Context Navigation

gencode.c @ 97c5f8e8

55-freebsd-126-freebsd-12

Last change on this file since 97c5f8e8 was 97c5f8e8, checked in by Sebastian Huber <sebastian.huber@…>, on 10/09/17 at 07:59:36

Update libpcap to FreeBSD head 2017-04-04

Update libpcap from Git mirror commit
99a648a912e81e29d9c4c159cbbe263462f2d719 to
642b174daddbd0efd9bb5f242c43f4ab4db6869f.

Property mode set to 100644

File size: 230.4 KB

Line
1	#include <machine/rtems-bsd-user-space.h>
2
3	/#define CHASE_CHAIN/
4	/*
5	* Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
6	* The Regents of the University of California. All rights reserved.
7	*
8	* Redistribution and use in source and binary forms, with or without
9	* modification, are permitted provided that: (1) source code distributions
10	* retain the above copyright notice and this paragraph in its entirety, (2)
11	* distributions including binary code include the above copyright notice and
12	* this paragraph in its entirety in the documentation or other materials
13	* provided with the distribution, and (3) all advertising materials mentioning
14	* features or use of this software display the following acknowledgement:
15	* ``This product includes software developed by the University of California,
16	* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
17	* the University nor the names of its contributors may be used to endorse
18	* or promote products derived from this software without specific prior
19	* written permission.
20	* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
21	* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
22	* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23	*
24	* $FreeBSD$
25	*/
26
27	#ifdef HAVE_CONFIG_H
28	#include "config.h"
29	#endif
30
31	#ifdef _WIN32
32	#include <pcap-stdinc.h>
33	#else /* _WIN32 */
34	#if HAVE_INTTYPES_H
35	#include <inttypes.h>
36	#elif HAVE_STDINT_H
37	#include <stdint.h>
38	#endif
39	#ifdef HAVE_SYS_BITYPES_H
40	#include <sys/bitypes.h>
41	#endif
42	#include <sys/types.h>
43	#include <sys/socket.h>
44	#endif /* _WIN32 */
45
46	#ifndef _WIN32
47
48	#ifdef __NetBSD__
49	#include <sys/param.h>
50	#endif
51
52	#include <netinet/in.h>
53	#include <arpa/inet.h>
54
55	#endif /* _WIN32 */
56
57	#include <stdlib.h>
58	#include <string.h>
59	#include <memory.h>
60	#include <setjmp.h>
61	#include <stdarg.h>
62
63	#ifdef MSDOS
64	#include "pcap-dos.h"
65	#endif
66
67	#include "pcap-int.h"
68
69	#include "ethertype.h"
70	#include "nlpid.h"
71	#include "llc.h"
72	#include "gencode.h"
73	#include "ieee80211.h"
74	#include "atmuni31.h"
75	#include "sunatmpos.h"
76	#include "ppp.h"
77	#include "pcap/sll.h"
78	#include "pcap/ipnet.h"
79	#include "arcnet.h"
80
81	#include "grammar.h"
82	#include "scanner.h"
83
84	#if defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER)
85	#include <linux/types.h>
86	#include <linux/if_packet.h>
87	#include <linux/filter.h>
88	#endif
89
90	#ifdef HAVE_NET_PFVAR_H
91	#include <sys/socket.h>
92	#include <net/if.h>
93	#include <net/pfvar.h>
94	#include <net/if_pflog.h>
95	#endif
96
97	#ifndef offsetof
98	#define offsetof(s, e) ((size_t)&((s *)0)->e)
99	#endif
100
101	#ifdef INET6
102	#ifdef _WIN32
103	#if defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF)
104	/* IPv6 address */
105	struct in6_addr
106	{
107	union
108	{
109	u_int8_t u6_addr8[16];
110	u_int16_t u6_addr16[8];
111	u_int32_t u6_addr32[4];
112	} in6_u;
113	#define s6_addr in6_u.u6_addr8
114	#define s6_addr16 in6_u.u6_addr16
115	#define s6_addr32 in6_u.u6_addr32
116	#define s6_addr64 in6_u.u6_addr64
117	};
118
119	typedef unsigned short sa_family_t;
120
121	#define __SOCKADDR_COMMON(sa_prefix) \
122	sa_family_t sa_prefix##family
123
124	/* Ditto, for IPv6. */
125	struct sockaddr_in6
126	{
127	__SOCKADDR_COMMON (sin6_);
128	u_int16_t sin6_port; /* Transport layer port # */
129	u_int32_t sin6_flowinfo; /* IPv6 flow information */
130	struct in6_addr sin6_addr; /* IPv6 address */
131	};
132
133	#ifndef EAI_ADDRFAMILY
134	struct addrinfo {
135	int ai_flags; /* AI_PASSIVE, AI_CANONNAME */
136	int ai_family; /* PF_xxx */
137	int ai_socktype; /* SOCK_xxx */
138	int ai_protocol; /* 0 or IPPROTO_xxx for IPv4 and IPv6 */
139	size_t ai_addrlen; /* length of ai_addr */
140	char ai_canonname; / canonical name for hostname */
141	struct sockaddr ai_addr; / binary address */
142	struct addrinfo ai_next; / next structure in linked list */
143	};
144	#endif /* EAI_ADDRFAMILY */
145	#endif /* defined(__MINGW32__) && defined(DEFINE_ADDITIONAL_IPV6_STUFF) */
146	#else /* _WIN32 */
147	#include <netdb.h> /* for "struct addrinfo" */
148	#endif /* _WIN32 */
149	#endif /* INET6 */
150	#include <pcap/namedb.h>
151
152	#include "nametoaddr.h"
153
154	#define ETHERMTU 1500
155
156	#ifndef ETHERTYPE_TEB
157	#define ETHERTYPE_TEB 0x6558
158	#endif
159
160	#ifndef IPPROTO_HOPOPTS
161	#define IPPROTO_HOPOPTS 0
162	#endif
163	#ifndef IPPROTO_ROUTING
164	#define IPPROTO_ROUTING 43
165	#endif
166	#ifndef IPPROTO_FRAGMENT
167	#define IPPROTO_FRAGMENT 44
168	#endif
169	#ifndef IPPROTO_DSTOPTS
170	#define IPPROTO_DSTOPTS 60
171	#endif
172	#ifndef IPPROTO_SCTP
173	#define IPPROTO_SCTP 132
174	#endif
175
176	#define GENEVE_PORT 6081
177
178	#ifdef HAVE_OS_PROTO_H
179	#include "os-proto.h"
180	#endif
181
182	#define JMP(c) ((c)\|BPF_JMP\|BPF_K)
183
184	/*
185	* "Push" the current value of the link-layer header type and link-layer
186	* header offset onto a "stack", and set a new value. (It's not a
187	* full-blown stack; we keep only the top two items.)
188	*/
189	#define PUSH_LINKHDR(cs, new_linktype, new_is_variable, new_constant_part, new_reg) \
190	{ \
191	(cs)->prevlinktype = (cs)->linktype; \
192	(cs)->off_prevlinkhdr = (cs)->off_linkhdr; \
193	(cs)->linktype = (new_linktype); \
194	(cs)->off_linkhdr.is_variable = (new_is_variable); \
195	(cs)->off_linkhdr.constant_part = (new_constant_part); \
196	(cs)->off_linkhdr.reg = (new_reg); \
197	(cs)->is_geneve = 0; \
198	}
199
200	/*
201	* Offset "not set" value.
202	*/
203	#define OFFSET_NOT_SET 0xffffffffU
204
205	/*
206	* Absolute offsets, which are offsets from the beginning of the raw
207	* packet data, are, in the general case, the sum of a variable value
208	* and a constant value; the variable value may be absent, in which
209	* case the offset is only the constant value, and the constant value
210	* may be zero, in which case the offset is only the variable value.
211	*
212	* bpf_abs_offset is a structure containing all that information:
213	*
214	* is_variable is 1 if there's a variable part.
215	*
216	* constant_part is the constant part of the value, possibly zero;
217	*
218	* if is_variable is 1, reg is the register number for a register
219	* containing the variable value if the register has been assigned,
220	* and -1 otherwise.
221	*/
222	typedef struct {
223	int is_variable;
224	u_int constant_part;
225	int reg;
226	} bpf_abs_offset;
227
228	/*
229	* Value passed to gen_load_a() to indicate what the offset argument
230	* is relative to the beginning of.
231	*/
232	enum e_offrel {
233	OR_PACKET, /* full packet data */
234	OR_LINKHDR, /* link-layer header */
235	OR_PREVLINKHDR, /* previous link-layer header */
236	OR_LLC, /* 802.2 LLC header */
237	OR_PREVMPLSHDR, /* previous MPLS header */
238	OR_LINKTYPE, /* link-layer type */
239	OR_LINKPL, /* link-layer payload */
240	OR_LINKPL_NOSNAP, /* link-layer payload, with no SNAP header at the link layer */
241	OR_TRAN_IPV4, /* transport-layer header, with IPv4 network layer */
242	OR_TRAN_IPV6 /* transport-layer header, with IPv6 network layer */
243	};
244
245	/*
246	* We divy out chunks of memory rather than call malloc each time so
247	* we don't have to worry about leaking memory. It's probably
248	* not a big deal if all this memory was wasted but if this ever
249	* goes into a library that would probably not be a good idea.
250	*
251	* XXX - this is in a library....
252	*/
253	#define NCHUNKS 16
254	#define CHUNK0SIZE 1024
255	struct chunk {
256	size_t n_left;
257	void *m;
258	};
259
260	/* Code generator state */
261
262	struct _compiler_state {
263	jmp_buf top_ctx;
264	pcap_t *bpf_pcap;
265
266	struct icode ic;
267
268	int snaplen;
269
270	int linktype;
271	int prevlinktype;
272	int outermostlinktype;
273
274	bpf_u_int32 netmask;
275	int no_optimize;
276
277	/* Hack for handling VLAN and MPLS stacks. */
278	u_int label_stack_depth;
279	u_int vlan_stack_depth;
280
281	/* XXX */
282	u_int pcap_fddipad;
283
284	#ifdef INET6
285	/*
286	* As errors are handled by a longjmp, anything allocated must
287	* be freed in the longjmp handler, so it must be reachable
288	* from that handler.
289	*
290	* One thing that's allocated is the result of pcap_nametoaddrinfo();
291	* it must be freed with freeaddrinfo(). This variable points to
292	* any addrinfo structure that would need to be freed.
293	*/
294	struct addrinfo *ai;
295	#endif
296
297	/*
298	* Various code constructs need to know the layout of the packet.
299	* These values give the necessary offsets from the beginning
300	* of the packet data.
301	*/
302
303	/*
304	* Absolute offset of the beginning of the link-layer header.
305	*/
306	bpf_abs_offset off_linkhdr;
307
308	/*
309	* If we're checking a link-layer header for a packet encapsulated
310	* in another protocol layer, this is the equivalent information
311	* for the previous layers' link-layer header from the beginning
312	* of the raw packet data.
313	*/
314	bpf_abs_offset off_prevlinkhdr;
315
316	/*
317	* This is the equivalent information for the outermost layers'
318	* link-layer header.
319	*/
320	bpf_abs_offset off_outermostlinkhdr;
321
322	/*
323	* Absolute offset of the beginning of the link-layer payload.
324	*/
325	bpf_abs_offset off_linkpl;
326
327	/*
328	* "off_linktype" is the offset to information in the link-layer
329	* header giving the packet type. This is an absolute offset
330	* from the beginning of the packet.
331	*
332	* For Ethernet, it's the offset of the Ethernet type field; this
333	* means that it must have a value that skips VLAN tags.
334	*
335	* For link-layer types that always use 802.2 headers, it's the
336	* offset of the LLC header; this means that it must have a value
337	* that skips VLAN tags.
338	*
339	* For PPP, it's the offset of the PPP type field.
340	*
341	* For Cisco HDLC, it's the offset of the CHDLC type field.
342	*
343	* For BSD loopback, it's the offset of the AF_ value.
344	*
345	* For Linux cooked sockets, it's the offset of the type field.
346	*
347	* off_linktype.constant_part is set to OFFSET_NOT_SET for no
348	* encapsulation, in which case, IP is assumed.
349	*/
350	bpf_abs_offset off_linktype;
351
352	/*
353	* TRUE if the link layer includes an ATM pseudo-header.
354	*/
355	int is_atm;
356
357	/*
358	* TRUE if "geneve" appeared in the filter; it causes us to
359	* generate code that checks for a Geneve header and assume
360	* that later filters apply to the encapsulated payload.
361	*/
362	int is_geneve;
363
364	/*
365	* These are offsets for the ATM pseudo-header.
366	*/
367	u_int off_vpi;
368	u_int off_vci;
369	u_int off_proto;
370
371	/*
372	* These are offsets for the MTP2 fields.
373	*/
374	u_int off_li;
375	u_int off_li_hsl;
376
377	/*
378	* These are offsets for the MTP3 fields.
379	*/
380	u_int off_sio;
381	u_int off_opc;
382	u_int off_dpc;
383	u_int off_sls;
384
385	/*
386	* This is the offset of the first byte after the ATM pseudo_header,
387	* or -1 if there is no ATM pseudo-header.
388	*/
389	u_int off_payload;
390
391	/*
392	* These are offsets to the beginning of the network-layer header.
393	* They are relative to the beginning of the link-layer payload
394	* (i.e., they don't include off_linkhdr.constant_part or
395	* off_linkpl.constant_part).
396	*
397	* If the link layer never uses 802.2 LLC:
398	*
399	* "off_nl" and "off_nl_nosnap" are the same.
400	*
401	* If the link layer always uses 802.2 LLC:
402	*
403	* "off_nl" is the offset if there's a SNAP header following
404	* the 802.2 header;
405	*
406	* "off_nl_nosnap" is the offset if there's no SNAP header.
407	*
408	* If the link layer is Ethernet:
409	*
410	* "off_nl" is the offset if the packet is an Ethernet II packet
411	* (we assume no 802.3+802.2+SNAP);
412	*
413	* "off_nl_nosnap" is the offset if the packet is an 802.3 packet
414	* with an 802.2 header following it.
415	*/
416	u_int off_nl;
417	u_int off_nl_nosnap;
418
419	/*
420	* Here we handle simple allocation of the scratch registers.
421	* If too many registers are alloc'd, the allocator punts.
422	*/
423	int regused[BPF_MEMWORDS];
424	int curreg;
425
426	/*
427	* Memory chunks.
428	*/
429	struct chunk chunks[NCHUNKS];
430	int cur_chunk;
431	};
432
433	void
434	bpf_syntax_error(compiler_state_t cstate, const char msg)
435	{
436	bpf_error(cstate, "syntax error in filter expression: %s", msg);
437	/* NOTREACHED */
438	}
439
440	/* VARARGS */
441	void
442	bpf_error(compiler_state_t cstate, const char fmt, ...)
443	{
444	va_list ap;
445
446	va_start(ap, fmt);
447	if (cstate->bpf_pcap != NULL)
448	(void)pcap_vsnprintf(pcap_geterr(cstate->bpf_pcap),
449	PCAP_ERRBUF_SIZE, fmt, ap);
450	va_end(ap);
451	longjmp(cstate->top_ctx, 1);
452	/* NOTREACHED */
453	}
454
455	static void init_linktype(compiler_state_t , pcap_t );
456
457	static void init_regs(compiler_state_t *);
458	static int alloc_reg(compiler_state_t *);
459	static void free_reg(compiler_state_t *, int);
460
461	static void initchunks(compiler_state_t *cstate);
462	static void newchunk(compiler_state_t cstate, size_t);
463	static void freechunks(compiler_state_t *cstate);
464	static inline struct block new_block(compiler_state_t cstate, int);
465	static inline struct slist new_stmt(compiler_state_t cstate, int);
466	static struct block gen_retblk(compiler_state_t cstate, int);
467	static inline void syntax(compiler_state_t *cstate);
468
469	static void backpatch(struct block , struct block );
470	static void merge(struct block , struct block );
471	static struct block gen_cmp(compiler_state_t , enum e_offrel, u_int,
472	u_int, bpf_int32);
473	static struct block gen_cmp_gt(compiler_state_t , enum e_offrel, u_int,
474	u_int, bpf_int32);
475	static struct block gen_cmp_ge(compiler_state_t , enum e_offrel, u_int,
476	u_int, bpf_int32);
477	static struct block gen_cmp_lt(compiler_state_t , enum e_offrel, u_int,
478	u_int, bpf_int32);
479	static struct block gen_cmp_le(compiler_state_t , enum e_offrel, u_int,
480	u_int, bpf_int32);
481	static struct block gen_mcmp(compiler_state_t , enum e_offrel, u_int,
482	u_int, bpf_int32, bpf_u_int32);
483	static struct block gen_bcmp(compiler_state_t , enum e_offrel, u_int,
484	u_int, const u_char *);
485	static struct block gen_ncmp(compiler_state_t , enum e_offrel, bpf_u_int32,
486	bpf_u_int32, bpf_u_int32, bpf_u_int32, int, bpf_int32);
487	static struct slist gen_load_absoffsetrel(compiler_state_t , bpf_abs_offset *,
488	u_int, u_int);
489	static struct slist gen_load_a(compiler_state_t , enum e_offrel, u_int,
490	u_int);
491	static struct slist gen_loadx_iphdrlen(compiler_state_t );
492	static struct block gen_uncond(compiler_state_t , int);
493	static inline struct block gen_true(compiler_state_t );
494	static inline struct block gen_false(compiler_state_t );
495	static struct block gen_ether_linktype(compiler_state_t , int);
496	static struct block gen_ipnet_linktype(compiler_state_t , int);
497	static struct block gen_linux_sll_linktype(compiler_state_t , int);
498	static struct slist gen_load_prism_llprefixlen(compiler_state_t );
499	static struct slist gen_load_avs_llprefixlen(compiler_state_t );
500	static struct slist gen_load_radiotap_llprefixlen(compiler_state_t );
501	static struct slist gen_load_ppi_llprefixlen(compiler_state_t );
502	static void insert_compute_vloffsets(compiler_state_t , struct block );
503	static struct slist gen_abs_offset_varpart(compiler_state_t ,
504	bpf_abs_offset *);
505	static int ethertype_to_ppptype(int);
506	static struct block gen_linktype(compiler_state_t , int);
507	static struct block gen_snap(compiler_state_t , bpf_u_int32, bpf_u_int32);
508	static struct block gen_llc_linktype(compiler_state_t , int);
509	static struct block gen_hostop(compiler_state_t , bpf_u_int32, bpf_u_int32,
510	int, int, u_int, u_int);
511	#ifdef INET6
512	static struct block gen_hostop6(compiler_state_t , struct in6_addr *,
513	struct in6_addr *, int, int, u_int, u_int);
514	#endif
515	static struct block gen_ahostop(compiler_state_t , const u_char *, int);
516	static struct block gen_ehostop(compiler_state_t , const u_char *, int);
517	static struct block gen_fhostop(compiler_state_t , const u_char *, int);
518	static struct block gen_thostop(compiler_state_t , const u_char *, int);
519	static struct block gen_wlanhostop(compiler_state_t , const u_char *, int);
520	static struct block gen_ipfchostop(compiler_state_t , const u_char *, int);
521	static struct block gen_dnhostop(compiler_state_t , bpf_u_int32, int);
522	static struct block gen_mpls_linktype(compiler_state_t , int);
523	static struct block gen_host(compiler_state_t , bpf_u_int32, bpf_u_int32,
524	int, int, int);
525	#ifdef INET6
526	static struct block gen_host6(compiler_state_t , struct in6_addr *,
527	struct in6_addr *, int, int, int);
528	#endif
529	#ifndef INET6
530	static struct block gen_gateway(compiler_state_t , const u_char *,
531	bpf_u_int32 **, int, int);
532	#endif
533	static struct block gen_ipfrag(compiler_state_t );
534	static struct block gen_portatom(compiler_state_t , int, bpf_int32);
535	static struct block gen_portrangeatom(compiler_state_t , int, bpf_int32,
536	bpf_int32);
537	static struct block gen_portatom6(compiler_state_t , int, bpf_int32);
538	static struct block gen_portrangeatom6(compiler_state_t , int, bpf_int32,
539	bpf_int32);
540	struct block gen_portop(compiler_state_t , int, int, int);
541	static struct block gen_port(compiler_state_t , int, int, int);
542	struct block gen_portrangeop(compiler_state_t , int, int, int, int);
543	static struct block gen_portrange(compiler_state_t , int, int, int, int);
544	struct block gen_portop6(compiler_state_t , int, int, int);
545	static struct block gen_port6(compiler_state_t , int, int, int);
546	struct block gen_portrangeop6(compiler_state_t , int, int, int, int);
547	static struct block gen_portrange6(compiler_state_t , int, int, int, int);
548	static int lookup_proto(compiler_state_t , const char , int);
549	static struct block gen_protochain(compiler_state_t , int, int, int);
550	static struct block gen_proto(compiler_state_t , int, int, int);
551	static struct slist xfer_to_x(compiler_state_t , struct arth *);
552	static struct slist xfer_to_a(compiler_state_t , struct arth *);
553	static struct block gen_mac_multicast(compiler_state_t , int);
554	static struct block gen_len(compiler_state_t , int, int);
555	static struct block gen_check_802_11_data_frame(compiler_state_t );
556	static struct block gen_geneve_ll_check(compiler_state_t cstate);
557
558	static struct block gen_ppi_dlt_check(compiler_state_t );
559	static struct block gen_msg_abbrev(compiler_state_t , int type);
560
561	static void
562	initchunks(compiler_state_t *cstate)
563	{
564	int i;
565
566	for (i = 0; i < NCHUNKS; i++) {
567	cstate->chunks[i].n_left = 0;
568	cstate->chunks[i].m = NULL;
569	}
570	cstate->cur_chunk = 0;
571	}
572
573	static void *
574	newchunk(compiler_state_t *cstate, size_t n)
575	{
576	struct chunk *cp;
577	int k;
578	size_t size;
579
580	#ifndef __NetBSD__
581	/* XXX Round up to nearest long. */
582	n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1);
583	#else
584	/* XXX Round up to structure boundary. */
585	n = ALIGN(n);
586	#endif
587
588	cp = &cstate->chunks[cstate->cur_chunk];
589	if (n > cp->n_left) {
590	++cp, k = ++cstate->cur_chunk;
591	if (k >= NCHUNKS)
592	bpf_error(cstate, "out of memory");
593	size = CHUNK0SIZE << k;
594	cp->m = (void *)malloc(size);
595	if (cp->m == NULL)
596	bpf_error(cstate, "out of memory");
597	memset((char *)cp->m, 0, size);
598	cp->n_left = size;
599	if (n > size)
600	bpf_error(cstate, "out of memory");
601	}
602	cp->n_left -= n;
603	return (void )((char )cp->m + cp->n_left);
604	}
605
606	static void
607	freechunks(compiler_state_t *cstate)
608	{
609	int i;
610
611	for (i = 0; i < NCHUNKS; ++i)
612	if (cstate->chunks[i].m != NULL)
613	free(cstate->chunks[i].m);
614	}
615
616	/*
617	* A strdup whose allocations are freed after code generation is over.
618	*/
619	char *
620	sdup(compiler_state_t cstate, const char s)
621	{
622	size_t n = strlen(s) + 1;
623	char *cp = newchunk(cstate, n);
624
625	strlcpy(cp, s, n);
626	return (cp);
627	}
628
629	static inline struct block *
630	new_block(compiler_state_t *cstate, int code)
631	{
632	struct block *p;
633
634	p = (struct block )newchunk(cstate, sizeof(p));
635	p->s.code = code;
636	p->head = p;
637
638	return p;
639	}
640
641	static inline struct slist *
642	new_stmt(compiler_state_t *cstate, int code)
643	{
644	struct slist *p;
645
646	p = (struct slist )newchunk(cstate, sizeof(p));
647	p->s.code = code;
648
649	return p;
650	}
651
652	static struct block *
653	gen_retblk(compiler_state_t *cstate, int v)
654	{
655	struct block *b = new_block(cstate, BPF_RET\|BPF_K);
656
657	b->s.k = v;
658	return b;
659	}
660
661	static inline void
662	syntax(compiler_state_t *cstate)
663	{
664	bpf_error(cstate, "syntax error in filter expression");
665	}
666
667	int
668	pcap_compile(pcap_t p, struct bpf_program program,
669	const char *buf, int optimize, bpf_u_int32 mask)
670	{
671	compiler_state_t cstate;
672	const char * volatile xbuf = buf;
673	yyscan_t scanner = NULL;
674	YY_BUFFER_STATE in_buffer = NULL;
675	u_int len;
676	int rc;
677
678	#ifdef _WIN32
679	static int done = 0;
680
681	if (!done)
682	pcap_wsockinit();
683	done = 1;
684	#endif
685
686	/*
687	* If this pcap_t hasn't been activated, it doesn't have a
688	* link-layer type, so we can't use it.
689	*/
690	if (!p->activated) {
691	pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
692	"not-yet-activated pcap_t passed to pcap_compile");
693	rc = -1;
694	goto quit;
695	}
696	initchunks(&cstate);
697	cstate.no_optimize = 0;
698	#ifdef INET6
699	cstate.ai = NULL;
700	#endif
701	cstate.ic.root = NULL;
702	cstate.ic.cur_mark = 0;
703	cstate.bpf_pcap = p;
704	init_regs(&cstate);
705
706	if (setjmp(cstate.top_ctx)) {
707	#ifdef INET6
708	if (cstate.ai != NULL)
709	freeaddrinfo(cstate.ai);
710	#endif
711	rc = -1;
712	goto quit;
713	}
714
715	cstate.netmask = mask;
716
717	cstate.snaplen = pcap_snapshot(p);
718	if (cstate.snaplen == 0) {
719	pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
720	"snaplen of 0 rejects all packets");
721	rc = -1;
722	goto quit;
723	}
724
725	if (pcap_lex_init(&scanner) != 0)
726	bpf_error(&cstate, "can't initialize scanner: %s", pcap_strerror(errno));
727	in_buffer = pcap__scan_string(xbuf ? xbuf : "", scanner);
728
729	/*
730	* Associate the compiler state with the lexical analyzer
731	* state.
732	*/
733	pcap_set_extra(&cstate, scanner);
734
735	init_linktype(&cstate, p);
736	(void)pcap_parse(scanner, &cstate);
737
738	if (cstate.ic.root == NULL)
739	cstate.ic.root = gen_retblk(&cstate, cstate.snaplen);
740
741	if (optimize && !cstate.no_optimize) {
742	bpf_optimize(&cstate, &cstate.ic);
743	if (cstate.ic.root == NULL \|\|
744	(cstate.ic.root->s.code == (BPF_RET\|BPF_K) && cstate.ic.root->s.k == 0))
745	bpf_error(&cstate, "expression rejects all packets");
746	}
747	program->bf_insns = icode_to_fcode(&cstate, &cstate.ic, cstate.ic.root, &len);
748	program->bf_len = len;
749
750	rc = 0; /* We're all okay */
751
752	quit:
753	/*
754	* Clean up everything for the lexical analyzer.
755	*/
756	if (in_buffer != NULL)
757	pcap__delete_buffer(in_buffer, scanner);
758	if (scanner != NULL)
759	pcap_lex_destroy(scanner);
760
761	/*
762	* Clean up our own allocated memory.
763	*/
764	freechunks(&cstate);
765
766	return (rc);
767	}
768
769	/*
770	* entry point for using the compiler with no pcap open
771	* pass in all the stuff that is needed explicitly instead.
772	*/
773	int
774	pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
775	struct bpf_program *program,
776	const char *buf, int optimize, bpf_u_int32 mask)
777	{
778	pcap_t *p;
779	int ret;
780
781	p = pcap_open_dead(linktype_arg, snaplen_arg);
782	if (p == NULL)
783	return (-1);
784	ret = pcap_compile(p, program, buf, optimize, mask);
785	pcap_close(p);
786	return (ret);
787	}
788
789	/*
790	* Clean up a "struct bpf_program" by freeing all the memory allocated
791	* in it.
792	*/
793	void
794	pcap_freecode(struct bpf_program *program)
795	{
796	program->bf_len = 0;
797	if (program->bf_insns != NULL) {
798	free((char *)program->bf_insns);
799	program->bf_insns = NULL;
800	}
801	}
802
803	/*
804	* Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates
805	* which of the jt and jf fields has been resolved and which is a pointer
806	* back to another unresolved block (or nil). At least one of the fields
807	* in each block is already resolved.
808	*/
809	static void
810	backpatch(list, target)
811	struct block list, target;
812	{
813	struct block *next;
814
815	while (list) {
816	if (!list->sense) {
817	next = JT(list);
818	JT(list) = target;
819	} else {
820	next = JF(list);
821	JF(list) = target;
822	}
823	list = next;
824	}
825	}
826
827	/*
828	* Merge the lists in b0 and b1, using the 'sense' field to indicate
829	* which of jt and jf is the link.
830	*/
831	static void
832	merge(b0, b1)
833	struct block b0, b1;
834	{
835	register struct block **p = &b0;
836
837	/* Find end of list. */
838	while (*p)
839	p = !((p)->sense) ? &JT(p) : &JF(*p);
840
841	/* Concatenate the lists. */
842	*p = b1;
843	}
844
845	void
846	finish_parse(compiler_state_t cstate, struct block p)
847	{
848	struct block *ppi_dlt_check;
849
850	/*
851	* Insert before the statements of the first (root) block any
852	* statements needed to load the lengths of any variable-length
853	* headers into registers.
854	*
855	* XXX - a fancier strategy would be to insert those before the
856	* statements of all blocks that use those lengths and that
857	* have no predecessors that use them, so that we only compute
858	* the lengths if we need them. There might be even better
859	* approaches than that.
860	*
861	* However, those strategies would be more complicated, and
862	* as we don't generate code to compute a length if the
863	* program has no tests that use the length, and as most
864	* tests will probably use those lengths, we would just
865	* postpone computing the lengths so that it's not done
866	* for tests that fail early, and it's not clear that's
867	* worth the effort.
868	*/
869	insert_compute_vloffsets(cstate, p->head);
870
871	/*
872	* For DLT_PPI captures, generate a check of the per-packet
873	* DLT value to make sure it's DLT_IEEE802_11.
874	*
875	* XXX - TurboCap cards use DLT_PPI for Ethernet.
876	* Can we just define some DLT_ETHERNET_WITH_PHDR pseudo-header
877	* with appropriate Ethernet information and use that rather
878	* than using something such as DLT_PPI where you don't know
879	* the link-layer header type until runtime, which, in the
880	* general case, would force us to generate both Ethernet and
881	* 802.11 code (and anything else for which PPI is used)
882	* and choose between them early in the BPF program?
883	*/
884	ppi_dlt_check = gen_ppi_dlt_check(cstate);
885	if (ppi_dlt_check != NULL)
886	gen_and(ppi_dlt_check, p);
887
888	backpatch(p, gen_retblk(cstate, cstate->snaplen));
889	p->sense = !p->sense;
890	backpatch(p, gen_retblk(cstate, 0));
891	cstate->ic.root = p->head;
892	}
893
894	void
895	gen_and(b0, b1)
896	struct block b0, b1;
897	{
898	backpatch(b0, b1->head);
899	b0->sense = !b0->sense;
900	b1->sense = !b1->sense;
901	merge(b1, b0);
902	b1->sense = !b1->sense;
903	b1->head = b0->head;
904	}
905
906	void
907	gen_or(b0, b1)
908	struct block b0, b1;
909	{
910	b0->sense = !b0->sense;
911	backpatch(b0, b1->head);
912	b0->sense = !b0->sense;
913	merge(b1, b0);
914	b1->head = b0->head;
915	}
916
917	void
918	gen_not(b)
919	struct block *b;
920	{
921	b->sense = !b->sense;
922	}
923
924	static struct block *
925	gen_cmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
926	u_int size, bpf_int32 v)
927	{
928	return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JEQ, 0, v);
929	}
930
931	static struct block *
932	gen_cmp_gt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
933	u_int size, bpf_int32 v)
934	{
935	return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 0, v);
936	}
937
938	static struct block *
939	gen_cmp_ge(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
940	u_int size, bpf_int32 v)
941	{
942	return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 0, v);
943	}
944
945	static struct block *
946	gen_cmp_lt(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
947	u_int size, bpf_int32 v)
948	{
949	return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGE, 1, v);
950	}
951
952	static struct block *
953	gen_cmp_le(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
954	u_int size, bpf_int32 v)
955	{
956	return gen_ncmp(cstate, offrel, offset, size, 0xffffffff, BPF_JGT, 1, v);
957	}
958
959	static struct block *
960	gen_mcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
961	u_int size, bpf_int32 v, bpf_u_int32 mask)
962	{
963	return gen_ncmp(cstate, offrel, offset, size, mask, BPF_JEQ, 0, v);
964	}
965
966	static struct block *
967	gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
968	u_int size, const u_char *v)
969	{
970	register struct block b, tmp;
971
972	b = NULL;
973	while (size >= 4) {
974	register const u_char *p = &v[size - 4];
975	bpf_int32 w = ((bpf_int32)p[0] << 24) \|
976	((bpf_int32)p[1] << 16) \| ((bpf_int32)p[2] << 8) \| p[3];
977
978	tmp = gen_cmp(cstate, offrel, offset + size - 4, BPF_W, w);
979	if (b != NULL)
980	gen_and(b, tmp);
981	b = tmp;
982	size -= 4;
983	}
984	while (size >= 2) {
985	register const u_char *p = &v[size - 2];
986	bpf_int32 w = ((bpf_int32)p[0] << 8) \| p[1];
987
988	tmp = gen_cmp(cstate, offrel, offset + size - 2, BPF_H, w);
989	if (b != NULL)
990	gen_and(b, tmp);
991	b = tmp;
992	size -= 2;
993	}
994	if (size > 0) {
995	tmp = gen_cmp(cstate, offrel, offset, BPF_B, (bpf_int32)v[0]);
996	if (b != NULL)
997	gen_and(b, tmp);
998	b = tmp;
999	}
1000	return b;
1001	}
1002
1003	/*
1004	* AND the field of size "size" at offset "offset" relative to the header
1005	* specified by "offrel" with "mask", and compare it with the value "v"
1006	* with the test specified by "jtype"; if "reverse" is true, the test
1007	* should test the opposite of "jtype".
1008	*/
1009	static struct block *
1010	gen_ncmp(compiler_state_t *cstate, enum e_offrel offrel, bpf_u_int32 offset,
1011	bpf_u_int32 size, bpf_u_int32 mask, bpf_u_int32 jtype, int reverse,
1012	bpf_int32 v)
1013	{
1014	struct slist s, s2;
1015	struct block *b;
1016
1017	s = gen_load_a(cstate, offrel, offset, size);
1018
1019	if (mask != 0xffffffff) {
1020	s2 = new_stmt(cstate, BPF_ALU\|BPF_AND\|BPF_K);
1021	s2->s.k = mask;
1022	sappend(s, s2);
1023	}
1024
1025	b = new_block(cstate, JMP(jtype));
1026	b->stmts = s;
1027	b->s.k = v;
1028	if (reverse && (jtype == BPF_JGT \|\| jtype == BPF_JGE))
1029	gen_not(b);
1030	return b;
1031	}
1032
1033	static void
1034	init_linktype(compiler_state_t cstate, pcap_t p)
1035	{
1036	cstate->pcap_fddipad = p->fddipad;
1037
1038	/*
1039	* We start out with only one link-layer header.
1040	*/
1041	cstate->outermostlinktype = pcap_datalink(p);
1042	cstate->off_outermostlinkhdr.constant_part = 0;
1043	cstate->off_outermostlinkhdr.is_variable = 0;
1044	cstate->off_outermostlinkhdr.reg = -1;
1045
1046	cstate->prevlinktype = cstate->outermostlinktype;
1047	cstate->off_prevlinkhdr.constant_part = 0;
1048	cstate->off_prevlinkhdr.is_variable = 0;
1049	cstate->off_prevlinkhdr.reg = -1;
1050
1051	cstate->linktype = cstate->outermostlinktype;
1052	cstate->off_linkhdr.constant_part = 0;
1053	cstate->off_linkhdr.is_variable = 0;
1054	cstate->off_linkhdr.reg = -1;
1055
1056	/*
1057	* XXX
1058	*/
1059	cstate->off_linkpl.constant_part = 0;
1060	cstate->off_linkpl.is_variable = 0;
1061	cstate->off_linkpl.reg = -1;
1062
1063	cstate->off_linktype.constant_part = 0;
1064	cstate->off_linktype.is_variable = 0;
1065	cstate->off_linktype.reg = -1;
1066
1067	/*
1068	* Assume it's not raw ATM with a pseudo-header, for now.
1069	*/
1070	cstate->is_atm = 0;
1071	cstate->off_vpi = -1;
1072	cstate->off_vci = -1;
1073	cstate->off_proto = -1;
1074	cstate->off_payload = -1;
1075
1076	/*
1077	* And not Geneve.
1078	*/
1079	cstate->is_geneve = 0;
1080
1081	/*
1082	* And assume we're not doing SS7.
1083	*/
1084	cstate->off_li = -1;
1085	cstate->off_li_hsl = -1;
1086	cstate->off_sio = -1;
1087	cstate->off_opc = -1;
1088	cstate->off_dpc = -1;
1089	cstate->off_sls = -1;
1090
1091	cstate->label_stack_depth = 0;
1092	cstate->vlan_stack_depth = 0;
1093
1094	switch (cstate->linktype) {
1095
1096	case DLT_ARCNET:
1097	cstate->off_linktype.constant_part = 2;
1098	cstate->off_linkpl.constant_part = 6;
1099	cstate->off_nl = 0; /* XXX in reality, variable! */
1100	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1101	break;
1102
1103	case DLT_ARCNET_LINUX:
1104	cstate->off_linktype.constant_part = 4;
1105	cstate->off_linkpl.constant_part = 8;
1106	cstate->off_nl = 0; /* XXX in reality, variable! */
1107	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1108	break;
1109
1110	case DLT_EN10MB:
1111	cstate->off_linktype.constant_part = 12;
1112	cstate->off_linkpl.constant_part = 14; /* Ethernet header length */
1113	cstate->off_nl = 0; /* Ethernet II */
1114	cstate->off_nl_nosnap = 3; /* 802.3+802.2 */
1115	break;
1116
1117	case DLT_SLIP:
1118	/*
1119	* SLIP doesn't have a link level type. The 16 byte
1120	* header is hacked into our SLIP driver.
1121	*/
1122	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1123	cstate->off_linkpl.constant_part = 16;
1124	cstate->off_nl = 0;
1125	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1126	break;
1127
1128	case DLT_SLIP_BSDOS:
1129	/* XXX this may be the same as the DLT_PPP_BSDOS case */
1130	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1131	/* XXX end */
1132	cstate->off_linkpl.constant_part = 24;
1133	cstate->off_nl = 0;
1134	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1135	break;
1136
1137	case DLT_NULL:
1138	case DLT_LOOP:
1139	cstate->off_linktype.constant_part = 0;
1140	cstate->off_linkpl.constant_part = 4;
1141	cstate->off_nl = 0;
1142	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1143	break;
1144
1145	case DLT_ENC:
1146	cstate->off_linktype.constant_part = 0;
1147	cstate->off_linkpl.constant_part = 12;
1148	cstate->off_nl = 0;
1149	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1150	break;
1151
1152	case DLT_PPP:
1153	case DLT_PPP_PPPD:
1154	case DLT_C_HDLC: /* BSD/OS Cisco HDLC */
1155	case DLT_PPP_SERIAL: /* NetBSD sync/async serial PPP */
1156	cstate->off_linktype.constant_part = 2; /* skip HDLC-like framing */
1157	cstate->off_linkpl.constant_part = 4; /* skip HDLC-like framing and protocol field */
1158	cstate->off_nl = 0;
1159	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1160	break;
1161
1162	case DLT_PPP_ETHER:
1163	/*
1164	* This does no include the Ethernet header, and
1165	* only covers session state.
