|
|
|
BPF Filter
Pseudo-Machine
WinDis™ 32 V4.12.07.19 release and later includes code ported from the LBL BPF codebase. This page includes extracts from the BPF.4 Unix manual which describe the syntax and usage of the BPF filter pseudo-machine. Accordingly, the following statement is made about this WinDis 32 help file page:
Table Of Contents
GeneralA filter program is an array of instructions, with all branches forwardly directed, terminated by a return instruction. Each instruction performs some action on the pseudo-machine state, which consists of an accumulator, index register, scratch memory store, and implicit program counter. The following structure defines the instruction format: struct bpf_insn {
u_short code;
u_char jt;
u_char jf;
long k;
};
The \fIk\fP field is used in different ways by different instructions, and the \fIjt\fP and \fIjf\fP fields are used as offsets by the branch instructions. The opcodes are encoded in a semi-hierarchical fashion. There are eight classes of instructions: BPF_LD, BPF_LDX, BPF_ST, BPF_STX, BPF_ALU, BPF_JMP, BPF_RET, and BPF_MISC. Various other mode and operator bits are or'd into the class to give the actual instructions. The classes and modes are defined in <bpf.h>. Below are the semantics for each defined BPF instruction. We use the convention that A is the accumulator, X is the index register, P[] packet data, and M[] scratch memory store. P[i:n] gives the data at byte offset ``i'' in the packet, interpreted as a word (n=4), unsigned halfword (n=2), or unsigned byte (n=1). M[i] gives the i'th word in the scratch memory store, which is only addressed in word units. The memory store is indexed from 0 to BPF_MEMWORDS-1. \fIk\fP, \fIjt\fP, and \fIjf\fP are the corresponding fields in the instruction definition. ``len'' refers to the length of the packet.
BPF_LDThese instructions copy a value into the accumulator. The type of the source operand is specified by an ``addressing mode'' and can be a constant (\fBBPF_IMM\fP), packet data at a fixed offset (\fBBPF_ABS\fP), packet data at a variable offset (\fBBPF_IND\fP), the packet length (\fBBPF_LEN\fP), or a word in the scratch memory store (\fBBPF_MEM\fP). For \fBBPF_IND\fP and \fBBPF_ABS\fP, the data size must be specified as a word (\fBBPF_W\fP), halfword (\fBBPF_H\fP), or byte (\fBBPF_B\fP). The semantics of all the recognized BPF_LD instructions follow. BPF_LD+BPF_W+BPF_ABS BPF_LD+BPF_H+BPF_ABS BPF_LD+BPF_B+BPF_ABS BPF_LD+BPF_W+BPF_IND BPF_LD+BPF_H+BPF_IND BPF_LD+BPF_B+BPF_IND BPF_LD+BPF_W+BPF_LEN BPF_LD+BPF_IMM BPF_LD+BPF_MEM
BPF_LDXThese instructions load a value into the index register. Note that the addressing modes are more restricted than those of the accumulator loads, but they include BPF_MSH, a hack for efficiently loading the IP header length. BPF_LDX+BPF_W+BPF_IMM BPF_LDX+BPF_W+BPF_MEM BPF_LDX+BPF_W+BPF_LEN BPF_LDX+BPF_B+BPF_MSH
BPF_STThis instruction stores the accumulator into the scratch memory. We do not need an addressing mode since there is only one possibility for the destination. BPF_ST
BPF_STXThis instruction stores the index register in the scratch memory store. BPF_STX
BPF_ALUThe alu instructions perform operations between the accumulator and index register or constant, and store the result back in the accumulator. For binary operations, a source mode is required (\fBBPF_K\fP or \fBBPF_X\fP). BPF_ALU+BPF_ADD+BPF_K BPF_ALU+BPF_SUB+BPF_K BPF_ALU+BPF_MUL+BPF_K BPF_ALU+BPF_DIV+BPF_K BPF_ALU+BPF_AND+BPF_K BPF_ALU+BPF_OR+BPF_K BPF_ALU+BPF_LSH+BPF_K BPF_ALU+BPF_RSH+BPF_K BPF_ALU+BPF_ADD+BPF_X BPF_ALU+BPF_SUB+BPF_X BPF_ALU+BPF_MUL+BPF_X BPF_ALU+BPF_DIV+BPF_X BPF_ALU+BPF_AND+BPF_X BPF_ALU+BPF_OR+BPF_X BPF_ALU+BPF_LSH+BPF_X BPF_ALU+BPF_RSH+BPF_X BPF_ALU+BPF_NEG
BPF_JMPThe jump instructions alter flow of control. Conditional jumps compare the accumulator against a constant (\fBBPF_K\fP) or the index register (\fBBPF_X\fP). If the result is true (or non-zero), the true branch is taken, otherwise the false branch is taken. Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. However, the jump always (\fBBPF_JA\fP) opcode uses the 32 bit \fIk\fP field as the offset, allowing arbitrarily distant destinations. All conditionals use unsigned comparison conventions. BPF_JMP+BPF_JA BPF_JMP+BPF_JGT+BPF_K BPF_JMP+BPF_JGE+BPF_K BPF_JMP+BPF_JEQ+BPF_K BPF_JMP+BPF_JSET+BPF_K BPF_JMP+BPF_JGT+BPF_X BPF_JMP+BPF_JGE+BPF_X BPF_JMP+BPF_JEQ+BPF_X BPF_JMP+BPF_JSET+BPF_X
BPF_RETThe return instructions terminate the filter program and specify the amount of packet to accept (i.e., they return the truncation amount). A return value of zero indicates that the packet should be ignored. The return value is either a constant (\fBBPF_K\fP) or the accumulator (\fBBPF_A\fP). BPF_RET+BPF_A BPF_RET+BPF_K
BPF_MISCThe miscellaneous category was created for anything that doesn't fit into the above classes, and for any new instructions that might need to be added. Currently, these are the register transfer instructions that copy the index register to the accumulator or vice versa. BPF_MISC+BPF_TAX BPF_MISC+BPF_TXA The BPF interface provides the following macros to facilitate array initializers:
Filter Program ExamplesThe following filter is taken from the Reverse ARP Daemon. It accepts only Reverse ARP requests. struct bpf_insn insns[] = { This filter accepts only IP packets between host 128.3.112.15 and 128.3.112.35. struct bpf_insn insns[] = { Finally, this filter returns only TCP finger packets. We must parse the IP header to reach the TCP header. The \fBBPF_JSET\fP instruction checks that the IP fragment offset is 0 so we are sure that we have a TCP header. struct bpf_insn insns[] = {
SEE ALSOMcCanne, S. and Jacobson V. "The BSD Packet Filter: A New Architecture for User-level Packet Capture" . Proceedings of the 1993 Winter USENIX Technical Conference, San Diego, CA.
HISTORYThe Enet packet filter was created in 1980 by Mike Accetta and Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at Stanford, ported the code to BSD and continued its development from 1983 on. Since then, it has evolved into the Ultrix Packet Filter at DEC, a STREAMS NIT module under SunOS 4.1, and BPF. Thomas F. Divine of Printing Communications Assoc., Inc. ported the BPF pseudo-machine to the Microsoft Windows platform for use in PCA's Win32 NDIS Framework (WinDis 32) in 1997.
AUTHORSSteven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in Summer 1990. The design was in collaboration with Van Jacobson, also of Lawrence Berkeley Laboratory. |
Mailing Lists ·
PCAUSA Newsletter
·
PCAUSA Discussion List
|
