From 4584b955420cd8d2fcae767c86b853fde4bccc6e Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Thu, 23 May 2013 11:08:03 +0200 Subject: bpfc: allow bpf programs to be passed to cpp This patch allows bpf programs to be passed to the C preprocessor before handing over to bpfc. Example: #define ETH_P_IP 0x800 ldh [12] jne #ETH_P_IP, drop ldb [23] jneq #6, drop ldh [20] jset #0x1fff, drop ldxb 4 * ([14] & 0xf) ldh [x + 14] jeq #0x16, pass ldh [x + 16] jne #0x16, drop pass: ret #-1 drop: ret #0 Compile with: bpfc -i foo -p Suggested-by: John Lange Signed-off-by: Daniel Borkmann --- bpf_parser.y | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) (limited to 'bpf_parser.y') diff --git a/bpf_parser.y b/bpf_parser.y index 459ea99..7734fb3 100644 --- a/bpf_parser.y +++ b/bpf_parser.y @@ -16,16 +16,19 @@ #include #include #include +#include #include "bpf.h" #include "xmalloc.h" #include "bpf_parser.tab.h" #include "built_in.h" #include "die.h" +#include "xutils.h" #define MAX_INSTRUCTIONS 4096 -int compile_filter(char *file, int verbose, int bypass, int format); +int compile_filter(char *file, int verbose, int bypass, int format, + bool invoke_cpp); static int curr_instr = 0; @@ -659,10 +662,30 @@ static void pretty_printer(const struct sock_fprog *prog, int format) } } -int compile_filter(char *file, int verbose, int bypass, int format) +int compile_filter(char *file, int verbose, int bypass, int format, + bool invoke_cpp) { int i; struct sock_fprog res; + char tmp_file[128]; + + memset(tmp_file, 0, sizeof(tmp_file)); + + if (invoke_cpp) { + char cmd[256], *dir, *base, *a, *b; + + dir = dirname((a = xstrdup(file))); + base = basename((b = xstrdup(file))); + + slprintf(tmp_file, sizeof(tmp_file), "%s/.tmp-%u-%s", dir, rand(), base); + slprintf(cmd, sizeof(cmd), "cpp -I" PREFIX_STRING + "/etc/netsniff-ng/ %s > %s", file, tmp_file); + system(cmd); + + file = tmp_file; + xfree(a); + xfree(b); + } if (!strncmp("-", file, strlen("-"))) yyin = stdin; @@ -718,6 +741,9 @@ int compile_filter(char *file, int verbose, int bypass, int format) } fclose(yyin); + if (invoke_cpp) + unlink(tmp_file); + return 0; } -- cgit v1.2.3-54-g00ecf