flowtop: rename variable
[netsniff-ng.git] / src / bpf_parser.y
blob83cf47b8c275a68a3437d8703086f66b06b8aba4
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
7 */
9 /* yaac-func-prefix: yy */
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <stdbool.h>
16 #include <signal.h>
17 #include <stdint.h>
18 #include <errno.h>
20 #include "bpf.h"
21 #include "xmalloc.h"
22 #include "bpf_parser.tab.h"
23 #include "built_in.h"
24 #include "die.h"
26 #define MAX_INSTRUCTIONS 4096
28 int compile_filter(char *file, int verbose, int bypass);
30 static int curr_instr = 0;
32 static struct sock_filter out[MAX_INSTRUCTIONS];
34 static char *labels[MAX_INSTRUCTIONS];
36 static char *labels_jt[MAX_INSTRUCTIONS];
37 static char *labels_jf[MAX_INSTRUCTIONS];
38 static char *labels_k[MAX_INSTRUCTIONS];
40 #define YYERROR_VERBOSE 0
41 #define YYDEBUG 0
42 #define YYENABLE_NLS 1
43 #define YYLTYPE_IS_TRIVIAL 1
44 #define ENABLE_NLS 1
46 extern FILE *yyin;
47 extern int yylex(void);
48 extern void yyerror(const char *);
49 extern int yylineno;
50 extern char *yytext;
52 static inline void set_curr_instr(uint16_t code, uint8_t jt, uint8_t jf, uint32_t k)
54 if (curr_instr >= MAX_INSTRUCTIONS)
55 panic("Exceeded maximal number of instructions!\n");
57 out[curr_instr].code = code;
58 out[curr_instr].jt = jt;
59 out[curr_instr].jf = jf;
60 out[curr_instr].k = k;
62 curr_instr++;
65 static inline void set_curr_label(char *label)
67 if (curr_instr >= MAX_INSTRUCTIONS)
68 panic("Exceeded maximal number of instructions!\n");
70 labels[curr_instr] = label;
73 #define JTL 1
74 #define JFL 2
75 #define JKL 3
77 static inline void set_jmp_label(char *label, int which)
79 if (curr_instr >= MAX_INSTRUCTIONS)
80 panic("Exceeded maximal number of instructions!\n");
82 bug_on(which != JTL && which != JFL && which != JKL);
84 if (which == JTL)
85 labels_jt[curr_instr] = label;
86 else if (which == JFL)
87 labels_jf[curr_instr] = label;
88 else
89 labels_k[curr_instr] = label;
92 static int find_intr_offset_or_panic(char *label_to_search)
94 int i, max = curr_instr, ret = -ENOENT;
96 bug_on(!label_to_search);
98 for (i = 0; i < max; ++i) {
99 if (labels[i] != NULL) {
100 /* Both are \0-terminated! */
101 if (!strcmp(label_to_search, labels[i])) {
102 ret = i;
103 break;
108 if (ret == -ENOENT)
109 panic("No such label!\n");
111 return ret;
116 %union {
117 char *label;
118 long int number;
121 %token OP_LDB OP_LDH OP_LD OP_LDX OP_ST OP_STX OP_JMP OP_JEQ OP_JGT OP_JGE
122 %token OP_JSET OP_ADD OP_SUB OP_MUL OP_DIV OP_AND OP_OR OP_XOR OP_LSH OP_RSH
123 %token OP_RET OP_TAX OP_TXA OP_LDXB OP_MOD OP_NEG K_PKT_LEN K_PROTO K_TYPE
124 %token K_NLATTR K_NLATTR_NEST K_MARK K_QUEUE K_HATYPE K_RXHASH K_CPU K_IFIDX
125 %token K_VLANT K_VLANP
127 %token ':' ',' '[' ']' '(' ')' 'x' 'a' '+' 'M' '*' '&' '#'
129 %token number label
131 %type <number> number
132 %type <label> label
136 prog
137 : line
138 | prog line
141 line
142 : instr
143 | labeled_instr
146 labeled_instr
147 : do_label instr
150 instr
151 : do_ldb
152 | do_ldh
