gen_mcode(s1, s2, masklen, q) 3136 register const char *s1, *s2; 3137 register int masklen; 3138 struct qual q; 3139{ 3140 register int nlen, mlen; 3141 bpf_u_int32 n, m; 3142 3143 nlen = __pcap_atoin(s1, &n); 3144 /* Promote short ipaddr */ 3145 n <<= 32 - nlen; 3146 3147 if (s2 != NULL) { 3148 mlen = __pcap_atoin(s2, &m); 3149 /* Promote short ipaddr */ 3150 m <<= 32 - mlen; 3151 if ((n & ~m) != 0) 3152 bpf_error("non-network bits set in \"%s mask %s\"", 3153 s1, s2); 3154 } else { 3155 /* Convert mask len to mask */ 3156 if (masklen > 32) 3157 bpf_error("mask length must be <= 32"); 3158 m = 0xffffffff << (32 - masklen); 3159 if ((n & ~m) != 0) 3160 bpf_error("non-network bits set in \"%s/%d\"", 3161 s1, masklen); 3162 } 3163 3164 switch (q.addr) { 3165 3166 case Q_NET: 3167 return gen_host(n, m, q.proto, q.dir); 3168 3169 default: 3170 bpf_error("Mask syntax for networks only"); 3171 /* NOTREACHED */ 3172 } 3173} 3174 3175struct block * 3176gen_ncode(s, v, q) 3177 register const char *s; 3178 bpf_u_int32 v; 3179 struct qual q; 3180{ 3181 bpf_u_int32 mask; 3182 int proto = q.proto; 3183 int dir = q.dir; 3184 register int vlen; 3185 3186 if (s == NULL) 3187 vlen = 32; 3188 else if (q.proto == Q_DECNET) 3189 vlen = __pcap_atodn(s, &v); 3190 else 3191 vlen = __pcap_atoin(s, &v); 3192 3193 switch (q.addr) { 3194 3195 case Q_DEFAULT: 3196 case Q_HOST: 3197 case Q_NET: 3198 if (proto == Q_DECNET) 3199 return gen_host(v, 0, proto, dir); 3200 else if (proto == Q_LINK) { 3201 bpf_error("illegal link layer address"); 3202 } else { 3203 mask = 0xffffffff; 3204 if (s == NULL && q.addr == Q_NET) { 3205 /* Promote short net number */ 3206 while (v && (v & 0xff000000) == 0) { 3207 v <<= 8; 3208 mask <<= 8; 3209 } 3210 } else { 3211 /* Promote short ipaddr */ 3212 v <<= 32 - vlen; 3213 mask <<= 32 - vlen; 3214 } 3215 return gen_host(v, mask, proto, dir); 3216 } 3217 3218 case Q_PORT: 3219 if (proto == Q_UDP) 3220 proto = IPPROTO_UDP; 3221 else if (proto == Q_TCP) 3222 proto = IPPROTO_TCP;
|
| 3223 else if (proto == Q_SCTP) 3224 proto = IPPROTO_SCTP;
|
2588 else if (proto == Q_DEFAULT) 2589 proto = PROTO_UNDEF; 2590 else 2591 bpf_error("illegal qualifier of 'port'"); 2592 2593#ifndef INET6 2594 return gen_port((int)v, proto, dir); 2595#else 2596 { 2597 struct block *b; 2598 b = gen_port((int)v, proto, dir); 2599 gen_or(gen_port6((int)v, proto, dir), b); 2600 return b; 2601 } 2602#endif /* INET6 */ 2603 2604 case Q_GATEWAY: 2605 bpf_error("'gateway' requires a name"); 2606 /* NOTREACHED */ 2607 2608 case Q_PROTO: 2609 return gen_proto((int)v, proto, dir); 2610 2611 case Q_PROTOCHAIN: 2612 return gen_protochain((int)v, proto, dir); 2613 2614 case Q_UNDEF: 2615 syntax(); 2616 /* NOTREACHED */ 2617 2618 default: 2619 abort(); 2620 /* NOTREACHED */ 2621 } 2622 /* NOTREACHED */ 2623} 2624 2625#ifdef INET6 2626struct block * 2627gen_mcode6(s1, s2, masklen, q) 2628 register const char *s1, *s2; 2629 register int masklen; 2630 struct qual q; 2631{ 2632 struct addrinfo *res; 2633 struct in6_addr *addr; 2634 struct in6_addr mask; 2635 struct block *b; 2636 u_int32_t *a, *m; 2637 2638 if (s2) 2639 bpf_error("no mask %s supported", s2); 2640 2641 res = pcap_nametoaddrinfo(s1); 2642 if (!res) 2643 bpf_error("invalid ip6 address %s", s1); 2644 if (res->ai_next) 2645 bpf_error("%s resolved to multiple address", s1); 2646 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 2647 2648 if (sizeof(mask) * 8 < masklen) 2649 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
