diff --git a/gencode.c b/gencode.c index b94ea72..8aa5727 100644 --- a/gencode.c +++ b/gencode.c @@ -1598,6 +1598,14 @@ init_linktype(p) off_nl = -1; off_nl_nosnap = -1; return; + + case DLT_LINK: + off_linktype = 8; + off_macpl = 0; + off_macpl_is_variable = 1; + off_nl = 0; + off_nl_nosnap = 0; + return; } bpf_error("unknown data link type %d", linktype); /* NOTREACHED */ @@ -2427,6 +2435,39 @@ gen_load_radiotap_llprefixlen() return (NULL); } +static struct slist * +gen_load_link_ll_header_len() +{ + struct slist *s1, *s2; + + if (reg_off_macpl == -1) + reg_off_macpl = alloc_reg(); + + /* + * Generate code to load the length of the link header into + * the register assigned to hold that length, if one has been + * assigned. (If one hasn't been assigned, no code we've + * generated uses that prefix, so we don't need to generate any + * code to load it.) + */ + if (reg_off_macpl != -1) { + s1 = new_stmt(BPF_LD|BPF_H|BPF_ABS); + s1->s.k = 2; + s2 = new_stmt(BPF_ST); + s2->s.k = reg_off_macpl; + sappend(s1, s2); + + /* + * Now move it into the X register. + */ + s2 = new_stmt(BPF_MISC|BPF_TAX); + sappend(s1, s2); + + return (s1); + } else + return (NULL); +} + /* * At the moment we treat PPI as normal Radiotap encoded * packets. The difference is in the function that generates @@ -2765,6 +2806,11 @@ insert_compute_vloffsets(b) case DLT_PPI: s = gen_load_802_11_header_len(s, b->stmts); break; + + case DLT_LINK: + s = gen_load_link_ll_header_len(); + break; + } /*