2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
9 /* yaac-func-prefix: yy */
22 #include "bpf_parser.tab.h"
26 #define MAX_INSTRUCTIONS 4096
28 int compile_filter
(char *file
, int verbose
, int bypass
);
30 static int curr_instr
= 0;
32 static struct sock_filter out
[MAX_INSTRUCTIONS
];
34 static char *labels
[MAX_INSTRUCTIONS
];
36 static char *labels_jt
[MAX_INSTRUCTIONS
];
37 static char *labels_jf
[MAX_INSTRUCTIONS
];
38 static char *labels_k
[MAX_INSTRUCTIONS
];
40 #define YYERROR_VERBOSE 0
42 #define YYENABLE_NLS 1
43 #define YYLTYPE_IS_TRIVIAL 1
47 extern
int yylex(void);
48 extern
void yyerror(const char *);
52 static inline
void check_max_instr
(void)
54 if
(curr_instr
>= MAX_INSTRUCTIONS
)
55 panic
("Exceeded maximal number of instructions!\n");
58 static inline
void set_curr_instr
(uint16_t code
, uint8_t jt
, uint8_t jf
, uint32_t k
)
62 out
[curr_instr
].code
= code
;
63 out
[curr_instr
].jt
= jt
;
64 out
[curr_instr
].jf
= jf
;
65 out
[curr_instr
].k
= k
;
70 static inline
void set_curr_label
(char *label
)
74 labels
[curr_instr
] = label
;
81 static inline
void set_jmp_label
(char *label
, int which
)
87 labels_jt
[curr_instr
] = label
;
90 labels_jf
[curr_instr
] = label
;
93 labels_k
[curr_instr
] = label
;
100 static int find_intr_offset_or_panic
(char *label_to_search
)
102 int i
, max
= curr_instr
, ret
= -ENOENT
;
104 bug_on
(!label_to_search
);
106 for
(i
= 0; i
< max
; ++i
) {
107 if
(labels
[i
] != NULL
) {
108 /* Both are \0-terminated! */
109 if
(!strcmp
(label_to_search
, labels
[i
])) {
117 panic
("No such label!\n");
129 %token OP_LDB OP_LDH OP_LD OP_LDX OP_ST OP_STX OP_JMP OP_JEQ OP_JGT OP_JGE
130 %token OP_JSET OP_ADD OP_SUB OP_MUL OP_DIV OP_AND OP_OR OP_XOR OP_LSH OP_RSH
131 %token OP_RET OP_TAX OP_TXA OP_LDXB OP_MOD OP_NEG OP_JNEQ OP_JLT OP_JLE OP_LDI
134 %token K_PKT_LEN K_PROTO K_TYPE K_NLATTR K_NLATTR_NEST K_MARK K_QUEUE K_HATYPE
135 %token K_RXHASH K_CPU K_IFIDX K_VLANT K_VLANP
137 %token
':' ',' '[' ']' '(' ')' 'x' 'a' '+' 'M' '*' '&' '#'
141 %type
<number
> number
194 : label
':' { set_curr_label
($1); }
198 : OP_LDB
'[' 'x' '+' number
']' {
199 set_curr_instr
(BPF_LD | BPF_B | BPF_IND
, 0, 0, $5); }
200 | OP_LDB
'[' number
']' {
201 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0, $3); }
203 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
204 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
206 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
207 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
209 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
210 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
212 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
213 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
214 | OP_LDB K_NLATTR_NEST
{
215 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
216 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
218 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
219 SKF_AD_OFF
+ SKF_AD_MARK
); }
221 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
222 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
224 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
225 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
227 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
228 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
230 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
231 SKF_AD_OFF
+ SKF_AD_CPU
); }
233 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
234 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
236 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
237 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
241 : OP_LDH
'[' 'x' '+' number
']' {
242 set_curr_instr
(BPF_LD | BPF_H | BPF_IND
, 0, 0, $5); }
243 | OP_LDH
'[' number
']' {
244 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0, $3); }
246 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
247 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
249 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
250 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
252 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
253 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
255 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
256 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
257 | OP_LDH K_NLATTR_NEST
{
258 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
259 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
261 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
262 SKF_AD_OFF
+ SKF_AD_MARK
); }
264 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
265 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
267 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
268 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
270 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
271 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
273 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
