1/*#define CHASE_CHAIN*/ 2/* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) --- 5 unchanged lines hidden (view full) --- 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 * |
22 * $FreeBSD: head/contrib/libpcap/gencode.c 98533 2002-06-21 01:38:14Z fenner $ |
23 */ 24#ifndef lint 25static const char rcsid[] = |
26 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.160 2001/11/30 07:25:48 guy Exp $ (LBL)"; |
27#endif 28 29#ifdef HAVE_CONFIG_H 30#include "config.h" 31#endif 32 33#include <sys/types.h> 34#include <sys/socket.h> --- 13 unchanged lines hidden (view full) --- 48#include <memory.h> 49#include <setjmp.h> 50#include <stdarg.h> 51 52#include "pcap-int.h" 53 54#include "ethertype.h" 55#include "nlpid.h" |
56#include "llc.h" |
57#include "gencode.h" 58#include "ppp.h" 59#include "sll.h" |
60#include "arcnet.h" |
61#include <pcap-namedb.h> 62#ifdef INET6 63#include <netdb.h> 64#include <sys/socket.h> 65#endif /*INET6*/ 66 |
67#undef ETHERMTU 68#define ETHERMTU 1500 69 |
70#ifndef IPPROTO_SCTP 71#define IPPROTO_SCTP 132 72#endif 73 |
74#ifdef HAVE_OS_PROTO_H 75#include "os-proto.h" 76#endif 77 78#define JMP(c) ((c)|BPF_JMP|BPF_K) 79 80/* Locals */ 81static jmp_buf top_ctx; 82static pcap_t *bpf_pcap; 83 |
84/* Hack for updating VLAN offsets. */ 85static u_int orig_linktype = -1, orig_nl = -1; 86 |
87/* XXX */ 88#ifdef PCAP_FDDIPAD 89int pcap_fddipad = PCAP_FDDIPAD; 90#else 91int pcap_fddipad; 92#endif 93 94/* VARARGS */ --- 52 unchanged lines hidden (view full) --- 147static inline struct block *gen_true(void); 148static inline struct block *gen_false(void); 149static struct block *gen_linktype(int); 150static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int); 151static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); 152#ifdef INET6 153static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int); 154#endif |
155static struct block *gen_ahostop(const u_char *, int); |
156static struct block *gen_ehostop(const u_char *, int); 157static struct block *gen_fhostop(const u_char *, int); 158static struct block *gen_thostop(const u_char *, int); 159static struct block *gen_dnhostop(bpf_u_int32, int, u_int); 160static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); 161#ifdef INET6 162static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int); 163#endif --- 388 unchanged lines hidden (view full) --- 552static int linktype; 553 554static void 555init_linktype(type) 556 int type; 557{ 558 linktype = type; 559 |
560 orig_linktype = -1; 561 orig_nl = -1; 562 |
563 switch (type) { 564 |
565 case DLT_ARCNET: 566 off_linktype = 2; 567 off_nl = 6; /* XXX in reality, variable! */ 568 return; 569 |
570 case DLT_EN10MB: 571 off_linktype = 12; 572 off_nl = 14; 573 return; 574 575 case DLT_SLIP: 576 /* 577 * SLIP doesn't have a link level type. The 16 byte --- 12 unchanged lines hidden (view full) --- 590 591 case DLT_NULL: 592 case DLT_LOOP: 593 off_linktype = 0; 594 off_nl = 4; 595 return; 596 597 case DLT_PPP: |
598 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 599 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */ |
600 off_linktype = 2; 601 off_nl = 4; 602 return; 603 |
604 case DLT_PPP_ETHER: 605 /* 606 * This does no include the Ethernet header, and 607 * only covers session state. 608 */ 609 off_linktype = 6; 610 off_nl = 8; 611 return; 612 |
613 case DLT_PPP_BSDOS: 614 off_linktype = 5; 615 off_nl = 24; 616 return; 617 618 case DLT_FDDI: 619 /* 620 * FDDI doesn't really have a link-level type field. |
621 * We set "off_linktype" to the offset of the LLC header. |
622 * |
623 * To check for Ethernet types, we assume that SSAP = SNAP 624 * is being used and pick out the encapsulated Ethernet type. |
625 * XXX - should we generate code to check for SNAP? 626 */ |
627 off_linktype = 13; |
628#ifdef PCAP_FDDIPAD 629 off_linktype += pcap_fddipad; 630#endif 631 off_nl = 21; 632#ifdef PCAP_FDDIPAD 633 off_nl += pcap_fddipad; 634#endif 635 return; 636 637 case DLT_IEEE802: 638 /* 639 * Token Ring doesn't really have a link-level type field. |
640 * We set "off_linktype" to the offset of the LLC header. |
641 * |
642 * To check for Ethernet types, we assume that SSAP = SNAP 643 * is being used and pick out the encapsulated Ethernet type. |
644 * XXX - should we generate code to check for SNAP? 645 * 646 * XXX - the header is actually variable-length. 647 * Some various Linux patched versions gave 38 648 * as "off_linktype" and 40 as "off_nl"; however, 649 * if a token ring packet has *no* routing 650 * information, i.e. is not source-routed, the correct 651 * values are 20 and 22, as they are in the vanilla code. 652 * 653 * A packet is source-routed iff the uppermost bit 654 * of the first byte of the source address, at an 655 * offset of 8, has the uppermost bit set. If the 656 * packet is source-routed, the total number of bytes 657 * of routing information is 2 plus bits 0x1F00 of 658 * the 16-bit value at an offset of 14 (shifted right 659 * 8 - figure out which byte that is). 660 */ |
661 off_linktype = 14; |
662 off_nl = 22; 663 return; 664 |
