LightBPF 1.0.0__py3-none-any.whl

LightBPF/Compiler.py

@@ -0,0 +1,1300 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+"""
+LightBPF Compiler: Compiles AST from BpfParser into classic BPF (cBPF) bytecode.
+Fully compatible with all AST nodes, operators, and constructs generated by
+LightBPF.Parser and LightBPF.Lexer.
+"""
+
+from dataclasses import dataclass
+import struct
+import socket
+import ipaddress
+import ctypes
+from typing import List, Optional, Tuple, Dict, Any, Union
+
+try:
+    from LightPacket.LightBPF.Lexer import BpfLexer
+    from LightPacket.LightBPF.Parser import (
+        BpfParser, ASTNode, BinaryOpNode, UnaryOpNode, ProtocolNode,
+        KeywordFilterNode, ByteAccessNode, LengthNode, NumberNode,
+        LiteralNode, FieldNode
+    )
+except ImportError:
+    from LightBPF.Lexer import BpfLexer
+    from LightBPF.Parser import (
+        BpfParser, ASTNode, BinaryOpNode, UnaryOpNode, ProtocolNode,
+        KeywordFilterNode, ByteAccessNode, LengthNode, NumberNode,
+        LiteralNode, FieldNode
+    )
+
+# ----------------------------------------------------------------------
+# Standard Classic BPF (cBPF) Constants & Opcodes
+# ----------------------------------------------------------------------
+
+# Instruction Classes (code & 0x07)
+BPF_LD   = 0x00
+BPF_LDX  = 0x01
+BPF_ST   = 0x02
+BPF_STX  = 0x03
+BPF_ALU  = 0x04
+BPF_JMP  = 0x05
+BPF_RET  = 0x06
+BPF_MISC = 0x07
+
+# Size Modifiers for LD / LDX (code & 0x18)
+BPF_W = 0x00  # 32 bits (4 bytes)
+BPF_H = 0x08  # 16 bits (2 bytes)
+BPF_B = 0x10  # 8 bits (1 byte)
+
+# Addressing Modes for LD / LDX (code & 0xe0)
+BPF_IMM = 0x00  # Immediate value
+BPF_ABS = 0x20  # Absolute packet offset
+BPF_IND = 0x40  # Packet offset indexed by Register X
+BPF_MEM = 0x60  # Scratch memory M[k]
+BPF_LEN = 0x80  # Packet length
+BPF_MSH = 0xa0  # 4 * (packet[k] & 0x0f) -> loaded into X (IPv4 IHL)
+
+# ALU Operations (code & 0xf0)
+BPF_ADD = 0x00
+BPF_SUB = 0x10
+BPF_MUL = 0x20
+BPF_DIV = 0x30
+BPF_OR  = 0x40
+BPF_AND = 0x50
+BPF_LSH = 0x60
+BPF_RSH = 0x70
+BPF_NEG = 0x80
+BPF_MOD = 0x90
+BPF_XOR = 0xa0
+
+# Jump Operations (code & 0xf0)
+BPF_JA   = 0x00
+BPF_JEQ  = 0x10
+BPF_JGT  = 0x20
+BPF_JGE  = 0x30
+BPF_JSET = 0x40
+
+# Source Operand (code & 0x08)
+BPF_K = 0x00  # Constant / Immediate
+BPF_X = 0x08  # Register X
+
+# Misc Operations (code & 0xf8)
+BPF_TAX = 0x00  # Register X = Register A
+BPF_TXA = 0x80  # Register A = Register X
+
+# Return operand mode
+BPF_A = 0x10
+
+# Snaplen / Accept length
+BPF_MAX_BUF_LEN = 0x40000  # 262144 bytes
+
+# Well-known Protocol EtherTypes
+ETHERTYPE_MAP = {
+    "ip": 0x0800,
+    "ip4": 0x0800,
+    "ipv4": 0x0800,
+    "ip6": 0x86DD,
+    "ipv6": 0x86DD,
+    "arp": 0x0806,
+    "rarp": 0x8035,
+    "vlan": 0x8100,
+    "mpls": 0x8847,
+    "pppoed": 0x8863,
+    "pppoes": 0x8864,
+}
+
+# Standard Services Port Map
+COMMON_SERVICES: Dict[str, int] = {
+    "echo": 7,
+    "discard": 9,
+    "ftp-data": 20,
+    "ftp": 21,
+    "ssh": 22,
+    "telnet": 23,
+    "smtp": 25,
+    "time": 37,
+    "nameserver": 42,
+    "nicname": 43,
+    "domain": 53,
+    "dns": 53,
+    "bootps": 67,
+    "bootpc": 68,
+    "tftp": 69,
+    "gopher": 70,
+    "finger": 79,
+    "http": 80,
+    "www": 80,
+    "kerberos": 88,
+    "pop2": 109,
+    "pop3": 110,
+    "sunrpc": 111,
+    "auth": 113,
+    "sftp": 115,
+    "nntp": 119,
+    "ntp": 123,
+    "netbios-ns": 137,
+    "netbios-dgm": 138,
+    "netbios-ssn": 139,
+    "imap": 143,
+    "snmp": 161,
+    "snmptrap": 162,
+    "bgp": 179,
+    "ldap": 389,
+    "https": 443,
+    "microsoft-ds": 445,
+    "ldaps": 636,
+    "rsync": 873,
+    "imaps": 993,
+    "pop3s": 995,
+    "openvpn": 1194,
+    "mysql": 3306,
+    "rdp": 3389,
+    "postgresql": 5432,
+    "http-alt": 8080,
+    "squid": 3128,
+}
+
+# Pseudo-field byte offsets and sizes
+FIELD_OFFSETS: Dict[str, Tuple[int, int]] = {
+    "tcpflags": (13, 1),
+    "icmptype": (0, 1),
+    "icmpcode": (1, 1),
+    "icmp6type": (0, 1),
+    "icmp6code": (1, 1),
+}
+
+
+# ----------------------------------------------------------------------
+# Instruction Representation
+# ----------------------------------------------------------------------
+@dataclass
+class Instruction:
+    code: int
+    jt: Union[int, str]
+    jf: Union[int, str]
+    k: Union[int, str]
+
+    def to_bytes(self) -> bytes:
+        """Pack into 8-byte Linux/BSD struct bpf_insn format."""
