1 /* 2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 */ 21 22 #include <config.h> 23 24 #ifdef _WIN32 25 #include <ws2tcpip.h> 26 #else 27 #include <sys/socket.h> 28 29 #ifdef __NetBSD__ 30 #include <sys/param.h> 31 #endif 32 33 #include <netinet/in.h> 34 #include <arpa/inet.h> 35 #endif /* _WIN32 */ 36 37 #include <stdlib.h> 38 #include <string.h> 39 #include <memory.h> 40 #include <setjmp.h> 41 #include <stdarg.h> 42 #include <stdio.h> 43 44 #ifdef MSDOS 45 #include "pcap-dos.h" 46 #endif 47 48 #include "pcap-int.h" 49 50 #include "extract.h" 51 52 #include "ethertype.h" 53 #include "nlpid.h" 54 #include "llc.h" 55 #include "gencode.h" 56 #include "ieee80211.h" 57 #include "atmuni31.h" 58 #include "sunatmpos.h" 59 #include "pflog.h" 60 #include "ppp.h" 61 #include "pcap/sll.h" 62 #include "pcap/ipnet.h" 63 #include "arcnet.h" 64 #include "diag-control.h" 65 66 #include "scanner.h" 67 68 #if defined(__linux__) 69 #include <linux/types.h> 70 #include <linux/if_packet.h> 71 #include <linux/filter.h> 72 #endif 73 74 #ifndef offsetof 75 #define offsetof(s, e) ((size_t)&((s *)0)->e) 76 #endif 77 78 #ifdef _WIN32 79 #ifdef INET6 80 #if defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF) 81 /* IPv6 address */ 82 struct in6_addr 83 { 84 union 85 { 86 uint8_t u6_addr8[16]; 87 uint16_t u6_addr16[8]; 88 uint32_t u6_addr32[4]; 89 } in6_u; 90 #define s6_addr in6_u.u6_addr8 91 #define s6_addr16 in6_u.u6_addr16 92 #define s6_addr32 in6_u.u6_addr32 93 #define s6_addr64 in6_u.u6_addr64 94 }; 95 96 typedef unsigned short sa_family_t; 97 98 #define __SOCKADDR_COMMON(sa_prefix) \ 99 sa_family_t sa_prefix##family 100 101 /* Ditto, for IPv6. */ 102 struct sockaddr_in6 103 { 104 __SOCKADDR_COMMON (sin6_); 105 uint16_t sin6_port; /* Transport layer port # */ 106 uint32_t sin6_flowinfo; /* IPv6 flow information */ 107 struct in6_addr sin6_addr; /* IPv6 address */ 108 }; 109 110 #ifndef EAI_ADDRFAMILY 111 struct addrinfo { 112 int ai_flags; /* AI_PASSIVE, AI_CANONNAME */ 113 int ai_family; /* PF_xxx */ 114 int ai_socktype; /* SOCK_xxx */ 115 int ai_protocol; /* 0 or IPPROTO_xxx for IPv4 and IPv6 */ 116 size_t ai_addrlen; /* length of ai_addr */ 117 char *ai_canonname; /* canonical name for hostname */ 118 struct sockaddr *ai_addr; /* binary address */ 119 struct addrinfo *ai_next; /* next structure in linked list */ 120 }; 121 #endif /* EAI_ADDRFAMILY */ 122 #endif /* defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF) */ 123 #endif /* INET6 */ 124 #else /* _WIN32 */ 125 #include <netdb.h> /* for "struct addrinfo" */ 126 #endif /* _WIN32 */ 127 #include <pcap/namedb.h> 128 129 #include "nametoaddr.h" 130 131 #define ETHERMTU 1500 132 133 #ifndef IPPROTO_HOPOPTS 134 #define IPPROTO_HOPOPTS 0 135 #endif 136 #ifndef IPPROTO_ROUTING 137 #define IPPROTO_ROUTING 43 138 #endif 139 #ifndef IPPROTO_FRAGMENT 140 #define IPPROTO_FRAGMENT 44 141 #endif 142 #ifndef IPPROTO_DSTOPTS 143 #define IPPROTO_DSTOPTS 60 144 #endif 145 #ifndef IPPROTO_SCTP 146 #define IPPROTO_SCTP 132 147 #endif 148 149 #define GENEVE_PORT 6081 150 151 #ifdef HAVE_OS_PROTO_H 152 #include "os-proto.h" 153 #endif 154 155 #define JMP(c) ((c)|BPF_JMP|BPF_K) 156 157 /* 158 * "Push" the current value of the link-layer header type and link-layer 159 * header offset onto a "stack", and set a new value. (It's not a 160 * full-blown stack; we keep only the top two items.) 161 */ 162 #define PUSH_LINKHDR(cs, new_linktype, new_is_variable, new_constant_part, new_reg) \ 163 { \ 164 (cs)->prevlinktype = (cs)->linktype; \ 165 (cs)->off_prevlinkhdr = (cs)->off_linkhdr; \ 166 (cs)->linktype = (new_linktype); \ 167 (cs)->off_linkhdr.is_variable = (new_is_variable); \ 168 (cs)->off_linkhdr.constant_part = (new_constant_part); \ 169 (cs)->off_linkhdr.reg = (new_reg); \ 170 (cs)->is_geneve = 0; \ 171 } 172 173 /* 174 * Offset "not set" value. 175 */ 176 #define OFFSET_NOT_SET 0xffffffffU 177 178 /* 179 * Absolute offsets, which are offsets from the beginning of the raw 180 * packet data, are, in the general case, the sum of a variable value 181 * and a constant value; the variable value may be absent, in which 182 * case the offset is only the constant value, and the constant value 183 * may be zero, in which case the offset is only the variable value. 184 * 185 * bpf_abs_offset is a structure containing all that information: 186 * 187 * is_variable is 1 if there's a variable part. 188 * 189 * constant_part is the constant part of the value, possibly zero; 190 * 191 * if is_variable is 1, reg is the register number for a register 192 * containing the variable value if the register has been assigned, 193 * and -1 otherwise. 194 */ 195 typedef struct { 196 int is_variable; 197 u_int constant_part; 198 int reg; 199 } bpf_abs_offset; 200 201 /* 202 * Value passed to gen_load_a() to indicate what the offset argument 203 * is relative to the beginning of. 204 */ 205 enum e_offrel { 206 OR_PACKET, /* full packet data */ 207 OR_LINKHDR, /* link-layer header */ 208 OR_PREVLINKHDR, /* previous link-layer header */ 209 OR_LLC, /* 802.2 LLC header */ 210 OR_PREVMPLSHDR, /* previous MPLS header */ 211 OR_LINKTYPE, /* link-layer type */ 212 OR_LINKPL, /* link-layer payload */ 213 OR_LINKPL_NOSNAP, /* link-layer payload, with no SNAP header at the link layer */ 214 OR_TRAN_IPV4, /* transport-layer header, with IPv4 network layer */ 215 OR_TRAN_IPV6 /* transport-layer header, with IPv6 network layer */ 216 }; 217 218 /* 219 * We divvy out chunks of memory rather than call malloc each time so 220 * we don't have to worry about leaking memory. It's probably 221 * not a big deal if all this memory was wasted but if this ever 222 * goes into a library that would probably not be a good idea. 223 * 224 * XXX - this *is* in a library.... 225 */ 226 #define NCHUNKS 16 227 #define CHUNK0SIZE 1024 228 struct chunk { 229 size_t n_left; 230 void *m; 231 }; 232 233 /* Code generator state */ 234 235 struct _compiler_state { 236 jmp_buf top_ctx; 237 pcap_t *bpf_pcap; 238 int error_set; 239 240 struct icode ic; 241 242 int snaplen; 243 244 int linktype; 245 int prevlinktype; 246 int outermostlinktype; 247 248 bpf_u_int32 netmask; 249 int no_optimize; 250 251 /* Hack for handling VLAN and MPLS stacks. */ 252 u_int label_stack_depth; 253 u_int vlan_stack_depth; 254 255 /* XXX */ 256 u_int pcap_fddipad; 257 258 /* 259 * As errors are handled by a longjmp, anything allocated must 260 * be freed in the longjmp handler, so it must be reachable 261 * from that handler. 262 * 263 * One thing that's allocated is the result of pcap_nametoaddrinfo(); 264 * it must be freed with freeaddrinfo(). This variable points to 265 * any addrinfo structure that would need to be freed. 266 */ 267 struct addrinfo *ai; 268 269 /* 270 * Another thing that's allocated is the result of pcap_ether_aton(); 271 * it must be freed with free(). This variable points to any 272 * address that would need to be freed. 273 */ 274 u_char *e; 275 276 /* 277 * Various code constructs need to know the layout of the packet. 278 * These values give the necessary offsets from the beginning 279 * of the packet data. 280 */ 281 282 /* 283 * Absolute offset of the beginning of the link-layer header. 284 */ 285 bpf_abs_offset off_linkhdr; 286 287 /* 288 * If we're checking a link-layer header for a packet encapsulated 289 * in another protocol layer, this is the equivalent information 290 * for the previous layers' link-layer header from the beginning 291 * of the raw packet data. 292 */ 293 bpf_abs_offset off_prevlinkhdr; 294 295 /* 296 * This is the equivalent information for the outermost layers' 297 * link-layer header. 298 */ 299 bpf_abs_offset off_outermostlinkhdr; 300 301 /* 302 * Absolute offset of the beginning of the link-layer payload. 303 */ 304 bpf_abs_offset off_linkpl; 305 306 /* 307 * "off_linktype" is the offset to information in the link-layer 308 * header giving the packet type. This is an absolute offset 309 * from the beginning of the packet. 310 * 311 * For Ethernet, it's the offset of the Ethernet type field; this 312 * means that it must have a value that skips VLAN tags. 313 * 314 * For link-layer types that always use 802.2 headers, it's the 315 * offset of the LLC header; this means that it must have a value 316 * that skips VLAN tags. 317 * 318 * For PPP, it's the offset of the PPP type field. 319 * 320 * For Cisco HDLC, it's the offset of the CHDLC type field. 321 * 322 * For BSD loopback, it's the offset of the AF_ value. 323 * 324 * For Linux cooked sockets, it's the offset of the type field. 325 * 326 * off_linktype.constant_part is set to OFFSET_NOT_SET for no 327 * encapsulation, in which case, IP is assumed. 328 */ 329 bpf_abs_offset off_linktype; 330 331 /* 332 * TRUE if the link layer includes an ATM pseudo-header. 333 */ 334 int is_atm; 335 336 /* 337 * TRUE if "geneve" appeared in the filter; it causes us to 338 * generate code that checks for a Geneve header and assume 339 * that later filters apply to the encapsulated payload. 340 */ 341 int is_geneve; 342 343 /* 344 * TRUE if we need variable length part of VLAN offset 345 */ 346 int is_vlan_vloffset; 347 348 /* 349 * These are offsets for the ATM pseudo-header. 350 */ 351 u_int off_vpi; 352 u_int off_vci; 353 u_int off_proto; 354 355 /* 356 * These are offsets for the MTP2 fields. 357 */ 358 u_int off_li; 359 u_int off_li_hsl; 360 361 /* 362 * These are offsets for the MTP3 fields. 363 */ 364 u_int off_sio; 365 u_int off_opc; 366 u_int off_dpc; 367 u_int off_sls; 368 369 /* 370 * This is the offset of the first byte after the ATM pseudo_header, 371 * or -1 if there is no ATM pseudo-header. 372 */ 373 u_int off_payload; 374 375 /* 376 * These are offsets to the beginning of the network-layer header. 377 * They are relative to the beginning of the link-layer payload 378 * (i.e., they don't include off_linkhdr.constant_part or 379 * off_linkpl.constant_part). 380 * 381 * If the link layer never uses 802.2 LLC: 382 * 383 * "off_nl" and "off_nl_nosnap" are the same. 384 * 385 * If the link layer always uses 802.2 LLC: 386 * 387 * "off_nl" is the offset if there's a SNAP header following 388 * the 802.2 header; 389 * 390 * "off_nl_nosnap" is the offset if there's no SNAP header. 391 * 392 * If the link layer is Ethernet: 393 * 394 * "off_nl" is the offset if the packet is an Ethernet II packet 395 * (we assume no 802.3+802.2+SNAP); 396 * 397 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet 398 * with an 802.2 header following it. 399 */ 400 u_int off_nl; 401 u_int off_nl_nosnap; 402 403 /* 404 * Here we handle simple allocation of the scratch registers. 405 * If too many registers are alloc'd, the allocator punts. 406 */ 407 int regused[BPF_MEMWORDS]; 408 int curreg; 409 410 /* 411 * Memory chunks. 412 */ 413 struct chunk chunks[NCHUNKS]; 414 int cur_chunk; 415 }; 416 417 /* 418 * For use by routines outside this file. 419 */ 420 /* VARARGS */ 421 void 422 bpf_set_error(compiler_state_t *cstate, const char *fmt, ...) 423 { 424 va_list ap; 425 426 /* 427 * If we've already set an error, don't override it. 428 * The lexical analyzer reports some errors by setting 429 * the error and then returning a LEX_ERROR token, which 430 * is not recognized by any grammar rule, and thus forces 431 * the parse to stop. We don't want the error reported 432 * by the lexical analyzer to be overwritten by the syntax 433 * error. 434 */ 435 if (!cstate->error_set) { 436 va_start(ap, fmt); 437 (void)vsnprintf(cstate->bpf_pcap->errbuf, PCAP_ERRBUF_SIZE, 438 fmt, ap); 439 va_end(ap); 440 cstate->error_set = 1; 441 } 442 } 443 444 /* 445 * For use *ONLY* in routines in this file. 446 */ 447 static void PCAP_NORETURN bpf_error(compiler_state_t *, const char *, ...) 448 PCAP_PRINTFLIKE(2, 3); 449 450 /* VARARGS */ 451 static void PCAP_NORETURN 452 bpf_error(compiler_state_t *cstate, const char *fmt, ...) 453 { 454 va_list ap; 455 456 va_start(ap, fmt); 457 (void)vsnprintf(cstate->bpf_pcap->errbuf, PCAP_ERRBUF_SIZE, 458 fmt, ap); 459 va_end(ap); 460 longjmp(cstate->top_ctx, 1); 461 /*NOTREACHED*/ 462 #ifdef _AIX 463 PCAP_UNREACHABLE 464 #endif /* _AIX */ 465 } 466 467 static int init_linktype(compiler_state_t *, pcap_t *); 468 469 static void init_regs(compiler_state_t *); 470 static int alloc_reg(compiler_state_t *); 471 static void free_reg(compiler_state_t *, int); 472 473 static void initchunks(compiler_state_t *cstate); 474 static void *newchunk_nolongjmp(compiler_state_t *cstate, size_t); 475 static void *newchunk(compiler_state_t *cstate, size_t); 476 static void freechunks(compiler_state_t *cstate); 477 static inline struct block *new_block(compiler_state_t *cstate, int); 478 static inline struct slist *new_stmt(compiler_state_t *cstate, int); 479 static struct block *gen_retblk(compiler_state_t *cstate, int); 480 static inline void syntax(compiler_state_t *cstate); 481 482 static void backpatch(struct block *, struct block *); 483 static void merge(struct block *, struct block *); 484 static struct block *gen_cmp(compiler_state_t *, enum e_offrel, u_int, 485 u_int, bpf_u_int32); 486 static struct block *gen_cmp_gt(compiler_state_t *, enum e_offrel, u_int, 487 u_int, bpf_u_int32); 488 static struct block *gen_cmp_ge(compiler_state_t *, enum e_offrel, u_int, 489 u_int, bpf_u_int32); 490 static struct block *gen_cmp_lt(compiler_state_t *, enum e_offrel, u_int, 491 u_int, bpf_u_int32); 492 static struct block *gen_cmp_le(compiler_state_t *, enum e_offrel, u_int, 493 u_int, bpf_u_int32); 494 static struct block *gen_mcmp(compiler_state_t *, enum e_offrel, u_int, 495 u_int, bpf_u_int32, bpf_u_int32); 496 static struct block *gen_bcmp(compiler_state_t *, enum e_offrel, u_int, 497 u_int, const u_char *); 498 static struct block *gen_ncmp(compiler_state_t *, enum e_offrel, u_int, 499 u_int, bpf_u_int32, int, int, bpf_u_int32); 500 static struct slist *gen_load_absoffsetrel(compiler_state_t *, bpf_abs_offset *, 501 u_int, u_int); 502 static struct slist *gen_load_a(compiler_state_t *, enum e_offrel, u_int, 503 u_int); 504 static struct slist *gen_loadx_iphdrlen(compiler_state_t *); 505 static struct block *gen_uncond(compiler_state_t *, int); 506 static inline struct block *gen_true(compiler_state_t *); 507 static inline struct block *gen_false(compiler_state_t *); 508 static struct block *gen_ether_linktype(compiler_state_t *, bpf_u_int32); 509 static struct block *gen_ipnet_linktype(compiler_state_t *, bpf_u_int32); 510 static struct block *gen_linux_sll_linktype(compiler_state_t *, bpf_u_int32); 511 static struct slist *gen_load_pflog_llprefixlen(compiler_state_t *); 512 static struct slist *gen_load_prism_llprefixlen(compiler_state_t *); 513 static struct slist *gen_load_avs_llprefixlen(compiler_state_t *); 514 static struct slist *gen_load_radiotap_llprefixlen(compiler_state_t *); 515 static struct slist *gen_load_ppi_llprefixlen(compiler_state_t *); 516 static void insert_compute_vloffsets(compiler_state_t *, struct block *); 517 static struct slist *gen_abs_offset_varpart(compiler_state_t *, 518 bpf_abs_offset *); 519 static bpf_u_int32 ethertype_to_ppptype(bpf_u_int32); 520 static struct block *gen_linktype(compiler_state_t *, bpf_u_int32); 521 static struct block *gen_snap(compiler_state_t *, bpf_u_int32, bpf_u_int32); 522 static struct block *gen_llc_linktype(compiler_state_t *, bpf_u_int32); 523 static struct block *gen_hostop(compiler_state_t *, bpf_u_int32, bpf_u_int32, 524 int, bpf_u_int32, u_int, u_int); 525 #ifdef INET6 526 static struct block *gen_hostop6(compiler_state_t *, struct in6_addr *, 527 struct in6_addr *, int, bpf_u_int32, u_int, u_int); 528 #endif 529 static struct block *gen_ahostop(compiler_state_t *, const u_char *, int); 530 static struct block *gen_ehostop(compiler_state_t *, const u_char *, int); 531 static struct block *gen_fhostop(compiler_state_t *, const u_char *, int); 532 static struct block *gen_thostop(compiler_state_t *, const u_char *, int); 533 static struct block *gen_wlanhostop(compiler_state_t *, const u_char *, int); 534 static struct block *gen_ipfchostop(compiler_state_t *, const u_char *, int); 535 static struct block *gen_dnhostop(compiler_state_t *, bpf_u_int32, int); 536 static struct block *gen_mpls_linktype(compiler_state_t *, bpf_u_int32); 537 static struct block *gen_host(compiler_state_t *, bpf_u_int32, bpf_u_int32, 538 int, int, int); 539 #ifdef INET6 540 static struct block *gen_host6(compiler_state_t *, struct in6_addr *, 541 struct in6_addr *, int, int, int); 542 #endif 543 #ifndef INET6 544 static struct block *gen_gateway(compiler_state_t *, const u_char *, 545 struct addrinfo *, int, int); 546 #endif 547 static struct block *gen_ipfrag(compiler_state_t *); 548 static struct block *gen_portatom(compiler_state_t *, int, bpf_u_int32); 549 static struct block *gen_portrangeatom(compiler_state_t *, u_int, bpf_u_int32, 550 bpf_u_int32); 551 static struct block *gen_portatom6(compiler_state_t *, int, bpf_u_int32); 552 static struct block *gen_portrangeatom6(compiler_state_t *, u_int, bpf_u_int32, 553 bpf_u_int32); 554 static struct block *gen_portop(compiler_state_t *, u_int, u_int, int); 555 static struct block *gen_port(compiler_state_t *, u_int, int, int); 556 static struct block *gen_portrangeop(compiler_state_t *, u_int, u_int, 557 bpf_u_int32, int); 558 static struct block *gen_portrange(compiler_state_t *, u_int, u_int, int, int); 559 struct block *gen_portop6(compiler_state_t *, u_int, u_int, int); 560 static struct block *gen_port6(compiler_state_t *, u_int, int, int); 561 static struct block *gen_portrangeop6(compiler_state_t *, u_int, u_int, 562 bpf_u_int32, int); 563 static struct block *gen_portrange6(compiler_state_t *, u_int, u_int, int, int); 564 static int lookup_proto(compiler_state_t *, const char *, int); 565 #if !defined(NO_PROTOCHAIN) 566 static struct block *gen_protochain(compiler_state_t *, bpf_u_int32, int); 567 #endif /* !defined(NO_PROTOCHAIN) */ 568 static struct block *gen_proto(compiler_state_t *, bpf_u_int32, int, int); 569 static struct slist *xfer_to_x(compiler_state_t *, struct arth *); 570 static struct slist *xfer_to_a(compiler_state_t *, struct arth *); 571 static struct block *gen_mac_multicast(compiler_state_t *, int); 572 static struct block *gen_len(compiler_state_t *, int, int); 573 static struct block *gen_check_802_11_data_frame(compiler_state_t *); 574 static struct block *gen_geneve_ll_check(compiler_state_t *cstate); 575 576 static struct block *gen_ppi_dlt_check(compiler_state_t *); 577 static struct block *gen_atmfield_code_internal(compiler_state_t *, int, 578 bpf_u_int32, int, int); 579 static struct block *gen_atmtype_llc(compiler_state_t *); 580 static struct block *gen_msg_abbrev(compiler_state_t *, int type); 581 582 static void 583 initchunks(compiler_state_t *cstate) 584 { 585 int i; 586 587 for (i = 0; i < NCHUNKS; i++) { 588 cstate->chunks[i].n_left = 0; 589 cstate->chunks[i].m = NULL; 590 } 591 cstate->cur_chunk = 0; 592 } 593 594 static void * 595 newchunk_nolongjmp(compiler_state_t *cstate, size_t n) 596 { 597 struct chunk *cp; 598 int k; 599 size_t size; 600 601 #ifndef __NetBSD__ 602 /* XXX Round up to nearest long. */ 603 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 604 #else 605 /* XXX Round up to structure boundary. */ 606 n = ALIGN(n); 607 #endif 608 609 cp = &cstate->chunks[cstate->cur_chunk]; 610 if (n > cp->n_left) { 611 ++cp; 612 k = ++cstate->cur_chunk; 613 if (k >= NCHUNKS) { 614 bpf_set_error(cstate, "out of memory"); 615 return (NULL); 616 } 617 size = CHUNK0SIZE << k; 618 cp->m = (void *)malloc(size); 619 if (cp->m == NULL) { 620 bpf_set_error(cstate, "out of memory"); 621 return (NULL); 622 } 623 memset((char *)cp->m, 0, size); 624 cp->n_left = size; 625 if (n > size) { 626 bpf_set_error(cstate, "out of memory"); 627 return (NULL); 628 } 629 } 630 cp->n_left -= n; 631 return (void *)((char *)cp->m + cp->n_left); 632 } 633 634 static void * 635 newchunk(compiler_state_t *cstate, size_t n) 636 { 637 void *p; 638 639 p = newchunk_nolongjmp(cstate, n); 640 if (p == NULL) { 641 longjmp(cstate->top_ctx, 1); 642 /*NOTREACHED*/ 643 } 644 return (p); 645 } 646 647 static void 648 freechunks(compiler_state_t *cstate) 649 { 650 int i; 651 652 for (i = 0; i < NCHUNKS; ++i) 653 if (cstate->chunks[i].m != NULL) 654 free(cstate->chunks[i].m); 655 } 656 657 /* 658 * A strdup whose allocations are freed after code generation is over. 659 * This is used by the lexical analyzer, so it can't longjmp; it just 660 * returns NULL on an allocation error, and the callers must check 661 * for it. 662 */ 663 char * 664 sdup(compiler_state_t *cstate, const char *s) 665 { 666 size_t n = strlen(s) + 1; 667 char *cp = newchunk_nolongjmp(cstate, n); 668 669 if (cp == NULL) 670 return (NULL); 671 pcapint_strlcpy(cp, s, n); 672 return (cp); 673 } 674 675 static inline struct block * 676 new_block(compiler_state_t *cstate, int code) 677 { 678 struct block *p; 679 680 p = (struct block *)newchunk(cstate, sizeof(*p)); 681 p->s.code = code; 682 p->head = p; 683 684 return p; 685 } 686 687 static inline struct slist * 688 new_stmt(compiler_state_t *cstate, int code) 689 { 690 struct slist *p; 691 692 p = (struct slist *)newchunk(cstate, sizeof(*p)); 693 p->s.code = code; 694 695 return p; 696 } 697 698 static struct block * 699 gen_retblk(compiler_state_t *cstate, int v) 700 { 701 struct block *b = new_block(cstate, BPF_RET|BPF_K); 702 703 b->s.k = v; 704 return b; 705 } 706 707 static inline PCAP_NORETURN_DEF void 708 syntax(compiler_state_t *cstate) 709 { 710 bpf_error(cstate, "syntax error in filter expression"); 711 } 712 713 int 714 pcap_compile(pcap_t *p, struct bpf_program *program, 715 const char *buf, int optimize, bpf_u_int32 mask) 716 { 717 #ifdef _WIN32 718 static int done = 0; 719 #endif 720 compiler_state_t cstate; 721 const char * volatile xbuf = buf; 722 yyscan_t scanner = NULL; 723 volatile YY_BUFFER_STATE in_buffer = NULL; 724 u_int len; 725 int rc; 726 727 /* 728 * If this pcap_t hasn't been activated, it doesn't have a 729 * link-layer type, so we can't use it. 730 */ 731 if (!p->activated) { 732 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 733 "not-yet-activated pcap_t passed to pcap_compile"); 734 return (PCAP_ERROR); 735 } 736 737 #ifdef _WIN32 738 if (!done) { 739 pcap_wsockinit(); 740 done = 1; 741 } 742 #endif 743 744 #ifdef ENABLE_REMOTE 745 /* 746 * If the device on which we're capturing need to be notified 747 * that a new filter is being compiled, do so. 748 * 749 * This allows them to save a copy of it, in case, for example, 750 * they're implementing a form of remote packet capture, and 751 * want the remote machine to filter out the packets in which 752 * it's sending the packets it's captured. 753 * 754 * XXX - the fact that we happen to be compiling a filter 755 * doesn't necessarily mean we'll be installing it as the 756 * filter for this pcap_t; we might be running it from userland 757 * on captured packets to do packet classification. We really 758 * need a better way of handling this, but this is all that 759 * the WinPcap remote capture code did. 760 */ 761 if (p->save_current_filter_op != NULL) 762 (p->save_current_filter_op)(p, buf); 763 #endif 764 765 initchunks(&cstate); 766 cstate.no_optimize = 0; 767 #ifdef INET6 768 cstate.ai = NULL; 769 #endif 770 cstate.e = NULL; 771 cstate.ic.root = NULL; 772 cstate.ic.cur_mark = 0; 773 cstate.bpf_pcap = p; 774 cstate.error_set = 0; 775 init_regs(&cstate); 776 777 cstate.netmask = mask; 778 779 cstate.snaplen = pcap_snapshot(p); 780 if (cstate.snaplen == 0) { 781 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 782 "snaplen of 0 rejects all packets"); 783 rc = PCAP_ERROR; 784 goto quit; 785 } 786 787 if (pcap_lex_init(&scanner) != 0) { 788 pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, 789 errno, "can't initialize scanner"); 790 rc = PCAP_ERROR; 791 goto quit; 792 } 793 in_buffer = pcap__scan_string(xbuf ? xbuf : "", scanner); 794 795 /* 796 * Associate the compiler state with the lexical analyzer 797 * state. 798 */ 799 pcap_set_extra(&cstate, scanner); 800 801 if (init_linktype(&cstate, p) == -1) { 802 rc = PCAP_ERROR; 803 goto quit; 804 } 805 if (pcap_parse(scanner, &cstate) != 0) { 806 #ifdef INET6 807 if (cstate.ai != NULL) 808 freeaddrinfo(cstate.ai); 809 #endif 810 if (cstate.e != NULL) 811 free(cstate.e); 812 rc = PCAP_ERROR; 813 goto quit; 814 } 815 816 if (cstate.ic.root == NULL) { 817 /* 818 * Catch errors reported by gen_retblk(). 819 */ 820 if (setjmp(cstate.top_ctx)) { 821 rc = PCAP_ERROR; 822 goto quit; 823 } 824 cstate.ic.root = gen_retblk(&cstate, cstate.snaplen); 825 } 826 827 if (optimize && !cstate.no_optimize) { 828 if (bpf_optimize(&cstate.ic, p->errbuf) == -1) { 829 /* Failure */ 830 rc = PCAP_ERROR; 831 goto quit; 832 } 833 if (cstate.ic.root == NULL || 834 (cstate.ic.root->s.code == (BPF_RET|BPF_K) && cstate.ic.root->s.k == 0)) { 835 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 836 "expression rejects all packets"); 837 rc = PCAP_ERROR; 838 goto quit; 839 } 840 } 841 program->bf_insns = icode_to_fcode(&cstate.ic, 842 cstate.ic.root, &len, p->errbuf); 843 if (program->bf_insns == NULL) { 844 /* Failure */ 845 rc = PCAP_ERROR; 846 goto quit; 847 } 848 program->bf_len = len; 849 850 rc = 0; /* We're all okay */ 851 852 quit: 853 /* 854 * Clean up everything for the lexical analyzer. 855 */ 856 if (in_buffer != NULL) 857 pcap__delete_buffer(in_buffer, scanner); 858 if (scanner != NULL) 859 pcap_lex_destroy(scanner); 860 861 /* 862 * Clean up our own allocated memory. 863 */ 864 freechunks(&cstate); 865 866 return (rc); 867 } 868 869 /* 870 * entry point for using the compiler with no pcap open 871 * pass in all the stuff that is needed explicitly instead. 872 */ 873 int 874 pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 875 struct bpf_program *program, 876 const char *buf, int optimize, bpf_u_int32 mask) 877 { 878 pcap_t *p; 879 int ret; 880 881 p = pcap_open_dead(linktype_arg, snaplen_arg); 882 if (p == NULL) 883 return (PCAP_ERROR); 884 ret = pcap_compile(p, program, buf, optimize, mask); 885 pcap_close(p); 886 return (ret); 887 } 888 889 /* 890 * Clean up a "struct bpf_program" by freeing all the memory allocated 891 * in it. 892 */ 893 void 894 pcap_freecode(struct bpf_program *program) 895 { 896 program->bf_len = 0; 897 if (program->bf_insns != NULL) { 898 free((char *)program->bf_insns); 899 program->bf_insns = NULL; 900 } 901 } 902 903 /* 904 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 905 * which of the jt and jf fields has been resolved and which is a pointer 906 * back to another unresolved block (or nil). At least one of the fields 907 * in each block is already resolved. 908 */ 909 static void 910 backpatch(struct block *list, struct block *target) 911 { 912 struct block *next; 913 914 while (list) { 915 if (!list->sense) { 916 next = JT(list); 917 JT(list) = target; 918 } else { 919 next = JF(list); 920 JF(list) = target; 921 } 922 list = next; 923 } 924 } 925 926 /* 927 * Merge the lists in b0 and b1, using the 'sense' field to indicate 928 * which of jt and jf is the link. 929 */ 930 static void 931 merge(struct block *b0, struct block *b1) 932 { 933 register struct block **p = &b0; 934 935 /* Find end of list. */ 936 while (*p) 937 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 938 939 /* Concatenate the lists. */ 940 *p = b1; 941 } 942 943 int 944 finish_parse(compiler_state_t *cstate, struct block *p) 945 { 946 struct block *ppi_dlt_check; 947 948 /* 949 * Catch errors reported by us and routines below us, and return -1 950 * on an error. 951 */ 952 if (setjmp(cstate->top_ctx)) 953 return (-1); 954 955 /* 956 * Insert before the statements of the first (root) block any 957 * statements needed to load the lengths of any variable-length 958 * headers into registers. 959 * 960 * XXX - a fancier strategy would be to insert those before the 961 * statements of all blocks that use those lengths and that 962 * have no predecessors that use them, so that we only compute 963 * the lengths if we need them. There might be even better 964 * approaches than that. 965 * 966 * However, those strategies would be more complicated, and 967 * as we don't generate code to compute a length if the 968 * program has no tests that use the length, and as most 969 * tests will probably use those lengths, we would just 970 * postpone computing the lengths so that it's not done 971 * for tests that fail early, and it's not clear that's 972 * worth the effort. 973 */ 974 insert_compute_vloffsets(cstate, p->head); 975 976 /* 977 * For DLT_PPI captures, generate a check of the per-packet 978 * DLT value to make sure it's DLT_IEEE802_11. 979 * 980 * XXX - TurboCap cards use DLT_PPI for Ethernet. 981 * Can we just define some DLT_ETHERNET_WITH_PHDR pseudo-header 982 * with appropriate Ethernet information and use that rather 983 * than using something such as DLT_PPI where you don't know 984 * the link-layer header type until runtime, which, in the 985 * general case, would force us to generate both Ethernet *and* 986 * 802.11 code (*and* anything else for which PPI is used) 987 * and choose between them early in the BPF program? 988 */ 989 ppi_dlt_check = gen_ppi_dlt_check(cstate); 990 if (ppi_dlt_check != NULL) 991 gen_and(ppi_dlt_check, p); 992 993 backpatch(p, gen_retblk(cstate, cstate->snaplen)); 994 p->sense = !p->sense; 995 backpatch(p, gen_retblk(cstate, 0)); 996 cstate->ic.root = p->head; 997 return (0); 998 } 999 1000 void 1001 gen_and(struct block *b0, struct block *b1) 1002 { 1003 backpatch(b0, b1->head); 1004 b0->sense = !b0->sense; 1005 b1->sense = !b1->sense; 1006 merge(b1, b0); 1007 b1->sense = !b1->sense; 1008 b1->head = b0->head; 1009 } 1010 1011 void 1012 gen_or(struct block *b0, struct block *b1) 1013 { 1014 b0->sense = !b0->sense; 1015 backpatch(b0, b1->head); 1016 b0->sense = !b0->sense; 1017 merge(b1, b0); 1018 b1->head = b0->head; 1019 } 1020 1021 void 1022 gen_not(struct block *b) 1023 { 1024 b->sense = !b->sense; 1025 } 1026 1027 static struct block * 1028 gen_cmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1029 u_int size, bpf_u_int32 v) 1030 { 1031 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v); 1032 } 1033 1034 static struct block * 1035 gen_cmp_gt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1036 u_int size, bpf_u_int32 v) 1037 { 1038 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 0, v); 1039 } 1040 1041 static struct block * 1042 gen_cmp_ge(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1043 u_int size, bpf_u_int32 v) 1044 { 1045 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 0, v); 1046 } 1047 1048 static struct block * 1049 gen_cmp_lt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1050 u_int size, bpf_u_int32 v) 1051 { 1052 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 1, v); 1053 } 1054 1055 static struct block * 1056 gen_cmp_le(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1057 u_int size, bpf_u_int32 v) 1058 { 1059 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 1, v); 1060 } 1061 1062 static struct block * 1063 gen_mcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1064 u_int size, bpf_u_int32 v, bpf_u_int32 mask) 1065 { 1066 return gen_ncmp(cstate, offrel, offset, size, mask, BPF_JEQ, 0, v); 1067 } 1068 1069 static struct block * 1070 gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1071 u_int size, const u_char *v) 1072 { 1073 register struct block *b, *tmp; 1074 1075 b = NULL; 1076 while (size >= 4) { 1077 register const u_char *p = &v[size - 4]; 1078 1079 tmp = gen_cmp(cstate, offrel, offset + size - 4, BPF_W, 1080 EXTRACT_BE_U_4(p)); 1081 if (b != NULL) 1082 gen_and(b, tmp); 1083 b = tmp; 1084 size -= 4; 1085 } 1086 while (size >= 2) { 1087 register const u_char *p = &v[size - 2]; 1088 1089 tmp = gen_cmp(cstate, offrel, offset + size - 2, BPF_H, 1090 EXTRACT_BE_U_2(p)); 1091 if (b != NULL) 1092 gen_and(b, tmp); 1093 b = tmp; 1094 size -= 2; 1095 } 1096 if (size > 0) { 1097 tmp = gen_cmp(cstate, offrel, offset, BPF_B, v[0]); 1098 if (b != NULL) 1099 gen_and(b, tmp); 1100 b = tmp; 1101 } 1102 return b; 1103 } 1104 1105 /* 1106 * AND the field of size "size" at offset "offset" relative to the header 1107 * specified by "offrel" with "mask", and compare it with the value "v" 1108 * with the test specified by "jtype"; if "reverse" is true, the test 1109 * should test the opposite of "jtype". 1110 */ 1111 static struct block * 1112 gen_ncmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1113 u_int size, bpf_u_int32 mask, int jtype, int reverse, 1114 bpf_u_int32 v) 1115 { 1116 struct slist *s, *s2; 1117 struct block *b; 1118 1119 s = gen_load_a(cstate, offrel, offset, size); 1120 1121 if (mask != 0xffffffff) { 1122 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 1123 s2->s.k = mask; 1124 sappend(s, s2); 1125 } 1126 1127 b = new_block(cstate, JMP(jtype)); 1128 b->stmts = s; 1129 b->s.k = v; 1130 if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE)) 1131 gen_not(b); 1132 return b; 1133 } 1134 1135 static int 1136 init_linktype(compiler_state_t *cstate, pcap_t *p) 1137 { 1138 cstate->pcap_fddipad = p->fddipad; 1139 1140 /* 1141 * We start out with only one link-layer header. 1142 */ 1143 cstate->outermostlinktype = pcap_datalink(p); 1144 cstate->off_outermostlinkhdr.constant_part = 0; 1145 cstate->off_outermostlinkhdr.is_variable = 0; 1146 cstate->off_outermostlinkhdr.reg = -1; 1147 1148 cstate->prevlinktype = cstate->outermostlinktype; 1149 cstate->off_prevlinkhdr.constant_part = 0; 1150 cstate->off_prevlinkhdr.is_variable = 0; 1151 cstate->off_prevlinkhdr.reg = -1; 1152 1153 cstate->linktype = cstate->outermostlinktype; 1154 cstate->off_linkhdr.constant_part = 0; 1155 cstate->off_linkhdr.is_variable = 0; 1156 cstate->off_linkhdr.reg = -1; 1157 1158 /* 1159 * XXX 1160 */ 1161 cstate->off_linkpl.constant_part = 0; 1162 cstate->off_linkpl.is_variable = 0; 1163 cstate->off_linkpl.reg = -1; 1164 1165 cstate->off_linktype.constant_part = 0; 1166 cstate->off_linktype.is_variable = 0; 1167 cstate->off_linktype.reg = -1; 1168 1169 /* 1170 * Assume it's not raw ATM with a pseudo-header, for now. 1171 */ 1172 cstate->is_atm = 0; 1173 cstate->off_vpi = OFFSET_NOT_SET; 1174 cstate->off_vci = OFFSET_NOT_SET; 1175 cstate->off_proto = OFFSET_NOT_SET; 1176 cstate->off_payload = OFFSET_NOT_SET; 1177 1178 /* 1179 * And not Geneve. 1180 */ 1181 cstate->is_geneve = 0; 1182 1183 /* 1184 * No variable length VLAN offset by default 1185 */ 1186 cstate->is_vlan_vloffset = 0; 1187 1188 /* 1189 * And assume we're not doing SS7. 1190 */ 1191 cstate->off_li = OFFSET_NOT_SET; 1192 cstate->off_li_hsl = OFFSET_NOT_SET; 1193 cstate->off_sio = OFFSET_NOT_SET; 1194 cstate->off_opc = OFFSET_NOT_SET; 1195 cstate->off_dpc = OFFSET_NOT_SET; 1196 cstate->off_sls = OFFSET_NOT_SET; 1197 1198 cstate->label_stack_depth = 0; 1199 cstate->vlan_stack_depth = 0; 1200 1201 switch (cstate->linktype) { 1202 1203 case DLT_ARCNET: 1204 cstate->off_linktype.constant_part = 2; 1205 cstate->off_linkpl.constant_part = 6; 1206 cstate->off_nl = 0; /* XXX in reality, variable! */ 1207 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1208 break; 1209 1210 case DLT_ARCNET_LINUX: 1211 cstate->off_linktype.constant_part = 4; 1212 cstate->off_linkpl.constant_part = 8; 1213 cstate->off_nl = 0; /* XXX in reality, variable! */ 1214 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1215 break; 1216 1217 case DLT_EN10MB: 1218 cstate->off_linktype.constant_part = 12; 1219 cstate->off_linkpl.constant_part = 14; /* Ethernet header length */ 1220 cstate->off_nl = 0; /* Ethernet II */ 1221 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 1222 break; 1223 1224 case DLT_SLIP: 1225 /* 1226 * SLIP doesn't have a link level type. The 16 byte 1227 * header is hacked into our SLIP driver. 1228 */ 1229 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1230 cstate->off_linkpl.constant_part = 16; 1231 cstate->off_nl = 0; 1232 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1233 break; 1234 1235 case DLT_SLIP_BSDOS: 1236 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 1237 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1238 /* XXX end */ 1239 cstate->off_linkpl.constant_part = 24; 1240 cstate->off_nl = 0; 1241 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1242 break; 1243 1244 case DLT_NULL: 1245 case DLT_LOOP: 1246 cstate->off_linktype.constant_part = 0; 1247 cstate->off_linkpl.constant_part = 4; 1248 cstate->off_nl = 0; 1249 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1250 break; 1251 1252 case DLT_ENC: 1253 cstate->off_linktype.constant_part = 0; 1254 cstate->off_linkpl.constant_part = 12; 1255 cstate->off_nl = 0; 1256 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1257 break; 1258 1259 case DLT_PPP: 1260 case DLT_PPP_PPPD: 1261 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 1262 case DLT_HDLC: /* NetBSD (Cisco) HDLC */ 1263 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */ 1264 cstate->off_linktype.constant_part = 2; /* skip HDLC-like framing */ 1265 cstate->off_linkpl.constant_part = 4; /* skip HDLC-like framing and protocol field */ 1266 cstate->off_nl = 0; 1267 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1268 break; 1269 1270 case DLT_PPP_ETHER: 1271 /* 1272 * This does no include the Ethernet header, and 1273 * only covers session state. 