BPF - Convert binary pattern matching to classic BPF programs

Very cool! Do you have any example setup for how to call libpcap with it?

Not currently.

If you specifically want libpcap integration (i.e. take a dependency on libpcap.so/dylib at runtime). You could write a NIF that takes the interface and the assembled bytes and does something like:

// validation / error handling elided
ErlNifBinary prog;
enif_inspect_binary(env, argv[1], &prog)

struct bpf_program fp;
fp.bf_len = prog.size >> 3; // instructions, not bytes, so divide by 8
fp.bf_insns = (struct bpf_insn *)prog.data
pcap_setfilter(handle, &fp);

If i was doing this, i’d use pcap_get_selectable_fd and then integrate it with enif_select_read to avoid any blocking issues and play nicely with the scheduler (or stick the pcap loop on a thread, and mark it as a dirty nif, but i prefer to not manage threads in my NIFs)

If you’re (only) on Linux you can skip most of this and set it all up through the erlang :socket module directly using raw sockets at the link or ip layer depending on your use case. Unfortunately, you still need a (tiny) NIF to handle setting the SO_ATTACH_FILTER options as the C struct it takes is not describable in Erlang (it contains pointers)

On the elixir side:

{:ok, filter} = BPF.assemble(prog)
{:ok, fd} = :socket.get_opt(sock, {:otp, :fd})
:ok = Nif.attach_filter(fd, filter)

On the C side:

int fd;
enif_get_int(env, argv[0], &fd);
ErlNifBinary prog;
enif_inspect_binary(env, argv[1], &prog)

struct sock_sock_fprog bpf = {
    .len = prog.size >>> 3;
    .filter = (struct sock_filter*)prog.data;
};
setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf));

You can then read the sock on the elixir side.

(None of the above code is tested, I’m winging it)

Gotcha, so it generates a struct sock_filter, I see, thanks. I will try to play with it then. Again, looks very interesting

I just did it anyway. I haven’t published a package for it yet, but I probably will.

https://github.com/ausimian/peacap

I published it. I’ve tested it on macos and linux, but i haven’t stressed it.

D:

That’s very nice. I can finally play with covert channels in Elixir. I think this library deserves a separate topic!