+        jt_val = self.jt if isinstance(self.jt, int) else 0
+        jf_val = self.jf if isinstance(self.jf, int) else 0
+        k_val = self.k if isinstance(self.k, int) else 0
+        return struct.pack("HBBI", self.code, jt_val, jf_val, k_val & 0xFFFFFFFF)
+
+    def __repr__(self) -> str:
+        return (
+            f"Instruction(code=0x{self.code:02x}, "
+            f"jt={self.jt}, jf={self.jf}, k=0x{self.k:x if isinstance(self.k, int) else self.k})"
+        )
+
+
+class bpf_insn(ctypes.Structure):
+    _fields_ = [
+        ("code", ctypes.c_uint16),
+        ("jt", ctypes.c_uint8),
+        ("jf", ctypes.c_uint8),
+        ("k", ctypes.c_uint32),
+    ]
+
+
+class sock_fprog(ctypes.Structure):
+    _fields_ = [
+        ("len", ctypes.c_ushort),
+        ("filter", ctypes.POINTER(bpf_insn)),
+    ]
+
+
+# ----------------------------------------------------------------------
+# Compiler Core
+# ----------------------------------------------------------------------
+class BpfCompiler:
+    """
+    Classic BPF (cBPF) Bytecode Compiler.
+    Translates AST from BpfParser into verified cBPF instructions.
+    """
+
+    def __init__(self):
+        self.instructions: List[Union[Instruction, str]] = []
+        self._label_counter = 0
+        self._scratch_counter = 0
+
+    def _new_label(self, prefix: str = "L") -> str:
+        self._label_counter += 1
+        return f"{prefix}_{self._label_counter}"
+
+    def _emit(self, instr: Instruction):
+        self.instructions.append(instr)
+
+    def _emit_label(self, label_name: str):
+        self.instructions.append(f"LABEL:{label_name}")
+
+    def compile(self, ast_root: ASTNode) -> List[Instruction]:
+        """Compile an AST into assembled BPF bytecode."""
+        self.instructions = []
+        self._label_counter = 0
+        self._scratch_counter = 0
+
+        true_label, false_label = "ACCEPT", "REJECT"
+
+        self._compile_bool(ast_root, true_label, false_label)
+
+        return self._assemble_and_backpatch(true_label, false_label)
+
+    @classmethod
+    def compile_str(cls, filter_string: str) -> List[Instruction]:
+        """Convenience method: Tokenize, parse, and compile a filter string."""
+        tokens = BpfLexer(filter_string).tokenize()
+        ast = BpfParser(tokens).parse()
+        return cls().compile(ast)
+
+    @staticmethod
+    def to_bytes(instructions: List[Instruction]) -> bytes:
+        """Convert a list of instructions to raw byte string."""
+        return b"".join(instr.to_bytes() for instr in instructions)
+
+    @staticmethod
+    def to_fprog(instructions: List[Instruction]) -> sock_fprog:
+        """Convert instruction list to ctypes sock_fprog structure."""
+        arr_type = bpf_insn * len(instructions)
+        insn_arr = arr_type()
+        for idx, instr in enumerate(instructions):
+            insn_arr[idx].code = instr.code
+            insn_arr[idx].jt = instr.jt if isinstance(instr.jt, int) else 0
+            insn_arr[idx].jf = instr.jf if isinstance(instr.jf, int) else 0
+            insn_arr[idx].k = (instr.k if isinstance(instr.k, int) else 0) & 0xFFFFFFFF
+        return sock_fprog(len(instructions), ctypes.cast(insn_arr, ctypes.POINTER(bpf_insn)))
+
+    # ------------------------------------------------------------------
+    # Boolean Expressions & Short-Circuit Evaluation
+    # ------------------------------------------------------------------
+    def _compile_bool(self, node: ASTNode, true_target: str, false_target: str):
+        if isinstance(node, BinaryOpNode):
+            if node.op == "and":
+                next_label = self._new_label("and")
+                self._compile_bool(node.left, next_label, false_target)
+                self._emit_label(next_label)
+                self._compile_bool(node.right, true_target, false_target)
+
+            elif node.op == "or":
+                next_label = self._new_label("or")
+                self._compile_bool(node.left, true_target, next_label)
+                self._emit_label(next_label)
+                self._compile_bool(node.right, true_target, false_target)
+
+            elif node.op in ("==", "!=", ">", ">=", "<", "<="):
+                self._compile_comparison(node, true_target, false_target)
+
+            elif node.op == "&":
+                # Bitwise test used as boolean: e.g. (tcp[13] & 2)
+                # Tests if (A & right) != 0
+                self._compile_bitwise_bool(node, true_target, false_target)
+
+            else:
+                # Standalone arithmetic expression: truthy if != 0
+                self._compile_value(node)
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, false_target, true_target, 0))
+
+        elif isinstance(node, UnaryOpNode) and node.op == "not":
+            self._compile_bool(node.expr, false_target, true_target)
+
+        elif isinstance(node, ProtocolNode):
+            self._compile_protocol(node, true_target, false_target)
+
+        elif isinstance(node, KeywordFilterNode):
+            self._compile_keyword(node, true_target, false_target)
+
+        elif isinstance(node, ByteAccessNode):
+            self._compile_value(node)
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, false_target, true_target, 0))
+
+        elif isinstance(node, (NumberNode, LengthNode, FieldNode)):
+            self._compile_value(node)
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, false_target, true_target, 0))
+
+        else:
+            raise NotImplementedError(f"Unsupported boolean AST node: {type(node).__name__}")
+
+    def _compile_bitwise_bool(self, node: BinaryOpNode, true_target: str, false_target: str):
+        """Compile bitwise & expression used directly in boolean position."""