1274 */ 1275 cstate->off_linktype.constant_part = 6; 1276 cstate->off_linkpl.constant_part = 8; 1277 cstate->off_nl = 0; 1278 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1279 break; 1280 1281 case DLT_PPP_BSDOS: 1282 cstate->off_linktype.constant_part = 5; 1283 cstate->off_linkpl.constant_part = 24; 1284 cstate->off_nl = 0; 1285 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1286 break; 1287 1288 case DLT_FDDI: 1289 /* 1290 * FDDI doesn't really have a link-level type field. 1291 * We set "off_linktype" to the offset of the LLC header. 1292 * 1293 * To check for Ethernet types, we assume that SSAP = SNAP 1294 * is being used and pick out the encapsulated Ethernet type. 1295 * XXX - should we generate code to check for SNAP? 1296 */ 1297 cstate->off_linktype.constant_part = 13; 1298 cstate->off_linktype.constant_part += cstate->pcap_fddipad; 1299 cstate->off_linkpl.constant_part = 13; /* FDDI MAC header length */ 1300 cstate->off_linkpl.constant_part += cstate->pcap_fddipad; 1301 cstate->off_nl = 8; /* 802.2+SNAP */ 1302 cstate->off_nl_nosnap = 3; /* 802.2 */ 1303 break; 1304 1305 case DLT_IEEE802: 1306 /* 1307 * Token Ring doesn't really have a link-level type field. 1308 * We set "off_linktype" to the offset of the LLC header. 1309 * 1310 * To check for Ethernet types, we assume that SSAP = SNAP 1311 * is being used and pick out the encapsulated Ethernet type. 1312 * XXX - should we generate code to check for SNAP? 1313 * 1314 * XXX - the header is actually variable-length. 1315 * Some various Linux patched versions gave 38 1316 * as "off_linktype" and 40 as "off_nl"; however, 1317 * if a token ring packet has *no* routing 1318 * information, i.e. is not source-routed, the correct 1319 * values are 20 and 22, as they are in the vanilla code. 1320 * 1321 * A packet is source-routed iff the uppermost bit 1322 * of the first byte of the source address, at an 1323 * offset of 8, has the uppermost bit set. If the 1324 * packet is source-routed, the total number of bytes 1325 * of routing information is 2 plus bits 0x1F00 of 1326 * the 16-bit value at an offset of 14 (shifted right 1327 * 8 - figure out which byte that is). 1328 */ 1329 cstate->off_linktype.constant_part = 14; 1330 cstate->off_linkpl.constant_part = 14; /* Token Ring MAC header length */ 1331 cstate->off_nl = 8; /* 802.2+SNAP */ 1332 cstate->off_nl_nosnap = 3; /* 802.2 */ 1333 break; 1334 1335 case DLT_PRISM_HEADER: 1336 case DLT_IEEE802_11_RADIO_AVS: 1337 case DLT_IEEE802_11_RADIO: 1338 cstate->off_linkhdr.is_variable = 1; 1339 /* Fall through, 802.11 doesn't have a variable link 1340 * prefix but is otherwise the same. */ 1341 /* FALLTHROUGH */ 1342 1343 case DLT_IEEE802_11: 1344 /* 1345 * 802.11 doesn't really have a link-level type field. 1346 * We set "off_linktype.constant_part" to the offset of 1347 * the LLC header. 1348 * 1349 * To check for Ethernet types, we assume that SSAP = SNAP 1350 * is being used and pick out the encapsulated Ethernet type. 1351 * XXX - should we generate code to check for SNAP? 1352 * 1353 * We also handle variable-length radio headers here. 1354 * The Prism header is in theory variable-length, but in 1355 * practice it's always 144 bytes long. However, some 1356 * drivers on Linux use ARPHRD_IEEE80211_PRISM, but 1357 * sometimes or always supply an AVS header, so we 1358 * have to check whether the radio header is a Prism 1359 * header or an AVS header, so, in practice, it's 1360 * variable-length. 1361 */ 1362 cstate->off_linktype.constant_part = 24; 1363 cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */ 1364 cstate->off_linkpl.is_variable = 1; 1365 cstate->off_nl = 8; /* 802.2+SNAP */ 1366 cstate->off_nl_nosnap = 3; /* 802.2 */ 1367 break; 1368 1369 case DLT_PPI: 1370 /* 1371 * At the moment we treat PPI the same way that we treat 1372 * normal Radiotap encoded packets. The difference is in 1373 * the function that generates the code at the beginning 1374 * to compute the header length. Since this code generator 1375 * of PPI supports bare 802.11 encapsulation only (i.e. 1376 * the encapsulated DLT should be DLT_IEEE802_11) we 1377 * generate code to check for this too. 1378 */ 1379 cstate->off_linktype.constant_part = 24; 1380 cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */ 1381 cstate->off_linkpl.is_variable = 1; 1382 cstate->off_linkhdr.is_variable = 1; 1383 cstate->off_nl = 8; /* 802.2+SNAP */ 1384 cstate->off_nl_nosnap = 3; /* 802.2 */ 1385 break; 1386 1387 case DLT_ATM_RFC1483: 1388 case DLT_ATM_CLIP: /* Linux ATM defines this */ 1389 /* 1390 * assume routed, non-ISO PDUs 1391 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 1392 * 1393 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS, 1394 * or PPP with the PPP NLPID (e.g., PPPoA)? The 1395 * latter would presumably be treated the way PPPoE 1396 * should be, so you can do "pppoe and udp port 2049" 1397 * or "pppoa and tcp port 80" and have it check for 1398 * PPPo{A,E} and a PPP protocol of IP and.... 1399 */ 1400 cstate->off_linktype.constant_part = 0; 1401 cstate->off_linkpl.constant_part = 0; /* packet begins with LLC header */ 1402 cstate->off_nl = 8; /* 802.2+SNAP */ 1403 cstate->off_nl_nosnap = 3; /* 802.2 */ 1404 break; 1405 1406 case DLT_SUNATM: 1407 /* 1408 * Full Frontal ATM; you get AALn PDUs with an ATM 1409 * pseudo-header. 1410 */ 1411 cstate->is_atm = 1; 1412 cstate->off_vpi = SUNATM_VPI_POS; 1413 cstate->off_vci = SUNATM_VCI_POS; 1414 cstate->off_proto = PROTO_POS; 1415 cstate->off_payload = SUNATM_PKT_BEGIN_POS; 1416 cstate->off_linktype.constant_part = cstate->off_payload; 1417 cstate->off_linkpl.constant_part = cstate->off_payload; /* if LLC-encapsulated */ 1418 cstate->off_nl = 8; /* 802.2+SNAP */ 1419 cstate->off_nl_nosnap = 3; /* 802.2 */ 1420 break; 1421 1422 case DLT_RAW: 1423 case DLT_IPV4: 1424 case DLT_IPV6: 1425 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1426 cstate->off_linkpl.constant_part = 0; 1427 cstate->off_nl = 0; 1428 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1429 break; 1430 1431 case DLT_LINUX_SLL: /* fake header for Linux cooked socket v1 */ 1432 cstate->off_linktype.constant_part = 14; 1433 cstate->off_linkpl.constant_part = 16; 1434 cstate->off_nl = 0; 1435 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1436 break; 1437 1438 case DLT_LINUX_SLL2: /* fake header for Linux cooked socket v2 */ 1439 cstate->off_linktype.constant_part = 0; 1440 cstate->off_linkpl.constant_part = 20; 1441 cstate->off_nl = 0; 1442 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1443 break; 1444 1445 case DLT_LTALK: 1446 /* 1447 * LocalTalk does have a 1-byte type field in the LLAP header, 1448 * but really it just indicates whether there is a "short" or 1449 * "long" DDP packet following. 1450 */ 1451 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1452 cstate->off_linkpl.constant_part = 0; 1453 cstate->off_nl = 0; 1454 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1455 break; 1456 1457 case DLT_IP_OVER_FC: 1458 /* 1459 * RFC 2625 IP-over-Fibre-Channel doesn't really have a 1460 * link-level type field. We set "off_linktype" to the 1461 * offset of the LLC header. 1462 * 1463 * To check for Ethernet types, we assume that SSAP = SNAP 1464 * is being used and pick out the encapsulated Ethernet type. 1465 * XXX - should we generate code to check for SNAP? RFC 1466 * 2625 says SNAP should be used. 1467 */ 1468 cstate->off_linktype.constant_part = 16; 1469 cstate->off_linkpl.constant_part = 16; 1470 cstate->off_nl = 8; /* 802.2+SNAP */ 1471 cstate->off_nl_nosnap = 3; /* 802.2 */ 1472 break; 1473 1474 case DLT_FRELAY: 1475 /* 1476 * XXX - we should set this to handle SNAP-encapsulated 1477 * frames (NLPID of 0x80). 1478 */ 1479 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1480 cstate->off_linkpl.constant_part = 0; 1481 cstate->off_nl = 0; 1482 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1483 break; 1484 1485 /* 1486 * the only BPF-interesting FRF.16 frames are non-control frames; 1487 * Frame Relay has a variable length link-layer 1488 * so lets start with offset 4 for now and increments later on (FIXME); 1489 */ 1490 case DLT_MFR: 1491 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1492 cstate->off_linkpl.constant_part = 0; 1493 cstate->off_nl = 4; 1494 cstate->off_nl_nosnap = 0; /* XXX - for now -> no 802.2 LLC */ 1495 break; 1496 1497 case DLT_APPLE_IP_OVER_IEEE1394: 1498 cstate->off_linktype.constant_part = 16; 1499 cstate->off_linkpl.constant_part = 18; 1500 cstate->off_nl = 0; 1501 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1502 break; 1503 1504 case DLT_SYMANTEC_FIREWALL: 1505 cstate->off_linktype.constant_part = 6; 1506 cstate->off_linkpl.constant_part = 44; 1507 cstate->off_nl = 0; /* Ethernet II */ 1508 cstate->off_nl_nosnap = 0; /* XXX - what does it do with 802.3 packets? */ 1509 break; 1510 1511 case DLT_PFLOG: 1512 cstate->off_linktype.constant_part = 0; 1513 cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */ 1514 cstate->off_linkpl.is_variable = 1; 1515 cstate->off_nl = 0; 1516 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1517 break; 1518 1519 case DLT_JUNIPER_MFR: 1520 case DLT_JUNIPER_MLFR: 1521 case DLT_JUNIPER_MLPPP: 1522 case DLT_JUNIPER_PPP: 1523 case DLT_JUNIPER_CHDLC: 1524 case DLT_JUNIPER_FRELAY: 1525 cstate->off_linktype.constant_part = 4; 1526 cstate->off_linkpl.constant_part = 4; 1527 cstate->off_nl = 0; 1528 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1529 break; 1530 1531 case DLT_JUNIPER_ATM1: 1532 cstate->off_linktype.constant_part = 4; /* in reality variable between 4-8 */ 1533 cstate->off_linkpl.constant_part = 4; /* in reality variable between 4-8 */ 1534 cstate->off_nl = 0; 1535 cstate->off_nl_nosnap = 10; 1536 break; 1537 1538 case DLT_JUNIPER_ATM2: 1539 cstate->off_linktype.constant_part = 8; /* in reality variable between 8-12 */ 1540 cstate->off_linkpl.constant_part = 8; /* in reality variable between 8-12 */ 1541 cstate->off_nl = 0; 1542 cstate->off_nl_nosnap = 10; 1543 break; 1544 1545 /* frames captured on a Juniper PPPoE service PIC 1546 * contain raw ethernet frames */ 1547 case DLT_JUNIPER_PPPOE: 1548 case DLT_JUNIPER_ETHER: 1549 cstate->off_linkpl.constant_part = 14; 1550 cstate->off_linktype.constant_part = 16; 1551 cstate->off_nl = 18; /* Ethernet II */ 1552 cstate->off_nl_nosnap = 21; /* 802.3+802.2 */ 1553 break; 1554 1555 case DLT_JUNIPER_PPPOE_ATM: 1556 cstate->off_linktype.constant_part = 4; 1557 cstate->off_linkpl.constant_part = 6; 1558 cstate->off_nl = 0; 1559 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1560 break; 1561 1562 case DLT_JUNIPER_GGSN: 1563 cstate->off_linktype.constant_part = 6; 1564 cstate->off_linkpl.constant_part = 12; 1565 cstate->off_nl = 0; 1566 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1567 break; 1568 1569 case DLT_JUNIPER_ES: 1570 cstate->off_linktype.constant_part = 6; 1571 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; /* not really a network layer but raw IP addresses */ 1572 cstate->off_nl = OFFSET_NOT_SET; /* not really a network layer but raw IP addresses */ 1573 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1574 break; 1575 1576 case DLT_JUNIPER_MONITOR: 1577 cstate->off_linktype.constant_part = 12; 1578 cstate->off_linkpl.constant_part = 12; 1579 cstate->off_nl = 0; /* raw IP/IP6 header */ 1580 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1581 break; 1582 1583 case DLT_BACNET_MS_TP: 1584 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1585 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1586 cstate->off_nl = OFFSET_NOT_SET; 1587 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1588 break; 1589 1590 case DLT_JUNIPER_SERVICES: 1591 cstate->off_linktype.constant_part = 12; 1592 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; /* L3 proto location dep. on cookie type */ 1593 cstate->off_nl = OFFSET_NOT_SET; /* L3 proto location dep. on cookie type */ 1594 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1595 break; 1596 1597 case DLT_JUNIPER_VP: 1598 cstate->off_linktype.constant_part = 18; 1599 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1600 cstate->off_nl = OFFSET_NOT_SET; 1601 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1602 break; 1603 1604 case DLT_JUNIPER_ST: 1605 cstate->off_linktype.constant_part = 18; 1606 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1607 cstate->off_nl = OFFSET_NOT_SET; 1608 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1609 break; 1610 1611 case DLT_JUNIPER_ISM: 1612 cstate->off_linktype.constant_part = 8; 1613 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1614 cstate->off_nl = OFFSET_NOT_SET; 1615 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1616 break; 1617 1618 case DLT_JUNIPER_VS: 1619 case DLT_JUNIPER_SRX_E2E: 1620 case DLT_JUNIPER_FIBRECHANNEL: 1621 case DLT_JUNIPER_ATM_CEMIC: 1622 cstate->off_linktype.constant_part = 8; 1623 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1624 cstate->off_nl = OFFSET_NOT_SET; 1625 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1626 break; 1627 1628 case DLT_MTP2: 1629 cstate->off_li = 2; 1630 cstate->off_li_hsl = 4; 1631 cstate->off_sio = 3; 1632 cstate->off_opc = 4; 1633 cstate->off_dpc = 4; 1634 cstate->off_sls = 7; 1635 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1636 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1637 cstate->off_nl = OFFSET_NOT_SET; 1638 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1639 break; 1640 1641 case DLT_MTP2_WITH_PHDR: 1642 cstate->off_li = 6; 1643 cstate->off_li_hsl = 8; 1644 cstate->off_sio = 7; 1645 cstate->off_opc = 8; 1646 cstate->off_dpc = 8; 1647 cstate->off_sls = 11; 1648 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1649 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1650 cstate->off_nl = OFFSET_NOT_SET; 1651 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1652 break; 1653 1654 case DLT_ERF: 1655 cstate->off_li = 22; 1656 cstate->off_li_hsl = 24; 1657 cstate->off_sio = 23; 1658 cstate->off_opc = 24; 1659 cstate->off_dpc = 24; 1660 cstate->off_sls = 27; 1661 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1662 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1663 cstate->off_nl = OFFSET_NOT_SET; 1664 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1665 break; 1666 1667 case DLT_PFSYNC: 1668 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1669 cstate->off_linkpl.constant_part = 4; 1670 cstate->off_nl = 0; 1671 cstate->off_nl_nosnap = 0; 1672 break; 1673 1674 case DLT_AX25_KISS: 1675 /* 1676 * Currently, only raw "link[N:M]" filtering is supported. 1677 */ 1678 cstate->off_linktype.constant_part = OFFSET_NOT_SET; /* variable, min 15, max 71 steps of 7 */ 1679 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1680 cstate->off_nl = OFFSET_NOT_SET; /* variable, min 16, max 71 steps of 7 */ 1681 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1682 break; 1683 1684 case DLT_IPNET: 1685 cstate->off_linktype.constant_part = 1; 1686 cstate->off_linkpl.constant_part = 24; /* ipnet header length */ 1687 cstate->off_nl = 0; 1688 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1689 break; 1690 1691 case DLT_NETANALYZER: 1692 cstate->off_linkhdr.constant_part = 4; /* Ethernet header is past 4-byte pseudo-header */ 1693 cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12; 1694 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* pseudo-header+Ethernet header length */ 1695 cstate->off_nl = 0; /* Ethernet II */ 1696 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 1697 break; 1698 1699 case DLT_NETANALYZER_TRANSPARENT: 1700 cstate->off_linkhdr.constant_part = 12; /* MAC header is past 4-byte pseudo-header, preamble, and SFD */ 1701 cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12; 1702 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* pseudo-header+preamble+SFD+Ethernet header length */ 1703 cstate->off_nl = 0; /* Ethernet II */ 1704 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 1705 break; 1706 1707 default: 1708 /* 1709 * For values in the range in which we've assigned new 1710 * DLT_ values, only raw "link[N:M]" filtering is supported. 1711 */ 1712 if (cstate->linktype >= DLT_HIGH_MATCHING_MIN && 1713 cstate->linktype <= DLT_HIGH_MATCHING_MAX) { 1714 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1715 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1716 cstate->off_nl = OFFSET_NOT_SET; 1717 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1718 } else { 1719 bpf_set_error(cstate, "unknown data link type %d (min %d, max %d)", 1720 cstate->linktype, DLT_HIGH_MATCHING_MIN, DLT_HIGH_MATCHING_MAX); 1721 return (-1); 1722 } 1723 break; 1724 } 1725 1726 cstate->off_outermostlinkhdr = cstate->off_prevlinkhdr = cstate->off_linkhdr; 1727 return (0); 1728 } 1729 1730 /* 1731 * Load a value relative to the specified absolute offset. 1732 */ 1733 static struct slist * 1734 gen_load_absoffsetrel(compiler_state_t *cstate, bpf_abs_offset *abs_offset, 1735 u_int offset, u_int size) 1736 { 1737 struct slist *s, *s2; 1738 1739 s = gen_abs_offset_varpart(cstate, abs_offset); 1740 1741 /* 1742 * If "s" is non-null, it has code to arrange that the X register 1743 * contains the variable part of the absolute offset, so we 1744 * generate a load relative to that, with an offset of 1745 * abs_offset->constant_part + offset. 1746 * 1747 * Otherwise, we can do an absolute load with an offset of 1748 * abs_offset->constant_part + offset. 1749 */ 1750 if (s != NULL) { 1751 /* 1752 * "s" points to a list of statements that puts the 1753 * variable part of the absolute offset into the X register. 1754 * Do an indirect load, to use the X register as an offset. 1755 */ 1756 s2 = new_stmt(cstate, BPF_LD|BPF_IND|size); 1757 s2->s.k = abs_offset->constant_part + offset; 1758 sappend(s, s2); 1759 } else { 1760 /* 1761 * There is no variable part of the absolute offset, so 1762 * just do an absolute load. 1763 */ 1764 s = new_stmt(cstate, BPF_LD|BPF_ABS|size); 1765 s->s.k = abs_offset->constant_part + offset; 1766 } 1767 return s; 1768 } 1769 1770 /* 1771 * Load a value relative to the beginning of the specified header. 1772 */ 1773 static struct slist * 1774 gen_load_a(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1775 u_int size) 1776 { 1777 struct slist *s, *s2; 1778 1779 /* 1780 * Squelch warnings from compilers that *don't* assume that 1781 * offrel always has a valid enum value and therefore don't 1782 * assume that we'll always go through one of the case arms. 1783 * 1784 * If we have a default case, compilers that *do* assume that 1785 * will then complain about the default case code being 1786 * unreachable. 1787 * 1788 * Damned if you do, damned if you don't. 1789 */ 1790 s = NULL; 1791 1792 switch (offrel) { 1793 1794 case OR_PACKET: 1795 s = new_stmt(cstate, BPF_LD|BPF_ABS|size); 1796 s->s.k = offset; 1797 break; 1798 1799 case OR_LINKHDR: 1800 s = gen_load_absoffsetrel(cstate, &cstate->off_linkhdr, offset, size); 1801 break; 1802 1803 case OR_PREVLINKHDR: 1804 s = gen_load_absoffsetrel(cstate, &cstate->off_prevlinkhdr, offset, size); 1805 break; 1806 1807 case OR_LLC: 1808 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, offset, size); 1809 break; 1810 1811 case OR_PREVMPLSHDR: 1812 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl - 4 + offset, size); 1813 break; 1814 1815 case OR_LINKPL: 1816 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + offset, size); 1817 break; 1818 1819 case OR_LINKPL_NOSNAP: 1820 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl_nosnap + offset, size); 1821 break; 1822 1823 case OR_LINKTYPE: 1824 s = gen_load_absoffsetrel(cstate, &cstate->off_linktype, offset, size); 1825 break; 1826 1827 case OR_TRAN_IPV4: 1828 /* 1829 * Load the X register with the length of the IPv4 header 1830 * (plus the offset of the link-layer header, if it's 1831 * preceded by a variable-length header such as a radio 1832 * header), in bytes. 1833 */ 1834 s = gen_loadx_iphdrlen(cstate); 1835 1836 /* 1837 * Load the item at {offset of the link-layer payload} + 1838 * {offset, relative to the start of the link-layer 1839 * payload, of the IPv4 header} + {length of the IPv4 header} + 1840 * {specified offset}. 1841 * 1842 * If the offset of the link-layer payload is variable, 1843 * the variable part of that offset is included in the 1844 * value in the X register, and we include the constant 1845 * part in the offset of the load. 1846 */ 1847 s2 = new_stmt(cstate, BPF_LD|BPF_IND|size); 1848 s2->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + offset; 1849 sappend(s, s2); 1850 break; 1851 1852 case OR_TRAN_IPV6: 1853 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + 40 + offset, size); 1854 break; 1855 } 1856 return s; 1857 } 1858 1859 /* 1860 * Generate code to load into the X register the sum of the length of 1861 * the IPv4 header and the variable part of the offset of the link-layer 1862 * payload. 1863 */ 1864 static struct slist * 1865 gen_loadx_iphdrlen(compiler_state_t *cstate) 1866 { 1867 struct slist *s, *s2; 1868 1869 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 1870 if (s != NULL) { 1871 /* 1872 * The offset of the link-layer payload has a variable 1873 * part. "s" points to a list of statements that put 1874 * the variable part of that offset into the X register. 1875 * 1876 * The 4*([k]&0xf) addressing mode can't be used, as we 1877 * don't have a constant offset, so we have to load the 1878 * value in question into the A register and add to it 1879 * the value from the X register. 1880 */ 1881 s2 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 1882 s2->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 1883 sappend(s, s2); 1884 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 1885 s2->s.k = 0xf; 1886 sappend(s, s2); 1887 s2 = new_stmt(cstate, BPF_ALU|BPF_LSH|BPF_K); 1888 s2->s.k = 2; 1889 sappend(s, s2); 1890 1891 /* 1892 * The A register now contains the length of the IP header. 1893 * We need to add to it the variable part of the offset of 1894 * the link-layer payload, which is still in the X 1895 * register, and move the result into the X register. 1896 */ 1897 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 1898 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 1899 } else { 1900 /* 1901 * The offset of the link-layer payload is a constant, 1902 * so no code was generated to load the (nonexistent) 1903 * variable part of that offset. 1904 * 1905 * This means we can use the 4*([k]&0xf) addressing 1906 * mode. Load the length of the IPv4 header, which 1907 * is at an offset of cstate->off_nl from the beginning of 1908 * the link-layer payload, and thus at an offset of 1909 * cstate->off_linkpl.constant_part + cstate->off_nl from the beginning 1910 * of the raw packet data, using that addressing mode. 1911 */ 1912 s = new_stmt(cstate, BPF_LDX|BPF_MSH|BPF_B); 1913 s->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 1914 } 1915 return s; 1916 } 1917 1918 1919 static struct block * 1920 gen_uncond(compiler_state_t *cstate, int rsense) 1921 { 1922 struct block *b; 1923 struct slist *s; 1924 1925 s = new_stmt(cstate, BPF_LD|BPF_IMM); 1926 s->s.k = !rsense; 1927 b = new_block(cstate, JMP(BPF_JEQ)); 1928 b->stmts = s; 1929 1930 return b; 1931 } 1932 1933 static inline struct block * 1934 gen_true(compiler_state_t *cstate) 1935 { 1936 return gen_uncond(cstate, 1); 1937 } 1938 1939 static inline struct block * 1940 gen_false(compiler_state_t *cstate) 1941 { 1942 return gen_uncond(cstate, 0); 1943 } 1944 1945 /* 1946 * Byte-swap a 32-bit number. 1947 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 1948 * big-endian platforms.) 1949 */ 1950 #define SWAPLONG(y) \ 1951 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 1952 1953 /* 1954 * Generate code to match a particular packet type. 1955 * 1956 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1957 * value, if <= ETHERMTU. We use that to determine whether to 1958 * match the type/length field or to check the type/length field for 1959 * a value <= ETHERMTU to see whether it's a type field and then do 1960 * the appropriate test. 1961 */ 1962 static struct block * 1963 gen_ether_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 1964 { 1965 struct block *b0, *b1; 1966 1967 switch (ll_proto) { 1968 1969 case LLCSAP_ISONS: 1970 case LLCSAP_IP: 1971 case LLCSAP_NETBEUI: 1972 /* 1973 * OSI protocols and NetBEUI always use 802.2 encapsulation, 1974 * so we check the DSAP and SSAP. 1975 * 1976 * LLCSAP_IP checks for IP-over-802.2, rather 1977 * than IP-over-Ethernet or IP-over-SNAP. 1978 * 1979 * XXX - should we check both the DSAP and the 1980 * SSAP, like this, or should we check just the 1981 * DSAP, as we do for other types <= ETHERMTU 1982 * (i.e., other SAP values)? 1983 */ 1984 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 1985 gen_not(b0); 1986 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (ll_proto << 8) | ll_proto); 1987 gen_and(b0, b1); 1988 return b1; 1989 1990 case LLCSAP_IPX: 1991 /* 1992 * Check for; 1993 * 1994 * Ethernet_II frames, which are Ethernet 1995 * frames with a frame type of ETHERTYPE_IPX; 1996 * 1997 * Ethernet_802.3 frames, which are 802.3 1998 * frames (i.e., the type/length field is 1999 * a length field, <= ETHERMTU, rather than 2000 * a type field) with the first two bytes 2001 * after the Ethernet/802.3 header being 2002 * 0xFFFF; 2003 * 2004 * Ethernet_802.2 frames, which are 802.3 2005 * frames with an 802.2 LLC header and 2006 * with the IPX LSAP as the DSAP in the LLC 2007 * header; 2008 * 2009 * Ethernet_SNAP frames, which are 802.3 2010 * frames with an LLC header and a SNAP 2011 * header and with an OUI of 0x000000 2012 * (encapsulated Ethernet) and a protocol 2013 * ID of ETHERTYPE_IPX in the SNAP header. 2014 * 2015 * XXX - should we generate the same code both 2016 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 2017 */ 2018 2019 /* 2020 * This generates code to check both for the 2021 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 2022 */ 2023 b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, LLCSAP_IPX); 2024 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, 0xFFFF); 2025 gen_or(b0, b1); 2026 2027 /* 2028 * Now we add code to check for SNAP frames with 2029 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 2030 */ 2031 b0 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX); 2032 gen_or(b0, b1); 2033 2034 /* 2035 * Now we generate code to check for 802.3 2036 * frames in general. 2037 */ 2038 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 2039 gen_not(b0); 2040 2041 /* 2042 * Now add the check for 802.3 frames before the 2043 * check for Ethernet_802.2 and Ethernet_802.3, 2044 * as those checks should only be done on 802.3 2045 * frames, not on Ethernet frames. 2046 */ 2047 gen_and(b0, b1); 2048 2049 /* 2050 * Now add the check for Ethernet_II frames, and 2051 * do that before checking for the other frame 2052 * types. 2053 */ 2054 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ETHERTYPE_IPX); 2055 gen_or(b0, b1); 2056 return b1; 2057 2058 case ETHERTYPE_ATALK: 2059 case ETHERTYPE_AARP: 2060 /* 2061 * EtherTalk (AppleTalk protocols on Ethernet link 2062 * layer) may use 802.2 encapsulation. 2063 */ 2064 2065 /* 2066 * Check for 802.2 encapsulation (EtherTalk phase 2?); 2067 * we check for an Ethernet type field less than 2068 * 1500, which means it's an 802.3 length field. 2069 */ 2070 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 2071 gen_not(b0); 2072 2073 /* 2074 * 802.2-encapsulated ETHERTYPE_ATALK packets are 2075 * SNAP packets with an organization code of 2076 * 0x080007 (Apple, for Appletalk) and a protocol 2077 * type of ETHERTYPE_ATALK (Appletalk). 2078 * 2079 * 802.2-encapsulated ETHERTYPE_AARP packets are 2080 * SNAP packets with an organization code of 2081 * 0x000000 (encapsulated Ethernet) and a protocol 2082 * type of ETHERTYPE_AARP (Appletalk ARP). 2083 */ 2084 if (ll_proto == ETHERTYPE_ATALK) 2085 b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); 2086 else /* ll_proto == ETHERTYPE_AARP */ 2087 b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP); 2088 gen_and(b0, b1); 2089 2090 /* 2091 * Check for Ethernet encapsulation (Ethertalk 2092 * phase 1?); we just check for the Ethernet 2093 * protocol type. 2094 */ 2095 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); 2096 2097 gen_or(b0, b1); 2098 return b1; 2099 2100 default: 2101 if (ll_proto <= ETHERMTU) { 2102 /* 2103 * This is an LLC SAP value, so the frames 2104 * that match would be 802.2 frames. 2105 * Check that the frame is an 802.2 frame 2106 * (i.e., that the length/type field is 2107 * a length field, <= ETHERMTU) and 2108 * then check the DSAP. 2109 */ 2110 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 2111 gen_not(b0); 2112 b1 = gen_cmp(cstate, OR_LINKTYPE, 2, BPF_B, ll_proto); 2113 gen_and(b0, b1); 2114 return b1; 2115 } else { 2116 /* 2117 * This is an Ethernet type, so compare 2118 * the length/type field with it (if 2119 * the frame is an 802.2 frame, the length 2120 * field will be <= ETHERMTU, and, as 2121 * "ll_proto" is > ETHERMTU, this test 2122 * will fail and the frame won't match, 2123 * which is what we want). 2124 */ 2125 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); 2126 } 2127 } 2128 } 2129 2130 static struct block * 2131 gen_loopback_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 2132 { 2133 /* 2134 * For DLT_NULL, the link-layer header is a 32-bit word 2135 * containing an AF_ value in *host* byte order, and for 2136 * DLT_ENC, the link-layer header begins with a 32-bit 2137 * word containing an AF_ value in host byte order. 2138 * 2139 * In addition, if we're reading a saved capture file, 2140 * the host byte order in the capture may not be the 2141 * same as the host byte order on this machine. 2142 * 2143 * For DLT_LOOP, the link-layer header is a 32-bit 2144 * word containing an AF_ value in *network* byte order. 2145 */ 2146 if (cstate->linktype == DLT_NULL || cstate->linktype == DLT_ENC) { 2147 /* 2148 * The AF_ value is in host byte order, but the BPF 2149 * interpreter will convert it to network byte order. 2150 * 2151 * If this is a save file, and it's from a machine 2152 * with the opposite byte order to ours, we byte-swap 2153 * the AF_ value. 2154 * 2155 * Then we run it through "htonl()", and generate 2156 * code to compare against the result. 2157 */ 2158 if (cstate->bpf_pcap->rfile != NULL && cstate->bpf_pcap->swapped) 2159 ll_proto = SWAPLONG(ll_proto); 2160 ll_proto = htonl(ll_proto); 2161 } 2162 return (gen_cmp(cstate, OR_LINKHDR, 0, BPF_W, ll_proto)); 2163 } 2164 2165 /* 2166 * "proto" is an Ethernet type value and for IPNET, if it is not IPv4 2167 * or IPv6 then we have an error. 2168 */ 2169 static struct block * 2170 gen_ipnet_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 2171 { 2172 switch (ll_proto) { 2173 2174 case ETHERTYPE_IP: 2175 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, IPH_AF_INET); 2176 /*NOTREACHED*/ 2177 2178 case ETHERTYPE_IPV6: 2179 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, IPH_AF_INET6); 2180 /*NOTREACHED*/ 2181 2182 default: 2183 break; 2184 } 2185 2186 return gen_false(cstate); 2187 } 2188 2189 /* 2190 * Generate code to match a particular packet type. 2191 * 2192 * "ll_proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 2193 * value, if <= ETHERMTU. We use that to determine whether to 2194 * match the type field or to check the type field for the special 2195 * LINUX_SLL_P_802_2 value and then do the appropriate test. 2196 */ 2197 static struct block * 2198 gen_linux_sll_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 2199 { 2200 struct block *b0, *b1; 2201 2202 switch (ll_proto) { 2203 2204 case LLCSAP_ISONS: 2205 case LLCSAP_IP: 2206 case LLCSAP_NETBEUI: 2207 /* 2208 * OSI protocols and NetBEUI always use 802.2 encapsulation, 2209 * so we check the DSAP and SSAP. 2210 * 2211 * LLCSAP_IP checks for IP-over-802.2, rather 2212 * than IP-over-Ethernet or IP-over-SNAP. 2213 * 2214 * XXX - should we check both the DSAP and the 2215 * SSAP, like this, or should we check just the 2216 * DSAP, as we do for other types <= ETHERMTU 2217 * (i.e., other SAP values)? 2218 */ 2219 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2220 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (ll_proto << 8) | ll_proto); 2221 gen_and(b0, b1); 2222 return b1; 2223 2224 case LLCSAP_IPX: 2225 /* 2226 * Ethernet_II frames, which are Ethernet 2227 * frames with a frame type of ETHERTYPE_IPX; 2228 * 2229 * Ethernet_802.3 frames, which have a frame 2230 * type of LINUX_SLL_P_802_3; 2231 * 2232 * Ethernet_802.2 frames, which are 802.3 2233 * frames with an 802.2 LLC header (i.e, have 2234 * a frame type of LINUX_SLL_P_802_2) and 2235 * with the IPX LSAP as the DSAP in the LLC 2236 * header; 2237 * 2238 * Ethernet_SNAP frames, which are 802.3 2239 * frames with an LLC header and a SNAP 2240 * header and with an OUI of 0x000000 2241 * (encapsulated Ethernet) and a protocol 2242 * ID of ETHERTYPE_IPX in the SNAP header. 2243 * 2244 * First, do the checks on LINUX_SLL_P_802_2 2245 * frames; generate the check for either 2246 * Ethernet_802.2 or Ethernet_SNAP frames, and 2247 * then put a check for LINUX_SLL_P_802_2 frames 2248 * before it. 2249 */ 2250 b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, LLCSAP_IPX); 2251 b1 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX); 2252 gen_or(b0, b1); 2253 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2254 gen_and(b0, b1); 2255 2256 /* 2257 * Now check for 802.3 frames and OR that with 2258 * the previous test. 2259 */ 2260 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_3); 2261 gen_or(b0, b1); 2262 2263 /* 2264 * Now add the check for Ethernet_II frames, and 2265 * do that before checking for the other frame 2266 * types. 2267 */ 2268 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ETHERTYPE_IPX); 2269 gen_or(b0, b1); 2270 return b1; 2271 2272 case ETHERTYPE_ATALK: 2273 case ETHERTYPE_AARP: 2274 /* 2275 * EtherTalk (AppleTalk protocols on Ethernet link 2276 * layer) may use 802.2 encapsulation. 2277 */ 2278 2279 /* 2280 * Check for 802.2 encapsulation (EtherTalk phase 2?); 2281 * we check for the 802.2 protocol type in the 2282 * "Ethernet type" field. 2283 */ 2284 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2285 2286 /* 2287 * 802.2-encapsulated ETHERTYPE_ATALK packets are 2288 * SNAP packets with an organization code of 2289 * 0x080007 (Apple, for Appletalk) and a protocol 2290 * type of ETHERTYPE_ATALK (Appletalk). 2291 * 2292 * 802.2-encapsulated ETHERTYPE_AARP packets are 2293 * SNAP packets with an organization code of 2294 * 0x000000 (encapsulated Ethernet) and a protocol 2295 * type of ETHERTYPE_AARP (Appletalk ARP). 2296 */ 2297 if (ll_proto == ETHERTYPE_ATALK) 2298 b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); 2299 else /* ll_proto == ETHERTYPE_AARP */ 2300 b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP); 2301 gen_and(b0, b1); 2302 2303 /* 2304 * Check for Ethernet encapsulation (Ethertalk 2305 * phase 1?); we just check for the Ethernet 2306 * protocol type. 2307 */ 2308 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); 2309 2310 gen_or(b0, b1); 2311 return b1; 2312 2313 default: 2314 if (ll_proto <= ETHERMTU) { 2315 /* 2316 * This is an LLC SAP value, so the frames 2317 * that match would be 802.2 frames. 2318 * Check for the 802.2 protocol type 2319 * in the "Ethernet type" field, and 2320 * then check the DSAP. 2321 */ 2322 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2323 b1 = gen_cmp(cstate, OR_LINKHDR, cstate->off_linkpl.constant_part, BPF_B, 2324 ll_proto); 2325 gen_and(b0, b1); 2326 return b1; 2327 } else { 2328 /* 2329 * This is an Ethernet type, so compare 2330 * the length/type field with it (if 2331 * the frame is an 802.2 frame, the length 2332 * field will be <= ETHERMTU, and, as 2333 * "ll_proto" is > ETHERMTU, this test 2334 * will fail and the frame won't match, 2335 * which is what we want). 2336 */ 2337 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); 2338 } 2339 } 2340 } 2341 2342 /* 2343 * Load a value relative to the beginning of the link-layer header after the 2344 * pflog header. 2345 */ 2346 static struct slist * 2347 gen_load_pflog_llprefixlen(compiler_state_t *cstate) 2348 { 2349 struct slist *s1, *s2; 2350 2351 /* 2352 * Generate code to load the length of the pflog header into 2353 * the register assigned to hold that length, if one has been 2354 * assigned. (If one hasn't been assigned, no code we've 2355 * generated uses that prefix, so we don't need to generate any 2356 * code to load it.) 2357 */ 2358 if (cstate->off_linkpl.reg != -1) { 2359 /* 2360 * The length is in the first byte of the header. 2361 */ 2362 s1 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2363 s1->s.k = 0; 2364 2365 /* 2366 * Round it up to a multiple of 4. 2367 * Add 3, and clear the lower 2 bits. 2368 */ 2369 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 2370 s2->s.k = 3; 2371 sappend(s1, s2); 2372 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 2373 s2->s.k = 0xfffffffc; 2374 sappend(s1, s2); 2375 2376 /* 2377 * Now allocate a register to hold that value and store 2378 * it. 2379 */ 2380 s2 = new_stmt(cstate, BPF_ST); 2381 s2->s.k = cstate->off_linkpl.reg; 2382 sappend(s1, s2); 2383 2384 /* 2385 * Now move it into the X register. 