| 3225 else if (proto == Q_DEFAULT) 3226 proto = PROTO_UNDEF; 3227 else 3228 bpf_error("illegal qualifier of 'port'"); 3229 3230#ifndef INET6 3231 return gen_port((int)v, proto, dir); 3232#else 3233 { 3234 struct block *b; 3235 b = gen_port((int)v, proto, dir); 3236 gen_or(gen_port6((int)v, proto, dir), b); 3237 return b; 3238 } 3239#endif /* INET6 */ 3240 3241 case Q_GATEWAY: 3242 bpf_error("'gateway' requires a name"); 3243 /* NOTREACHED */ 3244 3245 case Q_PROTO: 3246 return gen_proto((int)v, proto, dir); 3247 3248 case Q_PROTOCHAIN: 3249 return gen_protochain((int)v, proto, dir); 3250 3251 case Q_UNDEF: 3252 syntax(); 3253 /* NOTREACHED */ 3254 3255 default: 3256 abort(); 3257 /* NOTREACHED */ 3258 } 3259 /* NOTREACHED */ 3260} 3261 3262#ifdef INET6 3263struct block * 3264gen_mcode6(s1, s2, masklen, q) 3265 register const char *s1, *s2; 3266 register int masklen; 3267 struct qual q; 3268{ 3269 struct addrinfo *res; 3270 struct in6_addr *addr; 3271 struct in6_addr mask; 3272 struct block *b; 3273 u_int32_t *a, *m; 3274 3275 if (s2) 3276 bpf_error("no mask %s supported", s2); 3277 3278 res = pcap_nametoaddrinfo(s1); 3279 if (!res) 3280 bpf_error("invalid ip6 address %s", s1); 3281 if (res->ai_next) 3282 bpf_error("%s resolved to multiple address", s1); 3283 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 3284 3285 if (sizeof(mask) * 8 < masklen) 3286 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
|
| 3287 memset(&mask, 0, sizeof(mask));
|
2650 memset(&mask, 0xff, masklen / 8); 2651 if (masklen % 8) { 2652 mask.s6_addr[masklen / 8] = 2653 (0xff << (8 - masklen % 8)) & 0xff; 2654 } 2655 2656 a = (u_int32_t *)addr; 2657 m = (u_int32_t *)&mask; 2658 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 2659 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 2660 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen); 2661 } 2662 2663 switch (q.addr) { 2664 2665 case Q_DEFAULT: 2666 case Q_HOST: 2667 if (masklen != 128) 2668 bpf_error("Mask syntax for networks only"); 2669 /* FALLTHROUGH */ 2670 2671 case Q_NET: 2672 b = gen_host6(addr, &mask, q.proto, q.dir); 2673 freeaddrinfo(res); 2674 return b; 2675 2676 default: 2677 bpf_error("invalid qualifier against IPv6 address"); 2678 /* NOTREACHED */ 2679 } 2680} 2681#endif /*INET6*/ 2682 2683struct block * 2684gen_ecode(eaddr, q) 2685 register const u_char *eaddr; 2686 struct qual q; 2687{ 2688 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 2689 if (linktype == DLT_EN10MB) 2690 return gen_ehostop(eaddr, (int)q.dir); 2691 if (linktype == DLT_FDDI) 2692 return gen_fhostop(eaddr, (int)q.dir); 2693 if (linktype == DLT_IEEE802) 2694 return gen_thostop(eaddr, (int)q.dir); 2695 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring"); 2696 } 2697 bpf_error("ethernet address used in non-ether expression"); 2698 /* NOTREACHED */ 2699} 2700 2701void 2702sappend(s0, s1) 2703 struct slist *s0, *s1; 2704{ 2705 /* 2706 * This is definitely not the best way to do this, but the 2707 * lists will rarely get long. 2708 */ 2709 while (s0->next) 2710 s0 = s0->next; 2711 s0->next = s1; 2712} 2713 2714static struct slist * 2715xfer_to_x(a) 2716 struct arth *a; 2717{ 2718 struct slist *s; 2719 2720 s = new_stmt(BPF_LDX|BPF_MEM); 2721 s->s.k = a->regno; 2722 return s; 2723} 2724 2725static struct slist * 2726xfer_to_a(a) 2727 struct arth *a; 2728{ 2729 struct slist *s; 2730 2731 s = new_stmt(BPF_LD|BPF_MEM); 2732 s->s.k = a->regno; 2733 return s; 2734} 2735 2736struct arth * 2737gen_load(proto, index, size) 2738 int proto; 2739 struct arth *index; 2740 int size; 2741{ 2742 struct slist *s, *tmp; 2743 struct block *b; 2744 int regno = alloc_reg(); 2745 2746 free_reg(index->regno); 2747 switch (size) { 2748 2749 default: 2750 bpf_error("data size must be 1, 2, or 4"); 2751 2752 case 1: 2753 size = BPF_B; 2754 break; 2755 2756 case 2: 2757 size = BPF_H; 2758 break; 2759 2760 case 4: 2761 size = BPF_W; 2762 break; 2763 } 2764 switch (proto) { 2765 default: 2766 bpf_error("unsupported index operation"); 2767 2768 case Q_LINK: 2769 s = xfer_to_x(index); 2770 tmp = new_stmt(BPF_LD|BPF_IND|size); 2771 sappend(s, tmp); 2772 sappend(index->s, s); 2773 break; 2774 2775 case Q_IP: 2776 case Q_ARP: 2777 case Q_RARP: 2778 case Q_ATALK: 2779 case Q_DECNET: 2780 case Q_SCA: 2781 case Q_LAT: 2782 case Q_MOPRC: 2783 case Q_MOPDL: 2784#ifdef INET6 2785 case Q_IPV6: 2786#endif 2787 /* XXX Note that we assume a fixed link header here. */ 2788 s = xfer_to_x(index); 2789 tmp = new_stmt(BPF_LD|BPF_IND|size); 2790 tmp->s.k = off_nl; 2791 sappend(s, tmp); 2792 sappend(index->s, s); 2793 2794 b = gen_proto_abbrev(proto); 2795 if (index->b) 2796 gen_and(index->b, b); 2797 index->b = b; 2798 break; 2799
