1/*#define CHASE_CHAIN*/ 2/* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) --- 5 unchanged lines hidden (view full) --- 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 * |
22 * $FreeBSD: head/contrib/libpcap/gencode.c 147897 2005-07-11 03:43:25Z sam $ |
23 */ 24#ifndef lint 25static const char rcsid[] _U_ = |
26 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.24 2005/06/20 21:52:53 guy Exp $ (LBL)"; |
27#endif 28 29#ifdef HAVE_CONFIG_H 30#include "config.h" 31#endif 32 33#ifdef WIN32 34#include <pcap-stdinc.h> --- 64 unchanged lines hidden (view full) --- 99 100#define JMP(c) ((c)|BPF_JMP|BPF_K) 101 102/* Locals */ 103static jmp_buf top_ctx; 104static pcap_t *bpf_pcap; 105 106/* Hack for updating VLAN, MPLS offsets. */ |
107static u_int orig_linktype = -1U, orig_nl = -1U; |
108 109/* XXX */ 110#ifdef PCAP_FDDIPAD 111static int pcap_fddipad; 112#endif 113 114/* VARARGS */ 115void 116bpf_error(const char *fmt, ...) |
117{ 118 va_list ap; 119 120 va_start(ap, fmt); 121 if (bpf_pcap != NULL) 122 (void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE, 123 fmt, ap); 124 va_end(ap); --- 4 unchanged lines hidden (view full) --- 129static void init_linktype(pcap_t *); 130 131static int alloc_reg(void); 132static void free_reg(int); 133 134static struct block *root; 135 136/* |
137 * Value passed to gen_load_a() to indicate what the offset argument 138 * is relative to. 139 */ 140enum e_offrel { 141 OR_PACKET, /* relative to the beginning of the packet */ 142 OR_LINK, /* relative to the link-layer header */ 143 OR_NET, /* relative to the network-layer header */ 144 OR_NET_NOSNAP, /* relative to the network-layer header, with no SNAP header at the link layer */ 145 OR_TRAN_IPV4, /* relative to the transport-layer header, with IPv4 network layer */ 146 OR_TRAN_IPV6 /* relative to the transport-layer header, with IPv6 network layer */ 147}; 148 149/* |
150 * We divy out chunks of memory rather than call malloc each time so 151 * we don't have to worry about leaking memory. It's probably 152 * not a big deal if all this memory was wasted but if this ever 153 * goes into a library that would probably not be a good idea. 154 * 155 * XXX - this *is* in a library.... 156 */ 157#define NCHUNKS 16 --- 10 unchanged lines hidden (view full) --- 168static void freechunks(void); 169static inline struct block *new_block(int); 170static inline struct slist *new_stmt(int); 171static struct block *gen_retblk(int); 172static inline void syntax(void); 173 174static void backpatch(struct block *, struct block *); 175static void merge(struct block *, struct block *); |
176static struct block *gen_cmp(enum e_offrel, u_int, u_int, bpf_int32); 177static struct block *gen_cmp_gt(enum e_offrel, u_int, u_int, bpf_int32); 178static struct block *gen_cmp_ge(enum e_offrel, u_int, u_int, bpf_int32); 179static struct block *gen_cmp_lt(enum e_offrel, u_int, u_int, bpf_int32); 180static struct block *gen_cmp_le(enum e_offrel, u_int, u_int, bpf_int32); 181static struct block *gen_mcmp(enum e_offrel, u_int, u_int, bpf_int32, 182 bpf_u_int32); 183static struct block *gen_bcmp(enum e_offrel, u_int, u_int, const u_char *); 184static struct block *gen_ncmp(enum e_offrel, bpf_u_int32, bpf_u_int32, 185 bpf_u_int32, bpf_u_int32, int, bpf_int32); 186static struct slist *gen_load_llrel(u_int, u_int); 187static struct slist *gen_load_a(enum e_offrel, u_int, u_int); 188static struct slist *gen_loadx_iphdrlen(void); |
189static struct block *gen_uncond(int); 190static inline struct block *gen_true(void); 191static inline struct block *gen_false(void); 192static struct block *gen_ether_linktype(int); 193static struct block *gen_linux_sll_linktype(int); |
194static void insert_radiotap_load_llprefixlen(struct block *); 195static void insert_load_llprefixlen(struct block *); 196static struct slist *gen_llprefixlen(void); |
197static struct block *gen_linktype(int); 198static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); |
199static struct block *gen_llc_linktype(int); |
200static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 201#ifdef INET6 202static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 203#endif 204static struct block *gen_ahostop(const u_char *, int); 205static struct block *gen_ehostop(const u_char *, int); 206static struct block *gen_fhostop(const u_char *, int); 207static struct block *gen_thostop(const u_char *, int); 208static struct block *gen_wlanhostop(const u_char *, int); 209static struct block *gen_ipfchostop(const u_char *, int); |
210static struct block *gen_dnhostop(bpf_u_int32, int); |
211static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 212#ifdef INET6 213static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 214#endif 215#ifndef INET6 216static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); 217#endif 218static struct block *gen_ipfrag(void); 219static struct block *gen_portatom(int, bpf_int32); |
220static struct block *gen_portrangeatom(int, bpf_int32, bpf_int32); |
221#ifdef INET6 222static struct block *gen_portatom6(int, bpf_int32); |
223static struct block *gen_portrangeatom6(int, bpf_int32, bpf_int32); |
224#endif 225struct block *gen_portop(int, int, int); 226static struct block *gen_port(int, int, int); |
227struct block *gen_portrangeop(int, int, int, int); 228static struct block *gen_portrange(int, int, int, int); |
229#ifdef INET6 230struct block *gen_portop6(int, int, int); 231static struct block *gen_port6(int, int, int); |
232struct block *gen_portrangeop6(int, int, int, int); 233static struct block *gen_portrange6(int, int, int, int); |
234#endif 235static int lookup_proto(const char *, int); 236static struct block *gen_protochain(int, int, int); 237static struct block *gen_proto(int, int, int); 238static struct slist *xfer_to_x(struct arth *); 239static struct slist *xfer_to_a(struct arth *); 240static struct block *gen_mac_multicast(int); 241static struct block *gen_len(int, int); --- 235 unchanged lines hidden (view full) --- 477void 478finish_parse(p) 479 struct block *p; 480{ 481 backpatch(p, gen_retblk(snaplen)); 482 p->sense = !p->sense; 483 backpatch(p, gen_retblk(0)); 484 root = p->head; |
485 486 /* 487 * Insert before the statements of the first (root) block any 488 * statements needed to load the lengths of any variable-length 489 * headers into registers. 490 * 491 * XXX - a fancier strategy would be to insert those before the 492 * statements of all blocks that use those lengths and that 493 * have no predecessors that use them, so that we only compute 494 * the lengths if we need them. There might be even better 495 * approaches than that. However, as we're currently only 496 * handling variable-length radiotap headers, and as all 497 * filtering expressions other than raw link[M:N] tests 498 * require the length of that header, doing more for that 499 * header length isn't really worth the effort. 500 */ 501 insert_load_llprefixlen(root); |
502} 503 504void 505gen_and(b0, b1) 506 struct block *b0, *b1; 507{ 508 backpatch(b0, b1->head); 509 b0->sense = !b0->sense; --- 17 unchanged lines hidden (view full) --- 527void 528gen_not(b) 529 struct block *b; 530{ 531 b->sense = !b->sense; 532} 533 534static struct block * |
535gen_cmp(offrel, offset, size, v) 536 enum e_offrel offrel; |
537 u_int offset, size; 538 bpf_int32 v; 539{ |
540 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v); 541} |
542 |
543static struct block * 544gen_cmp_gt(offrel, offset, size, v) 545 enum e_offrel offrel; 546 u_int offset, size; 547 bpf_int32 v; 548{ 549 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGT, 0, v); 550} |
551 |
552static struct block * 553gen_cmp_ge(offrel, offset, size, v) 554 enum e_offrel offrel; 555 u_int offset, size; 556 bpf_int32 v; 557{ 558 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGE, 0, v); |
559} 560 561static struct block * |
562gen_cmp_lt(offrel, offset, size, v) 563 enum e_offrel offrel; |
564 u_int offset, size; 565 bpf_int32 v; 566{ |
567 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGE, 1, v); 568} |
569 |
570static struct block * 571gen_cmp_le(offrel, offset, size, v) 572 enum e_offrel offrel; 573 u_int offset, size; 574 bpf_int32 v; 575{ 576 return gen_ncmp(offrel, offset, size, 0xffffffff, BPF_JGT, 1, v); |
577} 578 579static struct block * |
580gen_mcmp(offrel, offset, size, v, mask) 581 enum e_offrel offrel; |
582 u_int offset, size; 583 bpf_int32 v; 584 bpf_u_int32 mask; 585{ |
586 return gen_ncmp(offrel, offset, size, mask, BPF_JEQ, 0, v); |
587} 588 589static struct block * |
590gen_bcmp(offrel, offset, size, v) 591 enum e_offrel offrel; |
592 register u_int offset, size; 593 register const u_char *v; 594{ 595 register struct block *b, *tmp; 596 597 b = NULL; 598 while (size >= 4) { 599 register const u_char *p = &v[size - 4]; 600 bpf_int32 w = ((bpf_int32)p[0] << 24) | 601 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 602 |
603 tmp = gen_cmp(offrel, offset + size - 4, BPF_W, w); |
604 if (b != NULL) 605 gen_and(b, tmp); 606 b = tmp; 607 size -= 4; 608 } 609 while (size >= 2) { 610 register const u_char *p = &v[size - 2]; 611 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 612 |
613 tmp = gen_cmp(offrel, offset + size - 2, BPF_H, w); |
614 if (b != NULL) 615 gen_and(b, tmp); 616 b = tmp; 617 size -= 2; 618 } 619 if (size > 0) { |
620 tmp = gen_cmp(offrel, offset, BPF_B, (bpf_int32)v[0]); |
621 if (b != NULL) 622 gen_and(b, tmp); 623 b = tmp; 624 } 625 return b; 626} 627 |
628/* 629 * AND the field of size "size" at offset "offset" relative to the header 630 * specified by "offrel" with "mask", and compare it with the value "v" 631 * with the test specified by "jtype"; if "reverse" is true, the test 632 * should test the opposite of "jtype". 633 */ |
634static struct block * |
635gen_ncmp(offrel, offset, size, mask, jtype, reverse, v) 636 enum e_offrel offrel; 637 bpf_int32 v; 638 bpf_u_int32 offset, size, mask, jtype; |
639 int reverse; 640{ |
641 struct slist *s, *s2; |
642 struct block *b; 643 |
644 s = gen_load_a(offrel, offset, size); |
645 646 if (mask != 0xffffffff) { |
647 s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K); 648 s2->s.k = mask; 649 sappend(s, s2); |
650 } 651 652 b = new_block(JMP(jtype)); 653 b->stmts = s; |
654 b->s.k = v; |
655 if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE)) 656 gen_not(b); 657 return b; 658} 659 660/* 661 * Various code constructs need to know the layout of the data link |
662 * layer. These variables give the necessary offsets from the beginning 663 * of the packet data. 664 * 665 * If the link layer has variable_length headers, the offsets are offsets 666 * from the end of the link-link-layer header, and "reg_ll_size" is 667 * the register number for a register containing the length of the 668 * link-layer header. Otherwise, "reg_ll_size" is -1. |
669 */ |
670static int reg_ll_size; |
671 672/* |
673 * This is the offset of the beginning of the link-layer header. 674 * It's usually 0, except for 802.11 with a fixed-length radio header. 675 */ 676static u_int off_ll; 677 678/* |
679 * This is the offset of the beginning of the MAC-layer header. 680 * It's usually 0, except for ATM LANE. 681 */ 682static u_int off_mac; 683 684/* 685 * "off_linktype" is the offset to information in the link-layer header 686 * giving the packet type. --- 29 unchanged lines hidden (view full) --- 716/* 717 * These are offsets for the ATM pseudo-header. 718 */ 719static u_int off_vpi; 720static u_int off_vci; 721static u_int off_proto; 722 723/* |
724 * These are offsets for the MTP3 fields. 725 */ 726static u_int off_sio; 727static u_int off_opc; 728static u_int off_dpc; 729static u_int off_sls; 730 731/* |
732 * This is the offset of the first byte after the ATM pseudo_header, 733 * or -1 if there is no ATM pseudo-header. 734 */ 735static u_int off_payload; 736 737/* 738 * These are offsets to the beginning of the network-layer header. 739 * --- 36 unchanged lines hidden (view full) --- 776 off_mac = 0; 777 is_atm = 0; 778 is_lane = 0; 779 off_vpi = -1; 780 off_vci = -1; 781 off_proto = -1; 782 off_payload = -1; 783 |
784 off_sio = -1; 785 off_opc = -1; 786 off_dpc = -1; 787 off_sls = -1; 788 789 /* 790 * Also assume it's not 802.11 with a fixed-length radio header. 791 */ 792 off_ll = 0; 793 |
794 orig_linktype = -1; 795 orig_nl = -1; |
796 |
797 reg_ll_size = -1; 798 |
799 switch (linktype) { 800 801 case DLT_ARCNET: 802 off_linktype = 2; 803 off_nl = 6; /* XXX in reality, variable! */ 804 off_nl_nosnap = 6; /* no 802.2 LLC */ 805 return; 806 --- 141 unchanged lines hidden (view full) --- 948 * the 802.11 header, containing a bunch of additional 949 * information including radio-level information. 950 * 951 * The header is 144 bytes long. 952 * 953 * XXX - same variable-length header problem; at least 954 * the Prism header is fixed-length. 955 */ |
956 off_ll = 144; |
