bpf.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2009 - 2012 Daniel Borkmann.
   4  * Copyright 2009, 2010 Emmanuel Roullit.
   5  * Copyright 1990-1996 The Regents of the University of
   6  * California. All rights reserved. (3-clause BSD license)
   7  * Subject to the GPL, version 2.
   8  */
   9
  10 #include <stdint.h>
  11 #include <stdio.h>
  12 #include <arpa/inet.h>
  13 #include <sys/types.h>
  14 #include <sys/stat.h>
  15 #include <fcntl.h>
  16
  17 #include "bpf.h"
  18 #include "xmalloc.h"
  19 #include "xutils.h"
  20 #include "die.h"
  21
  22 #define EXTRACT_SHORT(packet)                                           \
  23                 ((unsigned short) ntohs(*(unsigned short *) packet))
  24 #define EXTRACT_LONG(packet)                                            \
  25                 (ntohl(*(unsigned long *) packet))
  26
  27 #ifndef BPF_MEMWORDS
  28 # define BPF_MEMWORDS   16
  29 #endif
  30
  31 #define BPF_LD_B        (BPF_LD   |    BPF_B)
  32 #define BPF_LD_H        (BPF_LD   |    BPF_H)
  33 #define BPF_LD_W        (BPF_LD   |    BPF_W)
  34 #define BPF_LDX_B       (BPF_LDX  |    BPF_B)
  35 #define BPF_LDX_W       (BPF_LDX  |    BPF_W)
  36 #define BPF_JMP_JA      (BPF_JMP  |   BPF_JA)
  37 #define BPF_JMP_JEQ     (BPF_JMP  |  BPF_JEQ)
  38 #define BPF_JMP_JGT     (BPF_JMP  |  BPF_JGT)
  39 #define BPF_JMP_JGE     (BPF_JMP  |  BPF_JGE)
  40 #define BPF_JMP_JSET    (BPF_JMP  | BPF_JSET)
  41 #define BPF_ALU_ADD     (BPF_ALU  |  BPF_ADD)
  42 #define BPF_ALU_SUB     (BPF_ALU  |  BPF_SUB)
  43 #define BPF_ALU_MUL     (BPF_ALU  |  BPF_MUL)
  44 #define BPF_ALU_DIV     (BPF_ALU  |  BPF_DIV)
  45 #define BPF_ALU_MOD     (BPF_ALU  |  BPF_MOD)
  46 #define BPF_ALU_NEG     (BPF_ALU  |  BPF_NEG)
  47 #define BPF_ALU_AND     (BPF_ALU  |  BPF_AND)
  48 #define BPF_ALU_OR      (BPF_ALU  |   BPF_OR)
  49 #define BPF_ALU_XOR     (BPF_ALU  |  BPF_XOR)
  50 #define BPF_ALU_LSH     (BPF_ALU  |  BPF_LSH)
  51 #define BPF_ALU_RSH     (BPF_ALU  |  BPF_RSH)
  52 #define BPF_MISC_TAX    (BPF_MISC |  BPF_TAX)
  53 #define BPF_MISC_TXA    (BPF_MISC |  BPF_TXA)
  54
  55 static const char *op_table[] = {
  56         [BPF_LD_B]      =       "ldb",
  57         [BPF_LD_H]      =       "ldh",
  58         [BPF_LD_W]      =       "ld",
  59         [BPF_LDX]       =       "ldx",
  60         [BPF_LDX_B]     =       "ldxb",
  61         [BPF_ST]        =       "st",
  62         [BPF_STX]       =       "stx",
  63         [BPF_JMP_JA]    =       "ja",
  64         [BPF_JMP_JEQ]   =       "jeq",
  65         [BPF_JMP_JGT]   =       "jgt",
  66         [BPF_JMP_JGE]   =       "jge",
  67         [BPF_JMP_JSET]  =       "jset",
  68         [BPF_ALU_ADD]   =       "add",
  69         [BPF_ALU_SUB]   =       "sub",
  70         [BPF_ALU_MUL]   =       "mul",
  71         [BPF_ALU_DIV]   =       "div",
  72         [BPF_ALU_MOD]   =       "mod",
  73         [BPF_ALU_NEG]   =       "neg",
  74         [BPF_ALU_AND]   =       "and",
  75         [BPF_ALU_OR]    =       "or",
  76         [BPF_ALU_XOR]   =       "xor",
  77         [BPF_ALU_LSH]   =       "lsh",
  78         [BPF_ALU_RSH]   =       "rsh",
  79         [BPF_RET]       =       "ret",
  80         [BPF_MISC_TAX]  =       "tax",
  81         [BPF_MISC_TXA]  =       "txa",
  82 };
  83
  84 void bpf_dump_op_table(void)
  85 {
  86         int i;
  87         for (i = 0; i < array_size(op_table); ++i) {
  88                 if (op_table[i])
  89                         printf("%s\n", op_table[i]);
  90         }
  91 }
  92
  93 static const char *bpf_dump_linux_k(uint32_t k)
  94 {
  95         switch (k) {
  96         default:
  97                 return "[%d]";
  98         case SKF_AD_OFF + SKF_AD_PROTOCOL:
  99                 return "#proto";
 100         case SKF_AD_OFF + SKF_AD_PKTTYPE:
 101                 return "#type";
 102         case SKF_AD_OFF + SKF_AD_IFINDEX:
 103                 return "#ifidx";
 104         case SKF_AD_OFF + SKF_AD_NLATTR:
 105                 return "#nla";
 106         case SKF_AD_OFF + SKF_AD_NLATTR_NEST:
 107                 return "#nlan";
 108         case SKF_AD_OFF + SKF_AD_MARK:
 109                 return "#mark";
 110         case SKF_AD_OFF + SKF_AD_QUEUE:
 111                 return "#queue";
 112         case SKF_AD_OFF + SKF_AD_HATYPE:
 113                 return "#hatype";
 114         case SKF_AD_OFF + SKF_AD_RXHASH:
 115                 return "#rxhash";
 116         case SKF_AD_OFF + SKF_AD_CPU:
 117                 return "#cpu";
 118         case SKF_AD_OFF + SKF_AD_VLAN_TAG:
 119                 return "#vlant";
 120         case SKF_AD_OFF + SKF_AD_VLAN_TAG_PRESENT:
 121                 return "#vlanp";
 122         }
 123 }
 124
 125 static char *__bpf_dump(const struct sock_filter bpf, int n)
 126 {
 127         int v;
 128         const char *fmt, *op;
 129         static char image[256];
 130         char operand[64];
 131
 132         v = bpf.k;
 133         switch (bpf.code) {
 134         default:
 135                 op = "unimp";
 136                 fmt = "0x%x";
 137                 v = bpf.code;
 138                 break;
 139         case BPF_RET | BPF_K:
 140                 op = op_table[BPF_RET];
 141                 fmt = "#0x%x";
 142                 break;
 143         case BPF_RET | BPF_A:
 144                 op = op_table[BPF_RET];
 145                 fmt = "a";
 146                 break;
 147         case BPF_RET | BPF_X:
 148                 op = op_table[BPF_RET];
 149                 fmt = "x";
 150                 break;
 151         case BPF_LD_W | BPF_ABS:
 152                 op = op_table[BPF_LD_W];
 153                 fmt = bpf_dump_linux_k(bpf.k);
 154                 break;
 155         case BPF_LD_H | BPF_ABS:
 156                 op = op_table[BPF_LD_H];
 157                 fmt = bpf_dump_linux_k(bpf.k);
 158                 break;
 159         case BPF_LD_B | BPF_ABS:
 160                 op = op_table[BPF_LD_B];
 161                 fmt = bpf_dump_linux_k(bpf.k);
 162                 break;
 163         case BPF_LD_W | BPF_LEN:
 164                 op = op_table[BPF_LD_W];
 165                 fmt = "#len";
 166                 break;
 167         case BPF_LD_W | BPF_IND:
 168                 op = op_table[BPF_LD_W];
 169                 fmt = "[x + %d]";
 170                 break;
 171         case BPF_LD_H | BPF_IND:
 172                 op = op_table[BPF_LD_H];
 173                 fmt = "[x + %d]";
 174                 break;
 175         case BPF_LD_B | BPF_IND:
 176                 op = op_table[BPF_LD_B];
 177                 fmt = "[x + %d]";
 178                 break;
 179         case BPF_LD | BPF_IMM:
 180                 op = op_table[BPF_LD_W];
 181                 fmt = "#0x%x";
 182                 break;
 183         case BPF_LDX | BPF_IMM:
 184                 op = op_table[BPF_LDX];
 185                 fmt = "#0x%x";
 186                 break;
 187         case BPF_LDX_B | BPF_MSH:
 188                 op = op_table[BPF_LDX_B];
 189                 fmt = "4*([%d]&0xf)";
 190                 break;
 191         case BPF_LD | BPF_MEM:
 192                 op = op_table[BPF_LD_W];
 193                 fmt = "M[%d]";
 194                 break;
 195         case BPF_LDX | BPF_MEM:
 196                 op = op_table[BPF_LDX];
 197                 fmt = "M[%d]";
 198                 break;
 199         case BPF_ST:
 200                 op = op_table[BPF_ST];
 201                 fmt = "M[%d]";
 202                 break;
 203         case BPF_STX:
 204                 op = op_table[BPF_STX];
 205                 fmt = "M[%d]";