| 3288 memset(&mask, 0xff, masklen / 8); 3289 if (masklen % 8) { 3290 mask.s6_addr[masklen / 8] = 3291 (0xff << (8 - masklen % 8)) & 0xff; 3292 } 3293 3294 a = (u_int32_t *)addr; 3295 m = (u_int32_t *)&mask; 3296 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 3297 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 3298 bpf_error("non-network bits set in \"%s/%d\"", s1, masklen); 3299 } 3300 3301 switch (q.addr) { 3302 3303 case Q_DEFAULT: 3304 case Q_HOST: 3305 if (masklen != 128) 3306 bpf_error("Mask syntax for networks only"); 3307 /* FALLTHROUGH */ 3308 3309 case Q_NET: 3310 b = gen_host6(addr, &mask, q.proto, q.dir); 3311 freeaddrinfo(res); 3312 return b; 3313 3314 default: 3315 bpf_error("invalid qualifier against IPv6 address"); 3316 /* NOTREACHED */ 3317 } 3318} 3319#endif /*INET6*/ 3320 3321struct block * 3322gen_ecode(eaddr, q) 3323 register const u_char *eaddr; 3324 struct qual q; 3325{ 3326 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 3327 if (linktype == DLT_EN10MB) 3328 return gen_ehostop(eaddr, (int)q.dir); 3329 if (linktype == DLT_FDDI) 3330 return gen_fhostop(eaddr, (int)q.dir); 3331 if (linktype == DLT_IEEE802) 3332 return gen_thostop(eaddr, (int)q.dir); 3333 bpf_error("ethernet addresses supported only on ethernet, FDDI or token ring"); 3334 } 3335 bpf_error("ethernet address used in non-ether expression"); 3336 /* NOTREACHED */ 3337} 3338 3339void 3340sappend(s0, s1) 3341 struct slist *s0, *s1; 3342{ 3343 /* 3344 * This is definitely not the best way to do this, but the 3345 * lists will rarely get long. 3346 */ 3347 while (s0->next) 3348 s0 = s0->next; 3349 s0->next = s1; 3350} 3351 3352static struct slist * 3353xfer_to_x(a) 3354 struct arth *a; 3355{ 3356 struct slist *s; 3357 3358 s = new_stmt(BPF_LDX|BPF_MEM); 3359 s->s.k = a->regno; 3360 return s; 3361} 3362 3363static struct slist * 3364xfer_to_a(a) 3365 struct arth *a; 3366{ 3367 struct slist *s; 3368 3369 s = new_stmt(BPF_LD|BPF_MEM); 3370 s->s.k = a->regno; 3371 return s; 3372} 3373 3374struct arth * 3375gen_load(proto, index, size) 3376 int proto; 3377 struct arth *index; 3378 int size; 3379{ 3380 struct slist *s, *tmp; 3381 struct block *b; 3382 int regno = alloc_reg(); 3383 3384 free_reg(index->regno); 3385 switch (size) { 3386 3387 default: 3388 bpf_error("data size must be 1, 2, or 4"); 3389 3390 case 1: 3391 size = BPF_B; 3392 break; 3393 3394 case 2: 3395 size = BPF_H; 3396 break; 3397 3398 case 4: 3399 size = BPF_W; 3400 break; 3401 } 3402 switch (proto) { 3403 default: 3404 bpf_error("unsupported index operation"); 3405 3406 case Q_LINK: 3407 s = xfer_to_x(index); 3408 tmp = new_stmt(BPF_LD|BPF_IND|size); 3409 sappend(s, tmp); 3410 sappend(index->s, s); 3411 break; 3412 3413 case Q_IP: 3414 case Q_ARP: 3415 case Q_RARP: 3416 case Q_ATALK: 3417 case Q_DECNET: 3418 case Q_SCA: 3419 case Q_LAT: 3420 case Q_MOPRC: 3421 case Q_MOPDL: 3422#ifdef INET6 3423 case Q_IPV6: 3424#endif 3425 /* XXX Note that we assume a fixed link header here. */ 3426 s = xfer_to_x(index); 3427 tmp = new_stmt(BPF_LD|BPF_IND|size); 3428 tmp->s.k = off_nl; 3429 sappend(s, tmp); 3430 sappend(index->s, s); 3431 3432 b = gen_proto_abbrev(proto); 3433 if (index->b) 3434 gen_and(index->b, b); 3435 index->b = b; 3436 break; 3437
|
| 3438 case Q_SCTP:
|
2800 case Q_TCP: 2801 case Q_UDP: 2802 case Q_ICMP: 2803 case Q_IGMP: 2804 case Q_IGRP: 2805 case Q_PIM:
| 3439 case Q_TCP: 3440 case Q_UDP: 3441 case Q_ICMP: 3442 case Q_IGMP: 3443 case Q_IGRP: 3444 case Q_PIM:
|
| 3445 case Q_VRRP:
|