274 SKF_AD_OFF
+ SKF_AD_CPU
); }
276 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
277 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
279 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
280 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
285 set_curr_instr
(BPF_LD | BPF_IMM
, 0, 0, $2); }
290 set_curr_instr
(BPF_LD | BPF_IMM
, 0, 0, $3); }
292 set_curr_instr
(BPF_LD | BPF_W | BPF_LEN
, 0, 0, 0); }
294 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
295 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
297 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
298 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
300 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
301 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
303 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
304 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
305 | OP_LD K_NLATTR_NEST
{
306 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
307 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
309 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
310 SKF_AD_OFF
+ SKF_AD_MARK
); }
312 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
313 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
315 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
316 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
318 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
319 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
321 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
322 SKF_AD_OFF
+ SKF_AD_CPU
); }
324 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
325 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
327 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
328 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
329 | OP_LD
'M' '[' number
']' {
330 set_curr_instr
(BPF_LD | BPF_MEM
, 0, 0, $4); }
331 | OP_LD
'[' 'x' '+' number
']' {
332 set_curr_instr
(BPF_LD | BPF_W | BPF_IND
, 0, 0, $5); }
333 | OP_LD
'[' number
']' {
334 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0, $3); }
339 set_curr_instr
(BPF_LDX | BPF_IMM
, 0, 0, $2); }
343 : OP_LDX
'#' number
{
344 set_curr_instr
(BPF_LDX | BPF_IMM
, 0, 0, $3); }
345 | OP_LDX
'M' '[' number
']' {
346 set_curr_instr
(BPF_LDX | BPF_MEM
, 0, 0, $4); }
347 | OP_LDXB number
'*' '(' '[' number
']' '&' number
')' {
348 if
($2 != 4 ||
$9 != 0xf) {
349 panic
("ldxb offset not supported!\n");
351 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
352 | OP_LDX number
'*' '(' '[' number
']' '&' number
')' {
353 if
($2 != 4 ||
$9 != 0xf) {
354 panic
("ldxb offset not supported!\n");
356 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
360 : OP_ST
'M' '[' number
']' {
361 set_curr_instr
(BPF_ST
, 0, 0, $4); }
365 : OP_STX
'M' '[' number
']' {
366 set_curr_instr
(BPF_STX
, 0, 0, $4); }
371 set_jmp_label
($2, JKL
);
372 set_curr_instr
(BPF_JMP | BPF_JA
, 0, 0, 0); }
376 : OP_JEQ
'#' number
',' label
',' label
{
377 set_jmp_label
($5, JTL
);
378 set_jmp_label
($7, JFL
);
379 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
380 | OP_JEQ
'x' ',' label
',' label
{
381 set_jmp_label
($4, JTL
);
382 set_jmp_label
($6, JFL
);
383 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
384 | OP_JEQ
'#' number
',' label
{
385 set_jmp_label
($5, JTL
);
386 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
387 | OP_JEQ
'x' ',' label
{
388 set_jmp_label
($4, JTL
);
389 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
393 : OP_JNEQ
'#' number
',' label
{
394 set_jmp_label
($5, JFL
);
395 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
396 | OP_JNEQ
'x' ',' label
{
397 set_jmp_label
($4, JFL
);
398 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
402 : OP_JLT
'#' number
',' label
{
403 set_jmp_label
($5, JFL
);
404 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
405 | OP_JLT
'x' ',' label
{
406 set_jmp_label
($4, JFL
);
407 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
411 : OP_JLE
'#' number
',' label
{
412 set_jmp_label
($5, JFL
);
413 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
414 | OP_JLE
'x' ',' label
{
415 set_jmp_label
($4, JFL
);
416 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
420 : OP_JGT
'#' number
',' label
',' label
{
421 set_jmp_label
($5, JTL
);
422 set_jmp_label
($7, JFL
);
423 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
424 | OP_JGT
'x' ',' label
',' label
{
425 set_jmp_label
($4, JTL
);
426 set_jmp_label
($6, JFL
);
427 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
428 | OP_JGT
'#' number
',' label
{
429 set_jmp_label
($5, JTL
);
430 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
431 | OP_JGT
'x' ',' label
{
432 set_jmp_label
($4, JTL
);
433 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
437 : OP_JGE
'#' number
',' label
',' label
{
438 set_jmp_label
($5, JTL
);
439 set_jmp_label
($7, JFL
);
440 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
