2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
9 /* yaac-func-prefix: yy */
22 #include "bpf_parser.tab.h"
26 #define MAX_INSTRUCTIONS 4096
28 int compile_filter
(char *file
, int verbose
, int bypass
, int format
);
30 static int curr_instr
= 0;
32 static struct sock_filter out
[MAX_INSTRUCTIONS
];
34 static char *labels
[MAX_INSTRUCTIONS
];
36 static char *labels_jt
[MAX_INSTRUCTIONS
];
37 static char *labels_jf
[MAX_INSTRUCTIONS
];
38 static char *labels_k
[MAX_INSTRUCTIONS
];
40 #define YYERROR_VERBOSE 0
42 #define YYENABLE_NLS 1
43 #define YYLTYPE_IS_TRIVIAL 1
47 extern
int yylex(void);
48 extern
void yyerror(const char *);
52 static inline
void check_max_instr
(void)
54 if
(curr_instr
>= MAX_INSTRUCTIONS
)
55 panic
("Exceeded maximal number of instructions!\n");
58 static inline
void set_curr_instr
(uint16_t code
, uint8_t jt
, uint8_t jf
, uint32_t k
)
62 out
[curr_instr
].code
= code
;
63 out
[curr_instr
].jt
= jt
;
64 out
[curr_instr
].jf
= jf
;
65 out
[curr_instr
].k
= k
;
70 static inline
void set_curr_label
(char *label
)
74 labels
[curr_instr
] = label
;
81 static inline
void set_jmp_label
(char *label
, int which
)
87 labels_jt
[curr_instr
] = label
;
90 labels_jf
[curr_instr
] = label
;
93 labels_k
[curr_instr
] = label
;
100 static int find_intr_offset_or_panic
(char *label_to_search
)
102 int i
, max
= curr_instr
, ret
= -ENOENT
;
104 bug_on
(!label_to_search
);
106 for
(i
= 0; i
< max
; ++i
) {
107 if
(labels
[i
] != NULL
) {
108 /* Both are \0-terminated! */
109 if
(!strcmp
(label_to_search
, labels
[i
])) {
117 panic
("No such label!\n");
129 %token OP_LDB OP_LDH OP_LD OP_LDX OP_ST OP_STX OP_JMP OP_JEQ OP_JGT OP_JGE
130 %token OP_JSET OP_ADD OP_SUB OP_MUL OP_DIV OP_AND OP_OR OP_XOR OP_LSH OP_RSH
131 %token OP_RET OP_TAX OP_TXA OP_LDXB OP_MOD OP_NEG OP_JNEQ OP_JLT OP_JLE OP_LDI
134 %token K_PKT_LEN K_PROTO K_TYPE K_NLATTR K_NLATTR_NEST K_MARK K_QUEUE K_HATYPE
135 %token K_RXHASH K_CPU K_IFIDX K_VLANT K_VLANP K_POFF
137 %token
':' ',' '[' ']' '(' ')' 'x' 'a' '+' 'M' '*' '&' '#'
141 %type
<number
> number
194 : label
':' { set_curr_label
($1); }
198 : OP_LDB
'[' 'x' '+' number
']' {
199 set_curr_instr
(BPF_LD | BPF_B | BPF_IND
, 0, 0, $5); }
200 | OP_LDB
'[' number
']' {
201 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0, $3); }
203 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
204 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
206 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
207 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
209 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
210 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
212 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
213 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
214 | OP_LDB K_NLATTR_NEST
{
215 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
216 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
218 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
219 SKF_AD_OFF
+ SKF_AD_MARK
); }
221 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
222 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
224 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
225 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
227 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
228 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
230 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
231 SKF_AD_OFF
+ SKF_AD_CPU
); }
233 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
234 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
236 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
237 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
239 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
240 SKF_AD_OFF
+ SKF_AD_PAY_OFFSET
); }
244 : OP_LDH
'[' 'x' '+' number
']' {
245 set_curr_instr
(BPF_LD | BPF_H | BPF_IND
, 0, 0, $5); }
246 | OP_LDH
'[' number
']' {
247 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0, $3); }
