1 /*#define CHASE_CHAIN*/
3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
4 * The Regents of the University of California. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 static const char rcsid
[] _U_
=
24 "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.309 2008-12-23 20:13:29 guy Exp $ (LBL)";
32 #include <pcap-stdinc.h>
39 #ifdef HAVE_SYS_BITYPES_H
40 #include <sys/bitypes.h>
42 #include <sys/types.h>
43 #include <sys/socket.h>
47 * XXX - why was this included even on UNIX?
56 #include <sys/param.h>
59 #include <netinet/in.h>
60 #include <arpa/inet.h>
76 #include "ethertype.h"
80 #include "ieee80211.h"
82 #include "sunatmpos.h"
85 #include "pcap/ipnet.h"
87 #if defined(PF_PACKET) && defined(SO_ATTACH_FILTER)
88 #include <linux/types.h>
89 #include <linux/if_packet.h>
90 #include <linux/filter.h>
92 #ifdef HAVE_NET_PFVAR_H
93 #include <sys/socket.h>
95 #include <net/pfvar.h>
96 #include <net/if_pflog.h>
99 #define offsetof(s, e) ((size_t)&((s *)0)->e)
103 #include <netdb.h> /* for "struct addrinfo" */
106 #include <pcap/namedb.h>
108 #define ETHERMTU 1500
111 #define IPPROTO_SCTP 132
114 #ifdef HAVE_OS_PROTO_H
115 #include "os-proto.h"
118 #define JMP(c) ((c)|BPF_JMP|BPF_K)
121 static jmp_buf top_ctx
;
122 static pcap_t
*bpf_pcap
;
124 /* Hack for updating VLAN, MPLS, and PPPoE offsets. */
126 static u_int orig_linktype
= (u_int
)-1, orig_nl
= (u_int
)-1, label_stack_depth
= (u_int
)-1;
128 static u_int orig_linktype
= -1U, orig_nl
= -1U, label_stack_depth
= -1U;
133 static int pcap_fddipad
;
138 bpf_error(const char *fmt
, ...)
143 if (bpf_pcap
!= NULL
)
144 (void)vsnprintf(pcap_geterr(bpf_pcap
), PCAP_ERRBUF_SIZE
,
151 static void init_linktype(pcap_t
*);
153 static void init_regs(void);
154 static int alloc_reg(void);
155 static void free_reg(int);
157 static struct block
*root
;
160 * Value passed to gen_load_a() to indicate what the offset argument
164 OR_PACKET
, /* relative to the beginning of the packet */
165 OR_LINK
, /* relative to the beginning of the link-layer header */
166 OR_MACPL
, /* relative to the end of the MAC-layer header */
167 OR_NET
, /* relative to the network-layer header */
168 OR_NET_NOSNAP
, /* relative to the network-layer header, with no SNAP header at the link layer */
169 OR_TRAN_IPV4
, /* relative to the transport-layer header, with IPv4 network layer */
170 OR_TRAN_IPV6
/* relative to the transport-layer header, with IPv6 network layer */
175 * As errors are handled by a longjmp, anything allocated must be freed
176 * in the longjmp handler, so it must be reachable from that handler.
177 * One thing that's allocated is the result of pcap_nametoaddrinfo();
178 * it must be freed with freeaddrinfo(). This variable points to any
179 * addrinfo structure that would need to be freed.
181 static struct addrinfo
*ai
;
185 * We divy out chunks of memory rather than call malloc each time so
186 * we don't have to worry about leaking memory. It's probably
187 * not a big deal if all this memory was wasted but if this ever
188 * goes into a library that would probably not be a good idea.
190 * XXX - this *is* in a library....
193 #define CHUNK0SIZE 1024
199 static struct chunk chunks
[NCHUNKS
];
200 static int cur_chunk
;
202 static void *newchunk(u_int
);
203 static void freechunks(void);
204 static inline struct block
*new_block(int);
205 static inline struct slist
*new_stmt(int);
206 static struct block
*gen_retblk(int);
207 static inline void syntax(void);
209 static void backpatch(struct block
*, struct block
*);
210 static void merge(struct block
*, struct block
*);
211 static struct block
*gen_cmp(enum e_offrel
, u_int
, u_int
, bpf_int32
);
212 static struct block
*gen_cmp_gt(enum e_offrel
, u_int
, u_int
, bpf_int32
);
213 static struct block
*gen_cmp_ge(enum e_offrel
, u_int
, u_int
, bpf_int32
);
214 static struct block
*gen_cmp_lt(enum e_offrel
, u_int
, u_int
, bpf_int32
);
215 static struct block
*gen_cmp_le(enum e_offrel
, u_int
, u_int
, bpf_int32
);
216 static struct block
*gen_mcmp(enum e_offrel
, u_int
, u_int
, bpf_int32
,
218 static struct block
*gen_bcmp(enum e_offrel
, u_int
, u_int
, const u_char
*);
219 static struct block
*gen_ncmp(enum e_offrel
, bpf_u_int32
, bpf_u_int32
,
220 bpf_u_int32
, bpf_u_int32
, int, bpf_int32
);
221 static struct slist
*gen_load_llrel(u_int
, u_int
);
222 static struct slist
*gen_load_macplrel(u_int
, u_int
);
223 static struct slist
*gen_load_a(enum e_offrel
, u_int
, u_int
);
224 static struct slist
*gen_loadx_iphdrlen(void);
225 static struct block
*gen_uncond(int);
226 static inline struct block
*gen_true(void);
227 static inline struct block
*gen_false(void);
228 static struct block
*gen_ether_linktype(int);
229 static struct block
*gen_ipnet_linktype(int);
230 static struct block
*gen_linux_sll_linktype(int);
231 static struct slist
*gen_load_prism_llprefixlen(void);
232 static struct slist
*gen_load_avs_llprefixlen(void);
233 static struct slist
*gen_load_radiotap_llprefixlen(void);
234 static struct slist
*gen_load_ppi_llprefixlen(void);
235 static void insert_compute_vloffsets(struct block
*);
236 static struct slist
*gen_llprefixlen(void);
237 static struct slist
*gen_off_macpl(void);
238 static int ethertype_to_ppptype(int);
239 static struct block
*gen_linktype(int);
240 static struct block
*gen_snap(bpf_u_int32
, bpf_u_int32
);
241 static struct block
*gen_llc_linktype(int);
242 static struct block
*gen_hostop(bpf_u_int32
, bpf_u_int32
, int, int, u_int
, u_int
);
244 static struct block
*gen_hostop6(struct in6_addr
*, struct in6_addr
*, int, int, u_int
, u_int
);
246 static struct block
*gen_ahostop(const u_char
*, int);
247 static struct block
*gen_ehostop(const u_char
*, int);
248 static struct block
*gen_fhostop(const u_char
*, int);
249 static struct block
*gen_thostop(const u_char
*, int);
250 static struct block
*gen_wlanhostop(const u_char
*, int);
251 static struct block
*gen_ipfchostop(const u_char
*, int);
252 static struct block
*gen_dnhostop(bpf_u_int32
, int);
253 static struct block
*gen_mpls_linktype(int);
254 static struct block
*gen_host(bpf_u_int32
, bpf_u_int32
, int, int, int);
256 static struct block
*gen_host6(struct in6_addr
*, struct in6_addr
*, int, int, int);
259 static struct block
*gen_gateway(const u_char
*, bpf_u_int32
**, int, int);
261 static struct block
*gen_ipfrag(void);
262 static struct block
*gen_portatom(int, bpf_int32
);
263 static struct block
*gen_portrangeatom(int, bpf_int32
, bpf_int32
);
265 static struct block
*gen_portatom6(int, bpf_int32
);
266 static struct block
*gen_portrangeatom6(int, bpf_int32
, bpf_int32
);
268 struct block
*gen_portop(int, int, int);
269 static struct block
*gen_port(int, int, int);
270 struct block
*gen_portrangeop(int, int, int, int);
271 static struct block
*gen_portrange(int, int, int, int);
273 struct block
*gen_portop6(int, int, int);
274 static struct block
*gen_port6(int, int, int);
275 struct block
*gen_portrangeop6(int, int, int, int);
276 static struct block
*gen_portrange6(int, int, int, int);
278 static int lookup_proto(const char *, int);
279 static struct block
*gen_protochain(int, int, int);
280 static struct block
*gen_proto(int, int, int);
281 static struct slist
*xfer_to_x(struct arth
*);
282 static struct slist
*xfer_to_a(struct arth
*);
283 static struct block
*gen_mac_multicast(int);
284 static struct block
*gen_len(int, int);
285 static struct block
*gen_check_802_11_data_frame(void);
287 static struct block
*gen_ppi_dlt_check(void);
288 static struct block
*gen_msg_abbrev(int type
);
299 /* XXX Round up to nearest long. */
300 n
= (n
+ sizeof(long) - 1) & ~(sizeof(long) - 1);
302 /* XXX Round up to structure boundary. */
306 cp
= &chunks
[cur_chunk
];
307 if (n
> cp
->n_left
) {
308 ++cp
, k
= ++cur_chunk
;
310 bpf_error("out of memory");
311 size
= CHUNK0SIZE
<< k
;
312 cp
->m
= (void *)malloc(size
);
314 bpf_error("out of memory");
315 memset((char *)cp
->m
, 0, size
);
318 bpf_error("out of memory");
321 return (void *)((char *)cp
->m
+ cp
->n_left
);
330 for (i
= 0; i
< NCHUNKS
; ++i
)
331 if (chunks
[i
].m
!= NULL
) {
338 * A strdup whose allocations are freed after code generation is over.
342 register const char *s
;
344 int n
= strlen(s
) + 1;
345 char *cp
= newchunk(n
);
351 static inline struct block
*
357 p
= (struct block
*)newchunk(sizeof(*p
));
364 static inline struct slist
*
370 p
= (struct slist
*)newchunk(sizeof(*p
));
376 static struct block
*
380 struct block
*b
= new_block(BPF_RET
|BPF_K
);
389 bpf_error("syntax error in filter expression");
392 static bpf_u_int32 netmask
;
397 pcap_compile_unsafe(pcap_t
*p
, struct bpf_program
*program
,
398 const char *buf
, int optimize
, bpf_u_int32 mask
);
401 pcap_compile(pcap_t
*p
, struct bpf_program
*program
,
402 const char *buf
, int optimize
, bpf_u_int32 mask
)
406 EnterCriticalSection(&g_PcapCompileCriticalSection
);
408 result
= pcap_compile_unsafe(p
, program
, buf
, optimize
, mask
);
410 LeaveCriticalSection(&g_PcapCompileCriticalSection
);
416 pcap_compile_unsafe(pcap_t
*p
, struct bpf_program
*program
,
417 const char *buf
, int optimize
, bpf_u_int32 mask
)
420 pcap_compile(pcap_t
*p
, struct bpf_program
*program
,
421 const char *buf
, int optimize
, bpf_u_int32 mask
)
425 const char * volatile xbuf
= buf
;
431 - We are on an remote capture
432 - we do not want to capture RPCAP traffic
434 If so, we have to save the current filter, because we have to add some
437 if ( (p
->rmt_clientside
) && (p
->rmt_flags
& PCAP_OPENFLAG_NOCAPTURE_RPCAP
) )
441 if (p
->currentfilter
)
442 free (p
->currentfilter
);
445 bufferlen
= strlen(buf
) + 1;
449 p
->currentfilter
= (char *) malloc( sizeof(char) * bufferlen
);
451 strncpy(p
->currentfilter
, buf
, bufferlen
);
453 p
->currentfilter
[bufferlen
- 1]= 0;
455 #endif /* HAVE_REMOTE */
462 if (setjmp(top_ctx
)) {
476 snaplen
= pcap_snapshot(p
);
478 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
479 "snaplen of 0 rejects all packets");
483 lex_init(xbuf
? xbuf
: "");
491 root
= gen_retblk(snaplen
);
493 if (optimize
&& !no_optimize
) {
496 (root
->s
.code
== (BPF_RET
|BPF_K
) && root
->s
.k
== 0))
497 bpf_error("expression rejects all packets");
499 program
->bf_insns
= icode_to_fcode(root
, &len
);
500 program
->bf_len
= len
;
508 * entry point for using the compiler with no pcap open
509 * pass in all the stuff that is needed explicitly instead.
512 pcap_compile_nopcap(int snaplen_arg
, int linktype_arg
,
513 struct bpf_program
*program
,
514 const char *buf
, int optimize
, bpf_u_int32 mask
)
519 p
= pcap_open_dead(linktype_arg
, snaplen_arg
);
522 ret
= pcap_compile(p
, program
, buf
, optimize
, mask
);
528 * Clean up a "struct bpf_program" by freeing all the memory allocated
532 pcap_freecode(struct bpf_program
*program
)
535 if (program
->bf_insns
!= NULL
) {
536 free((char *)program
->bf_insns
);
537 program
->bf_insns
= NULL
;
542 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
543 * which of the jt and jf fields has been resolved and which is a pointer
544 * back to another unresolved block (or nil). At least one of the fields
545 * in each block is already resolved.
548 backpatch(list
, target
)
549 struct block
*list
, *target
;
566 * Merge the lists in b0 and b1, using the 'sense' field to indicate
567 * which of jt and jf is the link.
571 struct block
*b0
, *b1
;
573 register struct block
**p
= &b0
;
575 /* Find end of list. */
577 p
= !((*p
)->sense
) ? &JT(*p
) : &JF(*p
);
579 /* Concatenate the lists. */
587 struct block
*ppi_dlt_check
;
590 * Insert before the statements of the first (root) block any
591 * statements needed to load the lengths of any variable-length
592 * headers into registers.
594 * XXX - a fancier strategy would be to insert those before the
595 * statements of all blocks that use those lengths and that
596 * have no predecessors that use them, so that we only compute
597 * the lengths if we need them. There might be even better
598 * approaches than that.
600 * However, those strategies would be more complicated, and
601 * as we don't generate code to compute a length if the
602 * program has no tests that use the length, and as most
603 * tests will probably use those lengths, we would just
604 * postpone computing the lengths so that it's not done
605 * for tests that fail early, and it's not clear that's
608 insert_compute_vloffsets(p
->head
);
611 * For DLT_PPI captures, generate a check of the per-packet
612 * DLT value to make sure it's DLT_IEEE802_11.
614 ppi_dlt_check
= gen_ppi_dlt_check();
615 if (ppi_dlt_check
!= NULL
)
616 gen_and(ppi_dlt_check
, p
);
618 backpatch(p
, gen_retblk(snaplen
));
619 p
->sense
= !p
->sense
;
620 backpatch(p
, gen_retblk(0));
626 struct block
*b0
, *b1
;
628 backpatch(b0
, b1
->head
);
629 b0
->sense
= !b0
->sense
;
630 b1
->sense
= !b1
->sense
;
632 b1
->sense
= !b1
->sense
;
638 struct block
*b0
, *b1
;
640 b0
->sense
= !b0
->sense
;
641 backpatch(b0
, b1
->head
);
642 b0
->sense
= !b0
->sense
;
651 b
->sense
= !b
->sense
;
654 static struct block
*
655 gen_cmp(offrel
, offset
, size
, v
)
656 enum e_offrel offrel
;
660 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JEQ
, 0, v
);
663 static struct block
*
664 gen_cmp_gt(offrel
, offset
, size
, v
)
665 enum e_offrel offrel
;
669 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGT
, 0, v
);
672 static struct block
*
673 gen_cmp_ge(offrel
, offset
, size
, v
)
674 enum e_offrel offrel
;
678 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGE
, 0, v
);
681 static struct block
*
682 gen_cmp_lt(offrel
, offset
, size
, v
)
683 enum e_offrel offrel
;
687 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGE
, 1, v
);
690 static struct block
*
691 gen_cmp_le(offrel
, offset
, size
, v
)
692 enum e_offrel offrel
;
696 return gen_ncmp(offrel
, offset
, size
, 0xffffffff, BPF_JGT
, 1, v
);
699 static struct block
*
700 gen_mcmp(offrel
, offset
, size
, v
, mask
)
701 enum e_offrel offrel
;
706 return gen_ncmp(offrel
, offset
, size
, mask
, BPF_JEQ
, 0, v
);
709 static struct block
*
710 gen_bcmp(offrel
, offset
, size
, v
)
711 enum e_offrel offrel
;
712 register u_int offset
, size
;
713 register const u_char
*v
;
715 register struct block
*b
, *tmp
;
719 register const u_char
*p
= &v
[size
- 4];
720 bpf_int32 w
= ((bpf_int32
)p
[0] << 24) |
721 ((bpf_int32
)p
[1] << 16) | ((bpf_int32
)p
[2] << 8) | p
[3];
723 tmp
= gen_cmp(offrel
, offset
+ size
- 4, BPF_W
, w
);
730 register const u_char
*p
= &v
[size
- 2];
731 bpf_int32 w
= ((bpf_int32
)p
[0] << 8) | p
[1];
733 tmp
= gen_cmp(offrel
, offset
+ size
- 2, BPF_H
, w
);
740 tmp
= gen_cmp(offrel
, offset
, BPF_B
, (bpf_int32
)v
[0]);
749 * AND the field of size "size" at offset "offset" relative to the header
750 * specified by "offrel" with "mask", and compare it with the value "v"
751 * with the test specified by "jtype"; if "reverse" is true, the test
752 * should test the opposite of "jtype".
754 static struct block
*
755 gen_ncmp(offrel
, offset
, size
, mask
, jtype
, reverse
, v
)
756 enum e_offrel offrel
;
758 bpf_u_int32 offset
, size
, mask
, jtype
;
761 struct slist
*s
, *s2
;
764 s
= gen_load_a(offrel
, offset
, size
);
766 if (mask
!= 0xffffffff) {
767 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
772 b
= new_block(JMP(jtype
));
775 if (reverse
&& (jtype
== BPF_JGT
|| jtype
== BPF_JGE
))
781 * Various code constructs need to know the layout of the data link
782 * layer. These variables give the necessary offsets from the beginning
783 * of the packet data.
787 * This is the offset of the beginning of the link-layer header from
788 * the beginning of the raw packet data.
790 * It's usually 0, except for 802.11 with a fixed-length radio header.
791 * (For 802.11 with a variable-length radio header, we have to generate
792 * code to compute that offset; off_ll is 0 in that case.)
797 * If there's a variable-length header preceding the link-layer header,
798 * "reg_off_ll" is the register number for a register containing the
799 * length of that header, and therefore the offset of the link-layer
800 * header from the beginning of the raw packet data. Otherwise,
801 * "reg_off_ll" is -1.
803 static int reg_off_ll
;
806 * This is the offset of the beginning of the MAC-layer header from
807 * the beginning of the link-layer header.
808 * It's usually 0, except for ATM LANE, where it's the offset, relative
809 * to the beginning of the raw packet data, of the Ethernet header, and
810 * for Ethernet with various additional information.
812 static u_int off_mac
;
815 * This is the offset of the beginning of the MAC-layer payload,
816 * from the beginning of the raw packet data.
818 * I.e., it's the sum of the length of the link-layer header (without,
819 * for example, any 802.2 LLC header, so it's the MAC-layer
820 * portion of that header), plus any prefix preceding the
823 static u_int off_macpl
;
826 * This is 1 if the offset of the beginning of the MAC-layer payload
827 * from the beginning of the link-layer header is variable-length.
829 static int off_macpl_is_variable
;
832 * If the link layer has variable_length headers, "reg_off_macpl"
833 * is the register number for a register containing the length of the
834 * link-layer header plus the length of any variable-length header
835 * preceding the link-layer header. Otherwise, "reg_off_macpl"
838 static int reg_off_macpl
;
841 * "off_linktype" is the offset to information in the link-layer header
842 * giving the packet type. This offset is relative to the beginning
843 * of the link-layer header (i.e., it doesn't include off_ll).
845 * For Ethernet, it's the offset of the Ethernet type field.
847 * For link-layer types that always use 802.2 headers, it's the
848 * offset of the LLC header.
850 * For PPP, it's the offset of the PPP type field.
852 * For Cisco HDLC, it's the offset of the CHDLC type field.
854 * For BSD loopback, it's the offset of the AF_ value.
856 * For Linux cooked sockets, it's the offset of the type field.
858 * It's set to -1 for no encapsulation, in which case, IP is assumed.
860 static u_int off_linktype
;
863 * TRUE if "pppoes" appeared in the filter; it causes link-layer type
864 * checks to check the PPP header, assumed to follow a LAN-style link-
865 * layer header and a PPPoE session header.
867 static int is_pppoes
= 0;
870 * TRUE if the link layer includes an ATM pseudo-header.
872 static int is_atm
= 0;
875 * TRUE if "lane" appeared in the filter; it causes us to generate
876 * code that assumes LANE rather than LLC-encapsulated traffic in SunATM.
878 static int is_lane
= 0;
881 * These are offsets for the ATM pseudo-header.
883 static u_int off_vpi
;
884 static u_int off_vci
;
885 static u_int off_proto
;
888 * These are offsets for the MTP2 fields.
893 * These are offsets for the MTP3 fields.
895 static u_int off_sio
;
896 static u_int off_opc
;
897 static u_int off_dpc
;
898 static u_int off_sls
;
901 * This is the offset of the first byte after the ATM pseudo_header,
902 * or -1 if there is no ATM pseudo-header.
904 static u_int off_payload
;
907 * These are offsets to the beginning of the network-layer header.
908 * They are relative to the beginning of the MAC-layer payload (i.e.,
909 * they don't include off_ll or off_macpl).
911 * If the link layer never uses 802.2 LLC:
913 * "off_nl" and "off_nl_nosnap" are the same.
915 * If the link layer always uses 802.2 LLC:
917 * "off_nl" is the offset if there's a SNAP header following
920 * "off_nl_nosnap" is the offset if there's no SNAP header.
922 * If the link layer is Ethernet:
924 * "off_nl" is the offset if the packet is an Ethernet II packet
925 * (we assume no 802.3+802.2+SNAP);
927 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet
928 * with an 802.2 header following it.
931 static u_int off_nl_nosnap
;
939 linktype
= pcap_datalink(p
);
941 pcap_fddipad
= p
->fddipad
;
945 * Assume it's not raw ATM with a pseudo-header, for now.
956 * And that we're not doing PPPoE.
961 * And assume we're not doing SS7.
970 * Also assume it's not 802.11.
974 off_macpl_is_variable
= 0;
978 label_stack_depth
= 0;
988 off_nl
= 0; /* XXX in reality, variable! */
989 off_nl_nosnap
= 0; /* no 802.2 LLC */
992 case DLT_ARCNET_LINUX
:
995 off_nl
= 0; /* XXX in reality, variable! */
996 off_nl_nosnap
= 0; /* no 802.2 LLC */
1001 off_macpl
= 14; /* Ethernet header length */
1002 off_nl
= 0; /* Ethernet II */
1003 off_nl_nosnap
= 3; /* 802.3+802.2 */
1008 * SLIP doesn't have a link level type. The 16 byte
1009 * header is hacked into our SLIP driver.
1014 off_nl_nosnap
= 0; /* no 802.2 LLC */
1017 case DLT_SLIP_BSDOS
:
1018 /* XXX this may be the same as the DLT_PPP_BSDOS case */
1023 off_nl_nosnap
= 0; /* no 802.2 LLC */
1031 off_nl_nosnap
= 0; /* no 802.2 LLC */
1038 off_nl_nosnap
= 0; /* no 802.2 LLC */
1043 case DLT_C_HDLC
: /* BSD/OS Cisco HDLC */
1044 case DLT_PPP_SERIAL
: /* NetBSD sync/async serial PPP */
1048 off_nl_nosnap
= 0; /* no 802.2 LLC */
1053 * This does no include the Ethernet header, and
1054 * only covers session state.
1059 off_nl_nosnap
= 0; /* no 802.2 LLC */
1066 off_nl_nosnap
= 0; /* no 802.2 LLC */
1071 * FDDI doesn't really have a link-level type field.
1072 * We set "off_linktype" to the offset of the LLC header.
