1 /*#define CHASE_CHAIN*/
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 static const char rcsid
[] _U_
=
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.309 2008-12-23 20:13:29 guy Exp $ (LBL)";
32 #include <pcap-stdinc.h>
39 #ifdef HAVE_SYS_BITYPES_H
40 #include <sys/bitypes.h>
42 #include <sys/types.h>
43 #include <sys/socket.h>
47 * XXX - why was this included even on UNIX?
56 #include <sys/param.h>
59 #include <netinet/in.h>
60 #include <arpa/inet.h>
76 #include "ethertype.h"
80 #include "ieee80211.h"
82 #include "sunatmpos.h"
85 #include "pcap/ipnet.h"
87 #if defined(PF_PACKET) && defined(SO_ATTACH_FILTER)
88 #include <linux/types.h>
89 #include <linux/if_packet.h>
90 #include <linux/filter.h>
92 #ifdef HAVE_NET_PFVAR_H
93 #include <sys/socket.h>
95 #include <net/pf/pfvar.h>
96 #include <net/pf/if_pflog.h>
99 #define offsetof(s, e) ((size_t)&((s *)0)->e)
103 #include <netdb.h> /* for "struct addrinfo" */
106 #include <pcap/namedb.h>
108 #define ETHERMTU 1500
110 #ifndef IPPROTO_HOPOPTS
111 #define IPPROTO_HOPOPTS 0
113 #ifndef IPPROTO_ROUTING
114 #define IPPROTO_ROUTING 43
116 #ifndef IPPROTO_FRAGMENT
117 #define IPPROTO_FRAGMENT 44
119 #ifndef IPPROTO_DSTOPTS
120 #define IPPROTO_DSTOPTS 60
123 #define IPPROTO_SCTP 132
126 #ifdef HAVE_OS_PROTO_H
127 #include "os-proto.h"
130 #define JMP(c) ((c)|BPF_JMP|BPF_K)
133 static jmp_buf top_ctx
;
134 static pcap_t
*bpf_pcap
;
136 /* Hack for updating VLAN, MPLS, and PPPoE offsets. */
138 static u_int orig_linktype
= (u_int
)-1, orig_nl
= (u_int
)-1, label_stack_depth
= (u_int
)-1;
140 static u_int orig_linktype
= -1U, orig_nl
= -1U, label_stack_depth
= -1U;
145 static int pcap_fddipad
;
150 bpf_error(const char *fmt
, ...)
155 if (bpf_pcap
!= NULL
)
156 (void)vsnprintf(pcap_geterr(bpf_pcap
), PCAP_ERRBUF_SIZE
,
163 static void init_linktype(pcap_t
*);
165 static void init_regs(void);
166 static int alloc_reg(void);
167 static void free_reg(int);
169 static struct block
*root
;
172 * Value passed to gen_load_a() to indicate what the offset argument
176 OR_PACKET
, /* relative to the beginning of the packet */
177 OR_LINK
, /* relative to the beginning of the link-layer header */
178 OR_MACPL
, /* relative to the end of the MAC-layer header */
179 OR_NET
, /* relative to the network-layer header */
180 OR_NET_NOSNAP
, /* relative to the network-layer header, with no SNAP header at the link layer */
181 OR_TRAN_IPV4
, /* relative to the transport-layer header, with IPv4 network layer */
182 OR_TRAN_IPV6
/* relative to the transport-layer header, with IPv6 network layer */
187 * As errors are handled by a longjmp, anything allocated must be freed
188 * in the longjmp handler, so it must be reachable from that handler.
189 * One thing that's allocated is the result of pcap_nametoaddrinfo();
190 * it must be freed with freeaddrinfo(). This variable points to any
191 * addrinfo structure that would need to be freed.
193 static struct addrinfo
*ai
;
197 * We divy out chunks of memory rather than call malloc each time so
198 * we don't have to worry about leaking memory. It's probably
199 * not a big deal if all this memory was wasted but if this ever
200 * goes into a library that would probably not be a good idea.
202 * XXX - this *is* in a library....
205 #define CHUNK0SIZE 1024
211 static struct chunk chunks
[NCHUNKS
];
212 static int cur_chunk
;
214 static void *newchunk(u_int
);
215 static void freechunks(void);
216 static inline struct block
*new_block(int);
217 static inline struct slist
*new_stmt(int);
218 static struct block
*gen_retblk(int);
219 static inline void syntax(void);
221 static void backpatch(struct block
*, struct block
*);
222 static void merge(struct block
*, struct block
*);
223 static struct block
*gen_cmp(enum e_offrel
, u_int
, u_int
, bpf_int32
);
224 static struct block
*gen_cmp_gt(enum e_offrel
, u_int
, u_int
, bpf_int32
);
225 static struct block
*gen_cmp_ge(enum e_offrel
, u_int
, u_int
, bpf_int32
);
226 static struct block
*gen_cmp_lt(enum e_offrel
, u_int
, u_int
, bpf_int32
);
227 static struct block
*gen_cmp_le(enum e_offrel
, u_int
, u_int
, bpf_int32
);
228 static struct block
*gen_mcmp(enum e_offrel
, u_int
, u_int
, bpf_int32
,
230 static struct block
*gen_bcmp(enum e_offrel
, u_int
, u_int
, const u_char
*);
231 static struct block
*gen_ncmp(enum e_offrel
, bpf_u_int32
, bpf_u_int32
,
232 bpf_u_int32
, bpf_u_int32
, int, bpf_int32
);
233 static struct slist
*gen_load_llrel(u_int
, u_int
);
234 static struct slist
*gen_load_macplrel(u_int
, u_int
);
235 static struct slist
*gen_load_a(enum e_offrel
, u_int
, u_int
);
236 static struct slist
*gen_loadx_iphdrlen(void);
237 static struct block
*gen_uncond(int);
238 static inline struct block
*gen_true(void);
239 static inline struct block
*gen_false(void);
240 static struct block
*gen_ether_linktype(int);
241 static struct block
*gen_ipnet_linktype(int);
242 static struct block
*gen_linux_sll_linktype(int);
243 static struct slist
*gen_load_prism_llprefixlen(void);
244 static struct slist
*gen_load_avs_llprefixlen(void);
245 static struct slist
*gen_load_radiotap_llprefixlen(void);
246 static struct slist
*gen_load_ppi_llprefixlen(void);
247 static void insert_compute_vloffsets(struct block
*);
248 static struct slist
*gen_llprefixlen(void);
249 static struct slist
*gen_off_macpl(void);
250 static int ethertype_to_ppptype(int);
251 static struct block
*gen_linktype(int);
252 static struct block
*gen_snap(bpf_u_int32
, bpf_u_int32
);
253 static struct block
*gen_llc_linktype(int);
254 static struct block
*gen_hostop(bpf_u_int32
, bpf_u_int32
, int, int, u_int
, u_int
);
256 static struct block
*gen_hostop6(struct in6_addr
*, struct in6_addr
*, int, int, u_int
, u_int
);
258 static struct block
*gen_ahostop(const u_char
*, int);
259 static struct block
*gen_ehostop(const u_char
*, int);
260 static struct block
*gen_fhostop(const u_char
*, int);
261 static struct block
*gen_thostop(const u_char
*, int);
262 static struct block
*gen_wlanhostop(const u_char
*, int);
263 static struct block
*gen_ipfchostop(const u_char
*, int);
264 static struct block
*gen_dnhostop(bpf_u_int32
, int);
265 static struct block
*gen_mpls_linktype(int);
266 static struct block
*gen_host(bpf_u_int32
, bpf_u_int32
, int, int, int);
268 static struct block
*gen_host6(struct in6_addr
*, struct in6_addr
*, int, int, int);
271 static struct block
*gen_gateway(const u_char
*, bpf_u_int32
**, int, int);
273 static struct block
*gen_ipfrag(void);
274 static struct block
*gen_portatom(int, bpf_int32
);
275 static struct block
*gen_portrangeatom(int, bpf_int32
, bpf_int32
);
276 static struct block
*gen_portatom6(int, bpf_int32
);
277 static struct block
*gen_portrangeatom6(int, bpf_int32
, bpf_int32
);
278 struct block
*gen_portop(int, int, int);
279 static struct block
*gen_port(int, int, int);
280 struct block
*gen_portrangeop(int, int, int, int);
281 static struct block
*gen_portrange(int, int, int, int);
282 struct block
*gen_portop6(int, int, int);
283 static struct block
*gen_port6(int, int, int);
284 struct block
*gen_portrangeop6(int, int, int, int);
285 static struct block
*gen_portrange6(int, int, int, int);
286 static int lookup_proto(const char *, int);
287 static struct block
*gen_protochain(int, int, int);
288 static struct block
*gen_proto(int, int, int);
289 static struct slist
*xfer_to_x(struct arth
*);
290 static struct slist
*xfer_to_a(struct arth
*);
291 static struct block
*gen_mac_multicast(int);
292 static struct block
*gen_len(int, int);
293 static struct block
*gen_check_802_11_data_frame(void);
295 static struct block
*gen_ppi_dlt_check(void);
296 static struct block
*gen_msg_abbrev(int type
);
307 /* XXX Round up to nearest long. */
308 n
= (n
+ sizeof(long) - 1) & ~(sizeof(long) - 1);
310 /* XXX Round up to structure boundary. */
314 cp
= &chunks
[cur_chunk
];
315 if (n
> cp
->n_left
) {
316 ++cp
, k
= ++cur_chunk
;
318 bpf_error("out of memory");
319 size
= CHUNK0SIZE
<< k
;
320 cp
->m
= (void *)malloc(size
);
322 bpf_error("out of memory");
323 memset((char *)cp
->m
, 0, size
);
326 bpf_error("out of memory");
329 return (void *)((char *)cp
->m
+ cp
->n_left
);
338 for (i
= 0; i
< NCHUNKS
; ++i
)
339 if (chunks
[i
].m
!= NULL
) {
346 * A strdup whose allocations are freed after code generation is over.
350 register const char *s
;
352 int n
= strlen(s
) + 1;
353 char *cp
= newchunk(n
);
359 static inline struct block
*
365 p
= (struct block
*)newchunk(sizeof(*p
));
372 static inline struct slist
*
378 p
= (struct slist
*)newchunk(sizeof(*p
));
384 static struct block
*
388 struct block
*b
= new_block(BPF_RET
|BPF_K
);
397 bpf_error("syntax error in filter expression");
400 static bpf_u_int32 netmask
;
405 pcap_compile_unsafe(pcap_t
*p
, struct bpf_program
*program
,
406 const char *buf
, int optimize
, bpf_u_int32 mask
);
409 pcap_compile(pcap_t
*p
, struct bpf_program
*program
,
410 const char *buf
, int optimize
, bpf_u_int32 mask
)
414 EnterCriticalSection(&g_PcapCompileCriticalSection
);
416 result
= pcap_compile_unsafe(p
, program
, buf
, optimize
, mask
);
418 LeaveCriticalSection(&g_PcapCompileCriticalSection
);
424 pcap_compile_unsafe(pcap_t
*p
, struct bpf_program
*program
,
425 const char *buf
, int optimize
, bpf_u_int32 mask
)
428 pcap_compile(pcap_t
*p
, struct bpf_program
*program
,
429 const char *buf
, int optimize
, bpf_u_int32 mask
)
433 const char * volatile xbuf
= buf
;
437 * If this pcap_t hasn't been activated, it doesn't have a
438 * link-layer type, so we can't use it.
441 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
442 "not-yet-activated pcap_t passed to pcap_compile");
450 if (setjmp(top_ctx
)) {
464 snaplen
= pcap_snapshot(p
);
466 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
467 "snaplen of 0 rejects all packets");
471 lex_init(xbuf
? xbuf
: "");
479 root
= gen_retblk(snaplen
);
481 if (optimize
&& !no_optimize
) {
484 (root
->s
.code
== (BPF_RET
|BPF_K
) && root
->s
.k
== 0))
485 bpf_error("expression rejects all packets");
487 program
->bf_insns
= icode_to_fcode(root
, &len
);
488 program
->bf_len
= len
;
496 * entry point for using the compiler with no pcap open
497 * pass in all the stuff that is needed explicitly instead.
500 pcap_compile_nopcap(int snaplen_arg
, int linktype_arg
,
501 struct bpf_program
*program
,
502 const char *buf
, int optimize
, bpf_u_int32 mask
)
507 p
= pcap_open_dead(linktype_arg
, snaplen_arg
);
510 ret
= pcap_compile(p
, program
, buf
, optimize
, mask
);
516 * Clean up a "struct bpf_program" by freeing all the memory allocated
520 pcap_freecode(struct bpf_program
*program
)
523 if (program
->bf_insns
!= NULL
) {
524 free((char *)program
->bf_insns
);
525 program
->bf_insns
= NULL
;
530 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
531 * which of the jt and jf fields has been resolved and which is a pointer
532 * back to another unresolved block (or nil). At least one of the fields
533 * in each block is already resolved.
536 backpatch(list
, target
)
537 struct block
*list
, *target
;
554 * Merge the lists in b0 and b1, using the 'sense' field to indicate
555 * which of jt and jf is the link.
559 struct block
*b0
, *b1
;
561 register struct block
**p
= &b0
;
563 /* Find end of list. */
565 p
= !((*p
)->sense
) ? &JT(*p
) : &JF(*p
);
567 /* Concatenate the lists. */
575 struct block
*ppi_dlt_check
;
578 * Insert before the statements of the first (root) block any
579 * statements needed to load the lengths of any variable-length
580 * headers into registers.
582 * XXX - a fancier strategy would be to insert those before the
583 * statements of all blocks that use those lengths and that
584 * have no predecessors that use them, so that we only compute
585 * the lengths if we need them. There might be even better
586 * approaches than that.
588 * However, those strategies would be more complicated, and
589 * as we don't generate code to compute a length if the
590 * program has no tests that use the length, and as most
591 * tests will probably use those lengths, we would just
592 * postpone computing the lengths so that it's not done
593 * for tests that fail early, and it's not clear that's
596 insert_compute_vloffsets(p
->head
);
599 * For DLT_PPI captures, generate a check of the per-packet
600 * DLT value to make sure it's DLT_IEEE802_11.
602 ppi_dlt_check
= gen_ppi_dlt_check();
603 if (ppi_dlt_check
!= NULL
)
604 gen_and(ppi_dlt_check
, p
);
606 backpatch(p
, gen_retblk(snaplen
));
607 p
->sense
= !p
->sense
;
608 backpatch(p
, gen_retblk(0));
614 struct block
*b0
, *b1
;
616 backpatch(b0
, b1
->head
);
617 b0
->sense
= !b0
->sense
;
618 b1
->sense
= !b1
->sense
;
620 b1
->sense
= !b1
->sense
;
626 struct block
*b0
, *b1
;
628 b0
->sense
= !b0
->sense
;
629 backpatch(b0
, b1
->head
);
630 b0
->sense
= !b0
->sense
;
639 b
->sense
= !b
->sense
;
642 static struct block
*
643 gen_cmp(offrel
, offset
, size
, v
)
644 enum e_offrel offrel
;
648 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JEQ
, 0, v
);
651 static struct block
*
652 gen_cmp_gt(offrel
, offset
, size
, v
)
653 enum e_offrel offrel
;
657 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGT
, 0, v
);
660 static struct block
*
661 gen_cmp_ge(offrel
, offset
, size
, v
)
662 enum e_offrel offrel
;
666 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGE
, 0, v
);
669 static struct block
*
670 gen_cmp_lt(offrel
, offset
, size
, v
)
671 enum e_offrel offrel
;
675 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGE
, 1, v
);
678 static struct block
*
679 gen_cmp_le(offrel
, offset
, size
, v
)
680 enum e_offrel offrel
;
684 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGT
, 1, v
);
687 static struct block
*
688 gen_mcmp(offrel
, offset
, size
, v
, mask
)
689 enum e_offrel offrel
;
694 return gen_ncmp(offrel
, offset
, size
, mask
, BPF_JEQ
, 0, v
);
697 static struct block
*
698 gen_bcmp(offrel
, offset
, size
, v
)
699 enum e_offrel offrel
;
700 register u_int offset
, size
;
701 register const u_char
*v
;
703 register struct block
*b
, *tmp
;
707 register const u_char
*p
= &v
[size
- 4];
708 bpf_int32 w
= ((bpf_int32
)p
[0] << 24) |
709 ((bpf_int32
)p
[1] << 16) | ((bpf_int32
)p
[2] << 8) | p
[3];
711 tmp
= gen_cmp(offrel
, offset
+ size
- 4, BPF_W
, w
);
718 register const u_char
*p
= &v
[size
- 2];
719 bpf_int32 w
= ((bpf_int32
)p
[0] << 8) | p
[1];
721 tmp
= gen_cmp(offrel
, offset
+ size
- 2, BPF_H
, w
);
728 tmp
= gen_cmp(offrel
, offset
, BPF_B
, (bpf_int32
)v
[0]);
737 * AND the field of size "size" at offset "offset" relative to the header
738 * specified by "offrel" with "mask", and compare it with the value "v"
739 * with the test specified by "jtype"; if "reverse" is true, the test
740 * should test the opposite of "jtype".
742 static struct block
*
743 gen_ncmp(offrel
, offset
, size
, mask
, jtype
, reverse
, v
)
744 enum e_offrel offrel
;
746 bpf_u_int32 offset
, size
, mask
, jtype
;
749 struct slist
*s
, *s2
;
752 s
= gen_load_a(offrel
, offset
, size
);
754 if (mask
!= 0xffffffff) {
755 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
760 b
= new_block(JMP(jtype
));
763 if (reverse
&& (jtype
== BPF_JGT
|| jtype
== BPF_JGE
))
769 * Various code constructs need to know the layout of the data link
770 * layer. These variables give the necessary offsets from the beginning
771 * of the packet data.
775 * This is the offset of the beginning of the link-layer header from
776 * the beginning of the raw packet data.
778 * It's usually 0, except for 802.11 with a fixed-length radio header.
779 * (For 802.11 with a variable-length radio header, we have to generate
780 * code to compute that offset; off_ll is 0 in that case.)
785 * If there's a variable-length header preceding the link-layer header,
786 * "reg_off_ll" is the register number for a register containing the
787 * length of that header, and therefore the offset of the link-layer
788 * header from the beginning of the raw packet data. Otherwise,
789 * "reg_off_ll" is -1.
791 static int reg_off_ll
;
794 * This is the offset of the beginning of the MAC-layer header from
795 * the beginning of the link-layer header.
796 * It's usually 0, except for ATM LANE, where it's the offset, relative
797 * to the beginning of the raw packet data, of the Ethernet header, and
798 * for Ethernet with various additional information.
800 static u_int off_mac
;
803 * This is the offset of the beginning of the MAC-layer payload,
804 * from the beginning of the raw packet data.
806 * I.e., it's the sum of the length of the link-layer header (without,
807 * for example, any 802.2 LLC header, so it's the MAC-layer
808 * portion of that header), plus any prefix preceding the
811 static u_int off_macpl
;
814 * This is 1 if the offset of the beginning of the MAC-layer payload
815 * from the beginning of the link-layer header is variable-length.
817 static int off_macpl_is_variable
;
820 * If the link layer has variable_length headers, "reg_off_macpl"
821 * is the register number for a register containing the length of the
822 * link-layer header plus the length of any variable-length header
823 * preceding the link-layer header. Otherwise, "reg_off_macpl"
826 static int reg_off_macpl
;
829 * "off_linktype" is the offset to information in the link-layer header
830 * giving the packet type. This offset is relative to the beginning
831 * of the link-layer header (i.e., it doesn't include off_ll).
833 * For Ethernet, it's the offset of the Ethernet type field.
835 * For link-layer types that always use 802.2 headers, it's the
836 * offset of the LLC header.
838 * For PPP, it's the offset of the PPP type field.
840 * For Cisco HDLC, it's the offset of the CHDLC type field.
842 * For BSD loopback, it's the offset of the AF_ value.
844 * For Linux cooked sockets, it's the offset of the type field.
846 * It's set to -1 for no encapsulation, in which case, IP is assumed.
848 static u_int off_linktype
;
851 * TRUE if "pppoes" appeared in the filter; it causes link-layer type
852 * checks to check the PPP header, assumed to follow a LAN-style link-
853 * layer header and a PPPoE session header.
855 static int is_pppoes
= 0;
858 * TRUE if the link layer includes an ATM pseudo-header.
860 static int is_atm
= 0;
863 * TRUE if "lane" appeared in the filter; it causes us to generate
864 * code that assumes LANE rather than LLC-encapsulated traffic in SunATM.
866 static int is_lane
= 0;
869 * These are offsets for the ATM pseudo-header.
871 static u_int off_vpi
;
872 static u_int off_vci
;
873 static u_int off_proto
;
876 * These are offsets for the MTP2 fields.
881 * These are offsets for the MTP3 fields.
883 static u_int off_sio
;
884 static u_int off_opc
;
885 static u_int off_dpc
;
886 static u_int off_sls
;
889 * This is the offset of the first byte after the ATM pseudo_header,
890 * or -1 if there is no ATM pseudo-header.
892 static u_int off_payload
;
895 * These are offsets to the beginning of the network-layer header.
896 * They are relative to the beginning of the MAC-layer payload (i.e.,
897 * they don't include off_ll or off_macpl).
899 * If the link layer never uses 802.2 LLC:
901 * "off_nl" and "off_nl_nosnap" are the same.
903 * If the link layer always uses 802.2 LLC:
905 * "off_nl" is the offset if there's a SNAP header following
908 * "off_nl_nosnap" is the offset if there's no SNAP header.
910 * If the link layer is Ethernet:
912 * "off_nl" is the offset if the packet is an Ethernet II packet
913 * (we assume no 802.3+802.2+SNAP);
915 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet
916 * with an 802.2 header following it.
919 static u_int off_nl_nosnap
;
927 linktype
= pcap_datalink(p
);
929 pcap_fddipad
= p
->fddipad
;
933 * Assume it's not raw ATM with a pseudo-header, for now.
944 * And that we're not doing PPPoE.
949 * And assume we're not doing SS7.
958 * Also assume it's not 802.11.
962 off_macpl_is_variable
= 0;
966 label_stack_depth
= 0;
976 off_nl
= 0; /* XXX in reality, variable! */
977 off_nl_nosnap
= 0; /* no 802.2 LLC */
980 case DLT_ARCNET_LINUX
:
983 off_nl
= 0; /* XXX in reality, variable! */
984 off_nl_nosnap
= 0; /* no 802.2 LLC */
989 off_macpl
= 14; /* Ethernet header length */
990 off_nl
= 0; /* Ethernet II */
991 off_nl_nosnap
= 3; /* 802.3+802.2 */
996 * SLIP doesn't have a link level type. The 16 byte
997 * header is hacked into our SLIP driver.
1002 off_nl_nosnap
= 0; /* no 802.2 LLC */
1005 case DLT_SLIP_BSDOS
:
1006 /* XXX this may be the same as the DLT_PPP_BSDOS case */
1011 off_nl_nosnap
= 0; /* no 802.2 LLC */
1019 off_nl_nosnap
= 0; /* no 802.2 LLC */
1026 off_nl_nosnap
= 0; /* no 802.2 LLC */
1031 case DLT_C_HDLC
: /* BSD/OS Cisco HDLC */
1032 case DLT_PPP_SERIAL
: /* NetBSD sync/async serial PPP */
1036 off_nl_nosnap
= 0; /* no 802.2 LLC */
1041 * This does no include the Ethernet header, and
1042 * only covers session state.
