2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2009 - 2012 Daniel Borkmann.
5 * Copyright 2009, 2010 Emmanuel Roullit.
6 * Copyright 1990-1996 The Regents of the University of
7 * California. All rights reserved. (3-clause BSD license)
8 * Subject to the GPL, version 2.
13 #include <arpa/inet.h>
14 #include <sys/types.h>
23 /* This is a bug in libpcap, they actually use 'unsigned long' instead
25 #define EXTRACT_SHORT(packet) \
26 ((unsigned short) ntohs(*(unsigned short *) packet))
27 #define EXTRACT_LONG(packet) \
28 (ntohl(*(unsigned long *) packet))
30 # define BPF_MEMWORDS 16
33 #define BPF_LD_B (BPF_LD | BPF_B)
34 #define BPF_LD_H (BPF_LD | BPF_H)
35 #define BPF_LD_W (BPF_LD | BPF_W)
36 #define BPF_LDX_B (BPF_LDX | BPF_B)
37 #define BPF_LDX_W (BPF_LDX | BPF_W)
38 #define BPF_JMP_JA (BPF_JMP | BPF_JA)
39 #define BPF_JMP_JEQ (BPF_JMP | BPF_JEQ)
40 #define BPF_JMP_JGT (BPF_JMP | BPF_JGT)
41 #define BPF_JMP_JGE (BPF_JMP | BPF_JGE)
42 #define BPF_JMP_JSET (BPF_JMP | BPF_JSET)
43 #define BPF_ALU_ADD (BPF_ALU | BPF_ADD)
44 #define BPF_ALU_SUB (BPF_ALU | BPF_SUB)
45 #define BPF_ALU_MUL (BPF_ALU | BPF_MUL)
46 #define BPF_ALU_DIV (BPF_ALU | BPF_DIV)
47 #define BPF_ALU_MOD (BPF_ALU | BPF_MOD)
48 #define BPF_ALU_NEG (BPF_ALU | BPF_NEG)
49 #define BPF_ALU_AND (BPF_ALU | BPF_AND)
50 #define BPF_ALU_OR (BPF_ALU | BPF_OR)
51 #define BPF_ALU_XOR (BPF_ALU | BPF_XOR)
52 #define BPF_ALU_LSH (BPF_ALU | BPF_LSH)
53 #define BPF_ALU_RSH (BPF_ALU | BPF_RSH)
54 #define BPF_MISC_TAX (BPF_MISC | BPF_TAX)
55 #define BPF_MISC_TXA (BPF_MISC | BPF_TXA)
57 static const char *op_table
[] = {
66 [BPF_JMP_JEQ
] = "jeq",
67 [BPF_JMP_JGT
] = "jgt",
68 [BPF_JMP_JGE
] = "jge",
69 [BPF_JMP_JSET
] = "jset",
70 [BPF_ALU_ADD
] = "add",
71 [BPF_ALU_SUB
] = "sub",
72 [BPF_ALU_MUL
] = "mul",
73 [BPF_ALU_DIV
] = "div",
74 [BPF_ALU_MOD
] = "mod",
75 [BPF_ALU_NEG
] = "neg",
76 [BPF_ALU_AND
] = "and",
78 [BPF_ALU_XOR
] = "xor",
79 [BPF_ALU_LSH
] = "lsh",
80 [BPF_ALU_RSH
] = "rsh",
82 [BPF_MISC_TAX
] = "tax",
83 [BPF_MISC_TXA
] = "txa",
86 void bpf_dump_op_table(void)
89 for (i
= 0; i
< array_size(op_table
); ++i
) {
91 printf("%s\n", op_table
[i
]);
95 static const char *bpf_dump_linux_k(uint32_t k
)
100 /* Linux specific arguments */
101 case (SKF_AD_OFF
+ SKF_AD_PROTOCOL
):
103 case (SKF_AD_OFF
+ SKF_AD_PKTTYPE
):
105 case (SKF_AD_OFF
+ SKF_AD_IFINDEX
):
107 case (SKF_AD_OFF
+ SKF_AD_NLATTR
):
109 case (SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
):
111 case (SKF_AD_OFF
+ SKF_AD_MARK
):
113 case (SKF_AD_OFF
+ SKF_AD_QUEUE