+        if isinstance(node.right, NumberNode):
+            self._compile_value(node.left)
+            self._emit(Instruction(BPF_JMP | BPF_JSET | BPF_K, true_target, false_target, node.right.value))
+        else:
+            # Right side is complex
+            scratch = self._alloc_scratch()
+            self._compile_value(node.right)
+            self._emit(Instruction(BPF_ST, 0, 0, scratch))
+            self._compile_value(node.left)
+            self._emit(Instruction(BPF_LDX | BPF_MEM, 0, 0, scratch))
+            self._free_scratch()
+            self._emit(Instruction(BPF_JMP | BPF_JSET | BPF_X, true_target, false_target, 0))
+
+    def _compile_comparison(self, node: BinaryOpNode, true_target: str, false_target: str):
+        # Special optimization for idiomatic bitmask test: expr & MASK != 0 or expr & MASK == 0
+        if (isinstance(node.left, BinaryOpNode) and node.left.op == "&" and
+                isinstance(node.right, NumberNode) and node.right.value == 0 and
+                isinstance(node.left.right, NumberNode)):
+            mask = node.left.right.value
+            self._compile_value(node.left.left)
+            if node.op == "!=":
+                self._emit(Instruction(BPF_JMP | BPF_JSET | BPF_K, true_target, false_target, mask))
+            elif node.op == "==":
+                self._emit(Instruction(BPF_JMP | BPF_JSET | BPF_K, false_target, true_target, mask))
+            elif node.op in (">", ">="):
+                # Since A & mask >= 0 is always true (unsigned), > 0 means != 0
+                self._emit(Instruction(BPF_JMP | BPF_JSET | BPF_K, true_target, false_target, mask))
+            return
+
+        # Check if right operand is immediate constant
+        if isinstance(node.right, NumberNode):
+            self._compile_value(node.left)
+            val = node.right.value
+
+            if node.op == "==":
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, val))
+            elif node.op == "!=":
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, false_target, true_target, val))
+            elif node.op == ">":
+                self._emit(Instruction(BPF_JMP | BPF_JGT | BPF_K, true_target, false_target, val))
+            elif node.op == ">=":
+                self._emit(Instruction(BPF_JMP | BPF_JGE | BPF_K, true_target, false_target, val))
+            elif node.op == "<":
+                # A < K  <=>  !(A >= K)
+                self._emit(Instruction(BPF_JMP | BPF_JGE | BPF_K, false_target, true_target, val))
+            elif node.op == "<=":
+                # A <= K  <=>  !(A > K)
+                self._emit(Instruction(BPF_JMP | BPF_JGT | BPF_K, false_target, true_target, val))
+        else:
+            # Complex right side: evaluate right -> scratch -> evaluate left -> compare with X
+            scratch = self._alloc_scratch()
+            self._compile_value(node.right)
+            self._emit(Instruction(BPF_ST, 0, 0, scratch))
+            self._compile_value(node.left)
+            self._emit(Instruction(BPF_LDX | BPF_MEM, 0, 0, scratch))
+            self._free_scratch()
+
+            if node.op == "==":
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_X, true_target, false_target, 0))
+            elif node.op == "!=":
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_X, false_target, true_target, 0))
+            elif node.op == ">":
+                self._emit(Instruction(BPF_JMP | BPF_JGT | BPF_X, true_target, false_target, 0))
+            elif node.op == ">=":
+                self._emit(Instruction(BPF_JMP | BPF_JGE | BPF_X, true_target, false_target, 0))
+            elif node.op == "<":
+                self._emit(Instruction(BPF_JMP | BPF_JGE | BPF_X, false_target, true_target, 0))
+            elif node.op == "<=":
+                self._emit(Instruction(BPF_JMP | BPF_JGT | BPF_X, false_target, true_target, 0))
+
+    # ------------------------------------------------------------------
+    # Protocol Checks
+    # ------------------------------------------------------------------
+    def _compile_protocol(self, node: ProtocolNode, true_target: str, false_target: str):
+        proto_name = node.name.lower()
+
+        # Link-layer protocols / EtherType
+        if proto_name in ("ether", "link"):
+            # Always true for link-layer frames
+            self._emit(Instruction(BPF_JMP | BPF_JA, 0, 0, true_target))
+            return
+
+        if proto_name in ("arp", "rarp"):
+            ethertype = 0x0806 if proto_name == "arp" else 0x8035
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, ethertype))
+            return
+
+        if proto_name in ("ip", "ip4", "ipv4"):
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, 0x0800))
+            return
+
+        if proto_name in ("ip6", "ipv6"):
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, 0x86DD))
+            return
+
+        if proto_name == "vlan":
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            # 0x8100 (standard 802.1Q) or 0x88a8 (802.1ad QinQ)
+            vlan_ok = self._new_label("vlan_ok")
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, vlan_ok, 0x8100))
+            self._emit_label(vlan_ok)
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, 0x88a8))
+            return
+
+        if proto_name == "mpls":
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            mpls_ok = self._new_label("mpls_ok")
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, mpls_ok, 0x8847))
+            self._emit_label(mpls_ok)
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, 0x8848))
+            return
+
+        # Transport & Network protocols (e.g. tcp, udp, icmp, icmp6, etc.)
+        proto_num = None
+        if proto_name in BpfLexer.IP_PROTOCOLS:
+            proto_num = BpfLexer.IP_PROTOCOLS[proto_name]
+        elif node.proto_num is not None:
+            proto_num = node.proto_num
+
+        if proto_num is not None:
+            if proto_name == "icmp6":
+                # ICMPv6 only runs over IPv6 (next header byte 20 == 58)
+                check_ip6 = self._new_label("ip6")
+                self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, check_ip6, false_target, 0x86DD))
+                self._emit_label(check_ip6)
+                self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 20))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, 58))
+                return
+
+            # Support matching over IPv4 (protocol byte 23) or IPv6 (next header byte 20)
+            check_ip4 = self._new_label("check_ip4")
+            check_ip6 = self._new_label("check_ip6")
+
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, check_ip4, check_ip6, 0x0800))
+
+            self._emit_label(check_ip4)
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 23))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, proto_num))
+
+            self._emit_label(check_ip6)
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x86DD))
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 20))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, proto_num))
+            return
+
+        raise NotImplementedError(f"Unsupported protocol: '{proto_name}'")
+
+    # ------------------------------------------------------------------
+    # Keyword Filters
+    # ------------------------------------------------------------------