1047 off_nl_nosnap
= 0; /* no 802.2 LLC */
1054 off_nl_nosnap
= 0; /* no 802.2 LLC */
1059 * FDDI doesn't really have a link-level type field.
1060 * We set "off_linktype" to the offset of the LLC header.
1062 * To check for Ethernet types, we assume that SSAP = SNAP
1063 * is being used and pick out the encapsulated Ethernet type.
1064 * XXX - should we generate code to check for SNAP?
1068 off_linktype
+= pcap_fddipad
;
1070 off_macpl
= 13; /* FDDI MAC header length */
1072 off_macpl
+= pcap_fddipad
;
1074 off_nl
= 8; /* 802.2+SNAP */
1075 off_nl_nosnap
= 3; /* 802.2 */
1080 * Token Ring doesn't really have a link-level type field.
1081 * We set "off_linktype" to the offset of the LLC header.
1083 * To check for Ethernet types, we assume that SSAP = SNAP
1084 * is being used and pick out the encapsulated Ethernet type.
1085 * XXX - should we generate code to check for SNAP?
1087 * XXX - the header is actually variable-length.
1088 * Some various Linux patched versions gave 38
1089 * as "off_linktype" and 40 as "off_nl"; however,
1090 * if a token ring packet has *no* routing
1091 * information, i.e. is not source-routed, the correct
1092 * values are 20 and 22, as they are in the vanilla code.
1094 * A packet is source-routed iff the uppermost bit
1095 * of the first byte of the source address, at an
1096 * offset of 8, has the uppermost bit set. If the
1097 * packet is source-routed, the total number of bytes
1098 * of routing information is 2 plus bits 0x1F00 of
1099 * the 16-bit value at an offset of 14 (shifted right
1100 * 8 - figure out which byte that is).
1103 off_macpl
= 14; /* Token Ring MAC header length */
1104 off_nl
= 8; /* 802.2+SNAP */
1105 off_nl_nosnap
= 3; /* 802.2 */
1108 case DLT_IEEE802_11
:
1109 case DLT_PRISM_HEADER
:
1110 case DLT_IEEE802_11_RADIO_AVS
:
1111 case DLT_IEEE802_11_RADIO
:
1113 * 802.11 doesn't really have a link-level type field.
1114 * We set "off_linktype" to the offset of the LLC header.
1116 * To check for Ethernet types, we assume that SSAP = SNAP
1117 * is being used and pick out the encapsulated Ethernet type.
1118 * XXX - should we generate code to check for SNAP?
1120 * We also handle variable-length radio headers here.
1121 * The Prism header is in theory variable-length, but in
1122 * practice it's always 144 bytes long. However, some
1123 * drivers on Linux use ARPHRD_IEEE80211_PRISM, but
1124 * sometimes or always supply an AVS header, so we
1125 * have to check whether the radio header is a Prism
1126 * header or an AVS header, so, in practice, it's
1130 off_macpl
= 0; /* link-layer header is variable-length */
1131 off_macpl_is_variable
= 1;
1132 off_nl
= 8; /* 802.2+SNAP */
1133 off_nl_nosnap
= 3; /* 802.2 */
1138 * At the moment we treat PPI the same way that we treat
1139 * normal Radiotap encoded packets. The difference is in
1140 * the function that generates the code at the beginning
1141 * to compute the header length. Since this code generator
1142 * of PPI supports bare 802.11 encapsulation only (i.e.
1143 * the encapsulated DLT should be DLT_IEEE802_11) we
1144 * generate code to check for this too.
1147 off_macpl
= 0; /* link-layer header is variable-length */
1148 off_macpl_is_variable
= 1;
1149 off_nl
= 8; /* 802.2+SNAP */
1150 off_nl_nosnap
= 3; /* 802.2 */
1153 case DLT_ATM_RFC1483
:
1154 case DLT_ATM_CLIP
: /* Linux ATM defines this */
1156 * assume routed, non-ISO PDUs
1157 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
1159 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS,
1160 * or PPP with the PPP NLPID (e.g., PPPoA)? The
1161 * latter would presumably be treated the way PPPoE
1162 * should be, so you can do "pppoe and udp port 2049"
1163 * or "pppoa and tcp port 80" and have it check for
1164 * PPPo{A,E} and a PPP protocol of IP and....
1167 off_macpl
= 0; /* packet begins with LLC header */
1168 off_nl
= 8; /* 802.2+SNAP */
1169 off_nl_nosnap
= 3; /* 802.2 */
1174 * Full Frontal ATM; you get AALn PDUs with an ATM
1178 off_vpi
= SUNATM_VPI_POS
;
1179 off_vci
= SUNATM_VCI_POS
;
1180 off_proto
= PROTO_POS
;
1181 off_mac
= -1; /* assume LLC-encapsulated, so no MAC-layer header */
1182 off_payload
= SUNATM_PKT_BEGIN_POS
;
1183 off_linktype
= off_payload
;
1184 off_macpl
= off_payload
; /* if LLC-encapsulated */
1185 off_nl
= 8; /* 802.2+SNAP */
1186 off_nl_nosnap
= 3; /* 802.2 */
1195 off_nl_nosnap
= 0; /* no 802.2 LLC */
1198 case DLT_LINUX_SLL
: /* fake header for Linux cooked socket */
1202 off_nl_nosnap
= 0; /* no 802.2 LLC */
1207 * LocalTalk does have a 1-byte type field in the LLAP header,
1208 * but really it just indicates whether there is a "short" or
1209 * "long" DDP packet following.
1214 off_nl_nosnap
= 0; /* no 802.2 LLC */
1217 case DLT_IP_OVER_FC
:
1219 * RFC 2625 IP-over-Fibre-Channel doesn't really have a
1220 * link-level type field. We set "off_linktype" to the
1221 * offset of the LLC header.
1223 * To check for Ethernet types, we assume that SSAP = SNAP
1224 * is being used and pick out the encapsulated Ethernet type.
1225 * XXX - should we generate code to check for SNAP? RFC
1226 * 2625 says SNAP should be used.
1230 off_nl
= 8; /* 802.2+SNAP */
1231 off_nl_nosnap
= 3; /* 802.2 */
1236 * XXX - we should set this to handle SNAP-encapsulated
1237 * frames (NLPID of 0x80).
1242 off_nl_nosnap
= 0; /* no 802.2 LLC */
1246 * the only BPF-interesting FRF.16 frames are non-control frames;
1247 * Frame Relay has a variable length link-layer
1248 * so lets start with offset 4 for now and increments later on (FIXME);
1254 off_nl_nosnap
= 0; /* XXX - for now -> no 802.2 LLC */
1257 case DLT_APPLE_IP_OVER_IEEE1394
:
1261 off_nl_nosnap
= 0; /* no 802.2 LLC */
1264 case DLT_SYMANTEC_FIREWALL
:
1267 off_nl
= 0; /* Ethernet II */
1268 off_nl_nosnap
= 0; /* XXX - what does it do with 802.3 packets? */
1271 #ifdef HAVE_NET_PFVAR_H
1274 off_macpl
= PFLOG_HDRLEN
;
1276 off_nl_nosnap
= 0; /* no 802.2 LLC */
1280 case DLT_JUNIPER_MFR
:
1281 case DLT_JUNIPER_MLFR
:
1282 case DLT_JUNIPER_MLPPP
:
1283 case DLT_JUNIPER_PPP
:
1284 case DLT_JUNIPER_CHDLC
:
1285 case DLT_JUNIPER_FRELAY
:
1289 off_nl_nosnap
= -1; /* no 802.2 LLC */
1292 case DLT_JUNIPER_ATM1
:
1293 off_linktype
= 4; /* in reality variable between 4-8 */
1294 off_macpl
= 4; /* in reality variable between 4-8 */
1299 case DLT_JUNIPER_ATM2
:
1300 off_linktype
= 8; /* in reality variable between 8-12 */
1301 off_macpl
= 8; /* in reality variable between 8-12 */
1306 /* frames captured on a Juniper PPPoE service PIC
1307 * contain raw ethernet frames */
1308 case DLT_JUNIPER_PPPOE
:
1309 case DLT_JUNIPER_ETHER
:
1312 off_nl
= 18; /* Ethernet II */
1313 off_nl_nosnap
= 21; /* 802.3+802.2 */
1316 case DLT_JUNIPER_PPPOE_ATM
:
1320 off_nl_nosnap
= -1; /* no 802.2 LLC */
1323 case DLT_JUNIPER_GGSN
:
1327 off_nl_nosnap
= -1; /* no 802.2 LLC */
1330 case DLT_JUNIPER_ES
:
1332 off_macpl
= -1; /* not really a network layer but raw IP addresses */
1333 off_nl
= -1; /* not really a network layer but raw IP addresses */
1334 off_nl_nosnap
= -1; /* no 802.2 LLC */
1337 case DLT_JUNIPER_MONITOR
:
1340 off_nl
= 0; /* raw IP/IP6 header */
1341 off_nl_nosnap
= -1; /* no 802.2 LLC */
1344 case DLT_JUNIPER_SERVICES
:
1346 off_macpl
= -1; /* L3 proto location dep. on cookie type */
1347 off_nl
= -1; /* L3 proto location dep. on cookie type */
1348 off_nl_nosnap
= -1; /* no 802.2 LLC */
1351 case DLT_JUNIPER_VP
:
1358 case DLT_JUNIPER_ST
:
1365 case DLT_JUNIPER_ISM
:
1372 case DLT_JUNIPER_VS
:
1373 case DLT_JUNIPER_SRX_E2E
:
1374 case DLT_JUNIPER_FIBRECHANNEL
:
1375 case DLT_JUNIPER_ATM_CEMIC
:
1394 case DLT_MTP2_WITH_PHDR
:
1427 * Currently, only raw "link[N:M]" filtering is supported.
1429 off_linktype
= -1; /* variable, min 15, max 71 steps of 7 */
1431 off_nl
= -1; /* variable, min 16, max 71 steps of 7 */
1432 off_nl_nosnap
= -1; /* no 802.2 LLC */
1433 off_mac
= 1; /* step over the kiss length byte */
1438 off_macpl
= 24; /* ipnet header length */
1443 case DLT_NETANALYZER
:
1444 off_mac
= 4; /* MAC header is past 4-byte pseudo-header */
1445 off_linktype
= 16; /* includes 4-byte pseudo-header */
1446 off_macpl
= 18; /* pseudo-header+Ethernet header length */
1447 off_nl
= 0; /* Ethernet II */
1448 off_nl_nosnap
= 3; /* 802.3+802.2 */
1451 case DLT_NETANALYZER_TRANSPARENT
:
1452 off_mac
= 12; /* MAC header is past 4-byte pseudo-header, preamble, and SFD */
1453 off_linktype
= 24; /* includes 4-byte pseudo-header+preamble+SFD */
1454 off_macpl
= 26; /* pseudo-header+preamble+SFD+Ethernet header length */
1455 off_nl
= 0; /* Ethernet II */
1456 off_nl_nosnap
= 3; /* 802.3+802.2 */
1461 * For values in the range in which we've assigned new
1462 * DLT_ values, only raw "link[N:M]" filtering is supported.
1464 if (linktype
>= DLT_MATCHING_MIN
&&
1465 linktype
<= DLT_MATCHING_MAX
) {
1474 bpf_error("unknown data link type %d", linktype
);
1479 * Load a value relative to the beginning of the link-layer header.
1480 * The link-layer header doesn't necessarily begin at the beginning
1481 * of the packet data; there might be a variable-length prefix containing
1482 * radio information.
1484 static struct slist
*
1485 gen_load_llrel(offset
, size
)
1488 struct slist
*s
, *s2
;
1490 s
= gen_llprefixlen();
1493 * If "s" is non-null, it has code to arrange that the X register
1494 * contains the length of the prefix preceding the link-layer
1497 * Otherwise, the length of the prefix preceding the link-layer
1498 * header is "off_ll".
1502 * There's a variable-length prefix preceding the
1503 * link-layer header. "s" points to a list of statements
1504 * that put the length of that prefix into the X register.
1505 * do an indirect load, to use the X register as an offset.
1507 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1512 * There is no variable-length header preceding the
1513 * link-layer header; add in off_ll, which, if there's
1514 * a fixed-length header preceding the link-layer header,
1515 * is the length of that header.
1517 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1518 s
->s
.k
= offset
+ off_ll
;
1524 * Load a value relative to the beginning of the MAC-layer payload.
1526 static struct slist
*
1527 gen_load_macplrel(offset
, size
)
1530 struct slist
*s
, *s2
;
1532 s
= gen_off_macpl();
1535 * If s is non-null, the offset of the MAC-layer payload is
1536 * variable, and s points to a list of instructions that
1537 * arrange that the X register contains that offset.
1539 * Otherwise, the offset of the MAC-layer payload is constant,
1540 * and is in off_macpl.
1544 * The offset of the MAC-layer payload is in the X
1545 * register. Do an indirect load, to use the X register
1548 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1553 * The offset of the MAC-layer payload is constant,
1554 * and is in off_macpl; load the value at that offset
1555 * plus the specified offset.
1557 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1558 s
->s
.k
= off_macpl
+ offset
;
1564 * Load a value relative to the beginning of the specified header.
1566 static struct slist
*
1567 gen_load_a(offrel
, offset
, size
)
1568 enum e_offrel offrel
;
1571 struct slist
*s
, *s2
;
1576 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1581 s
= gen_load_llrel(offset
, size
);
1585 s
= gen_load_macplrel(offset
, size
);
1589 s
= gen_load_macplrel(off_nl
+ offset
, size
);
1593 s
= gen_load_macplrel(off_nl_nosnap
+ offset
, size
);
1598 * Load the X register with the length of the IPv4 header
1599 * (plus the offset of the link-layer header, if it's
1600 * preceded by a variable-length header such as a radio
1601 * header), in bytes.
1603 s
= gen_loadx_iphdrlen();
1606 * Load the item at {offset of the MAC-layer payload} +
1607 * {offset, relative to the start of the MAC-layer
1608 * paylod, of the IPv4 header} + {length of the IPv4 header} +
1609 * {specified offset}.
1611 * (If the offset of the MAC-layer payload is variable,
1612 * it's included in the value in the X register, and
1615 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1616 s2
->s
.k
= off_macpl
+ off_nl
+ offset
;
1621 s
= gen_load_macplrel(off_nl
+ 40 + offset
, size
);
1632 * Generate code to load into the X register the sum of the length of
1633 * the IPv4 header and any variable-length header preceding the link-layer
1636 static struct slist
*
1637 gen_loadx_iphdrlen()
1639 struct slist
*s
, *s2
;
1641 s
= gen_off_macpl();
1644 * There's a variable-length prefix preceding the
1645 * link-layer header, or the link-layer header is itself
1646 * variable-length. "s" points to a list of statements
1647 * that put the offset of the MAC-layer payload into
1650 * The 4*([k]&0xf) addressing mode can't be used, as we
1651 * don't have a constant offset, so we have to load the
1652 * value in question into the A register and add to it
1653 * the value from the X register.
1655 s2
= new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
1658 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
1661 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
1666 * The A register now contains the length of the
1667 * IP header. We need to add to it the offset of
1668 * the MAC-layer payload, which is still in the X
1669 * register, and move the result into the X register.
1671 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
1672 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
1675 * There is no variable-length header preceding the
1676 * link-layer header, and the link-layer header is
1677 * fixed-length; load the length of the IPv4 header,
1678 * which is at an offset of off_nl from the beginning
1679 * of the MAC-layer payload, and thus at an offset
1680 * of off_mac_pl + off_nl from the beginning of the
1683 s
= new_stmt(BPF_LDX
|BPF_MSH
|BPF_B
);
1684 s
->s
.k
= off_macpl
+ off_nl
;
1689 static struct block
*
1696 s
= new_stmt(BPF_LD
|BPF_IMM
);
1698 b
= new_block(JMP(BPF_JEQ
));
1704 static inline struct block
*
1707 return gen_uncond(1);
1710 static inline struct block
*
1713 return gen_uncond(0);
1717 * Byte-swap a 32-bit number.
1718 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
1719 * big-endian platforms.)
1721 #define SWAPLONG(y) \
1722 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
1725 * Generate code to match a particular packet type.
1727 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1728 * value, if <= ETHERMTU. We use that to determine whether to
1729 * match the type/length field or to check the type/length field for
1730 * a value <= ETHERMTU to see whether it's a type field and then do
1731 * the appropriate test.
1733 static struct block
*
1734 gen_ether_linktype(proto
)
1737 struct block
*b0
, *b1
;
1743 case LLCSAP_NETBEUI
:
1745 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1746 * so we check the DSAP and SSAP.
1748 * LLCSAP_IP checks for IP-over-802.2, rather
1749 * than IP-over-Ethernet or IP-over-SNAP.
1751 * XXX - should we check both the DSAP and the
1752 * SSAP, like this, or should we check just the
1753 * DSAP, as we do for other types <= ETHERMTU
1754 * (i.e., other SAP values)?
1756 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1758 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)
1759 ((proto
<< 8) | proto
));
1767 * Ethernet_II frames, which are Ethernet
1768 * frames with a frame type of ETHERTYPE_IPX;
1770 * Ethernet_802.3 frames, which are 802.3
1771 * frames (i.e., the type/length field is
1772 * a length field, <= ETHERMTU, rather than
1773 * a type field) with the first two bytes
1774 * after the Ethernet/802.3 header being
1777 * Ethernet_802.2 frames, which are 802.3
1778 * frames with an 802.2 LLC header and
1779 * with the IPX LSAP as the DSAP in the LLC
1782 * Ethernet_SNAP frames, which are 802.3
1783 * frames with an LLC header and a SNAP
1784 * header and with an OUI of 0x000000
1785 * (encapsulated Ethernet) and a protocol
1786 * ID of ETHERTYPE_IPX in the SNAP header.
1788 * XXX - should we generate the same code both
1789 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
1793 * This generates code to check both for the
1794 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
1796 b0
= gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)LLCSAP_IPX
);
1797 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)0xFFFF);
1801 * Now we add code to check for SNAP frames with
1802 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
1804 b0
= gen_snap(0x000000, ETHERTYPE_IPX
);
1808 * Now we generate code to check for 802.3
1809 * frames in general.
1811 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1815 * Now add the check for 802.3 frames before the
1816 * check for Ethernet_802.2 and Ethernet_802.3,
1817 * as those checks should only be done on 802.3
1818 * frames, not on Ethernet frames.
1823 * Now add the check for Ethernet_II frames, and
1824 * do that before checking for the other frame
1827 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
1828 (bpf_int32
)ETHERTYPE_IPX
);
1832 case ETHERTYPE_ATALK
:
1833 case ETHERTYPE_AARP
:
1835 * EtherTalk (AppleTalk protocols on Ethernet link
1836 * layer) may use 802.2 encapsulation.
1840 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1841 * we check for an Ethernet type field less than
1842 * 1500, which means it's an 802.3 length field.
1844 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1848 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1849 * SNAP packets with an organization code of
1850 * 0x080007 (Apple, for Appletalk) and a protocol
1851 * type of ETHERTYPE_ATALK (Appletalk).
1853 * 802.2-encapsulated ETHERTYPE_AARP packets are
1854 * SNAP packets with an organization code of
1855 * 0x000000 (encapsulated Ethernet) and a protocol
1856 * type of ETHERTYPE_AARP (Appletalk ARP).
1858 if (proto
== ETHERTYPE_ATALK
)
1859 b1
= gen_snap(0x080007, ETHERTYPE_ATALK
);
1860 else /* proto == ETHERTYPE_AARP */
1861 b1
= gen_snap(0x000000, ETHERTYPE_AARP
);
1865 * Check for Ethernet encapsulation (Ethertalk
1866 * phase 1?); we just check for the Ethernet
1869 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
1875 if (proto
<= ETHERMTU
) {
1877 * This is an LLC SAP value, so the frames
1878 * that match would be 802.2 frames.
1879 * Check that the frame is an 802.2 frame
1880 * (i.e., that the length/type field is
1881 * a length field, <= ETHERMTU) and
1882 * then check the DSAP.
1884 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1886 b1
= gen_cmp(OR_LINK
, off_linktype
+ 2, BPF_B
,
1892 * This is an Ethernet type, so compare
1893 * the length/type field with it (if
1894 * the frame is an 802.2 frame, the length
1895 * field will be <= ETHERMTU, and, as
1896 * "proto" is > ETHERMTU, this test
1897 * will fail and the frame won't match,
1898 * which is what we want).
1900 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
1907 * "proto" is an Ethernet type value and for IPNET, if it is not IPv4
1908 * or IPv6 then we have an error.
1910 static struct block
*
1911 gen_ipnet_linktype(proto
)
1917 return gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
1918 (bpf_int32
)IPH_AF_INET
);
1921 case ETHERTYPE_IPV6
:
1922 return gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
1923 (bpf_int32
)IPH_AF_INET6
);
1934 * Generate code to match a particular packet type.
1936 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1937 * value, if <= ETHERMTU. We use that to determine whether to
1938 * match the type field or to check the type field for the special
1939 * LINUX_SLL_P_802_2 value and then do the appropriate test.
1941 static struct block
*
1942 gen_linux_sll_linktype(proto
)
1945 struct block
*b0
, *b1
;
1951 case LLCSAP_NETBEUI
:
1953 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1954 * so we check the DSAP and SSAP.
1956 * LLCSAP_IP checks for IP-over-802.2, rather
1957 * than IP-over-Ethernet or IP-over-SNAP.
1959 * XXX - should we check both the DSAP and the
1960 * SSAP, like this, or should we check just the
1961 * DSAP, as we do for other types <= ETHERMTU
1962 * (i.e., other SAP values)?
1964 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
1965 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)
1966 ((proto
<< 8) | proto
));
1972 * Ethernet_II frames, which are Ethernet
1973 * frames with a frame type of ETHERTYPE_IPX;
1975 * Ethernet_802.3 frames, which have a frame
1976 * type of LINUX_SLL_P_802_3;
1978 * Ethernet_802.2 frames, which are 802.3
1979 * frames with an 802.2 LLC header (i.e, have
1980 * a frame type of LINUX_SLL_P_802_2) and
1981 * with the IPX LSAP as the DSAP in the LLC
1984 * Ethernet_SNAP frames, which are 802.3
1985 * frames with an LLC header and a SNAP
1986 * header and with an OUI of 0x000000
1987 * (encapsulated Ethernet) and a protocol
1988 * ID of ETHERTYPE_IPX in the SNAP header.
1990 * First, do the checks on LINUX_SLL_P_802_2
1991 * frames; generate the check for either
1992 * Ethernet_802.2 or Ethernet_SNAP frames, and
1993 * then put a check for LINUX_SLL_P_802_2 frames
1996 b0
= gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)LLCSAP_IPX
);
1997 b1
= gen_snap(0x000000, ETHERTYPE_IPX
);
1999 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
2003 * Now check for 802.3 frames and OR that with
2004 * the previous test.
