diff options
Diffstat (limited to 'freebsd/contrib/libpcap/gencode.c')
| -rw-r--r-- | freebsd/contrib/libpcap/gencode.c | 1868 |
1 files changed, 1312 insertions, 556 deletions
diff --git a/freebsd/contrib/libpcap/gencode.c b/freebsd/contrib/libpcap/gencode.c index df75cacd..7ae486fa 100644 --- a/freebsd/contrib/libpcap/gencode.c +++ b/freebsd/contrib/libpcap/gencode.c @@ -52,6 +52,8 @@ #include "pcap-int.h" +#include "extract.h" + #include "ethertype.h" #include "nlpid.h" #include "llc.h" @@ -279,6 +281,13 @@ struct _compiler_state { struct addrinfo *ai; /* + * Another thing that's allocated is the result of pcap_ether_aton(); + * it must be freed with free(). This variable points to any + * address that would need to be freed. + */ + u_char *e; + + /* * Various code constructs need to know the layout of the packet. * These values give the necessary offsets from the beginning * of the packet data. @@ -419,35 +428,49 @@ struct _compiler_state { int cur_chunk; }; -void PCAP_NORETURN -bpf_syntax_error(compiler_state_t *cstate, const char *msg) +/* + * For use by routines outside this file. + */ +/* VARARGS */ +void +bpf_set_error(compiler_state_t *cstate, const char *fmt, ...) { - bpf_error(cstate, "syntax error in filter expression: %s", msg); - /* NOTREACHED */ + va_list ap; + + va_start(ap, fmt); + (void)pcap_vsnprintf(cstate->bpf_pcap->errbuf, PCAP_ERRBUF_SIZE, + fmt, ap); + va_end(ap); } +/* + * For use *ONLY* in routines in this file. + */ +static void PCAP_NORETURN bpf_error(compiler_state_t *, const char *, ...) + PCAP_PRINTFLIKE(2, 3); + /* VARARGS */ -void PCAP_NORETURN +static void PCAP_NORETURN bpf_error(compiler_state_t *cstate, const char *fmt, ...) { va_list ap; va_start(ap, fmt); - if (cstate->bpf_pcap != NULL) - (void)pcap_vsnprintf(pcap_geterr(cstate->bpf_pcap), - PCAP_ERRBUF_SIZE, fmt, ap); + (void)pcap_vsnprintf(cstate->bpf_pcap->errbuf, PCAP_ERRBUF_SIZE, + fmt, ap); va_end(ap); longjmp(cstate->top_ctx, 1); - /* NOTREACHED */ + /*NOTREACHED*/ } -static void init_linktype(compiler_state_t *, pcap_t *); +static int init_linktype(compiler_state_t *, pcap_t *); static void init_regs(compiler_state_t *); static int alloc_reg(compiler_state_t *); static void free_reg(compiler_state_t *, int); static void initchunks(compiler_state_t *cstate); +static void *newchunk_nolongjmp(compiler_state_t *cstate, size_t); static void *newchunk(compiler_state_t *cstate, size_t); static void freechunks(compiler_state_t *cstate); static inline struct block *new_block(compiler_state_t *cstate, int); @@ -545,6 +568,9 @@ static struct block *gen_check_802_11_data_frame(compiler_state_t *); static struct block *gen_geneve_ll_check(compiler_state_t *cstate); static struct block *gen_ppi_dlt_check(compiler_state_t *); +static struct block *gen_atmfield_code_internal(compiler_state_t *, int, + bpf_int32, bpf_u_int32, int); +static struct block *gen_atmtype_llc(compiler_state_t *); static struct block *gen_msg_abbrev(compiler_state_t *, int type); static void @@ -560,7 +586,7 @@ initchunks(compiler_state_t *cstate) } static void * -newchunk(compiler_state_t *cstate, size_t n) +newchunk_nolongjmp(compiler_state_t *cstate, size_t n) { struct chunk *cp; int k; @@ -578,21 +604,40 @@ newchunk(compiler_state_t *cstate, size_t n) if (n > cp->n_left) { ++cp; k = ++cstate->cur_chunk; - if (k >= NCHUNKS) - bpf_error(cstate, "out of memory"); + if (k >= NCHUNKS) { + bpf_set_error(cstate, "out of memory"); + return (NULL); + } size = CHUNK0SIZE << k; cp->m = (void *)malloc(size); - if (cp->m == NULL) - bpf_error(cstate, "out of memory"); + if (cp->m == NULL) { + bpf_set_error(cstate, "out of memory"); + return (NULL); + } memset((char *)cp->m, 0, size); cp->n_left = size; - if (n > size) - bpf_error(cstate, "out of memory"); + if (n > size) { + bpf_set_error(cstate, "out of memory"); + return (NULL); + } } cp->n_left -= n; return (void *)((char *)cp->m + cp->n_left); } +static void * +newchunk(compiler_state_t *cstate, size_t n) +{ + void *p; + + p = newchunk_nolongjmp(cstate, n); + if (p == NULL) { + longjmp(cstate->top_ctx, 1); + /*NOTREACHED*/ + } + return (p); +} + static void freechunks(compiler_state_t *cstate) { @@ -605,14 +650,19 @@ freechunks(compiler_state_t *cstate) /* * A strdup whose allocations are freed after code generation is over. + * This is used by the lexical analyzer, so it can't longjmp; it just + * returns NULL on an allocation error, and the callers must check + * for it. */ char * sdup(compiler_state_t *cstate, const char *s) { size_t n = strlen(s) + 1; - char *cp = newchunk(cstate, n); + char *cp = newchunk_nolongjmp(cstate, n); - strlcpy(cp, s, n); + if (cp == NULL) + return (NULL); + pcap_strlcpy(cp, s, n); return (cp); } @@ -664,7 +714,7 @@ pcap_compile(pcap_t *p, struct bpf_program *program, compiler_state_t cstate; const char * volatile xbuf = buf; yyscan_t scanner = NULL; - YY_BUFFER_STATE in_buffer = NULL; + volatile YY_BUFFER_STATE in_buffer = NULL; u_int len; int rc; @@ -699,7 +749,7 @@ pcap_compile(pcap_t *p, struct bpf_program *program, * filter for this pcap_t; we might be running it from userland * on captured packets to do packet classification. We really * need a better way of handling this, but this is all that - * the WinPcap code did. + * the WinPcap remote capture code did. */ if (p->save_current_filter_op != NULL) (p->save_current_filter_op)(p, buf); @@ -710,20 +760,12 @@ pcap_compile(pcap_t *p, struct bpf_program *program, #ifdef INET6 cstate.ai = NULL; #endif + cstate.e = NULL; cstate.ic.root = NULL; cstate.ic.cur_mark = 0; cstate.bpf_pcap = p; init_regs(&cstate); - if (setjmp(cstate.top_ctx)) { -#ifdef INET6 - if (cstate.ai != NULL) - freeaddrinfo(cstate.ai); -#endif - rc = -1; - goto quit; - } - cstate.netmask = mask; cstate.snaplen = pcap_snapshot(p); @@ -745,19 +787,53 @@ pcap_compile(pcap_t *p, struct bpf_program *program, */ pcap_set_extra(&cstate, scanner); - init_linktype(&cstate, p); - (void)pcap_parse(scanner, &cstate); + if (init_linktype(&cstate, p) == -1) { + rc = -1; + goto quit; + } + if (pcap_parse(scanner, &cstate) != 0) { +#ifdef INET6 + if (cstate.ai != NULL) + freeaddrinfo(cstate.ai); +#endif + if (cstate.e != NULL) + free(cstate.e); + rc = -1; + goto quit; + } - if (cstate.ic.root == NULL) + if (cstate.ic.root == NULL) { + /* + * Catch errors reported by gen_retblk(). + */ + if (setjmp(cstate.top_ctx)) { + rc = -1; + goto quit; + } cstate.ic.root = gen_retblk(&cstate, cstate.snaplen); + } if (optimize && !cstate.no_optimize) { - bpf_optimize(&cstate, &cstate.ic); + if (bpf_optimize(&cstate.ic, p->errbuf) == -1) { + /* Failure */ + rc = -1; + goto quit; + } if (cstate.ic.root == NULL || - (cstate.ic.root->s.code == (BPF_RET|BPF_K) && cstate.ic.root->s.k == 0)) - bpf_error(&cstate, "expression rejects all packets"); + (cstate.ic.root->s.code == (BPF_RET|BPF_K) && cstate.ic.root->s.k == 0)) { + (void)pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, + "expression rejects all packets"); + rc = -1; + goto quit; + } + } + program->bf_insns = icode_to_fcode(&cstate.ic, + cstate.ic.root, &len, p->errbuf); + if (program->bf_insns == NULL) { + /* Failure */ + rc = -1; + goto quit; } - program->bf_insns = icode_to_fcode(&cstate, &cstate.ic, cstate.ic.root, &len); program->bf_len = len; rc = 0; /* We're all okay */ @@ -853,12 +929,19 @@ merge(struct block *b0, struct block *b1) *p = b1; } -void +int finish_parse(compiler_state_t *cstate, struct block *p) { struct block *ppi_dlt_check; /* + * Catch errors reported by us and routines below us, and return -1 + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (-1); + + /* * Insert before the statements of the first (root) block any * statements needed to load the lengths of any variable-length * headers into registers. @@ -900,6 +983,7 @@ finish_parse(compiler_state_t *cstate, struct block *p) p->sense = !p->sense; backpatch(p, gen_retblk(cstate, 0)); cstate->ic.root = p->head; + return (0); } void @@ -977,13 +1061,22 @@ gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, { register struct block *b, *tmp; + /* + * XXX - the actual *instructions* do unsigned comparisons on + * most platforms, and the load instructions don't do sign + * extension, so gen_cmp() should really take an unsigned + * value argument. + * + * As the load instructons also don't do sign-extension, we + * fetch the values from the byte array as unsigned. We don't + * want to use the signed versions of the extract calls. + */ b = NULL; while (size >= 4) { register const u_char *p = &v[size - 4]; - bpf_int32 w = ((bpf_int32)p[0] << 24) | - ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; - tmp = gen_cmp(cstate, offrel, offset + size - 4, BPF_W, w); + tmp = gen_cmp(cstate, offrel, offset + size - 4, BPF_W, + (bpf_int32)EXTRACT_32BITS(p)); if (b != NULL) gen_and(b, tmp); b = tmp; @@ -991,9 +1084,9 @@ gen_bcmp(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, } while (size >= 2) { register const u_char *p = &v[size - 2]; - bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; - tmp = gen_cmp(cstate, offrel, offset + size - 2, BPF_H, w); + tmp = gen_cmp(cstate, offrel, offset + size - 2, BPF_H, + (bpf_int32)EXTRACT_16BITS(p)); if (b != NULL) gen_and(b, tmp); b = tmp; @@ -1038,7 +1131,7 @@ gen_ncmp(compiler_state_t *cstate, enum e_offrel offrel, bpf_u_int32 offset, return b; } -static void +static int init_linktype(compiler_state_t *cstate, pcap_t *p) { cstate->pcap_fddipad = p->fddipad; @@ -1243,6 +1336,7 @@ init_linktype(compiler_state_t *cstate, pcap_t *p) cstate->off_linkhdr.is_variable = 1; /* Fall through, 802.11 doesn't have a variable link * prefix but is otherwise the same. */ + /* FALLTHROUGH */ case DLT_IEEE802_11: /* @@ -1332,13 +1426,20 @@ init_linktype(compiler_state_t *cstate, pcap_t *p) cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ break; - case DLT_LINUX_SLL: /* fake header for Linux cooked socket */ + case DLT_LINUX_SLL: /* fake header for Linux cooked socket v1 */ cstate->off_linktype.constant_part = 14; cstate->off_linkpl.constant_part = 16; cstate->off_nl = 0; cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ break; + case DLT_LINUX_SLL2: /* fake header for Linux cooked socket v2 */ + cstate->off_linktype.constant_part = 0; + cstate->off_linkpl.constant_part = 20; + cstate->off_nl = 0; + cstate->off_nl_nosnap = 0; /* no 802.2 LLC */ + break; + case DLT_LTALK: /* * LocalTalk does have a 1-byte type field in the LLAP header, @@ -1614,12 +1715,14 @@ init_linktype(compiler_state_t *cstate, pcap_t *p) cstate->off_nl = OFFSET_NOT_SET; cstate->off_nl_nosnap = OFFSET_NOT_SET; } else { - bpf_error(cstate, "unknown data link type %d", cstate->linktype); + bpf_set_error(cstate, "unknown data link type %d", cstate->linktype); + return (-1); } break; } cstate->off_outermostlinkhdr = cstate->off_prevlinkhdr = cstate->off_linkhdr; + return (0); } /* @@ -1671,6 +1774,19 @@ gen_load_a(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, { struct slist *s, *s2; + /* + * Squelch warnings from compilers that *don't* assume that + * offrel always has a valid enum value and therefore don't + * assume that we'll always go through one of the case arms. + * + * If we have a default case, compilers that *do* assume that + * will then complain about the default case code being + * unreachable. + * + * Damned if you do, damned if you don't. + */ + s = NULL; + switch (offrel) { case OR_PACKET: @@ -1734,10 +1850,6 @@ gen_load_a(compiler_state_t *cstate, enum e_offrel offrel, u_int offset, case OR_TRAN_IPV6: s = gen_load_absoffsetrel(cstate, &cstate->off_linkpl, cstate->off_nl + 40 + offset, size); break; - - default: - abort(); - /* NOTREACHED */ } return s; } @@ -2061,12 +2173,12 @@ gen_ipnet_linktype(compiler_state_t *cstate, int proto) case ETHERTYPE_IP: return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, (bpf_int32)IPH_AF_INET); - /* NOTREACHED */ + /*NOTREACHED*/ case ETHERTYPE_IPV6: return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_B, (bpf_int32)IPH_AF_INET6); - /* NOTREACHED */ + /*NOTREACHED*/ default: break; @@ -3043,7 +3155,7 @@ gen_linktype(compiler_state_t *cstate, int proto) default: bpf_error(cstate, "unsupported protocol over mpls"); - /* NOTREACHED */ + /*NOTREACHED*/ } } @@ -3064,7 +3176,6 @@ gen_linktype(compiler_state_t *cstate, int proto) gen_and(b0, b1); return b1; /*NOTREACHED*/ - break; case DLT_C_HDLC: switch (proto) { @@ -3076,9 +3187,7 @@ gen_linktype(compiler_state_t *cstate, int proto) default: return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); /*NOTREACHED*/ - break; } - break; case DLT_IEEE802_11: case DLT_PRISM_HEADER: @@ -3097,7 +3206,6 @@ gen_linktype(compiler_state_t *cstate, int proto) gen_and(b0, b1); return b1; /*NOTREACHED*/ - break; case DLT_FDDI: /* @@ -3105,7 +3213,6 @@ gen_linktype(compiler_state_t *cstate, int proto) */ return gen_llc_linktype(cstate, proto); /*NOTREACHED*/ - break; case DLT_IEEE802: /* @@ -3113,14 +3220,12 @@ gen_linktype(compiler_state_t *cstate, int proto) */ return gen_llc_linktype(cstate, proto); /*NOTREACHED*/ - break; case DLT_ATM_RFC1483: case DLT_ATM_CLIP: case DLT_IP_OVER_FC: return gen_llc_linktype(cstate, proto); /*NOTREACHED*/ - break; case DLT_SUNATM: /* @@ -3130,17 +3235,15 @@ gen_linktype(compiler_state_t *cstate, int proto) * * Check for LLC encapsulation and then check the protocol. */ - b0 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); b1 = gen_llc_linktype(cstate, proto); gen_and(b0, b1); return b1; /*NOTREACHED*/ - break; case DLT_LINUX_SLL: return gen_linux_sll_linktype(cstate, proto); /*NOTREACHED*/ - break; case DLT_SLIP: case DLT_SLIP_BSDOS: @@ -3166,7 +3269,6 @@ gen_linktype(compiler_state_t *cstate, int proto) return gen_false(cstate); /* always false */ } /*NOTREACHED*/ - break; case DLT_IPV4: /* @@ -3178,7 +3280,6 @@ gen_linktype(compiler_state_t *cstate, int proto) /* Checking for something other than IPv4; always false */ return gen_false(cstate); /*NOTREACHED*/ - break; case DLT_IPV6: /* @@ -3190,7 +3291,6 @@ gen_linktype(compiler_state_t *cstate, int proto) /* Checking for something other than IPv6; always false */ return gen_false(cstate); /*NOTREACHED*/ - break; case DLT_PPP: case DLT_PPP_PPPD: @@ -3203,7 +3303,6 @@ gen_linktype(compiler_state_t *cstate, int proto) proto = ethertype_to_ppptype(proto); return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); /*NOTREACHED*/ - break; case DLT_PPP_BSDOS: /* @@ -3230,7 +3329,6 @@ gen_linktype(compiler_state_t *cstate, int proto) (bpf_int32)proto); } /*NOTREACHED*/ - break; case DLT_NULL: case DLT_LOOP: @@ -3325,7 +3423,6 @@ gen_linktype(compiler_state_t *cstate, int proto) else return gen_false(cstate); /*NOTREACHED*/ - break; #endif /* HAVE_NET_PFVAR_H */ case DLT_ARCNET: @@ -3368,7 +3465,6 @@ gen_linktype(compiler_state_t *cstate, int proto) (bpf_int32)ARCTYPE_ATALK)); } /*NOTREACHED*/ - break; case DLT_LTALK: switch (proto) { @@ -3378,7 +3474,6 @@ gen_linktype(compiler_state_t *cstate, int proto) return gen_false(cstate); } /*NOTREACHED*/ - break; case DLT_FRELAY: /* @@ -3422,7 +3517,6 @@ gen_linktype(compiler_state_t *cstate, int proto) return gen_false(cstate); } /*NOTREACHED*/ - break; case DLT_MFR: bpf_error(cstate, "Multi-link Frame Relay link-layer type filtering not implemented"); @@ -3513,7 +3607,8 @@ gen_linktype(compiler_state_t *cstate, int proto) case DLT_RAIF1: bpf_error(cstate, "RAIF1 link-layer type filtering not implemented"); - case DLT_IPMB: + case DLT_IPMB_KONTRON: + case DLT_IPMB_LINUX: bpf_error(cstate, "IPMB link-layer type filtering not implemented"); case DLT_AX25_KISS: @@ -3540,20 +3635,16 @@ gen_linktype(compiler_state_t *cstate, int proto) * above.) */ return gen_cmp(cstate, OR_LINKTYPE, 0, BPF_H, (bpf_int32)proto); + /*NOTREACHED */ } else { /* * No; report an error. */ - description = pcap_datalink_val_to_description(cstate->linktype); - if (description != NULL) { - bpf_error(cstate, "%s link-layer type filtering not implemented", - description); - } else { - bpf_error(cstate, "DLT %u link-layer type filtering not implemented", - cstate->linktype); - } + description = pcap_datalink_val_to_description_or_dlt(cstate->linktype); + bpf_error(cstate, "%s link-layer type filtering not implemented", + description); + /*NOTREACHED */ } - break; } } @@ -3583,8 +3674,8 @@ gen_snap(compiler_state_t *cstate, bpf_u_int32 orgcode, bpf_u_int32 ptype) /* * Generate code to match frames with an LLC header. */ -struct block * -gen_llc(compiler_state_t *cstate) +static struct block * +gen_llc_internal(compiler_state_t *cstate) { struct block *b0, *b1; @@ -3611,7 +3702,7 @@ gen_llc(compiler_state_t *cstate) /* * We check for LLC traffic. */ - b0 = gen_atmtype_abbrev(cstate, A_LLC); + b0 = gen_atmtype_llc(cstate); return b0; case DLT_IEEE802: /* Token Ring */ @@ -3649,21 +3740,42 @@ gen_llc(compiler_state_t *cstate) return b0; default: - bpf_error(cstate, "'llc' not supported for linktype %d", cstate->linktype); - /* NOTREACHED */ + bpf_error(cstate, "'llc' not supported for %s", + pcap_datalink_val_to_description_or_dlt(cstate->linktype)); + /*NOTREACHED*/ } } struct block * +gen_llc(compiler_state_t *cstate) +{ + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + return gen_llc_internal(cstate); +} + +struct block * gen_llc_i(compiler_state_t *cstate) { struct block *b0, *b1; struct slist *s; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Check whether this is an LLC frame. */ - b0 = gen_llc(cstate); + b0 = gen_llc_internal(cstate); /* * Load the control byte and test the low-order bit; it must @@ -3684,9 +3796,16 @@ gen_llc_s(compiler_state_t *cstate) struct block *b0, *b1; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Check whether this is an LLC frame. */ - b0 = gen_llc(cstate); + b0 = gen_llc_internal(cstate); /* * Now compare the low-order 2 bit of the control byte against @@ -3703,9 +3822,16 @@ gen_llc_u(compiler_state_t *cstate) struct block *b0, *b1; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Check whether this is an LLC frame. */ - b0 = gen_llc(cstate); + b0 = gen_llc_internal(cstate); /* * Now compare the low-order 2 bit of the control byte against @@ -3722,9 +3848,16 @@ gen_llc_s_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) struct block *b0, *b1; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Check whether this is an LLC frame. */ - b0 = gen_llc(cstate); + b0 = gen_llc_internal(cstate); /* * Now check for an S frame with the appropriate type. @@ -3740,9 +3873,16 @@ gen_llc_u_subtype(compiler_state_t *cstate, bpf_u_int32 subtype) struct block *b0, *b1; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Check whether this is an LLC frame. */ - b0 = gen_llc(cstate); + b0 = gen_llc_internal(cstate); /* * Now check for a U frame with the appropriate type. @@ -3862,8 +4002,8 @@ gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, gen_and(b0, b1); return b1; - case Q_OR: case Q_DEFAULT: + case Q_OR: b0 = gen_hostop(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); b1 = gen_hostop(cstate, addr, mask, Q_DST, proto, src_off, dst_off); gen_or(b0, b1); @@ -3871,30 +4011,31 @@ gen_hostop(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ default: abort(); + /*NOTREACHED*/ } b0 = gen_linktype(cstate, proto); b1 = gen_mcmp(cstate, OR_LINKPL, offset, BPF_W, (bpf_int32)addr, mask); @@ -3927,8 +4068,8 @@ gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, gen_and(b0, b1); return b1; - case Q_OR: case Q_DEFAULT: + case Q_OR: b0 = gen_hostop6(cstate, addr, mask, Q_SRC, proto, src_off, dst_off); b1 = gen_hostop6(cstate, addr, mask, Q_DST, proto, src_off, dst_off); gen_or(b0, b1); @@ -3936,30 +4077,31 @@ gen_hostop6(compiler_state_t *cstate, struct in6_addr *addr, case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); - break; + /*NOTREACHED*/ default: abort(); + /*NOTREACHED*/ } /* this order is important */ a = (uint32_t *)addr; @@ -4004,30 +4146,30 @@ gen_ehostop(compiler_state_t *cstate, const u_char *eaddr, int dir) case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11 with 802.11 headers"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11 with 802.11 headers"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11 with 802.11 headers"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11 with 802.11 headers"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is only supported on 802.11 with 802.11 headers"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is only supported on 802.11 with 802.11 headers"); - break; + /*NOTREACHED*/ } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -4060,30 +4202,30 @@ gen_fhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is only supported on 802.11"); - break; + /*NOTREACHED*/ } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -4116,30 +4258,30 @@ gen_thostop(compiler_state_t *cstate, const u_char *eaddr, int dir) case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is only supported on 802.11"); - break; + /*NOTREACHED*/ } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -4428,6 +4570,68 @@ gen_wlanhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) gen_and(b1, b0); return b0; + case Q_AND: + b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); + b1 = gen_wlanhostop(cstate, eaddr, Q_DST); + gen_and(b0, b1); + return b1; + + case Q_DEFAULT: + case Q_OR: + b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); + b1 = gen_wlanhostop(cstate, eaddr, Q_DST); + gen_or(b0, b1); + return b1; + + /* + * XXX - add BSSID keyword? + */ + case Q_ADDR1: + return (gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr)); + + case Q_ADDR2: + /* + * Not present in CTS or ACK control frames. + */ + b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, + IEEE80211_FC0_TYPE_MASK); + gen_not(b0); + b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS, + IEEE80211_FC0_SUBTYPE_MASK); + gen_not(b1); + b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK, + IEEE80211_FC0_SUBTYPE_MASK); + gen_not(b2); + gen_and(b1, b2); + gen_or(b0, b2); + b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); + gen_and(b2, b1); + return b1; + + case Q_ADDR3: + /* + * Not present in control frames. + */ + b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, + IEEE80211_FC0_TYPE_MASK); + gen_not(b0); + b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); + gen_and(b0, b1); + return b1; + + case Q_ADDR4: + /* + * Present only if the direction mask has both "From DS" + * and "To DS" set. Neither control frames nor management + * frames should have both of those set, so we don't + * check the frame type. + */ + b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, + IEEE80211_FC1_DIR_DSTODS, IEEE80211_FC1_DIR_MASK); + b1 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr); + gen_and(b0, b1); + return b1; + case Q_RA: /* * Not present in management frames; addr1 in other @@ -4498,71 +4702,9 @@ gen_wlanhostop(compiler_state_t *cstate, const u_char *eaddr, int dir) b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); gen_and(b2, b1); return b1; - - /* - * XXX - add BSSID keyword? - */ - case Q_ADDR1: - return (gen_bcmp(cstate, OR_LINKHDR, 4, 6, eaddr)); - - case Q_ADDR2: - /* - * Not present in CTS or ACK control frames. - */ - b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, - IEEE80211_FC0_TYPE_MASK); - gen_not(b0); - b1 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS, - IEEE80211_FC0_SUBTYPE_MASK); - gen_not(b1); - b2 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK, - IEEE80211_FC0_SUBTYPE_MASK); - gen_not(b2); - gen_and(b1, b2); - gen_or(b0, b2); - b1 = gen_bcmp(cstate, OR_LINKHDR, 10, 6, eaddr); - gen_and(b2, b1); - return b1; - - case Q_ADDR3: - /* - * Not present in control frames. - */ - b0 = gen_mcmp(cstate, OR_LINKHDR, 0, BPF_B, IEEE80211_FC0_TYPE_CTL, - IEEE80211_FC0_TYPE_MASK); - gen_not(b0); - b1 = gen_bcmp(cstate, OR_LINKHDR, 16, 6, eaddr); - gen_and(b0, b1); - return b1; - - case Q_ADDR4: - /* - * Present only if the direction mask has both "From DS" - * and "To DS" set. Neither control frames nor management - * frames should have both of those set, so we don't - * check the frame type. - */ - b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, - IEEE80211_FC1_DIR_DSTODS, IEEE80211_FC1_DIR_MASK); - b1 = gen_bcmp(cstate, OR_LINKHDR, 24, 6, eaddr); - gen_and(b0, b1); - return b1; - - case Q_AND: - b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); - b1 = gen_wlanhostop(cstate, eaddr, Q_DST); - gen_and(b0, b1); - return b1; - - case Q_DEFAULT: - case Q_OR: - b0 = gen_wlanhostop(cstate, eaddr, Q_SRC); - b1 = gen_wlanhostop(cstate, eaddr, Q_DST); - gen_or(b0, b1); - return b1; } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -4597,30 +4739,30 @@ gen_ipfchostop(compiler_state_t *cstate, const u_char *eaddr, int dir) case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is only supported on 802.11"); - break; + /*NOTREACHED*/ } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -4667,19 +4809,41 @@ gen_dnhostop(compiler_state_t *cstate, bpf_u_int32 addr, int dir) gen_and(b0, b1); return b1; - case Q_OR: case Q_DEFAULT: + case Q_OR: /* Inefficient because we do our Calvinball dance twice */ b0 = gen_dnhostop(cstate, addr, Q_SRC); b1 = gen_dnhostop(cstate, addr, Q_DST); gen_or(b0, b1); return b1; - case Q_ISO: - bpf_error(cstate, "ISO host filtering not implemented"); + case Q_ADDR1: + bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for addresses other than 802.11 MAC addresses"); + /*NOTREACHED*/ + + case Q_ADDR2: + bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for addresses other than 802.11 MAC addresses"); + /*NOTREACHED*/ + + case Q_ADDR3: + bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for addresses other than 802.11 MAC addresses"); + /*NOTREACHED*/ + + case Q_ADDR4: + bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for addresses other than 802.11 MAC addresses"); + /*NOTREACHED*/ + + case Q_RA: + bpf_error(cstate, "'ra' is not a valid qualifier for addresses other than 802.11 MAC addresses"); + /*NOTREACHED*/ + + case Q_TA: + bpf_error(cstate, "'ta' is not a valid qualifier for addresses other than 802.11 MAC addresses"); + /*NOTREACHED*/ default: abort(); + /*NOTREACHED*/ } b0 = gen_linktype(cstate, ETHERTYPE_DN); /* Check for pad = 1, long header case */ @@ -4771,6 +4935,9 @@ gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, } return b0; + case Q_LINK: + bpf_error(cstate, "link-layer modifier applied to %s", typestr); + case Q_IP: return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_IP, 12, 16); @@ -4780,12 +4947,12 @@ gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, case Q_ARP: return gen_hostop(cstate, addr, mask, dir, ETHERTYPE_ARP, 14, 24); - case Q_TCP: - bpf_error(cstate, "'tcp' modifier applied to %s", typestr); - case Q_SCTP: bpf_error(cstate, "'sctp' modifier applied to %s", typestr); + case Q_TCP: + bpf_error(cstate, "'tcp' modifier applied to %s", typestr); + case Q_UDP: bpf_error(cstate, "'udp' modifier applied to %s", typestr); @@ -4798,36 +4965,24 @@ gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, case Q_IGRP: bpf_error(cstate, "'igrp' modifier applied to %s", typestr); - case Q_PIM: - bpf_error(cstate, "'pim' modifier applied to %s", typestr); - - case Q_VRRP: - bpf_error(cstate, "'vrrp' modifier applied to %s", typestr); - - case Q_CARP: - bpf_error(cstate, "'carp' modifier applied to %s", typestr); - case Q_ATALK: - bpf_error(cstate, "ATALK host filtering not implemented"); - - case Q_AARP: - bpf_error(cstate, "AARP host filtering not implemented"); + bpf_error(cstate, "AppleTalk host filtering not implemented"); case Q_DECNET: return gen_dnhostop(cstate, addr, dir); - case Q_SCA: - bpf_error(cstate, "SCA host filtering not implemented"); - case Q_LAT: bpf_error(cstate, "LAT host filtering not implemented"); - case Q_MOPDL: - bpf_error(cstate, "MOPDL host filtering not implemented"); + case Q_SCA: + bpf_error(cstate, "SCA host filtering not implemented"); case Q_MOPRC: bpf_error(cstate, "MOPRC host filtering not implemented"); + case Q_MOPDL: + bpf_error(cstate, "MOPDL host filtering not implemented"); + case Q_IPV6: bpf_error(cstate, "'ip6' modifier applied to ip host"); @@ -4840,6 +4995,15 @@ gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, case Q_ESP: bpf_error(cstate, "'esp' modifier applied to %s", typestr); + case Q_PIM: + bpf_error(cstate, "'pim' modifier applied to %s", typestr); + + case Q_VRRP: + bpf_error(cstate, "'vrrp' modifier applied to %s", typestr); + + case Q_AARP: + bpf_error(cstate, "AARP host filtering not implemented"); + case Q_ISO: bpf_error(cstate, "ISO host filtering not implemented"); @@ -4861,13 +5025,37 @@ gen_host(compiler_state_t *cstate, bpf_u_int32 addr, bpf_u_int32 mask, case Q_NETBEUI: bpf_error(cstate, "'netbeui' modifier applied to %s", typestr); + case Q_ISIS_L1: + bpf_error(cstate, "'l1' modifier applied to %s", typestr); + + case Q_ISIS_L2: + bpf_error(cstate, "'l2' modifier applied to %s", typestr); + + case Q_ISIS_IIH: + bpf_error(cstate, "'iih' modifier applied to %s", typestr); + + case Q_ISIS_SNP: + bpf_error(cstate, "'snp' modifier applied to %s", typestr); + + case Q_ISIS_CSNP: + bpf_error(cstate, "'csnp' modifier applied to %s", typestr); + + case Q_ISIS_PSNP: + bpf_error(cstate, "'psnp' modifier applied to %s", typestr); + + case Q_ISIS_LSP: + bpf_error(cstate, "'lsp' modifier applied to %s", typestr); + case Q_RADIO: bpf_error(cstate, "'radio' modifier applied to %s", typestr); + case Q_CARP: + bpf_error(cstate, "'carp' modifier applied to %s", typestr); + default: abort(); } - /* NOTREACHED */ + /*NOTREACHED*/ } #ifdef INET6 @@ -4900,93 +5088,114 @@ gen_host6(compiler_state_t *cstate, struct in6_addr *addr, bpf_error(cstate, "'arp' modifier applied to ip6 %s", typestr); case Q_SCTP: - bpf_error(cstate, "'sctp' modifier applied to %s", typestr); + bpf_error(cstate, "'sctp' modifier applied to ip6 %s", typestr); case Q_TCP: - bpf_error(cstate, "'tcp' modifier applied to %s", typestr); + bpf_error(cstate, "'tcp' modifier applied to ip6 %s", typestr); case Q_UDP: - bpf_error(cstate, "'udp' modifier applied to %s", typestr); + bpf_error(cstate, "'udp' modifier applied to ip6 %s", typestr); case Q_ICMP: - bpf_error(cstate, "'icmp' modifier applied to %s", typestr); + bpf_error(cstate, "'icmp' modifier applied to ip6 %s", typestr); case Q_IGMP: - bpf_error(cstate, "'igmp' modifier applied to %s", typestr); + bpf_error(cstate, "'igmp' modifier applied to ip6 %s", typestr); case Q_IGRP: - bpf_error(cstate, "'igrp' modifier applied to %s", typestr); - - case Q_PIM: - bpf_error(cstate, "'pim' modifier applied to %s", typestr); - - case Q_VRRP: - bpf_error(cstate, "'vrrp' modifier applied to %s", typestr); - - case Q_CARP: - bpf_error(cstate, "'carp' modifier applied to %s", typestr); + bpf_error(cstate, "'igrp' modifier applied to ip6 %s", typestr); case Q_ATALK: - bpf_error(cstate, "ATALK host filtering not implemented"); - - case Q_AARP: - bpf_error(cstate, "AARP host filtering not implemented"); + bpf_error(cstate, "AppleTalk modifier applied to ip6 %s", typestr); case Q_DECNET: bpf_error(cstate, "'decnet' modifier applied to ip6 %s", typestr); - case Q_SCA: - bpf_error(cstate, "SCA host filtering not implemented"); - case Q_LAT: - bpf_error(cstate, "LAT host filtering not implemented"); + bpf_error(cstate, "'lat' modifier applied to ip6 %s", typestr); - case Q_MOPDL: - bpf_error(cstate, "MOPDL host filtering not implemented"); + case Q_SCA: + bpf_error(cstate, "'sca' modifier applied to