1074 * To check for Ethernet types, we assume that SSAP = SNAP
1075 * is being used and pick out the encapsulated Ethernet type.
1076 * XXX - should we generate code to check for SNAP?
1080 off_linktype
+= pcap_fddipad
;
1082 off_macpl
= 13; /* FDDI MAC header length */
1084 off_macpl
+= pcap_fddipad
;
1086 off_nl
= 8; /* 802.2+SNAP */
1087 off_nl_nosnap
= 3; /* 802.2 */
1092 * Token Ring doesn't really have a link-level type field.
1093 * We set "off_linktype" to the offset of the LLC header.
1095 * To check for Ethernet types, we assume that SSAP = SNAP
1096 * is being used and pick out the encapsulated Ethernet type.
1097 * XXX - should we generate code to check for SNAP?
1099 * XXX - the header is actually variable-length.
1100 * Some various Linux patched versions gave 38
1101 * as "off_linktype" and 40 as "off_nl"; however,
1102 * if a token ring packet has *no* routing
1103 * information, i.e. is not source-routed, the correct
1104 * values are 20 and 22, as they are in the vanilla code.
1106 * A packet is source-routed iff the uppermost bit
1107 * of the first byte of the source address, at an
1108 * offset of 8, has the uppermost bit set. If the
1109 * packet is source-routed, the total number of bytes
1110 * of routing information is 2 plus bits 0x1F00 of
1111 * the 16-bit value at an offset of 14 (shifted right
1112 * 8 - figure out which byte that is).
1115 off_macpl
= 14; /* Token Ring MAC header length */
1116 off_nl
= 8; /* 802.2+SNAP */
1117 off_nl_nosnap
= 3; /* 802.2 */
1120 case DLT_IEEE802_11
:
1121 case DLT_PRISM_HEADER
:
1122 case DLT_IEEE802_11_RADIO_AVS
:
1123 case DLT_IEEE802_11_RADIO
:
1125 * 802.11 doesn't really have a link-level type field.
1126 * We set "off_linktype" to the offset of the LLC header.
1128 * To check for Ethernet types, we assume that SSAP = SNAP
1129 * is being used and pick out the encapsulated Ethernet type.
1130 * XXX - should we generate code to check for SNAP?
1132 * We also handle variable-length radio headers here.
1133 * The Prism header is in theory variable-length, but in
1134 * practice it's always 144 bytes long. However, some
1135 * drivers on Linux use ARPHRD_IEEE80211_PRISM, but
1136 * sometimes or always supply an AVS header, so we
1137 * have to check whether the radio header is a Prism
1138 * header or an AVS header, so, in practice, it's
1142 off_macpl
= 0; /* link-layer header is variable-length */
1143 off_macpl_is_variable
= 1;
1144 off_nl
= 8; /* 802.2+SNAP */
1145 off_nl_nosnap
= 3; /* 802.2 */
1150 * At the moment we treat PPI the same way that we treat
1151 * normal Radiotap encoded packets. The difference is in
1152 * the function that generates the code at the beginning
1153 * to compute the header length. Since this code generator
1154 * of PPI supports bare 802.11 encapsulation only (i.e.
1155 * the encapsulated DLT should be DLT_IEEE802_11) we
1156 * generate code to check for this too.
1159 off_macpl
= 0; /* link-layer header is variable-length */
1160 off_macpl_is_variable
= 1;
1161 off_nl
= 8; /* 802.2+SNAP */
1162 off_nl_nosnap
= 3; /* 802.2 */
1165 case DLT_ATM_RFC1483
:
1166 case DLT_ATM_CLIP
: /* Linux ATM defines this */
1168 * assume routed, non-ISO PDUs
1169 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
1171 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS,
1172 * or PPP with the PPP NLPID (e.g., PPPoA)? The
1173 * latter would presumably be treated the way PPPoE
1174 * should be, so you can do "pppoe and udp port 2049"
1175 * or "pppoa and tcp port 80" and have it check for
1176 * PPPo{A,E} and a PPP protocol of IP and....
1179 off_macpl
= 0; /* packet begins with LLC header */
1180 off_nl
= 8; /* 802.2+SNAP */
1181 off_nl_nosnap
= 3; /* 802.2 */
1186 * Full Frontal ATM; you get AALn PDUs with an ATM
1190 off_vpi
= SUNATM_VPI_POS
;
1191 off_vci
= SUNATM_VCI_POS
;
1192 off_proto
= PROTO_POS
;
1193 off_mac
= -1; /* assume LLC-encapsulated, so no MAC-layer header */
1194 off_payload
= SUNATM_PKT_BEGIN_POS
;
1195 off_linktype
= off_payload
;
1196 off_macpl
= off_payload
; /* if LLC-encapsulated */
1197 off_nl
= 8; /* 802.2+SNAP */
1198 off_nl_nosnap
= 3; /* 802.2 */
1207 off_nl_nosnap
= 0; /* no 802.2 LLC */
1210 case DLT_LINUX_SLL
: /* fake header for Linux cooked socket */
1214 off_nl_nosnap
= 0; /* no 802.2 LLC */
1219 * LocalTalk does have a 1-byte type field in the LLAP header,
1220 * but really it just indicates whether there is a "short" or
1221 * "long" DDP packet following.
1226 off_nl_nosnap
= 0; /* no 802.2 LLC */
1229 case DLT_IP_OVER_FC
:
1231 * RFC 2625 IP-over-Fibre-Channel doesn't really have a
1232 * link-level type field. We set "off_linktype" to the
1233 * offset of the LLC header.
1235 * To check for Ethernet types, we assume that SSAP = SNAP
1236 * is being used and pick out the encapsulated Ethernet type.
1237 * XXX - should we generate code to check for SNAP? RFC
1238 * 2625 says SNAP should be used.
1242 off_nl
= 8; /* 802.2+SNAP */
1243 off_nl_nosnap
= 3; /* 802.2 */
1248 * XXX - we should set this to handle SNAP-encapsulated
1249 * frames (NLPID of 0x80).
1254 off_nl_nosnap
= 0; /* no 802.2 LLC */
1258 * the only BPF-interesting FRF.16 frames are non-control frames;
1259 * Frame Relay has a variable length link-layer
1260 * so lets start with offset 4 for now and increments later on (FIXME);
1266 off_nl_nosnap
= 0; /* XXX - for now -> no 802.2 LLC */
1269 case DLT_APPLE_IP_OVER_IEEE1394
:
1273 off_nl_nosnap
= 0; /* no 802.2 LLC */
1276 case DLT_SYMANTEC_FIREWALL
:
1279 off_nl
= 0; /* Ethernet II */
1280 off_nl_nosnap
= 0; /* XXX - what does it do with 802.3 packets? */
1283 #ifdef HAVE_NET_PFVAR_H
1286 off_macpl
= PFLOG_HDRLEN
;
1288 off_nl_nosnap
= 0; /* no 802.2 LLC */
1292 case DLT_JUNIPER_MFR
:
1293 case DLT_JUNIPER_MLFR
:
1294 case DLT_JUNIPER_MLPPP
:
1295 case DLT_JUNIPER_PPP
:
1296 case DLT_JUNIPER_CHDLC
:
1297 case DLT_JUNIPER_FRELAY
:
1301 off_nl_nosnap
= -1; /* no 802.2 LLC */
1304 case DLT_JUNIPER_ATM1
:
1305 off_linktype
= 4; /* in reality variable between 4-8 */
1306 off_macpl
= 4; /* in reality variable between 4-8 */
1311 case DLT_JUNIPER_ATM2
:
1312 off_linktype
= 8; /* in reality variable between 8-12 */
1313 off_macpl
= 8; /* in reality variable between 8-12 */
1318 /* frames captured on a Juniper PPPoE service PIC
1319 * contain raw ethernet frames */
1320 case DLT_JUNIPER_PPPOE
:
1321 case DLT_JUNIPER_ETHER
:
1324 off_nl
= 18; /* Ethernet II */
1325 off_nl_nosnap
= 21; /* 802.3+802.2 */
1328 case DLT_JUNIPER_PPPOE_ATM
:
1332 off_nl_nosnap
= -1; /* no 802.2 LLC */
1335 case DLT_JUNIPER_GGSN
:
1339 off_nl_nosnap
= -1; /* no 802.2 LLC */
1342 case DLT_JUNIPER_ES
:
1344 off_macpl
= -1; /* not really a network layer but raw IP addresses */
1345 off_nl
= -1; /* not really a network layer but raw IP addresses */
1346 off_nl_nosnap
= -1; /* no 802.2 LLC */
1349 case DLT_JUNIPER_MONITOR
:
1352 off_nl
= 0; /* raw IP/IP6 header */
1353 off_nl_nosnap
= -1; /* no 802.2 LLC */
1356 case DLT_JUNIPER_SERVICES
:
1358 off_macpl
= -1; /* L3 proto location dep. on cookie type */
1359 off_nl
= -1; /* L3 proto location dep. on cookie type */
1360 off_nl_nosnap
= -1; /* no 802.2 LLC */
1363 case DLT_JUNIPER_VP
:
1370 case DLT_JUNIPER_ST
:
1377 case DLT_JUNIPER_ISM
:
1384 case DLT_JUNIPER_VS
:
1385 case DLT_JUNIPER_SRX_E2E
:
1386 case DLT_JUNIPER_FIBRECHANNEL
:
1387 case DLT_JUNIPER_ATM_CEMIC
:
1406 case DLT_MTP2_WITH_PHDR
:
1439 * Currently, only raw "link[N:M]" filtering is supported.
1441 off_linktype
= -1; /* variable, min 15, max 71 steps of 7 */
1443 off_nl
= -1; /* variable, min 16, max 71 steps of 7 */
1444 off_nl_nosnap
= -1; /* no 802.2 LLC */
1445 off_mac
= 1; /* step over the kiss length byte */
1450 off_macpl
= 24; /* ipnet header length */
1455 case DLT_NETANALYZER
:
1456 off_mac
= 4; /* MAC header is past 4-byte pseudo-header */
1457 off_linktype
= 16; /* includes 4-byte pseudo-header */
1458 off_macpl
= 18; /* pseudo-header+Ethernet header length */
1459 off_nl
= 0; /* Ethernet II */
1460 off_nl_nosnap
= 3; /* 802.3+802.2 */
1463 case DLT_NETANALYZER_TRANSPARENT
:
1464 off_mac
= 12; /* MAC header is past 4-byte pseudo-header, preamble, and SFD */
1465 off_linktype
= 24; /* includes 4-byte pseudo-header+preamble+SFD */
1466 off_macpl
= 26; /* pseudo-header+preamble+SFD+Ethernet header length */
1467 off_nl
= 0; /* Ethernet II */
1468 off_nl_nosnap
= 3; /* 802.3+802.2 */
1473 * For values in the range in which we've assigned new
1474 * DLT_ values, only raw "link[N:M]" filtering is supported.
1476 if (linktype
>= DLT_MATCHING_MIN
&&
1477 linktype
<= DLT_MATCHING_MAX
) {
1486 bpf_error("unknown data link type %d", linktype
);
1491 * Load a value relative to the beginning of the link-layer header.
1492 * The link-layer header doesn't necessarily begin at the beginning
1493 * of the packet data; there might be a variable-length prefix containing
1494 * radio information.
1496 static struct slist
*
1497 gen_load_llrel(offset
, size
)
1500 struct slist
*s
, *s2
;
1502 s
= gen_llprefixlen();
1505 * If "s" is non-null, it has code to arrange that the X register
1506 * contains the length of the prefix preceding the link-layer
1509 * Otherwise, the length of the prefix preceding the link-layer
1510 * header is "off_ll".
1514 * There's a variable-length prefix preceding the
1515 * link-layer header. "s" points to a list of statements
1516 * that put the length of that prefix into the X register.
1517 * do an indirect load, to use the X register as an offset.
1519 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1524 * There is no variable-length header preceding the
1525 * link-layer header; add in off_ll, which, if there's
1526 * a fixed-length header preceding the link-layer header,
1527 * is the length of that header.
1529 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1530 s
->s
.k
= offset
+ off_ll
;
1536 * Load a value relative to the beginning of the MAC-layer payload.
1538 static struct slist
*
1539 gen_load_macplrel(offset
, size
)
1542 struct slist
*s
, *s2
;
1544 s
= gen_off_macpl();
1547 * If s is non-null, the offset of the MAC-layer payload is
1548 * variable, and s points to a list of instructions that
1549 * arrange that the X register contains that offset.
1551 * Otherwise, the offset of the MAC-layer payload is constant,
1552 * and is in off_macpl.
1556 * The offset of the MAC-layer payload is in the X
1557 * register. Do an indirect load, to use the X register
1560 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1565 * The offset of the MAC-layer payload is constant,
1566 * and is in off_macpl; load the value at that offset
1567 * plus the specified offset.
1569 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1570 s
->s
.k
= off_macpl
+ offset
;
1576 * Load a value relative to the beginning of the specified header.
1578 static struct slist
*
1579 gen_load_a(offrel
, offset
, size
)
1580 enum e_offrel offrel
;
1583 struct slist
*s
, *s2
;
1588 s
= new_stmt(BPF_LD
|BPF_ABS
|size
);
1593 s
= gen_load_llrel(offset
, size
);
1597 s
= gen_load_macplrel(offset
, size
);
1601 s
= gen_load_macplrel(off_nl
+ offset
, size
);
1605 s
= gen_load_macplrel(off_nl_nosnap
+ offset
, size
);
1610 * Load the X register with the length of the IPv4 header
1611 * (plus the offset of the link-layer header, if it's
1612 * preceded by a variable-length header such as a radio
1613 * header), in bytes.
1615 s
= gen_loadx_iphdrlen();
1618 * Load the item at {offset of the MAC-layer payload} +
1619 * {offset, relative to the start of the MAC-layer
1620 * paylod, of the IPv4 header} + {length of the IPv4 header} +
1621 * {specified offset}.
1623 * (If the offset of the MAC-layer payload is variable,
1624 * it's included in the value in the X register, and
1627 s2
= new_stmt(BPF_LD
|BPF_IND
|size
);
1628 s2
->s
.k
= off_macpl
+ off_nl
+ offset
;
1633 s
= gen_load_macplrel(off_nl
+ 40 + offset
, size
);
1644 * Generate code to load into the X register the sum of the length of
1645 * the IPv4 header and any variable-length header preceding the link-layer
1648 static struct slist
*
1649 gen_loadx_iphdrlen()
1651 struct slist
*s
, *s2
;
1653 s
= gen_off_macpl();
1656 * There's a variable-length prefix preceding the
1657 * link-layer header, or the link-layer header is itself
1658 * variable-length. "s" points to a list of statements
1659 * that put the offset of the MAC-layer payload into
1662 * The 4*([k]&0xf) addressing mode can't be used, as we
1663 * don't have a constant offset, so we have to load the
1664 * value in question into the A register and add to it
1665 * the value from the X register.
1667 s2
= new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
1670 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
1673 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
1678 * The A register now contains the length of the
1679 * IP header. We need to add to it the offset of
1680 * the MAC-layer payload, which is still in the X
1681 * register, and move the result into the X register.
1683 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
1684 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
1687 * There is no variable-length header preceding the
1688 * link-layer header, and the link-layer header is
1689 * fixed-length; load the length of the IPv4 header,
1690 * which is at an offset of off_nl from the beginning
1691 * of the MAC-layer payload, and thus at an offset
1692 * of off_mac_pl + off_nl from the beginning of the
1695 s
= new_stmt(BPF_LDX
|BPF_MSH
|BPF_B
);
1696 s
->s
.k
= off_macpl
+ off_nl
;
1701 static struct block
*
1708 s
= new_stmt(BPF_LD
|BPF_IMM
);
1710 b
= new_block(JMP(BPF_JEQ
));
1716 static inline struct block
*
1719 return gen_uncond(1);
1722 static inline struct block
*
1725 return gen_uncond(0);
1729 * Byte-swap a 32-bit number.
1730 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
1731 * big-endian platforms.)
1733 #define SWAPLONG(y) \
1734 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))
1737 * Generate code to match a particular packet type.
1739 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1740 * value, if <= ETHERMTU. We use that to determine whether to
1741 * match the type/length field or to check the type/length field for
1742 * a value <= ETHERMTU to see whether it's a type field and then do
1743 * the appropriate test.
1745 static struct block
*
1746 gen_ether_linktype(proto
)
1749 struct block
*b0
, *b1
;
1755 case LLCSAP_NETBEUI
:
1757 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1758 * so we check the DSAP and SSAP.
1760 * LLCSAP_IP checks for IP-over-802.2, rather
1761 * than IP-over-Ethernet or IP-over-SNAP.
1763 * XXX - should we check both the DSAP and the
1764 * SSAP, like this, or should we check just the
1765 * DSAP, as we do for other types <= ETHERMTU
1766 * (i.e., other SAP values)?
1768 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1770 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)
1771 ((proto
<< 8) | proto
));
1779 * Ethernet_II frames, which are Ethernet
1780 * frames with a frame type of ETHERTYPE_IPX;
1782 * Ethernet_802.3 frames, which are 802.3
1783 * frames (i.e., the type/length field is
1784 * a length field, <= ETHERMTU, rather than
1785 * a type field) with the first two bytes
1786 * after the Ethernet/802.3 header being
1789 * Ethernet_802.2 frames, which are 802.3
1790 * frames with an 802.2 LLC header and
1791 * with the IPX LSAP as the DSAP in the LLC
1794 * Ethernet_SNAP frames, which are 802.3
1795 * frames with an LLC header and a SNAP
1796 * header and with an OUI of 0x000000
1797 * (encapsulated Ethernet) and a protocol
1798 * ID of ETHERTYPE_IPX in the SNAP header.
1800 * XXX - should we generate the same code both
1801 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
1805 * This generates code to check both for the
1806 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
1808 b0
= gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)LLCSAP_IPX
);
1809 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)0xFFFF);
1813 * Now we add code to check for SNAP frames with
1814 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
1816 b0
= gen_snap(0x000000, ETHERTYPE_IPX
);
1820 * Now we generate code to check for 802.3
1821 * frames in general.
1823 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1827 * Now add the check for 802.3 frames before the
1828 * check for Ethernet_802.2 and Ethernet_802.3,
1829 * as those checks should only be done on 802.3
1830 * frames, not on Ethernet frames.
1835 * Now add the check for Ethernet_II frames, and
1836 * do that before checking for the other frame
1839 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
1840 (bpf_int32
)ETHERTYPE_IPX
);
1844 case ETHERTYPE_ATALK
:
1845 case ETHERTYPE_AARP
:
1847 * EtherTalk (AppleTalk protocols on Ethernet link
1848 * layer) may use 802.2 encapsulation.
1852 * Check for 802.2 encapsulation (EtherTalk phase 2?);
1853 * we check for an Ethernet type field less than
1854 * 1500, which means it's an 802.3 length field.
1856 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1860 * 802.2-encapsulated ETHERTYPE_ATALK packets are
1861 * SNAP packets with an organization code of
1862 * 0x080007 (Apple, for Appletalk) and a protocol
1863 * type of ETHERTYPE_ATALK (Appletalk).
1865 * 802.2-encapsulated ETHERTYPE_AARP packets are
1866 * SNAP packets with an organization code of
1867 * 0x000000 (encapsulated Ethernet) and a protocol
1868 * type of ETHERTYPE_AARP (Appletalk ARP).
1870 if (proto
== ETHERTYPE_ATALK
)
1871 b1
= gen_snap(0x080007, ETHERTYPE_ATALK
);
1872 else /* proto == ETHERTYPE_AARP */
1873 b1
= gen_snap(0x000000, ETHERTYPE_AARP
);
1877 * Check for Ethernet encapsulation (Ethertalk
1878 * phase 1?); we just check for the Ethernet
1881 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
1887 if (proto
<= ETHERMTU
) {
1889 * This is an LLC SAP value, so the frames
1890 * that match would be 802.2 frames.
1891 * Check that the frame is an 802.2 frame
1892 * (i.e., that the length/type field is
1893 * a length field, <= ETHERMTU) and
1894 * then check the DSAP.
1896 b0
= gen_cmp_gt(OR_LINK
, off_linktype
, BPF_H
, ETHERMTU
);
1898 b1
= gen_cmp(OR_LINK
, off_linktype
+ 2, BPF_B
,
1904 * This is an Ethernet type, so compare
1905 * the length/type field with it (if
1906 * the frame is an 802.2 frame, the length
1907 * field will be <= ETHERMTU, and, as
1908 * "proto" is > ETHERMTU, this test
1909 * will fail and the frame won't match,
1910 * which is what we want).
1912 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
1919 * "proto" is an Ethernet type value and for IPNET, if it is not IPv4
1920 * or IPv6 then we have an error.
1922 static struct block
*
1923 gen_ipnet_linktype(proto
)
1929 return gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
1930 (bpf_int32
)IPH_AF_INET
);
1933 case ETHERTYPE_IPV6
:
1934 return gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
1935 (bpf_int32
)IPH_AF_INET6
);
1946 * Generate code to match a particular packet type.
1948 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1949 * value, if <= ETHERMTU. We use that to determine whether to
1950 * match the type field or to check the type field for the special
1951 * LINUX_SLL_P_802_2 value and then do the appropriate test.
1953 static struct block
*
1954 gen_linux_sll_linktype(proto
)
1957 struct block
*b0
, *b1
;
1963 case LLCSAP_NETBEUI
:
1965 * OSI protocols and NetBEUI always use 802.2 encapsulation,
1966 * so we check the DSAP and SSAP.
1968 * LLCSAP_IP checks for IP-over-802.2, rather
1969 * than IP-over-Ethernet or IP-over-SNAP.
1971 * XXX - should we check both the DSAP and the
1972 * SSAP, like this, or should we check just the
1973 * DSAP, as we do for other types <= ETHERMTU
1974 * (i.e., other SAP values)?
1976 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
1977 b1
= gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_int32
)
1978 ((proto
<< 8) | proto
));
1984 * Ethernet_II frames, which are Ethernet
1985 * frames with a frame type of ETHERTYPE_IPX;
1987 * Ethernet_802.3 frames, which have a frame
1988 * type of LINUX_SLL_P_802_3;
1990 * Ethernet_802.2 frames, which are 802.3
1991 * frames with an 802.2 LLC header (i.e, have
1992 * a frame type of LINUX_SLL_P_802_2) and
1993 * with the IPX LSAP as the DSAP in the LLC
1996 * Ethernet_SNAP frames, which are 802.3
1997 * frames with an LLC header and a SNAP
1998 * header and with an OUI of 0x000000
1999 * (encapsulated Ethernet) and a protocol
2000 * ID of ETHERTYPE_IPX in the SNAP header.
2002 * First, do the checks on LINUX_SLL_P_802_2
2003 * frames; generate the check for either
2004 * Ethernet_802.2 or Ethernet_SNAP frames, and
2005 * then put a check for LINUX_SLL_P_802_2 frames
2008 b0
= gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)LLCSAP_IPX
);
2009 b1
= gen_snap(0x000000, ETHERTYPE_IPX
);
2011 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
2015 * Now check for 802.3 frames and OR that with
2016 * the previous test.
2018 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_3
);
2022 * Now add the check for Ethernet_II frames, and
2023 * do that before checking for the other frame
2026 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2027 (bpf_int32
)ETHERTYPE_IPX
);
2031 case ETHERTYPE_ATALK
:
2032 case ETHERTYPE_AARP
:
2034 * EtherTalk (AppleTalk protocols on Ethernet link
2035 * layer) may use 802.2 encapsulation.
2039 * Check for 802.2 encapsulation (EtherTalk phase 2?);
2040 * we check for the 802.2 protocol type in the
2041 * "Ethernet type" field.
2043 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, LINUX_SLL_P_802_2
);
2046 * 802.2-encapsulated ETHERTYPE_ATALK packets are
2047 * SNAP packets with an organization code of
2048 * 0x080007 (Apple, for Appletalk) and a protocol
2049 * type of ETHERTYPE_ATALK (Appletalk).
