2 * netsniff-ng - the packet sniffing beast
3 * By Daniel Borkmann <daniel@netsniff-ng.org>
4 * Copyright 2011 Daniel Borkmann <dborkma@tik.ee.ethz.ch>,
5 * Swiss federal institute of technology (ETH Zurich)
6 * Subject to the GPL, version 2.
9 /* yaac-func-prefix: yy */
22 #include "bpf_parser.tab.h"
26 #define MAX_INSTRUCTIONS 4096
28 int compile_filter
(char *file
, int verbose
, int bypass
);
30 static int curr_instr
= 0;
32 static struct sock_filter out
[MAX_INSTRUCTIONS
];
34 static char *labels
[MAX_INSTRUCTIONS
];
36 static char *labels_jt
[MAX_INSTRUCTIONS
];
37 static char *labels_jf
[MAX_INSTRUCTIONS
];
38 static char *labels_k
[MAX_INSTRUCTIONS
];
40 #define YYERROR_VERBOSE 0
42 #define YYENABLE_NLS 1
43 #define YYLTYPE_IS_TRIVIAL 1
47 extern
int yylex(void);
48 extern
void yyerror(const char *);
52 static inline
void set_curr_instr
(uint16_t code
, uint8_t jt
, uint8_t jf
, uint32_t k
)
54 if
(curr_instr
>= MAX_INSTRUCTIONS
)
55 panic
("Exceeded maximal number of instructions!\n");
57 out
[curr_instr
].code
= code
;
58 out
[curr_instr
].jt
= jt
;
59 out
[curr_instr
].jf
= jf
;
60 out
[curr_instr
].k
= k
;
65 static inline
void set_curr_label
(char *label
)
67 if
(curr_instr
>= MAX_INSTRUCTIONS
)
68 panic
("Exceeded maximal number of instructions!\n");
70 labels
[curr_instr
] = label
;
77 static inline
void set_jmp_label
(char *label
, int which
)
79 if
(curr_instr
>= MAX_INSTRUCTIONS
)
80 panic
("Exceeded maximal number of instructions!\n");
82 bug_on
(which
!= JTL
&& which
!= JFL
&& which
!= JKL
);
85 labels_jt
[curr_instr
] = label
;
86 else if
(which
== JFL
)
87 labels_jf
[curr_instr
] = label
;
89 labels_k
[curr_instr
] = label
;
92 static int find_intr_offset_or_panic
(char *label_to_search
)
94 int i
, max
= curr_instr
, ret
= -ENOENT
;
96 bug_on
(!label_to_search
);
98 for
(i
= 0; i
< max
; ++i
) {
99 if
(labels
[i
] != NULL
) {
100 /* Both are \0-terminated! */
101 if
(!strcmp
(label_to_search
, labels
[i
])) {
109 panic
("No such label!\n");
121 %token OP_LDB OP_LDH OP_LD OP_LDX OP_ST OP_STX OP_JMP OP_JEQ OP_JGT OP_JGE
122 %token OP_JSET OP_ADD OP_SUB OP_MUL OP_DIV OP_AND OP_OR OP_XOR OP_LSH OP_RSH
123 %token OP_RET OP_TAX OP_TXA OP_LDXB OP_MOD OP_NEG K_PKT_LEN K_PROTO K_TYPE
124 %token K_NLATTR K_NLATTR_NEST K_MARK K_QUEUE K_HATYPE K_RXHASH K_CPU K_IFIDX
125 %token K_VLANT K_VLANP
127 %token
':' ',' '[' ']' '(' ')' 'x' 'a' '+' 'M' '*' '&' '#'
131 %type
<number
> number
179 : label
':' { set_curr_label
($1); }
183 : OP_LDB
'[' 'x' '+' number
']' {
184 set_curr_instr
(BPF_LD | BPF_B | BPF_IND
, 0, 0, $5); }
185 | OP_LDB
'[' number
']' {
186 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0, $3); }
187 | OP_LDB
'#' K_PROTO
{
188 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
189 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
190 | OP_LDB
'#' K_TYPE
{
191 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
192 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
193 | OP_LDB
'#' K_IFIDX
{
194 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
195 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
196 | OP_LDB
'#' K_NLATTR
{
197 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
198 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
199 | OP_LDB
'#' K_NLATTR_NEST
{
200 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
201 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
202 | OP_LDB
'#' K_MARK
{
203 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