665 case DLT_IEEE802_11: 666 /* 667 * 802.11 doesn't really have a link-level type field. 668 * We set "off_linktype" to the offset of the LLC header. 669 * 670 * To check for Ethernet types, we assume that SSAP = SNAP 671 * is being used and pick out the encapsulated Ethernet type. 672 * XXX - should we generate code to check for SNAP? 673 * 674 * XXX - the header is actually variable-length. We 675 * assume a 24-byte link-layer header, as appears in 676 * data frames in networks with no bridges. 677 */ 678 off_linktype = 24; 679 off_nl = 30; 680 return; 681 682 case DLT_PRISM_HEADER: 683 /* 684 * Same as 802.11, but with an additional header before 685 * the 802.11 header, containing a bunch of additional 686 * information including radio-level information. 687 * 688 * The header is 144 bytes long. 689 * 690 * XXX - same variable-length header problem; at least 691 * the Prism header is fixed-length. 692 */ 693 off_linktype = 144+24; 694 off_nl = 144+30; 695 return; 696 |
697 case DLT_ATM_RFC1483: 698 /* 699 * assume routed, non-ISO PDUs 700 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 701 */ 702 off_linktype = 6; 703 off_nl = 8; 704 return; --- 7 unchanged lines hidden (view full) --- 712 off_linktype = 6; 713 off_nl = 8; 714 return; 715 716 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 717 off_linktype = 14; 718 off_nl = 16; 719 return; |
720 721 case DLT_LTALK: 722 /* 723 * LocalTalk does have a 1-byte type field in the LLAP header, 724 * but really it just indicates whether there is a "short" or 725 * "long" DDP packet following. 726 */ 727 off_linktype = -1; 728 off_nl = 0; 729 return; |
730 } 731 bpf_error("unknown data link type %d", linktype); 732 /* NOTREACHED */ 733} 734 735static struct block * 736gen_uncond(rsense) 737 int rsense; --- 30 unchanged lines hidden (view full) --- 768((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 769 770static struct block * 771gen_linktype(proto) 772 register int proto; 773{ 774 struct block *b0, *b1; 775 |
776 switch (linktype) { 777 778 case DLT_EN10MB: |
779 switch (proto) { 780 |
781 case LLCSAP_ISONS: |
782 /* 783 * OSI protocols always use 802.2 encapsulation. |
784 * XXX - should we check both the DSAP and the 785 * SSAP, like this, or should we check just the 786 * DSAP? |
787 */ 788 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 789 gen_not(b0); 790 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) |
791 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); |
792 gen_and(b0, b1); 793 return b1; 794 |
795 case LLCSAP_NETBEUI: 796 /* 797 * NetBEUI always uses 802.2 encapsulation. 798 * XXX - should we check both the DSAP and the 799 * SSAP, like this, or should we check just the 800 * DSAP? 801 */ 802 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 803 gen_not(b0); 804 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 805 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 806 gen_and(b0, b1); 807 return b1; 808 809 case LLCSAP_IPX: 810 /* 811 * Check for; 812 * 813 * Ethernet_II frames, which are Ethernet 814 * frames with a frame type of ETHERTYPE_IPX; 815 * 816 * Ethernet_802.3 frames, which are 802.3 817 * frames (i.e., the type/length field is 818 * a length field, <= ETHERMTU, rather than 819 * a type field) with the first two bytes 820 * after the Ethernet/802.3 header being 821 * 0xFFFF; 822 * 823 * Ethernet_802.2 frames, which are 802.3 824 * frames with an 802.2 LLC header and 825 * with the IPX LSAP as the DSAP in the LLC 826 * header; 827 * 828 * Ethernet_SNAP frames, which are 802.3 829 * frames with an LLC header and a SNAP 830 * header and with an OUI of 0x000000 831 * (encapsulated Ethernet) and a protocol 832 * ID of ETHERTYPE_IPX in the SNAP header. 833 * 834 * XXX - should we generate the same code both 835 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 836 */ 837 838 /* 839 * This generates code to check both for the 840 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 841 */ 842 b0 = gen_cmp(off_linktype + 2, BPF_B, 843 (bpf_int32)LLCSAP_IPX); 844 b1 = gen_cmp(off_linktype + 2, BPF_H, 845 (bpf_int32)0xFFFF); 846 gen_or(b0, b1); 847 848 /* 849 * Now we add code to check for SNAP frames with 850 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 851 */ 852 b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14); 853 gen_or(b0, b1); 854 855 /* 856 * Now we generate code to check for 802.3 857 * frames in general. 858 */ 859 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 860 gen_not(b0); 861 862 /* 863 * Now add the check for 802.3 frames before the 864 * check for Ethernet_802.2 and Ethernet_802.3, 865 * as those checks should only be done on 802.3 866 * frames, not on Ethernet frames. 867 */ 868 gen_and(b0, b1); 869 870 /* 871 * Now add the check for Ethernet_II frames, and 872 * do that before checking for the other frame 873 * types. 874 */ 875 b0 = gen_cmp(off_linktype, BPF_H, 876 (bpf_int32)ETHERTYPE_IPX); 877 gen_or(b0, b1); 878 return b1; 879 |