+    def _compile_keyword(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        kw = node.keyword
+
+        if kw == "host":
+            self._compile_host_filter(node, true_target, false_target)
+        elif kw == "net":
+            self._compile_net_filter(node, true_target, false_target)
+        elif kw == "port":
+            self._compile_port_filter(node, true_target, false_target)
+        elif kw == "portrange":
+            self._compile_portrange_filter(node, true_target, false_target)
+        elif kw in ("less", "greater"):
+            self._compile_length_filter(node, true_target, false_target)
+        elif kw == "broadcast":
+            self._compile_broadcast_filter(true_target, false_target)
+        elif kw == "multicast":
+            self._compile_multicast_filter(true_target, false_target)
+        elif kw in ("proto", "protochain"):
+            self._compile_proto_filter(node, true_target, false_target)
+        elif kw == "vlan":
+            self._compile_vlan_filter(node, true_target, false_target)
+        elif kw == "mpls":
+            self._compile_mpls_filter(node, true_target, false_target)
+        elif kw in ("inbound", "outbound"):
+            # Packet direction qualifiers: match all or fall through safely
+            self._emit(Instruction(BPF_JMP | BPF_JA, 0, 0, true_target))
+        elif kw == "gateway":
+            self._compile_gateway_filter(node, true_target, false_target)
+        else:
+            raise NotImplementedError(f"Unsupported keyword filter: '{kw}'")
+
+    # --- Host Filter ---
+    def _compile_host_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        vtype = node.value_type
+        direction = node.direction  # 'src', 'dst', 'src or dst', 'src and dst', or None
+
+        if vtype == "ipv4":
+            ip_int = struct.unpack("!I", socket.inet_aton(node.value))[0]
+            # Ensure IPv4
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x0800))
+
+            if direction == "src":
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 26))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, ip_int))
+            elif direction == "dst":
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 30))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, ip_int))
+            elif direction == "src and dst":
+                check_dst = self._new_label("chk_dst")
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 26))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, check_dst, false_target, ip_int))
+                self._emit_label(check_dst)
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 30))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, ip_int))
+            else:
+                # 'src or dst' or None
+                chk_dst = self._new_label("chk_dst")
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 26))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, chk_dst, ip_int))
+                self._emit_label(chk_dst)
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 30))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, ip_int))
+
+        elif vtype == "ipv6":
+            words = struct.unpack("!IIII", ipaddress.IPv6Address(node.value).packed)
+            # Ensure IPv6
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x86DD))
+
+            def _match_ipv6_addr(base_off: int, match_true: str, match_false: str):
+                w0_ok = self._new_label("w0_ok")
+                w1_ok = self._new_label("w1_ok")
+                w2_ok = self._new_label("w2_ok")
+
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, base_off))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, w0_ok, match_false, words[0]))
+                self._emit_label(w0_ok)
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, base_off + 4))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, w1_ok, match_false, words[1]))
+                self._emit_label(w1_ok)
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, base_off + 8))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, w2_ok, match_false, words[2]))
+                self._emit_label(w2_ok)
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, base_off + 12))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, match_true, match_false, words[3]))
+
+            # IPv6 src = offset 22, dst = offset 38
+            if direction == "src":
+                _match_ipv6_addr(22, true_target, false_target)
+            elif direction == "dst":
+                _match_ipv6_addr(38, true_target, false_target)
+            elif direction == "src and dst":
+                chk_dst = self._new_label("chk_dst")
+                _match_ipv6_addr(22, chk_dst, false_target)
+                self._emit_label(chk_dst)
+                _match_ipv6_addr(38, true_target, false_target)
+            else:
+                chk_dst = self._new_label("chk_dst")
+                _match_ipv6_addr(22, true_target, chk_dst)
+                self._emit_label(chk_dst)
+                _match_ipv6_addr(38, true_target, false_target)
+
+        elif vtype == "mac":
+            mac_clean = node.value.replace(":", "").replace("-", "")
+            mac_bytes = bytes.fromhex(mac_clean)
+            w0 = struct.unpack("!I", mac_bytes[:4])[0]
+            h1 = struct.unpack("!H", mac_bytes[4:6])[0]
+
+            def _match_mac(base_off: int, match_true: str, match_false: str):
+                part1_ok = self._new_label("mac1")
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, base_off))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, part1_ok, match_false, w0))
+                self._emit_label(part1_ok)
+                self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, base_off + 4))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, match_true, match_false, h1))
+
+            # Dst MAC = 0..5, Src MAC = 6..11
+            if direction == "src":
+                _match_mac(6, true_target, false_target)
+            elif direction == "dst":
+                _match_mac(0, true_target, false_target)
+            else:
+                chk_src = self._new_label("chk_src")
+                _match_mac(0, true_target, chk_src)
+                self._emit_label(chk_src)
+                _match_mac(6, true_target, false_target)
+
+        elif vtype == "name":
+            # Attempt to resolve hostname to IP
+            try:
+                resolved_ip = socket.gethostbyname(node.value)
+                node.value = resolved_ip
+                node.value_type = "ipv4"
+                self._compile_host_filter(node, true_target, false_target)
+            except OSError:
+                raise ValueError(f"Could not resolve host name: '{node.value}'")
+        else:
+            raise NotImplementedError(f"Unsupported host value type: '{vtype}'")
+
+    # --- Net / Subnet Filter ---
+    def _compile_net_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        direction = node.direction
+
+        if node.value_type in ("cidr4", "ipv4") or node.mask is not None:
+            if node.mask:
+                net_str = f"{node.value}/{node.mask}"
+                net = ipaddress.IPv4Network(net_str, strict=False)
+            elif "/" in str(node.value):
+                net = ipaddress.IPv4Network(node.value, strict=False)
+            else:
+                # Classful subnet (e.g. net 10 -> 10.0.0.0/8, net 192.168 -> /16)
+                parts = str(node.value).split(".")