2006 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_3
);
2010 * Now add the check for Ethernet_II frames, and
2011 * do that before checking for the other frame
2014 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2015 (bpf_int32
)ETHERTYPE_IPX
);
2019 case ETHERTYPE_ATALK
:
2020 case ETHERTYPE_AARP
:
2022 * EtherTalk (AppleTalk protocols on Ethernet link
2023 * layer) may use 802.2 encapsulation.
2027 * Check for 802.2 encapsulation (EtherTalk phase 2?);
2028 * we check for the 802.2 protocol type in the
2029 * "Ethernet type" field.
2031 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
2034 * 802.2-encapsulated ETHERTYPE_ATALK packets are
2035 * SNAP packets with an organization code of
2036 * 0x080007 (Apple, for Appletalk) and a protocol
2037 * type of ETHERTYPE_ATALK (Appletalk).
2039 * 802.2-encapsulated ETHERTYPE_AARP packets are
2040 * SNAP packets with an organization code of
2041 * 0x000000 (encapsulated Ethernet) and a protocol
2042 * type of ETHERTYPE_AARP (Appletalk ARP).
2044 if (proto
== ETHERTYPE_ATALK
)
2045 b1
= gen_snap(0x080007, ETHERTYPE_ATALK
);
2046 else /* proto == ETHERTYPE_AARP */
2047 b1
= gen_snap(0x000000, ETHERTYPE_AARP
);
2051 * Check for Ethernet encapsulation (Ethertalk
2052 * phase 1?); we just check for the Ethernet
2055 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
2061 if (proto
<= ETHERMTU
) {
2063 * This is an LLC SAP value, so the frames
2064 * that match would be 802.2 frames.
2065 * Check for the 802.2 protocol type
2066 * in the "Ethernet type" field, and
2067 * then check the DSAP.
2069 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2071 b1
= gen_cmp(OR_LINK
, off_macpl
, BPF_B
,
2077 * This is an Ethernet type, so compare
2078 * the length/type field with it (if
2079 * the frame is an 802.2 frame, the length
2080 * field will be <= ETHERMTU, and, as
2081 * "proto" is > ETHERMTU, this test
2082 * will fail and the frame won't match,
2083 * which is what we want).
2085 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2091 static struct slist
*
2092 gen_load_prism_llprefixlen()
2094 struct slist
*s1
, *s2
;
2095 struct slist
*sjeq_avs_cookie
;
2096 struct slist
*sjcommon
;
2099 * This code is not compatible with the optimizer, as
2100 * we are generating jmp instructions within a normal
2101 * slist of instructions
2106 * Generate code to load the length of the radio header into
2107 * the register assigned to hold that length, if one has been
2108 * assigned. (If one hasn't been assigned, no code we've
2109 * generated uses that prefix, so we don't need to generate any
2112 * Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes
2113 * or always use the AVS header rather than the Prism header.
2114 * We load a 4-byte big-endian value at the beginning of the
2115 * raw packet data, and see whether, when masked with 0xFFFFF000,
2116 * it's equal to 0x80211000. If so, that indicates that it's
2117 * an AVS header (the masked-out bits are the version number).
2118 * Otherwise, it's a Prism header.
2120 * XXX - the Prism header is also, in theory, variable-length,
2121 * but no known software generates headers that aren't 144
2124 if (reg_off_ll
!= -1) {
2128 s1
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2132 * AND it with 0xFFFFF000.
2134 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
2135 s2
->s
.k
= 0xFFFFF000;
2139 * Compare with 0x80211000.
2141 sjeq_avs_cookie
= new_stmt(JMP(BPF_JEQ
));
2142 sjeq_avs_cookie
->s
.k
= 0x80211000;
2143 sappend(s1
, sjeq_avs_cookie
);
2148 * The 4 bytes at an offset of 4 from the beginning of
2149 * the AVS header are the length of the AVS header.
2150 * That field is big-endian.
2152 s2
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2155 sjeq_avs_cookie
->s
.jt
= s2
;
2158 * Now jump to the code to allocate a register
2159 * into which to save the header length and
2160 * store the length there. (The "jump always"
2161 * instruction needs to have the k field set;
2162 * it's added to the PC, so, as we're jumping
2163 * over a single instruction, it should be 1.)
2165 sjcommon
= new_stmt(JMP(BPF_JA
));
2167 sappend(s1
, sjcommon
);
2170 * Now for the code that handles the Prism header.
2171 * Just load the length of the Prism header (144)
2172 * into the A register. Have the test for an AVS
2173 * header branch here if we don't have an AVS header.
2175 s2
= new_stmt(BPF_LD
|BPF_W
|BPF_IMM
);
2178 sjeq_avs_cookie
->s
.jf
= s2
;
2181 * Now allocate a register to hold that value and store
2182 * it. The code for the AVS header will jump here after
2183 * loading the length of the AVS header.
2185 s2
= new_stmt(BPF_ST
);
2186 s2
->s
.k
= reg_off_ll
;
2188 sjcommon
->s
.jf
= s2
;
2191 * Now move it into the X register.
2193 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2201 static struct slist
*
2202 gen_load_avs_llprefixlen()
2204 struct slist
*s1
, *s2
;
2207 * Generate code to load the length of the AVS header into
2208 * the register assigned to hold that length, if one has been
2209 * assigned. (If one hasn't been assigned, no code we've
2210 * generated uses that prefix, so we don't need to generate any
2213 if (reg_off_ll
!= -1) {
2215 * The 4 bytes at an offset of 4 from the beginning of
2216 * the AVS header are the length of the AVS header.
2217 * That field is big-endian.
2219 s1
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2223 * Now allocate a register to hold that value and store
2226 s2
= new_stmt(BPF_ST
);
2227 s2
->s
.k
= reg_off_ll
;
2231 * Now move it into the X register.
2233 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2241 static struct slist
*
2242 gen_load_radiotap_llprefixlen()
2244 struct slist
*s1
, *s2
;
2247 * Generate code to load the length of the radiotap header into
2248 * the register assigned to hold that length, if one has been
2249 * assigned. (If one hasn't been assigned, no code we've
2250 * generated uses that prefix, so we don't need to generate any
2253 if (reg_off_ll
!= -1) {
2255 * The 2 bytes at offsets of 2 and 3 from the beginning
2256 * of the radiotap header are the length of the radiotap
2257 * header; unfortunately, it's little-endian, so we have
2258 * to load it a byte at a time and construct the value.
2262 * Load the high-order byte, at an offset of 3, shift it
2263 * left a byte, and put the result in the X register.
2265 s1
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2267 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
2270 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2274 * Load the next byte, at an offset of 2, and OR the
2275 * value from the X register into it.
2277 s2
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2280 s2
= new_stmt(BPF_ALU
|BPF_OR
|BPF_X
);
2284 * Now allocate a register to hold that value and store
2287 s2
= new_stmt(BPF_ST
);
2288 s2
->s
.k
= reg_off_ll
;
2292 * Now move it into the X register.
2294 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2303 * At the moment we treat PPI as normal Radiotap encoded
2304 * packets. The difference is in the function that generates
2305 * the code at the beginning to compute the header length.
2306 * Since this code generator of PPI supports bare 802.11
2307 * encapsulation only (i.e. the encapsulated DLT should be
2308 * DLT_IEEE802_11) we generate code to check for this too;
2309 * that's done in finish_parse().
2311 static struct slist
*
2312 gen_load_ppi_llprefixlen()
2314 struct slist
*s1
, *s2
;
2317 * Generate code to load the length of the radiotap header
2318 * into the register assigned to hold that length, if one has
2321 if (reg_off_ll
!= -1) {
2323 * The 2 bytes at offsets of 2 and 3 from the beginning
2324 * of the radiotap header are the length of the radiotap
2325 * header; unfortunately, it's little-endian, so we have
2326 * to load it a byte at a time and construct the value.
2330 * Load the high-order byte, at an offset of 3, shift it
2331 * left a byte, and put the result in the X register.
2333 s1
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2335 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
2338 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2342 * Load the next byte, at an offset of 2, and OR the
2343 * value from the X register into it.
2345 s2
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2348 s2
= new_stmt(BPF_ALU
|BPF_OR
|BPF_X
);
2352 * Now allocate a register to hold that value and store
2355 s2
= new_stmt(BPF_ST
);
2356 s2
->s
.k
= reg_off_ll
;
2360 * Now move it into the X register.
2362 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2371 * Load a value relative to the beginning of the link-layer header after the 802.11
2372 * header, i.e. LLC_SNAP.
2373 * The link-layer header doesn't necessarily begin at the beginning
2374 * of the packet data; there might be a variable-length prefix containing
2375 * radio information.
2377 static struct slist
*
2378 gen_load_802_11_header_len(struct slist
*s
, struct slist
*snext
)
2381 struct slist
*sjset_data_frame_1
;
2382 struct slist
*sjset_data_frame_2
;
2383 struct slist
*sjset_qos
;
2384 struct slist
*sjset_radiotap_flags
;
2385 struct slist
*sjset_radiotap_tsft
;
2386 struct slist
*sjset_tsft_datapad
, *sjset_notsft_datapad
;
2387 struct slist
*s_roundup
;
2389 if (reg_off_macpl
== -1) {
2391 * No register has been assigned to the offset of
2392 * the MAC-layer payload, which means nobody needs
2393 * it; don't bother computing it - just return
2394 * what we already have.
2400 * This code is not compatible with the optimizer, as
2401 * we are generating jmp instructions within a normal
2402 * slist of instructions
2407 * If "s" is non-null, it has code to arrange that the X register
2408 * contains the length of the prefix preceding the link-layer
2411 * Otherwise, the length of the prefix preceding the link-layer
2412 * header is "off_ll".
2416 * There is no variable-length header preceding the
2417 * link-layer header.
2419 * Load the length of the fixed-length prefix preceding
2420 * the link-layer header (if any) into the X register,
2421 * and store it in the reg_off_macpl register.
2422 * That length is off_ll.
2424 s
= new_stmt(BPF_LDX
|BPF_IMM
);
2429 * The X register contains the offset of the beginning of the
2430 * link-layer header; add 24, which is the minimum length
2431 * of the MAC header for a data frame, to that, and store it
2432 * in reg_off_macpl, and then load the Frame Control field,
2433 * which is at the offset in the X register, with an indexed load.
2435 s2
= new_stmt(BPF_MISC
|BPF_TXA
);
2437 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
2440 s2
= new_stmt(BPF_ST
);
2441 s2
->s
.k
= reg_off_macpl
;
2444 s2
= new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
2449 * Check the Frame Control field to see if this is a data frame;
2450 * a data frame has the 0x08 bit (b3) in that field set and the
2451 * 0x04 bit (b2) clear.
2453 sjset_data_frame_1
= new_stmt(JMP(BPF_JSET
));
2454 sjset_data_frame_1
->s
.k
= 0x08;
2455 sappend(s
, sjset_data_frame_1
);
2458 * If b3 is set, test b2, otherwise go to the first statement of
2459 * the rest of the program.
2461 sjset_data_frame_1
->s
.jt
= sjset_data_frame_2
= new_stmt(JMP(BPF_JSET
));
2462 sjset_data_frame_2
->s
.k
= 0x04;
2463 sappend(s
, sjset_data_frame_2
);
2464 sjset_data_frame_1
->s
.jf
= snext
;
2467 * If b2 is not set, this is a data frame; test the QoS bit.
2468 * Otherwise, go to the first statement of the rest of the
2471 sjset_data_frame_2
->s
.jt
= snext
;
2472 sjset_data_frame_2
->s
.jf
= sjset_qos
= new_stmt(JMP(BPF_JSET
));
2473 sjset_qos
->s
.k
= 0x80; /* QoS bit */
2474 sappend(s
, sjset_qos
);
2477 * If it's set, add 2 to reg_off_macpl, to skip the QoS
2479 * Otherwise, go to the first statement of the rest of the
2482 sjset_qos
->s
.jt
= s2
= new_stmt(BPF_LD
|BPF_MEM
);
2483 s2
->s
.k
= reg_off_macpl
;
2485 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_IMM
);
2488 s2
= new_stmt(BPF_ST
);
2489 s2
->s
.k
= reg_off_macpl
;
2493 * If we have a radiotap header, look at it to see whether
2494 * there's Atheros padding between the MAC-layer header
2497 * Note: all of the fields in the radiotap header are
2498 * little-endian, so we byte-swap all of the values
2499 * we test against, as they will be loaded as big-endian
2502 if (linktype
== DLT_IEEE802_11_RADIO
) {
2504 * Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set
2505 * in the presence flag?
2507 sjset_qos
->s
.jf
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_W
);
2511 sjset_radiotap_flags
= new_stmt(JMP(BPF_JSET
));
2512 sjset_radiotap_flags
->s
.k
= SWAPLONG(0x00000002);
2513 sappend(s
, sjset_radiotap_flags
);
2516 * If not, skip all of this.
2518 sjset_radiotap_flags
->s
.jf
= snext
;
2521 * Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set?
2523 sjset_radiotap_tsft
= sjset_radiotap_flags
->s
.jt
=
2524 new_stmt(JMP(BPF_JSET
));
2525 sjset_radiotap_tsft
->s
.k
= SWAPLONG(0x00000001);
2526 sappend(s
, sjset_radiotap_tsft
);
2529 * If IEEE80211_RADIOTAP_TSFT is set, the flags field is
2530 * at an offset of 16 from the beginning of the raw packet
2531 * data (8 bytes for the radiotap header and 8 bytes for
2534 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2537 sjset_radiotap_tsft
->s
.jt
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
2541 sjset_tsft_datapad
= new_stmt(JMP(BPF_JSET
));
2542 sjset_tsft_datapad
->s
.k
= 0x20;
2543 sappend(s
, sjset_tsft_datapad
);
2546 * If IEEE80211_RADIOTAP_TSFT is not set, the flags field is
2547 * at an offset of 8 from the beginning of the raw packet
2548 * data (8 bytes for the radiotap header).
2550 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2553 sjset_radiotap_tsft
->s
.jf
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
2557 sjset_notsft_datapad
= new_stmt(JMP(BPF_JSET
));
2558 sjset_notsft_datapad
->s
.k
= 0x20;
2559 sappend(s
, sjset_notsft_datapad
);
2562 * In either case, if IEEE80211_RADIOTAP_F_DATAPAD is
2563 * set, round the length of the 802.11 header to
2564 * a multiple of 4. Do that by adding 3 and then
2565 * dividing by and multiplying by 4, which we do by
2568 s_roundup
= new_stmt(BPF_LD
|BPF_MEM
);
2569 s_roundup
->s
.k
= reg_off_macpl
;
2570 sappend(s
, s_roundup
);
2571 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_IMM
);
2574 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_IMM
);
2577 s2
= new_stmt(BPF_ST
);
2578 s2
->s
.k
= reg_off_macpl
;
2581 sjset_tsft_datapad
->s
.jt
= s_roundup
;
2582 sjset_tsft_datapad
->s
.jf
= snext
;
2583 sjset_notsft_datapad
->s
.jt
= s_roundup
;
2584 sjset_notsft_datapad
->s
.jf
= snext
;
2586 sjset_qos
->s
.jf
= snext
;
2592 insert_compute_vloffsets(b
)
2598 * For link-layer types that have a variable-length header
2599 * preceding the link-layer header, generate code to load
2600 * the offset of the link-layer header into the register
2601 * assigned to that offset, if any.
2605 case DLT_PRISM_HEADER
:
2606 s
= gen_load_prism_llprefixlen();
2609 case DLT_IEEE802_11_RADIO_AVS
:
2610 s
= gen_load_avs_llprefixlen();
2613 case DLT_IEEE802_11_RADIO
:
2614 s
= gen_load_radiotap_llprefixlen();
2618 s
= gen_load_ppi_llprefixlen();
2627 * For link-layer types that have a variable-length link-layer
2628 * header, generate code to load the offset of the MAC-layer
2629 * payload into the register assigned to that offset, if any.
2633 case DLT_IEEE802_11
:
2634 case DLT_PRISM_HEADER
:
2635 case DLT_IEEE802_11_RADIO_AVS
:
2636 case DLT_IEEE802_11_RADIO
:
2638 s
= gen_load_802_11_header_len(s
, b
->stmts
);
2643 * If we have any offset-loading code, append all the
2644 * existing statements in the block to those statements,
2645 * and make the resulting list the list of statements
2649 sappend(s
, b
->stmts
);
2654 static struct block
*
2655 gen_ppi_dlt_check(void)
2657 struct slist
*s_load_dlt
;
2660 if (linktype
== DLT_PPI
)
2662 /* Create the statements that check for the DLT
2664 s_load_dlt
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2665 s_load_dlt
->s
.k
= 4;
2667 b
= new_block(JMP(BPF_JEQ
));
2669 b
->stmts
= s_load_dlt
;
2670 b
->s
.k
= SWAPLONG(DLT_IEEE802_11
);
2680 static struct slist
*
2681 gen_prism_llprefixlen(void)
2685 if (reg_off_ll
== -1) {
2687 * We haven't yet assigned a register for the length
2688 * of the radio header; allocate one.
2690 reg_off_ll
= alloc_reg();
2694 * Load the register containing the radio length
2695 * into the X register.
2697 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2698 s
->s
.k
= reg_off_ll
;
2702 static struct slist
*
2703 gen_avs_llprefixlen(void)
2707 if (reg_off_ll
== -1) {
2709 * We haven't yet assigned a register for the length
2710 * of the AVS header; allocate one.
2712 reg_off_ll
= alloc_reg();
2716 * Load the register containing the AVS length
2717 * into the X register.
2719 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2720 s
->s
.k
= reg_off_ll
;
2724 static struct slist
*
2725 gen_radiotap_llprefixlen(void)
2729 if (reg_off_ll
== -1) {
2731 * We haven't yet assigned a register for the length
2732 * of the radiotap header; allocate one.
2734 reg_off_ll
= alloc_reg();
2738 * Load the register containing the radiotap length
2739 * into the X register.
2741 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2742 s
->s
.k
= reg_off_ll
;
2747 * At the moment we treat PPI as normal Radiotap encoded
2748 * packets. The difference is in the function that generates
2749 * the code at the beginning to compute the header length.
2750 * Since this code generator of PPI supports bare 802.11
2751 * encapsulation only (i.e. the encapsulated DLT should be
2752 * DLT_IEEE802_11) we generate code to check for this too.
2754 static struct slist
*
2755 gen_ppi_llprefixlen(void)
2759 if (reg_off_ll
== -1) {
2761 * We haven't yet assigned a register for the length
2762 * of the radiotap header; allocate one.
2764 reg_off_ll
= alloc_reg();
2768 * Load the register containing the PPI length
2769 * into the X register.
2771 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2772 s
->s
.k
= reg_off_ll
;
2777 * Generate code to compute the link-layer header length, if necessary,
2778 * putting it into the X register, and to return either a pointer to a
2779 * "struct slist" for the list of statements in that code, or NULL if
2780 * no code is necessary.
2782 static struct slist
*
2783 gen_llprefixlen(void)
2787 case DLT_PRISM_HEADER
:
2788 return gen_prism_llprefixlen();
2790 case DLT_IEEE802_11_RADIO_AVS
:
2791 return gen_avs_llprefixlen();
2793 case DLT_IEEE802_11_RADIO
:
2794 return gen_radiotap_llprefixlen();
2797 return gen_ppi_llprefixlen();
2805 * Generate code to load the register containing the offset of the
2806 * MAC-layer payload into the X register; if no register for that offset
2807 * has been allocated, allocate it first.
2809 static struct slist
*
2814 if (off_macpl_is_variable
) {
2815 if (reg_off_macpl
== -1) {
2817 * We haven't yet assigned a register for the offset
2818 * of the MAC-layer payload; allocate one.
2820 reg_off_macpl
= alloc_reg();
2824 * Load the register containing the offset of the MAC-layer
2825 * payload into the X register.
2827 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2828 s
->s
.k
= reg_off_macpl
;
2832 * That offset isn't variable, so we don't need to
2833 * generate any code.
2840 * Map an Ethernet type to the equivalent PPP type.
2843 ethertype_to_ppptype(proto
)
2852 case ETHERTYPE_IPV6
:
2860 case ETHERTYPE_ATALK
:
2874 * I'm assuming the "Bridging PDU"s that go
2875 * over PPP are Spanning Tree Protocol
2889 * Generate code to match a particular packet type by matching the
2890 * link-layer type field or fields in the 802.2 LLC header.
2892 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
2893 * value, if <= ETHERMTU.
2895 static struct block
*
2899 struct block
*b0
, *b1
, *b2
;
2901 /* are we checking MPLS-encapsulated packets? */
2902 if (label_stack_depth
> 0) {
2906 /* FIXME add other L3 proto IDs */
2907 return gen_mpls_linktype(Q_IP
);
2909 case ETHERTYPE_IPV6
:
2911 /* FIXME add other L3 proto IDs */
2912 return gen_mpls_linktype(Q_IPV6
);
2915 bpf_error("unsupported protocol over mpls");
2921 * Are we testing PPPoE packets?
2925 * The PPPoE session header is part of the
2926 * MAC-layer payload, so all references
2927 * should be relative to the beginning of
2932 * We use Ethernet protocol types inside libpcap;
2933 * map them to the corresponding PPP protocol types.
2935 proto
= ethertype_to_ppptype(proto
);
2936 return gen_cmp(OR_MACPL
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
2942 case DLT_NETANALYZER
:
2943 case DLT_NETANALYZER_TRANSPARENT
:
2944 return gen_ether_linktype(proto
);
2952 proto
= (proto
<< 8 | LLCSAP_ISONS
);
2956 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2963 case DLT_IEEE802_11
:
2964 case DLT_PRISM_HEADER
:
2965 case DLT_IEEE802_11_RADIO_AVS
:
2966 case DLT_IEEE802_11_RADIO
:
2969 * Check that we have a data frame.
2971 b0
= gen_check_802_11_data_frame();
2974 * Now check for the specified link-layer type.
2976 b1
= gen_llc_linktype(proto
);
2984 * XXX - check for asynchronous frames, as per RFC 1103.
2986 return gen_llc_linktype(proto
);
2992 * XXX - check for LLC PDUs, as per IEEE 802.5.
2994 return gen_llc_linktype(proto
);
2998 case DLT_ATM_RFC1483
:
3000 case DLT_IP_OVER_FC
:
3001 return gen_llc_linktype(proto
);
3007 * If "is_lane" is set, check for a LANE-encapsulated
3008 * version of this protocol, otherwise check for an
3009 * LLC-encapsulated version of this protocol.
3011 * We assume LANE means Ethernet, not Token Ring.
3015 * Check that the packet doesn't begin with an
3016 * LE Control marker. (We've already generated
3019 b0
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
, BPF_H
,
3024 * Now generate an Ethernet test.
3026 b1
= gen_ether_linktype(proto
);
3031 * Check for LLC encapsulation and then check the
3034 b0
= gen_atmfield_code(A_PROTOTYPE
, PT_LLC
, BPF_JEQ
, 0);
3035 b1
= gen_llc_linktype(proto
);
3043 return gen_linux_sll_linktype(proto
);
3048 case DLT_SLIP_BSDOS
:
3051 * These types don't provide any type field; packets
3052 * are always IPv4 or IPv6.
3054 * XXX - for IPv4, check for a version number of 4, and,
3055 * for IPv6, check for a version number of 6?