880 case ETHERTYPE_ATALK: 881 case ETHERTYPE_AARP: 882 /* 883 * EtherTalk (AppleTalk protocols on Ethernet link 884 * layer) may use 802.2 encapsulation. 885 */ 886 887 /* --- 25 unchanged lines hidden (view full) --- 913 * Check for Ethernet encapsulation (Ethertalk 914 * phase 1?); we just check for the Ethernet 915 * protocol type. 916 */ 917 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 918 919 gen_or(b0, b1); 920 return b1; |
921 922 default: 923 if (proto <= ETHERMTU) { 924 /* 925 * This is an LLC SAP value, so the frames 926 * that match would be 802.2 frames. 927 * Check that the frame is an 802.2 frame 928 * (i.e., that the length/type field is 929 * a length field, <= ETHERMTU) and 930 * then check the DSAP. 931 */ 932 b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU); 933 gen_not(b0); 934 b1 = gen_cmp(off_linktype + 2, BPF_B, 935 (bpf_int32)proto); 936 gen_and(b0, b1); 937 return b1; 938 } else { 939 /* 940 * This is an Ethernet type, so compare 941 * the length/type field with it (if 942 * the frame is an 802.2 frame, the length 943 * field will be <= ETHERMTU, and, as 944 * "proto" is > ETHERMTU, this test 945 * will fail and the frame won't match, 946 * which is what we want). 947 */ 948 return gen_cmp(off_linktype, BPF_H, 949 (bpf_int32)proto); 950 } |
951 } 952 break; 953 |
954 case DLT_IEEE802_11: 955 case DLT_PRISM_HEADER: 956 case DLT_FDDI: 957 case DLT_IEEE802: 958 case DLT_ATM_RFC1483: 959 case DLT_ATM_CLIP: 960 /* 961 * XXX - handle token-ring variable-length header. 962 */ 963 switch (proto) { 964 965 case LLCSAP_ISONS: 966 return gen_cmp(off_linktype, BPF_H, (long) 967 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 968 969 case LLCSAP_NETBEUI: 970 return gen_cmp(off_linktype, BPF_H, (long) 971 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 972 973 case LLCSAP_IPX: 974 /* 975 * XXX - are there ever SNAP frames for IPX on 976 * non-Ethernet 802.x networks? 977 */ 978 return gen_cmp(off_linktype, BPF_B, 979 (bpf_int32)LLCSAP_IPX); 980 981 case ETHERTYPE_ATALK: 982 /* 983 * 802.2-encapsulated ETHERTYPE_ATALK packets are 984 * SNAP packets with an organization code of 985 * 0x080007 (Apple, for Appletalk) and a protocol 986 * type of ETHERTYPE_ATALK (Appletalk). 987 * 988 * XXX - check for an organization code of 989 * encapsulated Ethernet as well? 990 */ 991 return gen_snap(0x080007, ETHERTYPE_ATALK, 992 off_linktype); 993 break; 994 995 default: 996 /* 997 * XXX - we don't have to check for IPX 802.3 998 * here, but should we check for the IPX Ethertype? 999 */ 1000 if (proto <= ETHERMTU) { 1001 /* 1002 * This is an LLC SAP value, so check 1003 * the DSAP. 1004 */ 1005 return gen_cmp(off_linktype, BPF_B, 1006 (bpf_int32)proto); 1007 } else { 1008 /* 1009 * This is an Ethernet type; we assume 1010 * that it's unlikely that it'll 1011 * appear in the right place at random, 1012 * and therefore check only the 1013 * location that would hold the Ethernet 1014 * type in a SNAP frame with an organization 1015 * code of 0x000000 (encapsulated Ethernet). 1016 * 1017 * XXX - if we were to check for the SNAP DSAP 1018 * and LSAP, as per XXX, and were also to check 1019 * for an organization code of 0x000000 1020 * (encapsulated Ethernet), we'd do 1021 * 1022 * return gen_snap(0x000000, proto, 1023 * off_linktype); 1024 * 1025 * here; for now, we don't, as per the above. 1026 * I don't know whether it's worth the 1027 * extra CPU time to do the right check 1028 * or not. 1029 */ 1030 return gen_cmp(off_linktype+6, BPF_H, 1031 (bpf_int32)proto); 1032 } 1033 } 1034 break; 1035 1036 case DLT_LINUX_SLL: 1037 switch (proto) { 1038 1039 case LLCSAP_ISONS: 1040 /* 1041 * OSI protocols always use 802.2 encapsulation. 1042 * XXX - should we check both the DSAP and the 1043 * LSAP, like this, or should we check just the 1044 * DSAP? 1045 */ 1046 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1047 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1048 ((LLCSAP_ISONS << 8) | LLCSAP_ISONS)); 1049 gen_and(b0, b1); 1050 return b1; 1051 1052 case LLCSAP_NETBEUI: 1053 /* 1054 * NetBEUI always uses 802.2 encapsulation. 1055 * XXX - should we check both the DSAP and the 1056 * LSAP, like this, or should we check just the 1057 * DSAP? 1058 */ 1059 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1060 b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32) 1061 ((LLCSAP_NETBEUI << 8) | LLCSAP_NETBEUI)); 1062 gen_and(b0, b1); 1063 return b1; 1064 1065 case LLCSAP_IPX: 1066 /* 1067 * Ethernet_II frames, which are Ethernet 1068 * frames with a frame type of ETHERTYPE_IPX; 1069 * 1070 * Ethernet_802.3 frames, which have a frame 1071 * type of LINUX_SLL_P_802_3; 1072 * 1073 * Ethernet_802.2 frames, which are 802.3 1074 * frames with an 802.2 LLC header (i.e, have 1075 * a frame type of LINUX_SLL_P_802_2) and 1076 * with the IPX LSAP as the DSAP in the LLC 1077 * header; 1078 * 1079 * Ethernet_SNAP frames, which are 802.3 1080 * frames with an LLC header and a SNAP 1081 * header and with an OUI of 0x000000 1082 * (encapsulated Ethernet) and a protocol 1083 * ID of ETHERTYPE_IPX in the SNAP header. 