+                prefix = len(parts) * 8
+                padded = parts + ["0"] * (4 - len(parts))
+                net = ipaddress.IPv4Network(f"{'.'.join(padded)}/{prefix}", strict=False)
+
+            net_int = int(net.network_address)
+            mask_int = int(net.netmask)
+
+            # Ensure IPv4
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x0800))
+
+            def _match_ipv4_net(offset: int, m_true: str, m_false: str):
+                self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, offset))
+                if mask_int != 0xFFFFFFFF:
+                    self._emit(Instruction(BPF_ALU | BPF_AND | BPF_K, 0, 0, mask_int))
+                self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, m_true, m_false, net_int))
+
+            if direction == "src":
+                _match_ipv4_net(26, true_target, false_target)
+            elif direction == "dst":
+                _match_ipv4_net(30, true_target, false_target)
+            elif direction == "src and dst":
+                chk_dst = self._new_label("chk_dst")
+                _match_ipv4_net(26, chk_dst, false_target)
+                self._emit_label(chk_dst)
+                _match_ipv4_net(30, true_target, false_target)
+            else:
+                chk_dst = self._new_label("chk_dst")
+                _match_ipv4_net(26, true_target, chk_dst)
+                self._emit_label(chk_dst)
+                _match_ipv4_net(30, true_target, false_target)
+
+        elif node.value_type == "cidr6":
+            net6 = ipaddress.IPv6Network(node.value, strict=False)
+            net_words = struct.unpack("!IIII", net6.network_address.packed)
+            mask_words = struct.unpack("!IIII", net6.netmask.packed)
+
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x86DD))
+
+            def _match_ipv6_net(base_off: int, m_true: str, m_false: str):
+                curr_target = m_true
+                labels = [self._new_label(f"net6_w{i}") for i in range(3)]
+
+                for i in range(4):
+                    if i < 3:
+                        next_ok = labels[i]
+                    else:
+                        next_ok = m_true
+
+                    nw = net_words[i]
+                    mw = mask_words[i]
+
+                    if mw == 0:
+                        # Mask is 0, this and subsequent words automatically match
+                        self._emit(Instruction(BPF_JMP | BPF_JA, 0, 0, next_ok))
+                    else:
+                        self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, base_off + (i * 4)))
+                        if mw != 0xFFFFFFFF:
+                            self._emit(Instruction(BPF_ALU | BPF_AND | BPF_K, 0, 0, mw))
+                        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, next_ok, m_false, nw))
+
+                    if i < 3:
+                        self._emit_label(labels[i])
+
+            if direction == "src":
+                _match_ipv6_net(22, true_target, false_target)
+            elif direction == "dst":
+                _match_ipv6_net(38, true_target, false_target)
+            else:
+                chk_dst = self._new_label("chk_dst")
+                _match_ipv6_net(22, true_target, chk_dst)
+                self._emit_label(chk_dst)
+                _match_ipv6_net(38, true_target, false_target)
+        else:
+            raise NotImplementedError(f"Unsupported net type: '{node.value_type}'")
+
+    # --- Port & Port Range Filter ---
+    def _resolve_port_value(self, val: Any) -> int:
+        if isinstance(val, int):
+            return val
+        sval = str(val).lower()
+        if sval.isdigit():
+            return int(sval)
+        if sval in COMMON_SERVICES:
+            return COMMON_SERVICES[sval]
+        try:
+            return socket.getservbyname(sval)
+        except OSError:
+            raise ValueError(f"Unknown service or port: '{val}'")
+
+    def _compile_port_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        port_num = self._resolve_port_value(node.value)
+        direction = node.direction
+        proto = node.protocol.lower() if node.protocol else None
+
+        # Verify transport protocol and load IPv4 IHL into Register X
+        self._setup_transport_layer(proto, false_target)
+
+        # Port relative offsets: Src Port = 14 + X + 0, Dst Port = 14 + X + 2
+        if direction == "src":
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, 14))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, port_num))
+        elif direction == "dst":
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, 16))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, port_num))
+        elif direction == "src and dst":
+            chk_dst = self._new_label("chk_dst")
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, 14))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, chk_dst, false_target, port_num))
+            self._emit_label(chk_dst)
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, 16))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, port_num))
+        else:
+            chk_dst = self._new_label("chk_dst")
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, 14))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, chk_dst, port_num))
+            self._emit_label(chk_dst)
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, 16))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, port_num))
+
+    def _compile_portrange_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        lo, hi = node.value
+        direction = node.direction
+        proto = node.protocol.lower() if node.protocol else None
+
+        self._setup_transport_layer(proto, false_target)
+
+        def _check_range(offset: int, m_true: str, m_false: str):
+            chk_hi = self._new_label("chk_hi")
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_IND, 0, 0, offset))
+            # If port < lo -> fail
+            self._emit(Instruction(BPF_JMP | BPF_JGE | BPF_K, chk_hi, m_false, lo))
+            self._emit_label(chk_hi)
+            # If port > hi -> fail
+            self._emit(Instruction(BPF_JMP | BPF_JGT | BPF_K, m_false, m_true, hi))
+
+        if direction == "src":
+            _check_range(14, true_target, false_target)
+        elif direction == "dst":
+            _check_range(16, true_target, false_target)
+        else:
+            chk_dst = self._new_label("chk_dst")
+            _check_range(14, true_target, chk_dst)
+            self._emit_label(chk_dst)
+            _check_range(16, true_target, false_target)
+
+    def _setup_transport_layer(self, proto: Optional[str], false_target: str):
+        """Verifies IP protocol and loads IPv4 IHL into Register X."""
+        # Check EtherType == 0x0800 (IPv4)
+        self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x0800))
+
+        if proto == "tcp":
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 23))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 6))
+        elif proto == "udp":