2386 */ 2387 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2388 sappend(s1, s2); 2389 2390 return (s1); 2391 } else 2392 return (NULL); 2393 } 2394 2395 static struct slist * 2396 gen_load_prism_llprefixlen(compiler_state_t *cstate) 2397 { 2398 struct slist *s1, *s2; 2399 struct slist *sjeq_avs_cookie; 2400 struct slist *sjcommon; 2401 2402 /* 2403 * This code is not compatible with the optimizer, as 2404 * we are generating jmp instructions within a normal 2405 * slist of instructions 2406 */ 2407 cstate->no_optimize = 1; 2408 2409 /* 2410 * Generate code to load the length of the radio header into 2411 * the register assigned to hold that length, if one has been 2412 * assigned. (If one hasn't been assigned, no code we've 2413 * generated uses that prefix, so we don't need to generate any 2414 * code to load it.) 2415 * 2416 * Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes 2417 * or always use the AVS header rather than the Prism header. 2418 * We load a 4-byte big-endian value at the beginning of the 2419 * raw packet data, and see whether, when masked with 0xFFFFF000, 2420 * it's equal to 0x80211000. If so, that indicates that it's 2421 * an AVS header (the masked-out bits are the version number). 2422 * Otherwise, it's a Prism header. 2423 * 2424 * XXX - the Prism header is also, in theory, variable-length, 2425 * but no known software generates headers that aren't 144 2426 * bytes long. 2427 */ 2428 if (cstate->off_linkhdr.reg != -1) { 2429 /* 2430 * Load the cookie. 2431 */ 2432 s1 = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2433 s1->s.k = 0; 2434 2435 /* 2436 * AND it with 0xFFFFF000. 2437 */ 2438 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 2439 s2->s.k = 0xFFFFF000; 2440 sappend(s1, s2); 2441 2442 /* 2443 * Compare with 0x80211000. 2444 */ 2445 sjeq_avs_cookie = new_stmt(cstate, JMP(BPF_JEQ)); 2446 sjeq_avs_cookie->s.k = 0x80211000; 2447 sappend(s1, sjeq_avs_cookie); 2448 2449 /* 2450 * If it's AVS: 2451 * 2452 * The 4 bytes at an offset of 4 from the beginning of 2453 * the AVS header are the length of the AVS header. 2454 * That field is big-endian. 2455 */ 2456 s2 = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2457 s2->s.k = 4; 2458 sappend(s1, s2); 2459 sjeq_avs_cookie->s.jt = s2; 2460 2461 /* 2462 * Now jump to the code to allocate a register 2463 * into which to save the header length and 2464 * store the length there. (The "jump always" 2465 * instruction needs to have the k field set; 2466 * it's added to the PC, so, as we're jumping 2467 * over a single instruction, it should be 1.) 2468 */ 2469 sjcommon = new_stmt(cstate, JMP(BPF_JA)); 2470 sjcommon->s.k = 1; 2471 sappend(s1, sjcommon); 2472 2473 /* 2474 * Now for the code that handles the Prism header. 2475 * Just load the length of the Prism header (144) 2476 * into the A register. Have the test for an AVS 2477 * header branch here if we don't have an AVS header. 2478 */ 2479 s2 = new_stmt(cstate, BPF_LD|BPF_W|BPF_IMM); 2480 s2->s.k = 144; 2481 sappend(s1, s2); 2482 sjeq_avs_cookie->s.jf = s2; 2483 2484 /* 2485 * Now allocate a register to hold that value and store 2486 * it. The code for the AVS header will jump here after 2487 * loading the length of the AVS header. 2488 */ 2489 s2 = new_stmt(cstate, BPF_ST); 2490 s2->s.k = cstate->off_linkhdr.reg; 2491 sappend(s1, s2); 2492 sjcommon->s.jf = s2; 2493 2494 /* 2495 * Now move it into the X register. 2496 */ 2497 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2498 sappend(s1, s2); 2499 2500 return (s1); 2501 } else 2502 return (NULL); 2503 } 2504 2505 static struct slist * 2506 gen_load_avs_llprefixlen(compiler_state_t *cstate) 2507 { 2508 struct slist *s1, *s2; 2509 2510 /* 2511 * Generate code to load the length of the AVS header into 2512 * the register assigned to hold that length, if one has been 2513 * assigned. (If one hasn't been assigned, no code we've 2514 * generated uses that prefix, so we don't need to generate any 2515 * code to load it.) 2516 */ 2517 if (cstate->off_linkhdr.reg != -1) { 2518 /* 2519 * The 4 bytes at an offset of 4 from the beginning of 2520 * the AVS header are the length of the AVS header. 2521 * That field is big-endian. 2522 */ 2523 s1 = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2524 s1->s.k = 4; 2525 2526 /* 2527 * Now allocate a register to hold that value and store 2528 * it. 2529 */ 2530 s2 = new_stmt(cstate, BPF_ST); 2531 s2->s.k = cstate->off_linkhdr.reg; 2532 sappend(s1, s2); 2533 2534 /* 2535 * Now move it into the X register. 2536 */ 2537 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2538 sappend(s1, s2); 2539 2540 return (s1); 2541 } else 2542 return (NULL); 2543 } 2544 2545 static struct slist * 2546 gen_load_radiotap_llprefixlen(compiler_state_t *cstate) 2547 { 2548 struct slist *s1, *s2; 2549 2550 /* 2551 * Generate code to load the length of the radiotap header into 2552 * the register assigned to hold that length, if one has been 2553 * assigned. (If one hasn't been assigned, no code we've 2554 * generated uses that prefix, so we don't need to generate any 2555 * code to load it.) 2556 */ 2557 if (cstate->off_linkhdr.reg != -1) { 2558 /* 2559 * The 2 bytes at offsets of 2 and 3 from the beginning 2560 * of the radiotap header are the length of the radiotap 2561 * header; unfortunately, it's little-endian, so we have 2562 * to load it a byte at a time and construct the value. 2563 */ 2564 2565 /* 2566 * Load the high-order byte, at an offset of 3, shift it 2567 * left a byte, and put the result in the X register. 2568 */ 2569 s1 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2570 s1->s.k = 3; 2571 s2 = new_stmt(cstate, BPF_ALU|BPF_LSH|BPF_K); 2572 sappend(s1, s2); 2573 s2->s.k = 8; 2574 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2575 sappend(s1, s2); 2576 2577 /* 2578 * Load the next byte, at an offset of 2, and OR the 2579 * value from the X register into it. 2580 */ 2581 s2 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2582 sappend(s1, s2); 2583 s2->s.k = 2; 2584 s2 = new_stmt(cstate, BPF_ALU|BPF_OR|BPF_X); 2585 sappend(s1, s2); 2586 2587 /* 2588 * Now allocate a register to hold that value and store 2589 * it. 2590 */ 2591 s2 = new_stmt(cstate, BPF_ST); 2592 s2->s.k = cstate->off_linkhdr.reg; 2593 sappend(s1, s2); 2594 2595 /* 2596 * Now move it into the X register. 2597 */ 2598 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2599 sappend(s1, s2); 2600 2601 return (s1); 2602 } else 2603 return (NULL); 2604 } 2605 2606 /* 2607 * At the moment we treat PPI as normal Radiotap encoded 2608 * packets. The difference is in the function that generates 2609 * the code at the beginning to compute the header length. 2610 * Since this code generator of PPI supports bare 802.11 2611 * encapsulation only (i.e. the encapsulated DLT should be 2612 * DLT_IEEE802_11) we generate code to check for this too; 2613 * that's done in finish_parse(). 2614 */ 2615 static struct slist * 2616 gen_load_ppi_llprefixlen(compiler_state_t *cstate) 2617 { 2618 struct slist *s1, *s2; 2619 2620 /* 2621 * Generate code to load the length of the radiotap header 2622 * into the register assigned to hold that length, if one has 2623 * been assigned. 2624 */ 2625 if (cstate->off_linkhdr.reg != -1) { 2626 /* 2627 * The 2 bytes at offsets of 2 and 3 from the beginning 2628 * of the radiotap header are the length of the radiotap 2629 * header; unfortunately, it's little-endian, so we have 2630 * to load it a byte at a time and construct the value. 2631 */ 2632 2633 /* 2634 * Load the high-order byte, at an offset of 3, shift it 2635 * left a byte, and put the result in the X register. 2636 */ 2637 s1 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2638 s1->s.k = 3; 2639 s2 = new_stmt(cstate, BPF_ALU|BPF_LSH|BPF_K); 2640 sappend(s1, s2); 2641 s2->s.k = 8; 2642 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2643 sappend(s1, s2); 2644 2645 /* 2646 * Load the next byte, at an offset of 2, and OR the 2647 * value from the X register into it. 2648 */ 2649 s2 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2650 sappend(s1, s2); 2651 s2->s.k = 2; 2652 s2 = new_stmt(cstate, BPF_ALU|BPF_OR|BPF_X); 2653 sappend(s1, s2); 2654 2655 /* 2656 * Now allocate a register to hold that value and store 2657 * it. 2658 */ 2659 s2 = new_stmt(cstate, BPF_ST); 2660 s2->s.k = cstate->off_linkhdr.reg; 2661 sappend(s1, s2); 2662 2663 /* 2664 * Now move it into the X register. 2665 */ 2666 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2667 sappend(s1, s2); 2668 2669 return (s1); 2670 } else 2671 return (NULL); 2672 } 2673 2674 /* 2675 * Load a value relative to the beginning of the link-layer header after the 802.11 2676 * header, i.e. LLC_SNAP. 2677 * The link-layer header doesn't necessarily begin at the beginning 2678 * of the packet data; there might be a variable-length prefix containing 2679 * radio information. 2680 */ 2681 static struct slist * 2682 gen_load_802_11_header_len(compiler_state_t *cstate, struct slist *s, struct slist *snext) 2683 { 2684 struct slist *s2; 2685 struct slist *sjset_data_frame_1; 2686 struct slist *sjset_data_frame_2; 2687 struct slist *sjset_qos; 2688 struct slist *sjset_radiotap_flags_present; 2689 struct slist *sjset_radiotap_ext_present; 2690 struct slist *sjset_radiotap_tsft_present; 2691 struct slist *sjset_tsft_datapad, *sjset_notsft_datapad; 2692 struct slist *s_roundup; 2693 2694 if (cstate->off_linkpl.reg == -1) { 2695 /* 2696 * No register has been assigned to the offset of 2697 * the link-layer payload, which means nobody needs 2698 * it; don't bother computing it - just return 2699 * what we already have. 2700 */ 2701 return (s); 2702 } 2703 2704 /* 2705 * This code is not compatible with the optimizer, as 2706 * we are generating jmp instructions within a normal 2707 * slist of instructions 2708 */ 2709 cstate->no_optimize = 1; 2710 2711 /* 2712 * If "s" is non-null, it has code to arrange that the X register 2713 * contains the length of the prefix preceding the link-layer 2714 * header. 2715 * 2716 * Otherwise, the length of the prefix preceding the link-layer 2717 * header is "off_outermostlinkhdr.constant_part". 2718 */ 2719 if (s == NULL) { 2720 /* 2721 * There is no variable-length header preceding the 2722 * link-layer header. 2723 * 2724 * Load the length of the fixed-length prefix preceding 2725 * the link-layer header (if any) into the X register, 2726 * and store it in the cstate->off_linkpl.reg register. 2727 * That length is off_outermostlinkhdr.constant_part. 2728 */ 2729 s = new_stmt(cstate, BPF_LDX|BPF_IMM); 2730 s->s.k = cstate->off_outermostlinkhdr.constant_part; 2731 } 2732 2733 /* 2734 * The X register contains the offset of the beginning of the 2735 * link-layer header; add 24, which is the minimum length 2736 * of the MAC header for a data frame, to that, and store it 2737 * in cstate->off_linkpl.reg, and then load the Frame Control field, 2738 * which is at the offset in the X register, with an indexed load. 2739 */ 2740 s2 = new_stmt(cstate, BPF_MISC|BPF_TXA); 2741 sappend(s, s2); 2742 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 2743 s2->s.k = 24; 2744 sappend(s, s2); 2745 s2 = new_stmt(cstate, BPF_ST); 2746 s2->s.k = cstate->off_linkpl.reg; 2747 sappend(s, s2); 2748 2749 s2 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 2750 s2->s.k = 0; 2751 sappend(s, s2); 2752 2753 /* 2754 * Check the Frame Control field to see if this is a data frame; 2755 * a data frame has the 0x08 bit (b3) in that field set and the 2756 * 0x04 bit (b2) clear. 2757 */ 2758 sjset_data_frame_1 = new_stmt(cstate, JMP(BPF_JSET)); 2759 sjset_data_frame_1->s.k = 0x08; 2760 sappend(s, sjset_data_frame_1); 2761 2762 /* 2763 * If b3 is set, test b2, otherwise go to the first statement of 2764 * the rest of the program. 2765 */ 2766 sjset_data_frame_1->s.jt = sjset_data_frame_2 = new_stmt(cstate, JMP(BPF_JSET)); 2767 sjset_data_frame_2->s.k = 0x04; 2768 sappend(s, sjset_data_frame_2); 2769 sjset_data_frame_1->s.jf = snext; 2770 2771 /* 2772 * If b2 is not set, this is a data frame; test the QoS bit. 2773 * Otherwise, go to the first statement of the rest of the 2774 * program. 2775 */ 2776 sjset_data_frame_2->s.jt = snext; 2777 sjset_data_frame_2->s.jf = sjset_qos = new_stmt(cstate, JMP(BPF_JSET)); 2778 sjset_qos->s.k = 0x80; /* QoS bit */ 2779 sappend(s, sjset_qos); 2780 2781 /* 2782 * If it's set, add 2 to cstate->off_linkpl.reg, to skip the QoS 2783 * field. 2784 * Otherwise, go to the first statement of the rest of the 2785 * program. 2786 */ 2787 sjset_qos->s.jt = s2 = new_stmt(cstate, BPF_LD|BPF_MEM); 2788 s2->s.k = cstate->off_linkpl.reg; 2789 sappend(s, s2); 2790 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_IMM); 2791 s2->s.k = 2; 2792 sappend(s, s2); 2793 s2 = new_stmt(cstate, BPF_ST); 2794 s2->s.k = cstate->off_linkpl.reg; 2795 sappend(s, s2); 2796 2797 /* 2798 * If we have a radiotap header, look at it to see whether 2799 * there's Atheros padding between the MAC-layer header 2800 * and the payload. 2801 * 2802 * Note: all of the fields in the radiotap header are 2803 * little-endian, so we byte-swap all of the values 2804 * we test against, as they will be loaded as big-endian 2805 * values. 2806 * 2807 * XXX - in the general case, we would have to scan through 2808 * *all* the presence bits, if there's more than one word of 2809 * presence bits. That would require a loop, meaning that 2810 * we wouldn't be able to run the filter in the kernel. 2811 * 2812 * We assume here that the Atheros adapters that insert the 2813 * annoying padding don't have multiple antennae and therefore 2814 * do not generate radiotap headers with multiple presence words. 2815 */ 2816 if (cstate->linktype == DLT_IEEE802_11_RADIO) { 2817 /* 2818 * Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set 2819 * in the first presence flag word? 2820 */ 2821 sjset_qos->s.jf = s2 = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_W); 2822 s2->s.k = 4; 2823 sappend(s, s2); 2824 2825 sjset_radiotap_flags_present = new_stmt(cstate, JMP(BPF_JSET)); 2826 sjset_radiotap_flags_present->s.k = SWAPLONG(0x00000002); 2827 sappend(s, sjset_radiotap_flags_present); 2828 2829 /* 2830 * If not, skip all of this. 2831 */ 2832 sjset_radiotap_flags_present->s.jf = snext; 2833 2834 /* 2835 * Otherwise, is the "extension" bit set in that word? 2836 */ 2837 sjset_radiotap_ext_present = new_stmt(cstate, JMP(BPF_JSET)); 2838 sjset_radiotap_ext_present->s.k = SWAPLONG(0x80000000); 2839 sappend(s, sjset_radiotap_ext_present); 2840 sjset_radiotap_flags_present->s.jt = sjset_radiotap_ext_present; 2841 2842 /* 2843 * If so, skip all of this. 2844 */ 2845 sjset_radiotap_ext_present->s.jt = snext; 2846 2847 /* 2848 * Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set? 2849 */ 2850 sjset_radiotap_tsft_present = new_stmt(cstate, JMP(BPF_JSET)); 2851 sjset_radiotap_tsft_present->s.k = SWAPLONG(0x00000001); 2852 sappend(s, sjset_radiotap_tsft_present); 2853 sjset_radiotap_ext_present->s.jf = sjset_radiotap_tsft_present; 2854 2855 /* 2856 * If IEEE80211_RADIOTAP_TSFT is set, the flags field is 2857 * at an offset of 16 from the beginning of the raw packet 2858 * data (8 bytes for the radiotap header and 8 bytes for 2859 * the TSFT field). 2860 * 2861 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20) 2862 * is set. 2863 */ 2864 s2 = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 2865 s2->s.k = 16; 2866 sappend(s, s2); 2867 sjset_radiotap_tsft_present->s.jt = s2; 2868 2869 sjset_tsft_datapad = new_stmt(cstate, JMP(BPF_JSET)); 2870 sjset_tsft_datapad->s.k = 0x20; 2871 sappend(s, sjset_tsft_datapad); 2872 2873 /* 2874 * If IEEE80211_RADIOTAP_TSFT is not set, the flags field is 2875 * at an offset of 8 from the beginning of the raw packet 2876 * data (8 bytes for the radiotap header). 2877 * 2878 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20) 2879 * is set. 2880 */ 2881 s2 = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 2882 s2->s.k = 8; 2883 sappend(s, s2); 2884 sjset_radiotap_tsft_present->s.jf = s2; 2885 2886 sjset_notsft_datapad = new_stmt(cstate, JMP(BPF_JSET)); 2887 sjset_notsft_datapad->s.k = 0x20; 2888 sappend(s, sjset_notsft_datapad); 2889 2890 /* 2891 * In either case, if IEEE80211_RADIOTAP_F_DATAPAD is 2892 * set, round the length of the 802.11 header to 2893 * a multiple of 4. Do that by adding 3 and then 2894 * dividing by and multiplying by 4, which we do by 2895 * ANDing with ~3. 2896 */ 2897 s_roundup = new_stmt(cstate, BPF_LD|BPF_MEM); 2898 s_roundup->s.k = cstate->off_linkpl.reg; 2899 sappend(s, s_roundup); 2900 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_IMM); 2901 s2->s.k = 3; 2902 sappend(s, s2); 2903 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_IMM); 2904 s2->s.k = (bpf_u_int32)~3; 2905 sappend(s, s2); 2906 s2 = new_stmt(cstate, BPF_ST); 2907 s2->s.k = cstate->off_linkpl.reg; 2908 sappend(s, s2); 2909 2910 sjset_tsft_datapad->s.jt = s_roundup; 2911 sjset_tsft_datapad->s.jf = snext; 2912 sjset_notsft_datapad->s.jt = s_roundup; 2913 sjset_notsft_datapad->s.jf = snext; 2914 } else 2915 sjset_qos->s.jf = snext; 2916 2917 return s; 2918 } 2919 2920 static void 2921 insert_compute_vloffsets(compiler_state_t *cstate, struct block *b) 2922 { 2923 struct slist *s; 2924 2925 /* There is an implicit dependency between the link 2926 * payload and link header since the payload computation 2927 * includes the variable part of the header. Therefore, 2928 * if nobody else has allocated a register for the link 2929 * header and we need it, do it now. */ 2930 if (cstate->off_linkpl.reg != -1 && cstate->off_linkhdr.is_variable && 2931 cstate->off_linkhdr.reg == -1) 2932 cstate->off_linkhdr.reg = alloc_reg(cstate); 2933 2934 /* 2935 * For link-layer types that have a variable-length header 2936 * preceding the link-layer header, generate code to load 2937 * the offset of the link-layer header into the register 2938 * assigned to that offset, if any. 2939 * 2940 * XXX - this, and the next switch statement, won't handle 2941 * encapsulation of 802.11 or 802.11+radio information in 2942 * some other protocol stack. That's significantly more 2943 * complicated. 2944 */ 2945 switch (cstate->outermostlinktype) { 2946 2947 case DLT_PRISM_HEADER: 2948 s = gen_load_prism_llprefixlen(cstate); 2949 break; 2950 2951 case DLT_IEEE802_11_RADIO_AVS: 2952 s = gen_load_avs_llprefixlen(cstate); 2953 break; 2954 2955 case DLT_IEEE802_11_RADIO: 2956 s = gen_load_radiotap_llprefixlen(cstate); 2957 break; 2958 2959 case DLT_PPI: 2960 s = gen_load_ppi_llprefixlen(cstate); 2961 break; 2962 2963 default: 2964 s = NULL; 2965 break; 2966 } 2967 2968 /* 2969 * For link-layer types that have a variable-length link-layer 2970 * header, generate code to load the offset of the link-layer 2971 * payload into the register assigned to that offset, if any. 2972 */ 2973 switch (cstate->outermostlinktype) { 2974 2975 case DLT_IEEE802_11: 2976 case DLT_PRISM_HEADER: 2977 case DLT_IEEE802_11_RADIO_AVS: 2978 case DLT_IEEE802_11_RADIO: 2979 case DLT_PPI: 2980 s = gen_load_802_11_header_len(cstate, s, b->stmts); 2981 break; 2982 2983 case DLT_PFLOG: 2984 s = gen_load_pflog_llprefixlen(cstate); 2985 break; 2986 } 2987 2988 /* 2989 * If there is no initialization yet and we need variable 2990 * length offsets for VLAN, initialize them to zero 2991 */ 2992 if (s == NULL && cstate->is_vlan_vloffset) { 2993 struct slist *s2; 2994 2995 if (cstate->off_linkpl.reg == -1) 2996 cstate->off_linkpl.reg = alloc_reg(cstate); 2997 if (cstate->off_linktype.reg == -1) 2998 cstate->off_linktype.reg = alloc_reg(cstate); 2999 3000 s = new_stmt(cstate, BPF_LD|BPF_W|BPF_IMM); 3001 s->s.k = 0; 3002 s2 = new_stmt(cstate, BPF_ST); 3003 s2->s.k = cstate->off_linkpl.reg; 3004 sappend(s, s2); 3005 s2 = new_stmt(cstate, BPF_ST); 3006 s2->s.k = cstate->off_linktype.reg; 3007 sappend(s, s2); 3008 } 3009 3010 /* 3011 * If we have any offset-loading code, append all the 3012 * existing statements in the block to those statements, 3013 * and make the resulting list the list of statements 3014 * for the block. 3015 */ 3016 if (s != NULL) { 3017 sappend(s, b->stmts); 3018 b->stmts = s; 3019 } 3020 } 3021 3022 static struct block * 3023 gen_ppi_dlt_check(compiler_state_t *cstate) 3024 { 3025 struct slist *s_load_dlt; 3026 struct block *b; 3027 3028 if (cstate->linktype == DLT_PPI) 3029 { 3030 /* Create the statements that check for the DLT 3031 */ 3032 s_load_dlt = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 3033 s_load_dlt->s.k = 4; 3034 3035 b = new_block(cstate, JMP(BPF_JEQ)); 3036 3037 b->stmts = s_load_dlt; 3038 b->s.k = SWAPLONG(DLT_IEEE802_11); 3039 } 3040 else 3041 { 3042 b = NULL; 3043 } 3044 3045 return b; 3046 } 3047 3048 /* 3049 * Take an absolute offset, and: 3050 * 3051 * if it has no variable part, return NULL; 3052 * 3053 * if it has a variable part, generate code to load the register 3054 * containing that variable part into the X register, returning 3055 * a pointer to that code - if no register for that offset has 3056 * been allocated, allocate it first. 3057 * 3058 * (The code to set that register will be generated later, but will 3059 * be placed earlier in the code sequence.) 3060 */ 3061 static struct slist * 3062 gen_abs_offset_varpart(compiler_state_t *cstate, bpf_abs_offset *off) 3063 { 3064 struct slist *s; 3065 3066 if (off->is_variable) { 3067 if (off->reg == -1) { 3068 /* 3069 * We haven't yet assigned a register for the 3070 * variable part of the offset of the link-layer 3071 * header; allocate one. 3072 */ 3073 off->reg = alloc_reg(cstate); 3074 } 3075 3076 /* 3077 * Load the register containing the variable part of the 3078 * offset of the link-layer header into the X register. 3079 */ 3080 s = new_stmt(cstate, BPF_LDX|BPF_MEM); 3081 s->s.k = off->reg; 3082 return s; 3083 } else { 3084 /* 3085 * That offset isn't variable, there's no variable part, 3086 * so we don't need to generate any code. 3087 */ 3088 return NULL; 3089 } 3090 } 3091 3092 /* 3093 * Map an Ethernet type to the equivalent PPP type. 3094 */ 3095 static bpf_u_int32 3096 ethertype_to_ppptype(bpf_u_int32 ll_proto) 3097 { 3098 switch (ll_proto) { 3099 3100 case ETHERTYPE_IP: 3101 ll_proto = PPP_IP; 3102 break; 3103 3104 case ETHERTYPE_IPV6: 3105 ll_proto = PPP_IPV6; 3106 break; 3107 3108 case ETHERTYPE_DN: 3109 ll_proto = PPP_DECNET; 3110 break; 3111 3112 case ETHERTYPE_ATALK: 3113 ll_proto = PPP_APPLE; 3114 break; 3115 3116 case ETHERTYPE_NS: 3117 ll_proto = PPP_NS; 3118 break; 3119 3120 case LLCSAP_ISONS: 3121 ll_proto = PPP_OSI; 3122 break; 3123 3124 case LLCSAP_8021D: 3125 /* 3126 * I'm assuming the "Bridging PDU"s that go 3127 * over PPP are Spanning Tree Protocol 3128 * Bridging PDUs. 3129 */ 3130 ll_proto = PPP_BRPDU; 3131 break; 3132 3133 case LLCSAP_IPX: 3134 ll_proto = PPP_IPX; 3135 break; 3136 } 3137 return (ll_proto); 3138 } 3139 3140 /* 3141 * Generate any tests that, for encapsulation of a link-layer packet 3142 * inside another protocol stack, need to be done to check for those 3143 * link-layer packets (and that haven't already been done by a check 3144 * for that encapsulation). 3145 */ 3146 static struct block * 3147 gen_prevlinkhdr_check(compiler_state_t *cstate) 3148 { 3149 struct block *b0; 3150 3151 if (cstate->is_geneve) 3152 return gen_geneve_ll_check(cstate); 3153 3154 switch (cstate->prevlinktype) { 3155 3156 case DLT_SUNATM: 3157 /* 3158 * This is LANE-encapsulated Ethernet; check that the LANE 3159 * packet doesn't begin with an LE Control marker, i.e. 3160 * that it's data, not a control message. 3161 * 3162 * (We've already generated a test for LANE.) 3163 */ 3164 b0 = gen_cmp(cstate, OR_PREVLINKHDR, SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 3165 gen_not(b0); 3166 return b0; 3167 3168 default: 3169 /* 3170 * No such tests are necessary. 3171 */ 3172 return NULL; 3173 } 3174 /*NOTREACHED*/ 3175 } 3176 3177 /* 3178 * The three different values we should check for when checking for an 3179 * IPv6 packet with DLT_NULL. 3180 */ 3181 #define BSD_AFNUM_INET6_BSD 24 /* NetBSD, OpenBSD, BSD/OS, Npcap */ 3182 #define BSD_AFNUM_INET6_FREEBSD 28 /* FreeBSD */ 3183 #define BSD_AFNUM_INET6_DARWIN 30 /* macOS, iOS, other Darwin-based OSes */ 3184 3185 /* 3186 * Generate code to match a particular packet type by matching the 3187 * link-layer type field or fields in the 802.2 LLC header. 3188 * 3189 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 3190 * value, if <= ETHERMTU. 3191 */ 3192 static struct block * 3193 gen_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 3194 { 3195 struct block *b0, *b1, *b2; 3196 const char *description; 3197 3198 /* are we checking MPLS-encapsulated packets? */ 3199 if (cstate->label_stack_depth > 0) 3200 return gen_mpls_linktype(cstate, ll_proto); 3201 3202 switch (cstate->linktype) { 3203 3204 case DLT_EN10MB: 3205 case DLT_NETANALYZER: 3206 case DLT_NETANALYZER_TRANSPARENT: 3207 /* Geneve has an EtherType regardless of whether there is an 3208 * L2 header. */ 3209 if (!cstate->is_geneve) 3210 b0 = gen_prevlinkhdr_check(cstate); 3211 else 3212 b0 = NULL; 3213 3214 b1 = gen_ether_linktype(cstate, ll_proto); 3215 if (b0 != NULL) 3216 gen_and(b0, b1); 3217 return b1; 3218 /*NOTREACHED*/ 3219 3220 case DLT_C_HDLC: 3221 case DLT_HDLC: 3222 switch (ll_proto) { 3223 3224 case LLCSAP_ISONS: 3225 ll_proto = (ll_proto << 8 | LLCSAP_ISONS); 3226 /* fall through */ 3227 3228 default: 3229 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); 3230 /*NOTREACHED*/ 3231 } 3232 3233 case DLT_IEEE802_11: 3234 case DLT_PRISM_HEADER: 3235 case DLT_IEEE802_11_RADIO_AVS: 3236 case DLT_IEEE802_11_RADIO: 3237 case DLT_PPI: 3238 /* 3239 * Check that we have a data frame. 3240 */ 3241 b0 = gen_check_802_11_data_frame(cstate); 3242 3243 /* 3244 * Now check for the specified link-layer type. 3245 */ 3246 b1 = gen_llc_linktype(cstate, ll_proto); 3247 gen_and(b0, b1); 3248 return b1; 3249 /*NOTREACHED*/ 3250 3251 case DLT_FDDI: 3252 /* 3253 * XXX - check for LLC frames. 3254 */ 3255 return gen_llc_linktype(cstate, ll_proto); 3256 /*NOTREACHED*/ 3257 3258 case DLT_IEEE802: 3259 /* 3260 * XXX - check for LLC PDUs, as per IEEE 802.5. 3261 */ 3262 return gen_llc_linktype(cstate, ll_proto); 3263 /*NOTREACHED*/ 3264 3265 case DLT_ATM_RFC1483: 3266 case DLT_ATM_CLIP: 3267 case DLT_IP_OVER_FC: 3268 return gen_llc_linktype(cstate, ll_proto); 3269 /*NOTREACHED*/ 3270 3271 case DLT_SUNATM: 3272 /* 3273 * Check for an LLC-encapsulated version of this protocol; 3274 * if we were checking for LANE, linktype would no longer 3275 * be DLT_SUNATM. 3276 * 3277 * Check for LLC encapsulation and then check the protocol. 3278 */ 3279 b0 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 3280 b1 = gen_llc_linktype(cstate, ll_proto); 3281 gen_and(b0, b1); 3282 return b1; 3283 /*NOTREACHED*/ 3284 3285 case DLT_LINUX_SLL: 3286 return gen_linux_sll_linktype(cstate, ll_proto); 3287 /*NOTREACHED*/ 3288 3289 case DLT_SLIP: 3290 case DLT_SLIP_BSDOS: 3291 case DLT_RAW: 3292 /* 3293 * These types don't provide any type field; packets 3294 * are always IPv4 or IPv6. 3295 * 3296 * XXX - for IPv4, check for a version number of 4, and, 3297 * for IPv6, check for a version number of 6? 3298 */ 3299 switch (ll_proto) { 3300 3301 case ETHERTYPE_IP: 3302 /* Check for a version number of 4. */ 3303 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, 0x40, 0xF0); 3304 3305 case ETHERTYPE_IPV6: 3306 /* Check for a version number of 6. */ 3307 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, 0x60, 0xF0); 3308 3309 default: 3310 return gen_false(cstate); /* always false */ 3311 } 3312 /*NOTREACHED*/ 3313 3314 case DLT_IPV4: 3315 /* 3316 * Raw IPv4, so no type field. 3317 */ 3318 if (ll_proto == ETHERTYPE_IP) 3319 return gen_true(cstate); /* always true */ 3320 3321 /* Checking for something other than IPv4; always false */ 3322 return gen_false(cstate); 3323 /*NOTREACHED*/ 3324 3325 case DLT_IPV6: 3326 /* 3327 * Raw IPv6, so no type field. 3328 */ 3329 if (ll_proto == ETHERTYPE_IPV6) 3330 return gen_true(cstate); /* always true */ 3331 3332 /* Checking for something other than IPv6; always false */ 3333 return gen_false(cstate); 3334 /*NOTREACHED*/ 3335 3336 case DLT_PPP: 3337 case DLT_PPP_PPPD: 3338 case DLT_PPP_SERIAL: 3339 case DLT_PPP_ETHER: 3340 /* 3341 * We use Ethernet protocol types inside libpcap; 3342 * map them to the corresponding PPP protocol types. 3343 */ 3344 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, 3345 ethertype_to_ppptype(ll_proto)); 3346 /*NOTREACHED*/ 3347 3348 case DLT_PPP_BSDOS: 3349 /* 3350 * We use Ethernet protocol types inside libpcap; 3351 * map them to the corresponding PPP protocol types. 3352 */ 3353 switch (ll_proto) { 3354 3355 case ETHERTYPE_IP: 3356 /* 3357 * Also check for Van Jacobson-compressed IP. 3358 * XXX - do this for other forms of PPP? 3359 */ 3360 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_IP); 3361 b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_VJC); 3362 gen_or(b0, b1); 3363 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_VJNC); 3364 gen_or(b1, b0); 3365 return b0; 3366 3367 default: 3368 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, 3369 ethertype_to_ppptype(ll_proto)); 3370 } 3371 /*NOTREACHED*/ 3372 3373 case DLT_NULL: 3374 case DLT_LOOP: 3375 case DLT_ENC: 3376 switch (ll_proto) { 3377 3378 case ETHERTYPE_IP: 3379 return (gen_loopback_linktype(cstate, AF_INET)); 3380 3381 case ETHERTYPE_IPV6: 3382 /* 3383 * AF_ values may, unfortunately, be platform- 3384 * dependent; AF_INET isn't, because everybody 3385 * used 4.2BSD's value, but AF_INET6 is, because 3386 * 4.2BSD didn't have a value for it (given that 3387 * IPv6 didn't exist back in the early 1980's), 3388 * and they all picked their own values. 3389 * 3390 * This means that, if we're reading from a 3391 * savefile, we need to check for all the 3392 * possible values. 3393 * 3394 * If we're doing a live capture, we only need 3395 * to check for this platform's value; however, 3396 * Npcap uses 24, which isn't Windows's AF_INET6 3397 * value. (Given the multiple different values, 3398 * programs that read pcap files shouldn't be 3399 * checking for their platform's AF_INET6 value 3400 * anyway, they should check for all of the 3401 * possible values. and they might as well do 3402 * that even for live captures.) 3403 */ 3404 if (cstate->bpf_pcap->rfile != NULL) { 3405 /* 3406 * Savefile - check for all three 3407 * possible IPv6 values. 3408 */ 3409 b0 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_BSD); 3410 b1 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_FREEBSD); 3411 gen_or(b0, b1); 3412 b0 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_DARWIN); 3413 gen_or(b0, b1); 3414 return (b1); 3415 } else { 3416 /* 3417 * Live capture, so we only need to 3418 * check for the value used on this 3419 * platform. 3420 */ 3421 #ifdef _WIN32 3422 /* 3423 * Npcap doesn't use Windows's AF_INET6, 3424 * as that collides with AF_IPX on 3425 * some BSDs (both have the value 23). 3426 * Instead, it uses 24. 3427 */ 3428 return (gen_loopback_linktype(cstate, 24)); 3429 #else /* _WIN32 */ 3430 #ifdef AF_INET6 3431 return (gen_loopback_linktype(cstate, AF_INET6)); 3432 #else /* AF_INET6 */ 3433 /* 3434 * I guess this platform doesn't support 3435 * IPv6, so we just reject all packets. 3436 */ 3437 return gen_false(cstate); 3438 #endif /* AF_INET6 */ 3439 #endif /* _WIN32 */ 3440 } 3441 3442 default: 3443 /* 3444 * Not a type on which we support filtering. 3445 * XXX - support those that have AF_ values 3446 * #defined on this platform, at least? 3447 */ 3448 return gen_false(cstate); 3449 } 3450 3451 case DLT_PFLOG: 3452 /* 3453 * af field is host byte order in contrast to the rest of 3454 * the packet. 3455 */ 3456 if (ll_proto == ETHERTYPE_IP) 3457 return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af), 3458 BPF_B, AF_INET)); 3459 else if (ll_proto == ETHERTYPE_IPV6) 3460 return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af), 3461 BPF_B, AF_INET6)); 3462 else 3463 return gen_false(cstate); 3464 /*NOTREACHED*/ 3465 3466 case DLT_ARCNET: 3467 case DLT_ARCNET_LINUX: 3468 /* 3469 * XXX should we check for first fragment if the protocol 3470 * uses PHDS? 3471 */ 3472 switch (ll_proto) { 3473 3474 default: 3475 return gen_false(cstate); 3476 3477 case ETHERTYPE_IPV6: 3478 return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3479 ARCTYPE_INET6)); 3480 3481 case ETHERTYPE_IP: 3482 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3483 ARCTYPE_IP); 3484 b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3485 ARCTYPE_IP_OLD); 3486 gen_or(b0, b1); 3487 return (b1); 3488 3489 case ETHERTYPE_ARP: 3490 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3491 ARCTYPE_ARP); 3492 b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3493 ARCTYPE_ARP_OLD); 3494 gen_or(b0, b1); 3495 return (b1); 3496 3497 case ETHERTYPE_REVARP: 3498 return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3499 ARCTYPE_REVARP)); 3500 3501 case ETHERTYPE_ATALK: 3502 return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3503 ARCTYPE_ATALK)); 3504 } 3505 /*NOTREACHED*/ 3506 3507 case DLT_LTALK: 3508 switch (ll_proto) { 3509 case ETHERTYPE_ATALK: 3510 return gen_true(cstate); 3511 default: 3512 return gen_false(cstate); 3513 } 3514 /*NOTREACHED*/ 3515 3516 case DLT_FRELAY: 3517 /* 3518 * XXX - assumes a 2-byte Frame Relay header with 3519 * DLCI and flags. What if the address is longer? 3520 */ 3521 switch (ll_proto) { 3522 3523 case ETHERTYPE_IP: 3524 /* 3525 * Check for the special NLPID for IP. 3526 */ 3527 return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | 0xcc); 3528 3529 case ETHERTYPE_IPV6: 3530 /* 3531 * Check for the special NLPID for IPv6. 3532 */ 3533 return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | 0x8e); 3534 3535 case LLCSAP_ISONS: 3536 /* 3537 * Check for several OSI protocols. 3538 * 3539 * Frame Relay packets typically have an OSI 3540 * NLPID at the beginning; we check for each 3541 * of them. 3542 * 3543 * What we check for is the NLPID and a frame 3544 * control field of UI, i.e. 0x03 followed 3545 * by the NLPID. 3546 */ 3547 b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | ISO8473_CLNP); 3548 b1 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | ISO9542_ESIS); 3549 b2 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | ISO10589_ISIS); 3550 gen_or(b1, b2); 3551 gen_or(b0, b2); 3552 return b2; 3553 3554 default: 3555 return gen_false(cstate); 3556 } 3557 /*NOTREACHED*/ 3558 3559 case DLT_MFR: 3560 bpf_error(cstate, "Multi-link Frame Relay link-layer type filtering not implemented"); 3561 3562 case DLT_JUNIPER_MFR: 3563 case DLT_JUNIPER_MLFR: 3564 case DLT_JUNIPER_MLPPP: 3565 case DLT_JUNIPER_ATM1: 3566 case DLT_JUNIPER_ATM2: 3567 case DLT_JUNIPER_PPPOE: 3568 case DLT_JUNIPER_PPPOE_ATM: 3569 case DLT_JUNIPER_GGSN: 3570 case DLT_JUNIPER_ES: 3571 case DLT_JUNIPER_MONITOR: 3572 case DLT_JUNIPER_SERVICES: 3573 case DLT_JUNIPER_ETHER: 3574 case DLT_JUNIPER_PPP: 3575 case DLT_JUNIPER_FRELAY: 3576 case DLT_JUNIPER_CHDLC: 3577 case DLT_JUNIPER_VP: 3578 case DLT_JUNIPER_ST: 3579 case DLT_JUNIPER_ISM: 3580 case DLT_JUNIPER_VS: 3581 case DLT_JUNIPER_SRX_E2E: 3582 case DLT_JUNIPER_FIBRECHANNEL: 3583 case DLT_JUNIPER_ATM_CEMIC: 3584 3585 /* just lets verify the magic number for now - 3586 * on ATM we may have up to 6 different encapsulations on the wire 3587 * and need a lot of heuristics to figure out that the payload 3588 * might be; 3589 * 3590 * FIXME encapsulation specific BPF_ filters 3591 */ 3592 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */ 3593 3594 case DLT_BACNET_MS_TP: 3595 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x55FF0000, 0xffff0000); 3596 3597 case DLT_IPNET: 3598 return gen_ipnet_linktype(cstate, ll_proto); 3599 3600 case DLT_LINUX_IRDA: 3601 bpf_error(cstate, "IrDA link-layer type filtering not implemented"); 3602 3603 case DLT_DOCSIS: 3604 bpf_error(cstate, "DOCSIS link-layer type filtering not implemented"); 3605 3606 case DLT_MTP2: 3607 case DLT_MTP2_WITH_PHDR: 3608 bpf_error(cstate, "MTP2 link-layer type filtering not implemented"); 3609 3610 case DLT_ERF: 3611 bpf_error(cstate, "ERF link-layer type filtering not implemented"); 3612 3613 case DLT_PFSYNC: 3614 bpf_error(cstate, "PFSYNC link-layer type filtering not implemented"); 3615 3616 case DLT_LINUX_LAPD: 3617 bpf_error(cstate, "LAPD link-layer type filtering not implemented"); 3618 3619 case DLT_USB_FREEBSD: 3620 case DLT_USB_LINUX: 3621 case DLT_USB_LINUX_MMAPPED: 3622 case DLT_USBPCAP: 3623 bpf_error(cstate, "USB link-layer type filtering not implemented"); 3624 3625 case DLT_BLUETOOTH_HCI_H4: 3626 case DLT_BLUETOOTH_HCI_H4_WITH_PHDR: 3627 bpf_error(cstate, "Bluetooth link-layer type filtering not implemented"); 3628 3629 case DLT_CAN20B: 3630 case DLT_CAN_SOCKETCAN: 3631 bpf_error(cstate, "CAN link-layer type filtering not implemented"); 3632 3633 case DLT_IEEE802_15_4: 3634 case DLT_IEEE802_15_4_LINUX: 3635 case DLT_IEEE802_15_4_NONASK_PHY: 3636 case DLT_IEEE802_15_4_NOFCS: 3637 case DLT_IEEE802_15_4_TAP: 3638 bpf_error(cstate, "IEEE 802.15.4 link-layer type filtering not implemented"); 3639 3640 case DLT_IEEE802_16_MAC_CPS_RADIO: 3641 bpf_error(cstate, "IEEE 802.16 link-layer type filtering not implemented"); 3642 3643 case DLT_SITA: 3644 bpf_error(cstate, "SITA link-layer type filtering not implemented"); 3645 3646 case DLT_RAIF1: 3647 bpf_error(cstate, "RAIF1 link-layer type filtering not implemented"); 3648 3649 case DLT_IPMB_KONTRON: 3650 case DLT_IPMB_LINUX: 3651 bpf_error(cstate, "IPMB link-layer type filtering not implemented"); 3652 3653 case DLT_AX25_KISS: 3654 bpf_error(cstate, "AX.25 link-layer type filtering not implemented"); 3655 3656 case DLT_NFLOG: 3657 /* Using the fixed-size NFLOG header it is possible to tell only 3658 * the address family of the packet, other meaningful data is 3659 * either missing or behind TLVs. 3660 */ 3661 bpf_error(cstate, "NFLOG link-layer type filtering not implemented"); 3662 3663 default: 3664 /* 3665 * Does this link-layer header type have a field 3666 * indicating the type of the next protocol? If 3667 * so, off_linktype.constant_part will be the offset of that 3668 * field in the packet; if not, it will be OFFSET_NOT_SET. 3669 */ 3670 if (cstate->off_linktype.constant_part != OFFSET_NOT_SET) { 3671 /* 3672 * Yes; assume it's an Ethernet type. (If 3673 * it's not, it needs to be handled specially 3674 * above.) 