From 531a7bbb143a43ba8a5337703caab2ed255e1685 Mon Sep 17 00:00:00 2001
From: hannes <hannes>
Date: Wed, 4 Dec 2002 21:40:13 +0000
Subject: fixed BPF generation of OSI over {CHDLC and ATM-LLC} frames

---
 gencode.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 67 insertions(+), 14 deletions(-)

diff --git a/gencode.c b/gencode.c
index 08e89fe..19aa299 100644
--- a/gencode.c
+++ b/gencode.c
@@ -21,7 +21,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.180 2002-10-18 08:46:13 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.181 2002-12-04 21:40:13 hannes Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -839,6 +839,10 @@ init_linktype(type)
 		return;
 
 	case DLT_ATM_RFC1483:
+		off_linktype = 0;
+		off_nl = 4;             /* FIXME SNAP */
+		return;
+
 	case DLT_ATM_CLIP:	/* Linux ATM defines this */
 		/*
 		 * assume routed, non-ISO PDUs
@@ -964,9 +968,6 @@ gen_ether_linktype(proto)
 	case LLCSAP_ISONS:
 		/*
 		 * OSI protocols always use 802.2 encapsulation.
-		 * XXX - should we check both the DSAP and the
-		 * SSAP, like this, or should we check just the
-		 * DSAP?
 		 */
 		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
 		gen_not(b0);
@@ -975,12 +976,17 @@ gen_ether_linktype(proto)
 		gen_and(b0, b1);
 		return b1;
 
+	case LLCSAP_IP:
+		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+		gen_not(b0);
+		b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
+			     ((LLCSAP_IP << 8) | LLCSAP_IP));
+		gen_and(b0, b1);
+		return b1;
+
 	case LLCSAP_NETBEUI:
 		/*
 		 * NetBEUI always uses 802.2 encapsulation.
-		 * XXX - should we check both the DSAP and the
-		 * SSAP, like this, or should we check just the
-		 * DSAP?
 		 */
 		b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
 		gen_not(b0);
@@ -1141,6 +1147,15 @@ gen_linktype(proto)
 		return gen_ether_linktype(proto);
 		break;
 
+        case DLT_C_HDLC:
+            switch (proto) {
+            case LLCSAP_ISONS:
+                proto = (proto << 8 | LLCSAP_ISONS);
+                /* fall through */
+            default:
+                return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
+                break;
+            }
 	case DLT_IEEE802_11:
 	case DLT_PRISM_HEADER:
 	case DLT_FDDI:
@@ -1188,12 +1203,16 @@ gen_linktype(proto)
 	case DLT_LINUX_SLL:
 		switch (proto) {
 
+		case LLCSAP_IP:
+			b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+			b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
+				     ((LLCSAP_IP << 8) | LLCSAP_IP));
+			gen_and(b0, b1);
+			return b1;
+
 		case LLCSAP_ISONS:
 			/*
 			 * OSI protocols always use 802.2 encapsulation.
-			 * XXX - should we check both the DSAP and the
-			 * LSAP, like this, or should we check just the
-			 * DSAP?
 			 */
 			b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
 			b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
@@ -1372,7 +1391,7 @@ gen_linktype(proto)
 		switch (proto) {
 
 		case ETHERTYPE_IP:
-			proto = PPP_IP;			/* XXX was 0x21 */
+			proto = PPP_IP;
 			break;
 
 #ifdef INET6
@@ -1679,6 +1698,10 @@ gen_llc(proto)
 	 */
 	switch (proto) {
 
+        case LLCSAP_IP:
+		return gen_cmp(off_linktype, BPF_H, (long)
+			     ((LLCSAP_IP << 8) | LLCSAP_IP));
+                
 	case LLCSAP_ISONS:
 		return gen_cmp(off_linktype, BPF_H, (long)
 			     ((LLCSAP_ISONS << 8) | LLCSAP_ISONS));
@@ -2950,8 +2973,19 @@ gen_port(port, ip_proto, dir)
 {
 	struct block *b0, *b1, *tmp;
 
-	/* ether proto ip */
-	b0 =  gen_linktype(ETHERTYPE_IP);
+        switch (linktype) {
+        case DLT_IEEE802_11:
+        case DLT_PRISM_HEADER:
+        case DLT_FDDI:
+        case DLT_IEEE802:
+        case DLT_ATM_RFC1483:
+        case DLT_ATM_CLIP:
+                b0 = gen_linktype(LLCSAP_IP);
+                break;
+        default:
+                b0 = gen_linktype(ETHERTYPE_IP);
+                break;
+        }
 
 	switch (ip_proto) {
 	case IPPROTO_UDP:
@@ -3415,7 +3449,19 @@ gen_proto(v, proto, dir)
 		/*FALLTHROUGH*/
 #endif
 	case Q_IP:
-		b0 = gen_linktype(ETHERTYPE_IP);
+                switch (linktype) {
+                case DLT_IEEE802_11:
+                case DLT_PRISM_HEADER:
+                case DLT_FDDI:
+                case DLT_IEEE802:
+                case DLT_ATM_RFC1483:
+                case DLT_ATM_CLIP:
+			b0 = gen_linktype(LLCSAP_IP);
+                        break;
+                default:
+                        b0 = gen_linktype(ETHERTYPE_IP);
+                        break;
+                }
 #ifndef CHASE_CHAIN
 		b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
 #else
@@ -3449,6 +3495,13 @@ gen_proto(v, proto, dir)
 			return gen_cmp(2, BPF_H, (0x03<<8) | v);
 			break;
 
+                case DLT_C_HDLC:
+                        /* Cisco uses an Ethertype lookalike - for OSI its 0xfefe */
+                        b0 = gen_linktype(LLCSAP_ISONS<<8 | LLCSAP_ISONS);
+                        /* OSI in C-HDLC is stuffed with a fudge byte */
+			b1 = gen_cmp(off_nl_nosnap+1, BPF_B, (long)v);
+			gen_and(b0, b1);
+                        return b1;
 		default:
 			b0 = gen_linktype(LLCSAP_ISONS);
 			b1 = gen_cmp(off_nl_nosnap, BPF_B, (long)v);
-- 
cgit v1.2.3