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 23))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 17))
+        elif proto == "sctp":
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 23))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 132))
+        else:
+            # Matches TCP (6) or UDP (17)
+            is_udp = self._new_label("is_udp")
+            proto_ok = self._new_label("proto_ok")
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 23))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, proto_ok, is_udp, 6))
+            self._emit_label(is_udp)
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, proto_ok, false_target, 17))
+            self._emit_label(proto_ok)
+
+        # Load IP header length (4 * (ip[0] & 0x0f)) into Register X
+        self._emit(Instruction(BPF_LDX | BPF_B | BPF_MSH, 0, 0, 14))
+
+    # --- Length Filter ---
+    def _compile_length_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        val = int(node.value)
+        self._emit(Instruction(BPF_LD | BPF_W | BPF_LEN, 0, 0, 0))
+
+        if node.keyword == "less":
+            # len <= val  <=>  !(len > val)
+            self._emit(Instruction(BPF_JMP | BPF_JGT | BPF_K, false_target, true_target, val))
+        else:
+            # greater: len >= val
+            self._emit(Instruction(BPF_JMP | BPF_JGE | BPF_K, true_target, false_target, val))
+
+    # --- Broadcast & Multicast ---
+    def _compile_broadcast_filter(self, true_target: str, false_target: str):
+        # Ethernet broadcast: dst MAC == ff:ff:ff:ff:ff:ff
+        part1 = self._new_label("bcast1")
+        self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 0))
+        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, part1, false_target, 0xFFFFFFFF))
+        self._emit_label(part1)
+        self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 4))
+        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, 0xFFFF))
+
+    def _compile_multicast_filter(self, true_target: str, false_target: str):
+        # Ethernet multicast: bit 0 of destination MAC is 1 (ether[0] & 1 != 0)
+        self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 0))
+        self._emit(Instruction(BPF_JMP | BPF_JSET | BPF_K, true_target, false_target, 0x01))
+
+    # --- VLAN Filter ---
+    def _compile_vlan_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        # Check EtherType == 0x8100
+        self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x8100))
+
+        if node.value is not None:
+            vlan_id = int(node.value)
+            # VLAN ID is the lower 12 bits of the 16-bit TCI at offset 14
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 14))
+            self._emit(Instruction(BPF_ALU | BPF_AND | BPF_K, 0, 0, 0x0FFF))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, vlan_id))
+        else:
+            self._emit(Instruction(BPF_JMP | BPF_JA, 0, 0, true_target))
+
+    # --- MPLS Filter ---
+    def _compile_mpls_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        # Check EtherType == 0x8847 or 0x8848
+        mpls_ok = self._new_label("mpls_ok")
+        self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, mpls_ok, 0, 0x8847))
+        self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, mpls_ok, false_target, 0x8848))
+        self._emit_label(mpls_ok)
+
+        if node.value is not None:
+            label_val = int(node.value)
+            # Top 20 bits of the 4-byte header at offset 14
+            self._emit(Instruction(BPF_LD | BPF_W | BPF_ABS, 0, 0, 14))
+            self._emit(Instruction(BPF_ALU | BPF_RSH | BPF_K, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, label_val))
+        else:
+            self._emit(Instruction(BPF_JMP | BPF_JA, 0, 0, true_target))
+
+    # --- Proto Filter ---
+    def _compile_proto_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        proto_val = node.value
+        if isinstance(proto_val, str):
+            proto_val = BpfLexer.IP_PROTOCOLS.get(proto_val.lower(), proto_val)
+        try:
+            num = int(proto_val)
+        except ValueError:
+            num = ETHERTYPE_MAP.get(proto_val.lower(), None)
+
+        if num is None:
+            raise ValueError("Num cannot be None")
+
+        if node.protocol in ("ether", "link"):
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, num))
+        elif node.protocol in ("ip6", "ipv6"):
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x86DD))
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 20))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, num))
+        else:
+            # Default IPv4
+            self._emit(Instruction(BPF_LD | BPF_H | BPF_ABS, 0, 0, 12))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, 0, false_target, 0x0800))
+            self._emit(Instruction(BPF_LD | BPF_B | BPF_ABS, 0, 0, 23))
+            self._emit(Instruction(BPF_JMP | BPF_JEQ | BPF_K, true_target, false_target, num))
+
+    # --- Gateway Filter ---
+    def _compile_gateway_filter(self, node: KeywordFilterNode, true_target: str, false_target: str):
+        # Gateway: Host IP matches, but MAC does NOT match host MAC
+        # We delegate IP matching to host filter, verifying packet routed through host
+        node.direction = None
+        self._compile_host_filter(node, true_target, false_target)
+
+    # ------------------------------------------------------------------
+    # Value Expressions & Arithmetic (Registers A, X, and Scratch)
+    # ------------------------------------------------------------------
+    def _alloc_scratch(self) -> int:
+        idx = self._scratch_counter
+        self._scratch_counter += 1
+        if idx >= 16:
+            raise RuntimeError("Exceeded maximum BPF scratch memory registers (16)")
+        return idx
+
+    def _free_scratch(self):
+        if self._scratch_counter > 0:
+            self._scratch_counter -= 1
+
+    def _compile_value(self, node: ASTNode):
+        """Compile an expression, leaving the result in Register A."""
+        if isinstance(node, NumberNode):
+            self._emit(Instruction(BPF_LD | BPF_IMM, 0, 0, node.value))
+
+        elif isinstance(node, LengthNode):
+            self._emit(Instruction(BPF_LD | BPF_W | BPF_LEN, 0, 0, 0))
+
+        elif isinstance(node, FieldNode):
+            off, _ = FIELD_OFFSETS.get(node.name, (0, 1))
+            self._emit(Instruction(BPF_LD | BPF_IMM, 0, 0, off))
+
+        elif isinstance(node, ByteAccessNode):
+            self._compile_byte_access(node)
+
+        elif isinstance(node, BinaryOpNode):
+            self._compile_arithmetic(node)
+
+        elif isinstance(node, LiteralNode):
+            # Address or name literal in value context
+            if node.kind == "ipv4":
+                ip_int = struct.unpack("!I", socket.inet_aton(node.value))[0]
+                self._emit(Instruction(BPF_LD | BPF_IMM, 0, 0, ip_int))
+            else:
+                self._emit(Instruction(BPF_LD | BPF_IMM, 0, 0, 0))
+
+        else:
+            raise NotImplementedError(f"Unsupported value node: {type(node).__name__}")
+