2051 * 802.2-encapsulated ETHERTYPE_AARP packets are
2052 * SNAP packets with an organization code of
2053 * 0x000000 (encapsulated Ethernet) and a protocol
2054 * type of ETHERTYPE_AARP (Appletalk ARP).
2056 if (proto
== ETHERTYPE_ATALK
)
2057 b1
= gen_snap(0x080007, ETHERTYPE_ATALK
);
2058 else /* proto == ETHERTYPE_AARP */
2059 b1
= gen_snap(0x000000, ETHERTYPE_AARP
);
2063 * Check for Ethernet encapsulation (Ethertalk
2064 * phase 1?); we just check for the Ethernet
2067 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
2073 if (proto
<= ETHERMTU
) {
2075 * This is an LLC SAP value, so the frames
2076 * that match would be 802.2 frames.
2077 * Check for the 802.2 protocol type
2078 * in the "Ethernet type" field, and
2079 * then check the DSAP.
2081 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2083 b1
= gen_cmp(OR_LINK
, off_macpl
, BPF_B
,
2089 * This is an Ethernet type, so compare
2090 * the length/type field with it (if
2091 * the frame is an 802.2 frame, the length
2092 * field will be <= ETHERMTU, and, as
2093 * "proto" is > ETHERMTU, this test
2094 * will fail and the frame won't match,
2095 * which is what we want).
2097 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2103 static struct slist
*
2104 gen_load_prism_llprefixlen()
2106 struct slist
*s1
, *s2
;
2107 struct slist
*sjeq_avs_cookie
;
2108 struct slist
*sjcommon
;
2111 * This code is not compatible with the optimizer, as
2112 * we are generating jmp instructions within a normal
2113 * slist of instructions
2118 * Generate code to load the length of the radio header into
2119 * the register assigned to hold that length, if one has been
2120 * assigned. (If one hasn't been assigned, no code we've
2121 * generated uses that prefix, so we don't need to generate any
2124 * Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes
2125 * or always use the AVS header rather than the Prism header.
2126 * We load a 4-byte big-endian value at the beginning of the
2127 * raw packet data, and see whether, when masked with 0xFFFFF000,
2128 * it's equal to 0x80211000. If so, that indicates that it's
2129 * an AVS header (the masked-out bits are the version number).
2130 * Otherwise, it's a Prism header.
2132 * XXX - the Prism header is also, in theory, variable-length,
2133 * but no known software generates headers that aren't 144
2136 if (reg_off_ll
!= -1) {
2140 s1
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2144 * AND it with 0xFFFFF000.
2146 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
2147 s2
->s
.k
= 0xFFFFF000;
2151 * Compare with 0x80211000.
2153 sjeq_avs_cookie
= new_stmt(JMP(BPF_JEQ
));
2154 sjeq_avs_cookie
->s
.k
= 0x80211000;
2155 sappend(s1
, sjeq_avs_cookie
);
2160 * The 4 bytes at an offset of 4 from the beginning of
2161 * the AVS header are the length of the AVS header.
2162 * That field is big-endian.
2164 s2
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2167 sjeq_avs_cookie
->s
.jt
= s2
;
2170 * Now jump to the code to allocate a register
2171 * into which to save the header length and
2172 * store the length there. (The "jump always"
2173 * instruction needs to have the k field set;
2174 * it's added to the PC, so, as we're jumping
2175 * over a single instruction, it should be 1.)
2177 sjcommon
= new_stmt(JMP(BPF_JA
));
2179 sappend(s1
, sjcommon
);
2182 * Now for the code that handles the Prism header.
2183 * Just load the length of the Prism header (144)
2184 * into the A register. Have the test for an AVS
2185 * header branch here if we don't have an AVS header.
2187 s2
= new_stmt(BPF_LD
|BPF_W
|BPF_IMM
);
2190 sjeq_avs_cookie
->s
.jf
= s2
;
2193 * Now allocate a register to hold that value and store
2194 * it. The code for the AVS header will jump here after
2195 * loading the length of the AVS header.
2197 s2
= new_stmt(BPF_ST
);
2198 s2
->s
.k
= reg_off_ll
;
2200 sjcommon
->s
.jf
= s2
;
2203 * Now move it into the X register.
2205 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2213 static struct slist
*
2214 gen_load_avs_llprefixlen()
2216 struct slist
*s1
, *s2
;
2219 * Generate code to load the length of the AVS header into
2220 * the register assigned to hold that length, if one has been
2221 * assigned. (If one hasn't been assigned, no code we've
2222 * generated uses that prefix, so we don't need to generate any
2225 if (reg_off_ll
!= -1) {
2227 * The 4 bytes at an offset of 4 from the beginning of
2228 * the AVS header are the length of the AVS header.
2229 * That field is big-endian.
2231 s1
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2235 * Now allocate a register to hold that value and store
2238 s2
= new_stmt(BPF_ST
);
2239 s2
->s
.k
= reg_off_ll
;
2243 * Now move it into the X register.
2245 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2253 static struct slist
*
2254 gen_load_radiotap_llprefixlen()
2256 struct slist
*s1
, *s2
;
2259 * Generate code to load the length of the radiotap header into
2260 * the register assigned to hold that length, if one has been
2261 * assigned. (If one hasn't been assigned, no code we've
2262 * generated uses that prefix, so we don't need to generate any
2265 if (reg_off_ll
!= -1) {
2267 * The 2 bytes at offsets of 2 and 3 from the beginning
2268 * of the radiotap header are the length of the radiotap
2269 * header; unfortunately, it's little-endian, so we have
2270 * to load it a byte at a time and construct the value.
2274 * Load the high-order byte, at an offset of 3, shift it
2275 * left a byte, and put the result in the X register.
2277 s1
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2279 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
2282 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2286 * Load the next byte, at an offset of 2, and OR the
2287 * value from the X register into it.
2289 s2
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2292 s2
= new_stmt(BPF_ALU
|BPF_OR
|BPF_X
);
2296 * Now allocate a register to hold that value and store
2299 s2
= new_stmt(BPF_ST
);
2300 s2
->s
.k
= reg_off_ll
;
2304 * Now move it into the X register.
2306 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2315 * At the moment we treat PPI as normal Radiotap encoded
2316 * packets. The difference is in the function that generates
2317 * the code at the beginning to compute the header length.
2318 * Since this code generator of PPI supports bare 802.11
2319 * encapsulation only (i.e. the encapsulated DLT should be
2320 * DLT_IEEE802_11) we generate code to check for this too;
2321 * that's done in finish_parse().
2323 static struct slist
*
2324 gen_load_ppi_llprefixlen()
2326 struct slist
*s1
, *s2
;
2329 * Generate code to load the length of the radiotap header
2330 * into the register assigned to hold that length, if one has
2333 if (reg_off_ll
!= -1) {
2335 * The 2 bytes at offsets of 2 and 3 from the beginning
2336 * of the radiotap header are the length of the radiotap
2337 * header; unfortunately, it's little-endian, so we have
2338 * to load it a byte at a time and construct the value.
2342 * Load the high-order byte, at an offset of 3, shift it
2343 * left a byte, and put the result in the X register.
2345 s1
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2347 s2
= new_stmt(BPF_ALU
|BPF_LSH
|BPF_K
);
2350 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2354 * Load the next byte, at an offset of 2, and OR the
2355 * value from the X register into it.
2357 s2
= new_stmt(BPF_LD
|BPF_B
|BPF_ABS
);
2360 s2
= new_stmt(BPF_ALU
|BPF_OR
|BPF_X
);
2364 * Now allocate a register to hold that value and store
2367 s2
= new_stmt(BPF_ST
);
2368 s2
->s
.k
= reg_off_ll
;
2372 * Now move it into the X register.
2374 s2
= new_stmt(BPF_MISC
|BPF_TAX
);
2383 * Load a value relative to the beginning of the link-layer header after the 802.11
2384 * header, i.e. LLC_SNAP.
2385 * The link-layer header doesn't necessarily begin at the beginning
2386 * of the packet data; there might be a variable-length prefix containing
2387 * radio information.
2389 static struct slist
*
2390 gen_load_802_11_header_len(struct slist
*s
, struct slist
*snext
)
2393 struct slist
*sjset_data_frame_1
;
2394 struct slist
*sjset_data_frame_2
;
2395 struct slist
*sjset_qos
;
2396 struct slist
*sjset_radiotap_flags
;
2397 struct slist
*sjset_radiotap_tsft
;
2398 struct slist
*sjset_tsft_datapad
, *sjset_notsft_datapad
;
2399 struct slist
*s_roundup
;
2401 if (reg_off_macpl
== -1) {
2403 * No register has been assigned to the offset of
2404 * the MAC-layer payload, which means nobody needs
2405 * it; don't bother computing it - just return
2406 * what we already have.
2412 * This code is not compatible with the optimizer, as
2413 * we are generating jmp instructions within a normal
2414 * slist of instructions
2419 * If "s" is non-null, it has code to arrange that the X register
2420 * contains the length of the prefix preceding the link-layer
2423 * Otherwise, the length of the prefix preceding the link-layer
2424 * header is "off_ll".
2428 * There is no variable-length header preceding the
2429 * link-layer header.
2431 * Load the length of the fixed-length prefix preceding
2432 * the link-layer header (if any) into the X register,
2433 * and store it in the reg_off_macpl register.
2434 * That length is off_ll.
2436 s
= new_stmt(BPF_LDX
|BPF_IMM
);
2441 * The X register contains the offset of the beginning of the
2442 * link-layer header; add 24, which is the minimum length
2443 * of the MAC header for a data frame, to that, and store it
2444 * in reg_off_macpl, and then load the Frame Control field,
2445 * which is at the offset in the X register, with an indexed load.
2447 s2
= new_stmt(BPF_MISC
|BPF_TXA
);
2449 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
2452 s2
= new_stmt(BPF_ST
);
2453 s2
->s
.k
= reg_off_macpl
;
2456 s2
= new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
2461 * Check the Frame Control field to see if this is a data frame;
2462 * a data frame has the 0x08 bit (b3) in that field set and the
2463 * 0x04 bit (b2) clear.
2465 sjset_data_frame_1
= new_stmt(JMP(BPF_JSET
));
2466 sjset_data_frame_1
->s
.k
= 0x08;
2467 sappend(s
, sjset_data_frame_1
);
2470 * If b3 is set, test b2, otherwise go to the first statement of
2471 * the rest of the program.
2473 sjset_data_frame_1
->s
.jt
= sjset_data_frame_2
= new_stmt(JMP(BPF_JSET
));
2474 sjset_data_frame_2
->s
.k
= 0x04;
2475 sappend(s
, sjset_data_frame_2
);
2476 sjset_data_frame_1
->s
.jf
= snext
;
2479 * If b2 is not set, this is a data frame; test the QoS bit.
2480 * Otherwise, go to the first statement of the rest of the
2483 sjset_data_frame_2
->s
.jt
= snext
;
2484 sjset_data_frame_2
->s
.jf
= sjset_qos
= new_stmt(JMP(BPF_JSET
));
2485 sjset_qos
->s
.k
= 0x80; /* QoS bit */
2486 sappend(s
, sjset_qos
);
2489 * If it's set, add 2 to reg_off_macpl, to skip the QoS
2491 * Otherwise, go to the first statement of the rest of the
2494 sjset_qos
->s
.jt
= s2
= new_stmt(BPF_LD
|BPF_MEM
);
2495 s2
->s
.k
= reg_off_macpl
;
2497 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_IMM
);
2500 s2
= new_stmt(BPF_ST
);
2501 s2
->s
.k
= reg_off_macpl
;
2505 * If we have a radiotap header, look at it to see whether
2506 * there's Atheros padding between the MAC-layer header
2509 * Note: all of the fields in the radiotap header are
2510 * little-endian, so we byte-swap all of the values
2511 * we test against, as they will be loaded as big-endian
2514 if (linktype
== DLT_IEEE802_11_RADIO
) {
2516 * Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set
2517 * in the presence flag?
2519 sjset_qos
->s
.jf
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_W
);
2523 sjset_radiotap_flags
= new_stmt(JMP(BPF_JSET
));
2524 sjset_radiotap_flags
->s
.k
= SWAPLONG(0x00000002);
2525 sappend(s
, sjset_radiotap_flags
);
2528 * If not, skip all of this.
2530 sjset_radiotap_flags
->s
.jf
= snext
;
2533 * Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set?
2535 sjset_radiotap_tsft
= sjset_radiotap_flags
->s
.jt
=
2536 new_stmt(JMP(BPF_JSET
));
2537 sjset_radiotap_tsft
->s
.k
= SWAPLONG(0x00000001);
2538 sappend(s
, sjset_radiotap_tsft
);
2541 * If IEEE80211_RADIOTAP_TSFT is set, the flags field is
2542 * at an offset of 16 from the beginning of the raw packet
2543 * data (8 bytes for the radiotap header and 8 bytes for
2546 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2549 sjset_radiotap_tsft
->s
.jt
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
2553 sjset_tsft_datapad
= new_stmt(JMP(BPF_JSET
));
2554 sjset_tsft_datapad
->s
.k
= 0x20;
2555 sappend(s
, sjset_tsft_datapad
);
2558 * If IEEE80211_RADIOTAP_TSFT is not set, the flags field is
2559 * at an offset of 8 from the beginning of the raw packet
2560 * data (8 bytes for the radiotap header).
2562 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2565 sjset_radiotap_tsft
->s
.jf
= s2
= new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
2569 sjset_notsft_datapad
= new_stmt(JMP(BPF_JSET
));
2570 sjset_notsft_datapad
->s
.k
= 0x20;
2571 sappend(s
, sjset_notsft_datapad
);
2574 * In either case, if IEEE80211_RADIOTAP_F_DATAPAD is
2575 * set, round the length of the 802.11 header to
2576 * a multiple of 4. Do that by adding 3 and then
2577 * dividing by and multiplying by 4, which we do by
2580 s_roundup
= new_stmt(BPF_LD
|BPF_MEM
);
2581 s_roundup
->s
.k
= reg_off_macpl
;
2582 sappend(s
, s_roundup
);
2583 s2
= new_stmt(BPF_ALU
|BPF_ADD
|BPF_IMM
);
2586 s2
= new_stmt(BPF_ALU
|BPF_AND
|BPF_IMM
);
2589 s2
= new_stmt(BPF_ST
);
2590 s2
->s
.k
= reg_off_macpl
;
2593 sjset_tsft_datapad
->s
.jt
= s_roundup
;
2594 sjset_tsft_datapad
->s
.jf
= snext
;
2595 sjset_notsft_datapad
->s
.jt
= s_roundup
;
2596 sjset_notsft_datapad
->s
.jf
= snext
;
2598 sjset_qos
->s
.jf
= snext
;
2604 insert_compute_vloffsets(b
)
2610 * For link-layer types that have a variable-length header
2611 * preceding the link-layer header, generate code to load
2612 * the offset of the link-layer header into the register
2613 * assigned to that offset, if any.
2617 case DLT_PRISM_HEADER
:
2618 s
= gen_load_prism_llprefixlen();
2621 case DLT_IEEE802_11_RADIO_AVS
:
2622 s
= gen_load_avs_llprefixlen();
2625 case DLT_IEEE802_11_RADIO
:
2626 s
= gen_load_radiotap_llprefixlen();
2630 s
= gen_load_ppi_llprefixlen();
2639 * For link-layer types that have a variable-length link-layer
2640 * header, generate code to load the offset of the MAC-layer
2641 * payload into the register assigned to that offset, if any.
2645 case DLT_IEEE802_11
:
2646 case DLT_PRISM_HEADER
:
2647 case DLT_IEEE802_11_RADIO_AVS
:
2648 case DLT_IEEE802_11_RADIO
:
2650 s
= gen_load_802_11_header_len(s
, b
->stmts
);
2655 * If we have any offset-loading code, append all the
2656 * existing statements in the block to those statements,
2657 * and make the resulting list the list of statements
2661 sappend(s
, b
->stmts
);
2666 static struct block
*
2667 gen_ppi_dlt_check(void)
2669 struct slist
*s_load_dlt
;
2672 if (linktype
== DLT_PPI
)
2674 /* Create the statements that check for the DLT
2676 s_load_dlt
= new_stmt(BPF_LD
|BPF_W
|BPF_ABS
);
2677 s_load_dlt
->s
.k
= 4;
2679 b
= new_block(JMP(BPF_JEQ
));
2681 b
->stmts
= s_load_dlt
;
2682 b
->s
.k
= SWAPLONG(DLT_IEEE802_11
);
2692 static struct slist
*
2693 gen_prism_llprefixlen(void)
2697 if (reg_off_ll
== -1) {
2699 * We haven't yet assigned a register for the length
2700 * of the radio header; allocate one.
2702 reg_off_ll
= alloc_reg();
2706 * Load the register containing the radio length
2707 * into the X register.
2709 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2710 s
->s
.k
= reg_off_ll
;
2714 static struct slist
*
2715 gen_avs_llprefixlen(void)
2719 if (reg_off_ll
== -1) {
2721 * We haven't yet assigned a register for the length
2722 * of the AVS header; allocate one.
2724 reg_off_ll
= alloc_reg();
2728 * Load the register containing the AVS length
2729 * into the X register.
2731 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2732 s
->s
.k
= reg_off_ll
;
2736 static struct slist
*
2737 gen_radiotap_llprefixlen(void)
2741 if (reg_off_ll
== -1) {
2743 * We haven't yet assigned a register for the length
2744 * of the radiotap header; allocate one.
2746 reg_off_ll
= alloc_reg();
2750 * Load the register containing the radiotap length
2751 * into the X register.
2753 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2754 s
->s
.k
= reg_off_ll
;
2759 * At the moment we treat PPI as normal Radiotap encoded
2760 * packets. The difference is in the function that generates
2761 * the code at the beginning to compute the header length.
2762 * Since this code generator of PPI supports bare 802.11
2763 * encapsulation only (i.e. the encapsulated DLT should be
2764 * DLT_IEEE802_11) we generate code to check for this too.
2766 static struct slist
*
2767 gen_ppi_llprefixlen(void)
2771 if (reg_off_ll
== -1) {
2773 * We haven't yet assigned a register for the length
2774 * of the radiotap header; allocate one.
2776 reg_off_ll
= alloc_reg();
2780 * Load the register containing the PPI length
2781 * into the X register.
2783 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2784 s
->s
.k
= reg_off_ll
;
2789 * Generate code to compute the link-layer header length, if necessary,
2790 * putting it into the X register, and to return either a pointer to a
2791 * "struct slist" for the list of statements in that code, or NULL if
2792 * no code is necessary.
2794 static struct slist
*
2795 gen_llprefixlen(void)
2799 case DLT_PRISM_HEADER
:
2800 return gen_prism_llprefixlen();
2802 case DLT_IEEE802_11_RADIO_AVS
:
2803 return gen_avs_llprefixlen();
2805 case DLT_IEEE802_11_RADIO
:
2806 return gen_radiotap_llprefixlen();
2809 return gen_ppi_llprefixlen();
2817 * Generate code to load the register containing the offset of the
2818 * MAC-layer payload into the X register; if no register for that offset
2819 * has been allocated, allocate it first.
2821 static struct slist
*
2826 if (off_macpl_is_variable
) {
2827 if (reg_off_macpl
== -1) {
2829 * We haven't yet assigned a register for the offset
2830 * of the MAC-layer payload; allocate one.
2832 reg_off_macpl
= alloc_reg();
2836 * Load the register containing the offset of the MAC-layer
2837 * payload into the X register.
2839 s
= new_stmt(BPF_LDX
|BPF_MEM
);
2840 s
->s
.k
= reg_off_macpl
;
2844 * That offset isn't variable, so we don't need to
2845 * generate any code.
2852 * Map an Ethernet type to the equivalent PPP type.
2855 ethertype_to_ppptype(proto
)
2865 case ETHERTYPE_IPV6
:
2874 case ETHERTYPE_ATALK
:
2888 * I'm assuming the "Bridging PDU"s that go
2889 * over PPP are Spanning Tree Protocol
2903 * Generate code to match a particular packet type by matching the
2904 * link-layer type field or fields in the 802.2 LLC header.
2906 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
2907 * value, if <= ETHERMTU.
2909 static struct block
*
2913 struct block
*b0
, *b1
, *b2
;
2915 /* are we checking MPLS-encapsulated packets? */
2916 if (label_stack_depth
> 0) {
2920 /* FIXME add other L3 proto IDs */
2921 return gen_mpls_linktype(Q_IP
);
2923 case ETHERTYPE_IPV6
:
2925 /* FIXME add other L3 proto IDs */
2926 return gen_mpls_linktype(Q_IPV6
);
2929 bpf_error("unsupported protocol over mpls");
2935 * Are we testing PPPoE packets?
2939 * The PPPoE session header is part of the
2940 * MAC-layer payload, so all references
2941 * should be relative to the beginning of
2946 * We use Ethernet protocol types inside libpcap;
2947 * map them to the corresponding PPP protocol types.
2949 proto
= ethertype_to_ppptype(proto
);
2950 return gen_cmp(OR_MACPL
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
2956 case DLT_NETANALYZER
:
2957 case DLT_NETANALYZER_TRANSPARENT
:
2958 return gen_ether_linktype(proto
);
2966 proto
= (proto
<< 8 | LLCSAP_ISONS
);
2970 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
2977 case DLT_IEEE802_11
:
2978 case DLT_PRISM_HEADER
:
2979 case DLT_IEEE802_11_RADIO_AVS
:
2980 case DLT_IEEE802_11_RADIO
:
2983 * Check that we have a data frame.
2985 b0
= gen_check_802_11_data_frame();
2988 * Now check for the specified link-layer type.
2990 b1
= gen_llc_linktype(proto
);
2998 * XXX - check for asynchronous frames, as per RFC 1103.
3000 return gen_llc_linktype(proto
);
3006 * XXX - check for LLC PDUs, as per IEEE 802.5.
3008 return gen_llc_linktype(proto
);
3012 case DLT_ATM_RFC1483
:
3014 case DLT_IP_OVER_FC
:
3015 return gen_llc_linktype(proto
);
3021 * If "is_lane" is set, check for a LANE-encapsulated
3022 * version of this protocol, otherwise check for an
3023 * LLC-encapsulated version of this protocol.
3025 * We assume LANE means Ethernet, not Token Ring.
3029 * Check that the packet doesn't begin with an
3030 * LE Control marker. (We've already generated
3033 b0
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
, BPF_H
,
3038 * Now generate an Ethernet test.
3040 b1
= gen_ether_linktype(proto
);
3045 * Check for LLC encapsulation and then check the
3048 b0
= gen_atmfield_code(A_PROTOTYPE
, PT_LLC
, BPF_JEQ
, 0);
3049 b1
= gen_llc_linktype(proto
);
3057 return gen_linux_sll_linktype(proto
);
3062 case DLT_SLIP_BSDOS
:
3065 * These types don't provide any type field; packets
3066 * are always IPv4 or IPv6.
3068 * XXX - for IPv4, check for a version number of 4, and,
3069 * for IPv6, check for a version number of 6?
3074 /* Check for a version number of 4. */
3075 return gen_mcmp(OR_LINK
, 0, BPF_B
, 0x40, 0xF0);
3077 case ETHERTYPE_IPV6
:
3078 /* Check for a version number of 6. */
3079 return gen_mcmp(OR_LINK
, 0, BPF_B
, 0x60, 0xF0);
3083 return gen_false(); /* always false */
3090 * Raw IPv4, so no type field.
3092 if (proto
== ETHERTYPE_IP
)
3093 return gen_true(); /* always true */
3095 /* Checking for something other than IPv4; always false */
3102 * Raw IPv6, so no type field.
3105 if (proto
== ETHERTYPE_IPV6
)
3106 return gen_true(); /* always true */
3109 /* Checking for something other than IPv6; always false */
3116 case DLT_PPP_SERIAL
:
3119 * We use Ethernet protocol types inside libpcap;
3120 * map them to the corresponding PPP protocol types.
3122 proto
= ethertype_to_ppptype(proto
);
3123 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
3129 * We use Ethernet protocol types inside libpcap;
3130 * map them to the corresponding PPP protocol types.
