1 /*#define CHASE_CHAIN*/
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 static const char rcsid
[] _U_
=
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)";
32 #include <pcap-stdinc.h>
34 #include <sys/types.h>
35 #include <sys/socket.h>
39 * XXX - why was this included even on UNIX?
48 #include <sys/param.h>
51 #include <netinet/in.h>
67 #include "ethertype.h"
71 #include <netproto/802_11/ieee80211.h>
73 #include "sunatmpos.h"
77 #ifdef HAVE_NET_PFVAR_H
78 #include <sys/socket.h>
80 #include <net/if_var.h>
81 #include <net/pf/pfvar.h>
82 #include <net/pf/if_pflog.h>
85 #define offsetof(s, e) ((size_t)&((s *)0)->e)
89 #include <netdb.h> /* for "struct addrinfo" */
92 #include <pcap/namedb.h>
94 #include <netproto/802_11/ieee80211_radiotap.h>
99 #define IPPROTO_SCTP 132
102 #ifdef HAVE_OS_PROTO_H
103 #include "os-proto.h"
106 #define JMP(c) ((c)|BPF_JMP|BPF_K)
109 static jmp_buf top_ctx
;
110 static pcap_t
*bpf_pcap
;
112 /* Hack for updating VLAN, MPLS, and PPPoE offsets. */
114 static u_int orig_linktype
= (u_int
)-1, orig_nl
= (u_int
)-1, label_stack_depth
= (u_int
)-1;
116 static u_int orig_linktype
= -1U, orig_nl
= -1U, label_stack_depth
= -1U;
121 static int pcap_fddipad
;
126 bpf_error(const char *fmt
, ...)
131 if (bpf_pcap
!= NULL
)
132 (void)vsnprintf(pcap_geterr(bpf_pcap
), PCAP_ERRBUF_SIZE
,
139 static void init_linktype(pcap_t
*);
141 static void init_regs(void);
142 static int alloc_reg(void);
143 static void free_reg(int);
145 static struct block
*root
;
148 * Value passed to gen_load_a() to indicate what the offset argument
152 OR_PACKET
, /* relative to the beginning of the packet */
153 OR_LINK
, /* relative to the beginning of the link-layer header */
154 OR_MACPL
, /* relative to the end of the MAC-layer header */
155 OR_NET
, /* relative to the network-layer header */
156 OR_NET_NOSNAP
, /* relative to the network-layer header, with no SNAP header at the link layer */
157 OR_TRAN_IPV4
, /* relative to the transport-layer header, with IPv4 network layer */
158 OR_TRAN_IPV6
/* relative to the transport-layer header, with IPv6 network layer */
162 * We divy out chunks of memory rather than call malloc each time so
163 * we don't have to worry about leaking memory. It's probably
164 * not a big deal if all this memory was wasted but if this ever
165 * goes into a library that would probably not be a good idea.
167 * XXX - this *is* in a library....
170 #define CHUNK0SIZE 1024
176 static struct chunk chunks
[NCHUNKS
];
177 static int cur_chunk
;
179 static void *newchunk(u_int
);
180 static void freechunks(void);
181 static inline struct block
*new_block(int);
182 static inline struct slist
*new_stmt(int);
183 static struct block
*gen_retblk(int);
184 static inline void syntax(void);
186 static void backpatch(struct block
*, struct block
*);
187 static void merge(struct block
*, struct block
*);
188 static struct block
*gen_cmp(enum e_offrel
, u_int
, u_int
, bpf_int32
);
189 static struct block
*gen_cmp_gt(enum e_offrel
, u_int
, u_int
, bpf_int32
);
190 static struct block
*gen_cmp_ge(enum e_offrel
, u_int
, u_int
, bpf_int32
);
191 static struct block
*gen_cmp_lt(enum e_offrel
, u_int
, u_int
, bpf_int32
);
192 static struct block
*gen_cmp_le(enum e_offrel
, u_int
, u_int
, bpf_int32
);
193 static struct block
*gen_mcmp(enum e_offrel
, u_int
, u_int
, bpf_int32
,
195 static struct block
*gen_bcmp(enum e_offrel
, u_int
, u_int
, const u_char
*);
196 static struct block
*gen_ncmp(enum e_offrel
, bpf_u_int32
, bpf_u_int32
,
197 bpf_u_int32
, bpf_u_int32
, int, bpf_int32
);
198 static struct slist
*gen_load_llrel(u_int
, u_int
);
199 static struct slist
*gen_load_macplrel(u_int
, u_int
);
200 static struct slist
*gen_load_a(enum e_offrel
, u_int
, u_int
);
201 static struct slist
*gen_loadx_iphdrlen(void);
202 static struct block
*gen_uncond(int);
203 static inline struct block
*gen_true(void);
204 static inline struct block
*gen_false(void);
205 static struct block
*gen_ether_linktype(int);
206 static struct block
*gen_linux_sll_linktype(int);
207 static struct slist
*gen_load_prism_llprefixlen(void);
208 static struct slist
*gen_load_avs_llprefixlen(void);
209 static struct slist
*gen_load_radiotap_llprefixlen(void);
210 static struct slist
*gen_load_ppi_llprefixlen(void);
211 static void insert_compute_vloffsets(struct block
*);
212 static struct slist
*gen_llprefixlen(void);
213 static struct slist
*gen_off_macpl(void);
214 static int ethertype_to_ppptype(int);
215 static struct block
*gen_linktype(int);
216 static struct block
*gen_snap(bpf_u_int32
, bpf_u_int32
);
217 static struct block
*gen_llc_linktype(int);
218 static struct block
*gen_hostop(bpf_u_int32
, bpf_u_int32
, int, int, u_int
, u_int
);
220 static struct block
*gen_hostop6(struct in6_addr
*, struct in6_addr
*, int, int, u_int
, u_int
);
222 static struct block
*gen_ahostop(const u_char
*, int);
223 static struct block
*gen_ehostop(const u_char
*, int);
224 static struct block
*gen_fhostop(const u_char
*, int);
225 static struct block
*gen_thostop(const u_char
*, int);
226 static struct block
*gen_wlanhostop(const u_char
*, int);
227 static struct block
*gen_ipfchostop(const u_char
*, int);
228 static struct block
*gen_dnhostop(bpf_u_int32
, int);
229 static struct block
*gen_mpls_linktype(int);
230 static struct block
*gen_host(bpf_u_int32
, bpf_u_int32
, int, int, int);
232 static struct block
*gen_host6(struct in6_addr
*, struct in6_addr
*, int, int, int);
235 static struct block
*gen_gateway(const u_char
*, bpf_u_int32
**, int, int);
237 static struct block
*gen_ipfrag(void);
238 static struct block
*gen_portatom(int, bpf_int32
);
239 static struct block
*gen_portrangeatom(int, bpf_int32
, bpf_int32
);
241 static struct block
*gen_portatom6(int, bpf_int32
);
242 static struct block
*gen_portrangeatom6(int, bpf_int32
, bpf_int32
);
244 struct block
*gen_portop(int, int, int);
245 static struct block
*gen_port(int, int, int);
246 struct block
*gen_portrangeop(int, int, int, int);
247 static struct block
*gen_portrange(int, int, int, int);
249 struct block
*gen_portop6(int, int, int);
250 static struct block
*gen_port6(int, int, int);
251 struct block
*gen_portrangeop6(int, int, int, int);
252 static struct block
*gen_portrange6(int, int, int, int);
254 static int lookup_proto(const char *, int);
255 static struct block
*gen_protochain(int, int, int);
256 static struct block
*gen_proto(int, int, int);
257 static struct slist
*xfer_to_x(struct arth
*);
258 static struct slist
*xfer_to_a(struct arth
*);
259 static struct block
*gen_mac_multicast(int);
260 static struct block
*gen_len(int, int);
261 static struct block
*gen_check_802_11_data_frame(void);
263 static struct block
*gen_ppi_dlt_check(void);
264 static struct block
*gen_msg_abbrev(int type
);
275 /* XXX Round up to nearest long. */
276 n
= (n
+ sizeof(long) - 1) & ~(sizeof(long) - 1);
278 /* XXX Round up to structure boundary. */
282 cp
= &chunks
[cur_chunk
];
283 if (n
> cp
->n_left
) {
284 ++cp
, k
= ++cur_chunk
;
286 bpf_error("out of memory");
287 size
= CHUNK0SIZE
<< k
;
288 cp
->m
= (void *)malloc(size
);
290 bpf_error("out of memory");
291 memset((char *)cp
->m
, 0, size
);
294 bpf_error("out of memory");
297 return (void *)((char *)cp
->m
+ cp
->n_left
);
306 for (i
= 0; i
< NCHUNKS
; ++i
)
307 if (chunks
[i
].m
!= NULL
) {
314 * A strdup whose allocations are freed after code generation is over.
318 register const char *s
;
320 int n
= strlen(s
) + 1;
321 char *cp
= newchunk(n
);
327 static inline struct block
*
333 p
= (struct block
*)newchunk(sizeof(*p
));
340 static inline struct slist
*
346 p
= (struct slist
*)newchunk(sizeof(*p
));
352 static struct block
*
356 struct block
*b
= new_block(BPF_RET
|BPF_K
);
365 bpf_error("syntax error in filter expression");
368 static bpf_u_int32 netmask
;
373 pcap_compile(pcap_t
*p
, struct bpf_program
*program
,
374 const char *buf
, int optimize
, bpf_u_int32 mask
)
377 const char * volatile xbuf
= buf
;
385 if (setjmp(top_ctx
)) {
393 snaplen
= pcap_snapshot(p
);
395 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
396 "snaplen of 0 rejects all packets");
400 lex_init(xbuf
? xbuf
: "");
408 root
= gen_retblk(snaplen
);
410 if (optimize
&& !no_optimize
) {
413 (root
->s
.code
== (BPF_RET
|BPF_K
) && root
->s
.k
== 0))
414 bpf_error("expression rejects all packets");
416 program
->bf_insns
= icode_to_fcode(root
, &len
);
417 program
->bf_len
= len
;
425 * entry point for using the compiler with no pcap open
426 * pass in all the stuff that is needed explicitly instead.
429 pcap_compile_nopcap(int snaplen_arg
, int linktype_arg
,
430 struct bpf_program
*program
,
431 const char *buf
, int optimize
, bpf_u_int32 mask
)
436 p
= pcap_open_dead(linktype_arg
, snaplen_arg
);
439 ret
= pcap_compile(p
, program
, buf
, optimize
, mask
);
445 * Clean up a "struct bpf_program" by freeing all the memory allocated
449 pcap_freecode(struct bpf_program
*program
)
452 if (program
->bf_insns
!= NULL
) {
453 free((char *)program
->bf_insns
);
454 program
->bf_insns
= NULL
;
459 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
460 * which of the jt and jf fields has been resolved and which is a pointer
461 * back to another unresolved block (or nil). At least one of the fields
462 * in each block is already resolved.
465 backpatch(list
, target
)
466 struct block
*list
, *target
;
483 * Merge the lists in b0 and b1, using the 'sense' field to indicate
484 * which of jt and jf is the link.
488 struct block
*b0
, *b1
;
490 register struct block
**p
= &b0
;
492 /* Find end of list. */
494 p
= !((*p
)->sense
) ? &JT(*p
) : &JF(*p
);
496 /* Concatenate the lists. */
504 struct block
*ppi_dlt_check
;
507 * Insert before the statements of the first (root) block any
508 * statements needed to load the lengths of any variable-length
509 * headers into registers.
511 * XXX - a fancier strategy would be to insert those before the
512 * statements of all blocks that use those lengths and that
513 * have no predecessors that use them, so that we only compute
514 * the lengths if we need them. There might be even better
515 * approaches than that.
517 * However, those strategies would be more complicated, and
518 * as we don't generate code to compute a length if the
519 * program has no tests that use the length, and as most
520 * tests will probably use those lengths, we would just
521 * postpone computing the lengths so that it's not done
522 * for tests that fail early, and it's not clear that's
525 insert_compute_vloffsets(p
->head
);
528 * For DLT_PPI captures, generate a check of the per-packet
529 * DLT value to make sure it's DLT_IEEE802_11.
531 ppi_dlt_check
= gen_ppi_dlt_check();
532 if (ppi_dlt_check
!= NULL
)
533 gen_and(ppi_dlt_check
, p
);
535 backpatch(p
, gen_retblk(snaplen
));
536 p
->sense
= !p
->sense
;
537 backpatch(p
, gen_retblk(0));
543 struct block
*b0
, *b1
;
545 backpatch(b0
, b1
->head
);
546 b0
->sense
= !b0
->sense
;
547 b1
->sense
= !b1
->sense
;
549 b1
->sense
= !b1
->sense
;
555 struct block
*b0
, *b1
;
557 b0
->sense
= !b0
->sense
;
558 backpatch(b0
, b1
->head
);
559 b0
->sense
= !b0
->sense
;
568 b
->sense
= !b
->sense
;
571 static struct block
*
572 gen_cmp(offrel
, offset
, size
, v
)
573 enum e_offrel offrel
;
577 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JEQ
, 0, v
);
580 static struct block
*
581 gen_cmp_gt(offrel
, offset
, size
, v
)
582 enum e_offrel offrel
;
586 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGT
, 0, v
);
589 static struct block
*
590 gen_cmp_ge(offrel
, offset
, size
, v
)
591 enum e_offrel offrel
;
595 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGE
, 0, v
);
598 static struct block
*
599 gen_cmp_lt(offrel
, offset
, size
, v
)
600 enum e_offrel offrel
;
604 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGE
, 1, v
);
607 static struct block
*
608 gen_cmp_le(offrel
, offset
, size
, v
)
609 enum e_offrel offrel
;
613 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGT
, 1, v
);
616 static struct block
*
617 gen_mcmp(offrel
, offset
, size
, v
, mask
)
618 enum e_offrel offrel
;
623 return gen_ncmp(offrel
, offset
, size
, mask
, BPF_JEQ
, 0, v
);
626 static struct block
*
627 gen_bcmp(offrel
, offset
, size
, v
)
628 enum e_offrel offrel
;
629 register u_int offset
, size
;
630 register const u_char
*v
;
632 register struct block
*b
, *tmp
;
636 register const u_char
*p
= &v
[size
- 4];
637 bpf_int32 w
= ((bpf_int32
)p
[0] << 24) |
638 ((bpf_int32
)p
[1] << 16) | ((bpf_int32
)p
[2] << 8) | p
[3];
640 tmp
= gen_cmp(offrel
, offset
+ size
- 4, BPF_W
, w
);
647 register const u_char
*p
= &v
[size
- 2];
648 bpf_int32 w
= ((bpf_int32
)p
[0] << 8) | p
[1];
650 tmp
= gen_cmp(offrel
, offset
+ size
- 2, BPF_H
, w
);
657 tmp
= gen_cmp(offrel
, offset
, BPF_B
, (bpf_int32
)v
[0]);
666 * AND the field of size "size" at offset "offset" relative to the header
667 * specified by "offrel" with "mask", and compare it with the value "v"
668 * with the test specified by "jtype"; if "reverse" is true, the test
669 * should test the opposite of "jtype".
671 static struct block
*
672 gen_ncmp(offrel
, offset
, size
, mask
, jtype
, reverse
, v
)
673 enum e_offrel offrel
;
675 bpf_u_int32 offset
, size
, mask
, jtype
;
678 struct slist
*s
, *s2
;
681 s
= gen_load_a(offrel
, offset
, size
);
683 if (mask
!= 0xffffffff) {
684 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
689 b
= new_block(JMP(jtype
));
692 if (reverse
&& (jtype
== BPF_JGT
|| jtype
== BPF_JGE
))
698 * Various code constructs need to know the layout of the data link
699 * layer. These variables give the necessary offsets from the beginning
700 * of the packet data.
704 * This is the offset of the beginning of the link-layer header from
705 * the beginning of the raw packet data.
707 * It's usually 0, except for 802.11 with a fixed-length radio header.
708 * (For 802.11 with a variable-length radio header, we have to generate
709 * code to compute that offset; off_ll is 0 in that case.)
714 * If there's a variable-length header preceding the link-layer header,
715 * "reg_off_ll" is the register number for a register containing the
716 * length of that header, and therefore the offset of the link-layer
717 * header from the beginning of the raw packet data. Otherwise,
718 * "reg_off_ll" is -1.
720 static int reg_off_ll
;
723 * This is the offset of the beginning of the MAC-layer header from
724 * the beginning of the link-layer header.
725 * It's usually 0, except for ATM LANE, where it's the offset, relative
726 * to the beginning of the raw packet data, of the Ethernet header.
728 static u_int off_mac
;
731 * This is the offset of the beginning of the MAC-layer payload,
732 * from the beginning of the raw packet data.
734 * I.e., it's the sum of the length of the link-layer header (without,
735 * for example, any 802.2 LLC header, so it's the MAC-layer
736 * portion of that header), plus any prefix preceding the
739 static u_int off_macpl
;
742 * This is 1 if the offset of the beginning of the MAC-layer payload
743 * from the beginning of the link-layer header is variable-length.
745 static int off_macpl_is_variable
;
748 * If the link layer has variable_length headers, "reg_off_macpl"
749 * is the register number for a register containing the length of the
750 * link-layer header plus the length of any variable-length header
751 * preceding the link-layer header. Otherwise, "reg_off_macpl"
754 static int reg_off_macpl
;
757 * "off_linktype" is the offset to information in the link-layer header
758 * giving the packet type. This offset is relative to the beginning
759 * of the link-layer header (i.e., it doesn't include off_ll).
761 * For Ethernet, it's the offset of the Ethernet type field.
763 * For link-layer types that always use 802.2 headers, it's the
764 * offset of the LLC header.
766 * For PPP, it's the offset of the PPP type field.
768 * For Cisco HDLC, it's the offset of the CHDLC type field.
770 * For BSD loopback, it's the offset of the AF_ value.
772 * For Linux cooked sockets, it's the offset of the type field.
774 * It's set to -1 for no encapsulation, in which case, IP is assumed.
776 static u_int off_linktype
;
779 * TRUE if "pppoes" appeared in the filter; it causes link-layer type
780 * checks to check the PPP header, assumed to follow a LAN-style link-
781 * layer header and a PPPoE session header.
783 static int is_pppoes
= 0;
786 * TRUE if the link layer includes an ATM pseudo-header.
788 static int is_atm
= 0;
791 * TRUE if "lane" appeared in the filter; it causes us to generate
792 * code that assumes LANE rather than LLC-encapsulated traffic in SunATM.
794 static int is_lane
= 0;
797 * These are offsets for the ATM pseudo-header.
799 static u_int off_vpi
;
800 static u_int off_vci
;
801 static u_int off_proto
;
804 * These are offsets for the MTP2 fields.
809 * These are offsets for the MTP3 fields.
811 static u_int off_sio
;
812 static u_int off_opc
;
813 static u_int off_dpc
;
814 static u_int off_sls
;
817 * This is the offset of the first byte after the ATM pseudo_header,
818 * or -1 if there is no ATM pseudo-header.
820 static u_int off_payload
;
823 * These are offsets to the beginning of the network-layer header.
824 * They are relative to the beginning of the MAC-layer payload (i.e.,
825 * they don't include off_ll or off_macpl).
827 * If the link layer never uses 802.2 LLC:
829 * "off_nl" and "off_nl_nosnap" are the same.
831 * If the link layer always uses 802.2 LLC:
833 * "off_nl" is the offset if there's a SNAP header following
836 * "off_nl_nosnap" is the offset if there's no SNAP header.
838 * If the link layer is Ethernet:
840 * "off_nl" is the offset if the packet is an Ethernet II packet
841 * (we assume no 802.3+802.2+SNAP);
843 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet
844 * with an 802.2 header following it.
847 static u_int off_nl_nosnap
;
855 linktype
= pcap_datalink(p
);
857 pcap_fddipad
= p
->fddipad
;
861 * Assume it's not raw ATM with a pseudo-header, for now.
872 * And that we're not doing PPPoE.
877 * And assume we're not doing SS7.
886 * Also assume it's not 802.11.
890 off_macpl_is_variable
= 0;
894 label_stack_depth
= 0;
904 off_nl
= 0; /* XXX in reality, variable! */
905 off_nl_nosnap
= 0; /* no 802.2 LLC */
908 case DLT_ARCNET_LINUX
:
911 off_nl
= 0; /* XXX in reality, variable! */
912 off_nl_nosnap
= 0; /* no 802.2 LLC */
917 off_macpl
= 14; /* Ethernet header length */
918 off_nl
= 0; /* Ethernet II */
919 off_nl_nosnap
= 3; /* 802.3+802.2 */
924 * SLIP doesn't have a link level type. The 16 byte
925 * header is hacked into our SLIP driver.
930 off_nl_nosnap
= 0; /* no 802.2 LLC */
934 /* XXX this may be the same as the DLT_PPP_BSDOS case */
939 off_nl_nosnap
= 0; /* no 802.2 LLC */
947 off_nl_nosnap
= 0; /* no 802.2 LLC */
954 off_nl_nosnap
= 0; /* no 802.2 LLC */
959 case DLT_C_HDLC
: /* BSD/OS Cisco HDLC */
960 case DLT_PPP_SERIAL
: /* NetBSD sync/async serial PPP */
964 off_nl_nosnap
= 0; /* no 802.2 LLC */
969 * This does no include the Ethernet header, and
970 * only covers session state.
975 off_nl_nosnap
= 0; /* no 802.2 LLC */
982 off_nl_nosnap
= 0; /* no 802.2 LLC */
987 * FDDI doesn't really have a link-level type field.
988 * We set "off_linktype" to the offset of the LLC header.
990 * To check for Ethernet types, we assume that SSAP = SNAP
991 * is being used and pick out the encapsulated Ethernet type.
992 * XXX - should we generate code to check for SNAP?
996 off_linktype
+= pcap_fddipad
;
998 off_macpl
= 13; /* FDDI MAC header length */
1000 off_macpl
+= pcap_fddipad
;
1002 off_nl
= 8; /* 802.2+SNAP */
1003 off_nl_nosnap
= 3; /* 802.2 */
1008 * Token Ring doesn't really have a link-level type field.