1084 * 1085 * First, do the checks on LINUX_SLL_P_802_2 1086 * frames; generate the check for either 1087 * Ethernet_802.2 or Ethernet_SNAP frames, and 1088 * then put a check for LINUX_SLL_P_802_2 frames 1089 * before it. 1090 */ 1091 b0 = gen_cmp(off_linktype + 2, BPF_B, 1092 (bpf_int32)LLCSAP_IPX); 1093 b1 = gen_snap(0x000000, ETHERTYPE_IPX, 1094 off_linktype + 2); 1095 gen_or(b0, b1); 1096 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1097 gen_and(b0, b1); 1098 1099 /* 1100 * Now check for 802.3 frames and OR that with 1101 * the previous test. 1102 */ 1103 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3); 1104 gen_or(b0, b1); 1105 1106 /* 1107 * Now add the check for Ethernet_II frames, and 1108 * do that before checking for the other frame 1109 * types. 1110 */ 1111 b0 = gen_cmp(off_linktype, BPF_H, 1112 (bpf_int32)ETHERTYPE_IPX); 1113 gen_or(b0, b1); 1114 return b1; 1115 1116 case ETHERTYPE_ATALK: 1117 case ETHERTYPE_AARP: 1118 /* 1119 * EtherTalk (AppleTalk protocols on Ethernet link 1120 * layer) may use 802.2 encapsulation. 1121 */ 1122 1123 /* 1124 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1125 * we check for the 802.2 protocol type in the 1126 * "Ethernet type" field. 1127 */ 1128 b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2); 1129 1130 /* 1131 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1132 * SNAP packets with an organization code of 1133 * 0x080007 (Apple, for Appletalk) and a protocol 1134 * type of ETHERTYPE_ATALK (Appletalk). 1135 * 1136 * 802.2-encapsulated ETHERTYPE_AARP packets are 1137 * SNAP packets with an organization code of 1138 * 0x000000 (encapsulated Ethernet) and a protocol 1139 * type of ETHERTYPE_AARP (Appletalk ARP). 1140 */ 1141 if (proto == ETHERTYPE_ATALK) 1142 b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 1143 off_linktype + 2); 1144 else /* proto == ETHERTYPE_AARP */ 1145 b1 = gen_snap(0x000000, ETHERTYPE_AARP, 1146 off_linktype + 2); 1147 gen_and(b0, b1); 1148 1149 /* 1150 * Check for Ethernet encapsulation (Ethertalk 1151 * phase 1?); we just check for the Ethernet 1152 * protocol type. 1153 */ 1154 b0 = gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1155 1156 gen_or(b0, b1); 1157 return b1; 1158 1159 default: 1160 if (proto <= ETHERMTU) { 1161 /* 1162 * This is an LLC SAP value, so the frames 1163 * that match would be 802.2 frames. 1164 * Check for the 802.2 protocol type 1165 * in the "Ethernet type" field, and 1166 * then check the DSAP. 1167 */ 1168 b0 = gen_cmp(off_linktype, BPF_H, 1169 LINUX_SLL_P_802_2); 1170 b1 = gen_cmp(off_linktype + 2, BPF_B, 1171 (bpf_int32)proto); 1172 gen_and(b0, b1); 1173 return b1; 1174 } else { 1175 /* 1176 * This is an Ethernet type, so compare 1177 * the length/type field with it (if 1178 * the frame is an 802.2 frame, the length 1179 * field will be <= ETHERMTU, and, as 1180 * "proto" is > ETHERMTU, this test 1181 * will fail and the frame won't match, 1182 * which is what we want). 1183 */ 1184 return gen_cmp(off_linktype, BPF_H, 1185 (bpf_int32)proto); 1186 } 1187 } 1188 break; 1189 |
1190 case DLT_SLIP: |
1191 case DLT_SLIP_BSDOS: 1192 case DLT_RAW: 1193 /* 1194 * These types don't provide any type field; packets 1195 * are always IP. 1196 * 1197 * XXX - for IPv4, check for a version number of 4, and, 1198 * for IPv6, check for a version number of 6? 1199 */ 1200 switch (proto) { |
1201 |
1202 case ETHERTYPE_IP: 1203#ifdef INET6 1204 case ETHERTYPE_IPV6: 1205#endif 1206 return gen_true(); /* always true */ 1207 1208 default: 1209 return gen_false(); /* always false */ 1210 } 1211 break; 1212 |
1213 case DLT_PPP: 1214 case DLT_PPP_SERIAL: |
1215 case DLT_PPP_ETHER: |
1216 /* 1217 * We use Ethernet protocol types inside libpcap; 1218 * map them to the corresponding PPP protocol types. 1219 */ 1220 switch (proto) { 1221 1222 case ETHERTYPE_IP: 1223 proto = PPP_IP; /* XXX was 0x21 */ --- 12 unchanged lines hidden (view full) --- 1236 case ETHERTYPE_ATALK: 1237 proto = PPP_APPLE; 1238 break; 1239 1240 case ETHERTYPE_NS: 1241 proto = PPP_NS; 1242 break; 1243 |
1244 case LLCSAP_ISONS: |
1245 proto = PPP_OSI; 1246 break; |
1247 1248 case LLCSAP_8021D: 1249 /* 1250 * I'm assuming the "Bridging PDU"s that go 1251 * over PPP are Spanning Tree Protocol 1252 * Bridging PDUs. 1253 */ 1254 proto = PPP_BRPDU; 1255 break; 1256 1257 case LLCSAP_IPX: 1258 proto = PPP_IPX; 1259 break; |
1260 } 1261 break; 1262 1263 case DLT_PPP_BSDOS: 1264 /* 1265 * We use Ethernet protocol types inside libpcap; 1266 * map them to the corresponding PPP protocol types. 1267 */ --- 21 unchanged lines hidden (view full) --- 1289 case ETHERTYPE_ATALK: 1290 proto = PPP_APPLE; 1291 break; 1292 1293 case ETHERTYPE_NS: 1294 proto = PPP_NS; 1295 break; 1296 |
1297 case LLCSAP_ISONS: |
1298 proto = PPP_OSI; 1299 break; |
1300 1301 case LLCSAP_8021D: 1302 /* 1303 * I'm assuming the "Bridging PDU"s that go 1304 * over PPP are Spanning Tree Protocol 1305 * Bridging PDUs. 1306 */ 1307 proto = PPP_BRPDU; 1308 break; 1309 1310 case LLCSAP_IPX: 1311 proto = PPP_IPX; 1312 break; |
1313 } 1314 break; 1315 1316 case DLT_NULL: 1317 case DLT_LOOP: 1318 /* 1319 * For DLT_NULL, the link-layer header is a 32-bit 1320 * word containing an AF_ value in *host* byte order. --- 48 unchanged lines hidden (view full) --- 1369 * generate code to compare against the result. 1370 */ 1371 if (bpf_pcap->sf.rfile != NULL && 1372 bpf_pcap->sf.swapped) 1373 proto = SWAPLONG(proto); 1374 proto = htonl(proto); 1375 } 1376 return (gen_cmp(0, BPF_W, (bpf_int32)proto)); |