1166	*/
1167	cstate->off_linktype.constant_part = 6;
1168	cstate->off_linkpl.constant_part = 8;
1169	cstate->off_nl = 0;
1170	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1171	break;
1172
1173	case DLT_PPP_BSDOS:
1174	cstate->off_linktype.constant_part = 5;
1175	cstate->off_linkpl.constant_part = 24;
1176	cstate->off_nl = 0;
1177	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1178	break;
1179
1180	case DLT_FDDI:
1181	/*
1182	* FDDI doesn't really have a link-level type field.
1183	* We set "off_linktype" to the offset of the LLC header.
1184	*
1185	* To check for Ethernet types, we assume that SSAP = SNAP
1186	* is being used and pick out the encapsulated Ethernet type.
1187	* XXX - should we generate code to check for SNAP?
1188	*/
1189	cstate->off_linktype.constant_part = 13;
1190	cstate->off_linktype.constant_part += cstate->pcap_fddipad;
1191	cstate->off_linkpl.constant_part = 13; /* FDDI MAC header length */
1192	cstate->off_linkpl.constant_part += cstate->pcap_fddipad;
1193	cstate->off_nl = 8; /* 802.2+SNAP */
1194	cstate->off_nl_nosnap = 3; /* 802.2 */
1195	break;
1196
1197	case DLT_IEEE802:
1198	/*
1199	* Token Ring doesn't really have a link-level type field.
1200	* We set "off_linktype" to the offset of the LLC header.
1201	*
1202	* To check for Ethernet types, we assume that SSAP = SNAP
1203	* is being used and pick out the encapsulated Ethernet type.
1204	* XXX - should we generate code to check for SNAP?
1205	*
1206	* XXX - the header is actually variable-length.
1207	* Some various Linux patched versions gave 38
1208	* as "off_linktype" and 40 as "off_nl"; however,
1209	* if a token ring packet has no routing
1210	* information, i.e. is not source-routed, the correct
1211	* values are 20 and 22, as they are in the vanilla code.
1212	*
1213	* A packet is source-routed iff the uppermost bit
1214	* of the first byte of the source address, at an
1215	* offset of 8, has the uppermost bit set. If the
1216	* packet is source-routed, the total number of bytes
1217	* of routing information is 2 plus bits 0x1F00 of
1218	* the 16-bit value at an offset of 14 (shifted right
1219	* 8 - figure out which byte that is).
1220	*/
1221	cstate->off_linktype.constant_part = 14;
1222	cstate->off_linkpl.constant_part = 14; /* Token Ring MAC header length */
1223	cstate->off_nl = 8; /* 802.2+SNAP */
1224	cstate->off_nl_nosnap = 3; /* 802.2 */
1225	break;
1226
1227	case DLT_PRISM_HEADER:
1228	case DLT_IEEE802_11_RADIO_AVS:
1229	case DLT_IEEE802_11_RADIO:
1230	cstate->off_linkhdr.is_variable = 1;
1231	/* Fall through, 802.11 doesn't have a variable link
1232	* prefix but is otherwise the same. */
1233
1234	case DLT_IEEE802_11:
1235	/*
1236	* 802.11 doesn't really have a link-level type field.
1237	* We set "off_linktype.constant_part" to the offset of
1238	* the LLC header.
1239	*
1240	* To check for Ethernet types, we assume that SSAP = SNAP
1241	* is being used and pick out the encapsulated Ethernet type.
1242	* XXX - should we generate code to check for SNAP?
1243	*
1244	* We also handle variable-length radio headers here.
1245	* The Prism header is in theory variable-length, but in
1246	* practice it's always 144 bytes long. However, some
1247	* drivers on Linux use ARPHRD_IEEE80211_PRISM, but
1248	* sometimes or always supply an AVS header, so we
1249	* have to check whether the radio header is a Prism
1250	* header or an AVS header, so, in practice, it's
1251	* variable-length.
1252	*/
1253	cstate->off_linktype.constant_part = 24;
1254	cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */
1255	cstate->off_linkpl.is_variable = 1;
1256	cstate->off_nl = 8; /* 802.2+SNAP */
1257	cstate->off_nl_nosnap = 3; /* 802.2 */
1258	break;
1259
1260	case DLT_PPI:
1261	/*
1262	* At the moment we treat PPI the same way that we treat
1263	* normal Radiotap encoded packets. The difference is in
1264	* the function that generates the code at the beginning
1265	* to compute the header length. Since this code generator
1266	* of PPI supports bare 802.11 encapsulation only (i.e.
1267	* the encapsulated DLT should be DLT_IEEE802_11) we
1268	* generate code to check for this too.
1269	*/
1270	cstate->off_linktype.constant_part = 24;
1271	cstate->off_linkpl.constant_part = 0; /* link-layer header is variable-length */
1272	cstate->off_linkpl.is_variable = 1;
1273	cstate->off_linkhdr.is_variable = 1;
1274	cstate->off_nl = 8; /* 802.2+SNAP */
1275	cstate->off_nl_nosnap = 3; /* 802.2 */
1276	break;
1277
1278	case DLT_ATM_RFC1483:
1279	case DLT_ATM_CLIP: /* Linux ATM defines this */
1280	/*
1281	* assume routed, non-ISO PDUs
1282	* (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
1283	*
1284	* XXX - what about ISO PDUs, e.g. CLNP, ISIS, ESIS,
1285	* or PPP with the PPP NLPID (e.g., PPPoA)? The
1286	* latter would presumably be treated the way PPPoE
1287	* should be, so you can do "pppoe and udp port 2049"
1288	* or "pppoa and tcp port 80" and have it check for
1289	* PPPo{A,E} and a PPP protocol of IP and....
1290	*/
1291	cstate->off_linktype.constant_part = 0;
1292	cstate->off_linkpl.constant_part = 0; /* packet begins with LLC header */
1293	cstate->off_nl = 8; /* 802.2+SNAP */
1294	cstate->off_nl_nosnap = 3; /* 802.2 */
1295	break;
1296
1297	case DLT_SUNATM:
1298	/*
1299	* Full Frontal ATM; you get AALn PDUs with an ATM
1300	* pseudo-header.
1301	*/
1302	cstate->is_atm = 1;
1303	cstate->off_vpi = SUNATM_VPI_POS;
1304	cstate->off_vci = SUNATM_VCI_POS;
1305	cstate->off_proto = PROTO_POS;
1306	cstate->off_payload = SUNATM_PKT_BEGIN_POS;
1307	cstate->off_linktype.constant_part = cstate->off_payload;
1308	cstate->off_linkpl.constant_part = cstate->off_payload; /* if LLC-encapsulated */
1309	cstate->off_nl = 8; /* 802.2+SNAP */
1310	cstate->off_nl_nosnap = 3; /* 802.2 */
1311	break;
1312
1313	case DLT_RAW:
1314	case DLT_IPV4:
1315	case DLT_IPV6:
1316	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1317	cstate->off_linkpl.constant_part = 0;
1318	cstate->off_nl = 0;
1319	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1320	break;
1321
1322	case DLT_LINUX_SLL: /* fake header for Linux cooked socket */
1323	cstate->off_linktype.constant_part = 14;
1324	cstate->off_linkpl.constant_part = 16;
1325	cstate->off_nl = 0;
1326	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1327	break;
1328
1329	case DLT_LTALK:
1330	/*
1331	* LocalTalk does have a 1-byte type field in the LLAP header,
1332	* but really it just indicates whether there is a "short" or
1333	* "long" DDP packet following.
1334	*/
1335	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1336	cstate->off_linkpl.constant_part = 0;
1337	cstate->off_nl = 0;
1338	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1339	break;
1340
1341	case DLT_IP_OVER_FC:
1342	/*
1343	* RFC 2625 IP-over-Fibre-Channel doesn't really have a
1344	* link-level type field. We set "off_linktype" to the
1345	* offset of the LLC header.
1346	*
1347	* To check for Ethernet types, we assume that SSAP = SNAP
1348	* is being used and pick out the encapsulated Ethernet type.
1349	* XXX - should we generate code to check for SNAP? RFC
1350	* 2625 says SNAP should be used.
1351	*/
1352	cstate->off_linktype.constant_part = 16;
1353	cstate->off_linkpl.constant_part = 16;
1354	cstate->off_nl = 8; /* 802.2+SNAP */
1355	cstate->off_nl_nosnap = 3; /* 802.2 */
1356	break;
1357
1358	case DLT_FRELAY:
1359	/*
1360	* XXX - we should set this to handle SNAP-encapsulated
1361	* frames (NLPID of 0x80).
1362	*/
1363	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1364	cstate->off_linkpl.constant_part = 0;
1365	cstate->off_nl = 0;
1366	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1367	break;
1368
1369	/*
1370	* the only BPF-interesting FRF.16 frames are non-control frames;
1371	* Frame Relay has a variable length link-layer
1372	* so lets start with offset 4 for now and increments later on (FIXME);
1373	*/
1374	case DLT_MFR:
1375	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1376	cstate->off_linkpl.constant_part = 0;
1377	cstate->off_nl = 4;
1378	cstate->off_nl_nosnap = 0; /* XXX - for now -> no 802.2 LLC */
1379	break;
1380
1381	case DLT_APPLE_IP_OVER_IEEE1394:
1382	cstate->off_linktype.constant_part = 16;
1383	cstate->off_linkpl.constant_part = 18;
1384	cstate->off_nl = 0;
1385	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1386	break;
1387
1388	case DLT_SYMANTEC_FIREWALL:
1389	cstate->off_linktype.constant_part = 6;
1390	cstate->off_linkpl.constant_part = 44;
1391	cstate->off_nl = 0; /* Ethernet II */
1392	cstate->off_nl_nosnap = 0; /* XXX - what does it do with 802.3 packets? */
1393	break;
1394
1395	#ifdef HAVE_NET_PFVAR_H
1396	case DLT_PFLOG:
1397	cstate->off_linktype.constant_part = 0;
1398	cstate->off_linkpl.constant_part = PFLOG_HDRLEN;
1399	cstate->off_nl = 0;
1400	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
1401	break;
1402	#endif
1403
1404	case DLT_JUNIPER_MFR:
1405	case DLT_JUNIPER_MLFR:
1406	case DLT_JUNIPER_MLPPP:
1407	case DLT_JUNIPER_PPP:
1408	case DLT_JUNIPER_CHDLC:
1409	case DLT_JUNIPER_FRELAY:
1410	cstate->off_linktype.constant_part = 4;
1411	cstate->off_linkpl.constant_part = 4;
1412	cstate->off_nl = 0;
1413	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1414	break;
1415
1416	case DLT_JUNIPER_ATM1:
1417	cstate->off_linktype.constant_part = 4; /* in reality variable between 4-8 */
1418	cstate->off_linkpl.constant_part = 4; /* in reality variable between 4-8 */
1419	cstate->off_nl = 0;
1420	cstate->off_nl_nosnap = 10;
1421	break;
1422
1423	case DLT_JUNIPER_ATM2:
1424	cstate->off_linktype.constant_part = 8; /* in reality variable between 8-12 */
1425	cstate->off_linkpl.constant_part = 8; /* in reality variable between 8-12 */
1426	cstate->off_nl = 0;
1427	cstate->off_nl_nosnap = 10;
1428	break;
1429
1430	/* frames captured on a Juniper PPPoE service PIC
1431	* contain raw ethernet frames */
1432	case DLT_JUNIPER_PPPOE:
1433	case DLT_JUNIPER_ETHER:
1434	cstate->off_linkpl.constant_part = 14;
1435	cstate->off_linktype.constant_part = 16;
1436	cstate->off_nl = 18; /* Ethernet II */
1437	cstate->off_nl_nosnap = 21; /* 802.3+802.2 */
1438	break;
1439
1440	case DLT_JUNIPER_PPPOE_ATM:
1441	cstate->off_linktype.constant_part = 4;
1442	cstate->off_linkpl.constant_part = 6;
1443	cstate->off_nl = 0;
1444	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1445	break;
1446
1447	case DLT_JUNIPER_GGSN:
1448	cstate->off_linktype.constant_part = 6;
1449	cstate->off_linkpl.constant_part = 12;
1450	cstate->off_nl = 0;
1451	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1452	break;
1453
1454	case DLT_JUNIPER_ES:
1455	cstate->off_linktype.constant_part = 6;
1456	cstate->off_linkpl.constant_part = OFFSET_NOT_SET; /* not really a network layer but raw IP addresses */
1457	cstate->off_nl = -1; /* not really a network layer but raw IP addresses */
1458	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1459	break;
1460
1461	case DLT_JUNIPER_MONITOR:
1462	cstate->off_linktype.constant_part = 12;
1463	cstate->off_linkpl.constant_part = 12;
1464	cstate->off_nl = 0; /* raw IP/IP6 header */
1465	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1466	break;
1467
1468	case DLT_BACNET_MS_TP:
1469	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1470	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1471	cstate->off_nl = -1;
1472	cstate->off_nl_nosnap = -1;
1473	break;
1474
1475	case DLT_JUNIPER_SERVICES:
1476	cstate->off_linktype.constant_part = 12;
1477	cstate->off_linkpl.constant_part = OFFSET_NOT_SET; /* L3 proto location dep. on cookie type */
1478	cstate->off_nl = -1; /* L3 proto location dep. on cookie type */
1479	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1480	break;
1481
1482	case DLT_JUNIPER_VP:
1483	cstate->off_linktype.constant_part = 18;
1484	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1485	cstate->off_nl = -1;
1486	cstate->off_nl_nosnap = -1;
1487	break;
1488
1489	case DLT_JUNIPER_ST:
1490	cstate->off_linktype.constant_part = 18;
1491	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1492	cstate->off_nl = -1;
1493	cstate->off_nl_nosnap = -1;
1494	break;
1495
1496	case DLT_JUNIPER_ISM:
1497	cstate->off_linktype.constant_part = 8;
1498	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1499	cstate->off_nl = -1;
1500	cstate->off_nl_nosnap = -1;
1501	break;
1502
1503	case DLT_JUNIPER_VS:
1504	case DLT_JUNIPER_SRX_E2E:
1505	case DLT_JUNIPER_FIBRECHANNEL:
1506	case DLT_JUNIPER_ATM_CEMIC:
1507	cstate->off_linktype.constant_part = 8;
1508	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1509	cstate->off_nl = -1;
1510	cstate->off_nl_nosnap = -1;
1511	break;
1512
1513	case DLT_MTP2:
1514	cstate->off_li = 2;
1515	cstate->off_li_hsl = 4;
1516	cstate->off_sio = 3;
1517	cstate->off_opc = 4;
1518	cstate->off_dpc = 4;
1519	cstate->off_sls = 7;
1520	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1521	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1522	cstate->off_nl = -1;
1523	cstate->off_nl_nosnap = -1;
1524	break;
1525
1526	case DLT_MTP2_WITH_PHDR:
1527	cstate->off_li = 6;
1528	cstate->off_li_hsl = 8;
1529	cstate->off_sio = 7;
1530	cstate->off_opc = 8;
1531	cstate->off_dpc = 8;
1532	cstate->off_sls = 11;
1533	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1534	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1535	cstate->off_nl = -1;
1536	cstate->off_nl_nosnap = -1;
1537	break;
1538
1539	case DLT_ERF:
1540	cstate->off_li = 22;
1541	cstate->off_li_hsl = 24;
1542	cstate->off_sio = 23;
1543	cstate->off_opc = 24;
1544	cstate->off_dpc = 24;
1545	cstate->off_sls = 27;
1546	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1547	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1548	cstate->off_nl = -1;
1549	cstate->off_nl_nosnap = -1;
1550	break;
1551
1552	case DLT_PFSYNC:
1553	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1554	cstate->off_linkpl.constant_part = 4;
1555	cstate->off_nl = 0;
1556	cstate->off_nl_nosnap = 0;
1557	break;
1558
1559	case DLT_AX25_KISS:
1560	/*
1561	* Currently, only raw "link[N:M]" filtering is supported.
1562	*/
1563	cstate->off_linktype.constant_part = OFFSET_NOT_SET; /* variable, min 15, max 71 steps of 7 */
1564	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1565	cstate->off_nl = -1; /* variable, min 16, max 71 steps of 7 */
1566	cstate->off_nl_nosnap = -1; /* no 802.2 LLC */
1567	break;
1568
1569	case DLT_IPNET:
1570	cstate->off_linktype.constant_part = 1;
1571	cstate->off_linkpl.constant_part = 24; /* ipnet header length */
1572	cstate->off_nl = 0;
1573	cstate->off_nl_nosnap = -1;
1574	break;
1575
1576	case DLT_NETANALYZER:
1577	cstate->off_linkhdr.constant_part = 4; /* Ethernet header is past 4-byte pseudo-header */
1578	cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12;
1579	cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* pseudo-header+Ethernet header length */
1580	cstate->off_nl = 0; /* Ethernet II */
1581	cstate->off_nl_nosnap = 3; /* 802.3+802.2 */
1582	break;
1583
1584	case DLT_NETANALYZER_TRANSPARENT:
1585	cstate->off_linkhdr.constant_part = 12; /* MAC header is past 4-byte pseudo-header, preamble, and SFD */
1586	cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12;
1587	cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* pseudo-header+preamble+SFD+Ethernet header length */
1588	cstate->off_nl = 0; /* Ethernet II */
1589	cstate->off_nl_nosnap = 3; /* 802.3+802.2 */
1590	break;
1591
1592	default:
1593	/*
1594	* For values in the range in which we've assigned new
1595	* DLT_ values, only raw "link[N:M]" filtering is supported.
1596	*/
1597	if (cstate->linktype >= DLT_MATCHING_MIN &&
1598	cstate->linktype <= DLT_MATCHING_MAX) {
1599	cstate->off_linktype.constant_part = OFFSET_NOT_SET;
1600	cstate->off_linkpl.constant_part = OFFSET_NOT_SET;
1601	cstate->off_nl = -1;
1602	cstate->off_nl_nosnap = -1;
1603	} else {
1604	bpf_error(cstate, "unknown data link type %d", cstate->linktype);
1605	}
1606	break;
1607	}
1608
1609	cstate->off_outermostlinkhdr = cstate->off_prevlinkhdr = cstate->off_linkhdr;
1610	}
1611
1612	/*
1613	* Load a value relative to the specified absolute offset.
1614	*/
1615	static struct slist *
1616	gen_load_absoffsetrel(compiler_state_t cstate, bpf_abs_offset abs_offset,
1617	u_int offset, u_int size)
1618	{
1619	struct slist s, s2;
1620
1621	s = gen_abs_offset_varpart(cstate, abs_offset);
1622
1623	/*
1624	* If "s" is non-null, it has code to arrange that the X register
1625	* contains the variable part of the absolute offset, so we
1626	* generate a load relative to that, with an offset of
1627	* abs_offset->constant_part + offset.
1628	*
1629	* Otherwise, we can do an absolute load with an offset of
1630	* abs_offset->constant_part + offset.
1631	*/
1632	if (s != NULL) {
1633	/*
1634	* "s" points to a list of statements that puts the
1635	* variable part of the absolute offset into the X register.
1636	* Do an indirect load, to use the X register as an offset.
1637	*/
1638	s2 = new_stmt(cstate, BPF_LD\|BPF_IND\|size);
1639	s2->s.k = abs_offset->constant_part + offset;
1640	sappend(s, s2);
1641	} else {
1642	/*
1643	* There is no variable part of the absolute offset, so
1644	* just do an absolute load.
1645	*/
1646	s = new_stmt(cstate, BPF_LD\|BPF_ABS\|size);
1647	s->s.k = abs_offset->constant_part + offset;
1648	}
1649	return s;
1650	}
1651
1652	/*
1653	* Load a value relative to the beginning of the specified header.
1654	*/
1655	static struct slist *
1656	gen_load_a(compiler_state_t *cstate, enum e_offrel offrel, u_int offset,
1657	u_int size)
1658	{
1659	struct slist s, s2;
1660
1661	switch (offrel) {
1662
1663	case OR_PACKET:
1664	s = new_stmt(cstate, BPF_LD\|BPF_ABS\|size);
1665	s->s.k = offset;
1666	break;
1667
1668	case OR_LINKHDR:
1669	s = gen_load_absoffsetrel(cstate, &cstate->off_linkhdr, offset, size);
1670	break;
1671
1672	case OR_PREVLINKHDR:
1673	s = gen_load_absoffsetrel(cstate, &cstate->off_prevlinkhdr, offset, size);
1674	break;
1675
1676	case OR_LLC:
1677	s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, offset, size);
1678	break;
1679
1680	case OR_PREVMPLSHDR:
1681	s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl - 4 + offset, size);
1682	break;
1683
1684	case OR_LINKPL:
1685	s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + offset, size);
1686	break;
1687
1688	case OR_LINKPL_NOSNAP:
1689	s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl_nosnap + offset, size);
1690	break;
1691
1692	case OR_LINKTYPE:
1693	s = gen_load_absoffsetrel(cstate, &cstate->off_linktype, offset, size);
1694	break;
1695
1696	case OR_TRAN_IPV4:
1697	/*
1698	* Load the X register with the length of the IPv4 header
1699	* (plus the offset of the link-layer header, if it's
1700	* preceded by a variable-length header such as a radio
1701	* header), in bytes.
1702	*/
1703	s = gen_loadx_iphdrlen(cstate);
1704
1705	/*
1706	* Load the item at {offset of the link-layer payload} +
1707	* {offset, relative to the start of the link-layer
1708	* paylod, of the IPv4 header} + {length of the IPv4 header} +
1709	* {specified offset}.
1710	*
1711	* If the offset of the link-layer payload is variable,
1712	* the variable part of that offset is included in the
1713	* value in the X register, and we include the constant
1714	* part in the offset of the load.
1715	*/
1716	s2 = new_stmt(cstate, BPF_LD\|BPF_IND\|size);
1717	s2->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + offset;
1718	sappend(s, s2);
1719	break;
1720
1721	case OR_TRAN_IPV6:
1722	s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + 40 + offset, size);
1723	break;
1724
1725	default:
1726	abort();
1727	return NULL;
1728	}
1729	return s;
1730	}
1731
1732	/*
1733	* Generate code to load into the X register the sum of the length of
1734	* the IPv4 header and the variable part of the offset of the link-layer
1735	* payload.
1736	*/
1737	static struct slist *
1738	gen_loadx_iphdrlen(compiler_state_t *cstate)
1739	{
1740	struct slist s, s2;
1741
1742	s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl);
1743	if (s != NULL) {
1744	/*
1745	* The offset of the link-layer payload has a variable
1746	* part. "s" points to a list of statements that put
1747	* the variable part of that offset into the X register.
1748	*
1749	* The 4*([k]&0xf) addressing mode can't be used, as we
1750	* don't have a constant offset, so we have to load the
1751	* value in question into the A register and add to it
1752	* the value from the X register.
1753	*/
1754	s2 = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
1755	s2->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
1756	sappend(s, s2);
1757	s2 = new_stmt(cstate, BPF_ALU\|BPF_AND\|BPF_K);
1758	s2->s.k = 0xf;
1759	sappend(s, s2);
1760	s2 = new_stmt(cstate, BPF_ALU\|BPF_LSH\|BPF_K);
1761	s2->s.k = 2;
1762	sappend(s, s2);
1763
1764	/*
1765	* The A register now contains the length of the IP header.
1766	* We need to add to it the variable part of the offset of
1767	* the link-layer payload, which is still in the X
1768	* register, and move the result into the X register.
1769	*/
1770	sappend(s, new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X));
1771	sappend(s, new_stmt(cstate, BPF_MISC\|BPF_TAX));
1772	} else {
1773	/*
1774	* The offset of the link-layer payload is a constant,
1775	* so no code was generated to load the (non-existent)
1776	* variable part of that offset.
1777	*
1778	* This means we can use the 4*([k]&0xf) addressing
1779	* mode. Load the length of the IPv4 header, which
1780	* is at an offset of cstate->off_nl from the beginning of
1781	* the link-layer payload, and thus at an offset of
1782	* cstate->off_linkpl.constant_part + cstate->off_nl from the beginning
1783	* of the raw packet data, using that addressing mode.
1784	*/
1785	s = new_stmt(cstate, BPF_LDX\|BPF_MSH\|BPF_B);
1786	s->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
1787	}
1788	return s;
1789	}
1790
1791	static struct block *
1792	gen_uncond(compiler_state_t *cstate, int rsense)
1793	{
1794	struct block *b;
1795	struct slist *s;
1796
1797	s = new_stmt(cstate, BPF_LD\|BPF_IMM);
1798	s->s.k = !rsense;
1799	b = new_block(cstate, JMP(BPF_JEQ));
1800	b->stmts = s;
1801
1802	return b;
1803	}
1804
1805	static inline struct block *
1806	gen_true(compiler_state_t *cstate)
1807	{
1808	return gen_uncond(cstate, 1);
1809	}
1810
1811	static inline struct block *
1812	gen_false(compiler_state_t *cstate)
1813	{
1814	return gen_uncond(cstate, 0);
1815	}
1816
1817	/*
1818	* Byte-swap a 32-bit number.
1819	* ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
1820	* big-endian platforms.)
1821	*/
1822	#define SWAPLONG(y) \
1823	((((y)&0xff)<<24) \| (((y)&0xff00)<<8) \| (((y)&0xff0000)>>8) \| (((y)>>24)&0xff))
1824
1825	/*
1826	* Generate code to match a particular packet type.
1827	*
1828	* "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
1829	* value, if <= ETHERMTU. We use that to determine whether to
1830	* match the type/length field or to check the type/length field for
1831	* a value <= ETHERMTU to see whether it's a type field and then do
1832	* the appropriate test.
1833	*/
1834	static struct block *
1835	gen_ether_linktype(compiler_state_t *cstate, int proto)
1836	{
1837	struct block b0, b1;
1838
1839	switch (proto) {
1840
1841	case LLCSAP_ISONS:
1842	case LLCSAP_IP:
1843	case LLCSAP_NETBEUI:
1844	/*
1845	* OSI protocols and NetBEUI always use 802.2 encapsulation,
1846	* so we check the DSAP and SSAP.
1847	*
1848	* LLCSAP_IP checks for IP-over-802.2, rather
1849	* than IP-over-Ethernet or IP-over-SNAP.
1850	*
1851	* XXX - should we check both the DSAP and the
1852	* SSAP, like this, or should we check just the
1853	* DSAP, as we do for other types <= ETHERMTU
1854	* (i.e., other SAP values)?
1855	*/
1856	b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU);
1857	gen_not(b0);
1858	b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)
1859	((proto << 8) \| proto));
1860	gen_and(b0, b1);
1861	return b1;
1862
1863	case LLCSAP_IPX:
1864	/*
1865	* Check for;
1866	*
1867	* Ethernet_II frames, which are Ethernet
1868	* frames with a frame type of ETHERTYPE_IPX;
1869	*
1870	* Ethernet_802.3 frames, which are 802.3
1871	* frames (i.e., the type/length field is
1872	* a length field, <= ETHERMTU, rather than
1873	* a type field) with the first two bytes
1874	* after the Ethernet/802.3 header being
1875	* 0xFFFF;
1876	*
1877	* Ethernet_802.2 frames, which are 802.3
1878	* frames with an 802.2 LLC header and
1879	* with the IPX LSAP as the DSAP in the LLC
1880	* header;
1881	*
1882	* Ethernet_SNAP frames, which are 802.3
1883	* frames with an LLC header and a SNAP
1884	* header and with an OUI of 0x000000
1885	* (encapsulated Ethernet) and a protocol
1886	* ID of ETHERTYPE_IPX in the SNAP header.
1887	*
1888	* XXX - should we generate the same code both
1889	* for tests for LLCSAP_IPX and for ETHERTYPE_IPX?
1890	*/
1891
1892	/*
1893	* This generates code to check both for the
1894	* IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
1895	*/
1896	b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX);
1897	b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)0xFFFF);
1898	gen_or(b0, b1);
1899
1900	/*
1901	* Now we add code to check for SNAP frames with
1902	* ETHERTYPE_IPX, i.e. Ethernet_SNAP.
1903	*/
1904	b0 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX);
1905	gen_or(b0, b1);
1906
1907	/*
1908	* Now we generate code to check for 802.3
1909	* frames in general.
1910	*/
1911	b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU);
1912	gen_not(b0);
1913
1914	/*
1915	* Now add the check for 802.3 frames before the
1916	* check for Ethernet_802.2 and Ethernet_802.3,
1917	* as those checks should only be done on 802.3
1918	* frames, not on Ethernet frames.
1919	*/
1920	gen_and(b0, b1);
1921
1922	/*
1923	* Now add the check for Ethernet_II frames, and
1924	* do that before checking for the other frame
1925	* types.
1926	*/
1927	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX);
1928	gen_or(b0, b1);
1929	return b1;
1930
1931	case ETHERTYPE_ATALK:
1932	case ETHERTYPE_AARP:
1933	/*
1934	* EtherTalk (AppleTalk protocols on Ethernet link
1935	* layer) may use 802.2 encapsulation.
1936	*/
1937
1938	/*
1939	* Check for 802.2 encapsulation (EtherTalk phase 2?);
1940	* we check for an Ethernet type field less than
1941	* 1500, which means it's an 802.3 length field.
1942	*/
1943	b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU);
1944	gen_not(b0);
1945
1946	/*
1947	* 802.2-encapsulated ETHERTYPE_ATALK packets are
1948	* SNAP packets with an organization code of
1949	* 0x080007 (Apple, for Appletalk) and a protocol
1950	* type of ETHERTYPE_ATALK (Appletalk).
1951	*
1952	* 802.2-encapsulated ETHERTYPE_AARP packets are
1953	* SNAP packets with an organization code of
1954	* 0x000000 (encapsulated Ethernet) and a protocol
1955	* type of ETHERTYPE_AARP (Appletalk ARP).
1956	*/
1957	if (proto == ETHERTYPE_ATALK)
1958	b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK);
1959	else /* proto == ETHERTYPE_AARP */
1960	b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP);
1961	gen_and(b0, b1);
1962
1963	/*
1964	* Check for Ethernet encapsulation (Ethertalk
1965	* phase 1?); we just check for the Ethernet
1966	* protocol type.
1967	*/
1968	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
1969
1970	gen_or(b0, b1);
1971	return b1;
1972
1973	default:
1974	if (proto <= ETHERMTU) {
1975	/*
1976	* This is an LLC SAP value, so the frames
1977	* that match would be 802.2 frames.
1978	* Check that the frame is an 802.2 frame
1979	* (i.e., that the length/type field is
1980	* a length field, <= ETHERMTU) and
1981	* then check the DSAP.
1982	*/
1983	b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU);
1984	gen_not(b0);
1985	b1 = gen_cmp(cstate, OR_LINKTYPE, 2, BPF_B, (bpf_int32)proto);
1986	gen_and(b0, b1);
1987	return b1;
1988	} else {
1989	/*
1990	* This is an Ethernet type, so compare
1991	* the length/type field with it (if
1992	* the frame is an 802.2 frame, the length
1993	* field will be <= ETHERMTU, and, as
1994	* "proto" is > ETHERMTU, this test
1995	* will fail and the frame won't match,
1996	* which is what we want).
1997	*/
1998	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H,
1999	(bpf_int32)proto);
2000	}
2001	}
2002	}
2003
2004	static struct block *
2005	gen_loopback_linktype(compiler_state_t *cstate, int proto)
2006	{
2007	/*
2008	* For DLT_NULL, the link-layer header is a 32-bit word
2009	* containing an AF_ value in host byte order, and for
2010	* DLT_ENC, the link-layer header begins with a 32-bit
2011	* word containing an AF_ value in host byte order.
2012	*
2013	* In addition, if we're reading a saved capture file,
2014	* the host byte order in the capture may not be the
2015	* same as the host byte order on this machine.
2016	*
2017	* For DLT_LOOP, the link-layer header is a 32-bit
2018	* word containing an AF_ value in network byte order.
2019	*/
2020	if (cstate->linktype == DLT_NULL \|\| cstate->linktype == DLT_ENC) {
2021	/*
2022	* The AF_ value is in host byte order, but the BPF
2023	* interpreter will convert it to network byte order.
2024	*
2025	* If this is a save file, and it's from a machine
2026	* with the opposite byte order to ours, we byte-swap
2027	* the AF_ value.
2028	*
2029	* Then we run it through "htonl()", and generate
2030	* code to compare against the result.
2031	*/
2032	if (cstate->bpf_pcap->rfile != NULL && cstate->bpf_pcap->swapped)
2033	proto = SWAPLONG(proto);
2034	proto = htonl(proto);
2035	}
2036	return (gen_cmp(cstate, OR_LINKHDR, 0, BPF_W, (bpf_int32)proto));
2037	}
2038
2039	/*
2040	* "proto" is an Ethernet type value and for IPNET, if it is not IPv4
2041	* or IPv6 then we have an error.
2042	*/
2043	static struct block *
2044	gen_ipnet_linktype(compiler_state_t *cstate, int proto)
2045	{
2046	switch (proto) {
2047
2048	case ETHERTYPE_IP:
2049	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, (bpf_int32)IPH_AF_INET);
2050	/* NOTREACHED */
2051
2052	case ETHERTYPE_IPV6:
2053	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
2054	(bpf_int32)IPH_AF_INET6);
2055	/* NOTREACHED */
2056
2057	default:
2058	break;
2059	}
2060
2061	return gen_false(cstate);
2062	}
2063
2064	/*
2065	* Generate code to match a particular packet type.
2066	*
2067	* "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
2068	* value, if <= ETHERMTU. We use that to determine whether to
2069	* match the type field or to check the type field for the special
2070	* LINUX_SLL_P_802_2 value and then do the appropriate test.
2071	*/
2072	static struct block *
2073	gen_linux_sll_linktype(compiler_state_t *cstate, int proto)
2074	{
2075	struct block b0, b1;
2076
2077	switch (proto) {
2078
2079	case LLCSAP_ISONS:
2080	case LLCSAP_IP:
2081	case LLCSAP_NETBEUI:
2082	/*
2083	* OSI protocols and NetBEUI always use 802.2 encapsulation,
2084	* so we check the DSAP and SSAP.
2085	*
2086	* LLCSAP_IP checks for IP-over-802.2, rather
2087	* than IP-over-Ethernet or IP-over-SNAP.
2088	*
2089	* XXX - should we check both the DSAP and the
2090	* SSAP, like this, or should we check just the
2091	* DSAP, as we do for other types <= ETHERMTU
2092	* (i.e., other SAP values)?
2093	*/
2094	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
2095	b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)
2096	((proto << 8) \| proto));
2097	gen_and(b0, b1);
2098	return b1;
2099
2100	case LLCSAP_IPX:
2101	/*
2102	* Ethernet_II frames, which are Ethernet
2103	* frames with a frame type of ETHERTYPE_IPX;
2104	*
2105	* Ethernet_802.3 frames, which have a frame
2106	* type of LINUX_SLL_P_802_3;
2107	*
2108	* Ethernet_802.2 frames, which are 802.3
2109	* frames with an 802.2 LLC header (i.e, have
2110	* a frame type of LINUX_SLL_P_802_2) and
2111	* with the IPX LSAP as the DSAP in the LLC
2112	* header;
2113	*
2114	* Ethernet_SNAP frames, which are 802.3
2115	* frames with an LLC header and a SNAP
2116	* header and with an OUI of 0x000000
2117	* (encapsulated Ethernet) and a protocol
2118	* ID of ETHERTYPE_IPX in the SNAP header.
2119	*
2120	* First, do the checks on LINUX_SLL_P_802_2
2121	* frames; generate the check for either
2122	* Ethernet_802.2 or Ethernet_SNAP frames, and
2123	* then put a check for LINUX_SLL_P_802_2 frames
2124	* before it.
2125	*/
2126	b0 = gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)LLCSAP_IPX);
2127	b1 = gen_snap(cstate, 0x000000, ETHERTYPE_IPX);
2128	gen_or(b0, b1);
2129	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
2130	gen_and(b0, b1);
2131
2132	/*
2133	* Now check for 802.3 frames and OR that with
2134	* the previous test.
2135	*/
2136	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_3);
2137	gen_or(b0, b1);
2138
2139	/*
2140	* Now add the check for Ethernet_II frames, and
2141	* do that before checking for the other frame
2142	* types.
2143	*/
2144	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)ETHERTYPE_IPX);
2145	gen_or(b0, b1);
2146	return b1;
2147
2148	case ETHERTYPE_ATALK:
2149	case ETHERTYPE_AARP:
2150	/*
2151	* EtherTalk (AppleTalk protocols on Ethernet link
2152	* layer) may use 802.2 encapsulation.
2153	*/
2154
2155	/*
2156	* Check for 802.2 encapsulation (EtherTalk phase 2?);
2157	* we check for the 802.2 protocol type in the
2158	* "Ethernet type" field.
2159	*/
2160	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
2161
2162	/*
2163	* 802.2-encapsulated ETHERTYPE_ATALK packets are
2164	* SNAP packets with an organization code of
2165	* 0x080007 (Apple, for Appletalk) and a protocol
2166	* type of ETHERTYPE_ATALK (Appletalk).
2167	*
2168	* 802.2-encapsulated ETHERTYPE_AARP packets are
2169	* SNAP packets with an organization code of
2170	* 0x000000 (encapsulated Ethernet) and a protocol
2171	* type of ETHERTYPE_AARP (Appletalk ARP).
2172	*/
2173	if (proto == ETHERTYPE_ATALK)
2174	b1 = gen_snap(cstate, 0x080007, ETHERTYPE_ATALK);
2175	else /* proto == ETHERTYPE_AARP */
2176	b1 = gen_snap(cstate, 0x000000, ETHERTYPE_AARP);
2177	gen_and(b0, b1);
2178
2179	/*
2180	* Check for Ethernet encapsulation (Ethertalk
2181	* phase 1?); we just check for the Ethernet
2182	* protocol type.
2183	*/
2184	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
2185
2186	gen_or(b0, b1);
2187	return b1;
2188
2189	default:
2190	if (proto <= ETHERMTU) {
2191	/*
2192	* This is an LLC SAP value, so the frames
2193	* that match would be 802.2 frames.
2194	* Check for the 802.2 protocol type
2195	* in the "Ethernet type" field, and
2196	* then check the DSAP.
2197	*/
2198	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, LINUX_SLL_P_802_2);
2199	b1 = gen_cmp(cstate, OR_LINKHDR, cstate->off_linkpl.constant_part, BPF_B,
2200	(bpf_int32)proto);
2201	gen_and(b0, b1);
2202	return b1;
2203	} else {
2204	/*
2205	* This is an Ethernet type, so compare
2206	* the length/type field with it (if
2207	* the frame is an 802.2 frame, the length
2208	* field will be <= ETHERMTU, and, as
2209	* "proto" is > ETHERMTU, this test
2210	* will fail and the frame won't match,
2211	* which is what we want).
2212	*/
2213	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
2214	}
2215	}
2216	}
2217
2218	static struct slist *
2219	gen_load_prism_llprefixlen(compiler_state_t *cstate)
2220	{
2221	struct slist s1, s2;
2222	struct slist *sjeq_avs_cookie;
2223	struct slist *sjcommon;
2224
2225	/*
2226	* This code is not compatible with the optimizer, as
2227	* we are generating jmp instructions within a normal
2228	* slist of instructions
2229	*/
2230	cstate->no_optimize = 1;
2231
2232	/*
2233	* Generate code to load the length of the radio header into
2234	* the register assigned to hold that length, if one has been
2235	* assigned. (If one hasn't been assigned, no code we've
2236	* generated uses that prefix, so we don't need to generate any
2237	* code to load it.)
