diff --git a/ebpfcat/ebpf.py b/ebpfcat/ebpf.py
index 5f78e25a8912ac7cf8cab0d1cedc2b6bd80aaad9..f1949e6d8bfa41174334bbf222f5ba2ba43a9f92 100644
--- a/ebpfcat/ebpf.py
+++ b/ebpfcat/ebpf.py
@@ -230,6 +230,8 @@ class Opcode(Enum):
ST = 0x62
STX = 0x63
XADD = 0xc3
+ LE = 0xd4
+ BE = 0xdc
def __mul__(self, value):
if value:
@@ -606,6 +608,7 @@ class Expression:
with self.get_address(dst, long) as (src, fmt):
self.ebpf.append(Opcode.LD + fmt_to_opcode(fmt),
dst, src, 0, 0)
+ self.ebpf.append_endian(fmt, dst)
yield dst, long
@contextmanager
@@ -923,6 +926,7 @@ class Memory(Expression):
opcode = fmt_to_opcode(self.fmt)
self.ebpf.append(Opcode.LD + opcode, dst, self.address.left.no,
self.address.right.value, 0)
+ self.ebpf.append_endian(self.fmt, dst)
else:
dst, _ = exitStack.enter_context(
super().calculate(dst, long, force))
@@ -1005,7 +1009,10 @@ class MemoryDesc:
value = value.value
opcode = Opcode.XADD
elif not isinstance(value, Expression):
- value = Constant(ebpf, value)
+ if fmt == "x":
+ value = Constant(ebpf, value)
+ else:
+ value = Constant(ebpf, *unpack(fmt, pack(fmt[-1], value)))
if self.fmt == "x" and not value.fixed:
value *= Expression.FIXED_BASE
elif self.fmt != "x" and value.fixed:
@@ -1016,6 +1023,8 @@ class MemoryDesc:
return
with value.calculate(None, isinstance(fmt, str) and fmt[-1] in 'qQx'
) as (src, _):
+ if not isinstance(value, Constant):
+ ebpf.append_endian(fmt, src)
ebpf.append(opcode + fmt_to_opcode(fmt), self.base_register,
src, addr, 0)
@@ -1083,6 +1092,8 @@ class MemoryMap:
offset, int(value.value))
return
with value.calculate(None, None) as (src, _):
+ if not isinstance(value, Constant):
+ self.ebpf.append_endian(self.fmt, src)
self.ebpf.append(opcode + fmt_to_opcode(self.fmt),
dst, src, offset, 0)
@@ -1279,6 +1290,16 @@ class EBPF:
def append(self, opcode, dst, src, off, imm):
self.opcodes.append(Instruction(opcode, dst, src, off, imm))
+ def append_endian(self, fmt, dst):
+ if not isinstance(fmt, str) or len(fmt) != 2:
+ return
+ endian, size = fmt
+ if endian == "<":
+ opcode = Opcode.LE
+ elif endian in ">!":
+ opcode = Opcode.BE
+ self.append(opcode, dst, 0, 0, calcsize(fmt) * 8)
+
def assemble(self):
"""return the assembled program"""
sub(EBPF, self).program()
diff --git a/ebpfcat/ebpf.rst b/ebpfcat/ebpf.rst
index a09594efea4f9149c3b6564e5a67723f2fa48ed3..8184d415aef76e63b2a9e19acd32b69e0a9d8ebc 100644
--- a/ebpfcat/ebpf.rst
+++ b/ebpfcat/ebpf.rst
@@ -144,16 +144,17 @@ is too small (by default ``XDPExitCode.PASS``). So the above example becomes::
With the ``PacketVar`` descriptor it is possible to declare certain positions
in the packet as variables. As parameters it takes the position within the
packet, and the data format, following the conventions from the Python
-``struct`` package. So the above example simplifies to::
