xref: /openbsd-src/lib/libpcap/gencode.c (revision 78871eb876677c1cfa6cb2a6202247a39f574ae0)
1 /*	$OpenBSD: gencode.c,v 1.14 2001/12/17 22:29:47 dugsong Exp $	*/
2 
3 /*
4  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that: (1) source code distributions
9  * retain the above copyright notice and this paragraph in its entirety, (2)
10  * distributions including binary code include the above copyright notice and
11  * this paragraph in its entirety in the documentation or other materials
12  * provided with the distribution, and (3) all advertising materials mentioning
13  * features or use of this software display the following acknowledgement:
14  * ``This product includes software developed by the University of California,
15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16  * the University nor the names of its contributors may be used to endorse
17  * or promote products derived from this software without specific prior
18  * written permission.
19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22  */
23 #ifndef lint
24 static const char rcsid[] =
25     "@(#) $Header: /home/cvs/src/lib/libpcap/gencode.c,v 1.14 2001/12/17 22:29:47 dugsong Exp $ (LBL)";
26 #endif
27 
28 #include <sys/types.h>
29 #include <sys/socket.h>
30 #include <sys/time.h>
31 
32 #ifdef __STDC__
33 struct mbuf;
34 struct rtentry;
35 #endif
36 
37 #include <net/if.h>
38 
39 #include <netinet/in.h>
40 #include <netinet/if_ether.h>
41 #include <netinet/if_arc.h>
42 
43 #include <stdlib.h>
44 #include <memory.h>
45 #include <setjmp.h>
46 #ifdef __STDC__
47 #include <stdarg.h>
48 #else
49 #include <varargs.h>
50 #endif
51 
52 #include "pcap-int.h"
53 
54 #include "ethertype.h"
55 #include "gencode.h"
56 #include "ppp.h"
57 #include <pcap-namedb.h>
58 #ifdef INET6
59 #include <netdb.h>
60 #include <sys/socket.h>
61 #endif /*INET6*/
62 
63 #ifdef HAVE_OS_PROTO_H
64 #include "os-proto.h"
65 #endif
66 
67 #define JMP(c) ((c)|BPF_JMP|BPF_K)
68 
69 /* Locals */
70 static jmp_buf top_ctx;
71 static pcap_t *bpf_pcap;
72 
73 /* XXX */
74 #ifdef PCAP_FDDIPAD
75 int	pcap_fddipad = PCAP_FDDIPAD;
76 #else
77 int	pcap_fddipad;
78 #endif
79 
80 /* VARARGS */
81 __dead void
82 #ifdef __STDC__
83 bpf_error(const char *fmt, ...)
84 #else
85 bpf_error(fmt, va_alist)
86 	const char *fmt;
87 	va_dcl
88 #endif
89 {
90 	va_list ap;
91 
92 #ifdef __STDC__
93 	va_start(ap, fmt);
94 #else
95 	va_start(ap);
96 #endif
97 	if (bpf_pcap != NULL)
98 		(void)vsnprintf(pcap_geterr(bpf_pcap), PCAP_ERRBUF_SIZE,
99 		    fmt, ap);
100 	va_end(ap);
101 	longjmp(top_ctx, 1);
102 	/* NOTREACHED */
103 }
104 
105 static void init_linktype(int);
106 
107 static int alloc_reg(void);
108 static void free_reg(int);
109 
110 static struct block *root;
111 
112 /*
113  * We divy out chunks of memory rather than call malloc each time so
114  * we don't have to worry about leaking memory.  It's probably
115  * not a big deal if all this memory was wasted but it this ever
116  * goes into a library that would probably not be a good idea.
117  */
118 #define NCHUNKS 16
119 #define CHUNK0SIZE 1024
120 struct chunk {
121 	u_int n_left;
122 	void *m;
123 };
124 
125 static struct chunk chunks[NCHUNKS];
126 static int cur_chunk;
127 
128 static void *newchunk(u_int);
129 static void freechunks(void);
130 static __inline struct block *new_block(int);
131 static __inline struct slist *new_stmt(int);
132 static struct block *gen_retblk(int);
133 static __inline void syntax(void);
134 
135 static void backpatch(struct block *, struct block *);
136 static void merge(struct block *, struct block *);
137 static struct block *gen_cmp(u_int, u_int, bpf_int32);
138 static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32);
139 static struct block *gen_bcmp(u_int, u_int, const u_char *);
140 static struct block *gen_uncond(int);
141 static __inline struct block *gen_true(void);
142 static __inline struct block *gen_false(void);
143 static struct block *gen_linktype(int);
144 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
145 #ifdef INET6
146 static struct block *gen_hostop6(struct in6_addr *, struct in6_addr *, int, int, u_int, u_int);
147 #endif
148 static struct block *gen_ahostop(const u_char *, int);
149 static struct block *gen_ehostop(const u_char *, int);
150 static struct block *gen_fhostop(const u_char *, int);
151 static struct block *gen_dnhostop(bpf_u_int32, int, u_int);
152 static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int);
153 #ifdef INET6
154 static struct block *gen_host6(struct in6_addr *, struct in6_addr *, int, int);
155 #endif
156 #ifndef INET6
157 static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int);
158 #endif
159 static struct block *gen_ipfrag(void);
160 static struct block *gen_portatom(int, bpf_int32);
161 #ifdef INET6
162 static struct block *gen_portatom6(int, bpf_int32);
163 #endif
164 struct block *gen_portop(int, int, int);
165 static struct block *gen_port(int, int, int);
166 #ifdef INET6
167 struct block *gen_portop6(int, int, int);
168 static struct block *gen_port6(int, int, int);
169 #endif
170 static int lookup_proto(const char *, int);
171 static struct block *gen_protochain(int, int, int);
172 static struct block *gen_proto(int, int, int);
173 static struct slist *xfer_to_x(struct arth *);
174 static struct slist *xfer_to_a(struct arth *);
175 static struct block *gen_len(int, int);
176 
177 static void *
178 newchunk(n)
179 	u_int n;
180 {
181 	struct chunk *cp;
182 	int k, size;
183 
184 	/* XXX Round to structure boundary. */
185 	n = ALIGN(n);
186 
187 	cp = &chunks[cur_chunk];
188 	if (n > cp->n_left) {
189 		++cp, k = ++cur_chunk;
190 		if (k >= NCHUNKS)
191 			bpf_error("out of memory");
192 		size = CHUNK0SIZE << k;
193 		cp->m = (void *)malloc(size);
194 		memset((char *)cp->m, 0, size);
195 		cp->n_left = size;
196 		if (n > size)
197 			bpf_error("out of memory");
198 	}
199 	cp->n_left -= n;
200 	return (void *)((char *)cp->m + cp->n_left);
201 }
202 
203 static void
204 freechunks()
205 {
206 	int i;
207 
208 	cur_chunk = 0;
209 	for (i = 0; i < NCHUNKS; ++i)
210 		if (chunks[i].m != NULL) {
211 			free(chunks[i].m);
212 			chunks[i].m = NULL;
213 		}
214 }
215 
216 /*
217  * A strdup whose allocations are freed after code generation is over.
218  */
219 char *
220 sdup(s)
221 	register const char *s;
222 {
223 	int n = strlen(s) + 1;
224 	char *cp = newchunk(n);
225 
226 	strlcpy(cp, s, n);
227 	return (cp);
228 }
229 
230 static __inline struct block *
231 new_block(code)
232 	int code;
233 {
234 	struct block *p;
235 
236 	p = (struct block *)newchunk(sizeof(*p));
237 	p->s.code = code;
238 	p->head = p;
239 
240 	return p;
241 }
242 
243 static __inline struct slist *
244 new_stmt(code)
245 	int code;
246 {
247 	struct slist *p;
248 
249 	p = (struct slist *)newchunk(sizeof(*p));
250 	p->s.code = code;
251 
252 	return p;
253 }
254 
255 static struct block *
256 gen_retblk(v)
257 	int v;
258 {
259 	struct block *b = new_block(BPF_RET|BPF_K);
260 
261 	b->s.k = v;
262 	return b;
263 }
264 
265 static __inline void
266 syntax()
267 {
268 	bpf_error("syntax error in filter expression");
269 }
270 
271 static bpf_u_int32 netmask;
272 static int snaplen;
273 int no_optimize;
274 
275 int
276 pcap_compile(pcap_t *p, struct bpf_program *program,
277 	     char *buf, int optimize, bpf_u_int32 mask)
278 {
279 	extern int n_errors;
280 	int len;
281 
282 	no_optimize = 0;
283 	n_errors = 0;
284 	root = NULL;
285 	bpf_pcap = p;
286 	if (setjmp(top_ctx)) {
287 		freechunks();
288 		return (-1);
289 	}
290 
291 	netmask = mask;
292 	snaplen = pcap_snapshot(p);
293 
294 	lex_init(buf ? buf : "");
295 	init_linktype(pcap_datalink(p));
296 	(void)pcap_parse();
297 
298 	if (n_errors)
299 		syntax();
300 
301 	if (root == NULL)
302 		root = gen_retblk(snaplen);
303 
304 	if (optimize && !no_optimize) {
305 		bpf_optimize(&root);
306 		if (root == NULL ||
307 		    (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
308 			bpf_error("expression rejects all packets");
309 	}
310 	program->bf_insns = icode_to_fcode(root, &len);
311 	program->bf_len = len;
312 
313 	freechunks();
314 	return (0);
315 }
316 
317 /*
318  * entry point for using the compiler with no pcap open
319  * pass in all the stuff that is needed explicitly instead.
320  */
321 int
322 pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
323 		    struct bpf_program *program,
324 	     char *buf, int optimize, bpf_u_int32 mask)
325 {
326 	extern int n_errors;
327 	int len;
328 
329 	n_errors = 0;
330 	root = NULL;
331 	bpf_pcap = NULL;
332 	if (setjmp(top_ctx)) {
333 		freechunks();
334 		return (-1);
335 	}
336 
337 	netmask = mask;
338 
339 	/* XXX needed? I don't grok the use of globals here. */
340 	snaplen = snaplen_arg;
341 
342 	lex_init(buf ? buf : "");
343 	init_linktype(linktype_arg);
344 	(void)pcap_parse();
345 
346 	if (n_errors)
347 		syntax();
348 
349 	if (root == NULL)
350 		root = gen_retblk(snaplen_arg);
351 
352 	if (optimize) {
353 		bpf_optimize(&root);
354 		if (root == NULL ||
355 		    (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0))
356 			bpf_error("expression rejects all packets");
357 	}
358 	program->bf_insns = icode_to_fcode(root, &len);
359 	program->bf_len = len;
360 
361 	freechunks();
362 	return (0);
363 }
364 
365 /*
366  * Clean up a "struct bpf_program" by freeing all the memory allocated
367  * in it.
368  */
369 void
370 pcap_freecode(struct bpf_program *program)
371 {
372 	program->bf_len = 0;
373 	if (program->bf_insns != NULL) {
374 		free((char *)program->bf_insns);
375 		program->bf_insns = NULL;
376 	}
377 }
378 
379 /*
380  * Backpatch the blocks in 'list' to 'target'.  The 'sense' field indicates
381  * which of the jt and jf fields has been resolved and which is a pointer
382  * back to another unresolved block (or nil).  At least one of the fields
383  * in each block is already resolved.
384  */
385 static void
386 backpatch(list, target)
387 	struct block *list, *target;
388 {
389 	struct block *next;
390 
391 	while (list) {
392 		if (!list->sense) {
393 			next = JT(list);
394 			JT(list) = target;
395 		} else {
396 			next = JF(list);
397 			JF(list) = target;
398 		}
399 		list = next;
400 	}
401 }
402 
403 /*
404  * Merge the lists in b0 and b1, using the 'sense' field to indicate
405  * which of jt and jf is the link.