249 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
250 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
252 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
253 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
255 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
256 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
258 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
259 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
260 | OP_LDH K_NLATTR_NEST
{
261 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
262 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
264 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
265 SKF_AD_OFF
+ SKF_AD_MARK
); }
267 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
268 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
270 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
271 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
273 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
274 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
276 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
277 SKF_AD_OFF
+ SKF_AD_CPU
); }
279 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
280 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
282 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
283 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
285 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
286 SKF_AD_OFF
+ SKF_AD_PAY_OFFSET
); }
291 set_curr_instr
(BPF_LD | BPF_IMM
, 0, 0, $2); }
296 set_curr_instr
(BPF_LD | BPF_IMM
, 0, 0, $3); }
298 set_curr_instr
(BPF_LD | BPF_W | BPF_LEN
, 0, 0, 0); }
300 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
301 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
303 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
304 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
306 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
307 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
309 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
310 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
311 | OP_LD K_NLATTR_NEST
{
312 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
313 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
315 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
316 SKF_AD_OFF
+ SKF_AD_MARK
); }
318 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
319 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
321 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
322 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
324 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
325 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
327 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
328 SKF_AD_OFF
+ SKF_AD_CPU
); }
330 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
331 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
333 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
334 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
336 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
337 SKF_AD_OFF
+ SKF_AD_PAY_OFFSET
); }
338 | OP_LD
'M' '[' number
']' {
339 set_curr_instr
(BPF_LD | BPF_MEM
, 0, 0, $4); }
340 | OP_LD
'[' 'x' '+' number
']' {
341 set_curr_instr
(BPF_LD | BPF_W | BPF_IND
, 0, 0, $5); }
342 | OP_LD
'[' number
']' {
343 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0, $3); }
348 set_curr_instr
(BPF_LDX | BPF_IMM
, 0, 0, $2); }
352 : OP_LDX
'#' number
{
353 set_curr_instr
(BPF_LDX | BPF_IMM
, 0, 0, $3); }
354 | OP_LDX
'M' '[' number
']' {
355 set_curr_instr
(BPF_LDX | BPF_MEM
, 0, 0, $4); }
356 | OP_LDXB number
'*' '(' '[' number
']' '&' number
')' {
357 if
($2 != 4 ||
$9 != 0xf) {
358 panic
("ldxb offset not supported!\n");
360 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
361 | OP_LDX number
'*' '(' '[' number
']' '&' number
')' {
362 if
($2 != 4 ||
$9 != 0xf) {
363 panic
("ldxb offset not supported!\n");
365 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