 206                 break;
 207         case BPF_JMP_JA:
 208                 op = op_table[BPF_JMP_JA];
 209                 fmt = "%d";
 210                 v = n + 1 + bpf.k;
 211                 break;
 212         case BPF_JMP_JGT | BPF_K:
 213                 op = op_table[BPF_JMP_JGT];
 214                 fmt = "#0x%x";
 215                 break;
 216         case BPF_JMP_JGE | BPF_K:
 217                 op = op_table[BPF_JMP_JGE];
 218                 fmt = "#0x%x";
 219                 break;
 220         case BPF_JMP_JEQ | BPF_K:
 221                 op = op_table[BPF_JMP_JEQ];
 222                 fmt = "#0x%x";
 223                 break;
 224         case BPF_JMP_JSET | BPF_K:
 225                 op = op_table[BPF_JMP_JSET];
 226                 fmt = "#0x%x";
 227                 break;
 228         case BPF_JMP_JGT | BPF_X:
 229                 op = op_table[BPF_JMP_JGT];
 230                 fmt = "x";
 231                 break;
 232         case BPF_JMP_JGE | BPF_X:
 233                 op = op_table[BPF_JMP_JGE];
 234                 fmt = "x";
 235                 break;
 236         case BPF_JMP_JEQ | BPF_X:
 237                 op = op_table[BPF_JMP_JEQ];
 238                 fmt = "x";
 239                 break;
 240         case BPF_JMP_JSET | BPF_X:
 241                 op = op_table[BPF_JMP_JSET];
 242                 fmt = "x";
 243                 break;
 244         case BPF_ALU_ADD | BPF_X:
 245                 op = op_table[BPF_ALU_ADD];
 246                 fmt = "x";
 247                 break;
 248         case BPF_ALU_SUB | BPF_X:
 249                 op = op_table[BPF_ALU_SUB];
 250                 fmt = "x";
 251                 break;
 252         case BPF_ALU_MUL | BPF_X:
 253                 op = op_table[BPF_ALU_MUL];
 254                 fmt = "x";
 255                 break;
 256         case BPF_ALU_DIV | BPF_X:
 257                 op = op_table[BPF_ALU_DIV];
 258                 fmt = "x";
 259                 break;
 260         case BPF_ALU_MOD | BPF_X:
 261                 op = op_table[BPF_ALU_MOD];
 262                 fmt = "x";
 263                 break;
 264         case BPF_ALU_AND | BPF_X:
 265                 op = op_table[BPF_ALU_AND];
 266                 fmt = "x";
 267                 break;
 268         case BPF_ALU_OR | BPF_X:
 269                 op = op_table[BPF_ALU_OR];
 270                 fmt = "x";
 271                 break;
 272         case BPF_ALU_XOR | BPF_X:
 273                 op = op_table[BPF_ALU_XOR];
 274                 fmt = "x";
 275                 break;
 276         case BPF_ALU_LSH | BPF_X:
 277                 op = op_table[BPF_ALU_LSH];
 278                 fmt = "x";
 279                 break;
 280         case BPF_ALU_RSH | BPF_X:
 281                 op = op_table[BPF_ALU_RSH];
 282                 fmt = "x";
 283                 break;
 284         case BPF_ALU_ADD | BPF_K:
 285                 op = op_table[BPF_ALU_ADD];
 286                 fmt = "#%d";
 287                 break;
 288         case BPF_ALU_SUB | BPF_K:
 289                 op = op_table[BPF_ALU_SUB];
 290                 fmt = "#%d";
 291                 break;
 292         case BPF_ALU_MUL | BPF_K:
 293                 op = op_table[BPF_ALU_MUL];
 294                 fmt = "#%d";
 295                 break;
 296         case BPF_ALU_DIV | BPF_K:
 297                 op = op_table[BPF_ALU_DIV];
 298                 fmt = "#%d";
 299                 break;
 300         case BPF_ALU_MOD | BPF_K:
 301                 op = op_table[BPF_ALU_MOD];
 302                 fmt = "#%d";
 303                 break;
 304         case BPF_ALU_AND | BPF_K:
 305                 op = op_table[BPF_ALU_AND];
 306                 fmt = "#0x%x";
 307                 break;
 308         case BPF_ALU_OR | BPF_K:
 309                 op = op_table[BPF_ALU_OR];
 310                 fmt = "#0x%x";
 311                 break;
 312         case BPF_ALU_XOR | BPF_K:
 313                 op = op_table[BPF_ALU_XOR];
 314                 fmt = "#0x%x";
 315                 break;
 316         case BPF_ALU_LSH | BPF_K:
 317                 op = op_table[BPF_ALU_LSH];
 318                 fmt = "#%d";
 319                 break;
 320         case BPF_ALU_RSH | BPF_K:
 321                 op = op_table[BPF_ALU_RSH];
 322                 fmt = "#%d";
 323                 break;
 324         case BPF_ALU_NEG:
 325                 op = op_table[BPF_ALU_NEG];
 326                 fmt = "";
 327                 break;
 328         case BPF_MISC_TAX:
 329                 op = op_table[BPF_MISC_TAX];
 330                 fmt = "";
 331                 break;
 332         case BPF_MISC_TXA:
 333                 op = op_table[BPF_MISC_TXA];
 334                 fmt = "";
 335                 break;
 336         }
 337
 338         slprintf_nocheck(operand, sizeof(operand), fmt, v);
 339         slprintf_nocheck(image, sizeof(image),
 340                          (BPF_CLASS(bpf.code) == BPF_JMP &&
 341                           BPF_OP(bpf.code) != BPF_JA) ?
 342                          " L%d: %s %s, L%d, L%d" : " L%d: %s %s",
 343                          n, op, operand, n + 1 + bpf.jt, n + 1 + bpf.jf);
 344         return image;
 345 }
 346
 347 void bpf_dump_all(struct sock_fprog *bpf)
 348 {
 349         int i;
 350         for (i = 0; i < bpf->len; ++i)
 351                 printf("%s\n", __bpf_dump(bpf->filter[i], i));
 352 }
 353
 354 void bpf_attach_to_sock(int sock, struct sock_fprog *bpf)
 355 {
 356         int ret;
 357
 358         if (bpf->filter[0].code == BPF_RET &&
 359             bpf->filter[0].k == 0xFFFFFFFF)
 360                 return;
 361
 362         ret = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER,
 363                          bpf, sizeof(*bpf));
 364         if (ret < 0)
 365                 panic("Cannot attach filter to socket!\n");
 366 }
 367
 368 void bpf_detach_from_sock(int sock)
 369 {
 370         int ret, empty = 0;
 371
 372         ret = setsockopt(sock, SOL_SOCKET, SO_DETACH_FILTER,
 373                          &empty, sizeof(empty));
 374         if (ret < 0)
 375                 panic("Cannot detach filter from socket!\n");
 376 }
 377
 378 int enable_kernel_bpf_jit_compiler(void)
 379 {
 380         int fd;
 381         ssize_t ret;
 382         char *file = "/proc/sys/net/core/bpf_jit_enable";
 383
 384         fd = open(file, O_WRONLY);
 385         if (fd < 0)
 386                 return -1;
 387
 388         ret = write(fd, "1", strlen("1"));
 389
 390         close(fd);
 391         return ret;
 392 }
 393
 394 int __bpf_validate(const struct sock_fprog *bpf)
 395 {
 396         uint32_t i, from;
 397         const struct sock_filter *p;
 398
 399         if (!bpf)
 400                 return 0;
 401         if (bpf->len < 1)
 402                 return 0;
 403
 404         for (i = 0; i < bpf->len; ++i) {
 405                 p = &bpf->filter[i];
 406                 switch (BPF_CLASS(p->code)) {
 407                         /* Check that memory operations use valid addresses. */
 408                 case BPF_LD:
 409                 case BPF_LDX:
 410                         switch (BPF_MODE(p->code)) {
 411                         case BPF_IMM:
 412                                 break;
 413                         case BPF_ABS:
 414                         case BPF_IND:
 415                         case BPF_MSH:
 416                                 /* There's no maximum packet data size
 417                                  * in userland.  The runtime packet length
 418                                  * check suffices.