2806 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 2807 s->s.k = off_nl; 2808 sappend(s, xfer_to_a(index)); 2809 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 2810 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 2811 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 2812 tmp->s.k = off_nl; 2813 sappend(index->s, s); 2814 2815 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); 2816 if (index->b) 2817 gen_and(index->b, b); 2818#ifdef INET6 2819 gen_and(gen_proto_abbrev(Q_IP), b); 2820#endif 2821 index->b = b; 2822 break; 2823#ifdef INET6 2824 case Q_ICMPV6: 2825 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]"); 2826 /*NOTREACHED*/ 2827#endif 2828 } 2829 index->regno = regno; 2830 s = new_stmt(BPF_ST); 2831 s->s.k = regno; 2832 sappend(index->s, s); 2833 2834 return index; 2835} 2836 2837struct block * 2838gen_relation(code, a0, a1, reversed) 2839 int code; 2840 struct arth *a0, *a1; 2841 int reversed; 2842{ 2843 struct slist *s0, *s1, *s2; 2844 struct block *b, *tmp; 2845 2846 s0 = xfer_to_x(a1); 2847 s1 = xfer_to_a(a0); 2848 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X); 2849 b = new_block(JMP(code)); 2850 if (code == BPF_JGT || code == BPF_JGE) { 2851 reversed = !reversed; 2852 b->s.k = 0x80000000; 2853 } 2854 if (reversed) 2855 gen_not(b); 2856 2857 sappend(s1, s2); 2858 sappend(s0, s1); 2859 sappend(a1->s, s0); 2860 sappend(a0->s, a1->s); 2861 2862 b->stmts = a0->s; 2863 2864 free_reg(a0->regno); 2865 free_reg(a1->regno); 2866 2867 /* 'and' together protocol checks */ 2868 if (a0->b) { 2869 if (a1->b) { 2870 gen_and(a0->b, tmp = a1->b); 2871 } 2872 else 2873 tmp = a0->b; 2874 } else 2875 tmp = a1->b; 2876 2877 if (tmp) 2878 gen_and(tmp, b); 2879 2880 return b; 2881} 2882 2883struct arth * 2884gen_loadlen() 2885{ 2886 int regno = alloc_reg(); 2887 struct arth *a = (struct arth *)newchunk(sizeof(*a)); 2888 struct slist *s; 2889 2890 s = new_stmt(BPF_LD|BPF_LEN); 2891 s->next = new_stmt(BPF_ST); 2892 s->next->s.k = regno; 2893 a->s = s; 2894 a->regno = regno; 2895 2896 return a; 2897} 2898 2899struct arth * 2900gen_loadi(val) 2901 int val; 2902{ 2903 struct arth *a; 2904 struct slist *s; 2905 int reg; 2906 2907 a = (struct arth *)newchunk(sizeof(*a)); 2908 2909 reg = alloc_reg(); 2910 2911 s = new_stmt(BPF_LD|BPF_IMM); 2912 s->s.k = val; 2913 s->next = new_stmt(BPF_ST); 2914 s->next->s.k = reg; 2915 a->s = s; 2916 a->regno = reg; 2917 2918 return a; 2919} 2920 2921struct arth * 2922gen_neg(a) 2923 struct arth *a; 2924{ 2925 struct slist *s; 2926 2927 s = xfer_to_a(a); 2928 sappend(a->s, s); 2929 s = new_stmt(BPF_ALU|BPF_NEG); 2930 s->s.k = 0; 2931 sappend(a->s, s); 2932 s = new_stmt(BPF_ST); 2933 s->s.k = a->regno; 2934 sappend(a->s, s); 2935 2936 return a; 2937} 2938 2939struct arth * 2940gen_arth(code, a0, a1) 2941 int code; 2942 struct arth *a0, *a1; 2943{ 2944 struct slist *s0, *s1, *s2; 2945 2946 s0 = xfer_to_x(a1); 2947 s1 = xfer_to_a(a0); 2948 s2 = new_stmt(BPF_ALU|BPF_X|code); 2949 2950 sappend(s1, s2); 2951 sappend(s0, s1); 2952 sappend(a1->s, s0); 2953 sappend(a0->s, a1->s); 2954 2955 free_reg(a1->regno); 2956 2957 s0 = new_stmt(BPF_ST); 2958 a0->regno = s0->s.k = alloc_reg(); 2959 sappend(a0->s, s0); 2960 2961 return a0; 2962} 2963 2964/* 2965 * Here we handle simple allocation of the scratch registers. 2966 * If too many registers are alloc'd, the allocator punts. 2967 */ 2968static int regused[BPF_MEMWORDS]; 2969static int curreg; 2970 2971/* 2972 * Return the next free register. 2973 */ 2974static int 2975alloc_reg() 2976{ 2977 int n = BPF_MEMWORDS; 2978 2979 while (--n >= 0) { 2980 if (regused[curreg]) 2981 curreg = (curreg + 1) % BPF_MEMWORDS; 2982 else { 2983 regused[curreg] = 1; 2984 return curreg; 2985 } 2986 } 2987 bpf_error("too many registers needed to evaluate expression"); 2988 /* NOTREACHED */ 2989} 2990 2991/* 2992 * Return a register to the table so it can 2993 * be used later. 2994 */ 2995static void 2996free_reg(n) 2997 int n; 2998{ 2999 regused[n] = 0; 3000} 3001 3002static struct block * 3003gen_len(jmp, n) 3004 int jmp, n; 3005{ 3006 struct slist *s; 3007 struct block *b; 3008 3009 s = new_stmt(BPF_LD|BPF_LEN); 3010 b = new_block(JMP(jmp)); 3011 b->stmts = s; 3012 b->s.k = n; 3013 3014 return b; 3015} 3016 3017struct block * 3018gen_greater(n) 3019 int n; 3020{ 3021 return gen_len(BPF_JGE, n); 3022} 3023 3024/* 3025 * Actually, this is less than or equal. 