?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
pcap: also support byte swapped pcap types
[netsniff-ng.git] / bpf.c
blobace4307094bb7df5f393521118421e3b8a928f8e
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2009 - 2012 Daniel Borkmann.
5 * Copyright 2009, 2010 Emmanuel Roullit.
6 * Copyright 1990-1996 The Regents of the University of
7 * California. All rights reserved. (3-clause BSD license)
8 * Subject to the GPL, version 2.
9 */
10
11 #include <stdint.h>
12 #include <stdio.h>
13 #include <arpa/inet.h>
14 #include <sys/types.h>
15 #include <sys/stat.h>
16 #include <fcntl.h>
17
18 #include "bpf.h"
19 #include "xmalloc.h"
20 #include "xutils.h"
21 #include "die.h"
22
23 /* This is a bug in libpcap, they actually use 'unsigned long' instead
24 * of short! */
25 #define EXTRACT_SHORT(packet) \
26 ((unsigned short) ntohs(*(unsigned short *) packet))
27 #define EXTRACT_LONG(packet) \
28 (ntohl(*(unsigned long *) packet))
29 #ifndef BPF_MEMWORDS
30 # define BPF_MEMWORDS 16
31 #endif
32
33 #define BPF_LD_B (BPF_LD | BPF_B)
34 #define BPF_LD_H (BPF_LD | BPF_H)
35 #define BPF_LD_W (BPF_LD | BPF_W)
36 #define BPF_LDX_B (BPF_LDX | BPF_B)
37 #define BPF_LDX_W (BPF_LDX | BPF_W)
38 #define BPF_JMP_JA (BPF_JMP | BPF_JA)
39 #define BPF_JMP_JEQ (BPF_JMP | BPF_JEQ)
40 #define BPF_JMP_JGT (BPF_JMP | BPF_JGT)
41 #define BPF_JMP_JGE (BPF_JMP | BPF_JGE)
42 #define BPF_JMP_JSET (BPF_JMP | BPF_JSET)
43 #define BPF_ALU_ADD (BPF_ALU | BPF_ADD)
44 #define BPF_ALU_SUB (BPF_ALU | BPF_SUB)
45 #define BPF_ALU_MUL (BPF_ALU | BPF_MUL)
46 #define BPF_ALU_DIV (BPF_ALU | BPF_DIV)
47 #define BPF_ALU_MOD (BPF_ALU | BPF_MOD)
48 #define BPF_ALU_NEG (BPF_ALU | BPF_NEG)
49 #define BPF_ALU_AND (BPF_ALU | BPF_AND)
50 #define BPF_ALU_OR (BPF_ALU | BPF_OR)
51 #define BPF_ALU_XOR (BPF_ALU | BPF_XOR)
52 #define BPF_ALU_LSH (BPF_ALU | BPF_LSH)
53 #define BPF_ALU_RSH (BPF_ALU | BPF_RSH)
54 #define BPF_MISC_TAX (BPF_MISC | BPF_TAX)
55 #define BPF_MISC_TXA (BPF_MISC | BPF_TXA)
56
57 static const char *op_table[] = {
58 [BPF_LD_B] = "ldb",
59 [BPF_LD_H] = "ldh",
60 [BPF_LD_W] = "ld",
61 [BPF_LDX] = "ldx",
62 [BPF_LDX_B] = "ldxb",
63 [BPF_ST] = "st",
64 [BPF_STX] = "stx",
65 [BPF_JMP_JA] = "ja",
66 [BPF_JMP_JEQ] = "jeq",
67 [BPF_JMP_JGT] = "jgt",
68 [BPF_JMP_JGE] = "jge",
69 [BPF_JMP_JSET] = "jset",
70 [BPF_ALU_ADD] = "add",
71 [BPF_ALU_SUB] = "sub",
72 [BPF_ALU_MUL] = "mul",
73 [BPF_ALU_DIV] = "div",
74 [BPF_ALU_MOD] = "mod",
75 [BPF_ALU_NEG] = "neg",
76 [BPF_ALU_AND] = "and",
77 [BPF_ALU_OR] = "or",
78 [BPF_ALU_XOR] = "xor",
79 [BPF_ALU_LSH] = "lsh",
80 [BPF_ALU_RSH] = "rsh",
81 [BPF_RET] = "ret",
82 [BPF_MISC_TAX] = "tax",
83 [BPF_MISC_TXA] = "txa",
84 };
85
86 void bpf_dump_op_table(void)
87 {
88 int i;