406  */
407 static void
408 merge(b0, b1)
409 	struct block *b0, *b1;
410 {
411 	register struct block **p = &b0;
412 
413 	/* Find end of list. */
414 	while (*p)
415 		p = !((*p)->sense) ? &JT(*p) : &JF(*p);
416 
417 	/* Concatenate the lists. */
418 	*p = b1;
419 }
420 
421 void
422 finish_parse(p)
423 	struct block *p;
424 {
425 	backpatch(p, gen_retblk(snaplen));
426 	p->sense = !p->sense;
427 	backpatch(p, gen_retblk(0));
428 	root = p->head;
429 }
430 
431 void
432 gen_and(b0, b1)
433 	struct block *b0, *b1;
434 {
435 	backpatch(b0, b1->head);
436 	b0->sense = !b0->sense;
437 	b1->sense = !b1->sense;
438 	merge(b1, b0);
439 	b1->sense = !b1->sense;
440 	b1->head = b0->head;
441 }
442 
443 void
444 gen_or(b0, b1)
445 	struct block *b0, *b1;
446 {
447 	b0->sense = !b0->sense;
448 	backpatch(b0, b1->head);
449 	b0->sense = !b0->sense;
450 	merge(b1, b0);
451 	b1->head = b0->head;
452 }
453 
454 void
455 gen_not(b)
456 	struct block *b;
457 {
458 	b->sense = !b->sense;
459 }
460 
461 static struct block *
462 gen_cmp(offset, size, v)
463 	u_int offset, size;
464 	bpf_int32 v;
465 {
466 	struct slist *s;
467 	struct block *b;
468 
469 	s = new_stmt(BPF_LD|BPF_ABS|size);
470 	s->s.k = offset;
471 
472 	b = new_block(JMP(BPF_JEQ));
473 	b->stmts = s;
474 	b->s.k = v;
475 
476 	return b;
477 }
478 
479 static struct block *
480 gen_mcmp(offset, size, v, mask)
481 	u_int offset, size;
482 	bpf_int32 v;
483 	bpf_u_int32 mask;
484 {
485 	struct block *b = gen_cmp(offset, size, v);
486 	struct slist *s;
487 
488 	if (mask != 0xffffffff) {
489 		s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
490 		s->s.k = mask;
491 		b->stmts->next = s;
492 	}
493 	return b;
494 }
495 
496 static struct block *
497 gen_bcmp(offset, size, v)
498 	register u_int offset, size;
499 	register const u_char *v;
500 {
501 	register struct block *b, *tmp;
502 
503 	b = NULL;
504 	while (size >= 4) {
505 		register const u_char *p = &v[size - 4];
506 		bpf_int32 w = ((bpf_int32)p[0] << 24) |
507 		    ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3];
508 
509 		tmp = gen_cmp(offset + size - 4, BPF_W, w);
510 		if (b != NULL)
511 			gen_and(b, tmp);
512 		b = tmp;
513 		size -= 4;
514 	}
515 	while (size >= 2) {
516 		register const u_char *p = &v[size - 2];
517 		bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1];
518 
519 		tmp = gen_cmp(offset + size - 2, BPF_H, w);
520 		if (b != NULL)
521 			gen_and(b, tmp);
522 		b = tmp;
523 		size -= 2;
524 	}
525 	if (size > 0) {
526 		tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]);
527 		if (b != NULL)
528 			gen_and(b, tmp);
529 		b = tmp;
530 	}
531 	return b;
532 }
533 
534 /*
535  * Various code constructs need to know the layout of the data link
536  * layer.  These variables give the necessary offsets.  off_linktype
537  * is set to -1 for no encapsulation, in which case, IP is assumed.
538  */
539 static u_int off_linktype;
540 static u_int off_nl;
541 static int linktype;
542 
543 static void
544 init_linktype(type)
545 	int type;
546 {
547 	linktype = type;
548 
549 	switch (type) {
550 
551 	case DLT_ARCNET:
552 		off_linktype = 2;
553 		off_nl = 6;	/* XXX in reality, variable! */
554 		return;
555 
556 	case DLT_EN10MB:
557 		off_linktype = 12;
558 		off_nl = 14;
559 		return;
560 
561 	case DLT_SLIP:
562 		/*
563 		 * SLIP doesn't have a link level type.  The 16 byte
564 		 * header is hacked into our SLIP driver.
565 		 */
566 		off_linktype = -1;
567 		off_nl = 16;
568 		return;
569 
570 	case DLT_SLIP_BSDOS:
571 		/* XXX this may be the same as the DLT_PPP_BSDOS case */
572 		off_linktype = -1;
573 		/* XXX end */
574 		off_nl = 24;
575 		return;
576 
577 	case DLT_NULL:
578 		off_linktype = 0;
579 		off_nl = 4;
580 		return;
581 
582 	case DLT_PPP:
583 		off_linktype = 2;
584 		off_nl = 4;
585 		return;
586 
587 	case DLT_PPP_BSDOS:
588 		off_linktype = 5;
589 		off_nl = 24;
590 		return;
591 
592 	case DLT_FDDI:
593 		/*
594 		 * FDDI doesn't really have a link-level type field.
595 		 * We assume that SSAP = SNAP is being used and pick
596 		 * out the encapsulated Ethernet type.
597 		 */
598 		off_linktype = 19;
599 #ifdef PCAP_FDDIPAD
600 		off_linktype += pcap_fddipad;
601 #endif
602 		off_nl = 21;
603 #ifdef PCAP_FDDIPAD
604 		off_nl += pcap_fddipad;
605 #endif
606 		return;
607 
608 	case DLT_IEEE802:
609 		off_linktype = 20;
610 		off_nl = 22;
611 		return;
612 
613 	case DLT_ATM_RFC1483:
614 		/*
615 		 * assume routed, non-ISO PDUs
616 		 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
617 		 */
618 		off_linktype = 6;
619 		off_nl = 8;
620 		return;
621 
622 	case DLT_LOOP:
623 		off_linktype = -1;
624 		off_nl = 4;
625 		return;
626 
627 	case DLT_ENC:
628 		off_linktype = -1;
629 		off_nl = 12;
630 		return;
631 
632 	case DLT_PFLOG:
633 		off_linktype = -1;
634 		off_nl = 28;
635 		return;
636 
637 	case DLT_RAW:
638 		off_linktype = -1;
639 		off_nl = 0;
640 		return;
641 	}
642 	bpf_error("unknown data link type 0x%x", linktype);
643 	/* NOTREACHED */
644 }
645 
646 static struct block *
647 gen_uncond(rsense)
648 	int rsense;
649 {
650 	struct block *b;
651 	struct slist *s;
652 
653 	s = new_stmt(BPF_LD|BPF_IMM);
654 	s->s.k = !rsense;
655 	b = new_block(JMP(BPF_JEQ));
656 	b->stmts = s;
657 
658 	return b;
659 }
660 
661 static __inline struct block *
662 gen_true()
663 {
664 	return gen_uncond(1);
665 }
666 
667 static __inline struct block *
668 gen_false()
669 {
670 	return gen_uncond(0);
671 }
672 
673 static struct block *
674 gen_linktype(proto)
675 	register int proto;
676 {
677 	struct block *b0, *b1;
678 
679 	/* If we're not using encapsulation and checking for IP, we're done */
680 	if (off_linktype == -1 && proto == ETHERTYPE_IP)
681 		return gen_true();
682 #ifdef INET6
683 	/* this isn't the right thing to do, but sometimes necessary */
684 	if (off_linktype == -1 && proto == ETHERTYPE_IPV6)
685 		return gen_true();
686 #endif
687 
688 	switch (linktype) {
689 
690 	case DLT_SLIP:
691 		return gen_false();
692 
693 	case DLT_PPP:
694 		if (proto == ETHERTYPE_IP)
695 			proto = PPP_IP;			/* XXX was 0x21 */
696 #ifdef INET6
697 		else if (proto == ETHERTYPE_IPV6)
698 			proto = PPP_IPV6;
699 #endif
700 		break;
701 
702 	case DLT_PPP_BSDOS:
703 		switch (proto) {
704 
705 		case ETHERTYPE_IP:
706 			b0 = gen_cmp(off_linktype, BPF_H, PPP_IP);
707 			b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC);
708 			gen_or(b0, b1);
709 			b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC);
710 			gen_or(b1, b0);
711 			return b0;
712 
713 #ifdef INET6
714 		case ETHERTYPE_IPV6:
715 			proto = PPP_IPV6;
716 			/* more to go? */
717 			break;
718 #endif /* INET6 */
719 
720 		case ETHERTYPE_DN:
721 			proto = PPP_DECNET;
722 			break;
723 
724 		case ETHERTYPE_ATALK:
725 			proto = PPP_APPLE;
726 			break;
727 
728 		case ETHERTYPE_NS:
729 			proto = PPP_NS;
730 			break;
731 		}
732 		break;
733 
734 	case DLT_LOOP:
735 	case DLT_ENC:
736 	case DLT_PFLOG:
737 	case DLT_NULL:
738 		/* XXX */
739 		if (proto == ETHERTYPE_IP)
740 			return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET)));
741 #ifdef INET6
742 		else if (proto == ETHERTYPE_IPV6)
743 			return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET6)));
744 #endif /* INET6 */
745 		else
746 			return gen_false();
747 		break;
748 	case DLT_ARCNET:
749 		/*
750 		 * XXX should we check for first fragment if the protocol
751 		 * uses PHDS?
