2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2012 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
9 /* lex-func-prefix: yy */
18 #include <arpa/inet.h>
20 #include "trafgen_parser.tab.h"
25 extern void yyerror(const char *);
27 static char *try_convert_shellcode(char *sstr)
29 bool found_any = false;
30 char *bstr, *ostr = sstr, *hay, *orig = sstr;
31 size_t j = 0, blen, slen = strlen(sstr), tot = 0;
32 const char *needle = "\\x";
42 while ((hay = strstr(hay, needle)) != NULL ) {
43 hay += strlen(needle) + 2;
48 if (blen != tot || !found_any)
52 bstr = xzmalloc(blen);
56 bstr[j++] = (uint8_t) strtoul(sstr + 2, &sstr, 16);
74 number_oct ([0][0-9]+)
75 number_hex ([0]?[x][a-fA-F0-9]+)
76 number_bin ([0]?[b][0-1]+)
77 number_dec (([0])|([1-9][0-9]*))
78 number_ascii ([a-zA-Z])
80 mac_hex ([a-fA-F0-9]+)
81 mac ({mac_hex}:{mac_hex}:{mac_hex}:{mac_hex}:{mac_hex}:{mac_hex})
82 ip4_addr ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)
86 "cpu" { return K_CPU; }
87 "fill" { return K_FILL; }
88 "rnd" { return K_RND; }
89 "csum16" { return K_CSUMIP; }
90 "csumip" { return K_CSUMIP; }
91 "csumip4" { return K_CSUMIP; }
92 "csumicmp" { return K_CSUMIP; }
93 "csumicmp4" { return K_CSUMIP; }
94 "csumudp" { return K_CSUMUDP; }
95 "csumtcp" { return K_CSUMTCP; }
96 "csumudp6" { return K_CSUMUDP6; }
97 "csumtcp6" { return K_CSUMTCP6; }
98 "drnd" { return K_DRND; }
99 "dinc" { return K_DINC; }
100 "ddec" { return K_DDEC; }
101 "seqinc" { return K_SEQINC; }
102 "seqdec" { return K_SEQDEC; }
103 "const8"|"c8" { return K_CONST8; }
104 "const16"|"c16" { return K_CONST16; }
105 "const32"|"c32" { return K_CONST32; }
106 "const64"|"c64" { return K_CONST64; }
108 "prot"[o]? { return K_PROT; }
111 "daddr"|"da" { return K_DADDR; }
112 "saddr"|"sa" { return K_SADDR; }
113 [e]?"type" { return K_ETYPE; }
115 /* VLAN (802.1Q & 802.1ad) */
116 "tpid" { return K_TPID; }
117 "tci" { return K_TCI; }
118 "pcp" { return K_PCP; }
119 "dei"|"cfi" { return K_DEI; }
120 "1ad" { return K_1AD; }
121 "1q" { return K_1Q; }
123 /* MPLS (Multi Protocol Label Switching) */
124 "lbl"|"label" { return K_LABEL; }
125 "last" { return K_LAST; }
126 "tc"|"tclass" { return K_TC; }
127 "exp" { return K_EXP; }
130 "sha"|"smac" { return K_SHA; }
131 "spa"|"sip" { return K_SPA; }
132 "tha"|"tmac" { return K_THA; }
133 "tpa"|"tip" { return K_TPA; }
134 "req"|"request" { return K_REQUEST; }
135 "reply" { return K_REPLY; }
136 "op"|"oper" { return K_OPER; }
137 "htype" { return K_HTYPE; }
138 "ptype" { return K_PTYPE; }
141 "ihl" { return K_IHL; }
142 "ver"|"version" { return K_VER; }
143 "ttl" { return K_TTL; }
144 "dscp" { return K_DSCP; }
145 "ecn" { return K_ECN; }
146 "tos" { return K_TOS; }
147 "len"|"length" { return K_LEN; }
148 "id" { return K_ID; }
149 "flags" { return K_FLAGS; }
150 "frag" { return K_FRAG; }
151 "csum" { return K_CSUM; }
152 "df" { return K_DF; }
153 "mf" { return K_MF; }
156 "sp"|"sport" { return K_SPORT; }
157 "dp"|"dport" { return K_DPORT; }
160 "seq" { return K_SEQ; }
161 "ackseq"|"aseq" { return K_ACK_SEQ; }
162 "doff"|hlen { return K_DOFF; }
163 "cwr" { return K_CWR; }
164 "ece"|"ecn" { return K_ECE; }
165 "urg" { return K_URG; }
166 "ack" { return K_ACK; }
167 "psh" { return K_PSH; }
168 "rst" { return K_RST; }
169 "syn" { return K_SYN; }
170 "fin" { return K_FIN; }
171 "win"|"window" { return K_WINDOW; }
172 "urgptr" { return K_URG_PTR; }
174 "eth" { return K_ETH; }
175 "vlan" { return K_VLAN; }
176 "mpls" { return K_MPLS; }
177 "arp" { return K_ARP; }
178 "ip4"|"ipv4" { return K_IP4; }
179 "udp" { return K_UDP; }
180 "tcp" { return K_TCP; }
182 [ ]*"-"[ ]* { return '-'; }
183 [ ]*"+"[ ]* { return '+'; }
184 [ ]*"*"[ ]* { return '*'; }
185 [ ]*"/"[ ]* { return '/'; }
186 [ ]*"%"[ ]* { return '%'; }
187 [ ]*"&"[ ]* { return '&'; }
188 [ ]*"|"[ ]* { return '|'; }
189 [ ]*"<"[ ]* { return '<'; }
190 [ ]*">"[ ]* { return '>'; }
191 [ ]*"^"[ ]* { return '^'; }
204 "\""[^\"]+"\"" { yylval.str = try_convert_shellcode(xstrdup(yytext));
207 ([ \t\n]+)? { return K_WHITE; }
209 "/*"([^\*]|\*[^/])*"*/" { return K_COMMENT; }
211 "#"[^\n]* { return K_COMMENT; }
213 {number_hex} { yylval.number = strtoul(yytext + (yytext[0] == 'x' ? 1 : 0),
217 {number_dec} { yylval.number = strtol(yytext, NULL, 10);
220 {number_oct} { yylval.number = strtol(yytext + 1, NULL, 8);
223 {number_bin} { yylval.number = strtol(yytext + (yytext[0] == 'b' ? 1 : 2),
227 {number_ascii} { yylval.number = (uint8_t) (*yytext);
230 {mac} { if (str2mac(yytext, yylval.bytes, 256))
231 panic("Failed to parse MAC address %s\n", yytext);
234 {ip4_addr} { if (inet_pton(AF_INET, yytext, &yylval.ip4_addr) != 1)
235 panic("Failed to parse IPv4 address %s\n", yytext);
238 "'\\x"[a-fA-F0-9]{2}"'" { yylval.number = strtol(yytext + 3, NULL, 16);
241 "'"."'" { yylval.number = (uint8_t) (*(yytext + 1));
244 ";"[^\n]* {/* NOP */}
245 . { printf("Unknown character '%s'", yytext);
246 yyerror("lex Unknown character"); }