2238	*
2239	* Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes
2240	* or always use the AVS header rather than the Prism header.
2241	* We load a 4-byte big-endian value at the beginning of the
2242	* raw packet data, and see whether, when masked with 0xFFFFF000,
2243	* it's equal to 0x80211000. If so, that indicates that it's
2244	* an AVS header (the masked-out bits are the version number).
2245	* Otherwise, it's a Prism header.
2246	*
2247	* XXX - the Prism header is also, in theory, variable-length,
2248	* but no known software generates headers that aren't 144
2249	* bytes long.
2250	*/
2251	if (cstate->off_linkhdr.reg != -1) {
2252	/*
2253	* Load the cookie.
2254	*/
2255	s1 = new_stmt(cstate, BPF_LD\|BPF_W\|BPF_ABS);
2256	s1->s.k = 0;
2257
2258	/*
2259	* AND it with 0xFFFFF000.
2260	*/
2261	s2 = new_stmt(cstate, BPF_ALU\|BPF_AND\|BPF_K);
2262	s2->s.k = 0xFFFFF000;
2263	sappend(s1, s2);
2264
2265	/*
2266	* Compare with 0x80211000.
2267	*/
2268	sjeq_avs_cookie = new_stmt(cstate, JMP(BPF_JEQ));
2269	sjeq_avs_cookie->s.k = 0x80211000;
2270	sappend(s1, sjeq_avs_cookie);
2271
2272	/*
2273	* If it's AVS:
2274	*
2275	* The 4 bytes at an offset of 4 from the beginning of
2276	* the AVS header are the length of the AVS header.
2277	* That field is big-endian.
2278	*/
2279	s2 = new_stmt(cstate, BPF_LD\|BPF_W\|BPF_ABS);
2280	s2->s.k = 4;
2281	sappend(s1, s2);
2282	sjeq_avs_cookie->s.jt = s2;
2283
2284	/*
2285	* Now jump to the code to allocate a register
2286	* into which to save the header length and
2287	* store the length there. (The "jump always"
2288	* instruction needs to have the k field set;
2289	* it's added to the PC, so, as we're jumping
2290	* over a single instruction, it should be 1.)
2291	*/
2292	sjcommon = new_stmt(cstate, JMP(BPF_JA));
2293	sjcommon->s.k = 1;
2294	sappend(s1, sjcommon);
2295
2296	/*
2297	* Now for the code that handles the Prism header.
2298	* Just load the length of the Prism header (144)
2299	* into the A register. Have the test for an AVS
2300	* header branch here if we don't have an AVS header.
2301	*/
2302	s2 = new_stmt(cstate, BPF_LD\|BPF_W\|BPF_IMM);
2303	s2->s.k = 144;
2304	sappend(s1, s2);
2305	sjeq_avs_cookie->s.jf = s2;
2306
2307	/*
2308	* Now allocate a register to hold that value and store
2309	* it. The code for the AVS header will jump here after
2310	* loading the length of the AVS header.
2311	*/
2312	s2 = new_stmt(cstate, BPF_ST);
2313	s2->s.k = cstate->off_linkhdr.reg;
2314	sappend(s1, s2);
2315	sjcommon->s.jf = s2;
2316
2317	/*
2318	* Now move it into the X register.
2319	*/
2320	s2 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
2321	sappend(s1, s2);
2322
2323	return (s1);
2324	} else
2325	return (NULL);
2326	}
2327
2328	static struct slist *
2329	gen_load_avs_llprefixlen(compiler_state_t *cstate)
2330	{
2331	struct slist s1, s2;
2332
2333	/*
2334	* Generate code to load the length of the AVS header into
2335	* the register assigned to hold that length, if one has been
2336	* assigned. (If one hasn't been assigned, no code we've
2337	* generated uses that prefix, so we don't need to generate any
2338	* code to load it.)
2339	*/
2340	if (cstate->off_linkhdr.reg != -1) {
2341	/*
2342	* The 4 bytes at an offset of 4 from the beginning of
2343	* the AVS header are the length of the AVS header.
2344	* That field is big-endian.
2345	*/
2346	s1 = new_stmt(cstate, BPF_LD\|BPF_W\|BPF_ABS);
2347	s1->s.k = 4;
2348
2349	/*
2350	* Now allocate a register to hold that value and store
2351	* it.
2352	*/
2353	s2 = new_stmt(cstate, BPF_ST);
2354	s2->s.k = cstate->off_linkhdr.reg;
2355	sappend(s1, s2);
2356
2357	/*
2358	* Now move it into the X register.
2359	*/
2360	s2 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
2361	sappend(s1, s2);
2362
2363	return (s1);
2364	} else
2365	return (NULL);
2366	}
2367
2368	static struct slist *
2369	gen_load_radiotap_llprefixlen(compiler_state_t *cstate)
2370	{
2371	struct slist s1, s2;
2372
2373	/*
2374	* Generate code to load the length of the radiotap header into
2375	* the register assigned to hold that length, if one has been
2376	* assigned. (If one hasn't been assigned, no code we've
2377	* generated uses that prefix, so we don't need to generate any
2378	* code to load it.)
2379	*/
2380	if (cstate->off_linkhdr.reg != -1) {
2381	/*
2382	* The 2 bytes at offsets of 2 and 3 from the beginning
2383	* of the radiotap header are the length of the radiotap
2384	* header; unfortunately, it's little-endian, so we have
2385	* to load it a byte at a time and construct the value.
2386	*/
2387
2388	/*
2389	* Load the high-order byte, at an offset of 3, shift it
2390	* left a byte, and put the result in the X register.
2391	*/
2392	s1 = new_stmt(cstate, BPF_LD\|BPF_B\|BPF_ABS);
2393	s1->s.k = 3;
2394	s2 = new_stmt(cstate, BPF_ALU\|BPF_LSH\|BPF_K);
2395	sappend(s1, s2);
2396	s2->s.k = 8;
2397	s2 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
2398	sappend(s1, s2);
2399
2400	/*
2401	* Load the next byte, at an offset of 2, and OR the
2402	* value from the X register into it.
2403	*/
2404	s2 = new_stmt(cstate, BPF_LD\|BPF_B\|BPF_ABS);
2405	sappend(s1, s2);
2406	s2->s.k = 2;
2407	s2 = new_stmt(cstate, BPF_ALU\|BPF_OR\|BPF_X);
2408	sappend(s1, s2);
2409
2410	/*
2411	* Now allocate a register to hold that value and store
2412	* it.
2413	*/
2414	s2 = new_stmt(cstate, BPF_ST);
2415	s2->s.k = cstate->off_linkhdr.reg;
2416	sappend(s1, s2);
2417
2418	/*
2419	* Now move it into the X register.
2420	*/
2421	s2 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
2422	sappend(s1, s2);
2423
2424	return (s1);
2425	} else
2426	return (NULL);
2427	}
2428
2429	/*
2430	* At the moment we treat PPI as normal Radiotap encoded
2431	* packets. The difference is in the function that generates
2432	* the code at the beginning to compute the header length.
2433	* Since this code generator of PPI supports bare 802.11
2434	* encapsulation only (i.e. the encapsulated DLT should be
2435	* DLT_IEEE802_11) we generate code to check for this too;
2436	* that's done in finish_parse().
2437	*/
2438	static struct slist *
2439	gen_load_ppi_llprefixlen(compiler_state_t *cstate)
2440	{
2441	struct slist s1, s2;
2442
2443	/*
2444	* Generate code to load the length of the radiotap header
2445	* into the register assigned to hold that length, if one has
2446	* been assigned.
2447	*/
2448	if (cstate->off_linkhdr.reg != -1) {
2449	/*
2450	* The 2 bytes at offsets of 2 and 3 from the beginning
2451	* of the radiotap header are the length of the radiotap
2452	* header; unfortunately, it's little-endian, so we have
2453	* to load it a byte at a time and construct the value.
2454	*/
2455
2456	/*
2457	* Load the high-order byte, at an offset of 3, shift it
2458	* left a byte, and put the result in the X register.
2459	*/
2460	s1 = new_stmt(cstate, BPF_LD\|BPF_B\|BPF_ABS);
2461	s1->s.k = 3;
2462	s2 = new_stmt(cstate, BPF_ALU\|BPF_LSH\|BPF_K);
2463	sappend(s1, s2);
2464	s2->s.k = 8;
2465	s2 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
2466	sappend(s1, s2);
2467
2468	/*
2469	* Load the next byte, at an offset of 2, and OR the
2470	* value from the X register into it.
2471	*/
2472	s2 = new_stmt(cstate, BPF_LD\|BPF_B\|BPF_ABS);
2473	sappend(s1, s2);
2474	s2->s.k = 2;
2475	s2 = new_stmt(cstate, BPF_ALU\|BPF_OR\|BPF_X);
2476	sappend(s1, s2);
2477
2478	/*
2479	* Now allocate a register to hold that value and store
2480	* it.
2481	*/
2482	s2 = new_stmt(cstate, BPF_ST);
2483	s2->s.k = cstate->off_linkhdr.reg;
2484	sappend(s1, s2);
2485
2486	/*
2487	* Now move it into the X register.
2488	*/
2489	s2 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
2490	sappend(s1, s2);
2491
2492	return (s1);
2493	} else
2494	return (NULL);
2495	}
2496
2497	/*
2498	* Load a value relative to the beginning of the link-layer header after the 802.11
2499	* header, i.e. LLC_SNAP.
2500	* The link-layer header doesn't necessarily begin at the beginning
2501	* of the packet data; there might be a variable-length prefix containing
2502	* radio information.
2503	*/
2504	static struct slist *
2505	gen_load_802_11_header_len(compiler_state_t cstate, struct slist s, struct slist *snext)
2506	{
2507	struct slist *s2;
2508	struct slist *sjset_data_frame_1;
2509	struct slist *sjset_data_frame_2;
2510	struct slist *sjset_qos;
2511	struct slist *sjset_radiotap_flags_present;
2512	struct slist *sjset_radiotap_ext_present;
2513	struct slist *sjset_radiotap_tsft_present;
2514	struct slist sjset_tsft_datapad, sjset_notsft_datapad;
2515	struct slist *s_roundup;
2516
2517	if (cstate->off_linkpl.reg == -1) {
2518	/*
2519	* No register has been assigned to the offset of
2520	* the link-layer payload, which means nobody needs
2521	* it; don't bother computing it - just return
2522	* what we already have.
2523	*/
2524	return (s);
2525	}
2526
2527	/*
2528	* This code is not compatible with the optimizer, as
2529	* we are generating jmp instructions within a normal
2530	* slist of instructions
2531	*/
2532	cstate->no_optimize = 1;
2533
2534	/*
2535	* If "s" is non-null, it has code to arrange that the X register
2536	* contains the length of the prefix preceding the link-layer
2537	* header.
2538	*
2539	* Otherwise, the length of the prefix preceding the link-layer
2540	* header is "off_outermostlinkhdr.constant_part".
2541	*/
2542	if (s == NULL) {
2543	/*
2544	* There is no variable-length header preceding the
2545	* link-layer header.
2546	*
2547	* Load the length of the fixed-length prefix preceding
2548	* the link-layer header (if any) into the X register,
2549	* and store it in the cstate->off_linkpl.reg register.
2550	* That length is off_outermostlinkhdr.constant_part.
2551	*/
2552	s = new_stmt(cstate, BPF_LDX\|BPF_IMM);
2553	s->s.k = cstate->off_outermostlinkhdr.constant_part;
2554	}
2555
2556	/*
2557	* The X register contains the offset of the beginning of the
2558	* link-layer header; add 24, which is the minimum length
2559	* of the MAC header for a data frame, to that, and store it
2560	* in cstate->off_linkpl.reg, and then load the Frame Control field,
2561	* which is at the offset in the X register, with an indexed load.
2562	*/
2563	s2 = new_stmt(cstate, BPF_MISC\|BPF_TXA);
2564	sappend(s, s2);
2565	s2 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
2566	s2->s.k = 24;
2567	sappend(s, s2);
2568	s2 = new_stmt(cstate, BPF_ST);
2569	s2->s.k = cstate->off_linkpl.reg;
2570	sappend(s, s2);
2571
2572	s2 = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
2573	s2->s.k = 0;
2574	sappend(s, s2);
2575
2576	/*
2577	* Check the Frame Control field to see if this is a data frame;
2578	* a data frame has the 0x08 bit (b3) in that field set and the
2579	* 0x04 bit (b2) clear.
2580	*/
2581	sjset_data_frame_1 = new_stmt(cstate, JMP(BPF_JSET));
2582	sjset_data_frame_1->s.k = 0x08;
2583	sappend(s, sjset_data_frame_1);
2584
2585	/*
2586	* If b3 is set, test b2, otherwise go to the first statement of
2587	* the rest of the program.
2588	*/
2589	sjset_data_frame_1->s.jt = sjset_data_frame_2 = new_stmt(cstate, JMP(BPF_JSET));
2590	sjset_data_frame_2->s.k = 0x04;
2591	sappend(s, sjset_data_frame_2);
2592	sjset_data_frame_1->s.jf = snext;
2593
2594	/*
2595	* If b2 is not set, this is a data frame; test the QoS bit.
2596	* Otherwise, go to the first statement of the rest of the
2597	* program.
2598	*/
2599	sjset_data_frame_2->s.jt = snext;
2600	sjset_data_frame_2->s.jf = sjset_qos = new_stmt(cstate, JMP(BPF_JSET));
2601	sjset_qos->s.k = 0x80; /* QoS bit */
2602	sappend(s, sjset_qos);
2603
2604	/*
2605	* If it's set, add 2 to cstate->off_linkpl.reg, to skip the QoS
2606	* field.
2607	* Otherwise, go to the first statement of the rest of the
2608	* program.
2609	*/
2610	sjset_qos->s.jt = s2 = new_stmt(cstate, BPF_LD\|BPF_MEM);
2611	s2->s.k = cstate->off_linkpl.reg;
2612	sappend(s, s2);
2613	s2 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_IMM);
2614	s2->s.k = 2;
2615	sappend(s, s2);
2616	s2 = new_stmt(cstate, BPF_ST);
2617	s2->s.k = cstate->off_linkpl.reg;
2618	sappend(s, s2);
2619
2620	/*
2621	* If we have a radiotap header, look at it to see whether
2622	* there's Atheros padding between the MAC-layer header
2623	* and the payload.
2624	*
2625	* Note: all of the fields in the radiotap header are
2626	* little-endian, so we byte-swap all of the values
2627	* we test against, as they will be loaded as big-endian
2628	* values.
2629	*
2630	* XXX - in the general case, we would have to scan through
2631	* all the presence bits, if there's more than one word of
2632	* presence bits. That would require a loop, meaning that
2633	* we wouldn't be able to run the filter in the kernel.
2634	*
2635	* We assume here that the Atheros adapters that insert the
2636	* annoying padding don't have multiple antennae and therefore
2637	* do not generate radiotap headers with multiple presence words.
2638	*/
2639	if (cstate->linktype == DLT_IEEE802_11_RADIO) {
2640	/*
2641	* Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set
2642	* in the first presence flag word?
2643	*/
2644	sjset_qos->s.jf = s2 = new_stmt(cstate, BPF_LD\|BPF_ABS\|BPF_W);
2645	s2->s.k = 4;
2646	sappend(s, s2);
2647
2648	sjset_radiotap_flags_present = new_stmt(cstate, JMP(BPF_JSET));
2649	sjset_radiotap_flags_present->s.k = SWAPLONG(0x00000002);
2650	sappend(s, sjset_radiotap_flags_present);
2651
2652	/*
2653	* If not, skip all of this.
2654	*/
2655	sjset_radiotap_flags_present->s.jf = snext;
2656
2657	/*
2658	* Otherwise, is the "extension" bit set in that word?
2659	*/
2660	sjset_radiotap_ext_present = new_stmt(cstate, JMP(BPF_JSET));
2661	sjset_radiotap_ext_present->s.k = SWAPLONG(0x80000000);
2662	sappend(s, sjset_radiotap_ext_present);
2663	sjset_radiotap_flags_present->s.jt = sjset_radiotap_ext_present;
2664
2665	/*
2666	* If so, skip all of this.
2667	*/
2668	sjset_radiotap_ext_present->s.jt = snext;
2669
2670	/*
2671	* Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set?
2672	*/
2673	sjset_radiotap_tsft_present = new_stmt(cstate, JMP(BPF_JSET));
2674	sjset_radiotap_tsft_present->s.k = SWAPLONG(0x00000001);
2675	sappend(s, sjset_radiotap_tsft_present);
2676	sjset_radiotap_ext_present->s.jf = sjset_radiotap_tsft_present;
2677
2678	/*
2679	* If IEEE80211_RADIOTAP_TSFT is set, the flags field is
2680	* at an offset of 16 from the beginning of the raw packet
2681	* data (8 bytes for the radiotap header and 8 bytes for
2682	* the TSFT field).
2683	*
2684	* Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2685	* is set.
2686	*/
2687	s2 = new_stmt(cstate, BPF_LD\|BPF_ABS\|BPF_B);
2688	s2->s.k = 16;
2689	sappend(s, s2);
2690	sjset_radiotap_tsft_present->s.jt = s2;
2691
2692	sjset_tsft_datapad = new_stmt(cstate, JMP(BPF_JSET));
2693	sjset_tsft_datapad->s.k = 0x20;
2694	sappend(s, sjset_tsft_datapad);
2695
2696	/*
2697	* If IEEE80211_RADIOTAP_TSFT is not set, the flags field is
2698	* at an offset of 8 from the beginning of the raw packet
2699	* data (8 bytes for the radiotap header).
2700	*
2701	* Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
2702	* is set.
2703	*/
2704	s2 = new_stmt(cstate, BPF_LD\|BPF_ABS\|BPF_B);
2705	s2->s.k = 8;
2706	sappend(s, s2);
2707	sjset_radiotap_tsft_present->s.jf = s2;
2708
2709	sjset_notsft_datapad = new_stmt(cstate, JMP(BPF_JSET));
2710	sjset_notsft_datapad->s.k = 0x20;
2711	sappend(s, sjset_notsft_datapad);
2712
2713	/*
2714	* In either case, if IEEE80211_RADIOTAP_F_DATAPAD is
2715	* set, round the length of the 802.11 header to
2716	* a multiple of 4. Do that by adding 3 and then
2717	* dividing by and multiplying by 4, which we do by
2718	* ANDing with ~3.
2719	*/
2720	s_roundup = new_stmt(cstate, BPF_LD\|BPF_MEM);
2721	s_roundup->s.k = cstate->off_linkpl.reg;
2722	sappend(s, s_roundup);
2723	s2 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_IMM);
2724	s2->s.k = 3;
2725	sappend(s, s2);
2726	s2 = new_stmt(cstate, BPF_ALU\|BPF_AND\|BPF_IMM);
2727	s2->s.k = ~3;
2728	sappend(s, s2);
2729	s2 = new_stmt(cstate, BPF_ST);
2730	s2->s.k = cstate->off_linkpl.reg;
2731	sappend(s, s2);
2732
2733	sjset_tsft_datapad->s.jt = s_roundup;
2734	sjset_tsft_datapad->s.jf = snext;
2735	sjset_notsft_datapad->s.jt = s_roundup;
2736	sjset_notsft_datapad->s.jf = snext;
2737	} else
2738	sjset_qos->s.jf = snext;
2739
2740	return s;
2741	}
2742
2743	static void
2744	insert_compute_vloffsets(compiler_state_t cstate, struct block b)
2745	{
2746	struct slist *s;
2747
2748	/* There is an implicit dependency between the link
2749	* payload and link header since the payload computation
2750	* includes the variable part of the header. Therefore,
2751	* if nobody else has allocated a register for the link
2752	* header and we need it, do it now. */
2753	if (cstate->off_linkpl.reg != -1 && cstate->off_linkhdr.is_variable &&
2754	cstate->off_linkhdr.reg == -1)
2755	cstate->off_linkhdr.reg = alloc_reg(cstate);
2756
2757	/*
2758	* For link-layer types that have a variable-length header
2759	* preceding the link-layer header, generate code to load
2760	* the offset of the link-layer header into the register
2761	* assigned to that offset, if any.
2762	*
2763	* XXX - this, and the next switch statement, won't handle
2764	* encapsulation of 802.11 or 802.11+radio information in
2765	* some other protocol stack. That's significantly more
2766	* complicated.
2767	*/
2768	switch (cstate->outermostlinktype) {
2769
2770	case DLT_PRISM_HEADER:
2771	s = gen_load_prism_llprefixlen(cstate);
2772	break;
2773
2774	case DLT_IEEE802_11_RADIO_AVS:
2775	s = gen_load_avs_llprefixlen(cstate);
2776	break;
2777
2778	case DLT_IEEE802_11_RADIO:
2779	s = gen_load_radiotap_llprefixlen(cstate);
2780	break;
2781
2782	case DLT_PPI:
2783	s = gen_load_ppi_llprefixlen(cstate);
2784	break;
2785
2786	default:
2787	s = NULL;
2788	break;
2789	}
2790
2791	/*
2792	* For link-layer types that have a variable-length link-layer
2793	* header, generate code to load the offset of the link-layer
2794	* payload into the register assigned to that offset, if any.
2795	*/
2796	switch (cstate->outermostlinktype) {
2797
2798	case DLT_IEEE802_11:
2799	case DLT_PRISM_HEADER:
2800	case DLT_IEEE802_11_RADIO_AVS:
2801	case DLT_IEEE802_11_RADIO:
2802	case DLT_PPI:
2803	s = gen_load_802_11_header_len(cstate, s, b->stmts);
2804	break;
2805	}
2806
2807	/*
2808	* If we have any offset-loading code, append all the
2809	* existing statements in the block to those statements,
2810	* and make the resulting list the list of statements
2811	* for the block.
2812	*/
2813	if (s != NULL) {
2814	sappend(s, b->stmts);
2815	b->stmts = s;
2816	}
2817	}
2818
2819	static struct block *
2820	gen_ppi_dlt_check(compiler_state_t *cstate)
2821	{
2822	struct slist *s_load_dlt;
2823	struct block *b;
2824
2825	if (cstate->linktype == DLT_PPI)
2826	{
2827	/* Create the statements that check for the DLT
2828	*/
2829	s_load_dlt = new_stmt(cstate, BPF_LD\|BPF_W\|BPF_ABS);
2830	s_load_dlt->s.k = 4;
2831
2832	b = new_block(cstate, JMP(BPF_JEQ));
2833
2834	b->stmts = s_load_dlt;
2835	b->s.k = SWAPLONG(DLT_IEEE802_11);
2836	}
2837	else
2838	{
2839	b = NULL;
2840	}
2841
2842	return b;
2843	}
2844
2845	/*
2846	* Take an absolute offset, and:
2847	*
2848	* if it has no variable part, return NULL;
2849	*
2850	* if it has a variable part, generate code to load the register
2851	* containing that variable part into the X register, returning
2852	* a pointer to that code - if no register for that offset has
2853	* been allocated, allocate it first.
2854	*
2855	* (The code to set that register will be generated later, but will
2856	* be placed earlier in the code sequence.)
2857	*/
2858	static struct slist *
2859	gen_abs_offset_varpart(compiler_state_t cstate, bpf_abs_offset off)
2860	{
2861	struct slist *s;
2862
2863	if (off->is_variable) {
2864	if (off->reg == -1) {
2865	/*
2866	* We haven't yet assigned a register for the
2867	* variable part of the offset of the link-layer
2868	* header; allocate one.
2869	*/
2870	off->reg = alloc_reg(cstate);
2871	}
2872
2873	/*
2874	* Load the register containing the variable part of the
2875	* offset of the link-layer header into the X register.
2876	*/
2877	s = new_stmt(cstate, BPF_LDX\|BPF_MEM);
2878	s->s.k = off->reg;
2879	return s;
2880	} else {
2881	/*
2882	* That offset isn't variable, there's no variable part,
2883	* so we don't need to generate any code.
2884	*/
2885	return NULL;
2886	}
2887	}
2888
2889	/*
2890	* Map an Ethernet type to the equivalent PPP type.
2891	*/
2892	static int
2893	ethertype_to_ppptype(proto)
2894	int proto;
2895	{
2896	switch (proto) {
2897
2898	case ETHERTYPE_IP:
2899	proto = PPP_IP;
2900	break;
2901
2902	case ETHERTYPE_IPV6:
2903	proto = PPP_IPV6;
2904	break;
2905
2906	case ETHERTYPE_DN:
2907	proto = PPP_DECNET;
2908	break;
2909
2910	case ETHERTYPE_ATALK:
2911	proto = PPP_APPLE;
2912	break;
2913
2914	case ETHERTYPE_NS:
2915	proto = PPP_NS;
2916	break;
2917
2918	case LLCSAP_ISONS:
2919	proto = PPP_OSI;
2920	break;
2921
2922	case LLCSAP_8021D:
2923	/*
2924	* I'm assuming the "Bridging PDU"s that go
2925	* over PPP are Spanning Tree Protocol
2926	* Bridging PDUs.
2927	*/
2928	proto = PPP_BRPDU;
2929	break;
2930
2931	case LLCSAP_IPX:
2932	proto = PPP_IPX;
2933	break;
2934	}
2935	return (proto);
2936	}
2937
2938	/*
2939	* Generate any tests that, for encapsulation of a link-layer packet
2940	* inside another protocol stack, need to be done to check for those
2941	* link-layer packets (and that haven't already been done by a check
2942	* for that encapsulation).
2943	*/
2944	static struct block *
2945	gen_prevlinkhdr_check(compiler_state_t *cstate)
2946	{
2947	struct block *b0;
2948
2949	if (cstate->is_geneve)
2950	return gen_geneve_ll_check(cstate);
2951
2952	switch (cstate->prevlinktype) {
2953
2954	case DLT_SUNATM:
2955	/*
2956	* This is LANE-encapsulated Ethernet; check that the LANE
2957	* packet doesn't begin with an LE Control marker, i.e.
2958	* that it's data, not a control message.
2959	*
2960	* (We've already generated a test for LANE.)
2961	*/
2962	b0 = gen_cmp(cstate, OR_PREVLINKHDR, SUNATM_PKT_BEGIN_POS, BPF_H, 0xFF00);
2963	gen_not(b0);
2964	return b0;
2965
2966	default:
2967	/*
2968	* No such tests are necessary.
2969	*/
2970	return NULL;
2971	}
2972	/NOTREACHED/
2973	}
2974
2975	/*
2976	* The three different values we should check for when checking for an
2977	* IPv6 packet with DLT_NULL.
2978	*/
2979	#define BSD_AFNUM_INET6_BSD 24 /* NetBSD, OpenBSD, BSD/OS, Npcap */
2980	#define BSD_AFNUM_INET6_FREEBSD 28 /* FreeBSD */
2981	#define BSD_AFNUM_INET6_DARWIN 30 /* OS X, iOS, other Darwin-based OSes */
2982
2983	/*
2984	* Generate code to match a particular packet type by matching the
2985	* link-layer type field or fields in the 802.2 LLC header.
2986	*
2987	* "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
2988	* value, if <= ETHERMTU.
2989	*/
2990	static struct block *
2991	gen_linktype(compiler_state_t *cstate, int proto)
2992	{
2993	struct block b0, b1, *b2;
2994	const char *description;
2995
2996	/* are we checking MPLS-encapsulated packets? */
2997	if (cstate->label_stack_depth > 0) {
2998	switch (proto) {
2999	case ETHERTYPE_IP:
3000	case PPP_IP:
3001	/* FIXME add other L3 proto IDs */
3002	return gen_mpls_linktype(cstate, Q_IP);
3003
3004	case ETHERTYPE_IPV6:
3005	case PPP_IPV6:
3006	/* FIXME add other L3 proto IDs */
3007	return gen_mpls_linktype(cstate, Q_IPV6);
3008
3009	default:
3010	bpf_error(cstate, "unsupported protocol over mpls");
3011	/* NOTREACHED */
3012	}
3013	}
3014
3015	switch (cstate->linktype) {
3016
3017	case DLT_EN10MB:
3018	case DLT_NETANALYZER:
3019	case DLT_NETANALYZER_TRANSPARENT:
3020	/* Geneve has an EtherType regardless of whether there is an
3021	* L2 header. */
3022	if (!cstate->is_geneve)
3023	b0 = gen_prevlinkhdr_check(cstate);
3024	else
3025	b0 = NULL;
3026
3027	b1 = gen_ether_linktype(cstate, proto);
3028	if (b0 != NULL)
3029	gen_and(b0, b1);
3030	return b1;
3031	/NOTREACHED/
3032	break;
3033
3034	case DLT_C_HDLC:
3035	switch (proto) {
3036
3037	case LLCSAP_ISONS:
3038	proto = (proto << 8 \| LLCSAP_ISONS);
3039	/* fall through */
3040
3041	default:
3042	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
3043	/NOTREACHED/
3044	break;
3045	}
3046	break;
3047
3048	case DLT_IEEE802_11:
3049	case DLT_PRISM_HEADER:
3050	case DLT_IEEE802_11_RADIO_AVS:
3051	case DLT_IEEE802_11_RADIO:
3052	case DLT_PPI:
3053	/*
3054	* Check that we have a data frame.
3055	*/
3056	b0 = gen_check_802_11_data_frame(cstate);
3057
3058	/*
3059	* Now check for the specified link-layer type.
3060	*/
3061	b1 = gen_llc_linktype(cstate, proto);
3062	gen_and(b0, b1);
3063	return b1;
3064	/NOTREACHED/
3065	break;
3066
3067	case DLT_FDDI:
3068	/*
3069	* XXX - check for LLC frames.
3070	*/
3071	return gen_llc_linktype(cstate, proto);
3072	/NOTREACHED/
3073	break;
3074
3075	case DLT_IEEE802:
3076	/*
3077	* XXX - check for LLC PDUs, as per IEEE 802.5.
3078	*/
3079	return gen_llc_linktype(cstate, proto);
3080	/NOTREACHED/
3081	break;
3082
3083	case DLT_ATM_RFC1483:
3084	case DLT_ATM_CLIP:
3085	case DLT_IP_OVER_FC:
3086	return gen_llc_linktype(cstate, proto);
3087	/NOTREACHED/
3088	break;
3089
3090	case DLT_SUNATM:
3091	/*
3092	* Check for an LLC-encapsulated version of this protocol;
3093	* if we were checking for LANE, linktype would no longer
3094	* be DLT_SUNATM.
3095	*
3096	* Check for LLC encapsulation and then check the protocol.
3097	*/
3098	b0 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0);
3099	b1 = gen_llc_linktype(cstate, proto);
3100	gen_and(b0, b1);
3101	return b1;
3102	/NOTREACHED/
3103	break;
3104
3105	case DLT_LINUX_SLL:
3106	return gen_linux_sll_linktype(cstate, proto);
3107	/NOTREACHED/
3108	break;
3109
3110	case DLT_SLIP:
3111	case DLT_SLIP_BSDOS:
3112	case DLT_RAW:
3113	/*
3114	* These types don't provide any type field; packets
3115	* are always IPv4 or IPv6.
3116	*
3117	* XXX - for IPv4, check for a version number of 4, and,
3118	* for IPv6, check for a version number of 6?
3119	*/
3120	switch (proto) {
3121
3122	case ETHERTYPE_IP:
3123	/* Check for a version number of 4. */
3124	return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, 0x40, 0xF0);
3125
3126	case ETHERTYPE_IPV6:
3127	/* Check for a version number of 6. */
3128	return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, 0x60, 0xF0);
3129
3130	default:
3131	return gen_false(cstate); /* always false */
3132	}
3133	/NOTREACHED/
3134	break;
3135
3136	case DLT_IPV4:
3137	/*
3138	* Raw IPv4, so no type field.
3139	*/
3140	if (proto == ETHERTYPE_IP)
3141	return gen_true(cstate); /* always true */
3142
3143	/* Checking for something other than IPv4; always false */
3144	return gen_false(cstate);
3145	/NOTREACHED/
3146	break;
3147
3148	case DLT_IPV6:
3149	/*
3150	* Raw IPv6, so no type field.
3151	*/
3152	if (proto == ETHERTYPE_IPV6)
3153	return gen_true(cstate); /* always true */
3154
3155	/* Checking for something other than IPv6; always false */
3156	return gen_false(cstate);
3157	/NOTREACHED/
3158	break;
3159
3160	case DLT_PPP:
3161	case DLT_PPP_PPPD:
3162	case DLT_PPP_SERIAL:
3163	case DLT_PPP_ETHER:
3164	/*
3165	* We use Ethernet protocol types inside libpcap;
3166	* map them to the corresponding PPP protocol types.
3167	*/
3168	proto = ethertype_to_ppptype(proto);
3169	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
3170	/NOTREACHED/
3171	break;
3172
3173	case DLT_PPP_BSDOS:
3174	/*
3175	* We use Ethernet protocol types inside libpcap;
3176	* map them to the corresponding PPP protocol types.
3177	*/
3178	switch (proto) {
3179
3180	case ETHERTYPE_IP:
3181	/*
3182	* Also check for Van Jacobson-compressed IP.
3183	* XXX - do this for other forms of PPP?
3184	*/
3185	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_IP);
3186	b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_VJC);
3187	gen_or(b0, b1);
3188	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, PPP_VJNC);
3189	gen_or(b1, b0);
3190	return b0;
3191
3192	default:
3193	proto = ethertype_to_ppptype(proto);
3194	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H,
3195	(bpf_int32)proto);
3196	}
3197	/NOTREACHED/
3198	break;
3199
3200	case DLT_NULL:
3201	case DLT_LOOP:
3202	case DLT_ENC:
3203	switch (proto) {
3204
3205	case ETHERTYPE_IP:
3206	return (gen_loopback_linktype(cstate, AF_INET));
3207
3208	case ETHERTYPE_IPV6:
3209	/*
3210	* AF_ values may, unfortunately, be platform-
3211	* dependent; AF_INET isn't, because everybody
3212	* used 4.2BSD's value, but AF_INET6 is, because
3213	* 4.2BSD didn't have a value for it (given that
3214	* IPv6 didn't exist back in the early 1980's),
3215	* and they all picked their own values.
3216	*
3217	* This means that, if we're reading from a
3218	* savefile, we need to check for all the
3219	* possible values.
3220	*
3221	* If we're doing a live capture, we only need
3222	* to check for this platform's value; however,
3223	* Npcap uses 24, which isn't Windows's AF_INET6
3224	* value. (Given the multiple different values,
3225	* programs that read pcap files shouldn't be
3226	* checking for their platform's AF_INET6 value
3227	* anyway, they should check for all of the
3228	* possible values. and they might as well do
3229	* that even for live captures.)
3230	*/
3231	if (cstate->bpf_pcap->rfile != NULL) {
3232	/*
3233	* Savefile - check for all three
3234	* possible IPv6 values.
3235	*/
3236	b0 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_BSD);
3237	b1 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_FREEBSD);
3238	gen_or(b0, b1);
3239	b0 = gen_loopback_linktype(cstate, BSD_AFNUM_INET6_DARWIN);
3240	gen_or(b0, b1);
3241	return (b1);
3242	} else {
3243	/*
3244	* Live capture, so we only need to
3245	* check for the value used on this
3246	* platform.
3247	*/
3248	#ifdef _WIN32
3249	/*
3250	* Npcap doesn't use Windows's AF_INET6,
3251	* as that collides with AF_IPX on
3252	* some BSDs (both have the value 23).
3253	* Instead, it uses 24.
3254	*/
3255	return (gen_loopback_linktype(cstate, 24));
3256	#else /* _WIN32 */
3257	#ifdef AF_INET6
3258	return (gen_loopback_linktype(cstate, AF_INET6));
3259	#else /* AF_INET6 */
3260	/*
3261	* I guess this platform doesn't support
3262	* IPv6, so we just reject all packets.
3263	*/
3264	return gen_false(cstate);
3265	#endif /* AF_INET6 */
3266	#endif /* _WIN32 */
3267	}
3268
3269	default:
3270	/*
3271	* Not a type on which we support filtering.
3272	* XXX - support those that have AF_ values
3273	* #defined on this platform, at least?
3274	*/
3275	return gen_false(cstate);
3276	}
3277
3278	#ifdef HAVE_NET_PFVAR_H
3279	case DLT_PFLOG:
3280	/*
3281	* af field is host byte order in contrast to the rest of
3282	* the packet.
3283	*/
3284	if (proto == ETHERTYPE_IP)
3285	return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af),
3286	BPF_B, (bpf_int32)AF_INET));
3287	else if (proto == ETHERTYPE_IPV6)
3288	return (gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, af),
3289	BPF_B, (bpf_int32)AF_INET6));
3290	else
3291	return gen_false(cstate);
3292	/NOTREACHED/
3293	break;
3294	#endif /* HAVE_NET_PFVAR_H */
3295
3296	case DLT_ARCNET:
3297	case DLT_ARCNET_LINUX:
3298	/*
3299	* XXX should we check for first fragment if the protocol
3300	* uses PHDS?
3301	*/
3302	switch (proto) {
3303
3304	default:
3305	return gen_false(cstate);
3306
3307	case ETHERTYPE_IPV6:
3308	return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3309	(bpf_int32)ARCTYPE_INET6));
3310
3311	case ETHERTYPE_IP:
3312	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3313	(bpf_int32)ARCTYPE_IP);
3314	b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3315	(bpf_int32)ARCTYPE_IP_OLD);
3316	gen_or(b0, b1);
3317	return (b1);
3318
3319	case ETHERTYPE_ARP:
3320	b0 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3321	(bpf_int32)ARCTYPE_ARP);
3322	b1 = gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3323	(bpf_int32)ARCTYPE_ARP_OLD);
3324	gen_or(b0, b1);
3325	return (b1);
3326
3327	case ETHERTYPE_REVARP:
3328	return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3329	(bpf_int32)ARCTYPE_REVARP));
3330
3331	case ETHERTYPE_ATALK:
3332	return (gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B,
3333	(bpf_int32)ARCTYPE_ATALK));
3334	}
3335	/NOTREACHED/
3336	break;
3337
3338	case DLT_LTALK:
3339	switch (proto) {
3340	case ETHERTYPE_ATALK:
3341	return gen_true(cstate);
3342	default:
3343	return gen_false(cstate);
3344	}
3345	/NOTREACHED/
3346	break;
3347
3348	case DLT_FRELAY:
3349	/*
3350	* XXX - assumes a 2-byte Frame Relay header with
3351	* DLCI and flags. What if the address is longer?
3352	*/
3353	switch (proto) {
3354
3355	case ETHERTYPE_IP:
3356	/*
3357	* Check for the special NLPID for IP.
3358	*/
3359	return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) \| 0xcc);
3360
3361	case ETHERTYPE_IPV6:
3362	/*
3363	* Check for the special NLPID for IPv6.
3364	*/
3365	return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) \| 0x8e);
3366
3367	case LLCSAP_ISONS:
3368	/*
3369	* Check for several OSI protocols.
3370	*
3371	* Frame Relay packets typically have an OSI
3372	* NLPID at the beginning; we check for each
3373	* of them.
3374	*
3375	* What we check for is the NLPID and a frame
3376	* control field of UI, i.e. 0x03 followed
3377	* by the NLPID.