1009 * We set "off_linktype" to the offset of the LLC header.
1011 * To check for Ethernet types, we assume that SSAP = SNAP
1012 * is being used and pick out the encapsulated Ethernet type.
1013 * XXX - should we generate code to check for SNAP?
1015 * XXX - the header is actually variable-length.
1016 * Some various Linux patched versions gave 38
1017 * as "off_linktype" and 40 as "off_nl"; however,
1018 * if a token ring packet has *no* routing
1019 * information, i.e. is not source-routed, the correct
1020 * values are 20 and 22, as they are in the vanilla code.
1022 * A packet is source-routed iff the uppermost bit
1023 * of the first byte of the source address, at an
1024 * offset of 8, has the uppermost bit set. If the
1025 * packet is source-routed, the total number of bytes
1026 * of routing information is 2 plus bits 0x1F00 of
1027 * the 16-bit value at an offset of 14 (shifted right
1028 * 8 - figure out which byte that is).
1031 off_macpl
= 14; /* Token Ring MAC header length */
1032 off_nl
= 8; /* 802.2+SNAP */
1033 off_nl_nosnap
= 3; /* 802.2 */
1036 case DLT_IEEE802_11
:
1037 case DLT_PRISM_HEADER
:
1038 case DLT_IEEE802_11_RADIO_AVS
:
1039 case DLT_IEEE802_11_RADIO
:
1041 * 802.11 doesn't really have a link-level type field.
1042 * We set "off_linktype" to the offset of the LLC header.
1044 * To check for Ethernet types, we assume that SSAP = SNAP
1045 * is being used and pick out the encapsulated Ethernet type.
1046 * XXX - should we generate code to check for SNAP?
1048 * We also handle variable-length radio headers here.
1049 * The Prism header is in theory variable-length, but in
1050 * practice it's always 144 bytes long. However, some
1051 * drivers on Linux use ARPHRD_IEEE80211_PRISM, but
1052 * sometimes or always supply an AVS header, so we
1053 * have to check whether the radio header is a Prism
1054 * header or an AVS header, so, in practice, it's
1058 off_macpl
= 0; /* link-layer header is variable-length */
1059 off_macpl_is_variable
= 1;
1060 off_nl
= 8; /* 802.2+SNAP */
1061 off_nl_nosnap
= 3; /* 802.2 */
1066 * At the moment we treat PPI the same way that we treat
1067 * normal Radiotap encoded packets. The difference is in
1068 * the function that generates the code at the beginning
1069 * to compute the header length. Since this code generator
1070 * of PPI supports bare 802.11 encapsulation only (i.e.
1071 * the encapsulated DLT should be DLT_IEEE802_11) we
1072 * generate code to check for this too.
1075 off_macpl
= 0; /* link-layer header is variable-length */
1076 off_macpl_is_variable
= 1;
1077 off_nl
= 8; /* 802.2+SNAP */
1078 off_nl_nosnap
= 3; /* 802.2 */
1081 case DLT_ATM_RFC1483
:
1082 case DLT_ATM_CLIP
: /* Linux ATM defines this */
1084 * assume routed, non-ISO PDUs
1085 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
1087 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS,
1088 * or PPP with the PPP NLPID (e.g., PPPoA)? The
1089 * latter would presumably be treated the way PPPoE
1090 * should be, so you can do "pppoe and udp port 2049"
1091 * or "pppoa and tcp port 80" and have it check for
1092 * PPPo{A,E} and a PPP protocol of IP and....
1095 off_macpl
= 0; /* packet begins with LLC header */
1096 off_nl
= 8; /* 802.2+SNAP */
1097 off_nl_nosnap
= 3; /* 802.2 */
1102 * Full Frontal ATM; you get AALn PDUs with an ATM
1106 off_vpi
= SUNATM_VPI_POS
;
1107 off_vci
= SUNATM_VCI_POS
;
1108 off_proto
= PROTO_POS
;
1109 off_mac
= -1; /* assume LLC-encapsulated, so no MAC-layer header */
1110 off_payload
= SUNATM_PKT_BEGIN_POS
;
1111 off_linktype
= off_payload
;
1112 off_macpl
= off_payload
; /* if LLC-encapsulated */
1113 off_nl
= 8; /* 802.2+SNAP */
1114 off_nl_nosnap
= 3; /* 802.2 */
1121 off_nl_nosnap
= 0; /* no 802.2 LLC */
1124 case DLT_LINUX_SLL
: /* fake header for Linux cooked socket */
1128 off_nl_nosnap
= 0; /* no 802.2 LLC */
1133 * LocalTalk does have a 1-byte type field in the LLAP header,
1134 * but really it just indicates whether there is a "short" or
1135 * "long" DDP packet following.
1140 off_nl_nosnap
= 0; /* no 802.2 LLC */
1143 case DLT_IP_OVER_FC
:
1145 * RFC 2625 IP-over-Fibre-Channel doesn't really have a
1146 * link-level type field. We set "off_linktype" to the
1147 * offset of the LLC header.
1149 * To check for Ethernet types, we assume that SSAP = SNAP
1150 * is being used and pick out the encapsulated Ethernet type.
1151 * XXX - should we generate code to check for SNAP? RFC
1152 * 2625 says SNAP should be used.
1156 off_nl
= 8; /* 802.2+SNAP */
1157 off_nl_nosnap
= 3; /* 802.2 */
1162 * XXX - we should set this to handle SNAP-encapsulated
1163 * frames (NLPID of 0x80).
1168 off_nl_nosnap
= 0; /* no 802.2 LLC */
1172 * the only BPF-interesting FRF.16 frames are non-control frames;
1173 * Frame Relay has a variable length link-layer
1174 * so lets start with offset 4 for now and increments later on (FIXME);
1180 off_nl_nosnap
= 0; /* XXX - for now -> no 802.2 LLC */
1183 case DLT_APPLE_IP_OVER_IEEE1394
:
1187 off_nl_nosnap
= 0; /* no 802.2 LLC */
1190 case DLT_LINUX_IRDA
:
1192 * Currently, only raw "link[N:M]" filtering is supported.
1202 * Currently, only raw "link[N:M]" filtering is supported.
1210 case DLT_SYMANTEC_FIREWALL
:
1213 off_nl
= 0; /* Ethernet II */
1214 off_nl_nosnap
= 0; /* XXX - what does it do with 802.3 packets? */
1217 #ifdef HAVE_NET_PFVAR_H
1220 off_macpl
= PFLOG_HDRLEN
;
1222 off_nl_nosnap
= 0; /* no 802.2 LLC */
1226 case DLT_JUNIPER_MFR
:
1227 case DLT_JUNIPER_MLFR
:
1228 case DLT_JUNIPER_MLPPP
:
1229 case DLT_JUNIPER_PPP
:
1230 case DLT_JUNIPER_CHDLC
:
1231 case DLT_JUNIPER_FRELAY
:
1235 off_nl_nosnap
= -1; /* no 802.2 LLC */
1238 case DLT_JUNIPER_ATM1
:
1239 off_linktype
= 4; /* in reality variable between 4-8 */
1240 off_macpl
= 4; /* in reality variable between 4-8 */
1245 case DLT_JUNIPER_ATM2
:
1246 off_linktype
= 8; /* in reality variable between 8-12 */
1247 off_macpl
= 8; /* in reality variable between 8-12 */
1252 /* frames captured on a Juniper PPPoE service PIC
1253 * contain raw ethernet frames */
1254 case DLT_JUNIPER_PPPOE
:
1255 case DLT_JUNIPER_ETHER
:
1258 off_nl
= 18; /* Ethernet II */
1259 off_nl_nosnap
= 21; /* 802.3+802.2 */
1262 case DLT_JUNIPER_PPPOE_ATM
:
1266 off_nl_nosnap
= -1; /* no 802.2 LLC */
1269 case DLT_JUNIPER_GGSN
:
1273 off_nl_nosnap
= -1; /* no 802.2 LLC */
1276 case DLT_JUNIPER_ES
:
1278 off_macpl
= -1; /* not really a network layer but raw IP addresses */
1279 off_nl
= -1; /* not really a network layer but raw IP addresses */
1280 off_nl_nosnap
= -1; /* no 802.2 LLC */
1283 case DLT_JUNIPER_MONITOR
:
1286 off_nl
= 0; /* raw IP/IP6 header */
1287 off_nl_nosnap
= -1; /* no 802.2 LLC */
1290 case DLT_JUNIPER_SERVICES
:
1292 off_macpl
= -1; /* L3 proto location dep. on cookie type */
1293 off_nl
= -1; /* L3 proto location dep. on cookie type */
1294 off_nl_nosnap
= -1; /* no 802.2 LLC */
1297 case DLT_JUNIPER_VP
:
1304 case DLT_JUNIPER_ST
:
1311 case DLT_JUNIPER_ISM
:
1330 case DLT_MTP2_WITH_PHDR
:
1363 case DLT_LINUX_LAPD
:
1365 * Currently, only raw "link[N:M]" filtering is supported.
1375 * Currently, only raw "link[N:M]" filtering is supported.
1383 case DLT_BLUETOOTH_HCI_H4
:
1385 * Currently, only raw "link[N:M]" filtering is supported.
1395 * Currently, only raw "link[N:M]" filtering is supported.
1405 * Currently, only raw "link[N:M]" filtering is supported.
1413 case DLT_IEEE802_15_4_LINUX
:
1415 * Currently, only raw "link[N:M]" filtering is supported.
1423 case DLT_IEEE802_16_MAC_CPS_RADIO
:
1425 * Currently, only raw "link[N:M]" filtering is supported.
1433 case DLT_IEEE802_15_4
:
1435 * Currently, only raw "link[N:M]" filtering is supported.
1445 * Currently, only raw "link[N:M]" filtering is supported.
1455 * Currently, only raw "link[N:M]" filtering is supported.
1465 * Currently, only raw "link[N:M]" filtering is supported.
1473 case DLT_BLUETOOTH_HCI_H4_WITH_PHDR
:
1475 * Currently, only raw "link[N:M]" filtering is supported.
1485 * Currently, only raw "link[N:M]" filtering is supported.
1487 off_linktype
= -1; /* variable, min 15, max 71 steps of 7 */
1489 off_nl
= -1; /* variable, min 16, max 71 steps of 7 */
1490 off_nl_nosnap
= -1; /* no 802.2 LLC */
1491 off_mac
= 1; /* step over the kiss length byte */
1494 case DLT_IEEE802_15_4_NONASK_PHY
:
1496 * Currently, only raw "link[N:M]" filtering is supported.
1504 bpf_error("unknown data link type %d", linktype
);
1509 * Load a value relative to the beginning of the link-layer header.
1510 * The link-layer header doesn't necessarily begin at the beginning
1511 * of the packet data; there might be a variable-length prefix containing
1512 * radio information.
1514 static struct slist
*
1515 gen_load_llrel(offset
, size
)
1518 struct slist
*s
, *s2
;
1520 s
= gen_llprefixlen();
1523 * If "s" is non-null, it has code to arrange that the X register
1524 * contains the length of the prefix preceding the link-layer
1527 * Otherwise, the length of the prefix preceding the link-layer
1528 * header is "off_ll".
1532 * There's a variable-length prefix preceding the
1533 * link-layer header. "s" points to a list of statements
1534 * that put the length of that prefix into the X register.
1535 * do an indirect load, to use the X register as an offset.
1537 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1542 * There is no variable-length header preceding the
1543 * link-layer header; add in off_ll, which, if there's
1544 * a fixed-length header preceding the link-layer header,
1545 * is the length of that header.
1547 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1548 s
->s
.k
= offset
+ off_ll
;
1554 * Load a value relative to the beginning of the MAC-layer payload.
1556 static struct slist
*
1557 gen_load_macplrel(offset
, size
)
1560 struct slist
*s
, *s2
;
1562 s
= gen_off_macpl();
1565 * If s is non-null, the offset of the MAC-layer payload is
1566 * variable, and s points to a list of instructions that
1567 * arrange that the X register contains that offset.
1569 * Otherwise, the offset of the MAC-layer payload is constant,
1570 * and is in off_macpl.
1574 * The offset of the MAC-layer payload is in the X
1575 * register. Do an indirect load, to use the X register
1578 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1583 * The offset of the MAC-layer payload is constant,
1584 * and is in off_macpl; load the value at that offset
1585 * plus the specified offset.
1587 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1588 s
->s
.k
= off_macpl
+ offset
;
1594 * Load a value relative to the beginning of the specified header.
1596 static struct slist
*
1597 gen_load_a(offrel
, offset
, size
)
1598 enum e_offrel offrel
;
1601 struct slist
*s
, *s2
;
1606 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1611 s
= gen_load_llrel(offset
, size
);
1615 s
= gen_load_macplrel(offset
, size
);
1619 s
= gen_load_macplrel(off_nl
+ offset
, size
);
1623 s
= gen_load_macplrel(off_nl_nosnap
+ offset
, size
);
1628 * Load the X register with the length of the IPv4 header
1629 * (plus the offset of the link-layer header, if it's
1630 * preceded by a variable-length header such as a radio
1631 * header), in bytes.
1633 s
= gen_loadx_iphdrlen();
1636 * Load the item at {offset of the MAC-layer payload} +
1637 * {offset, relative to the start of the MAC-layer
1638 * paylod, of the IPv4 header} + {length of the IPv4 header} +
1639 * {specified offset}.
1641 * (If the offset of the MAC-layer payload is variable,
1642 * it's included in the value in the X register, and
1645 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1646 s2
->s
.k
= off_macpl
+ off_nl
+ offset
;
1651 s
= gen_load_macplrel(off_nl
+ 40 + offset
, size
);
1662 * Generate code to load into the X register the sum of the length of
1663 * the IPv4 header and any variable-length header preceding the link-layer
1666 static struct slist
*
1667 gen_loadx_iphdrlen()
1669 struct slist
*s
, *s2
;
1671 s
= gen_off_macpl();
1674 * There's a variable-length prefix preceding the
1675 * link-layer header, or the link-layer header is itself
1676 * variable-length. "s" points to a list of statements
1677 * that put the offset of the MAC-layer payload into
1680 * The 4*([k]&0xf) addressing mode can't be used, as we
1681 * don't have a constant offset, so we have to load the
1682 * value in question into the A register and add to it
1683 * the value from the X register.
1685 s2
= new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
1688 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
1691 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
1696 * The A register now contains the length of the
1697 * IP header. We need to add to it the offset of
1698 * the MAC-layer payload, which is still in the X
1699 * register, and move the result into the X register.
1701 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
1702 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
1705 * There is no variable-length header preceding the
1706 * link-layer header, and the link-layer header is
1707 * fixed-length; load the length of the IPv4 header,
1708 * which is at an offset of off_nl from the beginning
1709 * of the MAC-layer payload, and thus at an offset
1710 * of off_mac_pl + off_nl from the beginning of the
1713 s
= new_stmt(BPF_LDX
|BPF_MSH
|BPF_B
);
1714 s
->s
.k
= off_macpl
+ off_nl
;
1719 static struct block
*
1726 s
= new_stmt(BPF_LD
|BPF_IMM
);
1728 b
= new_block(JMP(BPF_JEQ
));
1734 static inline struct block
*
1737 return gen_uncond(1);
1740 static inline struct block
*
1743 return gen_uncond(0);
1747 * Byte-swap a 32-bit number.
1748 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
1749 * big-endian platforms.)
1751 #define SWAPLONG(y) \
1752 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
1755 * Generate code to match a particular packet type.
1757 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1758 * value, if <= ETHERMTU. We use that to determine whether to
1759 * match the type/length field or to check the type/length field for
1760 * a value <= ETHERMTU to see whether it's a type field and then do
1761 * the appropriate test.
1763 static struct block
*
1764 gen_ether_linktype(proto
)
1767 struct block
*b0
, *b1
;
1773 case LLCSAP_NETBEUI
:
1775 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1776 * so we check the DSAP and SSAP.
1778 * LLCSAP_IP checks for IP-over-802.2, rather
1779 * than IP-over-Ethernet or IP-over-SNAP.
1781 * XXX - should we check both the DSAP and the
1782 * SSAP, like this, or should we check just the
1783 * DSAP, as we do for other types <= ETHERMTU
1784 * (i.e., other SAP values)?
1786 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1788 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)
1789 ((proto
<< 8) | proto
));
1797 * Ethernet_II frames, which are Ethernet
1798 * frames with a frame type of ETHERTYPE_IPX;
1800 * Ethernet_802.3 frames, which are 802.3
1801 * frames (i.e., the type/length field is
1802 * a length field, <= ETHERMTU, rather than
1803 * a type field) with the first two bytes
1804 * after the Ethernet/802.3 header being
1807 * Ethernet_802.2 frames, which are 802.3
1808 * frames with an 802.2 LLC header and
1809 * with the IPX LSAP as the DSAP in the LLC
1812 * Ethernet_SNAP frames, which are 802.3
1813 * frames with an LLC header and a SNAP
1814 * header and with an OUI of 0x000000
1815 * (encapsulated Ethernet) and a protocol
1816 * ID of ETHERTYPE_IPX in the SNAP header.
1818 * XXX - should we generate the same code both
1819 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
1823 * This generates code to check both for the
1824 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
1826 b0
= gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)LLCSAP_IPX
);
1827 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)0xFFFF);
1831 * Now we add code to check for SNAP frames with
1832 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
1834 b0
= gen_snap(0x000000, ETHERTYPE_IPX
);
1838 * Now we generate code to check for 802.3
1839 * frames in general.
1841 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1845 * Now add the check for 802.3 frames before the
1846 * check for Ethernet_802.2 and Ethernet_802.3,
1847 * as those checks should only be done on 802.3
1848 * frames, not on Ethernet frames.
1853 * Now add the check for Ethernet_II frames, and
1854 * do that before checking for the other frame
1857 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
1858 (bpf_int32
)ETHERTYPE_IPX
);
1862 case ETHERTYPE_ATALK
:
1863 case ETHERTYPE_AARP
:
1865 * EtherTalk (AppleTalk protocols on Ethernet link
1866 * layer) may use 802.2 encapsulation.
1870 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1871 * we check for an Ethernet type field less than
1872 * 1500, which means it's an 802.3 length field.
1874 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1878 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1879 * SNAP packets with an organization code of
1880 * 0x080007 (Apple, for Appletalk) and a protocol
1881 * type of ETHERTYPE_ATALK (Appletalk).
1883 * 802.2-encapsulated ETHERTYPE_AARP packets are
1884 * SNAP packets with an organization code of
1885 * 0x000000 (encapsulated Ethernet) and a protocol
1886 * type of ETHERTYPE_AARP (Appletalk ARP).
1888 if (proto
== ETHERTYPE_ATALK
)
1889 b1
= gen_snap(0x080007, ETHERTYPE_ATALK
);
1890 else /* proto == ETHERTYPE_AARP */
1891 b1
= gen_snap(0x000000, ETHERTYPE_AARP
);
1895 * Check for Ethernet encapsulation (Ethertalk
1896 * phase 1?); we just check for the Ethernet
1899 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
1905 if (proto
<= ETHERMTU
) {
1907 * This is an LLC SAP value, so the frames
1908 * that match would be 802.2 frames.
1909 * Check that the frame is an 802.2 frame
1910 * (i.e., that the length/type field is
1911 * a length field, <= ETHERMTU) and
1912 * then check the DSAP.
1914 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1916 b1
= gen_cmp(OR_LINK
, off_linktype
+ 2, BPF_B
,
1922 * This is an Ethernet type, so compare
1923 * the length/type field with it (if
1924 * the frame is an 802.2 frame, the length
1925 * field will be <= ETHERMTU, and, as
1926 * "proto" is > ETHERMTU, this test
1927 * will fail and the frame won't match,
1928 * which is what we want).
1930 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
1937 * Generate code to match a particular packet type.
1939 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1940 * value, if <= ETHERMTU. We use that to determine whether to
1941 * match the type field or to check the type field for the special
1942 * LINUX_SLL_P_802_2 value and then do the appropriate test.
1944 static struct block
*
1945 gen_linux_sll_linktype(proto
)
1948 struct block
*b0
, *b1
;
1954 case LLCSAP_NETBEUI
:
1956 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1957 * so we check the DSAP and SSAP.
1959 * LLCSAP_IP checks for IP-over-802.2, rather
1960 * than IP-over-Ethernet or IP-over-SNAP.
1962 * XXX - should we check both the DSAP and the
1963 * SSAP, like this, or should we check just the
1964 * DSAP, as we do for other types <= ETHERMTU
1965 * (i.e., other SAP values)?
1967 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
1968 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)
1969 ((proto
<< 8) | proto
));
1975 * Ethernet_II frames, which are Ethernet
1976 * frames with a frame type of ETHERTYPE_IPX;
1978 * Ethernet_802.3 frames, which have a frame
1979 * type of LINUX_SLL_P_802_3;
1981 * Ethernet_802.2 frames, which are 802.3
1982 * frames with an 802.2 LLC header (i.e, have
1983 * a frame type of LINUX_SLL_P_802_2) and
1984 * with the IPX LSAP as the DSAP in the LLC
1987 * Ethernet_SNAP frames, which are 802.3
1988 * frames with an LLC header and a SNAP
1989 * header and with an OUI of 0x000000
1990 * (encapsulated Ethernet) and a protocol
1991 * ID of ETHERTYPE_IPX in the SNAP header.
1993 * First, do the checks on LINUX_SLL_P_802_2
1994 * frames; generate the check for either
1995 * Ethernet_802.2 or Ethernet_SNAP frames, and
1996 * then put a check for LINUX_SLL_P_802_2 frames
1999 b0
= gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)LLCSAP_IPX
);
2000 b1
= gen_snap(0x000000, ETHERTYPE_IPX
);
2002 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
2006 * Now check for 802.3 frames and OR that with
2007 * the previous test.
2009 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_3
);
2013 * Now add the check for Ethernet_II frames, and
2014 * do that before checking for the other frame
2017 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2018 (bpf_int32
)ETHERTYPE_IPX
);
2022 case ETHERTYPE_ATALK
:
2023 case ETHERTYPE_AARP
:
2025 * EtherTalk (AppleTalk protocols on Ethernet link
2026 * layer) may use 802.2 encapsulation.