204 SKF_AD_OFF
+ SKF_AD_MARK
); }
205 | OP_LDB
'#' K_QUEUE
{
206 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
207 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
208 | OP_LDB
'#' K_HATYPE
{
209 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
210 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
211 | OP_LDB
'#' K_RXHASH
{
212 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
213 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
215 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
216 SKF_AD_OFF
+ SKF_AD_CPU
); }
217 | OP_LDB
'#' K_VLANT
{
218 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
219 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
220 | OP_LDB
'#' K_VLANP
{
221 set_curr_instr
(BPF_LD | BPF_B | BPF_ABS
, 0, 0,
222 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
226 : OP_LDH
'[' 'x' '+' number
']' {
227 set_curr_instr
(BPF_LD | BPF_H | BPF_IND
, 0, 0, $5); }
228 | OP_LDH
'[' number
']' {
229 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0, $3); }
230 | OP_LDH
'#' K_PROTO
{
231 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
232 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
233 | OP_LDH
'#' K_TYPE
{
234 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
235 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
236 | OP_LDH
'#' K_IFIDX
{
237 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
238 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
239 | OP_LDH
'#' K_NLATTR
{
240 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
241 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
242 | OP_LDH
'#' K_NLATTR_NEST
{
243 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
244 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
245 | OP_LDH
'#' K_MARK
{
246 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
247 SKF_AD_OFF
+ SKF_AD_MARK
); }
248 | OP_LDH
'#' K_QUEUE
{
249 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
250 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
251 | OP_LDH
'#' K_HATYPE
{
252 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
253 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
254 | OP_LDH
'#' K_RXHASH
{
255 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
256 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
258 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
259 SKF_AD_OFF
+ SKF_AD_CPU
); }
260 | OP_LDH
'#' K_VLANT
{
261 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
262 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
263 | OP_LDH
'#' K_VLANP
{
264 set_curr_instr
(BPF_LD | BPF_H | BPF_ABS
, 0, 0,
265 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
270 set_curr_instr
(BPF_LD | BPF_IMM
, 0, 0, $3); }
271 | OP_LD
'#' K_PKT_LEN
{
272 set_curr_instr
(BPF_LD | BPF_W | BPF_LEN
, 0, 0, 0); }
273 | OP_LD
'#' K_PROTO
{
274 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
275 SKF_AD_OFF
+ SKF_AD_PROTOCOL
); }
277 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
278 SKF_AD_OFF
+ SKF_AD_PKTTYPE
); }
279 | OP_LD
'#' K_IFIDX
{
280 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
281 SKF_AD_OFF
+ SKF_AD_IFINDEX
); }
282 | OP_LD
'#' K_NLATTR
{
283 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
284 SKF_AD_OFF
+ SKF_AD_NLATTR
); }
285 | OP_LD
'#' K_NLATTR_NEST
{
286 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
287 SKF_AD_OFF
+ SKF_AD_NLATTR_NEST
); }
289 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