3060 /* Check for a version number of 4. */
3061 return gen_mcmp(OR_LINK
, 0, BPF_B
, 0x40, 0xF0);
3063 case ETHERTYPE_IPV6
:
3064 /* Check for a version number of 6. */
3065 return gen_mcmp(OR_LINK
, 0, BPF_B
, 0x60, 0xF0);
3068 return gen_false(); /* always false */
3075 * Raw IPv4, so no type field.
3077 if (proto
== ETHERTYPE_IP
)
3078 return gen_true(); /* always true */
3080 /* Checking for something other than IPv4; always false */
3087 * Raw IPv6, so no type field.
3089 if (proto
== ETHERTYPE_IPV6
)
3090 return gen_true(); /* always true */
3092 /* Checking for something other than IPv6; always false */
3099 case DLT_PPP_SERIAL
:
3102 * We use Ethernet protocol types inside libpcap;
3103 * map them to the corresponding PPP protocol types.
3105 proto
= ethertype_to_ppptype(proto
);
3106 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
3112 * We use Ethernet protocol types inside libpcap;
3113 * map them to the corresponding PPP protocol types.
3119 * Also check for Van Jacobson-compressed IP.
3120 * XXX - do this for other forms of PPP?
3122 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_IP
);
3123 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_VJC
);
3125 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_VJNC
);
3130 proto
= ethertype_to_ppptype(proto
);
3131 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
3141 * For DLT_NULL, the link-layer header is a 32-bit
3142 * word containing an AF_ value in *host* byte order,
3143 * and for DLT_ENC, the link-layer header begins
3144 * with a 32-bit work containing an AF_ value in
3147 * In addition, if we're reading a saved capture file,
3148 * the host byte order in the capture may not be the
3149 * same as the host byte order on this machine.
3151 * For DLT_LOOP, the link-layer header is a 32-bit
3152 * word containing an AF_ value in *network* byte order.
3154 * XXX - AF_ values may, unfortunately, be platform-
3155 * dependent; for example, FreeBSD's AF_INET6 is 24
3156 * whilst NetBSD's and OpenBSD's is 26.
3158 * This means that, when reading a capture file, just
3159 * checking for our AF_INET6 value won't work if the
3160 * capture file came from another OS.
3169 case ETHERTYPE_IPV6
:
3176 * Not a type on which we support filtering.
3177 * XXX - support those that have AF_ values
3178 * #defined on this platform, at least?
3183 if (linktype
== DLT_NULL
|| linktype
== DLT_ENC
) {
3185 * The AF_ value is in host byte order, but
3186 * the BPF interpreter will convert it to
3187 * network byte order.
3189 * If this is a save file, and it's from a
3190 * machine with the opposite byte order to
3191 * ours, we byte-swap the AF_ value.
3193 * Then we run it through "htonl()", and
3194 * generate code to compare against the result.
3196 if (bpf_pcap
->sf
.rfile
!= NULL
&&
3197 bpf_pcap
->sf
.swapped
)
3198 proto
= SWAPLONG(proto
);
3199 proto
= htonl(proto
);
3201 return (gen_cmp(OR_LINK
, 0, BPF_W
, (bpf_int32
)proto
));
3203 #ifdef HAVE_NET_PFVAR_H
3206 * af field is host byte order in contrast to the rest of
3209 if (proto
== ETHERTYPE_IP
)
3210 return (gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, af
),
3211 BPF_B
, (bpf_int32
)AF_INET
));
3212 else if (proto
== ETHERTYPE_IPV6
)
3213 return (gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, af
),
3214 BPF_B
, (bpf_int32
)AF_INET6
));
3219 #endif /* HAVE_NET_PFVAR_H */
3222 case DLT_ARCNET_LINUX
:
3224 * XXX should we check for first fragment if the protocol
3232 case ETHERTYPE_IPV6
:
3233 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3234 (bpf_int32
)ARCTYPE_INET6
));
3237 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3238 (bpf_int32
)ARCTYPE_IP
);
3239 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3240 (bpf_int32
)ARCTYPE_IP_OLD
);
3245 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3246 (bpf_int32
)ARCTYPE_ARP
);
3247 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3248 (bpf_int32
)ARCTYPE_ARP_OLD
);
3252 case ETHERTYPE_REVARP
:
3253 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3254 (bpf_int32
)ARCTYPE_REVARP
));
3256 case ETHERTYPE_ATALK
:
3257 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3258 (bpf_int32
)ARCTYPE_ATALK
));
3265 case ETHERTYPE_ATALK
:
3275 * XXX - assumes a 2-byte Frame Relay header with
3276 * DLCI and flags. What if the address is longer?
3282 * Check for the special NLPID for IP.
3284 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | 0xcc);
3286 case ETHERTYPE_IPV6
:
3288 * Check for the special NLPID for IPv6.
3290 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | 0x8e);
3294 * Check for several OSI protocols.
3296 * Frame Relay packets typically have an OSI
3297 * NLPID at the beginning; we check for each
3300 * What we check for is the NLPID and a frame
3301 * control field of UI, i.e. 0x03 followed
3304 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO8473_CLNP
);
3305 b1
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO9542_ESIS
);
3306 b2
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO10589_ISIS
);
3318 bpf_error("Multi-link Frame Relay link-layer type filtering not implemented");
3320 case DLT_JUNIPER_MFR
:
3321 case DLT_JUNIPER_MLFR
:
3322 case DLT_JUNIPER_MLPPP
:
3323 case DLT_JUNIPER_ATM1
:
3324 case DLT_JUNIPER_ATM2
:
3325 case DLT_JUNIPER_PPPOE
:
3326 case DLT_JUNIPER_PPPOE_ATM
:
3327 case DLT_JUNIPER_GGSN
:
3328 case DLT_JUNIPER_ES
:
3329 case DLT_JUNIPER_MONITOR
:
3330 case DLT_JUNIPER_SERVICES
:
3331 case DLT_JUNIPER_ETHER
:
3332 case DLT_JUNIPER_PPP
:
3333 case DLT_JUNIPER_FRELAY
:
3334 case DLT_JUNIPER_CHDLC
:
3335 case DLT_JUNIPER_VP
:
3336 case DLT_JUNIPER_ST
:
3337 case DLT_JUNIPER_ISM
:
3338 case DLT_JUNIPER_VS
:
3339 case DLT_JUNIPER_SRX_E2E
:
3340 case DLT_JUNIPER_FIBRECHANNEL
:
3341 case DLT_JUNIPER_ATM_CEMIC
:
3343 /* just lets verify the magic number for now -
3344 * on ATM we may have up to 6 different encapsulations on the wire
3345 * and need a lot of heuristics to figure out that the payload
3348 * FIXME encapsulation specific BPF_ filters
3350 return gen_mcmp(OR_LINK
, 0, BPF_W
, 0x4d474300, 0xffffff00); /* compare the magic number */
3353 return gen_ipnet_linktype(proto
);
3355 case DLT_LINUX_IRDA
:
3356 bpf_error("IrDA link-layer type filtering not implemented");
3359 bpf_error("DOCSIS link-layer type filtering not implemented");
3362 case DLT_MTP2_WITH_PHDR
:
3363 bpf_error("MTP2 link-layer type filtering not implemented");
3366 bpf_error("ERF link-layer type filtering not implemented");
3369 bpf_error("PFSYNC link-layer type filtering not implemented");
3371 case DLT_LINUX_LAPD
:
3372 bpf_error("LAPD link-layer type filtering not implemented");
3376 case DLT_USB_LINUX_MMAPPED
:
3377 bpf_error("USB link-layer type filtering not implemented");
3379 case DLT_BLUETOOTH_HCI_H4
:
3380 case DLT_BLUETOOTH_HCI_H4_WITH_PHDR
:
3381 bpf_error("Bluetooth link-layer type filtering not implemented");
3384 case DLT_CAN_SOCKETCAN
:
3385 bpf_error("CAN link-layer type filtering not implemented");
3387 case DLT_IEEE802_15_4
:
3388 case DLT_IEEE802_15_4_LINUX
:
3389 case DLT_IEEE802_15_4_NONASK_PHY
:
3390 case DLT_IEEE802_15_4_NOFCS
:
3391 bpf_error("IEEE 802.15.4 link-layer type filtering not implemented");
3393 case DLT_IEEE802_16_MAC_CPS_RADIO
:
3394 bpf_error("IEEE 802.16 link-layer type filtering not implemented");
3397 bpf_error("SITA link-layer type filtering not implemented");
3400 bpf_error("RAIF1 link-layer type filtering not implemented");
3403 bpf_error("IPMB link-layer type filtering not implemented");
3406 bpf_error("AX.25 link-layer type filtering not implemented");
3410 * All the types that have no encapsulation should either be
3411 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
3412 * all packets are IP packets, or should be handled in some
3413 * special case, if none of them are (if some are and some
3414 * aren't, the lack of encapsulation is a problem, as we'd
3415 * have to find some other way of determining the packet type).
3417 * Therefore, if "off_linktype" is -1, there's an error.
3419 if (off_linktype
== (u_int
)-1)
3423 * Any type not handled above should always have an Ethernet
3424 * type at an offset of "off_linktype".
3426 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
3430 * Check for an LLC SNAP packet with a given organization code and
3431 * protocol type; we check the entire contents of the 802.2 LLC and
3432 * snap headers, checking for DSAP and SSAP of SNAP and a control
3433 * field of 0x03 in the LLC header, and for the specified organization
3434 * code and protocol type in the SNAP header.
3436 static struct block
*
3437 gen_snap(orgcode
, ptype
)
3438 bpf_u_int32 orgcode
;
3441 u_char snapblock
[8];
3443 snapblock
[0] = LLCSAP_SNAP
; /* DSAP = SNAP */
3444 snapblock
[1] = LLCSAP_SNAP
; /* SSAP = SNAP */
3445 snapblock
[2] = 0x03; /* control = UI */
3446 snapblock
[3] = (orgcode
>> 16); /* upper 8 bits of organization code */
3447 snapblock
[4] = (orgcode
>> 8); /* middle 8 bits of organization code */
3448 snapblock
[5] = (orgcode
>> 0); /* lower 8 bits of organization code */
3449 snapblock
[6] = (ptype
>> 8); /* upper 8 bits of protocol type */
3450 snapblock
[7] = (ptype
>> 0); /* lower 8 bits of protocol type */
3451 return gen_bcmp(OR_MACPL
, 0, 8, snapblock
);
3455 * Generate code to match a particular packet type, for link-layer types
3456 * using 802.2 LLC headers.
3458 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used
3459 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues.
3461 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
3462 * value, if <= ETHERMTU. We use that to determine whether to
3463 * match the DSAP or both DSAP and LSAP or to check the OUI and
3464 * protocol ID in a SNAP header.
3466 static struct block
*
3467 gen_llc_linktype(proto
)
3471 * XXX - handle token-ring variable-length header.
3477 case LLCSAP_NETBEUI
:
3479 * XXX - should we check both the DSAP and the
3480 * SSAP, like this, or should we check just the
3481 * DSAP, as we do for other types <= ETHERMTU
3482 * (i.e., other SAP values)?
3484 return gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_u_int32
)
3485 ((proto
<< 8) | proto
));
3489 * XXX - are there ever SNAP frames for IPX on
3490 * non-Ethernet 802.x networks?
3492 return gen_cmp(OR_MACPL
, 0, BPF_B
,
3493 (bpf_int32
)LLCSAP_IPX
);
3495 case ETHERTYPE_ATALK
:
3497 * 802.2-encapsulated ETHERTYPE_ATALK packets are
3498 * SNAP packets with an organization code of
3499 * 0x080007 (Apple, for Appletalk) and a protocol
3500 * type of ETHERTYPE_ATALK (Appletalk).
3502 * XXX - check for an organization code of
3503 * encapsulated Ethernet as well?
3505 return gen_snap(0x080007, ETHERTYPE_ATALK
);
3509 * XXX - we don't have to check for IPX 802.3
3510 * here, but should we check for the IPX Ethertype?
3512 if (proto
<= ETHERMTU
) {
3514 * This is an LLC SAP value, so check
3517 return gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)proto
);
3520 * This is an Ethernet type; we assume that it's
3521 * unlikely that it'll appear in the right place
3522 * at random, and therefore check only the
3523 * location that would hold the Ethernet type
3524 * in a SNAP frame with an organization code of
3525 * 0x000000 (encapsulated Ethernet).
3527 * XXX - if we were to check for the SNAP DSAP and
3528 * LSAP, as per XXX, and were also to check for an
3529 * organization code of 0x000000 (encapsulated
3530 * Ethernet), we'd do
3532 * return gen_snap(0x000000, proto);
3534 * here; for now, we don't, as per the above.
3535 * I don't know whether it's worth the extra CPU
3536 * time to do the right check or not.
3538 return gen_cmp(OR_MACPL
, 6, BPF_H
, (bpf_int32
)proto
);
3543 static struct block
*
3544 gen_hostop(addr
, mask
, dir
, proto
, src_off
, dst_off
)
3548 u_int src_off
, dst_off
;
3550 struct block
*b0
, *b1
;
3564 b0
= gen_hostop(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3565 b1
= gen_hostop(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3571 b0
= gen_hostop(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3572 b1
= gen_hostop(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3579 b0
= gen_linktype(proto
);
3580 b1
= gen_mcmp(OR_NET
, offset
, BPF_W
, (bpf_int32
)addr
, mask
);
3586 static struct block
*
3587 gen_hostop6(addr
, mask
, dir
, proto
, src_off
, dst_off
)
3588 struct in6_addr
*addr
;
3589 struct in6_addr
*mask
;
3591 u_int src_off
, dst_off
;
3593 struct block
*b0
, *b1
;
3608 b0
= gen_hostop6(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3609 b1
= gen_hostop6(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3615 b0
= gen_hostop6(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3616 b1
= gen_hostop6(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3623 /* this order is important */
3624 a
= (u_int32_t
*)addr
;
3625 m
= (u_int32_t
*)mask
;
3626 b1
= gen_mcmp(OR_NET
, offset
+ 12, BPF_W
, ntohl(a
[3]), ntohl(m
[3]));
3627 b0
= gen_mcmp(OR_NET
, offset
+ 8, BPF_W
, ntohl(a
[2]), ntohl(m
[2]));
3629 b0
= gen_mcmp(OR_NET
, offset
+ 4, BPF_W
, ntohl(a
[1]), ntohl(m
[1]));
3631 b0
= gen_mcmp(OR_NET
, offset
+ 0, BPF_W
, ntohl(a
[0]), ntohl(m
[0]));
3633 b0
= gen_linktype(proto
);
3639 static struct block
*
3640 gen_ehostop(eaddr
, dir
)
3641 register const u_char
*eaddr
;
3644 register struct block
*b0
, *b1
;
3648 return gen_bcmp(OR_LINK
, off_mac
+ 6, 6, eaddr
);
3651 return gen_bcmp(OR_LINK
, off_mac
+ 0, 6, eaddr
);
3654 b0
= gen_ehostop(eaddr
, Q_SRC
);
3655 b1
= gen_ehostop(eaddr
, Q_DST
);
3661 b0
= gen_ehostop(eaddr
, Q_SRC
);
3662 b1
= gen_ehostop(eaddr
, Q_DST
);
3667 bpf_error("'addr1' is only supported on 802.11 with 802.11 headers");
3671 bpf_error("'addr2' is only supported on 802.11 with 802.11 headers");
3675 bpf_error("'addr3' is only supported on 802.11 with 802.11 headers");
3679 bpf_error("'addr4' is only supported on 802.11 with 802.11 headers");
3683 bpf_error("'ra' is only supported on 802.11 with 802.11 headers");
3687 bpf_error("'ta' is only supported on 802.11 with 802.11 headers");
3695 * Like gen_ehostop, but for DLT_FDDI
3697 static struct block
*
3698 gen_fhostop(eaddr
, dir
)
3699 register const u_char
*eaddr
;
3702 struct block
*b0
, *b1
;
3707 return gen_bcmp(OR_LINK
, 6 + 1 + pcap_fddipad
, 6, eaddr
);
3709 return gen_bcmp(OR_LINK
, 6 + 1, 6, eaddr
);
3714 return gen_bcmp(OR_LINK
, 0 + 1 + pcap_fddipad
, 6, eaddr
);
3716 return gen_bcmp(OR_LINK
, 0 + 1, 6, eaddr
);
3720 b0
= gen_fhostop(eaddr
, Q_SRC
);
3721 b1
= gen_fhostop(eaddr
, Q_DST
);
3727 b0
= gen_fhostop(eaddr
, Q_SRC
);
3728 b1
= gen_fhostop(eaddr
, Q_DST
);
3733 bpf_error("'addr1' is only supported on 802.11");
3737 bpf_error("'addr2' is only supported on 802.11");
3741 bpf_error("'addr3' is only supported on 802.11");
3745 bpf_error("'addr4' is only supported on 802.11");
3749 bpf_error("'ra' is only supported on 802.11");
3753 bpf_error("'ta' is only supported on 802.11");
3761 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
3763 static struct block
*
3764 gen_thostop(eaddr
, dir
)
3765 register const u_char
*eaddr
;
3768 register struct block
*b0
, *b1
;
3772 return gen_bcmp(OR_LINK
, 8, 6, eaddr
);
3775 return gen_bcmp(OR_LINK
, 2, 6, eaddr
);
3778 b0
= gen_thostop(eaddr
, Q_SRC
);
3779 b1
= gen_thostop(eaddr
, Q_DST
);
3785 b0
= gen_thostop(eaddr
, Q_SRC
);
3786 b1
= gen_thostop(eaddr
, Q_DST
);
3791 bpf_error("'addr1' is only supported on 802.11");
3795 bpf_error("'addr2' is only supported on 802.11");
3799 bpf_error("'addr3' is only supported on 802.11");
3803 bpf_error("'addr4' is only supported on 802.11");
3807 bpf_error("'ra' is only supported on 802.11");
3811 bpf_error("'ta' is only supported on 802.11");
3819 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and
3820 * various 802.11 + radio headers.
3822 static struct block
*
3823 gen_wlanhostop(eaddr
, dir
)
3824 register const u_char
*eaddr
;
3827 register struct block
*b0
, *b1
, *b2
;
3828 register struct slist
*s
;
3830 #ifdef ENABLE_WLAN_FILTERING_PATCH
3833 * We need to disable the optimizer because the optimizer is buggy
3834 * and wipes out some LD instructions generated by the below
3835 * code to validate the Frame Control bits
3838 #endif /* ENABLE_WLAN_FILTERING_PATCH */
3845 * For control frames, there is no SA.
3847 * For management frames, SA is at an
3848 * offset of 10 from the beginning of
3851 * For data frames, SA is at an offset
3852 * of 10 from the beginning of the packet
3853 * if From DS is clear, at an offset of
3854 * 16 from the beginning of the packet
3855 * if From DS is set and To DS is clear,
3856 * and an offset of 24 from the beginning
3857 * of the packet if From DS is set and To DS
3862 * Generate the tests to be done for data frames
3865 * First, check for To DS set, i.e. check "link[1] & 0x01".
3867 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3868 b1
= new_block(JMP(BPF_JSET
));
3869 b1
->s
.k
= 0x01; /* To DS */
3873 * If To DS is set, the SA is at 24.
3875 b0
= gen_bcmp(OR_LINK
, 24, 6, eaddr
);
3879 * Now, check for To DS not set, i.e. check
3880 * "!(link[1] & 0x01)".
3882 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3883 b2
= new_block(JMP(BPF_JSET
));
3884 b2
->s
.k
= 0x01; /* To DS */
3889 * If To DS is not set, the SA is at 16.
3891 b1
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
3895 * Now OR together the last two checks. That gives
3896 * the complete set of checks for data frames with
3902 * Now check for From DS being set, and AND that with
3903 * the ORed-together checks.
3905 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3906 b1
= new_block(JMP(BPF_JSET
));
3907 b1
->s
.k
= 0x02; /* From DS */
3912 * Now check for data frames with From DS not set.
3914 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3915 b2
= new_block(JMP(BPF_JSET
));
3916 b2
->s
.k
= 0x02; /* From DS */
3921 * If From DS isn't set, the SA is at 10.
3923 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
3927 * Now OR together the checks for data frames with
3928 * From DS not set and for data frames with From DS
3929 * set; that gives the checks done for data frames.
3934 * Now check for a data frame.
3935 * I.e, check "link[0] & 0x08".
3937 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3938 b1
= new_block(JMP(BPF_JSET
));
3943 * AND that with the checks done for data frames.
3948 * If the high-order bit of the type value is 0, this
3949 * is a management frame.
3950 * I.e, check "!(link[0] & 0x08)".
3952 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3953 b2
= new_block(JMP(BPF_JSET
));
3959 * For management frames, the SA is at 10.
3961 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
3965 * OR that with the checks done for data frames.
3966 * That gives the checks done for management and
3972 * If the low-order bit of the type value is 1,
3973 * this is either a control frame or a frame
3974 * with a reserved type, and thus not a
3977 * I.e., check "!(link[0] & 0x04)".
3979 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3980 b1
= new_block(JMP(BPF_JSET
));
3986 * AND that with the checks for data and management
3996 * For control frames, there is no DA.
3998 * For management frames, DA is at an
3999 * offset of 4 from the beginning of
4002 * For data frames, DA is at an offset
4003 * of 4 from the beginning of the packet
4004 * if To DS is clear and at an offset of
4005 * 16 from the beginning of the packet
4010 * Generate the tests to be done for data frames.
4012 * First, check for To DS set, i.e. "link[1] & 0x01".
4014 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
4015 b1
= new_block(JMP(BPF_JSET
));
4016 b1
->s
.k
= 0x01; /* To DS */
4020 * If To DS is set, the DA is at 16.
4022 b0
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
4026 * Now, check for To DS not set, i.e. check
4027 * "!(link[1] & 0x01)".
4029 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
4030 b2
= new_block(JMP(BPF_JSET
));
4031 b2
->s
.k
= 0x01; /* To DS */
4036 * If To DS is not set, the DA is at 4.
4038 b1
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
4042 * Now OR together the last two checks. That gives
4043 * the complete set of checks for data frames.
4048 * Now check for a data frame.
4049 * I.e, check "link[0] & 0x08".
4051 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4052 b1
= new_block(JMP(BPF_JSET
));
4057 * AND that with the checks done for data frames.
4062 * If the high-order bit of the type value is 0, this
4063 * is a management frame.
4064 * I.e, check "!(link[0] & 0x08)".
4066 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4067 b2
= new_block(JMP(BPF_JSET
));
4073 * For management frames, the DA is at 4.
4075 b1
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
4079 * OR that with the checks done for data frames.
4080 * That gives the checks done for management and
4086 * If the low-order bit of the type value is 1,
4087 * this is either a control frame or a frame
4088 * with a reserved type, and thus not a
4091 * I.e., check "!(link[0] & 0x04)".
4093 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4094 b1
= new_block(JMP(BPF_JSET
));
4100 * AND that with the checks for data and management
4108 * Not present in management frames; addr1 in other
4113 * If the high-order bit of the type value is 0, this
4114 * is a management frame.
4115 * I.e, check "(link[0] & 0x08)".
4117 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4118 b1
= new_block(JMP(BPF_JSET
));
4125 b0
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
4128 * AND that with the check of addr1.