89 for (i = 0; i < array_size(op_table); ++i) {
90 if (op_table[i])
91 printf("%s\n", op_table[i]);
92 }
93 }
94
95 static const char *bpf_dump_linux_k(uint32_t k)
96 {
97 switch (k) {
98 default:
99 return "[%d]";
100 /* Linux specific arguments */
101 case (SKF_AD_OFF + SKF_AD_PROTOCOL):
102 return "#proto";
103 case (SKF_AD_OFF + SKF_AD_PKTTYPE):
104 return "#type";
105 case (SKF_AD_OFF + SKF_AD_IFINDEX):
106 return "#ifidx";
107 case (SKF_AD_OFF + SKF_AD_NLATTR):
108 return "#nla";
109 case (SKF_AD_OFF + SKF_AD_NLATTR_NEST):
110 return "#nlan";
111 case (SKF_AD_OFF + SKF_AD_MARK):
112 return "#mark";
113 case (SKF_AD_OFF + SKF_AD_QUEUE):
114 return "#queue";
115 case (SKF_AD_OFF + SKF_AD_HATYPE):
116 return "#hatype";
117 case (SKF_AD_OFF + SKF_AD_RXHASH):
118 return "#rxhash";
119 case (SKF_AD_OFF + SKF_AD_CPU):
120 return "#cpu";
121 case (SKF_AD_OFF + SKF_AD_VLAN_TAG):
122 return "#vlant";
123 case (SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT):
124 return "#vlanp";
125 }
126 }
127
128 static char *__bpf_dump(const struct sock_filter bpf, int n)
129 {
130 int v;
131 const char *fmt, *op;
132 static char image[256];
133 char operand[64];
134
135 v = bpf.k;
136 switch (bpf.code) {
137 default:
138 op = "unimp";
139 fmt = "0x%x";
140 v = bpf.code;
141 break;
142 case BPF_RET | BPF_K:
143 op = op_table[BPF_RET];
144 fmt = "#0x%x";
145 break;
146 case BPF_RET | BPF_A:
147 op = op_table[BPF_RET];
148 fmt = "a";
149 break;
150 case BPF_RET | BPF_X:
151 op = op_table[BPF_RET];
152 fmt = "x";
153 break;
154 case BPF_LD_W | BPF_ABS:
155 op = op_table[BPF_LD_W];
156 fmt = bpf_dump_linux_k(bpf.k);
157 break;
158 case BPF_LD_H | BPF_ABS:
159 op = op_table[BPF_LD_H];
160 fmt = bpf_dump_linux_k(bpf.k);
161 break;
162 case BPF_LD_B | BPF_ABS:
163 op = op_table[BPF_LD_B];
164 fmt = bpf_dump_linux_k(bpf.k);
165 break;
166 case BPF_LD_W | BPF_LEN:
167 op = op_table[BPF_LD_W];
168 fmt = "#len";
169 break;
170 case BPF_LD_W | BPF_IND:
171 op = op_table[BPF_LD_W];
172 fmt = "[x + %d]";
173 break;
174 case BPF_LD_H | BPF_IND:
175 op = op_table[BPF_LD_H];
176 fmt = "[x + %d]";
177 break;
178 case BPF_LD_B | BPF_IND:
179 op = op_table[BPF_LD_B];
180 fmt = "[x + %d]";
181 break;
182 case BPF_LD | BPF_IMM:
183 op = op_table[BPF_LD_W];
184 fmt = "#0x%x";
185 break;
186 case BPF_LDX | BPF_IMM:
187 op = op_table[BPF_LDX];
188 fmt = "#0x%x";
189 break;
190 case BPF_LDX_B | BPF_MSH:
191 op = op_table[BPF_LDX_B];
192 fmt = "4*([%d]&0xf)";
193 break;
194 case BPF_LD | BPF_MEM:
195 op = op_table[BPF_LD_W];
196 fmt = "M[%d]";
197 break;
198 case BPF_LDX | BPF_MEM:
199 op = op_table[BPF_LDX];
200 fmt = "M[%d]";
201 break;
202 case BPF_ST:
203 op = op_table[BPF_ST];
204 fmt = "M[%d]";
205 break;