290 SKF_AD_OFF
+ SKF_AD_MARK
); }
291 | OP_LD
'#' K_QUEUE
{
292 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
293 SKF_AD_OFF
+ SKF_AD_QUEUE
); }
294 | OP_LD
'#' K_HATYPE
{
295 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
296 SKF_AD_OFF
+ SKF_AD_HATYPE
); }
297 | OP_LD
'#' K_RXHASH
{
298 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
299 SKF_AD_OFF
+ SKF_AD_RXHASH
); }
301 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
302 SKF_AD_OFF
+ SKF_AD_CPU
); }
303 | OP_LD
'#' K_VLANT
{
304 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
305 SKF_AD_OFF
+ SKF_AD_VLAN_TAG
); }
306 | OP_LD
'#' K_VLANP
{
307 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0,
308 SKF_AD_OFF
+ SKF_AD_VLAN_TAG_PRESENT
); }
309 | OP_LD
'M' '[' number
']' {
310 set_curr_instr
(BPF_LD | BPF_MEM
, 0, 0, $4); }
311 | OP_LD
'[' 'x' '+' number
']' {
312 set_curr_instr
(BPF_LD | BPF_W | BPF_IND
, 0, 0, $5); }
313 | OP_LD
'[' number
']' {
314 set_curr_instr
(BPF_LD | BPF_W | BPF_ABS
, 0, 0, $3); }
318 : OP_LDX
'#' number
{
319 set_curr_instr
(BPF_LDX | BPF_IMM
, 0, 0, $3); }
320 | OP_LDX
'M' '[' number
']' {
321 set_curr_instr
(BPF_LDX | BPF_MEM
, 0, 0, $4); }
322 | OP_LDXB number
'*' '(' '[' number
']' '&' number
')' {
323 if
($2 != 4 ||
$9 != 0xf) {
324 panic
("ldxb offset not supported!\n");
326 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
327 | OP_LDX number
'*' '(' '[' number
']' '&' number
')' {
328 if
($2 != 4 ||
$9 != 0xf) {
329 panic
("ldxb offset not supported!\n");
331 set_curr_instr
(BPF_LDX | BPF_MSH | BPF_B
, 0, 0, $6); } }
335 : OP_ST
'M' '[' number
']' {
336 set_curr_instr
(BPF_ST
, 0, 0, $4); }
340 : OP_STX
'M' '[' number
']' {
341 set_curr_instr
(BPF_STX
, 0, 0, $4); }
346 set_jmp_label
($2, JKL
);
347 set_curr_instr
(BPF_JMP | BPF_JA
, 0, 0, 0); }
351 : OP_JEQ
'#' number
',' label
',' label
{
352 set_jmp_label
($5, JTL
);
353 set_jmp_label
($7, JFL
);
354 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_K
, 0, 0, $3); }
355 | OP_JEQ
'x' ',' label
',' label
{
356 set_jmp_label
($4, JTL
);
357 set_jmp_label
($6, JFL
);
358 set_curr_instr
(BPF_JMP | BPF_JEQ | BPF_X
, 0, 0, 0); }
362 : OP_JGT
'#' number
',' label
',' label
{
363 set_jmp_label
($5, JTL
);
364 set_jmp_label
($7, JFL
);
365 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_K
, 0, 0, $3); }
366 | OP_JGT
'x' ',' label
',' label
{
367 set_jmp_label
($4, JTL
);
368 set_jmp_label
($6, JFL
);
369 set_curr_instr
(BPF_JMP | BPF_JGT | BPF_X
, 0, 0, 0); }
373 : OP_JGE
'#' number
',' label
',' label
{
374 set_jmp_label
($5, JTL
);
375 set_jmp_label
($7, JFL
);
376 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_K
, 0, 0, $3); }
377 | OP_JGE
'x' ',' label
',' label
{
378 set_jmp_label
($4, JTL
);
379 set_jmp_label
($6, JFL
);
380 set_curr_instr
(BPF_JMP | BPF_JGE | BPF_X
, 0, 0, 0); }
384 : OP_JSET
'#' number
',' label
',' label
{
385 set_jmp_label
($5, JTL
);
386 set_jmp_label
($7, JFL
);
387 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_K
, 0, 0, $3); }
388 | OP_JSET
'x' ',' label
',' label
{
389 set_jmp_label
($4, JTL
);
390 set_jmp_label
($6, JFL
);
391 set_curr_instr
(BPF_JMP | BPF_JSET | BPF_X
, 0, 0, 0); }
395 : OP_ADD
'#' number
{
396 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_K
, 0, 0, $3); }
398 set_curr_instr
(BPF_ALU | BPF_ADD | BPF_X
, 0, 0, 0); }
402 : OP_SUB
'#' number
{
403 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_K
, 0, 0, $3); }
405 set_curr_instr