3378	*/
3379	b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) \| ISO8473_CLNP);
3380	b1 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) \| ISO9542_ESIS);
3381	b2 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) \| ISO10589_ISIS);
3382	gen_or(b1, b2);
3383	gen_or(b0, b2);
3384	return b2;
3385
3386	default:
3387	return gen_false(cstate);
3388	}
3389	/NOTREACHED/
3390	break;
3391
3392	case DLT_MFR:
3393	bpf_error(cstate, "Multi-link Frame Relay link-layer type filtering not implemented");
3394
3395	case DLT_JUNIPER_MFR:
3396	case DLT_JUNIPER_MLFR:
3397	case DLT_JUNIPER_MLPPP:
3398	case DLT_JUNIPER_ATM1:
3399	case DLT_JUNIPER_ATM2:
3400	case DLT_JUNIPER_PPPOE:
3401	case DLT_JUNIPER_PPPOE_ATM:
3402	case DLT_JUNIPER_GGSN:
3403	case DLT_JUNIPER_ES:
3404	case DLT_JUNIPER_MONITOR:
3405	case DLT_JUNIPER_SERVICES:
3406	case DLT_JUNIPER_ETHER:
3407	case DLT_JUNIPER_PPP:
3408	case DLT_JUNIPER_FRELAY:
3409	case DLT_JUNIPER_CHDLC:
3410	case DLT_JUNIPER_VP:
3411	case DLT_JUNIPER_ST:
3412	case DLT_JUNIPER_ISM:
3413	case DLT_JUNIPER_VS:
3414	case DLT_JUNIPER_SRX_E2E:
3415	case DLT_JUNIPER_FIBRECHANNEL:
3416	case DLT_JUNIPER_ATM_CEMIC:
3417
3418	/* just lets verify the magic number for now -
3419	* on ATM we may have up to 6 different encapsulations on the wire
3420	* and need a lot of heuristics to figure out that the payload
3421	* might be;
3422	*
3423	* FIXME encapsulation specific BPF_ filters
3424	*/
3425	return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x4d474300, 0xffffff00); /* compare the magic number */
3426
3427	case DLT_BACNET_MS_TP:
3428	return gen_mcmp(cstate, OR_LINKHDR, 0, BPF_W, 0x55FF0000, 0xffff0000);
3429
3430	case DLT_IPNET:
3431	return gen_ipnet_linktype(cstate, proto);
3432
3433	case DLT_LINUX_IRDA:
3434	bpf_error(cstate, "IrDA link-layer type filtering not implemented");
3435
3436	case DLT_DOCSIS:
3437	bpf_error(cstate, "DOCSIS link-layer type filtering not implemented");
3438
3439	case DLT_MTP2:
3440	case DLT_MTP2_WITH_PHDR:
3441	bpf_error(cstate, "MTP2 link-layer type filtering not implemented");
3442
3443	case DLT_ERF:
3444	bpf_error(cstate, "ERF link-layer type filtering not implemented");
3445
3446	case DLT_PFSYNC:
3447	bpf_error(cstate, "PFSYNC link-layer type filtering not implemented");
3448
3449	case DLT_LINUX_LAPD:
3450	bpf_error(cstate, "LAPD link-layer type filtering not implemented");
3451
3452	case DLT_USB_FREEBSD:
3453	case DLT_USB_LINUX:
3454	case DLT_USB_LINUX_MMAPPED:
3455	case DLT_USBPCAP:
3456	bpf_error(cstate, "USB link-layer type filtering not implemented");
3457
3458	case DLT_BLUETOOTH_HCI_H4:
3459	case DLT_BLUETOOTH_HCI_H4_WITH_PHDR:
3460	bpf_error(cstate, "Bluetooth link-layer type filtering not implemented");
3461
3462	case DLT_CAN20B:
3463	case DLT_CAN_SOCKETCAN:
3464	bpf_error(cstate, "CAN link-layer type filtering not implemented");
3465
3466	case DLT_IEEE802_15_4:
3467	case DLT_IEEE802_15_4_LINUX:
3468	case DLT_IEEE802_15_4_NONASK_PHY:
3469	case DLT_IEEE802_15_4_NOFCS:
3470	bpf_error(cstate, "IEEE 802.15.4 link-layer type filtering not implemented");
3471
3472	case DLT_IEEE802_16_MAC_CPS_RADIO:
3473	bpf_error(cstate, "IEEE 802.16 link-layer type filtering not implemented");
3474
3475	case DLT_SITA:
3476	bpf_error(cstate, "SITA link-layer type filtering not implemented");
3477
3478	case DLT_RAIF1:
3479	bpf_error(cstate, "RAIF1 link-layer type filtering not implemented");
3480
3481	case DLT_IPMB:
3482	bpf_error(cstate, "IPMB link-layer type filtering not implemented");
3483
3484	case DLT_AX25_KISS:
3485	bpf_error(cstate, "AX.25 link-layer type filtering not implemented");
3486
3487	case DLT_NFLOG:
3488	/* Using the fixed-size NFLOG header it is possible to tell only
3489	* the address family of the packet, other meaningful data is
3490	* either missing or behind TLVs.
3491	*/
3492	bpf_error(cstate, "NFLOG link-layer type filtering not implemented");
3493
3494	default:
3495	/*
3496	* Does this link-layer header type have a field
3497	* indicating the type of the next protocol? If
3498	* so, off_linktype.constant_part will be the offset of that
3499	* field in the packet; if not, it will be OFFSET_NOT_SET.
3500	*/
3501	if (cstate->off_linktype.constant_part != OFFSET_NOT_SET) {
3502	/*
3503	* Yes; assume it's an Ethernet type. (If
3504	* it's not, it needs to be handled specially
3505	* above.)
3506	*/
3507	return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto);
3508	} else {
3509	/*
3510	* No; report an error.
3511	*/
3512	description = pcap_datalink_val_to_description(cstate->linktype);
3513	if (description != NULL) {
3514	bpf_error(cstate, "%s link-layer type filtering not implemented",
3515	description);
3516	} else {
3517	bpf_error(cstate, "DLT %u link-layer type filtering not implemented",
3518	cstate->linktype);
3519	}
3520	}
3521	break;
3522	}
3523	}
3524
3525	/*
3526	* Check for an LLC SNAP packet with a given organization code and
3527	* protocol type; we check the entire contents of the 802.2 LLC and
3528	* snap headers, checking for DSAP and SSAP of SNAP and a control
3529	* field of 0x03 in the LLC header, and for the specified organization
3530	* code and protocol type in the SNAP header.
3531	*/
3532	static struct block *
3533	gen_snap(compiler_state_t *cstate, bpf_u_int32 orgcode, bpf_u_int32 ptype)
3534	{
3535	u_char snapblock[8];
3536
3537	snapblock[0] = LLCSAP_SNAP; /* DSAP = SNAP */
3538	snapblock[1] = LLCSAP_SNAP; /* SSAP = SNAP */
3539	snapblock[2] = 0x03; /* control = UI */
3540	snapblock[3] = (orgcode >> 16); /* upper 8 bits of organization code */
3541	snapblock[4] = (orgcode >> 8); /* middle 8 bits of organization code */
3542	snapblock[5] = (orgcode >> 0); /* lower 8 bits of organization code */
3543	snapblock[6] = (ptype >> 8); /* upper 8 bits of protocol type */
3544	snapblock[7] = (ptype >> 0); /* lower 8 bits of protocol type */
3545	return gen_bcmp(cstate, OR_LLC, 0, 8, snapblock);
3546	}
3547
3548	/*
3549	* Generate code to match frames with an LLC header.
3550	*/
3551	struct block *
3552	gen_llc(compiler_state_t *cstate)
3553	{
3554	struct block b0, b1;
3555
3556	switch (cstate->linktype) {
3557
3558	case DLT_EN10MB:
3559	/*
3560	* We check for an Ethernet type field less than
3561	* 1500, which means it's an 802.3 length field.
3562	*/
3563	b0 = gen_cmp_gt(cstate, OR_LINKTYPE, 0, BPF_H, ETHERMTU);
3564	gen_not(b0);
3565
3566	/*
3567	* Now check for the purported DSAP and SSAP not being
3568	* 0xFF, to rule out NetWare-over-802.3.
3569	*/
3570	b1 = gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_int32)0xFFFF);
3571	gen_not(b1);
3572	gen_and(b0, b1);
3573	return b1;
3574
3575	case DLT_SUNATM:
3576	/*
3577	* We check for LLC traffic.
3578	*/
3579	b0 = gen_atmtype_abbrev(cstate, A_LLC);
3580	return b0;
3581
3582	case DLT_IEEE802: /* Token Ring */
3583	/*
3584	* XXX - check for LLC frames.
3585	*/
3586	return gen_true(cstate);
3587
3588	case DLT_FDDI:
3589	/*
3590	* XXX - check for LLC frames.
3591	*/
3592	return gen_true(cstate);
3593
3594	case DLT_ATM_RFC1483:
3595	/*
3596	* For LLC encapsulation, these are defined to have an
3597	* 802.2 LLC header.
3598	*
3599	* For VC encapsulation, they don't, but there's no
3600	* way to check for that; the protocol used on the VC
3601	* is negotiated out of band.
3602	*/
3603	return gen_true(cstate);
3604
3605	case DLT_IEEE802_11:
3606	case DLT_PRISM_HEADER:
3607	case DLT_IEEE802_11_RADIO:
3608	case DLT_IEEE802_11_RADIO_AVS:
3609	case DLT_PPI:
3610	/*
3611	* Check that we have a data frame.
3612	*/
3613	b0 = gen_check_802_11_data_frame(cstate);
3614	return b0;
3615
3616	default:
3617	bpf_error(cstate, "'llc' not supported for linktype %d", cstate->linktype);
3618	/* NOTREACHED */
3619	}
3620	}
3621
3622	struct block *
3623	gen_llc_i(compiler_state_t *cstate)
3624	{
3625	struct block b0, b1;
3626	struct slist *s;
3627
3628	/*
3629	* Check whether this is an LLC frame.
3630	*/
3631	b0 = gen_llc(cstate);
3632
3633	/*
3634	* Load the control byte and test the low-order bit; it must
3635	* be clear for I frames.
3636	*/
3637	s = gen_load_a(cstate, OR_LLC, 2, BPF_B);
3638	b1 = new_block(cstate, JMP(BPF_JSET));
3639	b1->s.k = 0x01;
3640	b1->stmts = s;
3641	gen_not(b1);
3642	gen_and(b0, b1);
3643	return b1;
3644	}
3645
3646	struct block *
3647	gen_llc_s(compiler_state_t *cstate)
3648	{
3649	struct block b0, b1;
3650
3651	/*
3652	* Check whether this is an LLC frame.
3653	*/
3654	b0 = gen_llc(cstate);
3655
3656	/*
3657	* Now compare the low-order 2 bit of the control byte against
3658	* the appropriate value for S frames.
3659	*/
3660	b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, LLC_S_FMT, 0x03);
3661	gen_and(b0, b1);
3662	return b1;
3663	}
3664
3665	struct block *
3666	gen_llc_u(compiler_state_t *cstate)
3667	{
3668	struct block b0, b1;
3669
3670	/*
3671	* Check whether this is an LLC frame.
3672	*/
3673	b0 = gen_llc(cstate);
3674
3675	/*
3676	* Now compare the low-order 2 bit of the control byte against
3677	* the appropriate value for U frames.
3678	*/
3679	b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, LLC_U_FMT, 0x03);
3680	gen_and(b0, b1);
3681	return b1;
3682	}
3683
3684	struct block *
3685	gen_llc_s_subtype(compiler_state_t *cstate, bpf_u_int32 subtype)
3686	{
3687	struct block b0, b1;
3688
3689	/*
3690	* Check whether this is an LLC frame.
3691	*/
3692	b0 = gen_llc(cstate);
3693
3694	/*
3695	* Now check for an S frame with the appropriate type.
3696	*/
3697	b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, subtype, LLC_S_CMD_MASK);
3698	gen_and(b0, b1);
3699	return b1;
3700	}
3701
3702	struct block *
3703	gen_llc_u_subtype(compiler_state_t *cstate, bpf_u_int32 subtype)
3704	{
3705	struct block b0, b1;
3706
3707	/*
3708	* Check whether this is an LLC frame.
3709	*/
3710	b0 = gen_llc(cstate);
3711
3712	/*
3713	* Now check for a U frame with the appropriate type.
3714	*/
3715	b1 = gen_mcmp(cstate, OR_LLC, 2, BPF_B, subtype, LLC_U_CMD_MASK);
3716	gen_and(b0, b1);
3717	return b1;
3718	}
3719
3720	/*
3721	* Generate code to match a particular packet type, for link-layer types
3722	* using 802.2 LLC headers.
3723	*
3724	* This is NOT used for Ethernet; "gen_ether_linktype()" is used
3725	* for that - it handles the D/I/X Ethernet vs. 802.3+802.2 issues.
3726	*
3727	* "proto" is an Ethernet type value, if > ETHERMTU, or an LLC SAP
3728	* value, if <= ETHERMTU. We use that to determine whether to
3729	* match the DSAP or both DSAP and LSAP or to check the OUI and
3730	* protocol ID in a SNAP header.
3731	*/
3732	static struct block *
3733	gen_llc_linktype(compiler_state_t *cstate, int proto)
3734	{
3735	/*
3736	* XXX - handle token-ring variable-length header.
3737	*/
3738	switch (proto) {
3739
3740	case LLCSAP_IP:
3741	case LLCSAP_ISONS:
3742	case LLCSAP_NETBEUI:
3743	/*
3744	* XXX - should we check both the DSAP and the
3745	* SSAP, like this, or should we check just the
3746	* DSAP, as we do for other SAP values?
3747	*/
3748	return gen_cmp(cstate, OR_LLC, 0, BPF_H, (bpf_u_int32)
3749	((proto << 8) \| proto));
3750
3751	case LLCSAP_IPX:
3752	/*
3753	* XXX - are there ever SNAP frames for IPX on
3754	* non-Ethernet 802.x networks?
3755	*/
3756	return gen_cmp(cstate, OR_LLC, 0, BPF_B,
3757	(bpf_int32)LLCSAP_IPX);
3758
3759	case ETHERTYPE_ATALK:
3760	/*
3761	* 802.2-encapsulated ETHERTYPE_ATALK packets are
3762	* SNAP packets with an organization code of
3763	* 0x080007 (Apple, for Appletalk) and a protocol
3764	* type of ETHERTYPE_ATALK (Appletalk).
3765	*
3766	* XXX - check for an organization code of
3767	* encapsulated Ethernet as well?
3768	*/
3769	return gen_snap(cstate, 0x080007, ETHERTYPE_ATALK);
3770
3771	default:
3772	/*
3773	* XXX - we don't have to check for IPX 802.3
3774	* here, but should we check for the IPX Ethertype?
3775	*/
3776	if (proto <= ETHERMTU) {
3777	/*
3778	* This is an LLC SAP value, so check
3779	* the DSAP.
3780	*/
3781	return gen_cmp(cstate, OR_LLC, 0, BPF_B, (bpf_int32)proto);
3782	} else {
3783	/*
3784	* This is an Ethernet type; we assume that it's
3785	* unlikely that it'll appear in the right place
3786	* at random, and therefore check only the
3787	* location that would hold the Ethernet type
3788	* in a SNAP frame with an organization code of
3789	* 0x000000 (encapsulated Ethernet).
3790	*
3791	* XXX - if we were to check for the SNAP DSAP and
3792	* LSAP, as per XXX, and were also to check for an
3793	* organization code of 0x000000 (encapsulated
3794	* Ethernet), we'd do
3795	*
3796	* return gen_snap(cstate, 0x000000, proto);
3797	*
3798	* here; for now, we don't, as per the above.
3799	* I don't know whether it's worth the extra CPU
3800	* time to do the right check or not.
3801	*/
3802	return gen_cmp(cstate, OR_LLC, 6, BPF_H, (bpf_int32)proto);
3803	}
3804	}
3805	}
3806
3807	static struct block *
3808	gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask,
3809	int dir, int proto, u_int src_off, u_int dst_off)
3810	{
3811	struct block b0, b1;
3812	u_int offset;
3813
3814	switch (dir) {
3815
3816	case Q_SRC:
3817	offset = src_off;
3818	break;
3819
3820	case Q_DST:
3821	offset = dst_off;
3822	break;
3823
3824	case Q_AND:
3825	b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off);
3826	b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off);
3827	gen_and(b0, b1);
3828	return b1;
3829
3830	case Q_OR:
3831	case Q_DEFAULT:
3832	b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off);
3833	b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off);
3834	gen_or(b0, b1);
3835	return b1;
3836
3837	default:
3838	abort();
3839	}
3840	b0 = gen_linktype(cstate, proto);
3841	b1 = gen_mcmp(cstate, OR_LINKPL, offset, BPF_W, (bpf_int32)addr, mask);
3842	gen_and(b0, b1);
3843	return b1;
3844	}
3845
3846	#ifdef INET6
3847	static struct block *
3848	gen_hostop6(compiler_state_t cstate, struct in6_addr addr,
3849	struct in6_addr *mask, int dir, int proto, u_int src_off, u_int dst_off)
3850	{
3851	struct block b0, b1;
3852	u_int offset;
3853	u_int32_t a, m;
3854
3855	switch (dir) {
3856
3857	case Q_SRC:
3858	offset = src_off;
3859	break;
3860
3861	case Q_DST:
3862	offset = dst_off;
3863	break;
3864
3865	case Q_AND:
3866	b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off);
3867	b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off);
3868	gen_and(b0, b1);
3869	return b1;
3870
3871	case Q_OR:
3872	case Q_DEFAULT:
3873	b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off);
3874	b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off);
3875	gen_or(b0, b1);
3876	return b1;
3877
3878	default:
3879	abort();
3880	}
3881	/* this order is important */
3882	a = (u_int32_t *)addr;
3883	m = (u_int32_t *)mask;
3884	b1 = gen_mcmp(cstate, OR_LINKPL, offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
3885	b0 = gen_mcmp(cstate, OR_LINKPL, offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
3886	gen_and(b0, b1);
3887	b0 = gen_mcmp(cstate, OR_LINKPL, offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
3888	gen_and(b0, b1);
3889	b0 = gen_mcmp(cstate, OR_LINKPL, offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
3890	gen_and(b0, b1);
3891	b0 = gen_linktype(cstate, proto);
3892	gen_and(b0, b1);
3893	return b1;
3894	}
3895	#endif
3896
3897	static struct block *
3898	gen_ehostop(compiler_state_t cstate, const u_char eaddr, int dir)
3899	{
3900	register struct block b0, b1;
3901
3902	switch (dir) {
3903	case Q_SRC:
3904	return gen_bcmp(cstate, OR_LINKHDR, 6, 6, eaddr);
3905
3906	case Q_DST:
3907	return gen_bcmp(cstate, OR_LINKHDR, 0, 6, eaddr);
3908
3909	case Q_AND:
3910	b0 = gen_ehostop(cstate, eaddr, Q_SRC);
3911	b1 = gen_ehostop(cstate, eaddr, Q_DST);
3912	gen_and(b0, b1);
3913	return b1;
3914
3915	case Q_DEFAULT:
3916	case Q_OR:
3917	b0 = gen_ehostop(cstate, eaddr, Q_SRC);
3918	b1 = gen_ehostop(cstate, eaddr, Q_DST);
3919	gen_or(b0, b1);
3920	return b1;
3921
3922	case Q_ADDR1:
3923	bpf_error(cstate, "'addr1' is only supported on 802.11 with 802.11 headers");
3924	break;
3925
3926	case Q_ADDR2:
3927	bpf_error(cstate, "'addr2' is only supported on 802.11 with 802.11 headers");
3928	break;
3929
3930	case Q_ADDR3:
3931	bpf_error(cstate, "'addr3' is only supported on 802.11 with 802.11 headers");
3932	break;
3933
3934	case Q_ADDR4:
3935	bpf_error(cstate, "'addr4' is only supported on 802.11 with 802.11 headers");
3936	break;
3937
3938	case Q_RA:
3939	bpf_error(cstate, "'ra' is only supported on 802.11 with 802.11 headers");
3940	break;
3941
3942	case Q_TA:
3943	bpf_error(cstate, "'ta' is only supported on 802.11 with 802.11 headers");
3944	break;
3945	}
3946	abort();
3947	/* NOTREACHED */
3948	}
3949
3950	/*
3951	* Like gen_ehostop, but for DLT_FDDI
3952	*/
3953	static struct block *
3954	gen_fhostop(compiler_state_t cstate, const u_char eaddr, int dir)
3955	{
3956	struct block b0, b1;
3957
3958	switch (dir) {
3959	case Q_SRC:
3960	return gen_bcmp(cstate, OR_LINKHDR, 6 + 1 + cstate->pcap_fddipad, 6, eaddr);
3961
3962	case Q_DST:
3963	return gen_bcmp(cstate, OR_LINKHDR, 0 + 1 + cstate->pcap_fddipad, 6, eaddr);
3964
3965	case Q_AND:
3966	b0 = gen_fhostop(cstate, eaddr, Q_SRC);
3967	b1 = gen_fhostop(cstate, eaddr, Q_DST);
3968	gen_and(b0, b1);
3969	return b1;
3970
3971	case Q_DEFAULT:
3972	case Q_OR:
3973	b0 = gen_fhostop(cstate, eaddr, Q_SRC);
3974	b1 = gen_fhostop(cstate, eaddr, Q_DST);
3975	gen_or(b0, b1);
3976	return b1;
3977
3978	case Q_ADDR1:
3979	bpf_error(cstate, "'addr1' is only supported on 802.11");
3980	break;
3981
3982	case Q_ADDR2:
3983	bpf_error(cstate, "'addr2' is only supported on 802.11");
3984	break;
3985
3986	case Q_ADDR3:
3987	bpf_error(cstate, "'addr3' is only supported on 802.11");
3988	break;
3989
3990	case Q_ADDR4:
3991	bpf_error(cstate, "'addr4' is only supported on 802.11");
3992	break;
3993
3994	case Q_RA:
3995	bpf_error(cstate, "'ra' is only supported on 802.11");
3996	break;
3997
3998	case Q_TA:
3999	bpf_error(cstate, "'ta' is only supported on 802.11");
4000	break;
4001	}
4002	abort();
4003	/* NOTREACHED */
4004	}
4005
4006	/*
4007	* Like gen_ehostop, but for DLT_IEEE802 (Token Ring)
4008	*/
4009	static struct block *
4010	gen_thostop(compiler_state_t cstate, const u_char eaddr, int dir)
4011	{
4012	register struct block b0, b1;
4013
4014	switch (dir) {
4015	case Q_SRC:
4016	return gen_bcmp(cstate, OR_LINKHDR, 8, 6, eaddr);
4017
4018	case Q_DST:
4019	return gen_bcmp(cstate, OR_LINKHDR, 2, 6, eaddr);
4020
4021	case Q_AND:
4022	b0 = gen_thostop(cstate, eaddr, Q_SRC);
4023	b1 = gen_thostop(cstate, eaddr, Q_DST);
4024	gen_and(b0, b1);
4025	return b1;
4026
4027	case Q_DEFAULT:
4028	case Q_OR:
4029	b0 = gen_thostop(cstate, eaddr, Q_SRC);
4030	b1 = gen_thostop(cstate, eaddr, Q_DST);
4031	gen_or(b0, b1);
4032	return b1;
4033
4034	case Q_ADDR1:
4035	bpf_error(cstate, "'addr1' is only supported on 802.11");
4036	break;
4037
4038	case Q_ADDR2:
4039	bpf_error(cstate, "'addr2' is only supported on 802.11");
4040	break;
4041
4042	case Q_ADDR3:
4043	bpf_error(cstate, "'addr3' is only supported on 802.11");
4044	break;
4045
4046	case Q_ADDR4:
4047	bpf_error(cstate, "'addr4' is only supported on 802.11");
4048	break;
4049
4050	case Q_RA:
4051	bpf_error(cstate, "'ra' is only supported on 802.11");
4052	break;
4053
4054	case Q_TA:
4055	bpf_error(cstate, "'ta' is only supported on 802.11");
4056	break;
4057	}
4058	abort();
4059	/* NOTREACHED */
4060	}
4061
4062	/*
4063	* Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and
4064	* various 802.11 + radio headers.
4065	*/
4066	static struct block *
4067	gen_wlanhostop(compiler_state_t cstate, const u_char eaddr, int dir)
4068	{
4069	register struct block b0, b1, *b2;
4070	register struct slist *s;
4071
4072	#ifdef ENABLE_WLAN_FILTERING_PATCH
4073	/*
4074	* TODO GV 20070613
4075	* We need to disable the optimizer because the optimizer is buggy
4076	* and wipes out some LD instructions generated by the below
4077	* code to validate the Frame Control bits
4078	*/
4079	cstate->no_optimize = 1;
4080	#endif /* ENABLE_WLAN_FILTERING_PATCH */
4081
4082	switch (dir) {
4083	case Q_SRC:
4084	/*
4085	* Oh, yuk.
4086	*
4087	* For control frames, there is no SA.
4088	*
4089	* For management frames, SA is at an
4090	* offset of 10 from the beginning of
4091	* the packet.
4092	*
4093	* For data frames, SA is at an offset
4094	* of 10 from the beginning of the packet
4095	* if From DS is clear, at an offset of
4096	* 16 from the beginning of the packet
4097	* if From DS is set and To DS is clear,
4098	* and an offset of 24 from the beginning
4099	* of the packet if From DS is set and To DS
4100	* is set.
4101	*/
4102
4103	/*
4104	* Generate the tests to be done for data frames
4105	* with From DS set.
4106	*
4107	* First, check for To DS set, i.e. check "link[1] & 0x01".
4108	*/
4109	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
4110	b1 = new_block(cstate, JMP(BPF_JSET));
4111	b1->s.k = 0x01; /* To DS */
4112	b1->stmts = s;
4113
4114	/*
4115	* If To DS is set, the SA is at 24.
4116	*/
4117	b0 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr);
4118	gen_and(b1, b0);
4119
4120	/*
4121	* Now, check for To DS not set, i.e. check
4122	* "!(link[1] & 0x01)".
4123	*/
4124	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
4125	b2 = new_block(cstate, JMP(BPF_JSET));
4126	b2->s.k = 0x01; /* To DS */
4127	b2->stmts = s;
4128	gen_not(b2);
4129
4130	/*
4131	* If To DS is not set, the SA is at 16.
4132	*/
4133	b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr);
4134	gen_and(b2, b1);
4135
4136	/*
4137	* Now OR together the last two checks. That gives
4138	* the complete set of checks for data frames with
4139	* From DS set.
4140	*/
4141	gen_or(b1, b0);
4142
4143	/*
4144	* Now check for From DS being set, and AND that with
4145	* the ORed-together checks.
4146	*/
4147	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
4148	b1 = new_block(cstate, JMP(BPF_JSET));
4149	b1->s.k = 0x02; /* From DS */
4150	b1->stmts = s;
4151	gen_and(b1, b0);
4152
4153	/*
4154	* Now check for data frames with From DS not set.
4155	*/
4156	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
4157	b2 = new_block(cstate, JMP(BPF_JSET));
4158	b2->s.k = 0x02; /* From DS */
4159	b2->stmts = s;
4160	gen_not(b2);
4161
4162	/*
4163	* If From DS isn't set, the SA is at 10.
4164	*/
4165	b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr);
4166	gen_and(b2, b1);
4167
4168	/*
4169	* Now OR together the checks for data frames with
4170	* From DS not set and for data frames with From DS
4171	* set; that gives the checks done for data frames.
4172	*/
4173	gen_or(b1, b0);
4174
4175	/*
4176	* Now check for a data frame.
4177	* I.e, check "link[0] & 0x08".
4178	*/
4179	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4180	b1 = new_block(cstate, JMP(BPF_JSET));
4181	b1->s.k = 0x08;
4182	b1->stmts = s;
4183
4184	/*
4185	* AND that with the checks done for data frames.
4186	*/
4187	gen_and(b1, b0);
4188
4189	/*
4190	* If the high-order bit of the type value is 0, this
4191	* is a management frame.
4192	* I.e, check "!(link[0] & 0x08)".
4193	*/
4194	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4195	b2 = new_block(cstate, JMP(BPF_JSET));
4196	b2->s.k = 0x08;
4197	b2->stmts = s;
4198	gen_not(b2);
4199
4200	/*
4201	* For management frames, the SA is at 10.
4202	*/
4203	b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr);
4204	gen_and(b2, b1);
4205
4206	/*
4207	* OR that with the checks done for data frames.
4208	* That gives the checks done for management and
4209	* data frames.
4210	*/
4211	gen_or(b1, b0);
4212
4213	/*
4214	* If the low-order bit of the type value is 1,
4215	* this is either a control frame or a frame
4216	* with a reserved type, and thus not a
4217	* frame with an SA.
4218	*
4219	* I.e., check "!(link[0] & 0x04)".
4220	*/
4221	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4222	b1 = new_block(cstate, JMP(BPF_JSET));
4223	b1->s.k = 0x04;
4224	b1->stmts = s;
4225	gen_not(b1);
4226
4227	/*
4228	* AND that with the checks for data and management
4229	* frames.
4230	*/
4231	gen_and(b1, b0);
4232	return b0;
4233
4234	case Q_DST:
4235	/*
4236	* Oh, yuk.
4237	*
4238	* For control frames, there is no DA.
4239	*
4240	* For management frames, DA is at an
4241	* offset of 4 from the beginning of
4242	* the packet.
4243	*
4244	* For data frames, DA is at an offset
4245	* of 4 from the beginning of the packet
4246	* if To DS is clear and at an offset of
4247	* 16 from the beginning of the packet
4248	* if To DS is set.
4249	*/
4250
4251	/*
4252	* Generate the tests to be done for data frames.
4253	*
4254	* First, check for To DS set, i.e. "link[1] & 0x01".
4255	*/
4256	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
4257	b1 = new_block(cstate, JMP(BPF_JSET));
4258	b1->s.k = 0x01; /* To DS */
4259	b1->stmts = s;
4260
4261	/*
4262	* If To DS is set, the DA is at 16.
4263	*/
4264	b0 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr);
4265	gen_and(b1, b0);
4266
4267	/*
4268	* Now, check for To DS not set, i.e. check
4269	* "!(link[1] & 0x01)".
4270	*/
4271	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
4272	b2 = new_block(cstate, JMP(BPF_JSET));
4273	b2->s.k = 0x01; /* To DS */
4274	b2->stmts = s;
4275	gen_not(b2);
4276
4277	/*
4278	* If To DS is not set, the DA is at 4.
4279	*/
4280	b1 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr);
4281	gen_and(b2, b1);
4282
4283	/*
4284	* Now OR together the last two checks. That gives
4285	* the complete set of checks for data frames.
4286	*/
4287	gen_or(b1, b0);
4288
4289	/*
4290	* Now check for a data frame.
4291	* I.e, check "link[0] & 0x08".
4292	*/
4293	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4294	b1 = new_block(cstate, JMP(BPF_JSET));
4295	b1->s.k = 0x08;
4296	b1->stmts = s;
4297
4298	/*
4299	* AND that with the checks done for data frames.
4300	*/
4301	gen_and(b1, b0);
4302
4303	/*
4304	* If the high-order bit of the type value is 0, this
4305	* is a management frame.
4306	* I.e, check "!(link[0] & 0x08)".
4307	*/
4308	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4309	b2 = new_block(cstate, JMP(BPF_JSET));
4310	b2->s.k = 0x08;
4311	b2->stmts = s;
4312	gen_not(b2);
4313
4314	/*
4315	* For management frames, the DA is at 4.
4316	*/
4317	b1 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr);
4318	gen_and(b2, b1);
4319
4320	/*
4321	* OR that with the checks done for data frames.
4322	* That gives the checks done for management and
4323	* data frames.
4324	*/
4325	gen_or(b1, b0);
4326
4327	/*
4328	* If the low-order bit of the type value is 1,
4329	* this is either a control frame or a frame
4330	* with a reserved type, and thus not a
4331	* frame with an SA.
4332	*
4333	* I.e., check "!(link[0] & 0x04)".
4334	*/
4335	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4336	b1 = new_block(cstate, JMP(BPF_JSET));
4337	b1->s.k = 0x04;
4338	b1->stmts = s;
4339	gen_not(b1);
4340
4341	/*
4342	* AND that with the checks for data and management
4343	* frames.
4344	*/
4345	gen_and(b1, b0);
4346	return b0;
4347
4348	case Q_RA:
4349	/*
4350	* Not present in management frames; addr1 in other
4351	* frames.
4352	*/
4353
4354	/*
4355	* If the high-order bit of the type value is 0, this
4356	* is a management frame.
4357	* I.e, check "(link[0] & 0x08)".
4358	*/
4359	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4360	b1 = new_block(cstate, JMP(BPF_JSET));
4361	b1->s.k = 0x08;
4362	b1->stmts = s;
4363
4364	/*
4365	* Check addr1.
4366	*/
4367	b0 = gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr);
4368
4369	/*
4370	* AND that with the check of addr1.
4371	*/
4372	gen_and(b1, b0);
4373	return (b0);
4374
4375	case Q_TA:
4376	/*
4377	* Not present in management frames; addr2, if present,
4378	* in other frames.
4379	*/
4380
4381	/*
4382	* Not present in CTS or ACK control frames.
4383	*/
4384	b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL,
4385	IEEE80211_FC0_TYPE_MASK);
4386	gen_not(b0);
4387	b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS,
4388	IEEE80211_FC0_SUBTYPE_MASK);
4389	gen_not(b1);
4390	b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK,
4391	IEEE80211_FC0_SUBTYPE_MASK);
4392	gen_not(b2);
4393	gen_and(b1, b2);
4394	gen_or(b0, b2);
4395
4396	/*
4397	* If the high-order bit of the type value is 0, this
4398	* is a management frame.
4399	* I.e, check "(link[0] & 0x08)".
4400	*/
4401	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
4402	b1 = new_block(cstate, JMP(BPF_JSET));
4403	b1->s.k = 0x08;
4404	b1->stmts = s;
4405
4406	/*
4407	* AND that with the check for frames other than
4408	* CTS and ACK frames.
4409	*/
4410	gen_and(b1, b2);
4411
4412	/*
4413	* Check addr2.
4414	*/
4415	b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr);
4416	gen_and(b2, b1);
4417	return b1;
4418
4419	/*
4420	* XXX - add BSSID keyword?
4421	*/
4422	case Q_ADDR1:
4423	return (gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr));
4424
4425	case Q_ADDR2:
4426	/*
4427	* Not present in CTS or ACK control frames.
4428	*/
4429	b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL,
4430	IEEE80211_FC0_TYPE_MASK);
4431	gen_not(b0);
4432	b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS,
4433	IEEE80211_FC0_SUBTYPE_MASK);
4434	gen_not(b1);
4435	b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK,
4436	IEEE80211_FC0_SUBTYPE_MASK);
4437	gen_not(b2);
4438	gen_and(b1, b2);
4439	gen_or(b0, b2);
4440	b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr);
4441	gen_and(b2, b1);
4442	return b1;
4443
4444	case Q_ADDR3:
4445	/*
4446	* Not present in control frames.
4447	*/
4448	b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL,
4449	IEEE80211_FC0_TYPE_MASK);
4450	gen_not(b0);
4451	b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr);
4452	gen_and(b0, b1);
4453	return b1;
4454
4455	case Q_ADDR4:
4456	/*
4457	* Present only if the direction mask has both "From DS"
4458	* and "To DS" set. Neither control frames nor management
4459	* frames should have both of those set, so we don't
4460	* check the frame type.
4461	*/
4462	b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B,
4463	IEEE80211_FC1_DIR_DSTODS, IEEE80211_FC1_DIR_MASK);
4464	b1 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr);
4465	gen_and(b0, b1);
4466	return b1;
4467
4468	case Q_AND:
4469	b0 = gen_wlanhostop(cstate, eaddr, Q_SRC);
4470	b1 = gen_wlanhostop(cstate, eaddr, Q_DST);
4471	gen_and(b0, b1);
4472	return b1;
4473
4474	case Q_DEFAULT:
4475	case Q_OR:
4476	b0 = gen_wlanhostop(cstate, eaddr, Q_SRC);
4477	b1 = gen_wlanhostop(cstate, eaddr, Q_DST);
4478	gen_or(b0, b1);
4479	return b1;
4480	}
4481	abort();
4482	/* NOTREACHED */
4483	}
4484
4485	/*
4486	* Like gen_ehostop, but for RFC 2625 IP-over-Fibre-Channel.
4487	* (We assume that the addresses are IEEE 48-bit MAC addresses,
4488	* as the RFC states.)
4489	*/
4490	static struct block *
4491	gen_ipfchostop(compiler_state_t cstate, const u_char eaddr, int dir)
4492	{
4493	register struct block b0, b1;
4494
4495	switch (dir) {
4496	case Q_SRC:
4497	return gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr);
4498
4499	case Q_DST:
4500	return gen_bcmp(cstate, OR_LINKHDR, 2, 6, eaddr);
4501
4502	case Q_AND:
4503	b0 = gen_ipfchostop(cstate, eaddr, Q_SRC);
4504	b1 = gen_ipfchostop(cstate, eaddr, Q_DST);
4505	gen_and(b0, b1);
4506	return b1;
4507
4508	case Q_DEFAULT:
4509	case Q_OR:
4510	b0 = gen_ipfchostop(cstate, eaddr, Q_SRC);
4511	b1 = gen_ipfchostop(cstate, eaddr, Q_DST);
4512	gen_or(b0, b1);
4513	return b1;
4514
4515	case Q_ADDR1:
4516	bpf_error(cstate, "'addr1' is only supported on 802.11");
4517	break;
4518
4519	case Q_ADDR2:
4520	bpf_error(cstate, "'addr2' is only supported on 802.11");
4521	break;
4522
4523	case Q_ADDR3:
4524	bpf_error(cstate, "'addr3' is only supported on 802.11");
4525	break;
4526
4527	case Q_ADDR4:
4528	bpf_error(cstate, "'addr4' is only supported on 802.11");
4529	break;
4530
4531	case Q_RA:
4532	bpf_error(cstate, "'ra' is only supported on 802.11");
4533	break;
4534
4535	case Q_TA:
4536	bpf_error(cstate, "'ta' is only supported on 802.11");
4537	break;
4538	}
4539	abort();
4540	/* NOTREACHED */
4541	}
4542
4543	/*
4544	* This is quite tricky because there may be pad bytes in front of the
4545	* DECNET header, and then there are two possible data packet formats that
4546	* carry both src and dst addresses, plus 5 packet types in a format that
4547	* carries only the src node, plus 2 types that use a different format and
4548	* also carry just the src node.
4549	*
4550	* Yuck.
4551	*
4552	* Instead of doing those all right, we just look for data packets with
4553	* 0 or 1 bytes of padding. If you want to look at other packets, that
4554	* will require a lot more hacking.
4555	*
4556	* To add support for filtering on DECNET "areas" (network numbers)
4557	* one would want to add a "mask" argument to this routine. That would
4558	* make the filter even more inefficient, although one could be clever
4559	* and not generate masking instructions if the mask is 0xFFFF.