206 case BPF_STX:
207 op = op_table[BPF_STX];
208 fmt = "M[%d]";
209 break;
210 case BPF_JMP_JA:
211 op = op_table[BPF_JMP_JA];
212 fmt = "%d";
213 v = n + 1 + bpf.k;
214 break;
215 case BPF_JMP_JGT | BPF_K:
216 op = op_table[BPF_JMP_JGT];
217 fmt = "#0x%x";
218 break;
219 case BPF_JMP_JGE | BPF_K:
220 op = op_table[BPF_JMP_JGE];
221 fmt = "#0x%x";
222 break;
223 case BPF_JMP_JEQ | BPF_K:
224 op = op_table[BPF_JMP_JEQ];
225 fmt = "#0x%x";
226 break;
227 case BPF_JMP_JSET | BPF_K:
228 op = op_table[BPF_JMP_JSET];
229 fmt = "#0x%x";
230 break;
231 case BPF_JMP_JGT | BPF_X:
232 op = op_table[BPF_JMP_JGT];
233 fmt = "x";
234 break;
235 case BPF_JMP_JGE | BPF_X:
236 op = op_table[BPF_JMP_JGE];
237 fmt = "x";
238 break;
239 case BPF_JMP_JEQ | BPF_X:
240 op = op_table[BPF_JMP_JEQ];
241 fmt = "x";
242 break;
243 case BPF_JMP_JSET | BPF_X:
244 op = op_table[BPF_JMP_JSET];
245 fmt = "x";
246 break;
247 case BPF_ALU_ADD | BPF_X:
248 op = op_table[BPF_ALU_ADD];
249 fmt = "x";
250 break;
251 case BPF_ALU_SUB | BPF_X:
252 op = op_table[BPF_ALU_SUB];
253 fmt = "x";
254 break;
255 case BPF_ALU_MUL | BPF_X:
256 op = op_table[BPF_ALU_MUL];
257 fmt = "x";
258 break;
259 case BPF_ALU_DIV | BPF_X:
260 op = op_table[BPF_ALU_DIV];
261 fmt = "x";
262 break;
263 case BPF_ALU_MOD | BPF_X:
264 op = op_table[BPF_ALU_MOD];
265 fmt = "x";
266 break;
267 case BPF_ALU_AND | BPF_X:
268 op = op_table[BPF_ALU_AND];
269 fmt = "x";
270 break;
271 case BPF_ALU_OR | BPF_X:
272 op = op_table[BPF_ALU_OR];
273 fmt = "x";
274 break;
275 case BPF_ALU_XOR | BPF_X:
276 op = op_table[BPF_ALU_XOR];
277 fmt = "x";
278 break;
279 case BPF_ALU_LSH | BPF_X:
280 op = op_table[BPF_ALU_LSH];
281 fmt = "x";
282 break;
283 case BPF_ALU_RSH | BPF_X:
284 op = op_table[BPF_ALU_RSH];
285 fmt = "x";
286 break;
287 case BPF_ALU_ADD | BPF_K:
288 op = op_table[BPF_ALU_ADD];
289 fmt = "#%d";
290 break;
291 case BPF_ALU_SUB | BPF_K:
292 op = op_table[BPF_ALU_SUB];
293 fmt = "#%d";
294 break;
295 case BPF_ALU_MUL | BPF_K:
296 op = op_table[BPF_ALU_MUL];
297 fmt = "#%d";
298 break;
299 case BPF_ALU_DIV | BPF_K:
300 op = op_table[BPF_ALU_DIV];
301 fmt = "#%d";
302 break;
303 case BPF_ALU_MOD | BPF_K:
304 op = op_table[BPF_ALU_MOD];
305 fmt = "#%d";
306 break;
307 case BPF_ALU_AND | BPF_K:
308 op = op_table[BPF_ALU_AND];
309 fmt = "#0x%x";
310 break;
311 case BPF_ALU_OR | BPF_K:
312 op = op_table[BPF_ALU_OR];
313 fmt = "#0x%x";
314 break;
315 case BPF_ALU_XOR | BPF_K:
316 op = op_table[BPF_ALU_XOR];
317 fmt = "#0x%x";
318 break;
319 case BPF_ALU_LSH | BPF_K:
320 op = op_table[BPF_ALU_LSH];
321 fmt = "#%d";
322 break;
323 case BPF_ALU_RSH | BPF_K:
324 op = op_table[BPF_ALU_RSH];
325 fmt = "#%d";
326 break;
327 case BPF_ALU_NEG:
328 op = op_table[BPF_ALU_NEG];