1377 1378 case DLT_ARCNET: 1379 /* 1380 * XXX should we check for first fragment if the protocol 1381 * uses PHDS? 1382 */ 1383 switch(proto) { 1384 default: 1385 return gen_false(); 1386#ifdef INET6 1387 case ETHERTYPE_IPV6: 1388 return(gen_cmp(2, BPF_B, 1389 (bpf_int32)htonl(ARCTYPE_INET6))); 1390#endif /* INET6 */ 1391 case ETHERTYPE_IP: 1392 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP)); 1393 b1 = gen_cmp(2, BPF_B, 1394 (bpf_int32)htonl(ARCTYPE_IP_OLD)); 1395 gen_or(b0, b1); 1396 return(b1); 1397 case ETHERTYPE_ARP: 1398 b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP)); 1399 b1 = gen_cmp(2, BPF_B, 1400 (bpf_int32)htonl(ARCTYPE_ARP_OLD)); 1401 gen_or(b0, b1); 1402 return(b1); 1403 case ETHERTYPE_REVARP: 1404 return(gen_cmp(2, BPF_B, 1405 (bpf_int32)htonl(ARCTYPE_REVARP))); 1406 case ETHERTYPE_ATALK: 1407 return(gen_cmp(2, BPF_B, 1408 (bpf_int32)htonl(ARCTYPE_ATALK))); 1409 } 1410 break; 1411 1412 case DLT_LTALK: 1413 switch (proto) { 1414 case ETHERTYPE_ATALK: 1415 return gen_true(); 1416 default: 1417 return gen_false(); 1418 } 1419 break; |
1420 } |
1421 1422 /* 1423 * All the types that have no encapsulation should either be 1424 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if 1425 * all packets are IP packets, or should be handled in some 1426 * special case, if none of them are (if some are and some 1427 * aren't, the lack of encapsulation is a problem, as we'd 1428 * have to find some other way of determining the packet type). 1429 * 1430 * Therefore, if "off_linktype" is -1, there's an error. 1431 */ 1432 if (off_linktype == -1) 1433 abort(); 1434 1435 /* 1436 * Any type not handled above should always have an Ethernet 1437 * type at an offset of "off_linktype". (PPP is partially 1438 * handled above - the protocol type is mapped from the 1439 * Ethernet and LLC types we use internally to the corresponding 1440 * PPP type - but the PPP type is always specified by a value 1441 * at "off_linktype", so we don't have to do the code generation 1442 * above.) 1443 */ |
1444 return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); 1445} 1446 1447/* 1448 * Check for an LLC SNAP packet with a given organization code and 1449 * protocol type; we check the entire contents of the 802.2 LLC and 1450 * snap headers, checking for DSAP and SSAP of SNAP and a control 1451 * field of 0x03 in the LLC header, and for the specified organization 1452 * code and protocol type in the SNAP header. 1453 */ 1454static struct block * 1455gen_snap(orgcode, ptype, offset) 1456 bpf_u_int32 orgcode; 1457 bpf_u_int32 ptype; 1458 u_int offset; 1459{ 1460 u_char snapblock[8]; 1461 |
1462 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 1463 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ |
1464 snapblock[2] = 0x03; /* control = UI */ 1465 snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */ 1466 snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */ 1467 snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */ 1468 snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */ 1469 snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */ 1470 return gen_bcmp(offset, 8, snapblock); 1471} --- 323 unchanged lines hidden (view full) --- 1795 1796 case Q_ARP: 1797 return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, 1798 off_nl + 14, off_nl + 24); 1799 1800 case Q_TCP: 1801 bpf_error("'tcp' modifier applied to host"); 1802 |
1803 case Q_SCTP: 1804 bpf_error("'sctp' modifier applied to host"); 1805 |
1806 case Q_UDP: 1807 bpf_error("'udp' modifier applied to host"); 1808 1809 case Q_ICMP: 1810 bpf_error("'icmp' modifier applied to host"); 1811 1812 case Q_IGMP: 1813 bpf_error("'igmp' modifier applied to host"); 1814 1815 case Q_IGRP: 1816 bpf_error("'igrp' modifier applied to host"); 1817 1818 case Q_PIM: 1819 bpf_error("'pim' modifier applied to host"); 1820 |
1821 case Q_VRRP: 1822 bpf_error("'vrrp' modifier applied to host"); 1823 |
1824 case Q_ATALK: 1825 bpf_error("ATALK host filtering not implemented"); 1826 1827 case Q_AARP: 1828 bpf_error("AARP host filtering not implemented"); 1829 1830 case Q_DECNET: 1831 return gen_dnhostop(addr, dir, off_nl); --- 31 unchanged lines hidden (view full) --- 1863 bpf_error("'esis' modifier applied to host"); 1864 1865 case Q_ISIS: 1866 bpf_error("'isis' modifier applied to host"); 1867 1868 case Q_CLNP: 1869 bpf_error("'clnp' modifier applied to host"); 1870 |
1871 case Q_STP: 1872 bpf_error("'stp' modifier applied to host"); 1873 1874 case Q_IPX: 1875 bpf_error("IPX host filtering not implemented"); 1876 1877 case Q_NETBEUI: 1878 bpf_error("'netbeui' modifier applied to host"); 1879 |
1880 default: 1881 abort(); 1882 } 1883 /* NOTREACHED */ 1884} 1885 1886#ifdef INET6 1887static struct block * --- 12 unchanged lines hidden (view full) --- 1900 bpf_error("'ip' modifier applied to ip6 host"); 1901 1902 case Q_RARP: 1903 bpf_error("'rarp' modifier applied to ip6 host"); 1904 1905 case Q_ARP: 1906 bpf_error("'arp' modifier applied to ip6 host"); 1907 |