3026 */ 3027struct block * 3028gen_less(n) 3029 int n; 3030{ 3031 struct block *b; 3032 3033 b = gen_len(BPF_JGT, n); 3034 gen_not(b); 3035 3036 return b; 3037} 3038 3039struct block * 3040gen_byteop(op, idx, val) 3041 int op, idx, val; 3042{ 3043 struct block *b; 3044 struct slist *s; 3045 3046 switch (op) { 3047 default: 3048 abort(); 3049 3050 case '=': 3051 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3052 3053 case '<': 3054 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3055 b->s.code = JMP(BPF_JGE); 3056 gen_not(b); 3057 return b; 3058 3059 case '>': 3060 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3061 b->s.code = JMP(BPF_JGT); 3062 return b; 3063 3064 case '|': 3065 s = new_stmt(BPF_ALU|BPF_OR|BPF_K); 3066 break; 3067 3068 case '&': 3069 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 3070 break; 3071 } 3072 s->s.k = val; 3073 b = new_block(JMP(BPF_JEQ)); 3074 b->stmts = s; 3075 gen_not(b); 3076 3077 return b; 3078} 3079
| 3446 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 3447 s->s.k = off_nl; 3448 sappend(s, xfer_to_a(index)); 3449 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 3450 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 3451 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 3452 tmp->s.k = off_nl; 3453 sappend(index->s, s); 3454 3455 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); 3456 if (index->b) 3457 gen_and(index->b, b); 3458#ifdef INET6 3459 gen_and(gen_proto_abbrev(Q_IP), b); 3460#endif 3461 index->b = b; 3462 break; 3463#ifdef INET6 3464 case Q_ICMPV6: 3465 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]"); 3466 /*NOTREACHED*/ 3467#endif 3468 } 3469 index->regno = regno; 3470 s = new_stmt(BPF_ST); 3471 s->s.k = regno; 3472 sappend(index->s, s); 3473 3474 return index; 3475} 3476 3477struct block * 3478gen_relation(code, a0, a1, reversed) 3479 int code; 3480 struct arth *a0, *a1; 3481 int reversed; 3482{ 3483 struct slist *s0, *s1, *s2; 3484 struct block *b, *tmp; 3485 3486 s0 = xfer_to_x(a1); 3487 s1 = xfer_to_a(a0); 3488 s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X); 3489 b = new_block(JMP(code)); 3490 if (code == BPF_JGT || code == BPF_JGE) { 3491 reversed = !reversed; 3492 b->s.k = 0x80000000; 3493 } 3494 if (reversed) 3495 gen_not(b); 3496 3497 sappend(s1, s2); 3498 sappend(s0, s1); 3499 sappend(a1->s, s0); 3500 sappend(a0->s, a1->s); 3501 3502 b->stmts = a0->s; 3503 3504 free_reg(a0->regno); 3505 free_reg(a1->regno); 3506 3507 /* 'and' together protocol checks */ 3508 if (a0->b) { 3509 if (a1->b) { 3510 gen_and(a0->b, tmp = a1->b); 3511 } 3512 else 3513 tmp = a0->b; 3514 } else 3515 tmp = a1->b; 3516 3517 if (tmp) 3518 gen_and(tmp, b); 3519 3520 return b; 3521} 3522 3523struct arth * 3524gen_loadlen() 3525{ 3526 int regno = alloc_reg(); 3527 struct arth *a = (struct arth *)newchunk(sizeof(*a)); 3528 struct slist *s; 3529 3530 s = new_stmt(BPF_LD|BPF_LEN); 3531 s->next = new_stmt(BPF_ST); 3532 s->next->s.k = regno; 3533 a->s = s; 3534 a->regno = regno; 3535 3536 return a; 3537} 3538 3539struct arth * 3540gen_loadi(val) 3541 int val; 3542{ 3543 struct arth *a; 3544 struct slist *s; 3545 int reg; 3546 3547 a = (struct arth *)newchunk(sizeof(*a)); 3548 3549 reg = alloc_reg(); 3550 3551 s = new_stmt(BPF_LD|BPF_IMM); 3552 s->s.k = val; 3553 s->next = new_stmt(BPF_ST); 3554 s->next->s.k = reg; 3555 a->s = s; 3556 a->regno = reg; 3557 3558 return a; 3559} 3560 3561struct arth * 3562gen_neg(a) 3563 struct arth *a; 3564{ 3565 struct slist *s; 3566 3567 s = xfer_to_a(a); 3568 sappend(a->s, s); 3569 s = new_stmt(BPF_ALU|BPF_NEG); 3570 s->s.k = 0; 3571 sappend(a->s, s); 3572 s = new_stmt(BPF_ST); 3573 s->s.k = a->regno; 3574 sappend(a->s, s); 3575 3576 return a; 3577} 3578 3579struct arth * 3580gen_arth(code, a0, a1) 3581 int code; 3582 struct arth *a0, *a1; 3583{ 3584 struct slist *s0, *s1, *s2; 3585 3586 s0 = xfer_to_x(a1); 3587 s1 = xfer_to_a(a0); 3588 s2 = new_stmt(BPF_ALU|BPF_X|code); 3589 3590 sappend(s1, s2); 3591 sappend(s0, s1); 3592 sappend(a1->s, s0); 3593 sappend(a0->s, a1->s); 3594 3595 free_reg(a1->regno); 3596 3597 s0 = new_stmt(BPF_ST); 3598 a0->regno = s0->s.k = alloc_reg(); 3599 sappend(a0->s, s0); 3600 3601 return a0; 3602} 3603 3604/* 3605 * Here we handle simple allocation of the scratch registers. 