):
115 case (SKF_AD_OFF
+ SKF_AD_HATYPE
):
117 case (SKF_AD_OFF
+ SKF_AD_RXHASH
):
119 case (SKF_AD_OFF
+ SKF_AD_CPU
):
121 case (SKF_AD_OFF
+ SKF_AD_VLAN_TAG
):
123 case (SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
):
128 static char *bpf_dump(const struct sock_filter bpf
, int n
)
131 const char *fmt
, *op
;
132 static char image
[256];
142 case BPF_RET
| BPF_K
:
143 op
= op_table
[BPF_RET
];
146 case BPF_RET
| BPF_A
:
147 op
= op_table
[BPF_RET
];
150 case BPF_LD_W
| BPF_ABS
:
151 op
= op_table
[BPF_LD_W
];
152 fmt
= bpf_dump_linux_k(bpf
.k
);
154 case BPF_LD_H
| BPF_ABS
:
155 op
= op_table
[BPF_LD_H
];
156 fmt
= bpf_dump_linux_k(bpf
.k
);
158 case BPF_LD_B
| BPF_ABS
:
159 op
= op_table
[BPF_LD_B
];
160 fmt
= bpf_dump_linux_k(bpf
.k
);
162 case BPF_LD_W
| BPF_LEN
:
163 op
= op_table
[BPF_LD_W
];
166 case BPF_LD_W
| BPF_IND
:
167 op
= op_table
[BPF_LD_W
];
170 case BPF_LD_H
| BPF_IND
:
171 op
= op_table
[BPF_LD_H
];
174 case BPF_LD_B
| BPF_IND
:
175 op
= op_table
[BPF_LD_B
];
178 case BPF_LD
| BPF_IMM
:
179 op
= op_table
[BPF_LD_W
];
182 case BPF_LDX
| BPF_IMM
:
183 op
= op_table
[BPF_LDX
];
186 case BPF_LDX_B
| BPF_MSH
:
187 op
= op_table
[BPF_LDX_B
];
188 fmt
= "4*([%d]&0xf)";
190 case BPF_LD
| BPF_MEM
:
191 op
= op_table
[BPF_LD_W
];
194 case BPF_LDX
| BPF_MEM
:
195 op
= op_table
[BPF_LDX
];
199 op
= op_table
[BPF_ST
];
203 op
= op_table
[BPF_STX
];
207 op
= op_table
[BPF_JMP_JA
];
211 case BPF_JMP_JGT
| BPF_K
:
212 op
= op_table
[BPF_JMP_JGT
];
215 case BPF_JMP_JGE
| BPF_K
:
216 op
= op_table
[BPF_JMP_JGE
];
219 case BPF_JMP_JEQ
| BPF_K
:
220 op
= op_table
[BPF_JMP_JEQ
];
223 case BPF_JMP_JSET
| BPF_K
:
224 op
= op_table
[BPF_JMP_JSET
];
227 case BPF_JMP_JGT
| BPF_X
:
228 op
= op_table
[BPF_JMP_JGT
];
231 case BPF_JMP_JGE
| BPF_X
:
232 op
= op_table
[BPF_JMP_JGE
];
235 case BPF_JMP_JEQ
| BPF_X
:
236 op
= op_table
[BPF_JMP_JEQ
];
239 case BPF_JMP_JSET
| BPF_X
:
240 op
= op_table
[BPF_JMP_JSET
];
243 case BPF_ALU_ADD
| BPF_X
:
244 op
= op_table
[BPF_ALU_ADD
];
247 case BPF_ALU_SUB
| BPF_X
:
248 op
= op_table
[BPF_ALU_SUB
];
251 case BPF_ALU_MUL
| BPF_X
:
252 op
= op_table
[BPF_ALU_MUL
];
255 case BPF_ALU_DIV
| BPF_X
:
256 op
= op_table
[BPF_ALU_DIV
];
259 case BPF_ALU_MOD
| BPF_X
:
260 op
= op_table
[BPF_ALU_MOD
];
263 case BPF_ALU_AND
| BPF_X
:
264 op
= op_table
[BPF_ALU_AND
];
267 case BPF_ALU_OR
| BPF_X
:
268 op
= op_table
[BPF_ALU_OR
];
271 case BPF_ALU_XOR
| BPF_X
:
272 op
= op_table
[BPF_ALU_XOR
];
275 case BPF_ALU_LSH
| BPF_X
:
276 op
= op_table
[BPF_ALU_LSH
];