 419                                  */
 420                                 break;
 421                         case BPF_MEM:
 422                                 if (p->k >= BPF_MEMWORDS)
 423                                         return 0;
 424                                 break;
 425                         case BPF_LEN:
 426                                 break;
 427                         default:
 428                                 return 0;
 429                         }
 430                         break;
 431                 case BPF_ST:
 432                 case BPF_STX:
 433                         if (p->k >= BPF_MEMWORDS)
 434                                 return 0;
 435                         break;
 436                 case BPF_ALU:
 437                         switch (BPF_OP(p->code)) {
 438                         case BPF_ADD:
 439                         case BPF_SUB:
 440                         case BPF_MUL:
 441                         case BPF_OR:
 442                         case BPF_XOR:
 443                         case BPF_AND:
 444                         case BPF_LSH:
 445                         case BPF_RSH:
 446                         case BPF_NEG:
 447                                 break;
 448                         case BPF_DIV:
 449                         case BPF_MOD:
 450                                 /* Check for constant division by 0 (undefined
 451                                  * for div and mod).
 452                                  */
 453                                 if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
 454                                         return 0;
 455                                 break;
 456                         default:
 457                                 return 0;
 458                         }
 459                         break;
 460                 case BPF_JMP:
 461                         /* Check that jumps are within the code block,
 462                          * and that unconditional branches don't go
 463                          * backwards as a result of an overflow.
 464                          * Unconditional branches have a 32-bit offset,
 465                          * so they could overflow; we check to make
 466                          * sure they don't.  Conditional branches have
 467                          * an 8-bit offset, and the from address is <=
 468                          * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
 469                          * is sufficiently small that adding 255 to it
 470                          * won't overflow.
 471                          *
 472                          * We know that len is <= BPF_MAXINSNS, and we
 473                          * assume that BPF_MAXINSNS is < the maximum size
 474                          * of a u_int, so that i + 1 doesn't overflow.
 475                          *
 476                          * For userland, we don't know that the from
 477                          * or len are <= BPF_MAXINSNS, but we know that
 478                          * from <= len, and, except on a 64-bit system,
 479                          * it's unlikely that len, if it truly reflects
 480                          * the size of the program we've been handed,
 481                          * will be anywhere near the maximum size of
 482                          * a u_int.  We also don't check for backward
 483                          * branches, as we currently support them in
 484                          * userland for the protochain operation.
 485                          */
 486                         from = i + 1;
 487                         switch (BPF_OP(p->code)) {
 488                         case BPF_JA:
 489                                 if (from + p->k >= bpf->len)
 490                                         return 0;
 491                                 break;
 492                         case BPF_JEQ:
 493                         case BPF_JGT:
 494                         case BPF_JGE:
 495                         case BPF_JSET:
 496                                 if (from + p->jt >= bpf->len ||
 497                                     from + p->jf >= bpf->len)
 498                                         return 0;
 499                                 break;
 500                         default:
 501                                 return 0;
 502                         }
 503                         break;
 504                 case BPF_RET:
 505                         break;
 506                 case BPF_MISC:
 507                         break;
 508                 default:
 509                         return 0;
 510                 }
 511         }
 512
 513         return BPF_CLASS(bpf->filter[bpf->len - 1].code) == BPF_RET;
 514 }
 515
 516 uint32_t bpf_run_filter(const struct sock_fprog * fcode, uint8_t * packet,
 517                         size_t plen)
 518 {
 519         /* XXX: caplen == len */
 520         uint32_t A, X;
 521         uint32_t k;
 522         struct sock_filter *bpf;