4560	*/
4561	static struct block *
4562	gen_dnhostop(compiler_state_t *cstate, bpf_u_int32 addr, int dir)
4563	{
4564	struct block b0, b1, b2, tmp;
4565	u_int offset_lh; /* offset if long header is received */
4566	u_int offset_sh; /* offset if short header is received */
4567
4568	switch (dir) {
4569
4570	case Q_DST:
4571	offset_sh = 1; /* follows flags */
4572	offset_lh = 7; /* flgs,darea,dsubarea,HIORD */
4573	break;
4574
4575	case Q_SRC:
4576	offset_sh = 3; /* follows flags, dstnode */
4577	offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
4578	break;
4579
4580	case Q_AND:
4581	/* Inefficient because we do our Calvinball dance twice */
4582	b0 = gen_dnhostop(cstate, addr, Q_SRC);
4583	b1 = gen_dnhostop(cstate, addr, Q_DST);
4584	gen_and(b0, b1);
4585	return b1;
4586
4587	case Q_OR:
4588	case Q_DEFAULT:
4589	/* Inefficient because we do our Calvinball dance twice */
4590	b0 = gen_dnhostop(cstate, addr, Q_SRC);
4591	b1 = gen_dnhostop(cstate, addr, Q_DST);
4592	gen_or(b0, b1);
4593	return b1;
4594
4595	case Q_ISO:
4596	bpf_error(cstate, "ISO host filtering not implemented");
4597
4598	default:
4599	abort();
4600	}
4601	b0 = gen_linktype(cstate, ETHERTYPE_DN);
4602	/* Check for pad = 1, long header case */
4603	tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H,
4604	(bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
4605	b1 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_lh,
4606	BPF_H, (bpf_int32)ntohs((u_short)addr));
4607	gen_and(tmp, b1);
4608	/* Check for pad = 0, long header case */
4609	tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
4610	b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_lh, BPF_H, (bpf_int32)ntohs((u_short)addr));
4611	gen_and(tmp, b2);
4612	gen_or(b2, b1);
4613	/* Check for pad = 1, short header case */
4614	tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_H,
4615	(bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
4616	b2 = gen_cmp(cstate, OR_LINKPL, 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs((u_short)addr));
4617	gen_and(tmp, b2);
4618	gen_or(b2, b1);
4619	/* Check for pad = 0, short header case */
4620	tmp = gen_mcmp(cstate, OR_LINKPL, 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
4621	b2 = gen_cmp(cstate, OR_LINKPL, 2 + offset_sh, BPF_H, (bpf_int32)ntohs((u_short)addr));
4622	gen_and(tmp, b2);
4623	gen_or(b2, b1);
4624
4625	/* Combine with test for cstate->linktype */
4626	gen_and(b0, b1);
4627	return b1;
4628	}
4629
4630	/*
4631	* Generate a check for IPv4 or IPv6 for MPLS-encapsulated packets;
4632	* test the bottom-of-stack bit, and then check the version number
4633	* field in the IP header.
4634	*/
4635	static struct block *
4636	gen_mpls_linktype(compiler_state_t *cstate, int proto)
4637	{
4638	struct block b0, b1;
4639
4640	switch (proto) {
4641
4642	case Q_IP:
4643	/* match the bottom-of-stack bit */
4644	b0 = gen_mcmp(cstate, OR_LINKPL, -2, BPF_B, 0x01, 0x01);
4645	/* match the IPv4 version number */
4646	b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_B, 0x40, 0xf0);
4647	gen_and(b0, b1);
4648	return b1;
4649
4650	case Q_IPV6:
4651	/* match the bottom-of-stack bit */
4652	b0 = gen_mcmp(cstate, OR_LINKPL, -2, BPF_B, 0x01, 0x01);
4653	/* match the IPv4 version number */
4654	b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_B, 0x60, 0xf0);
4655	gen_and(b0, b1);
4656	return b1;
4657
4658	default:
4659	abort();
4660	}
4661	}
4662
4663	static struct block *
4664	gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask,
4665	int proto, int dir, int type)
4666	{
4667	struct block b0, b1;
4668	const char *typestr;
4669
4670	if (type == Q_NET)
4671	typestr = "net";
4672	else
4673	typestr = "host";
4674
4675	switch (proto) {
4676
4677	case Q_DEFAULT:
4678	b0 = gen_host(cstate, addr, mask, Q_IP, dir, type);
4679	/*
4680	* Only check for non-IPv4 addresses if we're not
4681	* checking MPLS-encapsulated packets.
4682	*/
4683	if (cstate->label_stack_depth == 0) {
4684	b1 = gen_host(cstate, addr, mask, Q_ARP, dir, type);
4685	gen_or(b0, b1);
4686	b0 = gen_host(cstate, addr, mask, Q_RARP, dir, type);
4687	gen_or(b1, b0);
4688	}
4689	return b0;
4690
4691	case Q_IP:
4692	return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_IP, 12, 16);
4693
4694	case Q_RARP:
4695	return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_REVARP, 14, 24);
4696
4697	case Q_ARP:
4698	return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_ARP, 14, 24);
4699
4700	case Q_TCP:
4701	bpf_error(cstate, "'tcp' modifier applied to %s", typestr);
4702
4703	case Q_SCTP:
4704	bpf_error(cstate, "'sctp' modifier applied to %s", typestr);
4705
4706	case Q_UDP:
4707	bpf_error(cstate, "'udp' modifier applied to %s", typestr);
4708
4709	case Q_ICMP:
4710	bpf_error(cstate, "'icmp' modifier applied to %s", typestr);
4711
4712	case Q_IGMP:
4713	bpf_error(cstate, "'igmp' modifier applied to %s", typestr);
4714
4715	case Q_IGRP:
4716	bpf_error(cstate, "'igrp' modifier applied to %s", typestr);
4717
4718	case Q_PIM:
4719	bpf_error(cstate, "'pim' modifier applied to %s", typestr);
4720
4721	case Q_VRRP:
4722	bpf_error(cstate, "'vrrp' modifier applied to %s", typestr);
4723
4724	case Q_CARP:
4725	bpf_error(cstate, "'carp' modifier applied to %s", typestr);
4726
4727	case Q_ATALK:
4728	bpf_error(cstate, "ATALK host filtering not implemented");
4729
4730	case Q_AARP:
4731	bpf_error(cstate, "AARP host filtering not implemented");
4732
4733	case Q_DECNET:
4734	return gen_dnhostop(cstate, addr, dir);
4735
4736	case Q_SCA:
4737	bpf_error(cstate, "SCA host filtering not implemented");
4738
4739	case Q_LAT:
4740	bpf_error(cstate, "LAT host filtering not implemented");
4741
4742	case Q_MOPDL:
4743	bpf_error(cstate, "MOPDL host filtering not implemented");
4744
4745	case Q_MOPRC:
4746	bpf_error(cstate, "MOPRC host filtering not implemented");
4747
4748	case Q_IPV6:
4749	bpf_error(cstate, "'ip6' modifier applied to ip host");
4750
4751	case Q_ICMPV6:
4752	bpf_error(cstate, "'icmp6' modifier applied to %s", typestr);
4753
4754	case Q_AH:
4755	bpf_error(cstate, "'ah' modifier applied to %s", typestr);
4756
4757	case Q_ESP:
4758	bpf_error(cstate, "'esp' modifier applied to %s", typestr);
4759
4760	case Q_ISO:
4761	bpf_error(cstate, "ISO host filtering not implemented");
4762
4763	case Q_ESIS:
4764	bpf_error(cstate, "'esis' modifier applied to %s", typestr);
4765
4766	case Q_ISIS:
4767	bpf_error(cstate, "'isis' modifier applied to %s", typestr);
4768
4769	case Q_CLNP:
4770	bpf_error(cstate, "'clnp' modifier applied to %s", typestr);
4771
4772	case Q_STP:
4773	bpf_error(cstate, "'stp' modifier applied to %s", typestr);
4774
4775	case Q_IPX:
4776	bpf_error(cstate, "IPX host filtering not implemented");
4777
4778	case Q_NETBEUI:
4779	bpf_error(cstate, "'netbeui' modifier applied to %s", typestr);
4780
4781	case Q_RADIO:
4782	bpf_error(cstate, "'radio' modifier applied to %s", typestr);
4783
4784	default:
4785	abort();
4786	}
4787	/* NOTREACHED */
4788	}
4789
4790	#ifdef INET6
4791	static struct block *
4792	gen_host6(compiler_state_t cstate, struct in6_addr addr,
4793	struct in6_addr *mask, int proto, int dir, int type)
4794	{
4795	const char *typestr;
4796
4797	if (type == Q_NET)
4798	typestr = "net";
4799	else
4800	typestr = "host";
4801
4802	switch (proto) {
4803
4804	case Q_DEFAULT:
4805	return gen_host6(cstate, addr, mask, Q_IPV6, dir, type);
4806
4807	case Q_LINK:
4808	bpf_error(cstate, "link-layer modifier applied to ip6 %s", typestr);
4809
4810	case Q_IP:
4811	bpf_error(cstate, "'ip' modifier applied to ip6 %s", typestr);
4812
4813	case Q_RARP:
4814	bpf_error(cstate, "'rarp' modifier applied to ip6 %s", typestr);
4815
4816	case Q_ARP:
4817	bpf_error(cstate, "'arp' modifier applied to ip6 %s", typestr);
4818
4819	case Q_SCTP:
4820	bpf_error(cstate, "'sctp' modifier applied to %s", typestr);
4821
4822	case Q_TCP:
4823	bpf_error(cstate, "'tcp' modifier applied to %s", typestr);
4824
4825	case Q_UDP:
4826	bpf_error(cstate, "'udp' modifier applied to %s", typestr);
4827
4828	case Q_ICMP:
4829	bpf_error(cstate, "'icmp' modifier applied to %s", typestr);
4830
4831	case Q_IGMP:
4832	bpf_error(cstate, "'igmp' modifier applied to %s", typestr);
4833
4834	case Q_IGRP:
4835	bpf_error(cstate, "'igrp' modifier applied to %s", typestr);
4836
4837	case Q_PIM:
4838	bpf_error(cstate, "'pim' modifier applied to %s", typestr);
4839
4840	case Q_VRRP:
4841	bpf_error(cstate, "'vrrp' modifier applied to %s", typestr);
4842
4843	case Q_CARP:
4844	bpf_error(cstate, "'carp' modifier applied to %s", typestr);
4845
4846	case Q_ATALK:
4847	bpf_error(cstate, "ATALK host filtering not implemented");
4848
4849	case Q_AARP:
4850	bpf_error(cstate, "AARP host filtering not implemented");
4851
4852	case Q_DECNET:
4853	bpf_error(cstate, "'decnet' modifier applied to ip6 %s", typestr);
4854
4855	case Q_SCA:
4856	bpf_error(cstate, "SCA host filtering not implemented");
4857
4858	case Q_LAT:
4859	bpf_error(cstate, "LAT host filtering not implemented");
4860
4861	case Q_MOPDL:
4862	bpf_error(cstate, "MOPDL host filtering not implemented");
4863
4864	case Q_MOPRC:
4865	bpf_error(cstate, "MOPRC host filtering not implemented");
4866
4867	case Q_IPV6:
4868	return gen_hostop6(cstate, addr, mask, dir, ETHERTYPE_IPV6, 8, 24);
4869
4870	case Q_ICMPV6:
4871	bpf_error(cstate, "'icmp6' modifier applied to %s", typestr);
4872
4873	case Q_AH:
4874	bpf_error(cstate, "'ah' modifier applied to %s", typestr);
4875
4876	case Q_ESP:
4877	bpf_error(cstate, "'esp' modifier applied to %s", typestr);
4878
4879	case Q_ISO:
4880	bpf_error(cstate, "ISO host filtering not implemented");
4881
4882	case Q_ESIS:
4883	bpf_error(cstate, "'esis' modifier applied to %s", typestr);
4884
4885	case Q_ISIS:
4886	bpf_error(cstate, "'isis' modifier applied to %s", typestr);
4887
4888	case Q_CLNP:
4889	bpf_error(cstate, "'clnp' modifier applied to %s", typestr);
4890
4891	case Q_STP:
4892	bpf_error(cstate, "'stp' modifier applied to %s", typestr);
4893
4894	case Q_IPX:
4895	bpf_error(cstate, "IPX host filtering not implemented");
4896
4897	case Q_NETBEUI:
4898	bpf_error(cstate, "'netbeui' modifier applied to %s", typestr);
4899
4900	case Q_RADIO:
4901	bpf_error(cstate, "'radio' modifier applied to %s", typestr);
4902
4903	default:
4904	abort();
4905	}
4906	/* NOTREACHED */
4907	}
4908	#endif
4909
4910	#ifndef INET6
4911	static struct block *
4912	gen_gateway(compiler_state_t cstate, const u_char eaddr, bpf_u_int32 **alist,
4913	int proto, int dir)
4914	{
4915	struct block b0, b1, *tmp;
4916
4917	if (dir != 0)
4918	bpf_error(cstate, "direction applied to 'gateway'");
4919
4920	switch (proto) {
4921	case Q_DEFAULT:
4922	case Q_IP:
4923	case Q_ARP:
4924	case Q_RARP:
4925	switch (cstate->linktype) {
4926	case DLT_EN10MB:
4927	case DLT_NETANALYZER:
4928	case DLT_NETANALYZER_TRANSPARENT:
4929	b1 = gen_prevlinkhdr_check(cstate);
4930	b0 = gen_ehostop(cstate, eaddr, Q_OR);
4931	if (b1 != NULL)
4932	gen_and(b1, b0);
4933	break;
4934	case DLT_FDDI:
4935	b0 = gen_fhostop(cstate, eaddr, Q_OR);
4936	break;
4937	case DLT_IEEE802:
4938	b0 = gen_thostop(cstate, eaddr, Q_OR);
4939	break;
4940	case DLT_IEEE802_11:
4941	case DLT_PRISM_HEADER:
4942	case DLT_IEEE802_11_RADIO_AVS:
4943	case DLT_IEEE802_11_RADIO:
4944	case DLT_PPI:
4945	b0 = gen_wlanhostop(cstate, eaddr, Q_OR);
4946	break;
4947	case DLT_SUNATM:
4948	/*
4949	* This is LLC-multiplexed traffic; if it were
4950	* LANE, cstate->linktype would have been set to
4951	* DLT_EN10MB.
4952	*/
4953	bpf_error(cstate,
4954	"'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4955	break;
4956	case DLT_IP_OVER_FC:
4957	b0 = gen_ipfchostop(cstate, eaddr, Q_OR);
4958	break;
4959	default:
4960	bpf_error(cstate,
4961	"'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
4962	}
4963	b1 = gen_host(cstate, **alist++, 0xffffffff, proto, Q_OR, Q_HOST);
4964	while (*alist) {
4965	tmp = gen_host(cstate, **alist++, 0xffffffff, proto, Q_OR,
4966	Q_HOST);
4967	gen_or(b1, tmp);
4968	b1 = tmp;
4969	}
4970	gen_not(b1);
4971	gen_and(b0, b1);
4972	return b1;
4973	}
4974	bpf_error(cstate, "illegal modifier of 'gateway'");
4975	/* NOTREACHED */
4976	}
4977	#endif
4978
4979	struct block *
4980	gen_proto_abbrev(compiler_state_t *cstate, int proto)
4981	{
4982	struct block *b0;
4983	struct block *b1;
4984
4985	switch (proto) {
4986
4987	case Q_SCTP:
4988	b1 = gen_proto(cstate, IPPROTO_SCTP, Q_IP, Q_DEFAULT);
4989	b0 = gen_proto(cstate, IPPROTO_SCTP, Q_IPV6, Q_DEFAULT);
4990	gen_or(b0, b1);
4991	break;
4992
4993	case Q_TCP:
4994	b1 = gen_proto(cstate, IPPROTO_TCP, Q_IP, Q_DEFAULT);
4995	b0 = gen_proto(cstate, IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
4996	gen_or(b0, b1);
4997	break;
4998
4999	case Q_UDP:
5000	b1 = gen_proto(cstate, IPPROTO_UDP, Q_IP, Q_DEFAULT);
5001	b0 = gen_proto(cstate, IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
5002	gen_or(b0, b1);
5003	break;
5004
5005	case Q_ICMP:
5006	b1 = gen_proto(cstate, IPPROTO_ICMP, Q_IP, Q_DEFAULT);
5007	break;
5008
5009	#ifndef IPPROTO_IGMP
5010	#define IPPROTO_IGMP 2
5011	#endif
5012
5013	case Q_IGMP:
5014	b1 = gen_proto(cstate, IPPROTO_IGMP, Q_IP, Q_DEFAULT);
5015	break;
5016
5017	#ifndef IPPROTO_IGRP
5018	#define IPPROTO_IGRP 9
5019	#endif
5020	case Q_IGRP:
5021	b1 = gen_proto(cstate, IPPROTO_IGRP, Q_IP, Q_DEFAULT);
5022	break;
5023
5024	#ifndef IPPROTO_PIM
5025	#define IPPROTO_PIM 103
5026	#endif
5027
5028	case Q_PIM:
5029	b1 = gen_proto(cstate, IPPROTO_PIM, Q_IP, Q_DEFAULT);
5030	b0 = gen_proto(cstate, IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
5031	gen_or(b0, b1);
5032	break;
5033
5034	#ifndef IPPROTO_VRRP
5035	#define IPPROTO_VRRP 112
5036	#endif
5037
5038	case Q_VRRP:
5039	b1 = gen_proto(cstate, IPPROTO_VRRP, Q_IP, Q_DEFAULT);
5040	break;
5041
5042	#ifndef IPPROTO_CARP
5043	#define IPPROTO_CARP 112
5044	#endif
5045
5046	case Q_CARP:
5047	b1 = gen_proto(cstate, IPPROTO_CARP, Q_IP, Q_DEFAULT);
5048	break;
5049
5050	case Q_IP:
5051	b1 = gen_linktype(cstate, ETHERTYPE_IP);
5052	break;
5053
5054	case Q_ARP:
5055	b1 = gen_linktype(cstate, ETHERTYPE_ARP);
5056	break;
5057
5058	case Q_RARP:
5059	b1 = gen_linktype(cstate, ETHERTYPE_REVARP);
5060	break;
5061
5062	case Q_LINK:
5063	bpf_error(cstate, "link layer applied in wrong context");
5064
5065	case Q_ATALK:
5066	b1 = gen_linktype(cstate, ETHERTYPE_ATALK);
5067	break;
5068
5069	case Q_AARP:
5070	b1 = gen_linktype(cstate, ETHERTYPE_AARP);
5071	break;
5072
5073	case Q_DECNET:
5074	b1 = gen_linktype(cstate, ETHERTYPE_DN);
5075	break;
5076
5077	case Q_SCA:
5078	b1 = gen_linktype(cstate, ETHERTYPE_SCA);
5079	break;
5080
5081	case Q_LAT:
5082	b1 = gen_linktype(cstate, ETHERTYPE_LAT);
5083	break;
5084
5085	case Q_MOPDL:
5086	b1 = gen_linktype(cstate, ETHERTYPE_MOPDL);
5087	break;
5088
5089	case Q_MOPRC:
5090	b1 = gen_linktype(cstate, ETHERTYPE_MOPRC);
5091	break;
5092
5093	case Q_IPV6:
5094	b1 = gen_linktype(cstate, ETHERTYPE_IPV6);
5095	break;
5096
5097	#ifndef IPPROTO_ICMPV6
5098	#define IPPROTO_ICMPV6 58
5099	#endif
5100	case Q_ICMPV6:
5101	b1 = gen_proto(cstate, IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
5102	break;
5103
5104	#ifndef IPPROTO_AH
5105	#define IPPROTO_AH 51
5106	#endif
5107	case Q_AH:
5108	b1 = gen_proto(cstate, IPPROTO_AH, Q_IP, Q_DEFAULT);
5109	b0 = gen_proto(cstate, IPPROTO_AH, Q_IPV6, Q_DEFAULT);
5110	gen_or(b0, b1);
5111	break;
5112
5113	#ifndef IPPROTO_ESP
5114	#define IPPROTO_ESP 50
5115	#endif
5116	case Q_ESP:
5117	b1 = gen_proto(cstate, IPPROTO_ESP, Q_IP, Q_DEFAULT);
5118	b0 = gen_proto(cstate, IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
5119	gen_or(b0, b1);
5120	break;
5121
5122	case Q_ISO:
5123	b1 = gen_linktype(cstate, LLCSAP_ISONS);
5124	break;
5125
5126	case Q_ESIS:
5127	b1 = gen_proto(cstate, ISO9542_ESIS, Q_ISO, Q_DEFAULT);
5128	break;
5129
5130	case Q_ISIS:
5131	b1 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT);
5132	break;
5133
5134	case Q_ISIS_L1: /* all IS-IS Level1 PDU-Types */
5135	b0 = gen_proto(cstate, ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT);
5136	b1 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */
5137	gen_or(b0, b1);
5138	b0 = gen_proto(cstate, ISIS_L1_LSP, Q_ISIS, Q_DEFAULT);
5139	gen_or(b0, b1);
5140	b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT);
5141	gen_or(b0, b1);
5142	b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT);
5143	gen_or(b0, b1);
5144	break;
5145
5146	case Q_ISIS_L2: /* all IS-IS Level2 PDU-Types */
5147	b0 = gen_proto(cstate, ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT);
5148	b1 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT); /* FIXME extract the circuit-type bits */
5149	gen_or(b0, b1);
5150	b0 = gen_proto(cstate, ISIS_L2_LSP, Q_ISIS, Q_DEFAULT);
5151	gen_or(b0, b1);
5152	b0 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT);
5153	gen_or(b0, b1);
5154	b0 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT);
5155	gen_or(b0, b1);
5156	break;
5157
5158	case Q_ISIS_IIH: /* all IS-IS Hello PDU-Types */
5159	b0 = gen_proto(cstate, ISIS_L1_LAN_IIH, Q_ISIS, Q_DEFAULT);
5160	b1 = gen_proto(cstate, ISIS_L2_LAN_IIH, Q_ISIS, Q_DEFAULT);
5161	gen_or(b0, b1);
5162	b0 = gen_proto(cstate, ISIS_PTP_IIH, Q_ISIS, Q_DEFAULT);
5163	gen_or(b0, b1);
5164	break;
5165
5166	case Q_ISIS_LSP:
5167	b0 = gen_proto(cstate, ISIS_L1_LSP, Q_ISIS, Q_DEFAULT);
5168	b1 = gen_proto(cstate, ISIS_L2_LSP, Q_ISIS, Q_DEFAULT);
5169	gen_or(b0, b1);
5170	break;
5171
5172	case Q_ISIS_SNP:
5173	b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT);
5174	b1 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT);
5175	gen_or(b0, b1);
5176	b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT);
5177	gen_or(b0, b1);
5178	b0 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT);
5179	gen_or(b0, b1);
5180	break;
5181
5182	case Q_ISIS_CSNP:
5183	b0 = gen_proto(cstate, ISIS_L1_CSNP, Q_ISIS, Q_DEFAULT);
5184	b1 = gen_proto(cstate, ISIS_L2_CSNP, Q_ISIS, Q_DEFAULT);
5185	gen_or(b0, b1);
5186	break;
5187
5188	case Q_ISIS_PSNP:
5189	b0 = gen_proto(cstate, ISIS_L1_PSNP, Q_ISIS, Q_DEFAULT);
5190	b1 = gen_proto(cstate, ISIS_L2_PSNP, Q_ISIS, Q_DEFAULT);
5191	gen_or(b0, b1);
5192	break;
5193
5194	case Q_CLNP:
5195	b1 = gen_proto(cstate, ISO8473_CLNP, Q_ISO, Q_DEFAULT);
5196	break;
5197
5198	case Q_STP:
5199	b1 = gen_linktype(cstate, LLCSAP_8021D);
5200	break;
5201
5202	case Q_IPX:
5203	b1 = gen_linktype(cstate, LLCSAP_IPX);
5204	break;
5205
5206	case Q_NETBEUI:
5207	b1 = gen_linktype(cstate, LLCSAP_NETBEUI);
5208	break;
5209
5210	case Q_RADIO:
5211	bpf_error(cstate, "'radio' is not a valid protocol type");
5212
5213	default:
5214	abort();
5215	}
5216	return b1;
5217	}
5218
5219	static struct block *
5220	gen_ipfrag(compiler_state_t *cstate)
5221	{
5222	struct slist *s;
5223	struct block *b;
5224
5225	/* not IPv4 frag other than the first frag */
5226	s = gen_load_a(cstate, OR_LINKPL, 6, BPF_H);
5227	b = new_block(cstate, JMP(BPF_JSET));
5228	b->s.k = 0x1fff;
5229	b->stmts = s;
5230	gen_not(b);
5231
5232	return b;
5233	}
5234
5235	/*
5236	* Generate a comparison to a port value in the transport-layer header
5237	* at the specified offset from the beginning of that header.
5238	*
5239	* XXX - this handles a variable-length prefix preceding the link-layer
5240	* header, such as the radiotap or AVS radio prefix, but doesn't handle
5241	* variable-length link-layer headers (such as Token Ring or 802.11
5242	* headers).
5243	*/
5244	static struct block *
5245	gen_portatom(compiler_state_t *cstate, int off, bpf_int32 v)
5246	{
5247	return gen_cmp(cstate, OR_TRAN_IPV4, off, BPF_H, v);
5248	}
5249
5250	static struct block *
5251	gen_portatom6(compiler_state_t *cstate, int off, bpf_int32 v)
5252	{
5253	return gen_cmp(cstate, OR_TRAN_IPV6, off, BPF_H, v);
5254	}
5255
5256	struct block *
5257	gen_portop(compiler_state_t *cstate, int port, int proto, int dir)
5258	{
5259	struct block b0, b1, *tmp;
5260
5261	/* ip proto 'proto' and not a fragment other than the first fragment */
5262	tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)proto);
5263	b0 = gen_ipfrag(cstate);
5264	gen_and(tmp, b0);
5265
5266	switch (dir) {
5267	case Q_SRC:
5268	b1 = gen_portatom(cstate, 0, (bpf_int32)port);
5269	break;
5270
5271	case Q_DST:
5272	b1 = gen_portatom(cstate, 2, (bpf_int32)port);
5273	break;
5274
5275	case Q_OR:
5276	case Q_DEFAULT:
5277	tmp = gen_portatom(cstate, 0, (bpf_int32)port);
5278	b1 = gen_portatom(cstate, 2, (bpf_int32)port);
5279	gen_or(tmp, b1);
5280	break;
5281
5282	case Q_AND:
5283	tmp = gen_portatom(cstate, 0, (bpf_int32)port);
5284	b1 = gen_portatom(cstate, 2, (bpf_int32)port);
5285	gen_and(tmp, b1);
5286	break;
5287
5288	default:
5289	abort();
5290	}
5291	gen_and(b0, b1);
5292
5293	return b1;
5294	}
5295
5296	static struct block *
5297	gen_port(compiler_state_t *cstate, int port, int ip_proto, int dir)
5298	{
5299	struct block b0, b1, *tmp;
5300
5301	/*
5302	* ether proto ip
5303	*
5304	* For FDDI, RFC 1188 says that SNAP encapsulation is used,
5305	* not LLC encapsulation with LLCSAP_IP.
5306	*
5307	* For IEEE 802 networks - which includes 802.5 token ring
5308	* (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
5309	* says that SNAP encapsulation is used, not LLC encapsulation
5310	* with LLCSAP_IP.
5311	*
5312	* For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
5313	* RFC 2225 say that SNAP encapsulation is used, not LLC
5314	* encapsulation with LLCSAP_IP.
5315	*
5316	* So we always check for ETHERTYPE_IP.
5317	*/
5318	b0 = gen_linktype(cstate, ETHERTYPE_IP);
5319
5320	switch (ip_proto) {
5321	case IPPROTO_UDP:
5322	case IPPROTO_TCP:
5323	case IPPROTO_SCTP:
5324	b1 = gen_portop(cstate, port, ip_proto, dir);
5325	break;
5326
5327	case PROTO_UNDEF:
5328	tmp = gen_portop(cstate, port, IPPROTO_TCP, dir);
5329	b1 = gen_portop(cstate, port, IPPROTO_UDP, dir);
5330	gen_or(tmp, b1);
5331	tmp = gen_portop(cstate, port, IPPROTO_SCTP, dir);
5332	gen_or(tmp, b1);
5333	break;
5334
5335	default:
5336	abort();
5337	}
5338	gen_and(b0, b1);
5339	return b1;
5340	}
5341
5342	struct block *
5343	gen_portop6(compiler_state_t *cstate, int port, int proto, int dir)
5344	{
5345	struct block b0, b1, *tmp;
5346
5347	/* ip6 proto 'proto' */
5348	/* XXX - catch the first fragment of a fragmented packet? */
5349	b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)proto);
5350
5351	switch (dir) {
5352	case Q_SRC:
5353	b1 = gen_portatom6(cstate, 0, (bpf_int32)port);
5354	break;
5355
5356	case Q_DST:
5357	b1 = gen_portatom6(cstate, 2, (bpf_int32)port);
5358	break;
5359
5360	case Q_OR:
5361	case Q_DEFAULT:
5362	tmp = gen_portatom6(cstate, 0, (bpf_int32)port);
5363	b1 = gen_portatom6(cstate, 2, (bpf_int32)port);
5364	gen_or(tmp, b1);
5365	break;
5366
5367	case Q_AND:
5368	tmp = gen_portatom6(cstate, 0, (bpf_int32)port);
5369	b1 = gen_portatom6(cstate, 2, (bpf_int32)port);
5370	gen_and(tmp, b1);
5371	break;
5372
5373	default:
5374	abort();
5375	}
5376	gen_and(b0, b1);
5377
5378	return b1;
5379	}
5380
5381	static struct block *
5382	gen_port6(compiler_state_t *cstate, int port, int ip_proto, int dir)
5383	{
5384	struct block b0, b1, *tmp;
5385
5386	/* link proto ip6 */
5387	b0 = gen_linktype(cstate, ETHERTYPE_IPV6);
5388
5389	switch (ip_proto) {
5390	case IPPROTO_UDP:
5391	case IPPROTO_TCP:
5392	case IPPROTO_SCTP:
5393	b1 = gen_portop6(cstate, port, ip_proto, dir);
5394	break;
5395
5396	case PROTO_UNDEF:
5397	tmp = gen_portop6(cstate, port, IPPROTO_TCP, dir);
5398	b1 = gen_portop6(cstate, port, IPPROTO_UDP, dir);
5399	gen_or(tmp, b1);
5400	tmp = gen_portop6(cstate, port, IPPROTO_SCTP, dir);
5401	gen_or(tmp, b1);
5402	break;
5403
5404	default:
5405	abort();
5406	}
5407	gen_and(b0, b1);
5408	return b1;
5409	}
5410
5411	/* gen_portrange code */
5412	static struct block *
5413	gen_portrangeatom(compiler_state_t *cstate, int off, bpf_int32 v1,
5414	bpf_int32 v2)
5415	{
5416	struct block b1, b2;
5417
5418	if (v1 > v2) {
5419	/*
5420	* Reverse the order of the ports, so v1 is the lower one.
5421	*/
5422	bpf_int32 vtemp;
5423
5424	vtemp = v1;
5425	v1 = v2;
5426	v2 = vtemp;
5427	}
5428
5429	b1 = gen_cmp_ge(cstate, OR_TRAN_IPV4, off, BPF_H, v1);
5430	b2 = gen_cmp_le(cstate, OR_TRAN_IPV4, off, BPF_H, v2);
5431
5432	gen_and(b1, b2);
5433
5434	return b2;
5435	}
5436
5437	struct block *
5438	gen_portrangeop(compiler_state_t *cstate, int port1, int port2, int proto,
5439	int dir)
5440	{
5441	struct block b0, b1, *tmp;
5442
5443	/* ip proto 'proto' and not a fragment other than the first fragment */
5444	tmp = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)proto);
5445	b0 = gen_ipfrag(cstate);
5446	gen_and(tmp, b0);
5447
5448	switch (dir) {
5449	case Q_SRC:
5450	b1 = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2);
5451	break;
5452
5453	case Q_DST:
5454	b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2);
5455	break;
5456
5457	case Q_OR:
5458	case Q_DEFAULT:
5459	tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2);
5460	b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2);
5461	gen_or(tmp, b1);
5462	break;
5463
5464	case Q_AND:
5465	tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2);
5466	b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2);
5467	gen_and(tmp, b1);
5468	break;
5469
5470	default:
5471	abort();
5472	}
5473	gen_and(b0, b1);
5474
5475	return b1;
5476	}
5477
5478	static struct block *
5479	gen_portrange(compiler_state_t *cstate, int port1, int port2, int ip_proto,
5480	int dir)
5481	{
5482	struct block b0, b1, *tmp;
5483
5484	/* link proto ip */
5485	b0 = gen_linktype(cstate, ETHERTYPE_IP);
5486
5487	switch (ip_proto) {
5488	case IPPROTO_UDP:
5489	case IPPROTO_TCP:
5490	case IPPROTO_SCTP:
5491	b1 = gen_portrangeop(cstate, port1, port2, ip_proto, dir);
5492	break;
5493
5494	case PROTO_UNDEF:
5495	tmp = gen_portrangeop(cstate, port1, port2, IPPROTO_TCP, dir);
5496	b1 = gen_portrangeop(cstate, port1, port2, IPPROTO_UDP, dir);
5497	gen_or(tmp, b1);
5498	tmp = gen_portrangeop(cstate, port1, port2, IPPROTO_SCTP, dir);
5499	gen_or(tmp, b1);
5500	break;
5501
5502	default:
5503	abort();
5504	}
5505	gen_and(b0, b1);
5506	return b1;
5507	}
5508
5509	static struct block *
5510	gen_portrangeatom6(compiler_state_t *cstate, int off, bpf_int32 v1,
5511	bpf_int32 v2)
5512	{
5513	struct block b1, b2;
5514
5515	if (v1 > v2) {
5516	/*
5517	* Reverse the order of the ports, so v1 is the lower one.
5518	*/
5519	bpf_int32 vtemp;
5520
5521	vtemp = v1;
5522	v1 = v2;
5523	v2 = vtemp;
5524	}
5525
5526	b1 = gen_cmp_ge(cstate, OR_TRAN_IPV6, off, BPF_H, v1);
5527	b2 = gen_cmp_le(cstate, OR_TRAN_IPV6, off, BPF_H, v2);
5528
5529	gen_and(b1, b2);
5530
5531	return b2;
5532	}
5533
5534	struct block *
5535	gen_portrangeop6(compiler_state_t *cstate, int port1, int port2, int proto,
5536	int dir)
5537	{
5538	struct block b0, b1, *tmp;
5539
5540	/* ip6 proto 'proto' */
5541	/* XXX - catch the first fragment of a fragmented packet? */
5542	b0 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)proto);
5543
5544	switch (dir) {
5545	case Q_SRC:
5546	b1 = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2);
5547	break;
5548
5549	case Q_DST:
5550	b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2);
5551	break;
5552
5553	case Q_OR:
5554	case Q_DEFAULT:
5555	tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2);
5556	b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2);
5557	gen_or(tmp, b1);
5558	break;
5559
5560	case Q_AND:
5561	tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2);
5562	b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2);
5563	gen_and(tmp, b1);
5564	break;
5565
5566	default:
5567	abort();
5568	}
5569	gen_and(b0, b1);
5570
5571	return b1;
5572	}
5573
5574	static struct block *
5575	gen_portrange6(compiler_state_t *cstate, int port1, int port2, int ip_proto,
5576	int dir)
5577	{
5578	struct block b0, b1, *tmp;
5579
5580	/* link proto ip6 */
5581	b0 = gen_linktype(cstate, ETHERTYPE_IPV6);
5582
5583	switch (ip_proto) {
5584	case IPPROTO_UDP:
5585	case IPPROTO_TCP:
5586	case IPPROTO_SCTP:
5587	b1 = gen_portrangeop6(cstate, port1, port2, ip_proto, dir);
5588	break;
5589
5590	case PROTO_UNDEF:
5591	tmp = gen_portrangeop6(cstate, port1, port2, IPPROTO_TCP, dir);
5592	b1 = gen_portrangeop6(cstate, port1, port2, IPPROTO_UDP, dir);
5593	gen_or(tmp, b1);
5594	tmp = gen_portrangeop6(cstate, port1, port2, IPPROTO_SCTP, dir);
5595	gen_or(tmp, b1);
5596	break;
5597
5598	default:
5599	abort();
5600	}
5601	gen_and(b0, b1);
5602	return b1;
5603	}
5604
5605	static int
5606	lookup_proto(compiler_state_t cstate, const char name, int proto)
5607	{
5608	register int v;
5609
5610	switch (proto) {
5611
5612	case Q_DEFAULT:
5613	case Q_IP:
5614	case Q_IPV6:
5615	v = pcap_nametoproto(name);
5616	if (v == PROTO_UNDEF)
5617	bpf_error(cstate, "unknown ip proto '%s'", name);
5618	break;
5619
5620	case Q_LINK:
5621	/* XXX should look up h/w protocol type based on cstate->linktype */
5622	v = pcap_nametoeproto(name);
5623	if (v == PROTO_UNDEF) {
5624	v = pcap_nametollc(name);
5625	if (v == PROTO_UNDEF)
5626	bpf_error(cstate, "unknown ether proto '%s'", name);
5627	}
5628	break;
5629
5630	case Q_ISO:
5631	if (strcmp(name, "esis") == 0)
5632	v = ISO9542_ESIS;
5633	else if (strcmp(name, "isis") == 0)
5634	v = ISO10589_ISIS;
5635	else if (strcmp(name, "clnp") == 0)
5636	v = ISO8473_CLNP;
5637	else
5638	bpf_error(cstate, "unknown osi proto '%s'", name);
5639	break;
5640
5641	default:
5642	v = PROTO_UNDEF;
5643	break;
5644	}
5645	return v;
5646	}
5647
5648	#if 0
5649	struct stmt *
5650	gen_joinsp(s, n)
5651	struct stmt **s;
5652	int n;
5653	{
5654	return NULL;
5655	}
5656	#endif
5657
5658	static struct block *
5659	gen_protochain(compiler_state_t *cstate, int v, int proto, int dir)
5660	{
5661	#ifdef NO_PROTOCHAIN
5662	return gen_proto(cstate, v, proto, dir);
5663	#else
5664	struct block b0, b;
5665	struct slist *s[100];
5666	int fix2, fix3, fix4, fix5;
5667	int ahcheck, again, end;
5668	int i, max;
5669	int reg2 = alloc_reg(cstate);
5670
5671	memset(s, 0, sizeof(s));
5672	fix3 = fix4 = fix5 = 0;
5673
5674	switch (proto) {
5675	case Q_IP:
5676	case Q_IPV6:
5677	break;
5678	case Q_DEFAULT:
5679	b0 = gen_protochain(cstate, v, Q_IP, dir);
5680	b = gen_protochain(cstate, v, Q_IPV6, dir);
5681	gen_or(b0, b);
5682	return b;
5683	default:
5684	bpf_error(cstate, "bad protocol applied for 'protochain'");
5685	/NOTREACHED/
5686	}
5687
5688	/*
5689	* We don't handle variable-length prefixes before the link-layer
5690	* header, or variable-length link-layer headers, here yet.
5691	* We might want to add BPF instructions to do the protochain
5692	* work, to simplify that and, on platforms that have a BPF
5693	* interpreter with the new instructions, let the filtering
5694	* be done in the kernel. (We already require a modified BPF
5695	* engine to do the protochain stuff, to support backward
5696	* branches, and backward branch support is unlikely to appear
5697	* in kernel BPF engines.)
5698	*/
5699	if (cstate->off_linkpl.is_variable)
5700	bpf_error(cstate, "'protochain' not supported with variable length headers");
5701
5702	cstate->no_optimize = 1; /this code is not compatible with optimzer yet /
5703
5704	/*
5705	* s[0] is a dummy entry to protect other BPF insn from damage
5706	* by s[fix] = foo with uninitialized variable "fix". It is somewhat
5707	* hard to find interdependency made by jump table fixup.
