2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2012 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
9 /* lex-func-prefix: yy */
18 #include <arpa/inet.h>
20 #include "trafgen_parser.tab.h"
25 extern void yyerror(const char *);
27 static char *try_convert_shellcode(char *sstr)
29 bool found_any = false;
30 char *bstr, *ostr = sstr, *hay, *orig = sstr;
31 size_t j = 0, blen, slen = strlen(sstr), tot = 0;
32 const char *needle = "\\x";
42 while ((hay = strstr(hay, needle)) != NULL ) {
43 hay += strlen(needle) + 2;
48 if (blen != tot || !found_any)
52 bstr = xzmalloc(blen);
56 bstr[j++] = (uint8_t) strtoul(sstr + 2, &sstr, 16);
74 number_oct ([0][0-9]+)
75 number_hex ([0]?[x][a-fA-F0-9]+)
76 number_bin ([0]?[b][0-1]+)
77 number_dec (([0])|([1-9][0-9]*))
78 number_ascii ([a-zA-Z])
81 mac ({a_hex}:{a_hex}:{a_hex}:{a_hex}:{a_hex}:{a_hex})
82 ip4_addr ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)
83 /* We're very permissive about IPv6 addresses the grammar accepts, as
84 * they can come in various different formats. In any case,
85 * inet_pton(AF_INET6, ...) will reject the invalid ones later on. */
86 ip6_addr (({a_hex}?:)?({a_hex}?:)?({a_hex}?:)?({a_hex}?:)?({a_hex}?:)?({a_hex}?:)?({a_hex}?:)?({a_hex})?)
90 "cpu" { return K_CPU; }
91 "fill" { return K_FILL; }
92 "rnd" { return K_RND; }
93 "csum16" { return K_CSUMIP; }
94 "csumip" { return K_CSUMIP; }
95 "csumip4" { return K_CSUMIP; }
96 "csumicmp" { return K_CSUMIP; }
97 "csumicmp4" { return K_CSUMIP; }
98 "csumudp" { return K_CSUMUDP; }
99 "csumtcp" { return K_CSUMTCP; }
100 "csumudp6" { return K_CSUMUDP6; }
101 "csumtcp6" { return K_CSUMTCP6; }
102 "drnd" { return K_DRND; }
103 "dinc" { return K_DINC; }
104 "ddec" { return K_DDEC; }
105 "seqinc" { return K_SEQINC; }
106 "seqdec" { return K_SEQDEC; }
107 "const8"|"c8" { return K_CONST8; }
108 "const16"|"c16" { return K_CONST16; }
109 "const32"|"c32" { return K_CONST32; }
110 "const64"|"c64" { return K_CONST64; }
112 "prot"[o]? { return K_PROT; }
113 "tc"|"tclass" { return K_TC; }
116 "daddr"|"da" { return K_DADDR; }
117 "saddr"|"sa" { return K_SADDR; }
118 "etype" { return K_ETYPE; }
119 "type" { return K_TYPE; }
121 /* IEEE 802.3X PAUSE */
122 "time" { return K_TIME; }
124 /* VLAN (802.1Q & 802.1ad) */
125 "tpid" { return K_TPID; }
126 "tci" { return K_TCI; }
127 "pcp" { return K_PCP; }
128 "dei"|"cfi" { return K_DEI; }
129 "1ad" { return K_1AD; }
130 "1q" { return K_1Q; }
132 /* MPLS (Multi Protocol Label Switching) */
133 "lbl"|"label" { return K_LABEL; }
134 "last" { return K_LAST; }
135 "exp" { return K_EXP; }
138 "sha"|"smac" { return K_SHA; }
139 "spa"|"sip" { return K_SPA; }
140 "tha"|"tmac" { return K_THA; }
141 "tpa"|"tip" { return K_TPA; }
142 "req"|"request" { return K_REQUEST; }
143 "reply" { return K_REPLY; }
144 "op"|"oper" { return K_OPER; }
145 "htype" { return K_HTYPE; }
146 "ptype" { return K_PTYPE; }
149 "ihl" { return K_IHL; }
150 "ver"|"version" { return K_VER; }