4135 * Not present in management frames; addr2, if present,
4140 * Not present in CTS or ACK control frames.
4142 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4143 IEEE80211_FC0_TYPE_MASK
);
4145 b1
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_CTS
,
4146 IEEE80211_FC0_SUBTYPE_MASK
);
4148 b2
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_ACK
,
4149 IEEE80211_FC0_SUBTYPE_MASK
);
4155 * If the high-order bit of the type value is 0, this
4156 * is a management frame.
4157 * I.e, check "(link[0] & 0x08)".
4159 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4160 b1
= new_block(JMP(BPF_JSET
));
4165 * AND that with the check for frames other than
4166 * CTS and ACK frames.
4173 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4178 * XXX - add BSSID keyword?
4181 return (gen_bcmp(OR_LINK
, 4, 6, eaddr
));
4185 * Not present in CTS or ACK control frames.
4187 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4188 IEEE80211_FC0_TYPE_MASK
);
4190 b1
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_CTS
,
4191 IEEE80211_FC0_SUBTYPE_MASK
);
4193 b2
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_ACK
,
4194 IEEE80211_FC0_SUBTYPE_MASK
);
4198 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4204 * Not present in control frames.
4206 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4207 IEEE80211_FC0_TYPE_MASK
);
4209 b1
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
4215 * Present only if the direction mask has both "From DS"
4216 * and "To DS" set. Neither control frames nor management
4217 * frames should have both of those set, so we don't
4218 * check the frame type.
4220 b0
= gen_mcmp(OR_LINK
, 1, BPF_B
,
4221 IEEE80211_FC1_DIR_DSTODS
, IEEE80211_FC1_DIR_MASK
);
4222 b1
= gen_bcmp(OR_LINK
, 24, 6, eaddr
);
4227 b0
= gen_wlanhostop(eaddr
, Q_SRC
);
4228 b1
= gen_wlanhostop(eaddr
, Q_DST
);
4234 b0
= gen_wlanhostop(eaddr
, Q_SRC
);
4235 b1
= gen_wlanhostop(eaddr
, Q_DST
);
4244 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel.
4245 * (We assume that the addresses are IEEE 48-bit MAC addresses,
4246 * as the RFC states.)
4248 static struct block
*
4249 gen_ipfchostop(eaddr
, dir
)
4250 register const u_char
*eaddr
;
4253 register struct block
*b0
, *b1
;
4257 return gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4260 return gen_bcmp(OR_LINK
, 2, 6, eaddr
);
4263 b0
= gen_ipfchostop(eaddr
, Q_SRC
);
4264 b1
= gen_ipfchostop(eaddr
, Q_DST
);
4270 b0
= gen_ipfchostop(eaddr
, Q_SRC
);
4271 b1
= gen_ipfchostop(eaddr
, Q_DST
);
4276 bpf_error("'addr1' is only supported on 802.11");
4280 bpf_error("'addr2' is only supported on 802.11");
4284 bpf_error("'addr3' is only supported on 802.11");
4288 bpf_error("'addr4' is only supported on 802.11");
4292 bpf_error("'ra' is only supported on 802.11");
4296 bpf_error("'ta' is only supported on 802.11");
4304 * This is quite tricky because there may be pad bytes in front of the
4305 * DECNET header, and then there are two possible data packet formats that
4306 * carry both src and dst addresses, plus 5 packet types in a format that
4307 * carries only the src node, plus 2 types that use a different format and
4308 * also carry just the src node.
4312 * Instead of doing those all right, we just look for data packets with
4313 * 0 or 1 bytes of padding. If you want to look at other packets, that
4314 * will require a lot more hacking.
4316 * To add support for filtering on DECNET "areas" (network numbers)
4317 * one would want to add a "mask" argument to this routine. That would
4318 * make the filter even more inefficient, although one could be clever
4319 * and not generate masking instructions if the mask is 0xFFFF.
4321 static struct block
*
4322 gen_dnhostop(addr
, dir
)
4326 struct block
*b0
, *b1
, *b2
, *tmp
;
4327 u_int offset_lh
; /* offset if long header is received */
4328 u_int offset_sh
; /* offset if short header is received */
4333 offset_sh
= 1; /* follows flags */
4334 offset_lh
= 7; /* flgs,darea,dsubarea,HIORD */
4338 offset_sh
= 3; /* follows flags, dstnode */
4339 offset_lh
= 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
4343 /* Inefficient because we do our Calvinball dance twice */
4344 b0
= gen_dnhostop(addr
, Q_SRC
);
4345 b1
= gen_dnhostop(addr
, Q_DST
);
4351 /* Inefficient because we do our Calvinball dance twice */
4352 b0
= gen_dnhostop(addr
, Q_SRC
);
4353 b1
= gen_dnhostop(addr
, Q_DST
);
4358 bpf_error("ISO host filtering not implemented");
4363 b0
= gen_linktype(ETHERTYPE_DN
);
4364 /* Check for pad = 1, long header case */
4365 tmp
= gen_mcmp(OR_NET
, 2, BPF_H
,
4366 (bpf_int32
)ntohs(0x0681), (bpf_int32
)ntohs(0x07FF));
4367 b1
= gen_cmp(OR_NET
, 2 + 1 + offset_lh
,
4368 BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4370 /* Check for pad = 0, long header case */
4371 tmp
= gen_mcmp(OR_NET
, 2, BPF_B
, (bpf_int32
)0x06, (bpf_int32
)0x7);
4372 b2
= gen_cmp(OR_NET
, 2 + offset_lh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4375 /* Check for pad = 1, short header case */
4376 tmp
= gen_mcmp(OR_NET
, 2, BPF_H
,
4377 (bpf_int32
)ntohs(0x0281), (bpf_int32
)ntohs(0x07FF));
4378 b2
= gen_cmp(OR_NET
, 2 + 1 + offset_sh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4381 /* Check for pad = 0, short header case */
4382 tmp
= gen_mcmp(OR_NET
, 2, BPF_B
, (bpf_int32
)0x02, (bpf_int32
)0x7);
4383 b2
= gen_cmp(OR_NET
, 2 + offset_sh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4387 /* Combine with test for linktype */
4393 * Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets;
4394 * test the bottom-of-stack bit, and then check the version number
4395 * field in the IP header.
4397 static struct block
*
4398 gen_mpls_linktype(proto
)
4401 struct block
*b0
, *b1
;
4406 /* match the bottom-of-stack bit */
4407 b0
= gen_mcmp(OR_NET
, -2, BPF_B
, 0x01, 0x01);
4408 /* match the IPv4 version number */
4409 b1
= gen_mcmp(OR_NET
, 0, BPF_B
, 0x40, 0xf0);
4414 /* match the bottom-of-stack bit */
4415 b0
= gen_mcmp(OR_NET
, -2, BPF_B
, 0x01, 0x01);
4416 /* match the IPv4 version number */
4417 b1
= gen_mcmp(OR_NET
, 0, BPF_B
, 0x60, 0xf0);
4426 static struct block
*
4427 gen_host(addr
, mask
, proto
, dir
, type
)
4434 struct block
*b0
, *b1
;
4435 const char *typestr
;
4445 b0
= gen_host(addr
, mask
, Q_IP
, dir
, type
);
4447 * Only check for non-IPv4 addresses if we're not
4448 * checking MPLS-encapsulated packets.
4450 if (label_stack_depth
== 0) {
4451 b1
= gen_host(addr
, mask
, Q_ARP
, dir
, type
);
4453 b0
= gen_host(addr
, mask
, Q_RARP
, dir
, type
);
4459 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_IP
, 12, 16);
4462 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_REVARP
, 14, 24);
4465 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_ARP
, 14, 24);
4468 bpf_error("'tcp' modifier applied to %s", typestr
);
4471 bpf_error("'sctp' modifier applied to %s", typestr
);
4474 bpf_error("'udp' modifier applied to %s", typestr
);
4477 bpf_error("'icmp' modifier applied to %s", typestr
);
4480 bpf_error("'igmp' modifier applied to %s", typestr
);
4483 bpf_error("'igrp' modifier applied to %s", typestr
);
4486 bpf_error("'pim' modifier applied to %s", typestr
);
4489 bpf_error("'vrrp' modifier applied to %s", typestr
);
4492 bpf_error("'carp' modifier applied to %s", typestr
);
4495 bpf_error("ATALK host filtering not implemented");
4498 bpf_error("AARP host filtering not implemented");
4501 return gen_dnhostop(addr
, dir
);
4504 bpf_error("SCA host filtering not implemented");
4507 bpf_error("LAT host filtering not implemented");
4510 bpf_error("MOPDL host filtering not implemented");
4513 bpf_error("MOPRC host filtering not implemented");
4516 bpf_error("'ip6' modifier applied to ip host");
4519 bpf_error("'icmp6' modifier applied to %s", typestr
);
4522 bpf_error("'ah' modifier applied to %s", typestr
);
4525 bpf_error("'esp' modifier applied to %s", typestr
);
4528 bpf_error("ISO host filtering not implemented");
4531 bpf_error("'esis' modifier applied to %s", typestr
);
4534 bpf_error("'isis' modifier applied to %s", typestr
);
4537 bpf_error("'clnp' modifier applied to %s", typestr
);
4540 bpf_error("'stp' modifier applied to %s", typestr
);
4543 bpf_error("IPX host filtering not implemented");
4546 bpf_error("'netbeui' modifier applied to %s", typestr
);
4549 bpf_error("'radio' modifier applied to %s", typestr
);
4558 static struct block
*
4559 gen_host6(addr
, mask
, proto
, dir
, type
)
4560 struct in6_addr
*addr
;
4561 struct in6_addr
*mask
;
4566 const char *typestr
;
4576 return gen_host6(addr
, mask
, Q_IPV6
, dir
, type
);
4579 bpf_error("'ip' modifier applied to ip6 %s", typestr
);
4582 bpf_error("'rarp' modifier applied to ip6 %s", typestr
);
4585 bpf_error("'arp' modifier applied to ip6 %s", typestr
);
4588 bpf_error("'sctp' modifier applied to %s", typestr
);
4591 bpf_error("'tcp' modifier applied to %s", typestr
);
4594 bpf_error("'udp' modifier applied to %s", typestr
);
4597 bpf_error("'icmp' modifier applied to %s", typestr
);
4600 bpf_error("'igmp' modifier applied to %s", typestr
);
4603 bpf_error("'igrp' modifier applied to %s", typestr
);
4606 bpf_error("'pim' modifier applied to %s", typestr
);
4609 bpf_error("'vrrp' modifier applied to %s", typestr
);
4612 bpf_error("'carp' modifier applied to %s", typestr
);
4615 bpf_error("ATALK host filtering not implemented");
4618 bpf_error("AARP host filtering not implemented");
4621 bpf_error("'decnet' modifier applied to ip6 %s", typestr
);
4624 bpf_error("SCA host filtering not implemented");
4627 bpf_error("LAT host filtering not implemented");
4630 bpf_error("MOPDL host filtering not implemented");
4633 bpf_error("MOPRC host filtering not implemented");
4636 return gen_hostop6(addr
, mask
, dir
, ETHERTYPE_IPV6
, 8, 24);
4639 bpf_error("'icmp6' modifier applied to %s", typestr
);
4642 bpf_error("'ah' modifier applied to %s", typestr
);
4645 bpf_error("'esp' modifier applied to %s", typestr
);
4648 bpf_error("ISO host filtering not implemented");
4651 bpf_error("'esis' modifier applied to %s", typestr
);
4654 bpf_error("'isis' modifier applied to %s", typestr
);
4657 bpf_error("'clnp' modifier applied to %s", typestr
);
4660 bpf_error("'stp' modifier applied to %s", typestr
);
4663 bpf_error("IPX host filtering not implemented");
4666 bpf_error("'netbeui' modifier applied to %s", typestr
);
4669 bpf_error("'radio' modifier applied to %s", typestr
);
4679 static struct block
*
4680 gen_gateway(eaddr
, alist
, proto
, dir
)
4681 const u_char
*eaddr
;
4682 bpf_u_int32
**alist
;
4686 struct block
*b0
, *b1
, *tmp
;
4689 bpf_error("direction applied to 'gateway'");
4698 case DLT_NETANALYZER
:
4699 case DLT_NETANALYZER_TRANSPARENT
:
4700 b0
= gen_ehostop(eaddr
, Q_OR
);
4703 b0
= gen_fhostop(eaddr
, Q_OR
);
4706 b0
= gen_thostop(eaddr
, Q_OR
);
4708 case DLT_IEEE802_11
:
4709 case DLT_PRISM_HEADER
:
4710 case DLT_IEEE802_11_RADIO_AVS
:
4711 case DLT_IEEE802_11_RADIO
:
4713 b0
= gen_wlanhostop(eaddr
, Q_OR
);
4718 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4720 * Check that the packet doesn't begin with an
4721 * LE Control marker. (We've already generated
4724 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
4729 * Now check the MAC address.
4731 b0
= gen_ehostop(eaddr
, Q_OR
);
4734 case DLT_IP_OVER_FC
:
4735 b0
= gen_ipfchostop(eaddr
, Q_OR
);
4739 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4741 b1
= gen_host(**alist
++, 0xffffffff, proto
, Q_OR
, Q_HOST
);
4743 tmp
= gen_host(**alist
++, 0xffffffff, proto
, Q_OR
,
4752 bpf_error("illegal modifier of 'gateway'");
4758 gen_proto_abbrev(proto
)
4767 b1
= gen_proto(IPPROTO_SCTP
, Q_IP
, Q_DEFAULT
);
4768 b0
= gen_proto(IPPROTO_SCTP
, Q_IPV6
, Q_DEFAULT
);
4773 b1
= gen_proto(IPPROTO_TCP
, Q_IP
, Q_DEFAULT
);
4774 b0
= gen_proto(IPPROTO_TCP
, Q_IPV6
, Q_DEFAULT
);
4779 b1
= gen_proto(IPPROTO_UDP
, Q_IP
, Q_DEFAULT
);
4780 b0
= gen_proto(IPPROTO_UDP
, Q_IPV6
, Q_DEFAULT
);
4785 b1
= gen_proto(IPPROTO_ICMP
, Q_IP
, Q_DEFAULT
);
4788 #ifndef IPPROTO_IGMP
4789 #define IPPROTO_IGMP 2
4793 b1
= gen_proto(IPPROTO_IGMP
, Q_IP
, Q_DEFAULT
);
4796 #ifndef IPPROTO_IGRP
4797 #define IPPROTO_IGRP 9
4800 b1
= gen_proto(IPPROTO_IGRP
, Q_IP
, Q_DEFAULT
);
4804 #define IPPROTO_PIM 103
4808 b1
= gen_proto(IPPROTO_PIM
, Q_IP
, Q_DEFAULT
);
4809 b0
= gen_proto(IPPROTO_PIM
, Q_IPV6
, Q_DEFAULT
);
4813 #ifndef IPPROTO_VRRP
4814 #define IPPROTO_VRRP 112
4818 b1
= gen_proto(IPPROTO_VRRP
, Q_IP
, Q_DEFAULT
);
4821 #ifndef IPPROTO_CARP
4822 #define IPPROTO_CARP 112
4826 b1
= gen_proto(IPPROTO_CARP
, Q_IP
, Q_DEFAULT
);
4830 b1
= gen_linktype(ETHERTYPE_IP
);
4834 b1
= gen_linktype(ETHERTYPE_ARP
);
4838 b1
= gen_linktype(ETHERTYPE_REVARP
);
4842 bpf_error("link layer applied in wrong context");
4845 b1
= gen_linktype(ETHERTYPE_ATALK
);
4849 b1
= gen_linktype(ETHERTYPE_AARP
);
4853 b1
= gen_linktype(ETHERTYPE_DN
);
4857 b1
= gen_linktype(ETHERTYPE_SCA
);
4861 b1
= gen_linktype(ETHERTYPE_LAT
);
4865 b1
= gen_linktype(ETHERTYPE_MOPDL
);
4869 b1
= gen_linktype(ETHERTYPE_MOPRC
);
4873 b1
= gen_linktype(ETHERTYPE_IPV6
);
4876 #ifndef IPPROTO_ICMPV6
4877 #define IPPROTO_ICMPV6 58
4880 b1
= gen_proto(IPPROTO_ICMPV6
, Q_IPV6
, Q_DEFAULT
);
4884 #define IPPROTO_AH 51
4887 b1
= gen_proto(IPPROTO_AH
, Q_IP
, Q_DEFAULT
);
4888 b0
= gen_proto(IPPROTO_AH
, Q_IPV6
, Q_DEFAULT
);
4893 #define IPPROTO_ESP 50
4896 b1
= gen_proto(IPPROTO_ESP
, Q_IP
, Q_DEFAULT
);
4897 b0
= gen_proto(IPPROTO_ESP
, Q_IPV6
, Q_DEFAULT
);
4902 b1
= gen_linktype(LLCSAP_ISONS
);
4906 b1
= gen_proto(ISO9542_ESIS
, Q_ISO
, Q_DEFAULT
);
4910 b1
= gen_proto(ISO10589_ISIS
, Q_ISO
, Q_DEFAULT
);
4913 case Q_ISIS_L1
: /* all IS-IS Level1 PDU-Types */
4914 b0
= gen_proto(ISIS_L1_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4915 b1
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
); /* FIXME extract the circuit-type bits */
4917 b0
= gen_proto(ISIS_L1_LSP
, Q_ISIS
, Q_DEFAULT
);
4919 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4921 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4925 case Q_ISIS_L2
: /* all IS-IS Level2 PDU-Types */
4926 b0
= gen_proto(ISIS_L2_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4927 b1
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
); /* FIXME extract the circuit-type bits */
4929 b0
= gen_proto(ISIS_L2_LSP
, Q_ISIS
, Q_DEFAULT
);
4931 b0
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4933 b0
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4937 case Q_ISIS_IIH
: /* all IS-IS Hello PDU-Types */
4938 b0
= gen_proto(ISIS_L1_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4939 b1
= gen_proto(ISIS_L2_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4941 b0
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
);
4946 b0
= gen_proto(ISIS_L1_LSP
, Q_ISIS
, Q_DEFAULT
);
4947 b1
= gen_proto(ISIS_L2_LSP
, Q_ISIS
, Q_DEFAULT
);
4952 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4953 b1
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4955 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4957 b0
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4962 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4963 b1
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4968 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4969 b1
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4974 b1
= gen_proto(ISO8473_CLNP
, Q_ISO
, Q_DEFAULT
);
4978 b1
= gen_linktype(LLCSAP_8021D
);
4982 b1
= gen_linktype(LLCSAP_IPX
);
4986 b1
= gen_linktype(LLCSAP_NETBEUI
);
4990 bpf_error("'radio' is not a valid protocol type");
4998 static struct block
*
5004 /* not IPv4 frag other than the first frag */
5005 s
= gen_load_a(OR_NET
, 6, BPF_H
);
5006 b
= new_block(JMP(BPF_JSET
));
5015 * Generate a comparison to a port value in the transport-layer header
5016 * at the specified offset from the beginning of that header.
5018 * XXX - this handles a variable-length prefix preceding the link-layer
5019 * header, such as the radiotap or AVS radio prefix, but doesn't handle
5020 * variable-length link-layer headers (such as Token Ring or 802.11
5023 static struct block
*
5024 gen_portatom(off
, v
)
5028 return gen_cmp(OR_TRAN_IPV4
, off
, BPF_H
, v
);
5031 static struct block
*
5032 gen_portatom6(off
, v
)
5036 return gen_cmp(OR_TRAN_IPV6
, off
, BPF_H
, v
);
5040 gen_portop(port
, proto
, dir
)
5041 int port
, proto
, dir
;
5043 struct block
*b0
, *b1
, *tmp
;
5045 /* ip proto 'proto' and not a fragment other than the first fragment */
5046 tmp
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)proto
);
5052 b1
= gen_portatom(0, (bpf_int32
)port
);
5056 b1
= gen_portatom(2, (bpf_int32
)port
);
5061 tmp
= gen_portatom(0, (bpf_int32
)port
);
5062 b1
= gen_portatom(2, (bpf_int32
)port
);
5067 tmp
= gen_portatom(0, (bpf_int32
)port
);
5068 b1
= gen_portatom(2, (bpf_int32
)port
);
5080 static struct block
*
5081 gen_port(port
, ip_proto
, dir
)
5086 struct block
*b0
, *b1
, *tmp
;
5091 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
5092 * not LLC encapsulation with LLCSAP_IP.
5094 * For IEEE 802 networks - which includes 802.5 token ring
5095 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
5096 * says that SNAP encapsulation is used, not LLC encapsulation
5099 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
5100 * RFC 2225 say that SNAP encapsulation is used, not LLC
5101 * encapsulation with LLCSAP_IP.
5103 * So we always check for ETHERTYPE_IP.
5105 b0
= gen_linktype(ETHERTYPE_IP
);
5111 b1
= gen_portop(port
, ip_proto
, dir
);
5115 tmp
= gen_portop(port
, IPPROTO_TCP
, dir
);
5116 b1
= gen_portop(port
, IPPROTO_UDP
, dir
);
5118 tmp
= gen_portop(port
, IPPROTO_SCTP
, dir
);
5130 gen_portop6(port
, proto
, dir
)
5131 int port
, proto
, dir
;
5133 struct block
*b0
, *b1
, *tmp
;
5135 /* ip6 proto 'proto' */
5136 /* XXX - catch the first fragment of a fragmented packet? */
5137 b0
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)proto
);
5141 b1
= gen_portatom6(0, (bpf_int32
)port
);
5145 b1
= gen_portatom6(2, (bpf_int32
)port
);
5150 tmp
= gen_portatom6(0, (bpf_int32
)port
);
5151 b1
= gen_portatom6(2, (bpf_int32
)port
);
5156 tmp
= gen_portatom6(0, (bpf_int32
)port
);
5157 b1
= gen_portatom6(2, (bpf_int32
)port
);
5169 static struct block
*
5170 gen_port6(port
, ip_proto
, dir
)
5175 struct block
*b0
, *b1
, *tmp
;
5177 /* link proto ip6 */
5178 b0
= gen_linktype(ETHERTYPE_IPV6
);
5184 b1
= gen_portop6(port
, ip_proto
, dir
);
5188 tmp
= gen_portop6(port
, IPPROTO_TCP
, dir
);
5189 b1
= gen_portop6(port
, IPPROTO_UDP
, dir
);
5191 tmp
= gen_portop6(port
, IPPROTO_SCTP
, dir
);
5202 /* gen_portrange code */
5203 static struct block
*
5204 gen_portrangeatom(off
, v1
, v2
)
5208 struct block
*b1
, *b2
;
5212 * Reverse the order of the ports, so v1 is the lower one.