153 | do_ld
154 | do_ldx
155 | do_st
156 | do_stx
157 | do_jmp
158 | do_jeq
159 | do_jgt
160 | do_jge
161 | do_jset
162 | do_add
163 | do_sub
164 | do_mul
165 | do_div
166 | do_mod
167 | do_neg
168 | do_and
169 | do_or
170 | do_xor
171 | do_lsh
172 | do_rsh
173 | do_ret
174 | do_tax
175 | do_txa
178 do_label
179 : label ':' { set_curr_label($1); }
182 do_ldb
183 : OP_LDB '[' 'x' '+' number ']' {
184 set_curr_instr(BPF_LD | BPF_B | BPF_IND, 0, 0, $5); }
185 | OP_LDB '[' number ']' {
186 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0, $3); }
187 | OP_LDB '#' K_PROTO {
188 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
189 SKF_AD_OFF + SKF_AD_PROTOCOL); }
190 | OP_LDB '#' K_TYPE {
191 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
192 SKF_AD_OFF + SKF_AD_PKTTYPE); }
193 | OP_LDB '#' K_IFIDX {
194 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
195 SKF_AD_OFF + SKF_AD_IFINDEX); }
196 | OP_LDB '#' K_NLATTR {
197 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
198 SKF_AD_OFF + SKF_AD_NLATTR); }
199 | OP_LDB '#' K_NLATTR_NEST {
200 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
201 SKF_AD_OFF + SKF_AD_NLATTR_NEST); }
202 | OP_LDB '#' K_MARK {
203 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
204 SKF_AD_OFF + SKF_AD_MARK); }
205 | OP_LDB '#' K_QUEUE {
206 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
207 SKF_AD_OFF + SKF_AD_QUEUE); }
208 | OP_LDB '#' K_HATYPE {
209 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
210 SKF_AD_OFF + SKF_AD_HATYPE); }
211 | OP_LDB '#' K_RXHASH {
212 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
213 SKF_AD_OFF + SKF_AD_RXHASH); }
214 | OP_LDB '#' K_CPU {
215 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
216 SKF_AD_OFF + SKF_AD_CPU); }
217 | OP_LDB '#' K_VLANT {
218 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
219 SKF_AD_OFF + SKF_AD_VLAN_TAG); }
220 | OP_LDB '#' K_VLANP {
221 set_curr_instr(BPF_LD | BPF_B | BPF_ABS, 0, 0,
222 SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT); }
225 do_ldh
226 : OP_LDH '[' 'x' '+' number ']' {
227 set_curr_instr(BPF_LD | BPF_H | BPF_IND, 0, 0, $5); }
228 | OP_LDH '[' number ']' {
229 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0, $3); }
230 | OP_LDH '#' K_PROTO {
231 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
232 SKF_AD_OFF + SKF_AD_PROTOCOL); }
233 | OP_LDH '#' K_TYPE {
234 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
235 SKF_AD_OFF + SKF_AD_PKTTYPE); }
236 | OP_LDH '#' K_IFIDX {
237 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
238 SKF_AD_OFF + SKF_AD_IFINDEX); }
239 | OP_LDH '#' K_NLATTR {
240 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
241 SKF_AD_OFF + SKF_AD_NLATTR); }
242 | OP_LDH '#' K_NLATTR_NEST {
243 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
244 SKF_AD_OFF + SKF_AD_NLATTR_NEST); }
245 | OP_LDH '#' K_MARK {
246 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
247 SKF_AD_OFF + SKF_AD_MARK); }
248 | OP_LDH '#' K_QUEUE {
249 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
