converttobpf.tcl

Go to the documentation of this file.

##
# @brief Basic namespace for all Excentis Tcl extensions
#
namespace eval excentis {

##
# @brief Namespace for Excentis Tcl extensions for basic functions.
#
# This includes functionality such as:
# - Network frame generation
# - Address parsing and conversion
# - ...
#
namespace eval basic {

## \file
#
# @brief Utility module for <b>parsing DisplayFilter</b> strings and <b>converting</b> them <b>to BPF</b> filters, which is the only filter format used by the ByteBlower client.
#
# @copyright Excentis nv - www.excentis.com
#

proc ParseFilter { filter } {
    # Parses the filter in subfilters.
    #  Each subfilter is a string containing a field, operation and value.
    #  Field, operation and value must be separated by a space.
    # A filter can contain at maximum two subfilters, where a subfilter is
    # within parentheses.
    # Example filters:
    #  udp.srcport == 1024
    #  (ip.src == 10.11.0.2) and (ip.dst == 10.11.0.3)
    # The following filters are invalid:
    #  udp.srcport==1024
    #  ((ip.src == 10.11.0.2) and (ip.dst == 10.11.0.3))

    # First convert the filter to lower case and remove leading and/or trailing spaces
    set filter [string trim [string tolower $filter]]

    # Remove extra spaces within filter string
    set newFilter ""
    set rest ""
    set newPart ""
    while { [scan $filter "%s %\[^\n\]" newPart rest]  > 1} {
        set newFilter [append newFilter $newPart " "]
        set filter $rest
    }
    set filter [append newFilter $newPart] ; # append the last part

    # Recursive processing on standardized filter
    return [ConvertSubFilter $filter]
}

proc ConvertSubFilter { inFilter } {
    set result ""

    set endPosition [GetSubFilter $inFilter]
    if { $endPosition != {}} {
        set startPosition [lindex [lindex [regexp -indices -inline {[^\s\t]} $inFilter] 0] 0]
        if {[string index $inFilter $startPosition] == "("} {
            incr startPosition
        }
        set firstFilter [string range $inFilter $startPosition [expr $endPosition-1]]
        append result "(" [ConvertSubFilter $firstFilter] ")"
        # now an operator can follow
        set endPosition1 [lindex [lindex [regexp -indices -inline {[^\s\t]} [string range $inFilter [expr $endPosition + 1] end] ] 0] 0]
        if {$endPosition1 == {}} {
            return $result
        }
        # There is an "operator"
        set endPosition [expr $endPosition + $endPosition1 +1]
        set startPosition $endPosition
        set endPosition1 [lindex [lindex [regexp -indices -inline {[\s\t]} [string range $inFilter $endPosition end] ] 0] 0]
        set endPosition [expr $endPosition + $endPosition1]
        # Get the operator
        append result " " [string range $inFilter $startPosition $endPosition]
        set endPosition1 [lindex [lindex [regexp -indices -inline {[^\s\t]} [string range $inFilter [expr $endPosition + 1] end] ] 0] 0]
        set endPosition [expr $endPosition + $endPosition1 ]
        set secondFilter [string range $inFilter $endPosition end]
        append result [ConvertSubFilter $secondFilter]
        return $result
    } else {
        # Atomic case: convert a single BPF filter component
        return [ConvertToBpf $inFilter]
    }

}

proc GetSubFilter { inFilter } {
    # Find where the subfilter which starts with inFilter stops.
    # @return position of closing parenthesis + 1