 523         int32_t mem[BPF_MEMWORDS] = { 0, };
 524
 525         if (fcode == NULL || fcode->filter == NULL || fcode->len == 0)
 526                 return 0xFFFFFFFF;
 527
 528         A = 0;
 529         X = 0;
 530
 531         bpf = fcode->filter;
 532         --bpf;
 533         while (1) {
 534                 ++bpf;
 535                 switch (bpf->code) {
 536                 default:
 537                         return 0;
 538                 case BPF_RET | BPF_K:
 539                         return (uint32_t) bpf->k;
 540                 case BPF_RET | BPF_A:
 541                         return (uint32_t) A;
 542                 case BPF_LD_W | BPF_ABS:
 543                         /* No Linux extensions supported here! */
 544                         k = bpf->k;
 545                         if (k + sizeof(int32_t) > plen)
 546                                 return 0;
 547                         A = EXTRACT_LONG(&packet[k]);
 548                         continue;
 549                 case BPF_LD_H | BPF_ABS:
 550                         /* No Linux extensions supported here! */
 551                         k = bpf->k;
 552                         if (k + sizeof(short) > plen)
 553                                 return 0;
 554                         A = EXTRACT_SHORT(&packet[k]);
 555                         continue;
 556                 case BPF_LD_B | BPF_ABS:
 557                         /* No Linux extensions supported here! */
 558                         k = bpf->k;
 559                         if (k >= plen)
 560                                 return 0;
 561                         A = packet[k];
 562                         continue;
 563                 case BPF_LD_W | BPF_LEN:
 564                         A = plen;
 565                         continue;
 566                 case BPF_LDX_W | BPF_LEN:
 567                         X = plen;
 568                         continue;
 569                 case BPF_LD_W | BPF_IND:
 570                         k = X + bpf->k;
 571                         if (k + sizeof(int32_t) > plen)
 572                                 return 0;
 573                         A = EXTRACT_LONG(&packet[k]);
 574                         continue;
 575                 case BPF_LD_H | BPF_IND:
 576                         k = X + bpf->k;
 577                         if (k + sizeof(short) > plen)
 578                                 return 0;
 579                         A = EXTRACT_SHORT(&packet[k]);
 580                         continue;
 581                 case BPF_LD_B | BPF_IND:
 582                         k = X + bpf->k;
 583                         if (k >= plen)
 584                                 return 0;
 585                         A = packet[k];
 586                         continue;
 587                 case BPF_LDX_B | BPF_MSH:
 588                         k = bpf->k;
 589                         if (k >= plen)
 590                                 return 0;
 591                         X = (packet[bpf->k] & 0xf) << 2;
 592                         continue;
 593                 case BPF_LD | BPF_IMM:
 594                         A = bpf->k;
 595                         continue;
 596                 case BPF_LDX | BPF_IMM:
 597                         X = bpf->k;
 598                         continue;
 599                 case BPF_LD | BPF_MEM:
 600                         A = mem[bpf->k];
 601                         continue;
 602                 case BPF_LDX | BPF_MEM:
 603                         X = mem[bpf->k];
 604                         continue;
 605                 case BPF_ST:
 606                         mem[bpf->k] = A;
 607                         continue;
 608                 case BPF_STX:
 609                         mem[bpf->k] = X;
 610                         continue;
 611                 case BPF_JMP_JA:
 612                         bpf += bpf->k;
 613                         continue;
 614                 case BPF_JMP_JGT | BPF_K:
 615                         bpf += (A > bpf->k) ? bpf->jt : bpf->jf;
 616                         continue;
 617                 case BPF_JMP_JGE | BPF_K:
 618                         bpf += (A >= bpf->k) ? bpf->jt : bpf->jf;
 619                         continue;
 620                 case BPF_JMP_JEQ | BPF_K:
 621                         bpf += (A == bpf->k) ? bpf->jt : bpf->jf;
 622                         continue;
 623                 case BPF_JMP_JSET | BPF_K:
 624                         bpf += (A & bpf->k) ? bpf->jt : bpf->jf;
 625                         continue;
 626                 case BPF_JMP_JGT | BPF_X:
 627                         bpf += (A > X) ? bpf->jt : bpf->jf;
 628                         continue;
 629                 case BPF_JMP_JGE | BPF_X:
 630                         bpf += (A >= X) ? bpf->jt : bpf->jf;
 631                         continue;
 632                 case BPF_JMP_JEQ | BPF_X:
 633                         bpf += (A == X) ? bpf->jt : bpf->jf;
 634                         continue;
 635                 case BPF_JMP_JSET | BPF_X:
 636                         bpf += (A & X) ? bpf->jt : bpf->jf;