279 case BPF_ALU_RSH
| BPF_X
:
280 op
= op_table
[BPF_ALU_RSH
];
283 case BPF_ALU_ADD
| BPF_K
:
284 op
= op_table
[BPF_ALU_ADD
];
287 case BPF_ALU_SUB
| BPF_K
:
288 op
= op_table
[BPF_ALU_SUB
];
291 case BPF_ALU_MUL
| BPF_K
:
292 op
= op_table
[BPF_ALU_MUL
];
295 case BPF_ALU_DIV
| BPF_K
:
296 op
= op_table
[BPF_ALU_DIV
];
299 case BPF_ALU_MOD
| BPF_K
:
300 op
= op_table
[BPF_ALU_MOD
];
303 case BPF_ALU_AND
| BPF_K
:
304 op
= op_table
[BPF_ALU_AND
];
307 case BPF_ALU_OR
| BPF_K
:
308 op
= op_table
[BPF_ALU_OR
];
311 case BPF_ALU_XOR
| BPF_K
:
312 op
= op_table
[BPF_ALU_XOR
];
315 case BPF_ALU_LSH
| BPF_K
:
316 op
= op_table
[BPF_ALU_LSH
];
319 case BPF_ALU_RSH
| BPF_K
:
320 op
= op_table
[BPF_ALU_RSH
];
324 op
= op_table
[BPF_ALU_NEG
];
328 op
= op_table
[BPF_MISC_TAX
];
332 op
= op_table
[BPF_MISC_TXA
];
337 slprintf_nocheck(operand
, sizeof(operand
), fmt
, v
);
338 slprintf_nocheck(image
, sizeof(image
),
339 (BPF_CLASS(bpf
.code
) == BPF_JMP
&&
340 BPF_OP(bpf
.code
) != BPF_JA
) ?
341 " L%d: %s %s, L%d, L%d" : " L%d: %s %s",
342 n
, op
, operand
, n
+ 1 + bpf
.jt
, n
+ 1 + bpf
.jf
);
346 void bpf_dump_all(struct sock_fprog
*bpf
)
349 for (i
= 0; i
< bpf
->len
; ++i
)
350 printf("%s\n", bpf_dump(bpf
->filter
[i
], i
));
353 void bpf_attach_to_sock(int sock
, struct sock_fprog
*bpf
)
357 if (bpf
->filter
[0].code
== BPF_RET
&&
358 bpf
->filter
[0].k
== 0xFFFFFFFF)
361 ret
= setsockopt(sock
, SOL_SOCKET
, SO_ATTACH_FILTER
,
364 panic("Cannot attach filter to socket!\n");
367 void bpf_detach_from_sock(int sock
)
371 ret
= setsockopt(sock
, SOL_SOCKET
, SO_DETACH_FILTER
,
372 &empty
, sizeof(empty
));
374 panic("Cannot detach filter from socket!\n");
377 int enable_kernel_bpf_jit_compiler(void)
381 char *file
= "/proc/sys/net/core/bpf_jit_enable";
383 fd
= open(file
, O_WRONLY
);
387 ret
= write(fd
, "1", strlen("1"));
393 int bpf_validate(const struct sock_fprog
*bpf
)
396 const struct sock_filter
*p
;
403 for (i
= 0; i
< bpf
->len
; ++i
) {
405 switch (BPF_CLASS(p
->code
)) {
406 /* Check that memory operations use valid addresses. */
409 switch (BPF_MODE(p
->code
)) {
415 /* There's no maximum packet data size
416 * in userland. The runtime packet length
421 if (p
->k
>= BPF_MEMWORDS
)
432 if (p
->k
>= BPF_MEMWORDS
)
436 switch (BPF_OP(p
->code
)) {
449 /* Check for constant division by 0 (undefined
452 if (BPF_RVAL(p
->code
) == BPF_K
&& p
->k
== 0)
460 /* Check that jumps are within the code block,
461 * and that unconditional branches don't go
462 * backwards as a result of an overflow.