369 : OP_ST
'M' '[' number
']' {
370 set_curr_instr
(BPF_ST
, 0, 0, $4); }
374 : OP_STX
'M' '[' number
']' {
375 set_curr_instr
(BPF_STX
, 0, 0, $4); }
380 set_jmp_label
($2, JKL
);
381 set_curr_instr
(BPF_JMP | BPF_JA
, 0, 0, 0); }
385 : OP_JEQ
'#' number
',' label
',' label
{
386 set_jmp_label
($5, JTL
);
387 set_jmp_label
($7, JFL
);
388 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
389 | OP_JEQ
'x' ',' label
',' label
{
390 set_jmp_label
($4, JTL
);
391 set_jmp_label
($6, JFL
);
392 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
393 | OP_JEQ
'#' number
',' label
{
394 set_jmp_label
($5, JTL
);
395 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
396 | OP_JEQ
'x' ',' label
{
397 set_jmp_label
($4, JTL
);
398 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
402 : OP_JNEQ
'#' number
',' label
{
403 set_jmp_label
($5, JFL
);
404 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
405 | OP_JNEQ
'x' ',' label
{
406 set_jmp_label
($4, JFL
);
407 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
411 : OP_JLT
'#' number
',' label
{
412 set_jmp_label
($5, JFL
);
413 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
414 | OP_JLT
'x' ',' label
{
415 set_jmp_label
($4, JFL
);
416 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
420 : OP_JLE
'#' number
',' label
{
421 set_jmp_label
($5, JFL
);
422 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
423 | OP_JLE
'x' ',' label
{
424 set_jmp_label
($4, JFL
);
425 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
429 : OP_JGT
'#' number
',' label
',' label
{
430 set_jmp_label
($5, JTL
);
431 set_jmp_label
($7, JFL
);
432 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
433 | OP_JGT
'x' ',' label
',' label
{
434 set_jmp_label
($4, JTL
);
435 set_jmp_label
($6, JFL
);
436 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
437 | OP_JGT
'#' number
',' label
{
438 set_jmp_label
($5, JTL
);
439 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
440 | OP_JGT
'x' ',' label
{
441 set_jmp_label
($4, JTL
);
442 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
446 : OP_JGE
'#' number
',' label
',' label
{
447 set_jmp_label
($5, JTL
);
448 set_jmp_label
($7, JFL
);
449 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
450 | OP_JGE
'x' ',' label
',' label
{
451 set_jmp_label
($4, JTL
);
452 set_jmp_label
($6, JFL
);
453 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
454 | OP_JGE
'#' number
',' label
{
455 set_jmp_label
($5, JTL
);
456 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
457 | OP_JGE
'x' ',' label
{
458 set_jmp_label
($4, JTL
);
459 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
463 : OP_JSET
'#' number
',' label
',' label
{
464 set_jmp_label
($5, JTL
);
465 set_jmp_label
($7, JFL
);
466 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_K
, 0, 0, $3); }
467 | OP_JSET
'x' ',' label
',' label
{
468 set_jmp_label
($4, JTL
);
469 set_jmp_label
($6, JFL
);
470 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_X
, 0, 0, 0); }
471 | OP_JSET
'#' number
',' label
{
472 set_jmp_label
($5, JTL
);
473 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_K
, 0, 0, $3); }
474 | OP_JSET
'x' ',' label
{
475 set_jmp_label
($4, JTL
);
476 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_X
, 0, 0, 0); }
480 : OP_ADD
'#' number
{
481 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_K
, 0, 0, $3); }
483 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_X
, 0, 0, 0); }
487 : OP_SUB
'#' number
{
488 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_K
, 0, 0, $3); }
490 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_X
, 0, 0, 0); }
494 : OP_MUL
'#' number
{
495 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_K
, 0, 0, $3); }
497 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_X
, 0, 0, 0); }
501 : OP_DIV
'#' number
{
502 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_K
, 0, 0, $3); }
504 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_X