250 SKF_AD_OFF + SKF_AD_QUEUE); }
251 | OP_LDH '#' K_HATYPE {
252 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
253 SKF_AD_OFF + SKF_AD_HATYPE); }
254 | OP_LDH '#' K_RXHASH {
255 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
256 SKF_AD_OFF + SKF_AD_RXHASH); }
257 | OP_LDH '#' K_CPU {
258 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
259 SKF_AD_OFF + SKF_AD_CPU); }
260 | OP_LDH '#' K_VLANT {
261 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
262 SKF_AD_OFF + SKF_AD_VLAN_TAG); }
263 | OP_LDH '#' K_VLANP {
264 set_curr_instr(BPF_LD | BPF_H | BPF_ABS, 0, 0,
265 SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT); }
268 do_ld
269 : OP_LD '#' number {
270 set_curr_instr(BPF_LD | BPF_IMM, 0, 0, $3); }
271 | OP_LD '#' K_PKT_LEN {
272 set_curr_instr(BPF_LD | BPF_W | BPF_LEN, 0, 0, 0); }
273 | OP_LD '#' K_PROTO {
274 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
275 SKF_AD_OFF + SKF_AD_PROTOCOL); }
276 | OP_LD '#' K_TYPE {
277 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
278 SKF_AD_OFF + SKF_AD_PKTTYPE); }
279 | OP_LD '#' K_IFIDX {
280 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
281 SKF_AD_OFF + SKF_AD_IFINDEX); }
282 | OP_LD '#' K_NLATTR {
283 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
284 SKF_AD_OFF + SKF_AD_NLATTR); }
285 | OP_LD '#' K_NLATTR_NEST {
286 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
287 SKF_AD_OFF + SKF_AD_NLATTR_NEST); }
288 | OP_LD '#' K_MARK {
289 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
290 SKF_AD_OFF + SKF_AD_MARK); }
291 | OP_LD '#' K_QUEUE {
292 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
293 SKF_AD_OFF + SKF_AD_QUEUE); }
294 | OP_LD '#' K_HATYPE {
295 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
296 SKF_AD_OFF + SKF_AD_HATYPE); }
297 | OP_LD '#' K_RXHASH {
298 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
299 SKF_AD_OFF + SKF_AD_RXHASH); }
300 | OP_LD '#' K_CPU {
301 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
302 SKF_AD_OFF + SKF_AD_CPU); }
303 | OP_LD '#' K_VLANT {
304 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
305 SKF_AD_OFF + SKF_AD_VLAN_TAG); }
306 | OP_LD '#' K_VLANP {
307 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0,
308 SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT); }
309 | OP_LD 'M' '[' number ']' {
310 set_curr_instr(BPF_LD | BPF_MEM, 0, 0, $4); }
311 | OP_LD '[' 'x' '+' number ']' {
312 set_curr_instr(BPF_LD | BPF_W | BPF_IND, 0, 0, $5); }
313 | OP_LD '[' number ']' {
314 set_curr_instr(BPF_LD | BPF_W | BPF_ABS, 0, 0, $3); }
317 do_ldx
318 : OP_LDX '#' number {
319 set_curr_instr(BPF_LDX | BPF_IMM, 0, 0, $3); }
320 | OP_LDX 'M' '[' number ']' {
321 set_curr_instr(BPF_LDX | BPF_MEM, 0, 0, $4); }
322 | OP_LDXB number '*' '(' '[' number ']' '&' number ')' {
323 if ($2 != 4 || $9 != 0xf) {
324 panic("ldxb offset not supported!\n");
325 } else {
326 set_curr_instr(BPF_LDX | BPF_MSH | BPF_B, 0, 0, $6); } }
327 | OP_LDX number '*' '(' '[' number ']' '&' number ')' {
