Add "ipx", which checks for the LLC SAP for IPX as well as, on Ethernet,

for "Novell 802.3" frames, which are 802.3 frames (i.e., the type/length
field is a length field, i.e. it's <= ETHERMTU) with 0xFFFF as the first
2 bytes.  We don't yet check for ETHERTYPE_IPX as well.

When checking for OSI packets on Linux cooked captures, check for 802.2
frames by testing the packet type for LINUX_SLL_P_802_2 rather than by
checking whether the type field is <= ETHERMTU (it's always a type field
in DLT_LINUX_SLL captures).

1 files changed, 76 insertions, 4 deletions

diff --git a/gencode.c b/gencode.c
index 465cba1f..dde00486 100644
--- a/gencode.c
+++ b/gencode.c
@@ -21,7 +21,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.142 2001-01-14 05:30:07 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.143 2001-01-14 07:57:47 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -69,6 +69,7 @@ struct rtentry;
 #define LLC_SNAP_LSAP	0xaa
 #define LLC_ISO_LSAP	0xfe
 #define LLC_STP_LSAP	0x42
+#define LLC_IPX_LSAP	0xe0
 
 #define ETHERMTU	1500
 
@@ -720,7 +721,7 @@ gen_linktype(proto)
 			/*
 			 * OSI protocols always use 802.2 encapsulation.
 			 * XXX - should we check both the DSAP and the
-			 * LSAP, like this, or should we check just the
+			 * SSAP, like this, or should we check just the
 			 * DSAP?
 			 */
 			b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
@@ -730,6 +731,40 @@ gen_linktype(proto)
 			gen_and(b0, b1);
 			return b1;
 
+		case LLC_IPX_LSAP:
+			/*
+			 * Check both for the IPX LSAP as the DSAP and
+			 * for Netware 802.3, where the type/length
+			 * field is a length field (i.e., <= ETHERMTU)
+			 * and the first two bytes after the LLC header
+			 * are 0xFFFF.
+			 *
+			 * XXX - check for the IPX Ethertype, 0x8137,
+			 * as well?
+			 *
+			 * This generates code to check both for the
+			 * IPX LSAP and for Netware 802.3.
+			 */
+			b0 = gen_cmp(off_linktype + 2, BPF_B,
+			    (bpf_int32)LLC_IPX_LSAP);
+			b1 = gen_cmp(off_linktype + 2, BPF_H,
+			    (bpf_int32)0xFFFF);
+			gen_or(b0, b1);
+
+			/*
+			 * Now we generate code to check for 802.3
+			 * frames in general.
+			 */
+			b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
+			gen_not(b0);
+
+			/*
+			 * Now check for 802.3 frames and, if that passes,
+			 * check for either of the flavors of IPX.
+			 */
+			gen_and(b0, b1);
+			return b1;
+
 		case ETHERTYPE_ATALK:
 		case ETHERTYPE_AARP:
 			/*
@@ -832,6 +867,10 @@ gen_linktype(proto)
 			break;
 
 		default:
+			/*
+			 * XXX - we don't have to check for IPX 802.3
+			 * here, but should we check for the IPX Ethertype?
+			 */
 			if (proto <= ETHERMTU) {
 				/*
 				 * This is an LLC SAP value, so check
@@ -878,13 +917,33 @@ gen_linktype(proto)
 			 * LSAP, like this, or should we check just the
 			 * DSAP?
 			 */
-			b0 = gen_cmp_gt(off_linktype, BPF_H, ETHERMTU);
-			gen_not(b0);
+			b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
 			b1 = gen_cmp(off_linktype + 2, BPF_H, (bpf_int32)
 				     ((LLC_ISO_LSAP << 8) | LLC_ISO_LSAP));
 			gen_and(b0, b1);
 			return b1;
 
+		case LLC_IPX_LSAP:
+			/*
+			 * Check both for 802.2 frames with the IPX LSAP as
+			 * the DSAP and for Netware 802.3 frames.
+			 *
+			 * This generates code to check for 802.2 frames
+			 * with the IPX LSAP.
+			 */
+			b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_2);
+			b1 = gen_cmp(off_linktype + 2, BPF_B,
+			    (bpf_int32)LLC_IPX_LSAP);
+			gen_and(b0, b1);
+
+			/*
+			 * Now check for 802.3 frames and OR that with
+			 * the previous test.
+			 */
+			b0 = gen_cmp(off_linktype, BPF_H, LINUX_SLL_P_802_3);
+			gen_or(b0, b1);
+			return b1;
+
 		case ETHERTYPE_ATALK:
 		case ETHERTYPE_AARP:
 			/*
@@ -1562,6 +1621,9 @@ gen_host(addr, mask, proto, dir)
 	case Q_STP:
 		bpf_error("'stp' modifier applied to host");
 
+	case Q_IPX:
+		bpf_error("IPX host filtering not implemented");
+
 	default:
 		abort();
 	}
@@ -1657,6 +1719,9 @@ gen_host6(addr, mask, proto, dir)
 	case Q_STP:
 		bpf_error("'stp' modifier applied to host");
 
+	case Q_IPX:
+		bpf_error("IPX host filtering not implemented");
+
 	default:
 		abort();
 	}
@@ -1863,6 +1928,10 @@ gen_proto_abbrev(proto)
 	        b1 = gen_linktype(LLC_STP_LSAP);
 		break;
 
+	case Q_IPX:
+	        b1 = gen_linktype(LLC_IPX_LSAP);
+		break;
+
 	default:
 		abort();
 	}
@@ -2522,6 +2591,9 @@ gen_proto(v, proto, dir)
 	case Q_STP:
 		bpf_error("'stp proto' is bogus");
 
+	case Q_IPX:
+		bpf_error("'ipx proto' is bogus");
+
 	default:
 		abort();
 		/* NOTREACHED */