ip6 %s", typestr); case Q_MOPRC: - bpf_error(cstate, "MOPRC host filtering not implemented"); + bpf_error(cstate, "'moprc' modifier applied to ip6 %s", typestr); + + case Q_MOPDL: + bpf_error(cstate, "'mopdl' modifier applied to ip6 %s", typestr); case Q_IPV6: return gen_hostop6(cstate, addr, mask, dir, ETHERTYPE_IPV6, 8, 24); case Q_ICMPV6: - bpf_error(cstate, "'icmp6' modifier applied to %s", typestr); + bpf_error(cstate, "'icmp6' modifier applied to ip6 %s", typestr); case Q_AH: - bpf_error(cstate, "'ah' modifier applied to %s", typestr); + bpf_error(cstate, "'ah' modifier applied to ip6 %s", typestr); case Q_ESP: - bpf_error(cstate, "'esp' modifier applied to %s", typestr); + bpf_error(cstate, "'esp' modifier applied to ip6 %s", typestr); + + case Q_PIM: + bpf_error(cstate, "'pim' modifier applied to ip6 %s", typestr); + + case Q_VRRP: + bpf_error(cstate, "'vrrp' modifier applied to ip6 %s", typestr); + + case Q_AARP: + bpf_error(cstate, "'aarp' modifier applied to ip6 %s", typestr); case Q_ISO: - bpf_error(cstate, "ISO host filtering not implemented"); + bpf_error(cstate, "'iso' modifier applied to ip6 %s", typestr); case Q_ESIS: - bpf_error(cstate, "'esis' modifier applied to %s", typestr); + bpf_error(cstate, "'esis' modifier applied to ip6 %s", typestr); case Q_ISIS: - bpf_error(cstate, "'isis' modifier applied to %s", typestr); + bpf_error(cstate, "'isis' modifier applied to ip6 %s", typestr); case Q_CLNP: - bpf_error(cstate, "'clnp' modifier applied to %s", typestr); + bpf_error(cstate, "'clnp' modifier applied to ip6 %s", typestr); case Q_STP: - bpf_error(cstate, "'stp' modifier applied to %s", typestr); + bpf_error(cstate, "'stp' modifier applied to ip6 %s", typestr); case Q_IPX: - bpf_error(cstate, "IPX host filtering not implemented"); + bpf_error(cstate, "'ipx' modifier applied to ip6 %s", typestr); case Q_NETBEUI: - bpf_error(cstate, "'netbeui' modifier applied to %s", typestr); + bpf_error(cstate, "'netbeui' modifier applied to ip6 %s", typestr); + + case Q_ISIS_L1: + bpf_error(cstate, "'l1' modifier applied to ip6 %s", typestr); + + case Q_ISIS_L2: + bpf_error(cstate, "'l2' modifier applied to ip6 %s", typestr); + + case Q_ISIS_IIH: + bpf_error(cstate, "'iih' modifier applied to ip6 %s", typestr); + + case Q_ISIS_SNP: + bpf_error(cstate, "'snp' modifier applied to ip6 %s", typestr); + + case Q_ISIS_CSNP: + bpf_error(cstate, "'csnp' modifier applied to ip6 %s", typestr); + + case Q_ISIS_PSNP: + bpf_error(cstate, "'psnp' modifier applied to ip6 %s", typestr); + + case Q_ISIS_LSP: + bpf_error(cstate, "'lsp' modifier applied to ip6 %s", typestr); case Q_RADIO: - bpf_error(cstate, "'radio' modifier applied to %s", typestr); + bpf_error(cstate, "'radio' modifier applied to ip6 %s", typestr); + + case Q_CARP: + bpf_error(cstate, "'carp' modifier applied to ip6 %s", typestr); default: abort(); } - /* NOTREACHED */ + /*NOTREACHED*/ } #endif @@ -5093,12 +5302,12 @@ gen_gateway(compiler_state_t *cstate, const u_char *eaddr, return b1; } bpf_error(cstate, "illegal modifier of 'gateway'"); - /* NOTREACHED */ + /*NOTREACHED*/ } #endif -struct block * -gen_proto_abbrev(compiler_state_t *cstate, int proto) +static struct block * +gen_proto_abbrev_internal(compiler_state_t *cstate, int proto) { struct block *b0; struct block *b1; @@ -5337,6 +5546,19 @@ gen_proto_abbrev(compiler_state_t *cstate, int proto) return b1; } +struct block * +gen_proto_abbrev(compiler_state_t *cstate, int proto) +{ + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + return gen_proto_abbrev_internal(cstate, proto); +} + static struct block * gen_ipfrag(compiler_state_t *cstate) { @@ -5393,21 +5615,46 @@ gen_portop(compiler_state_t *cstate, int port, int proto, int dir) b1 = gen_portatom(cstate, 2, (bpf_int32)port); break; - case Q_OR: - case Q_DEFAULT: + case Q_AND: tmp = gen_portatom(cstate, 0, (bpf_int32)port); b1 = gen_portatom(cstate, 2, (bpf_int32)port); - gen_or(tmp, b1); + gen_and(tmp, b1); break; - case Q_AND: + case Q_DEFAULT: + case Q_OR: tmp = gen_portatom(cstate, 0, (bpf_int32)port); b1 = gen_portatom(cstate, 2, (bpf_int32)port); - gen_and(tmp, b1); + gen_or(tmp, b1); break; + case Q_ADDR1: + bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for ports"); + /*NOTREACHED*/ + + case Q_ADDR2: + bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for ports"); + /*NOTREACHED*/ + + case Q_ADDR3: + bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for ports"); + /*NOTREACHED*/ + + case Q_ADDR4: + bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for ports"); + /*NOTREACHED*/ + + case Q_RA: + bpf_error(cstate, "'ra' is not a valid qualifier for ports"); + /*NOTREACHED*/ + + case Q_TA: + bpf_error(cstate, "'ta' is not a valid qualifier for ports"); + /*NOTREACHED*/ + default: abort(); + /*NOTREACHED*/ } gen_and(b0, b1); @@ -5478,17 +5725,17 @@ gen_portop6(compiler_state_t *cstate, int port, int proto, int dir) b1 = gen_portatom6(cstate, 2, (bpf_int32)port); break; - case Q_OR: - case Q_DEFAULT: + case Q_AND: tmp = gen_portatom6(cstate, 0, (bpf_int32)port); b1 = gen_portatom6(cstate, 2, (bpf_int32)port); - gen_or(tmp, b1); + gen_and(tmp, b1); break; - case Q_AND: + case Q_DEFAULT: + case Q_OR: tmp = gen_portatom6(cstate, 0, (bpf_int32)port); b1 = gen_portatom6(cstate, 2, (bpf_int32)port); - gen_and(tmp, b1); + gen_or(tmp, b1); break; default: @@ -5575,21 +5822,46 @@ gen_portrangeop(compiler_state_t *cstate, int port1, int port2, int proto, b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); break; - case Q_OR: - case Q_DEFAULT: + case Q_AND: tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); - gen_or(tmp, b1); + gen_and(tmp, b1); break; - case Q_AND: + case Q_DEFAULT: + case Q_OR: tmp = gen_portrangeatom(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); b1 = gen_portrangeatom(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); - gen_and(tmp, b1); + gen_or(tmp, b1); break; + case Q_ADDR1: + bpf_error(cstate, "'addr1' and 'address1' are not valid qualifiers for port ranges"); + /*NOTREACHED*/ + + case Q_ADDR2: + bpf_error(cstate, "'addr2' and 'address2' are not valid qualifiers for port ranges"); + /*NOTREACHED*/ + + case Q_ADDR3: + bpf_error(cstate, "'addr3' and 'address3' are not valid qualifiers for port ranges"); + /*NOTREACHED*/ + + case Q_ADDR4: + bpf_error(cstate, "'addr4' and 'address4' are not valid qualifiers for port ranges"); + /*NOTREACHED*/ + + case Q_RA: + bpf_error(cstate, "'ra' is not a valid qualifier for port ranges"); + /*NOTREACHED*/ + + case Q_TA: + bpf_error(cstate, "'ta' is not a valid qualifier for port ranges"); + /*NOTREACHED*/ + default: abort(); + /*NOTREACHED*/ } gen_and(b0, b1); @@ -5671,17 +5943,17 @@ gen_portrangeop6(compiler_state_t *cstate, int port1, int port2, int proto, b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); break; - case Q_OR: - case Q_DEFAULT: + case Q_AND: tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); - gen_or(tmp, b1); + gen_and(tmp, b1); break; - case Q_AND: + case Q_DEFAULT: + case Q_OR: tmp = gen_portrangeatom6(cstate, 0, (bpf_int32)port1, (bpf_int32)port2); b1 = gen_portrangeatom6(cstate, 2, (bpf_int32)port1, (bpf_int32)port2); - gen_and(tmp, b1); + gen_or(tmp, b1); break; default: @@ -6118,6 +6390,9 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) gen_or(b0, b1); return b1; + case Q_LINK: + return gen_linktype(cstate, v); + case Q_IP: /* * For FDDI, RFC 1188 says that SNAP encapsulation is used, @@ -6143,6 +6418,104 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) gen_and(b0, b1); return b1; + case Q_ARP: + bpf_error(cstate, "arp does not encapsulate another protocol"); + /*NOTREACHED*/ + + case Q_RARP: + bpf_error(cstate, "rarp does not encapsulate another protocol"); + /*NOTREACHED*/ + + case Q_SCTP: + bpf_error(cstate, "'sctp proto' is bogus"); + /*NOTREACHED*/ + + case Q_TCP: + bpf_error(cstate, "'tcp proto' is bogus"); + /*NOTREACHED*/ + + case Q_UDP: + bpf_error(cstate, "'udp proto' is bogus"); + /*NOTREACHED*/ + + case Q_ICMP: + bpf_error(cstate, "'icmp proto' is bogus"); + /*NOTREACHED*/ + + case Q_IGMP: + bpf_error(cstate, "'igmp proto' is bogus"); + /*NOTREACHED*/ + + case Q_IGRP: + bpf_error(cstate, "'igrp proto' is bogus"); + /*NOTREACHED*/ + + case Q_ATALK: + bpf_error(cstate, "AppleTalk encapsulation is not specifiable"); + /*NOTREACHED*/ + + case Q_DECNET: + bpf_error(cstate, "DECNET encapsulation is not specifiable"); + /*NOTREACHED*/ + + case Q_LAT: + bpf_error(cstate, "LAT does not encapsulate another protocol"); + /*NOTREACHED*/ + + case Q_SCA: + bpf_error(cstate, "SCA does not encapsulate another protocol"); + /*NOTREACHED*/ + + case Q_MOPRC: + bpf_error(cstate, "MOPRC does not encapsulate another protocol"); + /*NOTREACHED*/ + + case Q_MOPDL: + bpf_error(cstate, "MOPDL does not encapsulate another protocol"); + /*NOTREACHED*/ + + case Q_IPV6: + b0 = gen_linktype(cstate, ETHERTYPE_IPV6); +#ifndef CHASE_CHAIN + /* + * Also check for a fragment header before the final + * header. + */ + b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, IPPROTO_FRAGMENT); + b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, (bpf_int32)v); + gen_and(b2, b1); + b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)v); + gen_or(b2, b1); +#else + b1 = gen_protochain(cstate, v, Q_IPV6); +#endif + gen_and(b0, b1); + return b1; + + case Q_ICMPV6: + bpf_error(cstate, "'icmp6 proto' is bogus"); + /*NOTREACHED*/ + + case Q_AH: + bpf_error(cstate, "'ah proto' is bogus"); + /*NOTREACHED*/ + + case Q_ESP: + bpf_error(cstate, "'ah proto' is bogus"); + /*NOTREACHED*/ + + case Q_PIM: + bpf_error(cstate, "'pim proto' is bogus"); + /*NOTREACHED*/ + + case Q_VRRP: + bpf_error(cstate, "'vrrp proto' is bogus"); + /*NOTREACHED*/ + + case Q_AARP: + bpf_error(cstate, "'aarp proto' is bogus"); + /*NOTREACHED*/ + case Q_ISO: switch (cstate->linktype) { @@ -6167,7 +6540,6 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) */ return gen_cmp(cstate, OR_LINKHDR, 2, BPF_H, (0x03<<8) | v); /*NOTREACHED*/ - break; case DLT_C_HDLC: /* @@ -6187,6 +6559,10 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) return b1; } + case Q_ESIS: + bpf_error(cstate, "'esis proto' is bogus"); + /*NOTREACHED*/ + case Q_ISIS: b0 = gen_proto(cstate, ISO10589_ISIS, Q_ISO, Q_DEFAULT); /* @@ -6197,121 +6573,63 @@ gen_proto(compiler_state_t *cstate, int v, int proto, int dir) gen_and(b0, b1); return b1; - case Q_ARP: - bpf_error(cstate, "arp does not encapsulate another protocol"); - /* NOTREACHED */ - - case Q_RARP: - bpf_error(cstate, "rarp does not encapsulate another protocol"); - /* NOTREACHED */ - - case Q_ATALK: - bpf_error(cstate, "atalk encapsulation is not specifiable"); - /* NOTREACHED */ - - case Q_DECNET: - bpf_error(cstate, "decnet encapsulation is not specifiable"); - /* NOTREACHED */ - - case Q_SCA: - bpf_error(cstate, "sca does not encapsulate another protocol"); - /* NOTREACHED */ - - case Q_LAT: - bpf_error(cstate, "lat does not encapsulate another protocol"); - /* NOTREACHED */ + case Q_CLNP: + bpf_error(cstate, "'clnp proto' is not supported"); + /*NOTREACHED*/ - case Q_MOPRC: - bpf_error(cstate, "moprc does not encapsulate another protocol"); - /* NOTREACHED */ + case Q_STP: + bpf_error(cstate, "'stp proto' is bogus"); + /*NOTREACHED*/ - case Q_MOPDL: - bpf_error(cstate, "mopdl does not encapsulate another protocol"); - /* NOTREACHED */ + case Q_IPX: + bpf_error(cstate, "'ipx proto' is bogus"); + /*NOTREACHED*/ - case Q_LINK: - return gen_linktype(cstate, v); + case Q_NETBEUI: + bpf_error(cstate, "'netbeui proto' is bogus"); + /*NOTREACHED*/ - case Q_UDP: - bpf_error(cstate, "'udp proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_L1: + bpf_error(cstate, "'l1 proto' is bogus"); + /*NOTREACHED*/ - case Q_TCP: - bpf_error(cstate, "'tcp proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_L2: + bpf_error(cstate, "'l2 proto' is bogus"); + /*NOTREACHED*/ - case Q_SCTP: - bpf_error(cstate, "'sctp proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_IIH: + bpf_error(cstate, "'iih proto' is bogus"); + /*NOTREACHED*/ - case Q_ICMP: - bpf_error(cstate, "'icmp proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_SNP: + bpf_error(cstate, "'snp proto' is bogus"); + /*NOTREACHED*/ - case Q_IGMP: - bpf_error(cstate, "'igmp proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_CSNP: + bpf_error(cstate, "'csnp proto' is bogus"); + /*NOTREACHED*/ - case Q_IGRP: - bpf_error(cstate, "'igrp proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_PSNP: + bpf_error(cstate, "'psnp proto' is bogus"); + /*NOTREACHED*/ - case Q_PIM: - bpf_error(cstate, "'pim proto' is bogus"); - /* NOTREACHED */ + case Q_ISIS_LSP: + bpf_error(cstate, "'lsp proto' is bogus"); + /*NOTREACHED*/ - case Q_VRRP: - bpf_error(cstate, "'vrrp proto' is bogus"); - /* NOTREACHED */ + case Q_RADIO: + bpf_error(cstate, "'radio proto' is bogus"); + /*NOTREACHED*/ case Q_CARP: bpf_error(cstate, "'carp proto' is bogus"); - /* NOTREACHED */ - - case Q_IPV6: - b0 = gen_linktype(cstate, ETHERTYPE_IPV6); -#ifndef CHASE_CHAIN - /* - * Also check for a fragment header before the final - * header. - */ - b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, IPPROTO_FRAGMENT); - b1 = gen_cmp(cstate, OR_LINKPL, 40, BPF_B, (bpf_int32)v); - gen_and(b2, b1); - b2 = gen_cmp(cstate, OR_LINKPL, 6, BPF_B, (bpf_int32)v); - gen_or(b2, b1); -#else - b1 = gen_protochain(cstate, v, Q_IPV6); -#endif - gen_and(b0, b1); - return b1; - - case Q_ICMPV6: - bpf_error(cstate, "'icmp6 proto' is bogus"); - - case Q_AH: - bpf_error(cstate, "'ah proto' is bogus"); - - case Q_ESP: - bpf_error(cstate, "'ah proto' is bogus"); - - case Q_STP: - bpf_error(cstate, "'stp proto' is bogus"); - - case Q_IPX: - bpf_error(cstate, "'ipx proto' is bogus"); - - case Q_NETBEUI: - bpf_error(cstate, "'netbeui proto' is bogus"); - - case Q_RADIO: - bpf_error(cstate, "'radio proto' is bogus"); + /*NOTREACHED*/ default: abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * @@ -6333,6 +6651,13 @@ gen_scode(compiler_state_t *cstate, const char *name, struct qual q) int port, real_proto; int port1, port2; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (q.addr) { case Q_NET: @@ -6611,10 +6936,10 @@ gen_scode(compiler_state_t *cstate, const char *name, struct qual q) case Q_UNDEF: syntax(cstate); - /* NOTREACHED */ + /*NOTREACHED*/ } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * @@ -6624,12 +6949,23 @@ gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2, register int nlen, mlen; bpf_u_int32 n, m; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + nlen = __pcap_atoin(s1, &n); + if (nlen < 0) + bpf_error(cstate, "invalid IPv4 address '%s'", s1); /* Promote short ipaddr */ n <<= 32 - nlen; if (s2 != NULL) { mlen = __pcap_atoin(s2, &m); + if (mlen < 0) + bpf_error(cstate, "invalid IPv4 address '%s'", s2); /* Promote short ipaddr */ m <<= 32 - mlen; if ((n & ~m) != 0) @@ -6659,27 +6995,39 @@ gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2, default: bpf_error(cstate, "Mask syntax for networks only"); - /* NOTREACHED */ + /*NOTREACHED*/ } - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) { bpf_u_int32 mask; - int proto = q.proto; - int dir = q.dir; + int proto; + int dir; register int vlen; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + proto = q.proto; + dir = q.dir; if (s == NULL) vlen = 32; else if (q.proto == Q_DECNET) { vlen = __pcap_atodn(s, &v); if (vlen == 0) bpf_error(cstate, "malformed decnet address '%s'", s); - } else + } else { vlen = __pcap_atoin(s, &v); + if (vlen < 0) + bpf_error(cstate, "invalid IPv4 address '%s'", s); + } switch (q.addr) { @@ -6752,7 +7100,7 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) case Q_GATEWAY: bpf_error(cstate, "'gateway' requires a name"); - /* NOTREACHED */ + /*NOTREACHED*/ case Q_PROTO: return gen_proto(cstate, (int)v, proto, dir); @@ -6762,13 +7110,13 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q) case Q_UNDEF: syntax(cstate); - /* NOTREACHED */ + /*NOTREACHED*/ default: abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } - /* NOTREACHED */ + /*NOTREACHED*/ } #ifdef INET6 @@ -6782,6 +7130,13 @@ gen_mcode6(compiler_state_t *cstate, const char *s1, const char *s2, struct block *b; uint32_t *a, *m; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (s2) bpf_error(cstate, "no mask %s supported", s2); @@ -6825,45 +7180,64 @@ gen_mcode6(compiler_state_t *cstate, const char *s1, const char *s2, default: bpf_error(cstate, "invalid qualifier against IPv6 address"); - /* NOTREACHED */ + /*NOTREACHED*/ } } #endif /*INET6*/ struct block * -gen_ecode(compiler_state_t *cstate, const u_char *eaddr, struct qual q) +gen_ecode(compiler_state_t *cstate, const char *s, struct qual q) { struct block *b, *tmp; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { + cstate->e = pcap_ether_aton(s); + if (cstate->e == NULL) + bpf_error(cstate, "malloc"); switch (cstate->linktype) { case DLT_EN10MB: case DLT_NETANALYZER: case DLT_NETANALYZER_TRANSPARENT: tmp = gen_prevlinkhdr_check(cstate); - b = gen_ehostop(cstate, eaddr, (int)q.dir); + b = gen_ehostop(cstate, cstate->e, (int)q.dir); if (tmp != NULL) gen_and(tmp, b); - return b; + break; case DLT_FDDI: - return gen_fhostop(cstate, eaddr, (int)q.dir); + b = gen_fhostop(cstate, cstate->e, (int)q.dir); + break; case DLT_IEEE802: - return gen_thostop(cstate, eaddr, (int)q.dir); + b = gen_thostop(cstate, cstate->e, (int)q.dir); + break; case DLT_IEEE802_11: case DLT_PRISM_HEADER: case DLT_IEEE802_11_RADIO_AVS: case DLT_IEEE802_11_RADIO: case DLT_PPI: - return gen_wlanhostop(cstate, eaddr, (int)q.dir); + b = gen_wlanhostop(cstate, cstate->e, (int)q.dir); + break; case DLT_IP_OVER_FC: - return gen_ipfchostop(cstate, eaddr, (int)q.dir); + b = gen_ipfchostop(cstate, cstate->e, (int)q.dir); + break; default: + free(cstate->e); + cstate->e = NULL; bpf_error(cstate, "ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel"); - break; + /*NOTREACHED*/ } + free(cstate->e); + cstate->e = NULL; + return (b); } bpf_error(cstate, "ethernet address used in non-ether expression"); - /* NOTREACHED */ + /*NOTREACHED*/ } void @@ -6905,8 +7279,8 @@ xfer_to_a(compiler_state_t *cstate, struct arth *a) * (1, 2, or 4) at that offset into that register, making it the register * for "index". */ -struct arth * -gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) +static struct arth * +gen_load_internal(compiler_state_t *cstate, int proto, struct arth *inst, int size) { struct slist *s, *tmp; struct block *b; @@ -7052,7 +7426,7 @@ gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) * Do the computation only if the packet contains * the protocol in question. */ - b = gen_proto_abbrev(cstate, proto); + b = gen_proto_abbrev_internal(cstate, proto); if (inst->b) gen_and(inst->b, b); inst->b = b; @@ -7110,10 +7484,10 @@ gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) * if this is an IP datagram and is the first or * only fragment of that datagram. */ - gen_and(gen_proto_abbrev(cstate, proto), b = gen_ipfrag(cstate)); + gen_and(gen_proto_abbrev_internal(cstate, proto), b = gen_ipfrag(cstate)); if (inst->b) gen_and(inst->b, b); - gen_and(gen_proto_abbrev(cstate, Q_IP), b); + gen_and(gen_proto_abbrev_internal(cstate, Q_IP), b); inst->b = b; break; case Q_ICMPV6: @@ -7121,7 +7495,7 @@ gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) * Do the computation only if the packet contains * the protocol in question. */ - b = gen_proto_abbrev(cstate, Q_IPV6); + b = gen_proto_abbrev_internal(cstate, Q_IPV6); if (inst->b) { gen_and(inst->b, b); } @@ -7178,8 +7552,21 @@ gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) return inst; } -struct block * -gen_relation(compiler_state_t *cstate, int code, struct arth *a0, +struct arth * +gen_load(compiler_state_t *cstate, int proto, struct arth *inst, int size) +{ + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + return gen_load_internal(cstate, proto, inst, size); +} + +static struct block * +gen_relation_internal(compiler_state_t *cstate, int code, struct arth *a0, struct arth *a1, int reversed) { struct slist *s0, *s1, *s2; @@ -7222,13 +7609,36 @@ gen_relation(compiler_state_t *cstate, int code, struct arth *a0, return b; } +struct block * +gen_relation(compiler_state_t *cstate, int code, struct arth *a0, + struct arth *a1, int reversed) +{ + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + return gen_relation_internal(cstate, code, a0, a1, reversed); +} + struct arth * gen_loadlen(compiler_state_t *cstate) { - int regno = alloc_reg(cstate); - struct arth *a = (struct arth *)newchunk(cstate, sizeof(*a)); + int regno; + struct arth *a; struct slist *s; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + regno = alloc_reg(cstate); + a = (struct arth *)newchunk(cstate, sizeof(*a)); s = new_stmt(cstate, BPF_LD|BPF_LEN); s->next = new_stmt(cstate, BPF_ST); s->next->s.k = regno; @@ -7238,8 +7648,8 @@ gen_loadlen(compiler_state_t *cstate) return a; } -struct arth * -gen_loadi(compiler_state_t *cstate, int