2030 * Check for 802.2 encapsulation (EtherTalk phase 2?);
2031 * we check for the 802.2 protocol type in the
2032 * "Ethernet type" field.
2034 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
2037 * 802.2-encapsulated ETHERTYPE_ATALK packets are
2038 * SNAP packets with an organization code of
2039 * 0x080007 (Apple, for Appletalk) and a protocol
2040 * type of ETHERTYPE_ATALK (Appletalk).
2042 * 802.2-encapsulated ETHERTYPE_AARP packets are
2043 * SNAP packets with an organization code of
2044 * 0x000000 (encapsulated Ethernet) and a protocol
2045 * type of ETHERTYPE_AARP (Appletalk ARP).
2047 if (proto
== ETHERTYPE_ATALK
)
2048 b1
= gen_snap(0x080007, ETHERTYPE_ATALK
);
2049 else /* proto == ETHERTYPE_AARP */
2050 b1
= gen_snap(0x000000, ETHERTYPE_AARP
);
2054 * Check for Ethernet encapsulation (Ethertalk
2055 * phase 1?); we just check for the Ethernet
2058 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
2064 if (proto
<= ETHERMTU
) {
2066 * This is an LLC SAP value, so the frames
2067 * that match would be 802.2 frames.
2068 * Check for the 802.2 protocol type
2069 * in the "Ethernet type" field, and
2070 * then check the DSAP.
2072 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2074 b1
= gen_cmp(OR_LINK
, off_macpl
, BPF_B
,
2080 * This is an Ethernet type, so compare
2081 * the length/type field with it (if
2082 * the frame is an 802.2 frame, the length
2083 * field will be <= ETHERMTU, and, as
2084 * "proto" is > ETHERMTU, this test
2085 * will fail and the frame won't match,
2086 * which is what we want).
2088 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2094 static struct slist
*
2095 gen_load_prism_llprefixlen()
2097 struct slist
*s1
, *s2
;
2098 struct slist
*sjeq_avs_cookie
;
2099 struct slist
*sjcommon
;
2102 * This code is not compatible with the optimizer, as
2103 * we are generating jmp instructions within a normal
2104 * slist of instructions
2109 * Generate code to load the length of the radio header into
2110 * the register assigned to hold that length, if one has been
2111 * assigned. (If one hasn't been assigned, no code we've
2112 * generated uses that prefix, so we don't need to generate any
2115 * Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes
2116 * or always use the AVS header rather than the Prism header.
2117 * We load a 4-byte big-endian value at the beginning of the
2118 * raw packet data, and see whether, when masked with 0xFFFFF000,
2119 * it's equal to 0x80211000. If so, that indicates that it's
2120 * an AVS header (the masked-out bits are the version number).
2121 * Otherwise, it's a Prism header.
2123 * XXX - the Prism header is also, in theory, variable-length,
2124 * but no known software generates headers that aren't 144
2127 if (reg_off_ll
!= -1) {
2131 s1
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2135 * AND it with 0xFFFFF000.
2137 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
2138 s2
->s
.k
= 0xFFFFF000;
2142 * Compare with 0x80211000.
2144 sjeq_avs_cookie
= new_stmt(JMP(BPF_JEQ
));
2145 sjeq_avs_cookie
->s
.k
= 0x80211000;
2146 sappend(s1
, sjeq_avs_cookie
);
2151 * The 4 bytes at an offset of 4 from the beginning of
2152 * the AVS header are the length of the AVS header.
2153 * That field is big-endian.
2155 s2
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2158 sjeq_avs_cookie
->s
.jt
= s2
;
2161 * Now jump to the code to allocate a register
2162 * into which to save the header length and
2163 * store the length there. (The "jump always"
2164 * instruction needs to have the k field set;
2165 * it's added to the PC, so, as we're jumping
2166 * over a single instruction, it should be 1.)
2168 sjcommon
= new_stmt(JMP(BPF_JA
));
2170 sappend(s1
, sjcommon
);
2173 * Now for the code that handles the Prism header.
2174 * Just load the length of the Prism header (144)
2175 * into the A register. Have the test for an AVS
2176 * header branch here if we don't have an AVS header.
2178 s2
= new_stmt(BPF_LD
|BPF_W
|BPF_IMM
);
2181 sjeq_avs_cookie
->s
.jf
= s2
;
2184 * Now allocate a register to hold that value and store
2185 * it. The code for the AVS header will jump here after
2186 * loading the length of the AVS header.
2188 s2
= new_stmt(BPF_ST
);
2189 s2
->s
.k
= reg_off_ll
;
2191 sjcommon
->s
.jf
= s2
;
2194 * Now move it into the X register.
2196 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2204 static struct slist
*
2205 gen_load_avs_llprefixlen()
2207 struct slist
*s1
, *s2
;
2210 * Generate code to load the length of the AVS header into
2211 * the register assigned to hold that length, if one has been
2212 * assigned. (If one hasn't been assigned, no code we've
2213 * generated uses that prefix, so we don't need to generate any
2216 if (reg_off_ll
!= -1) {
2218 * The 4 bytes at an offset of 4 from the beginning of
2219 * the AVS header are the length of the AVS header.
2220 * That field is big-endian.
2222 s1
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2226 * Now allocate a register to hold that value and store
2229 s2
= new_stmt(BPF_ST
);
2230 s2
->s
.k
= reg_off_ll
;
2234 * Now move it into the X register.
2236 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2244 static struct slist
*
2245 gen_load_radiotap_llprefixlen()
2247 struct slist
*s1
, *s2
;
2250 * Generate code to load the length of the radiotap header into
2251 * the register assigned to hold that length, if one has been
2252 * assigned. (If one hasn't been assigned, no code we've
2253 * generated uses that prefix, so we don't need to generate any
2256 if (reg_off_ll
!= -1) {
2258 * The 2 bytes at offsets of 2 and 3 from the beginning
2259 * of the radiotap header are the length of the radiotap
2260 * header; unfortunately, it's little-endian, so we have
2261 * to load it a byte at a time and construct the value.
2265 * Load the high-order byte, at an offset of 3, shift it
2266 * left a byte, and put the result in the X register.
2268 s1
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2270 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
2273 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2277 * Load the next byte, at an offset of 2, and OR the
2278 * value from the X register into it.
2280 s2
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2283 s2
= new_stmt(BPF_ALU
|BPF_OR
|BPF_X
);
2287 * Now allocate a register to hold that value and store
2290 s2
= new_stmt(BPF_ST
);
2291 s2
->s
.k
= reg_off_ll
;
2295 * Now move it into the X register.
2297 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2306 * At the moment we treat PPI as normal Radiotap encoded
2307 * packets. The difference is in the function that generates
2308 * the code at the beginning to compute the header length.
2309 * Since this code generator of PPI supports bare 802.11
2310 * encapsulation only (i.e. the encapsulated DLT should be
2311 * DLT_IEEE802_11) we generate code to check for this too;
2312 * that's done in finish_parse().
2314 static struct slist
*
2315 gen_load_ppi_llprefixlen()
2317 struct slist
*s1
, *s2
;
2320 * Generate code to load the length of the radiotap header
2321 * into the register assigned to hold that length, if one has
2324 if (reg_off_ll
!= -1) {
2326 * The 2 bytes at offsets of 2 and 3 from the beginning
2327 * of the radiotap header are the length of the radiotap
2328 * header; unfortunately, it's little-endian, so we have
2329 * to load it a byte at a time and construct the value.
2333 * Load the high-order byte, at an offset of 3, shift it
2334 * left a byte, and put the result in the X register.
2336 s1
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2338 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
2341 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2345 * Load the next byte, at an offset of 2, and OR the
2346 * value from the X register into it.
2348 s2
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2351 s2
= new_stmt(BPF_ALU
|BPF_OR
|BPF_X
);
2355 * Now allocate a register to hold that value and store
2358 s2
= new_stmt(BPF_ST
);
2359 s2
->s
.k
= reg_off_ll
;
2363 * Now move it into the X register.
2365 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2374 * Load a value relative to the beginning of the link-layer header after the 802.11
2375 * header, i.e. LLC_SNAP.
2376 * The link-layer header doesn't necessarily begin at the beginning
2377 * of the packet data; there might be a variable-length prefix containing
2378 * radio information.
2380 static struct slist
*
2381 gen_load_802_11_header_len(struct slist
*s
, struct slist
*snext
)
2384 struct slist
*sjset_data_frame_1
;
2385 struct slist
*sjset_data_frame_2
;
2386 struct slist
*sjset_qos
;
2387 struct slist
*sjset_radiotap_flags
;
2388 struct slist
*sjset_radiotap_tsft
;
2389 struct slist
*sjset_tsft_datapad
, *sjset_notsft_datapad
;
2390 struct slist
*s_roundup
;
2392 if (reg_off_macpl
== -1) {
2394 * No register has been assigned to the offset of
2395 * the MAC-layer payload, which means nobody needs
2396 * it; don't bother computing it - just return
2397 * what we already have.
2403 * This code is not compatible with the optimizer, as
2404 * we are generating jmp instructions within a normal
2405 * slist of instructions
2410 * If "s" is non-null, it has code to arrange that the X register
2411 * contains the length of the prefix preceding the link-layer
2414 * Otherwise, the length of the prefix preceding the link-layer
2415 * header is "off_ll".
2419 * There is no variable-length header preceding the
2420 * link-layer header.
2422 * Load the length of the fixed-length prefix preceding
2423 * the link-layer header (if any) into the X register,
2424 * and store it in the reg_off_macpl register.
2425 * That length is off_ll.
2427 s
= new_stmt(BPF_LDX
|BPF_IMM
);
2432 * The X register contains the offset of the beginning of the
2433 * link-layer header; add 24, which is the minimum length
2434 * of the MAC header for a data frame, to that, and store it
2435 * in reg_off_macpl, and then load the Frame Control field,
2436 * which is at the offset in the X register, with an indexed load.
2438 s2
= new_stmt(BPF_MISC
|BPF_TXA
);
2440 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
2443 s2
= new_stmt(BPF_ST
);
2444 s2
->s
.k
= reg_off_macpl
;
2447 s2
= new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
2452 * Check the Frame Control field to see if this is a data frame;
2453 * a data frame has the 0x08 bit (b3) in that field set and the
2454 * 0x04 bit (b2) clear.
2456 sjset_data_frame_1
= new_stmt(JMP(BPF_JSET
));
2457 sjset_data_frame_1
->s
.k
= 0x08;
2458 sappend(s
, sjset_data_frame_1
);
2461 * If b3 is set, test b2, otherwise go to the first statement of
2462 * the rest of the program.
2464 sjset_data_frame_1
->s
.jt
= sjset_data_frame_2
= new_stmt(JMP(BPF_JSET
));
2465 sjset_data_frame_2
->s
.k
= 0x04;
2466 sappend(s
, sjset_data_frame_2
);
2467 sjset_data_frame_1
->s
.jf
= snext
;
2470 * If b2 is not set, this is a data frame; test the QoS bit.
2471 * Otherwise, go to the first statement of the rest of the
2474 sjset_data_frame_2
->s
.jt
= snext
;
2475 sjset_data_frame_2
->s
.jf
= sjset_qos
= new_stmt(JMP(BPF_JSET
));
2476 sjset_qos
->s
.k
= 0x80; /* QoS bit */
2477 sappend(s
, sjset_qos
);
2480 * If it's set, add 2 to reg_off_macpl, to skip the QoS
2482 * Otherwise, go to the first statement of the rest of the
2485 sjset_qos
->s
.jt
= s2
= new_stmt(BPF_LD
|BPF_MEM
);
2486 s2
->s
.k
= reg_off_macpl
;
2488 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_IMM
);
2491 s2
= new_stmt(BPF_ST
);
2492 s2
->s
.k
= reg_off_macpl
;
2496 * If we have a radiotap header, look at it to see whether
2497 * there's Atheros padding between the MAC-layer header
2500 * Note: all of the fields in the radiotap header are
2501 * little-endian, so we byte-swap all of the values
2502 * we test against, as they will be loaded as big-endian
2505 if (linktype
== DLT_IEEE802_11_RADIO
) {
2507 * Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set
2508 * in the presence flag?
2510 sjset_qos
->s
.jf
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_W
);
2514 sjset_radiotap_flags
= new_stmt(JMP(BPF_JSET
));
2515 sjset_radiotap_flags
->s
.k
= SWAPLONG(0x00000002);
2516 sappend(s
, sjset_radiotap_flags
);
2519 * If not, skip all of this.
2521 sjset_radiotap_flags
->s
.jf
= snext
;
2524 * Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set?
2526 sjset_radiotap_tsft
= sjset_radiotap_flags
->s
.jt
=
2527 new_stmt(JMP(BPF_JSET
));
2528 sjset_radiotap_tsft
->s
.k
= SWAPLONG(0x00000001);
2529 sappend(s
, sjset_radiotap_tsft
);
2532 * If IEEE80211_RADIOTAP_TSFT is set, the flags field is
2533 * at an offset of 16 from the beginning of the raw packet
2534 * data (8 bytes for the radiotap header and 8 bytes for
2537 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2540 sjset_radiotap_tsft
->s
.jt
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
2544 sjset_tsft_datapad
= new_stmt(JMP(BPF_JSET
));
2545 sjset_tsft_datapad
->s
.k
= 0x20;
2546 sappend(s
, sjset_tsft_datapad
);
2549 * If IEEE80211_RADIOTAP_TSFT is not set, the flags field is
2550 * at an offset of 8 from the beginning of the raw packet
2551 * data (8 bytes for the radiotap header).
2553 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2556 sjset_radiotap_tsft
->s
.jf
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
2560 sjset_notsft_datapad
= new_stmt(JMP(BPF_JSET
));
2561 sjset_notsft_datapad
->s
.k
= 0x20;
2562 sappend(s
, sjset_notsft_datapad
);
2565 * In either case, if IEEE80211_RADIOTAP_F_DATAPAD is
2566 * set, round the length of the 802.11 header to
2567 * a multiple of 4. Do that by adding 3 and then
2568 * dividing by and multiplying by 4, which we do by
2571 s_roundup
= new_stmt(BPF_LD
|BPF_MEM
);
2572 s_roundup
->s
.k
= reg_off_macpl
;
2573 sappend(s
, s_roundup
);
2574 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_IMM
);
2577 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_IMM
);
2580 s2
= new_stmt(BPF_ST
);
2581 s2
->s
.k
= reg_off_macpl
;
2584 sjset_tsft_datapad
->s
.jt
= s_roundup
;
2585 sjset_tsft_datapad
->s
.jf
= snext
;
2586 sjset_notsft_datapad
->s
.jt
= s_roundup
;
2587 sjset_notsft_datapad
->s
.jf
= snext
;
2589 sjset_qos
->s
.jf
= snext
;
2595 insert_compute_vloffsets(b
)
2601 * For link-layer types that have a variable-length header
2602 * preceding the link-layer header, generate code to load
2603 * the offset of the link-layer header into the register
2604 * assigned to that offset, if any.
2608 case DLT_PRISM_HEADER
:
2609 s
= gen_load_prism_llprefixlen();
2612 case DLT_IEEE802_11_RADIO_AVS
:
2613 s
= gen_load_avs_llprefixlen();
2616 case DLT_IEEE802_11_RADIO
:
2617 s
= gen_load_radiotap_llprefixlen();
2621 s
= gen_load_ppi_llprefixlen();
2630 * For link-layer types that have a variable-length link-layer
2631 * header, generate code to load the offset of the MAC-layer
2632 * payload into the register assigned to that offset, if any.
2636 case DLT_IEEE802_11
:
2637 case DLT_PRISM_HEADER
:
2638 case DLT_IEEE802_11_RADIO_AVS
:
2639 case DLT_IEEE802_11_RADIO
:
2641 s
= gen_load_802_11_header_len(s
, b
->stmts
);
2646 * If we have any offset-loading code, append all the
2647 * existing statements in the block to those statements,
2648 * and make the resulting list the list of statements
2652 sappend(s
, b
->stmts
);
2657 static struct block
*
2658 gen_ppi_dlt_check(void)
2660 struct slist
*s_load_dlt
;
2663 if (linktype
== DLT_PPI
)
2665 /* Create the statements that check for the DLT
2667 s_load_dlt
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2668 s_load_dlt
->s
.k
= 4;
2670 b
= new_block(JMP(BPF_JEQ
));
2672 b
->stmts
= s_load_dlt
;
2673 b
->s
.k
= SWAPLONG(DLT_IEEE802_11
);
2683 static struct slist
*
2684 gen_prism_llprefixlen(void)
2688 if (reg_off_ll
== -1) {
2690 * We haven't yet assigned a register for the length
2691 * of the radio header; allocate one.
2693 reg_off_ll
= alloc_reg();
2697 * Load the register containing the radio length
2698 * into the X register.
2700 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2701 s
->s
.k
= reg_off_ll
;
2705 static struct slist
*
2706 gen_avs_llprefixlen(void)
2710 if (reg_off_ll
== -1) {
2712 * We haven't yet assigned a register for the length
2713 * of the AVS header; allocate one.
2715 reg_off_ll
= alloc_reg();
2719 * Load the register containing the AVS length
2720 * into the X register.
2722 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2723 s
->s
.k
= reg_off_ll
;
2727 static struct slist
*
2728 gen_radiotap_llprefixlen(void)
2732 if (reg_off_ll
== -1) {
2734 * We haven't yet assigned a register for the length
2735 * of the radiotap header; allocate one.
2737 reg_off_ll
= alloc_reg();
2741 * Load the register containing the radiotap length
2742 * into the X register.
2744 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2745 s
->s
.k
= reg_off_ll
;
2750 * At the moment we treat PPI as normal Radiotap encoded
2751 * packets. The difference is in the function that generates
2752 * the code at the beginning to compute the header length.
2753 * Since this code generator of PPI supports bare 802.11
2754 * encapsulation only (i.e. the encapsulated DLT should be
2755 * DLT_IEEE802_11) we generate code to check for this too.
2757 static struct slist
*
2758 gen_ppi_llprefixlen(void)
2762 if (reg_off_ll
== -1) {
2764 * We haven't yet assigned a register for the length
2765 * of the radiotap header; allocate one.
2767 reg_off_ll
= alloc_reg();
2771 * Load the register containing the PPI length
2772 * into the X register.
2774 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2775 s
->s
.k
= reg_off_ll
;
2780 * Generate code to compute the link-layer header length, if necessary,
2781 * putting it into the X register, and to return either a pointer to a
2782 * "struct slist" for the list of statements in that code, or NULL if
2783 * no code is necessary.
2785 static struct slist
*
2786 gen_llprefixlen(void)
2790 case DLT_PRISM_HEADER
:
2791 return gen_prism_llprefixlen();
2793 case DLT_IEEE802_11_RADIO_AVS
:
2794 return gen_avs_llprefixlen();
2796 case DLT_IEEE802_11_RADIO
:
2797 return gen_radiotap_llprefixlen();
2800 return gen_ppi_llprefixlen();
2808 * Generate code to load the register containing the offset of the
2809 * MAC-layer payload into the X register; if no register for that offset
2810 * has been allocated, allocate it first.
2812 static struct slist
*
2817 if (off_macpl_is_variable
) {
2818 if (reg_off_macpl
== -1) {
2820 * We haven't yet assigned a register for the offset
2821 * of the MAC-layer payload; allocate one.
2823 reg_off_macpl
= alloc_reg();
2827 * Load the register containing the offset of the MAC-layer
2828 * payload into the X register.
2830 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2831 s
->s
.k
= reg_off_macpl
;
2835 * That offset isn't variable, so we don't need to
2836 * generate any code.
2843 * Map an Ethernet type to the equivalent PPP type.
2846 ethertype_to_ppptype(proto
)
2856 case ETHERTYPE_IPV6
:
2865 case ETHERTYPE_ATALK
:
2879 * I'm assuming the "Bridging PDU"s that go
2880 * over PPP are Spanning Tree Protocol
2894 * Generate code to match a particular packet type by matching the
2895 * link-layer type field or fields in the 802.2 LLC header.
2897 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
2898 * value, if <= ETHERMTU.
2900 static struct block
*
2904 struct block
*b0
, *b1
, *b2
;
2906 /* are we checking MPLS-encapsulated packets? */
2907 if (label_stack_depth
> 0) {
2911 /* FIXME add other L3 proto IDs */
2912 return gen_mpls_linktype(Q_IP
);
2914 case ETHERTYPE_IPV6
:
2916 /* FIXME add other L3 proto IDs */
2917 return gen_mpls_linktype(Q_IPV6
);
2920 bpf_error("unsupported protocol over mpls");
2926 * Are we testing PPPoE packets?
2930 * The PPPoE session header is part of the
2931 * MAC-layer payload, so all references
2932 * should be relative to the beginning of
2937 * We use Ethernet protocol types inside libpcap;
2938 * map them to the corresponding PPP protocol types.
2940 proto
= ethertype_to_ppptype(proto
);
2941 return gen_cmp(OR_MACPL
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
2947 return gen_ether_linktype(proto
);
2955 proto
= (proto
<< 8 | LLCSAP_ISONS
);
2959 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2966 case DLT_IEEE802_11
:
2967 case DLT_PRISM_HEADER
:
2968 case DLT_IEEE802_11_RADIO_AVS
:
2969 case DLT_IEEE802_11_RADIO
:
2972 * Check that we have a data frame.
2974 b0
= gen_check_802_11_data_frame();
2977 * Now check for the specified link-layer type.
2979 b1
= gen_llc_linktype(proto
);
2987 * XXX - check for asynchronous frames, as per RFC 1103.
2989 return gen_llc_linktype(proto
);
2995 * XXX - check for LLC PDUs, as per IEEE 802.5.
2997 return gen_llc_linktype(proto
);
3001 case DLT_ATM_RFC1483
:
3003 case DLT_IP_OVER_FC
:
3004 return gen_llc_linktype(proto
);
3010 * If "is_lane" is set, check for a LANE-encapsulated
3011 * version of this protocol, otherwise check for an
3012 * LLC-encapsulated version of this protocol.