1908 case Q_SCTP: 1909 bpf_error("'sctp' modifier applied to host"); 1910 |
1911 case Q_TCP: 1912 bpf_error("'tcp' modifier applied to host"); 1913 1914 case Q_UDP: 1915 bpf_error("'udp' modifier applied to host"); 1916 1917 case Q_ICMP: 1918 bpf_error("'icmp' modifier applied to host"); 1919 1920 case Q_IGMP: 1921 bpf_error("'igmp' modifier applied to host"); 1922 1923 case Q_IGRP: 1924 bpf_error("'igrp' modifier applied to host"); 1925 1926 case Q_PIM: 1927 bpf_error("'pim' modifier applied to host"); 1928 |
1929 case Q_VRRP: 1930 bpf_error("'vrrp' modifier applied to host"); 1931 |
1932 case Q_ATALK: 1933 bpf_error("ATALK host filtering not implemented"); 1934 1935 case Q_AARP: 1936 bpf_error("AARP host filtering not implemented"); 1937 1938 case Q_DECNET: 1939 bpf_error("'decnet' modifier applied to ip6 host"); --- 30 unchanged lines hidden (view full) --- 1970 bpf_error("'esis' modifier applied to host"); 1971 1972 case Q_ISIS: 1973 bpf_error("'isis' modifier applied to host"); 1974 1975 case Q_CLNP: 1976 bpf_error("'clnp' modifier applied to host"); 1977 |
1978 case Q_STP: 1979 bpf_error("'stp' modifier applied to host"); 1980 1981 case Q_IPX: 1982 bpf_error("IPX host filtering not implemented"); 1983 1984 case Q_NETBEUI: 1985 bpf_error("'netbeui' modifier applied to host"); 1986 |
1987 default: 1988 abort(); 1989 } 1990 /* NOTREACHED */ 1991} 1992#endif /*INET6*/ 1993 1994#ifndef INET6 --- 45 unchanged lines hidden (view full) --- 2040{ 2041#ifdef INET6 2042 struct block *b0; 2043#endif 2044 struct block *b1; 2045 2046 switch (proto) { 2047 |
2048 case Q_SCTP: 2049 b1 = gen_proto(IPPROTO_SCTP, Q_IP, Q_DEFAULT); 2050#ifdef INET6 2051 b0 = gen_proto(IPPROTO_SCTP, Q_IPV6, Q_DEFAULT); 2052 gen_or(b0, b1); 2053#endif 2054 break; 2055 |
2056 case Q_TCP: 2057 b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT); 2058#ifdef INET6 2059 b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 2060 gen_or(b0, b1); 2061#endif 2062 break; 2063 --- 31 unchanged lines hidden (view full) --- 2095 case Q_PIM: 2096 b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT); 2097#ifdef INET6 2098 b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 2099 gen_or(b0, b1); 2100#endif 2101 break; 2102 |
2103#ifndef IPPROTO_VRRP 2104#define IPPROTO_VRRP 112 2105#endif 2106 2107 case Q_VRRP: 2108 b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT); 2109 break; 2110 |
2111 case Q_IP: 2112 b1 = gen_linktype(ETHERTYPE_IP); 2113 break; 2114 2115 case Q_ARP: 2116 b1 = gen_linktype(ETHERTYPE_ARP); 2117 break; 2118 --- 63 unchanged lines hidden (view full) --- 2182 b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT); 2183#ifdef INET6 2184 b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 2185 gen_or(b0, b1); 2186#endif 2187 break; 2188 2189 case Q_ISO: |
2190 b1 = gen_linktype(LLCSAP_ISONS); |
2191 break; 2192 2193 case Q_ESIS: 2194 b1 = gen_proto(ISO9542_ESIS, Q_ISO, Q_DEFAULT); 2195 break; 2196 2197 case Q_ISIS: 2198 b1 = gen_proto(ISO10589_ISIS, Q_ISO, Q_DEFAULT); 2199 break; 2200 2201 case Q_CLNP: 2202 b1 = gen_proto(ISO8473_CLNP, Q_ISO, Q_DEFAULT); 2203 break; 2204 |
2205 case Q_STP: 2206 b1 = gen_linktype(LLCSAP_8021D); 2207 break; 2208 2209 case Q_IPX: 2210 b1 = gen_linktype(LLCSAP_IPX); 2211 break; 2212 2213 case Q_NETBEUI: 2214 b1 = gen_linktype(LLCSAP_NETBEUI); 2215 break; 2216 |
2217 default: 2218 abort(); 2219 } 2220 return b1; 2221} 2222 2223static struct block * 2224gen_ipfrag() --- 93 unchanged lines hidden (view full) --- 2318 struct block *b0, *b1, *tmp; 2319 2320 /* ether proto ip */ 2321 b0 = gen_linktype(ETHERTYPE_IP); 2322 2323 switch (ip_proto) { 2324 case IPPROTO_UDP: 2325 case IPPROTO_TCP: |
2326 case IPPROTO_SCTP: |
2327 b1 = gen_portop(port, ip_proto, dir); 2328 break; 2329 2330 case PROTO_UNDEF: 2331 tmp = gen_portop(port, IPPROTO_TCP, dir); 2332 b1 = gen_portop(port, IPPROTO_UDP, dir); 2333 gen_or(tmp, b1); |
2334 tmp = gen_portop(port, IPPROTO_SCTP, dir); 2335 gen_or(tmp, b1); |
2336 break; 2337 2338 default: 2339 abort(); 2340 } 2341 gen_and(b0, b1); 2342 return b1; 2343} --- 47 unchanged lines hidden (view full) --- 2391 struct block *b0, *b1, *tmp; 2392 2393 /* ether proto ip */ 2394 b0 = gen_linktype(ETHERTYPE_IPV6); 2395 2396 switch (ip_proto) { 2397 case IPPROTO_UDP: 2398 case IPPROTO_TCP: |
2399 case IPPROTO_SCTP: |
2400 b1 = gen_portop6(port, ip_proto, dir); 2401 break; 2402 2403 case PROTO_UNDEF: 2404 tmp = gen_portop6(port, IPPROTO_TCP, dir); 2405 b1 = gen_portop6(port, IPPROTO_UDP, dir); 2406 gen_or(tmp, b1); |
2407 tmp = gen_portop6(port, IPPROTO_SCTP, dir); 2408 gen_or(tmp, b1); |
2409 break; 2410 2411 default: 2412 abort(); 2413 } 2414 gen_and(b0, b1); 2415 return b1; 2416} --- 5 unchanged lines hidden (view full) --- 2422 register int proto; 2423{ 2424 register int v; 2425 2426 switch (proto) { 2427 2428 case Q_DEFAULT: 2429 case Q_IP: |
2430 case Q_IPV6: |