329 fmt = "";
330 break;
331 case BPF_MISC_TAX:
332 op = op_table[BPF_MISC_TAX];
333 fmt = "";
334 break;
335 case BPF_MISC_TXA:
336 op = op_table[BPF_MISC_TXA];
337 fmt = "";
338 break;
339 }
340
341 slprintf_nocheck(operand, sizeof(operand), fmt, v);
342 slprintf_nocheck(image, sizeof(image),
343 (BPF_CLASS(bpf.code) == BPF_JMP &&
344 BPF_OP(bpf.code) != BPF_JA) ?
345 " L%d: %s %s, L%d, L%d" : " L%d: %s %s",
346 n, op, operand, n + 1 + bpf.jt, n + 1 + bpf.jf);
347 return image;
348 }
349
350 void bpf_dump_all(struct sock_fprog *bpf)
351 {
352 int i;
353 for (i = 0; i < bpf->len; ++i)
354 printf("%s\n", __bpf_dump(bpf->filter[i], i));
355 }
356
357 void bpf_attach_to_sock(int sock, struct sock_fprog *bpf)
358 {
359 int ret;
360
361 if (bpf->filter[0].code == BPF_RET &&
362 bpf->filter[0].k == 0xFFFFFFFF)
363 return;
364
365 ret = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER,
366 bpf, sizeof(*bpf));
367 if (ret < 0)
368 panic("Cannot attach filter to socket!\n");
369 }
370
371 void bpf_detach_from_sock(int sock)
372 {
373 int ret, empty = 0;
374
375 ret = setsockopt(sock, SOL_SOCKET, SO_DETACH_FILTER,
376 &empty, sizeof(empty));
377 if (ret < 0)
378 panic("Cannot detach filter from socket!\n");
379 }
380
381 int enable_kernel_bpf_jit_compiler(void)
382 {
383 int fd;
384 ssize_t ret;
385 char *file = "/proc/sys/net/core/bpf_jit_enable";
386
387 fd = open(file, O_WRONLY);
388 if (fd < 0)
389 return -1;
390
391 ret = write(fd, "1", strlen("1"));
392
393 close(fd);
394 return ret;
395 }
396
397 int __bpf_validate(const struct sock_fprog *bpf)
398 {
399 uint32_t i, from;
400 const struct sock_filter *p;
401
402 if (!bpf)
403 return 0;
404 if (bpf->len < 1)
405 return 0;
406
407 for (i = 0; i < bpf->len; ++i) {
408 p = &bpf->filter[i];
409 switch (BPF_CLASS(p->code)) {
410 /* Check that memory operations use valid addresses. */
411 case BPF_LD:
412 case BPF_LDX:
413 switch (BPF_MODE(p->code)) {
414 case BPF_IMM:
415 break;
416 case BPF_ABS:
417 case BPF_IND:
418 case BPF_MSH:
419 /* There's no maximum packet data size
420 * in userland. The runtime packet length
421 * check suffices.
422 */
423 break;
424 case BPF_MEM:
425 if (p->k >= BPF_MEMWORDS)
426 return 0;
427 break;
428 case BPF_LEN:
429 break;
430 default:
431 return 0;
432 }
433 break;
434 case BPF_ST:
435 case BPF_STX:
436 if (p->k >= BPF_MEMWORDS)
437 return 0;
438 break;
439 case BPF_ALU:
440 switch (BPF_OP(p->code)) {
441 case BPF_ADD:
442 case BPF_SUB:
443 case BPF_MUL:
444 case BPF_OR:
445 case BPF_XOR:
446 case BPF_AND:
447 case BPF_LSH:
448 case BPF_RSH:
449 case BPF_NEG:
450 break;
451 case BPF_DIV:
452 case BPF_MOD:
453 /* Check for constant division by 0 (undefined
454 * for div and mod).
