1 /*#define CHASE_CHAIN*/ 2 /* 3 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 4 * The Regents of the University of California. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 */ 22 23 #ifdef HAVE_CONFIG_H 24 #include <config.h> 25 #endif 26 27 #include <pcap-types.h> 28 #ifdef _WIN32 29 #include <ws2tcpip.h> 30 #else 31 #include <sys/socket.h> 32 33 #ifdef __NetBSD__ 34 #include <sys/param.h> 35 #endif 36 37 #include <netinet/in.h> 38 #include <arpa/inet.h> 39 #endif /* _WIN32 */ 40 41 #include <stdlib.h> 42 #include <string.h> 43 #include <memory.h> 44 #include <setjmp.h> 45 #include <stdarg.h> 46 47 #ifdef MSDOS 48 #include "pcap-dos.h" 49 #endif 50 51 #include "pcap-int.h" 52 53 #include "ethertype.h" 54 #include "nlpid.h" 55 #include "llc.h" 56 #include "gencode.h" 57 #include "ieee80211.h" 58 #include "atmuni31.h" 59 #include "sunatmpos.h" 60 #include "ppp.h" 61 #include "pcap/sll.h" 62 #include "pcap/ipnet.h" 63 #include "arcnet.h" 64 65 #include "grammar.h" 66 #include "scanner.h" 67 68 #if defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) 69 #include <linux/types.h> 70 #include <linux/if_packet.h> 71 #include <linux/filter.h> 72 #endif 73 74 #ifdef HAVE_NET_PFVAR_H 75 #include <sys/socket.h> 76 #include <net/if.h> 77 #include <net/pfvar.h> 78 #include <net/if_pflog.h> 79 #endif 80 81 #ifndef offsetof 82 #define offsetof(s, e) ((size_t)&((s *)0)->e) 83 #endif 84 85 #ifdef _WIN32 86 #ifdef INET6 87 #if defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF) 88 /* IPv6 address */ 89 struct in6_addr 90 { 91 union 92 { 93 uint8_t u6_addr8[16]; 94 uint16_t u6_addr16[8]; 95 uint32_t u6_addr32[4]; 96 } in6_u; 97 #define s6_addr in6_u.u6_addr8 98 #define s6_addr16 in6_u.u6_addr16 99 #define s6_addr32 in6_u.u6_addr32 100 #define s6_addr64 in6_u.u6_addr64 101 }; 102 103 typedef unsigned short sa_family_t; 104 105 #define __SOCKADDR_COMMON(sa_prefix) \ 106 sa_family_t sa_prefix##family 107 108 /* Ditto, for IPv6. */ 109 struct sockaddr_in6 110 { 111 __SOCKADDR_COMMON (sin6_); 112 uint16_t sin6_port; /* Transport layer port # */ 113 uint32_t sin6_flowinfo; /* IPv6 flow information */ 114 struct in6_addr sin6_addr; /* IPv6 address */ 115 }; 116 117 #ifndef EAI_ADDRFAMILY 118 struct addrinfo { 119 int ai_flags; /* AI_PASSIVE, AI_CANONNAME */ 120 int ai_family; /* PF_xxx */ 121 int ai_socktype; /* SOCK_xxx */ 122 int ai_protocol; /* 0 or IPPROTO_xxx for IPv4 and IPv6 */ 123 size_t ai_addrlen; /* length of ai_addr */ 124 char *ai_canonname; /* canonical name for hostname */ 125 struct sockaddr *ai_addr; /* binary address */ 126 struct addrinfo *ai_next; /* next structure in linked list */ 127 }; 128 #endif /* EAI_ADDRFAMILY */ 129 #endif /* defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF) */ 130 #endif /* INET6 */ 131 #else /* _WIN32 */ 132 #include <netdb.h> /* for "struct addrinfo" */ 133 #endif /* _WIN32 */ 134 #include <pcap/namedb.h> 135 136 #include "nametoaddr.h" 137 138 #define ETHERMTU 1500 139 140 #ifndef ETHERTYPE_TEB 141 #define ETHERTYPE_TEB 0x6558 142 #endif 143 144 #ifndef IPPROTO_HOPOPTS 145 #define IPPROTO_HOPOPTS 0 146 #endif 147 #ifndef IPPROTO_ROUTING 148 #define IPPROTO_ROUTING 43 149 #endif 150 #ifndef IPPROTO_FRAGMENT 151 #define IPPROTO_FRAGMENT 44 152 #endif 153 #ifndef IPPROTO_DSTOPTS 154 #define IPPROTO_DSTOPTS 60 155 #endif 156 #ifndef IPPROTO_SCTP 157 #define IPPROTO_SCTP 132 158 #endif 159 160 #define GENEVE_PORT 6081 161 162 #ifdef HAVE_OS_PROTO_H 163 #include "os-proto.h" 164 #endif 165 166 #define JMP(c) ((c)|BPF_JMP|BPF_K) 167 168 /* 169 * "Push" the current value of the link-layer header type and link-layer 170 * header offset onto a "stack", and set a new value. (It's not a 171 * full-blown stack; we keep only the top two items.) 172 */ 173 #define PUSH_LINKHDR(cs, new_linktype, new_is_variable, new_constant_part, new_reg) \ 174 { \ 175 (cs)->prevlinktype = (cs)->linktype; \ 176 (cs)->off_prevlinkhdr = (cs)->off_linkhdr; \ 177 (cs)->linktype = (new_linktype); \ 178 (cs)->off_linkhdr.is_variable = (new_is_variable); \ 179 (cs)->off_linkhdr.constant_part = (new_constant_part); \ 180 (cs)->off_linkhdr.reg = (new_reg); \ 181 (cs)->is_geneve = 0; \ 182 } 183 184 /* 185 * Offset "not set" value. 186 */ 187 #define OFFSET_NOT_SET 0xffffffffU 188 189 /* 190 * Absolute offsets, which are offsets from the beginning of the raw 191 * packet data, are, in the general case, the sum of a variable value 192 * and a constant value; the variable value may be absent, in which 193 * case the offset is only the constant value, and the constant value 194 * may be zero, in which case the offset is only the variable value. 195 * 196 * bpf_abs_offset is a structure containing all that information: 197 * 198 * is_variable is 1 if there's a variable part. 199 * 200 * constant_part is the constant part of the value, possibly zero; 201 * 202 * if is_variable is 1, reg is the register number for a register 203 * containing the variable value if the register has been assigned, 204 * and -1 otherwise. 205 */ 206 typedef struct { 207 int is_variable; 208 u_int constant_part; 209 int reg; 210 } bpf_abs_offset; 211 212 /* 213 * Value passed to gen_load_a() to indicate what the offset argument 214 * is relative to the beginning of. 215 */ 216 enum e_offrel { 217 OR_PACKET, /* full packet data */ 218 OR_LINKHDR, /* link-layer header */ 219 OR_PREVLINKHDR, /* previous link-layer header */ 220 OR_LLC, /* 802.2 LLC header */ 221 OR_PREVMPLSHDR, /* previous MPLS header */ 222 OR_LINKTYPE, /* link-layer type */ 223 OR_LINKPL, /* link-layer payload */ 224 OR_LINKPL_NOSNAP, /* link-layer payload, with no SNAP header at the link layer */ 225 OR_TRAN_IPV4, /* transport-layer header, with IPv4 network layer */ 226 OR_TRAN_IPV6 /* transport-layer header, with IPv6 network layer */ 227 }; 228 229 /* 230 * We divy out chunks of memory rather than call malloc each time so 231 * we don't have to worry about leaking memory. It's probably 232 * not a big deal if all this memory was wasted but if this ever 233 * goes into a library that would probably not be a good idea. 234 * 235 * XXX - this *is* in a library.... 236 */ 237 #define NCHUNKS 16 238 #define CHUNK0SIZE 1024 239 struct chunk { 240 size_t n_left; 241 void *m; 242 }; 243 244 /* Code generator state */ 245 246 struct _compiler_state { 247 jmp_buf top_ctx; 248 pcap_t *bpf_pcap; 249 250 struct icode ic; 251 252 int snaplen; 253 254 int linktype; 255 int prevlinktype; 256 int outermostlinktype; 257 258 bpf_u_int32 netmask; 259 int no_optimize; 260 261 /* Hack for handling VLAN and MPLS stacks. */ 262 u_int label_stack_depth; 263 u_int vlan_stack_depth; 264 265 /* XXX */ 266 u_int pcap_fddipad; 267 268 /* 269 * As errors are handled by a longjmp, anything allocated must 270 * be freed in the longjmp handler, so it must be reachable 271 * from that handler. 272 * 273 * One thing that's allocated is the result of pcap_nametoaddrinfo(); 274 * it must be freed with freeaddrinfo(). This variable points to 275 * any addrinfo structure that would need to be freed. 276 */ 277 struct addrinfo *ai; 278 279 /* 280 * Various code constructs need to know the layout of the packet. 281 * These values give the necessary offsets from the beginning 282 * of the packet data. 283 */ 284 285 /* 286 * Absolute offset of the beginning of the link-layer header. 287 */ 288 bpf_abs_offset off_linkhdr; 289 290 /* 291 * If we're checking a link-layer header for a packet encapsulated 292 * in another protocol layer, this is the equivalent information 293 * for the previous layers' link-layer header from the beginning 294 * of the raw packet data. 295 */ 296 bpf_abs_offset off_prevlinkhdr; 297 298 /* 299 * This is the equivalent information for the outermost layers' 300 * link-layer header. 301 */ 302 bpf_abs_offset off_outermostlinkhdr; 303 304 /* 305 * Absolute offset of the beginning of the link-layer payload. 306 */ 307 bpf_abs_offset off_linkpl; 308 309 /* 310 * "off_linktype" is the offset to information in the link-layer 311 * header giving the packet type. This is an absolute offset 312 * from the beginning of the packet. 313 * 314 * For Ethernet, it's the offset of the Ethernet type field; this 315 * means that it must have a value that skips VLAN tags. 316 * 317 * For link-layer types that always use 802.2 headers, it's the 318 * offset of the LLC header; this means that it must have a value 319 * that skips VLAN tags. 320 * 321 * For PPP, it's the offset of the PPP type field. 322 * 323 * For Cisco HDLC, it's the offset of the CHDLC type field. 324 * 325 * For BSD loopback, it's the offset of the AF_ value. 326 * 327 * For Linux cooked sockets, it's the offset of the type field. 328 * 329 * off_linktype.constant_part is set to OFFSET_NOT_SET for no 330 * encapsulation, in which case, IP is assumed. 331 */ 332 bpf_abs_offset off_linktype; 333 334 /* 335 * TRUE if the link layer includes an ATM pseudo-header. 336 */ 337 int is_atm; 338 339 /* 340 * TRUE if "geneve" appeared in the filter; it causes us to 341 * generate code that checks for a Geneve header and assume 342 * that later filters apply to the encapsulated payload. 343 */ 344 int is_geneve; 345 346 /* 347 * TRUE if we need variable length part of VLAN offset 348 */ 349 int is_vlan_vloffset; 350 351 /* 352 * These are offsets for the ATM pseudo-header. 353 */ 354 u_int off_vpi; 355 u_int off_vci; 356 u_int off_proto; 357 358 /* 359 * These are offsets for the MTP2 fields. 360 */ 361 u_int off_li; 362 u_int off_li_hsl; 363 364 /* 365 * These are offsets for the MTP3 fields. 366 */ 367 u_int off_sio; 368 u_int off_opc; 369 u_int off_dpc; 370 u_int off_sls; 371 372 /* 373 * This is the offset of the first byte after the ATM pseudo_header, 374 * or -1 if there is no ATM pseudo-header. 375 */ 376 u_int off_payload; 377 378 /* 379 * These are offsets to the beginning of the network-layer header. 380 * They are relative to the beginning of the link-layer payload 381 * (i.e., they don't include off_linkhdr.constant_part or 382 * off_linkpl.constant_part). 383 * 384 * If the link layer never uses 802.2 LLC: 385 * 386 * "off_nl" and "off_nl_nosnap" are the same. 387 * 388 * If the link layer always uses 802.2 LLC: 389 * 390 * "off_nl" is the offset if there's a SNAP header following 391 * the 802.2 header; 392 * 393 * "off_nl_nosnap" is the offset if there's no SNAP header. 394 * 395 * If the link layer is Ethernet: 396 * 397 * "off_nl" is the offset if the packet is an Ethernet II packet 398 * (we assume no 802.3+802.2+SNAP); 399 * 400 * "off_nl_nosnap" is the offset if the packet is an 802.3 packet 401 * with an 802.2 header following it. 402 */ 403 u_int off_nl; 404 u_int off_nl_nosnap; 405 406 /* 407 * Here we handle simple allocation of the scratch registers. 408 * If too many registers are alloc'd, the allocator punts. 409 */ 410 int regused[BPF_MEMWORDS]; 411 int curreg; 412 413 /* 414 * Memory chunks. 415 */ 416 struct chunk chunks[NCHUNKS]; 417 int cur_chunk; 418 }; 419 420 void PCAP_NORETURN 421 bpf_syntax_error(compiler_state_t *cstate, const char *msg) 422 { 423 bpf_error(cstate, "syntax error in filter expression: %s", msg); 424 /* NOTREACHED */ 425 } 426 427 /* VARARGS */ 428 void PCAP_NORETURN 429 bpf_error(compiler_state_t *cstate, const char *fmt, ...) 430 { 431 va_list ap; 432 433 va_start(ap, fmt); 434 if (cstate->bpf_pcap != NULL) 435 (void)pcap_vsnprintf(pcap_geterr(cstate->bpf_pcap), 436 PCAP_ERRBUF_SIZE, fmt, ap); 437 va_end(ap); 438 longjmp(cstate->top_ctx, 1); 439 /* NOTREACHED */ 440 } 441 442 static void init_linktype(compiler_state_t *, pcap_t *); 443 444 static void init_regs(compiler_state_t *); 445 static int alloc_reg(compiler_state_t *); 446 static void free_reg(compiler_state_t *, int); 447 448 static void initchunks(compiler_state_t *cstate); 449 static void *newchunk(compiler_state_t *cstate, size_t); 450 static void freechunks(compiler_state_t *cstate); 451 static inline struct block *new_block(compiler_state_t *cstate, int); 452 static inline struct slist *new_stmt(compiler_state_t *cstate, int); 453 static struct block *gen_retblk(compiler_state_t *cstate, int); 454 static inline void syntax(compiler_state_t *cstate); 455 456 static void backpatch(struct block *, struct block *); 457 static void merge(struct block *, struct block *); 458 static struct block *gen_cmp(compiler_state_t *, enum e_offrel, u_int, 459 u_int, bpf_int32); 460 static struct block *gen_cmp_gt(compiler_state_t *, enum e_offrel, u_int, 461 u_int, bpf_int32); 462 static struct block *gen_cmp_ge(compiler_state_t *, enum e_offrel, u_int, 463 u_int, bpf_int32); 464 static struct block *gen_cmp_lt(compiler_state_t *, enum e_offrel, u_int, 465 u_int, bpf_int32); 466 static struct block *gen_cmp_le(compiler_state_t *, enum e_offrel, u_int, 467 u_int, bpf_int32); 468 static struct block *gen_mcmp(compiler_state_t *, enum e_offrel, u_int, 469 u_int, bpf_int32, bpf_u_int32); 470 static struct block *gen_bcmp(compiler_state_t *, enum e_offrel, u_int, 471 u_int, const u_char *); 472 static struct block *gen_ncmp(compiler_state_t *, enum e_offrel, bpf_u_int32, 473 bpf_u_int32, bpf_u_int32, bpf_u_int32, int, bpf_int32); 474 static struct slist *gen_load_absoffsetrel(compiler_state_t *, bpf_abs_offset *, 475 u_int, u_int); 476 static struct slist *gen_load_a(compiler_state_t *, enum e_offrel, u_int, 477 u_int); 478 static struct slist *gen_loadx_iphdrlen(compiler_state_t *); 479 static struct block *gen_uncond(compiler_state_t *, int); 480 static inline struct block *gen_true(compiler_state_t *); 481 static inline struct block *gen_false(compiler_state_t *); 482 static struct block *gen_ether_linktype(compiler_state_t *, int); 483 static struct block *gen_ipnet_linktype(compiler_state_t *, int); 484 static struct block *gen_linux_sll_linktype(compiler_state_t *, int); 485 static struct slist *gen_load_prism_llprefixlen(compiler_state_t *); 486 static struct slist *gen_load_avs_llprefixlen(compiler_state_t *); 487 static struct slist *gen_load_radiotap_llprefixlen(compiler_state_t *); 488 static struct slist *gen_load_ppi_llprefixlen(compiler_state_t *); 489 static void insert_compute_vloffsets(compiler_state_t *, struct block *); 490 static struct slist *gen_abs_offset_varpart(compiler_state_t *, 491 bpf_abs_offset *); 492 static int ethertype_to_ppptype(int); 493 static struct block *gen_linktype(compiler_state_t *, int); 494 static struct block *gen_snap(compiler_state_t *, bpf_u_int32, bpf_u_int32); 495 static struct block *gen_llc_linktype(compiler_state_t *, int); 496 static struct block *gen_hostop(compiler_state_t *, bpf_u_int32, bpf_u_int32, 497 int, int, u_int, u_int); 498 #ifdef INET6 499 static struct block *gen_hostop6(compiler_state_t *, struct in6_addr *, 500 struct in6_addr *, int, int, u_int, u_int); 501 #endif 502 static struct block *gen_ahostop(compiler_state_t *, const u_char *, int); 503 static struct block *gen_ehostop(compiler_state_t *, const u_char *, int); 504 static struct block *gen_fhostop(compiler_state_t *, const u_char *, int); 505 static struct block *gen_thostop(compiler_state_t *, const u_char *, int); 506 static struct block *gen_wlanhostop(compiler_state_t *, const u_char *, int); 507 static struct block *gen_ipfchostop(compiler_state_t *, const u_char *, int); 508 static struct block *gen_dnhostop(compiler_state_t *, bpf_u_int32, int); 509 static struct block *gen_mpls_linktype(compiler_state_t *, int); 510 static struct block *gen_host(compiler_state_t *, bpf_u_int32, bpf_u_int32, 511 int, int, int); 512 #ifdef INET6 513 static struct block *gen_host6(compiler_state_t *, struct in6_addr *, 514 struct in6_addr *, int, int, int); 515 #endif 516 #ifndef INET6 517 static struct block *gen_gateway(compiler_state_t *, const u_char *, 518 struct addrinfo *, int, int); 519 #endif 520 static struct block *gen_ipfrag(compiler_state_t *); 521 static struct block *gen_portatom(compiler_state_t *, int, bpf_int32); 522 static struct block *gen_portrangeatom(compiler_state_t *, int, bpf_int32, 523 bpf_int32); 524 static struct block *gen_portatom6(compiler_state_t *, int, bpf_int32); 525 static struct block *gen_portrangeatom6(compiler_state_t *, int, bpf_int32, 526 bpf_int32); 527 struct block *gen_portop(compiler_state_t *, int, int, int); 528 static struct block *gen_port(compiler_state_t *, int, int, int); 529 struct block *gen_portrangeop(compiler_state_t *, int, int, int, int); 530 static struct block *gen_portrange(compiler_state_t *, int, int, int, int); 531 struct block *gen_portop6(compiler_state_t *, int, int, int); 532 static struct block *gen_port6(compiler_state_t *, int, int, int); 533 struct block *gen_portrangeop6(compiler_state_t *, int, int, int, int); 534 static struct block *gen_portrange6(compiler_state_t *, int, int, int, int); 535 static int lookup_proto(compiler_state_t *, const char *, int); 536 static struct block *gen_protochain(compiler_state_t *, int, int, int); 537 static struct block *gen_proto(compiler_state_t *, int, int, int); 538 static struct slist *xfer_to_x(compiler_state_t *, struct arth *); 539 static struct slist *xfer_to_a(compiler_state_t *, struct arth *); 540 static struct block *gen_mac_multicast(compiler_state_t *, int); 541 static struct block *gen_len(compiler_state_t *, int, int); 542 static struct block *gen_check_802_11_data_frame(compiler_state_t *); 543 static struct block *gen_geneve_ll_check(compiler_state_t *cstate); 544 545 static struct block *gen_ppi_dlt_check(compiler_state_t *); 546 static struct block *gen_msg_abbrev(compiler_state_t *, int type); 547 548 static void 549 initchunks(compiler_state_t *cstate) 550 { 551 int i; 552 553 for (i = 0; i < NCHUNKS; i++) { 554 cstate->chunks[i].n_left = 0; 555 cstate->chunks[i].m = NULL; 556 } 557 cstate->cur_chunk = 0; 558 } 559 560 static void * 561 newchunk(compiler_state_t *cstate, size_t n) 562 { 563 struct chunk *cp; 564 int k; 565 size_t size; 566 567 #ifndef __NetBSD__ 568 /* XXX Round up to nearest long. */ 569 n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); 570 #else 571 /* XXX Round up to structure boundary. */ 572 n = ALIGN(n); 573 #endif 574 575 cp = &cstate->chunks[cstate->cur_chunk]; 576 if (n > cp->n_left) { 577 ++cp; 578 k = ++cstate->cur_chunk; 579 if (k >= NCHUNKS) 580 bpf_error(cstate, "out of memory"); 581 size = CHUNK0SIZE << k; 582 cp->m = (void *)malloc(size); 583 if (cp->m == NULL) 584 bpf_error(cstate, "out of memory"); 585 memset((char *)cp->m, 0, size); 586 cp->n_left = size; 587 if (n > size) 588 bpf_error(cstate, "out of memory"); 589 } 590 cp->n_left -= n; 591 return (void *)((char *)cp->m + cp->n_left); 592 } 593 594 static void 595 freechunks(compiler_state_t *cstate) 596 { 597 int i; 598 599 for (i = 0; i < NCHUNKS; ++i) 600 if (cstate->chunks[i].m != NULL) 601 free(cstate->chunks[i].m); 602 } 603 604 /* 605 * A strdup whose allocations are freed after code generation is over. 606 */ 607 char * 608 sdup(compiler_state_t *cstate, const char *s) 609 { 610 size_t n = strlen(s) + 1; 611 char *cp = newchunk(cstate, n); 612 613 strlcpy(cp, s, n); 614 return (cp); 615 } 616 617 static inline struct block * 618 new_block(compiler_state_t *cstate, int code) 619 { 620 struct block *p; 621 622 p = (struct block *)newchunk(cstate, sizeof(*p)); 623 p->s.code = code; 624 p->head = p; 625 626 return p; 627 } 628 629 static inline struct slist * 630 new_stmt(compiler_state_t *cstate, int code) 631 { 632 struct slist *p; 633 634 p = (struct slist *)newchunk(cstate, sizeof(*p)); 635 p->s.code = code; 636 637 return p; 638 } 639 640 static struct block * 641 gen_retblk(compiler_state_t *cstate, int v) 642 { 643 struct block *b = new_block(cstate, BPF_RET|BPF_K); 644 645 b->s.k = v; 646 return b; 647 } 648 649 static inline PCAP_NORETURN_DEF void 650 syntax(compiler_state_t *cstate) 651 { 652 bpf_error(cstate, "syntax error in filter expression"); 653 } 654 655 int 656 pcap_compile(pcap_t *p, struct bpf_program *program, 657 const char *buf, int optimize, bpf_u_int32 mask) 658 { 659 #ifdef _WIN32 660 static int done = 0; 661 #endif 662 compiler_state_t cstate; 663 const char * volatile xbuf = buf; 664 yyscan_t scanner = NULL; 665 YY_BUFFER_STATE in_buffer = NULL; 666 u_int len; 667 int rc; 668 669 /* 670 * If this pcap_t hasn't been activated, it doesn't have a 671 * link-layer type, so we can't use it. 672 */ 673 if (!p->activated) { 674 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 675 "not-yet-activated pcap_t passed to pcap_compile"); 676 return (-1); 677 } 678 679 #ifdef _WIN32 680 if (!done) 681 pcap_wsockinit(); 682 done = 1; 683 #endif 684 685 #ifdef ENABLE_REMOTE 686 /* 687 * If the device on which we're capturing need to be notified 688 * that a new filter is being compiled, do so. 689 * 690 * This allows them to save a copy of it, in case, for example, 691 * they're implementing a form of remote packet capture, and 692 * want the remote machine to filter out the packets in which 693 * it's sending the packets it's captured. 694 * 695 * XXX - the fact that we happen to be compiling a filter 696 * doesn't necessarily mean we'll be installing it as the 697 * filter for this pcap_t; we might be running it from userland 698 * on captured packets to do packet classification. We really 699 * need a better way of handling this, but this is all that 700 * the WinPcap code did. 701 */ 702 if (p->save_current_filter_op != NULL) 703 (p->save_current_filter_op)(p, buf); 704 #endif 705 706 initchunks(&cstate); 707 cstate.no_optimize = 0; 708 #ifdef INET6 709 cstate.ai = NULL; 710 #endif 711 cstate.ic.root = NULL; 712 cstate.ic.cur_mark = 0; 713 cstate.bpf_pcap = p; 714 init_regs(&cstate); 715 716 if (setjmp(cstate.top_ctx)) { 717 #ifdef INET6 718 if (cstate.ai != NULL) 719 freeaddrinfo(cstate.ai); 720 #endif 721 rc = -1; 722 goto quit; 723 } 724 725 cstate.netmask = mask; 726 727 cstate.snaplen = pcap_snapshot(p); 728 if (cstate.snaplen == 0) { 729 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 730 "snaplen of 0 rejects all packets"); 731 rc = -1; 732 goto quit; 733 } 734 735 if (pcap_lex_init(&scanner) != 0) 736 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, 737 errno, "can't initialize scanner"); 738 in_buffer = pcap__scan_string(xbuf ? xbuf : "", scanner); 739 740 /* 741 * Associate the compiler state with the lexical analyzer 742 * state. 743 */ 744 pcap_set_extra(&cstate, scanner); 745 746 init_linktype(&cstate, p); 747 (void)pcap_parse(scanner, &cstate); 748 749 if (cstate.ic.root == NULL) 750 cstate.ic.root = gen_retblk(&cstate, cstate.snaplen); 751 752 if (optimize && !cstate.no_optimize) { 753 bpf_optimize(&cstate, &cstate.ic); 754 if (cstate.ic.root == NULL || 755 (cstate.ic.root->s.code == (BPF_RET|BPF_K) && cstate.ic.root->s.k == 0)) 756 bpf_error(&cstate, "expression rejects all packets"); 757 } 758 program->bf_insns = icode_to_fcode(&cstate, &cstate.ic, cstate.ic.root, &len); 759 program->bf_len = len; 760 761 rc = 0; /* We're all okay */ 762 763 quit: 764 /* 765 * Clean up everything for the lexical analyzer. 766 */ 767 if (in_buffer != NULL) 768 pcap__delete_buffer(in_buffer, scanner); 769 if (scanner != NULL) 770 pcap_lex_destroy(scanner); 771 772 /* 773 * Clean up our own allocated memory. 774 */ 775 freechunks(&cstate); 776 777 return (rc); 778 } 779 780 /* 781 * entry point for using the compiler with no pcap open 782 * pass in all the stuff that is needed explicitly instead. 783 */ 784 int 785 pcap_compile_nopcap(int snaplen_arg, int linktype_arg, 786 struct bpf_program *program, 787 const char *buf, int optimize, bpf_u_int32 mask) 788 { 789 pcap_t *p; 790 int ret; 791 792 p = pcap_open_dead(linktype_arg, snaplen_arg); 793 if (p == NULL) 794 return (-1); 795 ret = pcap_compile(p, program, buf, optimize, mask); 796 pcap_close(p); 797 return (ret); 798 } 799 800 /* 801 * Clean up a "struct bpf_program" by freeing all the memory allocated 802 * in it. 803 */ 804 void 805 pcap_freecode(struct bpf_program *program) 806 { 807 program->bf_len = 0; 808 if (program->bf_insns != NULL) { 809 free((char *)program->bf_insns); 810 program->bf_insns = NULL; 811 } 812 } 813 814 /* 815 * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates 816 * which of the jt and jf fields has been resolved and which is a pointer 817 * back to another unresolved block (or nil). At least one of the fields 818 * in each block is already resolved. 819 */ 820 static void 821 backpatch(struct block *list, struct block *target) 822 { 823 struct block *next; 824 825 while (list) { 826 if (!list->sense) { 827 next = JT(list); 828 JT(list) = target; 829 } else { 830 next = JF(list); 831 JF(list) = target; 832 } 833 list = next; 834 } 835 } 836 837 /* 838 * Merge the lists in b0 and b1, using the 'sense' field to indicate 839 * which of jt and jf is the link. 840 */ 841 static void 842 merge(struct block *b0, struct block *b1) 843 { 844 register struct block **p = &b0; 845 846 /* Find end of list. */ 847 while (*p) 848 p = !((*p)->sense) ? &JT(*p) : &JF(*p); 849 850 /* Concatenate the lists. */ 851 *p = b1; 852 } 853 854 void 855 finish_parse(compiler_state_t *cstate, struct block *p) 856 { 857 struct block *ppi_dlt_check; 858 859 /* 860 * Insert before the statements of the first (root) block any 861 * statements needed to load the lengths of any variable-length 862 * headers into registers. 863 * 864 * XXX - a fancier strategy would be to insert those before the 865 * statements of all blocks that use those lengths and that 866 * have no predecessors that use them, so that we only compute 867 * the lengths if we need them. There might be even better 868 * approaches than that. 869 * 870 * However, those strategies would be more complicated, and 871 * as we don't generate code to compute a length if the 872 * program has no tests that use the length, and as most 873 * tests will probably use those lengths, we would just 874 * postpone computing the lengths so that it's not done 875 * for tests that fail early, and it's not clear that's 876 * worth the effort. 877 */ 878 insert_compute_vloffsets(cstate, p->head); 879 880 /* 881 * For DLT_PPI captures, generate a check of the per-packet 882 * DLT value to make sure it's DLT_IEEE802_11. 883 * 884 * XXX - TurboCap cards use DLT_PPI for Ethernet. 885 * Can we just define some DLT_ETHERNET_WITH_PHDR pseudo-header 886 * with appropriate Ethernet information and use that rather 887 * than using something such as DLT_PPI where you don't know 888 * the link-layer header type until runtime, which, in the 889 * general case, would force us to generate both Ethernet *and* 890 * 802.11 code (*and* anything else for which PPI is used) 891 * and choose between them early in the BPF program? 892 */ 893 ppi_dlt_check = gen_ppi_dlt_check(cstate); 894 if (ppi_dlt_check != NULL) 895 gen_and(ppi_dlt_check, p); 896 897 backpatch(p, gen_retblk(cstate, cstate->snaplen)); 898 p->sense = !p->sense; 899 backpatch(p, gen_retblk(cstate, 0)); 900 cstate->ic.root = p->head; 901 } 902 903 void 904 gen_and(struct block *b0, struct block *b1) 905 { 906 backpatch(b0, b1->head); 907 b0->sense = !b0->sense; 908 b1->sense = !b1->sense; 909 merge(b1, b0); 910 b1->sense = !b1->sense; 911 b1->head = b0->head; 912 } 913 914 void 915 gen_or(struct block *b0, struct block *b1) 916 { 917 b0->sense = !b0->sense; 918 backpatch(b0, b1->head); 919 b0->sense = !b0->sense; 920 merge(b1, b0); 921 b1->head = b0->head; 922 } 923 924 void 925 gen_not(struct block *b) 926 { 927 b->sense = !b->sense; 928 } 929 930 static struct block * 931 gen_cmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 932 u_int size, bpf_int32 v) 933 { 934 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v); 935 } 936 937 static struct block * 938 gen_cmp_gt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 939 u_int size, bpf_int32 v) 940 { 941 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 0, v); 942 } 943 944 static struct block * 945 gen_cmp_ge(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 946 u_int size, bpf_int32 v) 947 { 948 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 0, v); 949 } 950 951 static struct block * 952 gen_cmp_lt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 953 u_int size, bpf_int32 v) 954 { 955 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 1, v); 956 } 957 958 static struct block * 959 gen_cmp_le(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 960 u_int size, bpf_int32 v) 961 { 962 return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 1, v); 963 } 964 965 static struct block * 966 gen_mcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 967 u_int size, bpf_int32 v, bpf_u_int32 mask) 968 { 969 return gen_ncmp(cstate, offrel, offset, size, mask, BPF_JEQ, 0, v); 970 } 971 972 static struct block * 973 gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 974 u_int size, const u_char *v) 975 { 976 register struct block *b, *tmp; 977 978 b = NULL; 979 while (size >= 4) { 980 register const u_char *p = &v[size - 4]; 981 bpf_int32 w = ((bpf_int32)p[0] << 24) | 982 ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; 983 984 tmp = gen_cmp(cstate, offrel, offset + size - 4, BPF_W, w); 985 if (b != NULL) 986 gen_and(b, tmp); 987 b = tmp; 988 size -= 4; 989 } 990 while (size >= 2) { 991 register const u_char *p = &v[size - 2]; 992 bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; 993 994 tmp = gen_cmp(cstate, offrel, offset + size - 2, BPF_H, w); 995 if (b != NULL) 996 gen_and(b, tmp); 997 b = tmp; 998 size -= 2; 999 } 1000 if (size > 0) { 1001 tmp = gen_cmp(cstate, offrel, offset, BPF_B, (bpf_int32)v[0]); 1002 if (b != NULL) 1003 gen_and(b, tmp); 1004 b = tmp; 1005 } 1006 return b; 1007 } 1008 1009 /* 1010 * AND the field of size "size" at offset "offset" relative to the header 1011 * specified by "offrel" with "mask", and compare it with the value "v" 1012 * with the test specified by "jtype"; if "reverse" is true, the test 1013 * should test the opposite of "jtype". 1014 */ 1015 static struct block * 1016 gen_ncmp(compiler_state_t *cstate, enum e_offrel offrel, bpf_u_int32 offset, 1017 bpf_u_int32 size, bpf_u_int32 mask, bpf_u_int32 jtype, int reverse, 1018 bpf_int32 v) 1019 { 1020 struct slist *s, *s2; 1021 struct block *b; 1022 1023 s = gen_load_a(cstate, offrel, offset, size); 1024 1025 if (mask != 0xffffffff) { 1026 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 1027 s2->s.k = mask; 1028 sappend(s, s2); 1029 } 1030 1031 b = new_block(cstate, JMP(jtype)); 1032 b->stmts = s; 1033 b->s.k = v; 1034 if (reverse && (jtype == BPF_JGT || jtype == BPF_JGE)) 1035 gen_not(b); 1036 return b; 1037 } 1038 1039 static void 1040 init_linktype(compiler_state_t *cstate, pcap_t *p) 1041 { 1042 cstate->pcap_fddipad = p->fddipad; 1043 1044 /* 1045 * We start out with only one link-layer header. 1046 */ 1047 cstate->outermostlinktype = pcap_datalink(p); 1048 cstate->off_outermostlinkhdr.constant_part = 0; 1049 cstate->off_outermostlinkhdr.is_variable = 0; 1050 cstate->off_outermostlinkhdr.reg = -1; 1051 1052 cstate->prevlinktype = cstate->outermostlinktype; 1053 cstate->off_prevlinkhdr.constant_part = 0; 1054 cstate->off_prevlinkhdr.is_variable = 0; 1055 cstate->off_prevlinkhdr.reg = -1; 1056 1057 cstate->linktype = cstate->outermostlinktype; 1058 cstate->off_linkhdr.constant_part = 0; 1059 cstate->off_linkhdr.is_variable = 0; 1060 cstate->off_linkhdr.reg = -1; 1061 1062 /* 1063 * XXX 1064 */ 1065 cstate->off_linkpl.constant_part = 0; 1066 cstate->off_linkpl.is_variable = 0; 1067 cstate->off_linkpl.reg = -1; 1068 1069 cstate->off_linktype.constant_part = 0; 1070 cstate->off_linktype.is_variable = 0; 1071 cstate->off_linktype.reg = -1; 1072 1073 /* 1074 * Assume it's not raw ATM with a pseudo-header, for now. 1075 */ 1076 cstate->is_atm = 0; 1077 cstate->off_vpi = OFFSET_NOT_SET; 1078 cstate->off_vci = OFFSET_NOT_SET; 1079 cstate->off_proto = OFFSET_NOT_SET; 1080 cstate->off_payload = OFFSET_NOT_SET; 1081 1082 /* 1083 * And not Geneve. 1084 */ 1085 cstate->is_geneve = 0; 1086 1087 /* 1088 * No variable length VLAN offset by default 1089 */ 1090 cstate->is_vlan_vloffset = 0; 1091 1092 /* 1093 * And assume we're not doing SS7. 1094 */ 1095 cstate->off_li = OFFSET_NOT_SET; 1096 cstate->off_li_hsl = OFFSET_NOT_SET; 1097 cstate->off_sio = OFFSET_NOT_SET; 1098 cstate->off_opc = OFFSET_NOT_SET; 1099 cstate->off_dpc = OFFSET_NOT_SET; 1100 cstate->off_sls = OFFSET_NOT_SET; 1101 1102 cstate->label_stack_depth = 0; 1103 cstate->vlan_stack_depth = 0; 1104 1105 switch (cstate->linktype) { 1106 1107 case DLT_ARCNET: 1108 cstate->off_linktype.constant_part = 2; 1109 cstate->off_linkpl.constant_part = 6; 1110 cstate->off_nl = 0; /* XXX in reality, variable! */ 1111 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1112 break; 1113 1114 case DLT_ARCNET_LINUX: 1115 cstate->off_linktype.constant_part = 4; 1116 cstate->off_linkpl.constant_part = 8; 1117 cstate->off_nl = 0; /* XXX in reality, variable! */ 1118 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1119 break; 1120 1121 case DLT_EN10MB: 1122 cstate->off_linktype.constant_part = 12; 1123 cstate->off_linkpl.constant_part = 14; /* Ethernet header length */ 1124 cstate->off_nl = 0; /* Ethernet II */ 1125 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 1126 break; 1127 1128 case DLT_SLIP: 1129 /* 1130 * SLIP doesn't have a link level type. The 16 byte 1131 * header is hacked into our SLIP driver. 