3014 * We assume LANE means Ethernet, not Token Ring.
3018 * Check that the packet doesn't begin with an
3019 * LE Control marker. (We've already generated
3022 b0
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
, BPF_H
,
3027 * Now generate an Ethernet test.
3029 b1
= gen_ether_linktype(proto
);
3034 * Check for LLC encapsulation and then check the
3037 b0
= gen_atmfield_code(A_PROTOTYPE
, PT_LLC
, BPF_JEQ
, 0);
3038 b1
= gen_llc_linktype(proto
);
3046 return gen_linux_sll_linktype(proto
);
3051 case DLT_SLIP_BSDOS
:
3054 * These types don't provide any type field; packets
3055 * are always IPv4 or IPv6.
3057 * XXX - for IPv4, check for a version number of 4, and,
3058 * for IPv6, check for a version number of 6?
3063 /* Check for a version number of 4. */
3064 return gen_mcmp(OR_LINK
, 0, BPF_B
, 0x40, 0xF0);
3066 case ETHERTYPE_IPV6
:
3067 /* Check for a version number of 6. */
3068 return gen_mcmp(OR_LINK
, 0, BPF_B
, 0x60, 0xF0);
3072 return gen_false(); /* always false */
3079 case DLT_PPP_SERIAL
:
3082 * We use Ethernet protocol types inside libpcap;
3083 * map them to the corresponding PPP protocol types.
3085 proto
= ethertype_to_ppptype(proto
);
3086 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
3092 * We use Ethernet protocol types inside libpcap;
3093 * map them to the corresponding PPP protocol types.
3099 * Also check for Van Jacobson-compressed IP.
3100 * XXX - do this for other forms of PPP?
3102 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_IP
);
3103 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_VJC
);
3105 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_VJNC
);
3110 proto
= ethertype_to_ppptype(proto
);
3111 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
3121 * For DLT_NULL, the link-layer header is a 32-bit
3122 * word containing an AF_ value in *host* byte order,
3123 * and for DLT_ENC, the link-layer header begins
3124 * with a 32-bit work containing an AF_ value in
3127 * In addition, if we're reading a saved capture file,
3128 * the host byte order in the capture may not be the
3129 * same as the host byte order on this machine.
3131 * For DLT_LOOP, the link-layer header is a 32-bit
3132 * word containing an AF_ value in *network* byte order.
3134 * XXX - AF_ values may, unfortunately, be platform-
3135 * dependent; for example, FreeBSD's AF_INET6 is 24
3136 * whilst NetBSD's and OpenBSD's is 26.
3138 * This means that, when reading a capture file, just
3139 * checking for our AF_INET6 value won't work if the
3140 * capture file came from another OS.
3149 case ETHERTYPE_IPV6
:
3156 * Not a type on which we support filtering.
3157 * XXX - support those that have AF_ values
3158 * #defined on this platform, at least?
3163 if (linktype
== DLT_NULL
|| linktype
== DLT_ENC
) {
3165 * The AF_ value is in host byte order, but
3166 * the BPF interpreter will convert it to
3167 * network byte order.
3169 * If this is a save file, and it's from a
3170 * machine with the opposite byte order to
3171 * ours, we byte-swap the AF_ value.
3173 * Then we run it through "htonl()", and
3174 * generate code to compare against the result.
3176 if (bpf_pcap
->sf
.rfile
!= NULL
&&
3177 bpf_pcap
->sf
.swapped
)
3178 proto
= SWAPLONG(proto
);
3179 proto
= htonl(proto
);
3181 return (gen_cmp(OR_LINK
, 0, BPF_W
, (bpf_int32
)proto
));
3183 #ifdef HAVE_NET_PFVAR_H
3186 * af field is host byte order in contrast to the rest of
3189 if (proto
== ETHERTYPE_IP
)
3190 return (gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, af
),
3191 BPF_B
, (bpf_int32
)AF_INET
));
3193 else if (proto
== ETHERTYPE_IPV6
)
3194 return (gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, af
),
3195 BPF_B
, (bpf_int32
)AF_INET6
));
3201 #endif /* HAVE_NET_PFVAR_H */
3204 case DLT_ARCNET_LINUX
:
3206 * XXX should we check for first fragment if the protocol
3215 case ETHERTYPE_IPV6
:
3216 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3217 (bpf_int32
)ARCTYPE_INET6
));
3221 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3222 (bpf_int32
)ARCTYPE_IP
);
3223 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3224 (bpf_int32
)ARCTYPE_IP_OLD
);
3229 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3230 (bpf_int32
)ARCTYPE_ARP
);
3231 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3232 (bpf_int32
)ARCTYPE_ARP_OLD
);
3236 case ETHERTYPE_REVARP
:
3237 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3238 (bpf_int32
)ARCTYPE_REVARP
));
3240 case ETHERTYPE_ATALK
:
3241 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3242 (bpf_int32
)ARCTYPE_ATALK
));
3249 case ETHERTYPE_ATALK
:
3259 * XXX - assumes a 2-byte Frame Relay header with
3260 * DLCI and flags. What if the address is longer?
3266 * Check for the special NLPID for IP.
3268 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | 0xcc);
3271 case ETHERTYPE_IPV6
:
3273 * Check for the special NLPID for IPv6.
3275 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | 0x8e);
3280 * Check for several OSI protocols.
3282 * Frame Relay packets typically have an OSI
3283 * NLPID at the beginning; we check for each
3286 * What we check for is the NLPID and a frame
3287 * control field of UI, i.e. 0x03 followed
3290 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO8473_CLNP
);
3291 b1
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO9542_ESIS
);
3292 b2
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO10589_ISIS
);
3304 bpf_error("Multi-link Frame Relay link-layer type filtering not implemented");
3306 case DLT_JUNIPER_MFR
:
3307 case DLT_JUNIPER_MLFR
:
3308 case DLT_JUNIPER_MLPPP
:
3309 case DLT_JUNIPER_ATM1
:
3310 case DLT_JUNIPER_ATM2
:
3311 case DLT_JUNIPER_PPPOE
:
3312 case DLT_JUNIPER_PPPOE_ATM
:
3313 case DLT_JUNIPER_GGSN
:
3314 case DLT_JUNIPER_ES
:
3315 case DLT_JUNIPER_MONITOR
:
3316 case DLT_JUNIPER_SERVICES
:
3317 case DLT_JUNIPER_ETHER
:
3318 case DLT_JUNIPER_PPP
:
3319 case DLT_JUNIPER_FRELAY
:
3320 case DLT_JUNIPER_CHDLC
:
3321 case DLT_JUNIPER_VP
:
3322 case DLT_JUNIPER_ST
:
3323 case DLT_JUNIPER_ISM
:
3324 /* just lets verify the magic number for now -
3325 * on ATM we may have up to 6 different encapsulations on the wire
3326 * and need a lot of heuristics to figure out that the payload
3329 * FIXME encapsulation specific BPF_ filters
3331 return gen_mcmp(OR_LINK
, 0, BPF_W
, 0x4d474300, 0xffffff00); /* compare the magic number */
3333 case DLT_LINUX_IRDA
:
3334 bpf_error("IrDA link-layer type filtering not implemented");
3337 bpf_error("DOCSIS link-layer type filtering not implemented");
3340 case DLT_MTP2_WITH_PHDR
:
3341 bpf_error("MTP2 link-layer type filtering not implemented");
3344 bpf_error("ERF link-layer type filtering not implemented");
3348 bpf_error("PFSYNC link-layer type filtering not implemented");
3351 case DLT_LINUX_LAPD
:
3352 bpf_error("LAPD link-layer type filtering not implemented");
3356 bpf_error("USB link-layer type filtering not implemented");
3358 case DLT_BLUETOOTH_HCI_H4
:
3359 case DLT_BLUETOOTH_HCI_H4_WITH_PHDR
:
3360 bpf_error("Bluetooth link-layer type filtering not implemented");
3363 bpf_error("CAN20B link-layer type filtering not implemented");
3365 case DLT_IEEE802_15_4
:
3366 case DLT_IEEE802_15_4_LINUX
:
3367 case DLT_IEEE802_15_4_NONASK_PHY
:
3368 bpf_error("IEEE 802.15.4 link-layer type filtering not implemented");
3370 case DLT_IEEE802_16_MAC_CPS_RADIO
:
3371 bpf_error("IEEE 802.16 link-layer type filtering not implemented");
3374 bpf_error("SITA link-layer type filtering not implemented");
3377 bpf_error("RAIF1 link-layer type filtering not implemented");
3380 bpf_error("IPMB link-layer type filtering not implemented");
3383 bpf_error("AX.25 link-layer type filtering not implemented");
3387 * All the types that have no encapsulation should either be
3388 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
3389 * all packets are IP packets, or should be handled in some
3390 * special case, if none of them are (if some are and some
3391 * aren't, the lack of encapsulation is a problem, as we'd
3392 * have to find some other way of determining the packet type).
3394 * Therefore, if "off_linktype" is -1, there's an error.
3396 if (off_linktype
== (u_int
)-1)
3400 * Any type not handled above should always have an Ethernet
3401 * type at an offset of "off_linktype".
3403 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
3407 * Check for an LLC SNAP packet with a given organization code and
3408 * protocol type; we check the entire contents of the 802.2 LLC and
3409 * snap headers, checking for DSAP and SSAP of SNAP and a control
3410 * field of 0x03 in the LLC header, and for the specified organization
3411 * code and protocol type in the SNAP header.
3413 static struct block
*
3414 gen_snap(orgcode
, ptype
)
3415 bpf_u_int32 orgcode
;
3418 u_char snapblock
[8];
3420 snapblock
[0] = LLCSAP_SNAP
; /* DSAP = SNAP */
3421 snapblock
[1] = LLCSAP_SNAP
; /* SSAP = SNAP */
3422 snapblock
[2] = 0x03; /* control = UI */
3423 snapblock
[3] = (orgcode
>> 16); /* upper 8 bits of organization code */
3424 snapblock
[4] = (orgcode
>> 8); /* middle 8 bits of organization code */
3425 snapblock
[5] = (orgcode
>> 0); /* lower 8 bits of organization code */
3426 snapblock
[6] = (ptype
>> 8); /* upper 8 bits of protocol type */
3427 snapblock
[7] = (ptype
>> 0); /* lower 8 bits of protocol type */
3428 return gen_bcmp(OR_MACPL
, 0, 8, snapblock
);
3432 * Generate code to match a particular packet type, for link-layer types
3433 * using 802.2 LLC headers.
3435 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used
3436 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues.
3438 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
3439 * value, if <= ETHERMTU. We use that to determine whether to
3440 * match the DSAP or both DSAP and LSAP or to check the OUI and
3441 * protocol ID in a SNAP header.
3443 static struct block
*
3444 gen_llc_linktype(proto
)
3448 * XXX - handle token-ring variable-length header.
3454 case LLCSAP_NETBEUI
:
3456 * XXX - should we check both the DSAP and the
3457 * SSAP, like this, or should we check just the
3458 * DSAP, as we do for other types <= ETHERMTU
3459 * (i.e., other SAP values)?
3461 return gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_u_int32
)
3462 ((proto
<< 8) | proto
));
3466 * XXX - are there ever SNAP frames for IPX on
3467 * non-Ethernet 802.x networks?
3469 return gen_cmp(OR_MACPL
, 0, BPF_B
,
3470 (bpf_int32
)LLCSAP_IPX
);
3472 case ETHERTYPE_ATALK
:
3474 * 802.2-encapsulated ETHERTYPE_ATALK packets are
3475 * SNAP packets with an organization code of
3476 * 0x080007 (Apple, for Appletalk) and a protocol
3477 * type of ETHERTYPE_ATALK (Appletalk).
3479 * XXX - check for an organization code of
3480 * encapsulated Ethernet as well?
3482 return gen_snap(0x080007, ETHERTYPE_ATALK
);
3486 * XXX - we don't have to check for IPX 802.3
3487 * here, but should we check for the IPX Ethertype?
3489 if (proto
<= ETHERMTU
) {
3491 * This is an LLC SAP value, so check
3494 return gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)proto
);
3497 * This is an Ethernet type; we assume that it's
3498 * unlikely that it'll appear in the right place
3499 * at random, and therefore check only the
3500 * location that would hold the Ethernet type
3501 * in a SNAP frame with an organization code of
3502 * 0x000000 (encapsulated Ethernet).
3504 * XXX - if we were to check for the SNAP DSAP and
3505 * LSAP, as per XXX, and were also to check for an
3506 * organization code of 0x000000 (encapsulated
3507 * Ethernet), we'd do
3509 * return gen_snap(0x000000, proto);
3511 * here; for now, we don't, as per the above.
3512 * I don't know whether it's worth the extra CPU
3513 * time to do the right check or not.
3515 return gen_cmp(OR_MACPL
, 6, BPF_H
, (bpf_int32
)proto
);
3520 static struct block
*
3521 gen_hostop(addr
, mask
, dir
, proto
, src_off
, dst_off
)
3525 u_int src_off
, dst_off
;
3527 struct block
*b0
, *b1
;
3541 b0
= gen_hostop(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3542 b1
= gen_hostop(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3548 b0
= gen_hostop(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3549 b1
= gen_hostop(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3556 b0
= gen_linktype(proto
);
3557 b1
= gen_mcmp(OR_NET
, offset
, BPF_W
, (bpf_int32
)addr
, mask
);
3563 static struct block
*
3564 gen_hostop6(addr
, mask
, dir
, proto
, src_off
, dst_off
)
3565 struct in6_addr
*addr
;
3566 struct in6_addr
*mask
;
3568 u_int src_off
, dst_off
;
3570 struct block
*b0
, *b1
;
3585 b0
= gen_hostop6(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3586 b1
= gen_hostop6(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3592 b0
= gen_hostop6(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3593 b1
= gen_hostop6(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3600 /* this order is important */
3601 a
= (u_int32_t
*)addr
;
3602 m
= (u_int32_t
*)mask
;
3603 b1
= gen_mcmp(OR_NET
, offset
+ 12, BPF_W
, ntohl(a
[3]), ntohl(m
[3]));
3604 b0
= gen_mcmp(OR_NET
, offset
+ 8, BPF_W
, ntohl(a
[2]), ntohl(m
[2]));
3606 b0
= gen_mcmp(OR_NET
, offset
+ 4, BPF_W
, ntohl(a
[1]), ntohl(m
[1]));
3608 b0
= gen_mcmp(OR_NET
, offset
+ 0, BPF_W
, ntohl(a
[0]), ntohl(m
[0]));
3610 b0
= gen_linktype(proto
);
3616 static struct block
*
3617 gen_ehostop(eaddr
, dir
)
3618 register const u_char
*eaddr
;
3621 register struct block
*b0
, *b1
;
3625 return gen_bcmp(OR_LINK
, off_mac
+ 6, 6, eaddr
);
3628 return gen_bcmp(OR_LINK
, off_mac
+ 0, 6, eaddr
);
3631 b0
= gen_ehostop(eaddr
, Q_SRC
);
3632 b1
= gen_ehostop(eaddr
, Q_DST
);
3638 b0
= gen_ehostop(eaddr
, Q_SRC
);
3639 b1
= gen_ehostop(eaddr
, Q_DST
);
3648 * Like gen_ehostop, but for DLT_FDDI
3650 static struct block
*
3651 gen_fhostop(eaddr
, dir
)
3652 register const u_char
*eaddr
;
3655 struct block
*b0
, *b1
;
3660 return gen_bcmp(OR_LINK
, 6 + 1 + pcap_fddipad
, 6, eaddr
);
3662 return gen_bcmp(OR_LINK
, 6 + 1, 6, eaddr
);
3667 return gen_bcmp(OR_LINK
, 0 + 1 + pcap_fddipad
, 6, eaddr
);
3669 return gen_bcmp(OR_LINK
, 0 + 1, 6, eaddr
);
3673 b0
= gen_fhostop(eaddr
, Q_SRC
);
3674 b1
= gen_fhostop(eaddr
, Q_DST
);
3680 b0
= gen_fhostop(eaddr
, Q_SRC
);
3681 b1
= gen_fhostop(eaddr
, Q_DST
);
3690 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
3692 static struct block
*
3693 gen_thostop(eaddr
, dir
)
3694 register const u_char
*eaddr
;
3697 register struct block
*b0
, *b1
;
3701 return gen_bcmp(OR_LINK
, 8, 6, eaddr
);
3704 return gen_bcmp(OR_LINK
, 2, 6, eaddr
);
3707 b0
= gen_thostop(eaddr
, Q_SRC
);
3708 b1
= gen_thostop(eaddr
, Q_DST
);
3714 b0
= gen_thostop(eaddr
, Q_SRC
);
3715 b1
= gen_thostop(eaddr
, Q_DST
);
3724 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and
3725 * various 802.11 + radio headers.
3727 static struct block
*
3728 gen_wlanhostop(eaddr
, dir
)
3729 register const u_char
*eaddr
;
3732 register struct block
*b0
, *b1
, *b2
;
3733 register struct slist
*s
;
3735 #ifdef ENABLE_WLAN_FILTERING_PATCH
3738 * We need to disable the optimizer because the optimizer is buggy
3739 * and wipes out some LD instructions generated by the below
3740 * code to validate the Frame Control bits
3743 #endif /* ENABLE_WLAN_FILTERING_PATCH */
3750 * For control frames, there is no SA.
3752 * For management frames, SA is at an
3753 * offset of 10 from the beginning of
3756 * For data frames, SA is at an offset
3757 * of 10 from the beginning of the packet
3758 * if From DS is clear, at an offset of
3759 * 16 from the beginning of the packet
3760 * if From DS is set and To DS is clear,
3761 * and an offset of 24 from the beginning
3762 * of the packet if From DS is set and To DS
3767 * Generate the tests to be done for data frames
3770 * First, check for To DS set, i.e. check "link[1] & 0x01".
3772 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3773 b1
= new_block(JMP(BPF_JSET
));
3774 b1
->s
.k
= 0x01; /* To DS */
3778 * If To DS is set, the SA is at 24.
3780 b0
= gen_bcmp(OR_LINK
, 24, 6, eaddr
);
3784 * Now, check for To DS not set, i.e. check
3785 * "!(link[1] & 0x01)".
3787 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3788 b2
= new_block(JMP(BPF_JSET
));
3789 b2
->s
.k
= 0x01; /* To DS */
3794 * If To DS is not set, the SA is at 16.
3796 b1
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
3800 * Now OR together the last two checks. That gives
3801 * the complete set of checks for data frames with
3807 * Now check for From DS being set, and AND that with
3808 * the ORed-together checks.
3810 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3811 b1
= new_block(JMP(BPF_JSET
));
3812 b1
->s
.k
= 0x02; /* From DS */
3817 * Now check for data frames with From DS not set.
3819 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3820 b2
= new_block(JMP(BPF_JSET
));
3821 b2
->s
.k
= 0x02; /* From DS */
3826 * If From DS isn't set, the SA is at 10.
3828 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
3832 * Now OR together the checks for data frames with
3833 * From DS not set and for data frames with From DS
3834 * set; that gives the checks done for data frames.
3839 * Now check for a data frame.
3840 * I.e, check "link[0] & 0x08".
3842 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3843 b1
= new_block(JMP(BPF_JSET
));
3848 * AND that with the checks done for data frames.
3853 * If the high-order bit of the type value is 0, this
3854 * is a management frame.
3855 * I.e, check "!(link[0] & 0x08)".
3857 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3858 b2
= new_block(JMP(BPF_JSET
));
3864 * For management frames, the SA is at 10.
3866 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
3870 * OR that with the checks done for data frames.
3871 * That gives the checks done for management and
3877 * If the low-order bit of the type value is 1,
3878 * this is either a control frame or a frame
3879 * with a reserved type, and thus not a
3882 * I.e., check "!(link[0] & 0x04)".
3884 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3885 b1
= new_block(JMP(BPF_JSET
));
3891 * AND that with the checks for data and management
3901 * For control frames, there is no DA.
3903 * For management frames, DA is at an
3904 * offset of 4 from the beginning of
3907 * For data frames, DA is at an offset
3908 * of 4 from the beginning of the packet
3909 * if To DS is clear and at an offset of
3910 * 16 from the beginning of the packet
3915 * Generate the tests to be done for data frames.
3917 * First, check for To DS set, i.e. "link[1] & 0x01".
3919 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3920 b1
= new_block(JMP(BPF_JSET
));
3921 b1
->s
.k
= 0x01; /* To DS */
3925 * If To DS is set, the DA is at 16.
3927 b0
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
3931 * Now, check for To DS not set, i.e. check
3932 * "!(link[1] & 0x01)".
3934 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3935 b2
= new_block(JMP(BPF_JSET
));
3936 b2
->s
.k
= 0x01; /* To DS */
3941 * If To DS is not set, the DA is at 4.
3943 b1
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
3947 * Now OR together the last two checks. That gives
3948 * the complete set of checks for data frames.
3953 * Now check for a data frame.
3954 * I.e, check "link[0] & 0x08".
3956 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3957 b1
= new_block(JMP(BPF_JSET
));
3962 * AND that with the checks done for data frames.
3967 * If the high-order bit of the type value is 0, this
3968 * is a management frame.
3969 * I.e, check "!(link[0] & 0x08)".
3971 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3972 b2
= new_block(JMP(BPF_JSET
));
3978 * For management frames, the DA is at 4.
3980 b1
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
3984 * OR that with the checks done for data frames.
3985 * That gives the checks done for management and
3991 * If the low-order bit of the type value is 1,
3992 * this is either a control frame or a frame
3993 * with a reserved type, and thus not a
3996 * I.e., check "!(link[0] & 0x04)".
3998 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3999 b1
= new_block(JMP(BPF_JSET
));
4005 * AND that with the checks for data and management
4012 * XXX - add RA, TA, and BSSID keywords?
4015 return (gen_bcmp(OR_LINK
, 4, 6, eaddr
));
4019 * Not present in CTS or ACK control frames.