3136 * Also check for Van Jacobson-compressed IP.
3137 * XXX - do this for other forms of PPP?
3139 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_IP
);
3140 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_VJC
);
3142 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
, PPP_VJNC
);
3147 proto
= ethertype_to_ppptype(proto
);
3148 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
3158 * For DLT_NULL, the link-layer header is a 32-bit
3159 * word containing an AF_ value in *host* byte order,
3160 * and for DLT_ENC, the link-layer header begins
3161 * with a 32-bit work containing an AF_ value in
3164 * In addition, if we're reading a saved capture file,
3165 * the host byte order in the capture may not be the
3166 * same as the host byte order on this machine.
3168 * For DLT_LOOP, the link-layer header is a 32-bit
3169 * word containing an AF_ value in *network* byte order.
3171 * XXX - AF_ values may, unfortunately, be platform-
3172 * dependent; for example, FreeBSD's AF_INET6 is 24
3173 * whilst NetBSD's and OpenBSD's is 26.
3175 * This means that, when reading a capture file, just
3176 * checking for our AF_INET6 value won't work if the
3177 * capture file came from another OS.
3186 case ETHERTYPE_IPV6
:
3193 * Not a type on which we support filtering.
3194 * XXX - support those that have AF_ values
3195 * #defined on this platform, at least?
3200 if (linktype
== DLT_NULL
|| linktype
== DLT_ENC
) {
3202 * The AF_ value is in host byte order, but
3203 * the BPF interpreter will convert it to
3204 * network byte order.
3206 * If this is a save file, and it's from a
3207 * machine with the opposite byte order to
3208 * ours, we byte-swap the AF_ value.
3210 * Then we run it through "htonl()", and
3211 * generate code to compare against the result.
3213 if (bpf_pcap
->sf
.rfile
!= NULL
&&
3214 bpf_pcap
->sf
.swapped
)
3215 proto
= SWAPLONG(proto
);
3216 proto
= htonl(proto
);
3218 return (gen_cmp(OR_LINK
, 0, BPF_W
, (bpf_int32
)proto
));
3220 #ifdef HAVE_NET_PFVAR_H
3223 * af field is host byte order in contrast to the rest of
3226 if (proto
== ETHERTYPE_IP
)
3227 return (gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, af
),
3228 BPF_B
, (bpf_int32
)AF_INET
));
3230 else if (proto
== ETHERTYPE_IPV6
)
3231 return (gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, af
),
3232 BPF_B
, (bpf_int32
)AF_INET6
));
3238 #endif /* HAVE_NET_PFVAR_H */
3241 case DLT_ARCNET_LINUX
:
3243 * XXX should we check for first fragment if the protocol
3252 case ETHERTYPE_IPV6
:
3253 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3254 (bpf_int32
)ARCTYPE_INET6
));
3258 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3259 (bpf_int32
)ARCTYPE_IP
);
3260 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3261 (bpf_int32
)ARCTYPE_IP_OLD
);
3266 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3267 (bpf_int32
)ARCTYPE_ARP
);
3268 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3269 (bpf_int32
)ARCTYPE_ARP_OLD
);
3273 case ETHERTYPE_REVARP
:
3274 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3275 (bpf_int32
)ARCTYPE_REVARP
));
3277 case ETHERTYPE_ATALK
:
3278 return (gen_cmp(OR_LINK
, off_linktype
, BPF_B
,
3279 (bpf_int32
)ARCTYPE_ATALK
));
3286 case ETHERTYPE_ATALK
:
3296 * XXX - assumes a 2-byte Frame Relay header with
3297 * DLCI and flags. What if the address is longer?
3303 * Check for the special NLPID for IP.
3305 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | 0xcc);
3308 case ETHERTYPE_IPV6
:
3310 * Check for the special NLPID for IPv6.
3312 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | 0x8e);
3317 * Check for several OSI protocols.
3319 * Frame Relay packets typically have an OSI
3320 * NLPID at the beginning; we check for each
3323 * What we check for is the NLPID and a frame
3324 * control field of UI, i.e. 0x03 followed
3327 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO8473_CLNP
);
3328 b1
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO9542_ESIS
);
3329 b2
= gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | ISO10589_ISIS
);
3341 bpf_error("Multi-link Frame Relay link-layer type filtering not implemented");
3343 case DLT_JUNIPER_MFR
:
3344 case DLT_JUNIPER_MLFR
:
3345 case DLT_JUNIPER_MLPPP
:
3346 case DLT_JUNIPER_ATM1
:
3347 case DLT_JUNIPER_ATM2
:
3348 case DLT_JUNIPER_PPPOE
:
3349 case DLT_JUNIPER_PPPOE_ATM
:
3350 case DLT_JUNIPER_GGSN
:
3351 case DLT_JUNIPER_ES
:
3352 case DLT_JUNIPER_MONITOR
:
3353 case DLT_JUNIPER_SERVICES
:
3354 case DLT_JUNIPER_ETHER
:
3355 case DLT_JUNIPER_PPP
:
3356 case DLT_JUNIPER_FRELAY
:
3357 case DLT_JUNIPER_CHDLC
:
3358 case DLT_JUNIPER_VP
:
3359 case DLT_JUNIPER_ST
:
3360 case DLT_JUNIPER_ISM
:
3361 case DLT_JUNIPER_VS
:
3362 case DLT_JUNIPER_SRX_E2E
:
3363 case DLT_JUNIPER_FIBRECHANNEL
:
3364 case DLT_JUNIPER_ATM_CEMIC
:
3366 /* just lets verify the magic number for now -
3367 * on ATM we may have up to 6 different encapsulations on the wire
3368 * and need a lot of heuristics to figure out that the payload
3371 * FIXME encapsulation specific BPF_ filters
3373 return gen_mcmp(OR_LINK
, 0, BPF_W
, 0x4d474300, 0xffffff00); /* compare the magic number */
3376 return gen_ipnet_linktype(proto
);
3378 case DLT_LINUX_IRDA
:
3379 bpf_error("IrDA link-layer type filtering not implemented");
3382 bpf_error("DOCSIS link-layer type filtering not implemented");
3385 case DLT_MTP2_WITH_PHDR
:
3386 bpf_error("MTP2 link-layer type filtering not implemented");
3389 bpf_error("ERF link-layer type filtering not implemented");
3392 bpf_error("PFSYNC link-layer type filtering not implemented");
3394 case DLT_LINUX_LAPD
:
3395 bpf_error("LAPD link-layer type filtering not implemented");
3399 case DLT_USB_LINUX_MMAPPED
:
3400 bpf_error("USB link-layer type filtering not implemented");
3402 case DLT_BLUETOOTH_HCI_H4
:
3403 case DLT_BLUETOOTH_HCI_H4_WITH_PHDR
:
3404 bpf_error("Bluetooth link-layer type filtering not implemented");
3407 case DLT_CAN_SOCKETCAN
:
3408 bpf_error("CAN link-layer type filtering not implemented");
3410 case DLT_IEEE802_15_4
:
3411 case DLT_IEEE802_15_4_LINUX
:
3412 case DLT_IEEE802_15_4_NONASK_PHY
:
3413 case DLT_IEEE802_15_4_NOFCS
:
3414 bpf_error("IEEE 802.15.4 link-layer type filtering not implemented");
3416 case DLT_IEEE802_16_MAC_CPS_RADIO
:
3417 bpf_error("IEEE 802.16 link-layer type filtering not implemented");
3420 bpf_error("SITA link-layer type filtering not implemented");
3423 bpf_error("RAIF1 link-layer type filtering not implemented");
3426 bpf_error("IPMB link-layer type filtering not implemented");
3429 bpf_error("AX.25 link-layer type filtering not implemented");
3433 * All the types that have no encapsulation should either be
3434 * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if
3435 * all packets are IP packets, or should be handled in some
3436 * special case, if none of them are (if some are and some
3437 * aren't, the lack of encapsulation is a problem, as we'd
3438 * have to find some other way of determining the packet type).
3440 * Therefore, if "off_linktype" is -1, there's an error.
3442 if (off_linktype
== (u_int
)-1)
3446 * Any type not handled above should always have an Ethernet
3447 * type at an offset of "off_linktype".
3449 return gen_cmp(OR_LINK
, off_linktype
, BPF_H
, (bpf_int32
)proto
);
3453 * Check for an LLC SNAP packet with a given organization code and
3454 * protocol type; we check the entire contents of the 802.2 LLC and
3455 * snap headers, checking for DSAP and SSAP of SNAP and a control
3456 * field of 0x03 in the LLC header, and for the specified organization
3457 * code and protocol type in the SNAP header.
3459 static struct block
*
3460 gen_snap(orgcode
, ptype
)
3461 bpf_u_int32 orgcode
;
3464 u_char snapblock
[8];
3466 snapblock
[0] = LLCSAP_SNAP
; /* DSAP = SNAP */
3467 snapblock
[1] = LLCSAP_SNAP
; /* SSAP = SNAP */
3468 snapblock
[2] = 0x03; /* control = UI */
3469 snapblock
[3] = (orgcode
>> 16); /* upper 8 bits of organization code */
3470 snapblock
[4] = (orgcode
>> 8); /* middle 8 bits of organization code */
3471 snapblock
[5] = (orgcode
>> 0); /* lower 8 bits of organization code */
3472 snapblock
[6] = (ptype
>> 8); /* upper 8 bits of protocol type */
3473 snapblock
[7] = (ptype
>> 0); /* lower 8 bits of protocol type */
3474 return gen_bcmp(OR_MACPL
, 0, 8, snapblock
);
3478 * Generate code to match a particular packet type, for link-layer types
3479 * using 802.2 LLC headers.
3481 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used
3482 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues.
3484 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
3485 * value, if <= ETHERMTU. We use that to determine whether to
3486 * match the DSAP or both DSAP and LSAP or to check the OUI and
3487 * protocol ID in a SNAP header.
3489 static struct block
*
3490 gen_llc_linktype(proto
)
3494 * XXX - handle token-ring variable-length header.
3500 case LLCSAP_NETBEUI
:
3502 * XXX - should we check both the DSAP and the
3503 * SSAP, like this, or should we check just the
3504 * DSAP, as we do for other types <= ETHERMTU
3505 * (i.e., other SAP values)?
3507 return gen_cmp(OR_MACPL
, 0, BPF_H
, (bpf_u_int32
)
3508 ((proto
<< 8) | proto
));
3512 * XXX - are there ever SNAP frames for IPX on
3513 * non-Ethernet 802.x networks?
3515 return gen_cmp(OR_MACPL
, 0, BPF_B
,
3516 (bpf_int32
)LLCSAP_IPX
);
3518 case ETHERTYPE_ATALK
:
3520 * 802.2-encapsulated ETHERTYPE_ATALK packets are
3521 * SNAP packets with an organization code of
3522 * 0x080007 (Apple, for Appletalk) and a protocol
3523 * type of ETHERTYPE_ATALK (Appletalk).
3525 * XXX - check for an organization code of
3526 * encapsulated Ethernet as well?
3528 return gen_snap(0x080007, ETHERTYPE_ATALK
);
3532 * XXX - we don't have to check for IPX 802.3
3533 * here, but should we check for the IPX Ethertype?
3535 if (proto
<= ETHERMTU
) {
3537 * This is an LLC SAP value, so check
3540 return gen_cmp(OR_MACPL
, 0, BPF_B
, (bpf_int32
)proto
);
3543 * This is an Ethernet type; we assume that it's
3544 * unlikely that it'll appear in the right place
3545 * at random, and therefore check only the
3546 * location that would hold the Ethernet type
3547 * in a SNAP frame with an organization code of
3548 * 0x000000 (encapsulated Ethernet).
3550 * XXX - if we were to check for the SNAP DSAP and
3551 * LSAP, as per XXX, and were also to check for an
3552 * organization code of 0x000000 (encapsulated
3553 * Ethernet), we'd do
3555 * return gen_snap(0x000000, proto);
3557 * here; for now, we don't, as per the above.
3558 * I don't know whether it's worth the extra CPU
3559 * time to do the right check or not.
3561 return gen_cmp(OR_MACPL
, 6, BPF_H
, (bpf_int32
)proto
);
3566 static struct block
*
3567 gen_hostop(addr
, mask
, dir
, proto
, src_off
, dst_off
)
3571 u_int src_off
, dst_off
;
3573 struct block
*b0
, *b1
;
3587 b0
= gen_hostop(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3588 b1
= gen_hostop(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3594 b0
= gen_hostop(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3595 b1
= gen_hostop(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3602 b0
= gen_linktype(proto
);
3603 b1
= gen_mcmp(OR_NET
, offset
, BPF_W
, (bpf_int32
)addr
, mask
);
3609 static struct block
*
3610 gen_hostop6(addr
, mask
, dir
, proto
, src_off
, dst_off
)
3611 struct in6_addr
*addr
;
3612 struct in6_addr
*mask
;
3614 u_int src_off
, dst_off
;
3616 struct block
*b0
, *b1
;
3631 b0
= gen_hostop6(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3632 b1
= gen_hostop6(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3638 b0
= gen_hostop6(addr
, mask
, Q_SRC
, proto
, src_off
, dst_off
);
3639 b1
= gen_hostop6(addr
, mask
, Q_DST
, proto
, src_off
, dst_off
);
3646 /* this order is important */
3647 a
= (u_int32_t
*)addr
;
3648 m
= (u_int32_t
*)mask
;
3649 b1
= gen_mcmp(OR_NET
, offset
+ 12, BPF_W
, ntohl(a
[3]), ntohl(m
[3]));
3650 b0
= gen_mcmp(OR_NET
, offset
+ 8, BPF_W
, ntohl(a
[2]), ntohl(m
[2]));
3652 b0
= gen_mcmp(OR_NET
, offset
+ 4, BPF_W
, ntohl(a
[1]), ntohl(m
[1]));
3654 b0
= gen_mcmp(OR_NET
, offset
+ 0, BPF_W
, ntohl(a
[0]), ntohl(m
[0]));
3656 b0
= gen_linktype(proto
);
3662 static struct block
*
3663 gen_ehostop(eaddr
, dir
)
3664 register const u_char
*eaddr
;
3667 register struct block
*b0
, *b1
;
3671 return gen_bcmp(OR_LINK
, off_mac
+ 6, 6, eaddr
);
3674 return gen_bcmp(OR_LINK
, off_mac
+ 0, 6, eaddr
);
3677 b0
= gen_ehostop(eaddr
, Q_SRC
);
3678 b1
= gen_ehostop(eaddr
, Q_DST
);
3684 b0
= gen_ehostop(eaddr
, Q_SRC
);
3685 b1
= gen_ehostop(eaddr
, Q_DST
);
3690 bpf_error("'addr1' is only supported on 802.11 with 802.11 headers");
3694 bpf_error("'addr2' is only supported on 802.11 with 802.11 headers");
3698 bpf_error("'addr3' is only supported on 802.11 with 802.11 headers");
3702 bpf_error("'addr4' is only supported on 802.11 with 802.11 headers");
3706 bpf_error("'ra' is only supported on 802.11 with 802.11 headers");
3710 bpf_error("'ta' is only supported on 802.11 with 802.11 headers");
3718 * Like gen_ehostop, but for DLT_FDDI
3720 static struct block
*
3721 gen_fhostop(eaddr
, dir
)
3722 register const u_char
*eaddr
;
3725 struct block
*b0
, *b1
;
3730 return gen_bcmp(OR_LINK
, 6 + 1 + pcap_fddipad
, 6, eaddr
);
3732 return gen_bcmp(OR_LINK
, 6 + 1, 6, eaddr
);
3737 return gen_bcmp(OR_LINK
, 0 + 1 + pcap_fddipad
, 6, eaddr
);
3739 return gen_bcmp(OR_LINK
, 0 + 1, 6, eaddr
);
3743 b0
= gen_fhostop(eaddr
, Q_SRC
);
3744 b1
= gen_fhostop(eaddr
, Q_DST
);
3750 b0
= gen_fhostop(eaddr
, Q_SRC
);
3751 b1
= gen_fhostop(eaddr
, Q_DST
);
3756 bpf_error("'addr1' is only supported on 802.11");
3760 bpf_error("'addr2' is only supported on 802.11");
3764 bpf_error("'addr3' is only supported on 802.11");
3768 bpf_error("'addr4' is only supported on 802.11");
3772 bpf_error("'ra' is only supported on 802.11");
3776 bpf_error("'ta' is only supported on 802.11");
3784 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
3786 static struct block
*
3787 gen_thostop(eaddr
, dir
)
3788 register const u_char
*eaddr
;
3791 register struct block
*b0
, *b1
;
3795 return gen_bcmp(OR_LINK
, 8, 6, eaddr
);
3798 return gen_bcmp(OR_LINK
, 2, 6, eaddr
);
3801 b0
= gen_thostop(eaddr
, Q_SRC
);
3802 b1
= gen_thostop(eaddr
, Q_DST
);
3808 b0
= gen_thostop(eaddr
, Q_SRC
);
3809 b1
= gen_thostop(eaddr
, Q_DST
);
3814 bpf_error("'addr1' is only supported on 802.11");
3818 bpf_error("'addr2' is only supported on 802.11");
3822 bpf_error("'addr3' is only supported on 802.11");
3826 bpf_error("'addr4' is only supported on 802.11");
3830 bpf_error("'ra' is only supported on 802.11");
3834 bpf_error("'ta' is only supported on 802.11");
3842 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and
3843 * various 802.11 + radio headers.
3845 static struct block
*
3846 gen_wlanhostop(eaddr
, dir
)
3847 register const u_char
*eaddr
;
3850 register struct block
*b0
, *b1
, *b2
;
3851 register struct slist
*s
;
3853 #ifdef ENABLE_WLAN_FILTERING_PATCH
3856 * We need to disable the optimizer because the optimizer is buggy
3857 * and wipes out some LD instructions generated by the below
3858 * code to validate the Frame Control bits
3861 #endif /* ENABLE_WLAN_FILTERING_PATCH */
3868 * For control frames, there is no SA.
3870 * For management frames, SA is at an
3871 * offset of 10 from the beginning of
3874 * For data frames, SA is at an offset
3875 * of 10 from the beginning of the packet
3876 * if From DS is clear, at an offset of
3877 * 16 from the beginning of the packet
3878 * if From DS is set and To DS is clear,
3879 * and an offset of 24 from the beginning
3880 * of the packet if From DS is set and To DS
3885 * Generate the tests to be done for data frames
3888 * First, check for To DS set, i.e. check "link[1] & 0x01".
3890 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3891 b1
= new_block(JMP(BPF_JSET
));
3892 b1
->s
.k
= 0x01; /* To DS */
3896 * If To DS is set, the SA is at 24.
3898 b0
= gen_bcmp(OR_LINK
, 24, 6, eaddr
);
3902 * Now, check for To DS not set, i.e. check
3903 * "!(link[1] & 0x01)".
3905 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3906 b2
= new_block(JMP(BPF_JSET
));
3907 b2
->s
.k
= 0x01; /* To DS */
3912 * If To DS is not set, the SA is at 16.
3914 b1
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
3918 * Now OR together the last two checks. That gives
3919 * the complete set of checks for data frames with
3925 * Now check for From DS being set, and AND that with
3926 * the ORed-together checks.
3928 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3929 b1
= new_block(JMP(BPF_JSET
));
3930 b1
->s
.k
= 0x02; /* From DS */
3935 * Now check for data frames with From DS not set.
3937 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
3938 b2
= new_block(JMP(BPF_JSET
));
3939 b2
->s
.k
= 0x02; /* From DS */
3944 * If From DS isn't set, the SA is at 10.
3946 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
3950 * Now OR together the checks for data frames with
3951 * From DS not set and for data frames with From DS
3952 * set; that gives the checks done for data frames.
3957 * Now check for a data frame.
3958 * I.e, check "link[0] & 0x08".
3960 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3961 b1
= new_block(JMP(BPF_JSET
));
3966 * AND that with the checks done for data frames.
3971 * If the high-order bit of the type value is 0, this
3972 * is a management frame.
3973 * I.e, check "!(link[0] & 0x08)".
3975 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
3976 b2
= new_block(JMP(BPF_JSET
));
3982 * For management frames, the SA is at 10.
3984 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
3988 * OR that with the checks done for data frames.
3989 * That gives the checks done for management and
3995 * If the low-order bit of the type value is 1,
3996 * this is either a control frame or a frame
3997 * with a reserved type, and thus not a
4000 * I.e., check "!(link[0] & 0x04)".
4002 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4003 b1
= new_block(JMP(BPF_JSET
));
4009 * AND that with the checks for data and management
4019 * For control frames, there is no DA.
4021 * For management frames, DA is at an
4022 * offset of 4 from the beginning of
4025 * For data frames, DA is at an offset
4026 * of 4 from the beginning of the packet
4027 * if To DS is clear and at an offset of
4028 * 16 from the beginning of the packet
4033 * Generate the tests to be done for data frames.
4035 * First, check for To DS set, i.e. "link[1] & 0x01".
4037 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
4038 b1
= new_block(JMP(BPF_JSET
));
4039 b1
->s
.k
= 0x01; /* To DS */
4043 * If To DS is set, the DA is at 16.
4045 b0
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
4049 * Now, check for To DS not set, i.e. check
4050 * "!(link[1] & 0x01)".
4052 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
4053 b2
= new_block(JMP(BPF_JSET
));
4054 b2
->s
.k
= 0x01; /* To DS */
4059 * If To DS is not set, the DA is at 4.
4061 b1
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
4065 * Now OR together the last two checks. That gives
4066 * the complete set of checks for data frames.
4071 * Now check for a data frame.
4072 * I.e, check "link[0] & 0x08".
4074 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4075 b1
= new_block(JMP(BPF_JSET
));
4080 * AND that with the checks done for data frames.
4085 * If the high-order bit of the type value is 0, this
4086 * is a management frame.
4087 * I.e, check "!(link[0] & 0x08)".
4089 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4090 b2
= new_block(JMP(BPF_JSET
));
4096 * For management frames, the DA is at 4.
4098 b1
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
4102 * OR that with the checks done for data frames.
4103 * That gives the checks done for management and
4109 * If the low-order bit of the type value is 1,
4110 * this is either a control frame or a frame
4111 * with a reserved type, and thus not a
4114 * I.e., check "!(link[0] & 0x04)".
4116 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4117 b1
= new_block(JMP(BPF_JSET
));
4123 * AND that with the checks for data and management
4131 * Not present in management frames; addr1 in other
4136 * If the high-order bit of the type value is 0, this
4137 * is a management frame.
4138 * I.e, check "(link[0] & 0x08)".
4140 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4141 b1
= new_block(JMP(BPF_JSET
));
4148 b0
= gen_bcmp(OR_LINK
, 4, 6, eaddr
);
4151 * AND that with the check of addr1.
4158 * Not present in management frames; addr2, if present,
4163 * Not present in CTS or ACK control frames.
4165 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4166 IEEE80211_FC0_TYPE_MASK
);
4168 b1
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_CTS
,
4169 IEEE80211_FC0_SUBTYPE_MASK
);
4171 b2
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_ACK
,
4172 IEEE80211_FC0_SUBTYPE_MASK
);
4178 * If the high-order bit of the type value is 0, this
4179 * is a management frame.
4180 * I.e, check "(link[0] & 0x08)".
4182 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
4183 b1
= new_block(JMP(BPF_JSET
));
4188 * AND that with the check for frames other than
4189 * CTS and ACK frames.
4196 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4201 * XXX - add BSSID keyword?
4204 return (gen_bcmp(OR_LINK
, 4, 6, eaddr
));
4208 * Not present in CTS or ACK control frames.
4210 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4211 IEEE80211_FC0_TYPE_MASK
);
4213 b1
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_CTS
,
4214 IEEE80211_FC0_SUBTYPE_MASK
);
4216 b2
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_SUBTYPE_ACK
,
4217 IEEE80211_FC0_SUBTYPE_MASK
);
4221 b1
= gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4227 * Not present in control frames.