1132 */ 1133 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1134 cstate->off_linkpl.constant_part = 16; 1135 cstate->off_nl = 0; 1136 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1137 break; 1138 1139 case DLT_SLIP_BSDOS: 1140 /* XXX this may be the same as the DLT_PPP_BSDOS case */ 1141 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1142 /* XXX end */ 1143 cstate->off_linkpl.constant_part = 24; 1144 cstate->off_nl = 0; 1145 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1146 break; 1147 1148 case DLT_NULL: 1149 case DLT_LOOP: 1150 cstate->off_linktype.constant_part = 0; 1151 cstate->off_linkpl.constant_part = 4; 1152 cstate->off_nl = 0; 1153 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1154 break; 1155 1156 case DLT_ENC: 1157 cstate->off_linktype.constant_part = 0; 1158 cstate->off_linkpl.constant_part = 12; 1159 cstate->off_nl = 0; 1160 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1161 break; 1162 1163 case DLT_PPP: 1164 case DLT_PPP_PPPD: 1165 case DLT_C_HDLC: /* BSD/OS Cisco HDLC */ 1166 case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */ 1167 cstate->off_linktype.constant_part = 2; /* skip HDLC-like framing */ 1168 cstate->off_linkpl.constant_part = 4; /* skip HDLC-like framing and protocol field */ 1169 cstate->off_nl = 0; 1170 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1171 break; 1172 1173 case DLT_PPP_ETHER: 1174 /* 1175 * This does no include the Ethernet header, and 1176 * only covers session state. 1177 */ 1178 cstate->off_linktype.constant_part = 6; 1179 cstate->off_linkpl.constant_part = 8; 1180 cstate->off_nl = 0; 1181 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1182 break; 1183 1184 case DLT_PPP_BSDOS: 1185 cstate->off_linktype.constant_part = 5; 1186 cstate->off_linkpl.constant_part = 24; 1187 cstate->off_nl = 0; 1188 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1189 break; 1190 1191 case DLT_FDDI: 1192 /* 1193 * FDDI doesn't really have a link-level type field. 1194 * We set "off_linktype" to the offset of the LLC header. 1195 * 1196 * To check for Ethernet types, we assume that SSAP = SNAP 1197 * is being used and pick out the encapsulated Ethernet type. 1198 * XXX - should we generate code to check for SNAP? 1199 */ 1200 cstate->off_linktype.constant_part = 13; 1201 cstate->off_linktype.constant_part += cstate->pcap_fddipad; 1202 cstate->off_linkpl.constant_part = 13; /* FDDI MAC header length */ 1203 cstate->off_linkpl.constant_part += cstate->pcap_fddipad; 1204 cstate->off_nl = 8; /* 802.2+SNAP */ 1205 cstate->off_nl_nosnap = 3; /* 802.2 */ 1206 break; 1207 1208 case DLT_IEEE802: 1209 /* 1210 * Token Ring doesn't really have a link-level type field. 1211 * We set "off_linktype" to the offset of the LLC header. 1212 * 1213 * To check for Ethernet types, we assume that SSAP = SNAP 1214 * is being used and pick out the encapsulated Ethernet type. 1215 * XXX - should we generate code to check for SNAP? 1216 * 1217 * XXX - the header is actually variable-length. 1218 * Some various Linux patched versions gave 38 1219 * as "off_linktype" and 40 as "off_nl"; however, 1220 * if a token ring packet has *no* routing 1221 * information, i.e. is not source-routed, the correct 1222 * values are 20 and 22, as they are in the vanilla code. 1223 * 1224 * A packet is source-routed iff the uppermost bit 1225 * of the first byte of the source address, at an 1226 * offset of 8, has the uppermost bit set. If the 1227 * packet is source-routed, the total number of bytes 1228 * of routing information is 2 plus bits 0x1F00 of 1229 * the 16-bit value at an offset of 14 (shifted right 1230 * 8 - figure out which byte that is). 1231 */ 1232 cstate->off_linktype.constant_part = 14; 1233 cstate->off_linkpl.constant_part = 14; /* Token Ring MAC header length */ 1234 cstate->off_nl = 8; /* 802.2+SNAP */ 1235 cstate->off_nl_nosnap = 3; /* 802.2 */ 1236 break; 1237 1238 case DLT_PRISM_HEADER: 1239 case DLT_IEEE802_11_RADIO_AVS: 1240 case DLT_IEEE802_11_RADIO: 1241 cstate->off_linkhdr.is_variable = 1; 1242 /* Fall through, 802.11 doesn't have a variable link 1243 * prefix but is otherwise the same. */ 1244 1245 case DLT_IEEE802_11: 1246 /* 1247 * 802.11 doesn't really have a link-level type field. 1248 * We set "off_linktype.constant_part" to the offset of 1249 * the LLC header. 1250 * 1251 * To check for Ethernet types, we assume that SSAP = SNAP 1252 * is being used and pick out the encapsulated Ethernet type. 1253 * XXX - should we generate code to check for SNAP? 1254 * 1255 * We also handle variable-length radio headers here. 1256 * The Prism header is in theory variable-length, but in 1257 * practice it's always 144 bytes long. However, some 1258 * drivers on Linux use ARPHRD_IEEE80211_PRISM, but 1259 * sometimes or always supply an AVS header, so we 1260 * have to check whether the radio header is a Prism 1261 * header or an AVS header, so, in practice, it's 1262 * variable-length. 1263 */ 1264 cstate->off_linktype.constant_part = 24; 1265 cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */ 1266 cstate->off_linkpl.is_variable = 1; 1267 cstate->off_nl = 8; /* 802.2+SNAP */ 1268 cstate->off_nl_nosnap = 3; /* 802.2 */ 1269 break; 1270 1271 case DLT_PPI: 1272 /* 1273 * At the moment we treat PPI the same way that we treat 1274 * normal Radiotap encoded packets. The difference is in 1275 * the function that generates the code at the beginning 1276 * to compute the header length. Since this code generator 1277 * of PPI supports bare 802.11 encapsulation only (i.e. 1278 * the encapsulated DLT should be DLT_IEEE802_11) we 1279 * generate code to check for this too. 1280 */ 1281 cstate->off_linktype.constant_part = 24; 1282 cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */ 1283 cstate->off_linkpl.is_variable = 1; 1284 cstate->off_linkhdr.is_variable = 1; 1285 cstate->off_nl = 8; /* 802.2+SNAP */ 1286 cstate->off_nl_nosnap = 3; /* 802.2 */ 1287 break; 1288 1289 case DLT_ATM_RFC1483: 1290 case DLT_ATM_CLIP: /* Linux ATM defines this */ 1291 /* 1292 * assume routed, non-ISO PDUs 1293 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) 1294 * 1295 * XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS, 1296 * or PPP with the PPP NLPID (e.g., PPPoA)? The 1297 * latter would presumably be treated the way PPPoE 1298 * should be, so you can do "pppoe and udp port 2049" 1299 * or "pppoa and tcp port 80" and have it check for 1300 * PPPo{A,E} and a PPP protocol of IP and.... 1301 */ 1302 cstate->off_linktype.constant_part = 0; 1303 cstate->off_linkpl.constant_part = 0; /* packet begins with LLC header */ 1304 cstate->off_nl = 8; /* 802.2+SNAP */ 1305 cstate->off_nl_nosnap = 3; /* 802.2 */ 1306 break; 1307 1308 case DLT_SUNATM: 1309 /* 1310 * Full Frontal ATM; you get AALn PDUs with an ATM 1311 * pseudo-header. 1312 */ 1313 cstate->is_atm = 1; 1314 cstate->off_vpi = SUNATM_VPI_POS; 1315 cstate->off_vci = SUNATM_VCI_POS; 1316 cstate->off_proto = PROTO_POS; 1317 cstate->off_payload = SUNATM_PKT_BEGIN_POS; 1318 cstate->off_linktype.constant_part = cstate->off_payload; 1319 cstate->off_linkpl.constant_part = cstate->off_payload; /* if LLC-encapsulated */ 1320 cstate->off_nl = 8; /* 802.2+SNAP */ 1321 cstate->off_nl_nosnap = 3; /* 802.2 */ 1322 break; 1323 1324 case DLT_RAW: 1325 case DLT_IPV4: 1326 case DLT_IPV6: 1327 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1328 cstate->off_linkpl.constant_part = 0; 1329 cstate->off_nl = 0; 1330 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1331 break; 1332 1333 case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ 1334 cstate->off_linktype.constant_part = 14; 1335 cstate->off_linkpl.constant_part = 16; 1336 cstate->off_nl = 0; 1337 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1338 break; 1339 1340 case DLT_LTALK: 1341 /* 1342 * LocalTalk does have a 1-byte type field in the LLAP header, 1343 * but really it just indicates whether there is a "short" or 1344 * "long" DDP packet following. 1345 */ 1346 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1347 cstate->off_linkpl.constant_part = 0; 1348 cstate->off_nl = 0; 1349 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1350 break; 1351 1352 case DLT_IP_OVER_FC: 1353 /* 1354 * RFC 2625 IP-over-Fibre-Channel doesn't really have a 1355 * link-level type field. We set "off_linktype" to the 1356 * offset of the LLC header. 1357 * 1358 * To check for Ethernet types, we assume that SSAP = SNAP 1359 * is being used and pick out the encapsulated Ethernet type. 1360 * XXX - should we generate code to check for SNAP? RFC 1361 * 2625 says SNAP should be used. 1362 */ 1363 cstate->off_linktype.constant_part = 16; 1364 cstate->off_linkpl.constant_part = 16; 1365 cstate->off_nl = 8; /* 802.2+SNAP */ 1366 cstate->off_nl_nosnap = 3; /* 802.2 */ 1367 break; 1368 1369 case DLT_FRELAY: 1370 /* 1371 * XXX - we should set this to handle SNAP-encapsulated 1372 * frames (NLPID of 0x80). 1373 */ 1374 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1375 cstate->off_linkpl.constant_part = 0; 1376 cstate->off_nl = 0; 1377 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1378 break; 1379 1380 /* 1381 * the only BPF-interesting FRF.16 frames are non-control frames; 1382 * Frame Relay has a variable length link-layer 1383 * so lets start with offset 4 for now and increments later on (FIXME); 1384 */ 1385 case DLT_MFR: 1386 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1387 cstate->off_linkpl.constant_part = 0; 1388 cstate->off_nl = 4; 1389 cstate->off_nl_nosnap = 0; /* XXX - for now -> no 802.2 LLC */ 1390 break; 1391 1392 case DLT_APPLE_IP_OVER_IEEE1394: 1393 cstate->off_linktype.constant_part = 16; 1394 cstate->off_linkpl.constant_part = 18; 1395 cstate->off_nl = 0; 1396 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1397 break; 1398 1399 case DLT_SYMANTEC_FIREWALL: 1400 cstate->off_linktype.constant_part = 6; 1401 cstate->off_linkpl.constant_part = 44; 1402 cstate->off_nl = 0; /* Ethernet II */ 1403 cstate->off_nl_nosnap = 0; /* XXX - what does it do with 802.3 packets? */ 1404 break; 1405 1406 #ifdef HAVE_NET_PFVAR_H 1407 case DLT_PFLOG: 1408 cstate->off_linktype.constant_part = 0; 1409 cstate->off_linkpl.constant_part = PFLOG_HDRLEN; 1410 cstate->off_nl = 0; 1411 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 1412 break; 1413 #endif 1414 1415 case DLT_JUNIPER_MFR: 1416 case DLT_JUNIPER_MLFR: 1417 case DLT_JUNIPER_MLPPP: 1418 case DLT_JUNIPER_PPP: 1419 case DLT_JUNIPER_CHDLC: 1420 case DLT_JUNIPER_FRELAY: 1421 cstate->off_linktype.constant_part = 4; 1422 cstate->off_linkpl.constant_part = 4; 1423 cstate->off_nl = 0; 1424 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1425 break; 1426 1427 case DLT_JUNIPER_ATM1: 1428 cstate->off_linktype.constant_part = 4; /* in reality variable between 4-8 */ 1429 cstate->off_linkpl.constant_part = 4; /* in reality variable between 4-8 */ 1430 cstate->off_nl = 0; 1431 cstate->off_nl_nosnap = 10; 1432 break; 1433 1434 case DLT_JUNIPER_ATM2: 1435 cstate->off_linktype.constant_part = 8; /* in reality variable between 8-12 */ 1436 cstate->off_linkpl.constant_part = 8; /* in reality variable between 8-12 */ 1437 cstate->off_nl = 0; 1438 cstate->off_nl_nosnap = 10; 1439 break; 1440 1441 /* frames captured on a Juniper PPPoE service PIC 1442 * contain raw ethernet frames */ 1443 case DLT_JUNIPER_PPPOE: 1444 case DLT_JUNIPER_ETHER: 1445 cstate->off_linkpl.constant_part = 14; 1446 cstate->off_linktype.constant_part = 16; 1447 cstate->off_nl = 18; /* Ethernet II */ 1448 cstate->off_nl_nosnap = 21; /* 802.3+802.2 */ 1449 break; 1450 1451 case DLT_JUNIPER_PPPOE_ATM: 1452 cstate->off_linktype.constant_part = 4; 1453 cstate->off_linkpl.constant_part = 6; 1454 cstate->off_nl = 0; 1455 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1456 break; 1457 1458 case DLT_JUNIPER_GGSN: 1459 cstate->off_linktype.constant_part = 6; 1460 cstate->off_linkpl.constant_part = 12; 1461 cstate->off_nl = 0; 1462 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1463 break; 1464 1465 case DLT_JUNIPER_ES: 1466 cstate->off_linktype.constant_part = 6; 1467 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; /* not really a network layer but raw IP addresses */ 1468 cstate->off_nl = OFFSET_NOT_SET; /* not really a network layer but raw IP addresses */ 1469 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1470 break; 1471 1472 case DLT_JUNIPER_MONITOR: 1473 cstate->off_linktype.constant_part = 12; 1474 cstate->off_linkpl.constant_part = 12; 1475 cstate->off_nl = 0; /* raw IP/IP6 header */ 1476 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1477 break; 1478 1479 case DLT_BACNET_MS_TP: 1480 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1481 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1482 cstate->off_nl = OFFSET_NOT_SET; 1483 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1484 break; 1485 1486 case DLT_JUNIPER_SERVICES: 1487 cstate->off_linktype.constant_part = 12; 1488 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; /* L3 proto location dep. on cookie type */ 1489 cstate->off_nl = OFFSET_NOT_SET; /* L3 proto location dep. on cookie type */ 1490 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1491 break; 1492 1493 case DLT_JUNIPER_VP: 1494 cstate->off_linktype.constant_part = 18; 1495 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1496 cstate->off_nl = OFFSET_NOT_SET; 1497 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1498 break; 1499 1500 case DLT_JUNIPER_ST: 1501 cstate->off_linktype.constant_part = 18; 1502 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1503 cstate->off_nl = OFFSET_NOT_SET; 1504 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1505 break; 1506 1507 case DLT_JUNIPER_ISM: 1508 cstate->off_linktype.constant_part = 8; 1509 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1510 cstate->off_nl = OFFSET_NOT_SET; 1511 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1512 break; 1513 1514 case DLT_JUNIPER_VS: 1515 case DLT_JUNIPER_SRX_E2E: 1516 case DLT_JUNIPER_FIBRECHANNEL: 1517 case DLT_JUNIPER_ATM_CEMIC: 1518 cstate->off_linktype.constant_part = 8; 1519 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1520 cstate->off_nl = OFFSET_NOT_SET; 1521 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1522 break; 1523 1524 case DLT_MTP2: 1525 cstate->off_li = 2; 1526 cstate->off_li_hsl = 4; 1527 cstate->off_sio = 3; 1528 cstate->off_opc = 4; 1529 cstate->off_dpc = 4; 1530 cstate->off_sls = 7; 1531 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1532 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1533 cstate->off_nl = OFFSET_NOT_SET; 1534 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1535 break; 1536 1537 case DLT_MTP2_WITH_PHDR: 1538 cstate->off_li = 6; 1539 cstate->off_li_hsl = 8; 1540 cstate->off_sio = 7; 1541 cstate->off_opc = 8; 1542 cstate->off_dpc = 8; 1543 cstate->off_sls = 11; 1544 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1545 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1546 cstate->off_nl = OFFSET_NOT_SET; 1547 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1548 break; 1549 1550 case DLT_ERF: 1551 cstate->off_li = 22; 1552 cstate->off_li_hsl = 24; 1553 cstate->off_sio = 23; 1554 cstate->off_opc = 24; 1555 cstate->off_dpc = 24; 1556 cstate->off_sls = 27; 1557 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1558 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1559 cstate->off_nl = OFFSET_NOT_SET; 1560 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1561 break; 1562 1563 case DLT_PFSYNC: 1564 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1565 cstate->off_linkpl.constant_part = 4; 1566 cstate->off_nl = 0; 1567 cstate->off_nl_nosnap = 0; 1568 break; 1569 1570 case DLT_AX25_KISS: 1571 /* 1572 * Currently, only raw "link[N:M]" filtering is supported. 1573 */ 1574 cstate->off_linktype.constant_part = OFFSET_NOT_SET; /* variable, min 15, max 71 steps of 7 */ 1575 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1576 cstate->off_nl = OFFSET_NOT_SET; /* variable, min 16, max 71 steps of 7 */ 1577 cstate->off_nl_nosnap = OFFSET_NOT_SET; /* no 802.2 LLC */ 1578 break; 1579 1580 case DLT_IPNET: 1581 cstate->off_linktype.constant_part = 1; 1582 cstate->off_linkpl.constant_part = 24; /* ipnet header length */ 1583 cstate->off_nl = 0; 1584 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1585 break; 1586 1587 case DLT_NETANALYZER: 1588 cstate->off_linkhdr.constant_part = 4; /* Ethernet header is past 4-byte pseudo-header */ 1589 cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12; 1590 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* pseudo-header+Ethernet header length */ 1591 cstate->off_nl = 0; /* Ethernet II */ 1592 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 1593 break; 1594 1595 case DLT_NETANALYZER_TRANSPARENT: 1596 cstate->off_linkhdr.constant_part = 12; /* MAC header is past 4-byte pseudo-header, preamble, and SFD */ 1597 cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12; 1598 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* pseudo-header+preamble+SFD+Ethernet header length */ 1599 cstate->off_nl = 0; /* Ethernet II */ 1600 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 1601 break; 1602 1603 default: 1604 /* 1605 * For values in the range in which we've assigned new 1606 * DLT_ values, only raw "link[N:M]" filtering is supported. 1607 */ 1608 if (cstate->linktype >= DLT_MATCHING_MIN && 1609 cstate->linktype <= DLT_MATCHING_MAX) { 1610 cstate->off_linktype.constant_part = OFFSET_NOT_SET; 1611 cstate->off_linkpl.constant_part = OFFSET_NOT_SET; 1612 cstate->off_nl = OFFSET_NOT_SET; 1613 cstate->off_nl_nosnap = OFFSET_NOT_SET; 1614 } else { 1615 bpf_error(cstate, "unknown data link type %d", cstate->linktype); 1616 } 1617 break; 1618 } 1619 1620 cstate->off_outermostlinkhdr = cstate->off_prevlinkhdr = cstate->off_linkhdr; 1621 } 1622 1623 /* 1624 * Load a value relative to the specified absolute offset. 1625 */ 1626 static struct slist * 1627 gen_load_absoffsetrel(compiler_state_t *cstate, bpf_abs_offset *abs_offset, 1628 u_int offset, u_int size) 1629 { 1630 struct slist *s, *s2; 1631 1632 s = gen_abs_offset_varpart(cstate, abs_offset); 1633 1634 /* 1635 * If "s" is non-null, it has code to arrange that the X register 1636 * contains the variable part of the absolute offset, so we 1637 * generate a load relative to that, with an offset of 1638 * abs_offset->constant_part + offset. 1639 * 1640 * Otherwise, we can do an absolute load with an offset of 1641 * abs_offset->constant_part + offset. 1642 */ 1643 if (s != NULL) { 1644 /* 1645 * "s" points to a list of statements that puts the 1646 * variable part of the absolute offset into the X register. 1647 * Do an indirect load, to use the X register as an offset. 1648 */ 1649 s2 = new_stmt(cstate, BPF_LD|BPF_IND|size); 1650 s2->s.k = abs_offset->constant_part + offset; 1651 sappend(s, s2); 1652 } else { 1653 /* 1654 * There is no variable part of the absolute offset, so 1655 * just do an absolute load. 1656 */ 1657 s = new_stmt(cstate, BPF_LD|BPF_ABS|size); 1658 s->s.k = abs_offset->constant_part + offset; 1659 } 1660 return s; 1661 } 1662 1663 /* 1664 * Load a value relative to the beginning of the specified header. 1665 */ 1666 static struct slist * 1667 gen_load_a(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, 1668 u_int size) 1669 { 1670 struct slist *s, *s2; 1671 1672 switch (offrel) { 1673 1674 case OR_PACKET: 1675 s = new_stmt(cstate, BPF_LD|BPF_ABS|size); 1676 s->s.k = offset; 1677 break; 1678 1679 case OR_LINKHDR: 1680 s = gen_load_absoffsetrel(cstate, &cstate->off_linkhdr, offset, size); 1681 break; 1682 1683 case OR_PREVLINKHDR: 1684 s = gen_load_absoffsetrel(cstate, &cstate->off_prevlinkhdr, offset, size); 1685 break; 1686 1687 case OR_LLC: 1688 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, offset, size); 1689 break; 1690 1691 case OR_PREVMPLSHDR: 1692 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl - 4 + offset, size); 1693 break; 1694 1695 case OR_LINKPL: 1696 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + offset, size); 1697 break; 1698 1699 case OR_LINKPL_NOSNAP: 1700 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl_nosnap + offset, size); 1701 break; 1702 1703 case OR_LINKTYPE: 1704 s = gen_load_absoffsetrel(cstate, &cstate->off_linktype, offset, size); 1705 break; 1706 1707 case OR_TRAN_IPV4: 1708 /* 1709 * Load the X register with the length of the IPv4 header 1710 * (plus the offset of the link-layer header, if it's 1711 * preceded by a variable-length header such as a radio 1712 * header), in bytes. 1713 */ 1714 s = gen_loadx_iphdrlen(cstate); 1715 1716 /* 1717 * Load the item at {offset of the link-layer payload} + 1718 * {offset, relative to the start of the link-layer 1719 * paylod, of the IPv4 header} + {length of the IPv4 header} + 1720 * {specified offset}. 1721 * 1722 * If the offset of the link-layer payload is variable, 1723 * the variable part of that offset is included in the 1724 * value in the X register, and we include the constant 1725 * part in the offset of the load. 1726 */ 1727 s2 = new_stmt(cstate, BPF_LD|BPF_IND|size); 1728 s2->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + offset; 1729 sappend(s, s2); 1730 break; 1731 1732 case OR_TRAN_IPV6: 1733 s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + 40 + offset, size); 1734 break; 1735 1736 default: 1737 abort(); 1738 /* NOTREACHED */ 1739 } 1740 return s; 1741 } 1742 1743 /* 1744 * Generate code to load into the X register the sum of the length of 1745 * the IPv4 header and the variable part of the offset of the link-layer 1746 * payload. 1747 */ 1748 static struct slist * 1749 gen_loadx_iphdrlen(compiler_state_t *cstate) 1750 { 1751 struct slist *s, *s2; 1752 1753 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 1754 if (s != NULL) { 1755 /* 1756 * The offset of the link-layer payload has a variable 1757 * part. "s" points to a list of statements that put 1758 * the variable part of that offset into the X register. 1759 * 1760 * The 4*([k]&0xf) addressing mode can't be used, as we 1761 * don't have a constant offset, so we have to load the 1762 * value in question into the A register and add to it 1763 * the value from the X register. 1764 */ 1765 s2 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 1766 s2->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 1767 sappend(s, s2); 1768 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 1769 s2->s.k = 0xf; 1770 sappend(s, s2); 1771 s2 = new_stmt(cstate, BPF_ALU|BPF_LSH|BPF_K); 1772 s2->s.k = 2; 1773 sappend(s, s2); 1774 1775 /* 1776 * The A register now contains the length of the IP header. 1777 * We need to add to it the variable part of the offset of 1778 * the link-layer payload, which is still in the X 1779 * register, and move the result into the X register. 1780 */ 1781 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 1782 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 1783 } else { 1784 /* 1785 * The offset of the link-layer payload is a constant, 1786 * so no code was generated to load the (non-existent) 1787 * variable part of that offset. 1788 * 1789 * This means we can use the 4*([k]&0xf) addressing 1790 * mode. Load the length of the IPv4 header, which 1791 * is at an offset of cstate->off_nl from the beginning of 1792 * the link-layer payload, and thus at an offset of 1793 * cstate->off_linkpl.constant_part + cstate->off_nl from the beginning 1794 * of the raw packet data, using that addressing mode. 1795 */ 1796 s = new_stmt(cstate, BPF_LDX|BPF_MSH|BPF_B); 1797 s->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 1798 } 1799 return s; 1800 } 1801 1802 1803 static struct block * 1804 gen_uncond(compiler_state_t *cstate, int rsense) 1805 { 1806 struct block *b; 1807 struct slist *s; 1808 1809 s = new_stmt(cstate, BPF_LD|BPF_IMM); 1810 s->s.k = !rsense; 1811 b = new_block(cstate, JMP(BPF_JEQ)); 1812 b->stmts = s; 1813 1814 return b; 1815 } 1816 1817 static inline struct block * 1818 gen_true(compiler_state_t *cstate) 1819 { 1820 return gen_uncond(cstate, 1); 1821 } 1822 1823 static inline struct block * 1824 gen_false(compiler_state_t *cstate) 1825 { 1826 return gen_uncond(cstate, 0); 1827 } 1828 1829 /* 1830 * Byte-swap a 32-bit number. 1831 * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on 1832 * big-endian platforms.) 1833 */ 1834 #define SWAPLONG(y) \ 1835 ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) 1836 1837 /* 1838 * Generate code to match a particular packet type. 1839 * 1840 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 1841 * value, if <= ETHERMTU. We use that to determine whether to 1842 * match the type/length field or to check the type/length field for 1843 * a value <= ETHERMTU to see whether it's a type field and then do 1844 * the appropriate test. 1845 */ 1846 static struct block * 1847 gen_ether_linktype(compiler_state_t *cstate, int proto) 1848 { 1849 struct block *b0, *b1; 1850 1851 switch (proto) { 1852 1853 case LLCSAP_ISONS: 1854 case LLCSAP_IP: 1855 case LLCSAP_NETBEUI: 1856 /* 1857 * OSI protocols and NetBEUI always use 802.2 encapsulation, 1858 * so we check the DSAP and SSAP. 1859 * 1860 * LLCSAP_IP checks for IP-over-802.2, rather 1861 * than IP-over-Ethernet or IP-over-SNAP. 1862 * 1863 * XXX - should we check both the DSAP and the 1864 * SSAP, like this, or should we check just the 1865 * DSAP, as we do for other types <= ETHERMTU 1866 * (i.e., other SAP values)? 1867 */ 1868 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 1869 gen_not(b0); 1870 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32) 1871 ((proto << 8) | proto)); 1872 gen_and(b0, b1); 1873 return b1; 1874 1875 case LLCSAP_IPX: 1876 /* 1877 * Check for; 1878 * 1879 * Ethernet_II frames, which are Ethernet 1880 * frames with a frame type of ETHERTYPE_IPX; 1881 * 1882 * Ethernet_802.3 frames, which are 802.3 1883 * frames (i.e., the type/length field is 1884 * a length field, <= ETHERMTU, rather than 1885 * a type field) with the first two bytes 1886 * after the Ethernet/802.3 header being 1887 * 0xFFFF; 1888 * 1889 * Ethernet_802.2 frames, which are 802.3 1890 * frames with an 802.2 LLC header and 1891 * with the IPX LSAP as the DSAP in the LLC 1892 * header; 1893 * 1894 * Ethernet_SNAP frames, which are 802.3 1895 * frames with an LLC header and a SNAP 1896 * header and with an OUI of 0x000000 1897 * (encapsulated Ethernet) and a protocol 1898 * ID of ETHERTYPE_IPX in the SNAP header. 1899 * 1900 * XXX - should we generate the same code both 1901 * for tests for LLCSAP_IPX and for ETHERTYPE_IPX? 1902 */ 1903 1904 /* 1905 * This generates code to check both for the 1906 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3. 1907 */ 1908 b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX); 1909 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)0xFFFF); 1910 gen_or(b0, b1); 1911 1912 /* 1913 * Now we add code to check for SNAP frames with 1914 * ETHERTYPE_IPX, i.e. Ethernet_SNAP. 1915 */ 1916 b0 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX); 1917 gen_or(b0, b1); 1918 1919 /* 1920 * Now we generate code to check for 802.3 1921 * frames in general. 1922 */ 1923 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 1924 gen_not(b0); 1925 1926 /* 1927 * Now add the check for 802.3 frames before the 1928 * check for Ethernet_802.2 and Ethernet_802.3, 1929 * as those checks should only be done on 802.3 1930 * frames, not on Ethernet frames. 1931 */ 1932 gen_and(b0, b1); 1933 1934 /* 1935 * Now add the check for Ethernet_II frames, and 1936 * do that before checking for the other frame 1937 * types. 1938 */ 1939 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX); 1940 gen_or(b0, b1); 1941 return b1; 1942 1943 case ETHERTYPE_ATALK: 1944 case ETHERTYPE_AARP: 1945 /* 1946 * EtherTalk (AppleTalk protocols on Ethernet link 1947 * layer) may use 802.2 encapsulation. 1948 */ 1949 1950 /* 1951 * Check for 802.2 encapsulation (EtherTalk phase 2?); 1952 * we check for an Ethernet type field less than 1953 * 1500, which means it's an 802.3 length field. 1954 */ 1955 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 1956 gen_not(b0); 1957 1958 /* 1959 * 802.2-encapsulated ETHERTYPE_ATALK packets are 1960 * SNAP packets with an organization code of 1961 * 0x080007 (Apple, for Appletalk) and a protocol 1962 * type of ETHERTYPE_ATALK (Appletalk). 1963 * 1964 * 802.2-encapsulated ETHERTYPE_AARP packets are 1965 * SNAP packets with an organization code of 1966 * 0x000000 (encapsulated Ethernet) and a protocol 1967 * type of ETHERTYPE_AARP (Appletalk ARP). 1968 */ 1969 if (proto == ETHERTYPE_ATALK) 1970 b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); 1971 else /* proto == ETHERTYPE_AARP */ 1972 b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP); 1973 gen_and(b0, b1); 1974 1975 /* 1976 * Check for Ethernet encapsulation (Ethertalk 1977 * phase 1?); we just check for the Ethernet 1978 * protocol type. 1979 */ 1980 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); 1981 1982 gen_or(b0, b1); 1983 return b1; 1984 1985 default: 1986 if (proto <= ETHERMTU) { 1987 /* 1988 * This is an LLC SAP value, so the frames 1989 * that match would be 802.2 frames. 1990 * Check that the frame is an 802.2 frame 1991 * (i.e., that the length/type field is 1992 * a length field, <= ETHERMTU) and 1993 * then check the DSAP. 1994 */ 1995 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 1996 gen_not(b0); 1997 b1 = gen_cmp(cstate, OR_LINKTYPE, 2, BPF_B, (bpf_int32)proto); 1998 gen_and(b0, b1); 1999 return b1; 2000 } else { 2001 /* 2002 * This is an Ethernet type, so compare 2003 * the length/type field with it (if 2004 * the frame is an 802.2 frame, the length 2005 * field will be <= ETHERMTU, and, as 2006 * "proto" is > ETHERMTU, this test 2007 * will fail and the frame won't match, 2008 * which is what we want). 2009 */ 2010 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, 2011 (bpf_int32)proto); 2012 } 2013 } 2014 } 2015 2016 static struct block * 2017 gen_loopback_linktype(compiler_state_t *cstate, int proto) 2018 { 2019 /* 2020 * For DLT_NULL, the link-layer header is a 32-bit word 2021 * containing an AF_ value in *host* byte order, and for 2022 * DLT_ENC, the link-layer header begins with a 32-bit 2023 * word containing an AF_ value in host byte order. 2024 * 2025 * In addition, if we're reading a saved capture file, 2026 * the host byte order in the capture may not be the 2027 * same as the host byte order on this machine. 2028 * 2029 * For DLT_LOOP, the link-layer header is a 32-bit 2030 * word containing an AF_ value in *network* byte order. 2031 */ 2032 if (cstate->linktype == DLT_NULL || cstate->linktype == DLT_ENC) { 2033 /* 2034 * The AF_ value is in host byte order, but the BPF 2035 * interpreter will convert it to network byte order. 2036 * 2037 * If this is a save file, and it's from a machine 2038 * with the opposite byte order to ours, we byte-swap 2039 * the AF_ value. 2040 * 2041 * Then we run it through "htonl()", and generate 2042 * code to compare against the result. 2043 */ 2044 if (cstate->bpf_pcap->rfile != NULL && cstate->bpf_pcap->swapped) 2045 proto = SWAPLONG(proto); 2046 proto = htonl(proto); 2047 } 2048 return (gen_cmp(cstate, OR_LINKHDR, 0, BPF_W, (bpf_int32)proto)); 2049 } 2050 2051 /* 2052 * "proto" is an Ethernet type value and for IPNET, if it is not IPv4 2053 * or IPv6 then we have an error. 2054 */ 2055 static struct block * 2056 gen_ipnet_linktype(compiler_state_t *cstate, int proto) 2057 { 2058 switch (proto) { 2059 2060 case ETHERTYPE_IP: 2061 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, (bpf_int32)IPH_AF_INET); 2062 /* NOTREACHED */ 2063 2064 case ETHERTYPE_IPV6: 2065 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 2066 (bpf_int32)IPH_AF_INET6); 2067 /* NOTREACHED */ 2068 2069 default: 2070 break; 2071 } 2072 2073 return gen_false(cstate); 2074 } 2075 2076 /* 2077 * Generate code to match a particular packet type. 2078 * 2079 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 2080 * value, if <= ETHERMTU. We use that to determine whether to 2081 * match the type field or to check the type field for the special 2082 * LINUX_SLL_P_802_2 value and then do the appropriate test. 2083 */ 2084 static struct block * 2085 gen_linux_sll_linktype(compiler_state_t *cstate, int proto) 2086 { 2087 struct block *b0, *b1; 2088 2089 switch (proto) { 2090 2091 case LLCSAP_ISONS: 2092 case LLCSAP_IP: 2093 case LLCSAP_NETBEUI: 2094 /* 2095 * OSI protocols and NetBEUI always use 802.2 encapsulation, 2096 * so we check the DSAP and SSAP. 2097 * 2098 * LLCSAP_IP checks for IP-over-802.2, rather 2099 * than IP-over-Ethernet or IP-over-SNAP. 2100 * 2101 * XXX - should we check both the DSAP and the 2102 * SSAP, like this, or should we check just the 2103 * DSAP, as we do for other types <= ETHERMTU 2104 * (i.e., other SAP values)? 2105 */ 2106 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2107 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32) 2108 ((proto << 8) | proto)); 2109 gen_and(b0, b1); 2110 return b1; 2111 2112 case LLCSAP_IPX: 2113 /* 2114 * Ethernet_II frames, which are Ethernet 2115 * frames with a frame type of ETHERTYPE_IPX; 2116 * 2117 * Ethernet_802.3 frames, which have a frame 2118 * type of LINUX_SLL_P_802_3; 2119 * 2120 * Ethernet_802.2 frames, which are 802.3 2121 * frames with an 802.2 LLC header (i.e, have 2122 * a frame type of LINUX_SLL_P_802_2) and 2123 * with the IPX LSAP as the DSAP in the LLC 2124 * header; 2125 * 2126 * Ethernet_SNAP frames, which are 802.3 2127 * frames with an LLC header and a SNAP 2128 * header and with an OUI of 0x000000 2129 * (encapsulated Ethernet) and a protocol 2130 * ID of ETHERTYPE_IPX in the SNAP header. 2131 * 2132 * First, do the checks on LINUX_SLL_P_802_2 2133 * frames; generate the check for either 2134 * Ethernet_802.2 or Ethernet_SNAP frames, and 2135 * then put a check for LINUX_SLL_P_802_2 frames 2136 * before it. 2137 */ 2138 b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX); 2139 b1 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX); 2140 gen_or(b0, b1); 2141 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2142 gen_and(b0, b1); 2143 2144 /* 2145 * Now check for 802.3 frames and OR that with 2146 * the previous test. 2147 */ 2148 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_3); 2149 gen_or(b0, b1); 2150 2151 /* 2152 * Now add the check for Ethernet_II frames, and 2153 * do that before checking for the other frame 2154 * types. 