2431 v = pcap_nametoproto(name); 2432 if (v == PROTO_UNDEF) 2433 bpf_error("unknown ip proto '%s'", name); 2434 break; 2435 2436 case Q_LINK: 2437 /* XXX should look up h/w protocol type based on linktype */ 2438 v = pcap_nametoeproto(name); --- 348 unchanged lines hidden (view full) --- 2787 b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v); 2788#else 2789 b1 = gen_protochain(v, Q_IP); 2790#endif 2791 gen_and(b0, b1); 2792 return b1; 2793 2794 case Q_ISO: |
2795 b0 = gen_linktype(LLCSAP_ISONS); |
2796 b1 = gen_cmp(off_nl + 3, BPF_B, (long)v); 2797 gen_and(b0, b1); 2798 return b1; 2799 2800 case Q_ARP: 2801 bpf_error("arp does not encapsulate another protocol"); 2802 /* NOTREACHED */ 2803 --- 31 unchanged lines hidden (view full) --- 2835 case Q_UDP: 2836 bpf_error("'udp proto' is bogus"); 2837 /* NOTREACHED */ 2838 2839 case Q_TCP: 2840 bpf_error("'tcp proto' is bogus"); 2841 /* NOTREACHED */ 2842 |
2843 case Q_SCTP: 2844 bpf_error("'sctp proto' is bogus"); 2845 /* NOTREACHED */ 2846 |
2847 case Q_ICMP: 2848 bpf_error("'icmp proto' is bogus"); 2849 /* NOTREACHED */ 2850 2851 case Q_IGMP: 2852 bpf_error("'igmp proto' is bogus"); 2853 /* NOTREACHED */ 2854 2855 case Q_IGRP: 2856 bpf_error("'igrp proto' is bogus"); 2857 /* NOTREACHED */ 2858 2859 case Q_PIM: 2860 bpf_error("'pim proto' is bogus"); 2861 /* NOTREACHED */ 2862 |
2863 case Q_VRRP: 2864 bpf_error("'vrrp proto' is bogus"); 2865 /* NOTREACHED */ 2866 |
2867#ifdef INET6 2868 case Q_IPV6: 2869 b0 = gen_linktype(ETHERTYPE_IPV6); 2870#ifndef CHASE_CHAIN 2871 b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v); 2872#else 2873 b1 = gen_protochain(v, Q_IPV6); 2874#endif --- 5 unchanged lines hidden (view full) --- 2880#endif /* INET6 */ 2881 2882 case Q_AH: 2883 bpf_error("'ah proto' is bogus"); 2884 2885 case Q_ESP: 2886 bpf_error("'ah proto' is bogus"); 2887 |
2888 case Q_STP: 2889 bpf_error("'stp proto' is bogus"); 2890 2891 case Q_IPX: 2892 bpf_error("'ipx proto' is bogus"); 2893 2894 case Q_NETBEUI: 2895 bpf_error("'netbeui proto' is bogus"); 2896 |
2897 default: 2898 abort(); 2899 /* NOTREACHED */ 2900 } 2901 /* NOTREACHED */ 2902} 2903 2904struct block * --- 37 unchanged lines hidden (view full) --- 2942 if (proto == Q_LINK) { 2943 switch (linktype) { 2944 2945 case DLT_EN10MB: 2946 eaddr = pcap_ether_hostton(name); 2947 if (eaddr == NULL) 2948 bpf_error( 2949 "unknown ether host '%s'", name); |
2950 b = gen_ehostop(eaddr, dir); 2951 free(eaddr); 2952 return b; |
2953 2954 case DLT_FDDI: 2955 eaddr = pcap_ether_hostton(name); 2956 if (eaddr == NULL) 2957 bpf_error( 2958 "unknown FDDI host '%s'", name); |
2959 b = gen_fhostop(eaddr, dir); 2960 free(eaddr); 2961 return b; |
2962 2963 case DLT_IEEE802: 2964 eaddr = pcap_ether_hostton(name); 2965 if (eaddr == NULL) 2966 bpf_error( 2967 "unknown token ring host '%s'", name); |
2968 b = gen_thostop(eaddr, dir); 2969 free(eaddr); 2970 return b; |
2971 2972 default: 2973 bpf_error( 2974 "only ethernet/FDDI/token ring supports link-level host name"); 2975 break; 2976 } 2977 } else if (proto == Q_DECNET) { 2978 unsigned short dn_addr = __pcap_nametodnaddr(name); --- 44 unchanged lines hidden (view full) --- 3023 if (tproto6 == Q_IP) 3024 continue; 3025 3026 sin6 = (struct sockaddr_in6 *) 3027 res->ai_addr; 3028 tmp = gen_host6(&sin6->sin6_addr, 3029 &mask128, tproto6, dir); 3030 break; |
3031 default: 3032 continue; |
3033 } 3034 if (b) 3035 gen_or(b, tmp); 3036 b = tmp; 3037 } 3038 freeaddrinfo(res0); 3039 if (b == NULL) { 3040 bpf_error("unknown host '%s'%s", name, 3041 (proto == Q_DEFAULT) 3042 ? "" 3043 : " for specified address family"); 3044 } 3045 return b; 3046#endif /*INET6*/ 3047 } 3048 3049 case Q_PORT: |
3050 if (proto != Q_DEFAULT && 3051 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) |
3052 bpf_error("illegal qualifier of 'port'"); 3053 if (pcap_nametoport(name, &port, &real_proto) == 0) 3054 bpf_error("unknown port '%s'", name); 3055 if (proto == Q_UDP) { 3056 if (real_proto == IPPROTO_TCP) 3057 bpf_error("port '%s' is tcp", name); |
3058 else if (real_proto == IPPROTO_SCTP) 3059 bpf_error("port '%s' is sctp", name); |
3060 else 3061 /* override PROTO_UNDEF */ 3062 real_proto = IPPROTO_UDP; 3063 } 3064 if (proto == Q_TCP) { 3065 if (real_proto == IPPROTO_UDP) 3066 bpf_error("port '%s' is udp", name); |
3067 3068 else if (real_proto == IPPROTO_SCTP) 3069 bpf_error("port '%s' is sctp", name); |
3070 else 3071 /* override PROTO_UNDEF */ 3072 real_proto = IPPROTO_TCP; 3073 } |
3074 if (proto == Q_SCTP) { 3075 if (real_proto == IPPROTO_UDP) 3076 bpf_error("port '%s' is udp", name); 3077 3078 else if (real_proto == IPPROTO_TCP) 3079 bpf_error("port '%s' is tcp", name); 3080 else 3081 /* override PROTO_UNDEF */ 3082 real_proto = IPPROTO_SCTP; 3083 } |
3084#ifndef INET6 3085 return gen_port(port, real_proto, dir); 3086#else 3087 { 3088 struct block *b; 3089 b = gen_port(port, real_proto, dir); 3090 gen_or(gen_port6(port, real_proto, dir), b); 3091 return b; --- 4 unchanged lines hidden (view full) --- 3096#ifndef INET6 3097 eaddr = pcap_ether_hostton(name); 3098 if (eaddr == NULL) 3099 bpf_error("unknown ether host: %s", name); 3100 3101 alist = pcap_nametoaddr(name); 3102 if (alist == NULL || *alist == NULL) 3103 bpf_error("unknown host '%s'", name); |