3675 */ 3676 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, ll_proto); 3677 /*NOTREACHED */ 3678 } else { 3679 /* 3680 * No; report an error. 3681 */ 3682 description = pcap_datalink_val_to_description_or_dlt(cstate->linktype); 3683 bpf_error(cstate, "%s link-layer type filtering not implemented", 3684 description); 3685 /*NOTREACHED */ 3686 } 3687 } 3688 } 3689 3690 /* 3691 * Check for an LLC SNAP packet with a given organization code and 3692 * protocol type; we check the entire contents of the 802.2 LLC and 3693 * snap headers, checking for DSAP and SSAP of SNAP and a control 3694 * field of 0x03 in the LLC header, and for the specified organization 3695 * code and protocol type in the SNAP header. 3696 */ 3697 static struct block * 3698 gen_snap(compiler_state_t *cstate, bpf_u_int32 orgcode, bpf_u_int32 ptype) 3699 { 3700 u_char snapblock[8]; 3701 3702 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 3703 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ 3704 snapblock[2] = 0x03; /* control = UI */ 3705 snapblock[3] = (u_char)(orgcode >> 16); /* upper 8 bits of organization code */ 3706 snapblock[4] = (u_char)(orgcode >> 8); /* middle 8 bits of organization code */ 3707 snapblock[5] = (u_char)(orgcode >> 0); /* lower 8 bits of organization code */ 3708 snapblock[6] = (u_char)(ptype >> 8); /* upper 8 bits of protocol type */ 3709 snapblock[7] = (u_char)(ptype >> 0); /* lower 8 bits of protocol type */ 3710 return gen_bcmp(cstate, OR_LLC, 0, 8, snapblock); 3711 } 3712 3713 /* 3714 * Generate code to match frames with an LLC header. 3715 */ 3716 static struct block * 3717 gen_llc_internal(compiler_state_t *cstate) 3718 { 3719 struct block *b0, *b1; 3720 3721 switch (cstate->linktype) { 3722 3723 case DLT_EN10MB: 3724 /* 3725 * We check for an Ethernet type field less than 3726 * 1500, which means it's an 802.3 length field. 3727 */ 3728 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 3729 gen_not(b0); 3730 3731 /* 3732 * Now check for the purported DSAP and SSAP not being 3733 * 0xFF, to rule out NetWare-over-802.3. 3734 */ 3735 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, 0xFFFF); 3736 gen_not(b1); 3737 gen_and(b0, b1); 3738 return b1; 3739 3740 case DLT_SUNATM: 3741 /* 3742 * We check for LLC traffic. 3743 */ 3744 b0 = gen_atmtype_llc(cstate); 3745 return b0; 3746 3747 case DLT_IEEE802: /* Token Ring */ 3748 /* 3749 * XXX - check for LLC frames. 3750 */ 3751 return gen_true(cstate); 3752 3753 case DLT_FDDI: 3754 /* 3755 * XXX - check for LLC frames. 3756 */ 3757 return gen_true(cstate); 3758 3759 case DLT_ATM_RFC1483: 3760 /* 3761 * For LLC encapsulation, these are defined to have an 3762 * 802.2 LLC header. 3763 * 3764 * For VC encapsulation, they don't, but there's no 3765 * way to check for that; the protocol used on the VC 3766 * is negotiated out of band. 3767 */ 3768 return gen_true(cstate); 3769 3770 case DLT_IEEE802_11: 3771 case DLT_PRISM_HEADER: 3772 case DLT_IEEE802_11_RADIO: 3773 case DLT_IEEE802_11_RADIO_AVS: 3774 case DLT_PPI: 3775 /* 3776 * Check that we have a data frame. 3777 */ 3778 b0 = gen_check_802_11_data_frame(cstate); 3779 return b0; 3780 3781 default: 3782 bpf_error(cstate, "'llc' not supported for %s", 3783 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 3784 /*NOTREACHED*/ 3785 } 3786 } 3787 3788 struct block * 3789 gen_llc(compiler_state_t *cstate) 3790 { 3791 /* 3792 * Catch errors reported by us and routines below us, and return NULL 3793 * on an error. 3794 */ 3795 if (setjmp(cstate->top_ctx)) 3796 return (NULL); 3797 3798 return gen_llc_internal(cstate); 3799 } 3800 3801 struct block * 3802 gen_llc_i(compiler_state_t *cstate) 3803 { 3804 struct block *b0, *b1; 3805 struct slist *s; 3806 3807 /* 3808 * Catch errors reported by us and routines below us, and return NULL 3809 * on an error. 3810 */ 3811 if (setjmp(cstate->top_ctx)) 3812 return (NULL); 3813 3814 /* 3815 * Check whether this is an LLC frame. 3816 */ 3817 b0 = gen_llc_internal(cstate); 3818 3819 /* 3820 * Load the control byte and test the low-order bit; it must 3821 * be clear for I frames. 3822 */ 3823 s = gen_load_a(cstate, OR_LLC, 2, BPF_B); 3824 b1 = new_block(cstate, JMP(BPF_JSET)); 3825 b1->s.k = 0x01; 3826 b1->stmts = s; 3827 gen_not(b1); 3828 gen_and(b0, b1); 3829 return b1; 3830 } 3831 3832 struct block * 3833 gen_llc_s(compiler_state_t *cstate) 3834 { 3835 struct block *b0, *b1; 3836 3837 /* 3838 * Catch errors reported by us and routines below us, and return NULL 3839 * on an error. 3840 */ 3841 if (setjmp(cstate->top_ctx)) 3842 return (NULL); 3843 3844 /* 3845 * Check whether this is an LLC frame. 3846 */ 3847 b0 = gen_llc_internal(cstate); 3848 3849 /* 3850 * Now compare the low-order 2 bit of the control byte against 3851 * the appropriate value for S frames. 3852 */ 3853 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, LLC_S_FMT, 0x03); 3854 gen_and(b0, b1); 3855 return b1; 3856 } 3857 3858 struct block * 3859 gen_llc_u(compiler_state_t *cstate) 3860 { 3861 struct block *b0, *b1; 3862 3863 /* 3864 * Catch errors reported by us and routines below us, and return NULL 3865 * on an error. 3866 */ 3867 if (setjmp(cstate->top_ctx)) 3868 return (NULL); 3869 3870 /* 3871 * Check whether this is an LLC frame. 3872 */ 3873 b0 = gen_llc_internal(cstate); 3874 3875 /* 3876 * Now compare the low-order 2 bit of the control byte against 3877 * the appropriate value for U frames. 3878 */ 3879 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, LLC_U_FMT, 0x03); 3880 gen_and(b0, b1); 3881 return b1; 3882 } 3883 3884 struct block * 3885 gen_llc_s_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) 3886 { 3887 struct block *b0, *b1; 3888 3889 /* 3890 * Catch errors reported by us and routines below us, and return NULL 3891 * on an error. 3892 */ 3893 if (setjmp(cstate->top_ctx)) 3894 return (NULL); 3895 3896 /* 3897 * Check whether this is an LLC frame. 3898 */ 3899 b0 = gen_llc_internal(cstate); 3900 3901 /* 3902 * Now check for an S frame with the appropriate type. 3903 */ 3904 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, subtype, LLC_S_CMD_MASK); 3905 gen_and(b0, b1); 3906 return b1; 3907 } 3908 3909 struct block * 3910 gen_llc_u_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) 3911 { 3912 struct block *b0, *b1; 3913 3914 /* 3915 * Catch errors reported by us and routines below us, and return NULL 3916 * on an error. 3917 */ 3918 if (setjmp(cstate->top_ctx)) 3919 return (NULL); 3920 3921 /* 3922 * Check whether this is an LLC frame. 3923 */ 3924 b0 = gen_llc_internal(cstate); 3925 3926 /* 3927 * Now check for a U frame with the appropriate type. 3928 */ 3929 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, subtype, LLC_U_CMD_MASK); 3930 gen_and(b0, b1); 3931 return b1; 3932 } 3933 3934 /* 3935 * Generate code to match a particular packet type, for link-layer types 3936 * using 802.2 LLC headers. 3937 * 3938 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used 3939 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues. 3940 * 3941 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 3942 * value, if <= ETHERMTU. We use that to determine whether to 3943 * match the DSAP or both DSAP and LSAP or to check the OUI and 3944 * protocol ID in a SNAP header. 3945 */ 3946 static struct block * 3947 gen_llc_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 3948 { 3949 /* 3950 * XXX - handle token-ring variable-length header. 3951 */ 3952 switch (ll_proto) { 3953 3954 case LLCSAP_IP: 3955 case LLCSAP_ISONS: 3956 case LLCSAP_NETBEUI: 3957 /* 3958 * XXX - should we check both the DSAP and the 3959 * SSAP, like this, or should we check just the 3960 * DSAP, as we do for other SAP values? 3961 */ 3962 return gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_u_int32) 3963 ((ll_proto << 8) | ll_proto)); 3964 3965 case LLCSAP_IPX: 3966 /* 3967 * XXX - are there ever SNAP frames for IPX on 3968 * non-Ethernet 802.x networks? 3969 */ 3970 return gen_cmp(cstate, OR_LLC, 0, BPF_B, LLCSAP_IPX); 3971 3972 case ETHERTYPE_ATALK: 3973 /* 3974 * 802.2-encapsulated ETHERTYPE_ATALK packets are 3975 * SNAP packets with an organization code of 3976 * 0x080007 (Apple, for Appletalk) and a protocol 3977 * type of ETHERTYPE_ATALK (Appletalk). 3978 * 3979 * XXX - check for an organization code of 3980 * encapsulated Ethernet as well? 3981 */ 3982 return gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); 3983 3984 default: 3985 /* 3986 * XXX - we don't have to check for IPX 802.3 3987 * here, but should we check for the IPX Ethertype? 3988 */ 3989 if (ll_proto <= ETHERMTU) { 3990 /* 3991 * This is an LLC SAP value, so check 3992 * the DSAP. 3993 */ 3994 return gen_cmp(cstate, OR_LLC, 0, BPF_B, ll_proto); 3995 } else { 3996 /* 3997 * This is an Ethernet type; we assume that it's 3998 * unlikely that it'll appear in the right place 3999 * at random, and therefore check only the 4000 * location that would hold the Ethernet type 4001 * in a SNAP frame with an organization code of 4002 * 0x000000 (encapsulated Ethernet). 4003 * 4004 * XXX - if we were to check for the SNAP DSAP and 4005 * LSAP, as per XXX, and were also to check for an 4006 * organization code of 0x000000 (encapsulated 4007 * Ethernet), we'd do 4008 * 4009 * return gen_snap(cstate, 0x000000, ll_proto); 4010 * 4011 * here; for now, we don't, as per the above. 4012 * I don't know whether it's worth the extra CPU 4013 * time to do the right check or not. 4014 */ 4015 return gen_cmp(cstate, OR_LLC, 6, BPF_H, ll_proto); 4016 } 4017 } 4018 } 4019 4020 static struct block * 4021 gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, 4022 int dir, bpf_u_int32 ll_proto, u_int src_off, u_int dst_off) 4023 { 4024 struct block *b0, *b1; 4025 u_int offset; 4026 4027 switch (dir) { 4028 4029 case Q_SRC: 4030 offset = src_off; 4031 break; 4032 4033 case Q_DST: 4034 offset = dst_off; 4035 break; 4036 4037 case Q_AND: 4038 b0 = gen_hostop(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); 4039 b1 = gen_hostop(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); 4040 gen_and(b0, b1); 4041 return b1; 4042 4043 case Q_DEFAULT: 4044 case Q_OR: 4045 b0 = gen_hostop(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); 4046 b1 = gen_hostop(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); 4047 gen_or(b0, b1); 4048 return b1; 4049 4050 case Q_ADDR1: 4051 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4052 /*NOTREACHED*/ 4053 4054 case Q_ADDR2: 4055 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4056 /*NOTREACHED*/ 4057 4058 case Q_ADDR3: 4059 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4060 /*NOTREACHED*/ 4061 4062 case Q_ADDR4: 4063 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4064 /*NOTREACHED*/ 4065 4066 case Q_RA: 4067 bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 4068 /*NOTREACHED*/ 4069 4070 case Q_TA: 4071 bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 4072 /*NOTREACHED*/ 4073 4074 default: 4075 abort(); 4076 /*NOTREACHED*/ 4077 } 4078 b0 = gen_linktype(cstate, ll_proto); 4079 b1 = gen_mcmp(cstate, OR_LINKPL, offset, BPF_W, addr, mask); 4080 gen_and(b0, b1); 4081 return b1; 4082 } 4083 4084 #ifdef INET6 4085 static struct block * 4086 gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, 4087 struct in6_addr *mask, int dir, bpf_u_int32 ll_proto, u_int src_off, 4088 u_int dst_off) 4089 { 4090 struct block *b0, *b1; 4091 u_int offset; 4092 /* 4093 * Code below needs to access four separate 32-bit parts of the 128-bit 4094 * IPv6 address and mask. In some OSes this is as simple as using the 4095 * s6_addr32 pseudo-member of struct in6_addr, which contains a union of 4096 * 8-, 16- and 32-bit arrays. In other OSes this is not the case, as 4097 * far as libpcap sees it. Hence copy the data before use to avoid 4098 * potential unaligned memory access and the associated compiler 4099 * warnings (whether genuine or not). 4100 */ 4101 bpf_u_int32 a[4], m[4]; 4102 4103 switch (dir) { 4104 4105 case Q_SRC: 4106 offset = src_off; 4107 break; 4108 4109 case Q_DST: 4110 offset = dst_off; 4111 break; 4112 4113 case Q_AND: 4114 b0 = gen_hostop6(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); 4115 b1 = gen_hostop6(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); 4116 gen_and(b0, b1); 4117 return b1; 4118 4119 case Q_DEFAULT: 4120 case Q_OR: 4121 b0 = gen_hostop6(cstate, addr, mask, Q_SRC, ll_proto, src_off, dst_off); 4122 b1 = gen_hostop6(cstate, addr, mask, Q_DST, ll_proto, src_off, dst_off); 4123 gen_or(b0, b1); 4124 return b1; 4125 4126 case Q_ADDR1: 4127 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4128 /*NOTREACHED*/ 4129 4130 case Q_ADDR2: 4131 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4132 /*NOTREACHED*/ 4133 4134 case Q_ADDR3: 4135 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4136 /*NOTREACHED*/ 4137 4138 case Q_ADDR4: 4139 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4140 /*NOTREACHED*/ 4141 4142 case Q_RA: 4143 bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 4144 /*NOTREACHED*/ 4145 4146 case Q_TA: 4147 bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 4148 /*NOTREACHED*/ 4149 4150 default: 4151 abort(); 4152 /*NOTREACHED*/ 4153 } 4154 /* this order is important */ 4155 memcpy(a, addr, sizeof(a)); 4156 memcpy(m, mask, sizeof(m)); 4157 b1 = gen_mcmp(cstate, OR_LINKPL, offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 4158 b0 = gen_mcmp(cstate, OR_LINKPL, offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 4159 gen_and(b0, b1); 4160 b0 = gen_mcmp(cstate, OR_LINKPL, offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 4161 gen_and(b0, b1); 4162 b0 = gen_mcmp(cstate, OR_LINKPL, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 4163 gen_and(b0, b1); 4164 b0 = gen_linktype(cstate, ll_proto); 4165 gen_and(b0, b1); 4166 return b1; 4167 } 4168 #endif 4169 4170 static struct block * 4171 gen_ehostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4172 { 4173 register struct block *b0, *b1; 4174 4175 switch (dir) { 4176 case Q_SRC: 4177 return gen_bcmp(cstate, OR_LINKHDR, 6, 6, eaddr); 4178 4179 case Q_DST: 4180 return gen_bcmp(cstate, OR_LINKHDR, 0, 6, eaddr); 4181 4182 case Q_AND: 4183 b0 = gen_ehostop(cstate, eaddr, Q_SRC); 4184 b1 = gen_ehostop(cstate, eaddr, Q_DST); 4185 gen_and(b0, b1); 4186 return b1; 4187 4188 case Q_DEFAULT: 4189 case Q_OR: 4190 b0 = gen_ehostop(cstate, eaddr, Q_SRC); 4191 b1 = gen_ehostop(cstate, eaddr, Q_DST); 4192 gen_or(b0, b1); 4193 return b1; 4194 4195 case Q_ADDR1: 4196 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11 with 802.11 headers"); 4197 /*NOTREACHED*/ 4198 4199 case Q_ADDR2: 4200 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11 with 802.11 headers"); 4201 /*NOTREACHED*/ 4202 4203 case Q_ADDR3: 4204 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11 with 802.11 headers"); 4205 /*NOTREACHED*/ 4206 4207 case Q_ADDR4: 4208 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11 with 802.11 headers"); 4209 /*NOTREACHED*/ 4210 4211 case Q_RA: 4212 bpf_error(cstate, "'ra' is only supported on 802.11 with 802.11 headers"); 4213 /*NOTREACHED*/ 4214 4215 case Q_TA: 4216 bpf_error(cstate, "'ta' is only supported on 802.11 with 802.11 headers"); 4217 /*NOTREACHED*/ 4218 } 4219 abort(); 4220 /*NOTREACHED*/ 4221 } 4222 4223 /* 4224 * Like gen_ehostop, but for DLT_FDDI 4225 */ 4226 static struct block * 4227 gen_fhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4228 { 4229 struct block *b0, *b1; 4230 4231 switch (dir) { 4232 case Q_SRC: 4233 return gen_bcmp(cstate, OR_LINKHDR, 6 + 1 + cstate->pcap_fddipad, 6, eaddr); 4234 4235 case Q_DST: 4236 return gen_bcmp(cstate, OR_LINKHDR, 0 + 1 + cstate->pcap_fddipad, 6, eaddr); 4237 4238 case Q_AND: 4239 b0 = gen_fhostop(cstate, eaddr, Q_SRC); 4240 b1 = gen_fhostop(cstate, eaddr, Q_DST); 4241 gen_and(b0, b1); 4242 return b1; 4243 4244 case Q_DEFAULT: 4245 case Q_OR: 4246 b0 = gen_fhostop(cstate, eaddr, Q_SRC); 4247 b1 = gen_fhostop(cstate, eaddr, Q_DST); 4248 gen_or(b0, b1); 4249 return b1; 4250 4251 case Q_ADDR1: 4252 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 4253 /*NOTREACHED*/ 4254 4255 case Q_ADDR2: 4256 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 4257 /*NOTREACHED*/ 4258 4259 case Q_ADDR3: 4260 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 4261 /*NOTREACHED*/ 4262 4263 case Q_ADDR4: 4264 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 4265 /*NOTREACHED*/ 4266 4267 case Q_RA: 4268 bpf_error(cstate, "'ra' is only supported on 802.11"); 4269 /*NOTREACHED*/ 4270 4271 case Q_TA: 4272 bpf_error(cstate, "'ta' is only supported on 802.11"); 4273 /*NOTREACHED*/ 4274 } 4275 abort(); 4276 /*NOTREACHED*/ 4277 } 4278 4279 /* 4280 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 4281 */ 4282 static struct block * 4283 gen_thostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4284 { 4285 register struct block *b0, *b1; 4286 4287 switch (dir) { 4288 case Q_SRC: 4289 return gen_bcmp(cstate, OR_LINKHDR, 8, 6, eaddr); 4290 4291 case Q_DST: 4292 return gen_bcmp(cstate, OR_LINKHDR, 2, 6, eaddr); 4293 4294 case Q_AND: 4295 b0 = gen_thostop(cstate, eaddr, Q_SRC); 4296 b1 = gen_thostop(cstate, eaddr, Q_DST); 4297 gen_and(b0, b1); 4298 return b1; 4299 4300 case Q_DEFAULT: 4301 case Q_OR: 4302 b0 = gen_thostop(cstate, eaddr, Q_SRC); 4303 b1 = gen_thostop(cstate, eaddr, Q_DST); 4304 gen_or(b0, b1); 4305 return b1; 4306 4307 case Q_ADDR1: 4308 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 4309 /*NOTREACHED*/ 4310 4311 case Q_ADDR2: 4312 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 4313 /*NOTREACHED*/ 4314 4315 case Q_ADDR3: 4316 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 4317 /*NOTREACHED*/ 4318 4319 case Q_ADDR4: 4320 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 4321 /*NOTREACHED*/ 4322 4323 case Q_RA: 4324 bpf_error(cstate, "'ra' is only supported on 802.11"); 4325 /*NOTREACHED*/ 4326 4327 case Q_TA: 4328 bpf_error(cstate, "'ta' is only supported on 802.11"); 4329 /*NOTREACHED*/ 4330 } 4331 abort(); 4332 /*NOTREACHED*/ 4333 } 4334 4335 /* 4336 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and 4337 * various 802.11 + radio headers. 4338 */ 4339 static struct block * 4340 gen_wlanhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4341 { 4342 register struct block *b0, *b1, *b2; 4343 register struct slist *s; 4344 4345 #ifdef ENABLE_WLAN_FILTERING_PATCH 4346 /* 4347 * TODO GV 20070613 4348 * We need to disable the optimizer because the optimizer is buggy 4349 * and wipes out some LD instructions generated by the below 4350 * code to validate the Frame Control bits 4351 */ 4352 cstate->no_optimize = 1; 4353 #endif /* ENABLE_WLAN_FILTERING_PATCH */ 4354 4355 switch (dir) { 4356 case Q_SRC: 4357 /* 4358 * Oh, yuk. 4359 * 4360 * For control frames, there is no SA. 4361 * 4362 * For management frames, SA is at an 4363 * offset of 10 from the beginning of 4364 * the packet. 4365 * 4366 * For data frames, SA is at an offset 4367 * of 10 from the beginning of the packet 4368 * if From DS is clear, at an offset of 4369 * 16 from the beginning of the packet 4370 * if From DS is set and To DS is clear, 4371 * and an offset of 24 from the beginning 4372 * of the packet if From DS is set and To DS 4373 * is set. 4374 */ 4375 4376 /* 4377 * Generate the tests to be done for data frames 4378 * with From DS set. 4379 * 4380 * First, check for To DS set, i.e. check "link[1] & 0x01". 4381 */ 4382 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4383 b1 = new_block(cstate, JMP(BPF_JSET)); 4384 b1->s.k = 0x01; /* To DS */ 4385 b1->stmts = s; 4386 4387 /* 4388 * If To DS is set, the SA is at 24. 4389 */ 4390 b0 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr); 4391 gen_and(b1, b0); 4392 4393 /* 4394 * Now, check for To DS not set, i.e. check 4395 * "!(link[1] & 0x01)". 4396 */ 4397 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4398 b2 = new_block(cstate, JMP(BPF_JSET)); 4399 b2->s.k = 0x01; /* To DS */ 4400 b2->stmts = s; 4401 gen_not(b2); 4402 4403 /* 4404 * If To DS is not set, the SA is at 16. 4405 */ 4406 b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); 4407 gen_and(b2, b1); 4408 4409 /* 4410 * Now OR together the last two checks. That gives 4411 * the complete set of checks for data frames with 4412 * From DS set. 4413 */ 4414 gen_or(b1, b0); 4415 4416 /* 4417 * Now check for From DS being set, and AND that with 4418 * the ORed-together checks. 4419 */ 4420 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4421 b1 = new_block(cstate, JMP(BPF_JSET)); 4422 b1->s.k = 0x02; /* From DS */ 4423 b1->stmts = s; 4424 gen_and(b1, b0); 4425 4426 /* 4427 * Now check for data frames with From DS not set. 4428 */ 4429 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4430 b2 = new_block(cstate, JMP(BPF_JSET)); 4431 b2->s.k = 0x02; /* From DS */ 4432 b2->stmts = s; 4433 gen_not(b2); 4434 4435 /* 4436 * If From DS isn't set, the SA is at 10. 4437 */ 4438 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4439 gen_and(b2, b1); 4440 4441 /* 4442 * Now OR together the checks for data frames with 4443 * From DS not set and for data frames with From DS 4444 * set; that gives the checks done for data frames. 4445 */ 4446 gen_or(b1, b0); 4447 4448 /* 4449 * Now check for a data frame. 4450 * I.e, check "link[0] & 0x08". 4451 */ 4452 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4453 b1 = new_block(cstate, JMP(BPF_JSET)); 4454 b1->s.k = 0x08; 4455 b1->stmts = s; 4456 4457 /* 4458 * AND that with the checks done for data frames. 4459 */ 4460 gen_and(b1, b0); 4461 4462 /* 4463 * If the high-order bit of the type value is 0, this 4464 * is a management frame. 4465 * I.e, check "!(link[0] & 0x08)". 4466 */ 4467 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4468 b2 = new_block(cstate, JMP(BPF_JSET)); 4469 b2->s.k = 0x08; 4470 b2->stmts = s; 4471 gen_not(b2); 4472 4473 /* 4474 * For management frames, the SA is at 10. 4475 */ 4476 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4477 gen_and(b2, b1); 4478 4479 /* 4480 * OR that with the checks done for data frames. 4481 * That gives the checks done for management and 4482 * data frames. 4483 */ 4484 gen_or(b1, b0); 4485 4486 /* 4487 * If the low-order bit of the type value is 1, 4488 * this is either a control frame or a frame 4489 * with a reserved type, and thus not a 4490 * frame with an SA. 4491 * 4492 * I.e., check "!(link[0] & 0x04)". 4493 */ 4494 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4495 b1 = new_block(cstate, JMP(BPF_JSET)); 4496 b1->s.k = 0x04; 4497 b1->stmts = s; 4498 gen_not(b1); 4499 4500 /* 4501 * AND that with the checks for data and management 4502 * frames. 4503 */ 4504 gen_and(b1, b0); 4505 return b0; 4506 4507 case Q_DST: 4508 /* 4509 * Oh, yuk. 4510 * 4511 * For control frames, there is no DA. 4512 * 4513 * For management frames, DA is at an 4514 * offset of 4 from the beginning of 4515 * the packet. 4516 * 4517 * For data frames, DA is at an offset 4518 * of 4 from the beginning of the packet 4519 * if To DS is clear and at an offset of 4520 * 16 from the beginning of the packet 4521 * if To DS is set. 4522 */ 4523 4524 /* 4525 * Generate the tests to be done for data frames. 4526 * 4527 * First, check for To DS set, i.e. "link[1] & 0x01". 4528 */ 4529 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4530 b1 = new_block(cstate, JMP(BPF_JSET)); 4531 b1->s.k = 0x01; /* To DS */ 4532 b1->stmts = s; 4533 4534 /* 4535 * If To DS is set, the DA is at 16. 4536 */ 4537 b0 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); 4538 gen_and(b1, b0); 4539 4540 /* 4541 * Now, check for To DS not set, i.e. check 4542 * "!(link[1] & 0x01)". 4543 */ 4544 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4545 b2 = new_block(cstate, JMP(BPF_JSET)); 4546 b2->s.k = 0x01; /* To DS */ 4547 b2->stmts = s; 4548 gen_not(b2); 4549 4550 /* 4551 * If To DS is not set, the DA is at 4. 4552 */ 4553 b1 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr); 4554 gen_and(b2, b1); 4555 4556 /* 4557 * Now OR together the last two checks. That gives 4558 * the complete set of checks for data frames. 4559 */ 4560 gen_or(b1, b0); 4561 4562 /* 4563 * Now check for a data frame. 4564 * I.e, check "link[0] & 0x08". 4565 */ 4566 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4567 b1 = new_block(cstate, JMP(BPF_JSET)); 4568 b1->s.k = 0x08; 4569 b1->stmts = s; 4570 4571 /* 4572 * AND that with the checks done for data frames. 4573 */ 4574 gen_and(b1, b0); 4575 4576 /* 4577 * If the high-order bit of the type value is 0, this 4578 * is a management frame. 4579 * I.e, check "!(link[0] & 0x08)". 4580 */ 4581 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4582 b2 = new_block(cstate, JMP(BPF_JSET)); 4583 b2->s.k = 0x08; 4584 b2->stmts = s; 4585 gen_not(b2); 4586 4587 /* 4588 * For management frames, the DA is at 4. 4589 */ 4590 b1 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr); 4591 gen_and(b2, b1); 4592 4593 /* 4594 * OR that with the checks done for data frames. 4595 * That gives the checks done for management and 4596 * data frames. 4597 */ 4598 gen_or(b1, b0); 4599 4600 /* 4601 * If the low-order bit of the type value is 1, 4602 * this is either a control frame or a frame 4603 * with a reserved type, and thus not a 4604 * frame with an SA. 4605 * 4606 * I.e., check "!(link[0] & 0x04)". 4607 */ 4608 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4609 b1 = new_block(cstate, JMP(BPF_JSET)); 4610 b1->s.k = 0x04; 4611 b1->stmts = s; 4612 gen_not(b1); 4613 4614 /* 4615 * AND that with the checks for data and management 4616 * frames. 4617 */ 4618 gen_and(b1, b0); 4619 return b0; 4620 4621 case Q_AND: 4622 b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); 4623 b1 = gen_wlanhostop(cstate, eaddr, Q_DST); 4624 gen_and(b0, b1); 4625 return b1; 4626 4627 case Q_DEFAULT: 4628 case Q_OR: 4629 b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); 4630 b1 = gen_wlanhostop(cstate, eaddr, Q_DST); 4631 gen_or(b0, b1); 4632 return b1; 4633 4634 /* 4635 * XXX - add BSSID keyword? 4636 */ 4637 case Q_ADDR1: 4638 return (gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr)); 4639 4640 case Q_ADDR2: 4641 /* 4642 * Not present in CTS or ACK control frames. 4643 */ 4644 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, 4645 IEEE80211_FC0_TYPE_MASK); 4646 gen_not(b0); 4647 b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS, 4648 IEEE80211_FC0_SUBTYPE_MASK); 4649 gen_not(b1); 4650 b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK, 4651 IEEE80211_FC0_SUBTYPE_MASK); 4652 gen_not(b2); 4653 gen_and(b1, b2); 4654 gen_or(b0, b2); 4655 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4656 gen_and(b2, b1); 4657 return b1; 4658 4659 case Q_ADDR3: 4660 /* 4661 * Not present in control frames. 4662 */ 4663 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, 4664 IEEE80211_FC0_TYPE_MASK); 4665 gen_not(b0); 4666 b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); 4667 gen_and(b0, b1); 4668 return b1; 4669 4670 case Q_ADDR4: 4671 /* 4672 * Present only if the direction mask has both "From DS" 4673 * and "To DS" set. Neither control frames nor management 4674 * frames should have both of those set, so we don't 4675 * check the frame type. 4676 */ 4677 b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, 4678 IEEE80211_FC1_DIR_DSTODS, IEEE80211_FC1_DIR_MASK); 4679 b1 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr); 4680 gen_and(b0, b1); 4681 return b1; 4682 4683 case Q_RA: 4684 /* 4685 * Not present in management frames; addr1 in other 4686 * frames. 4687 */ 4688 4689 /* 4690 * If the high-order bit of the type value is 0, this 4691 * is a management frame. 4692 * I.e, check "(link[0] & 0x08)". 4693 */ 4694 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4695 b1 = new_block(cstate, JMP(BPF_JSET)); 4696 b1->s.k = 0x08; 4697 b1->stmts = s; 4698 4699 /* 4700 * Check addr1. 4701 */ 4702 b0 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr); 4703 4704 /* 4705 * AND that with the check of addr1. 4706 */ 4707 gen_and(b1, b0); 4708 return (b0); 4709 4710 case Q_TA: 4711 /* 4712 * Not present in management frames; addr2, if present, 4713 * in other frames. 4714 */ 4715 4716 /* 4717 * Not present in CTS or ACK control frames. 4718 */ 4719 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, 4720 IEEE80211_FC0_TYPE_MASK); 4721 gen_not(b0); 4722 b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS, 4723 IEEE80211_FC0_SUBTYPE_MASK); 4724 gen_not(b1); 4725 b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK, 4726 IEEE80211_FC0_SUBTYPE_MASK); 4727 gen_not(b2); 4728 gen_and(b1, b2); 4729 gen_or(b0, b2); 4730 4731 /* 4732 * If the high-order bit of the type value is 0, this 4733 * is a management frame. 4734 * I.e, check "(link[0] & 0x08)". 4735 */ 4736 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4737 b1 = new_block(cstate, JMP(BPF_JSET)); 4738 b1->s.k = 0x08; 4739 b1->stmts = s; 4740 4741 /* 4742 * AND that with the check for frames other than 4743 * CTS and ACK frames. 4744 */ 4745 gen_and(b1, b2); 4746 4747 /* 4748 * Check addr2. 4749 */ 4750 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4751 gen_and(b2, b1); 4752 return b1; 4753 } 4754 abort(); 4755 /*NOTREACHED*/ 4756 } 4757 4758 /* 4759 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel. 4760 * (We assume that the addresses are IEEE 48-bit MAC addresses, 4761 * as the RFC states.) 4762 */ 4763 static struct block * 4764 gen_ipfchostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4765 { 4766 register struct block *b0, *b1; 4767 4768 switch (dir) { 4769 case Q_SRC: 4770 return gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4771 4772 case Q_DST: 4773 return gen_bcmp(cstate, OR_LINKHDR, 2, 6, eaddr); 4774 4775 case Q_AND: 4776 b0 = gen_ipfchostop(cstate, eaddr, Q_SRC); 4777 b1 = gen_ipfchostop(cstate, eaddr, Q_DST); 4778 gen_and(b0, b1); 4779 return b1; 4780 4781 case Q_DEFAULT: 4782 case Q_OR: 4783 b0 = gen_ipfchostop(cstate, eaddr, Q_SRC); 4784 b1 = gen_ipfchostop(cstate, eaddr, Q_DST); 4785 gen_or(b0, b1); 4786 return b1; 4787 4788 case Q_ADDR1: 4789 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 4790 /*NOTREACHED*/ 4791 4792 case Q_ADDR2: 4793 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 4794 /*NOTREACHED*/ 4795 4796 case Q_ADDR3: 4797 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 4798 /*NOTREACHED*/ 4799 4800 case Q_ADDR4: 4801 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 4802 /*NOTREACHED*/ 4803 4804 case Q_RA: 4805 bpf_error(cstate, "'ra' is only supported on 802.11"); 4806 /*NOTREACHED*/ 4807 4808 case Q_TA: 4809 bpf_error(cstate, "'ta' is only supported on 802.11"); 4810 /*NOTREACHED*/ 4811 } 4812 abort(); 4813 /*NOTREACHED*/ 4814 } 4815 4816 /* 4817 * This is quite tricky because there may be pad bytes in front of the 4818 * DECNET header, and then there are two possible data packet formats that 4819 * carry both src and dst addresses, plus 5 packet types in a format that 4820 * carries only the src node, plus 2 types that use a different format and 4821 * also carry just the src node. 4822 * 4823 * Yuck. 4824 * 4825 * Instead of doing those all right, we just look for data packets with 4826 * 0 or 1 bytes of padding. If you want to look at other packets, that 4827 * will require a lot more hacking. 4828 * 4829 * To add support for filtering on DECNET "areas" (network numbers) 4830 * one would want to add a "mask" argument to this routine. That would 4831 * make the filter even more inefficient, although one could be clever 4832 * and not generate masking instructions if the mask is 0xFFFF. 4833 */ 4834 static struct block * 4835 gen_dnhostop(compiler_state_t *cstate, bpf_u_int32 addr, int dir) 4836 { 4837 struct block *b0, *b1, *b2, *tmp; 4838 u_int offset_lh; /* offset if long header is received */ 4839 u_int offset_sh; /* offset if short header is received */ 4840 4841 switch (dir) { 4842 4843 case Q_DST: 4844 offset_sh = 1; /* follows flags */ 4845 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 4846 break; 4847 4848 case Q_SRC: 4849 offset_sh = 3; /* follows flags, dstnode */ 4850 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 4851 break; 4852 4853 case Q_AND: 4854 /* Inefficient because we do our Calvinball dance twice */ 4855 b0 = gen_dnhostop(cstate, addr, Q_SRC); 4856 b1 = gen_dnhostop(cstate, addr, Q_DST); 4857 gen_and(b0, b1); 4858 return b1; 4859 4860 case Q_DEFAULT: 4861 case Q_OR: 4862 /* Inefficient because we do our Calvinball dance twice */ 4863 b0 = gen_dnhostop(cstate, addr, Q_SRC); 4864 b1 = gen_dnhostop(cstate, addr, Q_DST); 4865 gen_or(b0, b1); 4866 return b1; 4867 4868 case Q_ADDR1: 4869 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4870 /*NOTREACHED*/ 4871 4872 case Q_ADDR2: 4873 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4874 /*NOTREACHED*/ 4875 4876 case Q_ADDR3: 4877 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4878 /*NOTREACHED*/ 4879 4880 case Q_ADDR4: 4881 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 4882 /*NOTREACHED*/ 4883 4884 case Q_RA: 4885 bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 4886 /*NOTREACHED*/ 4887 4888 case Q_TA: 4889 bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 4890 /*NOTREACHED*/ 4891 4892 default: 4893 abort(); 4894 /*NOTREACHED*/ 4895 } 4896 b0 = gen_linktype(cstate, ETHERTYPE_DN); 4897 /* Check for pad = 1, long header case */ 4898 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H, 4899 (bpf_u_int32)ntohs(0x0681), (bpf_u_int32)ntohs(0x07FF)); 4900 b1 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_lh, 4901 BPF_H, (bpf_u_int32)ntohs((u_short)addr)); 4902 gen_and(tmp, b1); 4903 /* Check for pad = 0, long header case */ 4904 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_u_int32)0x06, 4905 (bpf_u_int32)0x7); 4906 b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_lh, BPF_H, 4907 (bpf_u_int32)ntohs((u_short)addr)); 4908 gen_and(tmp, b2); 4909 gen_or(b2, b1); 4910 /* Check for pad = 1, short header case */ 4911 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H, 4912 (bpf_u_int32)ntohs(0x0281), (bpf_u_int32)ntohs(0x07FF)); 4913 b2 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_sh, BPF_H, 4914 (bpf_u_int32)ntohs((u_short)addr)); 4915 gen_and(tmp, b2); 4916 gen_or(b2, b1); 4917 /* Check for pad = 0, short header case */ 4918 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_u_int32)0x02, 4919 (bpf_u_int32)0x7); 4920 b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_sh, BPF_H, 4921 (bpf_u_int32)ntohs((u_short)addr)); 4922 gen_and(tmp, b2); 4923 gen_or(b2, b1); 4924 4925 /* Combine with test for cstate->linktype */ 4926 gen_and(b0, b1); 4927 return b1; 4928 } 4929 4930 /* 4931 * Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets; 4932 * test the bottom-of-stack bit, and then check the version number 4933 * field in the IP header. 4934 */ 4935 static struct block * 4936 gen_mpls_linktype(compiler_state_t *cstate, bpf_u_int32 ll_proto) 4937 { 4938 struct block *b0, *b1; 4939 4940 switch (ll_proto) { 4941 4942 case ETHERTYPE_IP: 4943 /* match the bottom-of-stack bit */ 4944 b0 = gen_mcmp(cstate, OR_LINKPL, (u_int)-2, BPF_B, 0x01, 0x01); 4945 /* match the IPv4 version number */ 4946 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_B, 0x40, 0xf0); 4947 gen_and(b0, b1); 4948 return b1; 4949 4950 case ETHERTYPE_IPV6: 4951 /* match the bottom-of-stack bit */ 4952 b0 = gen_mcmp(cstate, OR_LINKPL, (u_int)-2, BPF_B, 0x01, 0x01); 4953 /* match the IPv4 version number */ 4954 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_B, 0x60, 0xf0); 4955 gen_and(b0, b1); 4956 return b1; 4957 4958 default: 4959 /* FIXME add other L3 proto IDs */ 4960 bpf_error(cstate, "unsupported protocol over mpls"); 4961 /*NOTREACHED*/ 4962 } 4963 } 4964 4965 static struct block * 4966 gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, 4967 int proto, int dir, int type) 4968 { 4969 struct block *b0, *b1; 4970 const char *typestr; 4971 4972 if (type == Q_NET) 4973 typestr = "net"; 4974 else 4975 typestr = "host"; 4976 4977 switch (proto) { 4978 4979 case Q_DEFAULT: 4980 b0 = gen_host(cstate, addr, mask, Q_IP, dir, type); 4981 /* 4982 * Only check for non-IPv4 addresses if we're not 4983 * checking MPLS-encapsulated packets. 