752 		 */
753 		switch(proto) {
754 		default:
755 			return gen_false();
756 #ifdef INET6
757 		case ETHERTYPE_IPV6:
758 			return(gen_cmp(2, BPF_B,
759 					(bpf_int32)htonl(ARCTYPE_INET6)));
760 #endif /* INET6 */
761 		case ETHERTYPE_IP:
762 			b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_IP));
763 			b1 = gen_cmp(2, BPF_B,
764 					(bpf_int32)htonl(ARCTYPE_IP_OLD));
765 			gen_or(b0, b1);
766 			return(b1);
767 		case ETHERTYPE_ARP:
768 			b0 = gen_cmp(2, BPF_B, (bpf_int32)htonl(ARCTYPE_ARP));
769 			b1 = gen_cmp(2, BPF_B,
770 					(bpf_int32)htonl(ARCTYPE_ARP_OLD));
771 			gen_or(b0, b1);
772 			return(b1);
773 		case ETHERTYPE_REVARP:
774 			return(gen_cmp(2, BPF_B,
775 					(bpf_int32)htonl(ARCTYPE_REVARP)));
776 		case ETHERTYPE_ATALK:
777 			return(gen_cmp(2, BPF_B,
778 					(bpf_int32)htonl(ARCTYPE_ATALK)));
779 		}
780 	}
781 	return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto);
782 }
783 
784 static struct block *
785 gen_hostop(addr, mask, dir, proto, src_off, dst_off)
786 	bpf_u_int32 addr;
787 	bpf_u_int32 mask;
788 	int dir, proto;
789 	u_int src_off, dst_off;
790 {
791 	struct block *b0, *b1;
792 	u_int offset;
793 
794 	switch (dir) {
795 
796 	case Q_SRC:
797 		offset = src_off;
798 		break;
799 
800 	case Q_DST:
801 		offset = dst_off;
802 		break;
803 
804 	case Q_AND:
805 		b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
806 		b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
807 		gen_and(b0, b1);
808 		return b1;
809 
810 	case Q_OR:
811 	case Q_DEFAULT:
812 		b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off);
813 		b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off);
814 		gen_or(b0, b1);
815 		return b1;
816 
817 	default:
818 		abort();
819 	}
820 	b0 = gen_linktype(proto);
821 	b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask);
822 	gen_and(b0, b1);
823 	return b1;
824 }
825 
826 #ifdef INET6
827 static struct block *
828 gen_hostop6(addr, mask, dir, proto, src_off, dst_off)
829 	struct in6_addr *addr;
830 	struct in6_addr *mask;
831 	int dir, proto;
832 	u_int src_off, dst_off;
833 {
834 	struct block *b0, *b1;
835 	u_int offset;
836 	u_int32_t *a, *m;
837 
838 	switch (dir) {
839 
840 	case Q_SRC:
841 		offset = src_off;
842 		break;
843 
844 	case Q_DST:
845 		offset = dst_off;
846 		break;
847 
848 	case Q_AND:
849 		b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
850 		b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
851 		gen_and(b0, b1);
852 		return b1;
853 
854 	case Q_OR:
855 	case Q_DEFAULT:
856 		b0 = gen_hostop6(addr, mask, Q_SRC, proto, src_off, dst_off);
857 		b1 = gen_hostop6(addr, mask, Q_DST, proto, src_off, dst_off);
858 		gen_or(b0, b1);
859 		return b1;
860 
861 	default:
862 		abort();
863 	}
864 	/* this order is important */
865 	a = (u_int32_t *)addr;
866 	m = (u_int32_t *)mask;
867 	b1 = gen_mcmp(offset + 12, BPF_W, ntohl(a[3]), ntohl(m[3]));
868 	b0 = gen_mcmp(offset + 8, BPF_W, ntohl(a[2]), ntohl(m[2]));
869 	gen_and(b0, b1);
870 	b0 = gen_mcmp(offset + 4, BPF_W, ntohl(a[1]), ntohl(m[1]));
871 	gen_and(b0, b1);
872 	b0 = gen_mcmp(offset + 0, BPF_W, ntohl(a[0]), ntohl(m[0]));
873 	gen_and(b0, b1);
874 	b0 = gen_linktype(proto);
875 	gen_and(b0, b1);
876 	return b1;
877 }
878 #endif /*INET6*/
879 
880 static struct block *
881 gen_ehostop(eaddr, dir)
882 	register const u_char *eaddr;
883 	register int dir;
884 {
885 	struct block *b0, *b1;
886 
887 	switch (dir) {
888 	case Q_SRC:
889 		return gen_bcmp(6, 6, eaddr);
890 
891 	case Q_DST:
892 		return gen_bcmp(0, 6, eaddr);
893 
894 	case Q_AND:
895 		b0 = gen_ehostop(eaddr, Q_SRC);
896 		b1 = gen_ehostop(eaddr, Q_DST);
897 		gen_and(b0, b1);
898 		return b1;
899 
900 	case Q_DEFAULT:
901 	case Q_OR:
902 		b0 = gen_ehostop(eaddr, Q_SRC);
903 		b1 = gen_ehostop(eaddr, Q_DST);
904 		gen_or(b0, b1);
905 		return b1;
906 	}
907 	abort();
908 	/* NOTREACHED */
909 }
910 
911 /*
912  * Like gen_ehostop, but for DLT_FDDI
913  */
914 static struct block *
915 gen_fhostop(eaddr, dir)
916 	register const u_char *eaddr;
917 	register int dir;
918 {
919 	struct block *b0, *b1;
920 
921 	switch (dir) {
922 	case Q_SRC:
923 #ifdef PCAP_FDDIPAD
924 		return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr);
925 #else
926 		return gen_bcmp(6 + 1, 6, eaddr);
927 #endif
928 
929 	case Q_DST:
930 #ifdef PCAP_FDDIPAD
931 		return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr);
932 #else
933 		return gen_bcmp(0 + 1, 6, eaddr);
934 #endif
935 
936 	case Q_AND:
937 		b0 = gen_fhostop(eaddr, Q_SRC);
938 		b1 = gen_fhostop(eaddr, Q_DST);
939 		gen_and(b0, b1);
940 		return b1;
941 
942 	case Q_DEFAULT:
943 	case Q_OR:
944 		b0 = gen_fhostop(eaddr, Q_SRC);
945 		b1 = gen_fhostop(eaddr, Q_DST);
946 		gen_or(b0, b1);
947 		return b1;
948 	}
949 	abort();
950 	/* NOTREACHED */
951 }
952 
953 /*
954  * This is quite tricky because there may be pad bytes in front of the
955  * DECNET header, and then there are two possible data packet formats that
956  * carry both src and dst addresses, plus 5 packet types in a format that
957  * carries only the src node, plus 2 types that use a different format and
958  * also carry just the src node.
959  *
960  * Yuck.
961  *
962  * Instead of doing those all right, we just look for data packets with
963  * 0 or 1 bytes of padding.  If you want to look at other packets, that
964  * will require a lot more hacking.
965  *
966  * To add support for filtering on DECNET "areas" (network numbers)
967  * one would want to add a "mask" argument to this routine.  That would
968  * make the filter even more inefficient, although one could be clever
969  * and not generate masking instructions if the mask is 0xFFFF.
970  */
971 static struct block *
972 gen_dnhostop(addr, dir, base_off)
973 	bpf_u_int32 addr;
974 	int dir;
975 	u_int base_off;
976 {
977 	struct block *b0, *b1, *b2, *tmp;
978 	u_int offset_lh;	/* offset if long header is received */
979 	u_int offset_sh;	/* offset if short header is received */
980 
981 	switch (dir) {
982 
983 	case Q_DST:
984 		offset_sh = 1;	/* follows flags */
985 		offset_lh = 7;	/* flgs,darea,dsubarea,HIORD */
986 		break;
987 
988 	case Q_SRC:
989 		offset_sh = 3;	/* follows flags, dstnode */
990 		offset_lh = 15;	/* flgs,darea,dsubarea,did,sarea,ssub,HIORD */
991 		break;
992 
993 	case Q_AND:
994 		/* Inefficient because we do our Calvinball dance twice */
995 		b0 = gen_dnhostop(addr, Q_SRC, base_off);
996 		b1 = gen_dnhostop(addr, Q_DST, base_off);
997 		gen_and(b0, b1);
998 		return b1;
999 
1000 	case Q_OR:
1001 	case Q_DEFAULT:
1002 		/* Inefficient because we do our Calvinball dance twice */
1003 		b0 = gen_dnhostop(addr, Q_SRC, base_off);
1004 		b1 = gen_dnhostop(addr, Q_DST, base_off);
1005 		gen_or(b0, b1);
1006 		return b1;
1007 
1008 	default:
1009 		abort();
1010 	}
1011 	b0 = gen_linktype(ETHERTYPE_DN);
1012 	/* Check for pad = 1, long header case */
1013 	tmp = gen_mcmp(base_off + 2, BPF_H,
1014 	    (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF));
1015 	b1 = gen_cmp(base_off + 2 + 1 + offset_lh,
1016 	    BPF_H, (bpf_int32)ntohs(addr));
1017 	gen_and(tmp, b1);
1018 	/* Check for pad = 0, long header case */
1019 	tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7);
1020 	b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr));
1021 	gen_and(tmp, b2);
1022 	gen_or(b2, b1);
1023 	/* Check for pad = 1, short header case */
1024 	tmp = gen_mcmp(base_off + 2, BPF_H,
1025 	    (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF));
1026 	b2 = gen_cmp(base_off + 2 + 1 + offset_sh,
1027 	    BPF_H, (bpf_int32)ntohs(addr));
1028 	gen_and(tmp, b2);
1029 	gen_or(b2, b1);
1030 	/* Check for pad = 0, short header case */
1031 	tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7);
1032 	b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr));
1033 	gen_and(tmp, b2);
1034 	gen_or(b2, b1);
1035 
1036 	/* Combine with test for linktype */
1037 	gen_and(b0, b1);
1038 	return b1;
1039 }
1040 
1041 static struct block *
1042 gen_host(addr, mask, proto, dir)
1043 	bpf_u_int32 addr;
1044 	bpf_u_int32 mask;
1045 	int proto;
1046 	int dir;
1047 {
1048 	struct block *b0, *b1;
1049 
1050 	switch (proto) {
1051 
1052 	case Q_DEFAULT:
1053 		b0 = gen_host(addr, mask, Q_IP, dir);
1054 		b1 = gen_host(addr, mask, Q_ARP, dir);
1055 		gen_or(b0, b1);
1056 		b0 = gen_host(addr, mask, Q_RARP, dir);
1057 		gen_or(b1, b0);
1058 		return b0;
1059 
1060 	case Q_IP:
1061 		return gen_hostop(addr, mask, dir, ETHERTYPE_IP,
1062 				  off_nl + 12, off_nl + 16);
1063 
1064 	case Q_RARP:
1065 		return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP,
1066 				  off_nl + 14, off_nl + 24);
1067 
1068 	case Q_ARP:
1069 		return gen_hostop(addr, mask, dir, ETHERTYPE_ARP,
1070 				  off_nl + 14, off_nl + 24);
1071 
1072 	case Q_TCP:
1073 		bpf_error("'tcp' modifier applied to host");
1074 
1075 	case Q_UDP:
1076 		bpf_error("'udp' modifier applied to host");
1077 
1078 	case Q_ICMP:
1079 		bpf_error("'icmp' modifier applied to host");
1080 
1081 	case Q_IGMP:
1082 		bpf_error("'igmp' modifier applied to host");
1083 
1084 	case Q_IGRP:
1085 		bpf_error("'igrp' modifier applied to host");
1086 
1087 	case Q_PIM:
1088 		bpf_error("'pim' modifier applied to host");
1089 
1090 	case Q_ATALK:
1091 		bpf_error("ATALK host filtering not implemented");
1092 
1093 	case Q_DECNET:
1094 		return gen_dnhostop(addr, dir, off_nl);
1095 
1096 	case Q_SCA:
1097 		bpf_error("SCA host filtering not implemented");
1098 
1099 	case Q_LAT:
1100 		bpf_error("LAT host filtering not implemented");
1101 
1102 	case Q_MOPDL:
1103 		bpf_error("MOPDL host filtering not implemented");
1104 
1105 	case Q_MOPRC:
1106 		bpf_error("MOPRC host filtering not implemented");
1107 
1108 #ifdef INET6
1109 	case Q_IPV6:
1110 		bpf_error("'ip6' modifier applied to ip host");
1111 
1112 	case Q_ICMPV6:
1113 		bpf_error("'icmp6' modifier applied to host");
1114 #endif /* INET6 */
1115 
1116 	case Q_AH:
1117 		bpf_error("'ah' modifier applied to host");
1118 
1119 	case Q_ESP:
1120 		bpf_error("'esp' modifier applied to host");
1121 
1122 	default:
1123 		abort();
1124 	}
1125 	/* NOTREACHED */
1126 }
1127 
1128 #ifdef INET6
1129 static struct block *
1130 gen_host6(addr, mask, proto, dir)
1131 	struct in6_addr *addr;
1132 	struct in6_addr *mask;
1133 	int proto;
1134 	int dir;
1135 {
1136 	switch (proto) {
1137 
1138 	case Q_DEFAULT:
1139 		return gen_host6(addr, mask, Q_IPV6, dir);
1140 
1141 	case Q_IP:
1142 		bpf_error("'ip' modifier applied to ip6 host");
1143 
1144 	case Q_RARP:
1145 		bpf_error("'rarp' modifier applied to ip6 host");
1146 
1147 	case Q_ARP:
1148 		bpf_error("'arp' modifier applied to ip6 host");
1149 
1150 	case Q_TCP:
1151 		bpf_error("'tcp' modifier applied to host");
1152 
1153 	case Q_UDP:
1154 		bpf_error("'udp' modifier applied to host");
1155 
1156 	case Q_ICMP:
1157 		bpf_error("'icmp' modifier applied to host");
1158 
1159 	case Q_IGMP:
1160 		bpf_error("'igmp' modifier applied to host");
1161 
1162 	case Q_IGRP:
1163 		bpf_error("'igrp' modifier applied to host");
1164 
1165 	case Q_PIM:
1166 		bpf_error("'pim' modifier applied to host");
1167 
1168 	case Q_ATALK:
1169 		bpf_error("ATALK host filtering not implemented");
1170 
1171 	case Q_DECNET:
1172 		bpf_error("'decnet' modifier applied to ip6 host");
1173 
1174 	case Q_SCA:
1175 		bpf_error("SCA host filtering not implemented");
1176 
1177 	case Q_LAT:
1178 		bpf_error("LAT host filtering not implemented");
1179 
1180 	case Q_MOPDL:
1181 		bpf_error("MOPDL host filtering not implemented");
1182 
1183 	case Q_MOPRC:
1184 		bpf_error("MOPRC host filtering not implemented");
1185 
1186 	case Q_IPV6:
1187 		return gen_hostop6(addr, mask, dir, ETHERTYPE_IPV6,
1188 				  off_nl + 8, off_nl + 24);
1189 
1190 	case Q_ICMPV6:
1191 		bpf_error("'icmp6' modifier applied to host");
1192 
1193 	case Q_AH:
1194 		bpf_error("'ah' modifier applied to host");
1195 
1196 	case Q_ESP:
1197 		bpf_error("'esp' modifier applied to host");
1198 
1199 	default:
1200 		abort();
1201 	}
1202 	/* NOTREACHED */
1203 }
1204 #endif /*INET6*/
1205 
1206 #ifndef INET6
1207 static struct block *
1208 gen_gateway(eaddr, alist, proto, dir)
1209 	const u_char *eaddr;
1210 	bpf_u_int32 **alist;
1211 	int proto;
1212 	int dir;
1213 {
1214 	struct block *b0, *b1, *tmp;
1215 
1216 	if (dir != 0)
1217 		bpf_error("direction applied to 'gateway'");
1218 
1219 	switch (proto) {
1220 	case Q_DEFAULT:
1221 	case Q_IP:
1222 	case Q_ARP:
1223 	case Q_RARP:
1224 		if (linktype == DLT_EN10MB)
1225 			b0 = gen_ehostop(eaddr, Q_OR);
1226 		else if (linktype == DLT_FDDI)
1227 			b0 = gen_fhostop(eaddr, Q_OR);
1228 		else
1229 			bpf_error(
1230 			    "'gateway' supported only on ethernet or FDDI");
1231 
1232 		b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR);
1233 		while (*alist) {
1234 			tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR);
1235 			gen_or(b1, tmp);
1236 			b1 = tmp;
1237 		}
1238 		gen_not(b1);
1239 		gen_and(b0, b1);
1240 		return b1;
1241 	}
1242 	bpf_error("illegal modifier of 'gateway'");
1243 	/* NOTREACHED */
1244 }
1245 #endif	/*INET6*/
1246 
1247 struct block *
1248 gen_proto_abbrev(proto)
1249 	int proto;
1250 {
1251 	struct block *b0 = NULL, *b1;
1252 
1253 	switch (proto) {
1254 
1255 	case Q_TCP:
1256 		b1 = gen_proto(IPPROTO_TCP, Q_IP, Q_DEFAULT);
1257 #ifdef INET6
1258 		b0 = gen_proto(IPPROTO_TCP, Q_IPV6, Q_DEFAULT);
1259 		gen_or(b0, b1);
1260 #endif
1261 		break;
1262 
1263 	case Q_UDP:
1264 		b1 = gen_proto(IPPROTO_UDP, Q_IP, Q_DEFAULT);
1265 #ifdef INET6
1266 		b0 = gen_proto(IPPROTO_UDP, Q_IPV6, Q_DEFAULT);
1267 		gen_or(b0, b1);
1268 #endif
1269 		break;
1270 
1271 	case Q_ICMP:
1272 		b1 = gen_proto(IPPROTO_ICMP, Q_IP, Q_DEFAULT);
1273 		break;
1274 
1275 #ifndef	IPPROTO_IGMP
1276 #define	IPPROTO_IGMP	2
1277 #endif
1278 
1279 	case Q_IGMP:
1280 		b1 = gen_proto(IPPROTO_IGMP, Q_IP, Q_DEFAULT);
1281 		break;
1282 
1283 #ifndef	IPPROTO_IGRP
1284 #define	IPPROTO_IGRP	9
1285 #endif
1286 	case Q_IGRP:
1287 		b1 = gen_proto(IPPROTO_IGRP, Q_IP, Q_DEFAULT);
1288 		break;
1289 
1290 #ifndef IPPROTO_PIM
1291 #define IPPROTO_PIM	103
1292 #endif
1293 
1294 	case Q_PIM:
1295 		b1 = gen_proto(IPPROTO_PIM, Q_IP, Q_DEFAULT);
1296 #ifdef INET6
1297 		b0 = gen_proto(IPPROTO_PIM, Q_IPV6, Q_DEFAULT);
1298 		gen_or(b0, b1);
1299 #endif
1300 		break;
1301 
1302 	case Q_IP:
1303 		b1 =  gen_linktype(ETHERTYPE_IP);
1304 		break;
1305 
1306 	case Q_ARP:
1307 		b1 =  gen_linktype(ETHERTYPE_ARP);
1308 		break;
1309 
1310 	case Q_RARP:
1311 		b1 =  gen_linktype(ETHERTYPE_REVARP);
1312 		break;
1313 
1314 	case Q_LINK:
1315 		bpf_error("link layer applied in wrong context");
1316 
1317 	case Q_ATALK:
1318 		b1 =  gen_linktype(ETHERTYPE_ATALK);
1319 		break;
1320 
1321 	case Q_DECNET:
1322 		b1 =  gen_linktype(ETHERTYPE_DN);
1323 		break;
1324 
1325 	case Q_SCA:
1326 		b1 =  gen_linktype(ETHERTYPE_SCA);
1327 		break;
1328 
1329 	case Q_LAT:
1330 		b1 =  gen_linktype(ETHERTYPE_LAT);
1331 		break;
1332 
1333 	case Q_MOPDL:
1334 		b1 =  gen_linktype(ETHERTYPE_MOPDL);
1335 		break;
1336 
1337 	case Q_MOPRC:
1338 		b1 =  gen_linktype(ETHERTYPE_MOPRC);
1339 		break;
1340 
1341 #ifdef INET6
1342 	case Q_IPV6:
1343 		b1 = gen_linktype(ETHERTYPE_IPV6);
1344 		break;
1345 
1346 #ifndef IPPROTO_ICMPV6
1347 #define IPPROTO_ICMPV6	58
1348 #endif
1349 	case Q_ICMPV6:
1350 		b1 = gen_proto(IPPROTO_ICMPV6, Q_IPV6, Q_DEFAULT);
1351 		break;
1352 #endif /* INET6 */
1353 
1354 #ifndef IPPROTO_AH
1355 #define IPPROTO_AH	51
1356 #endif
1357 	case Q_AH:
1358 		b1 = gen_proto(IPPROTO_AH, Q_IP, Q_DEFAULT);
1359 #ifdef INET6
1360 		b0 = gen_proto(IPPROTO_AH, Q_IPV6, Q_DEFAULT);
1361 		gen_or(b0, b1);
1362 #endif
1363 		break;
1364 
1365 #ifndef IPPROTO_ESP
1366 #define IPPROTO_ESP	50
1367 #endif
1368 	case Q_ESP:
1369 		b1 = gen_proto(IPPROTO_ESP, Q_IP, Q_DEFAULT);
1370 #ifdef INET6
1371 		b0 = gen_proto(IPPROTO_ESP, Q_IPV6, Q_DEFAULT);
1372 		gen_or(b0, b1);
1373 #endif
1374 		break;
1375 
1376 	default:
1377 		abort();
1378 	}
1379 	return b1;
1380 }
1381 
1382 static struct block *
1383 gen_ipfrag()
1384 {
1385 	struct slist *s;
1386 	struct block *b;
1387 
1388 	/* not ip frag */
1389 	s = new_stmt(BPF_LD|BPF_H|BPF_ABS);
1390 	s->s.k = off_nl + 6;
1391 	b = new_block(JMP(BPF_JSET));
1392 	b->s.k = 0x1fff;
1393 	b->stmts = s;
1394 	gen_not(b);
1395 
1396 	return b;
1397 }
1398 
1399 static struct block *
1400 gen_portatom(off, v)
1401 	int off;
1402 	bpf_int32 v;
1403 {
1404 	struct slist *s;
1405 	struct block *b;
1406 
1407 	s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
1408 	s->s.k = off_nl;
1409 
1410 	s->next = new_stmt(BPF_LD|BPF_IND|BPF_H);
1411 	s->next->s.k = off_nl + off;
1412 
1413 	b = new_block(JMP(BPF_JEQ));
1414 	b->stmts = s;
1415 	b->s.k = v;
1416 
1417 	return b;
1418 }
1419 
1420 #ifdef INET6
1421 static struct block *
1422 gen_portatom6(off, v)
1423 	int off;
1424 	bpf_int32 v;
1425 {
1426 	return gen_cmp(off_nl + 40 + off, BPF_H, v);
1427 }
1428 #endif/*INET6*/
1429 
1430 struct block *
1431 gen_portop(port, proto, dir)
1432 	int port, proto, dir;
1433 {
1434 	struct block *b0, *b1, *tmp;
1435 
1436 	/* ip proto 'proto' */
1437 	tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto);
1438 	b0 = gen_ipfrag();
1439 	gen_and(tmp, b0);
1440 
1441 	switch (dir) {
1442 	case Q_SRC:
1443 		b1 = gen_portatom(0, (bpf_int32)port);
1444 		break;
1445 
1446 	case Q_DST:
1447 		b1 = gen_portatom(2, (bpf_int32)port);
1448 		break;
1449 
1450 	case Q_OR:
1451 	case Q_DEFAULT:
1452 		tmp = gen_portatom(0, (bpf_int32)port);
1453 		b1 = gen_portatom(2, (bpf_int32)port);
1454 		gen_or(tmp, b1);
1455 		break;
1456 
1457 	case Q_AND:
1458 		tmp = gen_portatom(0, (bpf_int32)port);
1459 		b1 = gen_portatom(2, (bpf_int32)port);
1460 		gen_and(tmp, b1);
1461 		break;
1462 
1463 	default:
1464 		abort();
1465 	}
1466 	gen_and(b0, b1);
1467 
1468 	return b1;
1469 }
1470 
1471 static struct block *
1472 gen_port(port, ip_proto, dir)
1473 	int port;
1474 	int ip_proto;
1475 	int dir;
1476 {
1477 	struct block *b0, *b1, *tmp;
1478 
1479 	/* ether proto ip */
1480 	b0 =  gen_linktype(ETHERTYPE_IP);
1481 
1482 	switch (ip_proto) {
1483 	case IPPROTO_UDP:
1484 	case IPPROTO_TCP:
1485 		b1 = gen_portop(port, ip_proto, dir);
1486 		break;
1487 
1488 	case PROTO_UNDEF:
1489 		tmp = gen_portop(port, IPPROTO_TCP, dir);
1490 		b1 = gen_portop(port, IPPROTO_UDP, dir);
1491 		gen_or(tmp, b1);
1492 		break;
1493 
1494 	default:
1495 		abort();
1496 	}
1497 	gen_and(b0, b1);
1498 	return b1;
1499 }
1500 
1501 #ifdef INET6
1502 struct block *
1503 gen_portop6(port, proto, dir)
1504 	int port, proto, dir;
1505 {
1506 	struct block *b0, *b1, *tmp;
1507 
1508 	/* ip proto 'proto' */
1509 	b0 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)proto);
1510 
1511 	switch (dir) {
1512 	case Q_SRC:
1513 		b1 = gen_portatom6(0, (bpf_int32)port);
1514 		break;
1515 
1516 	case Q_DST:
1517 		b1 = gen_portatom6(2, (bpf_int32)port);
1518 		break;
1519 
1520 	case Q_OR:
1521 	case Q_DEFAULT:
1522 		tmp = gen_portatom6(0, (bpf_int32)port);
1523 		b1 = gen_portatom6(2, (bpf_int32)port);
1524 		gen_or(tmp, b1);
1525 		break;
1526 
1527 	case Q_AND:
1528 		tmp = gen_portatom6(0, (bpf_int32)port);
1529 		b1 = gen_portatom6(2, (bpf_int32)port);
1530 		gen_and(tmp, b1);
1531 		break;
1532 
1533 	default:
1534 		abort();
1535 	}
1536 	gen_and(b0, b1);
1537 
1538 	return b1;
1539 }
1540 
1541 static struct block *
1542 gen_port6(port, ip_proto, dir)
1543 	int port;
1544 	int ip_proto;
1545 	int dir;
1546 {
1547 	struct block *b0, *b1, *tmp;
1548 
1549 	/* ether proto ip */
1550 	b0 =  gen_linktype(ETHERTYPE_IPV6);
1551 
1552 	switch (ip_proto) {
1553 	case IPPROTO_UDP:
1554 	case IPPROTO_TCP:
1555 		b1 = gen_portop6(port, ip_proto, dir);
1556 		break;
1557 
1558 	case PROTO_UNDEF:
1559 		tmp = gen_portop6(port, IPPROTO_TCP, dir);
1560 		b1 = gen_portop6(port, IPPROTO_UDP, dir);
1561 		gen_or(tmp, b1);
1562 		break;
1563 
1564 	default:
1565 		abort();
1566 	}
1567 	gen_and(b0, b1);
1568 	return b1;
1569 }
1570 #endif /* INET6 */
1571 
1572 static int
1573 lookup_proto(name, proto)
1574 	register const char *name;
1575 	register int proto;
1576 {
1577 	register int v;
1578 
1579 	switch (proto) {
1580 
1581 	case Q_DEFAULT:
1582 	case Q_IP:
1583 		v = pcap_nametoproto(name);
1584 		if (v == PROTO_UNDEF)
1585 			bpf_error("unknown ip proto '%s'", name);
1586 		break;
1587 
1588 	case Q_LINK:
1589 		/* XXX should look up h/w protocol type based on linktype */
1590 		v = pcap_nametoeproto(name);
1591 		if (v == PROTO_UNDEF)
1592 			bpf_error("unknown ether proto '%s'", name);
1593 		break;
1594 
1595 	default:
1596 		v = PROTO_UNDEF;
1597 		break;
1598 	}
1599 	return v;
1600 }
1601 
1602 static struct block *
1603 gen_protochain(v, proto, dir)
1604 	int v;
1605 	int proto;
1606 	int dir;
1607 {
1608 	struct block *b0, *b;
1609 	struct slist *s[100];
1610 	int fix2, fix3, fix4, fix5;
1611 	int ahcheck, again, end;
1612 	int i, max;
1613 	int reg1 = alloc_reg();
1614 	int reg2 = alloc_reg();
1615 
1616 	memset(s, 0, sizeof(s));
1617 	fix2 = fix3 = fix4 = fix5 = 0;
1618 
1619 	switch (proto) {
1620 	case Q_IP:
1621 	case Q_IPV6:
1622 		break;
1623 	case Q_DEFAULT:
1624 		b0 = gen_protochain(v, Q_IP, dir);
1625 		b = gen_protochain(v, Q_IPV6, dir);
1626 		gen_or(b0, b);
1627 		return b;
1628 	default:
1629 		bpf_error("bad protocol applied for 'protochain'");
1630 		/*NOTREACHED*/
1631 	}
1632 
1633 	no_optimize = 1; /*this code is not compatible with optimzer yet */
1634 
1635 	/*
1636 	 * s[0] is a dummy entry to protect other BPF insn from damaged
1637 	 * by s[fix] = foo with uninitialized variable "fix".  It is somewhat
1638 	 * hard to find interdependency made by jump table fixup.