2155 */ 2156 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX); 2157 gen_or(b0, b1); 2158 return b1; 2159 2160 case ETHERTYPE_ATALK: 2161 case ETHERTYPE_AARP: 2162 /* 2163 * EtherTalk (AppleTalk protocols on Ethernet link 2164 * layer) may use 802.2 encapsulation. 2165 */ 2166 2167 /* 2168 * Check for 802.2 encapsulation (EtherTalk phase 2?); 2169 * we check for the 802.2 protocol type in the 2170 * "Ethernet type" field. 2171 */ 2172 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2173 2174 /* 2175 * 802.2-encapsulated ETHERTYPE_ATALK packets are 2176 * SNAP packets with an organization code of 2177 * 0x080007 (Apple, for Appletalk) and a protocol 2178 * type of ETHERTYPE_ATALK (Appletalk). 2179 * 2180 * 802.2-encapsulated ETHERTYPE_AARP packets are 2181 * SNAP packets with an organization code of 2182 * 0x000000 (encapsulated Ethernet) and a protocol 2183 * type of ETHERTYPE_AARP (Appletalk ARP). 2184 */ 2185 if (proto == ETHERTYPE_ATALK) 2186 b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); 2187 else /* proto == ETHERTYPE_AARP */ 2188 b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP); 2189 gen_and(b0, b1); 2190 2191 /* 2192 * Check for Ethernet encapsulation (Ethertalk 2193 * phase 1?); we just check for the Ethernet 2194 * protocol type. 2195 */ 2196 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); 2197 2198 gen_or(b0, b1); 2199 return b1; 2200 2201 default: 2202 if (proto <= ETHERMTU) { 2203 /* 2204 * This is an LLC SAP value, so the frames 2205 * that match would be 802.2 frames. 2206 * Check for the 802.2 protocol type 2207 * in the "Ethernet type" field, and 2208 * then check the DSAP. 2209 */ 2210 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2); 2211 b1 = gen_cmp(cstate, OR_LINKHDR, cstate->off_linkpl.constant_part, BPF_B, 2212 (bpf_int32)proto); 2213 gen_and(b0, b1); 2214 return b1; 2215 } else { 2216 /* 2217 * This is an Ethernet type, so compare 2218 * the length/type field with it (if 2219 * the frame is an 802.2 frame, the length 2220 * field will be <= ETHERMTU, and, as 2221 * "proto" is > ETHERMTU, this test 2222 * will fail and the frame won't match, 2223 * which is what we want). 2224 */ 2225 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); 2226 } 2227 } 2228 } 2229 2230 static struct slist * 2231 gen_load_prism_llprefixlen(compiler_state_t *cstate) 2232 { 2233 struct slist *s1, *s2; 2234 struct slist *sjeq_avs_cookie; 2235 struct slist *sjcommon; 2236 2237 /* 2238 * This code is not compatible with the optimizer, as 2239 * we are generating jmp instructions within a normal 2240 * slist of instructions 2241 */ 2242 cstate->no_optimize = 1; 2243 2244 /* 2245 * Generate code to load the length of the radio header into 2246 * the register assigned to hold that length, if one has been 2247 * assigned. (If one hasn't been assigned, no code we've 2248 * generated uses that prefix, so we don't need to generate any 2249 * code to load it.) 2250 * 2251 * Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes 2252 * or always use the AVS header rather than the Prism header. 2253 * We load a 4-byte big-endian value at the beginning of the 2254 * raw packet data, and see whether, when masked with 0xFFFFF000, 2255 * it's equal to 0x80211000. If so, that indicates that it's 2256 * an AVS header (the masked-out bits are the version number). 2257 * Otherwise, it's a Prism header. 2258 * 2259 * XXX - the Prism header is also, in theory, variable-length, 2260 * but no known software generates headers that aren't 144 2261 * bytes long. 2262 */ 2263 if (cstate->off_linkhdr.reg != -1) { 2264 /* 2265 * Load the cookie. 2266 */ 2267 s1 = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2268 s1->s.k = 0; 2269 2270 /* 2271 * AND it with 0xFFFFF000. 2272 */ 2273 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 2274 s2->s.k = 0xFFFFF000; 2275 sappend(s1, s2); 2276 2277 /* 2278 * Compare with 0x80211000. 2279 */ 2280 sjeq_avs_cookie = new_stmt(cstate, JMP(BPF_JEQ)); 2281 sjeq_avs_cookie->s.k = 0x80211000; 2282 sappend(s1, sjeq_avs_cookie); 2283 2284 /* 2285 * If it's AVS: 2286 * 2287 * The 4 bytes at an offset of 4 from the beginning of 2288 * the AVS header are the length of the AVS header. 2289 * That field is big-endian. 2290 */ 2291 s2 = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2292 s2->s.k = 4; 2293 sappend(s1, s2); 2294 sjeq_avs_cookie->s.jt = s2; 2295 2296 /* 2297 * Now jump to the code to allocate a register 2298 * into which to save the header length and 2299 * store the length there. (The "jump always" 2300 * instruction needs to have the k field set; 2301 * it's added to the PC, so, as we're jumping 2302 * over a single instruction, it should be 1.) 2303 */ 2304 sjcommon = new_stmt(cstate, JMP(BPF_JA)); 2305 sjcommon->s.k = 1; 2306 sappend(s1, sjcommon); 2307 2308 /* 2309 * Now for the code that handles the Prism header. 2310 * Just load the length of the Prism header (144) 2311 * into the A register. Have the test for an AVS 2312 * header branch here if we don't have an AVS header. 2313 */ 2314 s2 = new_stmt(cstate, BPF_LD|BPF_W|BPF_IMM); 2315 s2->s.k = 144; 2316 sappend(s1, s2); 2317 sjeq_avs_cookie->s.jf = s2; 2318 2319 /* 2320 * Now allocate a register to hold that value and store 2321 * it. The code for the AVS header will jump here after 2322 * loading the length of the AVS header. 2323 */ 2324 s2 = new_stmt(cstate, BPF_ST); 2325 s2->s.k = cstate->off_linkhdr.reg; 2326 sappend(s1, s2); 2327 sjcommon->s.jf = s2; 2328 2329 /* 2330 * Now move it into the X register. 2331 */ 2332 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2333 sappend(s1, s2); 2334 2335 return (s1); 2336 } else 2337 return (NULL); 2338 } 2339 2340 static struct slist * 2341 gen_load_avs_llprefixlen(compiler_state_t *cstate) 2342 { 2343 struct slist *s1, *s2; 2344 2345 /* 2346 * Generate code to load the length of the AVS header into 2347 * the register assigned to hold that length, if one has been 2348 * assigned. (If one hasn't been assigned, no code we've 2349 * generated uses that prefix, so we don't need to generate any 2350 * code to load it.) 2351 */ 2352 if (cstate->off_linkhdr.reg != -1) { 2353 /* 2354 * The 4 bytes at an offset of 4 from the beginning of 2355 * the AVS header are the length of the AVS header. 2356 * That field is big-endian. 2357 */ 2358 s1 = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2359 s1->s.k = 4; 2360 2361 /* 2362 * Now allocate a register to hold that value and store 2363 * it. 2364 */ 2365 s2 = new_stmt(cstate, BPF_ST); 2366 s2->s.k = cstate->off_linkhdr.reg; 2367 sappend(s1, s2); 2368 2369 /* 2370 * Now move it into the X register. 2371 */ 2372 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2373 sappend(s1, s2); 2374 2375 return (s1); 2376 } else 2377 return (NULL); 2378 } 2379 2380 static struct slist * 2381 gen_load_radiotap_llprefixlen(compiler_state_t *cstate) 2382 { 2383 struct slist *s1, *s2; 2384 2385 /* 2386 * Generate code to load the length of the radiotap header into 2387 * the register assigned to hold that length, if one has been 2388 * assigned. (If one hasn't been assigned, no code we've 2389 * generated uses that prefix, so we don't need to generate any 2390 * code to load it.) 2391 */ 2392 if (cstate->off_linkhdr.reg != -1) { 2393 /* 2394 * The 2 bytes at offsets of 2 and 3 from the beginning 2395 * of the radiotap header are the length of the radiotap 2396 * header; unfortunately, it's little-endian, so we have 2397 * to load it a byte at a time and construct the value. 2398 */ 2399 2400 /* 2401 * Load the high-order byte, at an offset of 3, shift it 2402 * left a byte, and put the result in the X register. 2403 */ 2404 s1 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2405 s1->s.k = 3; 2406 s2 = new_stmt(cstate, BPF_ALU|BPF_LSH|BPF_K); 2407 sappend(s1, s2); 2408 s2->s.k = 8; 2409 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2410 sappend(s1, s2); 2411 2412 /* 2413 * Load the next byte, at an offset of 2, and OR the 2414 * value from the X register into it. 2415 */ 2416 s2 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2417 sappend(s1, s2); 2418 s2->s.k = 2; 2419 s2 = new_stmt(cstate, BPF_ALU|BPF_OR|BPF_X); 2420 sappend(s1, s2); 2421 2422 /* 2423 * Now allocate a register to hold that value and store 2424 * it. 2425 */ 2426 s2 = new_stmt(cstate, BPF_ST); 2427 s2->s.k = cstate->off_linkhdr.reg; 2428 sappend(s1, s2); 2429 2430 /* 2431 * Now move it into the X register. 2432 */ 2433 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2434 sappend(s1, s2); 2435 2436 return (s1); 2437 } else 2438 return (NULL); 2439 } 2440 2441 /* 2442 * At the moment we treat PPI as normal Radiotap encoded 2443 * packets. The difference is in the function that generates 2444 * the code at the beginning to compute the header length. 2445 * Since this code generator of PPI supports bare 802.11 2446 * encapsulation only (i.e. the encapsulated DLT should be 2447 * DLT_IEEE802_11) we generate code to check for this too; 2448 * that's done in finish_parse(). 2449 */ 2450 static struct slist * 2451 gen_load_ppi_llprefixlen(compiler_state_t *cstate) 2452 { 2453 struct slist *s1, *s2; 2454 2455 /* 2456 * Generate code to load the length of the radiotap header 2457 * into the register assigned to hold that length, if one has 2458 * been assigned. 2459 */ 2460 if (cstate->off_linkhdr.reg != -1) { 2461 /* 2462 * The 2 bytes at offsets of 2 and 3 from the beginning 2463 * of the radiotap header are the length of the radiotap 2464 * header; unfortunately, it's little-endian, so we have 2465 * to load it a byte at a time and construct the value. 2466 */ 2467 2468 /* 2469 * Load the high-order byte, at an offset of 3, shift it 2470 * left a byte, and put the result in the X register. 2471 */ 2472 s1 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2473 s1->s.k = 3; 2474 s2 = new_stmt(cstate, BPF_ALU|BPF_LSH|BPF_K); 2475 sappend(s1, s2); 2476 s2->s.k = 8; 2477 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2478 sappend(s1, s2); 2479 2480 /* 2481 * Load the next byte, at an offset of 2, and OR the 2482 * value from the X register into it. 2483 */ 2484 s2 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 2485 sappend(s1, s2); 2486 s2->s.k = 2; 2487 s2 = new_stmt(cstate, BPF_ALU|BPF_OR|BPF_X); 2488 sappend(s1, s2); 2489 2490 /* 2491 * Now allocate a register to hold that value and store 2492 * it. 2493 */ 2494 s2 = new_stmt(cstate, BPF_ST); 2495 s2->s.k = cstate->off_linkhdr.reg; 2496 sappend(s1, s2); 2497 2498 /* 2499 * Now move it into the X register. 2500 */ 2501 s2 = new_stmt(cstate, BPF_MISC|BPF_TAX); 2502 sappend(s1, s2); 2503 2504 return (s1); 2505 } else 2506 return (NULL); 2507 } 2508 2509 /* 2510 * Load a value relative to the beginning of the link-layer header after the 802.11 2511 * header, i.e. LLC_SNAP. 2512 * The link-layer header doesn't necessarily begin at the beginning 2513 * of the packet data; there might be a variable-length prefix containing 2514 * radio information. 2515 */ 2516 static struct slist * 2517 gen_load_802_11_header_len(compiler_state_t *cstate, struct slist *s, struct slist *snext) 2518 { 2519 struct slist *s2; 2520 struct slist *sjset_data_frame_1; 2521 struct slist *sjset_data_frame_2; 2522 struct slist *sjset_qos; 2523 struct slist *sjset_radiotap_flags_present; 2524 struct slist *sjset_radiotap_ext_present; 2525 struct slist *sjset_radiotap_tsft_present; 2526 struct slist *sjset_tsft_datapad, *sjset_notsft_datapad; 2527 struct slist *s_roundup; 2528 2529 if (cstate->off_linkpl.reg == -1) { 2530 /* 2531 * No register has been assigned to the offset of 2532 * the link-layer payload, which means nobody needs 2533 * it; don't bother computing it - just return 2534 * what we already have. 2535 */ 2536 return (s); 2537 } 2538 2539 /* 2540 * This code is not compatible with the optimizer, as 2541 * we are generating jmp instructions within a normal 2542 * slist of instructions 2543 */ 2544 cstate->no_optimize = 1; 2545 2546 /* 2547 * If "s" is non-null, it has code to arrange that the X register 2548 * contains the length of the prefix preceding the link-layer 2549 * header. 2550 * 2551 * Otherwise, the length of the prefix preceding the link-layer 2552 * header is "off_outermostlinkhdr.constant_part". 2553 */ 2554 if (s == NULL) { 2555 /* 2556 * There is no variable-length header preceding the 2557 * link-layer header. 2558 * 2559 * Load the length of the fixed-length prefix preceding 2560 * the link-layer header (if any) into the X register, 2561 * and store it in the cstate->off_linkpl.reg register. 2562 * That length is off_outermostlinkhdr.constant_part. 2563 */ 2564 s = new_stmt(cstate, BPF_LDX|BPF_IMM); 2565 s->s.k = cstate->off_outermostlinkhdr.constant_part; 2566 } 2567 2568 /* 2569 * The X register contains the offset of the beginning of the 2570 * link-layer header; add 24, which is the minimum length 2571 * of the MAC header for a data frame, to that, and store it 2572 * in cstate->off_linkpl.reg, and then load the Frame Control field, 2573 * which is at the offset in the X register, with an indexed load. 2574 */ 2575 s2 = new_stmt(cstate, BPF_MISC|BPF_TXA); 2576 sappend(s, s2); 2577 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 2578 s2->s.k = 24; 2579 sappend(s, s2); 2580 s2 = new_stmt(cstate, BPF_ST); 2581 s2->s.k = cstate->off_linkpl.reg; 2582 sappend(s, s2); 2583 2584 s2 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 2585 s2->s.k = 0; 2586 sappend(s, s2); 2587 2588 /* 2589 * Check the Frame Control field to see if this is a data frame; 2590 * a data frame has the 0x08 bit (b3) in that field set and the 2591 * 0x04 bit (b2) clear. 2592 */ 2593 sjset_data_frame_1 = new_stmt(cstate, JMP(BPF_JSET)); 2594 sjset_data_frame_1->s.k = 0x08; 2595 sappend(s, sjset_data_frame_1); 2596 2597 /* 2598 * If b3 is set, test b2, otherwise go to the first statement of 2599 * the rest of the program. 2600 */ 2601 sjset_data_frame_1->s.jt = sjset_data_frame_2 = new_stmt(cstate, JMP(BPF_JSET)); 2602 sjset_data_frame_2->s.k = 0x04; 2603 sappend(s, sjset_data_frame_2); 2604 sjset_data_frame_1->s.jf = snext; 2605 2606 /* 2607 * If b2 is not set, this is a data frame; test the QoS bit. 2608 * Otherwise, go to the first statement of the rest of the 2609 * program. 2610 */ 2611 sjset_data_frame_2->s.jt = snext; 2612 sjset_data_frame_2->s.jf = sjset_qos = new_stmt(cstate, JMP(BPF_JSET)); 2613 sjset_qos->s.k = 0x80; /* QoS bit */ 2614 sappend(s, sjset_qos); 2615 2616 /* 2617 * If it's set, add 2 to cstate->off_linkpl.reg, to skip the QoS 2618 * field. 2619 * Otherwise, go to the first statement of the rest of the 2620 * program. 2621 */ 2622 sjset_qos->s.jt = s2 = new_stmt(cstate, BPF_LD|BPF_MEM); 2623 s2->s.k = cstate->off_linkpl.reg; 2624 sappend(s, s2); 2625 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_IMM); 2626 s2->s.k = 2; 2627 sappend(s, s2); 2628 s2 = new_stmt(cstate, BPF_ST); 2629 s2->s.k = cstate->off_linkpl.reg; 2630 sappend(s, s2); 2631 2632 /* 2633 * If we have a radiotap header, look at it to see whether 2634 * there's Atheros padding between the MAC-layer header 2635 * and the payload. 2636 * 2637 * Note: all of the fields in the radiotap header are 2638 * little-endian, so we byte-swap all of the values 2639 * we test against, as they will be loaded as big-endian 2640 * values. 2641 * 2642 * XXX - in the general case, we would have to scan through 2643 * *all* the presence bits, if there's more than one word of 2644 * presence bits. That would require a loop, meaning that 2645 * we wouldn't be able to run the filter in the kernel. 2646 * 2647 * We assume here that the Atheros adapters that insert the 2648 * annoying padding don't have multiple antennae and therefore 2649 * do not generate radiotap headers with multiple presence words. 2650 */ 2651 if (cstate->linktype == DLT_IEEE802_11_RADIO) { 2652 /* 2653 * Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set 2654 * in the first presence flag word? 2655 */ 2656 sjset_qos->s.jf = s2 = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_W); 2657 s2->s.k = 4; 2658 sappend(s, s2); 2659 2660 sjset_radiotap_flags_present = new_stmt(cstate, JMP(BPF_JSET)); 2661 sjset_radiotap_flags_present->s.k = SWAPLONG(0x00000002); 2662 sappend(s, sjset_radiotap_flags_present); 2663 2664 /* 2665 * If not, skip all of this. 2666 */ 2667 sjset_radiotap_flags_present->s.jf = snext; 2668 2669 /* 2670 * Otherwise, is the "extension" bit set in that word? 2671 */ 2672 sjset_radiotap_ext_present = new_stmt(cstate, JMP(BPF_JSET)); 2673 sjset_radiotap_ext_present->s.k = SWAPLONG(0x80000000); 2674 sappend(s, sjset_radiotap_ext_present); 2675 sjset_radiotap_flags_present->s.jt = sjset_radiotap_ext_present; 2676 2677 /* 2678 * If so, skip all of this. 2679 */ 2680 sjset_radiotap_ext_present->s.jt = snext; 2681 2682 /* 2683 * Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set? 2684 */ 2685 sjset_radiotap_tsft_present = new_stmt(cstate, JMP(BPF_JSET)); 2686 sjset_radiotap_tsft_present->s.k = SWAPLONG(0x00000001); 2687 sappend(s, sjset_radiotap_tsft_present); 2688 sjset_radiotap_ext_present->s.jf = sjset_radiotap_tsft_present; 2689 2690 /* 2691 * If IEEE80211_RADIOTAP_TSFT is set, the flags field is 2692 * at an offset of 16 from the beginning of the raw packet 2693 * data (8 bytes for the radiotap header and 8 bytes for 2694 * the TSFT field). 2695 * 2696 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20) 2697 * is set. 2698 */ 2699 s2 = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 2700 s2->s.k = 16; 2701 sappend(s, s2); 2702 sjset_radiotap_tsft_present->s.jt = s2; 2703 2704 sjset_tsft_datapad = new_stmt(cstate, JMP(BPF_JSET)); 2705 sjset_tsft_datapad->s.k = 0x20; 2706 sappend(s, sjset_tsft_datapad); 2707 2708 /* 2709 * If IEEE80211_RADIOTAP_TSFT is not set, the flags field is 2710 * at an offset of 8 from the beginning of the raw packet 2711 * data (8 bytes for the radiotap header). 2712 * 2713 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20) 2714 * is set. 2715 */ 2716 s2 = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 2717 s2->s.k = 8; 2718 sappend(s, s2); 2719 sjset_radiotap_tsft_present->s.jf = s2; 2720 2721 sjset_notsft_datapad = new_stmt(cstate, JMP(BPF_JSET)); 2722 sjset_notsft_datapad->s.k = 0x20; 2723 sappend(s, sjset_notsft_datapad); 2724 2725 /* 2726 * In either case, if IEEE80211_RADIOTAP_F_DATAPAD is 2727 * set, round the length of the 802.11 header to 2728 * a multiple of 4. Do that by adding 3 and then 2729 * dividing by and multiplying by 4, which we do by 2730 * ANDing with ~3. 2731 */ 2732 s_roundup = new_stmt(cstate, BPF_LD|BPF_MEM); 2733 s_roundup->s.k = cstate->off_linkpl.reg; 2734 sappend(s, s_roundup); 2735 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_IMM); 2736 s2->s.k = 3; 2737 sappend(s, s2); 2738 s2 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_IMM); 2739 s2->s.k = ~3; 2740 sappend(s, s2); 2741 s2 = new_stmt(cstate, BPF_ST); 2742 s2->s.k = cstate->off_linkpl.reg; 2743 sappend(s, s2); 2744 2745 sjset_tsft_datapad->s.jt = s_roundup; 2746 sjset_tsft_datapad->s.jf = snext; 2747 sjset_notsft_datapad->s.jt = s_roundup; 2748 sjset_notsft_datapad->s.jf = snext; 2749 } else 2750 sjset_qos->s.jf = snext; 2751 2752 return s; 2753 } 2754 2755 static void 2756 insert_compute_vloffsets(compiler_state_t *cstate, struct block *b) 2757 { 2758 struct slist *s; 2759 2760 /* There is an implicit dependency between the link 2761 * payload and link header since the payload computation 2762 * includes the variable part of the header. Therefore, 2763 * if nobody else has allocated a register for the link 2764 * header and we need it, do it now. */ 2765 if (cstate->off_linkpl.reg != -1 && cstate->off_linkhdr.is_variable && 2766 cstate->off_linkhdr.reg == -1) 2767 cstate->off_linkhdr.reg = alloc_reg(cstate); 2768 2769 /* 2770 * For link-layer types that have a variable-length header 2771 * preceding the link-layer header, generate code to load 2772 * the offset of the link-layer header into the register 2773 * assigned to that offset, if any. 2774 * 2775 * XXX - this, and the next switch statement, won't handle 2776 * encapsulation of 802.11 or 802.11+radio information in 2777 * some other protocol stack. That's significantly more 2778 * complicated. 2779 */ 2780 switch (cstate->outermostlinktype) { 2781 2782 case DLT_PRISM_HEADER: 2783 s = gen_load_prism_llprefixlen(cstate); 2784 break; 2785 2786 case DLT_IEEE802_11_RADIO_AVS: 2787 s = gen_load_avs_llprefixlen(cstate); 2788 break; 2789 2790 case DLT_IEEE802_11_RADIO: 2791 s = gen_load_radiotap_llprefixlen(cstate); 2792 break; 2793 2794 case DLT_PPI: 2795 s = gen_load_ppi_llprefixlen(cstate); 2796 break; 2797 2798 default: 2799 s = NULL; 2800 break; 2801 } 2802 2803 /* 2804 * For link-layer types that have a variable-length link-layer 2805 * header, generate code to load the offset of the link-layer 2806 * payload into the register assigned to that offset, if any. 2807 */ 2808 switch (cstate->outermostlinktype) { 2809 2810 case DLT_IEEE802_11: 2811 case DLT_PRISM_HEADER: 2812 case DLT_IEEE802_11_RADIO_AVS: 2813 case DLT_IEEE802_11_RADIO: 2814 case DLT_PPI: 2815 s = gen_load_802_11_header_len(cstate, s, b->stmts); 2816 break; 2817 } 2818 2819 /* 2820 * If there there is no initialization yet and we need variable 2821 * length offsets for VLAN, initialize them to zero 2822 */ 2823 if (s == NULL && cstate->is_vlan_vloffset) { 2824 struct slist *s2; 2825 2826 if (cstate->off_linkpl.reg == -1) 2827 cstate->off_linkpl.reg = alloc_reg(cstate); 2828 if (cstate->off_linktype.reg == -1) 2829 cstate->off_linktype.reg = alloc_reg(cstate); 2830 2831 s = new_stmt(cstate, BPF_LD|BPF_W|BPF_IMM); 2832 s->s.k = 0; 2833 s2 = new_stmt(cstate, BPF_ST); 2834 s2->s.k = cstate->off_linkpl.reg; 2835 sappend(s, s2); 2836 s2 = new_stmt(cstate, BPF_ST); 2837 s2->s.k = cstate->off_linktype.reg; 2838 sappend(s, s2); 2839 } 2840 2841 /* 2842 * If we have any offset-loading code, append all the 2843 * existing statements in the block to those statements, 2844 * and make the resulting list the list of statements 2845 * for the block. 2846 */ 2847 if (s != NULL) { 2848 sappend(s, b->stmts); 2849 b->stmts = s; 2850 } 2851 } 2852 2853 static struct block * 2854 gen_ppi_dlt_check(compiler_state_t *cstate) 2855 { 2856 struct slist *s_load_dlt; 2857 struct block *b; 2858 2859 if (cstate->linktype == DLT_PPI) 2860 { 2861 /* Create the statements that check for the DLT 2862 */ 2863 s_load_dlt = new_stmt(cstate, BPF_LD|BPF_W|BPF_ABS); 2864 s_load_dlt->s.k = 4; 2865 2866 b = new_block(cstate, JMP(BPF_JEQ)); 2867 2868 b->stmts = s_load_dlt; 2869 b->s.k = SWAPLONG(DLT_IEEE802_11); 2870 } 2871 else 2872 { 2873 b = NULL; 2874 } 2875 2876 return b; 2877 } 2878 2879 /* 2880 * Take an absolute offset, and: 2881 * 2882 * if it has no variable part, return NULL; 2883 * 2884 * if it has a variable part, generate code to load the register 2885 * containing that variable part into the X register, returning 2886 * a pointer to that code - if no register for that offset has 2887 * been allocated, allocate it first. 2888 * 2889 * (The code to set that register will be generated later, but will 2890 * be placed earlier in the code sequence.) 2891 */ 2892 static struct slist * 2893 gen_abs_offset_varpart(compiler_state_t *cstate, bpf_abs_offset *off) 2894 { 2895 struct slist *s; 2896 2897 if (off->is_variable) { 2898 if (off->reg == -1) { 2899 /* 2900 * We haven't yet assigned a register for the 2901 * variable part of the offset of the link-layer 2902 * header; allocate one. 2903 */ 2904 off->reg = alloc_reg(cstate); 2905 } 2906 2907 /* 2908 * Load the register containing the variable part of the 2909 * offset of the link-layer header into the X register. 2910 */ 2911 s = new_stmt(cstate, BPF_LDX|BPF_MEM); 2912 s->s.k = off->reg; 2913 return s; 2914 } else { 2915 /* 2916 * That offset isn't variable, there's no variable part, 2917 * so we don't need to generate any code. 2918 */ 2919 return NULL; 2920 } 2921 } 2922 2923 /* 2924 * Map an Ethernet type to the equivalent PPP type. 2925 */ 2926 static int 2927 ethertype_to_ppptype(int proto) 2928 { 2929 switch (proto) { 2930 2931 case ETHERTYPE_IP: 2932 proto = PPP_IP; 2933 break; 2934 2935 case ETHERTYPE_IPV6: 2936 proto = PPP_IPV6; 2937 break; 2938 2939 case ETHERTYPE_DN: 2940 proto = PPP_DECNET; 2941 break; 2942 2943 case ETHERTYPE_ATALK: 2944 proto = PPP_APPLE; 2945 break; 2946 2947 case ETHERTYPE_NS: 2948 proto = PPP_NS; 2949 break; 2950 2951 case LLCSAP_ISONS: 2952 proto = PPP_OSI; 2953 break; 2954 2955 case LLCSAP_8021D: 2956 /* 2957 * I'm assuming the "Bridging PDU"s that go 2958 * over PPP are Spanning Tree Protocol 2959 * Bridging PDUs. 2960 */ 2961 proto = PPP_BRPDU; 2962 break; 2963 2964 case LLCSAP_IPX: 2965 proto = PPP_IPX; 2966 break; 2967 } 2968 return (proto); 2969 } 2970 2971 /* 2972 * Generate any tests that, for encapsulation of a link-layer packet 2973 * inside another protocol stack, need to be done to check for those 2974 * link-layer packets (and that haven't already been done by a check 2975 * for that encapsulation). 2976 */ 2977 static struct block * 2978 gen_prevlinkhdr_check(compiler_state_t *cstate) 2979 { 2980 struct block *b0; 2981 2982 if (cstate->is_geneve) 2983 return gen_geneve_ll_check(cstate); 2984 2985 switch (cstate->prevlinktype) { 2986 2987 case DLT_SUNATM: 2988 /* 2989 * This is LANE-encapsulated Ethernet; check that the LANE 2990 * packet doesn't begin with an LE Control marker, i.e. 2991 * that it's data, not a control message. 2992 * 2993 * (We've already generated a test for LANE.) 2994 */ 2995 b0 = gen_cmp(cstate, OR_PREVLINKHDR, SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00); 2996 gen_not(b0); 2997 return b0; 2998 2999 default: 3000 /* 3001 * No such tests are necessary. 3002 */ 3003 return NULL; 3004 } 3005 /*NOTREACHED*/ 3006 } 3007 3008 /* 3009 * The three different values we should check for when checking for an 3010 * IPv6 packet with DLT_NULL. 3011 */ 3012 #define BSD_AFNUM_INET6_BSD 24 /* NetBSD, OpenBSD, BSD/OS, Npcap */ 3013 #define BSD_AFNUM_INET6_FREEBSD 28 /* FreeBSD */ 3014 #define BSD_AFNUM_INET6_DARWIN 30 /* macOS, iOS, other Darwin-based OSes */ 3015 3016 /* 3017 * Generate code to match a particular packet type by matching the 3018 * link-layer type field or fields in the 802.2 LLC header. 3019 * 3020 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 3021 * value, if <= ETHERMTU. 3022 */ 3023 static struct block * 3024 gen_linktype(compiler_state_t *cstate, int proto) 3025 { 3026 struct block *b0, *b1, *b2; 3027 const char *description; 3028 3029 /* are we checking MPLS-encapsulated packets? */ 3030 if (cstate->label_stack_depth > 0) { 3031 switch (proto) { 3032 case ETHERTYPE_IP: 3033 case PPP_IP: 3034 /* FIXME add other L3 proto IDs */ 3035 return gen_mpls_linktype(cstate, Q_IP); 3036 3037 case ETHERTYPE_IPV6: 3038 case PPP_IPV6: 3039 /* FIXME add other L3 proto IDs */ 3040 return gen_mpls_linktype(cstate, Q_IPV6); 3041 3042 default: 3043 bpf_error(cstate, "unsupported protocol over mpls"); 3044 /* NOTREACHED */ 3045 } 3046 } 3047 3048 switch (cstate->linktype) { 3049 3050 case DLT_EN10MB: 3051 case DLT_NETANALYZER: 3052 case DLT_NETANALYZER_TRANSPARENT: 3053 /* Geneve has an EtherType regardless of whether there is an 3054 * L2 header. */ 3055 if (!cstate->is_geneve) 3056 b0 = gen_prevlinkhdr_check(cstate); 3057 else 3058 b0 = NULL; 3059 3060 b1 = gen_ether_linktype(cstate, proto); 3061 if (b0 != NULL) 3062 gen_and(b0, b1); 3063 return b1; 3064 /*NOTREACHED*/ 3065 break; 3066 3067 case DLT_C_HDLC: 3068 switch (proto) { 3069 3070 case LLCSAP_ISONS: 3071 proto = (proto << 8 | LLCSAP_ISONS); 3072 /* fall through */ 3073 3074 default: 3075 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); 3076 /*NOTREACHED*/ 3077 break; 3078 } 3079 break; 3080 3081 case DLT_IEEE802_11: 3082 case DLT_PRISM_HEADER: 3083 case DLT_IEEE802_11_RADIO_AVS: 3084 case DLT_IEEE802_11_RADIO: 3085 case DLT_PPI: 3086 /* 3087 * Check that we have a data frame. 3088 */ 3089 b0 = gen_check_802_11_data_frame(cstate); 3090 3091 /* 3092 * Now check for the specified link-layer type. 3093 */ 3094 b1 = gen_llc_linktype(cstate, proto); 3095 gen_and(b0, b1); 3096 return b1; 3097 /*NOTREACHED*/ 3098 break; 3099 3100 case DLT_FDDI: 3101 /* 3102 * XXX - check for LLC frames. 3103 */ 3104 return gen_llc_linktype(cstate, proto); 3105 /*NOTREACHED*/ 3106 break; 3107 3108 case DLT_IEEE802: 3109 /* 3110 * XXX - check for LLC PDUs, as per IEEE 802.5. 3111 */ 3112 return gen_llc_linktype(cstate, proto); 3113 /*NOTREACHED*/ 3114 break; 3115 3116 case DLT_ATM_RFC1483: 3117 case DLT_ATM_CLIP: 3118 case DLT_IP_OVER_FC: 3119 return gen_llc_linktype(cstate, proto); 3120 /*NOTREACHED*/ 3121 break; 3122 3123 case DLT_SUNATM: 3124 /* 3125 * Check for an LLC-encapsulated version of this protocol; 3126 * if we were checking for LANE, linktype would no longer 3127 * be DLT_SUNATM. 3128 * 3129 * Check for LLC encapsulation and then check the protocol. 3130 */ 3131 b0 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 3132 b1 = gen_llc_linktype(cstate, proto); 3133 gen_and(b0, b1); 3134 return b1; 3135 /*NOTREACHED*/ 3136 break; 3137 3138 case DLT_LINUX_SLL: 3139 return gen_linux_sll_linktype(cstate, proto); 3140 /*NOTREACHED*/ 3141 break; 3142 3143 case DLT_SLIP: 3144 case DLT_SLIP_BSDOS: 3145 case DLT_RAW: 3146 /* 3147 * These types don't provide any type field; packets 3148 * are always IPv4 or IPv6. 3149 * 3150 * XXX - for IPv4, check for a version number of 4, and, 3151 * for IPv6, check for a version number of 6? 3152 */ 3153 switch (proto) { 3154 3155 case ETHERTYPE_IP: 3156 /* Check for a version number of 4. */ 3157 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, 0x40, 0xF0); 3158 3159 case ETHERTYPE_IPV6: 3160 /* Check for a version number of 6. */ 3161 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, 0x60, 0xF0); 3162 3163 default: 3164 return gen_false(cstate); /* always false */ 3165 } 3166 /*NOTREACHED*/ 3167 break; 3168 3169 case DLT_IPV4: 3170 /* 3171 * Raw IPv4, so no type field. 3172 */ 3173 if (proto == ETHERTYPE_IP) 3174 return gen_true(cstate); /* always true */ 3175 3176 /* Checking for something other than IPv4; always false */ 3177 return gen_false(cstate); 3178 /*NOTREACHED*/ 3179 break; 3180 3181 case DLT_IPV6: 3182 /* 3183 * Raw IPv6, so no type field. 3184 */ 3185 if (proto == ETHERTYPE_IPV6) 3186 return gen_true(cstate); /* always true */ 3187 3188 /* Checking for something other than IPv6; always false */ 3189 return gen_false(cstate); 3190 /*NOTREACHED*/ 3191 break; 3192 3193 case DLT_PPP: 3194 case DLT_PPP_PPPD: 3195 case DLT_PPP_SERIAL: 3196 case DLT_PPP_ETHER: 3197 /* 3198 * We use Ethernet protocol types inside libpcap; 3199 * map them to the corresponding PPP protocol types. 3200 */ 3201 proto = ethertype_to_ppptype(proto); 3202 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); 3203 /*NOTREACHED*/ 3204 break; 3205 3206 case DLT_PPP_BSDOS: 3207 /* 3208 * We use Ethernet protocol types inside libpcap; 3209 * map them to the corresponding PPP protocol types. 3210 */ 3211 switch (proto) { 3212 3213 case ETHERTYPE_IP: 3214 /* 3215 * Also check for Van Jacobson-compressed IP. 3216 * XXX - do this for other forms of PPP? 3217 */ 3218 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_IP); 3219 b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_VJC); 3220 gen_or(b0, b1); 3221 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_VJNC); 3222 gen_or(b1, b0); 3223 return b0; 3224 3225 default: 3226 proto = ethertype_to_ppptype(proto); 3227 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, 3228 (bpf_int32)proto); 3229 } 3230 /*NOTREACHED*/ 3231 break; 3232 3233 case DLT_NULL: 3234 case DLT_LOOP: 3235 case DLT_ENC: 3236 switch (proto) { 3237 3238 case ETHERTYPE_IP: 3239 return (gen_loopback_linktype(cstate, AF_INET)); 3240 3241 case ETHERTYPE_IPV6: 3242 /* 3243 * AF_ values may, unfortunately, be platform- 3244 * dependent; AF_INET isn't, because everybody 3245 * used 4.2BSD's value, but AF_INET6 is, because 3246 * 4.2BSD didn't have a value for it (given that 3247 * IPv6 didn't exist back in the early 1980's), 3248 * and they all picked their own values. 3249 * 3250 * This means that, if we're reading from a 3251 * savefile, we need to check for all the 3252 * possible values. 3253 * 3254 * If we're doing a live capture, we only need 3255 * to check for this platform's value; however, 3256 * Npcap uses 24, which isn't Windows's AF_INET6 3257 * value. (Given the multiple different values, 3258 * programs that read pcap files shouldn't be 3259 * checking for their platform's AF_INET6 value 3260 * anyway, they should check for all of the 3261 * possible values. and they might as well do 3262 * that even for live captures.) 3263 */ 3264 if (cstate->bpf_pcap->rfile != NULL) { 3265 /* 3266 * Savefile - check for all three 3267 * possible IPv6 values. 3268 */ 3269 b0 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_BSD); 3270 b1 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_FREEBSD); 3271 gen_or(b0, b1); 3272 b0 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_DARWIN); 3273 gen_or(b0, b1); 3274 return (b1); 3275 } else { 3276 /* 3277 * Live capture, so we only need to 3278 * check for the value used on this 3279 * platform. 3280 */ 3281 #ifdef _WIN32 3282 /* 3283 * Npcap doesn't use Windows's AF_INET6, 3284 * as that collides with AF_IPX on 3285 * some BSDs (both have the value 23). 3286 * Instead, it uses 24. 3287 */ 3288 return (gen_loopback_linktype(cstate, 24)); 3289 #else /* _WIN32 */ 3290 #ifdef AF_INET6 3291 return (gen_loopback_linktype(cstate, AF_INET6)); 3292 #else /* AF_INET6 */ 3293 /* 3294 * I guess this platform doesn't support 3295 * IPv6, so we just reject all packets. 