328 if ($2 != 4 || $9 != 0xf) {
329 panic("ldxb offset not supported!\n");
330 } else {
331 set_curr_instr(BPF_LDX | BPF_MSH | BPF_B, 0, 0, $6); } }
334 do_st
335 : OP_ST 'M' '[' number ']' {
336 set_curr_instr(BPF_ST, 0, 0, $4); }
339 do_stx
340 : OP_STX 'M' '[' number ']' {
341 set_curr_instr(BPF_STX, 0, 0, $4); }
344 do_jmp
345 : OP_JMP label {
346 set_jmp_label($2, JKL);
347 set_curr_instr(BPF_JMP | BPF_JA, 0, 0, 0); }
350 do_jeq
351 : OP_JEQ '#' number ',' label ',' label {
352 set_jmp_label($5, JTL);
353 set_jmp_label($7, JFL);
354 set_curr_instr(BPF_JMP | BPF_JEQ | BPF_K, 0, 0, $3); }
355 | OP_JEQ 'x' ',' label ',' label {
356 set_jmp_label($4, JTL);
357 set_jmp_label($6, JFL);
358 set_curr_instr(BPF_JMP | BPF_JEQ | BPF_X, 0, 0, 0); }
361 do_jgt
362 : OP_JGT '#' number ',' label ',' label {
363 set_jmp_label($5, JTL);
364 set_jmp_label($7, JFL);
365 set_curr_instr(BPF_JMP | BPF_JGT | BPF_K, 0, 0, $3); }
366 | OP_JGT 'x' ',' label ',' label {
367 set_jmp_label($4, JTL);
368 set_jmp_label($6, JFL);
369 set_curr_instr(BPF_JMP | BPF_JGT | BPF_X, 0, 0, 0); }
372 do_jge
373 : OP_JGE '#' number ',' label ',' label {
374 set_jmp_label($5, JTL);
375 set_jmp_label($7, JFL);
376 set_curr_instr(BPF_JMP | BPF_JGE | BPF_K, 0, 0, $3); }
377 | OP_JGE 'x' ',' label ',' label {
378 set_jmp_label($4, JTL);
379 set_jmp_label($6, JFL);
380 set_curr_instr(BPF_JMP | BPF_JGE | BPF_X, 0, 0, 0); }
383 do_jset
384 : OP_JSET '#' number ',' label ',' label {
385 set_jmp_label($5, JTL);
386 set_jmp_label($7, JFL);
387 set_curr_instr(BPF_JMP | BPF_JSET | BPF_K, 0, 0, $3); }
388 | OP_JSET 'x' ',' label ',' label {
389 set_jmp_label($4, JTL);
390 set_jmp_label($6, JFL);
391 set_curr_instr(BPF_JMP | BPF_JSET | BPF_X, 0, 0, 0); }
394 do_add
395 : OP_ADD '#' number {
396 set_curr_instr(BPF_ALU | BPF_ADD | BPF_K, 0, 0, $3); }
397 | OP_ADD 'x' {
398 set_curr_instr(BPF_ALU | BPF_ADD | BPF_X, 0, 0, 0); }
401 do_sub
402 : OP_SUB '#' number {
403 set_curr_instr(BPF_ALU | BPF_SUB | BPF_K, 0, 0, $3); }
404 | OP_SUB 'x' {
405 set_curr_instr(BPF_ALU | BPF_SUB | BPF_X, 0, 0, 0); }
408 do_mul
409 : OP_MUL '#' number {
410 set_curr_instr(BPF_ALU | BPF_MUL | BPF_K, 0, 0, $3); }
411 | OP_MUL 'x' {
412 set_curr_instr(BPF_ALU | BPF_MUL | BPF_X, 0, 0, 0); }
415 do_div
416 : OP_DIV '#' number {
417 set_curr_instr(BPF_ALU | BPF_DIV | BPF_K, 0, 0, $3); }
418 | OP_DIV 'x' {
419 set_curr_instr(BPF_ALU | BPF_DIV | BPF_X, 0, 0, 0); }
422 do_mod
423 : OP_MOD '#' number {
424 set_curr_instr(BPF_ALU | BPF_MOD | BPF_K, 0, 0, $3); }
425 | OP_MOD 'x' {
426 set_curr_instr(BPF_ALU | BPF_MOD | BPF_X, 0, 0, 0); }
429 do_neg
430 : OP_NEG {
431 set_curr_instr(BPF_ALU | BPF_NEG, 0, 0, 0); }
434 do_and
435 : OP_AND '#' number {
436 set_curr_instr(BPF_ALU | BPF_AND | BPF_K, 0, 0, $3); }
437 | OP_AND 'x' {
438 set_curr_instr(BPF_ALU | BPF_AND | BPF_X, 0, 0, 0); }
441 do_or
442 : OP_OR '#' number {
443 set_curr_instr(BPF_ALU | BPF_OR | BPF_K, 0, 0, $3); }
444 | OP_OR 'x' {
445 set_curr_instr(BPF_ALU | BPF_OR | BPF_X, 0, 0, 0); }
448 do_xor
