2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
20 #include "bpf_parser.tab.h"
24 #define MAX_INSTRUCTIONS 4096
26 int compile_filter
(char *file
, int verbose
, int bypass
);
28 static int curr_instr
= 0;
30 static struct sock_filter out
[MAX_INSTRUCTIONS
];
32 static char *labels
[MAX_INSTRUCTIONS
];
34 static char *labels_jt
[MAX_INSTRUCTIONS
];
35 static char *labels_jf
[MAX_INSTRUCTIONS
];
36 static char *labels_k
[MAX_INSTRUCTIONS
];
38 #define YYERROR_VERBOSE 0
40 #define YYENABLE_NLS 1
41 #define YYLTYPE_IS_TRIVIAL 1
45 extern
int yylex(void);
46 extern
void yyerror(const char *);
50 static inline
void set_curr_instr
(uint16_t code
, uint8_t jt
, uint8_t jf
, uint32_t k
)
52 if
(curr_instr
>= MAX_INSTRUCTIONS
)
53 panic
("Exceeded maximal number of instructions!\n");
55 out
[curr_instr
].code
= code
;
56 out
[curr_instr
].jt
= jt
;
57 out
[curr_instr
].jf
= jf
;
58 out
[curr_instr
].k
= k
;
63 static inline
void set_curr_label
(char *label
)
65 if
(curr_instr
>= MAX_INSTRUCTIONS
)
66 panic
("Exceeded maximal number of instructions!\n");
68 labels
[curr_instr
] = label
;
75 static inline
void set_jmp_label
(char *label
, int which
)
77 if
(curr_instr
>= MAX_INSTRUCTIONS
)
78 panic
("Exceeded maximal number of instructions!\n");
80 bug_on
(which
!= JTL
&& which
!= JFL
&& which
!= JKL
);
83 labels_jt
[curr_instr
] = label
;
84 else if
(which
== JFL
)
85 labels_jf
[curr_instr
] = label
;
87 labels_k
[curr_instr
] = label
;
90 static int find_intr_offset_or_panic
(char *label_to_search
)
92 int i
, max
= curr_instr
, ret
= -ENOENT
;
94 bug_on
(!label_to_search
);
96 for
(i
= 0; i
< max
; ++i
) {
97 if
(labels
[i
] != NULL
) {
98 /* Both are \0-terminated! */
99 if
(!strcmp
(label_to_search
, labels
[i
])) {
107 panic
("No such label!\n");
119 %token OP_LDB OP_LDH OP_LD OP_LDX OP_ST OP_STX OP_JMP OP_JEQ OP_JGT OP_JGE
120 %token OP_JSET OP_ADD OP_SUB OP_MUL OP_DIV OP_AND OP_OR OP_XOR OP_LSH OP_RSH
121 %token OP_RET OP_TAX OP_TXA OP_LDXB OP_MOD OP_NEG K_PKT_LEN K_PROTO K_TYPE
122 %token K_NLATTR K_NLATTR_NEST K_MARK K_QUEUE K_HATYPE K_RXHASH K_CPU K_IFIDX
124 %token
':' ',' '[' ']' '(' ')' 'x' 'a' '+' 'M' '*' '&' '#'
126 %token number_hex number_dec number_oct number_bin label
128 %type
<number
> number_hex number_dec number_oct number_bin number
176 : number_dec
{ $$
= $1; }
177 | number_hex
{ $$
= $1; }
178 | number_oct
{ $$
= $1; }
179 | number_bin
{ $$
= $1; }
183 : label
':' { set_curr_label
($1); }
187 : OP_LDB
'[' 'x' '+' number
']' {
188 set_curr_instr
(BPF_LD | BPF_B | BPF_IND
, 0, 0, $5); }
189 | OP_LDB
'[' number
']' {
190 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0, $3); }
191 | OP_LDB
'#' K_PROTO
{
192 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
193 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
194 | OP_LDB
'#' K_TYPE
{
195 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
196 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
197 | OP_LDB
'#' K_IFIDX
{
198 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
199 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
200 | OP_LDB
'#' K_NLATTR
{
201 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
202 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
203 | OP_LDB
'#' K_NLATTR_NEST
{
204 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
205 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
206 | OP_LDB
'#' K_MARK
{
207 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
208 SKF_AD_OFF
+ SKF_AD_MARK
); }
209 | OP_LDB
'#' K_QUEUE
{
210 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
211 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
212 | OP_LDB
'#' K_HATYPE
{
213 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
214 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
215 | OP_LDB
'#' K_RXHASH
{
216 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
217 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
219 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
220 SKF_AD_OFF
+ SKF_AD_CPU
); }
224 : OP_LDH
'[' 'x' '+' number
']' {
225 set_curr_instr
(BPF_LD | BPF_H | BPF_IND
, 0, 0, $5); }
226 | OP_LDH
'[' number
']' {
227 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0, $3); }
228 | OP_LDH
'#' K_PROTO
{
229 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
230 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
231 | OP_LDH
'#' K_TYPE
{
232 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