3296 */ 3297 return gen_false(cstate); 3298 #endif /* AF_INET6 */ 3299 #endif /* _WIN32 */ 3300 } 3301 3302 default: 3303 /* 3304 * Not a type on which we support filtering. 3305 * XXX - support those that have AF_ values 3306 * #defined on this platform, at least? 3307 */ 3308 return gen_false(cstate); 3309 } 3310 3311 #ifdef HAVE_NET_PFVAR_H 3312 case DLT_PFLOG: 3313 /* 3314 * af field is host byte order in contrast to the rest of 3315 * the packet. 3316 */ 3317 if (proto == ETHERTYPE_IP) 3318 return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af), 3319 BPF_B, (bpf_int32)AF_INET)); 3320 else if (proto == ETHERTYPE_IPV6) 3321 return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af), 3322 BPF_B, (bpf_int32)AF_INET6)); 3323 else 3324 return gen_false(cstate); 3325 /*NOTREACHED*/ 3326 break; 3327 #endif /* HAVE_NET_PFVAR_H */ 3328 3329 case DLT_ARCNET: 3330 case DLT_ARCNET_LINUX: 3331 /* 3332 * XXX should we check for first fragment if the protocol 3333 * uses PHDS? 3334 */ 3335 switch (proto) { 3336 3337 default: 3338 return gen_false(cstate); 3339 3340 case ETHERTYPE_IPV6: 3341 return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3342 (bpf_int32)ARCTYPE_INET6)); 3343 3344 case ETHERTYPE_IP: 3345 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3346 (bpf_int32)ARCTYPE_IP); 3347 b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3348 (bpf_int32)ARCTYPE_IP_OLD); 3349 gen_or(b0, b1); 3350 return (b1); 3351 3352 case ETHERTYPE_ARP: 3353 b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3354 (bpf_int32)ARCTYPE_ARP); 3355 b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3356 (bpf_int32)ARCTYPE_ARP_OLD); 3357 gen_or(b0, b1); 3358 return (b1); 3359 3360 case ETHERTYPE_REVARP: 3361 return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3362 (bpf_int32)ARCTYPE_REVARP)); 3363 3364 case ETHERTYPE_ATALK: 3365 return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, 3366 (bpf_int32)ARCTYPE_ATALK)); 3367 } 3368 /*NOTREACHED*/ 3369 break; 3370 3371 case DLT_LTALK: 3372 switch (proto) { 3373 case ETHERTYPE_ATALK: 3374 return gen_true(cstate); 3375 default: 3376 return gen_false(cstate); 3377 } 3378 /*NOTREACHED*/ 3379 break; 3380 3381 case DLT_FRELAY: 3382 /* 3383 * XXX - assumes a 2-byte Frame Relay header with 3384 * DLCI and flags. What if the address is longer? 3385 */ 3386 switch (proto) { 3387 3388 case ETHERTYPE_IP: 3389 /* 3390 * Check for the special NLPID for IP. 3391 */ 3392 return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | 0xcc); 3393 3394 case ETHERTYPE_IPV6: 3395 /* 3396 * Check for the special NLPID for IPv6. 3397 */ 3398 return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | 0x8e); 3399 3400 case LLCSAP_ISONS: 3401 /* 3402 * Check for several OSI protocols. 3403 * 3404 * Frame Relay packets typically have an OSI 3405 * NLPID at the beginning; we check for each 3406 * of them. 3407 * 3408 * What we check for is the NLPID and a frame 3409 * control field of UI, i.e. 0x03 followed 3410 * by the NLPID. 3411 */ 3412 b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | ISO8473_CLNP); 3413 b1 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | ISO9542_ESIS); 3414 b2 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | ISO10589_ISIS); 3415 gen_or(b1, b2); 3416 gen_or(b0, b2); 3417 return b2; 3418 3419 default: 3420 return gen_false(cstate); 3421 } 3422 /*NOTREACHED*/ 3423 break; 3424 3425 case DLT_MFR: 3426 bpf_error(cstate, "Multi-link Frame Relay link-layer type filtering not implemented"); 3427 3428 case DLT_JUNIPER_MFR: 3429 case DLT_JUNIPER_MLFR: 3430 case DLT_JUNIPER_MLPPP: 3431 case DLT_JUNIPER_ATM1: 3432 case DLT_JUNIPER_ATM2: 3433 case DLT_JUNIPER_PPPOE: 3434 case DLT_JUNIPER_PPPOE_ATM: 3435 case DLT_JUNIPER_GGSN: 3436 case DLT_JUNIPER_ES: 3437 case DLT_JUNIPER_MONITOR: 3438 case DLT_JUNIPER_SERVICES: 3439 case DLT_JUNIPER_ETHER: 3440 case DLT_JUNIPER_PPP: 3441 case DLT_JUNIPER_FRELAY: 3442 case DLT_JUNIPER_CHDLC: 3443 case DLT_JUNIPER_VP: 3444 case DLT_JUNIPER_ST: 3445 case DLT_JUNIPER_ISM: 3446 case DLT_JUNIPER_VS: 3447 case DLT_JUNIPER_SRX_E2E: 3448 case DLT_JUNIPER_FIBRECHANNEL: 3449 case DLT_JUNIPER_ATM_CEMIC: 3450 3451 /* just lets verify the magic number for now - 3452 * on ATM we may have up to 6 different encapsulations on the wire 3453 * and need a lot of heuristics to figure out that the payload 3454 * might be; 3455 * 3456 * FIXME encapsulation specific BPF_ filters 3457 */ 3458 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */ 3459 3460 case DLT_BACNET_MS_TP: 3461 return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x55FF0000, 0xffff0000); 3462 3463 case DLT_IPNET: 3464 return gen_ipnet_linktype(cstate, proto); 3465 3466 case DLT_LINUX_IRDA: 3467 bpf_error(cstate, "IrDA link-layer type filtering not implemented"); 3468 3469 case DLT_DOCSIS: 3470 bpf_error(cstate, "DOCSIS link-layer type filtering not implemented"); 3471 3472 case DLT_MTP2: 3473 case DLT_MTP2_WITH_PHDR: 3474 bpf_error(cstate, "MTP2 link-layer type filtering not implemented"); 3475 3476 case DLT_ERF: 3477 bpf_error(cstate, "ERF link-layer type filtering not implemented"); 3478 3479 case DLT_PFSYNC: 3480 bpf_error(cstate, "PFSYNC link-layer type filtering not implemented"); 3481 3482 case DLT_LINUX_LAPD: 3483 bpf_error(cstate, "LAPD link-layer type filtering not implemented"); 3484 3485 case DLT_USB_FREEBSD: 3486 case DLT_USB_LINUX: 3487 case DLT_USB_LINUX_MMAPPED: 3488 case DLT_USBPCAP: 3489 bpf_error(cstate, "USB link-layer type filtering not implemented"); 3490 3491 case DLT_BLUETOOTH_HCI_H4: 3492 case DLT_BLUETOOTH_HCI_H4_WITH_PHDR: 3493 bpf_error(cstate, "Bluetooth link-layer type filtering not implemented"); 3494 3495 case DLT_CAN20B: 3496 case DLT_CAN_SOCKETCAN: 3497 bpf_error(cstate, "CAN link-layer type filtering not implemented"); 3498 3499 case DLT_IEEE802_15_4: 3500 case DLT_IEEE802_15_4_LINUX: 3501 case DLT_IEEE802_15_4_NONASK_PHY: 3502 case DLT_IEEE802_15_4_NOFCS: 3503 bpf_error(cstate, "IEEE 802.15.4 link-layer type filtering not implemented"); 3504 3505 case DLT_IEEE802_16_MAC_CPS_RADIO: 3506 bpf_error(cstate, "IEEE 802.16 link-layer type filtering not implemented"); 3507 3508 case DLT_SITA: 3509 bpf_error(cstate, "SITA link-layer type filtering not implemented"); 3510 3511 case DLT_RAIF1: 3512 bpf_error(cstate, "RAIF1 link-layer type filtering not implemented"); 3513 3514 case DLT_IPMB: 3515 bpf_error(cstate, "IPMB link-layer type filtering not implemented"); 3516 3517 case DLT_AX25_KISS: 3518 bpf_error(cstate, "AX.25 link-layer type filtering not implemented"); 3519 3520 case DLT_NFLOG: 3521 /* Using the fixed-size NFLOG header it is possible to tell only 3522 * the address family of the packet, other meaningful data is 3523 * either missing or behind TLVs. 3524 */ 3525 bpf_error(cstate, "NFLOG link-layer type filtering not implemented"); 3526 3527 default: 3528 /* 3529 * Does this link-layer header type have a field 3530 * indicating the type of the next protocol? If 3531 * so, off_linktype.constant_part will be the offset of that 3532 * field in the packet; if not, it will be OFFSET_NOT_SET. 3533 */ 3534 if (cstate->off_linktype.constant_part != OFFSET_NOT_SET) { 3535 /* 3536 * Yes; assume it's an Ethernet type. (If 3537 * it's not, it needs to be handled specially 3538 * above.) 3539 */ 3540 return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); 3541 } else { 3542 /* 3543 * No; report an error. 3544 */ 3545 description = pcap_datalink_val_to_description(cstate->linktype); 3546 if (description != NULL) { 3547 bpf_error(cstate, "%s link-layer type filtering not implemented", 3548 description); 3549 } else { 3550 bpf_error(cstate, "DLT %u link-layer type filtering not implemented", 3551 cstate->linktype); 3552 } 3553 } 3554 break; 3555 } 3556 } 3557 3558 /* 3559 * Check for an LLC SNAP packet with a given organization code and 3560 * protocol type; we check the entire contents of the 802.2 LLC and 3561 * snap headers, checking for DSAP and SSAP of SNAP and a control 3562 * field of 0x03 in the LLC header, and for the specified organization 3563 * code and protocol type in the SNAP header. 3564 */ 3565 static struct block * 3566 gen_snap(compiler_state_t *cstate, bpf_u_int32 orgcode, bpf_u_int32 ptype) 3567 { 3568 u_char snapblock[8]; 3569 3570 snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */ 3571 snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */ 3572 snapblock[2] = 0x03; /* control = UI */ 3573 snapblock[3] = (u_char)(orgcode >> 16); /* upper 8 bits of organization code */ 3574 snapblock[4] = (u_char)(orgcode >> 8); /* middle 8 bits of organization code */ 3575 snapblock[5] = (u_char)(orgcode >> 0); /* lower 8 bits of organization code */ 3576 snapblock[6] = (u_char)(ptype >> 8); /* upper 8 bits of protocol type */ 3577 snapblock[7] = (u_char)(ptype >> 0); /* lower 8 bits of protocol type */ 3578 return gen_bcmp(cstate, OR_LLC, 0, 8, snapblock); 3579 } 3580 3581 /* 3582 * Generate code to match frames with an LLC header. 3583 */ 3584 struct block * 3585 gen_llc(compiler_state_t *cstate) 3586 { 3587 struct block *b0, *b1; 3588 3589 switch (cstate->linktype) { 3590 3591 case DLT_EN10MB: 3592 /* 3593 * We check for an Ethernet type field less than 3594 * 1500, which means it's an 802.3 length field. 3595 */ 3596 b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU); 3597 gen_not(b0); 3598 3599 /* 3600 * Now check for the purported DSAP and SSAP not being 3601 * 0xFF, to rule out NetWare-over-802.3. 3602 */ 3603 b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)0xFFFF); 3604 gen_not(b1); 3605 gen_and(b0, b1); 3606 return b1; 3607 3608 case DLT_SUNATM: 3609 /* 3610 * We check for LLC traffic. 3611 */ 3612 b0 = gen_atmtype_abbrev(cstate, A_LLC); 3613 return b0; 3614 3615 case DLT_IEEE802: /* Token Ring */ 3616 /* 3617 * XXX - check for LLC frames. 3618 */ 3619 return gen_true(cstate); 3620 3621 case DLT_FDDI: 3622 /* 3623 * XXX - check for LLC frames. 3624 */ 3625 return gen_true(cstate); 3626 3627 case DLT_ATM_RFC1483: 3628 /* 3629 * For LLC encapsulation, these are defined to have an 3630 * 802.2 LLC header. 3631 * 3632 * For VC encapsulation, they don't, but there's no 3633 * way to check for that; the protocol used on the VC 3634 * is negotiated out of band. 3635 */ 3636 return gen_true(cstate); 3637 3638 case DLT_IEEE802_11: 3639 case DLT_PRISM_HEADER: 3640 case DLT_IEEE802_11_RADIO: 3641 case DLT_IEEE802_11_RADIO_AVS: 3642 case DLT_PPI: 3643 /* 3644 * Check that we have a data frame. 3645 */ 3646 b0 = gen_check_802_11_data_frame(cstate); 3647 return b0; 3648 3649 default: 3650 bpf_error(cstate, "'llc' not supported for linktype %d", cstate->linktype); 3651 /* NOTREACHED */ 3652 } 3653 } 3654 3655 struct block * 3656 gen_llc_i(compiler_state_t *cstate) 3657 { 3658 struct block *b0, *b1; 3659 struct slist *s; 3660 3661 /* 3662 * Check whether this is an LLC frame. 3663 */ 3664 b0 = gen_llc(cstate); 3665 3666 /* 3667 * Load the control byte and test the low-order bit; it must 3668 * be clear for I frames. 3669 */ 3670 s = gen_load_a(cstate, OR_LLC, 2, BPF_B); 3671 b1 = new_block(cstate, JMP(BPF_JSET)); 3672 b1->s.k = 0x01; 3673 b1->stmts = s; 3674 gen_not(b1); 3675 gen_and(b0, b1); 3676 return b1; 3677 } 3678 3679 struct block * 3680 gen_llc_s(compiler_state_t *cstate) 3681 { 3682 struct block *b0, *b1; 3683 3684 /* 3685 * Check whether this is an LLC frame. 3686 */ 3687 b0 = gen_llc(cstate); 3688 3689 /* 3690 * Now compare the low-order 2 bit of the control byte against 3691 * the appropriate value for S frames. 3692 */ 3693 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, LLC_S_FMT, 0x03); 3694 gen_and(b0, b1); 3695 return b1; 3696 } 3697 3698 struct block * 3699 gen_llc_u(compiler_state_t *cstate) 3700 { 3701 struct block *b0, *b1; 3702 3703 /* 3704 * Check whether this is an LLC frame. 3705 */ 3706 b0 = gen_llc(cstate); 3707 3708 /* 3709 * Now compare the low-order 2 bit of the control byte against 3710 * the appropriate value for U frames. 3711 */ 3712 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, LLC_U_FMT, 0x03); 3713 gen_and(b0, b1); 3714 return b1; 3715 } 3716 3717 struct block * 3718 gen_llc_s_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) 3719 { 3720 struct block *b0, *b1; 3721 3722 /* 3723 * Check whether this is an LLC frame. 3724 */ 3725 b0 = gen_llc(cstate); 3726 3727 /* 3728 * Now check for an S frame with the appropriate type. 3729 */ 3730 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, subtype, LLC_S_CMD_MASK); 3731 gen_and(b0, b1); 3732 return b1; 3733 } 3734 3735 struct block * 3736 gen_llc_u_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) 3737 { 3738 struct block *b0, *b1; 3739 3740 /* 3741 * Check whether this is an LLC frame. 3742 */ 3743 b0 = gen_llc(cstate); 3744 3745 /* 3746 * Now check for a U frame with the appropriate type. 3747 */ 3748 b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, subtype, LLC_U_CMD_MASK); 3749 gen_and(b0, b1); 3750 return b1; 3751 } 3752 3753 /* 3754 * Generate code to match a particular packet type, for link-layer types 3755 * using 802.2 LLC headers. 3756 * 3757 * This is *NOT* used for Ethernet; "gen_ether_linktype()" is used 3758 * for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues. 3759 * 3760 * "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP 3761 * value, if <= ETHERMTU. We use that to determine whether to 3762 * match the DSAP or both DSAP and LSAP or to check the OUI and 3763 * protocol ID in a SNAP header. 3764 */ 3765 static struct block * 3766 gen_llc_linktype(compiler_state_t *cstate, int proto) 3767 { 3768 /* 3769 * XXX - handle token-ring variable-length header. 3770 */ 3771 switch (proto) { 3772 3773 case LLCSAP_IP: 3774 case LLCSAP_ISONS: 3775 case LLCSAP_NETBEUI: 3776 /* 3777 * XXX - should we check both the DSAP and the 3778 * SSAP, like this, or should we check just the 3779 * DSAP, as we do for other SAP values? 3780 */ 3781 return gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_u_int32) 3782 ((proto << 8) | proto)); 3783 3784 case LLCSAP_IPX: 3785 /* 3786 * XXX - are there ever SNAP frames for IPX on 3787 * non-Ethernet 802.x networks? 3788 */ 3789 return gen_cmp(cstate, OR_LLC, 0, BPF_B, 3790 (bpf_int32)LLCSAP_IPX); 3791 3792 case ETHERTYPE_ATALK: 3793 /* 3794 * 802.2-encapsulated ETHERTYPE_ATALK packets are 3795 * SNAP packets with an organization code of 3796 * 0x080007 (Apple, for Appletalk) and a protocol 3797 * type of ETHERTYPE_ATALK (Appletalk). 3798 * 3799 * XXX - check for an organization code of 3800 * encapsulated Ethernet as well? 3801 */ 3802 return gen_snap(cstate, 0x080007, ETHERTYPE_ATALK); 3803 3804 default: 3805 /* 3806 * XXX - we don't have to check for IPX 802.3 3807 * here, but should we check for the IPX Ethertype? 3808 */ 3809 if (proto <= ETHERMTU) { 3810 /* 3811 * This is an LLC SAP value, so check 3812 * the DSAP. 3813 */ 3814 return gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)proto); 3815 } else { 3816 /* 3817 * This is an Ethernet type; we assume that it's 3818 * unlikely that it'll appear in the right place 3819 * at random, and therefore check only the 3820 * location that would hold the Ethernet type 3821 * in a SNAP frame with an organization code of 3822 * 0x000000 (encapsulated Ethernet). 3823 * 3824 * XXX - if we were to check for the SNAP DSAP and 3825 * LSAP, as per XXX, and were also to check for an 3826 * organization code of 0x000000 (encapsulated 3827 * Ethernet), we'd do 3828 * 3829 * return gen_snap(cstate, 0x000000, proto); 3830 * 3831 * here; for now, we don't, as per the above. 3832 * I don't know whether it's worth the extra CPU 3833 * time to do the right check or not. 3834 */ 3835 return gen_cmp(cstate, OR_LLC, 6, BPF_H, (bpf_int32)proto); 3836 } 3837 } 3838 } 3839 3840 static struct block * 3841 gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, 3842 int dir, int proto, u_int src_off, u_int dst_off) 3843 { 3844 struct block *b0, *b1; 3845 u_int offset; 3846 3847 switch (dir) { 3848 3849 case Q_SRC: 3850 offset = src_off; 3851 break; 3852 3853 case Q_DST: 3854 offset = dst_off; 3855 break; 3856 3857 case Q_AND: 3858 b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); 3859 b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off); 3860 gen_and(b0, b1); 3861 return b1; 3862 3863 case Q_OR: 3864 case Q_DEFAULT: 3865 b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); 3866 b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off); 3867 gen_or(b0, b1); 3868 return b1; 3869 3870 case Q_ADDR1: 3871 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3872 break; 3873 3874 case Q_ADDR2: 3875 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3876 break; 3877 3878 case Q_ADDR3: 3879 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3880 break; 3881 3882 case Q_ADDR4: 3883 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3884 break; 3885 3886 case Q_RA: 3887 bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 3888 break; 3889 3890 case Q_TA: 3891 bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 3892 break; 3893 3894 default: 3895 abort(); 3896 } 3897 b0 = gen_linktype(cstate, proto); 3898 b1 = gen_mcmp(cstate, OR_LINKPL, offset, BPF_W, (bpf_int32)addr, mask); 3899 gen_and(b0, b1); 3900 return b1; 3901 } 3902 3903 #ifdef INET6 3904 static struct block * 3905 gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, 3906 struct in6_addr *mask, int dir, int proto, u_int src_off, u_int dst_off) 3907 { 3908 struct block *b0, *b1; 3909 u_int offset; 3910 uint32_t *a, *m; 3911 3912 switch (dir) { 3913 3914 case Q_SRC: 3915 offset = src_off; 3916 break; 3917 3918 case Q_DST: 3919 offset = dst_off; 3920 break; 3921 3922 case Q_AND: 3923 b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); 3924 b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off); 3925 gen_and(b0, b1); 3926 return b1; 3927 3928 case Q_OR: 3929 case Q_DEFAULT: 3930 b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); 3931 b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off); 3932 gen_or(b0, b1); 3933 return b1; 3934 3935 case Q_ADDR1: 3936 bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3937 break; 3938 3939 case Q_ADDR2: 3940 bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3941 break; 3942 3943 case Q_ADDR3: 3944 bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3945 break; 3946 3947 case Q_ADDR4: 3948 bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); 3949 break; 3950 3951 case Q_RA: 3952 bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 3953 break; 3954 3955 case Q_TA: 3956 bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); 3957 break; 3958 3959 default: 3960 abort(); 3961 } 3962 /* this order is important */ 3963 a = (uint32_t *)addr; 3964 m = (uint32_t *)mask; 3965 b1 = gen_mcmp(cstate, OR_LINKPL, offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3])); 3966 b0 = gen_mcmp(cstate, OR_LINKPL, offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2])); 3967 gen_and(b0, b1); 3968 b0 = gen_mcmp(cstate, OR_LINKPL, offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1])); 3969 gen_and(b0, b1); 3970 b0 = gen_mcmp(cstate, OR_LINKPL, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0])); 3971 gen_and(b0, b1); 3972 b0 = gen_linktype(cstate, proto); 3973 gen_and(b0, b1); 3974 return b1; 3975 } 3976 #endif 3977 3978 static struct block * 3979 gen_ehostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 3980 { 3981 register struct block *b0, *b1; 3982 3983 switch (dir) { 3984 case Q_SRC: 3985 return gen_bcmp(cstate, OR_LINKHDR, 6, 6, eaddr); 3986 3987 case Q_DST: 3988 return gen_bcmp(cstate, OR_LINKHDR, 0, 6, eaddr); 3989 3990 case Q_AND: 3991 b0 = gen_ehostop(cstate, eaddr, Q_SRC); 3992 b1 = gen_ehostop(cstate, eaddr, Q_DST); 3993 gen_and(b0, b1); 3994 return b1; 3995 3996 case Q_DEFAULT: 3997 case Q_OR: 3998 b0 = gen_ehostop(cstate, eaddr, Q_SRC); 3999 b1 = gen_ehostop(cstate, eaddr, Q_DST); 4000 gen_or(b0, b1); 4001 return b1; 4002 4003 case Q_ADDR1: 4004 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11 with 802.11 headers"); 4005 break; 4006 4007 case Q_ADDR2: 4008 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11 with 802.11 headers"); 4009 break; 4010 4011 case Q_ADDR3: 4012 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11 with 802.11 headers"); 4013 break; 4014 4015 case Q_ADDR4: 4016 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11 with 802.11 headers"); 4017 break; 4018 4019 case Q_RA: 4020 bpf_error(cstate, "'ra' is only supported on 802.11 with 802.11 headers"); 4021 break; 4022 4023 case Q_TA: 4024 bpf_error(cstate, "'ta' is only supported on 802.11 with 802.11 headers"); 4025 break; 4026 } 4027 abort(); 4028 /* NOTREACHED */ 4029 } 4030 4031 /* 4032 * Like gen_ehostop, but for DLT_FDDI 4033 */ 4034 static struct block * 4035 gen_fhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4036 { 4037 struct block *b0, *b1; 4038 4039 switch (dir) { 4040 case Q_SRC: 4041 return gen_bcmp(cstate, OR_LINKHDR, 6 + 1 + cstate->pcap_fddipad, 6, eaddr); 4042 4043 case Q_DST: 4044 return gen_bcmp(cstate, OR_LINKHDR, 0 + 1 + cstate->pcap_fddipad, 6, eaddr); 4045 4046 case Q_AND: 4047 b0 = gen_fhostop(cstate, eaddr, Q_SRC); 4048 b1 = gen_fhostop(cstate, eaddr, Q_DST); 4049 gen_and(b0, b1); 4050 return b1; 4051 4052 case Q_DEFAULT: 4053 case Q_OR: 4054 b0 = gen_fhostop(cstate, eaddr, Q_SRC); 4055 b1 = gen_fhostop(cstate, eaddr, Q_DST); 4056 gen_or(b0, b1); 4057 return b1; 4058 4059 case Q_ADDR1: 4060 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 4061 break; 4062 4063 case Q_ADDR2: 4064 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 4065 break; 4066 4067 case Q_ADDR3: 4068 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 4069 break; 4070 4071 case Q_ADDR4: 4072 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 4073 break; 4074 4075 case Q_RA: 4076 bpf_error(cstate, "'ra' is only supported on 802.11"); 4077 break; 4078 4079 case Q_TA: 4080 bpf_error(cstate, "'ta' is only supported on 802.11"); 4081 break; 4082 } 4083 abort(); 4084 /* NOTREACHED */ 4085 } 4086 4087 /* 4088 * Like gen_ehostop, but for DLT_IEEE802 (Token Ring) 4089 */ 4090 static struct block * 4091 gen_thostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4092 { 4093 register struct block *b0, *b1; 4094 4095 switch (dir) { 4096 case Q_SRC: 4097 return gen_bcmp(cstate, OR_LINKHDR, 8, 6, eaddr); 4098 4099 case Q_DST: 4100 return gen_bcmp(cstate, OR_LINKHDR, 2, 6, eaddr); 4101 4102 case Q_AND: 4103 b0 = gen_thostop(cstate, eaddr, Q_SRC); 4104 b1 = gen_thostop(cstate, eaddr, Q_DST); 4105 gen_and(b0, b1); 4106 return b1; 4107 4108 case Q_DEFAULT: 4109 case Q_OR: 4110 b0 = gen_thostop(cstate, eaddr, Q_SRC); 4111 b1 = gen_thostop(cstate, eaddr, Q_DST); 4112 gen_or(b0, b1); 4113 return b1; 4114 4115 case Q_ADDR1: 4116 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 4117 break; 4118 4119 case Q_ADDR2: 4120 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 4121 break; 4122 4123 case Q_ADDR3: 4124 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 4125 break; 4126 4127 case Q_ADDR4: 4128 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 4129 break; 4130 4131 case Q_RA: 4132 bpf_error(cstate, "'ra' is only supported on 802.11"); 4133 break; 4134 4135 case Q_TA: 4136 bpf_error(cstate, "'ta' is only supported on 802.11"); 4137 break; 4138 } 4139 abort(); 4140 /* NOTREACHED */ 4141 } 4142 4143 /* 4144 * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and 4145 * various 802.11 + radio headers. 4146 */ 4147 static struct block * 4148 gen_wlanhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4149 { 4150 register struct block *b0, *b1, *b2; 4151 register struct slist *s; 4152 4153 #ifdef ENABLE_WLAN_FILTERING_PATCH 4154 /* 4155 * TODO GV 20070613 4156 * We need to disable the optimizer because the optimizer is buggy 4157 * and wipes out some LD instructions generated by the below 4158 * code to validate the Frame Control bits 4159 */ 4160 cstate->no_optimize = 1; 4161 #endif /* ENABLE_WLAN_FILTERING_PATCH */ 4162 4163 switch (dir) { 4164 case Q_SRC: 4165 /* 4166 * Oh, yuk. 4167 * 4168 * For control frames, there is no SA. 4169 * 4170 * For management frames, SA is at an 4171 * offset of 10 from the beginning of 4172 * the packet. 4173 * 4174 * For data frames, SA is at an offset 4175 * of 10 from the beginning of the packet 4176 * if From DS is clear, at an offset of 4177 * 16 from the beginning of the packet 4178 * if From DS is set and To DS is clear, 4179 * and an offset of 24 from the beginning 4180 * of the packet if From DS is set and To DS 4181 * is set. 4182 */ 4183 4184 /* 4185 * Generate the tests to be done for data frames 4186 * with From DS set. 4187 * 4188 * First, check for To DS set, i.e. check "link[1] & 0x01". 4189 */ 4190 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4191 b1 = new_block(cstate, JMP(BPF_JSET)); 4192 b1->s.k = 0x01; /* To DS */ 4193 b1->stmts = s; 4194 4195 /* 4196 * If To DS is set, the SA is at 24. 4197 */ 4198 b0 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr); 4199 gen_and(b1, b0); 4200 4201 /* 4202 * Now, check for To DS not set, i.e. check 4203 * "!(link[1] & 0x01)". 4204 */ 4205 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4206 b2 = new_block(cstate, JMP(BPF_JSET)); 4207 b2->s.k = 0x01; /* To DS */ 4208 b2->stmts = s; 4209 gen_not(b2); 4210 4211 /* 4212 * If To DS is not set, the SA is at 16. 4213 */ 4214 b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); 4215 gen_and(b2, b1); 4216 4217 /* 4218 * Now OR together the last two checks. That gives 4219 * the complete set of checks for data frames with 4220 * From DS set. 4221 */ 4222 gen_or(b1, b0); 4223 4224 /* 4225 * Now check for From DS being set, and AND that with 4226 * the ORed-together checks. 4227 */ 4228 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4229 b1 = new_block(cstate, JMP(BPF_JSET)); 4230 b1->s.k = 0x02; /* From DS */ 4231 b1->stmts = s; 4232 gen_and(b1, b0); 4233 4234 /* 4235 * Now check for data frames with From DS not set. 4236 */ 4237 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4238 b2 = new_block(cstate, JMP(BPF_JSET)); 4239 b2->s.k = 0x02; /* From DS */ 4240 b2->stmts = s; 4241 gen_not(b2); 4242 4243 /* 4244 * If From DS isn't set, the SA is at 10. 4245 */ 4246 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4247 gen_and(b2, b1); 4248 4249 /* 4250 * Now OR together the checks for data frames with 4251 * From DS not set and for data frames with From DS 4252 * set; that gives the checks done for data frames. 4253 */ 4254 gen_or(b1, b0); 4255 4256 /* 4257 * Now check for a data frame. 4258 * I.e, check "link[0] & 0x08". 4259 */ 4260 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4261 b1 = new_block(cstate, JMP(BPF_JSET)); 4262 b1->s.k = 0x08; 4263 b1->stmts = s; 4264 4265 /* 4266 * AND that with the checks done for data frames. 4267 */ 4268 gen_and(b1, b0); 4269 4270 /* 4271 * If the high-order bit of the type value is 0, this 4272 * is a management frame. 4273 * I.e, check "!(link[0] & 0x08)". 4274 */ 4275 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4276 b2 = new_block(cstate, JMP(BPF_JSET)); 4277 b2->s.k = 0x08; 4278 b2->stmts = s; 4279 gen_not(b2); 4280 4281 /* 4282 * For management frames, the SA is at 10. 4283 */ 4284 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4285 gen_and(b2, b1); 4286 4287 /* 4288 * OR that with the checks done for data frames. 4289 * That gives the checks done for management and 4290 * data frames. 4291 */ 4292 gen_or(b1, b0); 4293 4294 /* 4295 * If the low-order bit of the type value is 1, 4296 * this is either a control frame or a frame 4297 * with a reserved type, and thus not a 4298 * frame with an SA. 4299 * 4300 * I.e., check "!(link[0] & 0x04)". 4301 */ 4302 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4303 b1 = new_block(cstate, JMP(BPF_JSET)); 4304 b1->s.k = 0x04; 4305 b1->stmts = s; 4306 gen_not(b1); 4307 4308 /* 4309 * AND that with the checks for data and management 4310 * frames. 4311 */ 4312 gen_and(b1, b0); 4313 return b0; 4314 4315 case Q_DST: 4316 /* 4317 * Oh, yuk. 4318 * 4319 * For control frames, there is no DA. 4320 * 4321 * For management frames, DA is at an 4322 * offset of 4 from the beginning of 4323 * the packet. 4324 * 4325 * For data frames, DA is at an offset 4326 * of 4 from the beginning of the packet 4327 * if To DS is clear and at an offset of 4328 * 16 from the beginning of the packet 4329 * if To DS is set. 4330 */ 4331 4332 /* 4333 * Generate the tests to be done for data frames. 4334 * 4335 * First, check for To DS set, i.e. "link[1] & 0x01". 4336 */ 4337 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4338 b1 = new_block(cstate, JMP(BPF_JSET)); 4339 b1->s.k = 0x01; /* To DS */ 4340 b1->stmts = s; 4341 4342 /* 4343 * If To DS is set, the DA is at 16. 4344 */ 4345 b0 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); 4346 gen_and(b1, b0); 4347 4348 /* 4349 * Now, check for To DS not set, i.e. check 4350 * "!(link[1] & 0x01)". 4351 */ 4352 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 4353 b2 = new_block(cstate, JMP(BPF_JSET)); 4354 b2->s.k = 0x01; /* To DS */ 4355 b2->stmts = s; 4356 gen_not(b2); 4357 4358 /* 4359 * If To DS is not set, the DA is at 4. 4360 */ 4361 b1 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr); 4362 gen_and(b2, b1); 4363 4364 /* 4365 * Now OR together the last two checks. That gives 4366 * the complete set of checks for data frames. 4367 */ 4368 gen_or(b1, b0); 4369 4370 /* 4371 * Now check for a data frame. 4372 * I.e, check "link[0] & 0x08". 4373 */ 4374 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4375 b1 = new_block(cstate, JMP(BPF_JSET)); 4376 b1->s.k = 0x08; 4377 b1->stmts = s; 4378 4379 /* 4380 * AND that with the checks done for data frames. 4381 */ 4382 gen_and(b1, b0); 4383 4384 /* 4385 * If the high-order bit of the type value is 0, this 4386 * is a management frame. 4387 * I.e, check "!(link[0] & 0x08)". 4388 */ 4389 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4390 b2 = new_block(cstate, JMP(BPF_JSET)); 4391 b2->s.k = 0x08; 4392 b2->stmts = s; 4393 gen_not(b2); 4394 4395 /* 4396 * For management frames, the DA is at 4. 4397 */ 4398 b1 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr); 4399 gen_and(b2, b1); 4400 4401 /* 4402 * OR that with the checks done for data frames. 4403 * That gives the checks done for management and 4404 * data frames. 4405 */ 4406 gen_or(b1, b0); 4407 4408 /* 4409 * If the low-order bit of the type value is 1, 4410 * this is either a control frame or a frame 4411 * with a reserved type, and thus not a 4412 * frame with an SA. 4413 * 4414 * I.e., check "!(link[0] & 0x04)". 4415 */ 4416 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4417 b1 = new_block(cstate, JMP(BPF_JSET)); 4418 b1->s.k = 0x04; 4419 b1->stmts = s; 4420 gen_not(b1); 4421 4422 /* 4423 * AND that with the checks for data and management 4424 * frames. 4425 */ 4426 gen_and(b1, b0); 4427 return b0; 4428 4429 case Q_RA: 4430 /* 4431 * Not present in management frames; addr1 in other 4432 * frames. 4433 */ 4434 4435 /* 4436 * If the high-order bit of the type value is 0, this 4437 * is a management frame. 4438 * I.e, check "(link[0] & 0x08)". 4439 */ 4440 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4441 b1 = new_block(cstate, JMP(BPF_JSET)); 4442 b1->s.k = 0x08; 4443 b1->stmts = s; 4444 4445 /* 4446 * Check addr1. 4447 */ 4448 b0 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr); 4449 4450 /* 4451 * AND that with the check of addr1. 4452 */ 4453 gen_and(b1, b0); 4454 return (b0); 4455 4456 case Q_TA: 4457 /* 4458 * Not present in management frames; addr2, if present, 4459 * in other frames. 4460 */ 4461 4462 /* 4463 * Not present in CTS or ACK control frames. 4464 */ 4465 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, 4466 IEEE80211_FC0_TYPE_MASK); 4467 gen_not(b0); 4468 b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS, 4469 IEEE80211_FC0_SUBTYPE_MASK); 4470 gen_not(b1); 4471 b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK, 4472 IEEE80211_FC0_SUBTYPE_MASK); 4473 gen_not(b2); 4474 gen_and(b1, b2); 4475 gen_or(b0, b2); 4476 4477 /* 4478 * If the high-order bit of the type value is 0, this 4479 * is a management frame. 4480 * I.e, check "(link[0] & 0x08)". 4481 */ 4482 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 4483 b1 = new_block(cstate, JMP(BPF_JSET)); 4484 b1->s.k = 0x08; 4485 b1->stmts = s; 4486 4487 /* 4488 * AND that with the check for frames other than 4489 * CTS and ACK frames. 4490 */ 4491 gen_and(b1, b2); 4492 4493 /* 4494 * Check addr2. 4495 */ 4496 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4497 gen_and(b2, b1); 4498 return b1; 4499 4500 /* 4501 * XXX - add BSSID keyword? 4502 */ 4503 case Q_ADDR1: 4504 return (gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr)); 4505 4506 case Q_ADDR2: 4507 /* 4508 * Not present in CTS or ACK control frames. 4509 */ 4510 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, 4511 IEEE80211_FC0_TYPE_MASK); 4512 gen_not(b0); 4513 b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS, 4514 IEEE80211_FC0_SUBTYPE_MASK); 4515 gen_not(b1); 4516 b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK, 4517 IEEE80211_FC0_SUBTYPE_MASK); 4518 gen_not(b2); 4519 gen_and(b1, b2); 4520 gen_or(b0, b2); 4521 b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4522 gen_and(b2, b1); 4523 return b1; 4524 4525 case Q_ADDR3: 4526 /* 4527 * Not present in control frames. 