(BPF_ALU | BPF_SUB | BPF_X
, 0, 0, 0); }
409 : OP_MUL
'#' number
{
410 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_K
, 0, 0, $3); }
412 set_curr_instr
(BPF_ALU | BPF_MUL | BPF_X
, 0, 0, 0); }
416 : OP_DIV
'#' number
{
417 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_K
, 0, 0, $3); }
419 set_curr_instr
(BPF_ALU | BPF_DIV | BPF_X
, 0, 0, 0); }
423 : OP_MOD
'#' number
{
424 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_K
, 0, 0, $3); }
426 set_curr_instr
(BPF_ALU | BPF_MOD | BPF_X
, 0, 0, 0); }
431 set_curr_instr
(BPF_ALU | BPF_NEG
, 0, 0, 0); }
435 : OP_AND
'#' number
{
436 set_curr_instr
(BPF_ALU | BPF_AND | BPF_K
, 0, 0, $3); }
438 set_curr_instr
(BPF_ALU | BPF_AND | BPF_X
, 0, 0, 0); }
443 set_curr_instr
(BPF_ALU | BPF_OR | BPF_K
, 0, 0, $3); }
445 set_curr_instr
(BPF_ALU | BPF_OR | BPF_X
, 0, 0, 0); }
449 : OP_XOR
'#' number
{
450 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_K
, 0, 0, $3); }
452 set_curr_instr
(BPF_ALU | BPF_XOR | BPF_X
, 0, 0, 0); }
456 : OP_LSH
'#' number
{
457 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_K
, 0, 0, $3); }
459 set_curr_instr
(BPF_ALU | BPF_LSH | BPF_X
, 0, 0, 0); }
463 : OP_RSH
'#' number
{
464 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_K
, 0, 0, $3); }
466 set_curr_instr
(BPF_ALU | BPF_RSH | BPF_X
, 0, 0, 0); }
471 set_curr_instr
(BPF_RET | BPF_A
, 0, 0, 0); }
472 | OP_RET
'#' number
{
473 set_curr_instr
(BPF_RET | BPF_K
, 0, 0, $3); }
478 set_curr_instr
(BPF_MISC | BPF_TAX
, 0, 0, 0); }
483 set_curr_instr
(BPF_MISC | BPF_TXA
, 0, 0, 0); }
488 static void stage_1_inline
(void)
493 static void stage_2_label_reduce
(void)
495 int i
, max
= curr_instr
, off
;
497 /* 1. reduce k jumps */
498 for
(i
= 0; i
< max
; ++i
) {
499 if
(labels_k
[i
] != NULL
) {
500 off
= find_intr_offset_or_panic
(labels_k
[i
]);
501 out
[i
].k
= (uint32_t) (off
- i
- 1);
505 /* 1. reduce jt jumps */
506 for
(i
= 0; i
< max
; ++i
) {
507 if
(labels_jt
[i
] != NULL
) {
508 off
= find_intr_offset_or_panic
(labels_jt
[i
]);
509 out
[i
].jt
= (uint8_t) (off
- i
-1);
513 /* 1. reduce jf jumps */
514 for
(i
= 0; i
< max
; ++i
) {
515 if
(labels_jf
[i
] != NULL
) {
516 off
= find_intr_offset_or_panic
(labels_jf
[i
]);
517 out
[i
].jf
= (uint8_t) (off
- i
- 1);
522 int compile_filter
(char *file
, int verbose
, int bypass
)
525 struct sock_fprog res
;
527 if
(!strncmp
("-", file
, strlen
("-")))
530 yyin
= fopen
(file
, "r");
532 panic
("Cannot open file!\n");
534 memset
(out
, 0, sizeof
(out
));
535 memset
(labels
, 0, sizeof
(labels
));
536 memset
(labels_jf
, 0, sizeof
(labels_jf
));
537 memset
(labels_jt
, 0, sizeof
(labels_jt
));
538 memset
(labels_k
, 0, sizeof
(labels_k
));
541 stage_2_label_reduce
();
544 res.len
= curr_instr
;
547 printf
("Generated program:\n");
553 printf
("Validating: ");
557 if
(bpf_validate
(&res
) == 0) {
559 whine
("Semantic error! BPF validation "
562 panic
("Semantic error! BPF validation failed! "
563 "Try -V for debugging output!\n");
564 } else if
(verbose
) {
565 printf
("is runnable!\n");
571 for
(i
= 0; i
< res.len
; ++i
) {
572 printf
("{ 0x%x, %u, %u, 0x%08x },\n",
573 res.filter
[i
].code
, res.filter
[i
].jt
,
574 res.filter
[i
].jf
, res.filter
[i
].k
);
575 if
(labels
[i
] != NULL
)
577 if
(labels_jt
[i
] != NULL
)
579 if
(labels_jf
[i
] != NULL
)
581 if
(labels_k
[i
] != NULL
)
589 void yyerror(const char *err
)
591 panic
("Syntax error at line %d: %s! %s!\n",
592 yylineno
, yytext
, err
);