3104 b = gen_gateway(eaddr, alist, proto, dir); 3105 free(eaddr); 3106 return b; |
3107#else 3108 bpf_error("'gateway' not supported in this configuration"); 3109#endif /*INET6*/ 3110 3111 case Q_PROTO: 3112 real_proto = lookup_proto(name, proto); 3113 if (real_proto >= 0) 3114 return gen_proto(real_proto, proto, dir); --- 100 unchanged lines hidden (view full) --- 3215 return gen_host(v, mask, proto, dir); 3216 } 3217 3218 case Q_PORT: 3219 if (proto == Q_UDP) 3220 proto = IPPROTO_UDP; 3221 else if (proto == Q_TCP) 3222 proto = IPPROTO_TCP; |
3223 else if (proto == Q_SCTP) 3224 proto = IPPROTO_SCTP; |
3225 else if (proto == Q_DEFAULT) 3226 proto = PROTO_UNDEF; 3227 else 3228 bpf_error("illegal qualifier of 'port'"); 3229 3230#ifndef INET6 3231 return gen_port((int)v, proto, dir); 3232#else --- 46 unchanged lines hidden (view full) --- 3279 if (!res) 3280 bpf_error("invalid ip6 address %s", s1); 3281 if (res->ai_next) 3282 bpf_error("%s resolved to multiple address", s1); 3283 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 3284 3285 if (sizeof(mask) * 8 < masklen) 3286 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8)); |
3287 memset(&mask, 0, sizeof(mask)); |
3288 memset(&mask, 0xff, masklen / 8); 3289 if (masklen % 8) { 3290 mask.s6_addr[masklen / 8] = 3291 (0xff << (8 - masklen % 8)) & 0xff; 3292 } 3293 3294 a = (u_int32_t *)addr; 3295 m = (u_int32_t *)&mask; --- 134 unchanged lines hidden (view full) --- 3430 sappend(index->s, s); 3431 3432 b = gen_proto_abbrev(proto); 3433 if (index->b) 3434 gen_and(index->b, b); 3435 index->b = b; 3436 break; 3437 |
3438 case Q_SCTP: |
3439 case Q_TCP: 3440 case Q_UDP: 3441 case Q_ICMP: 3442 case Q_IGMP: 3443 case Q_IGRP: 3444 case Q_PIM: |
3445 case Q_VRRP: |
3446 s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); 3447 s->s.k = off_nl; 3448 sappend(s, xfer_to_a(index)); 3449 sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); 3450 sappend(s, new_stmt(BPF_MISC|BPF_TAX)); 3451 sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); 3452 tmp->s.k = off_nl; 3453 sappend(index->s, s); --- 258 unchanged lines hidden (view full) --- 3712 s->s.k = val; 3713 b = new_block(JMP(BPF_JEQ)); 3714 b->stmts = s; 3715 gen_not(b); 3716 3717 return b; 3718} 3719 |
3720static u_char abroadcast[] = { 0x0 }; 3721 |
3722struct block * 3723gen_broadcast(proto) 3724 int proto; 3725{ 3726 bpf_u_int32 hostmask; 3727 struct block *b0, *b1, *b2; 3728 static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 3729 3730 switch (proto) { 3731 3732 case Q_DEFAULT: 3733 case Q_LINK: |
3734 if (linktype == DLT_ARCNET) 3735 return gen_ahostop(abroadcast, Q_DST); |
3736 if (linktype == DLT_EN10MB) 3737 return gen_ehostop(ebroadcast, Q_DST); 3738 if (linktype == DLT_FDDI) 3739 return gen_fhostop(ebroadcast, Q_DST); 3740 if (linktype == DLT_IEEE802) 3741 return gen_thostop(ebroadcast, Q_DST); 3742 bpf_error("not a broadcast link"); 3743 break; --- 17 unchanged lines hidden (view full) --- 3761{ 3762 register struct block *b0, *b1; 3763 register struct slist *s; 3764 3765 switch (proto) { 3766 3767 case Q_DEFAULT: 3768 case Q_LINK: |
3769 if (linktype == DLT_ARCNET) 3770 /* all ARCnet multicasts use the same address */ 3771 return gen_ahostop(abroadcast, Q_DST); 3772 |
3773 if (linktype == DLT_EN10MB) { 3774 /* ether[0] & 1 != 0 */ 3775 s = new_stmt(BPF_LD|BPF_B|BPF_ABS); 3776 s->s.k = 0; 3777 b0 = new_block(JMP(BPF_JSET)); 3778 b0->s.k = 1; 3779 b0->stmts = s; 3780 return b0; --- 61 unchanged lines hidden (view full) --- 3842 bpf_error("inbound/outbound not supported on linktype %d\n", 3843 linktype); 3844 b0 = NULL; 3845 /* NOTREACHED */ 3846 } 3847 return (b0); 3848} 3849 |
3850struct block * 3851gen_acode(eaddr, q) 3852 register const u_char *eaddr; 3853 struct qual q; 3854{ 3855 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 3856 if (linktype == DLT_ARCNET) 3857 return gen_ahostop(eaddr, (int)q.dir); 3858 } 3859 bpf_error("ARCnet address used in non-arc expression"); 3860 /* NOTREACHED */ 3861} 3862 3863static struct block * 3864gen_ahostop(eaddr, dir) 3865 register const u_char *eaddr; 3866 register int dir; 3867{ 3868 register struct block *b0, *b1; 3869 3870 switch (dir) { 3871 /* src comes first, different from Ethernet */ 3872 case Q_SRC: 3873 return gen_bcmp(0, 1, eaddr); 3874 3875 case Q_DST: 3876 return gen_bcmp(1, 1, eaddr); 3877 3878 case Q_AND: 3879 b0 = gen_ahostop(eaddr, Q_SRC); 3880 b1 = gen_ahostop(eaddr, Q_DST); 3881 gen_and(b0, b1); 3882 return b1; 3883 3884 case Q_DEFAULT: 3885 case Q_OR: 3886 b0 = gen_ahostop(eaddr, Q_SRC); 3887 b1 = gen_ahostop(eaddr, Q_DST); 3888 gen_or(b0, b1); 3889 return b1; 3890 } 3891 abort(); 3892 /* NOTREACHED */ 3893} 3894 |
3895/* 3896 * support IEEE 802.1Q VLAN trunk over ethernet 3897 */ 3898struct block * 3899gen_vlan(vlan_num) 3900 int vlan_num; 3901{ |
3902 struct block *b0; 3903 3904 /* 3905 * Change the offsets to point to the type and data fields within 3906 * the VLAN packet. This is somewhat of a kludge. 3907 */ 3908 if (orig_nl == (u_int)-1) { 3909 orig_linktype = off_linktype; /* save original values */ --- 30 unchanged lines hidden --- |