1639 	 */
1640 	i = 0;
1641 	s[i] = new_stmt(0);	/*dummy*/
1642 	i++;
1643 
1644 	switch (proto) {
1645 	case Q_IP:
1646 		b0 = gen_linktype(ETHERTYPE_IP);
1647 
1648 		/* A = ip->ip_p */
1649 		s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
1650 		s[i]->s.k = off_nl + 9;
1651 		i++;
1652 		/* X = ip->ip_hl << 2 */
1653 		s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
1654 		s[i]->s.k = off_nl;
1655 		i++;
1656 		break;
1657 	case Q_IPV6:
1658 		b0 = gen_linktype(ETHERTYPE_IPV6);
1659 
1660 		/* A = ip6->ip_nxt */
1661 		s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
1662 		s[i]->s.k = off_nl + 6;
1663 		i++;
1664 		/* X = sizeof(struct ip6_hdr) */
1665 		s[i] = new_stmt(BPF_LDX|BPF_IMM);
1666 		s[i]->s.k = 40;
1667 		i++;
1668 		break;
1669 	default:
1670 		bpf_error("unsupported proto to gen_protochain");
1671 		/*NOTREACHED*/
1672 	}
1673 
1674 	/* again: if (A == v) goto end; else fall through; */
1675 	again = i;
1676 	s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1677 	s[i]->s.k = v;
1678 	s[i]->s.jt = NULL;		/*later*/
1679 	s[i]->s.jf = NULL;		/*update in next stmt*/
1680 	fix5 = i;
1681 	i++;
1682 
1683 	/* if (A == IPPROTO_NONE) goto end */
1684 	s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1685 	s[i]->s.jt = NULL;	/*later*/
1686 	s[i]->s.jf = NULL;	/*update in next stmt*/
1687 	s[i]->s.k = IPPROTO_NONE;
1688 	s[fix5]->s.jf = s[i];
1689 	fix2 = i;
1690 	i++;
1691 
1692 	if (proto == Q_IPV6) {
1693 		int v6start, v6end, v6advance, j;
1694 
1695 		v6start = i;
1696 		/* if (A == IPPROTO_HOPOPTS) goto v6advance */
1697 		s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1698 		s[i]->s.jt = NULL;	/*later*/
1699 		s[i]->s.jf = NULL;	/*update in next stmt*/
1700 		s[i]->s.k = IPPROTO_HOPOPTS;
1701 		s[fix2]->s.jf = s[i];
1702 		i++;
1703 		/* if (A == IPPROTO_DSTOPTS) goto v6advance */
1704 		s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1705 		s[i]->s.jt = NULL;	/*later*/
1706 		s[i]->s.jf = NULL;	/*update in next stmt*/
1707 		s[i]->s.k = IPPROTO_DSTOPTS;
1708 		i++;
1709 		/* if (A == IPPROTO_ROUTING) goto v6advance */
1710 		s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1711 		s[i]->s.jt = NULL;	/*later*/
1712 		s[i]->s.jf = NULL;	/*update in next stmt*/
1713 		s[i]->s.k = IPPROTO_ROUTING;
1714 		i++;
1715 		/* if (A == IPPROTO_FRAGMENT) goto v6advance; else goto ahcheck; */
1716 		s[i - 1]->s.jf = s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1717 		s[i]->s.jt = NULL;	/*later*/
1718 		s[i]->s.jf = NULL;	/*later*/
1719 		s[i]->s.k = IPPROTO_FRAGMENT;
1720 		fix3 = i;
1721 		v6end = i;
1722 		i++;
1723 
1724 		/* v6advance: */
1725 		v6advance = i;
1726 
1727 		/*
1728 		 * in short,
1729 		 * A = P[X + 1];
1730 		 * X = X + (P[X] + 1) * 8;
1731 		 */
1732 		/* A = X */
1733 		s[i] = new_stmt(BPF_MISC|BPF_TXA);
1734 		i++;
1735 		/* MEM[reg1] = A */
1736 		s[i] = new_stmt(BPF_ST);
1737 		s[i]->s.k = reg1;
1738 		i++;
1739 		/* A += 1 */
1740 		s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
1741 		s[i]->s.k = 1;
1742 		i++;
1743 		/* X = A */
1744 		s[i] = new_stmt(BPF_MISC|BPF_TAX);
1745 		i++;
1746 		/* A = P[X + packet head]; */
1747 		s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
1748 		s[i]->s.k = off_nl;
1749 		i++;
1750 		/* MEM[reg2] = A */
1751 		s[i] = new_stmt(BPF_ST);
1752 		s[i]->s.k = reg2;
1753 		i++;
1754 		/* X = MEM[reg1] */
1755 		s[i] = new_stmt(BPF_LDX|BPF_MEM);
1756 		s[i]->s.k = reg1;
1757 		i++;
1758 		/* A = P[X + packet head] */
1759 		s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
1760 		s[i]->s.k = off_nl;
1761 		i++;
1762 		/* A += 1 */
1763 		s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
1764 		s[i]->s.k = 1;
1765 		i++;
1766 		/* A *= 8 */
1767 		s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
1768 		s[i]->s.k = 8;
1769 		i++;
1770 		/* X = A; */
1771 		s[i] = new_stmt(BPF_MISC|BPF_TAX);
1772 		i++;
1773 		/* A = MEM[reg2] */
1774 		s[i] = new_stmt(BPF_LD|BPF_MEM);
1775 		s[i]->s.k = reg2;
1776 		i++;
1777 
1778 		/* goto again; (must use BPF_JA for backward jump) */
1779 		s[i] = new_stmt(BPF_JMP|BPF_JA);
1780 		s[i]->s.k = again - i - 1;
1781 		s[i - 1]->s.jf = s[i];
1782 		i++;
1783 
1784 		/* fixup */
1785 		for (j = v6start; j <= v6end; j++)
1786 			s[j]->s.jt = s[v6advance];
1787 	} else {
1788 		/* nop */
1789 		s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
1790 		s[i]->s.k = 0;
1791 		s[fix2]->s.jf = s[i];
1792 		i++;
1793 	}
1794 
1795 	/* ahcheck: */
1796 	ahcheck = i;
1797 	/* if (A == IPPROTO_AH) then fall through; else goto end; */
1798 	s[i] = new_stmt(BPF_JMP|BPF_JEQ|BPF_K);
1799 	s[i]->s.jt = NULL;	/*later*/
1800 	s[i]->s.jf = NULL;	/*later*/
1801 	s[i]->s.k = IPPROTO_AH;
1802 	if (fix3)
1803 		s[fix3]->s.jf = s[ahcheck];
1804 	fix4 = i;
1805 	i++;
1806 
1807 	/*
1808 	 * in short,
1809 	 * A = P[X + 1];
1810 	 * X = X + (P[X] + 2) * 4;
1811 	 */
1812 	/* A = X */
1813 	s[i - 1]->s.jt = s[i] = new_stmt(BPF_MISC|BPF_TXA);
1814 	i++;
1815 	/* MEM[reg1] = A */
1816 	s[i] = new_stmt(BPF_ST);
1817 	s[i]->s.k = reg1;
1818 	i++;
1819 	/* A += 1 */
1820 	s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
1821 	s[i]->s.k = 1;
1822 	i++;
1823 	/* X = A */
1824 	s[i] = new_stmt(BPF_MISC|BPF_TAX);
1825 	i++;
1826 	/* A = P[X + packet head]; */
1827 	s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
1828 	s[i]->s.k = off_nl;
1829 	i++;
1830 	/* MEM[reg2] = A */
1831 	s[i] = new_stmt(BPF_ST);
1832 	s[i]->s.k = reg2;
1833 	i++;
1834 	/* X = MEM[reg1] */
1835 	s[i] = new_stmt(BPF_LDX|BPF_MEM);
1836 	s[i]->s.k = reg1;
1837 	i++;
1838 	/* A = P[X + packet head] */
1839 	s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
1840 	s[i]->s.k = off_nl;
1841 	i++;
1842 	/* A += 2 */
1843 	s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
1844 	s[i]->s.k = 2;
1845 	i++;
1846 	/* A *= 4 */
1847 	s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
1848 	s[i]->s.k = 4;
1849 	i++;
1850 	/* X = A; */
1851 	s[i] = new_stmt(BPF_MISC|BPF_TAX);
1852 	i++;
1853 	/* A = MEM[reg2] */
1854 	s[i] = new_stmt(BPF_LD|BPF_MEM);
1855 	s[i]->s.k = reg2;
1856 	i++;
1857 
1858 	/* goto again; (must use BPF_JA for backward jump) */
1859 	s[i] = new_stmt(BPF_JMP|BPF_JA);
1860 	s[i]->s.k = again - i - 1;
1861 	i++;
1862 
1863 	/* end: nop */
1864 	end = i;
1865 	s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
1866 	s[i]->s.k = 0;
1867 	s[fix2]->s.jt = s[end];
1868 	s[fix4]->s.jf = s[end];
1869 	s[fix5]->s.jt = s[end];
1870 	i++;
1871 
1872 	/*
1873 	 * make slist chain
1874 	 */
1875 	max = i;
1876 	for (i = 0; i < max - 1; i++)
1877 		s[i]->next = s[i + 1];
1878 	s[max - 1]->next = NULL;
1879 
1880 	/*
1881 	 * emit final check
1882 	 */
1883 	b = new_block(JMP(BPF_JEQ));
1884 	b->stmts = s[1];	/*remember, s[0] is dummy*/
1885 	b->s.k = v;
1886 
1887 	free_reg(reg1);
1888 	free_reg(reg2);
1889 
1890 	gen_and(b0, b);
1891 	return b;
1892 }
1893 
1894 static struct block *
1895 gen_proto(v, proto, dir)
1896 	int v;
1897 	int proto;
1898 	int dir;
1899 {
1900 	struct block *b0, *b1;
1901 
1902 	if (dir != Q_DEFAULT)
1903 		bpf_error("direction applied to 'proto'");
1904 
1905 	switch (proto) {
1906 	case Q_DEFAULT:
1907 #ifdef INET6
1908 		b0 = gen_proto(v, Q_IP, dir);
1909 		b1 = gen_proto(v, Q_IPV6, dir);
1910 		gen_or(b0, b1);
1911 		return b1;
1912 #else
1913 		/*FALLTHROUGH*/
1914 #endif
1915 	case Q_IP:
1916 		b0 = gen_linktype(ETHERTYPE_IP);
1917 #ifndef CHASE_CHAIN
1918 		b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v);
1919 #else
1920 		b1 = gen_protochain(v, Q_IP);
1921 #endif
1922 		gen_and(b0, b1);
1923 		return b1;
1924 
1925 	case Q_ARP:
1926 		bpf_error("arp does not encapsulate another protocol");
1927 		/* NOTREACHED */
1928 
1929 	case Q_RARP:
1930 		bpf_error("rarp does not encapsulate another protocol");
1931 		/* NOTREACHED */
1932 
1933 	case Q_ATALK:
1934 		bpf_error("atalk encapsulation is not specifiable");
1935 		/* NOTREACHED */
1936 
1937 	case Q_DECNET:
1938 		bpf_error("decnet encapsulation is not specifiable");
1939 		/* NOTREACHED */
1940 
1941 	case Q_SCA:
1942 		bpf_error("sca does not encapsulate another protocol");
1943 		/* NOTREACHED */
1944 
1945 	case Q_LAT:
1946 		bpf_error("lat does not encapsulate another protocol");
1947 		/* NOTREACHED */
1948 
1949 	case Q_MOPRC:
1950 		bpf_error("moprc does not encapsulate another protocol");
1951 		/* NOTREACHED */
1952 
1953 	case Q_MOPDL:
1954 		bpf_error("mopdl does not encapsulate another protocol");
1955 		/* NOTREACHED */
1956 
1957 	case Q_LINK:
1958 		return gen_linktype(v);
1959 
1960 	case Q_UDP:
1961 		bpf_error("'udp proto' is bogus");