4984 */ 4985 if (cstate->label_stack_depth == 0) { 4986 b1 = gen_host(cstate, addr, mask, Q_ARP, dir, type); 4987 gen_or(b0, b1); 4988 b0 = gen_host(cstate, addr, mask, Q_RARP, dir, type); 4989 gen_or(b1, b0); 4990 } 4991 return b0; 4992 4993 case Q_LINK: 4994 bpf_error(cstate, "link-layer modifier applied to %s", typestr); 4995 4996 case Q_IP: 4997 return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_IP, 12, 16); 4998 4999 case Q_RARP: 5000 return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_REVARP, 14, 24); 5001 5002 case Q_ARP: 5003 return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_ARP, 14, 24); 5004 5005 case Q_SCTP: 5006 bpf_error(cstate, "'sctp' modifier applied to %s", typestr); 5007 5008 case Q_TCP: 5009 bpf_error(cstate, "'tcp' modifier applied to %s", typestr); 5010 5011 case Q_UDP: 5012 bpf_error(cstate, "'udp' modifier applied to %s", typestr); 5013 5014 case Q_ICMP: 5015 bpf_error(cstate, "'icmp' modifier applied to %s", typestr); 5016 5017 case Q_IGMP: 5018 bpf_error(cstate, "'igmp' modifier applied to %s", typestr); 5019 5020 case Q_IGRP: 5021 bpf_error(cstate, "'igrp' modifier applied to %s", typestr); 5022 5023 case Q_ATALK: 5024 bpf_error(cstate, "AppleTalk host filtering not implemented"); 5025 5026 case Q_DECNET: 5027 return gen_dnhostop(cstate, addr, dir); 5028 5029 case Q_LAT: 5030 bpf_error(cstate, "LAT host filtering not implemented"); 5031 5032 case Q_SCA: 5033 bpf_error(cstate, "SCA host filtering not implemented"); 5034 5035 case Q_MOPRC: 5036 bpf_error(cstate, "MOPRC host filtering not implemented"); 5037 5038 case Q_MOPDL: 5039 bpf_error(cstate, "MOPDL host filtering not implemented"); 5040 5041 case Q_IPV6: 5042 bpf_error(cstate, "'ip6' modifier applied to ip host"); 5043 5044 case Q_ICMPV6: 5045 bpf_error(cstate, "'icmp6' modifier applied to %s", typestr); 5046 5047 case Q_AH: 5048 bpf_error(cstate, "'ah' modifier applied to %s", typestr); 5049 5050 case Q_ESP: 5051 bpf_error(cstate, "'esp' modifier applied to %s", typestr); 5052 5053 case Q_PIM: 5054 bpf_error(cstate, "'pim' modifier applied to %s", typestr); 5055 5056 case Q_VRRP: 5057 bpf_error(cstate, "'vrrp' modifier applied to %s", typestr); 5058 5059 case Q_AARP: 5060 bpf_error(cstate, "AARP host filtering not implemented"); 5061 5062 case Q_ISO: 5063 bpf_error(cstate, "ISO host filtering not implemented"); 5064 5065 case Q_ESIS: 5066 bpf_error(cstate, "'esis' modifier applied to %s", typestr); 5067 5068 case Q_ISIS: 5069 bpf_error(cstate, "'isis' modifier applied to %s", typestr); 5070 5071 case Q_CLNP: 5072 bpf_error(cstate, "'clnp' modifier applied to %s", typestr); 5073 5074 case Q_STP: 5075 bpf_error(cstate, "'stp' modifier applied to %s", typestr); 5076 5077 case Q_IPX: 5078 bpf_error(cstate, "IPX host filtering not implemented"); 5079 5080 case Q_NETBEUI: 5081 bpf_error(cstate, "'netbeui' modifier applied to %s", typestr); 5082 5083 case Q_ISIS_L1: 5084 bpf_error(cstate, "'l1' modifier applied to %s", typestr); 5085 5086 case Q_ISIS_L2: 5087 bpf_error(cstate, "'l2' modifier applied to %s", typestr); 5088 5089 case Q_ISIS_IIH: 5090 bpf_error(cstate, "'iih' modifier applied to %s", typestr); 5091 5092 case Q_ISIS_SNP: 5093 bpf_error(cstate, "'snp' modifier applied to %s", typestr); 5094 5095 case Q_ISIS_CSNP: 5096 bpf_error(cstate, "'csnp' modifier applied to %s", typestr); 5097 5098 case Q_ISIS_PSNP: 5099 bpf_error(cstate, "'psnp' modifier applied to %s", typestr); 5100 5101 case Q_ISIS_LSP: 5102 bpf_error(cstate, "'lsp' modifier applied to %s", typestr); 5103 5104 case Q_RADIO: 5105 bpf_error(cstate, "'radio' modifier applied to %s", typestr); 5106 5107 case Q_CARP: 5108 bpf_error(cstate, "'carp' modifier applied to %s", typestr); 5109 5110 default: 5111 abort(); 5112 } 5113 /*NOTREACHED*/ 5114 } 5115 5116 #ifdef INET6 5117 static struct block * 5118 gen_host6(compiler_state_t *cstate, struct in6_addr *addr, 5119 struct in6_addr *mask, int proto, int dir, int type) 5120 { 5121 const char *typestr; 5122 5123 if (type == Q_NET) 5124 typestr = "net"; 5125 else 5126 typestr = "host"; 5127 5128 switch (proto) { 5129 5130 case Q_DEFAULT: 5131 return gen_host6(cstate, addr, mask, Q_IPV6, dir, type); 5132 5133 case Q_LINK: 5134 bpf_error(cstate, "link-layer modifier applied to ip6 %s", typestr); 5135 5136 case Q_IP: 5137 bpf_error(cstate, "'ip' modifier applied to ip6 %s", typestr); 5138 5139 case Q_RARP: 5140 bpf_error(cstate, "'rarp' modifier applied to ip6 %s", typestr); 5141 5142 case Q_ARP: 5143 bpf_error(cstate, "'arp' modifier applied to ip6 %s", typestr); 5144 5145 case Q_SCTP: 5146 bpf_error(cstate, "'sctp' modifier applied to ip6 %s", typestr); 5147 5148 case Q_TCP: 5149 bpf_error(cstate, "'tcp' modifier applied to ip6 %s", typestr); 5150 5151 case Q_UDP: 5152 bpf_error(cstate, "'udp' modifier applied to ip6 %s", typestr); 5153 5154 case Q_ICMP: 5155 bpf_error(cstate, "'icmp' modifier applied to ip6 %s", typestr); 5156 5157 case Q_IGMP: 5158 bpf_error(cstate, "'igmp' modifier applied to ip6 %s", typestr); 5159 5160 case Q_IGRP: 5161 bpf_error(cstate, "'igrp' modifier applied to ip6 %s", typestr); 5162 5163 case Q_ATALK: 5164 bpf_error(cstate, "AppleTalk modifier applied to ip6 %s", typestr); 5165 5166 case Q_DECNET: 5167 bpf_error(cstate, "'decnet' modifier applied to ip6 %s", typestr); 5168 5169 case Q_LAT: 5170 bpf_error(cstate, "'lat' modifier applied to ip6 %s", typestr); 5171 5172 case Q_SCA: 5173 bpf_error(cstate, "'sca' modifier applied to ip6 %s", typestr); 5174 5175 case Q_MOPRC: 5176 bpf_error(cstate, "'moprc' modifier applied to ip6 %s", typestr); 5177 5178 case Q_MOPDL: 5179 bpf_error(cstate, "'mopdl' modifier applied to ip6 %s", typestr); 5180 5181 case Q_IPV6: 5182 return gen_hostop6(cstate, addr, mask, dir, ETHERTYPE_IPV6, 8, 24); 5183 5184 case Q_ICMPV6: 5185 bpf_error(cstate, "'icmp6' modifier applied to ip6 %s", typestr); 5186 5187 case Q_AH: 5188 bpf_error(cstate, "'ah' modifier applied to ip6 %s", typestr); 5189 5190 case Q_ESP: 5191 bpf_error(cstate, "'esp' modifier applied to ip6 %s", typestr); 5192 5193 case Q_PIM: 5194 bpf_error(cstate, "'pim' modifier applied to ip6 %s", typestr); 5195 5196 case Q_VRRP: 5197 bpf_error(cstate, "'vrrp' modifier applied to ip6 %s", typestr); 5198 5199 case Q_AARP: 5200 bpf_error(cstate, "'aarp' modifier applied to ip6 %s", typestr); 5201 5202 case Q_ISO: 5203 bpf_error(cstate, "'iso' modifier applied to ip6 %s", typestr); 5204 5205 case Q_ESIS: 5206 bpf_error(cstate, "'esis' modifier applied to ip6 %s", typestr); 5207 5208 case Q_ISIS: 5209 bpf_error(cstate, "'isis' modifier applied to ip6 %s", typestr); 5210 5211 case Q_CLNP: 5212 bpf_error(cstate, "'clnp' modifier applied to ip6 %s", typestr); 5213 5214 case Q_STP: 5215 bpf_error(cstate, "'stp' modifier applied to ip6 %s", typestr); 5216 5217 case Q_IPX: 5218 bpf_error(cstate, "'ipx' modifier applied to ip6 %s", typestr); 5219 5220 case Q_NETBEUI: 5221 bpf_error(cstate, "'netbeui' modifier applied to ip6 %s", typestr); 5222 5223 case Q_ISIS_L1: 5224 bpf_error(cstate, "'l1' modifier applied to ip6 %s", typestr); 5225 5226 case Q_ISIS_L2: 5227 bpf_error(cstate, "'l2' modifier applied to ip6 %s", typestr); 5228 5229 case Q_ISIS_IIH: 5230 bpf_error(cstate, "'iih' modifier applied to ip6 %s", typestr); 5231 5232 case Q_ISIS_SNP: 5233 bpf_error(cstate, "'snp' modifier applied to ip6 %s", typestr); 5234 5235 case Q_ISIS_CSNP: 5236 bpf_error(cstate, "'csnp' modifier applied to ip6 %s", typestr); 5237 5238 case Q_ISIS_PSNP: 5239 bpf_error(cstate, "'psnp' modifier applied to ip6 %s", typestr); 5240 5241 case Q_ISIS_LSP: 5242 bpf_error(cstate, "'lsp' modifier applied to ip6 %s", typestr); 5243 5244 case Q_RADIO: 5245 bpf_error(cstate, "'radio' modifier applied to ip6 %s", typestr); 5246 5247 case Q_CARP: 5248 bpf_error(cstate, "'carp' modifier applied to ip6 %s", typestr); 5249 5250 default: 5251 abort(); 5252 } 5253 /*NOTREACHED*/ 5254 } 5255 #endif 5256 5257 #ifndef INET6 5258 static struct block * 5259 gen_gateway(compiler_state_t *cstate, const u_char *eaddr, 5260 struct addrinfo *alist, int proto, int dir) 5261 { 5262 struct block *b0, *b1, *tmp; 5263 struct addrinfo *ai; 5264 struct sockaddr_in *sin; 5265 5266 if (dir != 0) 5267 bpf_error(cstate, "direction applied to 'gateway'"); 5268 5269 switch (proto) { 5270 case Q_DEFAULT: 5271 case Q_IP: 5272 case Q_ARP: 5273 case Q_RARP: 5274 switch (cstate->linktype) { 5275 case DLT_EN10MB: 5276 case DLT_NETANALYZER: 5277 case DLT_NETANALYZER_TRANSPARENT: 5278 b1 = gen_prevlinkhdr_check(cstate); 5279 b0 = gen_ehostop(cstate, eaddr, Q_OR); 5280 if (b1 != NULL) 5281 gen_and(b1, b0); 5282 break; 5283 case DLT_FDDI: 5284 b0 = gen_fhostop(cstate, eaddr, Q_OR); 5285 break; 5286 case DLT_IEEE802: 5287 b0 = gen_thostop(cstate, eaddr, Q_OR); 5288 break; 5289 case DLT_IEEE802_11: 5290 case DLT_PRISM_HEADER: 5291 case DLT_IEEE802_11_RADIO_AVS: 5292 case DLT_IEEE802_11_RADIO: 5293 case DLT_PPI: 5294 b0 = gen_wlanhostop(cstate, eaddr, Q_OR); 5295 break; 5296 case DLT_SUNATM: 5297 /* 5298 * This is LLC-multiplexed traffic; if it were 5299 * LANE, cstate->linktype would have been set to 5300 * DLT_EN10MB. 5301 */ 5302 bpf_error(cstate, 5303 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 5304 case DLT_IP_OVER_FC: 5305 b0 = gen_ipfchostop(cstate, eaddr, Q_OR); 5306 break; 5307 default: 5308 bpf_error(cstate, 5309 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 5310 } 5311 b1 = NULL; 5312 for (ai = alist; ai != NULL; ai = ai->ai_next) { 5313 /* 5314 * Does it have an address? 5315 */ 5316 if (ai->ai_addr != NULL) { 5317 /* 5318 * Yes. Is it an IPv4 address? 5319 */ 5320 if (ai->ai_addr->sa_family == AF_INET) { 5321 /* 5322 * Generate an entry for it. 5323 */ 5324 sin = (struct sockaddr_in *)ai->ai_addr; 5325 tmp = gen_host(cstate, 5326 ntohl(sin->sin_addr.s_addr), 5327 0xffffffff, proto, Q_OR, Q_HOST); 5328 /* 5329 * Is it the *first* IPv4 address? 5330 */ 5331 if (b1 == NULL) { 5332 /* 5333 * Yes, so start with it. 5334 */ 5335 b1 = tmp; 5336 } else { 5337 /* 5338 * No, so OR it into the 5339 * existing set of 5340 * addresses. 5341 */ 5342 gen_or(b1, tmp); 5343 b1 = tmp; 5344 } 5345 } 5346 } 5347 } 5348 if (b1 == NULL) { 5349 /* 5350 * No IPv4 addresses found. 5351 */ 5352 return (NULL); 5353 } 5354 gen_not(b1); 5355 gen_and(b0, b1); 5356 return b1; 5357 } 5358 bpf_error(cstate, "illegal modifier of 'gateway'"); 5359 /*NOTREACHED*/ 5360 } 5361 #endif 5362 5363 static struct block * 5364 gen_proto_abbrev_internal(compiler_state_t *cstate, int proto) 5365 { 5366 struct block *b0; 5367 struct block *b1; 5368 5369 switch (proto) { 5370 5371 case Q_SCTP: 5372 b1 = gen_proto(cstate, IPPROTO_SCTP, Q_DEFAULT, Q_DEFAULT); 5373 break; 5374 5375 case Q_TCP: 5376 b1 = gen_proto(cstate, IPPROTO_TCP, Q_DEFAULT, Q_DEFAULT); 5377 break; 5378 5379 case Q_UDP: 5380 b1 = gen_proto(cstate, IPPROTO_UDP, Q_DEFAULT, Q_DEFAULT); 5381 break; 5382 5383 case Q_ICMP: 5384 b1 = gen_proto(cstate, IPPROTO_ICMP, Q_IP, Q_DEFAULT); 5385 break; 5386 5387 #ifndef IPPROTO_IGMP 5388 #define IPPROTO_IGMP 2 5389 #endif 5390 5391 case Q_IGMP: 5392 b1 = gen_proto(cstate, IPPROTO_IGMP, Q_IP, Q_DEFAULT); 5393 break; 5394 5395 #ifndef IPPROTO_IGRP 5396 #define IPPROTO_IGRP 9 5397 #endif 5398 case Q_IGRP: 5399 b1 = gen_proto(cstate, IPPROTO_IGRP, Q_IP, Q_DEFAULT); 5400 break; 5401 5402 #ifndef IPPROTO_PIM 5403 #define IPPROTO_PIM 103 5404 #endif 5405 5406 case Q_PIM: 5407 b1 = gen_proto(cstate, IPPROTO_PIM, Q_DEFAULT, Q_DEFAULT); 5408 break; 5409 5410 #ifndef IPPROTO_VRRP 5411 #define IPPROTO_VRRP 112 5412 #endif 5413 5414 case Q_VRRP: 5415 b1 = gen_proto(cstate, IPPROTO_VRRP, Q_IP, Q_DEFAULT); 5416 break; 5417 5418 #ifndef IPPROTO_CARP 5419 #define IPPROTO_CARP 112 5420 #endif 5421 5422 case Q_CARP: 5423 b1 = gen_proto(cstate, IPPROTO_CARP, Q_IP, Q_DEFAULT); 5424 break; 5425 5426 case Q_IP: 5427 b1 = gen_linktype(cstate, ETHERTYPE_IP); 5428 break; 5429 5430 case Q_ARP: 5431 b1 = gen_linktype(cstate, ETHERTYPE_ARP); 5432 break; 5433 5434 case Q_RARP: 5435 b1 = gen_linktype(cstate, ETHERTYPE_REVARP); 5436 break; 5437 5438 case Q_LINK: 5439 bpf_error(cstate, "link layer applied in wrong context"); 5440 5441 case Q_ATALK: 5442 b1 = gen_linktype(cstate, ETHERTYPE_ATALK); 5443 break; 5444 5445 case Q_AARP: 5446 b1 = gen_linktype(cstate, ETHERTYPE_AARP); 5447 break; 5448 5449 case Q_DECNET: 5450 b1 = gen_linktype(cstate, ETHERTYPE_DN); 5451 break; 5452 5453 case Q_SCA: 5454 b1 = gen_linktype(cstate, ETHERTYPE_SCA); 5455 break; 5456 5457 case Q_LAT: 5458 b1 = gen_linktype(cstate, ETHERTYPE_LAT); 5459 break; 5460 5461 case Q_MOPDL: 5462 b1 = gen_linktype(cstate, ETHERTYPE_MOPDL); 5463 break; 5464 5465 case Q_MOPRC: 5466 b1 = gen_linktype(cstate, ETHERTYPE_MOPRC); 5467 break; 5468 5469 case Q_IPV6: 5470 b1 = gen_linktype(cstate, ETHERTYPE_IPV6); 5471 break; 5472 5473 #ifndef IPPROTO_ICMPV6 5474 #define IPPROTO_ICMPV6 58 5475 #endif 5476 case Q_ICMPV6: 5477 b1 = gen_proto(cstate, IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 5478 break; 5479 5480 #ifndef IPPROTO_AH 5481 #define IPPROTO_AH 51 5482 #endif 5483 case Q_AH: 5484 b1 = gen_proto(cstate, IPPROTO_AH, Q_DEFAULT, Q_DEFAULT); 5485 break; 5486 5487 #ifndef IPPROTO_ESP 5488 #define IPPROTO_ESP 50 5489 #endif 5490 case Q_ESP: 5491 b1 = gen_proto(cstate, IPPROTO_ESP, Q_DEFAULT, Q_DEFAULT); 5492 break; 5493 5494 case Q_ISO: 5495 b1 = gen_linktype(cstate, LLCSAP_ISONS); 5496 break; 5497 5498 case Q_ESIS: 5499 b1 = gen_proto(cstate, ISO9542_ESIS, Q_ISO, Q_DEFAULT); 5500 break; 5501 5502 case Q_ISIS: 5503 b1 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT); 5504 break; 5505 5506 case Q_ISIS_L1: /* all IS-IS Level1 PDU-Types */ 5507 b0 = gen_proto(cstate, ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 5508 b1 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 5509 gen_or(b0, b1); 5510 b0 = gen_proto(cstate, ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 5511 gen_or(b0, b1); 5512 b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 5513 gen_or(b0, b1); 5514 b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 5515 gen_or(b0, b1); 5516 break; 5517 5518 case Q_ISIS_L2: /* all IS-IS Level2 PDU-Types */ 5519 b0 = gen_proto(cstate, ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 5520 b1 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 5521 gen_or(b0, b1); 5522 b0 = gen_proto(cstate, ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 5523 gen_or(b0, b1); 5524 b0 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 5525 gen_or(b0, b1); 5526 b0 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 5527 gen_or(b0, b1); 5528 break; 5529 5530 case Q_ISIS_IIH: /* all IS-IS Hello PDU-Types */ 5531 b0 = gen_proto(cstate, ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 5532 b1 = gen_proto(cstate, ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 5533 gen_or(b0, b1); 5534 b0 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); 5535 gen_or(b0, b1); 5536 break; 5537 5538 case Q_ISIS_LSP: 5539 b0 = gen_proto(cstate, ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 5540 b1 = gen_proto(cstate, ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 5541 gen_or(b0, b1); 5542 break; 5543 5544 case Q_ISIS_SNP: 5545 b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 5546 b1 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 5547 gen_or(b0, b1); 5548 b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 5549 gen_or(b0, b1); 5550 b0 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 5551 gen_or(b0, b1); 5552 break; 5553 5554 case Q_ISIS_CSNP: 5555 b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 5556 b1 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 5557 gen_or(b0, b1); 5558 break; 5559 5560 case Q_ISIS_PSNP: 5561 b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 5562 b1 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 5563 gen_or(b0, b1); 5564 break; 5565 5566 case Q_CLNP: 5567 b1 = gen_proto(cstate, ISO8473_CLNP, Q_ISO, Q_DEFAULT); 5568 break; 5569 5570 case Q_STP: 5571 b1 = gen_linktype(cstate, LLCSAP_8021D); 5572 break; 5573 5574 case Q_IPX: 5575 b1 = gen_linktype(cstate, LLCSAP_IPX); 5576 break; 5577 5578 case Q_NETBEUI: 5579 b1 = gen_linktype(cstate, LLCSAP_NETBEUI); 5580 break; 5581 5582 case Q_RADIO: 5583 bpf_error(cstate, "'radio' is not a valid protocol type"); 5584 5585 default: 5586 abort(); 5587 } 5588 return b1; 5589 } 5590 5591 struct block * 5592 gen_proto_abbrev(compiler_state_t *cstate, int proto) 5593 { 5594 /* 5595 * Catch errors reported by us and routines below us, and return NULL 5596 * on an error. 5597 */ 5598 if (setjmp(cstate->top_ctx)) 5599 return (NULL); 5600 5601 return gen_proto_abbrev_internal(cstate, proto); 5602 } 5603 5604 static struct block * 5605 gen_ipfrag(compiler_state_t *cstate) 5606 { 5607 struct slist *s; 5608 struct block *b; 5609 5610 /* not IPv4 frag other than the first frag */ 5611 s = gen_load_a(cstate, OR_LINKPL, 6, BPF_H); 5612 b = new_block(cstate, JMP(BPF_JSET)); 5613 b->s.k = 0x1fff; 5614 b->stmts = s; 5615 gen_not(b); 5616 5617 return b; 5618 } 5619 5620 /* 5621 * Generate a comparison to a port value in the transport-layer header 5622 * at the specified offset from the beginning of that header. 5623 * 5624 * XXX - this handles a variable-length prefix preceding the link-layer 5625 * header, such as the radiotap or AVS radio prefix, but doesn't handle 5626 * variable-length link-layer headers (such as Token Ring or 802.11 5627 * headers). 5628 */ 5629 static struct block * 5630 gen_portatom(compiler_state_t *cstate, int off, bpf_u_int32 v) 5631 { 5632 return gen_cmp(cstate, OR_TRAN_IPV4, off, BPF_H, v); 5633 } 5634 5635 static struct block * 5636 gen_portatom6(compiler_state_t *cstate, int off, bpf_u_int32 v) 5637 { 5638 return gen_cmp(cstate, OR_TRAN_IPV6, off, BPF_H, v); 5639 } 5640 5641 static struct block * 5642 gen_portop(compiler_state_t *cstate, u_int port, u_int proto, int dir) 5643 { 5644 struct block *b0, *b1, *tmp; 5645 5646 /* ip proto 'proto' and not a fragment other than the first fragment */ 5647 tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, proto); 5648 b0 = gen_ipfrag(cstate); 5649 gen_and(tmp, b0); 5650 5651 switch (dir) { 5652 case Q_SRC: 5653 b1 = gen_portatom(cstate, 0, port); 5654 break; 5655 5656 case Q_DST: 5657 b1 = gen_portatom(cstate, 2, port); 5658 break; 5659 5660 case Q_AND: 5661 tmp = gen_portatom(cstate, 0, port); 5662 b1 = gen_portatom(cstate, 2, port); 5663 gen_and(tmp, b1); 5664 break; 5665 5666 case Q_DEFAULT: 5667 case Q_OR: 5668 tmp = gen_portatom(cstate, 0, port); 5669 b1 = gen_portatom(cstate, 2, port); 5670 gen_or(tmp, b1); 5671 break; 5672 5673 case Q_ADDR1: 5674 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for ports"); 5675 /*NOTREACHED*/ 5676 5677 case Q_ADDR2: 5678 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for ports"); 5679 /*NOTREACHED*/ 5680 5681 case Q_ADDR3: 5682 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for ports"); 5683 /*NOTREACHED*/ 5684 5685 case Q_ADDR4: 5686 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for ports"); 5687 /*NOTREACHED*/ 5688 5689 case Q_RA: 5690 bpf_error(cstate, "'ra' is not a valid qualifier for ports"); 5691 /*NOTREACHED*/ 5692 5693 case Q_TA: 5694 bpf_error(cstate, "'ta' is not a valid qualifier for ports"); 5695 /*NOTREACHED*/ 5696 5697 default: 5698 abort(); 5699 /*NOTREACHED*/ 5700 } 5701 gen_and(b0, b1); 5702 5703 return b1; 5704 } 5705 5706 static struct block * 5707 gen_port(compiler_state_t *cstate, u_int port, int ip_proto, int dir) 5708 { 5709 struct block *b0, *b1, *tmp; 5710 5711 /* 5712 * ether proto ip 5713 * 5714 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 5715 * not LLC encapsulation with LLCSAP_IP. 5716 * 5717 * For IEEE 802 networks - which includes 802.5 token ring 5718 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 5719 * says that SNAP encapsulation is used, not LLC encapsulation 5720 * with LLCSAP_IP. 5721 * 5722 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 5723 * RFC 2225 say that SNAP encapsulation is used, not LLC 5724 * encapsulation with LLCSAP_IP. 5725 * 5726 * So we always check for ETHERTYPE_IP. 5727 */ 5728 b0 = gen_linktype(cstate, ETHERTYPE_IP); 5729 5730 switch (ip_proto) { 5731 case IPPROTO_UDP: 5732 case IPPROTO_TCP: 5733 case IPPROTO_SCTP: 5734 b1 = gen_portop(cstate, port, (u_int)ip_proto, dir); 5735 break; 5736 5737 case PROTO_UNDEF: 5738 tmp = gen_portop(cstate, port, IPPROTO_TCP, dir); 5739 b1 = gen_portop(cstate, port, IPPROTO_UDP, dir); 5740 gen_or(tmp, b1); 5741 tmp = gen_portop(cstate, port, IPPROTO_SCTP, dir); 5742 gen_or(tmp, b1); 5743 break; 5744 5745 default: 5746 abort(); 5747 } 5748 gen_and(b0, b1); 5749 return b1; 5750 } 5751 5752 struct block * 5753 gen_portop6(compiler_state_t *cstate, u_int port, u_int proto, int dir) 5754 { 5755 struct block *b0, *b1, *tmp; 5756 5757 /* ip6 proto 'proto' */ 5758 /* XXX - catch the first fragment of a fragmented packet? */ 5759 b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, proto); 5760 5761 switch (dir) { 5762 case Q_SRC: 5763 b1 = gen_portatom6(cstate, 0, port); 5764 break; 5765 5766 case Q_DST: 5767 b1 = gen_portatom6(cstate, 2, port); 5768 break; 5769 5770 case Q_AND: 5771 tmp = gen_portatom6(cstate, 0, port); 5772 b1 = gen_portatom6(cstate, 2, port); 5773 gen_and(tmp, b1); 5774 break; 5775 5776 case Q_DEFAULT: 5777 case Q_OR: 5778 tmp = gen_portatom6(cstate, 0, port); 5779 b1 = gen_portatom6(cstate, 2, port); 5780 gen_or(tmp, b1); 5781 break; 5782 5783 default: 5784 abort(); 5785 } 5786 gen_and(b0, b1); 5787 5788 return b1; 5789 } 5790 5791 static struct block * 5792 gen_port6(compiler_state_t *cstate, u_int port, int ip_proto, int dir) 5793 { 5794 struct block *b0, *b1, *tmp; 5795 5796 /* link proto ip6 */ 5797 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 5798 5799 switch (ip_proto) { 5800 case IPPROTO_UDP: 5801 case IPPROTO_TCP: 5802 case IPPROTO_SCTP: 5803 b1 = gen_portop6(cstate, port, (u_int)ip_proto, dir); 5804 break; 5805 5806 case PROTO_UNDEF: 5807 tmp = gen_portop6(cstate, port, IPPROTO_TCP, dir); 5808 b1 = gen_portop6(cstate, port, IPPROTO_UDP, dir); 5809 gen_or(tmp, b1); 5810 tmp = gen_portop6(cstate, port, IPPROTO_SCTP, dir); 5811 gen_or(tmp, b1); 5812 break; 5813 5814 default: 5815 abort(); 5816 } 5817 gen_and(b0, b1); 5818 return b1; 5819 } 5820 5821 /* gen_portrange code */ 5822 static struct block * 5823 gen_portrangeatom(compiler_state_t *cstate, u_int off, bpf_u_int32 v1, 5824 bpf_u_int32 v2) 5825 { 5826 struct block *b1, *b2; 5827 5828 if (v1 > v2) { 5829 /* 5830 * Reverse the order of the ports, so v1 is the lower one. 5831 */ 5832 bpf_u_int32 vtemp; 5833 5834 vtemp = v1; 5835 v1 = v2; 5836 v2 = vtemp; 5837 } 5838 5839 b1 = gen_cmp_ge(cstate, OR_TRAN_IPV4, off, BPF_H, v1); 5840 b2 = gen_cmp_le(cstate, OR_TRAN_IPV4, off, BPF_H, v2); 5841 5842 gen_and(b1, b2); 5843 5844 return b2; 5845 } 5846 5847 static struct block * 5848 gen_portrangeop(compiler_state_t *cstate, u_int port1, u_int port2, 5849 bpf_u_int32 proto, int dir) 5850 { 5851 struct block *b0, *b1, *tmp; 5852 5853 /* ip proto 'proto' and not a fragment other than the first fragment */ 5854 tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, proto); 5855 b0 = gen_ipfrag(cstate); 5856 gen_and(tmp, b0); 5857 5858 switch (dir) { 5859 case Q_SRC: 5860 b1 = gen_portrangeatom(cstate, 0, port1, port2); 5861 break; 5862 5863 case Q_DST: 5864 b1 = gen_portrangeatom(cstate, 2, port1, port2); 5865 break; 5866 5867 case Q_AND: 5868 tmp = gen_portrangeatom(cstate, 0, port1, port2); 5869 b1 = gen_portrangeatom(cstate, 2, port1, port2); 5870 gen_and(tmp, b1); 5871 break; 5872 5873 case Q_DEFAULT: 5874 case Q_OR: 5875 tmp = gen_portrangeatom(cstate, 0, port1, port2); 5876 b1 = gen_portrangeatom(cstate, 2, port1, port2); 5877 gen_or(tmp, b1); 5878 break; 5879 5880 case Q_ADDR1: 5881 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for port ranges"); 5882 /*NOTREACHED*/ 5883 5884 case Q_ADDR2: 5885 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for port ranges"); 5886 /*NOTREACHED*/ 5887 5888 case Q_ADDR3: 5889 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for port ranges"); 5890 /*NOTREACHED*/ 5891 5892 case Q_ADDR4: 5893 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for port ranges"); 5894 /*NOTREACHED*/ 5895 5896 case Q_RA: 5897 bpf_error(cstate, "'ra' is not a valid qualifier for port ranges"); 5898 /*NOTREACHED*/ 5899 5900 case Q_TA: 5901 bpf_error(cstate, "'ta' is not a valid qualifier for port ranges"); 5902 /*NOTREACHED*/ 5903 5904 default: 5905 abort(); 5906 /*NOTREACHED*/ 5907 } 5908 gen_and(b0, b1); 5909 5910 return b1; 5911 } 5912 5913 static struct block * 5914 gen_portrange(compiler_state_t *cstate, u_int port1, u_int port2, int ip_proto, 5915 int dir) 5916 { 5917 struct block *b0, *b1, *tmp; 5918 5919 /* link proto ip */ 5920 b0 = gen_linktype(cstate, ETHERTYPE_IP); 5921 5922 switch (ip_proto) { 5923 case IPPROTO_UDP: 5924 case IPPROTO_TCP: 5925 case IPPROTO_SCTP: 5926 b1 = gen_portrangeop(cstate, port1, port2, (bpf_u_int32)ip_proto, 5927 dir); 5928 break; 5929 5930 case PROTO_UNDEF: 5931 tmp = gen_portrangeop(cstate, port1, port2, IPPROTO_TCP, dir); 5932 b1 = gen_portrangeop(cstate, port1, port2, IPPROTO_UDP, dir); 5933 gen_or(tmp, b1); 5934 tmp = gen_portrangeop(cstate, port1, port2, IPPROTO_SCTP, dir); 5935 gen_or(tmp, b1); 5936 break; 5937 5938 default: 5939 abort(); 5940 } 5941 gen_and(b0, b1); 5942 return b1; 5943 } 5944 5945 static struct block * 5946 gen_portrangeatom6(compiler_state_t *cstate, u_int off, bpf_u_int32 v1, 5947 bpf_u_int32 v2) 5948 { 5949 struct block *b1, *b2; 5950 5951 if (v1 > v2) { 5952 /* 5953 * Reverse the order of the ports, so v1 is the lower one. 5954 */ 5955 bpf_u_int32 vtemp; 5956 5957 vtemp = v1; 5958 v1 = v2; 5959 v2 = vtemp; 5960 } 5961 5962 b1 = gen_cmp_ge(cstate, OR_TRAN_IPV6, off, BPF_H, v1); 5963 b2 = gen_cmp_le(cstate, OR_TRAN_IPV6, off, BPF_H, v2); 5964 5965 gen_and(b1, b2); 5966 5967 return b2; 5968 } 5969 5970 static struct block * 5971 gen_portrangeop6(compiler_state_t *cstate, u_int port1, u_int port2, 5972 bpf_u_int32 proto, int dir) 5973 { 5974 struct block *b0, *b1, *tmp; 5975 5976 /* ip6 proto 'proto' */ 5977 /* XXX - catch the first fragment of a fragmented packet? */ 5978 b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, proto); 5979 5980 switch (dir) { 5981 case Q_SRC: 5982 b1 = gen_portrangeatom6(cstate, 0, port1, port2); 5983 break; 5984 5985 case Q_DST: 5986 b1 = gen_portrangeatom6(cstate, 2, port1, port2); 5987 break; 5988 5989 case Q_AND: 5990 tmp = gen_portrangeatom6(cstate, 0, port1, port2); 5991 b1 = gen_portrangeatom6(cstate, 2, port1, port2); 5992 gen_and(tmp, b1); 5993 break; 5994 5995 case Q_DEFAULT: 5996 case Q_OR: 5997 tmp = gen_portrangeatom6(cstate, 0, port1, port2); 5998 b1 = gen_portrangeatom6(cstate, 2, port1, port2); 5999 gen_or(tmp, b1); 6000 break; 6001 6002 default: 6003 abort(); 6004 } 6005 gen_and(b0, b1); 6006 6007 return b1; 6008 } 6009 6010 static struct block * 6011 gen_portrange6(compiler_state_t *cstate, u_int port1, u_int port2, int ip_proto, 6012 int dir) 6013 { 6014 struct block *b0, *b1, *tmp; 6015 6016 /* link proto ip6 */ 6017 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 6018 6019 switch (ip_proto) { 6020 case IPPROTO_UDP: 6021 case IPPROTO_TCP: 6022 case IPPROTO_SCTP: 6023 b1 = gen_portrangeop6(cstate, port1, port2, (bpf_u_int32)ip_proto, 6024 dir); 6025 break; 6026 6027 case PROTO_UNDEF: 6028 tmp = gen_portrangeop6(cstate, port1, port2, IPPROTO_TCP, dir); 6029 b1 = gen_portrangeop6(cstate, port1, port2, IPPROTO_UDP, dir); 6030 gen_or(tmp, b1); 6031 tmp = gen_portrangeop6(cstate, port1, port2, IPPROTO_SCTP, dir); 6032 gen_or(tmp, b1); 6033 break; 6034 6035 default: 6036 abort(); 6037 } 6038 gen_and(b0, b1); 6039 return b1; 6040 } 6041 6042 static int 6043 lookup_proto(compiler_state_t *cstate, const char *name, int proto) 6044 { 6045 register int v; 6046 6047 switch (proto) { 6048 6049 case Q_DEFAULT: 6050 case Q_IP: 6051 case Q_IPV6: 6052 v = pcap_nametoproto(name); 6053 if (v == PROTO_UNDEF) 6054 bpf_error(cstate, "unknown ip proto '%s'", name); 6055 break; 6056 6057 case Q_LINK: 6058 /* XXX should look up h/w protocol type based on cstate->linktype */ 6059 v = pcap_nametoeproto(name); 6060 if (v == PROTO_UNDEF) { 6061 v = pcap_nametollc(name); 6062 if (v == PROTO_UNDEF) 6063 bpf_error(cstate, "unknown ether proto '%s'", name); 6064 } 6065 break; 6066 6067 case Q_ISO: 6068 if (strcmp(name, "esis") == 0) 6069 v = ISO9542_ESIS; 6070 else if (strcmp(name, "isis") == 0) 6071 v = ISO10589_ISIS; 6072 else if (strcmp(name, "clnp") == 0) 6073 v = ISO8473_CLNP; 6074 else 6075 bpf_error(cstate, "unknown osi proto '%s'", name); 6076 break; 6077 6078 default: 6079 v = PROTO_UNDEF; 6080 break; 6081 } 6082 return v; 6083 } 6084 6085 #if !defined(NO_PROTOCHAIN) 6086 static struct block * 6087 gen_protochain(compiler_state_t *cstate, bpf_u_int32 v, int proto) 6088 { 6089 struct block *b0, *b; 6090 struct slist *s[100]; 6091 int fix2, fix3, fix4, fix5; 6092 int ahcheck, again, end; 6093 int i, max; 6094 int reg2 = alloc_reg(cstate); 6095 6096 memset(s, 0, sizeof(s)); 6097 fix3 = fix4 = fix5 = 0; 6098 6099 switch (proto) { 6100 case Q_IP: 6101 case Q_IPV6: 6102 break; 6103 case Q_DEFAULT: 6104 b0 = gen_protochain(cstate, v, Q_IP); 6105 b = gen_protochain(cstate, v, Q_IPV6); 6106 gen_or(b0, b); 6107 return b; 6108 default: 6109 bpf_error(cstate, "bad protocol applied for 'protochain'"); 6110 /*NOTREACHED*/ 6111 } 6112 6113 /* 6114 * We don't handle variable-length prefixes before the link-layer 6115 * header, or variable-length link-layer headers, here yet. 6116 * We might want to add BPF instructions to do the protochain 6117 * work, to simplify that and, on platforms that have a BPF 6118 * interpreter with the new instructions, let the filtering 6119 * be done in the kernel. (We already require a modified BPF 6120 * engine to do the protochain stuff, to support backward 6121 * branches, and backward branch support is unlikely to appear 6122 * in kernel BPF engines.) 6123 */ 6124 if (cstate->off_linkpl.is_variable) 6125 bpf_error(cstate, "'protochain' not supported with variable length headers"); 6126 6127 /* 6128 * To quote a comment in optimize.c: 6129 * 6130 * "These data structures are used in a Cocke and Schwartz style 6131 * value numbering scheme. Since the flowgraph is acyclic, 6132 * exit values can be propagated from a node's predecessors 6133 * provided it is uniquely defined." 6134 * 6135 * "Acyclic" means "no backward branches", which means "no 6136 * loops", so we have to turn the optimizer off. 6137 */ 6138 cstate->no_optimize = 1; 6139 6140 /* 6141 * s[0] is a dummy entry to protect other BPF insn from damage 6142 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 6143 * hard to find interdependency made by jump table fixup. 6144 */ 6145 i = 0; 6146 s[i] = new_stmt(cstate, 0); /*dummy*/ 6147 i++; 6148 6149 switch (proto) { 6150 case Q_IP: 6151 b0 = gen_linktype(cstate, ETHERTYPE_IP); 6152 6153 /* A = ip->ip_p */ 6154 s[i] = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 6155 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 9; 6156 i++; 6157 /* X = ip->ip_hl << 2 */ 6158 s[i] = new_stmt(cstate, BPF_LDX|BPF_MSH|BPF_B); 6159 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 6160 i++; 6161 break; 6162 6163 case Q_IPV6: 6164 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 6165 6166 /* A = ip6->ip_nxt */ 6167 s[i] = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 6168 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 6; 6169 i++; 6170 /* X = sizeof(struct ip6_hdr) */ 6171 s[i] = new_stmt(cstate, BPF_LDX|BPF_IMM); 6172 s[i]->s.k = 40; 6173 i++; 6174 break; 6175 6176 default: 6177 bpf_error(cstate, "unsupported proto to gen_protochain"); 6178 /*NOTREACHED*/ 6179 } 6180 6181 /* again: if (A == v) goto end; else fall through; */ 6182 again = i; 6183 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6184 s[i]->s.k = v; 6185 s[i]->s.jt = NULL; /*later*/ 6186 s[i]->s.jf = NULL; /*update in next stmt*/ 6187 fix5 = i; 6188 i++; 6189 6190 #ifndef IPPROTO_NONE 6191 #define IPPROTO_NONE 59 6192 #endif 6193 /* if (A == IPPROTO_NONE) goto end */ 6194 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6195 s[i]->s.jt = NULL; /*later*/ 6196 s[i]->s.jf = NULL; /*update in next stmt*/ 6197 s[i]->s.k = IPPROTO_NONE; 6198 s[fix5]->s.jf = s[i]; 6199 fix2 = i; 6200 i++; 6201 6202 if (proto == Q_IPV6) { 6203 int v6start, v6end, v6advance, j; 6204 6205 v6start = i; 6206 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 6207 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6208 s[i]->s.jt = NULL; /*later*/ 6209 s[i]->s.jf = NULL; /*update in next stmt*/ 6210 s[i]->s.k = IPPROTO_HOPOPTS; 6211 s[fix2]->s.jf = s[i]; 6212 i++; 6213 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 6214 s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6215 s[i]->s.jt = NULL; /*later*/ 6216 s[i]->s.jf = NULL; /*update in next stmt*/ 6217 s[i]->s.k = IPPROTO_DSTOPTS; 6218 i++; 6219 /* if (A == IPPROTO_ROUTING) goto v6advance */ 6220 s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6221 s[i]->s.jt = NULL; /*later*/ 6222 s[i]->s.jf = NULL; /*update in next stmt*/ 6223 s[i]->s.k = IPPROTO_ROUTING; 6224 i++; 6225 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 6226 s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6227 s[i]->s.jt = NULL; /*later*/ 6228 s[i]->s.jf = NULL; /*later*/ 6229 s[i]->s.k = IPPROTO_FRAGMENT; 6230 fix3 = i; 6231 v6end = i; 6232 i++; 6233 6234 /* v6advance: */ 6235 v6advance = i; 6236 6237 /* 6238 * in short, 6239 * A = P[X + packet head]; 6240 * X = X + (P[X + packet head + 1] + 1) * 8; 6241 */ 6242 /* A = P[X + packet head] */ 6243 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 6244 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 6245 i++; 6246 /* MEM[reg2] = A */ 6247 s[i] = new_stmt(cstate, BPF_ST); 6248 s[i]->s.k = reg2; 6249 i++; 6250 /* A = P[X + packet head + 1]; */ 6251 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 6252 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 1; 6253 i++; 6254 /* A += 1 */ 6255 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6256 s[i]->s.k = 1; 6257 i++; 6258 /* A *= 8 */ 6259 s[i] = new_stmt(cstate, BPF_ALU|BPF_MUL|BPF_K); 6260 s[i]->s.k = 8; 6261 i++; 6262 /* A += X */ 6263 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X); 6264 s[i]->s.k = 0; 6265 i++; 6266 /* X = A; */ 6267 s[i] = new_stmt(cstate, BPF_MISC|BPF_TAX); 6268 i++; 6269 /* A = MEM[reg2] */ 6270 s[i] = new_stmt(cstate, BPF_LD|BPF_MEM); 6271 s[i]->s.k = reg2; 6272 i++; 6273 6274 /* goto again; (must use BPF_JA for backward jump) */ 6275 s[i] = new_stmt(cstate, BPF_JMP|BPF_JA); 6276 s[i]->s.k = again - i - 1; 6277 s[i - 1]->s.jf = s[i]; 6278 i++; 6279 6280 /* fixup */ 6281 for (j = v6start; j <= v6end; j++) 6282 s[j]->s.jt = s[v6advance]; 6283 } else { 6284 /* nop */ 6285 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6286 s[i]->s.k = 0; 6287 s[fix2]->s.jf = s[i]; 6288 i++; 6289 } 6290 6291 /* ahcheck: */ 6292 ahcheck = i; 6293 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 6294 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 6295 s[i]->s.jt = NULL; /*later*/ 6296 s[i]->s.jf = NULL; /*later*/ 6297 s[i]->s.k = IPPROTO_AH; 6298 if (fix3) 6299 s[fix3]->s.jf = s[ahcheck]; 6300 fix4 = i; 6301 i++; 6302 6303 /* 6304 * in short, 6305 * A = P[X]; 6306 * X = X + (P[X + 1] + 2) * 4; 6307 */ 6308 /* A = X */ 6309 s[i - 1]->s.jt = s[i] = new_stmt(cstate, BPF_MISC|BPF_TXA); 6310 i++; 6311 /* A = P[X + packet head]; */ 6312 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 6313 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 6314 i++; 6315 /* MEM[reg2] = A */ 6316 s[i] = new_stmt(cstate, BPF_ST); 6317 s[i]->s.k = reg2; 6318 i++; 6319 /* A = X */ 6320 s[i - 1]->s.jt = s[i] = new_stmt(cstate, BPF_MISC|BPF_TXA); 6321 i++; 6322 /* A += 1 */ 6323 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6324 s[i]->s.k = 1; 6325 i++; 6326 /* X = A */ 6327 s[i] = new_stmt(cstate, BPF_MISC|BPF_TAX); 6328 i++; 6329 /* A = P[X + packet head] */ 6330 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 6331 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 6332 i++; 6333 /* A += 2 */ 6334 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6335 s[i]->s.k = 2; 6336 i++; 6337 /* A *= 4 */ 6338 s[i] = new_stmt(cstate, BPF_ALU|BPF_MUL|BPF_K); 6339 s[i]->s.k = 4; 6340 i++; 6341 /* X = A; */ 6342 s[i] = new_stmt(cstate, BPF_MISC|BPF_TAX); 6343 i++; 6344 /* A = MEM[reg2] */ 6345 s[i] = new_stmt(cstate, BPF_LD|BPF_MEM); 6346 s[i]->s.k = reg2; 6347 i++; 6348 6349 /* goto again; (must use BPF_JA for backward jump) */ 6350 s[i] = new_stmt(cstate, BPF_JMP|BPF_JA); 6351 s[i]->s.k = again - i - 1; 6352 i++; 6353 6354 /* end: nop */ 6355 end = i; 6356 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6357 s[i]->s.k = 0; 6358 s[fix2]->s.jt = s[end]; 6359 s[fix4]->s.jf = s[end]; 6360 s[fix5]->s.jt = s[end]; 6361 i++; 6362 6363 /* 6364 * make slist chain 6365 */ 6366 max = i; 6367 for (i = 0; i < max - 1; i++) 6368 s[i]->next = s[i + 1]; 6369 s[max - 1]->next = NULL; 6370 6371 /* 6372 * emit final check 6373 */ 6374 b = new_block(cstate, JMP(BPF_JEQ)); 6375 b->stmts = s[1]; /*remember, s[0] is dummy*/ 6376 b->s.k = v; 6377 6378 free_reg(cstate, reg2); 6379 6380 gen_and(b0, b); 6381 return b; 6382 } 6383 #endif /* !defined(NO_PROTOCHAIN) */ 6384 6385 static struct block * 6386 gen_check_802_11_data_frame(compiler_state_t *cstate) 6387 { 6388 struct slist *s; 6389 struct block *b0, *b1; 6390 6391 /* 6392 * A data frame has the 0x08 bit (b3) in the frame control field set 6393 * and the 0x04 bit (b2) clear. 