4528 */ 4529 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, 4530 IEEE80211_FC0_TYPE_MASK); 4531 gen_not(b0); 4532 b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); 4533 gen_and(b0, b1); 4534 return b1; 4535 4536 case Q_ADDR4: 4537 /* 4538 * Present only if the direction mask has both "From DS" 4539 * and "To DS" set. Neither control frames nor management 4540 * frames should have both of those set, so we don't 4541 * check the frame type. 4542 */ 4543 b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, 4544 IEEE80211_FC1_DIR_DSTODS, IEEE80211_FC1_DIR_MASK); 4545 b1 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr); 4546 gen_and(b0, b1); 4547 return b1; 4548 4549 case Q_AND: 4550 b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); 4551 b1 = gen_wlanhostop(cstate, eaddr, Q_DST); 4552 gen_and(b0, b1); 4553 return b1; 4554 4555 case Q_DEFAULT: 4556 case Q_OR: 4557 b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); 4558 b1 = gen_wlanhostop(cstate, eaddr, Q_DST); 4559 gen_or(b0, b1); 4560 return b1; 4561 } 4562 abort(); 4563 /* NOTREACHED */ 4564 } 4565 4566 /* 4567 * Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel. 4568 * (We assume that the addresses are IEEE 48-bit MAC addresses, 4569 * as the RFC states.) 4570 */ 4571 static struct block * 4572 gen_ipfchostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 4573 { 4574 register struct block *b0, *b1; 4575 4576 switch (dir) { 4577 case Q_SRC: 4578 return gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); 4579 4580 case Q_DST: 4581 return gen_bcmp(cstate, OR_LINKHDR, 2, 6, eaddr); 4582 4583 case Q_AND: 4584 b0 = gen_ipfchostop(cstate, eaddr, Q_SRC); 4585 b1 = gen_ipfchostop(cstate, eaddr, Q_DST); 4586 gen_and(b0, b1); 4587 return b1; 4588 4589 case Q_DEFAULT: 4590 case Q_OR: 4591 b0 = gen_ipfchostop(cstate, eaddr, Q_SRC); 4592 b1 = gen_ipfchostop(cstate, eaddr, Q_DST); 4593 gen_or(b0, b1); 4594 return b1; 4595 4596 case Q_ADDR1: 4597 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 4598 break; 4599 4600 case Q_ADDR2: 4601 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 4602 break; 4603 4604 case Q_ADDR3: 4605 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 4606 break; 4607 4608 case Q_ADDR4: 4609 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 4610 break; 4611 4612 case Q_RA: 4613 bpf_error(cstate, "'ra' is only supported on 802.11"); 4614 break; 4615 4616 case Q_TA: 4617 bpf_error(cstate, "'ta' is only supported on 802.11"); 4618 break; 4619 } 4620 abort(); 4621 /* NOTREACHED */ 4622 } 4623 4624 /* 4625 * This is quite tricky because there may be pad bytes in front of the 4626 * DECNET header, and then there are two possible data packet formats that 4627 * carry both src and dst addresses, plus 5 packet types in a format that 4628 * carries only the src node, plus 2 types that use a different format and 4629 * also carry just the src node. 4630 * 4631 * Yuck. 4632 * 4633 * Instead of doing those all right, we just look for data packets with 4634 * 0 or 1 bytes of padding. If you want to look at other packets, that 4635 * will require a lot more hacking. 4636 * 4637 * To add support for filtering on DECNET "areas" (network numbers) 4638 * one would want to add a "mask" argument to this routine. That would 4639 * make the filter even more inefficient, although one could be clever 4640 * and not generate masking instructions if the mask is 0xFFFF. 4641 */ 4642 static struct block * 4643 gen_dnhostop(compiler_state_t *cstate, bpf_u_int32 addr, int dir) 4644 { 4645 struct block *b0, *b1, *b2, *tmp; 4646 u_int offset_lh; /* offset if long header is received */ 4647 u_int offset_sh; /* offset if short header is received */ 4648 4649 switch (dir) { 4650 4651 case Q_DST: 4652 offset_sh = 1; /* follows flags */ 4653 offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ 4654 break; 4655 4656 case Q_SRC: 4657 offset_sh = 3; /* follows flags, dstnode */ 4658 offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ 4659 break; 4660 4661 case Q_AND: 4662 /* Inefficient because we do our Calvinball dance twice */ 4663 b0 = gen_dnhostop(cstate, addr, Q_SRC); 4664 b1 = gen_dnhostop(cstate, addr, Q_DST); 4665 gen_and(b0, b1); 4666 return b1; 4667 4668 case Q_OR: 4669 case Q_DEFAULT: 4670 /* Inefficient because we do our Calvinball dance twice */ 4671 b0 = gen_dnhostop(cstate, addr, Q_SRC); 4672 b1 = gen_dnhostop(cstate, addr, Q_DST); 4673 gen_or(b0, b1); 4674 return b1; 4675 4676 case Q_ISO: 4677 bpf_error(cstate, "ISO host filtering not implemented"); 4678 4679 default: 4680 abort(); 4681 } 4682 b0 = gen_linktype(cstate, ETHERTYPE_DN); 4683 /* Check for pad = 1, long header case */ 4684 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H, 4685 (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); 4686 b1 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_lh, 4687 BPF_H, (bpf_int32)ntohs((u_short)addr)); 4688 gen_and(tmp, b1); 4689 /* Check for pad = 0, long header case */ 4690 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); 4691 b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_lh, BPF_H, (bpf_int32)ntohs((u_short)addr)); 4692 gen_and(tmp, b2); 4693 gen_or(b2, b1); 4694 /* Check for pad = 1, short header case */ 4695 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H, 4696 (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); 4697 b2 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs((u_short)addr)); 4698 gen_and(tmp, b2); 4699 gen_or(b2, b1); 4700 /* Check for pad = 0, short header case */ 4701 tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); 4702 b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_sh, BPF_H, (bpf_int32)ntohs((u_short)addr)); 4703 gen_and(tmp, b2); 4704 gen_or(b2, b1); 4705 4706 /* Combine with test for cstate->linktype */ 4707 gen_and(b0, b1); 4708 return b1; 4709 } 4710 4711 /* 4712 * Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets; 4713 * test the bottom-of-stack bit, and then check the version number 4714 * field in the IP header. 4715 */ 4716 static struct block * 4717 gen_mpls_linktype(compiler_state_t *cstate, int proto) 4718 { 4719 struct block *b0, *b1; 4720 4721 switch (proto) { 4722 4723 case Q_IP: 4724 /* match the bottom-of-stack bit */ 4725 b0 = gen_mcmp(cstate, OR_LINKPL, (u_int)-2, BPF_B, 0x01, 0x01); 4726 /* match the IPv4 version number */ 4727 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_B, 0x40, 0xf0); 4728 gen_and(b0, b1); 4729 return b1; 4730 4731 case Q_IPV6: 4732 /* match the bottom-of-stack bit */ 4733 b0 = gen_mcmp(cstate, OR_LINKPL, (u_int)-2, BPF_B, 0x01, 0x01); 4734 /* match the IPv4 version number */ 4735 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_B, 0x60, 0xf0); 4736 gen_and(b0, b1); 4737 return b1; 4738 4739 default: 4740 abort(); 4741 } 4742 } 4743 4744 static struct block * 4745 gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, 4746 int proto, int dir, int type) 4747 { 4748 struct block *b0, *b1; 4749 const char *typestr; 4750 4751 if (type == Q_NET) 4752 typestr = "net"; 4753 else 4754 typestr = "host"; 4755 4756 switch (proto) { 4757 4758 case Q_DEFAULT: 4759 b0 = gen_host(cstate, addr, mask, Q_IP, dir, type); 4760 /* 4761 * Only check for non-IPv4 addresses if we're not 4762 * checking MPLS-encapsulated packets. 4763 */ 4764 if (cstate->label_stack_depth == 0) { 4765 b1 = gen_host(cstate, addr, mask, Q_ARP, dir, type); 4766 gen_or(b0, b1); 4767 b0 = gen_host(cstate, addr, mask, Q_RARP, dir, type); 4768 gen_or(b1, b0); 4769 } 4770 return b0; 4771 4772 case Q_IP: 4773 return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_IP, 12, 16); 4774 4775 case Q_RARP: 4776 return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_REVARP, 14, 24); 4777 4778 case Q_ARP: 4779 return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_ARP, 14, 24); 4780 4781 case Q_TCP: 4782 bpf_error(cstate, "'tcp' modifier applied to %s", typestr); 4783 4784 case Q_SCTP: 4785 bpf_error(cstate, "'sctp' modifier applied to %s", typestr); 4786 4787 case Q_UDP: 4788 bpf_error(cstate, "'udp' modifier applied to %s", typestr); 4789 4790 case Q_ICMP: 4791 bpf_error(cstate, "'icmp' modifier applied to %s", typestr); 4792 4793 case Q_IGMP: 4794 bpf_error(cstate, "'igmp' modifier applied to %s", typestr); 4795 4796 case Q_IGRP: 4797 bpf_error(cstate, "'igrp' modifier applied to %s", typestr); 4798 4799 case Q_PIM: 4800 bpf_error(cstate, "'pim' modifier applied to %s", typestr); 4801 4802 case Q_VRRP: 4803 bpf_error(cstate, "'vrrp' modifier applied to %s", typestr); 4804 4805 case Q_CARP: 4806 bpf_error(cstate, "'carp' modifier applied to %s", typestr); 4807 4808 case Q_ATALK: 4809 bpf_error(cstate, "ATALK host filtering not implemented"); 4810 4811 case Q_AARP: 4812 bpf_error(cstate, "AARP host filtering not implemented"); 4813 4814 case Q_DECNET: 4815 return gen_dnhostop(cstate, addr, dir); 4816 4817 case Q_SCA: 4818 bpf_error(cstate, "SCA host filtering not implemented"); 4819 4820 case Q_LAT: 4821 bpf_error(cstate, "LAT host filtering not implemented"); 4822 4823 case Q_MOPDL: 4824 bpf_error(cstate, "MOPDL host filtering not implemented"); 4825 4826 case Q_MOPRC: 4827 bpf_error(cstate, "MOPRC host filtering not implemented"); 4828 4829 case Q_IPV6: 4830 bpf_error(cstate, "'ip6' modifier applied to ip host"); 4831 4832 case Q_ICMPV6: 4833 bpf_error(cstate, "'icmp6' modifier applied to %s", typestr); 4834 4835 case Q_AH: 4836 bpf_error(cstate, "'ah' modifier applied to %s", typestr); 4837 4838 case Q_ESP: 4839 bpf_error(cstate, "'esp' modifier applied to %s", typestr); 4840 4841 case Q_ISO: 4842 bpf_error(cstate, "ISO host filtering not implemented"); 4843 4844 case Q_ESIS: 4845 bpf_error(cstate, "'esis' modifier applied to %s", typestr); 4846 4847 case Q_ISIS: 4848 bpf_error(cstate, "'isis' modifier applied to %s", typestr); 4849 4850 case Q_CLNP: 4851 bpf_error(cstate, "'clnp' modifier applied to %s", typestr); 4852 4853 case Q_STP: 4854 bpf_error(cstate, "'stp' modifier applied to %s", typestr); 4855 4856 case Q_IPX: 4857 bpf_error(cstate, "IPX host filtering not implemented"); 4858 4859 case Q_NETBEUI: 4860 bpf_error(cstate, "'netbeui' modifier applied to %s", typestr); 4861 4862 case Q_RADIO: 4863 bpf_error(cstate, "'radio' modifier applied to %s", typestr); 4864 4865 default: 4866 abort(); 4867 } 4868 /* NOTREACHED */ 4869 } 4870 4871 #ifdef INET6 4872 static struct block * 4873 gen_host6(compiler_state_t *cstate, struct in6_addr *addr, 4874 struct in6_addr *mask, int proto, int dir, int type) 4875 { 4876 const char *typestr; 4877 4878 if (type == Q_NET) 4879 typestr = "net"; 4880 else 4881 typestr = "host"; 4882 4883 switch (proto) { 4884 4885 case Q_DEFAULT: 4886 return gen_host6(cstate, addr, mask, Q_IPV6, dir, type); 4887 4888 case Q_LINK: 4889 bpf_error(cstate, "link-layer modifier applied to ip6 %s", typestr); 4890 4891 case Q_IP: 4892 bpf_error(cstate, "'ip' modifier applied to ip6 %s", typestr); 4893 4894 case Q_RARP: 4895 bpf_error(cstate, "'rarp' modifier applied to ip6 %s", typestr); 4896 4897 case Q_ARP: 4898 bpf_error(cstate, "'arp' modifier applied to ip6 %s", typestr); 4899 4900 case Q_SCTP: 4901 bpf_error(cstate, "'sctp' modifier applied to %s", typestr); 4902 4903 case Q_TCP: 4904 bpf_error(cstate, "'tcp' modifier applied to %s", typestr); 4905 4906 case Q_UDP: 4907 bpf_error(cstate, "'udp' modifier applied to %s", typestr); 4908 4909 case Q_ICMP: 4910 bpf_error(cstate, "'icmp' modifier applied to %s", typestr); 4911 4912 case Q_IGMP: 4913 bpf_error(cstate, "'igmp' modifier applied to %s", typestr); 4914 4915 case Q_IGRP: 4916 bpf_error(cstate, "'igrp' modifier applied to %s", typestr); 4917 4918 case Q_PIM: 4919 bpf_error(cstate, "'pim' modifier applied to %s", typestr); 4920 4921 case Q_VRRP: 4922 bpf_error(cstate, "'vrrp' modifier applied to %s", typestr); 4923 4924 case Q_CARP: 4925 bpf_error(cstate, "'carp' modifier applied to %s", typestr); 4926 4927 case Q_ATALK: 4928 bpf_error(cstate, "ATALK host filtering not implemented"); 4929 4930 case Q_AARP: 4931 bpf_error(cstate, "AARP host filtering not implemented"); 4932 4933 case Q_DECNET: 4934 bpf_error(cstate, "'decnet' modifier applied to ip6 %s", typestr); 4935 4936 case Q_SCA: 4937 bpf_error(cstate, "SCA host filtering not implemented"); 4938 4939 case Q_LAT: 4940 bpf_error(cstate, "LAT host filtering not implemented"); 4941 4942 case Q_MOPDL: 4943 bpf_error(cstate, "MOPDL host filtering not implemented"); 4944 4945 case Q_MOPRC: 4946 bpf_error(cstate, "MOPRC host filtering not implemented"); 4947 4948 case Q_IPV6: 4949 return gen_hostop6(cstate, addr, mask, dir, ETHERTYPE_IPV6, 8, 24); 4950 4951 case Q_ICMPV6: 4952 bpf_error(cstate, "'icmp6' modifier applied to %s", typestr); 4953 4954 case Q_AH: 4955 bpf_error(cstate, "'ah' modifier applied to %s", typestr); 4956 4957 case Q_ESP: 4958 bpf_error(cstate, "'esp' modifier applied to %s", typestr); 4959 4960 case Q_ISO: 4961 bpf_error(cstate, "ISO host filtering not implemented"); 4962 4963 case Q_ESIS: 4964 bpf_error(cstate, "'esis' modifier applied to %s", typestr); 4965 4966 case Q_ISIS: 4967 bpf_error(cstate, "'isis' modifier applied to %s", typestr); 4968 4969 case Q_CLNP: 4970 bpf_error(cstate, "'clnp' modifier applied to %s", typestr); 4971 4972 case Q_STP: 4973 bpf_error(cstate, "'stp' modifier applied to %s", typestr); 4974 4975 case Q_IPX: 4976 bpf_error(cstate, "IPX host filtering not implemented"); 4977 4978 case Q_NETBEUI: 4979 bpf_error(cstate, "'netbeui' modifier applied to %s", typestr); 4980 4981 case Q_RADIO: 4982 bpf_error(cstate, "'radio' modifier applied to %s", typestr); 4983 4984 default: 4985 abort(); 4986 } 4987 /* NOTREACHED */ 4988 } 4989 #endif 4990 4991 #ifndef INET6 4992 static struct block * 4993 gen_gateway(compiler_state_t *cstate, const u_char *eaddr, 4994 struct addrinfo *alist, int proto, int dir) 4995 { 4996 struct block *b0, *b1, *tmp; 4997 struct addrinfo *ai; 4998 struct sockaddr_in *sin; 4999 5000 if (dir != 0) 5001 bpf_error(cstate, "direction applied to 'gateway'"); 5002 5003 switch (proto) { 5004 case Q_DEFAULT: 5005 case Q_IP: 5006 case Q_ARP: 5007 case Q_RARP: 5008 switch (cstate->linktype) { 5009 case DLT_EN10MB: 5010 case DLT_NETANALYZER: 5011 case DLT_NETANALYZER_TRANSPARENT: 5012 b1 = gen_prevlinkhdr_check(cstate); 5013 b0 = gen_ehostop(cstate, eaddr, Q_OR); 5014 if (b1 != NULL) 5015 gen_and(b1, b0); 5016 break; 5017 case DLT_FDDI: 5018 b0 = gen_fhostop(cstate, eaddr, Q_OR); 5019 break; 5020 case DLT_IEEE802: 5021 b0 = gen_thostop(cstate, eaddr, Q_OR); 5022 break; 5023 case DLT_IEEE802_11: 5024 case DLT_PRISM_HEADER: 5025 case DLT_IEEE802_11_RADIO_AVS: 5026 case DLT_IEEE802_11_RADIO: 5027 case DLT_PPI: 5028 b0 = gen_wlanhostop(cstate, eaddr, Q_OR); 5029 break; 5030 case DLT_SUNATM: 5031 /* 5032 * This is LLC-multiplexed traffic; if it were 5033 * LANE, cstate->linktype would have been set to 5034 * DLT_EN10MB. 5035 */ 5036 bpf_error(cstate, 5037 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 5038 break; 5039 case DLT_IP_OVER_FC: 5040 b0 = gen_ipfchostop(cstate, eaddr, Q_OR); 5041 break; 5042 default: 5043 bpf_error(cstate, 5044 "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 5045 } 5046 b1 = NULL; 5047 for (ai = alist; ai != NULL; ai = ai->ai_next) { 5048 /* 5049 * Does it have an address? 5050 */ 5051 if (ai->ai_addr != NULL) { 5052 /* 5053 * Yes. Is it an IPv4 address? 5054 */ 5055 if (ai->ai_addr->sa_family == AF_INET) { 5056 /* 5057 * Generate an entry for it. 5058 */ 5059 sin = (struct sockaddr_in *)ai->ai_addr; 5060 tmp = gen_host(cstate, 5061 ntohl(sin->sin_addr.s_addr), 5062 0xffffffff, proto, Q_OR, Q_HOST); 5063 /* 5064 * Is it the *first* IPv4 address? 5065 */ 5066 if (b1 == NULL) { 5067 /* 5068 * Yes, so start with it. 5069 */ 5070 b1 = tmp; 5071 } else { 5072 /* 5073 * No, so OR it into the 5074 * existing set of 5075 * addresses. 5076 */ 5077 gen_or(b1, tmp); 5078 b1 = tmp; 5079 } 5080 } 5081 } 5082 } 5083 if (b1 == NULL) { 5084 /* 5085 * No IPv4 addresses found. 5086 */ 5087 return (NULL); 5088 } 5089 gen_not(b1); 5090 gen_and(b0, b1); 5091 return b1; 5092 } 5093 bpf_error(cstate, "illegal modifier of 'gateway'"); 5094 /* NOTREACHED */ 5095 } 5096 #endif 5097 5098 struct block * 5099 gen_proto_abbrev(compiler_state_t *cstate, int proto) 5100 { 5101 struct block *b0; 5102 struct block *b1; 5103 5104 switch (proto) { 5105 5106 case Q_SCTP: 5107 b1 = gen_proto(cstate, IPPROTO_SCTP, Q_IP, Q_DEFAULT); 5108 b0 = gen_proto(cstate, IPPROTO_SCTP, Q_IPV6, Q_DEFAULT); 5109 gen_or(b0, b1); 5110 break; 5111 5112 case Q_TCP: 5113 b1 = gen_proto(cstate, IPPROTO_TCP, Q_IP, Q_DEFAULT); 5114 b0 = gen_proto(cstate, IPPROTO_TCP, Q_IPV6, Q_DEFAULT); 5115 gen_or(b0, b1); 5116 break; 5117 5118 case Q_UDP: 5119 b1 = gen_proto(cstate, IPPROTO_UDP, Q_IP, Q_DEFAULT); 5120 b0 = gen_proto(cstate, IPPROTO_UDP, Q_IPV6, Q_DEFAULT); 5121 gen_or(b0, b1); 5122 break; 5123 5124 case Q_ICMP: 5125 b1 = gen_proto(cstate, IPPROTO_ICMP, Q_IP, Q_DEFAULT); 5126 break; 5127 5128 #ifndef IPPROTO_IGMP 5129 #define IPPROTO_IGMP 2 5130 #endif 5131 5132 case Q_IGMP: 5133 b1 = gen_proto(cstate, IPPROTO_IGMP, Q_IP, Q_DEFAULT); 5134 break; 5135 5136 #ifndef IPPROTO_IGRP 5137 #define IPPROTO_IGRP 9 5138 #endif 5139 case Q_IGRP: 5140 b1 = gen_proto(cstate, IPPROTO_IGRP, Q_IP, Q_DEFAULT); 5141 break; 5142 5143 #ifndef IPPROTO_PIM 5144 #define IPPROTO_PIM 103 5145 #endif 5146 5147 case Q_PIM: 5148 b1 = gen_proto(cstate, IPPROTO_PIM, Q_IP, Q_DEFAULT); 5149 b0 = gen_proto(cstate, IPPROTO_PIM, Q_IPV6, Q_DEFAULT); 5150 gen_or(b0, b1); 5151 break; 5152 5153 #ifndef IPPROTO_VRRP 5154 #define IPPROTO_VRRP 112 5155 #endif 5156 5157 case Q_VRRP: 5158 b1 = gen_proto(cstate, IPPROTO_VRRP, Q_IP, Q_DEFAULT); 5159 break; 5160 5161 #ifndef IPPROTO_CARP 5162 #define IPPROTO_CARP 112 5163 #endif 5164 5165 case Q_CARP: 5166 b1 = gen_proto(cstate, IPPROTO_CARP, Q_IP, Q_DEFAULT); 5167 break; 5168 5169 case Q_IP: 5170 b1 = gen_linktype(cstate, ETHERTYPE_IP); 5171 break; 5172 5173 case Q_ARP: 5174 b1 = gen_linktype(cstate, ETHERTYPE_ARP); 5175 break; 5176 5177 case Q_RARP: 5178 b1 = gen_linktype(cstate, ETHERTYPE_REVARP); 5179 break; 5180 5181 case Q_LINK: 5182 bpf_error(cstate, "link layer applied in wrong context"); 5183 5184 case Q_ATALK: 5185 b1 = gen_linktype(cstate, ETHERTYPE_ATALK); 5186 break; 5187 5188 case Q_AARP: 5189 b1 = gen_linktype(cstate, ETHERTYPE_AARP); 5190 break; 5191 5192 case Q_DECNET: 5193 b1 = gen_linktype(cstate, ETHERTYPE_DN); 5194 break; 5195 5196 case Q_SCA: 5197 b1 = gen_linktype(cstate, ETHERTYPE_SCA); 5198 break; 5199 5200 case Q_LAT: 5201 b1 = gen_linktype(cstate, ETHERTYPE_LAT); 5202 break; 5203 5204 case Q_MOPDL: 5205 b1 = gen_linktype(cstate, ETHERTYPE_MOPDL); 5206 break; 5207 5208 case Q_MOPRC: 5209 b1 = gen_linktype(cstate, ETHERTYPE_MOPRC); 5210 break; 5211 5212 case Q_IPV6: 5213 b1 = gen_linktype(cstate, ETHERTYPE_IPV6); 5214 break; 5215 5216 #ifndef IPPROTO_ICMPV6 5217 #define IPPROTO_ICMPV6 58 5218 #endif 5219 case Q_ICMPV6: 5220 b1 = gen_proto(cstate, IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT); 5221 break; 5222 5223 #ifndef IPPROTO_AH 5224 #define IPPROTO_AH 51 5225 #endif 5226 case Q_AH: 5227 b1 = gen_proto(cstate, IPPROTO_AH, Q_IP, Q_DEFAULT); 5228 b0 = gen_proto(cstate, IPPROTO_AH, Q_IPV6, Q_DEFAULT); 5229 gen_or(b0, b1); 5230 break; 5231 5232 #ifndef IPPROTO_ESP 5233 #define IPPROTO_ESP 50 5234 #endif 5235 case Q_ESP: 5236 b1 = gen_proto(cstate, IPPROTO_ESP, Q_IP, Q_DEFAULT); 5237 b0 = gen_proto(cstate, IPPROTO_ESP, Q_IPV6, Q_DEFAULT); 5238 gen_or(b0, b1); 5239 break; 5240 5241 case Q_ISO: 5242 b1 = gen_linktype(cstate, LLCSAP_ISONS); 5243 break; 5244 5245 case Q_ESIS: 5246 b1 = gen_proto(cstate, ISO9542_ESIS, Q_ISO, Q_DEFAULT); 5247 break; 5248 5249 case Q_ISIS: 5250 b1 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT); 5251 break; 5252 5253 case Q_ISIS_L1: /* all IS-IS Level1 PDU-Types */ 5254 b0 = gen_proto(cstate, ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 5255 b1 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 5256 gen_or(b0, b1); 5257 b0 = gen_proto(cstate, ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 5258 gen_or(b0, b1); 5259 b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 5260 gen_or(b0, b1); 5261 b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 5262 gen_or(b0, b1); 5263 break; 5264 5265 case Q_ISIS_L2: /* all IS-IS Level2 PDU-Types */ 5266 b0 = gen_proto(cstate, ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 5267 b1 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */ 5268 gen_or(b0, b1); 5269 b0 = gen_proto(cstate, ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 5270 gen_or(b0, b1); 5271 b0 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 5272 gen_or(b0, b1); 5273 b0 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 5274 gen_or(b0, b1); 5275 break; 5276 5277 case Q_ISIS_IIH: /* all IS-IS Hello PDU-Types */ 5278 b0 = gen_proto(cstate, ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT); 5279 b1 = gen_proto(cstate, ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT); 5280 gen_or(b0, b1); 5281 b0 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); 5282 gen_or(b0, b1); 5283 break; 5284 5285 case Q_ISIS_LSP: 5286 b0 = gen_proto(cstate, ISIS_L1_LSP, Q_ISIS, Q_DEFAULT); 5287 b1 = gen_proto(cstate, ISIS_L2_LSP, Q_ISIS, Q_DEFAULT); 5288 gen_or(b0, b1); 5289 break; 5290 5291 case Q_ISIS_SNP: 5292 b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 5293 b1 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 5294 gen_or(b0, b1); 5295 b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 5296 gen_or(b0, b1); 5297 b0 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 5298 gen_or(b0, b1); 5299 break; 5300 5301 case Q_ISIS_CSNP: 5302 b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT); 5303 b1 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT); 5304 gen_or(b0, b1); 5305 break; 5306 5307 case Q_ISIS_PSNP: 5308 b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT); 5309 b1 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT); 5310 gen_or(b0, b1); 5311 break; 5312 5313 case Q_CLNP: 5314 b1 = gen_proto(cstate, ISO8473_CLNP, Q_ISO, Q_DEFAULT); 5315 break; 5316 5317 case Q_STP: 5318 b1 = gen_linktype(cstate, LLCSAP_8021D); 5319 break; 5320 5321 case Q_IPX: 5322 b1 = gen_linktype(cstate, LLCSAP_IPX); 5323 break; 5324 5325 case Q_NETBEUI: 5326 b1 = gen_linktype(cstate, LLCSAP_NETBEUI); 5327 break; 5328 5329 case Q_RADIO: 5330 bpf_error(cstate, "'radio' is not a valid protocol type"); 5331 5332 default: 5333 abort(); 5334 } 5335 return b1; 5336 } 5337 5338 static struct block * 5339 gen_ipfrag(compiler_state_t *cstate) 5340 { 5341 struct slist *s; 5342 struct block *b; 5343 5344 /* not IPv4 frag other than the first frag */ 5345 s = gen_load_a(cstate, OR_LINKPL, 6, BPF_H); 5346 b = new_block(cstate, JMP(BPF_JSET)); 5347 b->s.k = 0x1fff; 5348 b->stmts = s; 5349 gen_not(b); 5350 5351 return b; 5352 } 5353 5354 /* 5355 * Generate a comparison to a port value in the transport-layer header 5356 * at the specified offset from the beginning of that header. 5357 * 5358 * XXX - this handles a variable-length prefix preceding the link-layer 5359 * header, such as the radiotap or AVS radio prefix, but doesn't handle 5360 * variable-length link-layer headers (such as Token Ring or 802.11 5361 * headers). 5362 */ 5363 static struct block * 5364 gen_portatom(compiler_state_t *cstate, int off, bpf_int32 v) 5365 { 5366 return gen_cmp(cstate, OR_TRAN_IPV4, off, BPF_H, v); 5367 } 5368 5369 static struct block * 5370 gen_portatom6(compiler_state_t *cstate, int off, bpf_int32 v) 5371 { 5372 return gen_cmp(cstate, OR_TRAN_IPV6, off, BPF_H, v); 5373 } 5374 5375 struct block * 5376 gen_portop(compiler_state_t *cstate, int port, int proto, int dir) 5377 { 5378 struct block *b0, *b1, *tmp; 5379 5380 /* ip proto 'proto' and not a fragment other than the first fragment */ 5381 tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)proto); 5382 b0 = gen_ipfrag(cstate); 5383 gen_and(tmp, b0); 5384 5385 switch (dir) { 5386 case Q_SRC: 5387 b1 = gen_portatom(cstate, 0, (bpf_int32)port); 5388 break; 5389 5390 case Q_DST: 5391 b1 = gen_portatom(cstate, 2, (bpf_int32)port); 5392 break; 5393 5394 case Q_OR: 5395 case Q_DEFAULT: 5396 tmp = gen_portatom(cstate, 0, (bpf_int32)port); 5397 b1 = gen_portatom(cstate, 2, (bpf_int32)port); 5398 gen_or(tmp, b1); 5399 break; 5400 5401 case Q_AND: 5402 tmp = gen_portatom(cstate, 0, (bpf_int32)port); 5403 b1 = gen_portatom(cstate, 2, (bpf_int32)port); 5404 gen_and(tmp, b1); 5405 break; 5406 5407 default: 5408 abort(); 5409 } 5410 gen_and(b0, b1); 5411 5412 return b1; 5413 } 5414 5415 static struct block * 5416 gen_port(compiler_state_t *cstate, int port, int ip_proto, int dir) 5417 { 5418 struct block *b0, *b1, *tmp; 5419 5420 /* 5421 * ether proto ip 5422 * 5423 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 5424 * not LLC encapsulation with LLCSAP_IP. 5425 * 5426 * For IEEE 802 networks - which includes 802.5 token ring 5427 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 5428 * says that SNAP encapsulation is used, not LLC encapsulation 5429 * with LLCSAP_IP. 5430 * 5431 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 5432 * RFC 2225 say that SNAP encapsulation is used, not LLC 5433 * encapsulation with LLCSAP_IP. 5434 * 5435 * So we always check for ETHERTYPE_IP. 5436 */ 5437 b0 = gen_linktype(cstate, ETHERTYPE_IP); 5438 5439 switch (ip_proto) { 5440 case IPPROTO_UDP: 5441 case IPPROTO_TCP: 5442 case IPPROTO_SCTP: 5443 b1 = gen_portop(cstate, port, ip_proto, dir); 5444 break; 5445 5446 case PROTO_UNDEF: 5447 tmp = gen_portop(cstate, port, IPPROTO_TCP, dir); 5448 b1 = gen_portop(cstate, port, IPPROTO_UDP, dir); 5449 gen_or(tmp, b1); 5450 tmp = gen_portop(cstate, port, IPPROTO_SCTP, dir); 5451 gen_or(tmp, b1); 5452 break; 5453 5454 default: 5455 abort(); 5456 } 5457 gen_and(b0, b1); 5458 return b1; 5459 } 5460 5461 struct block * 5462 gen_portop6(compiler_state_t *cstate, int port, int proto, int dir) 5463 { 5464 struct block *b0, *b1, *tmp; 5465 5466 /* ip6 proto 'proto' */ 5467 /* XXX - catch the first fragment of a fragmented packet? */ 5468 b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)proto); 5469 5470 switch (dir) { 5471 case Q_SRC: 5472 b1 = gen_portatom6(cstate, 0, (bpf_int32)port); 5473 break; 5474 5475 case Q_DST: 5476 b1 = gen_portatom6(cstate, 2, (bpf_int32)port); 5477 break; 5478 5479 case Q_OR: 5480 case Q_DEFAULT: 5481 tmp = gen_portatom6(cstate, 0, (bpf_int32)port); 5482 b1 = gen_portatom6(cstate, 2, (bpf_int32)port); 5483 gen_or(tmp, b1); 5484 break; 5485 5486 case Q_AND: 5487 tmp = gen_portatom6(cstate, 0, (bpf_int32)port); 5488 b1 = gen_portatom6(cstate, 2, (bpf_int32)port); 5489 gen_and(tmp, b1); 5490 break; 5491 5492 default: 5493 abort(); 5494 } 5495 gen_and(b0, b1); 5496 5497 return b1; 5498 } 5499 5500 static struct block * 5501 gen_port6(compiler_state_t *cstate, int port, int ip_proto, int dir) 5502 { 5503 struct block *b0, *b1, *tmp; 5504 5505 /* link proto ip6 */ 5506 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 5507 5508 switch (ip_proto) { 5509 case IPPROTO_UDP: 5510 case IPPROTO_TCP: 5511 case IPPROTO_SCTP: 5512 b1 = gen_portop6(cstate, port, ip_proto, dir); 5513 break; 5514 5515 case PROTO_UNDEF: 5516 tmp = gen_portop6(cstate, port, IPPROTO_TCP, dir); 5517 b1 = gen_portop6(cstate, port, IPPROTO_UDP, dir); 5518 gen_or(tmp, b1); 5519 tmp = gen_portop6(cstate, port, IPPROTO_SCTP, dir); 5520 gen_or(tmp, b1); 5521 break; 5522 5523 default: 5524 abort(); 5525 } 5526 gen_and(b0, b1); 5527 return b1; 5528 } 5529 5530 /* gen_portrange code */ 5531 static struct block * 5532 gen_portrangeatom(compiler_state_t *cstate, int off, bpf_int32 v1, 5533 bpf_int32 v2) 5534 { 5535 struct block *b1, *b2; 5536 5537 if (v1 > v2) { 5538 /* 5539 * Reverse the order of the ports, so v1 is the lower one. 5540 */ 5541 bpf_int32 vtemp; 5542 5543 vtemp = v1; 5544 v1 = v2; 5545 v2 = vtemp; 5546 } 5547 5548 b1 = gen_cmp_ge(cstate, OR_TRAN_IPV4, off, BPF_H, v1); 5549 b2 = gen_cmp_le(cstate, OR_TRAN_IPV4, off, BPF_H, v2); 5550 5551 gen_and(b1, b2); 5552 5553 return b2; 5554 } 5555 5556 struct block * 5557 gen_portrangeop(compiler_state_t *cstate, int port1, int port2, int proto, 5558 int dir) 5559 { 5560 struct block *b0, *b1, *tmp; 5561 5562 /* ip proto 'proto' and not a fragment other than the first fragment */ 5563 tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)proto); 5564 b0 = gen_ipfrag(cstate); 5565 gen_and(tmp, b0); 5566 5567 switch (dir) { 5568 case Q_SRC: 5569 b1 = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); 5570 break; 5571 5572 case Q_DST: 5573 b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); 5574 break; 5575 5576 case Q_OR: 5577 case Q_DEFAULT: 5578 tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); 5579 b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); 5580 gen_or(tmp, b1); 5581 break; 5582 5583 case Q_AND: 5584 tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); 5585 b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); 5586 gen_and(tmp, b1); 5587 break; 5588 5589 default: 5590 abort(); 5591 } 5592 gen_and(b0, b1); 5593 5594 return b1; 5595 } 5596 5597 static struct block * 5598 gen_portrange(compiler_state_t *cstate, int port1, int port2, int ip_proto, 5599 int dir) 5600 { 5601 struct block *b0, *b1, *tmp; 5602 5603 /* link proto ip */ 5604 b0 = gen_linktype(cstate, ETHERTYPE_IP); 5605 5606 switch (ip_proto) { 5607 case IPPROTO_UDP: 5608 case IPPROTO_TCP: 5609 case IPPROTO_SCTP: 5610 b1 = gen_portrangeop(cstate, port1, port2, ip_proto, dir); 5611 break; 5612 5613 case PROTO_UNDEF: 5614 tmp = gen_portrangeop(cstate, port1, port2, IPPROTO_TCP, dir); 5615 b1 = gen_portrangeop(cstate, port1, port2, IPPROTO_UDP, dir); 5616 gen_or(tmp, b1); 5617 tmp = gen_portrangeop(cstate, port1, port2, IPPROTO_SCTP, dir); 5618 gen_or(tmp, b1); 5619 break; 5620 5621 default: 5622 abort(); 5623 } 5624 gen_and(b0, b1); 5625 return b1; 5626 } 5627 5628 static struct block * 5629 gen_portrangeatom6(compiler_state_t *cstate, int off, bpf_int32 v1, 5630 bpf_int32 v2) 5631 { 5632 struct block *b1, *b2; 5633 5634 if (v1 > v2) { 5635 /* 5636 * Reverse the order of the ports, so v1 is the lower one. 5637 */ 5638 bpf_int32 vtemp; 5639 5640 vtemp = v1; 5641 v1 = v2; 5642 v2 = vtemp; 5643 } 5644 5645 b1 = gen_cmp_ge(cstate, OR_TRAN_IPV6, off, BPF_H, v1); 5646 b2 = gen_cmp_le(cstate, OR_TRAN_IPV6, off, BPF_H, v2); 5647 5648 gen_and(b1, b2); 5649 5650 return b2; 5651 } 5652 5653 struct block * 5654 gen_portrangeop6(compiler_state_t *cstate, int port1, int port2, int proto, 5655 int dir) 5656 { 5657 struct block *b0, *b1, *tmp; 5658 5659 /* ip6 proto 'proto' */ 5660 /* XXX - catch the first fragment of a fragmented packet? */ 5661 b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)proto); 5662 5663 switch (dir) { 5664 case Q_SRC: 5665 b1 = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); 5666 break; 5667 5668 case Q_DST: 5669 b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); 5670 break; 5671 5672 case Q_OR: 5673 case Q_DEFAULT: 5674 tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); 5675 b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); 5676 gen_or(tmp, b1); 5677 break; 5678 5679 case Q_AND: 5680 tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); 5681 b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); 5682 gen_and(tmp, b1); 5683 break; 5684 5685 default: 5686 abort(); 5687 } 5688 gen_and(b0, b1); 5689 5690 return b1; 5691 } 5692 5693 static struct block * 5694 gen_portrange6(compiler_state_t *cstate, int port1, int port2, int ip_proto, 5695 int dir) 5696 { 5697 struct block *b0, *b1, *tmp; 5698 5699 /* link proto ip6 */ 5700 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 5701 5702 switch (ip_proto) { 5703 case IPPROTO_UDP: 5704 case IPPROTO_TCP: 5705 case IPPROTO_SCTP: 5706 b1 = gen_portrangeop6(cstate, port1, port2, ip_proto, dir); 5707 break; 5708 5709 case PROTO_UNDEF: 5710 tmp = gen_portrangeop6(cstate, port1, port2, IPPROTO_TCP, dir); 5711 b1 = gen_portrangeop6(cstate, port1, port2, IPPROTO_UDP, dir); 5712 gen_or(tmp, b1); 5713 tmp = gen_portrangeop6(cstate, port1, port2, IPPROTO_SCTP, dir); 5714 gen_or(tmp, b1); 5715 break; 5716 5717 default: 5718 abort(); 5719 } 5720 gen_and(b0, b1); 5721 return b1; 5722 } 5723 5724 static int 5725 lookup_proto(compiler_state_t *cstate, const char *name, int proto) 5726 { 5727 register int v; 5728 5729 switch (proto) { 5730 5731 case Q_DEFAULT: 5732 case Q_IP: 5733 case Q_IPV6: 5734 v = pcap_nametoproto(name); 5735 if (v == PROTO_UNDEF) 5736 bpf_error(cstate, "unknown ip proto '%s'", name); 5737 break; 5738 5739 case Q_LINK: 5740 /* XXX should look up h/w protocol type based on cstate->linktype */ 5741 v = pcap_nametoeproto(name); 5742 if (v == PROTO_UNDEF) { 5743 v = pcap_nametollc(name); 5744 if (v == PROTO_UNDEF) 5745 bpf_error(cstate, "unknown ether proto '%s'", name); 5746 } 5747 break; 5748 5749 case Q_ISO: 5750 if (strcmp(name, "esis") == 0) 5751 v = ISO9542_ESIS; 5752 else if (strcmp(name, "isis") == 0) 5753 v = ISO10589_ISIS; 5754 else if (strcmp(name, "clnp") == 0) 5755 v = ISO8473_CLNP; 5756 else 5757 bpf_error(cstate, "unknown osi proto '%s'", name); 5758 break; 5759 5760 default: 5761 v = PROTO_UNDEF; 5762 break; 5763 } 5764 return v; 5765 } 5766 5767 #if 0 5768 struct stmt * 5769 gen_joinsp(struct stmt **s, int n) 5770 { 5771 return NULL; 5772 } 5773 #endif 5774 5775 static struct block * 5776 gen_protochain(compiler_state_t *cstate, int v, int proto, int dir) 5777 { 5778 #ifdef NO_PROTOCHAIN 5779 return gen_proto(cstate, v, proto, dir); 5780 #else 5781 struct block *b0, *b; 5782 struct slist *s[100]; 5783 int fix2, fix3, fix4, fix5; 5784 int ahcheck, again, end; 5785 int i, max; 5786 int reg2 = alloc_reg(cstate); 5787 5788 memset(s, 0, sizeof(s)); 5789 fix3 = fix4 = fix5 = 0; 5790 5791 switch (proto) { 5792 case Q_IP: 5793 case Q_IPV6: 5794 break; 5795 case Q_DEFAULT: 5796 b0 = gen_protochain(cstate, v, Q_IP, dir); 5797 b = gen_protochain(cstate, v, Q_IPV6, dir); 5798 gen_or(b0, b); 5799 return b; 5800 default: 5801 bpf_error(cstate, "bad protocol applied for 'protochain'"); 5802 /*NOTREACHED*/ 5803 } 5804 5805 /* 5806 * We don't handle variable-length prefixes before the link-layer 5807 * header, or variable-length link-layer headers, here yet. 5808 * We might want to add BPF instructions to do the protochain 5809 * work, to simplify that and, on platforms that have a BPF 5810 * interpreter with the new instructions, let the filtering 5811 * be done in the kernel. (We already require a modified BPF 5812 * engine to do the protochain stuff, to support backward 5813 * branches, and backward branch support is unlikely to appear 5814 * in kernel BPF engines.) 