5221 b1
= gen_cmp_ge(OR_TRAN_IPV4
, off
, BPF_H
, v1
);
5222 b2
= gen_cmp_le(OR_TRAN_IPV4
, off
, BPF_H
, v2
);
5230 gen_portrangeop(port1
, port2
, proto
, dir
)
5235 struct block
*b0
, *b1
, *tmp
;
5237 /* ip proto 'proto' and not a fragment other than the first fragment */
5238 tmp
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)proto
);
5244 b1
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5248 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5253 tmp
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5254 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5259 tmp
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5260 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5272 static struct block
*
5273 gen_portrange(port1
, port2
, ip_proto
, dir
)
5278 struct block
*b0
, *b1
, *tmp
;
5281 b0
= gen_linktype(ETHERTYPE_IP
);
5287 b1
= gen_portrangeop(port1
, port2
, ip_proto
, dir
);
5291 tmp
= gen_portrangeop(port1
, port2
, IPPROTO_TCP
, dir
);
5292 b1
= gen_portrangeop(port1
, port2
, IPPROTO_UDP
, dir
);
5294 tmp
= gen_portrangeop(port1
, port2
, IPPROTO_SCTP
, dir
);
5305 static struct block
*
5306 gen_portrangeatom6(off
, v1
, v2
)
5310 struct block
*b1
, *b2
;
5314 * Reverse the order of the ports, so v1 is the lower one.
5323 b1
= gen_cmp_ge(OR_TRAN_IPV6
, off
, BPF_H
, v1
);
5324 b2
= gen_cmp_le(OR_TRAN_IPV6
, off
, BPF_H
, v2
);
5332 gen_portrangeop6(port1
, port2
, proto
, dir
)
5337 struct block
*b0
, *b1
, *tmp
;
5339 /* ip6 proto 'proto' */
5340 /* XXX - catch the first fragment of a fragmented packet? */
5341 b0
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)proto
);
5345 b1
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5349 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5354 tmp
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5355 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5360 tmp
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5361 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5373 static struct block
*
5374 gen_portrange6(port1
, port2
, ip_proto
, dir
)
5379 struct block
*b0
, *b1
, *tmp
;
5381 /* link proto ip6 */
5382 b0
= gen_linktype(ETHERTYPE_IPV6
);
5388 b1
= gen_portrangeop6(port1
, port2
, ip_proto
, dir
);
5392 tmp
= gen_portrangeop6(port1
, port2
, IPPROTO_TCP
, dir
);
5393 b1
= gen_portrangeop6(port1
, port2
, IPPROTO_UDP
, dir
);
5395 tmp
= gen_portrangeop6(port1
, port2
, IPPROTO_SCTP
, dir
);
5407 lookup_proto(name
, proto
)
5408 register const char *name
;
5418 v
= pcap_nametoproto(name
);
5419 if (v
== PROTO_UNDEF
)
5420 bpf_error("unknown ip proto '%s'", name
);
5424 /* XXX should look up h/w protocol type based on linktype */
5425 v
= pcap_nametoeproto(name
);
5426 if (v
== PROTO_UNDEF
) {
5427 v
= pcap_nametollc(name
);
5428 if (v
== PROTO_UNDEF
)
5429 bpf_error("unknown ether proto '%s'", name
);
5434 if (strcmp(name
, "esis") == 0)
5436 else if (strcmp(name
, "isis") == 0)
5438 else if (strcmp(name
, "clnp") == 0)
5441 bpf_error("unknown osi proto '%s'", name
);
5461 static struct block
*
5462 gen_protochain(v
, proto
, dir
)
5467 #ifdef NO_PROTOCHAIN
5468 return gen_proto(v
, proto
, dir
);
5470 struct block
*b0
, *b
;
5471 struct slist
*s
[100];
5472 int fix2
, fix3
, fix4
, fix5
;
5473 int ahcheck
, again
, end
;
5475 int reg2
= alloc_reg();
5477 memset(s
, 0, sizeof(s
));
5478 fix2
= fix3
= fix4
= fix5
= 0;
5485 b0
= gen_protochain(v
, Q_IP
, dir
);
5486 b
= gen_protochain(v
, Q_IPV6
, dir
);
5490 bpf_error("bad protocol applied for 'protochain'");
5495 * We don't handle variable-length prefixes before the link-layer
5496 * header, or variable-length link-layer headers, here yet.
5497 * We might want to add BPF instructions to do the protochain
5498 * work, to simplify that and, on platforms that have a BPF
5499 * interpreter with the new instructions, let the filtering
5500 * be done in the kernel. (We already require a modified BPF
5501 * engine to do the protochain stuff, to support backward
5502 * branches, and backward branch support is unlikely to appear
5503 * in kernel BPF engines.)
5507 case DLT_IEEE802_11
:
5508 case DLT_PRISM_HEADER
:
5509 case DLT_IEEE802_11_RADIO_AVS
:
5510 case DLT_IEEE802_11_RADIO
:
5512 bpf_error("'protochain' not supported with 802.11");
5515 no_optimize
= 1; /*this code is not compatible with optimzer yet */
5518 * s[0] is a dummy entry to protect other BPF insn from damage
5519 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
5520 * hard to find interdependency made by jump table fixup.
5523 s
[i
] = new_stmt(0); /*dummy*/
5528 b0
= gen_linktype(ETHERTYPE_IP
);
5531 s
[i
] = new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
5532 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 9;
5534 /* X = ip->ip_hl << 2 */
5535 s
[i
] = new_stmt(BPF_LDX
|BPF_MSH
|BPF_B
);
5536 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5541 b0
= gen_linktype(ETHERTYPE_IPV6
);
5543 /* A = ip6->ip_nxt */
5544 s
[i
] = new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
5545 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 6;
5547 /* X = sizeof(struct ip6_hdr) */
5548 s
[i
] = new_stmt(BPF_LDX
|BPF_IMM
);
5554 bpf_error("unsupported proto to gen_protochain");
5558 /* again: if (A == v) goto end; else fall through; */
5560 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5562 s
[i
]->s
.jt
= NULL
; /*later*/
5563 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5567 #ifndef IPPROTO_NONE
5568 #define IPPROTO_NONE 59
5570 /* if (A == IPPROTO_NONE) goto end */
5571 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5572 s
[i
]->s
.jt
= NULL
; /*later*/
5573 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5574 s
[i
]->s
.k
= IPPROTO_NONE
;
5575 s
[fix5
]->s
.jf
= s
[i
];
5579 if (proto
== Q_IPV6
) {
5580 int v6start
, v6end
, v6advance
, j
;
5583 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
5584 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5585 s
[i
]->s
.jt
= NULL
; /*later*/
5586 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5587 s
[i
]->s
.k
= IPPROTO_HOPOPTS
;
5588 s
[fix2
]->s
.jf
= s
[i
];
5590 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
5591 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5592 s
[i
]->s
.jt
= NULL
; /*later*/
5593 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5594 s
[i
]->s
.k
= IPPROTO_DSTOPTS
;
5596 /* if (A == IPPROTO_ROUTING) goto v6advance */
5597 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5598 s
[i
]->s
.jt
= NULL
; /*later*/
5599 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5600 s
[i
]->s
.k
= IPPROTO_ROUTING
;
5602 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
5603 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5604 s
[i
]->s
.jt
= NULL
; /*later*/
5605 s
[i
]->s
.jf
= NULL
; /*later*/
5606 s
[i
]->s
.k
= IPPROTO_FRAGMENT
;
5616 * A = P[X + packet head];
5617 * X = X + (P[X + packet head + 1] + 1) * 8;
5619 /* A = P[X + packet head] */
5620 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5621 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5624 s
[i
] = new_stmt(BPF_ST
);
5627 /* A = P[X + packet head + 1]; */
5628 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5629 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 1;
5632 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5636 s
[i
] = new_stmt(BPF_ALU
|BPF_MUL
|BPF_K
);
5640 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
);
5644 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5647 s
[i
] = new_stmt(BPF_LD
|BPF_MEM
);
5651 /* goto again; (must use BPF_JA for backward jump) */
5652 s
[i
] = new_stmt(BPF_JMP
|BPF_JA
);
5653 s
[i
]->s
.k
= again
- i
- 1;
5654 s
[i
- 1]->s
.jf
= s
[i
];
5658 for (j
= v6start
; j
<= v6end
; j
++)
5659 s
[j
]->s
.jt
= s
[v6advance
];
5662 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5664 s
[fix2
]->s
.jf
= s
[i
];
5670 /* if (A == IPPROTO_AH) then fall through; else goto end; */
5671 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5672 s
[i
]->s
.jt
= NULL
; /*later*/
5673 s
[i
]->s
.jf
= NULL
; /*later*/
5674 s
[i
]->s
.k
= IPPROTO_AH
;
5676 s
[fix3
]->s
.jf
= s
[ahcheck
];
5683 * X = X + (P[X + 1] + 2) * 4;
5686 s
[i
- 1]->s
.jt
= s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5688 /* A = P[X + packet head]; */
5689 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5690 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5693 s
[i
] = new_stmt(BPF_ST
);
5697 s
[i
- 1]->s
.jt
= s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5700 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5704 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5706 /* A = P[X + packet head] */
5707 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5708 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5711 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5715 s
[i
] = new_stmt(BPF_ALU
|BPF_MUL
|BPF_K
);
5719 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5722 s
[i
] = new_stmt(BPF_LD
|BPF_MEM
);
5726 /* goto again; (must use BPF_JA for backward jump) */
5727 s
[i
] = new_stmt(BPF_JMP
|BPF_JA
);
5728 s
[i
]->s
.k
= again
- i
- 1;
5733 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5735 s
[fix2
]->s
.jt
= s
[end
];
5736 s
[fix4
]->s
.jf
= s
[end
];
5737 s
[fix5
]->s
.jt
= s
[end
];
5744 for (i
= 0; i
< max
- 1; i
++)
5745 s
[i
]->next
= s
[i
+ 1];
5746 s
[max
- 1]->next
= NULL
;
5751 b
= new_block(JMP(BPF_JEQ
));
5752 b
->stmts
= s
[1]; /*remember, s[0] is dummy*/
5762 static struct block
*
5763 gen_check_802_11_data_frame()
5766 struct block
*b0
, *b1
;
5769 * A data frame has the 0x08 bit (b3) in the frame control field set
5770 * and the 0x04 bit (b2) clear.
5772 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
5773 b0
= new_block(JMP(BPF_JSET
));
5777 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
5778 b1
= new_block(JMP(BPF_JSET
));
5789 * Generate code that checks whether the packet is a packet for protocol
5790 * <proto> and whether the type field in that protocol's header has
5791 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an
5792 * IP packet and checks the protocol number in the IP header against <v>.
5794 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks
5795 * against Q_IP and Q_IPV6.
5797 static struct block
*
5798 gen_proto(v
, proto
, dir
)
5803 struct block
*b0
, *b1
;
5808 if (dir
!= Q_DEFAULT
)
5809 bpf_error("direction applied to 'proto'");
5813 b0
= gen_proto(v
, Q_IP
, dir
);
5814 b1
= gen_proto(v
, Q_IPV6
, dir
);
5820 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
5821 * not LLC encapsulation with LLCSAP_IP.
5823 * For IEEE 802 networks - which includes 802.5 token ring
5824 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
5825 * says that SNAP encapsulation is used, not LLC encapsulation
5828 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
5829 * RFC 2225 say that SNAP encapsulation is used, not LLC
5830 * encapsulation with LLCSAP_IP.
5832 * So we always check for ETHERTYPE_IP.
5834 b0
= gen_linktype(ETHERTYPE_IP
);
5836 b1
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)v
);
5838 b1
= gen_protochain(v
, Q_IP
);
5848 * Frame Relay packets typically have an OSI
5849 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)"
5850 * generates code to check for all the OSI
5851 * NLPIDs, so calling it and then adding a check
5852 * for the particular NLPID for which we're
5853 * looking is bogus, as we can just check for
5856 * What we check for is the NLPID and a frame
5857 * control field value of UI, i.e. 0x03 followed
5860 * XXX - assumes a 2-byte Frame Relay header with
5861 * DLCI and flags. What if the address is longer?
5863 * XXX - what about SNAP-encapsulated frames?
5865 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | v
);
5871 * Cisco uses an Ethertype lookalike - for OSI,
5874 b0
= gen_linktype(LLCSAP_ISONS
<<8 | LLCSAP_ISONS
);
5875 /* OSI in C-HDLC is stuffed with a fudge byte */
5876 b1
= gen_cmp(OR_NET_NOSNAP
, 1, BPF_B
, (long)v
);
5881 b0
= gen_linktype(LLCSAP_ISONS
);
5882 b1
= gen_cmp(OR_NET_NOSNAP
, 0, BPF_B
, (long)v
);
5888 b0
= gen_proto(ISO10589_ISIS
, Q_ISO
, Q_DEFAULT
);
5890 * 4 is the offset of the PDU type relative to the IS-IS
5893 b1
= gen_cmp(OR_NET_NOSNAP
, 4, BPF_B
, (long)v
);
5898 bpf_error("arp does not encapsulate another protocol");
5902 bpf_error("rarp does not encapsulate another protocol");
5906 bpf_error("atalk encapsulation is not specifiable");
5910 bpf_error("decnet encapsulation is not specifiable");
5914 bpf_error("sca does not encapsulate another protocol");
5918 bpf_error("lat does not encapsulate another protocol");
5922 bpf_error("moprc does not encapsulate another protocol");
5926 bpf_error("mopdl does not encapsulate another protocol");
5930 return gen_linktype(v
);
5933 bpf_error("'udp proto' is bogus");
5937 bpf_error("'tcp proto' is bogus");
5941 bpf_error("'sctp proto' is bogus");
5945 bpf_error("'icmp proto' is bogus");
5949 bpf_error("'igmp proto' is bogus");
5953 bpf_error("'igrp proto' is bogus");
5957 bpf_error("'pim proto' is bogus");
5961 bpf_error("'vrrp proto' is bogus");
5965 bpf_error("'carp proto' is bogus");
5969 b0
= gen_linktype(ETHERTYPE_IPV6
);
5972 * Also check for a fragment header before the final
5975 b2
= gen_cmp(OR_NET
, 6, BPF_B
, IPPROTO_FRAGMENT
);
5976 b1
= gen_cmp(OR_NET
, 40, BPF_B
, (bpf_int32
)v
);
5978 b2
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)v
);
5981 b1
= gen_protochain(v
, Q_IPV6
);
5987 bpf_error("'icmp6 proto' is bogus");
5990 bpf_error("'ah proto' is bogus");
5993 bpf_error("'ah proto' is bogus");
5996 bpf_error("'stp proto' is bogus");
5999 bpf_error("'ipx proto' is bogus");
6002 bpf_error("'netbeui proto' is bogus");
6005 bpf_error("'radio proto' is bogus");
6016 register const char *name
;
6019 int proto
= q
.proto
;
6023 bpf_u_int32 mask
, addr
;
6025 bpf_u_int32
**alist
;
6028 struct sockaddr_in
*sin4
;
6029 struct sockaddr_in6
*sin6
;
6030 struct addrinfo
*res
, *res0
;
6031 struct in6_addr mask128
;
6033 struct block
*b
, *tmp
;
6034 int port
, real_proto
;
6040 addr
= pcap_nametonetaddr(name
);
6042 bpf_error("unknown network '%s'", name
);
6043 /* Left justify network addr and calculate its network mask */
6045 while (addr
&& (addr
& 0xff000000) == 0) {
6049 return gen_host(addr
, mask
, proto
, dir
, q
.addr
);
6053 if (proto
== Q_LINK
) {
6057 case DLT_NETANALYZER
:
6058 case DLT_NETANALYZER_TRANSPARENT
:
6059 eaddr
= pcap_ether_hostton(name
);
6062 "unknown ether host '%s'", name
);
6063 b
= gen_ehostop(eaddr
, dir
);
6068 eaddr
= pcap_ether_hostton(name
);
6071 "unknown FDDI host '%s'", name
);
6072 b
= gen_fhostop(eaddr
, dir
);
6077 eaddr
= pcap_ether_hostton(name
);
6080 "unknown token ring host '%s'", name
);
6081 b
= gen_thostop(eaddr
, dir
);
6085 case DLT_IEEE802_11
:
6086 case DLT_PRISM_HEADER
:
6087 case DLT_IEEE802_11_RADIO_AVS
:
6088 case DLT_IEEE802_11_RADIO
:
6090 eaddr
= pcap_ether_hostton(name
);
6093 "unknown 802.11 host '%s'", name
);
6094 b
= gen_wlanhostop(eaddr
, dir
);
6098 case DLT_IP_OVER_FC
:
6099 eaddr
= pcap_ether_hostton(name
);
6102 "unknown Fibre Channel host '%s'", name
);
6103 b
= gen_ipfchostop(eaddr
, dir
);
6112 * Check that the packet doesn't begin
6113 * with an LE Control marker. (We've
6114 * already generated a test for LANE.)
6116 tmp
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
6120 eaddr
= pcap_ether_hostton(name
);
6123 "unknown ether host '%s'", name
);
6124 b
= gen_ehostop(eaddr
, dir
);
6130 bpf_error("only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name");
6131 } else if (proto
== Q_DECNET
) {
6132 unsigned short dn_addr
= __pcap_nametodnaddr(name
);
6134 * I don't think DECNET hosts can be multihomed, so
6135 * there is no need to build up a list of addresses
6137 return (gen_host(dn_addr
, 0, proto
, dir
, q
.addr
));
6140 alist
= pcap_nametoaddr(name
);
6141 if (alist
== NULL
|| *alist
== NULL
)
6142 bpf_error("unknown host '%s'", name
);
6144 if (off_linktype
== (u_int
)-1 && tproto
== Q_DEFAULT
)
6146 b
= gen_host(**alist
++, 0xffffffff, tproto
, dir
, q
.addr
);
6148 tmp
= gen_host(**alist
++, 0xffffffff,
6149 tproto
, dir
, q
.addr
);
6155 memset(&mask128
, 0xff, sizeof(mask128
));
6156 res0
= res
= pcap_nametoaddrinfo(name
);
6158 bpf_error("unknown host '%s'", name
);
6161 tproto
= tproto6
= proto
;
6162 if (off_linktype
== -1 && tproto
== Q_DEFAULT
) {
6166 for (res
= res0
; res
; res
= res
->ai_next
) {
6167 switch (res
->ai_family
) {
6169 if (tproto
== Q_IPV6
)
6172 sin4
= (struct sockaddr_in
*)
6174 tmp
= gen_host(ntohl(sin4
->sin_addr
.s_addr
),
6175 0xffffffff, tproto
, dir
, q
.addr
);
6178 if (tproto6
== Q_IP
)
6181 sin6
= (struct sockaddr_in6
*)
6183 tmp
= gen_host6(&sin6
->sin6_addr
,
6184 &mask128
, tproto6
, dir
, q
.addr
);
6196 bpf_error("unknown host '%s'%s", name
,
6197 (proto
== Q_DEFAULT
)
6199 : " for specified address family");
6206 if (proto
!= Q_DEFAULT
&&
6207 proto
!= Q_UDP
&& proto
!= Q_TCP
&& proto
!= Q_SCTP
)
6208 bpf_error("illegal qualifier of 'port'");
6209 if (pcap_nametoport(name
, &port
, &real_proto
) == 0)
6210 bpf_error("unknown port '%s'", name
);
6211 if (proto
== Q_UDP
) {
6212 if (real_proto
== IPPROTO_TCP
)
6213 bpf_error("port '%s' is tcp", name
);
6214 else if (real_proto
== IPPROTO_SCTP
)
6215 bpf_error("port '%s' is sctp", name
);
6217 /* override PROTO_UNDEF */
6218 real_proto
= IPPROTO_UDP
;
6220 if (proto
== Q_TCP
) {
6221 if (real_proto
== IPPROTO_UDP
)
6222 bpf_error("port '%s' is udp", name
);
6224 else if (real_proto
== IPPROTO_SCTP
)
6225 bpf_error("port '%s' is sctp", name
);
6227 /* override PROTO_UNDEF */
6228 real_proto
= IPPROTO_TCP
;
6230 if (proto
== Q_SCTP
) {
6231 if (real_proto
== IPPROTO_UDP
)
6232 bpf_error("port '%s' is udp", name
);
6234 else if (real_proto
== IPPROTO_TCP
)
6235 bpf_error("port '%s' is tcp", name
);
6237 /* override PROTO_UNDEF */
6238 real_proto
= IPPROTO_SCTP
;
6241 bpf_error("illegal port number %d < 0", port
);
6243 bpf_error("illegal port number %d > 65535", port
);
6244 b
= gen_port(port
, real_proto
, dir
);
6245 gen_or(gen_port6(port
, real_proto
, dir
), b
);
6249 if (proto
!= Q_DEFAULT
&&
6250 proto
!= Q_UDP
&& proto
!= Q_TCP
&& proto
!= Q_SCTP
)
6251 bpf_error("illegal qualifier of 'portrange'");
6252 if (pcap_nametoportrange(name
, &port1
, &port2
, &real_proto
) == 0)
6253 bpf_error("unknown port in range '%s'", name
);
6254 if (proto
== Q_UDP
) {
6255 if (real_proto
== IPPROTO_TCP
)
6256 bpf_error("port in range '%s' is tcp", name
);
6257 else if (real_proto
== IPPROTO_SCTP
)
6258 bpf_error("port in range '%s' is sctp", name
);
6260 /* override PROTO_UNDEF */
6261 real_proto
= IPPROTO_UDP
;
6263 if (proto
== Q_TCP
) {
6264 if (real_proto
== IPPROTO_UDP
)
6265 bpf_error("port in range '%s' is udp", name
);
6266 else if (real_proto
== IPPROTO_SCTP
)
6267 bpf_error("port in range '%s' is sctp", name
);
6269 /* override PROTO_UNDEF */
6270 real_proto
= IPPROTO_TCP
;
6272 if (proto
== Q_SCTP
) {
6273 if (real_proto
== IPPROTO_UDP
)
6274 bpf_error("port in range '%s' is udp", name
);
6275 else if (real_proto
== IPPROTO_TCP
)
6276 bpf_error("port in range '%s' is tcp", name
);
6278 /* override PROTO_UNDEF */
6279 real_proto
= IPPROTO_SCTP
;
6282 bpf_error("illegal port number %d < 0", port1
);
6284 bpf_error("illegal port number %d > 65535", port1
);
6286 bpf_error("illegal port number %d < 0", port2
);
6288 bpf_error("illegal port number %d > 65535", port2
);
6290 b
= gen_portrange(port1
, port2
, real_proto
, dir
);
6291 gen_or(gen_portrange6(port1
, port2
, real_proto
, dir
), b
);
6296 eaddr
= pcap_ether_hostton(name
);
6298 bpf_error("unknown ether host: %s", name
);
6300 alist
= pcap_nametoaddr(name
);
6301 if (alist
== NULL
|| *alist
== NULL
)
6302 bpf_error("unknown host '%s'", name
);
6303 b
= gen_gateway(eaddr
, alist
, proto
, dir
);
6307 bpf_error("'gateway' not supported in this configuration");
6311 real_proto
= lookup_proto(name
, proto
);
6312 if (real_proto
>= 0)
6313 return gen_proto(real_proto
, proto
, dir
);
6315 bpf_error("unknown protocol: %s", name
);
6318 real_proto
= lookup_proto(name
, proto
);
6319 if (real_proto
>= 0)
6320 return gen_protochain(real_proto
, proto
, dir
);
6322 bpf_error("unknown protocol: %s", name
);
6333 gen_mcode(s1
, s2
, masklen
, q
)
6334 register const char *s1
, *s2
;
6335 register int masklen
;
6338 register int nlen
, mlen
;
6341 nlen
= __pcap_atoin(s1
, &n
);
6342 /* Promote short ipaddr */
6346 mlen
= __pcap_atoin(s2
, &m
);
6347 /* Promote short ipaddr */
6350 bpf_error("non-network bits set in \"%s mask %s\"",
6353 /* Convert mask len to mask */
6355 bpf_error("mask length must be <= 32");
6358 * X << 32 is not guaranteed by C to be 0; it's
6363 m
= 0xffffffff << (32 - masklen
);
6365 bpf_error("non-network bits set in \"%s/%d\"",
6372 return gen_host(n
, m
, q
.proto
, q
.dir
, q
.addr
);
6375 bpf_error("Mask syntax for networks only");
6384 register const char *s
;
6389 int proto
= q
.proto
;
6395 else if (q
.proto
== Q_DECNET
)
6396 vlen
= __pcap_atodn(s
, &v
);
6398 vlen
= __pcap_atoin(s
, &v
);
6405 if (proto
== Q_DECNET
)
6406 return gen_host(v
, 0, proto
, dir
, q
.addr
);
6407 else if (proto
== Q_LINK
) {
6408 bpf_error("illegal link layer address");
6411 if (s
== NULL
&& q
.addr
== Q_NET
) {
6412 /* Promote short net number */
6413 while (v
&& (v
& 0xff000000) == 0) {
6418 /* Promote short ipaddr */
6422 return gen_host(v
, mask
, proto
, dir
, q
.addr
);
6427 proto
= IPPROTO_UDP
;
6428 else if (proto
== Q_TCP
)
6429 proto
= IPPROTO_TCP
;
6430 else if (proto
== Q_SCTP
)
6431 proto
= IPPROTO_SCTP
;
6432 else if (proto
== Q_DEFAULT
)
6433 proto
= PROTO_UNDEF
;
6435 bpf_error("illegal qualifier of 'port'");
6438 bpf_error("illegal port number %u > 65535", v
);
6442 b
= gen_port((int)v
, proto
, dir
);
6443 gen_or(gen_port6((int)v
, proto
, dir
), b
);
6449 proto
= IPPROTO_UDP
;
6450 else if (proto
== Q_TCP
)
6451 proto
= IPPROTO_TCP
;
6452 else if (proto
== Q_SCTP
)
6453 proto
= IPPROTO_SCTP
;
6454 else if (proto
== Q_DEFAULT
)
6455 proto
= PROTO_UNDEF
;
6457 bpf_error("illegal qualifier of 'portrange'");
6460 bpf_error("illegal port number %u > 65535", v
);
6464 b
= gen_portrange((int)v
, (int)v
, proto
, dir
);
6465 gen_or(gen_portrange6((int)v
, (int)v
, proto
, dir
), b
);
6470 bpf_error("'gateway' requires a name");
6474 return gen_proto((int)v
, proto
, dir
);
6477 return gen_protochain((int)v
, proto
, dir
);
6492 gen_mcode6(s1
, s2
, masklen
, q
)
6493 register const char *s1
, *s2
;
6494 register int masklen
;
6497 struct addrinfo
*res
;
6498 struct in6_addr
*addr
;
6499 struct in6_addr mask
;
6504 bpf_error("no mask %s supported", s2
);
6506 res
= pcap_nametoaddrinfo(s1
);
6508 bpf_error("invalid ip6 address %s", s1
);
6511 bpf_error("%s resolved to multiple address", s1
);
6512 addr
= &((struct sockaddr_in6
*)res
->ai_addr
)->sin6_addr
;
6514 if (sizeof(mask
) * 8 < masklen
)
6515 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask
) * 8));
6516 memset(&mask
, 0, sizeof(mask
));
6517 memset(&mask
, 0xff, masklen
/ 8);
6519 mask
.s6_addr
[masklen
/ 8] =
6520 (0xff << (8 - masklen
% 8)) & 0xff;
6523 a
= (u_int32_t
*)addr
;
6524 m
= (u_int32_t
*)&mask
;
6525 if ((a
[0] & ~m
[0]) || (a
[1] & ~m
[1])
6526 || (a
[2] & ~m
[2]) || (a
[3] & ~m
[3])) {
6527 bpf_error("non-network bits set in \"%s/%d\"", s1
, masklen
);
6535 bpf_error("Mask syntax for networks only");
6539 b
= gen_host6(addr
, &mask
, q
.proto
, q
.dir
, q
.addr
);
6545 bpf_error("invalid qualifier against IPv6 address");
6554 register const u_char
*eaddr
;
6557 struct block
*b
, *tmp
;
6559 if ((q
.addr
== Q_HOST
|| q
.addr
== Q_DEFAULT
) && q
.proto
== Q_LINK
) {
6562 case DLT_NETANALYZER
:
6563 case DLT_NETANALYZER_TRANSPARENT
:
6564 return gen_ehostop(eaddr
, (int)q
.dir
);
6566 return gen_fhostop(eaddr
, (int)q
.dir
);
6568 return gen_thostop(eaddr
, (int)q
.dir
);
6569 case DLT_IEEE802_11
:
6570 case DLT_PRISM_HEADER
:
6571 case DLT_IEEE802_11_RADIO_AVS
:
6572 case DLT_IEEE802_11_RADIO
:
6574 return gen_wlanhostop(eaddr
, (int)q
.dir
);
6578 * Check that the packet doesn't begin with an
6579 * LE Control marker. (We've already generated
6582 tmp
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
, BPF_H
,
6587 * Now check the MAC address.