5708	*/
5709	i = 0;
5710	s[i] = new_stmt(cstate, 0); /dummy/
5711	i++;
5712
5713	switch (proto) {
5714	case Q_IP:
5715	b0 = gen_linktype(cstate, ETHERTYPE_IP);
5716
5717	/* A = ip->ip_p */
5718	s[i] = new_stmt(cstate, BPF_LD\|BPF_ABS\|BPF_B);
5719	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 9;
5720	i++;
5721	/* X = ip->ip_hl << 2 */
5722	s[i] = new_stmt(cstate, BPF_LDX\|BPF_MSH\|BPF_B);
5723	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
5724	i++;
5725	break;
5726
5727	case Q_IPV6:
5728	b0 = gen_linktype(cstate, ETHERTYPE_IPV6);
5729
5730	/* A = ip6->ip_nxt */
5731	s[i] = new_stmt(cstate, BPF_LD\|BPF_ABS\|BPF_B);
5732	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 6;
5733	i++;
5734	/* X = sizeof(struct ip6_hdr) */
5735	s[i] = new_stmt(cstate, BPF_LDX\|BPF_IMM);
5736	s[i]->s.k = 40;
5737	i++;
5738	break;
5739
5740	default:
5741	bpf_error(cstate, "unsupported proto to gen_protochain");
5742	/NOTREACHED/
5743	}
5744
5745	/* again: if (A == v) goto end; else fall through; */
5746	again = i;
5747	s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5748	s[i]->s.k = v;
5749	s[i]->s.jt = NULL; /later/
5750	s[i]->s.jf = NULL; /update in next stmt/
5751	fix5 = i;
5752	i++;
5753
5754	#ifndef IPPROTO_NONE
5755	#define IPPROTO_NONE 59
5756	#endif
5757	/* if (A == IPPROTO_NONE) goto end */
5758	s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5759	s[i]->s.jt = NULL; /later/
5760	s[i]->s.jf = NULL; /update in next stmt/
5761	s[i]->s.k = IPPROTO_NONE;
5762	s[fix5]->s.jf = s[i];
5763	fix2 = i;
5764	i++;
5765
5766	if (proto == Q_IPV6) {
5767	int v6start, v6end, v6advance, j;
5768
5769	v6start = i;
5770	/* if (A == IPPROTO_HOPOPTS) goto v6advance */
5771	s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5772	s[i]->s.jt = NULL; /later/
5773	s[i]->s.jf = NULL; /update in next stmt/
5774	s[i]->s.k = IPPROTO_HOPOPTS;
5775	s[fix2]->s.jf = s[i];
5776	i++;
5777	/* if (A == IPPROTO_DSTOPTS) goto v6advance */
5778	s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5779	s[i]->s.jt = NULL; /later/
5780	s[i]->s.jf = NULL; /update in next stmt/
5781	s[i]->s.k = IPPROTO_DSTOPTS;
5782	i++;
5783	/* if (A == IPPROTO_ROUTING) goto v6advance */
5784	s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5785	s[i]->s.jt = NULL; /later/
5786	s[i]->s.jf = NULL; /update in next stmt/
5787	s[i]->s.k = IPPROTO_ROUTING;
5788	i++;
5789	/* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
5790	s[i - 1]->s.jf = s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5791	s[i]->s.jt = NULL; /later/
5792	s[i]->s.jf = NULL; /later/
5793	s[i]->s.k = IPPROTO_FRAGMENT;
5794	fix3 = i;
5795	v6end = i;
5796	i++;
5797
5798	/* v6advance: */
5799	v6advance = i;
5800
5801	/*
5802	* in short,
5803	* A = P[X + packet head];
5804	* X = X + (P[X + packet head + 1] + 1) * 8;
5805	*/
5806	/* A = P[X + packet head] */
5807	s[i] = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
5808	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
5809	i++;
5810	/* MEM[reg2] = A */
5811	s[i] = new_stmt(cstate, BPF_ST);
5812	s[i]->s.k = reg2;
5813	i++;
5814	/* A = P[X + packet head + 1]; */
5815	s[i] = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
5816	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 1;
5817	i++;
5818	/* A += 1 */
5819	s[i] = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
5820	s[i]->s.k = 1;
5821	i++;
5822	/* A = 8 /
5823	s[i] = new_stmt(cstate, BPF_ALU\|BPF_MUL\|BPF_K);
5824	s[i]->s.k = 8;
5825	i++;
5826	/* A += X */
5827	s[i] = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X);
5828	s[i]->s.k = 0;
5829	i++;
5830	/* X = A; */
5831	s[i] = new_stmt(cstate, BPF_MISC\|BPF_TAX);
5832	i++;
5833	/* A = MEM[reg2] */
5834	s[i] = new_stmt(cstate, BPF_LD\|BPF_MEM);
5835	s[i]->s.k = reg2;
5836	i++;
5837
5838	/* goto again; (must use BPF_JA for backward jump) */
5839	s[i] = new_stmt(cstate, BPF_JMP\|BPF_JA);
5840	s[i]->s.k = again - i - 1;
5841	s[i - 1]->s.jf = s[i];
5842	i++;
5843
5844	/* fixup */
5845	for (j = v6start; j <= v6end; j++)
5846	s[j]->s.jt = s[v6advance];
5847	} else {
5848	/* nop */
5849	s[i] = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
5850	s[i]->s.k = 0;
5851	s[fix2]->s.jf = s[i];
5852	i++;
5853	}
5854
5855	/* ahcheck: */
5856	ahcheck = i;
5857	/* if (A == IPPROTO_AH) then fall through; else goto end; */
5858	s[i] = new_stmt(cstate, BPF_JMP\|BPF_JEQ\|BPF_K);
5859	s[i]->s.jt = NULL; /later/
5860	s[i]->s.jf = NULL; /later/
5861	s[i]->s.k = IPPROTO_AH;
5862	if (fix3)
5863	s[fix3]->s.jf = s[ahcheck];
5864	fix4 = i;
5865	i++;
5866
5867	/*
5868	* in short,
5869	* A = P[X];
5870	* X = X + (P[X + 1] + 2) * 4;
5871	*/
5872	/* A = X */
5873	s[i - 1]->s.jt = s[i] = new_stmt(cstate, BPF_MISC\|BPF_TXA);
5874	i++;
5875	/* A = P[X + packet head]; */
5876	s[i] = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
5877	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
5878	i++;
5879	/* MEM[reg2] = A */
5880	s[i] = new_stmt(cstate, BPF_ST);
5881	s[i]->s.k = reg2;
5882	i++;
5883	/* A = X */
5884	s[i - 1]->s.jt = s[i] = new_stmt(cstate, BPF_MISC\|BPF_TXA);
5885	i++;
5886	/* A += 1 */
5887	s[i] = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
5888	s[i]->s.k = 1;
5889	i++;
5890	/* X = A */
5891	s[i] = new_stmt(cstate, BPF_MISC\|BPF_TAX);
5892	i++;
5893	/* A = P[X + packet head] */
5894	s[i] = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
5895	s[i]->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
5896	i++;
5897	/* A += 2 */
5898	s[i] = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
5899	s[i]->s.k = 2;
5900	i++;
5901	/* A = 4 /
5902	s[i] = new_stmt(cstate, BPF_ALU\|BPF_MUL\|BPF_K);
5903	s[i]->s.k = 4;
5904	i++;
5905	/* X = A; */
5906	s[i] = new_stmt(cstate, BPF_MISC\|BPF_TAX);
5907	i++;
5908	/* A = MEM[reg2] */
5909	s[i] = new_stmt(cstate, BPF_LD\|BPF_MEM);
5910	s[i]->s.k = reg2;
5911	i++;
5912
5913	/* goto again; (must use BPF_JA for backward jump) */
5914	s[i] = new_stmt(cstate, BPF_JMP\|BPF_JA);
5915	s[i]->s.k = again - i - 1;
5916	i++;
5917
5918	/* end: nop */
5919	end = i;
5920	s[i] = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
5921	s[i]->s.k = 0;
5922	s[fix2]->s.jt = s[end];
5923	s[fix4]->s.jf = s[end];
5924	s[fix5]->s.jt = s[end];
5925	i++;
5926
5927	/*
5928	* make slist chain
5929	*/
5930	max = i;
5931	for (i = 0; i < max - 1; i++)
5932	s[i]->next = s[i + 1];
5933	s[max - 1]->next = NULL;
5934
5935	/*
5936	* emit final check
5937	*/
5938	b = new_block(cstate, JMP(BPF_JEQ));
5939	b->stmts = s[1]; /remember, s[0] is dummy/
5940	b->s.k = v;
5941
5942	free_reg(cstate, reg2);
5943
5944	gen_and(b0, b);
5945	return b;
5946	#endif
5947	}
5948
5949	static struct block *
5950	gen_check_802_11_data_frame(compiler_state_t *cstate)
5951	{
5952	struct slist *s;
5953	struct block b0, b1;
5954
5955	/*
5956	* A data frame has the 0x08 bit (b3) in the frame control field set
5957	* and the 0x04 bit (b2) clear.
5958	*/
5959	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
5960	b0 = new_block(cstate, JMP(BPF_JSET));
5961	b0->s.k = 0x08;
5962	b0->stmts = s;
5963
5964	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
5965	b1 = new_block(cstate, JMP(BPF_JSET));
5966	b1->s.k = 0x04;
5967	b1->stmts = s;
5968	gen_not(b1);
5969
5970	gen_and(b1, b0);
5971
5972	return b0;
5973	}
5974
5975	/*
5976	* Generate code that checks whether the packet is a packet for protocol
5977	* <proto> and whether the type field in that protocol's header has
5978	* the value <v>, e.g. if <proto> is Q_IP, it checks whether it's an
5979	* IP packet and checks the protocol number in the IP header against <v>.
5980	*
5981	* If <proto> is Q_DEFAULT, i.e. just "proto" was specified, it checks
5982	* against Q_IP and Q_IPV6.
5983	*/
5984	static struct block *
5985	gen_proto(compiler_state_t *cstate, int v, int proto, int dir)
5986	{
5987	struct block b0, b1;
5988	#ifndef CHASE_CHAIN
5989	struct block *b2;
5990	#endif
5991
5992	if (dir != Q_DEFAULT)
5993	bpf_error(cstate, "direction applied to 'proto'");
5994
5995	switch (proto) {
5996	case Q_DEFAULT:
5997	b0 = gen_proto(cstate, v, Q_IP, dir);
5998	b1 = gen_proto(cstate, v, Q_IPV6, dir);
5999	gen_or(b0, b1);
6000	return b1;
6001
6002	case Q_IP:
6003	/*
6004	* For FDDI, RFC 1188 says that SNAP encapsulation is used,
6005	* not LLC encapsulation with LLCSAP_IP.
6006	*
6007	* For IEEE 802 networks - which includes 802.5 token ring
6008	* (which is what DLT_IEEE802 means) and 802.11 - RFC 1042
6009	* says that SNAP encapsulation is used, not LLC encapsulation
6010	* with LLCSAP_IP.
6011	*
6012	* For LLC-encapsulated ATM/"Classical IP", RFC 1483 and
6013	* RFC 2225 say that SNAP encapsulation is used, not LLC
6014	* encapsulation with LLCSAP_IP.
6015	*
6016	* So we always check for ETHERTYPE_IP.
6017	*/
6018	b0 = gen_linktype(cstate, ETHERTYPE_IP);
6019	#ifndef CHASE_CHAIN
6020	b1 = gen_cmp(cstate, OR_LINKPL, 9, BPF_B, (bpf_int32)v);
6021	#else
6022	b1 = gen_protochain(cstate, v, Q_IP);
6023	#endif
6024	gen_and(b0, b1);
6025	return b1;
6026
6027	case Q_ISO:
6028	switch (cstate->linktype) {
6029
6030	case DLT_FRELAY:
6031	/*
6032	* Frame Relay packets typically have an OSI
6033	* NLPID at the beginning; "gen_linktype(cstate, LLCSAP_ISONS)"
6034	* generates code to check for all the OSI
6035	* NLPIDs, so calling it and then adding a check
6036	* for the particular NLPID for which we're
6037	* looking is bogus, as we can just check for
6038	* the NLPID.
6039	*
6040	* What we check for is the NLPID and a frame
6041	* control field value of UI, i.e. 0x03 followed
6042	* by the NLPID.
6043	*
6044	* XXX - assumes a 2-byte Frame Relay header with
6045	* DLCI and flags. What if the address is longer?
6046	*
6047	* XXX - what about SNAP-encapsulated frames?
6048	*/
6049	return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) \| v);
6050	/NOTREACHED/
6051	break;
6052
6053	case DLT_C_HDLC:
6054	/*
6055	* Cisco uses an Ethertype lookalike - for OSI,
6056	* it's 0xfefe.
6057	*/
6058	b0 = gen_linktype(cstate, LLCSAP_ISONS<<8 \| LLCSAP_ISONS);
6059	/* OSI in C-HDLC is stuffed with a fudge byte */
6060	b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 1, BPF_B, (long)v);
6061	gen_and(b0, b1);
6062	return b1;
6063
6064	default:
6065	b0 = gen_linktype(cstate, LLCSAP_ISONS);
6066	b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 0, BPF_B, (long)v);
6067	gen_and(b0, b1);
6068	return b1;
6069	}
6070
6071	case Q_ISIS:
6072	b0 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT);
6073	/*
6074	* 4 is the offset of the PDU type relative to the IS-IS
6075	* header.
6076	*/
6077	b1 = gen_cmp(cstate, OR_LINKPL_NOSNAP, 4, BPF_B, (long)v);
6078	gen_and(b0, b1);
6079	return b1;
6080
6081	case Q_ARP:
6082	bpf_error(cstate, "arp does not encapsulate another protocol");
6083	/* NOTREACHED */
6084
6085	case Q_RARP:
6086	bpf_error(cstate, "rarp does not encapsulate another protocol");
6087	/* NOTREACHED */
6088
6089	case Q_ATALK:
6090	bpf_error(cstate, "atalk encapsulation is not specifiable");
6091	/* NOTREACHED */
6092
6093	case Q_DECNET:
6094	bpf_error(cstate, "decnet encapsulation is not specifiable");
6095	/* NOTREACHED */
6096
6097	case Q_SCA:
6098	bpf_error(cstate, "sca does not encapsulate another protocol");
6099	/* NOTREACHED */
6100
6101	case Q_LAT:
6102	bpf_error(cstate, "lat does not encapsulate another protocol");
6103	/* NOTREACHED */
6104
6105	case Q_MOPRC:
6106	bpf_error(cstate, "moprc does not encapsulate another protocol");
6107	/* NOTREACHED */
6108
6109	case Q_MOPDL:
6110	bpf_error(cstate, "mopdl does not encapsulate another protocol");
6111	/* NOTREACHED */
6112
6113	case Q_LINK:
6114	return gen_linktype(cstate, v);
6115
6116	case Q_UDP:
6117	bpf_error(cstate, "'udp proto' is bogus");
6118	/* NOTREACHED */
6119
6120	case Q_TCP:
6121	bpf_error(cstate, "'tcp proto' is bogus");
6122	/* NOTREACHED */
6123
6124	case Q_SCTP:
6125	bpf_error(cstate, "'sctp proto' is bogus");
6126	/* NOTREACHED */
6127
6128	case Q_ICMP:
6129	bpf_error(cstate, "'icmp proto' is bogus");
6130	/* NOTREACHED */
6131
6132	case Q_IGMP:
6133	bpf_error(cstate, "'igmp proto' is bogus");
6134	/* NOTREACHED */
6135
6136	case Q_IGRP:
6137	bpf_error(cstate, "'igrp proto' is bogus");
6138	/* NOTREACHED */
6139
6140	case Q_PIM:
6141	bpf_error(cstate, "'pim proto' is bogus");
6142	/* NOTREACHED */
6143
6144	case Q_VRRP:
6145	bpf_error(cstate, "'vrrp proto' is bogus");
6146	/* NOTREACHED */
6147
6148	case Q_CARP:
6149	bpf_error(cstate, "'carp proto' is bogus");
6150	/* NOTREACHED */
6151
6152	case Q_IPV6:
6153	b0 = gen_linktype(cstate, ETHERTYPE_IPV6);
6154	#ifndef CHASE_CHAIN
6155	/*
6156	* Also check for a fragment header before the final
6157	* header.
6158	*/
6159	b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, IPPROTO_FRAGMENT);
6160	b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, (bpf_int32)v);
6161	gen_and(b2, b1);
6162	b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)v);
6163	gen_or(b2, b1);
6164	#else
6165	b1 = gen_protochain(cstate, v, Q_IPV6);
6166	#endif
6167	gen_and(b0, b1);
6168	return b1;
6169
6170	case Q_ICMPV6:
6171	bpf_error(cstate, "'icmp6 proto' is bogus");
6172
6173	case Q_AH:
6174	bpf_error(cstate, "'ah proto' is bogus");
6175
6176	case Q_ESP:
6177	bpf_error(cstate, "'ah proto' is bogus");
6178
6179	case Q_STP:
6180	bpf_error(cstate, "'stp proto' is bogus");
6181
6182	case Q_IPX:
6183	bpf_error(cstate, "'ipx proto' is bogus");
6184
6185	case Q_NETBEUI:
6186	bpf_error(cstate, "'netbeui proto' is bogus");
6187
6188	case Q_RADIO:
6189	bpf_error(cstate, "'radio proto' is bogus");
6190
6191	default:
6192	abort();
6193	/* NOTREACHED */
6194	}
6195	/* NOTREACHED */
6196	}
6197
6198	struct block *
6199	gen_scode(compiler_state_t cstate, const char name, struct qual q)
6200	{
6201	int proto = q.proto;
6202	int dir = q.dir;
6203	int tproto;
6204	u_char *eaddr;
6205	bpf_u_int32 mask, addr;
6206	#ifndef INET6
6207	bpf_u_int32 **alist;
6208	#else
6209	int tproto6;
6210	struct sockaddr_in *sin4;
6211	struct sockaddr_in6 *sin6;
6212	struct addrinfo res, res0;
6213	struct in6_addr mask128;
6214	#endif /INET6/
6215	struct block b, tmp;
6216	int port, real_proto;
6217	int port1, port2;
6218
6219	switch (q.addr) {
6220
6221	case Q_NET:
6222	addr = pcap_nametonetaddr(name);
6223	if (addr == 0)
6224	bpf_error(cstate, "unknown network '%s'", name);
6225	/* Left justify network addr and calculate its network mask */
6226	mask = 0xffffffff;
6227	while (addr && (addr & 0xff000000) == 0) {
6228	addr <<= 8;
6229	mask <<= 8;
6230	}
6231	return gen_host(cstate, addr, mask, proto, dir, q.addr);
6232
6233	case Q_DEFAULT:
6234	case Q_HOST:
6235	if (proto == Q_LINK) {
6236	switch (cstate->linktype) {
6237
6238	case DLT_EN10MB:
6239	case DLT_NETANALYZER:
6240	case DLT_NETANALYZER_TRANSPARENT:
6241	eaddr = pcap_ether_hostton(name);
6242	if (eaddr == NULL)
6243	bpf_error(cstate,
6244	"unknown ether host '%s'", name);
6245	tmp = gen_prevlinkhdr_check(cstate);
6246	b = gen_ehostop(cstate, eaddr, dir);
6247	if (tmp != NULL)
6248	gen_and(tmp, b);
6249	free(eaddr);
6250	return b;
6251
6252	case DLT_FDDI:
6253	eaddr = pcap_ether_hostton(name);
6254	if (eaddr == NULL)
6255	bpf_error(cstate,
6256	"unknown FDDI host '%s'", name);
6257	b = gen_fhostop(cstate, eaddr, dir);
6258	free(eaddr);
6259	return b;
6260
6261	case DLT_IEEE802:
6262	eaddr = pcap_ether_hostton(name);
6263	if (eaddr == NULL)
6264	bpf_error(cstate,
6265	"unknown token ring host '%s'", name);
6266	b = gen_thostop(cstate, eaddr, dir);
6267	free(eaddr);
6268	return b;
6269
6270	case DLT_IEEE802_11:
6271	case DLT_PRISM_HEADER:
6272	case DLT_IEEE802_11_RADIO_AVS:
6273	case DLT_IEEE802_11_RADIO:
6274	case DLT_PPI:
6275	eaddr = pcap_ether_hostton(name);
6276	if (eaddr == NULL)
6277	bpf_error(cstate,
6278	"unknown 802.11 host '%s'", name);
6279	b = gen_wlanhostop(cstate, eaddr, dir);
6280	free(eaddr);
6281	return b;
6282
6283	case DLT_IP_OVER_FC:
6284	eaddr = pcap_ether_hostton(name);
6285	if (eaddr == NULL)
6286	bpf_error(cstate,
6287	"unknown Fibre Channel host '%s'", name);
6288	b = gen_ipfchostop(cstate, eaddr, dir);
6289	free(eaddr);
6290	return b;
6291	}
6292
6293	bpf_error(cstate, "only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name");
6294	} else if (proto == Q_DECNET) {
6295	unsigned short dn_addr;
6296
6297	if (!__pcap_nametodnaddr(name, &dn_addr)) {
6298	#ifdef DECNETLIB
6299	bpf_error(cstate, "unknown decnet host name '%s'\n", name);
6300	#else
6301	bpf_error(cstate, "decnet name support not included, '%s' cannot be translated\n",
6302	name);
6303	#endif
6304	}
6305	/*
6306	* I don't think DECNET hosts can be multihomed, so
6307	* there is no need to build up a list of addresses
6308	*/
6309	return (gen_host(cstate, dn_addr, 0, proto, dir, q.addr));
6310	} else {
6311	#ifndef INET6
6312	alist = pcap_nametoaddr(name);
6313	if (alist == NULL \|\| *alist == NULL)
6314	bpf_error(cstate, "unknown host '%s'", name);
6315	tproto = proto;
6316	if (cstate->off_linktype.constant_part == OFFSET_NOT_SET &&
6317	tproto == Q_DEFAULT)
6318	tproto = Q_IP;
6319	b = gen_host(cstate, **alist++, 0xffffffff, tproto, dir, q.addr);
6320	while (*alist) {
6321	tmp = gen_host(cstate, **alist++, 0xffffffff,
6322	tproto, dir, q.addr);
6323	gen_or(b, tmp);
6324	b = tmp;
6325	}
6326	return b;
6327	#else
6328	memset(&mask128, 0xff, sizeof(mask128));
6329	res0 = res = pcap_nametoaddrinfo(name);
6330	if (res == NULL)
6331	bpf_error(cstate, "unknown host '%s'", name);
6332	cstate->ai = res;
6333	b = tmp = NULL;
6334	tproto = tproto6 = proto;
6335	if (cstate->off_linktype.constant_part == OFFSET_NOT_SET &&
6336	tproto == Q_DEFAULT) {
6337	tproto = Q_IP;
6338	tproto6 = Q_IPV6;
6339	}
6340	for (res = res0; res; res = res->ai_next) {
6341	switch (res->ai_family) {
6342	case AF_INET:
6343	if (tproto == Q_IPV6)
6344	continue;
6345
6346	sin4 = (struct sockaddr_in *)
6347	res->ai_addr;
6348	tmp = gen_host(cstate, ntohl(sin4->sin_addr.s_addr),
6349	0xffffffff, tproto, dir, q.addr);
6350	break;
6351	case AF_INET6:
6352	if (tproto6 == Q_IP)
6353	continue;
6354
6355	sin6 = (struct sockaddr_in6 *)
6356	res->ai_addr;
6357	tmp = gen_host6(cstate, &sin6->sin6_addr,
6358	&mask128, tproto6, dir, q.addr);
6359	break;
6360	default:
6361	continue;
6362	}
6363	if (b)
6364	gen_or(b, tmp);
6365	b = tmp;
6366	}
6367	cstate->ai = NULL;
6368	freeaddrinfo(res0);
6369	if (b == NULL) {
6370	bpf_error(cstate, "unknown host '%s'%s", name,
6371	(proto == Q_DEFAULT)
6372	? ""
6373	: " for specified address family");
6374	}
6375	return b;
6376	#endif /INET6/
6377	}
6378
6379	case Q_PORT:
6380	if (proto != Q_DEFAULT &&
6381	proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
6382	bpf_error(cstate, "illegal qualifier of 'port'");
6383	if (pcap_nametoport(name, &port, &real_proto) == 0)
6384	bpf_error(cstate, "unknown port '%s'", name);
6385	if (proto == Q_UDP) {
6386	if (real_proto == IPPROTO_TCP)
6387	bpf_error(cstate, "port '%s' is tcp", name);
6388	else if (real_proto == IPPROTO_SCTP)
6389	bpf_error(cstate, "port '%s' is sctp", name);
6390	else
6391	/* override PROTO_UNDEF */
6392	real_proto = IPPROTO_UDP;
6393	}
6394	if (proto == Q_TCP) {
6395	if (real_proto == IPPROTO_UDP)
6396	bpf_error(cstate, "port '%s' is udp", name);
6397
6398	else if (real_proto == IPPROTO_SCTP)
6399	bpf_error(cstate, "port '%s' is sctp", name);
6400	else
6401	/* override PROTO_UNDEF */
6402	real_proto = IPPROTO_TCP;
6403	}
6404	if (proto == Q_SCTP) {
6405	if (real_proto == IPPROTO_UDP)
6406	bpf_error(cstate, "port '%s' is udp", name);
6407
6408	else if (real_proto == IPPROTO_TCP)
6409	bpf_error(cstate, "port '%s' is tcp", name);
6410	else
6411	/* override PROTO_UNDEF */
6412	real_proto = IPPROTO_SCTP;
6413	}
6414	if (port < 0)
6415	bpf_error(cstate, "illegal port number %d < 0", port);
6416	if (port > 65535)
6417	bpf_error(cstate, "illegal port number %d > 65535", port);
6418	b = gen_port(cstate, port, real_proto, dir);
6419	gen_or(gen_port6(cstate, port, real_proto, dir), b);
6420	return b;
6421
6422	case Q_PORTRANGE:
6423	if (proto != Q_DEFAULT &&
6424	proto != Q_UDP && proto != Q_TCP && proto != Q_SCTP)
6425	bpf_error(cstate, "illegal qualifier of 'portrange'");
6426	if (pcap_nametoportrange(name, &port1, &port2, &real_proto) == 0)
6427	bpf_error(cstate, "unknown port in range '%s'", name);
6428	if (proto == Q_UDP) {
6429	if (real_proto == IPPROTO_TCP)
6430	bpf_error(cstate, "port in range '%s' is tcp", name);
6431	else if (real_proto == IPPROTO_SCTP)
6432	bpf_error(cstate, "port in range '%s' is sctp", name);
6433	else
6434	/* override PROTO_UNDEF */
6435	real_proto = IPPROTO_UDP;
6436	}
6437	if (proto == Q_TCP) {
6438	if (real_proto == IPPROTO_UDP)
6439	bpf_error(cstate, "port in range '%s' is udp", name);
6440	else if (real_proto == IPPROTO_SCTP)
6441	bpf_error(cstate, "port in range '%s' is sctp", name);
6442	else
6443	/* override PROTO_UNDEF */
6444	real_proto = IPPROTO_TCP;
6445	}
6446	if (proto == Q_SCTP) {
6447	if (real_proto == IPPROTO_UDP)
6448	bpf_error(cstate, "port in range '%s' is udp", name);
6449	else if (real_proto == IPPROTO_TCP)
6450	bpf_error(cstate, "port in range '%s' is tcp", name);
6451	else
6452	/* override PROTO_UNDEF */
6453	real_proto = IPPROTO_SCTP;
6454	}
6455	if (port1 < 0)
6456	bpf_error(cstate, "illegal port number %d < 0", port1);
6457	if (port1 > 65535)
6458	bpf_error(cstate, "illegal port number %d > 65535", port1);
6459	if (port2 < 0)
6460	bpf_error(cstate, "illegal port number %d < 0", port2);
6461	if (port2 > 65535)
6462	bpf_error(cstate, "illegal port number %d > 65535", port2);
6463
6464	b = gen_portrange(cstate, port1, port2, real_proto, dir);
6465	gen_or(gen_portrange6(cstate, port1, port2, real_proto, dir), b);
6466	return b;
6467
6468	case Q_GATEWAY:
6469	#ifndef INET6
6470	eaddr = pcap_ether_hostton(name);
6471	if (eaddr == NULL)
6472	bpf_error(cstate, "unknown ether host: %s", name);
6473
6474	alist = pcap_nametoaddr(name);
6475	if (alist == NULL \|\| *alist == NULL)
6476	bpf_error(cstate, "unknown host '%s'", name);
6477	b = gen_gateway(cstate, eaddr, alist, proto, dir);
6478	free(eaddr);
6479	return b;
6480	#else
6481	bpf_error(cstate, "'gateway' not supported in this configuration");
6482	#endif /INET6/
6483
6484	case Q_PROTO:
6485	real_proto = lookup_proto(cstate, name, proto);
6486	if (real_proto >= 0)
6487	return gen_proto(cstate, real_proto, proto, dir);
6488	else
6489	bpf_error(cstate, "unknown protocol: %s", name);
6490
6491	case Q_PROTOCHAIN:
6492	real_proto = lookup_proto(cstate, name, proto);
6493	if (real_proto >= 0)
6494	return gen_protochain(cstate, real_proto, proto, dir);
6495	else
6496	bpf_error(cstate, "unknown protocol: %s", name);
6497
6498	case Q_UNDEF:
6499	syntax(cstate);
6500	/* NOTREACHED */
6501	}
6502	abort();
6503	/* NOTREACHED */
6504	}
6505
6506	struct block *
6507	gen_mcode(compiler_state_t cstate, const char s1, const char *s2,
6508	unsigned int masklen, struct qual q)
6509	{
6510	register int nlen, mlen;
6511	bpf_u_int32 n, m;
6512
6513	nlen = __pcap_atoin(s1, &n);
6514	/* Promote short ipaddr */
6515	n <<= 32 - nlen;
6516
6517	if (s2 != NULL) {
6518	mlen = __pcap_atoin(s2, &m);
6519	/* Promote short ipaddr */
6520	m <<= 32 - mlen;
6521	if ((n & ~m) != 0)
6522	bpf_error(cstate, "non-network bits set in \"%s mask %s\"",
6523	s1, s2);
6524	} else {
6525	/* Convert mask len to mask */
6526	if (masklen > 32)
6527	bpf_error(cstate, "mask length must be <= 32");
6528	if (masklen == 0) {
6529	/*
6530	* X << 32 is not guaranteed by C to be 0; it's
6531	* undefined.
6532	*/
6533	m = 0;
6534	} else
6535	m = 0xffffffff << (32 - masklen);
6536	if ((n & ~m) != 0)
6537	bpf_error(cstate, "non-network bits set in \"%s/%d\"",
6538	s1, masklen);
6539	}
6540
6541	switch (q.addr) {
6542
6543	case Q_NET:
6544	return gen_host(cstate, n, m, q.proto, q.dir, q.addr);
6545
6546	default:
6547	bpf_error(cstate, "Mask syntax for networks only");
6548	/* NOTREACHED */
6549	}
6550	/* NOTREACHED */
6551	return NULL;
6552	}
6553
6554	struct block *
6555	gen_ncode(compiler_state_t cstate, const char s, bpf_u_int32 v, struct qual q)
6556	{
6557	bpf_u_int32 mask;
6558	int proto = q.proto;
6559	int dir = q.dir;
6560	register int vlen;
6561
6562	if (s == NULL)
6563	vlen = 32;
6564	else if (q.proto == Q_DECNET) {
6565	vlen = __pcap_atodn(s, &v);
6566	if (vlen == 0)
6567	bpf_error(cstate, "malformed decnet address '%s'", s);
6568	} else
6569	vlen = __pcap_atoin(s, &v);
6570
6571	switch (q.addr) {
6572
6573	case Q_DEFAULT:
6574	case Q_HOST:
6575	case Q_NET:
6576	if (proto == Q_DECNET)
6577	return gen_host(cstate, v, 0, proto, dir, q.addr);
6578	else if (proto == Q_LINK) {
6579	bpf_error(cstate, "illegal link layer address");
6580	} else {
6581	mask = 0xffffffff;
6582	if (s == NULL && q.addr == Q_NET) {
6583	/* Promote short net number */
6584	while (v && (v & 0xff000000) == 0) {
6585	v <<= 8;
6586	mask <<= 8;
6587	}
6588	} else {
6589	/* Promote short ipaddr */
6590	v <<= 32 - vlen;
6591	mask <<= 32 - vlen ;
6592	}
6593	return gen_host(cstate, v, mask, proto, dir, q.addr);
6594	}
6595
6596	case Q_PORT:
6597	if (proto == Q_UDP)
6598	proto = IPPROTO_UDP;
6599	else if (proto == Q_TCP)
6600	proto = IPPROTO_TCP;
6601	else if (proto == Q_SCTP)
6602	proto = IPPROTO_SCTP;
6603	else if (proto == Q_DEFAULT)
6604	proto = PROTO_UNDEF;
6605	else
6606	bpf_error(cstate, "illegal qualifier of 'port'");
6607
6608	if (v > 65535)
6609	bpf_error(cstate, "illegal port number %u > 65535", v);
6610
6611	{
6612	struct block *b;
6613	b = gen_port(cstate, (int)v, proto, dir);
6614	gen_or(gen_port6(cstate, (int)v, proto, dir), b);
6615	return b;
6616	}
6617
6618	case Q_PORTRANGE:
6619	if (proto == Q_UDP)
6620	proto = IPPROTO_UDP;
6621	else if (proto == Q_TCP)
6622	proto = IPPROTO_TCP;
6623	else if (proto == Q_SCTP)
6624	proto = IPPROTO_SCTP;
6625	else if (proto == Q_DEFAULT)
6626	proto = PROTO_UNDEF;
6627	else
6628	bpf_error(cstate, "illegal qualifier of 'portrange'");
6629
6630	if (v > 65535)
6631	bpf_error(cstate, "illegal port number %u > 65535", v);
6632
6633	{
6634	struct block *b;
6635	b = gen_portrange(cstate, (int)v, (int)v, proto, dir);
6636	gen_or(gen_portrange6(cstate, (int)v, (int)v, proto, dir), b);
6637	return b;
6638	}
6639
6640	case Q_GATEWAY:
6641	bpf_error(cstate, "'gateway' requires a name");
6642	/* NOTREACHED */
6643
6644	case Q_PROTO:
6645	return gen_proto(cstate, (int)v, proto, dir);
6646
6647	case Q_PROTOCHAIN:
6648	return gen_protochain(cstate, (int)v, proto, dir);
6649
6650	case Q_UNDEF:
6651	syntax(cstate);
6652	/* NOTREACHED */
6653
6654	default:
6655	abort();
6656	/* NOTREACHED */
6657	}
6658	/* NOTREACHED */
6659	}
6660
6661	#ifdef INET6
6662	struct block *
6663	gen_mcode6(compiler_state_t cstate, const char s1, const char *s2,
6664	unsigned int masklen, struct qual q)
6665	{
6666	struct addrinfo *res;
6667	struct in6_addr *addr;
6668	struct in6_addr mask;
6669	struct block *b;
6670	u_int32_t a, m;
6671
6672	if (s2)
6673	bpf_error(cstate, "no mask %s supported", s2);
6674
6675	res = pcap_nametoaddrinfo(s1);
6676	if (!res)
6677	bpf_error(cstate, "invalid ip6 address %s", s1);
6678	cstate->ai = res;
6679	if (res->ai_next)
6680	bpf_error(cstate, "%s resolved to multiple address", s1);
6681	addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
6682
6683	if (sizeof(mask) * 8 < masklen)
6684	bpf_error(cstate, "mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
6685	memset(&mask, 0, sizeof(mask));
6686	memset(&mask, 0xff, masklen / 8);
6687	if (masklen % 8) {
6688	mask.s6_addr[masklen / 8] =
6689	(0xff << (8 - masklen % 8)) & 0xff;
6690	}
6691
6692	a = (u_int32_t *)addr;
6693	m = (u_int32_t *)&mask;
6694	if ((a[0] & ~m[0]) \|\| (a[1] & ~m[1])
6695	\|\| (a[2] & ~m[2]) \|\| (a[3] & ~m[3])) {
6696	bpf_error(cstate, "non-network bits set in \"%s/%d\"", s1, masklen);
6697	}
6698
6699	switch (q.addr) {
6700
6701	case Q_DEFAULT:
6702	case Q_HOST:
6703	if (masklen != 128)
6704	bpf_error(cstate, "Mask syntax for networks only");
6705	/* FALLTHROUGH */
6706
6707	case Q_NET:
6708	b = gen_host6(cstate, addr, &mask, q.proto, q.dir, q.addr);
6709	cstate->ai = NULL;
6710	freeaddrinfo(res);
6711	return b;
6712
6713	default:
6714	bpf_error(cstate, "invalid qualifier against IPv6 address");
6715	/* NOTREACHED */
6716	}
6717	return NULL;
6718	}
6719	#endif /INET6/
6720
6721	struct block *
6722	gen_ecode(compiler_state_t cstate, const u_char eaddr, struct qual q)
6723	{
6724	struct block b, tmp;
6725
6726	if ((q.addr == Q_HOST \|\| q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
6727	switch (cstate->linktype) {
6728	case DLT_EN10MB:
6729	case DLT_NETANALYZER:
6730	case DLT_NETANALYZER_TRANSPARENT:
6731	tmp = gen_prevlinkhdr_check(cstate);
6732	b = gen_ehostop(cstate, eaddr, (int)q.dir);
6733	if (tmp != NULL)
6734	gen_and(tmp, b);
6735	return b;
6736	case DLT_FDDI:
6737	return gen_fhostop(cstate, eaddr, (int)q.dir);
6738	case DLT_IEEE802:
6739	return gen_thostop(cstate, eaddr, (int)q.dir);
6740	case DLT_IEEE802_11:
6741	case DLT_PRISM_HEADER:
6742	case DLT_IEEE802_11_RADIO_AVS:
6743	case DLT_IEEE802_11_RADIO:
6744	case DLT_PPI:
6745	return gen_wlanhostop(cstate, eaddr, (int)q.dir);
6746	case DLT_IP_OVER_FC:
6747	return gen_ipfchostop(cstate, eaddr, (int)q.dir);
6748	default:
6749	bpf_error(cstate, "ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
6750	break;
6751	}
6752	}
6753	bpf_error(cstate, "ethernet address used in non-ether expression");
6754	/* NOTREACHED */
6755	return NULL;
6756	}
6757
6758	void
6759	sappend(s0, s1)
6760	struct slist s0, s1;
6761	{
6762	/*
6763	* This is definitely not the best way to do this, but the
6764	* lists will rarely get long.
6765	*/
6766	while (s0->next)
6767	s0 = s0->next;
6768	s0->next = s1;
6769	}
6770
6771	static struct slist *
6772	xfer_to_x(compiler_state_t cstate, struct arth a)
6773	{
6774	struct slist *s;
6775
6776	s = new_stmt(cstate, BPF_LDX\|BPF_MEM);
6777	s->s.k = a->regno;
6778	return s;
6779	}
6780
6781	static struct slist *
6782	xfer_to_a(compiler_state_t cstate, struct arth a)
6783	{
6784	struct slist *s;
6785
6786	s = new_stmt(cstate, BPF_LD\|BPF_MEM);
6787	s->s.k = a->regno;
6788	return s;
6789	}
6790
6791	/*
6792	* Modify "index" to use the value stored into its register as an
6793	* offset relative to the beginning of the header for the protocol
6794	* "proto", and allocate a register and put an item "size" bytes long
6795	* (1, 2, or 4) at that offset into that register, making it the register
6796	* for "index".