5815 */ 5816 if (cstate->off_linkpl.is_variable) 5817 bpf_error(cstate, "'protochain' not supported with variable length headers"); 5818 5819 cstate->no_optimize = 1; /* this code is not compatible with optimizer yet */ 5820 5821 /* 5822 * s[0] is a dummy entry to protect other BPF insn from damage 5823 * by s[fix] = foo with uninitialized variable "fix". It is somewhat 5824 * hard to find interdependency made by jump table fixup. 5825 */ 5826 i = 0; 5827 s[i] = new_stmt(cstate, 0); /*dummy*/ 5828 i++; 5829 5830 switch (proto) { 5831 case Q_IP: 5832 b0 = gen_linktype(cstate, ETHERTYPE_IP); 5833 5834 /* A = ip->ip_p */ 5835 s[i] = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 5836 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 9; 5837 i++; 5838 /* X = ip->ip_hl << 2 */ 5839 s[i] = new_stmt(cstate, BPF_LDX|BPF_MSH|BPF_B); 5840 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 5841 i++; 5842 break; 5843 5844 case Q_IPV6: 5845 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 5846 5847 /* A = ip6->ip_nxt */ 5848 s[i] = new_stmt(cstate, BPF_LD|BPF_ABS|BPF_B); 5849 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 6; 5850 i++; 5851 /* X = sizeof(struct ip6_hdr) */ 5852 s[i] = new_stmt(cstate, BPF_LDX|BPF_IMM); 5853 s[i]->s.k = 40; 5854 i++; 5855 break; 5856 5857 default: 5858 bpf_error(cstate, "unsupported proto to gen_protochain"); 5859 /*NOTREACHED*/ 5860 } 5861 5862 /* again: if (A == v) goto end; else fall through; */ 5863 again = i; 5864 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5865 s[i]->s.k = v; 5866 s[i]->s.jt = NULL; /*later*/ 5867 s[i]->s.jf = NULL; /*update in next stmt*/ 5868 fix5 = i; 5869 i++; 5870 5871 #ifndef IPPROTO_NONE 5872 #define IPPROTO_NONE 59 5873 #endif 5874 /* if (A == IPPROTO_NONE) goto end */ 5875 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5876 s[i]->s.jt = NULL; /*later*/ 5877 s[i]->s.jf = NULL; /*update in next stmt*/ 5878 s[i]->s.k = IPPROTO_NONE; 5879 s[fix5]->s.jf = s[i]; 5880 fix2 = i; 5881 i++; 5882 5883 if (proto == Q_IPV6) { 5884 int v6start, v6end, v6advance, j; 5885 5886 v6start = i; 5887 /* if (A == IPPROTO_HOPOPTS) goto v6advance */ 5888 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5889 s[i]->s.jt = NULL; /*later*/ 5890 s[i]->s.jf = NULL; /*update in next stmt*/ 5891 s[i]->s.k = IPPROTO_HOPOPTS; 5892 s[fix2]->s.jf = s[i]; 5893 i++; 5894 /* if (A == IPPROTO_DSTOPTS) goto v6advance */ 5895 s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5896 s[i]->s.jt = NULL; /*later*/ 5897 s[i]->s.jf = NULL; /*update in next stmt*/ 5898 s[i]->s.k = IPPROTO_DSTOPTS; 5899 i++; 5900 /* if (A == IPPROTO_ROUTING) goto v6advance */ 5901 s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5902 s[i]->s.jt = NULL; /*later*/ 5903 s[i]->s.jf = NULL; /*update in next stmt*/ 5904 s[i]->s.k = IPPROTO_ROUTING; 5905 i++; 5906 /* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */ 5907 s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5908 s[i]->s.jt = NULL; /*later*/ 5909 s[i]->s.jf = NULL; /*later*/ 5910 s[i]->s.k = IPPROTO_FRAGMENT; 5911 fix3 = i; 5912 v6end = i; 5913 i++; 5914 5915 /* v6advance: */ 5916 v6advance = i; 5917 5918 /* 5919 * in short, 5920 * A = P[X + packet head]; 5921 * X = X + (P[X + packet head + 1] + 1) * 8; 5922 */ 5923 /* A = P[X + packet head] */ 5924 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 5925 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 5926 i++; 5927 /* MEM[reg2] = A */ 5928 s[i] = new_stmt(cstate, BPF_ST); 5929 s[i]->s.k = reg2; 5930 i++; 5931 /* A = P[X + packet head + 1]; */ 5932 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 5933 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 1; 5934 i++; 5935 /* A += 1 */ 5936 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 5937 s[i]->s.k = 1; 5938 i++; 5939 /* A *= 8 */ 5940 s[i] = new_stmt(cstate, BPF_ALU|BPF_MUL|BPF_K); 5941 s[i]->s.k = 8; 5942 i++; 5943 /* A += X */ 5944 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X); 5945 s[i]->s.k = 0; 5946 i++; 5947 /* X = A; */ 5948 s[i] = new_stmt(cstate, BPF_MISC|BPF_TAX); 5949 i++; 5950 /* A = MEM[reg2] */ 5951 s[i] = new_stmt(cstate, BPF_LD|BPF_MEM); 5952 s[i]->s.k = reg2; 5953 i++; 5954 5955 /* goto again; (must use BPF_JA for backward jump) */ 5956 s[i] = new_stmt(cstate, BPF_JMP|BPF_JA); 5957 s[i]->s.k = again - i - 1; 5958 s[i - 1]->s.jf = s[i]; 5959 i++; 5960 5961 /* fixup */ 5962 for (j = v6start; j <= v6end; j++) 5963 s[j]->s.jt = s[v6advance]; 5964 } else { 5965 /* nop */ 5966 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 5967 s[i]->s.k = 0; 5968 s[fix2]->s.jf = s[i]; 5969 i++; 5970 } 5971 5972 /* ahcheck: */ 5973 ahcheck = i; 5974 /* if (A == IPPROTO_AH) then fall through; else goto end; */ 5975 s[i] = new_stmt(cstate, BPF_JMP|BPF_JEQ|BPF_K); 5976 s[i]->s.jt = NULL; /*later*/ 5977 s[i]->s.jf = NULL; /*later*/ 5978 s[i]->s.k = IPPROTO_AH; 5979 if (fix3) 5980 s[fix3]->s.jf = s[ahcheck]; 5981 fix4 = i; 5982 i++; 5983 5984 /* 5985 * in short, 5986 * A = P[X]; 5987 * X = X + (P[X + 1] + 2) * 4; 5988 */ 5989 /* A = X */ 5990 s[i - 1]->s.jt = s[i] = new_stmt(cstate, BPF_MISC|BPF_TXA); 5991 i++; 5992 /* A = P[X + packet head]; */ 5993 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 5994 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 5995 i++; 5996 /* MEM[reg2] = A */ 5997 s[i] = new_stmt(cstate, BPF_ST); 5998 s[i]->s.k = reg2; 5999 i++; 6000 /* A = X */ 6001 s[i - 1]->s.jt = s[i] = new_stmt(cstate, BPF_MISC|BPF_TXA); 6002 i++; 6003 /* A += 1 */ 6004 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6005 s[i]->s.k = 1; 6006 i++; 6007 /* X = A */ 6008 s[i] = new_stmt(cstate, BPF_MISC|BPF_TAX); 6009 i++; 6010 /* A = P[X + packet head] */ 6011 s[i] = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 6012 s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 6013 i++; 6014 /* A += 2 */ 6015 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6016 s[i]->s.k = 2; 6017 i++; 6018 /* A *= 4 */ 6019 s[i] = new_stmt(cstate, BPF_ALU|BPF_MUL|BPF_K); 6020 s[i]->s.k = 4; 6021 i++; 6022 /* X = A; */ 6023 s[i] = new_stmt(cstate, BPF_MISC|BPF_TAX); 6024 i++; 6025 /* A = MEM[reg2] */ 6026 s[i] = new_stmt(cstate, BPF_LD|BPF_MEM); 6027 s[i]->s.k = reg2; 6028 i++; 6029 6030 /* goto again; (must use BPF_JA for backward jump) */ 6031 s[i] = new_stmt(cstate, BPF_JMP|BPF_JA); 6032 s[i]->s.k = again - i - 1; 6033 i++; 6034 6035 /* end: nop */ 6036 end = i; 6037 s[i] = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 6038 s[i]->s.k = 0; 6039 s[fix2]->s.jt = s[end]; 6040 s[fix4]->s.jf = s[end]; 6041 s[fix5]->s.jt = s[end]; 6042 i++; 6043 6044 /* 6045 * make slist chain 6046 */ 6047 max = i; 6048 for (i = 0; i < max - 1; i++) 6049 s[i]->next = s[i + 1]; 6050 s[max - 1]->next = NULL; 6051 6052 /* 6053 * emit final check 6054 */ 6055 b = new_block(cstate, JMP(BPF_JEQ)); 6056 b->stmts = s[1]; /*remember, s[0] is dummy*/ 6057 b->s.k = v; 6058 6059 free_reg(cstate, reg2); 6060 6061 gen_and(b0, b); 6062 return b; 6063 #endif 6064 } 6065 6066 static struct block * 6067 gen_check_802_11_data_frame(compiler_state_t *cstate) 6068 { 6069 struct slist *s; 6070 struct block *b0, *b1; 6071 6072 /* 6073 * A data frame has the 0x08 bit (b3) in the frame control field set 6074 * and the 0x04 bit (b2) clear. 6075 */ 6076 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 6077 b0 = new_block(cstate, JMP(BPF_JSET)); 6078 b0->s.k = 0x08; 6079 b0->stmts = s; 6080 6081 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 6082 b1 = new_block(cstate, JMP(BPF_JSET)); 6083 b1->s.k = 0x04; 6084 b1->stmts = s; 6085 gen_not(b1); 6086 6087 gen_and(b1, b0); 6088 6089 return b0; 6090 } 6091 6092 /* 6093 * Generate code that checks whether the packet is a packet for protocol 6094 * <proto> and whether the type field in that protocol's header has 6095 * the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an 6096 * IP packet and checks the protocol number in the IP header against <v>. 6097 * 6098 * If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks 6099 * against Q_IP and Q_IPV6. 6100 */ 6101 static struct block * 6102 gen_proto(compiler_state_t *cstate, int v, int proto, int dir) 6103 { 6104 struct block *b0, *b1; 6105 #ifndef CHASE_CHAIN 6106 struct block *b2; 6107 #endif 6108 6109 if (dir != Q_DEFAULT) 6110 bpf_error(cstate, "direction applied to 'proto'"); 6111 6112 switch (proto) { 6113 case Q_DEFAULT: 6114 b0 = gen_proto(cstate, v, Q_IP, dir); 6115 b1 = gen_proto(cstate, v, Q_IPV6, dir); 6116 gen_or(b0, b1); 6117 return b1; 6118 6119 case Q_IP: 6120 /* 6121 * For FDDI, RFC 1188 says that SNAP encapsulation is used, 6122 * not LLC encapsulation with LLCSAP_IP. 6123 * 6124 * For IEEE 802 networks - which includes 802.5 token ring 6125 * (which is what DLT_IEEE802 means) and 802.11 - RFC 1042 6126 * says that SNAP encapsulation is used, not LLC encapsulation 6127 * with LLCSAP_IP. 6128 * 6129 * For LLC-encapsulated ATM/"Classical IP", RFC 1483 and 6130 * RFC 2225 say that SNAP encapsulation is used, not LLC 6131 * encapsulation with LLCSAP_IP. 6132 * 6133 * So we always check for ETHERTYPE_IP. 6134 */ 6135 b0 = gen_linktype(cstate, ETHERTYPE_IP); 6136 #ifndef CHASE_CHAIN 6137 b1 = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)v); 6138 #else 6139 b1 = gen_protochain(cstate, v, Q_IP); 6140 #endif 6141 gen_and(b0, b1); 6142 return b1; 6143 6144 case Q_ISO: 6145 switch (cstate->linktype) { 6146 6147 case DLT_FRELAY: 6148 /* 6149 * Frame Relay packets typically have an OSI 6150 * NLPID at the beginning; "gen_linktype(cstate, LLCSAP_ISONS)" 6151 * generates code to check for all the OSI 6152 * NLPIDs, so calling it and then adding a check 6153 * for the particular NLPID for which we're 6154 * looking is bogus, as we can just check for 6155 * the NLPID. 6156 * 6157 * What we check for is the NLPID and a frame 6158 * control field value of UI, i.e. 0x03 followed 6159 * by the NLPID. 6160 * 6161 * XXX - assumes a 2-byte Frame Relay header with 6162 * DLCI and flags. What if the address is longer? 6163 * 6164 * XXX - what about SNAP-encapsulated frames? 6165 */ 6166 return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | v); 6167 /*NOTREACHED*/ 6168 break; 6169 6170 case DLT_C_HDLC: 6171 /* 6172 * Cisco uses an Ethertype lookalike - for OSI, 6173 * it's 0xfefe. 6174 */ 6175 b0 = gen_linktype(cstate, LLCSAP_ISONS<<8 | LLCSAP_ISONS); 6176 /* OSI in C-HDLC is stuffed with a fudge byte */ 6177 b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 1, BPF_B, (long)v); 6178 gen_and(b0, b1); 6179 return b1; 6180 6181 default: 6182 b0 = gen_linktype(cstate, LLCSAP_ISONS); 6183 b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 0, BPF_B, (long)v); 6184 gen_and(b0, b1); 6185 return b1; 6186 } 6187 6188 case Q_ISIS: 6189 b0 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT); 6190 /* 6191 * 4 is the offset of the PDU type relative to the IS-IS 6192 * header. 6193 */ 6194 b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 4, BPF_B, (long)v); 6195 gen_and(b0, b1); 6196 return b1; 6197 6198 case Q_ARP: 6199 bpf_error(cstate, "arp does not encapsulate another protocol"); 6200 /* NOTREACHED */ 6201 6202 case Q_RARP: 6203 bpf_error(cstate, "rarp does not encapsulate another protocol"); 6204 /* NOTREACHED */ 6205 6206 case Q_ATALK: 6207 bpf_error(cstate, "atalk encapsulation is not specifiable"); 6208 /* NOTREACHED */ 6209 6210 case Q_DECNET: 6211 bpf_error(cstate, "decnet encapsulation is not specifiable"); 6212 /* NOTREACHED */ 6213 6214 case Q_SCA: 6215 bpf_error(cstate, "sca does not encapsulate another protocol"); 6216 /* NOTREACHED */ 6217 6218 case Q_LAT: 6219 bpf_error(cstate, "lat does not encapsulate another protocol"); 6220 /* NOTREACHED */ 6221 6222 case Q_MOPRC: 6223 bpf_error(cstate, "moprc does not encapsulate another protocol"); 6224 /* NOTREACHED */ 6225 6226 case Q_MOPDL: 6227 bpf_error(cstate, "mopdl does not encapsulate another protocol"); 6228 /* NOTREACHED */ 6229 6230 case Q_LINK: 6231 return gen_linktype(cstate, v); 6232 6233 case Q_UDP: 6234 bpf_error(cstate, "'udp proto' is bogus"); 6235 /* NOTREACHED */ 6236 6237 case Q_TCP: 6238 bpf_error(cstate, "'tcp proto' is bogus"); 6239 /* NOTREACHED */ 6240 6241 case Q_SCTP: 6242 bpf_error(cstate, "'sctp proto' is bogus"); 6243 /* NOTREACHED */ 6244 6245 case Q_ICMP: 6246 bpf_error(cstate, "'icmp proto' is bogus"); 6247 /* NOTREACHED */ 6248 6249 case Q_IGMP: 6250 bpf_error(cstate, "'igmp proto' is bogus"); 6251 /* NOTREACHED */ 6252 6253 case Q_IGRP: 6254 bpf_error(cstate, "'igrp proto' is bogus"); 6255 /* NOTREACHED */ 6256 6257 case Q_PIM: 6258 bpf_error(cstate, "'pim proto' is bogus"); 6259 /* NOTREACHED */ 6260 6261 case Q_VRRP: 6262 bpf_error(cstate, "'vrrp proto' is bogus"); 6263 /* NOTREACHED */ 6264 6265 case Q_CARP: 6266 bpf_error(cstate, "'carp proto' is bogus"); 6267 /* NOTREACHED */ 6268 6269 case Q_IPV6: 6270 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 6271 #ifndef CHASE_CHAIN 6272 /* 6273 * Also check for a fragment header before the final 6274 * header. 6275 */ 6276 b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, IPPROTO_FRAGMENT); 6277 b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, (bpf_int32)v); 6278 gen_and(b2, b1); 6279 b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)v); 6280 gen_or(b2, b1); 6281 #else 6282 b1 = gen_protochain(cstate, v, Q_IPV6); 6283 #endif 6284 gen_and(b0, b1); 6285 return b1; 6286 6287 case Q_ICMPV6: 6288 bpf_error(cstate, "'icmp6 proto' is bogus"); 6289 6290 case Q_AH: 6291 bpf_error(cstate, "'ah proto' is bogus"); 6292 6293 case Q_ESP: 6294 bpf_error(cstate, "'ah proto' is bogus"); 6295 6296 case Q_STP: 6297 bpf_error(cstate, "'stp proto' is bogus"); 6298 6299 case Q_IPX: 6300 bpf_error(cstate, "'ipx proto' is bogus"); 6301 6302 case Q_NETBEUI: 6303 bpf_error(cstate, "'netbeui proto' is bogus"); 6304 6305 case Q_RADIO: 6306 bpf_error(cstate, "'radio proto' is bogus"); 6307 6308 default: 6309 abort(); 6310 /* NOTREACHED */ 6311 } 6312 /* NOTREACHED */ 6313 } 6314 6315 struct block * 6316 gen_scode(compiler_state_t *cstate, const char *name, struct qual q) 6317 { 6318 int proto = q.proto; 6319 int dir = q.dir; 6320 int tproto; 6321 u_char *eaddr; 6322 bpf_u_int32 mask, addr; 6323 struct addrinfo *res, *res0; 6324 struct sockaddr_in *sin4; 6325 #ifdef INET6 6326 int tproto6; 6327 struct sockaddr_in6 *sin6; 6328 struct in6_addr mask128; 6329 #endif /*INET6*/ 6330 struct block *b, *tmp; 6331 int port, real_proto; 6332 int port1, port2; 6333 6334 switch (q.addr) { 6335 6336 case Q_NET: 6337 addr = pcap_nametonetaddr(name); 6338 if (addr == 0) 6339 bpf_error(cstate, "unknown network '%s'", name); 6340 /* Left justify network addr and calculate its network mask */ 6341 mask = 0xffffffff; 6342 while (addr && (addr & 0xff000000) == 0) { 6343 addr <<= 8; 6344 mask <<= 8; 6345 } 6346 return gen_host(cstate, addr, mask, proto, dir, q.addr); 6347 6348 case Q_DEFAULT: 6349 case Q_HOST: 6350 if (proto == Q_LINK) { 6351 switch (cstate->linktype) { 6352 6353 case DLT_EN10MB: 6354 case DLT_NETANALYZER: 6355 case DLT_NETANALYZER_TRANSPARENT: 6356 eaddr = pcap_ether_hostton(name); 6357 if (eaddr == NULL) 6358 bpf_error(cstate, 6359 "unknown ether host '%s'", name); 6360 tmp = gen_prevlinkhdr_check(cstate); 6361 b = gen_ehostop(cstate, eaddr, dir); 6362 if (tmp != NULL) 6363 gen_and(tmp, b); 6364 free(eaddr); 6365 return b; 6366 6367 case DLT_FDDI: 6368 eaddr = pcap_ether_hostton(name); 6369 if (eaddr == NULL) 6370 bpf_error(cstate, 6371 "unknown FDDI host '%s'", name); 6372 b = gen_fhostop(cstate, eaddr, dir); 6373 free(eaddr); 6374 return b; 6375 6376 case DLT_IEEE802: 6377 eaddr = pcap_ether_hostton(name); 6378 if (eaddr == NULL) 6379 bpf_error(cstate, 6380 "unknown token ring host '%s'", name); 6381 b = gen_thostop(cstate, eaddr, dir); 6382 free(eaddr); 6383 return b; 6384 6385 case DLT_IEEE802_11: 6386 case DLT_PRISM_HEADER: 6387 case DLT_IEEE802_11_RADIO_AVS: 6388 case DLT_IEEE802_11_RADIO: 6389 case DLT_PPI: 6390 eaddr = pcap_ether_hostton(name); 6391 if (eaddr == NULL) 6392 bpf_error(cstate, 6393 "unknown 802.11 host '%s'", name); 6394 b = gen_wlanhostop(cstate, eaddr, dir); 6395 free(eaddr); 6396 return b; 6397 6398 case DLT_IP_OVER_FC: 6399 eaddr = pcap_ether_hostton(name); 6400 if (eaddr == NULL) 6401 bpf_error(cstate, 6402 "unknown Fibre Channel host '%s'", name); 6403 b = gen_ipfchostop(cstate, eaddr, dir); 6404 free(eaddr); 6405 return b; 6406 } 6407 6408 bpf_error(cstate, "only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name"); 6409 } else if (proto == Q_DECNET) { 6410 unsigned short dn_addr; 6411 6412 if (!__pcap_nametodnaddr(name, &dn_addr)) { 6413 #ifdef DECNETLIB 6414 bpf_error(cstate, "unknown decnet host name '%s'\n", name); 6415 #else 6416 bpf_error(cstate, "decnet name support not included, '%s' cannot be translated\n", 6417 name); 6418 #endif 6419 } 6420 /* 6421 * I don't think DECNET hosts can be multihomed, so 6422 * there is no need to build up a list of addresses 6423 */ 6424 return (gen_host(cstate, dn_addr, 0, proto, dir, q.addr)); 6425 } else { 6426 #ifdef INET6 6427 memset(&mask128, 0xff, sizeof(mask128)); 6428 #endif 6429 res0 = res = pcap_nametoaddrinfo(name); 6430 if (res == NULL) 6431 bpf_error(cstate, "unknown host '%s'", name); 6432 cstate->ai = res; 6433 b = tmp = NULL; 6434 tproto = proto; 6435 #ifdef INET6 6436 tproto6 = proto; 6437 #endif 6438 if (cstate->off_linktype.constant_part == OFFSET_NOT_SET && 6439 tproto == Q_DEFAULT) { 6440 tproto = Q_IP; 6441 #ifdef INET6 6442 tproto6 = Q_IPV6; 6443 #endif 6444 } 6445 for (res = res0; res; res = res->ai_next) { 6446 switch (res->ai_family) { 6447 case AF_INET: 6448 #ifdef INET6 6449 if (tproto == Q_IPV6) 6450 continue; 6451 #endif 6452 6453 sin4 = (struct sockaddr_in *) 6454 res->ai_addr; 6455 tmp = gen_host(cstate, ntohl(sin4->sin_addr.s_addr), 6456 0xffffffff, tproto, dir, q.addr); 6457 break; 6458 #ifdef INET6 6459 case AF_INET6: 6460 if (tproto6 == Q_IP) 6461 continue; 6462 6463 sin6 = (struct sockaddr_in6 *) 6464 res->ai_addr; 6465 tmp = gen_host6(cstate, &sin6->sin6_addr, 6466 &mask128, tproto6, dir, q.addr); 6467 break; 6468 #endif 6469 default: 6470 continue; 6471 } 6472 if (b) 6473 gen_or(b, tmp); 6474 b = tmp; 6475 } 6476 cstate->ai = NULL; 6477 freeaddrinfo(res0); 6478 if (b == NULL) { 6479 bpf_error(cstate, "unknown host '%s'%s", name, 6480 (proto == Q_DEFAULT) 6481 ? "" 6482 : " for specified address family"); 6483 } 6484 return b; 6485 } 6486 6487 case Q_PORT: 6488 if (proto != Q_DEFAULT && 6489 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 6490 bpf_error(cstate, "illegal qualifier of 'port'"); 6491 if (pcap_nametoport(name, &port, &real_proto) == 0) 6492 bpf_error(cstate, "unknown port '%s'", name); 6493 if (proto == Q_UDP) { 6494 if (real_proto == IPPROTO_TCP) 6495 bpf_error(cstate, "port '%s' is tcp", name); 6496 else if (real_proto == IPPROTO_SCTP) 6497 bpf_error(cstate, "port '%s' is sctp", name); 6498 else 6499 /* override PROTO_UNDEF */ 6500 real_proto = IPPROTO_UDP; 6501 } 6502 if (proto == Q_TCP) { 6503 if (real_proto == IPPROTO_UDP) 6504 bpf_error(cstate, "port '%s' is udp", name); 6505 6506 else if (real_proto == IPPROTO_SCTP) 6507 bpf_error(cstate, "port '%s' is sctp", name); 6508 else 6509 /* override PROTO_UNDEF */ 6510 real_proto = IPPROTO_TCP; 6511 } 6512 if (proto == Q_SCTP) { 6513 if (real_proto == IPPROTO_UDP) 6514 bpf_error(cstate, "port '%s' is udp", name); 6515 6516 else if (real_proto == IPPROTO_TCP) 6517 bpf_error(cstate, "port '%s' is tcp", name); 6518 else 6519 /* override PROTO_UNDEF */ 6520 real_proto = IPPROTO_SCTP; 6521 } 6522 if (port < 0) 6523 bpf_error(cstate, "illegal port number %d < 0", port); 6524 if (port > 65535) 6525 bpf_error(cstate, "illegal port number %d > 65535", port); 6526 b = gen_port(cstate, port, real_proto, dir); 6527 gen_or(gen_port6(cstate, port, real_proto, dir), b); 6528 return b; 6529 6530 case Q_PORTRANGE: 6531 if (proto != Q_DEFAULT && 6532 proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP) 6533 bpf_error(cstate, "illegal qualifier of 'portrange'"); 6534 if (pcap_nametoportrange(name, &port1, &port2, &real_proto) == 0) 6535 bpf_error(cstate, "unknown port in range '%s'", name); 6536 if (proto == Q_UDP) { 6537 if (real_proto == IPPROTO_TCP) 6538 bpf_error(cstate, "port in range '%s' is tcp", name); 6539 else if (real_proto == IPPROTO_SCTP) 6540 bpf_error(cstate, "port in range '%s' is sctp", name); 6541 else 6542 /* override PROTO_UNDEF */ 6543 real_proto = IPPROTO_UDP; 6544 } 6545 if (proto == Q_TCP) { 6546 if (real_proto == IPPROTO_UDP) 6547 bpf_error(cstate, "port in range '%s' is udp", name); 6548 else if (real_proto == IPPROTO_SCTP) 6549 bpf_error(cstate, "port in range '%s' is sctp", name); 6550 else 6551 /* override PROTO_UNDEF */ 6552 real_proto = IPPROTO_TCP; 6553 } 6554 if (proto == Q_SCTP) { 6555 if (real_proto == IPPROTO_UDP) 6556 bpf_error(cstate, "port in range '%s' is udp", name); 6557 else if (real_proto == IPPROTO_TCP) 6558 bpf_error(cstate, "port in range '%s' is tcp", name); 6559 else 6560 /* override PROTO_UNDEF */ 6561 real_proto = IPPROTO_SCTP; 6562 } 6563 if (port1 < 0) 6564 bpf_error(cstate, "illegal port number %d < 0", port1); 6565 if (port1 > 65535) 6566 bpf_error(cstate, "illegal port number %d > 65535", port1); 6567 if (port2 < 0) 6568 bpf_error(cstate, "illegal port number %d < 0", port2); 6569 if (port2 > 65535) 6570 bpf_error(cstate, "illegal port number %d > 65535", port2); 6571 6572 b = gen_portrange(cstate, port1, port2, real_proto, dir); 6573 gen_or(gen_portrange6(cstate, port1, port2, real_proto, dir), b); 6574 return b; 6575 6576 case Q_GATEWAY: 6577 #ifndef INET6 6578 eaddr = pcap_ether_hostton(name); 6579 if (eaddr == NULL) 6580 bpf_error(cstate, "unknown ether host: %s", name); 6581 6582 res = pcap_nametoaddrinfo(name); 6583 cstate->ai = res; 6584 if (res == NULL) 6585 bpf_error(cstate, "unknown host '%s'", name); 6586 b = gen_gateway(cstate, eaddr, res, proto, dir); 6587 cstate->ai = NULL; 6588 freeaddrinfo(res); 6589 if (b == NULL) 6590 bpf_error(cstate, "unknown host '%s'", name); 6591 return b; 6592 #else 6593 bpf_error(cstate, "'gateway' not supported in this configuration"); 6594 #endif /*INET6*/ 6595 6596 case Q_PROTO: 6597 real_proto = lookup_proto(cstate, name, proto); 6598 if (real_proto >= 0) 6599 return gen_proto(cstate, real_proto, proto, dir); 6600 else 6601 bpf_error(cstate, "unknown protocol: %s", name); 6602 6603 case Q_PROTOCHAIN: 6604 real_proto = lookup_proto(cstate, name, proto); 6605 if (real_proto >= 0) 6606 return gen_protochain(cstate, real_proto, proto, dir); 6607 else 6608 bpf_error(cstate, "unknown protocol: %s", name); 6609 6610 case Q_UNDEF: 6611 syntax(cstate); 6612 /* NOTREACHED */ 6613 } 6614 abort(); 6615 /* NOTREACHED */ 6616 } 6617 6618 struct block * 6619 gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2, 6620 unsigned int masklen, struct qual q) 6621 { 6622 register int nlen, mlen; 6623 bpf_u_int32 n, m; 6624 6625 nlen = __pcap_atoin(s1, &n); 6626 /* Promote short ipaddr */ 6627 n <<= 32 - nlen; 6628 6629 if (s2 != NULL) { 6630 mlen = __pcap_atoin(s2, &m); 6631 /* Promote short ipaddr */ 6632 m <<= 32 - mlen; 6633 if ((n & ~m) != 0) 6634 bpf_error(cstate, "non-network bits set in \"%s mask %s\"", 6635 s1, s2); 6636 } else { 6637 /* Convert mask len to mask */ 6638 if (masklen > 32) 6639 bpf_error(cstate, "mask length must be <= 32"); 6640 if (masklen == 0) { 6641 /* 6642 * X << 32 is not guaranteed by C to be 0; it's 6643 * undefined. 6644 */ 6645 m = 0; 6646 } else 6647 m = 0xffffffff << (32 - masklen); 6648 if ((n & ~m) != 0) 6649 bpf_error(cstate, "non-network bits set in \"%s/%d\"", 6650 s1, masklen); 6651 } 6652 6653 switch (q.addr) { 6654 6655 case Q_NET: 6656 return gen_host(cstate, n, m, q.proto, q.dir, q.addr); 6657 6658 default: 6659 bpf_error(cstate, "Mask syntax for networks only"); 6660 /* NOTREACHED */ 6661 } 6662 /* NOTREACHED */ 6663 } 6664 6665 struct block * 6666 gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) 6667 { 6668 bpf_u_int32 mask; 6669 int proto = q.proto; 6670 int dir = q.dir; 6671 register int vlen; 6672 6673 if (s == NULL) 6674 vlen = 32; 6675 else if (q.proto == Q_DECNET) { 6676 vlen = __pcap_atodn(s, &v); 6677 if (vlen == 0) 6678 bpf_error(cstate, "malformed decnet address '%s'", s); 6679 } else 6680 vlen = __pcap_atoin(s, &v); 6681 6682 switch (q.addr) { 6683 6684 case Q_DEFAULT: 6685 case Q_HOST: 6686 case Q_NET: 6687 if (proto == Q_DECNET) 6688 return gen_host(cstate, v, 0, proto, dir, q.addr); 6689 else if (proto == Q_LINK) { 6690 bpf_error(cstate, "illegal link layer address"); 6691 } else { 6692 mask = 0xffffffff; 6693 if (s == NULL && q.addr == Q_NET) { 6694 /* Promote short net number */ 6695 while (v && (v & 0xff000000) == 0) { 6696 v <<= 8; 6697 mask <<= 8; 6698 } 6699 } else { 6700 /* Promote short ipaddr */ 6701 v <<= 32 - vlen; 6702 mask <<= 32 - vlen ; 6703 } 6704 return gen_host(cstate, v, mask, proto, dir, q.addr); 6705 } 6706 6707 case Q_PORT: 6708 if (proto == Q_UDP) 6709 proto = IPPROTO_UDP; 6710 else if (proto == Q_TCP) 6711 proto = IPPROTO_TCP; 6712 else if (proto == Q_SCTP) 6713 proto = IPPROTO_SCTP; 6714 else if (proto == Q_DEFAULT) 6715 proto = PROTO_UNDEF; 6716 else 6717 bpf_error(cstate, "illegal qualifier of 'port'"); 6718 6719 if (v > 65535) 6720 bpf_error(cstate, "illegal port number %u > 65535", v); 6721 6722 { 6723 struct block *b; 6724 b = gen_port(cstate, (int)v, proto, dir); 6725 gen_or(gen_port6(cstate, (int)v, proto, dir), b); 6726 return b; 6727 } 6728 6729 case Q_PORTRANGE: 6730 if (proto == Q_UDP) 6731 proto = IPPROTO_UDP; 6732 else if (proto == Q_TCP) 6733 proto = IPPROTO_TCP; 6734 else if (proto == Q_SCTP) 6735 proto = IPPROTO_SCTP; 6736 else if (proto == Q_DEFAULT) 6737 proto = PROTO_UNDEF; 6738 else 6739 bpf_error(cstate, "illegal qualifier of 'portrange'"); 6740 6741 if (v > 65535) 6742 bpf_error(cstate, "illegal port number %u > 65535", v); 6743 6744 { 6745 struct block *b; 6746 b = gen_portrange(cstate, (int)v, (int)v, proto, dir); 6747 gen_or(gen_portrange6(cstate, (int)v, (int)v, proto, dir), b); 6748 return b; 6749 } 6750 6751 case Q_GATEWAY: 6752 bpf_error(cstate, "'gateway' requires a name"); 6753 /* NOTREACHED */ 6754 6755 case Q_PROTO: 6756 return gen_proto(cstate, (int)v, proto, dir); 6757 6758 case Q_PROTOCHAIN: 6759 return gen_protochain(cstate, (int)v, proto, dir); 6760 6761 case Q_UNDEF: 6762 syntax(cstate); 6763 /* NOTREACHED */ 6764 6765 default: 6766 abort(); 6767 /* NOTREACHED */ 6768 } 6769 /* NOTREACHED */ 6770 } 6771 6772 #ifdef INET6 6773 struct block * 6774 gen_mcode6(compiler_state_t *cstate, const char *s1, const char *s2, 6775 unsigned int masklen, struct qual q) 6776 { 6777 struct addrinfo *res; 6778 struct in6_addr *addr; 6779 struct in6_addr mask; 6780 struct block *b; 6781 uint32_t *a, *m; 6782 6783 if (s2) 6784 bpf_error(cstate, "no mask %s supported", s2); 6785 6786 res = pcap_nametoaddrinfo(s1); 6787 if (!res) 6788 bpf_error(cstate, "invalid ip6 address %s", s1); 6789 cstate->ai = res; 6790 if (res->ai_next) 6791 bpf_error(cstate, "%s resolved to multiple address", s1); 6792 addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr; 6793 6794 if (sizeof(mask) * 8 < masklen) 6795 bpf_error(cstate, "mask length must be <= %u", (unsigned int)(sizeof(mask) * 8)); 6796 memset(&mask, 0, sizeof(mask)); 6797 memset(&mask, 0xff, masklen / 8); 6798 if (masklen % 8) { 6799 mask.s6_addr[masklen / 8] = 6800 (0xff << (8 - masklen % 8)) & 0xff; 6801 } 6802 6803 a = (uint32_t *)addr; 6804 m = (uint32_t *)&mask; 6805 if ((a[0] & ~m[0]) || (a[1] & ~m[1]) 6806 || (a[2] & ~m[2]) || (a[3] & ~m[3])) { 6807 bpf_error(cstate, "non-network bits set in \"%s/%d\"", s1, masklen); 6808 } 6809 6810 switch (q.addr) { 6811 6812 case Q_DEFAULT: 6813 case Q_HOST: 6814 if (masklen != 128) 6815 bpf_error(cstate, "Mask syntax for networks only"); 6816 /* FALLTHROUGH */ 6817 6818 case Q_NET: 6819 b = gen_host6(cstate, addr, &mask, q.proto, q.dir, q.addr); 6820 cstate->ai = NULL; 6821 freeaddrinfo(res); 6822 return b; 6823 6824 default: 6825 bpf_error(cstate, "invalid qualifier against IPv6 address"); 6826 /* NOTREACHED */ 6827 } 6828 } 6829 #endif /*INET6*/ 6830 6831 struct block * 6832 gen_ecode(compiler_state_t *cstate, const u_char *eaddr, struct qual q) 6833 { 6834 struct block *b, *tmp; 6835 6836 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { 6837 switch (cstate->linktype) { 6838 case DLT_EN10MB: 6839 case DLT_NETANALYZER: 6840 case DLT_NETANALYZER_TRANSPARENT: 6841 tmp = gen_prevlinkhdr_check(cstate); 6842 b = gen_ehostop(cstate, eaddr, (int)q.dir); 6843 if (tmp != NULL) 6844 gen_and(tmp, b); 6845 return b; 6846 case DLT_FDDI: 6847 return gen_fhostop(cstate, eaddr, (int)q.dir); 6848 case DLT_IEEE802: 6849 return gen_thostop(cstate, eaddr, (int)q.dir); 6850 case DLT_IEEE802_11: 6851 case DLT_PRISM_HEADER: 6852 case DLT_IEEE802_11_RADIO_AVS: 6853 case DLT_IEEE802_11_RADIO: 6854 case DLT_PPI: 6855 return gen_wlanhostop(cstate, eaddr, (int)q.dir); 6856 case DLT_IP_OVER_FC: 6857 return gen_ipfchostop(cstate, eaddr, (int)q.dir); 6858 default: 6859 bpf_error(cstate, "ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); 6860 break; 6861 } 6862 } 6863 bpf_error(cstate, "ethernet address used in non-ether expression"); 6864 /* NOTREACHED */ 6865 } 6866 6867 void 6868 sappend(struct slist *s0, struct slist *s1) 6869 { 6870 /* 6871 * This is definitely not the best way to do this, but the 6872 * lists will rarely get long. 6873 */ 6874 while (s0->next) 6875 s0 = s0->next; 6876 s0->next = s1; 6877 } 6878 6879 static struct slist * 6880 xfer_to_x(compiler_state_t *cstate, struct arth *a) 6881 { 6882 struct slist *s; 6883 6884 s = new_stmt(cstate, BPF_LDX|BPF_MEM); 6885 s->s.k = a->regno; 6886 return s; 6887 } 6888 6889 static struct slist * 6890 xfer_to_a(compiler_state_t *cstate, struct arth *a) 6891 { 6892 struct slist *s; 6893 6894 s = new_stmt(cstate, BPF_LD|BPF_MEM); 6895 s->s.k = a->regno; 6896 return s; 6897 } 6898 6899 /* 6900 * Modify "index" to use the value stored into its register as an 6901 * offset relative to the beginning of the header for the protocol 6902 * "proto", and allocate a register and put an item "size" bytes long 6903 * (1, 2, or 4) at that offset into that register, making it the register 6904 * for "index". 6905 */ 6906 struct arth * 6907 gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) 6908 { 6909 struct slist *s, *tmp; 6910 struct block *b; 6911 int regno = alloc_reg(cstate); 6912 6913 free_reg(cstate, inst->regno); 6914 switch (size) { 6915 6916 default: 6917 bpf_error(cstate, "data size must be 1, 2, or 4"); 6918 6919 case 1: 6920 size = BPF_B; 6921 break; 6922 6923 case 2: 6924 size = BPF_H; 6925 break; 6926 6927 case 4: 6928 size = BPF_W; 6929 break; 6930 } 6931 switch (proto) { 6932 default: 6933 bpf_error(cstate, "unsupported index operation"); 6934 6935 case Q_RADIO: 6936 /* 6937 * The offset is relative to the beginning of the packet 6938 * data, if we have a radio header. (If we don't, this 6939 * is an error.) 6940 */ 6941 if (cstate->linktype != DLT_IEEE802_11_RADIO_AVS && 6942 cstate->linktype != DLT_IEEE802_11_RADIO && 6943 cstate->linktype != DLT_PRISM_HEADER) 6944 bpf_error(cstate, "radio information not present in capture"); 6945 6946 /* 6947 * Load into the X register the offset computed into the 6948 * register specified by "index". 6949 */ 6950 s = xfer_to_x(cstate, inst); 6951 6952 /* 6953 * Load the item at that offset. 6954 */ 6955 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); 6956 sappend(s, tmp); 6957 sappend(inst->s, s); 6958 break; 6959 6960 case Q_LINK: 6961 /* 6962 * The offset is relative to the beginning of 6963 * the link-layer header. 6964 * 6965 * XXX - what about ATM LANE? Should the index be 6966 * relative to the beginning of the AAL5 frame, so 6967 * that 0 refers to the beginning of the LE Control 6968 * field, or relative to the beginning of the LAN 6969 * frame, so that 0 refers, for Ethernet LANE, to 6970 * the beginning of the destination address? 6971 */ 6972 s = gen_abs_offset_varpart(cstate, &cstate->off_linkhdr); 6973 6974 /* 6975 * If "s" is non-null, it has code to arrange that the 6976 * X register contains the length of the prefix preceding 6977 * the link-layer header. Add to it the offset computed 6978 * into the register specified by "index", and move that 6979 * into the X register. Otherwise, just load into the X 6980 * register the offset computed into the register specified 6981 * by "index". 6982 */ 6983 if (s != NULL) { 6984 sappend(s, xfer_to_a(cstate, inst)); 6985 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 6986 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 6987 } else 6988 s = xfer_to_x(cstate, inst); 6989 6990 /* 6991 * Load the item at the sum of the offset we've put in the 6992 * X register and the offset of the start of the link 6993 * layer header (which is 0 if the radio header is 6994 * variable-length; that header length is what we put 6995 * into the X register and then added to the index). 6996 */ 6997 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); 6998 tmp->s.k = cstate->off_linkhdr.constant_part; 6999 sappend(s, tmp); 7000 sappend(inst->s, s); 7001 break; 7002 7003 case Q_IP: 7004 case Q_ARP: 7005 case Q_RARP: 7006 case Q_ATALK: 7007 case Q_DECNET: 7008 case Q_SCA: 7009 case Q_LAT: 7010 case Q_MOPRC: 7011 case Q_MOPDL: 7012 case Q_IPV6: 7013 /* 7014 * The offset is relative to the beginning of 7015 * the network-layer header. 