233 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
234 | OP_LDH
'#' K_IFIDX
{
235 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
236 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
237 | OP_LDH
'#' K_NLATTR
{
238 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
239 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
240 | OP_LDH
'#' K_NLATTR_NEST
{
241 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
242 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
243 | OP_LDH
'#' K_MARK
{
244 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
245 SKF_AD_OFF
+ SKF_AD_MARK
); }
246 | OP_LDH
'#' K_QUEUE
{
247 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
248 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
249 | OP_LDH
'#' K_HATYPE
{
250 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
251 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
252 | OP_LDH
'#' K_RXHASH
{
253 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
254 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
256 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
257 SKF_AD_OFF
+ SKF_AD_CPU
); }
262 set_curr_instr
(BPF_LD | BPF_IMM
, 0, 0, $3); }
263 | OP_LD
'#' K_PKT_LEN
{
264 set_curr_instr
(BPF_LD | BPF_W | BPF_LEN
, 0, 0, 0); }
265 | OP_LD
'#' K_PROTO
{
266 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
267 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
269 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
270 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
271 | OP_LD
'#' K_IFIDX
{
272 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
273 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
274 | OP_LD
'#' K_NLATTR
{
275 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
276 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
277 | OP_LD
'#' K_NLATTR_NEST
{
278 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
279 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
281 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
282 SKF_AD_OFF
+ SKF_AD_MARK
); }
283 | OP_LD
'#' K_QUEUE
{
284 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
285 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
286 | OP_LD
'#' K_HATYPE
{
287 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
288 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
289 | OP_LD
'#' K_RXHASH
{
290 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
291 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
293 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
294 SKF_AD_OFF
+ SKF_AD_CPU
); }
295 | OP_LD
'M' '[' number
']' {
296 set_curr_instr
(BPF_LD | BPF_MEM
, 0, 0, $4); }
297 | OP_LD
'[' 'x' '+' number
']' {
298 set_curr_instr
(BPF_LD | BPF_W | BPF_IND
, 0, 0, $5); }
299 | OP_LD
'[' number
']' {
300 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0, $3); }
304 : OP_LDX
'#' number
{
305 set_curr_instr
(BPF_LDX | BPF_IMM
, 0, 0, $3); }
306 | OP_LDX
'M' '[' number
']' {
307 set_curr_instr
(BPF_LDX | BPF_MEM
, 0, 0, $4); }
308 | OP_LDXB number
'*' '(' '[' number
']' '&' number
')' {
309 if
($2 != 4 ||
$9 != 0xf) {
310 panic
("ldxb offset not supported!\n");
312 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
313 | OP_LDX number
'*' '(' '[' number
']' '&' number
')' {
314 if
($2 != 4 ||
$9 != 0xf) {
315 panic
("ldxb offset not supported!\n");
317 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
321 : OP_ST
'M' '[' number
']' {
322 set_curr_instr
(BPF_ST
, 0, 0, $4); }
326 : OP_STX
'M' '[' number
']' {
327 set_curr_instr
(BPF_STX
, 0, 0, $4); }
332 set_jmp_label
($2, JKL
);
333 set_curr_instr
(BPF_JMP | BPF_JA
, 0, 0, 0); }
337 : OP_JEQ
'#' number
',' label
',' label
{
338 set_jmp_label
($5, JTL
);
339 set_jmp_label
($7, JFL
);
340 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
341 | OP_JEQ
'x' ',' label
',' label
{
342 set_jmp_label
($4, JTL
);
343 set_jmp_label
($6, JFL
);
344 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
348 : OP_JGT
'#' number
',' label
',' label
{
349 set_jmp_label
($5, JTL
);
350 set_jmp_label
($7, JFL
);
351 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
352 | OP_JGT
'x' ',' label
',' label
{
353 set_jmp_label
($4, JTL
);
354 set_jmp_label
($6, JFL
);
355 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
359 : OP_JGE
'#' number
',' label
',' label
{
360 set_jmp_label
($5, JTL
);
361 set_jmp_label
($7, JFL
);