6394 */ 6395 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 6396 b0 = new_block(cstate, JMP(BPF_JSET)); 6397 b0->s.k = 0x08; 6398 b0->stmts = s; 6399 6400 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 6401 b1 = new_block(cstate, JMP(BPF_JSET)); 6402 b1->s.k = 0x04; 6403 b1->stmts = s; 6404 gen_not(b1); 6405 6406 gen_and(b1, b0); 6407 6408 return b0; 6409 } 6410 6411 /* 6412 * Generate code that checks whether the packet is a packet for protocol 6413 * <proto> and whether the type field in that protocol's header has 6414 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an 6415 * IP packet and checks the protocol number in the IP header against <v>. 6416 * 6417 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks 6418 * against Q_IP and Q_IPV6. 6419 */ 6420 static struct block * 6421 gen_proto(compiler_state_t *cstate, bpf_u_int32 v, int proto, int dir) 6422 { 6423 struct block *b0, *b1; 6424 struct block *b2; 6425 6426 if (dir != Q_DEFAULT) 6427 bpf_error(cstate, "direction applied to 'proto'"); 6428 6429 switch (proto) { 6430 case Q_DEFAULT: 6431 b0 = gen_proto(cstate, v, Q_IP, dir); 6432 b1 = gen_proto(cstate, v, Q_IPV6, dir); 6433 gen_or(b0, b1); 6434 return b1; 6435 6436 case Q_LINK: 6437 return gen_linktype(cstate, v); 6438 6439 case Q_IP: 6440 /* 6441 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 6442 * not LLC encapsulation with LLCSAP_IP. 6443 * 6444 * For IEEE 802 networks - which includes 802.5 token ring 6445 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 6446 * says that SNAP encapsulation is used, not LLC encapsulation 6447 * with LLCSAP_IP. 6448 * 6449 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 6450 * RFC 2225 say that SNAP encapsulation is used, not LLC 6451 * encapsulation with LLCSAP_IP. 6452 * 6453 * So we always check for ETHERTYPE_IP. 6454 */ 6455 b0 = gen_linktype(cstate, ETHERTYPE_IP); 6456 b1 = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, v); 6457 gen_and(b0, b1); 6458 return b1; 6459 6460 case Q_ARP: 6461 bpf_error(cstate, "arp does not encapsulate another protocol"); 6462 /*NOTREACHED*/ 6463 6464 case Q_RARP: 6465 bpf_error(cstate, "rarp does not encapsulate another protocol"); 6466 /*NOTREACHED*/ 6467 6468 case Q_SCTP: 6469 bpf_error(cstate, "'sctp proto' is bogus"); 6470 /*NOTREACHED*/ 6471 6472 case Q_TCP: 6473 bpf_error(cstate, "'tcp proto' is bogus"); 6474 /*NOTREACHED*/ 6475 6476 case Q_UDP: 6477 bpf_error(cstate, "'udp proto' is bogus"); 6478 /*NOTREACHED*/ 6479 6480 case Q_ICMP: 6481 bpf_error(cstate, "'icmp proto' is bogus"); 6482 /*NOTREACHED*/ 6483 6484 case Q_IGMP: 6485 bpf_error(cstate, "'igmp proto' is bogus"); 6486 /*NOTREACHED*/ 6487 6488 case Q_IGRP: 6489 bpf_error(cstate, "'igrp proto' is bogus"); 6490 /*NOTREACHED*/ 6491 6492 case Q_ATALK: 6493 bpf_error(cstate, "AppleTalk encapsulation is not specifiable"); 6494 /*NOTREACHED*/ 6495 6496 case Q_DECNET: 6497 bpf_error(cstate, "DECNET encapsulation is not specifiable"); 6498 /*NOTREACHED*/ 6499 6500 case Q_LAT: 6501 bpf_error(cstate, "LAT does not encapsulate another protocol"); 6502 /*NOTREACHED*/ 6503 6504 case Q_SCA: 6505 bpf_error(cstate, "SCA does not encapsulate another protocol"); 6506 /*NOTREACHED*/ 6507 6508 case Q_MOPRC: 6509 bpf_error(cstate, "MOPRC does not encapsulate another protocol"); 6510 /*NOTREACHED*/ 6511 6512 case Q_MOPDL: 6513 bpf_error(cstate, "MOPDL does not encapsulate another protocol"); 6514 /*NOTREACHED*/ 6515 6516 case Q_IPV6: 6517 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 6518 /* 6519 * Also check for a fragment header before the final 6520 * header. 6521 */ 6522 b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, IPPROTO_FRAGMENT); 6523 b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, v); 6524 gen_and(b2, b1); 6525 b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, v); 6526 gen_or(b2, b1); 6527 gen_and(b0, b1); 6528 return b1; 6529 6530 case Q_ICMPV6: 6531 bpf_error(cstate, "'icmp6 proto' is bogus"); 6532 /*NOTREACHED*/ 6533 6534 case Q_AH: 6535 bpf_error(cstate, "'ah proto' is bogus"); 6536 /*NOTREACHED*/ 6537 6538 case Q_ESP: 6539 bpf_error(cstate, "'esp proto' is bogus"); 6540 /*NOTREACHED*/ 6541 6542 case Q_PIM: 6543 bpf_error(cstate, "'pim proto' is bogus"); 6544 /*NOTREACHED*/ 6545 6546 case Q_VRRP: 6547 bpf_error(cstate, "'vrrp proto' is bogus"); 6548 /*NOTREACHED*/ 6549 6550 case Q_AARP: 6551 bpf_error(cstate, "'aarp proto' is bogus"); 6552 /*NOTREACHED*/ 6553 6554 case Q_ISO: 6555 switch (cstate->linktype) { 6556 6557 case DLT_FRELAY: 6558 /* 6559 * Frame Relay packets typically have an OSI 6560 * NLPID at the beginning; "gen_linktype(cstate, LLCSAP_ISONS)" 6561 * generates code to check for all the OSI 6562 * NLPIDs, so calling it and then adding a check 6563 * for the particular NLPID for which we're 6564 * looking is bogus, as we can just check for 6565 * the NLPID. 6566 * 6567 * What we check for is the NLPID and a frame 6568 * control field value of UI, i.e. 0x03 followed 6569 * by the NLPID. 6570 * 6571 * XXX - assumes a 2-byte Frame Relay header with 6572 * DLCI and flags. What if the address is longer? 6573 * 6574 * XXX - what about SNAP-encapsulated frames? 6575 */ 6576 return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | v); 6577 /*NOTREACHED*/ 6578 6579 case DLT_C_HDLC: 6580 case DLT_HDLC: 6581 /* 6582 * Cisco uses an Ethertype lookalike - for OSI, 6583 * it's 0xfefe. 6584 */ 6585 b0 = gen_linktype(cstate, LLCSAP_ISONS<<8 | LLCSAP_ISONS); 6586 /* OSI in C-HDLC is stuffed with a fudge byte */ 6587 b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 1, BPF_B, v); 6588 gen_and(b0, b1); 6589 return b1; 6590 6591 default: 6592 b0 = gen_linktype(cstate, LLCSAP_ISONS); 6593 b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 0, BPF_B, v); 6594 gen_and(b0, b1); 6595 return b1; 6596 } 6597 6598 case Q_ESIS: 6599 bpf_error(cstate, "'esis proto' is bogus"); 6600 /*NOTREACHED*/ 6601 6602 case Q_ISIS: 6603 b0 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT); 6604 /* 6605 * 4 is the offset of the PDU type relative to the IS-IS 6606 * header. 6607 */ 6608 b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 4, BPF_B, v); 6609 gen_and(b0, b1); 6610 return b1; 6611 6612 case Q_CLNP: 6613 bpf_error(cstate, "'clnp proto' is not supported"); 6614 /*NOTREACHED*/ 6615 6616 case Q_STP: 6617 bpf_error(cstate, "'stp proto' is bogus"); 6618 /*NOTREACHED*/ 6619 6620 case Q_IPX: 6621 bpf_error(cstate, "'ipx proto' is bogus"); 6622 /*NOTREACHED*/ 6623 6624 case Q_NETBEUI: 6625 bpf_error(cstate, "'netbeui proto' is bogus"); 6626 /*NOTREACHED*/ 6627 6628 case Q_ISIS_L1: 6629 bpf_error(cstate, "'l1 proto' is bogus"); 6630 /*NOTREACHED*/ 6631 6632 case Q_ISIS_L2: 6633 bpf_error(cstate, "'l2 proto' is bogus"); 6634 /*NOTREACHED*/ 6635 6636 case Q_ISIS_IIH: 6637 bpf_error(cstate, "'iih proto' is bogus"); 6638 /*NOTREACHED*/ 6639 6640 case Q_ISIS_SNP: 6641 bpf_error(cstate, "'snp proto' is bogus"); 6642 /*NOTREACHED*/ 6643 6644 case Q_ISIS_CSNP: 6645 bpf_error(cstate, "'csnp proto' is bogus"); 6646 /*NOTREACHED*/ 6647 6648 case Q_ISIS_PSNP: 6649 bpf_error(cstate, "'psnp proto' is bogus"); 6650 /*NOTREACHED*/ 6651 6652 case Q_ISIS_LSP: 6653 bpf_error(cstate, "'lsp proto' is bogus"); 6654 /*NOTREACHED*/ 6655 6656 case Q_RADIO: 6657 bpf_error(cstate, "'radio proto' is bogus"); 6658 /*NOTREACHED*/ 6659 6660 case Q_CARP: 6661 bpf_error(cstate, "'carp proto' is bogus"); 6662 /*NOTREACHED*/ 6663 6664 default: 6665 abort(); 6666 /*NOTREACHED*/ 6667 } 6668 /*NOTREACHED*/ 6669 } 6670 6671 /* 6672 * Convert a non-numeric name to a port number. 6673 */ 6674 static int 6675 nametoport(compiler_state_t *cstate, const char *name, int ipproto) 6676 { 6677 struct addrinfo hints, *res, *ai; 6678 int error; 6679 struct sockaddr_in *in4; 6680 #ifdef INET6 6681 struct sockaddr_in6 *in6; 6682 #endif 6683 int port = -1; 6684 6685 /* 6686 * We check for both TCP and UDP in case there are 6687 * ambiguous entries. 6688 */ 6689 memset(&hints, 0, sizeof(hints)); 6690 hints.ai_family = PF_UNSPEC; 6691 hints.ai_socktype = (ipproto == IPPROTO_TCP) ? SOCK_STREAM : SOCK_DGRAM; 6692 hints.ai_protocol = ipproto; 6693 error = getaddrinfo(NULL, name, &hints, &res); 6694 if (error != 0) { 6695 switch (error) { 6696 6697 case EAI_NONAME: 6698 case EAI_SERVICE: 6699 /* 6700 * No such port. Just return -1. 6701 */ 6702 break; 6703 6704 #ifdef EAI_SYSTEM 6705 case EAI_SYSTEM: 6706 /* 6707 * We don't use strerror() because it's not 6708 * guaranteed to be thread-safe on all platforms 6709 * (probably because it might use a non-thread-local 6710 * buffer into which to format an error message 6711 * if the error code isn't one for which it has 6712 * a canned string; three cheers for C string 6713 * handling). 6714 */ 6715 bpf_set_error(cstate, "getaddrinfo(\"%s\" fails with system error: %d", 6716 name, errno); 6717 port = -2; /* a real error */ 6718 break; 6719 #endif 6720 6721 default: 6722 /* 6723 * This is a real error, not just "there's 6724 * no such service name". 6725 * 6726 * We don't use gai_strerror() because it's not 6727 * guaranteed to be thread-safe on all platforms 6728 * (probably because it might use a non-thread-local 6729 * buffer into which to format an error message 6730 * if the error code isn't one for which it has 6731 * a canned string; three cheers for C string 6732 * handling). 6733 */ 6734 bpf_set_error(cstate, "getaddrinfo(\"%s\") fails with error: %d", 6735 name, error); 6736 port = -2; /* a real error */ 6737 break; 6738 } 6739 } else { 6740 /* 6741 * OK, we found it. Did it find anything? 6742 */ 6743 for (ai = res; ai != NULL; ai = ai->ai_next) { 6744 /* 6745 * Does it have an address? 6746 */ 6747 if (ai->ai_addr != NULL) { 6748 /* 6749 * Yes. Get a port number; we're done. 6750 */ 6751 if (ai->ai_addr->sa_family == AF_INET) { 6752 in4 = (struct sockaddr_in *)ai->ai_addr; 6753 port = ntohs(in4->sin_port); 6754 break; 6755 } 6756 #ifdef INET6 6757 if (ai->ai_addr->sa_family == AF_INET6) { 6758 in6 = (struct sockaddr_in6 *)ai->ai_addr; 6759 port = ntohs(in6->sin6_port); 6760 break; 6761 } 6762 #endif 6763 } 6764 } 6765 freeaddrinfo(res); 6766 } 6767 return port; 6768 } 6769 6770 /* 6771 * Convert a string to a port number. 6772 */ 6773 static bpf_u_int32 6774 stringtoport(compiler_state_t *cstate, const char *string, size_t string_size, 6775 int *proto) 6776 { 6777 stoulen_ret ret; 6778 char *cpy; 6779 bpf_u_int32 val; 6780 int tcp_port = -1; 6781 int udp_port = -1; 6782 6783 /* 6784 * See if it's a number. 6785 */ 6786 ret = stoulen(string, string_size, &val, cstate); 6787 switch (ret) { 6788 6789 case STOULEN_OK: 6790 /* Unknown port type - it's just a number. */ 6791 *proto = PROTO_UNDEF; 6792 break; 6793 6794 case STOULEN_NOT_OCTAL_NUMBER: 6795 case STOULEN_NOT_HEX_NUMBER: 6796 case STOULEN_NOT_DECIMAL_NUMBER: 6797 /* 6798 * Not a valid number; try looking it up as a port. 6799 */ 6800 cpy = malloc(string_size + 1); /* +1 for terminating '\0' */ 6801 memcpy(cpy, string, string_size); 6802 cpy[string_size] = '\0'; 6803 tcp_port = nametoport(cstate, cpy, IPPROTO_TCP); 6804 if (tcp_port == -2) { 6805 /* 6806 * We got a hard error; the error string has 6807 * already been set. 6808 */ 6809 free(cpy); 6810 longjmp(cstate->top_ctx, 1); 6811 /*NOTREACHED*/ 6812 } 6813 udp_port = nametoport(cstate, cpy, IPPROTO_UDP); 6814 if (udp_port == -2) { 6815 /* 6816 * We got a hard error; the error string has 6817 * already been set. 6818 */ 6819 free(cpy); 6820 longjmp(cstate->top_ctx, 1); 6821 /*NOTREACHED*/ 6822 } 6823 6824 /* 6825 * We need to check /etc/services for ambiguous entries. 6826 * If we find an ambiguous entry, and it has the 6827 * same port number, change the proto to PROTO_UNDEF 6828 * so both TCP and UDP will be checked. 6829 */ 6830 if (tcp_port >= 0) { 6831 val = (bpf_u_int32)tcp_port; 6832 *proto = IPPROTO_TCP; 6833 if (udp_port >= 0) { 6834 if (udp_port == tcp_port) 6835 *proto = PROTO_UNDEF; 6836 #ifdef notdef 6837 else 6838 /* Can't handle ambiguous names that refer 6839 to different port numbers. */ 6840 warning("ambiguous port %s in /etc/services", 6841 cpy); 6842 #endif 6843 } 6844 free(cpy); 6845 break; 6846 } 6847 if (udp_port >= 0) { 6848 val = (bpf_u_int32)udp_port; 6849 *proto = IPPROTO_UDP; 6850 free(cpy); 6851 break; 6852 } 6853 #if defined(ultrix) || defined(__osf__) 6854 /* Special hack in case NFS isn't in /etc/services */ 6855 if (strcmp(cpy, "nfs") == 0) { 6856 val = 2049; 6857 *proto = PROTO_UNDEF; 6858 free(cpy); 6859 break; 6860 } 6861 #endif 6862 bpf_set_error(cstate, "'%s' is not a valid port", cpy); 6863 free(cpy); 6864 longjmp(cstate->top_ctx, 1); 6865 /*NOTREACHED*/ 6866 6867 case STOULEN_ERROR: 6868 /* Error already set. */ 6869 longjmp(cstate->top_ctx, 1); 6870 /*NOTREACHED*/ 6871 6872 default: 6873 /* Should not happen */ 6874 bpf_set_error(cstate, "stoulen returned %d - this should not happen", ret); 6875 longjmp(cstate->top_ctx, 1); 6876 /*NOTREACHED*/ 6877 } 6878 return (val); 6879 } 6880 6881 /* 6882 * Convert a string in the form PPP-PPP, which correspond to ports, to 6883 * a starting and ending port in a port range. 6884 */ 6885 static void 6886 stringtoportrange(compiler_state_t *cstate, const char *string, 6887 bpf_u_int32 *port1, bpf_u_int32 *port2, int *proto) 6888 { 6889 char *hyphen_off; 6890 const char *first, *second; 6891 size_t first_size, second_size; 6892 int save_proto; 6893 6894 if ((hyphen_off = strchr(string, '-')) == NULL) 6895 bpf_error(cstate, "port range '%s' contains no hyphen", string); 6896 6897 /* 6898 * Make sure there are no other hyphens. 6899 * 6900 * XXX - we support named ports, but there are some port names 6901 * in /etc/services that include hyphens, so this would rule 6902 * that out. 6903 */ 6904 if (strchr(hyphen_off + 1, '-') != NULL) 6905 bpf_error(cstate, "port range '%s' contains more than one hyphen", 6906 string); 6907 6908 /* 6909 * Get the length of the first port. 6910 */ 6911 first = string; 6912 first_size = hyphen_off - string; 6913 if (first_size == 0) { 6914 /* Range of "-port", which we don't support. */ 6915 bpf_error(cstate, "port range '%s' has no starting port", string); 6916 } 6917 6918 /* 6919 * Try to convert it to a port. 6920 */ 6921 *port1 = stringtoport(cstate, first, first_size, proto); 6922 save_proto = *proto; 6923 6924 /* 6925 * Get the length of the second port. 6926 */ 6927 second = hyphen_off + 1; 6928 second_size = strlen(second); 6929 if (second_size == 0) { 6930 /* Range of "port-", which we don't support. */ 6931 bpf_error(cstate, "port range '%s' has no ending port", string); 6932 } 6933 6934 /* 6935 * Try to convert it to a port. 6936 */ 6937 *port2 = stringtoport(cstate, second, second_size, proto); 6938 if (*proto != save_proto) 6939 *proto = PROTO_UNDEF; 6940 } 6941 6942 struct block * 6943 gen_scode(compiler_state_t *cstate, const char *name, struct qual q) 6944 { 6945 int proto = q.proto; 6946 int dir = q.dir; 6947 int tproto; 6948 u_char *eaddr; 6949 bpf_u_int32 mask, addr; 6950 struct addrinfo *res, *res0; 6951 struct sockaddr_in *sin4; 6952 #ifdef INET6 6953 int tproto6; 6954 struct sockaddr_in6 *sin6; 6955 struct in6_addr mask128; 6956 #endif /*INET6*/ 6957 struct block *b, *tmp; 6958 int port, real_proto; 6959 bpf_u_int32 port1, port2; 6960 6961 /* 6962 * Catch errors reported by us and routines below us, and return NULL 6963 * on an error. 6964 */ 6965 if (setjmp(cstate->top_ctx)) 6966 return (NULL); 6967 6968 switch (q.addr) { 6969 6970 case Q_NET: 6971 addr = pcap_nametonetaddr(name); 6972 if (addr == 0) 6973 bpf_error(cstate, "unknown network '%s'", name); 6974 /* Left justify network addr and calculate its network mask */ 6975 mask = 0xffffffff; 6976 while (addr && (addr & 0xff000000) == 0) { 6977 addr <<= 8; 6978 mask <<= 8; 6979 } 6980 return gen_host(cstate, addr, mask, proto, dir, q.addr); 6981 6982 case Q_DEFAULT: 6983 case Q_HOST: 6984 if (proto == Q_LINK) { 6985 switch (cstate->linktype) { 6986 6987 case DLT_EN10MB: 6988 case DLT_NETANALYZER: 6989 case DLT_NETANALYZER_TRANSPARENT: 6990 eaddr = pcap_ether_hostton(name); 6991 if (eaddr == NULL) 6992 bpf_error(cstate, 6993 "unknown ether host '%s'", name); 6994 tmp = gen_prevlinkhdr_check(cstate); 6995 b = gen_ehostop(cstate, eaddr, dir); 6996 if (tmp != NULL) 6997 gen_and(tmp, b); 6998 free(eaddr); 6999 return b; 7000 7001 case DLT_FDDI: 7002 eaddr = pcap_ether_hostton(name); 7003 if (eaddr == NULL) 7004 bpf_error(cstate, 7005 "unknown FDDI host '%s'", name); 7006 b = gen_fhostop(cstate, eaddr, dir); 7007 free(eaddr); 7008 return b; 7009 7010 case DLT_IEEE802: 7011 eaddr = pcap_ether_hostton(name); 7012 if (eaddr == NULL) 7013 bpf_error(cstate, 7014 "unknown token ring host '%s'", name); 7015 b = gen_thostop(cstate, eaddr, dir); 7016 free(eaddr); 7017 return b; 7018 7019 case DLT_IEEE802_11: 7020 case DLT_PRISM_HEADER: 7021 case DLT_IEEE802_11_RADIO_AVS: 7022 case DLT_IEEE802_11_RADIO: 7023 case DLT_PPI: 7024 eaddr = pcap_ether_hostton(name); 7025 if (eaddr == NULL) 7026 bpf_error(cstate, 7027 "unknown 802.11 host '%s'", name); 7028 b = gen_wlanhostop(cstate, eaddr, dir); 7029 free(eaddr); 7030 return b; 7031 7032 case DLT_IP_OVER_FC: 7033 eaddr = pcap_ether_hostton(name); 7034 if (eaddr == NULL) 7035 bpf_error(cstate, 7036 "unknown Fibre Channel host '%s'", name); 7037 b = gen_ipfchostop(cstate, eaddr, dir); 7038 free(eaddr); 7039 return b; 7040 } 7041 7042 bpf_error(cstate, "only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name"); 7043 } else if (proto == Q_DECNET) { 7044 unsigned short dn_addr; 7045 7046 if (!__pcap_nametodnaddr(name, &dn_addr)) { 7047 #ifdef DECNETLIB 7048 bpf_error(cstate, "unknown decnet host name '%s'\n", name); 7049 #else 7050 bpf_error(cstate, "decnet name support not included, '%s' cannot be translated\n", 7051 name); 7052 #endif 7053 } 7054 /* 7055 * I don't think DECNET hosts can be multihomed, so 7056 * there is no need to build up a list of addresses 7057 */ 7058 return (gen_host(cstate, dn_addr, 0, proto, dir, q.addr)); 7059 } else { 7060 #ifdef INET6 7061 memset(&mask128, 0xff, sizeof(mask128)); 7062 #endif 7063 res0 = res = pcap_nametoaddrinfo(name); 7064 if (res == NULL) 7065 bpf_error(cstate, "unknown host '%s'", name); 7066 cstate->ai = res; 7067 b = tmp = NULL; 7068 tproto = proto; 7069 #ifdef INET6 7070 tproto6 = proto; 7071 #endif 7072 if (cstate->off_linktype.constant_part == OFFSET_NOT_SET && 7073 tproto == Q_DEFAULT) { 7074 tproto = Q_IP; 7075 #ifdef INET6 7076 tproto6 = Q_IPV6; 7077 #endif 7078 } 7079 for (res = res0; res; res = res->ai_next) { 7080 switch (res->ai_family) { 7081 case AF_INET: 7082 #ifdef INET6 7083 if (tproto == Q_IPV6) 7084 continue; 7085 #endif 7086 7087 sin4 = (struct sockaddr_in *) 7088 res->ai_addr; 7089 tmp = gen_host(cstate, ntohl(sin4->sin_addr.s_addr), 7090 0xffffffff, tproto, dir, q.addr); 7091 break; 7092 #ifdef INET6 7093 case AF_INET6: 7094 if (tproto6 == Q_IP) 7095 continue; 7096 7097 sin6 = (struct sockaddr_in6 *) 7098 res->ai_addr; 7099 tmp = gen_host6(cstate, &sin6->sin6_addr, 7100 &mask128, tproto6, dir, q.addr); 7101 break; 7102 #endif 7103 default: 7104 continue; 7105 } 7106 if (b) 7107 gen_or(b, tmp); 7108 b = tmp; 7109 } 7110 cstate->ai = NULL; 7111 freeaddrinfo(res0); 7112 if (b == NULL) { 7113 bpf_error(cstate, "unknown host '%s'%s", name, 7114 (proto == Q_DEFAULT) 7115 ? "" 7116 : " for specified address family"); 7117 } 7118 return b; 7119 } 7120 7121 case Q_PORT: 7122 if (proto != Q_DEFAULT && 7123 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 7124 bpf_error(cstate, "illegal qualifier of 'port'"); 7125 if (pcap_nametoport(name, &port, &real_proto) == 0) 7126 bpf_error(cstate, "unknown port '%s'", name); 7127 if (proto == Q_UDP) { 7128 if (real_proto == IPPROTO_TCP) 7129 bpf_error(cstate, "port '%s' is tcp", name); 7130 else if (real_proto == IPPROTO_SCTP) 7131 bpf_error(cstate, "port '%s' is sctp", name); 7132 else 7133 /* override PROTO_UNDEF */ 7134 real_proto = IPPROTO_UDP; 7135 } 7136 if (proto == Q_TCP) { 7137 if (real_proto == IPPROTO_UDP) 7138 bpf_error(cstate, "port '%s' is udp", name); 7139 7140 else if (real_proto == IPPROTO_SCTP) 7141 bpf_error(cstate, "port '%s' is sctp", name); 7142 else 7143 /* override PROTO_UNDEF */ 7144 real_proto = IPPROTO_TCP; 7145 } 7146 if (proto == Q_SCTP) { 7147 if (real_proto == IPPROTO_UDP) 7148 bpf_error(cstate, "port '%s' is udp", name); 7149 7150 else if (real_proto == IPPROTO_TCP) 7151 bpf_error(cstate, "port '%s' is tcp", name); 7152 else 7153 /* override PROTO_UNDEF */ 7154 real_proto = IPPROTO_SCTP; 7155 } 7156 if (port < 0) 7157 bpf_error(cstate, "illegal port number %d < 0", port); 7158 if (port > 65535) 7159 bpf_error(cstate, "illegal port number %d > 65535", port); 7160 b = gen_port(cstate, port, real_proto, dir); 7161 gen_or(gen_port6(cstate, port, real_proto, dir), b); 7162 return b; 7163 7164 case Q_PORTRANGE: 7165 if (proto != Q_DEFAULT && 7166 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 7167 bpf_error(cstate, "illegal qualifier of 'portrange'"); 7168 stringtoportrange(cstate, name, &port1, &port2, &real_proto); 7169 if (proto == Q_UDP) { 7170 if (real_proto == IPPROTO_TCP) 7171 bpf_error(cstate, "port in range '%s' is tcp", name); 7172 else if (real_proto == IPPROTO_SCTP) 7173 bpf_error(cstate, "port in range '%s' is sctp", name); 7174 else 7175 /* override PROTO_UNDEF */ 7176 real_proto = IPPROTO_UDP; 7177 } 7178 if (proto == Q_TCP) { 7179 if (real_proto == IPPROTO_UDP) 7180 bpf_error(cstate, "port in range '%s' is udp", name); 7181 else if (real_proto == IPPROTO_SCTP) 7182 bpf_error(cstate, "port in range '%s' is sctp", name); 7183 else 7184 /* override PROTO_UNDEF */ 7185 real_proto = IPPROTO_TCP; 7186 } 7187 if (proto == Q_SCTP) { 7188 if (real_proto == IPPROTO_UDP) 7189 bpf_error(cstate, "port in range '%s' is udp", name); 7190 else if (real_proto == IPPROTO_TCP) 7191 bpf_error(cstate, "port in range '%s' is tcp", name); 7192 else 7193 /* override PROTO_UNDEF */ 7194 real_proto = IPPROTO_SCTP; 7195 } 7196 if (port1 > 65535) 7197 bpf_error(cstate, "illegal port number %d > 65535", port1); 7198 if (port2 > 65535) 7199 bpf_error(cstate, "illegal port number %d > 65535", port2); 7200 7201 b = gen_portrange(cstate, port1, port2, real_proto, dir); 7202 gen_or(gen_portrange6(cstate, port1, port2, real_proto, dir), b); 7203 return b; 7204 7205 case Q_GATEWAY: 7206 #ifndef INET6 7207 eaddr = pcap_ether_hostton(name); 7208 if (eaddr == NULL) 7209 bpf_error(cstate, "unknown ether host: %s", name); 7210 7211 res = pcap_nametoaddrinfo(name); 7212 cstate->ai = res; 7213 if (res == NULL) 7214 bpf_error(cstate, "unknown host '%s'", name); 7215 b = gen_gateway(cstate, eaddr, res, proto, dir); 7216 cstate->ai = NULL; 7217 freeaddrinfo(res); 7218 if (b == NULL) 7219 bpf_error(cstate, "unknown host '%s'", name); 7220 return b; 7221 #else 7222 bpf_error(cstate, "'gateway' not supported in this configuration"); 7223 #endif /*INET6*/ 7224 7225 case Q_PROTO: 7226 real_proto = lookup_proto(cstate, name, proto); 7227 if (real_proto >= 0) 7228 return gen_proto(cstate, real_proto, proto, dir); 7229 else 7230 bpf_error(cstate, "unknown protocol: %s", name); 7231 7232 #if !defined(NO_PROTOCHAIN) 7233 case Q_PROTOCHAIN: 7234 real_proto = lookup_proto(cstate, name, proto); 7235 if (real_proto >= 0) 7236 return gen_protochain(cstate, real_proto, proto); 7237 else 7238 bpf_error(cstate, "unknown protocol: %s", name); 7239 #endif /* !defined(NO_PROTOCHAIN) */ 7240 7241 case Q_UNDEF: 7242 syntax(cstate); 7243 /*NOTREACHED*/ 7244 } 7245 abort(); 7246 /*NOTREACHED*/ 7247 } 7248 7249 struct block * 7250 gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2, 7251 bpf_u_int32 masklen, struct qual q) 7252 { 7253 register int nlen, mlen; 7254 bpf_u_int32 n, m; 7255 7256 /* 7257 * Catch errors reported by us and routines below us, and return NULL 7258 * on an error. 7259 */ 7260 if (setjmp(cstate->top_ctx)) 7261 return (NULL); 7262 7263 nlen = __pcap_atoin(s1, &n); 7264 if (nlen < 0) 7265 bpf_error(cstate, "invalid IPv4 address '%s'", s1); 7266 /* Promote short ipaddr */ 7267 n <<= 32 - nlen; 7268 7269 if (s2 != NULL) { 7270 mlen = __pcap_atoin(s2, &m); 7271 if (mlen < 0) 7272 bpf_error(cstate, "invalid IPv4 address '%s'", s2); 7273 /* Promote short ipaddr */ 7274 m <<= 32 - mlen; 7275 if ((n & ~m) != 0) 7276 bpf_error(cstate, "non-network bits set in \"%s mask %s\"", 7277 s1, s2); 7278 } else { 7279 /* Convert mask len to mask */ 7280 if (masklen > 32) 7281 bpf_error(cstate, "mask length must be <= 32"); 7282 if (masklen == 0) { 7283 /* 7284 * X << 32 is not guaranteed by C to be 0; it's 7285 * undefined. 7286 */ 7287 m = 0; 7288 } else 7289 m = 0xffffffff << (32 - masklen); 7290 if ((n & ~m) != 0) 7291 bpf_error(cstate, "non-network bits set in \"%s/%d\"", 7292 s1, masklen); 7293 } 7294 7295 switch (q.addr) { 7296 7297 case Q_NET: 7298 return gen_host(cstate, n, m, q.proto, q.dir, q.addr); 7299 7300 default: 7301 bpf_error(cstate, "Mask syntax for networks only"); 7302 /*NOTREACHED*/ 7303 } 7304 /*NOTREACHED*/ 7305 } 7306 7307 struct block * 7308 gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) 7309 { 7310 bpf_u_int32 mask; 7311 int proto; 7312 int dir; 7313 register int vlen; 7314 7315 /* 7316 * Catch errors reported by us and routines below us, and return NULL 7317 * on an error. 7318 */ 7319 if (setjmp(cstate->top_ctx)) 7320 return (NULL); 7321 7322 proto = q.proto; 7323 dir = q.dir; 7324 if (s == NULL) 7325 vlen = 32; 7326 else if (q.proto == Q_DECNET) { 7327 vlen = __pcap_atodn(s, &v); 7328 if (vlen == 0) 7329 bpf_error(cstate, "malformed decnet address '%s'", s); 7330 } else { 7331 vlen = __pcap_atoin(s, &v); 7332 if (vlen < 0) 7333 bpf_error(cstate, "invalid IPv4 address '%s'", s); 7334 } 7335 7336 switch (q.addr) { 7337 7338 case Q_DEFAULT: 7339 case Q_HOST: 7340 case Q_NET: 7341 if (proto == Q_DECNET) 7342 return gen_host(cstate, v, 0, proto, dir, q.addr); 7343 else if (proto == Q_LINK) { 7344 bpf_error(cstate, "illegal link layer address"); 7345 } else { 7346 mask = 0xffffffff; 7347 if (s == NULL && q.addr == Q_NET) { 7348 /* Promote short net number */ 7349 while (v && (v & 0xff000000) == 0) { 7350 v <<= 8; 7351 mask <<= 8; 7352 } 7353 } else { 7354 /* Promote short ipaddr */ 7355 v <<= 32 - vlen; 7356 mask <<= 32 - vlen ; 7357 } 7358 return gen_host(cstate, v, mask, proto, dir, q.addr); 7359 } 7360 7361 case Q_PORT: 7362 if (proto == Q_UDP) 7363 proto = IPPROTO_UDP; 7364 else if (proto == Q_TCP) 7365 proto = IPPROTO_TCP; 7366 else if (proto == Q_SCTP) 7367 proto = IPPROTO_SCTP; 7368 else if (proto == Q_DEFAULT) 7369 proto = PROTO_UNDEF; 7370 else 7371 bpf_error(cstate, "illegal qualifier of 'port'"); 7372 7373 if (v > 65535) 7374 bpf_error(cstate, "illegal port number %u > 65535", v); 7375 7376 { 7377 struct block *b; 7378 b = gen_port(cstate, v, proto, dir); 7379 gen_or(gen_port6(cstate, v, proto, dir), b); 7380 return b; 7381 } 7382 7383 case Q_PORTRANGE: 7384 if (proto == Q_UDP) 7385 proto = IPPROTO_UDP; 7386 else if (proto == Q_TCP) 7387 proto = IPPROTO_TCP; 7388 else if (proto == Q_SCTP) 7389 proto = IPPROTO_SCTP; 7390 else if (proto == Q_DEFAULT) 7391 proto = PROTO_UNDEF; 7392 else 7393 bpf_error(cstate, "illegal qualifier of 'portrange'"); 7394 7395 if (v > 65535) 7396 bpf_error(cstate, "illegal port number %u > 65535", v); 7397 7398 { 7399 struct block *b; 7400 b = gen_portrange(cstate, v, v, proto, dir); 7401 gen_or(gen_portrange6(cstate, v, v, proto, dir), b); 7402 return b; 7403 } 7404 7405 case Q_GATEWAY: 7406 bpf_error(cstate, "'gateway' requires a name"); 7407 /*NOTREACHED*/ 7408 7409 case Q_PROTO: 7410 return gen_proto(cstate, v, proto, dir); 7411 7412 #if !defined(NO_PROTOCHAIN) 7413 case Q_PROTOCHAIN: 7414 return gen_protochain(cstate, v, proto); 7415 #endif 7416 7417 case Q_UNDEF: 7418 syntax(cstate); 7419 /*NOTREACHED*/ 7420 7421 default: 7422 abort(); 7423 /*NOTREACHED*/ 7424 } 7425 /*NOTREACHED*/ 7426 } 7427 7428 #ifdef INET6 7429 struct block * 7430 gen_mcode6(compiler_state_t *cstate, const char *s, bpf_u_int32 masklen, 7431 struct qual q) 7432 { 7433 struct addrinfo *res; 7434 struct in6_addr *addr; 7435 struct in6_addr mask; 7436 struct block *b; 7437 bpf_u_int32 a[4], m[4]; /* Same as in gen_hostop6(). */ 7438 7439 /* 7440 * Catch errors reported by us and routines below us, and return NULL 7441 * on an error. 7442 */ 7443 if (setjmp(cstate->top_ctx)) 7444 return (NULL); 7445 7446 res = pcap_nametoaddrinfo(s); 7447 if (!res) 7448 bpf_error(cstate, "invalid ip6 address %s", s); 7449 cstate->ai = res; 7450 if (res->ai_next) 7451 bpf_error(cstate, "%s resolved to multiple address", s); 7452 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 7453 7454 if (masklen > sizeof(mask.s6_addr) * 8) 7455 bpf_error(cstate, "mask length must be <= %zu", sizeof(mask.s6_addr) * 8); 7456 memset(&mask, 0, sizeof(mask)); 7457 memset(&mask.s6_addr, 0xff, masklen / 8); 7458 if (masklen % 8) { 7459 mask.s6_addr[masklen / 8] = 7460 (0xff << (8 - masklen % 8)) & 0xff; 7461 } 7462 7463 memcpy(a, addr, sizeof(a)); 7464 memcpy(m, &mask, sizeof(m)); 7465 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 7466 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 7467 bpf_error(cstate, "non-network bits set in \"%s/%d\"", s, masklen); 7468 } 7469 7470 switch (q.addr) { 7471 7472 case Q_DEFAULT: 7473 case Q_HOST: 7474 if (masklen != 128) 7475 bpf_error(cstate, "Mask syntax for networks only"); 7476 /* FALLTHROUGH */ 7477 7478 case Q_NET: 7479 b = gen_host6(cstate, addr, &mask, q.proto, q.dir, q.addr); 7480 cstate->ai = NULL; 7481 freeaddrinfo(res); 7482 return b; 7483 7484 default: 7485 bpf_error(cstate, "invalid qualifier against IPv6 address"); 7486 /*NOTREACHED*/ 7487 } 7488 } 7489 #endif /*INET6*/ 7490 7491 struct block * 7492 gen_ecode(compiler_state_t *cstate, const char *s, struct qual q) 7493 { 7494 struct block *b, *tmp; 7495 7496 /* 7497 * Catch errors reported by us and routines below us, and return NULL 7498 * on an error. 7499 */ 7500 if (setjmp(cstate->top_ctx)) 7501 return (NULL); 7502 7503 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 7504 cstate->e = pcap_ether_aton(s); 7505 if (cstate->e == NULL) 7506 bpf_error(cstate, "malloc"); 7507 switch (cstate->linktype) { 7508 case DLT_EN10MB: 7509 case DLT_NETANALYZER: 7510 case DLT_NETANALYZER_TRANSPARENT: 7511 tmp = gen_prevlinkhdr_check(cstate); 7512 b = gen_ehostop(cstate, cstate->e, (int)q.dir); 7513 if (tmp != NULL) 7514 gen_and(tmp, b); 7515 break; 7516 case DLT_FDDI: 7517 b = gen_fhostop(cstate, cstate->e, (int)q.dir); 7518 break; 7519 case DLT_IEEE802: 7520 b = gen_thostop(cstate, cstate->e, (int)q.dir); 7521 break; 7522 case DLT_IEEE802_11: 7523 case DLT_PRISM_HEADER: 7524 case DLT_IEEE802_11_RADIO_AVS: 7525 case DLT_IEEE802_11_RADIO: 7526 case DLT_PPI: 7527 b = gen_wlanhostop(cstate, cstate->e, (int)q.dir); 7528 break; 7529 case DLT_IP_OVER_FC: 7530 b = gen_ipfchostop(cstate, cstate->e, (int)q.dir); 7531 break; 7532 default: 7533 free(cstate->e); 7534 cstate->e = NULL; 7535 bpf_error(cstate, "ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 7536 /*NOTREACHED*/ 7537 } 7538 free(cstate->e); 7539 cstate->e = NULL; 7540 return (b); 7541 } 7542 bpf_error(cstate, "ethernet address used in non-ether expression"); 7543 /*NOTREACHED*/ 7544 } 7545 7546 void 7547 sappend(struct slist *s0, struct slist *s1) 7548 { 7549 /* 7550 * This is definitely not the best way to do this, but the 7551 * lists will rarely get long. 7552 */ 7553 while (s0->next) 7554 s0 = s0->next; 7555 s0->next = s1; 7556 } 7557 7558 static struct slist * 7559 xfer_to_x(compiler_state_t *cstate, struct arth *a) 7560 { 7561 struct slist *s; 7562 7563 s = new_stmt(cstate, BPF_LDX|BPF_MEM); 7564 s->s.k = a->regno; 7565 return s; 7566 } 7567 7568 static struct slist * 7569 xfer_to_a(compiler_state_t *cstate, struct arth *a) 7570 { 7571 struct slist *s; 7572 7573 s = new_stmt(cstate, BPF_LD|BPF_MEM); 7574 s->s.k = a->regno; 7575 return s; 7576 } 7577 7578 /* 7579 * Modify "index" to use the value stored into its register as an 7580 * offset relative to the beginning of the header for the protocol 7581 * "proto", and allocate a register and put an item "size" bytes long 7582 * (1, 2, or 4) at that offset into that register, making it the register 7583 * for "index". 7584 */ 7585 static struct arth * 7586 gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, 7587 bpf_u_int32 size) 7588 { 7589 int size_code; 7590 struct slist *s, *tmp; 7591 struct block *b; 7592 int regno = alloc_reg(cstate); 7593 7594 free_reg(cstate, inst->regno); 7595 switch (size) { 7596 7597 default: 7598 bpf_error(cstate, "data size must be 1, 2, or 4"); 7599 /*NOTREACHED*/ 7600 7601 case 1: 7602 size_code = BPF_B; 7603 break; 7604 7605 case 2: 7606 size_code = BPF_H; 7607 break; 7608 7609 case 4: 7610 size_code = BPF_W; 7611 break; 7612 } 7613 switch (proto) { 7614 default: 7615 bpf_error(cstate, "unsupported index operation"); 7616 7617 case Q_RADIO: 7618 /* 7619 * The offset is relative to the beginning of the packet 7620 * data, if we have a radio header. (If we don't, this 7621 * is an error.) 7622 */ 7623 if (cstate->linktype != DLT_IEEE802_11_RADIO_AVS && 7624 cstate->linktype != DLT_IEEE802_11_RADIO && 7625 cstate->linktype != DLT_PRISM_HEADER) 7626 bpf_error(cstate, "radio information not present in capture"); 7627 7628 /* 7629 * Load into the X register the offset computed into the 7630 * register specified by "index". 7631 */ 7632 s = xfer_to_x(cstate, inst); 7633 7634 /* 7635 * Load the item at that offset. 7636 */ 7637 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); 7638 sappend(s, tmp); 7639 sappend(inst->s, s); 7640 break; 7641 7642 case Q_LINK: 7643 /* 7644 * The offset is relative to the beginning of 7645 * the link-layer header. 7646 * 7647 * XXX - what about ATM LANE? Should the index be 7648 * relative to the beginning of the AAL5 frame, so 7649 * that 0 refers to the beginning of the LE Control 7650 * field, or relative to the beginning of the LAN 7651 * frame, so that 0 refers, for Ethernet LANE, to 7652 * the beginning of the destination address? 7653 */ 7654 s = gen_abs_offset_varpart(cstate, &cstate->off_linkhdr); 7655 7656 /* 7657 * If "s" is non-null, it has code to arrange that the 7658 * X register contains the length of the prefix preceding 7659 * the link-layer header. Add to it the offset computed 7660 * into the register specified by "index", and move that 7661 * into the X register. Otherwise, just load into the X 7662 * register the offset computed into the register specified 7663 * by "index". 7664 */ 7665 if (s != NULL) { 7666 sappend(s, xfer_to_a(cstate, inst)); 7667 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7668 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7669 } else 7670 s = xfer_to_x(cstate, inst); 7671 7672 /* 7673 * Load the item at the sum of the offset we've put in the 7674 * X register and the offset of the start of the link 7675 * layer header (which is 0 if the radio header is 7676 * variable-length; that header length is what we put 7677 * into the X register and then added to the index). 7678 */ 7679 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); 7680 tmp->s.k = cstate->off_linkhdr.constant_part; 7681 sappend(s, tmp); 7682 sappend(inst->s, s); 7683 break; 7684 7685 case Q_IP: 7686 case Q_ARP: 7687 case Q_RARP: 7688 case Q_ATALK: 7689 case Q_DECNET: 7690 case Q_SCA: 7691 case Q_LAT: 7692 case Q_MOPRC: 7693 case Q_MOPDL: 7694 case Q_IPV6: 7695 /* 7696 * The offset is relative to the beginning of 7697 * the network-layer header. 7698 * XXX - are there any cases where we want 7699 * cstate->off_nl_nosnap? 7700 */ 7701 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 7702 7703 /* 7704 * If "s" is non-null, it has code to arrange that the 7705 * X register contains the variable part of the offset 7706 * of the link-layer payload. Add to it the offset 7707 * computed into the register specified by "index", 7708 * and move that into the X register. Otherwise, just 7709 * load into the X register the offset computed into 7710 * the register specified by "index". 7711 */ 7712 if (s != NULL) { 7713 sappend(s, xfer_to_a(cstate, inst)); 7714 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7715 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7716 } else 7717 s = xfer_to_x(cstate, inst); 7718 7719 /* 7720 * Load the item at the sum of the offset we've put in the 7721 * X register, the offset of the start of the network 7722 * layer header from the beginning of the link-layer 7723 * payload, and the constant part of the offset of the 7724 * start of the link-layer payload. 7725 */ 7726 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); 7727 tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 7728 sappend(s, tmp); 7729 sappend(inst->s, s); 7730 7731 /* 7732 * Do the computation only if the packet contains 7733 * the protocol in question. 