441 | OP_JGE
'x' ',' label
',' label
{
442 set_jmp_label
($4, JTL
);
443 set_jmp_label
($6, JFL
);
444 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
445 | OP_JGE
'#' number
',' label
{
446 set_jmp_label
($5, JTL
);
447 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
448 | OP_JGE
'x' ',' label
{
449 set_jmp_label
($4, JTL
);
450 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
454 : OP_JSET
'#' number
',' label
',' label
{
455 set_jmp_label
($5, JTL
);
456 set_jmp_label
($7, JFL
);
457 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_K
, 0, 0, $3); }
458 | OP_JSET
'x' ',' label
',' label
{
459 set_jmp_label
($4, JTL
);
460 set_jmp_label
($6, JFL
);
461 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_X
, 0, 0, 0); }
462 | OP_JSET
'#' number
',' label
{
463 set_jmp_label
($5, JTL
);
464 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_K
, 0, 0, $3); }
465 | OP_JSET
'x' ',' label
{
466 set_jmp_label
($4, JTL
);
467 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_X
, 0, 0, 0); }
471 : OP_ADD
'#' number
{
472 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_K
, 0, 0, $3); }
474 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_X
, 0, 0, 0); }
478 : OP_SUB
'#' number
{
479 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_K
, 0, 0, $3); }
481 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_X
, 0, 0, 0); }
485 : OP_MUL
'#' number
{
486 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_K
, 0, 0, $3); }
488 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_X
, 0, 0, 0); }
492 : OP_DIV
'#' number
{
493 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_K
, 0, 0, $3); }
495 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_X
, 0, 0, 0); }
499 : OP_MOD
'#' number
{
500 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_K
, 0, 0, $3); }
502 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_X
, 0, 0, 0); }
507 set_curr_instr
(BPF_ALU | BPF_NEG
, 0, 0, 0); }
511 : OP_AND
'#' number
{
512 set_curr_instr
(BPF_ALU | BPF_AND | BPF_K
, 0, 0, $3); }
514 set_curr_instr
(BPF_ALU | BPF_AND | BPF_X
, 0, 0, 0); }
519 set_curr_instr
(BPF_ALU | BPF_OR | BPF_K
, 0, 0, $3); }
521 set_curr_instr
(BPF_ALU | BPF_OR | BPF_X
, 0, 0, 0); }
525 : OP_XOR
'#' number
{
526 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_K
, 0, 0, $3); }
528 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_X
, 0, 0, 0); }
532 : OP_LSH
'#' number
{
533 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_K
, 0, 0, $3); }
535 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_X
, 0, 0, 0); }
539 : OP_RSH
'#' number
{
540 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_K
, 0, 0, $3); }
542 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_X
, 0, 0, 0); }
547 set_curr_instr
(BPF_RET | BPF_A
, 0, 0, 0); }
549 set_curr_instr
(BPF_RET | BPF_X
, 0, 0, 0); }
550 | OP_RET
'#' number
{
551 set_curr_instr
(BPF_RET | BPF_K
, 0, 0, $3); }
556 set_curr_instr
(BPF_MISC | BPF_TAX
, 0, 0, 0); }
561 set_curr_instr
(BPF_MISC | BPF_TXA
, 0, 0, 0); }
566 static void stage_1_inline
(void)
571 static void stage_2_label_reduce
(void)
573 int i
, max
= curr_instr
, off
;
575 /* 1. reduce k jumps */
576 for
(i
= 0; i
< max
; ++i
) {
577 if
(labels_k
[i
] != NULL
) {
578 off
= find_intr_offset_or_panic
(labels_k
[i
]);
579 out
[i
].k
= (uint32_t) (off
- i
- 1);
583 /* 1. reduce jt jumps */
584 for
(i
= 0; i
< max
; ++i
) {
585 if
(labels_jt
[i
] != NULL
) {
586 off
= find_intr_offset_or_panic
(labels_jt
[i
]);
587 out
[i
].jt
= (uint8_t) (off
- i
-1);
591 /* 1. reduce jf jumps */
592 for
(i
= 0; i
< max
; ++i
) {
593 if
(labels_jf
[i
] != NULL
) {
594 off
= find_intr_offset_or_panic
(labels_jf
[i
]);
595 out
[i
].jf
= (uint8_t) (off
- i
- 1);
600 int compile_filter
(char *file
, int verbose
, int bypass
)
603 struct sock_fprog res
;
605 if
(!strncmp
("-", file
, strlen
("-")))
608 yyin
= fopen
(file
, "r");
610 panic
("Cannot open file!\n");
612 memset
(out
, 0, sizeof
(out
));
613 memset
(labels
, 0, sizeof
(labels
));
614 memset
(labels_jf
, 0, sizeof
(labels_jf
));
615 memset
(labels_jt
, 0, sizeof
(labels_jt
));
616 memset
(labels_k
, 0, sizeof
(labels_k
));
619 stage_2_label_reduce
();
622 res.len
= curr_instr
;
625 printf
("Generated program:\n");
631 printf
("Validating: ");
635 if
(bpf_validate
(&res
) == 0) {
637 whine
("Semantic error! BPF validation "
640 panic
("Semantic error! BPF validation failed! "
641 "Try -V for debugging output!\n");
642 } else if
(verbose
) {
643 printf
("is runnable!\n");
649 for
(i
= 0; i
< res.len
; ++i
) {
650 printf
("{ 0x%x, %u, %u, 0x%08x },\n",
651 res.filter
[i
].code
, res.filter
[i
].jt
,
652 res.filter
[i
].jf
, res.filter
[i
].k
);
653 if
(labels
[i
] != NULL
)
655 if
(labels_jt
[i
] != NULL
)
657 if
(labels_jf
[i
] != NULL
)
659 if
(labels_k
[i
] != NULL
)
667 void yyerror(const char *err
)
669 panic
("Syntax error at line %d: %s! %s!\n",
670 yylineno
, yytext
, err
);