957 off_linktype = 144+24; 958 off_nl = 144+32; /* Prism+802.11+802.2+SNAP */ 959 off_nl_nosnap = 144+27; /* Prism+802.11+802.2 */ 960 return; 961 962 case DLT_IEEE802_11_RADIO_AVS: 963 /* 964 * Same as 802.11, but with an additional header before --- 4 unchanged lines hidden (view full) --- 969 * current incarnation. 970 * 971 * XXX - same variable-length header problem, only 972 * more so; this header is also variable-length, 973 * with the length being the 32-bit big-endian 974 * number at an offset of 4 from the beginning 975 * of the radio header. 976 */ |
977 off_ll = 64; |
978 off_linktype = 64+24; 979 off_nl = 64+32; /* Radio+802.11+802.2+SNAP */ 980 off_nl_nosnap = 64+27; /* Radio+802.11+802.2 */ 981 return; 982 983 case DLT_IEEE802_11_RADIO: 984 /* 985 * Same as 802.11, but with an additional header before 986 * the 802.11 header, containing a bunch of additional 987 * information including radio-level information. 988 * |
989 * The radiotap header is variable length, and we 990 * generate code to compute its length and store it 991 * in a register. These offsets are relative to the 992 * beginning of the 802.11 header. |
993 */ |
994 off_linktype = 24; 995 off_nl = 32; /* 802.11+802.2+SNAP */ 996 off_nl_nosnap = 27; /* 802.11+802.2 */ |
997 return; 998 999 case DLT_ATM_RFC1483: 1000 case DLT_ATM_CLIP: /* Linux ATM defines this */ 1001 /* 1002 * assume routed, non-ISO PDUs 1003 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) |
1004 * 1005 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS, 1006 * or PPP with the PPP NLPID (e.g., PPPoA)? The 1007 * latter would presumably be treated the way PPPoE 1008 * should be, so you can do "pppoe and udp port 2049" 1009 * or "pppoa and tcp port 80" and have it check for 1010 * PPPo{A,E} and a PPP protocol of IP and.... |
1011 */ 1012 off_linktype = 0; 1013 off_nl = 8; /* 802.2+SNAP */ 1014 off_nl_nosnap = 3; /* 802.2 */ 1015 return; 1016 1017 case DLT_SUNATM: 1018 /* --- 58 unchanged lines hidden (view full) --- 1077 off_linktype = -1; 1078 off_nl = 0; 1079 off_nl_nosnap = 0; /* no 802.2 LLC */ 1080 return; 1081 1082 case DLT_APPLE_IP_OVER_IEEE1394: 1083 off_linktype = 16; 1084 off_nl = 18; |
1085 off_nl_nosnap = 18; /* no 802.2 LLC */ |
1086 return; 1087 1088 case DLT_LINUX_IRDA: 1089 /* 1090 * Currently, only raw "link[N:M]" filtering is supported. 1091 */ 1092 off_linktype = -1; 1093 off_nl = -1; --- 12 unchanged lines hidden (view full) --- 1106 case DLT_SYMANTEC_FIREWALL: 1107 off_linktype = 6; 1108 off_nl = 44; /* Ethernet II */ 1109 off_nl_nosnap = 44; /* XXX - what does it do with 802.3 packets? */ 1110 return; 1111 1112 case DLT_PFLOG: 1113 off_linktype = 0; |
1114 /* XXX read this from pf.h? */ |
1115 off_nl = PFLOG_HDRLEN; |
1116 off_nl_nosnap = PFLOG_HDRLEN; /* no 802.2 LLC */ |
1117 return; 1118 1119 case DLT_JUNIPER_MLFR: 1120 case DLT_JUNIPER_MLPPP: 1121 off_linktype = 4; 1122 off_nl = 4; |
1123 off_nl_nosnap = -1; /* no 802.2 LLC */ |
1124 return; 1125 1126 case DLT_JUNIPER_ATM1: 1127 off_linktype = 4; /* in reality variable between 4-8 */ 1128 off_nl = 4; 1129 off_nl_nosnap = 14; 1130 return; 1131 1132 case DLT_JUNIPER_ATM2: 1133 off_linktype = 8; /* in reality variable between 8-12 */ 1134 off_nl = 8; 1135 off_nl_nosnap = 18; 1136 return; 1137 |
1138 /* frames captured on a Juniper PPPoE service PIC 1139 * contain raw ethernet frames */ 1140 case DLT_JUNIPER_PPPOE: 1141 off_linktype = 16; 1142 off_nl = 18; /* Ethernet II */ 1143 off_nl_nosnap = 21; /* 802.3+802.2 */ 1144 return; 1145 1146 case DLT_JUNIPER_PPPOE_ATM: 1147 off_linktype = 4; 1148 off_nl = 6; 1149 off_nl_nosnap = -1; /* no 802.2 LLC */ 1150 return; 1151 1152 case DLT_JUNIPER_GGSN: 1153 off_linktype = 6; 1154 off_nl = 12; 1155 off_nl_nosnap = -1; /* no 802.2 LLC */ 1156 return; 1157 1158 case DLT_JUNIPER_ES: 1159 off_linktype = 6; 1160 off_nl = -1; /* not really a network layer but raw IP adresses */ 1161 off_nl_nosnap = -1; /* no 802.2 LLC */ 1162 return; 1163 1164 case DLT_JUNIPER_MONITOR: 1165 off_linktype = 12; 1166 off_nl = 12; /* raw IP/IP6 header */ 1167 off_nl_nosnap = -1; /* no 802.2 LLC */ 1168 return; 1169 1170 case DLT_JUNIPER_SERVICES: 1171 off_linktype = 12; 1172 off_nl = -1; /* L3 proto location dep. on cookie type */ 1173 off_nl_nosnap = -1; /* no 802.2 LLC */ 1174 return; 1175 1176 case DLT_MTP2: 1177 off_sio = 3; 1178 off_opc = 4; 1179 off_dpc = 4; 1180 off_sls = 7; 1181 off_linktype = -1; 1182 off_nl = -1; 1183 off_nl_nosnap = -1; 1184 return; 1185 |
1186#ifdef DLT_PFSYNC 1187 case DLT_PFSYNC: 1188 off_linktype = -1; 1189 off_nl = 4; 1190 off_nl_nosnap = 4; 1191 return; 1192#endif |
1193 1194 case DLT_LINUX_LAPD: 1195 /* 1196 * Currently, only raw "link[N:M]" filtering is supported. 1197 */ 1198 off_linktype = -1; 1199 off_nl = -1; 1200 off_nl_nosnap = -1; 1201 return; |
1202 } 1203 bpf_error("unknown data link type %d", linktype); 1204 /* NOTREACHED */ 1205} 1206 |
1207/* 1208 * Load a value relative to the beginning of the link-layer header. 1209 * The link-layer header doesn't necessarily begin at the beginning 1210 * of the packet data; there might be a variable-length prefix containing 1211 * radio information. 1212 */ 1213static struct slist * 1214gen_load_llrel(offset, size) 1215 u_int offset, size; 1216{ 1217 struct slist *s, *s2; 1218 1219 s = gen_llprefixlen(); 1220 1221 /* 1222 * If "s" is non-null, it has code to arrange that the X register 1223 * contains the length of the prefix preceding the link-layer 1224 * header. 1225 */ 1226 if (s != NULL) { 1227 s2 = new_stmt(BPF_LD|BPF_IND|size); 1228 s2->s.k = offset; 1229 sappend(s, s2); 1230 } else { 1231 s = new_stmt(BPF_LD|BPF_ABS|size); 1232 s->s.k = offset; 1233 } 1234 return s; 1235} 1236 1237/* 1238 * Load a value relative to the beginning of the specified header. 1239 */ 1240static struct slist * 1241gen_load_a(offrel, offset, size) 1242 enum e_offrel offrel; 1243 u_int offset, size; 1244{ 1245 struct slist *s, *s2; 1246 1247 switch (offrel) { 1248 1249 case OR_PACKET: 1250 s = gen_load_llrel(offset, size); 1251 break; 1252 1253 case OR_LINK: 1254 s = gen_load_llrel(off_ll + offset, size); 1255 break; 1256 1257 case OR_NET: 1258 s = gen_load_llrel(off_nl + offset, size); 1259 break; 1260 1261 case OR_NET_NOSNAP: 1262 s = gen_load_llrel(off_nl_nosnap + offset, size); 1263 break; 1264 1265 case OR_TRAN_IPV4: 1266 /* 1267 * Load the X register with the length of the IPv4 header, 1268 * in bytes. 1269 */ 1270 s = gen_loadx_iphdrlen(); 1271 1272 /* 1273 * Load the item at {length of the link-layer header} + 1274 * {length of the IPv4 header} + {specified offset}. 1275 */ 1276 s2 = new_stmt(BPF_LD|BPF_IND|size); 1277 s2->s.k = off_nl + offset; 1278 sappend(s, s2); 1279 break; 1280 1281 case OR_TRAN_IPV6: 1282 s = gen_load_llrel(off_nl + 40 + offset, size); 1283 break; 1284 1285 default: 1286 abort(); 1287 return NULL; 1288 } 1289 return s; 1290} 1291 1292/* 1293 * Generate code to load into the X register the sum of the length of 1294 * the IPv4 header and any variable-length header preceding the link-layer 1295 * header. 1296 */ 1297static struct slist * 1298gen_loadx_iphdrlen() 1299{ 1300 struct slist *s, *s2; 1301 1302 s = gen_llprefixlen(); 1303 if (s != NULL) { 1304 /* 1305 * There's a variable-length prefix preceding the 1306 * link-layer header. "s" points to a list of statements 1307 * that put the length of that prefix into the X register. 1308 * The 4*([k]&0xf) addressing mode can't be used, as we 1309 * don't have a constant offset, so we have to load the 1310 * value in question into the A register and add to it 1311 * the value from the X register. 1312 */ 1313 s2 = new_stmt(BPF_LD|BPF_IND|BPF_B); 1314 s2->s.k = off_nl; 1315 sappend(s, s2); 1316 s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K); 1317 s2->s.k = 0xf; 1318 sappend(s, s2); 1319 s2 = new_stmt(BPF_ALU|BPF_LSH|BPF_K); 1320 s2->s.k = 2; 1321 sappend(s, s2); 1322 1323 /* 1324 * The A register now contains the length of the 1325 * IP header. We need to add to it the length 1326 * of the prefix preceding the link-layer 1327 * header, which is still in the X register, and 1328 * move the result into the X register. 1329 */ 1330 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 1331 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 1332 } else { 1333 /* 1334 * There is no variable-length header preceding the 1335 * link-layer header; if there's a fixed-length 1336 * header preceding it, its length is included in 1337 * the off_ variables, so it doesn't need to be added. 1338 */ 1339 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 1340 s->s.k = off_nl; 1341 } 1342 return s; 1343} 1344 |
1345static struct block * 1346gen_uncond(rsense) 1347 int rsense; 1348{ 1349 struct block *b; 1350 struct slist *s; 1351 1352 s = new_stmt(BPF_LD|BPF_IMM); --- 19 unchanged lines hidden (view full) --- 1372/* 1373 * Byte-swap a 32-bit number. 1374 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 1375 * big-endian platforms.) 1376 */ 1377#define SWAPLONG(y) \ 1378((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 1379 |
1380/* 1381 * Generate code to match a particular packet type. 1382 * 1383 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1384 * value, if <= ETHERMTU. We use that to determine whether to 1385 * match the type/length field or to check the type/length field for 1386 * a value <= ETHERMTU to see whether it's a type field and then do 1387 * the appropriate test. 1388 */ |
1389static struct block * 1390gen_ether_linktype(proto) 1391 register int proto; 1392{ 1393 struct block *b0, *b1; 1394 1395 switch (proto) { 1396 1397 case LLCSAP_ISONS: |
1398 case LLCSAP_IP: |
1399 case LLCSAP_NETBEUI: 1400 /* |
1401 * OSI protocols and NetBEUI always use 802.2 encapsulation, 1402 * so we check the DSAP and SSAP. 1403 * 1404 * LLCSAP_IP checks for IP-over-802.2, rather 1405 * than IP-over-Ethernet or IP-over-SNAP. 1406 * |
1407 * XXX - should we check both the DSAP and the 1408 * SSAP, like this, or should we check just the |
1409 * DSAP, as we do for other types <= ETHERMTU 1410 * (i.e., other SAP values)? |
1411 */ |
1412 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); |
1413 gen_not(b0); |
1414 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32) 1415 ((proto << 8) | proto)); |
1416 gen_and(b0, b1); 1417 return b1; 1418 1419 case LLCSAP_IPX: 1420 /* 1421 * Check for; 1422 * 1423 * Ethernet_II frames, which are Ethernet --- 20 unchanged lines hidden (view full) --- 1444 * XXX - should we generate the same code both 1445 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 1446 */ 1447 1448 /* 1449 * This generates code to check both for the 1450 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 1451 */ |
1452 b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, 1453 (bpf_int32)LLCSAP_IPX); 1454 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, 1455 (bpf_int32)0xFFFF); |
1456 gen_or(b0, b1); 1457 1458 /* 1459 * Now we add code to check for SNAP frames with 1460 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 1461 */ 1462 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14); 1463 gen_or(b0, b1); 1464 1465 /* 1466 * Now we generate code to check for 802.3 1467 * frames in general. 1468 */ |
1469 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); |
1470 gen_not(b0); 1471 1472 /* 1473 * Now add the check for 802.3 frames before the 1474 * check for Ethernet_802.2 and Ethernet_802.3, 1475 * as those checks should only be done on 802.3 1476 * frames, not on Ethernet frames. 1477 */ 1478 gen_and(b0, b1); 1479 1480 /* 1481 * Now add the check for Ethernet_II frames, and 1482 * do that before checking for the other frame 1483 * types. 1484 */ |
1485 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, 1486 (bpf_int32)ETHERTYPE_IPX); |
1487 gen_or(b0, b1); 1488 return b1; 1489 1490 case ETHERTYPE_ATALK: 1491 case ETHERTYPE_AARP: 1492 /* 1493 * EtherTalk (AppleTalk protocols on Ethernet link 1494 * layer) may use 802.2 encapsulation. 1495 */ 1496 1497 /* 1498 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1499 * we check for an Ethernet type field less than 1500 * 1500, which means it's an 802.3 length field. 1501 */ |
1502 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); |
1503 gen_not(b0); 1504 1505 /* 1506 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1507 * SNAP packets with an organization code of 1508 * 0x080007 (Apple, for Appletalk) and a protocol 1509 * type of ETHERTYPE_ATALK (Appletalk). 1510 * --- 8 unchanged lines hidden (view full) --- 1519 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14); 1520 gen_and(b0, b1); 1521 1522 /* 1523 * Check for Ethernet encapsulation (Ethertalk 1524 * phase 1?); we just check for the Ethernet 1525 * protocol type. 1526 */ |
1527 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto); |
1528 1529 gen_or(b0, b1); 1530 return b1; 1531 1532 default: 1533 if (proto <= ETHERMTU) { 1534 /* 1535 * This is an LLC SAP value, so the frames 1536 * that match would be 802.2 frames. 1537 * Check that the frame is an 802.2 frame 1538 * (i.e., that the length/type field is 1539 * a length field, <= ETHERMTU) and 1540 * then check the DSAP. 1541 */ |
1542 b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU); |
1543 gen_not(b0); |