1962 		/* NOTREACHED */
1963 
1964 	case Q_TCP:
1965 		bpf_error("'tcp proto' is bogus");
1966 		/* NOTREACHED */
1967 
1968 	case Q_ICMP:
1969 		bpf_error("'icmp proto' is bogus");
1970 		/* NOTREACHED */
1971 
1972 	case Q_IGMP:
1973 		bpf_error("'igmp proto' is bogus");
1974 		/* NOTREACHED */
1975 
1976 	case Q_IGRP:
1977 		bpf_error("'igrp proto' is bogus");
1978 		/* NOTREACHED */
1979 
1980 	case Q_PIM:
1981 		bpf_error("'pim proto' is bogus");
1982 		/* NOTREACHED */
1983 
1984 #ifdef INET6
1985 	case Q_IPV6:
1986 		b0 = gen_linktype(ETHERTYPE_IPV6);
1987 #ifndef CHASE_CHAIN
1988 		b1 = gen_cmp(off_nl + 6, BPF_B, (bpf_int32)v);
1989 #else
1990 		b1 = gen_protochain(v, Q_IPV6);
1991 #endif
1992 		gen_and(b0, b1);
1993 		return b1;
1994 
1995 	case Q_ICMPV6:
1996 		bpf_error("'icmp6 proto' is bogus");
1997 #endif /* INET6 */
1998 
1999 	case Q_AH:
2000 		bpf_error("'ah proto' is bogus");
2001 
2002 	case Q_ESP:
2003 		bpf_error("'ah proto' is bogus");
2004 
2005 	default:
2006 		abort();
2007 		/* NOTREACHED */
2008 	}
2009 	/* NOTREACHED */
2010 }
2011 
2012 struct block *
2013 gen_scode(name, q)
2014 	register const char *name;
2015 	struct qual q;
2016 {
2017 	int proto = q.proto;
2018 	int dir = q.dir;
2019 	int tproto;
2020 	u_char *eaddr;
2021 	bpf_u_int32 mask, addr;
2022 #ifndef INET6
2023 	bpf_u_int32 **alist;
2024 #else
2025 	int tproto6;
2026 	struct sockaddr_in *sin;
2027 	struct sockaddr_in6 *sin6;
2028 	struct addrinfo *res, *res0;
2029 	struct in6_addr mask128;
2030 #endif /*INET6*/
2031 	struct block *b, *tmp;
2032 	int port, real_proto;
2033 
2034 	switch (q.addr) {
2035 
2036 	case Q_NET:
2037 		addr = pcap_nametonetaddr(name);
2038 		if (addr == 0)
2039 			bpf_error("unknown network '%s'", name);
2040 		/* Left justify network addr and calculate its network mask */
2041 		mask = 0xffffffff;
2042 		while (addr && (addr & 0xff000000) == 0) {
2043 			addr <<= 8;
2044 			mask <<= 8;
2045 		}
2046 		return gen_host(addr, mask, proto, dir);
2047 
2048 	case Q_DEFAULT:
2049 	case Q_HOST:
2050 		if (proto == Q_LINK) {
2051 			switch (linktype) {
2052 
2053 			case DLT_EN10MB:
2054 				eaddr = pcap_ether_hostton(name);
2055 				if (eaddr == NULL)
2056 					bpf_error(
2057 					    "unknown ether host '%s'", name);
2058 				return gen_ehostop(eaddr, dir);
2059 
2060 			case DLT_FDDI:
2061 				eaddr = pcap_ether_hostton(name);
2062 				if (eaddr == NULL)
2063 					bpf_error(
2064 					    "unknown FDDI host '%s'", name);
2065 				return gen_fhostop(eaddr, dir);
2066 
2067 			default:
2068 				bpf_error(
2069 			"only ethernet/FDDI supports link-level host name");
2070 				break;
2071 			}
2072 		} else if (proto == Q_DECNET) {
2073 			unsigned short dn_addr = __pcap_nametodnaddr(name);
2074 			/*
2075 			 * I don't think DECNET hosts can be multihomed, so
2076 			 * there is no need to build up a list of addresses
2077 			 */
2078 			return (gen_host(dn_addr, 0, proto, dir));
2079 		} else {
2080 #ifndef INET6
2081 			alist = pcap_nametoaddr(name);
2082 			if (alist == NULL || *alist == NULL)
2083 				bpf_error("unknown host '%s'", name);
2084 			tproto = proto;
2085 			if (off_linktype == -1 && tproto == Q_DEFAULT)
2086 				tproto = Q_IP;
2087 			b = gen_host(**alist++, 0xffffffff, tproto, dir);
2088 			while (*alist) {
2089 				tmp = gen_host(**alist++, 0xffffffff,
2090 					       tproto, dir);
2091 				gen_or(b, tmp);
2092 				b = tmp;
2093 			}
2094 			return b;
2095 #else
2096 			memset(&mask128, 0xff, sizeof(mask128));
2097 			res0 = res = pcap_nametoaddrinfo(name);
2098 			if (res == NULL)
2099 				bpf_error("unknown host '%s'", name);
2100 			b = tmp = NULL;
2101 			tproto = tproto6 = proto;
2102 			if (off_linktype == -1 && tproto == Q_DEFAULT) {
2103 				tproto = Q_IP;
2104 				tproto6 = Q_IPV6;
2105 			}
2106 			for (res = res0; res; res = res->ai_next) {
2107 				switch (res->ai_family) {
2108 				case AF_INET:
2109 					if (tproto == Q_IPV6)
2110 						continue;
2111 
2112 					sin = (struct sockaddr_in *)
2113 						res->ai_addr;
2114 					tmp = gen_host(ntohl(sin->sin_addr.s_addr),
2115 						0xffffffff, tproto, dir);
2116 					break;
2117 				case AF_INET6:
2118 					if (tproto6 == Q_IP)
2119 						continue;
2120 
2121 					sin6 = (struct sockaddr_in6 *)
2122 						res->ai_addr;
2123 					tmp = gen_host6(&sin6->sin6_addr,
2124 						&mask128, tproto6, dir);
2125 					break;
2126 				}
2127 				if (b)
2128 					gen_or(b, tmp);
2129 				b = tmp;
2130 			}
2131 			freeaddrinfo(res0);
2132 			if (b == NULL) {
2133 				bpf_error("unknown host '%s'%s", name,
2134 				    (proto == Q_DEFAULT)
2135 					? ""
2136 					: " for specified address family");
2137 			}
2138 			return b;
2139 #endif /*INET6*/
2140 		}
2141 
2142 	case Q_PORT:
2143 		if (proto != Q_DEFAULT && proto != Q_UDP && proto != Q_TCP)
2144 			bpf_error("illegal qualifier of 'port'");
2145 		if (pcap_nametoport(name, &port, &real_proto) == 0)
2146 			bpf_error("unknown port '%s'", name);
2147 		if (proto == Q_UDP) {
2148 			if (real_proto == IPPROTO_TCP)
2149 				bpf_error("port '%s' is tcp", name);
2150 			else
2151 				/* override PROTO_UNDEF */
2152 				real_proto = IPPROTO_UDP;
2153 		}
2154 		if (proto == Q_TCP) {
2155 			if (real_proto == IPPROTO_UDP)
2156 				bpf_error("port '%s' is udp", name);
2157 			else
2158 				/* override PROTO_UNDEF */
2159 				real_proto = IPPROTO_TCP;
2160 		}
2161 #ifndef INET6
2162 		return gen_port(port, real_proto, dir);
2163 #else
2164 	    {
2165 		struct block *b;
2166 		b = gen_port(port, real_proto, dir);
2167 		gen_or(gen_port6(port, real_proto, dir), b);
2168 		return b;
2169 	    }
2170 #endif /* INET6 */
2171 
2172 	case Q_GATEWAY:
2173 #ifndef INET6
2174 		eaddr = pcap_ether_hostton(name);
2175 		if (eaddr == NULL)
2176 			bpf_error("unknown ether host: %s", name);
2177 
2178 		alist = pcap_nametoaddr(name);
2179 		if (alist == NULL || *alist == NULL)
2180 			bpf_error("unknown host '%s'", name);
2181 		return gen_gateway(eaddr, alist, proto, dir);
2182 #else
2183 		bpf_error("'gateway' not supported in this configuration");
2184 #endif /*INET6*/
2185 
2186 	case Q_PROTO:
2187 		real_proto = lookup_proto(name, proto);
2188 		if (real_proto >= 0)
2189 			return gen_proto(real_proto, proto, dir);
2190 		else
2191 			bpf_error("unknown protocol: %s", name);
2192 
2193 	case Q_PROTOCHAIN:
2194 		real_proto = lookup_proto(name, proto);
2195 		if (real_proto >= 0)
2196 			return gen_protochain(real_proto, proto, dir);
2197 		else
2198 			bpf_error("unknown protocol: %s", name);
2199 
2200 
2201 	case Q_UNDEF:
2202 		syntax();
2203 		/* NOTREACHED */
2204 	}
2205 	abort();
2206 	/* NOTREACHED */
2207 }
2208 
2209 struct block *
2210 gen_mcode(s1, s2, masklen, q)
2211 	register const char *s1, *s2;
2212 	register int masklen;
2213 	struct qual q;
2214 {
2215 	register int nlen, mlen;
2216 	bpf_u_int32 n, m;
2217 
2218 	nlen = __pcap_atoin(s1, &n);
2219 	/* Promote short ipaddr */
2220 	n <<= 32 - nlen;
2221 
2222 	if (s2 != NULL) {
2223 		mlen = __pcap_atoin(s2, &m);
2224 		/* Promote short ipaddr */
2225 		m <<= 32 - mlen;
2226 		if ((n & ~m) != 0)
2227 			bpf_error("non-network bits set in \"%s mask %s\"",
2228 			    s1, s2);
2229 	} else {
2230 		/* Convert mask len to mask */
2231 		if (masklen > 32)
2232 			bpf_error("mask length must be <= 32");
2233 		m = 0xffffffff << (32 - masklen);
2234 		if ((n & ~m) != 0)
2235 			bpf_error("non-network bits set in \"%s/%d\"",
2236 			    s1, masklen);
2237 	}
2238 
2239 	switch (q.addr) {
2240 
2241 	case Q_NET:
2242 		return gen_host(n, m, q.proto, q.dir);
2243 
2244 	default:
2245 		bpf_error("Mask syntax for networks only");
2246 		/* NOTREACHED */
2247 	}
2248 }
2249 
2250 struct block *
2251 gen_ncode(s, v, q)
2252 	register const char *s;
2253 	bpf_u_int32 v;
2254 	struct qual q;
2255 {
2256 	bpf_u_int32 mask;
2257 	int proto = q.proto;
2258 	int dir = q.dir;
2259 	register int vlen;
2260 
2261 	if (s == NULL)
2262 		vlen = 32;
2263 	else if (q.proto == Q_DECNET)
2264 		vlen = __pcap_atodn(s, &v);
2265 	else
2266 		vlen = __pcap_atoin(s, &v);
2267 
2268 	switch (q.addr) {
2269 
2270 	case Q_DEFAULT:
2271 	case Q_HOST:
2272 	case Q_NET:
2273 		if (proto == Q_DECNET)
2274 			return gen_host(v, 0, proto, dir);
2275 		else if (proto == Q_LINK) {
2276 			bpf_error("illegal link layer address");
2277 		} else {
2278 			mask = 0xffffffff;
2279 			if (s == NULL && q.addr == Q_NET) {
2280 				/* Promote short net number */
2281 				while (v && (v & 0xff000000) == 0) {
2282 					v <<= 8;
2283 					mask <<= 8;
2284 				}
2285 			} else {
2286 				/* Promote short ipaddr */
2287 				v <<= 32 - vlen;
2288 				mask <<= 32 - vlen;