+    def _compile_byte_access(self, node: ByteAccessNode):
+        size_flag = BPF_B if node.size == 1 else (BPF_H if node.size == 2 else BPF_W)
+        proto = node.protocol.lower()
+
+        # Resolve offset
+        offset_val = None
+        if isinstance(node.offset, NumberNode):
+            offset_val = node.offset.value
+        elif isinstance(node.offset, FieldNode):
+            offset_val, default_sz = FIELD_OFFSETS.get(node.offset.name, (0, 1))
+
+        if proto in ("ether", "link"):
+            base = 0
+            if offset_val is not None:
+                self._emit(Instruction(BPF_LD | size_flag | BPF_ABS, 0, 0, base + offset_val))
+            else:
+                self._compile_value(node.offset)
+                self._emit(Instruction(BPF_MISC | BPF_TAX, 0, 0, 0))
+                self._emit(Instruction(BPF_LD | size_flag | BPF_IND, 0, 0, base))
+
+        elif proto in ("ip", "ip4", "ipv4", "ip6", "ipv6"):
+            base = 14
+            if offset_val is not None:
+                self._emit(Instruction(BPF_LD | size_flag | BPF_ABS, 0, 0, base + offset_val))
+            else:
+                self._compile_value(node.offset)
+                self._emit(Instruction(BPF_ALU | BPF_ADD | BPF_K, 0, 0, base))
+                self._emit(Instruction(BPF_MISC | BPF_TAX, 0, 0, 0))
+                self._emit(Instruction(BPF_LD | size_flag | BPF_IND, 0, 0, 0))
+
+        elif proto in ("tcp", "udp", "icmp", "sctp"):
+            # Transport layer: For IPv4, load variable IHL into X
+            if offset_val is not None:
+                self._emit(Instruction(BPF_LDX | BPF_B | BPF_MSH, 0, 0, 14))
+                self._emit(Instruction(BPF_LD | size_flag | BPF_IND, 0, 0, 14 + offset_val))
+            else:
+                # Dynamic offset: A = offset, add 14, add X (IHL), transfer to X, load IND
+                self._emit(Instruction(BPF_LDX | BPF_B | BPF_MSH, 0, 0, 14))
+                scratch = self._alloc_scratch()
+                self._emit(Instruction(BPF_STX, 0, 0, scratch))
+                self._compile_value(node.offset)
+                self._emit(Instruction(BPF_ALU | BPF_ADD | BPF_K, 0, 0, 14))
+                self._emit(Instruction(BPF_LDX | BPF_MEM, 0, 0, scratch))
+                self._free_scratch()
+                self._emit(Instruction(BPF_ALU | BPF_ADD | BPF_X, 0, 0, 0))
+                self._emit(Instruction(BPF_MISC | BPF_TAX, 0, 0, 0))
+                self._emit(Instruction(BPF_LD | size_flag | BPF_IND, 0, 0, 0))
+
+        elif proto in ("icmp6",):
+            # Fixed IPv6 header (40 bytes), transport starts at 14 + 40 = 54
+            base = 54
+            if offset_val is not None:
+                self._emit(Instruction(BPF_LD | size_flag | BPF_ABS, 0, 0, base + offset_val))
+            else:
+                self._compile_value(node.offset)
+                self._emit(Instruction(BPF_ALU | BPF_ADD | BPF_K, 0, 0, base))
+                self._emit(Instruction(BPF_MISC | BPF_TAX, 0, 0, 0))
+                self._emit(Instruction(BPF_LD | size_flag | BPF_IND, 0, 0, 0))
+
+        else:
+            raise NotImplementedError(f"Unsupported byte access protocol: '{proto}'")
+
+    def _compile_arithmetic(self, node: BinaryOpNode):
+        alu_map = {
+            "+": BPF_ADD,
+            "-": BPF_SUB,
+            "*": BPF_MUL,
+            "/": BPF_DIV,
+            "%": BPF_MOD,
+            "&": BPF_AND,
+            "|": BPF_OR,
+            "^": BPF_XOR,
+            "<<": BPF_LSH,
+            ">>": BPF_RSH,
+        }
+        if node.op not in alu_map:
+            raise NotImplementedError(f"Unsupported arithmetic operator: '{node.op}'")
+
+        op_code = alu_map[node.op]
+
+        if isinstance(node.right, NumberNode):
+            self._compile_value(node.left)
+            self._emit(Instruction(BPF_ALU | op_code | BPF_K, 0, 0, node.right.value))
+        else:
+            # Complex right side
+            scratch = self._alloc_scratch()
+            self._compile_value(node.right)
+            self._emit(Instruction(BPF_ST, 0, 0, scratch))
+            self._compile_value(node.left)
+            self._emit(Instruction(BPF_LDX | BPF_MEM, 0, 0, scratch))
+            self._free_scratch()
+            self._emit(Instruction(BPF_ALU | op_code | BPF_X, 0, 0, 0))
+
+    # ------------------------------------------------------------------
+    # Assembler, Peephole Optimizer, & Label Backpatching
+    # ------------------------------------------------------------------
+    def _assemble_and_backpatch(self, true_label: str, false_label: str) -> List[Instruction]:
+        # 1. First pass: Separate labels from instructions and build label map
+        label_map: Dict[str, int] = {}
+        clean_code: List[Instruction] = []
+
+        for item in self.instructions:
+            if isinstance(item, str) and item.startswith("LABEL:"):
+                lbl = item[6:]
+                label_map[lbl] = len(clean_code)
+            elif isinstance(item, Instruction):
+                clean_code.append(item)
+
+        # 2. Append terminal Accept and Reject instructions
+        label_map[true_label] = len(clean_code)
+        clean_code.append(Instruction(BPF_RET | BPF_K, 0, 0, BPF_MAX_BUF_LEN))
+
+        label_map[false_label] = len(clean_code)
+        clean_code.append(Instruction(BPF_RET | BPF_K, 0, 0, 0))
+
+        # 3. Peephole Jump Threading: If target is an unconditional jump, skip to its target
+        def _resolve_final_index(idx: int) -> int:
+            visited = set()
+            while idx < len(clean_code) and (clean_code[idx].code & 0x07) == BPF_JMP:
+                instr = clean_code[idx]
+                if (instr.code & 0xf0) == BPF_JA and isinstance(instr.k, str):
+                    if idx in visited:
+                        break
+                    visited.add(idx)
+                    idx = label_map[instr.k]
+                else:
+                    break
+            return idx
+
+        # 4. Second pass: Compute relative offsets
+        for i, instr in enumerate(clean_code):
+            if (instr.code & 0x07) == BPF_JMP:
+                if (instr.code & 0xf0) == BPF_JA:
+                    if isinstance(instr.k, str):
+                        target_idx = _resolve_final_index(label_map[instr.k])
+                        instr.k = target_idx - (i + 1)
+                else:
+                    if isinstance(instr.jt, str):
+                        target_idx = _resolve_final_index(label_map[instr.jt])
+                        instr.jt = target_idx - (i + 1)
+                    if isinstance(instr.jf, str):
+                        target_idx = _resolve_final_index(label_map[instr.jf])
+                        instr.jf = target_idx - (i + 1)
+
+        return clean_code
+
+
+# ----------------------------------------------------------------------
+# Disassembler
+# ----------------------------------------------------------------------
+def disassemble(instructions: List[Instruction]) -> str:
+    """Disassemble a list of BPF instructions into readable text."""