4229 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, IEEE80211_FC0_TYPE_CTL
,
4230 IEEE80211_FC0_TYPE_MASK
);
4232 b1
= gen_bcmp(OR_LINK
, 16, 6, eaddr
);
4238 * Present only if the direction mask has both "From DS"
4239 * and "To DS" set. Neither control frames nor management
4240 * frames should have both of those set, so we don't
4241 * check the frame type.
4243 b0
= gen_mcmp(OR_LINK
, 1, BPF_B
,
4244 IEEE80211_FC1_DIR_DSTODS
, IEEE80211_FC1_DIR_MASK
);
4245 b1
= gen_bcmp(OR_LINK
, 24, 6, eaddr
);
4250 b0
= gen_wlanhostop(eaddr
, Q_SRC
);
4251 b1
= gen_wlanhostop(eaddr
, Q_DST
);
4257 b0
= gen_wlanhostop(eaddr
, Q_SRC
);
4258 b1
= gen_wlanhostop(eaddr
, Q_DST
);
4267 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel.
4268 * (We assume that the addresses are IEEE 48-bit MAC addresses,
4269 * as the RFC states.)
4271 static struct block
*
4272 gen_ipfchostop(eaddr
, dir
)
4273 register const u_char
*eaddr
;
4276 register struct block
*b0
, *b1
;
4280 return gen_bcmp(OR_LINK
, 10, 6, eaddr
);
4283 return gen_bcmp(OR_LINK
, 2, 6, eaddr
);
4286 b0
= gen_ipfchostop(eaddr
, Q_SRC
);
4287 b1
= gen_ipfchostop(eaddr
, Q_DST
);
4293 b0
= gen_ipfchostop(eaddr
, Q_SRC
);
4294 b1
= gen_ipfchostop(eaddr
, Q_DST
);
4299 bpf_error("'addr1' is only supported on 802.11");
4303 bpf_error("'addr2' is only supported on 802.11");
4307 bpf_error("'addr3' is only supported on 802.11");
4311 bpf_error("'addr4' is only supported on 802.11");
4315 bpf_error("'ra' is only supported on 802.11");
4319 bpf_error("'ta' is only supported on 802.11");
4327 * This is quite tricky because there may be pad bytes in front of the
4328 * DECNET header, and then there are two possible data packet formats that
4329 * carry both src and dst addresses, plus 5 packet types in a format that
4330 * carries only the src node, plus 2 types that use a different format and
4331 * also carry just the src node.
4335 * Instead of doing those all right, we just look for data packets with
4336 * 0 or 1 bytes of padding. If you want to look at other packets, that
4337 * will require a lot more hacking.
4339 * To add support for filtering on DECNET "areas" (network numbers)
4340 * one would want to add a "mask" argument to this routine. That would
4341 * make the filter even more inefficient, although one could be clever
4342 * and not generate masking instructions if the mask is 0xFFFF.
4344 static struct block
*
4345 gen_dnhostop(addr
, dir
)
4349 struct block
*b0
, *b1
, *b2
, *tmp
;
4350 u_int offset_lh
; /* offset if long header is received */
4351 u_int offset_sh
; /* offset if short header is received */
4356 offset_sh
= 1; /* follows flags */
4357 offset_lh
= 7; /* flgs,darea,dsubarea,HIORD */
4361 offset_sh
= 3; /* follows flags, dstnode */
4362 offset_lh
= 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
4366 /* Inefficient because we do our Calvinball dance twice */
4367 b0
= gen_dnhostop(addr
, Q_SRC
);
4368 b1
= gen_dnhostop(addr
, Q_DST
);
4374 /* Inefficient because we do our Calvinball dance twice */
4375 b0
= gen_dnhostop(addr
, Q_SRC
);
4376 b1
= gen_dnhostop(addr
, Q_DST
);
4381 bpf_error("ISO host filtering not implemented");
4386 b0
= gen_linktype(ETHERTYPE_DN
);
4387 /* Check for pad = 1, long header case */
4388 tmp
= gen_mcmp(OR_NET
, 2, BPF_H
,
4389 (bpf_int32
)ntohs(0x0681), (bpf_int32
)ntohs(0x07FF));
4390 b1
= gen_cmp(OR_NET
, 2 + 1 + offset_lh
,
4391 BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4393 /* Check for pad = 0, long header case */
4394 tmp
= gen_mcmp(OR_NET
, 2, BPF_B
, (bpf_int32
)0x06, (bpf_int32
)0x7);
4395 b2
= gen_cmp(OR_NET
, 2 + offset_lh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4398 /* Check for pad = 1, short header case */
4399 tmp
= gen_mcmp(OR_NET
, 2, BPF_H
,
4400 (bpf_int32
)ntohs(0x0281), (bpf_int32
)ntohs(0x07FF));
4401 b2
= gen_cmp(OR_NET
, 2 + 1 + offset_sh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4404 /* Check for pad = 0, short header case */
4405 tmp
= gen_mcmp(OR_NET
, 2, BPF_B
, (bpf_int32
)0x02, (bpf_int32
)0x7);
4406 b2
= gen_cmp(OR_NET
, 2 + offset_sh
, BPF_H
, (bpf_int32
)ntohs((u_short
)addr
));
4410 /* Combine with test for linktype */
4416 * Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets;
4417 * test the bottom-of-stack bit, and then check the version number
4418 * field in the IP header.
4420 static struct block
*
4421 gen_mpls_linktype(proto
)
4424 struct block
*b0
, *b1
;
4429 /* match the bottom-of-stack bit */
4430 b0
= gen_mcmp(OR_NET
, -2, BPF_B
, 0x01, 0x01);
4431 /* match the IPv4 version number */
4432 b1
= gen_mcmp(OR_NET
, 0, BPF_B
, 0x40, 0xf0);
4437 /* match the bottom-of-stack bit */
4438 b0
= gen_mcmp(OR_NET
, -2, BPF_B
, 0x01, 0x01);
4439 /* match the IPv4 version number */
4440 b1
= gen_mcmp(OR_NET
, 0, BPF_B
, 0x60, 0xf0);
4449 static struct block
*
4450 gen_host(addr
, mask
, proto
, dir
, type
)
4457 struct block
*b0
, *b1
;
4458 const char *typestr
;
4468 b0
= gen_host(addr
, mask
, Q_IP
, dir
, type
);
4470 * Only check for non-IPv4 addresses if we're not
4471 * checking MPLS-encapsulated packets.
4473 if (label_stack_depth
== 0) {
4474 b1
= gen_host(addr
, mask
, Q_ARP
, dir
, type
);
4476 b0
= gen_host(addr
, mask
, Q_RARP
, dir
, type
);
4482 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_IP
, 12, 16);
4485 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_REVARP
, 14, 24);
4488 return gen_hostop(addr
, mask
, dir
, ETHERTYPE_ARP
, 14, 24);
4491 bpf_error("'tcp' modifier applied to %s", typestr
);
4494 bpf_error("'sctp' modifier applied to %s", typestr
);
4497 bpf_error("'udp' modifier applied to %s", typestr
);
4500 bpf_error("'icmp' modifier applied to %s", typestr
);
4503 bpf_error("'igmp' modifier applied to %s", typestr
);
4506 bpf_error("'igrp' modifier applied to %s", typestr
);
4509 bpf_error("'pim' modifier applied to %s", typestr
);
4512 bpf_error("'vrrp' modifier applied to %s", typestr
);
4515 bpf_error("'carp' modifier applied to %s", typestr
);
4518 bpf_error("ATALK host filtering not implemented");
4521 bpf_error("AARP host filtering not implemented");
4524 return gen_dnhostop(addr
, dir
);
4527 bpf_error("SCA host filtering not implemented");
4530 bpf_error("LAT host filtering not implemented");
4533 bpf_error("MOPDL host filtering not implemented");
4536 bpf_error("MOPRC host filtering not implemented");
4540 bpf_error("'ip6' modifier applied to ip host");
4543 bpf_error("'icmp6' modifier applied to %s", typestr
);
4547 bpf_error("'ah' modifier applied to %s", typestr
);
4550 bpf_error("'esp' modifier applied to %s", typestr
);
4553 bpf_error("ISO host filtering not implemented");
4556 bpf_error("'esis' modifier applied to %s", typestr
);
4559 bpf_error("'isis' modifier applied to %s", typestr
);
4562 bpf_error("'clnp' modifier applied to %s", typestr
);
4565 bpf_error("'stp' modifier applied to %s", typestr
);
4568 bpf_error("IPX host filtering not implemented");
4571 bpf_error("'netbeui' modifier applied to %s", typestr
);
4574 bpf_error("'radio' modifier applied to %s", typestr
);
4583 static struct block
*
4584 gen_host6(addr
, mask
, proto
, dir
, type
)
4585 struct in6_addr
*addr
;
4586 struct in6_addr
*mask
;
4591 const char *typestr
;
4601 return gen_host6(addr
, mask
, Q_IPV6
, dir
, type
);
4604 bpf_error("'ip' modifier applied to ip6 %s", typestr
);
4607 bpf_error("'rarp' modifier applied to ip6 %s", typestr
);
4610 bpf_error("'arp' modifier applied to ip6 %s", typestr
);
4613 bpf_error("'sctp' modifier applied to %s", typestr
);
4616 bpf_error("'tcp' modifier applied to %s", typestr
);
4619 bpf_error("'udp' modifier applied to %s", typestr
);
4622 bpf_error("'icmp' modifier applied to %s", typestr
);
4625 bpf_error("'igmp' modifier applied to %s", typestr
);
4628 bpf_error("'igrp' modifier applied to %s", typestr
);
4631 bpf_error("'pim' modifier applied to %s", typestr
);
4634 bpf_error("'vrrp' modifier applied to %s", typestr
);
4637 bpf_error("'carp' modifier applied to %s", typestr
);
4640 bpf_error("ATALK host filtering not implemented");
4643 bpf_error("AARP host filtering not implemented");
4646 bpf_error("'decnet' modifier applied to ip6 %s", typestr
);
4649 bpf_error("SCA host filtering not implemented");
4652 bpf_error("LAT host filtering not implemented");
4655 bpf_error("MOPDL host filtering not implemented");
4658 bpf_error("MOPRC host filtering not implemented");
4661 return gen_hostop6(addr
, mask
, dir
, ETHERTYPE_IPV6
, 8, 24);
4664 bpf_error("'icmp6' modifier applied to %s", typestr
);
4667 bpf_error("'ah' modifier applied to %s", typestr
);
4670 bpf_error("'esp' modifier applied to %s", typestr
);
4673 bpf_error("ISO host filtering not implemented");
4676 bpf_error("'esis' modifier applied to %s", typestr
);
4679 bpf_error("'isis' modifier applied to %s", typestr
);
4682 bpf_error("'clnp' modifier applied to %s", typestr
);
4685 bpf_error("'stp' modifier applied to %s", typestr
);
4688 bpf_error("IPX host filtering not implemented");
4691 bpf_error("'netbeui' modifier applied to %s", typestr
);
4694 bpf_error("'radio' modifier applied to %s", typestr
);
4704 static struct block
*
4705 gen_gateway(eaddr
, alist
, proto
, dir
)
4706 const u_char
*eaddr
;
4707 bpf_u_int32
**alist
;
4711 struct block
*b0
, *b1
, *tmp
;
4714 bpf_error("direction applied to 'gateway'");
4723 case DLT_NETANALYZER
:
4724 case DLT_NETANALYZER_TRANSPARENT
:
4725 b0
= gen_ehostop(eaddr
, Q_OR
);
4728 b0
= gen_fhostop(eaddr
, Q_OR
);
4731 b0
= gen_thostop(eaddr
, Q_OR
);
4733 case DLT_IEEE802_11
:
4734 case DLT_PRISM_HEADER
:
4735 case DLT_IEEE802_11_RADIO_AVS
:
4736 case DLT_IEEE802_11_RADIO
:
4738 b0
= gen_wlanhostop(eaddr
, Q_OR
);
4743 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4745 * Check that the packet doesn't begin with an
4746 * LE Control marker. (We've already generated
4749 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
4754 * Now check the MAC address.
4756 b0
= gen_ehostop(eaddr
, Q_OR
);
4759 case DLT_IP_OVER_FC
:
4760 b0
= gen_ipfchostop(eaddr
, Q_OR
);
4764 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4766 b1
= gen_host(**alist
++, 0xffffffff, proto
, Q_OR
, Q_HOST
);
4768 tmp
= gen_host(**alist
++, 0xffffffff, proto
, Q_OR
,
4777 bpf_error("illegal modifier of 'gateway'");
4783 gen_proto_abbrev(proto
)
4792 b1
= gen_proto(IPPROTO_SCTP
, Q_IP
, Q_DEFAULT
);
4794 b0
= gen_proto(IPPROTO_SCTP
, Q_IPV6
, Q_DEFAULT
);
4800 b1
= gen_proto(IPPROTO_TCP
, Q_IP
, Q_DEFAULT
);
4802 b0
= gen_proto(IPPROTO_TCP
, Q_IPV6
, Q_DEFAULT
);
4808 b1
= gen_proto(IPPROTO_UDP
, Q_IP
, Q_DEFAULT
);
4810 b0
= gen_proto(IPPROTO_UDP
, Q_IPV6
, Q_DEFAULT
);
4816 b1
= gen_proto(IPPROTO_ICMP
, Q_IP
, Q_DEFAULT
);
4819 #ifndef IPPROTO_IGMP
4820 #define IPPROTO_IGMP 2
4824 b1
= gen_proto(IPPROTO_IGMP
, Q_IP
, Q_DEFAULT
);
4827 #ifndef IPPROTO_IGRP
4828 #define IPPROTO_IGRP 9
4831 b1
= gen_proto(IPPROTO_IGRP
, Q_IP
, Q_DEFAULT
);
4835 #define IPPROTO_PIM 103
4839 b1
= gen_proto(IPPROTO_PIM
, Q_IP
, Q_DEFAULT
);
4841 b0
= gen_proto(IPPROTO_PIM
, Q_IPV6
, Q_DEFAULT
);
4846 #ifndef IPPROTO_VRRP
4847 #define IPPROTO_VRRP 112
4851 b1
= gen_proto(IPPROTO_VRRP
, Q_IP
, Q_DEFAULT
);
4854 #ifndef IPPROTO_CARP
4855 #define IPPROTO_CARP 112
4859 b1
= gen_proto(IPPROTO_CARP
, Q_IP
, Q_DEFAULT
);
4863 b1
= gen_linktype(ETHERTYPE_IP
);
4867 b1
= gen_linktype(ETHERTYPE_ARP
);
4871 b1
= gen_linktype(ETHERTYPE_REVARP
);
4875 bpf_error("link layer applied in wrong context");
4878 b1
= gen_linktype(ETHERTYPE_ATALK
);
4882 b1
= gen_linktype(ETHERTYPE_AARP
);
4886 b1
= gen_linktype(ETHERTYPE_DN
);
4890 b1
= gen_linktype(ETHERTYPE_SCA
);
4894 b1
= gen_linktype(ETHERTYPE_LAT
);
4898 b1
= gen_linktype(ETHERTYPE_MOPDL
);
4902 b1
= gen_linktype(ETHERTYPE_MOPRC
);
4907 b1
= gen_linktype(ETHERTYPE_IPV6
);
4910 #ifndef IPPROTO_ICMPV6
4911 #define IPPROTO_ICMPV6 58
4914 b1
= gen_proto(IPPROTO_ICMPV6
, Q_IPV6
, Q_DEFAULT
);
4919 #define IPPROTO_AH 51
4922 b1
= gen_proto(IPPROTO_AH
, Q_IP
, Q_DEFAULT
);
4924 b0
= gen_proto(IPPROTO_AH
, Q_IPV6
, Q_DEFAULT
);
4930 #define IPPROTO_ESP 50
4933 b1
= gen_proto(IPPROTO_ESP
, Q_IP
, Q_DEFAULT
);
4935 b0
= gen_proto(IPPROTO_ESP
, Q_IPV6
, Q_DEFAULT
);
4941 b1
= gen_linktype(LLCSAP_ISONS
);
4945 b1
= gen_proto(ISO9542_ESIS
, Q_ISO
, Q_DEFAULT
);
4949 b1
= gen_proto(ISO10589_ISIS
, Q_ISO
, Q_DEFAULT
);
4952 case Q_ISIS_L1
: /* all IS-IS Level1 PDU-Types */
4953 b0
= gen_proto(ISIS_L1_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4954 b1
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
); /* FIXME extract the circuit-type bits */
4956 b0
= gen_proto(ISIS_L1_LSP
, Q_ISIS
, Q_DEFAULT
);
4958 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4960 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4964 case Q_ISIS_L2
: /* all IS-IS Level2 PDU-Types */
4965 b0
= gen_proto(ISIS_L2_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4966 b1
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
); /* FIXME extract the circuit-type bits */
4968 b0
= gen_proto(ISIS_L2_LSP
, Q_ISIS
, Q_DEFAULT
);
4970 b0
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4972 b0
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
4976 case Q_ISIS_IIH
: /* all IS-IS Hello PDU-Types */
4977 b0
= gen_proto(ISIS_L1_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4978 b1
= gen_proto(ISIS_L2_LAN_IIH
, Q_ISIS
, Q_DEFAULT
);
4980 b0
= gen_proto(ISIS_PTP_IIH
, Q_ISIS
, Q_DEFAULT
);
4985 b0
= gen_proto(ISIS_L1_LSP
, Q_ISIS
, Q_DEFAULT
);
4986 b1
= gen_proto(ISIS_L2_LSP
, Q_ISIS
, Q_DEFAULT
);
4991 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
4992 b1
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
4994 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
4996 b0
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
5001 b0
= gen_proto(ISIS_L1_CSNP
, Q_ISIS
, Q_DEFAULT
);
5002 b1
= gen_proto(ISIS_L2_CSNP
, Q_ISIS
, Q_DEFAULT
);
5007 b0
= gen_proto(ISIS_L1_PSNP
, Q_ISIS
, Q_DEFAULT
);
5008 b1
= gen_proto(ISIS_L2_PSNP
, Q_ISIS
, Q_DEFAULT
);
5013 b1
= gen_proto(ISO8473_CLNP
, Q_ISO
, Q_DEFAULT
);
5017 b1
= gen_linktype(LLCSAP_8021D
);
5021 b1
= gen_linktype(LLCSAP_IPX
);
5025 b1
= gen_linktype(LLCSAP_NETBEUI
);
5029 bpf_error("'radio' is not a valid protocol type");
5037 static struct block
*
5043 /* not IPv4 frag other than the first frag */
5044 s
= gen_load_a(OR_NET
, 6, BPF_H
);
5045 b
= new_block(JMP(BPF_JSET
));
5054 * Generate a comparison to a port value in the transport-layer header
5055 * at the specified offset from the beginning of that header.
5057 * XXX - this handles a variable-length prefix preceding the link-layer
5058 * header, such as the radiotap or AVS radio prefix, but doesn't handle
5059 * variable-length link-layer headers (such as Token Ring or 802.11
5062 static struct block
*
5063 gen_portatom(off
, v
)
5067 return gen_cmp(OR_TRAN_IPV4
, off
, BPF_H
, v
);
5071 static struct block
*
5072 gen_portatom6(off
, v
)
5076 return gen_cmp(OR_TRAN_IPV6
, off
, BPF_H
, v
);
5081 gen_portop(port
, proto
, dir
)
5082 int port
, proto
, dir
;
5084 struct block
*b0
, *b1
, *tmp
;
5086 /* ip proto 'proto' and not a fragment other than the first fragment */
5087 tmp
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)proto
);
5093 b1
= gen_portatom(0, (bpf_int32
)port
);
5097 b1
= gen_portatom(2, (bpf_int32
)port
);
5102 tmp
= gen_portatom(0, (bpf_int32
)port
);
5103 b1
= gen_portatom(2, (bpf_int32
)port
);
5108 tmp
= gen_portatom(0, (bpf_int32
)port
);
5109 b1
= gen_portatom(2, (bpf_int32
)port
);
5121 static struct block
*
5122 gen_port(port
, ip_proto
, dir
)
5127 struct block
*b0
, *b1
, *tmp
;
5132 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
5133 * not LLC encapsulation with LLCSAP_IP.
5135 * For IEEE 802 networks - which includes 802.5 token ring
5136 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
5137 * says that SNAP encapsulation is used, not LLC encapsulation
5140 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
5141 * RFC 2225 say that SNAP encapsulation is used, not LLC
5142 * encapsulation with LLCSAP_IP.
5144 * So we always check for ETHERTYPE_IP.
5146 b0
= gen_linktype(ETHERTYPE_IP
);
5152 b1
= gen_portop(port
, ip_proto
, dir
);
5156 tmp
= gen_portop(port
, IPPROTO_TCP
, dir
);
5157 b1
= gen_portop(port
, IPPROTO_UDP
, dir
);
5159 tmp
= gen_portop(port
, IPPROTO_SCTP
, dir
);
5172 gen_portop6(port
, proto
, dir
)
5173 int port
, proto
, dir
;
5175 struct block
*b0
, *b1
, *tmp
;
5177 /* ip6 proto 'proto' */
5178 /* XXX - catch the first fragment of a fragmented packet? */
5179 b0
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)proto
);
5183 b1
= gen_portatom6(0, (bpf_int32
)port
);
5187 b1
= gen_portatom6(2, (bpf_int32
)port
);
5192 tmp
= gen_portatom6(0, (bpf_int32
)port
);
5193 b1
= gen_portatom6(2, (bpf_int32
)port
);
5198 tmp
= gen_portatom6(0, (bpf_int32
)port
);
5199 b1
= gen_portatom6(2, (bpf_int32
)port
);
5211 static struct block
*
5212 gen_port6(port
, ip_proto
, dir
)
5217 struct block
*b0
, *b1
, *tmp
;
5219 /* link proto ip6 */
5220 b0
= gen_linktype(ETHERTYPE_IPV6
);
5226 b1
= gen_portop6(port
, ip_proto
, dir
);
5230 tmp
= gen_portop6(port
, IPPROTO_TCP
, dir
);
5231 b1
= gen_portop6(port
, IPPROTO_UDP
, dir
);
5233 tmp
= gen_portop6(port
, IPPROTO_SCTP
, dir
);
5245 /* gen_portrange code */
5246 static struct block
*
5247 gen_portrangeatom(off
, v1
, v2
)
5251 struct block
*b1
, *b2
;
5255 * Reverse the order of the ports, so v1 is the lower one.
5264 b1
= gen_cmp_ge(OR_TRAN_IPV4
, off
, BPF_H
, v1
);
5265 b2
= gen_cmp_le(OR_TRAN_IPV4
, off
, BPF_H
, v2
);
5273 gen_portrangeop(port1
, port2
, proto
, dir
)
5278 struct block
*b0
, *b1
, *tmp
;
5280 /* ip proto 'proto' and not a fragment other than the first fragment */
5281 tmp
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)proto
);
5287 b1
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5291 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5296 tmp
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5297 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5302 tmp
= gen_portrangeatom(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5303 b1
= gen_portrangeatom(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5315 static struct block
*
5316 gen_portrange(port1
, port2
, ip_proto
, dir
)
5321 struct block
*b0
, *b1
, *tmp
;
5324 b0
= gen_linktype(ETHERTYPE_IP
);
5330 b1
= gen_portrangeop(port1
, port2
, ip_proto
, dir
);
5334 tmp
= gen_portrangeop(port1
, port2
, IPPROTO_TCP
, dir
);
5335 b1
= gen_portrangeop(port1
, port2
, IPPROTO_UDP
, dir
);
5337 tmp
= gen_portrangeop(port1
, port2
, IPPROTO_SCTP
, dir
);
5349 static struct block
*
5350 gen_portrangeatom6(off
, v1
, v2
)
5354 struct block
*b1
, *b2
;
5358 * Reverse the order of the ports, so v1 is the lower one.