4021 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4022 IEEE80211_FC0_TYPE_MASK
);
4024 b1
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_CTS
,
4025 IEEE80211_FC0_SUBTYPE_MASK
);
4027 b2
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_ACK
,
4028 IEEE80211_FC0_SUBTYPE_MASK
);
4032 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4038 * Not present in control frames.
4040 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4041 IEEE80211_FC0_TYPE_MASK
);
4043 b1
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
4049 * Present only if the direction mask has both "From DS"
4050 * and "To DS" set. Neither control frames nor management
4051 * frames should have both of those set, so we don't
4052 * check the frame type.
4054 b0
= gen_mcmp(OR_LINK
, 1, BPF_B
,
4055 IEEE80211_FC1_DIR_DSTODS
, IEEE80211_FC1_DIR_MASK
);
4056 b1
= gen_bcmp(OR_LINK
, 24, 6, eaddr
);
4061 b0
= gen_wlanhostop(eaddr
, Q_SRC
);
4062 b1
= gen_wlanhostop(eaddr
, Q_DST
);
4068 b0
= gen_wlanhostop(eaddr
, Q_SRC
);
4069 b1
= gen_wlanhostop(eaddr
, Q_DST
);
4078 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel.
4079 * (We assume that the addresses are IEEE 48-bit MAC addresses,
4080 * as the RFC states.)
4082 static struct block
*
4083 gen_ipfchostop(eaddr
, dir
)
4084 register const u_char
*eaddr
;
4087 register struct block
*b0
, *b1
;
4091 return gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4094 return gen_bcmp(OR_LINK
, 2, 6, eaddr
);
4097 b0
= gen_ipfchostop(eaddr
, Q_SRC
);
4098 b1
= gen_ipfchostop(eaddr
, Q_DST
);
4104 b0
= gen_ipfchostop(eaddr
, Q_SRC
);
4105 b1
= gen_ipfchostop(eaddr
, Q_DST
);
4114 * This is quite tricky because there may be pad bytes in front of the
4115 * DECNET header, and then there are two possible data packet formats that
4116 * carry both src and dst addresses, plus 5 packet types in a format that
4117 * carries only the src node, plus 2 types that use a different format and
4118 * also carry just the src node.
4122 * Instead of doing those all right, we just look for data packets with
4123 * 0 or 1 bytes of padding. If you want to look at other packets, that
4124 * will require a lot more hacking.
4126 * To add support for filtering on DECNET "areas" (network numbers)
4127 * one would want to add a "mask" argument to this routine. That would
4128 * make the filter even more inefficient, although one could be clever
4129 * and not generate masking instructions if the mask is 0xFFFF.
4131 static struct block
*
4132 gen_dnhostop(addr
, dir
)
4136 struct block
*b0
, *b1
, *b2
, *tmp
;
4137 u_int offset_lh
; /* offset if long header is received */
4138 u_int offset_sh
; /* offset if short header is received */
4143 offset_sh
= 1; /* follows flags */
4144 offset_lh
= 7; /* flgs,darea,dsubarea,HIORD */
4148 offset_sh
= 3; /* follows flags, dstnode */
4149 offset_lh
= 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
4153 /* Inefficient because we do our Calvinball dance twice */
4154 b0
= gen_dnhostop(addr
, Q_SRC
);
4155 b1
= gen_dnhostop(addr
, Q_DST
);
4161 /* Inefficient because we do our Calvinball dance twice */
4162 b0
= gen_dnhostop(addr
, Q_SRC
);
4163 b1
= gen_dnhostop(addr
, Q_DST
);
4168 bpf_error("ISO host filtering not implemented");
4173 b0
= gen_linktype(ETHERTYPE_DN
);
4174 /* Check for pad = 1, long header case */
4175 tmp
= gen_mcmp(OR_NET
, 2, BPF_H
,
4176 (bpf_int32
)ntohs(0x0681), (bpf_int32
)ntohs(0x07FF));
4177 b1
= gen_cmp(OR_NET
, 2 + 1 + offset_lh
,
4178 BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4180 /* Check for pad = 0, long header case */
4181 tmp
= gen_mcmp(OR_NET
, 2, BPF_B
, (bpf_int32
)0x06, (bpf_int32
)0x7);
4182 b2
= gen_cmp(OR_NET
, 2 + offset_lh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4185 /* Check for pad = 1, short header case */
4186 tmp
= gen_mcmp(OR_NET
, 2, BPF_H
,
4187 (bpf_int32
)ntohs(0x0281), (bpf_int32
)ntohs(0x07FF));
4188 b2
= gen_cmp(OR_NET
, 2 + 1 + offset_sh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4191 /* Check for pad = 0, short header case */
4192 tmp
= gen_mcmp(OR_NET
, 2, BPF_B
, (bpf_int32
)0x02, (bpf_int32
)0x7);
4193 b2
= gen_cmp(OR_NET
, 2 + offset_sh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4197 /* Combine with test for linktype */
4203 * Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets;
4204 * test the bottom-of-stack bit, and then check the version number
4205 * field in the IP header.
4207 static struct block
*
4208 gen_mpls_linktype(proto
)
4211 struct block
*b0
, *b1
;
4216 /* match the bottom-of-stack bit */
4217 b0
= gen_mcmp(OR_NET
, -2, BPF_B
, 0x01, 0x01);
4218 /* match the IPv4 version number */
4219 b1
= gen_mcmp(OR_NET
, 0, BPF_B
, 0x40, 0xf0);
4224 /* match the bottom-of-stack bit */
4225 b0
= gen_mcmp(OR_NET
, -2, BPF_B
, 0x01, 0x01);
4226 /* match the IPv4 version number */
4227 b1
= gen_mcmp(OR_NET
, 0, BPF_B
, 0x60, 0xf0);
4236 static struct block
*
4237 gen_host(addr
, mask
, proto
, dir
, type
)
4244 struct block
*b0
, *b1
;
4245 const char *typestr
;
4255 b0
= gen_host(addr
, mask
, Q_IP
, dir
, type
);
4257 * Only check for non-IPv4 addresses if we're not
4258 * checking MPLS-encapsulated packets.
4260 if (label_stack_depth
== 0) {
4261 b1
= gen_host(addr
, mask
, Q_ARP
, dir
, type
);
4263 b0
= gen_host(addr
, mask
, Q_RARP
, dir
, type
);
4269 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_IP
, 12, 16);
4272 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_REVARP
, 14, 24);
4275 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_ARP
, 14, 24);
4278 bpf_error("'tcp' modifier applied to %s", typestr
);
4281 bpf_error("'sctp' modifier applied to %s", typestr
);
4284 bpf_error("'udp' modifier applied to %s", typestr
);
4287 bpf_error("'icmp' modifier applied to %s", typestr
);
4290 bpf_error("'igmp' modifier applied to %s", typestr
);
4293 bpf_error("'igrp' modifier applied to %s", typestr
);
4296 bpf_error("'pim' modifier applied to %s", typestr
);
4299 bpf_error("'vrrp' modifier applied to %s", typestr
);
4302 bpf_error("ATALK host filtering not implemented");
4305 bpf_error("AARP host filtering not implemented");
4308 return gen_dnhostop(addr
, dir
);
4311 bpf_error("SCA host filtering not implemented");
4314 bpf_error("LAT host filtering not implemented");
4317 bpf_error("MOPDL host filtering not implemented");
4320 bpf_error("MOPRC host filtering not implemented");
4324 bpf_error("'ip6' modifier applied to ip host");
4327 bpf_error("'icmp6' modifier applied to %s", typestr
);
4331 bpf_error("'ah' modifier applied to %s", typestr
);
4334 bpf_error("'esp' modifier applied to %s", typestr
);
4337 bpf_error("ISO host filtering not implemented");
4340 bpf_error("'esis' modifier applied to %s", typestr
);
4343 bpf_error("'isis' modifier applied to %s", typestr
);
4346 bpf_error("'clnp' modifier applied to %s", typestr
);
4349 bpf_error("'stp' modifier applied to %s", typestr
);
4352 bpf_error("IPX host filtering not implemented");
4355 bpf_error("'netbeui' modifier applied to %s", typestr
);
4358 bpf_error("'radio' modifier applied to %s", typestr
);
4367 static struct block
*
4368 gen_host6(addr
, mask
, proto
, dir
, type
)
4369 struct in6_addr
*addr
;
4370 struct in6_addr
*mask
;
4375 const char *typestr
;
4385 return gen_host6(addr
, mask
, Q_IPV6
, dir
, type
);
4388 bpf_error("'ip' modifier applied to ip6 %s", typestr
);
4391 bpf_error("'rarp' modifier applied to ip6 %s", typestr
);
4394 bpf_error("'arp' modifier applied to ip6 %s", typestr
);
4397 bpf_error("'sctp' modifier applied to %s", typestr
);
4400 bpf_error("'tcp' modifier applied to %s", typestr
);
4403 bpf_error("'udp' modifier applied to %s", typestr
);
4406 bpf_error("'icmp' modifier applied to %s", typestr
);
4409 bpf_error("'igmp' modifier applied to %s", typestr
);
4412 bpf_error("'igrp' modifier applied to %s", typestr
);
4415 bpf_error("'pim' modifier applied to %s", typestr
);
4418 bpf_error("'vrrp' modifier applied to %s", typestr
);
4421 bpf_error("ATALK host filtering not implemented");
4424 bpf_error("AARP host filtering not implemented");
4427 bpf_error("'decnet' modifier applied to ip6 %s", typestr
);
4430 bpf_error("SCA host filtering not implemented");
4433 bpf_error("LAT host filtering not implemented");
4436 bpf_error("MOPDL host filtering not implemented");
4439 bpf_error("MOPRC host filtering not implemented");
4442 return gen_hostop6(addr
, mask
, dir
, ETHERTYPE_IPV6
, 8, 24);
4445 bpf_error("'icmp6' modifier applied to %s", typestr
);
4448 bpf_error("'ah' modifier applied to %s", typestr
);
4451 bpf_error("'esp' modifier applied to %s", typestr
);
4454 bpf_error("ISO host filtering not implemented");
4457 bpf_error("'esis' modifier applied to %s", typestr
);
4460 bpf_error("'isis' modifier applied to %s", typestr
);
4463 bpf_error("'clnp' modifier applied to %s", typestr
);
4466 bpf_error("'stp' modifier applied to %s", typestr
);
4469 bpf_error("IPX host filtering not implemented");
4472 bpf_error("'netbeui' modifier applied to %s", typestr
);
4475 bpf_error("'radio' modifier applied to %s", typestr
);
4485 static struct block
*
4486 gen_gateway(eaddr
, alist
, proto
, dir
)
4487 const u_char
*eaddr
;
4488 bpf_u_int32
**alist
;
4492 struct block
*b0
, *b1
, *tmp
;
4495 bpf_error("direction applied to 'gateway'");
4504 b0
= gen_ehostop(eaddr
, Q_OR
);
4507 b0
= gen_fhostop(eaddr
, Q_OR
);
4510 b0
= gen_thostop(eaddr
, Q_OR
);
4512 case DLT_IEEE802_11
:
4513 case DLT_PRISM_HEADER
:
4514 case DLT_IEEE802_11_RADIO_AVS
:
4515 case DLT_IEEE802_11_RADIO
:
4517 b0
= gen_wlanhostop(eaddr
, Q_OR
);
4522 * Check that the packet doesn't begin with an
4523 * LE Control marker. (We've already generated
4526 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
4531 * Now check the MAC address.
4533 b0
= gen_ehostop(eaddr
, Q_OR
);
4537 case DLT_IP_OVER_FC
:
4538 b0
= gen_ipfchostop(eaddr
, Q_OR
);
4542 "'gateway' supported only on ethernet/FDDI/token ring/802.11/Fibre Channel");
4544 b1
= gen_host(**alist
++, 0xffffffff, proto
, Q_OR
, Q_HOST
);
4546 tmp
= gen_host(**alist
++, 0xffffffff, proto
, Q_OR
,
4555 bpf_error("illegal modifier of 'gateway'");
4561 gen_proto_abbrev(proto
)
4570 b1
= gen_proto(IPPROTO_SCTP
, Q_IP
, Q_DEFAULT
);
4572 b0
= gen_proto(IPPROTO_SCTP
, Q_IPV6
, Q_DEFAULT
);
4578 b1
= gen_proto(IPPROTO_TCP
, Q_IP
, Q_DEFAULT
);
4580 b0
= gen_proto(IPPROTO_TCP
, Q_IPV6
, Q_DEFAULT
);
4586 b1
= gen_proto(IPPROTO_UDP
, Q_IP
, Q_DEFAULT
);
4588 b0
= gen_proto(IPPROTO_UDP
, Q_IPV6
, Q_DEFAULT
);
4594 b1
= gen_proto(IPPROTO_ICMP
, Q_IP
, Q_DEFAULT
);
4597 #ifndef IPPROTO_IGMP
4598 #define IPPROTO_IGMP 2
4602 b1
= gen_proto(IPPROTO_IGMP
, Q_IP
, Q_DEFAULT
);
4605 #ifndef IPPROTO_IGRP
4606 #define IPPROTO_IGRP 9
4609 b1
= gen_proto(IPPROTO_IGRP
, Q_IP
, Q_DEFAULT
);
4613 #define IPPROTO_PIM 103
4617 b1
= gen_proto(IPPROTO_PIM
, Q_IP
, Q_DEFAULT
);
4619 b0
= gen_proto(IPPROTO_PIM
, Q_IPV6
, Q_DEFAULT
);
4624 #ifndef IPPROTO_VRRP
4625 #define IPPROTO_VRRP 112
4629 b1
= gen_proto(IPPROTO_VRRP
, Q_IP
, Q_DEFAULT
);
4633 b1
= gen_linktype(ETHERTYPE_IP
);
4637 b1
= gen_linktype(ETHERTYPE_ARP
);
4641 b1
= gen_linktype(ETHERTYPE_REVARP
);
4645 bpf_error("link layer applied in wrong context");
4648 b1
= gen_linktype(ETHERTYPE_ATALK
);
4652 b1
= gen_linktype(ETHERTYPE_AARP
);
4656 b1
= gen_linktype(ETHERTYPE_DN
);
4660 b1
= gen_linktype(ETHERTYPE_SCA
);
4664 b1
= gen_linktype(ETHERTYPE_LAT
);
4668 b1
= gen_linktype(ETHERTYPE_MOPDL
);
4672 b1
= gen_linktype(ETHERTYPE_MOPRC
);
4677 b1
= gen_linktype(ETHERTYPE_IPV6
);
4680 #ifndef IPPROTO_ICMPV6
4681 #define IPPROTO_ICMPV6 58
4684 b1
= gen_proto(IPPROTO_ICMPV6
, Q_IPV6
, Q_DEFAULT
);
4689 #define IPPROTO_AH 51
4692 b1
= gen_proto(IPPROTO_AH
, Q_IP
, Q_DEFAULT
);
4694 b0
= gen_proto(IPPROTO_AH
, Q_IPV6
, Q_DEFAULT
);
4700 #define IPPROTO_ESP 50
4703 b1
= gen_proto(IPPROTO_ESP
, Q_IP
, Q_DEFAULT
);
4705 b0
= gen_proto(IPPROTO_ESP
, Q_IPV6
, Q_DEFAULT
);
4711 b1
= gen_linktype(LLCSAP_ISONS
);
4715 b1
= gen_proto(ISO9542_ESIS
, Q_ISO
, Q_DEFAULT
);
4719 b1
= gen_proto(ISO10589_ISIS
, Q_ISO
, Q_DEFAULT
);
4722 case Q_ISIS_L1
: /* all IS-IS Level1 PDU-Types */
4723 b0
= gen_proto(ISIS_L1_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4724 b1
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
); /* FIXME extract the circuit-type bits */
4726 b0
= gen_proto(ISIS_L1_LSP
, Q_ISIS
, Q_DEFAULT
);
4728 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4730 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4734 case Q_ISIS_L2
: /* all IS-IS Level2 PDU-Types */
4735 b0
= gen_proto(ISIS_L2_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4736 b1
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
); /* FIXME extract the circuit-type bits */
4738 b0
= gen_proto(ISIS_L2_LSP
, Q_ISIS
, Q_DEFAULT
);
4740 b0
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4742 b0
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4746 case Q_ISIS_IIH
: /* all IS-IS Hello PDU-Types */
4747 b0
= gen_proto(ISIS_L1_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4748 b1
= gen_proto(ISIS_L2_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4750 b0
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
);
4755 b0
= gen_proto(ISIS_L1_LSP
, Q_ISIS
, Q_DEFAULT
);
4756 b1
= gen_proto(ISIS_L2_LSP
, Q_ISIS
, Q_DEFAULT
);
4761 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4762 b1
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4764 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4766 b0
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4771 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4772 b1
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4777 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4778 b1
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4783 b1
= gen_proto(ISO8473_CLNP
, Q_ISO
, Q_DEFAULT
);
4787 b1
= gen_linktype(LLCSAP_8021D
);
4791 b1
= gen_linktype(LLCSAP_IPX
);
4795 b1
= gen_linktype(LLCSAP_NETBEUI
);
4799 bpf_error("'radio' is not a valid protocol type");
4807 static struct block
*
4814 s
= gen_load_a(OR_NET
, 6, BPF_H
);
4815 b
= new_block(JMP(BPF_JSET
));
4824 * Generate a comparison to a port value in the transport-layer header
4825 * at the specified offset from the beginning of that header.
4827 * XXX - this handles a variable-length prefix preceding the link-layer
4828 * header, such as the radiotap or AVS radio prefix, but doesn't handle
4829 * variable-length link-layer headers (such as Token Ring or 802.11
4832 static struct block
*
4833 gen_portatom(off
, v
)
4837 return gen_cmp(OR_TRAN_IPV4
, off
, BPF_H
, v
);
4841 static struct block
*
4842 gen_portatom6(off
, v
)
4846 return gen_cmp(OR_TRAN_IPV6
, off
, BPF_H
, v
);
4851 gen_portop(port
, proto
, dir
)
4852 int port
, proto
, dir
;
4854 struct block
*b0
, *b1
, *tmp
;
4856 /* ip proto 'proto' */
4857 tmp
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)proto
);
4863 b1
= gen_portatom(0, (bpf_int32
)port
);
4867 b1
= gen_portatom(2, (bpf_int32
)port
);
4872 tmp
= gen_portatom(0, (bpf_int32
)port
);
4873 b1
= gen_portatom(2, (bpf_int32
)port
);
4878 tmp
= gen_portatom(0, (bpf_int32
)port
);
4879 b1
= gen_portatom(2, (bpf_int32
)port
);
4891 static struct block
*
4892 gen_port(port
, ip_proto
, dir
)
4897 struct block
*b0
, *b1
, *tmp
;
4902 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
4903 * not LLC encapsulation with LLCSAP_IP.
4905 * For IEEE 802 networks - which includes 802.5 token ring
4906 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
4907 * says that SNAP encapsulation is used, not LLC encapsulation
4910 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
4911 * RFC 2225 say that SNAP encapsulation is used, not LLC
4912 * encapsulation with LLCSAP_IP.
4914 * So we always check for ETHERTYPE_IP.
4916 b0
= gen_linktype(ETHERTYPE_IP
);
4922 b1
= gen_portop(port
, ip_proto
, dir
);
4926 tmp
= gen_portop(port
, IPPROTO_TCP
, dir
);
4927 b1
= gen_portop(port
, IPPROTO_UDP
, dir
);
4929 tmp
= gen_portop(port
, IPPROTO_SCTP
, dir
);
4942 gen_portop6(port
, proto
, dir
)
4943 int port
, proto
, dir
;
4945 struct block
*b0
, *b1
, *tmp
;
4947 /* ip6 proto 'proto' */
4948 b0
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)proto
);
4952 b1
= gen_portatom6(0, (bpf_int32
)port
);
4956 b1
= gen_portatom6(2, (bpf_int32
)port
);
4961 tmp
= gen_portatom6(0, (bpf_int32
)port
);
4962 b1
= gen_portatom6(2, (bpf_int32
)port
);
4967 tmp
= gen_portatom6(0, (bpf_int32
)port
);
4968 b1
= gen_portatom6(2, (bpf_int32
)port
);
4980 static struct block
*
4981 gen_port6(port
, ip_proto
, dir
)
4986 struct block
*b0
, *b1
, *tmp
;
4988 /* link proto ip6 */
4989 b0
= gen_linktype(ETHERTYPE_IPV6
);
4995 b1
= gen_portop6(port
, ip_proto
, dir
);
4999 tmp
= gen_portop6(port
, IPPROTO_TCP
, dir
);
5000 b1
= gen_portop6(port
, IPPROTO_UDP
, dir
);
5002 tmp
= gen_portop6(port
, IPPROTO_SCTP
, dir
);
5014 /* gen_portrange code */
5015 static struct block
*
5016 gen_portrangeatom(off
, v1
, v2
)
5020 struct block
*b1
, *b2
;
5024 * Reverse the order of the ports, so v1 is the lower one.
5033 b1
= gen_cmp_ge(OR_TRAN_IPV4
, off
, BPF_H
, v1
);
5034 b2
= gen_cmp_le(OR_TRAN_IPV4
, off
, BPF_H
, v2
);
5042 gen_portrangeop(port1
, port2
, proto
, dir
)
5047 struct block
*b0
, *b1
, *tmp
;
5049 /* ip proto 'proto' */
5050 tmp
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)proto
);
5056 b1
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5060 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5065 tmp
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5066 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5071 tmp
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5072 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5084 static struct block
*
5085 gen_portrange(port1
, port2
, ip_proto
, dir
)
5090 struct block
*b0
, *b1
, *tmp
;
5093 b0
= gen_linktype(ETHERTYPE_IP
);
5099 b1
= gen_portrangeop(port1
, port2
, ip_proto
, dir
);
5103 tmp
= gen_portrangeop(port1
, port2
, IPPROTO_TCP
, dir
);
5104 b1
= gen_portrangeop(port1
, port2
, IPPROTO_UDP
, dir
);
5106 tmp
= gen_portrangeop(port1
, port2
, IPPROTO_SCTP
, dir
);
5118 static struct block
*
5119 gen_portrangeatom6(off
, v1
, v2
)
5123 struct block
*b1
, *b2
;
5127 * Reverse the order of the ports, so v1 is the lower one.