7734 */ 7735 b = gen_proto_abbrev_internal(cstate, proto); 7736 if (inst->b) 7737 gen_and(inst->b, b); 7738 inst->b = b; 7739 break; 7740 7741 case Q_SCTP: 7742 case Q_TCP: 7743 case Q_UDP: 7744 case Q_ICMP: 7745 case Q_IGMP: 7746 case Q_IGRP: 7747 case Q_PIM: 7748 case Q_VRRP: 7749 case Q_CARP: 7750 /* 7751 * The offset is relative to the beginning of 7752 * the transport-layer header. 7753 * 7754 * Load the X register with the length of the IPv4 header 7755 * (plus the offset of the link-layer header, if it's 7756 * a variable-length header), in bytes. 7757 * 7758 * XXX - are there any cases where we want 7759 * cstate->off_nl_nosnap? 7760 * XXX - we should, if we're built with 7761 * IPv6 support, generate code to load either 7762 * IPv4, IPv6, or both, as appropriate. 7763 */ 7764 s = gen_loadx_iphdrlen(cstate); 7765 7766 /* 7767 * The X register now contains the sum of the variable 7768 * part of the offset of the link-layer payload and the 7769 * length of the network-layer header. 7770 * 7771 * Load into the A register the offset relative to 7772 * the beginning of the transport layer header, 7773 * add the X register to that, move that to the 7774 * X register, and load with an offset from the 7775 * X register equal to the sum of the constant part of 7776 * the offset of the link-layer payload and the offset, 7777 * relative to the beginning of the link-layer payload, 7778 * of the network-layer header. 7779 */ 7780 sappend(s, xfer_to_a(cstate, inst)); 7781 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7782 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7783 sappend(s, tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code)); 7784 tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 7785 sappend(inst->s, s); 7786 7787 /* 7788 * Do the computation only if the packet contains 7789 * the protocol in question - which is true only 7790 * if this is an IP datagram and is the first or 7791 * only fragment of that datagram. 7792 */ 7793 gen_and(gen_proto_abbrev_internal(cstate, proto), b = gen_ipfrag(cstate)); 7794 if (inst->b) 7795 gen_and(inst->b, b); 7796 gen_and(gen_proto_abbrev_internal(cstate, Q_IP), b); 7797 inst->b = b; 7798 break; 7799 case Q_ICMPV6: 7800 /* 7801 * Do the computation only if the packet contains 7802 * the protocol in question. 7803 */ 7804 b = gen_proto_abbrev_internal(cstate, Q_IPV6); 7805 if (inst->b) 7806 gen_and(inst->b, b); 7807 inst->b = b; 7808 7809 /* 7810 * Check if we have an icmp6 next header 7811 */ 7812 b = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, 58); 7813 if (inst->b) 7814 gen_and(inst->b, b); 7815 inst->b = b; 7816 7817 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 7818 /* 7819 * If "s" is non-null, it has code to arrange that the 7820 * X register contains the variable part of the offset 7821 * of the link-layer payload. Add to it the offset 7822 * computed into the register specified by "index", 7823 * and move that into the X register. Otherwise, just 7824 * load into the X register the offset computed into 7825 * the register specified by "index". 7826 */ 7827 if (s != NULL) { 7828 sappend(s, xfer_to_a(cstate, inst)); 7829 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7830 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7831 } else 7832 s = xfer_to_x(cstate, inst); 7833 7834 /* 7835 * Load the item at the sum of the offset we've put in the 7836 * X register, the offset of the start of the network 7837 * layer header from the beginning of the link-layer 7838 * payload, and the constant part of the offset of the 7839 * start of the link-layer payload. 7840 */ 7841 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size_code); 7842 tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 40; 7843 7844 sappend(s, tmp); 7845 sappend(inst->s, s); 7846 7847 break; 7848 } 7849 inst->regno = regno; 7850 s = new_stmt(cstate, BPF_ST); 7851 s->s.k = regno; 7852 sappend(inst->s, s); 7853 7854 return inst; 7855 } 7856 7857 struct arth * 7858 gen_load(compiler_state_t *cstate, int proto, struct arth *inst, 7859 bpf_u_int32 size) 7860 { 7861 /* 7862 * Catch errors reported by us and routines below us, and return NULL 7863 * on an error. 7864 */ 7865 if (setjmp(cstate->top_ctx)) 7866 return (NULL); 7867 7868 return gen_load_internal(cstate, proto, inst, size); 7869 } 7870 7871 static struct block * 7872 gen_relation_internal(compiler_state_t *cstate, int code, struct arth *a0, 7873 struct arth *a1, int reversed) 7874 { 7875 struct slist *s0, *s1, *s2; 7876 struct block *b, *tmp; 7877 7878 s0 = xfer_to_x(cstate, a1); 7879 s1 = xfer_to_a(cstate, a0); 7880 if (code == BPF_JEQ) { 7881 s2 = new_stmt(cstate, BPF_ALU|BPF_SUB|BPF_X); 7882 b = new_block(cstate, JMP(code)); 7883 sappend(s1, s2); 7884 } 7885 else 7886 b = new_block(cstate, BPF_JMP|code|BPF_X); 7887 if (reversed) 7888 gen_not(b); 7889 7890 sappend(s0, s1); 7891 sappend(a1->s, s0); 7892 sappend(a0->s, a1->s); 7893 7894 b->stmts = a0->s; 7895 7896 free_reg(cstate, a0->regno); 7897 free_reg(cstate, a1->regno); 7898 7899 /* 'and' together protocol checks */ 7900 if (a0->b) { 7901 if (a1->b) { 7902 gen_and(a0->b, tmp = a1->b); 7903 } 7904 else 7905 tmp = a0->b; 7906 } else 7907 tmp = a1->b; 7908 7909 if (tmp) 7910 gen_and(tmp, b); 7911 7912 return b; 7913 } 7914 7915 struct block * 7916 gen_relation(compiler_state_t *cstate, int code, struct arth *a0, 7917 struct arth *a1, int reversed) 7918 { 7919 /* 7920 * Catch errors reported by us and routines below us, and return NULL 7921 * on an error. 7922 */ 7923 if (setjmp(cstate->top_ctx)) 7924 return (NULL); 7925 7926 return gen_relation_internal(cstate, code, a0, a1, reversed); 7927 } 7928 7929 struct arth * 7930 gen_loadlen(compiler_state_t *cstate) 7931 { 7932 int regno; 7933 struct arth *a; 7934 struct slist *s; 7935 7936 /* 7937 * Catch errors reported by us and routines below us, and return NULL 7938 * on an error. 7939 */ 7940 if (setjmp(cstate->top_ctx)) 7941 return (NULL); 7942 7943 regno = alloc_reg(cstate); 7944 a = (struct arth *)newchunk(cstate, sizeof(*a)); 7945 s = new_stmt(cstate, BPF_LD|BPF_LEN); 7946 s->next = new_stmt(cstate, BPF_ST); 7947 s->next->s.k = regno; 7948 a->s = s; 7949 a->regno = regno; 7950 7951 return a; 7952 } 7953 7954 static struct arth * 7955 gen_loadi_internal(compiler_state_t *cstate, bpf_u_int32 val) 7956 { 7957 struct arth *a; 7958 struct slist *s; 7959 int reg; 7960 7961 a = (struct arth *)newchunk(cstate, sizeof(*a)); 7962 7963 reg = alloc_reg(cstate); 7964 7965 s = new_stmt(cstate, BPF_LD|BPF_IMM); 7966 s->s.k = val; 7967 s->next = new_stmt(cstate, BPF_ST); 7968 s->next->s.k = reg; 7969 a->s = s; 7970 a->regno = reg; 7971 7972 return a; 7973 } 7974 7975 struct arth * 7976 gen_loadi(compiler_state_t *cstate, bpf_u_int32 val) 7977 { 7978 /* 7979 * Catch errors reported by us and routines below us, and return NULL 7980 * on an error. 7981 */ 7982 if (setjmp(cstate->top_ctx)) 7983 return (NULL); 7984 7985 return gen_loadi_internal(cstate, val); 7986 } 7987 7988 /* 7989 * The a_arg dance is to avoid annoying whining by compilers that 7990 * a might be clobbered by longjmp - yeah, it might, but *WHO CARES*? 7991 * It's not *used* after setjmp returns. 7992 */ 7993 struct arth * 7994 gen_neg(compiler_state_t *cstate, struct arth *a_arg) 7995 { 7996 struct arth *a = a_arg; 7997 struct slist *s; 7998 7999 /* 8000 * Catch errors reported by us and routines below us, and return NULL 8001 * on an error. 8002 */ 8003 if (setjmp(cstate->top_ctx)) 8004 return (NULL); 8005 8006 s = xfer_to_a(cstate, a); 8007 sappend(a->s, s); 8008 s = new_stmt(cstate, BPF_ALU|BPF_NEG); 8009 s->s.k = 0; 8010 sappend(a->s, s); 8011 s = new_stmt(cstate, BPF_ST); 8012 s->s.k = a->regno; 8013 sappend(a->s, s); 8014 8015 return a; 8016 } 8017 8018 /* 8019 * The a0_arg dance is to avoid annoying whining by compilers that 8020 * a0 might be clobbered by longjmp - yeah, it might, but *WHO CARES*? 8021 * It's not *used* after setjmp returns. 8022 */ 8023 struct arth * 8024 gen_arth(compiler_state_t *cstate, int code, struct arth *a0_arg, 8025 struct arth *a1) 8026 { 8027 struct arth *a0 = a0_arg; 8028 struct slist *s0, *s1, *s2; 8029 8030 /* 8031 * Catch errors reported by us and routines below us, and return NULL 8032 * on an error. 8033 */ 8034 if (setjmp(cstate->top_ctx)) 8035 return (NULL); 8036 8037 /* 8038 * Disallow division by, or modulus by, zero; we do this here 8039 * so that it gets done even if the optimizer is disabled. 8040 * 8041 * Also disallow shifts by a value greater than 31; we do this 8042 * here, for the same reason. 8043 */ 8044 if (code == BPF_DIV) { 8045 if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) 8046 bpf_error(cstate, "division by zero"); 8047 } else if (code == BPF_MOD) { 8048 if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) 8049 bpf_error(cstate, "modulus by zero"); 8050 } else if (code == BPF_LSH || code == BPF_RSH) { 8051 if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k > 31) 8052 bpf_error(cstate, "shift by more than 31 bits"); 8053 } 8054 s0 = xfer_to_x(cstate, a1); 8055 s1 = xfer_to_a(cstate, a0); 8056 s2 = new_stmt(cstate, BPF_ALU|BPF_X|code); 8057 8058 sappend(s1, s2); 8059 sappend(s0, s1); 8060 sappend(a1->s, s0); 8061 sappend(a0->s, a1->s); 8062 8063 free_reg(cstate, a0->regno); 8064 free_reg(cstate, a1->regno); 8065 8066 s0 = new_stmt(cstate, BPF_ST); 8067 a0->regno = s0->s.k = alloc_reg(cstate); 8068 sappend(a0->s, s0); 8069 8070 return a0; 8071 } 8072 8073 /* 8074 * Initialize the table of used registers and the current register. 8075 */ 8076 static void 8077 init_regs(compiler_state_t *cstate) 8078 { 8079 cstate->curreg = 0; 8080 memset(cstate->regused, 0, sizeof cstate->regused); 8081 } 8082 8083 /* 8084 * Return the next free register. 8085 */ 8086 static int 8087 alloc_reg(compiler_state_t *cstate) 8088 { 8089 int n = BPF_MEMWORDS; 8090 8091 while (--n >= 0) { 8092 if (cstate->regused[cstate->curreg]) 8093 cstate->curreg = (cstate->curreg + 1) % BPF_MEMWORDS; 8094 else { 8095 cstate->regused[cstate->curreg] = 1; 8096 return cstate->curreg; 8097 } 8098 } 8099 bpf_error(cstate, "too many registers needed to evaluate expression"); 8100 /*NOTREACHED*/ 8101 } 8102 8103 /* 8104 * Return a register to the table so it can 8105 * be used later. 8106 */ 8107 static void 8108 free_reg(compiler_state_t *cstate, int n) 8109 { 8110 cstate->regused[n] = 0; 8111 } 8112 8113 static struct block * 8114 gen_len(compiler_state_t *cstate, int jmp, int n) 8115 { 8116 struct slist *s; 8117 struct block *b; 8118 8119 s = new_stmt(cstate, BPF_LD|BPF_LEN); 8120 b = new_block(cstate, JMP(jmp)); 8121 b->stmts = s; 8122 b->s.k = n; 8123 8124 return b; 8125 } 8126 8127 struct block * 8128 gen_greater(compiler_state_t *cstate, int n) 8129 { 8130 /* 8131 * Catch errors reported by us and routines below us, and return NULL 8132 * on an error. 8133 */ 8134 if (setjmp(cstate->top_ctx)) 8135 return (NULL); 8136 8137 return gen_len(cstate, BPF_JGE, n); 8138 } 8139 8140 /* 8141 * Actually, this is less than or equal. 8142 */ 8143 struct block * 8144 gen_less(compiler_state_t *cstate, int n) 8145 { 8146 struct block *b; 8147 8148 /* 8149 * Catch errors reported by us and routines below us, and return NULL 8150 * on an error. 8151 */ 8152 if (setjmp(cstate->top_ctx)) 8153 return (NULL); 8154 8155 b = gen_len(cstate, BPF_JGT, n); 8156 gen_not(b); 8157 8158 return b; 8159 } 8160 8161 /* 8162 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to 8163 * the beginning of the link-layer header. 8164 * XXX - that means you can't test values in the radiotap header, but 8165 * as that header is difficult if not impossible to parse generally 8166 * without a loop, that might not be a severe problem. A new keyword 8167 * "radio" could be added for that, although what you'd really want 8168 * would be a way of testing particular radio header values, which 8169 * would generate code appropriate to the radio header in question. 8170 */ 8171 struct block * 8172 gen_byteop(compiler_state_t *cstate, int op, int idx, bpf_u_int32 val) 8173 { 8174 struct block *b; 8175 struct slist *s; 8176 8177 /* 8178 * Catch errors reported by us and routines below us, and return NULL 8179 * on an error. 8180 */ 8181 if (setjmp(cstate->top_ctx)) 8182 return (NULL); 8183 8184 switch (op) { 8185 default: 8186 abort(); 8187 8188 case '=': 8189 return gen_cmp(cstate, OR_LINKHDR, (u_int)idx, BPF_B, val); 8190 8191 case '<': 8192 b = gen_cmp_lt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, val); 8193 return b; 8194 8195 case '>': 8196 b = gen_cmp_gt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, val); 8197 return b; 8198 8199 case '|': 8200 s = new_stmt(cstate, BPF_ALU|BPF_OR|BPF_K); 8201 break; 8202 8203 case '&': 8204 s = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 8205 break; 8206 } 8207 s->s.k = val; 8208 b = new_block(cstate, JMP(BPF_JEQ)); 8209 b->stmts = s; 8210 gen_not(b); 8211 8212 return b; 8213 } 8214 8215 static const u_char abroadcast[] = { 0x0 }; 8216 8217 struct block * 8218 gen_broadcast(compiler_state_t *cstate, int proto) 8219 { 8220 bpf_u_int32 hostmask; 8221 struct block *b0, *b1, *b2; 8222 static const u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 8223 8224 /* 8225 * Catch errors reported by us and routines below us, and return NULL 8226 * on an error. 8227 */ 8228 if (setjmp(cstate->top_ctx)) 8229 return (NULL); 8230 8231 switch (proto) { 8232 8233 case Q_DEFAULT: 8234 case Q_LINK: 8235 switch (cstate->linktype) { 8236 case DLT_ARCNET: 8237 case DLT_ARCNET_LINUX: 8238 return gen_ahostop(cstate, abroadcast, Q_DST); 8239 case DLT_EN10MB: 8240 case DLT_NETANALYZER: 8241 case DLT_NETANALYZER_TRANSPARENT: 8242 b1 = gen_prevlinkhdr_check(cstate); 8243 b0 = gen_ehostop(cstate, ebroadcast, Q_DST); 8244 if (b1 != NULL) 8245 gen_and(b1, b0); 8246 return b0; 8247 case DLT_FDDI: 8248 return gen_fhostop(cstate, ebroadcast, Q_DST); 8249 case DLT_IEEE802: 8250 return gen_thostop(cstate, ebroadcast, Q_DST); 8251 case DLT_IEEE802_11: 8252 case DLT_PRISM_HEADER: 8253 case DLT_IEEE802_11_RADIO_AVS: 8254 case DLT_IEEE802_11_RADIO: 8255 case DLT_PPI: 8256 return gen_wlanhostop(cstate, ebroadcast, Q_DST); 8257 case DLT_IP_OVER_FC: 8258 return gen_ipfchostop(cstate, ebroadcast, Q_DST); 8259 default: 8260 bpf_error(cstate, "not a broadcast link"); 8261 } 8262 /*NOTREACHED*/ 8263 8264 case Q_IP: 8265 /* 8266 * We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff) 8267 * as an indication that we don't know the netmask, and fail 8268 * in that case. 8269 */ 8270 if (cstate->netmask == PCAP_NETMASK_UNKNOWN) 8271 bpf_error(cstate, "netmask not known, so 'ip broadcast' not supported"); 8272 b0 = gen_linktype(cstate, ETHERTYPE_IP); 8273 hostmask = ~cstate->netmask; 8274 b1 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, 0, hostmask); 8275 b2 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, 8276 ~0 & hostmask, hostmask); 8277 gen_or(b1, b2); 8278 gen_and(b0, b2); 8279 return b2; 8280 } 8281 bpf_error(cstate, "only link-layer/IP broadcast filters supported"); 8282 /*NOTREACHED*/ 8283 } 8284 8285 /* 8286 * Generate code to test the low-order bit of a MAC address (that's 8287 * the bottom bit of the *first* byte). 8288 */ 8289 static struct block * 8290 gen_mac_multicast(compiler_state_t *cstate, int offset) 8291 { 8292 register struct block *b0; 8293 register struct slist *s; 8294 8295 /* link[offset] & 1 != 0 */ 8296 s = gen_load_a(cstate, OR_LINKHDR, offset, BPF_B); 8297 b0 = new_block(cstate, JMP(BPF_JSET)); 8298 b0->s.k = 1; 8299 b0->stmts = s; 8300 return b0; 8301 } 8302 8303 struct block * 8304 gen_multicast(compiler_state_t *cstate, int proto) 8305 { 8306 register struct block *b0, *b1, *b2; 8307 register struct slist *s; 8308 8309 /* 8310 * Catch errors reported by us and routines below us, and return NULL 8311 * on an error. 8312 */ 8313 if (setjmp(cstate->top_ctx)) 8314 return (NULL); 8315 8316 switch (proto) { 8317 8318 case Q_DEFAULT: 8319 case Q_LINK: 8320 switch (cstate->linktype) { 8321 case DLT_ARCNET: 8322 case DLT_ARCNET_LINUX: 8323 /* all ARCnet multicasts use the same address */ 8324 return gen_ahostop(cstate, abroadcast, Q_DST); 8325 case DLT_EN10MB: 8326 case DLT_NETANALYZER: 8327 case DLT_NETANALYZER_TRANSPARENT: 8328 b1 = gen_prevlinkhdr_check(cstate); 8329 /* ether[0] & 1 != 0 */ 8330 b0 = gen_mac_multicast(cstate, 0); 8331 if (b1 != NULL) 8332 gen_and(b1, b0); 8333 return b0; 8334 case DLT_FDDI: 8335 /* 8336 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX 8337 * 8338 * XXX - was that referring to bit-order issues? 8339 */ 8340 /* fddi[1] & 1 != 0 */ 8341 return gen_mac_multicast(cstate, 1); 8342 case DLT_IEEE802: 8343 /* tr[2] & 1 != 0 */ 8344 return gen_mac_multicast(cstate, 2); 8345 case DLT_IEEE802_11: 8346 case DLT_PRISM_HEADER: 8347 case DLT_IEEE802_11_RADIO_AVS: 8348 case DLT_IEEE802_11_RADIO: 8349 case DLT_PPI: 8350 /* 8351 * Oh, yuk. 8352 * 8353 * For control frames, there is no DA. 8354 * 8355 * For management frames, DA is at an 8356 * offset of 4 from the beginning of 8357 * the packet. 8358 * 8359 * For data frames, DA is at an offset 8360 * of 4 from the beginning of the packet 8361 * if To DS is clear and at an offset of 8362 * 16 from the beginning of the packet 8363 * if To DS is set. 8364 */ 8365 8366 /* 8367 * Generate the tests to be done for data frames. 8368 * 8369 * First, check for To DS set, i.e. "link[1] & 0x01". 8370 */ 8371 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 8372 b1 = new_block(cstate, JMP(BPF_JSET)); 8373 b1->s.k = 0x01; /* To DS */ 8374 b1->stmts = s; 8375 8376 /* 8377 * If To DS is set, the DA is at 16. 8378 */ 8379 b0 = gen_mac_multicast(cstate, 16); 8380 gen_and(b1, b0); 8381 8382 /* 8383 * Now, check for To DS not set, i.e. check 8384 * "!(link[1] & 0x01)". 8385 */ 8386 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 8387 b2 = new_block(cstate, JMP(BPF_JSET)); 8388 b2->s.k = 0x01; /* To DS */ 8389 b2->stmts = s; 8390 gen_not(b2); 8391 8392 /* 8393 * If To DS is not set, the DA is at 4. 8394 */ 8395 b1 = gen_mac_multicast(cstate, 4); 8396 gen_and(b2, b1); 8397 8398 /* 8399 * Now OR together the last two checks. That gives 8400 * the complete set of checks for data frames. 8401 */ 8402 gen_or(b1, b0); 8403 8404 /* 8405 * Now check for a data frame. 8406 * I.e, check "link[0] & 0x08". 8407 */ 8408 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 8409 b1 = new_block(cstate, JMP(BPF_JSET)); 8410 b1->s.k = 0x08; 8411 b1->stmts = s; 8412 8413 /* 8414 * AND that with the checks done for data frames. 8415 */ 8416 gen_and(b1, b0); 8417 8418 /* 8419 * If the high-order bit of the type value is 0, this 8420 * is a management frame. 8421 * I.e, check "!(link[0] & 0x08)". 8422 */ 8423 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 8424 b2 = new_block(cstate, JMP(BPF_JSET)); 8425 b2->s.k = 0x08; 8426 b2->stmts = s; 8427 gen_not(b2); 8428 8429 /* 8430 * For management frames, the DA is at 4. 8431 */ 8432 b1 = gen_mac_multicast(cstate, 4); 8433 gen_and(b2, b1); 8434 8435 /* 8436 * OR that with the checks done for data frames. 8437 * That gives the checks done for management and 8438 * data frames. 8439 */ 8440 gen_or(b1, b0); 8441 8442 /* 8443 * If the low-order bit of the type value is 1, 8444 * this is either a control frame or a frame 8445 * with a reserved type, and thus not a 8446 * frame with an SA. 8447 * 8448 * I.e., check "!(link[0] & 0x04)". 8449 */ 8450 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 8451 b1 = new_block(cstate, JMP(BPF_JSET)); 8452 b1->s.k = 0x04; 8453 b1->stmts = s; 8454 gen_not(b1); 8455 8456 /* 8457 * AND that with the checks for data and management 8458 * frames. 8459 */ 8460 gen_and(b1, b0); 8461 return b0; 8462 case DLT_IP_OVER_FC: 8463 b0 = gen_mac_multicast(cstate, 2); 8464 return b0; 8465 default: 8466 break; 8467 } 8468 /* Link not known to support multicasts */ 8469 break; 8470 8471 case Q_IP: 8472 b0 = gen_linktype(cstate, ETHERTYPE_IP); 8473 b1 = gen_cmp_ge(cstate, OR_LINKPL, 16, BPF_B, 224); 8474 gen_and(b0, b1); 8475 return b1; 8476 8477 case Q_IPV6: 8478 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 8479 b1 = gen_cmp(cstate, OR_LINKPL, 24, BPF_B, 255); 8480 gen_and(b0, b1); 8481 return b1; 8482 } 8483 bpf_error(cstate, "link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel"); 8484 /*NOTREACHED*/ 8485 } 8486 8487 struct block * 8488 gen_ifindex(compiler_state_t *cstate, int ifindex) 8489 { 8490 register struct block *b0; 8491 8492 /* 8493 * Catch errors reported by us and routines below us, and return NULL 8494 * on an error. 8495 */ 8496 if (setjmp(cstate->top_ctx)) 8497 return (NULL); 8498 8499 /* 8500 * Only some data link types support ifindex qualifiers. 8501 */ 8502 switch (cstate->linktype) { 8503 case DLT_LINUX_SLL2: 8504 /* match packets on this interface */ 8505 b0 = gen_cmp(cstate, OR_LINKHDR, 4, BPF_W, ifindex); 8506 break; 8507 default: 8508 #if defined(__linux__) 8509 /* 8510 * This is Linux; we require PF_PACKET support. 8511 * If this is a *live* capture, we can look at 8512 * special meta-data in the filter expression; 8513 * if it's a savefile, we can't. 8514 */ 8515 if (cstate->bpf_pcap->rfile != NULL) { 8516 /* We have a FILE *, so this is a savefile */ 8517 bpf_error(cstate, "ifindex not supported on %s when reading savefiles", 8518 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 8519 /*NOTREACHED*/ 8520 } 8521 /* match ifindex */ 8522 b0 = gen_cmp(cstate, OR_LINKHDR, SKF_AD_OFF + SKF_AD_IFINDEX, BPF_W, 8523 ifindex); 8524 #else /* defined(__linux__) */ 8525 bpf_error(cstate, "ifindex not supported on %s", 8526 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 8527 /*NOTREACHED*/ 8528 #endif /* defined(__linux__) */ 8529 } 8530 return (b0); 8531 } 8532 8533 /* 8534 * Filter on inbound (dir == 0) or outbound (dir == 1) traffic. 8535 * Outbound traffic is sent by this machine, while inbound traffic is 8536 * sent by a remote machine (and may include packets destined for a 8537 * unicast or multicast link-layer address we are not subscribing to). 8538 * These are the same definitions implemented by pcap_setdirection(). 8539 * Capturing only unicast traffic destined for this host is probably 8540 * better accomplished using a higher-layer filter. 8541 */ 8542 struct block * 8543 gen_inbound(compiler_state_t *cstate, int dir) 8544 { 8545 register struct block *b0; 8546 8547 /* 8548 * Catch errors reported by us and routines below us, and return NULL 8549 * on an error. 8550 */ 8551 if (setjmp(cstate->top_ctx)) 8552 return (NULL); 8553 8554 /* 8555 * Only some data link types support inbound/outbound qualifiers. 8556 */ 8557 switch (cstate->linktype) { 8558 case DLT_SLIP: 8559 b0 = gen_relation_internal(cstate, BPF_JEQ, 8560 gen_load_internal(cstate, Q_LINK, gen_loadi_internal(cstate, 0), 1), 8561 gen_loadi_internal(cstate, 0), 8562 dir); 8563 break; 8564 8565 case DLT_IPNET: 8566 if (dir) { 8567 /* match outgoing packets */ 8568 b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, IPNET_OUTBOUND); 8569 } else { 8570 /* match incoming packets */ 8571 b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, IPNET_INBOUND); 8572 } 8573 break; 8574 8575 case DLT_LINUX_SLL: 8576 /* match outgoing packets */ 8577 b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_H, LINUX_SLL_OUTGOING); 8578 if (!dir) { 8579 /* to filter on inbound traffic, invert the match */ 8580 gen_not(b0); 8581 } 8582 break; 8583 8584 case DLT_LINUX_SLL2: 8585 /* match outgoing packets */ 8586 b0 = gen_cmp(cstate, OR_LINKHDR, 10, BPF_B, LINUX_SLL_OUTGOING); 8587 if (!dir) { 8588 /* to filter on inbound traffic, invert the match */ 8589 gen_not(b0); 8590 } 8591 break; 8592 8593 case DLT_PFLOG: 8594 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, dir), BPF_B, 8595 ((dir == 0) ? PF_IN : PF_OUT)); 8596 break; 8597 8598 case DLT_PPP_PPPD: 8599 if (dir) { 8600 /* match outgoing packets */ 8601 b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_B, PPP_PPPD_OUT); 8602 } else { 8603 /* match incoming packets */ 8604 b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_B, PPP_PPPD_IN); 8605 } 8606 break; 8607 8608 case DLT_JUNIPER_MFR: 8609 case DLT_JUNIPER_MLFR: 8610 case DLT_JUNIPER_MLPPP: 8611 case DLT_JUNIPER_ATM1: 8612 case DLT_JUNIPER_ATM2: 8613 case DLT_JUNIPER_PPPOE: 8614 case DLT_JUNIPER_PPPOE_ATM: 8615 case DLT_JUNIPER_GGSN: 8616 case DLT_JUNIPER_ES: 8617 case DLT_JUNIPER_MONITOR: 8618 case DLT_JUNIPER_SERVICES: 8619 case DLT_JUNIPER_ETHER: 8620 case DLT_JUNIPER_PPP: 8621 case DLT_JUNIPER_FRELAY: 8622 case DLT_JUNIPER_CHDLC: 8623 case DLT_JUNIPER_VP: 8624 case DLT_JUNIPER_ST: 8625 case DLT_JUNIPER_ISM: 8626 case DLT_JUNIPER_VS: 8627 case DLT_JUNIPER_SRX_E2E: 8628 case DLT_JUNIPER_FIBRECHANNEL: 8629 case DLT_JUNIPER_ATM_CEMIC: 8630 8631 /* juniper flags (including direction) are stored 8632 * the byte after the 3-byte magic number */ 8633 if (dir) { 8634 /* match outgoing packets */ 8635 b0 = gen_mcmp(cstate, OR_LINKHDR, 3, BPF_B, 0, 0x01); 8636 } else { 8637 /* match incoming packets */ 8638 b0 = gen_mcmp(cstate, OR_LINKHDR, 3, BPF_B, 1, 0x01); 8639 } 8640 break; 8641 8642 default: 8643 /* 8644 * If we have packet meta-data indicating a direction, 8645 * and that metadata can be checked by BPF code, check 8646 * it. Otherwise, give up, as this link-layer type has 8647 * nothing in the packet data. 8648 * 8649 * Currently, the only platform where a BPF filter can 8650 * check that metadata is Linux with the in-kernel 8651 * BPF interpreter. If other packet capture mechanisms 8652 * and BPF filters also supported this, it would be 8653 * nice. It would be even better if they made that 8654 * metadata available so that we could provide it 8655 * with newer capture APIs, allowing it to be saved 8656 * in pcapng files. 8657 */ 8658 #if defined(__linux__) 8659 /* 8660 * This is Linux; we require PF_PACKET support. 8661 * If this is a *live* capture, we can look at 8662 * special meta-data in the filter expression; 8663 * if it's a savefile, we can't. 8664 */ 8665 if (cstate->bpf_pcap->rfile != NULL) { 8666 /* We have a FILE *, so this is a savefile */ 8667 bpf_error(cstate, "inbound/outbound not supported on %s when reading savefiles", 8668 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 8669 /*NOTREACHED*/ 8670 } 8671 /* match outgoing packets */ 8672 b0 = gen_cmp(cstate, OR_LINKHDR, SKF_AD_OFF + SKF_AD_PKTTYPE, BPF_H, 8673 PACKET_OUTGOING); 8674 if (!dir) { 8675 /* to filter on inbound traffic, invert the match */ 8676 gen_not(b0); 8677 } 8678 #else /* defined(__linux__) */ 8679 bpf_error(cstate, "inbound/outbound not supported on %s", 8680 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 8681 /*NOTREACHED*/ 8682 #endif /* defined(__linux__) */ 8683 } 8684 return (b0); 8685 } 8686 8687 /* PF firewall log matched interface */ 8688 struct block * 8689 gen_pf_ifname(compiler_state_t *cstate, const char *ifname) 8690 { 8691 struct block *b0; 8692 u_int len, off; 8693 8694 /* 8695 * Catch errors reported by us and routines below us, and return NULL 8696 * on an error. 8697 */ 8698 if (setjmp(cstate->top_ctx)) 8699 return (NULL); 8700 8701 if (cstate->linktype != DLT_PFLOG) { 8702 bpf_error(cstate, "ifname supported only on PF linktype"); 8703 /*NOTREACHED*/ 8704 } 8705 len = sizeof(((struct pfloghdr *)0)->ifname); 8706 off = offsetof(struct pfloghdr, ifname); 8707 if (strlen(ifname) >= len) { 8708 bpf_error(cstate, "ifname interface names can only be %d characters", 8709 len-1); 8710 /*NOTREACHED*/ 8711 } 8712 b0 = gen_bcmp(cstate, OR_LINKHDR, off, (u_int)strlen(ifname), 8713 (const u_char *)ifname); 8714 return (b0); 8715 } 8716 8717 /* PF firewall log ruleset name */ 8718 struct block * 8719 gen_pf_ruleset(compiler_state_t *cstate, char *ruleset) 8720 { 8721 struct block *b0; 8722 8723 /* 8724 * Catch errors reported by us and routines below us, and return NULL 8725 * on an error. 8726 */ 8727 if (setjmp(cstate->top_ctx)) 8728 return (NULL); 8729 8730 if (cstate->linktype != DLT_PFLOG) { 8731 bpf_error(cstate, "ruleset supported only on PF linktype"); 8732 /*NOTREACHED*/ 8733 } 8734 8735 if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) { 8736 bpf_error(cstate, "ruleset names can only be %ld characters", 8737 (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1)); 8738 /*NOTREACHED*/ 8739 } 8740 8741 b0 = gen_bcmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, ruleset), 8742 (u_int)strlen(ruleset), (const u_char *)ruleset); 8743 return (b0); 8744 } 8745 8746 /* PF firewall log rule number */ 8747 struct block * 8748 gen_pf_rnr(compiler_state_t *cstate, int rnr) 8749 { 8750 struct block *b0; 8751 8752 /* 8753 * Catch errors reported by us and routines below us, and return NULL 8754 * on an error. 8755 */ 8756 if (setjmp(cstate->top_ctx)) 8757 return (NULL); 8758 8759 if (cstate->linktype != DLT_PFLOG) { 8760 bpf_error(cstate, "rnr supported only on PF linktype"); 8761 /*NOTREACHED*/ 8762 } 8763 8764 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, rulenr), BPF_W, 8765 (bpf_u_int32)rnr); 8766 return (b0); 8767 } 8768 8769 /* PF firewall log sub-rule number */ 8770 struct block * 8771 gen_pf_srnr(compiler_state_t *cstate, int srnr) 8772 { 8773 struct block *b0; 8774 8775 /* 8776 * Catch errors reported by us and routines below us, and return NULL 8777 * on an error. 8778 */ 8779 if (setjmp(cstate->top_ctx)) 8780 return (NULL); 8781 8782 if (cstate->linktype != DLT_PFLOG) { 8783 bpf_error(cstate, "srnr supported only on PF linktype"); 8784 /*NOTREACHED*/ 8785 } 8786 8787 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, subrulenr), BPF_W, 8788 (bpf_u_int32)srnr); 8789 return (b0); 8790 } 8791 8792 /* PF firewall log reason code */ 8793 struct block * 8794 gen_pf_reason(compiler_state_t *cstate, int reason) 8795 { 8796 struct block *b0; 8797 8798 /* 8799 * Catch errors reported by us and routines below us, and return NULL 8800 * on an error. 8801 */ 8802 if (setjmp(cstate->top_ctx)) 8803 return (NULL); 8804 8805 if (cstate->linktype != DLT_PFLOG) { 8806 bpf_error(cstate, "reason supported only on PF linktype"); 8807 /*NOTREACHED*/ 8808 } 8809 8810 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, reason), BPF_B, 8811 (bpf_u_int32)reason); 8812 return (b0); 8813 } 8814 8815 /* PF firewall log action */ 8816 struct block * 8817 gen_pf_action(compiler_state_t *cstate, int action) 8818 { 8819 struct block *b0; 8820 8821 /* 8822 * Catch errors reported by us and routines below us, and return NULL 8823 * on an error. 8824 */ 8825 if (setjmp(cstate->top_ctx)) 8826 return (NULL); 8827 8828 if (cstate->linktype != DLT_PFLOG) { 8829 bpf_error(cstate, "action supported only on PF linktype"); 8830 /*NOTREACHED*/ 8831 } 8832 8833 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, action), BPF_B, 8834 (bpf_u_int32)action); 8835 return (b0); 8836 } 8837 8838 /* IEEE 802.11 wireless header */ 8839 struct block * 8840 gen_p80211_type(compiler_state_t *cstate, bpf_u_int32 type, bpf_u_int32 mask) 8841 { 8842 struct block *b0; 8843 8844 /* 8845 * Catch errors reported by us and routines below us, and return NULL 8846 * on an error. 8847 */ 8848 if (setjmp(cstate->top_ctx)) 8849 return (NULL); 8850 8851 switch (cstate->linktype) { 8852 8853 case DLT_IEEE802_11: 8854 case DLT_PRISM_HEADER: 8855 case DLT_IEEE802_11_RADIO_AVS: 8856 case DLT_IEEE802_11_RADIO: 8857 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, type, mask); 8858 break; 8859 8860 default: 8861 bpf_error(cstate, "802.11 link-layer types supported only on 802.11"); 8862 /*NOTREACHED*/ 8863 } 8864 8865 return (b0); 8866 } 8867 8868 struct block * 8869 gen_p80211_fcdir(compiler_state_t *cstate, bpf_u_int32 fcdir) 8870 { 8871 struct block *b0; 8872 8873 /* 8874 * Catch errors reported by us and routines below us, and return NULL 8875 * on an error. 8876 */ 8877 if (setjmp(cstate->top_ctx)) 8878 return (NULL); 8879 8880 switch (cstate->linktype) { 8881 8882 case DLT_IEEE802_11: 8883 case DLT_PRISM_HEADER: 8884 case DLT_IEEE802_11_RADIO_AVS: 8885 case DLT_IEEE802_11_RADIO: 8886 break; 8887 8888 default: 8889 bpf_error(cstate, "frame direction supported only with 802.11 headers"); 8890 /*NOTREACHED*/ 8891 } 8892 8893 b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, fcdir, 8894 IEEE80211_FC1_DIR_MASK); 8895 8896 return (b0); 8897 } 8898 8899 struct block * 8900 gen_acode(compiler_state_t *cstate, const char *s, struct qual q) 8901 { 8902 struct block *b; 8903 8904 /* 8905 * Catch errors reported by us and routines below us, and return NULL 8906 * on an error. 8907 */ 8908 if (setjmp(cstate->top_ctx)) 8909 return (NULL); 8910 8911 switch (cstate->linktype) { 8912 8913 case DLT_ARCNET: 8914 case DLT_ARCNET_LINUX: 8915 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && 8916 q.proto == Q_LINK) { 8917 cstate->e = pcap_ether_aton(s); 8918 if (cstate->e == NULL) 8919 bpf_error(cstate, "malloc"); 8920 b = gen_ahostop(cstate, cstate->e, (int)q.dir); 8921 free(cstate->e); 8922 cstate->e = NULL; 8923 return (b); 8924 } else 8925 bpf_error(cstate, "ARCnet address used in non-arc expression"); 8926 /*NOTREACHED*/ 8927 8928 default: 8929 bpf_error(cstate, "aid supported only on ARCnet"); 8930 /*NOTREACHED*/ 8931 } 8932 } 8933 8934 static struct block * 8935 gen_ahostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 8936 { 8937 register struct block *b0, *b1; 8938 8939 switch (dir) { 8940 /* src comes first, different from Ethernet */ 8941 case Q_SRC: 8942 return gen_bcmp(cstate, OR_LINKHDR, 0, 1, eaddr); 8943 8944 case Q_DST: 8945 return gen_bcmp(cstate, OR_LINKHDR, 1, 1, eaddr); 8946 8947 case Q_AND: 8948 b0 = gen_ahostop(cstate, eaddr, Q_SRC); 8949 b1 = gen_ahostop(cstate, eaddr, Q_DST); 8950 gen_and(b0, b1); 8951 return b1; 8952 8953 case Q_DEFAULT: 8954 case Q_OR: 8955 b0 = gen_ahostop(cstate, eaddr, Q_SRC); 8956 b1 = gen_ahostop(cstate, eaddr, Q_DST); 8957 gen_or(b0, b1); 8958 return b1; 8959 8960 case Q_ADDR1: 8961 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 8962 /*NOTREACHED*/ 8963 8964 case Q_ADDR2: 8965 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 8966 /*NOTREACHED*/ 8967 8968 case Q_ADDR3: 8969 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 8970 /*NOTREACHED*/ 8971 8972 case Q_ADDR4: 8973 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 8974 /*NOTREACHED*/ 8975 8976 case Q_RA: 8977 bpf_error(cstate, "'ra' is only supported on 802.11"); 8978 /*NOTREACHED*/ 8979 8980 case Q_TA: 8981 bpf_error(cstate, "'ta' is only supported on 802.11"); 8982 /*NOTREACHED*/ 8983 } 8984 abort(); 8985 /*NOTREACHED*/ 8986 } 8987 8988 static struct block * 8989 gen_vlan_tpid_test(compiler_state_t *cstate) 8990 { 8991 struct block *b0, *b1; 8992 8993 /* check for VLAN, including 802.1ad and QinQ */ 8994 b0 = gen_linktype(cstate, ETHERTYPE_8021Q); 8995 b1 = gen_linktype(cstate, ETHERTYPE_8021AD); 8996 gen_or(b0,b1); 8997 b0 = b1; 8998 b1 = gen_linktype(cstate, ETHERTYPE_8021QINQ); 8999 gen_or(b0,b1); 9000 9001 return b1; 9002 } 9003 9004 static struct block * 9005 gen_vlan_vid_test(compiler_state_t *cstate, bpf_u_int32 vlan_num) 9006 { 9007 if (vlan_num > 0x0fff) { 9008 bpf_error(cstate, "VLAN tag %u greater than maximum %u", 9009 vlan_num, 0x0fff); 9010 } 9011 return gen_mcmp(cstate, OR_LINKPL, 0, BPF_H, vlan_num, 0x0fff); 9012 } 9013 9014 static struct block * 9015 gen_vlan_no_bpf_extensions(compiler_state_t *cstate, bpf_u_int32 vlan_num, 9016 int has_vlan_tag) 9017 { 9018 struct block *b0, *b1; 9019 9020 b0 = gen_vlan_tpid_test(cstate); 9021 9022 if (has_vlan_tag) { 9023 b1 = gen_vlan_vid_test(cstate, vlan_num); 9024 gen_and(b0, b1); 9025 b0 = b1; 9026 } 9027 9028 /* 9029 * Both payload and link header type follow the VLAN tags so that 9030 * both need to be updated. 