3606 * If too many registers are alloc'd, the allocator punts. 3607 */ 3608static int regused[BPF_MEMWORDS]; 3609static int curreg; 3610 3611/* 3612 * Return the next free register. 3613 */ 3614static int 3615alloc_reg() 3616{ 3617 int n = BPF_MEMWORDS; 3618 3619 while (--n >= 0) { 3620 if (regused[curreg]) 3621 curreg = (curreg + 1) % BPF_MEMWORDS; 3622 else { 3623 regused[curreg] = 1; 3624 return curreg; 3625 } 3626 } 3627 bpf_error("too many registers needed to evaluate expression"); 3628 /* NOTREACHED */ 3629} 3630 3631/* 3632 * Return a register to the table so it can 3633 * be used later. 3634 */ 3635static void 3636free_reg(n) 3637 int n; 3638{ 3639 regused[n] = 0; 3640} 3641 3642static struct block * 3643gen_len(jmp, n) 3644 int jmp, n; 3645{ 3646 struct slist *s; 3647 struct block *b; 3648 3649 s = new_stmt(BPF_LD|BPF_LEN); 3650 b = new_block(JMP(jmp)); 3651 b->stmts = s; 3652 b->s.k = n; 3653 3654 return b; 3655} 3656 3657struct block * 3658gen_greater(n) 3659 int n; 3660{ 3661 return gen_len(BPF_JGE, n); 3662} 3663 3664/* 3665 * Actually, this is less than or equal. 3666 */ 3667struct block * 3668gen_less(n) 3669 int n; 3670{ 3671 struct block *b; 3672 3673 b = gen_len(BPF_JGT, n); 3674 gen_not(b); 3675 3676 return b; 3677} 3678 3679struct block * 3680gen_byteop(op, idx, val) 3681 int op, idx, val; 3682{ 3683 struct block *b; 3684 struct slist *s; 3685 3686 switch (op) { 3687 default: 3688 abort(); 3689 3690 case '=': 3691 return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3692 3693 case '<': 3694 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3695 b->s.code = JMP(BPF_JGE); 3696 gen_not(b); 3697 return b; 3698 3699 case '>': 3700 b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); 3701 b->s.code = JMP(BPF_JGT); 3702 return b; 3703 3704 case '|': 3705 s = new_stmt(BPF_ALU|BPF_OR|BPF_K); 3706 break; 3707 3708 case '&': 3709 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); 3710 break; 3711 } 3712 s->s.k = val; 3713 b = new_block(JMP(BPF_JEQ)); 3714 b->stmts = s; 3715 gen_not(b); 3716 3717 return b; 3718} 3719
|
| 3720static u_char abroadcast[] = { 0x0 }; 3721
|
3080struct block * 3081gen_broadcast(proto) 3082 int proto; 3083{ 3084 bpf_u_int32 hostmask; 3085 struct block *b0, *b1, *b2; 3086 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 3087 3088 switch (proto) { 3089 3090 case Q_DEFAULT: 3091 case Q_LINK:
| 3722struct block * 3723gen_broadcast(proto) 3724 int proto; 3725{ 3726 bpf_u_int32 hostmask; 3727 struct block *b0, *b1, *b2; 3728 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 3729 3730 switch (proto) { 3731 3732 case Q_DEFAULT: 3733 case Q_LINK:
|
| 3734 if (linktype == DLT_ARCNET) 3735 return gen_ahostop(abroadcast, Q_DST);
|
3092 if (linktype == DLT_EN10MB) 3093 return gen_ehostop(ebroadcast, Q_DST); 3094 if (linktype == DLT_FDDI) 3095 return gen_fhostop(ebroadcast, Q_DST); 3096 if (linktype == DLT_IEEE802) 3097 return gen_thostop(ebroadcast, Q_DST); 3098 bpf_error("not a broadcast link"); 3099 break; 3100 3101 case Q_IP: 3102 b0 = gen_linktype(ETHERTYPE_IP); 3103 hostmask = ~netmask; 3104 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask); 3105 b2 = gen_mcmp(off_nl + 16, BPF_W, 3106 (bpf_int32)(~0 & hostmask), hostmask); 3107 gen_or(b1, b2); 3108 gen_and(b0, b2); 3109 return b2; 3110 } 3111 bpf_error("only ether/ip broadcast filters supported"); 3112} 3113 3114struct block * 3115gen_multicast(proto) 3116 int proto; 3117{ 3118 register struct block *b0, *b1; 3119 register struct slist *s; 3120 3121 switch (proto) { 3122 3123 case Q_DEFAULT: 3124 case Q_LINK:
| 3736 if (linktype == DLT_EN10MB) 3737 return gen_ehostop(ebroadcast, Q_DST); 3738 if (linktype == DLT_FDDI) 3739 return gen_fhostop(ebroadcast, Q_DST); 3740 if (linktype == DLT_IEEE802) 3741 return gen_thostop(ebroadcast, Q_DST); 3742 bpf_error("not a broadcast link"); 3743 break; 3744 3745 case Q_IP: 3746 b0 = gen_linktype(ETHERTYPE_IP); 3747 hostmask = ~netmask; 3748 b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask); 3749 b2 = gen_mcmp(off_nl + 16, BPF_W, 3750 (bpf_int32)(~0 & hostmask), hostmask); 3751 gen_or(b1, b2); 3752 gen_and(b0, b2); 3753 return b2; 3754 } 3755 bpf_error("only ether/ip broadcast filters supported"); 3756} 3757 3758struct block * 3759gen_multicast(proto) 3760 int proto; 3761{ 3762 register struct block *b0, *b1; 3763 register struct slist *s; 3764 3765 switch (proto) { 3766 3767 case Q_DEFAULT: 3768 case Q_LINK:
|
| 3769 if (linktype == DLT_ARCNET) 3770 /* all ARCnet multicasts use the same address */ 3771 return gen_ahostop(abroadcast, Q_DST); 3772
|
3125 if (linktype == DLT_EN10MB) { 3126 /* ether[0] & 1 != 0 */ 3127 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3128 s->s.k = 0; 3129 b0 = new_block(JMP(BPF_JSET)); 3130 b0->s.k = 1; 3131 b0->stmts = s; 3132 return b0; 3133 } 3134 3135 if (linktype == DLT_FDDI) { 3136 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */ 3137 /* fddi[1] & 1 != 0 */ 3138 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3139 s->s.k = 1; 3140 b0 = new_block(JMP(BPF_JSET)); 3141 b0->s.k = 1; 3142 b0->stmts = s; 3143 return b0; 3144 } 3145 3146 /* TODO - check how token ring handles multicast */ 3147 /* if (linktype == DLT_IEEE802) ... */ 3148 3149 /* Link not known to support multicasts */ 3150 break; 3151 3152 case Q_IP: 3153 b0 = gen_linktype(ETHERTYPE_IP); 3154 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224); 3155 b1->s.code = JMP(BPF_JGE); 3156 gen_and(b0, b1); 3157 return b1; 3158 3159#ifdef INET6 3160 case Q_IPV6: 3161 b0 = gen_linktype(ETHERTYPE_IPV6); 3162 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255); 3163 gen_and(b0, b1); 3164 return b1; 3165#endif /* INET6 */ 3166 } 3167 bpf_error("only IP multicast filters supported on ethernet/FDDI"); 3168} 3169 3170/* 3171 * generate command for inbound/outbound. It's here so we can 3172 * make it link-type specific. 'dir' = 0 implies "inbound", 3173 * = 1 implies "outbound". 3174 */ 3175struct block * 3176gen_inbound(dir) 3177 int dir; 3178{ 3179 register struct block *b0; 3180 3181 /* 3182 * Only some data link types support inbound/outbound qualifiers. 3183 */ 3184 switch (linktype) { 3185 case DLT_SLIP: 3186 case DLT_PPP: 3187 b0 = gen_relation(BPF_JEQ, 3188 gen_load(Q_LINK, gen_loadi(0), 1), 3189 gen_loadi(0), 3190 dir); 3191 break; 3192 3193 default: 3194 bpf_error("inbound/outbound not supported on linktype %d\n", 3195 linktype); 3196 b0 = NULL; 3197 /* NOTREACHED */ 3198 } 3199 return (b0); 3200} 3201
| 3773 if (linktype == DLT_EN10MB) { 3774 /* ether[0] & 1 != 0 */ 3775 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3776 s->s.k = 0; 3777 b0 = new_block(JMP(BPF_JSET)); 3778 b0->s.k = 1; 3779 b0->stmts = s; 3780 return b0; 3781 } 3782 3783 if (linktype == DLT_FDDI) { 3784 /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */ 3785 /* fddi[1] & 1 != 0 */ 3786 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3787 s->s.k = 1; 3788 b0 = new_block(JMP(BPF_JSET)); 3789 b0->s.k = 1; 3790 b0->stmts = s; 3791 return b0; 3792 } 3793 3794 /* TODO - check how token ring handles multicast */ 3795 /* if (linktype == DLT_IEEE802) ... */ 3796 3797 /* Link not known to support multicasts */ 3798 break; 3799 3800 case Q_IP: 3801 b0 = gen_linktype(ETHERTYPE_IP); 3802 b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224); 3803 b1->s.code = JMP(BPF_JGE); 3804 gen_and(b0, b1); 3805 return b1; 3806 3807#ifdef INET6 3808 case Q_IPV6: 3809 b0 = gen_linktype(ETHERTYPE_IPV6); 3810 b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255); 3811 gen_and(b0, b1); 3812 return b1; 3813#endif /* INET6 */ 3814 } 3815 bpf_error("only IP multicast filters supported on ethernet/FDDI"); 3816} 3817 3818/* 3819 * generate command for inbound/outbound. It's here so we can 3820 * make it link-type specific. 'dir' = 0 implies "inbound", 3821 * = 1 implies "outbound". 3822 */ 3823struct block * 3824gen_inbound(dir) 3825 int dir; 3826{ 3827 register struct block *b0; 3828 3829 /* 3830 * Only some data link types support inbound/outbound qualifiers. 3831 */ 3832 switch (linktype) { 3833 case DLT_SLIP: 3834 case DLT_PPP: 3835 b0 = gen_relation(BPF_JEQ, 3836 gen_load(Q_LINK, gen_loadi(0), 1), 3837 gen_loadi(0), 3838 dir); 3839 break; 3840 3841 default: 3842 bpf_error("inbound/outbound not supported on linktype %d\n", 3843 linktype); 3844 b0 = NULL; 3845 /* NOTREACHED */ 3846 } 3847 return (b0); 3848} 3849
|
| 3850struct block * 3851gen_acode(eaddr, q) 3852 register const u_char *eaddr; 3853 struct qual q; 3854{ 3855 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 3856 if (linktype == DLT_ARCNET) 3857 return gen_ahostop(eaddr, (int)q.dir); 3858 } 3859 bpf_error("ARCnet address used in non-arc expression"); 3860 /* NOTREACHED */ 3861} 3862 3863static struct block * 3864gen_ahostop(eaddr, dir) 3865 register const u_char *eaddr; 3866 register int dir; 3867{ 3868 register struct block *b0, *b1; 3869 3870 switch (dir) { 3871 /* src comes first, different from Ethernet */ 3872 case Q_SRC: 3873 return gen_bcmp(0, 1, eaddr); 3874 3875 case Q_DST: 3876 return gen_bcmp(1, 1, eaddr); 3877 3878 case Q_AND: 3879 b0 = gen_ahostop(eaddr, Q_SRC); 3880 b1 = gen_ahostop(eaddr, Q_DST); 3881 gen_and(b0, b1); 3882 return b1; 3883 3884 case Q_DEFAULT: 3885 case Q_OR: 3886 b0 = gen_ahostop(eaddr, Q_SRC); 3887 b1 = gen_ahostop(eaddr, Q_DST); 3888 gen_or(b0, b1); 3889 return b1; 3890 } 3891 abort(); 3892 /* NOTREACHED */ 3893} 3894
|
3202/* 3203 * support IEEE 802.1Q VLAN trunk over ethernet 3204 */ 3205struct block * 3206gen_vlan(vlan_num) 3207 int vlan_num; 3208{
| 3895/* 3896 * support IEEE 802.1Q VLAN trunk over ethernet 3897 */ 3898struct block * 3899gen_vlan(vlan_num) 3900 int vlan_num; 3901{
|
3209 static u_int orig_linktype = -1, orig_nl = -1;
| |
3210 struct block *b0; 3211 3212 /* 3213 * Change the offsets to point to the type and data fields within 3214 * the VLAN packet. This is somewhat of a kludge. 3215 */ 3216 if (orig_nl == (u_int)-1) { 3217 orig_linktype = off_linktype; /* save original values */ 3218 orig_nl = off_nl; 3219 3220 switch (linktype) { 3221 3222 case DLT_EN10MB: 3223 off_linktype = 16; 3224 off_nl = 18; 3225 break; 3226 3227 default: 3228 bpf_error("no VLAN support for data link type %d", 3229 linktype); 3230 /*NOTREACHED*/ 3231 } 3232 } 3233 3234 /* check for VLAN */ 3235 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q); 3236 3237 /* If a specific VLAN is requested, check VLAN id */ 3238 if (vlan_num >= 0) { 3239 struct block *b1; 3240 3241 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num); 3242 gen_and(b0, b1); 3243 b0 = b1; 3244 } 3245 3246 return (b0); 3247}
| 3902 struct block *b0; 3903 3904 /* 3905 * Change the offsets to point to the type and data fields within 3906 * the VLAN packet. This is somewhat of a kludge. 3907 */ 3908 if (orig_nl == (u_int)-1) { 3909 orig_linktype = off_linktype; /* save original values */ 3910 orig_nl = off_nl; 3911 3912 switch (linktype) { 3913 3914 case DLT_EN10MB: 3915 off_linktype = 16; 3916 off_nl = 18; 3917 break; 3918 3919 default: 3920 bpf_error("no VLAN support for data link type %d", 3921 linktype); 3922 /*NOTREACHED*/ 3923 } 3924 } 3925 3926 /* check for VLAN */ 3927 b0 = gen_cmp(orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q); 3928 3929 /* If a specific VLAN is requested, check VLAN id */ 3930 if (vlan_num >= 0) { 3931 struct block *b1; 3932 3933 b1 = gen_cmp(orig_nl, BPF_H, (bpf_int32)vlan_num); 3934 gen_and(b0, b1); 3935 b0 = b1; 3936 } 3937 3938 return (b0); 3939}
|