5136 b1
= gen_cmp_ge(OR_TRAN_IPV6
, off
, BPF_H
, v1
);
5137 b2
= gen_cmp_le(OR_TRAN_IPV6
, off
, BPF_H
, v2
);
5145 gen_portrangeop6(port1
, port2
, proto
, dir
)
5150 struct block
*b0
, *b1
, *tmp
;
5152 /* ip6 proto 'proto' */
5153 b0
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)proto
);
5157 b1
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5161 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5166 tmp
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5167 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5172 tmp
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5173 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5185 static struct block
*
5186 gen_portrange6(port1
, port2
, ip_proto
, dir
)
5191 struct block
*b0
, *b1
, *tmp
;
5193 /* link proto ip6 */
5194 b0
= gen_linktype(ETHERTYPE_IPV6
);
5200 b1
= gen_portrangeop6(port1
, port2
, ip_proto
, dir
);
5204 tmp
= gen_portrangeop6(port1
, port2
, IPPROTO_TCP
, dir
);
5205 b1
= gen_portrangeop6(port1
, port2
, IPPROTO_UDP
, dir
);
5207 tmp
= gen_portrangeop6(port1
, port2
, IPPROTO_SCTP
, dir
);
5220 lookup_proto(name
, proto
)
5221 register const char *name
;
5231 v
= pcap_nametoproto(name
);
5232 if (v
== PROTO_UNDEF
)
5233 bpf_error("unknown ip proto '%s'", name
);
5237 /* XXX should look up h/w protocol type based on linktype */
5238 v
= pcap_nametoeproto(name
);
5239 if (v
== PROTO_UNDEF
) {
5240 v
= pcap_nametollc(name
);
5241 if (v
== PROTO_UNDEF
)
5242 bpf_error("unknown ether proto '%s'", name
);
5247 if (strcmp(name
, "esis") == 0)
5249 else if (strcmp(name
, "isis") == 0)
5251 else if (strcmp(name
, "clnp") == 0)
5254 bpf_error("unknown osi proto '%s'", name
);
5274 static struct block
*
5275 gen_protochain(v
, proto
, dir
)
5280 #ifdef NO_PROTOCHAIN
5281 return gen_proto(v
, proto
, dir
);
5283 struct block
*b0
, *b
;
5284 struct slist
*s
[100];
5285 int fix2
, fix3
, fix4
, fix5
;
5286 int ahcheck
, again
, end
;
5288 int reg2
= alloc_reg();
5290 memset(s
, 0, sizeof(s
));
5291 fix2
= fix3
= fix4
= fix5
= 0;
5298 b0
= gen_protochain(v
, Q_IP
, dir
);
5299 b
= gen_protochain(v
, Q_IPV6
, dir
);
5303 bpf_error("bad protocol applied for 'protochain'");
5308 * We don't handle variable-length prefixes before the link-layer
5309 * header, or variable-length link-layer headers, here yet.
5310 * We might want to add BPF instructions to do the protochain
5311 * work, to simplify that and, on platforms that have a BPF
5312 * interpreter with the new instructions, let the filtering
5313 * be done in the kernel. (We already require a modified BPF
5314 * engine to do the protochain stuff, to support backward
5315 * branches, and backward branch support is unlikely to appear
5316 * in kernel BPF engines.)
5320 case DLT_IEEE802_11
:
5321 case DLT_PRISM_HEADER
:
5322 case DLT_IEEE802_11_RADIO_AVS
:
5323 case DLT_IEEE802_11_RADIO
:
5325 bpf_error("'protochain' not supported with 802.11");
5328 no_optimize
= 1; /*this code is not compatible with optimzer yet */
5331 * s[0] is a dummy entry to protect other BPF insn from damage
5332 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
5333 * hard to find interdependency made by jump table fixup.
5336 s
[i
] = new_stmt(0); /*dummy*/
5341 b0
= gen_linktype(ETHERTYPE_IP
);
5344 s
[i
] = new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
5345 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 9;
5347 /* X = ip->ip_hl << 2 */
5348 s
[i
] = new_stmt(BPF_LDX
|BPF_MSH
|BPF_B
);
5349 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5354 b0
= gen_linktype(ETHERTYPE_IPV6
);
5356 /* A = ip6->ip_nxt */
5357 s
[i
] = new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
5358 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 6;
5360 /* X = sizeof(struct ip6_hdr) */
5361 s
[i
] = new_stmt(BPF_LDX
|BPF_IMM
);
5367 bpf_error("unsupported proto to gen_protochain");
5371 /* again: if (A == v) goto end; else fall through; */
5373 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5375 s
[i
]->s
.jt
= NULL
; /*later*/
5376 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5380 #ifndef IPPROTO_NONE
5381 #define IPPROTO_NONE 59
5383 /* if (A == IPPROTO_NONE) goto end */
5384 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5385 s
[i
]->s
.jt
= NULL
; /*later*/
5386 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5387 s
[i
]->s
.k
= IPPROTO_NONE
;
5388 s
[fix5
]->s
.jf
= s
[i
];
5393 if (proto
== Q_IPV6
) {
5394 int v6start
, v6end
, v6advance
, j
;
5397 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
5398 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5399 s
[i
]->s
.jt
= NULL
; /*later*/
5400 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5401 s
[i
]->s
.k
= IPPROTO_HOPOPTS
;
5402 s
[fix2
]->s
.jf
= s
[i
];
5404 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
5405 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5406 s
[i
]->s
.jt
= NULL
; /*later*/
5407 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5408 s
[i
]->s
.k
= IPPROTO_DSTOPTS
;
5410 /* if (A == IPPROTO_ROUTING) goto v6advance */
5411 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5412 s
[i
]->s
.jt
= NULL
; /*later*/
5413 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5414 s
[i
]->s
.k
= IPPROTO_ROUTING
;
5416 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
5417 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5418 s
[i
]->s
.jt
= NULL
; /*later*/
5419 s
[i
]->s
.jf
= NULL
; /*later*/
5420 s
[i
]->s
.k
= IPPROTO_FRAGMENT
;
5431 * X = X + (P[X + 1] + 1) * 8;
5434 s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5436 /* A = P[X + packet head] */
5437 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5438 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5441 s
[i
] = new_stmt(BPF_ST
);
5445 s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5448 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5452 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5454 /* A = P[X + packet head]; */
5455 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5456 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5459 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5463 s
[i
] = new_stmt(BPF_ALU
|BPF_MUL
|BPF_K
);
5467 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5470 s
[i
] = new_stmt(BPF_LD
|BPF_MEM
);
5474 /* goto again; (must use BPF_JA for backward jump) */
5475 s
[i
] = new_stmt(BPF_JMP
|BPF_JA
);
5476 s
[i
]->s
.k
= again
- i
- 1;
5477 s
[i
- 1]->s
.jf
= s
[i
];
5481 for (j
= v6start
; j
<= v6end
; j
++)
5482 s
[j
]->s
.jt
= s
[v6advance
];
5487 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5489 s
[fix2
]->s
.jf
= s
[i
];
5495 /* if (A == IPPROTO_AH) then fall through; else goto end; */
5496 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5497 s
[i
]->s
.jt
= NULL
; /*later*/
5498 s
[i
]->s
.jf
= NULL
; /*later*/
5499 s
[i
]->s
.k
= IPPROTO_AH
;
5501 s
[fix3
]->s
.jf
= s
[ahcheck
];
5508 * X = X + (P[X + 1] + 2) * 4;
5511 s
[i
- 1]->s
.jt
= s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5513 /* A = P[X + packet head]; */
5514 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5515 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5518 s
[i
] = new_stmt(BPF_ST
);
5522 s
[i
- 1]->s
.jt
= s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5525 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5529 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5531 /* A = P[X + packet head] */
5532 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5533 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5536 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5540 s
[i
] = new_stmt(BPF_ALU
|BPF_MUL
|BPF_K
);
5544 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5547 s
[i
] = new_stmt(BPF_LD
|BPF_MEM
);
5551 /* goto again; (must use BPF_JA for backward jump) */
5552 s
[i
] = new_stmt(BPF_JMP
|BPF_JA
);
5553 s
[i
]->s
.k
= again
- i
- 1;
5558 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5560 s
[fix2
]->s
.jt
= s
[end
];
5561 s
[fix4
]->s
.jf
= s
[end
];
5562 s
[fix5
]->s
.jt
= s
[end
];
5569 for (i
= 0; i
< max
- 1; i
++)
5570 s
[i
]->next
= s
[i
+ 1];
5571 s
[max
- 1]->next
= NULL
;
5576 b
= new_block(JMP(BPF_JEQ
));
5577 b
->stmts
= s
[1]; /*remember, s[0] is dummy*/
5587 static struct block
*
5588 gen_check_802_11_data_frame()
5591 struct block
*b0
, *b1
;
5594 * A data frame has the 0x08 bit (b3) in the frame control field set
5595 * and the 0x04 bit (b2) clear.
5597 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
5598 b0
= new_block(JMP(BPF_JSET
));
5602 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
5603 b1
= new_block(JMP(BPF_JSET
));
5614 * Generate code that checks whether the packet is a packet for protocol
5615 * <proto> and whether the type field in that protocol's header has
5616 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an
5617 * IP packet and checks the protocol number in the IP header against <v>.
5619 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks
5620 * against Q_IP and Q_IPV6.
5622 static struct block
*
5623 gen_proto(v
, proto
, dir
)
5628 struct block
*b0
, *b1
;
5630 if (dir
!= Q_DEFAULT
)
5631 bpf_error("direction applied to 'proto'");
5636 b0
= gen_proto(v
, Q_IP
, dir
);
5637 b1
= gen_proto(v
, Q_IPV6
, dir
);
5645 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
5646 * not LLC encapsulation with LLCSAP_IP.
5648 * For IEEE 802 networks - which includes 802.5 token ring
5649 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
5650 * says that SNAP encapsulation is used, not LLC encapsulation
5653 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
5654 * RFC 2225 say that SNAP encapsulation is used, not LLC
5655 * encapsulation with LLCSAP_IP.
5657 * So we always check for ETHERTYPE_IP.
5659 b0
= gen_linktype(ETHERTYPE_IP
);
5661 b1
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)v
);
5663 b1
= gen_protochain(v
, Q_IP
);
5673 * Frame Relay packets typically have an OSI
5674 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)"
5675 * generates code to check for all the OSI
5676 * NLPIDs, so calling it and then adding a check
5677 * for the particular NLPID for which we're
5678 * looking is bogus, as we can just check for
5681 * What we check for is the NLPID and a frame
5682 * control field value of UI, i.e. 0x03 followed
5685 * XXX - assumes a 2-byte Frame Relay header with
5686 * DLCI and flags. What if the address is longer?
5688 * XXX - what about SNAP-encapsulated frames?
5690 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | v
);
5696 * Cisco uses an Ethertype lookalike - for OSI,
5699 b0
= gen_linktype(LLCSAP_ISONS
<<8 | LLCSAP_ISONS
);
5700 /* OSI in C-HDLC is stuffed with a fudge byte */
5701 b1
= gen_cmp(OR_NET_NOSNAP
, 1, BPF_B
, (long)v
);
5706 b0
= gen_linktype(LLCSAP_ISONS
);
5707 b1
= gen_cmp(OR_NET_NOSNAP
, 0, BPF_B
, (long)v
);
5713 b0
= gen_proto(ISO10589_ISIS
, Q_ISO
, Q_DEFAULT
);
5715 * 4 is the offset of the PDU type relative to the IS-IS
5718 b1
= gen_cmp(OR_NET_NOSNAP
, 4, BPF_B
, (long)v
);
5723 bpf_error("arp does not encapsulate another protocol");
5727 bpf_error("rarp does not encapsulate another protocol");
5731 bpf_error("atalk encapsulation is not specifiable");
5735 bpf_error("decnet encapsulation is not specifiable");
5739 bpf_error("sca does not encapsulate another protocol");
5743 bpf_error("lat does not encapsulate another protocol");
5747 bpf_error("moprc does not encapsulate another protocol");
5751 bpf_error("mopdl does not encapsulate another protocol");
5755 return gen_linktype(v
);
5758 bpf_error("'udp proto' is bogus");
5762 bpf_error("'tcp proto' is bogus");
5766 bpf_error("'sctp proto' is bogus");
5770 bpf_error("'icmp proto' is bogus");
5774 bpf_error("'igmp proto' is bogus");
5778 bpf_error("'igrp proto' is bogus");
5782 bpf_error("'pim proto' is bogus");
5786 bpf_error("'vrrp proto' is bogus");
5791 b0
= gen_linktype(ETHERTYPE_IPV6
);
5793 b1
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)v
);
5795 b1
= gen_protochain(v
, Q_IPV6
);
5801 bpf_error("'icmp6 proto' is bogus");
5805 bpf_error("'ah proto' is bogus");
5808 bpf_error("'ah proto' is bogus");
5811 bpf_error("'stp proto' is bogus");
5814 bpf_error("'ipx proto' is bogus");
5817 bpf_error("'netbeui proto' is bogus");
5820 bpf_error("'radio proto' is bogus");
5831 register const char *name
;
5834 int proto
= q
.proto
;
5838 bpf_u_int32 mask
, addr
;
5840 bpf_u_int32
**alist
;
5843 struct sockaddr_in
*sin4
;
5844 struct sockaddr_in6
*sin6
;
5845 struct addrinfo
*res
, *res0
;
5846 struct in6_addr mask128
;
5848 struct block
*b
, *tmp
;
5849 int port
, real_proto
;
5855 addr
= pcap_nametonetaddr(name
);
5857 bpf_error("unknown network '%s'", name
);
5858 /* Left justify network addr and calculate its network mask */
5860 while (addr
&& (addr
& 0xff000000) == 0) {
5864 return gen_host(addr
, mask
, proto
, dir
, q
.addr
);
5868 if (proto
== Q_LINK
) {
5872 eaddr
= pcap_ether_hostton(name
);
5875 "unknown ether host '%s'", name
);
5876 b
= gen_ehostop(eaddr
, dir
);
5881 eaddr
= pcap_ether_hostton(name
);
5884 "unknown FDDI host '%s'", name
);
5885 b
= gen_fhostop(eaddr
, dir
);
5890 eaddr
= pcap_ether_hostton(name
);
5893 "unknown token ring host '%s'", name
);
5894 b
= gen_thostop(eaddr
, dir
);
5898 case DLT_IEEE802_11
:
5899 case DLT_PRISM_HEADER
:
5900 case DLT_IEEE802_11_RADIO_AVS
:
5901 case DLT_IEEE802_11_RADIO
:
5903 eaddr
= pcap_ether_hostton(name
);
5906 "unknown 802.11 host '%s'", name
);
5907 b
= gen_wlanhostop(eaddr
, dir
);
5911 case DLT_IP_OVER_FC
:
5912 eaddr
= pcap_ether_hostton(name
);
5915 "unknown Fibre Channel host '%s'", name
);
5916 b
= gen_ipfchostop(eaddr
, dir
);
5925 * Check that the packet doesn't begin
5926 * with an LE Control marker. (We've
5927 * already generated a test for LANE.)
5929 tmp
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
5933 eaddr
= pcap_ether_hostton(name
);
5936 "unknown ether host '%s'", name
);
5937 b
= gen_ehostop(eaddr
, dir
);
5943 bpf_error("only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name");
5944 } else if (proto
== Q_DECNET
) {
5945 unsigned short dn_addr
= __pcap_nametodnaddr(name
);
5947 * I don't think DECNET hosts can be multihomed, so
5948 * there is no need to build up a list of addresses
5950 return (gen_host(dn_addr
, 0, proto
, dir
, q
.addr
));
5953 alist
= pcap_nametoaddr(name
);
5954 if (alist
== NULL
|| *alist
== NULL
)
5955 bpf_error("unknown host '%s'", name
);
5957 if (off_linktype
== (u_int
)-1 && tproto
== Q_DEFAULT
)
5959 b
= gen_host(**alist
++, 0xffffffff, tproto
, dir
, q
.addr
);
5961 tmp
= gen_host(**alist
++, 0xffffffff,
5962 tproto
, dir
, q
.addr
);
5968 memset(&mask128
, 0xff, sizeof(mask128
));
5969 res0
= res
= pcap_nametoaddrinfo(name
);
5971 bpf_error("unknown host '%s'", name
);
5973 tproto
= tproto6
= proto
;
5974 if (off_linktype
== -1 && tproto
== Q_DEFAULT
) {
5978 for (res
= res0
; res
; res
= res
->ai_next
) {
5979 switch (res
->ai_family
) {
5981 if (tproto
== Q_IPV6
)
5984 sin4
= (struct sockaddr_in
*)
5986 tmp
= gen_host(ntohl(sin4
->sin_addr
.s_addr
),
5987 0xffffffff, tproto
, dir
, q
.addr
);
5990 if (tproto6
== Q_IP
)
5993 sin6
= (struct sockaddr_in6
*)
5995 tmp
= gen_host6(&sin6
->sin6_addr
,
5996 &mask128
, tproto6
, dir
, q
.addr
);
6007 bpf_error("unknown host '%s'%s", name
,
6008 (proto
== Q_DEFAULT
)
6010 : " for specified address family");
6017 if (proto
!= Q_DEFAULT
&&
6018 proto
!= Q_UDP
&& proto
!= Q_TCP
&& proto
!= Q_SCTP
)
6019 bpf_error("illegal qualifier of 'port'");
6020 if (pcap_nametoport(name
, &port
, &real_proto
) == 0)
6021 bpf_error("unknown port '%s'", name
);
6022 if (proto
== Q_UDP
) {
6023 if (real_proto
== IPPROTO_TCP
)
6024 bpf_error("port '%s' is tcp", name
);
6025 else if (real_proto
== IPPROTO_SCTP
)
6026 bpf_error("port '%s' is sctp", name
);
6028 /* override PROTO_UNDEF */
6029 real_proto
= IPPROTO_UDP
;
6031 if (proto
== Q_TCP
) {
6032 if (real_proto
== IPPROTO_UDP
)
6033 bpf_error("port '%s' is udp", name
);
6035 else if (real_proto
== IPPROTO_SCTP
)
6036 bpf_error("port '%s' is sctp", name
);
6038 /* override PROTO_UNDEF */
6039 real_proto
= IPPROTO_TCP
;
6041 if (proto
== Q_SCTP
) {
6042 if (real_proto
== IPPROTO_UDP
)
6043 bpf_error("port '%s' is udp", name
);
6045 else if (real_proto
== IPPROTO_TCP
)
6046 bpf_error("port '%s' is tcp", name
);
6048 /* override PROTO_UNDEF */
6049 real_proto
= IPPROTO_SCTP
;
6052 return gen_port(port
, real_proto
, dir
);
6054 b
= gen_port(port
, real_proto
, dir
);
6055 gen_or(gen_port6(port
, real_proto
, dir
), b
);
6060 if (proto
!= Q_DEFAULT
&&
6061 proto
!= Q_UDP
&& proto
!= Q_TCP
&& proto
!= Q_SCTP
)
6062 bpf_error("illegal qualifier of 'portrange'");
6063 if (pcap_nametoportrange(name
, &port1
, &port2
, &real_proto
) == 0)
6064 bpf_error("unknown port in range '%s'", name
);
6065 if (proto
== Q_UDP
) {
6066 if (real_proto
== IPPROTO_TCP
)
6067 bpf_error("port in range '%s' is tcp", name
);
6068 else if (real_proto
== IPPROTO_SCTP
)
6069 bpf_error("port in range '%s' is sctp", name
);
6071 /* override PROTO_UNDEF */
6072 real_proto
= IPPROTO_UDP
;
6074 if (proto
== Q_TCP
) {
6075 if (real_proto
== IPPROTO_UDP
)
6076 bpf_error("port in range '%s' is udp", name
);
6077 else if (real_proto
== IPPROTO_SCTP
)
6078 bpf_error("port in range '%s' is sctp", name
);
6080 /* override PROTO_UNDEF */
6081 real_proto
= IPPROTO_TCP
;
6083 if (proto
== Q_SCTP
) {
6084 if (real_proto
== IPPROTO_UDP
)
6085 bpf_error("port in range '%s' is udp", name
);
6086 else if (real_proto
== IPPROTO_TCP
)
6087 bpf_error("port in range '%s' is tcp", name
);
6089 /* override PROTO_UNDEF */
6090 real_proto
= IPPROTO_SCTP
;
6093 return gen_portrange(port1
, port2
, real_proto
, dir
);
6095 b
= gen_portrange(port1
, port2
, real_proto
, dir
);
6096 gen_or(gen_portrange6(port1
, port2
, real_proto
, dir
), b
);
6102 eaddr
= pcap_ether_hostton(name
);
6104 bpf_error("unknown ether host: %s", name
);
6106 alist
= pcap_nametoaddr(name
);
6107 if (alist
== NULL
|| *alist
== NULL
)
6108 bpf_error("unknown host '%s'", name
);
6109 b
= gen_gateway(eaddr
, alist
, proto
, dir
);
6113 bpf_error("'gateway' not supported in this configuration");
6117 real_proto
= lookup_proto(name
, proto
);
6118 if (real_proto
>= 0)
6119 return gen_proto(real_proto
, proto
, dir
);
6121 bpf_error("unknown protocol: %s", name
);
6124 real_proto
= lookup_proto(name
, proto
);
6125 if (real_proto
>= 0)
6126 return gen_protochain(real_proto
, proto
, dir
);
6128 bpf_error("unknown protocol: %s", name
);
6139 gen_mcode(s1
, s2
, masklen
, q
)
6140 register const char *s1
, *s2
;
6141 register int masklen
;
6144 register int nlen
, mlen
;
6147 nlen
= __pcap_atoin(s1
, &n
);
6148 /* Promote short ipaddr */
6152 mlen
= __pcap_atoin(s2
, &m
);
6153 /* Promote short ipaddr */
6156 bpf_error("non-network bits set in \"%s mask %s\"",
6159 /* Convert mask len to mask */
6161 bpf_error("mask length must be <= 32");
6164 * X << 32 is not guaranteed by C to be 0; it's
6169 m
= 0xffffffff << (32 - masklen
);
6171 bpf_error("non-network bits set in \"%s/%d\"",
6178 return gen_host(n
, m
, q
.proto
, q
.dir
, q
.addr
);
6181 bpf_error("Mask syntax for networks only");
6190 register const char *s
;
6195 int proto
= q
.proto
;
6201 else if (q
.proto
== Q_DECNET
)
6202 vlen
= __pcap_atodn(s
, &v
);
6204 vlen
= __pcap_atoin(s
, &v
);
6211 if (proto
== Q_DECNET
)
6212 return gen_host(v
, 0, proto
, dir
, q
.addr
);
6213 else if (proto
== Q_LINK
) {
6214 bpf_error("illegal link layer address");
6217 if (s
== NULL
&& q
.addr
== Q_NET
) {
6218 /* Promote short net number */
6219 while (v
&& (v
& 0xff000000) == 0) {
6224 /* Promote short ipaddr */
6228 return gen_host(v
, mask
, proto
, dir
, q
.addr
);
6233 proto
= IPPROTO_UDP
;
6234 else if (proto
== Q_TCP
)
6235 proto
= IPPROTO_TCP
;
6236 else if (proto
== Q_SCTP
)
6237 proto
= IPPROTO_SCTP
;
6238 else if (proto
== Q_DEFAULT
)
6239 proto
= PROTO_UNDEF
;
6241 bpf_error("illegal qualifier of 'port'");
6244 return gen_port((int)v
, proto
, dir
);
6248 b
= gen_port((int)v
, proto
, dir
);
6249 gen_or(gen_port6((int)v
, proto
, dir
), b
);
6256 proto
= IPPROTO_UDP
;
6257 else if (proto
== Q_TCP
)
6258 proto
= IPPROTO_TCP
;
6259 else if (proto
== Q_SCTP
)
6260 proto
= IPPROTO_SCTP
;
6261 else if (proto
== Q_DEFAULT
)
6262 proto
= PROTO_UNDEF
;
6264 bpf_error("illegal qualifier of 'portrange'");
6267 return gen_portrange((int)v
, (int)v
, proto
, dir
);
6271 b
= gen_portrange((int)v
, (int)v
, proto
, dir
);
6272 gen_or(gen_portrange6((int)v
, (int)v
, proto
, dir
), b
);
6278 bpf_error("'gateway' requires a name");
6282 return gen_proto((int)v
, proto
, dir
);
6285 return gen_protochain((int)v
, proto
, dir
);
6300 gen_mcode6(s1
, s2
, masklen
, q
)
6301 register const char *s1
, *s2
;
6302 register int masklen
;
6305 struct addrinfo
*res
;
6306 struct in6_addr
*addr
;
6307 struct in6_addr mask
;
6312 bpf_error("no mask %s supported", s2
);
6314 res
= pcap_nametoaddrinfo(s1
);
6316 bpf_error("invalid ip6 address %s", s1
);
6318 bpf_error("%s resolved to multiple address", s1
);
6319 addr
= &((struct sockaddr_in6
*)res
->ai_addr
)->sin6_addr
;
6321 if (sizeof(mask
) * 8 < masklen
)
6322 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask
) * 8));
6323 memset(&mask
, 0, sizeof(mask
));
6324 memset(&mask
, 0xff, masklen
/ 8);
6326 mask
.s6_addr
[masklen
/ 8] =
6327 (0xff << (8 - masklen
% 8)) & 0xff;
6330 a
= (u_int32_t
*)addr
;
6331 m
= (u_int32_t
*)&mask
;
6332 if ((a
[0] & ~m
[0]) || (a
[1] & ~m
[1])
6333 || (a
[2] & ~m
[2]) || (a
[3] & ~m
[3])) {
6334 bpf_error("non-network bits set in \"%s/%d\"", s1
, masklen
);
6342 bpf_error("Mask syntax for networks only");
6346 b
= gen_host6(addr
, &mask
, q
.proto
, q
.dir
, q
.addr
);
6351 bpf_error("invalid qualifier against IPv6 address");
6360 register const u_char
*eaddr
;
6363 struct block
*b
, *tmp
;
6365 if ((q
.addr
== Q_HOST
|| q
.addr
== Q_DEFAULT
) && q
.proto
== Q_LINK
) {
6368 return gen_ehostop(eaddr
, (int)q
.dir
);
6370 return gen_fhostop(eaddr
, (int)q
.dir
);
6372 return gen_thostop(eaddr
, (int)q
.dir
);
6373 case DLT_IEEE802_11
:
6374 case DLT_PRISM_HEADER
:
6375 case DLT_IEEE802_11_RADIO_AVS
:
6376 case DLT_IEEE802_11_RADIO
:
6378 return gen_wlanhostop(eaddr
, (int)q
.dir
);
6382 * Check that the packet doesn't begin with an
6383 * LE Control marker. (We've already generated
6386 tmp
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
, BPF_H
,
6391 * Now check the MAC address.