7016 * XXX - are there any cases where we want 7017 * cstate->off_nl_nosnap? 7018 */ 7019 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 7020 7021 /* 7022 * If "s" is non-null, it has code to arrange that the 7023 * X register contains the variable part of the offset 7024 * of the link-layer payload. Add to it the offset 7025 * computed into the register specified by "index", 7026 * and move that into the X register. Otherwise, just 7027 * load into the X register the offset computed into 7028 * the register specified by "index". 7029 */ 7030 if (s != NULL) { 7031 sappend(s, xfer_to_a(cstate, inst)); 7032 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7033 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7034 } else 7035 s = xfer_to_x(cstate, inst); 7036 7037 /* 7038 * Load the item at the sum of the offset we've put in the 7039 * X register, the offset of the start of the network 7040 * layer header from the beginning of the link-layer 7041 * payload, and the constant part of the offset of the 7042 * start of the link-layer payload. 7043 */ 7044 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); 7045 tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 7046 sappend(s, tmp); 7047 sappend(inst->s, s); 7048 7049 /* 7050 * Do the computation only if the packet contains 7051 * the protocol in question. 7052 */ 7053 b = gen_proto_abbrev(cstate, proto); 7054 if (inst->b) 7055 gen_and(inst->b, b); 7056 inst->b = b; 7057 break; 7058 7059 case Q_SCTP: 7060 case Q_TCP: 7061 case Q_UDP: 7062 case Q_ICMP: 7063 case Q_IGMP: 7064 case Q_IGRP: 7065 case Q_PIM: 7066 case Q_VRRP: 7067 case Q_CARP: 7068 /* 7069 * The offset is relative to the beginning of 7070 * the transport-layer header. 7071 * 7072 * Load the X register with the length of the IPv4 header 7073 * (plus the offset of the link-layer header, if it's 7074 * a variable-length header), in bytes. 7075 * 7076 * XXX - are there any cases where we want 7077 * cstate->off_nl_nosnap? 7078 * XXX - we should, if we're built with 7079 * IPv6 support, generate code to load either 7080 * IPv4, IPv6, or both, as appropriate. 7081 */ 7082 s = gen_loadx_iphdrlen(cstate); 7083 7084 /* 7085 * The X register now contains the sum of the variable 7086 * part of the offset of the link-layer payload and the 7087 * length of the network-layer header. 7088 * 7089 * Load into the A register the offset relative to 7090 * the beginning of the transport layer header, 7091 * add the X register to that, move that to the 7092 * X register, and load with an offset from the 7093 * X register equal to the sum of the constant part of 7094 * the offset of the link-layer payload and the offset, 7095 * relative to the beginning of the link-layer payload, 7096 * of the network-layer header. 7097 */ 7098 sappend(s, xfer_to_a(cstate, inst)); 7099 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7100 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7101 sappend(s, tmp = new_stmt(cstate, BPF_LD|BPF_IND|size)); 7102 tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl; 7103 sappend(inst->s, s); 7104 7105 /* 7106 * Do the computation only if the packet contains 7107 * the protocol in question - which is true only 7108 * if this is an IP datagram and is the first or 7109 * only fragment of that datagram. 7110 */ 7111 gen_and(gen_proto_abbrev(cstate, proto), b = gen_ipfrag(cstate)); 7112 if (inst->b) 7113 gen_and(inst->b, b); 7114 gen_and(gen_proto_abbrev(cstate, Q_IP), b); 7115 inst->b = b; 7116 break; 7117 case Q_ICMPV6: 7118 /* 7119 * Do the computation only if the packet contains 7120 * the protocol in question. 7121 */ 7122 b = gen_proto_abbrev(cstate, Q_IPV6); 7123 if (inst->b) { 7124 gen_and(inst->b, b); 7125 } 7126 inst->b = b; 7127 7128 /* 7129 * Check if we have an icmp6 next header 7130 */ 7131 b = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, 58); 7132 if (inst->b) { 7133 gen_and(inst->b, b); 7134 } 7135 inst->b = b; 7136 7137 7138 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 7139 /* 7140 * If "s" is non-null, it has code to arrange that the 7141 * X register contains the variable part of the offset 7142 * of the link-layer payload. Add to it the offset 7143 * computed into the register specified by "index", 7144 * and move that into the X register. Otherwise, just 7145 * load into the X register the offset computed into 7146 * the register specified by "index". 7147 */ 7148 if (s != NULL) { 7149 sappend(s, xfer_to_a(cstate, inst)); 7150 sappend(s, new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X)); 7151 sappend(s, new_stmt(cstate, BPF_MISC|BPF_TAX)); 7152 } else { 7153 s = xfer_to_x(cstate, inst); 7154 } 7155 7156 /* 7157 * Load the item at the sum of the offset we've put in the 7158 * X register, the offset of the start of the network 7159 * layer header from the beginning of the link-layer 7160 * payload, and the constant part of the offset of the 7161 * start of the link-layer payload. 7162 */ 7163 tmp = new_stmt(cstate, BPF_LD|BPF_IND|size); 7164 tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 40; 7165 7166 sappend(s, tmp); 7167 sappend(inst->s, s); 7168 7169 break; 7170 } 7171 inst->regno = regno; 7172 s = new_stmt(cstate, BPF_ST); 7173 s->s.k = regno; 7174 sappend(inst->s, s); 7175 7176 return inst; 7177 } 7178 7179 struct block * 7180 gen_relation(compiler_state_t *cstate, int code, struct arth *a0, 7181 struct arth *a1, int reversed) 7182 { 7183 struct slist *s0, *s1, *s2; 7184 struct block *b, *tmp; 7185 7186 s0 = xfer_to_x(cstate, a1); 7187 s1 = xfer_to_a(cstate, a0); 7188 if (code == BPF_JEQ) { 7189 s2 = new_stmt(cstate, BPF_ALU|BPF_SUB|BPF_X); 7190 b = new_block(cstate, JMP(code)); 7191 sappend(s1, s2); 7192 } 7193 else 7194 b = new_block(cstate, BPF_JMP|code|BPF_X); 7195 if (reversed) 7196 gen_not(b); 7197 7198 sappend(s0, s1); 7199 sappend(a1->s, s0); 7200 sappend(a0->s, a1->s); 7201 7202 b->stmts = a0->s; 7203 7204 free_reg(cstate, a0->regno); 7205 free_reg(cstate, a1->regno); 7206 7207 /* 'and' together protocol checks */ 7208 if (a0->b) { 7209 if (a1->b) { 7210 gen_and(a0->b, tmp = a1->b); 7211 } 7212 else 7213 tmp = a0->b; 7214 } else 7215 tmp = a1->b; 7216 7217 if (tmp) 7218 gen_and(tmp, b); 7219 7220 return b; 7221 } 7222 7223 struct arth * 7224 gen_loadlen(compiler_state_t *cstate) 7225 { 7226 int regno = alloc_reg(cstate); 7227 struct arth *a = (struct arth *)newchunk(cstate, sizeof(*a)); 7228 struct slist *s; 7229 7230 s = new_stmt(cstate, BPF_LD|BPF_LEN); 7231 s->next = new_stmt(cstate, BPF_ST); 7232 s->next->s.k = regno; 7233 a->s = s; 7234 a->regno = regno; 7235 7236 return a; 7237 } 7238 7239 struct arth * 7240 gen_loadi(compiler_state_t *cstate, int val) 7241 { 7242 struct arth *a; 7243 struct slist *s; 7244 int reg; 7245 7246 a = (struct arth *)newchunk(cstate, sizeof(*a)); 7247 7248 reg = alloc_reg(cstate); 7249 7250 s = new_stmt(cstate, BPF_LD|BPF_IMM); 7251 s->s.k = val; 7252 s->next = new_stmt(cstate, BPF_ST); 7253 s->next->s.k = reg; 7254 a->s = s; 7255 a->regno = reg; 7256 7257 return a; 7258 } 7259 7260 struct arth * 7261 gen_neg(compiler_state_t *cstate, struct arth *a) 7262 { 7263 struct slist *s; 7264 7265 s = xfer_to_a(cstate, a); 7266 sappend(a->s, s); 7267 s = new_stmt(cstate, BPF_ALU|BPF_NEG); 7268 s->s.k = 0; 7269 sappend(a->s, s); 7270 s = new_stmt(cstate, BPF_ST); 7271 s->s.k = a->regno; 7272 sappend(a->s, s); 7273 7274 return a; 7275 } 7276 7277 struct arth * 7278 gen_arth(compiler_state_t *cstate, int code, struct arth *a0, 7279 struct arth *a1) 7280 { 7281 struct slist *s0, *s1, *s2; 7282 7283 /* 7284 * Disallow division by, or modulus by, zero; we do this here 7285 * so that it gets done even if the optimizer is disabled. 7286 */ 7287 if (code == BPF_DIV) { 7288 if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) 7289 bpf_error(cstate, "division by zero"); 7290 } else if (code == BPF_MOD) { 7291 if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) 7292 bpf_error(cstate, "modulus by zero"); 7293 } 7294 s0 = xfer_to_x(cstate, a1); 7295 s1 = xfer_to_a(cstate, a0); 7296 s2 = new_stmt(cstate, BPF_ALU|BPF_X|code); 7297 7298 sappend(s1, s2); 7299 sappend(s0, s1); 7300 sappend(a1->s, s0); 7301 sappend(a0->s, a1->s); 7302 7303 free_reg(cstate, a0->regno); 7304 free_reg(cstate, a1->regno); 7305 7306 s0 = new_stmt(cstate, BPF_ST); 7307 a0->regno = s0->s.k = alloc_reg(cstate); 7308 sappend(a0->s, s0); 7309 7310 return a0; 7311 } 7312 7313 /* 7314 * Initialize the table of used registers and the current register. 7315 */ 7316 static void 7317 init_regs(compiler_state_t *cstate) 7318 { 7319 cstate->curreg = 0; 7320 memset(cstate->regused, 0, sizeof cstate->regused); 7321 } 7322 7323 /* 7324 * Return the next free register. 7325 */ 7326 static int 7327 alloc_reg(compiler_state_t *cstate) 7328 { 7329 int n = BPF_MEMWORDS; 7330 7331 while (--n >= 0) { 7332 if (cstate->regused[cstate->curreg]) 7333 cstate->curreg = (cstate->curreg + 1) % BPF_MEMWORDS; 7334 else { 7335 cstate->regused[cstate->curreg] = 1; 7336 return cstate->curreg; 7337 } 7338 } 7339 bpf_error(cstate, "too many registers needed to evaluate expression"); 7340 /* NOTREACHED */ 7341 } 7342 7343 /* 7344 * Return a register to the table so it can 7345 * be used later. 7346 */ 7347 static void 7348 free_reg(compiler_state_t *cstate, int n) 7349 { 7350 cstate->regused[n] = 0; 7351 } 7352 7353 static struct block * 7354 gen_len(compiler_state_t *cstate, int jmp, int n) 7355 { 7356 struct slist *s; 7357 struct block *b; 7358 7359 s = new_stmt(cstate, BPF_LD|BPF_LEN); 7360 b = new_block(cstate, JMP(jmp)); 7361 b->stmts = s; 7362 b->s.k = n; 7363 7364 return b; 7365 } 7366 7367 struct block * 7368 gen_greater(compiler_state_t *cstate, int n) 7369 { 7370 return gen_len(cstate, BPF_JGE, n); 7371 } 7372 7373 /* 7374 * Actually, this is less than or equal. 7375 */ 7376 struct block * 7377 gen_less(compiler_state_t *cstate, int n) 7378 { 7379 struct block *b; 7380 7381 b = gen_len(cstate, BPF_JGT, n); 7382 gen_not(b); 7383 7384 return b; 7385 } 7386 7387 /* 7388 * This is for "byte {idx} {op} {val}"; "idx" is treated as relative to 7389 * the beginning of the link-layer header. 7390 * XXX - that means you can't test values in the radiotap header, but 7391 * as that header is difficult if not impossible to parse generally 7392 * without a loop, that might not be a severe problem. A new keyword 7393 * "radio" could be added for that, although what you'd really want 7394 * would be a way of testing particular radio header values, which 7395 * would generate code appropriate to the radio header in question. 7396 */ 7397 struct block * 7398 gen_byteop(compiler_state_t *cstate, int op, int idx, int val) 7399 { 7400 struct block *b; 7401 struct slist *s; 7402 7403 switch (op) { 7404 default: 7405 abort(); 7406 7407 case '=': 7408 return gen_cmp(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val); 7409 7410 case '<': 7411 b = gen_cmp_lt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val); 7412 return b; 7413 7414 case '>': 7415 b = gen_cmp_gt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val); 7416 return b; 7417 7418 case '|': 7419 s = new_stmt(cstate, BPF_ALU|BPF_OR|BPF_K); 7420 break; 7421 7422 case '&': 7423 s = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 7424 break; 7425 } 7426 s->s.k = val; 7427 b = new_block(cstate, JMP(BPF_JEQ)); 7428 b->stmts = s; 7429 gen_not(b); 7430 7431 return b; 7432 } 7433 7434 static const u_char abroadcast[] = { 0x0 }; 7435 7436 struct block * 7437 gen_broadcast(compiler_state_t *cstate, int proto) 7438 { 7439 bpf_u_int32 hostmask; 7440 struct block *b0, *b1, *b2; 7441 static const u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 7442 7443 switch (proto) { 7444 7445 case Q_DEFAULT: 7446 case Q_LINK: 7447 switch (cstate->linktype) { 7448 case DLT_ARCNET: 7449 case DLT_ARCNET_LINUX: 7450 return gen_ahostop(cstate, abroadcast, Q_DST); 7451 case DLT_EN10MB: 7452 case DLT_NETANALYZER: 7453 case DLT_NETANALYZER_TRANSPARENT: 7454 b1 = gen_prevlinkhdr_check(cstate); 7455 b0 = gen_ehostop(cstate, ebroadcast, Q_DST); 7456 if (b1 != NULL) 7457 gen_and(b1, b0); 7458 return b0; 7459 case DLT_FDDI: 7460 return gen_fhostop(cstate, ebroadcast, Q_DST); 7461 case DLT_IEEE802: 7462 return gen_thostop(cstate, ebroadcast, Q_DST); 7463 case DLT_IEEE802_11: 7464 case DLT_PRISM_HEADER: 7465 case DLT_IEEE802_11_RADIO_AVS: 7466 case DLT_IEEE802_11_RADIO: 7467 case DLT_PPI: 7468 return gen_wlanhostop(cstate, ebroadcast, Q_DST); 7469 case DLT_IP_OVER_FC: 7470 return gen_ipfchostop(cstate, ebroadcast, Q_DST); 7471 default: 7472 bpf_error(cstate, "not a broadcast link"); 7473 } 7474 break; 7475 7476 case Q_IP: 7477 /* 7478 * We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff) 7479 * as an indication that we don't know the netmask, and fail 7480 * in that case. 7481 */ 7482 if (cstate->netmask == PCAP_NETMASK_UNKNOWN) 7483 bpf_error(cstate, "netmask not known, so 'ip broadcast' not supported"); 7484 b0 = gen_linktype(cstate, ETHERTYPE_IP); 7485 hostmask = ~cstate->netmask; 7486 b1 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, (bpf_int32)0, hostmask); 7487 b2 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, 7488 (bpf_int32)(~0 & hostmask), hostmask); 7489 gen_or(b1, b2); 7490 gen_and(b0, b2); 7491 return b2; 7492 } 7493 bpf_error(cstate, "only link-layer/IP broadcast filters supported"); 7494 /* NOTREACHED */ 7495 } 7496 7497 /* 7498 * Generate code to test the low-order bit of a MAC address (that's 7499 * the bottom bit of the *first* byte). 7500 */ 7501 static struct block * 7502 gen_mac_multicast(compiler_state_t *cstate, int offset) 7503 { 7504 register struct block *b0; 7505 register struct slist *s; 7506 7507 /* link[offset] & 1 != 0 */ 7508 s = gen_load_a(cstate, OR_LINKHDR, offset, BPF_B); 7509 b0 = new_block(cstate, JMP(BPF_JSET)); 7510 b0->s.k = 1; 7511 b0->stmts = s; 7512 return b0; 7513 } 7514 7515 struct block * 7516 gen_multicast(compiler_state_t *cstate, int proto) 7517 { 7518 register struct block *b0, *b1, *b2; 7519 register struct slist *s; 7520 7521 switch (proto) { 7522 7523 case Q_DEFAULT: 7524 case Q_LINK: 7525 switch (cstate->linktype) { 7526 case DLT_ARCNET: 7527 case DLT_ARCNET_LINUX: 7528 /* all ARCnet multicasts use the same address */ 7529 return gen_ahostop(cstate, abroadcast, Q_DST); 7530 case DLT_EN10MB: 7531 case DLT_NETANALYZER: 7532 case DLT_NETANALYZER_TRANSPARENT: 7533 b1 = gen_prevlinkhdr_check(cstate); 7534 /* ether[0] & 1 != 0 */ 7535 b0 = gen_mac_multicast(cstate, 0); 7536 if (b1 != NULL) 7537 gen_and(b1, b0); 7538 return b0; 7539 case DLT_FDDI: 7540 /* 7541 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX 7542 * 7543 * XXX - was that referring to bit-order issues? 7544 */ 7545 /* fddi[1] & 1 != 0 */ 7546 return gen_mac_multicast(cstate, 1); 7547 case DLT_IEEE802: 7548 /* tr[2] & 1 != 0 */ 7549 return gen_mac_multicast(cstate, 2); 7550 case DLT_IEEE802_11: 7551 case DLT_PRISM_HEADER: 7552 case DLT_IEEE802_11_RADIO_AVS: 7553 case DLT_IEEE802_11_RADIO: 7554 case DLT_PPI: 7555 /* 7556 * Oh, yuk. 7557 * 7558 * For control frames, there is no DA. 7559 * 7560 * For management frames, DA is at an 7561 * offset of 4 from the beginning of 7562 * the packet. 7563 * 7564 * For data frames, DA is at an offset 7565 * of 4 from the beginning of the packet 7566 * if To DS is clear and at an offset of 7567 * 16 from the beginning of the packet 7568 * if To DS is set. 7569 */ 7570 7571 /* 7572 * Generate the tests to be done for data frames. 7573 * 7574 * First, check for To DS set, i.e. "link[1] & 0x01". 7575 */ 7576 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 7577 b1 = new_block(cstate, JMP(BPF_JSET)); 7578 b1->s.k = 0x01; /* To DS */ 7579 b1->stmts = s; 7580 7581 /* 7582 * If To DS is set, the DA is at 16. 7583 */ 7584 b0 = gen_mac_multicast(cstate, 16); 7585 gen_and(b1, b0); 7586 7587 /* 7588 * Now, check for To DS not set, i.e. check 7589 * "!(link[1] & 0x01)". 7590 */ 7591 s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B); 7592 b2 = new_block(cstate, JMP(BPF_JSET)); 7593 b2->s.k = 0x01; /* To DS */ 7594 b2->stmts = s; 7595 gen_not(b2); 7596 7597 /* 7598 * If To DS is not set, the DA is at 4. 7599 */ 7600 b1 = gen_mac_multicast(cstate, 4); 7601 gen_and(b2, b1); 7602 7603 /* 7604 * Now OR together the last two checks. That gives 7605 * the complete set of checks for data frames. 7606 */ 7607 gen_or(b1, b0); 7608 7609 /* 7610 * Now check for a data frame. 7611 * I.e, check "link[0] & 0x08". 7612 */ 7613 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 7614 b1 = new_block(cstate, JMP(BPF_JSET)); 7615 b1->s.k = 0x08; 7616 b1->stmts = s; 7617 7618 /* 7619 * AND that with the checks done for data frames. 7620 */ 7621 gen_and(b1, b0); 7622 7623 /* 7624 * If the high-order bit of the type value is 0, this 7625 * is a management frame. 7626 * I.e, check "!(link[0] & 0x08)". 7627 */ 7628 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 7629 b2 = new_block(cstate, JMP(BPF_JSET)); 7630 b2->s.k = 0x08; 7631 b2->stmts = s; 7632 gen_not(b2); 7633 7634 /* 7635 * For management frames, the DA is at 4. 7636 */ 7637 b1 = gen_mac_multicast(cstate, 4); 7638 gen_and(b2, b1); 7639 7640 /* 7641 * OR that with the checks done for data frames. 7642 * That gives the checks done for management and 7643 * data frames. 7644 */ 7645 gen_or(b1, b0); 7646 7647 /* 7648 * If the low-order bit of the type value is 1, 7649 * this is either a control frame or a frame 7650 * with a reserved type, and thus not a 7651 * frame with an SA. 7652 * 7653 * I.e., check "!(link[0] & 0x04)". 7654 */ 7655 s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B); 7656 b1 = new_block(cstate, JMP(BPF_JSET)); 7657 b1->s.k = 0x04; 7658 b1->stmts = s; 7659 gen_not(b1); 7660 7661 /* 7662 * AND that with the checks for data and management 7663 * frames. 7664 */ 7665 gen_and(b1, b0); 7666 return b0; 7667 case DLT_IP_OVER_FC: 7668 b0 = gen_mac_multicast(cstate, 2); 7669 return b0; 7670 default: 7671 break; 7672 } 7673 /* Link not known to support multicasts */ 7674 break; 7675 7676 case Q_IP: 7677 b0 = gen_linktype(cstate, ETHERTYPE_IP); 7678 b1 = gen_cmp_ge(cstate, OR_LINKPL, 16, BPF_B, (bpf_int32)224); 7679 gen_and(b0, b1); 7680 return b1; 7681 7682 case Q_IPV6: 7683 b0 = gen_linktype(cstate, ETHERTYPE_IPV6); 7684 b1 = gen_cmp(cstate, OR_LINKPL, 24, BPF_B, (bpf_int32)255); 7685 gen_and(b0, b1); 7686 return b1; 7687 } 7688 bpf_error(cstate, "link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel"); 7689 /* NOTREACHED */ 7690 } 7691 7692 /* 7693 * Filter on inbound (dir == 0) or outbound (dir == 1) traffic. 7694 * Outbound traffic is sent by this machine, while inbound traffic is 7695 * sent by a remote machine (and may include packets destined for a 7696 * unicast or multicast link-layer address we are not subscribing to). 7697 * These are the same definitions implemented by pcap_setdirection(). 7698 * Capturing only unicast traffic destined for this host is probably 7699 * better accomplished using a higher-layer filter. 7700 */ 7701 struct block * 7702 gen_inbound(compiler_state_t *cstate, int dir) 7703 { 7704 register struct block *b0; 7705 7706 /* 7707 * Only some data link types support inbound/outbound qualifiers. 7708 */ 7709 switch (cstate->linktype) { 7710 case DLT_SLIP: 7711 b0 = gen_relation(cstate, BPF_JEQ, 7712 gen_load(cstate, Q_LINK, gen_loadi(cstate, 0), 1), 7713 gen_loadi(cstate, 0), 7714 dir); 7715 break; 7716 7717 case DLT_IPNET: 7718 if (dir) { 7719 /* match outgoing packets */ 7720 b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, IPNET_OUTBOUND); 7721 } else { 7722 /* match incoming packets */ 7723 b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, IPNET_INBOUND); 7724 } 7725 break; 7726 7727 case DLT_LINUX_SLL: 7728 /* match outgoing packets */ 7729 b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_H, LINUX_SLL_OUTGOING); 7730 if (!dir) { 7731 /* to filter on inbound traffic, invert the match */ 7732 gen_not(b0); 7733 } 7734 break; 7735 7736 #ifdef HAVE_NET_PFVAR_H 7737 case DLT_PFLOG: 7738 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, dir), BPF_B, 7739 (bpf_int32)((dir == 0) ? PF_IN : PF_OUT)); 7740 break; 7741 #endif 7742 7743 case DLT_PPP_PPPD: 7744 if (dir) { 7745 /* match outgoing packets */ 7746 b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_B, PPP_PPPD_OUT); 7747 } else { 7748 /* match incoming packets */ 7749 b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_B, PPP_PPPD_IN); 7750 } 7751 break; 7752 7753 case DLT_JUNIPER_MFR: 7754 case DLT_JUNIPER_MLFR: 7755 case DLT_JUNIPER_MLPPP: 7756 case DLT_JUNIPER_ATM1: 7757 case DLT_JUNIPER_ATM2: 7758 case DLT_JUNIPER_PPPOE: 7759 case DLT_JUNIPER_PPPOE_ATM: 7760 case DLT_JUNIPER_GGSN: 7761 case DLT_JUNIPER_ES: 7762 case DLT_JUNIPER_MONITOR: 7763 case DLT_JUNIPER_SERVICES: 7764 case DLT_JUNIPER_ETHER: 7765 case DLT_JUNIPER_PPP: 7766 case DLT_JUNIPER_FRELAY: 7767 case DLT_JUNIPER_CHDLC: 7768 case DLT_JUNIPER_VP: 7769 case DLT_JUNIPER_ST: 7770 case DLT_JUNIPER_ISM: 7771 case DLT_JUNIPER_VS: 7772 case DLT_JUNIPER_SRX_E2E: 7773 case DLT_JUNIPER_FIBRECHANNEL: 7774 case DLT_JUNIPER_ATM_CEMIC: 7775 7776 /* juniper flags (including direction) are stored 7777 * the byte after the 3-byte magic number */ 7778 if (dir) { 7779 /* match outgoing packets */ 7780 b0 = gen_mcmp(cstate, OR_LINKHDR, 3, BPF_B, 0, 0x01); 7781 } else { 7782 /* match incoming packets */ 7783 b0 = gen_mcmp(cstate, OR_LINKHDR, 3, BPF_B, 1, 0x01); 7784 } 7785 break; 7786 7787 default: 7788 /* 7789 * If we have packet meta-data indicating a direction, 7790 * and that metadata can be checked by BPF code, check 7791 * it. Otherwise, give up, as this link-layer type has 7792 * nothing in the packet data. 7793 * 7794 * Currently, the only platform where a BPF filter can 7795 * check that metadata is Linux with the in-kernel 7796 * BPF interpreter. If other packet capture mechanisms 7797 * and BPF filters also supported this, it would be 7798 * nice. It would be even better if they made that 7799 * metadata available so that we could provide it 7800 * with newer capture APIs, allowing it to be saved 7801 * in pcapng files. 7802 */ 7803 #if defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) 7804 /* 7805 * This is Linux with PF_PACKET support. 7806 * If this is a *live* capture, we can look at 7807 * special meta-data in the filter expression; 7808 * if it's a savefile, we can't. 7809 */ 7810 if (cstate->bpf_pcap->rfile != NULL) { 7811 /* We have a FILE *, so this is a savefile */ 7812 bpf_error(cstate, "inbound/outbound not supported on linktype %d when reading savefiles", 7813 cstate->linktype); 7814 b0 = NULL; 7815 /* NOTREACHED */ 7816 } 7817 /* match outgoing packets */ 7818 b0 = gen_cmp(cstate, OR_LINKHDR, SKF_AD_OFF + SKF_AD_PKTTYPE, BPF_H, 7819 PACKET_OUTGOING); 7820 if (!dir) { 7821 /* to filter on inbound traffic, invert the match */ 7822 gen_not(b0); 7823 } 7824 #else /* defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */ 7825 bpf_error(cstate, "inbound/outbound not supported on linktype %d", 7826 cstate->linktype); 7827 /* NOTREACHED */ 7828 #endif /* defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */ 7829 } 7830 return (b0); 7831 } 7832 7833 #ifdef HAVE_NET_PFVAR_H 7834 /* PF firewall log matched interface */ 7835 struct block * 7836 gen_pf_ifname(compiler_state_t *cstate, const char *ifname) 7837 { 7838 struct block *b0; 7839 u_int len, off; 7840 7841 if (cstate->linktype != DLT_PFLOG) { 7842 bpf_error(cstate, "ifname supported only on PF linktype"); 7843 /* NOTREACHED */ 7844 } 7845 len = sizeof(((struct pfloghdr *)0)->ifname); 7846 off = offsetof(struct pfloghdr, ifname); 7847 if (strlen(ifname) >= len) { 7848 bpf_error(cstate, "ifname interface names can only be %d characters", 7849 len-1); 7850 /* NOTREACHED */ 7851 } 7852 b0 = gen_bcmp(cstate, OR_LINKHDR, off, strlen(ifname), (const u_char *)ifname); 7853 return (b0); 7854 } 7855 7856 /* PF firewall log ruleset name */ 7857 struct block * 7858 gen_pf_ruleset(compiler_state_t *cstate, char *ruleset) 7859 { 7860 struct block *b0; 7861 7862 if (cstate->linktype != DLT_PFLOG) { 7863 bpf_error(cstate, "ruleset supported only on PF linktype"); 7864 /* NOTREACHED */ 7865 } 7866 7867 if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) { 7868 bpf_error(cstate, "ruleset names can only be %ld characters", 7869 (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1)); 7870 /* NOTREACHED */ 7871 } 7872 7873 b0 = gen_bcmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, ruleset), 7874 strlen(ruleset), (const u_char *)ruleset); 7875 return (b0); 7876 } 7877 7878 /* PF firewall log rule number */ 7879 struct block * 7880 gen_pf_rnr(compiler_state_t *cstate, int rnr) 7881 { 7882 struct block *b0; 7883 7884 if (cstate->linktype != DLT_PFLOG) { 7885 bpf_error(cstate, "rnr supported only on PF linktype"); 7886 /* NOTREACHED */ 7887 } 7888 7889 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, rulenr), BPF_W, 7890 (bpf_int32)rnr); 7891 return (b0); 7892 } 7893 7894 /* PF firewall log sub-rule number */ 7895 struct block * 7896 gen_pf_srnr(compiler_state_t *cstate, int srnr) 7897 { 7898 struct block *b0; 7899 7900 if (cstate->linktype != DLT_PFLOG) { 7901 bpf_error(cstate, "srnr supported only on PF linktype"); 7902 /* NOTREACHED */ 7903 } 7904 7905 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, subrulenr), BPF_W, 7906 (bpf_int32)srnr); 7907 return (b0); 7908 } 7909 7910 /* PF firewall log reason code */ 7911 struct block * 7912 gen_pf_reason(compiler_state_t *cstate, int reason) 7913 { 7914 struct block *b0; 7915 7916 if (cstate->linktype != DLT_PFLOG) { 7917 bpf_error(cstate, "reason supported only on PF linktype"); 7918 /* NOTREACHED */ 7919 } 7920 7921 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, reason), BPF_B, 7922 (bpf_int32)reason); 7923 return (b0); 7924 } 7925 7926 /* PF firewall log action */ 7927 struct block * 7928 gen_pf_action(compiler_state_t *cstate, int action) 7929 { 7930 struct block *b0; 7931 7932 if (cstate->linktype != DLT_PFLOG) { 7933 bpf_error(cstate, "action supported only on PF linktype"); 7934 /* NOTREACHED */ 7935 } 7936 7937 b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, action), BPF_B, 7938 (bpf_int32)action); 7939 return (b0); 7940 } 7941 #else /* !HAVE_NET_PFVAR_H */ 7942 struct block * 7943 gen_pf_ifname(compiler_state_t *cstate, const char *ifname _U_) 7944 { 7945 bpf_error(cstate, "libpcap was compiled without pf support"); 7946 /* NOTREACHED */ 7947 } 7948 7949 struct block * 7950 gen_pf_ruleset(compiler_state_t *cstate, char *ruleset _U_) 7951 { 7952 bpf_error(cstate, "libpcap was compiled on a machine without pf support"); 7953 /* NOTREACHED */ 7954 } 7955 7956 struct block * 7957 gen_pf_rnr(compiler_state_t *cstate, int rnr _U_) 7958 { 7959 bpf_error(cstate, "libpcap was compiled on a machine without pf support"); 7960 /* NOTREACHED */ 7961 } 7962 7963 struct block * 7964 gen_pf_srnr(compiler_state_t *cstate, int srnr _U_) 7965 { 7966 bpf_error(cstate, "libpcap was compiled on a machine without pf support"); 7967 /* NOTREACHED */ 7968 } 7969 7970 struct block * 7971 gen_pf_reason(compiler_state_t *cstate, int reason _U_) 7972 { 7973 bpf_error(cstate, "libpcap was compiled on a machine without pf support"); 7974 /* NOTREACHED */ 7975 } 7976 7977 struct block * 7978 gen_pf_action(compiler_state_t *cstate, int action _U_) 7979 { 7980 bpf_error(cstate, "libpcap was compiled on a machine without pf support"); 7981 /* NOTREACHED */ 7982 } 7983 #endif /* HAVE_NET_PFVAR_H */ 7984 7985 /* IEEE 802.11 wireless header */ 7986 struct block * 7987 gen_p80211_type(compiler_state_t *cstate, int type, int mask) 7988 { 7989 struct block *b0; 7990 7991 switch (cstate->linktype) { 7992 7993 case DLT_IEEE802_11: 7994 case DLT_PRISM_HEADER: 7995 case DLT_IEEE802_11_RADIO_AVS: 7996 case DLT_IEEE802_11_RADIO: 7997 b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, (bpf_int32)type, 7998 (bpf_int32)mask); 7999 break; 8000 8001 default: 8002 bpf_error(cstate, "802.11 link-layer types supported only on 802.11"); 8003 /* NOTREACHED */ 8004 } 8005 8006 return (b0); 8007 } 8008 8009 struct block * 8010 gen_p80211_fcdir(compiler_state_t *cstate, int fcdir) 8011 { 8012 struct block *b0; 8013 8014 switch (cstate->linktype) { 8015 8016 case DLT_IEEE802_11: 8017 case DLT_PRISM_HEADER: 8018 case DLT_IEEE802_11_RADIO_AVS: 8019 case DLT_IEEE802_11_RADIO: 8020 break; 8021 8022 default: 8023 bpf_error(cstate, "frame direction supported only with 802.11 headers"); 8024 /* NOTREACHED */ 8025 } 8026 8027 b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, (bpf_int32)fcdir, 8028 (bpf_u_int32)IEEE80211_FC1_DIR_MASK); 8029 8030 return (b0); 8031 } 8032 8033 struct block * 8034 gen_acode(compiler_state_t *cstate, const u_char *eaddr, struct qual q) 8035 { 8036 switch (cstate->linktype) { 8037 8038 case DLT_ARCNET: 8039 case DLT_ARCNET_LINUX: 8040 if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && 8041 q.proto == Q_LINK) 8042 return (gen_ahostop(cstate, eaddr, (int)q.dir)); 8043 else { 8044 bpf_error(cstate, "ARCnet address used in non-arc expression"); 8045 /* NOTREACHED */ 8046 } 8047 break; 8048 8049 default: 8050 bpf_error(cstate, "aid supported only on ARCnet"); 8051 /* NOTREACHED */ 8052 } 8053 } 8054 8055 static struct block * 8056 gen_ahostop(compiler_state_t *cstate, const u_char *eaddr, int dir) 8057 { 8058 register struct block *b0, *b1; 8059 8060 switch (dir) { 8061 /* src comes first, different from Ethernet */ 8062 case Q_SRC: 8063 return gen_bcmp(cstate, OR_LINKHDR, 0, 1, eaddr); 8064 8065 case Q_DST: 8066 return gen_bcmp(cstate, OR_LINKHDR, 1, 1, eaddr); 8067 8068 case Q_AND: 8069 b0 = gen_ahostop(cstate, eaddr, Q_SRC); 8070 b1 = gen_ahostop(cstate, eaddr, Q_DST); 8071 gen_and(b0, b1); 8072 return b1; 8073 8074 case Q_DEFAULT: 8075 case Q_OR: 8076 b0 = gen_ahostop(cstate, eaddr, Q_SRC); 8077 b1 = gen_ahostop(cstate, eaddr, Q_DST); 8078 gen_or(b0, b1); 8079 return b1; 8080 8081 case Q_ADDR1: 8082 bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); 8083 break; 8084 8085 case Q_ADDR2: 8086 bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); 8087 break; 8088 8089 case Q_ADDR3: 8090 bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); 8091 break; 8092 8093 case Q_ADDR4: 8094 bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); 8095 break; 8096 8097 case Q_RA: 8098 bpf_error(cstate, "'ra' is only supported on 802.11"); 8099 break; 8100 8101 case Q_TA: 8102 bpf_error(cstate, "'ta' is only supported on 802.11"); 8103 break; 8104 } 8105 abort(); 8106 /* NOTREACHED */ 8107 } 8108 8109 static struct block * 8110 gen_vlan_tpid_test(compiler_state_t *cstate) 8111 { 8112 struct block *b0, *b1; 8113 8114 /* check for VLAN, including QinQ */ 8115 b0 = gen_linktype(cstate, ETHERTYPE_8021Q); 8116 b1 = gen_linktype(cstate, ETHERTYPE_8021AD); 8117 gen_or(b0,b1); 8118 b0 = b1; 8119 b1 = gen_linktype(cstate, ETHERTYPE_8021QINQ); 8120 gen_or(b0,b1); 8121 8122 return b1; 8123 } 8124 8125 static struct block * 8126 gen_vlan_vid_test(compiler_state_t *cstate, int vlan_num) 8127 { 8128 return gen_mcmp(cstate, OR_LINKPL, 0, BPF_H, (bpf_int32)vlan_num, 0x0fff); 8129 } 8130 8131 static struct block * 8132 gen_vlan_no_bpf_extensions(compiler_state_t *cstate, int vlan_num) 8133 { 8134 struct block *b0, *b1; 8135 8136 b0 = gen_vlan_tpid_test(cstate); 8137 8138 if (vlan_num >= 0) { 8139 b1 = gen_vlan_vid_test(cstate, vlan_num); 8140 gen_and(b0, b1); 8141 b0 = b1; 8142 } 8143 8144 /* 8145 * Both payload and link header type follow the VLAN tags so that 8146 * both need to be updated. 