6589 b
= gen_ehostop(eaddr
, (int)q
.dir
);
6594 case DLT_IP_OVER_FC
:
6595 return gen_ipfchostop(eaddr
, (int)q
.dir
);
6597 bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
6601 bpf_error("ethernet address used in non-ether expression");
6608 struct slist
*s0
, *s1
;
6611 * This is definitely not the best way to do this, but the
6612 * lists will rarely get long.
6619 static struct slist
*
6625 s
= new_stmt(BPF_LDX
|BPF_MEM
);
6630 static struct slist
*
6636 s
= new_stmt(BPF_LD
|BPF_MEM
);
6642 * Modify "index" to use the value stored into its register as an
6643 * offset relative to the beginning of the header for the protocol
6644 * "proto", and allocate a register and put an item "size" bytes long
6645 * (1, 2, or 4) at that offset into that register, making it the register
6649 gen_load(proto
, inst
, size
)
6654 struct slist
*s
, *tmp
;
6656 int regno
= alloc_reg();
6658 free_reg(inst
->regno
);
6662 bpf_error("data size must be 1, 2, or 4");
6678 bpf_error("unsupported index operation");
6682 * The offset is relative to the beginning of the packet
6683 * data, if we have a radio header. (If we don't, this
6686 if (linktype
!= DLT_IEEE802_11_RADIO_AVS
&&
6687 linktype
!= DLT_IEEE802_11_RADIO
&&
6688 linktype
!= DLT_PRISM_HEADER
)
6689 bpf_error("radio information not present in capture");
6692 * Load into the X register the offset computed into the
6693 * register specified by "index".
6695 s
= xfer_to_x(inst
);
6698 * Load the item at that offset.
6700 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6702 sappend(inst
->s
, s
);
6707 * The offset is relative to the beginning of
6708 * the link-layer header.
6710 * XXX - what about ATM LANE? Should the index be
6711 * relative to the beginning of the AAL5 frame, so
6712 * that 0 refers to the beginning of the LE Control
6713 * field, or relative to the beginning of the LAN
6714 * frame, so that 0 refers, for Ethernet LANE, to
6715 * the beginning of the destination address?
6717 s
= gen_llprefixlen();
6720 * If "s" is non-null, it has code to arrange that the
6721 * X register contains the length of the prefix preceding
6722 * the link-layer header. Add to it the offset computed
6723 * into the register specified by "index", and move that
6724 * into the X register. Otherwise, just load into the X
6725 * register the offset computed into the register specified
6729 sappend(s
, xfer_to_a(inst
));
6730 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6731 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6733 s
= xfer_to_x(inst
);
6736 * Load the item at the sum of the offset we've put in the
6737 * X register and the offset of the start of the link
6738 * layer header (which is 0 if the radio header is
6739 * variable-length; that header length is what we put
6740 * into the X register and then added to the index).
6742 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6745 sappend(inst
->s
, s
);
6759 * The offset is relative to the beginning of
6760 * the network-layer header.
6761 * XXX - are there any cases where we want
6764 s
= gen_off_macpl();
6767 * If "s" is non-null, it has code to arrange that the
6768 * X register contains the offset of the MAC-layer
6769 * payload. Add to it the offset computed into the
6770 * register specified by "index", and move that into
6771 * the X register. Otherwise, just load into the X
6772 * register the offset computed into the register specified
6776 sappend(s
, xfer_to_a(inst
));
6777 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6778 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6780 s
= xfer_to_x(inst
);
6783 * Load the item at the sum of the offset we've put in the
6784 * X register, the offset of the start of the network
6785 * layer header from the beginning of the MAC-layer
6786 * payload, and the purported offset of the start of the
6787 * MAC-layer payload (which might be 0 if there's a
6788 * variable-length prefix before the link-layer header
6789 * or the link-layer header itself is variable-length;
6790 * the variable-length offset of the start of the
6791 * MAC-layer payload is what we put into the X register
6792 * and then added to the index).
6794 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6795 tmp
->s
.k
= off_macpl
+ off_nl
;
6797 sappend(inst
->s
, s
);
6800 * Do the computation only if the packet contains
6801 * the protocol in question.
6803 b
= gen_proto_abbrev(proto
);
6805 gen_and(inst
->b
, b
);
6819 * The offset is relative to the beginning of
6820 * the transport-layer header.
6822 * Load the X register with the length of the IPv4 header
6823 * (plus the offset of the link-layer header, if it's
6824 * a variable-length header), in bytes.
6826 * XXX - are there any cases where we want
6828 * XXX - we should, if we're built with
6829 * IPv6 support, generate code to load either
6830 * IPv4, IPv6, or both, as appropriate.
6832 s
= gen_loadx_iphdrlen();
6835 * The X register now contains the sum of the length
6836 * of any variable-length header preceding the link-layer
6837 * header, any variable-length link-layer header, and the
6838 * length of the network-layer header.
6840 * Load into the A register the offset relative to
6841 * the beginning of the transport layer header,
6842 * add the X register to that, move that to the
6843 * X register, and load with an offset from the
6844 * X register equal to the offset of the network
6845 * layer header relative to the beginning of
6846 * the MAC-layer payload plus the fixed-length
6847 * portion of the offset of the MAC-layer payload
6848 * from the beginning of the raw packet data.
6850 sappend(s
, xfer_to_a(inst
));
6851 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6852 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6853 sappend(s
, tmp
= new_stmt(BPF_LD
|BPF_IND
|size
));
6854 tmp
->s
.k
= off_macpl
+ off_nl
;
6855 sappend(inst
->s
, s
);
6858 * Do the computation only if the packet contains
6859 * the protocol in question - which is true only
6860 * if this is an IP datagram and is the first or
6861 * only fragment of that datagram.
6863 gen_and(gen_proto_abbrev(proto
), b
= gen_ipfrag());
6865 gen_and(inst
->b
, b
);
6866 gen_and(gen_proto_abbrev(Q_IP
), b
);
6870 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
6873 inst
->regno
= regno
;
6874 s
= new_stmt(BPF_ST
);
6876 sappend(inst
->s
, s
);
6882 gen_relation(code
, a0
, a1
, reversed
)
6884 struct arth
*a0
, *a1
;
6887 struct slist
*s0
, *s1
, *s2
;
6888 struct block
*b
, *tmp
;
6892 if (code
== BPF_JEQ
) {
6893 s2
= new_stmt(BPF_ALU
|BPF_SUB
|BPF_X
);
6894 b
= new_block(JMP(code
));
6898 b
= new_block(BPF_JMP
|code
|BPF_X
);
6904 sappend(a0
->s
, a1
->s
);
6908 free_reg(a0
->regno
);
6909 free_reg(a1
->regno
);
6911 /* 'and' together protocol checks */
6914 gen_and(a0
->b
, tmp
= a1
->b
);
6930 int regno
= alloc_reg();
6931 struct arth
*a
= (struct arth
*)newchunk(sizeof(*a
));
6934 s
= new_stmt(BPF_LD
|BPF_LEN
);
6935 s
->next
= new_stmt(BPF_ST
);
6936 s
->next
->s
.k
= regno
;
6951 a
= (struct arth
*)newchunk(sizeof(*a
));
6955 s
= new_stmt(BPF_LD
|BPF_IMM
);
6957 s
->next
= new_stmt(BPF_ST
);
6973 s
= new_stmt(BPF_ALU
|BPF_NEG
);
6976 s
= new_stmt(BPF_ST
);
6984 gen_arth(code
, a0
, a1
)
6986 struct arth
*a0
, *a1
;
6988 struct slist
*s0
, *s1
, *s2
;
6992 s2
= new_stmt(BPF_ALU
|BPF_X
|code
);
6997 sappend(a0
->s
, a1
->s
);
6999 free_reg(a0
->regno
);
7000 free_reg(a1
->regno
);
7002 s0
= new_stmt(BPF_ST
);
7003 a0
->regno
= s0
->s
.k
= alloc_reg();
7010 * Here we handle simple allocation of the scratch registers.
7011 * If too many registers are alloc'd, the allocator punts.
7013 static int regused
[BPF_MEMWORDS
];
7017 * Initialize the table of used registers and the current register.
7023 memset(regused
, 0, sizeof regused
);
7027 * Return the next free register.
7032 int n
= BPF_MEMWORDS
;
7035 if (regused
[curreg
])
7036 curreg
= (curreg
+ 1) % BPF_MEMWORDS
;
7038 regused
[curreg
] = 1;
7042 bpf_error("too many registers needed to evaluate expression");
7048 * Return a register to the table so it can
7058 static struct block
*
7065 s
= new_stmt(BPF_LD
|BPF_LEN
);
7066 b
= new_block(JMP(jmp
));
7077 return gen_len(BPF_JGE
, n
);
7081 * Actually, this is less than or equal.
7089 b
= gen_len(BPF_JGT
, n
);
7096 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to
7097 * the beginning of the link-layer header.
7098 * XXX - that means you can't test values in the radiotap header, but
7099 * as that header is difficult if not impossible to parse generally
7100 * without a loop, that might not be a severe problem. A new keyword
7101 * "radio" could be added for that, although what you'd really want
7102 * would be a way of testing particular radio header values, which
7103 * would generate code appropriate to the radio header in question.
7106 gen_byteop(op
, idx
, val
)
7117 return gen_cmp(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
7120 b
= gen_cmp_lt(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
7124 b
= gen_cmp_gt(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
7128 s
= new_stmt(BPF_ALU
|BPF_OR
|BPF_K
);
7132 s
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
7136 b
= new_block(JMP(BPF_JEQ
));
7143 static u_char abroadcast
[] = { 0x0 };
7146 gen_broadcast(proto
)
7149 bpf_u_int32 hostmask
;
7150 struct block
*b0
, *b1
, *b2
;
7151 static u_char ebroadcast
[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
7159 case DLT_ARCNET_LINUX
:
7160 return gen_ahostop(abroadcast
, Q_DST
);
7162 case DLT_NETANALYZER
:
7163 case DLT_NETANALYZER_TRANSPARENT
:
7164 return gen_ehostop(ebroadcast
, Q_DST
);
7166 return gen_fhostop(ebroadcast
, Q_DST
);
7168 return gen_thostop(ebroadcast
, Q_DST
);
7169 case DLT_IEEE802_11
:
7170 case DLT_PRISM_HEADER
:
7171 case DLT_IEEE802_11_RADIO_AVS
:
7172 case DLT_IEEE802_11_RADIO
:
7174 return gen_wlanhostop(ebroadcast
, Q_DST
);
7175 case DLT_IP_OVER_FC
:
7176 return gen_ipfchostop(ebroadcast
, Q_DST
);
7180 * Check that the packet doesn't begin with an
7181 * LE Control marker. (We've already generated
7184 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
7189 * Now check the MAC address.
7191 b0
= gen_ehostop(ebroadcast
, Q_DST
);
7197 bpf_error("not a broadcast link");
7203 * We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff)
7204 * as an indication that we don't know the netmask, and fail
7207 if (netmask
== PCAP_NETMASK_UNKNOWN
)
7208 bpf_error("netmask not known, so 'ip broadcast' not supported");
7209 b0
= gen_linktype(ETHERTYPE_IP
);
7210 hostmask
= ~netmask
;
7211 b1
= gen_mcmp(OR_NET
, 16, BPF_W
, (bpf_int32
)0, hostmask
);
7212 b2
= gen_mcmp(OR_NET
, 16, BPF_W
,
7213 (bpf_int32
)(~0 & hostmask
), hostmask
);
7218 bpf_error("only link-layer/IP broadcast filters supported");
7224 * Generate code to test the low-order bit of a MAC address (that's
7225 * the bottom bit of the *first* byte).
7227 static struct block
*
7228 gen_mac_multicast(offset
)
7231 register struct block
*b0
;
7232 register struct slist
*s
;
7234 /* link[offset] & 1 != 0 */
7235 s
= gen_load_a(OR_LINK
, offset
, BPF_B
);
7236 b0
= new_block(JMP(BPF_JSET
));
7243 gen_multicast(proto
)
7246 register struct block
*b0
, *b1
, *b2
;
7247 register struct slist
*s
;
7255 case DLT_ARCNET_LINUX
:
7256 /* all ARCnet multicasts use the same address */
7257 return gen_ahostop(abroadcast
, Q_DST
);
7259 case DLT_NETANALYZER
:
7260 case DLT_NETANALYZER_TRANSPARENT
:
7261 /* ether[0] & 1 != 0 */
7262 return gen_mac_multicast(0);
7265 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
7267 * XXX - was that referring to bit-order issues?
7269 /* fddi[1] & 1 != 0 */
7270 return gen_mac_multicast(1);
7272 /* tr[2] & 1 != 0 */
7273 return gen_mac_multicast(2);
7274 case DLT_IEEE802_11
:
7275 case DLT_PRISM_HEADER
:
7276 case DLT_IEEE802_11_RADIO_AVS
:
7277 case DLT_IEEE802_11_RADIO
:
7282 * For control frames, there is no DA.
7284 * For management frames, DA is at an
7285 * offset of 4 from the beginning of
7288 * For data frames, DA is at an offset
7289 * of 4 from the beginning of the packet
7290 * if To DS is clear and at an offset of
7291 * 16 from the beginning of the packet
7296 * Generate the tests to be done for data frames.
7298 * First, check for To DS set, i.e. "link[1] & 0x01".
7300 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
7301 b1
= new_block(JMP(BPF_JSET
));
7302 b1
->s
.k
= 0x01; /* To DS */
7306 * If To DS is set, the DA is at 16.
7308 b0
= gen_mac_multicast(16);
7312 * Now, check for To DS not set, i.e. check
7313 * "!(link[1] & 0x01)".
7315 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
7316 b2
= new_block(JMP(BPF_JSET
));
7317 b2
->s
.k
= 0x01; /* To DS */
7322 * If To DS is not set, the DA is at 4.
7324 b1
= gen_mac_multicast(4);
7328 * Now OR together the last two checks. That gives
7329 * the complete set of checks for data frames.
7334 * Now check for a data frame.
7335 * I.e, check "link[0] & 0x08".
7337 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7338 b1
= new_block(JMP(BPF_JSET
));
7343 * AND that with the checks done for data frames.
7348 * If the high-order bit of the type value is 0, this
7349 * is a management frame.
7350 * I.e, check "!(link[0] & 0x08)".
7352 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7353 b2
= new_block(JMP(BPF_JSET
));
7359 * For management frames, the DA is at 4.
7361 b1
= gen_mac_multicast(4);
7365 * OR that with the checks done for data frames.
7366 * That gives the checks done for management and
7372 * If the low-order bit of the type value is 1,
7373 * this is either a control frame or a frame
7374 * with a reserved type, and thus not a
7377 * I.e., check "!(link[0] & 0x04)".
7379 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7380 b1
= new_block(JMP(BPF_JSET
));
7386 * AND that with the checks for data and management
7391 case DLT_IP_OVER_FC
:
7392 b0
= gen_mac_multicast(2);
7397 * Check that the packet doesn't begin with an
7398 * LE Control marker. (We've already generated
7401 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
7405 /* ether[off_mac] & 1 != 0 */
7406 b0
= gen_mac_multicast(off_mac
);
7414 /* Link not known to support multicasts */
7418 b0
= gen_linktype(ETHERTYPE_IP
);
7419 b1
= gen_cmp_ge(OR_NET
, 16, BPF_B
, (bpf_int32
)224);
7424 b0
= gen_linktype(ETHERTYPE_IPV6
);
7425 b1
= gen_cmp(OR_NET
, 24, BPF_B
, (bpf_int32
)255);
7429 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel");
7435 * Filter on inbound (dir == 0) or outbound (dir == 1) traffic.
7436 * Outbound traffic is sent by this machine, while inbound traffic is
7437 * sent by a remote machine (and may include packets destined for a
7438 * unicast or multicast link-layer address we are not subscribing to).
7439 * These are the same definitions implemented by pcap_setdirection().
7440 * Capturing only unicast traffic destined for this host is probably
7441 * better accomplished using a higher-layer filter.
7447 register struct block
*b0
;
7450 * Only some data link types support inbound/outbound qualifiers.
7454 b0
= gen_relation(BPF_JEQ
,
7455 gen_load(Q_LINK
, gen_loadi(0), 1),
7462 /* match outgoing packets */
7463 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, IPNET_OUTBOUND
);
7465 /* match incoming packets */
7466 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, IPNET_INBOUND
);
7471 /* match outgoing packets */
7472 b0
= gen_cmp(OR_LINK
, 0, BPF_H
, LINUX_SLL_OUTGOING
);
7474 /* to filter on inbound traffic, invert the match */
7479 #ifdef HAVE_NET_PFVAR_H
7481 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, dir
), BPF_B
,
7482 (bpf_int32
)((dir
== 0) ? PF_IN
: PF_OUT
));
7488 /* match outgoing packets */
7489 b0
= gen_cmp(OR_LINK
, 0, BPF_B
, PPP_PPPD_OUT
);
7491 /* match incoming packets */
7492 b0
= gen_cmp(OR_LINK
, 0, BPF_B
, PPP_PPPD_IN
);
7496 case DLT_JUNIPER_MFR
:
7497 case DLT_JUNIPER_MLFR
:
7498 case DLT_JUNIPER_MLPPP
:
7499 case DLT_JUNIPER_ATM1
:
7500 case DLT_JUNIPER_ATM2
:
7501 case DLT_JUNIPER_PPPOE
:
7502 case DLT_JUNIPER_PPPOE_ATM
:
7503 case DLT_JUNIPER_GGSN
:
7504 case DLT_JUNIPER_ES
:
7505 case DLT_JUNIPER_MONITOR
:
7506 case DLT_JUNIPER_SERVICES
:
7507 case DLT_JUNIPER_ETHER
:
7508 case DLT_JUNIPER_PPP
:
7509 case DLT_JUNIPER_FRELAY
:
7510 case DLT_JUNIPER_CHDLC
:
7511 case DLT_JUNIPER_VP
:
7512 case DLT_JUNIPER_ST
:
7513 case DLT_JUNIPER_ISM
:
7514 case DLT_JUNIPER_VS
:
7515 case DLT_JUNIPER_SRX_E2E
:
7516 case DLT_JUNIPER_FIBRECHANNEL
:
7517 case DLT_JUNIPER_ATM_CEMIC
:
7519 /* juniper flags (including direction) are stored
7520 * the byte after the 3-byte magic number */
7522 /* match outgoing packets */
7523 b0
= gen_mcmp(OR_LINK
, 3, BPF_B
, 0, 0x01);
7525 /* match incoming packets */
7526 b0
= gen_mcmp(OR_LINK
, 3, BPF_B
, 1, 0x01);
7532 * If we have packet meta-data indicating a direction,
7533 * check it, otherwise give up as this link-layer type
7534 * has nothing in the packet data.