455 */
456 if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
457 return 0;
458 break;
459 default:
460 return 0;
461 }
462 break;
463 case BPF_JMP:
464 /* Check that jumps are within the code block,
465 * and that unconditional branches don't go
466 * backwards as a result of an overflow.
467 * Unconditional branches have a 32-bit offset,
468 * so they could overflow; we check to make
469 * sure they don't. Conditional branches have
470 * an 8-bit offset, and the from address is <=
471 * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
472 * is sufficiently small that adding 255 to it
473 * won't overflow.
474 *
475 * We know that len is <= BPF_MAXINSNS, and we
476 * assume that BPF_MAXINSNS is < the maximum size
477 * of a u_int, so that i + 1 doesn't overflow.
478 *
479 * For userland, we don't know that the from
480 * or len are <= BPF_MAXINSNS, but we know that
481 * from <= len, and, except on a 64-bit system,
482 * it's unlikely that len, if it truly reflects
483 * the size of the program we've been handed,
484 * will be anywhere near the maximum size of
485 * a u_int. We also don't check for backward
486 * branches, as we currently support them in
487 * userland for the protochain operation.
488 */
489 from = i + 1;
490 switch (BPF_OP(p->code)) {
491 case BPF_JA:
492 if (from + p->k >= bpf->len)
493 return 0;
494 break;
495 case BPF_JEQ:
496 case BPF_JGT:
497 case BPF_JGE:
498 case BPF_JSET:
499 if (from + p->jt >= bpf->len ||
500 from + p->jf >= bpf->len)
501 return 0;
502 break;
503 default:
504 return 0;
505 }
506 break;
507 case BPF_RET:
508 break;
509 case BPF_MISC:
510 break;
511 default:
512 return 0;
513 }
514 }
515
516 return BPF_CLASS(bpf->filter[bpf->len - 1].code) == BPF_RET;
517 }
518
519 uint32_t bpf_run_filter(const struct sock_fprog * fcode, uint8_t * packet,
520 size_t plen)
521 {
522 /* XXX: caplen == len */
523 uint32_t A, X;
524 uint32_t k;
525 struct sock_filter *bpf;
526 int32_t mem[BPF_MEMWORDS] = { 0, };
527
528 if (fcode == NULL || fcode->filter == NULL || fcode->len == 0)
529 return 0xFFFFFFFF;
530
531 A = 0;
532 X = 0;
533
534 bpf = fcode->filter;
535 --bpf;
536 while (1) {
537 ++bpf;
538 switch (bpf->code) {
539 default:
540 return 0;
541 case BPF_RET | BPF_K:
542 return (uint32_t) bpf->k;
543 case BPF_RET | BPF_A:
544 return (uint32_t) A;
545 case BPF_LD_W | BPF_ABS:
546 /* No Linux extensions supported here! */
547 k = bpf->k;
548 if (k + sizeof(int32_t) > plen)
549 return 0;
550 A = EXTRACT_LONG(&packet[k]);
551 continue;
552 case BPF_LD_H | BPF_ABS:
553 /* No Linux extensions supported here! */
554 k = bpf->k;
555 if (k + sizeof(short) > plen)
556 return 0;
557 A = EXTRACT_SHORT(&packet[k]);
558 continue;
559 case BPF_LD_B | BPF_ABS:
560 /* No Linux extensions supported here! */
561 k = bpf->k;
562 if (k >= plen)
563 return 0;
564 A = packet[k];
