Skip to content
Browse files

Add "ipx", which checks for the LLC SAP for IPX as well as, on Ethernet,

for "Novell 802.3" frames, which are 802.3 frames (i.e., the type/length
field is a length field, i.e. it's <= ETHERMTU) with 0xFFFF as the first
2 bytes.  We don't yet check for ETHERTYPE_IPX as well.

When checking for OSI packets on Linux cooked captures, check for 802.2
frames by testing the packet type for LINUX_SLL_P_802_2 rather than by
checking whether the type field is <= ETHERMTU (it's always a type field
in DLT_LINUX_SLL captures).
  • Loading branch information...
1 parent c3c2ed0 commit d17596dbd9966e379419c8c30a0bb294d348ca55 @yuguy yuguy committed Jan 14, 2001
Showing with 85 additions and 7 deletions.
  1. +76 −4 gencode.c
  2. +3 −1 gencode.h
  3. +3 −1 grammar.y
  4. +3 −1 scanner.l
View
80 gencode.c
@@ -21,7 +21,7 @@
*/
#ifndef lint
static const char rcsid[] =
- "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.142 2001-01-14 05:30:07 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.143 2001-01-14 07:57:47 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -69,6 +69,7 @@ struct rtentry;
#define LLC_SNAP_LSAP 0xaa
#define LLC_ISO_LSAP 0xfe
#define LLC_STP_LSAP 0x42
+#define LLC_IPX_LSAP 0xe0
#define ETHERMTU 1500
@@ -720,7 +721,7 @@ gen_linktype(proto)
/*
* OSI protocols always use 802.2 encapsulation.
* XXX - should we check both the DSAP and the
- * LSAP, like this, or should we check just the
+ * SSAP, like this, or should we check just the
* DSAP?
*/
b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
@@ -730,6 +731,40 @@ gen_linktype(proto)
gen_and(b0, b1);
return b1;
+ case LLC_IPX_LSAP:
+ /*
+ * Check both for the IPX LSAP as the DSAP and
+ * for Netware 802.3, where the type/length
+ * field is a length field (i.e., <= ETHERMTU)
+ * and the first two bytes after the LLC header
+ * are 0xFFFF.
+ *
+ * XXX - check for the IPX Ethertype, 0x8137,
+ * as well?
+ *
+ * This generates code to check both for the
+ * IPX LSAP and for Netware 802.3.
+ */
+ b0 = gen_cmp(off_linktype + 2, BPF_B,
+ (bpf_int32)LLC_IPX_LSAP);
+ b1 = gen_cmp(off_linktype + 2, BPF_H,
+ (bpf_int32)0xFFFF);
+ gen_or(b0, b1);
+
+ /*
+ * Now we generate code to check for 802.3
+ * frames in general.
+ */
+ b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+ gen_not(b0);
+
+ /*
+ * Now check for 802.3 frames and, if that passes,
+ * check for either of the flavors of IPX.
+ */
+ gen_and(b0, b1);
+ return b1;
+
case ETHERTYPE_ATALK:
case ETHERTYPE_AARP:
/*
@@ -832,6 +867,10 @@ gen_linktype(proto)
break;
default:
+ /*
+ * XXX - we don't have to check for IPX 802.3
+ * here, but should we check for the IPX Ethertype?
+ */
if (proto <= ETHERMTU) {
/*
* This is an LLC SAP value, so check
@@ -878,13 +917,33 @@ gen_linktype(proto)
* LSAP, like this, or should we check just the
* DSAP?
*/
- b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
- gen_not(b0);
+ b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
gen_and(b0, b1);
return b1;
+ case LLC_IPX_LSAP:
+ /*
+ * Check both for 802.2 frames with the IPX LSAP as
+ * the DSAP and for Netware 802.3 frames.
+ *
+ * This generates code to check for 802.2 frames
+ * with the IPX LSAP.
+ */
+ b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+ b1 = gen_cmp(off_linktype + 2, BPF_B,
+ (bpf_int32)LLC_IPX_LSAP);
+ gen_and(b0, b1);
+
+ /*
+ * Now check for 802.3 frames and OR that with
+ * the previous test.
+ */
+ b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
+ gen_or(b0, b1);
+ return b1;
+
case ETHERTYPE_ATALK:
case ETHERTYPE_AARP:
/*
@@ -1562,6 +1621,9 @@ gen_host(addr, mask, proto, dir)
case Q_STP:
bpf_error("'stp' modifier applied to host");
+ case Q_IPX:
+ bpf_error("IPX host filtering not implemented");
+
default:
abort();
}
@@ -1657,6 +1719,9 @@ gen_host6(addr, mask, proto, dir)
case Q_STP:
bpf_error("'stp' modifier applied to host");
+ case Q_IPX:
+ bpf_error("IPX host filtering not implemented");
+
default:
abort();
}
@@ -1863,6 +1928,10 @@ gen_proto_abbrev(proto)
b1 = gen_linktype(LLC_STP_LSAP);
break;
+ case Q_IPX:
+ b1 = gen_linktype(LLC_IPX_LSAP);
+ break;
+
default:
abort();
}
@@ -2522,6 +2591,9 @@ gen_proto(v, proto, dir)
case Q_STP:
bpf_error("'stp proto' is bogus");
+ case Q_IPX:
+ bpf_error("'ipx proto' is bogus");
+
default:
abort();
/* NOTREACHED */
View
4 gencode.h
@@ -18,7 +18,7 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
- * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.48 2001-01-14 04:34:51 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.49 2001-01-14 07:57:48 guy Exp $ (LBL)
*/
/* Address qualifiers. */
@@ -67,6 +67,8 @@
#define Q_STP 26
+#define Q_IPX 27
+
/* Directional qualifiers. */
#define Q_SRC 1
View
4 grammar.y
@@ -22,7 +22,7 @@
*/
#ifndef lint
static const char rcsid[] =
- "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.65 2001-01-14 04:34:52 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.66 2001-01-14 07:57:48 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -119,6 +119,7 @@ pcap_parse()
%token VLAN
%token ISO ESIS ISIS CLNP
%token STP
+%token IPX
%type <s> ID
%type <e> EID
@@ -265,6 +266,7 @@ pname: LINK { $$ = Q_LINK; }
| ISIS { $$ = Q_ISIS; }
| CLNP { $$ = Q_CLNP; }
| STP { $$ = Q_STP; }
+ | IPX { $$ = Q_IPX; }
;
other: pqual TK_BROADCAST { $$ = gen_broadcast($1); }
| pqual TK_MULTICAST { $$ = gen_multicast($1); }
View
4 scanner.l
@@ -22,7 +22,7 @@
#ifndef lint
static const char rcsid[] =
- "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.71 2001-01-14 04:34:52 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.72 2001-01-14 07:57:49 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -199,6 +199,8 @@ clnp return CLNP;
stp return STP;
+ipx return IPX;
+
host return HOST;
net return NET;
mask return MASK;

0 comments on commit d17596d

Please sign in to comment.
Something went wrong with that request. Please try again.