9031 */ 9032 cstate->off_linkpl.constant_part += 4; 9033 cstate->off_linktype.constant_part += 4; 9034 9035 return b0; 9036 } 9037 9038 #if defined(SKF_AD_VLAN_TAG_PRESENT) 9039 /* add v to variable part of off */ 9040 static void 9041 gen_vlan_vloffset_add(compiler_state_t *cstate, bpf_abs_offset *off, 9042 bpf_u_int32 v, struct slist *s) 9043 { 9044 struct slist *s2; 9045 9046 if (!off->is_variable) 9047 off->is_variable = 1; 9048 if (off->reg == -1) 9049 off->reg = alloc_reg(cstate); 9050 9051 s2 = new_stmt(cstate, BPF_LD|BPF_MEM); 9052 s2->s.k = off->reg; 9053 sappend(s, s2); 9054 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_IMM); 9055 s2->s.k = v; 9056 sappend(s, s2); 9057 s2 = new_stmt(cstate, BPF_ST); 9058 s2->s.k = off->reg; 9059 sappend(s, s2); 9060 } 9061 9062 /* 9063 * patch block b_tpid (VLAN TPID test) to update variable parts of link payload 9064 * and link type offsets first 9065 */ 9066 static void 9067 gen_vlan_patch_tpid_test(compiler_state_t *cstate, struct block *b_tpid) 9068 { 9069 struct slist s; 9070 9071 /* offset determined at run time, shift variable part */ 9072 s.next = NULL; 9073 cstate->is_vlan_vloffset = 1; 9074 gen_vlan_vloffset_add(cstate, &cstate->off_linkpl, 4, &s); 9075 gen_vlan_vloffset_add(cstate, &cstate->off_linktype, 4, &s); 9076 9077 /* we get a pointer to a chain of or-ed blocks, patch first of them */ 9078 sappend(s.next, b_tpid->head->stmts); 9079 b_tpid->head->stmts = s.next; 9080 } 9081 9082 /* 9083 * patch block b_vid (VLAN id test) to load VID value either from packet 9084 * metadata (using BPF extensions) if SKF_AD_VLAN_TAG_PRESENT is true 9085 */ 9086 static void 9087 gen_vlan_patch_vid_test(compiler_state_t *cstate, struct block *b_vid) 9088 { 9089 struct slist *s, *s2, *sjeq; 9090 unsigned cnt; 9091 9092 s = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 9093 s->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT; 9094 9095 /* true -> next instructions, false -> beginning of b_vid */ 9096 sjeq = new_stmt(cstate, JMP(BPF_JEQ)); 9097 sjeq->s.k = 1; 9098 sjeq->s.jf = b_vid->stmts; 9099 sappend(s, sjeq); 9100 9101 s2 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 9102 s2->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG; 9103 sappend(s, s2); 9104 sjeq->s.jt = s2; 9105 9106 /* Jump to the test in b_vid. We need to jump one instruction before 9107 * the end of the b_vid block so that we only skip loading the TCI 9108 * from packet data and not the 'and' instruction extracting VID. 9109 */ 9110 cnt = 0; 9111 for (s2 = b_vid->stmts; s2; s2 = s2->next) 9112 cnt++; 9113 s2 = new_stmt(cstate, JMP(BPF_JA)); 9114 s2->s.k = cnt - 1; 9115 sappend(s, s2); 9116 9117 /* insert our statements at the beginning of b_vid */ 9118 sappend(s, b_vid->stmts); 9119 b_vid->stmts = s; 9120 } 9121 9122 /* 9123 * Generate check for "vlan" or "vlan <id>" on systems with support for BPF 9124 * extensions. Even if kernel supports VLAN BPF extensions, (outermost) VLAN 9125 * tag can be either in metadata or in packet data; therefore if the 9126 * SKF_AD_VLAN_TAG_PRESENT test is negative, we need to check link 9127 * header for VLAN tag. As the decision is done at run time, we need 9128 * update variable part of the offsets 9129 */ 9130 static struct block * 9131 gen_vlan_bpf_extensions(compiler_state_t *cstate, bpf_u_int32 vlan_num, 9132 int has_vlan_tag) 9133 { 9134 struct block *b0, *b_tpid, *b_vid = NULL; 9135 struct slist *s; 9136 9137 /* generate new filter code based on extracting packet 9138 * metadata */ 9139 s = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 9140 s->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT; 9141 9142 b0 = new_block(cstate, JMP(BPF_JEQ)); 9143 b0->stmts = s; 9144 b0->s.k = 1; 9145 9146 /* 9147 * This is tricky. We need to insert the statements updating variable 9148 * parts of offsets before the traditional TPID and VID tests so 9149 * that they are called whenever SKF_AD_VLAN_TAG_PRESENT fails but 9150 * we do not want this update to affect those checks. That's why we 9151 * generate both test blocks first and insert the statements updating 9152 * variable parts of both offsets after that. This wouldn't work if 9153 * there already were variable length link header when entering this 9154 * function but gen_vlan_bpf_extensions() isn't called in that case. 9155 */ 9156 b_tpid = gen_vlan_tpid_test(cstate); 9157 if (has_vlan_tag) 9158 b_vid = gen_vlan_vid_test(cstate, vlan_num); 9159 9160 gen_vlan_patch_tpid_test(cstate, b_tpid); 9161 gen_or(b0, b_tpid); 9162 b0 = b_tpid; 9163 9164 if (has_vlan_tag) { 9165 gen_vlan_patch_vid_test(cstate, b_vid); 9166 gen_and(b0, b_vid); 9167 b0 = b_vid; 9168 } 9169 9170 return b0; 9171 } 9172 #endif 9173 9174 /* 9175 * support IEEE 802.1Q VLAN trunk over ethernet 9176 */ 9177 struct block * 9178 gen_vlan(compiler_state_t *cstate, bpf_u_int32 vlan_num, int has_vlan_tag) 9179 { 9180 struct block *b0; 9181 9182 /* 9183 * Catch errors reported by us and routines below us, and return NULL 9184 * on an error. 9185 */ 9186 if (setjmp(cstate->top_ctx)) 9187 return (NULL); 9188 9189 /* can't check for VLAN-encapsulated packets inside MPLS */ 9190 if (cstate->label_stack_depth > 0) 9191 bpf_error(cstate, "no VLAN match after MPLS"); 9192 9193 /* 9194 * Check for a VLAN packet, and then change the offsets to point 9195 * to the type and data fields within the VLAN packet. Just 9196 * increment the offsets, so that we can support a hierarchy, e.g. 9197 * "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within 9198 * VLAN 100. 9199 * 9200 * XXX - this is a bit of a kludge. If we were to split the 9201 * compiler into a parser that parses an expression and 9202 * generates an expression tree, and a code generator that 9203 * takes an expression tree (which could come from our 9204 * parser or from some other parser) and generates BPF code, 9205 * we could perhaps make the offsets parameters of routines 9206 * and, in the handler for an "AND" node, pass to subnodes 9207 * other than the VLAN node the adjusted offsets. 9208 * 9209 * This would mean that "vlan" would, instead of changing the 9210 * behavior of *all* tests after it, change only the behavior 9211 * of tests ANDed with it. That would change the documented 9212 * semantics of "vlan", which might break some expressions. 9213 * However, it would mean that "(vlan and ip) or ip" would check 9214 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than 9215 * checking only for VLAN-encapsulated IP, so that could still 9216 * be considered worth doing; it wouldn't break expressions 9217 * that are of the form "vlan and ..." or "vlan N and ...", 9218 * which I suspect are the most common expressions involving 9219 * "vlan". "vlan or ..." doesn't necessarily do what the user 9220 * would really want, now, as all the "or ..." tests would 9221 * be done assuming a VLAN, even though the "or" could be viewed 9222 * as meaning "or, if this isn't a VLAN packet...". 9223 */ 9224 switch (cstate->linktype) { 9225 9226 case DLT_EN10MB: 9227 case DLT_NETANALYZER: 9228 case DLT_NETANALYZER_TRANSPARENT: 9229 #if defined(SKF_AD_VLAN_TAG_PRESENT) 9230 /* Verify that this is the outer part of the packet and 9231 * not encapsulated somehow. */ 9232 if (cstate->vlan_stack_depth == 0 && !cstate->off_linkhdr.is_variable && 9233 cstate->off_linkhdr.constant_part == 9234 cstate->off_outermostlinkhdr.constant_part) { 9235 /* 9236 * Do we need special VLAN handling? 9237 */ 9238 if (cstate->bpf_pcap->bpf_codegen_flags & BPF_SPECIAL_VLAN_HANDLING) 9239 b0 = gen_vlan_bpf_extensions(cstate, vlan_num, 9240 has_vlan_tag); 9241 else 9242 b0 = gen_vlan_no_bpf_extensions(cstate, 9243 vlan_num, has_vlan_tag); 9244 } else 9245 #endif 9246 b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num, 9247 has_vlan_tag); 9248 break; 9249 9250 case DLT_IEEE802_11: 9251 case DLT_PRISM_HEADER: 9252 case DLT_IEEE802_11_RADIO_AVS: 9253 case DLT_IEEE802_11_RADIO: 9254 b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num, has_vlan_tag); 9255 break; 9256 9257 default: 9258 bpf_error(cstate, "no VLAN support for %s", 9259 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 9260 /*NOTREACHED*/ 9261 } 9262 9263 cstate->vlan_stack_depth++; 9264 9265 return (b0); 9266 } 9267 9268 /* 9269 * support for MPLS 9270 * 9271 * The label_num_arg dance is to avoid annoying whining by compilers that 9272 * label_num might be clobbered by longjmp - yeah, it might, but *WHO CARES*? 9273 * It's not *used* after setjmp returns. 9274 */ 9275 struct block * 9276 gen_mpls(compiler_state_t *cstate, bpf_u_int32 label_num_arg, 9277 int has_label_num) 9278 { 9279 volatile bpf_u_int32 label_num = label_num_arg; 9280 struct block *b0, *b1; 9281 9282 /* 9283 * Catch errors reported by us and routines below us, and return NULL 9284 * on an error. 9285 */ 9286 if (setjmp(cstate->top_ctx)) 9287 return (NULL); 9288 9289 if (cstate->label_stack_depth > 0) { 9290 /* just match the bottom-of-stack bit clear */ 9291 b0 = gen_mcmp(cstate, OR_PREVMPLSHDR, 2, BPF_B, 0, 0x01); 9292 } else { 9293 /* 9294 * We're not in an MPLS stack yet, so check the link-layer 9295 * type against MPLS. 9296 */ 9297 switch (cstate->linktype) { 9298 9299 case DLT_C_HDLC: /* fall through */ 9300 case DLT_HDLC: 9301 case DLT_EN10MB: 9302 case DLT_NETANALYZER: 9303 case DLT_NETANALYZER_TRANSPARENT: 9304 b0 = gen_linktype(cstate, ETHERTYPE_MPLS); 9305 break; 9306 9307 case DLT_PPP: 9308 b0 = gen_linktype(cstate, PPP_MPLS_UCAST); 9309 break; 9310 9311 /* FIXME add other DLT_s ... 9312 * for Frame-Relay/and ATM this may get messy due to SNAP headers 9313 * leave it for now */ 9314 9315 default: 9316 bpf_error(cstate, "no MPLS support for %s", 9317 pcap_datalink_val_to_description_or_dlt(cstate->linktype)); 9318 /*NOTREACHED*/ 9319 } 9320 } 9321 9322 /* If a specific MPLS label is requested, check it */ 9323 if (has_label_num) { 9324 if (label_num > 0xFFFFF) { 9325 bpf_error(cstate, "MPLS label %u greater than maximum %u", 9326 label_num, 0xFFFFF); 9327 } 9328 label_num = label_num << 12; /* label is shifted 12 bits on the wire */ 9329 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, label_num, 9330 0xfffff000); /* only compare the first 20 bits */ 9331 gen_and(b0, b1); 9332 b0 = b1; 9333 } 9334 9335 /* 9336 * Change the offsets to point to the type and data fields within 9337 * the MPLS packet. Just increment the offsets, so that we 9338 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to 9339 * capture packets with an outer label of 100000 and an inner 9340 * label of 1024. 9341 * 9342 * Increment the MPLS stack depth as well; this indicates that 9343 * we're checking MPLS-encapsulated headers, to make sure higher 9344 * level code generators don't try to match against IP-related 9345 * protocols such as Q_ARP, Q_RARP etc. 9346 * 9347 * XXX - this is a bit of a kludge. See comments in gen_vlan(). 9348 */ 9349 cstate->off_nl_nosnap += 4; 9350 cstate->off_nl += 4; 9351 cstate->label_stack_depth++; 9352 return (b0); 9353 } 9354 9355 /* 9356 * Support PPPOE discovery and session. 9357 */ 9358 struct block * 9359 gen_pppoed(compiler_state_t *cstate) 9360 { 9361 /* 9362 * Catch errors reported by us and routines below us, and return NULL 9363 * on an error. 9364 */ 9365 if (setjmp(cstate->top_ctx)) 9366 return (NULL); 9367 9368 /* check for PPPoE discovery */ 9369 return gen_linktype(cstate, ETHERTYPE_PPPOED); 9370 } 9371 9372 struct block * 9373 gen_pppoes(compiler_state_t *cstate, bpf_u_int32 sess_num, int has_sess_num) 9374 { 9375 struct block *b0, *b1; 9376 9377 /* 9378 * Catch errors reported by us and routines below us, and return NULL 9379 * on an error. 9380 */ 9381 if (setjmp(cstate->top_ctx)) 9382 return (NULL); 9383 9384 /* 9385 * Test against the PPPoE session link-layer type. 9386 */ 9387 b0 = gen_linktype(cstate, ETHERTYPE_PPPOES); 9388 9389 /* If a specific session is requested, check PPPoE session id */ 9390 if (has_sess_num) { 9391 if (sess_num > 0x0000ffff) { 9392 bpf_error(cstate, "PPPoE session number %u greater than maximum %u", 9393 sess_num, 0x0000ffff); 9394 } 9395 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, sess_num, 0x0000ffff); 9396 gen_and(b0, b1); 9397 b0 = b1; 9398 } 9399 9400 /* 9401 * Change the offsets to point to the type and data fields within 9402 * the PPP packet, and note that this is PPPoE rather than 9403 * raw PPP. 9404 * 9405 * XXX - this is a bit of a kludge. See the comments in 9406 * gen_vlan(). 9407 * 9408 * The "network-layer" protocol is PPPoE, which has a 6-byte 9409 * PPPoE header, followed by a PPP packet. 9410 * 9411 * There is no HDLC encapsulation for the PPP packet (it's 9412 * encapsulated in PPPoES instead), so the link-layer type 9413 * starts at the first byte of the PPP packet. For PPPoE, 9414 * that offset is relative to the beginning of the total 9415 * link-layer payload, including any 802.2 LLC header, so 9416 * it's 6 bytes past cstate->off_nl. 9417 */ 9418 PUSH_LINKHDR(cstate, DLT_PPP, cstate->off_linkpl.is_variable, 9419 cstate->off_linkpl.constant_part + cstate->off_nl + 6, /* 6 bytes past the PPPoE header */ 9420 cstate->off_linkpl.reg); 9421 9422 cstate->off_linktype = cstate->off_linkhdr; 9423 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 2; 9424 9425 cstate->off_nl = 0; 9426 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 9427 9428 return b0; 9429 } 9430 9431 /* Check that this is Geneve and the VNI is correct if 9432 * specified. Parameterized to handle both IPv4 and IPv6. */ 9433 static struct block * 9434 gen_geneve_check(compiler_state_t *cstate, 9435 struct block *(*gen_portfn)(compiler_state_t *, u_int, int, int), 9436 enum e_offrel offrel, bpf_u_int32 vni, int has_vni) 9437 { 9438 struct block *b0, *b1; 9439 9440 b0 = gen_portfn(cstate, GENEVE_PORT, IPPROTO_UDP, Q_DST); 9441 9442 /* Check that we are operating on version 0. Otherwise, we 9443 * can't decode the rest of the fields. The version is 2 bits 9444 * in the first byte of the Geneve header. */ 9445 b1 = gen_mcmp(cstate, offrel, 8, BPF_B, 0, 0xc0); 9446 gen_and(b0, b1); 9447 b0 = b1; 9448 9449 if (has_vni) { 9450 if (vni > 0xffffff) { 9451 bpf_error(cstate, "Geneve VNI %u greater than maximum %u", 9452 vni, 0xffffff); 9453 } 9454 vni <<= 8; /* VNI is in the upper 3 bytes */ 9455 b1 = gen_mcmp(cstate, offrel, 12, BPF_W, vni, 0xffffff00); 9456 gen_and(b0, b1); 9457 b0 = b1; 9458 } 9459 9460 return b0; 9461 } 9462 9463 /* The IPv4 and IPv6 Geneve checks need to do two things: 9464 * - Verify that this actually is Geneve with the right VNI. 9465 * - Place the IP header length (plus variable link prefix if 9466 * needed) into register A to be used later to compute 9467 * the inner packet offsets. */ 9468 static struct block * 9469 gen_geneve4(compiler_state_t *cstate, bpf_u_int32 vni, int has_vni) 9470 { 9471 struct block *b0, *b1; 9472 struct slist *s, *s1; 9473 9474 b0 = gen_geneve_check(cstate, gen_port, OR_TRAN_IPV4, vni, has_vni); 9475 9476 /* Load the IP header length into A. */ 9477 s = gen_loadx_iphdrlen(cstate); 9478 9479 s1 = new_stmt(cstate, BPF_MISC|BPF_TXA); 9480 sappend(s, s1); 9481 9482 /* Forcibly append these statements to the true condition 9483 * of the protocol check by creating a new block that is 9484 * always true and ANDing them. */ 9485 b1 = new_block(cstate, BPF_JMP|BPF_JEQ|BPF_X); 9486 b1->stmts = s; 9487 b1->s.k = 0; 9488 9489 gen_and(b0, b1); 9490 9491 return b1; 9492 } 9493 9494 static struct block * 9495 gen_geneve6(compiler_state_t *cstate, bpf_u_int32 vni, int has_vni) 9496 { 9497 struct block *b0, *b1; 9498 struct slist *s, *s1; 9499 9500 b0 = gen_geneve_check(cstate, gen_port6, OR_TRAN_IPV6, vni, has_vni); 9501 9502 /* Load the IP header length. We need to account for a 9503 * variable length link prefix if there is one. */ 9504 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 9505 if (s) { 9506 s1 = new_stmt(cstate, BPF_LD|BPF_IMM); 9507 s1->s.k = 40; 9508 sappend(s, s1); 9509 9510 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X); 9511 s1->s.k = 0; 9512 sappend(s, s1); 9513 } else { 9514 s = new_stmt(cstate, BPF_LD|BPF_IMM); 9515 s->s.k = 40; 9516 } 9517 9518 /* Forcibly append these statements to the true condition 9519 * of the protocol check by creating a new block that is 9520 * always true and ANDing them. */ 9521 s1 = new_stmt(cstate, BPF_MISC|BPF_TAX); 9522 sappend(s, s1); 9523 9524 b1 = new_block(cstate, BPF_JMP|BPF_JEQ|BPF_X); 9525 b1->stmts = s; 9526 b1->s.k = 0; 9527 9528 gen_and(b0, b1); 9529 9530 return b1; 9531 } 9532 9533 /* We need to store three values based on the Geneve header:: 9534 * - The offset of the linktype. 9535 * - The offset of the end of the Geneve header. 9536 * - The offset of the end of the encapsulated MAC header. */ 9537 static struct slist * 9538 gen_geneve_offsets(compiler_state_t *cstate) 9539 { 9540 struct slist *s, *s1, *s_proto; 9541 9542 /* First we need to calculate the offset of the Geneve header 9543 * itself. This is composed of the IP header previously calculated 9544 * (include any variable link prefix) and stored in A plus the 9545 * fixed sized headers (fixed link prefix, MAC length, and UDP 9546 * header). */ 9547 s = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 9548 s->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 8; 9549 9550 /* Stash this in X since we'll need it later. */ 9551 s1 = new_stmt(cstate, BPF_MISC|BPF_TAX); 9552 sappend(s, s1); 9553 9554 /* The EtherType in Geneve is 2 bytes in. Calculate this and 9555 * store it. */ 9556 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 9557 s1->s.k = 2; 9558 sappend(s, s1); 9559 9560 cstate->off_linktype.reg = alloc_reg(cstate); 9561 cstate->off_linktype.is_variable = 1; 9562 cstate->off_linktype.constant_part = 0; 9563 9564 s1 = new_stmt(cstate, BPF_ST); 9565 s1->s.k = cstate->off_linktype.reg; 9566 sappend(s, s1); 9567 9568 /* Load the Geneve option length and mask and shift to get the 9569 * number of bytes. It is stored in the first byte of the Geneve 9570 * header. */ 9571 s1 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 9572 s1->s.k = 0; 9573 sappend(s, s1); 9574 9575 s1 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 9576 s1->s.k = 0x3f; 9577 sappend(s, s1); 9578 9579 s1 = new_stmt(cstate, BPF_ALU|BPF_MUL|BPF_K); 9580 s1->s.k = 4; 9581 sappend(s, s1); 9582 9583 /* Add in the rest of the Geneve base header. */ 9584 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 9585 s1->s.k = 8; 9586 sappend(s, s1); 9587 9588 /* Add the Geneve header length to its offset and store. */ 9589 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X); 9590 s1->s.k = 0; 9591 sappend(s, s1); 9592 9593 /* Set the encapsulated type as Ethernet. Even though we may 9594 * not actually have Ethernet inside there are two reasons this 9595 * is useful: 9596 * - The linktype field is always in EtherType format regardless 9597 * of whether it is in Geneve or an inner Ethernet frame. 9598 * - The only link layer that we have specific support for is 9599 * Ethernet. We will confirm that the packet actually is 9600 * Ethernet at runtime before executing these checks. */ 9601 PUSH_LINKHDR(cstate, DLT_EN10MB, 1, 0, alloc_reg(cstate)); 9602 9603 s1 = new_stmt(cstate, BPF_ST); 9604 s1->s.k = cstate->off_linkhdr.reg; 9605 sappend(s, s1); 9606 9607 /* Calculate whether we have an Ethernet header or just raw IP/ 9608 * MPLS/etc. If we have Ethernet, advance the end of the MAC offset 9609 * and linktype by 14 bytes so that the network header can be found 9610 * seamlessly. Otherwise, keep what we've calculated already. */ 9611 9612 /* We have a bare jmp so we can't use the optimizer. */ 9613 cstate->no_optimize = 1; 9614 9615 /* Load the EtherType in the Geneve header, 2 bytes in. */ 9616 s1 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_H); 9617 s1->s.k = 2; 9618 sappend(s, s1); 9619 9620 /* Load X with the end of the Geneve header. */ 9621 s1 = new_stmt(cstate, BPF_LDX|BPF_MEM); 9622 s1->s.k = cstate->off_linkhdr.reg; 9623 sappend(s, s1); 9624 9625 /* Check if the EtherType is Transparent Ethernet Bridging. At the 9626 * end of this check, we should have the total length in X. In 9627 * the non-Ethernet case, it's already there. */ 9628 s_proto = new_stmt(cstate, JMP(BPF_JEQ)); 9629 s_proto->s.k = ETHERTYPE_TEB; 9630 sappend(s, s_proto); 9631 9632 s1 = new_stmt(cstate, BPF_MISC|BPF_TXA); 9633 sappend(s, s1); 9634 s_proto->s.jt = s1; 9635 9636 /* Since this is Ethernet, use the EtherType of the payload 9637 * directly as the linktype. Overwrite what we already have. */ 9638 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 9639 s1->s.k = 12; 9640 sappend(s, s1); 9641 9642 s1 = new_stmt(cstate, BPF_ST); 9643 s1->s.k = cstate->off_linktype.reg; 9644 sappend(s, s1); 9645 9646 /* Advance two bytes further to get the end of the Ethernet 9647 * header. */ 9648 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 9649 s1->s.k = 2; 9650 sappend(s, s1); 9651 9652 /* Move the result to X. */ 9653 s1 = new_stmt(cstate, BPF_MISC|BPF_TAX); 9654 sappend(s, s1); 9655 9656 /* Store the final result of our linkpl calculation. */ 9657 cstate->off_linkpl.reg = alloc_reg(cstate); 9658 cstate->off_linkpl.is_variable = 1; 9659 cstate->off_linkpl.constant_part = 0; 9660 9661 s1 = new_stmt(cstate, BPF_STX); 9662 s1->s.k = cstate->off_linkpl.reg; 9663 sappend(s, s1); 9664 s_proto->s.jf = s1; 9665 9666 cstate->off_nl = 0; 9667 9668 return s; 9669 } 9670 9671 /* Check to see if this is a Geneve packet. */ 9672 struct block * 9673 gen_geneve(compiler_state_t *cstate, bpf_u_int32 vni, int has_vni) 9674 { 9675 struct block *b0, *b1; 9676 struct slist *s; 9677 9678 /* 9679 * Catch errors reported by us and routines below us, and return NULL 9680 * on an error. 9681 */ 9682 if (setjmp(cstate->top_ctx)) 9683 return (NULL); 9684 9685 b0 = gen_geneve4(cstate, vni, has_vni); 9686 b1 = gen_geneve6(cstate, vni, has_vni); 9687 9688 gen_or(b0, b1); 9689 b0 = b1; 9690 9691 /* Later filters should act on the payload of the Geneve frame, 9692 * update all of the header pointers. Attach this code so that 9693 * it gets executed in the event that the Geneve filter matches. */ 9694 s = gen_geneve_offsets(cstate); 9695 9696 b1 = gen_true(cstate); 9697 sappend(s, b1->stmts); 9698 b1->stmts = s; 9699 9700 gen_and(b0, b1); 9701 9702 cstate->is_geneve = 1; 9703 9704 return b1; 9705 } 9706 9707 /* Check that the encapsulated frame has a link layer header 9708 * for Ethernet filters. */ 9709 static struct block * 9710 gen_geneve_ll_check(compiler_state_t *cstate) 9711 { 9712 struct block *b0; 9713 struct slist *s, *s1; 9714 9715 /* The easiest way to see if there is a link layer present 9716 * is to check if the link layer header and payload are not 9717 * the same. */ 9718 9719 /* Geneve always generates pure variable offsets so we can 9720 * compare only the registers. */ 9721 s = new_stmt(cstate, BPF_LD|BPF_MEM); 9722 s->s.k = cstate->off_linkhdr.reg; 9723 9724 s1 = new_stmt(cstate, BPF_LDX|BPF_MEM); 9725 s1->s.k = cstate->off_linkpl.reg; 9726 sappend(s, s1); 9727 9728 b0 = new_block(cstate, BPF_JMP|BPF_JEQ|BPF_X); 9729 b0->stmts = s; 9730 b0->s.k = 0; 9731 gen_not(b0); 9732 9733 return b0; 9734 } 9735 9736 static struct block * 9737 gen_atmfield_code_internal(compiler_state_t *cstate, int atmfield, 9738 bpf_u_int32 jvalue, int jtype, int reverse) 9739 { 9740 struct block *b0; 9741 9742 switch (atmfield) { 9743 9744 case A_VPI: 9745 if (!cstate->is_atm) 9746 bpf_error(cstate, "'vpi' supported only on raw ATM"); 9747 if (cstate->off_vpi == OFFSET_NOT_SET) 9748 abort(); 9749 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vpi, BPF_B, 9750 0xffffffffU, jtype, reverse, jvalue); 9751 break; 9752 9753 case A_VCI: 9754 if (!cstate->is_atm) 9755 bpf_error(cstate, "'vci' supported only on raw ATM"); 9756 if (cstate->off_vci == OFFSET_NOT_SET) 9757 abort(); 9758 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vci, BPF_H, 9759 0xffffffffU, jtype, reverse, jvalue); 9760 break; 9761 9762 case A_PROTOTYPE: 9763 if (cstate->off_proto == OFFSET_NOT_SET) 9764 abort(); /* XXX - this isn't on FreeBSD */ 9765 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 9766 0x0fU, jtype, reverse, jvalue); 9767 break; 9768 9769 case A_MSGTYPE: 9770 if (cstate->off_payload == OFFSET_NOT_SET) 9771 abort(); 9772 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_payload + MSG_TYPE_POS, BPF_B, 9773 0xffffffffU, jtype, reverse, jvalue); 9774 break; 9775 9776 case A_CALLREFTYPE: 9777 if (!cstate->is_atm) 9778 bpf_error(cstate, "'callref' supported only on raw ATM"); 9779 if (cstate->off_proto == OFFSET_NOT_SET) 9780 abort(); 9781 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 9782 0xffffffffU, jtype, reverse, jvalue); 9783 break; 9784 9785 default: 9786 abort(); 9787 } 9788 return b0; 9789 } 9790 9791 static struct block * 9792 gen_atmtype_metac(compiler_state_t *cstate) 9793 { 9794 struct block *b0, *b1; 9795 9796 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 9797 b1 = gen_atmfield_code_internal(cstate, A_VCI, 1, BPF_JEQ, 0); 9798 gen_and(b0, b1); 9799 return b1; 9800 } 9801 9802 static struct block * 9803 gen_atmtype_sc(compiler_state_t *cstate) 9804 { 9805 struct block *b0, *b1; 9806 9807 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 9808 b1 = gen_atmfield_code_internal(cstate, A_VCI, 5, BPF_JEQ, 0); 9809 gen_and(b0, b1); 9810 return b1; 9811 } 9812 9813 static struct block * 9814 gen_atmtype_llc(compiler_state_t *cstate) 9815 { 9816 struct block *b0; 9817 9818 b0 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 9819 cstate->linktype = cstate->prevlinktype; 9820 return b0; 9821 } 9822 9823 struct block * 9824 gen_atmfield_code(compiler_state_t *cstate, int atmfield, 9825 bpf_u_int32 jvalue, int jtype, int reverse) 9826 { 9827 /* 9828 * Catch errors reported by us and routines below us, and return NULL 9829 * on an error. 9830 */ 9831 if (setjmp(cstate->top_ctx)) 9832 return (NULL); 9833 9834 return gen_atmfield_code_internal(cstate, atmfield, jvalue, jtype, 9835 reverse); 9836 } 9837 9838 struct block * 9839 gen_atmtype_abbrev(compiler_state_t *cstate, int type) 9840 { 9841 struct block *b0, *b1; 9842 9843 /* 9844 * Catch errors reported by us and routines below us, and return NULL 9845 * on an error. 9846 */ 9847 if (setjmp(cstate->top_ctx)) 9848 return (NULL); 9849 9850 switch (type) { 9851 9852 case A_METAC: 9853 /* Get all packets in Meta signalling Circuit */ 9854 if (!cstate->is_atm) 9855 bpf_error(cstate, "'metac' supported only on raw ATM"); 9856 b1 = gen_atmtype_metac(cstate); 9857 break; 9858 9859 case A_BCC: 9860 /* Get all packets in Broadcast Circuit*/ 9861 if (!cstate->is_atm) 9862 bpf_error(cstate, "'bcc' supported only on raw ATM"); 9863 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 9864 b1 = gen_atmfield_code_internal(cstate, A_VCI, 2, BPF_JEQ, 0); 9865 gen_and(b0, b1); 9866 break; 9867 9868 case A_OAMF4SC: 9869 /* Get all cells in Segment OAM F4 circuit*/ 9870 if (!cstate->is_atm) 9871 bpf_error(cstate, "'oam4sc' supported only on raw ATM"); 9872 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 9873 b1 = gen_atmfield_code_internal(cstate, A_VCI, 3, BPF_JEQ, 0); 9874 gen_and(b0, b1); 9875 break; 9876 9877 case A_OAMF4EC: 9878 /* Get all cells in End-to-End OAM F4 Circuit*/ 9879 if (!cstate->is_atm) 9880 bpf_error(cstate, "'oam4ec' supported only on raw ATM"); 9881 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 9882 b1 = gen_atmfield_code_internal(cstate, A_VCI, 4, BPF_JEQ, 0); 9883 gen_and(b0, b1); 9884 break; 9885 9886 case A_SC: 9887 /* Get all packets in connection Signalling Circuit */ 9888 if (!cstate->is_atm) 9889 bpf_error(cstate, "'sc' supported only on raw ATM"); 9890 b1 = gen_atmtype_sc(cstate); 9891 break; 9892 9893 case A_ILMIC: 9894 /* Get all packets in ILMI Circuit */ 9895 if (!cstate->is_atm) 9896 bpf_error(cstate, "'ilmic' supported only on raw ATM"); 9897 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 9898 b1 = gen_atmfield_code_internal(cstate, A_VCI, 16, BPF_JEQ, 0); 9899 gen_and(b0, b1); 9900 break; 9901 9902 case A_LANE: 9903 /* Get all LANE packets */ 9904 if (!cstate->is_atm) 9905 bpf_error(cstate, "'lane' supported only on raw ATM"); 9906 b1 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LANE, BPF_JEQ, 0); 9907 9908 /* 9909 * Arrange that all subsequent tests assume LANE 9910 * rather than LLC-encapsulated packets, and set 9911 * the offsets appropriately for LANE-encapsulated 9912 * Ethernet. 9913 * 9914 * We assume LANE means Ethernet, not Token Ring. 9915 */ 9916 PUSH_LINKHDR(cstate, DLT_EN10MB, 0, 9917 cstate->off_payload + 2, /* Ethernet header */ 9918 -1); 9919 cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12; 9920 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* Ethernet */ 9921 cstate->off_nl = 0; /* Ethernet II */ 9922 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 9923 break; 9924 9925 case A_LLC: 9926 /* Get all LLC-encapsulated packets */ 9927 if (!cstate->is_atm) 9928 bpf_error(cstate, "'llc' supported only on raw ATM"); 9929 b1 = gen_atmtype_llc(cstate); 9930 break; 9931 9932 default: 9933 abort(); 9934 } 9935 return b1; 9936 } 9937 9938 /* 9939 * Filtering for MTP2 messages based on li value 9940 * FISU, length is null 9941 * LSSU, length is 1 or 2 9942 * MSU, length is 3 or more 9943 * For MTP2_HSL, sequences are on 2 bytes, and length on 9 bits 9944 */ 9945 struct block * 9946 gen_mtp2type_abbrev(compiler_state_t *cstate, int type) 9947 { 9948 struct block *b0, *b1; 9949 9950 /* 9951 * Catch errors reported by us and routines below us, and return NULL 9952 * on an error. 9953 */ 9954 if (setjmp(cstate->top_ctx)) 9955 return (NULL); 9956 9957 switch (type) { 9958 9959 case M_FISU: 9960 if ( (cstate->linktype != DLT_MTP2) && 9961 (cstate->linktype != DLT_ERF) && 9962 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9963 bpf_error(cstate, "'fisu' supported only on MTP2"); 9964 /* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */ 9965 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 9966 0x3fU, BPF_JEQ, 0, 0U); 9967 break; 9968 9969 case M_LSSU: 9970 if ( (cstate->linktype != DLT_MTP2) && 9971 (cstate->linktype != DLT_ERF) && 9972 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9973 bpf_error(cstate, "'lssu' supported only on MTP2"); 9974 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 9975 0x3fU, BPF_JGT, 1, 2U); 9976 b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 9977 0x3fU, BPF_JGT, 0, 0U); 9978 gen_and(b1, b0); 9979 break; 9980 9981 case M_MSU: 9982 if ( (cstate->linktype != DLT_MTP2) && 9983 (cstate->linktype != DLT_ERF) && 9984 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9985 bpf_error(cstate, "'msu' supported only on MTP2"); 9986 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 9987 0x3fU, BPF_JGT, 0, 2U); 9988 break; 9989 9990 case MH_FISU: 9991 if ( (cstate->linktype != DLT_MTP2) && 9992 (cstate->linktype != DLT_ERF) && 9993 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9994 bpf_error(cstate, "'hfisu' supported only on MTP2_HSL"); 9995 /* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */ 9996 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 9997 0xff80U, BPF_JEQ, 0, 0U); 9998 break; 9999 10000 case MH_LSSU: 10001 if ( (cstate->linktype != DLT_MTP2) && 10002 (cstate->linktype != DLT_ERF) && 10003 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 10004 bpf_error(cstate, "'hlssu' supported only on MTP2_HSL"); 10005 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 10006 0xff80U, BPF_JGT, 1, 0x0100U); 10007 b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 10008 0xff80U, BPF_JGT, 0, 0U); 10009 gen_and(b1, b0); 10010 break; 10011 10012 case MH_MSU: 10013 if ( (cstate->linktype != DLT_MTP2) && 10014 (cstate->linktype != DLT_ERF) && 10015 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 10016 bpf_error(cstate, "'hmsu' supported only on MTP2_HSL"); 10017 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 10018 0xff80U, BPF_JGT, 0, 0x0100U); 10019 break; 10020 10021 default: 10022 abort(); 10023 } 10024 return b0; 10025 } 10026 10027 /* 10028 * The jvalue_arg dance is to avoid annoying whining by compilers that 10029 * jvalue might be clobbered by longjmp - yeah, it might, but *WHO CARES*? 10030 * It's not *used* after setjmp returns. 10031 */ 10032 struct block * 10033 gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, 10034 bpf_u_int32 jvalue_arg, int jtype, int reverse) 10035 { 10036 volatile bpf_u_int32 jvalue = jvalue_arg; 10037 struct block *b0; 10038 bpf_u_int32 val1 , val2 , val3; 10039 u_int newoff_sio; 10040 u_int newoff_opc; 10041 u_int newoff_dpc; 10042 u_int newoff_sls; 10043 10044 /* 10045 * Catch errors reported by us and routines below us, and return NULL 10046 * on an error. 10047 */ 10048 if (setjmp(cstate->top_ctx)) 10049 return (NULL); 10050 10051 newoff_sio = cstate->off_sio; 10052 newoff_opc = cstate->off_opc; 10053 newoff_dpc = cstate->off_dpc; 10054 newoff_sls = cstate->off_sls; 10055 switch (mtp3field) { 10056 10057 case MH_SIO: 10058 newoff_sio += 3; /* offset for MTP2_HSL */ 10059 /* FALLTHROUGH */ 10060 10061 case M_SIO: 10062 if (cstate->off_sio == OFFSET_NOT_SET) 10063 bpf_error(cstate, "'sio' supported only on SS7"); 10064 /* sio coded on 1 byte so max value 255 */ 10065 if(jvalue > 255) 10066 bpf_error(cstate, "sio value %u too big; max value = 255", 10067 jvalue); 10068 b0 = gen_ncmp(cstate, OR_PACKET, newoff_sio, BPF_B, 0xffffffffU, 10069 jtype, reverse, jvalue); 10070 break; 10071 10072 case MH_OPC: 10073 newoff_opc += 3; 10074 10075 /* FALLTHROUGH */ 10076 case M_OPC: 10077 if (cstate->off_opc == OFFSET_NOT_SET) 10078 bpf_error(cstate, "'opc' supported only on SS7"); 10079 /* opc coded on 14 bits so max value 16383 */ 10080 if (jvalue > 16383) 10081 bpf_error(cstate, "opc value %u too big; max value = 16383", 10082 jvalue); 10083 /* the following instructions are made to convert jvalue 10084 * to the form used to write opc in an ss7 message*/ 10085 val1 = jvalue & 0x00003c00; 10086 val1 = val1 >>10; 10087 val2 = jvalue & 0x000003fc; 10088 val2 = val2 <<6; 10089 val3 = jvalue & 0x00000003; 10090 val3 = val3 <<22; 10091 jvalue = val1 + val2 + val3; 10092 b0 = gen_ncmp(cstate, OR_PACKET, newoff_opc, BPF_W, 0x00c0ff0fU, 10093 jtype, reverse, jvalue); 10094 break; 10095 10096 case MH_DPC: 10097 newoff_dpc += 3; 10098 /* FALLTHROUGH */ 10099 10100 case M_DPC: 10101 if (cstate->off_dpc == OFFSET_NOT_SET) 10102 bpf_error(cstate, "'dpc' supported only on SS7"); 10103 /* dpc coded on 14 bits so max value 16383 */ 10104 if (jvalue > 16383) 10105 bpf_error(cstate, "dpc value %u too big; max value = 16383", 10106 jvalue); 10107 /* the following instructions are made to convert jvalue 10108 * to the forme used to write dpc in an ss7 message*/ 10109 val1 = jvalue & 0x000000ff; 10110 val1 = val1 << 24; 10111 val2 = jvalue & 0x00003f00; 10112 val2 = val2 << 8; 10113 jvalue = val1 + val2; 10114 b0 = gen_ncmp(cstate, OR_PACKET, newoff_dpc, BPF_W, 0xff3f0000U, 10115 jtype, reverse, jvalue); 10116 break; 10117 10118 case MH_SLS: 10119 newoff_sls += 3; 10120 /* FALLTHROUGH */ 10121 10122 case M_SLS: 10123 if (cstate->off_sls == OFFSET_NOT_SET) 10124 bpf_error(cstate, "'sls' supported only on SS7"); 10125 /* sls coded on 4 bits so max value 15 */ 10126 if (jvalue > 15) 10127 bpf_error(cstate, "sls value %u too big; max value = 15", 10128 jvalue); 10129 /* the following instruction is made to convert jvalue 10130 * to the forme used to write sls in an ss7 message*/ 10131 jvalue = jvalue << 4; 10132 b0 = gen_ncmp(cstate, OR_PACKET, newoff_sls, BPF_B, 0xf0U, 10133 jtype, reverse, jvalue); 10134 break; 10135 10136 default: 10137 abort(); 10138 } 10139 return b0; 10140 } 10141 10142 static struct block * 10143 gen_msg_abbrev(compiler_state_t *cstate, int type) 10144 { 10145 struct block *b1; 10146 10147 /* 10148 * Q.2931 signalling protocol messages for handling virtual circuits 10149 * establishment and teardown 10150 */ 10151 switch (type) { 10152 10153 case A_SETUP: 10154 b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, SETUP, BPF_JEQ, 0); 10155 break; 10156 10157 case A_CALLPROCEED: 10158 b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0); 10159 break; 10160 10161 case A_CONNECT: 10162 b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, CONNECT, BPF_JEQ, 0); 10163 break; 10164 10165 case A_CONNECTACK: 10166 b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0); 10167 break; 10168 10169 case A_RELEASE: 10170 b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, RELEASE, BPF_JEQ, 0); 10171 break; 10172 10173 case A_RELEASE_DONE: 10174 b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0); 10175 break; 10176 10177 default: 10178 abort(); 10179 } 10180 return b1; 10181 } 10182 10183 struct block * 10184 gen_atmmulti_abbrev(compiler_state_t *cstate, int type) 10185 { 10186 struct block *b0, *b1; 10187 10188 /* 10189 * Catch errors reported by us and routines below us, and return NULL 10190 * on an error. 10191 */ 10192 if (setjmp(cstate->top_ctx)) 10193 return (NULL); 10194 10195 switch (type) { 10196 10197 case A_OAM: 10198 if (!cstate->is_atm) 10199 bpf_error(cstate, "'oam' supported only on raw ATM"); 10200 /* OAM F4 type */ 10201 b0 = gen_atmfield_code_internal(cstate, A_VCI, 3, BPF_JEQ, 0); 10202 b1 = gen_atmfield_code_internal(cstate, A_VCI, 4, BPF_JEQ, 0); 10203 gen_or(b0, b1); 10204 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 10205 gen_and(b0, b1); 10206 break; 10207 10208 case A_OAMF4: 10209 if (!cstate->is_atm) 10210 bpf_error(cstate, "'oamf4' supported only on raw ATM"); 10211 /* OAM F4 type */ 10212 b0 = gen_atmfield_code_internal(cstate, A_VCI, 3, BPF_JEQ, 0); 10213 b1 = gen_atmfield_code_internal(cstate, A_VCI, 4, BPF_JEQ, 0); 10214 gen_or(b0, b1); 10215 b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); 10216 gen_and(b0, b1); 10217 break; 10218 10219 case A_CONNECTMSG: 10220 /* 10221 * Get Q.2931 signalling messages for switched 10222 * virtual connection 10223 */ 10224 if (!cstate->is_atm) 10225 bpf_error(cstate, "'connectmsg' supported only on raw ATM"); 10226 b0 = gen_msg_abbrev(cstate, A_SETUP); 10227 b1 = gen_msg_abbrev(cstate, A_CALLPROCEED); 10228 gen_or(b0, b1); 10229 b0 = gen_msg_abbrev(cstate, A_CONNECT); 10230 gen_or(b0, b1); 10231 b0 = gen_msg_abbrev(cstate, A_CONNECTACK); 10232 gen_or(b0, b1); 10233 b0 = gen_msg_abbrev(cstate, A_RELEASE); 10234 gen_or(b0, b1); 10235 b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE); 10236 gen_or(b0, b1); 10237 b0 = gen_atmtype_sc(cstate); 10238 gen_and(b0, b1); 10239 break; 10240 10241 case A_METACONNECT: 10242 if (!cstate->is_atm) 10243 bpf_error(cstate, "'metaconnect' supported only on raw ATM"); 10244 b0 = gen_msg_abbrev(cstate, A_SETUP); 10245 b1 = gen_msg_abbrev(cstate, A_CALLPROCEED); 10246 gen_or(b0, b1); 10247 b0 = gen_msg_abbrev(cstate, A_CONNECT); 10248 gen_or(b0, b1); 10249 b0 = gen_msg_abbrev(cstate, A_RELEASE); 10250 gen_or(b0, b1); 10251 b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE); 10252 gen_or(b0, b1); 10253 b0 = gen_atmtype_metac(cstate); 10254 gen_and(b0, b1); 10255 break; 10256 10257 default: 10258 abort(); 10259 } 10260 return b1; 10261 } 10262