, 0, 0, 0); }
508 : OP_MOD
'#' number
{
509 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_K
, 0, 0, $3); }
511 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_X
, 0, 0, 0); }
516 set_curr_instr
(BPF_ALU | BPF_NEG
, 0, 0, 0); }
520 : OP_AND
'#' number
{
521 set_curr_instr
(BPF_ALU | BPF_AND | BPF_K
, 0, 0, $3); }
523 set_curr_instr
(BPF_ALU | BPF_AND | BPF_X
, 0, 0, 0); }
528 set_curr_instr
(BPF_ALU | BPF_OR | BPF_K
, 0, 0, $3); }
530 set_curr_instr
(BPF_ALU | BPF_OR | BPF_X
, 0, 0, 0); }
534 : OP_XOR
'#' number
{
535 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_K
, 0, 0, $3); }
537 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_X
, 0, 0, 0); }
541 : OP_LSH
'#' number
{
542 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_K
, 0, 0, $3); }
544 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_X
, 0, 0, 0); }
548 : OP_RSH
'#' number
{
549 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_K
, 0, 0, $3); }
551 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_X
, 0, 0, 0); }
556 set_curr_instr
(BPF_RET | BPF_A
, 0, 0, 0); }
558 set_curr_instr
(BPF_RET | BPF_X
, 0, 0, 0); }
559 | OP_RET
'#' number
{
560 set_curr_instr
(BPF_RET | BPF_K
, 0, 0, $3); }
565 set_curr_instr
(BPF_MISC | BPF_TAX
, 0, 0, 0); }
570 set_curr_instr
(BPF_MISC | BPF_TXA
, 0, 0, 0); }
575 static void stage_1_inline
(void)
580 static void stage_2_label_reduce
(void)
582 int i
, max
= curr_instr
, off
;
584 /* 1. reduce k jumps */
585 for
(i
= 0; i
< max
; ++i
) {
586 if
(labels_k
[i
] != NULL
) {
587 off
= find_intr_offset_or_panic
(labels_k
[i
]);
588 out
[i
].k
= (uint32_t) (off
- i
- 1);
592 /* 1. reduce jt jumps */
593 for
(i
= 0; i
< max
; ++i
) {
594 if
(labels_jt
[i
] != NULL
) {
595 off
= find_intr_offset_or_panic
(labels_jt
[i
]);
596 out
[i
].jt
= (uint8_t) (off
- i
-1);
600 /* 1. reduce jf jumps */
601 for
(i
= 0; i
< max
; ++i
) {
602 if
(labels_jf
[i
] != NULL
) {
603 off
= find_intr_offset_or_panic
(labels_jf
[i
]);
604 out
[i
].jf
= (uint8_t) (off
- i
- 1);
609 static void pretty_printer_c
(const struct sock_fprog
*prog
)
613 for
(i
= 0; i
< prog
->len
; ++i
) {
614 printf
("{ 0x%x, %u, %u, 0x%08x },\n",
615 prog
->filter
[i
].code
, prog
->filter
[i
].jt
,
616 prog
->filter
[i
].jf
, prog
->filter
[i
].k
);
620 static void pretty_printer_xt_bpf
(const struct sock_fprog
*prog
)
624 printf
("%d,", prog
->len
);
625 for
(i
= 0; i
< prog
->len
; ++i
) {
626 printf
("%u %u %u %u,",
627 prog
->filter
[i
].code
, prog
->filter
[i
].jt
,
628 prog
->filter
[i
].jf
, prog
->filter
[i
].k
);
634 static void pretty_printer_tcpdump
(const struct sock_fprog
*prog
)
638 for
(i
= 0; i
< prog
->len
; ++i
) {
639 printf
("%u %u %u %u\n",
640 prog
->filter
[i
].code
, prog
->filter
[i
].jt
,
641 prog
->filter
[i
].jf
, prog
->filter
[i
].k
);
645 static void pretty_printer
(const struct sock_fprog
*prog
, int format
)
649 pretty_printer_c
(prog
);
652 pretty_printer_xt_bpf
(prog
);
655 pretty_printer_tcpdump
(prog
);
662 int compile_filter
(char *file
, int verbose
, int bypass
, int format
)
665 struct sock_fprog res
;
667 if
(!strncmp
("-", file
, strlen
("-")))
670 yyin
= fopen
(file
, "r");
672 panic
("Cannot open file!\n");
674 memset
(out
, 0, sizeof
(out
));
675 memset
(labels
, 0, sizeof
(labels
));
676 memset
(labels_jf
, 0, sizeof
(labels_jf
));
677 memset
(labels_jt
, 0, sizeof
(labels_jt
));
678 memset
(labels_k
, 0, sizeof
(labels_k
));
681 stage_2_label_reduce
();
684 res.len
= curr_instr
;
687 printf
("Generated program:\n");
693 printf
("Validating: ");
697 if
(__bpf_validate
(&res
) == 0) {
699 printf
("Semantic error! BPF validation failed!\n");
701 panic
("Semantic error! BPF validation failed! "
702 "Try -V for debugging output!\n");
703 } else if
(verbose
) {
704 printf
("is runnable!\n");
711 pretty_printer
(&res
, format
);
713 for
(i
= 0; i
< res.len
; ++i
) {
724 void yyerror(const char *err
)
726 panic
("Syntax error at line %d: %s! %s!\n",
727 yylineno
, yytext
, err
);