filter

package
v0.0.0-...-c97f47a Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 9, 2020 License: BSD-2-Clause Imports: 6 Imported by: 0

Documentation

Overview

Provides an API for compiling and manipulating BPF filters. A filter can be either compiled from tcpdump-like expressions, or created from basic BPF instructions. Filters can then be either applied to packet sources (see the capture package) or directly run against binary data.

Index

Examples

Constants

View Source 
const (
	LD   Code = syscall.BPF_LD
	LDX       = syscall.BPF_LDX
	ST        = syscall.BPF_ST
	STX       = syscall.BPF_STX
	ALU       = syscall.BPF_ALU
	JMP       = syscall.BPF_JMP
	RET       = syscall.BPF_RET
	MISC      = syscall.BPF_MISC
)
View Source 
const (
	Word Size = syscall.BPF_W
	Half      = syscall.BPF_H
	Byte      = syscall.BPF_B
)
View Source 
const (
	IMM Mode = syscall.BPF_IMM
	ABS      = syscall.BPF_ABS
	IND      = syscall.BPF_IND
	MEM      = syscall.BPF_MEM
	LEN      = syscall.BPF_LEN
	MSH      = syscall.BPF_MSH
)
View Source 
const (
	Const Src = syscall.BPF_K
	Index     = syscall.BPF_X
	Acc       = syscall.BPF_A
)

Variables

This section is empty.

Functions

This section is empty.

Types

type Builder 

type Builder struct {
	// contains filtered or unexported fields
}

A Builder is used to compile a BPF filter from basic BPF instructions.

Example 
package main

import (
	"log"

	"github.com/ghedo/go.pkt/filter"
)

func main() {
	// Build a filter to match ARP packets on top of Ethernet
	flt := filter.NewBuilder().
		LD(filter.Half, filter.ABS, 12).
		JEQ(filter.Const, "", "fail", 0x806).
		RET(filter.Const, 0x40000).
		Label("fail").
		RET(filter.Const, 0x0).
		Build()

	if flt.Match([]byte("random data")) {
		log.Println("MATCH!!!")
	}
}

Output:

func NewBuilder 

func NewBuilder() *Builder

Allocate and initialize a new Builder.

func (*Builder) ADD 

func (b *Builder) ADD(s Src, val uint32) *Builder

Append an ADD instruction to the filter, which adds a value to the accumulator. s represents the source operand type and can be either Const (which adds the supplied value) or Index (which adds the index register value).

func (*Builder) AND 

func (b *Builder) AND(s Src, val uint32) *Builder

Append an AND instruction to the filter, which performs the binary "and" between the accumulator and a value. s represents the source operand type and can be either Const (which uses the supplied value) or Index (which uses the index register value).

func (*Builder) AppendInstruction 

func (b *Builder) AppendInstruction(code Code, jt, jf uint8, k uint32) *Builder

Append a raw BPF instruction

func (*Builder) Build 

func (b *Builder) Build() *Filter

Generate and return the Filter associated with the Builder.

func (*Builder) DIV 

func (b *Builder) DIV(s Src, val uint32) *Builder

Append a DIV instruction to the filter, which divides the accumulator by a value. s represents the source operand type and can be either Const (which divides by the supplied value) or Index (which divides by the index register value).

func (*Builder) JA 

func (b *Builder) JA(j string) *Builder

Append a JA instruction to the filter, which performs a jump to the given label.

func (*Builder) JEQ 

func (b *Builder) JEQ(s Src, jt, jf string, cmp uint32) *Builder

Append a JEQ instruction to the filter, which performs a jump to the jt label if the accumulator value equals cmp (if s is Const) or the index register (if s is Index), otherwise jumps to jf.

func (*Builder) JGE 

func (b *Builder) JGE(s Src, jt, jf string, cmp uint32) *Builder

Append a JGE instruction to the filter, which performs a jump to the jt label if the accumulator value is greater than or equals cmp (if s is Const) or the index register (if s is Index), otherwise jumps to jf.

func (*Builder) JGT 

func (b *Builder) JGT(s Src, jt, jf string, cmp uint32) *Builder

Append a JGT instruction to the filter, which performs a jump to the jt label if the accumulator value is greater than cmp (if s is Const) or the index register (if s is Index), otherwise jumps to jf.

func (*Builder) JSET 

func (b *Builder) JSET(s Src, jt, jf string, cmp uint32) *Builder

Append a JSET instruction to the filter.

func (*Builder) LD 

func (b *Builder) LD(s Size, m Mode, val uint32) *Builder

Append an LD instruction to the filter, which loads a value of size s into the accumulator. m represents the addressing mode of the source operand and can be IMM (load a constant value), ABS (load packet data at the given fixed offset), IND (load packet data at the given relative offset), LEN (load the packet length or MEM (load a value from memory at the given offset).