2289 			}
2290 			return gen_host(v, mask, proto, dir);
2291 		}
2292 
2293 	case Q_PORT:
2294 		if (proto == Q_UDP)
2295 			proto = IPPROTO_UDP;
2296 		else if (proto == Q_TCP)
2297 			proto = IPPROTO_TCP;
2298 		else if (proto == Q_DEFAULT)
2299 			proto = PROTO_UNDEF;
2300 		else
2301 			bpf_error("illegal qualifier of 'port'");
2302 
2303 #ifndef INET6
2304 		return gen_port((int)v, proto, dir);
2305 #else
2306 	    {
2307 		struct block *b;
2308 		b = gen_port((int)v, proto, dir);
2309 		gen_or(gen_port6((int)v, proto, dir), b);
2310 		return b;
2311 	    }
2312 #endif /* INET6 */
2313 
2314 	case Q_GATEWAY:
2315 		bpf_error("'gateway' requires a name");
2316 		/* NOTREACHED */
2317 
2318 	case Q_PROTO:
2319 		return gen_proto((int)v, proto, dir);
2320 
2321 	case Q_PROTOCHAIN:
2322 		return gen_protochain((int)v, proto, dir);
2323 
2324 	case Q_UNDEF:
2325 		syntax();
2326 		/* NOTREACHED */
2327 
2328 	default:
2329 		abort();
2330 		/* NOTREACHED */
2331 	}
2332 	/* NOTREACHED */
2333 }
2334 
2335 #ifdef INET6
2336 struct block *
2337 gen_mcode6(s1, s2, masklen, q)
2338 	register const char *s1, *s2;
2339 	register int masklen;
2340 	struct qual q;
2341 {
2342 	struct addrinfo *res;
2343 	struct in6_addr *addr;
2344 	struct in6_addr mask;
2345 	struct block *b;
2346 	u_int32_t *a, *m;
2347 
2348 	if (s2)
2349 		bpf_error("no mask %s supported", s2);
2350 
2351 	res = pcap_nametoaddrinfo(s1);
2352 	if (!res)
2353 		bpf_error("invalid ip6 address %s", s1);
2354 	if (res->ai_next)
2355 		bpf_error("%s resolved to multiple address", s1);
2356 	addr = &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
2357 
2358 	if (sizeof(mask) * 8 < masklen)
2359 		bpf_error("mask length must be <= %u", (unsigned int)(sizeof(mask) * 8));
2360 	memset(&mask, 0xff, masklen / 8);
2361 	if (masklen % 8) {
2362 		mask.s6_addr[masklen / 8] =
2363 			(0xff << (8 - masklen % 8)) & 0xff;
2364 	}
2365 
2366 	a = (u_int32_t *)addr;
2367 	m = (u_int32_t *)&mask;
2368 	if ((a[0] & ~m[0]) || (a[1] & ~m[1])
2369 	 || (a[2] & ~m[2]) || (a[3] & ~m[3])) {
2370 		bpf_error("non-network bits set in \"%s/%d\"", s1, masklen);
2371 	}
2372 
2373 	switch (q.addr) {
2374 
2375 	case Q_DEFAULT:
2376 	case Q_HOST:
2377 		if (masklen != 128)
2378 			bpf_error("Mask syntax for networks only");
2379 		/* FALLTHROUGH */
2380 
2381 	case Q_NET:
2382 		b = gen_host6(addr, &mask, q.proto, q.dir);
2383 		freeaddrinfo(res);
2384 		return b;
2385 
2386 	default:
2387 		bpf_error("invalid qualifier against IPv6 address");
2388 		/* NOTREACHED */
2389 	}
2390 }
2391 #endif /*INET6*/
2392 
2393 struct block *
2394 gen_ecode(eaddr, q)
2395 	register const u_char *eaddr;
2396 	struct qual q;
2397 {
2398 	if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
2399 		if (linktype == DLT_EN10MB)
2400 			return gen_ehostop(eaddr, (int)q.dir);
2401 		if (linktype == DLT_FDDI)
2402 			return gen_fhostop(eaddr, (int)q.dir);
2403 	}
2404 	bpf_error("ethernet address used in non-ether expression");
2405 	/* NOTREACHED */
2406 }
2407 
2408 void
2409 sappend(s0, s1)
2410 	struct slist *s0, *s1;
2411 {
2412 	/*
2413 	 * This is definitely not the best way to do this, but the
2414 	 * lists will rarely get long.
2415 	 */
2416 	while (s0->next)
2417 		s0 = s0->next;
2418 	s0->next = s1;
2419 }
2420 
2421 static struct slist *
2422 xfer_to_x(a)
2423 	struct arth *a;
2424 {
2425 	struct slist *s;
2426 
2427 	s = new_stmt(BPF_LDX|BPF_MEM);
2428 	s->s.k = a->regno;
2429 	return s;
2430 }
2431 
2432 static struct slist *
2433 xfer_to_a(a)
2434 	struct arth *a;
2435 {
2436 	struct slist *s;
2437 
2438 	s = new_stmt(BPF_LD|BPF_MEM);
2439 	s->s.k = a->regno;
2440 	return s;
2441 }
2442 
2443 struct arth *
2444 gen_load(proto, index, size)
2445 	int proto;
2446 	struct arth *index;
2447 	int size;
2448 {
2449 	struct slist *s, *tmp;
2450 	struct block *b;
2451 	int regno = alloc_reg();
2452 
2453 	free_reg(index->regno);
2454 	switch (size) {
2455 
2456 	default:
2457 		bpf_error("data size must be 1, 2, or 4");
2458 
2459 	case 1:
2460 		size = BPF_B;
2461 		break;
2462 
2463 	case 2:
2464 		size = BPF_H;
2465 		break;
2466 
2467 	case 4:
2468 		size = BPF_W;
2469 		break;
2470 	}
2471 	switch (proto) {
2472 	default:
2473 		bpf_error("unsupported index operation");
2474 
2475 	case Q_LINK:
2476 		s = xfer_to_x(index);
2477 		tmp = new_stmt(BPF_LD|BPF_IND|size);
2478 		sappend(s, tmp);
2479 		sappend(index->s, s);
2480 		break;
2481 
2482 	case Q_IP:
2483 	case Q_ARP:
2484 	case Q_RARP:
2485 	case Q_ATALK:
2486 	case Q_DECNET:
2487 	case Q_SCA:
2488 	case Q_LAT:
2489 	case Q_MOPRC:
2490 	case Q_MOPDL:
2491 #ifdef INET6
2492 	case Q_IPV6:
2493 #endif
2494 		/* XXX Note that we assume a fixed link header here. */
2495 		s = xfer_to_x(index);
2496 		tmp = new_stmt(BPF_LD|BPF_IND|size);
2497 		tmp->s.k = off_nl;
2498 		sappend(s, tmp);
2499 		sappend(index->s, s);
2500 
2501 		b = gen_proto_abbrev(proto);
2502 		if (index->b)
2503 			gen_and(index->b, b);
2504 		index->b = b;
2505 		break;
2506 
2507 	case Q_TCP:
2508 	case Q_UDP:
2509 	case Q_ICMP:
2510 	case Q_IGMP:
2511 	case Q_IGRP:
2512 	case Q_PIM:
2513 		s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
2514 		s->s.k = off_nl;
2515 		sappend(s, xfer_to_a(index));
2516 		sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
2517 		sappend(s, new_stmt(BPF_MISC|BPF_TAX));
2518 		sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
2519 		tmp->s.k = off_nl;
2520 		sappend(index->s, s);
2521 
2522 		gen_and(gen_proto_abbrev(proto), b = gen_ipfrag());
2523 		if (index->b)
2524 			gen_and(index->b, b);
2525 #ifdef INET6
2526 		gen_and(gen_proto_abbrev(Q_IP), b);
2527 #endif
2528 		index->b = b;
2529 		break;
2530 #ifdef INET6
2531 	case Q_ICMPV6:
2532 		bpf_error("IPv6 upper-layer protocol is not supported by proto[x]");
2533 		/*NOTREACHED*/
2534 #endif
2535 	}
2536 	index->regno = regno;
2537 	s = new_stmt(BPF_ST);
2538 	s->s.k = regno;
2539 	sappend(index->s, s);
2540 
2541 	return index;
2542 }
2543 
2544 struct block *
2545 gen_relation(code, a0, a1, reversed)
2546 	int code;
2547 	struct arth *a0, *a1;
2548 	int reversed;
2549 {
2550 	struct slist *s0, *s1, *s2;
2551 	struct block *b, *tmp;
2552 
2553 	s0 = xfer_to_x(a1);
2554 	s1 = xfer_to_a(a0);
2555 	s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X);
2556 	b = new_block(JMP(code));
2557 	if (code == BPF_JGT || code == BPF_JGE) {
2558 		reversed = !reversed;
2559 		b->s.k = 0x80000000;
2560 	}
2561 	if (reversed)
2562 		gen_not(b);
2563 
2564 	sappend(s1, s2);
2565 	sappend(s0, s1);
2566 	sappend(a1->s, s0);
2567 	sappend(a0->s, a1->s);
2568 
2569 	b->stmts = a0->s;
2570 
2571 	free_reg(a0->regno);
2572 	free_reg(a1->regno);
2573 
2574 	/* 'and' together protocol checks */
2575 	if (a0->b) {
2576 		if (a1->b) {
2577 			gen_and(a0->b, tmp = a1->b);
2578 		}
2579 		else
2580 			tmp = a0->b;
2581 	} else
2582 		tmp = a1->b;
2583 
2584 	if (tmp)
2585 		gen_and(tmp, b);
2586 
2587 	return b;
2588 }
2589 
2590 struct arth *
2591 gen_loadlen()
2592 {
2593 	int regno = alloc_reg();
2594 	struct arth *a = (struct arth *)newchunk(sizeof(*a));
2595 	struct slist *s;
2596 
2597 	s = new_stmt(BPF_LD|BPF_LEN);
2598 	s->next = new_stmt(BPF_ST);
2599 	s->next->s.k = regno;
2600 	a->s = s;
2601 	a->regno = regno;
2602 
2603 	return a;
2604 }
2605 
2606 struct arth *
2607 gen_loadi(val)
2608 	int val;
2609 {
2610 	struct arth *a;
2611 	struct slist *s;
2612 	int reg;
2613 
2614 	a = (struct arth *)newchunk(sizeof(*a));
2615 
2616 	reg = alloc_reg();
2617 
2618 	s = new_stmt(BPF_LD|BPF_IMM);
2619 	s->s.k = val;
2620 	s->next = new_stmt(BPF_ST);
2621 	s->next->s.k = reg;
2622 	a->s = s;
2623 	a->regno = reg;
2624 
2625 	return a;
2626 }
2627 
2628 struct arth *
2629 gen_neg(a)
2630 	struct arth *a;
2631 {
2632 	struct slist *s;
2633 
2634 	s = xfer_to_a(a);
2635 	sappend(a->s, s);
2636 	s = new_stmt(BPF_ALU|BPF_NEG);
2637 	s->s.k = 0;
2638 	sappend(a->s, s);
2639 	s = new_stmt(BPF_ST);
2640 	s->s.k = a->regno;
2641 	sappend(a->s, s);
2642 
2643 	return a;
2644 }
2645 
2646 struct arth *
2647 gen_arth(code, a0, a1)
2648 	int code;
2649 	struct arth *a0, *a1;
2650 {
2651 	struct slist *s0, *s1, *s2;
2652 
2653 	s0 = xfer_to_x(a1);
2654 	s1 = xfer_to_a(a0);
2655 	s2 = new_stmt(BPF_ALU|BPF_X|code);
2656 
2657 	sappend(s1, s2);
2658 	sappend(s0, s1);
2659 	sappend(a1->s, s0);
2660 	sappend(a0->s, a1->s);
2661 
2662 	free_reg(a1->regno);
2663 
2664 	s0 = new_stmt(BPF_ST);
2665 	a0->regno = s0->s.k = alloc_reg();
2666 	sappend(a0->s, s0);
2667 
2668 	return a0;
2669 }
2670 
2671 /*
2672  * Here we handle simple allocation of the scratch registers.