463 * Unconditional branches have a 32-bit offset,
464 * so they could overflow; we check to make
465 * sure they don't. Conditional branches have
466 * an 8-bit offset, and the from address is <=
467 * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
468 * is sufficiently small that adding 255 to it
471 * We know that len is <= BPF_MAXINSNS, and we
472 * assume that BPF_MAXINSNS is < the maximum size
473 * of a u_int, so that i + 1 doesn't overflow.
475 * For userland, we don't know that the from
476 * or len are <= BPF_MAXINSNS, but we know that
477 * from <= len, and, except on a 64-bit system,
478 * it's unlikely that len, if it truly reflects
479 * the size of the program we've been handed,
480 * will be anywhere near the maximum size of
481 * a u_int. We also don't check for backward
482 * branches, as we currently support them in
483 * userland for the protochain operation.
486 switch (BPF_OP(p
->code
)) {
488 if (from
+ p
->k
>= bpf
->len
)
495 if (from
+ p
->jt
>= bpf
->len
||
496 from
+ p
->jf
>= bpf
->len
)
512 return BPF_CLASS(bpf
->filter
[bpf
->len
- 1].code
) == BPF_RET
;
515 uint32_t bpf_run_filter(const struct sock_fprog
* fcode
, uint8_t * packet
,
518 /* XXX: caplen == len */
521 struct sock_filter
*bpf
;
522 int32_t mem
[BPF_MEMWORDS
];
524 if (fcode
== NULL
|| fcode
->filter
== NULL
|| fcode
->len
== 0)
537 case BPF_RET
| BPF_K
:
538 return (uint32_t) bpf
->k
;
539 case BPF_RET
| BPF_A
:
541 case BPF_LD_W
| BPF_ABS
:
542 /* No Linux extensions supported here! */
544 if (k
+ sizeof(int32_t) > plen
)
546 A
= EXTRACT_LONG(&packet
[k
]);
548 case BPF_LD_H
| BPF_ABS
:
549 /* No Linux extensions supported here! */
551 if (k
+ sizeof(short) > plen
)
553 A
= EXTRACT_SHORT(&packet
[k
]);
555 case BPF_LD_B
| BPF_ABS
:
556 /* No Linux extensions supported here! */
562 case BPF_LD_W
| BPF_LEN
:
565 case BPF_LDX_W
| BPF_LEN
:
568 case BPF_LD_W
| BPF_IND
:
570 if (k
+ sizeof(int32_t) > plen
)
572 A
= EXTRACT_LONG(&packet
[k
]);
574 case BPF_LD_H
| BPF_IND
:
576 if (k
+ sizeof(short) > plen
)
578 A
= EXTRACT_SHORT(&packet
[k
]);
580 case BPF_LD_B
| BPF_IND
:
586 case BPF_LDX_B
| BPF_MSH
:
590 X
= (packet
[bpf
->k
] & 0xf) << 2;
592 case BPF_LD
| BPF_IMM
:
595 case BPF_LDX
| BPF_IMM
:
598 case BPF_LD
| BPF_MEM
:
601 case BPF_LDX
| BPF_MEM
:
613 case BPF_JMP_JGT