+``struct`` package, including the endianness markers ``<>!``. So the above
+example simplifies to::
class Program(XDP):
minimumPacketSize = 16
userspace = HashMap()
count = userspace.globalVar()
- etherType = PacketVar(12, "H")
+ etherType = PacketVar(12, "!H") # use network byte order
def program(self):
- with self.etherType == 8:
+ with self.etherType == 0x800:
self.count += 1
diff --git a/ebpfcat/ebpf_test.py b/ebpfcat/ebpf_test.py
index 6d27e2f80e1c82607d77f675a860e96f3de0015d..0b36f0262499c01559305209c0f3b8fbd6a4e4cc 100644
--- a/ebpfcat/ebpf_test.py
+++ b/ebpfcat/ebpf_test.py
@@ -900,6 +900,57 @@ class Tests(TestCase):
Instruction(opcode=O.JMP, dst=0, src=0, off=1, imm=0),
Instruction(opcode=O.MOV+O.LONG, dst=3, src=0, off=0, imm=77)])
+ def test_endian(self):
+ class P(XDP):
+ minimumPacketSize = 100
+
+ ph = PacketVar(20, "<H")
+ pi = PacketVar(28, ">i")
+ pq = PacketVar(36, "!q")
+
+ pp = PacketVar(100, "Q")
+
+ def program(self):
+ self.ph = 3
+ self.pi = 5
+ self.pq = 7
+
+ self.ph += 3
+ self.pi += 5
+ self.pq = self.ph
+
+ e = P(license="GPL")
+ e.assemble()
+ self.assertEqual(e.opcodes, [
+ Instruction(opcode=O.W+O.LD, dst=9, src=1, off=0, imm=0),
+ Instruction(opcode=O.W+O.LD, dst=0, src=1, off=4, imm=0),
+ Instruction(opcode=O.W+O.LD, dst=2, src=1, off=0, imm=0),
+ Instruction(opcode=O.LONG+O.ADD, dst=2, src=0, off=0, imm=100),
+ Instruction(opcode=O.JLE+O.REG, dst=0, src=2, off=19, imm=0),
+ Instruction(opcode=O.ST+O.REG, dst=9, src=0, off=20, imm=3),
+ Instruction(opcode=O.W+O.ST, dst=9, src=0, off=28, imm=83886080),
+ Instruction(opcode=O.DW, dst=0, src=0, off=0, imm=0),
+ Instruction(opcode=O.W, dst=0, src=0, off=0, imm=117440512),
+ Instruction(opcode=O.DW+O.STX, dst=9, src=0, off=36, imm=0),
+ Instruction(opcode=O.LD+O.REG, dst=0, src=9, off=20, imm=0),
+ Instruction(opcode=O.LE, dst=0, src=0, off=0, imm=16),
+ Instruction(opcode=O.ADD, dst=0, src=0, off=0, imm=3),
+ Instruction(opcode=O.LE, dst=0, src=0, off=0, imm=16),
+ Instruction(opcode=O.REG+O.STX, dst=9, src=0, off=20, imm=0),
+ Instruction(opcode=O.W+O.LD, dst=0, src=9, off=28, imm=0),
+ Instruction(opcode=O.BE, dst=0, src=0, off=0, imm=32),
+ Instruction(opcode=O.ADD, dst=0, src=0, off=0, imm=5),
+ Instruction(opcode=O.BE, dst=0, src=0, off=0, imm=32),
+ Instruction(opcode=O.W+O.STX, dst=9, src=0, off=28, imm=0),
+ Instruction(opcode=O.LD+O.REG, dst=0, src=9, off=20, imm=0),
+ Instruction(opcode=O.LE, dst=0, src=0, off=0, imm=16),
+ Instruction(opcode=O.BE, dst=0, src=0, off=0, imm=64),
+ Instruction(opcode=O.DW+O.STX, dst=9, src=0, off=36, imm=0),
+ Instruction(opcode=O.LONG+O.MOV, dst=0, src=0, off=0, imm=2),
+ Instruction(opcode=O.EXIT, dst=0, src=0, off=0, imm=0),
+ ])
+
+
def test_xdp_minsize(self):
class P(XDP):
minimumPacketSize = 100