1544 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, 1545 (bpf_int32)proto); |
1546 gen_and(b0, b1); 1547 return b1; 1548 } else { 1549 /* 1550 * This is an Ethernet type, so compare 1551 * the length/type field with it (if 1552 * the frame is an 802.2 frame, the length 1553 * field will be <= ETHERMTU, and, as 1554 * "proto" is > ETHERMTU, this test 1555 * will fail and the frame won't match, 1556 * which is what we want). 1557 */ |
1558 return gen_cmp(OR_LINK, off_linktype, BPF_H, 1559 (bpf_int32)proto); |
1560 } 1561 } 1562} 1563 |
1564/* 1565 * Generate code to match a particular packet type. 1566 * 1567 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1568 * value, if <= ETHERMTU. We use that to determine whether to 1569 * match the type field or to check the type field for the special 1570 * LINUX_SLL_P_802_2 value and then do the appropriate test. 1571 */ |
1572static struct block * 1573gen_linux_sll_linktype(proto) 1574 register int proto; 1575{ 1576 struct block *b0, *b1; 1577 1578 switch (proto) { 1579 |
1580 case LLCSAP_ISONS: |
1581 case LLCSAP_IP: 1582 case LLCSAP_NETBEUI: |
1583 /* |
1584 * OSI protocols and NetBEUI always use 802.2 encapsulation, 1585 * so we check the DSAP and SSAP. 1586 * 1587 * LLCSAP_IP checks for IP-over-802.2, rather 1588 * than IP-over-Ethernet or IP-over-SNAP. 1589 * |
1590 * XXX - should we check both the DSAP and the 1591 * SSAP, like this, or should we check just the |
1592 * DSAP, as we do for other types <= ETHERMTU 1593 * (i.e., other SAP values)? |
1594 */ |
1595 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2); 1596 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32) 1597 ((proto << 8) | proto)); |
1598 gen_and(b0, b1); 1599 return b1; 1600 |
1601 case LLCSAP_IPX: 1602 /* 1603 * Ethernet_II frames, which are Ethernet 1604 * frames with a frame type of ETHERTYPE_IPX; 1605 * 1606 * Ethernet_802.3 frames, which have a frame 1607 * type of LINUX_SLL_P_802_3; 1608 * --- 10 unchanged lines hidden (view full) --- 1619 * ID of ETHERTYPE_IPX in the SNAP header. 1620 * 1621 * First, do the checks on LINUX_SLL_P_802_2 1622 * frames; generate the check for either 1623 * Ethernet_802.2 or Ethernet_SNAP frames, and 1624 * then put a check for LINUX_SLL_P_802_2 frames 1625 * before it. 1626 */ |
1627 b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, |
1628 (bpf_int32)LLCSAP_IPX); 1629 b1 = gen_snap(0x000000, ETHERTYPE_IPX, 1630 off_linktype + 2); 1631 gen_or(b0, b1); |
1632 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2); |
1633 gen_and(b0, b1); 1634 1635 /* 1636 * Now check for 802.3 frames and OR that with 1637 * the previous test. 1638 */ |
1639 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_3); |
1640 gen_or(b0, b1); 1641 1642 /* 1643 * Now add the check for Ethernet_II frames, and 1644 * do that before checking for the other frame 1645 * types. 1646 */ |
1647 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, |
1648 (bpf_int32)ETHERTYPE_IPX); 1649 gen_or(b0, b1); 1650 return b1; 1651 1652 case ETHERTYPE_ATALK: 1653 case ETHERTYPE_AARP: 1654 /* 1655 * EtherTalk (AppleTalk protocols on Ethernet link 1656 * layer) may use 802.2 encapsulation. 1657 */ 1658 1659 /* 1660 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1661 * we check for the 802.2 protocol type in the 1662 * "Ethernet type" field. 1663 */ |
1664 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2); |
1665 1666 /* 1667 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1668 * SNAP packets with an organization code of 1669 * 0x080007 (Apple, for Appletalk) and a protocol 1670 * type of ETHERTYPE_ATALK (Appletalk). 1671 * 1672 * 802.2-encapsulated ETHERTYPE_AARP packets are --- 9 unchanged lines hidden (view full) --- 1682 off_linktype + 2); 1683 gen_and(b0, b1); 1684 1685 /* 1686 * Check for Ethernet encapsulation (Ethertalk 1687 * phase 1?); we just check for the Ethernet 1688 * protocol type. 1689 */ |
1690 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto); |
1691 1692 gen_or(b0, b1); 1693 return b1; 1694 1695 default: 1696 if (proto <= ETHERMTU) { 1697 /* 1698 * This is an LLC SAP value, so the frames 1699 * that match would be 802.2 frames. 1700 * Check for the 802.2 protocol type 1701 * in the "Ethernet type" field, and 1702 * then check the DSAP. 1703 */ |
1704 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, |
1705 LINUX_SLL_P_802_2); |
1706 b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B, |
1707 (bpf_int32)proto); 1708 gen_and(b0, b1); 1709 return b1; 1710 } else { 1711 /* 1712 * This is an Ethernet type, so compare 1713 * the length/type field with it (if 1714 * the frame is an 802.2 frame, the length 1715 * field will be <= ETHERMTU, and, as 1716 * "proto" is > ETHERMTU, this test 1717 * will fail and the frame won't match, 1718 * which is what we want). 1719 */ |
1720 return gen_cmp(OR_LINK, off_linktype, BPF_H, |
1721 (bpf_int32)proto); 1722 } 1723 } 1724} 1725 |
1726static void 1727insert_radiotap_load_llprefixlen(b) 1728 struct block *b; 1729{ 1730 struct slist *s1, *s2; 1731 1732 /* 1733 * Prepend to the statements in this block code to load the 1734 * length of the radiotap header into the register assigned 1735 * to hold that length, if one has been assigned. 1736 */ 1737 if (reg_ll_size != -1) { 1738 /* 1739 * The 2 bytes at offsets of 2 and 3 from the beginning 1740 * of the radiotap header are the length of the radiotap 1741 * header; unfortunately, it's little-endian, so we have 1742 * to load it a byte at a time and construct the value. 1743 */ 1744 1745 /* 1746 * Load the high-order byte, at an offset of 3, shift it 1747 * left a byte, and put the result in the X register. 1748 */ 1749 s1 = new_stmt(BPF_LD|BPF_B|BPF_ABS); 1750 s1->s.k = 3; 1751 s2 = new_stmt(BPF_ALU|BPF_LSH|BPF_K); 1752 sappend(s1, s2); 1753 s2->s.k = 8; 1754 s2 = new_stmt(BPF_MISC|BPF_TAX); 1755 sappend(s1, s2); 1756 1757 /* 1758 * Load the next byte, at an offset of 2, and OR the 1759 * value from the X register into it. 1760 */ 1761 s2 = new_stmt(BPF_LD|BPF_B|BPF_ABS); 1762 sappend(s1, s2); 1763 s2->s.k = 2; 1764 s2 = new_stmt(BPF_ALU|BPF_OR|BPF_X); 1765 sappend(s1, s2); 1766 1767 /* 1768 * Now allocate a register to hold that value and store 1769 * it. 1770 */ 1771 s2 = new_stmt(BPF_ST); 1772 s2->s.k = reg_ll_size; 1773 sappend(s1, s2); 1774 1775 /* 1776 * Now move it into the X register. 1777 */ 1778 s2 = new_stmt(BPF_MISC|BPF_TAX); 1779 sappend(s1, s2); 1780 1781 /* 1782 * Now append all the existing statements in this 1783 * block to these statements. 1784 */ 1785 sappend(s1, b->stmts); 1786 b->stmts = s1; 1787 } 1788} 1789 1790 1791static void 1792insert_load_llprefixlen(b) 1793 struct block *b; 1794{ 1795 switch (linktype) { 1796 1797 case DLT_IEEE802_11_RADIO: 1798 insert_radiotap_load_llprefixlen(b); 1799 } 1800} 1801 1802 1803static struct slist * 1804gen_radiotap_llprefixlen(void) 1805{ 1806 struct slist *s; 1807 1808 if (reg_ll_size == -1) { 1809 /* 1810 * We haven't yet assigned a register for the length 1811 * of the radiotap header; allocate one. 1812 */ 1813 reg_ll_size = alloc_reg(); 1814 } 1815 1816 /* 1817 * Load the register containing the radiotap length 1818 * into the X register. 1819 */ 1820 s = new_stmt(BPF_LDX|BPF_MEM); 1821 s->s.k = reg_ll_size; 1822 return s; 1823} 1824 1825/* 1826 * Generate code to compute the link-layer header length, if necessary, 1827 * putting it into the X register, and to return either a pointer to a 1828 * "struct slist" for the list of statements in that code, or NULL if 1829 * no code is necessary. 1830 */ 1831static struct slist * 1832gen_llprefixlen(void) 1833{ 1834 switch (linktype) { 1835 1836 case DLT_IEEE802_11_RADIO: 1837 return gen_radiotap_llprefixlen(); 1838 1839 default: 1840 return NULL; 1841 } 1842} 1843 1844/* 1845 * Generate code to match a particular packet type by matching the 1846 * link-layer type field or fields in the 802.2 LLC header. 1847 * 1848 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1849 * value, if <= ETHERMTU. 1850 */ |
1851static struct block * 1852gen_linktype(proto) 1853 register int proto; 1854{ 1855 struct block *b0, *b1, *b2; 1856 1857 switch (linktype) { 1858 --- 5 unchanged lines hidden (view full) --- 1864 case DLT_C_HDLC: 1865 switch (proto) { 1866 1867 case LLCSAP_ISONS: 1868 proto = (proto << 8 | LLCSAP_ISONS); 1869 /* fall through */ 1870 1871 default: |
1872 return gen_cmp(OR_LINK, off_linktype, BPF_H, 1873 (bpf_int32)proto); |
1874 /*NOTREACHED*/ 1875 break; 1876 } 1877 break; 1878 |
1879 case DLT_FDDI: 1880 case DLT_IEEE802: |
1881 case DLT_IEEE802_11: 1882 case DLT_IEEE802_11_RADIO_AVS: 1883 case DLT_IEEE802_11_RADIO: 1884 case DLT_PRISM_HEADER: |
1885 case DLT_ATM_RFC1483: 1886 case DLT_ATM_CLIP: 1887 case DLT_IP_OVER_FC: |
1888 return gen_llc_linktype(proto); |
1889 /*NOTREACHED*/ 1890 break; 1891 1892 case DLT_SUNATM: 1893 /* 1894 * If "is_lane" is set, check for a LANE-encapsulated 1895 * version of this protocol, otherwise check for an 1896 * LLC-encapsulated version of this protocol. 1897 * 1898 * We assume LANE means Ethernet, not Token Ring. 1899 */ 1900 if (is_lane) { 1901 /* 1902 * Check that the packet doesn't begin with an 1903 * LE Control marker. (We've already generated 1904 * a test for LANE.) 1905 */ |
1906 b0 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 1907 0xFF00); |
1908 gen_not(b0); 1909 1910 /* 1911 * Now generate an Ethernet test. 1912 */ 1913 b1 = gen_ether_linktype(proto); 1914 gen_and(b0, b1); 1915 return b1; 1916 } else { 1917 /* 1918 * Check for LLC encapsulation and then check the 1919 * protocol. 1920 */ 1921 b0 = gen_atmfield_code(A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); |
1922 b1 = gen_llc_linktype(proto); |
1923 gen_and(b0, b1); 1924 return b1; 1925 } |
1926 /*NOTREACHED*/ 1927 break; |
1928 1929 case DLT_LINUX_SLL: 1930 return gen_linux_sll_linktype(proto); 1931 /*NOTREACHED*/ 1932 break; 1933 1934 case DLT_SLIP: 1935 case DLT_SLIP_BSDOS: --- 73 unchanged lines hidden (view full) --- 2009 case DLT_PPP_BSDOS: 2010 /* 2011 * We use Ethernet protocol types inside libpcap; 2012 * map them to the corresponding PPP protocol types. 2013 */ 2014 switch (proto) { 2015 2016 case ETHERTYPE_IP: |
2017 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_IP); 2018 b1 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJC); |
2019 gen_or(b0, b1); |
2020 b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJNC); |
2021 gen_or(b1, b0); 2022 return b0; 2023 2024#ifdef INET6 2025 case ETHERTYPE_IPV6: 2026 proto = PPP_IPV6; 2027 /* more to go? */ 2028 break; --- 89 unchanged lines hidden (view full) --- 2118 * Then we run it through "htonl()", and 2119 * generate code to compare against the result. 2120 */ 2121 if (bpf_pcap->sf.rfile != NULL && 2122 bpf_pcap->sf.swapped) 2123 proto = SWAPLONG(proto); 2124 proto = htonl(proto); 2125 } |
2126 return (gen_cmp(OR_LINK, 0, BPF_W, (bpf_int32)proto)); |
2127 2128 case DLT_PFLOG: 2129 /* 2130 * af field is host byte order in contrast to the rest of 2131 * the packet. 2132 */ 2133 if (proto == ETHERTYPE_IP) |
2134 return (gen_cmp(OR_LINK, offsetof(struct pfloghdr, af), 2135 BPF_B, (bpf_int32)AF_INET)); |
2136#ifdef INET6 2137 else if (proto == ETHERTYPE_IPV6) |
2138 return (gen_cmp(OR_LINK, offsetof(struct pfloghdr, af), 2139 BPF_B, (bpf_int32)AF_INET6)); |
2140#endif /* INET6 */ 2141 else 2142 return gen_false(); 2143 /*NOTREACHED*/ 2144 break; 2145 2146 case DLT_ARCNET: 2147 case DLT_ARCNET_LINUX: 2148 /* 2149 * XXX should we check for first fragment if the protocol 2150 * uses PHDS? 2151 */ 2152 switch (proto) { 2153 2154 default: 2155 return gen_false(); 2156 2157#ifdef INET6 2158 case ETHERTYPE_IPV6: |
2159 return (gen_cmp(OR_LINK, off_linktype, BPF_B, |
2160 (bpf_int32)ARCTYPE_INET6)); 2161#endif /* INET6 */ 2162 2163 case ETHERTYPE_IP: |
2164 b0 = gen_cmp(OR_LINK, off_linktype, BPF_B, |
2165 (bpf_int32)ARCTYPE_IP); |
2166 b1 = gen_cmp(OR_LINK, off_linktype, BPF_B, |
2167 (bpf_int32)ARCTYPE_IP_OLD); 2168 gen_or(b0, b1); 2169 return (b1); 2170 2171 case ETHERTYPE_ARP: |
2172 b0 = gen_cmp(OR_LINK, off_linktype, BPF_B, |
2173 (bpf_int32)ARCTYPE_ARP); |
2174 b1 = gen_cmp(OR_LINK, off_linktype, BPF_B, |
2175 (bpf_int32)ARCTYPE_ARP_OLD); 2176 gen_or(b0, b1); 2177 return (b1); 2178 2179 case ETHERTYPE_REVARP: |
2180 return (gen_cmp(OR_LINK, off_linktype, BPF_B, |
2181 (bpf_int32)ARCTYPE_REVARP)); 2182 2183 case ETHERTYPE_ATALK: |
2184 return (gen_cmp(OR_LINK, off_linktype, BPF_B, |
2185 (bpf_int32)ARCTYPE_ATALK)); 2186 } 2187 /*NOTREACHED*/ 2188 break; 2189 2190 case DLT_LTALK: 2191 switch (proto) { 2192 case ETHERTYPE_ATALK: --- 10 unchanged lines hidden (view full) --- 2203 * DLCI and flags. What if the address is longer? 2204 */ 2205 switch (proto) { 2206 2207 case ETHERTYPE_IP: 2208 /* 2209 * Check for the special NLPID for IP. 2210 */ |
2211 return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | 0xcc); |
2212 2213#ifdef INET6 2214 case ETHERTYPE_IPV6: 2215 /* 2216 * Check for the special NLPID for IPv6. 2217 */ |
2218 return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | 0x8e); |