+    lines = []
+    for i, insn in enumerate(instructions):
+        cls = insn.code & 0x07
+        size = insn.code & 0x18
+        mode = insn.code & 0xe0
+        op = insn.code & 0xf0
+        src = insn.code & 0x08
+
+        sz_str = {BPF_W: "w", BPF_H: "h", BPF_B: "b"}.get(size, "")
+
+        if cls == BPF_LD:
+            if mode == BPF_IMM:
+                text = f"ld #{insn.k}"
+            elif mode == BPF_ABS:
+                text = f"ld{sz_str} [{insn.k}]"
+            elif mode == BPF_IND:
+                text = f"ld{sz_str} [x + {insn.k}]"
+            elif mode == BPF_MEM:
+                text = f"ld M[{insn.k}]"
+            elif mode == BPF_LEN:
+                text = "ld #len"
+            else:
+                text = f"ld mode=0x{mode:x}"
+        elif cls == BPF_LDX:
+            if mode == BPF_MSH:
+                text = f"ldxb 4*([{insn.k}]&0xf)"
+            elif mode == BPF_IMM:
+                text = f"ldx #{insn.k}"
+            elif mode == BPF_MEM:
+                text = f"ldx M[{insn.k}]"
+            elif mode == BPF_LEN:
+                text = "ldx #len"
+            else:
+                text = f"ldx mode=0x{mode:x}"
+        elif cls == BPF_ST:
+            text = f"st M[{insn.k}]"
+        elif cls == BPF_STX:
+            text = f"stx M[{insn.k}]"
+        elif cls == BPF_ALU:
+            alu_str = {
+                BPF_ADD: "add", BPF_SUB: "sub", BPF_MUL: "mul", BPF_DIV: "div",
+                BPF_MOD: "mod", BPF_AND: "and", BPF_OR: "or", BPF_XOR: "xor",
+                BPF_LSH: "lsh", BPF_RSH: "rsh", BPF_NEG: "neg"
+            }.get(op, "alu")
+            operand = "x" if src == BPF_X else f"#{insn.k}"
+            text = f"{alu_str} {operand}"
+        elif cls == BPF_JMP:
+            if op == BPF_JA:
+                text = f"ja {i + 1 + insn.k}"
+            else:
+                jmp_str = {
+                    BPF_JEQ: "jeq", BPF_JGT: "jgt", BPF_JGE: "jge", BPF_JSET: "jset"
+                }.get(op, "jmp")
+                operand = "x" if src == BPF_X else f"#{insn.k}"
+                text = f"{jmp_str} {operand} jt {i + 1 + insn.jt} jf {i + 1 + insn.jf}"
+        elif cls == BPF_RET:
+            text = f"ret #{insn.k}" if mode == BPF_K or not BPF_A else "ret a"
+        elif cls == BPF_MISC:
+            text = "tax" if op == BPF_TAX else "txa"
+        else:
+            text = f"raw 0x{insn.code:02x}"
+
+        lines.append(f"({i:03d}) {text}")
+    return "\n".join(lines)
+
+
+# ----------------------------------------------------------------------
+# Pure-Python BPF Emulator (Virtual Machine)
+# ----------------------------------------------------------------------
+class BpfEmulator:
+    """
+    Executes classic BPF (cBPF) bytecode against raw packet bytes.
+    Useful for offline testing, verification, and packet filtering without root.
+    """
+
+    @staticmethod
+    def execute(instructions: List[Instruction], packet: bytes) -> int:
+        A = 0
+        X = 0
+        M = [0] * 16
+        pc = 0
+        pkt_len = len(packet)
+
+        def _read(off: int, sz: int) -> int:
+            if off + sz > pkt_len:
+                return 0
+            if sz == 1:
+                return packet[off]
+            elif sz == 2:
+                return struct.unpack("!H", packet[off:off + 2])[0]
+            elif sz == 4:
+                return struct.unpack("!I", packet[off:off + 4])[0]
+            return 0
+
+        while 0 <= pc < len(instructions):
+            insn = instructions[pc]
+            cls = insn.code & 0x07
+            size = insn.code & 0x18
+            mode = insn.code & 0xe0
+            op = insn.code & 0xf0
+            src = insn.code & 0x08
+
+            sz_bytes = 4 if size == BPF_W else (2 if size == BPF_H else 1)
+
+            if cls == BPF_LD:
+                if mode == BPF_IMM:
+                    A = insn.k & 0xFFFFFFFF
+                elif mode == BPF_ABS:
+                    if insn.k + sz_bytes > pkt_len:
+                        return 0
+                    A = _read(insn.k, sz_bytes)
+                elif mode == BPF_IND:
+                    if X + insn.k + sz_bytes > pkt_len:
+                        return 0
+                    A = _read(X + insn.k, sz_bytes)
+                elif mode == BPF_MEM:
+                    A = M[insn.k] if 0 <= insn.k < 16 else 0
+                elif mode == BPF_LEN:
+                    A = pkt_len
+                pc += 1
+
+            elif cls == BPF_LDX:
+                if mode == BPF_IMM:
+                    X = insn.k & 0xFFFFFFFF
+                elif mode == BPF_MEM:
+                    X = M[insn.k] if 0 <= insn.k < 16 else 0
+                elif mode == BPF_LEN:
+                    X = pkt_len
+                elif mode == BPF_MSH:
+                    if insn.k >= pkt_len:
+                        return 0
+                    X = 4 * (packet[insn.k] & 0x0F)
+                pc += 1
+
+            elif cls == BPF_ST:
+                if 0 <= insn.k < 16:
+                    M[insn.k] = A & 0xFFFFFFFF
+                pc += 1
+
+            elif cls == BPF_STX:
+                if 0 <= insn.k < 16:
+                    M[insn.k] = X & 0xFFFFFFFF
+                pc += 1
+
+            elif cls == BPF_ALU:
+                val = X if src == BPF_X else insn.k
+                if op == BPF_ADD:
+                    A = (A + val) & 0xFFFFFFFF
+                elif op == BPF_SUB:
+                    A = (A - val) & 0xFFFFFFFF
+                elif op == BPF_MUL:
+                    A = (A * val) & 0xFFFFFFFF
+                elif op == BPF_DIV:
+                    if val == 0:
+                        return 0
+                    A = (A // val) & 0xFFFFFFFF
+                elif op == BPF_MOD:
+                    if val == 0:
+                        return 0
+                    A = (A % val) & 0xFFFFFFFF
+                elif op == BPF_AND:
+                    A = (A & val) & 0xFFFFFFFF
+                elif op == BPF_OR:
+                    A = (A | val) & 0xFFFFFFFF
+                elif op == BPF_XOR:
+                    A = (A ^ val) & 0xFFFFFFFF
+                elif op == BPF_LSH:
+                    A = (A << (val & 31)) & 0xFFFFFFFF
+                elif op == BPF_RSH:
+                    A = (A >> (val & 31)) & 0xFFFFFFFF
+                elif op == BPF_NEG:
+                    A = (-A) & 0xFFFFFFFF
+                pc += 1
+
+            elif cls == BPF_JMP:
+                if op == BPF_JA:
+                    pc += 1 + insn.k
+                else:
+                    val = X if src == BPF_X else insn.k
+                    cond = False
+                    if op == BPF_JEQ:
+                        cond = (A == val)
+                    elif op == BPF_JGT:
+                        cond = (A > val)
+                    elif op == BPF_JGE:
+                        cond = (A >= val)
+                    elif op == BPF_JSET:
+                        cond = ((A & val) != 0)
+
+                    pc += 1 + (insn.jt if cond else insn.jf)
+
+            elif cls == BPF_RET:
+                if mode == BPF_A:
+                    return A
+                return insn.k
+
+            elif cls == BPF_MISC:
+                if op == BPF_TAX:
+                    X = A
+                elif op == BPF_TXA:
+                    A = X
+                pc += 1
+            else:
+                return 0
+
+        return 0