| BPF_K
:
614 bpf
+= (A
> bpf
->k
) ? bpf
->jt
: bpf
->jf
;
616 case BPF_JMP_JGE
| BPF_K
:
617 bpf
+= (A
>= bpf
->k
) ? bpf
->jt
: bpf
->jf
;
619 case BPF_JMP_JEQ
| BPF_K
:
620 bpf
+= (A
== bpf
->k
) ? bpf
->jt
: bpf
->jf
;
622 case BPF_JMP_JSET
| BPF_K
:
623 bpf
+= (A
& bpf
->k
) ? bpf
->jt
: bpf
->jf
;
625 case BPF_JMP_JGT
| BPF_X
:
626 bpf
+= (A
> X
) ? bpf
->jt
: bpf
->jf
;
628 case BPF_JMP_JGE
| BPF_X
:
629 bpf
+= (A
>= X
) ? bpf
->jt
: bpf
->jf
;
631 case BPF_JMP_JEQ
| BPF_X
:
632 bpf
+= (A
== X
) ? bpf
->jt
: bpf
->jf
;
634 case BPF_JMP_JSET
| BPF_X
:
635 bpf
+= (A
& X
) ? bpf
->jt
: bpf
->jf
;
637 case BPF_ALU_ADD
| BPF_X
:
640 case BPF_ALU_SUB
| BPF_X
:
643 case BPF_ALU_MUL
| BPF_X
:
646 case BPF_ALU_DIV
| BPF_X
:
651 case BPF_ALU_MOD
| BPF_X
:
656 case BPF_ALU_AND
| BPF_X
:
659 case BPF_ALU_OR
| BPF_X
:
662 case BPF_ALU_XOR
| BPF_X
:
665 case BPF_ALU_LSH
| BPF_X
:
668 case BPF_ALU_RSH
| BPF_X
:
671 case BPF_ALU_ADD
| BPF_K
:
674 case BPF_ALU_SUB
| BPF_K
:
677 case BPF_ALU_MUL
| BPF_K
:
680 case BPF_ALU_DIV
| BPF_K
:
683 case BPF_ALU_MOD
| BPF_K
:
686 case BPF_ALU_AND
| BPF_K
:
689 case BPF_ALU_OR
| BPF_K
:
692 case BPF_ALU_XOR
| BPF_K
:
695 case BPF_ALU_LSH
| BPF_K
:
698 case BPF_ALU_RSH
| BPF_K
:
714 void bpf_parse_rules(char *rulefile
, struct sock_fprog
*bpf
)
718 struct sock_filter sf_single
= { 0x06, 0, 0, 0xFFFFFFFF };
721 if (rulefile
== NULL
) {
723 bpf
->filter
= xmalloc(sizeof(sf_single
));
724 fmemcpy(&bpf
->filter
[0], &sf_single
, sizeof(sf_single
));
728 fp
= fopen(rulefile
, "r");
730 panic("Cannot read BPF rule file!\n");
732 fmemset(buff
, 0, sizeof(buff
));
733 while (fgets(buff
, sizeof(buff
), fp
) != NULL
) {
734 buff
[sizeof(buff
) - 1] = 0;
735 if (buff
[0] != '{') {
736 fmemset(buff
, 0, sizeof(buff
));
740 fmemset(&sf_single
, 0, sizeof(sf_single
));
741 ret
= sscanf(buff
, "{ 0x%x, %u, %u, 0x%08x },",
742 (unsigned int *) &sf_single
.code
,
743 (unsigned int *) &sf_single
.jt
,
744 (unsigned int *) &sf_single
.jf
,
745 (unsigned int *) &sf_single
.k
);
747 panic("BPF syntax error!\n");
750 bpf
->filter
= xrealloc(bpf
->filter
, 1,
751 bpf
->len
* sizeof(sf_single
));
753 fmemcpy(&bpf
->filter
[bpf
->len
- 1], &sf_single
,
755 fmemset(buff
, 0, sizeof(buff
));
760 if (bpf_validate(bpf
) == 0)
761 panic("This is not a valid BPF program!\n");