2219#endif 2220 2221 case LLCSAP_ISONS: 2222 /* 2223 * Check for several OSI protocols. 2224 * 2225 * Frame Relay packets typically have an OSI 2226 * NLPID at the beginning; we check for each 2227 * of them. 2228 * 2229 * What we check for is the NLPID and a frame 2230 * control field of UI, i.e. 0x03 followed 2231 * by the NLPID. 2232 */ |
2233 b0 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO8473_CLNP); 2234 b1 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO9542_ESIS); 2235 b2 = gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | ISO10589_ISIS); |
2236 gen_or(b1, b2); 2237 gen_or(b0, b2); 2238 return b2; 2239 2240 default: 2241 return gen_false(); 2242 } 2243 /*NOTREACHED*/ 2244 break; 2245 2246 case DLT_JUNIPER_MLFR: 2247 case DLT_JUNIPER_MLPPP: 2248 case DLT_JUNIPER_ATM1: 2249 case DLT_JUNIPER_ATM2: |
2250 case DLT_JUNIPER_PPPOE: 2251 case DLT_JUNIPER_PPPOE_ATM: 2252 case DLT_JUNIPER_GGSN: 2253 case DLT_JUNIPER_ES: 2254 case DLT_JUNIPER_MONITOR: 2255 case DLT_JUNIPER_SERVICES: |
2256 /* just lets verify the magic number for now - 2257 * on ATM we may have up to 6 different encapsulations on the wire 2258 * and need a lot of heuristics to figure out that the payload 2259 * might be; 2260 * 2261 * FIXME encapsulation specific BPF_ filters 2262 */ |
2263 return gen_mcmp(OR_LINK, 0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */ |
2264 2265 case DLT_LINUX_IRDA: 2266 bpf_error("IrDA link-layer type filtering not implemented"); 2267 2268 case DLT_DOCSIS: 2269 bpf_error("DOCSIS link-layer type filtering not implemented"); |
2270 2271 case DLT_LINUX_LAPD: 2272 bpf_error("LAPD link-layer type filtering not implemented"); |
2273 } 2274 2275 /* 2276 * All the types that have no encapsulation should either be 2277 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if 2278 * all packets are IP packets, or should be handled in some 2279 * special case, if none of them are (if some are and some 2280 * aren't, the lack of encapsulation is a problem, as we'd --- 8 unchanged lines hidden (view full) --- 2289 * Any type not handled above should always have an Ethernet 2290 * type at an offset of "off_linktype". (PPP is partially 2291 * handled above - the protocol type is mapped from the 2292 * Ethernet and LLC types we use internally to the corresponding 2293 * PPP type - but the PPP type is always specified by a value 2294 * at "off_linktype", so we don't have to do the code generation 2295 * above.) 2296 */ |
2297 return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto); |
2298} 2299 2300/* 2301 * Check for an LLC SNAP packet with a given organization code and 2302 * protocol type; we check the entire contents of the 802.2 LLC and 2303 * snap headers, checking for DSAP and SSAP of SNAP and a control 2304 * field of 0x03 in the LLC header, and for the specified organization 2305 * code and protocol type in the SNAP header. --- 9 unchanged lines hidden (view full) --- 2315 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 2316 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ 2317 snapblock[2] = 0x03; /* control = UI */ 2318 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 2319 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 2320 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 2321 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 2322 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ |
2323 return gen_bcmp(OR_LINK, offset, 8, snapblock); |
2324} 2325 2326/* |
2327 * Generate code to match a particular packet type, for link-layer types 2328 * using 802.2 LLC headers. 2329 * 2330 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used 2331 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues. 2332 * 2333 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 2334 * value, if <= ETHERMTU. We use that to determine whether to 2335 * match the DSAP or both DSAP and LSAP or to check the OUI and 2336 * protocol ID in a SNAP header. |
2337 */ 2338static struct block * |
2339gen_llc_linktype(proto) |
2340 int proto; 2341{ 2342 /* 2343 * XXX - handle token-ring variable-length header. 2344 */ 2345 switch (proto) { 2346 2347 case LLCSAP_IP: |
2348 case LLCSAP_ISONS: |
2349 case LLCSAP_NETBEUI: |
2350 /* 2351 * XXX - should we check both the DSAP and the 2352 * SSAP, like this, or should we check just the 2353 * DSAP, as we do for other types <= ETHERMTU 2354 * (i.e., other SAP values)? 2355 */ 2356 return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_u_int32) 2357 ((proto << 8) | proto)); |
2358 2359 case LLCSAP_IPX: 2360 /* 2361 * XXX - are there ever SNAP frames for IPX on 2362 * non-Ethernet 802.x networks? 2363 */ |
2364 return gen_cmp(OR_LINK, off_linktype, BPF_B, 2365 (bpf_int32)LLCSAP_IPX); |
2366 2367 case ETHERTYPE_ATALK: 2368 /* 2369 * 802.2-encapsulated ETHERTYPE_ATALK packets are 2370 * SNAP packets with an organization code of 2371 * 0x080007 (Apple, for Appletalk) and a protocol 2372 * type of ETHERTYPE_ATALK (Appletalk). 2373 * --- 7 unchanged lines hidden (view full) --- 2381 * XXX - we don't have to check for IPX 802.3 2382 * here, but should we check for the IPX Ethertype? 2383 */ 2384 if (proto <= ETHERMTU) { 2385 /* 2386 * This is an LLC SAP value, so check 2387 * the DSAP. 2388 */ |
2389 return gen_cmp(OR_LINK, off_linktype, BPF_B, 2390 (bpf_int32)proto); |
2391 } else { 2392 /* 2393 * This is an Ethernet type; we assume that it's 2394 * unlikely that it'll appear in the right place 2395 * at random, and therefore check only the 2396 * location that would hold the Ethernet type 2397 * in a SNAP frame with an organization code of 2398 * 0x000000 (encapsulated Ethernet). --- 5 unchanged lines hidden (view full) --- 2404 * 2405 * return gen_snap(0x000000, proto, 2406 * off_linktype); 2407 * 2408 * here; for now, we don't, as per the above. 2409 * I don't know whether it's worth the extra CPU 2410 * time to do the right check or not. 2411 */ |
2412 return gen_cmp(OR_LINK, off_linktype+6, BPF_H, 2413 (bpf_int32)proto); |
2414 } 2415 } 2416} 2417 2418static struct block * 2419gen_hostop(addr, mask, dir, proto, src_off, dst_off) 2420 bpf_u_int32 addr; 2421 bpf_u_int32 mask; --- 25 unchanged lines hidden (view full) --- 2447 b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); 2448 gen_or(b0, b1); 2449 return b1; 2450 2451 default: 2452 abort(); 2453 } 2454 b0 = gen_linktype(proto); |
2455 b1 = gen_mcmp(OR_NET, offset, BPF_W, (bpf_int32)addr, mask); |
2456 gen_and(b0, b1); 2457 return b1; 2458} 2459 2460#ifdef INET6 2461static struct block * 2462gen_hostop6(addr, mask, dir, proto, src_off, dst_off) 2463 struct in6_addr *addr; --- 29 unchanged lines hidden (view full) --- 2493 return b1; 2494 2495 default: 2496 abort(); 2497 } 2498 /* this order is important */ 2499 a = (u_int32_t *)addr; 2500 m = (u_int32_t *)mask; |
2501 b1 = gen_mcmp(OR_NET, offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 2502 b0 = gen_mcmp(OR_NET, offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); |
2503 gen_and(b0, b1); |
2504 b0 = gen_mcmp(OR_NET, offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); |
2505 gen_and(b0, b1); |
2506 b0 = gen_mcmp(OR_NET, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); |
2507 gen_and(b0, b1); 2508 b0 = gen_linktype(proto); 2509 gen_and(b0, b1); 2510 return b1; 2511} 2512#endif /*INET6*/ 2513 2514static struct block * 2515gen_ehostop(eaddr, dir) 2516 register const u_char *eaddr; 2517 register int dir; 2518{ 2519 register struct block *b0, *b1; 2520 2521 switch (dir) { 2522 case Q_SRC: |
2523 return gen_bcmp(OR_LINK, off_mac + 6, 6, eaddr); |
2524 2525 case Q_DST: |
2526 return gen_bcmp(OR_LINK, off_mac + 0, 6, eaddr); |
2527 2528 case Q_AND: 2529 b0 = gen_ehostop(eaddr, Q_SRC); 2530 b1 = gen_ehostop(eaddr, Q_DST); 2531 gen_and(b0, b1); 2532 return b1; 2533 2534 case Q_DEFAULT: --- 15 unchanged lines hidden (view full) --- 2550 register const u_char *eaddr; 2551 register int dir; 2552{ 2553 struct block *b0, *b1; 2554 2555 switch (dir) { 2556 case Q_SRC: 2557#ifdef PCAP_FDDIPAD |
2558 return gen_bcmp(OR_LINK, 6 + 1 + pcap_fddipad, 6, eaddr); |
2559#else |
2560 return gen_bcmp(OR_LINK, 6 + 1, 6, eaddr); |
2561#endif 2562 2563 case Q_DST: 2564#ifdef PCAP_FDDIPAD |
2565 return gen_bcmp(OR_LINK, 0 + 1 + pcap_fddipad, 6, eaddr); |
2566#else |
2567 return gen_bcmp(OR_LINK, 0 + 1, 6, eaddr); |
2568#endif 2569 2570 case Q_AND: 2571 b0 = gen_fhostop(eaddr, Q_SRC); 2572 b1 = gen_fhostop(eaddr, Q_DST); 2573 gen_and(b0, b1); 2574 return b1; 2575 --- 15 unchanged lines hidden (view full) --- 2591gen_thostop(eaddr, dir) 2592 register const u_char *eaddr; 2593 register int dir; 2594{ 2595 register struct block *b0, *b1; 2596 2597 switch (dir) { 2598 case Q_SRC: |
2599 return gen_bcmp(OR_LINK, 8, 6, eaddr); |
2600 2601 case Q_DST: |
2602 return gen_bcmp(OR_LINK, 2, 6, eaddr); |
2603 2604 case Q_AND: 2605 b0 = gen_thostop(eaddr, Q_SRC); 2606 b1 = gen_thostop(eaddr, Q_DST); 2607 gen_and(b0, b1); 2608 return b1; 2609 2610 case Q_DEFAULT: --- 40 unchanged lines hidden (view full) --- 2651 */ 2652 2653 /* 2654 * Generate the tests to be done for data frames 2655 * with From DS set. 2656 * 2657 * First, check for To DS set, i.e. check "link[1] & 0x01". 2658 */ |
2659 s = gen_load_a(OR_LINK, 1, BPF_B); |
2660 b1 = new_block(JMP(BPF_JSET)); 2661 b1->s.k = 0x01; /* To DS */ 2662 b1->stmts = s; 2663 2664 /* 2665 * If To DS is set, the SA is at 24. 2666 */ |
2667 b0 = gen_bcmp(OR_LINK, 24, 6, eaddr); |
2668 gen_and(b1, b0); 2669 2670 /* 2671 * Now, check for To DS not set, i.e. check 2672 * "!(link[1] & 0x01)". 2673 */ |
2674 s = gen_load_a(OR_LINK, 1, BPF_B); |
2675 b2 = new_block(JMP(BPF_JSET)); 2676 b2->s.k = 0x01; /* To DS */ 2677 b2->stmts = s; 2678 gen_not(b2); 2679 2680 /* 2681 * If To DS is not set, the SA is at 16. 2682 */ |
2683 b1 = gen_bcmp(OR_LINK, 16, 6, eaddr); |
2684 gen_and(b2, b1); 2685 2686 /* 2687 * Now OR together the last two checks. That gives 2688 * the complete set of checks for data frames with 2689 * From DS set. 2690 */ 2691 gen_or(b1, b0); 2692 2693 /* 2694 * Now check for From DS being set, and AND that with 2695 * the ORed-together checks. 2696 */ |
2697 s = gen_load_a(OR_LINK, 1, BPF_B); |
2698 b1 = new_block(JMP(BPF_JSET)); 2699 b1->s.k = 0x02; /* From DS */ 2700 b1->stmts = s; 2701 gen_and(b1, b0); 2702 2703 /* 2704 * Now check for data frames with From DS not set. 2705 */ |
2706 s = gen_load_a(OR_LINK, 1, BPF_B); |
2707 b2 = new_block(JMP(BPF_JSET)); 2708 b2->s.k = 0x02; /* From DS */ 2709 b2->stmts = s; 2710 gen_not(b2); 2711 2712 /* 2713 * If From DS isn't set, the SA is at 10. 2714 */ |
2715 b1 = gen_bcmp(OR_LINK, 10, 6, eaddr); |
2716 gen_and(b2, b1); 2717 2718 /* 2719 * Now OR together the checks for data frames with 2720 * From DS not set and for data frames with From DS 2721 * set; that gives the checks done for data frames. 2722 */ 2723 gen_or(b1, b0); 2724 2725 /* 2726 * Now check for a data frame. 2727 * I.e, check "link[0] & 0x08". 2728 */ |
2729 gen_load_a(OR_LINK, 0, BPF_B); |
2730 b1 = new_block(JMP(BPF_JSET)); 2731 b1->s.k = 0x08; 2732 b1->stmts = s; 2733 2734 /* 2735 * AND that with the checks done for data frames. 2736 */ 2737 gen_and(b1, b0); 2738 2739 /* 2740 * If the high-order bit of the type value is 0, this 2741 * is a management frame. 2742 * I.e, check "!(link[0] & 0x08)". 2743 */ |
2744 s = gen_load_a(OR_LINK, 0, BPF_B); |
2745 b2 = new_block(JMP(BPF_JSET)); 2746 b2->s.k = 0x08; 2747 b2->stmts = s; 2748 gen_not(b2); 2749 2750 /* 2751 * For management frames, the SA is at 10. 2752 */ |
2753 b1 = gen_bcmp(OR_LINK, 10, 6, eaddr); |
2754 gen_and(b2, b1); 2755 2756 /* 2757 * OR that with the checks done for data frames. 2758 * That gives the checks done for management and 2759 * data frames. 2760 */ 2761 gen_or(b1, b0); 2762 2763 /* 2764 * If the low-order bit of the type value is 1, 2765 * this is either a control frame or a frame 2766 * with a reserved type, and thus not a 2767 * frame with an SA. 2768 * 2769 * I.e., check "!(link[0] & 0x04)". 2770 */ |
2771 s = gen_load_a(OR_LINK, 0, BPF_B); |
2772 b1 = new_block(JMP(BPF_JSET)); 2773 b1->s.k = 0x04; 2774 b1->stmts = s; 2775 gen_not(b1); 2776 2777 /* 2778 * AND that with the checks for data and management 2779 * frames. --- 18 unchanged lines hidden (view full) --- 2798 * if To DS is set. 2799 */ 2800 2801 /* 2802 * Generate the tests to be done for data frames. 2803 * 2804 * First, check for To DS set, i.e. "link[1] & 0x01". 2805 */ |
2806 s = gen_load_a(OR_LINK, 1, BPF_B); |
2807 b1 = new_block(JMP(BPF_JSET)); 2808 b1->s.k = 0x01; /* To DS */ 2809 b1->stmts = s; 2810 2811 /* 2812 * If To DS is set, the DA is at 16. 2813 */ |
2814 b0 = gen_bcmp(OR_LINK, 16, 6, eaddr); |
2815 gen_and(b1, b0); 2816 2817 /* 2818 * Now, check for To DS not set, i.e. check 2819 * "!(link[1] & 0x01)". 2820 */ |
2821 s = gen_load_a(OR_LINK, 1, BPF_B); |
2822 b2 = new_block(JMP(BPF_JSET)); 2823 b2->s.k = 0x01; /* To DS */ 2824 b2->stmts = s; 2825 gen_not(b2); 2826 2827 /* 2828 * If To DS is not set, the DA is at 4. 2829 */ |