6393 b
= gen_ehostop(eaddr
, (int)q
.dir
);
6398 case DLT_IP_OVER_FC
:
6399 return gen_ipfchostop(eaddr
, (int)q
.dir
);
6401 bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
6405 bpf_error("ethernet address used in non-ether expression");
6412 struct slist
*s0
, *s1
;
6415 * This is definitely not the best way to do this, but the
6416 * lists will rarely get long.
6423 static struct slist
*
6429 s
= new_stmt(BPF_LDX
|BPF_MEM
);
6434 static struct slist
*
6440 s
= new_stmt(BPF_LD
|BPF_MEM
);
6446 * Modify "index" to use the value stored into its register as an
6447 * offset relative to the beginning of the header for the protocol
6448 * "proto", and allocate a register and put an item "size" bytes long
6449 * (1, 2, or 4) at that offset into that register, making it the register
6453 gen_load(proto
, inst
, size
)
6458 struct slist
*s
, *tmp
;
6460 int regno
= alloc_reg();
6462 free_reg(inst
->regno
);
6466 bpf_error("data size must be 1, 2, or 4");
6482 bpf_error("unsupported index operation");
6486 * The offset is relative to the beginning of the packet
6487 * data, if we have a radio header. (If we don't, this
6490 if (linktype
!= DLT_IEEE802_11_RADIO_AVS
&&
6491 linktype
!= DLT_IEEE802_11_RADIO
&&
6492 linktype
!= DLT_PRISM_HEADER
)
6493 bpf_error("radio information not present in capture");
6496 * Load into the X register the offset computed into the
6497 * register specifed by "index".
6499 s
= xfer_to_x(inst
);
6502 * Load the item at that offset.
6504 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6506 sappend(inst
->s
, s
);
6511 * The offset is relative to the beginning of
6512 * the link-layer header.
6514 * XXX - what about ATM LANE? Should the index be
6515 * relative to the beginning of the AAL5 frame, so
6516 * that 0 refers to the beginning of the LE Control
6517 * field, or relative to the beginning of the LAN
6518 * frame, so that 0 refers, for Ethernet LANE, to
6519 * the beginning of the destination address?
6521 s
= gen_llprefixlen();
6524 * If "s" is non-null, it has code to arrange that the
6525 * X register contains the length of the prefix preceding
6526 * the link-layer header. Add to it the offset computed
6527 * into the register specified by "index", and move that
6528 * into the X register. Otherwise, just load into the X
6529 * register the offset computed into the register specifed
6533 sappend(s
, xfer_to_a(inst
));
6534 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6535 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6537 s
= xfer_to_x(inst
);
6540 * Load the item at the sum of the offset we've put in the
6541 * X register and the offset of the start of the link
6542 * layer header (which is 0 if the radio header is
6543 * variable-length; that header length is what we put
6544 * into the X register and then added to the index).
6546 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6549 sappend(inst
->s
, s
);
6565 * The offset is relative to the beginning of
6566 * the network-layer header.
6567 * XXX - are there any cases where we want
6570 s
= gen_off_macpl();
6573 * If "s" is non-null, it has code to arrange that the
6574 * X register contains the offset of the MAC-layer
6575 * payload. Add to it the offset computed into the
6576 * register specified by "index", and move that into
6577 * the X register. Otherwise, just load into the X
6578 * register the offset computed into the register specifed
6582 sappend(s
, xfer_to_a(inst
));
6583 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6584 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6586 s
= xfer_to_x(inst
);
6589 * Load the item at the sum of the offset we've put in the
6590 * X register, the offset of the start of the network
6591 * layer header from the beginning of the MAC-layer
6592 * payload, and the purported offset of the start of the
6593 * MAC-layer payload (which might be 0 if there's a
6594 * variable-length prefix before the link-layer header
6595 * or the link-layer header itself is variable-length;
6596 * the variable-length offset of the start of the
6597 * MAC-layer payload is what we put into the X register
6598 * and then added to the index).
6600 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6601 tmp
->s
.k
= off_macpl
+ off_nl
;
6603 sappend(inst
->s
, s
);
6606 * Do the computation only if the packet contains
6607 * the protocol in question.
6609 b
= gen_proto_abbrev(proto
);
6611 gen_and(inst
->b
, b
);
6624 * The offset is relative to the beginning of
6625 * the transport-layer header.
6627 * Load the X register with the length of the IPv4 header
6628 * (plus the offset of the link-layer header, if it's
6629 * a variable-length header), in bytes.
6631 * XXX - are there any cases where we want
6633 * XXX - we should, if we're built with
6634 * IPv6 support, generate code to load either
6635 * IPv4, IPv6, or both, as appropriate.
6637 s
= gen_loadx_iphdrlen();
6640 * The X register now contains the sum of the length
6641 * of any variable-length header preceding the link-layer
6642 * header, any variable-length link-layer header, and the
6643 * length of the network-layer header.
6645 * Load into the A register the offset relative to
6646 * the beginning of the transport layer header,
6647 * add the X register to that, move that to the
6648 * X register, and load with an offset from the
6649 * X register equal to the offset of the network
6650 * layer header relative to the beginning of
6651 * the MAC-layer payload plus the fixed-length
6652 * portion of the offset of the MAC-layer payload
6653 * from the beginning of the raw packet data.
6655 sappend(s
, xfer_to_a(inst
));
6656 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6657 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6658 sappend(s
, tmp
= new_stmt(BPF_LD
|BPF_IND
|size
));
6659 tmp
->s
.k
= off_macpl
+ off_nl
;
6660 sappend(inst
->s
, s
);
6663 * Do the computation only if the packet contains
6664 * the protocol in question - which is true only
6665 * if this is an IP datagram and is the first or
6666 * only fragment of that datagram.
6668 gen_and(gen_proto_abbrev(proto
), b
= gen_ipfrag());
6670 gen_and(inst
->b
, b
);
6672 gen_and(gen_proto_abbrev(Q_IP
), b
);
6678 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
6682 inst
->regno
= regno
;
6683 s
= new_stmt(BPF_ST
);
6685 sappend(inst
->s
, s
);
6691 gen_relation(code
, a0
, a1
, reversed
)
6693 struct arth
*a0
, *a1
;
6696 struct slist
*s0
, *s1
, *s2
;
6697 struct block
*b
, *tmp
;
6701 if (code
== BPF_JEQ
) {
6702 s2
= new_stmt(BPF_ALU
|BPF_SUB
|BPF_X
);
6703 b
= new_block(JMP(code
));
6707 b
= new_block(BPF_JMP
|code
|BPF_X
);
6713 sappend(a0
->s
, a1
->s
);
6717 free_reg(a0
->regno
);
6718 free_reg(a1
->regno
);
6720 /* 'and' together protocol checks */
6723 gen_and(a0
->b
, tmp
= a1
->b
);
6739 int regno
= alloc_reg();
6740 struct arth
*a
= (struct arth
*)newchunk(sizeof(*a
));
6743 s
= new_stmt(BPF_LD
|BPF_LEN
);
6744 s
->next
= new_stmt(BPF_ST
);
6745 s
->next
->s
.k
= regno
;
6760 a
= (struct arth
*)newchunk(sizeof(*a
));
6764 s
= new_stmt(BPF_LD
|BPF_IMM
);
6766 s
->next
= new_stmt(BPF_ST
);
6782 s
= new_stmt(BPF_ALU
|BPF_NEG
);
6785 s
= new_stmt(BPF_ST
);
6793 gen_arth(code
, a0
, a1
)
6795 struct arth
*a0
, *a1
;
6797 struct slist
*s0
, *s1
, *s2
;
6801 s2
= new_stmt(BPF_ALU
|BPF_X
|code
);
6806 sappend(a0
->s
, a1
->s
);
6808 free_reg(a0
->regno
);
6809 free_reg(a1
->regno
);
6811 s0
= new_stmt(BPF_ST
);
6812 a0
->regno
= s0
->s
.k
= alloc_reg();
6819 * Here we handle simple allocation of the scratch registers.
6820 * If too many registers are alloc'd, the allocator punts.
6822 static int regused
[BPF_MEMWORDS
];
6826 * Initialize the table of used registers and the current register.
6832 memset(regused
, 0, sizeof regused
);
6836 * Return the next free register.
6841 int n
= BPF_MEMWORDS
;
6844 if (regused
[curreg
])
6845 curreg
= (curreg
+ 1) % BPF_MEMWORDS
;
6847 regused
[curreg
] = 1;
6851 bpf_error("too many registers needed to evaluate expression");
6857 * Return a register to the table so it can
6867 static struct block
*
6874 s
= new_stmt(BPF_LD
|BPF_LEN
);
6875 b
= new_block(JMP(jmp
));
6886 return gen_len(BPF_JGE
, n
);
6890 * Actually, this is less than or equal.
6898 b
= gen_len(BPF_JGT
, n
);
6905 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to
6906 * the beginning of the link-layer header.
6907 * XXX - that means you can't test values in the radiotap header, but
6908 * as that header is difficult if not impossible to parse generally
6909 * without a loop, that might not be a severe problem. A new keyword
6910 * "radio" could be added for that, although what you'd really want
6911 * would be a way of testing particular radio header values, which
6912 * would generate code appropriate to the radio header in question.
6915 gen_byteop(op
, idx
, val
)
6926 return gen_cmp(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
6929 b
= gen_cmp_lt(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
6933 b
= gen_cmp_gt(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
6937 s
= new_stmt(BPF_ALU
|BPF_OR
|BPF_K
);
6941 s
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
6945 b
= new_block(JMP(BPF_JEQ
));
6952 static u_char abroadcast
[] = { 0x0 };
6955 gen_broadcast(proto
)
6958 bpf_u_int32 hostmask
;
6959 struct block
*b0
, *b1
, *b2
;
6960 static u_char ebroadcast
[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
6968 case DLT_ARCNET_LINUX
:
6969 return gen_ahostop(abroadcast
, Q_DST
);
6971 return gen_ehostop(ebroadcast
, Q_DST
);
6973 return gen_fhostop(ebroadcast
, Q_DST
);
6975 return gen_thostop(ebroadcast
, Q_DST
);
6976 case DLT_IEEE802_11
:
6977 case DLT_PRISM_HEADER
:
6978 case DLT_IEEE802_11_RADIO_AVS
:
6979 case DLT_IEEE802_11_RADIO
:
6981 return gen_wlanhostop(ebroadcast
, Q_DST
);
6982 case DLT_IP_OVER_FC
:
6983 return gen_ipfchostop(ebroadcast
, Q_DST
);
6987 * Check that the packet doesn't begin with an
6988 * LE Control marker. (We've already generated
6991 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
6996 * Now check the MAC address.
6998 b0
= gen_ehostop(ebroadcast
, Q_DST
);
7004 bpf_error("not a broadcast link");
7009 b0
= gen_linktype(ETHERTYPE_IP
);
7010 hostmask
= ~netmask
;
7011 b1
= gen_mcmp(OR_NET
, 16, BPF_W
, (bpf_int32
)0, hostmask
);
7012 b2
= gen_mcmp(OR_NET
, 16, BPF_W
,
7013 (bpf_int32
)(~0 & hostmask
), hostmask
);
7018 bpf_error("only link-layer/IP broadcast filters supported");
7024 * Generate code to test the low-order bit of a MAC address (that's
7025 * the bottom bit of the *first* byte).
7027 static struct block
*
7028 gen_mac_multicast(offset
)
7031 register struct block
*b0
;
7032 register struct slist
*s
;
7034 /* link[offset] & 1 != 0 */
7035 s
= gen_load_a(OR_LINK
, offset
, BPF_B
);
7036 b0
= new_block(JMP(BPF_JSET
));
7043 gen_multicast(proto
)
7046 register struct block
*b0
, *b1
, *b2
;
7047 register struct slist
*s
;
7055 case DLT_ARCNET_LINUX
:
7056 /* all ARCnet multicasts use the same address */
7057 return gen_ahostop(abroadcast
, Q_DST
);
7059 /* ether[0] & 1 != 0 */
7060 return gen_mac_multicast(0);
7063 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
7065 * XXX - was that referring to bit-order issues?
7067 /* fddi[1] & 1 != 0 */
7068 return gen_mac_multicast(1);
7070 /* tr[2] & 1 != 0 */
7071 return gen_mac_multicast(2);
7072 case DLT_IEEE802_11
:
7073 case DLT_PRISM_HEADER
:
7074 case DLT_IEEE802_11_RADIO_AVS
:
7075 case DLT_IEEE802_11_RADIO
:
7080 * For control frames, there is no DA.
7082 * For management frames, DA is at an
7083 * offset of 4 from the beginning of
7086 * For data frames, DA is at an offset
7087 * of 4 from the beginning of the packet
7088 * if To DS is clear and at an offset of
7089 * 16 from the beginning of the packet
7094 * Generate the tests to be done for data frames.
7096 * First, check for To DS set, i.e. "link[1] & 0x01".
7098 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
7099 b1
= new_block(JMP(BPF_JSET
));
7100 b1
->s
.k
= 0x01; /* To DS */
7104 * If To DS is set, the DA is at 16.
7106 b0
= gen_mac_multicast(16);
7110 * Now, check for To DS not set, i.e. check
7111 * "!(link[1] & 0x01)".
7113 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
7114 b2
= new_block(JMP(BPF_JSET
));
7115 b2
->s
.k
= 0x01; /* To DS */
7120 * If To DS is not set, the DA is at 4.
7122 b1
= gen_mac_multicast(4);
7126 * Now OR together the last two checks. That gives
7127 * the complete set of checks for data frames.
7132 * Now check for a data frame.
7133 * I.e, check "link[0] & 0x08".
7135 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7136 b1
= new_block(JMP(BPF_JSET
));
7141 * AND that with the checks done for data frames.
7146 * If the high-order bit of the type value is 0, this
7147 * is a management frame.
7148 * I.e, check "!(link[0] & 0x08)".
7150 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7151 b2
= new_block(JMP(BPF_JSET
));
7157 * For management frames, the DA is at 4.
7159 b1
= gen_mac_multicast(4);
7163 * OR that with the checks done for data frames.
7164 * That gives the checks done for management and
7170 * If the low-order bit of the type value is 1,
7171 * this is either a control frame or a frame
7172 * with a reserved type, and thus not a
7175 * I.e., check "!(link[0] & 0x04)".
7177 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7178 b1
= new_block(JMP(BPF_JSET
));
7184 * AND that with the checks for data and management
7189 case DLT_IP_OVER_FC
:
7190 b0
= gen_mac_multicast(2);
7195 * Check that the packet doesn't begin with an
7196 * LE Control marker. (We've already generated
7199 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
7203 /* ether[off_mac] & 1 != 0 */
7204 b0
= gen_mac_multicast(off_mac
);
7212 /* Link not known to support multicasts */
7216 b0
= gen_linktype(ETHERTYPE_IP
);
7217 b1
= gen_cmp_ge(OR_NET
, 16, BPF_B
, (bpf_int32
)224);
7223 b0
= gen_linktype(ETHERTYPE_IPV6
);
7224 b1
= gen_cmp(OR_NET
, 24, BPF_B
, (bpf_int32
)255);
7229 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel");
7235 * generate command for inbound/outbound. It's here so we can
7236 * make it link-type specific. 'dir' = 0 implies "inbound",
7237 * = 1 implies "outbound".
7243 register struct block
*b0
;
7246 * Only some data link types support inbound/outbound qualifiers.
7250 b0
= gen_relation(BPF_JEQ
,
7251 gen_load(Q_LINK
, gen_loadi(0), 1),
7259 * Match packets sent by this machine.
7261 b0
= gen_cmp(OR_LINK
, 0, BPF_H
, LINUX_SLL_OUTGOING
);
7264 * Match packets sent to this machine.
7265 * (No broadcast or multicast packets, or
7266 * packets sent to some other machine and
7267 * received promiscuously.)
7269 * XXX - packets sent to other machines probably
7270 * shouldn't be matched, but what about broadcast
7271 * or multicast packets we received?