 637                         continue;
 638                 case BPF_ALU_ADD | BPF_X:
 639                         A += X;
 640                         continue;
 641                 case BPF_ALU_SUB | BPF_X:
 642                         A -= X;
 643                         continue;
 644                 case BPF_ALU_MUL | BPF_X:
 645                         A *= X;
 646                         continue;
 647                 case BPF_ALU_DIV | BPF_X:
 648                         if (X == 0)
 649                                 return 0;
 650                         A /= X;
 651                         continue;
 652                 case BPF_ALU_MOD | BPF_X:
 653                         if (X == 0)
 654                                 return 0;
 655                         A %= X;
 656                         continue;
 657                 case BPF_ALU_AND | BPF_X:
 658                         A &= X;
 659                         continue;
 660                 case BPF_ALU_OR | BPF_X:
 661                         A |= X;
 662                         continue;
 663                 case BPF_ALU_XOR | BPF_X:
 664                         A ^= X;
 665                         continue;
 666                 case BPF_ALU_LSH | BPF_X:
 667                         A <<= X;
 668                         continue;
 669                 case BPF_ALU_RSH | BPF_X:
 670                         A >>= X;
 671                         continue;
 672                 case BPF_ALU_ADD | BPF_K:
 673                         A += bpf->k;
 674                         continue;
 675                 case BPF_ALU_SUB | BPF_K:
 676                         A -= bpf->k;
 677                         continue;
 678                 case BPF_ALU_MUL | BPF_K:
 679                         A *= bpf->k;
 680                         continue;
 681                 case BPF_ALU_DIV | BPF_K:
 682                         A /= bpf->k;
 683                         continue;
 684                 case BPF_ALU_MOD | BPF_K:
 685                         A %= bpf->k;
 686                         continue;
 687                 case BPF_ALU_AND | BPF_K:
 688                         A &= bpf->k;
 689                         continue;
 690                 case BPF_ALU_OR | BPF_K:
 691                         A |= bpf->k;
 692                         continue;
 693                 case BPF_ALU_XOR | BPF_K:
 694                         A ^= bpf->k;
 695                         continue;
 696                 case BPF_ALU_LSH | BPF_K:
 697                         A <<= bpf->k;
 698                         continue;
 699                 case BPF_ALU_RSH | BPF_K:
 700                         A >>= bpf->k;
 701                         continue;
 702                 case BPF_ALU_NEG:
 703                         A = -A;
 704                         continue;
 705                 case BPF_MISC_TAX:
 706                         X = A;
 707                         continue;
 708                 case BPF_MISC_TXA:
 709                         A = X;
 710                         continue;
 711                 }
 712         }
 713 }
 714
 715 void bpf_parse_rules(char *rulefile, struct sock_fprog *bpf, uint32_t link_type)
 716 {
 717         int ret;
 718         char buff[256];
 719         struct sock_filter sf_single = { 0x06, 0, 0, 0xFFFFFFFF };
 720         FILE *fp;
 721
 722         if (rulefile == NULL) {
 723                 bpf->len = 1;
 724                 bpf->filter = xmalloc(sizeof(sf_single));
 725                 fmemcpy(&bpf->filter[0], &sf_single, sizeof(sf_single));
 726                 return;
 727         }
 728
 729         fp = fopen(rulefile, "r");
 730         if (!fp) {
 731                 bpf_try_compile(rulefile, bpf, link_type);
 732                 return;
 733         }
 734
 735         fmemset(buff, 0, sizeof(buff));
 736         while (fgets(buff, sizeof(buff), fp) != NULL) {
 737                 buff[sizeof(buff) - 1] = 0;
 738                 if (buff[0] != '{') {
 739                         fmemset(buff, 0, sizeof(buff));
 740                         continue;
 741                 }
 742
 743                 fmemset(&sf_single, 0, sizeof(sf_single));
 744                 ret = sscanf(buff, "{ 0x%x, %u, %u, 0x%08x },",
 745                              (unsigned int *) &sf_single.code,
 746                              (unsigned int *) &sf_single.jt,
 747                              (unsigned int *) &sf_single.jf,
 748                              (unsigned int *) &sf_single.k);
 749                 if (ret != 4)
 750                         panic("BPF syntax error!\n");
 751
 752                 bpf->len++;
 753                 bpf->filter = xrealloc(bpf->filter, 1,
 754                                        bpf->len * sizeof(sf_single));
 755
 756                 fmemcpy(&bpf->filter[bpf->len - 1], &sf_single,
 757                        sizeof(sf_single));
 758                 fmemset(buff, 0, sizeof(buff));
 759         }
 760
 761         fclose(fp);
 762
 763         if (__bpf_validate(bpf) == 0)
 764                 panic("This is not a valid BPF program!\n");
 765 }