    # Move search point to first non-space character in inFilter
    set position [lindex [lindex [regexp -indices -inline {[^\s\t]} $inFilter] 0] 0]
    if {$position == {}} {
        # Empty filter
        return $position
    }

    if {[string index $inFilter $position] == ")"} {
        # A subfilter should not start with a closing brace
        error "ParseFilter error: Unbalanced brace found. Please make sure each opening brace finds a closing one."
    } elseif {[string index $inFilter $position] == "("} {
        # The subfilter consists of everything up to the matching closing brace
        set numberOfBracesToFind 1
        while {1} {
            # Find next brace in the (remaining) substring, after the current search point
            set position1 [lindex [lindex [regexp -indices -inline {[()]} [string range $inFilter [expr $position + 1] end] ] 0] 0]
            if {$position1 == {}} {
                error "ParseFilter error: Unbalanced brace found. Please make sure each opening brace finds a closing one."
            }
            # Move search point to the next brace
            set position [expr $position + $position1 + 1]
            # Brace counting
            if {[string index $inFilter $position] == "("} {
                incr numberOfBracesToFind
            } else {
                incr numberOfBracesToFind -1
            }
            if {$numberOfBracesToFind == 0} {
                # Current search point is end of subfilter
                return $position
            }
        }
    } else {
        # Not a brace, so we have to find a valid field, operator and value.
        set position1 [lindex [lindex [regexp -indices -inline {[\s\t]} [string range $inFilter [expr $position + 1] end]] 0] 0]
        if {$position1 == {}} {
            # Unexpected end of subfilter
            error "ParseFilter error: Error during parsing of filter string. Expected a logical operation."
        }
        set position [expr $position + $position1 + 1]
        set position1 [lindex [lindex [regexp -indices -inline {[\s\t]} [string range $inFilter [expr $position + 1] end]] 0] 0]
        if {$position1 == {}} {
            # Unexpected end of subfilter
            error "ParseFilter error: Error during parsing of filter string. Expected a value."
        }
        set position [expr $position + $position1 + 1]

        if {[string index $inFilter [expr $position + 1]] == "("} {
            set position1 [lindex [lindex [regexp -indices -inline {[)]} [string range $inFilter [expr $position + 1] end]] 0] 0]
            set position [expr $position + $position1 + 1]
        }
        set position1 [lindex [lindex [regexp -indices -inline {[\s\t]} [string range $inFilter [expr $position + 1] end]] 0] 0]
        if {$position1 == {}} {
            return $position1
        }
        set position [expr $position + $position1 + 1]
        return $position
    }
}

proc ConvertToBpf { filter } {
    # @param filter : A filter string containing a field, operation and value.
    # @return A bpf filter which filters the packet based on the user filter.
    #
    # Examples:
    #  ConvertToBpf "ip.src == 10.0.0.1" returns "ip src 10.0.0.1"
    #  ConvertToBpf "ip" returns "ip"

    set filterParts [split $filter]
    if {[llength $filterParts] > 3} {
        error "ConvertToBpf error: Invalid filter format: \"$filter\""
    }
    # FIELD
    set field [lindex $filterParts 0]
    # OPERATION
    set operation [ lindex $filterParts 1 ]
    switch -- $operation {
        "eq" - "=="  { set operation "=" }
        "gt" - ">"   { set operation ">" }
        "lt" - "<"   { set operation "<" }
        "ge" - ">=" { set operation ">=" }
        "le" - "<="  { set operation "<=" }
        ""          {  }
        "!=" - "ne"  { set operation "!=" }
        default { error "ConvertToBpf error: Invalid filter operation: $operation" }
    }
    # VALUE
    set value [ lindex $filterParts 2 ]

    set result ""
    switch -regexp $field {
        {^eth\.}      { set result [ConvertToBpfEth $field $operation $value] }
        {^vlan\.}     { set result [ConvertToBpfVlan $field $operation $value] }
        {^ip\.}          { set result [ConvertToBpfIp $field $operation $value] }
        {^udp\.}      { set result [ConvertToBpfUdp $field $operation $value] }
        {^ipv6\.}     { set result [ConvertToBpfIpv6 $field $operation $value] }
        {^tcp\.}      { set result [ConvertToBpfTcp $field $operation $value] }
        default       { error "ConvertToBpf error: Unknown or unsupported filter protocol: $field\n   Contact byteblower@exentis.com if you require support for this." }
    }

