bpfc xor and mod instructions

[John Lange]

Greetings,

I'm having difficulty with bpfc when using the mod and xor instructions.  These instructions compile fine, but trying to load them gives the error message:

Cannot attach filter to socket!

Here's a simple example (which doesn't do anything useful) to demonstrate the issue:

                ldh [12]

                mod #8

                jeq #0,Keep,Drop

Keep:           ret #0xffffffff    ; Return full packet

Drop:           ret #0             ; Discard packet

which produces:

{ 0x28, 0, 0, 0x0000000c },

{ 0x94, 0, 0, 0x00000008 },

{ 0x15, 0, 1, 0x00000000 },

{ 0x6, 0, 0, 0xffffffff },

{ 0x6, 0, 0, 0x00000000 },

When run with 'netsniff-ng -i <ethN> -f <bpfc output file>, it produces the error above. Other operation instructions work fine, although I haven't tried them all.

Thanks,

John

PS I've tried to post this question from https://groups.google.com/forum/?fromgroups#!forum/netsniff-ng twice, but my post hasn't show up, so I'm trying to email it instead.  My apologies if this same question shows up a few more times in the forum. 

[Daniel Borkmann]

On 05/23/2013 11:50 PM, John Lange wrote:
> Greetings,
>
> I'm having difficulty with bpfc when using the mod and xor instructions. These instructions compile fine, but trying to load them gives the error message:
> Cannot attach filter to socket!
>
> Here's a simple example (which doesn't do anything useful) to demonstrate the issue:
> ldh [12]
> mod #8
> jeq #0,Keep,Drop
> Keep: ret #0xffffffff ; Return full packet
> Drop: ret #0 ; Discard packet
>
> which produces:
> { 0x28, 0, 0, 0x0000000c },
> { 0x94, 0, 0, 0x00000008 },
> { 0x15, 0, 1, 0x00000000 },
> { 0x6, 0, 0, 0xffffffff },
> { 0x6, 0, 0, 0x00000000 },
>
> When run with 'netsniff-ng -i <ethN> -f <bpfc output file>, it produces the error above. Other operation instructions work fine, although I haven't tried them all.

mod and xor were added in later kernels, what kernel version
do you run?

Cheers,

Daniel

[John Lange]

I'm using the latest Centos 6.4, kernel 2.6.32-358.

Thanks,
John

[Daniel Borkmann]

On 05/23/2013 11:56 PM, John Lange wrote:
> I'm using the latest Centos 6.4, kernel 2.6.32-358.

Unfortunately xor and mod were added later than that,
just checked, it's not part of 2.6.32-358. If you have
the chance, upgrading your kernel would be an option.

[John Lange]

That explains it. Thanks for checking!