func (*Builder) LDX 

func (b *Builder) LDX(s Size, m Mode, val uint32) *Builder

Append a LDX (load index) instruction to the filter, which loads a value of size s into the index register. m represents the addressing mode of the source operand and can be IMM (load a constant value), LEN (load the packet length, MEM (load a value from memory at the given offset) or MSH (load the length of the IP header).

func (*Builder) LSH 

func (b *Builder) LSH(s Src, val uint32) *Builder

Append an LSH instruction to the filter, which shifts to the left the accumulator register by a value. s represents the source operand type and can be either Const (which shifts by the supplied value) or Index (which shifts by the index register value).

func (*Builder) Label 

func (b *Builder) Label(name string) *Builder

Define a new label at the next instruction position. Labels are used in jump instructions to identify the jump target.

func (*Builder) MOD 

func (b *Builder) MOD(s Src, val uint32) *Builder

Append a MOD instruction to the filter, which computes the accumulator modulo a value. s represents the source operand type and can be either Const (which divides by the supplied value) or Index (which divides by the index register value).

func (*Builder) MUL 

func (b *Builder) MUL(s Src, val uint32) *Builder

Append a MUL instruction to the filter, which multiplies a value to the accumulator. s represents the source operand type and can be either Const (which multiplies the supplied value) or Index (which multiplies the index register value).

func (*Builder) NEG 

func (b *Builder) NEG() *Builder

Append a NEG instruction to the filter which negates the accumulator.

func (*Builder) OR 

func (b *Builder) OR(s Src, val uint32) *Builder

Append an OR instruction to the filter, which performs the binary "or" between the accumulator and a value. s represents the source operand type and can be either Const (which uses the supplied value) or Index (which uses the index register value).

func (*Builder) RET 

func (b *Builder) RET(s Src, bytes uint32) *Builder

Append a RET instruction to the filter, which terminates the filter program and specifies the amount of the packet to accept. s represents the source operand type and can be either Const (which returns the supplied value) or Acc (which returns the accumulator value).

func (*Builder) RSH 

func (b *Builder) RSH(s Src, val uint32) *Builder

Append an RSH instruction to the filter, which shifts to the right the accumulator register by a value. s represents the source operand type and can be either Const (which shifts by the supplied value) or Index (which shifts by the index register value).

func (*Builder) ST 

func (b *Builder) ST(off uint32) *Builder

Append a ST (store) instruction to the filter, which stores the value of the accumulator in memory at the given offset.

func (*Builder) STX 

func (b *Builder) STX(off uint32) *Builder

Append a STX (store index) instruction to the filter, which stores the value of the index register in memory at the given offset.

func (*Builder) SUB 

func (b *Builder) SUB(s Src, val uint32) *Builder

Append a SUB instruction to the filter, which subtracts a value from the accumulator. s represents the source operand type and can be either Const (which subtracts the supplied value) or Index (which subtracts the index register value).

func (*Builder) TAX 

func (b *Builder) TAX() *Builder

Append a TAX instruction to the filter. TAX transfers the accumulator value into the index register.

func (*Builder) TXA 

func (b *Builder) TXA() *Builder

Append a TXA instruction to the filter. TXA transfers the index register value into the accumulator.

func (*Builder) XOR 

func (b *Builder) XOR(s Src, val uint32) *Builder

Append an XOR instruction to the filter, which performs the binary "xor" between the accumulator and a value. s represents the source operand type and can be either Const (which uses the supplied value) or Index (which uses the index register value).

type Code 

type Code uint16

type Filter 

type Filter struct {
	// contains filtered or unexported fields
}
Example 
package main

import (
	"log"

	"github.com/ghedo/go.pkt/filter"
	"github.com/ghedo/go.pkt/packet"
)

func main() {
	// Match UDP or TCP packets on top of Ethernet
	flt, err := filter.Compile("udp or tcp", packet.Eth, false)
	if err != nil {
		log.Fatal(err)
	}

	if flt.Match([]byte("random data")) {
		log.Println("MATCH!!!")
	}
}

Output:

func Compile 

func Compile(filter string, link_type packet.Type, optimize bool) (*Filter, error)

Compile the given tcpdump-like expression to a BPF filter.

func (*Filter) Cleanup 

func (f *Filter) Cleanup()

Deallocate the filter.

func (*Filter) Filter 

func (f *Filter) Filter(buf []byte) uint

Run filter on the given buffer and return its result.

func (*Filter) Len 

func (f *Filter) Len() int

Return the number of instructions in the filter.

func (*Filter) Match 

func (f *Filter) Match(buf []byte) bool

Try to match the given buffer against the filter.

func (*Filter) Program 

func (f *Filter) Program() unsafe.Pointer

Return the compiled BPF program.

func (*Filter) String 

func (f *Filter) String() string

func (*Filter) Validate 

func (f *Filter) Validate() bool

Validate the filter. The constraints are that each jump be forward and to a valid code. The code must terminate with either an accept or reject.

type Mode 

type Mode uint16

type Size 

type Size uint16

type Src 

type Src uint16

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.