    return $result
}

proc ConvertToBpfEth { field operation value } {
    # Convert Ethernet filter to bpf
    #
    # @param field : field name
    # @param operation : comparison operator
    # @param value : value to compare against

    set result ""
    set invert 0
    if { [string equal $operation "="]} {
        set invert 0
    } elseif { [string equal $operation "!="]} {
        set invert 1
        set operation "="
    } else {
        if { ! [string equal $field "eth.len"]} {
            error "ConvertToBpfEth error: Operation '$operation' not allowed on Ethernet protocol fields (except eth.len)\n   Contact byteblower@exentis.com if you require support for this."
        }
    }

    switch -exact $field {
        eth.dst {
            # Convert the value from 000102030405 to 00:01:02:03:04:05
            set result "ether dst $value"
        }
        eth.src {
            set result "ether src $value"
        }
        eth.type {
            set result "ether proto $value"
        }
        eth.len {
            set result "len $operation $value"
        }
        default {
            error "ConvertToBpfEth error: Unknown or unsupported Ethernet field: $field\n   Contact byteblower@exentis.com if you require support for this."
        }
    }
    if {$invert} {
        set result "!($result)"
    }

    return $result
}

proc ConvertToBpfVlan { field operation value } {
    # Convert VLAN filter to bpf
    #
    # @param field : field name
    # @param operation : comparison operator
    # @param value : value to compare against

    set result ""
    set invert 0
    if { [string equal $operation "="]} {
        set invert 0
    } elseif { [string equal $operation "!="]} {
        set invert 1
        set operation "="
    } else {
        error "ConvertToBpfVlan error: Operation '$operation' not allowed on VLAN protocol fields\n   Contact byteblower@exentis.com if you require support for this."
    }

    switch -exact $field {
        vlan.id {
            set result "vlan $value"
        }
        default {
            error "ConvertToBpfVlan error: Unknown or unsupported VLAN field: $field\n   Contact byteblower@exentis.com if you require support for this."
        }
    }
    if {$invert} {
        set result "!($result)"
    }

    return $result
}

proc ConvertToBpfIp { field operation value } {
    # Convert IP filter to bpf
    #
    # @param field : field name
    # @param operation : comparison operator
    # @param value : value to compare against

    set result ""
    set invert 0
    if { [string equal $operation "="]} {
        set invert 0
    } elseif { [string equal $operation "!="]} {
        set invert 1
        set operation "="
    } else {
        error "ConvertToBpfIp error: Operation '$operation' not allowed on IP protocol fields\n   Contact byteblower@exentis.com if you require support for this."
    }

    switch -exact $field {
        ip.dst {
            set result "ip dst $value"
        }
        ip.src {
            set result "ip src $value"
        }
        ip.version {
            set result "ip\[0\] & 0xF0 = $value"
        }
        ip.hdr_len {
            # Ip header length ( in words )
            set result "ip\[0\] & 0x0F = $value"
        }
        ip.tos {
            # Ip Type of Service
            set result "ip\[1\] = $value"
        }
        ip.len {
            # Ip Total Length
            set result "ip\[2:2\] $operation $value"
        }
        ip.id {
            # Ip identification
            set result "ip\[4:2\] = $value"
        }
        ip.flags.df {
            # Ip don't fragment flag
            set result "ip\[6\]  & 0x40 = [expr $value * 0x40]"
        }
        ip.flags.mf {
            # Ip more fragments flag
            set result "ip\[7\]  & 0x20 = [expr $value * 0x20]"
        }
        ip.frag_offset {
            # Ip fragment offset
            set result "ip\[7:2\]  & 0x1FFF = $value"
        }
        ip.ttl {
            # Ip time to live
            set result "ip\[8\] = $value"
        }
        ip.proto {
            # Higher layer protocol
            set result "ip\[9\] = $value"
        }
        ip.checksum {
            # Ip header checksum
            set result "ip\[10:2\] = $value"
        }
        default {
            error "ConvertToBpfIp error: Unknown or unsupported IP field: $field\n   Contact byteblower@exentis.com if you require support for this."
        }
    }
    if {$invert} {
        set result "!($result)"
    }