8147 */ 8148 cstate->off_linkpl.constant_part += 4; 8149 cstate->off_linktype.constant_part += 4; 8150 8151 return b0; 8152 } 8153 8154 #if defined(SKF_AD_VLAN_TAG_PRESENT) 8155 /* add v to variable part of off */ 8156 static void 8157 gen_vlan_vloffset_add(compiler_state_t *cstate, bpf_abs_offset *off, int v, struct slist *s) 8158 { 8159 struct slist *s2; 8160 8161 if (!off->is_variable) 8162 off->is_variable = 1; 8163 if (off->reg == -1) 8164 off->reg = alloc_reg(cstate); 8165 8166 s2 = new_stmt(cstate, BPF_LD|BPF_MEM); 8167 s2->s.k = off->reg; 8168 sappend(s, s2); 8169 s2 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_IMM); 8170 s2->s.k = v; 8171 sappend(s, s2); 8172 s2 = new_stmt(cstate, BPF_ST); 8173 s2->s.k = off->reg; 8174 sappend(s, s2); 8175 } 8176 8177 /* 8178 * patch block b_tpid (VLAN TPID test) to update variable parts of link payload 8179 * and link type offsets first 8180 */ 8181 static void 8182 gen_vlan_patch_tpid_test(compiler_state_t *cstate, struct block *b_tpid) 8183 { 8184 struct slist s; 8185 8186 /* offset determined at run time, shift variable part */ 8187 s.next = NULL; 8188 cstate->is_vlan_vloffset = 1; 8189 gen_vlan_vloffset_add(cstate, &cstate->off_linkpl, 4, &s); 8190 gen_vlan_vloffset_add(cstate, &cstate->off_linktype, 4, &s); 8191 8192 /* we get a pointer to a chain of or-ed blocks, patch first of them */ 8193 sappend(s.next, b_tpid->head->stmts); 8194 b_tpid->head->stmts = s.next; 8195 } 8196 8197 /* 8198 * patch block b_vid (VLAN id test) to load VID value either from packet 8199 * metadata (using BPF extensions) if SKF_AD_VLAN_TAG_PRESENT is true 8200 */ 8201 static void 8202 gen_vlan_patch_vid_test(compiler_state_t *cstate, struct block *b_vid) 8203 { 8204 struct slist *s, *s2, *sjeq; 8205 unsigned cnt; 8206 8207 s = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 8208 s->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT; 8209 8210 /* true -> next instructions, false -> beginning of b_vid */ 8211 sjeq = new_stmt(cstate, JMP(BPF_JEQ)); 8212 sjeq->s.k = 1; 8213 sjeq->s.jf = b_vid->stmts; 8214 sappend(s, sjeq); 8215 8216 s2 = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 8217 s2->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG; 8218 sappend(s, s2); 8219 sjeq->s.jt = s2; 8220 8221 /* jump to the test in b_vid (bypass loading VID from packet data) */ 8222 cnt = 0; 8223 for (s2 = b_vid->stmts; s2; s2 = s2->next) 8224 cnt++; 8225 s2 = new_stmt(cstate, JMP(BPF_JA)); 8226 s2->s.k = cnt; 8227 sappend(s, s2); 8228 8229 /* insert our statements at the beginning of b_vid */ 8230 sappend(s, b_vid->stmts); 8231 b_vid->stmts = s; 8232 } 8233 8234 /* 8235 * Generate check for "vlan" or "vlan <id>" on systems with support for BPF 8236 * extensions. Even if kernel supports VLAN BPF extensions, (outermost) VLAN 8237 * tag can be either in metadata or in packet data; therefore if the 8238 * SKF_AD_VLAN_TAG_PRESENT test is negative, we need to check link 8239 * header for VLAN tag. As the decision is done at run time, we need 8240 * update variable part of the offsets 8241 */ 8242 static struct block * 8243 gen_vlan_bpf_extensions(compiler_state_t *cstate, int vlan_num) 8244 { 8245 struct block *b0, *b_tpid, *b_vid = NULL; 8246 struct slist *s; 8247 8248 /* generate new filter code based on extracting packet 8249 * metadata */ 8250 s = new_stmt(cstate, BPF_LD|BPF_B|BPF_ABS); 8251 s->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT; 8252 8253 b0 = new_block(cstate, JMP(BPF_JEQ)); 8254 b0->stmts = s; 8255 b0->s.k = 1; 8256 8257 /* 8258 * This is tricky. We need to insert the statements updating variable 8259 * parts of offsets before the the traditional TPID and VID tests so 8260 * that they are called whenever SKF_AD_VLAN_TAG_PRESENT fails but 8261 * we do not want this update to affect those checks. That's why we 8262 * generate both test blocks first and insert the statements updating 8263 * variable parts of both offsets after that. This wouldn't work if 8264 * there already were variable length link header when entering this 8265 * function but gen_vlan_bpf_extensions() isn't called in that case. 8266 */ 8267 b_tpid = gen_vlan_tpid_test(cstate); 8268 if (vlan_num >= 0) 8269 b_vid = gen_vlan_vid_test(cstate, vlan_num); 8270 8271 gen_vlan_patch_tpid_test(cstate, b_tpid); 8272 gen_or(b0, b_tpid); 8273 b0 = b_tpid; 8274 8275 if (vlan_num >= 0) { 8276 gen_vlan_patch_vid_test(cstate, b_vid); 8277 gen_and(b0, b_vid); 8278 b0 = b_vid; 8279 } 8280 8281 return b0; 8282 } 8283 #endif 8284 8285 /* 8286 * support IEEE 802.1Q VLAN trunk over ethernet 8287 */ 8288 struct block * 8289 gen_vlan(compiler_state_t *cstate, int vlan_num) 8290 { 8291 struct block *b0; 8292 8293 /* can't check for VLAN-encapsulated packets inside MPLS */ 8294 if (cstate->label_stack_depth > 0) 8295 bpf_error(cstate, "no VLAN match after MPLS"); 8296 8297 /* 8298 * Check for a VLAN packet, and then change the offsets to point 8299 * to the type and data fields within the VLAN packet. Just 8300 * increment the offsets, so that we can support a hierarchy, e.g. 8301 * "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within 8302 * VLAN 100. 8303 * 8304 * XXX - this is a bit of a kludge. If we were to split the 8305 * compiler into a parser that parses an expression and 8306 * generates an expression tree, and a code generator that 8307 * takes an expression tree (which could come from our 8308 * parser or from some other parser) and generates BPF code, 8309 * we could perhaps make the offsets parameters of routines 8310 * and, in the handler for an "AND" node, pass to subnodes 8311 * other than the VLAN node the adjusted offsets. 8312 * 8313 * This would mean that "vlan" would, instead of changing the 8314 * behavior of *all* tests after it, change only the behavior 8315 * of tests ANDed with it. That would change the documented 8316 * semantics of "vlan", which might break some expressions. 8317 * However, it would mean that "(vlan and ip) or ip" would check 8318 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than 8319 * checking only for VLAN-encapsulated IP, so that could still 8320 * be considered worth doing; it wouldn't break expressions 8321 * that are of the form "vlan and ..." or "vlan N and ...", 8322 * which I suspect are the most common expressions involving 8323 * "vlan". "vlan or ..." doesn't necessarily do what the user 8324 * would really want, now, as all the "or ..." tests would 8325 * be done assuming a VLAN, even though the "or" could be viewed 8326 * as meaning "or, if this isn't a VLAN packet...". 8327 */ 8328 switch (cstate->linktype) { 8329 8330 case DLT_EN10MB: 8331 case DLT_NETANALYZER: 8332 case DLT_NETANALYZER_TRANSPARENT: 8333 #if defined(SKF_AD_VLAN_TAG_PRESENT) 8334 /* Verify that this is the outer part of the packet and 8335 * not encapsulated somehow. */ 8336 if (cstate->vlan_stack_depth == 0 && !cstate->off_linkhdr.is_variable && 8337 cstate->off_linkhdr.constant_part == 8338 cstate->off_outermostlinkhdr.constant_part) { 8339 /* 8340 * Do we need special VLAN handling? 8341 */ 8342 if (cstate->bpf_pcap->bpf_codegen_flags & BPF_SPECIAL_VLAN_HANDLING) 8343 b0 = gen_vlan_bpf_extensions(cstate, vlan_num); 8344 else 8345 b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num); 8346 } else 8347 #endif 8348 b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num); 8349 break; 8350 8351 case DLT_IEEE802_11: 8352 case DLT_PRISM_HEADER: 8353 case DLT_IEEE802_11_RADIO_AVS: 8354 case DLT_IEEE802_11_RADIO: 8355 b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num); 8356 break; 8357 8358 default: 8359 bpf_error(cstate, "no VLAN support for data link type %d", 8360 cstate->linktype); 8361 /*NOTREACHED*/ 8362 } 8363 8364 cstate->vlan_stack_depth++; 8365 8366 return (b0); 8367 } 8368 8369 /* 8370 * support for MPLS 8371 */ 8372 struct block * 8373 gen_mpls(compiler_state_t *cstate, int label_num) 8374 { 8375 struct block *b0, *b1; 8376 8377 if (cstate->label_stack_depth > 0) { 8378 /* just match the bottom-of-stack bit clear */ 8379 b0 = gen_mcmp(cstate, OR_PREVMPLSHDR, 2, BPF_B, 0, 0x01); 8380 } else { 8381 /* 8382 * We're not in an MPLS stack yet, so check the link-layer 8383 * type against MPLS. 8384 */ 8385 switch (cstate->linktype) { 8386 8387 case DLT_C_HDLC: /* fall through */ 8388 case DLT_EN10MB: 8389 case DLT_NETANALYZER: 8390 case DLT_NETANALYZER_TRANSPARENT: 8391 b0 = gen_linktype(cstate, ETHERTYPE_MPLS); 8392 break; 8393 8394 case DLT_PPP: 8395 b0 = gen_linktype(cstate, PPP_MPLS_UCAST); 8396 break; 8397 8398 /* FIXME add other DLT_s ... 8399 * for Frame-Relay/and ATM this may get messy due to SNAP headers 8400 * leave it for now */ 8401 8402 default: 8403 bpf_error(cstate, "no MPLS support for data link type %d", 8404 cstate->linktype); 8405 /*NOTREACHED*/ 8406 break; 8407 } 8408 } 8409 8410 /* If a specific MPLS label is requested, check it */ 8411 if (label_num >= 0) { 8412 label_num = label_num << 12; /* label is shifted 12 bits on the wire */ 8413 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, (bpf_int32)label_num, 8414 0xfffff000); /* only compare the first 20 bits */ 8415 gen_and(b0, b1); 8416 b0 = b1; 8417 } 8418 8419 /* 8420 * Change the offsets to point to the type and data fields within 8421 * the MPLS packet. Just increment the offsets, so that we 8422 * can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to 8423 * capture packets with an outer label of 100000 and an inner 8424 * label of 1024. 8425 * 8426 * Increment the MPLS stack depth as well; this indicates that 8427 * we're checking MPLS-encapsulated headers, to make sure higher 8428 * level code generators don't try to match against IP-related 8429 * protocols such as Q_ARP, Q_RARP etc. 8430 * 8431 * XXX - this is a bit of a kludge. See comments in gen_vlan(). 8432 */ 8433 cstate->off_nl_nosnap += 4; 8434 cstate->off_nl += 4; 8435 cstate->label_stack_depth++; 8436 return (b0); 8437 } 8438 8439 /* 8440 * Support PPPOE discovery and session. 8441 */ 8442 struct block * 8443 gen_pppoed(compiler_state_t *cstate) 8444 { 8445 /* check for PPPoE discovery */ 8446 return gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOED); 8447 } 8448 8449 struct block * 8450 gen_pppoes(compiler_state_t *cstate, int sess_num) 8451 { 8452 struct block *b0, *b1; 8453 8454 /* 8455 * Test against the PPPoE session link-layer type. 8456 */ 8457 b0 = gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOES); 8458 8459 /* If a specific session is requested, check PPPoE session id */ 8460 if (sess_num >= 0) { 8461 b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, 8462 (bpf_int32)sess_num, 0x0000ffff); 8463 gen_and(b0, b1); 8464 b0 = b1; 8465 } 8466 8467 /* 8468 * Change the offsets to point to the type and data fields within 8469 * the PPP packet, and note that this is PPPoE rather than 8470 * raw PPP. 8471 * 8472 * XXX - this is a bit of a kludge. If we were to split the 8473 * compiler into a parser that parses an expression and 8474 * generates an expression tree, and a code generator that 8475 * takes an expression tree (which could come from our 8476 * parser or from some other parser) and generates BPF code, 8477 * we could perhaps make the offsets parameters of routines 8478 * and, in the handler for an "AND" node, pass to subnodes 8479 * other than the PPPoE node the adjusted offsets. 8480 * 8481 * This would mean that "pppoes" would, instead of changing the 8482 * behavior of *all* tests after it, change only the behavior 8483 * of tests ANDed with it. That would change the documented 8484 * semantics of "pppoes", which might break some expressions. 8485 * However, it would mean that "(pppoes and ip) or ip" would check 8486 * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than 8487 * checking only for VLAN-encapsulated IP, so that could still 8488 * be considered worth doing; it wouldn't break expressions 8489 * that are of the form "pppoes and ..." which I suspect are the 8490 * most common expressions involving "pppoes". "pppoes or ..." 8491 * doesn't necessarily do what the user would really want, now, 8492 * as all the "or ..." tests would be done assuming PPPoE, even 8493 * though the "or" could be viewed as meaning "or, if this isn't 8494 * a PPPoE packet...". 8495 * 8496 * The "network-layer" protocol is PPPoE, which has a 6-byte 8497 * PPPoE header, followed by a PPP packet. 8498 * 8499 * There is no HDLC encapsulation for the PPP packet (it's 8500 * encapsulated in PPPoES instead), so the link-layer type 8501 * starts at the first byte of the PPP packet. For PPPoE, 8502 * that offset is relative to the beginning of the total 8503 * link-layer payload, including any 802.2 LLC header, so 8504 * it's 6 bytes past cstate->off_nl. 8505 */ 8506 PUSH_LINKHDR(cstate, DLT_PPP, cstate->off_linkpl.is_variable, 8507 cstate->off_linkpl.constant_part + cstate->off_nl + 6, /* 6 bytes past the PPPoE header */ 8508 cstate->off_linkpl.reg); 8509 8510 cstate->off_linktype = cstate->off_linkhdr; 8511 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 2; 8512 8513 cstate->off_nl = 0; 8514 cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ 8515 8516 return b0; 8517 } 8518 8519 /* Check that this is Geneve and the VNI is correct if 8520 * specified. Parameterized to handle both IPv4 and IPv6. */ 8521 static struct block * 8522 gen_geneve_check(compiler_state_t *cstate, 8523 struct block *(*gen_portfn)(compiler_state_t *, int, int, int), 8524 enum e_offrel offrel, int vni) 8525 { 8526 struct block *b0, *b1; 8527 8528 b0 = gen_portfn(cstate, GENEVE_PORT, IPPROTO_UDP, Q_DST); 8529 8530 /* Check that we are operating on version 0. Otherwise, we 8531 * can't decode the rest of the fields. The version is 2 bits 8532 * in the first byte of the Geneve header. */ 8533 b1 = gen_mcmp(cstate, offrel, 8, BPF_B, (bpf_int32)0, 0xc0); 8534 gen_and(b0, b1); 8535 b0 = b1; 8536 8537 if (vni >= 0) { 8538 vni <<= 8; /* VNI is in the upper 3 bytes */ 8539 b1 = gen_mcmp(cstate, offrel, 12, BPF_W, (bpf_int32)vni, 8540 0xffffff00); 8541 gen_and(b0, b1); 8542 b0 = b1; 8543 } 8544 8545 return b0; 8546 } 8547 8548 /* The IPv4 and IPv6 Geneve checks need to do two things: 8549 * - Verify that this actually is Geneve with the right VNI. 8550 * - Place the IP header length (plus variable link prefix if 8551 * needed) into register A to be used later to compute 8552 * the inner packet offsets. */ 8553 static struct block * 8554 gen_geneve4(compiler_state_t *cstate, int vni) 8555 { 8556 struct block *b0, *b1; 8557 struct slist *s, *s1; 8558 8559 b0 = gen_geneve_check(cstate, gen_port, OR_TRAN_IPV4, vni); 8560 8561 /* Load the IP header length into A. */ 8562 s = gen_loadx_iphdrlen(cstate); 8563 8564 s1 = new_stmt(cstate, BPF_MISC|BPF_TXA); 8565 sappend(s, s1); 8566 8567 /* Forcibly append these statements to the true condition 8568 * of the protocol check by creating a new block that is 8569 * always true and ANDing them. */ 8570 b1 = new_block(cstate, BPF_JMP|BPF_JEQ|BPF_X); 8571 b1->stmts = s; 8572 b1->s.k = 0; 8573 8574 gen_and(b0, b1); 8575 8576 return b1; 8577 } 8578 8579 static struct block * 8580 gen_geneve6(compiler_state_t *cstate, int vni) 8581 { 8582 struct block *b0, *b1; 8583 struct slist *s, *s1; 8584 8585 b0 = gen_geneve_check(cstate, gen_port6, OR_TRAN_IPV6, vni); 8586 8587 /* Load the IP header length. We need to account for a 8588 * variable length link prefix if there is one. */ 8589 s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl); 8590 if (s) { 8591 s1 = new_stmt(cstate, BPF_LD|BPF_IMM); 8592 s1->s.k = 40; 8593 sappend(s, s1); 8594 8595 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X); 8596 s1->s.k = 0; 8597 sappend(s, s1); 8598 } else { 8599 s = new_stmt(cstate, BPF_LD|BPF_IMM); 8600 s->s.k = 40; 8601 } 8602 8603 /* Forcibly append these statements to the true condition 8604 * of the protocol check by creating a new block that is 8605 * always true and ANDing them. */ 8606 s1 = new_stmt(cstate, BPF_MISC|BPF_TAX); 8607 sappend(s, s1); 8608 8609 b1 = new_block(cstate, BPF_JMP|BPF_JEQ|BPF_X); 8610 b1->stmts = s; 8611 b1->s.k = 0; 8612 8613 gen_and(b0, b1); 8614 8615 return b1; 8616 } 8617 8618 /* We need to store three values based on the Geneve header:: 8619 * - The offset of the linktype. 8620 * - The offset of the end of the Geneve header. 8621 * - The offset of the end of the encapsulated MAC header. */ 8622 static struct slist * 8623 gen_geneve_offsets(compiler_state_t *cstate) 8624 { 8625 struct slist *s, *s1, *s_proto; 8626 8627 /* First we need to calculate the offset of the Geneve header 8628 * itself. This is composed of the IP header previously calculated 8629 * (include any variable link prefix) and stored in A plus the 8630 * fixed sized headers (fixed link prefix, MAC length, and UDP 8631 * header). */ 8632 s = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 8633 s->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 8; 8634 8635 /* Stash this in X since we'll need it later. */ 8636 s1 = new_stmt(cstate, BPF_MISC|BPF_TAX); 8637 sappend(s, s1); 8638 8639 /* The EtherType in Geneve is 2 bytes in. Calculate this and 8640 * store it. */ 8641 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 8642 s1->s.k = 2; 8643 sappend(s, s1); 8644 8645 cstate->off_linktype.reg = alloc_reg(cstate); 8646 cstate->off_linktype.is_variable = 1; 8647 cstate->off_linktype.constant_part = 0; 8648 8649 s1 = new_stmt(cstate, BPF_ST); 8650 s1->s.k = cstate->off_linktype.reg; 8651 sappend(s, s1); 8652 8653 /* Load the Geneve option length and mask and shift to get the 8654 * number of bytes. It is stored in the first byte of the Geneve 8655 * header. */ 8656 s1 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_B); 8657 s1->s.k = 0; 8658 sappend(s, s1); 8659 8660 s1 = new_stmt(cstate, BPF_ALU|BPF_AND|BPF_K); 8661 s1->s.k = 0x3f; 8662 sappend(s, s1); 8663 8664 s1 = new_stmt(cstate, BPF_ALU|BPF_MUL|BPF_K); 8665 s1->s.k = 4; 8666 sappend(s, s1); 8667 8668 /* Add in the rest of the Geneve base header. */ 8669 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 8670 s1->s.k = 8; 8671 sappend(s, s1); 8672 8673 /* Add the Geneve header length to its offset and store. */ 8674 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_X); 8675 s1->s.k = 0; 8676 sappend(s, s1); 8677 8678 /* Set the encapsulated type as Ethernet. Even though we may 8679 * not actually have Ethernet inside there are two reasons this 8680 * is useful: 8681 * - The linktype field is always in EtherType format regardless 8682 * of whether it is in Geneve or an inner Ethernet frame. 8683 * - The only link layer that we have specific support for is 8684 * Ethernet. We will confirm that the packet actually is 8685 * Ethernet at runtime before executing these checks. */ 8686 PUSH_LINKHDR(cstate, DLT_EN10MB, 1, 0, alloc_reg(cstate)); 8687 8688 s1 = new_stmt(cstate, BPF_ST); 8689 s1->s.k = cstate->off_linkhdr.reg; 8690 sappend(s, s1); 8691 8692 /* Calculate whether we have an Ethernet header or just raw IP/ 8693 * MPLS/etc. If we have Ethernet, advance the end of the MAC offset 8694 * and linktype by 14 bytes so that the network header can be found 8695 * seamlessly. Otherwise, keep what we've calculated already. */ 8696 8697 /* We have a bare jmp so we can't use the optimizer. */ 8698 cstate->no_optimize = 1; 8699 8700 /* Load the EtherType in the Geneve header, 2 bytes in. */ 8701 s1 = new_stmt(cstate, BPF_LD|BPF_IND|BPF_H); 8702 s1->s.k = 2; 8703 sappend(s, s1); 8704 8705 /* Load X with the end of the Geneve header. */ 8706 s1 = new_stmt(cstate, BPF_LDX|BPF_MEM); 8707 s1->s.k = cstate->off_linkhdr.reg; 8708 sappend(s, s1); 8709 8710 /* Check if the EtherType is Transparent Ethernet Bridging. At the 8711 * end of this check, we should have the total length in X. In 8712 * the non-Ethernet case, it's already there. */ 8713 s_proto = new_stmt(cstate, JMP(BPF_JEQ)); 8714 s_proto->s.k = ETHERTYPE_TEB; 8715 sappend(s, s_proto); 8716 8717 s1 = new_stmt(cstate, BPF_MISC|BPF_TXA); 8718 sappend(s, s1); 8719 s_proto->s.jt = s1; 8720 8721 /* Since this is Ethernet, use the EtherType of the payload 8722 * directly as the linktype. Overwrite what we already have. */ 8723 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 8724 s1->s.k = 12; 8725 sappend(s, s1); 8726 8727 s1 = new_stmt(cstate, BPF_ST); 8728 s1->s.k = cstate->off_linktype.reg; 8729 sappend(s, s1); 8730 8731 /* Advance two bytes further to get the end of the Ethernet 8732 * header. */ 8733 s1 = new_stmt(cstate, BPF_ALU|BPF_ADD|BPF_K); 8734 s1->s.k = 2; 8735 sappend(s, s1); 8736 8737 /* Move the result to X. */ 8738 s1 = new_stmt(cstate, BPF_MISC|BPF_TAX); 8739 sappend(s, s1); 8740 8741 /* Store the final result of our linkpl calculation. */ 8742 cstate->off_linkpl.reg = alloc_reg(cstate); 8743 cstate->off_linkpl.is_variable = 1; 8744 cstate->off_linkpl.constant_part = 0; 8745 8746 s1 = new_stmt(cstate, BPF_STX); 8747 s1->s.k = cstate->off_linkpl.reg; 8748 sappend(s, s1); 8749 s_proto->s.jf = s1; 8750 8751 cstate->off_nl = 0; 8752 8753 return s; 8754 } 8755 8756 /* Check to see if this is a Geneve packet. */ 8757 struct block * 8758 gen_geneve(compiler_state_t *cstate, int vni) 8759 { 8760 struct block *b0, *b1; 8761 struct slist *s; 8762 8763 b0 = gen_geneve4(cstate, vni); 8764 b1 = gen_geneve6(cstate, vni); 8765 8766 gen_or(b0, b1); 8767 b0 = b1; 8768 8769 /* Later filters should act on the payload of the Geneve frame, 8770 * update all of the header pointers. Attach this code so that 8771 * it gets executed in the event that the Geneve filter matches. */ 8772 s = gen_geneve_offsets(cstate); 8773 8774 b1 = gen_true(cstate); 8775 sappend(s, b1->stmts); 8776 b1->stmts = s; 8777 8778 gen_and(b0, b1); 8779 8780 cstate->is_geneve = 1; 8781 8782 return b1; 8783 } 8784 8785 /* Check that the encapsulated frame has a link layer header 8786 * for Ethernet filters. */ 8787 static struct block * 8788 gen_geneve_ll_check(compiler_state_t *cstate) 8789 { 8790 struct block *b0; 8791 struct slist *s, *s1; 8792 8793 /* The easiest way to see if there is a link layer present 8794 * is to check if the link layer header and payload are not 8795 * the same. */ 8796 8797 /* Geneve always generates pure variable offsets so we can 8798 * compare only the registers. */ 8799 s = new_stmt(cstate, BPF_LD|BPF_MEM); 8800 s->s.k = cstate->off_linkhdr.reg; 8801 8802 s1 = new_stmt(cstate, BPF_LDX|BPF_MEM); 8803 s1->s.k = cstate->off_linkpl.reg; 8804 sappend(s, s1); 8805 8806 b0 = new_block(cstate, BPF_JMP|BPF_JEQ|BPF_X); 8807 b0->stmts = s; 8808 b0->s.k = 0; 8809 gen_not(b0); 8810 8811 return b0; 8812 } 8813 8814 struct block * 8815 gen_atmfield_code(compiler_state_t *cstate, int atmfield, bpf_int32 jvalue, 8816 bpf_u_int32 jtype, int reverse) 8817 { 8818 struct block *b0; 8819 8820 switch (atmfield) { 8821 8822 case A_VPI: 8823 if (!cstate->is_atm) 8824 bpf_error(cstate, "'vpi' supported only on raw ATM"); 8825 if (cstate->off_vpi == OFFSET_NOT_SET) 8826 abort(); 8827 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vpi, BPF_B, 0xffffffff, jtype, 8828 reverse, jvalue); 8829 break; 8830 8831 case A_VCI: 8832 if (!cstate->is_atm) 8833 bpf_error(cstate, "'vci' supported only on raw ATM"); 8834 if (cstate->off_vci == OFFSET_NOT_SET) 8835 abort(); 8836 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vci, BPF_H, 0xffffffff, jtype, 8837 reverse, jvalue); 8838 break; 8839 8840 case A_PROTOTYPE: 8841 if (cstate->off_proto == OFFSET_NOT_SET) 8842 abort(); /* XXX - this isn't on FreeBSD */ 8843 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 0x0f, jtype, 8844 reverse, jvalue); 8845 break; 8846 8847 case A_MSGTYPE: 8848 if (cstate->off_payload == OFFSET_NOT_SET) 8849 abort(); 8850 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_payload + MSG_TYPE_POS, BPF_B, 8851 0xffffffff, jtype, reverse, jvalue); 8852 break; 8853 8854 case A_CALLREFTYPE: 8855 if (!cstate->is_atm) 8856 bpf_error(cstate, "'callref' supported only on raw ATM"); 8857 if (cstate->off_proto == OFFSET_NOT_SET) 8858 abort(); 8859 b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 0xffffffff, 8860 jtype, reverse, jvalue); 8861 break; 8862 8863 default: 8864 abort(); 8865 } 8866 return b0; 8867 } 8868 8869 struct block * 8870 gen_atmtype_abbrev(compiler_state_t *cstate, int type) 8871 { 8872 struct block *b0, *b1; 8873 8874 switch (type) { 8875 8876 case A_METAC: 8877 /* Get all packets in Meta signalling Circuit */ 8878 if (!cstate->is_atm) 8879 bpf_error(cstate, "'metac' supported only on raw ATM"); 8880 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 8881 b1 = gen_atmfield_code(cstate, A_VCI, 1, BPF_JEQ, 0); 8882 gen_and(b0, b1); 8883 break; 8884 8885 case A_BCC: 8886 /* Get all packets in Broadcast Circuit*/ 8887 if (!cstate->is_atm) 8888 bpf_error(cstate, "'bcc' supported only on raw ATM"); 8889 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 8890 b1 = gen_atmfield_code(cstate, A_VCI, 2, BPF_JEQ, 0); 8891 gen_and(b0, b1); 8892 break; 8893 8894 case A_OAMF4SC: 8895 /* Get all cells in Segment OAM F4 circuit*/ 8896 if (!cstate->is_atm) 8897 bpf_error(cstate, "'oam4sc' supported only on raw ATM"); 8898 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 8899 b1 = gen_atmfield_code(cstate, A_VCI, 3, BPF_JEQ, 0); 8900 gen_and(b0, b1); 8901 break; 8902 8903 case A_OAMF4EC: 8904 /* Get all cells in End-to-End OAM F4 Circuit*/ 8905 if (!cstate->is_atm) 8906 bpf_error(cstate, "'oam4ec' supported only on raw ATM"); 8907 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 8908 b1 = gen_atmfield_code(cstate, A_VCI, 4, BPF_JEQ, 0); 8909 gen_and(b0, b1); 8910 break; 8911 8912 case A_SC: 8913 /* Get all packets in connection Signalling Circuit */ 8914 if (!cstate->is_atm) 8915 bpf_error(cstate, "'sc' supported only on raw ATM"); 8916 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 8917 b1 = gen_atmfield_code(cstate, A_VCI, 5, BPF_JEQ, 0); 8918 gen_and(b0, b1); 8919 break; 8920 8921 case A_ILMIC: 8922 /* Get all packets in ILMI Circuit */ 8923 if (!cstate->is_atm) 8924 bpf_error(cstate, "'ilmic' supported only on raw ATM"); 8925 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 8926 b1 = gen_atmfield_code(cstate, A_VCI, 16, BPF_JEQ, 0); 8927 gen_and(b0, b1); 8928 break; 8929 8930 case A_LANE: 8931 /* Get all LANE packets */ 8932 if (!cstate->is_atm) 8933 bpf_error(cstate, "'lane' supported only on raw ATM"); 8934 b1 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LANE, BPF_JEQ, 0); 8935 8936 /* 8937 * Arrange that all subsequent tests assume LANE 8938 * rather than LLC-encapsulated packets, and set 8939 * the offsets appropriately for LANE-encapsulated 8940 * Ethernet. 8941 * 8942 * We assume LANE means Ethernet, not Token Ring. 8943 */ 8944 PUSH_LINKHDR(cstate, DLT_EN10MB, 0, 8945 cstate->off_payload + 2, /* Ethernet header */ 8946 -1); 8947 cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12; 8948 cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* Ethernet */ 8949 cstate->off_nl = 0; /* Ethernet II */ 8950 cstate->off_nl_nosnap = 3; /* 802.3+802.2 */ 8951 break; 8952 8953 case A_LLC: 8954 /* Get all LLC-encapsulated packets */ 8955 if (!cstate->is_atm) 8956 bpf_error(cstate, "'llc' supported only on raw ATM"); 8957 b1 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); 8958 cstate->linktype = cstate->prevlinktype; 8959 break; 8960 8961 default: 8962 abort(); 8963 } 8964 return b1; 8965 } 8966 8967 /* 8968 * Filtering for MTP2 messages based on li value 8969 * FISU, length is null 8970 * LSSU, length is 1 or 2 8971 * MSU, length is 3 or more 8972 * For MTP2_HSL, sequences are on 2 bytes, and length on 9 bits 8973 */ 8974 struct block * 8975 gen_mtp2type_abbrev(compiler_state_t *cstate, int type) 8976 { 8977 struct block *b0, *b1; 8978 8979 switch (type) { 8980 8981 case M_FISU: 8982 if ( (cstate->linktype != DLT_MTP2) && 8983 (cstate->linktype != DLT_ERF) && 8984 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 8985 bpf_error(cstate, "'fisu' supported only on MTP2"); 8986 /* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */ 8987 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JEQ, 0, 0); 8988 break; 8989 8990 case M_LSSU: 8991 if ( (cstate->linktype != DLT_MTP2) && 8992 (cstate->linktype != DLT_ERF) && 8993 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 8994 bpf_error(cstate, "'lssu' supported only on MTP2"); 8995 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 1, 2); 8996 b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 0, 0); 8997 gen_and(b1, b0); 8998 break; 8999 9000 case M_MSU: 9001 if ( (cstate->linktype != DLT_MTP2) && 9002 (cstate->linktype != DLT_ERF) && 9003 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9004 bpf_error(cstate, "'msu' supported only on MTP2"); 9005 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 0, 2); 9006 break; 9007 9008 case MH_FISU: 9009 if ( (cstate->linktype != DLT_MTP2) && 9010 (cstate->linktype != DLT_ERF) && 9011 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9012 bpf_error(cstate, "'hfisu' supported only on MTP2_HSL"); 9013 /* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */ 9014 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JEQ, 0, 0); 9015 break; 9016 9017 case MH_LSSU: 9018 if ( (cstate->linktype != DLT_MTP2) && 9019 (cstate->linktype != DLT_ERF) && 9020 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9021 bpf_error(cstate, "'hlssu' supported only on MTP2_HSL"); 9022 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 1, 0x0100); 9023 b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 0, 0); 9024 gen_and(b1, b0); 9025 break; 9026 9027 case MH_MSU: 9028 if ( (cstate->linktype != DLT_MTP2) && 9029 (cstate->linktype != DLT_ERF) && 9030 (cstate->linktype != DLT_MTP2_WITH_PHDR) ) 9031 bpf_error(cstate, "'hmsu' supported only on MTP2_HSL"); 9032 b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 0, 0x0100); 9033 break; 9034 9035 default: 9036 abort(); 9037 } 9038 return b0; 9039 } 9040 9041 struct block * 9042 gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, bpf_u_int32 jvalue, 9043 bpf_u_int32 jtype, int reverse) 9044 { 9045 struct block *b0; 9046 bpf_u_int32 val1 , val2 , val3; 9047 u_int newoff_sio = cstate->off_sio; 9048 u_int newoff_opc = cstate->off_opc; 9049 u_int newoff_dpc = cstate->off_dpc; 9050 u_int newoff_sls = cstate->off_sls; 9051 9052 switch (mtp3field) { 9053 9054 case MH_SIO: 9055 newoff_sio += 3; /* offset for MTP2_HSL */ 9056 /* FALLTHROUGH */ 9057 9058 case M_SIO: 9059 if (cstate->off_sio == OFFSET_NOT_SET) 9060 bpf_error(cstate, "'sio' supported only on SS7"); 9061 /* sio coded on 1 byte so max value 255 */ 9062 if(jvalue > 255) 9063 bpf_error(cstate, "sio value %u too big; max value = 255", 9064 jvalue); 9065 b0 = gen_ncmp(cstate, OR_PACKET, newoff_sio, BPF_B, 0xffffffff, 9066 (u_int)jtype, reverse, (u_int)jvalue); 9067 break; 9068 9069 case MH_OPC: 9070 newoff_opc+=3; 9071 case M_OPC: 9072 if (cstate->off_opc == OFFSET_NOT_SET) 9073 bpf_error(cstate, "'opc' supported only on SS7"); 9074 /* opc coded on 14 bits so max value 16383 */ 9075 if (jvalue > 16383) 9076 bpf_error(cstate, "opc value %u too big; max value = 16383", 9077 jvalue); 9078 /* the following instructions are made to convert jvalue 9079 * to the form used to write opc in an ss7 message*/ 9080 val1 = jvalue & 0x00003c00; 9081 val1 = val1 >>10; 9082 val2 = jvalue & 0x000003fc; 9083 val2 = val2 <<6; 9084 val3 = jvalue & 0x00000003; 9085 val3 = val3 <<22; 9086 jvalue = val1 + val2 + val3; 9087 b0 = gen_ncmp(cstate, OR_PACKET, newoff_opc, BPF_W, 0x00c0ff0f, 9088 (u_int)jtype, reverse, (u_int)jvalue); 9089 break; 9090 9091 case MH_DPC: 9092 newoff_dpc += 3; 9093 /* FALLTHROUGH */ 9094 9095 case M_DPC: 9096 if (cstate->off_dpc == OFFSET_NOT_SET) 9097 bpf_error(cstate, "'dpc' supported only on SS7"); 9098 /* dpc coded on 14 bits so max value 16383 */ 9099 if (jvalue > 16383) 9100 bpf_error(cstate, "dpc value %u too big; max value = 16383", 9101 jvalue); 9102 /* the following instructions are made to convert jvalue 9103 * to the forme used to write dpc in an ss7 message*/ 9104 val1 = jvalue & 0x000000ff; 9105 val1 = val1 << 24; 9106 val2 = jvalue & 0x00003f00; 9107 val2 = val2 << 8; 9108 jvalue = val1 + val2; 9109 b0 = gen_ncmp(cstate, OR_PACKET, newoff_dpc, BPF_W, 0xff3f0000, 9110 (u_int)jtype, reverse, (u_int)jvalue); 9111 break; 9112 9113 case MH_SLS: 9114 newoff_sls+=3; 9115 case M_SLS: 9116 if (cstate->off_sls == OFFSET_NOT_SET) 9117 bpf_error(cstate, "'sls' supported only on SS7"); 9118 /* sls coded on 4 bits so max value 15 */ 9119 if (jvalue > 15) 9120 bpf_error(cstate, "sls value %u too big; max value = 15", 9121 jvalue); 9122 /* the following instruction is made to convert jvalue 9123 * to the forme used to write sls in an ss7 message*/ 9124 jvalue = jvalue << 4; 9125 b0 = gen_ncmp(cstate, OR_PACKET, newoff_sls, BPF_B, 0xf0, 9126 (u_int)jtype,reverse, (u_int)jvalue); 9127 break; 9128 9129 default: 9130 abort(); 9131 } 9132 return b0; 9133 } 9134 9135 static struct block * 9136 gen_msg_abbrev(compiler_state_t *cstate, int type) 9137 { 9138 struct block *b1; 9139 9140 /* 9141 * Q.2931 signalling protocol messages for handling virtual circuits 9142 * establishment and teardown 9143 */ 9144 switch (type) { 9145 9146 case A_SETUP: 9147 b1 = gen_atmfield_code(cstate, A_MSGTYPE, SETUP, BPF_JEQ, 0); 9148 break; 9149 9150 case A_CALLPROCEED: 9151 b1 = gen_atmfield_code(cstate, A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0); 9152 break; 9153 9154 case A_CONNECT: 9155 b1 = gen_atmfield_code(cstate, A_MSGTYPE, CONNECT, BPF_JEQ, 0); 9156 break; 9157 9158 case A_CONNECTACK: 9159 b1 = gen_atmfield_code(cstate, A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0); 9160 break; 9161 9162 case A_RELEASE: 9163 b1 = gen_atmfield_code(cstate, A_MSGTYPE, RELEASE, BPF_JEQ, 0); 9164 break; 9165 9166 case A_RELEASE_DONE: 9167 b1 = gen_atmfield_code(cstate, A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0); 9168 break; 9169 9170 default: 9171 abort(); 9172 } 9173 return b1; 9174 } 9175 9176 struct block * 9177 gen_atmmulti_abbrev(compiler_state_t *cstate, int type) 9178 { 9179 struct block *b0, *b1; 9180 9181 switch (type) { 9182 9183 case A_OAM: 9184 if (!cstate->is_atm) 9185 bpf_error(cstate, "'oam' supported only on raw ATM"); 9186 b1 = gen_atmmulti_abbrev(cstate, A_OAMF4); 9187 break; 9188 9189 case A_OAMF4: 9190 if (!cstate->is_atm) 9191 bpf_error(cstate, "'oamf4' supported only on raw ATM"); 9192 /* OAM F4 type */ 9193 b0 = gen_atmfield_code(cstate, A_VCI, 3, BPF_JEQ, 0); 9194 b1 = gen_atmfield_code(cstate, A_VCI, 4, BPF_JEQ, 0); 9195 gen_or(b0, b1); 9196 b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); 9197 gen_and(b0, b1); 9198 break; 9199 9200 case A_CONNECTMSG: 9201 /* 9202 * Get Q.2931 signalling messages for switched 9203 * virtual connection 9204 */ 9205 if (!cstate->is_atm) 9206 bpf_error(cstate, "'connectmsg' supported only on raw ATM"); 9207 b0 = gen_msg_abbrev(cstate, A_SETUP); 9208 b1 = gen_msg_abbrev(cstate, A_CALLPROCEED); 9209 gen_or(b0, b1); 9210 b0 = gen_msg_abbrev(cstate, A_CONNECT); 9211 gen_or(b0, b1); 9212 b0 = gen_msg_abbrev(cstate, A_CONNECTACK); 9213 gen_or(b0, b1); 9214 b0 = gen_msg_abbrev(cstate, A_RELEASE); 9215 gen_or(b0, b1); 9216 b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE); 9217 gen_or(b0, b1); 9218 b0 = gen_atmtype_abbrev(cstate, A_SC); 9219 gen_and(b0, b1); 9220 break; 9221 9222 case A_METACONNECT: 9223 if (!cstate->is_atm) 9224 bpf_error(cstate, "'metaconnect' supported only on raw ATM"); 9225 b0 = gen_msg_abbrev(cstate, A_SETUP); 9226 b1 = gen_msg_abbrev(cstate, A_CALLPROCEED); 9227 gen_or(b0, b1); 9228 b0 = gen_msg_abbrev(cstate, A_CONNECT); 9229 gen_or(b0, b1); 9230 b0 = gen_msg_abbrev(cstate, A_RELEASE); 9231 gen_or(b0, b1); 9232 b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE); 9233 gen_or(b0, b1); 9234 b0 = gen_atmtype_abbrev(cstate, A_METAC); 9235 gen_and(b0, b1); 9236 break; 9237 9238 default: 9239 abort(); 9240 } 9241 return b1; 9242 } 9243