151 "ttl" { return K_TTL; }
152 "dscp" { return K_DSCP; }
153 "ecn" { return K_ECN; }
154 "tos" { return K_TOS; }
155 "len"|"length" { return K_LEN; }
156 "id" { return K_ID; }
157 "flags" { return K_FLAGS; }
158 "frag" { return K_FRAG; }
159 "csum" { return K_CSUM; }
160 "df" { return K_DF; }
161 "mf" { return K_MF; }
164 "fl"|"flow" { return K_FLOW; }
165 "nh"|"nexthdr" { return K_NEXT_HDR; }
166 "hl"|"hoplimit" { return K_HOP_LIMIT; }
170 "addr" { return K_ADDR; }
171 "mtu" { return K_MTU; }
174 "code" { return K_CODE; }
175 "echorequest" { return K_ECHO_REQUEST; }
176 "echoreply" { return K_ECHO_REPLY; }
179 "sp"|"sport" { return K_SPORT; }
180 "dp"|"dport" { return K_DPORT; }
183 "seq" { return K_SEQ; }
184 "ackseq"|"aseq" { return K_ACK_SEQ; }
185 "doff"|hlen { return K_DOFF; }
186 "cwr" { return K_CWR; }
187 "ece"|"ecn" { return K_ECE; }
188 "urg" { return K_URG; }
189 "ack" { return K_ACK; }
190 "psh" { return K_PSH; }
191 "rst" { return K_RST; }
192 "syn" { return K_SYN; }
193 "fin" { return K_FIN; }
194 "win"|"window" { return K_WINDOW; }
195 "urgptr" { return K_URG_PTR; }
197 "eth" { return K_ETH; }
198 "pause" { return K_PAUSE; }
199 "vlan" { return K_VLAN; }
200 "mpls" { return K_MPLS; }
201 "arp" { return K_ARP; }
202 "ip4"|"ipv4" { return K_IP4; }
203 "ip6"|"ipv6" { return K_IP6; }
204 "icmp4"|"icmpv4" { return K_ICMP4; }
205 "icmp6"|"icmpv6" { return K_ICMP6; }
206 "udp" { return K_UDP; }
207 "tcp" { return K_TCP; }
209 [ ]*"-"[ ]* { return '-'; }
210 [ ]*"+"[ ]* { return '+'; }
211 [ ]*"*"[ ]* { return '*'; }
212 [ ]*"/"[ ]* { return '/'; }
213 [ ]*"%"[ ]* { return '%'; }
214 [ ]*"&"[ ]* { return '&'; }
215 [ ]*"|"[ ]* { return '|'; }
216 [ ]*"<"[ ]* { return '<'; }
217 [ ]*">"[ ]* { return '>'; }
218 [ ]*"^"[ ]* { return '^'; }
231 "\""[^\"]+"\"" { yylval.str = try_convert_shellcode(xstrdup(yytext));
234 ([ \t\n]+)? { return K_WHITE; }
236 "/*"([^\*]|\*[^/])*"*/" { return K_COMMENT; }
238 "#"[^\n]* { return K_COMMENT; }
240 {number_hex} { yylval.number = strtoul(yytext + (yytext[0] == 'x' ? 1 : 0),
244 {number_dec} { yylval.number = strtol(yytext, NULL, 10);
247 {number_oct} { yylval.number = strtol(yytext + 1, NULL, 8);
250 {number_bin} { yylval.number = strtol(yytext + (yytext[0] == 'b' ? 1 : 2),
254 {number_ascii} { yylval.number = (uint8_t) (*yytext);
257 {mac} { if (str2mac(yytext, yylval.bytes, 256))
258 panic("Failed to parse MAC address %s\n", yytext);
261 {ip4_addr} { if (inet_pton(AF_INET, yytext, &yylval.ip4_addr) != 1)
262 panic("Failed to parse IPv4 address %s\n", yytext);
265 {ip6_addr} { if (inet_pton(AF_INET6, yytext, &yylval.ip6_addr) != 1)
266 panic("Failed to parse IPv6 address %s\n", yytext);
269 "'\\x"[a-fA-F0-9]{2}"'" { yylval.number = strtol(yytext + 3, NULL, 16);
272 "'"."'" { yylval.number = (uint8_t) (*(yytext + 1));
275 ";"[^\n]* {/* NOP */}
276 . { printf("Unknown character '%s'", yytext);
277 yyerror("lex Unknown character"); }