362 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
363 | OP_JGE
'x' ',' label
',' label
{
364 set_jmp_label
($4, JTL
);
365 set_jmp_label
($6, JFL
);
366 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
370 : OP_JSET
'#' number
',' label
',' label
{
371 set_jmp_label
($5, JTL
);
372 set_jmp_label
($7, JFL
);
373 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_K
, 0, 0, $3); }
374 | OP_JSET
'x' ',' label
',' label
{
375 set_jmp_label
($4, JTL
);
376 set_jmp_label
($6, JFL
);
377 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_X
, 0, 0, 0); }
381 : OP_ADD
'#' number
{
382 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_K
, 0, 0, $3); }
384 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_X
, 0, 0, 0); }
388 : OP_SUB
'#' number
{
389 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_K
, 0, 0, $3); }
391 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_X
, 0, 0, 0); }
395 : OP_MUL
'#' number
{
396 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_K
, 0, 0, $3); }
398 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_X
, 0, 0, 0); }
402 : OP_DIV
'#' number
{
403 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_K
, 0, 0, $3); }
405 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_X
, 0, 0, 0); }
409 : OP_MOD
'#' number
{
410 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_K
, 0, 0, $3); }
412 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_X
, 0, 0, 0); }
417 set_curr_instr
(BPF_ALU | BPF_NEG
, 0, 0, 0); }
421 : OP_AND
'#' number
{
422 set_curr_instr
(BPF_ALU | BPF_AND | BPF_K
, 0, 0, $3); }
424 set_curr_instr
(BPF_ALU | BPF_AND | BPF_X
, 0, 0, 0); }
429 set_curr_instr
(BPF_ALU | BPF_OR | BPF_K
, 0, 0, $3); }
431 set_curr_instr
(BPF_ALU | BPF_OR | BPF_X
, 0, 0, 0); }
435 : OP_XOR
'#' number
{
436 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_K
, 0, 0, $3); }
438 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_X
, 0, 0, 0); }
442 : OP_LSH
'#' number
{
443 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_K
, 0, 0, $3); }
445 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_X
, 0, 0, 0); }
449 : OP_RSH
'#' number
{
450 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_K
, 0, 0, $3); }
452 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_X
, 0, 0, 0); }
457 set_curr_instr
(BPF_RET | BPF_A
, 0, 0, 0); }
458 | OP_RET
'#' number
{
459 set_curr_instr
(BPF_RET | BPF_K
, 0, 0, $3); }
464 set_curr_instr
(BPF_MISC | BPF_TAX
, 0, 0, 0); }
469 set_curr_instr
(BPF_MISC | BPF_TXA
, 0, 0, 0); }
474 static void stage_1_inline
(void)
479 static void stage_2_label_reduce
(void)
481 int i
, max
= curr_instr
, off
;
483 /* 1. reduce k jumps */
484 for
(i
= 0; i
< max
; ++i
) {
485 if
(labels_k
[i
] != NULL
) {
486 off
= find_intr_offset_or_panic
(labels_k
[i
]);
487 out
[i
].k
= (uint32_t) (off
- i
- 1);
491 /* 1. reduce jt jumps */
492 for
(i
= 0; i
< max
; ++i
) {
493 if
(labels_jt
[i
] != NULL
) {
494 off
= find_intr_offset_or_panic
(labels_jt
[i
]);
495 out
[i
].jt
= (uint8_t) (off
- i
-1);
499 /* 1. reduce jf jumps */
500 for
(i
= 0; i
< max
; ++i
) {
501 if
(labels_jf
[i
] != NULL
) {
502 off
= find_intr_offset_or_panic
(labels_jf
[i
]);
503 out
[i
].jf
= (uint8_t) (off
- i
- 1);
508 int compile_filter
(char *file
, int verbose
, int bypass
)
511 struct sock_fprog res
;
513 if
(!strncmp
("-", file
, strlen
("-")))
516 yyin
= fopen
(file
, "r");
518 panic
("Cannot open file!\n");
520 memset
(out
, 0, sizeof
(out
));
521 memset
(labels
, 0, sizeof
(labels
));
522 memset
(labels_jf
, 0, sizeof
(labels_jf
));
523 memset
(labels_jt
, 0, sizeof
(labels_jt
));
524 memset
(labels_k
, 0, sizeof
(labels_k
));
527 stage_2_label_reduce
();
530 res.len
= curr_instr
;
533 printf
("Generated program:\n");
539 printf
("Validating: ");
543 if
(bpf_validate
(&res
) == 0) {
545 whine
("Semantic error! BPF validation "
548 panic
("Semantic error! BPF validation failed! "
549 "Try -V for debugging output!\n");
550 } else if
(verbose
) {
551 printf
("is runnable!\n");
557 for
(i
= 0; i
< res.len
; ++i
) {
558 printf
("{ 0x%x, %u, %u, 0x%08x },\n",
559 res.filter
[i
].code
, res.filter
[i
].jt
,
560 res.filter
[i
].jf
, res.filter
[i
].k
);
561 if
(labels
[i
] != NULL
)
563 if
(labels_jt
[i
] != NULL
)
565 if
(labels_jf
[i
] != NULL
)
567 if
(labels_k
[i
] != NULL
)
575 void yyerror(const char *err
)
577 panic
("Syntax error at line %d: %s! %s!\n",
578 yylineno
, yytext
, err
);