565 continue;
566 case BPF_LD_W | BPF_LEN:
567 A = plen;
568 continue;
569 case BPF_LDX_W | BPF_LEN:
570 X = plen;
571 continue;
572 case BPF_LD_W | BPF_IND:
573 k = X + bpf->k;
574 if (k + sizeof(int32_t) > plen)
575 return 0;
576 A = EXTRACT_LONG(&packet[k]);
577 continue;
578 case BPF_LD_H | BPF_IND:
579 k = X + bpf->k;
580 if (k + sizeof(short) > plen)
581 return 0;
582 A = EXTRACT_SHORT(&packet[k]);
583 continue;
584 case BPF_LD_B | BPF_IND:
585 k = X + bpf->k;
586 if (k >= plen)
587 return 0;
588 A = packet[k];
589 continue;
590 case BPF_LDX_B | BPF_MSH:
591 k = bpf->k;
592 if (k >= plen)
593 return 0;
594 X = (packet[bpf->k] & 0xf) << 2;
595 continue;
596 case BPF_LD | BPF_IMM:
597 A = bpf->k;
598 continue;
599 case BPF_LDX | BPF_IMM:
600 X = bpf->k;
601 continue;
602 case BPF_LD | BPF_MEM:
603 A = mem[bpf->k];
604 continue;
605 case BPF_LDX | BPF_MEM:
606 X = mem[bpf->k];
607 continue;
608 case BPF_ST:
609 mem[bpf->k] = A;
610 continue;
611 case BPF_STX:
612 mem[bpf->k] = X;
613 continue;
614 case BPF_JMP_JA:
615 bpf += bpf->k;
616 continue;
617 case BPF_JMP_JGT | BPF_K:
618 bpf += (A > bpf->k) ? bpf->jt : bpf->jf;
619 continue;
620 case BPF_JMP_JGE | BPF_K:
621 bpf += (A >= bpf->k) ? bpf->jt : bpf->jf;
622 continue;
623 case BPF_JMP_JEQ | BPF_K:
624 bpf += (A == bpf->k) ? bpf->jt : bpf->jf;
625 continue;
626 case BPF_JMP_JSET | BPF_K:
627 bpf += (A & bpf->k) ? bpf->jt : bpf->jf;
628 continue;
629 case BPF_JMP_JGT | BPF_X:
630 bpf += (A > X) ? bpf->jt : bpf->jf;
631 continue;
632 case BPF_JMP_JGE | BPF_X:
633 bpf += (A >= X) ? bpf->jt : bpf->jf;
634 continue;
635 case BPF_JMP_JEQ | BPF_X:
636 bpf += (A == X) ? bpf->jt : bpf->jf;
637 continue;
638 case BPF_JMP_JSET | BPF_X:
639 bpf += (A & X) ? bpf->jt : bpf->jf;
640 continue;
641 case BPF_ALU_ADD | BPF_X:
642 A += X;
643 continue;
644 case BPF_ALU_SUB | BPF_X:
645 A -= X;
646 continue;
647 case BPF_ALU_MUL | BPF_X:
648 A *= X;
649 continue;
650 case BPF_ALU_DIV | BPF_X:
651 if (X == 0)
652 return 0;
653 A /= X;
654 continue;
655 case BPF_ALU_MOD | BPF_X:
656 if (X == 0)
657 return 0;
658 A %= X;
659 continue;
660 case BPF_ALU_AND | BPF_X:
661 A &= X;
662 continue;
663 case BPF_ALU_OR | BPF_X:
664 A |= X;
665 continue;
666 case BPF_ALU_XOR | BPF_X:
667 A ^= X;
668 continue;
669 case BPF_ALU_LSH | BPF_X:
670 A <<= X;
671 continue;
672 case BPF_ALU_RSH | BPF_X:
673 A >>= X;
674 continue;
675 case BPF_ALU_ADD | BPF_K:
676 A += bpf->k;
677 continue;
678 case BPF_ALU_SUB | BPF_K:
679 A -= bpf->k;
680 continue;
681 case BPF_ALU_MUL | BPF_K:
682 A *= bpf->k;
683 continue;
684 case BPF_ALU_DIV | BPF_K:
685 A /= bpf->k;
686 continue;
687 case BPF_ALU_MOD | BPF_K:
688 A %= bpf->k;
689 continue;
690 case BPF_ALU_AND | BPF_K:
691 A &= bpf->k;
692 continue;
693 case BPF_ALU_OR | BPF_K:
694 A |= bpf->k;
695 continue;
696 case BPF_ALU_XOR | BPF_K:
697 A ^= bpf->k;
698 continue;
699 case BPF_ALU_LSH | BPF_K:
700 A <<= bpf->k;
701 continue;
702 case BPF_ALU_RSH | BPF_K:
703 A >>= bpf->k;
704 continue;
705 case BPF_ALU_NEG:
706 A = -A;
707 continue;
708 case BPF_MISC_TAX:
709 X = A;
710 continue;
711 case BPF_MISC_TXA:
712 A = X;
713 continue;
714 }
715 }
716 }
717
718 #ifdef __WITH_TCPDUMP_LIKE_FILTER
719 # include <pcap/pcap.h>
720 # include <pcap/bpf.h>
721 #endif
722
723 void bpf_parse_rules(char *dev, char *rulefile, struct sock_fprog *bpf)
724 {
725 int ret;
726 char buff[256];
727 struct sock_filter sf_single = { 0x06, 0, 0, 0xFFFFFFFF };
728 FILE *fp;
729
730 if (rulefile == NULL) {
731 bpf->len = 1;
732 bpf->filter = xmalloc(sizeof(sf_single));
733 fmemcpy(&bpf->filter[0], &sf_single, sizeof(sf_single));
734 return;
735 }
736
737 fp = fopen(rulefile, "r");
738 if (!fp)
739 #ifdef __WITH_TCPDUMP_LIKE_FILTER
740 goto try_compile_str;
741 #else
742 panic("Cannot open file %s!\n", rulefile);
743 #endif
744
745 fmemset(buff, 0, sizeof(buff));
746 while (fgets(buff, sizeof(buff), fp) != NULL) {
747 buff[sizeof(buff) - 1] = 0;
748 if (buff[0] != '{') {
749 fmemset(buff, 0, sizeof(buff));
750 continue;
751 }
752
753 fmemset(&sf_single, 0, sizeof(sf_single));
754 ret = sscanf(buff, "{ 0x%x, %u, %u, 0x%08x },",
755 (unsigned int *) &sf_single.code,
756 (unsigned int *) &sf_single.jt,
757 (unsigned int *) &sf_single.jf,
758 (unsigned int *) &sf_single.k);
759 if (ret != 4)
760 panic("BPF syntax error!\n");
761
762 bpf->len++;
763 bpf->filter = xrealloc(bpf->filter, 1,
764 bpf->len * sizeof(sf_single));
765
766 fmemcpy(&bpf->filter[bpf->len - 1], &sf_single,
767 sizeof(sf_single));
768 fmemset(buff, 0, sizeof(buff));
769 }
770
771 fclose(fp);
772
773 if (__bpf_validate(bpf) == 0)
774 panic("This is not a valid BPF program!\n");
775
776 return;
777 #ifdef __WITH_TCPDUMP_LIKE_FILTER
778 try_compile_str:
779 {
780 int i;
781 struct bpf_program bpfp;
782 struct pcap *fd;
783
784 /* For users, who want to have a tcpdump-sytle filter syntax */
785 fd = pcap_open_live(dev, 60, 0, 1000, NULL);
786 if (!fd)
787 panic("Cannot open any device!\n");
788
789 ret = pcap_compile(fd, &bpfp, rulefile, 1, 0xffffffff);
790 if (ret < 0)
791 panic("Cannot compile filter %s: %s\n", rulefile, pcap_geterr(fd));
792
793 pcap_close(fd);
794
795 bpf->len = bpfp.bf_len;
796 bpf->filter = xrealloc(bpf->filter, 1,
797 bpf->len * sizeof(sf_single));
798
799 for (i = 0; i < bpf->len; ++i) {
800 bpf->filter[i].code = bpfp.bf_insns[i].code;
801 bpf->filter[i].jt = bpfp.bf_insns[i].jt;
802 bpf->filter[i].jf = bpfp.bf_insns[i].jf;
803 bpf->filter[i].k = bpfp.bf_insns[i].k;
804
805 if (bpf->filter[i].code == 0x06 && bpf->filter[i].k > 0)
806 bpf->filter[i].k = 0xFFFFFFFF;
807 }
808 }
809 #endif
810 }
netsniff-ng toolkit, the packet sniffing beast, staging tree