449 : OP_XOR '#' number {
450 set_curr_instr(BPF_ALU | BPF_XOR | BPF_K, 0, 0, $3); }
451 | OP_XOR 'x' {
452 set_curr_instr(BPF_ALU | BPF_XOR | BPF_X, 0, 0, 0); }
455 do_lsh
456 : OP_LSH '#' number {
457 set_curr_instr(BPF_ALU | BPF_LSH | BPF_K, 0, 0, $3); }
458 | OP_LSH 'x' {
459 set_curr_instr(BPF_ALU | BPF_LSH | BPF_X, 0, 0, 0); }
462 do_rsh
463 : OP_RSH '#' number {
464 set_curr_instr(BPF_ALU | BPF_RSH | BPF_K, 0, 0, $3); }
465 | OP_RSH 'x' {
466 set_curr_instr(BPF_ALU | BPF_RSH | BPF_X, 0, 0, 0); }
469 do_ret
470 : OP_RET 'a' {
471 set_curr_instr(BPF_RET | BPF_A, 0, 0, 0); }
472 | OP_RET '#' number {
473 set_curr_instr(BPF_RET | BPF_K, 0, 0, $3); }
476 do_tax
477 : OP_TAX {
478 set_curr_instr(BPF_MISC | BPF_TAX, 0, 0, 0); }
481 do_txa
482 : OP_TXA {
483 set_curr_instr(BPF_MISC | BPF_TXA, 0, 0, 0); }
488 static void stage_1_inline(void)
490 yyparse();
493 static void stage_2_label_reduce(void)
495 int i, max = curr_instr, off;
497 /* 1. reduce k jumps */
498 for (i = 0; i < max; ++i) {
499 if (labels_k[i] != NULL) {
500 off = find_intr_offset_or_panic(labels_k[i]);
501 out[i].k = (uint32_t) (off - i - 1);
505 /* 1. reduce jt jumps */
506 for (i = 0; i < max; ++i) {
507 if (labels_jt[i] != NULL) {
508 off = find_intr_offset_or_panic(labels_jt[i]);
509 out[i].jt = (uint8_t) (off - i -1);
513 /* 1. reduce jf jumps */
514 for (i = 0; i < max; ++i) {
515 if (labels_jf[i] != NULL) {
516 off = find_intr_offset_or_panic(labels_jf[i]);
517 out[i].jf = (uint8_t) (off - i - 1);
522 int compile_filter(char *file, int verbose, int bypass)
524 int i;
525 struct sock_fprog res;
527 if (!strncmp("-", file, strlen("-")))
528 yyin = stdin;
529 else
530 yyin = fopen(file, "r");
531 if (!yyin)
532 panic("Cannot open file!\n");
534 memset(out, 0, sizeof(out));
535 memset(labels, 0, sizeof(labels));
536 memset(labels_jf, 0, sizeof(labels_jf));
537 memset(labels_jt, 0, sizeof(labels_jt));
538 memset(labels_k, 0, sizeof(labels_k));
540 stage_1_inline();
541 stage_2_label_reduce();
543 res.filter = out;
544 res.len = curr_instr;
546 if (verbose) {
547 printf("Generated program:\n");
548 bpf_dump_all(&res);
551 if (!bypass) {
552 if (verbose) {
553 printf("Validating: ");
554 fflush(stdout);
557 if (bpf_validate(&res) == 0) {
558 if (verbose)
559 whine("Semantic error! BPF validation "
560 "failed!\n");
561 else
562 panic("Semantic error! BPF validation failed! "
563 "Try -V for debugging output!\n");
564 } else if (verbose) {
565 printf("is runnable!\n");
569 if (verbose)
570 printf("Result:\n");
571 for (i = 0; i < res.len; ++i) {
572 printf("{ 0x%x, %u, %u, 0x%08x },\n",
573 res.filter[i].code, res.filter[i].jt,
574 res.filter[i].jf, res.filter[i].k);
575 if (labels[i] != NULL)
576 xfree(labels[i]);
577 if (labels_jt[i] != NULL)
578 xfree(labels_jt[i]);
579 if (labels_jf[i] != NULL)
580 xfree(labels_jf[i]);
581 if (labels_k[i] != NULL)
582 xfree(labels_k[i]);
585 fclose(yyin);
586 return 0;
589 void yyerror(const char *err)
591 panic("Syntax error at line %d: %s! %s!\n",
592 yylineno, yytext, err);