2673  * If too many registers are alloc'd, the allocator punts.
2674  */
2675 static int regused[BPF_MEMWORDS];
2676 static int curreg;
2677 
2678 /*
2679  * Return the next free register.
2680  */
2681 static int
2682 alloc_reg()
2683 {
2684 	int n = BPF_MEMWORDS;
2685 
2686 	while (--n >= 0) {
2687 		if (regused[curreg])
2688 			curreg = (curreg + 1) % BPF_MEMWORDS;
2689 		else {
2690 			regused[curreg] = 1;
2691 			return curreg;
2692 		}
2693 	}
2694 	bpf_error("too many registers needed to evaluate expression");
2695 	/* NOTREACHED */
2696 }
2697 
2698 /*
2699  * Return a register to the table so it can
2700  * be used later.
2701  */
2702 static void
2703 free_reg(n)
2704 	int n;
2705 {
2706 	regused[n] = 0;
2707 }
2708 
2709 static struct block *
2710 gen_len(jmp, n)
2711 	int jmp, n;
2712 {
2713 	struct slist *s;
2714 	struct block *b;
2715 
2716 	s = new_stmt(BPF_LD|BPF_LEN);
2717 	b = new_block(JMP(jmp));
2718 	b->stmts = s;
2719 	b->s.k = n;
2720 
2721 	return b;
2722 }
2723 
2724 struct block *
2725 gen_greater(n)
2726 	int n;
2727 {
2728 	return gen_len(BPF_JGE, n);
2729 }
2730 
2731 struct block *
2732 gen_less(n)
2733 	int n;
2734 {
2735 	struct block *b;
2736 
2737 	b = gen_len(BPF_JGT, n);
2738 	gen_not(b);
2739 
2740 	return b;
2741 }
2742 
2743 struct block *
2744 gen_byteop(op, idx, val)
2745 	int op, idx, val;
2746 {
2747 	struct block *b;
2748 	struct slist *s;
2749 
2750 	switch (op) {
2751 	default:
2752 		abort();
2753 
2754 	case '=':
2755 		return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
2756 
2757 	case '<':
2758 		b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
2759 		b->s.code = JMP(BPF_JGE);
2760 		gen_not(b);
2761 		return b;
2762 
2763 	case '>':
2764 		b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val);
2765 		b->s.code = JMP(BPF_JGT);
2766 		return b;
2767 
2768 	case '|':
2769 		s = new_stmt(BPF_ALU|BPF_OR|BPF_K);
2770 		break;
2771 
2772 	case '&':
2773 		s = new_stmt(BPF_ALU|BPF_AND|BPF_K);
2774 		break;
2775 	}
2776 	s->s.k = val;
2777 	b = new_block(JMP(BPF_JEQ));
2778 	b->stmts = s;
2779 	gen_not(b);
2780 
2781 	return b;
2782 }
2783 
2784 static u_char abroadcast[] = { 0x0 };
2785 
2786 struct block *
2787 gen_broadcast(proto)
2788 	int proto;
2789 {
2790 	bpf_u_int32 hostmask;
2791 	struct block *b0, *b1, *b2;
2792 	static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
2793 
2794 	switch (proto) {
2795 
2796 	case Q_DEFAULT:
2797 	case Q_LINK:
2798 		if (linktype == DLT_ARCNET)
2799 			return gen_ahostop(abroadcast, Q_DST);
2800 		if (linktype == DLT_EN10MB)
2801 			return gen_ehostop(ebroadcast, Q_DST);
2802 		if (linktype == DLT_FDDI)
2803 			return gen_fhostop(ebroadcast, Q_DST);
2804 		bpf_error("not a broadcast link");
2805 		break;
2806 
2807 	case Q_IP:
2808 		b0 = gen_linktype(ETHERTYPE_IP);
2809 		hostmask = ~netmask;
2810 		b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask);
2811 		b2 = gen_mcmp(off_nl + 16, BPF_W,
2812 			      (bpf_int32)(~0 & hostmask), hostmask);
2813 		gen_or(b1, b2);
2814 		gen_and(b0, b2);
2815 		return b2;
2816 	}
2817 	bpf_error("only ether/ip broadcast filters supported");
2818 }
2819 
2820 struct block *
2821 gen_multicast(proto)
2822 	int proto;
2823 {
2824 	register struct block *b0, *b1;
2825 	register struct slist *s;
2826 
2827 	switch (proto) {
2828 
2829 	case Q_DEFAULT:
2830 	case Q_LINK:
2831 		if (linktype == DLT_ARCNET)
2832 			/* all ARCnet multicasts use the same address */
2833 			return gen_ahostop(abroadcast, Q_DST);
2834 
2835 		if (linktype == DLT_EN10MB) {
2836 			/* ether[0] & 1 != 0 */
2837 			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2838 			s->s.k = 0;
2839 			b0 = new_block(JMP(BPF_JSET));
2840 			b0->s.k = 1;
2841 			b0->stmts = s;
2842 			return b0;
2843 		}
2844 
2845 		if (linktype == DLT_FDDI) {
2846 			/* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */
2847 			/* fddi[1] & 1 != 0 */
2848 			s = new_stmt(BPF_LD|BPF_B|BPF_ABS);
2849 			s->s.k = 1;
2850 			b0 = new_block(JMP(BPF_JSET));
2851 			b0->s.k = 1;
2852 			b0->stmts = s;
2853 			return b0;
2854 		}
2855 		/* Link not known to support multicasts */
2856 		break;
2857 
2858 	case Q_IP:
2859 		b0 = gen_linktype(ETHERTYPE_IP);
2860 		b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224);
2861 		b1->s.code = JMP(BPF_JGE);
2862 		gen_and(b0, b1);
2863 		return b1;
2864 
2865 #ifdef INET6
2866 	case Q_IPV6:
2867 		b0 = gen_linktype(ETHERTYPE_IPV6);
2868 		b1 = gen_cmp(off_nl + 24, BPF_B, (bpf_int32)255);
2869 		gen_and(b0, b1);
2870 		return b1;
2871 #endif /* INET6 */
2872 	}
2873 	bpf_error("only IP multicast filters supported on ethernet/FDDI");
2874 }
2875 
2876 /*
2877  * generate command for inbound/outbound.  It's here so we can
2878  * make it link-type specific.  'dir' = 0 implies "inbound",
2879  * = 1 implies "outbound".
2880  */
2881 struct block *
2882 gen_inbound(dir)
2883 	int dir;
2884 {
2885 	register struct block *b0;
2886 
2887 	/*
2888 	 * Only SLIP and old-style PPP data link types support
2889 	 * inbound/outbound qualifiers.
2890 	 */
2891 	switch (linktype) {
2892 	case DLT_SLIP:
2893 	case DLT_PPP:
2894 		/* These are okay. */
2895 		break;
2896 
2897 	default:
2898 		bpf_error("inbound/outbound not supported on linktype 0x%x\n",
2899 		    linktype);
2900 		/* NOTREACHED */
2901 	}
2902 
2903 	b0 = gen_relation(BPF_JEQ,
2904 			  gen_load(Q_LINK, gen_loadi(0), 1),
2905 			  gen_loadi(0),
2906 			  dir);
2907 	return (b0);
2908 }
2909 
2910 struct block *
2911 gen_acode(eaddr, q)
2912 	register const u_char *eaddr;
2913 	struct qual q;
2914 {
2915 	if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
2916 		if (linktype == DLT_ARCNET)
2917 			return gen_ahostop(eaddr, (int)q.dir);
2918 	}
2919 	bpf_error("ARCnet address used in non-arc expression");
2920 	/* NOTREACHED */
2921 }
2922 
2923 static struct block *
2924 gen_ahostop(eaddr, dir)
2925 	register const u_char *eaddr;
2926 	register int dir;
2927 {
2928 	register struct block *b0, *b1;
2929 
2930 	switch (dir) {
2931 	/* src comes first, different from Ethernet */
2932 	case Q_SRC:
2933 		return gen_bcmp(0, 1, eaddr);
2934 
2935 	case Q_DST:
2936 		return gen_bcmp(1, 1, eaddr);
2937 
2938 	case Q_AND:
2939 		b0 = gen_ahostop(eaddr, Q_SRC);
2940 		b1 = gen_ahostop(eaddr, Q_DST);
2941 		gen_and(b0, b1);
2942 		return b1;
2943 
2944 	case Q_DEFAULT:
2945 	case Q_OR:
2946 		b0 = gen_ahostop(eaddr, Q_SRC);
2947 		b1 = gen_ahostop(eaddr, Q_DST);
2948 		gen_or(b0, b1);
2949 		return b1;
2950 	}
2951 	abort();
2952 	/* NOTREACHED */
2953 }
2954