6797	*/
6798	struct arth *
6799	gen_load(compiler_state_t cstate, int proto, struct arth inst, int size)
6800	{
6801	struct slist s, tmp;
6802	struct block *b;
6803	int regno = alloc_reg(cstate);
6804
6805	free_reg(cstate, inst->regno);
6806	switch (size) {
6807
6808	default:
6809	bpf_error(cstate, "data size must be 1, 2, or 4");
6810
6811	case 1:
6812	size = BPF_B;
6813	break;
6814
6815	case 2:
6816	size = BPF_H;
6817	break;
6818
6819	case 4:
6820	size = BPF_W;
6821	break;
6822	}
6823	switch (proto) {
6824	default:
6825	bpf_error(cstate, "unsupported index operation");
6826
6827	case Q_RADIO:
6828	/*
6829	* The offset is relative to the beginning of the packet
6830	* data, if we have a radio header. (If we don't, this
6831	* is an error.)
6832	*/
6833	if (cstate->linktype != DLT_IEEE802_11_RADIO_AVS &&
6834	cstate->linktype != DLT_IEEE802_11_RADIO &&
6835	cstate->linktype != DLT_PRISM_HEADER)
6836	bpf_error(cstate, "radio information not present in capture");
6837
6838	/*
6839	* Load into the X register the offset computed into the
6840	* register specified by "index".
6841	*/
6842	s = xfer_to_x(cstate, inst);
6843
6844	/*
6845	* Load the item at that offset.
6846	*/
6847	tmp = new_stmt(cstate, BPF_LD\|BPF_IND\|size);
6848	sappend(s, tmp);
6849	sappend(inst->s, s);
6850	break;
6851
6852	case Q_LINK:
6853	/*
6854	* The offset is relative to the beginning of
6855	* the link-layer header.
6856	*
6857	* XXX - what about ATM LANE? Should the index be
6858	* relative to the beginning of the AAL5 frame, so
6859	* that 0 refers to the beginning of the LE Control
6860	* field, or relative to the beginning of the LAN
6861	* frame, so that 0 refers, for Ethernet LANE, to
6862	* the beginning of the destination address?
6863	*/
6864	s = gen_abs_offset_varpart(cstate, &cstate->off_linkhdr);
6865
6866	/*
6867	* If "s" is non-null, it has code to arrange that the
6868	* X register contains the length of the prefix preceding
6869	* the link-layer header. Add to it the offset computed
6870	* into the register specified by "index", and move that
6871	* into the X register. Otherwise, just load into the X
6872	* register the offset computed into the register specified
6873	* by "index".
6874	*/
6875	if (s != NULL) {
6876	sappend(s, xfer_to_a(cstate, inst));
6877	sappend(s, new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X));
6878	sappend(s, new_stmt(cstate, BPF_MISC\|BPF_TAX));
6879	} else
6880	s = xfer_to_x(cstate, inst);
6881
6882	/*
6883	* Load the item at the sum of the offset we've put in the
6884	* X register and the offset of the start of the link
6885	* layer header (which is 0 if the radio header is
6886	* variable-length; that header length is what we put
6887	* into the X register and then added to the index).
6888	*/
6889	tmp = new_stmt(cstate, BPF_LD\|BPF_IND\|size);
6890	tmp->s.k = cstate->off_linkhdr.constant_part;
6891	sappend(s, tmp);
6892	sappend(inst->s, s);
6893	break;
6894
6895	case Q_IP:
6896	case Q_ARP:
6897	case Q_RARP:
6898	case Q_ATALK:
6899	case Q_DECNET:
6900	case Q_SCA:
6901	case Q_LAT:
6902	case Q_MOPRC:
6903	case Q_MOPDL:
6904	case Q_IPV6:
6905	/*
6906	* The offset is relative to the beginning of
6907	* the network-layer header.
6908	* XXX - are there any cases where we want
6909	* cstate->off_nl_nosnap?
6910	*/
6911	s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl);
6912
6913	/*
6914	* If "s" is non-null, it has code to arrange that the
6915	* X register contains the variable part of the offset
6916	* of the link-layer payload. Add to it the offset
6917	* computed into the register specified by "index",
6918	* and move that into the X register. Otherwise, just
6919	* load into the X register the offset computed into
6920	* the register specified by "index".
6921	*/
6922	if (s != NULL) {
6923	sappend(s, xfer_to_a(cstate, inst));
6924	sappend(s, new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X));
6925	sappend(s, new_stmt(cstate, BPF_MISC\|BPF_TAX));
6926	} else
6927	s = xfer_to_x(cstate, inst);
6928
6929	/*
6930	* Load the item at the sum of the offset we've put in the
6931	* X register, the offset of the start of the network
6932	* layer header from the beginning of the link-layer
6933	* payload, and the constant part of the offset of the
6934	* start of the link-layer payload.
6935	*/
6936	tmp = new_stmt(cstate, BPF_LD\|BPF_IND\|size);
6937	tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
6938	sappend(s, tmp);
6939	sappend(inst->s, s);
6940
6941	/*
6942	* Do the computation only if the packet contains
6943	* the protocol in question.
6944	*/
6945	b = gen_proto_abbrev(cstate, proto);
6946	if (inst->b)
6947	gen_and(inst->b, b);
6948	inst->b = b;
6949	break;
6950
6951	case Q_SCTP:
6952	case Q_TCP:
6953	case Q_UDP:
6954	case Q_ICMP:
6955	case Q_IGMP:
6956	case Q_IGRP:
6957	case Q_PIM:
6958	case Q_VRRP:
6959	case Q_CARP:
6960	/*
6961	* The offset is relative to the beginning of
6962	* the transport-layer header.
6963	*
6964	* Load the X register with the length of the IPv4 header
6965	* (plus the offset of the link-layer header, if it's
6966	* a variable-length header), in bytes.
6967	*
6968	* XXX - are there any cases where we want
6969	* cstate->off_nl_nosnap?
6970	* XXX - we should, if we're built with
6971	* IPv6 support, generate code to load either
6972	* IPv4, IPv6, or both, as appropriate.
6973	*/
6974	s = gen_loadx_iphdrlen(cstate);
6975
6976	/*
6977	* The X register now contains the sum of the variable
6978	* part of the offset of the link-layer payload and the
6979	* length of the network-layer header.
6980	*
6981	* Load into the A register the offset relative to
6982	* the beginning of the transport layer header,
6983	* add the X register to that, move that to the
6984	* X register, and load with an offset from the
6985	* X register equal to the sum of the constant part of
6986	* the offset of the link-layer payload and the offset,
6987	* relative to the beginning of the link-layer payload,
6988	* of the network-layer header.
6989	*/
6990	sappend(s, xfer_to_a(cstate, inst));
6991	sappend(s, new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X));
6992	sappend(s, new_stmt(cstate, BPF_MISC\|BPF_TAX));
6993	sappend(s, tmp = new_stmt(cstate, BPF_LD\|BPF_IND\|size));
6994	tmp->s.k = cstate->off_linkpl.constant_part + cstate->off_nl;
6995	sappend(inst->s, s);
6996
6997	/*
6998	* Do the computation only if the packet contains
6999	* the protocol in question - which is true only
7000	* if this is an IP datagram and is the first or
7001	* only fragment of that datagram.
7002	*/
7003	gen_and(gen_proto_abbrev(cstate, proto), b = gen_ipfrag(cstate));
7004	if (inst->b)
7005	gen_and(inst->b, b);
7006	gen_and(gen_proto_abbrev(cstate, Q_IP), b);
7007	inst->b = b;
7008	break;
7009	case Q_ICMPV6:
7010	bpf_error(cstate, "IPv6 upper-layer protocol is not supported by proto[x]");
7011	/NOTREACHED/
7012	}
7013	inst->regno = regno;
7014	s = new_stmt(cstate, BPF_ST);
7015	s->s.k = regno;
7016	sappend(inst->s, s);
7017
7018	return inst;
7019	}
7020
7021	struct block *
7022	gen_relation(compiler_state_t cstate, int code, struct arth a0,
7023	struct arth *a1, int reversed)
7024	{
7025	struct slist s0, s1, *s2;
7026	struct block b, tmp;
7027
7028	s0 = xfer_to_x(cstate, a1);
7029	s1 = xfer_to_a(cstate, a0);
7030	if (code == BPF_JEQ) {
7031	s2 = new_stmt(cstate, BPF_ALU\|BPF_SUB\|BPF_X);
7032	b = new_block(cstate, JMP(code));
7033	sappend(s1, s2);
7034	}
7035	else
7036	b = new_block(cstate, BPF_JMP\|code\|BPF_X);
7037	if (reversed)
7038	gen_not(b);
7039
7040	sappend(s0, s1);
7041	sappend(a1->s, s0);
7042	sappend(a0->s, a1->s);
7043
7044	b->stmts = a0->s;
7045
7046	free_reg(cstate, a0->regno);
7047	free_reg(cstate, a1->regno);
7048
7049	/* 'and' together protocol checks */
7050	if (a0->b) {
7051	if (a1->b) {
7052	gen_and(a0->b, tmp = a1->b);
7053	}
7054	else
7055	tmp = a0->b;
7056	} else
7057	tmp = a1->b;
7058
7059	if (tmp)
7060	gen_and(tmp, b);
7061
7062	return b;
7063	}
7064
7065	struct arth *
7066	gen_loadlen(compiler_state_t *cstate)
7067	{
7068	int regno = alloc_reg(cstate);
7069	struct arth a = (struct arth )newchunk(cstate, sizeof(*a));
7070	struct slist *s;
7071
7072	s = new_stmt(cstate, BPF_LD\|BPF_LEN);
7073	s->next = new_stmt(cstate, BPF_ST);
7074	s->next->s.k = regno;
7075	a->s = s;
7076	a->regno = regno;
7077
7078	return a;
7079	}
7080
7081	struct arth *
7082	gen_loadi(compiler_state_t *cstate, int val)
7083	{
7084	struct arth *a;
7085	struct slist *s;
7086	int reg;
7087
7088	a = (struct arth )newchunk(cstate, sizeof(a));
7089
7090	reg = alloc_reg(cstate);
7091
7092	s = new_stmt(cstate, BPF_LD\|BPF_IMM);
7093	s->s.k = val;
7094	s->next = new_stmt(cstate, BPF_ST);
7095	s->next->s.k = reg;
7096	a->s = s;
7097	a->regno = reg;
7098
7099	return a;
7100	}
7101
7102	struct arth *
7103	gen_neg(compiler_state_t cstate, struct arth a)
7104	{
7105	struct slist *s;
7106
7107	s = xfer_to_a(cstate, a);
7108	sappend(a->s, s);
7109	s = new_stmt(cstate, BPF_ALU\|BPF_NEG);
7110	s->s.k = 0;
7111	sappend(a->s, s);
7112	s = new_stmt(cstate, BPF_ST);
7113	s->s.k = a->regno;
7114	sappend(a->s, s);
7115
7116	return a;
7117	}
7118
7119	struct arth *
7120	gen_arth(compiler_state_t cstate, int code, struct arth a0,
7121	struct arth *a1)
7122	{
7123	struct slist s0, s1, *s2;
7124
7125	/*
7126	* Disallow division by, or modulus by, zero; we do this here
7127	* so that it gets done even if the optimizer is disabled.
7128	*/
7129	if (code == BPF_DIV) {
7130	if (a1->s->s.code == (BPF_LD\|BPF_IMM) && a1->s->s.k == 0)
7131	bpf_error(cstate, "division by zero");
7132	} else if (code == BPF_MOD) {
7133	if (a1->s->s.code == (BPF_LD\|BPF_IMM) && a1->s->s.k == 0)
7134	bpf_error(cstate, "modulus by zero");
7135	}
7136	s0 = xfer_to_x(cstate, a1);
7137	s1 = xfer_to_a(cstate, a0);
7138	s2 = new_stmt(cstate, BPF_ALU\|BPF_X\|code);
7139
7140	sappend(s1, s2);
7141	sappend(s0, s1);
7142	sappend(a1->s, s0);
7143	sappend(a0->s, a1->s);
7144
7145	free_reg(cstate, a0->regno);
7146	free_reg(cstate, a1->regno);
7147
7148	s0 = new_stmt(cstate, BPF_ST);
7149	a0->regno = s0->s.k = alloc_reg(cstate);
7150	sappend(a0->s, s0);
7151
7152	return a0;
7153	}
7154
7155	/*
7156	* Initialize the table of used registers and the current register.
7157	*/
7158	static void
7159	init_regs(compiler_state_t *cstate)
7160	{
7161	cstate->curreg = 0;
7162	memset(cstate->regused, 0, sizeof cstate->regused);
7163	}
7164
7165	/*
7166	* Return the next free register.
7167	*/
7168	static int
7169	alloc_reg(compiler_state_t *cstate)
7170	{
7171	int n = BPF_MEMWORDS;
7172
7173	while (--n >= 0) {
7174	if (cstate->regused[cstate->curreg])
7175	cstate->curreg = (cstate->curreg + 1) % BPF_MEMWORDS;
7176	else {
7177	cstate->regused[cstate->curreg] = 1;
7178	return cstate->curreg;
7179	}
7180	}
7181	bpf_error(cstate, "too many registers needed to evaluate expression");
7182	/* NOTREACHED */
7183	return 0;
7184	}
7185
7186	/*
7187	* Return a register to the table so it can
7188	* be used later.
7189	*/
7190	static void
7191	free_reg(compiler_state_t *cstate, int n)
7192	{
7193	cstate->regused[n] = 0;
7194	}
7195
7196	static struct block *
7197	gen_len(compiler_state_t *cstate, int jmp, int n)
7198	{
7199	struct slist *s;
7200	struct block *b;
7201
7202	s = new_stmt(cstate, BPF_LD\|BPF_LEN);
7203	b = new_block(cstate, JMP(jmp));
7204	b->stmts = s;
7205	b->s.k = n;
7206
7207	return b;
7208	}
7209
7210	struct block *
7211	gen_greater(compiler_state_t *cstate, int n)
7212	{
7213	return gen_len(cstate, BPF_JGE, n);
7214	}
7215
7216	/*
7217	* Actually, this is less than or equal.
7218	*/
7219	struct block *
7220	gen_less(compiler_state_t *cstate, int n)
7221	{
7222	struct block *b;
7223
7224	b = gen_len(cstate, BPF_JGT, n);
7225	gen_not(b);
7226
7227	return b;
7228	}
7229
7230	/*
7231	* This is for "byte {idx} {op} {val}"; "idx" is treated as relative to
7232	* the beginning of the link-layer header.
7233	* XXX - that means you can't test values in the radiotap header, but
7234	* as that header is difficult if not impossible to parse generally
7235	* without a loop, that might not be a severe problem. A new keyword
7236	* "radio" could be added for that, although what you'd really want
7237	* would be a way of testing particular radio header values, which
7238	* would generate code appropriate to the radio header in question.
7239	*/
7240	struct block *
7241	gen_byteop(compiler_state_t *cstate, int op, int idx, int val)
7242	{
7243	struct block *b;
7244	struct slist *s;
7245
7246	switch (op) {
7247	default:
7248	abort();
7249
7250	case '=':
7251	return gen_cmp(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val);
7252
7253	case '<':
7254	b = gen_cmp_lt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val);
7255	return b;
7256
7257	case '>':
7258	b = gen_cmp_gt(cstate, OR_LINKHDR, (u_int)idx, BPF_B, (bpf_int32)val);
7259	return b;
7260
7261	case '\|':
7262	s = new_stmt(cstate, BPF_ALU\|BPF_OR\|BPF_K);
7263	break;
7264
7265	case '&':
7266	s = new_stmt(cstate, BPF_ALU\|BPF_AND\|BPF_K);
7267	break;
7268	}
7269	s->s.k = val;
7270	b = new_block(cstate, JMP(BPF_JEQ));
7271	b->stmts = s;
7272	gen_not(b);
7273
7274	return b;
7275	}
7276
7277	static const u_char abroadcast[] = { 0x0 };
7278
7279	struct block *
7280	gen_broadcast(compiler_state_t *cstate, int proto)
7281	{
7282	bpf_u_int32 hostmask;
7283	struct block b0, b1, *b2;
7284	static const u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
7285
7286	switch (proto) {
7287
7288	case Q_DEFAULT:
7289	case Q_LINK:
7290	switch (cstate->linktype) {
7291	case DLT_ARCNET:
7292	case DLT_ARCNET_LINUX:
7293	return gen_ahostop(cstate, abroadcast, Q_DST);
7294	case DLT_EN10MB:
7295	case DLT_NETANALYZER:
7296	case DLT_NETANALYZER_TRANSPARENT:
7297	b1 = gen_prevlinkhdr_check(cstate);
7298	b0 = gen_ehostop(cstate, ebroadcast, Q_DST);
7299	if (b1 != NULL)
7300	gen_and(b1, b0);
7301	return b0;
7302	case DLT_FDDI:
7303	return gen_fhostop(cstate, ebroadcast, Q_DST);
7304	case DLT_IEEE802:
7305	return gen_thostop(cstate, ebroadcast, Q_DST);
7306	case DLT_IEEE802_11:
7307	case DLT_PRISM_HEADER:
7308	case DLT_IEEE802_11_RADIO_AVS:
7309	case DLT_IEEE802_11_RADIO:
7310	case DLT_PPI:
7311	return gen_wlanhostop(cstate, ebroadcast, Q_DST);
7312	case DLT_IP_OVER_FC:
7313	return gen_ipfchostop(cstate, ebroadcast, Q_DST);
7314	default:
7315	bpf_error(cstate, "not a broadcast link");
7316	}
7317	break;
7318
7319	case Q_IP:
7320	/*
7321	* We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff)
7322	* as an indication that we don't know the netmask, and fail
7323	* in that case.
7324	*/
7325	if (cstate->netmask == PCAP_NETMASK_UNKNOWN)
7326	bpf_error(cstate, "netmask not known, so 'ip broadcast' not supported");
7327	b0 = gen_linktype(cstate, ETHERTYPE_IP);
7328	hostmask = ~cstate->netmask;
7329	b1 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W, (bpf_int32)0, hostmask);
7330	b2 = gen_mcmp(cstate, OR_LINKPL, 16, BPF_W,
7331	(bpf_int32)(~0 & hostmask), hostmask);
7332	gen_or(b1, b2);
7333	gen_and(b0, b2);
7334	return b2;
7335	}
7336	bpf_error(cstate, "only link-layer/IP broadcast filters supported");
7337	/* NOTREACHED */
7338	return NULL;
7339	}
7340
7341	/*
7342	* Generate code to test the low-order bit of a MAC address (that's
7343	* the bottom bit of the first byte).
7344	*/
7345	static struct block *
7346	gen_mac_multicast(compiler_state_t *cstate, int offset)
7347	{
7348	register struct block *b0;
7349	register struct slist *s;
7350
7351	/* link[offset] & 1 != 0 */
7352	s = gen_load_a(cstate, OR_LINKHDR, offset, BPF_B);
7353	b0 = new_block(cstate, JMP(BPF_JSET));
7354	b0->s.k = 1;
7355	b0->stmts = s;
7356	return b0;
7357	}
7358
7359	struct block *
7360	gen_multicast(compiler_state_t *cstate, int proto)
7361	{
7362	register struct block b0, b1, *b2;
7363	register struct slist *s;
7364
7365	switch (proto) {
7366
7367	case Q_DEFAULT:
7368	case Q_LINK:
7369	switch (cstate->linktype) {
7370	case DLT_ARCNET:
7371	case DLT_ARCNET_LINUX:
7372	/* all ARCnet multicasts use the same address */
7373	return gen_ahostop(cstate, abroadcast, Q_DST);
7374	case DLT_EN10MB:
7375	case DLT_NETANALYZER:
7376	case DLT_NETANALYZER_TRANSPARENT:
7377	b1 = gen_prevlinkhdr_check(cstate);
7378	/* ether[0] & 1 != 0 */
7379	b0 = gen_mac_multicast(cstate, 0);
7380	if (b1 != NULL)
7381	gen_and(b1, b0);
7382	return b0;
7383	case DLT_FDDI:
7384	/*
7385	* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
7386	*
7387	* XXX - was that referring to bit-order issues?
7388	*/
7389	/* fddi[1] & 1 != 0 */
7390	return gen_mac_multicast(cstate, 1);
7391	case DLT_IEEE802:
7392	/* tr[2] & 1 != 0 */
7393	return gen_mac_multicast(cstate, 2);
7394	case DLT_IEEE802_11:
7395	case DLT_PRISM_HEADER:
7396	case DLT_IEEE802_11_RADIO_AVS:
7397	case DLT_IEEE802_11_RADIO:
7398	case DLT_PPI:
7399	/*
7400	* Oh, yuk.
7401	*
7402	* For control frames, there is no DA.
7403	*
7404	* For management frames, DA is at an
7405	* offset of 4 from the beginning of
7406	* the packet.
7407	*
7408	* For data frames, DA is at an offset
7409	* of 4 from the beginning of the packet
7410	* if To DS is clear and at an offset of
7411	* 16 from the beginning of the packet
7412	* if To DS is set.
7413	*/
7414
7415	/*
7416	* Generate the tests to be done for data frames.
7417	*
7418	* First, check for To DS set, i.e. "link[1] & 0x01".
7419	*/
7420	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
7421	b1 = new_block(cstate, JMP(BPF_JSET));
7422	b1->s.k = 0x01; /* To DS */
7423	b1->stmts = s;
7424
7425	/*
7426	* If To DS is set, the DA is at 16.
7427	*/
7428	b0 = gen_mac_multicast(cstate, 16);
7429	gen_and(b1, b0);
7430
7431	/*
7432	* Now, check for To DS not set, i.e. check
7433	* "!(link[1] & 0x01)".
7434	*/
7435	s = gen_load_a(cstate, OR_LINKHDR, 1, BPF_B);
7436	b2 = new_block(cstate, JMP(BPF_JSET));
7437	b2->s.k = 0x01; /* To DS */
7438	b2->stmts = s;
7439	gen_not(b2);
7440
7441	/*
7442	* If To DS is not set, the DA is at 4.
7443	*/
7444	b1 = gen_mac_multicast(cstate, 4);
7445	gen_and(b2, b1);
7446
7447	/*
7448	* Now OR together the last two checks. That gives
7449	* the complete set of checks for data frames.
7450	*/
7451	gen_or(b1, b0);
7452
7453	/*
7454	* Now check for a data frame.
7455	* I.e, check "link[0] & 0x08".
7456	*/
7457	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
7458	b1 = new_block(cstate, JMP(BPF_JSET));
7459	b1->s.k = 0x08;
7460	b1->stmts = s;
7461
7462	/*
7463	* AND that with the checks done for data frames.
7464	*/
7465	gen_and(b1, b0);
7466
7467	/*
7468	* If the high-order bit of the type value is 0, this
7469	* is a management frame.
7470	* I.e, check "!(link[0] & 0x08)".
7471	*/
7472	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
7473	b2 = new_block(cstate, JMP(BPF_JSET));
7474	b2->s.k = 0x08;
7475	b2->stmts = s;
7476	gen_not(b2);
7477
7478	/*
7479	* For management frames, the DA is at 4.
7480	*/
7481	b1 = gen_mac_multicast(cstate, 4);
7482	gen_and(b2, b1);
7483
7484	/*
7485	* OR that with the checks done for data frames.
7486	* That gives the checks done for management and
7487	* data frames.
7488	*/
7489	gen_or(b1, b0);
7490
7491	/*
7492	* If the low-order bit of the type value is 1,
7493	* this is either a control frame or a frame
7494	* with a reserved type, and thus not a
7495	* frame with an SA.
7496	*
7497	* I.e., check "!(link[0] & 0x04)".
7498	*/
7499	s = gen_load_a(cstate, OR_LINKHDR, 0, BPF_B);
7500	b1 = new_block(cstate, JMP(BPF_JSET));
7501	b1->s.k = 0x04;
7502	b1->stmts = s;
7503	gen_not(b1);
7504
7505	/*
7506	* AND that with the checks for data and management
7507	* frames.
7508	*/
7509	gen_and(b1, b0);
7510	return b0;
7511	case DLT_IP_OVER_FC:
7512	b0 = gen_mac_multicast(cstate, 2);
7513	return b0;
7514	default:
7515	break;
7516	}
7517	/* Link not known to support multicasts */
7518	break;
7519
7520	case Q_IP:
7521	b0 = gen_linktype(cstate, ETHERTYPE_IP);
7522	b1 = gen_cmp_ge(cstate, OR_LINKPL, 16, BPF_B, (bpf_int32)224);
7523	gen_and(b0, b1);
7524	return b1;
7525
7526	case Q_IPV6:
7527	b0 = gen_linktype(cstate, ETHERTYPE_IPV6);
7528	b1 = gen_cmp(cstate, OR_LINKPL, 24, BPF_B, (bpf_int32)255);
7529	gen_and(b0, b1);
7530	return b1;
7531	}
7532	bpf_error(cstate, "link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel");
7533	/* NOTREACHED */
7534	return NULL;
7535	}
7536
7537	/*
7538	* Filter on inbound (dir == 0) or outbound (dir == 1) traffic.
7539	* Outbound traffic is sent by this machine, while inbound traffic is
7540	* sent by a remote machine (and may include packets destined for a
7541	* unicast or multicast link-layer address we are not subscribing to).
7542	* These are the same definitions implemented by pcap_setdirection().
7543	* Capturing only unicast traffic destined for this host is probably
7544	* better accomplished using a higher-layer filter.
7545	*/
7546	struct block *
7547	gen_inbound(compiler_state_t *cstate, int dir)
7548	{
7549	register struct block *b0;
7550
7551	/*
7552	* Only some data link types support inbound/outbound qualifiers.
7553	*/
7554	switch (cstate->linktype) {
7555	case DLT_SLIP:
7556	b0 = gen_relation(cstate, BPF_JEQ,
7557	gen_load(cstate, Q_LINK, gen_loadi(cstate, 0), 1),
7558	gen_loadi(cstate, 0),
7559	dir);
7560	break;
7561
7562	case DLT_IPNET:
7563	if (dir) {
7564	/* match outgoing packets */
7565	b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, IPNET_OUTBOUND);
7566	} else {
7567	/* match incoming packets */
7568	b0 = gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, IPNET_INBOUND);
7569	}
7570	break;
7571
7572	case DLT_LINUX_SLL:
7573	/* match outgoing packets */
7574	b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_H, LINUX_SLL_OUTGOING);
7575	if (!dir) {
7576	/* to filter on inbound traffic, invert the match */
7577	gen_not(b0);
7578	}
7579	break;
7580
7581	#ifdef HAVE_NET_PFVAR_H
7582	case DLT_PFLOG:
7583	b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, dir), BPF_B,
7584	(bpf_int32)((dir == 0) ? PF_IN : PF_OUT));
7585	break;
7586	#endif
7587
7588	case DLT_PPP_PPPD:
7589	if (dir) {
7590	/* match outgoing packets */
7591	b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_B, PPP_PPPD_OUT);
7592	} else {
7593	/* match incoming packets */
7594	b0 = gen_cmp(cstate, OR_LINKHDR, 0, BPF_B, PPP_PPPD_IN);
7595	}
7596	break;
7597
7598	case DLT_JUNIPER_MFR:
7599	case DLT_JUNIPER_MLFR:
7600	case DLT_JUNIPER_MLPPP:
7601	case DLT_JUNIPER_ATM1:
7602	case DLT_JUNIPER_ATM2:
7603	case DLT_JUNIPER_PPPOE:
7604	case DLT_JUNIPER_PPPOE_ATM:
7605	case DLT_JUNIPER_GGSN:
7606	case DLT_JUNIPER_ES:
7607	case DLT_JUNIPER_MONITOR:
7608	case DLT_JUNIPER_SERVICES:
7609	case DLT_JUNIPER_ETHER:
7610	case DLT_JUNIPER_PPP:
7611	case DLT_JUNIPER_FRELAY:
7612	case DLT_JUNIPER_CHDLC:
7613	case DLT_JUNIPER_VP:
7614	case DLT_JUNIPER_ST:
7615	case DLT_JUNIPER_ISM:
7616	case DLT_JUNIPER_VS:
7617	case DLT_JUNIPER_SRX_E2E:
7618	case DLT_JUNIPER_FIBRECHANNEL:
7619	case DLT_JUNIPER_ATM_CEMIC:
7620
7621	/* juniper flags (including direction) are stored
7622	* the byte after the 3-byte magic number */
7623	if (dir) {
7624	/* match outgoing packets */
7625	b0 = gen_mcmp(cstate, OR_LINKHDR, 3, BPF_B, 0, 0x01);
7626	} else {
7627	/* match incoming packets */
7628	b0 = gen_mcmp(cstate, OR_LINKHDR, 3, BPF_B, 1, 0x01);
7629	}
7630	break;
7631
7632	default:
7633	/*
7634	* If we have packet meta-data indicating a direction,
7635	* check it, otherwise give up as this link-layer type
7636	* has nothing in the packet data.
7637	*/
7638	#if defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER)
7639	/*
7640	* This is Linux with PF_PACKET support.
7641	* If this is a live capture, we can look at
7642	* special meta-data in the filter expression;
7643	* if it's a savefile, we can't.
7644	*/
7645	if (cstate->bpf_pcap->rfile != NULL) {
7646	/* We have a FILE , so this is a savefile /
7647	bpf_error(cstate, "inbound/outbound not supported on linktype %d when reading savefiles",
7648	cstate->linktype);
7649	b0 = NULL;
7650	/* NOTREACHED */
7651	}
7652	/* match outgoing packets */
7653	b0 = gen_cmp(cstate, OR_LINKHDR, SKF_AD_OFF + SKF_AD_PKTTYPE, BPF_H,
7654	PACKET_OUTGOING);
7655	if (!dir) {
7656	/* to filter on inbound traffic, invert the match */
7657	gen_not(b0);
7658	}
7659	#else /* defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */
7660	bpf_error(cstate, "inbound/outbound not supported on linktype %d",
7661	cstate->linktype);
7662	b0 = NULL;
7663	/* NOTREACHED */
7664	#endif /* defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */
7665	}
7666	return (b0);
7667	}
7668
7669	#ifdef HAVE_NET_PFVAR_H
7670	/* PF firewall log matched interface */
7671	struct block *
7672	gen_pf_ifname(compiler_state_t cstate, const char ifname)
7673	{
7674	struct block *b0;
7675	u_int len, off;
7676
7677	if (cstate->linktype != DLT_PFLOG) {
7678	bpf_error(cstate, "ifname supported only on PF linktype");
7679	/* NOTREACHED */
7680	}
7681	len = sizeof(((struct pfloghdr *)0)->ifname);
7682	off = offsetof(struct pfloghdr, ifname);
7683	if (strlen(ifname) >= len) {
7684	bpf_error(cstate, "ifname interface names can only be %d characters",
7685	len-1);
7686	/* NOTREACHED */
7687	}
7688	b0 = gen_bcmp(cstate, OR_LINKHDR, off, strlen(ifname), (const u_char *)ifname);
7689	return (b0);
7690	}
7691
7692	/* PF firewall log ruleset name */
7693	struct block *
7694	gen_pf_ruleset(compiler_state_t cstate, char ruleset)
7695	{
7696	struct block *b0;
7697
7698	if (cstate->linktype != DLT_PFLOG) {
7699	bpf_error(cstate, "ruleset supported only on PF linktype");
7700	/* NOTREACHED */
7701	}
7702
7703	if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) {
7704	bpf_error(cstate, "ruleset names can only be %ld characters",
7705	(long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1));
7706	/* NOTREACHED */
7707	}
7708
7709	b0 = gen_bcmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, ruleset),
7710	strlen(ruleset), (const u_char *)ruleset);
7711	return (b0);
7712	}
7713
7714	/* PF firewall log rule number */
7715	struct block *
7716	gen_pf_rnr(compiler_state_t *cstate, int rnr)
7717	{
7718	struct block *b0;
7719
7720	if (cstate->linktype != DLT_PFLOG) {
7721	bpf_error(cstate, "rnr supported only on PF linktype");
7722	/* NOTREACHED */
7723	}
7724
7725	b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, rulenr), BPF_W,
7726	(bpf_int32)rnr);
7727	return (b0);
7728	}
7729
7730	/* PF firewall log sub-rule number */
7731	struct block *
7732	gen_pf_srnr(compiler_state_t *cstate, int srnr)
7733	{
7734	struct block *b0;
7735
7736	if (cstate->linktype != DLT_PFLOG) {
7737	bpf_error(cstate, "srnr supported only on PF linktype");
7738	/* NOTREACHED */
7739	}
7740
7741	b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, subrulenr), BPF_W,
7742	(bpf_int32)srnr);
7743	return (b0);
7744	}
7745
7746	/* PF firewall log reason code */
7747	struct block *
7748	gen_pf_reason(compiler_state_t *cstate, int reason)
7749	{
7750	struct block *b0;
7751
7752	if (cstate->linktype != DLT_PFLOG) {
7753	bpf_error(cstate, "reason supported only on PF linktype");
7754	/* NOTREACHED */
7755	}
7756
7757	b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, reason), BPF_B,
7758	(bpf_int32)reason);
7759	return (b0);
7760	}
7761
7762	/* PF firewall log action */
7763	struct block *
7764	gen_pf_action(compiler_state_t *cstate, int action)
7765	{
7766	struct block *b0;
7767
7768	if (cstate->linktype != DLT_PFLOG) {
7769	bpf_error(cstate, "action supported only on PF linktype");
7770	/* NOTREACHED */
7771	}
7772
7773	b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, action), BPF_B,
7774	(bpf_int32)action);
7775	return (b0);
7776	}
7777	#else /* !HAVE_NET_PFVAR_H */
7778	struct block *
7779	gen_pf_ifname(compiler_state_t cstate, const char ifname)
7780	{
7781	bpf_error(cstate, "libpcap was compiled without pf support");
7782	/* NOTREACHED */
7783	return (NULL);
7784	}
7785
7786	struct block *
7787	gen_pf_ruleset(compiler_state_t cstate, char ruleset)
7788	{
7789	bpf_error(cstate, "libpcap was compiled on a machine without pf support");
7790	/* NOTREACHED */
7791	return (NULL);
7792	}
7793
7794	struct block *
7795	gen_pf_rnr(compiler_state_t *cstate, int rnr)
7796	{
7797	bpf_error(cstate, "libpcap was compiled on a machine without pf support");
7798	/* NOTREACHED */
7799	return (NULL);
7800	}
7801
7802	struct block *
7803	gen_pf_srnr(compiler_state_t *cstate, int srnr)
7804	{
7805	bpf_error(cstate, "libpcap was compiled on a machine without pf support");
7806	/* NOTREACHED */
7807	return (NULL);
7808	}
7809
7810	struct block *
7811	gen_pf_reason(compiler_state_t *cstate, int reason)
7812	{
7813	bpf_error(cstate, "libpcap was compiled on a machine without pf support");
7814	/* NOTREACHED */
7815	return (NULL);
7816	}
7817
7818	struct block *
7819	gen_pf_action(compiler_state_t *cstate, int action)
7820	{
7821	bpf_error(cstate, "libpcap was compiled on a machine without pf support");
7822	/* NOTREACHED */
7823	return (NULL);
7824	}
7825	#endif /* HAVE_NET_PFVAR_H */
7826
7827	/* IEEE 802.11 wireless header */
7828	struct block *
7829	gen_p80211_type(compiler_state_t *cstate, int type, int mask)
7830	{
7831	struct block *b0;
7832
7833	switch (cstate->linktype) {
7834
7835	case DLT_IEEE802_11:
7836	case DLT_PRISM_HEADER:
7837	case DLT_IEEE802_11_RADIO_AVS:
7838	case DLT_IEEE802_11_RADIO:
7839	b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, (bpf_int32)type,
7840	(bpf_int32)mask);
7841	break;
7842
7843	default:
7844	bpf_error(cstate, "802.11 link-layer types supported only on 802.11");
7845	/* NOTREACHED */
7846	}
7847
7848	return (b0);
7849	}
7850
7851	struct block *
7852	gen_p80211_fcdir(compiler_state_t *cstate, int fcdir)
7853	{
7854	struct block *b0;
7855
7856	switch (cstate->linktype) {
7857
7858	case DLT_IEEE802_11:
7859	case DLT_PRISM_HEADER:
7860	case DLT_IEEE802_11_RADIO_AVS:
7861	case DLT_IEEE802_11_RADIO:
7862	break;
7863
7864	default:
7865	bpf_error(cstate, "frame direction supported only with 802.11 headers");
7866	/* NOTREACHED */
7867	}
7868
7869	b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, (bpf_int32)fcdir,
7870	(bpf_u_int32)IEEE80211_FC1_DIR_MASK);
7871
7872	return (b0);
7873	}
7874
7875	struct block *
7876	gen_acode(compiler_state_t cstate, const u_char eaddr, struct qual q)
7877	{
7878	switch (cstate->linktype) {
7879
7880	case DLT_ARCNET:
7881	case DLT_ARCNET_LINUX:
7882	if ((q.addr == Q_HOST \|\| q.addr == Q_DEFAULT) &&
7883	q.proto == Q_LINK)
7884	return (gen_ahostop(cstate, eaddr, (int)q.dir));
7885	else {
7886	bpf_error(cstate, "ARCnet address used in non-arc expression");
7887	/* NOTREACHED */
7888	}
7889	break;
7890
7891	default:
7892	bpf_error(cstate, "aid supported only on ARCnet");
7893	/* NOTREACHED */
7894	}
7895	bpf_error(cstate, "ARCnet address used in non-arc expression");
7896	/* NOTREACHED */
7897	return NULL;
7898	}
7899
7900	static struct block *
7901	gen_ahostop(compiler_state_t cstate, const u_char eaddr, int dir)
7902	{
7903	register struct block b0, b1;
7904
7905	switch (dir) {
7906	/* src comes first, different from Ethernet */
7907	case Q_SRC:
7908	return gen_bcmp(cstate, OR_LINKHDR, 0, 1, eaddr);
7909
7910	case Q_DST:
7911	return gen_bcmp(cstate, OR_LINKHDR, 1, 1, eaddr);
7912
7913	case Q_AND:
7914	b0 = gen_ahostop(cstate, eaddr, Q_SRC);
7915	b1 = gen_ahostop(cstate, eaddr, Q_DST);
7916	gen_and(b0, b1);
7917	return b1;
7918
7919	case Q_DEFAULT:
7920	case Q_OR:
7921	b0 = gen_ahostop(cstate, eaddr, Q_SRC);
7922	b1 = gen_ahostop(cstate, eaddr, Q_DST);
7923	gen_or(b0, b1);
7924	return b1;
7925
7926	case Q_ADDR1:
7927	bpf_error(cstate, "'addr1' is only supported on 802.11");
7928	break;
7929
7930	case Q_ADDR2:
7931	bpf_error(cstate, "'addr2' is only supported on 802.11");
7932	break;
7933
7934	case Q_ADDR3:
7935	bpf_error(cstate, "'addr3' is only supported on 802.11");
7936	break;
7937
7938	case Q_ADDR4:
7939	bpf_error(cstate, "'addr4' is only supported on 802.11");
7940	break;
7941
7942	case Q_RA:
7943	bpf_error(cstate, "'ra' is only supported on 802.11");
7944	break;
7945
7946	case Q_TA:
7947	bpf_error(cstate, "'ta' is only supported on 802.11");
7948	break;
7949	}
7950	abort();
7951	/* NOTREACHED */
7952	}
7953
7954	#if defined(SKF_AD_VLAN_TAG) && defined(SKF_AD_VLAN_TAG_PRESENT)
7955	static struct block *
7956	gen_vlan_bpf_extensions(compiler_state_t *cstate, int vlan_num)
7957	{
7958	struct block b0, b1;
7959	struct slist *s;
7960
7961	/* generate new filter code based on extracting packet
7962	* metadata */
7963	s = new_stmt(cstate, BPF_LD\|BPF_B\|BPF_ABS);
7964	s->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT;
7965
7966	b0 = new_block(cstate, JMP(BPF_JEQ));
7967	b0->stmts = s;
7968	b0->s.k = 1;
7969
7970	if (vlan_num >= 0) {
7971	s = new_stmt(cstate, BPF_LD\|BPF_B\|BPF_ABS);
7972	s->s.k = SKF_AD_OFF + SKF_AD_VLAN_TAG;
7973
7974	b1 = new_block(cstate, JMP(BPF_JEQ));
7975	b1->stmts = s;
7976	b1->s.k = (bpf_int32) vlan_num;
7977
7978	gen_and(b0,b1);
7979	b0 = b1;
7980	}
7981
7982	return b0;
7983	}
7984	#endif
7985
7986	static struct block *
7987	gen_vlan_no_bpf_extensions(compiler_state_t *cstate, int vlan_num)
7988	{
7989	struct block b0, b1;
7990
7991	/* check for VLAN, including QinQ */
7992	b0 = gen_linktype(cstate, ETHERTYPE_8021Q);
7993	b1 = gen_linktype(cstate, ETHERTYPE_8021AD);
7994	gen_or(b0,b1);
7995	b0 = b1;
7996	b1 = gen_linktype(cstate, ETHERTYPE_8021QINQ);
7997	gen_or(b0,b1);
7998	b0 = b1;
7999
8000	/* If a specific VLAN is requested, check VLAN id */
8001	if (vlan_num >= 0) {
8002	b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_H,
8003	(bpf_int32)vlan_num, 0x0fff);
8004	gen_and(b0, b1);
8005	b0 = b1;
8006	}
8007
8008	/*
8009	* The payload follows the full header, including the
8010	* VLAN tags, so skip past this VLAN tag.
