0

I'm trying to read some BPF syntax for a filter to try and figure out what it does. One thing I cannot find is where the "byte offset starts". Meaning, that if we have the following assembler code:

 0000: 0x28 0x00 0x00 0x00000004   ldh $data[4]
 0001: 0x15 0x00 0x61 0x00000028   jeq 40   true:0002 false:0099
 0002: 0x30 0x00 0x00 0x0000000d   ldb $data[13]
 0003: 0x14 0x00 0x00 0x00000033   sub 51
 0004: 0x15 0x00 0x5e 0x00000006   jeq 6    true:0005 false:0099
  1. Question 1

For byte offset 4, does that put me in the middle of the destination MAC address of an 802.3 frame? Or is it in the preamble? Where in the packet do I start from, then walk 4 bytes to my half word is what I am asking.

  1. Question 2

If it is in the MAC address, would scapy be a viable option to write my own packet's ethernet frame? The goal of this is to write a client that will connect and pass all of the BPF requirements.

1 Answer 1

3

For your first question: it depends on where, and how, you attach your BPF program.

  • If you attach it to the TC (traffic control) interface as a classifier, it will start working on the L2 Ethernet header (destination MAC address).

  • If you attach it to a socket, I think there are several cases:

    • If the protocol you passed when creating your socket is, for example, TCP, then the program starts on the L3 (IP) header. See for example this question.
    • If the protocol required is “every packet”, then the program starts working on the MAC header. See the example in the BPF kernel documentation (grep for ETH_P_ALL).

    Edit: Rather than the protocol, this is more likely the socket domain in use (AF_PACKET vs. AF_INET) that makes the difference here.

For your second question, you can build Ethernet headers and payloads with scapy, but I'm sorry, I don't understand what you mean by “connect and pass all of the BPF requirements”… Could you please detail a bit more?

3
  • So if it using setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "d\0\0\0\300\221\4\10", 8 Then I assume it will start at the IP header? I mean that I need to fulfill all of the filter requirements. Like if it filtered out port 22, I would need to connect via port 22. Mar 31, 2018 at 21:11
  • For the second question, I mean that I need to fulfill all of the filter requirements. Like if it filtered out port 22, I would need to connect via port 22 Mar 31, 2018 at 21:11
  • As far as I understand, for sockets it depends on the domain of the socket you created with the socket(*domain*, type, protocol) call, not on the setsockopt() that comes after. If you want to connect via port 22, use scapy or whatever other method is available in your app. For example, SSH defaults to port 22 but you could change it with -p; other apps could have similar options. Scapy will allow you to forge your packets from scratch. Whether you need it or not is a matter of what you are trying to achieve.
    – Qeole
    Apr 1, 2018 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.