5367 b1
= gen_cmp_ge(OR_TRAN_IPV6
, off
, BPF_H
, v1
);
5368 b2
= gen_cmp_le(OR_TRAN_IPV6
, off
, BPF_H
, v2
);
5376 gen_portrangeop6(port1
, port2
, proto
, dir
)
5381 struct block
*b0
, *b1
, *tmp
;
5383 /* ip6 proto 'proto' */
5384 /* XXX - catch the first fragment of a fragmented packet? */
5385 b0
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)proto
);
5389 b1
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5393 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5398 tmp
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5399 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5404 tmp
= gen_portrangeatom6(0, (bpf_int32
)port1
, (bpf_int32
)port2
);
5405 b1
= gen_portrangeatom6(2, (bpf_int32
)port1
, (bpf_int32
)port2
);
5417 static struct block
*
5418 gen_portrange6(port1
, port2
, ip_proto
, dir
)
5423 struct block
*b0
, *b1
, *tmp
;
5425 /* link proto ip6 */
5426 b0
= gen_linktype(ETHERTYPE_IPV6
);
5432 b1
= gen_portrangeop6(port1
, port2
, ip_proto
, dir
);
5436 tmp
= gen_portrangeop6(port1
, port2
, IPPROTO_TCP
, dir
);
5437 b1
= gen_portrangeop6(port1
, port2
, IPPROTO_UDP
, dir
);
5439 tmp
= gen_portrangeop6(port1
, port2
, IPPROTO_SCTP
, dir
);
5452 lookup_proto(name
, proto
)
5453 register const char *name
;
5463 v
= pcap_nametoproto(name
);
5464 if (v
== PROTO_UNDEF
)
5465 bpf_error("unknown ip proto '%s'", name
);
5469 /* XXX should look up h/w protocol type based on linktype */
5470 v
= pcap_nametoeproto(name
);
5471 if (v
== PROTO_UNDEF
) {
5472 v
= pcap_nametollc(name
);
5473 if (v
== PROTO_UNDEF
)
5474 bpf_error("unknown ether proto '%s'", name
);
5479 if (strcmp(name
, "esis") == 0)
5481 else if (strcmp(name
, "isis") == 0)
5483 else if (strcmp(name
, "clnp") == 0)
5486 bpf_error("unknown osi proto '%s'", name
);
5506 static struct block
*
5507 gen_protochain(v
, proto
, dir
)
5512 #ifdef NO_PROTOCHAIN
5513 return gen_proto(v
, proto
, dir
);
5515 struct block
*b0
, *b
;
5516 struct slist
*s
[100];
5517 int fix2
, fix3
, fix4
, fix5
;
5518 int ahcheck
, again
, end
;
5520 int reg2
= alloc_reg();
5522 memset(s
, 0, sizeof(s
));
5523 fix2
= fix3
= fix4
= fix5
= 0;
5530 b0
= gen_protochain(v
, Q_IP
, dir
);
5531 b
= gen_protochain(v
, Q_IPV6
, dir
);
5535 bpf_error("bad protocol applied for 'protochain'");
5540 * We don't handle variable-length prefixes before the link-layer
5541 * header, or variable-length link-layer headers, here yet.
5542 * We might want to add BPF instructions to do the protochain
5543 * work, to simplify that and, on platforms that have a BPF
5544 * interpreter with the new instructions, let the filtering
5545 * be done in the kernel. (We already require a modified BPF
5546 * engine to do the protochain stuff, to support backward
5547 * branches, and backward branch support is unlikely to appear
5548 * in kernel BPF engines.)
5552 case DLT_IEEE802_11
:
5553 case DLT_PRISM_HEADER
:
5554 case DLT_IEEE802_11_RADIO_AVS
:
5555 case DLT_IEEE802_11_RADIO
:
5557 bpf_error("'protochain' not supported with 802.11");
5560 no_optimize
= 1; /*this code is not compatible with optimzer yet */
5563 * s[0] is a dummy entry to protect other BPF insn from damage
5564 * by s[fix] = foo with uninitialized variable "fix". It is somewhat
5565 * hard to find interdependency made by jump table fixup.
5568 s
[i
] = new_stmt(0); /*dummy*/
5573 b0
= gen_linktype(ETHERTYPE_IP
);
5576 s
[i
] = new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
5577 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 9;
5579 /* X = ip->ip_hl << 2 */
5580 s
[i
] = new_stmt(BPF_LDX
|BPF_MSH
|BPF_B
);
5581 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5586 b0
= gen_linktype(ETHERTYPE_IPV6
);
5588 /* A = ip6->ip_nxt */
5589 s
[i
] = new_stmt(BPF_LD
|BPF_ABS
|BPF_B
);
5590 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 6;
5592 /* X = sizeof(struct ip6_hdr) */
5593 s
[i
] = new_stmt(BPF_LDX
|BPF_IMM
);
5599 bpf_error("unsupported proto to gen_protochain");
5603 /* again: if (A == v) goto end; else fall through; */
5605 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5607 s
[i
]->s
.jt
= NULL
; /*later*/
5608 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5612 #ifndef IPPROTO_NONE
5613 #define IPPROTO_NONE 59
5615 /* if (A == IPPROTO_NONE) goto end */
5616 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5617 s
[i
]->s
.jt
= NULL
; /*later*/
5618 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5619 s
[i
]->s
.k
= IPPROTO_NONE
;
5620 s
[fix5
]->s
.jf
= s
[i
];
5625 if (proto
== Q_IPV6
) {
5626 int v6start
, v6end
, v6advance
, j
;
5629 /* if (A == IPPROTO_HOPOPTS) goto v6advance */
5630 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5631 s
[i
]->s
.jt
= NULL
; /*later*/
5632 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5633 s
[i
]->s
.k
= IPPROTO_HOPOPTS
;
5634 s
[fix2
]->s
.jf
= s
[i
];
5636 /* if (A == IPPROTO_DSTOPTS) goto v6advance */
5637 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5638 s
[i
]->s
.jt
= NULL
; /*later*/
5639 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5640 s
[i
]->s
.k
= IPPROTO_DSTOPTS
;
5642 /* if (A == IPPROTO_ROUTING) goto v6advance */
5643 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5644 s
[i
]->s
.jt
= NULL
; /*later*/
5645 s
[i
]->s
.jf
= NULL
; /*update in next stmt*/
5646 s
[i
]->s
.k
= IPPROTO_ROUTING
;
5648 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
5649 s
[i
- 1]->s
.jf
= s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5650 s
[i
]->s
.jt
= NULL
; /*later*/
5651 s
[i
]->s
.jf
= NULL
; /*later*/
5652 s
[i
]->s
.k
= IPPROTO_FRAGMENT
;
5662 * A = P[X + packet head];
5663 * X = X + (P[X + packet head + 1] + 1) * 8;
5665 /* A = P[X + packet head] */
5666 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5667 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5670 s
[i
] = new_stmt(BPF_ST
);
5673 /* A = P[X + packet head + 1]; */
5674 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5675 s
[i
]->s
.k
= off_macpl
+ off_nl
+ 1;
5678 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5682 s
[i
] = new_stmt(BPF_ALU
|BPF_MUL
|BPF_K
);
5686 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
);
5690 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5693 s
[i
] = new_stmt(BPF_LD
|BPF_MEM
);
5697 /* goto again; (must use BPF_JA for backward jump) */
5698 s
[i
] = new_stmt(BPF_JMP
|BPF_JA
);
5699 s
[i
]->s
.k
= again
- i
- 1;
5700 s
[i
- 1]->s
.jf
= s
[i
];
5704 for (j
= v6start
; j
<= v6end
; j
++)
5705 s
[j
]->s
.jt
= s
[v6advance
];
5710 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5712 s
[fix2
]->s
.jf
= s
[i
];
5718 /* if (A == IPPROTO_AH) then fall through; else goto end; */
5719 s
[i
] = new_stmt(BPF_JMP
|BPF_JEQ
|BPF_K
);
5720 s
[i
]->s
.jt
= NULL
; /*later*/
5721 s
[i
]->s
.jf
= NULL
; /*later*/
5722 s
[i
]->s
.k
= IPPROTO_AH
;
5724 s
[fix3
]->s
.jf
= s
[ahcheck
];
5731 * X = X + (P[X + 1] + 2) * 4;
5734 s
[i
- 1]->s
.jt
= s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5736 /* A = P[X + packet head]; */
5737 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5738 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5741 s
[i
] = new_stmt(BPF_ST
);
5745 s
[i
- 1]->s
.jt
= s
[i
] = new_stmt(BPF_MISC
|BPF_TXA
);
5748 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5752 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5754 /* A = P[X + packet head] */
5755 s
[i
] = new_stmt(BPF_LD
|BPF_IND
|BPF_B
);
5756 s
[i
]->s
.k
= off_macpl
+ off_nl
;
5759 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5763 s
[i
] = new_stmt(BPF_ALU
|BPF_MUL
|BPF_K
);
5767 s
[i
] = new_stmt(BPF_MISC
|BPF_TAX
);
5770 s
[i
] = new_stmt(BPF_LD
|BPF_MEM
);
5774 /* goto again; (must use BPF_JA for backward jump) */
5775 s
[i
] = new_stmt(BPF_JMP
|BPF_JA
);
5776 s
[i
]->s
.k
= again
- i
- 1;
5781 s
[i
] = new_stmt(BPF_ALU
|BPF_ADD
|BPF_K
);
5783 s
[fix2
]->s
.jt
= s
[end
];
5784 s
[fix4
]->s
.jf
= s
[end
];
5785 s
[fix5
]->s
.jt
= s
[end
];
5792 for (i
= 0; i
< max
- 1; i
++)
5793 s
[i
]->next
= s
[i
+ 1];
5794 s
[max
- 1]->next
= NULL
;
5799 b
= new_block(JMP(BPF_JEQ
));
5800 b
->stmts
= s
[1]; /*remember, s[0] is dummy*/
5810 static struct block
*
5811 gen_check_802_11_data_frame()
5814 struct block
*b0
, *b1
;
5817 * A data frame has the 0x08 bit (b3) in the frame control field set
5818 * and the 0x04 bit (b2) clear.
5820 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
5821 b0
= new_block(JMP(BPF_JSET
));
5825 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
5826 b1
= new_block(JMP(BPF_JSET
));
5837 * Generate code that checks whether the packet is a packet for protocol
5838 * <proto> and whether the type field in that protocol's header has
5839 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an
5840 * IP packet and checks the protocol number in the IP header against <v>.
5842 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks
5843 * against Q_IP and Q_IPV6.
5845 static struct block
*
5846 gen_proto(v
, proto
, dir
)
5851 struct block
*b0
, *b1
;
5858 if (dir
!= Q_DEFAULT
)
5859 bpf_error("direction applied to 'proto'");
5864 b0
= gen_proto(v
, Q_IP
, dir
);
5865 b1
= gen_proto(v
, Q_IPV6
, dir
);
5873 * For FDDI, RFC 1188 says that SNAP encapsulation is used,
5874 * not LLC encapsulation with LLCSAP_IP.
5876 * For IEEE 802 networks - which includes 802.5 token ring
5877 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
5878 * says that SNAP encapsulation is used, not LLC encapsulation
5881 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
5882 * RFC 2225 say that SNAP encapsulation is used, not LLC
5883 * encapsulation with LLCSAP_IP.
5885 * So we always check for ETHERTYPE_IP.
5887 b0
= gen_linktype(ETHERTYPE_IP
);
5889 b1
= gen_cmp(OR_NET
, 9, BPF_B
, (bpf_int32
)v
);
5891 b1
= gen_protochain(v
, Q_IP
);
5901 * Frame Relay packets typically have an OSI
5902 * NLPID at the beginning; "gen_linktype(LLCSAP_ISONS)"
5903 * generates code to check for all the OSI
5904 * NLPIDs, so calling it and then adding a check
5905 * for the particular NLPID for which we're
5906 * looking is bogus, as we can just check for
5909 * What we check for is the NLPID and a frame
5910 * control field value of UI, i.e. 0x03 followed
5913 * XXX - assumes a 2-byte Frame Relay header with
5914 * DLCI and flags. What if the address is longer?
5916 * XXX - what about SNAP-encapsulated frames?
5918 return gen_cmp(OR_LINK
, 2, BPF_H
, (0x03<<8) | v
);
5924 * Cisco uses an Ethertype lookalike - for OSI,
5927 b0
= gen_linktype(LLCSAP_ISONS
<<8 | LLCSAP_ISONS
);
5928 /* OSI in C-HDLC is stuffed with a fudge byte */
5929 b1
= gen_cmp(OR_NET_NOSNAP
, 1, BPF_B
, (long)v
);
5934 b0
= gen_linktype(LLCSAP_ISONS
);
5935 b1
= gen_cmp(OR_NET_NOSNAP
, 0, BPF_B
, (long)v
);
5941 b0
= gen_proto(ISO10589_ISIS
, Q_ISO
, Q_DEFAULT
);
5943 * 4 is the offset of the PDU type relative to the IS-IS
5946 b1
= gen_cmp(OR_NET_NOSNAP
, 4, BPF_B
, (long)v
);
5951 bpf_error("arp does not encapsulate another protocol");
5955 bpf_error("rarp does not encapsulate another protocol");
5959 bpf_error("atalk encapsulation is not specifiable");
5963 bpf_error("decnet encapsulation is not specifiable");
5967 bpf_error("sca does not encapsulate another protocol");
5971 bpf_error("lat does not encapsulate another protocol");
5975 bpf_error("moprc does not encapsulate another protocol");
5979 bpf_error("mopdl does not encapsulate another protocol");
5983 return gen_linktype(v
);
5986 bpf_error("'udp proto' is bogus");
5990 bpf_error("'tcp proto' is bogus");
5994 bpf_error("'sctp proto' is bogus");
5998 bpf_error("'icmp proto' is bogus");
6002 bpf_error("'igmp proto' is bogus");
6006 bpf_error("'igrp proto' is bogus");
6010 bpf_error("'pim proto' is bogus");
6014 bpf_error("'vrrp proto' is bogus");
6018 bpf_error("'carp proto' is bogus");
6023 b0
= gen_linktype(ETHERTYPE_IPV6
);
6026 * Also check for a fragment header before the final
6029 b2
= gen_cmp(OR_NET
, 6, BPF_B
, IPPROTO_FRAGMENT
);
6030 b1
= gen_cmp(OR_NET
, 40, BPF_B
, (bpf_int32
)v
);
6032 b2
= gen_cmp(OR_NET
, 6, BPF_B
, (bpf_int32
)v
);
6035 b1
= gen_protochain(v
, Q_IPV6
);
6041 bpf_error("'icmp6 proto' is bogus");
6045 bpf_error("'ah proto' is bogus");
6048 bpf_error("'ah proto' is bogus");
6051 bpf_error("'stp proto' is bogus");
6054 bpf_error("'ipx proto' is bogus");
6057 bpf_error("'netbeui proto' is bogus");
6060 bpf_error("'radio proto' is bogus");
6071 register const char *name
;
6074 int proto
= q
.proto
;
6078 bpf_u_int32 mask
, addr
;
6080 bpf_u_int32
**alist
;
6083 struct sockaddr_in
*sin4
;
6084 struct sockaddr_in6
*sin6
;
6085 struct addrinfo
*res
, *res0
;
6086 struct in6_addr mask128
;
6088 struct block
*b
, *tmp
;
6089 int port
, real_proto
;
6095 addr
= pcap_nametonetaddr(name
);
6097 bpf_error("unknown network '%s'", name
);
6098 /* Left justify network addr and calculate its network mask */
6100 while (addr
&& (addr
& 0xff000000) == 0) {
6104 return gen_host(addr
, mask
, proto
, dir
, q
.addr
);
6108 if (proto
== Q_LINK
) {
6112 case DLT_NETANALYZER
:
6113 case DLT_NETANALYZER_TRANSPARENT
:
6114 eaddr
= pcap_ether_hostton(name
);
6117 "unknown ether host '%s'", name
);
6118 b
= gen_ehostop(eaddr
, dir
);
6123 eaddr
= pcap_ether_hostton(name
);
6126 "unknown FDDI host '%s'", name
);
6127 b
= gen_fhostop(eaddr
, dir
);
6132 eaddr
= pcap_ether_hostton(name
);
6135 "unknown token ring host '%s'", name
);
6136 b
= gen_thostop(eaddr
, dir
);
6140 case DLT_IEEE802_11
:
6141 case DLT_PRISM_HEADER
:
6142 case DLT_IEEE802_11_RADIO_AVS
:
6143 case DLT_IEEE802_11_RADIO
:
6145 eaddr
= pcap_ether_hostton(name
);
6148 "unknown 802.11 host '%s'", name
);
6149 b
= gen_wlanhostop(eaddr
, dir
);
6153 case DLT_IP_OVER_FC
:
6154 eaddr
= pcap_ether_hostton(name
);
6157 "unknown Fibre Channel host '%s'", name
);
6158 b
= gen_ipfchostop(eaddr
, dir
);
6167 * Check that the packet doesn't begin
6168 * with an LE Control marker. (We've
6169 * already generated a test for LANE.)
6171 tmp
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
6175 eaddr
= pcap_ether_hostton(name
);
6178 "unknown ether host '%s'", name
);
6179 b
= gen_ehostop(eaddr
, dir
);
6185 bpf_error("only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name");
6186 } else if (proto
== Q_DECNET
) {
6187 unsigned short dn_addr
= __pcap_nametodnaddr(name
);
6189 * I don't think DECNET hosts can be multihomed, so
6190 * there is no need to build up a list of addresses
6192 return (gen_host(dn_addr
, 0, proto
, dir
, q
.addr
));
6195 alist
= pcap_nametoaddr(name
);
6196 if (alist
== NULL
|| *alist
== NULL
)
6197 bpf_error("unknown host '%s'", name
);
6199 if (off_linktype
== (u_int
)-1 && tproto
== Q_DEFAULT
)
6201 b
= gen_host(**alist
++, 0xffffffff, tproto
, dir
, q
.addr
);
6203 tmp
= gen_host(**alist
++, 0xffffffff,
6204 tproto
, dir
, q
.addr
);
6210 memset(&mask128
, 0xff, sizeof(mask128
));
6211 res0
= res
= pcap_nametoaddrinfo(name
);
6213 bpf_error("unknown host '%s'", name
);
6216 tproto
= tproto6
= proto
;
6217 if (off_linktype
== -1 && tproto
== Q_DEFAULT
) {
6221 for (res
= res0
; res
; res
= res
->ai_next
) {
6222 switch (res
->ai_family
) {
6224 if (tproto
== Q_IPV6
)
6227 sin4
= (struct sockaddr_in
*)
6229 tmp
= gen_host(ntohl(sin4
->sin_addr
.s_addr
),
6230 0xffffffff, tproto
, dir
, q
.addr
);
6233 if (tproto6
== Q_IP
)
6236 sin6
= (struct sockaddr_in6
*)
6238 tmp
= gen_host6(&sin6
->sin6_addr
,
6239 &mask128
, tproto6
, dir
, q
.addr
);
6251 bpf_error("unknown host '%s'%s", name
,
6252 (proto
== Q_DEFAULT
)
6254 : " for specified address family");
6261 if (proto
!= Q_DEFAULT
&&
6262 proto
!= Q_UDP
&& proto
!= Q_TCP
&& proto
!= Q_SCTP
)
6263 bpf_error("illegal qualifier of 'port'");
6264 if (pcap_nametoport(name
, &port
, &real_proto
) == 0)
6265 bpf_error("unknown port '%s'", name
);
6266 if (proto
== Q_UDP
) {
6267 if (real_proto
== IPPROTO_TCP
)
6268 bpf_error("port '%s' is tcp", name
);
6269 else if (real_proto
== IPPROTO_SCTP
)
6270 bpf_error("port '%s' is sctp", name
);
6272 /* override PROTO_UNDEF */
6273 real_proto
= IPPROTO_UDP
;
6275 if (proto
== Q_TCP
) {
6276 if (real_proto
== IPPROTO_UDP
)
6277 bpf_error("port '%s' is udp", name
);
6279 else if (real_proto
== IPPROTO_SCTP
)
6280 bpf_error("port '%s' is sctp", name
);
6282 /* override PROTO_UNDEF */
6283 real_proto
= IPPROTO_TCP
;
6285 if (proto
== Q_SCTP
) {
6286 if (real_proto
== IPPROTO_UDP
)
6287 bpf_error("port '%s' is udp", name
);
6289 else if (real_proto
== IPPROTO_TCP
)
6290 bpf_error("port '%s' is tcp", name
);
6292 /* override PROTO_UNDEF */
6293 real_proto
= IPPROTO_SCTP
;
6296 bpf_error("illegal port number %d < 0", port
);
6298 bpf_error("illegal port number %d > 65535", port
);
6300 return gen_port(port
, real_proto
, dir
);
6302 b
= gen_port(port
, real_proto
, dir
);
6303 gen_or(gen_port6(port
, real_proto
, dir
), b
);
6308 if (proto
!= Q_DEFAULT
&&
6309 proto
!= Q_UDP
&& proto
!= Q_TCP
&& proto
!= Q_SCTP
)
6310 bpf_error("illegal qualifier of 'portrange'");
6311 if (pcap_nametoportrange(name
, &port1
, &port2
, &real_proto
) == 0)
6312 bpf_error("unknown port in range '%s'", name
);
6313 if (proto
== Q_UDP
) {
6314 if (real_proto
== IPPROTO_TCP
)
6315 bpf_error("port in range '%s' is tcp", name
);
6316 else if (real_proto
== IPPROTO_SCTP
)
6317 bpf_error("port in range '%s' is sctp", name
);
6319 /* override PROTO_UNDEF */
6320 real_proto
= IPPROTO_UDP
;
6322 if (proto
== Q_TCP
) {
6323 if (real_proto
== IPPROTO_UDP
)
6324 bpf_error("port in range '%s' is udp", name
);
6325 else if (real_proto
== IPPROTO_SCTP
)
6326 bpf_error("port in range '%s' is sctp", name
);
6328 /* override PROTO_UNDEF */
6329 real_proto
= IPPROTO_TCP
;
6331 if (proto
== Q_SCTP
) {
6332 if (real_proto
== IPPROTO_UDP
)
6333 bpf_error("port in range '%s' is udp", name
);
6334 else if (real_proto
== IPPROTO_TCP
)
6335 bpf_error("port in range '%s' is tcp", name
);
6337 /* override PROTO_UNDEF */
6338 real_proto
= IPPROTO_SCTP
;
6341 bpf_error("illegal port number %d < 0", port1
);
6343 bpf_error("illegal port number %d > 65535", port1
);
6345 bpf_error("illegal port number %d < 0", port2
);
6347 bpf_error("illegal port number %d > 65535", port2
);
6350 return gen_portrange(port1
, port2
, real_proto
, dir
);
6352 b
= gen_portrange(port1
, port2
, real_proto
, dir
);
6353 gen_or(gen_portrange6(port1
, port2
, real_proto
, dir
), b
);
6359 eaddr
= pcap_ether_hostton(name
);
6361 bpf_error("unknown ether host: %s", name
);
6363 alist
= pcap_nametoaddr(name
);
6364 if (alist
== NULL
|| *alist
== NULL
)
6365 bpf_error("unknown host '%s'", name
);
6366 b
= gen_gateway(eaddr
, alist
, proto
, dir
);
6370 bpf_error("'gateway' not supported in this configuration");
6374 real_proto
= lookup_proto(name
, proto
);
6375 if (real_proto
>= 0)
6376 return gen_proto(real_proto
, proto
, dir
);
6378 bpf_error("unknown protocol: %s", name
);
6381 real_proto
= lookup_proto(name
, proto
);
6382 if (real_proto
>= 0)
6383 return gen_protochain(real_proto
, proto
, dir
);
6385 bpf_error("unknown protocol: %s", name
);
6396 gen_mcode(s1
, s2
, masklen
, q
)
6397 register const char *s1
, *s2
;
6398 register int masklen
;
6401 register int nlen
, mlen
;
6404 nlen
= __pcap_atoin(s1
, &n
);
6405 /* Promote short ipaddr */
6409 mlen
= __pcap_atoin(s2
, &m
);
6410 /* Promote short ipaddr */
6413 bpf_error("non-network bits set in \"%s mask %s\"",
6416 /* Convert mask len to mask */
6418 bpf_error("mask length must be <= 32");
6421 * X << 32 is not guaranteed by C to be 0; it's
6426 m
= 0xffffffff << (32 - masklen
);
6428 bpf_error("non-network bits set in \"%s/%d\"",
6435 return gen_host(n
, m
, q
.proto
, q
.dir
, q
.addr
);
6438 bpf_error("Mask syntax for networks only");
6447 register const char *s
;
6452 int proto
= q
.proto
;
6458 else if (q
.proto
== Q_DECNET
)
6459 vlen
= __pcap_atodn(s
, &v
);
6461 vlen
= __pcap_atoin(s
, &v
);
6468 if (proto
== Q_DECNET
)
6469 return gen_host(v
, 0, proto
, dir
, q
.addr
);
6470 else if (proto
== Q_LINK
) {
6471 bpf_error("illegal link layer address");
6474 if (s
== NULL
&& q
.addr
== Q_NET
) {
6475 /* Promote short net number */
6476 while (v
&& (v
& 0xff000000) == 0) {
6481 /* Promote short ipaddr */
6485 return gen_host(v
, mask
, proto
, dir
, q
.addr
);
6490 proto
= IPPROTO_UDP
;
6491 else if (proto
== Q_TCP
)
6492 proto
= IPPROTO_TCP
;
6493 else if (proto
== Q_SCTP
)
6494 proto
= IPPROTO_SCTP
;
6495 else if (proto
== Q_DEFAULT
)
6496 proto
= PROTO_UNDEF
;
6498 bpf_error("illegal qualifier of 'port'");
6501 bpf_error("illegal port number %u > 65535", v
);
6504 return gen_port((int)v
, proto
, dir
);
6508 b
= gen_port((int)v
, proto
, dir
);
6509 gen_or(gen_port6((int)v
, proto
, dir
), b
);
6516 proto
= IPPROTO_UDP
;
6517 else if (proto
== Q_TCP
)
6518 proto
= IPPROTO_TCP
;
6519 else if (proto
== Q_SCTP
)
6520 proto
= IPPROTO_SCTP
;
6521 else if (proto
== Q_DEFAULT
)
6522 proto
= PROTO_UNDEF
;
6524 bpf_error("illegal qualifier of 'portrange'");
6527 bpf_error("illegal port number %u > 65535", v
);
6530 return gen_portrange((int)v
, (int)v
, proto
, dir
);
6534 b
= gen_portrange((int)v
, (int)v
, proto
, dir
);
6535 gen_or(gen_portrange6((int)v
, (int)v
, proto
, dir
), b
);
6541 bpf_error("'gateway' requires a name");
6545 return gen_proto((int)v
, proto
, dir
);
6548 return gen_protochain((int)v
, proto
, dir
);
6563 gen_mcode6(s1
, s2
, masklen
, q
)
6564 register const char *s1
, *s2
;
6565 register int masklen
;
6568 struct addrinfo
*res
;
6569 struct in6_addr
*addr
;
6570 struct in6_addr mask
;
6575 bpf_error("no mask %s supported", s2
);
6577 res
= pcap_nametoaddrinfo(s1
);
6579 bpf_error("invalid ip6 address %s", s1
);
6582 bpf_error("%s resolved to multiple address", s1
);
6583 addr
= &((struct sockaddr_in6
*)res
->ai_addr
)->sin6_addr
;
6585 if (sizeof(mask
) * 8 < masklen
)
6586 bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask
) * 8));
6587 memset(&mask
, 0, sizeof(mask
));
6588 memset(&mask
, 0xff, masklen
/ 8);
6590 mask
.s6_addr
[masklen
/ 8] =
6591 (0xff << (8 - masklen
% 8)) & 0xff;
6594 a
= (u_int32_t
*)addr
;
6595 m
= (u_int32_t
*)&mask
;
6596 if ((a
[0] & ~m
[0]) || (a
[1] & ~m
[1])
6597 || (a
[2] & ~m
[2]) || (a
[3] & ~m
[3])) {
6598 bpf_error("non-network bits set in \"%s/%d\"", s1
, masklen
);
6606 bpf_error("Mask syntax for networks only");
6610 b
= gen_host6(addr
, &mask
, q
.proto
, q
.dir
, q
.addr
);
6616 bpf_error("invalid qualifier against IPv6 address");
6625 register const u_char
*eaddr
;
6628 struct block
*b
, *tmp
;
6630 if ((q
.addr
== Q_HOST
|| q
.addr
== Q_DEFAULT
) && q
.proto
== Q_LINK
) {
6633 case DLT_NETANALYZER
:
6634 case DLT_NETANALYZER_TRANSPARENT
:
6635 return gen_ehostop(eaddr
, (int)q
.dir
);
6637 return gen_fhostop(eaddr
, (int)q
.dir
);
6639 return gen_thostop(eaddr
, (int)q
.dir
);
6640 case DLT_IEEE802_11
:
6641 case DLT_PRISM_HEADER
:
6642 case DLT_IEEE802_11_RADIO_AVS
:
6643 case DLT_IEEE802_11_RADIO
:
6645 return gen_wlanhostop(eaddr
, (int)q
.dir
);
6649 * Check that the packet doesn't begin with an
6650 * LE Control marker. (We've already generated
6653 tmp
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
, BPF_H
,
6658 * Now check the MAC address.
