* Check if we need to upgrade our descriptor @d from write-only mode. */
| 767 | * Check if we need to upgrade our descriptor @d from write-only mode. |
| 768 | */ |
| 769 | static int |
| 770 | bpf_check_upgrade(u_long cmd, struct bpf_d *d, struct bpf_insn *fcode, |
| 771 | int flen) |
| 772 | { |
| 773 | int is_snap, need_upgrade; |
| 774 | |
| 775 | /* |
| 776 | * Check if we've already upgraded or new filter is empty. |
| 777 | */ |
| 778 | if (d->bd_writer == 0 || fcode == NULL) |
| 779 | return (0); |
| 780 | |
| 781 | need_upgrade = 0; |
| 782 | |
| 783 | /* |
| 784 | * Check if cmd looks like snaplen setting from |
| 785 | * pcap_bpf.c:pcap_open_live(). |
| 786 | * Note we're not checking .k value here: |
| 787 | * while pcap_open_live() definitely sets to non-zero value, |
| 788 | * we'd prefer to treat k=0 (deny ALL) case the same way: e.g. |
| 789 | * do not consider upgrading immediately |
| 790 | */ |
| 791 | if (cmd == BIOCSETF && flen == 1 && |
| 792 | fcode[0].code == (BPF_RET | BPF_K)) |
| 793 | is_snap = 1; |
| 794 | else |
| 795 | is_snap = 0; |
| 796 | |
| 797 | if (is_snap == 0) { |
| 798 | /* |
| 799 | * We're setting first filter and it doesn't look like |
| 800 | * setting snaplen. We're probably using bpf directly. |
| 801 | * Upgrade immediately. |
| 802 | */ |
| 803 | need_upgrade = 1; |
| 804 | } else { |
| 805 | /* |
| 806 | * Do not require upgrade by first BIOCSETF |
| 807 | * (used to set snaplen) by pcap_open_live(). |
| 808 | */ |
| 809 | |
| 810 | if (--d->bd_writer == 0) { |
| 811 | /* |
| 812 | * First snaplen filter has already |
| 813 | * been set. This is probably catch-all |
| 814 | * filter |
| 815 | */ |
| 816 | need_upgrade = 1; |
| 817 | } |
| 818 | } |
| 819 | |
| 820 | CTR5(KTR_NET, |
| 821 | "%s: filter function set by pid %d, " |
| 822 | "bd_writer counter %d, snap %d upgrade %d", |
| 823 | __func__, d->bd_pid, d->bd_writer, |
| 824 | is_snap, need_upgrade); |
| 825 | |
| 826 | return (need_upgrade); |