7536 #if defined(PF_PACKET) && defined(SO_ATTACH_FILTER)
7538 * We infer that this is Linux with PF_PACKET support.
7539 * If this is a *live* capture, we can look at
7540 * special meta-data in the filter expression;
7541 * if it's a savefile, we can't.
7543 if (bpf_pcap
->sf
.rfile
!= NULL
) {
7544 /* We have a FILE *, so this is a savefile */
7545 bpf_error("inbound/outbound not supported on linktype %d when reading savefiles",
7550 /* match outgoing packets */
7551 b0
= gen_cmp(OR_LINK
, SKF_AD_OFF
+ SKF_AD_PKTTYPE
, BPF_H
,
7554 /* to filter on inbound traffic, invert the match */
7557 #else /* defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */
7558 bpf_error("inbound/outbound not supported on linktype %d",
7562 #endif /* defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */
7567 #ifdef HAVE_NET_PFVAR_H
7568 /* PF firewall log matched interface */
7570 gen_pf_ifname(const char *ifname
)
7575 if (linktype
!= DLT_PFLOG
) {
7576 bpf_error("ifname supported only on PF linktype");
7579 len
= sizeof(((struct pfloghdr
*)0)->ifname
);
7580 off
= offsetof(struct pfloghdr
, ifname
);
7581 if (strlen(ifname
) >= len
) {
7582 bpf_error("ifname interface names can only be %d characters",
7586 b0
= gen_bcmp(OR_LINK
, off
, strlen(ifname
), (const u_char
*)ifname
);
7590 /* PF firewall log ruleset name */
7592 gen_pf_ruleset(char *ruleset
)
7596 if (linktype
!= DLT_PFLOG
) {
7597 bpf_error("ruleset supported only on PF linktype");
7601 if (strlen(ruleset
) >= sizeof(((struct pfloghdr
*)0)->ruleset
)) {
7602 bpf_error("ruleset names can only be %ld characters",
7603 (long)(sizeof(((struct pfloghdr
*)0)->ruleset
) - 1));
7607 b0
= gen_bcmp(OR_LINK
, offsetof(struct pfloghdr
, ruleset
),
7608 strlen(ruleset
), (const u_char
*)ruleset
);
7612 /* PF firewall log rule number */
7618 if (linktype
!= DLT_PFLOG
) {
7619 bpf_error("rnr supported only on PF linktype");
7623 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, rulenr
), BPF_W
,
7628 /* PF firewall log sub-rule number */
7630 gen_pf_srnr(int srnr
)
7634 if (linktype
!= DLT_PFLOG
) {
7635 bpf_error("srnr supported only on PF linktype");
7639 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, subrulenr
), BPF_W
,
7644 /* PF firewall log reason code */
7646 gen_pf_reason(int reason
)
7650 if (linktype
!= DLT_PFLOG
) {
7651 bpf_error("reason supported only on PF linktype");
7655 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, reason
), BPF_B
,
7660 /* PF firewall log action */
7662 gen_pf_action(int action
)
7666 if (linktype
!= DLT_PFLOG
) {
7667 bpf_error("action supported only on PF linktype");
7671 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, action
), BPF_B
,
7675 #else /* !HAVE_NET_PFVAR_H */
7677 gen_pf_ifname(const char *ifname
)
7679 bpf_error("libpcap was compiled without pf support");
7685 gen_pf_ruleset(char *ruleset
)
7687 bpf_error("libpcap was compiled on a machine without pf support");
7695 bpf_error("libpcap was compiled on a machine without pf support");
7701 gen_pf_srnr(int srnr
)
7703 bpf_error("libpcap was compiled on a machine without pf support");
7709 gen_pf_reason(int reason
)
7711 bpf_error("libpcap was compiled on a machine without pf support");
7717 gen_pf_action(int action
)
7719 bpf_error("libpcap was compiled on a machine without pf support");
7723 #endif /* HAVE_NET_PFVAR_H */
7725 /* IEEE 802.11 wireless header */
7727 gen_p80211_type(int type
, int mask
)
7733 case DLT_IEEE802_11
:
7734 case DLT_PRISM_HEADER
:
7735 case DLT_IEEE802_11_RADIO_AVS
:
7736 case DLT_IEEE802_11_RADIO
:
7737 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, (bpf_int32
)type
,
7742 bpf_error("802.11 link-layer types supported only on 802.11");
7750 gen_p80211_fcdir(int fcdir
)
7756 case DLT_IEEE802_11
:
7757 case DLT_PRISM_HEADER
:
7758 case DLT_IEEE802_11_RADIO_AVS
:
7759 case DLT_IEEE802_11_RADIO
:
7763 bpf_error("frame direction supported only with 802.11 headers");
7767 b0
= gen_mcmp(OR_LINK
, 1, BPF_B
, (bpf_int32
)fcdir
,
7768 (bpf_u_int32
)IEEE80211_FC1_DIR_MASK
);
7775 register const u_char
*eaddr
;
7781 case DLT_ARCNET_LINUX
:
7782 if ((q
.addr
== Q_HOST
|| q
.addr
== Q_DEFAULT
) &&
7784 return (gen_ahostop(eaddr
, (int)q
.dir
));
7786 bpf_error("ARCnet address used in non-arc expression");
7792 bpf_error("aid supported only on ARCnet");
7795 bpf_error("ARCnet address used in non-arc expression");
7800 static struct block
*
7801 gen_ahostop(eaddr
, dir
)
7802 register const u_char
*eaddr
;
7805 register struct block
*b0
, *b1
;
7808 /* src comes first, different from Ethernet */
7810 return gen_bcmp(OR_LINK
, 0, 1, eaddr
);
7813 return gen_bcmp(OR_LINK
, 1, 1, eaddr
);
7816 b0
= gen_ahostop(eaddr
, Q_SRC
);
7817 b1
= gen_ahostop(eaddr
, Q_DST
);
7823 b0
= gen_ahostop(eaddr
, Q_SRC
);
7824 b1
= gen_ahostop(eaddr
, Q_DST
);
7829 bpf_error("'addr1' is only supported on 802.11");
7833 bpf_error("'addr2' is only supported on 802.11");
7837 bpf_error("'addr3' is only supported on 802.11");
7841 bpf_error("'addr4' is only supported on 802.11");
7845 bpf_error("'ra' is only supported on 802.11");
7849 bpf_error("'ta' is only supported on 802.11");
7857 * support IEEE 802.1Q VLAN trunk over ethernet
7863 struct block
*b0
, *b1
;
7865 /* can't check for VLAN-encapsulated packets inside MPLS */
7866 if (label_stack_depth
> 0)
7867 bpf_error("no VLAN match after MPLS");
7870 * Check for a VLAN packet, and then change the offsets to point
7871 * to the type and data fields within the VLAN packet. Just
7872 * increment the offsets, so that we can support a hierarchy, e.g.
7873 * "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within
7876 * XXX - this is a bit of a kludge. If we were to split the
7877 * compiler into a parser that parses an expression and
7878 * generates an expression tree, and a code generator that
7879 * takes an expression tree (which could come from our
7880 * parser or from some other parser) and generates BPF code,
7881 * we could perhaps make the offsets parameters of routines
7882 * and, in the handler for an "AND" node, pass to subnodes
7883 * other than the VLAN node the adjusted offsets.
7885 * This would mean that "vlan" would, instead of changing the
7886 * behavior of *all* tests after it, change only the behavior
7887 * of tests ANDed with it. That would change the documented
7888 * semantics of "vlan", which might break some expressions.
7889 * However, it would mean that "(vlan and ip) or ip" would check
7890 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
7891 * checking only for VLAN-encapsulated IP, so that could still
7892 * be considered worth doing; it wouldn't break expressions
7893 * that are of the form "vlan and ..." or "vlan N and ...",
7894 * which I suspect are the most common expressions involving
7895 * "vlan". "vlan or ..." doesn't necessarily do what the user
7896 * would really want, now, as all the "or ..." tests would
7897 * be done assuming a VLAN, even though the "or" could be viewed
7898 * as meaning "or, if this isn't a VLAN packet...".
7905 case DLT_NETANALYZER
:
7906 case DLT_NETANALYZER_TRANSPARENT
:
7907 /* check for VLAN, including QinQ */
7908 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
7909 (bpf_int32
)ETHERTYPE_8021Q
);
7910 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
7911 (bpf_int32
)ETHERTYPE_8021QINQ
);
7915 /* If a specific VLAN is requested, check VLAN id */
7916 if (vlan_num
>= 0) {
7917 b1
= gen_mcmp(OR_MACPL
, 0, BPF_H
,
7918 (bpf_int32
)vlan_num
, 0x0fff);
7932 bpf_error("no VLAN support for data link type %d",
7947 struct block
*b0
,*b1
;
7950 * Change the offsets to point to the type and data fields within
7951 * the MPLS packet. Just increment the offsets, so that we
7952 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to
7953 * capture packets with an outer label of 100000 and an inner
7956 * XXX - this is a bit of a kludge. See comments in gen_vlan().
7960 if (label_stack_depth
> 0) {
7961 /* just match the bottom-of-stack bit clear */
7962 b0
= gen_mcmp(OR_MACPL
, orig_nl
-2, BPF_B
, 0, 0x01);
7965 * Indicate that we're checking MPLS-encapsulated headers,
7966 * to make sure higher level code generators don't try to
7967 * match against IP-related protocols such as Q_ARP, Q_RARP
7972 case DLT_C_HDLC
: /* fall through */
7974 case DLT_NETANALYZER
:
7975 case DLT_NETANALYZER_TRANSPARENT
:
7976 b0
= gen_linktype(ETHERTYPE_MPLS
);
7980 b0
= gen_linktype(PPP_MPLS_UCAST
);
7983 /* FIXME add other DLT_s ...
7984 * for Frame-Relay/and ATM this may get messy due to SNAP headers
7985 * leave it for now */
7988 bpf_error("no MPLS support for data link type %d",
7996 /* If a specific MPLS label is requested, check it */
7997 if (label_num
>= 0) {
7998 label_num
= label_num
<< 12; /* label is shifted 12 bits on the wire */
7999 b1
= gen_mcmp(OR_MACPL
, orig_nl
, BPF_W
, (bpf_int32
)label_num
,
8000 0xfffff000); /* only compare the first 20 bits */
8007 label_stack_depth
++;
8012 * Support PPPOE discovery and session.
8017 /* check for PPPoE discovery */
8018 return gen_linktype((bpf_int32
)ETHERTYPE_PPPOED
);
8027 * Test against the PPPoE session link-layer type.
8029 b0
= gen_linktype((bpf_int32
)ETHERTYPE_PPPOES
);
8032 * Change the offsets to point to the type and data fields within
8033 * the PPP packet, and note that this is PPPoE rather than
8036 * XXX - this is a bit of a kludge. If we were to split the
8037 * compiler into a parser that parses an expression and
8038 * generates an expression tree, and a code generator that
8039 * takes an expression tree (which could come from our
8040 * parser or from some other parser) and generates BPF code,
8041 * we could perhaps make the offsets parameters of routines
8042 * and, in the handler for an "AND" node, pass to subnodes
8043 * other than the PPPoE node the adjusted offsets.
8045 * This would mean that "pppoes" would, instead of changing the
8046 * behavior of *all* tests after it, change only the behavior
8047 * of tests ANDed with it. That would change the documented
8048 * semantics of "pppoes", which might break some expressions.
8049 * However, it would mean that "(pppoes and ip) or ip" would check
8050 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
8051 * checking only for VLAN-encapsulated IP, so that could still
8052 * be considered worth doing; it wouldn't break expressions
8053 * that are of the form "pppoes and ..." which I suspect are the
8054 * most common expressions involving "pppoes". "pppoes or ..."
8055 * doesn't necessarily do what the user would really want, now,
8056 * as all the "or ..." tests would be done assuming PPPoE, even
8057 * though the "or" could be viewed as meaning "or, if this isn't
8058 * a PPPoE packet...".
8060 orig_linktype
= off_linktype
; /* save original values */
8065 * The "network-layer" protocol is PPPoE, which has a 6-byte
8066 * PPPoE header, followed by a PPP packet.
8068 * There is no HDLC encapsulation for the PPP packet (it's
8069 * encapsulated in PPPoES instead), so the link-layer type
8070 * starts at the first byte of the PPP packet. For PPPoE,
8071 * that offset is relative to the beginning of the total
8072 * link-layer payload, including any 802.2 LLC header, so
8073 * it's 6 bytes past off_nl.
8075 off_linktype
= off_nl
+ 6;
8078 * The network-layer offsets are relative to the beginning
8079 * of the MAC-layer payload; that's past the 6-byte
8080 * PPPoE header and the 2-byte PPP header.
8083 off_nl_nosnap
= 6+2;
8089 gen_atmfield_code(atmfield
, jvalue
, jtype
, reverse
)
8101 bpf_error("'vpi' supported only on raw ATM");
8102 if (off_vpi
== (u_int
)-1)
8104 b0
= gen_ncmp(OR_LINK
, off_vpi
, BPF_B
, 0xffffffff, jtype
,
8110 bpf_error("'vci' supported only on raw ATM");
8111 if (off_vci
== (u_int
)-1)
8113 b0
= gen_ncmp(OR_LINK
, off_vci
, BPF_H
, 0xffffffff, jtype
,
8118 if (off_proto
== (u_int
)-1)
8119 abort(); /* XXX - this isn't on FreeBSD */
8120 b0
= gen_ncmp(OR_LINK
, off_proto
, BPF_B
, 0x0f, jtype
,
8125 if (off_payload
== (u_int
)-1)
8127 b0
= gen_ncmp(OR_LINK
, off_payload
+ MSG_TYPE_POS
, BPF_B
,
8128 0xffffffff, jtype
, reverse
, jvalue
);
8133 bpf_error("'callref' supported only on raw ATM");
8134 if (off_proto
== (u_int
)-1)
8136 b0
= gen_ncmp(OR_LINK
, off_proto
, BPF_B
, 0xffffffff,
8137 jtype
, reverse
, jvalue
);
8147 gen_atmtype_abbrev(type
)
8150 struct block
*b0
, *b1
;
8155 /* Get all packets in Meta signalling Circuit */
8157 bpf_error("'metac' supported only on raw ATM");
8158 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8159 b1
= gen_atmfield_code(A_VCI
, 1, BPF_JEQ
, 0);
8164 /* Get all packets in Broadcast Circuit*/
8166 bpf_error("'bcc' supported only on raw ATM");
8167 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8168 b1
= gen_atmfield_code(A_VCI
, 2, BPF_JEQ
, 0);
8173 /* Get all cells in Segment OAM F4 circuit*/
8175 bpf_error("'oam4sc' supported only on raw ATM");
8176 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8177 b1
= gen_atmfield_code(A_VCI
, 3, BPF_JEQ
, 0);
8182 /* Get all cells in End-to-End OAM F4 Circuit*/
8184 bpf_error("'oam4ec' supported only on raw ATM");
8185 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8186 b1
= gen_atmfield_code(A_VCI
, 4, BPF_JEQ
, 0);
8191 /* Get all packets in connection Signalling Circuit */
8193 bpf_error("'sc' supported only on raw ATM");
8194 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8195 b1
= gen_atmfield_code(A_VCI
, 5, BPF_JEQ
, 0);
8200 /* Get all packets in ILMI Circuit */
8202 bpf_error("'ilmic' supported only on raw ATM");
8203 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8204 b1
= gen_atmfield_code(A_VCI
, 16, BPF_JEQ
, 0);
8209 /* Get all LANE packets */
8211 bpf_error("'lane' supported only on raw ATM");
8212 b1
= gen_atmfield_code(A_PROTOTYPE
, PT_LANE
, BPF_JEQ
, 0);
8215 * Arrange that all subsequent tests assume LANE
8216 * rather than LLC-encapsulated packets, and set
8217 * the offsets appropriately for LANE-encapsulated
8220 * "off_mac" is the offset of the Ethernet header,
8221 * which is 2 bytes past the ATM pseudo-header
8222 * (skipping the pseudo-header and 2-byte LE Client
8223 * field). The other offsets are Ethernet offsets
8224 * relative to "off_mac".
8227 off_mac
= off_payload
+ 2; /* MAC header */
8228 off_linktype
= off_mac
+ 12;
8229 off_macpl
= off_mac
+ 14; /* Ethernet */
8230 off_nl
= 0; /* Ethernet II */
8231 off_nl_nosnap
= 3; /* 802.3+802.2 */
8235 /* Get all LLC-encapsulated packets */
8237 bpf_error("'llc' supported only on raw ATM");
8238 b1
= gen_atmfield_code(A_PROTOTYPE
, PT_LLC
, BPF_JEQ
, 0);
8249 * Filtering for MTP2 messages based on li value
8250 * FISU, length is null
8251 * LSSU, length is 1 or 2
8252 * MSU, length is 3 or more
8255 gen_mtp2type_abbrev(type
)
8258 struct block
*b0
, *b1
;
8263 if ( (linktype
!= DLT_MTP2
) &&
8264 (linktype
!= DLT_ERF
) &&
8265 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8266 bpf_error("'fisu' supported only on MTP2");
8267 /* gen_ncmp(offrel, offset, size, mask, jtype, reverse, value) */
8268 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JEQ
, 0, 0);
8272 if ( (linktype
!= DLT_MTP2
) &&
8273 (linktype
!= DLT_ERF
) &&
8274 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8275 bpf_error("'lssu' supported only on MTP2");
8276 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 1, 2);
8277 b1
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 0, 0);
8282 if ( (linktype
!= DLT_MTP2
) &&
8283 (linktype
!= DLT_ERF
) &&
8284 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8285 bpf_error("'msu' supported only on MTP2");
8286 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 0, 2);
8296 gen_mtp3field_code(mtp3field
, jvalue
, jtype
, reverse
)
8303 bpf_u_int32 val1
, val2
, val3
;
8305 switch (mtp3field
) {
8308 if (off_sio
== (u_int
)-1)
8309 bpf_error("'sio' supported only on SS7");
8310 /* sio coded on 1 byte so max value 255 */
8312 bpf_error("sio value %u too big; max value = 255",
8314 b0
= gen_ncmp(OR_PACKET
, off_sio
, BPF_B
, 0xffffffff,
8315 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8319 if (off_opc
== (u_int
)-1)
8320 bpf_error("'opc' supported only on SS7");
8321 /* opc coded on 14 bits so max value 16383 */
8323 bpf_error("opc value %u too big; max value = 16383",
8325 /* the following instructions are made to convert jvalue
8326 * to the form used to write opc in an ss7 message*/
8327 val1
= jvalue
& 0x00003c00;
8329 val2
= jvalue
& 0x000003fc;
8331 val3
= jvalue
& 0x00000003;
8333 jvalue
= val1
+ val2
+ val3
;
8334 b0
= gen_ncmp(OR_PACKET
, off_opc
, BPF_W
, 0x00c0ff0f,
8335 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8339 if (off_dpc
== (u_int
)-1)
8340 bpf_error("'dpc' supported only on SS7");
8341 /* dpc coded on 14 bits so max value 16383 */
8343 bpf_error("dpc value %u too big; max value = 16383",
8345 /* the following instructions are made to convert jvalue
8346 * to the forme used to write dpc in an ss7 message*/
8347 val1
= jvalue
& 0x000000ff;
8349 val2
= jvalue
& 0x00003f00;
8351 jvalue
= val1
+ val2
;
8352 b0
= gen_ncmp(OR_PACKET
, off_dpc
, BPF_W
, 0xff3f0000,
8353 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8357 if (off_sls
== (u_int
)-1)
8358 bpf_error("'sls' supported only on SS7");
8359 /* sls coded on 4 bits so max value 15 */
8361 bpf_error("sls value %u too big; max value = 15",
8363 /* the following instruction is made to convert jvalue
8364 * to the forme used to write sls in an ss7 message*/
8365 jvalue
= jvalue
<< 4;
8366 b0
= gen_ncmp(OR_PACKET
, off_sls
, BPF_B
, 0xf0,
8367 (u_int
)jtype
,reverse
, (u_int
)jvalue
);
8376 static struct block
*
8377 gen_msg_abbrev(type
)
8383 * Q.2931 signalling protocol messages for handling virtual circuits
8384 * establishment and teardown
8389 b1
= gen_atmfield_code(A_MSGTYPE
, SETUP
, BPF_JEQ
, 0);
8393 b1
= gen_atmfield_code(A_MSGTYPE
, CALL_PROCEED
, BPF_JEQ
, 0);
8397 b1
= gen_atmfield_code(A_MSGTYPE
, CONNECT
, BPF_JEQ
, 0);
8401 b1
= gen_atmfield_code(A_MSGTYPE
, CONNECT_ACK
, BPF_JEQ
, 0);
8405 b1
= gen_atmfield_code(A_MSGTYPE
, RELEASE
, BPF_JEQ
, 0);
8408 case A_RELEASE_DONE
:
8409 b1
= gen_atmfield_code(A_MSGTYPE
, RELEASE_DONE
, BPF_JEQ
, 0);
8419 gen_atmmulti_abbrev(type
)
8422 struct block
*b0
, *b1
;
8428 bpf_error("'oam' supported only on raw ATM");
8429 b1
= gen_atmmulti_abbrev(A_OAMF4
);
8434 bpf_error("'oamf4' supported only on raw ATM");
8436 b0
= gen_atmfield_code(A_VCI
, 3, BPF_JEQ
, 0);
8437 b1
= gen_atmfield_code(A_VCI
, 4, BPF_JEQ
, 0);
8439 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8445 * Get Q.2931 signalling messages for switched
8446 * virtual connection
8449 bpf_error("'connectmsg' supported only on raw ATM");
8450 b0
= gen_msg_abbrev(A_SETUP
);
8451 b1
= gen_msg_abbrev(A_CALLPROCEED
);
8453 b0
= gen_msg_abbrev(A_CONNECT
);
8455 b0
= gen_msg_abbrev(A_CONNECTACK
);
8457 b0
= gen_msg_abbrev(A_RELEASE
);
8459 b0
= gen_msg_abbrev(A_RELEASE_DONE
);
8461 b0
= gen_atmtype_abbrev(A_SC
);
8467 bpf_error("'metaconnect' supported only on raw ATM");
8468 b0
= gen_msg_abbrev(A_SETUP
);
8469 b1
= gen_msg_abbrev(A_CALLPROCEED
);
8471 b0
= gen_msg_abbrev(A_CONNECT
);
8473 b0
= gen_msg_abbrev(A_RELEASE
);
8475 b0
= gen_msg_abbrev(A_RELEASE_DONE
);
8477 b0
= gen_atmtype_abbrev(A_METAC
);