7273 b0
= gen_cmp(OR_LINK
, 0, BPF_H
, LINUX_SLL_HOST
);
7277 #ifdef HAVE_NET_PFVAR_H
7279 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, dir
), BPF_B
,
7280 (bpf_int32
)((dir
== 0) ? PF_IN
: PF_OUT
));
7286 /* match outgoing packets */
7287 b0
= gen_cmp(OR_LINK
, 0, BPF_B
, PPP_PPPD_OUT
);
7289 /* match incoming packets */
7290 b0
= gen_cmp(OR_LINK
, 0, BPF_B
, PPP_PPPD_IN
);
7294 case DLT_JUNIPER_MFR
:
7295 case DLT_JUNIPER_MLFR
:
7296 case DLT_JUNIPER_MLPPP
:
7297 case DLT_JUNIPER_ATM1
:
7298 case DLT_JUNIPER_ATM2
:
7299 case DLT_JUNIPER_PPPOE
:
7300 case DLT_JUNIPER_PPPOE_ATM
:
7301 case DLT_JUNIPER_GGSN
:
7302 case DLT_JUNIPER_ES
:
7303 case DLT_JUNIPER_MONITOR
:
7304 case DLT_JUNIPER_SERVICES
:
7305 case DLT_JUNIPER_ETHER
:
7306 case DLT_JUNIPER_PPP
:
7307 case DLT_JUNIPER_FRELAY
:
7308 case DLT_JUNIPER_CHDLC
:
7309 case DLT_JUNIPER_VP
:
7310 case DLT_JUNIPER_ST
:
7311 case DLT_JUNIPER_ISM
:
7312 /* juniper flags (including direction) are stored
7313 * the byte after the 3-byte magic number */
7315 /* match outgoing packets */
7316 b0
= gen_mcmp(OR_LINK
, 3, BPF_B
, 0, 0x01);
7318 /* match incoming packets */
7319 b0
= gen_mcmp(OR_LINK
, 3, BPF_B
, 1, 0x01);
7324 bpf_error("inbound/outbound not supported on linktype %d",
7332 #ifdef HAVE_NET_PFVAR_H
7333 /* PF firewall log matched interface */
7335 gen_pf_ifname(const char *ifname
)
7340 if (linktype
!= DLT_PFLOG
) {
7341 bpf_error("ifname supported only on PF linktype");
7344 len
= sizeof(((struct pfloghdr
*)0)->ifname
);
7345 off
= offsetof(struct pfloghdr
, ifname
);
7346 if (strlen(ifname
) >= len
) {
7347 bpf_error("ifname interface names can only be %d characters",
7351 b0
= gen_bcmp(OR_LINK
, off
, strlen(ifname
), (const u_char
*)ifname
);
7355 /* PF firewall log ruleset name */
7357 gen_pf_ruleset(char *ruleset
)
7361 if (linktype
!= DLT_PFLOG
) {
7362 bpf_error("ruleset supported only on PF linktype");
7366 if (strlen(ruleset
) >= sizeof(((struct pfloghdr
*)0)->ruleset
)) {
7367 bpf_error("ruleset names can only be %ld characters",
7368 (long)(sizeof(((struct pfloghdr
*)0)->ruleset
) - 1));
7372 b0
= gen_bcmp(OR_LINK
, offsetof(struct pfloghdr
, ruleset
),
7373 strlen(ruleset
), (const u_char
*)ruleset
);
7377 /* PF firewall log rule number */
7383 if (linktype
!= DLT_PFLOG
) {
7384 bpf_error("rnr supported only on PF linktype");
7388 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, rulenr
), BPF_W
,
7393 /* PF firewall log sub-rule number */
7395 gen_pf_srnr(int srnr
)
7399 if (linktype
!= DLT_PFLOG
) {
7400 bpf_error("srnr supported only on PF linktype");
7404 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, subrulenr
), BPF_W
,
7409 /* PF firewall log reason code */
7411 gen_pf_reason(int reason
)
7415 if (linktype
!= DLT_PFLOG
) {
7416 bpf_error("reason supported only on PF linktype");
7420 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, reason
), BPF_B
,
7425 /* PF firewall log action */
7427 gen_pf_action(int action
)
7431 if (linktype
!= DLT_PFLOG
) {
7432 bpf_error("action supported only on PF linktype");
7436 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, action
), BPF_B
,
7440 #else /* !HAVE_NET_PFVAR_H */
7442 gen_pf_ifname(const char *ifname
)
7444 bpf_error("libpcap was compiled without pf support");
7450 gen_pf_ruleset(char *ruleset
)
7452 bpf_error("libpcap was compiled on a machine without pf support");
7460 bpf_error("libpcap was compiled on a machine without pf support");
7466 gen_pf_srnr(int srnr
)
7468 bpf_error("libpcap was compiled on a machine without pf support");
7474 gen_pf_reason(int reason
)
7476 bpf_error("libpcap was compiled on a machine without pf support");
7482 gen_pf_action(int action
)
7484 bpf_error("libpcap was compiled on a machine without pf support");
7488 #endif /* HAVE_NET_PFVAR_H */
7490 /* IEEE 802.11 wireless header */
7492 gen_p80211_type(int type
, int mask
)
7498 case DLT_IEEE802_11
:
7499 case DLT_PRISM_HEADER
:
7500 case DLT_IEEE802_11_RADIO_AVS
:
7501 case DLT_IEEE802_11_RADIO
:
7502 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, (bpf_int32
)type
,
7507 bpf_error("802.11 link-layer types supported only on 802.11");
7515 gen_p80211_fcdir(int fcdir
)
7521 case DLT_IEEE802_11
:
7522 case DLT_PRISM_HEADER
:
7523 case DLT_IEEE802_11_RADIO_AVS
:
7524 case DLT_IEEE802_11_RADIO
:
7528 bpf_error("frame direction supported only with 802.11 headers");
7532 b0
= gen_mcmp(OR_LINK
, 1, BPF_B
, (bpf_int32
)fcdir
,
7533 (bpf_u_int32
)IEEE80211_FC1_DIR_MASK
);
7540 register const u_char
*eaddr
;
7546 case DLT_ARCNET_LINUX
:
7547 if ((q
.addr
== Q_HOST
|| q
.addr
== Q_DEFAULT
) &&
7549 return (gen_ahostop(eaddr
, (int)q
.dir
));
7551 bpf_error("ARCnet address used in non-arc expression");
7557 bpf_error("aid supported only on ARCnet");
7560 bpf_error("ARCnet address used in non-arc expression");
7565 static struct block
*
7566 gen_ahostop(eaddr
, dir
)
7567 register const u_char
*eaddr
;
7570 register struct block
*b0
, *b1
;
7573 /* src comes first, different from Ethernet */
7575 return gen_bcmp(OR_LINK
, 0, 1, eaddr
);
7578 return gen_bcmp(OR_LINK
, 1, 1, eaddr
);
7581 b0
= gen_ahostop(eaddr
, Q_SRC
);
7582 b1
= gen_ahostop(eaddr
, Q_DST
);
7588 b0
= gen_ahostop(eaddr
, Q_SRC
);
7589 b1
= gen_ahostop(eaddr
, Q_DST
);
7598 * support IEEE 802.1Q VLAN trunk over ethernet
7604 struct block
*b0
, *b1
;
7606 /* can't check for VLAN-encapsulated packets inside MPLS */
7607 if (label_stack_depth
> 0)
7608 bpf_error("no VLAN match after MPLS");
7611 * Check for a VLAN packet, and then change the offsets to point
7612 * to the type and data fields within the VLAN packet. Just
7613 * increment the offsets, so that we can support a hierarchy, e.g.
7614 * "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within
7617 * XXX - this is a bit of a kludge. If we were to split the
7618 * compiler into a parser that parses an expression and
7619 * generates an expression tree, and a code generator that
7620 * takes an expression tree (which could come from our
7621 * parser or from some other parser) and generates BPF code,
7622 * we could perhaps make the offsets parameters of routines
7623 * and, in the handler for an "AND" node, pass to subnodes
7624 * other than the VLAN node the adjusted offsets.
7626 * This would mean that "vlan" would, instead of changing the
7627 * behavior of *all* tests after it, change only the behavior
7628 * of tests ANDed with it. That would change the documented
7629 * semantics of "vlan", which might break some expressions.
7630 * However, it would mean that "(vlan and ip) or ip" would check
7631 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
7632 * checking only for VLAN-encapsulated IP, so that could still
7633 * be considered worth doing; it wouldn't break expressions
7634 * that are of the form "vlan and ..." or "vlan N and ...",
7635 * which I suspect are the most common expressions involving
7636 * "vlan". "vlan or ..." doesn't necessarily do what the user
7637 * would really want, now, as all the "or ..." tests would
7638 * be done assuming a VLAN, even though the "or" could be viewed
7639 * as meaning "or, if this isn't a VLAN packet...".
7646 /* check for VLAN */
7647 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
7648 (bpf_int32
)ETHERTYPE_8021Q
);
7650 /* If a specific VLAN is requested, check VLAN id */
7651 if (vlan_num
>= 0) {
7652 b1
= gen_mcmp(OR_MACPL
, 0, BPF_H
,
7653 (bpf_int32
)vlan_num
, 0x0fff);
7667 bpf_error("no VLAN support for data link type %d",
7682 struct block
*b0
,*b1
;
7685 * Change the offsets to point to the type and data fields within
7686 * the MPLS packet. Just increment the offsets, so that we
7687 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to
7688 * capture packets with an outer label of 100000 and an inner
7691 * XXX - this is a bit of a kludge. See comments in gen_vlan().
7695 if (label_stack_depth
> 0) {
7696 /* just match the bottom-of-stack bit clear */
7697 b0
= gen_mcmp(OR_MACPL
, orig_nl
-2, BPF_B
, 0, 0x01);
7700 * Indicate that we're checking MPLS-encapsulated headers,
7701 * to make sure higher level code generators don't try to
7702 * match against IP-related protocols such as Q_ARP, Q_RARP
7707 case DLT_C_HDLC
: /* fall through */
7709 b0
= gen_linktype(ETHERTYPE_MPLS
);
7713 b0
= gen_linktype(PPP_MPLS_UCAST
);
7716 /* FIXME add other DLT_s ...
7717 * for Frame-Relay/and ATM this may get messy due to SNAP headers
7718 * leave it for now */
7721 bpf_error("no MPLS support for data link type %d",
7729 /* If a specific MPLS label is requested, check it */
7730 if (label_num
>= 0) {
7731 label_num
= label_num
<< 12; /* label is shifted 12 bits on the wire */
7732 b1
= gen_mcmp(OR_MACPL
, orig_nl
, BPF_W
, (bpf_int32
)label_num
,
7733 0xfffff000); /* only compare the first 20 bits */
7740 label_stack_depth
++;
7745 * Support PPPOE discovery and session.
7750 /* check for PPPoE discovery */
7751 return gen_linktype((bpf_int32
)ETHERTYPE_PPPOED
);
7760 * Test against the PPPoE session link-layer type.
7762 b0
= gen_linktype((bpf_int32
)ETHERTYPE_PPPOES
);
7765 * Change the offsets to point to the type and data fields within
7766 * the PPP packet, and note that this is PPPoE rather than
7769 * XXX - this is a bit of a kludge. If we were to split the
7770 * compiler into a parser that parses an expression and
7771 * generates an expression tree, and a code generator that
7772 * takes an expression tree (which could come from our
7773 * parser or from some other parser) and generates BPF code,
7774 * we could perhaps make the offsets parameters of routines
7775 * and, in the handler for an "AND" node, pass to subnodes
7776 * other than the PPPoE node the adjusted offsets.
7778 * This would mean that "pppoes" would, instead of changing the
7779 * behavior of *all* tests after it, change only the behavior
7780 * of tests ANDed with it. That would change the documented
7781 * semantics of "pppoes", which might break some expressions.
7782 * However, it would mean that "(pppoes and ip) or ip" would check
7783 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
7784 * checking only for VLAN-encapsulated IP, so that could still
7785 * be considered worth doing; it wouldn't break expressions
7786 * that are of the form "pppoes and ..." which I suspect are the
7787 * most common expressions involving "pppoes". "pppoes or ..."
7788 * doesn't necessarily do what the user would really want, now,
7789 * as all the "or ..." tests would be done assuming PPPoE, even
7790 * though the "or" could be viewed as meaning "or, if this isn't
7791 * a PPPoE packet...".
7793 orig_linktype
= off_linktype
; /* save original values */
7798 * The "network-layer" protocol is PPPoE, which has a 6-byte
7799 * PPPoE header, followed by a PPP packet.
7801 * There is no HDLC encapsulation for the PPP packet (it's
7802 * encapsulated in PPPoES instead), so the link-layer type
7803 * starts at the first byte of the PPP packet. For PPPoE,
7804 * that offset is relative to the beginning of the total
7805 * link-layer payload, including any 802.2 LLC header, so
7806 * it's 6 bytes past off_nl.
7808 off_linktype
= off_nl
+ 6;
7811 * The network-layer offsets are relative to the beginning
7812 * of the MAC-layer payload; that's past the 6-byte
7813 * PPPoE header and the 2-byte PPP header.
7816 off_nl_nosnap
= 6+2;
7822 gen_atmfield_code(atmfield
, jvalue
, jtype
, reverse
)
7834 bpf_error("'vpi' supported only on raw ATM");
7835 if (off_vpi
== (u_int
)-1)
7837 b0
= gen_ncmp(OR_LINK
, off_vpi
, BPF_B
, 0xffffffff, jtype
,
7843 bpf_error("'vci' supported only on raw ATM");
7844 if (off_vci
== (u_int
)-1)
7846 b0
= gen_ncmp(OR_LINK
, off_vci
, BPF_H
, 0xffffffff, jtype
,
7851 if (off_proto
== (u_int
)-1)
7852 abort(); /* XXX - this isn't on FreeBSD */
7853 b0
= gen_ncmp(OR_LINK
, off_proto
, BPF_B
, 0x0f, jtype
,
7858 if (off_payload
== (u_int
)-1)
7860 b0
= gen_ncmp(OR_LINK
, off_payload
+ MSG_TYPE_POS
, BPF_B
,
7861 0xffffffff, jtype
, reverse
, jvalue
);
7866 bpf_error("'callref' supported only on raw ATM");
7867 if (off_proto
== (u_int
)-1)
7869 b0
= gen_ncmp(OR_LINK
, off_proto
, BPF_B
, 0xffffffff,
7870 jtype
, reverse
, jvalue
);
7880 gen_atmtype_abbrev(type
)
7883 struct block
*b0
, *b1
;
7888 /* Get all packets in Meta signalling Circuit */
7890 bpf_error("'metac' supported only on raw ATM");
7891 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
7892 b1
= gen_atmfield_code(A_VCI
, 1, BPF_JEQ
, 0);
7897 /* Get all packets in Broadcast Circuit*/
7899 bpf_error("'bcc' supported only on raw ATM");
7900 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
7901 b1
= gen_atmfield_code(A_VCI
, 2, BPF_JEQ
, 0);
7906 /* Get all cells in Segment OAM F4 circuit*/
7908 bpf_error("'oam4sc' supported only on raw ATM");
7909 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
7910 b1
= gen_atmfield_code(A_VCI
, 3, BPF_JEQ
, 0);
7915 /* Get all cells in End-to-End OAM F4 Circuit*/
7917 bpf_error("'oam4ec' supported only on raw ATM");
7918 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
7919 b1
= gen_atmfield_code(A_VCI
, 4, BPF_JEQ
, 0);
7924 /* Get all packets in connection Signalling Circuit */
7926 bpf_error("'sc' supported only on raw ATM");
7927 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
7928 b1
= gen_atmfield_code(A_VCI
, 5, BPF_JEQ
, 0);
7933 /* Get all packets in ILMI Circuit */
7935 bpf_error("'ilmic' supported only on raw ATM");
7936 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
7937 b1
= gen_atmfield_code(A_VCI
, 16, BPF_JEQ
, 0);
7942 /* Get all LANE packets */
7944 bpf_error("'lane' supported only on raw ATM");
7945 b1
= gen_atmfield_code(A_PROTOTYPE
, PT_LANE
, BPF_JEQ
, 0);
7948 * Arrange that all subsequent tests assume LANE
7949 * rather than LLC-encapsulated packets, and set
7950 * the offsets appropriately for LANE-encapsulated
7953 * "off_mac" is the offset of the Ethernet header,
7954 * which is 2 bytes past the ATM pseudo-header
7955 * (skipping the pseudo-header and 2-byte LE Client
7956 * field). The other offsets are Ethernet offsets
7957 * relative to "off_mac".
7960 off_mac
= off_payload
+ 2; /* MAC header */
7961 off_linktype
= off_mac
+ 12;
7962 off_macpl
= off_mac
+ 14; /* Ethernet */
7963 off_nl
= 0; /* Ethernet II */
7964 off_nl_nosnap
= 3; /* 802.3+802.2 */
7968 /* Get all LLC-encapsulated packets */
7970 bpf_error("'llc' supported only on raw ATM");
7971 b1
= gen_atmfield_code(A_PROTOTYPE
, PT_LLC
, BPF_JEQ
, 0);
7982 * Filtering for MTP2 messages based on li value
7983 * FISU, length is null
7984 * LSSU, length is 1 or 2
7985 * MSU, length is 3 or more
7988 gen_mtp2type_abbrev(type
)
7991 struct block
*b0
, *b1
;
7996 if ( (linktype
!= DLT_MTP2
) &&
7997 (linktype
!= DLT_ERF
) &&
7998 (linktype
!= DLT_MTP2_WITH_PHDR
) )
7999 bpf_error("'fisu' supported only on MTP2");
8000 /* gen_ncmp(offrel, offset, size, mask, jtype, reverse, value) */
8001 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JEQ
, 0, 0);
8005 if ( (linktype
!= DLT_MTP2
) &&
8006 (linktype
!= DLT_ERF
) &&
8007 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8008 bpf_error("'lssu' supported only on MTP2");
8009 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 1, 2);
8010 b1
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 0, 0);
8015 if ( (linktype
!= DLT_MTP2
) &&
8016 (linktype
!= DLT_ERF
) &&
8017 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8018 bpf_error("'msu' supported only on MTP2");
8019 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 0, 2);
8029 gen_mtp3field_code(mtp3field
, jvalue
, jtype
, reverse
)
8036 bpf_u_int32 val1
, val2
, val3
;
8038 switch (mtp3field
) {
8041 if (off_sio
== (u_int
)-1)
8042 bpf_error("'sio' supported only on SS7");
8043 /* sio coded on 1 byte so max value 255 */
8045 bpf_error("sio value %u too big; max value = 255",
8047 b0
= gen_ncmp(OR_PACKET
, off_sio
, BPF_B
, 0xffffffff,
8048 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8052 if (off_opc
== (u_int
)-1)
8053 bpf_error("'opc' supported only on SS7");
8054 /* opc coded on 14 bits so max value 16383 */
8056 bpf_error("opc value %u too big; max value = 16383",
8058 /* the following instructions are made to convert jvalue
8059 * to the form used to write opc in an ss7 message*/
8060 val1
= jvalue
& 0x00003c00;
8062 val2
= jvalue
& 0x000003fc;
8064 val3
= jvalue
& 0x00000003;
8066 jvalue
= val1
+ val2
+ val3
;
8067 b0
= gen_ncmp(OR_PACKET
, off_opc
, BPF_W
, 0x00c0ff0f,
8068 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8072 if (off_dpc
== (u_int
)-1)
8073 bpf_error("'dpc' supported only on SS7");
8074 /* dpc coded on 14 bits so max value 16383 */
8076 bpf_error("dpc value %u too big; max value = 16383",
8078 /* the following instructions are made to convert jvalue
8079 * to the forme used to write dpc in an ss7 message*/
8080 val1
= jvalue
& 0x000000ff;
8082 val2
= jvalue
& 0x00003f00;
8084 jvalue
= val1
+ val2
;
8085 b0
= gen_ncmp(OR_PACKET
, off_dpc
, BPF_W
, 0xff3f0000,
8086 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8090 if (off_sls
== (u_int
)-1)
8091 bpf_error("'sls' supported only on SS7");
8092 /* sls coded on 4 bits so max value 15 */
8094 bpf_error("sls value %u too big; max value = 15",
8096 /* the following instruction is made to convert jvalue
8097 * to the forme used to write sls in an ss7 message*/
8098 jvalue
= jvalue
<< 4;
8099 b0
= gen_ncmp(OR_PACKET
, off_sls
, BPF_B
, 0xf0,
8100 (u_int
)jtype
,reverse
, (u_int
)jvalue
);
8109 static struct block
*
8110 gen_msg_abbrev(type
)
8116 * Q.2931 signalling protocol messages for handling virtual circuits
8117 * establishment and teardown
8122 b1
= gen_atmfield_code(A_MSGTYPE
, SETUP
, BPF_JEQ
, 0);
8126 b1
= gen_atmfield_code(A_MSGTYPE
, CALL_PROCEED
, BPF_JEQ
, 0);
8130 b1
= gen_atmfield_code(A_MSGTYPE
, CONNECT
, BPF_JEQ
, 0);
8134 b1
= gen_atmfield_code(A_MSGTYPE
, CONNECT_ACK
, BPF_JEQ
, 0);
8138 b1
= gen_atmfield_code(A_MSGTYPE
, RELEASE
, BPF_JEQ
, 0);
8141 case A_RELEASE_DONE
:
8142 b1
= gen_atmfield_code(A_MSGTYPE
, RELEASE_DONE
, BPF_JEQ
, 0);
8152 gen_atmmulti_abbrev(type
)
8155 struct block
*b0
, *b1
;
8161 bpf_error("'oam' supported only on raw ATM");
8162 b1
= gen_atmmulti_abbrev(A_OAMF4
);
8167 bpf_error("'oamf4' supported only on raw ATM");
8169 b0
= gen_atmfield_code(A_VCI
, 3, BPF_JEQ
, 0);
8170 b1
= gen_atmfield_code(A_VCI
, 4, BPF_JEQ
, 0);
8172 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8178 * Get Q.2931 signalling messages for switched
8179 * virtual connection
8182 bpf_error("'connectmsg' supported only on raw ATM");
8183 b0
= gen_msg_abbrev(A_SETUP
);
8184 b1
= gen_msg_abbrev(A_CALLPROCEED
);
8186 b0
= gen_msg_abbrev(A_CONNECT
);
8188 b0
= gen_msg_abbrev(A_CONNECTACK
);
8190 b0
= gen_msg_abbrev(A_RELEASE
);
8192 b0
= gen_msg_abbrev(A_RELEASE_DONE
);
8194 b0
= gen_atmtype_abbrev(A_SC
);
8200 bpf_error("'metaconnect' supported only on raw ATM");
8201 b0
= gen_msg_abbrev(A_SETUP
);
8202 b1
= gen_msg_abbrev(A_CALLPROCEED
);
8204 b0
= gen_msg_abbrev(A_CONNECT
);
8206 b0
= gen_msg_abbrev(A_RELEASE
);
8208 b0
= gen_msg_abbrev(A_RELEASE_DONE
);
8210 b0
= gen_atmtype_abbrev(A_METAC
);