val) +static struct arth * +gen_loadi_internal(compiler_state_t *cstate, int val) { struct arth *a; struct slist *s; @@ -7260,10 +7670,36 @@ gen_loadi(compiler_state_t *cstate, int val) } struct arth * -gen_neg(compiler_state_t *cstate, struct arth *a) +gen_loadi(compiler_state_t *cstate, int val) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + return gen_loadi_internal(cstate, val); +} + +/* + * The a_arg dance is to avoid annoying whining by compilers that + * a might be clobbered by longjmp - yeah, it might, but *WHO CARES*? + * It's not *used* after setjmp returns. + */ +struct arth * +gen_neg(compiler_state_t *cstate, struct arth *a_arg) +{ + struct arth *a = a_arg; struct slist *s; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + s = xfer_to_a(cstate, a); sappend(a->s, s); s = new_stmt(cstate, BPF_ALU|BPF_NEG); @@ -7276,15 +7712,31 @@ gen_neg(compiler_state_t *cstate, struct arth *a) return a; } +/* + * The a0_arg dance is to avoid annoying whining by compilers that + * a0 might be clobbered by longjmp - yeah, it might, but *WHO CARES*? + * It's not *used* after setjmp returns. + */ struct arth * -gen_arth(compiler_state_t *cstate, int code, struct arth *a0, +gen_arth(compiler_state_t *cstate, int code, struct arth *a0_arg, struct arth *a1) { + struct arth *a0 = a0_arg; struct slist *s0, *s1, *s2; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Disallow division by, or modulus by, zero; we do this here * so that it gets done even if the optimizer is disabled. + * + * Also disallow shifts by a value greater than 31; we do this + * here, for the same reason. */ if (code == BPF_DIV) { if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) @@ -7292,6 +7744,15 @@ gen_arth(compiler_state_t *cstate, int code, struct arth *a0, } else if (code == BPF_MOD) { if (a1->s->s.code == (BPF_LD|BPF_IMM) && a1->s->s.k == 0) bpf_error(cstate, "modulus by zero"); + } else if (code == BPF_LSH || code == BPF_RSH) { + /* + * XXX - we need to make up our minds as to what integers + * are signed and what integers are unsigned in BPF programs + * and in our IR. + */ + if (a1->s->s.code == (BPF_LD|BPF_IMM) && + (a1->s->s.k < 0 || a1->s->s.k > 31)) + bpf_error(cstate, "shift by more than 31 bits"); } s0 = xfer_to_x(cstate, a1); s1 = xfer_to_a(cstate, a0); @@ -7339,7 +7800,7 @@ alloc_reg(compiler_state_t *cstate) } } bpf_error(cstate, "too many registers needed to evaluate expression"); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -7369,6 +7830,13 @@ gen_len(compiler_state_t *cstate, int jmp, int n) struct block * gen_greater(compiler_state_t *cstate, int n) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + return gen_len(cstate, BPF_JGE, n); } @@ -7380,6 +7848,13 @@ gen_less(compiler_state_t *cstate, int n) { struct block *b; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + b = gen_len(cstate, BPF_JGT, n); gen_not(b); @@ -7402,6 +7877,13 @@ gen_byteop(compiler_state_t *cstate, int op, int idx, int val) struct block *b; struct slist *s; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (op) { default: abort(); @@ -7442,6 +7924,13 @@ gen_broadcast(compiler_state_t *cstate, int proto) struct block *b0, *b1, *b2; static const u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (proto) { case Q_DEFAULT: @@ -7473,7 +7962,7 @@ gen_broadcast(compiler_state_t *cstate, int proto) default: bpf_error(cstate, "not a broadcast link"); } - break; + /*NOTREACHED*/ case Q_IP: /* @@ -7493,7 +7982,7 @@ gen_broadcast(compiler_state_t *cstate, int proto) return b2; } bpf_error(cstate, "only link-layer/IP broadcast filters supported"); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -7520,6 +8009,13 @@ gen_multicast(compiler_state_t *cstate, int proto) register struct block *b0, *b1, *b2; register struct slist *s; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (proto) { case Q_DEFAULT: @@ -7688,7 +8184,7 @@ gen_multicast(compiler_state_t *cstate, int proto) return b1; } bpf_error(cstate, "link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel"); - /* NOTREACHED */ + /*NOTREACHED*/ } /* @@ -7706,13 +8202,20 @@ gen_inbound(compiler_state_t *cstate, int dir) register struct block *b0; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Only some data link types support inbound/outbound qualifiers. */ switch (cstate->linktype) { case DLT_SLIP: - b0 = gen_relation(cstate, BPF_JEQ, - gen_load(cstate, Q_LINK, gen_loadi(cstate, 0), 1), - gen_loadi(cstate, 0), + b0 = gen_relation_internal(cstate, BPF_JEQ, + gen_load_internal(cstate, Q_LINK, gen_loadi_internal(cstate, 0), 1), + gen_loadi_internal(cstate, 0), dir); break; @@ -7735,6 +8238,15 @@ gen_inbound(compiler_state_t *cstate, int dir) } break; + case DLT_LINUX_SLL2: + /* match outgoing packets */ + b0 = gen_cmp(cstate, OR_LINKHDR, 10, BPF_B, LINUX_SLL_OUTGOING); + if (!dir) { + /* to filter on inbound traffic, invert the match */ + gen_not(b0); + } + break; + #ifdef HAVE_NET_PFVAR_H case DLT_PFLOG: b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, dir), BPF_B, @@ -7811,10 +8323,10 @@ gen_inbound(compiler_state_t *cstate, int dir) */ if (cstate->bpf_pcap->rfile != NULL) { /* We have a FILE *, so this is a savefile */ - bpf_error(cstate, "inbound/outbound not supported on linktype %d when reading savefiles", - cstate->linktype); + bpf_error(cstate, "inbound/outbound not supported on %s when reading savefiles", + pcap_datalink_val_to_description_or_dlt(cstate->linktype)); b0 = NULL; - /* NOTREACHED */ + /*NOTREACHED*/ } /* match outgoing packets */ b0 = gen_cmp(cstate, OR_LINKHDR, SKF_AD_OFF + SKF_AD_PKTTYPE, BPF_H, @@ -7824,9 +8336,9 @@ gen_inbound(compiler_state_t *cstate, int dir) gen_not(b0); } #else /* defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */ - bpf_error(cstate, "inbound/outbound not supported on linktype %d", - cstate->linktype); - /* NOTREACHED */ + bpf_error(cstate, "inbound/outbound not supported on %s", + pcap_datalink_val_to_description_or_dlt(cstate->linktype)); + /*NOTREACHED*/ #endif /* defined(linux) && defined(PF_PACKET) && defined(SO_ATTACH_FILTER) */ } return (b0); @@ -7840,18 +8352,26 @@ gen_pf_ifname(compiler_state_t *cstate, const char *ifname) struct block *b0; u_int len, off; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->linktype != DLT_PFLOG) { bpf_error(cstate, "ifname supported only on PF linktype"); - /* NOTREACHED */ + /*NOTREACHED*/ } len = sizeof(((struct pfloghdr *)0)->ifname); off = offsetof(struct pfloghdr, ifname); if (strlen(ifname) >= len) { bpf_error(cstate, "ifname interface names can only be %d characters", len-1); - /* NOTREACHED */ + /*NOTREACHED*/ } - b0 = gen_bcmp(cstate, OR_LINKHDR, off, strlen(ifname), (const u_char *)ifname); + b0 = gen_bcmp(cstate, OR_LINKHDR, off, (u_int)strlen(ifname), + (const u_char *)ifname); return (b0); } @@ -7861,19 +8381,26 @@ gen_pf_ruleset(compiler_state_t *cstate, char *ruleset) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->linktype != DLT_PFLOG) { bpf_error(cstate, "ruleset supported only on PF linktype"); - /* NOTREACHED */ + /*NOTREACHED*/ } if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) { bpf_error(cstate, "ruleset names can only be %ld characters", (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1)); - /* NOTREACHED */ + /*NOTREACHED*/ } b0 = gen_bcmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, ruleset), - strlen(ruleset), (const u_char *)ruleset); + (u_int)strlen(ruleset), (const u_char *)ruleset); return (b0); } @@ -7883,9 +8410,16 @@ gen_pf_rnr(compiler_state_t *cstate, int rnr) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->linktype != DLT_PFLOG) { bpf_error(cstate, "rnr supported only on PF linktype"); - /* NOTREACHED */ + /*NOTREACHED*/ } b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, rulenr), BPF_W, @@ -7899,9 +8433,16 @@ gen_pf_srnr(compiler_state_t *cstate, int srnr) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->linktype != DLT_PFLOG) { bpf_error(cstate, "srnr supported only on PF linktype"); - /* NOTREACHED */ + /*NOTREACHED*/ } b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, subrulenr), BPF_W, @@ -7915,9 +8456,16 @@ gen_pf_reason(compiler_state_t *cstate, int reason) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->linktype != DLT_PFLOG) { bpf_error(cstate, "reason supported only on PF linktype"); - /* NOTREACHED */ + /*NOTREACHED*/ } b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, reason), BPF_B, @@ -7931,9 +8479,16 @@ gen_pf_action(compiler_state_t *cstate, int action) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->linktype != DLT_PFLOG) { bpf_error(cstate, "action supported only on PF linktype"); - /* NOTREACHED */ + /*NOTREACHED*/ } b0 = gen_cmp(cstate, OR_LINKHDR, offsetof(struct pfloghdr, action), BPF_B, @@ -7944,43 +8499,85 @@ gen_pf_action(compiler_state_t *cstate, int action) struct block * gen_pf_ifname(compiler_state_t *cstate, const char *ifname _U_) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + bpf_error(cstate, "libpcap was compiled without pf support"); - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * gen_pf_ruleset(compiler_state_t *cstate, char *ruleset _U_) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + bpf_error(cstate, "libpcap was compiled on a machine without pf support"); - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * gen_pf_rnr(compiler_state_t *cstate, int rnr _U_) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + bpf_error(cstate, "libpcap was compiled on a machine without pf support"); - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * gen_pf_srnr(compiler_state_t *cstate, int srnr _U_) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + bpf_error(cstate, "libpcap was compiled on a machine without pf support"); - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * gen_pf_reason(compiler_state_t *cstate, int reason _U_) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + bpf_error(cstate, "libpcap was compiled on a machine without pf support"); - /* NOTREACHED */ + /*NOTREACHED*/ } struct block * gen_pf_action(compiler_state_t *cstate, int action _U_) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + bpf_error(cstate, "libpcap was compiled on a machine without pf support"); - /* NOTREACHED */ + /*NOTREACHED*/ } #endif /* HAVE_NET_PFVAR_H */ @@ -7990,6 +8587,13 @@ gen_p80211_type(compiler_state_t *cstate, int type, int mask) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (cstate->linktype) { case DLT_IEEE802_11: @@ -8002,7 +8606,7 @@ gen_p80211_type(compiler_state_t *cstate, int type, int mask) default: bpf_error(cstate, "802.11 link-layer types supported only on 802.11"); - /* NOTREACHED */ + /*NOTREACHED*/ } return (b0); @@ -8013,6 +8617,13 @@ gen_p80211_fcdir(compiler_state_t *cstate, int fcdir) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (cstate->linktype) { case DLT_IEEE802_11: @@ -8023,7 +8634,7 @@ gen_p80211_fcdir(compiler_state_t *cstate, int fcdir) default: bpf_error(cstate, "frame direction supported only with 802.11 headers"); - /* NOTREACHED */ + /*NOTREACHED*/ } b0 = gen_mcmp(cstate, OR_LINKHDR, 1, BPF_B, (bpf_int32)fcdir, @@ -8033,24 +8644,37 @@ gen_p80211_fcdir(compiler_state_t *cstate, int fcdir) } struct block * -gen_acode(compiler_state_t *cstate, const u_char *eaddr, struct qual q) +gen_acode(compiler_state_t *cstate, const char *s, struct qual q) { + struct block *b; + + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (cstate->linktype) { case DLT_ARCNET: case DLT_ARCNET_LINUX: if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && - q.proto == Q_LINK) - return (gen_ahostop(cstate, eaddr, (int)q.dir)); - else { + q.proto == Q_LINK) { + cstate->e = pcap_ether_aton(s); + if (cstate->e == NULL) + bpf_error(cstate, "malloc"); + b = gen_ahostop(cstate, cstate->e, (int)q.dir); + free(cstate->e); + cstate->e = NULL; + return (b); + } else bpf_error(cstate, "ARCnet address used in non-arc expression"); - /* NOTREACHED */ - } - break; + /*NOTREACHED*/ default: bpf_error(cstate, "aid supported only on ARCnet"); - /* NOTREACHED */ + /*NOTREACHED*/ } } @@ -8082,30 +8706,30 @@ gen_ahostop(compiler_state_t *cstate, const u_char *eaddr, int dir) case Q_ADDR1: bpf_error(cstate, "'addr1' and 'address1' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR2: bpf_error(cstate, "'addr2' and 'address2' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR3: bpf_error(cstate, "'addr3' and 'address3' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_ADDR4: bpf_error(cstate, "'addr4' and 'address4' are only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_RA: bpf_error(cstate, "'ra' is only supported on 802.11"); - break; + /*NOTREACHED*/ case Q_TA: bpf_error(cstate, "'ta' is only supported on 802.11"); - break; + /*NOTREACHED*/ } abort(); - /* NOTREACHED */ + /*NOTREACHED*/ } static struct block * @@ -8125,19 +8749,24 @@ gen_vlan_tpid_test(compiler_state_t *cstate) } static struct block * -gen_vlan_vid_test(compiler_state_t *cstate, int vlan_num) +gen_vlan_vid_test(compiler_state_t *cstate, bpf_u_int32 vlan_num) { + if (vlan_num > 0x0fff) { + bpf_error(cstate, "VLAN tag %u greater than maximum %u", + vlan_num, 0x0fff); + } return gen_mcmp(cstate, OR_LINKPL, 0, BPF_H, (bpf_int32)vlan_num, 0x0fff); } static struct block * -gen_vlan_no_bpf_extensions(compiler_state_t *cstate, int vlan_num) +gen_vlan_no_bpf_extensions(compiler_state_t *cstate, bpf_u_int32 vlan_num, + int has_vlan_tag) { struct block *b0, *b1; b0 = gen_vlan_tpid_test(cstate); - if (vlan_num >= 0) { + if (has_vlan_tag) { b1 = gen_vlan_vid_test(cstate, vlan_num); gen_and(b0, b1); b0 = b1; @@ -8220,12 +8849,15 @@ gen_vlan_patch_vid_test(compiler_state_t *cstate, struct block *b_vid) sappend(s, s2); sjeq->s.jt = s2; - /* jump to the test in b_vid (bypass loading VID from packet data) */ + /* Jump to the test in b_vid. We need to jump one instruction before + * the end of the b_vid block so that we only skip loading the TCI + * from packet data and not the 'and' instruction extractging VID. + */ cnt = 0; for (s2 = b_vid->stmts; s2; s2 = s2->next) cnt++; s2 = new_stmt(cstate, JMP(BPF_JA)); - s2->s.k = cnt; + s2->s.k = cnt - 1; sappend(s, s2); /* insert our statements at the beginning of b_vid */ @@ -8242,7 +8874,8 @@ gen_vlan_patch_vid_test(compiler_state_t *cstate, struct block *b_vid) * update variable part of the offsets */ static struct block * -gen_vlan_bpf_extensions(compiler_state_t *cstate, int vlan_num) +gen_vlan_bpf_extensions(compiler_state_t *cstate, bpf_u_int32 vlan_num, + int has_vlan_tag) { struct block *b0, *b_tpid, *b_vid = NULL; struct slist *s; @@ -8267,14 +8900,14 @@ gen_vlan_bpf_extensions(compiler_state_t *cstate, int vlan_num) * function but gen_vlan_bpf_extensions() isn't called in that case. */ b_tpid = gen_vlan_tpid_test(cstate); - if (vlan_num >= 0) + if (has_vlan_tag) b_vid = gen_vlan_vid_test(cstate, vlan_num); gen_vlan_patch_tpid_test(cstate, b_tpid); gen_or(b0, b_tpid); b0 = b_tpid; - if (vlan_num >= 0) { + if (has_vlan_tag) { gen_vlan_patch_vid_test(cstate, b_vid); gen_and(b0, b_vid); b0 = b_vid; @@ -8288,10 +8921,17 @@ gen_vlan_bpf_extensions(compiler_state_t *cstate, int vlan_num) * support IEEE 802.1Q VLAN trunk over ethernet */ struct block * -gen_vlan(compiler_state_t *cstate, int vlan_num) +gen_vlan(compiler_state_t *cstate, bpf_u_int32 vlan_num, int has_vlan_tag) { struct block *b0; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + /* can't check for VLAN-encapsulated packets inside MPLS */ if (cstate->label_stack_depth > 0) bpf_error(cstate, "no VLAN match after MPLS"); @@ -8342,24 +8982,27 @@ gen_vlan(compiler_state_t *cstate, int vlan_num) * Do we need special VLAN handling? */ if (cstate->bpf_pcap->bpf_codegen_flags & BPF_SPECIAL_VLAN_HANDLING) - b0 = gen_vlan_bpf_extensions(cstate, vlan_num); + b0 = gen_vlan_bpf_extensions(cstate, vlan_num, + has_vlan_tag); else - b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num); + b0 = gen_vlan_no_bpf_extensions(cstate, + vlan_num, has_vlan_tag); } else #endif - b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num); + b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num, + has_vlan_tag); break; case DLT_IEEE802_11: case DLT_PRISM_HEADER: case DLT_IEEE802_11_RADIO_AVS: case DLT_IEEE802_11_RADIO: - b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num); + b0 = gen_vlan_no_bpf_extensions(cstate, vlan_num, has_vlan_tag); break; default: - bpf_error(cstate, "no VLAN support for data link type %d", - cstate->linktype); + bpf_error(cstate, "no VLAN support for %s", + pcap_datalink_val_to_description_or_dlt(cstate->linktype)); /*NOTREACHED*/ } @@ -8370,12 +9013,25 @@ gen_vlan(compiler_state_t *cstate, int vlan_num) /* * support for MPLS + * + * The label_num_arg dance is to avoid annoying whining by compilers that + * label_num might be clobbered by longjmp - yeah, it might, but *WHO CARES*? + * It's not *used* after setjmp returns. */ struct block * -gen_mpls(compiler_state_t *cstate, int label_num) +gen_mpls(compiler_state_t *cstate, bpf_u_int32 label_num_arg, + int has_label_num) { + volatile bpf_u_int32 label_num = label_num_arg; struct block *b0, *b1; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + if (cstate->label_stack_depth > 0) { /* just match the bottom-of-stack bit clear */ b0 = gen_mcmp(cstate, OR_PREVMPLSHDR, 2, BPF_B, 0, 0x01); @@ -8402,15 +9058,18 @@ gen_mpls(compiler_state_t *cstate, int label_num) * leave it for now */ default: - bpf_error(cstate, "no MPLS support for data link type %d", - cstate->linktype); + bpf_error(cstate, "no MPLS support for %s", + pcap_datalink_val_to_description_or_dlt(cstate->linktype)); /*NOTREACHED*/ - break; } } /* If a specific MPLS label is requested, check it */ - if (label_num >= 0) { + if (has_label_num) { + if (label_num > 0xFFFFF) { + bpf_error(cstate, "MPLS label %u greater than maximum %u", + label_num, 0xFFFFF); + } label_num = label_num << 12; /* label is shifted 12 bits on the wire */ b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, (bpf_int32)label_num, 0xfffff000); /* only compare the first 20 bits */ @@ -8444,22 +9103,40 @@ gen_mpls(compiler_state_t *cstate, int label_num) struct block * gen_pppoed(compiler_state_t *cstate) { + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + /* check for PPPoE discovery */ return gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOED); } struct block * -gen_pppoes(compiler_state_t *cstate, int sess_num) +gen_pppoes(compiler_state_t *cstate, bpf_u_int32 sess_num, int has_sess_num) { struct block *b0, *b1; /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + /* * Test against the PPPoE session link-layer type. */ b0 = gen_linktype(cstate, (bpf_int32)ETHERTYPE_PPPOES); /* If a specific session is requested, check PPPoE session id */ - if (sess_num >= 0) { + if (has_sess_num) { + if (sess_num > 0x0000ffff) { + bpf_error(cstate, "PPPoE session number %u greater than maximum %u", + sess_num, 0x0000ffff); + } b1 = gen_mcmp(cstate, OR_LINKPL, 0, BPF_W, (bpf_int32)sess_num, 0x0000ffff); gen_and(b0, b1); @@ -8471,29 +9148,8 @@ gen_pppoes(compiler_state_t *cstate, int sess_num) * the PPP packet, and note that this is PPPoE rather than * raw PPP. * - * XXX - this is a bit of a kludge. If we were to split the - * compiler into a parser that parses an expression and - * generates an expression tree, and a code generator that - * takes an expression tree (which could come from our - * parser or from some other parser) and generates BPF code, - * we could perhaps make the offsets parameters of routines - * and, in the handler for an "AND" node, pass to subnodes - * other than the PPPoE node the adjusted offsets. - * - * This would mean that "pppoes" would, instead of changing the - * behavior of *all* tests after it, change only the behavior - * of tests ANDed with it. That would change the documented - * semantics of "pppoes", which might break some expressions. - * However, it would mean that "(pppoes and ip) or ip" would check - * both for VLAN-encapsulated IP and IP-over-Ethernet, rather than - * checking only for VLAN-encapsulated IP, so that could still - * be considered worth doing; it wouldn't break expressions - * that are of the form "pppoes and ..." which I suspect are the - * most common expressions involving "pppoes". "pppoes or ..." - * doesn't necessarily do what the user would really want, now, - * as all the "or ..." tests would be done assuming PPPoE, even - * though the "or" could be viewed as meaning "or, if this isn't - * a PPPoE packet...". + * XXX - this is a bit of a kludge. See the comments in + * gen_vlan(). * * The "network-layer" protocol is PPPoE, which has a 6-byte * PPPoE header, followed by a PPP packet. @@ -8523,7 +9179,7 @@ gen_pppoes(compiler_state_t *cstate, int sess_num) static struct block * gen_geneve_check(compiler_state_t *cstate, struct block *(*gen_portfn)(compiler_state_t *, int, int, int), - enum e_offrel offrel, int vni) + enum e_offrel offrel, bpf_u_int32 vni, int has_vni) { struct block *b0, *b1; @@ -8536,7 +9192,11 @@ gen_geneve_check(compiler_state_t *cstate, gen_and(b0, b1); b0 = b1; - if (vni >= 0) { + if (has_vni) { + if (vni > 0xffffff) { + bpf_error(cstate, "Geneve VNI %u greater than maximum %u", + vni, 0xffffff); + } vni <<= 8; /* VNI is in the upper 3 bytes */ b1 = gen_mcmp(cstate, offrel, 12, BPF_W, (bpf_int32)vni, 0xffffff00); @@ -8553,12 +9213,12 @@ gen_geneve_check(compiler_state_t *cstate, * needed) into register A to be used later to compute * the inner packet offsets. */ static struct block * -gen_geneve4(compiler_state_t *cstate, int vni) +gen_geneve4(compiler_state_t *cstate, bpf_u_int32 vni, int has_vni) { struct block *b0, *b1; struct slist *s, *s1; - b0 = gen_geneve_check(cstate, gen_port, OR_TRAN_IPV4, vni); + b0 = gen_geneve_check(cstate, gen_port, OR_TRAN_IPV4, vni, has_vni); /* Load the IP header length into A. */ s = gen_loadx_iphdrlen(cstate); @@ -8579,12 +9239,12 @@ gen_geneve4(compiler_state_t *cstate, int vni) } static struct block * -gen_geneve6(compiler_state_t *cstate, int vni) +gen_geneve6(compiler_state_t *cstate, bpf_u_int32 vni, int has_vni) { struct block *b0, *b1; struct slist *s, *s1; - b0 = gen_geneve_check(cstate, gen_port6, OR_TRAN_IPV6, vni); + b0 = gen_geneve_check(cstate, gen_port6, OR_TRAN_IPV6, vni, has_vni); /* Load the IP header length. We need to account for a * variable length link prefix if there is one. */ @@ -8757,13 +9417,20 @@ gen_geneve_offsets(compiler_state_t *cstate) /* Check to see if this is a Geneve packet. */ struct block * -gen_geneve(compiler_state_t *cstate, int vni) +gen_geneve(compiler_state_t *cstate, bpf_u_int32 vni, int has_vni) { struct block *b0, *b1; struct slist *s; - b0 = gen_geneve4(cstate, vni); - b1 = gen_geneve6(cstate, vni); + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + b0 = gen_geneve4(cstate, vni, has_vni); + b1 = gen_geneve6(cstate, vni, has_vni); gen_or(b0, b1); b0 = b1; @@ -8813,9 +9480,9 @@ gen_geneve_ll_check(compiler_state_t *cstate) return b0; } -struct block * -gen_atmfield_code(compiler_state_t *cstate, int atmfield, bpf_int32 jvalue, - bpf_u_int32 jtype, int reverse) +static struct block * +gen_atmfield_code_internal(compiler_state_t *cstate, int atmfield, + bpf_int32 jvalue, bpf_u_int32 jtype, int reverse) { struct block *b0; @@ -8868,28 +9535,80 @@ gen_atmfield_code(compiler_state_t *cstate, int atmfield, bpf_int32 jvalue, return b0; } +static struct block * +gen_atmtype_metac(compiler_state_t *cstate) +{ + struct block *b0, *b1; + + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 1, BPF_JEQ, 0); + gen_and(b0, b1); + return b1; +} + +static struct block * +gen_atmtype_sc(compiler_state_t *cstate) +{ + struct block *b0, *b1; + + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 5, BPF_JEQ, 0); + gen_and(b0, b1); + return b1; +} + +static struct block * +gen_atmtype_llc(compiler_state_t *cstate) +{ + struct block *b0; + + b0 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); + cstate->linktype = cstate->prevlinktype; + return b0; +} + +struct block * +gen_atmfield_code(compiler_state_t *cstate, int atmfield, + bpf_int32 jvalue, bpf_u_int32 jtype, int reverse) +{ + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + return gen_atmfield_code_internal(cstate, atmfield, jvalue, jtype, + reverse); +} + struct block * gen_atmtype_abbrev(compiler_state_t *cstate, int type) { struct block *b0, *b1; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (type) { case A_METAC: /* Get all packets in Meta signalling Circuit */ if (!cstate->is_atm) bpf_error(cstate, "'metac' supported only on raw ATM"); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 1, BPF_JEQ, 0); - gen_and(b0, b1); + b1 = gen_atmtype_metac(cstate); break; case A_BCC: /* Get all packets in Broadcast Circuit*/ if (!cstate->is_atm) bpf_error(cstate, "'bcc' supported only on raw ATM"); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 2, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 2, BPF_JEQ, 0); gen_and(b0, b1); break; @@ -8897,8 +9616,8 @@ gen_atmtype_abbrev(compiler_state_t *cstate, int type) /* Get all cells in Segment OAM F4 circuit*/ if (!cstate->is_atm) bpf_error(cstate, "'oam4sc' supported only on raw ATM"); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 3, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 3, BPF_JEQ, 0); gen_and(b0, b1); break; @@ -8906,8 +9625,8 @@ gen_atmtype_abbrev(compiler_state_t *cstate, int type) /* Get all cells in End-to-End OAM F4 Circuit*/ if (!cstate->is_atm) bpf_error(cstate, "'oam4ec' supported only on raw ATM"); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 4, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 4, BPF_JEQ, 0); gen_and(b0, b1); break; @@ -8915,17 +9634,15 @@ gen_atmtype_abbrev(compiler_state_t *cstate, int type) /* Get all packets in connection Signalling Circuit */ if (!cstate->is_atm) bpf_error(cstate, "'sc' supported only on raw ATM"); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 5, BPF_JEQ, 0); - gen_and(b0, b1); + b1 = gen_atmtype_sc(cstate); break; case A_ILMIC: /* Get all packets in ILMI Circuit */ if (!cstate->is_atm) bpf_error(cstate, "'ilmic' supported only on raw ATM"); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 16, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 16, BPF_JEQ, 0); gen_and(b0, b1); break; @@ -8933,7 +9650,7 @@ gen_atmtype_abbrev(compiler_state_t *cstate, int type) /* Get all LANE packets */ if (!cstate->is_atm) bpf_error(cstate, "'lane' supported only on raw ATM"); - b1 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LANE, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_PROTOTYPE, PT_LANE, BPF_JEQ, 0); /* * Arrange that all subsequent tests assume LANE @@ -8956,8 +9673,7 @@ gen_atmtype_abbrev(compiler_state_t *cstate, int type) /* Get all LLC-encapsulated packets */ if (!cstate->is_atm) bpf_error(cstate, "'llc' supported only on raw ATM"); - b1 = gen_atmfield_code(cstate, A_PROTOTYPE, PT_LLC, BPF_JEQ, 0); - cstate->linktype = cstate->prevlinktype; + b1 = gen_atmtype_llc(cstate); break; default: @@ -8978,6 +9694,13 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) { struct block *b0, *b1; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (type) { case M_FISU: @@ -9040,17 +9763,34 @@ gen_mtp2type_abbrev(compiler_state_t *cstate, int type) return b0; } +/* + * The jvalue_arg dance is to avoid annoying whining by compilers that + * jvalue might be clobbered by longjmp - yeah, it might, but *WHO CARES*? + * It's not *used* after setjmp returns. + */ struct block * -gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, bpf_u_int32 jvalue, - bpf_u_int32 jtype, int reverse) +gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, + bpf_u_int32 jvalue_arg, bpf_u_int32 jtype, int reverse) { + volatile bpf_u_int32 jvalue = jvalue_arg; struct block *b0; bpf_u_int32 val1 , val2 , val3; - u_int newoff_sio = cstate->off_sio; - u_int newoff_opc = cstate->off_opc; - u_int newoff_dpc = cstate->off_dpc; - u_int newoff_sls = cstate->off_sls; + u_int newoff_sio; + u_int newoff_opc; + u_int newoff_dpc; + u_int newoff_sls; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + + newoff_sio = cstate->off_sio; + newoff_opc = cstate->off_opc; + newoff_dpc = cstate->off_dpc; + newoff_sls = cstate->off_sls; switch (mtp3field) { case MH_SIO: @@ -9069,7 +9809,9 @@ gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, bpf_u_int32 jvalue, break; case MH_OPC: - newoff_opc+=3; + newoff_opc += 3; + + /* FALLTHROUGH */ case M_OPC: if (cstate->off_opc == OFFSET_NOT_SET) bpf_error(cstate, "'opc' supported only on SS7"); @@ -9113,7 +9855,9 @@ gen_mtp3field_code(compiler_state_t *cstate, int mtp3field, bpf_u_int32 jvalue, break; case MH_SLS: - newoff_sls+=3; + newoff_sls += 3; + /* FALLTHROUGH */ + case M_SLS: if (cstate->off_sls == OFFSET_NOT_SET) bpf_error(cstate, "'sls' supported only on SS7"); @@ -9146,27 +9890,27 @@ gen_msg_abbrev(compiler_state_t *cstate, int type) switch (type) { case A_SETUP: - b1 = gen_atmfield_code(cstate, A_MSGTYPE, SETUP, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, SETUP, BPF_JEQ, 0); break; case A_CALLPROCEED: - b1 = gen_atmfield_code(cstate, A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, CALL_PROCEED, BPF_JEQ, 0); break; case A_CONNECT: - b1 = gen_atmfield_code(cstate, A_MSGTYPE, CONNECT, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, CONNECT, BPF_JEQ, 0); break; case A_CONNECTACK: - b1 = gen_atmfield_code(cstate, A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, CONNECT_ACK, BPF_JEQ, 0); break; case A_RELEASE: - b1 = gen_atmfield_code(cstate, A_MSGTYPE, RELEASE, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, RELEASE, BPF_JEQ, 0); break; case A_RELEASE_DONE: - b1 = gen_atmfield_code(cstate, A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_MSGTYPE, RELEASE_DONE, BPF_JEQ, 0); break; default: @@ -9180,22 +9924,34 @@ gen_atmmulti_abbrev(compiler_state_t *cstate, int type) { struct block *b0, *b1; + /* + * Catch errors reported by us and routines below us, and return NULL + * on an error. + */ + if (setjmp(cstate->top_ctx)) + return (NULL); + switch (type) { case A_OAM: if (!cstate->is_atm) bpf_error(cstate, "'oam' supported only on raw ATM"); - b1 = gen_atmmulti_abbrev(cstate, A_OAMF4); + /* OAM F4 type */ + b0 = gen_atmfield_code_internal(cstate, A_VCI, 3, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 4, BPF_JEQ, 0); + gen_or(b0, b1); + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); + gen_and(b0, b1); break; case A_OAMF4: if (!cstate->is_atm) bpf_error(cstate, "'oamf4' supported only on raw ATM"); /* OAM F4 type */ - b0 = gen_atmfield_code(cstate, A_VCI, 3, BPF_JEQ, 0); - b1 = gen_atmfield_code(cstate, A_VCI, 4, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_VCI, 3, BPF_JEQ, 0); + b1 = gen_atmfield_code_internal(cstate, A_VCI, 4, BPF_JEQ, 0); gen_or(b0, b1); - b0 = gen_atmfield_code(cstate, A_VPI, 0, BPF_JEQ, 0); + b0 = gen_atmfield_code_internal(cstate, A_VPI, 0, BPF_JEQ, 0); gen_and(b0, b1); break; @@ -9217,7 +9973,7 @@ gen_atmmulti_abbrev(compiler_state_t *cstate, int type) gen_or(b0, b1); b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE); gen_or(b0, b1); - b0 = gen_atmtype_abbrev(cstate, A_SC); + b0 = gen_atmtype_sc(cstate); gen_and(b0, b1); break; @@ -9233,7 +9989,7 @@ gen_atmmulti_abbrev(compiler_state_t *cstate, int type) gen_or(b0, b1); b0 = gen_msg_abbrev(cstate, A_RELEASE_DONE); gen_or(b0, b1); - b0 = gen_atmtype_abbrev(cstate, A_METAC); + b0 = gen_atmtype_metac(cstate); gen_and(b0, b1); break; |