2830 b1 = gen_bcmp(OR_LINK, 4, 6, eaddr); |
2831 gen_and(b2, b1); 2832 2833 /* 2834 * Now OR together the last two checks. That gives 2835 * the complete set of checks for data frames. 2836 */ 2837 gen_or(b1, b0); 2838 2839 /* 2840 * Now check for a data frame. 2841 * I.e, check "link[0] & 0x08". 2842 */ |
2843 s = gen_load_a(OR_LINK, 0, BPF_B); |
2844 b1 = new_block(JMP(BPF_JSET)); 2845 b1->s.k = 0x08; 2846 b1->stmts = s; 2847 2848 /* 2849 * AND that with the checks done for data frames. 2850 */ 2851 gen_and(b1, b0); 2852 2853 /* 2854 * If the high-order bit of the type value is 0, this 2855 * is a management frame. 2856 * I.e, check "!(link[0] & 0x08)". 2857 */ |
2858 s = gen_load_a(OR_LINK, 0, BPF_B); |
2859 b2 = new_block(JMP(BPF_JSET)); 2860 b2->s.k = 0x08; 2861 b2->stmts = s; 2862 gen_not(b2); 2863 2864 /* 2865 * For management frames, the DA is at 4. 2866 */ |
2867 b1 = gen_bcmp(OR_LINK, 4, 6, eaddr); |
2868 gen_and(b2, b1); 2869 2870 /* 2871 * OR that with the checks done for data frames. 2872 * That gives the checks done for management and 2873 * data frames. 2874 */ 2875 gen_or(b1, b0); 2876 2877 /* 2878 * If the low-order bit of the type value is 1, 2879 * this is either a control frame or a frame 2880 * with a reserved type, and thus not a 2881 * frame with an SA. 2882 * 2883 * I.e., check "!(link[0] & 0x04)". 2884 */ |
2885 s = gen_load_a(OR_LINK, 0, BPF_B); |
2886 b1 = new_block(JMP(BPF_JSET)); 2887 b1->s.k = 0x04; 2888 b1->stmts = s; 2889 gen_not(b1); 2890 2891 /* 2892 * AND that with the checks for data and management 2893 * frames. --- 27 unchanged lines hidden (view full) --- 2921gen_ipfchostop(eaddr, dir) 2922 register const u_char *eaddr; 2923 register int dir; 2924{ 2925 register struct block *b0, *b1; 2926 2927 switch (dir) { 2928 case Q_SRC: |
2929 return gen_bcmp(OR_LINK, 10, 6, eaddr); |
2930 2931 case Q_DST: |
2932 return gen_bcmp(OR_LINK, 2, 6, eaddr); |
2933 2934 case Q_AND: 2935 b0 = gen_ipfchostop(eaddr, Q_SRC); 2936 b1 = gen_ipfchostop(eaddr, Q_DST); 2937 gen_and(b0, b1); 2938 return b1; 2939 2940 case Q_DEFAULT: --- 21 unchanged lines hidden (view full) --- 2962 * will require a lot more hacking. 2963 * 2964 * To add support for filtering on DECNET "areas" (network numbers) 2965 * one would want to add a "mask" argument to this routine. That would 2966 * make the filter even more inefficient, although one could be clever 2967 * and not generate masking instructions if the mask is 0xFFFF. 2968 */ 2969static struct block * |
2970gen_dnhostop(addr, dir) |
2971 bpf_u_int32 addr; 2972 int dir; |
2973{ 2974 struct block *b0, *b1, *b2, *tmp; 2975 u_int offset_lh; /* offset if long header is received */ 2976 u_int offset_sh; /* offset if short header is received */ 2977 2978 switch (dir) { 2979 2980 case Q_DST: 2981 offset_sh = 1; /* follows flags */ 2982 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 2983 break; 2984 2985 case Q_SRC: 2986 offset_sh = 3; /* follows flags, dstnode */ 2987 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 2988 break; 2989 2990 case Q_AND: 2991 /* Inefficient because we do our Calvinball dance twice */ |
2992 b0 = gen_dnhostop(addr, Q_SRC); 2993 b1 = gen_dnhostop(addr, Q_DST); |
2994 gen_and(b0, b1); 2995 return b1; 2996 2997 case Q_OR: 2998 case Q_DEFAULT: 2999 /* Inefficient because we do our Calvinball dance twice */ |
3000 b0 = gen_dnhostop(addr, Q_SRC); 3001 b1 = gen_dnhostop(addr, Q_DST); |
3002 gen_or(b0, b1); 3003 return b1; 3004 3005 case Q_ISO: 3006 bpf_error("ISO host filtering not implemented"); 3007 3008 default: 3009 abort(); 3010 } 3011 b0 = gen_linktype(ETHERTYPE_DN); 3012 /* Check for pad = 1, long header case */ |
3013 tmp = gen_mcmp(OR_NET, 2, BPF_H, |
3014 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); |
3015 b1 = gen_cmp(OR_NET, 2 + 1 + offset_lh, |
3016 BPF_H, (bpf_int32)ntohs(addr)); 3017 gen_and(tmp, b1); 3018 /* Check for pad = 0, long header case */ |
3019 tmp = gen_mcmp(OR_NET, 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 3020 b2 = gen_cmp(OR_NET, 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); |
3021 gen_and(tmp, b2); 3022 gen_or(b2, b1); 3023 /* Check for pad = 1, short header case */ |
3024 tmp = gen_mcmp(OR_NET, 2, BPF_H, |
3025 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); |
3026 b2 = gen_cmp(OR_NET, 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); |
3027 gen_and(tmp, b2); 3028 gen_or(b2, b1); 3029 /* Check for pad = 0, short header case */ |
3030 tmp = gen_mcmp(OR_NET, 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 3031 b2 = gen_cmp(OR_NET, 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); |
3032 gen_and(tmp, b2); 3033 gen_or(b2, b1); 3034 3035 /* Combine with test for linktype */ 3036 gen_and(b0, b1); 3037 return b1; 3038} 3039 --- 14 unchanged lines hidden (view full) --- 3054 b1 = gen_host(addr, mask, Q_ARP, dir); 3055 gen_or(b0, b1); 3056 b0 = gen_host(addr, mask, Q_RARP, dir); 3057 gen_or(b1, b0); 3058 } 3059 return b0; 3060 3061 case Q_IP: |
3062 return gen_hostop(addr, mask, dir, ETHERTYPE_IP, 12, 16); |
3063 3064 case Q_RARP: |
3065 return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, 14, 24); |
3066 3067 case Q_ARP: |
3068 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 14, 24); |
3069 3070 case Q_TCP: 3071 bpf_error("'tcp' modifier applied to host"); 3072 3073 case Q_SCTP: 3074 bpf_error("'sctp' modifier applied to host"); 3075 3076 case Q_UDP: --- 16 unchanged lines hidden (view full) --- 3093 3094 case Q_ATALK: 3095 bpf_error("ATALK host filtering not implemented"); 3096 3097 case Q_AARP: 3098 bpf_error("AARP host filtering not implemented"); 3099 3100 case Q_DECNET: |
3101 return gen_dnhostop(addr, dir); |
3102 3103 case Q_SCA: 3104 bpf_error("SCA host filtering not implemented"); 3105 3106 case Q_LAT: 3107 bpf_error("LAT host filtering not implemented"); 3108 3109 case Q_MOPDL: --- 32 unchanged lines hidden (view full) --- 3142 bpf_error("'stp' modifier applied to host"); 3143 3144 case Q_IPX: 3145 bpf_error("IPX host filtering not implemented"); 3146 3147 case Q_NETBEUI: 3148 bpf_error("'netbeui' modifier applied to host"); 3149 |
3150 case Q_RADIO: 3151 bpf_error("'radio' modifier applied to host"); 3152 |
3153 default: 3154 abort(); 3155 } 3156 /* NOTREACHED */ 3157} 3158 3159#ifdef INET6 3160static struct block * --- 58 unchanged lines hidden (view full) --- 3219 3220 case Q_MOPDL: 3221 bpf_error("MOPDL host filtering not implemented"); 3222 3223 case Q_MOPRC: 3224 bpf_error("MOPRC host filtering not implemented"); 3225 3226 case Q_IPV6: |
3227 return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6, 8, 24); |
3228 3229 case Q_ICMPV6: 3230 bpf_error("'icmp6' modifier applied to host"); 3231 3232 case Q_AH: 3233 bpf_error("'ah' modifier applied to host"); 3234 3235 case Q_ESP: --- 15 unchanged lines hidden (view full) --- 3251 bpf_error("'stp' modifier applied to host"); 3252 3253 case Q_IPX: 3254 bpf_error("IPX host filtering not implemented"); 3255 3256 case Q_NETBEUI: 3257 bpf_error("'netbeui' modifier applied to host"); 3258 |
3259 case Q_RADIO: 3260 bpf_error("'radio' modifier applied to host"); 3261 |
3262 default: 3263 abort(); 3264 } 3265 /* NOTREACHED */ 3266} 3267#endif /*INET6*/ 3268 3269#ifndef INET6 --- 15 unchanged lines hidden (view full) --- 3285 case Q_ARP: 3286 case Q_RARP: 3287 if (linktype == DLT_EN10MB) 3288 b0 = gen_ehostop(eaddr, Q_OR); 3289 else if (linktype == DLT_FDDI) 3290 b0 = gen_fhostop(eaddr, Q_OR); 3291 else if (linktype == DLT_IEEE802) 3292 b0 = gen_thostop(eaddr, Q_OR); |
3293 else if (linktype == DLT_IEEE802_11 || 3294 linktype == DLT_IEEE802_11_RADIO_AVS || 3295 linktype == DLT_IEEE802_11_RADIO || 3296 linktype == DLT_PRISM_HEADER) |
3297 b0 = gen_wlanhostop(eaddr, Q_OR); 3298 else if (linktype == DLT_SUNATM && is_lane) { 3299 /* 3300 * Check that the packet doesn't begin with an 3301 * LE Control marker. (We've already generated 3302 * a test for LANE.) 3303 */ |
3304 b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 3305 0xFF00); |
3306 gen_not(b1); 3307 3308 /* 3309 * Now check the MAC address. 3310 */ 3311 b0 = gen_ehostop(eaddr, Q_OR); 3312 gen_and(b1, b0); 3313 } else if (linktype == DLT_IP_OVER_FC) --- 250 unchanged lines hidden (view full) --- 3564 case Q_IPX: 3565 b1 = gen_linktype(LLCSAP_IPX); 3566 break; 3567 3568 case Q_NETBEUI: 3569 b1 = gen_linktype(LLCSAP_NETBEUI); 3570 break; 3571 |
3572 case Q_RADIO: 3573 bpf_error("'radio' is not a valid protocol type"); 3574 |
3575 default: 3576 abort(); 3577 } 3578 return b1; 3579} 3580 3581static struct block * 3582gen_ipfrag() 3583{ 3584 struct slist *s; 3585 struct block *b; 3586 3587 /* not ip frag */ |
3588 s = gen_load_a(OR_NET, 6, BPF_H); |
3589 b = new_block(JMP(BPF_JSET)); 3590 b->s.k = 0x1fff; 3591 b->stmts = s; 3592 gen_not(b); 3593 3594 return b; 3595} 3596 |
3597/* 3598 * Generate a comparison to a port value in the transport-layer header 3599 * at the specified offset from the beginning of that header. 3600 * 3601 * XXX - this handles a variable-length prefix preceding the link-layer 3602 * header, such as the radiotap or AVS radio prefix, but doesn't handle 3603 * variable-length link-layer headers (such as Token Ring or 802.11 3604 * headers). 3605 */ |
3606static struct block * 3607gen_portatom(off, v) 3608 int off; 3609 bpf_int32 v; 3610{ |
3611 return gen_cmp(OR_TRAN_IPV4, off, BPF_H, v); |
3612} 3613 3614#ifdef INET6 3615static struct block * 3616gen_portatom6(off, v) 3617 int off; 3618 bpf_int32 v; 3619{ |
3620 return gen_cmp(OR_TRAN_IPV6, off, BPF_H, v); |
3621} 3622#endif/*INET6*/ 3623 3624struct block * 3625gen_portop(port, proto, dir) 3626 int port, proto, dir; 3627{ 3628 struct block *b0, *b1, *tmp; 3629 3630 /* ip proto 'proto' */ |
3631 tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto); |
3632 b0 = gen_ipfrag(); 3633 gen_and(tmp, b0); 3634 3635 switch (dir) { 3636 case Q_SRC: 3637 b1 = gen_portatom(0, (bpf_int32)port); 3638 break; 3639 --- 73 unchanged lines hidden (view full) --- 3713 3714#ifdef INET6 3715struct block * 3716gen_portop6(port, proto, dir) 3717 int port, proto, dir; 3718{ 3719 struct block *b0, *b1, *tmp; 3720 |
3721 /* ip6 proto 'proto' */ 3722 b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto); |
3723 3724 switch (dir) { 3725 case Q_SRC: 3726 b1 = gen_portatom6(0, (bpf_int32)port); 3727 break; 3728 3729 case Q_DST: 3730 b1 = gen_portatom6(2, (bpf_int32)port); --- 23 unchanged lines hidden (view full) --- 3754static struct block * 3755gen_port6(port, ip_proto, dir) 3756 int port; 3757 int ip_proto; 3758 int dir; 3759{ 3760 struct block *b0, *b1, *tmp; 3761 |
3762 /* link proto ip6 */ |
3763 b0 = gen_linktype(ETHERTYPE_IPV6); 3764 3765 switch (ip_proto) { 3766 case IPPROTO_UDP: 3767 case IPPROTO_TCP: 3768 case IPPROTO_SCTP: 3769 b1 = gen_portop6(port, ip_proto, dir); 3770 break; --- 9 unchanged lines hidden (view full) --- 3780 default: 3781 abort(); 3782 } 3783 gen_and(b0, b1); 3784 return b1; 3785} 3786#endif /* INET6 */ 3787 |
3788/* gen_portrange code */ 3789static struct block * 3790gen_portrangeatom(off, v1, v2) 3791 int off; 3792 bpf_int32 v1, v2; 3793{ 3794 struct block *b1, *b2; 3795 3796 if (v1 > v2) { 3797 /* 3798 * Reverse the order of the ports, so v1 is the lower one. 3799 */ 3800 bpf_int32 vtemp; 3801 3802 vtemp = v1; 3803 v1 = v2; 3804 v2 = vtemp; 3805 } 3806 3807 b1 = gen_cmp_ge(OR_TRAN_IPV4, off, BPF_H, v1); 3808 b2 = gen_cmp_le(OR_TRAN_IPV4, off, BPF_H, v2); 3809 3810 gen_and(b1, b2); 3811 3812 return b2; 3813} 3814 3815struct block * 3816gen_portrangeop(port1, port2, proto, dir) 3817 int port1, port2; 3818 int proto; 3819 int dir; 3820{ 3821 struct block *b0, *b1, *tmp; 3822 3823 /* ip proto 'proto' */ 3824 tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto); 3825 b0 = gen_ipfrag(); 3826 gen_and(tmp, b0); 3827 3828 switch (dir) { 3829 case Q_SRC: 3830 b1 = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2); 3831 break; 3832 3833 case Q_DST: 3834 b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2); 3835 break; 3836 3837 case Q_OR: 3838 case Q_DEFAULT: 3839 tmp = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2); 3840 b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2); 3841 gen_or(tmp, b1); 3842 break; 3843 3844 case Q_AND: 3845 tmp = gen_portrangeatom(0, (bpf_int32)port1, (bpf_int32)port2); 3846 b1 = gen_portrangeatom(2, (bpf_int32)port1, (bpf_int32)port2); 3847 gen_and(tmp, b1); 3848 break; 3849 3850 default: 3851 abort(); 3852 } 3853 gen_and(b0, b1); 3854 3855 return b1; 3856} 3857 3858static struct block * 3859gen_portrange(port1, port2, ip_proto, dir) 3860 int port1, port2; 3861 int ip_proto; 3862 int dir; 3863{ 3864 struct block *b0, *b1, *tmp; 3865 3866 /* link proto ip */ 3867 b0 = gen_linktype(ETHERTYPE_IP); 3868 3869 switch (ip_proto) { 3870 case IPPROTO_UDP: 3871 case IPPROTO_TCP: 3872 case IPPROTO_SCTP: 3873 b1 = gen_portrangeop(port1, port2, ip_proto, dir); 3874 break; 3875 3876 case PROTO_UNDEF: 3877 tmp = gen_portrangeop(port1, port2, IPPROTO_TCP, dir); 3878 b1 = gen_portrangeop(port1, port2, IPPROTO_UDP, dir); 3879 gen_or(tmp, b1); 3880 tmp = gen_portrangeop(port1, port2, IPPROTO_SCTP, dir); 3881 gen_or(tmp, b1); 3882 break; 3883 3884 default: 3885 abort(); 3886 } 3887 gen_and(b0, b1); 3888 return b1; 3889} 3890 3891#ifdef INET6 3892static struct block * 3893gen_portrangeatom6(off, v1, v2) 3894 int off; 3895 bpf_int32 v1, v2; 3896{ 3897 struct block *b1, *b2; 3898 3899 if (v1 > v2) { 3900 /* 3901 * Reverse the order of the ports, so v1 is the lower one. 3902 */ 3903 bpf_int32 vtemp; 3904 3905 vtemp = v1; 3906 v1 = v2; 3907 v2 = vtemp; 3908 } 3909 3910 b1 = gen_cmp_ge(OR_TRAN_IPV6, off, BPF_H, v1); 3911 b2 = gen_cmp_le(OR_TRAN_IPV6, off, BPF_H, v2); 3912 3913 gen_and(b1, b2); 3914 3915 return b2; 3916} 3917 3918struct block * 3919gen_portrangeop6(port1, port2, proto, dir) 3920 int port1, port2; 3921 int proto; 3922 int dir; 3923{ 3924 struct block *b0, *b1, *tmp; 3925 3926 /* ip6 proto 'proto' */ 3927 b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto); 3928 3929 switch (dir) { 3930 case Q_SRC: 3931 b1 = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2); 3932 break; 3933 3934 case Q_DST: 3935 b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2); 3936 break; 3937 3938 case Q_OR: 3939 case Q_DEFAULT: 3940 tmp = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2); 3941 b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2); 3942 gen_or(tmp, b1); 3943 break; 3944 3945 case Q_AND: 3946 tmp = gen_portrangeatom6(0, (bpf_int32)port1, (bpf_int32)port2); 3947 b1 = gen_portrangeatom6(2, (bpf_int32)port1, (bpf_int32)port2); 3948 gen_and(tmp, b1); 3949 break; 3950 3951 default: 3952 abort(); 3953 } 3954 gen_and(b0, b1); 3955 3956 return b1; 3957} 3958 3959static struct block * 3960gen_portrange6(port1, port2, ip_proto, dir) 3961 int port1, port2; 3962 int ip_proto; 3963 int dir; 3964{ 3965 struct block *b0, *b1, *tmp; 3966 3967 /* link proto ip6 */ 3968 b0 = gen_linktype(ETHERTYPE_IPV6); 3969 3970 switch (ip_proto) { 3971 case IPPROTO_UDP: 3972 case IPPROTO_TCP: 3973 case IPPROTO_SCTP: 3974 b1 = gen_portrangeop6(port1, port2, ip_proto, dir); 3975 break; 3976 3977 case PROTO_UNDEF: 3978 tmp = gen_portrangeop6(port1, port2, IPPROTO_TCP, dir); 3979 b1 = gen_portrangeop6(port1, port2, IPPROTO_UDP, dir); 3980 gen_or(tmp, b1); 3981 tmp = gen_portrangeop6(port1, port2, IPPROTO_SCTP, dir); 3982 gen_or(tmp, b1); 3983 break; 3984 3985 default: 3986 abort(); 3987 } 3988 gen_and(b0, b1); 3989 return b1; 3990} 3991#endif /* INET6 */ 3992 |
3993static int 3994lookup_proto(name, proto) 3995 register const char *name; 3996 register int proto; 3997{ 3998 register int v; 3999 4000 switch (proto) { --- 72 unchanged lines hidden (view full) --- 4073 b = gen_protochain(v, Q_IPV6, dir); 4074 gen_or(b0, b); 4075 return b; 4076 default: 4077 bpf_error("bad protocol applied for 'protochain'"); 4078 /*NOTREACHED*/ 4079 } 4080 |
4081 /* 4082 * We don't handle variable-length radiotap here headers yet. 4083 * We might want to add BPF instructions to do the protochain 4084 * work, to simplify that and, on platforms that have a BPF 4085 * interpreter with the new instructions, let the filtering 4086 * be done in the kernel. (We already require a modified BPF 4087 * engine to do the protochain stuff, to support backward 4088 * branches, and backward branch support is unlikely to appear 4089 * in kernel BPF engines.) 4090 */ 4091 if (linktype == DLT_IEEE802_11_RADIO) 4092 bpf_error("'protochain' not supported with radiotap headers"); 4093 |
4094 no_optimize = 1; /*this code is not compatible with optimzer yet */ 4095 4096 /* |
4097 * s[0] is a dummy entry to protect other BPF insn from damage |
4098 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 4099 * hard to find interdependency made by jump table fixup. 4100 */ 4101 i = 0; 4102 s[i] = new_stmt(0); /*dummy*/ 4103 i++; 4104 4105 switch (proto) { --- 239 unchanged lines hidden (view full) --- 4345 4346 free_reg(reg2); 4347 4348 gen_and(b0, b); 4349 return b; 4350#endif 4351} 4352 |
4353/* 4354 * Generate code that checks whether the packet is a packet for protocol 4355 * <proto> and whether the type field in that protocol's header has 4356 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an 4357 * IP packet and checks the protocol number in the IP header against <v>. 4358 * 4359 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks 4360 * against Q_IP and Q_IPV6. 4361 */ |
4362static struct block * 4363gen_proto(v, proto, dir) 4364 int v; 4365 int proto; 4366 int dir; 4367{ 4368 struct block *b0, *b1; 4369 --- 23 unchanged lines hidden (view full) --- 4393 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 4394 * RFC 2225 say that SNAP encapsulation is used, not LLC 4395 * encapsulation with LLCSAP_IP. 4396 * 4397 * So we always check for ETHERTYPE_IP. 4398 */ 4399 b0 = gen_linktype(ETHERTYPE_IP); 4400#ifndef CHASE_CHAIN |
4401 b1 = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)v); |
4402#else 4403 b1 = gen_protochain(v, Q_IP); 4404#endif 4405 gen_and(b0, b1); 4406 return b1; 4407 4408 case Q_ISO: 4409 switch (linktype) { --- 12 unchanged lines hidden (view full) --- 4422 * control field value of UI, i.e. 0x03 followed 4423 * by the NLPID. 4424 * 4425 * XXX - assumes a 2-byte Frame Relay header with 4426 * DLCI and flags. What if the address is longer? 4427 * 4428 * XXX - what about SNAP-encapsulated frames? 4429 */ |
4430 return gen_cmp(OR_LINK, 2, BPF_H, (0x03<<8) | v); |
4431 /*NOTREACHED*/ 4432 break; 4433 4434 case DLT_C_HDLC: 4435 /* 4436 * Cisco uses an Ethertype lookalike - for OSI, 4437 * it's 0xfefe. 4438 */ 4439 b0 = gen_linktype(LLCSAP_ISONS<<8 | LLCSAP_ISONS); 4440 /* OSI in C-HDLC is stuffed with a fudge byte */ |
4441 b1 = gen_cmp(OR_NET_NOSNAP, 1, BPF_B, (long)v); |
4442 gen_and(b0, b1); 4443 return b1; 4444 4445 default: 4446 b0 = gen_linktype(LLCSAP_ISONS); |
4447 b1 = gen_cmp(OR_NET_NOSNAP, 0, BPF_B, (long)v); |
4448 gen_and(b0, b1); 4449 return b1; 4450 } 4451 4452 case Q_ISIS: 4453 b0 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 4454 /* 4455 * 4 is the offset of the PDU type relative to the IS-IS 4456 * header. 4457 */ |
4458 b1 = gen_cmp(OR_NET_NOSNAP, 4, BPF_B, (long)v); |
4459 gen_and(b0, b1); 4460 return b1; 4461 4462 case Q_ARP: 4463 bpf_error("arp does not encapsulate another protocol"); 4464 /* NOTREACHED */ 4465 4466 case Q_RARP: --- 58 unchanged lines hidden (view full) --- 4525 case Q_VRRP: 4526 bpf_error("'vrrp proto' is bogus"); 4527 /* NOTREACHED */ 4528 4529#ifdef INET6 4530 case Q_IPV6: 4531 b0 = gen_linktype(ETHERTYPE_IPV6); 4532#ifndef CHASE_CHAIN |
4533 b1 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)v); |
4534#else 4535 b1 = gen_protochain(v, Q_IPV6); 4536#endif 4537 gen_and(b0, b1); 4538 return b1; 4539 4540 case Q_ICMPV6: 4541 bpf_error("'icmp6 proto' is bogus"); --- 9 unchanged lines hidden (view full) --- 4551 bpf_error("'stp proto' is bogus"); 4552 4553 case Q_IPX: 4554 bpf_error("'ipx proto' is bogus"); 4555 4556 case Q_NETBEUI: 4557 bpf_error("'netbeui proto' is bogus"); 4558 |
4559 case Q_RADIO: 4560 bpf_error("'radio proto' is bogus"); 4561 |
4562 default: 4563 abort(); 4564 /* NOTREACHED */ 4565 } 4566 /* NOTREACHED */ 4567} 4568 4569struct block * --- 12 unchanged lines hidden (view full) --- 4582 int tproto6; 4583 struct sockaddr_in *sin; 4584 struct sockaddr_in6 *sin6; 4585 struct addrinfo *res, *res0; 4586 struct in6_addr mask128; 4587#endif /*INET6*/ 4588 struct block *b, *tmp; 4589 int port, real_proto; |
4590 int port1, port2; |
4591 4592 switch (q.addr) { 4593 4594 case Q_NET: 4595 addr = pcap_nametonetaddr(name); 4596 if (addr == 0) 4597 bpf_error("unknown network '%s'", name); 4598 /* Left justify network addr and calculate its network mask */ --- 32 unchanged lines hidden (view full) --- 4631 if (eaddr == NULL) 4632 bpf_error( 4633 "unknown token ring host '%s'", name); 4634 b = gen_thostop(eaddr, dir); 4635 free(eaddr); 4636 return b; 4637 4638 case DLT_IEEE802_11: |
4639 case DLT_IEEE802_11_RADIO_AVS: 4640 case DLT_IEEE802_11_RADIO: 4641 case DLT_PRISM_HEADER: |
4642 eaddr = pcap_ether_hostton(name); 4643 if (eaddr == NULL) 4644 bpf_error( 4645 "unknown 802.11 host '%s'", name); 4646 b = gen_wlanhostop(eaddr, dir); 4647 free(eaddr); 4648 return b; 4649 --- 10 unchanged lines hidden (view full) --- 4660 if (!is_lane) 4661 break; 4662 4663 /* 4664 * Check that the packet doesn't begin 4665 * with an LE Control marker. (We've 4666 * already generated a test for LANE.) 4667 */ |
4668 tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, 4669 BPF_H, 0xFF00); |
4670 gen_not(tmp); 4671 4672 eaddr = pcap_ether_hostton(name); 4673 if (eaddr == NULL) 4674 bpf_error( 4675 "unknown ether host '%s'", name); 4676 b = gen_ehostop(eaddr, dir); 4677 gen_and(tmp, b); --- 115 unchanged lines hidden (view full) --- 4793 { 4794 struct block *b; 4795 b = gen_port(port, real_proto, dir); 4796 gen_or(gen_port6(port, real_proto, dir), b); 4797 return b; 4798 } 4799#endif /* INET6 */ 4800 |
4801 case Q_PORTRANGE: 4802 if (proto != Q_DEFAULT && 4803 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 4804 bpf_error("illegal qualifier of 'portrange'"); 4805 if (pcap_nametoportrange(name, &port1, &port2, &real_proto) == 0) 4806 bpf_error("unknown port in range '%s'", name); 4807 if (proto == Q_UDP) { 4808 if (real_proto == IPPROTO_TCP) 4809 bpf_error("port in range '%s' is tcp", name); 4810 else if (real_proto == IPPROTO_SCTP) 4811 bpf_error("port in range '%s' is sctp", name); 4812 else 4813 /* override PROTO_UNDEF */ 4814 real_proto = IPPROTO_UDP; 4815 } 4816 if (proto == Q_TCP) { 4817 if (real_proto == IPPROTO_UDP) 4818 bpf_error("port in range '%s' is udp", name); 4819 else if (real_proto == IPPROTO_SCTP) 4820 bpf_error("port in range '%s' is sctp", name); 4821 else 4822 /* override PROTO_UNDEF */ 4823 real_proto = IPPROTO_TCP; 4824 } 4825 if (proto == Q_SCTP) { 4826 if (real_proto == IPPROTO_UDP) 4827 bpf_error("port in range '%s' is udp", name); 4828 else if (real_proto == IPPROTO_TCP) 4829 bpf_error("port in range '%s' is tcp", name); 4830 else 4831 /* override PROTO_UNDEF */ 4832 real_proto = IPPROTO_SCTP; 4833 } 4834#ifndef INET6 4835 return gen_portrange(port1, port2, real_proto, dir); 4836#else 4837 { 4838 struct block *b; 4839 b = gen_portrange(port1, port2, real_proto, dir); 4840 gen_or(gen_portrange6(port1, port2, real_proto, dir), b); 4841 return b; 4842 } 4843#endif /* INET6 */ 4844 |
4845 case Q_GATEWAY: 4846#ifndef INET6 4847 eaddr = pcap_ether_hostton(name); 4848 if (eaddr == NULL) 4849 bpf_error("unknown ether host: %s", name); 4850 4851 alist = pcap_nametoaddr(name); 4852 if (alist == NULL || *alist == NULL) --- 131 unchanged lines hidden (view full) --- 4984 { 4985 struct block *b; 4986 b = gen_port((int)v, proto, dir); 4987 gen_or(gen_port6((int)v, proto, dir), b); 4988 return b; 4989 } 4990#endif /* INET6 */ 4991 |
4992 case Q_PORTRANGE: 4993 if (proto == Q_UDP) 4994 proto = IPPROTO_UDP; 4995 else if (proto == Q_TCP) 4996 proto = IPPROTO_TCP; 4997 else if (proto == Q_SCTP) 4998 proto = IPPROTO_SCTP; 4999 else if (proto == Q_DEFAULT) 5000 proto = PROTO_UNDEF; 5001 else 5002 bpf_error("illegal qualifier of 'portrange'"); 5003 5004#ifndef INET6 5005 return gen_portrange((int)v, (int)v, proto, dir); 5006#else 5007 { 5008 struct block *b; 5009 b = gen_portrange((int)v, (int)v, proto, dir); 5010 gen_or(gen_portrange6((int)v, (int)v, proto, dir), b); 5011 return b; 5012 } 5013#endif /* INET6 */ 5014 |
5015 case Q_GATEWAY: 5016 bpf_error("'gateway' requires a name"); 5017 /* NOTREACHED */ 5018 5019 case Q_PROTO: 5020 return gen_proto((int)v, proto, dir); 5021 5022 case Q_PROTOCHAIN: --- 78 unchanged lines hidden (view full) --- 5101 5102 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 5103 if (linktype == DLT_EN10MB) 5104 return gen_ehostop(eaddr, (int)q.dir); 5105 if (linktype == DLT_FDDI) 5106 return gen_fhostop(eaddr, (int)q.dir); 5107 if (linktype == DLT_IEEE802) 5108 return gen_thostop(eaddr, (int)q.dir); |
5109 if (linktype == DLT_IEEE802_11 || 5110 linktype == DLT_IEEE802_11_RADIO_AVS || 5111 linktype == DLT_IEEE802_11_RADIO || 5112 linktype == DLT_PRISM_HEADER) |
5113 return gen_wlanhostop(eaddr, (int)q.dir); 5114 if (linktype == DLT_SUNATM && is_lane) { 5115 /* 5116 * Check that the packet doesn't begin with an 5117 * LE Control marker. (We've already generated 5118 * a test for LANE.) 5119 */ |
5120 tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 5121 0xFF00); |
5122 gen_not(tmp); 5123 5124 /* 5125 * Now check the MAC address. 5126 */ 5127 b = gen_ehostop(eaddr, (int)q.dir); 5128 gen_and(tmp, b); 5129 return b; --- 36 unchanged lines hidden (view full) --- 5166{ 5167 struct slist *s; 5168 5169 s = new_stmt(BPF_LD|BPF_MEM); 5170 s->s.k = a->regno; 5171 return s; 5172} 5173 |
5174/* 5175 * Modify "index" to use the value stored into its register as an 5176 * offset relative to the beginning of the header for the protocol 5177 * "proto", and allocate a register and put an item "size" bytes long 5178 * (1, 2, or 4) at that offset into that register, making it the register 5179 * for "index". 5180 */ |
5181struct arth * 5182gen_load(proto, index, size) 5183 int proto; 5184 struct arth *index; 5185 int size; 5186{ 5187 struct slist *s, *tmp; 5188 struct block *b; --- 16 unchanged lines hidden (view full) --- 5205 case 4: 5206 size = BPF_W; 5207 break; 5208 } 5209 switch (proto) { 5210 default: 5211 bpf_error("unsupported index operation"); 5212 |
5213 case Q_RADIO: 5214 /* 5215 * The offset is relative to the beginning of the packet 5216 * data, if we have a radio header. (If we don't, this 5217 * is an error.) 5218 */ 5219 if (linktype != DLT_IEEE802_11_RADIO_AVS && 5220 linktype != DLT_IEEE802_11_RADIO && 5221 linktype != DLT_PRISM_HEADER) 5222 bpf_error("radio information not present in capture"); 5223 5224 /* 5225 * Load into the X register the offset computed into the 5226 * register specifed by "index". 5227 */ 5228 s = xfer_to_x(index); 5229 5230 /* 5231 * Load the item at that offset. 5232 */ 5233 tmp = new_stmt(BPF_LD|BPF_IND|size); 5234 sappend(s, tmp); 5235 sappend(index->s, s); 5236 break; 5237 |
5238 case Q_LINK: 5239 /* |
5240 * The offset is relative to the beginning of 5241 * the link-layer header. 5242 * |
5243 * XXX - what about ATM LANE? Should the index be 5244 * relative to the beginning of the AAL5 frame, so 5245 * that 0 refers to the beginning of the LE Control 5246 * field, or relative to the beginning of the LAN 5247 * frame, so that 0 refers, for Ethernet LANE, to 5248 * the beginning of the destination address? 5249 */ |
5250 s = gen_llprefixlen(); 5251 5252 /* 5253 * If "s" is non-null, it has code to arrange that the 5254 * X register contains the length of the prefix preceding 5255 * the link-layer header. Add to it the offset computed 5256 * into the register specified by "index", and move that 5257 * into the X register. Otherwise, just load into the X 5258 * register the offset computed into the register specifed 5259 * by "index". 5260 */ 5261 if (s != NULL) { 5262 sappend(s, xfer_to_a(index)); 5263 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 5264 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 5265 } else 5266 s = xfer_to_x(index); 5267 5268 /* 5269 * Load the item at the sum of the offset we've put in the 5270 * X register and the offset of the start of the link 5271 * layer header (which is 0 if the radio header is 5272 * variable-length; that header length is what we put 5273 * into the X register and then added to the index). 5274 */ |
5275 tmp = new_stmt(BPF_LD|BPF_IND|size); |
5276 tmp->s.k = off_ll; |
5277 sappend(s, tmp); 5278 sappend(index->s, s); 5279 break; 5280 5281 case Q_IP: 5282 case Q_ARP: 5283 case Q_RARP: 5284 case Q_ATALK: 5285 case Q_DECNET: 5286 case Q_SCA: 5287 case Q_LAT: 5288 case Q_MOPRC: 5289 case Q_MOPDL: 5290#ifdef INET6 5291 case Q_IPV6: 5292#endif |
5293 /* 5294 * The offset is relative to the beginning of 5295 * the network-layer header. 5296 * XXX - are there any cases where we want 5297 * off_nl_nosnap? 5298 */ 5299 s = gen_llprefixlen(); 5300 5301 /* 5302 * If "s" is non-null, it has code to arrange that the 5303 * X register contains the length of the prefix preceding 5304 * the link-layer header. Add to it the offset computed 5305 * into the register specified by "index", and move that 5306 * into the X register. Otherwise, just load into the X 5307 * register the offset computed into the register specifed 5308 * by "index". 5309 */ 5310 if (s != NULL) { 5311 sappend(s, xfer_to_a(index)); 5312 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 5313 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 5314 } else 5315 s = xfer_to_x(index); 5316 5317 /* 5318 * Load the item at the sum of the offset we've put in the 5319 * X register and the offset of the start of the network 5320 * layer header. 5321 */ |
5322 tmp = new_stmt(BPF_LD|BPF_IND|size); 5323 tmp->s.k = off_nl; 5324 sappend(s, tmp); 5325 sappend(index->s, s); 5326 |
5327 /* 5328 * Do the computation only if the packet contains 5329 * the protocol in question. 5330 */ |
5331 b = gen_proto_abbrev(proto); 5332 if (index->b) 5333 gen_and(index->b, b); 5334 index->b = b; 5335 break; 5336 5337 case Q_SCTP: 5338 case Q_TCP: 5339 case Q_UDP: 5340 case Q_ICMP: 5341 case Q_IGMP: 5342 case Q_IGRP: 5343 case Q_PIM: 5344 case Q_VRRP: |
5345 /* 5346 * The offset is relative to the beginning of 5347 * the transport-layer header. 5348 * XXX - are there any cases where we want 5349 * off_nl_nosnap? 5350 * XXX - we should, if we're built with 5351 * IPv6 support, generate code to load either 5352 * IPv4, IPv6, or both, as appropriate. 5353 */ 5354 s = gen_loadx_iphdrlen(); 5355 5356 /* 5357 * The X register now contains the sum of the offset 5358 * of the beginning of the link-layer header and 5359 * the length of the network-layer header. Load 5360 * into the A register the offset relative to 5361 * the beginning of the transport layer header, 5362 * add the X register to that, move that to the 5363 * X register, and load with an offset from the 5364 * X register equal to the offset of the network 5365 * layer header relative to the beginning of 5366 * the link-layer header. 5367 */ |
5368 sappend(s, xfer_to_a(index)); 5369 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 5370 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 5371 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 5372 tmp->s.k = off_nl; 5373 sappend(index->s, s); 5374 |
5375 /* 5376 * Do the computation only if the packet contains 5377 * the protocol in question - which is true only 5378 * if this is an IP datagram and is the first or 5379 * only fragment of that datagram. 5380 */ |
5381 gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); 5382 if (index->b) 5383 gen_and(index->b, b); 5384#ifdef INET6 5385 gen_and(gen_proto_abbrev(Q_IP), b); 5386#endif 5387 index->b = b; 5388 break; --- 209 unchanged lines hidden (view full) --- 5598 struct block *b; 5599 5600 b = gen_len(BPF_JGT, n); 5601 gen_not(b); 5602 5603 return b; 5604} 5605 |
5606/* 5607 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to 5608 * the beginning of the link-layer header. 5609 * XXX - that means you can't test values in the radiotap header, but 5610 * as that header is difficult if not impossible to parse generally 5611 * without a loop, that might not be a severe problem. A new keyword 5612 * "radio" could be added for that, although what you'd really want 5613 * would be a way of testing particular radio header values, which 5614 * would generate code appropriate to the radio header in question. 5615 */ |
5616struct block * 5617gen_byteop(op, idx, val) 5618 int op, idx, val; 5619{ 5620 struct block *b; 5621 struct slist *s; 5622 5623 switch (op) { 5624 default: 5625 abort(); 5626 5627 case '=': |
5628 return gen_cmp(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val); |
5629 5630 case '<': |
5631 b = gen_cmp_lt(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val); |
5632 return b; 5633 5634 case '>': |
5635 b = gen_cmp_gt(OR_LINK, (u_int)idx, BPF_B, (bpf_int32)val); |
5636 return b; 5637 5638 case '|': 5639 s = new_stmt(BPF_ALU|BPF_OR|BPF_K); 5640 break; 5641 5642 case '&': 5643 s = new_stmt(BPF_ALU|BPF_AND|BPF_K); --- 24 unchanged lines hidden (view full) --- 5668 if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX) 5669 return gen_ahostop(abroadcast, Q_DST); 5670 if (linktype == DLT_EN10MB) 5671 return gen_ehostop(ebroadcast, Q_DST); 5672 if (linktype == DLT_FDDI) 5673 return gen_fhostop(ebroadcast, Q_DST); 5674 if (linktype == DLT_IEEE802) 5675 return gen_thostop(ebroadcast, Q_DST); |
5676 if (linktype == DLT_IEEE802_11 || 5677 linktype == DLT_IEEE802_11_RADIO_AVS || 5678 linktype == DLT_IEEE802_11_RADIO || 5679 linktype == DLT_PRISM_HEADER) |
5680 return gen_wlanhostop(ebroadcast, Q_DST); 5681 if (linktype == DLT_IP_OVER_FC) 5682 return gen_ipfchostop(ebroadcast, Q_DST); 5683 if (linktype == DLT_SUNATM && is_lane) { 5684 /* 5685 * Check that the packet doesn't begin with an 5686 * LE Control marker. (We've already generated 5687 * a test for LANE.) 5688 */ |
5689 b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 5690 0xFF00); |
5691 gen_not(b1); 5692 5693 /* 5694 * Now check the MAC address. 5695 */ 5696 b0 = gen_ehostop(ebroadcast, Q_DST); 5697 gen_and(b1, b0); 5698 return b0; 5699 } 5700 bpf_error("not a broadcast link"); 5701 break; 5702 5703 case Q_IP: 5704 b0 = gen_linktype(ETHERTYPE_IP); 5705 hostmask = ~netmask; |
5706 b1 = gen_mcmp(OR_NET, 16, BPF_W, (bpf_int32)0, hostmask); 5707 b2 = gen_mcmp(OR_NET, 16, BPF_W, |
5708 (bpf_int32)(~0 & hostmask), hostmask); 5709 gen_or(b1, b2); 5710 gen_and(b0, b2); 5711 return b2; 5712 } 5713 bpf_error("only link-layer/IP broadcast filters supported"); 5714 /* NOTREACHED */ 5715} --- 5 unchanged lines hidden (view full) --- 5721static struct block * 5722gen_mac_multicast(offset) 5723 int offset; 5724{ 5725 register struct block *b0; 5726 register struct slist *s; 5727 5728 /* link[offset] & 1 != 0 */ |
5729 s = gen_load_a(OR_LINK, offset, BPF_B); |
5730 b0 = new_block(JMP(BPF_JSET)); 5731 b0->s.k = 1; 5732 b0->stmts = s; 5733 return b0; 5734} 5735 5736struct block * 5737gen_multicast(proto) --- 25 unchanged lines hidden (view full) --- 5763 return gen_mac_multicast(1); 5764 } 5765 5766 if (linktype == DLT_IEEE802) { 5767 /* tr[2] & 1 != 0 */ 5768 return gen_mac_multicast(2); 5769 } 5770 |
5771 if (linktype == DLT_IEEE802_11 || 5772 linktype == DLT_IEEE802_11_RADIO_AVS || 5773 linktype == DLT_IEEE802_11_RADIO || 5774 linktype == DLT_PRISM_HEADER) { |
5775 /* 5776 * Oh, yuk. 5777 * 5778 * For control frames, there is no DA. 5779 * 5780 * For management frames, DA is at an 5781 * offset of 4 from the beginning of 5782 * the packet. --- 5 unchanged lines hidden (view full) --- 5788 * if To DS is set. 5789 */ 5790 5791 /* 5792 * Generate the tests to be done for data frames. 5793 * 5794 * First, check for To DS set, i.e. "link[1] & 0x01". 5795 */ |
5796 s = gen_load_a(OR_LINK, 1, BPF_B); |
5797 b1 = new_block(JMP(BPF_JSET)); 5798 b1->s.k = 0x01; /* To DS */ 5799 b1->stmts = s; 5800 5801 /* 5802 * If To DS is set, the DA is at 16. 5803 */ 5804 b0 = gen_mac_multicast(16); 5805 gen_and(b1, b0); 5806 5807 /* 5808 * Now, check for To DS not set, i.e. check 5809 * "!(link[1] & 0x01)". 5810 */ |
5811 s = gen_load_a(OR_LINK, 1, BPF_B); |
5812 b2 = new_block(JMP(BPF_JSET)); 5813 b2->s.k = 0x01; /* To DS */ 5814 b2->stmts = s; 5815 gen_not(b2); 5816 5817 /* 5818 * If To DS is not set, the DA is at 4. 5819 */ --- 5 unchanged lines hidden (view full) --- 5825 * the complete set of checks for data frames. 5826 */ 5827 gen_or(b1, b0); 5828 5829 /* 5830 * Now check for a data frame. 5831 * I.e, check "link[0] & 0x08". 5832 */ |
5833 s = gen_load_a(OR_LINK, 0, BPF_B); |
5834 b1 = new_block(JMP(BPF_JSET)); 5835 b1->s.k = 0x08; 5836 b1->stmts = s; 5837 5838 /* 5839 * AND that with the checks done for data frames. 5840 */ 5841 gen_and(b1, b0); 5842 5843 /* 5844 * If the high-order bit of the type value is 0, this 5845 * is a management frame. 5846 * I.e, check "!(link[0] & 0x08)". 5847 */ |
5848 s = gen_load_a(OR_LINK, 0, BPF_B); |
5849 b2 = new_block(JMP(BPF_JSET)); 5850 b2->s.k = 0x08; 5851 b2->stmts = s; 5852 gen_not(b2); 5853 5854 /* 5855 * For management frames, the DA is at 4. 5856 */ --- 10 unchanged lines hidden (view full) --- 5867 /* 5868 * If the low-order bit of the type value is 1, 5869 * this is either a control frame or a frame 5870 * with a reserved type, and thus not a 5871 * frame with an SA. 5872 * 5873 * I.e., check "!(link[0] & 0x04)". 5874 */ |
5875 s = gen_load_a(OR_LINK, 0, BPF_B); |
5876 b1 = new_block(JMP(BPF_JSET)); 5877 b1->s.k = 0x04; 5878 b1->stmts = s; 5879 gen_not(b1); 5880 5881 /* 5882 * AND that with the checks for data and management 5883 * frames. --- 8 unchanged lines hidden (view full) --- 5892 } 5893 5894 if (linktype == DLT_SUNATM && is_lane) { 5895 /* 5896 * Check that the packet doesn't begin with an 5897 * LE Control marker. (We've already generated 5898 * a test for LANE.) 5899 */ |
5900 b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H, 5901 0xFF00); |
5902 gen_not(b1); 5903 5904 /* ether[off_mac] & 1 != 0 */ 5905 b0 = gen_mac_multicast(off_mac); 5906 gen_and(b1, b0); 5907 return b0; 5908 } 5909 5910 /* Link not known to support multicasts */ 5911 break; 5912 5913 case Q_IP: 5914 b0 = gen_linktype(ETHERTYPE_IP); |
5915 b1 = gen_cmp_ge(OR_NET, 16, BPF_B, (bpf_int32)224); |
5916 gen_and(b0, b1); 5917 return b1; 5918 5919#ifdef INET6 5920 case Q_IPV6: 5921 b0 = gen_linktype(ETHERTYPE_IPV6); |
5922 b1 = gen_cmp(OR_NET, 24, BPF_B, (bpf_int32)255); |
5923 gen_and(b0, b1); 5924 return b1; 5925#endif /* INET6 */ 5926 } 5927 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel"); 5928 /* NOTREACHED */ 5929} 5930 --- 19 unchanged lines hidden (view full) --- 5950 dir); 5951 break; 5952 5953 case DLT_LINUX_SLL: 5954 if (dir) { 5955 /* 5956 * Match packets sent by this machine. 5957 */ |
5958 b0 = gen_cmp(OR_LINK, 0, BPF_H, LINUX_SLL_OUTGOING); |
5959 } else { 5960 /* 5961 * Match packets sent to this machine. 5962 * (No broadcast or multicast packets, or 5963 * packets sent to some other machine and 5964 * received promiscuously.) 5965 * 5966 * XXX - packets sent to other machines probably 5967 * shouldn't be matched, but what about broadcast 5968 * or multicast packets we received? 5969 */ |
5970 b0 = gen_cmp(OR_LINK, 0, BPF_H, LINUX_SLL_HOST); |
5971 } 5972 break; 5973 5974 case DLT_PFLOG: |
5975 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, dir), BPF_B, |
5976 (bpf_int32)((dir == 0) ? PF_IN : PF_OUT)); 5977 break; 5978 5979 case DLT_PPP_PPPD: 5980 if (dir) { 5981 /* match outgoing packets */ |
5982 b0 = gen_cmp(OR_LINK, 0, BPF_B, PPP_PPPD_OUT); |
5983 } else { 5984 /* match incoming packets */ |
5985 b0 = gen_cmp(OR_LINK, 0, BPF_B, PPP_PPPD_IN); |
5986 } 5987 break; 5988 5989 case DLT_JUNIPER_MLFR: 5990 case DLT_JUNIPER_MLPPP: 5991 case DLT_JUNIPER_ATM1: 5992 case DLT_JUNIPER_ATM2: |
5993 case DLT_JUNIPER_PPPOE: 5994 case DLT_JUNIPER_PPPOE_ATM: 5995 case DLT_JUNIPER_GGSN: 5996 case DLT_JUNIPER_ES: 5997 case DLT_JUNIPER_MONITOR: 5998 case DLT_JUNIPER_SERVICES: |
5999 /* juniper flags (including direction) are stored 6000 * the byte after the 3-byte magic number */ 6001 if (dir) { 6002 /* match outgoing packets */ |
6003 b0 = gen_mcmp(OR_LINK, 3, BPF_B, 0, 0x01); |
6004 } else { 6005 /* match incoming packets */ |
6006 b0 = gen_mcmp(OR_LINK, 3, BPF_B, 1, 0x01); |
6007 } 6008 break; 6009 6010 default: 6011 bpf_error("inbound/outbound not supported on linktype %d", 6012 linktype); 6013 b0 = NULL; 6014 /* NOTREACHED */ --- 15 unchanged lines hidden (view full) --- 6030 bpf_error("ifname not supported on linktype 0x%x", linktype); 6031 /* NOTREACHED */ 6032 } 6033 if (strlen(ifname) >= len) { 6034 bpf_error("ifname interface names can only be %d characters", 6035 len-1); 6036 /* NOTREACHED */ 6037 } |
6038 b0 = gen_bcmp(OR_LINK, off, strlen(ifname), (const u_char *)ifname); |
6039 return (b0); 6040} 6041 6042/* PF firewall log matched interface */ 6043struct block * 6044gen_pf_ruleset(char *ruleset) 6045{ 6046 struct block *b0; 6047 6048 if (linktype != DLT_PFLOG) { 6049 bpf_error("ruleset not supported on linktype 0x%x", linktype); 6050 /* NOTREACHED */ 6051 } 6052 if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) { 6053 bpf_error("ruleset names can only be %ld characters", 6054 (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1)); 6055 /* NOTREACHED */ 6056 } |
6057 b0 = gen_bcmp(OR_LINK, offsetof(struct pfloghdr, ruleset), |
6058 strlen(ruleset), (const u_char *)ruleset); 6059 return (b0); 6060} 6061 6062/* PF firewall log rule number */ 6063struct block * 6064gen_pf_rnr(int rnr) 6065{ 6066 struct block *b0; 6067 6068 if (linktype == DLT_PFLOG) { |
6069 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, rulenr), BPF_W, |
6070 (bpf_int32)rnr); 6071 } else { 6072 bpf_error("rnr not supported on linktype 0x%x", linktype); 6073 /* NOTREACHED */ 6074 } 6075 6076 return (b0); 6077} --- 4 unchanged lines hidden (view full) --- 6082{ 6083 struct block *b0; 6084 6085 if (linktype != DLT_PFLOG) { 6086 bpf_error("srnr not supported on linktype 0x%x", linktype); 6087 /* NOTREACHED */ 6088 } 6089 |
6090 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, subrulenr), BPF_W, |
6091 (bpf_int32)srnr); 6092 return (b0); 6093} 6094 6095/* PF firewall log reason code */ 6096struct block * 6097gen_pf_reason(int reason) 6098{ 6099 struct block *b0; 6100 6101 if (linktype == DLT_PFLOG) { |
6102 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, reason), BPF_B, |
6103 (bpf_int32)reason); 6104 } else { 6105 bpf_error("reason not supported on linktype 0x%x", linktype); 6106 /* NOTREACHED */ 6107 } 6108 6109 return (b0); 6110} 6111 6112/* PF firewall log action */ 6113struct block * 6114gen_pf_action(int action) 6115{ 6116 struct block *b0; 6117 6118 if (linktype == DLT_PFLOG) { |
6119 b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, action), BPF_B, |
6120 (bpf_int32)action); 6121 } else { 6122 bpf_error("action not supported on linktype 0x%x", linktype); 6123 /* NOTREACHED */ 6124 } 6125 6126 return (b0); 6127} --- 16 unchanged lines hidden (view full) --- 6144 register const u_char *eaddr; 6145 register int dir; 6146{ 6147 register struct block *b0, *b1; 6148 6149 switch (dir) { 6150 /* src comes first, different from Ethernet */ 6151 case Q_SRC: |
6152 return gen_bcmp(OR_LINK, 0, 1, eaddr); |
6153 6154 case Q_DST: |
6155 return gen_bcmp(OR_LINK, 1, 1, eaddr); |
6156 6157 case Q_AND: 6158 b0 = gen_ahostop(eaddr, Q_SRC); 6159 b1 = gen_ahostop(eaddr, Q_DST); 6160 gen_and(b0, b1); 6161 return b1; 6162 6163 case Q_DEFAULT: --- 13 unchanged lines hidden (view full) --- 6177struct block * 6178gen_vlan(vlan_num) 6179 int vlan_num; 6180{ 6181 struct block *b0; 6182 6183 /* 6184 * Change the offsets to point to the type and data fields within |
6185 * the VLAN packet. Just increment the offsets, so that we 6186 * can support a hierarchy, e.g. "vlan 300 && vlan 200" to 6187 * capture VLAN 200 encapsulated within VLAN 100. 6188 * 6189 * XXX - this is a bit of a kludge. If we were to split the 6190 * compiler into a parser that parses an expression and 6191 * generates an expression tree, and a code generator that 6192 * takes an expression tree (which could come from our 6193 * parser or from some other parser) and generates BPF code, 6194 * we could perhaps make the offsets parameters of routines 6195 * and, in the handler for an "AND" node, pass to subnodes 6196 * other than the VLAN node the adjusted offsets. 6197 * 6198 * This would mean that "vlan" would, instead of changing the 6199 * behavior of *all* tests after it, change only the behavior 6200 * of tests ANDed with it. That would change the documented 6201 * semantics of "vlan", which might break some expressions. 6202 * However, it would mean that "(vlan and ip) or ip" would check 6203 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than 6204 * checking only for VLAN-encapsulated IP, so that could still 6205 * be considered worth doing; it wouldn't break expressions 6206 * that are of the form "vlan and ..." or "vlan N and ...", 6207 * which I suspect are the most common expressions involving 6208 * "vlan". "vlan or ..." doesn't necessarily do what the user 6209 * would really want, now, as all the "or ..." tests would 6210 * be done assuming a VLAN, even though the "or" could be viewed 6211 * as meaning "or, if this isn't a VLAN packet...". |
6212 */ |
6213 orig_linktype = off_linktype; /* save original values */ 6214 orig_nl = off_nl; |
6215 |
6216 switch (linktype) { |
6217 |
6218 case DLT_EN10MB: 6219 off_linktype += 4; 6220 off_nl_nosnap += 4; 6221 off_nl += 4; 6222 break; |
6223 |
6224 default: 6225 bpf_error("no VLAN support for data link type %d", 6226 linktype); 6227 /*NOTREACHED*/ 6228 } |
6229 6230 /* check for VLAN */ |
6231 b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q); |
6232 6233 /* If a specific VLAN is requested, check VLAN id */ 6234 if (vlan_num >= 0) { 6235 struct block *b1; 6236 |
6237 b1 = gen_mcmp(OR_LINK, orig_nl, BPF_H, (bpf_int32)vlan_num, 6238 0x0fff); |
6239 gen_and(b0, b1); 6240 b0 = b1; 6241 } 6242 6243 return (b0); 6244} 6245 6246/* 6247 * support for MPLS 6248 */ 6249struct block * 6250gen_mpls(label_num) 6251 int label_num; 6252{ 6253 struct block *b0; 6254 6255 /* 6256 * Change the offsets to point to the type and data fields within |
6257 * the MPLS packet. Just increment the offsets, so that we 6258 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to 6259 * capture packets with an outer label of 100000 and an inner 6260 * label of 1024. 6261 * 6262 * XXX - this is a bit of a kludge. See comments in gen_vlan(). |
6263 */ |
6264 orig_linktype = off_linktype; /* save original values */ 6265 orig_nl = off_nl; |
6266 |
6267 switch (linktype) { 6268 6269 case DLT_C_HDLC: /* fall through */ 6270 case DLT_EN10MB: 6271 off_nl_nosnap += 4; 6272 off_nl += 4; 6273 6274 b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H, 6275 (bpf_int32)ETHERTYPE_MPLS); 6276 break; |
6277 |
6278 case DLT_PPP: 6279 off_nl_nosnap += 4; 6280 off_nl += 4; |
6281 |
6282 b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H, 6283 (bpf_int32)PPP_MPLS_UCAST); 6284 break; |
6285 |
6286 /* FIXME add other DLT_s ... 6287 * for Frame-Relay/and ATM this may get messy due to SNAP headers 6288 * leave it for now */ |
6289 |
6290 default: 6291 bpf_error("no MPLS support for data link type %d", 6292 linktype); 6293 b0 = NULL; 6294 /*NOTREACHED*/ 6295 break; 6296 } |
6297 |
6298 /* If a specific MPLS label is requested, check it */ 6299 if (label_num >= 0) { 6300 struct block *b1; 6301 6302 label_num = label_num << 12; /* label is shifted 12 bits on the wire */ |
6303 b1 = gen_mcmp(OR_LINK, orig_nl, BPF_W, (bpf_int32)label_num, 6304 0xfffff000); /* only compare the first 20 bits */ |
6305 gen_and(b0, b1); 6306 b0 = b1; 6307 } 6308 6309 return (b0); 6310} 6311 6312struct block * 6313gen_atmfield_code(atmfield, jvalue, jtype, reverse) 6314 int atmfield; |
6315 bpf_int32 jvalue; |
6316 bpf_u_int32 jtype; 6317 int reverse; 6318{ 6319 struct block *b0; 6320 6321 switch (atmfield) { 6322 6323 case A_VPI: 6324 if (!is_atm) 6325 bpf_error("'vpi' supported only on raw ATM"); 6326 if (off_vpi == (u_int)-1) 6327 abort(); |
6328 b0 = gen_ncmp(OR_LINK, off_vpi, BPF_B, 0xffffffff, jtype, 6329 reverse, jvalue); |
6330 break; 6331 6332 case A_VCI: 6333 if (!is_atm) 6334 bpf_error("'vci' supported only on raw ATM"); 6335 if (off_vci == (u_int)-1) 6336 abort(); |
6337 b0 = gen_ncmp(OR_LINK, off_vci, BPF_H, 0xffffffff, jtype, 6338 reverse, jvalue); |
6339 break; 6340 6341 case A_PROTOTYPE: 6342 if (off_proto == (u_int)-1) 6343 abort(); /* XXX - this isn't on FreeBSD */ |
6344 b0 = gen_ncmp(OR_LINK, off_proto, BPF_B, 0x0f, jtype, 6345 reverse, jvalue); |
6346 break; 6347 6348 case A_MSGTYPE: 6349 if (off_payload == (u_int)-1) 6350 abort(); |
6351 b0 = gen_ncmp(OR_LINK, off_payload + MSG_TYPE_POS, BPF_B, 6352 0xffffffff, jtype, reverse, jvalue); |
6353 break; 6354 6355 case A_CALLREFTYPE: 6356 if (!is_atm) 6357 bpf_error("'callref' supported only on raw ATM"); 6358 if (off_proto == (u_int)-1) 6359 abort(); |
6360 b0 = gen_ncmp(OR_LINK, off_proto, BPF_B, 0xffffffff, 6361 jtype, reverse, jvalue); |
6362 break; 6363 6364 default: 6365 abort(); 6366 } 6367 return b0; 6368} 6369 --- 93 unchanged lines hidden (view full) --- 6463 break; 6464 6465 default: 6466 abort(); 6467 } 6468 return b1; 6469} 6470 |
6471struct block * 6472gen_mtp3field_code(mtp3field, jvalue, jtype, reverse) 6473 int mtp3field; 6474 bpf_u_int32 jvalue; 6475 bpf_u_int32 jtype; 6476 int reverse; 6477{ 6478 struct block *b0; 6479 bpf_u_int32 val1 , val2 , val3; |
6480 |
6481 switch (mtp3field) { 6482 6483 case M_SIO: 6484 if (off_sio == (u_int)-1) 6485 bpf_error("'sio' supported only on SS7"); 6486 /* sio coded on 1 byte so max value 255 */ 6487 if(jvalue > 255) 6488 bpf_error("sio value %u too big; max value = 255", 6489 jvalue); 6490 b0 = gen_ncmp(OR_PACKET, off_sio, BPF_B, 0xffffffff, 6491 (u_int)jtype, reverse, (u_int)jvalue); 6492 break; 6493 6494 case M_OPC: 6495 if (off_opc == (u_int)-1) 6496 bpf_error("'opc' supported only on SS7"); 6497 /* opc coded on 14 bits so max value 16383 */ 6498 if (jvalue > 16383) 6499 bpf_error("opc value %u too big; max value = 16383", 6500 jvalue); 6501 /* the following instructions are made to convert jvalue 6502 * to the form used to write opc in an ss7 message*/ 6503 val1 = jvalue & 0x00003c00; 6504 val1 = val1 >>10; 6505 val2 = jvalue & 0x000003fc; 6506 val2 = val2 <<6; 6507 val3 = jvalue & 0x00000003; 6508 val3 = val3 <<22; 6509 jvalue = val1 + val2 + val3; 6510 b0 = gen_ncmp(OR_PACKET, off_opc, BPF_W, 0x00c0ff0f, 6511 (u_int)jtype, reverse, (u_int)jvalue); 6512 break; 6513 6514 case M_DPC: 6515 if (off_dpc == (u_int)-1) 6516 bpf_error("'dpc' supported only on SS7"); 6517 /* dpc coded on 14 bits so max value 16383 */ 6518 if (jvalue > 16383) 6519 bpf_error("dpc value %u too big; max value = 16383", 6520 jvalue); 6521 /* the following instructions are made to convert jvalue 6522 * to the forme used to write dpc in an ss7 message*/ 6523 val1 = jvalue & 0x000000ff; 6524 val1 = val1 << 24; 6525 val2 = jvalue & 0x00003f00; 6526 val2 = val2 << 8; 6527 jvalue = val1 + val2; 6528 b0 = gen_ncmp(OR_PACKET, off_dpc, BPF_W, 0xff3f0000, 6529 (u_int)jtype, reverse, (u_int)jvalue); 6530 break; 6531 6532 case M_SLS: 6533 if (off_sls == (u_int)-1) 6534 bpf_error("'sls' supported only on SS7"); 6535 /* sls coded on 4 bits so max value 15 */ 6536 if (jvalue > 15) 6537 bpf_error("sls value %u too big; max value = 15", 6538 jvalue); 6539 /* the following instruction is made to convert jvalue 6540 * to the forme used to write sls in an ss7 message*/ 6541 jvalue = jvalue << 4; 6542 b0 = gen_ncmp(OR_PACKET, off_sls, BPF_B, 0xf0, 6543 (u_int)jtype,reverse, (u_int)jvalue); 6544 break; 6545 6546 default: 6547 abort(); 6548 } 6549 return b0; 6550} 6551 |
6552static struct block * 6553gen_msg_abbrev(type) 6554 int type; 6555{ 6556 struct block *b1; 6557 6558 /* 6559 * Q.2931 signalling protocol messages for handling virtual circuits --- 102 unchanged lines hidden --- |