8011	*/
8012	cstate->off_linkpl.constant_part += 4;
8013
8014	/*
8015	* The link-layer type information follows the VLAN tags, so
8016	* skip past this VLAN tag.
8017	*/
8018	cstate->off_linktype.constant_part += 4;
8019
8020	return b0;
8021	}
8022
8023	/*
8024	* support IEEE 802.1Q VLAN trunk over ethernet
8025	*/
8026	struct block *
8027	gen_vlan(compiler_state_t *cstate, int vlan_num)
8028	{
8029	struct block *b0;
8030
8031	/* can't check for VLAN-encapsulated packets inside MPLS */
8032	if (cstate->label_stack_depth > 0)
8033	bpf_error(cstate, "no VLAN match after MPLS");
8034
8035	/*
8036	* Check for a VLAN packet, and then change the offsets to point
8037	* to the type and data fields within the VLAN packet. Just
8038	* increment the offsets, so that we can support a hierarchy, e.g.
8039	* "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within
8040	* VLAN 100.
8041	*
8042	* XXX - this is a bit of a kludge. If we were to split the
8043	* compiler into a parser that parses an expression and
8044	* generates an expression tree, and a code generator that
8045	* takes an expression tree (which could come from our
8046	* parser or from some other parser) and generates BPF code,
8047	* we could perhaps make the offsets parameters of routines
8048	* and, in the handler for an "AND" node, pass to subnodes
8049	* other than the VLAN node the adjusted offsets.
8050	*
8051	* This would mean that "vlan" would, instead of changing the
8052	* behavior of all tests after it, change only the behavior
8053	* of tests ANDed with it. That would change the documented
8054	* semantics of "vlan", which might break some expressions.
8055	* However, it would mean that "(vlan and ip) or ip" would check
8056	* both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
8057	* checking only for VLAN-encapsulated IP, so that could still
8058	* be considered worth doing; it wouldn't break expressions
8059	* that are of the form "vlan and ..." or "vlan N and ...",
8060	* which I suspect are the most common expressions involving
8061	* "vlan". "vlan or ..." doesn't necessarily do what the user
8062	* would really want, now, as all the "or ..." tests would
8063	* be done assuming a VLAN, even though the "or" could be viewed
8064	* as meaning "or, if this isn't a VLAN packet...".
8065	*/
8066	switch (cstate->linktype) {
8067
8068	case DLT_EN10MB:
8069	case DLT_NETANALYZER:
8070	case DLT_NETANALYZER_TRANSPARENT:
8071	#if defined(SKF_AD_VLAN_TAG) && defined(SKF_AD_VLAN_TAG_PRESENT)
8072	/* Verify that this is the outer part of the packet and
8073	* not encapsulated somehow. */
8074	if (cstate->vlan_stack_depth == 0 && !cstate->off_linkhdr.is_variable &&
8075	cstate->off_linkhdr.constant_part ==
8076	cstate->off_outermostlinkhdr.constant_part) {
8077	/*
8078	* Do we need special VLAN handling?
8079	*/
8080	if (cstate->bpf_pcap->bpf_codegen_flags & BPF_SPECIAL_VLAN_HANDLING)
8081	b0 = gen_vlan_bpf_extensions(cstate, vlan_num);
8082	else
8083	b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num);
8084	} else
8085	#endif
8086	b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num);
8087	break;
8088
8089	case DLT_IEEE802_11:
8090	case DLT_PRISM_HEADER:
8091	case DLT_IEEE802_11_RADIO_AVS:
8092	case DLT_IEEE802_11_RADIO:
8093	b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num);
8094	break;
8095
8096	default:
8097	bpf_error(cstate, "no VLAN support for data link type %d",
8098	cstate->linktype);
8099	/NOTREACHED/
8100	}
8101
8102	cstate->vlan_stack_depth++;
8103
8104	return (b0);
8105	}
8106
8107	/*
8108	* support for MPLS
8109	*/
8110	struct block *
8111	gen_mpls(compiler_state_t *cstate, int label_num)
8112	{
8113	struct block b0, b1;
8114
8115	if (cstate->label_stack_depth > 0) {
8116	/* just match the bottom-of-stack bit clear */
8117	b0 = gen_mcmp(cstate, OR_PREVMPLSHDR, 2, BPF_B, 0, 0x01);
8118	} else {
8119	/*
8120	* We're not in an MPLS stack yet, so check the link-layer
8121	* type against MPLS.
8122	*/
8123	switch (cstate->linktype) {
8124
8125	case DLT_C_HDLC: /* fall through */
8126	case DLT_EN10MB:
8127	case DLT_NETANALYZER:
8128	case DLT_NETANALYZER_TRANSPARENT:
8129	b0 = gen_linktype(cstate, ETHERTYPE_MPLS);
8130	break;
8131
8132	case DLT_PPP:
8133	b0 = gen_linktype(cstate, PPP_MPLS_UCAST);
8134	break;
8135
8136	/* FIXME add other DLT_s ...
8137	* for Frame-Relay/and ATM this may get messy due to SNAP headers
8138	* leave it for now */
8139
8140	default:
8141	bpf_error(cstate, "no MPLS support for data link type %d",
8142	cstate->linktype);
8143	b0 = NULL;
8144	/NOTREACHED/
8145	break;
8146	}
8147	}
8148
8149	/* If a specific MPLS label is requested, check it */
8150	if (label_num >= 0) {
8151	label_num = label_num << 12; /* label is shifted 12 bits on the wire */
8152	b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, (bpf_int32)label_num,
8153	0xfffff000); /* only compare the first 20 bits */
8154	gen_and(b0, b1);
8155	b0 = b1;
8156	}
8157
8158	/*
8159	* Change the offsets to point to the type and data fields within
8160	* the MPLS packet. Just increment the offsets, so that we
8161	* can support a hierarchy, e.g. "mpls 100000 && mpls 1024" to
8162	* capture packets with an outer label of 100000 and an inner
8163	* label of 1024.
8164	*
8165	* Increment the MPLS stack depth as well; this indicates that
8166	* we're checking MPLS-encapsulated headers, to make sure higher
8167	* level code generators don't try to match against IP-related
8168	* protocols such as Q_ARP, Q_RARP etc.
8169	*
8170	* XXX - this is a bit of a kludge. See comments in gen_vlan().
8171	*/
8172	cstate->off_nl_nosnap += 4;
8173	cstate->off_nl += 4;
8174	cstate->label_stack_depth++;
8175	return (b0);
8176	}
8177
8178	/*
8179	* Support PPPOE discovery and session.
8180	*/
8181	struct block *
8182	gen_pppoed(compiler_state_t *cstate)
8183	{
8184	/* check for PPPoE discovery */
8185	return gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOED);
8186	}
8187
8188	struct block *
8189	gen_pppoes(compiler_state_t *cstate, int sess_num)
8190	{
8191	struct block b0, b1;
8192
8193	/*
8194	* Test against the PPPoE session link-layer type.
8195	*/
8196	b0 = gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOES);
8197
8198	/* If a specific session is requested, check PPPoE session id */
8199	if (sess_num >= 0) {
8200	b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W,
8201	(bpf_int32)sess_num, 0x0000ffff);
8202	gen_and(b0, b1);
8203	b0 = b1;
8204	}
8205
8206	/*
8207	* Change the offsets to point to the type and data fields within
8208	* the PPP packet, and note that this is PPPoE rather than
8209	* raw PPP.
8210	*
8211	* XXX - this is a bit of a kludge. If we were to split the
8212	* compiler into a parser that parses an expression and
8213	* generates an expression tree, and a code generator that
8214	* takes an expression tree (which could come from our
8215	* parser or from some other parser) and generates BPF code,
8216	* we could perhaps make the offsets parameters of routines
8217	* and, in the handler for an "AND" node, pass to subnodes
8218	* other than the PPPoE node the adjusted offsets.
8219	*
8220	* This would mean that "pppoes" would, instead of changing the
8221	* behavior of all tests after it, change only the behavior
8222	* of tests ANDed with it. That would change the documented
8223	* semantics of "pppoes", which might break some expressions.
8224	* However, it would mean that "(pppoes and ip) or ip" would check
8225	* both for VLAN-encapsulated IP and IP-over-Ethernet, rather than
8226	* checking only for VLAN-encapsulated IP, so that could still
8227	* be considered worth doing; it wouldn't break expressions
8228	* that are of the form "pppoes and ..." which I suspect are the
8229	* most common expressions involving "pppoes". "pppoes or ..."
8230	* doesn't necessarily do what the user would really want, now,
8231	* as all the "or ..." tests would be done assuming PPPoE, even
8232	* though the "or" could be viewed as meaning "or, if this isn't
8233	* a PPPoE packet...".
8234	*
8235	* The "network-layer" protocol is PPPoE, which has a 6-byte
8236	* PPPoE header, followed by a PPP packet.
8237	*
8238	* There is no HDLC encapsulation for the PPP packet (it's
8239	* encapsulated in PPPoES instead), so the link-layer type
8240	* starts at the first byte of the PPP packet. For PPPoE,
8241	* that offset is relative to the beginning of the total
8242	* link-layer payload, including any 802.2 LLC header, so
8243	* it's 6 bytes past cstate->off_nl.
8244	*/
8245	PUSH_LINKHDR(cstate, DLT_PPP, cstate->off_linkpl.is_variable,
8246	cstate->off_linkpl.constant_part + cstate->off_nl + 6, /* 6 bytes past the PPPoE header */
8247	cstate->off_linkpl.reg);
8248
8249	cstate->off_linktype = cstate->off_linkhdr;
8250	cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 2;
8251
8252	cstate->off_nl = 0;
8253	cstate->off_nl_nosnap = 0; /* no 802.2 LLC */
8254
8255	return b0;
8256	}
8257
8258	/* Check that this is Geneve and the VNI is correct if
8259	* specified. Parameterized to handle both IPv4 and IPv6. */
8260	static struct block *
8261	gen_geneve_check(compiler_state_t *cstate,
8262	struct block (gen_portfn)(compiler_state_t *, int, int, int),
8263	enum e_offrel offrel, int vni)
8264	{
8265	struct block b0, b1;
8266
8267	b0 = gen_portfn(cstate, GENEVE_PORT, IPPROTO_UDP, Q_DST);
8268
8269	/* Check that we are operating on version 0. Otherwise, we
8270	* can't decode the rest of the fields. The version is 2 bits
8271	* in the first byte of the Geneve header. */
8272	b1 = gen_mcmp(cstate, offrel, 8, BPF_B, (bpf_int32)0, 0xc0);
8273	gen_and(b0, b1);
8274	b0 = b1;
8275
8276	if (vni >= 0) {
8277	vni <<= 8; /* VNI is in the upper 3 bytes */
8278	b1 = gen_mcmp(cstate, offrel, 12, BPF_W, (bpf_int32)vni,
8279	0xffffff00);
8280	gen_and(b0, b1);
8281	b0 = b1;
8282	}
8283
8284	return b0;
8285	}
8286
8287	/* The IPv4 and IPv6 Geneve checks need to do two things:
8288	* - Verify that this actually is Geneve with the right VNI.
8289	* - Place the IP header length (plus variable link prefix if
8290	* needed) into register A to be used later to compute
8291	* the inner packet offsets. */
8292	static struct block *
8293	gen_geneve4(compiler_state_t *cstate, int vni)
8294	{
8295	struct block b0, b1;
8296	struct slist s, s1;
8297
8298	b0 = gen_geneve_check(cstate, gen_port, OR_TRAN_IPV4, vni);
8299
8300	/* Load the IP header length into A. */
8301	s = gen_loadx_iphdrlen(cstate);
8302
8303	s1 = new_stmt(cstate, BPF_MISC\|BPF_TXA);
8304	sappend(s, s1);
8305
8306	/* Forcibly append these statements to the true condition
8307	* of the protocol check by creating a new block that is
8308	* always true and ANDing them. */
8309	b1 = new_block(cstate, BPF_JMP\|BPF_JEQ\|BPF_X);
8310	b1->stmts = s;
8311	b1->s.k = 0;
8312
8313	gen_and(b0, b1);
8314
8315	return b1;
8316	}
8317
8318	static struct block *
8319	gen_geneve6(compiler_state_t *cstate, int vni)
8320	{
8321	struct block b0, b1;
8322	struct slist s, s1;
8323
8324	b0 = gen_geneve_check(cstate, gen_port6, OR_TRAN_IPV6, vni);
8325
8326	/* Load the IP header length. We need to account for a
8327	* variable length link prefix if there is one. */
8328	s = gen_abs_offset_varpart(cstate, &cstate->off_linkpl);
8329	if (s) {
8330	s1 = new_stmt(cstate, BPF_LD\|BPF_IMM);
8331	s1->s.k = 40;
8332	sappend(s, s1);
8333
8334	s1 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X);
8335	s1->s.k = 0;
8336	sappend(s, s1);
8337	} else {
8338	s = new_stmt(cstate, BPF_LD\|BPF_IMM);
8339	s->s.k = 40;
8340	}
8341
8342	/* Forcibly append these statements to the true condition
8343	* of the protocol check by creating a new block that is
8344	* always true and ANDing them. */
8345	s1 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
8346	sappend(s, s1);
8347
8348	b1 = new_block(cstate, BPF_JMP\|BPF_JEQ\|BPF_X);
8349	b1->stmts = s;
8350	b1->s.k = 0;
8351
8352	gen_and(b0, b1);
8353
8354	return b1;
8355	}
8356
8357	/* We need to store three values based on the Geneve header::
8358	* - The offset of the linktype.
8359	* - The offset of the end of the Geneve header.
8360	* - The offset of the end of the encapsulated MAC header. */
8361	static struct slist *
8362	gen_geneve_offsets(compiler_state_t *cstate)
8363	{
8364	struct slist s, s1, *s_proto;
8365
8366	/* First we need to calculate the offset of the Geneve header
8367	* itself. This is composed of the IP header previously calculated
8368	* (include any variable link prefix) and stored in A plus the
8369	* fixed sized headers (fixed link prefix, MAC length, and UDP
8370	* header). */
8371	s = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
8372	s->s.k = cstate->off_linkpl.constant_part + cstate->off_nl + 8;
8373
8374	/* Stash this in X since we'll need it later. */
8375	s1 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
8376	sappend(s, s1);
8377
8378	/* The EtherType in Geneve is 2 bytes in. Calculate this and
8379	* store it. */
8380	s1 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
8381	s1->s.k = 2;
8382	sappend(s, s1);
8383
8384	cstate->off_linktype.reg = alloc_reg(cstate);
8385	cstate->off_linktype.is_variable = 1;
8386	cstate->off_linktype.constant_part = 0;
8387
8388	s1 = new_stmt(cstate, BPF_ST);
8389	s1->s.k = cstate->off_linktype.reg;
8390	sappend(s, s1);
8391
8392	/* Load the Geneve option length and mask and shift to get the
8393	* number of bytes. It is stored in the first byte of the Geneve
8394	* header. */
8395	s1 = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_B);
8396	s1->s.k = 0;
8397	sappend(s, s1);
8398
8399	s1 = new_stmt(cstate, BPF_ALU\|BPF_AND\|BPF_K);
8400	s1->s.k = 0x3f;
8401	sappend(s, s1);
8402
8403	s1 = new_stmt(cstate, BPF_ALU\|BPF_MUL\|BPF_K);
8404	s1->s.k = 4;
8405	sappend(s, s1);
8406
8407	/* Add in the rest of the Geneve base header. */
8408	s1 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
8409	s1->s.k = 8;
8410	sappend(s, s1);
8411
8412	/* Add the Geneve header length to its offset and store. */
8413	s1 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_X);
8414	s1->s.k = 0;
8415	sappend(s, s1);
8416
8417	/* Set the encapsulated type as Ethernet. Even though we may
8418	* not actually have Ethernet inside there are two reasons this
8419	* is useful:
8420	* - The linktype field is always in EtherType format regardless
8421	* of whether it is in Geneve or an inner Ethernet frame.
8422	* - The only link layer that we have specific support for is
8423	* Ethernet. We will confirm that the packet actually is
8424	* Ethernet at runtime before executing these checks. */
8425	PUSH_LINKHDR(cstate, DLT_EN10MB, 1, 0, alloc_reg(cstate));
8426
8427	s1 = new_stmt(cstate, BPF_ST);
8428	s1->s.k = cstate->off_linkhdr.reg;
8429	sappend(s, s1);
8430
8431	/* Calculate whether we have an Ethernet header or just raw IP/
8432	* MPLS/etc. If we have Ethernet, advance the end of the MAC offset
8433	* and linktype by 14 bytes so that the network header can be found
8434	* seamlessly. Otherwise, keep what we've calculated already. */
8435
8436	/* We have a bare jmp so we can't use the optimizer. */
8437	cstate->no_optimize = 1;
8438
8439	/* Load the EtherType in the Geneve header, 2 bytes in. */
8440	s1 = new_stmt(cstate, BPF_LD\|BPF_IND\|BPF_H);
8441	s1->s.k = 2;
8442	sappend(s, s1);
8443
8444	/* Load X with the end of the Geneve header. */
8445	s1 = new_stmt(cstate, BPF_LDX\|BPF_MEM);
8446	s1->s.k = cstate->off_linkhdr.reg;
8447	sappend(s, s1);
8448
8449	/* Check if the EtherType is Transparent Ethernet Bridging. At the
8450	* end of this check, we should have the total length in X. In
8451	* the non-Ethernet case, it's already there. */
8452	s_proto = new_stmt(cstate, JMP(BPF_JEQ));
8453	s_proto->s.k = ETHERTYPE_TEB;
8454	sappend(s, s_proto);
8455
8456	s1 = new_stmt(cstate, BPF_MISC\|BPF_TXA);
8457	sappend(s, s1);
8458	s_proto->s.jt = s1;
8459
8460	/* Since this is Ethernet, use the EtherType of the payload
8461	* directly as the linktype. Overwrite what we already have. */
8462	s1 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
8463	s1->s.k = 12;
8464	sappend(s, s1);
8465
8466	s1 = new_stmt(cstate, BPF_ST);
8467	s1->s.k = cstate->off_linktype.reg;
8468	sappend(s, s1);
8469
8470	/* Advance two bytes further to get the end of the Ethernet
8471	* header. */
8472	s1 = new_stmt(cstate, BPF_ALU\|BPF_ADD\|BPF_K);
8473	s1->s.k = 2;
8474	sappend(s, s1);
8475
8476	/* Move the result to X. */
8477	s1 = new_stmt(cstate, BPF_MISC\|BPF_TAX);
8478	sappend(s, s1);
8479
8480	/* Store the final result of our linkpl calculation. */
8481	cstate->off_linkpl.reg = alloc_reg(cstate);
8482	cstate->off_linkpl.is_variable = 1;
8483	cstate->off_linkpl.constant_part = 0;
8484
8485	s1 = new_stmt(cstate, BPF_STX);
8486	s1->s.k = cstate->off_linkpl.reg;
8487	sappend(s, s1);
8488	s_proto->s.jf = s1;
8489
8490	cstate->off_nl = 0;
8491
8492	return s;
8493	}
8494
8495	/* Check to see if this is a Geneve packet. */
8496	struct block *
8497	gen_geneve(compiler_state_t *cstate, int vni)
8498	{
8499	struct block b0, b1;
8500	struct slist *s;
8501
8502	b0 = gen_geneve4(cstate, vni);
8503	b1 = gen_geneve6(cstate, vni);
8504
8505	gen_or(b0, b1);
8506	b0 = b1;
8507
8508	/* Later filters should act on the payload of the Geneve frame,
8509	* update all of the header pointers. Attach this code so that
8510	* it gets executed in the event that the Geneve filter matches. */
8511	s = gen_geneve_offsets(cstate);
8512
8513	b1 = gen_true(cstate);
8514	sappend(s, b1->stmts);
8515	b1->stmts = s;
8516
8517	gen_and(b0, b1);
8518
8519	cstate->is_geneve = 1;
8520
8521	return b1;
8522	}
8523
8524	/* Check that the encapsulated frame has a link layer header
8525	* for Ethernet filters. */
8526	static struct block *
8527	gen_geneve_ll_check(compiler_state_t *cstate)
8528	{
8529	struct block *b0;
8530	struct slist s, s1;
8531
8532	/* The easiest way to see if there is a link layer present
8533	* is to check if the link layer header and payload are not
8534	* the same. */
8535
8536	/* Geneve always generates pure variable offsets so we can
8537	* compare only the registers. */
8538	s = new_stmt(cstate, BPF_LD\|BPF_MEM);
8539	s->s.k = cstate->off_linkhdr.reg;
8540
8541	s1 = new_stmt(cstate, BPF_LDX\|BPF_MEM);
8542	s1->s.k = cstate->off_linkpl.reg;
8543	sappend(s, s1);
8544
8545	b0 = new_block(cstate, BPF_JMP\|BPF_JEQ\|BPF_X);
8546	b0->stmts = s;
8547	b0->s.k = 0;
8548	gen_not(b0);
8549
8550	return b0;
8551	}
8552
8553	struct block *
8554	gen_atmfield_code(compiler_state_t *cstate, int atmfield, bpf_int32 jvalue,
8555	bpf_u_int32 jtype, int reverse)
8556	{
8557	struct block *b0;
8558
8559	switch (atmfield) {
8560
8561	case A_VPI:
8562	if (!cstate->is_atm)
8563	bpf_error(cstate, "'vpi' supported only on raw ATM");
8564	if (cstate->off_vpi == (u_int)-1)
8565	abort();
8566	b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vpi, BPF_B, 0xffffffff, jtype,
8567	reverse, jvalue);
8568	break;
8569
8570	case A_VCI:
8571	if (!cstate->is_atm)
8572	bpf_error(cstate, "'vci' supported only on raw ATM");
8573	if (cstate->off_vci == (u_int)-1)
8574	abort();
8575	b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_vci, BPF_H, 0xffffffff, jtype,
8576	reverse, jvalue);
8577	break;
8578
8579	case A_PROTOTYPE:
8580	if (cstate->off_proto == (u_int)-1)
8581	abort(); /* XXX - this isn't on FreeBSD */
8582	b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 0x0f, jtype,
8583	reverse, jvalue);
8584	break;
8585
8586	case A_MSGTYPE:
8587	if (cstate->off_payload == (u_int)-1)
8588	abort();
8589	b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_payload + MSG_TYPE_POS, BPF_B,
8590	0xffffffff, jtype, reverse, jvalue);
8591	break;
8592
8593	case A_CALLREFTYPE:
8594	if (!cstate->is_atm)
8595	bpf_error(cstate, "'callref' supported only on raw ATM");
8596	if (cstate->off_proto == (u_int)-1)
8597	abort();
8598	b0 = gen_ncmp(cstate, OR_LINKHDR, cstate->off_proto, BPF_B, 0xffffffff,
8599	jtype, reverse, jvalue);
8600	break;
8601
8602	default:
8603	abort();
8604	}
8605	return b0;
8606	}
8607
8608	struct block *
8609	gen_atmtype_abbrev(compiler_state_t *cstate, int type)
8610	{
8611	struct block b0, b1;
8612
8613	switch (type) {
8614
8615	case A_METAC:
8616	/* Get all packets in Meta signalling Circuit */
8617	if (!cstate->is_atm)
8618	bpf_error(cstate, "'metac' supported only on raw ATM");
8619	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8620	b1 = gen_atmfield_code(cstate, A_VCI, 1, BPF_JEQ, 0);
8621	gen_and(b0, b1);
8622	break;
8623
8624	case A_BCC:
8625	/* Get all packets in Broadcast Circuit*/
8626	if (!cstate->is_atm)
8627	bpf_error(cstate, "'bcc' supported only on raw ATM");
8628	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8629	b1 = gen_atmfield_code(cstate, A_VCI, 2, BPF_JEQ, 0);
8630	gen_and(b0, b1);
8631	break;
8632
8633	case A_OAMF4SC:
8634	/* Get all cells in Segment OAM F4 circuit*/
8635	if (!cstate->is_atm)
8636	bpf_error(cstate, "'oam4sc' supported only on raw ATM");
8637	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8638	b1 = gen_atmfield_code(cstate, A_VCI, 3, BPF_JEQ, 0);
8639	gen_and(b0, b1);
8640	break;
8641
8642	case A_OAMF4EC:
8643	/* Get all cells in End-to-End OAM F4 Circuit*/
8644	if (!cstate->is_atm)
8645	bpf_error(cstate, "'oam4ec' supported only on raw ATM");
8646	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8647	b1 = gen_atmfield_code(cstate, A_VCI, 4, BPF_JEQ, 0);
8648	gen_and(b0, b1);
8649	break;
8650
8651	case A_SC:
8652	/* Get all packets in connection Signalling Circuit */
8653	if (!cstate->is_atm)
8654	bpf_error(cstate, "'sc' supported only on raw ATM");
8655	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8656	b1 = gen_atmfield_code(cstate, A_VCI, 5, BPF_JEQ, 0);
8657	gen_and(b0, b1);
8658	break;
8659
8660	case A_ILMIC:
8661	/* Get all packets in ILMI Circuit */
8662	if (!cstate->is_atm)
8663	bpf_error(cstate, "'ilmic' supported only on raw ATM");
8664	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8665	b1 = gen_atmfield_code(cstate, A_VCI, 16, BPF_JEQ, 0);
8666	gen_and(b0, b1);
8667	break;
8668
8669	case A_LANE:
8670	/* Get all LANE packets */
8671	if (!cstate->is_atm)
8672	bpf_error(cstate, "'lane' supported only on raw ATM");
8673	b1 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LANE, BPF_JEQ, 0);
8674
8675	/*
8676	* Arrange that all subsequent tests assume LANE
8677	* rather than LLC-encapsulated packets, and set
8678	* the offsets appropriately for LANE-encapsulated
8679	* Ethernet.
8680	*
8681	* We assume LANE means Ethernet, not Token Ring.
8682	*/
8683	PUSH_LINKHDR(cstate, DLT_EN10MB, 0,
8684	cstate->off_payload + 2, /* Ethernet header */
8685	-1);
8686	cstate->off_linktype.constant_part = cstate->off_linkhdr.constant_part + 12;
8687	cstate->off_linkpl.constant_part = cstate->off_linkhdr.constant_part + 14; /* Ethernet */
8688	cstate->off_nl = 0; /* Ethernet II */
8689	cstate->off_nl_nosnap = 3; /* 802.3+802.2 */
8690	break;
8691
8692	case A_LLC:
8693	/* Get all LLC-encapsulated packets */
8694	if (!cstate->is_atm)
8695	bpf_error(cstate, "'llc' supported only on raw ATM");
8696	b1 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0);
8697	cstate->linktype = cstate->prevlinktype;
8698	break;
8699
8700	default:
8701	abort();
8702	}
8703	return b1;
8704	}
8705
8706	/*
8707	* Filtering for MTP2 messages based on li value
8708	* FISU, length is null
8709	* LSSU, length is 1 or 2
8710	* MSU, length is 3 or more
8711	* For MTP2_HSL, sequences are on 2 bytes, and length on 9 bits
8712	*/
8713	struct block *
8714	gen_mtp2type_abbrev(compiler_state_t *cstate, int type)
8715	{
8716	struct block b0, b1;
8717
8718	switch (type) {
8719
8720	case M_FISU:
8721	if ( (cstate->linktype != DLT_MTP2) &&
8722	(cstate->linktype != DLT_ERF) &&
8723	(cstate->linktype != DLT_MTP2_WITH_PHDR) )
8724	bpf_error(cstate, "'fisu' supported only on MTP2");
8725	/* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */
8726	b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JEQ, 0, 0);
8727	break;
8728
8729	case M_LSSU:
8730	if ( (cstate->linktype != DLT_MTP2) &&
8731	(cstate->linktype != DLT_ERF) &&
8732	(cstate->linktype != DLT_MTP2_WITH_PHDR) )
8733	bpf_error(cstate, "'lssu' supported only on MTP2");
8734	b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 1, 2);
8735	b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 0, 0);
8736	gen_and(b1, b0);
8737	break;
8738
8739	case M_MSU:
8740	if ( (cstate->linktype != DLT_MTP2) &&
8741	(cstate->linktype != DLT_ERF) &&
8742	(cstate->linktype != DLT_MTP2_WITH_PHDR) )
8743	bpf_error(cstate, "'msu' supported only on MTP2");
8744	b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li, BPF_B, 0x3f, BPF_JGT, 0, 2);
8745	break;
8746
8747	case MH_FISU:
8748	if ( (cstate->linktype != DLT_MTP2) &&
8749	(cstate->linktype != DLT_ERF) &&
8750	(cstate->linktype != DLT_MTP2_WITH_PHDR) )
8751	bpf_error(cstate, "'hfisu' supported only on MTP2_HSL");
8752	/* gen_ncmp(cstate, offrel, offset, size, mask, jtype, reverse, value) */
8753	b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JEQ, 0, 0);
8754	break;
8755
8756	case MH_LSSU:
8757	if ( (cstate->linktype != DLT_MTP2) &&
8758	(cstate->linktype != DLT_ERF) &&
8759	(cstate->linktype != DLT_MTP2_WITH_PHDR) )
8760	bpf_error(cstate, "'hlssu' supported only on MTP2_HSL");
8761	b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 1, 0x0100);
8762	b1 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 0, 0);
8763	gen_and(b1, b0);
8764	break;
8765
8766	case MH_MSU:
8767	if ( (cstate->linktype != DLT_MTP2) &&
8768	(cstate->linktype != DLT_ERF) &&
8769	(cstate->linktype != DLT_MTP2_WITH_PHDR) )
8770	bpf_error(cstate, "'hmsu' supported only on MTP2_HSL");
8771	b0 = gen_ncmp(cstate, OR_PACKET, cstate->off_li_hsl, BPF_H, 0xff80, BPF_JGT, 0, 0x0100);
8772	break;
8773
8774	default:
8775	abort();
8776	}
8777	return b0;
8778	}
8779
8780	struct block *
8781	gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, bpf_u_int32 jvalue,
8782	bpf_u_int32 jtype, int reverse)
8783	{
8784	struct block *b0;
8785	bpf_u_int32 val1 , val2 , val3;
8786	u_int newoff_sio = cstate->off_sio;
8787	u_int newoff_opc = cstate->off_opc;
8788	u_int newoff_dpc = cstate->off_dpc;
8789	u_int newoff_sls = cstate->off_sls;
8790
8791	switch (mtp3field) {
8792
8793	case MH_SIO:
8794	newoff_sio += 3; /* offset for MTP2_HSL */
8795	/* FALLTHROUGH */
8796
8797	case M_SIO:
8798	if (cstate->off_sio == (u_int)-1)
8799	bpf_error(cstate, "'sio' supported only on SS7");
8800	/* sio coded on 1 byte so max value 255 */
8801	if(jvalue > 255)
8802	bpf_error(cstate, "sio value %u too big; max value = 255",
8803	jvalue);
8804	b0 = gen_ncmp(cstate, OR_PACKET, newoff_sio, BPF_B, 0xffffffff,
8805	(u_int)jtype, reverse, (u_int)jvalue);
8806	break;
8807
8808	case MH_OPC:
8809	newoff_opc+=3;
8810	case M_OPC:
8811	if (cstate->off_opc == (u_int)-1)
8812	bpf_error(cstate, "'opc' supported only on SS7");
8813	/* opc coded on 14 bits so max value 16383 */
8814	if (jvalue > 16383)
8815	bpf_error(cstate, "opc value %u too big; max value = 16383",
8816	jvalue);
8817	/* the following instructions are made to convert jvalue
8818	* to the form used to write opc in an ss7 message*/
8819	val1 = jvalue & 0x00003c00;
8820	val1 = val1 >>10;
8821	val2 = jvalue & 0x000003fc;
8822	val2 = val2 <<6;
8823	val3 = jvalue & 0x00000003;
8824	val3 = val3 <<22;
8825	jvalue = val1 + val2 + val3;
8826	b0 = gen_ncmp(cstate, OR_PACKET, newoff_opc, BPF_W, 0x00c0ff0f,
8827	(u_int)jtype, reverse, (u_int)jvalue);
8828	break;
8829
8830	case MH_DPC:
8831	newoff_dpc += 3;
8832	/* FALLTHROUGH */
8833
8834	case M_DPC:
8835	if (cstate->off_dpc == (u_int)-1)
8836	bpf_error(cstate, "'dpc' supported only on SS7");
8837	/* dpc coded on 14 bits so max value 16383 */
8838	if (jvalue > 16383)
8839	bpf_error(cstate, "dpc value %u too big; max value = 16383",
8840	jvalue);
8841	/* the following instructions are made to convert jvalue
8842	* to the forme used to write dpc in an ss7 message*/
8843	val1 = jvalue & 0x000000ff;
8844	val1 = val1 << 24;
8845	val2 = jvalue & 0x00003f00;
8846	val2 = val2 << 8;
8847	jvalue = val1 + val2;
8848	b0 = gen_ncmp(cstate, OR_PACKET, newoff_dpc, BPF_W, 0xff3f0000,
8849	(u_int)jtype, reverse, (u_int)jvalue);
8850	break;
8851
8852	case MH_SLS:
8853	newoff_sls+=3;
8854	case M_SLS:
8855	if (cstate->off_sls == (u_int)-1)
8856	bpf_error(cstate, "'sls' supported only on SS7");
8857	/* sls coded on 4 bits so max value 15 */
8858	if (jvalue > 15)
8859	bpf_error(cstate, "sls value %u too big; max value = 15",
8860	jvalue);
8861	/* the following instruction is made to convert jvalue
8862	* to the forme used to write sls in an ss7 message*/
8863	jvalue = jvalue << 4;
8864	b0 = gen_ncmp(cstate, OR_PACKET, newoff_sls, BPF_B, 0xf0,
8865	(u_int)jtype,reverse, (u_int)jvalue);
8866	break;
8867
8868	default:
8869	abort();
8870	}
8871	return b0;
8872	}
8873
8874	static struct block *
8875	gen_msg_abbrev(compiler_state_t *cstate, int type)
8876	{
8877	struct block *b1;
8878
8879	/*
8880	* Q.2931 signalling protocol messages for handling virtual circuits
8881	* establishment and teardown
8882	*/
8883	switch (type) {
8884
8885	case A_SETUP:
8886	b1 = gen_atmfield_code(cstate, A_MSGTYPE, SETUP, BPF_JEQ, 0);
8887	break;
8888
8889	case A_CALLPROCEED:
8890	b1 = gen_atmfield_code(cstate, A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0);
8891	break;
8892
8893	case A_CONNECT:
8894	b1 = gen_atmfield_code(cstate, A_MSGTYPE, CONNECT, BPF_JEQ, 0);
8895	break;
8896
8897	case A_CONNECTACK:
8898	b1 = gen_atmfield_code(cstate, A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0);
8899	break;
8900
8901	case A_RELEASE:
8902	b1 = gen_atmfield_code(cstate, A_MSGTYPE, RELEASE, BPF_JEQ, 0);
8903	break;
8904
8905	case A_RELEASE_DONE:
8906	b1 = gen_atmfield_code(cstate, A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0);
8907	break;
8908
8909	default:
8910	abort();
8911	}
8912	return b1;
8913	}
8914
8915	struct block *
8916	gen_atmmulti_abbrev(compiler_state_t *cstate, int type)
8917	{
8918	struct block b0, b1;
8919
8920	switch (type) {
8921
8922	case A_OAM:
8923	if (!cstate->is_atm)
8924	bpf_error(cstate, "'oam' supported only on raw ATM");
8925	b1 = gen_atmmulti_abbrev(cstate, A_OAMF4);
8926	break;
8927
8928	case A_OAMF4:
8929	if (!cstate->is_atm)
8930	bpf_error(cstate, "'oamf4' supported only on raw ATM");
8931	/* OAM F4 type */
8932	b0 = gen_atmfield_code(cstate, A_VCI, 3, BPF_JEQ, 0);
8933	b1 = gen_atmfield_code(cstate, A_VCI, 4, BPF_JEQ, 0);
8934	gen_or(b0, b1);
8935	b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0);
8936	gen_and(b0, b1);
8937	break;
8938
8939	case A_CONNECTMSG:
8940	/*
8941	* Get Q.2931 signalling messages for switched
8942	* virtual connection
8943	*/
8944	if (!cstate->is_atm)
8945	bpf_error(cstate, "'connectmsg' supported only on raw ATM");
8946	b0 = gen_msg_abbrev(cstate, A_SETUP);
8947	b1 = gen_msg_abbrev(cstate, A_CALLPROCEED);
8948	gen_or(b0, b1);
8949	b0 = gen_msg_abbrev(cstate, A_CONNECT);
8950	gen_or(b0, b1);
8951	b0 = gen_msg_abbrev(cstate, A_CONNECTACK);
8952	gen_or(b0, b1);
8953	b0 = gen_msg_abbrev(cstate, A_RELEASE);
8954	gen_or(b0, b1);
8955	b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE);
8956	gen_or(b0, b1);
8957	b0 = gen_atmtype_abbrev(cstate, A_SC);
8958	gen_and(b0, b1);
8959	break;
8960
8961	case A_METACONNECT:
8962	if (!cstate->is_atm)
8963	bpf_error(cstate, "'metaconnect' supported only on raw ATM");
8964	b0 = gen_msg_abbrev(cstate, A_SETUP);
8965	b1 = gen_msg_abbrev(cstate, A_CALLPROCEED);
8966	gen_or(b0, b1);
8967	b0 = gen_msg_abbrev(cstate, A_CONNECT);
8968	gen_or(b0, b1);
8969	b0 = gen_msg_abbrev(cstate, A_RELEASE);
8970	gen_or(b0, b1);
8971	b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE);
8972	gen_or(b0, b1);
8973	b0 = gen_atmtype_abbrev(cstate, A_METAC);
8974	gen_and(b0, b1);
8975	break;
8976
8977	default:
8978	abort();
8979	}
8980	return b1;
8981	}

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: rtems-libbsd/freebsd/contrib/libpcap/gencode.c @ 97c5f8e8

Download in other formats: