redhound 1.0.0 → 2.0.0.rc1

data/lib/redhound/filter/analyzer.rb

@@ -0,0 +1,197 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+require 'ipaddr'
+require 'socket'
+
+module Redhound
+  # @api private
+  module Filter
+    # @api private
+    class Analyzer
+      PROTOCOL_NUMBERS = { 'icmp' => 1, 'igmp' => 2, 'tcp' => 6, 'udp' => 17, 'ipv6' => 41,
+                           'ipv6-frag' => 44, 'esp' => 50, 'ah' => 51, 'icmp6' => 58,
+                           'ipv6-icmp' => 58, 'ospf' => 89, 'sctp' => 132 }.freeze
+      ETHER_TYPES = { 'ip' => 0x0800, 'ip6' => 0x86dd, 'arp' => 0x0806, 'rarp' => 0x8035,
+                      'vlan' => 0x8100 }.freeze
+
+      # @rbs (String expression) -> void
+      def initialize(expression)
+        @expression = expression
+      end
+
+      # @rbs (untyped node) -> untyped
+      def analyze(node)
+        case node[0]
+        when :and, :or then [node[0], analyze(node[1]), analyze(node[2])]
+        when :not then [:not, analyze(node[1])]
+        when :primitive then primitive(node)
+        when :relation then [:relation, arithmetic(node[1]), node[2], arithmetic(node[3])]
+        else node
+        end
+      end
+
+      private
+
+      # @rbs (untyped node) -> untyped
+      def primitive(node)
+        _, proto, direction, type, value, position = node
+        error('unsupported qualifier combination', position) if %w[tcp udp sctp].include?(proto) && !%i[port portrange protocol].include?(type)
+        case type
+        when :port, :portrange
+          error('ports require TCP, UDP or SCTP', position) if proto && !%w[tcp udp sctp].include?(proto)
+          value = ports(value, proto, type, position)
+        when :host, :net
+          if proto == 'ether'
+            error('Ethernet network qualifiers are unsupported', position) if type == :net
+            error('expected a MAC address', position) unless /\A(?:[\da-fA-F]{1,2}:){5}[\da-fA-F]{1,2}\z/.match?(value)
+            value = [value.split(':').map { |octet| octet.to_i(16) }.pack('C6')]
+          else
+            error('host qualifier requires ip, ip6, arp or rarp', position) if proto && !%w[ip ip6 arp rarp].include?(proto)
+            value = addresses(value, type, position)
+            value.select! { |family, _, _| proto == 'ip6' ? family == 6 : family == 4 } if proto
+            error('address family does not match qualifier', position) if value.empty?
+          end
+        when :proto
+          error('protocol qualifier cannot have a direction', position) unless direction == :either
+          error('proto requires ip, ip6 or ether', position) if proto && !%w[ip ip6 ether].include?(proto)
+          numbers = proto == 'ether' ? ETHER_TYPES : protocol_numbers
+          value = integer_or_name(value, numbers, position)
+          error('protocol number is out of range', position) unless value.between?(0, proto == 'ether' ? 65535 : 255)
+        when :vlan
+          error('VLAN ID is out of range', position) if value && !value.between?(0, 4095)
+        when :greater, :less
+          error('length is out of range', position) unless value.between?(0, 0xffffffff)
+        when :broadcast, :multicast
+          error('invalid broadcast/multicast protocol', position) if proto && !%w[ether ip ip6].include?(proto)
+          error('IPv6 has no broadcast address', position) if type == :broadcast && proto == 'ip6'
+        end
+        [:primitive, proto, direction, type, value, position]
+      end
+
+      # @rbs (untyped node) -> untyped
+      def arithmetic(node)
+        case node[0]
+        when :number
+          error('arithmetic constant is out of range', 0) unless node[1].between?(0, 0xffffffff)
+        when :binary
+          node = [:binary, node[1], arithmetic(node[2]), arithmetic(node[3])]
+          if %w[/ %].include?(node[1]) && node[3] == [:number, 0]
+            error('division by zero', 0)
+          end
+          if %w[<< >>].include?(node[1]) && node[3][0] == :number && node[3][1] > 31
+            error('shift count is out of range', 0)
+          end
+        when :neg then node = [:neg, arithmetic(node[1])]
+        when :access then node = [:access, node[1], arithmetic(node[2]), node[3]]
+        end
+        node
+      end
+
+      # @rbs (String value, String? proto, Symbol type, Integer position) -> untyped
+      def ports(value, proto, type, position)
+        values = type == :port ? [value, value] : value.split('-', 2)
+        error('portrange requires two port values', position) unless values.size == 2
+        result = {} #: untyped
+        candidates = proto ? [proto] : %w[tcp udp]
+        candidates.each do |protocol|
+          numbers = values.map do |part|
+            if /\A(?:0x[\da-fA-F]+|\d+)\z/.match?(part)
+              integer_or_name(part, {}, position)
+            else
+              error('expected a service name or port number', position) unless /\A[a-zA-Z][a-zA-Z0-9_-]*\z/.match?(part)
+              begin
+                Socket.getservbyname(part, protocol)
+              rescue SocketError
+                nil
+              end
+            end
+          end
+          next if numbers.any?(&:nil?)
+          numbers = numbers.compact
+          error('port number is out of range', position) unless numbers.all? { |port| port.between?(0, 65535) }
+          result[PROTOCOL_NUMBERS.fetch(protocol)] = numbers.minmax
+        end
+        error('unknown service name', position) if result.empty?
+        if !proto && result.values.uniq.size == 1
+          result[132] = result.values.first
+        end
+        result
+      end
+
+      # @rbs (String value, Symbol type, Integer position) -> untyped
+      def addresses(value, type, position)
+        address_parts = value.split(' mask ', 2)
+        address = address_parts.fetch(0)
+        mask = address_parts[1]
+        if /\A(?:\d+\.){0,3}\d+(?:\/\d+)?\z/.match?(address) || address.start_with?('0x')
+          cidr_parts = address.split('/', 2)
+          literal = cidr_parts.fetch(0)
+          cidr = cidr_parts[1]
+          octets = literal.split('.')
+          if octets.size == 1
+            number = integer_or_name(literal, {}, position)
+            error('IPv4 address is out of range', position) unless number.between?(0, 0xffffffff)
+            if type == :net && number <= 255
+              number <<= 24
+              prefix = 8
+            else
+              prefix = 32
+            end
+            ip = IPAddr.new([number].pack('N').unpack('C4').join('.'))
+          else
+            error('IPv4 octet is out of range', position) unless octets.all? { |part| part.to_i <= 255 }
+            prefix = octets.size * 8
+            ip = IPAddr.new((octets + Array.new(4 - octets.size, '0')).join('.'))
+          end
+          prefix = cidr.to_i if cidr
+          error('CIDR requires a network qualifier', position) if type == :host && cidr && prefix != 32
+          bitmask = mask ? IPAddr.new(mask).to_i : (0xffffffff << (32 - prefix)) & 0xffffffff
+          error('invalid IPv4 netmask', position) unless prefix.between?(0, 32) && ((~bitmask & 0xffffffff) & ((~bitmask & 0xffffffff) + 1)).zero?
+          error('non-network bits set in network address', position) if type == :net && (ip.to_i & bitmask) != ip.to_i
+          return [[4, ip.to_i & bitmask, bitmask]]
+        end
+        if address.include?(':')
+          ip = IPAddr.new(address)
+          error('expected IPv6 address', position) unless ip.ipv6?
+          prefix = address.include?('/') ? address.split('/').last.to_i : 128
+          error('CIDR requires a network qualifier', position) if type == :host && prefix != 128
+          return [[6, ip.to_i, ((1 << 128) - 1) ^ ((1 << (128 - prefix)) - 1)]]
+        end
+        error('network names must be numerical', position) if type == :net
+        Addrinfo.getaddrinfo(address, nil, nil, Socket::SOCK_DGRAM).map do |info|
+          ip = IPAddr.new(info.ip_address)
+          [ip.ipv4? ? 4 : 6, ip.to_i, ip.ipv4? ? 0xffffffff : ((1 << 128) - 1)]
+        end.uniq
+      rescue IPAddr::Error, SocketError, ArgumentError => e
+        error("invalid address #{value.inspect}: #{e.message}", position)
+      end
+
+      # @rbs (String value, Hash[String, Integer] names, Integer position) -> Integer
+      def integer_or_name(value, names, position)
+        value = value.delete_prefix('\\')
+        return names.fetch(value.downcase) if names.key?(value.downcase)
+        Integer(value, value.start_with?('0') && value.size > 1 ? 0 : 10)
+      rescue ArgumentError
+        error("unknown numeric value or name #{value.inspect}", position)
+      end
+
+      # @rbs () -> Hash[String, Integer]
+      def protocol_numbers
+        names = PROTOCOL_NUMBERS.dup
+        if ::File.readable?('/etc/protocols')
+          ::File.foreach('/etc/protocols') do |line|
+            tokens = line.split('#', 2).first.to_s.split
+            next unless tokens[1]&.match?(/\A\d+\z/)
+            ([tokens[0]] + tokens.drop(2)).each { |name| names[name] = tokens[1].to_i }
+          end
+        end
+        names
+      end
+
+      # @rbs (String message, Integer position) -> bot
+      def error(message, position)
+        raise FilterSyntaxError.new(message, expression: @expression, position: position)
+      end
+    end
+  end
+end

data/lib/redhound/filter/bpf/assembler.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Redhound
+  # @api private
+  module Filter
+    # @api private
+    module BPF
+      # @api private
+      class Assembler
+        # @rbs () -> void
+        def initialize
+          @items = [] #: untyped
+          @sequence = 0
+        end
+
+        # @rbs () -> Symbol
+        def label
+          @sequence += 1
+          "label_#{@sequence}".to_sym
+        end
+
+        # @rbs (Symbol label) -> void
+        def mark(label) = @items << [:label, label]
+
+        # @rbs (Integer code, ?Integer k) -> void
+        def emit(code, k = 0) = @items << [code, 0, 0, k & 0xffffffff]
+
+        # @rbs (Symbol target) -> void
+        def jump(target) = @items << [:jump, target]
+
+        # @rbs (Integer code, Integer k, Symbol yes, Symbol no) -> void
+        def branch(code, k, yes, no) = @items << [:branch, code, k & 0xffffffff, yes, no]
+
+        # @rbs () -> Array[[Integer, Integer, Integer, Integer]]
+        def assemble
+          compact!
+          widths = @items.map { |item| item[0] == :label ? 0 : 1 }
+          labels = {} #: untyped
+          loop do
+            offset = 0
+            @items.each_with_index do |item, index|
+              labels[item[1]] = offset if item[0] == :label
+              offset += widths[index]
+            end
+            raise FilterTooLarge, 'BPF programs are limited to 4096 instructions' if offset > 4096
+            changed = false
+            pc = 0
+            @items.each_with_index do |item, index|
+              if item[0] == :branch && widths[index] == 1 && [item[3], item[4]].any? { |target| labels.fetch(target) - pc - 1 > 255 }
+                widths[index] = 3
+                changed = true
+              end
+              pc += widths[index]
+            end
+            break unless changed
+          end
+          result = [] #: Array[[Integer, Integer, Integer, Integer]]
+          @items.each_with_index do |item, index|
+            pc = result.size
+            case item[0]
+            when :label then next
+            when :jump then result << [5, 0, 0, labels.fetch(item[1]) - pc - 1]
+            when :branch
+              _, code, k, yes, no = item
+              if widths[index] == 1
+                result << [code, labels.fetch(yes) - pc - 1, labels.fetch(no) - pc - 1, k]
+              else
+                result << [code, 0, 1, k]
+                result << [5, 0, 0, labels.fetch(yes) - pc - 2]
+                result << [5, 0, 0, labels.fetch(no) - pc - 3]
+              end
+            else result << item
+            end
+          end
+          result
+        end
+
+        private
+
+        # Remove unreachable blocks and thread jumps through unconditional jumps.
+        # @rbs () -> void
+        def compact!
+          labels = {} #: untyped
+          @items.each_with_index { |item, index| labels[item[1]] = index if item[0] == :label }
+          target = lambda do |name|
+            index = labels.fetch(name) + 1
+            index += 1 while @items[index]&.first == :label
+            @items[index]&.first == :jump ? target.call(@items[index][1]) : name
+          end
+          @items.each do |item|
+            item[1] = target.call(item[1]) if item[0] == :jump
+            if item[0] == :branch
+              item[3] = target.call(item[3])
+              item[4] = target.call(item[4])
+            end
+          end
+          reachable = {} #: Hash[Integer, bool]
+          pending = [0]
+          until pending.empty?
+            index = pending.pop
+            next if !index || index >= @items.size || reachable[index]
+            reachable[index] = true
+            item = @items[index]
+            case item[0]
+            when :jump then pending << labels.fetch(item[1])
+            when :branch then pending.concat([labels.fetch(item[3]), labels.fetch(item[4])])
+            when 6, 0x16 then next
+            else pending << index + 1
+            end
+          end
+          @items = @items.each_with_index.filter_map { |item, index| item if reachable[index] || item[0] == :label }
+          @items = @items.each_with_index.filter_map do |item, index|
+            following = @items[(index + 1)..].take_while { |next_item| next_item[0] == :label }
+            item unless item[0] == :jump && following.any? { |label_item| label_item[1] == item[1] }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/redhound/filter/bpf/disassembler.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Redhound
+  # @api private
+  module Filter
+    # @api private
+    module BPF
+      # @api private
+      module Disassembler
+        # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions, ?format: Symbol) -> String
+        def self.disassemble(instructions, format: :text)
+          case format
+          when :ruby
+            "[\n" + instructions.map { |code, jt, jf, k| format('  [0x%04x, %d, %d, 0x%08x],', code, jt, jf, k) }.join("\n") + "\n]\n"
+          when :decimal
+            "#{instructions.size}\n" + instructions.map { |i| i.join(' ') }.join("\n") + "\n"
+          when :text
+            instructions.each_with_index.map do |(code, jt, jf, k), index|
+              text = instruction(code, k)
+              text += " jt #{index + jt + 1} jf #{index + jf + 1}" if Validator::JUMPS.include?(code)
+              text = "ja #{index + k + 1}" if code == 5
+              format('(%03d) %s', index, text)
+            end.join("\n") + "\n"
+          else raise ArgumentError, "unknown disassembly format #{format.inspect}"
+          end
+        end
+
+        # @rbs (Integer code, Integer k) -> String
+        def self.instruction(code, k)
+          source = (code & 8).zero? ? "#0x#{k.to_s(16)}" : 'x'
+          case code & 7
+          when 0, 1
+            mnemonic = (code & 7).zero? ? 'ld' : 'ldx'
+            mnemonic += { 0 => '', 8 => 'h', 16 => 'b' }.fetch(code & 0x18)
+            operand = case code & 0xe0
+                      when 0 then "#0x#{k.to_s(16)}"
+                      when 0x20 then "[#{k}]"
+                      when 0x40 then "[x + #{k}]"
+                      when 0x60 then "M[#{k}]"
+                      when 0x80 then 'len'
+                      when 0xa0 then "4*([#{k}]&0xf)"
+                      end
+            "#{mnemonic} #{operand}"
+          when 2 then "st M[#{k}]"
+          when 3 then "stx M[#{k}]"
+          when 4
+            "#{ { 0 => 'add', 0x10 => 'sub', 0x20 => 'mul', 0x30 => 'div', 0x40 => 'or', 0x50 => 'and', 0x60 => 'lsh', 0x70 => 'rsh', 0x80 => 'neg', 0x90 => 'mod', 0xa0 => 'xor' }.fetch(code & 0xf0)} #{source}"
+          when 5 then "#{ { 0 => 'ja', 0x10 => 'jeq', 0x20 => 'jgt', 0x30 => 'jge', 0x40 => 'jset' }.fetch(code & 0xf0)} #{source}"
+          when 6 then "ret #{code == 0x16 ? 'a' : "##{k}"}"
+          when 7 then code == 7 ? 'tax' : 'txa'
+          else raise FilterError, 'invalid BPF opcode'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/redhound/filter/bpf/validator.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Redhound
+  # @api private
+  module Filter
+    # @api private
+    module BPF
+      # Validates the portable cBPF ISA and Linux VLAN ancillary loads.
+      # @api private
+      module Validator
+        LOADS = [0x00, 0x20, 0x28, 0x30, 0x40, 0x48, 0x50, 0x60, 0x80,
+                 0x01, 0x61, 0x81, 0xb1].freeze
+        ALU = [0x00, 0x10, 0x20, 0x30, 0x40, 0x50, 0x60, 0x70, 0x90, 0xa0].flat_map { |op| [op | 4, op | 12] }.freeze
+        JUMPS = [0x15, 0x1d, 0x25, 0x2d, 0x35, 0x3d, 0x45, 0x4d].freeze
+        OPCODES = (LOADS + ALU + JUMPS + [0x02, 0x03, 0x05, 0x06, 0x16, 0x07, 0x87, 0x84]).freeze
+
+        # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> bool
+        def self.validate!(instructions)
+          raise FilterError, 'BPF instructions must be an Array' unless instructions.is_a?(Array)
+          count = instructions.size
+          raise FilterTooLarge, 'BPF programs are limited to 4096 instructions' if count > 4096
+          raise FilterError, 'BPF program is empty' if count.zero?
+
+          instructions.each_with_index do |instruction, index|
+            unless instruction.is_a?(Array) && instruction.size == 4 && instruction.all? { |field| field.is_a?(Integer) }
+              raise FilterError, "invalid BPF instruction #{index}"
+            end
+            code, jt, jf, k = instruction
+            unless OPCODES.include?(code) && jt.between?(0, 255) && jf.between?(0, 255) && k.between?(0, 0xffffffff)
+              raise FilterError, "invalid BPF opcode or operand at #{index}"
+            end
+            raise FilterError, "invalid scratch address at #{index}" if [0x60, 0x61, 2, 3].include?(code) && k > 15
+            raise FilterError, "division by zero at #{index}" if [0x34, 0x94].include?(code) && k.zero?
+            raise FilterError, "invalid shift at #{index}" if [0x64, 0x74].include?(code) && k > 31
+            if [0x20, 0x28, 0x30].include?(code) && k >= 0xfffff000 && (code != 0x20 || ![0xfffff000, 0xfffff02c, 0xfffff030, 0xfffff03c].include?(k))
+              raise FilterError, "unsupported ancillary load at #{index}"
+            end
+            successors(code, jt, jf, k, index).each do |target|
+              raise FilterError, "invalid BPF jump at #{index}" unless target > index && target < count
+            end
+          end
+          raise FilterError, 'BPF program must end with RET' unless [6, 0x16].include?(instructions.last[0])
+          validate_memory!(instructions)
+          true
+        end
+
+        # @rbs (Integer code, Integer jt, Integer jf, Integer k, Integer index) -> Array[Integer]
+        def self.successors(code, jt, jf, k, index)
+          return [] if [6, 0x16].include?(code)
+          return [index + 1 + k] if code == 5
+          return [index + 1 + jt, index + 1 + jf] if JUMPS.include?(code)
+
+          [index + 1]
+        end
+
+        # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> void
+        def self.validate_memory!(instructions)
+          incoming = {} #: Hash[Integer, Integer]
+          incoming[0] = 0
+          instructions.each_with_index do |(code, jt, jf, k), index|
+            initialized = incoming[index]
+            next unless initialized
+            if [0x60, 0x61].include?(code) && (initialized & (1 << k)).zero?
+              raise FilterError, "uninitialized BPF scratch memory at #{index}"
+            end
+            initialized |= (1 << k) if [2, 3].include?(code)
+            successors(code, jt, jf, k, index).each do |target|
+              previous = incoming[target]
+              incoming[target] = previous ? previous & initialized : initialized
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/redhound/filter/bpf/vm.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+# rbs_inline: enabled
+
+module Redhound
+  # @api private
+  module Filter
+    # @api private
+    module BPF
+      # @api private
+      class VM
+        # @rbs (Array[[Integer, Integer, Integer, Integer]] instructions) -> void
+        def initialize(instructions)
+          Validator.validate!(instructions)
+          @instructions = instructions
+        end
+
+        # @rbs (untyped packet) -> Integer
+        def evaluate(packet)
+          a = 0
+          x = 0
+          memory = Array.new(16, 0)
+          pc = 0
+          loop do
+            code, jt, jf, k = @instructions.fetch(pc)
+            pc += 1
+            case code & 7
+            when 0, 1
+              value = case code & 0xe0
+                      when 0 then k
+                      when 0x60 then memory.fetch(k)
+                      when 0x80 then packet.original_length
+                      else
+                        offset = k + ((code & 0xe0) == 0x40 ? x : 0)
+                        if k >= 0xfffff000 && (code & 0xe0) == 0x20
+                          ancillary(k, packet.meta)
+                        else
+                          size = { 0x00 => 4, 0x08 => 2, 0x10 => 1 }.fetch(code & 0x18)
+                          return 0 if offset.negative? || offset + size > packet.data.bytesize
+                          packet.data.unpack1({ 4 => 'N', 2 => 'n', 1 => 'C' }.fetch(size), offset: offset)
+                        end
+                      end
+              if code == 0xb1
+                x = (value & 15) * 4
+              elsif (code & 7) == 1
+                x = value & 0xffffffff
+              else
+                a = value & 0xffffffff
+              end
+            when 2 then memory[k] = a
+            when 3 then memory[k] = x
+            when 4
+              operand = (code & 8).zero? ? k : x
+              return 0 if [0x30, 0x90].include?(code & 0xf0) && operand.zero?
+              a = arithmetic(code & 0xf0, a, operand) & 0xffffffff
+            when 5
+              if code == 5
+                pc += k
+              else
+                operand = (code & 8).zero? ? k : x
+                result = case code & 0xf0
+                         when 0x10 then a == operand
+                         when 0x20 then a > operand
+                         when 0x30 then a >= operand
+                         when 0x40 then (a & operand) != 0
+                         end
+                pc += result ? jt : jf
+              end
+            when 6 then return code == 0x16 ? a : k
+            when 7
+              code == 7 ? x = a : a = x
+            end
+          end
+        end
+
+        private
+
+        # @rbs (Integer operation, Integer a, Integer operand) -> Integer
+        def arithmetic(operation, a, operand)
+          case operation
+          when 0x00 then a + operand
+          when 0x10 then a - operand
+          when 0x20 then a * operand
+          when 0x30 then a / operand
+          when 0x40 then a | operand
+          when 0x50 then a & operand
+          when 0x60 then operand >= 32 ? 0 : a << operand
+          when 0x70 then operand >= 32 ? 0 : a >> operand
+          when 0x80 then -a
+          when 0x90 then a % operand
+          when 0xa0 then a ^ operand
+          else 0
+          end
+        end
+
+        # @rbs (Integer offset, untyped meta) -> Integer
+        def ancillary(offset, meta)
+          case offset
+          when 0xfffff000 then meta.fetch(:protocol, 0)
+          when 0xfffff030 then meta.key?(:vlan_tci) ? 1 : 0
+          when 0xfffff02c then meta.fetch(:vlan_tci, 0)
+          when 0xfffff03c then meta.fetch(:vlan_tpid, 0x8100)
+          else 0
+          end
+        end
+      end
+    end
+  end
+end