6660 b
= gen_ehostop(eaddr
, (int)q
.dir
);
6665 case DLT_IP_OVER_FC
:
6666 return gen_ipfchostop(eaddr
, (int)q
.dir
);
6668 bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
6672 bpf_error("ethernet address used in non-ether expression");
6679 struct slist
*s0
, *s1
;
6682 * This is definitely not the best way to do this, but the
6683 * lists will rarely get long.
6690 static struct slist
*
6696 s
= new_stmt(BPF_LDX
|BPF_MEM
);
6701 static struct slist
*
6707 s
= new_stmt(BPF_LD
|BPF_MEM
);
6713 * Modify "index" to use the value stored into its register as an
6714 * offset relative to the beginning of the header for the protocol
6715 * "proto", and allocate a register and put an item "size" bytes long
6716 * (1, 2, or 4) at that offset into that register, making it the register
6720 gen_load(proto
, inst
, size
)
6725 struct slist
*s
, *tmp
;
6727 int regno
= alloc_reg();
6729 free_reg(inst
->regno
);
6733 bpf_error("data size must be 1, 2, or 4");
6749 bpf_error("unsupported index operation");
6753 * The offset is relative to the beginning of the packet
6754 * data, if we have a radio header. (If we don't, this
6757 if (linktype
!= DLT_IEEE802_11_RADIO_AVS
&&
6758 linktype
!= DLT_IEEE802_11_RADIO
&&
6759 linktype
!= DLT_PRISM_HEADER
)
6760 bpf_error("radio information not present in capture");
6763 * Load into the X register the offset computed into the
6764 * register specified by "index".
6766 s
= xfer_to_x(inst
);
6769 * Load the item at that offset.
6771 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6773 sappend(inst
->s
, s
);
6778 * The offset is relative to the beginning of
6779 * the link-layer header.
6781 * XXX - what about ATM LANE? Should the index be
6782 * relative to the beginning of the AAL5 frame, so
6783 * that 0 refers to the beginning of the LE Control
6784 * field, or relative to the beginning of the LAN
6785 * frame, so that 0 refers, for Ethernet LANE, to
6786 * the beginning of the destination address?
6788 s
= gen_llprefixlen();
6791 * If "s" is non-null, it has code to arrange that the
6792 * X register contains the length of the prefix preceding
6793 * the link-layer header. Add to it the offset computed
6794 * into the register specified by "index", and move that
6795 * into the X register. Otherwise, just load into the X
6796 * register the offset computed into the register specified
6800 sappend(s
, xfer_to_a(inst
));
6801 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6802 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6804 s
= xfer_to_x(inst
);
6807 * Load the item at the sum of the offset we've put in the
6808 * X register and the offset of the start of the link
6809 * layer header (which is 0 if the radio header is
6810 * variable-length; that header length is what we put
6811 * into the X register and then added to the index).
6813 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6816 sappend(inst
->s
, s
);
6832 * The offset is relative to the beginning of
6833 * the network-layer header.
6834 * XXX - are there any cases where we want
6837 s
= gen_off_macpl();
6840 * If "s" is non-null, it has code to arrange that the
6841 * X register contains the offset of the MAC-layer
6842 * payload. Add to it the offset computed into the
6843 * register specified by "index", and move that into
6844 * the X register. Otherwise, just load into the X
6845 * register the offset computed into the register specified
6849 sappend(s
, xfer_to_a(inst
));
6850 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6851 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6853 s
= xfer_to_x(inst
);
6856 * Load the item at the sum of the offset we've put in the
6857 * X register, the offset of the start of the network
6858 * layer header from the beginning of the MAC-layer
6859 * payload, and the purported offset of the start of the
6860 * MAC-layer payload (which might be 0 if there's a
6861 * variable-length prefix before the link-layer header
6862 * or the link-layer header itself is variable-length;
6863 * the variable-length offset of the start of the
6864 * MAC-layer payload is what we put into the X register
6865 * and then added to the index).
6867 tmp
= new_stmt(BPF_LD
|BPF_IND
|size
);
6868 tmp
->s
.k
= off_macpl
+ off_nl
;
6870 sappend(inst
->s
, s
);
6873 * Do the computation only if the packet contains
6874 * the protocol in question.
6876 b
= gen_proto_abbrev(proto
);
6878 gen_and(inst
->b
, b
);
6892 * The offset is relative to the beginning of
6893 * the transport-layer header.
6895 * Load the X register with the length of the IPv4 header
6896 * (plus the offset of the link-layer header, if it's
6897 * a variable-length header), in bytes.
6899 * XXX - are there any cases where we want
6901 * XXX - we should, if we're built with
6902 * IPv6 support, generate code to load either
6903 * IPv4, IPv6, or both, as appropriate.
6905 s
= gen_loadx_iphdrlen();
6908 * The X register now contains the sum of the length
6909 * of any variable-length header preceding the link-layer
6910 * header, any variable-length link-layer header, and the
6911 * length of the network-layer header.
6913 * Load into the A register the offset relative to
6914 * the beginning of the transport layer header,
6915 * add the X register to that, move that to the
6916 * X register, and load with an offset from the
6917 * X register equal to the offset of the network
6918 * layer header relative to the beginning of
6919 * the MAC-layer payload plus the fixed-length
6920 * portion of the offset of the MAC-layer payload
6921 * from the beginning of the raw packet data.
6923 sappend(s
, xfer_to_a(inst
));
6924 sappend(s
, new_stmt(BPF_ALU
|BPF_ADD
|BPF_X
));
6925 sappend(s
, new_stmt(BPF_MISC
|BPF_TAX
));
6926 sappend(s
, tmp
= new_stmt(BPF_LD
|BPF_IND
|size
));
6927 tmp
->s
.k
= off_macpl
+ off_nl
;
6928 sappend(inst
->s
, s
);
6931 * Do the computation only if the packet contains
6932 * the protocol in question - which is true only
6933 * if this is an IP datagram and is the first or
6934 * only fragment of that datagram.
6936 gen_and(gen_proto_abbrev(proto
), b
= gen_ipfrag());
6938 gen_and(inst
->b
, b
);
6940 gen_and(gen_proto_abbrev(Q_IP
), b
);
6946 bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
6950 inst
->regno
= regno
;
6951 s
= new_stmt(BPF_ST
);
6953 sappend(inst
->s
, s
);
6959 gen_relation(code
, a0
, a1
, reversed
)
6961 struct arth
*a0
, *a1
;
6964 struct slist
*s0
, *s1
, *s2
;
6965 struct block
*b
, *tmp
;
6969 if (code
== BPF_JEQ
) {
6970 s2
= new_stmt(BPF_ALU
|BPF_SUB
|BPF_X
);
6971 b
= new_block(JMP(code
));
6975 b
= new_block(BPF_JMP
|code
|BPF_X
);
6981 sappend(a0
->s
, a1
->s
);
6985 free_reg(a0
->regno
);
6986 free_reg(a1
->regno
);
6988 /* 'and' together protocol checks */
6991 gen_and(a0
->b
, tmp
= a1
->b
);
7007 int regno
= alloc_reg();
7008 struct arth
*a
= (struct arth
*)newchunk(sizeof(*a
));
7011 s
= new_stmt(BPF_LD
|BPF_LEN
);
7012 s
->next
= new_stmt(BPF_ST
);
7013 s
->next
->s
.k
= regno
;
7028 a
= (struct arth
*)newchunk(sizeof(*a
));
7032 s
= new_stmt(BPF_LD
|BPF_IMM
);
7034 s
->next
= new_stmt(BPF_ST
);
7050 s
= new_stmt(BPF_ALU
|BPF_NEG
);
7053 s
= new_stmt(BPF_ST
);
7061 gen_arth(code
, a0
, a1
)
7063 struct arth
*a0
, *a1
;
7065 struct slist
*s0
, *s1
, *s2
;
7069 s2
= new_stmt(BPF_ALU
|BPF_X
|code
);
7074 sappend(a0
->s
, a1
->s
);
7076 free_reg(a0
->regno
);
7077 free_reg(a1
->regno
);
7079 s0
= new_stmt(BPF_ST
);
7080 a0
->regno
= s0
->s
.k
= alloc_reg();
7087 * Here we handle simple allocation of the scratch registers.
7088 * If too many registers are alloc'd, the allocator punts.
7090 static int regused
[BPF_MEMWORDS
];
7094 * Initialize the table of used registers and the current register.
7100 memset(regused
, 0, sizeof regused
);
7104 * Return the next free register.
7109 int n
= BPF_MEMWORDS
;
7112 if (regused
[curreg
])
7113 curreg
= (curreg
+ 1) % BPF_MEMWORDS
;
7115 regused
[curreg
] = 1;
7119 bpf_error("too many registers needed to evaluate expression");
7125 * Return a register to the table so it can
7135 static struct block
*
7142 s
= new_stmt(BPF_LD
|BPF_LEN
);
7143 b
= new_block(JMP(jmp
));
7154 return gen_len(BPF_JGE
, n
);
7158 * Actually, this is less than or equal.
7166 b
= gen_len(BPF_JGT
, n
);
7173 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to
7174 * the beginning of the link-layer header.
7175 * XXX - that means you can't test values in the radiotap header, but
7176 * as that header is difficult if not impossible to parse generally
7177 * without a loop, that might not be a severe problem. A new keyword
7178 * "radio" could be added for that, although what you'd really want
7179 * would be a way of testing particular radio header values, which
7180 * would generate code appropriate to the radio header in question.
7183 gen_byteop(op
, idx
, val
)
7194 return gen_cmp(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
7197 b
= gen_cmp_lt(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
7201 b
= gen_cmp_gt(OR_LINK
, (u_int
)idx
, BPF_B
, (bpf_int32
)val
);
7205 s
= new_stmt(BPF_ALU
|BPF_OR
|BPF_K
);
7209 s
= new_stmt(BPF_ALU
|BPF_AND
|BPF_K
);
7213 b
= new_block(JMP(BPF_JEQ
));
7220 static u_char abroadcast
[] = { 0x0 };
7223 gen_broadcast(proto
)
7226 bpf_u_int32 hostmask
;
7227 struct block
*b0
, *b1
, *b2
;
7228 static u_char ebroadcast
[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
7236 case DLT_ARCNET_LINUX
:
7237 return gen_ahostop(abroadcast
, Q_DST
);
7239 case DLT_NETANALYZER
:
7240 case DLT_NETANALYZER_TRANSPARENT
:
7241 return gen_ehostop(ebroadcast
, Q_DST
);
7243 return gen_fhostop(ebroadcast
, Q_DST
);
7245 return gen_thostop(ebroadcast
, Q_DST
);
7246 case DLT_IEEE802_11
:
7247 case DLT_PRISM_HEADER
:
7248 case DLT_IEEE802_11_RADIO_AVS
:
7249 case DLT_IEEE802_11_RADIO
:
7251 return gen_wlanhostop(ebroadcast
, Q_DST
);
7252 case DLT_IP_OVER_FC
:
7253 return gen_ipfchostop(ebroadcast
, Q_DST
);
7257 * Check that the packet doesn't begin with an
7258 * LE Control marker. (We've already generated
7261 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
7266 * Now check the MAC address.
7268 b0
= gen_ehostop(ebroadcast
, Q_DST
);
7274 bpf_error("not a broadcast link");
7280 * We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff)
7281 * as an indication that we don't know the netmask, and fail
7284 if (netmask
== PCAP_NETMASK_UNKNOWN
)
7285 bpf_error("netmask not known, so 'ip broadcast' not supported");
7286 b0
= gen_linktype(ETHERTYPE_IP
);
7287 hostmask
= ~netmask
;
7288 b1
= gen_mcmp(OR_NET
, 16, BPF_W
, (bpf_int32
)0, hostmask
);
7289 b2
= gen_mcmp(OR_NET
, 16, BPF_W
,
7290 (bpf_int32
)(~0 & hostmask
), hostmask
);
7295 bpf_error("only link-layer/IP broadcast filters supported");
7301 * Generate code to test the low-order bit of a MAC address (that's
7302 * the bottom bit of the *first* byte).
7304 static struct block
*
7305 gen_mac_multicast(offset
)
7308 register struct block
*b0
;
7309 register struct slist
*s
;
7311 /* link[offset] & 1 != 0 */
7312 s
= gen_load_a(OR_LINK
, offset
, BPF_B
);
7313 b0
= new_block(JMP(BPF_JSET
));
7320 gen_multicast(proto
)
7323 register struct block
*b0
, *b1
, *b2
;
7324 register struct slist
*s
;
7332 case DLT_ARCNET_LINUX
:
7333 /* all ARCnet multicasts use the same address */
7334 return gen_ahostop(abroadcast
, Q_DST
);
7336 case DLT_NETANALYZER
:
7337 case DLT_NETANALYZER_TRANSPARENT
:
7338 /* ether[0] & 1 != 0 */
7339 return gen_mac_multicast(0);
7342 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
7344 * XXX - was that referring to bit-order issues?
7346 /* fddi[1] & 1 != 0 */
7347 return gen_mac_multicast(1);
7349 /* tr[2] & 1 != 0 */
7350 return gen_mac_multicast(2);
7351 case DLT_IEEE802_11
:
7352 case DLT_PRISM_HEADER
:
7353 case DLT_IEEE802_11_RADIO_AVS
:
7354 case DLT_IEEE802_11_RADIO
:
7359 * For control frames, there is no DA.
7361 * For management frames, DA is at an
7362 * offset of 4 from the beginning of
7365 * For data frames, DA is at an offset
7366 * of 4 from the beginning of the packet
7367 * if To DS is clear and at an offset of
7368 * 16 from the beginning of the packet
7373 * Generate the tests to be done for data frames.
7375 * First, check for To DS set, i.e. "link[1] & 0x01".
7377 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
7378 b1
= new_block(JMP(BPF_JSET
));
7379 b1
->s
.k
= 0x01; /* To DS */
7383 * If To DS is set, the DA is at 16.
7385 b0
= gen_mac_multicast(16);
7389 * Now, check for To DS not set, i.e. check
7390 * "!(link[1] & 0x01)".
7392 s
= gen_load_a(OR_LINK
, 1, BPF_B
);
7393 b2
= new_block(JMP(BPF_JSET
));
7394 b2
->s
.k
= 0x01; /* To DS */
7399 * If To DS is not set, the DA is at 4.
7401 b1
= gen_mac_multicast(4);
7405 * Now OR together the last two checks. That gives
7406 * the complete set of checks for data frames.
7411 * Now check for a data frame.
7412 * I.e, check "link[0] & 0x08".
7414 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7415 b1
= new_block(JMP(BPF_JSET
));
7420 * AND that with the checks done for data frames.
7425 * If the high-order bit of the type value is 0, this
7426 * is a management frame.
7427 * I.e, check "!(link[0] & 0x08)".
7429 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7430 b2
= new_block(JMP(BPF_JSET
));
7436 * For management frames, the DA is at 4.
7438 b1
= gen_mac_multicast(4);
7442 * OR that with the checks done for data frames.
7443 * That gives the checks done for management and
7449 * If the low-order bit of the type value is 1,
7450 * this is either a control frame or a frame
7451 * with a reserved type, and thus not a
7454 * I.e., check "!(link[0] & 0x04)".
7456 s
= gen_load_a(OR_LINK
, 0, BPF_B
);
7457 b1
= new_block(JMP(BPF_JSET
));
7463 * AND that with the checks for data and management
7468 case DLT_IP_OVER_FC
:
7469 b0
= gen_mac_multicast(2);
7474 * Check that the packet doesn't begin with an
7475 * LE Control marker. (We've already generated
7478 b1
= gen_cmp(OR_LINK
, SUNATM_PKT_BEGIN_POS
,
7482 /* ether[off_mac] & 1 != 0 */
7483 b0
= gen_mac_multicast(off_mac
);
7491 /* Link not known to support multicasts */
7495 b0
= gen_linktype(ETHERTYPE_IP
);
7496 b1
= gen_cmp_ge(OR_NET
, 16, BPF_B
, (bpf_int32
)224);
7502 b0
= gen_linktype(ETHERTYPE_IPV6
);
7503 b1
= gen_cmp(OR_NET
, 24, BPF_B
, (bpf_int32
)255);
7508 bpf_error("link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel");
7514 * Filter on inbound (dir == 0) or outbound (dir == 1) traffic.
7515 * Outbound traffic is sent by this machine, while inbound traffic is
7516 * sent by a remote machine (and may include packets destined for a
7517 * unicast or multicast link-layer address we are not subscribing to).
7518 * These are the same definitions implemented by pcap_setdirection().
7519 * Capturing only unicast traffic destined for this host is probably
7520 * better accomplished using a higher-layer filter.
7526 register struct block
*b0
;
7529 * Only some data link types support inbound/outbound qualifiers.
7533 b0
= gen_relation(BPF_JEQ
,
7534 gen_load(Q_LINK
, gen_loadi(0), 1),
7541 /* match outgoing packets */
7542 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, IPNET_OUTBOUND
);
7544 /* match incoming packets */
7545 b0
= gen_cmp(OR_LINK
, 2, BPF_H
, IPNET_INBOUND
);
7550 /* match outgoing packets */
7551 b0
= gen_cmp(OR_LINK
, 0, BPF_H
, LINUX_SLL_OUTGOING
);
7553 /* to filter on inbound traffic, invert the match */
7558 #ifdef HAVE_NET_PFVAR_H
7560 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, dir
), BPF_B
,
7561 (bpf_int32
)((dir
== 0) ? PF_IN
: PF_OUT
));
7567 /* match outgoing packets */
7568 b0
= gen_cmp(OR_LINK
, 0, BPF_B
, PPP_PPPD_OUT
);
7570 /* match incoming packets */
7571 b0
= gen_cmp(OR_LINK
, 0, BPF_B
, PPP_PPPD_IN
);
7575 case DLT_JUNIPER_MFR
:
7576 case DLT_JUNIPER_MLFR
:
7577 case DLT_JUNIPER_MLPPP
:
7578 case DLT_JUNIPER_ATM1
:
7579 case DLT_JUNIPER_ATM2
:
7580 case DLT_JUNIPER_PPPOE
:
7581 case DLT_JUNIPER_PPPOE_ATM
:
7582 case DLT_JUNIPER_GGSN
:
7583 case DLT_JUNIPER_ES
:
7584 case DLT_JUNIPER_MONITOR
:
7585 case DLT_JUNIPER_SERVICES
:
7586 case DLT_JUNIPER_ETHER
:
7587 case DLT_JUNIPER_PPP
:
7588 case DLT_JUNIPER_FRELAY
:
7589 case DLT_JUNIPER_CHDLC
:
7590 case DLT_JUNIPER_VP
:
7591 case DLT_JUNIPER_ST
:
7592 case DLT_JUNIPER_ISM
:
7593 case DLT_JUNIPER_VS
:
7594 case DLT_JUNIPER_SRX_E2E
:
7595 case DLT_JUNIPER_FIBRECHANNEL
:
7596 case DLT_JUNIPER_ATM_CEMIC
:
7598 /* juniper flags (including direction) are stored
7599 * the byte after the 3-byte magic number */
7601 /* match outgoing packets */
7602 b0
= gen_mcmp(OR_LINK
, 3, BPF_B
, 0, 0x01);
7604 /* match incoming packets */
7605 b0
= gen_mcmp(OR_LINK
, 3, BPF_B
, 1, 0x01);
7611 * If we have packet meta-data indicating a direction,
7612 * check it, otherwise give up as this link-layer type
7613 * has nothing in the packet data.