    return $result
}

proc ConvertToBpfUdp {field operation value} {
    # Convert UDP filter to bpf
    #
    # @param field : field name
    # @param operation : comparison operator
    # @param value : value to compare against

    set result ""
    set invert 0
    if { [string equal $operation "="]} {
        set invert 0
    } elseif { [string equal $operation "!="]} {
        set invert 1
        set operation "="
    } else {
        error "ConvertToBpfUdp error: Operation '$operation' not allowed on UDP protocol fields\n   Contact byteblower@exentis.com if you require support for this."
    }
    switch -exact $field {
        udp.srcport {
            set result "udp src port $value"
        }
        udp.dstport {
            set result "udp dst port $value"
        }
        udp.length {
            set result "udp\[4:2\] = $value"
        }
        udp.checksum {
            set result "udp\[6:2\] = $value"
        }
        default {
            error "ConvertToBpfUdp error: Unknown or unsupported UDP field: $field\n   Contact byteblower@exentis.com if you require support for this."
        }
    }
    if {$invert} {
        set result "!($result)"
    }
    return $result

}

proc ConvertToBpfTcp {field operation value} {
    # Convert TCP filter to bpf
    #
    # @param field : field name
    # @param operation : comparison operator
    # @param value : value to compare against

    set result ""
    set invert 0
    if { [string equal $operation "="]} {
        set invert 0
    } elseif { [string equal $operation "!="]} {
        set invert 1
        set operation "="
    } else {
        error "ConvertToBpfTcp error: Operation '$operation' not allowed on TCP protocol fields\n   Contact byteblower@exentis.com if you require support for this."
    }

    switch -exact $field {
        tcp.srcport {
            set result "tcp src port $value"
        }
        tcp.dstport {
            set result "tcp dst port $value"
        }
        default {
            error "ConvertToBpfTcp error: Unknown or unsupported TCP field: $field\n   Contact byteblower@exentis.com if you require support for this."
        }
    }
    if {$invert} {
        set result "!($result)"
    }
    return $result

}

proc ConvertToBpfIpv6 { field operation value } {
    # Convert IPv6 filter to bpf
    #
    # @param field : field name
    # @param operation : comparison operator
    # @param value : value to compare against

    set result ""
    set invert 0
    if { [string equal $operation "="]} {
        set invert 0
    } elseif { [string equal $operation "!="]} {
        set invert 1
        set operation "="
    } else {
        error "ConvertToBpfIpv6 error: Operation '$operation' not allowed on IPv6 protocol fields\n   Contact byteblower@exentis.com if you require support for this."
    }

    switch -exact $field {
        ipv6.dst {
            set result "ip6 dst $value"
        }
        ipv6.src {
            set result "ip6 src $value"
        }
        ipv6.version {
            set result "ip6\[0\] & 0xF0 = $value"
        }
        ipv6.class {
            # Ipv6 traffic class ( in words )
            set result "ip6\[0:2\] & 0x0FF0 = $value"
        }
        ipv6.flow {
            # Ip Type of Service
            set result "ip6\[1:3\] & 0x0FFFFF = $value"
        }
        ipv6.plen {
            # Ipv6 payload Length
            set result "ip6\[4:2\] $operation $value"
        }
        ipv6.nxt {
            # Ipv6 next header
            set result "ip6\[6\] = $value"
        }
        ipv6.hlim {
            # Ipv6 hop limit
            set result "ip6\[7\] = $value"
        }
        default {
            error "ConvertToBpfIpv6 error: Unknown or unsupported IPv6 field: $field\n   Contact byteblower@exentis.com if you require support for this."
        }
    }
    if {$invert} {
        set result "!($result)"
    }

    return $result
}


}

}