7615 #if defined(PF_PACKET) && defined(SO_ATTACH_FILTER)
7617 * We infer that this is Linux with PF_PACKET support.
7618 * If this is a *live* capture, we can look at
7619 * special meta-data in the filter expression;
7620 * if it's a savefile, we can't.
7622 if (bpf_pcap
->sf
.rfile
!= NULL
) {
7623 /* We have a FILE *, so this is a savefile */
7624 bpf_error("inbound/outbound not supported on linktype %d when reading savefiles",
7629 /* match outgoing packets */
7630 b0
= gen_cmp(OR_LINK
, SKF_AD_OFF
+ SKF_AD_PKTTYPE
, BPF_H
,
7633 /* to filter on inbound traffic, invert the match */
7636 #else /* defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */
7637 bpf_error("inbound/outbound not supported on linktype %d",
7641 #endif /* defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */
7646 #ifdef HAVE_NET_PFVAR_H
7647 /* PF firewall log matched interface */
7649 gen_pf_ifname(const char *ifname
)
7654 if (linktype
!= DLT_PFLOG
) {
7655 bpf_error("ifname supported only on PF linktype");
7658 len
= sizeof(((struct pfloghdr
*)0)->ifname
);
7659 off
= offsetof(struct pfloghdr
, ifname
);
7660 if (strlen(ifname
) >= len
) {
7661 bpf_error("ifname interface names can only be %d characters",
7665 b0
= gen_bcmp(OR_LINK
, off
, strlen(ifname
), (const u_char
*)ifname
);
7669 /* PF firewall log ruleset name */
7671 gen_pf_ruleset(char *ruleset
)
7675 if (linktype
!= DLT_PFLOG
) {
7676 bpf_error("ruleset supported only on PF linktype");
7680 if (strlen(ruleset
) >= sizeof(((struct pfloghdr
*)0)->ruleset
)) {
7681 bpf_error("ruleset names can only be %ld characters",
7682 (long)(sizeof(((struct pfloghdr
*)0)->ruleset
) - 1));
7686 b0
= gen_bcmp(OR_LINK
, offsetof(struct pfloghdr
, ruleset
),
7687 strlen(ruleset
), (const u_char
*)ruleset
);
7691 /* PF firewall log rule number */
7697 if (linktype
!= DLT_PFLOG
) {
7698 bpf_error("rnr supported only on PF linktype");
7702 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, rulenr
), BPF_W
,
7707 /* PF firewall log sub-rule number */
7709 gen_pf_srnr(int srnr
)
7713 if (linktype
!= DLT_PFLOG
) {
7714 bpf_error("srnr supported only on PF linktype");
7718 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, subrulenr
), BPF_W
,
7723 /* PF firewall log reason code */
7725 gen_pf_reason(int reason
)
7729 if (linktype
!= DLT_PFLOG
) {
7730 bpf_error("reason supported only on PF linktype");
7734 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, reason
), BPF_B
,
7739 /* PF firewall log action */
7741 gen_pf_action(int action
)
7745 if (linktype
!= DLT_PFLOG
) {
7746 bpf_error("action supported only on PF linktype");
7750 b0
= gen_cmp(OR_LINK
, offsetof(struct pfloghdr
, action
), BPF_B
,
7754 #else /* !HAVE_NET_PFVAR_H */
7756 gen_pf_ifname(const char *ifname
)
7758 bpf_error("libpcap was compiled without pf support");
7764 gen_pf_ruleset(char *ruleset
)
7766 bpf_error("libpcap was compiled on a machine without pf support");
7774 bpf_error("libpcap was compiled on a machine without pf support");
7780 gen_pf_srnr(int srnr
)
7782 bpf_error("libpcap was compiled on a machine without pf support");
7788 gen_pf_reason(int reason
)
7790 bpf_error("libpcap was compiled on a machine without pf support");
7796 gen_pf_action(int action
)
7798 bpf_error("libpcap was compiled on a machine without pf support");
7802 #endif /* HAVE_NET_PFVAR_H */
7804 /* IEEE 802.11 wireless header */
7806 gen_p80211_type(int type
, int mask
)
7812 case DLT_IEEE802_11
:
7813 case DLT_PRISM_HEADER
:
7814 case DLT_IEEE802_11_RADIO_AVS
:
7815 case DLT_IEEE802_11_RADIO
:
7816 b0
= gen_mcmp(OR_LINK
, 0, BPF_B
, (bpf_int32
)type
,
7821 bpf_error("802.11 link-layer types supported only on 802.11");
7829 gen_p80211_fcdir(int fcdir
)
7835 case DLT_IEEE802_11
:
7836 case DLT_PRISM_HEADER
:
7837 case DLT_IEEE802_11_RADIO_AVS
:
7838 case DLT_IEEE802_11_RADIO
:
7842 bpf_error("frame direction supported only with 802.11 headers");
7846 b0
= gen_mcmp(OR_LINK
, 1, BPF_B
, (bpf_int32
)fcdir
,
7847 (bpf_u_int32
)IEEE80211_FC1_DIR_MASK
);
7854 register const u_char
*eaddr
;
7860 case DLT_ARCNET_LINUX
:
7861 if ((q
.addr
== Q_HOST
|| q
.addr
== Q_DEFAULT
) &&
7863 return (gen_ahostop(eaddr
, (int)q
.dir
));
7865 bpf_error("ARCnet address used in non-arc expression");
7871 bpf_error("aid supported only on ARCnet");
7874 bpf_error("ARCnet address used in non-arc expression");
7879 static struct block
*
7880 gen_ahostop(eaddr
, dir
)
7881 register const u_char
*eaddr
;
7884 register struct block
*b0
, *b1
;
7887 /* src comes first, different from Ethernet */
7889 return gen_bcmp(OR_LINK
, 0, 1, eaddr
);
7892 return gen_bcmp(OR_LINK
, 1, 1, eaddr
);
7895 b0
= gen_ahostop(eaddr
, Q_SRC
);
7896 b1
= gen_ahostop(eaddr
, Q_DST
);
7902 b0
= gen_ahostop(eaddr
, Q_SRC
);
7903 b1
= gen_ahostop(eaddr
, Q_DST
);
7908 bpf_error("'addr1' is only supported on 802.11");
7912 bpf_error("'addr2' is only supported on 802.11");
7916 bpf_error("'addr3' is only supported on 802.11");
7920 bpf_error("'addr4' is only supported on 802.11");
7924 bpf_error("'ra' is only supported on 802.11");
7928 bpf_error("'ta' is only supported on 802.11");
7936 * support IEEE 802.1Q VLAN trunk over ethernet
7942 struct block
*b0
, *b1
;
7944 /* can't check for VLAN-encapsulated packets inside MPLS */
7945 if (label_stack_depth
> 0)
7946 bpf_error("no VLAN match after MPLS");
7949 * Check for a VLAN packet, and then change the offsets to point
7950 * to the type and data fields within the VLAN packet. Just
7951 * increment the offsets, so that we can support a hierarchy, e.g.
7952 * "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within
7955 * XXX - this is a bit of a kludge. If we were to split the
7956 * compiler into a parser that parses an expression and
7957 * generates an expression tree, and a code generator that
7958 * takes an expression tree (which could come from our
7959 * parser or from some other parser) and generates BPF code,
7960 * we could perhaps make the offsets parameters of routines
7961 * and, in the handler for an "AND" node, pass to subnodes
7962 * other than the VLAN node the adjusted offsets.
7964 * This would mean that "vlan" would, instead of changing the
7965 * behavior of *all* tests after it, change only the behavior
7966 * of tests ANDed with it. That would change the documented
7967 * semantics of "vlan", which might break some expressions.
7968 * However, it would mean that "(vlan and ip) or ip" would check
7969 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
7970 * checking only for VLAN-encapsulated IP, so that could still
7971 * be considered worth doing; it wouldn't break expressions
7972 * that are of the form "vlan and ..." or "vlan N and ...",
7973 * which I suspect are the most common expressions involving
7974 * "vlan". "vlan or ..." doesn't necessarily do what the user
7975 * would really want, now, as all the "or ..." tests would
7976 * be done assuming a VLAN, even though the "or" could be viewed
7977 * as meaning "or, if this isn't a VLAN packet...".
7984 case DLT_NETANALYZER
:
7985 case DLT_NETANALYZER_TRANSPARENT
:
7986 /* check for VLAN, including QinQ */
7987 b0
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
7988 (bpf_int32
)ETHERTYPE_8021Q
);
7989 b1
= gen_cmp(OR_LINK
, off_linktype
, BPF_H
,
7990 (bpf_int32
)ETHERTYPE_8021QINQ
);
7994 /* If a specific VLAN is requested, check VLAN id */
7995 if (vlan_num
>= 0) {
7996 b1
= gen_mcmp(OR_MACPL
, 0, BPF_H
,
7997 (bpf_int32
)vlan_num
, 0x0fff);
8011 bpf_error("no VLAN support for data link type %d",
8026 struct block
*b0
,*b1
;
8029 * Change the offsets to point to the type and data fields within
8030 * the MPLS packet. Just increment the offsets, so that we
8031 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to
8032 * capture packets with an outer label of 100000 and an inner
8035 * XXX - this is a bit of a kludge. See comments in gen_vlan().
8039 if (label_stack_depth
> 0) {
8040 /* just match the bottom-of-stack bit clear */
8041 b0
= gen_mcmp(OR_MACPL
, orig_nl
-2, BPF_B
, 0, 0x01);
8044 * Indicate that we're checking MPLS-encapsulated headers,
8045 * to make sure higher level code generators don't try to
8046 * match against IP-related protocols such as Q_ARP, Q_RARP
8051 case DLT_C_HDLC
: /* fall through */
8053 case DLT_NETANALYZER
:
8054 case DLT_NETANALYZER_TRANSPARENT
:
8055 b0
= gen_linktype(ETHERTYPE_MPLS
);
8059 b0
= gen_linktype(PPP_MPLS_UCAST
);
8062 /* FIXME add other DLT_s ...
8063 * for Frame-Relay/and ATM this may get messy due to SNAP headers
8064 * leave it for now */
8067 bpf_error("no MPLS support for data link type %d",
8075 /* If a specific MPLS label is requested, check it */
8076 if (label_num
>= 0) {
8077 label_num
= label_num
<< 12; /* label is shifted 12 bits on the wire */
8078 b1
= gen_mcmp(OR_MACPL
, orig_nl
, BPF_W
, (bpf_int32
)label_num
,
8079 0xfffff000); /* only compare the first 20 bits */
8086 label_stack_depth
++;
8091 * Support PPPOE discovery and session.
8096 /* check for PPPoE discovery */
8097 return gen_linktype((bpf_int32
)ETHERTYPE_PPPOED
);
8106 * Test against the PPPoE session link-layer type.
8108 b0
= gen_linktype((bpf_int32
)ETHERTYPE_PPPOES
);
8111 * Change the offsets to point to the type and data fields within
8112 * the PPP packet, and note that this is PPPoE rather than
8115 * XXX - this is a bit of a kludge. If we were to split the
8116 * compiler into a parser that parses an expression and
8117 * generates an expression tree, and a code generator that
8118 * takes an expression tree (which could come from our
8119 * parser or from some other parser) and generates BPF code,
8120 * we could perhaps make the offsets parameters of routines
8121 * and, in the handler for an "AND" node, pass to subnodes
8122 * other than the PPPoE node the adjusted offsets.
8124 * This would mean that "pppoes" would, instead of changing the
8125 * behavior of *all* tests after it, change only the behavior
8126 * of tests ANDed with it. That would change the documented
8127 * semantics of "pppoes", which might break some expressions.
8128 * However, it would mean that "(pppoes and ip) or ip" would check
8129 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
8130 * checking only for VLAN-encapsulated IP, so that could still
8131 * be considered worth doing; it wouldn't break expressions
8132 * that are of the form "pppoes and ..." which I suspect are the
8133 * most common expressions involving "pppoes". "pppoes or ..."
8134 * doesn't necessarily do what the user would really want, now,
8135 * as all the "or ..." tests would be done assuming PPPoE, even
8136 * though the "or" could be viewed as meaning "or, if this isn't
8137 * a PPPoE packet...".
8139 orig_linktype
= off_linktype
; /* save original values */
8144 * The "network-layer" protocol is PPPoE, which has a 6-byte
8145 * PPPoE header, followed by a PPP packet.
8147 * There is no HDLC encapsulation for the PPP packet (it's
8148 * encapsulated in PPPoES instead), so the link-layer type
8149 * starts at the first byte of the PPP packet. For PPPoE,
8150 * that offset is relative to the beginning of the total
8151 * link-layer payload, including any 802.2 LLC header, so
8152 * it's 6 bytes past off_nl.
8154 off_linktype
= off_nl
+ 6;
8157 * The network-layer offsets are relative to the beginning
8158 * of the MAC-layer payload; that's past the 6-byte
8159 * PPPoE header and the 2-byte PPP header.
8162 off_nl_nosnap
= 6+2;
8168 gen_atmfield_code(atmfield
, jvalue
, jtype
, reverse
)
8180 bpf_error("'vpi' supported only on raw ATM");
8181 if (off_vpi
== (u_int
)-1)
8183 b0
= gen_ncmp(OR_LINK
, off_vpi
, BPF_B
, 0xffffffff, jtype
,
8189 bpf_error("'vci' supported only on raw ATM");
8190 if (off_vci
== (u_int
)-1)
8192 b0
= gen_ncmp(OR_LINK
, off_vci
, BPF_H
, 0xffffffff, jtype
,
8197 if (off_proto
== (u_int
)-1)
8198 abort(); /* XXX - this isn't on FreeBSD */
8199 b0
= gen_ncmp(OR_LINK
, off_proto
, BPF_B
, 0x0f, jtype
,
8204 if (off_payload
== (u_int
)-1)
8206 b0
= gen_ncmp(OR_LINK
, off_payload
+ MSG_TYPE_POS
, BPF_B
,
8207 0xffffffff, jtype
, reverse
, jvalue
);
8212 bpf_error("'callref' supported only on raw ATM");
8213 if (off_proto
== (u_int
)-1)
8215 b0
= gen_ncmp(OR_LINK
, off_proto
, BPF_B
, 0xffffffff,
8216 jtype
, reverse
, jvalue
);
8226 gen_atmtype_abbrev(type
)
8229 struct block
*b0
, *b1
;
8234 /* Get all packets in Meta signalling Circuit */
8236 bpf_error("'metac' supported only on raw ATM");
8237 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8238 b1
= gen_atmfield_code(A_VCI
, 1, BPF_JEQ
, 0);
8243 /* Get all packets in Broadcast Circuit*/
8245 bpf_error("'bcc' supported only on raw ATM");
8246 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8247 b1
= gen_atmfield_code(A_VCI
, 2, BPF_JEQ
, 0);
8252 /* Get all cells in Segment OAM F4 circuit*/
8254 bpf_error("'oam4sc' supported only on raw ATM");
8255 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8256 b1
= gen_atmfield_code(A_VCI
, 3, BPF_JEQ
, 0);
8261 /* Get all cells in End-to-End OAM F4 Circuit*/
8263 bpf_error("'oam4ec' supported only on raw ATM");
8264 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8265 b1
= gen_atmfield_code(A_VCI
, 4, BPF_JEQ
, 0);
8270 /* Get all packets in connection Signalling Circuit */
8272 bpf_error("'sc' supported only on raw ATM");
8273 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8274 b1
= gen_atmfield_code(A_VCI
, 5, BPF_JEQ
, 0);
8279 /* Get all packets in ILMI Circuit */
8281 bpf_error("'ilmic' supported only on raw ATM");
8282 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8283 b1
= gen_atmfield_code(A_VCI
, 16, BPF_JEQ
, 0);
8288 /* Get all LANE packets */
8290 bpf_error("'lane' supported only on raw ATM");
8291 b1
= gen_atmfield_code(A_PROTOTYPE
, PT_LANE
, BPF_JEQ
, 0);
8294 * Arrange that all subsequent tests assume LANE
8295 * rather than LLC-encapsulated packets, and set
8296 * the offsets appropriately for LANE-encapsulated
8299 * "off_mac" is the offset of the Ethernet header,
8300 * which is 2 bytes past the ATM pseudo-header
8301 * (skipping the pseudo-header and 2-byte LE Client
8302 * field). The other offsets are Ethernet offsets
8303 * relative to "off_mac".
8306 off_mac
= off_payload
+ 2; /* MAC header */
8307 off_linktype
= off_mac
+ 12;
8308 off_macpl
= off_mac
+ 14; /* Ethernet */
8309 off_nl
= 0; /* Ethernet II */
8310 off_nl_nosnap
= 3; /* 802.3+802.2 */
8314 /* Get all LLC-encapsulated packets */
8316 bpf_error("'llc' supported only on raw ATM");
8317 b1
= gen_atmfield_code(A_PROTOTYPE
, PT_LLC
, BPF_JEQ
, 0);
8328 * Filtering for MTP2 messages based on li value
8329 * FISU, length is null
8330 * LSSU, length is 1 or 2
8331 * MSU, length is 3 or more
8334 gen_mtp2type_abbrev(type
)
8337 struct block
*b0
, *b1
;
8342 if ( (linktype
!= DLT_MTP2
) &&
8343 (linktype
!= DLT_ERF
) &&
8344 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8345 bpf_error("'fisu' supported only on MTP2");
8346 /* gen_ncmp(offrel, offset, size, mask, jtype, reverse, value) */
8347 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JEQ
, 0, 0);
8351 if ( (linktype
!= DLT_MTP2
) &&
8352 (linktype
!= DLT_ERF
) &&
8353 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8354 bpf_error("'lssu' supported only on MTP2");
8355 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 1, 2);
8356 b1
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 0, 0);
8361 if ( (linktype
!= DLT_MTP2
) &&
8362 (linktype
!= DLT_ERF
) &&
8363 (linktype
!= DLT_MTP2_WITH_PHDR
) )
8364 bpf_error("'msu' supported only on MTP2");
8365 b0
= gen_ncmp(OR_PACKET
, off_li
, BPF_B
, 0x3f, BPF_JGT
, 0, 2);
8375 gen_mtp3field_code(mtp3field
, jvalue
, jtype
, reverse
)
8382 bpf_u_int32 val1
, val2
, val3
;
8384 switch (mtp3field
) {
8387 if (off_sio
== (u_int
)-1)
8388 bpf_error("'sio' supported only on SS7");
8389 /* sio coded on 1 byte so max value 255 */
8391 bpf_error("sio value %u too big; max value = 255",
8393 b0
= gen_ncmp(OR_PACKET
, off_sio
, BPF_B
, 0xffffffff,
8394 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8398 if (off_opc
== (u_int
)-1)
8399 bpf_error("'opc' supported only on SS7");
8400 /* opc coded on 14 bits so max value 16383 */
8402 bpf_error("opc value %u too big; max value = 16383",
8404 /* the following instructions are made to convert jvalue
8405 * to the form used to write opc in an ss7 message*/
8406 val1
= jvalue
& 0x00003c00;
8408 val2
= jvalue
& 0x000003fc;
8410 val3
= jvalue
& 0x00000003;
8412 jvalue
= val1
+ val2
+ val3
;
8413 b0
= gen_ncmp(OR_PACKET
, off_opc
, BPF_W
, 0x00c0ff0f,
8414 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8418 if (off_dpc
== (u_int
)-1)
8419 bpf_error("'dpc' supported only on SS7");
8420 /* dpc coded on 14 bits so max value 16383 */
8422 bpf_error("dpc value %u too big; max value = 16383",
8424 /* the following instructions are made to convert jvalue
8425 * to the forme used to write dpc in an ss7 message*/
8426 val1
= jvalue
& 0x000000ff;
8428 val2
= jvalue
& 0x00003f00;
8430 jvalue
= val1
+ val2
;
8431 b0
= gen_ncmp(OR_PACKET
, off_dpc
, BPF_W
, 0xff3f0000,
8432 (u_int
)jtype
, reverse
, (u_int
)jvalue
);
8436 if (off_sls
== (u_int
)-1)
8437 bpf_error("'sls' supported only on SS7");
8438 /* sls coded on 4 bits so max value 15 */
8440 bpf_error("sls value %u too big; max value = 15",
8442 /* the following instruction is made to convert jvalue
8443 * to the forme used to write sls in an ss7 message*/
8444 jvalue
= jvalue
<< 4;
8445 b0
= gen_ncmp(OR_PACKET
, off_sls
, BPF_B
, 0xf0,
8446 (u_int
)jtype
,reverse
, (u_int
)jvalue
);
8455 static struct block
*
8456 gen_msg_abbrev(type
)
8462 * Q.2931 signalling protocol messages for handling virtual circuits
8463 * establishment and teardown
8468 b1
= gen_atmfield_code(A_MSGTYPE
, SETUP
, BPF_JEQ
, 0);
8472 b1
= gen_atmfield_code(A_MSGTYPE
, CALL_PROCEED
, BPF_JEQ
, 0);
8476 b1
= gen_atmfield_code(A_MSGTYPE
, CONNECT
, BPF_JEQ
, 0);
8480 b1
= gen_atmfield_code(A_MSGTYPE
, CONNECT_ACK
, BPF_JEQ
, 0);
8484 b1
= gen_atmfield_code(A_MSGTYPE
, RELEASE
, BPF_JEQ
, 0);
8487 case A_RELEASE_DONE
:
8488 b1
= gen_atmfield_code(A_MSGTYPE
, RELEASE_DONE
, BPF_JEQ
, 0);
8498 gen_atmmulti_abbrev(type
)
8501 struct block
*b0
, *b1
;
8507 bpf_error("'oam' supported only on raw ATM");
8508 b1
= gen_atmmulti_abbrev(A_OAMF4
);
8513 bpf_error("'oamf4' supported only on raw ATM");
8515 b0
= gen_atmfield_code(A_VCI
, 3, BPF_JEQ
, 0);
8516 b1
= gen_atmfield_code(A_VCI
, 4, BPF_JEQ
, 0);
8518 b0
= gen_atmfield_code(A_VPI
, 0, BPF_JEQ
, 0);
8524 * Get Q.2931 signalling messages for switched
8525 * virtual connection
8528 bpf_error("'connectmsg' supported only on raw ATM");
8529 b0
= gen_msg_abbrev(A_SETUP
);
8530 b1
= gen_msg_abbrev(A_CALLPROCEED
);
8532 b0
= gen_msg_abbrev(A_CONNECT
);
8534 b0
= gen_msg_abbrev(A_CONNECTACK
);
8536 b0
= gen_msg_abbrev(A_RELEASE
);
8538 b0
= gen_msg_abbrev(A_RELEASE_DONE
);
8540 b0
= gen_atmtype_abbrev(A_SC
);
8546 bpf_error("'metaconnect' supported only on raw ATM");
8547 b0
= gen_msg_abbrev(A_SETUP
);
8548 b1
= gen_msg_abbrev(A_CALLPROCEED
);
8550 b0
= gen_msg_abbrev(A_CONNECT
);
8552 b0
= gen_msg_abbrev(A_RELEASE
);
8554 b0
= gen_msg_abbrev(A_RELEASE_DONE
);
8556 b0
= gen_atmtype_abbrev(A_METAC
);